Add briscola chiamata

Five-player briscola with a descending calling auction and a secret
partner. Starting with the player after the dealer, each player bids a
lower rank (A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2) or passes; once the
standing bid is the two the auction continues on points (62, 64, ...).
The last player standing must bid, and the winner names any card of the
won rank: its holder is the secret partner, or the caller plays alone
when it is one of their own cards, and its suit becomes the trump. The
calling side must reach 61 (or the raised target); a 60-60 deal with the
plain target is a patta and is replayed. A match is a single deal, so
the caller and partner (or the lone caller) against the other players
map onto the platform's two-team result, Elo and match history.

The rules live in tavolo.briscola.chiamata with the
BriscolaChiamataEngine adapter registered alongside the other briscola
variants; the partner's role and the side totals stay hidden until the
called card is played. The web client gets a five-seat table, the
auction panel with legal bids and point raises, the call picker, the
reveal bands and a chiamata-aware final summary.

README.md

@@ -1,14 +1,17 @@
 # tavolo
 
-A platform for multiplayer card games. The first game is **scopone
-scientifico** — the four-player, fixed-partnership Italian card game:
+A platform for multiplayer card games. Three games are included:
+**scopone scientifico** — the four-player, fixed-partnership Italian card
+game — **briscola**, in its classic two-player and four-player
+partnership (*briscola a quattro*) variants, and **briscola chiamata** —
+the five-player variant with a calling auction and a secret partner:
 
 - **`server/`** — backend: Python + [kaya](https://github.com/woggioni/kaya)
   framework, OIDC login, live games in Redis, match statistics in Postgres.
-  A monorepo of three distributions sharing the `tavolo` namespace: the
-  game-independent `tavolo-platform`, the scopone game `tavolo-scopone`,
-  and the `tavolo-app` composition root wiring them together.
-  See [server/README.md](server/README.md).
+  A monorepo of four distributions sharing the `tavolo` namespace: the
+  game-independent `tavolo-platform`, the `tavolo-scopone` and
+  `tavolo-briscola` games, and the `tavolo-app` composition root wiring
+  them together. See [server/README.md](server/README.md).
 - **`web/`** — frontend: Rust + [Sycamore](https://sycamore.dev) compiled to
   WebAssembly, built with [Trunk](https://trunkrs.dev) and styled with
   [Bootstrap](https://getbootstrap.com) 5.3 (MIT, vendored under
@@ -37,20 +40,36 @@ echo "127.0.0.1 mockoauth" | sudo tee -a /etc/hosts
 ## Between hands
 
 When a hand ends but the match is not decided, the game pauses on a
-**scoring summary screen**: every player sees how each category was won
+**scoring summary screen**: scopone players see how each category was won
 (carte, denara, settebello, primiera, scope — plus napola and asso
-pigliatutto when enabled)
-with the running totals and
-must click "Understood" before the next hand is dealt. If someone is away
-the next hand is dealt automatically after `HAND_ACK_TIMEOUT_SECONDS`
-(default 30s). The match-ending hand is explained on the final screen.
+pigliatutto when enabled), briscola players see the deal's points and any
+*patta*; both see the running totals and must click "Understood" before
+the next hand is dealt. If someone is away the next hand is dealt
+automatically after `HAND_ACK_TIMEOUT_SECONDS` (default 30s). The
+match-ending hand is explained on the final screen. Briscola chiamata
+plays a single deal per match, so it goes straight from the last trick to
+the final scoring screen; a 60–60 *patta* is replayed immediately.
 
 ## On your turn
 
 Every turn shows a countdown (`TURN_TIMEOUT_SECONDS`, default 30s). If a
 player does not move — disconnected or fallen asleep — the server plays a
-random legal card for them (randomizing among the legal captures when the
+random legal card for them (choosing among the legal captures when the
 rules require a capture), so one absent player cannot stall the table.
+Briscola chiamata arms the same countdown for its auction bids and for
+the auction winner's called-card choice (auto-bid or auto-pass, then a
+random suit of the won rank).
+
+## Watching
+
+Anyone who has the game URL (`/game/<id>`) can watch, logged in or not:
+spectators see the table, the score and every player's captured cards
+(and scope for scopone), but never a hand and never the join code. In
+briscola chiamata they also see no role labels and no side totals until
+the called card is played, so the secret partner stays secret. The
+"Copy watch link" button in the waiting room and in the game HUD copies
+the URL to share. A spectator who opens the URL before the match starts
+sees a "game not started yet" waiting room.
 
 ## Development
 
@@ -60,10 +79,11 @@ Backend (from `server/`):
 cd server
 python3 -m venv .venv
 .venv/bin/pip install -r requirements.txt
-.venv/bin/pip install -e ./packages/tavolo-platform -e ./packages/tavolo-scopone -e './packages/tavolo-app[dev]'
+.venv/bin/pip install -e ./packages/tavolo-platform -e ./packages/tavolo-scopone -e ./packages/tavolo-briscola -e './packages/tavolo-app[dev]'
 .venv/bin/python -m unittest discover -s tests -t .
 .venv/bin/python -m unittest discover -s packages/tavolo-platform/tests
 .venv/bin/python -m unittest discover -s packages/tavolo-scopone/tests
+.venv/bin/python -m unittest discover -s packages/tavolo-briscola/tests
 ```
 
 Frontend (from `web/`), with the backend running on :8080:
@@ -78,8 +98,12 @@ Trunk proxies `/api`, `/auth` and `/ws` to `127.0.0.1:8080` (see
 run the backend with:
 
 ```sh
-OIDC_POST_LOGIN_REDIRECT=http://localhost:8000/ \
-OIDC_POST_LOGOUT_REDIRECT=http://localhost:8000/ \
+OIDC_0_PROVIDER=default \
+OIDC_0_ISSUER=http://localhost:8180/tavolo \
+OIDC_0_CLIENT_ID=tavolo \
+OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback \
+OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8000/ \
+OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8000/ \
   .venv/bin/granian --host 127.0.0.1 --port 8080 tavolo.app:app
 ```
 

deploy/k8s/tavolo.yaml

@@ -21,7 +21,7 @@
 #   - This file deploys a ClusterIP Service only. Until you add an Ingress,
 #     reach the app with:
 #         kubectl port-forward -n tavolo svc/tavolo 8080:80
-#     and set OIDC_REDIRECT_URI to match whatever URL the browser uses.
+#     and set OIDC_0_REDIRECT_URI to match whatever URL the browser uses.
 
 ---
 apiVersion: v1
@@ -81,15 +81,22 @@ data:
   # OTEL_EXCLUDED_PATHS: "/api/health"   # default; paths skipped by tracing
   # OTEL_METRIC_EXPORT_INTERVAL_MILLIS: "60000"
   # OTEL_METRICS_POLL_INTERVAL_SECONDS: "15"
-  # OIDC (provider lives in another namespace).
-  OIDC_CLIENT_ID: tavolo
-  OIDC_POST_LOGIN_REDIRECT: /
-  OIDC_POST_LOGOUT_REDIRECT: /
+  # OIDC (the provider lives in another namespace). Each provider is an
+  # indexed block: OIDC_<n>_PROVIDER names it in the login URL
+  # (/auth/<provider>/login) and indices must be contiguous from 0. Add
+  # OIDC_1_*, OIDC_2_*, ... blocks for more providers; add their secrets
+  # to tavolo-secrets as well.
+  OIDC_0_PROVIDER: default
+  OIDC_0_CLIENT_ID: tavolo
+  OIDC_0_POST_LOGIN_REDIRECT: /
+  OIDC_0_POST_LOGOUT_REDIRECT: /
   # Issuer URL as seen by the browser AND the pods (see notes above).
-  OIDC_ISSUER: REPLACE_ME
+  OIDC_0_ISSUER: REPLACE_ME
   # Public callback URL of this deployment, e.g.
-  # http://<host>:<port>/auth/callback (must be allowed at the provider).
-  OIDC_REDIRECT_URI: REPLACE_ME
+  # http://<host>:<port>/auth/default/callback (must be allowed at the
+  # provider). When unset it defaults to
+  # http://localhost:8080/auth/<provider>/callback.
+  OIDC_0_REDIRECT_URI: REPLACE_ME
 
 ---
 apiVersion: v1
@@ -106,8 +113,8 @@ stringData:
   # The only Postgres secret: the password for DATABASE_USER at
   # DATABASE_HOST (both configured in the tavolo-config ConfigMap).
   DATABASE_PASSWORD: REPLACE_ME
-  # Client secret for OIDC_CLIENT_ID at the provider.
-  OIDC_CLIENT_SECRET: REPLACE_ME
+  # Client secret for OIDC_0_CLIENT_ID at the provider.
+  OIDC_0_CLIENT_SECRET: REPLACE_ME
 
 ---
 # Redis: sessions + live game state. Ephemeral by design (emptyDir): worst

docker-compose.yml

@@ -103,13 +103,15 @@ services:
       DATABASE_USER: tavolo
       DATABASE_PASSWORD: ${DATABASE_PASSWORD:-password}
       # By default the app and browsers reach the mock IdP under the same
-      # name (see README /etc/hosts note); override OIDC_ISSUER and
-      # OIDC_REDIRECT_URI to use a real provider or a different host port.
-      OIDC_ISSUER: ${OIDC_ISSUER:-http://mockoauth:8180/tavolo}
+      # name (see README /etc/hosts note); override the OIDC_0_* values to
+      # use a real provider or a different host port. Additional providers
+      # take OIDC_1_*, OIDC_2_*, ... blocks (indices are contiguous from 0).
+      OIDC_0_PROVIDER: ${OIDC_0_PROVIDER:-default}
+      OIDC_0_ISSUER: ${OIDC_0_ISSUER:-http://mockoauth:8180/tavolo}
       # The mock OIDC server does not validate clients: any id/secret works.
-      OIDC_CLIENT_ID: tavolo
-      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-dev-secret}
-      OIDC_REDIRECT_URI: ${OIDC_REDIRECT_URI:-http://localhost:8080/auth/callback}
+      OIDC_0_CLIENT_ID: tavolo
+      OIDC_0_CLIENT_SECRET: ${OIDC_0_CLIENT_SECRET:-dev-secret}
+      OIDC_0_REDIRECT_URI: ${OIDC_0_REDIRECT_URI:-http://localhost:8080/auth/default/callback}
       REDIS_URL: redis://redis:6379/0
       HAND_ACK_TIMEOUT_SECONDS: ${HAND_ACK_TIMEOUT_SECONDS:-30}
       TURN_TIMEOUT_SECONDS: ${TURN_TIMEOUT_SECONDS:-30}

server/.env.example

@@ -13,12 +13,29 @@ DATABASE_OPTIONS=
 # test suite (sqlite://:memory:) and handy for managed-DB URLs.
 #DATABASE_URL=postgres://tavolo:password@localhost:5432/tavolo
 
-# OIDC (mock-oauth2-server in dev; it does not validate clients, so any
-# client id/secret works. For a real IdP like Keycloak, use its values here.)
-OIDC_ISSUER=http://localhost:8180/tavolo
-OIDC_CLIENT_ID=tavolo
-OIDC_CLIENT_SECRET=dev-secret
-OIDC_REDIRECT_URI=http://localhost:8080/auth/callback
+# OIDC providers. Each provider is an indexed block: OIDC_<n>_PROVIDER
+# (required; names the provider in the login URL /auth/<provider>/login and
+# in its session state), OIDC_<n>_ISSUER, OIDC_<n>_CLIENT_ID,
+# OIDC_<n>_CLIENT_SECRET (optional: leave unset for public clients),
+# OIDC_<n>_REDIRECT_URI (defaults to
+# http://localhost:8080/auth/<provider>/callback), OIDC_<n>_POST_LOGIN_REDIRECT
+# and OIDC_<n>_POST_LOGOUT_REDIRECT (default /). Indices must be contiguous
+# from 0; add a second provider with an OIDC_1_* block (and so on).
+#
+# The values below target the dev mock-oauth2-server (it does not validate
+# clients, so any client id/secret works). For a real IdP like Keycloak,
+# use its values and register the redirect URI there.
+OIDC_0_PROVIDER=default
+OIDC_0_ISSUER=http://localhost:8180/tavolo
+OIDC_0_CLIENT_ID=tavolo
+OIDC_0_CLIENT_SECRET=dev-secret
+OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback
+# A second provider, e.g. Google:
+#OIDC_1_PROVIDER=google
+#OIDC_1_ISSUER=https://accounts.google.com
+#OIDC_1_CLIENT_ID=...
+#OIDC_1_CLIENT_SECRET=...
+#OIDC_1_REDIRECT_URI=http://localhost:8080/auth/google/callback
 
 # Redis (session and live-game storage). Unset to fall back to in-memory
 # stores (only sensible for local development with a single worker).

server/Dockerfile

@@ -58,13 +58,13 @@ RUN --mount=type=cache,target=/root/.cache/pip \
  && /opt/venv/bin/pip install --upgrade pip \
  && /opt/venv/bin/pip install -r requirements.txt
 
-# The three sibling distributions, installed from the local tree (PEP 420
+# The four sibling distributions, installed from the local tree (PEP 420
 # namespace packages sharing the `tavolo` namespace). --no-deps: every
 # third-party dependency — including the tavolo-app `otel` extra — is
 # already pinned in requirements.txt.
 COPY server/packages/ ./packages/
 RUN --mount=type=cache,target=/root/.cache/pip \
-    /opt/venv/bin/pip install --no-deps ./packages/tavolo-platform ./packages/tavolo-scopone ./packages/tavolo-app
+    /opt/venv/bin/pip install --no-deps ./packages/tavolo-platform ./packages/tavolo-scopone ./packages/tavolo-briscola ./packages/tavolo-app
 # server/pyproject.toml only carries the [tool.aerich] section (the
 # db-migrate compose service runs `aerich upgrade` with working_dir=/app,
 # next to ./migrations).

server/README.md

@@ -1,10 +1,12 @@
 # tavolo (backend)
 
 The backend for a multiplayer card-game platform, built on the
-[kaya](../kaya) framework. It is a monorepo of three distributions
+[kaya](../kaya) framework. It is a monorepo of four distributions
 sharing the `tavolo` namespace (see
-[`packages/tavolo-platform/README.md`](packages/tavolo-platform/README.md)
-and [`packages/tavolo-scopone/README.md`](packages/tavolo-scopone/README.md)):
+[`packages/tavolo-platform/README.md`](packages/tavolo-platform/README.md),
+[`packages/tavolo-scopone/README.md`](packages/tavolo-scopone/README.md)
+and
+[`packages/tavolo-briscola/README.md`](packages/tavolo-briscola/README.md)):
 
 - **`tavolo-platform`** (`packages/tavolo-platform/`) — everything
   game-independent: the lobby API, the live-game store, the WebSocket
@@ -13,8 +15,13 @@ and [`packages/tavolo-scopone/README.md`](packages/tavolo-scopone/README.md)):
 - **`tavolo-scopone`** (`packages/tavolo-scopone/`) — scopone
   scientifico, the four-player, fixed-partnership variant of the classic
   Italian card game: pure rules plus the platform adapter.
+- **`tavolo-briscola`** (`packages/tavolo-briscola/`) — briscola, the
+  Italian trick-taking game, in its classic two-player (`briscola`),
+  four-player partnership (`briscola_a_quattro`) and five-player
+  called-partner (`briscola_chiamata`) variants: pure rules plus the
+  platform adapter.
 - **`tavolo-app`** (`packages/tavolo-app/`) — the
-  composition root wiring the platform to the scopone game, with the
+  composition root wiring the platform to the games, with the
   environment-driven settings and the SPA shell.
 
 Players authenticate with the configured **OIDC** provider. Live game
@@ -43,7 +50,8 @@ Because the browser and the app both talk to the OIDC issuer at
 echo "127.0.0.1 mockoauth" | sudo tee -a /etc/hosts
 ```
 
-Then log in: `GET http://localhost:8080/auth/login`, type any username
+Then log in: `GET http://localhost:8080/auth/login` (a provider-agnostic
+alias that redirects to the first configured provider), type any username
 (e.g. `alice`) in the interactive login, and you are redirected back with a
 session cookie. That cookie authenticates both the REST API and the
 WebSocket endpoint.
@@ -65,14 +73,17 @@ All configuration comes from environment variables (see `.env.example`):
 | `DATABASE_OPTIONS` | unset | Extra DSN query parameters, e.g. `ssl=require` |
 | `DATABASE_URL` | unset | Full-DSN override; when set, the `DATABASE_*` parts above are ignored (used for sqlite in tests and for managed-DB URLs) |
 | `REDIS_URL` | unset | Redis DSN for sessions + live games. Unset falls back to in-memory stores |
-| `OIDC_ISSUER` | `http://localhost:8180/tavolo` | OIDC issuer URL |
-| `OIDC_CLIENT_ID` | `tavolo` | OIDC client id |
-| `OIDC_CLIENT_SECRET` | unset | OIDC client secret |
-| `OIDC_REDIRECT_URI` | `http://localhost:8080/auth/callback` | Login callback URL |
+| `OIDC_<n>_PROVIDER` | `default` ¹ | Provider name (required when OIDC is configured): used in the login URL `/auth/<provider>/login` and to namespace its session keys. Unique, `[A-Za-z0-9_-]+` |
+| `OIDC_<n>_ISSUER` | `http://localhost:8180/tavolo` ¹ | OIDC issuer URL |
+| `OIDC_<n>_CLIENT_ID` | `tavolo` ¹ | OIDC client id |
+| `OIDC_<n>_CLIENT_SECRET` | unset | OIDC client secret; leave unset for public clients |
+| `OIDC_<n>_REDIRECT_URI` | `http://localhost:8080/auth/<provider>/callback` | Login callback URL; must be registered at the provider |
+| `OIDC_<n>_POST_LOGIN_REDIRECT` | `/` | Where the browser is sent after login |
+| `OIDC_<n>_POST_LOGOUT_REDIRECT` | `/` | Where the browser is sent after logout |
 | `GAME_TTL_SECONDS` | `86400` | Sliding TTL of a live game in Redis |
-| `HAND_ACK_TIMEOUT_SECONDS` | `30` | Seconds the scopone between-hands scoring summary waits for acknowledgements (wired into the `ScoponeEngine`) |
-| `TURN_TIMEOUT_SECONDS` | `30` | Seconds a scopone player has to play before the server plays a random legal card for them (wired into the `ScoponeEngine`) |
-| `DEADLINE_HEARTBEAT_MS` | `1000` | Upper bound on the deadline consumer's poll interval (locally enqueued deadlines fire on time regardless) |
+| `HAND_ACK_TIMEOUT_SECONDS` | `30` | Seconds the between-hands scoring summary waits for acknowledgements (wired into the game engines) |
+| `TURN_TIMEOUT_SECONDS` | `30` | Seconds a player has to play before the server plays a random legal card for them (wired into the game engines) |
+| `DEADLINE_HEARTBEAT_MS` | `30000` | Backstop poll interval of the deadline consumer; enqueued deadlines are announced over pub/sub and wake consumers immediately, so this only bounds recovery from lost notifications or a dead worker |
 | `LOGGING_CONFIG` | unset | Path to a YAML logging configuration file (see below). Unset logs DEBUG to the console |
 | `CORS_ALLOW_ORIGINS` | unset | Comma-separated origins allowed for cross-origin requests, or `*` for any. CORS is disabled unless this or `CORS_ALLOW_ORIGIN_REGEX` is set |
 | `CORS_ALLOW_ORIGIN_REGEX` | unset | Regex (fullmatch) additionally matched against request origins, e.g. `https://tavolo-[a-z0-9-]+\.vercel\.app` |
@@ -90,6 +101,44 @@ All configuration comes from environment variables (see `.env.example`):
 | `OTEL_METRICS_POLL_INTERVAL_SECONDS` | `15` | How often the session/game count gauges are refreshed |
 | `APP_HOST` / `APP_PORT` | `0.0.0.0` / `8080` | Bind address |
 
+¹ When no `OIDC_<n>_*` variable is set at all, a single provider named
+`default` pointing at the dev mock IdP is used. Indices must be contiguous
+from 0 (`OIDC_0_*`, `OIDC_1_*`, ...).
+
+### Multiple OIDC providers
+
+Providers are configured in indexed blocks; each becomes its own login
+route `/auth/<provider>/login` with its own callback URL and session
+namespace:
+
+```sh
+OIDC_0_PROVIDER=google
+OIDC_0_ISSUER=https://accounts.google.com
+OIDC_0_CLIENT_ID=...
+OIDC_0_CLIENT_SECRET=...
+OIDC_0_REDIRECT_URI=https://tavolo.example.com/auth/google/callback
+
+OIDC_1_PROVIDER=github
+OIDC_1_ISSUER=https://github.com/login/oauth
+OIDC_1_CLIENT_ID=...
+OIDC_1_CLIENT_SECRET=...
+OIDC_1_REDIRECT_URI=https://tavolo.example.com/auth/github/callback
+```
+
+The login page reads `GET /api/auth/providers` and shows one button per
+provider. `GET /auth/login` redirects to the first provider (useful for
+bookmarks and scripts), and `GET /auth/logout` signs out whichever
+provider the session is logged in with.
+
+Sessions hold a single identity: logging in with another provider
+replaces the previous one. Each provider's `sub` is a separate account,
+so match history and Elo ratings are per provider identity (someone using
+two providers has two accounts). Migrating from the pre-0.0.6 unindexed
+variables: rename `OIDC_ISSUER`/`OIDC_CLIENT_ID`/... to `OIDC_0_...`, add
+`OIDC_0_PROVIDER`, and register the new callback path
+(`/auth/<provider>/callback`) at the provider. Sessions survive only when
+the provider is named `default`; otherwise users log in once more.
+
 ## Logging
 
 The application logs through the Python stdlib `logging` module, one
@@ -170,12 +219,15 @@ aggregate with `max`, not `sum`.
   signals; every open WebSocket reloads the session and pushes the
   personalized view to its player.
 - `tavolo:deadlines` — a sorted set (score = due timestamp) of pending
-  timeouts (e.g. scopone's turn auto-plays and hand-end auto-continues).
+  timeouts (e.g. the games' turn auto-plays and hand-end auto-continues).
   Every worker runs a consumer that fires due entries under the per-game
   lock by calling the engine's `fire_deadline`, so timeouts do not depend
   on any player being connected and survive the death of any worker
   (delivery is at-least-once; engines revalidate the entry's token
   against the live state before firing).
+- `tavolo:deadlines:events` — a pub/sub channel announcing newly enqueued
+  deadlines; it wakes every worker's consumer immediately, while the
+  heartbeat poll remains as a backstop for lost signals.
 
 ### Postgres (statistics, via Tortoise ORM + aerich migrations)
 
@@ -184,7 +236,10 @@ aggregate with `max`, not `sum`.
   scoped per game), start/finish timestamps, and the game-specific outcome
   as reported by the engine (`result` JSON — for scopone: both teams'
   final scores, winner, target score, hands played and the per-hand
-  audit).
+  audit; for briscola: the final scores, winner, target score, deals
+  played and the per-deal audit; for briscola chiamata: the calling side's
+  points against the defenders', the declared target, the called card and
+  whether the caller played alone).
 - `match_player` — one row per participant: the OIDC `sub`, display name,
   seat, game-defined team label (nullable), whether they won, the points
   they scored, the Elo change the match produced (`elo_delta`) and
@@ -217,37 +272,47 @@ existed):
 ## REST API
 
 All endpoints except `/api/health`, `/api/docs`, `/api/openapi.json`,
-`/api/game-types` and `/api/leaderboard` require authentication.
+`/api/game-types`, `/api/leaderboard` and the game snapshot
+(`GET /api/games/{id}`) require authentication.
 
 | Method | Path | Description |
 |---|---|---|
 | `GET` | `/api/game-types` | The games the platform can host (for the creation dropdown), each with its `options_schema` |
-| `POST` | `/api/games` | Create a lobby game. Optional body `{"game_type": "scopone_scientifico", "options": {"target_score": 11, "napola": true, "asso_pigliatutto": false}}`. Returns the lobby (`{id, join_code, players, seats_open, ...}`) |
+| `POST` | `/api/games` | Create a lobby game. Optional body `{"game_type": "scopone_scientifico", "options": {"target_score": 11, "napola": true, "asso_pigliatutto": false}}`; briscola games use `{"game_type": "briscola"}` or `{"game_type": "briscola_a_quattro"}` with an optional `{"target_score": 61}`, and briscola chiamata uses `{"game_type": "briscola_chiamata"}` with no options. Returns the lobby (`{id, join_code, players, seats_open, ...}`) |
 | `POST` | `/api/games/join` | Join with `{"code": "ABC123"}`. The last player triggers the start and gets the game view back |
 | `GET` | `/api/games/preview?code=ABC123` | Pre-join summary of the lobby behind a code: game name/description, seated players, open seats and the engine-echoed options. `404` when the code is unknown |
-| `GET` | `/api/games/{id}` | Personalized snapshot (only your own hand is visible) |
+| `GET` | `/api/games/{id}` | Game snapshot. Seated players get the personalized view (own hand plus the join code); anyone else gets the read-only spectator view: table, scores, captured counts and scope, no hands and no join code |
+| `GET` | `/api/me/games` | Live games the caller is seated in (waiting lobbies, matches in progress or between hands), newest first, for the lobby's "Continue" list. Finished matches are not included |
 | `GET` | `/api/me/matches` | Cursor-paginated match history with the engine's `result` and per-player Elo deltas (`?limit=&cursor=&game_type=`) |
 | `GET` | `/api/me/ratings` | The caller's Elo rating per game type |
 | `GET` | `/api/leaderboard` | Elo rating, aggregated wins / matches / points per player, sorted by Elo (`?game_type=`) |
 
 ## WebSocket protocol
 
-Connect to `/ws/games/{game_id}` with your session cookie. Only seated
-players are accepted; unauthenticated, unknown-game and non-player
-connections are closed with codes `4401`, `4404` and `4403` respectively.
+Connect to `/ws/games/{game_id}`; the session cookie is optional. Anyone
+who knows the game id is accepted: seated players get their personalized
+view, everyone else — anonymous users and authenticated non-players — is
+a read-only **spectator**. Only an unknown game id is refused before the
+handshake completes, with `404`. (Browsers report a refused handshake as
+an abnormal close — there is no close code to read.)
 
 Server → client messages are JSON objects with a `type`:
 
 - `{"type": "state", "game": {...}}` — personalized game view. Your own
   hand is included; other players expose only their card counts.
-  `your_turn: true` is present when it is your move.
+  Spectators get no hand at all, `spectator: true` marks the view and
+  `join_code` is omitted for them. `your_turn: true` is present when it
+  is your move. `seats_open` reports the free chairs (0 once the match
+  started).
 - `{"type": "game_over", "scores": {"A": 11, "B": 7}, "winner": "A"}`
 - `{"type": "error", "code": "illegal_move", "message": "..."}`
 
 Client → server messages are JSON objects with an `action`. The
 platform handles `state` (resend the snapshot) itself; every other action
 is dispatched to the session's game engine with the rest of the message
-as its payload. For scopone scientifico:
+as its payload. Spectators may only send `state`/`sync`: any other
+action is answered with an `error` whose `code` is `forbidden`. For
+scopone scientifico:
 
 ```json
 {"action": "play", "card": "07D", "capture": ["02D", "05C"]}
@@ -266,7 +331,39 @@ as its payload. For scopone scientifico:
   after `HAND_ACK_TIMEOUT_SECONDS`.
 - `state` asks for a fresh snapshot.
 
-After every accepted move the new state is broadcast to all four players.
+For briscola (`briscola`, `briscola_a_quattro`) the game actions are
+`play` (with `card` only — every card in hand is legal) and `ack`:
+
+```json
+{"action": "play", "card": "04C"}
+{"action": "ack"}
+```
+
+- `card` uses the same `RRSUIT` convention.
+- `ack` acknowledges the deal-end summary; the next deal is dealt once
+  every player has acknowledged, or automatically after
+  `HAND_ACK_TIMEOUT_SECONDS`.
+
+For briscola chiamata the game actions are the calling auction plus play:
+
+```json
+{"action": "bid", "rank": 3}
+{"action": "bid", "points": 64}
+{"action": "pass"}
+{"action": "call", "card": "03D"}
+{"action": "play", "card": "04C"}
+```
+
+- `bid` with a `rank` calls a lower rank than the standing bid
+  (`A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2`); with `points` it raises the
+  target once the standing bid is the two.
+- `pass` leaves the auction; the last player standing must bid.
+- `call` names any card of the won rank; naming one of your own cards
+  means playing alone.
+- `play` follows briscola: any card in hand is legal.
+
+After every accepted move the new state is broadcast to every connected
+client, spectators included.
 
 ### Turn timeout
 
@@ -277,20 +374,26 @@ is required), so a disconnected or idle player cannot stall the match. The
 timeout is `TURN_TIMEOUT_SECONDS` (default 30); the auto-played move is
 broadcast like any other. Deadlines fire from the shared `tavolo:deadlines`
 queue (see above), not from timers tied to client connections, so the
-match keeps progressing even with every player disconnected.
+match keeps progressing even with every player disconnected. Briscola
+chiamata uses the same timeout for its auction bids (auto-bid or
+auto-pass) and for the called-card choice (a random suit of the won
+rank).
 
 ### Hand-end summary
 
 When a hand finishes but the match continues, the game enters the
-`hand_end` phase instead of dealing immediately: the state carries
-`last_hand` (a full scoring breakdown with an `award` map naming the team
-that won each category), the `acknowledged` seats and a
-`hand_end_deadline`. The frontend renders this as a screen every player
-must dismiss. A play attempted in this phase is rejected with an
+`hand_end` phase instead of dealing immediately: the state carries the
+scoring breakdown of the hand just played (`last_hand` with an `award`
+map naming the team that won each scopone category; `last_deal` with the
+deal's points and running totals for briscola), the `acknowledged` seats
+and a `hand_end_deadline`. The frontend renders this as a screen every
+player must dismiss. A play attempted in this phase is rejected with an
 `illegal_move` error.
 
 ## Rules implemented
 
+### Scopone scientifico
+
 - 40-card Italian deck, ten cards per player, empty table at hand start.
 - A card captures a **single card of equal rank** (mandatory when present)
   or a **combination of table cards whose ranks sum to its own**.
@@ -314,20 +417,69 @@ must dismiss. A play attempted in this phase is rejected with an
   configurable per game via the `target_score` creation option) with a
   clear lead; a tie at or above the target is broken by another hand.
 
+### Briscola
+
+- 40-card Italian deck, three cards per player. The card turned up after
+  the deal fixes the trump (*briscola*) suit for the whole deal and is the
+  last card drawn from the stock.
+- Trick play: the highest trump wins; when no trump was played, the
+  highest card of the led suit wins. The winner takes the trick and leads
+  the next one.
+- After each trick every player draws back up to three cards, starting
+  with the trick winner; the face-up briscola card goes to whoever's turn
+  to draw it is.
+- Card points: ace 11, three 10, king 4, horse 3, jack 2 — 120 points per
+  deal. Trick strength is unrelated to points: ace > three > king > horse
+  > jack > 7 > 6 > 5 > 4 > 2.
+- Match points accumulate across deals; a 60–60 deal is a *patta*: its
+  points are discarded and the deal is replayed. The match ends when a
+  team reaches the target score (default 61, configurable per game via
+  the `target_score` creation option) with a clear lead; a tie at or
+  above the target is broken by another deal.
+- `briscola` is the classic two-player game; `briscola_a_quattro` seats
+  four players in two fixed partnerships (seats 0/2 vs 1/3, partners
+  opposite).
+
+### Briscola chiamata
+
+- 40-card Italian deck, eight cards each for five players: the whole deck
+  is dealt, so there is no stock and no face-up card.
+- The calling auction starts with the player after the dealer: each
+  player either passes (leaving the auction) or bids a lower rank than
+  the standing bid (*A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2*); once the
+  standing bid is the two, the auction continues on points (62, 64, …).
+  The last player standing must bid, so every deal gets a caller.
+- The winner names any card of the won rank. If the winner holds it, the
+  caller plays alone against the other four; otherwise its holder is the
+  secret partner and the two form the calling side. The called card's
+  suit is the trump; the partner's identity stays hidden until the
+  called card is played.
+- Play and trick resolution follow briscola; eight tricks exhaust every
+  hand. The calling side must reach the declared target (61 unless
+  raised); with the plain target a 60–60 deal is a *patta* and is
+  replayed with the next dealer. A match is a single deal, so the caller
+  and partner (or the lone caller) against the other players map onto
+  the platform's two-team result, Elo and history.
+- Auction bids, the called-card choice and the plays all have their own
+  `TURN_TIMEOUT_SECONDS` deadlines (an absent player is auto-bid,
+  auto-called or auto-played for).
+
 ## Development
 
 ```sh
 python3 -m venv .venv
 .venv/bin/pip install -r requirements.txt
-.venv/bin/pip install -e ./packages/tavolo-platform -e ./packages/tavolo-scopone -e './packages/tavolo-app[dev]'
+.venv/bin/pip install -e ./packages/tavolo-platform -e ./packages/tavolo-scopone -e ./packages/tavolo-briscola -e './packages/tavolo-app[dev]'
 # app integration suite:
 .venv/bin/python -m unittest discover -s tests -t .
 # per-package suites (each package is self-contained):
 .venv/bin/python -m unittest discover -s packages/tavolo-platform/tests
 .venv/bin/python -m unittest discover -s packages/tavolo-scopone/tests
+.venv/bin/python -m unittest discover -s packages/tavolo-briscola/tests
 # type checks (see packages/tavolo-app/README.md for the app modules):
 .venv/bin/python -m mypy -p tavolo.platform
 .venv/bin/python -m mypy -p tavolo.scopone
+.venv/bin/python -m mypy -p tavolo.briscola
 ```
 
 Tests run fully in-process: in-memory sqlite for Postgres, in-memory stores
@@ -385,6 +537,13 @@ packages/tavolo-scopone/      # scopone scientifico game (own pyproject + tests)
   ├── engine.py               # pure scopone scientifico rules
   ├── errors.py               # scopone-specific rule violations
   └── plugin.py               # ScoponeEngine: the GameEngine adapter
+packages/tavolo-briscola/     # briscola game (own pyproject + tests)
+  src/tavolo/briscola/
+  ├── state.py                # BriscolaState / PlayerState / Card / Trick, JSON (de)serialization
+  ├── engine.py               # pure briscola rules (2- and 4-player)
+  ├── chiamata.py             # pure briscola chiamata rules (5-player, auction, secret partner)
+  ├── errors.py               # briscola-specific rule violations
+  └── plugin.py               # BriscolaEngine + BriscolaQuattroEngine + BriscolaChiamataEngine
 packages/tavolo-app/          # deployable app: composition root (own pyproject)
   src/tavolo/
   ├── app.py                  # session/OIDC/Tortoise/OpenAPI/Platform/DeadlineScheduler mixins
@@ -395,5 +554,5 @@ packages/tavolo-app/          # deployable app: composition root (own pyproject)
   └── static.py               # SPA shell hosting
 pyproject.toml                # tooling shim: [tool.aerich] + [tool.mypy] for server/ CWD
 migrations/                   # aerich migrations for the platform models
-tests/                        # app integration suite (platform + scopone wired together)
+tests/                        # app integration suite (platform + games wired together)
 ```

server/conftest.py

@@ -10,7 +10,8 @@ from __future__ import annotations
 import os
 
 os.environ.setdefault("DATABASE_URL", "sqlite://:memory:")
-os.environ.setdefault("OIDC_ISSUER", "http://localhost:8180/tavolo")
-os.environ.setdefault("OIDC_CLIENT_ID", "tavolo")
-os.environ.setdefault("OIDC_REDIRECT_URI", "http://localhost:8080/auth/callback")
+os.environ.setdefault("OIDC_0_PROVIDER", "default")
+os.environ.setdefault("OIDC_0_ISSUER", "http://localhost:8180/tavolo")
+os.environ.setdefault("OIDC_0_CLIENT_ID", "tavolo")
+os.environ.setdefault("OIDC_0_REDIRECT_URI", "http://localhost:8080/auth/default/callback")
 os.environ.pop("REDIS_URL", None)

server/packages/tavolo-app/README.md

@@ -2,14 +2,15 @@
 
 The deployable tavolo application: the composition root wiring
 [`tavolo-platform`](../tavolo-platform/README.md) to the
-[`tavolo-scopone`](../tavolo-scopone/README.md) game.
+[`tavolo-scopone`](../tavolo-scopone/README.md) and
+[`tavolo-briscola`](../tavolo-briscola/README.md) games.
 
