What shipped

The first tagged release, and the first one to upgrade from. Start with Breaking in CHANGELOG.md.

• Upgrades follow release tags. UPGRADING.md starts you on the newest release and renames each one on a kit-renamed branch before main merges it, so a renamed fork conflicts only where you and the release changed the same lines. This release carries four migrations. Three need steps before you deploy (see Breaking), and bun run db:migrate applies whichever your database lacks.
• Licence 1.1. LICENSE.md names the two licences sold, Solo (one Invited Account) and Team (up to five, plus a 45-minute onboarding call). Purchases from 8 October 2026 get an Update Period of 12 months from the purchase; earlier ones keep the update terms they were sold with.
• SvelteKit 3. The web app runs on SvelteKit 3.0.1 and Svelte 5.57.2. $lib is now #lib, environment variables are declared in apps/web/src/env.ts, and an installed Node.js must be 22.17 or newer. UPGRADING.md lists the changes your own code needs.
• Documents, jobs and AI. Presigned uploads to local disk or S3/R2/MinIO, a Postgres job queue that runs inline or as a separate worker, an AI-credit ledger, and Documents and Jobs pages. The FastAPI service extracts text (with OCR), summarizes and embeds, locally or through any OpenAI-compatible endpoint. Workspaces get pgvector search and storage quotas.
• A home page. /app shows a getting-started checklist that hides once every step is done: verify the address and add a passkey or two-factor authentication. It also shows the organization’s member and AI-credit counters and its workspaces, and the checklist asks for a first workspace and an invited teammate too.
• Setup. bun run setup writes every local .env, bun run doctor checks prerequisites and configuration, bun run verify runs lint, typecheck and test in CI’s order, and bun run rename renames the kit to your product. QUICKSTART.md is the one setup guide; AGENTS.md gives coding agents the layout, the commands and the rules the code relies on. bun run seed loads demo data: an organization, a team, workspaces, documents and jobs.
• Operations. A provisioning script for a fresh VPS, GHCR images, SOPS-encrypted secrets, nightly backups with an off-box copy and a restore drill, and a runbook. Deploys are opt-in (set DEPLOY_ENABLED to true if you already deploy from Actions), wait for CI to pass, keep no deploy key or token on the server, and can be recovered after an interrupted rollout. Requests get structured logs and OpenTelemetry traces.
• Public demo mode. PUBLIC_DEMO_MODE adds a demo banner and a noindex tag, and infra/demo runs a demo next to production on the same host. Uploads, search, starting or retrying jobs and billing actions are refused, and “Enter the demo” builds each visitor a private sample organization, so nothing one visitor does reaches the next.
• Security. Forged requests are refused on /rpc and /api/v1, the app’s script-src has no 'unsafe-inline', request bodies are bounded at every layer, failed queries no longer log their parameters, and backups verify what they restore. An account can no longer get past plan limits by owning more organizations.
• Billing. Entitlement ends three days past the period end, or after the dunning window once a payment is past due; a daily job reconciles subscriptions with Stripe; a downgrade below current usage is refused; webhook deliveries are deduplicated; the pricing page’s plan reaches checkout.

The parts that turn a scaffold into a product.

• Billing. Stripe through the Better Auth plugin, with the organization as the customer. A browser-safe plan catalog renders the pricing page, the in-app billing page and drives the API’s limits. Checkout, customer portal, cancel and restore; per-seat plans follow the member count; trials, dunning emails and a payment-failed banner. Everything stays dormant until Stripe keys are set.
• Admin. Platform administrators (a role on the user, independent of organization roles) get user search, ban and unban, role changes, session revocation and one-hour impersonation; a tenant list with members, workspaces and subscription state; feature flags with a global default and per-organization overrides; and a system page with version, uptime, counts, database and migration state, and service health. The first admin is created from the command line.

• Component kit. shadcn-svelte components generated into the shared UI package, alongside the hand-written primitives. Design tokens as light-dark() pairs, so every surface follows the operating system without JavaScript; the app adds a Light/Dark/System toggle.
• Forms and data. sveltekit-superforms in SPA mode with Zod 4, validating the contract’s own schemas; TanStack Query with keys, fetchers and types derived from the contract.
• App shell. Skip link, responsive sidebar, command palette (Ctrl/⌘K), toasts, dialog confirmations, skeletons and empty states, error boundaries with a reference id, and an “Install app” button when the browser offers it.
• PWA. A service worker that precaches the build and serves a prerendered offline page, registered in production browsers only.
• Deployment switches. Sentry error tracking and PostHog analytics, both off until a key is set; PostHog loads only after the visitor accepts a consent banner.
• Accessibility. axe (WCAG 2.2 AA) runs on the public pages in the end-to-end suite; the authenticated pages passed the same checks in both color modes.

Accounts and tenancy, end to end.

• Email flows. Sign-up with email verification, password reset, change email confirmed from the old address, and account deletion confirmed by email. Emails print to the API console in development and go through Resend when a key is set.
• Social sign-in. GitHub and Google switch on when their credentials are present. The sign-in page asks the API which providers are live instead of keeping a second configuration.
• Two-factor and passkeys. TOTP with backup codes, and WebAuthn passkeys, managed from the security settings. Sessions can be listed and revoked.
• Rate limits. Better Auth’s own per-IP limits on the auth routes, plus a limiter on every procedure.
• Session guard. One universal load protects the app routes in server rendering and in the static SPA, so the same code redirects to sign-in on every target.
• Organizations. Create and switch organizations; members with owner, admin and member roles; email invitations that expire after seven days; teams that group members.
• Workspaces. The product container, scoped to an organization and optionally to a team, with unique slugs per organization and a reserved list for the app’s own routes.
• Access control. Roles and permissions are defined once and used by the auth server, the auth client (to hide what a role cannot do) and the API router (every workspace procedure refuses non-members).
• Plan limits and audit log. Workspace and seat limits enforced server-side and reported to the UI; an audit log records who did what per organization.

The scaffold: one Bun workspace, one HTTP API, every surface a thin client of it.

• Workspace and toolchain. Bun as runtime, package manager and test runner; Turborepo for build, check and test; Biome as the only linter and formatter; shared versions pinned once in the root catalog. Internal packages are consumed from source, with no build step.
• Shared packages. The oRPC + Zod API contract, the typed client, the Better Auth server instance and Svelte client, the Drizzle schema with the generated auth tables and the first migration, plan catalog, email provider abstraction, validated environment, and the shared UI package with the Tailwind tokens.
• API. Hono on Bun with Better Auth mounted at /api/auth/*, the oRPC router exposed as POST /rpc/* and as plain REST under /api/v1/*, and an OpenAPI 3.1 document at /api/v1/openapi.json.
• Application. SvelteKit 2 with Svelte 5, building for Node, Cloudflare Workers or as a static SPA from one ADAPTER variable; SSR and SPA share every route.
• Public sites. This Astro site and the Starlight documentation, both fully static.
• Native shell. A Tauri 2 project that wraps the static build with no IPC data layer. The shell talks to the API over HTTPS exactly like the browser.

• Compute service. An internal FastAPI service managed with uv, reachable only from the API with a service token.

• Infrastructure. Docker Compose for the whole stack (Postgres, API, web, AI service, Caddy), a Caddy configuration for public subdomains or a single origin, and a development compose file for Postgres.