Add live poker tables with Cloudflare Durable Objects

[ataymo1]

Summary

• add real-time live poker tables, host controls, buy-in approval, reconnect handling, and hand/settlement persistence
• run authoritative table state and WebSockets in a Cloudflare Worker backed by Durable Objects while keeping Next.js/API routes on Vercel
• harden card shuffling, table closure, token refresh, origin checks, Convex request access, and Durable Object outbox storage
• add production deployment docs, environment templates, Cloudflare health checks, and CI verification
• merge the latest main changes for player claims and PokerNow imports

Abuse and zero-cost safeguards

• authenticate and rate-limit requests before Durable Object dispatch; cap table/user/socket connections, message rates, payloads, active tables, unattended actions, and total hands
• bound webhook timeouts, retries, retry batches, dead letters, storage retention, alarms, reconnects, and browser polling
• make player settlements idempotent and safe when failed callbacks arrive out of order
• separate JWT, Worker control, callback, and Convex secrets
• disable persisted Cloudflare observability and cap Worker CPU at the Free-plan limit
• require pnpm deploy:worker, which verifies the dedicated account allowlist and every page of Cloudflare account subscriptions using a Billing Read token before deploying

Cloudflare must remain a dedicated Workers Free account. Free-quota exhaustion can cause downtime but should not create Workers overage charges. The guard cannot prevent a later dashboard upgrade or eliminate legal/account-policy risks associated with real-money wagering. Vercel and Convex must independently remain on their free plans for the whole system to stay at $0.

Deployment

See DEPLOYMENT.md for the Vercel, Convex, and Cloudflare environment matrix, deployment order, emergency stop, secret separation, and guarded Worker deployment. The Vercel app talks to the separately deployed Worker over HTTPS/WSS; Vercel does not need a Durable Object binding.

Verification

• pnpm run type-check
• pnpm build
• pnpm run test:live-poker (37 passed)
• Biome lint on all modified TypeScript/JavaScript files
• git diff --check
• pnpm exec wrangler deploy --dry-run
• deployment guard fixtures: Free plan accepted; missing configuration and paid subscription on a later page rejected

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
buy-in	Ready	Preview	Aug 21, 2026 11:07pm