Appsmith

# MISSION: Scaffold "Appsmith" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Appsmith**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Appsmith
- **What It Does**: Appsmith is an open-source low-code platform for building admin panels, dashboards and internal tools on top of existing databases and APIs, with a React builder, a reactive Java server and a plugin system for datasources.
- **Domain & Category**: Low-Code Internal Tool Platform
- **Production Scale**: 21-100 people
- **Development Mode**: CLASSIC
- **Architectural Rationale**: A reactive Spring Boot server with PF4J plugins isolates dozens of datasource integrations, MongoDB stores app definitions as documents, and a single supervisord-managed image keeps self-hosting to one container.
- **Live Website Reference**: https://www.appsmith.com
- **Source Repository**: https://github.com/appsmithorg/appsmith
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: TypeScript, React, Java, Spring Boot, MongoDB, Redis, Node.js, Docker, Kubernetes, Playwright
- **Primary Language(s)**: TypeScript, Java
- **License of the reference repo**: Apache-2.0
- **Frontend**: React — The app builder and runtime UI in `app/client`, started with Create-React-App-style `scripts/start.js` and `REACT_APP_*` environment flags.; TypeScript — Largest language in the repo; the client is a Yarn 3 workspace (`packages/**`) on Node 24.; Storybook — Component development and visual regression via Chromatic (`build-storybook.yml`, `build-chromatic.yml`).
- **Backend & APIs**: Java — API server in `app/server` on Java 25 as a Maven multi-module build.; Spring Boot — Spring Boot 3.5 parent POM; WebFlux and Project Reactor in `reactive-caching` make the server reactive end to end.; PF4J — Datasource integrations are PF4J plugin modules under `appsmith-plugins` (SQL, NoSQL, warehouses, S3, GraphQL, REST, AI providers).; Node.js — The RTS (real-time service) and MCP packages in `app/client/packages` are Node services bundled into the image.; JGit — `appsmith-git` implements git sync for apps with JGit over SSH (Apache MINA).; OpenTelemetry — Tracing in the server via the OpenTelemetry BOM.
- **Data & persistence**: MongoDB — Primary application database, bundled in the image as `server/mongo/server.jar`; migrations run with Mongock.; Redis — Reactive caching and sessions (`spring-boot-starter-data-redis-reactive`); Heroku config adds a Redis add-on.
- **Infrastructure & deploy**: Docker — Single `appsmith-ce` image runs editor, RTS, MCP, server and MongoDB under `supervisord` with a health check and Watchtower hooks.; Kubernetes — Helm chart under `deploy/helm` with `helm-release.yml`, `helm-unittest.yml` and `helm-docs.yml` workflows.; Caddy — Reverse proxy inside the image; routes are tested by `caddy-routes-test.yml`.; Ansible — Cloud install recipes under `deploy/` for AWS (AMI + Packer), DigitalOcean, Heroku and Ansible.
- **Tooling, testing & ops**: Playwright — E2E suites with smoke, sanity and regression projects (`test:pw:*` scripts, `playwright-e2e.yml`).; Cypress — Legacy E2E suite still run in CI (`pr-cypress.yml`, `app/client/cypress/Dockerfile`).; Jest — Client unit tests across workspaces (`test:unit:ci` runs `yarn workspaces foreach`).; GitHub Actions — Fifty-plus workflows: client/server builds, lint, spotless, vulnerability scans, deploy previews, release drafting.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/appsmithorg/appsmith @ 09a7581)
1. **One container that runs the whole stack**: The Dockerfile copies the React build, the RTS and MCP Node services and the Spring server into one image and starts them with `supervisord`, even bundling a MongoDB `server.jar`. Self-hosters get a single `docker run`; scaling out is done with external MongoDB and Redis plus the Helm chart.
2. **Datasource integrations as PF4J plugins in Java**: `appsmith-plugins` lists more than twenty Maven modules, each a PF4J plugin: relational databases, document stores, warehouses, S3, GraphQL, REST, SMTP, AWS Lambda and AI providers. New integrations are added as modules without touching the server core.
3. **Reactive Java server on WebFlux**: The server extends Spring Boot 3.5 with WebFlux and Project Reactor, and `reactive-caching` layers reactive Redis caching on top. Query execution against many datasources is I/O bound, which is why the non-blocking model was chosen.
4. **Git-native app versioning**: `appsmith-git` uses JGit with SSH support so applications can be committed to and pulled from git repositories; the image reserves `/dev/shm/git-storage` for working copies.
5. **MongoDB as the system of record**: Application definitions are documents, stored in MongoDB and migrated with Mongock. `app.json` for Heroku makes the dependency explicit by requiring a Mongo URI, and a `sync-release-to-pg.yml` workflow indicates ongoing work around PostgreSQL support.
6. **Security hardening baked into the image**: The Dockerfile strips setuid/setgid bits, pins CVE-affected Java dependencies in `app/server/pom.xml` (commons-lang3, httpcore5, jackson), runs Trivy and Docker Scout scripts, and ships Watchtower lifecycle hooks for safe auto-updates.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Isolate interactive UI state to leaf components. Keep core pages lightweight and performant.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (MongoDB, Redis): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.