Glossary
Plain-language definitions for the kit-specific nouns and web concepts these docs lean on.
Short definitions for the SyntaxKit-specific terms and web concepts these docs lean on. Grouped by topic and cross-linked to the page that owns each one. Use Cmd-F or the jump cards below. Missing something? Email the support address on the License page and we'll add it.
Auth & sessions
Better Auth, passkeys, 2FA, and the cookies behind a session.
Organizations
Active org, personal org, and the multi-tenant guards.
Data & API
Prisma adapters, migrations, oRPC, packages, and uploads.
Frontend & i18n
Styling helpers, server vs client components, and locale routing.
Billing & webhooks
Billing providers, signing secrets, and idempotent event handling.
Security & abuse
CORS, CSP, CSRF, rate limits, and captcha.
Email & observability
Transactional mail, deliverability, analytics, and logs.
Build & deployment
Env timing, capabilities, the setup doctor, and the monorepo.
Auth & Sessions
| Term | Definition |
|---|---|
| Better Auth | The self-hosted auth library behind packages/auth: sessions, OAuth, 2FA, passkeys, and the multi-tenant org model (via plugins). No per-MAU pricing. Authentication. |
| Passkey | Phishing-resistant sign-in using device-bound key pairs (Touch ID, Windows Hello, hardware keys). Built on WebAuthn via Better Auth's passkey plugin. Passkeys. |
| Platform admin | A User.role = "admin" (distinct from per-org roles) that gates /dashboard/admin and the admin oRPC namespace. Bootstrap with pnpm admin:bootstrap --email <email>. Platform Admin Role. |
| SameSite cookie | A cookie attribute (Strict / Lax / None) controlling cross-site sends. The kit uses sameSite=lax for session cookies to blunt CSRF without breaking inbound links. |
| Session cookie | The httpOnly, sameSite=lax cookie Better Auth sets after sign-in. Encrypted with BETTER_AUTH_SECRET; carries the user id and activeOrganizationId. How Sessions Work. |
| Two-Factor Auth | A second sign-in factor: TOTP codes from an authenticator app plus single-use backup codes, wired via Better Auth's twoFactor plugin. Two-Factor Auth. |
Organizations
| Term | Definition |
|---|---|
| Active organization | The org the current session is acting on. The session carries activeOrganizationId; the withActiveOrganization middleware puts context.organization on every signed-in oRPC call. The Active Organization. |
| Last-owner protection | A guard that blocks removing or demoting an org's only remaining owner, holding an organization-specific advisory lock through authorization and the membership write. Guards That Keep Things Sane. |
| Personal organization | An org auto-created for each user on sign-up (isPersonalOrganization: true), so single-user accounts feel native. Structurally identical to a team org. Organizations. |
Data & API
| Term | Definition |
|---|---|
| Composite project | A TypeScript project (tsc -b) that emits declaration files for other packages. Used by packages/shared and packages/api so their types are shared across the workspace. |
| Driver adapter | A pluggable Prisma layer for a specific Postgres protocol. The kit picks @prisma/adapter-neon for *.neon.tech hosts and @prisma/adapter-pg everywhere else. Database. |
| Migration vs seed | A migration is a versioned schema change (prisma migrate dev); a seed loads starter data (prisma db seed). Seeds ship in three modes: bootstrap, demo, test. Database. |
| oRPC | The OpenAPI-native typed RPC framework behind packages/api: end-to-end TypeScript plus a generated spec at /api-reference. API. |
| Pre-signed URL | A short-lived S3 URL letting the browser PUT bytes straight to a bucket key, bypassing serverless body-size limits. How An Upload Flows. |
| Subpath export | A package.json exports entry exposing one file under a sub-path (e.g. @syntaxkit/analytics/client), so consumers pull only the client or server half. Package Map. |
Frontend & i18n
| Term | Definition |
|---|---|
cn helper | clsx plus tailwind-merge, from @syntaxkit/ui/lib/utils. Caller-side className wins over the cva default, ending Tailwind specificity wars. Base Components. |
cva | class-variance-authority: turns Tailwind class strings into typed component variants. Every shadcn-style primitive uses it. Base Components. |
