Portal Architecture

The portal uses TanStack Start for the app shell and Better Auth for sessions.

Authentication requests terminate at /api/auth/$, route protection happens in TanStack Start beforeLoad guards, and the auth state persists in Postgres when DATABASE_URL is set. A local SQLite fallback remains available for constrained dev environments. That gives you a clean path to add role checks, organization support, or an internal SSO provider later.