Spinza v0.1.0 — fictional social casino: engine, 20 certified games, API, web, admin · 3b4179a · spinza

added .env.example +12 −0

++# Spinza — local development
++DATABASE_URL=postgres://localhost:5432/spinza
++REDIS_URL=redis://127.0.0.1:6379
++API_PORT=8231
++API_HOST=127.0.0.1
++WEB_PORT=8230
++API_URL=http://127.0.0.1:8231
++NEXT_PUBLIC_SITE_URL=http://localhost:8230
++SESSION_SECRET=change-me-64-hex
++ADMIN_IP_ALLOWLIST=
++COOKIE_SECURE=0
++LOG_LEVEL=info

added .gitignore +18 −0

++node_modules/
++.next/
++dist/
++*.tsbuildinfo
++.env
++.env.*
++!.env.example
++logs/
++tmp/
++coverage/
++.DS_Store
++.turbo/
++.claude/
++qa/node_modules/
++qa/screens/
++deploy/spinza.mld.json
++apps/web/next-env.d.ts
++data/

added CLAUDE.md +48 −0

++# Spinza — repository guide
++
++Spinza (www.spinza.dev) is a premium **fictional** social casino. Virtual credits only: no deposits, no withdrawals, no purchases, no crypto, no cash value, no prizes. The full product brief is in `docs/SPEC-original.md`; this file is the condensed working guide.
++
++## Layout (pnpm workspaces + Turborepo)
++
++| Path | Package | Role |
++|---|---|---|
++| `packages/shared` | `@spinza/shared` | Economy constants (10,000 SC start, bet levels, daily rewards, XP curve), zod schemas, formatting (`formatSC` — never a currency sign), API DTO types. |
++| `packages/game-core` | `@spinza/game-core` | **Server-only game engine**: `CryptoRng` (crypto.randomBytes, rejection sampling — `Math.random` is banned for outcomes), reels, ways/lines evaluation, wild/scatter/cascade/hold-respin/pick-bonus/meter/heat/mystery/quantum/dynamic-grid features, `runSpin()`, `simulate()`, `certify()`, `validateDefinition()`, `defineGame()`. `./client` export = types only (safe for the browser). |
++| `games/` | `@spinza/games` | 20 original game definitions (`src/<slug>/index.ts`), `registry.ts`, `calibration.json` (payScale per slug+version, written by the simulator), `certifications/<slug>.json` (PASS/FAIL reports). |
++| `packages/database` | `@spinza/database` | Drizzle schema (25 tables, snake_case casing), migrations in `drizzle/`, `seed.ts` (games sync, achievements, missions, levels, flags, settings), `sync-games.ts`. |
++| `apps/api` | `@spinza/api` | Fastify on 127.0.0.1:8231. Auth (argon2id, opaque 256-bit sessions hashed, recovery codes), atomic spin (`services/spin.ts`), wallet ledger (`services/wallet.ts`), progression, rewards, leaderboards, admin (TOTP), health. |
++| `apps/simulator` | `@spinza/simulator` | CLI `pnpm sim <validate|run|calibrate|certify>` with worker threads; also used by the admin simulator. |
++| `apps/web` | `@spinza/web` | Next 16 (port 8230). `/api/*` is rewritten to the Fastify service. Game screen = `src/components/game/*` (PixiJS renderer, procedural symbols, WebAudio sound). Admin console under `/admin`. |
++
++## Non-negotiable rules
++
++- Outcomes are decided **only** in `apps/api` via `runSpin`. The browser animates `result.steps`; it never computes wins.
++- Every balance change goes through `lockWallet` → `applyCredit` (ledger row) → `saveWallet` inside one Postgres transaction. `sum(credit_transactions.amount) == wallets.balance` is an invariant checked in admin.
++- Spin idempotency: unique `(user_id, client_round_id)`; duplicates (even concurrent) return the stored round with `replayed: true`.
++- A game is `published` only if `games/certifications/<slug>.json` is `PASS` for its exact `version`. Changing pays/weights ⇒ bump `version`, re-run `pnpm sim calibrate <slug>` then `pnpm sim certify <slug>`.
++- Never log passwords, hashes, recovery codes, session tokens (pino redact list in `apps/api/src/app.ts`).
++- No payments, no `$`/`€` anywhere in UI copy. Credits are formatted `10,000 SC`.
++
++## Commands
++
++```bash
++pnpm install
++createdb spinza && pnpm db:migrate && pnpm db:seed          # local Postgres 17 + Redis required
++pnpm dev:api   # 8231     pnpm dev:web   # 8230
++pnpm sim validate | pnpm sim run <slug> --spins 1000000 | pnpm sim calibrate all --spins 10000000 --threads 26 | pnpm sim certify all --spins 10000000
++pnpm --filter @spinza/game-core test    # engine unit tests
++pnpm --filter @spinza/api test          # integration tests (needs local DB/Redis)
++pnpm admin:create <username> [password] # prints TOTP secret once
++```
++
++## Deployment (MacLustr)
++
++`mld deploy spinza` from the laptop (`~/Desktop/cluster-skill/mld`). Manifest with secrets: `M1M32:~/dispatch/apps/spinza.json` (copy: `deploy/spinza.mld.json`, gitignored). Node M3U96a, PM2 `spinza-api` (8231 loopback) + `spinza-web` (8230) + `spinza-ngrok` (`www.spinza.dev`). Postgres db `spinza` + Redis local to the node. Hooks: install → migrate + seed → `next build`. Backups: `deploy/backup.sh` (daily launchd on the node).
++
++## Gotchas
++
++- drizzle-orm ≥0.44 wraps pg errors: use `pgCode(e)` (`apps/api/src/lib/pg.ts`), not `e.code`.
++- Way/line pays are in bet units (`betDivisor`: 25 for 5-reel ways, 50 for 6+ reels, `lines.length` for line games); scatter/bonus/coin values are × total bet. `payScale` from `calibration.json` scales all non-jackpot wins.
++- Certification tolerance is statistical: `max(0.4%, 3σ/√n)` capped at 1.5% — high-volatility games need ≥10M spins.
++- Turbopack: import workspace packages without `.js` extensions; browser code imports `@spinza/game-core/client` only.
++- PixiJS renderer must be created client-side only (`GameClient` is `"use client"`; `Application.init` is async).

added README.md +38 −0

++# Spinza
++
++**www.spinza.dev — The Virtual Casino Playground.**
++
++Spinza is a premium *fictional* social casino: twenty original games, a real server-authoritative game engine, cryptographically secure RNG, versioned game mathematics, a simulation & certification platform and an immutable wallet ledger — all running on **Spinza Credits (SC)**, a virtual currency with no monetary value.
++
++> Virtual credits only. No deposits. No withdrawals. No cash value. 18+.
++
++## What's inside
++
++- `packages/game-core` — the Spinza Game Engine (ways/lines, wilds, scatters, cascades, hold & respin, pick bonuses, persistent meters, heat, mystery, quantum split, dynamic grids, fictional jackpots), simulator and certification.
++- `games/` — 20 original definitions (`defineGame`), calibration and 10,000,000-spin certification reports.
++- `apps/api` — Fastify API: username/password accounts (Argon2id), recovery codes, opaque sessions, atomic spins with idempotency, ledger, XP/levels, achievements, missions, daily & rescue rewards, leaderboards, TOTP admin.
++- `apps/web` — Next.js 16 front-end: landing, lobby, PixiJS game screen with procedural art and WebAudio sound, rewards, leaderboards, profile, settings, admin console.
++- `apps/simulator` — multi-threaded CLI (`pnpm sim …`).
++
++See `CLAUDE.md` for the working guide and `docs/SPEC-original.md` for the product brief.
++
++## Quick start
++
++```bash
++pnpm install
++createdb spinza
++pnpm db:migrate && pnpm db:seed
++pnpm dev:api    # http://127.0.0.1:8231
++pnpm dev:web    # http://localhost:8230
++```
++
++Requires Node ≥ 22, pnpm 11, PostgreSQL 17 and Redis on localhost.
++
++## Certification
++
++Every game ships with `games/certifications/<slug>.json`; the seed publishes a game only when the report is `PASS` for the exact version. Re-certify after any math change:
++
++```bash
++pnpm sim calibrate <slug> --spins 10000000
++pnpm sim certify <slug> --spins 10000000
++```

added apps/api/package.json +34 −0

++{
++  "name": "@spinza/api",
++  "version": "0.1.0",
++  "private": true,
++  "type": "module",
++  "scripts": {
++    "dev": "tsx watch src/server.ts",
++    "start": "tsx src/server.ts",
++    "admin:create": "tsx src/admin-create.ts",
++    "typecheck": "tsc -p tsconfig.json --noEmit",
++    "test": "vitest run"
++  },
++  "dependencies": {
++    "@fastify/cookie": "^11.0.2",
++    "@spinza/database": "workspace:*",
++    "@spinza/game-core": "workspace:*",
++    "@spinza/games": "workspace:*",
++    "@spinza/shared": "workspace:*",
++    "@spinza/simulator": "workspace:*",
++    "argon2": "^0.44.0",
++    "fastify": "^5.4.0",
++    "fastify-plugin": "^6.0.0",
++    "ioredis": "^5.6.0",
++    "pino": "^9.7.0",
++    "pino-pretty": "^13.0.0",
++    "tsx": "^4.20.0",
++    "zod": "^4.0.0"
++  },
++  "devDependencies": {
++    "@types/node": "^24.0.0",
++    "typescript": "^5.9.3",
++    "vitest": "^3.2.0"
++  }
++}

added apps/api/src/admin-create.ts +36 −0

++/**
++ * Create (or reset) an admin account with TOTP.
++ *   pnpm admin:create <username> [password]
++ * Prints the TOTP secret + otpauth URL once. Never logs the password.
++ */
++import { adminUsers, closeDb, db, eq } from "@spinza/database";
++import { encrypt, generateTotpSecret, hashPassword, otpauthUrl, randomToken } from "./lib/crypto";
++
++async function main() {
++  const [username, passwordArg] = process.argv.slice(2);
++  if (!username) {
++    console.error("usage: admin:create <username> [password]");
++    process.exit(1);
++  }
++  const password = passwordArg ?? randomToken(12);
++  const secret = generateTotpSecret();
++  const passwordHash = await hashPassword(password);
++  const existing = await db.query.adminUsers.findFirst({ where: eq(adminUsers.username, username.toLowerCase()) });
++  if (existing) {
++    await db.update(adminUsers).set({ passwordHash, totpSecret: encrypt(secret), disabled: false }).where(eq(adminUsers.id, existing.id));
++    console.log(`Admin "${username}" reset.`);
++  } else {
++    await db.insert(adminUsers).values({ username: username.toLowerCase(), passwordHash, totpSecret: encrypt(secret) });
++    console.log(`Admin "${username}" created.`);
++  }
++  console.log(`Password: ${passwordArg ? "(as provided)" : password}`);
++  console.log(`TOTP secret (base32): ${secret}`);
++  console.log(`otpauth URL: ${otpauthUrl(username, secret)}`);
++  console.log("Add the secret to an authenticator app now — it is not shown again.");
++  await closeDb();
++}
++
++main().catch((e) => {
++  console.error(e);
++  process.exit(1);
++});

