# Architecture decision: modular TypeScript monolith

Crakey v2 begins as a modular monolith. It preserves strong transaction boundaries for orders, inventory, escrow and ledger operations while avoiding premature distributed-system failure modes.

## Boundaries

- `domain`: pure invariants and state machines; no HTTP, SQL or framework imports.
- `application`: use cases, authorization, transactions and repository ports.
- `infrastructure`: PostgreSQL, private object storage, email queue and payment-provider adapters.
- `interfaces`: HTTP/API and worker entry points.

Modules may reference shared identifiers, money and audit contracts, but may not update another module's tables directly. Financial postings go only through the ledger service. Authorization is checked at the interface and again in application use cases. Database constraints are the last line of defense.

## Deployment shape

One versioned application artifact supplies separate web and worker processes. Administrative infrastructure commands remain CLI-only. MySQL 8.0+/MariaDB 10.6+ with InnoDB is the intended system of record; private object storage holds encrypted KYC evidence and digital secrets. Provider callbacks enter a dedicated verified, idempotent adapter.

## Security defaults

- deny by default;
- opaque UUID identifiers at trust boundaries;
- secure, rotated server-side sessions;
- origin/CSRF validation for cookie-authenticated mutations;
- content-security policy and contextual output encoding;
- bounded uploads with decoded-file validation and malware-scanning hook;
- structured redacted logs and immutable audit events;
- environment validation that rejects debug mode in production.