CargoFlow · v1.0.0
The fleet SaaS, finished and handed over.
Multi-tenant organizations, drivers, shipments, live GPS, an offline driver app, public tracking, ETAs, notifications and reports. Built in the open on YouTube across nine phases, and shipped with the reasoning behind every decision.
One-time payment · Perpetual licence · Regional pricing at checkout
Specification
- Framework
- Next.js 16
- Language
- TypeScript
- Database
- PostgreSQL · Prisma 7
- Tests passing
- 741 / 741
- Phases built
- 9 / 9
- Security review
- Included
- Licence
- Perpetual
01 — Screens
Four people, four surfaces
The office, the driver, the customer, and whoever answers for the numbers.
02 — The difference
Most starter kits stop at the login screen.
They hand you authentication, a payment form and an empty dashboard. The hard part — the domain — is left as an exercise for the reader.
CargoFlow is the domain. A dispatcher assigns a load to a truck and a driver. The truck reports its position. The driver closes the delivery at the door with no signal and a photo of who signed for it. The customer watches it move on a link that reveals nothing about anyone else's business. And the office gets an answer to the only question it ever rings about: when does it get there?
Every sentence above is a feature that exists, is tested, and has a written record of why it works the way it does.
03 — Build order
Nine phases, each depending on the last
That order is why it holds together rather than sprawling.
Organizations, roles & audit
Multi-tenant from the first commit. Every row and query scoped by organization, five roles, an immutable audit log.
Fleet & drivers
Vehicles, drivers, documents in private object storage, licence and insurance expiry tracking, maintenance records.
Shipments
Customers, loads, assignment, a status lifecycle that cannot skip states, and a timeline nobody can edit afterwards.
Live GPS tracking
A token-authenticated ingest endpoint for telematics hardware, breadcrumb throttling, a Leaflet map, positions over SSE.
Driver PWA
Installable, works with no signal. An outbox queues proof-of-delivery photos and status changes, then flushes on reconnect.
Customer portal
A public page authenticated by the tracking code alone, with a projection layer that proves what a stranger can never see.
Route planning & ETA
Real road routing, arrival computed from plan and observed speed, and an at-risk band that fires before the deadline.
Notifications & jobs
In-app, email and Web Push on one channel-agnostic pipeline, per-user preferences, and a durable background job runner.
Reports & console polish
Four permission-gated report surfaces with CSV export. Command palette, URL-addressable filters, 2FA, ownership transfer.
04 — Stack
Current, boring, deliberate
Nothing exotic. Nothing added that a few lines of code could do. If you write Next.js today, you can read this on day one.
- Next.js 16
- React 19
- TypeScript
- Tailwind v4
- shadcn/ui
- tRPC v11
- Prisma 7
- PostgreSQL
- Better Auth
- TanStack Query
- Leaflet + OSM
- Server-Sent Events
- Cloudflare R2
- Resend
- Trigger.dev
- Web Push
- Vitest
- Vercel
05 — Evidence
Claims you can check before you pay
No testimonials here yet. Numbers instead — every one of them verifiable in the repository on day one.
The decision log
Not a changelog. A record of what was considered, what was chosen, what was rejected and why, and what was knowingly left undone — written while the decisions were being made.
When you hit a piece of code and think why on earth is it like this, the answer is already written down. That is the difference between owning a codebase and inheriting one.
The security review
A static security, privacy and scalability review was run against the finished code. It found seven items. The report ships in the package — findings, fixes, and the evidence for each.
- Five fixed and verified — a shared-handset cache disclosure, unthrottled public endpoints, missing security headers, a driver-app memory leak.
- Two open and documented — both scale architecture, neither a disclosure risk, each written up with what to build and when it stops being optional.
06 — Before you buy
What this does not include
Better you read it here than find it on day three.
Not built
- SMS notifications. In-app, email and push are done. SMS is the top recommended addition, and the seams for it are documented.
- Billing. No Stripe, no Paystack. It is multi-tenant SaaS with no way to charge for it yet.
- Product analytics. No PostHog, no telemetry of any kind.
- Multi-stop routes. A shipment is origin to destination.
- A native mobile app. The driver app is a PWA — genuinely good, but background location on iOS is a ceiling the web cannot cross.
You supply
- A PostgreSQL database, plus accounts for Cloudflare R2, Resend and Trigger.dev. All have free tiers.
- Your own API keys, rotated on arrival. The setup checklist walks through every one.
- Working knowledge of Next.js and TypeScript. This is a real codebase, not a no-code template.
Don't want to do the setup? I'll do it for you.
07 — Licence
One payment. Yours permanently.
Build and sell applications with this code. Don't sell the code itself. That is the whole licence in two sentences; the full text ships in the package.
Personal
$79One developer
- Full source and documentation
- Learning, portfolio and private projects
- One non-commercial end product
- 12 months of updates
- Upgrade later by paying the difference
Commercial
$279Up to five developers
- Everything in Personal
- One commercial product, uncapped users and revenue
- Keep 100% of what you earn
- 12 months of updates
- Eligible for the deployment service
Agency
$699Unlimited developers
- Everything in Commercial
- Unlimited end products
- Client work permitted
- Hand the deployed product to your client
- 12 months of updates
Regional pricing is on. Checkout detects where you are and adjusts. In Nigeria, Kenya, Ghana, India or anywhere else these figures don't reflect local rates, you'll see a lower one automatically — no code to ask for.
08 — Done for you
Two ways to skip the hard part
Add-on
Deploy it for you
$250
CargoFlow touches seven external services before it runs properly. Every one has a step that costs you an evening the first time — the storage CORS policy, the push key pair, the job worker, the OAuth redirect URIs.
- Database provisioned, schema applied, every environment variable set
- Storage, email, jobs and push each verified working — a real email received, a real notification delivered
- Deployed to your Vercel on your domain, your owner account created
- A recorded 30-minute handover call
Three business days. Your accounts, your billing, your data — you rotate every key at the end of the call. Requires a Commercial or Agency licence.
Engagement
Custom build
From $3,000
Your branding, your workflows, the features your operation actually needs — SMS notifications, multi-stop routes, geofencing, billing, customer accounts. CargoFlow becomes the starting point rather than the deliverable.
- Scoped against how you actually run loads today
- Built on a codebase that already works, so you pay for your differences rather than the basics
- Handed over with the same standard of documentation you see here
09 — Questions
Before you decide
v1.0.0 — available now
Start from a product that already works.
Nine phases, 741 tests, a security review in the box, and every decision written down.