Adds the API surface behind playtest.evobug.com: per-product branded
signup funnels, age gating, NDA collection, waitlist selection and Steam
key distribution.

Two classes of secret are stored and neither is ever readable from a
database dump alone:

  - Steam keys, sealed with AES-256-GCM under an HKDF-derived,
    domain-separated subkey. List endpoints return the masked form only;
    plaintext requires a separate revealKey call with a stated reason,
    and every reveal is audited. Assignment uses SELECT ... FOR UPDATE
    SKIP LOCKED plus a unique index on assignedApplicationId, so two
    admins acting at once cannot issue the same key twice.

  - NDA legal name and postal address, encrypted the same way. Only the
    country code and a hash of the exact document text stay readable, so
    the agreement can be proven without a second copy of the personal
    data.

The date of birth is deliberately not stored at all. The age gate checks
it in memory, discards it, and persists only the bracket that was met
("18+") - the funnel promises this to the player, so it is enforced in
the schema rather than by convention.

Admin identity is kept entirely separate from the public users table: a
compromised playtester account must not be one role flip away from the
key vault. Admins are invite-only with argon2id passwords, mandatory
TOTP (RFC 6238, implemented in-repo and verified against the spec's test
vectors, with a persisted counter to block replay), sessions stored only
as SHA-256 hashes with idle and absolute expiry, per-account lockout,
and an append-only audit log.

Providers whose Evobug application is not configured on a deployment are
no longer advertised on the signup screen, so a player cannot be sent to
a dead end; requesting one returns 503 rather than a generic 500.
Required connections are intentionally not filtered - dropping one would
silently disable a gate an admin turned on.

Also extends users with steamId/mickleId and the display handles the
account screen needs. The two touched spec files are existing
toStrictEqual assertions on the full user shape.

676 tests pass.

@@ -0,0 +57,7 @@
+		"drifter", "phantom", "airlock", "salvage", "beacon", "nebula", "gantry", "thruster",
+	];
+
+	const picked = Array.from(
+		crypto.getRandomValues(new Uint8Array(4)),
+		(byte) => words[byte % words.length],
+	);

@@ -0,0 +67,7 @@
+}
+
+const args = parseArgs(process.argv.slice(2));
+const email = args.email?.trim().toLowerCase();
+const displayName = args.name?.trim();
+
+if (!email || !displayName) {

@@ -0,0 +87,5 @@
+	process.exit(1);
+}
+
+const password = args.password ?? process.env.PLAYTEST_ADMIN_PASSWORD ?? generatePassword();
+const generatedPassword = !args.password && !process.env.PLAYTEST_ADMIN_PASSWORD;

@@ -0,0 +95,5 @@
+	process.exit(1);
+}
+
+const client = new Bun.SQL(process.env.DATABASE_URL);
+const db = drizzle({ client, relations });

@@ -0,0 +98,8 @@
+const client = new Bun.SQL(process.env.DATABASE_URL);
+const db = drizzle({ client, relations });
+
+const [existing] = await db
+	.select({ id: playtestAdminsTable.id })
+	.from(playtestAdminsTable)
+	.where(eq(playtestAdminsTable.email, email))
+	.limit(1);

@@ -0,0 +133,6 @@
+
+const line = "─".repeat(66);
+
+console.log(`
+${line}
+  Playtest admin created - id ${admin?.id}

@@ -0,0 +156,14 @@
+		const inviteToken = generateToken(32);
+		const expiresAt = new Date(Date.now() + ADMIN_INVITE_TTL_MS);
+
+		const [created] = await context.db
+			.insert(playtestAdminsTable)
+			.values({
+				email: input.email,
+				displayName: input.displayName,
+				status: "invited",
+				invitedByAdminId: actor.id,
+				inviteTokenHash: await sha256Hex(inviteToken),
+				inviteExpiresAt: expiresAt,
+			})
+			.returning();

@@ -0,0 +202,5 @@
+export const acceptInvite = base
+	.input(
+		z.object({
+			token: z.string().min(1),
+			password: adminPasswordSchema,

