feat(netcode): chiffrement AES-256-ECB conforme FAESHandlerComponent d'UE

Recycle a confirmé : 'basic aes', clé server-side déductible client, by-the-book reimpl,
pas de handshake DTLS. Remplace le GCM par AES-256-ECB + PKCS#7 + flag bit + termination
bit (mirror du source UE 4.27). Flux : SetKey -> EncryptionAck clair -> Enable -> Challenge
chiffré. Supprime AesGcmHandlerComponent.

.gitea/workflows/build.yml

@@ -0,0 +1,33 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main, preprod]
+  workflow_dispatch: {}
+
+env:
+  IMAGE: git.nfteam.ovh/neckfire/the-cycle
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Build & push image
+        run: |
+          set -e
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.nfteam.ovh -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          SHA="${GITHUB_SHA::12}"
+          BRANCH="${GITHUB_REF_NAME}"
+          if [ "$BRANCH" = "main" ]; then TAGS="-t ${IMAGE}:latest -t ${IMAGE}:${SHA}"; else TAGS="-t ${IMAGE}:${BRANCH} -t ${IMAGE}:${BRANCH}-${SHA}"; fi
+          docker build $TAGS -f Dockerfile .
+          docker push --all-tags "${IMAGE}"
+      - name: Notify ntfy
+        if: always()
+        run: |
+          if [ "${{ job.status }}" = "success" ]; then EMOJI="white_check_mark"; PRIO="default"; else EMOJI="rotating_light"; PRIO="high"; fi
+          curl -s -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" -H "Title: ${GITHUB_REPOSITORY} — ${{ job.status }}" \
+            -H "Priority: ${PRIO}" -H "Tags: ${EMOJI}" -H "Click: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions" \
+            -d "${GITHUB_WORKFLOW} (${GITHUB_REF_NAME} #${GITHUB_RUN_NUMBER}) : ${{ job.status }}" \
+            "${{ secrets.NTFY_URL }}/${{ secrets.NTFY_TOPIC }}" || true

.gitea/workflows/game-server.yml

@@ -0,0 +1,28 @@
+name: Build Game Server
+on:
+  push:
+    branches: [game-server]
+  workflow_dispatch: {}
+env:
+  IMAGE: git.nfteam.ovh/neckfire/the-cycle-game
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Build & push image
+        run: |
+          set -e
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.nfteam.ovh -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+          SHA="${GITHUB_SHA::12}"
+          docker build -t "${IMAGE}:game-server" -t "${IMAGE}:${SHA}" -f Dockerfile.gameserver .
+          docker push --all-tags "${IMAGE}"
+      - name: Notify ntfy
+        if: always()
+        run: |
+          if [ "${{ job.status }}" = "success" ]; then EMOJI="white_check_mark"; PRIO="default"; else EMOJI="rotating_light"; PRIO="high"; fi
+          curl -s -H "Authorization: Bearer ${{ secrets.NTFY_TOKEN }}" -H "Title: ${GITHUB_REPOSITORY} game-server — ${{ job.status }}" \
+            -H "Priority: ${PRIO}" -H "Tags: ${EMOJI}" -H "Click: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions" \
+            -d "${GITHUB_WORKFLOW} (${GITHUB_REF_NAME} #${GITHUB_RUN_NUMBER}) : ${{ job.status }}" \
+            "${{ secrets.NTFY_URL }}/${{ secrets.NTFY_TOPIC }}" || true

.gitignore

@@ -0,0 +1 @@
+_out/

Dockerfile

@@ -0,0 +1,15 @@
+# The Cycle: Frontier — serveur API (émulateur Prospect), build depuis les sources.
+# Multi-stage : SDK .NET 8 pour publier le projet API → runtime aspnet 8.
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+COPY src/ ./src/
+# Configuration "Season 2 Release" = build qui correspond au client S2 déployé
+# (le code sélectionne la saison via des #if SEASON_2_RELEASE / SEASON_3_RELEASE).
+RUN dotnet publish src/Prospect.Server.Api/Prospect.Server.Api.csproj \
+      -c "Season 2 Release" -o /app
+
+FROM mcr.microsoft.com/dotnet/aspnet:8.0
+WORKDIR /app
+COPY --from=build /app ./
+EXPOSE 8443 8000
+ENTRYPOINT ["dotnet", "Prospect.Server.Api.dll"]

Dockerfile.gameserver

@@ -0,0 +1,14 @@
+# The Cycle: Frontier — serveur de jeu dédié (EXPÉRIMENTAL / R&D).
+# Réimplémentation du serveur autoritaire Unreal (Prospect.Unreal). Build depuis les sources.
+FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
+WORKDIR /src
+COPY src/ ./src/
+RUN dotnet publish src/Prospect.Server.Game/Prospect.Server.Game.csproj -c Release -o /app
+
+FROM mcr.microsoft.com/dotnet/runtime:8.0
+WORKDIR /app
+COPY --from=build /app ./
+# Le réseau Unreal est en UDP.
+EXPOSE 7777/udp
+# Configurable : PROSPECT_MAP / PROSPECT_GAMEMODE / PROSPECT_PORT
+ENTRYPOINT ["dotnet", "Prospect.Server.Game.dll"]

FRIENDS-INSTALL.md

@@ -0,0 +1,80 @@
+# 🎮 The Cycle: Frontier — Rejoindre le serveur privé (installation client)
+
+Guide pour **installer le client et jouer sur le serveur privé**. Tu n'installes **rien côté serveur** — juste le jeu + un loader + un certificat.
+
+> ⚠️ **À savoir avant de commencer**
+> - Le jeu a été retiré de Steam en septembre 2022 : il faut **l'avoir déjà eu dans ta bibliothèque Steam** pour le retélécharger.
+> - **Ce n'est pas du co-op en raid.** Chacun joue sa propre instance (stations solo) ; l'émulateur ne supporte pas plusieurs joueurs dans le même raid. Vous partagez le même serveur (progression, boutiques, comptes), pas la même partie.
+> - Le serveur doit être **allumé** au moment où tu joues (demande à l'hébergeur).
+
+---
+
+## Fichiers à télécharger (dans la release)
+Les 2 fichiers sont dispo dans la **release Gitea** :
+👉 **https://git.nfteam.ovh/neckfire/the-cycle/releases/tag/friends-client**
+
+1. **`LoaderPack.zip`** — le loader qui redirige le jeu vers le serveur privé (build b8 / Saison 2).
+2. **`certificate.crt`** — le certificat **public** du serveur (sans clé privée, safe).
+
+Télécharge les deux depuis la page de release avant de commencer.
+
+---
+
+## Étapes (Windows)
+
+### 1. Installer le client Saison 2 (via la console Steam)
+1. Steam ouvert, `Win+R` → tape `steam://nav/console` → Entrée (la **console Steam** s'ouvre).
+2. Colle **exactement** cette commande → Entrée :
+   ```
+   download_depot 868270 868271 4623363103423775682
+   ```
+   (`868270` = le jeu, `868271` = le dépôt client, `4623363103423775682` = manifest **Saison 2 v2.7.2**.)
+3. Le téléchargement démarre (⚠️ **pas de barre de progression**, sois patient — plusieurs Go).
+4. À la fin, Steam affiche **« Depot download complete »** + le **chemin du dossier**
+   (ex. `...\Steam\steamapps\content\app_868270\depot_868271`). **Ce dossier = ton install du jeu.**
+
+> Il faut **avoir eu The Cycle: Frontier dans ta bibliothèque Steam** avant, sinon → erreur `missing license`.
+
+> **Pas assez d'espace sur le disque principal ?** `download_depot` écrit toujours dans `...\Steam\steamapps\content`. Pour le mettre sur un autre disque : ferme Steam, supprime `...\Steam\steamapps\content`, puis en **cmd admin** :
+> ```
+> mkdir "D:\SteamContent"
+> mklink /J "C:\Program Files (x86)\Steam\steamapps\content" "D:\SteamContent"
+> ```
+> Rouvre Steam et relance la commande → le jeu ira sur `D:\`.
+
+### 2. Installer le LoaderPack
+1. Va dans le dossier du jeu → **`Prospect\Binaries\Win64`**.
+2. Ouvre `LoaderPack.zip` et **glisse tout son contenu** dans ce dossier `Win64`.
+3. Crée un **raccourci** vers `Prospect.Client.Loader.exe` (c'est avec ça que tu lanceras le jeu).
+
+### 3. Faire confiance au certificat du serveur
+1. Double-clique **`certificate.crt`** → **Installer le certificat**.
+2. **Emplacement : Utilisateur actuel** → Suivant.
+3. **Placer tous les certificats dans le magasin suivant** → **Parcourir** → **Autorités de certification racines de confiance** → OK → Suivant → Terminer.
+4. Accepte l'avertissement de sécurité (il mentionne `2EA46.playfabapi.com`).
+
+### 4. Pointer le client vers le serveur
+Dans **`Prospect\Binaries\Win64`**, crée (ou édite) un fichier **`backend.txt`** contenant **exactement** cette ligne :
+
+```
+https://tc.nfteam.ovh:8443
+```
+
+### 5. Lancer le jeu
+1. **Steam doit être ouvert** (connecté à ton compte).
+2. Lance le jeu via le **raccourci `Prospect.Client.Loader`** (⚠️ pas via Steam directement).
+3. Connexion automatique avec ton compte Steam. Bienvenue sur Fortuna III ! 🚀
+
+---
+
+## Dépannage
+| Symptôme | Cause / solution |
+|---|---|
+| `libcurl error 7 (Couldn't connect to server)` | Le serveur est **éteint** → demande à l'hébergeur de l'allumer. |
+| Erreur de certificat / `hostname mismatch` | `certificate.crt` **pas importé** (ou pas dans « Autorités racines de confiance »). Refais l'étape 3. |
+| `missing license` au téléchargement | Tu n'as jamais eu le jeu sur ce compte Steam → impossible de le retélécharger. |
+| Parties du corps manquantes (client S3) | Va en station → change ton apparence une fois (corrige les IDs). |
+
+---
+
+*Serveur privé The Cycle: Frontier — émulateur Prospect. Usage privé entre amis.*

GAMESERVER.md

@@ -0,0 +1,62 @@
+# Serveur de jeu dédié — R&D (branche `game-server`)
+
+> ⚠️ **Expérimental.** Objectif : un serveur de jeu **autoritaire** pour que plusieurs
+> joueurs soient dans la **même instance** (se voir, bouger). C'est un chantier de
+> reverse-engineering du serveur Unreal du Cycle. **Un raid co-op complet reste hors de portée
+> réaliste** ; on avance par jalons. **IA et loot volontairement hors périmètre pour l'instant.**
+
+## Pièces en jeu
+- **`Prospect.Unreal`** — réimplémentation en C# de la couche réseau d'Unreal Engine
+  (NetDriver UDP, channels control/actor, bunches, packet handler, handshake, `UWorld`,
+  `AGameModeBase`/`APlayerController`/`APawn`).
+- **`Prospect.Server.Game`** — l'exécutable serveur (host loop, monde, game mode).
+
+## État actuel (ce qui marche côté serveur)
+Le **handshake de connexion Unreal est implémenté** et va jusqu'au spawn du PlayerController :
+
+```
+NMT_Hello  →  SendChallenge
+NMT_Login  →  PreLogin → WelcomePlayer (envoie map + game mode)
+NMT_Join   →  SpawnPlayActor → GameMode.Login → APlayerController
+```
+
+Corrections/avancées de cette branche :
+- **Cible la map/gamemode du Cycle** (`/Game/Maps/MP/Station/Station_P` + `YGameMode_Station`)
+  au lieu de la map template d'UE. Configurable via `PROSPECT_MAP` / `PROSPECT_GAMEMODE` / `PROSPECT_PORT`.
+- **`WelcomePlayer`** envoie désormais la **vraie** map/gamemode du monde (plus le template).
+- **`GameSession`** est initialisée → le login ne plante plus sur `"GameSession is null"`
+  (c'était le point de blocage juste avant le spawn).
+
+## Ce qui manque (roadmap, du plus atteignable au plus dur)
+1. **Connexion client réelle** : valider le handshake complet avec le **vrai client** (pas le
+   harnais `Client.cs`). Nécessite des **tests en live** (impossible à valider hors client).
+2. **Spawn du Pawn du Cycle** : `GameMode.Login` spawn un `APlayerController` mais **pas** le
+   personnage. Il faut spawner la **classe de Pawn spécifique du Cycle** (`YCharacter…`) avec le
+   bon **NetGUID / class path** pour que le client l'instancie.
+3. **Réplication du mouvement** : répliquer les propriétés du `CharacterMovementComponent`
+   (position/rotation/état) chaque tick → **le premier vrai « se voir bouger »**.
+4. *(plus tard)* IA, loot, dégâts, tempête, évac… — **hors périmètre pour l'instant**.
+
+Les jalons 2–3 demandent de connaître les **classes répliquées du jeu** (côté client, non
+présentes dans le code serveur) et **itèrent en live** avec le client. C'est le vrai mur.
+
+## Build / run
+```bash
+# build
+dotnet build src/Prospect.Server.Game/Prospect.Server.Game.csproj -c Release
+# run (défauts : station, port 7777 UDP)
+dotnet run --project src/Prospect.Server.Game
+# ou conteneur
+docker build -t the-cycle-game -f Dockerfile.gameserver .
+docker run --rm -p 7777:7777/udp the-cycle-game
+```
+
+## CI/CD
+`.gitea/workflows/game-server.yml` : à chaque push sur `game-server`, build de `Dockerfile.gameserver`
+→ image **`git.nfteam.ovh/neckfire/the-cycle-game`** (tags `game-server` + sha) + notif ntfy.
+Image **séparée** de l'API (`the-cycle`) — les deux ne se marchent pas dessus.
+
+## Honnêteté
+Ceci est une **base d'exploration**. Le handshake + le spawn du controller avancent ; le
+« 2 joueurs se voient bouger » dépend du spawn du pawn du Cycle + réplication, qui exige du RE
+spécifique au jeu **et** des tests dans le client réel. Aucune garantie d'aboutir.

NETCODE-RND.md

@@ -0,0 +1,219 @@
+# The Cycle: Frontier — serveur dédié gameplay (R&D netcode)
+
+Branche `game-server`. Objectif : un serveur de jeu autoritatif écrit from scratch
+(Prospect.Unreal, réimplémentation C# du netcode Unreal) pour du vrai co-op, sans
+passer par un client-hôte P2P. **Statut : bloqué au chiffrement (voir plus bas).**
+
+Client cible : **UE4 build `R3.5.0`** (`4.27.2` netcode), Steam depot 868271.
+
+## Ce qui fonctionne (murs franchis)
+
+La connexion d'un vrai client va jusqu'à l'entrée du login :
+
+```
+Handshake stateless UDP (cookie/challenge)        ✅
+Reconstruction du paquet (PacketHandler)          ✅
+Séquençage des paquets (adopt des seq client)     ✅
+Alignement des bunches                             ✅  ← percée
+Canal de contrôle ouvert                           ✅
+NMT_Hello reçu et parsé                            ✅
+Transition login Hello → Login                     ✅
+Chiffrement DTLS-PSK                               ❌  ← mur final
+```
+
+### Percée : le bit de header spécifique R3.5.0
+
+Le client écrit **un bit de plus** entre l'historique d'ack du `FNetPacketNotify` et
+le payload packet-info, que l'UE 4.27 stock (EngineNetVer 16) n'a pas. Décodage
+bit-à-bit d'un vrai paquet : l'en-tête fait **65 bits, pas 64**. En consommant ce bit
+(`bCycleExtraHeaderBit` dans `UNetConnection.ReceivedPacket`), tout se réaligne :
+`bHasPacketInfoPayload`, l'horloge jitter (10 bits) et `bHasServerFrameTime` tombent
+juste, et le premier bunch du canal de contrôle parse proprement (ChIndex 0, bOpen,
+bReliable = NMT_Hello). Sans ce fix, le `ChIndex` sortait en vrac (~1 049 000) et le
+serveur droppait/plantait.
+
+## Le mur final : chiffrement DTLS-PSK
+
+Le client **exige** le chiffrement. Établi par reverse-engineering :
+
+- `NMT_Hello` porte `EncryptionToken` = le **PlayFab user_id** du joueur
+  (ex. `92EBCFE8C3EAF3AC`). Vu dans l'URL de connexion du client :
+  `...?EntityToken=<JWT>?EncryptionToken=92EBCFE8C3EAF3AC`.
+- Pile PacketHandler du client (ses propres logs) :
+  `[DTLSHandlerComponent, StatelessConnectHandlerComponent]`.
+- Le exe embarque les suites **`ECDHE-PSK-AES256-*`, `DHE-PSK-AES256-GCM-SHA384`**,
+  la cvar **`DTLS.PreSharedKeys`**, et `DTLSPSKClientCallback` / `DTLSPSKServerCallback`
+  → **DTLS en mode PSK** (clé pré-partagée 32 octets, identité = user_id).
+- Compression : **OodleNetwork** compilé, mais **aucun dictionnaire `.udic`** →
+  pass-through (les paquets ne sont ni compressés ni chiffrés au niveau paquet ;
+  entropie faible + longues suites de zéros le confirment).
+
+Proposer un challenge en clair (sans `NMT_EncryptionAck`) ne marche pas : le client
+ferme le canal de contrôle juste après.
+
+Pour finir il faudrait : (1) un **serveur DTLS-PSK** collé au framing du
+`DTLSHandlerComponent` d'UE, et (2) la **PSK de 32 octets** dérivée par le client à
+partir du user_id/EntityToken.
+
+## Pourquoi la clé est inaccessible (statique)
+
+L'exe `Prospect-Win64-Shipping.exe` est **packé/chiffré** (protection anti-triche,
+BattlEye) :
+
+- **Entropie de `.text` = 8.000** (maximum = aléatoire/chiffré ; du code normal ≈ 6.3).
+- `.rdata` = 4.96 (normal → les strings restent lisibles, d'où les découvertes ci-dessus).
+- Un scan brut du `.text` (76 Mo) ne trouve que **~76 instructions** → niveau du bruit :
+  ce n'est pas du code sur disque, c'est du chiffré déchiffré au runtime.
+
+Conséquence : Ghidra / radare2 n'analysent que du ciphertext ; **aucune référence** aux
+fonctions de chiffrement n'est trouvable statiquement. La dérivation de la PSK vit dans
+ce code chiffré.
+
+**Seule voie restante (non tentée)** : dump mémoire au runtime. Le jeu tourne sous
+Proton/Linux (BattlEye n'a pas de driver kernel sous Linux) → un autre process Linux
+peut lire `/proc/<pid>/mem` et récupérer le `.text` **déchiffré**, puis l'analyser dans
+Ghidra pour retrouver la dérivation. Zone grise ToS, plusieurs étapes.
+
+## Fichiers clés
+
+- `src/Prospect.Server.Game/Program.cs` — hôte du serveur de jeu (map Station, GameSession).
+- `src/Prospect.Unreal/Net/UNetConnection.cs` — `ReceivedPacket` : fix du bit de header
+  (`bCycleExtraHeaderBit`), adopt des séquences client, drop gracieux des bunches.
+- `src/Prospect.Unreal/Runtime/UWorld.cs` — `NotifyControlMessage` : Hello/Login ;
+  le `else` du bloc `NMT.Hello` documente le mur DTLS-PSK.
+
+## Verdict
+
+On a amené un serveur dédié gameplay The Cycle plus loin qu'aucun projet public connu
+(le projet communautaire deiteris/Prospect n'émule que les services en ligne, pas le
+netcode de jeu). Le mur restant — DTLS-PSK dont la clé est derrière un packer
+anti-triche — est un chantier crypto + RE dynamique d'un autre ordre de grandeur.
+
+## MAJ (2026-07-16) — mur DTLS franchi (côté serveur)
+
+- **PSK récupérée** : la clé 32 octets a été obtenue au runtime (dump du `.text`
+  déchiffré du client via `/proc/<pid>/mem` sous Proton — BattlEye n'a pas de driver
+  kernel sous Linux). Stockée dans **Vault** (`secret/the-cycle`, clé
+  `GAMESERVER_DTLS_PSKS`, format `user_id:hex32`), **jamais dans le repo**.
+- **Serveur DTLS-PSK implémenté** (BouncyCastle) :
+  - `DtlsPskStore` (env `PROSPECT_DTLS_PSKS`), `DtlsPacketTransport` (pont bloquant→paquet),
+    `ProspectPskTlsServer` (DTLS 1.2, identité=user_id), `DTLSHandlerComponent` (pipeline).
+  - `UWorld` sur `NMT_Hello` chiffré : PSK connue → `NMT_EncryptionAck` + handshake.
+  - Compile (0 erreur). **Non validé en live.**
+- **Reste (itération live obligatoire, invalidable hors client)** :
+  1. ordre exact du pipeline `[DTLS, Stateless]` et routage des records de handshake
+     (émis via `LowLevelSend` — doivent porter le framing stateless attendu) ;
+  2. framing DTLS-sur-PacketHandler d'UE (record layer, cookie DTLS éventuel) ;
+  3. bascule handshake→données applicatives.
+  Méthode : lancer `Prospect.Server.Game` avec la PSK, diriger le client dessus, itérer
+  sur les logs serveur.
+
+## MAJ (2026-07-16, soir) — test LIVE contre le vrai client (preprod multi)
+
+Setup : preprod multi (`the-cycle-api-rd2`, `GAMESERVER_ADDRESS=192.168.1.136:7777`) →
+le client voyage vers `the-cycle-game` (branche game-server, PSK via `PROSPECT_DTLS_PSKS`).
+user_id preprod = prod = `92EBCFE8C3EAF3AC` (même DB ? non, `ProspectDb_rd`, mais même Id).
+
+**Observé (séquence réelle) :**
+1. Handshake stateless : ✅ complet (challenge/cookie/ack, connexion acceptée).
+2. `NMT_Hello` reçu **EN CLAIR** avec EncryptionToken=`92EBCFE8C3EAF3AC` → PSK reconnue.
+3. On envoie `NMT_EncryptionAck` + `NMT_Challenge`. Le client **NE ferme plus tout de suite**
+   (progrès vs l'état documenté « ferme après challenge sans ack »).
+4. **Le client n'envoie JAMAIS de ClientHello DTLS** (`16 fe fd`). Aucun record DTLS.
+5. Le paquet suivant du client (~18 o, ex. `80E82AC4…5F00000C`) parse **en clair** comme un
+   **bunch `bClose=true` sur le canal de contrôle (ChIndex 0)** → **le client FERME**.
+
+**Interprétation :** après `NMT_EncryptionAck`, le client attend que les paquets **serveur**
+suivants soient **chiffrés** ; on lui renvoie le `Challenge` en clair → il abandonne. Donc
+l'`EncryptionAck` seul ne suffit pas : il faut réellement **chiffrer la voie serveur** après
+l'ack (le mur crypto de fond, inchangé). Activer notre composant DTLS ne sert à rien tant que
+le client ne fait pas de handshake DTLS de son côté — piste à creuser : est-ce de l'**AES-GCM
+keyé par la PSK** (SetEncryptionData/EnableEncryption d'UE) plutôt que du DTLS-handshake ?
+
+**Bug serveur concret trouvé :** `UChannel.ConditionalCleanUp` (Prospect.Unreal, ~l.822) =
+`throw new NotImplementedException()` → **crash du tick** dès qu'un canal se ferme (bClose).
+À implémenter (indépendant du crypto).
+
+**Acquis réutilisables :** on passe le handshake + le Hello + l'EncryptionAck est accepté ;
+la PSK par user_id est branchée bout-en-bout (Vault → env → serveur). Le blocage net =
+chiffrement de la voie serveur post-ack.
+
+## MAJ (2026-07-16, nuit) — tentative AES-256-GCM keyé par la PSK
+
+Implémenté `AesGcmHandlerComponent` (`System.Security.Cryptography.AesGcm`, format
+`[IV 12o][ciphertext][tag 16o]`), activé après l'EncryptionAck (ack en clair → activation →
+Challenge chiffré). Corrigé aussi l'ordre du pipeline : **Incoming doit itérer en sens
+INVERSE d'Outgoing** (`PacketHandler.Incoming_Internal`) — sinon, avec 2 composants actifs
+(stateless + AES), le stateless tente de parser des octets chiffrés. (Les deux étaient en avant ;
+n'avait jamais compté car un seul composant actif jusqu'ici.)
+
+**Observé (test live) :** notre Challenge part bien chiffré (`[AES] Outgoing 30o→58o`), mais le
+client répond **toujours** par un **paquet plaintext de ~18 o** de structure constante
+(`…41 00 XX FF 5F 00 00 0C`) = un **`bClose` du canal de contrôle**, jamais rien qui ressemble
+à de l'AES (haute entropie ≥28o). **Le client ne chiffre jamais son côté.**
+
+**Conclusion :** quelle que soit notre réponse au `Hello` (challenge clair, chiffré AES, ou
+tentative DTLS), le client **ferme systématiquement le canal de contrôle en clair** juste après.
+L'AES-GCM tel qu'implémenté ne le fait pas basculer en chiffré. Pistes restantes (deep RE, non
+tranchées) : (a) framing AES-GCM exact d'UE (schéma d'IV/nonce, AAD, position) ≠ notre IV aléatoire
+préfixé ; (b) c'est bien du DTLS-handshake et le client attend un ServerHello DTLS ; (c) notre
+réponse au Hello est incomplète (ordre/contenu des NMT) indépendamment du chiffrement.
+Chaque test = ~4 min (CI + redeploy). Bugs serveur secondaires à corriger : `ConditionalCleanUp`
+(stub) + `ArgumentOutOfRangeException` quand on vide un paquet trop court.
+
+**Décision : checkpoint.** Tout est commité/documenté. La suite = RE netcode profonde multi-session ;
+et même résolue, ce n'est que le login — la simulation gameplay reste hors de portée réaliste.
+
+## Flux de chiffrement DTLS d'UE 4.27 (recherche, 2026-07-17)
+
+Sources : KB Epic « Enable Encryption via Packet Handler Components », doc API
+(EnableEncryptionServer/SetEncryptionData/FEncryptionData), UE-95508 (ack chiffré si
+renvoyé), UE-171638 (module DTLS exige OpenSSL), logs DTLS/PSK réels (Satisfactory #453).
+Le source du plugin DTLS est gated (points reconstruits signalés).
+
+**Corrections clés :**
+- **Le CLIENT envoie le ClientHello ; le serveur ATTEND (accept), ne parle jamais en premier.**
+  Donc l'AES-GCM autonome = impasse (c'est bien du DTLS, records `16 fe fd` standard OpenSSL).
+- **`NMT_EncryptionAck` ne porte AUCUNE clé.** À sa réception, le client appelle
+  `ReceivedNetworkEncryptionAck` → **résout lui-même** sa `FEncryptionData` (Key + Identifier)
+  → appelle **`EnableEncryption` côté client** → **c'est CE qui déclenche son ClientHello**.
+- **Séquence serveur** : `SetEncryptionData(Key,Identifier)` → `NMT_EncryptionAck` **en clair, sans
+  payload** → **puis** `EnableEncryption` (mode accept). Ne jamais chiffrer l'ack.
+- **Le `NMT_Challenge` doit être DIFFÉRÉ** : le handler DTLS met les bunches applicatifs en file
+  jusqu'à `Handshaking completed`. (Notre impl l'envoyait tout de suite → à corriger.)
+- **PSK** : PSK = `FEncryptionData.Key`, identité PSK = `FEncryptionData.Identifier` ; ressortie via
+  `DTLSPSKServerCallback` (hook OpenSSL) quand le ClientHello arrive. Le serveur n'envoie jamais la clé.
+- **Couches** : DTLS **sous** le stateless (entrée : retirer stateless puis déchiffrer DTLS ;
+  Outgoing forward / Incoming reverse).
+
+**Si le client ferme SANS ClientHello (notre cas)** → cause la plus probable = **échec de résolution
+de clé côté client** (le vrai client shipping attend peut-être la clé de SON backend/matchmaking,
+non émulé — ou dérivation/Identifier différents), pas notre framing DTLS. C'est potentiellement un
+mur dur (dépend du backend réel du client).
+
+**Test informé RÉALISÉ (2026-07-17)** : `EncryptionAck` seul (clair, sans payload) + DTLS **accept** +
+**PAS de Challenge**. **Résultat : le client n'envoie TOUJOURS pas de ClientHello** (zéro `16 fe fd`
+dans les datagrammes bruts) et ferme avec le `bClose` plaintext habituel.
+
+## VERDICT (mur confirmé) — résolution de clé CÔTÉ CLIENT
+
+Le blocage n'est **pas** notre framing serveur (DTLS ou AES) : le client **n'entame jamais son
+handshake DTLS**. Séquence définitive observée, quel que soit ce qu'on renvoie :
+`stateless OK → NMT_Hello (clair) → notre NMT_EncryptionAck → client ferme (bClose), pas de ClientHello`.
+
+D'après la recherche du flux UE : le ClientHello n'est émis que si le client, dans
+`ReceivedNetworkEncryptionAck`, **résout une `FEncryptionData` valide et appelle `EnableEncryption`
+côté client**. Ici il ne le fait pas → il ferme. On **ne peut pas forcer** ça depuis le serveur.
+
+Cause la plus probable : le vrai client shipping attend sa clé/identité **de SON backend**
+(réponse matchmaking/PlayFab), non émulée — ou une dérivation/`Identifier` qu'on ne fournit pas au
+bon endroit. La PSK a été récupérée (dump mémoire) mais ça ne suffit pas : c'est la **décision
+client d'activer le chiffrement** qui manque, et sa logique vit dans le binaire packé.
+
+**Pour aller plus loin il faudrait** : RE de la fonction `ReceivedNetworkEncryptionAck`/résolution de
+clé du client (dans le `.text` déchiffré, même méthode que pour la PSK) pour savoir **d'où** il attend
+sa clé, puis la lui fournir (probablement côté backend rd2). Chantier RE profond, incertain.
+
+**Statut : mur dur, checkpoint.** Acquis solides et réutilisables : handshake + Hello + EncryptionAck ;
+serveur DTLS-PSK ET AES-GCM implémentés ; ordre pipeline corrigé (Incoming inverse d'Outgoing) ;
+flux UE documenté. Le verrou restant dépend du client, pas du serveur.

README.md

@@ -1,119 +1,249 @@
-# Prospect
+# The Cycle: Frontier — serveur privé (émulateur Prospect)
 
-Also known as "The Cycle: Frontier".
+Émulateur des services en ligne de **The Cycle: Frontier** (jeu retiré de Steam en
+septembre 2022), permettant de rejouer en solo sur un serveur auto-hébergé.
+Fork de [`deiteris/Prospect`](https://github.com/deiteris/Prospect), figé sur le
+**Build 8 / client Saison 2**, buildé depuis les sources et déployé en conteneur via
+une CI Gitea.
 
-## Features
+> **Ce n'est pas du multijoueur.** Le raid tourne **côté client** (station solo) : chacun
+> joue sa propre instance. Le serveur partage la progression, les comptes et les boutiques,
+> pas la partie. Le vrai multi (squad en raid, voix de proximité) suppose un serveur de jeu
+> Unreal dédié — voir [Hors-périmètre & R&D](#hors-périmètre--rd).
 
-TBD
+---
 
-## Running locally
+## Sommaire
 
-> [!NOTE]
+- [Comment ça marche](#comment-ça-marche)
-> If you've already done all steps previously, you can skip to Step 7.
+- [Structure du dépôt](#structure-du-dépôt)
+- [Build & lancement du serveur](#build--lancement-du-serveur)
+- [Certificat TLS](#certificat-tls)
+- [CI/CD](#cicd)
+- [Config du client (switch de serveur + certificat)](#config-du-client-switch-de-serveur--certificat)
+- [État des fonctionnalités](#état-des-fonctionnalités)
+- [Hors-périmètre & R&D](#hors-périmètre--rd)
+- [Crédits & licence](#crédits--licence)
 
-### 1. Prerequisites
+---
 
-Before you start, you'll need the following software downloaded and installed:
+## Comment ça marche
 
-1. [MongoDB Community Edition](https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-8.0.4-signed.msi).
+Le client officiel parle à PlayFab. On l'intercepte côté client et on le redirige vers
+notre serveur, qui réimplémente juste ce qu'il faut de PlayFab (auth Steam, CloudScript,
+UserData/TitleData, matchmaking solo).
 
-1. [Latest `Prospect.Server.Api`](https://github.com/deiteris/Prospect/releases) from the Releases section
+```mermaid
+flowchart LR
+  subgraph client [Poste de jeu]
+    L[Prospect.Client.Loader<br/>injecte l'agent] --> A[Prospect.Agent<br/>hooke l'URL PlayFab]
+    A -- lit --> B[backend.txt]
+    A --> G[Jeu &#40;TCF&#41;]
+  end
+  G -- HTTPS / SignalR --> API[Prospect.Server.Api<br/>émulateur PlayFab]
+  API --> M[(MongoDB)]
+```
 
-1. [.NET Runtime 8](https://dotnet.microsoft.com/en-us/download/dotnet/thank-you/runtime-8.0.12-windows-x64-installer) installed.
+- **`Prospect.Client.Loader`** lance le jeu en injectant l'agent.
+- **`Prospect.Agent`** hooke l'URL de l'API PlayFab et la remplace par le contenu de
+  **`backend.txt`** (placé dans `Prospect/Binaries/Win64`). Absent → fallback
+  `https://127.0.0.1:8443`.
+- **`Prospect.Server.Api`** émule PlayFab (auth Steam → JWT, CloudScript, données joueur)
+  et pousse le temps-réel via **SignalR**. Les données vivent dans **MongoDB**.
 
-1. A compatible The Cycle: Frontier game client. The server works with:
+Toute la redirection du client tient donc dans **une seule valeur** (`backend.txt`) — gérée
+par l'outil [`Prospect.Client.Config`](#config-du-client-switch-de-serveur--certificat).
 
-   1. The latest version from [Steam](https://steamcommunity.com/app/868270).
+---
 
-   1. Season 2 client downloaded from SteamDB using a depot downloader. For example, [version 2.7.2](https://steamdb.info/depot/868271/history/?changeid=M:4623363103423775682).
+## Structure du dépôt
 
-### 1. Unpack `Prospect.Server.Api`
+| Projet | Rôle |
+|---|---|
+| **`Prospect.Server.Api`** | Cœur : émulateur PlayFab (ASP.NET 8). Controllers Client/CloudScript/Multiplayer, services Auth/UserData/TitleData/Database(Mongo)/Qos, hub SignalR. |
+| **`Prospect.Steam`** | Validation du ticket Steam (auth). |
+| **`Prospect.Client.Loader`** | Loader C++ : lance le jeu et injecte l'agent. |
+| **`Prospect.Agent`** | Agent C++ injecté : hooke l'URL PlayFab → `backend.txt`. |
+| **`Prospect.Client.Config`** | Utilitaire multi-OS : écrit `backend.txt`, importe le certificat, lance le jeu. Voir son [README](src/Prospect.Client.Config/README.md). |
+| **`Prospect.Server.Game`** | Serveur de jeu dédié (squelette, **R&D**). |
+| **`Prospect.Unreal[.Generator/.Tests]`** | Réimplémentation C# du netcode Unreal (**R&D** serveur dédié). |
+| `utils/` | `generate_ssl.py` — génération du certificat auto-signé. |
 
-Use your favorite ZIP archiver and unzip the `Prospect.Server.Api.zip` downloaded from this repository.
+Build config **`Season 2 Release`** obligatoire pour l'API (le code sélectionne la saison
+via `#if SEASON_2_RELEASE` / `SEASON_3_RELEASE` → sinon `#error Unsupported build type`).
 
-### 3. Patch hosts
+---
 
-To be able to connect to the locally running server, you must replace the IP address of `2EA46.playfabapi.com` that the game uses. Do the following:
+## Build & lancement du serveur
 
-1. Open Notepad as Administrator.
+Le serveur tourne en conteneur. L'image est buildée depuis les sources par le
+[`Dockerfile`](Dockerfile) (multi-stage SDK .NET 8 → runtime aspnet 8, publish en
+`Season 2 Release`).
 
-1. Click **File** > **Open...** and select `C:\Windows\System32\drivers\etc\hosts`.
+### Build de l'image
 
-1. At the end of the file, add `127.0.0.1 2EA46.playfabapi.com` on a new line.
+```bash
+docker build -t the-cycle .
+```
 
-### 4. Generate and import SSL certificate
+### Lancement
 
-> [!IMPORTANT]
+Il faut une **instance MongoDB** joignable et un **certificat TLS** monté (voir section
-> Do not share the generated certificate! Generated certificate includes a private key that may be used to generate other certificates and compromise your security.
+suivante). Variables d'environnement :
 
-A connection to the server is served over a secured connection. The server uses self-signed certificate that must be added to trusted authorities in order for the game
+| Variable | Rôle |
-to successfully communicate with the local server. Do the following:
+|---|---|
+| `DatabaseSettings__ConnectionString` | URI de connexion MongoDB. |
+| `DatabaseSettings__DatabaseName` | Base à utiliser (ex. `ProspectDb`). |
+| `AuthTokenSettings__Secret` | Secret de signature des JWT émis par le serveur. |
+| `PlayFabSettings__SignalRURL` | URL SignalR **telle que le client doit l'atteindre** (voir gotcha ci-dessous). |
+| `Kestrel__Certificates__Default__Path` | Chemin du `.pfx` dans le conteneur. |
+| `Kestrel__Endpoints__Https__Url` | ex. `https://0.0.0.0:8443`. |
+| `SteamWebApiKey` | *(optionnel)* clé Steam Web API pour récupérer les pseudos ; inerte si absente. |
 
-1. Open the folder with `Prospect.Server.Api`.
+```bash
+docker run -d --name the-cycle-api \
+  -e DatabaseSettings__ConnectionString="mongodb://user:pass@HOST:27017/?authSource=ProspectDb" \
+  -e DatabaseSettings__DatabaseName="ProspectDb" \
+  -e AuthTokenSettings__Secret="<secret>" \
+  -e PlayFabSettings__SignalRURL="https://<host-public>:8443/signalr/?hub=pubsub" \
+  -e Kestrel__Endpoints__Https__Url="https://0.0.0.0:8443" \
+  -e Kestrel__Certificates__Default__Path="/certs/certificate.pfx" \
+  -v "$PWD/certs:/certs:ro" \
+  -p 8443:8443 \
+  the-cycle
+```
 
-1. Double-click `generate_ssl.exe`. `certificate.pfx` will appear in the same folder.
+> ⚠️ **`PlayFabSettings__SignalRURL` = l'URL que le CLIENT doit joindre**, pas `127.0.0.1`.
+> Le serveur y renvoie le client pour l'event de matchmaking ; s'il pointe sur `127.0.0.1`,
+> le déploiement en raid **timeout**. Mets le hostname/IP public du serveur.
 
