Product

The SvelteKit + Postgres B2B starter — the boring 80% already wired.

Every B2B app ends up needing the same things, and every one of them is only obvious once a customer hits it. This kit is the version where that list was written down first, tested second, and shipped — on real Postgres with Drizzle ORM, and no provider lock-in.

Organizations, invitations, role-based access, seat-based billing behind a swappable adapter, and an append-only audit log — typed end to end, and scaled to any team size.

What's inside

  • Organizations & membership

    Create, join, leave; single-use invite links with expiry and atomic claim; ownership transfer.

  • Role-based access control

    Three built-in roles (owner > admin > member) with strict hierarchy — enforced server-side on every request, not just hidden in the UI.

  • Seat-based billing seam

    A BillingAdapter interface with seat limits enforced at join-time. Checkout runs through a merchant of record when live, so you never touch raw card data.

  • Append-only audit log

    Who did what, queryable, export-ready. No update or delete path exists.

  • Real Postgres, no provider lock-in

    Drizzle ORM + postgres.js over any Postgres — Neon, Railway, Supabase-direct, Fly.io, or self-hosted. Connection pooling config + PgBouncer/Supavisor guidance included.

  • Row-level security (opt-in)

    Defense-in-depth RLS policies with a per-request identity pattern — fail-closed at the database level once you adopt the GUC.

See it in action

Real UI from the live deployed demo — postgres-starter.verdantstack-site.pages.dev (seeded org, resets daily).

Live demo: organizations home after sign-in
Organizations home after sign-in — pick an org, manage members and seats.
RBAC denial: member view has no admin controls; a native POST attempting to promote the owner returns a real 403
RBAC denial — enforced server-side, real HTTP 403.
Live demo: append-only org audit log
Audit log — every event recorded, append-only, export-ready.

Built for AI coding agents

The kit ships AGENTS.md, a generated API reference andllms.txt, so Claude Code, Cursor and Copilot start with the file map and the public API already in context instead of inferring them.

They are included because they cost nothing to ship and make the kit more usable — not because they are unusual. The Svelte CLI'snpx sv add ai-tools already scaffolds a framework-levelAGENTS.md into any SvelteKit project; these are the product-specific files layered on top of that baseline.

  • AGENTS.md — architecture decisions, command shortcuts, and "things that will bite you" so an agent starts productive, not fumbling.
  • TypeDoc API reference — generated from the code, a machine-readable spec of every export that cannot silently rot.
  • A public docs portal + llms.txt — deep-dive guides and a site index an agent can retrieve, not just a human can read.
  • 454 automated tests — the trust layer. AI code without tests is a liability. AI code with 454 tests is a foundation.

Not a bolt-on: the full agent context lives in the repo from day one.Read the AGENTS.md.

The data layer

Unlike a single-file database that hits a ceiling at single-server scale, this starter uses the full Postgres ecosystem: connection pooling (postgres.js pool + PgBouncer/Supavisor guidance), row-level security as opt-in defense-in-depth, and documented add-yourself paths for read replicas,JSONB, and full-text search. The service layer is identical across VerdantStack kits — only the driver changes.

Tenancy is application-enforced by default; rls/0010_rls_policies.sql adds database-level fail-closed hardening once you adopt the per-request identity pattern.

Which database fits

All three kits ship the same tested multi-tenant core — orgs, invites, RBAC, seat billing, audit log. They differ only in the data layer. So the only real question is: which database do you already run, or plan to run? Pick by situation, not by feature list.

Do I need to scale past a single server / need Postgres features?

Postgres Starter (vendor-neutral)

Am I already invested in Supabase (auth, storage, realtime)?

Supabase Starter

Do I want a free, managed, edge-native database with zero ops?

Multi-tenant SvelteKit Starter (D1)

Your situationPickWhy
You will outgrow a single-file DB — pooling, replicas, JSONB, RLS, big dataSvelteKit + Postgres Starter(this one)Real Postgres, zero lock-in, Drizzle ORM, opt-in RLS. The vendor-neutral flagship.
You want managed Supabase Auth / realtime / storage APIs and RLS out of the boxSvelteKit + Supabase StarterThe same core layered onto Supabase — auth, database, realtime, RLS handled for you.
You want zero external services — everything on the Cloudflare edge, cost-freeMulti-tenant SvelteKit StarterSQLite/D1 via better-sqlite3 + Drizzle. The zero-ops serverless default.

Not sure? Read the documentation or the multi-tenant starter evaluation checklist. Every kit is a one-time license with lifetime updates and a 30-day refund.

