System Context
The whole platform on one page. This is C4 Level 1: it shows what CONA talks to, not what is inside each part. Every box here has a detail page linked at the bottom. Deliberately omitted: internal module structure, the 57@cona/core domains, individual
integrations (19 provider families are grouped into two boxes), and the split between
Axiom, Sentry, and PostHog.
Who uses CONA, and what runs
What CONA talks to
Portal and console are omitted from the second diagram — neither talks to an external system beyond Auth0.The four deployed units
@cona/internal-docs (this site) is a fifth app but has no code edges — it is Mintlify
content only.
Three ways in
The three entry paths have genuinely different trust properties. This is the most important thing on the diagram.Authenticated app
proxy.ts enforces an Auth0 session on every request. Covers all pages and most API routes.Self-verifying
Webhooks and the Stripe App bypass the auth proxy and verify their own signatures.
Share token + PLZ
Portal has no middleware, but access is two-factor: the share link plus the customer’s postal
code, then a signed session cookie.
Notes
Data flows in through the workers, not the webapp. Marketplaces and payment providers are polled by Temporal activities. The webapp only receives OAuth callbacks and webhooks — it never pulls provider data itself. DATEV is a format, not a connection. The DATEV export generates files that users download; no CONA code calls a DATEV API. That is why no DATEV box appears above. Google is the one true outbound integration.api/export/google-sheets pushes to
Google Drive. Every other external edge is inbound or a notification.
File storage is mid-migration. All new uploads go to Supabase Storage; the UploadThing
store is a read-only shim for legacy URLs
(packages/core/src/files/composite-file-store.ts:7-11).
Observability coverage is uneven — the dotted lines are not equivalent. Console has
@axiomhq/js only; Sentry and PostHog are webapp-only. See
Observability.