@opengroundplan/core 0.1.1

package/catalog/sources/fullstack-saas.yaml

@@ -0,0 +1,629 @@
+# Groundplan source catalog — category: fullstack-saas
+#
+# Research date: 2026-07-18
+#
+# VERIFICATION METHOD / PROVENANCE NOTE
+# -------------------------------------
+# Every star count, last-commit date, archived flag and license below was verified
+# against a GitHub primary source on 2026-07-18. The unauthenticated GitHub JSON API
+# (api.github.com, 60 req/hr per IP) was exhausted for this run's IP by concurrent
+# sibling research workflows, so the following primary sources were used instead:
+#
+#   * stars / archived / default branch  -> github.com/{owner}/{repo} rendered repo page
+#                                           (embedded React payload + repo-stars-counter)
+#   * license                            -> the ACTUAL LICENSE file text fetched from
+#                                           raw.githubusercontent.com, SPDX-matched against
+#                                           canonical license text, cross-checked against
+#                                           GitHub's own license-tab classification
+#   * last commit (pushed_at)            -> github.com/{owner}/{repo}/commits/{branch}.atom
+#                                           (entry-level <updated>, not feed-level)
+#
+# The task permits license verification from "the LICENSE file"; reading the license text
+# is strictly stronger evidence than an spdx_id label, so licenses here are high-confidence.
+# Star counts are exact (from the title attribute, not the abbreviated "29k" display).
+#
+# Two results were manually re-verified because they contradicted expectations:
+#   * calcom/cal.com  -> SEE CORRECTION BELOW. The original claim ("cal.com relicensed to
+#                        MIT") was WRONG. See the ADVERSARIAL VERIFICATION PASS note.
+#   * theodorusclarence/ts-nextjs-tailwind-starter -> NO license file exists at any of
+#                        LICENSE/LICENSE.md/LICENSE.txt/license/COPYING (all 404) and GitHub
+#                        detects no license. Per the rules this is EXCLUDED, not permissive.
+#
+# ADVERSARIAL VERIFICATION PASS — 2026-07-18 (second, independent reviewer)
+# ------------------------------------------------------------------------
+# api.github.com was still rate-limited (HTTP 403, "rate limit exceeded") for this IP and no
+# GITHUB_TOKEN / gh CLI was available, so the same alternative primary sources were used and
+# every figure was re-fetched from scratch rather than trusted:
+#   * stars    -> repo-stars-counter-star title attribute on the rendered repo page
+#   * dates    -> /commits/{branch}.atom entry-level <updated>
+#   * license  -> raw.githubusercontent.com LICENSE text, plus per-package LICENSE probes on
+#                 the two monorepos (supabase, cal.*) to catch root-vs-package divergence
+#
+# RESULT: all 15 star counts and all 15 last-commit dates matched the recorded values exactly.
+# All 15 recorded SPDX ids matched the actual LICENSE text. vercel/nextjs-subscription-payments
+# is confirmed archived ("Public archive" banner) and is already recorded maintained:false.
+# supabase/supabase was probed for per-package license overrides (apps/studio, apps/docs,
+# apps/www, packages, examples) — none exist; root Apache-2.0 governs. Numbers were sound.
+#
+# The defects were NOT in the numbers. They were:
+#   1. CRITICAL / IDENTITY — the cal.com entry. github.com/calcom/cal.com now 301-redirects to
+#      github.com/calcom/cal.diy, and raw.githubusercontent silently follows repo renames. The
+#      first pass fetched an MIT LICENSE, saw it under the cal.com path, and concluded "cal.com
+#      relicensed to MIT". It did not. calcom/cal.diy is a SEPARATE, MIT-licensed, enterprise-
+#      stripped distribution. Cal.com the product remains open-core. The entry has been
+#      retargeted to its true identity and the relicensing narrative deleted. The MIT license
+#      is real for cal.diy, so the entry survives the license gate — but anyone acting on the
+#      old text would have gone looking for MIT code in a commercially-licensed product.
+#   2. Three proposedLayerIds asserted capabilities the repos do not have (verified against
+#      package.json / file existence). Corrected in place; see per-entry comments.
+#
+# STALENESS RULE: last commit older than 18 months (i.e. before 2025-01-18) => maintained:false.
+# A few entries under 18 months are also marked maintained:false where the stack itself has
+# aged out of current practice; each such call is explained in whatToAvoid.
