> SaaS boilerplate and starter kit for the agent era. Production TypeScript with rules your agent follows: agent context, agent tooling, and golden paths. [failure modes 01](#failure-modes) [agent native 02](#agent-native) [what is inside 03](#features) [the stack 04](#stack) [deployment 05](#deployment) [pricing 06](#pricing) [faq 07](#faq) # The SaaS starter kit built for the agent era Engineered so you and your AI agents build the part that makes money, not the boilerplate under it. [Get lifetime access](#pricing) [See the demo](https://app.superslate.dev) -  -  -  -  -  -  guardrails your AI agents follow so their code fits the repository boundaries the app your customers log into it runs the minute you clone it sign-up, teams, payments, email working on day one, not stubbed your product the only part left to build one repo with the boring parts already finished so you start on what makes your product different What actually goes wrong. ## Agents don't break your codebase in one commit. They break it gradually: reading context nobody maintained, inventing a route through the code, and passing every check on the way to a regression you find two weeks later. -  Someone wrote the context file months ago. Your agent is still working from it. -  There's no established route for how features get built, so every agent takes a different one. -  The run comes back green and the PR looks right, but a regression shows up two weeks later. Not an AI sticker on an old template. ## Your codebase is half the harness. You tuned the model, the prompts, the tools, and then dropped the agent into a repo it can't verify. Superslate is the other half: a map to read, boundaries to respect, and checks that prove every change. AGENTS.md · the root contract, verbatim > Preserve its current architecture unless reproducible evidence requires a change. Optimize for a buyer reaching a deployed, paid, maintainable product, not for framework novelty or feature count. > > Prefer the smallest reversible change that fixes the evidenced problem. Scoped per directory. Your agent reads the closest one before it edits. docs/golden-paths/ · maintained change recipes - add-domain-end-to-end.md - add-billing-gated-feature.md - add-authenticated-route.md - add-transactional-email.md - add-database-migration.md - diagnose-failed-webhook.md - deploy-fresh-application.md - remove-optional-subsystem.md Maintained routes through common changes and failures, not hidden rules. packages/agent-eval/ · measure it, don't vibe it > Run an agent against a task, then score the diff for boundary violations before it reaches review. Plus agent-navigation-contract.json: which rules apply to which change, deterministically. packages/agent-context/ · local and read-only > Six tools search version-matched docs and implementation, match navigation rules, load applicable invariants, and return the complete verification matrix without modifying source. Optional STDIO context for Codex, Claude Code, and Cursor. What you're not building. ## Skip to the part that's yours. Auth, billing, teams, uploads, email: the infrastructure every SaaS repeats is already here, wired end to end and tested against real Postgres. Your first commit is a feature, not a login form. ### authentication - Password and magic-link sign-in - Optional Google provider - Email verification required - Reset revokes every session [Better Auth](https://better-auth.com) ### billing - One contract, three providers - Signature-verified webhooks - Replays change nothing [Polar](https://polar.sh) · [Stripe](https://stripe.com) · [Dodo](https://dodopayments.com) ### organizations - Personal and team orgs - Invites, roles, transfers - Queries scoped by organization\_id personal + team ### api contracts - One schema, three consumers - Types inferred, not duplicated - Drift is a compile error [Zod](https://zod.dev) ### database - Raw SQL in repositories - Migrations up and down - CI proves every rollback [Postgres](https://www.postgresql.org) + [dbmate](https://github.com/amacneil/dbmate) ### email - Ten typed React templates - Local preview server - No key? Links go to the log [React Email](https://react.email) + [Resend](https://resend.com) ### uploads - Presigned direct uploads - Staging bucket, then promote - Checked by bytes, not extension [R2](https://developers.cloudflare.com/r2/) · [S3](https://aws.amazon.com/s3/) · [GCS](https://cloud.google.com/storage) ### ui kit - Tables, palette, pickers, toasts - Zag.js keyboard and ARIA - CSS Modules and tokens [](https://react.dev)45 components ### notifications - One typed notification enum - In-app inbox and email - Per-type user preferences inbox + email ### i18n - English, Spanish, German - TypeScript locale files - Missing key fails the build [i18next](https://www.i18next.com) · en · es · de ### search - Postgres full-text search - Trigram indexes, typos match - No search service to run [Postgres](https://www.postgresql.org) FTS ### error monitoring - First-party Sentry tunnel - Ad blockers cannot see it - Structured server logs [Sentry](https://sentry.io) + [pino](https://getpino.io) ### pwa - Installable, works offline - Real update prompt - Manifest and icons generated [vite-plugin-pwa](https://vite-pwa-org.netlify.app) ### tests - Vitest in every workspace - 15 integration files - Real Postgres, not mocks [Vitest](https://vitest.dev) · 97 files ### security - Secure headers and CORS allowlist - Body limits and timeouts - On every route on by default ### rate limiting - Per-route auth and app rules - Stored in Postgres - Nothing extra to deploy [Postgres](https://www.postgresql.org)\-backed ### docs - A shipped documentation app - Golden-path guides - llms.txt routes for agents [Fumadocs](https://www.fumadocs.dev) + [llms.txt](https://llmstxt.org) ### your turn - 17 subsystems you don't write - Wired together, not a pile of packages - One command scaffolds it as yours [See what it costs](#pricing) [See it running](https://app.superslate.dev) Why this stack. ## Opinionated, on purpose. The modern TypeScript stack for a SaaS, chosen once and wired end to end: fast to run, strict to type, and