Twaicy — Enterprise Zero-Commission Restaurant Commerce OS

Overview

Twaicy (twaicy.com) is an enterprise restaurant commerce operating system engineered to liberate restaurants, cloud kitchens, and dhabas from predatory 25-35% aggregator commissions. Architected as a Unified Monolith running on Bun, combining Next.js 16 (App Router + Turbopack) and NestJS 11, Twaicy powers direct-to-consumer digital ordering with zero commission.

The platform provides end-to-end multi-tenant isolation, instant UPI payment settlement via PhonePe PG webhooks or manual counter soundbox verification, an autonomous WhatsApp ordering bot built on Baileys, and real-time kitchen display audio synthesizers.

Technical Valuation: Replacement Cost: ₹58.0 Lakhs | Complexity Score: 240 FP. Full IDOR isolation, cryptographic HMAC webhooks, and sub-50ms Socket.IO kitchen chime dispatch.

Architectural Blueprint: Unified Monolith

Rather than separating the frontend and backend into brittle distributed microservices, Twaicy runs a single-process unified monolith gateway where Next.js 16 reverse-proxies /v1/*, /socket.io/*, and /uploads/* directly to NestJS 11 on the same origin—eliminating CORS overhead and session desynchronization.

twicy/
├── src/
│   ├── app/                # Next.js 16 App Router (Storefront, Merchant KDS, Admin)
│   ├── features/           # Modular domain UI (Cart, FoodFlex, Dynamic Website Builder)
│   ├── services/           # Shared client utilities & TwaicySoundEngine audio chime
│   └── server/             # NestJS 11 Core Enterprise Backend
│       ├── modules/        # Auth, Store, Product, Order, Payment, WhatsApp, Loyalty
│       └── main.ts         # NestJS bootstrap & internal HTTP listener (port 3001)
├── prisma/                 # Authoritative PostgreSQL schema & migrations
└── e2e/                    # Playwright end-to-end regression suites

Engineering Moats

1. Dual-Mode 0% Commission Payment Pipeline

Twaicy solves India's restaurant payment problem with a dual-mode flow:

• Mode A (Automated Webhooks via PhonePe PG): 0% UPI transaction fee. The server signs payloads with X-VERIFY SHA-256 HMAC headers. When PhonePe delivers the server-to-server callback, Twaicy verifies the checksum in constant-time, transitions order status to CONFIRMED, and fires the in-kitchen audio chime.
• Mode B (Counter UPI Soundbox): Zero setup cost. The customer scans the restaurant's existing counter UPI QR (merchant@upi), inputs the 12-digit UTR reference code, and the merchant verifies the Soundbox announcement with atomic verification locks.

// payment-webhook.service.ts
export function verifyPhonePeChecksum(
  payloadBase64: string,
  checksumHeader: string,
  saltKey: string,
  saltIndex: string
): boolean {
  const calculatedHash = crypto
    .createHash('sha256')
    .update(payloadBase64 + '/v3/transaction/callback' + saltKey)
    .digest('hex');

  const expectedChecksum = `${calculatedHash}###${saltIndex}`;
  return crypto.timingSafeEqual(
    Buffer.from(checksumHeader),
    Buffer.from(expectedChecksum)
  );
}

2. Autonomous WhatsApp Ordering Engine (Baileys)

Using the persistent multi-device WhatsApp protocol, Twaicy turns WhatsApp into an automated interactive storefront:

• Customers message the restaurant's official number.
• The stateful bot displays categories, dietary filters, and dish variants.
• Dynamic cart state is preserved across interactions, outputting a 1-click checkout payment link or automated cash-on-counter confirmation.

3. Kitchen Sound Engine (Socket.IO Synthesizer)

When noisy kitchen environments miss visual screen updates, TwaicySoundEngine uses Web Audio API oscillators to generate resonant, customizable polyphonic kitchen chimes across all paired staff devices the instant an order enters CONFIRMED state.

4. Strict Security & IDOR Shield

• Tenant Scoping: All Prisma queries unconditionally enforce WHERE storeId = :currentMerchantStoreId.
• Brute-Force Lockout: 5 consecutive failed login attempts trigger an IP/tenant-level 15-minute HTTP 429 lockout.
• Authoritative Price Calculation: Cart prices submitted by clients are completely discarded; the server computes every price directly from the PostgreSQL catalog.

Live Platform: twaicy.com