 ## Contents
 
 - `app.py` — assembles the `KayaApp` (session/OIDC/Tortoise/OpenAPI
   mixins plus `PlatformMixin` and the deadline scheduler), registers the
-  `ScoponeEngine` with its configured timeouts, and exposes
-  `tavolo.app:app` for granian.
+  `ScoponeEngine`, `BriscolaEngine` and `BriscolaQuattroEngine` with
+  their configured timeouts, and exposes `tavolo.app:app` for granian.
 - `config.py` — environment-driven frozen `Settings`.
 - `telemetry.py` — the optional OpenTelemetry wiring beyond kaya-otel:
   meter/tracer/logger providers, the

server/packages/tavolo-app/pyproject.toml

@@ -5,12 +5,13 @@ build-backend = "setuptools.build_meta"
 [project]
 name = "tavolo-app"
 version = "0.1.0"
-description = "Tavolo multiplayer card-game application: platform + scopone game wiring"
+description = "Tavolo multiplayer card-game application: platform + games wiring"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "tavolo-platform",
     "tavolo-scopone",
+    "tavolo-briscola",
     "kaya-core",
     "kaya-cors",
     "kaya-session",
@@ -34,7 +35,7 @@ dev = [
     "httpx-ws",
 ]
 otel = [
-    "kaya-otel>=0.0.4",
+    "kaya-otel>=0.0.7",
     "opentelemetry-instrumentation-asyncpg>=0.66b0",
     "opentelemetry-instrumentation-redis>=0.66b0",
     "opentelemetry-instrumentation-system-metrics>=0.66b0",

server/packages/tavolo-app/src/tavolo/app.py

@@ -6,7 +6,7 @@ platform:
 - :class:`~kaya.session.SessionMixin` (sessions persisted in Redis via
   :class:`~kaya.session.redis.RedisSessionStore` when ``REDIS_URL`` is set,
   otherwise an in-memory store — e.g. for tests)
-- :class:`~kaya.oidc.OIDCMixin` (OIDC login)
+- :class:`~kaya.oidc.OIDCProviders` (the configured OIDC providers)
 - :class:`~tavolo.platform.tortoise_mixin.TortoiseMixin` (Postgres match
   statistics; skipped for ``/api/health`` and the OpenAPI documentation
   endpoints)
@@ -35,10 +35,15 @@ from typing import Any, Dict, Optional
 
 from kaya.core import KayaApp, KayaMixin
 from kaya.cors import CorsMixin
-from kaya.oidc import OIDCConfig, OIDCMixin
+from kaya.oidc import OIDCConfig, OIDCProviders
 from kaya.openapi import OpenAPIMixin
 from kaya.session import SessionMixin
 from redis.asyncio import Redis
+from tavolo.briscola import (
+    BriscolaChiamataEngine,
+    BriscolaEngine,
+    BriscolaQuattroEngine,
+)
 from tavolo.platform import GameRegistry, Platform, PlatformMixin
 from tavolo.platform.deadlines import DeadlineScheduler, DeadlineSchedulerMixin
 from tavolo.platform.store import GameStore, InMemoryGameStore, RedisGameStore
@@ -131,9 +136,27 @@ registry.register(
         hand_ack_timeout_seconds=settings.hand_ack_timeout_seconds,
     )
 )
+registry.register(
+    BriscolaEngine(
+        turn_timeout_seconds=settings.turn_timeout_seconds,
+        hand_ack_timeout_seconds=settings.hand_ack_timeout_seconds,
+    )
+)
+registry.register(
+    BriscolaQuattroEngine(
+        turn_timeout_seconds=settings.turn_timeout_seconds,
+        hand_ack_timeout_seconds=settings.hand_ack_timeout_seconds,
+    )
+)
+registry.register(
+    BriscolaChiamataEngine(
+        turn_timeout_seconds=settings.turn_timeout_seconds,
+        hand_ack_timeout_seconds=settings.hand_ack_timeout_seconds,
+    )
+)
 log.info("registered games: %s", ", ".join(e.id for e in registry.all()))
 log.debug(
-    "scopone timeouts: hand_ack=%ds turn=%ds",
+    "game timeouts: hand_ack=%ds turn=%ds",
     settings.hand_ack_timeout_seconds,
     settings.turn_timeout_seconds,
 )
@@ -156,18 +179,26 @@ else:
     log.info("REDIS_URL unset: using in-memory stores (sessions + live games)")
 
 session_mixin = SessionMixin(session_store)
-oidc_mixin = OIDCMixin(
-    OIDCConfig(
-        issuer=settings.oidc_issuer,
-        client_id=settings.oidc_client_id,
-        client_secret=settings.oidc_client_secret,
-        redirect_uri=settings.oidc_redirect_uri,
-        post_login_redirect=settings.oidc_post_login_redirect,
-        post_logout_redirect=settings.oidc_post_logout_redirect,
-        fetch_userinfo=True,
-    ),
+oidc = OIDCProviders(
+    [
+        OIDCConfig(
+            provider=provider.provider,
+            issuer=provider.issuer,
+            client_id=provider.client_id,
+            client_secret=provider.client_secret,
+            redirect_uri=provider.redirect_uri,
+            post_login_redirect=provider.post_login_redirect,
+            post_logout_redirect=provider.post_logout_redirect,
+            fetch_userinfo=True,
+        )
+        for provider in settings.oidc_providers
+    ],
     session=session_mixin,
 )
+log.info(
+    "OIDC providers: %s",
+    ", ".join(provider.provider for provider in settings.oidc_providers),
+)
 openapi_mixin = OpenAPIMixin(
     title="tavolo",
     version=_pkg_version("tavolo-app"),
@@ -192,10 +223,10 @@ platform = Platform(
     registry=registry,
     game_store=game_store,
     scheduler=scheduler,
-    oidc=oidc_mixin,
+    oidc=oidc,
 )
 
-mixins: list[KayaMixin] = [session_mixin, oidc_mixin, tortoise_mixin, openapi_mixin,
+mixins: list[KayaMixin] = [session_mixin, oidc, tortoise_mixin, openapi_mixin,
                            PlatformMixin(platform), DeadlineSchedulerMixin(scheduler)]
 telemetry = telemetry_from_settings(settings, session_store, game_store)
 if telemetry is not None:

server/packages/tavolo-app/src/tavolo/config.py

@@ -6,6 +6,7 @@ dataclass. No pydantic-settings, no settings module.
 from __future__ import annotations
 
 import os
+import re
 from dataclasses import dataclass
 from typing import Optional, Tuple
 from urllib.parse import quote
@@ -39,6 +40,135 @@ def _env_bool(name: str, default: bool = False) -> bool:
     return value.strip().lower() in ("1", "true", "yes", "on")
 
 
+# Per-provider OIDC settings are indexed with a 0-based suffix:
+# OIDC_<n>_PROVIDER, OIDC_<n>_ISSUER, ... Indices must be contiguous from 0.
+_OIDC_VARIABLES = (
+    "PROVIDER",
+    "ISSUER",
+    "CLIENT_ID",
+    "CLIENT_SECRET",
+    "REDIRECT_URI",
+    "POST_LOGIN_REDIRECT",
+    "POST_LOGOUT_REDIRECT",
+)
+_OIDC_ENV = re.compile(r"^OIDC_(\d+)_([A-Z0-9_]+)$")
+_PROVIDER_NAME = re.compile(r"^[A-Za-z0-9_-]+$")
+
+# The pre-0.0.6 unindexed names, detected only to point the migration out.
+_LEGACY_OIDC_VARIABLES = (
+    "OIDC_ISSUER",
+    "OIDC_CLIENT_ID",
+    "OIDC_CLIENT_SECRET",
+    "OIDC_REDIRECT_URI",
+    "OIDC_POST_LOGIN_REDIRECT",
+    "OIDC_POST_LOGOUT_REDIRECT",
+)
+
+_DEFAULT_OIDC_ISSUER = "http://localhost:8180/tavolo"
+_DEFAULT_OIDC_CLIENT_ID = "tavolo"
+
+
+@dataclass(frozen=True)
+class OidcProviderSettings:
+    """One OIDC provider, parsed from the ``OIDC_<n>_*`` variables.
+
+    ``provider`` names the provider in URLs (``/auth/<provider>/login``)
+    and namespaces its session state (``oidc:<provider>:...``); it must
+    match kaya-oidc's ``[A-Za-z0-9_-]+`` pattern.
+    """
+
+    provider: str
+    issuer: str
+    client_id: str
+    client_secret: Optional[str]
+    redirect_uri: str
+    post_login_redirect: str
+    post_logout_redirect: str
+
+
+def _oidc_providers_from_env() -> Tuple[OidcProviderSettings, ...]:
+    """Parse the indexed ``OIDC_<n>_*`` provider configuration.
+
+    With no indexed variables at all, fall back to a single provider
+    named ``default`` pointing at the dev mock IdP, mirroring the
+    pre-0.0.6 defaults. The old unindexed variables are rejected with a
+    migration hint: they would otherwise be silently ignored.
+    """
+    legacy = [name for name in _LEGACY_OIDC_VARIABLES if os.environ.get(name)]
+    if legacy:
+        renamed = ", ".join(
+            f"{name} -> OIDC_0_{name[len('OIDC_'):]}" for name in legacy
+        )
+        raise RuntimeError(
+            "the OIDC variables are now indexed per provider "
+            f"({renamed}; add OIDC_0_PROVIDER)"
+        )
+
+    indices: set = set()
+    for name in os.environ:
+        match = _OIDC_ENV.match(name)
+        if match is None:
+            continue
+        index, variable = match.groups()
+        if variable not in _OIDC_VARIABLES:
+            raise RuntimeError(
+                f"unknown OIDC environment variable {name!r}; expected one of "
+                + ", ".join(f"OIDC_<n>_{v}" for v in _OIDC_VARIABLES)
+            )
+        indices.add(int(index))
+
+    if not indices:
+        return (
+            OidcProviderSettings(
+                provider="default",
+                issuer=_DEFAULT_OIDC_ISSUER,
+                client_id=_DEFAULT_OIDC_CLIENT_ID,
+                client_secret=None,
+                redirect_uri="http://localhost:8080/auth/default/callback",
+                post_login_redirect="/",
+                post_logout_redirect="/",
+            ),
+        )
+
+    missing = sorted(set(range(max(indices) + 1)) - indices)
+    if missing:
+        raise RuntimeError(
+            "OIDC provider indices must be contiguous from 0; missing "
+            + ", ".join(f"OIDC_{index}_*" for index in missing)
+        )
+
+    providers = []
+    seen = set()
+    for index in sorted(indices):
+        prefix = f"OIDC_{index}_"
+        provider = _env(prefix + "PROVIDER")
+        if _PROVIDER_NAME.match(provider) is None:
+            raise RuntimeError(
+                f"{prefix}PROVIDER must be a non-empty string of letters, "
+                f"digits, underscores or hyphens (got {provider!r})"
+            )
+        if provider in seen:
+            raise RuntimeError(f"duplicate OIDC provider name {provider!r}")
+        seen.add(provider)
+        providers.append(
+            OidcProviderSettings(
+                provider=provider,
+                issuer=_env(prefix + "ISSUER"),
+                client_id=_env(prefix + "CLIENT_ID"),
+                client_secret=os.environ.get(prefix + "CLIENT_SECRET") or None,
+                # kaya-oidc's OIDCProviders derives the callback route from
+                # the provider name; keep the default in sync with it.
+                redirect_uri=_env(
+                    prefix + "REDIRECT_URI",
+                    f"http://localhost:8080/auth/{provider}/callback",
+                ),
+                post_login_redirect=_env(prefix + "POST_LOGIN_REDIRECT", "/"),
+                post_logout_redirect=_env(prefix + "POST_LOGOUT_REDIRECT", "/"),
+            )
+        )
+    return tuple(providers)
+
+
 def _database_url_from_parts(engine: str,
                              user: str,
                              password: Optional[str],
@@ -70,15 +200,10 @@ def _database_url_from_parts(engine: str,
 @dataclass(frozen=True)
 class Settings:
     database_url: str
-    oidc_issuer: str
-    oidc_client_id: str
-    oidc_client_secret: Optional[str]
-    oidc_redirect_uri: str
-    # Where the browser is sent after login/logout. In production the SPA is
-    # served by this app ("/"); in development point these at the trunk dev
-    # server (e.g. "http://localhost:8000/").
-    oidc_post_login_redirect: str
-    oidc_post_logout_redirect: str
+    # The configured OIDC providers, in index order. Each provider
+    # authenticates users independently and namespaces its session state;
+    # see OidcProviderSettings above.
+    oidc_providers: Tuple[OidcProviderSettings, ...]
     app_host: str
     app_port: int
     redis_url: Optional[str]
@@ -90,17 +215,17 @@ class Settings:
     # are served by Granian under /static (GRANIAN_STATIC_PATH_* env vars).
     static_dir: str
     # Seconds the between-hands scoring summary waits for acknowledgements
-    # before dealing the next hand anyway (wired into the ScoponeEngine;
+    # before dealing the next hand anyway (wired into the game engines;
     # see tavolo.app).
     hand_ack_timeout_seconds: int
     # Seconds a player has to play before the server plays a random legal
     # card for them, covering disconnects and idle players (wired into the
-    # ScoponeEngine; see tavolo.app).
+    # game engines; see tavolo.app).
     turn_timeout_seconds: int
-    # Upper bound on how long the deadline consumer sleeps between polls.
-    # Locally enqueued deadlines wake the consumer immediately; the
-    # heartbeat only bounds the discovery delay for deadlines enqueued by
-    # other workers.
+    # Upper bound on how long the deadline consumer sleeps between polls
+    # when nothing else wakes it. Enqueued deadlines are announced over a
+    # pub/sub channel, so this is only the backstop recovering lost
+    # notifications and deadlines orphaned by a dead worker.
     deadline_heartbeat_ms: int
     # Path to a YAML logging configuration file (logging.config.dictConfig
     # schema). Unset uses the built-in default: DEBUG to the console.
@@ -147,12 +272,7 @@ class Settings:
                 # Raw DSN query string (e.g. "ssl=require"); empty = none.
                 options=os.environ.get("DATABASE_OPTIONS", ""),
             ),
-            oidc_issuer=_env("OIDC_ISSUER", "http://localhost:8180/tavolo"),
-            oidc_client_id=_env("OIDC_CLIENT_ID", "tavolo"),
-            oidc_client_secret=os.environ.get("OIDC_CLIENT_SECRET"),
-            oidc_redirect_uri=_env("OIDC_REDIRECT_URI", "http://localhost:8080/auth/callback"),
-            oidc_post_login_redirect=_env("OIDC_POST_LOGIN_REDIRECT", "/"),
-            oidc_post_logout_redirect=_env("OIDC_POST_LOGOUT_REDIRECT", "/"),
+            oidc_providers=_oidc_providers_from_env(),
             app_host=_env("APP_HOST", "0.0.0.0"),
             app_port=int(_env("APP_PORT", "8080")),
             # When unset, sessions and live games fall back to in-memory
@@ -163,7 +283,7 @@ class Settings:
             static_dir=_env("STATIC_DIR", "web/dist"),
             hand_ack_timeout_seconds=int(_env("HAND_ACK_TIMEOUT_SECONDS", "30")),
             turn_timeout_seconds=int(_env("TURN_TIMEOUT_SECONDS", "30")),
-            deadline_heartbeat_ms=int(_env("DEADLINE_HEARTBEAT_MS", "1000")),
+            deadline_heartbeat_ms=int(_env("DEADLINE_HEARTBEAT_MS", "30000")),
             logging_config=os.environ.get("LOGGING_CONFIG"),
             # CORS is disabled unless CORS_ALLOW_ORIGINS (a comma-separated
             # list of origins, or "*" for any) or CORS_ALLOW_ORIGIN_REGEX

server/packages/tavolo-app/src/tavolo/telemetry.py

@@ -28,12 +28,13 @@ import hashlib
 import logging
 from dataclasses import dataclass
 from logging import getLogger
-from typing import TYPE_CHECKING, Any, Dict, Mapping, Optional, Union
+from typing import TYPE_CHECKING, Any, Dict, Optional, Union
 
 from kaya.core import KayaApp, KayaMixin
 from kaya.session import InMemorySessionStore, SessionStore
 from kaya.session.redis import RedisSessionStore
 from redis.asyncio import Redis
+from tavolo.platform.auth import session_user
 from tavolo.platform.store import GameStore
 
 from .config import Settings
@@ -108,8 +109,8 @@ def session_tag_hook(span: Any, carrier: Any) -> None:
             "session.id",
             hashlib.sha256(session_id.encode()).hexdigest()[:16],
         )
-    user = session.get("oidc_user")
-    if isinstance(user, Mapping):
+    user = session_user(session)
+    if user is not None:
         sub = user.get("sub")
         if sub:
             span.set_attribute("user.id", str(sub))

server/packages/tavolo-briscola/README.md

@@ -0,0 +1,98 @@
+# tavolo-briscola
+
+Briscola — the Italian trick-taking game — as a
+[`tavolo-platform`](../tavolo-platform/README.md) game implementation.
+Three variants share one rules core:
+
+- `briscola` — the classic two-player game;
+- `briscola_a_quattro` — four-player fixed-partnership briscola;
+- `briscola_chiamata` — five-player briscola with a calling auction and a
+  secret partner.
+
+## Contents
+
+- `state.py` — `BriscolaState` (pure game data: phases, players, hands,
+  stock, face-up briscola, tricks, scores, deadlines), `PlayerState`,
+  `Card`, `TrickCard`, `Trick`, with JSON (de)serialization. No session
+  envelope, no transport, no I/O.
+- `engine.py` — the pure rules engine for two- and four-player briscola:
+  deck, deals, trick resolution (trump first, then the led suit; strength
+  ace > three > king > horse > jack > 7 > 6 > 5 > 4 > 2), the draw order
+  (trick winner first, the face-up briscola last), card points (ace 11,
+  three 10, king 4, horse 3, jack 2), patta re-deals and the
+  target-score match end, deal-end acknowledgements and auto-play.
+  Deterministic and I/O-free apart from logging, so the whole rule set is
+  unit-testable.
+- `chiamata.py` — the pure rules engine for five-player briscola
+  chiamata: `ChiamataState`/`ChiamataPlayer`/`Auction` (JSON
+  round-trip), the 8-card deal with no stock, the descending calling
+  auction with point raises, the winner's call (including calling one's
+  own card, which means playing alone), the called-card reveal, single-
+  deal scoring with the 60–60 patta and the auto-actions for timeouts.
+- `errors.py` — briscola-specific errors (`CardNotInHand`); every other
+  failure mode is a shared `tavolo.platform.errors` subclass.
+- `plugin.py` — `BriscolaEngine`, `BriscolaQuattroEngine` and
+  `BriscolaChiamataEngine` (`GameEngine`): the platform-facing adapters.
+  The first two validate the `target_score` creation option (61–120,
+  default 61) and extract the `MatchResult` (teams, winner, per-player
+  scores and the match summary persisted as the match's JSON `result`).
+  Briscola chiamata takes no creation options.
+
+Timeouts are constructor arguments (`turn_timeout_seconds`,
+`hand_ack_timeout_seconds`), wired from the environment by the
+application composition root. Briscola chiamata uses the turn timeout
+for its auction bids, the called-card choice and the plays; it never
+enters the between-deals acknowledgement phase (a single deal ends the
+match), so the hand-ack timeout is accepted but unused.
+
+## Rules
+
+### Briscola (two-player and four-player)
+
+- Three cards per player; the next card is turned face up: its suit is
+  the trump (briscola) for the deal and it is the last card drawn.
+- The winner of a trick is the highest trump, or the highest card of the
+  led suit when no trump was played. The winner takes the trick and leads
+  the next one.
+- After each trick everyone draws back up to three cards, starting with
+  the trick winner.
+- Card points total 120 per deal; a 60–60 deal is a *patta*, its points
+  are discarded and the deal is replayed. The first team to the target
+  score wins; a tie at or above the target is broken by another deal.
+- Between deals of an unfinished match every player acknowledges the
+  summary (or the hand-end timeout deals on), exactly like scopone.
+
+### Briscola chiamata (five-player)
+
+- The whole 40-card deck is dealt out, eight cards each: there is no
+  stock and no face-up card.
+- Starting with the player after the dealer, each player either passes
+  (leaving the auction for good) or bids a **lower** rank than the
+  standing bid on the ladder *A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2*;
+  the first bidder may bid any rank. Once the standing bid is the two,
+  the auction continues on points instead (62, 64, …): the calling side
+  then has to reach the raised target. The last player standing must
+  bid, so a deal always gets a caller.
+- The auction winner names any card of the winning rank. If the winner
+  holds it, they **play alone** against the other four; otherwise its
+  holder is the **secret partner** and the two form the calling side.
+  The called card's suit is the trump for the deal. The partner's
+  identity is hidden until the called card is played.
+- Play follows briscola: the player after the dealer leads, the highest
+  trump (or highest led-suit card) takes the trick and leads the next
+  one; eight tricks exhaust every hand.
+- The calling side (caller plus partner, or the lone caller) must reach
+  the declared target — 61 unless the auction raised it. With the plain
+  target a 60–60 deal is a patta and is replayed with the next dealer.
+  A match is a single deal, so the two sides map onto the platform's
+  two-team result (Elo rating, match history).
+
+## Development (from `server/`)
+
+```sh
+.venv/bin/python -m unittest discover -s packages/tavolo-briscola/tests
+.venv/bin/python -m mypy -p tavolo.briscola
+```
+
+`test_engine.py`/`test_plugin.py` cover the two classic variants;
+`test_chiamata.py`/`test_chiamata_plugin.py` cover briscola chiamata.

server/packages/tavolo-briscola/pyproject.toml

@@ -0,0 +1,22 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tavolo-briscola"
+version = "0.1.0"
+description = "Briscola game implementation for the tavolo platform"
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+    "tavolo-platform",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+namespaces = true
+
+[tool.mypy]
+python_version = "3.12"
+ignore_missing_imports = true
+plugins = []

server/packages/tavolo-briscola/src/tavolo/briscola/__init__.py

@@ -0,0 +1,31 @@
+"""Briscola: tavolo's trick-taking game implementation.
+
+Three variants share the same rules core and platform adapter:
+
+- :class:`~tavolo.briscola.plugin.BriscolaEngine` — classic two-player
+  briscola (``briscola``);
+- :class:`~tavolo.briscola.plugin.BriscolaQuattroEngine` — four-player
+  fixed-partnership briscola a quattro (``briscola_a_quattro``);
+- :class:`~tavolo.briscola.plugin.BriscolaChiamataEngine` — five-player
+  briscola chiamata (``briscola_chiamata``).
+
+The pure rules (:mod:`tavolo.briscola.engine`,
+:mod:`tavolo.briscola.state` and :mod:`tavolo.briscola.chiamata`) know
+nothing about HTTP, Redis or Postgres; :mod:`tavolo.briscola.plugin`
+adapts them to the platform's
+:class:`~tavolo.platform.engine.GameEngine` contract so the
+game-independent platform can host them.
+"""
+from __future__ import annotations
+
+from .plugin import (
+    BriscolaChiamataEngine,
+    BriscolaEngine,
+    BriscolaQuattroEngine,
+)
+
+__all__ = [
+    "BriscolaChiamataEngine",
+    "BriscolaEngine",
+    "BriscolaQuattroEngine",
+]