+
+category: fullstack-saas
+
+sources:
+
+  # ---------------------------------------------------------------- simple ---
+  - name: Skolaczk/next-starter
+    url: https://github.com/Skolaczk/next-starter
+    stars: 996
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2025-11-01"
+    complexity: simple
+    stack: Next.js 15 + Drizzle + NextAuth v5 + Stripe + next-intl + Tailwind v4
+    whatToBorrow: >-
+      The cleanest small reference for "auth + db + payments" without monorepo weight.
+      Borrow the @t3-oss/env-nextjs env schema (src/env.mjs) as the canonical typed-config
+      entry point, the @auth/drizzle-adapter wiring, the next-intl message/routing layout,
+      and the split lint/format/typecheck/test/e2e script set in package.json — that script
+      taxonomy is a good default for every generated repo. Playwright + Vitest are both
+      pre-wired at a size you can actually read end to end.
+    whatToAvoid: >-
+      Small single-maintainer project (996 stars) — treat as a pattern reference, not an
+      upstream you can track. NextAuth v5 is still the beta-era API surface and is being
+      superseded by Better Auth in newer starters; do not copy its auth config verbatim
+      into a layer you intend to maintain.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - db-postgres-drizzle
+      - auth-nextauth
+      - payments-stripe
+      - i18n-next-intl
+      - ui-shadcn-tailwind
+      - tooling-t3-env
+      - testing-vitest
+      - testing-playwright
+
+  - name: dotnize/react-tanstarter
+    url: https://github.com/dotnize/react-tanstarter
+    stars: 1259
+    spdx: Unlicense
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-17"
+    complexity: simple
+    stack: TanStack Start + TanStack Router/Query + Drizzle + Better Auth + Nitro + Tailwind v4
+    whatToBorrow: >-
+      The best minimal TanStack Start baseline, and the single most permissively licensed
+      entry here (Unlicense = public domain, zero attribution burden — ideal for a generator
+      that copies files). Borrow the src/routes file-based routing conventions, the
+      @tanstack/react-router-ssr-query integration that hydrates Query state through SSR,
+      the better-auth + @better-auth/drizzle-adapter setup, and the Nitro/Vite build config.
+      Updated the day before this research ran, so it tracks the fast-moving TanStack Start
+      API closely.
+    whatToAvoid: >-
+      Deliberately unopinionated — no payments, no email, no multi-tenancy, so it cannot be
+      the sole source for a full SaaS tier. TanStack Start's API is still moving; anything
+      copied needs a version pin and re-validation. Unlicense is not OSI-preferred by some
+      corporate policies even though it is maximally permissive.
+    proposedLayerIds:
+      - framework-tanstack-start
+      - db-postgres-drizzle
+      - auth-better-auth
+      - ui-shadcn-tailwind
+      # CORRECTED 2026-07-18: was api-server-actions (a Next.js concept — this is TanStack
+      # Start's createServerFn) and deploy-docker (no Dockerfile exists; only a
+      # docker-compose.yml for a local Postgres, which is a dev-DB layer, not a deploy layer).
+      - api-server-functions
+      - dev-docker-compose-postgres
+
+  # -------------------------------------------------------------- standard ---
+  - name: nextjs/saas-starter
+    url: https://github.com/nextjs/saas-starter
+    stars: 15969
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2025-12-11"
+    complexity: standard
+    stack: Next.js 15 App Router + Postgres + Drizzle + Stripe + JWT cookie sessions + Tailwind v4
+    whatToBorrow: >-
+      The official Vercel SaaS starter and the highest-signal "sensible default" in the
+      category. Borrow the db:setup / db:seed / db:generate / db:migrate / db:studio script
+      quartet and the Drizzle schema+migration layout wholesale — that is the cleanest
+      Postgres layer contract available. Also borrow the Stripe checkout + customer-portal
+      route handlers, the webhook handler, and the hand-rolled JWT-in-httpOnly-cookie session
+      implementation (a genuinely useful zero-dependency auth layer when you don't want
+      Clerk/Auth.js), plus the activity-log and RBAC-ish team/role tables.