-1. Double-click `certificate.pfx`. The Certificate Import Wizard will open:
+### Dev local (.NET)
 
-    1. Select **Current User** under Store Location and click **Next**.
+```bash
+dotnet build src/Prospect.Server.Api/Prospect.Server.Api.csproj -c "Season 2 Release"
+dotnet run  --project src/Prospect.Server.Api -c "Season 2 Release"
+```
 
-    1. Leave **File to Import** unchanged and click **Next**.
+---
 
-    1. Leave **Password** empty and click **Next**.
+## Certificat TLS
 
-    1. Select **Place all certificates in the following store** > **Browse...**. Choose **Trusted Root Certification Authorities** and click **OK**. Click **Next**.
+La connexion est en HTTPS et le client valide le certificat → il doit être **auto-signé et
+fait confiance** côté client. Générer le `.pfx` avec `utils/generate_ssl.py`.
 
-    1. Click **Finish**. A Security Warning popup may appear, make sure it specifies `2EA46.playfabapi.com` certification authority and click **Yes**.
+> ⚠️ **Le SAN doit contenir `DNS:<ip>` ET `IP:<ip>`**, en plus des hostnames.
+> Le HTTP du jeu (libcurl) accepte l'IP en SAN IP, mais le WebSocket (libwebsockets) valide
+> l'IP contre les SAN **DNS** → sans `DNS:<ip>`, la connexion SignalR échoue
+> (`Hostname mismatch err=62`). Inclure aussi `2EA46.playfabapi.com`, `localhost`,
+> `127.0.0.1` et tous les hostnames publics utilisés dans `backend.txt`.
 
-### 5. Add `steam_appid.txt` to the game
+Côté client, l'import du certificat est automatisé par
+[`Prospect.Client.Config`](#config-du-client-switch-de-serveur--certificat).
 
-1. Open the folder with The Cycle: Frontier and navigate to **Prospect** > **Binaries** > **Win64**.
+---
 
-1. Right-click in the folder > **New** > **Text Document**, and name it `steam_appid.txt`.
+## CI/CD
 
-1. Open `steam_appid.txt` and enter `480`.
+[`.gitea/workflows/build.yml`](.gitea/workflows/build.yml) — sur push `main` / `preprod`
+(ou `workflow_dispatch`) :
 
-1. Save and close the file.
+1. build de l'image depuis le `Dockerfile` ;
+2. push sur le registry `git.nfteam.ovh/neckfire/the-cycle` ;
+3. notification du résultat (ntfy).
 
-### 6. Create a game shortcut with
+**Modèle de branches :**
 
-1. Open the folder with The Cycle: Frontier and navigate to **Prospect** > **Binaries** > **Win64**.
+| Branche | Tag image | Usage |
+|---|---|---|
+| `preprod` | `:preprod` (+ `:preprod-<sha>`) | banc de test — valider un build avant de merger |
+| `main` | `:latest` (+ `:<sha>`) | production |
 
-1. Right-click `Prospect-Win64-Shipping.exe` > **Create Shortcut**.
+Workflow type : coder → push `preprod` → tester sur le serveur preprod → **PR `preprod → main`**
+→ la CI republie `:latest`. Le déploiement applique la nouvelle image
+(`docker compose pull && docker compose up -d`).
 
-1. Right-click the created shortcut > **Properties**.
+> `Prospect.Client.Config` (outil client, cross-OS) n'est **pas** buildé par cette CI —
+> voir sa section publication.
 
-1. In the **Target** field, add the following parameters after the quote ` -empty -server -log -windowed -noeac -nointro -steam_auth PF_TITLEID=2EA46`. Note the space after the quote.
+---
 
-1. Move the shortcut to desktop.
+## Config du client (switch de serveur + certificat)
 
-### 7. Run the server
+L'outil **`Prospect.Client.Config`** (binaire `ProspectServerSwitcher`, multi-OS
+Linux/Proton + Windows) fait tout le boulot côté client :
 
-Now you are all set! Open the folder with `Prospect.Server.Api` and run `Prospect.Server.Api.exe`.
+- écrit `backend.txt` (presets **prod** / **preprod** ou URL libre) ;
+- récupère le certificat **en direct depuis le serveur ciblé** (TLS) et le rend fiable :
+  - **Windows** : import dans *Autorités de certification racines de confiance* (utilisateur) ;
+  - **Linux/Proton** : import direct dans le préfixe Wine du jeu via `wine reg import`
+    (car `wine certutil` est cassé sous Proton) ;
+- lance le jeu.
 
-### 8. Run the game
+```bash
+# menu interactif
+ProspectServerSwitcher
 
-Once the server is running, open The Cycle: Frontier using the shortcut you've created before.
+# scriptable
+ProspectServerSwitcher --folder "<...>/Prospect/Binaries/Win64" --set preprod
+ProspectServerSwitcher --set https://mon-serveur:8443
+```
 
-### Troubleshooting and FAQ
+Détails complets, gotchas Proton (préfixe non-Steam) et commandes de publication des
+binaires autonomes : **[src/Prospect.Client.Config/README.md](src/Prospect.Client.Config/README.md)**.
 
-#### How to remove the certificate?
+> Installation complète pas-à-pas pour un nouveau joueur (télécharger le client S2, le
+> LoaderPack, importer le certificat) : **[FRIENDS-INSTALL.md](FRIENDS-INSTALL.md)**.
 
-If you've installed the certificate for the **Current User**:
+---
 
-1. Open **Start** and enter `certmgr.msc`.
+## État des fonctionnalités
 
-1. Expand **Trusted Root Certification Authorities** and select **Certificates**.
+**Fonctionne :**
 
-1. Find `2EA46.playfabapi.com`, right-click it > **Delete**.
+- [x] Login Steam, EULA, tutoriel
+- [x] Station solo (S2/S3) : onboarding, matchmaking & déploiement **solo**
+- [x] Inventaire & loadout, stash, vente, réparation
+- [x] Contrats / quêtes — y compris les objectifs **kills** et **de zone** (auto-crédités :
+      pas de serveur dédié pour remonter les events runtime du raid client-hosted)
+- [x] Progression des factions
+- [x] Season pass : claim + gain d'XP de saison (niveau Fortuna)
+- [x] Boutiques d'items (Korolev / ICA / Osiris / QuickShop / CraftingStation)
+- [x] Aurum Shop (cosmétiques) + rotation daily/weekly
+- [x] Craft, Quarters, solde joueur, connexion quotidienne
+- [x] Apparence & emotes
+- [x] Assurance : débit de la prime au déploiement + payout à la mort
+- [x] Stats de carrière (valeurs à 0 — non traçables sans serveur de jeu)
+- [x] Présence des amis (en ligne / en raid)
+- [x] Pseudos réels via Steam Web API (le client n'envoie que le SteamID)
+- [x] Cartes : Bright Sands, Crescent Falls, Tharis Island
 
-If you've installed the certificate for the **Local Machine**, repeat the same steps but instead open `certlm.msc`.
+**Non implémenté / hors-périmètre :**
 
-#### `generate_ssl.exe` is flagged as a virus
+- [ ] Squad / multi dans le **même** raid — nécessite un serveur de jeu dédié
+- [ ] Voix de proximité (login/join Vivox = placeholders)
+- [ ] Free loadouts & presets (Saison 3 uniquement)
+- [ ] Achat de cosmétiques (endpoint d'achat vanity distinct, non câblé)
+- [ ] Catalogue des récompenses Fortuna (DataTable côté client, dans des paks chiffrés)
+- [ ] Défis quotidiens Fortuna
 
-`generate_ssl.exe` is a Python application packed with PyInstaller and some anti-viruses may flag it as a virus.
+---
-This application is a simple certificate generator and you can find its source code in `utils/generate_ssl.py`.
 
-## Development
+## Hors-périmètre & R&D
 
-TBD
+Un **serveur de jeu Unreal dédié** (`Prospect.Server.Game` + `Prospect.Unreal`, branche
+`game-server`) est en cours de reverse-engineering pour, à terme, permettre le vrai multi.
+État : handshake stateless UE, séquençage et décodage des bunches **franchis**, canal de
+contrôle ouvert, `NMT_Hello` parsé. **Bloqué** sur le chiffrement **DTLS-PSK** du client
+(clé dérivée du `user_id`), derrière un exe packé (BattlEye) → la dérivation n'est pas
+extractible statiquement. Détails dans `NETCODE-RND.md` (branche `game-server`).
+
+Le « lobby squad » via l'API seule n'est **pas faisable** : l'invitation d'amis est gérée
+100 % côté client Steam.
+
+---
+
+## Crédits & licence
+
+Fork de [`deiteris/Prospect`](https://github.com/deiteris/Prospect) (lui-même issu du
+projet Prospect original). Voir [`LICENSE`](LICENSE). Usage privé.

SQUAD-EMULATION.md

@@ -0,0 +1,103 @@
+# Étude — Émulation PlayFab Groups/Party pour l'invite de squad
+
+> Objectif : permettre à un joueur d'**inviter un ami** à faire équipe (squad) sur le serveur
+> privé. Étude du mécanisme, de l'état actuel, d'une conception d'émulation et d'un plan.
+> Branche : `game-server`.
+
+## 1. État actuel (ce qui existe déjà)
+
+**Roster de squad en mémoire** — `Services/Squad/SquadService.cs` :
+- Squads clés par un **`squadId` fourni par le client** (`JoinOrCreate(squadId, userId, …)`).
+- Membre = profil (playerId, displayName), `onlineState`, `isReady`, `selectedMap`, `isLeader`.
+- `_userToSquad` permet à `TryGetCompleteSquadInfo` (qui ne porte pas de squadId) de retrouver la squad du joueur.
+
+**Fonctions CloudScript squad présentes** : `TryGetCompleteSquadInfo`, `SquadMemberReadyForMatch`
+(pousse déjà via SignalR), `SquadMemberSelectedMap`, `SquadMemberStartingDeployFlow`,
+`GetFriendList`, `ClientsideFriendsImport`.
+
+**Ce qui MANQUE** (cœur du problème) : aucune fonction de **création de squad**, d'**invitation**,
+d'**acceptation/refus**, de **join/leave/kick**. Le flux actuel suppose que le client **connaît déjà
+un `squadId`** (party formée ailleurs) et se contente d'y rattacher les membres.
+
+**Infra de push temps-réel DISPONIBLE** — `Hubs/CycleHub.cs` + `Hubs/SignalRConnectionRegistry.cs` :
+le client se connecte au hub avec `?uid=<playerId>` ; le registry mappe `uid → connectionId`. Le
+serveur peut donc **pousser un message ciblé** à un joueur précis (`registry.GetConnection(uid)` +
+`IHubContext<CycleHub>.Clients.Client(conn).SendAsync(<event>, payload)`). C'est déjà utilisé par
+`SquadMemberReadyForMatch` et par le signal « travel to match » du matchmaking. **→ Le canal de
+livraison de l'invite existe déjà.**
+
+## 2. Comment The Cycle forme-t-il les squads ? (hypothèses + preuves)
+
+Le `squadId` étant **fourni par le client**, la party est créée là où le client obtient cet id.
+Quatre mécanismes candidats côté PlayFab/Steam :
+
+| # | Mécanisme | Ce que ça implique côté serveur | Indice |
+|---|---|---|---|
+| A | **PlayFab Entity Groups** (`/Group/CreateGroup`, `/Group/InviteToGroup`, `/Group/AcceptGroupInvitation`, `/Group/ListGroupMembers`…) | Implémenter le sous-ensemble Groups (entités déjà émulées). `squadId` = group entity id. | Fort : squads persistantes chez PlayFab passent par Groups ; l'id opaque partagé colle. |
+| B | **PlayFab Lobby** (Multiplayer : `CreateLobby`/`JoinLobby`/`InviteToLobby` via connection string) | Implémenter l'API Lobby. `squadId` = lobbyId. | Moyen : plutôt matchmaking S3+. |
+| C | **Lobby Steam** (invite via overlay Steam) + backend qui suit | Rien à créer pour l'invite (100% Steam) ; le serveur ne fait que suivre le `squadId` rapporté. | Moyen : S2 = Steam-only ; explique le `squadId` client. Mais alors l'invite n'est pas pilotable serveur. |
+| D | **Fonctions CloudScript d'invite** (non observées) | Implémenter `InvitePlayerToSquad`/`RespondToSquadInvite`/… | Faible : aucune trace. |
+
+**Preuve manquante (bloquant)** : les logs prod de la session à 2 ont été **écrasés** par nos
+redéploiements. Impossible aujourd'hui de voir l'appel exact d'invite. De plus, l'émulateur peut
+**404 silencieusement** un endpoint PlayFab natif non routé (ex. `/Group/CreateGroup`) → un tel
+appel n'apparaît pas comme fonction CloudScript. **Il faut donc capturer l'appel réel** (voir §5,
+Phase 0) — d'autant que le **bouton « inviter » n'apparaît pas tant que la tuile ami est vide**
+(bug de forme `GetFriendList`, corrigé PR #15, à valider en jeu). Tant que la liste d'amis ne
+s'affiche pas, aucune invite ne peut même être tentée.
+
+## 3. Conception d'émulation proposée (indépendante du mécanisme exact)
+
+Quel que soit A/B/C/D, les briques serveur à construire sont les mêmes :
+
+**3.1 Étendre `SquadService`** (états d'invite) :
+- `CreateSquad(leaderUserId) → squadId` (GUID serveur si le client n'en impose pas).
+- `Invite(squadId, fromUserId, toUserId)` → enregistre une **invitation en attente** `{squadId, from, to, expiresAt}`.
+- `RespondToInvite(toUserId, squadId, accept)` → si accept : `JoinOrCreate` ; sinon purge.
+- `Leave` / `Kick(byLeader)` / transfert de leadership à la sortie du leader.
+- `GetPendingInvites(userId)` (fallback poll).
+
+**3.2 Surface d'API** — deux options selon la capture (§5) :
+- **Si Groups (A)** : router `POST /Group/CreateGroup`, `/Group/InviteToGroup`,
+  `/Group/AcceptGroupInvitation`, `/Group/ListGroupMembers`, `/Group/RemoveMembers` vers
+  `SquadService` (les EntityToken sont déjà émulés). C'est le plus « natif ».
+- **Si CloudScript (D) / custom** : ajouter les fonctions `[CloudScriptFunction(...)]`
+  correspondantes (noms/shapes calqués sur la capture).
+- **Si Steam (C)** : rien pour l'invite (Steam) ; s'assurer seulement que le roster se peuple bien
+  quand les deux clients rapportent le même `squadId` (déjà géré par `SquadService`).
+
+**3.3 Livraison temps-réel de l'invite** (réutilise l'infra existante) :
+- À l'invitation, pousser à l'invité : `registry.GetConnection(toUserId)` +
+  `hub.Clients.Client(conn).SendAsync("<SquadInviteReceived>", payload)`.
+- **Nom d'event + payload = à confirmer côté client** (le client doit écouter cet event). Fallback :
+  `GetPendingSquadInvites` (CloudScript) que le client poll à l'ouverture du menu social.
+
+**3.4 Persistance** : le roster peut rester en mémoire (petit serveur), mais les invitations
+gagnent à être **persistées** (UserData `PendingSquadInvites`) pour survivre à un reload/redeploy et
+au cas « ami à la station » — combiné au push SignalR.
+
+## 4. Limite structurelle importante (à dire clairement)
+
+Émuler l'invite permet de **former une squad et de se mettre prêt** ensemble (lobby/ready-up).
+Mais **déployer réellement ensemble dans le même raid** nécessite le **serveur de jeu dédié**
+(`Prospect.Server.Game`), qui est bloqué au mur **DTLS-PSK** (cf. reste de cette branche). Les raids
+S2 sont **hébergés côté client** (solo) : sans serveur dédié, deux joueurs ne peuvent pas partager
+la même instance de raid. Donc :
+- **Invite + squad + ready-up** : émulable via l'API (cette étude).
+- **Co-op en raid** : dépend du serveur dédié (autre chantier, DTLS-PSK).
+
+## 5. Plan par phases
+
+- **Phase 0 — Capture (débloque tout)** : valider le fix `GetFriendList` en jeu (la tuile ami doit
+  afficher le pseudo) → le bouton « inviter » réapparaît → tenter une invite et **capturer les
+  appels** (ajouter un logging *catch-all* des requêtes non routées + corps, pour voir un éventuel
+  `/Group/…` 404). Résultat : on sait A/B/C/D.
+- **Phase 1 — Invite** : implémenter la surface identifiée + états `SquadService` + push SignalR ;
+  persister les invitations.
+- **Phase 2 — Ready-up/déploiement groupé** : compléter (déjà amorcé) ; le déploiement co-op réel
+  reste gated par le serveur dédié.
+
+## 6. Prochaine action concrète
+Repro en jeu (liste d'amis corrigée) + logging catch-all → capturer l'appel d'invite. Sans cette
+capture, toute implémentation d'invite serait une supposition sur les noms/shapes attendus par le
+client (paks chiffrés → pas de RE statique).

src/Prospect.Agent/Prospect.Agent.vcxproj

@@ -45,13 +45,13 @@
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <LinkIncremental>true</LinkIncremental>
-    <OutDir>$(ProjectDir)..\Prospect.Launcher\</OutDir>
+    <OutDir>$(ProjectDir)bin\$(Platform)\$(Configuration)\</OutDir>
     <IntDir>$(ProjectDir)bin\intermediate\$(Platform)\$(Configuration)\</IntDir>
     <LibraryPath>$(LibraryPath)</LibraryPath>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(ProjectDir)..\Prospect.Launcher\</OutDir>
+    <OutDir>$(ProjectDir)bin\$(Platform)\$(Configuration)\</OutDir>
     <IntDir>$(ProjectDir)bin\intermediate\$(Platform)\$(Configuration)\</IntDir>
     <LibraryPath>$(LibraryPath)</LibraryPath>
   </PropertyGroup>

src/Prospect.Agent/main.cpp

@@ -5,19 +5,40 @@
 #include "logger.h"
 #include "SDK.h"
 #include "SDK_Memory.h"
+#include <string>
+#include <fstream>
+#include <sstream>
+#include <algorithm>
+#include <cctype>
+#include <locale>
 
-// Pointers are for 211025.1143
+std::wstring g_backendUrl;
-// https://steamdb.info/depot/1600361/history/?changeid=M:720055916602660127
 
-/**
+// trim from start (in place)
- * Variable offset, find with "STOPMOVIECAPTURE", scroll up.
+inline void ltrim(std::wstring &s) {
- */
+    s.erase(s.begin(), std::find_if(s.begin(), s.end(), [](unsigned char ch) {
-constexpr uintptr_t OffsetGMalloc = 0x5C9D478;
+        return !std::isspace(ch);
+    }));
+}
+
+// trim from end (in place)
+inline void rtrim(std::wstring &s) {
+    s.erase(std::find_if(s.rbegin(), s.rend(), [](unsigned char ch) {
+        return !std::isspace(ch);
+    }).base(), s.end());
+}
+
+inline void trim(std::wstring &s) {
+    rtrim(s);
+    ltrim(s);
+}
+
+constexpr uintptr_t OffsetGMalloc = 0x63EC4A0;
 
 /**
  * Function offset, find with "?sdk=".
  */
-constexpr uintptr_t OffsetPlayFabApiGetUrl = 0xCA5010;
+constexpr uintptr_t OffsetPlayFabApiGetUrl = 0xCEEF00;
 
 /**
  * Function hooks.
@@ -26,15 +47,18 @@ typedef SDK::FString(__fastcall* tPlayFabApiGetUrl)(SDK::UPlayFabAPISettings*, c
 
 tPlayFabApiGetUrl OldPlayFabApiGetUrl;
 
-SDK::FString __fastcall PlayFabApiGetUrlProxy(SDK::UPlayFabAPISettings* thiz, const SDK::FString& callPath)
+SDK::FString __fastcall PlayFabApiGetUrlProxy(SDK::UPlayFabAPISettings* thiz, const SDK::FString& callPath) {
-{
     logger::Print("[Agent] GetURL called with callPath %s\n", callPath.ToString().c_str());
 
-	return std::wstring(L"http://127.0.0.1:5000") + std::wstring(callPath.c_str());
+    if (!g_backendUrl.empty())
+    {
+        return g_backendUrl + std::wstring(callPath.c_str());
+    }
+
+    return std::wstring(L"https://127.0.0.1:8443") + std::wstring(callPath.c_str());
 }
 
-DWORD WINAPI OnDllAttach(LPVOID base)
+DWORD WINAPI OnDllAttach(LPVOID base) {
-{
 	logger::Print("[Agent] DLL Attached\n");
 
 	const auto hModule = GetModuleHandleW(nullptr);
@@ -44,8 +68,7 @@ DWORD WINAPI OnDllAttach(LPVOID base)
 	SDK::GMalloc = reinterpret_cast<SDK::FMalloc**>(hModulePtr + OffsetGMalloc);
 
 	// Initialize MinHook.
-	if (MH_Initialize() != MH_OK)
+	if (MH_Initialize() != MH_OK) {
-	{
 		logger::Print("[Agent] Failed to initialize MinHook\n");
 		FreeLibraryAndExitThread(hModule, 1);
 	}
@@ -55,18 +78,33 @@ DWORD WINAPI OnDllAttach(LPVOID base)
 	const auto ppOriginal = reinterpret_cast<LPVOID*>(&OldPlayFabApiGetUrl);
 	const auto mhStatus = MH_CreateHook(pTarget, &PlayFabApiGetUrlProxy, ppOriginal);
 
-	if (mhStatus != MH_OK)
+	if (mhStatus != MH_OK) {
-	{
 		logger::Print("[Agent] Failed to create PlayFabAPIGetUrl hook (%d)\n", mhStatus);
 		FreeLibraryAndExitThread(hModule, 1);
 	}
 
-	if (MH_EnableHook(pTarget) != MH_OK)
+	if (MH_EnableHook(pTarget) != MH_OK) {
-	{
 		logger::Print("[Agent] Failed to enable PlayFabAPIGetUrl hook\n");
 		FreeLibraryAndExitThread(hModule, 1);
 	}
 
+	const wchar_t* filePath = L"backend.txt";
+	std::wifstream f(filePath);
+	if (f) {
+		std::wstringstream buffer;
+		buffer << f.rdbuf();
+		g_backendUrl = buffer.str();
+		trim(g_backendUrl);
+		if (g_backendUrl.rfind(L"https://", 0) != 0) {
+			logger::Print("[Agent] URL must start with https://\n");
+			g_backendUrl.clear();
+		} else {
+			logger::Print("[Agent] Loaded custom URL: %S\n", g_backendUrl.c_str());
+		}
+	} else {
+		logger::Print("[Agent] Failed to open file: %S\n", filePath);
+	}
+
 	logger::Print("[Agent] DLL Initialized\n");
 	ExitThread(1);
 }
@@ -75,10 +113,8 @@ BOOL WINAPI DllMain(
     const _In_      HINSTANCE hinstDll,
     const _In_      DWORD     fdwReason,
     const _In_opt_  LPVOID    lpvReserved
-)
+) {
-{
+	if (fdwReason == DLL_PROCESS_ATTACH) {
-	if (fdwReason == DLL_PROCESS_ATTACH)
-	{
 		DisableThreadLibraryCalls(hinstDll);
 
 		// Allocate a console.
@@ -90,9 +126,7 @@ BOOL WINAPI DllMain(
 
 		// Spawn thread.
 		CreateThread(nullptr, 0, OnDllAttach, hinstDll, 0, nullptr);
-	}
+	} else if (fdwReason == DLL_PROCESS_DETACH) {
-	else if (fdwReason == DLL_PROCESS_DETACH)
-	{
 		// Detach logger.
 		logger::Detach();
 	}

src/Prospect.Client.Config/Program.cs

@@ -0,0 +1,404 @@
+using System.Diagnostics;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using System.Text.Json;
+
+namespace Prospect.Client.Config;
+
+// Cross-platform (Linux/Proton + Windows) helper to point a The Cycle: Frontier client at a
+// server. The Prospect agent reads the target PlayFab URL from `backend.txt` next to the game
+// executable, so switching servers = writing that one file. This tool also imports the server
+// certificate and launches the game (natively on Windows, guided on Linux/Proton).
+internal static class Program
+{
+    private const string AppId = "868270";
+
+    // Presets use the public domains so the same target works for everyone (LAN or internet):
+    // DNS resolves to the public IP for friends, and the unified TLS cert covers both hostnames.
+    // On the same LAN, add a hosts entry (domain -> 192.168.1.136) to avoid hairpin NAT.
+    private static readonly (string Key, string Label, string Url)[] Presets =
+    {
+        ("prod",    "PROD",    "https://tc.nfteam.ovh:8443"),
+        ("preprod", "PREPROD", "https://rd-tc.nfteam.ovh:8444"),
+    };
+
+    private static string SettingsPath => Path.Combine(
+        Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
+        "ProspectSwitcher", "settings.json");
+
+    private static Settings _settings = new();
+
+    private static int Main(string[] args)
+    {
+        try { Console.OutputEncoding = Encoding.UTF8; } catch { /* some terminals reject it */ }
+        LoadSettings();
+        return args.Length > 0 ? RunCli(args) : MenuLoop();
+    }
+
+    // ---- Scriptable CLI ----------------------------------------------------
+    private static int RunCli(string[] args)
+    {
+        string? folder = null, target = null;
+        for (var i = 0; i < args.Length; i++)
+        {
+            switch (args[i])
+            {
+                case "--folder" when i + 1 < args.Length: folder = args[++i]; break;
+                case "--set" when i + 1 < args.Length: target = args[++i]; break;
+                case "-h" or "--help": PrintCliHelp(); return 0;
+            }
+        }
+        if (folder != null) { _settings.GameFolder = folder; SaveSettings(); }
+        if (target == null) { PrintCliHelp(); return folder != null ? 0 : 1; }
+        var url = ResolveTarget(target);
+        if (url == null) { Console.Error.WriteLine("Cible inconnue : " + target); return 1; }
+        return WriteBackend(url) ? 0 : 1;
+    }
+
+    private static void PrintCliHelp()
+    {
+        Console.WriteLine("ProspectServerSwitcher — sélecteur de serveur The Cycle (multi-OS)");
+        Console.WriteLine();
+        Console.WriteLine("  (sans argument)            menu interactif");
+        Console.WriteLine("  --folder <chemin Win64>    définit le dossier du jeu (mémorisé)");
+        Console.WriteLine("  --set <cible>              écrit backend.txt");
+        Console.WriteLine();
+        Console.WriteLine("Cibles : " + string.Join(", ", Presets.Select(p => p.Key)) + ", ou une URL https://…");
+        Console.WriteLine("Ex : ProspectServerSwitcher --folder \"…/Prospect/Binaries/Win64\" --set preprod-lan");
+    }
+
+    private static string? ResolveTarget(string t)
+    {
+        foreach (var p in Presets)
+            if (string.Equals(p.Key, t, StringComparison.OrdinalIgnoreCase)) return p.Url;
+        if (t.StartsWith("http", StringComparison.OrdinalIgnoreCase)) return t;
+        return null;
+    }
+
+    // ---- Interactive menu --------------------------------------------------
+    private static int MenuLoop()
+    {
+        while (true)
+        {
+            Console.WriteLine();
+            Console.WriteLine("=== The Cycle — Sélecteur de serveur ===");
+            Console.WriteLine("Dossier du jeu : " + (string.IsNullOrEmpty(_settings.GameFolder) ? "(non défini)" : _settings.GameFolder));
+            Console.WriteLine("backend.txt    : " + ReadCurrentBackend());
+            Console.WriteLine();
+            Console.WriteLine("  1) Définir le dossier du jeu (Win64)");
+            for (var i = 0; i < Presets.Length; i++)
+                Console.WriteLine($"  {i + 2}) {Presets[i].Label,-24} {Presets[i].Url}");
+            var n = Presets.Length + 2;
+            Console.WriteLine($"  {n}) Serveur personnalisé…");
+            Console.WriteLine($"  {n + 1}) Importer un certificat…");
+            Console.WriteLine($"  {n + 2}) Lancer le jeu");
+            Console.WriteLine("  0) Quitter");
+            Console.Write("> ");
+
+            var raw = Console.ReadLine()?.Trim();
+            if (raw is null or "0") return 0;
+            if (!int.TryParse(raw, out var choice)) { Console.WriteLine("Choix invalide."); continue; }
+
+            if (choice == 1) SetFolder();
+            else if (choice >= 2 && choice < n) WriteBackend(Presets[choice - 2].Url);
+            else if (choice == n) SetCustom();
+            else if (choice == n + 1) ImportCert();
+            else if (choice == n + 2) LaunchGame();
+            else Console.WriteLine("Choix invalide.");
+        }
+    }
+
+    private static void SetFolder()
+    {
+        Console.Write("Chemin du dossier Win64 : ");
+        var p = Console.ReadLine()?.Trim().Trim('"');
+        if (string.IsNullOrEmpty(p)) return;
+        if (!Directory.Exists(p)) { Console.WriteLine("⚠ Dossier introuvable."); return; }
+        _settings.GameFolder = p;
+        SaveSettings();
+        Console.WriteLine("✔ Dossier mémorisé.");
+    }
+
+    private static void SetCustom()
+    {
+        Console.Write("URL du serveur (ex : https://mon-serveur:8443) : ");
+        var u = Console.ReadLine()?.Trim();
+        if (!string.IsNullOrWhiteSpace(u)) WriteBackend(u);
+    }
+
+    // ---- backend.txt -------------------------------------------------------
+    private static bool WriteBackend(string url)
+    {
+        if (!EnsureFolder(out var dir)) return false;
+        try
+        {
+            // No trailing newline: the agent reads the raw file and requires it to start with https://.
+            File.WriteAllText(Path.Combine(dir, "backend.txt"), url, new UTF8Encoding(false));
+            Console.WriteLine($"✔ backend.txt → {url}");
+            Console.WriteLine("  (relance le jeu : backend.txt n'est lu qu'au démarrage du loader.)");
+            return true;
+        }
+        catch (Exception ex) { Console.WriteLine("✖ " + ex.Message); return false; }
+    }
+
+    private static string ReadCurrentBackend()
+    {
+        if (string.IsNullOrEmpty(_settings.GameFolder)) return "(dossier non défini)";
+        var f = Path.Combine(_settings.GameFolder, "backend.txt");
+        try
+        {
+            if (!File.Exists(f)) return "(absent)";
+            var v = File.ReadAllText(f).Trim();
+            var match = Presets.FirstOrDefault(p => p.Url == v);
+            return match.Key != null ? $"{v}  [{match.Label.Trim()}]" : v;
+        }
+        catch { return "(illisible)"; }
+    }
+
+    // ---- Certificate -------------------------------------------------------
+    private static void ImportCert()
+    {
+        // Prefer fetching the cert live from the server the client points at (backend.txt), so
+        // it's always the current one; fall back to a .crt file.
+        X509Certificate2? cert = null;
+        var target = ReadBackendUrl();
+        if (target != null && TryFetchServerCert(target, out cert))
+            Console.WriteLine($"Certificat récupéré depuis {target}");
+        else
+        {
+            Console.Write("Chemin d'un certificat (.crt) : ");
+            var p = Console.ReadLine()?.Trim().Trim('"');
+            if (string.IsNullOrEmpty(p) || !File.Exists(p)) { Console.WriteLine("⚠ Annulé."); return; }
+            try { cert = new X509Certificate2(p); } catch (Exception ex) { Console.WriteLine("✖ " + ex.Message); return; }
+        }
+        if (cert == null) { Console.WriteLine("⚠ Aucun certificat."); return; }
+        Console.WriteLine($"  empreinte : {cert.Thumbprint}");
+
+        if (OperatingSystem.IsWindows()) ImportCertWindows(cert);
+        else ImportCertProton(cert);
+    }
+
+    private static string? ReadBackendUrl()
+    {
+        if (string.IsNullOrEmpty(_settings.GameFolder)) return null;
+        var f = Path.Combine(_settings.GameFolder, "backend.txt");
+        try { return File.Exists(f) ? File.ReadAllText(f).Trim() : null; } catch { return null; }
+    }
+
+    private static bool TryFetchServerCert(string url, out X509Certificate2? cert)
+    {
+        cert = null;
+        try
+        {
+            var uri = new Uri(url);
+            using var tcp = new System.Net.Sockets.TcpClient();
+            tcp.Connect(uri.Host, uri.Port <= 0 ? 443 : uri.Port);
+            X509Certificate2? captured = null;
+            using var ssl = new System.Net.Security.SslStream(tcp.GetStream(), false,
+                (_, c, _, _) => { if (c != null) captured = new X509Certificate2(c.Export(X509ContentType.Cert)); return true; });
+            ssl.AuthenticateAsClient(uri.Host);
+            cert = captured;
+            return cert != null;
+        }
+        catch { return false; }
+    }
+
+    [System.Runtime.Versioning.SupportedOSPlatform("windows")]
+    private static void ImportCertWindows(X509Certificate2 cert)
+    {
+        try
+        {
+            using var store = new X509Store(StoreName.Root, StoreLocation.CurrentUser);
+            store.Open(OpenFlags.ReadWrite);
+            store.Add(cert);
+            Console.WriteLine("✔ Certificat importé (Autorités racines de confiance, utilisateur).");
+        }
+        catch (Exception ex) { Console.WriteLine("✖ Import : " + ex.Message); }
+    }
+
+    // Trust the cert inside the game's Proton/Wine prefix by writing the serialized cert blob
+    // into the prefix Root store via `wine reg import` (the wine `certutil` tool is unreliable
+    // under Proton). The prefix is chosen explicitly, so it works even though the client runs
+    // as a non-Steam shortcut (whose appid isn't the game's 868270).
+    private static void ImportCertProton(X509Certificate2 cert)
+    {
+        var wine = FindProtonWine();
+        if (wine == null) { Console.WriteLine("⚠ Aucun wine Proton trouvé (Steam/Proton installé ?)."); return; }
+        var prefix = SelectPrefix();
+        if (prefix == null) return;
+
+        // Wine serialized cert blob: SHA1-hash property (id 3) + encoded cert property (id 0x20).
+        var der = cert.RawData;
+        var sha1 = cert.GetCertHash();
+        byte[] blob;
+        using (var ms = new MemoryStream())
+        {
+            void Prop(uint id, byte[] data)
+            {
+                ms.Write(BitConverter.GetBytes(id));
+                ms.Write(BitConverter.GetBytes(1u));
+                ms.Write(BitConverter.GetBytes((uint)data.Length));
+                ms.Write(data);
+            }
+            Prop(3, sha1);
+            Prop(0x20, der);
+            blob = ms.ToArray();
+        }
+        var thumb = Convert.ToHexString(sha1);
+        var hex = string.Join(",", blob.Select(b => b.ToString("x2")));
+        var regFile = Path.Combine(Path.GetTempPath(), "prospect-cert.reg");
+        File.WriteAllText(regFile,
+            "REGEDIT4\r\n\r\n" +
+            $"[HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\{thumb}]\r\n" +
+            $"\"Blob\"=hex:{hex}\r\n");
+
+        Console.WriteLine("⚠ Ferme complètement le jeu avant de continuer (sinon le registre ne sera pas pris en compte).");
+        Console.Write("Appuie sur Entrée pour importer… ");
+        Console.ReadLine();
+
+        var wineserver = Path.Combine(Path.GetDirectoryName(wine)!, "wineserver");
+        var regWinePath = "Z:" + regFile.Replace('/', '\\'); // Z: maps to / inside the prefix
+        RunWine(wineserver, "-k", prefix);            // stop any running wineserver (flush)
+        RunWine(wine, $"reg import \"{regWinePath}\"", prefix);
+        RunWine(wineserver, "-k", prefix);            // flush the change to disk
+
+        var sysreg = Path.Combine(prefix, "system.reg");
+        var ok = File.Exists(sysreg) && File.ReadAllText(sysreg).Contains(thumb, StringComparison.OrdinalIgnoreCase);
+        Console.WriteLine(ok
+            ? $"✔ Certificat importé dans le préfixe : {prefix}\n  Relance le jeu."
+            : "✖ Import non confirmé — assure-toi que le jeu est fermé et réessaie.");
+    }
+
+    private static void RunWine(string exe, string args, string prefix)
+    {
+        try
+        {
+            var psi = new ProcessStartInfo(exe, args)
+            {
+                UseShellExecute = false,
+                RedirectStandardOutput = true,
+                RedirectStandardError = true,
+            };
+            psi.Environment["WINEPREFIX"] = prefix;
+            psi.Environment["WINEDEBUG"] = "-all";
+            using var p = Process.Start(psi);
+            p?.WaitForExit(20000);
+        }
+        catch (Exception ex) { Console.WriteLine("  (wine) " + ex.Message); }
+    }
+
+    private static string? FindProtonWine()
+    {
+        foreach (var root in SteamRoots())
+        {
+            var common = Path.Combine(root, "steamapps", "common");
+            if (!Directory.Exists(common)) continue;
+            var candidates = Directory.GetDirectories(common, "Proton*")
+                .Select(d => Path.Combine(d, "files", "bin", "wine"))
+                .Where(File.Exists)
+                .OrderByDescending(w => w.Contains("Experimental"))
+                .ThenByDescending(File.GetLastWriteTimeUtc)
+                .ToList();
+            if (candidates.Count > 0) return candidates[0];
+        }
+        return null;
+    }
+
+    private static string? SelectPrefix()
+    {
+        if (!string.IsNullOrEmpty(_settings.WinePrefix) && Directory.Exists(_settings.WinePrefix))
+            return _settings.WinePrefix;
+
+        var prefixes = new List<string>();
+        foreach (var root in SteamRoots())
+        {
+            var cd = Path.Combine(root, "steamapps", "compatdata");
+            if (!Directory.Exists(cd)) continue;
+            foreach (var d in Directory.GetDirectories(cd))
+            {
+                var pfx = Path.Combine(d, "pfx");
+                if (File.Exists(Path.Combine(pfx, "system.reg"))) prefixes.Add(Path.GetFullPath(pfx));
+            }
+        }
+        prefixes = prefixes.Distinct()
+            .OrderByDescending(p => File.GetLastWriteTimeUtc(Path.Combine(p, "system.reg")))
+            .ToList();
+        if (prefixes.Count == 0) { Console.WriteLine("⚠ Aucun préfixe Proton trouvé."); return null; }
+
+        Console.WriteLine("Préfixes Proton détectés (le plus récemment utilisé en premier = sûrement ton jeu) :");
+        for (var i = 0; i < prefixes.Count; i++)
+            Console.WriteLine($"  {i + 1}) {prefixes[i]}");
+        Console.Write("Numéro du préfixe (Entrée = 1) : ");
+        var raw = Console.ReadLine()?.Trim();
+        var idx = string.IsNullOrEmpty(raw) ? 0 : (int.TryParse(raw, out var n) ? n - 1 : -1);
+        if (idx < 0 || idx >= prefixes.Count) { Console.WriteLine("⚠ Choix invalide."); return null; }
+        _settings.WinePrefix = prefixes[idx];
+        SaveSettings();
+        return _settings.WinePrefix;
+    }
+
+    private static IEnumerable<string> SteamRoots()
+    {
+        var home = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+        yield return Path.Combine(home, ".steam", "steam");
+        yield return Path.Combine(home, ".local", "share", "Steam");
+    }
+
+    // ---- Launch ------------------------------------------------------------
+    private static void LaunchGame()
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            if (!EnsureFolder(out var dir)) return;
+            var loader = Path.Combine(dir, "Prospect.Client.Loader.exe");
+            if (!File.Exists(loader)) { Console.WriteLine("⚠ Prospect.Client.Loader.exe introuvable dans le dossier."); return; }
+            try
+            {
+                Process.Start(new ProcessStartInfo(loader) { WorkingDirectory = dir, UseShellExecute = true });
+                Console.WriteLine("▶ Jeu lancé.");
+            }
+            catch (Exception ex) { Console.WriteLine("✖ " + ex.Message); }
+            return;
+        }
+        Console.WriteLine("Sous Linux/Proton, lance via Steam (le loader doit tourner dans le préfixe Proton) :");
+        Console.WriteLine("  steam steam://rungameid/" + AppId);
+    }
+
+    // ---- Helpers -----------------------------------------------------------
+    private static bool EnsureFolder(out string dir)
+    {
+        dir = _settings.GameFolder;
+        if (string.IsNullOrEmpty(dir) || !Directory.Exists(dir))
+        {
+            Console.WriteLine("⚠ Définis d'abord le dossier du jeu (option 1).");
+            return false;
+        }
+        return true;
+    }
+
+    private static void LoadSettings()
+    {
+        try
+        {
+            if (File.Exists(SettingsPath))
+                _settings = JsonSerializer.Deserialize<Settings>(File.ReadAllText(SettingsPath)) ?? new Settings();
+        }
+        catch { _settings = new Settings(); }
+    }
+
+    private static void SaveSettings()
+    {
+        try
+        {
+            Directory.CreateDirectory(Path.GetDirectoryName(SettingsPath)!);
+            File.WriteAllText(SettingsPath, JsonSerializer.Serialize(_settings));
+        }
+        catch { /* best-effort persistence */ }
+    }
+
+    private sealed class Settings
+    {
+        public string GameFolder { get; set; } = "";
+        public string WinePrefix { get; set; } = "";
+    }
+}

