Module Boundaries

web-console

The permanent React browser application owns presentation, local interaction state, and the typed Platform API client. It never makes authorization decisions. Access tokens remain in memory and refresh credentials are handled by the API cookie boundary.

Its deployable static server owns SPA delivery, runtime configuration, security headers, health, readiness, version, and low-cardinality HTTP metrics.

platform-api

The API owns:

• authentication and session lifecycle;
• authorization and organization scope evaluation;
• tenant, organization, user, membership, and audit workflows;
• device, device-type, telemetry-flow, and raw-ingestion inspection workflows;
• public HTTP validation and error semantics.

Business logic accesses persistence only through repositories. Shared HTTP mechanics, administration change tracking, authorization policy predicates, session-token handling, and login throttling remain internal modules inside the single platform-api deployable.

database

packages/database owns SQL migrations, PostgreSQL/TimescaleDB-specific behavior, connections, and repositories. Tenant-owned repository operations require explicit tenant context.

Existing device, flow, raw-ingestion, measurement, export, and audit tables are preparatory foundations. Their contracts are reviewed before a service starts using them.

contracts

packages/contracts is the authoritative TypeScript contract package. DTO runtime schemas are colocated with their types so the API and web-console do not maintain separate structural validators. OpenAPI and contract documentation must remain synchronized with externally visible API behavior.

flow-engine

packages/flow-engine owns the schema registry, graph compiler, immutable execution frame and repository-controlled built-in blocks. Pure blocks cannot access the network, database, filesystem, or Secrets. Side effects cross the boundary only as typed measurement or action intents.

config, logging, and operability

These packages provide startup validation, structured logging, correlation, health, readiness, and metrics. They remain shared capabilities, not independent deployables.

documentation

The Starlight application is the repository-local product and technical source of truth. Test and production publish versioned documentation images.

Raw-ingestion modules

The first real Netmore phase implements two explicit capabilities:

1. mqtt-ingestion-worker validates the external envelope and publishes once to a durable raw stream;
2. raw-storage-worker stores one row per distinct received event and acknowledges only after commit.

The next stage is implemented as a transactional raw-stored outbox, SENS_RAW_STORED_V1, and flow-worker. Their names, subjects, event schemas, retry behavior, and resource limits are explicit contracts. The separate script-sandbox-worker and flow-action-worker provide security and operational isolation for scripts and external side effects.