added apps/api/src/app.ts +75 −0

++import Fastify, { type FastifyInstance } from "fastify";
++import cookie from "@fastify/cookie";
++import { ZodError } from "zod";
++import { config } from "./config";
++import { ApiError } from "./lib/errors";
++import { authPlugin } from "./plugins/auth";
++import { authRoutes } from "./routes/auth";
++import { userRoutes } from "./routes/user";
++import { gameRoutes } from "./routes/games";
++import { rewardRoutes } from "./routes/rewards";
++import { healthRoutes } from "./routes/health";
++import { adminRoutes } from "./routes/admin";
++import { refreshSettings } from "./lib/settings";
++
++const REDACT = ["req.headers.cookie", "req.headers.authorization", "*.password", "*.newPassword", "*.currentPassword", "*.recoveryCode", "*.totp", "*.passwordHash", "*.tokenHash"];
++
++export async function buildApp(): Promise<FastifyInstance> {
++  const app = Fastify({
++    logger: {
++      level: config.logLevel,
++      redact: { paths: REDACT, censor: "[redacted]" },
++      transport: config.env === "development" ? { target: "pino-pretty", options: { translateTime: "HH:MM:ss", ignore: "pid,hostname" } } : undefined,
++    },
++    trustProxy: config.trustProxy,
++    bodyLimit: 64 * 1024,
++    genReqId: () => Math.random().toString(36).slice(2, 10), // request ids only — never used for game outcomes
++  });
++
++  await app.register(cookie, { secret: config.sessionSecret });
++  await app.register(authPlugin);
++
++  app.addHook("onRequest", async (_req, reply) => {
++    reply.header("Cache-Control", "no-store");
++    reply.header("X-Content-Type-Options", "nosniff");
++  });
++
++  app.addHook("onReady", async () => {
++    await refreshSettings(true);
++    setInterval(() => refreshSettings().catch(() => {}), 10_000).unref();
++  });
++
++  app.setErrorHandler((err: Error & { validation?: unknown; statusCode?: number }, req, reply) => {
++    if (err instanceof ApiError) {
++      reply.code(err.status).send({ error: err.code, message: err.message, details: err.details });
++      return;
++    }
++    if (err instanceof ZodError) {
++      reply.code(400).send({ error: "VALIDATION", message: "Invalid request.", details: err.flatten() });
++      return;
++    }
++    if ((err as { validation?: unknown }).validation) {
++      reply.code(400).send({ error: "VALIDATION", message: err.message });
++      return;
++    }
++    if ((err as { statusCode?: number }).statusCode === 413) {
++      reply.code(413).send({ error: "PAYLOAD_TOO_LARGE", message: "Request too large." });
++      return;
++    }
++    req.log.error({ err }, "unhandled error");
++    reply.code(500).send({ error: "INTERNAL", message: "Something went wrong on our side." });
++  });
++
++  app.setNotFoundHandler((_req, reply) => {
++    reply.code(404).send({ error: "NOT_FOUND", message: "Route not found." });
++  });
++
++  await app.register(healthRoutes);
++  await app.register(authRoutes);
++  await app.register(userRoutes);
++  await app.register(gameRoutes);
++  await app.register(rewardRoutes);
++  await app.register(adminRoutes);
++
++  return app;
++}

added apps/api/src/config.ts +22 −0

++export const config = {
++  env: process.env.NODE_ENV ?? "development",
++  port: Number(process.env.API_PORT ?? 8231),
++  host: process.env.API_HOST ?? "127.0.0.1",
++  databaseUrl: process.env.DATABASE_URL ?? "postgres://localhost:5432/spinza",
++  redisUrl: process.env.REDIS_URL ?? "redis://127.0.0.1:6379",
++  sessionSecret: process.env.SESSION_SECRET ?? "dev-secret-change-me-dev-secret-change-me",
++  siteUrl: process.env.NEXT_PUBLIC_SITE_URL ?? "http://localhost:8230",
++  cookieSecure: process.env.COOKIE_SECURE ? process.env.COOKIE_SECURE === "1" : (process.env.NODE_ENV ?? "development") === "production",
++  adminIpAllowlist: (process.env.ADMIN_IP_ALLOWLIST ?? "")
++    .split(",")
++    .map((s) => s.trim())
++    .filter(Boolean),
++  logLevel: process.env.LOG_LEVEL ?? "info",
++  version: process.env.SPINZA_VERSION ?? "0.1.0",
++  /** Trust X-Forwarded-For from the local reverse proxy / Next rewrite. */
++  trustProxy: true,
++};
++
++export const allowedOrigins = new Set(
++  [config.siteUrl, "http://localhost:8230", "http://127.0.0.1:8230", "http://localhost:3000"].map((u) => u.replace(/\/$/, "")),
++);

added apps/api/src/lib/crypto.ts +154 −0

++import argon2 from "argon2";
++import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
++import { RECOVERY_CODE_PREFIX, ROUND_ID_PREFIX } from "@spinza/shared";
++import { config } from "../config";
++
++/* ------------------------------------------------------------- passwords */
++
++const ARGON_OPTS: argon2.Options = { type: argon2.argon2id, memoryCost: 19456, timeCost: 2, parallelism: 1 };
++
++export async function hashPassword(password: string): Promise<string> {
++  return argon2.hash(password, ARGON_OPTS);
++}
++
++export async function verifyPassword(hash: string, password: string): Promise<boolean> {
++  try {
++    return await argon2.verify(hash, password);
++  } catch {
++    return false;
++  }
++}
++
++/* ---------------------------------------------------------------- tokens */
++
++export function randomToken(bytes = 32): string {
++  return randomBytes(bytes).toString("base64url");
++}
++
++export function sha256(input: string): string {
++  return createHash("sha256").update(input).digest("hex");
++}
++
++export function hmac(input: string): string {
++  return createHmac("sha256", config.sessionSecret).update(input).digest("hex");
++}
++
++/** Round ids: spz_rnd_ + 12 chars from an unambiguous alphabet. */
++const ROUND_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
++export function newRoundId(): string {
++  let s = "";
++  for (let i = 0; i < 12; i++) s += ROUND_ALPHABET[randomInt(ROUND_ALPHABET.length)];
++  return `${ROUND_ID_PREFIX}${s}`;
++}
++
++/* --------------------------------------------------------- recovery code */
++
++export function generateRecoveryCode(): string {
++  const groups: string[] = [];
++  for (let g = 0; g < 3; g++) {
++    let s = "";
++    for (let i = 0; i < 4; i++) s += ROUND_ALPHABET[randomInt(ROUND_ALPHABET.length)];
++    groups.push(s);
++  }
++  return `${RECOVERY_CODE_PREFIX}-${groups.join("-")}`;
++}
++
++export function normalizeRecoveryCode(code: string): string {
++  return code.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
++}
++
++export async function hashRecoveryCode(code: string): Promise<string> {
++  return argon2.hash(normalizeRecoveryCode(code), ARGON_OPTS);
++}
++
++export async function verifyRecoveryCode(hash: string, code: string): Promise<boolean> {
++  try {
++    return await argon2.verify(hash, normalizeRecoveryCode(code));
++  } catch {
++    return false;
++  }
++}
++
++/* -------------------------------------------------- symmetric encryption */
++
++function key(): Buffer {
++  return createHash("sha256").update(config.sessionSecret).digest();
++}
++
++export function encrypt(plain: string): string {
++  const iv = randomBytes(12);
++  const c = createCipheriv("aes-256-gcm", key(), iv);
++  const enc = Buffer.concat([c.update(plain, "utf8"), c.final()]);
++  return `${iv.toString("base64url")}.${enc.toString("base64url")}.${c.getAuthTag().toString("base64url")}`;
++}
++
++export function decrypt(payload: string): string {
++  const [iv, enc, tag] = payload.split(".").map((p) => Buffer.from(p, "base64url"));
++  const d = createDecipheriv("aes-256-gcm", key(), iv);
++  d.setAuthTag(tag);
++  return Buffer.concat([d.update(enc), d.final()]).toString("utf8");
++}
++
++/* ------------------------------------------------------------------ TOTP */
++
++const B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
++
++export function base32Encode(buf: Buffer): string {
++  let bits = 0;
++  let value = 0;
++  let out = "";
++  for (const byte of buf) {
++    value = (value << 8) | byte;
++    bits += 8;
++    while (bits >= 5) {
++      out += B32[(value >>> (bits - 5)) & 31];
++      bits -= 5;
++    }
++  }
++  if (bits > 0) out += B32[(value << (5 - bits)) & 31];
++  return out;
++}
++
++export function base32Decode(s: string): Buffer {
++  const clean = s.toUpperCase().replace(/=+$/, "").replace(/[^A-Z2-7]/g, "");
++  let bits = 0;
++  let value = 0;
++  const out: number[] = [];
++  for (const ch of clean) {
++    value = (value << 5) | B32.indexOf(ch);
++    bits += 5;
++    if (bits >= 8) {
++      out.push((value >>> (bits - 8)) & 255);
++      bits -= 8;
++    }
++  }
++  return Buffer.from(out);
++}
++
++export function generateTotpSecret(): string {
++  return base32Encode(randomBytes(20));
++}
++
++export function totpCode(secret: string, time = Date.now(), step = 30, digits = 6): string {
++  const counter = Math.floor(time / 1000 / step);
++  const msg = Buffer.alloc(8);
++  msg.writeBigUInt64BE(BigInt(counter));
++  const h = createHmac("sha1", base32Decode(secret)).update(msg).digest();
++  const offset = h[h.length - 1] & 0xf;
++  const bin = ((h[offset] & 0x7f) << 24) | (h[offset + 1] << 16) | (h[offset + 2] << 8) | h[offset + 3];
++  return String(bin % 10 ** digits).padStart(digits, "0");
++}
++
++export function verifyTotp(secret: string, code: string, window = 1): boolean {
++  const c = code.replace(/\s+/g, "");
++  if (!/^\d{6}$/.test(c)) return false;
++  for (let w = -window; w <= window; w++) {
++    const expected = totpCode(secret, Date.now() + w * 30_000);
++    if (timingSafeEqual(Buffer.from(expected), Buffer.from(c))) return true;
++  }
++  return false;
++}
++
++export function otpauthUrl(username: string, secret: string): string {
++  return `otpauth://totp/Spinza%20Admin:${encodeURIComponent(username)}?secret=${secret}&issuer=Spinza%20Admin&algorithm=SHA1&digits=6&period=30`;
++}

added apps/api/src/lib/errors.ts +22 −0

++export class ApiError extends Error {
++  constructor(
++    public status: number,
++    public code: string,
++    message: string,
++    public details?: unknown,
++  ) {
++    super(message);
++  }
++}
++
++export const errors = {
++  badRequest: (msg = "Bad request", details?: unknown) => new ApiError(400, "BAD_REQUEST", msg, details),
++  unauthorized: (msg = "Please sign in.") => new ApiError(401, "UNAUTHORIZED", msg),
++  forbidden: (msg = "Forbidden") => new ApiError(403, "FORBIDDEN", msg),
++  notFound: (msg = "Not found") => new ApiError(404, "NOT_FOUND", msg),
++  conflict: (code: string, msg: string) => new ApiError(409, code, msg),
++  rateLimited: (retryAfter: number) => new ApiError(429, "RATE_LIMITED", "Too many requests. Please slow down.", { retryAfter }),
++  insufficient: (balance: number, bet: number) => new ApiError(402, "INSUFFICIENT_CREDITS", "Not enough Spinza Credits for this bet.", { balance, bet }),
++  maintenance: (message: string) => new ApiError(503, "MAINTENANCE", message),
++  unavailable: (msg = "Game unavailable") => new ApiError(503, "GAME_UNAVAILABLE", msg),
++};

added apps/api/src/lib/pg.ts +7 −0

++/** Extract the PostgreSQL error code from a raw pg error or a drizzle-wrapped one. */
++export function pgCode(e: unknown): string | undefined {
++  const err = e as { code?: string; cause?: { code?: string } } | undefined;
++  return err?.code ?? err?.cause?.code;
++}
++
++export const PG_UNIQUE_VIOLATION = "23505";

