Stack & Structure
• Stack: Bun, Turborepo, Next 16 (App Router), React 19, Supabase, Drizzle, TanStack Query, Tailwind 4
• Apps: dashboard (app + Vercel crons/workflows), admin, website
• Packages: db, auth, supabase, ui, i18n, api

Data Flow & Fetching
• Logic: All logic lives in defineQuery / defineAction wrappers (packages/auth). Handles session, RBAC, billing locks, and audit logging.
• Reads (GET /api/q/[name]): Custom GET endpoints via allow-list (lib/query/registry.ts). Bypasses React's single-threaded Server Action queue for parallel browser fetches without router cache busts.
• Writes: Standard POST Server Actions via useActionMutation with client-side optimistic updates.
• Caching: TanStack Query is the sole transactional cache (staleTime: 60s, gcTime: 15m). Zero server-side DB caching ("use cache" is only for static/ref data).

RSCs & Auth
• RSCs: Pages await only one primary query via prefetchQuery; secondary queries use void prefetchQuery(...) to stream via Suspense.
• Auth: Local ES256 JWKS token verification via getClaims() (no network round trips). defineQuery runs an uncached getFreshAccountStatus check for instant org suspension across deployments.
• Security Chain: Middleware JWT verify → Page guards → defineQuery → Supabase RLS.
• Org Claim: active_org_id is baked into the JWT. Switching orgs calls ensureOrgClaim to force-refresh tokens and avoid Storage 403s.

Database & Storage
• DB: Supavisor pooler (:6543 runtime) + direct (:5432 DDL). warmConnection() runs on boot to skip the ~200ms cold TCP/TLS hit.
• Storage: Batch-signs URLs where possible. Transformed thumbnails flatten arrays page-wide before signing to prevent N+1 calls.

any idea? is our setup wrong?