{
  "shell": {
    "title": "लटरी इन्टिग्रेसन दस्तावेज",
    "admin": "Admin",
    "adminLogin": "Admin console"
  },
  "nav": {
    "overview": "अवलोकन",
    "api": "API",
    "ship": "लाइभ",
    "home": "सारांश",
    "delivery": "इन्टिग्रेसन वितरण",
    "quickstart": "छिटो सुरु",
    "fundamentals": "रकम मोडेल",
    "setup": "सेटअप",
    "sso": "SSO",
    "iframe": "iframe प्रोटोकल",
    "wallet": "वालेट गेटवे",
    "transfer": "स्थानान्तरण (सन्दर्भ)",
    "errors": "त्रुटि कोड",
    "troubleshooting": "समस्या निवारण",
    "golive": "लाइभ सूची",
    "operations": "सञ्चालन",
    "adminGuide": "Admin Guide",
    "apiReference": "API Reference"
  },
  "headers": {
    "component": ["कम्पोनेन्ट", "भूमिका", "मालिक"],
    "convention": ["वस्तु", "नियम"],
    "claim": ["Claim", "Type", "Req", "Note"],
    "param": ["प्यारामिटर", "उद्देश्य"],
    "methodPath": ["Method", "Path", ""],
    "query": ["Query", "Type", ""],
    "field": ["Field", "Type", "Note"],
    "code": ["Code", "Message"],
    "http": ["Status", "message", "Cause"],
    "message": ["Dir", "type", "Payload"],
    "balance": ["फिल्ड", "खाता", "नोट"],
    "call": ["दिशा", "API", "Auth"],
    "sequence": ["चरण", "अभिनेता", "कार्य"],
    "envMap": ["वस्तु", "Admin साइट", "मुख्य .env", "नोट"],
    "account": ["प्रयोगकर्ता", "पासवर्ड", "site_player_id"],
    "contract": ["परिदृश्य", "HTTP", "Body"],
    "adminField": ["फिल्ड", "नोट", "उदाहरण"],
    "handoffTable": ["वस्तु", "विवरण", "जिम्मेवार"],
    "env": ["Environment", "Address example", "Note"],
    "envelopeTable": ["Dir", "Message fields", "Note"],
    "faq": ["Symptom", "Troubleshooting"]
  },
  "pages": {
    "overview": {
      "title": "Integration overview",
      "description": "For main-site developers / integration engineers. You implement: JWT signing + wallet gateway; lottery provides H5 and API.",
      "roles": "Roles",
      "flow": "Business flow",
      "e2eSequence": "End-to-end sequence",
      "conventions": "Conventions",
      "readingOrder": "Suggested reading order",
      "matrix": [
        ["Main site (partner)", "User login; server-side JWT; wallet gateway", "Partner"],
        ["Lottery API (us)", "JWT verify, transfer, bet, draw, settlement", "Us"],
        ["Lottery H5 (us)", "Player UI; iframe or URL entry", "Us"]
      ],
      "flowItems": [
        "User logs in on main site → main site server issues short-lived JWT",
        "Enter lottery H5 (iframe embed or URL ?token= redirect)",
        "Player taps transfer-in in H5 → lottery calls main site debit → lottery balance credited",
        "Player bets / wins in H5 (uses lottery balance)",
        "(Optional) Player taps transfer-out in H5 → lottery calls main site credit"
      ],
      "e2eRows": [
        ["1", "Main site", "User login; server issues JWT (site_code, site_player_id)"],
        ["2", "Main site", "Embed lottery H5 iframe, or redirect to lottery_h5_base_url/?token="],
        ["3", "Lottery H5", "Receives JWT; calls GET /api/v1/player/me to verify and auto-provision"],
        ["4", "Player", "Taps transfer-in in H5"],
        ["5", "Lottery API", "Server calls main site POST /wallet/debit-for-lottery"],
        ["6", "Main wallet", "Debit main_balance; return success: true"],
        ["7", "Lottery API", "Credit lottery balance"],
        ["8", "Player", "Bets / waits for settlement in H5"],
        ["9", "Player", "(Optional) taps transfer-out in H5"],
        ["10", "Lottery API", "Calls main site POST /wallet/credit-from-lottery"]
      ],
      "conventionRows": [
        ["Amount", "Minor integer units, e.g. 2000 = 20.00 NPR"],
        ["Encoding", "UTF-8 JSON"],
        ["Time", "JWT uses Unix seconds (iat / exp); recommend exp - iat ≤ 300 seconds"],
        ["Player API auth", "Authorization: Bearer {JWT} (main site signs, lottery verifies)"],
        ["Wallet gateway auth", "Authorization: Bearer {wallet_api_key} (lottery sends on callback)"]