added apps/api/src/lib/redis.ts +52 −0

++import Redis from "ioredis";
++import { config } from "../config";
++
++let _redis: Redis | null = null;
++
++export function redis(): Redis {
++  if (!_redis) {
++    _redis = new Redis(config.redisUrl, { maxRetriesPerRequest: 2, enableOfflineQueue: true, lazyConnect: false });
++    _redis.on("error", (e) => console.error("[redis]", e.message));
++  }
++  return _redis;
++}
++
++export async function pingRedis(): Promise<number> {
++  const t = Date.now();
++  await redis().ping();
++  return Date.now() - t;
++}
++
++export async function closeRedis(): Promise<void> {
++  if (_redis) {
++    await _redis.quit();
++    _redis = null;
++  }
++}
++
++/**
++ * Sliding-window rate limit (fixed window with two buckets). Returns retry-after
++ * seconds when exceeded, else 0.
++ */
++export async function rateLimit(key: string, limit: number, windowSec: number): Promise<number> {
++  const r = redis();
++  const now = Math.floor(Date.now() / 1000);
++  const bucket = Math.floor(now / windowSec);
++  const k = `rl:${key}:${bucket}`;
++  const prevK = `rl:${key}:${bucket - 1}`;
++  const [[, cur], [, prev]] = (await r.multi().incr(k).get(prevK).exec()) as [[null, number], [null, string | null]];
++  if (cur === 1) await r.expire(k, windowSec * 2);
++  const elapsed = (now % windowSec) / windowSec;
++  const weighted = cur + Number(prev ?? 0) * (1 - elapsed);
++  if (weighted > limit) return Math.max(1, windowSec - (now % windowSec));
++  return 0;
++}
++
++export async function setJson(key: string, value: unknown, ttlSec: number): Promise<void> {
++  await redis().set(key, JSON.stringify(value), "EX", ttlSec);
++}
++
++export async function getJson<T>(key: string): Promise<T | null> {
++  const v = await redis().get(key);
++  return v ? (JSON.parse(v) as T) : null;
++}

added apps/api/src/lib/security.ts +49 −0

++import { db, securityEvents } from "@spinza/database";
++import type { FastifyRequest } from "fastify";
++
++export type SecurityEventType =
++  | "login.success"
++  | "login.failed"
++  | "register"
++  | "logout"
++  | "password.changed"
++  | "recovery.used"
++  | "recovery.failed"
++  | "rate_limit"
++  | "spin.suspicious"
++  | "admin.login.success"
++  | "admin.login.failed"
++  | "admin.wallet.adjust"
++  | "admin.user.status"
++  | "admin.game.lifecycle"
++  | "admin.game.flags"
++  | "admin.flag"
++  | "admin.setting"
++  | "admin.maintenance"
++  | "csrf.rejected";
++
++export function clientIp(req: FastifyRequest): string {
++  const xff = req.headers["x-forwarded-for"];
++  if (typeof xff === "string" && xff.length) return xff.split(",").pop()!.trim();
++  return req.ip;
++}
++
++export async function logSecurity(
++  req: FastifyRequest | null,
++  type: SecurityEventType,
++  opts: { userId?: string | null; adminId?: string | null; severity?: "info" | "warn" | "high"; meta?: Record<string, unknown> } = {},
++): Promise<void> {
++  try {
++    await db.insert(securityEvents).values({
++      userId: opts.userId ?? null,
++      adminId: opts.adminId ?? null,
++      type,
++      severity: opts.severity ?? (type.includes("failed") || type === "rate_limit" || type === "csrf.rejected" ? "warn" : "info"),
++      ip: req ? clientIp(req) : null,
++      userAgent: req ? (req.headers["user-agent"] ?? "").slice(0, 300) : null,
++      meta: opts.meta ?? null,
++    });
++  } catch (e) {
++    req?.log.error({ err: e }, "security event write failed");
++  }
++}

added apps/api/src/lib/settings.ts +51 −0

++import { db, eq, featureFlags, platformSettings } from "@spinza/database";
++import { DAILY_REWARDS, RESCUE_CREDITS_AMOUNT, RESCUE_CREDITS_COOLDOWN_HOURS } from "@spinza/shared";
++
++/** In-process cache of flags & settings, refreshed every 10 s. */
++let flags = new Map<string, boolean>();
++let settings = new Map<string, unknown>();
++let loadedAt = 0;
++const TTL = 10_000;
++
++export async function refreshSettings(force = false): Promise<void> {
++  if (!force && Date.now() - loadedAt < TTL) return;
++  const [f, s] = await Promise.all([db.select().from(featureFlags), db.select().from(platformSettings)]);
++  flags = new Map(f.map((x) => [x.key, x.enabled]));
++  settings = new Map(s.map((x) => [x.key, x.value]));
++  loadedAt = Date.now();
++}
++
++export function flag(key: string, def = true): boolean {
++  return flags.has(key) ? (flags.get(key) as boolean) : def;
++}
++
++export function setting<T>(key: string, def: T): T {
++  return settings.has(key) ? (settings.get(key) as T) : def;
++}
++
++export interface MaintenanceSetting {
++  enabled: boolean;
++  message: string;
++}
++export const maintenance = () => setting<MaintenanceSetting>("maintenance", { enabled: false, message: "Spinza is getting an upgrade. Your credits and progress are safe." });
++export const rescueConfig = () => setting("rescue", { amount: RESCUE_CREDITS_AMOUNT, cooldownHours: RESCUE_CREDITS_COOLDOWN_HOURS, threshold: 0 });
++export const dailySchedule = () => setting("dailyRewards", { schedule: DAILY_REWARDS as readonly number[] }).schedule;
++export const profanityWords = () => setting("profanity", { words: [] as string[] }).words;
++
++export async function setFlag(key: string, enabled: boolean): Promise<void> {
++  await db.insert(featureFlags).values({ key, enabled }).onConflictDoUpdate({ target: featureFlags.key, set: { enabled, updatedAt: new Date() } });
++  await refreshSettings(true);
++}
++
++export async function setSetting(key: string, value: unknown): Promise<void> {
++  await db.insert(platformSettings).values({ key, value }).onConflictDoUpdate({ target: platformSettings.key, set: { value, updatedAt: new Date() } });
++  await refreshSettings(true);
++}
++
++export function allFlags(): Record<string, boolean> {
++  return Object.fromEntries(flags);
++}
++export function allSettings(): Record<string, unknown> {
++  return Object.fromEntries(settings);
++}
++export { eq };

added apps/api/src/plugins/auth.ts +150 −0

++import fp from "fastify-plugin";
++import type { FastifyReply, FastifyRequest } from "fastify";
++import { and, db, eq, gt, sessions, users, adminSessions, adminUsers } from "@spinza/database";
++import { ADMIN_COOKIE, ADMIN_SESSION_TTL_HOURS, SESSION_COOKIE, SESSION_TTL_DAYS } from "@spinza/shared";
++import { randomToken, sha256 } from "../lib/crypto";
++import { getJson, redis, setJson } from "../lib/redis";
++import { config, allowedOrigins } from "../config";
++import { errors } from "../lib/errors";
++import { clientIp, logSecurity } from "../lib/security";
++
++export interface SessionUser {
++  id: string;
++  username: string;
++  status: string;
++}
++
++export interface AdminUser {
++  id: string;
++  username: string;
++  role: string;
++}
++
++declare module "fastify" {
++  interface FastifyRequest {
++    user: SessionUser | null;
++    sessionId: string | null;
++    admin: AdminUser | null;
++  }
++}
++
++const SESSION_CACHE_TTL = 60;
++
++export async function createSession(reply: FastifyReply, req: FastifyRequest, userId: string): Promise<void> {
++  const token = randomToken(32);
++  const tokenHash = sha256(token);
++  const expiresAt = new Date(Date.now() + SESSION_TTL_DAYS * 86400_000);
++  await db.insert(sessions).values({ userId, tokenHash, expiresAt, userAgent: (req.headers["user-agent"] ?? "").slice(0, 300), ip: clientIp(req) });
++  reply.setCookie(SESSION_COOKIE, token, {
++    httpOnly: true,
++    secure: config.cookieSecure,
++    sameSite: "lax",
++    path: "/",
++    maxAge: SESSION_TTL_DAYS * 86400,
++  });
++}
++
++export async function destroySession(reply: FastifyReply, req: FastifyRequest): Promise<void> {
++  const token = req.cookies[SESSION_COOKIE];
++  if (token) {
++    const h = sha256(token);
++    await db.delete(sessions).where(eq(sessions.tokenHash, h));
++    await redis().del(`sess:${h}`);
++  }
++  reply.clearCookie(SESSION_COOKIE, { path: "/" });
++}
++
++export async function destroyAllSessions(userId: string): Promise<void> {
++  const rows = await db.select({ tokenHash: sessions.tokenHash }).from(sessions).where(eq(sessions.userId, userId));
++  await db.delete(sessions).where(eq(sessions.userId, userId));
++  if (rows.length) await redis().del(...rows.map((r) => `sess:${r.tokenHash}`));
++}
++
++async function resolveUser(token: string): Promise<{ user: SessionUser; sessionId: string } | null> {
++  const h = sha256(token);
++  const cached = await getJson<{ user: SessionUser; sessionId: string }>(`sess:${h}`);
++  if (cached) return cached;
++  const row = await db
++    .select({ id: users.id, username: users.username, status: users.status, sessionId: sessions.id })
++    .from(sessions)
++    .innerJoin(users, eq(users.id, sessions.userId))
++    .where(and(eq(sessions.tokenHash, h), gt(sessions.expiresAt, new Date())))
++    .limit(1);
++  if (!row.length) return null;
++  const value = { user: { id: row[0].id, username: row[0].username, status: row[0].status }, sessionId: row[0].sessionId };
++  await setJson(`sess:${h}`, value, SESSION_CACHE_TTL);
++  // Touch last_seen occasionally (cheap update).
++  db.update(sessions).set({ lastSeenAt: new Date() }).where(eq(sessions.id, value.sessionId)).catch(() => {});
++  return value;
++}
++
++export async function createAdminSession(reply: FastifyReply, req: FastifyRequest, adminId: string): Promise<void> {
++  const token = randomToken(32);
++  const expiresAt = new Date(Date.now() + ADMIN_SESSION_TTL_HOURS * 3600_000);
++  await db.insert(adminSessions).values({ adminId, tokenHash: sha256(token), expiresAt, ip: clientIp(req) });
++  reply.setCookie(ADMIN_COOKIE, token, { httpOnly: true, secure: config.cookieSecure, sameSite: "strict", path: "/", maxAge: ADMIN_SESSION_TTL_HOURS * 3600 });
++}
++
++export async function destroyAdminSession(reply: FastifyReply, req: FastifyRequest): Promise<void> {
++  const token = req.cookies[ADMIN_COOKIE];
++  if (token) await db.delete(adminSessions).where(eq(adminSessions.tokenHash, sha256(token)));
++  reply.clearCookie(ADMIN_COOKIE, { path: "/" });
++}
++
++async function resolveAdmin(token: string): Promise<AdminUser | null> {
++  const row = await db
++    .select({ id: adminUsers.id, username: adminUsers.username, role: adminUsers.role, disabled: adminUsers.disabled })
++    .from(adminSessions)
++    .innerJoin(adminUsers, eq(adminUsers.id, adminSessions.adminId))
++    .where(and(eq(adminSessions.tokenHash, sha256(token)), gt(adminSessions.expiresAt, new Date())))
++    .limit(1);
++  if (!row.length || row[0].disabled) return null;
++  return { id: row[0].id, username: row[0].username, role: row[0].role };
++}
++
++export const authPlugin = fp(async (app) => {
++  app.decorateRequest("user", null);
++  app.decorateRequest("sessionId", null);
++  app.decorateRequest("admin", null);
++
++  app.addHook("onRequest", async (req) => {
++    const token = req.cookies?.[SESSION_COOKIE];
++    if (token) {
++      const r = await resolveUser(token);
++      if (r) {
++        req.user = r.user;
++        req.sessionId = r.sessionId;
++      }
++    }
++    if (req.url.startsWith("/api/admin")) {
++      const at = req.cookies?.[ADMIN_COOKIE];
++      if (at) req.admin = await resolveAdmin(at);
++    }
++  });
++
++  // CSRF: state-changing requests must come from an allowed origin.
++  app.addHook("preHandler", async (req) => {
++    if (req.method === "GET" || req.method === "HEAD" || req.method === "OPTIONS") return;
++    const origin = req.headers.origin ?? (req.headers.referer ? new URL(req.headers.referer).origin : null);
++    const fetchSite = req.headers["sec-fetch-site"];
++    if (fetchSite === "same-origin" || fetchSite === "none") return;
++    if (origin && allowedOrigins.has(origin.replace(/\/$/, ""))) return;
++    // Requests forwarded by the Next.js server keep the browser's Origin header. Missing origin from a
++    // non-browser client is accepted only when there is no session cookie to protect.
++    if (!origin && !req.cookies?.[SESSION_COOKIE] && !req.cookies?.[ADMIN_COOKIE]) return;
++    await logSecurity(req, "csrf.rejected", { meta: { origin, path: req.url } });
++    throw errors.forbidden("Cross-site request rejected.");
++  });
++});
++
++export function requireUser(req: FastifyRequest): SessionUser {
++  if (!req.user) throw errors.unauthorized();
++  if (req.user.status !== "active") throw errors.forbidden("This account is suspended.");
++  return req.user;
++}
++
++export function requireAdmin(req: FastifyRequest): AdminUser {
++  if (config.adminIpAllowlist.length && !config.adminIpAllowlist.includes(clientIp(req))) throw errors.forbidden("Admin access is restricted.");
++  if (!req.admin) throw errors.unauthorized("Admin sign-in required.");
++  return req.admin;
++}

