Home › SaaS Starter Kit
SaaS Starter Kit
A minimal, tested Next.js 16 SaaS starter with auth, a database interface, a Lemon Squeezy webhook and a landing page. Lint, typecheck, tests and build all pass.
$49 one-time · v1.1.0 · zip, 259 KB
Buy SaaS Starter Kit: $49Secure checkout by Lemon Squeezy (merchant of record). One-time payment, instant download.
Or get it in the Complete Vibe Coding Toolkit (all four kits for $99).
What's inside
- Next.js 16 App Router: landing, pricing, signup/login, protected dashboard and a health route.
- Auth with scrypt password hashing and HMAC-signed httpOnly session cookies, with Zod-validated forms.
- A database interface with an in-memory adapter. The /connect-database skill swaps in your real DB.
- A Lemon Squeezy webhook with HMAC-SHA256 signature verification and idempotency. 15 tests, a clean
next buildand security headers. - SaaS-architecture rules, plus /add-feature-route, /connect-database and /connect-payments skills.
- Local rules next to the risky code (
lib/auth/AGENTS.md,lib/payments/AGENTS.md), plus the agent-safe definition of done and Next.js 16 version-pinning rules.
Contains a ready-to-run starter project with every tool's rule files already installed.
Rules (11)
| Rule | When it applies |
|---|---|
agent-workflow | How the AI agent plans, executes and verifies work in this repository |
core | Always-on engineering rules for any language or stack in this repository |
definition-of-done | What "done" means; forbids weakening tests, assertions or acceptance criteria to make work pass |
git-workflow | Branching, commit message and safety rules for git operations |
local-rules | Read and obey module-level AGENTS.md files (auth, billing, migrations) before editing files in those directories |
react-next | React 19 and Next.js App Router conventions for components, routes and server actions |
saas-architecture | Structure and invariants of this Next.js SaaS starter (auth, db, payments, env) and how to extend them |
security | Secrets handling, input validation, authentication/authorization and dependency hygiene rules |
testing | How to write and run tests (Vitest/Jest for TS, pytest for Python) |
typescript | Strict TypeScript conventions for .ts/.tsx files |
version-pinning | Detect exact framework and library versions from manifests and lockfiles before writing code, and use that version's APIs |
Skills and slash commands (10)
| Command | What it does |
|---|---|
/add-feature-route | Add a new protected page, server action or API route to the SaaS starter with auth, ownership checks, zod validation and tests. Use when building a new product feature screen or endpoint. |
/commit-work | Run all checks, then stage and create a Conventional Commits commit for the current work. Only when the user explicitly asks to commit. |
/connect-database | Replace the in-memory Db adapter with a real database (e.g. Postgres with Drizzle or Prisma) behind the existing Db interface. Use when the user wants persistent storage. |
/connect-payments | Wire up Lemon Squeezy checkout and webhooks for the SaaS starter (env vars, checkout link, webhook URL, event mapping, testing). Use when the user is ready to take payments. |
/fix-bug | Diagnose and fix one bug with a regression test, smallest possible change. Use when the user reports a bug, error message, failing test or unexpected behaviour. |
/plan-feature | Plan a single feature before writing code. Writes or updates PLAN.md with goal, files, small steps and done-criteria. Use when starting a new feature or when the user asks for a plan. |
/record-decisions | End-of-session step that appends the decisions made in this session (what, why, alternatives rejected) to the Decisions log in AGENTS.md. Use when the user wraps up a session or asks to record decisions. |
/review-changes | Review the current uncommitted diff or branch for bugs, security issues, missing tests and rule violations before committing. Use when asked to review, check or audit changes. |
/security-audit | Audit the codebase or a diff for secrets, missing input validation, missing authorization, injection, unsafe dependencies and insecure config. Use when asked for a security review or before a release. |
/write-tests | Write focused, deterministic tests for a given module or behaviour following the project's test framework. Use when asked to add tests or increase coverage for specific code. |
Every tool, native format
- Cursor:
.cursor/rules/*.mdcwith description/globs/alwaysApply frontmatter. Workflows ship as manual @rules. - Claude Code: a thin
CLAUDE.mdthat imports the sharedAGENTS.mdwith@AGENTS.md, plus.claude/skills/*/SKILL.mdslash commands. - Codex:
AGENTS.md(well under the 32 KiB default cap) with a Decisions log, and.agents/skills. - Windsurf:
.windsurf/ruleswith trigger frontmatter (each file under 12,000 characters) and.windsurf/workflows. - GitHub Copilot:
.github/copilot-instructions.md,.github/instructions/*.instructions.mdwith applyTo, and.github/prompts/*.prompt.md.
Every file is generated from one master source and checked by a format validator, so the five versions never drift apart. In your repo, AGENTS.md is the one file to edit: Codex, Cursor, Windsurf and Copilot read it, and Claude Code imports it. Why one source of truth.
Install
Unzip, then copy your tool's folder to the project root. See the docs for your tool.