✨ DeepBuilder — AI website builder SaaS on CodeCanyon

Best Practices

Development conventions for DeepBuilder and CodeCanyon customization.

Best Practices

Conventions used throughout DeepBuilder. This assumes you already know Laravel and Livewire.

Namespace rules

Area	Namespace	View path
Admin list	`App\Livewire\Dashboard\Admin\{Feature}\{Feature}Component`	`livewire/dashboard/admin/{feature}/`
Admin CRUD	`...\Options\CreateComponent` / `EditComponent`	`.../options/`
User dashboard	`App\Livewire\Dashboard\{Feature}\...`	`livewire/dashboard/`
Marketing	`App\Livewire\Main\{Feature}\...`	`livewire/main/`

Class names end with Component. Route names use admin.{feature}.{action}.

Authorization

Admin routes: middleware(['auth', 'admin']) plus $this->authorize() or abort_unless(auth()->user()->can(...))
Workspace APIs: policies on BuildProject — always scope by projectUuid and user_id
Never trust client-sent paths; workspace services normalize and reject .. segments

Seed permissions in PermissionSeeder; assign via Roles admin.

Localization

lang/en/admin.php — admin UI
lang/en/messages.php — app and builder strings
lang/en/installer.php — installer wizard

Use __('admin.key') in admin Blade and __('messages.key') on the dashboard. Add keys for every new string.

Settings

Read/write site config through SystemSettingsService, not raw SystemSetting:: queries in components.

$settings->get('site_name', config('app.name'));
$settings->setMany(['site_name' => $validated['site_name']]);

Branding uploads go to storage/app/... with paths stored as setting values.

Builder and queues

Long work (builds, agent continuations) belongs in queued jobs, not HTTP request cycles
Run php artisan queue:work in production (Supervisor)
Set realistic timeouts in config/deepbuild.php for your hosting
WebContainer commercial deployments need a valid API key; non-commercial can omit it

Credits

Debit credits in the service layer when an agent run completes, not in the Blade view
Use database transactions when granting credits and creating CreditTransaction rows
Surface “insufficient credits” as a user-friendly message in the builder API

Payments

Store Stripe whsec_ and PayPal webhook IDs in Payment Gateways admin when possible
Verify webhook signatures before updating subscriptions
Keep APP_URL stable; return URLs are built from it

Frontend builds

After changing resources/js/ or CSS:


pnpm build
php artisan view:clear   # if Blade components changed
php artisan config:cache # production only, after .env deploy

Local all-in-one dev:

composer run dev

CodeCanyon upgrades

When merging a new version from CodeCanyon:

Diff config/deepbuild.php and .env.example for new keys
Run php artisan migrate
Re-run npm run build
Re-apply your customizations in app/ and resources/views/components/deep/ — avoid editing vendor

Security production checklist

APP_DEBUG=false
HTTPS + SESSION_SECURE_COOKIE=true
Rotate AI and payment keys if exposed
Restrict DEEPBUILD_ALLOW_MANIFEST_EDITS unless you accept supply-chain risk from AI-edited lockfiles
Run builder workloads on isolated workers for multi-tenant hosts

Support

Open a ticket at deep42.freshdesk.com — that is our official support desk.

Include your CodeCanyon purchase code, PHP version (php -v), DeepBuilder version, steps to reproduce, and relevant lines from storage/logs/laravel.log.

A note from deep42

Don't Panic.

We've structured DeepBuilder to be extensible. The codebase follows Laravel and Livewire conventions, so if you know the framework, you'll feel at home.

The architecture is modular—admin components, dashboard and builder flows, services, and models are clearly separated. When extending, follow the existing patterns. Don't fight the framework.

Deep UI handles the frontend. Everything is namespaced and organized. If something feels off, there's probably a reason—check the existing implementations first.

Customize freely, but keep it maintainable. Use migrations for schema changes. Eager load relationships. Validate inputs. Check permissions. The usual stuff.

A friendly heads-up: We'll release updates, and when we do, you'll need to adapt your customizations. That's just how software works—things evolve. Extending helps, but it's not a magic shield. You can stay on your current version if it works for you, or roll up your sleeves when updates arrive. Either way, you're in control.

The answer is 42. The code is clean. Build something great.