added apps/api/src/routes/admin.ts +387 −0

++import type { FastifyInstance } from "fastify";
++import os from "node:os";
++import { achievements, adminUsers, and, count, creditTransactions, db, desc, eq, gameRounds, gameStatistics, games, gte, ilike, missions, securityEvents, sessions, simulationRuns, sql, users, wallets, gameVersions, or } from "@spinza/database";
++import { GAMES, getGame } from "@spinza/games";
++import { certify, DEFAULT_CERTIFICATION_RULES, validateDefinition } from "@spinza/game-core";
++import { simulateParallel } from "@spinza/simulator";
++import { GAME_LIFECYCLE } from "@spinza/shared";
++import { z } from "zod";
++import { errors } from "../lib/errors";
++import { decrypt, verifyPassword, verifyTotp } from "../lib/crypto";
++import { rateLimit, redis } from "../lib/redis";
++import { createAdminSession, destroyAdminSession, requireAdmin } from "../plugins/auth";
++import { clientIp, logSecurity } from "../lib/security";
++import { allFlags, allSettings, refreshSettings, setFlag, setSetting } from "../lib/settings";
++import { grant } from "../services/wallet";
++import { config } from "../config";
++import { pingDb } from "@spinza/database";
++import { pingRedis } from "../lib/redis";
++
++const startedAt = Date.now();
++
++export async function adminRoutes(app: FastifyInstance) {
++  /* ------------------------------------------------------------- auth */
++  app.post("/api/admin/auth/login", async (req, reply) => {
++    if (config.adminIpAllowlist.length && !config.adminIpAllowlist.includes(clientIp(req))) throw errors.forbidden("Admin access is restricted.");
++    const retry = await rateLimit(`admin-login:${clientIp(req)}`, 10, 600);
++    if (retry) throw errors.rateLimited(retry);
++    const body = z.object({ username: z.string().min(1), password: z.string().min(1), totp: z.string().min(6).max(8) }).parse(req.body);
++    const a = await db.query.adminUsers.findFirst({ where: eq(adminUsers.username, body.username.toLowerCase()) });
++    const ok = !!a && !a.disabled && (await verifyPassword(a.passwordHash, body.password)) && verifyTotp(decrypt(a.totpSecret), body.totp);
++    if (!ok) {
++      await logSecurity(req, "admin.login.failed", { adminId: a?.id ?? null, severity: "high", meta: { username: body.username } });
++      throw errors.unauthorized("Invalid credentials.");
++    }
++    await db.update(adminUsers).set({ lastLoginAt: new Date() }).where(eq(adminUsers.id, a.id));
++    await createAdminSession(reply, req, a.id);
++    await logSecurity(req, "admin.login.success", { adminId: a.id, severity: "warn" });
++    return { admin: { id: a.id, username: a.username, role: a.role } };
++  });
++
++  app.post("/api/admin/auth/logout", async (req, reply) => {
++    await destroyAdminSession(reply, req);
++    return { ok: true };
++  });
++
++  app.get("/api/admin/me", async (req) => {
++    const admin = requireAdmin(req);
++    return { admin };
++  });
++
++  /* -------------------------------------------------------- dashboard */
++  app.get("/api/admin/dashboard", async (req) => {
++    requireAdmin(req);
++    const now = new Date();
++    const dayAgo = new Date(now.getTime() - 86400_000);
++    const weekAgo = new Date(now.getTime() - 7 * 86400_000);
++    const monthAgo = new Date(now.getTime() - 30 * 86400_000);
++    const todayStart = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
++    const [[regs], [dau], [wau], [mau], [activeSessions], todayAgg, topGames, highestWins, latency, errCount] = await Promise.all([
++      db.select({ n: count() }).from(users),
++      db.select({ n: sql<number>`count(distinct user_id)::int` }).from(gameRounds).where(gte(gameRounds.createdAt, dayAgo)),
++      db.select({ n: sql<number>`count(distinct user_id)::int` }).from(gameRounds).where(gte(gameRounds.createdAt, weekAgo)),
++      db.select({ n: sql<number>`count(distinct user_id)::int` }).from(gameRounds).where(gte(gameRounds.createdAt, monthAgo)),
++      db.select({ n: count() }).from(sessions).where(gte(sessions.lastSeenAt, new Date(now.getTime() - 30 * 60_000))),
++      db.execute(sql`select count(*)::int as spins, coalesce(sum(bet),0)::bigint as wagered, coalesce(sum(win),0)::bigint as won, coalesce(avg(duration_ms),0)::float as avg_ms,
++                     coalesce(percentile_cont(0.95) within group (order by duration_ms),0)::float as p95_ms from game_rounds where created_at >= ${todayStart}`),
++      db.execute(sql`select game_slug, count(*)::int as spins, coalesce(sum(bet),0)::bigint as wagered, coalesce(sum(win),0)::bigint as won from game_rounds where created_at >= ${weekAgo} group by game_slug order by spins desc limit 8`),
++      db.execute(sql`select r.round_id, r.game_slug, r.bet, r.win, r.multiplier, r.created_at, u.username from game_rounds r join users u on u.id = r.user_id order by r.win desc limit 10`),
++      pingDb().catch(() => -1),
++      db.select({ n: count() }).from(securityEvents).where(and(gte(securityEvents.createdAt, dayAgo), eq(securityEvents.severity, "high"))),
++    ]);
++    const t = todayAgg.rows[0] as { spins: number; wagered: number; won: number; avg_ms: number; p95_ms: number };
++    const sessionsAgg = await db.execute(sql`select coalesce(avg(extract(epoch from (last_seen_at - created_at))),0)::float as avg_session from sessions where created_at >= ${weekAgo}`);
++    const live = await redis().zcount("live:players", Date.now() - 5 * 60_000, "+inf").catch(() => 0);
++    return {
++      users: { registered: regs.n, dau: dau.n, wau: wau.n, mau: mau.n, activeSessions: activeSessions.n, livePlayers: live },
++      today: { spins: t.spins, wagered: Number(t.wagered), won: Number(t.won), effectiveRtp: Number(t.wagered) ? Number(t.won) / Number(t.wagered) : null, avgSpinMs: t.avg_ms, p95SpinMs: t.p95_ms },
++      averageSessionSec: Number((sessionsAgg.rows[0] as { avg_session: number }).avg_session),
++      topGames: (topGames.rows as Record<string, unknown>[]).map((r) => ({ slug: r.game_slug, spins: r.spins, wagered: Number(r.wagered), won: Number(r.won), rtp: Number(r.wagered) ? Number(r.won) / Number(r.wagered) : null })),
++      highestWins: (highestWins.rows as Record<string, unknown>[]).map((r) => ({ roundId: r.round_id, game: r.game_slug, bet: Number(r.bet), win: Number(r.win), multiplier: Number(r.multiplier), at: r.created_at, username: r.username })),
++      health: { dbLatencyMs: latency, highSeverityEvents24h: errCount[0].n, uptimeSec: Math.round((Date.now() - startedAt) / 1000), version: config.version, node: os.hostname() },
++    };
++  });
++
++  /* ------------------------------------------------------------ users */
++  app.get("/api/admin/users", async (req) => {
++    requireAdmin(req);
++    const q = z.object({ q: z.string().optional(), limit: z.coerce.number().int().min(1).max(200).default(50), offset: z.coerce.number().int().min(0).default(0), sort: z.enum(["created", "spins", "balance", "level"]).default("created") }).parse(req.query);
++    const where = q.q ? ilike(users.username, `%${q.q}%`) : undefined;
++    const order = { created: desc(users.createdAt), spins: desc(users.totalSpins), balance: desc(wallets.balance), level: desc(users.level) }[q.sort];
++    const rows = await db
++      .select({ id: users.id, username: users.username, level: users.level, xp: users.xp, status: users.status, createdAt: users.createdAt, lastLoginAt: users.lastLoginAt, totalSpins: users.totalSpins, biggestWin: users.biggestWin, balance: wallets.balance, wagered: wallets.lifetimeWagered, won: wallets.lifetimeWon })
++      .from(users)
++      .innerJoin(wallets, eq(wallets.userId, users.id))
++      .where(where)
++      .orderBy(order)
++      .limit(q.limit)
++      .offset(q.offset);
++    const [{ n }] = await db.select({ n: count() }).from(users).where(where);
++    return { users: rows, total: n };
++  });
++
++  app.get("/api/admin/users/:id", async (req) => {
++    requireAdmin(req);
++    const { id } = req.params as { id: string };
++    const u = await db.query.users.findFirst({ where: eq(users.id, id) });
++    if (!u) throw errors.notFound();
++    const [w, ledger, rounds, sess, events] = await Promise.all([
++      db.query.wallets.findFirst({ where: eq(wallets.userId, id) }),
++      db.select().from(creditTransactions).where(eq(creditTransactions.userId, id)).orderBy(desc(creditTransactions.createdAt)).limit(50),
++      db.select().from(gameRounds).where(eq(gameRounds.userId, id)).orderBy(desc(gameRounds.createdAt)).limit(30),
++      db.select().from(sessions).where(eq(sessions.userId, id)).orderBy(desc(sessions.lastSeenAt)),
++      db.select().from(securityEvents).where(eq(securityEvents.userId, id)).orderBy(desc(securityEvents.createdAt)).limit(30),
++    ]);
++    const { passwordHash: _p, ...safe } = u;
++    // Ledger invariant: sum(amount) must equal balance.
++    const [{ total }] = await db.select({ total: sql<number>`coalesce(sum(amount),0)::bigint` }).from(creditTransactions).where(eq(creditTransactions.userId, id));
++    return { user: safe, wallet: w, ledger, rounds: rounds.map((r) => ({ ...r, result: undefined })), sessions: sess, events, invariant: { ledgerTotal: Number(total), balance: w?.balance ?? 0, ok: Number(total) === (w?.balance ?? 0) } };
++  });
++
++  app.post("/api/admin/users/:id/adjust", async (req) => {
++    const admin = requireAdmin(req);
++    const { id } = req.params as { id: string };
++    const body = z.object({ amount: z.number().int().min(-1_000_000_000).max(1_000_000_000).refine((n) => n !== 0), note: z.string().min(3).max(200) }).parse(req.body);
++    const balance = await db.transaction((tx) => grant(tx, id, "ADMIN_ADJUSTMENT", body.amount, `admin:${admin.username}`, { note: body.note, adminId: admin.id }));
++    await logSecurity(req, "admin.wallet.adjust", { adminId: admin.id, userId: id, severity: "high", meta: { amount: body.amount, note: body.note } });
++    return { balance };
++  });
++
++  app.post("/api/admin/users/:id/status", async (req) => {
++    const admin = requireAdmin(req);
++    const { id } = req.params as { id: string };
++    const body = z.object({ status: z.enum(["active", "suspended"]) }).parse(req.body);
++    await db.update(users).set({ status: body.status }).where(eq(users.id, id));
++    if (body.status === "suspended") {
++      const rows = await db.select({ tokenHash: sessions.tokenHash }).from(sessions).where(eq(sessions.userId, id));
++      await db.delete(sessions).where(eq(sessions.userId, id));
++      if (rows.length) await redis().del(...rows.map((r) => `sess:${r.tokenHash}`));
++    }
++    await logSecurity(req, "admin.user.status", { adminId: admin.id, userId: id, severity: "high", meta: { status: body.status } });
++    return { ok: true };
++  });
++
++  /* ------------------------------------------------------------ games */
++  app.get("/api/admin/games", async (req) => {
++    requireAdmin(req);
++    const rows = await db
++      .select({ game: games, stats: gameStatistics })
++      .from(games)
++      .leftJoin(gameStatistics, eq(gameStatistics.gameId, games.id))
++      .orderBy(games.sortOrder);
++    const flags = allFlags();
++    return {
++      games: rows.map(({ game, stats }) => {
++        const def = getGame(game.slug);
++        return {
++          ...game,
++          enabled: flags[`game.${game.slug}.enabled`] ?? true,
++          rtp: def?.rtp ?? null,
++          payScale: def?.payScale ?? null,
++          stats: stats ? { ...stats, effectiveRtp: Number(stats.wagered) ? Number(stats.won) / Number(stats.wagered) : null } : null,
++          validation: def ? validateDefinition(def) : [{ level: "error", message: "definition missing from library" }],
++        };
++      }),
++    };
++  });
++
++  app.get("/api/admin/games/:slug", async (req) => {
++    requireAdmin(req);
++    const { slug } = req.params as { slug: string };
++    const g = await db.query.games.findFirst({ where: eq(games.slug, slug) });
++    if (!g) throw errors.notFound();
++    const versions = await db.select({ version: gameVersions.version, status: gameVersions.status, createdAt: gameVersions.createdAt, certification: gameVersions.certification, definitionHash: gameVersions.definitionHash }).from(gameVersions).where(eq(gameVersions.gameId, g.id)).orderBy(desc(gameVersions.createdAt));
++    const stats = await db.query.gameStatistics.findFirst({ where: eq(gameStatistics.gameId, g.id) });
++    const daily = await db.execute(sql`select date_trunc('day', created_at) as day, count(*)::int as spins, sum(bet)::bigint as wagered, sum(win)::bigint as won, count(distinct user_id)::int as players
++      from game_rounds where game_id = ${g.id} and created_at >= now() - interval '30 days' group by 1 order by 1`);
++    const runs = await db.select().from(simulationRuns).where(eq(simulationRuns.gameSlug, slug)).orderBy(desc(simulationRuns.createdAt)).limit(10);
++    return { game: g, definition: getGame(slug) ?? null, versions, stats, daily: daily.rows, simulationRuns: runs };
++  });
++
++  app.post("/api/admin/games/:slug/lifecycle", async (req) => {
++    const admin = requireAdmin(req);
++    const { slug } = req.params as { slug: string };
++    const body = z.object({ lifecycle: z.enum(GAME_LIFECYCLE) }).parse(req.body);
++    const g = await db.query.games.findFirst({ where: eq(games.slug, slug) });
++    if (!g) throw errors.notFound();
++    if (body.lifecycle === "published") {
++      const v = await db.query.gameVersions.findFirst({ where: and(eq(gameVersions.gameId, g.id), eq(gameVersions.version, g.version)) });
++      const cert = v?.certification as { status?: string; version?: string } | null;
++      if (!cert || cert.status !== "PASS" || cert.version !== g.version) throw errors.conflict("NOT_CERTIFIED", "A game cannot be published without a PASS certification for its current version.");
++    }
++    await db.update(games).set({ lifecycle: body.lifecycle, publishedAt: body.lifecycle === "published" ? sql`coalesce(${games.publishedAt}, now())` : games.publishedAt, updatedAt: new Date() }).where(eq(games.id, g.id));
++    await logSecurity(req, "admin.game.lifecycle", { adminId: admin.id, severity: "warn", meta: { slug, lifecycle: body.lifecycle } });
++    return { ok: true };
++  });
++
++  app.post("/api/admin/games/:slug/flags", async (req) => {
++    const admin = requireAdmin(req);
++    const { slug } = req.params as { slug: string };
++    const body = z.object({ isFeatured: z.boolean().optional(), isNew: z.boolean().optional(), sortOrder: z.number().int().optional() }).parse(req.body);
++    await db.update(games).set({ ...body, updatedAt: new Date() }).where(eq(games.slug, slug));
++    await logSecurity(req, "admin.game.flags", { adminId: admin.id, meta: { slug, ...body } });
++    return { ok: true };
++  });
++