      ],
      "readingItems": [
        "Integration delivery — confirm deliverables and environment URLs",
        "Quick start — first integration pass",
        "Setup — admin site provisioning and key mapping",
        "SSO → iframe protocol → wallet gateway",
        "Troubleshooting — common issues",
        "Go-live checklist — production release checks"
      ]
    },
    "delivery": {
      "title": "Integration delivery",
      "description": "Before integration testing, confirm the following deliverables with sales / support. Test and production environments must be fully isolated.",
      "handoffScope": "Integration scope (what you need to do)",
      "weProvide": "We provide",
      "youProvide": "Partner provides",
      "environment": "Environment URLs",
      "process": "Typical integration process",
      "note": "Secrets (sso_jwt_secret, wallet_api_key) are shown only once after creation — save them securely immediately. Store secrets on the main-site server only; never in frontend or mobile apps. URLs below are Tanumo current defaults; partner deployments follow sales delivery.",
      "handoffRows": [
        ["JWT signing", "Main site server issues HS256 JWT after login; no token-exchange login API", "Partner"],
        ["Wallet gateway", "Implement balance / debit / credit over HTTPS", "Partner"],
        ["iframe or URL entry", "Embed lottery H5 or redirect with JWT", "Partner"],
        ["Lottery H5 + API", "Games, transfer, bet, draw", "Us"],
        ["Integration site & keys", "Create site_code and deliver secrets", "Us (super admin)"]
      ],
      "provideRows": [
        ["site_code", "Site code written into JWT"],
        ["sso_jwt_secret", "JWT signing secret (held by main site)"],
        ["wallet_api_key", "Bearer secret when lottery calls wallet gateway"],
        ["lottery_h5_base_url", "Lottery H5 entry; default https://front.tanumo.com"],
        ["lottery_api_base_url", "Lottery API base; default https://lotterylaravel.tanumo.com"]
      ],
      "submitRows": [
        ["wallet_api_url", "Partner wallet gateway HTTPS root (publicly reachable)"],
        ["iframe_allowed_origins", "Main-site origin allowlist (required for iframe; one per line)"],
        ["Test accounts", "Several site_player_id values with initial main_balance"],
        ["Egress IP (if needed)", "If gateway uses IP allowlist, request lottery server egress IP"]
      ],
      "environmentRows": [
        ["Lottery API", "https://lotterylaravel.tanumo.com", "curl: GET /api/v1/player/me"],
        ["Lottery H5 entry", "https://front.tanumo.com", "iframe / ?token=; wallet example /wallet"],
        ["Integration docs", "https://lotteryadmin.tanumo.com/docs/integration", "Public documentation"],
        ["Admin console", "https://lotteryadmin.tanumo.com/admin", "Super admin; Config → Integration sites"],
        ["Production", "Separate domain and secrets", "site_code, secrets, domains not shared with staging"]
      ],
      "processSteps": [
        "Sales opens integration → our super admin creates integration site and delivers keys + H5 URL",
        "Partner implements three wallet endpoints on public HTTPS (tunnel OK for staging)",
        "Partner fills wallet_api_url, iframe_allowed_origins in admin; run connectivity test",
        "Partner implements JWT signing and iframe postMessage (or URL redirect)",
        "Complete integration using Quick start acceptance checklist",
        "Production: new site, new secrets, full end-to-end retest before go-live"
      ]
    },
    "quickstart": {
      "title": "छिटो सुरु",
      "description": "Assumes Integration delivery is done and you have site_code, secrets, and H5 URL. Follow these steps for first integration pass.",
      "prereq": "पूर्वशर्त",
      "steps": "Integration steps",
      "acceptance": "Acceptance checklist",
