Stackmesa SaaS Starter

What it does & who it's for

Every SaaS rebuilds the same four things before it can build anything: sign-in, teams, billing, email. Stackmesa is those four things finished — wired together and clicked through end to end, not just present in package.json. Before this listing went up, the starter was booted against a fresh Postgres and every claim below was exercised in one continuous run: sign-up created a user and their workspace, an invitation email carried a working link that survived the new member's sign-up, a real test-mode Stripe Checkout charged a per-seat plan (two members, so two seats — $24, with the maths visible on Stripe's own page), the webhook mirrored the subscription, a simulated payment failure started the grace period and sent the dunning email, the recovery cleared it, and the same webhook delivered twice was refused by the idempotency ledger with a polite {"duplicate":true}. The demo shows that run: real screenshots, verbatim code, and the actual webhook transcript. Billing is where most starters wave their hands, so it gets the most engineering here: an idempotency ledger that makes webhook retries and races safe, per-seat quantities that track your member count with prorations, flat plans beside them so both modes are exercised, a 7-day grace window when a card fails (cutting access on the first decline churns customers who just got a new card in the mail), dunning emails written for humans, and a signed-fixture harness that replays the entire lifecycle against your local webhook with no Stripe account and no internet. Auth arrives three ways — email + password, passwordless magic links, Google/GitHub OAuth — resolving to one identity, with sessions as JWTs and route protection at the edge. Teams are the data backbone: invitations are personal 7-day links, roles are owner/admin/member with the escalation paths closed, ownership transfer works, and the last owner can't be removed. Email is nine React Email templates through Resend — or, with no key set, printed to your dev console with links intact, which is why the whole product is clickable locally with zero third-party accounts. Configuration is one zod schema: required keys fail the boot with readable errors, optional keys gate features off gracefully. The code is deliberately boring: server components, server actions, plain CSS, one client component in the whole app, TypeScript strict with noUncheckedIndexedAccess, and 72 unit tests over the logic that loses money when it's wrong. And because a starter should shrink to fit, every module ships a guide that ends with deletion instructions — remove billing, teams, OAuth or email cleanly and typecheck your way to done.

Version history

1. v1.0Latest4 Aug 2026

Licence & terms

These terms are snapshotted at purchase — what you see here is what applies to your order.

Reviews (1)