+    whatToAvoid: >-
+      Auth is deliberately hand-rolled — no OAuth, no email verification, no password reset,
+      no MFA. Do not ship it as a complete auth layer; treat it as auth-session-cookie and
+      offer a real IdP layer alongside. Team/org modelling is minimal (single team per user
+      in practice). Strongly Vercel/Postgres-shaped in its deployment assumptions.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - db-postgres-drizzle
+      - auth-session-cookie
+      - payments-stripe-subscriptions
+      - tenancy-organizations
+      - rbac-permissions
+      - ui-shadcn-tailwind
+      - deploy-vercel
+
+  - name: t3-oss/create-t3-app
+    url: https://github.com/t3-oss/create-t3-app
+    stars: 29048
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2025-12-13"
+    complexity: standard
+    stack: CLI scaffolder — Next.js + TypeScript + tRPC + Prisma/Drizzle + NextAuth + Tailwind
+    whatToBorrow: >-
+      Uniquely valuable to Groundplan because it is itself a scaffolder: read cli/src/installers/*
+      to see how composable, independently-selectable layers are modelled and applied — each
+      installer declares its own deps, files and post-install edits, and index.ts composes
+      them. That is close to the exact architecture Groundplan needs. Also borrow the AST-free
+      template-merge strategy in cli/src/helpers/, the base vs conditional template split
+      under cli/template/{base,extras}/, and the t3-env typed-env pattern this project
+      popularised.
+    whatToAvoid: >-
+      The generated app is intentionally thin — no payments, no orgs, no email. Its templates
+      target a slightly older Next.js/NextAuth generation than the 2026 starters here. Don't
+      copy the CLI's own prompt/UX chrome; copy the installer composition model.
+    proposedLayerIds:
+      - scaffold-cli-generator
+      - framework-nextjs-app-router
+      - api-trpc
+      - db-postgres-prisma
+      - db-postgres-drizzle
+      - auth-nextauth
+      - ui-shadcn-tailwind
+      - tooling-t3-env
+
+  - name: CarlosZiegler/fullstack-start-template
+    url: https://github.com/CarlosZiegler/fullstack-start-template
+    stars: 290
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2025-10-20"
+    complexity: standard
+    stack: TanStack Start + Better Auth + Drizzle/Neon + tRPC-ish server fns + React Email + Sentry + Biome + AI SDK
+    whatToBorrow: >-
+      The "batteries included" counterpart to react-tanstarter, and the most complete
+      TanStack Start SaaS wiring found. Borrow the auth:generate script (generates the
+      Better Auth schema into Drizzle — a clean codegen contract for an auth layer), the
+      db:neon-setup and db:setup-vector scripts, the @react-email/components + preview-server
+      email layer with an email:dev script, the @sentry/tanstackstart-react instrumentation,
+      and the Biome-instead-of-ESLint/Prettier toolchain config.
+    whatToAvoid: >-
+      Only 290 stars and one maintainer — low bus factor, verify before depending on it.
+      It bundles a large AI surface (@ai-sdk/*, @openai/agents, @langchain/*, MCP SDK) that
+      is irrelevant to most SaaS scaffolds and should be stripped rather than carried; the
+      dependency tree is much heavier than the useful core. Neon-specific setup scripts need
+      generalising before they become a portable Postgres layer.
+    proposedLayerIds:
+      - framework-tanstack-start
+      - auth-better-auth
+      - db-postgres-drizzle
+      - email-react-email-resend
+      - observability-sentry
+      - tooling-biome
+      - ui-shadcn-tailwind
+      # jobs-inngest REMOVED 2026-07-18: package.json contains no inngest dependency at all.
+      # The repo has no background-job layer. (sentry, resend, react-email, biome all verified
+      # present.)
+
+  - name: Kiranism/next-shadcn-dashboard-starter
+    url: https://github.com/Kiranism/next-shadcn-dashboard-starter
+    stars: 6689
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    complexity: standard
+    stack: Next.js 15 + shadcn/ui + Clerk + TanStack Table/Query/Form + Sentry + Zod + Tailwind v4
+    whatToBorrow: >-
+      The strongest source for the authenticated-app-shell layer specifically: sidebar/nav
+      composition, parallel routes and route groups for dashboard sections, and a genuinely
+      good TanStack Table setup with server-side pagination/sorting/filtering driven by
+      URL search params (nuqs-style state). Borrow the data-table primitives, the
+      @tanstack/react-form + Zod form patterns, the Sentry config, and the feature-folder
+      layout under src/features/. Committed the day this research ran — very actively kept.