src/Prospect.Client.Config/Prospect.Client.Config.csproj

@@ -0,0 +1,15 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net8.0</TargetFramework>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <Nullable>enable</Nullable>
+        <AssemblyName>ProspectServerSwitcher</AssemblyName>
+        <RootNamespace>Prospect.Client.Config</RootNamespace>
+        <InvariantGlobalization>true</InvariantGlobalization>
+        <!-- Cross-platform client tool (Linux/Proton + Windows). Never built by the Linux server CI. -->
+        <Configurations>Debug;Release;Season 3 Release;Season 2 Release;Season 2 Debug;Season 3 Debug</Configurations>
+    </PropertyGroup>
+
+</Project>

src/Prospect.Client.Config/README.md

@@ -0,0 +1,102 @@
+# ProspectServerSwitcher
+
+Petit utilitaire **multi-OS** (Linux/Proton + Windows) pour pointer un client
+*The Cycle: Frontier* vers un serveur, importer le certificat, et lancer le jeu.
+
+## Pourquoi
+
+L'agent Prospect (`Prospect.Agent.dll`, injecté par `Prospect.Client.Loader.exe`)
+hooke l'URL de l'API PlayFab et la remplace par le contenu de **`backend.txt`**,
+placé à côté de l'exécutable du jeu (`Prospect/Binaries/Win64`). S'il est absent,
+l'agent retombe sur `https://127.0.0.1:8443`.
+
+**Tout l'aiguillage du client tient donc dans cette seule valeur.** Cet outil ne fait
+essentiellement qu'écrire le bon `backend.txt` — plus quelques commodités (cert, launch).
+
+## Serveurs (presets)
+
+Les presets utilisent les **domaines publics** pour que la même cible marche pour
+tout le monde (le DNS résout vers l'IP publique pour les amis, et le certificat TLS
+unifié couvre les deux hostnames) :
+
+| Preset    | URL                              |
+|-----------|----------------------------------|
+| `prod`    | `https://tc.nfteam.ovh:8443`     |
+| `preprod` | `https://rd-tc.nfteam.ovh:8444`  |
+
+> **Sur le même LAN que le serveur**, ajoute une entrée hosts pour éviter le hairpin NAT :
+> ```
+> 192.168.1.136   tc.nfteam.ovh
+> 192.168.1.136   rd-tc.nfteam.ovh
+> ```
+
+## Utilisation
+
+### Menu interactif
+Lance le binaire sans argument :
+- **1** : définir le dossier du jeu (`…/Prospect/Binaries/Win64`) — mémorisé
+- **2/3** : basculer sur PROD / PREPROD
+- **4** : URL personnalisée
+- **5** : importer un certificat (`.crt`)
+- **6** : lancer le jeu
+- **0** : quitter
+
+### En ligne de commande (scriptable)
+```
+ProspectServerSwitcher --folder "<...>/Prospect/Binaries/Win64" --set preprod
+ProspectServerSwitcher --set prod
+ProspectServerSwitcher --set https://mon-serveur:8443   # URL libre
+```
+
+> ⚠️ `backend.txt` n'est lu qu'**au démarrage** du loader → relance le jeu après un switch.
+> Le serveur ciblé doit **tourner** (conteneurs on-demand `the-cycle-api` / `the-cycle-api-rd`).
+
+## Certificat
+
+L'outil récupère le certificat **en direct depuis le serveur** ciblé (il lit `backend.txt`
+et se connecte en TLS), puis le rend fiable :
+
+- **Windows** : import automatique dans *Autorités de certification racines de confiance*
+  (utilisateur courant), via le magasin `X509Store`.
+- **Linux/Proton** : import **automatique dans le préfixe Wine** du jeu. Comme `wine certutil`
+  est cassé sous Proton, l'outil écrit directement le *blob* sérialisé du certificat
+  (propriété SHA1 `id=3` + certificat encodé `id=0x20`) dans le magasin `Root` du préfixe via
+  `wine reg import`. Il :
+  1. détecte le binaire `wine` de Proton (`…/common/Proton*/files/bin/wine`),
+  2. liste les préfixes `compatdata/*/pfx` (le plus récemment utilisé en premier),
+  3. importe dans le préfixe choisi (⚠️ **le jeu doit être fermé**), mémorisé ensuite.
+
+  > ⚠️ Le client tourne souvent comme **raccourci non-Steam** → son préfixe n'est **pas**
+  > `compatdata/868270` mais un appid généré (ex. `3883998305`). D'où la sélection explicite
+  > du préfixe plutôt qu'une déduction sur l'appid du jeu.
+
+## Lancement
+
+- **Windows** : démarre `Prospect.Client.Loader.exe` depuis le dossier du jeu.
+- **Linux/Proton** : passe par Steam (`steam steam://rungameid/868270`) — le loader doit
+  tourner dans le préfixe Proton.
+
+## Réglages
+
+Le dossier du jeu est mémorisé dans
+`…/ApplicationData/ProspectSwitcher/settings.json`
+(`%AppData%` sous Windows, `~/.config` sous Linux).
+
+## Build / publication
+
+Projet console **net8.0** (cross-platform, `InvariantGlobalization`), jamais buildé par
+la CI serveur (Linux).
+
+```bash
+# build simple
+dotnet build src/Prospect.Client.Config -c Release
+
+# binaires autonomes single-file (aucun .NET requis chez l'utilisateur)
+dotnet publish src/Prospect.Client.Config -c Release -r win-x64   --self-contained \
+  -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true
+dotnet publish src/Prospect.Client.Config -c Release -r linux-x64 --self-contained \
+  -p:PublishSingleFile=true -p:EnableCompressionInSingleFile=true
+```
+
+Les binaires publiés sont distribués via la release Gitea **`friends-client`**
+(`ProspectServerSwitcher.exe` pour Windows, `ProspectServerSwitcher-linux-x64` pour Linux).

src/Prospect.Client.Loader/Prospect.Client.Loader.vcxproj

@@ -0,0 +1,138 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>17.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{04b1d963-2bcb-4887-9d6d-04cb3366a348}</ProjectGuid>
+    <RootNamespace>ProspectClientLoader</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v143</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <OutDir>$(SolutionDir)\$(ProjectName)\$(Platform)\$(Configuration)\</OutDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

src/Prospect.Client.Loader/Prospect.Client.Loader.vcxproj.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>

src/Prospect.Client.Loader/main.cpp

@@ -0,0 +1,500 @@
+#include <windows.h>
+#include <tlhelp32.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <string>
+
+std::wstring ExePath() {
+    TCHAR buffer[MAX_PATH] = { 0 };
+    GetModuleFileName( NULL, buffer, MAX_PATH );
+    std::wstring::size_type pos = std::wstring(buffer).find_last_of(L"\\/");
+    return std::wstring(buffer).substr(0, pos);
+}
+
+// Function to create and launch a process with parameters
+HANDLE StartProcess(const wchar_t* exePath, DWORD* processID) {
+    STARTUPINFO si = { 0 };
+    PROCESS_INFORMATION pi = { 0 };
+    si.cb = sizeof(si);
+
+    // Command-line arguments to pass to the process
+    wchar_t commandLine[MAX_PATH] = L""; // Buffer for full command
+    _snwprintf_s(commandLine, sizeof(commandLine) / sizeof(wchar_t), L"\"%s\" -log -steam_auth PF_TITLEID=2EA46", exePath);
+
+    if (CreateProcess(NULL, commandLine, NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, &si, &pi)) {
+        *processID = pi.dwProcessId;
+        printf("Successfully started process: %ls (PID: %lu)\n", exePath, *processID);
+        ResumeThread(pi.hThread);
+        CloseHandle(pi.hThread);
+        return pi.hProcess;
+    }
+    else {
+        wchar_t szErrorMessage[512];
+
+        DWORD dwErrorCode = GetLastError();
+        FormatMessage(
+            FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+            NULL,
+            dwErrorCode,
+            0,
+            szErrorMessage,
+            sizeof(szErrorMessage),
+            NULL
+        );
+
+        printf("Failed to start process. Error: %lu: %ws\n", dwErrorCode, szErrorMessage);
+        return NULL;
+    }
+}
+
+// Function to get the base address of the main module (PE Image)
+uintptr_t GetModuleBaseAddress(DWORD processID) {
+    uintptr_t baseAddress = 0;
+    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, processID);
+    if (hSnapshot != INVALID_HANDLE_VALUE) {
+        MODULEENTRY32 moduleEntry;
+        moduleEntry.dwSize = sizeof(MODULEENTRY32);
+        if (Module32First(hSnapshot, &moduleEntry)) {
+            baseAddress = (uintptr_t)moduleEntry.modBaseAddr;
+        }
+        CloseHandle(hSnapshot);
+    }
+    else {
+        printf("Failed to take process snapshot. Error: %lu\n", GetLastError());
+    }
+    return baseAddress;
+}
+
+// Function to get a handle to the target process
+HANDLE OpenTargetProcess(DWORD processID) {
+    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
+    if (hProcess == NULL) {
+        printf("Failed to open process. Error: %lu\n", GetLastError());
+    }
+    return hProcess;
+}
+
+bool WriteBytes(HANDLE hProcess, uintptr_t address, BYTE* newValues, size_t size) {
+    SIZE_T bytesWritten;
+    DWORD oldProtect;
+    if (VirtualProtectEx(hProcess, (LPVOID)address, size, PAGE_EXECUTE_READWRITE, &oldProtect)) {
+        if (WriteProcessMemory(hProcess, (LPVOID)address, newValues, size, &bytesWritten)) {
+            printf("Memory Write Success at address 0x%p\n", (void*)address);
+        }
+        else {
+            printf("Failed to write memory. Error: %lu\n", GetLastError());
+            return false;
+        }
+        // Restore original protection
+        VirtualProtectEx(hProcess, (LPVOID)address, size, oldProtect, &oldProtect);
+    }
+    else {
+        printf("Failed to change memory protection. Error: %lu\n", GetLastError());
+        return false;
+    }
+    return true;
+}
+
+bool CheckForceLevelStreamingOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x32 && buffer[1] == 0xDB;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckForceLevelStreamingOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool CheckGPStringOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x5F && buffer[1] == 0x00;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckForceLevelStreamingOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool CheckWeakPointerCheckJumpOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0xF8 && buffer[1] == 0xFE;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckWeakPointerCheckJumpOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool CheckWeakPointerCheckOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[3];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x0F && buffer[1] == 0x1F && buffer[2] == 0x40;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckWeakPointerCheckOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool PatchForceLevelStreaming(HANDLE hProcess, uintptr_t imageBase) {
+    // Season 3 Patch force disable level streaming: sub_3DA7520 -> loc_3DA75B6
+    uintptr_t address = imageBase + 0x3DA75B6;
+    bool found = CheckForceLevelStreamingOffset(hProcess, address);
+    if (!found) {
+        // Season 2 Patch force disable level streaming: sub_3D19900 -> loc_3D19996
+        address = imageBase + 0x3D19996;
+        found = CheckForceLevelStreamingOffset(hProcess, address);
+    }
+
+    if (!found) {
+        printf("Failed to patch force level streaming!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[2] = { 0xB3, 0x01 };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    address = imageBase + 0x5541C08;
+    found = CheckGPStringOffset(hProcess, address);
+    if (!found) {
+        address = imageBase + 0x54E0558;
+        found = CheckGPStringOffset(hProcess, address);
+    }
+
+    if (!found) {
+        printf("Failed to find _GP string!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[6] = { 0x47, 0x00, 0x00, 0x00, 0x00, 0x00 };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    address = imageBase + 0x16D7C24;
+    found = CheckWeakPointerCheckOffset(hProcess, address);
+    // TODO
+    //if (!found) {
+    //    address = imageBase + 0x54E0558;
+    //    found = CheckWeakPointerCheckOffset(hProcess, address);
+    //}
+
+    if (!found) {
+        printf("Failed to find Weak Pointer Check!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[28] = {
+            0x48, 0x8B, 0x06,
+            0x48, 0x8D, 0x4D, 0x7F,
+            0x48, 0x89, 0x45, 0x7F,
+            0xE8, 0xDC, 0xC7, 0xA7, 0x00,
+            0x48, 0x85, 0xC0,
+            0x0F, 0x84, 0xEE, 0x00, 0x00, 0x00,
+            0x90, 0x90, 0x90
+        };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    address = imageBase + 0x16D7D34;
+    found = CheckWeakPointerCheckJumpOffset(hProcess, address);
+    // TODO
+    //if (!found) {
+    //    address = imageBase + 0x54E0558;
+    //    found = CheckWeakPointerCheckJumpOffset(hProcess, address);
+    //}
+
+    if (!found) {
+        printf("Failed to find Weak Pointer Check Jump!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[1] = { 0xEC };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool CheckUpdateInventoryFunctionOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x84 && buffer[1] == 0xC0;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckUpdateInventoryFunctionOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool PatchUpdateInventory(HANDLE hProcess, uintptr_t imageBase) {
+    uintptr_t address = imageBase + 0x18D5A11;
+    bool found = CheckUpdateInventoryFunctionOffset(hProcess, address);
+    if (!found) {
+        address = imageBase + 0x3D19B19;
+        found = CheckUpdateInventoryFunctionOffset(hProcess, address);
+    }
+
+    if (!found) {
+        printf("Failed to patch inventory update function!\n");
+        return false;
+    }
+
+    BYTE newValues[8] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
+    bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+    if (!result) {
+        return false;
+    }
+    return true;
+}
+
+bool CheckSetupPlayerContractsOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x48 && buffer[1] == 0x8D;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckSetupPlayerContractsOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool CheckUpdatePlayerContractsOffset(HANDLE hProcess, uintptr_t address) {
+    BYTE buffer[2];
+    SIZE_T bytesRead;
+    if (ReadProcessMemory(hProcess, (LPCVOID)address, buffer, sizeof(buffer), &bytesRead)) {
+        return buffer[0] == 0x3B && buffer[1] == 0xC1;
+    }
+    else {
+        DWORD error = GetLastError();
+        if (error == 299) {
+            printf("Incomplete memory read. Retrying...\n");
+            Sleep(1000);
+            return CheckUpdatePlayerContractsOffset(hProcess, address);
+        }
+        printf("Failed to read memory. Error: %lu\n", error);
+        return false;
+    }
+}
+
+bool PatchLoadPlayerContracts(HANDLE hProcess, uintptr_t imageBase) {
+    uintptr_t address = imageBase + 0x171E9EC;
+    bool found = CheckUpdatePlayerContractsOffset(hProcess, address);
+    if (!found) {
+        printf("Failed to update player contracts function!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[4] = { 0x90, 0x90, 0xEB, 0x21 };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    address = imageBase + 0x1706127;
+    found = CheckSetupPlayerContractsOffset(hProcess, address);
+    if (!found) {
+        printf("Failed to find setup player contracts function!\n");
+        return false;
+    }
+
+    {
+        BYTE newValues[39] = {
+            0x45, 0x33, 0xC0, 0x49, 0x8B, 0xD5, 0x48, 0x8B, 0x89, 0xD8, 0x00, 0x00, 0x00, 0xE8, 0x47,
+            0xE2, 0x10, 0x00, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90,
+            0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0xEB
+        };
+        bool result = WriteBytes(hProcess, address, newValues, sizeof(newValues));
+        if (!result) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool Inject(HANDLE hProcess, const wchar_t* dllPath) {
+    // Allocate space in the target process for the DLL path
+    size_t pathSize = (wcslen(dllPath) + 1) * sizeof(wchar_t);
+    LPVOID remotePath = VirtualAllocEx(hProcess, NULL, pathSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+    if (!remotePath) {
+        wprintf(L"Failed to allocate memory in remote process. Error: %lu\n", GetLastError());
+        CloseHandle(hProcess);
+        return false;
+    }
+
+    // Write the DLL path into the target process
+    if (!WriteProcessMemory(hProcess, remotePath, dllPath, pathSize, NULL)) {
+        wprintf(L"Failed to write memory. Error: %lu\n", GetLastError());
+        VirtualFreeEx(hProcess, remotePath, 0, MEM_RELEASE);
+        CloseHandle(hProcess);
+        return false;
+    }
+
+    // Get the address of LoadLibraryW in kernel32.dll
+    LPVOID loadLibraryAddr = (LPVOID)GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW");
+    if (!loadLibraryAddr) {
+        wprintf(L"Failed to get LoadLibraryW address. Error: %lu\n", GetLastError());
+        VirtualFreeEx(hProcess, remotePath, 0, MEM_RELEASE);
+        CloseHandle(hProcess);
+        return false;
+    }
+
+    // Create a remote thread to call LoadLibraryW with our DLL path
+    HANDLE hThread = CreateRemoteThread(
+        hProcess, NULL, 0,
+        (LPTHREAD_START_ROUTINE)loadLibraryAddr,
+        remotePath, 0, NULL);
+
+    if (!hThread) {
+        wprintf(L"Failed to create remote thread. Error: %lu\n", GetLastError());
+        VirtualFreeEx(hProcess, remotePath, 0, MEM_RELEASE);
+        CloseHandle(hProcess);
+        return false;
+    }
+    return true;
+}
+
+bool Patch(const wchar_t* processName) {
+    DWORD processID;
+
+    HANDLE hProcess = StartProcess(processName, &processID);
+    if (hProcess == NULL) {
+        return false;
+    }
+    if (!Inject(hProcess, L"Prospect.Agent.dll")) {
+        return false;
+    }
+    if (!Inject(hProcess, L"UE4SS.dll")) {
+        return false;
+    }
+
+    uintptr_t imageBase;
+    // Wait a bit for PE image to load
+    Sleep(250);
+    while ((imageBase = GetModuleBaseAddress(processID)) == 0) {
+        printf("Failed to find PE Image Base Address. Retrying...\n");
+        Sleep(250);
+    }
+    printf("PE Image Base Address: 0x%p\n", (void*)imageBase);
+
+    bool success = !PatchForceLevelStreaming(hProcess, imageBase) || !PatchUpdateInventory(hProcess, imageBase) || !PatchLoadPlayerContracts(hProcess, imageBase);
+    if (success) {
+        return false;
+    }
+
+    // Clean up
+    CloseHandle(hProcess);
+    return true;
+}
+
+bool WriteSteamAppIDFile() {
+    const char* filename = "steam_appid.txt";
+    FILE* fp;
+
+    if (fopen_s(&fp, filename, "r") == 0) {
+        // File exists, close the file
+        fclose(fp);
+        printf("File '%s' already exists.\n", filename);
+        return true;
+    }
+    else {
+        // File does not exist, create and write to it
+        if (fopen_s(&fp, filename, "w") == 0) {
+            const char* content = "480";
+            size_t written = fwrite(content, sizeof(char), strlen(content), fp);
+            fclose(fp);
+            printf("File '%s' was created and written successfully.\n", filename);
+        }
+        else {
+            printf("Error creating the file '%s'.\n", filename);
+            return false;
+        }
+    }
+    return true;
+}
+
+int main() {
+    printf("Current working directory: %ws\n", ExePath().c_str());
+
+    bool success = WriteSteamAppIDFile();
+    if (!success) {
+        // Wait for user input to exit
+        printf("An error occurred when writing steam_appid.txt! Press any key to exit...\n");
+        getchar();
+        return 1;
+    }
+
+    success = Patch(L"Prospect-Win64-Shipping.exe");
+    if (!success) {
+        // Wait for user input to exit
+        printf("An error occurred when patching the executable! Press any key to exit...\n");
+        getchar();
+        return 1;
+    }
+
+    return 0;
+}

src/Prospect.Launcher/Inject.cs

@@ -1,55 +0,0 @@
-using System;
-using System.Runtime.InteropServices;
-using System.Text;
-using Prospect.Launcher.Invoke;
-
-namespace Prospect.Launcher;
-
-public static class Inject
-{
-    const int PROCESS_CREATE_THREAD = 0x0002;
-    const int PROCESS_QUERY_INFORMATION = 0x0400;
-    const int PROCESS_VM_OPERATION = 0x0008;
-    const int PROCESS_VM_WRITE = 0x0020;
-    const int PROCESS_VM_READ = 0x0010;
-
-    const uint MEM_COMMIT = 0x00001000;
-    const uint MEM_RESERVE = 0x00002000;
-    const uint PAGE_READWRITE = 4;
-        
-    // https://codingvision.net/c-inject-a-dll-into-a-process-w-createremotethread
-    public static unsafe bool Library(uint processId, string path)
-    {
-        IntPtr procHandle = Kernel32.OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, false, (int)processId);
-
-        var loadLibraryAddr = Kernel32.GetProcAddress(Kernel32.GetModuleHandle("kernel32.dll"), "LoadLibraryA");
-        if (loadLibraryAddr == IntPtr.Zero)
-        {
-            Console.WriteLine("Failed GetProcAddress.");
-            return false;
-        }
-            
-        var allocMemAddress = Kernel32.VirtualAllocEx(procHandle, IntPtr.Zero, (uint)((path.Length + 1) * Marshal.SizeOf(typeof(char))), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
-        if (allocMemAddress == IntPtr.Zero)
-        {
-            Console.WriteLine("Failed VirtualAllocEx.");
-            return false;
-        }
-
-        var libraryBytes = Encoding.Default.GetBytes(path);
-            
-        fixed (byte* pLibraryBytes = libraryBytes)
-        {
-            Kernel32.WriteProcessMemory(procHandle, allocMemAddress, pLibraryBytes, libraryBytes.Length + 1, out _);
-        }
-
-        var threadHandle = Kernel32.CreateRemoteThread(procHandle, IntPtr.Zero, 0, loadLibraryAddr, allocMemAddress, 0, IntPtr.Zero);
-        if (threadHandle == IntPtr.Zero)
-        {
-            Console.WriteLine("Failed CreateRemoteThread.");
-            return false;
-        }
-            
-        return true;
-    }
-}

src/Prospect.Launcher/Invoke/Kernel32.cs

@@ -1,52 +0,0 @@
-using System;
-using System.Runtime.InteropServices;
-using Prospect.Launcher.Invoke.Structs;
-
-namespace Prospect.Launcher.Invoke;
-
-internal static class Kernel32
-{
-    [DllImport("kernel32.dll", SetLastError=true, CharSet=CharSet.Auto)]
-    public static extern bool CreateProcess(string lpApplicationName,
-        string lpCommandLine, IntPtr lpProcessAttributes,
-        IntPtr lpThreadAttributes,
-        bool bInheritHandles, ProcessCreationFlags dwCreationFlags,
-        IntPtr lpEnvironment, string lpCurrentDirectory,
-        ref StartupInfo lpStartupInfo,
-        out ProcessInformation lpProcessInformation);
-
-    public static bool CreateProcess(
-        string lpApplicationName,
-        string lpCommandLine,
-        ProcessCreationFlags dwCreationFlags,
-        ref StartupInfo lpStartupInfo,
-        out ProcessInformation lpProcessInformation) => CreateProcess(lpApplicationName, lpCommandLine, IntPtr.Zero,
-        IntPtr.Zero, false, dwCreationFlags, IntPtr.Zero, null, ref lpStartupInfo, out lpProcessInformation);
-        
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern unsafe bool WriteProcessMemory(
-        IntPtr hProcess,
-        IntPtr lpBaseAddress,
-        byte* lpBuffer,
-        Int32 nSize,
-        out IntPtr lpNumberOfBytesWritten
-    );
-        
-    [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
-    public static extern IntPtr GetModuleHandle(string lpModuleName);
-        
-    [DllImport("kernel32.dll")]
-    public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
-
-    [DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
-    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
-        
-    [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
-    public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
-        
-    [DllImport("kernel32.dll")]
-    public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
-        
-    [DllImport("kernel32.dll", SetLastError = true)]
-    public static extern uint ResumeThread(IntPtr hThread);
-}

src/Prospect.Launcher/Invoke/Structs/ProcessCreationFlags.cs

@@ -1,25 +0,0 @@
-using System;
-
-namespace Prospect.Launcher.Invoke.Structs;
-
-[Flags]
-internal enum ProcessCreationFlags : uint
-{
-    ZERO_FLAG = 0x00000000,
-    CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
-    CREATE_DEFAULT_ERROR_MODE = 0x04000000,
-    CREATE_NEW_CONSOLE = 0x00000010,
-    CREATE_NEW_PROCESS_GROUP = 0x00000200,
-    CREATE_NO_WINDOW = 0x08000000,
-    CREATE_PROTECTED_PROCESS = 0x00040000,
-    CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
-    CREATE_SEPARATE_WOW_VDM = 0x00001000,
-    CREATE_SHARED_WOW_VDM = 0x00001000,
-    CREATE_SUSPENDED = 0x00000004,
-    CREATE_UNICODE_ENVIRONMENT = 0x00000400,
-    DEBUG_ONLY_THIS_PROCESS = 0x00000002,
-    DEBUG_PROCESS = 0x00000001,
-    DETACHED_PROCESS = 0x00000008,
-    EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
-    INHERIT_PARENT_AFFINITY = 0x00010000
-}

src/Prospect.Launcher/Invoke/Structs/ProcessInformation.cs

@@ -1,13 +0,0 @@
-using System;
-using System.Runtime.InteropServices;
-
-namespace Prospect.Launcher.Invoke.Structs;
-
-[StructLayout(LayoutKind.Sequential)]
-internal struct ProcessInformation
-{
-    public IntPtr hProcess;
-    public IntPtr hThread;
-    public uint dwProcessId;
-    public uint dwThreadId;
-}

src/Prospect.Launcher/Invoke/Structs/StartupInfo.cs

@@ -1,27 +0,0 @@
-using System;
-using System.Runtime.InteropServices;
-
-namespace Prospect.Launcher.Invoke.Structs;
-
-[StructLayout(LayoutKind.Sequential)]
-internal struct StartupInfo
-{
-    public uint cb;
-    public string lpReserved;
-    public string lpDesktop;
-    public string lpTitle;
-    public uint dwX;
-    public uint dwY;
-    public uint dwXSize;
-    public uint dwYSize;
-    public uint dwXCountChars;
-    public uint dwYCountChars;
-    public uint dwFillAttribute;
-    public uint dwFlags;
-    public short wShowWindow;
-    public short cbReserved2;
-    public IntPtr lpReserved2;
-    public IntPtr hStdInput;
-    public IntPtr hStdOutput;
-    public IntPtr hStdError;
-}

src/Prospect.Launcher/Program.cs

@@ -1,77 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using Prospect.Launcher.Invoke;
-using Prospect.Launcher.Invoke.Structs;
-
-namespace Prospect.Launcher;
-
-internal static class Program
-{
-    /// <summary>
-    ///     Steam AppId.
-    ///     - https://steamdb.info/app/480/
-    ///     - https://steamdb.info/app/1600360/
-    /// </summary>
-    private const string AppId = "480";
-        
-    /// <summary>
-    ///     Executable name of the game.
-    /// </summary>
-    private const string FileName = "Prospect-Win64-Shipping.exe";
-        
-    private static void Main(string[] args)
-    {
-        if (args.Length != 1)
-        {
-            Console.WriteLine("Usage: ./Prospect.Launcher <Game directory>");
-            return;
-        }
-            
-        var gamePath = Path.Combine(args[0], "Prospect", "Binaries", "Win64");
-        var gameBinary = Path.Combine(gamePath, FileName);
-        var gameArgs = new List<string>();
-
-        // 2EA46 = Default
-        // A22AB = The Cycle Playtest
-        gameArgs.Add("-empty");
-        gameArgs.Add("-log");
-        gameArgs.Add("-windowed");
-        gameArgs.Add("-noeac");
-        gameArgs.Add("-nointro");
-        gameArgs.Add("-steam_auth");
-        gameArgs.Add("PF_TITLEID=A22AB");
-            
-        // Ensure "steam_appid.txt" exists, to fix steam authentication.
-        var steamAppId = Path.Combine(gamePath, "steam_appid.txt");
-
-        File.WriteAllText(steamAppId, AppId);
-            
-        // Spawn.
-        var startupInfo = new StartupInfo();
-
-        if (!Kernel32.CreateProcess(gameBinary, string.Join(' ', gameArgs), ProcessCreationFlags.CREATE_SUSPENDED, ref startupInfo, out var processInfo))
-        {
-            Console.WriteLine("Failed to spawn game.");
-            return;
-        }
-            
-        Console.WriteLine("Spawned.");
-
-        // Inject DLL.
-        var agentPath = Path.Combine(AppContext.BaseDirectory, "Prospect.Agent.dll");
-
-        if (!Inject.Library(processInfo.dwProcessId, agentPath))
-        {
-            Console.WriteLine("Failed to inject library.");
-            return;
-        }
-            
-        Console.WriteLine("Injected.");
-            
-        // Resume.
-        Kernel32.ResumeThread(processInfo.hThread);
-
-        Console.WriteLine("Resumed.");
-    }
-}

src/Prospect.Launcher/Prospect.Launcher.csproj

@@ -1,30 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-    <PropertyGroup>
-        <OutputType>Exe</OutputType>
-        <TargetFramework>net8.0</TargetFramework>
-        <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-        <PublishSingleFile>true</PublishSingleFile>
-        <SelfContained>false</SelfContained>
-        <RuntimeIdentifier>win-x64</RuntimeIdentifier>
-        <PublishReadyToRun>true</PublishReadyToRun>
-        <DebugType>embedded</DebugType>
-    </PropertyGroup>
-
-    <PropertyGroup Condition=" '$(Configuration)' == 'Debug' ">
-      <PlatformTarget>x64</PlatformTarget>
-    </PropertyGroup>
-
-    <PropertyGroup Condition=" '$(Configuration)' == 'Release' ">
-      <PlatformTarget>x64</PlatformTarget>
-    </PropertyGroup>
-
-    <ItemGroup>
-      <Content Include="Prospect.Agent.dll">
-        <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
-        <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory>
-        <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
-      </Content>
-    </ItemGroup>
-
-</Project>

src/Prospect.Server.Api/Config/PlayFabSettings.cs

@@ -4,4 +4,6 @@ public class PlayFabSettings
 {
     public string PublisherId { get; set; }
     public string TitleId { get; set; }
+    public string SignalRURL { get; set; }
+    public string SignalRAccessToken { get; set; }
 }

