Features & Stack

Universal Payment Adapter

Vendor lock-in is dead. Switch providers with one env var — zero code changes.

Provider	Config	Best For	Tax Handling
Stripe	`stripe`	Global, full-featured	You handle
Polar	`polar`	Open-source, EU-friendly	Merchant of Record
Lemon Squeezy	`lemon-squeezy`	Simple global tax	Merchant of Record
Dodo	`dodo`	Emerging markets	Merchant of Record
Creem	`creem`	Global tax compliance	Merchant of Record

Average SaaS changes payment providers at least once in 3 years. Traditional migration = weeks. Vibe44:

PAYMENT_PROVIDER=polar  # Was "stripe". Done.

Built-in security:

✅ Webhook idempotency via webhook_logs (success skips, active processing skips, failed/stale processing retries)
✅ Provider-resource idempotency via unique (provider, provider_subscription_id) and (provider, provider_payment_id) indexes
✅ Decoupled Billing Architecture — TIER_IDS central registry eliminating hardcoded tiers
✅ Dynamic Usage Limits — Render tier constraints (projects, team members, API requests, storage) directly from central pricing configs
✅ Upgrade Guard Hardening — Intelligently hide "Upgrade Plan" buttons for users already on the most expensive plan
✅ Paid product-name mapping — config-driven highIntentAliases per tier (e.g. business, agency, enterprise) resolve provider product names to the correct tier without hardcoded keyword lists
✅ Digital Product Fulfillment — Secure downloads decoupled from tier-granting logic
✅ HMAC-SHA256 signature verification on every webhook
✅ Replay protection with timestamp validation
✅ Same-origin checkout/portal redirects via allowlisted return paths
✅ Generic billing API errors with provider details retained server-side
✅ Impersonation-aware REST billing routes via getEffectiveUserId() parity with Server Actions
✅ Provider readiness checks — selected-provider secrets and active paid-tier product IDs validated from one helper
✅ Fail-closed paid account deletion — every active-like provider subscription is canceled by stored provider before storage, waitlist, profile, or Auth deletion proceeds
✅ Guest Checkout — public checkout creates provider sessions only; subscription users are provisioned from verified webhook completion, and digital products use email/token fulfillment
✅ Subscription Cancellation — AlertDialog with "Canceling" badge + period-end banner
✅ Lifetime Access Rendering — Dynamic active subscription state for lifetime purchases
✅ Atomic credit deduction with PostgreSQL FOR UPDATE row locking
✅ Token-Based Fulfillment — Secure signed download links for digital products
✅ Independent billing toggles — credits and seats independently enabled; seat billing auto-disables when orgs disabled

Glassmorphism 2.0 — Crystal UI Design System

Looks like you had a dedicated design team. You didn't.

Element	Implementation	Why
Crystal Surfaces	`bg-white/5 backdrop-blur-2xl border-white/10`	Depth without heaviness — premium feel
Touch-First UI	Strict 44px tap targets, iOS safe-zones (`min-h-dvh`)	Native mobile app feel on the web
GlowCard	Animated shine, mesh gradient, colored glow	Conversion-point attention magnet
Spring Animations	`stiffness: 50`, staggered fade-ins via `motion/react`	Alive and responsive, not janky
Bento Grids	8-column responsive system	High info density, zero overload
Tri-Font Stack	Space Grotesk + DM Sans + Fragment Mono	Professional hierarchy that guides the eye
Split-Screen Auth	`AuthBranding` left + form right	Social proof during auth reduces drop-off
OKLCH Colors	Perceptually uniform tokens	No "muddy" gradients across screens
Emoji Loader	Spinning `⏳` replaces spinner icons	Distinctive, lightweight, consistent
Pixel-Perfect Mobile	`px-4 md:px-8 max-w-7xl` standardized + adaptive align	Consistent boundaries, no layout drift
Theme-Aware Logos	`dark:hidden` / `hidden dark:block` conditional render	Brand integrity across light and dark modes
Collapsible Nav	Animated dropdown sub-links on Home (hover + tap)	Clean header with deep navigation hierarchy
Localized Forms	Newsletter inputs use `next-intl` translation keys	End-to-end i18n across all marketing surfaces
Sidebar Hover Isolation	Scoped `group/name` namespaces (`group/text`, `group/theme`)	CSS-safe child animations without parent leakage
Collapsed Sidebar Branding	Theme-aware compact icons in `collapsible=icon` mode	Professional brand identity at every density
Bifurcated Errors	`GlobalError` (Public) vs `DashboardError` (Protected)	Context-aware recovery paths for better UX

Tip

Built on Tailwind v4 CSS custom properties. Override any design token in global CSS — no component files touched.

