Architecture

A TypeScript monorepo with explicit responsibilities and independently deployable services.

Components

Web forwards /v1/* and /api/auth/* to the internal API. API owns business authority and persistence. The worker shares PostgreSQL events rather than relying on a web process's memory.

Decisions

Next.js serves the public website, account flows, merchant console, documentation and checkout. Fastify keeps API logic independent from rendering. Prisma provides versioned migrations and types. PostgreSQL holds both data and the initial queue, without requiring Redis at this stage.

The queue uses FOR UPDATE SKIP LOCKED and leases for multiple workers. Unique constraints protect cross-instance idempotency. Quotes use a short local cache and never act as balances or settlement authority.

Business and provider boundaries

Each account has one business. Workspace IDs remain stable resource scopes, not a multi-business account selector. Businesses manage fixed receiving addresses by network and asset through authenticated settings. Checkout never accepts a payer-selected beneficiary.

The Magnum operator manages one private global 4P credential on the backend. Tenant API keys are separate credentials, scoped to that business. The shared technical credential is not evidence that 4P authorizes a platform or multiple merchants under one account; live processing remains blocked pending explicit approval.

Delivery boundaries

There is no available-balance ledger, key custody, live commercial settlement, or billing. Those modules cannot be substituted by summing payments. The system is prepared for development without claiming financial certification.