Service Catalog

Single source of truth for every folder's purpose, dependencies, phase, and status. Keep this in sync when a STUB graduates to WORKING (update the row here in the same PR).

apps/

All six apps have their full page inventory built and visually designed per docs/design/design-system.md. merchant-dashboard, Landing-page, and ops-console are wired to real backend APIs via @tbbn/sdk-js (browser-side, imported from the /client subpath — see each app's lib/tbbn.ts) and, where relevant, @tbbn/sdk-next (server components) — no more hand-authored placeholder data. Every fetch that can fail (no live backend, expired session, etc.) degrades gracefully to an inline error message rather than a stuck loading state or a crash. docs-site and status-page remain static/content-only by design — see their own rows below.

Folder	Purpose	Depends on	Phase	Status
docs-site	developer.tbbnetwork.com (Phase 33) — splits into /merchant/docs (Overview, Getting started, 21 guides, full non-Space API reference, SDKs, Changelog — all rendered live) and /space/docs (Space API guide, Getting started, the Space-tagged API reference: global search, API keys, headless booking)	packages/openapi-spec	14	WORKING (content is live/sourced, not hand-duplicated)
merchant-dashboard	dashboard.tbbnetwork.com — a marketing home at / (Phase 39, the merchant/developer platform's own pitch), OTP login (unchanged — a legitimate merchant-rep principal, verified not a sign-in-rule violation), Overview (analytics/billing, moved to /dashboard), Sellers, API Keys (create/revoke), Webhooks (create/disable), Billing (live usage), Team (invite), Sandbox (provision)	auth-service, merchant-service, analytics-service, billing-service, webhook-service, seller-identity-service, sandbox-service	18	WORKING (real API calls, no placeholder data)
Landing-page	tbbnetwork.com root domain (Phase 29, renamed from exchange-web in Phase 37) — a landing page (a 2-slide hero carousel, Trade then Space, no text between the nav and it — Phase 38) into /marketplace (full browse directory search/category/sort), plus listing detail, sign up/sign in (only ever here — see item 23), individual listing creation, inbox (accept/reject), trade detail, account. Folded-in marketing sections (audience split, TBBN Space explainer + a single-row, no-filter SpaceListingsTeaser, safety tips) live on the home page below the "Top trading items" teaser. Phase 36 (item 29) added real /how-it-works, /solutions, /pricing, /company routes (migrated from the now-deleted marketing-site, restyled to this app's own local design system).	directory-service, auth-service, listing-service, offer-service, trade-session-service, reputation-service, space-service	20	WORKING (real API calls; browse/detail fall back to demo data only if the API is unreachable)
ops-console	admin.tbbnetwork.com (Phase 39) — real TBBN_OPS staff login (email OTP, StaffRole-gated), Overview, Merchant approvals, Business verification (/businesses, Phase 34), Moderation queue, Fraud review, Feature flags. Every ops-only backend route is now guarded by OpsRolesGuard/@OpsRoles(...) — see docs/security/rbac-strategy.md.	auth-service, merchant-service, business-service, moderation-service, fraud-service, feature-service, space-service	19	WORKING (real API calls, real staff auth)
status-page	status.tbbnetwork.com — live service list (hand-maintained until status-service exists)	—	14	DESIGNED (static, matches actual Phase 0-3 status)
business-dashboard	business.tbbnetwork.com — a marketing home at / (Phase 39), private management dashboard (moved to /dashboard) for Business/Branch/Merchant-link CRUD; not a public profile site. No login of its own as of Phase 39 (previously a duplicate local registration/login wrongly calling the same marketplace-member endpoints Landing-page uses — a real sign-in-rule violation, fixed via the same cross-subdomain cookie pattern as account-dashboard/space-dashboard; see item 32).	auth-service, business-service	22	WORKING (real API calls, no placeholder data)
space-dashboard	space.tbbnetwork.com — a Space-only marketing home (/, Phase 38 — no barter/trade wording, a hero carousel plus a single-row Spaces teaser) with a /get-started resolver routing a visitor to tbbnetwork.com login, business setup, a Space-enabling Branch page, the existing Space-onboarding form, or their own dashboard (moved to /dashboard, Phase 38), whichever actually applies; the host portal itself (/dashboard): per-Branch Space roster + payout onboarding, per-Space profile/pricing/bookings including category/checkInMethod (Phase 34/36 — a Branch lists multiple Spaces, each independently bookable); plus public global /listings (renamed from /browse in Phase 36 — Space-grained, visibility-aware search/book with a category filter, deep-linkable via query params, no account required), /pay/:bookingId (hosted payment link, session- or token-authorized, Phase 32/34), and /consent/:bookingId (hosted headless-booking consent link, Phase 34). No login of its own as of Phase 38 (previously a duplicate local login — fixed to use the same cross-subdomain cookie pattern as account-dashboard; see item 31).	auth-service, business-service, space-service	23	WORKING (real API calls, no placeholder data)
account-dashboard	account.tbbnetwork.com (Phase 29) — payments, subscription management, the OAuth account-linking consent screen (/link/authorize, Phase 28), Space API key/config management (/space-api-keys, Phase 32, config gains consentMode in Phase 34), and Business team/role management (/team, Phase 34). No login of its own — reads a cross-subdomain httpOnly cookie Landing-page sets; see item 23.	auth-service, business-service, billing-service, seller-identity-service, space-service	29	WORKING (real API calls, no placeholder data)

