Built by 
About this software
About Paperwala - Nostalgic 3D Web Game
Paperwala is a nostalgic 3D arcade game set in 1980s Dhaka where players deliver newspapers by bicycle through procedurally rendered streets. Built on Next.js 16 with Three.js WebGL rendering, it features mobile-first touch controls with haptic feedback, realistic bicycle physics, and a 7-day campaign progression. The system includes SQLite/Postgres database storage, role-based authentication (admin/rider), and a comprehensive administrative console for player management, run moderation, and system telemetry. Players compete on a global leaderboard while navigating hazards like street dogs, window targets, and delivery deadlines.
Why Paperwala - Nostalgic 3D Web Game
What makes it better
than the alternatives
- 01
Three.js WebGL Engine
Soft morning lighting, procedural bicycle kinematics, gouache-painted foliage, dynamic shadows and chrome finishes
- 02
Mobile-First Touch Physics
Dedicated pedaling, steering, throwing controls with vibration feedback and automatic fullscreen mode
- 03
Dual Database Support
Node SQLite (DatabaseSync WAL mode) for local deployment or Neon Postgres for serverless scaling
- 04
Role-Based Admin Console
Complete player management, run moderation, audit logs, system telemetry and JSON export at /admin
- 05
Cultural Authenticity
Dhaka landmarks (Mirpur Road, Road 27, Satmasjid Road), Bengali typography (Noto Serif Bengali), 1980s aesthetic
Game Engine & Rendering
- Three.js WebGL 3D graphics with procedural bicycle frame and handlebar steering
- Realistic physics: inertia
- cadence gear shifts
- wobble on collision
- jump trajectory
- Dynamic lighting with soft morning shadows and chrome material finishes
- Gouache-painted foliage textures and colonial verandah architecture
- 60 FPS performance optimization with mobile GPU compatibility
Player Controls & Input
- Desktop keyboard controls: Arrow keys for steering
- Spacebar for toss
- X for mischief
- Mobile touch layout: Pedal
- Brake
- Steer
- Toss
- Mischief buttons with haptic feedback
- Automatic fullscreen mode on mobile game start
- Mouse click alternative for newspaper throwing
- Pause/resume with Escape or P key
- HUD pause button
Campaign & Scoring
- 7-day weekly tour from Monday dawn to Sunday evening
- Paper toss targeting with dynamic trajectory prediction and balcony precision
- Window smash sound effects and speed delivery bonuses
- Interactive hazards: chasing street dogs
- radar speed traps
- ramp jumps
- Subscriber retention management across daily routes
Leaderboard System
- Global ranked leaderboard with parameterized queries (GET /api/leaderboard)
- Player registration with unique token issuance (POST /api/register)
- Run recording with score
- distance
- deliveries
- hazards (POST /api/runs)
- Scoped run deletion for players (DELETE /api/runs with token validation)
- Top 100 entries display with configurable LEADERBOARD_LIMIT
Authentication & Security
- Role-based access control: admin and rider roles
- HMAC-signed session tokens with HTTP-only cookies
- Bcrypt password hashing (12 rounds) for admin credentials
- Parameter-bound SQL queries preventing injection attacks
- Admin JWT secret and session secret environment variables
Administrative Console
- Dashboard at /admin with telemetry
- player stats
- run moderation
- Player management: GET
- PATCH
- DELETE operations on courier records
- Run moderation: Administrative deletion of flagged entries
- System diagnostics: Database health
- storage metrics
- JSON export
- Audit log viewer with retention purging (GET
- DELETE /
api/admin/audit
Database Layer
- Node SQLite (DatabaseSync) in WAL mode for local deployments
- Neon Postgres support for serverless scaling (DATABASE_TYPE=postgres)
- Schema with players
- runs
- leaderboard
- users
- audit_logs tables
- Migration scripts: setup-db.js
- seed-db.js
- migrate-neon.js
- Database seeding endpoint (POST /
api/admin/seedfor demo baseline
API Routes
- Player registration: POST /api/register returns token and player_id
- Run submission: POST /api/runs with authentication validation
- Admin login/logout: POST /
api/admin/login - /
api/admin/logoutwith cookie management - Stats endpoint: GET /
api/admin/statsfor system telemetry - User management: GET
- POST
- PATCH
- DELETE /
api/admin/usersfor operators
Deployment & Infrastructure
- Docker configuration with Dockerfile and docker-compose.yml
- Health check endpoint: wget /api/leaderboard every 30s
- Environment variable validation in docker-entrypoint.sh
- Production build with Next.js 16 static optimization
- Package audit script
scripts/package-audit.shfor vulnerability scanning
Cultural & Visual Assets
- Bengali typography with Noto Serif Bengali variable font
- Dhaka landmark artwork: Mirpur Road
- Road 27
- Satmasjid Road scenes
- 1980s aesthetic: Hero bicycle model
- vintage newspaper mastheads
- Audio assets: retro-melody.mp3 (6.5 MB)
- glass-breaking.mp3
- 3D models: playable-dog.glb
- grumpy-newsman.glb
- playable-houses.glb
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| JavaScript | — | — | Front-end | 66.3% |
| JavaScript (React) | — | — | Front-end | 25.6% |
| CSS | — | — | Styling | 5.9% |
| SQL | — | — | Database | 1.2% |
| Shell | — | — | Scripts | 1% |
- Primary language
- JavaScript (Node.js 22+)
- Framework
- Next.js 16.3 (React 19.2)
- Database
- SQLite 3 (node:sqlite) or PostgreSQL 14+ (Neon)
- Authentication
- HMAC-signed session tokens, bcrypt password hashing, role-based access control (admin/rider)
- Licence
- Single-site
- Screens
- 6
- Database tables
- 5
- Supported languages
- English (UI), Bengali (Noto Serif Bengali font for branding)
- Browser support
- Modern browsers with WebGL support (Chrome 90+, Firefox 88+, Safari 14+, Edge 90+)
| Minimum | Recommended | |
|---|---|---|
| CPU | 1 vCPU | 2 vCPU |
| RAM | 2 GB RAM / 2 GB storage | 4 GB RAM / 10 GB storage |
| OS | Node.js 22+ on Linux (Alpine, Ubuntu) or macOS | Node.js 22+ on Linux (Alpine, Ubuntu) or macOS |
| Est. monthly hosting | $5 | $5 |
```bash cp .env.example .env # Edit .env and set ADMIN_PASSWORD, ADMIN_JWT_SECRET, SESSION_SECRET docker-compose up -d ```
```bash curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs git clone <repo-url> paperwala cd paperwala cp .env.example .env # Edit .env with production secrets npm ci --omit=dev npm run db:setup npm run build PORT=3000 npm start ```
```bash vercel login vercel link # Set environment variables in Vercel dashboard: # DATABASE_TYPE=postgres # DATABASE_URL=<neon-pooled-connection-string> # ADMIN_PASSWORD, ADMIN_JWT_SECRET, SESSION_SECRET node scripts/migrate-neon.js vercel deploy --prod ```
```bash cp .env.example .env # Generate secrets: # ADMIN_PASSWORD=$(openssl rand -base64 24) # ADMIN_JWT_SECRET=$(openssl rand -base64 32) # SESSION_SECRET=$(openssl rand -base64 32) npm install npm run db:setup npm run dev # Open http://localhost:3000 ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (6 minor)
Small improvements the developer has been told about. None of them stop the software from working.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
