Fasten Health

# MISSION: Scaffold "Fasten Health" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Fasten Health**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Fasten Health
- **What It Does**: Fasten Health (fasten-onprem) is a self-hosted, open-source personal health record manager: a Go and Gin backend storing HL7 FHIR data in SQLite, paired with an Angular frontend, shipped as one Docker image.
- **Domain & Category**: Personal Health Records & Medical EHR Engine
- **Production Scale**: Solo Developer
- **Development Mode**: CLASSIC
- **Architectural Rationale**: A single distroless Docker image embeds the Angular build inside the Go binary and defaults to file-based SQLite so a family can self-host medical records without provisioning a separate database or web server.
- **Live Website Reference**: https://fastenhealth.com
- **Source Repository**: https://github.com/fastenhealth/fasten-onprem
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Go, Angular, TypeScript, SQLite, FHIR
- **Primary Language(s)**: Go, TypeScript, HTML
- **License of the reference repo**: GPL-3.0
- **Frontend**: Angular — Single-page frontend under frontend/, built with the Angular 14 CLI and served as static assets by the Go backend.; Bootstrap — Base CSS framework for the Angular UI, applied through ng-bootstrap components.
- **Backend & APIs**: Go — Implements the REST API, FHIR data handling, and the fasten CLI (start/migrate/user commands).; Gin — HTTP web framework serving the backend REST API.; GORM — ORM used against the SQLite, PostgreSQL, or MySQL database drivers.
- **Data & persistence**: SQLite — Default embedded database engine, using a patched go-sqlite3 driver swapped in via a go.mod replace directive.; FHIR — Domain data model: patient records are stored and queried as HL7 FHIR resources through the gofhir-models and fhirpath libraries.
- **Infrastructure & deploy**: Docker — A multi-stage Dockerfile compiles the Angular frontend and the Go backend separately, then assembles them into one distroless runtime image.; GitHub Actions — Runs CI, Docker image builds, and CDN/cloud deploy workflows.
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/fastenhealth/fasten-onprem @ 36d9244)
1. **Multi-stage Docker build compiles Angular and Go separately**: The Dockerfile has a frontend-build stage (node:20, yarn build) and a backend-build stage (golang:1.21, go build with -tags static), then copies both outputs into a gcr.io/distroless/static-debian11 final stage, producing a single binary image with no shell or package manager.
2. **A self-signed root CA is generated at first boot for HTTPS**: README.md describes Fasten generating its own "Fasten Health CA" certificate authority on first run and using it to sign a server certificate for localhost, with the resulting rootCA.pem written to the certs directory referenced by docker-compose.yml, so HTTPS works out of the box without an external certificate.
3. **SQLite ships with a patched driver instead of the upstream one**: go.mod replaces github.com/mattn/go-sqlite3 v1.14.17 with github.com/jgiannuzzi/go-sqlite3 at the same version tag, and gorm.io/driver/sqlite is the primary database driver alongside indirect gorm.io/driver/postgres and gorm.io/driver/mysql requirements for alternate backends.
4. **Third-party health-data import is factored into a separate fasten-sources module**: go.mod requires github.com/fastenhealth/fasten-sources as a versioned dependency (not vendored into this repo) alongside github.com/fastenhealth/gofhir-models, keeping the provider-integration and FHIR-model code independently releasable from the on-prem application.
5. **The Angular build output is embedded into the Go binary image, not served separately**: The Dockerfile copies the frontend build stage output from /usr/src/fastenhealth/dist directly into /opt/fasten/web in the final image, and the Go backend serves it as static files, so on-prem deployment is one container instead of separate frontend and backend services.
6. **This repo is the open-source on-prem app, distinct from commercial Fasten Connect**: README.md states this repo is the community-maintained, self-hosted Personal Health Record app, separate from Fasten Connect (a commercial, fully-managed API product); the on-prem app cannot import data directly from healthcare providers and instead relies on manually entered data or uploaded FHIR bundles.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
   - Structure as a Turborepo monorepo with strict package boundaries:
     - `apps/web`: Application UI, routing, layouts, and server endpoints.
     - `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
     - `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
     - `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
   - Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
   - Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
   - Isolate interactive UI state to leaf components. Keep core pages lightweight and performant.
4. **Design System & Aesthetics**:
   - Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
   - Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
   - Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
   - Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (SQLite, FHIR): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.