SAAS STARTER · TYPESCRIPT MONOREPO
roxabi-boilerplate
A production-ready SaaS starter. A Bun + TurboRepo TypeScript monorepo with auth, multi-tenancy, RBAC, API keys, and email already wired — plus a built-in Claude agent team that runs the full development lifecycle. Skip the plumbing every product rebuilds; start on the thing you actually want to ship.
What it is
Building a SaaS product from scratch means wiring the same infrastructure every time — auth, multi-tenancy, API keys, permissions, email, CI, documentation — before you write a single line of the thing that makes your product yours. roxabi-boilerplate ships all of that production-ready, so a team starts at its first real feature instead of its tenth piece of boilerplate.
It pairs a modern TypeScript monorepo with an integrated AI agent team for the full lifecycle — issue triage, implementation, code review, deployment. The plumbing is done; the workflow comes with it.
The value is everything you don't write. Auth, tenancy, and CI are solved problems — this is them, solved, so your first commit is product.
The stack
A TurboRepo monorepo orchestrates three apps over shared packages, so only what changed rebuilds. The choices are deliberately current and strict — Bun for speed, Biome for one fast lint-and-format, TypeScript in strict mode throughout.
| Layer | Technology |
|---|---|
| Monorepo | Bun + TurboRepo · task graph + build caching |
| Language | TypeScript 5.x, strict |
| Frontend | TanStack Start (SSR) — web |
| Backend | NestJS + Fastify — api |
| Docs | Fumadocs + Next.js — docs |
| Tooling | Biome (lint + format) · Vitest + Playwright · Lefthook |
Shared packages — ui, types, config, email — are consumed across the apps through Bun workspaces, so a contract or a component is defined once and reused everywhere.
What's already wired
The infrastructure most SaaS products need on day one, present and tested before you start.
- Passwordless auth — magic-link email via better-auth, secure server-side sessions.
- Multi-tenancy — organizations you invite into, switch between, and manage.
- RBAC — role-based access control scoped per organization.
- API keys — per-org issuance and revocation.
- Email — templated, in its own shared package.
- Quality gates — Lefthook hooks (commit-msg, pre-commit, pre-push) and semantic release: Conventional Commits → changelog + tags.
A built-in AI team
The boilerplate ships with a Claude agent team configured for the whole dev lifecycle — the same roxabi-plugins workflow the rest of the portfolio runs on. An issue goes from triage through implementation, review, and merge along a defined path, with the git hooks and CI as the enforcement.
GitHub Issue → Branch → Implement → PR → Review → MergeIt is not a bolt-on. The agents, the standards docs they read, and the pipeline they follow are part of the repo — clone it and the workflow is already there.
Run it
Requirements: Node ≥ 24, Bun 1.3.9+, and Docker for the database. Install brings the git hooks with it; one command brings up every app.
bun install
bun run db:up && bun run db:migrate && bun run db:seed
bun run dev # web :3000 · api :4000 · email :3001Apps, shared packages, the docs site, and the full standards library are all in the open.
- The repo · github.com/Roxabi/roxabi-boilerplate →