# Acme Toolkit Documentation - Full Text # Product Overview URL: https://contractorverifiedusa.com/docs A complete, production-ready toolkit you buy once and own forever. ## What Is Acme Toolkit? Acme Toolkit is a complete, production-ready digital product you buy once and own forever. You receive the full source code as a downloadable archive, a license key, and access to this documentation. There is no subscription, no per-seat fee, and no feature gate. Once you buy it, it is yours to run, modify, and rebrand on infrastructure you control. This documentation is a worked example that ships with the boilerplate. It shows how the docs system is wired together, what each page can contain, and the kind of copy a real product would publish. Replace it with your own content when you make the toolkit your own. ## Who Is It For? Acme Toolkit is built for people who want a complete product they can buy once and make their own. - **Founders** who want a head start on a real product instead of a blank repository - **Developers** who want clean, readable source code they can fork and extend - **Operators** who want a one-time purchase instead of a recurring subscription - **Agencies and resellers** who want to rebrand a finished product as their own ## Why Choose Acme Toolkit? **Buy it once.** One payment, no subscription, and no seat limits as your team grows. **Full source code, no black boxes.** You receive the complete codebase. Read it, customize it, and extend every part of it. Nothing is hidden behind a paywall or a hosted service you cannot inspect. **Production-ready from day one.** The toolkit ships with sensible defaults, a documented setup path, and the supporting pieces (auth, payments, email, content) already wired together. **Yours to rebrand.** Change the name, colors, copy, and domain. There are no usage limits and no per-seat fees, so you can run it for yourself or resell it under your own brand. **Modern, fast, and maintainable.** Built on a modern stack that is well documented and easy to deploy, so you are not fighting your tools to ship. ## What You Get | What | Detail | |------|--------| | Full source code | The complete application as a downloadable archive | | License key | Your proof of purchase, used to unlock downloads and updates | | Documentation | This site, covering setup, features, the API, and architecture | | Updates | Major fixes and improvements, shipped on a regular cadence | | Ownership | No subscription, no seat limits, no recurring charge | ## Where To Go Next - Read the [Setup and Deployment](/docs/setup) guide to get a working deployment. - Browse the [Feature Overview](/docs/features) to see what is included. - Skim the [Architecture](/docs/architecture) page to understand the stack. - Check the [Changelog](/docs/changelog) to see what has shipped and how often. --- # API and Webhooks URL: https://contractorverifiedusa.com/docs/api The public REST API, inbound webhooks for custom triggers, and outbound webhooks for events. Acme Toolkit exposes a public REST API and a webhook system so you can integrate with other tools, push events in, and receive events out. --- ## REST API A versioned REST API at `/api/v1` lets external systems read and write your data. - Authenticated with API keys you create in settings, passed as a bearer token - Scoped permissions per key (for example, read-only on one resource, or read and write on another) so a key can only do what you allow - Test and live keys, and the ability to revoke or expire a key at any time - Consistent response envelope and clear error codes, with a machine-readable spec - Resources cover the core records the product manages, plus webhook subscriptions ## Inbound Webhooks Inbound webhooks let an external system trigger your automations. - Each automation can expose an inbound webhook URL; an HTTP POST to it injects a custom event and runs the automation - Useful for connecting tools that are not built in, for example firing an automation from a third-party form, a payment processor, or your own app ## Outbound Webhooks Outbound webhooks push events to a URL you control. - Subscribe to events such as a record created, a message received, or a payment completed - Each delivery is signed so you can verify it came from your installation - Retries on transient failures so a delivered event is not silently lost For the full endpoint reference, request and response shapes, scopes, and event payloads, see the API reference that ships with the source. --- # Architecture URL: https://contractorverifiedusa.com/docs/architecture Tech stack, real-time data, security, hosting, and scalability. This page is for technical evaluators who want to understand what the product is built on and how it handles data, security, and scale. --- ## Tech Stack | Layer | Technology | |-------|------------| | Backend and Database | A serverless backend with a built-in database, real-time subscriptions, file storage, search indexes, and scheduled functions | | Frontend | Next.js (App Router) with React and TypeScript | | UI Framework | shadcn/ui + Radix Primitives + Tailwind CSS | | Authentication | Built-in (OAuth2, JWT, session management) | | Permissions | Role-based access control with frontend and backend enforcement | | Email Templates | React Email | | Frontend Hosting | Your host of choice | | CI/CD | GitHub Actions | | Testing | Vitest (unit) + Playwright (E2E) | --- ## Real-Time Architecture Acme Toolkit is real-time by default. Every data query in the application is a live subscription. When data changes on the backend, every connected client viewing that data receives the update automatically. This is not achieved through manual polling or cache invalidation. The backend provides automatic reactivity at the database layer: when a write happens, any query that reads the affected data re-executes and pushes the new result to all subscribed clients. There is no refresh button and no stale data. --- ## Security ### Authentication - Built-in authentication with OAuth2 sign-in and signed session tokens - Session management with token refresh and revocation - Optional two-factor authentication that can be enforced as a site-wide policy ### Authorization - Role-based access control with system roles and support for custom roles - A permission matrix with per-action scope control (view, create, update, delete) - Backend enforcement on every write - all operations are permission-checked before execution - Frontend enforcement for UI visibility, so users only see what they can act on ### Data Security - Industry-standard encryption (AES-256) for tokens and sensitive credentials stored in the database - Runtime schema validation on every backend operation - HTML sanitization on all user-generated content to prevent XSS ### Webhook Security - Cryptographic signature verification on inbound webhooks from third-party providers - Signed payloads for outbound custom webhooks ### Audit Logging - Significant actions are recorded in an audit trail with action type, entity, user, timestamp, and a diff of changes - A filterable audit log UI and export capability for compliance ### Rate Limiting - Per-token rate limiting on public mutations - Configurable send caps and webhook deduplication to prevent double-processing on provider retries --- ## Scalability The product is built on a serverless platform that handles scaling automatically. There are no servers to provision and no database connections to pool. - **Compute** scales automatically based on load - **Database** scales with usage, with no connection limits or manual sharding - **File storage** is built in, with no separate object storage to manage - **Scheduled functions** run reliably without a separate job queue - **Real-time subscriptions** scale with the number of connected clients --- ## Hosting and Deployment | Component | Host | Details | |-----------|------|---------| | Frontend | Your host of choice | Automatic deployments from GitHub, edge CDN, preview deployments for branches | | Backend | Managed platform | Automatic deployments, zero-downtime migrations, built-in monitoring | | CI/CD | GitHub Actions | Automated testing, type checking, and deployment pipelines | **The managed path is the default and the fastest way to go live, but it is not a lock-in.** Because you receive the source, advanced users can self-host every layer on their own servers. You own and control the source for both halves of the stack. --- ## Data Retention The product enforces automatic data retention policies to keep storage clean and support compliance: - **Deleted records (trash)** are held for a recovery window, then permanently removed - **Audit logs** are retained for a fixed compliance window - **Webhook delivery and event-processing records** are cleaned up automatically on a rolling schedule Active data is kept indefinitely. Per-record data erasure is available on demand for compliance with data protection requests. --- # Changelog URL: https://contractorverifiedusa.com/docs/changelog Release history and product updates for Acme Toolkit. A record of major updates, new features, and improvements to Acme Toolkit. The most recent changes appear first. This is an example changelog that ships with the boilerplate; replace it with your own release history. --- ## v1.0.0 - First public release _The first public release of Acme Toolkit. Anyone who buys it owns it forever, updates included._ The full toolkit is in place: - **Full source code** - the complete application as a downloadable archive, yours to keep and modify - **Authentication** - built-in OAuth2 sign-in, session management, and optional two-factor authentication - **Permissions** - role-based access control with backend and frontend enforcement - **Payments and licensing** - one-time and recurring payments via Stripe, with license keys issued on purchase - **Email** - transactional and marketing email with branded templates and unsubscribe handling - **Content and docs** - an MDX docs site, a blog with RSS and SEO metadata, and a single brand config - **API and webhooks** - a versioned REST API plus signed inbound and outbound