Pryde Ergon
Operations workspace shipped across 8 named phases — auth, orders, docs, billing
Phased delivery
Eight named phases, each a single commit with deliverables and acceptance criteria — P0 foundations, P1 auth, P2 profile + admin users, P3 documents, P4 orders, P5 conversion hook, P6 admin dash + contacts, P7 billing. Each phase ships in a single PR you can revert in isolation; the workspace is shippable at every commit.
The 16-status order machine
Order numbers (PE-CAT-DDMMYY-NNNNN) are generated via pg_advisory_xact_lock so concurrent writes never collide. OrderDocType → OrderStatus auto-progression: when an LOI uploads, the order’s status flips automatically. Role-aware permissions on every transition keep the wrong staff from advancing the wrong stage.
Edge auth via jose
The pryde_session cookie is verified at the edge for every /dashboard/* and /admin/* request — no Node runtime in the middleware path. jose for JWT, bcryptjs at 12 rounds for hashing, Resend for OTP delivery. ADMIN_BOOTSTRAP_EMAILpromotes the first matching registrant so a fresh deployment doesn’t need a manual DB poke.
Documents — Blob with bytea fallback
UserDocument.blobKey is nullable; bytesData Bytes? is the Postgres-side fallback. The system runs end-to-end without BLOB_READ_WRITE_TOKEN — once Vercel Blob is configured, the upload path switches without code changes. .docx generation runs through buildTradeDocumentDocx; the Central Documentation Factory handles format conversion behind a caller-scoped HMAC.
Billing — Razorpay + wallet
charge() writes a UsageCharge row and debits the wallet atomically. Razorpay topup is the canonical flow — create → verify → webhook reconciliation.allowNegative=true so format conversions never block on thin balances; the wallet rebalances on the next topup.
What I learned
- Phase contracts (named phase + deliverables + acceptance) keep a 12-model app shippable each commit. Each phase is a single PR you can revert in isolation.
- Transparent Blob-or-bytea fallback removes the “blocked on a token” failure mode. The system runs end-to-end without external storage; Blob takes over once it’s wired.
- Caller-scoped HMAC to the Central Documentation Factory makes every conversion billed to the right tenant without per-product integration code.