| Locale routing | Two i18n strategies in parallel: marketing routes are URL-prefixed (/en/..., /de/...); the dashboard reads a NEXT_LOCALE cookie at render time. Internationalization. |
next-intl | The i18n library powering both locale strategies (URL-prefix marketing, cookie-driven dashboard). Internationalization. |
| OKLCH | A perceptually uniform color space (oklch(L C H)) used for every color token in packages/ui. Pick colors at oklch.com. Brand Tokens. |
| Server action | A Next.js "use server" function called from the client. Used sparingly (e.g. the setLocale action). Multi-instance deploys need a shared NEXT_SERVER_ACTIONS_ENCRYPTION_KEY. Operational Secrets. |
| Server component vs client component | App Router primitives: server components render server-side and ship no JS; client components ("use client") ship interactive code. Calling The API From React. |
| shadcn/ui | A pattern (and CLI) for copying React primitives into your own repo instead of installing them. The kit's packages/ui is yours to edit. Customization. |
Billing & Webhooks
| Term | Definition |
|---|---|
| Best-effort side effect | An email or analytics dispatch wrapped so its failure doesn't fail the webhook; the OutboundEffect claim is released so the provider's next retry tries again. Best-Effort Side Effects. |
| Billing provider | The payment service a deployment bills through: Stripe (default), Polar, or Creem, selected by BILLING_PROVIDER. Exactly one is active; each persisted subscription and webhook event row carries a provider discriminator. Switching never migrates subscriptions. Choosing A Billing Provider. |
| Creem | The third shipped billing provider, and a merchant of record. BILLING_PROVIDER=creem. Portal and in-app resume ship; manual webhook replay does not; seats are not advertised. Connecting Creem. |
CREEM_PRODUCT_ID_* | Server-only Creem product id for one catalog price (for example CREEM_PRODUCT_ID_PRO_MONTHLY). Required when Creem is the active provider. Never reaches the client. Connecting Creem. |
CREEM_SERVER | Creem API environment: test or prod. Defaults to prod when unset. test in a production build is a doctor warning. |
| Billing provider mismatch | Issue code billing_provider_mismatch: a live subscription row belongs to a provider other than the active one. Resolves to the blocking configuration_error phase; the doctor counts such rows before boot. Switching never migrates anything. |
| Capabilities (billing) | The declared BillingProviderCapabilities flags per adapter (portal, resume, plan change in portal, manual webhook replay, kit-sent receipts, trial-ending notification). UI and support console read them instead of special-casing a provider. What each provider can do. |
| Live mode vs test mode | Stripe's two environments: test (sk_test_*) for fake cards, live (sk_live_*) for real charges. Signing secrets and price ids differ between them. Polar's equivalent is the sandbox vs production split selected by POLAR_SERVER. Creem's equivalent is CREEM_SERVER (test or prod). Pricing And Stripe Live Mode. |
| Merchant of record | The legal seller of record. Polar and Creem are both merchants of record: Polar invoices the customer and collects and remits tax, and the kit does not send receipts or trial reminders for either of them. Creem seats are not advertised. With Stripe, you are the merchant. Connecting Polar, Connecting Creem. |
| OutboundEffect | A Postgres table keyed by (kind, key) that records each email/analytics dispatch, so retries can't double-send. Two-Layer Idempotency. |
| Provider price reference | The server-only identifier a catalog price resolves to for the active provider: a Stripe Price ID (STRIPE_PRICE_ID_*), a Polar Product ID (POLAR_PRODUCT_ID_*), or a Creem product id (CREEM_PRODUCT_ID_*). Never reaches the client. Pricing Plans And Catalog. |
| Recency guard | The canonical subscription write rejects a payload whose provider event time is older than the row's last recorded one, so late redeliveries cannot roll state backwards. Shared by Stripe, Polar, and Creem. Reconciliation. |
| Stale processing recovery | Recovers webhook events whose handler crashed mid-run: after the lease window, the next retry may re-claim and re-run it. Stale Processing Recovery. |