How it compares

Who this is for

This page is written for one reader: someone who has already chosen SvelteKit, is building a B2B product that will hold more than one organisation, and has run out of patience for the tenancy layer.

  • Teams are on your roadmap, not in your codebase.The next milestone is orgs, workspaces or accounts — the point where "just add a tenant_id column" stops being true and every query starts being somebody's data leak.
  • A demo date is closer than the feature is.The work in this kit is the work you cannot show on Friday: an invite that expires before it is claimed, two members claiming the same invite, a join that lands after the seat limit is reached.
  • You have already decided on Postgres.If you want managed Auth on Supabase instead, that isthe other kit; if you want zero-ops SQLite on Cloudflare D1, that isthis one.
  • Your next customer has more than one team in it.When the first real account asks who changed what and when, the audit log and the server-side RBAC are the two answers you would otherwise be writing from scratch — under a deadline, in someone else's code.

What you're buying instead of building it

The honest version of "$79 or do it myself" is not a number of hours — you know your rate better than we do. It is the list of what you would otherwise have to write, and the list of what you would only notice was missing after a customer hit it.

  • 43 source files, 3,511 lines of application code
  • 27 test files — 454 of them, running against a real Postgres database
  • 6 tables of schema, plus the migration and the RLS policy file
  • One licence covering every project you build on it

The tests are the part that earns the money. They are the written record of the edge cases: an invite link that expired, two members claiming the same invite, a join arriving after the seat limit, a member's forged POST trying to promote themselves, an audit row with no edit path. None of that shows up in a screenshot, and all of it is what a paying account finds first.

If your own estimate for that list is a few weeks, then $79 is not really the decision — the weeks are. We don't publish an hour count, because we cannot measure yours, and a number we made up would only be an ad.

Who it's NOT for

  • You want managed Supabase Auth/realtime/storage — this kit is provider-neutral and owns auth itself.
  • You need enterprise SSO/SCIM on day one — this ships app-level tenancy, not identity-provider federation.
  • You want a huge component library — this is a foundation, not a UI kit.

Pricing, stated plainly

One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.

$79Early-bird pricing, currently active.

Building for a client or a team of three or more? TheTeam Licence is$249 — 3+ seats, still unlimited projects. Same updates, same support, no per-project fee.Ask about a team licence — invoiced individually, since checkout is per-kit.

  • Actively maintained — v0.1.16, released 2026-10-16, 16 dated releases, 83 logged changes. The full history is public.
  • Commercial license — use it in your business
  • Live interactive demo — try before you buy
  • 454 automated tests against a real Postgres database
  • Full documentation + API reference + AI-agent files
  • Lifetime updates included

Source delivered to buyers. The full kit code is delivered privately to you after purchase — it is not posted publicly. Explore the docs, feature list and proof freely; buy when you want the code.

Get the kit — $79

30-day full refund — no hassle, no questions. If it's not for you, get your money back.

Actively maintained — see the latest release.Read License Agreement

FAQ

Why Postgres instead of SQLite?

The same service layer runs on both. If you will outgrow a single-file database — connection pooling, read replicas, JSONB, full-text search, row-level security — start on Postgres. The kit gives you the real thing from day one.

Is this different from Supabase?

Yes. Supabase is a managed Postgres platform with its own Auth/RLS/Realtime/Storage. This kit is provider-neutral: bring any Postgres connection string and own the whole stack. Both are valid — it depends on whether you want the managed convenience or the lock-in-free control.

How many tests does it ship with?

454 automated tests run against a real Postgres test database (docker-compose provides one), covering auth, RBAC, invites, seat limits, audit, and HTTP-level flows.

What's the update policy?

One license, unlimited projects, commercial use permitted. Lifetime updates included. Stated plainly because pricing pages that hide this are worse than useless.

Is there a team license?

One license covers one developer. For a client or a team of three or more, the Team Licence is $249 — 3+ seats, still unlimited projects, same updates and support, invoiced individually.

Can't I build this myself or with an AI coding agent?

You can — and the kit includes AGENTS.md and TypeDoc so your agent starts productive. But the value is in the 454 tests, the edge cases (invite expiry, atomic claims, seat enforcement, audit tamper-proofing), and the plumbing that's invisible until an enterprise pilot asks for it in week one. You're buying a tested foundation, not a code generator. See our guides: Claude Code + VerdantStack, Cursor + VerdantStack.

Dive deeper

Get in touch

Questions about the product, team licenses, or anything else? We'll aim to respond within 48 hours.

Max 2000 characters

Stored in our own database — no third party. Deleted on request.