      "note": "JWT must be signed on the main-site server only — never hard-code sso_jwt_secret in frontend. Production wallet_api_url must be public HTTPS.",
      "prereqItems": [
        "Received site_code, sso_jwt_secret, wallet_api_key, lottery_h5_base_url",
        "Main site implements GET /wallet/balance, POST /wallet/debit-for-lottery, POST /wallet/credit-from-lottery",
        "Admin integration site has wallet_api_url and iframe_allowed_origins; connectivity test passed",
        "At least one test site_player_id with sufficient main_balance"
      ],
      "stepItems": [
        "Main-site server implements JWT signing (see SSO jsonwebtoken example)",
        "Self-test with curl: Bearer JWT on GET https://lotterylaravel.tanumo.com/api/v1/player/me → code=0",
        "Embed <iframe src=\"https://front.tanumo.com\"> on main site; listen for postMessage",
        "After LOTTERY_READY, send MAIN_INIT_TOKEN (token at message top level — see iframe page)",
        "After H5 enters hall, initiate transfer-in in H5",
        "Confirm main site receives POST /wallet/debit-for-lottery with success: true",
        "Confirm lottery balance increases in H5; try a bet",
        "(Optional) transfer-out in H5; confirm POST /wallet/credit-from-lottery callback",
        "Check off acceptance checklist below"
      ],
      "acceptanceItems": [
        "JWT self-test: curl https://lotterylaravel.tanumo.com/api/v1/player/me returns code=0, data.site_player_id correct",
        "Wallet self-test: curl POST /wallet/debit-for-lottery returns success:true, main_balance debited correctly",
        "Idempotency: same idempotent_key replay returns same response, no double debit",
        "iframe: LOTTERY_READY → MAIN_INIT_TOKEN → H5 hall loads",
        "Transfer-in: success in H5; main-site gateway logs show debit-for-lottery",
        "Refresh: after JWT near expiry or LOTTERY_TOKEN_NEEDED, MAIN_REFRESH_TOKEN succeeds"
      ]
    },
    "fundamentals": {
      "title": "Money model",
      "balances": "Two balance layers",
      "calls": "Call directions",
      "note": "All amounts use minor integers. Credit-line (agent) players are out of scope; this doc covers main-site wallet mode only.",
      "balanceRows": [
        ["main_balance", "Main wallet", "Partner gateway; lottery server callbacks debit/credit"],
        ["lottery balance", "In-lottery balance", "Used for betting after transfer-in; shown in lottery H5"]
      ],
      "callRows": [
        ["Lottery → main", "GET balance / POST debit / POST credit", "Bearer wallet_api_key"],
        ["Lottery H5 → lottery API", "me / transfer / bet / balance", "Bearer player JWT (main site not involved)"]
      ]
    },
    "setup": {
      "title": "Setup",
      "description": "Our super admin creates the integration site in admin. Secrets are shown only once — save immediately.",
      "weProvide": "After site creation we provide",
      "youProvide": "Partner fills / provides",
      "defaultPaths": "Default wallet paths",
      "envMapping": "Config mapping",
      "adminSop": "Admin provisioning (our super admin)",
      "network": "Network requirements",
      "note": "Test and production site_code, secrets, and domains must be fully isolated. Secrets go in main-site server config — not auto-synced from admin.",
      "receiveRows": [
        ["site_code", "Site code written into JWT"],
        ["sso_jwt_secret", "JWT signing secret (main site holds)"],
        ["wallet_api_key", "Wallet callback auth (main site verifies)"],
        ["lottery_h5_base_url", "Lottery H5 entry URL"]
      ],
      "provideRows": [
        ["wallet_api_url", "Partner wallet gateway HTTPS root (no path suffix)"],
        ["iframe_allowed_origins", "Main-site origin allowlist (iframe mode)"],
        ["Test accounts", "site_player_id list + initial balance"]
      ],
      "pathRows": [