️ AI Legal Compliance Engine

Traditional cost: $2,000–5,000+ in legal fees. Vibe44 includes AI-powered generation:

📄 Privacy Policies

GDPR, CCPA, PIPEDA compliant

📄 Terms of Service

Liability, acceptable use, termination clauses

📄 Refund Policies

Subscription + one-time purchase coverage

✅ Consent Tracking

`user_legal_consents` tracks agreement timestamps

🔄 Version Control

Every document versioned per `type + locale`; supported types are `privacy_policy`, `terms_of_service`, `cookie_policy`, and `refund_policy`

Warning

AI-generated legal docs are a starting point. Have a lawyer review before going live with sensitive data (health, finance, children).

AI-Powered Support & RAG Knowledge Base

Complete AI support infrastructure — chat to knowledge base:

Feature	Technology	Description
100+ Language Chat	Gemini 3.1 Flash-Lite Preview	Detects input language, responds in kind
AI Intent Detection	Gemini `classifyIntent()`	Escalation, priority classification — any language
RAG Pipeline	`gemini-embedding-2` + pgvector	Semantic search over your knowledge base
Multilingual Voice	ElevenLabs/Murf TTS + ElevenLabs STT	Voice conversations with speech output and ElevenLabs transcription
Voice Boundary	Adapter factory + SSRF guard	Murf `audioFile` URLs are sanitized before server-side fetches
Real-Time Sync	Supabase Realtime Broadcasts	Live sync between user widget and super-admin
Lazy Creation	Server Actions	Conversations created on first message — zero empty records
Escalation	Support Tickets	AI escalates complex issues to human queue
Lifecycle	Archive / Unarchive / Delete	Full management flow with defensive deletion safeguards
UX Polish	Granular Loading States	Per-ticket UI feedback prevents universal dashboard blocking
Guest Access	localStorage persistence	Non-auth users chat with history preserved
Ownership Guard	Drizzle owner lookup	Authenticated conversation IDs are resolved by effective user

Affiliate & Referral System

Built-in referral tracking with full attribution:

🔗 Tracked Links

Approved affiliates use /api/affiliate/track links that set 30-day attribution cookies before redirect.

🎯 Conversion Attribution

Payment providers pass referral ID and buyer user ID so self-referrals and expired referrals are rejected before commission credit.

🕵️ Privacy-Minimized Clicks

IP addresses and browser user agents are hashed before referral persistence.

💳 Payout Profile

Affiliates select Wise, PayPal, or Payoneer during registration; payout method and email are stored on affiliates.

💸 Payout Management

affiliate_payouts uses the stored payout profile, config.affiliate.minimumPayoutThresholdInCents, serializable deduction, and pending-only completion.

📊 Dashboard

Affiliates view performance metrics without raw tracking identifiers.

📊 Overview Dashboard

KPI metric cards, revenue area charts, activity bar charts

⚡ Dynamic Chart Loading

`next/dynamic` for Recharts (~100-150KB savings)

🔄 Real-Time Sync

Supabase Realtime subscriptions

️ super-admin Dashboard (17 Modules / Super-Admin RBAC)

Full-featured super-admin panel at /super-admin — no third-party tools. All 17 modules feature standardized Glassmorphism 2.0 CardHeader layouts, client-side filtering, and unified CSV export.

👥 User Management

Search, metrics, roles, subscription status, org hierarchy badges, deletion (via centralized account-deletion service), super-admin shielding, and automatic waitlist-to-profile metadata synchronization.

🏢 Organization Management

List, search, members, deletion

💳 Transaction Management

Unified dashboard for all recurring subscriptions and one-time purchases with granular statuses, intelligent product-name resolution, and CSV exports.

