Tech Stack
Core Technologies
Section titled “Core Technologies”| Layer | Technology | Purpose |
|---|---|---|
| Runtime | Cloudflare Workers (via Astro @astrojs/cloudflare) | Serverless edge execution |
| Framework | Astro 6 + Preact (islands) | Full-stack web framework |
| CSS | Tailwind CSS 4 | Utility-first styling |
| Database | PostgreSQL (Neon serverless) | Primary data store |
| ORM | Drizzle | Type-safe SQL |
| Auth | Lucia (two instances: buyer + admin) | Session management |
| Schemas | Zod 4 (src/schemas/) | Runtime type validation |
| Frontend (buyer) | Hugo | Static site generation |
| Icons | Material Symbols | UI iconography |
Cloudflare Services
Section titled “Cloudflare Services”| Service | Usage |
|---|---|
| Workers | Application runtime (Astro SSR) |
| Pages | Static asset hosting + Hugo buyer sites |
| D1 / Durable Objects | Webhook processing queue |
| R2 | Image/document storage |
| Email Service | Email delivery (OTP codes, contact form, invites) |
| Access (Zero Trust) | Operator authentication |
| Custom Hostnames | Per-project custom domains |
Validation & API Layer
Section titled “Validation & API Layer”| Tool | Location | Usage |
|---|---|---|
| Zod schemas | src/schemas/ | Shared type definitions validated at the API boundary |
| Typed API client | src/lib/api-client.ts | Zod-validated api.get/post/patch/put/delete helpers |
| Zod body validation | src/pages/api/**/*.ts | Per-endpoint request validation |
| CSRF protection | src/lib/http/csrf.ts | Origin/referer validation for mutating endpoints |
Deployment
Section titled “Deployment”| Component | Deployment |
|---|---|
| Platform (Astro) | Cloudflare Pages via platform/ directory |
| Buyer Frontend (Hugo) | Cloudflare Pages via buyer/portal-hugo/ directory |
| Database Migrations | drizzle-kit push (dev), drizzle-kit migrate (prod) |