Paperwala - Nostalgic 3D Web Game

Game Engine & Rendering

• Three.js WebGL 3D graphics with procedural bicycle frame and handlebar steering
• Realistic physics: inertia
• cadence gear shifts
• wobble on collision
• jump trajectory
• Dynamic lighting with soft morning shadows and chrome material finishes
• Gouache-painted foliage textures and colonial verandah architecture
• 60 FPS performance optimization with mobile GPU compatibility

Player Controls & Input

• Desktop keyboard controls: Arrow keys for steering
• Spacebar for toss
• X for mischief
• Mobile touch layout: Pedal
• Brake
• Steer
• Toss
• Mischief buttons with haptic feedback
• Automatic fullscreen mode on mobile game start
• Mouse click alternative for newspaper throwing
• Pause/resume with Escape or P key
• HUD pause button

Campaign & Scoring

• 7-day weekly tour from Monday dawn to Sunday evening
• Paper toss targeting with dynamic trajectory prediction and balcony precision
• Window smash sound effects and speed delivery bonuses
• Interactive hazards: chasing street dogs
• radar speed traps
• ramp jumps
• Subscriber retention management across daily routes

Leaderboard System

• Global ranked leaderboard with parameterized queries (GET /api/leaderboard)
• Player registration with unique token issuance (POST /api/register)
• Run recording with score
• distance
• deliveries
• hazards (POST /api/runs)
• Scoped run deletion for players (DELETE /api/runs with token validation)
• Top 100 entries display with configurable LEADERBOARD_LIMIT

Authentication & Security

• Role-based access control: admin and rider roles
• HMAC-signed session tokens with HTTP-only cookies
• Bcrypt password hashing (12 rounds) for admin credentials
• Parameter-bound SQL queries preventing injection attacks
• Admin JWT secret and session secret environment variables

Administrative Console

• Dashboard at /admin with telemetry
• player stats
• run moderation
• Player management: GET
• PATCH
• DELETE operations on courier records
• Run moderation: Administrative deletion of flagged entries
• System diagnostics: Database health
• storage metrics
• JSON export
• Audit log viewer with retention purging (GET
• DELETE /api/admin/audit)

Database Layer

• Node SQLite (DatabaseSync) in WAL mode for local deployments
• Neon Postgres support for serverless scaling (DATABASE_TYPE=postgres)
• Schema with players
• runs
• leaderboard
• users
• audit_logs tables
• Migration scripts: setup-db.js
• seed-db.js
• migrate-neon.js
• Database seeding endpoint (POST /api/admin/seed) for demo baseline

API Routes

• Player registration: POST /api/register returns token and player_id
• Run submission: POST /api/runs with authentication validation
• Admin login/logout: POST /api/admin/login
• /api/admin/logout with cookie management
• Stats endpoint: GET /api/admin/stats for system telemetry
• User management: GET
• POST
• PATCH
• DELETE /api/admin/users for operators

Deployment & Infrastructure

• Docker configuration with Dockerfile and docker-compose.yml
• Health check endpoint: wget /api/leaderboard every 30s
• Environment variable validation in docker-entrypoint.sh
• Production build with Next.js 16 static optimization
• Package audit script (scripts/package-audit.sh) for vulnerability scanning

Cultural & Visual Assets

• Bengali typography with Noto Serif Bengali variable font
• Dhaka landmark artwork: Mirpur Road
• Road 27
• Satmasjid Road scenes
• 1980s aesthetic: Hero bicycle model
• vintage newspaper mastheads
• Audio assets: retro-melody.mp3 (6.5 MB)
• glass-breaking.mp3
• 3D models: playable-dog.glb
• grumpy-newsman.glb
• playable-houses.glb