        ["GET", "/wallet/balance", "Balance query"],
        ["POST", "/wallet/debit-for-lottery", "Debit (transfer-in)"],
        ["POST", "/wallet/credit-from-lottery", "Credit (transfer-out)"]
      ],
      "envMappingRows": [
        ["site_code", "code", "MAIN_SITE_CODE", "JWT and player provisioning; must match both sides"],
        ["SSO secret", "sso_jwt_secret", "MAIN_SITE_SSO_JWT_SECRET", "Main site signs JWT; lottery verifies"],
        ["Wallet auth", "wallet_api_key", "MAIN_SITE_WALLET_API_KEY", "Lottery sends Bearer on callback"],
        ["Wallet root URL", "wallet_api_url", "(main site deploy)", "Partner HTTPS root; lottery appends /wallet/*"],
        ["Lottery API", "—", "—", "Default https://lotterylaravel.tanumo.com; player/wallet API root"],
        ["Lottery H5", "lottery_h5_base_url", "(main site iframe src)", "Default https://front.tanumo.com"],
        ["iframe allowlist", "iframe_allowed_origins", "(main site origin)", "Must match actual main-site origin"]
      ],
      "adminSopSteps": [
        "Super admin → Config → Integration sites",
        "Create site: site_code, name, default currency",
        "Fill wallet_api_url (HTTPS root), lottery_h5_base_url, iframe_allowed_origins",
        "Save sso_jwt_secret, wallet_api_key shown once after creation",
        "Deliver secrets securely to partner; partner configures main-site server",
        "Run connectivity test on site list (probes GET /wallet/balance)"
      ],
      "adminFieldRows": [
        ["code", "Site code for JWT site_code", "partner_demo"],
        ["wallet_api_url", "Partner wallet gateway HTTPS root", "https://wallet.partner.com"],
        ["lottery_h5_base_url", "Lottery H5 entry", "https://front.tanumo.com"],
        ["iframe_allowed_origins", "Allowed parent origins", "https://www.partner.com"],
        ["sso_jwt_secret", "Shown once after creation", "—"],
        ["wallet_api_key", "Shown once after creation", "—"]
      ],
      "networkItems": [
        "Wallet callbacks originate from lottery server (not player browser); gateway must be reachable from lottery servers",
        "Production wallet_api_url must be public HTTPS (no localhost / private IP)",
        "Default paths /wallet/balance, /wallet/debit-for-lottery, /wallet/credit-from-lottery (path prefix configurable in admin)",
        "Recommend timeout ≤ 10 seconds; timeout may leave transfer in pending reconciliation"
      ]
    },
    "sso": {
      "title": "SSO",
      "description": "HS256 JWT. Main site signs; lottery verifies. Entry: URL ?token= or iframe postMessage.",
      "claims": "JWT claims",
      "sign": "Signing example (Node.js)",
      "entryA": "Method A — URL redirect",
      "entryB": "Method B — iframe postMessage",
      "noExchangeNote": "Lottery has no token-exchange login API. Main site issues JWT after login; player APIs use Authorization: Bearer with the same JWT. First valid GET /api/v1/player/me auto-provisions the player — no separate login call.",
      "entryApi": "Verify and provision",
      "entryApiNote": "Optional: main site may call GET /api/v1/player/me once server-side after login as a pre-check. Daily play (transfer, bet) is called by lottery H5 with JWT — main site does not integrate those APIs.",
      "publicApis": "Public APIs (no token)",
      "h5ScopeNote": "Transfer, bet, in-lottery balance queries are called by our H5 with JWT — outside main-site integration scope. Main site only: ① issue JWT  ② implement wallet gateway.",
      "refreshNote": "iframe refresh: on LOTTERY_TOKEN_NEEDED or LOTTERY_TOKEN_REFRESH_REQUEST, re-issue JWT and send MAIN_REFRESH_TOKEN. See iframe protocol page.",
      "authResponse": "Auth failure example",
      "errors": "SSO error codes",
      "iframeNote": "Configure iframe_allowed_origins. Pass token via postMessage top-level field token — not inside payload.",
      "claimRows": [
