customization recipes recipes tell buyers how to turn the foundation into their own saas while preserving source-of-truth code, tests, and operational safety. operate recipe: add a dashboard page add a dashboard surface without mixing route entrypoint code, ui state, server reads, and access checks. src/lib/auth/guards/route.ts src/lib/auth/rbac/nav-config.ts src/features/settings/ui/section.tsx src/app/(dashboard)//page.tsx src/features//ui/.tsx src/features//server/queries/.ts src/lib/auth/rbac/nav-config.ts create a thin route page that checks access and delegates ui. put screen composition in feature ui. put server reads in feature queries or services. add navigation only after the route is protected. add focused tests for access and server behavior when practical. pnpm run test:features pnpm run quality recipe: add an admin module add admin-only work with fail-closed access, auditability, and predictable navigation. src/lib/auth/guards/route.ts src/lib/auth/rbac/features.ts src/lib/auth/rbac/nav-config.ts src/lib/audit/log.ts src/app/(dashboard)/admin//page.tsx src/features//server/actions/.ts src/features//ui/.tsx src/lib/auth/rbac/nav-config.ts define the feature key and route access before adding ui. gate the route on the server. keep admin actions server-owned and validate inputs. log important changes with actor and target context. add navigation after access is correct. pnpm run test:features pnpm run quality recipe: add an analytics card add dashboard analytics without creating provider calls in render loops or unbounded database scans. src/features/analytics/server/queries/platform-metrics.ts src/features/analytics/server/queries/revenue-dashboard-data.ts src/features/analytics/shared/chart-config.ts src/features/analytics/ui/platform-dashboard.tsx src/features/analytics/server/queries/.ts src/features/analytics/shared/chart-config.ts src/features/analytics/ui/.tsx define the metric and date range. aggregate on the server with bounded reads. return only the fields the chart needs. render empty and loading states. add tests for range behavior and empty data. pnpm run test:features pnpm run quality recipe: add a database table add durable product data without leaving schema, generated types, rls, grants, and feature persistence out of sync. supabase/migrations/20260426000000_init.sql src/lib/supabase/server.ts src/lib/supabase/types.ts supabase/migrations/_.sql src/lib/supabase/types.ts src/features//server/persistence/