@@ -0,0 +241,15 @@
+
+		const totpSecret = generateTotpSecret();
+
+		await context.db
+			.update(playtestAdminsTable)
+			.set({
+				passwordHash: await Bun.password.hash(input.password, ADMIN_PASSWORD_HASH_OPTIONS),
+				totpSecretCiphertext: await encryptSecret(totpSecret, CRYPTO_DOMAIN.totpSecret),
+				totpEnabled: false,
+				// Burn the invite so the link is single-use.
+				inviteTokenHash: null,
+				inviteExpiresAt: null,
+				updatedAt: new Date(),
+			})
+			.where(eq(playtestAdminsTable.id, admin.id));

@@ -0,0 +302,8 @@
+	.handler(async ({ input, context, errors }) => {
+		const meta = getRequestMeta(context.headers);
+
+		const limit = checkRateLimit(
+			`playtest:admin-login:${meta.ip ?? "unknown"}`,
+			LOGIN_RATE_LIMIT_MAX,
+			LOGIN_RATE_LIMIT_WINDOW_MS,
+		);

@@ -0,0 +308,6 @@
+			LOGIN_RATE_LIMIT_WINDOW_MS,
+		);
+
+		if (!limit.allowed) {
+			throw errors.RATE_LIMITED({ data: { retryAfter: limit.retryAfter } });
+		}

@@ -0,0 +358,9 @@
+
+		// Password accepted - reset the failure counter but do NOT mark the session
+		// authenticated. That only happens after the second factor.
+		await context.db
+			.update(playtestAdminsTable)
+			.set({ failedLoginCount: 0, lockedUntil: null, updatedAt: new Date() })
+			.where(eq(playtestAdminsTable.id, admin.id));
+
+		clearRateLimit(`playtest:admin-login:${meta.ip ?? "unknown"}`);

@@ -0,0 +441,14 @@
+			throw errors.INVALID_CODE();
+		}
+
+		await context.db
+			.update(playtestAdminsTable)
+			.set({
+				// Spending the counter makes this exact code unusable again.
+				totpLastUsedCounter: result.counter,
+				failedLoginCount: 0,
+				lastLoginAt: new Date(),
+				lastLoginIp: meta.ip,
+				updatedAt: new Date(),
+			})
+			.where(eq(playtestAdminsTable.id, admin.id));

@@ -0,0 +538,7 @@
+	.errors({
+		INVALID_CODE: { message: "That recovery code is not valid" },
+	})
+	.handler(async ({ input, context, errors }) => {
+		const { admin, session, meta } = context as unknown as AdminSessionContext;
+
+		const candidate = await fingerprint(

@@ -0,0 +558,15 @@
+			throw errors.INVALID_CODE();
+		}
+
+		const remaining = stored.filter((hash) => hash !== match);
+
+		await context.db
+			.update(playtestAdminsTable)
+			.set({
+				recoveryCodeHashes: remaining,
+				failedLoginCount: 0,
+				lastLoginAt: new Date(),
+				lastLoginIp: meta.ip,
+				updatedAt: new Date(),
+			})
+			.where(eq(playtestAdminsTable.id, admin.id));

@@ -0,0 +657,5 @@
+			})
+			.where(eq(playtestAdminsTable.id, admin.id));
+
+		// Force every other device to re-authenticate with the new credential.
+		await revokeAllSessions(context.db, admin.id);

@@ -0,0 +765,12 @@
+
+		await context.db
+			.update(playtestAdminsTable)
+			.set({
+				totpEnabled: false,
+				totpSecretCiphertext: null,
+				totpConfirmedAt: null,
+				totpLastUsedCounter: null,
+				recoveryCodeHashes: [],
+				status: "invited",
+				updatedAt: new Date(),
+			})

@@ -0,0 +859,7 @@
+	.input(z.object({}).optional())
+	.output(z.object({ removed: z.number() }))
+	.handler(async ({ context }) => {
+		const removed = await context.db
+			.delete(playtestAdminSessionsTable)
+			.where(and(lt(playtestAdminSessionsTable.expiresAt, new Date()), isNull(playtestAdminSessionsTable.revokedAt)))
+			.returning({ id: playtestAdminSessionsTable.id });

@@ -0,0 +26,7 @@
+ * Only http(s) URLs. Blocks `javascript:` and `data:` from reaching an href or
+ * a background-image on the branded page.
+ */
+const httpUrlSchema = z
+	.string()
+	.max(500)
+	.refine((value) => /^https?:\/\//i.test(value), "Must be an http(s) URL");

@@ -0,0 +41,4 @@
+
+const productShapeSchema = z.object({
+	slug: slugSchema,
+	name: z.string().min(1).max(255).trim(),