services/

Folder	Purpose	Depends on	Phase	Status
api-gateway	Routing, rate limiting, auth validation, tenant isolation	all Phase 0-3 services	1	WORKING
auth-service	JWT/refresh/API-keys/OTP; email OTP/magic-link real via AWS SES (SesNotificationAdapter, Phase 39) once SES_FROM_EMAIL is set — SMS OTP still logs, no SNS/SMS provider configured	db-schema, core-auth	1	WORKING
merchant-service	Merchant org, onboarding, RBAC, API keys (folds in api-key-service/rbac-service logic)	db-schema, auth-service	2	WORKING
seller-identity-service	Federation, headless-Seller creation (Phase 27), OAuth account-linking handshake (Phase 28, replacing the original sequential email/phone OTP flow — see docs/business/conflict-resolution-log.md item 22)	db-schema, auth-service, core-auth, core-identity	3	WORKING
event-service	Event bus abstraction (Redis dev transport)	event-contracts	1	WORKING
audit-service	Audit/security/compliance logs	event-service	2	WORKING
webhook-service	Merchant webhook subscriptions, delivery, retry, DLQ; Phase 34 adds a Business-rooted counterpart (business-webhooks/) firing on Space booking events, sharing the same HMAC signing/retry kernel (delivery-kernel.ts)	event-service	2	WORKING
listing-service	Listing CRUD, visibility, merchant sync	db-schema, event-service	4	WORKING
catalog-service	Category/subcategory/brand taxonomy reference data	—	4	WORKING
media-service	Listing image ingestion/validation; real AWS S3 (S3StorageAdapter, Phase 39) once S3_BUCKET_NAME is set — no resize/re-encode step yet, width/height stay null	listing-service	4	WORKING (behind StoragePort)
directory-service	Read-surface aggregator for the global directory	listing-service, search-service	5	WORKING
search-service	OpenSearch-backed listing/seller search	listing-service	5	WORKING (Postgres now, documented OpenSearch swap-in)
trade-engine	TradeValue formula, settlement calc, currency normalization	listing-service	6	WORKING
currency-service	Currency reference/normalization (display/estimation only)	—	6	WORKING
localization-service	Languages, phone formats, address formats reference data	—	6	WORKING
matching-engine	Trade Compatibility Score	core-matching, trade-engine	7	WORKING
recommendation-service	Related trades / suggestions, plus (Phase 39) POST /v1/recommendations/events behavior-event ingestion and GET /v1/recommendations/{listings,spaces}/for-visitor — cold-start-safe personalization for both the trade marketplace and Space listings, built from a first-party BehaviorEvent log, falling back to a plain recency feed with no view history	matching-engine, db-schema	7	WORKING
offer-service	Offer create/accept/reject/cancel/expire/counter	matching-engine, listing-service	8	WORKING
reservation-service	Item-availability locking during a trade session	listing-service	9	WORKING
