Technology Stack Matrix
Comprehensive architectural overview of the frameworks, runtimes, database engines, and design system tooling powering the Doxt ecosystem.
Frontend & Application Framework
Ultra-fast, modular React 19 architecture with React Router v7 and Vite 6
Latest React 19 release powering reactive UI components, concurrent rendering, and fast transitions.
- Modern Hooks & Concurrent Features
- Server Components & SSR Compatible
- Strict Mode Strict ESM
Full-stack web framework handling client-side navigation, loaders, actions, and server-side rendering.
- Unified Data Loading & Actions
- Nested Layout Routing
- Seamless SSR & Hydration
Lightning-fast HMR and ESM-native build tooling optimized for modern frontend development.
- Instant Hot Module Replacement
- Rollup Production Bundling
- Custom Cloudflare Vite Plugins
End-to-end type safety spanning shared UI primitives, API contracts, and application routes.
- Strict Type Checking
- Shared Monorepo Path Aliases
- Zero Implicit Any
Styling & Design System Core
Tailwind CSS v4 with dual-theme HSL semantic variables and zero-latency typography
Next-gen Tailwind engine configured with @source scanning across monorepo packages.
- CSS-First Configuration
- Instant Compilation & JIT
- Monorepo Package Source Scanning
Dual-theme HSL color system (Canvas, Panel, Elevated, Borders, and Charcoal CTA tokens).
- Dual Theme (Light & Dark)
- CSS Custom Properties (--*)
- Contrast Ratio AA/AAA Verified
Dual-font family system: TASA Orbiter for brand display/headings and General Sans for UI/body text.
- TASA Orbiter (Headings)
- General Sans (Body & UI)
- Zero-Latency Variable Loading
Crisp, semantically coherent SVG icon libraries mapped to functional and navigational actions.
- Scalable Vector Graphics
- Dynamic Stroke & Active Weights
- Accessibility Labels
Edge Compute & Cloudflare Infrastructure
Globally distributed edge compute delivering sub-50ms TTFB and serverless execution
High-performance edge compute running close to end-users with instant cold starts.
- Global Anycast Network
- Near-Zero Cold Starts (<5ms)
- Custom Worker Middleware
Command-line suite for automated builds, local preview environments, and production deployments.
- Non-interactive CI Deployments
- Custom Environment Bindings
- Fast Local Preview
Direct edge caching and distribution of immutable CSS, JS chunks, and self-hosted fonts.
- Brotli & Gzip Compression
- Immutable Caching Headers
- DDoS & SSL Protection
Backend, Database & Security
PostgreSQL with strict Row-Level Security, Supabase Auth, and serverless Edge Functions
Frictionless Google authentication with PKCE authorization code exchange, account selector enforcement, and automated profile provisioning.
- Google Cloud Identity Services
- PKCE Authorization Code Flow
- Auto Profile Sync (Avatar, Name, Email)
- JWT Session & Refresh Tokens
Enterprise single sign-on supporting Microsoft 365, Outlook, and Azure Active Directory work/school accounts.
- Microsoft Entra ID (Azure AD)
- Multi-Tenant & Single-Tenant Support
- Office 365 / Outlook Account Sync
- Corporate Domain Auto-Mapping
Multi-factor authentication supporting OAuth 2.0 (Google, Microsoft/Azure), Magic Links, and Passwordless sessions.
- Secure HTTP-Only Cookies
- Role-Based Access Control (RBAC)
- Multi-Tenant Isolation
Enterprise-grade relational database with real-time subscriptions and complex relational modeling.
- Row-Level Security (RLS)
- Custom Stored RPC Functions
- Automated SQL Migrations
Isolated serverless functions for PDF compilation, webhook handling, and cryptographic verification.
- Secure Service Role Execution
- eSign Finalization RPCs
- CORS & Auth Gateway
Document Engine & eSignature
Client-side PDF extraction, serverless PDF sealing, and cryptographic audit trails
High-precision PDF parsing engine extracting text coordinate matrices for table conversion.
- Coordinate-Based Word Grouping
- Column Separator Detection
- Zero-Server Parsing
Serverless coordinate-based PDF manipulation for embedding signatures and audit certificates.
- Coordinate Signature Placement
- Tamper-Evident Stamping
- Audit Trail Attachment
Browser and edge cryptographic verification generating SHA-256 document checksums.
- SHA-256 Hash Verification
- Tamper Detection
- Zero-Latency Client Hashing
Monorepo & Build Orchestration
Turborepo pipeline with npm workspaces and zero-fork shared UI primitives
Intelligent build system with task caching, topological execution, and incremental builds.
- Multi-App Pipeline Caching
- Parallelized Task Execution
- Cross-Package Dependency Graphs
Native workspace resolution linking apps/* and packages/* without external symlinkers.
- Shared Dependency Hoisting
- Isolated App Deployments
- Zero Config Package Resolution
Centralized atomic design system consumed across all applications without code duplication.
- Zero-Fork Component Architecture
- Strict Atomic Hierarchy
- Synchronized Design Tokens
Social & Enterprise Identity Architecture (Google & Microsoft)
Enterprise-grade federated identity implementation using Google Cloud Identity Services, Microsoft Entra ID (Azure AD), PKCE protocol, and automatic PostgreSQL profile synchronization.
Browser initiates OAuth for Google or Microsoft (azure) with prompt: "select_account" and origin-aware redirectTo: "/auth/callback".
Identity providers validate client ID and scopes (openid, email, profile) before returning a signed authorization code.
Callback route exchanges auth code for JWT session via PKCE verifier, storing access and refresh tokens in HTTP-only cookies.
PostgreSQL trigger automatically populates public.profiles with avatar URL, verified email, and full name from provider metadata.
Session Management & Security
- ✓Zero-Storage JWTs: Session tokens are stored in secure, SameSite=Lax HTTP-only cookies preventing XSS exfiltration.
- ✓Enterprise SSO: Microsoft 365 and Azure Active Directory work accounts can be restricted to specific company tenants.
- ✓Account Disambiguation: Seamlessly unifies Google, Microsoft, and passwordless Magic Links on matching verified emails.
Required Environment Configurations
// Google Cloud Console
GOOGLE_CLIENT_ID="doxt-*.apps.googleusercontent.com"
GOOGLE_CLIENT_SECRET="GOCSPX-*"
// Microsoft Azure Entra ID
AZURE_CLIENT_ID="doxt-*-*-*"
AZURE_CLIENT_SECRET="*.azure_secret"
AUTH_REDIRECT_URI="https://<project>.supabase.co/auth/v1/callback"
Workspace Packages & Applications
Documentation portal and live sandbox for all atomic components, tokens, and design patterns.
Core customer application for document conversion, eSign workflows, and user dashboards.
Administrative management console with metrics, tenant controls, system logs, and support desks.
Dedicated, lightweight public signer view for reviewing and completing signature requests.
Canonical design system package aliased as @/design across all workspaces.
Shared utility functions, formatting helpers, crypto signing verification, and TypeScript interfaces.
import { … } from "@/design"
// source: packages/ui/index.ts