++  /* -------------------------------------------------------- simulator */
++  app.post("/api/admin/simulator/run", async (req) => {
++    const admin = requireAdmin(req);
++    const body = z.object({ slug: z.string(), spins: z.number().int().min(1000).max(10_000_000), bet: z.number().int().min(10).max(1000).default(100), certify: z.boolean().default(false) }).parse(req.body);
++    const def = getGame(body.slug);
++    if (!def) throw errors.notFound("Unknown game");
++    const running = await db.select({ n: count() }).from(simulationRuns).where(eq(simulationRuns.status, "running"));
++    if (running[0].n >= 2) throw errors.conflict("BUSY", "Two simulations are already running. Please wait.");
++    const [run] = await db.insert(simulationRuns).values({ gameSlug: def.slug, gameVersion: def.version, spins: body.spins, requestedBy: admin.id }).returning();
++    // Fire and forget: worker threads keep the event loop free.
++    simulateParallel(def.slug, {
++      spins: body.spins,
++      bet: body.bet,
++      payScale: def.payScale,
++      threads: Math.max(1, Math.min(os.cpus().length - 2, 12)),
++      onProgress: (done) => {
++        db.update(simulationRuns).set({ progress: done }).where(eq(simulationRuns.id, run.id)).catch(() => {});
++      },
++    })
++      .then(async (result) => {
++        const report = body.certify ? certify(def, result, { ...DEFAULT_CERTIFICATION_RULES, minSpins: Math.min(DEFAULT_CERTIFICATION_RULES.minSpins, body.spins) }) : null;
++        await db.update(simulationRuns).set({ status: "done", progress: body.spins, result: { simulation: result, certification: report } as unknown as Record<string, unknown>, finishedAt: new Date() }).where(eq(simulationRuns.id, run.id));
++        // A full-size PASS certification from the admin simulator becomes the official certification of this version,
++        // which is what unlocks the `published` lifecycle.
++        if (report && report.status === "PASS" && body.spins >= DEFAULT_CERTIFICATION_RULES.minSpins) {
++          const g = await db.query.games.findFirst({ where: eq(games.slug, def.slug), columns: { id: true } });
++          if (g) await db.update(gameVersions).set({ certification: report as unknown as Record<string, unknown> }).where(and(eq(gameVersions.gameId, g.id), eq(gameVersions.version, def.version)));
++        }
++      })
++      .catch(async (e) => {
++        await db.update(simulationRuns).set({ status: "failed", error: String(e?.message ?? e), finishedAt: new Date() }).where(eq(simulationRuns.id, run.id));
++      });
++    return { runId: run.id };
++  });
++
++  app.get("/api/admin/simulator/runs", async (req) => {
++    requireAdmin(req);
++    const q = z.object({ slug: z.string().optional(), limit: z.coerce.number().int().min(1).max(50).default(20) }).parse(req.query);
++    const rows = await db.select({ id: simulationRuns.id, gameSlug: simulationRuns.gameSlug, gameVersion: simulationRuns.gameVersion, spins: simulationRuns.spins, status: simulationRuns.status, progress: simulationRuns.progress, createdAt: simulationRuns.createdAt, finishedAt: simulationRuns.finishedAt, error: simulationRuns.error }).from(simulationRuns).where(q.slug ? eq(simulationRuns.gameSlug, q.slug) : undefined).orderBy(desc(simulationRuns.createdAt)).limit(q.limit);
++    return { runs: rows };
++  });
++
++  app.get("/api/admin/simulator/runs/:id", async (req) => {
++    requireAdmin(req);
++    const { id } = req.params as { id: string };
++    const run = await db.query.simulationRuns.findFirst({ where: eq(simulationRuns.id, id) });
++    if (!run) throw errors.notFound();
++    return { run };
++  });
++
++  /** Library certifications shipped with the build. */
++  app.get("/api/admin/certifications", async (req) => {
++    requireAdmin(req);
++    const rows = await db.select({ slug: games.slug, version: games.version, lifecycle: games.lifecycle, certification: gameVersions.certification }).from(games).innerJoin(gameVersions, and(eq(gameVersions.gameId, games.id), eq(gameVersions.version, games.version))).orderBy(games.sortOrder);
++    return { certifications: rows };
++  });
++
++  /* ---------------------------------------------------------- economy */
++  app.get("/api/admin/economy", async (req) => {
++    requireAdmin(req);
++    const days = z.object({ days: z.coerce.number().int().min(1).max(90).default(30) }).parse(req.query).days;
++    const byType = await db.execute(sql`select type, count(*)::int as n, sum(amount)::bigint as total from credit_transactions where created_at >= now() - (${days} || ' days')::interval group by type order by type`);
++    const daily = await db.execute(sql`select date_trunc('day', created_at) as day, type, sum(amount)::bigint as total from credit_transactions where created_at >= now() - (${days} || ' days')::interval group by 1,2 order by 1`);
++    const supply = await db.execute(sql`select coalesce(sum(balance),0)::bigint as circulating, coalesce(sum(lifetime_granted),0)::bigint as granted, coalesce(sum(lifetime_wagered),0)::bigint as wagered, coalesce(sum(lifetime_won),0)::bigint as won from wallets`);
++    const invariant = await db.execute(sql`select count(*)::int as mismatches from (select w.user_id, w.balance, coalesce(sum(t.amount),0) as ledger from wallets w left join credit_transactions t on t.user_id = w.user_id group by w.user_id, w.balance having w.balance <> coalesce(sum(t.amount),0)) x`);
++    const dist = await db.execute(sql`select width_bucket(balance, 0, 100000, 10) as bucket, count(*)::int as n from wallets group by 1 order by 1`);
++    return { byType: byType.rows, daily: daily.rows, supply: supply.rows[0], invariant: invariant.rows[0], balanceDistribution: dist.rows };
++  });
++
++  /* -------------------------------------------------------- analytics */
++  app.get("/api/admin/analytics/games", async (req) => {
++    requireAdmin(req);
++    const days = z.object({ days: z.coerce.number().int().min(1).max(90).default(30) }).parse(req.query).days;
++    const rows = await db.execute(sql`select game_slug, count(*)::int as spins, count(distinct user_id)::int as players, sum(bet)::bigint as wagered, sum(win)::bigint as won,
++      avg(bet)::float as avg_bet, count(*) filter (where bonus or free_spins)::int as bonuses, max(win)::bigint as max_win, max(multiplier)::float as max_multiplier,
++      count(*) filter (where multiplier >= 20)::int as big_wins, avg(duration_ms)::float as avg_ms
++      from game_rounds where created_at >= now() - (${days} || ' days')::interval group by game_slug order by spins desc`);
++    const launches = await db.select({ slug: games.slug, launches: gameStatistics.launches, favorites: gameStatistics.favorites }).from(gameStatistics).innerJoin(games, eq(games.id, gameStatistics.gameId));
++    const l = new Map(launches.map((x) => [x.slug, x]));
++    return {
++      games: (rows.rows as Record<string, unknown>[]).map((r) => ({ ...r, wagered: Number(r.wagered), won: Number(r.won), max_win: Number(r.max_win), rtp: Number(r.wagered) ? Number(r.won) / Number(r.wagered) : null, launches: Number(l.get(r.game_slug as string)?.launches ?? 0), favorites: l.get(r.game_slug as string)?.favorites ?? 0 })),
++    };
++  });
++
++  app.get("/api/admin/analytics/players", async (req) => {
++    requireAdmin(req);
++    const days = z.object({ days: z.coerce.number().int().min(1).max(90).default(30) }).parse(req.query).days;
++    const signups = await db.execute(sql`select date_trunc('day', created_at) as day, count(*)::int as n from users where created_at >= now() - (${days} || ' days')::interval group by 1 order by 1`);
++    const activity = await db.execute(sql`select date_trunc('day', created_at) as day, count(distinct user_id)::int as players, count(*)::int as spins from game_rounds where created_at >= now() - (${days} || ' days')::interval group by 1 order by 1`);
++    const levels = await db.execute(sql`select width_bucket(level, 1, 101, 10) as bucket, count(*)::int as n from users group by 1 order by 1`);
++    const retention = await db.execute(sql`select count(*) filter (where last_login_at >= now() - interval '1 day')::int as d1, count(*) filter (where last_login_at >= now() - interval '7 days')::int as d7, count(*)::int as total from users`);
++    return { signups: signups.rows, activity: activity.rows, levels: levels.rows, retention: retention.rows[0] };
++  });
++
++  /* --------------------------------------------- missions / achievements */
++  app.get("/api/admin/missions", async (req) => {
++    requireAdmin(req);
++    const rows = await db.select().from(missions).orderBy(missions.sortOrder);
++    const completions = await db.execute(sql`select mission_key, count(*) filter (where completed_at is not null)::int as completed, count(*)::int as started from user_missions where expires_at >= now() - interval '7 days' group by mission_key`);
++    return { missions: rows, completions: completions.rows };
++  });
++  app.patch("/api/admin/missions/:key", async (req) => {
++    requireAdmin(req);
++    const { key } = req.params as { key: string };
++    const body = z.object({ enabled: z.boolean().optional(), target: z.number().int().min(1).optional(), rewardCredits: z.number().int().min(0).optional(), rewardXp: z.number().int().min(0).optional(), name: z.string().min(2).optional(), description: z.string().min(2).optional() }).parse(req.body);
++    await db.update(missions).set(body).where(eq(missions.key, key));
++    return { ok: true };
++  });
++  app.get("/api/admin/achievements", async (req) => {
++    requireAdmin(req);
++    const rows = await db.select().from(achievements).orderBy(achievements.sortOrder);
++    const unlocks = await db.execute(sql`select achievement_key, count(*)::int as n from user_achievements group by achievement_key`);
++    return { achievements: rows, unlocks: unlocks.rows };
++  });
++  app.patch("/api/admin/achievements/:key", async (req) => {
++    requireAdmin(req);
++    const { key } = req.params as { key: string };
++    const body = z.object({ enabled: z.boolean().optional(), target: z.number().int().min(1).optional(), rewardCredits: z.number().int().min(0).optional(), rewardXp: z.number().int().min(0).optional(), name: z.string().min(2).optional(), description: z.string().min(2).optional() }).parse(req.body);
++    await db.update(achievements).set(body).where(eq(achievements.key, key));
++    return { ok: true };
++  });
++
++  /* ------------------------------------------- flags / settings / maint */
++  app.get("/api/admin/settings", async (req) => {
++    requireAdmin(req);
++    await refreshSettings(true);
++    return { flags: allFlags(), settings: allSettings() };
++  });
++  app.post("/api/admin/flags/:key", async (req) => {
++    const admin = requireAdmin(req);
++    const { key } = req.params as { key: string };
++    const body = z.object({ enabled: z.boolean() }).parse(req.body);
++    await setFlag(key, body.enabled);
++    await logSecurity(req, "admin.flag", { adminId: admin.id, meta: { key, enabled: body.enabled } });
++    return { ok: true };
++  });
++  app.post("/api/admin/settings/:key", async (req) => {
++    const admin = requireAdmin(req);
++    const { key } = req.params as { key: string };
++    const body = z.object({ value: z.unknown() }).parse(req.body);
++    if (key === "rescue") z.object({ amount: z.number().int().min(0), cooldownHours: z.number().min(0), threshold: z.number().int().min(0) }).parse(body.value);
++    if (key === "dailyRewards") z.object({ schedule: z.array(z.number().int().min(0)).min(1).max(30) }).parse(body.value);
++    if (key === "maintenance") z.object({ enabled: z.boolean(), message: z.string().min(3) }).parse(body.value);
++    if (key === "profanity") z.object({ words: z.array(z.string()) }).parse(body.value);
++    await setSetting(key, body.value);
++    await logSecurity(req, key === "maintenance" ? "admin.maintenance" : "admin.setting", { adminId: admin.id, severity: key === "maintenance" ? "high" : "info", meta: { key, value: body.value } });
++    return { ok: true };
++  });
++
++  /* ---------------------------------------------------------- security */
++  app.get("/api/admin/security/events", async (req) => {
++    requireAdmin(req);
++    const q = z.object({ type: z.string().optional(), severity: z.string().optional(), limit: z.coerce.number().int().min(1).max(200).default(100) }).parse(req.query);
++    const conds = [];
++    if (q.type) conds.push(eq(securityEvents.type, q.type));
++    if (q.severity) conds.push(eq(securityEvents.severity, q.severity));
++    const rows = await db.select({ ev: securityEvents, username: users.username }).from(securityEvents).leftJoin(users, eq(users.id, securityEvents.userId)).where(conds.length ? and(...conds) : undefined).orderBy(desc(securityEvents.createdAt)).limit(q.limit);
++    const summary = await db.execute(sql`select type, count(*)::int as n from security_events where created_at >= now() - interval '24 hours' group by type order by n desc`);
++    return { events: rows.map((r) => ({ ...r.ev, username: r.username })), summary24h: summary.rows };
++  });
++
++  /* ------------------------------------------------------------ system */
++  app.get("/api/admin/system", async (req) => {
++    requireAdmin(req);
++    const [dbMs, redisMs] = await Promise.all([pingDb().catch(() => -1), pingRedis().catch(() => -1)]);
++    const spinLatency = await db.execute(sql`select coalesce(avg(duration_ms),0)::float as avg, coalesce(percentile_cont(0.95) within group (order by duration_ms),0)::float as p95, count(*)::int as n from game_rounds where created_at >= now() - interval '1 hour'`);
++    const mem = process.memoryUsage();
++    const sizes = await db.execute(sql`select relname as table, pg_total_relation_size(relid)::bigint as bytes, n_live_tup::bigint as rows from pg_stat_user_tables order by bytes desc limit 15`);
++    return {
++      services: [
++        { name: "spinza-api", node: os.hostname(), version: config.version, uptimeSec: Math.round((Date.now() - startedAt) / 1000), status: "ok", latencyMs: 0 },
++        { name: "postgresql", node: "local", version: "17", uptimeSec: null, status: dbMs >= 0 ? "ok" : "down", latencyMs: dbMs },
++        { name: "redis", node: "local", version: "7", uptimeSec: null, status: redisMs >= 0 ? "ok" : "down", latencyMs: redisMs },
++      ],
++      process: { rssMb: Math.round(mem.rss / 1048576), heapMb: Math.round(mem.heapUsed / 1048576), cpus: os.cpus().length, load: os.loadavg(), totalMemMb: Math.round(os.totalmem() / 1048576), freeMemMb: Math.round(os.freemem() / 1048576), platform: `${os.platform()} ${os.release()}`, nodeVersion: process.version },
++      spins: spinLatency.rows[0],
++      tables: sizes.rows,
++      games: GAMES.length,
++    };
++  });
++  void or;
++}

