Next.js + Supabase engineer: partner application portal for a data licensing marketplace

We license document archives from companies. Today a partner tells us what they have over email and a person chases the rest. We want the front half of that to run itself: a company signs in, answers a structured application about what data they hold and what rights they have to license it, and then watches their own deal move through review, agreement, samples and delivery. The stack is Next.js 16 App Router, React 19, TypeScript, Tailwind, Supabase Postgres, on Vercel. Small, clean, tested, and someone reads every diff. First milestone, fixed price: Passwordless sign-in by email link, with the account scoped to a company rather than a person, so teammates can join and follow the same partnership. A sectioned application wizard driven by a taxonomy config rather than hardcoded fields, because a second vertical has to be a data change and not a rewrite. Six steps: the company and its registered address, the data types they hold as multi-select tiles with a free-text detail per tile, scale as repeatable unit rows with a count each plus coverage and monthly volume, a rights step covering de-identification status and whether they can license for commercial and AI use and whether those rights are pooled or siloed, an approval and signatory step, and a review screen that renders every answer back with a per-section edit link. Progress saves and resumes. Continue stays disabled until a step validates, and the line beside it says in plain words what is still missing. Then the partner dashboard the application unlocks: a stage rail from application through agreement, samples, review and delivery, each stage showing its state and what unlocks it, a status card, an agreement card, a read-only view of what they submitted, and team management. The rights step is the part that matters most. It is the screen that decides whether a partner is worth scoping at all, so it has to capture uncertainty rather than push people into a confident wrong answer. How we work: - Four gates green before any push: typecheck, lint, tests, build. Node's test runner, already set up. New behaviour ships with a test. - Pull requests into a branch, reviewed before merge. No pushes to master. - Thin dependencies. Five in the whole app. Adding one needs a reason in writing. - You work against a separate database seeded with fake data and your own preview environment. You will not have production credentials at any point, and that is not a trust question, it is how the project is set up. - Mutual NDA before repository access. There is more after this: a resumable multi-gigabyte uploader for the archives themselves, executed PDF agreements, a buyer facing marketplace with anonymised listings, and a payout ledger. Roughly three months if the first milestone goes well. I would rather run a sequence of fixed price milestones with one person than one big contract with someone I have not worked with. Timezone: US Pacific. I need four hours of overlap.