@@ -0,0 +62,4 @@
+	ndaIntroText: z.string().max(20_000).nullish(),
+	disclaimerText: z.string().max(20_000).nullish(),
+	waitlistText: z.string().max(20_000).nullish(),
+	privacyPolicyUrl: httpUrlSchema.default("https://evobug.com/privacy"),

@@ -0,0 +132,10 @@
+
+		assertConsistentProviders(input.allowedAuthProviders, input.requiredConnections);
+
+		const [existing] = await context.db
+			.select({ id: playtestProductsTable.id })
+			.from(playtestProductsTable)
+			.where(eq(playtestProductsTable.slug, input.slug))
+			.limit(1);
+
+		if (existing) throw errors.SLUG_TAKEN();

@@ -0,0 +158,10 @@
+
+		if (!created) throw new ORPCError("INTERNAL_ERROR");
+
+		await writeAudit(context.db, meta, {
+			action: "product.create",
+			actorAdminId: admin.id,
+			entityType: "playtest_product",
+			entityId: created.id,
+			metadata: { slug: created.slug, name: created.name },
+		});

@@ -0,0 +206,8 @@
+			if (clash) throw errors.SLUG_TAKEN();
+		}
+
+		const [updated] = await context.db
+			.update(playtestProductsTable)
+			.set({ ...patch, updatedAt: new Date() })
+			.where(eq(playtestProductsTable.id, id))
+			.returning();

@@ -0,0 +262,13 @@
+			.orderBy(playtestProductsTable.id);
+
+		// Two grouped aggregates rather than N+1 per product.
+		const applicationCounts = await context.db
+			.select({
+				productId: playtestApplicationsTable.productId,
+				total: count(),
+				waitlisted: sql<number>`count(*) filter (where ${playtestApplicationsTable.status} = 'waitlisted')`.mapWith(
+					Number,
+				),
+			})
+			.from(playtestApplicationsTable)
+			.groupBy(playtestApplicationsTable.productId);

@@ -0,0 +330,14 @@
+	.handler(async ({ input, context, errors }) => {
+		const { admin, meta } = context as unknown as AdminSessionContext;
+
+		const [assigned] = await context.db
+			.select({ value: count() })
+			.from(playtestKeysTable)
+			.where(and(eq(playtestKeysTable.productId, input.id), eq(playtestKeysTable.status, "assigned")));
+
+		if ((assigned?.value ?? 0) > 0) throw errors.KEYS_STILL_ASSIGNED();
+
+		await context.db
+			.update(playtestProductsTable)
+			.set({ status: "archived", updatedAt: new Date() })
+			.where(eq(playtestProductsTable.id, input.id));

@@ -0,0 +42,4 @@
+
+Thanks for signing up. Places in each round are limited, so we review applications in batches and pick a spread of players and hardware that suits whatever we're testing at the time.
+
+If you're selected, you'll get an email with the NDA. Sign it, and your key appears on this page.

@@ -0,0 +56,4 @@
+	fallback: string,
+	gameName: string,
+): string {
+	return (template ?? fallback).replaceAll("{{GAME}}", gameName);

@@ -316,0 +342,7 @@
+			from: r.playtestApplicationsTable.productId,
+			to: r.playtestProductsTable.id,
+		}),
+		user: r.one.usersTable({
+			from: r.playtestApplicationsTable.userId,
+			to: r.usersTable.id,
+		}),

@@ -316,0 +370,7 @@
+			from: r.playtestKeysTable.assignedUserId,
+			to: r.usersTable.id,
+		}),
+		application: r.one.playtestApplicationsTable({
+			from: r.playtestKeysTable.assignedApplicationId,
+			to: r.playtestApplicationsTable.id,
+		}),

@@ -0,0 +1,73 @@
+/**
+ * Fixed-window in-memory rate limiter.