📈 Affiliate System

Referral code tracking, click metrics, payout status management

📬 Contact Submissions

Premium Glassmorphism 2.0 interface with status tracking, identity-aware avatar resolution for registered users, CSV export, defensive deletion dialogs, and interactive 'Reply to Sender' / 'Copy Message' actions

🎫 Support Tickets

Human support queue with priority management, advanced lifecycle (Archive/Delete), and granular loading states

💬 Conversation Monitoring

AI chat history oversight and sentiment analysis

📚 Knowledge Base

CRUD for RAG documents with Markdown editor + embedding management

📊 Analytics Dashboard

KPI cards, revenue area charts, and geographic distribution

📝 Blog & CMS

Full CRUD for articles and categories with SEO fields and publishing workflow

🛡️ Security Dashboard

`auth_events` stat cards, event table, severity badges, brute-force alerts

📜 Legal Document Generator

AI-powered generation and versioning of compliance docs

📰 Newsletter Management

Subscriber CRUD, source tracking, and list export

⏱️ Waitlist Management

Early-access queue management, bulk approval, and localized transactional emails.

🔗 Webhook Operations

Real-time event logging, status monitoring, and replay history

📊 System Health

Real-time service status, database metrics, uptime monitoring

🔄 User Impersonation

Cookie-based "view as user" with read/write isolation, UI safeguards, 1-hour auto-expiry, and instantaneous layout synchronization via reactive CSS variables to eliminate UI jitter during transitions

Enterprise Security (Baked In, Not Bolted On)

Security isn't a feature you add later. It's in every layer:

Layer	Implementation	Protects Against
RLS	Policies on all 32 tables	Data isolation between users/tenants
API Key Hashing	SHA-256 with salt + prefix-only storage	Zero plaintext exposure of developer keys
Edge Rate Limiting	Upstash Redis at middleware; fail-closed in production	DDoS, brute force, credential stuffing
Circuit Breaker	Auto IP ban after 5 violations	Persistent attackers
CSP Headers	Nonce-based via `proxy.ts` + `'strict-dynamic'`	XSS, code injection, clickjacking
Webhook Verification	HMAC-SHA256 signature validation	Forged webhook attacks
Input Validation	Zod i18n-aware factories for bodies, params, and query strings	SQLi, XSS, malformed data
Error Containment	Generic translated API/action failures; no Zod `flatten()` payloads or raw provider errors	Schema disclosure, noisy UX, support escalations
Session Management	Supabase Auth with auto-refresh	Session hijacking, token expiry
QStash Security	Triple-guard bypass constraints (`QSTASH_ALLOW_DEV_BYPASS`)	Unauthorized background job execution
Step-Up Auth	Server-side password re-verification via `FormData` for high-risk actions (MFA disablement) to prevent log leakage	Account takeover, log-exposure of secrets
AAL Enforcement	Middleware blocks `/dashboard` until TOTP done; administrative bypassing restricted to secure server actions	MFA bypass
WebAuthn Auditing	Challenge lifecycle persistence (`status`) creates immutable audit trails for passkey events	Repudiation of authentication events
CSRF Protection	HMAC-bound double-submit cookie with root-level client context, authenticated page-route token seeding,`csrfFetch()` for browser mutations, and same-origin oRPC CSRF headers; guest chat remains public only without a session	Cross-site request forgery
Impersonation State	HMAC-signed `impersonation-context` cookie with read-time super-admin/target revalidation	Local cookie tampering and stale target privilege drift
SSRF Protection	`lib/security/ssrf.ts` blocks private IPs, metadata, and provider-returned Murf audio URLs	Server-Side Request Forgery
XSS Protection	`lib/security/xss.ts` input sanitization + CSP nonces	Cross-site scripting (XSS)
Crypto Security	`lib/security/crypto.ts` — zero `Math.random()` in server code	Predictable token generation
Credit Guard	`p_amount > 0` check in `deduct_credits()`	Credit inflation via negatives
Profiles Lock	RLS blocks 6 billing fields from user UPDATEs	Privilege escalation
Cursor Pagination	All super-admin queries cursor-based	Memory exhaustion
Invoice Lockdown	INSERT restricted to `service_role` + `amount > 0` CHECK	User-fabricated or negative invoices
Storage Scoping	`post-images` INSERT scoped to user folder; upload object extensions derive from validated MIME type	Cross-user file uploads and active-content confusion
CI Build Gating	`build: needs: [quality]` — lint + type-check first	Deploying broken code
Deletion Safety	Mandatory `AlertDialog` confirmation guards + fail-closed paid account deletion	Prevents accidental data loss and paid entitlement drift
Resource Gating	Tier-based limits enforced in UI + server-side	Prevents resource exhaustion