        ["site_code", "string", "Y", "Integration site code matching admin"],
        ["site_player_id", "string", "Y", "Stable main-site user ID"],
        ["iat", "number", "Y", "Issued at (Unix seconds)"],
        ["exp", "number", "Y", "Expiry (Unix seconds); exp - iat ≤ 300"]
      ],
      "messageRows": [
        ["→ main", "LOTTERY_READY", "Child ready; requests token"],
        ["→ main", "LOTTERY_TOKEN_NEEDED", "Token invalid; requests refresh"],
        ["→ lottery", "MAIN_INIT_TOKEN", "Top-level token field"],
        ["→ lottery", "MAIN_REFRESH_TOKEN", "Top-level token field"]
      ],
      "publicApiRows": [
        ["GET", "/api/v1/player/ping", "Player API connectivity probe"],
        ["GET", "/api/v1/integration/runtime-origins", "iframe allowed embed origins"]
      ],
      "errorRows": [
        ["8001", "Missing Authorization header"],
        ["8002", "JWT invalid or expired (wrong secret, exp passed, bad signature)"],
        ["8003", "Player not provisioned (SSO me auto-provisions; rare in normal flow)"],
        ["8004", "SSO secret not configured (site issue — contact us)"],
        ["8005", "Account suspended (site disabled or player frozen)"]
      ]
    },
    "iframe": {
      "title": "iframe protocol",
      "description": "postMessage contract when main site embeds lottery H5. Skip this chapter if using URL ?token= redirect only.",
      "sequence": "Recommended sequence",
      "envelopeSection": "Message format (note direction differences)",
      "childMessages": "Lottery → main",
      "parentMessages": "Main → lottery",
      "example": "Main-site integration example",
      "targetOrigin": "targetOrigin security",
      "envelopeNote": "Common mistake: putting token in payload.token. Lottery H5 reads data.token at the message top level.",
      "targetOriginNote": "postMessage second argument must be lottery H5 origin (default https://front.tanumo.com), never *. Main site validates event.origin; iframe_allowed_origins is the main-site origin.",
      "timingNote": "After MAIN_INIT_TOKEN the lottery child does not send LOTTERY_READY again. Refresh: LOTTERY_TOKEN_NEEDED → main sends MAIN_REFRESH_TOKEN (top-level token).",
      "sequenceSteps": [
        "Embed <iframe src=\"{lottery_h5_base_url}\">",
        "Lottery H5 validates allowlist and sends LOTTERY_READY",
        "Main listens for message, validates origin, sends MAIN_INIT_TOKEN (top-level token)",
        "Lottery H5 stores token, calls GET /api/v1/player/me to enter",
        "JWT nearing expiry: lottery sends LOTTERY_TOKEN_NEEDED → main sends MAIN_REFRESH_TOKEN"
      ],
      "envelopeRows": [
        ["Lottery → main", "type + payload + timestamp", "e.g. LOTTERY_READY; business data in payload"],
        ["Main → lottery", "type + token + timestamp", "token must be top-level, not nested in payload"]
      ],
      "childMessageRows": [
        ["→ main", "LOTTERY_READY", "Child ready; requests token"],
        ["→ main", "LOTTERY_TOKEN_NEEDED", "Token invalid; requests refresh"],
        ["→ main", "LOTTERY_TOKEN_REFRESH_REQUEST", "Active refresh request"],
        ["→ main", "LOTTERY_HEARTBEAT", "Heartbeat (may ignore)"],
        ["→ main", "LOTTERY_TOKEN_REFRESHED", "Refresh succeeded (child → main)"]
      ],
      "parentMessageRows": [
        ["→ lottery", "MAIN_INIT_TOKEN", "First delivery; top-level token field"],
        ["→ lottery", "MAIN_REFRESH_TOKEN", "Refresh; top-level token field"],
        ["→ lottery", "MAIN_REQUEST_STATUS", "Request child status"],
        ["→ lottery", "MAIN_NAVIGATE", "Navigate to path"]
      ]
    },
    "wallet": {
      "title": "Wallet gateway",
      "description": "Implemented by partner. Called by lottery server (not player browser). Auth: Authorization: Bearer {wallet_api_key}.",
      "balance": "Query balance",
      "debit": "Debit (transfer-in)",
      "credit": "Credit (transfer-out)",