familiar to every coding model. Every option you don't have is a decision that can't be made wrong. frontend [React 19](https://react.dev) SPAover _server-rendered ambiguity_ Code runs in the browser, never "it depends", and React is the framework every coding model has read the most of. contracts [TypeScript](https://www.typescriptlang.org) + [Zod](https://zod.dev)over _types by convention_ One schema package carries full type safety end to end: the API validates it, the SPA infers it. Change a field and every consumer fails at compile time. api [Hono](https://hono.dev)over _framework magic_ Web-standard request handling: every route is a typed function you can read top to bottom. runtime [Bun](https://bun.sh)over _a five-tool Node pipeline_ One runtime for the API, scripts, tests, and the production binary. The whole test loop runs in milliseconds. database [Postgres](https://www.postgresql.org) + [dbmate](https://github.com/amacneil/dbmate)over _an ORM DSL_ Plain SQL you can read in full. Nothing translates between you and your data, so nothing hides. One decision, one maintained path. ## Choose your cloud during setup. Say yes in the CLI, choose a backend and static frontend, then commit the generated non-secret configuration. Say no and run `pnpm deploy:configure` when the product is ready. Once locked, unused provider roots and adapters are removed. deploy targets · generated during setup OpenTofu cloud native frontend external frontend API database IaC AWS S3 + CloudFront Vercel or Cloudflare ECS Fargate + ALB RDS PostgreSQL 18 OpenTofu GCP GCS + Cloud CDN Vercel or Cloudflare Cloud Run Cloud SQL PostgreSQL 18 OpenTofu Azure Static Web Apps Vercel or Cloudflare Container Apps Flexible Server PostgreSQL 18 OpenTofu **repository proof** bootstrap, cost-first, and HA plans **release gate** nine live custom-domain combinations pending The license. ## Pay once for lifetime access. Buy it once. Use it on every product you own. most popular ### Individual 50% off Made for solo founders and independent builders. Lifetime access: $99 Standard price $199 - One developer per license - Unlimited products you own - Commercial use included **Founding updates included** Updates to this Superslate edition are included while it remains maintained and distributed. The first **50 licenses** are this price, then **$149**. [Get Superslate for one developer](https://buy.polar.sh/polar_cl_9LFYnXcZW1gvE3waUvVBf45Yucwn39Wcf6dCb1uieav) ### Team 50% off Made for startups and fast-moving product teams. Lifetime access: $199 Standard price $399 - Every developer in one company - Unlimited company-owned products - No seat count or per-developer fees **Founding updates included** Updates to this Superslate edition are included while it remains maintained and distributed. [Get Superslate for your team](https://buy.polar.sh/polar_cl_0IrEuU4LhP01MRlIsU6REqcinmGp6L8YwGCH43sBQXj) Both licenses include the complete source, private GitHub access, and no runtime DRM. Client delivery and source redistribution are not included. [Read the license](https://superslate.dev/license/). Common questions. ## FAQ What exactly do I receive? The source repository on GitHub, a versioned archive with SHA-256 checksum, and a non-expiring license key, for entitlement and support, not runtime DRM. Can I try it before I buy? Yes. app.superslate.dev runs the same image the scaffold produces. Sign in with your email and explore the real thing: the user table, files, organizations and roles, settings, and the notification inbox. No card required. It is a read-only preview, so writes are disabled and nothing you do changes it for the next visitor. Visitor accounts stay out of the directory, so the accounts listed there are staged data, never other visitors. What does the license cover? The Individual license covers one developer. Team covers every developer in one company, for unlimited products that company owns. Neither tier permits client delivery or redistribution of the source. The published license and terms of service govern the purchase, including update eligibility and the fact that sales are final once source access is delivered. Why Bun and Hono instead of Next.js? One fast runtime for the API, scripts, and tests; a router on standard web APIs. Your product is a SaaS, not a content site, so an SPA plus a typed API keeps the boundaries clean. Which coding agents does it work with? Any of them. The contract is plain artifacts (markdown, JSON, runnable checks) read equally well by Claude Code, Cursor, Codex, or whatever ships next. Can I swap or remove parts of the stack? Yes. It's your source, and there's a golden path for it (remove-optional-subsystem.md). But the defaults are the maintained, tested route. How does cloud deployment setup work? The creator can configure deployment immediately or defer it. You choose AWS, GCP, or Azure; a native, Vercel, or Cloudflare static frontend; region; domains; and cost-first or HA. Superslate writes the non-secret config and operator checklist, then removes unused provider paths. Cloud credentials and secret values stay in your provider and protected GitHub environment. Do I have to use AI agents to benefit? No. Explicit boundaries, typed contracts, and maintained recipes make a good codebase for humans too. Agents are the multiplier, not the requirement. How is "agent-ready" more than marketing here? It ships as artifacts you can inspect: scoped AGENTS.md contracts, maintained golden paths, a deterministic navigation contract, an outcome eval harness, and an optional local read-only context server with six tools for documentation, implementation search, rules, invariants, and verification. What happens after I buy? Polar takes the payment. The purchase email carries source-access instructions, the checksummed release details, your license record, and a human recovery contact if automated delivery needs help. ## Ship this weekend. By Monday, people can sign in and pay. You spend the weekend on the product. [Get lifetime access](#pricing) [Read the docs](https://docs.superslate.dev/docs) Repository access lands the moment checkout completes.