server/packages/tavolo-briscola/src/tavolo/briscola/chiamata.py

@@ -0,0 +1,954 @@
+"""Pure rules engine for briscola chiamata.
+
+Briscola chiamata is the five-player variant of briscola. The 40-card
+deck is dealt out entirely (8 cards each, no stock): there is no face-up
+briscola card. Instead the players auction off the right to call a
+partner:
+
+* starting with the player after the dealer, each player either passes
+  (leaving the auction for good) or bids a rank lower than the standing
+  bid on the ladder ``A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2``; the first
+  bidder may bid any rank. Once the standing bid is the 2, further bids
+  raise the points the calling side must reach instead (62, 64, ...).
+* the last remaining bidder wins and names the exact card of the winning
+  rank (any suit). If the winner holds the named card they play alone
+  against the other four; otherwise its holder is the **secret partner**
+  and the two form the calling side. The called card's suit is the trump
+  (*briscola*) for the whole deal.
+* play and scoring follow briscola. The calling side must reach the
+  declared target (61 unless raised); a 60-60 deal with the plain target
+  is a **patta** and is replayed.
+
+A match is a single deal (patta replays aside), so the two sides map
+onto the platform's two-team result (Elo rating, match history). The
+partner's identity stays hidden until the called card is played, at
+which point the roles are revealed.
+
+Like :mod:`tavolo.briscola.engine` this module is deterministic and
+I/O-free apart from logging: it mutates (or reads)
+:class:`~tavolo.briscola.chiamata.ChiamataState` and raises
+:class:`~tavolo.platform.errors.GameError` subclasses on rule
+violations. The platform-facing adapter is
+:class:`~tavolo.briscola.plugin.BriscolaChiamataEngine`.
+"""
+from __future__ import annotations
+
+import random
+from dataclasses import dataclass, field
+from datetime import datetime, timedelta, timezone
+from logging import getLogger
+from typing import Any, Dict, List, Optional, Tuple
+
+from tavolo.platform.errors import (
+    AlreadyJoined,
+    GameFinished,
+    GameNotStarted,
+    IllegalMove,
+    LobbyFull,
+    NotYourTurn,
+)
+
+from .engine import TRICK_STRENGTH, card_points, shuffled_deck
+from .errors import CardNotInHand
+from .state import (
+    DEFAULT_TURN_TIMEOUT_SECONDS,
+    PHASE_FINISHED,
+    PHASE_LOBBY,
+    PHASE_PLAYING,
+    SUITS,
+    Card,
+    Trick,
+    TrickCard,
+    parse_card,
+)
+
+log = getLogger(__name__)
+
+# Five seats, the whole 40-card deck dealt out.
+PLAYER_COUNT = 5
+HAND_SIZE = 8
+
+PHASE_AUCTION = "auction"
+PHASE_CALLING = "calling"
+
+# The two sides of the match: the caller (plus the partner, when there is
+# one) against the other players.
+SIDE_CALLER = 0
+SIDE_DEFENDERS = 1
+SIDE_NAMES = ("Chiamante", "Difensori")
+
+# Role labels carried by the personalized view once they are public.
+ROLE_CALLER = "Chiamante"
+ROLE_PARTNER = "Socio"
+ROLE_DEFENDER = "Difensori"
+
+# Points the calling side must reach: 61 unless the auction raised it.
+DEFAULT_TARGET = 61
+MIN_TARGET = 61
+MAX_TARGET = 120
+
+# Rank ladder of the auction, strongest first: ace, three, king, horse,
+# jack, then the plain ranks downwards.
+BID_LADDER = (1, 3, 10, 9, 8, 7, 6, 5, 4, 2)
+_BID_INDEX: Dict[int, int] = {rank: index for index, rank in enumerate(BID_LADDER)}
+
+_rng = random.SystemRandom()
+
+
+# -- state -----------------------------------------------------------------
+
+
+@dataclass
+class ChiamataPlayer:
+    sub: str
+    name: str
+    seat: int
+    hand: List[Card] = field(default_factory=list)
+    captured: List[Card] = field(default_factory=list)
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "sub": self.sub,
+            "name": self.name,
+            "seat": self.seat,
+            "hand": [c.to_json() for c in self.hand],
+            "captured": [c.to_json() for c in self.captured],
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "ChiamataPlayer":
+        return ChiamataPlayer(
+            sub=str(data["sub"]),
+            name=str(data["name"]),
+            seat=int(data["seat"]),
+            hand=[Card.from_json(c) for c in data.get("hand", [])],
+            captured=[Card.from_json(c) for c in data.get("captured", [])],
+        )
+
+
+@dataclass
+class Bid:
+    """One auction bid: a rank, or (at the 2) a raised points target."""
+
+    seat: int
+    rank: int
+    points: int
+
+    def to_json(self) -> Dict[str, Any]:
+        return {"seat": self.seat, "rank": self.rank, "points": self.points}
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "Bid":
+        return Bid(
+            seat=int(data["seat"]),
+            rank=int(data["rank"]),
+            points=int(data["points"]),
+        )
+
+
+@dataclass
+class Auction:
+    """The state of the calling auction."""
+
+    # Seat to act; always one of ``active``.
+    turn: int = 0
+    active: List[int] = field(default_factory=list)
+    passed: List[int] = field(default_factory=list)
+    current: Optional[Bid] = None
+    history: List[Bid] = field(default_factory=list)
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "turn": self.turn,
+            "active": list(self.active),
+            "passed": list(self.passed),
+            "current": self.current.to_json() if self.current else None,
+            "history": [b.to_json() for b in self.history],
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "Auction":
+        return Auction(
+            turn=int(data.get("turn", 0)),
+            active=[int(s) for s in data.get("active", [])],
+            passed=[int(s) for s in data.get("passed", [])],
+            current=(
+                Bid.from_json(data["current"]) if data.get("current") else None
+            ),
+            history=[Bid.from_json(b) for b in data.get("history", [])],
+        )
+
+
+@dataclass
+class ChiamataState:
+    phase: str = PHASE_LOBBY
+    players: List[ChiamataPlayer] = field(default_factory=list)
+    dealer: int = 0
+    # 1-based deal counter; grows with patta replays.
+    hand_number: int = 1
+    # 0 = the calling side (caller plus partner, when there is one),
+    # 1 = the defenders. Only set once the match is finished.
+    winner: Optional[int] = None
+    scores: List[int] = field(default_factory=lambda: [0, 0])
+    # The calling auction of the current deal.
+    auction: Optional[Auction] = None
+    # Seat that won the auction (public from then on).
+    caller: Optional[int] = None
+    # The card named by the caller; its suit is the trump.
+    called_card: Optional[Card] = None
+    briscola_suit: str = ""
+    # Points target from the auction (61 unless raised).
+    declared_target: int = DEFAULT_TARGET
+    # True when the caller named a card of their own hand: no partner.
+    solo: bool = False
+    # True once the called card has been played; roles become public.
+    called_played: bool = False
+    # The partner's seat, recorded when the called card is played; stays
+    # ``None`` for a solo call.
+    partner_seat: Optional[int] = None
+    # Cards of the trick in progress, in play order.
+    trick: List[TrickCard] = field(default_factory=list)
+    trick_leader: int = 0
+    last_trick: Optional[Trick] = None
+    # Seat currently to act (auction bidder, caller, or player on turn).
+    turn: int = 0
+    # Per-deal audit trail, patta entries included.
+    hand_scores: List[Dict[str, Any]] = field(default_factory=list)
+    # While phase == "auction"/"playing": when the server acts for the
+    # player on turn.
+    turn_deadline: Optional[str] = None
+    auction_deadline: Optional[str] = None
+    # While phase == "calling": when the server names a card for the
+    # auction winner.
+    call_deadline: Optional[str] = None
+    # Seconds a player has to act before the server acts for them.
+    turn_timeout: int = DEFAULT_TURN_TIMEOUT_SECONDS
+
+    # -- serialization ----------------------------------------------------
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "phase": self.phase,
+            "players": [p.to_json() for p in self.players],
+            "dealer": self.dealer,
+            "hand_number": self.hand_number,
+            "winner": self.winner,
+            "scores": list(self.scores),
+            "auction": self.auction.to_json() if self.auction else None,
+            "caller": self.caller,
+            "called_card": (
+                self.called_card.to_json() if self.called_card else None
+            ),
+            "briscola_suit": self.briscola_suit,
+            "declared_target": self.declared_target,
+            "solo": self.solo,
+            "called_played": self.called_played,
+            "partner_seat": self.partner_seat,
+            "trick": [t.to_json() for t in self.trick],
+            "trick_leader": self.trick_leader,
+            "last_trick": self.last_trick.to_json() if self.last_trick else None,
+            "turn": self.turn,
+            "hand_scores": list(self.hand_scores),
+            "turn_deadline": self.turn_deadline,
+            "auction_deadline": self.auction_deadline,
+            "call_deadline": self.call_deadline,
+            "turn_timeout": self.turn_timeout,
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "ChiamataState":
+        return ChiamataState(
+            phase=str(data.get("phase", PHASE_LOBBY)),
+            players=[
+                ChiamataPlayer.from_json(p) for p in data.get("players", [])
+            ],
+            dealer=int(data.get("dealer", 0)),
+            hand_number=int(data.get("hand_number", 1)),
+            winner=data.get("winner"),
+            scores=[int(x) for x in data.get("scores", [0, 0])],
+            auction=(
+                Auction.from_json(data["auction"]) if data.get("auction") else None
+            ),
+            caller=data.get("caller"),
+            called_card=(
+                Card.from_json(data["called_card"])
+                if data.get("called_card")
+                else None
+            ),
+            briscola_suit=str(data.get("briscola_suit", "")),
+            declared_target=int(data.get("declared_target", DEFAULT_TARGET)),
+            solo=bool(data.get("solo", False)),
+            called_played=bool(data.get("called_played", False)),
+            partner_seat=data.get("partner_seat"),
+            trick=[TrickCard.from_json(t) for t in data.get("trick", [])],
+            trick_leader=int(data.get("trick_leader", 0)),
+            last_trick=(
+                Trick.from_json(data["last_trick"]) if data.get("last_trick") else None
+            ),
+            turn=int(data.get("turn", 0)),
+            hand_scores=list(data.get("hand_scores", [])),
+            turn_deadline=data.get("turn_deadline"),
+            auction_deadline=data.get("auction_deadline"),
+            call_deadline=data.get("call_deadline"),
+            turn_timeout=int(
+                data.get("turn_timeout", DEFAULT_TURN_TIMEOUT_SECONDS)
+            ),
+        )
+
+    # -- helpers ----------------------------------------------------------
+
+    def player_for(self, sub: Optional[str]) -> Optional[ChiamataPlayer]:
+        for player in self.players:
+            if player.sub == sub:
+                return player
+        return None
+
+    def seated(self, sub: str) -> bool:
+        return self.player_for(sub) is not None
+
+
+# -- game setup --------------------------------------------------------------
+
+
+def create_game(
+    creator_sub: str,
+    creator_name: str,
+    turn_timeout: int = DEFAULT_TURN_TIMEOUT_SECONDS,
+) -> ChiamataState:
+    """Create a lobby game with the creator seated first."""
+    return ChiamataState(
+        phase=PHASE_LOBBY,
+        players=[ChiamataPlayer(sub=creator_sub, name=creator_name, seat=0)],
+        turn_timeout=turn_timeout,
+    )
+
+
+def join_game(state: ChiamataState, sub: str, name: str) -> None:
+    """Seat ``sub`` in the next free chair, starting the match when full."""
+    if state.phase != PHASE_LOBBY:
+        raise GameNotStarted("game has already started")
+    if state.seated(sub):
+        raise AlreadyJoined("already joined this game")
+    if len(state.players) >= PLAYER_COUNT:
+        raise LobbyFull("game is full")
+    seat = len(state.players)
+    state.players.append(ChiamataPlayer(sub=sub, name=name, seat=seat))
+    if len(state.players) == PLAYER_COUNT:
+        start_game(state)
+
+
+def start_game(state: ChiamataState) -> None:
+    """Deal the first hand and open the auction."""
+    if len(state.players) != PLAYER_COUNT:
+        raise GameNotStarted(f"need exactly {PLAYER_COUNT} players to start")
+    _deal(state)
+
+
+def _player_at(state: ChiamataState, seat: int) -> ChiamataPlayer:
+    for player in state.players:
+        if player.seat == seat:
+            return player
+    raise IllegalMove(f"no player in seat {seat}")
+
+
+def _set_deadline(seconds: int) -> str:
+    deadline = datetime.now(timezone.utc) + timedelta(seconds=seconds)
+    return deadline.isoformat()
+
+
+def _set_auction_deadline(state: ChiamataState) -> None:
+    state.auction_deadline = _set_deadline(state.turn_timeout)
+
+
+def _set_call_deadline(state: ChiamataState) -> None:
+    state.call_deadline = _set_deadline(state.turn_timeout)
+
+
+def _set_turn_deadline(state: ChiamataState) -> None:
+    state.turn_deadline = _set_deadline(state.turn_timeout)
+
+
+def _deal(state: ChiamataState) -> None:
+    """Deal 8 cards each and open the auction."""
+    deck = shuffled_deck()
+    for player in state.players:
+        player.hand = []
+        player.captured = []
+    state.trick = []
+    state.last_trick = None
+    state.turn_deadline = None
+    state.call_deadline = None
+    state.called_card = None
+    state.briscola_suit = ""
+    state.declared_target = DEFAULT_TARGET
+    state.solo = False
+    state.called_played = False
+    state.partner_seat = None
+    state.caller = None
+    state.winner = None
+    state.scores = [0, 0]
+    # The whole deck is dealt, one card at a time, starting with the
+    # player after the dealer.
+    for _ in range(HAND_SIZE):
+        for offset in range(PLAYER_COUNT):
+            _player_at(
+                state, (state.dealer + 1 + offset) % PLAYER_COUNT
+            ).hand.append(deck.pop())
+    first = (state.dealer + 1) % PLAYER_COUNT
+    state.turn = first
+    state.trick_leader = first
+    state.auction = Auction(
+        turn=first,
+        active=[player.seat for player in state.players],
+    )
+    state.phase = PHASE_AUCTION
+    _set_auction_deadline(state)
+    log.debug(
+        "deal %d dealt (dealer seat %d), auction opens with seat %d",
+        state.hand_number,
+        state.dealer,
+        first,
+    )
+
+
+# -- auction -----------------------------------------------------------------
+
+
+def _require_auction(
+    state: ChiamataState, sub: str
+) -> Tuple[Auction, ChiamataPlayer]:
+    if state.phase == PHASE_FINISHED:
+        raise GameFinished("the match is over")
+    if state.phase != PHASE_AUCTION:
+        raise GameNotStarted("the auction is not open")
+    player = state.player_for(sub)
+    if player is None:
+        raise NotYourTurn("you are not seated in this game")
+    auction = state.auction
+    if auction is None:  # pragma: no cover - auction always exists here
+        raise GameNotStarted("the auction is not open")
+    if auction.turn != player.seat:
+        raise NotYourTurn("it is not your turn to bid")
+    return auction, player
+
+
+def legal_bid_ranks(state: ChiamataState) -> List[int]:
+    """The ranks the player on turn may bid, empty at the point stage."""
+    auction = state.auction
+    if state.phase != PHASE_AUCTION or auction is None:
+        return []
+    current = auction.current
+    if current is None:
+        return list(BID_LADDER)
+    if current.rank == 2:
+        return []
+    index = _BID_INDEX[current.rank]
+    return [rank for rank in BID_LADDER if _BID_INDEX[rank] > index]
+
+
+def legal_bid_points(state: ChiamataState) -> Optional[int]:
+    """The lowest legal points raise, ``None`` when there is none.
+
+    Points may only be raised once the standing bid is the 2; any value
+    higher than the standing bid (up to :data:`MAX_TARGET`) is accepted.
+    """
+    auction = state.auction
+    if state.phase != PHASE_AUCTION or auction is None:
+        return None
+    current = auction.current
+    if current is None or current.rank != 2:
+        return None
+    if current.points >= MAX_TARGET:
+        return None
+    return current.points + 2
+
+
+def _finish_auction(state: ChiamataState) -> None:
+    """The last active bidder wins and must name the called card."""
+    auction = state.auction
+    if auction is None:  # pragma: no cover - guarded by callers
+        raise GameNotStarted("the auction is not open")
+    if len(auction.active) != 1 or auction.current is None:  # pragma: no cover
+        raise IllegalMove("the auction cannot be concluded yet")
+    winner = auction.active[0]
+    state.caller = winner
+    state.declared_target = auction.current.points
+    state.turn = winner
+    state.phase = PHASE_CALLING
+    state.auction_deadline = None
+    _set_call_deadline(state)
+    log.debug(
+        "deal %d: seat %d wins the auction (rank %d, target %d)",
+        state.hand_number,
+        winner,
+        auction.current.rank,
+        auction.current.points,
+    )
+
+
+def _advance_auction(state: ChiamataState) -> None:
+    auction = state.auction
+    if auction is None:  # pragma: no cover - guarded by callers
+        return
+    for offset in range(1, PLAYER_COUNT + 1):
+        seat = (auction.turn + offset) % PLAYER_COUNT
+        if seat in auction.active:
+            auction.turn = seat
+            break
+    state.turn = auction.turn
+    _set_auction_deadline(state)
+
+
+def _apply_bid(state: ChiamataState, bid: Bid) -> None:
+    auction = state.auction
+    if auction is None:  # pragma: no cover - guarded by callers
+        raise GameNotStarted("the auction is not open")
+    auction.current = bid
+    auction.history.append(bid)
+    log.debug(
+        "deal %d: seat %d bids rank %d at %d",
+        state.hand_number,
+        bid.seat,
+        bid.rank,
+        bid.points,
+    )
+    if len(auction.active) == 1:
+        _finish_auction(state)
+        return
+    _advance_auction(state)
+
+
+def bid_rank(state: ChiamataState, sub: str, rank: int) -> None:
+    """Bid ``rank``; it must be weaker than the standing bid."""
+    auction, player = _require_auction(state, sub)
+    if rank not in _BID_INDEX:
+        raise IllegalMove(f"invalid rank: {rank!r}")
+    current = auction.current
+    if current is not None:
+        if current.rank == 2:
+            raise IllegalMove("the auction is at the 2: raise the points or pass")
+        if _BID_INDEX[rank] <= _BID_INDEX[current.rank]:
+            raise IllegalMove("a bid must call a lower rank than the standing bid")
+    _apply_bid(state, Bid(seat=player.seat, rank=rank, points=DEFAULT_TARGET))
+
+
+def bid_points(state: ChiamataState, sub: str, points: int) -> None:
+    """Raise the points target; only legal once the standing bid is the 2."""
+    auction, player = _require_auction(state, sub)
+    current = auction.current
+    if current is None or current.rank != 2:
+        raise IllegalMove("points can only be raised after a bid of the 2")
+    if points <= current.points:
+        raise IllegalMove(
+            f"the points must be higher than the standing bid ({current.points})"
+        )
+    if points > MAX_TARGET:
+        raise IllegalMove(f"the points must be at most {MAX_TARGET}")
+    _apply_bid(state, Bid(seat=player.seat, rank=2, points=points))
+
+
+def pass_auction(state: ChiamataState, sub: str) -> None:
+    """Leave the auction for good."""
+    auction, player = _require_auction(state, sub)
+    if player.seat not in auction.active:  # pragma: no cover - turn implies active
+        raise IllegalMove("you already passed")
+    if len(auction.active) == 1 and auction.current is None:
+        # Everyone else passed before any bid: the last player must bid.
+        raise IllegalMove("you must bid: everyone else has passed")
+    auction.active.remove(player.seat)
+    auction.passed.append(player.seat)
+    log.debug("deal %d: seat %d passes", state.hand_number, player.seat)
+    if len(auction.active) == 1 and auction.current is not None:
+        _finish_auction(state)
+        return
+    _advance_auction(state)
+
+
+# -- calling -------------------------------------------------------------------
+
+
+def call(state: ChiamataState, sub: str, card_code: str) -> None:
+    """The auction winner names the called card (any suit of the bid rank).
+
+    If the caller holds the named card they play alone; the card's suit
+    becomes the trump for the deal.
+    """
+    if state.phase == PHASE_FINISHED:
+        raise GameFinished("the match is over")
+    if state.phase != PHASE_CALLING:
+        raise GameNotStarted("no call is waiting")
+    caller = None if state.caller is None else _player_at(state, state.caller)
+    player = state.player_for(sub)
+    if player is None or caller is None or player.seat != caller.seat:
+        raise NotYourTurn("only the auction winner calls the card")
+    auction = state.auction
+    if auction is None or auction.current is None:  # pragma: no cover
+        raise GameNotStarted("no call is waiting")
+    card = parse_card(card_code)
+    if card.rank != auction.current.rank:
+        raise IllegalMove(
+            "the called card must match the rank won in the auction"
+        )
+    state.called_card = card
+    state.briscola_suit = card.suit
+    state.solo = card in caller.hand
+    state.phase = PHASE_PLAYING
+    # The player after the dealer opens the play, whichever seat won the
+    # auction.
+    first = (state.dealer + 1) % PLAYER_COUNT
+    state.turn = first
+    state.trick_leader = first
+    state.call_deadline = None
+    _set_turn_deadline(state)
+    log.debug(
+        "deal %d: seat %d calls %s%s",
+        state.hand_number,
+        caller.seat,
+        card.code,
+        " (playing alone)" if state.solo else "",
+    )
+
+
+# -- play ----------------------------------------------------------------------
+
+
+def play(state: ChiamataState, sub: str, card_code: str) -> None:
+    """Apply one move by the player identified by ``sub``.
+
+    Any card in hand is a legal play; only turn order and phase are
+    validated. Raises a :class:`~tavolo.platform.errors.GameError`
+    subclass on any violation.
+    """
+    if state.phase == PHASE_FINISHED:
+        raise GameFinished("the match is over")
+    if state.phase == PHASE_AUCTION:
+        raise IllegalMove("the auction is still open")
+    if state.phase == PHASE_CALLING:
+        raise IllegalMove("the called card has not been named yet")
+    if state.phase != PHASE_PLAYING:
+        raise GameNotStarted("the game has not started yet")
+
+    player = state.player_for(sub)
+    if player is None or player.seat != state.turn:
+        raise NotYourTurn("it is not your turn")
+
+    card = parse_card(card_code)
+    if card not in player.hand:
+        raise CardNotInHand(f"card {card.code} is not in your hand")
+
+    player.hand.remove(card)
+    if state.called_card is not None and card == state.called_card:
+        state.called_played = True
+        state.partner_seat = (
+            None if player.seat == state.caller else player.seat
+        )
+        log.info(
+            "deal %d: the called card %s was played by seat %d (%s)",
+            state.hand_number,
+            card.code,
+            player.seat,
+            "the caller plays alone" if state.partner_seat is None else "partner revealed",
+        )
+    state.trick.append(TrickCard(seat=player.seat, card=card.code))
+    log.debug(
+        "deal %d: seat %d played %s (%d/%d in the trick)",
+        state.hand_number,
+        player.seat,
+        card.code,
+        len(state.trick),
+        PLAYER_COUNT,
+    )
+
+    if len(state.trick) == PLAYER_COUNT:
+        _resolve_trick(state)
+    else:
+        state.turn = (state.turn + 1) % PLAYER_COUNT
+        _set_turn_deadline(state)
+
+
+def _resolve_trick(state: ChiamataState) -> None:
+    """Score the completed trick, draw no cards (deck already exhausted)."""
+    winner = _trick_winner(state)
+    taken = [parse_card(t.card) for t in state.trick]
+    _player_at(state, winner).captured.extend(taken)
+    state.last_trick = Trick(winner=winner, cards=list(state.trick))
+    state.trick = []
+    state.trick_leader = winner
+    state.turn = winner
+    log.debug(
+        "deal %d: seat %d takes the trick with %s",
+        state.hand_number,
+        winner,
+        [t.card for t in state.last_trick.cards],
+    )
+
+    if all(not player.hand for player in state.players):
+        _end_deal(state)
+        return
+    _set_turn_deadline(state)
+
+
+def _trick_winner(state: ChiamataState) -> int:
+    """The seat winning the current (complete) trick."""
+    played = [(t.seat, parse_card(t.card)) for t in state.trick]
+    leader_suit = played[0][1].suit
+    trumps = [
+        (seat, card)
+        for seat, card in played
+        if card.suit == state.briscola_suit
+    ]
+    pool = trumps or [
+        (seat, card) for seat, card in played if card.suit == leader_suit
+    ]
+    return max(pool, key=lambda item: TRICK_STRENGTH[item[1].rank])[0]
+
+
+# -- scoring -------------------------------------------------------------------
+
+
+def side_points(state: ChiamataState) -> Tuple[int, int]:
+    """The points captured by the calling side and the defenders.
+
+    The partner's pile only joins the caller's once the partner is known
+    (the called card has been played); until then this is only used to
+    score a finished deal, where the reveal has always happened.
+    """
+    if state.caller is None:
+        return (0, 0)
+    caller_seats = {state.caller}
+    if state.partner_seat is not None:
+        caller_seats.add(state.partner_seat)
+    caller_points = 0
+    defender_points = 0
+    for player in state.players:
+        points = sum(card_points(card) for card in player.captured)
+        if player.seat in caller_seats:
+            caller_points += points
+        else:
+            defender_points += points
+    return (caller_points, defender_points)
+
+
+def _end_deal(state: ChiamataState) -> None:
+    """Score the deal: finish the match, or replay after a patta.
+
+    A 60-60 deal with the plain 61 target is a patta: its points do not
+    count, the dealer rotates and the deal is replayed (a new auction).
+    Otherwise the calling side wins by reaching the declared target.
+    """
+    state.turn_deadline = None
+    caller_points, defender_points = side_points(state)
+    patta = (
+        state.declared_target == DEFAULT_TARGET
+        and caller_points == 60
+        and defender_points == 60
+    )
+    caller_name = (
+        _player_at(state, state.caller).name if state.caller is not None else None
+    )
+    caller_seats = {state.caller}
+    if state.partner_seat is not None:
+        caller_seats.add(state.partner_seat)
+    caller_cards = sum(
+        len(player.captured)
+        for player in state.players
+        if player.seat in caller_seats
+    )
+    entry: Dict[str, Any] = {
+        "deal": state.hand_number,
+        "patta": patta,
+        "points": {"A": caller_points, "B": defender_points},
+        "cards": {"A": caller_cards, "B": 40 - caller_cards},
+        "declared_target": state.declared_target,
+        "called_card": (
+            state.called_card.code if state.called_card is not None else None
+        ),
+        "caller": caller_name,
+        "solo": state.solo,
+    }
+    state.hand_scores.append(entry)
+    log.debug(
+        "deal %d scored caller %d - defenders %d%s (target %d)",
+        state.hand_number,
+        caller_points,
+        defender_points,
+        " patta" if patta else "",
+        state.declared_target,
+    )
+    if patta:
+        state.hand_number += 1
+        state.dealer = (state.dealer + 1) % PLAYER_COUNT
+        _deal(state)
+        return
+
+    state.scores = [caller_points, defender_points]
+    state.winner = (
+        SIDE_CALLER if caller_points >= state.declared_target else SIDE_DEFENDERS
+    )
+    state.phase = PHASE_FINISHED
+    log.info(
+        "match ended, %s win %d-%d",
+        SIDE_NAMES[state.winner],
+        caller_points,
+        defender_points,
+    )
+
+
+# -- server-side auto actions ---------------------------------------------------
+
+
+def auto_bid(state: ChiamataState, rng: Optional[random.Random] = None) -> None:
+    """Act for the bidder on turn: bid a random legal rank, else pass.
+
+    The only player who cannot afford to pass — the last one standing
+    before any bid — always has every rank available, so a bid is always
+    possible there.
+    """
+    if state.phase != PHASE_AUCTION:
+        raise GameNotStarted("the auction is not open")
+    auction = state.auction
+    if auction is None:  # pragma: no cover - guarded by phase
+        raise GameNotStarted("the auction is not open")
+    player = _player_at(state, auction.turn)
+    ranks = legal_bid_ranks(state)
+    if ranks:
+        chooser = rng or _rng
+        bid_rank(state, player.sub, chooser.choice(ranks))
+        return
+    pass_auction(state, player.sub)
+
+
+def auto_call(state: ChiamataState, rng: Optional[random.Random] = None) -> None:
+    """Name a random suit of the auction rank for the winner."""
+    if state.phase != PHASE_CALLING:
+        raise GameNotStarted("no call is waiting")
+    auction = state.auction
+    if auction is None or auction.current is None:  # pragma: no cover
+        raise GameNotStarted("no call is waiting")
+    caller = _player_at(state, state.caller) if state.caller is not None else None
+    if caller is None:  # pragma: no cover - guarded by phase
+        raise GameNotStarted("no call is waiting")
+    chooser = rng or _rng
+    card = Card(rank=auction.current.rank, suit=chooser.choice(SUITS))
+    call(state, caller.sub, card.code)
+
+
+def auto_play(state: ChiamataState, rng: Optional[random.Random] = None) -> None:
+    """Play a random card for the player currently on turn."""
+    if state.phase != PHASE_PLAYING:
+        raise GameNotStarted("the game has not started yet")
+    player = _player_at(state, state.turn)
+    if not player.hand:
+        raise IllegalMove("the player on turn has no cards")
+    chooser = rng or _rng
+    card = chooser.choice(player.hand)
+    play(state, player.sub, card.code)
+
+
+# -- views ---------------------------------------------------------------------
+
+
+def _roles_public(state: ChiamataState) -> bool:
+    return state.called_played
+
+
+def state_for_player(
+    state: ChiamataState, sub: Optional[str]
+) -> Dict[str, object]:
+    """Serialize ``state`` hiding other players' hands and secret roles.
+
+    Hands are reduced to a count, except for the requesting player's own
+    hand. The partner's role only appears once the called card has been
+    played; before that only the caller is labeled. The calling side's
+    running total is withheld until then too: it would let onlookers
+    deduce the partner's identity from who captured the points.
+    """
+    viewer = state.player_for(sub)
+    revealed = _roles_public(state)
+    players: List[Dict[str, object]] = []
+    for player in state.players:
+        role = ""
+        if state.caller is not None and player.seat == state.caller:
+            role = ROLE_CALLER
+        if revealed:
+            if state.partner_seat is not None and player.seat == state.partner_seat:
+                role = ROLE_PARTNER
+            elif player.seat != state.caller:
+                role = ROLE_DEFENDER
+        view: Dict[str, object] = {
+            "sub": player.sub,
+            "name": player.name,
+            "seat": player.seat,
+            "team": role,
+            "cards_left": len(player.hand),
+            "captured_count": len(player.captured),
+            "points": sum(card_points(card) for card in player.captured),
+        }
+        if viewer is not None and viewer.seat == player.seat:
+            view["hand"] = [c.code for c in player.hand]
+        players.append(view)
+
+    auction = state.auction
+    auction_view: Optional[Dict[str, object]] = None
+    if auction is not None:
+        auction_view = {
+            "turn": auction.turn,
+            "active": list(auction.active),
+            "passed": list(auction.passed),
+            "current": auction.current.to_json() if auction.current else None,
+            "history": [b.to_json() for b in auction.history],
+        }
+
+    payload: Dict[str, object] = {
+        "phase": state.phase,
+        "player_count": PLAYER_COUNT,
+        "dealer": state.dealer,
+        "hand_number": state.hand_number,
+        "turn": state.turn,
+        "auction": auction_view,
+        "caller": state.caller,
+        "called_card": (
+            state.called_card.code if state.called_card is not None else None
+        ),
+        "briscola_suit": state.briscola_suit,
+        "declared_target": state.declared_target,
+        "called_played": state.called_played,
+        "solo": state.solo if revealed else False,
+        "partner": (
+            state.partner_seat if revealed and state.partner_seat is not None else None
+        ),
+        "players": players,
+        "trick": [t.to_json() for t in state.trick],
+        "trick_leader": state.trick_leader,
+        "last_trick": state.last_trick.to_json() if state.last_trick else None,
+        "last_deal": state.hand_scores[-1] if state.hand_scores else None,
+        "auction_deadline": state.auction_deadline,
+        "call_deadline": state.call_deadline,
+        "turn_deadline": state.turn_deadline,
+        "winner": (
+            None if state.winner is None else SIDE_NAMES[state.winner]
+        ),
+    }
+    if revealed and state.caller is not None:
+        caller_points, defender_points = side_points(state)
+        payload["scores"] = {"A": caller_points, "B": defender_points}
+
+    if viewer is not None:
+        if state.phase == PHASE_AUCTION and auction is not None:
+            if auction.turn == viewer.seat:
+                payload["your_turn"] = True
+                payload["legal_bids"] = {
+                    "ranks": legal_bid_ranks(state),
+                    "points_min": legal_bid_points(state),
+                    "points_max": MAX_TARGET,
+                }
+        elif state.phase == PHASE_CALLING and state.caller == viewer.seat:
+            payload["your_turn"] = True
+            current = auction.current if auction is not None else None
+            if current is not None:
+                payload["callable_cards"] = [
+                    Card(rank=current.rank, suit=suit).code for suit in SUITS
+                ]
+        elif state.phase == PHASE_PLAYING and state.turn == viewer.seat:
+            payload["your_turn"] = True
+    return payload

