Everything you need toship with confidence.

NextOne.dev is built on Next.js 16, React 19, TypeScript 5.5 and Tailwind CSS 4. You need Node.js 20 or later, pnpm 9+, a PostgreSQL 14+ database, and optionally Redis for rate limiting.

All environment values are validated by src/lib/env.ts in production. Run the commands below to check your toolchain.

Copy the repository, install dependencies with pnpm, then generate the Prisma client and run migrations.

Create your first admin with pnpm admin:create so you can log into the panel.

Copy .env.example to .env.local and fill in at least AUTH_SECRET, DATABASE_URL and NEXT_SERVER_ACTIONS_ENCRYPTION_KEY. AI key encryption also needs AI_SECRET_ENCRYPTION_KEY when FEATURE_AI is enabled.

Payment, email and media integrations run in local-only mode until their service keys are provided.

The schema lives in prisma/schema.prisma. Migrations use Prisma Migrate and are checked into prisma/migrations.

After migrating, use pnpm admin:create to create an admin user, then sign in at /panel.

The App Router routes are grouped by audience: (marketing), (auth), (panel) and (app). Shared server logic lives in src/lib, services and actions; reusable components are in src/components.

Public assets, dictionaries and the Prisma schema sit at the project root.

Marketing and public pages are Server Components that fetch data directly from Prisma or services. Mutations go through validated Server Actions in src/actions and src/services.

The API layer handles webhooks (Polar, UploadThing) and external callbacks; it verifies signatures before updating local records.

Users have roles managed in the User model. The panel uses role checks; public routes rely on NextAuth sessions. Audit logging tracks sensitive actions when FEATURE_AUDIT is enabled.

Disable entire modules by setting FEATURE_<NAME>=false in your environment. This removes the route group and navigation entries.

Auth is built on NextAuth v5. Users can sign up with email and password or OAuth providers. Password reset, profile management and role checks are included.

Session configuration and adapter setup are centralized; validate every action with parseActionInput() from src/lib/validation.ts.

The blog module uses a Tiptap editor with sanitized HTML output. Posts support categories, tags, cover images and moderation-gated comments.

Sanitize HTML before storing with sanitizeHtml() from src/lib/sanitize.ts to prevent XSS.

Campaigns are built with a GrapesJS visual editor and rendered to responsive MJML. The mail provider abstraction lets you switch between Resend and SMTP without rewriting templates.

Set MAIL_PROVIDER=resend or smtp and provide the matching environment variables.

AI provider API keys are encrypted at rest with AES-256-GCM using AI_SECRET_ENCRYPTION_KEY. Admins can add multiple providers and models from the panel.

Prompts live in src/lib/ai-prompts and generate SEO metadata, blog drafts and image prompts.

Products created in the admin panel sync to Polar via src/services/polar-sync.ts. Customers check out on a Polar-hosted page; webhooks update local subscriptions and orders.

Configure POLAR_ACCESS_TOKEN, POLAR_ORGANIZATION_ID, POLAR_SERVER and POLAR_WEBHOOK_SECRET for production.

UploadThing handles image and video uploads through src/app/api/uploadthing/core.ts. File size and count limits are configurable in the admin Media settings and stored in the Setting table.

Changes take effect after a server restart. UploadThing returns a route config to the client automatically.

Unit tests use Vitest with jsdom and React Testing Library. E2E tests use Playwright and auto-start the dev server.

The CI workflow runs lint, typecheck, unit tests, E2E tests and build in parallel jobs.

Run pnpm build locally before deploying to catch type and build errors. The production build validates required environment variables.

You can deploy to Vercel by connecting the repository or run the provided Docker image for self-hosted environments.

Expose a simple health route or use your platform's monitoring for the /api/webhooks/polar endpoint. Log webhook failures and replay events from Polar's dashboard when needed.

Schedule regular PostgreSQL backups and test restores. Keep AUTH_SECRET and encryption keys in a secrets manager.

Every server action validates input with Zod through parseActionInput(). Never trust client-provided data. Roles are checked before executing admin mutations.

Panel routes live under (panel) and use session-based guards. API routes verify Polar webhook signatures and UploadThing tokens.

Rate limiting uses Upstash Redis in production with an in-memory fallback for development. Dedicated limiters cover login, password reset, 2FA, contact, newsletter and general mutations.

Configure UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN to enable distributed rate limiting.

AUTH_SECRET signs sessions. NEXT_SERVER_ACTIONS_ENCRYPTION_KEY encrypts Server Actions in production. AI_SECRET_ENCRYPTION_KEY protects AI provider keys.

POLAR_WEBHOOK_SECRET validates Polar webhook signatures. Generate all secrets with a cryptographically secure random generator and rotate them on any suspected leak.

Before going live, confirm all required environment variables are set, migrations are deployed, rate limiting is backed by Redis, and webhooks are reachable with a valid secret.

Enable HTTPS, set up backups, review feature flags, and run a full security and accessibility audit.