Started from deessejs/saas-template (MIT, July 2026). This repo was cloned from it as the foundation for the deessejs main app and has since diverged. See DESIGN.md for the current state of the monorepo.
👉 Need workspaces / multi-tenant? See deessejs/saas-template-multi-tenant — same monorepo with the Better Auth Organization plugin wired in, for users who need per-tenant data isolation and invite-based memberships.
What's included
| Layer | What you get | Why it matters |
|---|
| Apps | apps/web (marketing), apps/app (authenticated product), apps/docs (Fumadocs) | Three deployable surfaces, each with its own purpose. |
| Auth | packages/auth (server-side Better Auth configuration and plugins), accessed by applications through configured auth clients and API endpoints | Production auth flows with email verification and password reset. |
| API | Hono and oRPC in packages/api | Type-safe RPC without GraphQL. |
| Database | Drizzle ORM, Postgres and pg-mem in packages/database | Single source of truth for schema; tests run without a DB. |
| UI | packages/ui ( shadcn/ui + Tailwind v4, centralized design tokens | One component library, every app reuses it. |
| Tooling | pnpm 11 workspaces, Turbo v2, strict catalogs, shared Oxlint + TS configs | One command rebuilds, lints, types, tests the whole monorepo. |
| Organizations | Better Auth organization plugin, organization/member/invitation schema and invitation delivery | Organization support is wired in; the member-management UI is not shipped yet. |
Why this stack
- Current stack. Next.js 16, Tailwind v4, React 19 and TypeScript 6. Shared dependency versions are recorded in
pnpm-workspace.yaml and pnpm-lock.yaml.
- Lockfile-clean pnpm catalogs. All shared versions live in
pnpm-workspace.yaml with catalogMode: strict. No drift between apps.
- Real auth flow. Email verification is enforced in the proxy. No "demo" auth.
- Real database. Postgres locally (Docker) or in the cloud. Schema is generated, not hand-written.
- Three apps, one repo. Marketing, product, docs. Each deployable independently to Vercel.
Quick start
[!TIP]
Don't want to install anything locally? Open in GitHub Codespaces. PostgreSQL is pre-configured in the dev container.
Prerequisites
- Node.js 22.0.0+ (
engines.node: ">=22.0.0" enforced)
- pnpm 11+ (
corepack enable if not installed)
- Docker (for local Postgres). Skip if you point
DATABASE_URL at a remote DB
Install and run
# 1. Clone
git clone https://github.com/deessejs/deessejs.git
cd deessejs
# 2. Install dependencies
pnpm install
# 3. Copy environment defaults
cp .env.example .env.local
# 4. Generate the auth schema and push it to your database
pnpm auth:generate
pnpm db:push
# 5. Start every app in dev mode
pnpm dev
Each app's default port is in its own README.md (under apps/*/). apps/app proxies trust localhost:3000 and localhost:3001 by default. See packages/auth/src/auth.ts:13.
Available commands
| Command | What it does |
|---|
pnpm dev | Start every app in dev mode |
pnpm build | Build every workspace |
pnpm lint | Lint every workspace |
pnpm typecheck | Type-check every workspace |
pnpm test | Run unit tests (pg-mem, no DB needed) |
pnpm db:generate | Diff schema → write SQL migration |
pnpm db:migrate | Apply pending migrations |
pnpm db:push | Sync schema directly (dev only. Never in prod) |
pnpm db:studio | Open Drizzle Studio in the browser |
pnpm auth:generate | Regenerate Better Auth schema in packages/database/src/schema/auth.ts |
pnpm env:check | Validate that all required env vars are present |
pnpm dedupe:check | Detect duplicated dependencies |
Environment variables
| Variable | Required | Where | Purpose |
|---|
BETTER_AUTH_URL | Yes | server | Public URL where auth runs |
BETTER_AUTH_SECRET | Yes | server | Min 32 chars. Generate: openssl rand -base64 32 |
DATABASE_URL | Yes | server | Postgres connection string |
ALLOWED_ORIGINS | No | server | CSV of trusted origins for CSRF |
MAIL_TRANSPORT | No | server | console (default) or resend |
RESEND_API_KEY | Prod only | server | Required when MAIL_TRANSPORT=resend |
RESEND_FROM_EMAIL | Prod only | server | Verified sender on Resend |
NEXT_PUBLIC_APP_NAME | No | client | Marketing site brand |
NEXT_PUBLIC_APP_URL | No | client | Public URL of apps/app |
Copy .env.example to .env.local to start; defaults work for local Docker Postgres.
Project structure
.
├── .oxlintrc.json # Oxlint rules
├── .oxfmtrc.json # Oxfmt style
├── apps/
│ ├── web/ # Next.js 16 (marketing site) (public, no auth)
│ ├── app/ # Next.js 16 (authenticated product) (proxy.ts guard)
│ └── docs/ # Next.js 16 (Fumadocs site)
├── packages/
│ ├── auth/ # Better Auth setup (single source of truth)
│ ├── database/ # Drizzle ORM + schema (CLI-generated for auth tables)
│ ├── api/ # Hono + oRPC router
│ ├── email/ # React Email templates (Console dev / Resend prod)
│ ├── ui/ # shadcn/ui + Tailwind v4 design system
│ ├── env/ # Zod-validated env (server + client)
│ ├── cookies/ # Cookie consent UI
│ ├── utils/ # General utilities
│ └── typescript-config/
├── pnpm-workspace.yaml # catalogs (strict)
├── turbo.json # pipelines
└── .env.example
Deployment
One-click
Click the Deploy with Vercel button at the top. The monorepo is detected automatically; you will need to create three Vercel projects (one per app) and configure env vars per project.
Per-app mapping
| App | Production URL |
|---|
apps/web | https://yourdomain.com |
apps/app | https://app.yourdomain.com |
apps/docs | https://docs.yourdomain.com |
Organizations
Organization support is enabled in packages/auth and persisted through the generated schema in packages/database. The current product includes organization creation and invitations. The member-management UI is not shipped yet. The target application boundary uses auth and API clients. apps/app/lib/admin-auth.ts and the device page still contain legacy direct auth calls, tracked as migration targets in WORKSPACES.md.
Architecture notes
- Proxy, not middleware. Next.js 16 renamed
middleware.ts to proxy.ts. The auth guard lives at apps/app/proxy.ts.
- Catalogs, not manual pins. All shared versions are centralized in
pnpm-workspace.yaml with catalogMode: strict.
- Schema ownership.
packages/database/src/schema/auth.ts is owned by the Better Auth CLI. Never hand-edit.
- Service clients define the application boundary.
packages/auth owns the server implementation; applications use their configured auth clients and the endpoints mounted by packages/api. App code never imports runtime auth or database APIs directly. Typed API clients and packages/contracts define the application-facing data boundary.
Contributing
Open an issue to discuss larger changes. For typos, broken links, and small fixes, PRs are welcome.
License
MIT. See the LICENSE file for details.
Support