Security

Zero critical vulnerabilities. Full OWASP Top 10 (2025) compliance. See SECURITY_AUDIT.md · THREAT_MODEL.md

️ OWASP Top 10 (2025) — Full Compliance

Pricing (One-Time Payment — No Subscriptions, Ever)

One-time purchase. No monthly fees. No per-seat SaaS tax. Pay once, own forever, deploy unlimited projects.

👉 Check our Pricing page for detailed tier breakdowns (Starter, Growth, Agency), ROI calculations, and latest infrastructure cost-benefit analysis in PRICING.md.

agent-native Architecture (100/100 Machine Readability)

Designed from the ground up for AI-assisted development. Your AI coding agent (Cursor, Trae, Copilot, Windsurf, Gemini CLI, Claude Code, Antigravity, Codex, Jules) reads .agents/ and immediately understands your entire architecture:

AGENTS.md                               # Root agent instruction contract
CLAUDE.md                               # Persistent instruction manual for Claude Code
.agents/
├── rules/
│   └── system-prompt.md                # Always-on system prompt (role, anti-hallucination, verification)
├── skills/
│   ├── backend/SKILL.md    # Backend architecture bible
│   ├── frontend/SKILL.md   # Frontend design system bible
│   └── i18n/SKILL.md       # i18n namespace routing & locale architecture
└── workflows/
    ├── add-feature.md          # End-to-end feature building
    ├── add-api-route.md        # API route with auth + validation + rate limiting
    ├── add-ui-component.md     # Glassmorphism 2.0 component creation
    ├── add-payment-provider.md # Payment provider integration (strategy pattern)
    ├── add-ai-provider.md  # AI provider integration (AIProvider interface)
    ├── add-email-provider.md # Email provider integration (EmailProvider interface)
    ├── add-email-template.md   # React Email + i18n + provider adapter
    ├── add-locale.md           # Language addition across 14 sub-modules
    ├── add-oauth-provider.md   # Social auth provider setup
    ├── database-migration.md   # Schema change + migration + RLS
    ├── debugging.md            # Systematic debugging with Sentry + logs
    ├── security-audit.md       # OWASP-aligned security review
    ├── testing.md              # Vitest unit + Playwright E2E
    ├── deploy.md               # Vercel / Railway deployment (auto-invocation disabled)
    ├── remove-org-feature.md   # Safe org feature removal (auto-invocation disabled)
    └── remove-mock-data.md     # Production data cleanup (auto-invocation disabled)

🎯 Zero hallucination — AI reads your actual schema, not guessed table names; <investigate_before_answering> XML tags enforce read-before-answering
🎯 Knowledge Graph Navigation — Built-in Graphify MCP integration maps your entire AST, allowing AI to query codebase relationships directly.
🎯 Pattern consistency — Every new feature follows established conventions
🎯 Token efficiency — Modular files + progressive disclosure = AI reads only what's relevant
🎯 Workflow automation — "/add-feature" triggers a proven playbook; all 18 workflows include standardized frontmatter (name, description, argument-hint)
🎯 Safety-first — Destructive workflows (deploy, migration, removal) include disable-model-invocation: true to prevent accidental agent execution
🎯 Verification mandate — System prompt requires tsc --noEmit, test suite run, and build confirmation before marking work complete

Independent newsletter subscription infrastructure — decoupled from waitlist and auth:

📧 Public Subscription

`subscribeToNewsletter` server action with IP-based rate limiting and Zod input validation

🔁 Idempotent Signup

Duplicate email submissions return success without creating duplicate records

📊 Source Tracking

`source` column tracks subscription origin (`website`, `landing_page`, `footer`)

🛡️ Super-Admin Management

Dedicated `/super-admin/newsletter` interface with subscriber CRUD and oversight

⚙️ 13 i18n Templates

Welcome, Password Reset, Receipt, Trial Expiring, Purchase Confirmation, Waitlist Approved, Onboarding Day 3, Org Joined, Credits Low, Payment Failed, Weekly Digest, and more.