@@ -0,0 +12,4 @@
+	hits: number[];
+}
+
+const buckets = new Map<string, Bucket>();

@@ -0,0 +24,4 @@
+/**
+ * Record an attempt against `key` and report whether it may proceed.
+ */
+export function checkRateLimit(key: string, max: number, windowMs: number): RateLimitResult {

@@ -0,0 +64,4 @@
+	const now = Date.now();
+	for (const [key, bucket] of buckets) {
+		// One hour is longer than any window used here, so anything older is dead.
+		if (bucket.hits.every((t) => now - t > 60 * 60 * 1000)) {

@@ -0,0 +50,4 @@
+
+export function base32Decode(input: string): Uint8Array {
+	// Users retyping a secret tend to include spaces and padding; both are noise.
+	const normalized = input.replace(/[\s=]/g, "").toUpperCase();

@@ -0,0 +153,8 @@
+/**
+ * Check a submitted code, scanning the drift window and rejecting replays.
+ */
+export async function verifyTotp(
+	secret: string,
+	token: string,
+	options: TotpVerifyOptions = {},
+): Promise<TotpVerifyResult> {

@@ -0,0 +158,10 @@
+	token: string,
+	options: TotpVerifyOptions = {},
+): Promise<TotpVerifyResult> {
+	const {
+		digits = DEFAULT_DIGITS,
+		period = DEFAULT_PERIOD_SECONDS,
+		window = DEFAULT_WINDOW,
+		atMs = Date.now(),
+		lastUsedCounter = null,
+	} = options;

@@ -0,0 +184,5 @@
+	for (let offset = -window; offset <= window; offset++) {
+		const counter = current + offset;
+
+		// Replay guard - never accept a step at or below one already spent.
+		if (lastUsedCounter !== null && counter <= lastUsedCounter) continue;

@@ -0,0 +238,5 @@
+ * One-time recovery codes for when an admin loses their authenticator.
+ *
+ * Formatted `XXXX-XXXX-XXXX` from an unambiguous alphabet so they survive being
+ * written on paper. ~62 bits of entropy each; they are stored only as keyed
+ * fingerprints, never in clear.

@@ -0,0 +57,4 @@
+		"drifter", "phantom", "airlock", "salvage", "beacon", "nebula", "gantry", "thruster",
+	];
+
+	const picked = Array.from(

@@ -0,0 +67,4 @@
+}
+
+const args = parseArgs(process.argv.slice(2));
+const email = args.email?.trim().toLowerCase();

@@ -0,0 +87,4 @@
+	process.exit(1);
+}
+
+const password = args.password ?? process.env.PLAYTEST_ADMIN_PASSWORD ?? generatePassword();

@@ -0,0 +95,4 @@
+	process.exit(1);
+}
+
+const client = new Bun.SQL(process.env.DATABASE_URL);

@@ -0,0 +98,4 @@
+const client = new Bun.SQL(process.env.DATABASE_URL);
+const db = drizzle({ client, relations });
+
+const [existing] = await db

@@ -0,0 +133,4 @@
+
+const line = "─".repeat(66);
+
+console.log(`

@@ -0,0 +156,4 @@
+		const inviteToken = generateToken(32);
+		const expiresAt = new Date(Date.now() + ADMIN_INVITE_TTL_MS);
+
+		const [created] = await context.db

@@ -0,0 +202,4 @@
+export const acceptInvite = base
+	.input(
+		z.object({
+			token: z.string().min(1),

@@ -0,0 +241,4 @@
+
+		const totpSecret = generateTotpSecret();
+
+		await context.db

@@ -0,0 +302,4 @@
+	.handler(async ({ input, context, errors }) => {
+		const meta = getRequestMeta(context.headers);
+
+		const limit = checkRateLimit(

@@ -0,0 +308,4 @@
+			LOGIN_RATE_LIMIT_WINDOW_MS,
+		);
+
+		if (!limit.allowed) {

@@ -0,0 +358,4 @@
+
+		// Password accepted - reset the failure counter but do NOT mark the session
+		// authenticated. That only happens after the second factor.
+		await context.db

@@ -0,0 +441,4 @@
+			throw errors.INVALID_CODE();
+		}
+
+		await context.db

@@ -0,0 +538,4 @@
+	.errors({
+		INVALID_CODE: { message: "That recovery code is not valid" },
+	})
+	.handler(async ({ input, context, errors }) => {

@@ -0,0 +558,4 @@
+			throw errors.INVALID_CODE();
+		}
+
+		const remaining = stored.filter((hash) => hash !== match);

@@ -0,0 +657,4 @@
+			})
+			.where(eq(playtestAdminsTable.id, admin.id));
+
+		// Force every other device to re-authenticate with the new credential.