+    whatToAvoid: >-
+      Clerk is wired in as the default auth and is a hosted, paid-at-scale vendor — isolate
+      it behind an auth layer boundary rather than letting Clerk imports spread through the
+      UI. There is no database, no payments and no real backend: mock/fake data backs the
+      tables, so this is a UI-tier source only and must be composed with a data source.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - ui-shadcn-tailwind
+      - ui-dashboard-shell
+      - auth-clerk
+      - observability-sentry
+      - forms-tanstack-zod
+      - table-tanstack-server-pagination
+
+  - name: ixartz/Next-js-Boilerplate
+    url: https://github.com/ixartz/Next-js-Boilerplate
+    stars: 13023
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-08"
+    complexity: standard
+    stack: Next.js 15 + Drizzle + Clerk + next-intl + Sentry + Vitest + Playwright + Storybook + Arcjet
+    whatToBorrow: >-
+      The best-maintained "developer experience baseline" in the category — borrow the
+      tooling layer rather than the app. Specifically: the full CI matrix in
+      .github/workflows/, the ESLint flat-config, the Husky + lint-staged + commitlint
+      chain, semantic-release setup, the Vitest browser-mode + Playwright split, Storybook
+      wiring, and the Sentry + Arcjet (bot/rate-limit) integration. Its i18n via next-intl
+      is the cleanest reference implementation available.
+    whatToAvoid: >-
+      Very opinionated and dependency-dense for a "boilerplate"; the tooling surface is
+      larger than many teams want and upgrades are frequent enough to churn. Clerk and
+      Arcjet are hosted vendors baked into the defaults. Strip the marketing/demo pages.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - db-postgres-drizzle
+      - auth-clerk
+      - i18n-next-intl
+      - observability-sentry
+      - testing-vitest
+      - testing-playwright
+      - tooling-eslint-prettier
+      - tooling-husky-commitlint
+      - ci-github-actions
+      - security-arcjet
+
+  - name: nextacular/nextacular
+    url: https://github.com/nextacular/nextacular
+    stars: 1376
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-05-30"
+    complexity: standard
+    stack: Next.js + Prisma/Postgres + NextAuth + Stripe + i18next + workspaces/subdomain multi-tenancy
+    whatToBorrow: >-
+      The clearest open reference for real multi-tenancy: borrow the workspace model
+      (prisma/schema.prisma), the subdomain and custom-domain routing middleware, the
+      workspace-scoped member/invitation flow with email invites, and the tenant-scoped
+      query guards. Most starters here stop at "teams"; this one actually implements
+      subdomain tenancy end to end, which is the hard part to get right.
+    whatToAvoid: >-
+      Still Pages Router — the app structure is a generation behind and should be treated as
+      a domain-model reference, not a code-copy source for App Router projects. i18next
+      rather than next-intl. Modest star count and slow cadence; verify Prisma/NextAuth
+      versions before adopting.
+    proposedLayerIds:
+      - framework-nextjs-pages-router
+      - db-postgres-prisma
+      - auth-nextauth
+      - payments-stripe-subscriptions
+      - tenancy-subdomain-multitenant
+      - tenancy-organizations
+      - email-transactional-invites
+
+  - name: vercel/nextjs-subscription-payments
+    url: https://github.com/vercel/nextjs-subscription-payments
+    stars: 7722
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: false
+    lastCommit: "2025-01-23"
+    complexity: standard
+    stack: Next.js App Router + Supabase (auth + Postgres + RLS) + Stripe subscriptions
+    whatToBorrow: >-
+      ARCHIVED but still the canonical reference for Stripe<->database subscription state
+      sync, which is the single most error-prone part of a SaaS build. Borrow
+      supabase/migrations/*.sql (products/prices/subscriptions tables mirroring Stripe's
+      object model), the RLS policies, and the webhook handler that upserts Stripe events
+      into those tables idempotently. Also a good Supabase Auth + SSR cookie reference.
+    whatToAvoid: >-
+      Archived by Vercel on GitHub — no upstream, no security updates, and its Next.js and
+      @supabase/* versions are pinned to early-2025. Do not track it; lift the SQL schema
+      and webhook logic and re-implement against current SDKs. Deeply Supabase-coupled.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - db-supabase-postgres
+      - auth-supabase
+      - payments-stripe-subscriptions
+      - security-rls-policies
+      - deploy-vercel
+
+  # ---------------------------------------------------------- professional ---
+  - name: ixartz/SaaS-Boilerplate
+    url: https://github.com/ixartz/SaaS-Boilerplate
+    stars: 7291
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-02"
+    complexity: professional
+    stack: Next.js 15 + Drizzle + Clerk (orgs/roles) + Stripe + next-intl + Sentry + Vitest/Playwright/Storybook
+    whatToBorrow: >-
+      The most complete MIT-licensed SaaS boilerplate that is still actively maintained.