      "response": "Response example",
      "httpContract": "HTTP contract",
      "httpErrors": "HTTP errors",
      "creditNote": "Same body as debit; used for transfer-out or rollback credit.",
      "idempotentNote": "idempotent_key: same key + same amount must return first JSON (HTTP 200), no double booking; same key different amount → success: false.",
      "queryRows": [
        ["site_code", "string", "Site code"],
        ["site_player_id", "string", "Main-site user ID"],
        ["currency_code", "string", "Currency code"]
      ],
      "fieldRows": [
        ["site_code", "string", "Site code"],
        ["site_player_id", "string", "Main-site user ID"],
        ["player_id", "number", "Lottery player ID (reference)"],
        ["currency_code", "string", "Currency code"],
        ["amount_minor", "integer", "Positive minor integer"],
        ["idempotent_key", "string", "Idempotency key, globally unique"]
      ],
      "httpErrorRows": [
        ["401", "unauthorized", "wallet_api_key wrong or missing"],
        ["422", "invalid request", "Missing fields or invalid amount_minor"],
        ["409", "main balance insufficient", "Business rejection e.g. insufficient balance"]
      ],
      "httpContractRows": [
        ["Debit/credit success", "200", "success: true; external_ref_no (recommended) + data.main_balance"],
        ["Balance success", "200", "success: true; data.main_balance + currency_code"],
        ["Invalid params", "422", "success: false; message: invalid request"],
        ["Auth failure", "401", "success: false; message: unauthorized"],
        ["Business rejection", "409", "success: false; message explains reason"],
        ["Idempotent replay", "200", "Identical to first success/rejection response"]
      ]
    },
    "transfer": {
      "title": "स्थानान्तरण (सन्दर्भ)",
      "description": "For understanding how funds move between sides — not a partner integration surface.",
      "outOfScopeNote": "Partner does not implement these APIs. Transfer-in/out is called by our H5 with player JWT; partner only implements wallet gateway debit/credit.",
      "requestFields": "Request fields",
      "transferIn": "Transfer-in (main → lottery)",
      "transferOut": "Transfer-out (lottery → main)",
      "transferResponse": "Success response",
      "errors": "Common error codes",
      "inNote": "Flow: player H5 initiates transfer-in → lottery calls main debit-for-lottery → lottery balance credited.",
      "outNote": "Flow: player H5 initiates transfer-out → lottery debits → lottery calls main credit-from-lottery.",
      "responseNote": "Transfer-in and transfer-out share the same response shape; direction is in / out. Idempotent replay returns same data.",
      "requestFieldRows": [
        ["amount", "integer", "Positive minor integer"],
        ["currency", "string", "Optional; defaults to player default_currency"],
        ["idempotent_key", "string", "Globally unique; retries must return same result"]
      ],
      "errorRows": [
        ["1001", "Insufficient lottery balance (transfer-out)"],
        ["1009", "Main wallet processing failed (gateway unreachable, 401, timeout, etc.)"],
        ["1010", "Idempotency conflict (same key, different amount)"],
        ["2003", "Transfer in before betting"]
      ]
    },
    "errors": {
      "title": "Errors",
      "sso": "SSO auth",
      "lotteryWallet": "Lottery wallet / transfer",
      "gateway": "Partner wallet gateway (HTTP)",
      "idempotentNote": "Idempotency: same idempotent_key + same amount → same result; same key different amount → 1010 or success:false.",
      "ssoRows": [
        ["8001", "Missing Authorization header"],
        ["8002", "JWT invalid or expired"],
        ["8003", "Player not provisioned (SSO me auto-provisions in normal flow)"],
        ["8004", "SSO secret not configured"],
        ["8005", "Account suspended"]
      ],
