# Orbit

> An opinionated SaaS starter kit. Multi-tenant workspaces, teams, PBAC, billing (Stripe / Polar / Dodo), audit logs, realtime, email, and uploads — wired up and typed end-to-end. Scaffolded by `npx create-orb`.

## Pages

- [Home](https://wereorbit.com/): landing page
- [Pricing](https://wereorbit.com/pricing): one-time payment tiers
- [Features](https://wereorbit.com/features): feature inventory
- [Tech stack](https://wereorbit.com/tech-stack): the libraries Orbit is built on
- [Changelog](https://wereorbit.com/changelog): release history

## Docs

### getting started

- [npm run dev — what's happening?](https://wereorbit.com/docs/getting-started/dev-server.md): Four processes, three ports, one Turbo pipeline.
- [Environment variables](https://wereorbit.com/docs/getting-started/environment-variables.md): Everything in apps/api/.env.example, grouped by what it turns on. The web shells need only two.
- [First migration + seed](https://wereorbit.com/docs/getting-started/first-migration-and-seed.md): Get a schema into your Postgres, then drop in just enough rows to log in and click around.
- [Prerequisites](https://wereorbit.com/docs/getting-started/prerequisites.md): A short list of tools you'll need on your machine before running the CLI.
- [Quickstart](https://wereorbit.com/docs/getting-started/quickstart.md): Ship a running Orbit dashboard in under 5 minutes. Three commands, and npm run setup handles everything else — Postgres, env files, migrations, even generating a better-auth secret.
- [Running the CLI](https://wereorbit.com/docs/getting-started/running-the-cli.md): One command. A handful of prompts. A project that only ships the features you asked for.

### concepts

- [DDD bounded contexts for SaaS](https://wereorbit.com/docs/concepts/bounded-contexts.md): Each piece of the product is a folder. Each folder has the same three layers. Every context looks alike.
- [Realtime events over WebSocket + presence](https://wereorbit.com/docs/concepts/realtime-events.md): One WebSocket connection per tab. A channel-based pub/sub hub. Domain events in, ServerEvent DTOs out.
- [Two-scope PBAC for multi-tenant SaaS](https://wereorbit.com/docs/concepts/two-scope-pbac.md): Permission-based access control for SaaS, in two scopes: workspace-wide and team-specific. One vocabulary, same shape on both sides.
- [Unit of Work + domain event dispatch](https://wereorbit.com/docs/concepts/unit-of-work.md): Every write runs inside one transaction. Domain events are collected there and dispatched after commit — so projectors always see committed state.
- [Multi-tenant SaaS workspaces, teams & tenancy](https://wereorbit.com/docs/concepts/workspaces-teams-tenancy.md): How Orbit's multi-tenant SaaS model scopes every row, every permission, and every realtime channel to a workspace.

### guides

- [Add a bounded context](https://wereorbit.com/docs/guides/add-a-bounded-context.md): End-to-end: from empty folder to a typed HTTP endpoint that writes a new aggregate and broadcasts a realtime event.
- [Add a permission & role check](https://wereorbit.com/docs/guides/add-a-permission.md): Extend the permission vocabulary, wire it to a default role, then guard the route and gate the UI.
- [Add a plan + checkout button](https://wereorbit.com/docs/guides/add-a-plan.md): Create the product at your provider, list it in BILLING_PLANS_JSON, and the billing settings page renders it automatically.
- [Write a React Email template](https://wereorbit.com/docs/guides/add-an-email-template.md): New .tsx template, new Mailer method, one line in each adapter, one projector to fire it.
- [Write a graphile-worker job](https://wereorbit.com/docs/guides/write-a-job.md): Declare a payload type, register a handler, pick a schedule. Works identically under QStash.

### integrations

- [SaaS audit log (workspace + admin scope)](https://wereorbit.com/docs/integrations/audit-log.md): Append-only ledger at two scopes — tenant and app-wide. Entries are projected from the domain event bus so services never write audit rows directly.
- [SaaS billing — Stripe, Polar & Dodo](https://wereorbit.com/docs/integrations/billing.md): One BillingProvider port, three interchangeable adapters — Stripe, Polar, and Dodo Payments. The master switch is a single env var.
- [Background jobs — graphile-worker & QStash](https://wereorbit.com/docs/integrations/jobs.md): A provider-agnostic queue, a pluggable runtime, and a registry that's typed end-to-end.
- [Transactional email — Mailer port + Resend](https://wereorbit.com/docs/integrations/mailer.md): Six methods. One dev-friendly stub. React Email templates for anything fancier.
- [OAuth providers (Google + Apple) via better-auth](https://wereorbit.com/docs/integrations/oauth.md): better-auth OAuth setup for Google and Apple. Magic links are always on; OAuth providers only register when their credentials are both set.
- [ORM: Prisma or Drizzle](https://wereorbit.com/docs/integrations/orm.md): One repository port per aggregate. Two interchangeable ORMs behind it. Picked once at scaffold time.
- [Rate limiting — in-memory, Upstash Redis & Unkey](https://wereorbit.com/docs/integrations/rate-limiting.md): A pluggable RateLimiter port. In-memory fallback for dev, Upstash Redis or Unkey for production — pick one per deploy.
- [Uploads (UploadThing)](https://wereorbit.com/docs/integrations/uploads.md): A thin FileStorage port, a single catch-all route, and a disabled state that doesn't 500.

### deploy

- [Deploy the API](https://wereorbit.com/docs/deploy/api.md): One Dockerfile, one migrate-then-boot sequence, and a handful of env vars. Any long-lived-container host will do.
- [Postgres providers](https://wereorbit.com/docs/deploy/postgres.md): Any modern Postgres works. The only footgun is transaction poolers — reach for DIRECT_DATABASE_URL when you hit one.
- [Secrets & rotation](https://wereorbit.com/docs/deploy/secrets.md): Which keys are load-bearing, what happens when you rotate each, and what you can do zero-downtime.
- [Deploy the web shells](https://wereorbit.com/docs/deploy/web.md): SSR Node server for TanStack Start. Node or edge for Next. Two env vars, baked at build.
- [Production webhook routing](https://wereorbit.com/docs/deploy/webhooks.md): One public URL per provider, signature verification on every call, dedupe in the ledger, nothing else fancy.