added apps/api/src/routes/auth.ts +151 −0

++import type { FastifyInstance } from "fastify";
++import { db, eq, recoveryCodes, userSettings, users, wallets, dailyRewards, sql } from "@spinza/database";
++import { STARTING_BALANCE, checkUsername, loginSchema, recoverSchema, registerSchema, passwordSchema } from "@spinza/shared";
++import { errors } from "../lib/errors";
++import { generateRecoveryCode, hashPassword, hashRecoveryCode, verifyPassword, verifyRecoveryCode } from "../lib/crypto";
++import { rateLimit } from "../lib/redis";
++import { createSession, destroyAllSessions, destroySession, requireUser } from "../plugins/auth";
++import { clientIp, logSecurity } from "../lib/security";
++import { flag, profanityWords, maintenance } from "../lib/settings";
++import { applyCredit, lockWallet, saveWallet } from "../services/wallet";
++import { z } from "zod";
++import { PG_UNIQUE_VIOLATION, pgCode } from "../lib/pg";
++
++async function limit(req: Parameters<typeof clientIp>[0], scope: string, max: number, windowSec: number) {
++  const retry = await rateLimit(`${scope}:${clientIp(req)}`, max, windowSec);
++  if (retry) {
++    await logSecurity(req, "rate_limit", { meta: { scope } });
++    throw errors.rateLimited(retry);
++  }
++}
++
++export async function authRoutes(app: FastifyInstance) {
++  app.post("/api/auth/check-username", async (req) => {
++    await limit(req, "check-username", 60, 60);
++    const body = z.object({ username: z.string().max(64) }).parse(req.body);
++    const check = checkUsername(body.username, profanityWords());
++    if (!check.ok) return { available: false, reason: check.reason };
++    const normalized = body.username.trim().toLowerCase();
++    const exists = await db.query.users.findFirst({ where: eq(users.usernameNormalized, normalized), columns: { id: true } });
++    return { available: !exists, reason: exists ? "taken" : undefined };
++  });
++
++  app.post("/api/auth/register", async (req, reply) => {
++    await limit(req, "register", 10, 600);
++    if (!flag("registration.enabled")) throw errors.forbidden("Registration is temporarily closed.");
++    const m = maintenance();
++    if (m.enabled) throw errors.maintenance(m.message);
++    const parsed = registerSchema.safeParse(req.body);
++    if (!parsed.success) throw errors.badRequest("Please check the form.", parsed.error.flatten());
++    const { username, password } = parsed.data;
++    const check = checkUsername(username, profanityWords());
++    if (!check.ok) {
++      const msg = { length: "Username must be 3–24 characters.", charset: "Use lowercase letters, numbers, _ or -.", reserved: "This username is reserved.", profanity: "This username is not allowed." }[check.reason!];
++      throw errors.badRequest(msg, { field: "username" });
++    }
++    const passwordHash = await hashPassword(password);
++    const recoveryCode = generateRecoveryCode();
++    const codeHash = await hashRecoveryCode(recoveryCode);
++
++    let userId: string;
++    try {
++      userId = await db.transaction(async (tx) => {
++        const [u] = await tx
++          .insert(users)
++          .values({ username, usernameNormalized: username, passwordHash, ageConfirmedAt: new Date(), lastLoginAt: new Date() })
++          .returning({ id: users.id });
++        await tx.insert(wallets).values({ userId: u.id, balance: 0 });
++        await tx.insert(userSettings).values({ userId: u.id });
++        await tx.insert(recoveryCodes).values({ userId: u.id, codeHash });
++        await tx.insert(dailyRewards).values({ userId: u.id });
++        const w = await lockWallet(tx, u.id);
++        await applyCredit(tx, w, "INITIAL_GRANT", STARTING_BALANCE, "welcome", { reason: "Welcome to Spinza" });
++        await saveWallet(tx, w);
++        return u.id;
++      });
++    } catch (e) {
++      if (pgCode(e) === PG_UNIQUE_VIOLATION) throw errors.conflict("USERNAME_TAKEN", "That username is already taken.");
++      throw e;
++    }
++    await createSession(reply, req, userId);
++    await logSecurity(req, "register", { userId });
++    return {
++      user: { id: userId, username, isNew: true },
++      balance: STARTING_BALANCE,
++      recoveryCode,
++      notice: "Save this recovery code. Spinza does not collect your email address. If you lose your password and recovery code, your account cannot be recovered.",
++    };
++  });
++
++  app.post("/api/auth/login", async (req, reply) => {
++    await limit(req, "login", 20, 300);
++    const parsed = loginSchema.safeParse(req.body);
++    if (!parsed.success) throw errors.unauthorized("Invalid username or password.");
++    const { username, password } = parsed.data;
++    const perUser = await rateLimit(`login-user:${username}`, 10, 300);
++    if (perUser) throw errors.rateLimited(perUser);
++    const u = await db.query.users.findFirst({ where: eq(users.usernameNormalized, username) });
++    const ok = u ? await verifyPassword(u.passwordHash, password) : await verifyPassword("$argon2id$v=19$m=19456,t=2,p=1$AAAAAAAAAAAAAAAAAAAAAA$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", password);
++    if (!u || !ok) {
++      await logSecurity(req, "login.failed", { userId: u?.id ?? null, meta: { username } });
++      throw errors.unauthorized("Invalid username or password.");
++    }
++    if (u.status !== "active") throw errors.forbidden("This account is suspended.");
++    await db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, u.id));
++    await createSession(reply, req, u.id);
++    await logSecurity(req, "login.success", { userId: u.id });
++    return { user: { id: u.id, username: u.username } };
++  });
++
++  app.post("/api/auth/logout", async (req, reply) => {
++    const uid = req.user?.id;
++    await destroySession(reply, req);
++    if (uid) await logSecurity(req, "logout", { userId: uid });
++    return { ok: true };
++  });
++
++  app.post("/api/auth/recover", async (req, reply) => {
++    await limit(req, "recover", 8, 900);
++    const parsed = recoverSchema.safeParse(req.body);
++    if (!parsed.success) throw errors.badRequest("Please check the form.", parsed.error.flatten());
++    const { username, recoveryCode, newPassword } = parsed.data;
++    const u = await db.query.users.findFirst({ where: eq(users.usernameNormalized, username) });
++    const rc = u ? await db.query.recoveryCodes.findFirst({ where: eq(recoveryCodes.userId, u.id) }) : null;
++    const ok = rc ? await verifyRecoveryCode(rc.codeHash, recoveryCode) : false;
++    if (!u || !rc || !ok) {
++      await logSecurity(req, "recovery.failed", { userId: u?.id ?? null, severity: "warn", meta: { username } });
++      throw errors.unauthorized("Invalid username or recovery code.");
++    }
++    const nextCode = generateRecoveryCode();
++    const passwordHash = await hashPassword(newPassword);
++    await db.transaction(async (tx) => {
++      await tx.update(users).set({ passwordHash }).where(eq(users.id, u.id));
++      await tx.update(recoveryCodes).set({ codeHash: await hashRecoveryCode(nextCode), rotatedAt: new Date(), usedAt: new Date(), useCount: sql`${recoveryCodes.useCount} + 1` }).where(eq(recoveryCodes.userId, u.id));
++    });
++    await destroyAllSessions(u.id);
++    await createSession(reply, req, u.id);
++    await logSecurity(req, "recovery.used", { userId: u.id, severity: "warn" });
++    return { user: { id: u.id, username: u.username }, recoveryCode: nextCode, notice: "Your recovery code has been rotated. Save the new one." };
++  });
++
++  app.post("/api/auth/password", async (req) => {
++    const user = requireUser(req);
++    const body = z.object({ currentPassword: z.string().min(1), newPassword: passwordSchema }).parse(req.body);
++    const u = await db.query.users.findFirst({ where: eq(users.id, user.id) });
++    if (!u || !(await verifyPassword(u.passwordHash, body.currentPassword))) throw errors.unauthorized("Current password is incorrect.");
++    await db.update(users).set({ passwordHash: await hashPassword(body.newPassword) }).where(eq(users.id, u.id));
++    await logSecurity(req, "password.changed", { userId: u.id });
++    return { ok: true };
++  });
++
++  /** Rotate the recovery code (requires password). */
++  app.post("/api/auth/recovery-code/rotate", async (req) => {
++    const user = requireUser(req);
++    const body = z.object({ password: z.string().min(1) }).parse(req.body);
++    const u = await db.query.users.findFirst({ where: eq(users.id, user.id) });
++    if (!u || !(await verifyPassword(u.passwordHash, body.password))) throw errors.unauthorized("Password is incorrect.");
++    const code = generateRecoveryCode();
++    await db.insert(recoveryCodes).values({ userId: u.id, codeHash: await hashRecoveryCode(code) }).onConflictDoUpdate({ target: recoveryCodes.userId, set: { codeHash: await hashRecoveryCode(code), rotatedAt: new Date() } });
++    return { recoveryCode: code };
++  });
++}

added apps/api/src/routes/games.ts +198 −0

++import type { FastifyInstance } from "fastify";
++import { and, db, desc, eq, favorites, gameStatistics, games, sql, userGameStats } from "@spinza/database";
++import { getGame, FIRST_GAME_RECOMMENDATIONS } from "@spinza/games";
++import { spinSchema, type GameCard, type GameInfo } from "@spinza/shared";
++import { requireUser } from "../plugins/auth";
++import { errors } from "../lib/errors";
++import { flag } from "../lib/settings";
++import { spin } from "../services/spin";
++import { rateLimit, redis } from "../lib/redis";
++import { clientIp, logSecurity } from "../lib/security";
++import { z } from "zod";
++
++type GameRow = typeof games.$inferSelect;
++
++function toCard(g: GameRow, extra: { popularity?: number; favorite?: boolean; lastPlayedAt?: Date | null } = {}): GameCard {
++  const s = g.summary as Record<string, unknown>;
++  return {
++    slug: g.slug,
++    name: g.name,