trade-session-service	Canonical trade-session state machine (through RESERVED)	offer-service, reservation-service	9	WORKING
checkout-service	Merchant-checkout redirect orchestration, merchant adapters (drives RESERVED -> COMPLETED); folds in payment-status-service	trade-session-service	10	WORKING
payment-status-service	Tracks merchant payment.completed/payment.failed webhooks	checkout-service	10	MERGED into checkout-service
billing-service	Merchant SaaS subscription + usage overage via Stripe Billing — the only TBBN-owned payment flow; TBBN does not currently charge an individual seller, see docs/business/conflict-resolution-log.md items 14 and 17	db-schema, Stripe	2	WORKING (behind StripePort)
notification-service	Email/SMS/push/webhook/in-app dispatch; trade-lifecycle email real via AWS SES (SesGeneralNotificationAdapter, Phase 39) once SES_FROM_EMAIL is set — SMS/push still log, no provider configured for either	event-service	11	WORKING (behind GeneralNotificationPort)
fraud-service	Fraud signal scoring	event-service	12	WORKING (2 rules; see README for the attribution gap on the rest)
moderation-service	Listing-note PII/contact-info scanning	listing-service	12	WORKING (ops review surface — the scan itself runs in listing-service)
reputation-service	Seller trust score, plus post-trade 1-5 star Reviews of Merchants/Space branches (Phase 24)	trade-session-service, business-service, space-service	12	WORKING
analytics-service	GMV, trade volume, match rate, completion rate	all above	13	WORKING
feature-service	Feature flags	—	2	WORKING
sandbox-service	Sandbox environment keys/fixtures for docs+dashboard	auth-service	14	WORKING
business-service	Business/Branch profiles, Business<->Merchant linking, Space-enablement flag; Phase 34 adds Business.verificationStatus (gates Space creation), BusinessUser/BusinessUserRole team management, and a Space-grained/visibility-aware nearbySpaces; Phase 39 adds real Google Maps Geocoding (GoogleGeoAdapter) — a new Branch's address is geocoded to lat/lng automatically once GOOGLE_MAPS_SERVER_API_KEY is set and the client didn't already supply coordinates	db-schema, auth-service, core-space	22	WORKING
space-service	TBBN Space — Space (the bookable room within a Branch, Phase 34) CRUD, pricing/bookings (Space-rooted since Phase 34), Stripe Connect payout/commission (Branch-rooted); TradeSession wired via TradeSpaceProposal (Phase 31); global visibility-aware Space search + Business-rooted API keys/config (consentMode, Phase 34) + headless booking with optional consent step (Phase 32/34, "calendly for space" — see docs/business/conflict-resolution-log.md items 26/28)	db-schema, business-service, core-auth, core-geo, core-space	23	WORKING

