Architecture

Kredal is a server-rendered Next.js 16 application backed by Supabase (Postgres, Auth, Storage). All sensitive work happens server-side; the browser never holds privileged keys.

System context (C4 level 1)

Kredal does not integrate with banks. It produces a readiness assessment and an application pack that the founder submits themselves.

Containers (C4 level 2)

Key flows

Authentication & routing. src/proxy.ts (the Next.js 16 rename of middleware) refreshes the Supabase session cookie on every request and redirects unauthenticated users away from /app/**.

Data access. Server Components and Server Actions use a per-request Supabase client that runs as the signed-in user, so Row-Level Security enforces workspace isolation. A separate service-role client exists only for privileged server-side operations (signed URL generation) and is never imported into client code.

Assessment. runReadinessAssessment gathers the company, owners, documents, and questionnaire answers, calls the pure calculateReadiness() engine, and stores an immutable snapshot in readiness_assessments, updating the company status.

Reports. generateReport renders a deterministic Markdown template from the latest assessment and stores it in reports.

AI layer. After a document upload (and on demand), server-side Gemini extraction reads the file into a strict JSON contract stored on the document row with a confidence score; low-confidence results route to human review. Deterministic xdoc_* rules then compare extracted fields with the profile during assessment. A narrative-draft assistant writes a source-of-funds first draft from the founder's own answers, applied only on explicit confirmation. AI never sets the score — see ADR 0009 and Configure AI extraction.

Source of truth

• Data model & RLS → Database schema
• Scoring rules → Scoring engine
• Routes & actions → Routes and actions
• Security rationale → Security model