server/packages/tavolo-briscola/src/tavolo/briscola/engine.py

@@ -0,0 +1,469 @@
+"""Pure rules engine for briscola.
+
+Every function here is deterministic and I/O-free (the only side effect is
+logging): it mutates (or reads)
+:class:`~tavolo.briscola.state.BriscolaState` and raises
+:class:`~tavolo.platform.errors.GameError` subclasses on rule violations.
+This makes the whole rule set unit-testable without Redis, Postgres or
+HTTP. The platform-facing adapter is
+:class:`~tavolo.briscola.plugin.BriscolaEngine`.
+
+Rules implemented
+-----------------
+* 40-card Italian deck (4 suits x ranks 1-10), three cards per player.
+* The next card after the deal is turned face up: its suit is the
+  **briscola** (trump) for the whole deal, and it is the last card drawn
+  from the stock (the stock is drawn from the bottom up).
+* Trick play: the player to the dealer's left leads; each other player
+  plays one card. The highest trump wins; when no trump was played, the
+  highest card of the led suit wins. The winner takes the trick and leads
+  the next one.
+* After each trick every player draws back up to three cards, starting
+  with the trick winner and continuing in turn order; the face-up
+  briscola card is drawn last, so whoever's turn to draw when only it
+  remains takes it.
+* Card points: ace 11, three 10, king 4, horse 3, jack 2, everything else
+  0 — 120 points per deal. Trick strength is unrelated to points:
+  ace > three > king > horse > jack > 7 > 6 > 5 > 4 > 2.
+* Match points accumulate across deals. A 60-60 deal is a **patta**: its
+  points are discarded and the deal is replayed (the dealer rotates).
+  The first team to reach the target score (default 61) wins; a tie at or
+  above the target is broken by another deal.
+* Between deals of an unfinished match the game pauses in the
+  ``hand_end`` phase for the deal summary, exactly like scopone: every
+  player acknowledges (or the hand-end timeout elapses) before the next
+  deal.
+"""
+from __future__ import annotations
+
+import random
+from datetime import datetime, timedelta, timezone
+from logging import getLogger
+from typing import Any, Dict, List, Optional, Tuple
+
+from tavolo.platform.errors import (
+    AlreadyJoined,
+    GameFinished,
+    GameNotStarted,
+    IllegalMove,
+    LobbyFull,
+    NotYourTurn,
+)
+
+from .errors import CardNotInHand
+
+from .state import (
+    DEFAULT_HAND_ACK_TIMEOUT_SECONDS,
+    DEFAULT_TARGET_SCORE,
+    DEFAULT_TURN_TIMEOUT_SECONDS,
+    HAND_SIZE,
+    MAX_TARGET_SCORE,
+    MIN_TARGET_SCORE,
+    PHASE_FINISHED,
+    PHASE_HAND_END,
+    PHASE_LOBBY,
+    PHASE_PLAYING,
+    PLAYER_COUNTS,
+    SUITS,
+    TEAM_NAMES,
+    BriscolaState,
+    Card,
+    PlayerState,
+    Trick,
+    TrickCard,
+    parse_card,
+)
+
+log = getLogger(__name__)
+
+# Trick strength: higher wins. Ace > three > king > horse > jack, then the
+# remaining ranks in descending order. All ranks are distinct within a
+# suit, so a trick never ties.
+TRICK_STRENGTH: Dict[int, int] = {
+    1: 9,
+    3: 8,
+    10: 7,
+    9: 6,
+    8: 5,
+    7: 4,
+    6: 3,
+    5: 2,
+    4: 1,
+    2: 0,
+}
+
+# Card points: 120 per deal in total.
+CARD_POINTS: Dict[int, int] = {
+    1: 11,
+    3: 10,
+    10: 4,
+    9: 3,
+    8: 2,
+}
+
+_rng = random.SystemRandom()
+
+
+def full_deck() -> List[Card]:
+    """Return the 40 cards of the Italian deck in canonical order."""
+    return [Card(rank=rank, suit=suit) for suit in SUITS for rank in range(1, 11)]
+
+
+def shuffled_deck(rng: Optional[random.Random] = None) -> List[Card]:
+    """Return a shuffled deck. Pass ``rng`` for deterministic tests."""
+    deck = full_deck()
+    (rng or _rng).shuffle(deck)
+    return deck
+
+
+def card_points(card: Card) -> int:
+    """The point value of a single card."""
+    return CARD_POINTS.get(card.rank, 0)
+
+
+def create_game(
+    creator_sub: str,
+    creator_name: str,
+    player_count: int = 2,
+    target_score: int = DEFAULT_TARGET_SCORE,
+    hand_ack_timeout: int = DEFAULT_HAND_ACK_TIMEOUT_SECONDS,
+    turn_timeout: int = DEFAULT_TURN_TIMEOUT_SECONDS,
+) -> BriscolaState:
+    """Create a lobby game with the creator seated first."""
+    if player_count not in PLAYER_COUNTS:
+        raise IllegalMove(f"player_count must be one of {PLAYER_COUNTS}")
+    if (
+        isinstance(target_score, bool)
+        or not isinstance(target_score, int)
+        or target_score < MIN_TARGET_SCORE
+        or target_score > MAX_TARGET_SCORE
+    ):
+        raise IllegalMove(
+            f"target_score must be between {MIN_TARGET_SCORE} and {MAX_TARGET_SCORE}"
+        )
+    return BriscolaState(
+        player_count=player_count,
+        target_score=target_score,
+        phase=PHASE_LOBBY,
+        players=[PlayerState(sub=creator_sub, name=creator_name, seat=0)],
+        hand_ack_timeout=hand_ack_timeout,
+        turn_timeout=turn_timeout,
+    )
+
+
+def join_game(state: BriscolaState, sub: str, name: str) -> None:
+    """Seat ``sub`` in the next free chair, starting the match when full."""
+    if state.phase != PHASE_LOBBY:
+        raise GameNotStarted("game has already started")
+    if state.seated(sub):
+        raise AlreadyJoined("already joined this game")
+    if len(state.players) >= state.player_count:
+        raise LobbyFull("game is full")
+    seat = len(state.players)
+    state.players.append(PlayerState(sub=sub, name=name, seat=seat))
+    if len(state.players) == state.player_count:
+        start_game(state)
+
+
+def start_game(state: BriscolaState) -> None:
+    """Deal the first hand and switch the game to playing."""
+    if len(state.players) != state.player_count:
+        raise GameNotStarted(
+            f"need exactly {state.player_count} players to start"
+        )
+    state.phase = PHASE_PLAYING
+    _deal(state)
+
+
+def _set_turn_deadline(state: BriscolaState) -> None:
+    """Arm the auto-play deadline for whoever is on turn."""
+    deadline = datetime.now(timezone.utc) + timedelta(seconds=state.turn_timeout)
+    state.turn_deadline = deadline.isoformat()
+
+
+def _deal(state: BriscolaState) -> None:
+    deck = shuffled_deck()
+    for player in state.players:
+        player.hand = []
+        player.captured = []
+    state.trick = []
+    state.last_trick = None
+    state.briscola_card = None
+    # Dealer rotates each deal; the first card is played by the player to
+    # the dealer's left.
+    state.turn = (state.dealer + 1) % state.player_count
+    state.trick_leader = state.turn
+    for _ in range(HAND_SIZE):
+        for offset in range(state.player_count):
+            player = _player_at(
+                state, (state.dealer + 1 + offset) % state.player_count
+            )
+            player.hand.append(deck.pop())
+    # The turned-up card is the last card drawn: keep it separate from the
+    # face-down stock and hand it out once the stock is exhausted.
+    state.briscola_card = deck.pop()
+    state.briscola_suit = state.briscola_card.suit
+    state.stock = deck
+    _set_turn_deadline(state)
+    log.debug(
+        "deal %d dealt (dealer seat %d, briscola %s)",
+        state.hand_number,
+        state.dealer,
+        state.briscola_card.code,
+    )
+
+
+def _player_at(state: BriscolaState, seat: int) -> PlayerState:
+    for player in state.players:
+        if player.seat == seat:
+            return player
+    raise IllegalMove(f"no player in seat {seat}")
+
+
+def play(state: BriscolaState, sub: str, card_code: str) -> None:
+    """Apply one move by the player identified by ``sub``.
+
+    Any card in hand is a legal play; only turn order and phase are
+    validated. Raises a :class:`~tavolo.platform.errors.GameError`
+    subclass on any violation.
+    """
+    if state.phase == PHASE_FINISHED:
+        raise GameFinished("the match is over")
+    if state.phase == PHASE_HAND_END:
+        raise IllegalMove("the deal is over; acknowledge the summary to continue")
+    if state.phase != PHASE_PLAYING:
+        raise GameNotStarted("the game has not started yet")
+
+    player = state.player_for(sub)
+    if player is None or player.seat != state.turn:
+        raise NotYourTurn("it is not your turn")
+
+    card = parse_card(card_code)
+    if card not in player.hand:
+        raise CardNotInHand(f"card {card.code} is not in your hand")
+
+    player.hand.remove(card)
+    state.trick.append(TrickCard(seat=player.seat, card=card.code))
+    log.debug(
+        "deal %d: seat %d played %s (%d/%d in the trick)",
+        state.hand_number,
+        player.seat,
+        card.code,
+        len(state.trick),
+        state.player_count,
+    )
+
+    if len(state.trick) == state.player_count:
+        _resolve_trick(state)
+    else:
+        state.turn = (state.turn + 1) % state.player_count
+        _set_turn_deadline(state)
+
+
+def _resolve_trick(state: BriscolaState) -> None:
+    """Score the completed trick, draw and hand the lead to the winner."""
+    winner = _trick_winner(state)
+    taken = [parse_card(t.card) for t in state.trick]
+    _player_at(state, winner).captured.extend(taken)
+    state.last_trick = Trick(winner=winner, cards=list(state.trick))
+    state.trick = []
+    state.trick_leader = winner
+    state.turn = winner
+    log.debug(
+        "deal %d: seat %d takes the trick with %s",
+        state.hand_number,
+        winner,
+        [t.card for t in state.last_trick.cards],
+    )
+
+    if all(not player.hand for player in state.players):
+        _end_deal(state)
+        return
+    _draw(state, winner)
+    _set_turn_deadline(state)
+
+
+def _trick_winner(state: BriscolaState) -> int:
+    """The seat winning the current (complete) trick."""
+    played = [(t.seat, parse_card(t.card)) for t in state.trick]
+    leader_suit = played[0][1].suit
+    trumps = [(seat, card) for seat, card in played if card.suit == state.briscola_suit]
+    pool = trumps or [
+        (seat, card) for seat, card in played if card.suit == leader_suit
+    ]
+    return max(pool, key=lambda item: TRICK_STRENGTH[item[1].rank])[0]
+
+
+def _draw(state: BriscolaState, winner: int) -> None:
+    """Draw back up to ``HAND_SIZE`` cards, winner first, then turn order."""
+    for offset in range(state.player_count):
+        player = _player_at(state, (winner + offset) % state.player_count)
+        if state.stock:
+            player.hand.append(state.stock.pop())
+        elif state.briscola_card is not None:
+            # The face-up briscola is the last card of the stock: the first
+            # player who needs a card when only it remains takes it.
+            player.hand.append(state.briscola_card)
+            state.briscola_card = None
+
+
+def auto_play(state: BriscolaState, rng: Optional[random.Random] = None) -> None:
+    """Play a random card for the player currently on turn.
+
+    Every card in hand is legal, so one is drawn at random. Delegates to
+    :func:`play`, so the move is fully validated and can end the deal or
+    the match. Pass ``rng`` for deterministic tests.
+    """
+    if state.phase != PHASE_PLAYING:
+        raise GameNotStarted("the game has not started yet")
+    player = _player_at(state, state.turn)
+    if not player.hand:
+        raise IllegalMove("the player on turn has no cards")
+    chooser = rng or _rng
+    card = chooser.choice(player.hand)
+    play(state, player.sub, card.code)
+
+
+def _end_deal(state: BriscolaState) -> None:
+    """Score the deal and either finish the match or pause for the summary.
+
+    A 60-60 deal is a patta: its points do not count and the deal is
+    replayed. If the match continues, the game pauses in the ``hand_end``
+    phase so every player can read the summary; the next deal is dealt by
+    :func:`acknowledge_hand` once all players have acknowledged (or by the
+    hand-end timeout fired by the platform's deadline scheduler).
+    """
+    state.turn_deadline = None
+    points, details = deal_points(state)
+    patta = points[0] == points[1]
+    if not patta:
+        state.scores[0] += points[0]
+        state.scores[1] += points[1]
+    entry: Dict[str, Any] = {
+        "deal": state.hand_number,
+        "patta": patta,
+        "points": details["points"],
+        "cards": details["cards"],
+        "totals": {"A": state.scores[0], "B": state.scores[1]},
+    }
+    state.hand_scores.append(entry)
+
+    a, b = state.scores
+    log.debug(
+        "deal %d scored A+%d B+%d%s (totals %d-%d)",
+        state.hand_number,
+        points[0],
+        points[1],
+        " patta" if patta else "",
+        a,
+        b,
+    )
+    if not patta and max(a, b) >= state.target_score and a != b:
+        state.phase = PHASE_FINISHED
+        state.winner = 0 if a > b else 1
+        log.info("match ended, team %s wins", TEAM_NAMES[state.winner])
+        return
+
+    # Pause for the deal summary instead of dealing immediately.
+    state.phase = PHASE_HAND_END
+    state.acked = []
+    deadline = datetime.now(timezone.utc) + timedelta(seconds=state.hand_ack_timeout)
+    state.hand_end_deadline = deadline.isoformat()
+
+
+def acknowledge_hand(state: BriscolaState, sub: str) -> None:
+    """Record that ``sub`` has read the deal summary.
+
+    When every player has acknowledged, the next deal is dealt.
+    Acknowledging twice is a no-op; acknowledging outside the ``hand_end``
+    phase raises an error.
+    """
+    if state.phase != PHASE_HAND_END:
+        raise IllegalMove("no deal summary is waiting for acknowledgement")
+    player = state.player_for(sub)
+    if player is None:
+        raise NotYourTurn("you are not seated in this game")
+    if player.seat in state.acked:
+        return
+    state.acked.append(player.seat)
+    if len(state.acked) < state.player_count:
+        return
+
+    state.hand_number += 1
+    state.dealer = (state.dealer + 1) % state.player_count
+    state.acked = []
+    state.hand_end_deadline = None
+    state.phase = PHASE_PLAYING
+    _deal(state)
+
+
+def deal_points(state: BriscolaState) -> Tuple[List[int], Dict[str, object]]:
+    """Compute the deal points for both teams (index 0 = team A)."""
+    piles: List[List[Card]] = [[], []]
+    for player in state.players:
+        piles[player.team].extend(player.captured)
+    points = [
+        sum(card_points(card) for card in pile) for pile in piles
+    ]
+    details: Dict[str, object] = {
+        "points": {"A": points[0], "B": points[1]},
+        "cards": {"A": len(piles[0]), "B": len(piles[1])},
+    }
+    return points, details
+
+
+def state_for_player(state: BriscolaState, sub: Optional[str]) -> Dict[str, object]:
+    """Serialize ``state`` hiding other players' hands.
+
+    Hands are reduced to a count, except for the requesting player's own
+    hand. Non-seated viewers — including spectators, for whom ``sub`` is
+    ``None`` — simply see no hand at all. The platform merges the session
+    envelope (``id``, ``join_code`` for seated players, ``game_type``,
+    ``spectator``) into the view itself.
+    """
+    viewer = state.player_for(sub)
+    players: List[Dict[str, object]] = []
+    for player in state.players:
+        view: Dict[str, object] = {
+            "sub": player.sub,
+            "name": player.name,
+            "seat": player.seat,
+            "team": TEAM_NAMES[player.team],
+            "cards_left": len(player.hand),
+            "captured_count": len(player.captured),
+            "points": sum(card_points(card) for card in player.captured),
+        }
+        if viewer is not None and viewer.seat == player.seat:
+            view["hand"] = [c.code for c in player.hand]
+        players.append(view)
+
+    payload: Dict[str, object] = {
+        "phase": state.phase,
+        "target_score": state.target_score,
+        "player_count": state.player_count,
+        "hand_number": state.hand_number,
+        "dealer": state.dealer,
+        "turn": state.turn,
+        "scores": {"A": state.scores[0], "B": state.scores[1]},
+        "winner": None if state.winner is None else TEAM_NAMES[state.winner],
+        "briscola_suit": state.briscola_suit,
+        "briscola_card": (
+            state.briscola_card.code if state.briscola_card is not None else None
+        ),
+        "stock_count": len(state.stock),
+        "trick": [t.to_json() for t in state.trick],
+        "trick_leader": state.trick_leader,
+        "last_trick": state.last_trick.to_json() if state.last_trick else None,
+        "players": players,
+        "last_deal": state.hand_scores[-1] if state.hand_scores else None,
+        "acknowledged": list(state.acked),
+        "hand_end_deadline": state.hand_end_deadline,
+        "turn_deadline": state.turn_deadline,
+    }
+    if (
+        viewer is not None
+        and state.phase == PHASE_PLAYING
+        and viewer.seat == state.turn
+    ):
+        payload["your_turn"] = True
+    return payload

server/packages/tavolo-briscola/src/tavolo/briscola/errors.py

@@ -0,0 +1,34 @@
+"""Briscola errors.
+
+Most failure modes are game-independent and live in
+:mod:`tavolo.platform.errors`; only genuinely briscola-specific errors
+are defined here.
+"""
+from __future__ import annotations
+
+from tavolo.platform.errors import (
+    AlreadyJoined,
+    GameError,
+    GameFinished,
+    GameNotFound,
+    GameNotStarted,
+    IllegalMove,
+    LobbyFull,
+    NotYourTurn,
+)
+
+__all__ = [
+    "AlreadyJoined",
+    "CardNotInHand",
+    "GameError",
+    "GameFinished",
+    "GameNotFound",
+    "GameNotStarted",
+    "IllegalMove",
+    "LobbyFull",
+    "NotYourTurn",
+]
+
+
+class CardNotInHand(GameError):
+    """The played card is not held by the player."""

server/packages/tavolo-briscola/src/tavolo/briscola/plugin.py

@@ -0,0 +1,580 @@
+"""The platform-facing adapter for briscola.
+
+Three :class:`~tavolo.platform.engine.GameEngine` implementations share
+one rules core (:mod:`tavolo.briscola.engine`, with the five-player
+variant in :mod:`tavolo.briscola.chiamata`): classic two-player
+:class:`BriscolaEngine`, four-player fixed-partnership
+:class:`BriscolaQuattroEngine` and five-player
+:class:`BriscolaChiamataEngine`. They translate platform calls (create,
+join, websocket actions, deadlines) into rules-engine calls and back,
+keeping all briscola knowledge inside this package. Nothing outside
+``tavolo.briscola`` needs to know about phases, tricks or deal scoring.
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from logging import getLogger
+from typing import Any, Dict, Mapping, Optional
+
+from tavolo.platform.engine import (
+    Deadline,
+    GameEngine,
+    GameSession,
+    MatchResult,
+    PlayerResult,
+    Seat,
+)
+from tavolo.platform.errors import GameError, IllegalMove
+
+from . import chiamata, engine
+from .chiamata import (
+    PHASE_AUCTION,
+    PHASE_CALLING,
+    ROLE_CALLER,
+    ROLE_DEFENDER,
+    ROLE_PARTNER,
+    SIDE_NAMES,
+    ChiamataPlayer,
+    ChiamataState,
+)
+from .engine import card_points
+from .state import (
+    DEFAULT_HAND_ACK_TIMEOUT_SECONDS,
+    DEFAULT_TARGET_SCORE,
+    DEFAULT_TURN_TIMEOUT_SECONDS,
+    MAX_TARGET_SCORE,
+    MIN_TARGET_SCORE,
+    PHASE_FINISHED,
+    PHASE_HAND_END,
+    PHASE_LOBBY,
+    PHASE_PLAYING,
+    TEAM_NAMES,
+    BriscolaState,
+)
+
+log = getLogger(__name__)
+
+
+def _deadline_ms(iso: Optional[str]) -> Optional[int]:
+    """Epoch milliseconds for an ISO-8601 deadline, ``None`` when absent
+    or unparseable."""
+    if not iso:
+        return None
+    try:
+        return int(datetime.fromisoformat(iso).timestamp() * 1000)
+    except ValueError:
+        return None
+
+
+class _BriscolaBase(GameEngine):
+    """Shared platform adapter for the two briscola table sizes."""
+
+    #: 2 (classic) or 4 (fixed partnerships); set by the subclasses.
+    player_count: int
+
+    options_schema = {
+        "type": "object",
+        "properties": {
+            "target_score": {
+                "type": "integer",
+                "minimum": MIN_TARGET_SCORE,
+                "maximum": MAX_TARGET_SCORE,
+                "default": DEFAULT_TARGET_SCORE,
+                "description": "Match points the winning team must reach.",
+            },
+        },
+    }
+
+    def __init__(
+        self,
+        turn_timeout_seconds: int = DEFAULT_TURN_TIMEOUT_SECONDS,
+        hand_ack_timeout_seconds: int = DEFAULT_HAND_ACK_TIMEOUT_SECONDS,
+    ) -> None:
+        self._turn_timeout = turn_timeout_seconds
+        self._hand_ack_timeout = hand_ack_timeout_seconds
+
+    # -- lobby ------------------------------------------------------------
+
+    def create(self, session: GameSession, options: Mapping[str, Any]) -> None:
+        target_score = options.get("target_score", DEFAULT_TARGET_SCORE)
+        if isinstance(target_score, bool) or not isinstance(target_score, int):
+            raise IllegalMove("target_score must be an integer")
+        creator = session.players[0]
+        session.state = engine.create_game(
+            creator_sub=creator.user_sub,
+            creator_name=creator.display_name,
+            player_count=self.player_count,
+            target_score=target_score,
+            hand_ack_timeout=self._hand_ack_timeout,
+            turn_timeout=self._turn_timeout,
+        )
+        # The creator takes seat 0, i.e. team A.
+        session.players[0] = Seat(
+            user_sub=creator.user_sub,
+            display_name=creator.display_name,
+            team=TEAM_NAMES[0],
+        )
+
+    def join(self, session: GameSession, user_sub: str, display_name: str) -> None:
+        seat = len(session.players)
+        engine.join_game(session.state, user_sub, display_name)
+        # join_game raises before appending on any violation, so the seat
+        # list stays in sync with the engine's players.
+        session.players.append(
+            Seat(
+                user_sub=user_sub,
+                display_name=display_name,
+                team=TEAM_NAMES[seat % 2],
+            )
+        )
+
+    def in_lobby(self, session: GameSession) -> bool:
+        return session.state.phase == PHASE_LOBBY
+
+    def lobby_view(self, session: GameSession) -> Dict[str, Any]:
+        state: BriscolaState = session.state
+        return {
+            "phase": state.phase,
+            "target_score": state.target_score,
+        }
+
+    # -- play -------------------------------------------------------------
+
+    def handle_action(
+        self, session: GameSession, user_sub: str, action: str, payload: Mapping[str, Any]
+    ) -> None:
+        state: BriscolaState = session.state
+        if action == "play":
+            card = payload.get("card")
+            if not isinstance(card, str):
+                raise IllegalMove("'card' must be a card code string")
+            try:
+                engine.play(state, user_sub, card)
+            except ValueError:
+                raise IllegalMove("invalid card code")
+        elif action == "ack":
+            engine.acknowledge_hand(state, user_sub)
+        else:
+            raise IllegalMove(f"unknown action: {action!r}")
+
+    def view_for(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
+        return engine.state_for_player(session.state, user_sub)
+
+    def is_finished(self, session: GameSession) -> bool:
+        return session.state.phase == PHASE_FINISHED
+
+    def game_over_view(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
+        state: BriscolaState = session.state
+        return {
+            "scores": {"A": state.scores[0], "B": state.scores[1]},
+            "winner": None if state.winner is None else TEAM_NAMES[state.winner],
+        }
+
+    # -- (de)serialization -------------------------------------------------
+
+    def state_to_json(self, state: Any) -> Dict[str, Any]:
+        assert isinstance(state, BriscolaState)
+        return state.to_json()
+
+    def state_from_json(self, data: Mapping[str, Any]) -> Any:
+        return BriscolaState.from_json(dict(data))
+
+    # -- deadlines ----------------------------------------------------------
+
+    def next_deadline(self, session: GameSession) -> Optional[Deadline]:
+        state: BriscolaState = session.state
+        if state.phase == PHASE_PLAYING and state.turn_deadline:
+            due_ms = _deadline_ms(state.turn_deadline)
+            if due_ms is None:
+                return None
+            return Deadline(
+                kind="turn",
+                due_at=datetime.fromtimestamp(due_ms / 1000, tz=timezone.utc),
+                token=f"turn:{state.hand_number}:{state.turn}:{due_ms}",
+            )
+        if state.phase == PHASE_HAND_END and state.hand_end_deadline:
+            due_ms = _deadline_ms(state.hand_end_deadline)
+            if due_ms is None:
+                return None
+            return Deadline(
+                kind="hand_end",
+                due_at=datetime.fromtimestamp(due_ms / 1000, tz=timezone.utc),
+                token=f"hand_end:{state.hand_number}:{due_ms}",
+            )
+        return None
+
+    def fire_deadline(self, session: GameSession, kind: str, token: str) -> None:
+        current = self.next_deadline(session)
+        if current is None or current.kind != kind or current.token != token:
+            # Overtaken by events (a play landed in time, the deal was
+            # acknowledged, the deadline moved): nothing to do.
+            raise GameError("stale deadline")
+        state: BriscolaState = session.state
+        if kind == "turn":
+            seat = state.turn
+            engine.auto_play(state)
+            log.info(
+                "auto-played for seat %s (turn timeout, deal %d)",
+                seat,
+                state.hand_number,
+            )
+        elif kind == "hand_end":
+            for player in state.players:
+                engine.acknowledge_hand(state, player.sub)
+            log.info(
+                "deal %d auto-advanced after the acknowledgement timeout",
+                state.hand_number,
+            )
+        else:  # pragma: no cover - next_deadline never emits other kinds
+            raise GameError(f"unknown deadline kind: {kind!r}")
+
+    # -- results -------------------------------------------------------------
+
+    def result(self, session: GameSession) -> MatchResult:
+        state: BriscolaState = session.state
+        if state.winner is None:
+            raise GameError("no result: the match is not finished")
+        teams = [
+            [p.sub for p in state.players if p.team == 0],
+            [p.sub for p in state.players if p.team == 1],
+        ]
+        return MatchResult(
+            teams=teams,
+            winner_team=state.winner,
+            players=[
+                PlayerResult(
+                    user_sub=player.sub,
+                    seat=player.seat,
+                    won=player.team == state.winner,
+                    team=TEAM_NAMES[player.team],
+                    score=float(state.scores[player.team]),
+                    details={"captured_cards": len(player.captured)},
+                )
+                for player in state.players
+            ],
+            summary={
+                "team_a_score": state.scores[0],
+                "team_b_score": state.scores[1],
+                "winner_team": TEAM_NAMES[state.winner],
+                "target_score": state.target_score,
+                "deals_played": state.hand_number,
+                "deal_scores": state.hand_scores,
+            },
+        )
+
+
+class BriscolaEngine(_BriscolaBase):
+    """Classic two-player briscola as a platform game engine."""
+
+    id = "briscola"
+    name = "Briscola"
+    description = (
+        "The classic two-player Italian trick-taking game: three cards "
+        "each, a trump suit and 120 points per deal. First to the target "
+        "score wins."
+    )
+    min_players = 2
+    max_players = 2
+    player_count = 2
+
+
+class BriscolaQuattroEngine(_BriscolaBase):
+    """Four-player fixed-partnership briscola as a platform game engine."""
+
+    id = "briscola_a_quattro"
+    name = "Briscola a quattro"
+    description = (
+        "Briscola played in two fixed partnerships of two, three cards "
+        "each and a trump suit. First team to the target score wins."
+    )
+    min_players = 4
+    max_players = 4
+    player_count = 4
+
+
+def _chiamata_player(state: ChiamataState, seat: int) -> ChiamataPlayer:
+    for player in state.players:
+        if player.seat == seat:
+            return player
+    raise GameError(f"no player in seat {seat}")
+
+
+class BriscolaChiamataEngine(GameEngine):
+    """Five-player briscola chiamata as a platform game engine.
+
+    One deal per match: the five players auction the call, the winner
+    names a card (playing alone when it is in their own hand) and the
+    calling side must reach the declared target (61 unless the auction
+    raised it). A 60-60 deal with the plain target is a patta and is
+    replayed. This keeps the match result a clean two-sided affair —
+    caller and secret partner against the other three, or the lone
+    caller against the other four — which the platform can rate,
+    persist and display like any other game.
+    """
+
+    id = "briscola_chiamata"
+    name = "Briscola chiamata"
+    description = (
+        "Five-player briscola with a descending auction: the winner calls "
+        "a card, whose holder becomes the secret partner (or, when the "
+        "caller holds it, the caller plays alone) and whose suit becomes "
+        "the trump. The calling side must reach 61 points; one deal per "
+        "match, replayed after a patta."
+    )
+    min_players = 5
+    max_players = 5
+
+    options_schema: Mapping[str, Any] = {}
+
+    def __init__(
+        self,
+        turn_timeout_seconds: int = DEFAULT_TURN_TIMEOUT_SECONDS,
+        hand_ack_timeout_seconds: int = DEFAULT_HAND_ACK_TIMEOUT_SECONDS,
+    ) -> None:
+        self._turn_timeout = turn_timeout_seconds
+        # A chiamata match is a single deal, so there is no between-deals
+        # acknowledgement phase to time out; the parameter is accepted
+        # for symmetry with the other briscola engines and wired by the
+        # application root.
+        self._hand_ack_timeout = hand_ack_timeout_seconds
+
+    # -- lobby ------------------------------------------------------------
+
+    def create(self, session: GameSession, options: Mapping[str, Any]) -> None:
+        creator = session.players[0]
+        session.state = chiamata.create_game(
+            creator_sub=creator.user_sub,
+            creator_name=creator.display_name,
+            turn_timeout=self._turn_timeout,
+        )
+
+    def join(self, session: GameSession, user_sub: str, display_name: str) -> None:
+        chiamata.join_game(session.state, user_sub, display_name)
+        session.players.append(
+            Seat(user_sub=user_sub, display_name=display_name)
+        )
+
+    def in_lobby(self, session: GameSession) -> bool:
+        return session.state.phase == PHASE_LOBBY
+
+    def lobby_view(self, session: GameSession) -> Dict[str, Any]:
+        state: ChiamataState = session.state
+        return {
+            "phase": state.phase,
+            "declared_target": state.declared_target,
+        }
+
+    # -- play -------------------------------------------------------------
+
+    def handle_action(
+        self, session: GameSession, user_sub: str, action: str, payload: Mapping[str, Any]
+    ) -> None:
+        state: ChiamataState = session.state
+        if action == "bid":
+            rank = payload.get("rank")
+            points = payload.get("points")
+            if rank is not None:
+                if isinstance(rank, bool) or not isinstance(rank, int):
+                    raise IllegalMove("'rank' must be an integer")
+                chiamata.bid_rank(state, user_sub, rank)
+            elif points is not None:
+                if isinstance(points, bool) or not isinstance(points, int):
+                    raise IllegalMove("'points' must be an integer")
+                chiamata.bid_points(state, user_sub, points)
+            else:
+                raise IllegalMove("a bid needs a 'rank' or a 'points' value")
+        elif action == "pass":
+            chiamata.pass_auction(state, user_sub)
+        elif action == "call":
+            card = payload.get("card")
+            if not isinstance(card, str):
+                raise IllegalMove("'card' must be a card code string")
+            try:
+                chiamata.call(state, user_sub, card)
+            except ValueError:
+                raise IllegalMove("invalid card code")
+        elif action == "play":
+            card = payload.get("card")
+            if not isinstance(card, str):
+                raise IllegalMove("'card' must be a card code string")
+            try:
+                chiamata.play(state, user_sub, card)
+            except ValueError:
+                raise IllegalMove("invalid card code")
+        else:
+            raise IllegalMove(f"unknown action: {action!r}")
+
+    def view_for(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
+        return chiamata.state_for_player(session.state, user_sub)
+
+    def is_finished(self, session: GameSession) -> bool:
+        return session.state.phase == PHASE_FINISHED
+
+    def game_over_view(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
+        state: ChiamataState = session.state
+        caller = (
+            _chiamata_player(state, state.caller) if state.caller is not None else None
+        )
+        partner = (
+            _chiamata_player(state, state.partner_seat)
+            if state.partner_seat is not None
+            else None
+        )
+        return {
+            "scores": {"A": state.scores[0], "B": state.scores[1]},
+            "winner": (
+                None if state.winner is None else SIDE_NAMES[state.winner]
+            ),
+            "declared_target": state.declared_target,
+            "called_card": (
+                state.called_card.code if state.called_card is not None else None
+            ),
+            "caller": None if caller is None else caller.name,
+            "partner": None if partner is None else partner.name,
+            "solo": state.solo,
+        }
+
+    # -- (de)serialization -------------------------------------------------
+
+    def state_to_json(self, state: Any) -> Dict[str, Any]:
+        assert isinstance(state, ChiamataState)
+        return state.to_json()
+
+    def state_from_json(self, data: Mapping[str, Any]) -> Any:
+        return ChiamataState.from_json(dict(data))
+
+    # -- deadlines ----------------------------------------------------------
+
+    def next_deadline(self, session: GameSession) -> Optional[Deadline]:
+        state: ChiamataState = session.state
+        if state.phase == PHASE_AUCTION and state.auction_deadline:
+            due_ms = _deadline_ms(state.auction_deadline)
+            if due_ms is None:
+                return None
+            return Deadline(
+                kind="auction",
+                due_at=datetime.fromtimestamp(due_ms / 1000, tz=timezone.utc),
+                token=f"auction:{state.hand_number}:{state.turn}:{due_ms}",
+            )
+        if state.phase == PHASE_CALLING and state.call_deadline:
+            due_ms = _deadline_ms(state.call_deadline)
+            if due_ms is None:
+                return None
+            return Deadline(
+                kind="call",
+                due_at=datetime.fromtimestamp(due_ms / 1000, tz=timezone.utc),
+                token=f"call:{state.hand_number}:{due_ms}",
+            )
+        if state.phase == PHASE_PLAYING and state.turn_deadline:
+            due_ms = _deadline_ms(state.turn_deadline)
+            if due_ms is None:
+                return None
+            return Deadline(
+                kind="turn",
+                due_at=datetime.fromtimestamp(due_ms / 1000, tz=timezone.utc),
+                token=f"turn:{state.hand_number}:{state.turn}:{due_ms}",
+            )
+        return None
+
+    def fire_deadline(self, session: GameSession, kind: str, token: str) -> None:
+        current = self.next_deadline(session)
+        if current is None or current.kind != kind or current.token != token:
+            # Overtaken by events (a bid, call or play landed in time):
+            # nothing to do.
+            raise GameError("stale deadline")
+        state: ChiamataState = session.state
+        if kind == "auction":
+            seat = state.turn
+            chiamata.auto_bid(state)
+            log.info(
+                "auto-bid for seat %s (auction timeout, deal %d)",
+                seat,
+                state.hand_number,
+            )
+        elif kind == "call":
+            caller = state.caller
+            chiamata.auto_call(state)
+            log.info(
+                "auto-called for seat %s (call timeout, deal %d)",
+                caller,
+                state.hand_number,
+            )
+        elif kind == "turn":
+            seat = state.turn
+            chiamata.auto_play(state)
+            log.info(
+                "auto-played for seat %s (turn timeout, deal %d)",
+                seat,
+                state.hand_number,
+            )
+        else:  # pragma: no cover - next_deadline never emits other kinds
+            raise GameError(f"unknown deadline kind: {kind!r}")
+
+    # -- results -------------------------------------------------------------
+
+    def result(self, session: GameSession) -> MatchResult:
+        state: ChiamataState = session.state
+        if state.winner is None:
+            raise GameError("no result: the match is not finished")
+        if state.caller is None:  # pragma: no cover - a winner implies a caller
+            raise GameError("no result: the caller is unknown")
+        caller = state.caller
+        partner = state.partner_seat
+        caller_seats = [caller] + ([partner] if partner is not None else [])
+        teams = [
+            [_chiamata_player(state, seat).sub for seat in caller_seats],
+            [
+                player.sub
+                for player in state.players
+                if player.seat not in caller_seats
+            ],
+        ]
+        caller_points, defender_points = chiamata.side_points(state)
+        side_scores = [caller_points, defender_points]
+        players = []
+        for player in state.players:
+            if player.seat == caller:
+                role = ROLE_CALLER
+                side = 0
+            elif partner is not None and player.seat == partner:
+                role = ROLE_PARTNER
+                side = 0
+            else:
+                role = ROLE_DEFENDER
+                side = 1
+            players.append(
+                PlayerResult(
+                    user_sub=player.sub,
+                    seat=player.seat,
+                    won=side == state.winner,
+                    team=role,
+                    score=float(side_scores[side]),
+                    details={
+                        "points": sum(card_points(card) for card in player.captured),
+                        "captured_cards": len(player.captured),
+                    },
+                )
+            )
+        return MatchResult(
+            teams=teams,
+            winner_team=state.winner,
+            players=players,
+            summary={
+                "team_a_score": caller_points,
+                "team_b_score": defender_points,
+                "winner_team": SIDE_NAMES[state.winner],
+                "declared_target": state.declared_target,
+                "called_card": (
+                    state.called_card.code if state.called_card is not None else None
+                ),
+                "caller": _chiamata_player(state, caller).name,
+                "partner": (
+                    _chiamata_player(state, partner).name
+                    if partner is not None
+                    else None
+                ),
+                "solo": state.solo,
+                "deals_played": state.hand_number,
+                "deal_scores": state.hand_scores,
+            },
+        )