++    tagline: s.tagline as string,
++    theme: s.theme as string,
++    volatility: s.volatility as GameCard["volatility"],
++    version: g.version,
++    grid: s.grid as GameCard["grid"],
++    minBet: s.minBet as number,
++    maxBet: s.maxBet as number,
++    maxMultiplier: s.maxMultiplier as number,
++    features: (s.features as string[]) ?? [],
++    tags: (s.tags as string[]) ?? [],
++    palette: s.palette as GameCard["palette"],
++    lifecycle: g.lifecycle as GameCard["lifecycle"],
++    isNew: g.isNew,
++    isFeatured: g.isFeatured,
++    isJackpot: !!s.isJackpot,
++    popularity: extra.popularity ?? 0,
++    favorite: extra.favorite,
++    lastPlayedAt: extra.lastPlayedAt ? extra.lastPlayedAt.toISOString() : null,
++  };
++}
++
++export async function publishedGames(): Promise<GameRow[]> {
++  const rows = await db.select().from(games).where(eq(games.lifecycle, "published")).orderBy(games.sortOrder);
++  return rows.filter((g) => flag(`game.${g.slug}.enabled`));
++}
++
++export async function gameRoutes(app: FastifyInstance) {
++  /** Public lobby data. When signed in, includes favorites + continue playing. */
++  app.get("/api/games", async (req) => {
++    const rows = await publishedGames();
++    const stats = await db.select({ gameId: gameStatistics.gameId, spins: gameStatistics.spins, launches: gameStatistics.launches }).from(gameStatistics);
++    const statMap = new Map(stats.map((s) => [s.gameId, s]));
++    let favs = new Set<string>();
++    let recent = new Map<string, Date>();
++    if (req.user) {
++      const f = await db.select({ gameId: favorites.gameId }).from(favorites).where(eq(favorites.userId, req.user.id));
++      favs = new Set(f.map((x) => x.gameId));
++      const r = await db.select({ gameId: userGameStats.gameId, at: userGameStats.lastPlayedAt }).from(userGameStats).where(eq(userGameStats.userId, req.user.id));
++      recent = new Map(r.map((x) => [x.gameId, x.at]));
++    }
++    const live = await redis().zcount("live:players", Date.now() - 5 * 60_000, "+inf").catch(() => 0);
++    const cards = rows.map((g) => {
++      const st = statMap.get(g.id);
++      return toCard(g, { popularity: Number(st?.spins ?? 0) + Number(st?.launches ?? 0) * 20, favorite: favs.has(g.id), lastPlayedAt: recent.get(g.id) ?? null });
++    });
++    return { games: cards, livePlayers: live, recommendations: FIRST_GAME_RECOMMENDATIONS };
++  });
++
++  app.get("/api/games/:slug", async (req) => {
++    const { slug } = req.params as { slug: string };
++    const g = await db.query.games.findFirst({ where: eq(games.slug, slug) });
++    const def = getGame(slug);
++    if (!g || !def || g.lifecycle !== "published" || !flag(`game.${slug}.enabled`)) throw errors.notFound("Game not found");
++    const s = g.summary as Record<string, unknown>;
++    const cert = (s.certification as GameInfo["certification"] | null) ?? null;
++    let favorite = false;
++    if (req.user) favorite = !!(await db.query.favorites.findFirst({ where: and(eq(favorites.userId, req.user.id), eq(favorites.gameId, g.id)) }));
++    const info: GameInfo = {
++      ...toCard(g, { favorite }),
++      rtp: def.rtp,
++      hitFrequency: cert?.hitRate ?? null,
++      description: def.description,
++      rules: def.rules,
++      paytable: def.symbols
++        .filter((sym) => sym.pays || sym.scatterPays)
++        .map((sym) => ({
++          symbol: sym.id,
++          label: sym.name,
++          // Displayed as multiples of total bet (payScale/betDivisor applied), rounded to 2 decimals.
++          pays: Object.fromEntries(
++            Object.entries(sym.pays ?? sym.scatterPays ?? {}).map(([k, v]) => [k, Number(((v * def.payScale) / (sym.pays ? def.betDivisor : 1)).toFixed(3))]),
++          ),
++        })),
++      certification: cert,
++    };
++    return { game: info, definition: clientDefinition(def) };
++  });
++
++  app.post("/api/games/:slug/launch", async (req) => {
++    const { slug } = req.params as { slug: string };
++    const g = await db.query.games.findFirst({ where: eq(games.slug, slug), columns: { id: true } });
++    if (!g) throw errors.notFound();
++    await db.update(gameStatistics).set({ launches: sql`${gameStatistics.launches} + 1` }).where(eq(gameStatistics.gameId, g.id));
++    if (req.user) {
++      // Persisted game state for meters/heat so the client can render them on load.
++      const st = await db.execute(sql`select state from game_states where user_id = ${req.user.id} and game_id = ${g.id}`);
++      return { ok: true, state: (st.rows[0] as { state?: unknown } | undefined)?.state ?? null };
++    }
++    return { ok: true, state: null };
++  });
++
++  app.post("/api/games/:slug/spin", async (req) => {
++    const user = requireUser(req);
++    const { slug } = req.params as { slug: string };
++    const retry = await rateLimit(`spin:${user.id}`, 240, 60);
++    if (retry) {
++      await logSecurity(req, "spin.suspicious", { userId: user.id, severity: "warn", meta: { slug, ip: clientIp(req) } });
++      throw errors.rateLimited(retry);
++    }
++    const parsed = spinSchema.safeParse(req.body);
++    if (!parsed.success) throw errors.badRequest("Invalid spin request.", parsed.error.flatten());
++    return spin({ userId: user.id, slug, bet: parsed.data.bet, clientRoundId: parsed.data.clientRoundId });
++  });
++
++  app.get("/api/games/:slug/history", async (req) => {
++    const user = requireUser(req);
++    const { slug } = req.params as { slug: string };
++    const q = z.object({ limit: z.coerce.number().int().min(1).max(50).default(20) }).parse(req.query);
++    const rows = await db.execute(sql`select round_id, bet, win, multiplier, balance_after, created_at, features from game_rounds where user_id = ${user.id} and game_slug = ${slug} order by created_at desc limit ${q.limit}`);
++    return {
++      entries: (rows.rows as Record<string, unknown>[]).map((r) => ({
++        roundId: r.round_id,
++        bet: Number(r.bet),
++        win: Number(r.win),
++        multiplier: Number(r.multiplier),
++        balanceAfter: Number(r.balance_after),
++        createdAt: (r.created_at as Date).toISOString(),
++        features: r.features,
++      })),
++    };
++  });
++
++  app.post("/api/games/:slug/favorite", async (req) => {
++    const user = requireUser(req);
++    const { slug } = req.params as { slug: string };
++    const g = await db.query.games.findFirst({ where: eq(games.slug, slug), columns: { id: true } });
++    if (!g) throw errors.notFound();
++    const existing = await db.query.favorites.findFirst({ where: and(eq(favorites.userId, user.id), eq(favorites.gameId, g.id)) });
++    if (existing) {
++      await db.delete(favorites).where(and(eq(favorites.userId, user.id), eq(favorites.gameId, g.id)));
++      await db.update(gameStatistics).set({ favorites: sql`greatest(${gameStatistics.favorites} - 1, 0)` }).where(eq(gameStatistics.gameId, g.id));
++      return { favorite: false };
++    }
++    await db.insert(favorites).values({ userId: user.id, gameId: g.id });
++    await db.update(gameStatistics).set({ favorites: sql`${gameStatistics.favorites} + 1` }).where(eq(gameStatistics.gameId, g.id));
++    return { favorite: true };
++  });
++
++  app.get("/api/user/games", async (req) => {
++    const user = requireUser(req);
++    const rows = await db
++      .select({ slug: games.slug, name: games.name, spins: userGameStats.spins, won: userGameStats.won, wagered: userGameStats.wagered, biggestWin: userGameStats.biggestWin, biggestMultiplier: userGameStats.biggestMultiplier, lastPlayedAt: userGameStats.lastPlayedAt })
++      .from(userGameStats)
++      .innerJoin(games, eq(games.id, userGameStats.gameId))
++      .where(eq(userGameStats.userId, user.id))
++      .orderBy(desc(userGameStats.lastPlayedAt));
++    return { games: rows.map((r) => ({ ...r, biggestMultiplier: Number(r.biggestMultiplier), lastPlayedAt: r.lastPlayedAt.toISOString() })) };
++  });
++}
++
++/** Definition data the renderer needs (symbols, grid, presentation). Weights are public "Game Info" data too. */
++export function clientDefinition(def: ReturnType<typeof getGame> & object) {
++  return {
++    slug: def.slug,
++    name: def.name,
++    version: def.version,
++    grid: def.grid,
++    payModel: def.payModel,
++    symbols: def.symbols.map((s) => ({ id: s.id, name: s.name, kind: s.kind, tier: s.tier, style: s.style })),
++    wild: def.wild ? { id: def.wild.id, expanding: !!def.wild.expanding, sticky: !!def.wild.sticky, multiplier: !!def.wild.multiplier, exploding: !!def.wild.exploding, moving: !!def.wild.moving } : null,
++    scatter: def.scatter ? { id: def.scatter.id, triggers: def.scatter.triggers } : null,
++    cascades: !!def.cascades,
++    spinCollect: def.spinCollect ? { symbolId: def.spinCollect.symbolId, ladder: def.spinCollect.ladder } : null,
++    holdRespin: def.holdRespin ? { symbolId: def.holdRespin.symbolId, respins: def.holdRespin.respins, jackpots: def.holdRespin.jackpots } : null,
++    meter: def.meter ? { id: def.meter.id, name: def.meter.name, symbolId: def.meter.symbolId, max: def.meter.max, label: def.meter.onFull.label } : null,
++    heat: def.heat ? { max: def.heat.max, ladder: def.heat.ladder, bandSize: def.heat.bandSize, label: def.heat.meltdown.label } : null,
++    mystery: def.mystery ? { symbolId: def.mystery.symbolId } : null,
++    quantum: !!def.quantum,
++    dynamicGrid: def.dynamicGrid ?? null,
++    jackpot: def.jackpot ? { tiers: def.jackpot.tiers.map((t) => ({ id: t.id, multiplier: t.multiplier })) } : null,
++    pickBonuses: def.pickBonuses?.map((b) => ({ id: b.id, name: b.name, cells: b.cells, picks: b.picks })) ?? [],
++    minBet: def.minBet,
++    maxBet: def.maxBet,
++    maxMultiplier: def.maxMultiplier,
++    volatility: def.volatility,
++    presentation: def.presentation,
++    featureNames: def.featureNames,
++  };
++}