packages/

Folder	Purpose	Phase	Status
types	Shared TS domain types/enums	0	WORKING
utils	UUIDv7, currency math, date/tz helpers	0	WORKING
config	Zod-validated env config loader	0	WORKING
openapi-spec	OpenAPI 3.1 source of truth	0	WORKING (Phase 0-13 resources)
db-schema	Prisma schema, migrations, seed	0	WORKING
event-contracts	Typed event names/payloads	0	WORKING (Phase 0-3 events)
core-auth	Shared auth client/RBAC guards, API-key/OAuth-client/Space-API-key credential generation	1	WORKING
ui	Shared React component library — design tokens, Tailwind preset, chrome primitives (SiteNav, SiteFooter, Container, Button, Badge, SectionHeading, Wordmark)	14	WORKING (consumed independently by all six apps/*; Landing-page additionally pins its own local design brief on top — see that app's own docs)
core-listings	Shared listing domain logic (validation, PII moderation, computeTradeValue)	4	WORKING
core-offers	Shared offer/trade-session domain logic	9	STUB (offer/trade-session logic ended up needed by exactly one service each, offer-service/trade-session-service — no second consumer to justify extracting yet; revisit if that changes)
core-checkout	Shared checkout orchestration domain logic	10	STUB (same reasoning as core-offers — logic lives directly in checkout-service)
core-search	Shared OpenSearch query builders	5	STUB (search-service is Postgres-backed for now, see its README)
core-matching	Trade Compatibility Score calculator (pure function)	7	WORKING
core-notifications	Notification templating/dispatch interfaces	11	STUB
core-identity	Headless-Seller tier-gate validation (validateHeadlessSellerCreation) — shared by seller-identity-service and sandbox-service (Phase 27)	27	WORKING
core-geo	Haversine great-circle distance (distanceMiles, boundingBoxDegrees) — backs business-service's 200-mile nearby-Space search (Phase 31) and space-service's unbounded global search (Phase 32)	31	WORKING
core-space	Shared Space-visibility resolution (resolveSpaceViewer, visibleSpaceWhereClause) — implemented once, reused byte-for-byte by space-service's global search and business-service's nearbySpaces so a RESTRICTED_EMAIL Space can't leak through one path but not the other (Phase 34)	34	WORKING
sdk-js	Vanilla JS client	15	WORKING (Phase 0-13 resources)
sdk-typescript	Typed TS client	15	WORKING (Phase 0-13 resources — full generics on Auth/Merchants/ApiKeys/Sellers/Listings/Offers/TradeSessions, passthrough on the rest; Phase 36 fixed a real gap — the space resource group and branches.nearbySpaces were missing from this facade entirely, silently blocking any @tbbn/sdk-next Server Component consumer from reaching Space endpoints)
sdk-react	React hooks wrapper	15	WORKING
sdk-next	Next.js server/client helpers	15	WORKING
sdk-dotnet, sdk-python, sdk-php, sdk-flutter, sdk-ios, sdk-android, sdk-java	Non-JS language SDKs	15	WORKING (idiomatic source, all 27 resource groups, explicitly flagged untested — no toolchain for these 7 languages in this environment; two background-agent attempts at these hit a session usage limit mid-run, finished by hand afterward)
sdk-vue, sdk-rn	Vue/React Native SDKs	15	STUB (out of the explicit non-JS SDK scope this pass covered; sdk-rn in particular could likely just re-export sdk-react since RN uses the same React APIs — not done yet)
widget-core	Shared base custom-element class + design tokens for every widget-*	16	WORKING
widget-trade-button, widget-offer-modal, widget-trade-inbox, widget-trade-card, widget-trade-directory, widget-trade-status, widget-checkout-redirect	Embeddable widgets (real Custom Elements + Shadow DOM, esbuild-bundled)	16	WORKING
plugin-shopify	Shopify app skeleton	17	WORKING (real Remix app source — not run in this environment, needs a Shopify Merchant account)

infra/, tools/

Folder	Purpose	Status
infra/docker	Local dev infra containers (Postgres/Redis/OpenSearch/MinIO)	WORKING
infra/terraform	Cloud IaC	STUB (empty scaffold, no provider chosen)
infra/env	.env.example per service, env matrix	WORKING
infra/scripts	DB create/migrate/seed/wait-for-it	WORKING
tools/codegen	OpenAPI → SDK codegen	WORKING
tools/seed	Cross-service demo seed data	WORKING (Phase 0-3 tables)
tools/scripts	new-service scaffolder, health-check-all	WORKING

Note: infra/k8s does not exist in this repo, intentionally — see docs/phase-plan/phase-0-3-build-plan.md, no container orchestration until it's actually justified by scale.