server/packages/tavolo-briscola/src/tavolo/briscola/state.py

@@ -0,0 +1,279 @@
+"""In-memory representation of a briscola game.
+
+The whole mutable game lives in :class:`BriscolaState`, which is
+serialized to and from plain JSON for storage inside the platform's
+session envelope (see :mod:`tavolo.platform.store`). Keeping the
+representation JSON-native means the store needs no custom codecs and the
+state is inspectable with ``redis-cli``.
+
+The state contains only game data: the platform owns the session envelope
+(id, join code, seats, timestamps, stats persistence) — see
+:class:`tavolo.platform.engine.GameSession`.
+
+Deck convention: a 40-card Italian deck. Suits are ``D`` (denari),
+``C`` (coppe), ``S`` (spade) and ``B`` (bastoni); ranks are ``1``..``10``.
+A card is rendered as ``RRSUIT`` (e.g. ``07D``).
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional
+
+SUITS = ("D", "C", "S", "B")
+RANKS = tuple(range(1, 11))
+
+# Teams are derived from the seat: seats 0 and 2 form team A (index 0),
+# seats 1 and 3 form team B (index 1). In the two-player variant the teams
+# are simply the two players; in briscola a quattro the partners sit
+# opposite each other.
+TEAM_A = 0
+TEAM_B = 1
+TEAM_NAMES = ("A", "B")
+
+PHASE_LOBBY = "lobby"
+PHASE_PLAYING = "playing"
+# Between deals of an unfinished match: deal summary shown to every
+# player; the next deal is dealt once all players acknowledge (or the
+# hand-end timeout elapses).
+PHASE_HAND_END = "hand_end"
+PHASE_FINISHED = "finished"
+
+# Supported table sizes: classic head-to-head and four-player partnerships.
+PLAYER_COUNTS = (2, 4)
+
+DEFAULT_TARGET_SCORE = 61
+MIN_TARGET_SCORE = 61
+MAX_TARGET_SCORE = 120
+
+# Cards dealt to each player at the start of a deal.
+HAND_SIZE = 3
+
+# Default seconds the between-deals summary waits before dealing anyway.
+# Games carry their own copy in ``BriscolaState.hand_ack_timeout``.
+DEFAULT_HAND_ACK_TIMEOUT_SECONDS = 30
+
+# Default seconds a player has to play before the server plays a random
+# card for them. Games carry their own copy in
+# ``BriscolaState.turn_timeout``.
+DEFAULT_TURN_TIMEOUT_SECONDS = 30
+
+
+def team_of(seat: int) -> int:
+    return seat % 2
+
+
+@dataclass(frozen=True)
+class Card:
+    rank: int
+    suit: str
+
+    def __post_init__(self) -> None:
+        if self.suit not in SUITS:
+            raise ValueError(f"invalid suit: {self.suit!r}")
+        if self.rank not in RANKS:
+            raise ValueError(f"invalid rank: {self.rank!r}")
+
+    @property
+    def code(self) -> str:
+        return f"{self.rank:02d}{self.suit}"
+
+    @staticmethod
+    def parse(code: str) -> "Card":
+        code = str(code).upper()
+        if len(code) != 3 or not code[:2].isdigit():
+            raise ValueError(f"invalid card code: {code!r}")
+        return Card(rank=int(code[:2]), suit=code[2])
+
+    def to_json(self) -> str:
+        return self.code
+
+    @staticmethod
+    def from_json(value: Any) -> "Card":
+        return Card.parse(str(value))
+
+
+def parse_card(code: Any) -> Card:
+    """Parse a card code, raising :class:`ValueError` on malformed input."""
+    return Card.parse(str(code))
+
+
+@dataclass
+class TrickCard:
+    """One card played in the current trick, in play order."""
+
+    seat: int
+    card: str
+
+    def to_json(self) -> Dict[str, Any]:
+        return {"seat": self.seat, "card": self.card}
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "TrickCard":
+        return TrickCard(seat=int(data["seat"]), card=str(data["card"]))
+
+
+@dataclass
+class Trick:
+    """A completed trick: the winner's seat and the cards it captured."""
+
+    winner: int
+    cards: List[TrickCard] = field(default_factory=list)
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "winner": self.winner,
+            "cards": [c.to_json() for c in self.cards],
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "Trick":
+        return Trick(
+            winner=int(data["winner"]),
+            cards=[TrickCard.from_json(c) for c in data.get("cards", [])],
+        )
+
+
+@dataclass
+class PlayerState:
+    sub: str
+    name: str
+    seat: int
+    hand: List[Card] = field(default_factory=list)
+    captured: List[Card] = field(default_factory=list)
+
+    @property
+    def team(self) -> int:
+        return team_of(self.seat)
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "sub": self.sub,
+            "name": self.name,
+            "seat": self.seat,
+            "hand": [c.to_json() for c in self.hand],
+            "captured": [c.to_json() for c in self.captured],
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "PlayerState":
+        return PlayerState(
+            sub=str(data["sub"]),
+            name=str(data["name"]),
+            seat=int(data["seat"]),
+            hand=[Card.from_json(c) for c in data.get("hand", [])],
+            captured=[Card.from_json(c) for c in data.get("captured", [])],
+        )
+
+
+@dataclass
+class BriscolaState:
+    player_count: int = 2
+    target_score: int = DEFAULT_TARGET_SCORE
+    phase: str = PHASE_LOBBY
+    players: List[PlayerState] = field(default_factory=list)
+    # Face-down draw pile; cards are drawn from the end.
+    stock: List[Card] = field(default_factory=list)
+    # The face-up card turned at deal time: its suit is the trump suit for
+    # the whole deal, and it is the last card drawn from the stock.
+    briscola_card: Optional[Card] = None
+    briscola_suit: str = ""
+    dealer: int = 0
+    turn: int = 0
+    # 1-based deal counter, used in the audit trail and deadlines.
+    hand_number: int = 1
+    # Cards of the trick in progress, in play order.
+    trick: List[TrickCard] = field(default_factory=list)
+    trick_leader: int = 0
+    # The most recently completed trick, for the table announcement.
+    last_trick: Optional[Trick] = None
+    # Match points accumulated across deals (patta deals do not count).
+    scores: List[int] = field(default_factory=lambda: [0, 0])
+    winner: Optional[int] = None
+    # Per-deal points awarded, for a compact audit trail in the API.
+    hand_scores: List[Dict[str, Any]] = field(default_factory=list)
+    # While phase == "hand_end": seats that acknowledged the summary, and
+    # when the auto-continue timeout fires.
+    acked: List[int] = field(default_factory=list)
+    hand_end_deadline: Optional[str] = None
+    # Seconds the deal summary waits before dealing anyway.
+    hand_ack_timeout: int = DEFAULT_HAND_ACK_TIMEOUT_SECONDS
+    # While phase == "playing": when the server plays a random card for
+    # the player on turn.
+    turn_deadline: Optional[str] = None
+    turn_timeout: int = DEFAULT_TURN_TIMEOUT_SECONDS
+
+    # -- serialization ----------------------------------------------------
+
+    def to_json(self) -> Dict[str, Any]:
+        return {
+            "player_count": self.player_count,
+            "target_score": self.target_score,
+            "phase": self.phase,
+            "players": [p.to_json() for p in self.players],
+            "stock": [c.to_json() for c in self.stock],
+            "briscola_card": (
+                self.briscola_card.to_json() if self.briscola_card else None
+            ),
+            "briscola_suit": self.briscola_suit,
+            "dealer": self.dealer,
+            "turn": self.turn,
+            "hand_number": self.hand_number,
+            "trick": [t.to_json() for t in self.trick],
+            "trick_leader": self.trick_leader,
+            "last_trick": self.last_trick.to_json() if self.last_trick else None,
+            "scores": list(self.scores),
+            "winner": self.winner,
+            "hand_scores": list(self.hand_scores),
+            "acked": list(self.acked),
+            "hand_end_deadline": self.hand_end_deadline,
+            "hand_ack_timeout": self.hand_ack_timeout,
+            "turn_deadline": self.turn_deadline,
+            "turn_timeout": self.turn_timeout,
+        }
+
+    @staticmethod
+    def from_json(data: Dict[str, Any]) -> "BriscolaState":
+        return BriscolaState(
+            player_count=int(data.get("player_count", 2)),
+            target_score=int(data.get("target_score", DEFAULT_TARGET_SCORE)),
+            phase=str(data.get("phase", PHASE_LOBBY)),
+            players=[PlayerState.from_json(p) for p in data.get("players", [])],
+            stock=[Card.from_json(c) for c in data.get("stock", [])],
+            briscola_card=(
+                Card.from_json(data["briscola_card"])
+                if data.get("briscola_card")
+                else None
+            ),
+            briscola_suit=str(data.get("briscola_suit", "")),
+            dealer=int(data.get("dealer", 0)),
+            turn=int(data.get("turn", 0)),
+            hand_number=int(data.get("hand_number", 1)),
+            trick=[TrickCard.from_json(t) for t in data.get("trick", [])],
+            trick_leader=int(data.get("trick_leader", 0)),
+            last_trick=(
+                Trick.from_json(data["last_trick"]) if data.get("last_trick") else None
+            ),
+            scores=[int(x) for x in data.get("scores", [0, 0])],
+            winner=data.get("winner"),
+            hand_scores=list(data.get("hand_scores", [])),
+            acked=[int(s) for s in data.get("acked", [])],
+            hand_end_deadline=data.get("hand_end_deadline"),
+            hand_ack_timeout=int(
+                data.get("hand_ack_timeout", DEFAULT_HAND_ACK_TIMEOUT_SECONDS)
+            ),
+            turn_deadline=data.get("turn_deadline"),
+            turn_timeout=int(
+                data.get("turn_timeout", DEFAULT_TURN_TIMEOUT_SECONDS)
+            ),
+        )
+
+    # -- helpers ----------------------------------------------------------
+
+    def player_for(self, sub: Optional[str]) -> Optional[PlayerState]:
+        for player in self.players:
+            if player.sub == sub:
+                return player
+        return None
+
+    def seated(self, sub: str) -> bool:
+        return self.player_for(sub) is not None

server/packages/tavolo-briscola/tests/test_chiamata.py

@@ -0,0 +1,642 @@
+"""Rules tests for briscola chiamata: auction, call, play, scoring, patta."""
+from __future__ import annotations
+
+import random
+import unittest
+
+from tavolo.briscola import chiamata as rules
+from tavolo.briscola.chiamata import (
+    BID_LADDER,
+    Bid,
+    ChiamataPlayer,
+    ChiamataState,
+    PHASE_AUCTION,
+    PHASE_CALLING,
+    PHASE_FINISHED,
+    PHASE_PLAYING,
+    ROLE_CALLER,
+    ROLE_DEFENDER,
+    ROLE_PARTNER,
+    SIDE_CALLER,
+    SIDE_DEFENDERS,
+)
+from tavolo.briscola.errors import (
+    CardNotInHand,
+    GameFinished,
+    GameNotStarted,
+    IllegalMove,
+    NotYourTurn,
+)
+from tavolo.briscola.state import Card
+
+
+def card(code: str) -> Card:
+    return Card.parse(code)
+
+
+def started_state() -> ChiamataState:
+    """A five-player game whose auction has just opened (dealer seat 0)."""
+    state = rules.create_game("p0", "p0")
+    for i in range(1, 5):
+        rules.join_game(state, f"p{i}", f"p{i}")
+    return state
+
+
+def bid(state: ChiamataState, seat: int, rank: int) -> None:
+    rules.bid_rank(state, f"p{seat}", rank)
+
+
+def make_state(
+    hands,
+    *,
+    briscola_suit: str = "S",
+    called_card: str | None = None,
+    caller: int | None = None,
+    solo: bool = False,
+    called_played: bool = False,
+    partner_seat: int | None = None,
+    captured=None,
+    turn: int = 0,
+    dealer: int = 0,
+    declared_target: int = rules.DEFAULT_TARGET,
+    phase: str = PHASE_PLAYING,
+    hand_number: int = 1,
+) -> ChiamataState:
+    """Build a controlled playing state directly (bypassing the auction)."""
+    state = ChiamataState(
+        phase=phase,
+        dealer=dealer,
+        hand_number=hand_number,
+        declared_target=declared_target,
+        briscola_suit=briscola_suit,
+        called_card=card(called_card) if called_card else None,
+        caller=caller,
+        solo=solo,
+        called_played=called_played,
+        partner_seat=partner_seat,
+        turn=turn,
+    )
+    for seat, hand in enumerate(hands):
+        state.players.append(
+            ChiamataPlayer(
+                sub=f"p{seat}", name=f"p{seat}", seat=seat,
+                hand=[card(c) for c in hand],
+            )
+        )
+    if captured is not None:
+        for player, codes in zip(state.players, captured):
+            player.captured = [card(c) for c in codes]
+    return state
+
+
+def play_all(state: ChiamataState) -> None:
+    """Play the first card of each hand in turn order until the trick resolves."""
+    for _ in range(rules.PLAYER_COUNT):
+        player = next(p for p in state.players if p.seat == state.turn)
+        rules.play(state, player.sub, player.hand[0].code)
+
+
+class SetupTest(unittest.TestCase):
+    def test_five_player_deal(self) -> None:
+        state = started_state()
+        self.assertEqual(PHASE_AUCTION, state.phase)
+        self.assertEqual(rules.PLAYER_COUNT, len(state.players))
+        for player in state.players:
+            self.assertEqual(rules.HAND_SIZE, len(player.hand))
+        # The whole deck is dealt: no stock, no face-up card.
+        dealt = [c.code for p in state.players for c in p.hand]
+        self.assertEqual(40, len(dealt))
+        self.assertEqual(40, len(set(dealt)))
+        # The auction opens with the player after the dealer.
+        assert state.auction is not None
+        self.assertEqual(1, state.auction.turn)
+        self.assertEqual([0, 1, 2, 3, 4], state.auction.active)
+        self.assertIsNone(state.auction.current)
+
+    def test_join_errors(self) -> None:
+        from tavolo.platform.errors import AlreadyJoined, GameNotStarted, LobbyFull
+
+        state = rules.create_game("p0", "p0")
+        with self.assertRaises(AlreadyJoined):
+            rules.join_game(state, "p0", "p0")
+        for i in range(1, 5):
+            rules.join_game(state, f"p{i}", f"p{i}")
+        self.assertEqual(PHASE_AUCTION, state.phase)
+        with self.assertRaises(GameNotStarted):
+            rules.join_game(state, "p5", "p5")
+
+        lobby = rules.create_game("p0", "p0")
+        for i in range(1, 5):
+            rules.join_game(lobby, f"p{i}", f"p{i}")
+        # Joining a sixth player is impossible once the fifth started the
+        # match; exercise LobbyFull on an artificially unfilled start.
+        unfilled = rules.create_game("p0", "p0")
+        unfilled.phase = rules.PHASE_LOBBY
+        for i in range(1, 5):
+            unfilled.players.append(
+                ChiamataPlayer(sub=f"p{i}", name=f"p{i}", seat=i)
+            )
+        with self.assertRaises(LobbyFull):
+            rules.join_game(unfilled, "p5", "p5")
+
+
+class AuctionTest(unittest.TestCase):
+    def test_first_bid_accepts_any_rank(self) -> None:
+        state = started_state()
+        rules.bid_rank(state, "p1", 5)
+        assert state.auction is not None
+        self.assertEqual(Bid(seat=1, rank=5, points=61), state.auction.current)
+
+    def test_bids_must_descend(self) -> None:
+        state = started_state()
+        bid(state, 1, 1)  # ace
+        with self.assertRaises(IllegalMove):
+            bid(state, 2, 1)  # same rank
+        bid(state, 2, 3)  # three, weaker than the ace
+        bid(state, 3, 10)  # king, weaker than the three
+        with self.assertRaises(IllegalMove):
+            bid(state, 4, 3)  # three is stronger than the king
+        bid(state, 4, 9)  # horse
+
+    def test_bid_ladder_ordering(self) -> None:
+        # A bid must be weaker than the standing bid: descending strength
+        # follows A > 3 > K > H > J > 7 > 6 > 5 > 4 > 2.
+        state = started_state()
+        bid(state, 1, 10)  # king
+        for opponent, rank in ((2, 9), (3, 8), (4, 7), (0, 6)):
+            rules.bid_rank(state, f"p{opponent}", rank)
+        # 3 and A are stronger than 6: rejected.
+        with self.assertRaises(IllegalMove):
+            rules.bid_rank(state, "p1", 3)
+        with self.assertRaises(IllegalMove):
+            rules.bid_rank(state, "p1", 1)
+        rules.bid_rank(state, "p1", 5)
+
+    def test_not_your_turn(self) -> None:
+        state = started_state()
+        with self.assertRaises(NotYourTurn):
+            bid(state, 2, 1)
+
+    def test_pass_eliminates_and_last_standing_bids(self) -> None:
+        state = started_state()
+        for seat in (1, 2, 3, 4):
+            rules.pass_auction(state, f"p{seat}")
+        assert state.auction is not None
+        # Only seat 0 remains and nobody has bid: it must bid.
+        self.assertEqual([0], state.auction.active)
+        with self.assertRaises(IllegalMove):
+            rules.pass_auction(state, "p0")
+        rules.bid_rank(state, "p0", 2)
+        self.assertEqual(PHASE_CALLING, state.phase)
+        self.assertEqual(0, state.caller)
+        self.assertEqual(61, state.declared_target)
+
+    def test_auction_ends_when_one_bidder_remains(self) -> None:
+        state = started_state()
+        bid(state, 1, 1)  # ace
+        rules.pass_auction(state, "p2")
+        bid(state, 3, 10)  # king
+        rules.pass_auction(state, "p4")
+        rules.pass_auction(state, "p0")
+        rules.pass_auction(state, "p1")
+        self.assertEqual(PHASE_CALLING, state.phase)
+        self.assertEqual(3, state.caller)
+        self.assertEqual(61, state.declared_target)
+
+    def test_point_raises_only_after_the_two(self) -> None:
+        state = started_state()
+        bid(state, 1, 1)
+        with self.assertRaises(IllegalMove):
+            rules.bid_points(state, "p2", 62)
+        bid(state, 2, 2)
+        with self.assertRaises(IllegalMove):
+            rules.bid_rank(state, "p3", 2)  # no ranks below the 2
+        with self.assertRaises(IllegalMove):
+            rules.bid_points(state, "p3", 61)  # not higher
+        with self.assertRaises(IllegalMove):
+            rules.bid_points(state, "p3", 121)  # above the cap
+        rules.bid_points(state, "p3", 63)
+        assert state.auction is not None
+        self.assertEqual(Bid(seat=3, rank=2, points=63), state.auction.current)
+
+    def test_legal_bids_exposed_to_the_bidder_only(self) -> None:
+        state = started_state()
+        bid(state, 1, 10)  # king
+        view = rules.state_for_player(state, "p2")
+        self.assertTrue(view["your_turn"])
+        legal = view["legal_bids"]
+        self.assertEqual([9, 8, 7, 6, 5, 4, 2], legal["ranks"])
+        self.assertIsNone(legal["points_min"])
+        # A player who is not on turn gets no legal bids.
+        other = rules.state_for_player(state, "p3")
+        self.assertNotIn("legal_bids", other)
+        self.assertNotIn("your_turn", other)
+
+    def test_legal_points_exposed_at_the_two(self) -> None:
+        state = started_state()
+        bid(state, 1, 2)
+        view = rules.state_for_player(state, "p2")
+        self.assertEqual([], view["legal_bids"]["ranks"])
+        self.assertEqual(63, view["legal_bids"]["points_min"])
+        self.assertEqual(120, view["legal_bids"]["points_max"])
+
+    def test_auto_bid_bids_or_passes(self) -> None:
+        state = started_state()
+        rules.auto_bid(state, random.Random(1))
+        assert state.auction is not None
+        self.assertIsNotNone(state.auction.current)
+        # The auction keeps moving and eventually concludes.
+        for _ in range(50):
+            if state.phase != PHASE_AUCTION:
+                break
+            rules.auto_bid(state, random.Random(2))
+        self.assertEqual(PHASE_CALLING, state.phase)
+        self.assertIsNotNone(state.caller)
+
+
+class CallTest(unittest.TestCase):
+    def _called_state(self, rank: int = 1) -> ChiamataState:
+        state = started_state()
+        bid(state, 1, rank)
+        for seat in (2, 3, 4, 0):
+            rules.pass_auction(state, f"p{seat}")
+        return state
+
+    def test_call_must_match_the_winning_rank(self) -> None:
+        state = self._called_state(1)
+        with self.assertRaises(IllegalMove):
+            rules.call(state, "p1", "03D")
+        # Any suit of the winning rank is fine.
+        rules.call(state, "p1", "01D")
+        self.assertEqual("D", state.briscola_suit)
+        self.assertEqual(PHASE_PLAYING, state.phase)
+
+    def test_only_the_winner_calls(self) -> None:
+        state = self._called_state()
+        with self.assertRaises(NotYourTurn):
+            rules.call(state, "p2", "01D")
+
+    def test_call_in_hand_means_playing_alone(self) -> None:
+        state = self._called_state(1)
+        # Seat 1 calls a card it holds: solo.
+        state.players[1].hand[0] = card("01S")
+        rules.call(state, "p1", "01S")
+        self.assertTrue(state.solo)
+        self.assertIsNone(state.partner_seat)
+
+    def test_play_starts_with_the_player_after_the_dealer(self) -> None:
+        state = self._called_state(1)
+        rules.call(state, "p1", "01D")
+        self.assertEqual(1, state.turn)
+        self.assertNotEqual(state.caller, None)
+
+    def test_auto_call_names_the_bid_rank(self) -> None:
+        state = self._called_state(10)
+        rules.auto_call(state, random.Random(3))
+        assert state.called_card is not None
+        self.assertEqual(10, state.called_card.rank)
+        self.assertEqual(PHASE_PLAYING, state.phase)
+
+    def test_calling_phase_view(self) -> None:
+        state = self._called_state(1)
+        view = rules.state_for_player(state, "p1")
+        self.assertEqual(PHASE_CALLING, view["phase"])
+        self.assertTrue(view["your_turn"])
+        self.assertEqual(
+            ["01D", "01C", "01S", "01B"], view["callable_cards"]
+        )
+        other = rules.state_for_player(state, "p2")
+        self.assertNotIn("callable_cards", other)
+
+
+class PlayTest(unittest.TestCase):
+    def test_five_player_trick_resolution(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"], ["06D"]],
+            briscola_suit="S",
+            caller=0,
+            called_card="01D",
+            called_played=True,
+            partner_seat=4,
+            turn=0,
+        )
+        play_all(state)
+        assert state.last_trick is not None
+        self.assertEqual(3, state.last_trick.winner)
+
+    def test_trump_wins(self) -> None:
+        state = make_state(
+            [["02D"], ["01D"], ["04D"], ["02C"], ["03D"]],
+            briscola_suit="C",
+            caller=0,
+            called_card="01D",
+            called_played=True,
+            partner_seat=4,
+            turn=0,
+        )
+        play_all(state)
+        assert state.last_trick is not None
+        self.assertEqual(3, state.last_trick.winner)
+
+    def test_called_card_reveals_the_partner(self) -> None:
+        state = make_state(
+            [["02D"], ["01D"], ["04D"], ["07D"], ["06D"]],
+            briscola_suit="D",
+            caller=0,
+            called_card="01S",
+            turn=1,
+        )
+        self.assertFalse(state.called_played)
+        view = rules.state_for_player(state, "p2")
+        roles = {p["seat"]: p["team"] for p in view["players"]}
+        self.assertEqual(ROLE_CALLER, roles[0])
+        self.assertNotIn("scores", view)
+        rules.play(state, "p1", "01D")
+        # The called card has not been played yet.
+        self.assertFalse(state.called_played)
+        # Drive the trick until the called card appears: give it to seat 3.
+        state.players[3].hand = [card("01S")]
+        state.turn = 3
+        rules.play(state, "p3", "01S")
+        self.assertTrue(state.called_played)
+        self.assertEqual(3, state.partner_seat)
+        view = rules.state_for_player(state, "p2")
+        roles = {p["seat"]: p["team"] for p in view["players"]}
+        self.assertEqual(ROLE_CALLER, roles[0])
+        self.assertEqual(ROLE_PARTNER, roles[3])
+        self.assertEqual(ROLE_DEFENDER, roles[1])
+        self.assertIn("scores", view)
+
+    def test_called_card_played_by_the_caller_is_solo(self) -> None:
+        state = make_state(
+            [["01S", "02D"], ["04D"], ["07D"], ["06D"], ["05D"]],
+            briscola_suit="S",
+            caller=0,
+            called_card="01S",
+            solo=True,
+            turn=0,
+        )
+        rules.play(state, "p0", "01S")
+        self.assertTrue(state.called_played)
+        self.assertIsNone(state.partner_seat)
+        view = rules.state_for_player(state, "p4")
+        self.assertTrue(view["solo"])
+        roles = {p["seat"]: p["team"] for p in view["players"]}
+        self.assertEqual(ROLE_CALLER, roles[0])
+        self.assertEqual(ROLE_DEFENDER, roles[1])
+
+    def test_play_validations(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"], ["06D"]],
+            briscola_suit="S",
+            caller=0,
+            turn=0,
+        )
+        with self.assertRaises(NotYourTurn):
+            rules.play(state, "p1", "05D")
+        with self.assertRaises(CardNotInHand):
+            rules.play(state, "p0", "01D")
+        state.phase = PHASE_FINISHED
+        with self.assertRaises(GameFinished):
+            rules.play(state, "p0", "02D")
+
+    def test_play_rejected_before_the_call(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"], ["06D"]],
+            caller=0,
+            turn=0,
+            phase=PHASE_CALLING,
+        )
+        with self.assertRaises(IllegalMove):
+            rules.play(state, "p0", "02D")
+
+    def test_auto_play_advances(self) -> None:
+        state = make_state(
+            [["02D", "03C"], ["05D"], ["04D"], ["07D"], ["06D"]],
+            briscola_suit="S",
+            caller=0,
+            called_card="09B",
+            turn=0,
+        )
+        rules.auto_play(state, random.Random(7))
+        self.assertEqual(1, state.turn)
+        self.assertEqual(1, len(state.trick))
+        self.assertEqual(1, len(state.players[0].hand))
+
+
+class ScoringTest(unittest.TestCase):
+    def _piles(self):
+        # 60 points in denari + coppe, 60 in spade + bastoni.
+        a_cards = [f"{rank:02d}D" for rank in (1, 3, 10, 9, 8)] + [
+            f"{rank:02d}C" for rank in (1, 3, 10, 9, 8)
+        ]
+        b_cards = [f"{rank:02d}S" for rank in (1, 3, 10, 9, 8)] + [
+            f"{rank:02d}B" for rank in (1, 3, 10, 9, 8)
+        ]
+        return a_cards, b_cards
+
+    def test_side_points_split_caller_side_and_defenders(self) -> None:
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            partner_seat=3,
+            called_played=True,
+            captured=[
+                ["01D"],          # caller, side A: 11
+                ["03C", "01S"],   # defender: 21
+                ["10D"],          # defender: 4
+                ["01C"],          # partner, side A: 11
+                ["03S"],          # defender: 10
+            ],
+        )
+        caller_points, defender_points = rules.side_points(state)
+        self.assertEqual(22, caller_points)
+        self.assertEqual(35, defender_points)
+
+    def test_solo_side_points(self) -> None:
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            solo=True,
+            called_played=True,
+            captured=[["01D"], ["01C"], ["03D"], ["03C"], ["10D"]],
+        )
+        caller_points, defender_points = rules.side_points(state)
+        self.assertEqual(11, caller_points)
+        self.assertEqual(35, defender_points)
+
+    def test_calling_side_wins_at_the_target(self) -> None:
+        a_cards, b_cards = self._piles()
+        b_rest = [c for c in b_cards if c != "01S"]
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            partner_seat=1,
+            called_played=True,
+            captured=[a_cards, ["01S"], [], b_rest, []],
+        )
+        rules._end_deal(state)
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertEqual(SIDE_CALLER, state.winner)
+        self.assertEqual([71, 49], state.scores)
+
+    def test_defenders_win_below_the_declared_target(self) -> None:
+        a_cards, b_cards = self._piles()
+        # Calling side only 30 points of the 61 needed.
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            partner_seat=1,
+            called_played=True,
+            captured=[a_cards[:5], [], [], b_cards, []],
+        )
+        rules._end_deal(state)
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertEqual(SIDE_DEFENDERS, state.winner)
+        self.assertEqual([30, 60], state.scores)
+
+    def test_patta_replays_the_deal_with_a_new_auction(self) -> None:
+        a_cards, b_cards = self._piles()
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            partner_seat=1,
+            called_played=True,
+            captured=[a_cards, [], [], b_cards, []],
+        )
+        rules._end_deal(state)
+        self.assertEqual(PHASE_AUCTION, state.phase)
+        self.assertEqual(2, state.hand_number)
+        self.assertEqual(1, state.dealer)
+        assert state.auction is not None
+        self.assertEqual(2, state.auction.turn)
+        self.assertIsNone(state.caller)
+        self.assertIsNone(state.called_card)
+        # The patta entry is kept in the audit trail.
+        entry = state.hand_scores[-1]
+        self.assertTrue(entry["patta"])
+        self.assertEqual({"A": 60, "B": 60}, entry["points"])
+
+    def test_raised_target_disables_patta(self) -> None:
+        a_cards, b_cards = self._piles()
+        state = make_state(
+            [[], [], [], [], []],
+            briscola_suit="D",
+            caller=0,
+            partner_seat=1,
+            called_played=True,
+            declared_target=62,
+            captured=[a_cards, [], [], b_cards, []],
+        )
+        rules._end_deal(state)
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertEqual(SIDE_DEFENDERS, state.winner)
+
+    def test_full_deal_scores_120(self) -> None:
+        state = started_state()
+        rng = random.Random(2026)
+        moves = 0
+        while state.phase != PHASE_FINISHED and moves < 5000:
+            if state.phase == PHASE_AUCTION:
+                rules.auto_bid(state, rng)
+            elif state.phase == PHASE_CALLING:
+                rules.auto_call(state, rng)
+            else:
+                rules.auto_play(state, rng)
+            moves += 1
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertEqual(120, sum(state.scores))
+        self.assertIn(state.winner, (SIDE_CALLER, SIDE_DEFENDERS))
+        captured = sum(len(p.captured) for p in state.players)
+        self.assertEqual(40, captured)
+
+
+class ViewTest(unittest.TestCase):
+    def test_state_for_player_hides_other_hands(self) -> None:
+        state = make_state(
+            [["02D", "03C"], ["04D"], ["05D"], ["06D"], ["07D"]],
+            briscola_suit="D",
+            caller=0,
+            called_card="01D",
+            called_played=False,
+            turn=0,
+        )
+        view = rules.state_for_player(state, "p0")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertEqual(["02D", "03C"], players[0]["hand"])
+        self.assertNotIn("hand", players[1])
+        self.assertEqual(1, players[1]["cards_left"])
+        self.assertEqual("01D", view["called_card"])
+        self.assertEqual(5, view["player_count"])
+
+    def test_spectator_sees_public_information_only(self) -> None:
+        state = make_state(
+            [["02D"], ["04D"], ["05D"], ["06D"], ["07D"]],
+            briscola_suit="D",
+            caller=2,
+            called_card="01D",
+            called_played=False,
+        )
+        view = rules.state_for_player(state, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+        self.assertNotIn("scores", view)
+        roles = {p["seat"]: p["team"] for p in view["players"]}
+        self.assertEqual(ROLE_CALLER, roles[2])
+        self.assertEqual("", roles[0])
+
+    def test_player_points_are_public(self) -> None:
+        state = make_state(
+            [["02D"], ["04D"], ["05D"], ["06D"], ["07D"]],
+            briscola_suit="D",
+            caller=0,
+            captured=[["01C", "03B"], ["10D"], [], [], []],
+        )
+        view = rules.state_for_player(state, "p0")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertEqual(21, players[0]["points"])
+        self.assertEqual(4, players[1]["points"])
+        self.assertEqual(2, players[0]["captured_count"])
+
+
+class SerializationTest(unittest.TestCase):
+    def test_state_roundtrip(self) -> None:
+        state = started_state()
+        bid(state, 1, 10)
+        bid(state, 2, 7)
+        restored = ChiamataState.from_json(state.to_json())
+        self.assertEqual(state.phase, restored.phase)
+        self.assertEqual(state.hand_number, restored.hand_number)
+        self.assertEqual(state.turn, restored.turn)
+        assert restored.auction is not None and state.auction is not None
+        self.assertEqual(state.auction.active, restored.auction.active)
+        self.assertEqual(state.auction.passed, restored.auction.passed)
+        self.assertEqual(
+            state.auction.history, restored.auction.history
+        )
+        self.assertEqual(
+            [[c.code for c in p.hand] for p in state.players],
+            [[c.code for c in p.hand] for p in restored.players],
+        )
+
+    def test_legacy_state_defaults(self) -> None:
+        state = started_state()
+        data = state.to_json()
+        del data["auction"]
+        del data["called_card"]
+        del data["declared_target"]
+        restored = ChiamataState.from_json(data)
+        self.assertIsNone(restored.auction)
+        self.assertIsNone(restored.called_card)
+        self.assertEqual(rules.DEFAULT_TARGET, restored.declared_target)
+        self.assertFalse(restored.solo)
+
+
+if __name__ == "__main__":
+    unittest.main()