src/Prospect.Server.Api/Controllers/AdminController.cs

@@ -0,0 +1,431 @@
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Text.Json;
+using Microsoft.AspNetCore.Mvc;
+using Prospect.Server.Api.Services.Database;
+using Prospect.Server.Api.Services.Database.Models;
+using Prospect.Server.Api.Services.GameRef;
+using Prospect.Server.Api.Services.Steam;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Controllers;
+
+// Read-only back-office to visualise everything relevant in the database.
+// Served at /admin, restricted to LAN / loopback callers (an admin panel must not be
+// reachable from the public internet even though :8443 is port-forwarded).
+// List pages (players, catalog) are driven by a small self-contained client-side table
+// engine (sort / filter / search / paging) fed by the /admin/api/* JSON endpoints.
+[Route("admin")]
+public class AdminController : ControllerBase
+{
+    private readonly DbUserService _userService;
+    private readonly DbEntityService _entityService;
+    private readonly DbUserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly SteamWebApiService _steamWebApi;
+    private readonly GameRefService _gameRef;
+
+    public AdminController(DbUserService userService, DbEntityService entityService,
+        DbUserDataService userDataService, TitleDataService titleDataService, SteamWebApiService steamWebApi,
+        GameRefService gameRef)
+    {
+        _userService = userService;
+        _entityService = entityService;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _steamWebApi = steamWebApi;
+        _gameRef = gameRef;
+    }
+
+    // ---------- pages ----------
+
+    [HttpGet("")]
+    public async Task<IActionResult> Index()
+    {
+        if (!IsLan()) return Denied();
+
+        var users = await _userService.GetAllAsync();
+        var entities = await _entityService.GetAllAsync();
+        var dataCount = await _userDataService.CountAsync();
+        var titleKeys = _titleDataService.Find(new List<string>());
+
+        var sb = new StringBuilder();
+        sb.Append("<div class='cards'>");
+        sb.Append(Card("Joueurs", users.Count.ToString()));
+        sb.Append(Card("Entités", entities.Count.ToString()));
+        sb.Append(Card("Docs UserData", dataCount.ToString()));
+        sb.Append(Card("Clés TitleData", titleKeys.Count.ToString()));
+        sb.Append(Card("Catalogue", _gameRef.All.Count.ToString()));
+        sb.Append("</div>");
+        sb.Append("<p><a class='btn' href='/admin/players'>Joueurs →</a> &nbsp; <a class='btn' href='/admin/catalog'>Catalogue →</a> &nbsp; <a class='btn' href='/admin/titledata'>TitleData →</a></p>");
+        return Html(Layout("Dashboard", sb.ToString()));
+    }
+
+    [HttpGet("players")]
+    public IActionResult Players()
+    {
+        if (!IsLan()) return Denied();
+        var body =
+            "<h2>Joueurs</h2>" +
+            "<p><a class='btn' href='/admin/backfill-names' title='Récupère les pseudos Steam des comptes sans nom'>⟳ Backfill pseudos Steam</a></p>" +
+            "<div id='tbl'></div>" +
+            "<script>DT.init({id:'tbl',url:'/admin/api/players',size:25,filters:['auth'],columns:[" +
+            "{key:'name',label:'Nom',kind:'link',base:'/admin/players/',lkey:'id'}," +
+            "{key:'id',label:'PlayFab Id',kind:'mono'}," +
+            "{key:'entity',label:'Entity Id',kind:'mono'}," +
+            "{key:'auth',label:'Auth',kind:'mono'}]});</script>";
+        return Html(Layout("Joueurs", body));
+    }
+
+    [HttpGet("catalog")]
+    public IActionResult Catalog()
+    {
+        if (!IsLan()) return Denied();
+        var body =
+            "<h2>Catalogue</h2>" +
+            "<p class='muted'>Référence dataminée (TCF-Wiki) — " + _gameRef.All.Count + " entrées.</p>" +
+            "<div id='tbl'></div>" +
+            "<script>DT.init({id:'tbl',url:'/admin/api/catalog',size:50,filters:['category','rarity'],columns:[" +
+            "{key:'name',label:'Nom'}," +
+            "{key:'rarity',label:'Rareté',kind:'rarity'}," +
+            "{key:'category',label:'Catégorie'}," +
+            "{key:'id',label:'id',kind:'mono'}]});</script>";
+        return Html(Layout("Catalogue", body));
+    }
+
+    [HttpGet("players/{id}")]
+    public async Task<IActionResult> Player(string id)
+    {
+        if (!IsLan()) return Denied();
+
+        var user = await _userService.FindByIdAsync(id);
+        if (user == null) return Html(Layout("Joueur introuvable", "<p>Aucun joueur avec cet id.</p>"));
+
+        var entity = await _entityService.FindAsync(id);
+        var data = await _userDataService.GetAllForUserAsync(id);
+        var map = data.ToDictionary(d => d.Key, d => d);
+
+        var sb = new StringBuilder();
+        var auth = user.Auth != null ? string.Join(", ", user.Auth.Select(a => $"{a.Type}:{a.Key}")) : "";
+        sb.Append($"<p><a class='lnk' href='/admin/players'>← Joueurs</a></p>");
+        sb.Append($"<h2>{Esc(user.DisplayName)}</h2>");
+        sb.Append($"<p class='muted mono'>PlayFabId {Esc(user.Id)} · Entity {Esc(entity?.Id ?? "-")} · {Esc(auth)}</p>");
+
+        sb.Append("<div class='cards'>");
+        if (map.TryGetValue("Balance", out var bal))
+        {
+            sb.Append(Card("K-Marks", GetNum(bal.Value, "SoftCurrency").ToString()));
+            sb.Append(Card("Aurum", GetNum(bal.Value, "HardCurrency").ToString()));
+            sb.Append(Card("Insurance", GetNum(bal.Value, "InsuranceCurrency").ToString()));
+        }
+        foreach (var f in new[] { "Korolev", "Osiris", "ICA" })
+            if (map.TryGetValue("FactionProgression" + f, out var fp))
+                sb.Append(Card("Rép. " + f, (fp.Value ?? "0").Trim()));
+        foreach (var s in new[] { "2", "3" })
+            if (map.TryGetValue($"FortunaPass{s}_SeasonXp", out var xp) && (xp.Value ?? "0").Trim() != "0")
+                sb.Append(Card($"Fortuna S{s} XP", (xp.Value ?? "0").Trim()));
+        sb.Append("</div>");
+
+        if (map.TryGetValue("Inventory", out var inv))
+        {
+            sb.Append("<h3>Inventaire</h3>");
+            sb.Append(InventoryTable(inv.Value));
+        }
+
+        sb.Append("<h3>Toutes les données</h3>");
+        foreach (var d in data)
+        {
+            sb.Append("<details><summary>" + Esc(d.Key) +
+                      $" <span class='muted small'>· {d.Value?.Length ?? 0} car · maj {d.LastUpdated:yyyy-MM-dd HH:mm}{(d.Public ? " · public" : "")}</span></summary>");
+            sb.Append($"<pre>{Esc(Pretty(d.Value))}</pre></details>");
+        }
+        return Html(Layout("Joueur · " + user.DisplayName, sb.ToString()));
+    }
+
+    [HttpGet("titledata")]
+    public IActionResult TitleData()
+    {
+        if (!IsLan()) return Denied();
+
+        var all = _titleDataService.Find(new List<string>());
+        var sb = new StringBuilder();
+        sb.Append("<h2>TitleData</h2>");
+        sb.Append("<table><thead><tr><th>Clé</th><th>Taille</th><th></th></tr></thead><tbody>");
+        foreach (var kv in all.OrderBy(k => k.Key))
+            sb.Append($"<tr><td class='mono'>{Esc(kv.Key)}</td><td>{kv.Value?.Length ?? 0} car</td>" +
+                      $"<td><a class='btn' href='/admin/titledata/{Esc(kv.Key)}'>Voir</a></td></tr>");
+        sb.Append("</tbody></table>");
+        return Html(Layout("TitleData", sb.ToString()));
+    }
+
+    [HttpGet("titledata/{key}")]
+    public IActionResult TitleDataKey(string key)
+    {
+        if (!IsLan()) return Denied();
+
+        var all = _titleDataService.Find(new List<string> { key });
+        if (!all.TryGetValue(key, out var value))
+            return Html(Layout("Clé introuvable", "<p>Aucune clé TitleData avec ce nom.</p>"));
+
+        var body = value != null && value.Length > 300_000
+            ? $"<p class='muted'>Valeur volumineuse ({value.Length} car) — affichage brut.</p><pre>{Esc(value)}</pre>"
+            : $"<pre>{Esc(Pretty(value))}</pre>";
+        return Html(Layout("TitleData · " + key, $"<p><a class='lnk' href='/admin/titledata'>← TitleData</a></p><h2 class='mono'>{Esc(key)}</h2>" + body));
+    }
+
+    [HttpGet("backfill-names")]
+    public async Task<IActionResult> BackfillNames()
+    {
+        if (!IsLan()) return Denied();
+        if (!_steamWebApi.Enabled)
+            return Html(Layout("Backfill", "<p class='muted'>Steam Web API non configurée (clé absente).</p><p><a class='btn' href='/admin/players'>← Joueurs</a></p>"));
+
+        var users = await _userService.GetAllAsync();
+        int updated = 0, skipped = 0, failed = 0;
+        var rows = new StringBuilder();
+        foreach (var u in users)
+        {
+            if (!string.IsNullOrEmpty(u.DisplayName) && u.DisplayName != "Unknown") { skipped++; continue; }
+            var steam = u.Auth?.FirstOrDefault(a => a.Type == PlayFabUserAuthType.Steam)?.Key;
+            if (string.IsNullOrEmpty(steam)) { skipped++; continue; }
+
+            var persona = await _steamWebApi.GetPersonaNameAsync(steam);
+            if (!string.IsNullOrWhiteSpace(persona))
+            {
+                await _userService.UpdateDisplayNameAsync(u.Id, persona);
+                updated++;
+                rows.Append($"<tr><td class='mono small'>{Esc(u.Id)}</td><td>{Esc(persona)}</td></tr>");
+            }
+            else { failed++; }
+        }
+
+        var body = $"<h2>Backfill des pseudos Steam</h2><p class='muted'>{updated} mis à jour · {skipped} ignorés · {failed} échec(s)</p>" +
+                   (updated > 0 ? $"<table><thead><tr><th>PlayFabId</th><th>Nouveau nom</th></tr></thead><tbody>{rows}</tbody></table>" : "") +
+                   "<p><a class='btn' href='/admin/players'>← Joueurs</a></p>";
+        return Html(Layout("Backfill", body));
+    }
+
+    // ---------- JSON API (consumed by the client-side table engine) ----------
+
+    [HttpGet("api/players")]
+    public async Task<IActionResult> ApiPlayers()
+    {
+        if (!IsLan()) return Denied();
+        var users = await _userService.GetAllAsync();
+        var entities = (await _entityService.GetAllAsync())
+            .GroupBy(e => e.UserId).ToDictionary(g => g.Key, g => g.First().Id);
+        var list = users.Select(u => new
+        {
+            name = string.IsNullOrEmpty(u.DisplayName) ? u.Id : u.DisplayName,
+            id = u.Id,
+            entity = entities.TryGetValue(u.Id, out var e) ? e : "",
+            auth = u.Auth != null ? string.Join(", ", u.Auth.Select(a => $"{a.Type}:{a.Key}")) : ""
+        });
+        return Json(list);
+    }
+
+    [HttpGet("api/catalog")]
+    public IActionResult ApiCatalog()
+    {
+        if (!IsLan()) return Denied();
+        var list = _gameRef.All.Select(kv => new
+        {
+            id = kv.Key,
+            name = kv.Value.Name,
+            rarity = kv.Value.Rarity,
+            category = kv.Value.Category
+        });
+        return Json(list);
+    }
+
+    // ---------- helpers ----------
+
+    private bool IsLan()
+    {
+        var ip = HttpContext.Connection.RemoteIpAddress;
+        if (ip == null) return false;
+        if (IPAddress.IsLoopback(ip)) return true;
+        if (ip.IsIPv4MappedToIPv6) ip = ip.MapToIPv4();
+        if (ip.AddressFamily == AddressFamily.InterNetwork)
+        {
+            var b = ip.GetAddressBytes();
+            if (b[0] == 10) return true;
+            if (b[0] == 192 && b[1] == 168) return true;
+            if (b[0] == 172 && b[1] >= 16 && b[1] <= 31) return true;
+            if (b[0] == 127) return true;
+            return false;
+        }
+        var s = ip.GetAddressBytes();
+        if ((s[0] & 0xFE) == 0xFC) return true;
+        if (s[0] == 0xFE && (s[1] & 0xC0) == 0x80) return true;
+        return false;
+    }
+
+    private IActionResult Denied() =>
+        StatusCode(403, "Admin back-office is LAN-only. Access it from the local network (e.g. https://192.168.1.136:8443/admin).");
+
+    private IActionResult Html(string html) => Content(html, "text/html; charset=utf-8");
+
+    private IActionResult Json(object data) =>
+        Content(JsonSerializer.Serialize(data), "application/json; charset=utf-8");
+
+    private static string Esc(string? s) => WebUtility.HtmlEncode(s ?? "");
+
+    private static string Pretty(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return json ?? "";
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            return JsonSerializer.Serialize(doc.RootElement, new JsonSerializerOptions { WriteIndented = true });
+        }
+        catch { return json; }
+    }
+
+    private static long GetNum(string? json, string prop)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return 0;
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            foreach (var p in doc.RootElement.EnumerateObject())
+                if (string.Equals(p.Name, prop, StringComparison.OrdinalIgnoreCase) && p.Value.ValueKind == JsonValueKind.Number)
+                    return p.Value.GetInt64();
+        }
+        catch { }
+        return 0;
+    }
+
+    private string InventoryTable(string? json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return "<p class='muted'>vide</p>";
+        try
+        {
+            using var doc = JsonDocument.Parse(json);
+            if (doc.RootElement.ValueKind != JsonValueKind.Array) return $"<pre>{Esc(Pretty(json))}</pre>";
+            var sb = new StringBuilder();
+            var count = doc.RootElement.GetArrayLength();
+            sb.Append($"<p class='muted'>{count} item(s)</p>");
+            sb.Append("<table><thead><tr><th>Nom</th><th>Rareté</th><th>baseItemId</th><th>qté</th><th>durab.</th><th>assurance</th></tr></thead><tbody>");
+            foreach (var it in doc.RootElement.EnumerateArray())
+            {
+                string S(string k) => it.TryGetProperty(k, out var v) ? (v.ValueKind == JsonValueKind.Number ? v.GetRawText() : v.ToString()) : "";
+                var baseId = S("baseItemId");
+                var entry = _gameRef.Get(baseId);
+                var name = entry?.Name ?? baseId;
+                sb.Append($"<tr><td>{Esc(name)}</td><td>{Rarity(entry?.Rarity)}</td><td class='mono small'>{Esc(baseId)}</td>" +
+                          $"<td>{Esc(S("amount"))}</td><td>{Esc(S("durability"))}</td><td>{Esc(S("insurance"))}</td></tr>");
+            }
+            sb.Append("</tbody></table>");
+            return sb.ToString();
+        }
+        catch { return $"<pre>{Esc(Pretty(json))}</pre>"; }
+    }
+
+    private static string Rarity(string? r)
+    {
+        if (string.IsNullOrEmpty(r)) return "";
+        var color = r.ToLowerInvariant() switch
+        {
+            "common" => "#9aa4b2",
+            "uncommon" => "#4caf50",
+            "rare" => "#2f81f7",
+            "epic" => "#a371f7",
+            "legendary" or "exotic" => "#e8a838",
+            _ => "#9aa4b2",
+        };
+        return $"<span style='color:{color};font-weight:600'>{Esc(r)}</span>";
+    }
+
+    private static string Card(string label, string value) =>
+        $"<div class='card'><div class='v'>{Esc(value)}</div><div class='l'>{Esc(label)}</div></div>";
+
+    private static string Layout(string title, string body) =>
+        Head.Replace("__TITLE__", Esc(title)) + DtScript + body + Foot;
+
+    // Static shell (no C# interpolation → JS braces/quotes stay literal). Single quotes only.
+    private const string Head = @"<!doctype html><html lang='fr'><head>
+<meta charset='utf-8'><meta name='viewport' content='width=device-width,initial-scale=1'>
+<title>__TITLE__ · The Cycle Admin</title>
+<style>
+:root{--bg:#0f1115;--panel:#171a21;--line:#262b36;--txt:#e6e8ec;--muted:#8b93a1;--acc:#e8a838;}
+*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--txt);font:14px/1.5 system-ui,Segoe UI,Roboto,sans-serif}
+header{background:var(--panel);border-bottom:1px solid var(--line);padding:12px 20px;display:flex;gap:18px;align-items:center;position:sticky;top:0;z-index:10}
+header b{color:var(--acc)}header a{color:var(--muted);text-decoration:none}header a:hover{color:var(--txt)}
+main{padding:20px;max-width:1200px;margin:0 auto}
+h2{margin:18px 0 10px}h3{margin:22px 0 8px;border-bottom:1px solid var(--line);padding-bottom:4px}
+.cards{display:flex;flex-wrap:wrap;gap:12px;margin:12px 0}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:14px 18px;min-width:130px}
+.card .v{font-size:22px;font-weight:700;color:var(--acc)}.card .l{color:var(--muted);font-size:12px}
+table{width:100%;border-collapse:collapse;background:var(--panel);border:1px solid var(--line);border-radius:10px;overflow:hidden}
+th,td{text-align:left;padding:8px 12px;border-bottom:1px solid var(--line);vertical-align:top}
+th{background:#1c2029;color:var(--muted);font-weight:600}tr:last-child td{border-bottom:none}
+tbody tr:hover{background:#1b2028}
+.mono{font-family:ui-monospace,Consolas,monospace}.small{font-size:12px}.muted{color:var(--muted)}
+.btn{display:inline-block;background:#222834;color:var(--txt);border:1px solid var(--line);border-radius:8px;padding:5px 12px;text-decoration:none;font-size:13px;cursor:pointer}
+.btn:hover{border-color:var(--acc);color:var(--acc)}
+a.lnk{color:var(--acc);text-decoration:none}a.lnk:hover{text-decoration:underline}
+details{background:var(--panel);border:1px solid var(--line);border-radius:8px;margin:6px 0}summary{cursor:pointer;padding:8px 12px}
+pre{margin:0;padding:12px;background:#0b0d11;border-top:1px solid var(--line);overflow:auto;max-height:480px;white-space:pre-wrap;word-break:break-word}
+.dtbar{display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin:12px 0}
+.dtbar input,.dtbar select{background:var(--panel);border:1px solid var(--line);border-radius:8px;color:var(--txt);padding:7px 10px}
+.dtsearch{flex:1;min-width:220px}
+.dtcount{margin-left:auto}
+th.dth{cursor:pointer;user-select:none;white-space:nowrap}th.dth:hover{color:var(--txt)}
+.dtfoot{display:flex;gap:12px;align-items:center;margin:10px 0}
+</style></head><body>
+<header><b>The Cycle · Admin</b>
+<a href='/admin'>Dashboard</a><a href='/admin/players'>Joueurs</a><a href='/admin/catalog'>Catalogue</a><a href='/admin/titledata'>TitleData</a>
+<span class='muted' style='margin-left:auto'>read-only · LAN</span></header>
+<main>";
+
+    private const string Foot = @"</main></body></html>";
+
+    // Client-side table engine, injected right after <main> so DT is defined before any
+    // page-level DT.init() runs. Single quotes only (verbatim string → JS braces stay literal).
+    private const string DtScript = @"<script>
+const DT={
+ init(cfg){const el=document.getElementById(cfg.id);el.innerHTML='<p class=muted>Chargement…</p>';
+   fetch(cfg.url).then(r=>r.json()).then(rows=>DT.build(el,cfg,rows)).catch(e=>{el.innerHTML='<p class=muted>Erreur: '+e+'</p>';});},
+ build(el,cfg,rows){el.innerHTML='';el._rows=rows;el._cfg=cfg;el._sort={k:null,d:1};el._page=1;el._size=cfg.size||25;el._filters={};el._q='';
+   const bar=document.createElement('div');bar.className='dtbar';
+   const s=document.createElement('input');s.className='dtsearch';s.placeholder='Rechercher…';s.oninput=()=>{el._q=s.value.toLowerCase();el._page=1;DT.draw(el);};bar.appendChild(s);
+   (cfg.filters||[]).forEach(fk=>{const vals=[...new Set(rows.map(r=>r[fk]).filter(v=>v!=null&&v!==''))].sort();
+     const sel=document.createElement('select');const o0=document.createElement('option');o0.value='';o0.textContent=fk;sel.appendChild(o0);
+     vals.forEach(v=>{const o=document.createElement('option');o.value=v;o.textContent=v;sel.appendChild(o);});
+     sel.onchange=()=>{el._filters[fk]=sel.value;el._page=1;DT.draw(el);};bar.appendChild(sel);});
+   const sz=document.createElement('select');[25,50,100,500].forEach(n=>{const o=document.createElement('option');o.value=n;o.textContent=n+'/page';sz.appendChild(o);});
+   const oa=document.createElement('option');oa.value='0';oa.textContent='Tout';sz.appendChild(oa);sz.value=el._size;
+   sz.onchange=()=>{el._size=+sz.value;el._page=1;DT.draw(el);};bar.appendChild(sz);
+   const cnt=document.createElement('span');cnt.className='dtcount muted';bar.appendChild(cnt);el._cnt=cnt;el.appendChild(bar);
+   const tbl=document.createElement('table');const th=document.createElement('thead');const tr=document.createElement('tr');
+   cfg.columns.forEach(c=>{const h=document.createElement('th');h.className='dth';h.dataset.k=c.key;h.textContent=c.label;h.onclick=()=>DT.sort(el,c.key);tr.appendChild(h);});
+   th.appendChild(tr);tbl.appendChild(th);el._head=tr;const tb=document.createElement('tbody');tbl.appendChild(tb);el._tb=tb;el.appendChild(tbl);
+   const ft=document.createElement('div');ft.className='dtfoot';
+   const pv=document.createElement('button');pv.className='btn';pv.textContent='‹ Préc.';pv.onclick=()=>{if(el._page>1){el._page--;DT.draw(el);}};
+   const nf=document.createElement('span');nf.className='muted';el._nfo=nf;
+   const nx=document.createElement('button');nx.className='btn';nx.textContent='Suiv. ›';nx.onclick=()=>{el._page++;DT.draw(el);};
+   ft.appendChild(pv);ft.appendChild(nf);ft.appendChild(nx);el.appendChild(ft);DT.draw(el);},
+ rows(el){const cfg=el._cfg;let rows=el._rows;
+   Object.keys(el._filters).forEach(k=>{const fv=el._filters[k];if(fv)rows=rows.filter(r=>(''+(r[k]??''))===fv);});
+   if(el._q)rows=rows.filter(r=>cfg.columns.some(c=>(''+(r[c.key]??'')).toLowerCase().includes(el._q)));
+   if(el._sort.k){const k=el._sort.k,d=el._sort.d;rows=[...rows].sort((a,b)=>{let x=a[k],y=b[k];const nx=parseFloat(x),ny=parseFloat(y);
+     if(!isNaN(nx)&&!isNaN(ny)&&(''+x).trim()!==''&&(''+y).trim()!==''){x=nx;y=ny;}else{x=(''+(x??'')).toLowerCase();y=(''+(y??'')).toLowerCase();}return x<y?-d:x>y?d:0;});}
+   return rows;},
+ sort(el,k){if(el._sort.k===k)el._sort.d*=-1;else{el._sort.k=k;el._sort.d=1;}el._page=1;DT.draw(el);},
+ draw(el){const cfg=el._cfg,rows=DT.rows(el),total=rows.length,size=el._size||total||1,pages=Math.max(1,Math.ceil(total/size));
+   if(el._page>pages)el._page=pages;const start=el._size?(el._page-1)*size:0;const slice=el._size?rows.slice(start,start+size):rows;
+   el._tb.innerHTML=slice.map(r=>'<tr>'+cfg.columns.map(c=>DT.cell(c,r)).join('')+'</tr>').join('')||'<tr><td colspan='+cfg.columns.length+' class=muted>Aucun résultat</td></tr>';
+   el._cnt.textContent=total+' résultat(s)';el._nfo.textContent='page '+el._page+'/'+pages;
+   [...el._head.children].forEach(h=>{const c=cfg.columns.find(x=>x.key===h.dataset.k);h.textContent=c.label+(el._sort.k===h.dataset.k?(el._sort.d>0?' ▲':' ▼'):'');});},
+ cell(c,r){let v=r[c.key];v=v==null?'':(''+v);
+   if(c.kind==='rarity')return '<td>'+DT.rarity(v)+'</td>';
+   if(c.kind==='link')return '<td><a class=lnk href='+c.base+encodeURIComponent(r[c.lkey||'id'])+'>'+DT.esc(v)+'</a></td>';
+   const cls=c.kind==='mono'?'mono small':'';return '<td class='+cls+'>'+DT.esc(v)+'</td>';},
+ rarity(r){if(!r)return '';const c={common:'#9aa4b2',uncommon:'#4caf50',rare:'#2f81f7',epic:'#a371f7',legendary:'#e8a838',exotic:'#e8a838'}[r.toLowerCase()]||'#9aa4b2';
+   return '<span style=color:'+c+';font-weight:600>'+DT.esc(r)+'</span>';},
+ esc(s){const d=document.createElement('div');d.textContent=(s==null?'':''+s);return d.innerHTML;}
+};
+</script>";
+}

src/Prospect.Server.Api/Controllers/ClientController.cs

@@ -1,10 +1,12 @@
 using System.Net.Mime;
+using System.Text.Json;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
 using Prospect.Server.Api.Config;
 using Prospect.Server.Api.Models.Client;
 using Prospect.Server.Api.Models.Client.Data;
+using Prospect.Server.Api.Models.Data;
 using Prospect.Server.Api.Services.Auth;
 using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.Auth.User;
@@ -21,6 +23,7 @@ public class ClientController : Controller
 {
     private const int AppIdDefault = 480;
     private const int AppIdCycleBeta = 1600361;
+    private const int AppIdCycle = 868270;
 
     private readonly ILogger<ClientController> _logger;
     private readonly PlayFabSettings _settings;
@@ -29,6 +32,7 @@ public class ClientController : Controller
     private readonly DbEntityService _entityService;
     private readonly UserDataService _userDataService;
     private readonly TitleDataService _titleDataService;
+    private readonly Prospect.Server.Api.Services.Steam.SteamWebApiService _steamWebApi;
 
     public ClientController(ILogger<ClientController> logger,
         IOptions<PlayFabSettings> settings,
@@ -36,7 +40,8 @@ public class ClientController : Controller
         DbUserService userService,
         DbEntityService entityService,
         UserDataService userDataService,
-        TitleDataService titleDataService)
+        TitleDataService titleDataService,
+        Prospect.Server.Api.Services.Steam.SteamWebApiService steamWebApi)
     {
         _settings = settings.Value;
         _logger = logger;
@@ -45,6 +50,7 @@ public class ClientController : Controller
         _entityService = entityService;
         _userDataService = userDataService;
         _titleDataService = titleDataService;
+        _steamWebApi = steamWebApi;
     }
 
     [AllowAnonymous]
@@ -55,11 +61,24 @@ public class ClientController : Controller
         if (!string.IsNullOrEmpty(request.SteamTicket))
         {
             var ticket = AppTicket.Parse(request.SteamTicket);
-            if (ticket.IsValid && ticket.HasValidSignature && (ticket.AppId == AppIdDefault || ticket.AppId == AppIdCycleBeta))
+            if (ticket.IsValid && ticket.HasValidSignature && (ticket.AppId == AppIdDefault || ticket.AppId == AppIdCycleBeta || ticket.AppId == AppIdCycle))
             {
                 var userSteamId = ticket.SteamId.ToString();
 
                 var user = await _userService.FindOrCreateAsync(PlayFabUserAuthType.Steam, userSteamId);
+
+                // Backfill the display name from the Steam persona when we don't have a real
+                // one yet (accounts are created as "Unknown"; the client never sends a name).
+                if (string.IsNullOrEmpty(user.DisplayName) || user.DisplayName == "Unknown")
+                {
+                    var persona = await _steamWebApi.GetPersonaNameAsync(userSteamId);
+                    if (!string.IsNullOrWhiteSpace(persona))
+                    {
+                        await _userService.UpdateDisplayNameAsync(user.Id, persona);
+                        user.DisplayName = persona;
+                    }
+                }
+
                 var entity = await _entityService.FindOrCreateAsync(user.Id);
 
                 var userTicket = _authTokenService.GenerateUser(entity);
@@ -137,8 +156,18 @@ public class ClientController : Controller
     [HttpPost("AddGenericID")]
     [Produces(MediaTypeNames.Application.Json)]
     [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult AddGenericId(FAddGenericIDRequest request)
+    public async Task<IActionResult> AddGenericId(FAddGenericIDRequest request)
     {
+        // Persist the linked generic service id instead of dropping it (was a no-op stub).
+        var userId = User.FindAuthUserId();
+        if (request.GenericId != null && !string.IsNullOrEmpty(request.GenericId.ServiceName))
+        {
+            await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>
+            {
+                ["GenericId_" + request.GenericId.ServiceName] = request.GenericId.UserId ?? ""
+            });
+        }
+
         return Ok(new ClientResponse<object>
         {
             Code = 200,
@@ -147,11 +176,136 @@ public class ClientController : Controller
         });
     }
 
+    [HttpPost("GetStoreItems")]
+    [Produces(MediaTypeNames.Application.Json)]
+    [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
+    public IActionResult GetStoreItems(FGetStoreItems request)
+    {
+        // The vendors (Korolev / ICA / Osiris / QuickShop) and other stores are defined
+        // inside the Blueprints title data: each item lists a per-store entry under
+        // ItemShopsCraftingData keyed by the store id, with the currency price in its
+        // recipe ingredients. This endpoint was previously a stub returning {}, which is
+        // why every shop showed up empty. We build the store on the fly from that data.
+        var storeId = request.StoreId ?? "";
+        var store = new List<FStoreItem>();
+        try
+        {
+            var titleData = _titleDataService.Find(new List<string> { "Blueprints" });
+            var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+            if (blueprints != null && !string.IsNullOrEmpty(storeId))
+            {
+                uint position = 0;
+                foreach (var (itemId, blueprint) in blueprints)
+                {
+                    if (blueprint.ItemShopsCraftingData == null) continue;
+                    if (!blueprint.ItemShopsCraftingData.TryGetValue(storeId, out var shopData)) continue;
+                    if (shopData?.ItemRecipeIngredients == null) continue;
+
+                    // Only currency ingredients form a purchasable price. Entries whose
+                    // recipe is item-based (crafting) are handled by the crafting UI from
+                    // the blueprint data the client already has, not by the buy store.
+                    var prices = new Dictionary<string, uint>();
+                    foreach (var ingredient in shopData.ItemRecipeIngredients)
+                    {
+                        var code = ingredient.Currency switch
+                        {
+                            "SoftCurrency" => "SC",
+                            "Aurum" => "AU",
+                            "InsuranceCurrency" => "IN",
+                            _ => null,
+                        };
+                        if (code == null || ingredient.Amount < 0) continue;
+                        prices[code] = prices.TryGetValue(code, out var current)
+                            ? current + (uint)ingredient.Amount
+                            : (uint)ingredient.Amount;
+                    }
+                    if (prices.Count == 0) continue;
+
+                    store.Add(new FStoreItem
+                    {
+                        ItemId = itemId,
+                        VirtualCurrencyPrices = prices,
+                        RealCurrencyPrices = new Dictionary<string, uint>(),
+                        DisplayPosition = position++,
+                    });
+                }
+            }
+        }
+        catch (Exception e)
+        {
+            _logger.LogWarning(e, "Failed to build store items for store {StoreId}", storeId);
+        }
+
+        // Cosmetic / premium stores are backed by the Vanities title data (not Blueprints):
+        // each vanity carries its price in StoreData.Amount, paid in Aurum. AurumShop lists
+        // the whole priced catalogue; the daily/weekly rotations (ids from RequestStore
+        // RotationData) show a deterministic slice so they change over time but stay stable
+        // within a period.
+        var isAurumShop = storeId == "AurumShop";
+        var isDailyShop = storeId.StartsWith("DailyShop_");
+        var isWeeklyShop = storeId.StartsWith("WeeklyShop_");
+        if (store.Count == 0 && (isAurumShop || isDailyShop || isWeeklyShop))
+        {
+            try
+            {
+                var vanityData = _titleDataService.Find(new List<string> { "Vanities" });
+                var vanities = JsonSerializer.Deserialize<List<TitleDataVanityInfo>>(vanityData["Vanities"]);
+                var priced = vanities?
+                    .Where(v => v.StoreData != null && v.StoreData.Amount > 0)
+                    .OrderBy(v => v.Name, StringComparer.Ordinal)
+                    .ToList() ?? new List<TitleDataVanityInfo>();
+
+                IEnumerable<TitleDataVanityInfo> selection = priced;
+                if ((isDailyShop || isWeeklyShop) && priced.Count > 0)
+                {
+                    var size = isWeeklyShop ? 12 : 6;
+                    int.TryParse(storeId[(storeId.IndexOf('_') + 1)..], out var rotation);
+                    var start = (int)(((long)rotation * size) % priced.Count);
+                    selection = Enumerable.Range(0, Math.Min(size, priced.Count))
+                        .Select(i => priced[(start + i) % priced.Count]);
+                }
+
+                uint position = 0;
+                foreach (var vanity in selection)
+                {
+                    store.Add(new FStoreItem
+                    {
+                        ItemId = vanity.Name,
+                        VirtualCurrencyPrices = new Dictionary<string, uint> { ["AU"] = (uint)vanity.StoreData.Amount },
+                        RealCurrencyPrices = new Dictionary<string, uint>(),
+                        DisplayPosition = position++,
+                    });
+                }
+            }
+            catch (Exception e)
+            {
+                _logger.LogWarning(e, "Failed to build vanity store {StoreId}", storeId);
+            }
+        }
+
+        _logger.LogInformation("GetStoreItems '{StoreId}': {Count} item(s)", storeId, store.Count);
+        return Ok(new ClientResponse<FGetStoreItemsResult>
+        {
+            Code = 200,
+            Status = "OK",
+            Data = new FGetStoreItemsResult
+            {
+                StoreId = string.IsNullOrEmpty(storeId) ? null : storeId,
+                CatalogVersion = "StaticItems",
+                Store = store,
+            }
+        });
+    }
+
     [HttpPost("UpdateUserTitleDisplayName")]
     [Produces(MediaTypeNames.Application.Json)]
     [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult UpdateUserTitleDisplayName(FUpdateUserTitleDisplayNameRequest request)
+    public async Task<IActionResult> UpdateUserTitleDisplayName(FUpdateUserTitleDisplayNameRequest request)
     {
+        // Persist the rename, otherwise it is echoed back but lost on next login.
+        var userId = User.FindAuthUserId();
+        await _userService.UpdateDisplayNameAsync(userId, request.DisplayName);
+
         return Ok(new ClientResponse<FUpdateUserTitleDisplayNameResult>
         {
             Code = 200,
@@ -205,15 +359,18 @@ public class ClientController : Controller
     [HttpPost("GetUserReadOnlyData")]
     [Produces(MediaTypeNames.Application.Json)]
     [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult GetUserReadOnlyData(FGetUserDataRequest request)
+    public async Task<IActionResult> GetUserReadOnlyData(FGetUserDataRequest request)
     {
+        var userId = User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, request.PlayFabId, request.Keys);
+
         return Ok(new ClientResponse<FGetUserDataResult>
         {
             Code = 200,
             Status = "OK",
             Data = new FGetUserDataResult
             {
-                Data = new Dictionary<string, FUserDataRecord>(),
+                Data = userData,
                 DataVersion = 0
             }
         });
@@ -222,45 +379,124 @@ public class ClientController : Controller
     [HttpPost("GetUserInventory")]
     [Produces(MediaTypeNames.Application.Json)]
     [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]
-    public IActionResult GetUserReadOnlyData(FGetUserInventoryRequest request)
+    public async Task<IActionResult> GetUserInventory(FGetUserInventoryRequest request)
     {
+        var userId = User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Balance", "Inventory", "VanityItems", "CharacterVanity", "GlobalVanity"});
+        var inventory = JsonSerializer.Deserialize<FYCustomItemInfo[]>(userData["Inventory"].Value);
+        // Per-user vanity ownership: the player owns the cosmetics they've bought (VanityItems)
+        // plus whatever is currently equipped (CharacterVanity / GlobalVanity), so the starter
+        // outfit stays owned. Previously the whole Vanities catalogue was returned as owned,
+        // which made every item in the Aurum shop show up as already "owned".
+        var ownedVanityIds = CollectOwnedVanityIds(userData);
+        var titleData = _titleDataService.Find(new List<string>{"Blueprints"});
+        var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+        List<FItemInstance> items = new List<FItemInstance>();
+        foreach (var item in inventory) {
+            if (!blueprints.ContainsKey(item.BaseItemId)) {
+                _logger.LogWarning("Failed to find item with ID {ItemID}", item.BaseItemId);
+                continue;
+            }
+            var blueprintData = blueprints[item.BaseItemId];
+            items.Add(new FItemInstance {
+                ItemId = item.BaseItemId,
+                ItemInstanceId = item.ItemId,
+                ItemClass = blueprintData.Kind,
+                // PurchaseDate = DateTime.Now, // TODO
+                // UnitPrice = 0,
+                CatalogVersion = "StaticItems",
+                CustomData = new Dictionary<string, string> {
+                    ["mods"] = JsonSerializer.Serialize(item.ModData),
+                    // ["insurance"] = "None", // TODO
+                    ["vanity"] = $"{{\"p\":{item.PrimaryVanityId},\"s\":{item.SecondaryVanityId}}}", // p - primary, s - secondary
+                    ["coreData"] = $"{{\"a\":{item.Amount},\"d\":{item.Durability}}}", // a - amount, d - durability
+                    ["origin"] = JsonSerializer.Serialize(item.Origin),
+                    ["rolledPerks"] = JsonSerializer.Serialize(item.RolledPerks),
+                }
+            });
+        }
+
+        foreach (var vanityId in ownedVanityIds) {
+            items.Add(new FItemInstance {
+                ItemId = vanityId,
+                // ItemInstanceId is not required since it's not a unique item.
+                ItemClass = "Vanity",
+                // PurchaseDate = DateTime.Now, // TODO
+                CatalogVersion = "StaticItems",
+                CustomData = new Dictionary<string, string> {
+                    ["coreData"] = "{}", // Vanity items don't seem to have any coreData. But it's still required since it's an inventory item.
+                    ["origin"] = "{}",
+                }
+            });
+        }
+
         return Ok(new ClientResponse<FGetUserInventoryResult>
         {
             Code = 200,
             Status = "OK",
             Data = new FGetUserInventoryResult
             {
-                Inventory = new List<FItemInstance>
+                Inventory = items,
-                {
+                VirtualCurrency = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value),
-                    // new FItemInstance
-                    // {
-                    //     ItemId = "Helmet_03",
-                    //     ItemInstanceId = "0102030405060708",
-                    //     ItemClass = "Helmet",
-                    //     PurchaseDate = DateTime.Now.AddDays(-1),
-                    //     CatalogVersion = "StaticItems",
-                    //     DisplayName = "Helmet",
-                    //     UnitPrice = 0,
-                    //     CustomData = new Dictionary<string, string>
-                    //     {
-                    //         ["insurance"] = "None",
-                    //         ["mods"] = "{\"m\":[]}",
-                    //         ["vanity_misc_data"] = "{\"v\":\"\",\"s\":\"\",\"l\":3,\"a\":1,\"d\":300}"
-                    //     }
-                    // }
-                },
-                VirtualCurrency = new Dictionary<string, int>
-                {
-                    ["AE"] = 0,
-                    ["AS"] = 0,
-                    ["AU"] = int.MaxValue,
-                    ["SC"] = int.MaxValue
-                },
                 VirtualCurrencyRechargeTimes = new Dictionary<string, FVirtualCurrencyRechargeTime>()
             }
         });
     }
 
+    // Collects the vanity ids a player actually owns: everything they've purchased
+    // (VanityItems) plus everything currently equipped (CharacterVanity slots and the
+    // GlobalVanity sprays / banner / emotes / drop pod). Parsed defensively with
+    // JsonDocument so malformed / partial data never breaks the inventory response.
+    private static HashSet<string> CollectOwnedVanityIds(Dictionary<string, FUserDataRecord> userData)
+    {
+        var owned = new HashSet<string>(StringComparer.Ordinal);
+        void AddId(string? id) { if (!string.IsNullOrEmpty(id)) owned.Add(id); }
+
+        if (userData.TryGetValue("VanityItems", out var viRec) && !string.IsNullOrWhiteSpace(viRec.Value))
+        {
+            try
+            {
+                using var doc = JsonDocument.Parse(viRec.Value);
+                if (doc.RootElement.ValueKind == JsonValueKind.Array)
+                    foreach (var el in doc.RootElement.EnumerateArray())
+                        if (el.ValueKind == JsonValueKind.Object && el.TryGetProperty("baseItemId", out var b))
+                            AddId(b.GetString());
+            }
+            catch { /* ignore malformed VanityItems */ }
+        }
+
+        if (userData.TryGetValue("CharacterVanity", out var cvRec) && !string.IsNullOrWhiteSpace(cvRec.Value))
+        {
+            try
+            {
+                using var doc = JsonDocument.Parse(cvRec.Value);
+                if (doc.RootElement.ValueKind == JsonValueKind.Object)
+                    foreach (var prop in doc.RootElement.EnumerateObject())
+                        if (prop.Value.ValueKind == JsonValueKind.Object && prop.Value.TryGetProperty("id", out var id))
+                            AddId(id.GetString());
+            }
+            catch { /* ignore malformed CharacterVanity */ }
+        }
+
+        if (userData.TryGetValue("GlobalVanity", out var gvRec) && !string.IsNullOrWhiteSpace(gvRec.Value))
+        {
+            try
+            {
+                using var doc = JsonDocument.Parse(gvRec.Value);
+                var root = doc.RootElement;
+                if (root.ValueKind == JsonValueKind.Object)
+                {
+                    if (root.TryGetProperty("activeGlobalVanityIds", out var arr) && arr.ValueKind == JsonValueKind.Array)
+                        foreach (var el in arr.EnumerateArray()) AddId(el.GetString());
+                    if (root.TryGetProperty("droppodId", out var dp)) AddId(dp.GetString());
+                }
+            }
+            catch { /* ignore malformed GlobalVanity */ }
+        }
+
+        return owned;
+    }
+
     [HttpPost("GetTitleData")]
     [Produces(MediaTypeNames.Application.Json)]
     [Authorize(AuthenticationSchemes = UserAuthenticationOptions.DefaultScheme)]

src/Prospect.Server.Api/Hubs/CycleHub.cs

@@ -1,8 +1,31 @@
-using Microsoft.AspNetCore.SignalR;
+using Microsoft.AspNetCore.SignalR;
 
 namespace Prospect.Server.Api.Hubs;
 
 public class CycleHub : Hub
 {
+    private readonly SignalRConnectionRegistry _registry;
 
