Tech Stack
Core Technologies
| Layer | Technology | Version |
|---|---|---|
| Server | Fastify | 5.x |
| Client | React | 19.x |
| Client Routing | React Router | 7.x |
| Database | SQLite (via better-sqlite3) | -- |
| ORM | Drizzle ORM | 0.45.x |
| Bundler | Webpack | 5.x |
| Styling | CSS Modules | -- |
| Testing | Jest (unit/integration), Playwright (E2E) | 30.x / 1.59.x |
| Language | TypeScript | ~6.0 |
| Runtime | Node.js | 24 LTS |
| Container | Docker (DHI Alpine) | -- |
| Monorepo | npm workspaces | -- |
Key Design Decisions
Each major technology choice is documented in an Architectural Decision Record (ADR) on the GitHub Wiki:
- ADR-001: Server Framework (Fastify)
- ADR-002: Frontend Framework (React)
- ADR-003: Database and ORM (SQLite + Drizzle)
- ADR-004: Bundler (Webpack)
- ADR-005: Testing Framework (Jest + Playwright)
- ADR-006: Styling (CSS Modules)
- ADR-007: Project Structure (npm workspaces)
Dependency Policy
Cornerstone follows strict dependency policies:
- No native binary frontend tooling -- tools like esbuild, SWC, and Tailwind v4 ship platform-specific binaries that fail in certain environments. Cornerstone uses pure JavaScript alternatives (Webpack, Babel, PostCSS).
- Pinned versions -- exact versions rather than caret ranges (
^) to prevent unexpected upgrades. - Zero known fixable vulnerabilities in the runtime image --
npm audit --omit=devmust report 0 before merging. Dev, test and docs tooling may carry accepted vulnerabilities when fixing them would require downgrades or brittle dependency pinning.
Further Reading
For detailed technical documentation, visit the GitHub Wiki:
- Architecture -- system design and conventions
- API Contract -- REST API endpoint specifications
- Schema -- database schema documentation
- Security Audit -- security findings and status