+      Borrow the multi-tenant organization + role model built on Clerk Organizations, the
+      Stripe subscription/plan configuration split (plans declared as data, not inline), the
+      @t3-oss/env-nextjs config boundary, the dashboard shell, and the unusually thorough
+      test pyramid (Vitest browser mode + Playwright + Storybook + Chromatic). The i18n and
+      Sentry layers are shared with Next-js-Boilerplate and are equally solid.
+    whatToAvoid: >-
+      Multi-tenancy is implemented *through Clerk Organizations* — that is real vendor
+      lock-in at the data-model level, not just the login screen, and it is the main thing to
+      re-architect if you want a portable tenancy layer. Heavy dependency surface. The
+      author also sells a paid "Pro" variant, so the OSS repo intentionally stops short in
+      places (fewer prebuilt pages/components).
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - db-postgres-drizzle
+      - auth-clerk
+      - tenancy-organizations
+      - rbac-permissions
+      - payments-stripe-subscriptions
+      - i18n-next-intl
+      - observability-sentry
+      - testing-vitest
+      - testing-playwright
+      - ci-github-actions
+
+  - name: epicweb-dev/epic-stack
+    url: https://github.com/epicweb-dev/epic-stack
+    stars: 5542
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-06-02"
+    complexity: professional
+    stack: React Router v7 (ex-Remix) + Prisma/SQLite(LiteFS) + hand-rolled auth + passkeys + TOTP 2FA + Fly.io
+    whatToBorrow: >-
+      Kent C. Dodds' production stack and the strongest non-Next.js entry. It owns its auth
+      instead of renting it: borrow the @simplewebauthn passkey registration/login flow, the
+      @epic-web/totp 2FA implementation, the session + "remember me" + email-verification
+      flows, and the permissions/roles seed. Also borrow the Conform + Zod progressive-
+      enhancement form pattern (works without JS), @epic-web/cachified caching, the
+      error-boundary conventions, and its very complete Playwright + MSW test setup.
+      Best available source for auth-passkeys and auth-2fa-totp layers.
+    whatToAvoid: >-
+      Strongly coupled to Fly.io + SQLite/LiteFS for its distributed-database story; that
+      deployment layer does not transfer to Vercel/Postgres and must be swapped. Large and
+      opinionated — it is a whole application, and stripping it down is real work. The
+      React Router v7 naming/migration churn means older docs and blog posts about "Epic
+      Stack Remix" no longer match the code.
+    proposedLayerIds:
+      - framework-react-router-v7
+      - db-sqlite-prisma
+      - auth-session-cookie
+      - auth-passkeys
+      - auth-2fa-totp
+      - rbac-permissions
+      - forms-conform-zod
+      - email-react-email-resend
+      - observability-sentry
+      - testing-playwright
+      - testing-msw
+      - deploy-fly-io
+
+  - name: alan2207/bulletproof-react
+    url: https://github.com/alan2207/bulletproof-react
+    stars: 35562
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-05-14"
+    complexity: professional
+    stack: Architecture guide + reference apps (Next.js App Router, Next.js Pages, Vite React, React Native)
+    whatToBorrow: >-
+      Not a SaaS kit — the architecture rulebook that should govern how Groundplan lays out every
+      React template. Borrow the feature-sliced directory convention (src/features/<name>/
+      {api,components,hooks,stores,types}), the "no cross-feature imports" ESLint
+      import/no-restricted-paths rule (docs/ + .eslintrc), the unidirectional dependency
+      graph (shared -> features -> app), the api-layer/query-factory pattern over TanStack
+      Query, and the testing and error-handling docs. It ships four parallel reference apps,
+      so the same conventions can be applied per framework layer.
+    whatToAvoid: >-
+      Provides no auth, payments, tenancy or database — zero SaaS functionality, so it can
+      never be a standalone template, only a structural overlay. Some guidance is
+      deliberately generic and a few reference apps lag the newest framework releases.
+      Applying the full convention set to a tiny project is over-engineering.
