# Tech Stack

## Core

| Couche | Techno | Notes |
|--------|--------|-------|
| Framework | Next.js 16 | App Router, React 19, Turbopack |
| Auth | BetterAuth | Passwordless-first (Passkey + Google/GitHub + Magic Link) |
| Payments | Stripe | Via `@better-auth/stripe` plugin |
| Database | PostgreSQL 17 | Via `pg` Pool, Docker Compose (Colima sur macOS) |
| MCP Gateway | `@modelcontextprotocol/sdk` + Node.js HTTP | Serveur standalone sur Dedibox (`mcp.ceoinsight.dev`) |
| UI | Tailwind CSS 4 + shadcn/ui | Radix primitives + Framer Motion |
| Forms | React Hook Form + Zod 4 | `@hookform/resolvers` |
| State | TanStack React Query | Client-side data fetching |
| Email | Resend | Transactionnel (magic link, invitations, 2FA OTP) |
| Package Manager | pnpm | |

## Fichiers cles

| Fichier | Role |
|---------|------|
| `lib/auth.ts` | Config BetterAuth serveur (plugins, Stripe, session, hooks) |
| `lib/auth-client.ts` | Hooks BetterAuth client |
| `lib/db.ts` | Pool PostgreSQL partage |
| `lib/crypto.ts` | AES-256-GCM encrypt/decrypt (cles BYOK) |
| `lib/plans.ts` | Limites par plan (Solo/Pro) |
| `lib/email.ts` | Service Resend |
| `lib/email-utils.ts` | Normalisation email + domaines bloques |
| `gateway/src/index.ts` | MCP Gateway (serveur Node.js standalone) |
| `gateway/src/session-manager.ts` | Sessions MCP en memoire (Map, 30min idle) |
| `lib/mcp/gateway.ts` | `registerAllTools(server, jwt)` — coeur du gateway |
| `lib/mcp/tokens.ts` | JWT HS512 creation/verification tokens MCP |
| `lib/mcp/builtins.ts` | Tools builtin (Fetch) sans subprocess |
| `lib/mcp/connectors/registry.ts` | Registry des 7 connecteurs MCP |
| `lib/mcp/downstream.ts` | Pool connexions downstream (stdio + HTTP) |
| `lib/mcp/cache.ts` | LRU cache (10K entries, 500MB) |
| `app/api/keys/route.ts` | CRUD cles API BYOK |
| `app/api/sites/route.ts` | CRUD sites GSC |
| `app/api/usage/route.ts` | Stats usage quotidien |

## Plugins BetterAuth actifs

Magic Link, Passkey, Organization, 2FA (TOTP), Admin, MultiSession, Stripe, SSO/SAML, SCIM, OAuth Provider, JWT, Device Authorization, OneTap, Bearer, OpenAPI, Last Login Method, Custom Session