PackX402 beta: core data model, fairness engine, x402 payments, CardTrader adapter, auth, docs

.claude/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "packx402-dev",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev"],
+      "port": 3000
+    }
+  ]
+}

.env.example

@@ -1,4 +1,4 @@
-# Pack402 environment configuration
+# PackX402 environment configuration
 # Copy to .env.local for local dev. NEVER commit a file containing real values.
 # Every secret below must be provisioned per-environment (local/staging/prod) — do not share across environments.
 
@@ -21,7 +21,7 @@ FIELD_ENCRYPTION_KEY=
 # ---------------------------------------------------------------------------
 # Database (Postgres via Drizzle ORM)
 # ---------------------------------------------------------------------------
-DATABASE_URL=postgres://pack402:pack402@localhost:5432/pack402
+DATABASE_URL=postgres://packx402:packx402@localhost:5432/packx402
 
 # ---------------------------------------------------------------------------
 # Redis-compatible cache / rate limiting / queues
@@ -37,14 +37,14 @@ SMTP_HOST=
 SMTP_PORT=587
 SMTP_USER=
 SMTP_PASSWORD=
-EMAIL_FROM=Pack402 <no-reply@pack402.example>
+EMAIL_FROM=PackX402 <no-reply@packx402.example>
 
 # ---------------------------------------------------------------------------
 # S3-compatible object storage (profile images, showcase covers)
 # ---------------------------------------------------------------------------
 S3_ENDPOINT=
 S3_REGION=auto
-S3_BUCKET=pack402-uploads
+S3_BUCKET=packx402-uploads
 S3_ACCESS_KEY_ID=
 S3_SECRET_ACCESS_KEY=
 S3_PUBLIC_BASE_URL=
@@ -97,7 +97,7 @@ CARDTRADER_ACCOUNT_ID=
 # ---------------------------------------------------------------------------
 # Feature flags / safety switches
 # ---------------------------------------------------------------------------
-FEATURE_HIGH_VALUE_PACKS_ENABLED=false  # server-side gate for packs > $100
+FEATURE_HIGH_VALUE_PACKS_ENABLED=false  # server-side gate for packs > $250 (bankroll-limited during beta)
 FEATURE_LOYALTY_ENABLED=true
 FEATURE_LOYALTY_KILL_SWITCH=false
 FEATURE_AFFILIATE_PROGRAM_ENABLED=true

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Report a bug in PackX402
+title: "[Bug] "
+labels: bug
+---
+
+## Description
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+## Actual behavior
+
+## Environment
+
+- Branch/commit:
+- `NODE_ENV` / `APP_ENV`:
+- Browser (if UI bug):
+
+## Security-sensitive?
+
+If this is a security vulnerability, **do not file a public issue** — see
+[SECURITY.md](../../SECURITY.md) for the private reporting process.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Propose a new feature or change for PackX402
+title: "[Feature] "
+labels: enhancement
+---
+
+## Problem
+
+What's missing or painful today?
+
+## Proposed solution
+
+## Relevant spec section(s)
+
+<!-- If this maps to a numbered section in the product spec, reference it. -->
+
+## Alternatives considered
+
+## Additional context

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,32 @@
+## Summary
+
+<!-- What changed and why, in 2-4 bullets. -->
+
+## Website areas / spec sections touched
+
+<!-- List relevant sections from the product spec, e.g. "Section 41 (x402 payments)". -->
+
+## Test evidence
+
+- [ ] `npm run typecheck` passes
+- [ ] `npm run lint` passes
+- [ ] `npm run test` passes (paste the summary line)
+- [ ] `npm run build` passes
+- [ ] If schema changed: `npm run db:generate` was run and the migration is committed
+- [ ] Manually verified against a local database (`docker compose up -d && npm run
+db:migrate && npm run dev`), if the change touches a DB-backed route or page
+
+## Security checklist
+
+- [ ] No secrets committed
+- [ ] No new client-trusted value used for price/eligibility/limits without server
+      re-derivation
+- [ ] No new unencrypted sensitive field
+- [ ] `PROJECT_STATUS.md` updated if this moves something from unverified/not-started to
+      implemented-and-tested, or introduces a new gap
+
+## Known limitations / follow-ups
+
+<!-- What's still missing, stubbed, or unverified as a result of this change. -->
+
+## Screenshots (if UI)

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,195 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  install:
+    name: Install dependencies (locked)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+
+  format:
+    name: Format check
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run format:check
+
+  lint:
+    name: ESLint
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  typecheck:
+    name: Strict TypeScript
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  unit-tests:
+    name: Unit & integration tests
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run test
+
+  build:
+    name: Production build
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+        env:
+          SESSION_SECRET: ci-placeholder-session-secret-32-chars-min
+          FIELD_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
+          DATABASE_URL: postgres://ci:ci@localhost:5432/ci
+          REDIS_URL: redis://localhost:6379
+
+  db-schema-check:
+    name: Database schema validation
+    runs-on: ubuntu-latest
+    needs: install
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: packx402
+          POSTGRES_PASSWORD: packx402
+          POSTGRES_DB: packx402
+        ports: ["5432:5432"]
+        options: >-
+          --health-cmd "pg_isready -U packx402 -d packx402"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - name: Fail if the checked-in schema has ungenerated migrations
+        run: npx drizzle-kit generate --name ci-schema-check-should-be-empty
+        env:
+          DATABASE_URL: postgres://packx402:packx402@localhost:5432/packx402
+      - name: Verify no new migration file was produced
+        run: |
+          if [ -n "$(git status --porcelain drizzle/)" ]; then
+            echo "Schema changed without a committed migration. Run 'npm run db:generate' and commit the result."
+            git status --porcelain drizzle/
+            exit 1
+          fi
+
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  dependency-audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npm audit --audit-level=critical
+
+  sbom:
+    name: Software bill of materials
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.json
+
+  e2e:
+    name: Playwright end-to-end tests
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+      - run: npm ci
+      - name: Check for Playwright tests
+        id: check
+        run: echo "has_tests=$(find tests -name '*.spec.ts' 2>/dev/null | wc -l)" >> "$GITHUB_OUTPUT"
+      - name: Install Playwright browsers
+        if: steps.check.outputs.has_tests != '0'
+        run: npx playwright install --with-deps
+      - name: Run Playwright tests
+        if: steps.check.outputs.has_tests != '0'
+        run: npm run test:e2e
+      - name: No Playwright tests yet
+        if: steps.check.outputs.has_tests == '0'
+        run: echo "No Playwright specs found yet — see PROJECT_STATUS.md. Skipping without failing the build."

.gitignore

@@ -46,7 +46,7 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-# --- Pack402 secrets & sensitive data (never commit) ---
+# --- PackX402 secrets & sensitive data (never commit) ---
 *.pem
 *.key
 *.p12

.prettierignore

@@ -0,0 +1,7 @@
+node_modules
+.next
+drizzle
+coverage
+playwright-report
+test-results
+package-lock.json

.prettierrc.json

@@ -0,0 +1,7 @@
+{
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "plugins": ["prettier-plugin-tailwindcss"]
+}