+    proposedLayerIds:
+      - arch-feature-sliced
+      - lint-import-boundaries
+      - api-layer-tanstack-query
+      - testing-vitest
+      - testing-msw
+      - tooling-eslint-prettier
+
+  # ------------------------------------------------------------ enterprise ---
+  - name: Blazity/next-enterprise
+    url: https://github.com/Blazity/next-enterprise
+    stars: 7428
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-05-18"
+    complexity: enterprise
+    stack: Next.js + OpenTelemetry/@vercel/otel + Storybook + Playwright + semantic-release + CVA + t3-env
+    whatToBorrow: >-
+      The governance and release-engineering layer, which no other entry here covers
+      properly. Borrow the OpenTelemetry setup (@opentelemetry/sdk-node + @vercel/otel
+      instrumentation.ts) as a vendor-neutral observability layer, the semantic-release
+      config with conventional commits and automated changelog, the bundle-analyzer and
+      bundle-size CI gates, the Storybook + test-runner + a11y setup, and the CVA
+      (class-variance-authority) component-variant conventions.
+    whatToAvoid: >-
+      "Enterprise" here means process and tooling, not application features — there is no
+      auth, no database, no payments, no tenancy, so it is an overlay rather than a SaaS
+      base. The Babel plugins in devDependencies signal some legacy tooling carried forward.
+      Storybook 7-era addon packages suggest parts of the toolchain are due an upgrade.
+    proposedLayerIds:
+      - framework-nextjs-app-router
+      - observability-opentelemetry
+      - release-semantic-release
+      - tooling-storybook
+      - tooling-t3-env
+      - testing-playwright
+      - ci-github-actions
+      - perf-bundle-budget
+
+  # CORRECTED 2026-07-18: was recorded as calcom/cal.com. github.com/calcom/cal.com
+  # 301-redirects here; this is a distinct MIT, enterprise-stripped distribution, NOT
+  # evidence that the Cal.com product relicensed. Do not source from cal.com itself.
+  - name: calcom/cal.diy
+    url: https://github.com/calcom/cal.diy
+    stars: 46574
+    spdx: MIT
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-09"
+    complexity: enterprise
+    stack: Turborepo monorepo + Next.js + Prisma/Postgres + tRPC + NextAuth v4 + Stripe + next-i18next + app store
+    whatToBorrow: >-
+      A community MIT fork of Cal.com with all enterprise/commercial code removed — verified
+      MIT at raw LICENSE, and verified as the redirect target of the old cal.com URL. Rare in
+      being a genuine production-scale codebase that is safely vendorable. Borrow the Turborepo
+      layout (apps/web + packages/features + packages/ui + packages/prisma — all four confirmed
+      present) as the model for an enterprise monorepo layer, the tRPC router composition and
+      middleware, the app-store/plugin architecture under packages/app-store for extensibility,
+      the Prisma booking/availability domain model, and the webhook subsystem.
+    whatToAvoid: >-
+      DO NOT source from Cal.com itself — this repo is a stripped fork, not proof that the
+      Cal.com product relicensed; Cal.com remains open-core with commercially-licensed code.
+      Confirm you are on the cal.diy remote before copying anything.
+      Its README states Teams, Organizations, Insights, Workflows and SSO/SAML have been
+      REMOVED, so this is NOT a source for tenancy, org/seat modelling or seat-based billing —
+      an earlier revision of this file wrongly claimed all three. Dependencies are dated:
+      next-auth 4.24, stripe 9.16, @stripe/stripe-js 1.35, i18next 23 — pin and re-validate.
+      Enormous, with a deeply interlinked internal dependency web; extraction is surgical work.
+      MIT attribution still required. Long build and setup times.
+    proposedLayerIds:
+      - tooling-turborepo
+      - framework-nextjs-app-router
+      - db-postgres-prisma
+      - api-trpc
+      - auth-nextauth
+      # tenancy-organizations / rbac-permissions / payments-stripe-seats REMOVED 2026-07-18:
+      # README confirms Teams, Organizations and SSO/SAML were stripped from this fork.
+      # i18n corrected: package.json shows next-i18next + i18next, NOT next-intl.
