Everything in the box
A full inventory of what ships with the template — auth, an admin console, a design system, observability, and the agent workflow that builds it. This is the whole shelf.
Auth and role-based access
Email and password auth
Sign-up, login, forgot password, and update-password flows under the shared auth layout.
Sessions and route protection
A server-side session gate refreshes on matched requests and redirects unauthenticated visitors from protected routes.
Role-based admin access
Admin privilege keyed on app_metadata.role, enforced in the proxy, admin gate, and server actions.
Email confirmation flow
Confirm and recovery routes with safe post-auth redirects and mapped auth error copy.
Admin console
Admin shell
A sidebar console layout with breadcrumb and nav, separate from the authenticated app shell.
User management
Paginated, sortable user list with stat-tile filters, debounced search, and focus refetch.
Promote and demote
Grant or revoke admin from row actions in the users table or via the secret-key CLI.
Ban and unban
Time-based or permanent bans with confirmation dialogs; self-ban blocked and unban is idempotent.
Runtime settings
Registry-driven app settings with type-matched controls and per-row save in admin.
Banners admin
Configure public and authenticated banners with schedule, persistence, preview, and status badges.
Admin CLI
Break-glass secret-key scripts for promote, demote, delete, and list admins.
Design system
Semantic token theming
One semantic token layer drives light and dark across the app — no hardcoded theme colors.
See it liveOwned UI primitives
shadcn/ui components vendored as source you edit, not installed as a black-box package.
See it liveData table pattern
Shared list-view shell with server sort, pagination, stat-tile filters, and skeleton loading.
See it liveForms and save models
Canonical blur-save, explicit submit, and upload-on-complete patterns with schema validation.
See it liveError surfaces
Operational InlineError and fault ErrorPanel branches — errors never surface as toasts.
See it liveToast system
Semantic success toasts with status icons; confirmations only, never error feedback.
See it liveAccessibility checks
CI-enforced heading order, meaningful alt text, and semantic token contrast in both themes.
Observability
Persistent logging
Structured app logs written to the database via server and CLI wrappers, not raw console.
Live logs feed
Realtime INSERT subscription on the admin logs page with debounced invalidate-and-refetch.
Browser log relay
Client logs POST to a public relay route that forwards to server persistence under client- tags.
Retention auto-purge
Scheduled daily purge of log rows older than the configurable retention window.
SEO and GEO
Metadata and social previews
Per-route metadata and dynamic Open Graph images resolved from a single site URL helper.
Sitemap and robots
Auto-discovered marketing routes in the sitemap with training-crawler disallow policy.
Structured data
Organization and WebSite JSON-LD on the landing page, driven from site config.
PM and agent workflow
Locked rules
AGENTS.md holds hard constraints, workflow gates, the merge checklist, and a change protocol.
Deterministic rules
Cursor rules with mechanical enforcement via lint rules and check scripts in pre-push.
Skills suite
Invokable skills for migrations, review, doc sync, and quality audits.
CI quality gates
Pre-push hook mirroring CI — type-check, hard-constraint checks, lint, and coverage thresholds.
Collaboration model
A packaged PM + agent partnership — planning docs, workflow explainer, and paired build skills.
Site content and configuration
Public banners
Admin-configurable announcement banners on marketing and authenticated surfaces.
Legal placeholder pages
Terms and privacy stubs with generator callouts — replace when you spin off.
Site identity config
Product name, nav links, metadata, and landing copy in three config files to re-skin.