Turborepo (pnpm workspaces) with all dependencies pinned to latest
mutually-compatible versions: turbo 2.9, TypeScript 6, Fastify 5,
React 19, Vite 8, better-sqlite3 12 + Drizzle ORM 0.45.
Layout:
- apps/server Fastify backend (local JWT auth + role guard, /health)
- apps/web React 19 + Vite 8 operator SPA
- packages/db Drizzle schema on SQLite/WAL; append-only events + users
- packages/devices reader/printer/relay adapter interfaces (intent-only relay)
- packages/shared shared domain types
Architecture constraints from the design wiki are encoded in the scaffold:
append-only hash-chained + signed event log, device-agnostic adapters,
"a barrier is not a door" (relay expresses intent only), fully-local
offline-first auth.
wiki/ is an LLM-maintained Obsidian knowledge base (28 pages) ingested
from the architecture & design notes, with its own maintenance schema.
Verified: pnpm install, full turbo build (5/5), server boots and serves
/health, drizzle-kit generates the initial migration.
Not yet decided, and they drive everything else — settle before procurement. (See
parking-system-architecture §10.)
Lane topology. One host per lane, or one central host driving networked devices in each
lane? Decides how many controllers, printers, UPSs, and sqlite instances exist, and the
failure blast radius. (A single central host is a single point of failure for all lanes.)
Failure modes. Define per direction what happens to barriers on host/power/network loss —
particularly fail-open on exit for egress safety. Currently unaddressed. See
fail-state-safety.
Payment subsystem. Manned booth (P2PE terminal + cash drawer) vs unmanned pay station;
confirm PCI scope is kept out of the application via a standalone certified terminal
(see bom).
Reconciliation channel. Even if "offline," establish some periodic path (USB, hotspot,
manager visit) to reconcile the signed log against an external authority — the real anti-fraud
control. See reconciliation.
Durability / backup. Backup strategy for the sqlite database + recovery plan; "sync
later" currently leaves a disk failure as total revenue-history loss.
Secure-element integration. Confirm atecc608 wiring/usage on both the host (event
signing) and, if pursued, the custom controller (command authentication — see
esp32-custom-controller).
julian
bfe64032d8