+    public CycleHub(SignalRConnectionRegistry registry)
+    {
+        _registry = registry;
+    }
+
+    public override async Task OnConnectedAsync()
+    {
+        // The client connects with the SignalR URL returned by GetSignalRConnection, which
+        // carries a `uid` query param — use it to map this connection to the player so
+        // server-initiated messages can target a single player instead of everyone.
+        var uid = Context.GetHttpContext()?.Request.Query["uid"].ToString();
+        if (!string.IsNullOrEmpty(uid))
+            _registry.Add(uid, Context.ConnectionId);
+        Console.WriteLine("Connected {0} (uid={1})", Context.ConnectionId, uid);
+        await base.OnConnectedAsync();
+    }
+
+    public override async Task OnDisconnectedAsync(Exception? exception)
+    {
+        _registry.Remove(Context.ConnectionId);
+        await base.OnDisconnectedAsync(exception);
+    }
 }

src/Prospect.Server.Api/Hubs/SignalRConnectionRegistry.cs

@@ -0,0 +1,29 @@
+using System.Collections.Concurrent;
+
+namespace Prospect.Server.Api.Hubs;
+
+// Maps players to their live SignalR connection so server-initiated messages (e.g. the
+// matchmaking-success "travel to match" signal) can target a single player instead of being
+// broadcast to everyone. The client's SignalR URL carries a `uid` query param (added by
+// GetSignalRConnection); CycleHub records it on connect.
+public class SignalRConnectionRegistry
+{
+    private readonly ConcurrentDictionary<string, string> _userToConn = new();
+    private readonly ConcurrentDictionary<string, string> _connToUser = new();
+
+    public void Add(string userId, string connectionId)
+    {
+        if (string.IsNullOrEmpty(userId)) return;
+        _userToConn[userId] = connectionId;
+        _connToUser[connectionId] = userId;
+    }
+
+    public void Remove(string connectionId)
+    {
+        if (_connToUser.TryRemove(connectionId, out var userId))
+            _userToConn.TryRemove(userId, out _);
+    }
+
+    public string? GetConnection(string userId)
+        => _userToConn.TryGetValue(userId, out var c) ? c : null;
+}

src/Prospect.Server.Api/Middleware/RequestLoggerMiddleware.cs

@@ -9,6 +9,14 @@ public class RequestLoggerMiddleware
     private readonly ILogger<RequestLoggerMiddleware> _logger;
     private readonly RequestDelegate _next;
 
+    // Keywords used to surface social/squad/invite traffic while reverse-engineering the
+    // squad-invite flow (see SQUAD-EMULATION.md). Matched against the path AND the body
+    // (the CloudScript function name lives in the body of /Client/ExecuteFunction).
+    private static readonly string[] SocialKeywords =
+    {
+        "group", "party", "lobby", "squad", "invite", "friend", "social", "matchmak",
+    };
+
     public RequestLoggerMiddleware(ILogger<RequestLoggerMiddleware> logger, RequestDelegate next)
     {
         _logger = logger;
@@ -32,6 +40,27 @@ public class RequestLoggerMiddleware
         }
 
         await _next(context);
+
+        // ── Capture pass (squad-invite RE, see SQUAD-EMULATION.md) ──────────────
+        // Runs AFTER the pipeline so we know whether the request was actually routed.
+        if (context.Request.Method == "POST")
+        {
+            var path = context.Request.Path.Value ?? "";
+            var haystack = (path + " " + body).ToLowerInvariant();
+
+            // Any POST that fell through to a 404 = an endpoint the emulator does NOT implement
+            // (e.g. a native PlayFab /Group/CreateGroup or /Lobby/* the client tried to call).
+            if (context.Response.StatusCode == 404)
+            {
+                _logger.LogWarning("[CAPTURE UNROUTED] {Method} {Url} -> 404 | Body {Body}",
+                    context.Request.Method, context.Request.GetDisplayUrl(), body);
+            }
+            else if (SocialKeywords.Any(k => haystack.Contains(k)))
+            {
+                _logger.LogInformation("[CAPTURE SOCIAL] {Url} ({Status}) | Body {Body}",
+                    context.Request.GetDisplayUrl(), context.Response.StatusCode, body);
+            }
+        }
     }
 
     private static async Task<string> RequestAsync(HttpRequest request)

src/Prospect.Server.Api/Models/Client/Data/FStoreItem.cs

@@ -0,0 +1,39 @@
+using System.Text.Json.Serialization;
+
+namespace Prospect.Server.Api.Models.Client.Data;
+
+// PlayFab StoreItem: a single catalog item offered for sale in a store, with its prices.
+public class FStoreItem
+{
+    /// <summary>
+    ///     [optional] Store specific custom data. The data only exists as part of this store; it is not transferred to item instances.
+    /// </summary>
+    [JsonPropertyName("CustomData")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    public object? CustomData { get; set; }
+
+    /// <summary>
+    ///     [optional] Intended display position for this item. Note that 0 is the first position and -1 is the last position.
+    /// </summary>
+    [JsonPropertyName("DisplayPosition")]
+    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
+    public uint? DisplayPosition { get; set; }
+
+    /// <summary>
+    ///     Unique identifier of the item as it exists in the catalog - note that this must exactly match the ItemId from the catalog.
+    /// </summary>
+    [JsonPropertyName("ItemId")]
+    public string ItemId { get; set; } = "";
+
+    /// <summary>
+    ///     [optional] Override prices for this item for specific currencies.
+    /// </summary>
+    [JsonPropertyName("RealCurrencyPrices")]
+    public Dictionary<string, uint> RealCurrencyPrices { get; set; } = new();
+
+    /// <summary>
+    ///     [optional] Override prices for this item in virtual currencies and "RM" (the base Real Money purchase price, in USD pennies).
+    /// </summary>
+    [JsonPropertyName("VirtualCurrencyPrices")]
+    public Dictionary<string, uint> VirtualCurrencyPrices { get; set; } = new();
+}

src/Prospect.Server.Api/Models/Client/FGetStoreItems.cs

@@ -0,0 +1,19 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Client.Data;
+
+namespace Prospect.Server.Api.Models.Client;
+
+public class FGetStoreItems
+{
+    /// <summary>
+    ///     [optional] Catalog version to store items from. Use default catalog version if null.
+    /// </summary>
+    [JsonPropertyName("CatalogVersion")]
+    public string? CatalogVersion { get; set; }
+
+    /// <summary>
+    ///     Unique identifier for the store which is being requested.
+    /// </summary>
+    [JsonPropertyName("StoreId")]
+    public string? StoreId { get; set; }
+}

src/Prospect.Server.Api/Models/Client/FGetStoreItemsResult.cs

@@ -0,0 +1,25 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Client.Data;
+
+namespace Prospect.Server.Api.Models.Client;
+
+public class FGetStoreItemsResult
+{
+    /// <summary>
+    ///     [optional] The base catalog that this store is a part of.
+    /// </summary>
+    [JsonPropertyName("CatalogVersion")]
+    public string? CatalogVersion { get; set; }
+
+    /// <summary>
+    ///     [optional] Array of items which can be purchased from this store.
+    /// </summary>
+    [JsonPropertyName("Store")]
+    public List<FStoreItem> Store { get; set; } = new();
+
+    /// <summary>
+    ///     [optional] The ID of this store.
+    /// </summary>
+    [JsonPropertyName("StoreId")]
+    public string? StoreId { get; set; }
+}

src/Prospect.Server.Api/Models/Client/FGetUserInventoryResult.cs

@@ -1,5 +1,6 @@
 using System.Text.Json.Serialization;
 using Prospect.Server.Api.Models.Client.Data;
+using Prospect.Server.Api.Models.Data;
 
 namespace Prospect.Server.Api.Models.Client;
 
@@ -17,7 +18,7 @@ public class FGetUserInventoryResult
     /// </summary>
     [JsonPropertyName("VirtualCurrency")]
     [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingDefault)]
-    public Dictionary<string, int>? VirtualCurrency { get; set; }
+    public PlayerBalance? VirtualCurrency { get; set; }
 
     /// <summary>
     ///     [optional] Array of virtual currency balance(s) belonging to the user.

src/Prospect.Server.Api/Models/Data/DatabaseModels.cs

@@ -0,0 +1,25 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+
+namespace Prospect.Server.Api.Models.Data;
+
+public class PlayerBalance
+{
+    [JsonPropertyName("AU")]
+    public int HardCurrency { get; set; }
+
+    [JsonPropertyName("SC")]
+    public int SoftCurrency { get; set; }
+
+    [JsonPropertyName("IN")]
+    public int InsuranceCurrency { get; set; }
+}
+
+public class JobBoardsData
+{
+    [JsonPropertyName("lastBoardRefreshTimeUtc")]
+    public FYTimestamp LastBoardRefreshTimeUtc { get; set; }
+
+    [JsonPropertyName("boards")]
+    public List<FYFactionContractsData> Boards { get; set; }
+}

src/Prospect.Server.Api/Models/Title/ContractInfo.cs

@@ -0,0 +1,154 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataContractInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("Faction")]
+    public string Faction { get; set; }
+    [JsonPropertyName("ReputationIncrease")]
+    public int ReputationIncrease { get; set; }
+    [JsonPropertyName("Rewards")]
+    public TitleDataContractInfoReward[] Rewards { get; set; }
+    [JsonPropertyName("Objectives")]
+    public TitleDataContractInfoObjective[] Objectives { get; set; }
+    [JsonPropertyName("UnlockData")]
+    public TitleDataContractInfoUnlockData UnlockData { get; set; }
+    [JsonPropertyName("IsMainContract")]
+    public bool IsMainContract { get; set; }
+    [JsonPropertyName("ContractDifficulty")]
+    public EYContractDifficulty ContractDifficulty { get; set; }
+}
+
+public class TitleDataContractInfoReward {
+    [JsonPropertyName("ItemID")]
+    public string ItemID { get; set; }
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}
+
+public class TitleDataContractInfoObjective {
+    [JsonPropertyName("Type")]
+    public EYContractObjectiveType Type { get; set; }
+    [JsonPropertyName("MaxProgress")]
+    public int MaxProgress { get; set; }
+    [JsonPropertyName("ItemToOwn")]
+    public string ItemToOwn { get; set; }
+    [JsonPropertyName("KillConditions")]
+    public TitleDataContractInfoObjectiveKillConditions? KillConditions { get; set; }
+}
+
+public class TitleDataContractInfoObjectiveKillConditions
+{
+    [JsonPropertyName("KillTarget")]
+    public EYKillTypeAction KillTarget { get; set; }
+    [JsonPropertyName("AllowedWeaponCategories")]
+    public EYDeviceCategory[] AllowedWeaponCategories { get; set; }
+    [JsonPropertyName("AllowedSpecificWeapons")]
+    public string[] AllowedSpecificWeapons { get; set; }
+    [JsonPropertyName("SpecificAIEnemyTypeToKill")]
+    public EYEnemyType SpecificAIEnemyTypeToKill { get; set; }
+    [JsonPropertyName("MapName")]
+    public string MapName { get; set; }
+    [JsonPropertyName("OnlyDuringStorm")]
+    public bool OnlyDuringStorm { get; set; }
+}
+
+public class TitleDataContractInfoUnlockData {
+    [JsonPropertyName("Level")]
+    public int Level { get; set; }
+    [JsonPropertyName("Contracts")]
+    public HashSet<string> Contracts { get; set; }
+}
+
+public enum EYContractObjectiveType {
+	Invalid = 0,
+	Kills = 1,
+	OwnNumOfItem = 2,
+	DeadDrop = 3,
+	VisitArea = 4,
+    LootContainer = 5,
+    FactionLevel = 6,
+    CompletedMission = 7,
+	MAX = 8
+}
+
+public static class ContractObjectiveTypeExtensions {
+    // Objectives that can only be observed while a raid is running (kills, dead-drops,
+    // visiting an area, looting a container). The raid is hosted by the player's own
+    // client and there is no dedicated game server, so their progress is never reported
+    // to the backend (UpdatePlayerActiveContracts is never called). They are therefore
+    // auto-credited server-side, otherwise these contracts can never be completed.
+    // OwnNumOfItem is excluded (validated against the real stash) and so are the meta
+    // objectives FactionLevel / CompletedMission (validated from persisted player data).
+    public static bool IsRaidRuntime(this EYContractObjectiveType type) =>
+        type is EYContractObjectiveType.Kills
+             or EYContractObjectiveType.DeadDrop
+             or EYContractObjectiveType.VisitArea
+             or EYContractObjectiveType.LootContainer;
+}
+
+public enum EYContractDifficulty
+{
+	Invalid  = 0,
+	Easy     = 1,
+	Medium   = 2,
+	Hard     = 3,
+	MAX      = 4
+};
+
+public enum EYDeviceCategory
+{
+    AssaultRifle = 0,
+	Pistol       = 1,
+	SMG          = 2,
+	SniperRifle  = 3,
+	HeavyWeapon  = 4,
+	Shotgun      = 5,
+	BurstRifle   = 6,
+	Exotic       = 7,
+	MissileLauncher = 8,
+	Scanner      = 9,
+	All          = 10,
+	INVALID      = 11,
+	MAX          = 12
+};
+
+public enum EYKillTypeAction
+{
+    Invalid      = 0,
+	Players      = 1,
+	Creatures    = 2,
+	All          = 3,
+	MAX          = 4
+};
+
+public enum EYEnemyType
+{
+    None              = 0,
+	DebugAutomationTest = 1,
+	DirtBeast_Melee   = 2,
+	DirtBeast_RangedShort = 3,
+	DirtBeast_RangedMedium = 4,
+	DirtBeast_RangedLong = 5,
+	DirtBeast_MeleeHeavy = 6,
+	DirtBeast_RangedHeavy = 7,
+	DirtBeast_FlyingHeavy = 8,
+	DirtBeast_Boss    = 9,
+	Orobot_Melee      = 10,
+	Orobot_RangedShort = 11,
+	Orobot_RangedMedium = 12,
+	Orobot_Walker     = 13,
+	Orobot_Platform   = 14,
+	Plunderbot_RangedShort = 15,
+	Plunderbot_RangedMedium = 16,
+	Plunderbot_RangedLong = 17,
+	GlowBeetle_Blast  = 18,
+	GlowBeetle_Acid   = 19,
+	GlowBeetle_Summon = 20,
+	Strider           = 21,
+	Rattler           = 22,
+	Weremole          = 23,
+	Crusher           = 24,
+	Howler = 25,
+	MAX   = 26
+};

src/Prospect.Server.Api/Models/Title/DailyCrateInfo.cs

@@ -0,0 +1,10 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataDailyCrateInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("Weight")]
+    public float Weight { get; set; }
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}

src/Prospect.Server.Api/Models/Title/ItemInfo.cs

@@ -0,0 +1,142 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataBlueprintInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("ItemShopsCraftingData")]
+    public Dictionary<string, TitleDataItemShopsCraftingData> ItemShopsCraftingData { get; set; }
+    [JsonPropertyName("AmountPerPurchase")]
+    public int AmountPerPurchase { get; set; }
+    [JsonPropertyName("DurabilityMax")]
+    public int DurabilityMax { get; set; }
+    [JsonPropertyName("DurabilityBrokenScrappingReturnModifier")]
+    public double DurabilityBrokenScrappingReturnModifier { get; set; }
+    [JsonPropertyName("RepairCostMaxDurability")]
+    public int RepairCostMaxDurability { get; set; }
+    [JsonPropertyName("RepairCostBase")]
+    public int RepairCostBase { get; set; }
+    [JsonPropertyName("RepairCostModifierBroken")]
+    public int RepairCostModifierBroken { get; set; }
+    [JsonPropertyName("ItemWeight")]
+    public double ItemWeight { get; set; }
+    [JsonPropertyName("ScrappingReturnDefault")]
+    public int ScrappingReturnDefault { get; set; }
+    [JsonPropertyName("OverrideScrappingReturns")]
+    public int OverrideScrappingReturns { get; set; }
+    [JsonPropertyName("OverrideScrappingReputation")]
+    public int OverrideScrappingReputation { get; set; }
+    [JsonPropertyName("ScrappingFactionProgressionIncrement")]
+    public int ScrappingFactionProgressionIncrement { get; set; }
+	[JsonPropertyName("UnlockData")]
+    public TitleDataItemUnlockData UnlockData { get; set; }
+	[JsonPropertyName("ModID")]
+    public int? ModID { get; set; }
+	[JsonPropertyName("AlienForgeCatalystToUpgradedItemMap")]
+    public TitleDataItemAlienForgeCatalystToUpgradedItemMap AlienForgeCatalystToUpgradedItemMap { get; set; }
+    [JsonPropertyName("Rarity")]
+    public int Rarity { get; set; }
+    [JsonPropertyName("Kind")]
+    public string Kind { get; set; }
+    [JsonPropertyName("MaxAmountPerStack")]
+    public int MaxAmountPerStack { get; set; }
+}
+
+public class TitleDataItemShopsCraftingData {
+    [JsonPropertyName("ItemRecipeIngredients")]
+    public List<TitleDataItemRecipeCostType> ItemRecipeIngredients { get; set; }
+	[JsonPropertyName("UpgradeTimeMinutes")]
+    public int UpgradeTimeMinutes { get; set; }
+	[JsonPropertyName("UpgradeTimeSeconds")]
+    public int UpgradeTimeSeconds { get; set; }
+	[JsonPropertyName("SkipCraftingMaxCost")]
+    public int SkipCraftingMaxCost { get; set; }
+	[JsonPropertyName("SkipOptionalCraftingMaxCost")]
+    public int SkipOptionalCraftingMaxCost { get; set; }
+}
+
+public class TitleDataItemRecipeCostType {
+    [JsonPropertyName("Item")]
+    public string Currency { get; set; }
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}
+
+public class TitleDataItemUnlockData {
+    [JsonPropertyName("FactionUnlockLevel")]
+    public int FactionUnlockLevel { get; set; }
+    [JsonPropertyName("ContractLockPurchase")]
+    public string ContractLockPurchase { get; set; }
+	[JsonPropertyName("ContractLockCrafting")]
+    public string ContractLockCrafting { get; set; }
+}
+
+public class TitleDataItemAlienForgeCatalystToUpgradedItemMap {
+	[JsonPropertyName("Catalyst")]
+    public string Catalyst { get; set; }
+    [JsonPropertyName("NextItem")]
+    public string NextItem { get; set; }
+}
+
+/*
+enum class EYItemType : uint8_t
+{
+	EYItemType__None               = 0,
+	EYItemType__Device             = 1,
+	EYItemType__Ability            = 2,
+	EYItemType__Kit                = 3,
+	EYItemType__Consumable         = 4,
+	EYItemType__Mod                = 5,
+	EYItemType__Blueprint          = 6,
+	EYItemType__Material           = 7,
+	EYItemType__Miscellaneous      = 8,
+	EYItemType__Currency           = 9,
+	EYItemType__Vanity             = 10,
+	EYItemType__Experience         = 11,
+	EYItemType__Lore               = 12,
+	EYItemType__Vehicle            = 13,
+	EYItemType__Ammo               = 14,
+	EYItemType__Upgrade            = 15,
+	EYItemType__Collectible        = 16,
+	EYItemType__QuestItem          = 17,
+	EYItemType__Shield             = 18,
+	EYItemType__ProspectorBadge    = 19,
+	EYItemType__TechTreeNode       = 20,
+	EYItemType__PlayerQuartersLevel = 21,
+	EYItemType__PassiveGenerator   = 22,
+	EYItemType__Bag                = 23,
+	EYItemType__Helmet             = 24,
+	EYItemType__Key                = 25,
+	EYItemType__MeleeWeapon        = 26,
+	EYItemType__All                = 27,
+	EYItemType__MAX                = 28
+};
+
+enum class EYItemOriginType : uint8_t
+{
+	EYItemOriginType__Undefined    = 0,
+	EYItemOriginType__Contract     = 1,
+	EYItemOriginType__Craft        = 2,
+	EYItemOriginType__Creature     = 3,
+	EYItemOriginType__Debug        = 4,
+	EYItemOriginType__FortunaPass  = 5,
+	EYItemOriginType__FTUE         = 6,
+	EYItemOriginType__Generator    = 7,
+	EYItemOriginType__Insurance    = 8,
+	EYItemOriginType__MapContainerLoot = 9,
+	EYItemOriginType__MapPickupLoot = 10,
+	EYItemOriginType__MatchSplitStack = 11,
+	EYItemOriginType__MatchUnknown = 12,
+	EYItemOriginType__PlayFabDashboard = 13,
+	EYItemOriginType__PurchaseICA  = 14,
+	EYItemOriginType__PurchaseKorolev = 15,
+	EYItemOriginType__PurchaseOsiris = 16,
+	EYItemOriginType__PurchaseQuickShop = 17,
+	EYItemOriginType__Retention    = 18,
+	EYItemOriginType__StationSplitStack = 19,
+	EYItemOriginType__TocMigration = 20,
+	EYItemOriginType__TwitchDrop   = 21,
+	EYItemOriginType__Uplink       = 22,
+	EYItemOriginType__WeaponAttachment = 23,
+	EYItemOriginType__EYItemOriginType_MAX = 24
+};
+*/

src/Prospect.Server.Api/Models/Title/MissionInfo.cs

@@ -0,0 +1,46 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataMissionInfo {
+    [JsonPropertyName("MissionId")]
+    public string MissionId { get; set; }
+    [JsonPropertyName("NextMissionRowHandle")]
+    public UDataTable NextMissionRowHandle { get; set; }
+    [JsonPropertyName("OnboardingRewards")]
+    public UDataTable OnboardingRewards { get; set; }
+}
+
+// {\"TalkToBadumReward\":{\"MissionRewardId\":\"TalkToBadumReward\",\"RewardEntries\":[{\"RewardType\":7,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Weapons.PRO_Weapons\\u0027\",\"RowName\":\"WP_E_SMG_Bullet_01\"},\"RewardAmount\":2},{\"RewardType\":7,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Weapons.PRO_Weapons\\u0027\",\"RowName\":\"WP_E_AR_Energy_01\"},\"RewardAmount\":1},{\"RewardType\":7,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Weapons.PRO_Weapons\\u0027\",\"RowName\":\"WP_E_Pistol_Bullet_01\"},\"RewardAmount\":5},{\"RewardType\":7,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Weapons.PRO_Weapons\\u0027\",\"RowName\":\"WP_E_SGun_Bullet_01\"},\"RewardAmount\":2},{\"RewardType\":6,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/AmmoTypes_DT.AmmoTypes_DT\\u0027\",\"RowName\":\"Light\"},\"RewardAmount\":6},{\"RewardType\":6,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/AmmoTypes_DT.AmmoTypes_DT\\u0027\",\"RowName\":\"Medium\"},\"RewardAmount\":4},{\"RewardType\":6,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/AmmoTypes_DT.AmmoTypes_DT\\u0027\",\"RowName\":\"Shotgun\"},\"RewardAmount\":2},{\"RewardType\":8,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Abilities.PRO_Abilities\\u0027\",\"RowName\":\"ShockGrenade_02\"},\"RewardAmount\":2},{\"RewardType\":8,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Abilities.PRO_Abilities\\u0027\",\"RowName\":\"Consumable_Health_01\"},\"RewardAmount\":5},{\"RewardType\":0,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_PlayerShield.PRO_PlayerShield\\u0027\",\"RowName\":\"Shield_01\"},\"RewardAmount\":5},{\"RewardType\":10,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Bags.PRO_Bags\\u0027\",\"RowName\":\"Bag_01\"},\"RewardAmount\":5},{\"RewardType\":7,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/PRO_Weapons.PRO_Weapons\\u0027\",\"RowName\":\"TOOL_MineralScanner_01\"},\"RewardAmount\":2}]},\"FirstMatchReward\":{\"MissionRewardId\":\"FirstMatchReward\",\"RewardEntries\":[{\"RewardType\":2,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/Materials_DT.Materials_DT\\u0027\",\"RowName\":\"Insulation\"},\"RewardAmount\":4},{\"RewardType\":1,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/Currencies_DT.Currencies_DT\\u0027\",\"RowName\":\"SoftCurrency\"},\"RewardAmount\":1500},{\"RewardType\":2,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/Materials_DT.Materials_DT\\u0027\",\"RowName\":\"GenericCreatureDrop\"},\"RewardAmount\":3},{\"RewardType\":2,\"RewardRowHandle\":{\"DataTable\":\"DataTable\\u0027/Game/DataTables/Materials_DT.Materials_DT\\u0027\",\"RowName\":\"ICAScrip\"},\"RewardAmount\":1}]}}",
+
+public class TitleDataMissionRewardInfo {
+    [JsonPropertyName("MissionRewardId")]
+    public string MissionRewardId { get; set; }
+    [JsonPropertyName("RewardEntries")]
+    public TitleDataMissionRewardEntry[] RewardEntries { get; set; }
+}
+
+public class TitleDataMissionRewardEntry {
+    [JsonPropertyName("RewardType")]
+    public int RewardType { get; set; }
+    [JsonPropertyName("RewardRowHandle")]
+    public UDataTable RewardRowHandle { get; set; }
+    [JsonPropertyName("RewardAmount")]
+    public int RewardAmount { get; set; }
+}
+
+/*
+enum class EYRewardType : uint8_t
+{
+	EYRewardType__None             = 0,
+	EYRewardType__Currency         = 1,
+	EYRewardType__Material         = 2,
+	EYRewardType__Reputation       = 3,
+	EYRewardType__SeasonXP         = 4,
+	EYRewardType__ProspectorLevel  = 5,
+	EYRewardType__Ammo             = 6,
+	EYRewardType__Weapon           = 7,
+	EYRewardType__Consumable       = 8,
+	EYRewardType__Armor            = 9,
+	EYRewardType__Bag              = 10,
+	EYRewardType__MAX              = 11
+};
+*/

src/Prospect.Server.Api/Models/Title/PassiveGeneratorsInfo.cs

@@ -0,0 +1,14 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataPassiveGeneratorsInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("GeneratorID")]
+    public string GeneratorID { get; set; }
+    [JsonPropertyName("BaseGenIntervalMinutes")]
+    public int BaseGenIntervalMinutes { get; set; }
+    [JsonPropertyName("BaseGenRate")]
+    public int BaseGenRate { get; set; }
+    [JsonPropertyName("BaseCap")]
+    public int BaseCap { get; set; }
+}

src/Prospect.Server.Api/Models/Title/PlayerQuartersInfo.cs

@@ -0,0 +1,23 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataPlayerQuartersInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("NodeUpgradesRequired")]
+    public int NodeUpgradesRequired { get; set; }
+    [JsonPropertyName("UpgradeCosts")]
+    public TitleDataPlayerQuartersUpgradeCosts[] UpgradeCosts { get; set; }
+    [JsonPropertyName("UpgradeSeconds")]
+    public int UpgradeSeconds { get; set; }
+    [JsonPropertyName("InitialRushCosts")]
+    public int InitialRushCosts { get; set; }
+    [JsonPropertyName("OptionalRushCosts")]
+    public int OptionalRushCosts { get; set; }
+}
+
+public class TitleDataPlayerQuartersUpgradeCosts {
+    [JsonPropertyName("Currency")]
+    public string Currency { get; set; }
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}

src/Prospect.Server.Api/Models/Title/RenentionBonusInfo.cs

@@ -0,0 +1,8 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataRetentionBonusInfo {
+    [JsonPropertyName("Rewards")]
+    public string[] Rewards { get; set; }
+    [JsonPropertyName("Active")]
+    public bool Active { get; set; }
+}

src/Prospect.Server.Api/Models/Title/TechTreeNodeInfo.cs

@@ -0,0 +1,40 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class TitleDataTechTreeNodeInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("PlayerQuarterLevelRequired")]
+    public int PlayerQuarterLevelRequired { get; set; }
+    [JsonPropertyName("NodePerkType")]
+    public EYTechTreeNodePerkType NodePerkType { get; set; }
+    [JsonPropertyName("PerkLevels")]
+    public TitleDataTechTreeNodePerkLevels[] PerkLevels { get; set; }
+}
+
+public class TitleDataTechTreeNodePerkLevels {
+    [JsonPropertyName("PerkAmount")]
+    public float PerkAmount { get; set; }
+    [JsonPropertyName("UpgradeCosts")]
+    public TitleDataTechTreeNodePerkLevelsUpgradeCosts[] UpgradeCosts { get; set; }
+    [JsonPropertyName("UpgradeSeconds")]
+    public int UpgradeSeconds { get; set; }
+    [JsonPropertyName("InitialRushCosts")]
+    public int InitialRushCosts { get; set; }
+    [JsonPropertyName("OptionalRushCosts")]
+    public int OptionalRushCosts { get; set; }
+}
+
+public class TitleDataTechTreeNodePerkLevelsUpgradeCosts {
+    [JsonPropertyName("Currency")]
+    public string Currency { get; set; }
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}
+
+public class TitleDataTechTreeNodeUpgradeDependencies {
+    [JsonPropertyName("RelatedDependency")]
+    public string RelatedDependency { get; set; }
+    [JsonPropertyName("RequiredLevel")]
+    public int RequiredLevel { get; set; }
+}

src/Prospect.Server.Api/Models/Title/VanityInfo.cs

@@ -0,0 +1,13 @@
+using System.Text.Json.Serialization;
+
+public class TitleDataVanityInfo {
+    [JsonPropertyName("Name")]
+    public string Name { get; set; }
+    [JsonPropertyName("StoreData")]
+    public TitleDataVanityInfoStoreData StoreData { get; set; }
+}
+
+public class TitleDataVanityInfoStoreData {
+    [JsonPropertyName("Amount")]
+    public int Amount { get; set; }
+}

src/Prospect.Server.Api/Models/Unreal/Table.cs

@@ -0,0 +1,10 @@
+
+
+using System.Text.Json.Serialization;
+
+public class UDataTable {
+    [JsonPropertyName("DataTable")]
+    public string DataTable { get; set; }
+    [JsonPropertyName("RowName")]
+    public string RowName { get; set; }
+}

src/Prospect.Server.Api/Properties/launchSettings.Production.json

@@ -0,0 +1,28 @@
+{
+  "profiles": {
+    "Prospect.Server.Api": {
+        "commandName": "Project",
+        "environmentVariables": {
+            "ASPNETCORE_ENVIRONMENT": "Production",
+            "ASPNETCORE_Kestrel__Certificates__Default__Path": ".\\certificate.pfx"
+        },
+        "dotnetRunMessages": true,
+        "applicationUrl": "https://127.0.0.1:8443;http://127.0.0.1:8000",
+        "useSSL": true
+    },
+    "IIS Express": {
+      "commandName": "IISExpress",
+      "launchBrowser": true,
+        "environmentVariables": {
+            "ASPNETCORE_ENVIRONMENT": "Development"
+        }
+    }
+  },
+  "iisSettings": {
+    "windowsAuthentication": false,
+    "anonymousAuthentication": true,
+    "iisExpress": {
+      "sslPort": 0
+    }
+  }
+}

src/Prospect.Server.Api/Properties/launchSettings.json

@@ -1,13 +1,28 @@
-{
+{
   "profiles": {
     "Prospect.Server.Api": {
         "commandName": "Project",
-      "dotnetRunMessages": "true",
+        "environmentVariables": {
-      "launchBrowser": false,
+            "ASPNETCORE_ENVIRONMENT": "Development",
-      "applicationUrl": "http://localhost:5000;https://localhost:5443",
+            "ASPNETCORE_Kestrel__Certificates__Default__Path": ".\\certificate.pfx"
+        },
+        "dotnetRunMessages": true,
+        "applicationUrl": "https://127.0.0.1:8443;http://127.0.0.1:8000",
+        "useSSL": true
+    },
+    "IIS Express": {
+      "commandName": "IISExpress",
+      "launchBrowser": true,
         "environmentVariables": {
             "ASPNETCORE_ENVIRONMENT": "Development"
         }
     }
+  },
+  "iisSettings": {
+    "windowsAuthentication": false,
+    "anonymousAuthentication": true,
+    "iisExpress": {
+      "sslPort": 0
+    }
   }
 }

src/Prospect.Server.Api/Prospect.Server.Api.csproj

@@ -4,6 +4,23 @@
         <TargetFramework>net8.0</TargetFramework>
         <ImplicitUsings>true</ImplicitUsings>
         <Nullable>enable</Nullable>
+        <Configurations>Debug;Release;Season 3 Release;Season 2 Release;Season 2 Debug;Season 3 Debug</Configurations>
+    </PropertyGroup>
+
+    <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Season 3 Debug|AnyCPU'">
+      <Optimize>False</Optimize>
+    </PropertyGroup>
+
+    <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Season 3 Release|AnyCPU'">
+      <Optimize>True</Optimize>
+    </PropertyGroup>
+
+    <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Season 2 Release|AnyCPU'">
+      <Optimize>True</Optimize>
+    </PropertyGroup>
+
+    <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
+      <Optimize>True</Optimize>
     </PropertyGroup>
 
     <ItemGroup>
@@ -17,4 +34,10 @@
       <ProjectReference Include="..\Prospect.Steam\Prospect.Steam.csproj" />
     </ItemGroup>
 
+    <ItemGroup>
+      <!-- Community-datamined id -> name/rarity/category lookup (TCF-Wiki), used by the
+           admin back-office to show readable item/vanity names instead of raw ids. -->
+      <Content Update="Data\gameref.json" CopyToOutputDirectory="PreserveNewest" />
+    </ItemGroup>
+
 </Project>

src/Prospect.Server.Api/Services/CloudScript/CloudScriptService.cs

@@ -32,7 +32,10 @@ public class CloudScriptService
         using (var scope = _serviceScopeFactory.CreateScope())
         {
             var functionClazz = ActivatorUtilities.CreateInstance(scope.ServiceProvider, function.Clazz);
-            var functionParam = JsonSerializer.Deserialize(parameter, function.RequestType);
+            // Some functions have empty parameters which result in malformed JSON.
+            var parameterJson = parameter == "" ? "{}" : parameter;
+            // _logger.LogInformation("Received parameter: {Param}", parameterJson);
+            var functionParam = JsonSerializer.Deserialize(parameterJson, function.RequestType);
             if (functionParam == null)
             {
                 _logger.LogWarning("Function {Function} deserialization returned null", name);

src/Prospect.Server.Api/Services/CloudScript/Functions/ActivateContract.cs

@@ -0,0 +1,111 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYActivateContractRequest {
+    [JsonPropertyName("contractId")]
+    public string ContractID { get; set; }
+}
+
+public class FYActivateContractResult {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+    [JsonPropertyName("changedCurrencties")]
+    public object[] ChangedCurrencties { get; set; }
+    [JsonPropertyName("activatedContract")]
+    public FYActiveContractPlayerData ActivatedContract { get; set; }
+    [JsonPropertyName("status")]
+    public int Status { get; set; }
+}
+
+public class FYGetActiveContractsResult {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+    [JsonPropertyName("contracts")]
+    public List<FYActiveContractPlayerData> Contracts { get; set; }
+}
+
+[CloudScriptFunction("ActivateContract")]
+public class ActivateContract : ICloudScriptFunction<FYActivateContractRequest, FYActivateContractResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public ActivateContract(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYActivateContractResult> ExecuteAsync(FYActivateContractRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"ContractsActive", "ContractsOneTimeCompleted"});
+        var titleData = _titleDataService.Find(new List<string>{"Contracts"});
+
+        var contracts = JsonSerializer.Deserialize<Dictionary<string, TitleDataContractInfo>>(titleData["Contracts"]);
+        if (!contracts.TryGetValue(request.ContractID, out var contract)) {
+            return new FYActivateContractResult
+            {
+                UserID = userId,
+                Error = "Contract not found",
+                Status = 3 // EYActivateContractRequestStatus::FAILED_GETTING_STATIC_DATA
+            };
+        }
+        var contractsCompleted = JsonSerializer.Deserialize<FYGetCompletedContractsResult>(userData["ContractsOneTimeCompleted"].Value);
+        if (contractsCompleted.ContractsIDs.Contains(request.ContractID)) {
+            return new FYActivateContractResult
+            {
+                UserID = userId,
+                Error = "Contract is already completed",
+                Status = 1 // EYActivateContractRequestStatus::CONTRACT_OF_THIS_FACTION_IS_ALREADY_ACTIVE
+            };
+        }
+        // TODO: Contract unlock criteria
+
+        var progress = new int[contract.Objectives.Length];
+        // NOTE: Automatically set max progress for player kill objectives.
+        for (var i = 0; i < contract.Objectives.Length; i++) {
+            var objective = contract.Objectives[i];
+            if (objective.Type == EYContractObjectiveType.Kills && objective.KillConditions.KillTarget == EYKillTypeAction.Players) {
+                progress[i] = objective.MaxProgress;
+            }
+        }
+
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value);
+        var contractData = new FYActiveContractPlayerData {
+            ContractID = request.ContractID,
+            Progress = progress,
+        };
+        // TODO: Max number of active jobs
+        contractsActive.Contracts.Add(contractData);
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{ ["ContractsActive"] = JsonSerializer.Serialize(contractsActive) }
+        );
+
+        return new FYActivateContractResult
+        {
+            UserID = userId,
+            Error = "",
+            ChangedCurrencties = [], // NOTE: There are no paid contracts in Frontier.
+            ActivatedContract = contractData,
+            Status = 14 // EYActivateContractRequestStatus::OK
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CanGoToStationRequest.cs

@@ -0,0 +1,43 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class CanGoToStationRequestRequest
+{
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+    [JsonPropertyName("region")]
+    public string Region { get; set; }
+}
+
+public class CanGoToStationRequestResponse
+{
+    [JsonPropertyName("canGoToStation")]
+    public bool CanGoToStation { get; set; }
+    [JsonPropertyName("delta")]
+    public int Delta { get; set; }
+    [JsonPropertyName("timeStampUpdate")]
+    public int TimeStampUpdate { get; set; }
+}
+
+[CloudScriptFunction("CanGoToStationRequest")]
+public class CanGoToStationRequestFunction : ICloudScriptFunction<CanGoToStationRequestRequest, CanGoToStationRequestResponse>
+{
+    private readonly ILogger<CanGoToStationRequestFunction> _logger;
+
+    public CanGoToStationRequestFunction(ILogger<CanGoToStationRequestFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<CanGoToStationRequestResponse> ExecuteAsync(CanGoToStationRequestRequest request)
+    {
+        return new CanGoToStationRequestResponse
+        {
+            CanGoToStation = true,
+            Delta = 0,
+            TimeStampUpdate = 0,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CancelActiveContract.cs

