The brief
After building the same production-app skeleton several times — auth, database with row-level security, billing, deploy pipeline, verification gate — I froze it into a template: clone, fill an intake JSON, flip feature flags, verify, deploy.
How it was built
- RLS architecture baked in. Multi-tenant Postgres policies are the part most projects get wrong late; the template ships them wired from the first migration.
- Stripe webhook sync — subscription state flows from Stripe webhooks into the database, so the app never asks Stripe a question it can answer locally.
- Credential provisioning scripted. The setup scripts create and wire the Supabase project, secrets, and environment so a fresh clone reaches "running against real services" without manual dashboard work.
- An automated definition-of-done gate. Playwright end-to-end checks plus config verification must pass before the template calls a build shippable — the gate is part of the product.
Stack notes
npm-workspaces monorepo: Vite + React 19 + TypeScript strict + Tailwind v4 + shadcn/ui + vite-plugin-pwa, Supabase (Postgres, RLS, Edge Functions, Google SSO), Stripe. Deliberately frozen — it moves only when a real project proves an improvement.