| Standard Webhooks | The signing scheme Polar uses: webhook-id, webhook-timestamp, and webhook-signature headers with a five-minute tolerance. The kit accepts both encodings a Polar secret can have. The Polar Webhook. |
| Stripe webhook signing secret | The secret Stripe signs payloads with; the kit verifies every event via stripe.webhooks.constructEvent. The production secret differs from the Stripe-CLI one. Endpoint And Signature Verification. |
| StripeWebhookEvent | A Postgres table keyed by eventId ensuring each webhook event is processed exactly once. Shared by Stripe, Polar, and Creem (the name is historical; the provider column qualifies each row). One half of two-layer idempotency. Two-Layer Idempotency. |
| Two-layer idempotency | The webhook dedupe story: StripeWebhookEvent.eventId blocks duplicate event ids; OutboundEffect.(kind, key) blocks duplicate business actions. Two-Layer Idempotency. |
Security & Abuse
| Term | Definition |
|---|---|
| CORS | Cross-Origin Resource Sharing: HTTP headers deciding whether a browser may call your API from another origin. proxy.ts scopes it to NEXT_PUBLIC_APP_URL. Edge: Headers, CSP, CORS. |
| CSP | Content Security Policy: an allow-list header limiting which origins can load scripts, styles, fonts, etc. Set strict via Nosecone plus a curated allow-list. Edge: Headers, CSP, CORS. |
| CSRF | Cross-Site Request Forgery: tricking a user's browser into an authenticated request to your site. Mitigated by httpOnly, sameSite=lax session cookies set explicitly in packages/auth/src/server.ts. |
| Rate limit | A sliding-window counter capping requests over time (e.g. 5 per 10s). Backed by Upstash Redis on auth, contact, and other public surfaces. Abuse Protection (Upstash). |
| Turnstile | Cloudflare's captcha alternative to reCAPTCHA, used for auth flows (Better Auth's captcha plugin) and the public contact form. Authentication: Sessions And Captcha. |
Email & Observability
| Term | Definition |
|---|---|
| OpenTelemetry | The observability standard the kit uses for structured logs, exporting OTLP records to PostHog Logs. Structured Logging. |
| PostHog | One vendor for all telemetry: product and web analytics, session replay, error tracking, and structured logs. Analytics and Monitoring. |
| Reverse proxy | A Next.js rewrite routing /ingest/* to PostHog, defeating ad-blockers (same-origin) and simplifying CSP. The Reverse Proxy. |
| Source map upload | A build step (withPostHogConfig) that uploads JS source maps to PostHog so stack traces de-minify. Needs POSTHOG_API_KEY and POSTHOG_PROJECT_ID. Source Maps. |
| SPF, DKIM, DMARC | Three DNS records that prove your domain may send email; without them, Gmail and Outlook deliverability drops sharply. Email Sender Configuration. |
| Transactional email | Email triggered by a specific user action (verification, receipt) rather than bulk marketing. Delivered through Plunk, Resend, Postmark, Brevo, SendGrid, or SMTP, templated with React Email. Email. |
Build & Deployment
| Term | Definition |
|---|---|
| Build-time vs runtime env | Every NEXT_PUBLIC_* var is inlined into the JS bundle at build time, so changing one needs a rebuild; server secrets are read at runtime. Build-Time vs Runtime Env. |
| Capability | A boolean for whether a feature's env-var group is fully configured (isBillingEnabled, etc., from packages/shared/src/setup.ts). Drives graceful degradation everywhere. Environment Variables. |
dotenvx | The .env-loading CLI behind the kit's test, integration, E2E, and webserver scripts. Loads files by priority; --overload overrides host env. Commands And Scripts. |
| Setup Doctor | The pnpm setup:doctor script: validates the env file, lists which integrations are configured, and confirms the database is reachable. Run after a fresh clone. Commands And Scripts. |
| Standalone output | A Next.js build option (output: "standalone") producing a self-contained Node server with only the deps actually used. Both apps use it to keep Docker images small. Deployment. |
| Turborepo | The monorepo task runner: caches lint, check-types, build, test and orders tasks so ^db:generate runs before any build. The Build Pipeline. |