— deep42

Deep UI Components

On This Page

Best Practices Namespace rules Authorization Localization Settings Builder and queues Credits Payments Frontend builds CodeCanyon upgrades Security production checklist Support A note from deep42

Best Practices

Development conventions for DeepBuilder and CodeCanyon customization.

Best Practices

Conventions used throughout DeepBuilder. This assumes you already know Laravel and Livewire.

Namespace rules

Area	Namespace	View path
Admin list	`App\Livewire\Dashboard\Admin\{Feature}\{Feature}Component`	`livewire/dashboard/admin/{feature}/`
Admin CRUD	`...\Options\CreateComponent` / `EditComponent`	`.../options/`
User dashboard	`App\Livewire\Dashboard\{Feature}\...`	`livewire/dashboard/`
Marketing	`App\Livewire\Main\{Feature}\...`	`livewire/main/`

Class names end with Component. Route names use admin.{feature}.{action}.

Authorization

Admin routes: middleware(['auth', 'admin']) plus $this->authorize() or abort_unless(auth()->user()->can(...))
Workspace APIs: policies on BuildProject — always scope by projectUuid and user_id
Never trust client-sent paths; workspace services normalize and reject .. segments

Seed permissions in PermissionSeeder; assign via Roles admin.

Localization

lang/en/admin.php — admin UI
lang/en/messages.php — app and builder strings
lang/en/installer.php — installer wizard

Use __('admin.key') in admin Blade and __('messages.key') on the dashboard. Add keys for every new string.

Settings

Read/write site config through SystemSettingsService, not raw SystemSetting:: queries in components.

$settings->get('site_name', config('app.name'));
$settings->setMany(['site_name' => $validated['site_name']]);

Branding uploads go to storage/app/... with paths stored as setting values.

Builder and queues

Long work (builds, agent continuations) belongs in queued jobs, not HTTP request cycles
Run php artisan queue:work in production (Supervisor)
Set realistic timeouts in config/deepbuild.php for your hosting
WebContainer commercial deployments need a valid API key; non-commercial can omit it

Credits

Debit credits in the service layer when an agent run completes, not in the Blade view
Use database transactions when granting credits and creating CreditTransaction rows
Surface “insufficient credits” as a user-friendly message in the builder API

Payments

Store Stripe whsec_ and PayPal webhook IDs in Payment Gateways admin when possible
Verify webhook signatures before updating subscriptions
Keep APP_URL stable; return URLs are built from it

Frontend builds

After changing resources/js/ or CSS:


pnpm build
php artisan view:clear   # if Blade components changed
php artisan config:cache # production only, after .env deploy

Local all-in-one dev:

composer run dev

CodeCanyon upgrades

When merging a new version from CodeCanyon:

Diff config/deepbuild.php and .env.example for new keys
Run php artisan migrate
Re-run npm run build
Re-apply your customizations in app/ and resources/views/components/deep/ — avoid editing vendor

Security production checklist

APP_DEBUG=false
HTTPS + SESSION_SECURE_COOKIE=true
Rotate AI and payment keys if exposed
Restrict DEEPBUILD_ALLOW_MANIFEST_EDITS unless you accept supply-chain risk from AI-edited lockfiles
Run builder workloads on isolated workers for multi-tenant hosts

Support

Open a ticket at deep42.freshdesk.com — that is our official support desk.

Include your CodeCanyon purchase code, PHP version (php -v), DeepBuilder version, steps to reproduce, and relevant lines from storage/logs/laravel.log.

A note from deep42

Don't Panic.

We've structured DeepBuilder to be extensible. The codebase follows Laravel and Livewire conventions, so if you know the framework, you'll feel at home.

The architecture is modular—admin components, dashboard and builder flows, services, and models are clearly separated. When extending, follow the existing patterns. Don't fight the framework.

Deep UI handles the frontend. Everything is namespaced and organized. If something feels off, there's probably a reason—check the existing implementations first.

Customize freely, but keep it maintainable. Use migrations for schema changes. Eager load relationships. Validate inputs. Check permissions. The usual stuff.

The answer is 42. The code is clean. Build something great.

— deep42

Deep UI Components

On This Page

Best Practices Namespace rules Authorization Localization Settings Builder and queues Credits Payments Frontend builds CodeCanyon upgrades Security production checklist Support A note from deep42