+      - i18n-next-i18next
+      - webhooks-outbound
+      - plugin-app-store
+
+  - name: supabase/supabase
+    url: https://github.com/supabase/supabase
+    stars: 106526
+    spdx: Apache-2.0
+    licenseClass: vendorable
+    maintained: true
+    lastCommit: "2026-07-18"
+    complexity: enterprise
+    stack: Turborepo monorepo — Studio (Next.js), docs, and dozens of framework starter examples
+    whatToBorrow: >-
+      Treat as a library of verified starters rather than one template: examples/ contains
+      maintained Next.js, React Router, SvelteKit, Nuxt and Expo integrations, and
+      examples/user-management/* plus the auth SSR helpers are the reference for cookie-based
+      Supabase auth in App Router. Borrow the RLS policy patterns and SQL migrations under
+      supabase/migrations, the local-dev docker-compose stack, the type-generation flow
+      (supabase gen types typescript) as a db-codegen layer contract, and Studio's own
+      dashboard architecture as an enterprise UI reference.
+    whatToAvoid: >-
+      Apache-2.0 carries a real attribution obligation the MIT entries do not: retain the
+      license text and any copyright/attribution headers on copied files, and state changes
+      you make. (Verified 2026-07-18: there is no NOTICE file in this repo — root /NOTICE
+      404s — so the §4(d) NOTICE-propagation duty does not apply here; an earlier revision of
+      this file wrongly said a NOTICE must be preserved. The other §4 duties still apply.) The monorepo is huge and mostly irrelevant to a scaffold; take only
+      examples/ and the SQL. Everything assumes Supabase-hosted or self-hosted Supabase, so
+      the auth and storage layers are not portable to a plain Postgres target without work.
+    proposedLayerIds:
+      - db-supabase-postgres
+      - auth-supabase
+      - security-rls-policies
+      - db-codegen-types
+      - storage-supabase
+      - realtime-supabase
+      - deploy-docker
+
+droppedCandidates:
+  - "theodorusclarence/ts-nextjs-tailwind-starter — 3417 stars, active (2025-07-24), but NO license file exists (LICENSE/LICENSE.md/LICENSE.txt/license/COPYING all return 404 and GitHub detects no license). Absence of a license means all rights reserved => EXCLUDED, not permissive. Would otherwise have been a strong 'simple' entry."
+  - "dubinc/dub — 24077 stars, very active. LICENSE.md re-verified 2026-07-18: it is a SPLIT open-core license ('Portions of this software are licensed as follows...') combining AGPL-3.0 with commercially-licensed portions, not plain AGPL-3.0 as first recorded. EXCLUDED either way — both halves fail the gate."
+  - "documenso/documenso — AGPL-3.0 (verified from LICENSE text), 13964 stars, active. EXCLUDED for the same reason; also has a paid enterprise tier."
+  - "formbricks/formbricks — 12563 stars, active. LICENSE re-verified 2026-07-18: SPLIT open-core license ('Portions of this software are licensed as follows'), AGPL-3.0 plus commercial portions, not plain AGPL-3.0. EXCLUDED either way."
+  - "midday-ai/midday — AGPL-3.0 (verified from LICENSE text), 14592 stars, active. EXCLUDED. Frequently recommended as a modern monorepo SaaS reference — worth reading for ideas only, never copying."
+  - "unkeyed/unkey — 5394 stars, active. LICENSE re-verified 2026-07-18: SPLIT open-core license ('Portions of this software are licensed as follows'), not plain AGPL-3.0. EXCLUDED either way."
+  - "shadcn-ui/taxonomy — MIT, 19272 stars. Not GitHub-archived, and its most recent commit (2026-04-20) is the archive notice itself; the README now states the project is officially archived, uses deprecated Next.js 13-era APIs and is 'not recommended for use in production'. Dropped as a dead source despite the permissive license and high star count."
+  - "steven-tey/precedent — MIT, 5109 stars, last commit 2024-10-02 (~21 months) => STALE by the 18-month rule."
+  - "mickasmt/next-saas-stripe-starter — MIT, 2997 stars, last commit 2024-07-26 (~24 months) => STALE."
+  - "sadmann7/skateshop — MIT, 5458 stars, last commit 2024-07-15 (~24 months) => STALE. Good Stripe Connect marketplace reference historically, but unmaintained."
+  - "juliusmarminge/acme-corp — MIT, 1176 stars, last commit 2024-01-19 (~30 months) => STALE. Was a good T3-turbo SaaS monorepo reference."
+  - "async-labs/saas — MIT, 4492 stars, last commit 2025-03-21 (~16 months, just inside the staleness window) but the stack (Next.js Pages Router + MobX + Express) is a full generation out of date. Dropped on practical grounds rather than the date rule."
