Maris & Terra

Mar 2026 — present

Full Stack · Web Development · Architect · Solo Engineer

—A production spa-commerce and operations platform for Alis Wellness, architected and built solo end to end as a Turborepo monorepo — a Next.js 16 customer/admin/therapist app, an Express 5 REST API, and a shared package as the single source of truth for both.
—The product catalog — 63 rituals, pricing, and copy — is modeled as versioned JSON compiled at build time into a shared package and imported by both runtimes, so MongoDB is scoped to transactional state only and marketing/checkout prices can never drift apart.
—A 6-state booking state machine (pending → confirmed → completed, plus cancellation and no-show paths) supports both self-checkout and admin walk-ins across four payment methods behind one provider interface, freezing a priced snapshot on every booking.
—Three independent wallets — loyalty, therapist commission, referral commission — share one lazily-created balance-plus-ledger pattern; a 5-role RBAC system (9 pure predicate functions) is enforced identically at the edge, in Express middleware, and in React route guards.
—A crash-safe audit pipeline (in-memory buffer → local write-ahead log → batched MongoDB migration) adds zero request-path latency across 136 REST endpoints and 29 Mongoose models.
—47K+ lines of TypeScript, 139 commits, single author — deployed as a Docker container on a GCP instance.

Next.js 16React 19TypeScriptExpress 5MongoDBMongooseTurborepoTailwind CSS 4ZodJWTDockerGoogle Cloud Platform (GCP)

◼ Challenges

→Keep marketing and checkout prices from ever drifting apart while serving a weekly-changing product catalog with zero added request latency
→Enforce identical authorization rules across an edge proxy, an Express API, and a React admin UI without letting client and server logic drift apart
→Log every mutation for audit and compliance without adding latency to the request path, and survive a crash mid-write with zero data loss

◼ Solutions

→63-item product catalog and all copy modeled as versioned JSON in a shared package, compiled and imported at build time by both apps — database scoped to transactional state only, cutting mobile LCP 3.8s → 2.6s
→One predicate set (9 pure functions in @repo/shared/permissions) enforced three times — edge cookie check, API JWT + role guard, React route guard — so a disabled button and a 403 come from the same function
→Crash-safe write-ahead log: synchronous in-memory push → periodic local NDJSON flush → batched MongoDB migration, with rename-before-write-then-delete semantics so a crash mid-migration loses nothing