Multi-language i18n (10 locales pre-wired)
EN, VN, ES, FR, JA, KO, ZH, AR (with RTL), ID, TH ship as working locales. Type-safe translation keys, browser-locale + timezone auto-detect, hreflang alternates, multi-locale sitemap, language switcher. Drop a new locale file in `src/locales/` and the build picks it up — no config change needed.
45 themed UI primitives + showcase catalog
Every shadcn / Base UI primitive a SaaS needs — DataTable (TanStack v8), recharts, cmdk command palette, vaul drawer, resizable panels, combobox, sortable, hover-card, context-menu, tabs, dialog. A live `/components` catalog renders each primitive with copy-paste code so you never wire one from scratch.
Live Theme Studio — 12 presets, fonts, RTL/LTR
`/settings/theme` page with 12 WCAG-AA color presets, light / dark / system, soft / default / bold contrast, font-size slider, layout + stretch, RTL/LTR. Settings persist to localStorage via CSS variables — instant preview, no rebuild.
Supabase Auth + NextAuth alternative stack
Default: Supabase Auth (email/password + OAuth + OTP + recovery). Flip `AUTH_PROVIDER=nextauth` and `DB_PROVIDER=neon` for an Auth.js v5 + Neon Postgres alt stack — same `requireUser` / `requireAdmin` API surface, same admin panel, no code changes. UX shells for social-only, multi-step register, 2FA, magic-link, SSO.
Stripe billing — multi-currency subscriptions
Free / Pro / Business tiers with webhook-verified upgrades, customer portal, dunning, idempotent `StripeEvent` table, and a `profiles_update_self_safe_columns` RLS policy that blocks user-side billing tampering. Multi-currency (USD / EUR / GBP / VND) — visitor locale picks the price.
Full admin panel + audit log
Dashboard (4 KPI cards + signups timeseries + plan-mix donut), Users (list + detail + 5 lifecycle actions), Subscribers (list + CSV export), Messages (mark all read + reply via Resend), Audit log (filterable + paginated), Site Settings (runtime feature flags), Posts CRUD, Email gallery (preview + send test), Feature-flag editor, Docs viewer.
Public blog + full-text search + image uploads
Posts CRUD with `tsvector` full-text search via `websearch_to_tsquery`, `ts_headline` snippets with `<mark>`-wrapped matches, drag-and-drop cover image uploads to Supabase Storage with folder-prefix RLS, public `/blog` + `/blog/[slug]`, JSON-LD Article + breadcrumb.
Multi-tenancy — Organizations + Memberships
`Organization` + `Membership` Prisma models with RLS via `is_org_member()` / `is_org_admin()` SECURITY DEFINER helpers. `/app/organizations` lets users list + create orgs (creator becomes owner via atomic transaction). Owner-only delete, admin-only update, member-only read enforced server-side.
Public API + per-user API keys
`ApiKey` table stores prefix + sha256(plaintext); plaintext shown once at creation. `requireUser()` accepts `sk_live_…` / `sk_test_…` bearer tokens. `/api/v1/me` worked example. `/app/settings#api-keys` UI for create + revoke. RLS owner-scoped.
AI chat widget (streaming SSE)
`/api/ai/chat` Server-Sent Events endpoint proxies to OpenAI when `OPENAI_API_KEY` is set; otherwise streams a deterministic stub so the demo works without a key. Floating widget in the bottom-right, rate-limited 30 msg/IP/min.
Growth toolkit — analytics, affiliate, lead magnet
One `track(event)` fans out to GA4 / Plausible / PostHog. UTM + affiliate ref capture (60-day cookie, sanitised, forwarded to Stripe metadata). Crisp live-chat. Social-proof toaster. Lead-magnet modal with cookie-gated dismiss. Each gated by a `FEATURES.*` flag.
GDPR + observability — cookie consent, Sentry, cron
GDPR cookie consent banner gates analytics + live chat until accepted. Sentry CDN loader. Cron pattern (`/api/cron/trial-expiry` + `requireCronSecret`) scheduled via `vercel.json`. RLS verifier (`bun run verify:rls`) asserts every table's policies match expectations — drift fails CI.