server/packages/tavolo-briscola/tests/test_chiamata_plugin.py

@@ -0,0 +1,421 @@
+"""Adapter tests: the platform contract over the briscola chiamata rules."""
+from __future__ import annotations
+
+import unittest
+from datetime import datetime, timedelta, timezone
+
+from tavolo.briscola import BriscolaChiamataEngine
+from tavolo.briscola import chiamata as rules
+from tavolo.briscola.chiamata import (
+    PHASE_AUCTION,
+    PHASE_CALLING,
+    PHASE_FINISHED,
+    PHASE_LOBBY,
+    PHASE_PLAYING,
+    ROLE_CALLER,
+    ROLE_DEFENDER,
+    ROLE_PARTNER,
+    ChiamataState,
+)
+from tavolo.briscola.state import Card
+from tavolo.platform import GameSession, Seat
+from tavolo.platform.errors import (
+    AlreadyJoined,
+    GameError,
+    GameNotStarted,
+    IllegalMove,
+)
+
+
+def _session(engine, **options) -> GameSession:
+    session = GameSession(
+        id="c1",
+        game_type=engine.id,
+        join_code="CODE01",
+        creator_sub="p0",
+        players=[Seat(user_sub="p0", display_name="P0")],
+    )
+    engine.create(session, options)
+    return session
+
+
+def _started(engine, **options) -> GameSession:
+    session = _session(engine, **options)
+    for i in range(1, engine.max_players):
+        engine.join(session, f"p{i}", f"P{i}")
+    return session
+
+
+def _player_on_turn(session: GameSession):
+    state = session.state
+    return next(p for p in state.players if p.seat == state.turn)
+
+
+def _drive_to_finish(engine, session: GameSession, limit: int = 200000) -> None:
+    moves = 0
+    while not engine.is_finished(session) and moves < limit:
+        state = session.state
+        if state.phase == PHASE_AUCTION:
+            player = _player_on_turn(session)
+            try:
+                engine.handle_action(session, player.sub, "pass", {})
+            except IllegalMove:
+                # The last player standing must bid.
+                engine.handle_action(session, player.sub, "bid", {"rank": 2})
+        elif state.phase == PHASE_CALLING:
+            assert state.auction is not None and state.auction.current is not None
+            caller = next(
+                p for p in state.players if p.seat == state.caller
+            )
+            card = Card(rank=state.auction.current.rank, suit="D")
+            engine.handle_action(session, caller.sub, "call", {"card": card.code})
+        else:
+            player = _player_on_turn(session)
+            engine.handle_action(
+                session, player.sub, "play", {"card": player.hand[0].code}
+            )
+        moves += 1
+    assert engine.is_finished(session), "match did not finish"
+
+
+class MetadataTest(unittest.TestCase):
+    def test_metadata(self) -> None:
+        engine = BriscolaChiamataEngine()
+        self.assertEqual("briscola_chiamata", engine.id)
+        self.assertEqual("Briscola chiamata", engine.name)
+        self.assertTrue(engine.description)
+        self.assertEqual(5, engine.min_players)
+        self.assertEqual(5, engine.max_players)
+        self.assertEqual({}, engine.options_schema)
+
+
+class CreateJoinTest(unittest.TestCase):
+    def test_create_seats_creator_without_a_team(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _session(engine)
+        self.assertIsNone(session.players[0].team)
+        self.assertIsInstance(session.state, ChiamataState)
+        self.assertEqual(PHASE_LOBBY, session.state.phase)
+        self.assertTrue(engine.in_lobby(session))
+
+    def test_join_starts_when_full(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _session(engine)
+        self.assertTrue(engine.in_lobby(session))
+        for i in range(1, 4):
+            engine.join(session, f"p{i}", f"P{i}")
+        self.assertTrue(engine.in_lobby(session))
+        engine.join(session, "p4", "P4")
+        self.assertFalse(engine.in_lobby(session))
+        self.assertEqual(PHASE_AUCTION, session.state.phase)
+        self.assertEqual(5, len(session.players))
+        for seat in session.players:
+            self.assertIsNone(seat.team)
+
+    def test_join_errors(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _session(engine)
+        with self.assertRaises(AlreadyJoined):
+            engine.join(session, "p0", "P0")
+        for i in range(1, 5):
+            engine.join(session, f"p{i}", f"P{i}")
+        with self.assertRaises(GameNotStarted):
+            engine.join(session, "p5", "P5")
+
+    def test_timeouts_come_from_the_engine(self) -> None:
+        engine = BriscolaChiamataEngine(
+            turn_timeout_seconds=7, hand_ack_timeout_seconds=9
+        )
+        session = _session(engine)
+        self.assertEqual(7, session.state.turn_timeout)
+
+
+class ActionTest(unittest.TestCase):
+    def test_unknown_action_rejected(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "dance", {})
+
+    def test_bid_payload_validation(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "bid", {})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "bid", {"rank": "ace"})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "bid", {"rank": True})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "bid", {"points": False})
+        # points cannot be raised before a bid of the 2
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "bid", {"points": 64})
+
+    def test_auction_flow_through_actions(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        engine.handle_action(session, "p1", "bid", {"rank": 1})
+        engine.handle_action(session, "p2", "pass", {})
+        engine.handle_action(session, "p3", "bid", {"rank": 2})
+        engine.handle_action(session, "p4", "bid", {"points": 64})
+        engine.handle_action(session, "p0", "pass", {})
+        engine.handle_action(session, "p1", "pass", {})
+        engine.handle_action(session, "p3", "pass", {})
+        state = session.state
+        self.assertEqual(PHASE_CALLING, state.phase)
+        self.assertEqual(4, state.caller)
+        self.assertEqual(64, state.declared_target)
+        assert state.auction is not None and state.auction.current is not None
+        self.assertEqual(2, state.auction.current.rank)
+
+        engine.handle_action(session, "p4", "call", {"card": "02S"})
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        self.assertEqual("S", state.briscola_suit)
+
+        # Play the first card of the player on turn.
+        player = _player_on_turn(session)
+        engine.handle_action(
+            session, player.sub, "play", {"card": player.hand[0].code}
+        )
+        self.assertEqual(1, len(state.trick))
+
+    def test_call_payload_validation(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        engine.handle_action(session, "p1", "bid", {"rank": 2})
+        for i in (2, 3, 4, 0):
+            engine.handle_action(session, f"p{i}", "pass", {})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "call", {"card": 42})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "call", {"card": "nope"})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "call", {"card": "01D"})
+
+    def test_finished_match_rejects_actions(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        _drive_to_finish(engine, session)
+        with self.assertRaises(GameError):
+            engine.handle_action(session, session.players[0].user_sub, "play", {})
+
+
+class ViewTest(unittest.TestCase):
+    def test_view_hides_other_hands_and_roles(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        view = engine.view_for(session, "p0")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertIn("hand", players[0])
+        self.assertNotIn("hand", players[1])
+        self.assertNotIn("your_turn", view)
+        self.assertNotIn("scores", view)
+        self.assertEqual(5, view["player_count"])
+        # p1 opens the auction.
+        auction = view["auction"]
+        self.assertEqual(1, auction["turn"])
+        self.assertIsNone(auction["current"])
+
+    def test_view_marks_the_acting_player(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        view = engine.view_for(session, "p1")
+        self.assertTrue(view["your_turn"])
+        self.assertIn("legal_bids", view)
+        # The caller is labeled as soon as the auction is won.
+        engine.handle_action(session, "p1", "bid", {"rank": 1})
+        for i in (2, 3, 4, 0):
+            engine.handle_action(session, f"p{i}", "pass", {})
+        view = engine.view_for(session, "p0")
+        self.assertIn("callable_cards", engine.view_for(session, "p1"))
+        roles = {p["seat"]: p["team"] for p in view["players"]}
+        self.assertEqual(ROLE_CALLER, roles[1])
+
+    def test_spectator_view(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        view = engine.view_for(session, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+
+    def test_lobby_view(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _session(engine)
+        lobby = engine.lobby_view(session)
+        self.assertEqual("lobby", lobby["phase"])
+        self.assertEqual(61, lobby["declared_target"])
+
+
+class SerializationTest(unittest.TestCase):
+    def test_state_roundtrip(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        engine.handle_action(session, "p1", "bid", {"rank": 10})
+        restored = engine.state_from_json(engine.state_to_json(session.state))
+        self.assertIsInstance(restored, ChiamataState)
+        self.assertEqual(session.state.phase, restored.phase)
+        self.assertEqual(session.state.turn, restored.turn)
+        assert restored.auction is not None and session.state.auction is not None
+        self.assertEqual(session.state.auction.history, restored.auction.history)
+        self.assertEqual(
+            [p.sub for p in session.state.players],
+            [p.sub for p in restored.players],
+        )
+
+
+class DeadlineTest(unittest.TestCase):
+    def test_no_deadline_in_lobby(self) -> None:
+        engine = BriscolaChiamataEngine()
+        self.assertIsNone(engine.next_deadline(_session(engine)))
+
+    def test_auction_deadline_and_revalidation(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        self.assertEqual("auction", deadline.kind)
+        with self.assertRaises(GameError):
+            engine.fire_deadline(session, "auction", "auction:1:1:0")
+        engine.fire_deadline(session, deadline.kind, deadline.token)
+        # The auto-bid moved the auction on: a fresh deadline exists.
+        state = session.state
+        self.assertIn(
+            state.phase, (PHASE_AUCTION, PHASE_CALLING, PHASE_PLAYING)
+        )
+        self.assertIsNotNone(engine.next_deadline(session))
+
+    def test_stale_auction_deadline_after_a_bid(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        engine.handle_action(session, "p1", "bid", {"rank": 1})
+        with self.assertRaises(GameError):
+            engine.fire_deadline(session, deadline.kind, deadline.token)
+
+    def test_call_deadline_auto_calls(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        engine.handle_action(session, "p1", "bid", {"rank": 2})
+        for i in (2, 3, 4, 0):
+            engine.handle_action(session, f"p{i}", "pass", {})
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        self.assertEqual("call", deadline.kind)
+        engine.fire_deadline(session, deadline.kind, deadline.token)
+        state = session.state
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        assert state.called_card is not None
+        self.assertEqual(2, state.called_card.rank)
+
+    def test_turn_deadline_auto_plays(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        engine.handle_action(session, "p1", "bid", {"rank": 2})
+        for i in (2, 3, 4, 0):
+            engine.handle_action(session, f"p{i}", "pass", {})
+        engine.handle_action(session, "p1", "call", {"card": "02D"})
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        self.assertEqual("turn", deadline.kind)
+        state = session.state
+        before = state.turn
+        engine.fire_deadline(session, deadline.kind, deadline.token)
+        self.assertEqual(1, len(state.trick))
+        self.assertNotEqual(before, state.turn)
+
+
+class ResultTest(unittest.TestCase):
+    def test_result_of_finished_match(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        _drive_to_finish(engine, session)
+        state = session.state
+        result = engine.result(session)
+        sizes = sorted(len(team) for team in result.teams)
+        self.assertIn(sizes, ([2, 3], [1, 4]))
+        self.assertEqual(5, len(result.players))
+        self.assertIn(result.winner_team, (0, 1))
+        for player in result.players:
+            self.assertIn(player.team, (ROLE_CALLER, ROLE_PARTNER, ROLE_DEFENDER))
+            self.assertEqual(
+                player.won,
+                (player.team in (ROLE_CALLER, ROLE_PARTNER))
+                == (result.winner_team == 0),
+            )
+            self.assertIn("points", player.details)
+        summary = result.summary
+        for key in (
+            "team_a_score",
+            "team_b_score",
+            "winner_team",
+            "declared_target",
+            "called_card",
+            "caller",
+            "solo",
+            "deals_played",
+            "deal_scores",
+        ):
+            self.assertIn(key, summary)
+        self.assertIn(summary["winner_team"], ("Chiamante", "Difensori"))
+        self.assertEqual(state.hand_number, summary["deals_played"])
+
+    def test_result_requires_finished_match(self) -> None:
+        engine = BriscolaChiamataEngine()
+        with self.assertRaises(GameError):
+            engine.result(_started(engine))
+
+    def test_solo_result_teams(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        state = session.state
+        # Force a finished solo match: seat 0 called its own card.
+        state.caller = 0
+        state.solo = True
+        state.partner_seat = None
+        state.called_played = True
+        state.called_card = Card.parse("01D")
+        # Caller side captures 71 (60 + 11), defenders 49.
+        state.players[0].captured = [
+            Card.parse(code)
+            for code in [f"{rank:02d}D" for rank in (1, 3, 10, 9, 8)]
+            + [f"{rank:02d}C" for rank in (1, 3, 10, 9, 8)]
+            + ["01S"]
+        ]
+        state.players[1].captured = [
+            Card.parse(code)
+            for code in [f"{rank:02d}S" for rank in (3, 10, 9, 8)]
+            + [f"{rank:02d}B" for rank in (1, 3, 10, 9, 8)]
+        ]
+        state.scores = [71, 49]
+        state.winner = 0
+        state.phase = PHASE_FINISHED
+        result = engine.result(session)
+        self.assertEqual([1, 4], sorted(len(team) for team in result.teams))
+        # The lone caller won: exactly one winner.
+        self.assertEqual(1, sum(1 for p in result.players if p.won))
+        caller = next(p for p in result.players if p.team == ROLE_CALLER)
+        self.assertTrue(caller.won)
+        self.assertEqual(71.0, caller.score)
+
+    def test_game_over_view(self) -> None:
+        engine = BriscolaChiamataEngine()
+        session = _started(engine)
+        state = session.state
+        state.phase = PHASE_FINISHED
+        state.winner = 1
+        state.scores = [55, 65]
+        state.caller = 2
+        state.solo = False
+        state.partner_seat = 4
+        state.called_card = Card.parse("03C")
+        over = engine.game_over_view(session, "p0")
+        self.assertEqual({"A": 55, "B": 65}, over["scores"])
+        self.assertEqual("Difensori", over["winner"])
+        self.assertEqual("03C", over["called_card"])
+
+
+if __name__ == "__main__":
+    unittest.main()

server/packages/tavolo-briscola/tests/test_engine.py

@@ -0,0 +1,691 @@
+"""Rule engine tests: deals, tricks, draws, scoring and full-match simulation."""
+from __future__ import annotations
+
+import random
+import unittest
+
+from tavolo.briscola import engine
+from tavolo.briscola.errors import (
+    CardNotInHand,
+    GameFinished,
+    GameNotStarted,
+    IllegalMove,
+    NotYourTurn,
+)
+from tavolo.briscola.state import (
+    HAND_SIZE,
+    PHASE_FINISHED,
+    PHASE_HAND_END,
+    PHASE_PLAYING,
+    BriscolaState,
+    Card,
+    PlayerState,
+)
+
+
+def card(code: str) -> Card:
+    return Card.parse(code)
+
+
+def make_state(
+    hands,
+    *,
+    briscola_suit: str = "S",
+    briscola_card: str | None = None,
+    stock=None,
+    captured=None,
+    turn: int = 0,
+    dealer: int = 0,
+    target: int = 61,
+    scores=None,
+    phase: str = PHASE_PLAYING,
+) -> BriscolaState:
+    """Build a controlled game state directly (bypassing the deal)."""
+    state = BriscolaState(
+        player_count=len(hands),
+        target_score=target,
+        phase=phase,
+        dealer=dealer,
+        turn=turn,
+        briscola_suit=briscola_suit,
+        briscola_card=card(briscola_card) if briscola_card else None,
+        stock=[card(c) for c in (stock or [])],
+        scores=list(scores or [0, 0]),
+    )
+    for seat, hand in enumerate(hands):
+        state.players.append(
+            PlayerState(sub=f"p{seat}", name=f"p{seat}", seat=seat,
+                        hand=[card(c) for c in hand])
+        )
+    if captured is not None:
+        for player, codes in zip(state.players, captured):
+            player.captured = [card(c) for c in codes]
+    return state
+
+
+def trick_cards(state: BriscolaState) -> list[str]:
+    return [t.card for t in state.trick]
+
+
+def play_all(state: BriscolaState) -> None:
+    """Play every card of the current trick in turn order."""
+    for _ in range(state.player_count):
+        player = next(p for p in state.players if p.seat == state.turn)
+        engine.play(state, player.sub, player.hand[0].code)
+
+
+class DeckTest(unittest.TestCase):
+    def test_full_deck_has_40_unique_cards(self) -> None:
+        deck = engine.full_deck()
+        self.assertEqual(40, len(deck))
+        self.assertEqual(40, len({c.code for c in deck}))
+        self.assertEqual(4, len({c.suit for c in deck}))
+
+    def test_shuffled_deck_is_permutation(self) -> None:
+        deck = engine.shuffled_deck()
+        self.assertEqual(
+            sorted(c.code for c in engine.full_deck()),
+            sorted(c.code for c in deck),
+        )
+
+    def test_card_points_add_up_to_120(self) -> None:
+        self.assertEqual(
+            120, sum(engine.card_points(c) for c in engine.full_deck())
+        )
+        self.assertEqual(11, engine.card_points(card("01D")))
+        self.assertEqual(10, engine.card_points(card("03C")))
+        self.assertEqual(4, engine.card_points(card("10S")))
+        self.assertEqual(3, engine.card_points(card("09B")))
+        self.assertEqual(2, engine.card_points(card("08D")))
+        self.assertEqual(0, engine.card_points(card("07C")))
+
+
+class DealTest(unittest.TestCase):
+    def test_two_player_deal(self) -> None:
+        state = engine.create_game("p0", "p0")
+        engine.join_game(state, "p1", "p1")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        for player in state.players:
+            self.assertEqual(HAND_SIZE, len(player.hand))
+        # 40 - 3*2 - 1 face-up = 33 face-down.
+        self.assertEqual(33, len(state.stock))
+        self.assertIsNotNone(state.briscola_card)
+        assert state.briscola_card is not None
+        self.assertEqual(state.briscola_card.suit, state.briscola_suit)
+        self.assertEqual(1, state.turn)  # dealer is seat 0
+        self.assertEqual([], state.trick)
+
+    def test_four_player_deal(self) -> None:
+        state = engine.create_game("p0", "p0", player_count=4)
+        for i in range(1, 4):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        for player in state.players:
+            self.assertEqual(HAND_SIZE, len(player.hand))
+        self.assertEqual(40 - 3 * 4 - 1, len(state.stock))
+        self.assertEqual(1, state.turn)
+
+    def test_deal_cards_are_unique_and_leave_nothing_out(self) -> None:
+        state = engine.create_game("p0", "p0", player_count=4)
+        for i in range(1, 4):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        dealt = [c.code for p in state.players for c in p.hand]
+        assert state.briscola_card is not None
+        dealt.append(state.briscola_card.code)
+        dealt.extend(c.code for c in state.stock)
+        self.assertEqual(40, len(dealt))
+        self.assertEqual(40, len(set(dealt)))
+
+    def test_unsupported_player_count(self) -> None:
+        with self.assertRaises(IllegalMove):
+            engine.create_game("p0", "p0", player_count=3)
+
+    def test_target_score_bounds(self) -> None:
+        with self.assertRaises(IllegalMove):
+            engine.create_game("p0", "p0", target_score=60)
+        with self.assertRaises(IllegalMove):
+            engine.create_game("p0", "p0", target_score=121)
+        with self.assertRaises(IllegalMove):
+            engine.create_game("p0", "p0", target_score=True)
+        state = engine.create_game("p0", "p0", target_score=101)
+        self.assertEqual(101, state.target_score)
+
+
+class TrickTest(unittest.TestCase):
+    def test_higher_card_of_led_suit_wins(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        engine.play(state, "p0", "02D")
+        engine.play(state, "p1", "05D")
+        self.assertEqual(1, state.last_trick.winner)
+        self.assertEqual(["02D", "05D"],
+                         [c.code for c in state.players[1].captured])
+
+    def test_trump_beats_a_higher_led_card(self) -> None:
+        state = make_state([["07D"], ["02C"]], briscola_suit="C")
+        engine.play(state, "p0", "07D")
+        engine.play(state, "p1", "02C")
+        self.assertEqual(1, state.last_trick.winner)
+
+    def test_higher_trump_wins_among_trumps(self) -> None:
+        state = make_state([["02C"], ["05C"]], briscola_suit="C")
+        engine.play(state, "p0", "02C")
+        engine.play(state, "p1", "05C")
+        self.assertEqual(1, state.last_trick.winner)
+
+    def test_off_suit_non_trump_loses(self) -> None:
+        state = make_state([["04D"], ["01C"]], briscola_suit="B")
+        engine.play(state, "p0", "04D")
+        engine.play(state, "p1", "01C")
+        self.assertEqual(0, state.last_trick.winner)
+
+    def test_rank_strength_order(self) -> None:
+        # (winner card, loser card) pairs of the led suit, strongest first:
+        # ace > three > king > horse > jack > 7 > 6 > 5 > 4 > 2.
+        pairs = [
+            ("01D", "03D"),  # ace beats three
+            ("03D", "10D"),  # three beats king
+            ("10D", "09D"),  # king beats horse
+            ("09D", "08D"),  # horse beats jack
+            ("08D", "07D"),  # jack beats seven
+            ("07D", "06D"),
+            ("06D", "05D"),
+            ("05D", "04D"),
+            ("04D", "02D"),
+        ]
+        for winner, loser in pairs:
+            state = make_state([["02D"], ["05D"]], briscola_suit="B")
+            state.players[0].hand = [card(winner)]
+            state.players[1].hand = [card(loser)]
+            engine.play(state, "p0", winner)
+            engine.play(state, "p1", loser)
+            self.assertEqual(
+                0, state.last_trick.winner, f"{winner} should beat {loser}"
+            )
+
+    def test_four_player_trick(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"]], briscola_suit="S"
+        )
+        for seat in range(4):
+            engine.play(state, f"p{seat}", state.players[seat].hand[0].code)
+        self.assertEqual(3, state.last_trick.winner)
+
+    def test_four_player_trump_beats_all(self) -> None:
+        state = make_state(
+            [["02D"], ["02C"], ["04D"], ["07D"]], briscola_suit="C"
+        )
+        for seat in range(4):
+            engine.play(state, f"p{seat}", state.players[seat].hand[0].code)
+        self.assertEqual(1, state.last_trick.winner)
+
+    def test_winner_leads_the_next_trick(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"]],
+            briscola_suit="S",
+            stock=["01B", "02B", "03B", "04B"],
+        )
+        for seat in range(4):
+            engine.play(state, f"p{seat}", state.players[seat].hand[0].code)
+        self.assertEqual(3, state.turn)
+        self.assertEqual(3, state.trick_leader)
+        self.assertEqual([], state.trick)
+
+    def test_turn_advances_within_a_trick(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        engine.play(state, "p0", "02D")
+        self.assertEqual(1, state.turn)
+        self.assertEqual(["02D"], trick_cards(state))
+
+    def test_not_your_turn(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S", turn=1)
+        with self.assertRaises(NotYourTurn):
+            engine.play(state, "p0", "02D")
+
+    def test_card_not_in_hand(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        with self.assertRaises(CardNotInHand):
+            engine.play(state, "p0", "07D")
+
+    def test_finished_and_hand_end_reject_plays(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        state.phase = PHASE_FINISHED
+        with self.assertRaises(GameFinished):
+            engine.play(state, "p0", "02D")
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        state.phase = PHASE_HAND_END
+        with self.assertRaises(IllegalMove):
+            engine.play(state, "p0", "02D")
+
+
+class DrawTest(unittest.TestCase):
+    def test_winner_draws_first(self) -> None:
+        # The stock is drawn from its end: 04B first, then 03B, ...
+        state = make_state(
+            [["02D", "09C"], ["05D", "09B"]],
+            briscola_suit="S",
+            stock=["01B", "02B", "03B", "04B"],
+        )
+        engine.play(state, "p0", "02D")
+        engine.play(state, "p1", "05D")
+        hands = {p.seat: [c.code for c in p.hand] for p in state.players}
+        self.assertEqual(["09C", "03B"], hands[0])
+        self.assertEqual(["09B", "04B"], hands[1])
+
+    def test_face_up_briscola_is_drawn_last(self) -> None:
+        state = make_state(
+            [["02D", "09C"], ["05D", "09B"]],
+            briscola_suit="C",
+            briscola_card="05C",
+            stock=["03B"],
+        )
+        engine.play(state, "p0", "02D")
+        engine.play(state, "p1", "05D")
+        hands = {p.seat: [c.code for c in p.hand] for p in state.players}
+        # The winner draws first and takes the last face-down card; the
+        # other player then takes the face-up briscola.
+        self.assertEqual(["09B", "03B"], hands[1])
+        self.assertEqual(["09C", "05C"], hands[0])
+        self.assertIsNone(state.briscola_card)
+
+    def test_no_draw_when_stock_is_empty(self) -> None:
+        state = make_state(
+            [["02D", "03D"], ["05D", "06D"]], briscola_suit="S", stock=[]
+        )
+        engine.play(state, "p0", "02D")
+        engine.play(state, "p1", "05D")
+        # p1 wins the trick; with no stock nobody draws and the hands
+        # shrink for the rest of the deal.
+        for player in state.players:
+            self.assertEqual(1, len(player.hand))
+
+    def test_hands_stay_at_three_until_stock_runs_out(self) -> None:
+        state = engine.create_game("p0", "p0")
+        engine.join_game(state, "p1", "p1")
+        while state.stock or state.briscola_card is not None:
+            play_all(state)
+            for player in state.players:
+                self.assertEqual(HAND_SIZE, len(player.hand))
+        self.assertEqual(0, len(state.stock))
+        self.assertIsNone(state.briscola_card)
+
+
+class ScoringTest(unittest.TestCase):
+    def test_deal_points_group_by_team(self) -> None:
+        state = make_state(
+            [[], [], [], []],
+            briscola_suit="S",
+            captured=[
+                ["01D", "07C"],   # seat 0, team A: 11
+                ["03C", "08D"],   # seat 1, team B: 10
+                ["10S"],          # seat 2, team A: 4
+                ["09B"],          # seat 3, team B: 3
+            ],
+        )
+        points, details = engine.deal_points(state)
+        self.assertEqual([15, 15], points)
+        self.assertEqual({"A": 15, "B": 15}, details["points"])
+        self.assertEqual({"A": 3, "B": 3}, details["cards"])
+
+    def test_full_deal_scores_120(self) -> None:
+        state = engine.create_game("p0", "p0", player_count=4)
+        for i in range(1, 4):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        while state.phase == PHASE_PLAYING:
+            player = next(p for p in state.players if p.seat == state.turn)
+            engine.play(state, player.sub, player.hand[0].code)
+        points, _ = engine.deal_points(state)
+        self.assertEqual(120, sum(points))
+
+    def test_match_ends_when_target_reached(self) -> None:
+        # p0 captures the ace of denari (11) on the last trick: 60+11 >= 61.
+        state = make_state(
+            [["02D"], ["05D"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[["01C"], ["10C"]],
+            scores=[60, 50],
+            target=61,
+        )
+        # p0's pile is worth 11+0 = 11; p1's 4. p0 wins the trick with a
+        # higher card: 02D vs 05D -> p1 would win, so give p0 the five.
+        state.players[0].hand = [card("05D")]
+        state.players[1].hand = [card("02D")]
+        engine.play(state, "p0", "05D")
+        engine.play(state, "p1", "02D")
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertEqual(0, state.winner)
+        self.assertEqual([71, 54], state.scores)
+
+    def test_tie_at_target_is_broken_by_another_deal(self) -> None:
+        # 65-55 before the deal; this deal gives A 55 and B 65: both reach
+        # 120 and tie, so another deal must be played.
+        a_cards = [f"{rank:02d}D" for rank in range(1, 11)] + ["01C", "03C", "10C"]
+        b_cards = ["09C", "08C", "07C", "06C", "05C", "04C", "02C"] + [
+            f"{rank:02d}S" for rank in range(1, 11)
+        ] + [f"{rank:02d}B" for rank in range(1, 11)]
+        state = make_state(
+            [[], []],
+            briscola_suit="S",
+            stock=[],
+            captured=[a_cards, b_cards],
+            scores=[65, 55],
+            target=120,
+        )
+        engine._end_deal(state)
+        self.assertEqual(PHASE_HAND_END, state.phase)
+        self.assertEqual([120, 120], state.scores)
+        self.assertIsNone(state.winner)
+
+    def test_patta_is_discarded_and_replayed(self) -> None:
+        a_cards = [f"{rank:02d}D" for rank in range(1, 11)] + [
+            f"{rank:02d}C" for rank in range(1, 11)
+        ]
+        b_cards = [f"{rank:02d}S" for rank in range(1, 11)] + [
+            f"{rank:02d}B" for rank in range(1, 11)
+        ]
+        state = make_state(
+            [["02D"], ["02S"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[a_cards, b_cards],
+            scores=[10, 20],
+            target=61,
+        )
+        engine._end_deal(state)
+        self.assertEqual(PHASE_HAND_END, state.phase)
+        # The 60-60 deal does not count: totals are unchanged.
+        self.assertEqual([10, 20], state.scores)
+        entry = state.hand_scores[-1]
+        self.assertTrue(entry["patta"])
+        self.assertEqual({"A": 60, "B": 60}, entry["points"])
+        # The next deal is played at the same cumulative totals.
+        engine.acknowledge_hand(state, "p0")
+        engine.acknowledge_hand(state, "p1")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        self.assertEqual(2, state.hand_number)
+        self.assertEqual([10, 20], state.scores)
+
+    def test_audit_trail_records_each_deal(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[["01C"], []],
+            scores=[0, 0],
+        )
+        engine._end_deal(state)
+        entry = state.hand_scores[-1]
+        self.assertEqual(1, entry["deal"])
+        self.assertFalse(entry["patta"])
+        self.assertEqual({"A": 11, "B": 0}, entry["points"])
+        self.assertEqual({"A": 11, "B": 0}, entry["totals"])
+        self.assertEqual({"A": 1, "B": 0}, entry["cards"])
+
+
+class MatchFlowTest(unittest.TestCase):
+    def test_join_starts_when_full(self) -> None:
+        state = engine.create_game("p0", "p0")
+        self.assertEqual(1, len(state.players))
+        engine.join_game(state, "p1", "p1")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+
+        state = engine.create_game("p0", "p0", player_count=4)
+        for i in range(1, 3):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        self.assertEqual("lobby", state.phase)
+        engine.join_game(state, "p3", "p3")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+
+    def test_join_errors(self) -> None:
+        from tavolo.platform.errors import AlreadyJoined, GameNotStarted
+
+        state = engine.create_game("p0", "p0")
+        with self.assertRaises(AlreadyJoined):
+            engine.join_game(state, "p0", "p0")
+        engine.join_game(state, "p1", "p1")
+        with self.assertRaises(GameNotStarted):
+            engine.join_game(state, "p2", "p2")
+
+    def test_full_random_two_player_match(self) -> None:
+        self._random_match(player_count=2)
+
+    def test_full_random_four_player_match(self) -> None:
+        self._random_match(player_count=4)
+
+    def _random_match(self, player_count: int) -> None:
+        state = engine.create_game("p0", "p0", player_count=player_count)
+        for i in range(1, player_count):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        rng = random.Random(2026)
+        moves = 0
+        while state.phase != PHASE_FINISHED and moves < 200000:
+            if state.phase == PHASE_HAND_END:
+                for player in state.players:
+                    engine.acknowledge_hand(state, player.sub)
+                continue
+            player = next(p for p in state.players if p.seat == state.turn)
+            engine.play(state, player.sub, rng.choice(player.hand).code)
+            moves += 1
+
+        self.assertEqual(PHASE_FINISHED, state.phase)
+        self.assertIn(state.winner, (0, 1))
+        self.assertEqual([], state.trick)
+        self.assertTrue(all(not p.hand for p in state.players))
+        self.assertEqual(
+            40, sum(len(p.captured) for p in state.players)
+        )
+        # Every counted deal totals 120 points, and the winner reached the
+        # target with a clear lead.
+        winner_score = state.scores[state.winner]
+        loser_score = state.scores[1 - state.winner]
+        self.assertGreaterEqual(winner_score, state.target_score)
+        self.assertGreater(winner_score, loser_score)
+        self.assertEqual(0, (winner_score + loser_score) % 120)
+
+
+class AckTest(unittest.TestCase):
+    def _hand_end_state(self) -> BriscolaState:
+        state = make_state(
+            [["02D"], ["05D"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[["01C"], []],
+            target=120,
+        )
+        engine._end_deal(state)
+        return state
+
+    def test_ack_all_deals_the_next_deal(self) -> None:
+        state = self._hand_end_state()
+        dealer_before = state.dealer
+        engine.acknowledge_hand(state, "p0")
+        self.assertEqual([0], state.acked)
+        self.assertEqual(PHASE_HAND_END, state.phase)
+        engine.acknowledge_hand(state, "p1")
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        self.assertEqual(2, state.hand_number)
+        self.assertEqual((dealer_before + 1) % 2, state.dealer)
+        self.assertEqual((dealer_before + 2) % 2, state.turn)
+        self.assertEqual([], state.acked)
+        self.assertIsNone(state.hand_end_deadline)
+        for player in state.players:
+            self.assertEqual(HAND_SIZE, len(player.hand))
+            self.assertEqual([], player.captured)
+
+    def test_double_ack_is_idempotent(self) -> None:
+        state = self._hand_end_state()
+        engine.acknowledge_hand(state, "p0")
+        engine.acknowledge_hand(state, "p0")
+        self.assertEqual([0], state.acked)
+
+    def test_ack_outside_hand_end_is_rejected(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        with self.assertRaises(IllegalMove):
+            engine.acknowledge_hand(state, "p0")
+
+    def test_ack_by_non_player_is_rejected(self) -> None:
+        state = self._hand_end_state()
+        with self.assertRaises(NotYourTurn):
+            engine.acknowledge_hand(state, "mallory")
+
+
+class AutoPlayTest(unittest.TestCase):
+    def test_auto_play_plays_a_card_and_advances_turn(self) -> None:
+        state = make_state(
+            [["02D", "03C"], ["05D"]],
+            briscola_suit="S",
+            stock=["01B", "02B"],
+            briscola_card="03B",
+        )
+        engine.auto_play(state, random.Random(7))
+        self.assertEqual(1, state.turn)
+        self.assertEqual(1, len(state.players[0].hand))
+        self.assertEqual(1, len(state.trick))
+
+    def test_auto_play_can_end_the_deal(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[["01C"], []],
+            target=120,
+        )
+        # Both players are on their last card: two auto-plays complete the
+        # trick and the deal, scored A=11 / B=0.
+        engine.auto_play(state)
+        engine.auto_play(state)
+        self.assertEqual(PHASE_HAND_END, state.phase)
+        self.assertIsNone(state.turn_deadline)
+        self.assertTrue(state.hand_end_deadline)
+
+    def test_auto_play_requires_playing_phase(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        state.phase = PHASE_HAND_END
+        with self.assertRaises(GameNotStarted):
+            engine.auto_play(state)
+
+
+class ViewTest(unittest.TestCase):
+    def test_state_for_player_hides_other_hands(self) -> None:
+        state = make_state(
+            [["02D", "03C"], ["04D"], ["05D"], ["06D"]],
+            briscola_suit="D",
+            briscola_card="07D",
+            stock=["01B", "02B"],
+        )
+        view = engine.state_for_player(state, "p0")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertEqual(["02D", "03C"], players[0]["hand"])
+        self.assertNotIn("hand", players[1])
+        self.assertEqual(1, players[1]["cards_left"])
+        self.assertEqual("D", view["briscola_suit"])
+        self.assertEqual("07D", view["briscola_card"])
+        self.assertEqual(2, view["stock_count"])
+        self.assertTrue(view.get("your_turn"))
+
+    def test_spectator_sees_public_info_only(self) -> None:
+        state = make_state(
+            [["02D"], ["04D"]],
+            briscola_suit="D",
+            briscola_card="07D",
+        )
+        view = engine.state_for_player(state, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+        self.assertEqual("07D", view["briscola_card"])
+        self.assertEqual({"A": 0, "B": 0}, view["scores"])
+
+    def test_player_points_are_public(self) -> None:
+        state = make_state(
+            [["02D"], ["04D"]],
+            briscola_suit="D",
+            captured=[["01C", "03B"], ["10D"]],
+        )
+        view = engine.state_for_player(state, "p0")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertEqual(21, players[0]["points"])
+        self.assertEqual(4, players[1]["points"])
+        self.assertEqual(2, players[0]["captured_count"])
+
+    def test_hand_end_view_exposes_the_deal_summary(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"]],
+            briscola_suit="S",
+            stock=[],
+            captured=[["01C"], []],
+            target=120,
+        )
+        engine._end_deal(state)
+        view = engine.state_for_player(state, "p0")
+        self.assertEqual(PHASE_HAND_END, view["phase"])
+        self.assertEqual(
+            {
+                "deal": 1,
+                "patta": False,
+                "points": {"A": 11, "B": 0},
+                "cards": {"A": 1, "B": 0},
+                "totals": {"A": 11, "B": 0},
+            },
+            view["last_deal"],
+        )
+        self.assertTrue(view["hand_end_deadline"])
+
+    def test_trick_is_public_in_play_order(self) -> None:
+        state = make_state(
+            [["02D"], ["05D"], ["04D"], ["07D"]], briscola_suit="S"
+        )
+        engine.play(state, "p0", "02D")
+        engine.play(state, "p1", "05D")
+        view = engine.state_for_player(state, None)
+        self.assertEqual(
+            [{"seat": 0, "card": "02D"}, {"seat": 1, "card": "05D"}],
+            view["trick"],
+        )
+
+
+class SerializationTest(unittest.TestCase):
+    def test_state_roundtrip(self) -> None:
+        state = engine.create_game("p0", "p0", player_count=4, target_score=101)
+        for i in range(1, 4):
+            engine.join_game(state, f"p{i}", f"p{i}")
+        engine.play(state, state.players[1].sub, state.players[1].hand[0].code)
+        restored = BriscolaState.from_json(state.to_json())
+        self.assertEqual(state.phase, restored.phase)
+        self.assertEqual(state.turn, restored.turn)
+        self.assertEqual(state.hand_number, restored.hand_number)
+        self.assertEqual(state.target_score, restored.target_score)
+        self.assertEqual(state.briscola_suit, restored.briscola_suit)
+        self.assertEqual(
+            state.briscola_card.code if state.briscola_card else None,
+            restored.briscola_card.code if restored.briscola_card else None,
+        )
+        self.assertEqual(
+            [c.code for c in state.stock], [c.code for c in restored.stock]
+        )
+        self.assertEqual(
+            [(t.seat, t.card) for t in state.trick],
+            [(t.seat, t.card) for t in restored.trick],
+        )
+        self.assertEqual(
+            [p.sub for p in state.players], [p.sub for p in restored.players]
+        )
+        self.assertEqual(
+            [[c.code for c in p.hand] for p in state.players],
+            [[c.code for c in p.hand] for p in restored.players],
+        )
+
+    def test_legacy_state_defaults(self) -> None:
+        state = make_state([["02D"], ["05D"]], briscola_suit="S")
+        data = state.to_json()
+        del data["player_count"]
+        del data["briscola_card"]
+        del data["last_trick"]
+        restored = BriscolaState.from_json(data)
+        self.assertEqual(2, restored.player_count)
+        self.assertIsNone(restored.briscola_card)
+        self.assertIsNone(restored.last_trick)
+
+
+if __name__ == "__main__":
+    unittest.main()