      "lotteryRows": [
        ["1001", "Insufficient lottery balance"],
        ["1009", "Main wallet processing failed"],
        ["1010", "Idempotency conflict"],
        ["2003", "Transfer in before betting"]
      ],
      "gatewayRows": [
        ["401", "unauthorized", "API Key wrong"],
        ["422", "invalid request", "Invalid field or amount"],
        ["409", "—", "Business rejection (e.g. insufficient balance)"]
      ]
    },
    "troubleshooting": {
      "title": "Troubleshooting",
      "description": "Match symptoms below. If still stuck, contact integration support with site_code, timestamp, and request ID.",
      "faq": "FAQ",
      "jwt": "JWT / entry",
      "iframe": "iframe",
      "wallet": "Wallet gateway",
      "note": "During integration, verify JWT (/player/me) and wallet (/wallet/balance) with curl separately before full iframe flow.",
      "faqRows": [
        ["curl /player/me returns 8002", "Check sso_jwt_secret matches admin site; site_code matches; exp not passed (≤300s)"],
        ["iframe blank / no hall", "Check token is postMessage top-level; MAIN_INIT_TOKEN after LOTTERY_READY; iframe_allowed_origins includes main origin"],
        ["Transfer-in fails 1009", "Can lottery server reach wallet_api_url; wallet_api_key correct; debit returns 200 + success:true"],
        ["Connectivity test fails", "wallet_api_url must be public HTTPS; GET /wallet/balance reachable with Bearer wallet_api_key"],
        ["8005 account frozen", "Check integration site enabled in admin; site_player_id not frozen"]
      ],
      "jwtRows": [
        ["8002 Token invalid", "Wrong secret / exp passed / wrong site_code / algorithm not HS256"],
        ["8004 SSO not configured", "Contact us to confirm site sso_jwt_secret is set"],
        ["me code=0 but H5 still fails", "iframe token differs from curl test token, or token nested in payload not top-level"]
      ],
      "iframeRows": [
        ["No LOTTERY_READY", "iframe src is lottery_h5_base_url; H5 finished loading"],
        ["postMessage no response", "targetOrigin is lottery H5 origin (not main-site origin)"],
        ["Repeated token spam", "After MAIN_INIT_TOKEN child should not send LOTTERY_READY again"],
        ["Refresh fails", "Main listens for LOTTERY_TOKEN_NEEDED and replies MAIN_REFRESH_TOKEN"]
      ],
      "walletRows": [
        ["401 unauthorized", "wallet_api_key does not match admin site"],
        ["409 insufficient balance", "Test account main_balance too low; check amount_minor units"],
        ["Double debit", "idempotent_key not idempotent; same key must return first response"],
        ["Lottery never calls debit", "wallet_api_url unreachable or connectivity test not passed"]
      ]
    },
    "golive": {
      "title": "Go-live",
      "description": "Before production release, confirm integration passed with account manager and complete checks below.",
      "deliveryChecklist": "Delivery and process",
      "checklist": "Technical checklist",
      "deliveryItems": [
        "Production integration site created separately (site_code, secrets isolated from staging)",
        "Secrets stored securely in main-site production config (not frontend)",
        "wallet_api_url is production public HTTPS; connectivity test passed",
        "iframe_allowed_origins includes production main-site origin",
        "Full integration log archived (transfer-in → bet → settlement → transfer-out)"
      ],
      "items": [
        "JWT server-side only, TTL ≤ 5 minutes",
        "Wallet three endpoints HTTPS, timeout ≤ 10s, idempotency implemented",
        "iframe: postMessage token top-level, origin validation enabled",
        "Test vs production: site_code, secrets, domains fully separated",
        "Monitoring: wallet gateway 4xx/5xx and debit/credit log alerts",
        "Rollback plan: can temporarily disable integration site"
      ]
    }
  }
}