Backend
| Library | Version | Role |
|---|---|---|
| NestJS | 11 | Application framework. Modules, controllers, providers, dependency injection. |
| Prisma | 7 | ORM and schema management. schema.prisma is the source of truth. |
| better-auth | 1.6 | Authentication. Session-based, no JWT. Stored in PostgreSQL via Prisma adapter. |
| @better-auth/prisma-ad | — | Prisma adapter for better-auth session/user tables. |
| helmet | — | HTTP security headers. Applied globally in main.ts. |
| compression | — | gzip middleware for API responses. Reduces payload size ~90% for reports. |
| cookie-parser | — | Parses cookies for better-auth session handling. |
| class-validator | — | DTO validation via ValidationPipe with whitelist: true and forbidNonWhitelisted: true. |
| class-transformer | — | Automatic DTO transformation in the global ValidationPipe. |
| @nestjs/throttler | — | Rate limiting. 100 requests per minute per client, TTL 60 seconds. |
| pdf-lib | — | Server-side PDF generation for order forms and packing slips. |
| adm-zip | — | ZIP archive creation for bulk report exports. |
| nodemailer | — | SMTP email delivery (development fallback). |
| Brevo (REST API) | — | Production email delivery via HTTPS API — works where outbound SMTP ports are blocked (e.g. Render free). |
| @aws-sdk/client-s3 | — | S3-compatible client for Cloudflare R2 file uploads. |
| csv-parse / csv-stringify | — | CSV parsing for employee bulk imports and rule-set CSV uploads. |
Frontend
| Library | Version | Role |
|---|---|---|
| React | 19 | UI framework. Functional components with hooks throughout. |
| Vite | 8 | Build tool and dev server. HMR in development. |
| React Router | v8 | Client-side routing. Route tree defined in App.tsx. |
| TanStack React Query | v5 | Server state management. All API data fetched via useQuery/useMutation. |
| React Hook Form | — | Form state management. Combined with Zod resolvers for validation. |
| Zod | — | Schema validation for all forms and API inputs. |
| better-auth/react | — | useSession() hook and <SessionProvider> for auth state. |
| Tailwind CSS | v4 | Utility-first CSS. All styling via utility classes. |
| shadcn/ui | v4 | Component library (Radix UI primitives + Tailwind). Not an npm package; components live in src/components/ui/. |
| class-variance-authority | — | Component variant system. Used by Button, Badge, and other UI primitives. |
| radix-ui | — | Accessible headless primitives. Popover, Dialog, Select, Tabs, etc. |
| Motion (Framer Motion) | — | Animations. Used for page transitions and micro-interactions. |
| Recharts | v3 | Charting library for dashboard reports. |
| SheetJS (xlsx) | — | Client-side Excel export for reports. |
| sonner | — | Toast notifications. <Toaster /> mounted in root layout. |
| lucide-react | — | Icon library. All icons from Lucide. |
| clsx + tailwind-merge | — | Utility for merging Tailwind classes. Exposed as cn() in src/lib/utils.ts. |
DevOps & Tooling
| Tool | Role |
|---|---|
| Firebase Hosting | Frontend deployment. Static SPA served from CDN. |
| Render | Backend deployment. Node 20 runtime, auto-deploy from main. |
| Neon | Serverless PostgreSQL. Branching, autoscaling, scale-to-zero. |
| Vitest | Unit and integration testing (frontend). |
| Testing Library | Component testing utilities for Vitest. |
| Playwright | End-to-end browser testing. |
| TypeScript | Type system for both frontend and backend. |
| ESLint | Linting for both frontend and backend. |
| Prettier | Code formatting (frontend). |