server/packages/tavolo-briscola/tests/test_plugin.py

@@ -0,0 +1,349 @@
+"""Adapter tests: the platform contract over the pure briscola rules."""
+from __future__ import annotations
+
+import unittest
+from datetime import datetime, timedelta, timezone
+
+from tavolo.platform import GameSession, Seat
+from tavolo.platform.errors import (
+    AlreadyJoined,
+    GameError,
+    GameFinished,
+    GameNotStarted,
+    IllegalMove,
+)
+from tavolo.briscola import BriscolaEngine, BriscolaQuattroEngine
+from tavolo.briscola import engine as rules
+from tavolo.briscola.state import (
+    PHASE_FINISHED,
+    PHASE_HAND_END,
+    PHASE_PLAYING,
+    BriscolaState,
+)
+
+
+def _session(engine, **options) -> GameSession:
+    session = GameSession(
+        id="b1",
+        game_type=engine.id,
+        join_code="CODE01",
+        creator_sub="alice",
+        players=[Seat(user_sub="alice", display_name="Alice")],
+    )
+    engine.create(session, options)
+    return session
+
+
+def _started(engine, **options) -> GameSession:
+    session = _session(engine, **options)
+    for i in range(1, engine.max_players):
+        name = f"p{i}"
+        engine.join(session, name, name.capitalize())
+    return session
+
+
+def _drive_to_finish(engine, session: GameSession, limit: int = 200000) -> None:
+    moves = 0
+    while not engine.is_finished(session) and moves < limit:
+        state = session.state
+        if state.phase == PHASE_HAND_END:
+            for player in state.players:
+                engine.handle_action(session, player.sub, "ack", {})
+            continue
+        player = next(p for p in state.players if p.seat == state.turn)
+        engine.handle_action(
+            session, player.sub, "play", {"card": player.hand[0].code}
+        )
+        moves += 1
+
+
+class MetadataTest(unittest.TestCase):
+    def test_two_player_metadata(self) -> None:
+        engine = BriscolaEngine()
+        self.assertEqual("briscola", engine.id)
+        self.assertEqual("Briscola", engine.name)
+        self.assertTrue(engine.description)
+        self.assertEqual(2, engine.min_players)
+        self.assertEqual(2, engine.max_players)
+        target = engine.options_schema["properties"]["target_score"]
+        self.assertEqual("integer", target["type"])
+        self.assertEqual(61, target["minimum"])
+        self.assertEqual(120, target["maximum"])
+        self.assertEqual(61, target["default"])
+
+    def test_four_player_metadata(self) -> None:
+        engine = BriscolaQuattroEngine()
+        self.assertEqual("briscola_a_quattro", engine.id)
+        self.assertEqual("Briscola a quattro", engine.name)
+        self.assertTrue(engine.description)
+        self.assertEqual(4, engine.min_players)
+        self.assertEqual(4, engine.max_players)
+        self.assertIn("target_score", engine.options_schema["properties"])
+
+
+class CreateTest(unittest.TestCase):
+    def test_create_seats_creator_on_team_a(self) -> None:
+        engine = BriscolaEngine()
+        session = _session(engine)
+        self.assertEqual("A", session.players[0].team)
+        self.assertIsInstance(session.state, BriscolaState)
+        self.assertEqual(61, session.state.target_score)
+        self.assertEqual(2, session.state.player_count)
+
+    def test_create_options(self) -> None:
+        engine = BriscolaQuattroEngine()
+        session = _session(engine, target_score=101)
+        self.assertEqual(101, session.state.target_score)
+        self.assertEqual(4, session.state.player_count)
+
+    def test_create_rejects_bad_options(self) -> None:
+        engine = BriscolaEngine()
+        with self.assertRaises(IllegalMove):
+            _session(engine, target_score=60)
+        with self.assertRaises(IllegalMove):
+            _session(engine, target_score=121)
+        with self.assertRaises(IllegalMove):
+            _session(engine, target_score="sixtyone")
+        with self.assertRaises(IllegalMove):
+            _session(engine, target_score=True)
+
+    def test_timeouts_come_from_the_engine(self) -> None:
+        engine = BriscolaEngine(turn_timeout_seconds=7, hand_ack_timeout_seconds=9)
+        session = _session(engine)
+        self.assertEqual(7, session.state.turn_timeout)
+        self.assertEqual(9, session.state.hand_ack_timeout)
+
+
+class JoinTest(unittest.TestCase):
+    def test_two_player_join_starts(self) -> None:
+        engine = BriscolaEngine()
+        session = _session(engine)
+        self.assertTrue(engine.in_lobby(session))
+        engine.join(session, "bob", "Bob")
+        self.assertEqual("B", session.players[-1].team)
+        self.assertFalse(engine.in_lobby(session))
+        self.assertEqual(PHASE_PLAYING, session.state.phase)
+
+    def test_four_player_teams_alternate(self) -> None:
+        engine = BriscolaQuattroEngine()
+        session = _session(engine)
+        teams = []
+        for name in ("bob", "carol", "dave"):
+            engine.join(session, name, name.capitalize())
+            teams.append(session.players[-1].team)
+        self.assertEqual(["B", "A", "B"], teams)
+        self.assertEqual(PHASE_PLAYING, session.state.phase)
+
+    def test_join_errors(self) -> None:
+        engine = BriscolaEngine()
+        session = _session(engine)
+        with self.assertRaises(AlreadyJoined):
+            engine.join(session, "alice", "Alice")
+        engine.join(session, "bob", "Bob")
+        with self.assertRaises(GameNotStarted):
+            engine.join(session, "carol", "Carol")
+
+
+class ActionTest(unittest.TestCase):
+    def test_unknown_action_rejected(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "alice", "dance", {})
+
+    def test_play_validates_payload(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "play", {"card": 42})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "play", {})
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "p1", "play", {"card": "nope"})
+
+    def test_play_advances_the_trick(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        state = session.state
+        self.assertEqual(1, state.turn)
+        card = state.players[1].hand[0].code
+        engine.handle_action(session, "p1", "play", {"card": card})
+        self.assertEqual([{"seat": 1, "card": card}], engine.view_for(session, "p1")["trick"])
+
+    def test_play_out_of_turn_rejected(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        state = session.state
+        card = state.players[0].hand[0].code
+        with self.assertRaises(GameError):
+            engine.handle_action(session, "alice", "play", {"card": card})
+
+    def test_ack_outside_hand_end_rejected(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        with self.assertRaises(IllegalMove):
+            engine.handle_action(session, "alice", "ack", {})
+
+    def test_finished_match_rejects_actions(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        _drive_to_finish(engine, session)
+        self.assertTrue(engine.is_finished(session))
+        with self.assertRaises(GameFinished):
+            engine.handle_action(session, "alice", "play", {"card": "01D"})
+
+    def test_ack_all_deals_next(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine, target_score=120)
+        state = session.state
+        # Force the deal-end phase: both players keep 3 cards, so the
+        # match continues after the summary.
+        state.phase = PHASE_HAND_END
+        state.acked = []
+        state.hand_end_deadline = (
+            datetime.now(timezone.utc) + timedelta(seconds=60)
+        ).isoformat()
+        engine.handle_action(session, "alice", "ack", {})
+        self.assertEqual(PHASE_HAND_END, state.phase)
+        engine.handle_action(session, "p1", "ack", {})
+        self.assertEqual(PHASE_PLAYING, state.phase)
+        self.assertEqual(2, state.hand_number)
+
+
+class ViewTest(unittest.TestCase):
+    def test_view_for_hides_other_hands(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        view = engine.view_for(session, "alice")
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertIn("hand", players[0])
+        self.assertNotIn("hand", players[1])
+        # The envelope is the platform's job, not the view's.
+        self.assertNotIn("id", view)
+        self.assertNotIn("join_code", view)
+        self.assertNotIn("game_type", view)
+        self.assertIn("briscola_suit", view)
+        self.assertIn("stock_count", view)
+
+    def test_view_for_spectator_hides_all_hands(self) -> None:
+        engine = BriscolaQuattroEngine()
+        session = _started(engine)
+        view = engine.view_for(session, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+        self.assertEqual({"A": 0, "B": 0}, view["scores"])
+
+    def test_lobby_view(self) -> None:
+        engine = BriscolaEngine()
+        session = _session(engine, target_score=101)
+        lobby = engine.lobby_view(session)
+        self.assertEqual("lobby", lobby["phase"])
+        self.assertEqual(101, lobby["target_score"])
+
+
+class SerializationTest(unittest.TestCase):
+    def test_state_roundtrip(self) -> None:
+        engine = BriscolaQuattroEngine()
+        session = _started(engine)
+        restored = engine.state_from_json(engine.state_to_json(session.state))
+        self.assertIsInstance(restored, BriscolaState)
+        self.assertEqual(session.state.phase, restored.phase)
+        self.assertEqual(session.state.turn, restored.turn)
+        self.assertEqual(
+            [p.sub for p in session.state.players],
+            [p.sub for p in restored.players],
+        )
+
+
+class DeadlineTest(unittest.TestCase):
+    def test_no_deadline_in_lobby(self) -> None:
+        engine = BriscolaEngine()
+        self.assertIsNone(engine.next_deadline(_session(engine)))
+
+    def test_turn_deadline_and_revalidation(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        self.assertEqual("turn", deadline.kind)
+        with self.assertRaises(GameError):
+            engine.fire_deadline(session, "turn", "turn:1:1:0")
+        turn_before = session.state.turn
+        engine.fire_deadline(session, deadline.kind, deadline.token)
+        self.assertNotEqual(turn_before, session.state.turn)
+
+    def test_stale_deadline_after_play(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        state = session.state
+        player = next(p for p in state.players if p.seat == state.turn)
+        engine.handle_action(session, player.sub, "play", {"card": player.hand[0].code})
+        with self.assertRaises(GameError):
+            engine.fire_deadline(session, deadline.kind, deadline.token)
+
+    def test_hand_end_deadline_advances(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine, target_score=120)
+        state = session.state
+        state.phase = PHASE_HAND_END
+        state.hand_end_deadline = (
+            datetime.now(timezone.utc) + timedelta(seconds=60)
+        ).isoformat()
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        self.assertEqual("hand_end", deadline.kind)
+        engine.fire_deadline(session, deadline.kind, deadline.token)
+        self.assertEqual(PHASE_PLAYING, session.state.phase)
+        self.assertEqual(2, session.state.hand_number)
+
+
+class ResultTest(unittest.TestCase):
+    def test_result_of_finished_match(self) -> None:
+        engine = BriscolaQuattroEngine()
+        session = _started(engine)
+        _drive_to_finish(engine, session)
+        result = engine.result(session)
+        self.assertEqual(2, len(result.teams))
+        self.assertEqual([2, 2], [len(team) for team in result.teams])
+        self.assertIn(result.winner_team, (0, 1))
+        self.assertEqual(4, len(result.players))
+        winner_name = "A" if result.winner_team == 0 else "B"
+        for player in result.players:
+            self.assertEqual(player.won, player.team == winner_name)
+            self.assertIn("captured_cards", player.details)
+        self.assertIn("team_a_score", result.summary)
+        self.assertIn("team_b_score", result.summary)
+        self.assertIn("winner_team", result.summary)
+        self.assertIn("target_score", result.summary)
+        self.assertIn("deals_played", result.summary)
+        self.assertIn("deal_scores", result.summary)
+
+    def test_two_player_result(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        _drive_to_finish(engine, session)
+        result = engine.result(session)
+        self.assertEqual([[session.players[0].user_sub], [session.players[1].user_sub]], result.teams)
+        self.assertEqual(2, len(result.players))
+
+    def test_result_requires_finished_match(self) -> None:
+        engine = BriscolaEngine()
+        with self.assertRaises(GameError):
+            engine.result(_started(engine))
+
+    def test_game_over_view(self) -> None:
+        engine = BriscolaEngine()
+        session = _started(engine)
+        session.state.phase = PHASE_FINISHED
+        session.state.winner = 1
+        session.state.scores = [55, 65]
+        over = engine.game_over_view(session, "alice")
+        self.assertEqual({"A": 55, "B": 65}, over["scores"])
+        self.assertEqual("B", over["winner"])
+
+
+if __name__ == "__main__":
+    unittest.main()

server/packages/tavolo-platform/README.md

@@ -48,8 +48,8 @@ itself ships no game.
 Implement `GameEngine` (see `engine.py` for the full contract), register
 it in a `GameRegistry`, and mount `PlatformMixin(Platform(...))` on a
 `KayaApp` — see the composition root in `tavolo.app`. The canonical
-example is
-[`tavolo-scopone`](../tavolo-scopone/README.md).
+examples are [`tavolo-scopone`](../tavolo-scopone/README.md) and
+[`tavolo-briscola`](../tavolo-briscola/README.md).
 
 ## Development (from `server/`)
 

server/packages/tavolo-platform/pyproject.toml

@@ -9,9 +9,9 @@ description = "Game-independent multiplayer game platform (lobby, live play, mat
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "kaya-core",
+    "kaya-core>=0.0.7",
     "kaya-session",
-    "kaya-oidc",
+    "kaya-oidc>=0.0.7",
     "kaya-openapi",
     "tortoise-orm",
     "redis",

server/packages/tavolo-platform/src/tavolo/platform/auth.py

@@ -9,7 +9,29 @@ from __future__ import annotations
 from typing import Any, Callable, Mapping, Optional
 
 from kaya.core import HttpContext, WebSocket
-from kaya.oidc import OIDCMixin, OIDCUser
+from kaya.oidc import OIDCProviders, OIDCUser
+from kaya.session import Session
+
+# kaya-oidc namespaces its session state per provider as
+# ``oidc:{provider}:user`` (since 0.0.6), so the lookup cannot assume a
+# fixed key or provider name.
+_OIDC_PREFIX = "oidc:"
+_USER_SUFFIX = ":user"
+
+
+def session_user(session: Session) -> Optional[OIDCUser]:
+    """Return the authenticated user stored in a session, if any.
+
+    The kaya-oidc mixin writes the userinfo at login under a per-provider
+    key, so any provider's user is accepted (the configured provider is
+    ``default`` unless the app says otherwise).
+    """
+    for key in session:
+        if key.startswith(_OIDC_PREFIX) and key.endswith(_USER_SUFFIX):
+            claims = session.get(key)
+            if isinstance(claims, Mapping):
+                return OIDCUser(claims)
+    return None
 
 
 def get_ws_user(ws: WebSocket) -> Optional[OIDCUser]:
@@ -21,22 +43,33 @@ def get_ws_user(ws: WebSocket) -> Optional[OIDCUser]:
     session = getattr(ws, "session", None)
     if session is None:
         return None
-    claims = session.get("oidc_user")
-    if not isinstance(claims, Mapping):
-        return None
-    return OIDCUser(claims)
+    return session_user(session)
 
 
 def display_name(user: OIDCUser) -> str:
-    """Best-effort human-readable name for a user."""
-    for key in ("name", "preferred_username", "email"):
+    """Best-effort human-readable name for a user.
+
+    ``preferred_username`` is preferred: it is the account's stable handle,
+    while ``name`` is a free-form display name a user may change (and two
+    accounts can share). ``email`` is a last resort before the ``sub``.
+    """
+    for key in ("preferred_username", "name", "email"):
         value = user.get(key)
         if isinstance(value, str) and value:
             return value
     return user.sub
 
 
-def require_auth(oidc: OIDCMixin) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
+def current_user(oidc: OIDCProviders, ctx: HttpContext) -> Optional[OIDCUser]:
+    """Return the authenticated user of an HTTP request, if any.
+
+    Sessions are single-identity by default, so at most one provider has
+    a user; if several do, the first configured provider wins.
+    """
+    return next(iter(oidc.get_users(ctx).values()), None)
+
+
+def require_auth(oidc: OIDCProviders) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
     """Build a decorator gating a handler on being authenticated.
 
     Responds ``401`` with a JSON error envelope when unauthenticated —
@@ -46,7 +79,7 @@ def require_auth(oidc: OIDCMixin) -> Callable[[Callable[..., Any]], Callable[...
 
     def decorator(handler: Callable[..., Any]) -> Callable[..., Any]:
         async def guarded(ctx: HttpContext, *args: Any, **kwargs: Any) -> None:
-            if oidc.get_user(ctx) is None:
+            if current_user(oidc, ctx) is None:
                 await ctx.send_bytes(
                     401,
                     b'{"error":"unauthenticated"}',

server/packages/tavolo-platform/src/tavolo/platform/deadlines.py

@@ -11,8 +11,11 @@ machinery; the *meaning* of each deadline belongs to the game engine:
   token), and the scheduler enqueues it in the store's shared deadline
   queue (a Redis sorted set in production, see
   :mod:`tavolo.platform.store`); enqueueing is idempotent;
-* a background consumer running on **every** worker polls the queue for
-  due entries and hands them to the engine's
+* enqueueing a deadline announces it on a shared pub/sub channel, so
+  every worker's consumer wakes immediately instead of waiting for its
+  next poll; the consumer also wakes on a slow heartbeat, which is the
+  backstop recovering notifications lost to a reconnect or a worker
+  crash. Due entries are handed to the engine's
   :meth:`~tavolo.platform.engine.GameEngine.fire_deadline` under the
   per-game lock; the engine revalidates the token against the live state
   and raises :class:`~tavolo.platform.errors.GameError` when the entry
@@ -65,8 +68,8 @@ class DeadlineScheduler:
     """Enqueue and fire the deadlines game engines ask for.
 
     Holds the store and the registry so a single instance serves every
-    game type. One consumer task (and its wake-up event) is kept per
-    event loop — tests run each test on a fresh loop.
+    game type. One consumer task, its listener task and its wake-up
+    event are kept per event loop — tests run each test on a fresh loop.
 
     ``context_binder`` is an optional async callable the consumer awaits
     before persisting a finished match. The consumer is a long-lived task
@@ -80,14 +83,19 @@ class DeadlineScheduler:
         store: GameStore,
         registry: GameRegistry,
         heartbeat_ms: int = 1000,
+        retry_ms: int = 1000,
         context_binder: Optional[Callable[[], Awaitable[None]]] = None,
     ) -> None:
         self._store = store
         self._registry = registry
         self._heartbeat = heartbeat_ms / 1000
+        # Backoff for entries that failed to process and for listener
+        # reconnects; deliberately independent of the (slow) heartbeat.
+        self._retry_delay = retry_ms / 1000
         self._context_binder = context_binder
         self._consumers: Dict[asyncio.AbstractEventLoop, asyncio.Task] = {}
         self._wake_events: Dict[asyncio.AbstractEventLoop, asyncio.Event] = {}
+        self._listeners: Dict[asyncio.AbstractEventLoop, asyncio.Task] = {}
 
     async def sync_deadline(self, session: GameSession) -> None:
         """Enqueue the deadline the current state implies, if any.
@@ -109,6 +117,16 @@ class DeadlineScheduler:
         self.ensure_consumer()
         due_at = deadline.due_at.timestamp()
         await self._store.add_deadline(encode(entry), due_at)
+        # Announce the enqueue so consumers on other workers wake up too.
+        # The entry is already queued, so a lost notification only delays
+        # their discovery to the next poll backstop.
+        try:
+            await self._store.notify_deadline()
+        except Exception:
+            log.warning(
+                "deadline enqueue notification failed; relying on the poll backstop",
+                exc_info=True,
+            )
         wake = self._wake_events.get(asyncio.get_running_loop())
         if wake is not None:
             wake.set()
@@ -190,15 +208,22 @@ class DeadlineScheduler:
             if old.is_closed():
                 self._consumers.pop(old, None)
                 self._wake_events.pop(old, None)
+                self._listeners.pop(old, None)
         task = self._consumers.get(loop)
         if task is None or task.done():
             self._wake_events[loop] = asyncio.Event()
             self._consumers[loop] = loop.create_task(self._run(loop))
+            listener = self._listeners.get(loop)
+            if listener is None or listener.done():
+                self._listeners[loop] = loop.create_task(self._listen(loop))
             log.debug("deadline consumer started")
 
     def stop_consumer(self, loop: asyncio.AbstractEventLoop) -> None:
         task = self._consumers.pop(loop, None)
         self._wake_events.pop(loop, None)
+        listener = self._listeners.pop(loop, None)
+        if listener is not None:
+            listener.cancel()
         if task is not None:
             task.cancel()
 
@@ -228,21 +253,48 @@ class DeadlineScheduler:
                 log.exception("deadline consumer: poll failed; retrying")
                 failed = True
             if failed:
-                # A failed entry is still due: back off to the heartbeat
-                # instead of polling it again immediately.
-                delay = self._heartbeat
+                # A failed entry is still due: back off briefly instead of
+                # polling it again immediately. Kept independent of the
+                # heartbeat, which is only a slow backstop.
+                delay = self._retry_delay
             try:
                 await asyncio.wait_for(wake.wait(), timeout=delay)
             except asyncio.TimeoutError:
                 pass
 
+    async def _listen(self, loop: asyncio.AbstractEventLoop) -> None:
+        """Wake the consumer on deadline-enqueue notifications.
+
+        The subscription is best effort: a dropped connection or a lost
+        message is recovered by the consumer's heartbeat backstop, so
+        this task only has to reconnect and keep forwarding signals.
+        """
+        while True:
+            try:
+                async with self._store.subscribe_deadlines() as events:
+                    async for _ in events:
+                        wake = self._wake_events.get(loop)
+                        if wake is None:
+                            # Shut down: the consumer is gone.
+                            return
+                        wake.set()
+            except asyncio.CancelledError:
+                raise
+            except Exception:
+                log.exception("deadline listener failed; reconnecting")
+            try:
+                await asyncio.sleep(self._retry_delay)
+            except asyncio.CancelledError:
+                raise
+
 
 class DeadlineSchedulerMixin(KayaMixin):
     """Run the deadline consumer for the whole app lifetime.
 
-    Every worker (and every pod) runs the same consumer; coordination
-    happens exclusively through the shared deadline queue and the
-    per-game locks, so any worker may fire any game's deadline.
+    Every worker (and every pod) runs the same consumer and listener;
+    coordination happens exclusively through the shared deadline queue,
+    its notification channel and the per-game locks, so any worker may
+    fire any game's deadline.
     """
 
     def __init__(self, scheduler: DeadlineScheduler) -> None:

server/packages/tavolo-platform/src/tavolo/platform/engine.py

@@ -191,12 +191,17 @@ class GameEngine(ABC):
         """
 
     @abstractmethod
-    def view_for(self, session: GameSession, user_sub: str) -> Dict[str, Any]:
-        """The personalized game view for one player.
+    def view_for(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
+        """The personalized game view for one viewer.
 
-        Must hide information the player is not entitled to (e.g. other
-        players' hands). The platform merges in the envelope fields
-        (``id``, ``join_code``, ``game_type``) itself.
+        Must hide information the viewer is not entitled to (e.g. other
+        players' hands). ``user_sub`` is ``None`` for a spectator — an
+        anonymous user or an authenticated user who is not seated — and
+        the view must then contain no privileged information either (no
+        hand, no legal moves: only what everyone at the table can see).
+        The platform merges in the envelope fields (``id``,
+        ``join_code`` for seated players, ``game_type``, ``spectator``)
+        itself.
         """
 
     @abstractmethod
@@ -248,6 +253,13 @@ class GameEngine(ABC):
         ``kind``/``token`` no longer match the live state.
         """
 
-    def game_over_view(self, session: GameSession, user_sub: str) -> Dict[str, Any]:
-        """Extra fields merged into the ``game_over`` websocket message."""
+    def game_over_view(
+        self, session: GameSession, user_sub: Optional[str]
+    ) -> Dict[str, Any]:
+        """Extra fields merged into the ``game_over`` websocket message.
+
+        ``user_sub`` is ``None`` for a spectator (see :meth:`view_for`);
+        the default fields are public, so the default implementation
+        ignores it.
+        """
         return {}

server/packages/tavolo-platform/src/tavolo/platform/mixin.py

@@ -2,7 +2,7 @@
 
 ``Platform`` bundles the collaborators every platform endpoint needs —
 the game registry, the live-game store, the deadline scheduler and the
-OIDC mixin used for authentication — so route and websocket modules
+OIDC providers used for authentication — so route and websocket modules
 never reach for module-global state. :class:`PlatformMixin` is a plain
 :class:`~kaya.core.KayaMixin`: applying it registers the lobby, stats
 and health HTTP routes plus the live-play websocket endpoint, and the
@@ -14,7 +14,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 
 from kaya.core import KayaApp, KayaMixin
-from kaya.oidc import OIDCMixin
+from kaya.oidc import OIDCProviders
 
 from .deadlines import DeadlineScheduler
 from .registry import GameRegistry
@@ -28,7 +28,7 @@ class Platform:
     registry: GameRegistry
     game_store: GameStore
     scheduler: DeadlineScheduler
-    oidc: OIDCMixin
+    oidc: OIDCProviders
 
 
 class PlatformMixin(KayaMixin):
@@ -41,9 +41,10 @@ class PlatformMixin(KayaMixin):
         # Imported here so module import order stays acyclic: the route
         # modules reference Platform only for typing.
         from . import ws
-        from .routes import games, health, me, stats
+        from .routes import auth, games, health, me, stats
 
         health.register(app, self.platform)
+        auth.register(app, self.platform)
         me.register(app, self.platform)
         games.register(app, self.platform)
         stats.register(app, self.platform)

server/packages/tavolo-platform/src/tavolo/platform/routes/auth.py

@@ -0,0 +1,62 @@
+"""Authentication plumbing for the single-page app.
+
+kaya-oidc registers one login/callback/logout route per provider
+(``/auth/<provider>/...``); this module adds the provider-agnostic
+pieces:
+
+* ``GET /api/auth/providers`` lists the configured providers with their
+  login URLs, so the SPA can offer a choice without hardcoding names;
+* ``GET /auth/login`` redirects to the first configured provider;
+* ``GET /auth/logout`` redirects to the provider this session is logged
+  in with (or the SPA root when not logged in), so the UI can keep a
+  single logout link.
+"""
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from kaya.core import HttpContext, KayaApp
+from kaya.openapi import operation
+
+from ..http import send_json
+
+if TYPE_CHECKING:
+    from ..mixin import Platform
+
+
+def _login_url(platform: "Platform", provider: str) -> str:
+    return f"{platform.oidc.base_path}/{provider}/login"
+
+
+def register(app: KayaApp, platform: "Platform") -> None:
+    providers = list(platform.oidc.providers)
+
+    @app.GET("/api/auth/providers")
+    @operation(summary="Configured login providers",
+               description="Names and login URLs of the configured OIDC "
+                           "providers, in configuration order.",
+               tags=["auth"],
+               responses={200: {"description": "The configured providers"}})
+    async def auth_providers(ctx: HttpContext) -> None:
+        await send_json(
+            ctx,
+            200,
+            {
+                "providers": [
+                    {"name": name, "login_url": _login_url(platform, name)}
+                    for name in providers
+                ]
+            },
+        )
+
+    @app.GET("/auth/login")
+    async def login(ctx: HttpContext) -> None:
+        await ctx.send_empty(302, {"Location": _login_url(platform, providers[0])})
+
+    @app.GET("/auth/logout")
+    async def logout(ctx: HttpContext) -> None:
+        logged_in = platform.oidc.logged_in_providers(ctx)
+        location = (
+            f"{platform.oidc.base_path}/{logged_in[0]}/logout" if logged_in else "/"
+        )
+        await ctx.send_empty(302, {"Location": location})

server/packages/tavolo-platform/src/tavolo/platform/routes/games.py

@@ -16,12 +16,12 @@ import secrets
 import uuid
 from datetime import datetime, timezone
 from logging import getLogger
-from typing import TYPE_CHECKING, Any, Dict
+from typing import TYPE_CHECKING, Any, Dict, Optional
 
 from kaya.core import HttpContext, KayaApp
 from kaya.openapi import operation
 
-from ..auth import display_name, require_auth
+from ..auth import current_user, display_name, require_auth
 from ..engine import GameSession, Seat
 from ..errors import GameError
 from ..http import (
@@ -71,19 +71,29 @@ def _lobby_payload(platform: "Platform", session: GameSession) -> Dict[str, Any]
             }
             for index, seat in enumerate(session.players)
         ],
-        "seats_open": engine.max_players - len(session.players),
+        "seats_open": max(0, engine.max_players - len(session.players)),
         **engine.lobby_view(session),
     }
 
 
-def _view_payload(platform: "Platform", session: GameSession, sub: str) -> Dict[str, Any]:
+def _view_payload(
+    platform: "Platform", session: GameSession, sub: Optional[str]
+) -> Dict[str, Any]:
     engine = platform.registry.require(session.game_type)
-    return {
+    seated = sub is not None and session.seated(sub)
+    payload: Dict[str, Any] = {
         "id": session.id,
-        "join_code": session.join_code,
         "game_type": session.game_type,
-        **engine.view_for(session, sub),
+        "spectator": not seated,
+        # Free chairs; the lobby view needs it for games with other player
+        # counts than four.
+        "seats_open": max(0, engine.max_players - len(session.players)),
     }
+    if seated:
+        # The join code is a credential: only players get it.
+        payload["join_code"] = session.join_code
+    payload.update(engine.view_for(session, sub))
+    return payload
 
 
 def _preview_payload(platform: "Platform", session: GameSession) -> Dict[str, Any]:
@@ -98,6 +108,34 @@ def _preview_payload(platform: "Platform", session: GameSession) -> Dict[str, An
     }
 
 
+def _ongoing_game_payload(
+    platform: "Platform", session: GameSession, sub: str
+) -> Dict[str, Any]:
+    """One entry of the caller's ongoing-games list.
+
+    Reuses the lobby payload (players, open seats, option echo) but drops
+    the join code — the Continue link only needs the id, and the game page
+    shows the code to its players anyway.
+    """
+    engine = platform.registry.require(session.game_type)
+    payload = _lobby_payload(platform, session)
+    payload.pop("join_code", None)
+    payload["game_name"] = engine.name
+    payload["game_description"] = engine.description
+    payload["your_seat"] = next(
+        (
+            index
+            for index, seat in enumerate(session.players)
+            if seat.user_sub == sub
+        ),
+        None,
+    )
+    payload["created_at"] = (
+        session.created_at.isoformat() if session.created_at else None
+    )
+    return payload
+
+
 def register(app: KayaApp, platform: "Platform") -> None:
     @app.GET("/api/game-types")
     @operation(summary="List available games",
@@ -183,7 +221,7 @@ def register(app: KayaApp, platform: "Platform") -> None:
             await send_error(ctx, 400, "options must be an object")
             return
 