@@ -0,0 +765,4 @@
+
+		await context.db
+			.update(playtestAdminsTable)
+			.set({

@@ -0,0 +859,4 @@
+	.input(z.object({}).optional())
+	.output(z.object({ removed: z.number() }))
+	.handler(async ({ context }) => {
+		const removed = await context.db

@@ -0,0 +26,4 @@
+ * Only http(s) URLs. Blocks `javascript:` and `data:` from reaching an href or
+ * a background-image on the branded page.
+ */
+const httpUrlSchema = z

@@ -0,0 +41,4 @@
+
+const productShapeSchema = z.object({
+	slug: slugSchema,
+	name: z.string().min(1).max(255).trim(),

@@ -0,0 +62,4 @@
+	ndaIntroText: z.string().max(20_000).nullish(),
+	disclaimerText: z.string().max(20_000).nullish(),
+	waitlistText: z.string().max(20_000).nullish(),
+	privacyPolicyUrl: httpUrlSchema.default("https://evobug.com/privacy"),

@@ -0,0 +132,4 @@
+
+		assertConsistentProviders(input.allowedAuthProviders, input.requiredConnections);
+
+		const [existing] = await context.db

@@ -0,0 +158,4 @@
+
+		if (!created) throw new ORPCError("INTERNAL_ERROR");
+
+		await writeAudit(context.db, meta, {

@@ -0,0 +206,4 @@
+			if (clash) throw errors.SLUG_TAKEN();
+		}
+
+		const [updated] = await context.db

@@ -0,0 +262,4 @@
+			.orderBy(playtestProductsTable.id);
+
+		// Two grouped aggregates rather than N+1 per product.
+		const applicationCounts = await context.db

@@ -0,0 +330,4 @@
+	.handler(async ({ input, context, errors }) => {
+		const { admin, meta } = context as unknown as AdminSessionContext;
+
+		const [assigned] = await context.db

@@ -0,0 +42,4 @@
+
+Thanks for signing up. Places in each round are limited, so we review applications in batches and pick a spread of players and hardware that suits whatever we're testing at the time.
+
+If you're selected, you'll get an email with the NDA. Sign it, and your key appears on this page.

@@ -0,0 +56,4 @@
+	fallback: string,
+	gameName: string,
+): string {
+	return (template ?? fallback).replaceAll("{{GAME}}", gameName);

@@ -316,0 +342,4 @@
+			from: r.playtestApplicationsTable.productId,
+			to: r.playtestProductsTable.id,
+		}),
+		user: r.one.usersTable({

@@ -316,0 +370,4 @@
+			from: r.playtestKeysTable.assignedUserId,
+			to: r.usersTable.id,
+		}),
+		application: r.one.playtestApplicationsTable({

@@ -0,0 +1,73 @@
+/**
+ * Fixed-window in-memory rate limiter.

@@ -0,0 +12,4 @@
+	hits: number[];
+}
+
+const buckets = new Map<string, Bucket>();

@@ -0,0 +24,4 @@
+/**
+ * Record an attempt against `key` and report whether it may proceed.
+ */
+export function checkRateLimit(key: string, max: number, windowMs: number): RateLimitResult {

@@ -0,0 +64,4 @@
+	const now = Date.now();
+	for (const [key, bucket] of buckets) {
+		// One hour is longer than any window used here, so anything older is dead.
+		if (bucket.hits.every((t) => now - t > 60 * 60 * 1000)) {

@@ -0,0 +50,4 @@
+
+export function base32Decode(input: string): Uint8Array {
+	// Users retyping a secret tend to include spaces and padding; both are noise.
+	const normalized = input.replace(/[\s=]/g, "").toUpperCase();

@@ -0,0 +153,4 @@
+/**
+ * Check a submitted code, scanning the drift window and rejecting replays.
+ */
+export async function verifyTotp(

@@ -0,0 +158,4 @@
+	token: string,
+	options: TotpVerifyOptions = {},
+): Promise<TotpVerifyResult> {
+	const {

@@ -0,0 +184,4 @@
+	for (let offset = -window; offset <= window; offset++) {
+		const counter = current + offset;
+
+		// Replay guard - never accept a step at or below one already spent.

@@ -0,0 +238,4 @@
+ * One-time recovery codes for when an admin loses their authenticator.
+ *
+ * Formatted `XXXX-XXXX-XXXX` from an unambiguous alphabet so they survive being
+ * written on paper. ~62 bits of entropy each; they are stored only as keyed