+  - "remix-run/indie-stack — MIT, 1143 stars, ARCHIVED on GitHub. Superseded by epicweb-dev/epic-stack, which is included above."
+  - "saas-js/saas-ui — MIT, 1635 stars, very active (2026-07-18), but the OSS repo is a Chakra UI component library, not a SaaS starter; the actual 'SaaS starter kit' is the paid Pro product. Open-core split makes it weak source material for a scaffolder."
+
+notes: >-
+  Verification caveat stated plainly: the unauthenticated api.github.com JSON API (60 req/hr
+  per IP) was fully consumed by concurrent sibling research workflows sharing this machine's
+  IP, and WebFetch against api.github.com returned 403 as well. Rather than report unverified
+  numbers, every figure above was taken from an alternative GitHub primary source — the
+  rendered repo page for exact star counts and archived status, the commits Atom feed for
+  last-commit dates, and the raw LICENSE file text for licensing. Licenses are therefore
+  verified more strongly than an spdx_id lookup would provide, because the actual license
+  text was fetched and pattern-matched against canonical license bodies, then cross-checked
+  against GitHub's own license classification. No number here comes from memory or a blog post.
+
+  CORRECTION (adversarial pass, 2026-07-18): the previous headline finding here — "calcom/cal.com
+  has relicensed to MIT" — was FALSE and has been removed. What actually happened is that
+  github.com/calcom/cal.com 301-redirects to github.com/calcom/cal.diy, an MIT-licensed
+  community fork with all enterprise/commercial code stripped, and raw.githubusercontent
+  silently follows the rename. Cal.com the product has NOT relicensed; it remains open-core.
+  The entry has been retargeted to calcom/cal.diy, where MIT is genuine and verified. The
+  practical consequence: the enterprise tier gains an MIT monorepo/tRPC/app-store reference,
+  but NOT an orgs/tenancy/seat-billing reference — cal.diy's README confirms Teams,
+  Organizations, Insights, Workflows and SSO/SAML were removed from the fork. Tenancy coverage
+  therefore still rests on nextacular (subdomain tenancy) and ixartz/SaaS-Boilerplate
+  (Clerk Organizations). Treat any "cal.com is MIT now" claim elsewhere as the same redirect trap.
+
+  The AGPL-3.0 cluster (dub, documenso, formbricks, midday, unkey) is large,
+  popular and actively recommended across the ecosystem; all five are hard-excluded here
+  because copying from them would force network copyleft onto every repo Groundplan generates.
+  That is the most likely license trap for this category and is called out explicitly.
+
+  Coverage: the strongest tiers are standard and professional. The simple tier is thin — the
+  best minimal candidate (ts-nextjs-tailwind-starter) had to be excluded for having no license
+  at all, leaving Skolaczk/next-starter and dotnize/react-tanstarter, both single-maintainer
+  projects. Consider authoring the simple tier in-house rather than sourcing it. Non-Next.js
+  coverage rests on epic-stack (React Router v7) and two TanStack Start entries; TanStack Start
+  is moving fast enough that anything borrowed needs version pinning. Note also that several
+  entries are overlays rather than bases — bulletproof-react, next-enterprise and
+  Next-js-Boilerplate contribute architecture, release engineering and tooling layers but ship
+  no SaaS features, so the build plan should compose them onto nextjs/saas-starter or
+  SaaS-Boilerplate rather than treating them as standalone templates. Only supabase/supabase is
+  Apache-2.0 and thus carries an attribution obligation (license text + copyright headers +
+  change notices; note there is no NOTICE file in that repo, so no NOTICE duty attaches); every
+  other included source is MIT except react-tanstarter, which is Unlicense (public domain, zero
+  attribution burden).
+
+  Layer-id hygiene (adversarial pass, 2026-07-18): three ids asserted capabilities the repos do
+  not have and were removed or renamed — jobs-inngest on fullstack-start-template (no inngest
+  dependency anywhere in package.json), and api-server-actions / deploy-docker on
+  react-tanstarter (a Next.js concept misapplied to TanStack Start server functions; and no
+  Dockerfile exists, only a local-Postgres docker-compose.yml). tenancy-rbac and rbac-permissions
+  were two ids for one concept across three entries and are now normalised to rbac-permissions.
+  cal.diy's i18n-next-intl was corrected to i18n-next-i18next per its package.json. All 15
+  entries survive the license gate; no entry was dropped in this pass.