webhooks - **Affiliate and referral program** - optional buyer-referral rewards and checkout discounts, gated behind a feature flag - **Reporting** - a dashboard, optional analytics and error monitoring, and an exportable audit log --- ## Before v1.0.0 - Private beta _Internal and invite-only testing._ - Hardening across authentication, payments, and webhook processing - A guided setup path so a fresh download reaches a live deployment in an afternoon - A neutral, white-label-ready default theme and placeholder product copy - The documentation and example content you are reading now --- # Frequently Asked Questions URL: https://contractorverifiedusa.com/docs/faq Common questions about Acme Toolkit - what you get, the license, security, and getting started. ## General ### What is Acme Toolkit? Acme Toolkit is a complete, production-ready digital product you buy once and own forever. You receive the full source code as a downloadable archive, plus a license key and access to this documentation. There is no recurring charge. ### Who is Acme Toolkit for? It is built for founders, developers, operators, and resellers who want a finished, ownable product instead of a blank repository or another monthly subscription. ### Is this a subscription? No. It is a one-time purchase. You pay once and keep it forever, with no per-seat or monthly license fee from us. ### Is Acme Toolkit open source? Not in the OSI sense. It is distributed as source code under a commercial license. You receive the full codebase and can read, customize, and extend every part of it. ### What does the license allow? You can customize your copy of the code however you like, deploy it, and run it under your own branding. You may **not** resell or redistribute the codebase itself. Updates are provided for major fixes and have shipped regularly since launch (see the [Changelog](/docs/changelog)). --- ## Features ### What is included? You get the full application: the source code, sensible defaults, and the supporting pieces (auth, payments, email, content) already wired together. See the [Feature Overview](/docs/features) for the full list. ### Can I rebrand it? Yes. Change the name, colors, copy, and domain. There are no usage limits and no per-seat fees, so you can run it for yourself or rebrand it as your own. ### Does it have an API? Yes. A versioned REST API plus inbound and outbound webhooks let you integrate with other tools. See the [API and Webhooks](/docs/api) page. --- ## Security and Data ### Where is my data stored? By default the backend and database run on a managed platform that handles encryption at rest, SSL, and infrastructure for you. Advanced users can self-host every layer on their own servers if they prefer. See [Architecture](/docs/architecture) for the full picture. ### What authentication does it use? Authentication is handled by the built-in auth system, supporting OAuth2, JWT tokens, session management, and optional two-factor authentication. ### Is there an audit log? Yes. Significant actions are logged with the user who performed them, the action type, the affected record, a timestamp, and a diff of changes. The audit log is searchable, filterable, and exportable. --- ## Pricing and Plans ### How is Acme Toolkit priced? Visit the pricing page for current pricing. It is a one-time purchase of the source. There is no per-seat or monthly license fee from us. ### What does it cost to run? It depends on which providers you connect. The product runs on free or low-cost tiers for light use; your real costs scale with usage (email volume, payments, and any third-party APIs you wire in). ### Can I get a refund? Yes, within the refund window stated at checkout if it is not a fit. See the refund policy for details. --- ## Getting Started ### How do I set it up? After purchase, you receive the source code and a deployment guide. Follow the guided setup to create your accounts, connect your providers, point your domain, and go live. See the [Setup and Deployment](/docs/setup) page for the overview. ### Where can I get help? This documentation covers setup, features, the API, and architecture. For anything else, email the team at [support@example.com](mailto:support@example.com). --- # Feature Overview URL: https://contractorverifiedusa.com/docs/features A detailed look at what ships inside the toolkit. A detailed look at what ships inside Acme Toolkit - what each part does and what you can build with it. This is an example feature overview that ships with the boilerplate; replace it with the features your own product offers. --- ## Full Source Code You receive the complete application as a downloadable archive. Nothing is hidden behind a hosted black box. - Clean, readable, well-organized source you can fork and extend - A documented project structure so you know where everything lives - Sensible defaults that describe a neutral placeholder product out of the box - Yours to keep, modify, and deploy with no usage limits --- ## Authentication and Accounts A built-in auth system so you are not bolting one on