Three repos, one ecosystem

SlabTrack is a constellation: an operator brain (slabtrack), a marketplace where buyers play games for cards (thisorthat), and a storefront platform where vendors run their own shops (slabtrack-storefront). Each is an independent Next.js app with its own database — they coordinate via webhooks, JWT auth, and a shared sale-lock layer.

The mental model

┌──────────────────────────────────────────────────────────────┐
│                       slabtrack (brain)                       │
│          collection · pricing · strategist · bridge           │
│                    Express + Postgres + React                 │
└──────────────────────────────────────────────────────────────┘
                ▼ webhook ingest         ▲ engage/disengage
                │  (push lots/singles)   │  (canonical state)
┌───────────────┴───────────────┐ ┌──────┴────────────────────┐
│   thisorthat (marketplace)    │ │  storefront (per-vendor)  │
│   Next.js 16 + Postgres       │ │  Next.js 16 + Postgres    │
│   buyer plays Flip / Pull     │ │  buyer direct-buys cards  │
│   Stripe direct charges       │ │  Stripe Connect (Express) │
│   Shippo labels               │ │  Shippo labels            │
└───────────────────────────────┘ └──────────────────────────┘

Repo-by-repo

slabtrack Brain

The operator-side dashboard. Catalogs every card you own, prices them, scores them, and routes them to the right channel via the Strategist. Also runs the Command Bridge — the cross-channel awareness layer that knows which card is live where, and the Sync Center that reconciles SlabTrack's view with each satellite.

• Stack: Express 5 + PostgreSQL + React 19 (Vite) + JWT auth
• Owns: cards, users, card_channels, consignment_* tables
• Talks outbound to: ToT (engage/disengage webhooks, comp lookup), Storefront (publish cards)
• Receives inbound from: ToT + Storefront (sync events)

thisorthat Marketplace

The buyer-facing game marketplace. Buyers pick cards, then choose a Flip (50/50 spread) or Pull (mystery stack from 2-5 cards) — the outcome decides their final price, but the card always ships. Provably fair via SHA-256 + Solana on-chain seed anchoring.

• Stack: Next.js 16 (App Router) + PostgreSQL + Prisma + JWT auth (shared with SlabTrack)
• Owns: Listing, FlipConfig, Pull, Play, Order, CollectionCard
• Stripe model: direct charges on the platform account, manual capture for sale-lock safety
• Shipping: Shippo, ship-from from SHIP_FROM_* env vars (one address per ToT install)
• Receives webhook from SlabTrack: POST /api/webhook/ingest → stages cards as CollectionCard rows + auto-publishes Listings

slabtrack-storefront Multi-tenant

Vendor storefronts. Each operator gets their own slug at storefront.slabtrack.io/[slug] with their own theme, logo, accent color, and Stripe Connect account. Direct-buy commerce (no games) — the buyer adds cards to a cart and checks out via Stripe-hosted Checkout.

• Stack: Next.js 16 (App Router) + PostgreSQL + Prisma + JWT auth (shared with SlabTrack)
• Owns: Storefront, StorefrontCard, Order, Want, SellOffer
• Stripe model: Stripe Connect Express — funds settle directly into operator accounts, platform takes a 3% application fee
• Shipping: Shippo, ship-from per-shop (read from Storefront.shipFromName/Street1/...)
• Receives card publishes from SlabTrack via POST /api/storefronts/[slug]/cards

Auth — the JWT shared secret

All three repos verify JWTs signed with the same JWT_SECRET. SlabTrack issues the JWT at login; ToT and Storefront accept it via the handoff route (/auth/handoff?token=…) which sets a same-origin cookie on the satellite.

Order lifecycle (storefront example)

1. Buyer adds cards to cart → POST /api/stripe/checkout on storefront
2. Storefront acquires sale-locks for each card across SlabTrack + ToT (so the same card can't be bought twice on different channels)
3. Storefront creates pending Order rows + Stripe Checkout Session (idempotent)
4. Buyer pays on Stripe-hosted page
5. checkout.session.completed webhook fires → flips Orders to paid + reservations to sold + completes the sale-locks (which fan out bulk-disengage to ToT/etc.)
6. Operator clicks "Print Label" in dashboard → /api/shippo/buy-label/[orderId] purchases USPS label, stores tracking
7. Buyer email fires with tracking link

Webhook endpoints (production URLs)

Where data lives

Each repo has its own Postgres database (separate Railway services). Cards are referenced across repos by slabtrackId (the canonical SlabTrack cards.id). Listings/orders/etc. are owned by whichever repo creates them and never cross-leak.