.ts src/features//server/schemas/

.ts define ownership, uniqueness, status, timestamps, and foreign keys before writing the migration. add the table, constraints, rls policies, and grants in a migration. regenerate generated supabase types. keep reads and writes in feature-owned persistence or query files. add tests for invalid input, auth failures, and duplicate writes when relevant. pnpm run contract:migrations pnpm run supabase:types pnpm run test:features pnpm run quality do not expose a new table before deciding its rls policy. do not put one-off seed or repair data into durable schema migrations. recipe: add a protected api route add an api boundary that validates input, fails closed on auth, delegates real work, and returns a stable response shape. src/lib/auth/guards/api.ts src/app/api/billing/checkout/route.ts src/features/billing/server/checkout/service.ts src/features/contact/shared/schemas.ts src/features/contact/server/services.ts src/app/api//route.ts src/features//server/services/.ts src/features//server/schemas/.ts keep the route handler thin: parse request, call the auth guard, validate payload, delegate to a service, and return the response. put business rules in the service, not the route. validate request bodies with a feature-owned schema. return safe error copy without leaking provider payloads or secrets. add api or feature tests for unauthenticated, invalid, and successful requests. pnpm run test:api pnpm run test:features pnpm run quality do not trust user ids from request json when server identity is available. do not call provider sdks directly from generic route glue. recipe: add an email template add a transactional message without bypassing event definitions, runtime rendering, delivery registration, or outbox retry behavior. src/features/notifications/server/notification-events.ts src/features/notifications/server/templates/shared/defaults.ts src/features/notifications/server/templates/services/runtime.ts src/features/notifications/server/templates/actions/management.ts src/features/notifications/server/delivery/registry.ts src/features/notifications/server/notification-events.ts src/features/notifications/server/templates/shared/defaults.ts src/features/notifications/server/templates/shared/types.ts add or select the notification event before writing template content. define default subject, body, and required variables. confirm runtime rendering validates variables and produces the expected output. send through the existing delivery and outbox path. add focused tests for missing variables, rendered content, and delivery registration. pnpm run test:features pnpm run quality do not send directly from feature code when the outbox should own retries. do not log rendered messages if they can contain user data. recipe: add a billing product add a product or price without breaking provider setup, checkout eligibility, customer projection, or webhook handling. src/features/billing/server/runtime/provider.ts src/features/billing/server/catalog/configuration.ts src/features/billing/server/runtime/readiness.ts src/features/billing/server/checkout/service.ts src/app/api/webhooks/stripe/billing/route.ts billing_catalog_json billing_enabled_models src/features/billing/server/catalog/configuration.ts choose the billing model and provider before editing catalog data. add provider price ids and product metadata to the catalog. confirm setup checks understand the new item. run a test checkout for the new price. confirm webhook projection updates the local customer billing state. pnpm run test:features pnpm run quality open /billing/setup and complete a provider test checkout. do not mix provider price ids across providers. do not skip webhook verification after checkout succeeds. recipe: add a settings field add configurable product behavior without splitting validation, defaults, normalization, persistence, and ui state. src/features/settings/server/actions/website-settings.ts src/features/settings/server/schemas/settings.ts src/features/settings/server/normalizer/settings-normalizer.ts src/features/settings/server/config/defaults.ts src/features/settings/server/persistence/settings.ts src/features/settings/ui/website-form.tsx src/features/settings/server/schemas/settings.ts src/features/settings/server/config/defaults.ts src/features/settings/server/normalizer/settings-normalizer.ts src/features/settings/ui/website-form.tsx add the field to the server schema and define its safe default. normalize persisted values before returning settings to ui. update the settings form with loading, invalid, and saved states. persist through the existing settings action. add tests for defaulting, invalid values, and updates. pnpm run test:features pnpm run quality do not rely on ui-only validation. do not introduce fallback env names for settings that should be database-backed. recipe: add a waitlist field capture a new lead attribute while preserving validation, duplicate handling, settings, notifications, and rate limits. src/features/waitlist/server/signup/schemas/payload.ts src/features/waitlist/server/signup/actions/submit-route.ts src/features/waitlist/server/signup/services/submit.ts src/features/waitlist/server/signup/persistence/signups.ts src/features/waitlist/server/settings.ts src/lib/security/rate-limit/policy.ts supabase/migrations/_waitlist_field.sql src/features/waitlist/server/signup/schemas/payload.ts src/features/waitlist/server/signup/services/submit.ts src/features/waitlist/server/signup/persistence/signups.ts decide whether the field is required, optional, or admin-only. add durable storage and regenerate generated types if the field is persisted. update payload validation and persistence mapping together. preserve duplicate signup handling and notification side effects. add tests for missing, invalid, duplicate, and successful submissions. pnpm run contract:migrations pnpm run supabase:types pnpm run test:features pnpm run quality do not store unbounded free-form text without validation. do not bypass rate limits when adding a new public field. recipe: remove a module safely remove an unwanted module without leaving routes, nav items, schema, jobs, webhooks, env vars, tests, or docs pointing at dead behavior. src/lib/auth/rbac/nav-config.ts src/lib/auth/rbac/features.ts src/features/settings/server/actions/website-settings.ts src/features/notifications/server/notification-events.ts supabase/migrations/20260426000000_init.sql src/app/ src/features/ src/lib/auth/rbac/nav-config.ts src/lib/auth/rbac/features.ts supabase/migrations/_.sql inventory public routes, dashboard routes, api routes, feature code, settings, jobs, webhooks, env vars, database tables, tests, and docs references. disable navigation and access before deleting shared data or provider behavior. remove or migrate durable data with an explicit migration plan. delete tests only after replacing them with coverage for the intended absence when the boundary is risky. run search for the module name and route paths before shipping. pnpm run test:features pnpm run test:contracts pnpm run quality do not remove only the ui and leave api routes or jobs active. do not drop tables without a buyer-owned data export or migration decision.

Job	Endpoint	Method	Suggested schedule
Scheduled publishing	/api/scheduler/publish	POST	Every 5 minutes
Email delivery queue	/api/cron/notification-outbox	GET	Every 2 minutes
Data cleanup	/api/cron/data-retention	GET	Daily at 04:15 UTC