Start with the fire already lit.

Already burning

Not a roadmap. The starter ships with all of it working — deployed, wired together, and covered by tests.

Two Workers, one stack

A private Effect v4 backend owns D1, KV, R2, email, and every secret. The public TanStack Start Worker is the sole ingress and forwards to it over a service binding — the data plane is never exposed to the internet.

Wrangler-zero

There is no wrangler.jsonc. Resources, bindings, migrations, and secrets are declared in TypeScript, and one Alchemy stack deploys both Workers — D1 migrations apply on deploy.

A stage per branch

deploy --stage pr-123 mints a full isolated copy: fresh Workers, fresh data, its own minted secrets. Destroy the stage and it’s gone, cleanly.

Passwordless sign-in

Better Auth emails a six-digit code — no passwords stored, no reset flow. The identity and the person are separate tables sharing one id, and sessions live in KV.

Payments without the money path

Polar is the Merchant of Record for a lifetime purchase: hosted checkout, receipts, and taxes. The Worker only records the entitlement — and previews run against the sandbox.

Media on R2

Avatar uploads land in R2 and serve through signed URLs, so the Worker stays out of the byte path.

Tests in the real runtime

Request tests boot the actual backend inside workerd, over real local D1 and KV, and sign in through the real OTP flow — no mocks pretending to be Cloudflare.

Conventions, not configuration

Where a file goes, what it's called, how an error becomes a status — decided once, in the Rails / 37signals tradition. Your thinking goes to the domain, not the plumbing.