Skip to main content

​
Webapp

@cona/webapp — the primary application. Next.js App Router on Vercel at cona.app. 90 pages, 42 API route handlers, 501 files carrying "use server".

​
Request path

Every request passes through proxy.ts unless the matcher excludes it. The exempt families each authenticate themselves — verified, not assumed. See Ingress.

​
Layers

The @cona/database root edge is the one that should not exist. 40 production files import the live prisma client directly, bypassing both @cona/core and @cona/database/tracked — including 9 mutations. See Package Graph.

​
Route groups

24 of the settings pages are integration setup at setup/integrations/<provider>/[id] — one per provider, all the same shape.

​
Two kinds of “tool”

tool/ar-recon, tool/datev-export, tool/deferred-revenue are native modules installed from the App Store — distinct from integrations, which are external data sources. Both are sold through the same App Store.

​
Auth and tenancy

app/lib/auth/auth.ts is the tenancy surface: getOrganizationAndActorId() returning both in one call is what couples tenant scoping to mutation attribution. See Auth, Tenancy & Actors. A further 14 files handle Auth0 management: user CRUD, MFA enrolment, TOTP deletion, password and email updates.

​
Server actions

65 domain folders under app/lib/actions/, largely mirroring @cona/core domains. The asymmetry is informative — these 17 folders have no core counterpart because they are presentation or admin concerns: admin, cache, catalog, contacts, copilot, copilot-memory, customer_debtor_accounts, dashboard, delivery_terms, dev, filters, gl_dimensions, gl_reconciliations, posting_matrix, posting_matrix_column_type, sandbox, subscriptions

​
Notes

proxy.ts, not middleware.ts. Next.js 16 naming. Anyone grepping for middleware.ts will find nothing. Two near-empty layers. app/lib/controllers/ holds 2 files and app/lib/services/ holds 1 (PostHog). They look like abandoned layering experiments and are folded into “support” above rather than drawn as tiers. Three loose files break the action-folder convention: app/lib/actions/delete-financial-data.ts, dev-token-actions.ts, and a stray test document-default-settings-actions-i18n.test.ts sit outside any domain folder. Function duration is capped at 60s, except app/lib/integrations/bank-account/initiate-bank-reconnect.ts at 90s (apps/webapp/vercel.json).