Changelog

Changelog

A high-level, capability-oriented history of the platform. This is a curated summary, not a commit log — see the repository history for detail. Dates are approximate to the milestone.

Integrations & Webhooks — PAM integration (2026-07)

  • Brand-scoped API keys — keys can be pinned to a single brand; the credential is the brand-isolation boundary (x-brand ignored for pinned keys). Least-privilege scopes (events:write for ingestion).
  • Configurable mapping engine — a per-brand, versioned JSONB mapping translates a PAM’s raw events to the canonical model (event-type map, payload field map, player field map, unmapped policy) with a fixed transform vocabulary. Raw payload always retained.
  • Mapping editor + live tester + ingestion log in the dashboard — configure and validate mappings against real sample payloads with no live traffic.
  • Platform Owner truly cross-tenant — super-aware permission checks close a latent cross-tenant write gap (brands / API keys / webhooks).
  • Canonical taxonomy extended (withdrawal, bonus_granted, kyc_verified, status_changed).
  • Service-role API-key backdoor gated off by default in production.
  • Comprehensive documentation across Platform, Operator Guides, PAM Integration, and Developer Docs.
  • Event-driven financials: deposit/withdrawal events now derive the player’s deposit/withdrawal totals + last_deposit_at/last_bet_at incrementally (previously only wagering/GGR/NGR/LTV were derived from events; deposits were snapshot-only). A POST /players snapshot remains for one-time history import.

RBAC & Platform Owner

  • Granular, brand-aware RBAC (permission catalog, system + custom roles, per-brand assignments, per-user overrides), enforced in both RLS and the app.
  • Cross-tenant Platform console and an “All brands” aggregate for the Platform Owner, scoped through the normal RLS layer.

Analytics & reporting

  • Revenue (GGR/NGR/wagered), retention/at-risk/churn, engagement & stickiness, cohort retention/LTV, forecasting, lifecycle migration, event path-flow, deposits by payment method, A/B experiments.
  • Customizable/reorderable dashboard; scheduled KPI digests with PDF charts.

CRM depth

  • Player 360 with derived stats, timelines, lifecycle history, consent, ownership; data-quality dashboard; VIP tiering; per-host team rollup; tasks with reminders and comments; custom fields; segment export & scheduled exports.

Campaigns, journeys & messaging

  • Omnichannel campaigns with real delivery (email/SMTP, Telegram/Bot API, web-push/VAPID, in-app over Realtime; SMS/WhatsApp editors).
  • Visual journey automation with a playbook library.

Gamification

  • Levels, missions, badges, tournaments (+ analytics), point currencies, and a first-class bonuses admin.

Player portal

  • Real player-facing portal: Supabase auth, gamification view, Realtime in-app inbox, and web-push subscribe.

Foundation

  • Turborepo monorepo, four Next.js apps + a BullMQ worker, self-hosted Supabase (Postgres + RLS), CI/CD, and a self-hosted Hetzner/Docker Compose deployment.

Versioning: the public REST API is versioned under /api/v1; breaking changes would ship under a new version. The canonical event set and the outbound webhook catalog grow additively.

API Reference