# The Fabrica > Engineering documentation for The Fabrica: a production FastAPI + > Next.js SaaS foundation. The decisions, the trade-offs, and the > receipts — published so it can be evaluated before it is bought. The Fabrica is a production FastAPI + Next.js SaaS foundation, licensed once: authentication, billing, credits, background work, account lifecycle and the compliance surface are already built and tested, and the buyer extends them for their own product. This site is the engineering reasoning behind it — what was built, what was rejected, and where the guarantees are narrower than the convenient phrasing. Every page under a section heading is extracted from the product's own documentation rather than written for this site, and names the product version it describes. It is not the product source, and it is not open source: the repository it is published from reserves all rights. ## Start here - [Start here](https://docs.thefabrica.dev/index.md): The engineering reasoning behind The Fabrica: the decisions, the trade-offs, and the receipts. - [Architecture](https://docs.thefabrica.dev/architecture.md): What talks to what, why, and at what boundary. - [What is opinionated, and what is replaceable](https://docs.thefabrica.dev/extending/opinionated-and-replaceable.md): Which decisions you inherit when you buy The Fabrica, which are load-bearing, and what replacing each one actually touches. - [Credits are a ledger, not a counter](https://docs.thefabrica.dev/production/credits.md): Why metering is append-only, and the two mechanisms that keep it safe. - [Ownership and access](https://docs.thefabrica.dev/production/ownership-and-access.md): Where the ownership filter lives, and why the admin gate is an allowlist. ## Architecture - [Architecture](https://docs.thefabrica.dev/architecture.md): What talks to what, why, and at what boundary. ## Recent releases - [Recent releases](https://docs.thefabrica.dev/releases.md): What counts as a release, and the notes for the two most recent. ## The production model - [Credits are a ledger, not a counter](https://docs.thefabrica.dev/production/credits.md): Why metering is append-only, and the two mechanisms that keep it safe. - [Webhook delivery is idempotent by construction](https://docs.thefabrica.dev/production/webhook-delivery.md): At-least-once delivery, and the two-table pattern that absorbs it. - [Why Paddle, not Stripe](https://docs.thefabrica.dev/production/payments-provider.md): Merchant of record versus a tax bolt-on, for an EU seller. - [Subscription lifecycle](https://docs.thefabrica.dev/production/subscription-lifecycle.md): Seven distinct events rather than one upsert, and the two endpoints that move a plan. - [Signing the checkout payload](https://docs.thefabrica.dev/production/checkout-integrity.md): The identity-confusion attack, and the HMAC binding that closes it. - [Background work](https://docs.thefabrica.dev/production/async-work.md): Worker configuration decisions, and why compensation sweeps are bounded. - [Ownership and access](https://docs.thefabrica.dev/production/ownership-and-access.md): Where the ownership filter lives, and why the admin gate is an allowlist. - [Account lifecycle and erasure](https://docs.thefabrica.dev/production/account-lifecycle.md): Soft delete with a grace window, and erasure as a real code path. - [Boot and runtime posture](https://docs.thefabrica.dev/production/boot-and-runtime.md): Fail-fast guards, response headers, transport pinning and per-tier limits. - [Three health endpoints, three purposes](https://docs.thefabrica.dev/production/health.md): Liveness, readiness and a public component matrix — and what none of them check. - [Server components by default](https://docs.thefabrica.dev/production/frontend-model.md): Where the client boundary falls, and what that costs. - [First-touch attribution](https://docs.thefabrica.dev/production/attribution.md): Why attribution is first-touch, and why the frontend carries it. - [Consent and one-click unsubscribe](https://docs.thefabrica.dev/production/email-consent.md): The only public side-effecting endpoint, and why an HMAC token is its auth. - [One endpoint per screen](https://docs.thefabrica.dev/production/api-shape.md): A fat dashboard endpoint against a request per card. ## Extending it - [The extension boundary](https://docs.thefabrica.dev/extending/domain-boundary.md): Where buyer code lives, and precisely what that guarantees. - [Taking an update](https://docs.thefabrica.dev/extending/taking-an-update.md): What a release merge does to a codebase shaped like this one. - [What is opinionated, and what is replaceable](https://docs.thefabrica.dev/extending/opinionated-and-replaceable.md): Which decisions you inherit when you buy The Fabrica, which are load-bearing, and what replacing each one actually touches. ## Working with coding agents - [What a coding agent is handed](https://docs.thefabrica.dev/agents/repository-context.md): One canonical instruction file, and the two pointers that reach it. - [AGENTS.md, in full](https://docs.thefabrica.dev/agents/agents-md.md): The Codex entry point, reproduced whole. - [The Cursor rule](https://docs.thefabrica.dev/agents/cursor-rule.md): The Cursor entry point, below its frontmatter. - [What agent-driven work is bad at](https://docs.thefabrica.dev/agents/what-this-is-bad-at.md): The failure modes, in the order you meet them. ## Proof and receipts - [What executing our own guide broke](https://docs.thefabrica.dev/receipts/executing-the-guide.md): Six defects found by running the first-resource walkthrough, and their fixes. - [Two events, no delivery order](https://docs.thefabrica.dev/receipts/paddle-delivery-order.md): What a real sandbox purchase showed about concurrent webhooks, and the defect it exposed. - [How these documents are maintained](https://docs.thefabrica.dev/receipts/documentation-discipline.md): Receipts must resolve, counts are held to the filesystem, claims are guarded by tests. - [A scaffolded resource, in full](https://docs.thefabrica.dev/receipts/example-resource.md): The six files a new user-owned resource arrives as, and the security properties already in place. - [The concurrency test, and its output](https://docs.thefabrica.dev/receipts/ledger-concurrency.md): The test behind the claim that two concurrent spends cannot overdraw an account, and what breaking it looks like. ## Operating it - [Changing the schema safely](https://docs.thefabrica.dev/operating/migrations.md): Safety classes and expand-contract playbooks for production changes. - [Threat model](https://docs.thefabrica.dev/operating/security.md): OWASP API Top 10 and the GDPR-relevant threats, with residual risk stated. - [GDPR coverage map](https://docs.thefabrica.dev/operating/gdpr-coverage.md): Article by article: what the code enforces, what a document carries, what is yours.