added apps/api/src/routes/health.ts +63 −0

Large diff (63 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/routes/rewards.ts +215 −0

Large diff (215 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/routes/user.ts +160 −0

Large diff (160 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/server.ts +33 −0

Large diff (33 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/services/progression.ts +242 −0

Large diff (242 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/services/spin.ts +254 −0

Large diff (254 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/src/services/wallet.ts +64 −0

Large diff (64 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/test/wallet.test.ts +150 −0

Large diff (150 lines) is not loaded by default to keep the page fast.Load diff

added apps/api/tsconfig.json +5 −0

Large diff (5 lines) is not loaded by default to keep the page fast.Load diff

added apps/simulator/package.json +27 −0

Large diff (27 lines) is not loaded by default to keep the page fast.Load diff

added apps/simulator/src/cli.ts +128 −0

Large diff (128 lines) is not loaded by default to keep the page fast.Load diff

added apps/simulator/src/index.ts +76 −0

Large diff (76 lines) is not loaded by default to keep the page fast.Load diff

added apps/simulator/src/worker.ts +24 −0

Large diff (24 lines) is not loaded by default to keep the page fast.Load diff

added apps/simulator/tsconfig.json +5 −0

Large diff (5 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/eslint.config.mjs +10 −0

Large diff (10 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/next.config.ts +32 −0

Large diff (32 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/package.json +41 −0

Large diff (41 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/postcss.config.mjs +2 −0

Large diff (2 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/public/apple-icon.png +0 −0

Binary file not shown.

added apps/web/public/icon.svg +19 −0

Large diff (19 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/public/manifest.webmanifest +17 −0

Large diff (17 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/(auth)/layout.tsx +36 −0

Large diff (36 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/(auth)/login/page.tsx +104 −0

Large diff (104 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/(auth)/recover/page.tsx +108 −0

Large diff (108 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/(auth)/register/page.tsx +182 −0

Large diff (182 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/achievements/page.tsx +64 −0

Large diff (64 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/analytics/games/page.tsx +71 −0

Large diff (71 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/analytics/players/page.tsx +103 −0

Large diff (103 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/economy/page.tsx +158 −0

Large diff (158 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/games/[slug]/page.tsx +284 −0

Large diff (284 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/games/page.tsx +199 −0

Large diff (199 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/layout.tsx +18 −0

Large diff (18 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/missions/page.tsx +67 −0

Large diff (67 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/page.tsx +103 −0

Large diff (103 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/rewards/page.tsx +202 −0

Large diff (202 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/security/page.tsx +99 −0

Large diff (99 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/settings/page.tsx +213 −0

Large diff (213 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/simulator/page.tsx +333 −0

Large diff (333 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/system/page.tsx +96 −0

Large diff (96 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/users/[id]/page.tsx +349 −0

Large diff (349 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/admin/users/page.tsx +106 −0

Large diff (106 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/error.tsx +40 −0

Large diff (40 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/games/[slug]/page.tsx +22 −0

Large diff (22 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/games/page.tsx +42 −0

Large diff (42 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/globals.css +229 −0

Large diff (229 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/how-it-works/page.tsx +127 −0

Large diff (127 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/layout.tsx +42 −0

Large diff (42 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/leaderboard/page.tsx +179 −0

Large diff (179 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/legal/privacy/page.tsx +132 −0

Large diff (132 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/legal/terms/page.tsx +96 −0

Large diff (96 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/maintenance/page.tsx +28 −0

Large diff (28 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/maintenance/retry.tsx +54 −0

Large diff (54 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/not-found.tsx +35 −0

Large diff (35 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/page.tsx +50 −0

Large diff (50 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/profile/history/page.tsx +303 −0

Large diff (303 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/profile/ledger/page.tsx +194 −0

Large diff (194 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/profile/page.tsx +177 −0

Large diff (177 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/responsible-play/page.tsx +93 −0

Large diff (93 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/rewards/page.tsx +388 −0

Large diff (388 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/app/settings/page.tsx +354 −0

Large diff (354 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/charts.tsx +212 −0

Large diff (212 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/format.ts +110 −0

Large diff (110 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/gate.tsx +140 −0

Large diff (140 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/primitives.tsx +443 −0

Large diff (443 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/progression-table.tsx +176 −0

Large diff (176 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/shell.tsx +189 −0

Large diff (189 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/simulation-results.tsx +123 −0

Large diff (123 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/store.ts +75 −0

Large diff (75 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/types.ts +374 −0

Large diff (374 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/admin/use-query.ts +87 −0

Large diff (87 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/brand/logo.tsx +42 −0

Large diff (42 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/game/game-client.tsx +849 −0

Large diff (849 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/game/renderer.ts +889 −0

Large diff (889 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/game/sound.ts +244 −0

Large diff (244 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/game/symbol-art.ts +269 −0

Large diff (269 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/game/types.ts +46 −0

Large diff (46 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/game-art.tsx +760 −0

Large diff (760 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/game-card.tsx +194 −0

Large diff (194 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/games-browser.tsx +129 −0

Large diff (129 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/landing.tsx +163 −0

Large diff (163 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/lobby.tsx +137 −0

Large diff (137 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/prose.tsx +64 −0

Large diff (64 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/rewards-strip.tsx +115 −0

Large diff (115 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/site-footer.tsx +40 −0

Large diff (40 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/lobby/welcome-overlay.tsx +103 −0

Large diff (103 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/api-error.tsx +34 −0

Large diff (34 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/app-shell.tsx +152 −0

Large diff (152 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/providers.tsx +57 −0

Large diff (57 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/recovery-code.tsx +66 −0

Large diff (66 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/require-auth.tsx +35 −0

Large diff (35 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/shell/session-reminder.tsx +51 −0

Large diff (51 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/components/ui/index.tsx +247 −0

Large diff (247 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/lib/api-server.ts +26 −0

Large diff (26 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/lib/api.ts +42 −0

Large diff (42 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/lib/store.ts +86 −0

Large diff (86 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/lib/use-api.ts +78 −0

Large diff (78 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/src/lib/utils.ts +29 −0

Large diff (29 lines) is not loaded by default to keep the page fast.Load diff

added apps/web/tsconfig.json +21 −0

Large diff (21 lines) is not loaded by default to keep the page fast.Load diff

added deploy/backup.sh +27 −0

Large diff (27 lines) is not loaded by default to keep the page fast.Load diff

added deploy/install-backup.sh +22 −0

Large diff (22 lines) is not loaded by default to keep the page fast.Load diff

added docs/SPEC-original.md +60 −0

Large diff (60 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/arctic-fortune.json +317 −0

Large diff (317 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/cosmic-collapse.json +318 −0

Large diff (318 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/deep-treasure.json +318 −0

Large diff (318 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/diamond-heist.json +320 −0

Large diff (320 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/dragon-core.json +317 −0

Large diff (317 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/golden-emperor.json +316 −0

Large diff (316 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/inferno-reels.json +318 −0

Large diff (318 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/lucky-circuit.json +316 −0

Large diff (316 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/midnight-tokyo.json +318 −0

Large diff (318 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/moonbase-77.json +316 −0

Large diff (316 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/neon-vault.json +318 −0

Large diff (318 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/obsidian.json +316 −0

Large diff (316 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/pharaoh-protocol.json +317 −0

Large diff (317 lines) is not loaded by default to keep the page fast.Load diff

added games/certifications/quantum-jackpot.json +319 −0

Large diff (319 lines) is not loaded by default to keep the page fast.Load diff

Diff truncated — file too large.

spb/spinza

Spinza v0.1.0 — fictional social casino: engine, 20 certified games, API, web, admin

Theme