# ARI > How ARI is built, layer by layer: the request flow, the module runtime, the data layer and the AI provider integrations behind the self-hosted workspace. Layered Architecture v2.0.6 · read bottom-up as “what builds on what”, top-down as request flow 02 AI-NATIVE ## AI-Native platform, not a bolt-on External AI agents and clients enter here - the entire surface below is built to be driven by them. → 11 provider integrations OpenRouter · Claude · OpenAI · Gemini · xAI · Mistral · DeepSeek · Groq · Perplexity · ElevenLabs (voice) · Ollama (local) → Per-module “brain” each module selects its own provider + model → AI modules Agents · Chat · Board of Advisors · Morning Brief · Brainstorm → Agent-ready surface OpenAPI spec + API keys let external AI agents drive ARI 03 APIS ## Everything in ARI is reachable over REST → Module APIs /api/modules/{module}/… → Core app APIs auth · users · settings · storage · backup · health · license → Autogenerated OpenAPI Documentation a machine-readable openapi.json spec is generated automatically from the route registry · interactive docs at /api-docs → Interactive Scalar API explorer browse, try, and send live requests to every endpoint straight from the docs → API keys API key manager to let external applications securely access your data. Keys can auto-expire. → Zod validation + rate limiting all endpoints validated · 5 sign-ins / 5 min · 3 sign-ups / 5 min · 5 TOTP verifies / min 04 GUARDRAILS ## Security & permissions - every request passes through here Isolation model (docs/SECURITY.md): middleware auth → API-layer filtering → RLS. Also: AES-256-GCM encrypted secrets at rest · disabled-account lockout (sessions rejected, API keys stop working). → Session middleware every route authenticated by default · security headers (CSP · HSTS · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy) → Account security Argon2id · 18-char min passwords · TOTP MFA · rate limiting & brute-force protection · public sign-up disabled at the middleware → Roles & permissions admin/user roles · granular keys · always resolved fresh from the DB, never the cookie-cached session → Audit Logs every user and system action is tracked and timestamped for full visibility and accountability → Tenant isolation per-user vs shared data model · API-layer user\_id filtering → Database deployment control local Postgres, local Supabase in Docker, or Supabase Cloud - choose the data layer that fits your security and infrastructure model 01 MODULES ## Modules Each module code is entirely self-contained in its own directory, which means they are fully portable. Fork them and share with colleagues. Modules can declare their own npm dependencies (auto-installed on module install). ARI supports trusted native modules with unrestricted flexibility and guardrailed modules with enforced isolation and permissions. Native Modules Tasks Dashboard Contacts Documents Knowledge Manager Notepad Quotes Motivation Brainstorm Chat Focus Timer Music Player Health Data Morning Brief Board of Advisors Havoc Companions Module Template Agents Fitness Users (ari-users) Portfolio Bible Study Task Monsters Airport Tasks Timezones Sandboxed Modules Invoice Manager Asset Manager CRM Shipping Manager ERP → Uniform by construction every module is generated from one fully-commented canonical template — same structure, same API shape, auth, validation, RLS, and theming inherited automatically · committed CLAUDE.md / AGENTS.md rules steer any AI builder (Claude Code, Codex), so the architecture is enforced on the builder, not left to convention → ARI Module Library premium module distribution via api.ari.software, unlocked by license key. Modules hosted on private Cloudflare R2. → Idempotent Module Updates automatic self-healing updates · dependency health handled automatically, auto-installed on module install (with version-conflict detection) → Module semver versioning every module declares its own major.minor.patch version · updates are compatibility-checked before install, and breaking changes require an explicit major-version upgrade 06 ARI FOUNDATION ## Self-hosted core platform → Next.js 16 + React 19 App Router → Better Auth email/password · Argon2id hashing · HTTP-only cookie sessions → Module System runtime auto-discovery · generated registry · module lifecycle → UI shell sidebar · ⌘K command palette · dashboard widgets · TanStack Query → Themes built-in light & dark themes, fully customizable to match your brand's colors and identity → Backup & restore dynamic table discovery · checksummed SQL export/import → Self-healing cache update-aware guard · stale build caches detected & cleared automatically · no manual resets after updates → Health diagnostics automatic 355+ health checks to proactively detect issues. → Telemetry lib/telemetry → Tenant Isolation per-tenant data separation · scoped queries · isolated storage → Deploy anywhere localhost · LAN · one-click Vercel Deploy Button (boots with zero env vars) · Supabase Cloud — guided /welcome setup wizard configures the database, admin account, and secrets on first visit 05 STORAGE Database - row-level security + Drizzle ORM → PostgreSQL 3 interchangeable backends: local Postgres · local Supabase · Supabase Cloud (ARI\_DB\_MODE) → withRLS() on every query - defense-in-depth; API-layer filtering is the real tenant boundary → Idempotent schema lib/db/setup.sql + per-module schema.sql, auto-applied on boot/enable Media Storage Layer → Filesystem (default) data/storage/{user\_id}/{bucket}/ → AWS S3 · Cloudflare R2 + Supabase Storage (S3-compatible) Authenticated endpoints only ( /api/storage/…) - no public file URLs. --- Source: https://ari.software/architecture Markdown rendering of this page, served for `Accept: text/markdown`. Full site index for agents: https://ari.software/llms.txt