🎨 Brand-Consistent UI

`NewsletterForm` component with `motion/react` success/error states and `next-intl` label resolution

Multi-Tenancy & Organizations

Built-in team/org system with role-based access:

🏗️ Organizations

Create, manage, invite members

👤 RBAC

Owner, Admin, Member with granular permissions

📨 Invitations

Email-based with acceptance flow

🔄 Context Switching

Personal ↔ org contexts

📊 Member Limits

Configurable per subscription tier

🔀 Feature Flags

Orgs and Projects independently toggleable; disabling one has zero effect on the other

💺 Seat Billing

`isSeatsEnabled()` auto-returns `false` when orgs disabled (seats are per-org)

️ Developer Tools

🔑 API Key Management

Secure developer keys with SHA-256 hashing, scopes, rate limits, and usage tracking

📊 Usage Analytics

`api_usage_logs` for tracking API consumption, status codes, and latency

📖 API Documentation

OpenAPI 3.0.3 with Scalar interactive docs; platform profile roles document only `user` and `super-admin`

🩺 Health Endpoint

`/api/health` and public oRPC health expose minimal liveness; super-admin-only health surfaces show dependency readiness

🔄 Onboarding Flow

Multi-step wizard with Enter key progression, `useCallback`-stabilized refs, dynamic branding

♻️ Keyboard Accessibility

Enter key on all dialogs/modals/forms, `CornerDownLeft` indicators, keyboard-only operation across entire app

🔍 i18n Validation

`find-missing-locale-keys.ts` + `find-missing-translations.ts` with automated reporting

️ The Stack

Every technology choice is strategic:

Layer	Technology	Why
Framework	Next.js 16 (App Router)	Server Actions eliminate API boilerplate. RSC reduces client bundle. Edge middleware for CDN-level security.
Styling	Tailwind v4 + shadcn/ui	Native CSS approach. Component ownership (no npm dependency).
Language	TypeScript 6 (Strict) + Zod	Strict = compile-time safety. Zod = runtime boundaries. Zero-gap type coverage.
Database	Supabase (PostgreSQL 15)	RLS. Realtime. pgvector. Auth. One provider.
ORM	Drizzle ORM	Type-safe. SQL-like syntax. `drizzle-kit push` for instant updates.
Payments	Universal Adapter	Strategy Pattern — 5 providers. Swap via env var.
Email	Universal Adapter (SendGrid, Resend, Postmark, Brevo)	Validated provider keys, SDK-backed adapters, configured-key fallback, and 13 i18n-ready React Email templates.
AI	Universal Adapter (Gemini, OpenAI, Anthropic, DeepSeek)	Validated `AI_PROVIDER` / `EMBEDDING_PROVIDER` factories. Streaming, intent, structured output, and provider-scoped key gates.
Embeddings	`gemini-embedding-2`	3072-dim vectors in PostgreSQL. No separate vector DB. Cosine similarity.
Voice	ElevenLabs + Murf AI + Web Audio API	High-quality TTS via both providers; STT requires ElevenLabs.
Queue	Upstash QStash + Trigger.dev	QStash verifies signed ingress at `/api/qstash`; Trigger.dev handles configured scheduled jobs and retries.
Analytics	Universal Adapter (9 providers)	DataFast, GA4, Mixpanel, PostHog, Plausible, Pirsch, Umami, Vercel Analytics, and Vemetric run only after analytics consent and CSP allowlisting.
Rate Limit	Upstash Redis	Edge-compatible. Sub-ms latency. Sliding window. Circuit breaker.
i18n	next-intl (EN/ES/FR)	Cookie-based locale switcher. 14 sub-modules. Global translation values via `i18n.ts`. Automated discrepancy detection.
Performance	RSC boundaries + explicit projections + lazy client bundles	Stable Next.js config, parallel Promise.all() reads, bounded list queries, LazyMotion, hydration-stable ChartContainer, fixed image ratios.