CARRY
A production platform for a NYC concealed-carry license-assistance service: it turns the NYPD's deliberately demanding, ~6-month application process into a guided, evidence-assembling workflow — for the applicant and for the consultant running dozens of cases at once.
The controlling insight: NYC carry is not a form you submit — it's an investigation you assemble evidence for. The two levers the product is built around: long-lead parallelism (training expires 6 months after completion — start it on day one) and disclosure discipline (false statements and lack of candor are the dominant denial grounds, not the underlying conduct).
The legal frame: consulting firms cannot represent applicants before the License Division, cannot expedite, and are not endorsed by NYPD. The product is therefore built so the applicant always reviews and submits their own application, disclosures are candor-maximizing by design, anything advisory routes to a NY-licensed attorney, and every registry rule carries provenance awaiting attorney sign-off (/admin/legal).
Surfaces
| Surface | Path | What it does |
|---|
| Marketing | app/(marketing) | Landing, eligibility quiz (feeds intake), DB-driven pricing, guides, standing disclaimer |
| Client portal | app/portal | Intake interview → personalized checklist from the versioned requirements engine; documents (HEIC-safe uploads, NYPD photo-spec validation); e-signatures; self-serve enrollment; instructor marketplace + booking; references & household outreach; assembled filing packet; post-issuance license hub (30-day/90-day/72-hour clocks, §5-24 reporting); appeal seam |
| Consultant admin | app/admin | Pipeline with stall signals, case files (requirements, disclosures review, documents, people w/ token status, training & scheduling, internal notes, tasks, messages w/ templates, activity), unified inbox, CP-5 pre-filing QA gate (a case physically cannot be filed incomplete), legal-verification register, reports |
| Instructor | app/instructor | Self-registration → admin verification → redacted offer feed (privacy firewall: never sees disclosures or pre-accept PII) → availability, bookings, ICS invites, Connect payouts (flag-gated) |
| Public token flows | app/r/[token], app/c/[token] | No-login reference letters and cohabitant affidavits: questionnaire → generated PDF → e-sign → notarize (in person or RON) → upload. Tokens expire in 30 days and are revocable |
Stack
Next.js 16 (App Router, proxy.ts) · React 19 · Supabase (Postgres + RLS + Auth + Storage + PostGIS) · Tailwind v4 · bespoke shadcn-derived UI (config/brand.ts tokens) · Stripe (flag-gated) · Resend (flag-gated) · pdf-lib · pnpm · Vercel (+ daily cron).
Running it
pnpm install
supabase start # local stack
pnpm db:reset && pnpm seed && pnpm db:types
pnpm dev
Demo logins (local seed, password Passw0rd!): [email protected], [email protected], [email protected], [email protected], [email protected].
Checks: pnpm test (vitest units: rule engine, validators, license math, intake schema) · pnpm tsx scripts/verify-v3p0.ts … verify-v3p3.ts + verify-p9.ts (live harnesses incl. the RLS matrix, run after a reset+seed) · pnpm lint · pnpm build.
Going fully live — the switches
STRIPE_ENABLED=true + Stripe keys → real card checkout (until then, "Request invoice" records intent + tasks staff).RESEND_API_KEY → outbound email (until then, emails log; applicants share links via Copy-link buttons).- Attorney sign-off of the requirements registry in
/admin/legal (nothing is presumed verified).
- Real business contact details in
config/brand.ts.
Deep agent/contributor context: AGENTS.md. V3 evidence base: CCW_V3_AUDIT.md + CCW_V3_BUILD_PROMPT.md. Historical plans: docs/archive/.