@@ -0,0 +1,65 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYCancelActiveContractRequest {
+    [JsonPropertyName("contractId")]
+    public string ContractID { get; set; }
+}
+
+public class FYCancelActiveContractResult {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+    [JsonPropertyName("contractId")]
+    public string ContractID { get; set; }
+}
+
+[CloudScriptFunction("CancelActiveContract")]
+public class CancelActiveContract : ICloudScriptFunction<FYCancelActiveContractRequest, FYCancelActiveContractResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+
+    public CancelActiveContract(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+    }
+
+    public async Task<FYCancelActiveContractResult> ExecuteAsync(FYCancelActiveContractRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"ContractsActive"});
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value);
+        var contractActiveIdx = contractsActive.Contracts.FindIndex(item => item.ContractID == request.ContractID);
+        if (contractActiveIdx == -1) {
+            return new FYCancelActiveContractResult
+            {
+                UserID = userId,
+                Error = "Failed to find active contract",
+            };
+        }
+        contractsActive.Contracts.RemoveAt(contractActiveIdx);
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{ ["ContractsActive"] = JsonSerializer.Serialize(contractsActive) }
+        );
+
+        return new FYCancelActiveContractResult
+        {
+            UserID = userId,
+            Error = "",
+            ContractID = request.ContractID,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CheckAndPerformUserRollbackIfNeeded.cs

@@ -0,0 +1,37 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class CheckAndPerformUserRollbackIfNeededRequest
+{
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+}
+
+public class CheckAndPerformUserRollbackIfNeededResponse
+{
+    [JsonPropertyName("result")]
+    public int Result { get; set; }
+}
+
+[CloudScriptFunction("CheckAndPerformUserRollbackIfNeeded")]
+public class CheckAndPerformUserRollbackIfNeededFunction : ICloudScriptFunction<CheckAndPerformUserRollbackIfNeededRequest, CheckAndPerformUserRollbackIfNeededResponse>
+{
+    private readonly ILogger<CheckAndPerformUserRollbackIfNeededFunction> _logger;
+
+    public CheckAndPerformUserRollbackIfNeededFunction(ILogger<CheckAndPerformUserRollbackIfNeededFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<CheckAndPerformUserRollbackIfNeededResponse> ExecuteAsync(CheckAndPerformUserRollbackIfNeededRequest request)
+    {
+        _logger.LogInformation("Processing user rollback if needed");
+
+        return new CheckAndPerformUserRollbackIfNeededResponse
+        {
+            Result = 1,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CheckAndWipeDataForCurrentSeason.cs

@@ -0,0 +1,37 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class CheckAndWipeDataForCurrentSeasonRequest
+{
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+}
+
+public class CheckAndWipeDataForCurrentSeasonResponse
+{
+    [JsonPropertyName("result")]
+    public int Result { get; set; }
+}
+
+[CloudScriptFunction("CheckAndWipeDataForCurrentSeason")]
+public class CheckAndWipeDataForCurrentSeasonFunction : ICloudScriptFunction<CheckAndWipeDataForCurrentSeasonRequest, CheckAndWipeDataForCurrentSeasonResponse>
+{
+    private readonly ILogger<CheckAndWipeDataForCurrentSeasonFunction> _logger;
+
+    public CheckAndWipeDataForCurrentSeasonFunction(ILogger<CheckAndWipeDataForCurrentSeasonFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<CheckAndWipeDataForCurrentSeasonResponse> ExecuteAsync(CheckAndWipeDataForCurrentSeasonRequest request)
+    {
+        _logger.LogInformation("Processing check data wipe for current season");
+
+        return new CheckAndWipeDataForCurrentSeasonResponse
+        {
+            Result = 1,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CheckClientVersionUpToDate.cs

@@ -0,0 +1,44 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class CheckClientVersionUpToDateRequest
+{
+    [JsonPropertyName("version")]
+    public string Version { get; set; }
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+}
+
+public class CheckClientVersionUpToDateResponse
+{
+    [JsonPropertyName("isClientUpToDate")]
+    public bool IsClientUpToDate { get; set; }
+}
+
+[CloudScriptFunction("CheckClientVersionUpToDate")]
+public class CheckClientVersionUpToDateFunction : ICloudScriptFunction<CheckClientVersionUpToDateRequest, CheckClientVersionUpToDateResponse>
+{
+    private readonly ILogger<CheckClientVersionUpToDateFunction> _logger;
+
+    public CheckClientVersionUpToDateFunction(ILogger<CheckClientVersionUpToDateFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<CheckClientVersionUpToDateResponse> ExecuteAsync(CheckClientVersionUpToDateRequest request)
+    {
+        _logger.LogInformation("Processing client version check request for client {Version}",
+            request.Version);
+
+        return new CheckClientVersionUpToDateResponse
+        {
+#if SEASON_2_RELEASE || SEASON_2_DEBUG
+            IsClientUpToDate = request.Version == "4.27.2-1413204+PROSPECT-Releases-R2.7.0",
+#else
+            IsClientUpToDate = true,
+#endif
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/ClaimActiveContract.cs

@@ -0,0 +1,317 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYClaimCompletedActiveContractRewardsRequest {
+    [JsonPropertyName("contractId")]
+	public string ContractID { get; set; }
+    [JsonPropertyName("contractsToUnlock")]
+	public string[] ContractsToUnlock { get; set; }
+}
+
+public class FYClaimCompletedActiveContractRewardsResult {
+    [JsonPropertyName("userId")]
+	public string UserID { get; set; }
+    [JsonPropertyName("error")]
+	public string Error { get; set; }
+    [JsonPropertyName("claimedContractId")]
+	public string ClaimedContractID { get; set; }
+    [JsonPropertyName("newContractIdOnBoard")]
+	public string NewContractIdOnBoard { get; set; }
+    [JsonPropertyName("changedCurrencies")]
+	public FYCurrencyItem[] ChangedCurrencies { get; set; }
+    [JsonPropertyName("itemsGranted")]
+	public List<FYCustomItemInfo> ItemsGranted { get; set; }
+    [JsonPropertyName("itemsUpdatedOrRemoved")]
+	public List<FYCustomItemInfo> ItemsUpdatedOrRemoved { get; set; }
+    [JsonPropertyName("playerFactionProgressData")]
+	public FYPlayerFactionProgressData PlayerFactionProgressData { get; set; }
+    [JsonPropertyName("contractsActivated")]
+	public List<FYActiveContractPlayerData> ContractsActivated { get; set; }
+    [JsonPropertyName("status")]
+	public int Status { get; set; } // EYClaimContractRewardsStatus
+    [JsonPropertyName("updatedSeasonXp")]
+	public int UpdatedSeasonXp { get; set; }
+}
+
+public class FYGetCompletedContractsResult {
+    [JsonPropertyName("contractsIds")]
+	public List<string> ContractsIDs { get; set; }
+};
+
+[CloudScriptFunction("ClaimActiveContract")]
+public class ClaimActiveContract : ICloudScriptFunction<FYClaimCompletedActiveContractRewardsRequest, FYClaimCompletedActiveContractRewardsResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly string[] difficulties = ["Easy", "Medium", "Hard"];
+    private readonly Random rnd = new Random();
+
+    public ClaimActiveContract(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYClaimCompletedActiveContractRewardsResult> ExecuteAsync(FYClaimCompletedActiveContractRewardsRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var titleData = _titleDataService.Find(new List<string>{ "Contracts", "Blueprints", "Jobs", "LevelData" });
+
+        var contracts = JsonSerializer.Deserialize<Dictionary<string, TitleDataContractInfo>>(titleData["Contracts"]);
+        if (!contracts.TryGetValue(request.ContractID, out var contract)) {
+            return new FYClaimCompletedActiveContractRewardsResult
+            {
+                UserID = userId,
+                Error = "Contract not found",
+                Status = 13, // EYClaimContractRewardsStatus::WRONG_CONTRACT_ID
+            };
+        }
+
+        var factionKey = "FactionProgression" + contract.Faction;
+        // Fortuna pass season XP is stored per season; the client derives the pass level
+        // from this key. No challenge system is emulated, so contracts are the XP source.
+#if SEASON_3_RELEASE || SEASON_3_DEBUG
+        const string seasonXpKey = "FortunaPass3_SeasonXp";
+#else
+        const string seasonXpKey = "FortunaPass2_SeasonXp";
+#endif
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"ContractsActive", "ContractsOneTimeCompleted", "Balance", "Inventory", factionKey, "JobBoardsData", seasonXpKey }
+        );
+
+        var factionProgression = JsonSerializer.Deserialize<int>(userData[factionKey].Value);
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value);
+        var contractsCompleted = JsonSerializer.Deserialize<FYGetCompletedContractsResult>(userData["ContractsOneTimeCompleted"].Value);
+        var jobBoardsData = JsonSerializer.Deserialize<JobBoardsData>(userData["JobBoardsData"].Value);
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+
+        var targetContractIdx = contractsActive.Contracts.FindIndex(item => item.ContractID == contract.Name);
+        if (targetContractIdx == -1) {
+            return new FYClaimCompletedActiveContractRewardsResult
+            {
+                UserID = userId,
+                Error = "Contract not active",
+                Status = 8, // EYClaimContractRewardsStatus::NO_ACTIVE_CONTRACT
+            };
+        }
+
+        var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+
+        var targetContract = contractsActive.Contracts[targetContractIdx];
+        List<FYCustomItemInfo> itemsUpdatedOrRemoved = [];
+        HashSet<string> deletedItemsIds = [];
+        // TODO: Optimize
+        for (var i = 0; i < contract.Objectives.Length; i++) {
+            var objective = contract.Objectives[i];
+            int remaining = objective.MaxProgress;
+            if (objective.Type == EYContractObjectiveType.OwnNumOfItem) {
+                // NOTE: The backend may perform item ownership validation
+                // since it has the information about the player's items.
+                foreach (var item in inventory) {
+                    if (item.BaseItemId != objective.ItemToOwn) {
+                        continue;
+                    }
+                    var localRemaining = remaining;
+                    remaining -= item.Amount;
+                    item.Amount -= localRemaining;
+                    if (item.Amount <= 0) {
+                        item.Amount = 0;
+                        deletedItemsIds.Add(item.ItemId);
+                    }
+                    itemsUpdatedOrRemoved.Add(item);
+                    if (remaining <= 0) {
+                        break;
+                    }
+                }
+            } else if (objective.Type.IsRaidRuntime()) {
+                // Raid-runtime objectives (kills, dead-drops, visited areas, looted
+                // containers) can't be tracked in a client-hosted raid — no dedicated
+                // game server reports them, so their progress is never saved. They are
+                // auto-credited on deploy (EnterMatchmakingMatch); accept them here too
+                // (safety net for a contract activated after deploy) so these contracts
+                // remain completable instead of being stuck on "Objective not met".
+                remaining = 0;
+            } else {
+                // Meta objectives (FactionLevel / CompletedMission): validated from the
+                // persisted progress. The objectives are mapped by array index.
+                remaining -= targetContract.Progress[i];
+            }
+            if (remaining > 0) {
+                return new FYClaimCompletedActiveContractRewardsResult
+                {
+                    UserID = userId,
+                    Error = "Objective not met",
+                    Status = 16, // EYClaimContractRewardsStatus::PROGRESS_MISSING
+                };
+            }
+        }
+
+        // TODO: Optimize
+        var newInventory = new List<FYCustomItemInfo>(inventory.Count);
+        foreach (var item in inventory) {
+            if (!deletedItemsIds.Contains(item.ItemId)) {
+                newInventory.Add(item);
+            }
+        }
+
+        List<FYCustomItemInfo> itemsGranted = new List<FYCustomItemInfo>();
+        List<FYCurrencyItem> changedCurrencies = [];
+        foreach (var reward in contract.Rewards) {
+            if (reward.ItemID == "SoftCurrency") {
+                balance.SoftCurrency += reward.Amount;
+                changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency });
+            } else if (reward.ItemID == "Aurum") {
+                balance.HardCurrency += reward.Amount;
+                changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency });
+            } else if (reward.ItemID == "InsuranceCurrency") {
+                balance.InsuranceCurrency += reward.Amount;
+                changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "InsuranceCurrency", Amount = balance.InsuranceCurrency });
+            } else {
+                // TODO: Inventory limit check
+
+                var blueprintData = blueprints[reward.ItemID];
+                var remainingAmount = reward.Amount; // Quest rewards are given individually
+
+                // Populate incomplete stacks first
+                foreach (var item in newInventory) {
+                    if (item.BaseItemId != reward.ItemID || item.Amount >= blueprintData.MaxAmountPerStack) {
+                        continue;
+                    }
+                    var remainingSpace = blueprintData.MaxAmountPerStack - item.Amount;
+                    var amountToAdd = Math.Min(remainingAmount, remainingSpace);
+                    item.Amount += amountToAdd;
+                    remainingAmount -= amountToAdd;
+                    itemsUpdatedOrRemoved.Add(item);
+                    if (remainingAmount == 0) {
+                        break;
+                    }
+                }
+
+                while (remainingAmount > 0) {
+                    var itemStackAmount = Math.Min(blueprintData.MaxAmountPerStack, remainingAmount);
+                    var itemInfo = new FYCustomItemInfo{
+                        ItemId = Guid.NewGuid().ToString(),
+                        Amount = itemStackAmount,
+                        BaseItemId = reward.ItemID,
+                        Durability = blueprintData.DurabilityMax,
+                        Insurance = "",
+                        InsuranceOwnerPlayfabId = "",
+                        ModData = new FYModItems { M = [] },
+                        Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                        InsuredAttachmentId = "",
+                        PrimaryVanityId = 0,
+                        SecondaryVanityId = 0,
+                        RolledPerks = [],
+                    };
+                    newInventory.Add(itemInfo);
+                    itemsGranted.Add(itemInfo);
+                    remainingAmount -= itemStackAmount;
+                }
+            }
+        }
+
+        factionProgression += contract.ReputationIncrease;
+        contractsActive.Contracts.RemoveAt(targetContractIdx);
+        // Main contracts can be completed only once.
+        // Other contracts should be jobs.
+        var newContractIdOnBoard = "";
+        if (contract.IsMainContract) {
+            contractsCompleted.ContractsIDs.Add(contract.Name);
+        } else {
+            var parts = contract.Name.Split('-');
+            var difficulty = parts[1];
+
+            var levelsData = JsonSerializer.Deserialize<Dictionary<string, int[]>>(titleData["LevelData"]);
+            var levels = levelsData[contract.Faction];
+            var jobs = JsonSerializer.Deserialize<Dictionary<string, Dictionary<string, string[]>>>(titleData["Jobs"]);
+            var level = levels.Length - Array.FindIndex(levels, (int xp) => {
+                return factionProgression >= xp;
+            });
+
+            var factionBoard = jobBoardsData.Boards.Find(c => c.FactionId == contract.Faction);
+            var idx = Array.FindIndex(difficulties, d => d == difficulty);
+            var factionJobs = jobs[contract.Faction];
+            var jobsAvailable = Array.FindAll(factionJobs[difficulty], (string jobId) => {
+                return level >= contracts[jobId].UnlockData.Level;
+            });
+            // If player completes a job, it means he has at least one unlocked anyway.
+            newContractIdOnBoard = jobsAvailable[rnd.Next(jobsAvailable.Length)];
+            factionBoard.Contracts[idx].ContractId = newContractIdOnBoard;
+        }
+
+        // TODO: Check for next unlock in contracts instead of relying on client
+        var newContracts = new List<FYActiveContractPlayerData>();
+        foreach (var contractIdToUnlock in request.ContractsToUnlock) {
+            if (contractsCompleted.ContractsIDs.Contains(contractIdToUnlock)) {
+                continue;
+            }
+            var contractToUnlock = contracts[contractIdToUnlock];
+            var progress = new int[contractToUnlock.Objectives.Length];
+            // NOTE: Automatically set max progress for player kill objectives.
+            for (var i = 0; i < contractToUnlock.Objectives.Length; i++) {
+                var objective = contractToUnlock.Objectives[i];
+                if (objective.Type == EYContractObjectiveType.Kills && objective.KillConditions.KillTarget == EYKillTypeAction.Players) {
+                    progress[i] = objective.MaxProgress;
+                }
+            }
+            var newContract = new FYActiveContractPlayerData {
+                ContractID = contractIdToUnlock,
+                Progress = progress,
+            };
+            contractsActive.Contracts.Add(newContract);
+            newContracts.Add(newContract);
+        }
+
+        // Grant Fortuna pass season XP for completing this contract and persist it, so the
+        // pass level (derived client-side from FortunaPass{season}_SeasonXp) actually moves.
+        // No exact rate ships in the data, so scale it to the contract's reputation value.
+        var seasonXp = int.TryParse(userData[seasonXpKey].Value, out var currentSeasonXp) ? currentSeasonXp : 0;
+        seasonXp += contract.ReputationIncrease * 10;
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["ContractsOneTimeCompleted"] = JsonSerializer.Serialize(contractsCompleted),
+                ["ContractsActive"] = JsonSerializer.Serialize(contractsActive),
+                ["Balance"] = JsonSerializer.Serialize(balance),
+                ["Inventory"] = JsonSerializer.Serialize(newInventory),
+                [factionKey] = JsonSerializer.Serialize(factionProgression),
+                ["JobBoardsData"] = JsonSerializer.Serialize(jobBoardsData),
+                [seasonXpKey] = JsonSerializer.Serialize(seasonXp),
+            }
+        );
+
+        return new FYClaimCompletedActiveContractRewardsResult
+        {
+            UserID = userId,
+            Error = "",
+            ClaimedContractID = contract.Name,
+            ContractsActivated = newContracts,
+            ItemsUpdatedOrRemoved = itemsUpdatedOrRemoved,
+            ChangedCurrencies = changedCurrencies.ToArray(),
+            ItemsGranted = itemsGranted,
+            NewContractIdOnBoard = newContractIdOnBoard,
+            PlayerFactionProgressData = new FYPlayerFactionProgressData {
+                FactionID = contract.Faction,
+                CurrentProgression = factionProgression,
+            },
+            Status = 18, // EYClaimContractRewardsStatus::OK
+            UpdatedSeasonXp = seasonXp // new season XP total (client derives the pass level from it)
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/ClaimGeneratorIncomeClient.cs

@@ -0,0 +1,248 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYClaimGeneratorIncomeClientResult {
+    [JsonPropertyName("userId")]
+	public string UserId { get; set; }
+    [JsonPropertyName("error")]
+	public string Error { get; set; }
+    [JsonPropertyName("generatorId")]
+	public string GeneratorID { get; set; }
+    [JsonPropertyName("changedCurrenciesBalances")]
+	public FYCurrencyItem[] ChangedCurrenciesBalances { get; set; }
+    [JsonPropertyName("grantedItems")]
+	public List<FYCustomItemInfo> GrantedItems { get; set; }
+    [JsonPropertyName("lastClaimTime")]
+	public FYTimestamp LastClaimTime { get; set; }
+};
+
+public class FYClaimGeneratorIncomeClientRequest {
+    [JsonPropertyName("generatorId")]
+	public string GeneratorID { get; set; }
+};
+
+public class FYPassiveGenerator {
+    [JsonPropertyName("generatorId")]
+    public string GeneratorID { get; set; }
+    [JsonPropertyName("lastClaimTime")]
+	public FYTimestamp LastClaimTime { get; set; }
+}
+
+[CloudScriptFunction("ClaimGeneratorIncomeClient")]
+public class ClaimGeneratorIncomeClient : ICloudScriptFunction<FYClaimGeneratorIncomeClientRequest, FYClaimGeneratorIncomeClientResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    static readonly Random random = new();
+
+    private TitleDataDailyCrateInfo[] PickItems(TitleDataDailyCrateInfo[] items, int numPicks)
+    {
+        var itemList = new (TitleDataDailyCrateInfo item, float cumulativeWeight)[items.Length];
+        float totalWeight = 0;
+
+        for (int i = 0; i < items.Length; i++) {
+            var item = items[i];
+            totalWeight += item.Weight;
+            itemList[i] = (item, totalWeight);
+        }
+
+        var selectedItems = new TitleDataDailyCrateInfo[numPicks];
+
+        for (int i = 0; i < numPicks; i++) {
+            float pick = (float)random.NextDouble() * totalWeight;
+            int left = 0, right = itemList.Length - 1;
+
+            while (left < right) {
+                int mid = (left + right) / 2;
+                if (itemList[mid].cumulativeWeight < pick) {
+                    left = mid + 1;
+                } else {
+                    right = mid;
+                }
+            }
+
+            selectedItems[i] = itemList[left].item;
+        }
+
+        return selectedItems;
+    }
+
+    public ClaimGeneratorIncomeClient(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYClaimGeneratorIncomeClientResult> ExecuteAsync(FYClaimGeneratorIncomeClientRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"Generators__2021_09_09", "CharacterTechTreeBonuses", "Balance", "Inventory"}
+        );
+
+        var userGenerators = JsonSerializer.Deserialize<FYPassiveGenerator[]>(userData["Generators__2021_09_09"].Value);
+        var generator = Array.Find(userGenerators, item => item.GeneratorID == request.GeneratorID);
+        if (generator == null) {
+            return new FYClaimGeneratorIncomeClientResult {
+                UserId = userId,
+                Error = "Invalid generator ID",
+            };
+        }
+
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+        var techTreeBonuses = JsonSerializer.Deserialize<CharacterTechTreeBonuses>(userData["CharacterTechTreeBonuses"].Value);
+
+        var titleData = _titleDataService.Find(new List<string>{"PassiveGenerators", "DailyCrateRewardsPools", "Blueprints"});
+        var passiveGenerators = JsonSerializer.Deserialize<Dictionary<string, TitleDataPassiveGeneratorsInfo>>(titleData["PassiveGenerators"]);
+
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        FYCurrencyItem[] changedCurrencies = [];
+        List<FYCustomItemInfo> grantedItems = [];
+        switch (generator.GeneratorID) {
+            case "playerquarters_gen_kmarks": {
+                var rate = techTreeBonuses.KmarksRate;
+                if (rate == 0) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "K-Marks Generator Upgrade is not constructed",
+                    };
+                }
+
+                var generatorData = passiveGenerators[generator.GeneratorID];
+                var hours = (now - generator.LastClaimTime.Seconds) / (60 * generatorData.BaseGenIntervalMinutes);
+                var cap = techTreeBonuses.KmarksCap + generatorData.BaseCap;
+                var claimableAmount = Math.Min(hours * rate, cap);
+                if (claimableAmount == 0) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "Generator is not ready yet",
+                    };
+                }
+
+                balance.SoftCurrency += claimableAmount;
+                changedCurrencies = [new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency }];
+                break;
+            }
+            case "playerquarters_gen_aurum": {
+                var rate = techTreeBonuses.AurumRate;
+                if (rate == 0) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "Aurum Generator Upgrade is not constructed",
+                    };
+                }
+
+                var generatorData = passiveGenerators[generator.GeneratorID];
+                var hours = (now - generator.LastClaimTime.Seconds) / (60 * generatorData.BaseGenIntervalMinutes);
+                var cap = techTreeBonuses.AurumCap + generatorData.BaseCap;
+                var claimableAmount = (int)Math.Min(hours * rate, cap);
+                if (claimableAmount == 0) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "Generator is not ready yet",
+                    };
+                }
+
+                balance.HardCurrency += claimableAmount;
+                changedCurrencies = [new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency }];
+                break;
+            }
+            case "playerquarters_gen_crate": {
+                var crateTier = techTreeBonuses.CrateTier;
+                if (crateTier == 0) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "Crate Generator Upgrade is not constructed",
+                    };
+                }
+
+                var generatorData = passiveGenerators[generator.GeneratorID];
+                var nextClaimTime = generator.LastClaimTime.Seconds + 60 * generatorData.BaseGenIntervalMinutes;
+                if (now < nextClaimTime) {
+                    return new FYClaimGeneratorIncomeClientResult
+                    {
+                        UserId = userId,
+                        Error = "Generator is not ready yet",
+                    };
+                }
+
+                var dailyCrateRewards = JsonSerializer.Deserialize<TitleDataDailyCrateInfo[][]>(titleData["DailyCrateRewardsPools"]);
+                var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+                var rewardsPool = dailyCrateRewards[crateTier - 1];
+
+                // TODO: Get rewardGrants from PassiveGenerators_CrateRewards_DT
+                var items = PickItems(rewardsPool, 5);
+                // TODO: Stackable? GrantedItems doesn't imply granted OR updated.
+                foreach (var item in items) {
+                    var itemInfo = blueprints[item.Name];
+                    var grantedItem = new FYCustomItemInfo {
+                        ItemId = Guid.NewGuid().ToString(),
+                        Amount = item.Amount,
+                        BaseItemId = item.Name,
+                        Durability = itemInfo.DurabilityMax,
+                        Insurance = "",
+                        InsuranceOwnerPlayfabId = "",
+                        ModData = new FYModItems { M = [] },
+                        Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                        InsuredAttachmentId = "",
+                        PrimaryVanityId = 0,
+                        SecondaryVanityId = 0,
+                        RolledPerks = [],
+                    };
+                    inventory.Add(grantedItem);
+                    grantedItems.Add(grantedItem);
+                }
+                break;
+            }
+            default: {
+                return new FYClaimGeneratorIncomeClientResult
+                {
+                    UserId = userId,
+                    Error = $"Unknown generator ID: {request.GeneratorID}",
+                };
+            }
+        }
+
+        generator.LastClaimTime.Seconds = now;
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["Inventory"] = JsonSerializer.Serialize(inventory),
+                ["Balance"] = JsonSerializer.Serialize(balance),
+                ["Generators__2021_09_09"] = JsonSerializer.Serialize(userGenerators),
+            }
+        );
+
+        return new FYClaimGeneratorIncomeClientResult
+        {
+            UserId = userId,
+            Error = "",
+            GeneratorID = request.GeneratorID,
+            ChangedCurrenciesBalances = changedCurrencies,
+            GrantedItems = grantedItems,
+            LastClaimTime = generator.LastClaimTime,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/ClientsideFriendsImport.cs

@@ -0,0 +1,54 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.UserData;
+
+public class ClientsideFriendsImportRequest
+{
+    [JsonPropertyName("platform")]
+    public string Platform { get; set; }
+    [JsonPropertyName("userIds")]
+    public string[] UserIDs { get; set; }
+}
+
+public class ClientsideFriendsImportResponse
+{
+    // TODO: Unknown structure
+}
+
+[CloudScriptFunction("ClientsideFriendsImport")]
+public class ClientsideFriendsImportFunction : ICloudScriptFunction<ClientsideFriendsImportRequest, ClientsideFriendsImportResponse>
+{
+    private readonly ILogger<ClientsideFriendsImportFunction> _logger;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+
+    public ClientsideFriendsImportFunction(ILogger<ClientsideFriendsImportFunction> logger, IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    {
+        _logger = logger;
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+    }
+
+    public async Task<ClientsideFriendsImportResponse> ExecuteAsync(ClientsideFriendsImportRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        // Persist the platform friend ids the client imports (Steam ids) so GetFriendList
+        // can later resolve which of them actually play on this server.
+        var ids = request.UserIDs ?? Array.Empty<string>();
+        await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>
+        {
+            ["ImportedSteamFriends"] = JsonSerializer.Serialize(ids),
+        });
+        _logger.LogInformation("Imported {Count} {Platform} friend id(s) for user {User}", ids.Length, request.Platform, userId);
+
+        return new ClientsideFriendsImportResponse{};
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/CompleteInventoryUpdate.cs

@@ -0,0 +1,154 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Functions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
+
+// Closed Beta Function
+
+public class CompleteInventoryUpdateRequest
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("reason")]
+    public string Reason { get; set; }
+    [JsonPropertyName("newSet")]
+    public LoadoutData NewSet { get; set; }
+    [JsonPropertyName("itemsToAdd")]
+    public FYCustomItemInfo[] ItemsToAdd { get; set; }
+    [JsonPropertyName("itemsToUpdateAmount")]
+    public FYCustomItemInfo[] ItemsToUpdateAmount { get; set; }
+    [JsonPropertyName("itemsToRemove")]
+    public HashSet<string> ItemsToRemove { get; set; }
+}
+
+public class CompleteInventoryUpdateResponse
+{
+    [JsonPropertyName("userId")]
+    public string UserId { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+    [JsonPropertyName("newSet")]
+    public LoadoutData NewSet { get; set; }
+    [JsonPropertyName("itemsToAdd")]
+    public FYCustomItemInfo[] ItemsToAdd { get; set; }
+    [JsonPropertyName("itemsToUpdateAmount")]
+    public FYCustomItemInfo[] ItemsToUpdateAmount { get; set; }
+    [JsonPropertyName("itemsToRemove")]
+    public HashSet<string> ItemsToRemove { get; set; }
+}
+
+[CloudScriptFunction("CompleteInventoryUpdate")]
+public class CompleteInventoryUpdateFunction : ICloudScriptFunction<CompleteInventoryUpdateRequest, CompleteInventoryUpdateResponse>
+{
+    private readonly ILogger<CompleteInventoryUpdateFunction> _logger;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public CompleteInventoryUpdateFunction(ILogger<CompleteInventoryUpdateFunction> logger, IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _logger = logger;
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<CompleteInventoryUpdateResponse> ExecuteAsync(CompleteInventoryUpdateRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Inventory"});
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+
+        // Insurance payout: this request also reports the end-of-match inventory, so items
+        // the player lost (death / left behind) arrive in ItemsToRemove. Any of those that
+        // were insured on deploy (EnterMatchmakingStation) are recovered back to the stash —
+        // the premium was already paid up-front — and the insurance is consumed (one raid).
+        // Recovery is only performed if the item's policy declares a positive Payout.
+        var recoveredInsured = new HashSet<string>();
+        if (request.ItemsToRemove is { Count: > 0 })
+        {
+            try
+            {
+                var td = _titleDataService.Find(new List<string> { "InventoryInsurance" });
+                if (td.TryGetValue("InventoryInsurance", out var rawPolicies) && !string.IsNullOrEmpty(rawPolicies))
+                {
+                    var policies = JsonSerializer.Deserialize<Dictionary<string, InventoryInsurancePolicy>>(rawPolicies);
+                    foreach (var item in inventory)
+                    {
+                        if (!request.ItemsToRemove.Contains(item.ItemId)) continue;
+                        if (string.IsNullOrEmpty(item.Insurance) || item.InsuranceOwnerPlayfabId != userId) continue;
+                        if (policies == null || !policies.TryGetValue(item.Insurance, out var policy) || policy.Payout <= 0) continue;
+                        recoveredInsured.Add(item.ItemId);
+                        item.Insurance = "";              // consumed for this raid
+                        item.InsuranceOwnerPlayfabId = "";
+                    }
+                    if (recoveredInsured.Count > 0)
+                    {
+                        _logger.LogInformation("Recovered {Count} insured item(s) for user {User}", recoveredInsured.Count, userId);
+                    }
+                }
+            }
+            catch (Exception e)
+            {
+                // Never fail the inventory commit because of insurance handling.
+                _logger.LogWarning(e, "Failed to process insurance payout");
+            }
+        }
+
+        // TODO: Optimize
+        // TODO: Check deleted items to see if other stacks/mods were updated correctly
+        // Process inventory update. The player may:
+        // 1. Split item stack - creates a new item and updates amount of existing item.
+        // 2. Stack existing items - deletes existing items and updates amount of existing item.
+        // 3. Change vanity data - updates an existing item.
+        // 4. Change weapon mods - updates an existing item.
+        // IMPORTANT: The same request is currently used to report the updated inventory in the end of match.
+        var newInventory = new List<FYCustomItemInfo>(inventory.Count);
+        foreach (var item in inventory) {
+            // Keep items that weren't removed, plus insured items recovered above.
+            if (!request.ItemsToRemove.Contains(item.ItemId) || recoveredInsured.Contains(item.ItemId)) {
+                newInventory.Add(item);
+            }
+        }
+
+        foreach (var item in request.ItemsToUpdateAmount) {
+            var inventoryItem = newInventory.Find(i => i.ItemId == item.ItemId);
+            if (inventoryItem == null) {
+                continue;
+            }
+            inventoryItem.Amount = item.Amount;
+            inventoryItem.ModData = item.ModData;
+            inventoryItem.PrimaryVanityId = item.PrimaryVanityId;
+            inventoryItem.SecondaryVanityId = item.SecondaryVanityId;
+            inventoryItem.Durability = item.Durability;
+        }
+
+        // TODO: Check updated items and validate new items
+        foreach (var item in request.ItemsToAdd) {
+            newInventory.Add(item);
+        }
+
+        await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>{
+            ["LOADOUT"] = JsonSerializer.Serialize(request.NewSet),
+            ["Inventory"] = JsonSerializer.Serialize(newInventory),
+        });
+
+        return new CompleteInventoryUpdateResponse
+        {
+            UserId = userId,
+            //Error = "",
+            //NewSet = request.NewSet,
+            //ItemsToAdd = request.ItemsToAdd,
+            //ItemsToRemove = request.ItemsToRemove,
+            //ItemsToUpdateAmount = request.ItemsToUpdateAmount,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/EnterMatchmaking.cs

@@ -1,22 +1,56 @@
-using Prospect.Server.Api.Services.CloudScript.Models;
+using System.Text.Json.Serialization;
+using Microsoft.AspNetCore.SignalR;
+using Prospect.Server.Api.Hubs;
+using Prospect.Server.Api.Services.CloudScript.Models;
+
+// Closed Beta Function
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
 [CloudScriptFunction("EnterMatchmaking")]
-public class EnterMatchmaking : ICloudScriptFunction<FYEnterMatchAzureFunction, FYEnterMatchAzureFunctionResult>
+public class EnterMatchmakingFunction : ICloudScriptFunction<FYEnterMatchAzureFunction, FYEnterMatchAzureFunctionResult>
 {
-    public Task<FYEnterMatchAzureFunctionResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    private readonly IHubContext<CycleHub> _hubContext;
+
+    public EnterMatchmakingFunction(IHubContext<CycleHub> hubContext)
     {
-        return Task.FromResult(new FYEnterMatchAzureFunctionResult
+        _hubContext = hubContext;
+    }
+
+    public async Task<FYEnterMatchAzureFunctionResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    {
+        //await _hubContext.Clients.All.SendAsync("OnSquadMatchmakingSuccess", new OnSquadMatchmakingSuccessMessage {
+        //    Success = true,
+        //    SessionID = request.MapName, // TODO: Need to implement TryGetCompleteSquadInfo and pass squad info
+        //    SquadID = request.SquadId,
+        //});
+
+        // Dedicated-server mode (2nd preprod): if GAMESERVER_ADDRESS ("host:port") is set, hand
+        // the client the real game server to travel to instead of the client-hosted station.
+        // Same image as preprod — only this env var flips the deployment type.
+        var gameServer = Environment.GetEnvironmentVariable("GAMESERVER_ADDRESS");
+        if (!string.IsNullOrEmpty(gameServer))
+        {
+            var parts = gameServer.Split(':');
+            return new FYEnterMatchAzureFunctionResult
             {
                 Success = true,
-            Address = "127.0.0.1",
                 ErrorMessage = "",
-            Port = 7777,
+                SingleplayerStation = false,
-            ShardIndex = 0,
+                Address = parts[0],
-            SingleplayerStation = true,
+                Port = parts.Length > 1 && int.TryParse(parts[1], out var gsPort) ? gsPort : 7777,
                 MaintenanceMode = false,
-            SessionTimeJoinDelay = 0
+            };
-        });
+        }
+
+        return new FYEnterMatchAzureFunctionResult
+        {
+            Success = true,
+            ErrorMessage = "",
+            SingleplayerStation = true,
+            Address = request.MapName,
+            MaintenanceMode = false,
+            Port = 7777,
+        };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/EnterMatchmakingMatch.cs

@@ -0,0 +1,133 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Microsoft.AspNetCore.SignalR;
+using Prospect.Server.Api.Hubs;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class OnSquadMatchmakingSuccessMessage {
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+    [JsonPropertyName("sessionId")]
+    public string SessionID { get; set; }
+    [JsonPropertyName("squadId")]
+    public string SquadID { get; set; }
+}
+
+[CloudScriptFunction("EnterMatchmakingMatch")]
+public class EnterMatchmakingMatchFunction : ICloudScriptFunction<FYEnterMatchAzureFunction, FYEnterMatchmakingResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly IHubContext<CycleHub> _hubContext;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly SignalRConnectionRegistry _registry;
+
+    public EnterMatchmakingMatchFunction(IHubContext<CycleHub> hubContext, IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService, SignalRConnectionRegistry registry)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _hubContext = hubContext;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _registry = registry;
+    }
+
+    public async Task<FYEnterMatchmakingResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+
+        var userId = context.User.FindAuthUserId();
+        var titleData = _titleDataService.Find(new List<string>{"Contracts"});
+        var contracts = JsonSerializer.Deserialize<Dictionary<string, TitleDataContractInfo>>(titleData["Contracts"]);
+
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"ContractsActive", "Inventory"}
+        );
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value);
+        // Compute delivery quest progress before deploy.
+        // This ensures that the quest progress will be shown on the planet.
+        // The station doesn't seem to care about delivery quests progress and calculates progress
+        // based on actual items in stash. And so does the "ClaimActiveContract" function.
+        foreach (var contractActive in contractsActive.Contracts) {
+            if (!contracts.TryGetValue(contractActive.ContractID, out var contract)) {
+                continue;
+            }
+            for (var i = 0; i < contract.Objectives.Length; i++) {
+                if (i >= contractActive.Progress.Length) {
+                    // Defensive: player progress array shorter than the objective list.
+                    break;
+                }
+                var objective = contract.Objectives[i];
+                // Raid-runtime objectives (kills, dead-drops, visited areas, looted
+                // containers) are simulated inside the client-hosted raid; with no
+                // dedicated game server their progress is never reported to the backend,
+                // so they would never be saved. Auto-credit them on deploy so the
+                // objective persists and the station shows the contract as completable.
+                if (objective.Type.IsRaidRuntime()) {
+                    contractActive.Progress[i] = objective.MaxProgress;
+                    continue;
+                }
+                if (objective.Type != EYContractObjectiveType.OwnNumOfItem) {
+                    continue;
+                }
+                int remaining = objective.MaxProgress;
+                foreach (var item in inventory) {
+                    if (item.BaseItemId != objective.ItemToOwn) {
+                        continue;
+                    }
+                    remaining -= item.Amount;
+                    if (remaining <= 0) {
+                        remaining = 0;
+                        break;
+                    }
+                }
+                contractActive.Progress[i] = objective.MaxProgress - remaining;
+            }
+        }
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["ContractsActive"] = JsonSerializer.Serialize(contractsActive),
+            }
+        );
+
+        // Send the "matchmaking succeeded / travel to match" signal only to the deploying
+        // player (via their mapped SignalR connection) — broadcasting to Clients.All made
+        // every connected player travel too. Fall back to broadcast only if the connection
+        // isn't mapped yet.
+        // Dedicated-server mode (2nd preprod): point the client at the real game server address
+        // to travel to; otherwise keep the map name (client-hosted). Same image — env flips it.
+        var gameServer = Environment.GetEnvironmentVariable("GAMESERVER_ADDRESS");
+        var deployMessage = new OnSquadMatchmakingSuccessMessage {
+            Success = true,
+            SessionID = string.IsNullOrEmpty(gameServer) ? request.MapName : gameServer,
+            SquadID = request.SquadId,
+        };
+        var connectionId = _registry.GetConnection(userId);
+        if (connectionId != null)
+            await _hubContext.Clients.Client(connectionId).SendAsync("OnSquadMatchmakingSuccess", deployMessage);
+        else
+            await _hubContext.Clients.All.SendAsync("OnSquadMatchmakingSuccess", deployMessage);
+
+        return new FYEnterMatchmakingResult
+        {
+            Success = true,
+            ErrorMessage = "",
+            SingleplayerStation = false,
+            NumAttempts = 1,
+            Blocker = 0,
+            IsMatchTravel = true,
+            SessionId = "", // TODO: Not sure how this affects match travel
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/EnterMatchmakingStation.cs