later. - OAuth2 sign-in and signed session tokens - Session management with token refresh and revocation - Optional two-factor authentication, enforceable as a site-wide policy - User accounts stored in your own database, with no required third-party identity provider --- ## Permissions and Access Control Role-based access control with enforcement on both ends. - System roles plus support for custom roles - A permission matrix with per-action scope control (view, create, update, delete) - Backend enforcement on every write, so the UI never decides what is allowed - Frontend enforcement for UI visibility, so users only see what they can act on --- ## Payments and Licensing Sell the product and manage what buyers receive. - One-time and recurring payment collection via Stripe - License keys issued on purchase, with a configurable download allowance and expiry - A customer portal for managing payment details and viewing past purchases - Refunds routed back through the account that captured the original charge --- ## Email and Notifications Transactional and marketing email, wired up and ready. - Transactional email (confirmations, receipts, reminders) via Resend or Postmark - Branded email templates built with React Email - A working unsubscribe link and one-click unsubscribe headers on marketing email - Domain verification guidance (SPF, DKIM, DMARC) so your mail reaches the inbox --- ## Content and Docs A content system for your marketing site and documentation. - An MDX-powered docs site (the one you are reading now) - A blog with categories, RSS, and SEO metadata - Structured data for search engines, generated per page - A single brand config file so product name, pricing, and copy live in one place --- ## Automation and Webhooks Connect the product to the rest of your stack. - A versioned REST API for reading and writing your data - Inbound webhooks to trigger automations from external systems - Outbound, signed webhooks to push events to a URL you control - Retries on transient failures so a delivered event is not silently lost --- ## Affiliate and Referral Program Optional growth machinery you can switch on when you are ready. - A buyer-referral program with a configurable cash reward per qualifying referral - A referral discount applied at checkout for the people your buyers invite - A hold window before rewards become payable, aligned with the refund window - Toggles to ship a bare checkout portal first and enable the program later --- ## Reporting and Analytics Understand what is happening without leaving the product. - A dashboard with high-level KPIs - Optional product analytics (PostHog) and error monitoring (Sentry) - Date range filtering and export to CSV - An audit log of significant actions, searchable and exportable --- ## Settings and White-Label Make the product your own. - A single brand config for name, pricing, links, company details, and copy - Theming for colors, typography, and spacing - Neutral browser tab title and favicon out of the box, ready to rebrand - Feature flags that gate optional subsystems so you ship what you need --- # Integrations URL: https://contractorverifiedusa.com/docs/integrations Built-in integrations for email, payments, authentication, analytics, and more. ## Overview Acme Toolkit connects with external services to handle email, payments, authentication, analytics, and security. Some integrations are built into the platform and work out of the box. Others require you to connect your own external account (such as a payment processor or an email provider). Credentials live in your environment configuration, never in the source. This page is an example integration directory that ships with the boilerplate. Replace it with the integrations your own product supports. --- ## Integration Directory ### Email | Integration | Provider | What It Enables | Account Required | |-------------|----------|-----------------|------------------| | Transactional Email | Resend | Confirmations, receipts, reminders, and notifications | Resend account | | Transactional Email | Postmark | Alternative transactional email delivery with tracking | Postmark account | ### Payments | Integration | Provider | What It Enables | Account Required | |-------------|----------|-----------------|------------------| | Payments | Stripe | One-time and recurring payment collection, customer portal, and refunds | Stripe account | **Webhook-driven automation.** When a payment is received via a Stripe webhook, the platform runs the matching automation: events fire, records update, and follow-up steps execute automatically. **Refund routing.