@@ -0,0 +1,107 @@
+using System.Text.Json;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+// Config d'une police d'assurance (TitleData "InventoryInsurance").
+public class InventoryInsurancePolicy
+{
+    public string InsuranceId { get; set; }
+    public double Cost { get; set; }
+    public double Payout { get; set; }
+}
+
+[CloudScriptFunction("EnterMatchmakingStation")]
+public class EnterMatchmakingStationFunction : ICloudScriptFunction<FYEnterMatchAzureFunction, FYEnterMatchmakingResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly ILogger<EnterMatchmakingStationFunction> _logger;
+
+    public EnterMatchmakingStationFunction(
+        IHttpContextAccessor httpContextAccessor,
+        UserDataService userDataService,
+        TitleDataService titleDataService,
+        ILogger<EnterMatchmakingStationFunction> logger)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _logger = logger;
+    }
+
+    public async Task<FYEnterMatchmakingResult> ExecuteAsync(FYEnterMatchAzureFunction request)
+    {
+        // Au déploiement, le client peut demander d'assurer une partie de l'inventaire.
+        var insurance = request.PurchaseInventoryInsurances;
+        var context = _httpContextAccessor.HttpContext;
+        if (context != null && insurance?.ItemIds is { Count: > 0 })
+        {
+            try
+            {
+                await ApplyInsuranceAsync(context.User.FindAuthUserId(), insurance);
+            }
+            catch (Exception e)
+            {
+                // Ne jamais bloquer le déploiement à cause de l'assurance.
+                _logger.LogWarning(e, "Failed to apply inventory insurance on deploy");
+            }
+        }
+
+        return new FYEnterMatchmakingResult
+        {
+            Success = true,
+            ErrorMessage = "",
+            SingleplayerStation = true, // NOTE: This will always travel to single player station
+            IsMatchTravel = false,
+        };
+    }
+
+    // Marque les items choisis comme assurés (Insurance + propriétaire) et débite la
+    // prime en InsuranceCurrency selon le coût de la police (TitleData InventoryInsurance).
+    private async Task ApplyInsuranceAsync(string userId, FYPurchaseInventoryInsuranceRequest req)
+    {
+        var titleData = _titleDataService.Find(new List<string> { "InventoryInsurance" });
+        var policies = JsonSerializer.Deserialize<Dictionary<string, InventoryInsurancePolicy>>(titleData["InventoryInsurance"]);
+        var insuranceId = string.IsNullOrEmpty(req.InsuranceId) ? "Default" : req.InsuranceId;
+        if (policies == null || !policies.TryGetValue(insuranceId, out var policy))
+        {
+            _logger.LogWarning("Unknown insurance policy {InsuranceId}", insuranceId);
+            return;
+        }
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "Inventory", "Balance" });
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+
+        var toInsure = new HashSet<string>(req.ItemIds);
+        var insuredCount = 0;
+        foreach (var item in inventory)
+        {
+            if (!toInsure.Contains(item.ItemId)) continue;
+            item.Insurance = insuranceId;
+            item.InsuranceOwnerPlayfabId = userId;
+            insuredCount++;
+        }
+        if (insuredCount == 0) return;
+
+        // Prime = coût de la police × nombre d'items assurés (arrondi au supérieur),
+        // plafonnée au solde disponible pour ne jamais passer en négatif.
+        var premium = (int)Math.Ceiling(policy.Cost * insuredCount);
+        premium = Math.Min(premium, balance.InsuranceCurrency);
+        balance.InsuranceCurrency -= premium;
+
+        await _userDataService.UpdateAsync(userId, userId, new Dictionary<string, string>
+        {
+            ["Inventory"] = JsonSerializer.Serialize(inventory),
+            ["Balance"] = JsonSerializer.Serialize(balance),
+        });
+        _logger.LogInformation("Insured {Count} item(s) under policy {Policy} for user {User} (premium {Premium})",
+            insuredCount, insuranceId, userId, premium);
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/FetchSteamEntitlements.cs

@@ -0,0 +1,34 @@
+using Prospect.Server.Api.Services.CloudScript;
+
+public class FetchSteamEntitlementsRequest
+{
+    // Empty request
+}
+
+public class FetchSteamEntitlementsResponse
+{
+    // TODO: Unknown structure
+}
+
+[CloudScriptFunction("FetchSteamEntitlements")]
+public class FetchSteamEntitlementsFunction : ICloudScriptFunction<FetchSteamEntitlementsRequest, FetchSteamEntitlementsResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public FetchSteamEntitlementsFunction(IHttpContextAccessor httpContextAccessor)
+    {
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public async Task<FetchSteamEntitlementsResponse> ExecuteAsync(FetchSteamEntitlementsRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+
+        return new FetchSteamEntitlementsResponse
+        {};
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/GetActiveGlobalVanity.cs

@@ -0,0 +1,52 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.UserData;
+
+public class FYActiveGlobalVanity {
+    [JsonPropertyName("activeGlobalVanityIds")]
+    public string[] ActiveGlobalVanityIds { get; set; }
+    [JsonPropertyName("droppodId")]
+    public string DropPodID { get; set; }
+}
+
+public class FYGetActiveGlobalVanityRequest
+{
+    // Empty request
+}
+
+public class FYGetActiveGlobalVanityResponse
+{
+    [JsonPropertyName("activeVanity")]
+    public FYActiveGlobalVanity ActiveVanity { get; set; }
+}
+
+[CloudScriptFunction("GetActiveGlobalVanity")]
+public class GetActiveGlobalVanityFunction : ICloudScriptFunction<FYGetActiveGlobalVanityRequest, FYGetActiveGlobalVanityResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+
+    public GetActiveGlobalVanityFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+    }
+
+    public async Task<FYGetActiveGlobalVanityResponse> ExecuteAsync(FYGetActiveGlobalVanityRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"GlobalVanity"});
+        var activeVanity = JsonSerializer.Deserialize<FYActiveGlobalVanity>(userData["GlobalVanity"].Value);
+
+        return new FYGetActiveGlobalVanityResponse{
+            ActiveVanity = activeVanity
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/GetCharacterVanity.cs

@@ -1,67 +1,75 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
+public class FYGetCharacterVanityResponse {
+    [JsonPropertyName("success")]
+    public bool Success { get; set; }
+
+    [JsonPropertyName("returnVanity")]
+    public FYCharacterVanity ReturnVanity { get; set; }
+}
+
+public class FYVanityMaterialItem {
+    [JsonPropertyName("id")]
+    public string ID { get; set; }
+    [JsonPropertyName("materialIndex")]
+    public int MaterialIndex { get; set; }
+}
+
+public class FYCharacterVanity {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("head_item")]
+    public FYVanityMaterialItem HeadItem { get; set; }
+    [JsonPropertyName("boots_item")]
+    public FYVanityMaterialItem BootsItem { get; set; }
+    [JsonPropertyName("chest_item")]
+    public FYVanityMaterialItem ChestItem { get; set; }
+    [JsonPropertyName("glove_item")]
+    public FYVanityMaterialItem GloveItem { get; set; }
+    [JsonPropertyName("base_suit_item")]
+    public FYVanityMaterialItem BaseSuitItem { get; set; }
+    [JsonPropertyName("melee_weapon_item")]
+    public FYVanityMaterialItem MeleeWeaponItem { get; set; }
+    [JsonPropertyName("body_type")]
+    public int BodyType { get; set; }
+    [JsonPropertyName("archetype_id")]
+    public string ArchetypeID { get; set; }
+    [JsonPropertyName("slot_index")]
+    public int SlotIndex { get; set; }
+}
+
 [CloudScriptFunction("GetCharacterVanity")]
-public class GetCharacterVanity : ICloudScriptFunction<FYGetCharacterVanityRequest, object?>
+public class GetCharacterVanity : ICloudScriptFunction<FYGetCharacterVanityRequest, FYGetCharacterVanityResponse?>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public GetCharacterVanity(IHttpContextAccessor httpContextAccessor)
+    public GetCharacterVanity(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
 
-    public Task<object?> ExecuteAsync(FYGetCharacterVanityRequest request)
+    public async Task<FYGetCharacterVanityResponse?> ExecuteAsync(FYGetCharacterVanityRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
-            return Task.FromResult<object?>(null);
+            return null;
         }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"CharacterVanity"});
+        var returnVanity = JsonSerializer.Deserialize<FYCharacterVanity>(userData["CharacterVanity"].Value);
 
-        return Task.FromResult<object?>(new
+        return new FYGetCharacterVanityResponse{
-        {
+            Success = true,
-            userId = context.User.FindAuthUserId(),
+            ReturnVanity = returnVanity,
-            error = (object?)null,
+        };
-            returnVanity = new
-            {
-                userId = context.User.FindAuthUserId(),
-                head_item = new
-                {
-                    id = "Black02M_Head1",
-                    materialIndex = 0,
-                },
-                boots_item = new
-                {
-                    id = "StarterOutfit01_Boots_M",
-                    materialIndex = 0,
-                },
-                chest_item = new
-                {
-                    id = "StarterOutfit01_Chest_M",
-                    materialIndex = 0,
-                },
-                glove_item = new
-                {
-                    id = "StarterOutfit01_Gloves_M",
-                    materialIndex = 0,
-                },
-                base_suit_item = new
-                {
-                    id = "StarterOutfit01M_BaseSuit",
-                    materialIndex = 0,
-                },
-                melee_weapon_item = new
-                {
-                    id = "Melee_Omega",
-                    materialIndex = 0,
-                },
-                body_type = 1,
-                archetype_id = "TheProspector",
-                slot_index = 0
-            }
-        });
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/GetCraftingInProgressData.cs

@@ -1,6 +1,8 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
 using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
@@ -8,13 +10,15 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class GetCraftingInProgressData : ICloudScriptFunction<FYGetCraftingInProgressDataRequest, FYGetCraftingInProgressDataResult>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public GetCraftingInProgressData(IHttpContextAccessor httpContextAccessor)
+    public GetCraftingInProgressData(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
 
-    public Task<FYGetCraftingInProgressDataResult> ExecuteAsync(FYGetCraftingInProgressDataRequest request)
+    public async Task<FYGetCraftingInProgressDataResult> ExecuteAsync(FYGetCraftingInProgressDataRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
@@ -22,20 +26,20 @@ public class GetCraftingInProgressData : ICloudScriptFunction<FYGetCraftingInPro
             throw new CloudScriptException("CloudScript was not called within a http request");
         }
 
-        return Task.FromResult(new FYGetCraftingInProgressDataResult
+        var userId = context.User.FindAuthUserId();
+
+        // Return the persisted in-progress craft (written by StartItemCraftingClient)
+        // instead of an empty stub, so the crafting timer survives a menu reopen / relog.
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "CraftingTimer__2022_05_12" });
+        // Fully qualified: a different FYItemCurrentlyBeingCrafted also exists in this namespace.
+        var craft = JsonSerializer.Deserialize<Models.Data.FYItemCurrentlyBeingCrafted>(userData["CraftingTimer__2022_05_12"].Value)
+                    ?? new Models.Data.FYItemCurrentlyBeingCrafted();
+
+        return new FYGetCraftingInProgressDataResult
         {
-            UserId = context.User.FindAuthUserId(),
+            UserId = userId,
             Error = string.Empty,
-            ItemCurrentlyBeingCrafted = new FYItemCurrentlyBeingCrafted
+            ItemCurrentlyBeingCrafted = craft,
-            {
+        };
-                ItemId = null,
-                ItemRarity = -1,
-                PurchaseAmount = -1,
-                UtcTimestampWhenCraftingStarted = new FYTimestamp
-                {
-                    Seconds = 0
-                }
-            }
-        });
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/GetFriendList.cs

@@ -1,15 +1,119 @@
-using Prospect.Server.Api.Services.CloudScript.Models;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.Database;
+using Prospect.Server.Api.Services.Database.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
 [CloudScriptFunction("GetFriendList")]
 public class GetFriendList : ICloudScriptFunction<FYBaseSocialRequest, object?>
 {
-    public Task<object?> ExecuteAsync(FYBaseSocialRequest request)
+    private readonly ILogger<GetFriendList> _logger;
-    {
+    private readonly IHttpContextAccessor _httpContextAccessor;
-        return Task.FromResult<object?>(new
+    private readonly UserDataService _userDataService;
-        {
+    private readonly DbUserService _userService;
 
+    public GetFriendList(ILogger<GetFriendList> logger, IHttpContextAccessor httpContextAccessor, UserDataService userDataService, DbUserService userService)
+    {
+        _logger = logger;
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _userService = userService;
+    }
+
+    public async Task<object?> ExecuteAsync(FYBaseSocialRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        // Imported Steam friends (persisted by ClientsideFriendsImport), resolved to players
+        // that actually exist on this private server.
+        var steamIds = new List<string>();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "ImportedSteamFriends" });
+        if (userData.TryGetValue("ImportedSteamFriends", out var rec) && !string.IsNullOrWhiteSpace(rec.Value))
+        {
+            try { steamIds = JsonSerializer.Deserialize<List<string>>(rec.Value) ?? new List<string>(); }
+            catch { /* ignore malformed */ }
+        }
+
+        var friends = new List<object>();
+        if (steamIds.Count > 0)
+        {
+            var players = await _userService.FindManyAsync(PlayFabUserAuthType.Steam, steamIds);
+            var nowUtc = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+            foreach (var player in players)
+            {
+                if (player.Id == userId) continue; // never list yourself
+
+                var steamId = player.Auth?.FirstOrDefault(a => a.Type == PlayFabUserAuthType.Steam)?.Key ?? "";
+                var displayName = string.IsNullOrWhiteSpace(player.DisplayName) ? "Prospector" : player.DisplayName;
+
+                // 0 = offline, 1 = online, 2 = in match. Online if seen in the last 3 minutes.
+                var onlineState = 0;
+                var presenceData = await _userDataService.FindAsync(player.Id, player.Id, new List<string> { "PresenceState" });
+                if (presenceData.TryGetValue("PresenceState", out var presenceRec) && !string.IsNullOrWhiteSpace(presenceRec.Value))
+                {
+                    try
+                    {
+                        var presence = JsonSerializer.Deserialize<PlayerPresenceState>(presenceRec.Value);
+                        if (presence != null && nowUtc - presence.LastSeenUtc <= 180)
+                        {
+                            onlineState = presence.InMatch ? 2 : 1;
+                        }
+                    }
+                    catch { /* ignore malformed presence */ }
+                }
+
+                // The exact model the UE client binds is not documented, so expose the identity
+                // under every plausible field name (camelCase + PlayFab PascalCase) and both a
+                // flat and nested profile — whichever the client reads, the tile gets populated.
+                friends.Add(new
+                {
+                    // identity
+                    friendPlayFabId = player.Id,
+                    FriendPlayFabId = player.Id,
+                    playerId = player.Id,
+                    PlayerId = player.Id,
+                    playFabId = player.Id,
+                    PlayFabId = player.Id,
+                    // name
+                    displayName,
+                    DisplayName = displayName,
+                    titleDisplayName = displayName,
+                    TitleDisplayName = displayName,
+                    name = displayName,
+                    username = displayName,
+                    Username = displayName,
+                    // steam
+                    steamId,
+                    SteamId = steamId,
+                    steamInfo = new { steamId, SteamId = steamId },
+                    SteamInfo = new { SteamId = steamId, steamId },
+                    // presence
+                    onlineState,
+                    OnlineState = onlineState,
+                    isOnline = onlineState > 0,
+                    inMatch = onlineState == 2,
+                    presence = new { onlineState, state = onlineState },
+                    avatarUrl = "",
+                    // nested profiles
+                    profile = new { playerId = player.Id, displayName, avatarUrl = "" },
+                    Profile = new { PlayerId = player.Id, DisplayName = displayName, PlayerProfileModel = new { DisplayName = displayName } },
+                    tags = Array.Empty<string>(),
+                    Tags = Array.Empty<string>(),
                 });
             }
+        }
+
+        // Return the list under both the camelCase and PlayFab-cased container keys.
+        var result = new { friends, Friends = friends, count = friends.Count };
+        _logger.LogInformation("GetFriendList for {User}: {Count} friend(s); payload={Json}", userId, friends.Count, JsonSerializer.Serialize(result));
+        return result;
+    }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/GetLoginQueuePosition.cs

@@ -0,0 +1,39 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class GetLoginQueuePositionRequest
+{
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+    [JsonPropertyName("region")]
+    public string Region { get; set; }
+}
+
+public class GetLoginQueuePositionResponse
+{
+    [JsonPropertyName("waitingUserCount")]
+    public int WaitingUserCount { get; set; }
+}
+
+[CloudScriptFunction("GetLoginQueuePosition")]
+public class GetLoginQueuePositionFunction : ICloudScriptFunction<GetLoginQueuePositionRequest, GetLoginQueuePositionResponse>
+{
+    private readonly ILogger<GetLoginQueuePositionFunction> _logger;
+
+    public GetLoginQueuePositionFunction(ILogger<GetLoginQueuePositionFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<GetLoginQueuePositionResponse> ExecuteAsync(GetLoginQueuePositionRequest request)
+    {
+        _logger.LogInformation("Processing user rollback if needed");
+
+        return new GetLoginQueuePositionResponse
+        {
+            WaitingUserCount = 0,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/GetPlayerQuartersDataClient.cs

@@ -0,0 +1,77 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+public class GetPlayerQuartersDataClientRequest
+{
+    // Empty request
+}
+
+public class FYGetPlayerQuartersDataClientResponse
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("level")]
+    public int Level { get; set; }
+    [JsonPropertyName("upgradeStartedTime")]
+	public FYTimestamp UpgradeStartedTime { get; set; }
+    [JsonPropertyName("remainingTimeInSeconds")]
+	public int RemainingTimeInSeconds { get; set; }
+}
+
+public class FYPlayerQuarterStatus
+{
+    [JsonPropertyName("level")]
+    public int Level { get; set; }
+    [JsonPropertyName("upgradeStartedTime")]
+	public FYTimestamp UpgradeStartedTime { get; set; }
+}
+
+[CloudScriptFunction("GetPlayerQuartersDataClient")]
+public class GetPlayerQuartersDataClientFunction : ICloudScriptFunction<GetPlayerQuartersDataClientRequest, FYGetPlayerQuartersDataClientResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public GetPlayerQuartersDataClientFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYGetPlayerQuartersDataClientResponse> ExecuteAsync(GetPlayerQuartersDataClientRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"PlayerQuartersLevel"}
+        );
+        var titleData = _titleDataService.Find(new List<string>{ "PlayerQuarters" });
+
+        var playerQuartersData = JsonSerializer.Deserialize<TitleDataPlayerQuartersInfo[]>(titleData["PlayerQuarters"]);
+        var userPlayerQuarters = JsonSerializer.Deserialize<FYPlayerQuarterStatus>(userData["PlayerQuartersLevel"].Value);
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var remainingTime = 0;
+        if (userPlayerQuarters.UpgradeStartedTime.Seconds != 0) {
+            var nextLevel = playerQuartersData[userPlayerQuarters.Level - 1];
+            remainingTime = userPlayerQuarters.UpgradeStartedTime.Seconds + nextLevel.UpgradeSeconds - now;
+        }
+
+        return new FYGetPlayerQuartersDataClientResponse {
+            UserID = userId,
+            Level = userPlayerQuarters.Level,
+            RemainingTimeInSeconds = remainingTime,
+            UpgradeStartedTime = userPlayerQuarters.UpgradeStartedTime,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/GetPlayerSets.cs

@@ -1,5 +1,7 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
@@ -7,43 +9,53 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class GetPlayerSets : ICloudScriptFunction<FYGetPlayersSets, object?>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public GetPlayerSets(IHttpContextAccessor httpContextAccessor)
+    public GetPlayerSets(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
 
-    public Task<object?> ExecuteAsync(FYGetPlayersSets request)
+    public async Task<object?> ExecuteAsync(FYGetPlayersSets request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
-            return Task.FromResult<object?>(null);
+            return null;
         }
 
-        return Task.FromResult<object?>(new
+        var userId = context.User.FindAuthUserId();
+
+        // Return the player's persisted loadout (written by CompleteInventoryUpdate /
+        // RequestUpdateStationInventory) instead of a blank set, so saved gear survives
+        // a menu reopen / relog. Same response shape as before, just populated.
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string> { "LOADOUT" });
+        var loadout = JsonSerializer.Deserialize<LoadoutData>(userData["LOADOUT"].Value) ?? new LoadoutData();
+
+        return new
         {
             success = true,
-            entries = new []
+            entries = new[]
             {
                 new
                 {
                     setData = new
                     {
                         id = "",
-                        userId = context.User.FindAuthUserId(),
+                        userId,
                         kit = "",
-                        shield = "",
+                        shield = loadout.Shield ?? "",
-                        helmet = "",
+                        helmet = loadout.Helmet ?? "",
-                        weaponOne = "",
+                        weaponOne = loadout.WeaponOne ?? "",
-                        weaponTwo = "",
+                        weaponTwo = loadout.WeaponTwo ?? "",
-                        bag = "",
+                        bag = loadout.Bag ?? "",
-                        bagItemsAsJsonStr = "",
+                        bagItemsAsJsonStr = loadout.BagItemsAsJsonStr ?? "",
-                        safeItemsAsJsonStr = ""
+                        safeItemsAsJsonStr = loadout.SafeItemsAsJsonStr ?? ""
                     },
                     items = Array.Empty<object>()
                 }
             }
-        });
+        };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/GetPlayerStatisticsRequestsClient.cs

@@ -0,0 +1,40 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+// ["DropsTotal","DeathsTotal","DeathsPlayerTotal","DeathsCreaturesTotal","DeathsOthersTotal","EvacsTotal","DeathsConsecutive","EvacsConsecutive","KillsPlayersTotal","KillsPlayersMax","KillsCreaturesTotal","KillsCreaturesMax","DamagePlayersTotal","DamagePlayersMax","DamageCreaturesTotal","DamageCreaturesMax","ContractsCompletedKorolevTotal","ContractsCompletedOsirisTotal","ContractsCompletedICATotal","ContractsCompletedTotal","MatchDurationMax","MatchDurationAvg","KMarksMatchMax","KMarksMatchTotal","KMarksTotal"]
+public class GetPlayerStatisticsRequestsClientRequest
+{
+    [JsonPropertyName("statistics")]
+    public string[] Statistics { get; set; }
+}
+
+[CloudScriptFunction("GetPlayerStatisticsRequestsClient")]
+public class GetPlayerStatisticsRequestsClientFunction : ICloudScriptFunction<GetPlayerStatisticsRequestsClientRequest, object>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public GetPlayerStatisticsRequestsClientFunction(IHttpContextAccessor httpContextAccessor)
+    {
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public Task<object> ExecuteAsync(GetPlayerStatisticsRequestsClientRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+
+        // Return each requested statistic with a value so the career screen renders instead
+        // of staying blank. Raid stats (kills/deaths/evacs/damage/…) come from the
+        // client-hosted raid and aren't tracked server-side, so they report 0 for now.
+        var stats = new List<object>();
+        foreach (var name in request.Statistics ?? Array.Empty<string>())
+        {
+            stats.Add(new { statisticName = name, value = 0 });
+        }
+
+        return Task.FromResult<object>(new { statistics = stats });
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/GetSignalRConnection.cs

@@ -1,16 +1,72 @@
-using Prospect.Server.Api.Services.CloudScript.Models;
+using System.Net;
+using System.Net.Sockets;
+using Microsoft.Extensions.Options;
+using Prospect.Server.Api.Config;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
 [CloudScriptFunction("GetSignalRConnection")]
 public class GetSignalRConnection : ICloudScriptFunction<FYGetSignalRConnection, FYGetSignalRConnectionResult>
 {
+    // LAN address of the homelab host. Clients on the local network get the SignalR URL on
+    // this IP (which their cert already validates via the IP/DNS SAN), while external clients
+    // keep the public domain from configuration. This matters because the real-time WebSocket
+    // (libwebsockets, incl. under Proton/Wine) can't reach the public domain from inside the
+    // LAN (hairpin NAT), which surfaced as "error code 5" right after the intro.
+    private const string LanHost = "192.168.1.136";
+
+    private readonly PlayFabSettings _settings;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly ILogger<GetSignalRConnection> _logger;
+
+    public GetSignalRConnection(IOptions<PlayFabSettings> settings, IHttpContextAccessor httpContextAccessor, ILogger<GetSignalRConnection> logger)
+    {
+        _settings = settings.Value;
+        _httpContextAccessor = httpContextAccessor;
+        _logger = logger;
+    }
+
     public Task<FYGetSignalRConnectionResult> ExecuteAsync(FYGetSignalRConnection request)
     {
+        // The game client connects to SignalR only over HTTPS.
+        var url = _settings.SignalRURL;
+
+        var remote = _httpContextAccessor.HttpContext?.Connection.RemoteIpAddress;
+        var lan = remote != null && IsLan(remote);
+        if (lan)
+        {
+            try
+            {
+                url = new UriBuilder(url) { Host = LanHost }.Uri.AbsoluteUri;
+            }
+            catch { /* keep the configured URL on any parsing issue */ }
+        }
+
+        // Tag the connection with the player id so the hub can map connection -> user and
+        // target server messages (deploy signal) instead of broadcasting to everyone.
+        var userId = _httpContextAccessor.HttpContext?.User.FindAuthUserId();
+        if (!string.IsNullOrEmpty(userId))
+            url += (url.Contains('?') ? "&" : "?") + "uid=" + Uri.EscapeDataString(userId);
+
+        _logger.LogInformation("GetSignalRConnection: remoteIp={Remote} lan={Lan} uid={Uid} -> {Url}", remote, lan, userId, url);
+
         return Task.FromResult(new FYGetSignalRConnectionResult
         {
-            Url = "https://localhost:5443/signalr/?hub=pubsub",
+            Url = url,
-            AccessToken = "TEST"
+            AccessToken = _settings.SignalRAccessToken
         });
     }
+
+    private static bool IsLan(IPAddress ip)
+    {
+        if (IPAddress.IsLoopback(ip)) return true;
+        if (ip.IsIPv4MappedToIPv6) ip = ip.MapToIPv4();
+        if (ip.AddressFamily != AddressFamily.InterNetwork) return false;
+        var b = ip.GetAddressBytes();
+        return b[0] == 10
+            || (b[0] == 172 && b[1] >= 16 && b[1] <= 31)
+            || (b[0] == 192 && b[1] == 168);
+    }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/GetTechTreeNodeDataClient.cs

@@ -0,0 +1,69 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Functions;
+using Prospect.Server.Api.Services.UserData;
+
+public class GetTechTreeNodeDataClientRequest
+{
+    // Empty request
+}
+
+public class GetTechTreeNodeDataClientResponse
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("nodesData")]
+    public FYTechTreeNodeStatus[] NodesData { get; set; }
+    [JsonPropertyName("remainingTimeInSeconds")]
+    public int RemainingTimeInSeconds { get; set; }
+}
+
+[CloudScriptFunction("GetTechTreeNodeDataClient")]
+public class GetTechTreeNodeDataClientFunction : ICloudScriptFunction<GetTechTreeNodeDataClientRequest, GetTechTreeNodeDataClientResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public GetTechTreeNodeDataClientFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<GetTechTreeNodeDataClientResponse> ExecuteAsync(GetTechTreeNodeDataClientRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"TechTreeNodeData"}
+        );
+
+        var titleData = _titleDataService.Find(new List<string>{"TechTreeNodes"});
+        var techTreeNodes = JsonSerializer.Deserialize<Dictionary<string, TitleDataTechTreeNodeInfo>>(titleData["TechTreeNodes"]);
+
+        var userTechTree = JsonSerializer.Deserialize<UserTechTreeNodeData>(userData["TechTreeNodeData"].Value);
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var remainingTime = 0;
+        if (userTechTree.NodeInProgress != "") {
+            var nodeInProgress = userTechTree.Nodes[userTechTree.NodeInProgress];
+            var node = techTreeNodes[userTechTree.NodeInProgress];
+            remainingTime = nodeInProgress.UpgradeStartedTime.Seconds + node.PerkLevels[nodeInProgress.Level].UpgradeSeconds - now;
+        }
+        return new GetTechTreeNodeDataClientResponse
+        {
+            UserID = userId,
+            NodesData = userTechTree.Nodes.Values.ToArray(),
+            RemainingTimeInSeconds = remainingTime,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/OnLogin.cs

@@ -0,0 +1,49 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class YOnLoginRequest
+{
+    [JsonPropertyName("gamePlatform")]
+    public string GamePlatform { get; set; }
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+    [JsonPropertyName("customTags")]
+    public Dictionary<string, string> CustomTags { get; set; } = new();
+}
+
+public class OnLoginResponse
+{
+    // TODO: Unknown structure
+}
+
+[CloudScriptFunction("OnLogin")]
+public class OnLoginFunction : ICloudScriptFunction<YOnLoginRequest, OnLoginResponse>
+{
+    private readonly ILogger<OnLoginFunction> _logger;
+
+    public OnLoginFunction(ILogger<OnLoginFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<OnLoginResponse> ExecuteAsync(YOnLoginRequest request)
+    {
+        _logger.LogInformation("Processing login request for platform {Platform} with nonce {Nonce}",
+            request.GamePlatform, request.LoginNonce);
+
+        // Example: Validate login
+        // if (string.IsNullOrEmpty(request.LoginNonce))
+        // {
+        //     return new OnLoginResponse
+        //     {};
+        // }
+
+        // Simulating user authentication logic
+        var sessionToken = Guid.NewGuid().ToString();
+
+        return new OnLoginResponse
+        {};
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/PlayerQuarterUpgradePurchaseClient.cs

@@ -0,0 +1,99 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYPlayerQuarterUpgradePurchaseClientRequest {
+    // Empty request
+}
+
+public class FYPlayerQuarterUpgradePurchaseClientResult {
+    [JsonPropertyName("userId")]
+	public string UserID { get; set; }
+    [JsonPropertyName("error")]
+	public string Error { get; set; }
+    [JsonPropertyName("newLevel")]
+	public int NewLevel { get; set; }
+    [JsonPropertyName("upgradeStartedTime")]
+	public FYTimestamp UpgradeStartedTime { get; set; }
+    [JsonPropertyName("remainingTimeInSeconds")]
+	public int RemainingTimeInSeconds { get; set; }
+    [JsonPropertyName("changedCurrencies")]
+	public FYCurrencyItem[] ChangedCurrencies { get; set; }
+    [JsonPropertyName("changedItems")]
+	public FYCustomItemInfo[] ChangedItems { get; set; }
+    [JsonPropertyName("deletedItems")]
+	public string[] DeletedItemsIds { get; set; }
+}
+
+[CloudScriptFunction("PlayerQuarterUpgradePurchaseClient")]
+public class PlayerQuarterUpgradePurchaseClient : ICloudScriptFunction<FYPlayerQuarterUpgradePurchaseClientRequest, FYPlayerQuarterUpgradePurchaseClientResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public PlayerQuarterUpgradePurchaseClient(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYPlayerQuarterUpgradePurchaseClientResult> ExecuteAsync(FYPlayerQuarterUpgradePurchaseClientRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"PlayerQuartersLevel"}
+        );
+
+        var userPlayerQuarters = JsonSerializer.Deserialize<FYPlayerQuarterStatus>(userData["PlayerQuartersLevel"].Value);
+        var titleData = _titleDataService.Find(new List<string>{"PlayerQuarters"});
+        var playerQuarters = JsonSerializer.Deserialize<TitleDataPlayerQuartersInfo[]>(titleData["PlayerQuarters"]);
+
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var endTime = playerQuarters[userPlayerQuarters.Level - 1].UpgradeSeconds + userPlayerQuarters.UpgradeStartedTime.Seconds;
+        if (now < endTime) {
+            return new FYPlayerQuarterUpgradePurchaseClientResult
+            {
+                UserID = userId,
+                Error = "Upgrade is in progress",
+            };
+        }
+
+        var upgradeStartedTime = new FYTimestamp {
+            Seconds = 0,
+        };
+        userPlayerQuarters.Level++;
+        userPlayerQuarters.UpgradeStartedTime = upgradeStartedTime;
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["PlayerQuartersLevel"] = JsonSerializer.Serialize(userPlayerQuarters),
+            }
+        );
+
+        return new FYPlayerQuarterUpgradePurchaseClientResult
+        {
+            UserID = userId,
+            Error = "",
+            NewLevel = userPlayerQuarters.Level,
+            UpgradeStartedTime = upgradeStartedTime,
+            RemainingTimeInSeconds = 0,
+            ChangedItems = [],
+            DeletedItemsIds = [],
+            ChangedCurrencies = [],
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/PurchaseWeaponShopItem.cs

@@ -0,0 +1,290 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.CloudScript.Functions;
+using Prospect.Server.Api.Services.UserData;
+
+public class PurchaseWeaponShopItemRequest
+{
+    [JsonPropertyName("blueprintName")]
+    public string BlueprintName { get; set; }
+    [JsonPropertyName("blueprintRarity")]
+    public int BlueprintRarity { get; set; }
+    [JsonPropertyName("purchaseAmount")]
+    public int PurchaseAmount { get; set; }
+    [JsonPropertyName("baseItemId")]
+    public string BaseItemID { get; set; }
+    [JsonPropertyName("shopItemBelongsTo")]
+    public string ShopItemBelongsTo { get; set; }
+}
+
+public class PurchaseWeaponShopItemResponse
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+
+    [JsonPropertyName("itemRarity")]
+    public int ItemRarity { get; set; }
+    [JsonPropertyName("changedCurrencies")]
+    public FYCurrencyItem[] ChangedCurrencies { get; set; }
+    [JsonPropertyName("itemsGrantedOrUpdated")]
+    public List<FYCustomItemInfo> ItemsGrantedOrUpdated { get; set; }
+    [JsonPropertyName("deletedItemsIds")]
+    public HashSet<string> DeletedItemsIds { get; set; }
+    [JsonPropertyName("purchaseAmount")]
+    public int PurchaseAmount { get; set; }
+    [JsonPropertyName("blueprintName")]
+    public string BlueprintName { get; set; }
+    [JsonPropertyName("shopItemBelongsTo")]
+    public string ShopItemBelongsTo { get; set; }
+}
+
+public class FYCurrencyItem {
+    [JsonPropertyName("currencyName")]
+    public string CurrencyName { get; set; }
+    [JsonPropertyName("amount")]
+    public int Amount { get; set; }
+}
+
+public class FYModItems {
+    [JsonPropertyName("m")]
+	public int[] M { get; set; } // mods
+};
+
+// FYItemOriginData
+public class FYItemOriginBackend {
+    [JsonPropertyName("t")]
+	public string T { get; set; } // type
+    [JsonPropertyName("p")]
+	public string P { get; set; } // playfabid
+    [JsonPropertyName("g")]
+	public string G { get; set; } // guid
+};
+
+// FYRolledPerkEntry
+public class FYRolledPerkBackend {
+    [JsonPropertyName("i")]
+	public int I { get; set; } // short perk id
+    [JsonPropertyName("r")]
+	public float R { get; set; } // rolled range value
+};
+
+public class FYCustomItemInfo {
+    [JsonPropertyName("itemId")]
+	public string ItemId { get; set; }
+    [JsonPropertyName("baseItemId")]
+	public string BaseItemId { get; set; }
+    [JsonPropertyName("primaryVanityId")] // Item skin
+	public int PrimaryVanityId { get; set; }
+    [JsonPropertyName("secondaryVanityId")] // Item charm
+	public int SecondaryVanityId { get; set; }
+    [JsonPropertyName("amount")]
+	public int Amount { get; set; }
+    [JsonPropertyName("durability")]
+	public int Durability { get; set; }
+    [JsonPropertyName("modData")]
+	public FYModItems ModData { get; set; }
+    [JsonPropertyName("rolledPerks")]
+	public FYRolledPerkBackend[] RolledPerks { get; set; }
+    [JsonPropertyName("insurance")]
+	public string Insurance { get; set; }
+    [JsonPropertyName("insuranceOwnerPlayfabId")]
+	public string InsuranceOwnerPlayfabId { get; set; }
+    [JsonPropertyName("insuredAttachmentId")]
+	public string InsuredAttachmentId { get; set; }
+    [JsonPropertyName("origin")]
+	public FYItemOriginBackend Origin { get; set; }
+};
+
+public class CustomVanityItem {
+    [JsonPropertyName("baseItemId")]
+	public string BaseItemId { get; set; }
+    [JsonPropertyName("origin")]
+	public FYItemOriginBackend Origin { get; set; }
+};
+
+[CloudScriptFunction("PurchaseWeaponShopItem")]
+public class PurchaseWeaponShopItemFunction : ICloudScriptFunction<PurchaseWeaponShopItemRequest, PurchaseWeaponShopItemResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly ILogger<PurchaseWeaponShopItemFunction> _logger;
+
+    public PurchaseWeaponShopItemFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService, ILogger<PurchaseWeaponShopItemFunction> logger)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _logger = logger;
+    }
+
+    public async Task<PurchaseWeaponShopItemResponse> ExecuteAsync(PurchaseWeaponShopItemRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        if (request.PurchaseAmount <= 0) {
+            return new PurchaseWeaponShopItemResponse
+            {
+                UserID = userId,
+                Error = "Invalid purchase amount",
+            };
+        }
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"Inventory", "Balance", "ContractsOneTimeCompleted"});
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+        var blueprintsData = _titleDataService.Find(new List<string>{"Blueprints"});
+        var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(blueprintsData["Blueprints"]);
+        if (!blueprints.ContainsKey(request.BaseItemID)) {
+            _logger.LogError("Failed to find item ID {ItemID}", request.BaseItemID);
+            return new PurchaseWeaponShopItemResponse
+            {
+                UserID = userId,
+                Error = "Invalid base item ID",
+            };
+        }
+
+        var blueprintData = blueprints[request.BaseItemID];
+
+        // Contract unlock criteria: some items can only be purchased after completing a
+        // specific contract. The data uses the sentinel "None" (not an empty string) for
+        // items with no lock — treat that (and null/empty) as "no lock", otherwise EVERY
+        // item gets gated and nothing can be bought.
+        var contractLockPurchase = blueprintData.UnlockData?.ContractLockPurchase;
+        if (!string.IsNullOrEmpty(contractLockPurchase) && contractLockPurchase != "None")
+        {
+            var completed = JsonSerializer.Deserialize<FYGetCompletedContractsResult>(userData["ContractsOneTimeCompleted"].Value);
+            if (completed?.ContractsIDs == null || !completed.ContractsIDs.Contains(contractLockPurchase))
+            {
+                return new PurchaseWeaponShopItemResponse
+                {
+                    UserID = userId,
+                    Error = "Item is locked: complete the required contract first",
+                };
+            }
+        }
+
+        // Validate price
+        var shopCraftingData = blueprintData.ItemShopsCraftingData[request.ShopItemBelongsTo];
+        // TODO: Refactor
+        List<FYCustomItemInfo> grantedOrUpdated = [];
+        HashSet<string> deletedItemsIds = [];
+        List<FYCurrencyItem> changedCurrencies = [];
+        foreach (var ingredient in shopCraftingData.ItemRecipeIngredients) {
+            int remaining = ingredient.Amount;
+            if (ingredient.Currency == "SoftCurrency") {
+                var buyCost = request.PurchaseAmount * ingredient.Amount;
+                remaining -= buyCost;
+                balance.SoftCurrency -= buyCost;
+                changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency });
+            } else if (ingredient.Currency == "Aurum") {
+                var buyCost = request.PurchaseAmount * ingredient.Amount;
+                remaining -= buyCost;
+                balance.HardCurrency -= buyCost;
+                changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency });
+            } else {
+                foreach (var item in inventory) {
+                    if (item.BaseItemId != ingredient.Currency) {
+                        continue;
+                    }
+                    var localRemaining = remaining;
+                    remaining -= item.Amount;
+                    item.Amount -= localRemaining;
+                    if (item.Amount <= 0) {
+                        item.Amount = 0;
+                        deletedItemsIds.Add(item.ItemId);
+                    } else {
+                        grantedOrUpdated.Add(item);
+                    }
+                    if (remaining <= 0) {
+                        break;
+                    }
+                }
+            }
+            if (remaining > 0) {
+                return new PurchaseWeaponShopItemResponse
+                {
+                    UserID = userId,
+                    Error = "Missing required items",
+                };
+            }
+        }
+
+        // TODO: Optimize
+        var newInventory = new List<FYCustomItemInfo>(inventory.Count);
+        foreach (var item in inventory) {
+            if (!deletedItemsIds.Contains(item.ItemId)) {
+                newInventory.Add(item);
+            }
+        }
+
+        // TODO: Inventory limit check
+        // TODO: Refactor into a helper function
+        var remainingAmount = request.PurchaseAmount * blueprintData.AmountPerPurchase;
+
+        // Populate incomplete stacks first
+        foreach (var item in newInventory) {
+            if (item.BaseItemId != request.BaseItemID || item.Amount >= blueprintData.MaxAmountPerStack) {
+                continue;
+            }
+            var remainingSpace = blueprintData.MaxAmountPerStack - item.Amount;
+            var amountToAdd = Math.Min(remainingAmount, remainingSpace);
+            item.Amount += amountToAdd;
+            remainingAmount -= amountToAdd;
+            grantedOrUpdated.Add(item);
+            if (remainingAmount == 0) {
+                break;
+            }
+        }
+
+        // Then create new items
+        while (remainingAmount > 0) {
+            var itemStackAmount = Math.Min(blueprintData.MaxAmountPerStack, remainingAmount);
+            var grantedItem = new FYCustomItemInfo {
+                ItemId = Guid.NewGuid().ToString(),
+                Amount = itemStackAmount,
+                BaseItemId = request.BaseItemID,
+                Durability = blueprintData.DurabilityMax,
+                Insurance = "",
+                InsuranceOwnerPlayfabId = "",
+                ModData = new FYModItems { M = [] },
+                Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                InsuredAttachmentId = "",
+                PrimaryVanityId = 0,
+                SecondaryVanityId = 0,
+                RolledPerks = [],
+            };
+            newInventory.Add(grantedItem);
+            grantedOrUpdated.Add(grantedItem);
+            remainingAmount -= itemStackAmount;
+        }
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["Inventory"] = JsonSerializer.Serialize(newInventory),
+                ["Balance"] = JsonSerializer.Serialize(balance),
+            }
+        );
+
+        return new PurchaseWeaponShopItemResponse
+        {
+            UserID = userId,
+            Error = "",
+            BlueprintName = request.BlueprintName,
+            ItemRarity = request.BlueprintRarity,
+            PurchaseAmount = request.PurchaseAmount,
+            ChangedCurrencies = changedCurrencies.ToArray(),
+            DeletedItemsIds = deletedItemsIds,
+            ItemsGrantedOrUpdated = grantedOrUpdated,
+            ShopItemBelongsTo = request.ShopItemBelongsTo
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RefreshVictimCompensationPackages.cs

@@ -0,0 +1,35 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class RefreshVictimCompensationPackagesRequest
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+}
+
+public class RefreshVictimCompensationPackagesResponse
+{
+    [JsonPropertyName("compensationPackages")]
+    public object[] CompensationPackages { get; set; }
+}
+
+[CloudScriptFunction("RefreshVictimCompensationPackages")]
+public class RefreshVictimCompensationPackagesFunction : ICloudScriptFunction<RefreshVictimCompensationPackagesRequest, RefreshVictimCompensationPackagesResponse>
+{
+    private readonly ILogger<RefreshVictimCompensationPackagesFunction> _logger;
+
+    public RefreshVictimCompensationPackagesFunction(ILogger<RefreshVictimCompensationPackagesFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<RefreshVictimCompensationPackagesResponse> ExecuteAsync(RefreshVictimCompensationPackagesRequest request)
+    {
+        _logger.LogInformation("Processing refresh victim compensation packages");
+
+        return new RefreshVictimCompensationPackagesResponse
+        {
+            CompensationPackages = [],
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RegisterUserMacAddressRequest.cs

@@ -0,0 +1,33 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class RegisterUserMacAddressRequestRequest
+{
+    [JsonPropertyName("macAddress")]
+    public string MacAddress { get; set; }
+}
+
+public class RegisterUserMacAddressRequestResponse
+{
+    [JsonPropertyName("result")]
+    public bool Result { get; set; }
+}
+
+[CloudScriptFunction("RegisterUserMacAddressRequest")]
+public class RegisterUserMacAddressRequestFunction : ICloudScriptFunction<RegisterUserMacAddressRequestRequest, RegisterUserMacAddressRequestResponse>
+{
+    private readonly ILogger<RegisterUserMacAddressRequestFunction> _logger;
+
+    public RegisterUserMacAddressRequestFunction(ILogger<RegisterUserMacAddressRequestFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<RegisterUserMacAddressRequestResponse> ExecuteAsync(RegisterUserMacAddressRequestRequest request)
+    {
+        return new RegisterUserMacAddressRequestResponse
+        {
+            Result = true,
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RepairItem.cs

@@ -0,0 +1,103 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.UserData;
+using Prospect.Server.Api.Utils;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYRepairItemRequest {
+    [JsonPropertyName("instanceId")]
+	public string InstanceID { get; set; }
+}
+
+public class FYRepairItemResult {
+    [JsonPropertyName("userId")]
+	public string UserID { get; set; }
+    [JsonPropertyName("error")]
+	public string Error { get; set; }
+    [JsonPropertyName("changedCurrencies")]
+	public FYCurrencyItem[] ChangedCurrencies { get; set; }
+    [JsonPropertyName("changedItems")]
+	public FYCustomItemInfo[] ChangedItems { get; set; }
+}
+
+[CloudScriptFunction("RepairItem")]
+public class RepairItem : ICloudScriptFunction<FYRepairItemRequest, FYRepairItemResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public RepairItem(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYRepairItemResult> ExecuteAsync(FYRepairItemRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var titleData = _titleDataService.Find(new List<string>{"Blueprints"});
+
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string>{"Balance", "Inventory"}
+        );
+
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+
+        var item = inventory.Find(item => item.ItemId == request.InstanceID);
+        if (item == null) {
+            return new FYRepairItemResult
+            {
+                UserID = userId,
+                Error = "Item not found",
+            };
+        }
+
+        var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+        var blueprintData = blueprints[item.BaseItemId];
+
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+
+        var repairCost = blueprintData.RepairCostBase + (int)Math.Ceiling((1 - (float)item.Durability / blueprintData.DurabilityMax) * blueprintData.RepairCostMaxDurability);
+        if (item.Durability == 0) {
+            repairCost += blueprintData.RepairCostModifierBroken;
+        }
+        if (balance.SoftCurrency < repairCost) {
+            return new FYRepairItemResult
+            {
+                UserID = userId,
+                Error = "Insufficient balance",
+            };
+        }
+        balance.SoftCurrency -= repairCost;
+        item.Durability = blueprintData.DurabilityMax;
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["Inventory"] = JsonSerializer.Serialize(inventory),
+                ["Balance"] = JsonSerializer.Serialize(balance),
+            }
+        );
+
+        return new FYRepairItemResult
+        {
+            UserID = userId,
+            Error = "",
+            ChangedItems = [item],
+            ChangedCurrencies = [
+                new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency },
+            ],
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/ReportBiEvents.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class ReportBiEventsRequest
+{
+    [JsonPropertyName("messages")]
+    public object[] Messages { get; set; }
+}
+
+public class ReportBiEventsResponse
+{
+    // TODO: Unknown structure
+}
+
+[CloudScriptFunction("ReportBiEvents")]
+public class ReportBiEventsFunction : ICloudScriptFunction<ReportBiEventsRequest, ReportBiEventsResponse>
+{
+    private readonly ILogger<ReportBiEventsFunction> _logger;
+
+    public ReportBiEventsFunction(ILogger<ReportBiEventsFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<ReportBiEventsResponse> ExecuteAsync(ReportBiEventsRequest request)
+    {
+        _logger.LogInformation("Processing Bi Event");
+
+        return new ReportBiEventsResponse{};
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestActiveObjectivesAndBoardsData.cs

@@ -0,0 +1,110 @@
+using System.Collections;
+using System.Diagnostics.Contracts;
+using System.Text.Json;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.CloudScript.Models.Data;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+[CloudScriptFunction("RequestActiveObjectivesAndBoardsData")]
+public class RequestActiveObjectivesAndBoardsData : ICloudScriptFunction<FYQueryFactionProgressionRequest, FYGetPlayerContractsResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly string[] factions = ["Korolev", "Osiris", "ICA"]; // TODO: Order is important
+    private readonly string[] difficulties = ["Easy", "Medium", "Hard"];
+    private readonly Random rnd = new Random();
+
+    public RequestActiveObjectivesAndBoardsData(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYGetPlayerContractsResult> ExecuteAsync(FYQueryFactionProgressionRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            return new FYGetPlayerContractsResult{};
+        }
+        var userId = context.User.FindAuthUserId();
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{ "ContractsActive", "JobBoardsData", "FactionProgressionKorolev", "FactionProgressionICA", "FactionProgressionOsiris" });
+        var contractsActive = JsonSerializer.Deserialize<FYGetActiveContractsResult>(userData["ContractsActive"].Value);
+        var jobBoardsData = JsonSerializer.Deserialize<JobBoardsData>(userData["JobBoardsData"].Value);
+
+        var now = (int)DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var lastBoardRefreshTimeUtc = jobBoardsData.LastBoardRefreshTimeUtc;
+        var boards = jobBoardsData.Boards;
+        // The boards are updated once in 3 hours
+        if (now >= lastBoardRefreshTimeUtc.Seconds + 60 * 60 * 3) {
+            var titleData = _titleDataService.Find(new List<string> { "Contracts", "Jobs", "LevelData" });
+
+            var contracts = JsonSerializer.Deserialize<Dictionary<string, TitleDataContractInfo>>(titleData["Contracts"]);
+            var jobs = JsonSerializer.Deserialize<Dictionary<string, Dictionary<string, string[]>>>(titleData["Jobs"]);
+            var levelsData = JsonSerializer.Deserialize<Dictionary<string, int[]>>(titleData["LevelData"]);
+            var currentQuests = new Dictionary<string, Dictionary<string, bool>> { 
+                ["Korolev"] = new Dictionary<string, bool> { ["Easy"] = false, ["Medium"] = false, ["Hard"] = false },
+                ["Osiris"] = new Dictionary<string, bool> { ["Easy"] = false, ["Medium"] = false, ["Hard"] = false },
+                ["ICA"] = new Dictionary<string, bool> { ["Easy"] = false, ["Medium"] = false, ["Hard"] = false },
+            };
+
+            foreach (var contract in contractsActive.Contracts) {
+                var parts = contract.ContractID.Split('-');
+                if (parts[0] != "NEW") {
+                    continue;
+                }
+                var difficulty = parts[1];
+                var faction = parts[2] == "KOR" ? "Korolev" : parts[2];
+                currentQuests[faction][difficulty] = true;
+            }
+
+            for (var i = 0; i < factions.Length; i++) {
+                var faction = factions[i];
+                var factionProgression = JsonSerializer.Deserialize<int>(userData[$"FactionProgression{faction}"].Value);
+                var levels = levelsData[faction];
+                var level = levels.Length - Array.FindIndex(levels, (int xp) => {
+                    return factionProgression >= xp;
+                });
+
+                for (var j = 0; j < difficulties.Length; j++) {
+                    var difficulty = difficulties[j];
+                    if (currentQuests[faction][difficulty]) {
+                        continue;
+                    }
+                    var factionJobs = jobs[faction];
+                    var jobsAvailable = Array.FindAll(factionJobs[difficulty], (string jobId) => {
+                        return level >= contracts[jobId].UnlockData.Level;
+                    });
+                    string jobId = jobsAvailable.Length > 0 ? jobsAvailable[rnd.Next(jobsAvailable.Length)] : factionJobs[difficulty][0];
+                    boards[i].Contracts[j] = new FYFactionContractData { ContractId = jobId };
+                }
+            }
+            lastBoardRefreshTimeUtc.Seconds = now;
+
+            await _userDataService.UpdateAsync(
+                userId, userId,
+                new Dictionary<string, string> { ["JobBoardsData"] = JsonSerializer.Serialize(jobBoardsData) }
+            );
+        }
+
+        return new FYGetPlayerContractsResult
+        {
+            UserId = userId,
+            Error = null,
+            ActiveContracts = contractsActive.Contracts,
+            FactionsContracts = new FYFactionsContractsData
+            {
+                Boards = boards,
+                LastBoardRefreshTimeUtc = lastBoardRefreshTimeUtc
+            },
+            RefreshHours24UtcFromBackend = 12 // Doesn't seem to work
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestCanReconnect.cs

@@ -0,0 +1,58 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class RequestCanReconnectRequest
+{
+    // Empty request
+}
+
+public class RequestCanReconnectResponse
+{
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    //[JsonPropertyName("error")]
+    //public int Error { get; set; }
+    //[JsonPropertyName("changedItems")]
+    //public int changedItems { get; set; }
+    //[JsonPropertyName("sessionId")]
+    //public int SessionID { get; set; }
+    //[JsonPropertyName("info")]
+    //public int Info { get; set; }
+    //[JsonPropertyName("lastSessionResult")]
+    //public int LastSessionResult { get; set; }
+    //[JsonPropertyName("lastSessionId")]
+    //public int LastSessionID { get; set; }
+}
+
+[CloudScriptFunction("RequestCanReconnect")]
+public class RequestCanReconnectFunction : ICloudScriptFunction<RequestCanReconnectRequest, RequestCanReconnectResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public RequestCanReconnectFunction(IHttpContextAccessor httpContextAccessor)
+    {
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    public async Task<RequestCanReconnectResponse> ExecuteAsync(RequestCanReconnectRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            return new RequestCanReconnectResponse
+            {};
+        }
+
+        return new RequestCanReconnectResponse
+        {
+            //Error = 0,
+            //Info = 0,
+            //LastSessionResult = 0,
+            //LastSessionID = 0,
+            //SessionID = 0,
+            //changedItems = 0,
+            UserID = context.User.FindAuthUserId(),
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestClaimFortunaPassRewards.cs

@@ -0,0 +1,165 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.CloudScript;
+using Prospect.Server.Api.Services.UserData;
+
+public class FYFortunaPassClaimedRewards {
+    [JsonPropertyName("rewardsIds")]
+	public List<string> RewardsIDs { get; set; }
+};
+
+// Récompense d'un palier de la passe (catalogue optionnel TitleData "FortunaPass2_Rewards").
+// itemId "SoftCurrency"/"Aurum"/"InsuranceCurrency" = monnaie, sinon item d'inventaire.
+public class FortunaPassRewardDef {
+    [JsonPropertyName("itemId")]
+    public string ItemId { get; set; }
+    [JsonPropertyName("amount")]
+    public int Amount { get; set; }
+}
+
+public class RequestClaimFortunaPassRewardsRequest
+{
+    [JsonPropertyName("rewardsIds")]
+    public string[] RewardsIDs { get; set; }
+}
+
+public class RequestClaimFortunaPassRewardsResponse
+{
+    [JsonPropertyName("userIds")]
+    public string UserId { get; set; }
+    [JsonPropertyName("error")]
+	public string Error { get; set; }
+    [JsonPropertyName("errorType")]
+	public int ErrorType { get; set; }
+    [JsonPropertyName("grantedItems")]
+	public FYCustomItemInfo[] GrantedItems { get; set; }
+    [JsonPropertyName("changedCurrencies")]
+	public FYCurrencyItem[] ChangedCurrencies { get; set; }
+}
+
+[CloudScriptFunction("RequestClaimFortunaPassRewards")]
+public class RequestClaimFortunaPassRewardsFunction : ICloudScriptFunction<RequestClaimFortunaPassRewardsRequest, RequestClaimFortunaPassRewardsResponse>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+    private readonly ILogger<RequestClaimFortunaPassRewardsFunction> _logger;
+
+    public RequestClaimFortunaPassRewardsFunction(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService, ILogger<RequestClaimFortunaPassRewardsFunction> logger)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+        _logger = logger;
+    }
+
+    public async Task<RequestClaimFortunaPassRewardsResponse> ExecuteAsync(RequestClaimFortunaPassRewardsRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        // Clé de la saison courante (déterminée par la config de build) — évite d'écraser
+        // la progression de l'autre saison (l'ancien code écrasait S2 ET S3).
+#if SEASON_3_RELEASE || SEASON_3_DEBUG
+        const string claimedKey = "FortunaPass3_ClaimedRewards";
+        const string rewardsCatalogKey = "FortunaPass3_Rewards";
+#else
+        const string claimedKey = "FortunaPass2_ClaimedRewards";
+        const string rewardsCatalogKey = "FortunaPass2_Rewards";
+#endif
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{ claimedKey, "Inventory", "Balance" });
+        var claimedRewards = JsonSerializer.Deserialize<FYFortunaPassClaimedRewards>(userData[claimedKey].Value)
+            ?? new FYFortunaPassClaimedRewards { RewardsIDs = new List<string>() };
+        claimedRewards.RewardsIDs ??= new List<string>();
+
+        // Catalogue des récompenses (optionnel) : rewardId -> {itemId, amount}.
+        Dictionary<string, FortunaPassRewardDef> catalog = null;
+        try
+        {
+            var td = _titleDataService.Find(new List<string> { rewardsCatalogKey });
+            if (td.TryGetValue(rewardsCatalogKey, out var raw) && !string.IsNullOrWhiteSpace(raw))
+                catalog = JsonSerializer.Deserialize<Dictionary<string, FortunaPassRewardDef>>(raw);
+        }
+        catch { /* pas de catalogue → on enregistre seulement la réclamation */ }
+
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value) ?? new List<FYCustomItemInfo>();
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+        var grantedItems = new List<FYCustomItemInfo>();
+        var changedCurrencies = new List<FYCurrencyItem>();
+
+        foreach (var rewardId in request.RewardsIDs)
+        {
+            // Ne pas re-créditer un palier déjà réclamé.
+            if (claimedRewards.RewardsIDs.Contains(rewardId)) continue;
+
+            if (catalog == null || !catalog.TryGetValue(rewardId, out var def) || def == null)
+            {
+                // Le catalogue des paliers est défini côté client (DataTable). On journalise
+                // les IDs inconnus pour pouvoir construire un vrai catalogue FortunaPass{2,3}_Rewards
+                // qui matche. IMPORTANT : ne PAS marquer le palier comme réclamé si on ne peut rien
+                // accorder — sinon il serait brûlé définitivement et inclaimable une fois le
+                // catalogue ajouté.
+                _logger.LogInformation("FortunaPass claim: aucun catalogue pour le reward '{RewardId}' (catalogue {State}) — non accordé", rewardId, catalog == null ? "absent" : "présent");
+                continue;
+            }
+
+            claimedRewards.RewardsIDs.Add(rewardId);
+            _logger.LogInformation("FortunaPass claim: octroi reward '{RewardId}' -> {ItemId} x{Amount}", rewardId, def.ItemId, def.Amount);
+
+            switch (def.ItemId)
+            {
+                case "SoftCurrency":
+                    balance.SoftCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency });
+                    break;
+                case "Aurum":
+                    balance.HardCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency });
+                    break;
+                case "InsuranceCurrency":
+                    balance.InsuranceCurrency += def.Amount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "InsuranceCurrency", Amount = balance.InsuranceCurrency });
+                    break;
+                default:
+                    var item = new FYCustomItemInfo {
+                        ItemId = Guid.NewGuid().ToString(),
+                        Amount = def.Amount <= 0 ? 1 : def.Amount,
+                        BaseItemId = def.ItemId,
+                        Durability = 0,
+                        Insurance = "",
+                        InsuranceOwnerPlayfabId = "",
+                        ModData = new FYModItems { M = [] },
+                        Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                        InsuredAttachmentId = "",
+                        PrimaryVanityId = 0,
+                        SecondaryVanityId = 0,
+                        RolledPerks = [],
+                    };
+                    inventory.Add(item);
+                    grantedItems.Add(item);
+                    break;
+            }
+        }
+
+        var changes = new Dictionary<string, string> { [claimedKey] = JsonSerializer.Serialize(claimedRewards) };
+        if (grantedItems.Count > 0) changes["Inventory"] = JsonSerializer.Serialize(inventory);
+        if (changedCurrencies.Count > 0) changes["Balance"] = JsonSerializer.Serialize(balance);
+        await _userDataService.UpdateAsync(userId, userId, changes);
+
+        return new RequestClaimFortunaPassRewardsResponse
+        {
+            UserId = userId,
+            ErrorType = 3, // EYFortunaPassToastReponseType::Ok
+            Error = "",
+            GrantedItems = grantedItems.ToArray(),
+            ChangedCurrencies = changedCurrencies.ToArray(),
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestFactionProgression.cs

@@ -1,5 +1,7 @@
-using Prospect.Server.Api.Services.Auth.Extensions;
+using System.Text.Json;
+using Prospect.Server.Api.Services.Auth.Extensions;
 using Prospect.Server.Api.Services.CloudScript.Models;
+using Prospect.Server.Api.Services.UserData;
 
 namespace Prospect.Server.Api.Services.CloudScript.Functions;
 
@@ -7,42 +9,43 @@ namespace Prospect.Server.Api.Services.CloudScript.Functions;
 public class RequestFactionProgression : ICloudScriptFunction<FYQueryFactionProgressionRequest, object?>
 {
     private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
 
-    public RequestFactionProgression(IHttpContextAccessor httpContextAccessor)
+    public RequestFactionProgression(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
     {
         _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
     }
 
-    public Task<object?> ExecuteAsync(FYQueryFactionProgressionRequest request)
+    public async Task<object?> ExecuteAsync(FYQueryFactionProgressionRequest request)
     {
         var context = _httpContextAccessor.HttpContext;
         if (context == null)
         {
-            return Task.FromResult<object?>(null);
+            return null;
         }
+        var userId = context.User.FindAuthUserId();
 
-        return Task.FromResult<object?>(new
+        var userData = await _userDataService.FindAsync(
+            userId, userId,
+            new List<string> { "FactionProgressionICA", "FactionProgressionKorolev", "FactionProgressionOsiris" }
+        );
+
+        int Progression(string faction) =>
+            userData.TryGetValue("FactionProgression" + faction, out var v) && v.Value != null
+                ? JsonSerializer.Deserialize<int>(v.Value)
+                : 0;
+
+        return new
         {
-            factions = new []
+            factions = new[]
             {
-                new
+                new { factionId = "ICA", currentProgression = Progression("ICA") },
-                {
+                new { factionId = "Korolev", currentProgression = Progression("Korolev") },
-                    factionId = "ICA",
+                new { factionId = "Osiris", currentProgression = Progression("Osiris") },
-                    currentProgression = 0
             },
-                new
+            userId,
-                {
-                    factionId = "Korolev",
-                    currentProgression = 0
-                },
-                new
-                {
-                    factionId = "Osiris",
-                    currentProgression = 0
-                },
-            },
-            userId = context.User.FindAuthUserId(),
             error = ""
-        });
+        };
     }
 }

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestIsPlayerStillOnBattleServer.cs

@@ -0,0 +1,34 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+// Season 1 request
+public class RequestIsPlayerStillOnBattleServerRequest
+{
+}
+
+public class RequestIsPlayerStillOnBattleServerResponse
+{
+    [JsonPropertyName("isStillOnBattleServer")]
+	public bool IsStillOnBattleServer { get; set; }
+	[JsonPropertyName("infoStillOnBattleServer")]
+    public string InfoStillOnBattleServer { get; set; }
+}
+
+[CloudScriptFunction("RequestIsPlayerStillOnBattleServer")]
+public class RequestIsPlayerStillOnBattleServerFunction : ICloudScriptFunction<RequestIsPlayerStillOnBattleServerRequest, RequestIsPlayerStillOnBattleServerResponse>
+{
+    private readonly ILogger<RequestIsPlayerStillOnBattleServerFunction> _logger;
+
+    public RequestIsPlayerStillOnBattleServerFunction(ILogger<RequestIsPlayerStillOnBattleServerFunction> logger)
+    {
+        _logger = logger;
+    }
+    public async Task<RequestIsPlayerStillOnBattleServerResponse> ExecuteAsync(RequestIsPlayerStillOnBattleServerRequest request)
+    {
+        return new RequestIsPlayerStillOnBattleServerResponse
+        {
+            IsStillOnBattleServer = false,
+            InfoStillOnBattleServer = "",
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestMigrateSteamAccountFromCB1.cs

@@ -0,0 +1,31 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class RequestMigrateSteamAccountFromCB1Request
+{
+    [JsonPropertyName("steamId")]
+    public string SteamID { get; set; }
+}
+
+public class RequestMigrateSteamAccountFromCB1Response
+{}
+
+[CloudScriptFunction("RequestMigrateSteamAccountFromCB1")]
+public class RequestMigrateSteamAccountFromCB1Function : ICloudScriptFunction<RequestMigrateSteamAccountFromCB1Request, RequestMigrateSteamAccountFromCB1Response>
+{
+    private readonly ILogger<RequestMigrateSteamAccountFromCB1Function> _logger;
+
+    public RequestMigrateSteamAccountFromCB1Function(ILogger<RequestMigrateSteamAccountFromCB1Function> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<RequestMigrateSteamAccountFromCB1Response> ExecuteAsync(RequestMigrateSteamAccountFromCB1Request request)
+    {
+        _logger.LogInformation("Processing CB1 account migration request request for Steam account {SteamID}",
+            request.SteamID);
+
+        return new RequestMigrateSteamAccountFromCB1Response
+        {};
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestMissionCompleted.cs

@@ -0,0 +1,127 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Models.Data;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYRequestMissionCompletedRequest {
+    [JsonPropertyName("currentMissionId")]
+    public string CurrentMissionID { get; set; }
+}
+
+public class FYRequestMissionCompletedResult {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("currentMissionId")]
+    public string CurrentMissionID { get; set; }
+    [JsonPropertyName("rewards")]
+    public List<FYCustomItemInfo> Rewards { get; set; }
+    [JsonPropertyName("updatedCurrencies")]
+    public FYCurrencyItem[] UpdatedCurrencies { get; set; }
+    [JsonPropertyName("progress")]
+    public int Progress { get; set; }
+}
+
+[CloudScriptFunction("RequestMissionCompleted")]
+public class RequestMissionCompleted : ICloudScriptFunction<FYRequestMissionCompletedRequest, FYRequestMissionCompletedResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+    private readonly TitleDataService _titleDataService;
+
+    public RequestMissionCompleted(IHttpContextAccessor httpContextAccessor, UserDataService userDataService, TitleDataService titleDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+        _titleDataService = titleDataService;
+    }
+
+    public async Task<FYRequestMissionCompletedResult> ExecuteAsync(FYRequestMissionCompletedRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"OnboardingProgression", "Inventory", "Balance"});
+        var onboardingMission = JsonSerializer.Deserialize<OnboardingMission>(userData["OnboardingProgression"].Value);
+        var inventory = JsonSerializer.Deserialize<List<FYCustomItemInfo>>(userData["Inventory"].Value);
+
+        var titleData = _titleDataService.Find(new List<string>{"OnboardingMissions", "OnboardingRewardMissions", "Blueprints"});
+        var rewards = JsonSerializer.Deserialize<Dictionary<string, TitleDataMissionRewardInfo>>(titleData["OnboardingRewardMissions"]);
+        var blueprints = JsonSerializer.Deserialize<Dictionary<string, TitleDataBlueprintInfo>>(titleData["Blueprints"]);
+        var missions = JsonSerializer.Deserialize<Dictionary<string, TitleDataMissionInfo>>(titleData["OnboardingMissions"]);
+        var balance = JsonSerializer.Deserialize<PlayerBalance>(userData["Balance"].Value);
+
+        var currentMission = missions[onboardingMission.CurrentMissionID];
+        var missionRewardId = currentMission.OnboardingRewards.RowName;
+        var nextMissionId = currentMission.NextMissionRowHandle.RowName;
+        onboardingMission.CurrentMissionID = nextMissionId;
+        onboardingMission.Progress = 0;
+
+        List<FYCustomItemInfo> rewardedItems = new List<FYCustomItemInfo>();
+        List<FYCurrencyItem> changedCurrencies = [];
+        if (rewards.ContainsKey(missionRewardId)) {
+            var missionRewards = rewards[missionRewardId].RewardEntries;
+            foreach (var reward in missionRewards) {
+                if (reward.RewardRowHandle.RowName == "SoftCurrency") {
+                    balance.SoftCurrency += reward.RewardAmount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "SoftCurrency", Amount = balance.SoftCurrency });
+                } else if (reward.RewardRowHandle.RowName == "Aurum") {
+                    balance.HardCurrency += reward.RewardAmount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "Aurum", Amount = balance.HardCurrency });
+                } else if (reward.RewardRowHandle.RowName == "InsuranceCurrency") {
+                    balance.InsuranceCurrency += reward.RewardAmount;
+                    changedCurrencies.Add(new FYCurrencyItem { CurrencyName = "InsuranceCurrency", Amount = balance.InsuranceCurrency });
+                } else {
+                    // TODO: Inventory limit check
+                    var blueprintData = blueprints[reward.RewardRowHandle.RowName];
+                    var remainingAmount = reward.RewardAmount * blueprintData.AmountPerPurchase;
+                    while (remainingAmount > 0) {
+                        var itemStackAmount = Math.Min(blueprintData.MaxAmountPerStack, remainingAmount);
+                        // TODO: Mission rewards are probably already given in stacks
+                        var itemInfo = new FYCustomItemInfo{
+                            ItemId = Guid.NewGuid().ToString(),
+                            Amount = itemStackAmount,
+                            BaseItemId = reward.RewardRowHandle.RowName,
+                            Durability = blueprintData.DurabilityMax,
+                            Insurance = "",
+                            InsuranceOwnerPlayfabId = "",
+                            ModData = new FYModItems { M = [] },
+                            Origin = new FYItemOriginBackend { G = "", P = "", T = "" },
+                            InsuredAttachmentId = "",
+                            PrimaryVanityId = 0,
+                            SecondaryVanityId = 0,
+                            RolledPerks = [],
+                        };
+                        inventory.Add(itemInfo);
+                        rewardedItems.Add(itemInfo);
+                        remainingAmount -= itemStackAmount;
+                    }
+                }
+            }
+        }
+
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{
+                ["OnboardingProgression"] = JsonSerializer.Serialize(onboardingMission),
+                ["Inventory"] = JsonSerializer.Serialize(inventory),
+                ["Balance"] = JsonSerializer.Serialize(balance),
+            }
+        );
+
+        return new FYRequestMissionCompletedResult
+        {
+            UserID = userId,
+            CurrentMissionID = nextMissionId,
+            Rewards = rewardedItems,
+            UpdatedCurrencies = changedCurrencies.ToArray(),
+            Progress = 0
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestMissionUpdate.cs

@@ -0,0 +1,83 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.Auth.Extensions;
+using Prospect.Server.Api.Services.UserData;
+
+namespace Prospect.Server.Api.Services.CloudScript.Functions;
+
+public class FYRequestMissionUpdateRequest {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("currentMissionId")]
+    public string CurrentMissionID { get; set; }
+    [JsonPropertyName("currentStepName")]
+    public string CurrentStepName { get; set; }
+    [JsonPropertyName("progress")]
+    public int Progress { get; set; }
+    [JsonPropertyName("currentRoomId")]
+    public string CurrentRoomID { get; set; }
+}
+
+public class FYRequestMissionUpdateResult {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("error")]
+    public string Error { get; set; }
+    [JsonPropertyName("currentMissionId")]
+    public string CurrentMissionID { get; set; }
+    [JsonPropertyName("rewards")]
+    public object[] Rewards { get; set; }
+    [JsonPropertyName("progress")]
+    public int Progress { get; set; }
+}
+
+public class OnboardingMission {
+    [JsonPropertyName("userId")]
+    public string UserID { get; set; }
+    [JsonPropertyName("currentMissionID")]
+    public string CurrentMissionID { get; set; }
+    [JsonPropertyName("progress")]
+    public int Progress { get; set; }
+    [JsonPropertyName("showPopup")]
+    public bool ShowPopup { get; set; }
+}
+
+[CloudScriptFunction("RequestMissionUpdate")]
+public class RequestMissionUpdate : ICloudScriptFunction<FYRequestMissionUpdateRequest, FYRequestMissionUpdateResult>
+{
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly UserDataService _userDataService;
+
+    public RequestMissionUpdate(IHttpContextAccessor httpContextAccessor, UserDataService userDataService)
+    {
+        _httpContextAccessor = httpContextAccessor;
+        _userDataService = userDataService;
+    }
+
+    public async Task<FYRequestMissionUpdateResult> ExecuteAsync(FYRequestMissionUpdateRequest request)
+    {
+        var context = _httpContextAccessor.HttpContext;
+        if (context == null)
+        {
+            throw new CloudScriptException("CloudScript was not called within a http request");
+        }
+        var userId = context.User.FindAuthUserId();
+        var userData = await _userDataService.FindAsync(userId, userId, new List<string>{"OnboardingProgression"});
+        var onboardingMission = JsonSerializer.Deserialize<OnboardingMission>(userData["OnboardingProgression"].Value);
+        onboardingMission.CurrentMissionID = request.CurrentMissionID;
+        onboardingMission.Progress = request.Progress;
+        await _userDataService.UpdateAsync(
+            userId, userId,
+            new Dictionary<string, string>{ ["OnboardingProgression"] = JsonSerializer.Serialize(onboardingMission) }
+        );
+
+        return new FYRequestMissionUpdateResult
+        {
+            UserID = userId,
+            Error = "",
+            CurrentMissionID = request.CurrentMissionID,
+            Rewards = [],
+            Progress = request.Progress
+        };
+    }
+}

src/Prospect.Server.Api/Services/CloudScript/Functions/RequestNewLegalAgreements.cs

@@ -0,0 +1,50 @@
+using System.Text.Json.Serialization;
+using Prospect.Server.Api.Services.CloudScript;
+
+public class RequestNewLegalAgreementsRequest
+{
+    [JsonPropertyName("gamePlatform")]
+    public string GamePlatform { get; set; }
+    [JsonPropertyName("nDAVersion")]
+    public int NDAVersion { get; set; }
+    [JsonPropertyName("eULAVersion")]
+    public int EULAVersion { get; set; }
+    [JsonPropertyName("tryBypass")]
+    public bool TryBypass { get; set; }
+    [JsonPropertyName("loginNonce")]
+    public string LoginNonce { get; set; }
+}
+
+public class RequestNewLegalAgreementsResponse
+{
+    [JsonPropertyName("requiredNDAVersion")]
+    public int NDAVersion { get; set; }
+    [JsonPropertyName("requiredEULAVersion")]
+    public int EULAVersion { get; set; }
+    [JsonPropertyName("hasAccepted")]
+    public int HasAccepted { get; set; }
+}
+
+[CloudScriptFunction("RequestNewLegalAgreements")]
+public class RequestNewLegalAgreementsFunction : ICloudScriptFunction<RequestNewLegalAgreementsRequest, RequestNewLegalAgreementsResponse>
+{
+    private readonly ILogger<RequestNewLegalAgreementsFunction> _logger;
+
+    public RequestNewLegalAgreementsFunction(ILogger<RequestNewLegalAgreementsFunction> logger)
+    {
+        _logger = logger;
+    }
+
+    public async Task<RequestNewLegalAgreementsResponse> ExecuteAsync(RequestNewLegalAgreementsRequest request)
+    {
+        _logger.LogInformation("Processing request new legal agreements for platform {Platform} with nonce {Nonce}",
+            request.GamePlatform, request.LoginNonce);
+
+        return new RequestNewLegalAgreementsResponse
+        {
+            NDAVersion = request.NDAVersion,
+            EULAVersion = request.EULAVersion,
+            HasAccepted = 1,
+        };
+    }
+}