** Refunds are routed back through the account that captured the original charge. ### Storage | Integration | Provider | What It Enables | Account Required | |-------------|----------|-----------------|------------------| | File Storage | S3-compatible | Uploads and downloads of files and assets | S3-compatible bucket | ### Analytics and Monitoring | Integration | Provider | What It Enables | Account Required | |-------------|----------|-----------------|------------------| | Error Monitoring | Sentry | Frontend and backend error tracking with source maps | Optional | | Product Analytics | PostHog | Product usage analytics and event tracking | Optional | ### Security and Verification | Integration | Provider | What It Enables | Account Required | |-------------|----------|-----------------|------------------| | Authentication | Built-in | User authentication (OAuth2, JWT), session management, and two-factor authentication | Built-in | | CAPTCHA | reCAPTCHA / Cloudflare Turnstile | Bot prevention on public forms | Built-in (configurable) | --- ## Integration Configuration ### Credentials All integration secrets (API keys, OAuth tokens, provider settings) live in your environment configuration, not in the source. Set them once per deployment, and keep separate values for your test and live environments. ### Email Domain Verification The product includes guidance for verifying your sending domain: - DKIM record setup and validation - SPF record guidance - DMARC configuration ### Webhook Infrastructure For custom integrations, the product provides: - Inbound webhook endpoints for triggering automations from external systems - Outbound webhooks for calling external APIs - Cryptographically signed webhook payloads for security - Webhook logging for debugging --- # Setup & Deployment URL: https://contractorverifiedusa.com/docs/setup How Acme Toolkit deploys - what you get, how the guided setup works, where it runs, and what you need. This is the plain-English overview of how you get from buying Acme Toolkit to a live deployment running on infrastructure you control. It is not an exhaustive runbook; the full step-by-step lives in the setup guide that ships inside the product. ## What you get when you buy The moment you purchase, you receive two things by email: 1. **A license key** - your proof of purchase and the key that unlocks the developer guide and downloads. 2. **The full source code** - the complete application, yours to keep, modify, and deploy. From there, the path is simple: download the source, run the guided setup, and deploy. Most people who are comfortable following technical instructions get to a working deployment in an afternoon. ## Two ways to set it up You do not have to wire this together from memory. There are two supported paths, and you can mix them: - **The built-in setup guide.** It walks you through the whole deployment in plain English, one step at a time, and waits for you at each step. It is designed for an operator, not just an engineer. - **Point a coding tool at the repo.** If you use a coding assistant, you can open the project and ask it to set everything up. It reads the included instructions and does the configuration with you. Either way, the included documentation covers each account you create and each value you need to set. ## Where it runs Acme Toolkit is a modern web app. You deploy the application to a host of your choice and connect a managed backend for data and authentication. - **A managed backend is the default.** It runs your database, the server-side logic, and authentication as one service, so backups, scaling, and uptime are handled for you. - **Self-host if you prefer.** Because you have the full code, advanced users can run every layer on their own servers instead. That path is more work, and it is optional. This is the honest version of self-hosting. You control the code and your data, and you choose where it is deployed. ## What you need A realistic checklist before you start: 1. **A hosting account** - where the app is deployed. A free tier is plenty to start. 2. **A backend or database account** - for your data and server logic. The free tier comfortably covers a small project. 3. **Your own domain** - pointed at your deployment so the product lives on your brand. 4. **An email service** - Resend, Postmark, or similar, for transactional email (confirmations, reminders, notifications). 5. **Optional provider accounts** - add these when you need them, such as a payment processor if you want to sell or bill. None are required to get the core product running first. ### What it costs to run For most projects, hosting runs on free or low-cost tiers to start and scales with usage from there. The usage-based services you connect (email, payments, and any third-party APIs) are billed by their providers at their own rates. ## Roughly how long Plan for **a couple of hours** the first time, mostly spent creating accounts and pasting in credentials. The setup itself is guided; the time goes into the one-time configuration tasks (connecting providers, verifying your sending domain) that you do once and never touch again. ## After it is live - Read the [Architecture](/docs/architecture) page if you want to understand the stack and how it is put together. - Browse the [Feature Overview](/docs/features) for what each part of the product does. - Check the [Changelog](/docs/changelog) to see what has shipped and how often. You buy once, and you decide when to update. Nothing changes unless you pull it in. ---