-        user = platform.oidc.get_user(ctx)
+        user = current_user(platform.oidc, ctx)
         assert user is not None  # enforced by @require_auth
         session = GameSession(
             id=str(uuid.uuid4()),
@@ -244,7 +282,7 @@ def register(app: KayaApp, platform: "Platform") -> None:
             await send_error(ctx, 400, "code is required")
             return
 
-        user = platform.oidc.get_user(ctx)
+        user = current_user(platform.oidc, ctx)
         assert user is not None
         existing = await platform.game_store.find_by_code(code)
         if existing is None:
@@ -310,24 +348,48 @@ def register(app: KayaApp, platform: "Platform") -> None:
 
     @app.GET("/api/games/${game_id}")
     @operation(summary="Get a game snapshot",
-               description="Only seated players may read a game; the view is "
-                           "personalized by the engine (e.g. hidden hands).",
+               description="Anyone who knows the game id may read a game. "
+                           "Seated players get the personalized view (their "
+                           "own hand plus the join code); everyone else — "
+                           "anonymous users and authenticated non-players — "
+                           "gets the read-only spectator view: no hands, no "
+                           "join code, just what is public at the table.",
                tags=["games"],
                responses={
-                   200: {"description": "The personalized game state"},
-                   401: {"description": "Authentication required"},
-                   403: {"description": "Not a player in this game"},
+                   200: {"description": "The personalized (player) or "
+                                        "read-only (spectator) game state"},
                    404: {"description": "Game not found"},
                })
-    @require_auth(platform.oidc)
     async def get_game(ctx: HttpContext, game_id: str) -> None:
         session = await platform.game_store.load(game_id)
         if session is None:
             await send_error(ctx, 404, "game not found")
             return
-        user = platform.oidc.get_user(ctx)
-        assert user is not None
-        if not session.seated(user.sub):
-            await send_error(ctx, 403, "forbidden")
-            return
-        await send_json(ctx, 200, _view_payload(platform, session, user.sub))
+        user = current_user(platform.oidc, ctx)
+        await send_json(
+            ctx, 200, _view_payload(platform, session, user.sub if user else None)
+        )
+
+    @app.GET("/api/me/games")
+    @operation(summary="List my ongoing games",
+               description="Live games the caller is seated in — waiting "
+                           "lobbies and matches in progress or between "
+                           "hands — newest first, for the lobby's Continue "
+                           "list. Finished matches are not included.",
+               tags=["games"],
+               responses={
+                   200: {"description": "The caller's ongoing games"},
+                   401: {"description": "Authentication required"},
+               })
+    @require_auth(platform.oidc)
+    async def my_games(ctx: HttpContext) -> None:
+        user = current_user(platform.oidc, ctx)
+        assert user is not None  # enforced by @require_auth
+        sessions = await platform.game_store.list_ongoing()
+        await send_json(ctx, 200, {
+            "results": [
+                _ongoing_game_payload(platform, session, user.sub)
+                for session in sessions
+                if session.seated(user.sub)
+            ]
+        })

server/packages/tavolo-platform/src/tavolo/platform/routes/me.py

@@ -6,7 +6,7 @@ from typing import TYPE_CHECKING
 from kaya.core import HttpContext, KayaApp
 from kaya.openapi import operation
 
-from ..auth import display_name, require_auth
+from ..auth import current_user, display_name, require_auth
 from ..http import send_json
 
 if TYPE_CHECKING:
@@ -25,6 +25,6 @@ def register(app: KayaApp, platform: "Platform") -> None:
                })
     @require_auth(platform.oidc)
     async def me(ctx: HttpContext) -> None:
-        user = platform.oidc.get_user(ctx)
+        user = current_user(platform.oidc, ctx)
         assert user is not None  # enforced by @require_auth
         await send_json(ctx, 200, {"sub": user.sub, "name": display_name(user)})

server/packages/tavolo-platform/src/tavolo/platform/routes/stats.py

@@ -15,7 +15,7 @@ from uuid import UUID
 from kaya.core import HttpContext, KayaApp
 from kaya.openapi import operation
 
-from ..auth import require_auth
+from ..auth import current_user, require_auth
 from ..elo import INITIAL_RATING
 from ..http import extract_query_params, send_error, send_json
 from ..models import Match, MatchPlayer, PlayerRating
@@ -104,7 +104,7 @@ def register(app: KayaApp, platform: "Platform") -> None:
         if error is not None:
             await send_error(ctx, 400, error)
             return
-        user = platform.oidc.get_user(ctx)
+        user = current_user(platform.oidc, ctx)
         assert user is not None
         queryset = Match.filter(players__user_sub=user.sub).distinct()
         if game_type is not None:
@@ -193,7 +193,7 @@ def register(app: KayaApp, platform: "Platform") -> None:
                })
     @require_auth(platform.oidc)
     async def my_ratings(ctx: HttpContext) -> None:
-        user = platform.oidc.get_user(ctx)
+        user = current_user(platform.oidc, ctx)
         assert user is not None
         rows = await PlayerRating.filter(user_sub=user.sub).order_by("game_type")
         await send_json(ctx, 200, {

server/packages/tavolo-platform/src/tavolo/platform/store.py

@@ -26,8 +26,9 @@ signal (never the state) means updated state reaches connections on
 every worker without leaking hidden information into the channel.
 
 Timeouts are driven by a shared delayed-deadline queue: producers
-enqueue an opaque ``member`` string with a due timestamp, and a consumer
-on every worker polls for due entries (see
+enqueue an opaque ``member`` string with a due timestamp and announce it
+on a shared "deadline enqueued" channel, and a consumer on every worker
+wakes on that signal to process due entries (see
 :mod:`tavolo.platform.deadlines`). Delivery is at-least-once — entries
 are removed only after they are processed — so a worker dying
 mid-processing cannot lose a deadline; engines revalidate entries
@@ -40,7 +41,7 @@ import contextlib
 import json
 import time
 from abc import ABC, abstractmethod
-from datetime import datetime
+from datetime import datetime, timezone
 from logging import getLogger
 from typing import Any, AsyncContextManager, AsyncIterator, Dict, List, Mapping, Optional, Set, cast
 
@@ -55,6 +56,9 @@ GAME_KEY_PREFIX = "tavolo:game:"
 CODE_KEY_PREFIX = "tavolo:code:"
 CHANNEL_PREFIX = "tavolo:game:"
 DEADLINES_KEY = "tavolo:deadlines"
+# Channel announcing newly enqueued deadline entries, so every worker's
+# consumer can wake immediately instead of polling on its heartbeat.
+DEADLINES_CHANNEL = "tavolo:deadlines:events"
 # Sorted set of running games (score = expiry timestamp), maintained by the
 # stores so the telemetry gauge can count ongoing matches without loading
 # every session. Finished games are removed on their final save.
@@ -68,6 +72,15 @@ def _dt_to_json(value: Optional[datetime]) -> Optional[str]:
     return value.isoformat() if value is not None else None
 
 
+def _created_at_key(session: GameSession) -> datetime:
+    """Sort key for :meth:`GameStore.list_ongoing` (newest first).
+
+    Sessions without a creation timestamp sort last; the epoch sentinel is
+    timezone-aware so it never mixes with the stored UTC datetimes.
+    """
+    return session.created_at or datetime.min.replace(tzinfo=timezone.utc)
+
+
 def _dt_from_json(value: Any) -> Optional[datetime]:
     if not value:
         return None
@@ -133,6 +146,15 @@ class GameStore(ABC):
         still retained for the final-board view do not.
         """
 
+    @abstractmethod
+    async def list_ongoing(self, limit: int = 20) -> List[GameSession]:
+        """Return up to ``limit`` live games that have not finished yet.
+
+        Newest ``created_at`` first. Sessions whose key has expired are
+        skipped, and so are matches that are over but still retained for
+        the final-board view.
+        """
+
     @abstractmethod
     def lock(self, game_id: str) -> AsyncContextManager[None]:
         """Async context manager serializing mutations of one game."""
@@ -165,6 +187,18 @@ class GameStore(ABC):
     async def remove_deadline(self, member: str) -> None:
         """Remove ``member`` from the queue; a no-op when absent."""
 
+    @abstractmethod
+    async def notify_deadline(self) -> None:
+        """Wake every worker's deadline consumer (best effort).
+
+        Notification is advisory: consumers stay correct when a signal
+        is lost, because their poll backstop recovers it.
+        """
+
+    @abstractmethod
+    def subscribe_deadlines(self) -> AsyncContextManager[AsyncIterator[None]]:
+        """Async context manager yielding deadline-enqueue signals."""
+
 
 def _channel(game_id: str) -> str:
     return f"{CHANNEL_PREFIX}{game_id}:events"
@@ -225,6 +259,27 @@ class RedisGameStore(GameStore):
             _, count = await pipe.execute()
         return int(count)
 
+    async def list_ongoing(self, limit: int = 20) -> List[GameSession]:
+        await self._redis.zremrangebyscore(
+            ONGOING_GAMES_KEY, "-inf", time.time()
+        )
+        members = await self._redis.zrange(ONGOING_GAMES_KEY, 0, -1)
+        sessions: List[GameSession] = []
+        for member in members:
+            game_id = (
+                member.decode("utf-8") if isinstance(member, bytes) else str(member)
+            )
+            session = await self.load(game_id)
+            if session is None:
+                # The game key expired but the ongoing entry had not been
+                # pruned yet: skip it.
+                continue
+            if self._registry.require(session.game_type).is_finished(session):
+                continue
+            sessions.append(session)
+        sessions.sort(key=_created_at_key, reverse=True)
+        return sessions[:limit]
+
     @contextlib.asynccontextmanager
     async def subscribe(self, game_id: str) -> AsyncIterator[AsyncIterator[None]]:
         pubsub = self._redis.pubsub()
@@ -244,10 +299,17 @@ class RedisGameStore(GameStore):
         await self._redis.zadd(DEADLINES_KEY, {member: due_at})
 
     async def due_deadlines(self, now: float, limit: int = 32) -> List[str]:
+        # ``ZRANGE ... BYSCORE`` is the non-deprecated spelling of the
+        # old ``ZRANGEBYSCORE``.
         members = cast(
             list,
-            await self._redis.zrangebyscore(
-                DEADLINES_KEY, "-inf", now, start=0, num=limit
+            await self._redis.zrange(
+                DEADLINES_KEY,
+                "-inf",
+                now,
+                byscore=True,
+                offset=0,
+                num=limit,
             ),
         )
         return [m.decode("utf-8") if isinstance(m, bytes) else m for m in members]
@@ -259,6 +321,20 @@ class RedisGameStore(GameStore):
     async def remove_deadline(self, member: str) -> None:
         await self._redis.zrem(DEADLINES_KEY, member)
 
+    async def notify_deadline(self) -> None:
+        await self._redis.publish(DEADLINES_CHANNEL, "deadline")
+
+    @contextlib.asynccontextmanager
+    async def subscribe_deadlines(self) -> AsyncIterator[AsyncIterator[None]]:
+        pubsub = self._redis.pubsub()
+        await pubsub.subscribe(DEADLINES_CHANNEL)
+        try:
+            yield _redis_events(pubsub)
+        finally:
+            with contextlib.suppress(Exception):
+                await pubsub.unsubscribe(DEADLINES_CHANNEL)
+                await pubsub.aclose()
+
 
 async def _redis_events(pubsub) -> AsyncIterator[None]:
     async for message in pubsub.listen():
@@ -277,6 +353,7 @@ class InMemoryGameStore(GameStore):
         self._locks: Dict[str, asyncio.Lock] = {}
         self._subscribers: Dict[str, Set[asyncio.Queue]] = {}
         self._deadlines: Dict[str, float] = {}
+        self._deadline_subscribers: Set[asyncio.Queue] = set()
 
     def _lock_for(self, game_id: str) -> asyncio.Lock:
         lock = self._locks.get(game_id)
@@ -314,6 +391,18 @@ class InMemoryGameStore(GameStore):
     async def count_ongoing(self) -> int:
         return len(self._ongoing)
 
+    async def list_ongoing(self, limit: int = 20) -> List[GameSession]:
+        sessions: List[GameSession] = []
+        for game_id in list(self._ongoing):
+            session = await self.load(game_id)
+            if session is None:
+                continue
+            if self._registry.require(session.game_type).is_finished(session):
+                continue
+            sessions.append(session)
+        sessions.sort(key=_created_at_key, reverse=True)
+        return sessions[:limit]
+
     @contextlib.asynccontextmanager
     async def subscribe(self, game_id: str) -> AsyncIterator[AsyncIterator[None]]:
         queue: asyncio.Queue = asyncio.Queue()
@@ -345,6 +434,19 @@ class InMemoryGameStore(GameStore):
     async def remove_deadline(self, member: str) -> None:
         self._deadlines.pop(member, None)
 
+    async def notify_deadline(self) -> None:
+        for queue in list(self._deadline_subscribers):
+            queue.put_nowait(_BUMP)
+
+    @contextlib.asynccontextmanager
+    async def subscribe_deadlines(self) -> AsyncIterator[AsyncIterator[None]]:
+        queue: asyncio.Queue = asyncio.Queue()
+        self._deadline_subscribers.add(queue)
+        try:
+            yield _queue_events(queue)
+        finally:
+            self._deadline_subscribers.discard(queue)
+
 
 async def _queue_events(queue: asyncio.Queue) -> AsyncIterator[None]:
     while True:

server/packages/tavolo-platform/src/tavolo/platform/ws.py

@@ -2,12 +2,21 @@
 
 Clients connect to ``/ws/games/{game_id}`` using their session cookie
 (the OIDC login stores the user in the session, which the session mixin
-loads onto the websocket). Only seated players are accepted.
+loads onto the websocket). Anyone who knows the game id is accepted:
+seated players get their personalized view, everyone else — anonymous
+users and authenticated users who are not seated — is a read-only
+**spectator** receiving the view without privileged information (no
+hands, no legal moves). The game view carries ``spectator: true`` for
+them and never carries the join code. Spectator actions other than
+``state``/``sync`` are rejected with a ``forbidden`` error; seating is
+re-checked under the game lock so a viewer who joins mid-connection
+immediately gains (and, if they somehow left, would lose) the right to
+act.
 
-The platform owns the connection lifecycle — authentication, seat
-check, the subscription/publish fan-out and the message envelope — and
-delegates the game-specific actions to the engine registered for the
-session's ``game_type``.
+The platform owns the connection lifecycle — authentication, the
+subscription/publish fan-out and the message envelope — and delegates
+the game-specific actions to the engine registered for the session's
+``game_type``.
 
 Protocol
 --------
@@ -27,9 +36,10 @@ Client -> server messages are JSON objects::
 
 For scopone scientifico the game actions are ``play`` (with ``card``
 and optionally ``capture``) and ``ack`` — see
-:mod:`tavolo.scopone.plugin`. Because the whole message (minus
-``action``) is handed to the engine as the payload, games define their
-own fields freely.
+:mod:`tavolo.scopone.plugin`; briscola uses ``play`` with just ``card``
+plus ``ack`` — see :mod:`tavolo.briscola.plugin`. Because the whole
+message (minus ``action``) is handed to the engine as the payload, games
+define their own fields freely.
 
 Mutations run under the per-game lock; after a successful action the new
 session is saved and a change signal is published. Every connected
@@ -48,9 +58,9 @@ import asyncio
 import json
 from contextlib import suppress
 from logging import getLogger
-from typing import TYPE_CHECKING, Any, Awaitable, Callable, Dict
+from typing import TYPE_CHECKING, Any, Awaitable, Callable, Dict, Optional
 
-from kaya.core import KayaApp, WebSocket
+from kaya.core import KayaApp, WebSocket, WebSocketDisconnect
 
 from . import auth
 from .engine import GameSession
@@ -68,17 +78,39 @@ def _error(message: str, code: str = "invalid") -> Dict[str, Any]:
     return {"type": "error", "code": code, "message": message}
 
 
-def _state_message(platform: "Platform", session: GameSession, sub: str) -> Dict[str, Any]:
+async def _reject(ws: WebSocket, status: int) -> None:
+    """Refuse a websocket upgrade with the HTTP ``status``.
+
+    Rejections happen before :meth:`WebSocket.accept`, so ``close()``
+    carries the HTTP status of the refused upgrade rather than a
+    WebSocket close code: ASGI servers answer ``403`` per the spec, and
+    RSGI (granian) uses the value verbatim as the response status.
+    Passing a 4xxx close code here would panic granian's RSGI layer on
+    the invalid status — and since granian is built with
+    ``panic = "abort"``, that kills the worker and takes the whole app
+    down.
+    """
+    await ws.close(status)
+
+
+def _state_message(
+    platform: "Platform", session: GameSession, sub: Optional[str]
+) -> Dict[str, Any]:
     engine = platform.registry.require(session.game_type)
-    return {
-        "type": "state",
-        "game": {
-            "id": session.id,
-            "join_code": session.join_code,
-            "game_type": session.game_type,
-            **engine.view_for(session, sub),
-        },
+    seated = sub is not None and session.seated(sub)
+    payload: Dict[str, Any] = {
+        "id": session.id,
+        "game_type": session.game_type,
+        "spectator": not seated,
+        # Free chairs; the lobby view needs it for games with other player
+        # counts than four.
+        "seats_open": max(0, engine.max_players - len(session.players)),
     }
+    if seated:
+        # The join code is a credential: only players get it.
+        payload["join_code"] = session.join_code
+    payload.update(engine.view_for(session, sub))
+    return {"type": "state", "game": payload}
 
 
 def register(app: KayaApp, platform: "Platform") -> None:
@@ -86,32 +118,33 @@ def register(app: KayaApp, platform: "Platform") -> None:
 
     @app.websocket("/ws/games/${game_id}")
     async def game_socket(ws: WebSocket, game_id: str) -> None:
+        # Anonymous and non-seated viewers are welcome as read-only
+        # spectators; only an unknown game id is refused.
         user = auth.get_ws_user(ws)
-        if user is None:
-            log.debug("websocket %s rejected: no authenticated user", game_id)
-            await ws.close(4401)
-            return
+        sub: Optional[str] = user.sub if user is not None else None
 
         session = await platform.game_store.load(game_id)
         if session is None:
             log.debug("websocket rejected: unknown game %s", game_id)
-            await ws.close(4404)
-            return
-        if not session.seated(user.sub):
-            log.debug("websocket %s rejected: %s is not seated", game_id, user.sub)
-            await ws.close(4403)
+            await _reject(ws, 404)
             return
 
         await ws.accept()
-        log.info("%s connected to game %s", user.sub, game_id)
+        log.info("%s connected to game %s", sub or "spectator", game_id)
 
         send_lock = asyncio.Lock()
 
         async def send(payload: Dict[str, Any]) -> None:
             async with send_lock:
-                await ws.send_text(json.dumps(payload))
+                try:
+                    await ws.send_text(json.dumps(payload))
+                except WebSocketDisconnect:
+                    # The peer went away without a close handshake: kaya
+                    # raises this from the transport, and the receive loop
+                    # ends momentarily.
+                    pass
 
-        await send(_state_message(platform, session, user.sub))
+        await send(_state_message(platform, session, sub))
         # Backstop: make sure the current deadline is queued even if its
         # entry was lost (e.g. the queue was flushed while the game lived
         # on thanks to its sliding TTL).
@@ -119,7 +152,7 @@ def register(app: KayaApp, platform: "Platform") -> None:
 
         async with platform.game_store.subscribe(game_id) as events:
             forward = asyncio.create_task(
-                _forward(platform, events, game_id, user.sub, send)
+                _forward(platform, events, game_id, sub, send)
             )
             try:
                 async for message in ws:
@@ -128,19 +161,19 @@ def register(app: KayaApp, platform: "Platform") -> None:
                     if message.kind != "text" or not isinstance(message.data, str):
                         await send(_error("expected a text frame with a JSON object"))
                         continue
-                    await _handle_message(platform, send, game_id, user.sub, message.data)
+                    await _handle_message(platform, send, game_id, sub, message.data)
             finally:
                 forward.cancel()
                 with suppress(asyncio.CancelledError):
                     await forward
-                log.debug("%s disconnected from game %s", user.sub, game_id)
+                log.debug("%s disconnected from game %s", sub or "spectator", game_id)
 
 
 async def _forward(
     platform: "Platform",
     events,
     game_id: str,
-    sub: str,
+    sub: Optional[str],
     send: Send,
 ) -> None:
     async for _ in events:
@@ -160,7 +193,7 @@ async def _forward(
 
 
 async def _handle_message(
-    platform: "Platform", send: Send, game_id: str, sub: str, raw: str
+    platform: "Platform", send: Send, game_id: str, sub: Optional[str], raw: str
 ) -> None:
     try:
         data = json.loads(raw)
@@ -189,7 +222,7 @@ async def _handle_action(
     platform: "Platform",
     send: Send,
     game_id: str,
-    sub: str,
+    sub: Optional[str],
     action: str,
     data: Dict[str, Any],
 ) -> None:
@@ -198,6 +231,13 @@ async def _handle_action(
         if session is None:
             await send(_error("game not found", code="not_found"))
             return
+        # Re-check seating under the lock: an anonymous spectator stays a
+        # spectator forever, while a logged-in viewer who joins the game
+        # mid-connection becomes a player and may act from then on.
+        if sub is None or not session.seated(sub):
+            log.debug("game %s: rejected %r from a spectator", game_id, action)
+            await send(_error("spectators cannot act on the game", code="forbidden"))
+            return
         engine = platform.registry.require(session.game_type)
         payload = {key: value for key, value in data.items() if key != "action"}
         try:

server/packages/tavolo-platform/tests/helpers.py

@@ -8,7 +8,7 @@ without importing any real game. Its rules: the first player to reach
 ``target`` plays wins the match.
 
 :func:`make_platform` builds a throwaway :class:`~kaya.core.KayaApp`
-wired with in-memory stores, a dummy OIDC mixin (patched per test) and
+wired with in-memory stores, dummy OIDC providers (patched per test) and
 a sqlite :class:`~tavolo.platform.tortoise_mixin.TortoiseMixin`, so
 tests construct their own app instead of importing a global one.
 """
@@ -22,7 +22,7 @@ from functools import wraps
 from typing import Any, Callable, Coroutine, Dict, Iterator, List, Mapping, Optional, Sequence, Tuple
 
 from kaya.core import KayaApp
-from kaya.oidc import OIDCConfig, OIDCMixin, OIDCUser
+from kaya.oidc import OIDCConfig, OIDCProviders, OIDCUser
 from kaya.openapi import OpenAPIMixin
 from kaya.session import InMemorySessionStore, SessionMixin
 
@@ -138,7 +138,7 @@ class DummyEngine(GameEngine):
             state["finished"] = True
             state["winner"] = user_sub
 
-    def view_for(self, session: GameSession, user_sub: str) -> Dict[str, Any]:
+    def view_for(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
         state = session.state
         return {
             "started": state["started"],
@@ -146,7 +146,7 @@ class DummyEngine(GameEngine):
             "winner": state["winner"],
             "plays": len(state["plays"]),
             "target": state["target"],
-            "viewer_seated": session.seated(user_sub),
+            "viewer_seated": user_sub is not None and session.seated(user_sub),
         }
 
     def lobby_view(self, session: GameSession) -> Dict[str, Any]:
@@ -220,20 +220,26 @@ class DummyEngine(GameEngine):
 
 def make_platform(
     engines: Sequence[GameEngine] = (DummyEngine(),),
+    heartbeat_ms: int = 50,
+    oidc_providers: Sequence[str] = ("default",),
 ) -> Tuple[KayaApp, Platform, TortoiseMixin]:
     """Build a throwaway app + platform wired with in-memory stores."""
     registry = GameRegistry(engines)
     game_store = InMemoryGameStore(registry)
     session_mixin = SessionMixin(InMemorySessionStore())
-    oidc_mixin = OIDCMixin(
-        OIDCConfig(
-            issuer="http://localhost:8180/tavolo",
-            client_id="tavolo",
-            client_secret=None,
-            redirect_uri="http://localhost:8080/auth/callback",
-            post_login_redirect="/",
-            post_logout_redirect="/",
-        ),
+    oidc = OIDCProviders(
+        [
+            OIDCConfig(
+                provider=name,
+                issuer=f"http://localhost:8180/{name}",
+                client_id="tavolo",
+                client_secret=None,
+                redirect_uri=f"http://localhost:8080/auth/{name}/callback",
+                post_login_redirect="/",
+                post_logout_redirect="/",
+            )
+            for name in oidc_providers
+        ],
         session=session_mixin,
     )
     tortoise_mixin = TortoiseMixin(
@@ -251,19 +257,19 @@ def make_platform(
     scheduler = DeadlineScheduler(
         game_store,
         registry,
-        heartbeat_ms=50,
+        heartbeat_ms=heartbeat_ms,
         context_binder=tortoise_mixin.ensure_context,
     )
     platform = Platform(
         registry=registry,
         game_store=game_store,
         scheduler=scheduler,
-        oidc=oidc_mixin,
+        oidc=oidc,
     )
     app = KayaApp(
         mixins=[
             session_mixin,
-            oidc_mixin,
+            oidc,
             tortoise_mixin,
             openapi_mixin,
             PlatformMixin(platform),
@@ -319,10 +325,12 @@ def make_user(sub: str, name: Optional[str] = None) -> OIDCUser:
 
 
 @contextlib.contextmanager
-def oidc_user(oidc: OIDCMixin, sub: str, name: Optional[str] = None) -> Iterator[OIDCUser]:
-    """Context manager: patch ``oidc.get_user`` to return this user."""
+def oidc_user(oidc: OIDCProviders, sub: str, name: Optional[str] = None) -> Iterator[OIDCUser]:
+    """Context manager: make ``oidc.get_users`` return this user for the
+    first configured provider."""
     user = make_user(sub, name)
-    patcher = _mock.patch.object(oidc, "get_user", return_value=user)
+    provider = next(iter(oidc.providers))
+    patcher = _mock.patch.object(oidc, "get_users", return_value={provider: user})
     patcher.start()
     try:
         yield user

server/packages/tavolo-platform/tests/test_auth.py

@@ -0,0 +1,184 @@
+"""Tests for the auth helpers' OIDC user lookup and gating.
+
+kaya-oidc (0.0.6) namespaces session state per provider as
+``oidc:{provider}:user`` and tavolo wires an :class:`OIDCProviders`; these
+tests pin both contracts so a kaya upgrade or a provider change cannot
+silently break HTTP or websocket authentication.
+"""
+from __future__ import annotations
+
+import unittest
+from types import SimpleNamespace
+from typing import Any
+
+from kaya.oidc import OIDCConfig, OIDCProviders, OIDCUser
+from kaya.session import InMemorySessionStore, Session, SessionMixin
+
+from helpers import async_test
+from tavolo.platform.auth import (
+    current_user,
+    display_name,
+    get_ws_user,
+    require_auth,
+    session_user,
+)
+
+
+def _providers(*names: str) -> OIDCProviders:
+    session = SessionMixin(InMemorySessionStore())
+    return OIDCProviders(
+        [
+            OIDCConfig(
+                provider=name,
+                issuer=f"http://localhost:8180/{name}",
+                client_id="tavolo",
+                redirect_uri=f"http://localhost:8080/auth/{name}/callback",
+            )
+            for name in names
+        ],
+        session=session,
+    )
+
+
+def _ctx(data: Any) -> Any:
+    return SimpleNamespace(session=Session("sid", data))
+
+
+def _ws(session: Any) -> Any:
+    return SimpleNamespace(session=session)
+
+
+class SessionUserTest(unittest.TestCase):
+    def test_finds_default_provider_user(self) -> None:
+        user = session_user(Session("sid", {"oidc:default:user": {"sub": "alice"}}))
+        assert user is not None
+        self.assertEqual("alice", user.sub)
+
+    def test_finds_user_of_any_provider(self) -> None:
+        user = session_user(Session("sid", {"oidc:google:user": {"sub": "alice"}}))
+        assert user is not None
+        self.assertEqual("alice", user.sub)
+
+    def test_ignores_flow_state_and_tokens(self) -> None:
+        session = Session(
+            "sid",
+            {
+                "oidc:default:state": "state",
+                "oidc:default:id_token": "token",
+                "oidc:default:access_token": "token",
+            },
+        )
+        self.assertIsNone(session_user(session))
+
+    def test_ignores_legacy_unprefixed_user_key(self) -> None:
+        session = Session("sid", {"oidc_user": {"sub": "alice"}})
+        self.assertIsNone(session_user(session))
+
+    def test_ignores_malformed_user_claims(self) -> None:
+        session = Session("sid", {"oidc:default:user": "alice"})
+        self.assertIsNone(session_user(session))
+
+
+class GetWsUserTest(unittest.TestCase):
+    def test_returns_user_from_provider_namespaced_session(self) -> None:
+        session = Session(
+            "sid",
+            {"oidc:default:user": {"sub": "alice", "preferred_username": "Alice"}},
+        )
+        user = get_ws_user(_ws(session))
+        assert user is not None
+        self.assertEqual("alice", user.sub)
+
+    def test_missing_session_returns_none(self) -> None:
+        self.assertIsNone(get_ws_user(SimpleNamespace()))
+
+
+class DisplayNameTest(unittest.TestCase):
+    """The claim priority used for the name shown at the table."""
+
+    def test_prefers_preferred_username_over_name(self) -> None:
+        user = OIDCUser(
+            {"sub": "alice", "preferred_username": "alice", "name": "Alice"}
+        )
+        self.assertEqual("alice", display_name(user))
+
+    def test_falls_back_to_name(self) -> None:
+        user = OIDCUser({"sub": "alice", "name": "Alice"})
+        self.assertEqual("Alice", display_name(user))
+
+    def test_falls_back_to_email(self) -> None:
+        user = OIDCUser({"sub": "alice", "email": "alice@example.com"})
+        self.assertEqual("alice@example.com", display_name(user))
+
+    def test_falls_back_to_sub(self) -> None:
+        user = OIDCUser({"sub": "alice"})
+        self.assertEqual("alice", display_name(user))
+
+    def test_ignores_empty_and_non_string_claims(self) -> None:
+        user = OIDCUser({"sub": "alice", "preferred_username": "", "name": 42})
+        self.assertEqual("alice", display_name(user))
+
+
+class CurrentUserTest(unittest.TestCase):
+    def test_anonymous_session_has_no_user(self) -> None:
+        self.assertIsNone(current_user(_providers("default"), _ctx({})))
+
+    def test_returns_the_authenticated_provider_user(self) -> None:
+        user = current_user(
+            _providers("default", "google"),
+            _ctx({"oidc:google:user": {"sub": "alice"}}),
+        )
+        assert user is not None
+        self.assertEqual("alice", user.sub)
+
+    def test_first_configured_provider_wins(self) -> None:
+        # Single-identity sessions never hold two users; this only pins the
+        # tie-break should they ever coexist.
+        user = current_user(
+            _providers("default", "google"),
+            _ctx(
+                {
+                    "oidc:default:user": {"sub": "alice"},
+                    "oidc:google:user": {"sub": "bob"},
+                }
+            ),
+        )
+        assert user is not None
+        self.assertEqual("alice", user.sub)
+
+
+class RequireAuthTest(unittest.TestCase):
+    @async_test
+    async def test_rejects_anonymous_requests(self) -> None:
+        oidc = _providers("default")
+        ctx = _ctx({})
+        sent = {}
+
+        async def send_bytes(*args: Any) -> None:
+            sent["status"] = args[0]
+
+        ctx.send_bytes = send_bytes
+        handled = []
+
+        @require_auth(oidc)
+        async def handler(_ctx: Any) -> None:
+            handled.append(True)
+
+        await handler(ctx)
+        self.assertEqual(401, sent["status"])
+        self.assertEqual([], handled)
+
+    @async_test
+    async def test_allows_authenticated_requests(self) -> None:
+        oidc = _providers("default")
+        ctx = _ctx({"oidc:default:user": {"sub": "alice"}})
+        handled = []
+
+        @require_auth(oidc)
+        async def handler(request_ctx: Any) -> None:
+            user = current_user(oidc, request_ctx)
+            assert user is not None
+            handled.append(user.sub)
+
+        await handler(ctx)
+        self.assertEqual(["alice"], handled)

server/packages/tavolo-platform/tests/test_deadlines.py

@@ -112,6 +112,38 @@ async def _finished(store, game_id: str) -> Optional[GameSession]:
     return None
 
 
+class NotificationTest(unittest.TestCase):
+    """Deadline-enqueue notifications wake consumers on other workers."""
+
+    @async_test
+    async def test_notification_wakes_a_long_heartbeat_consumer(self) -> None:
+        # The consumer's heartbeat is a minute away and nothing sets its
+        # local wake event: only the pub/sub notification can deliver the
+        # deadline in time. This is the cross-worker path.
+        _, platform, _ = make_platform(heartbeat_ms=60_000)
+        store = platform.game_store
+        scheduler = platform.scheduler
+        session = _started_session(deadline_in_seconds=0.1)
+        await store.save(session)
+        scheduler.ensure_consumer()
+        # Let the listener task subscribe before announcing.
+        await asyncio.sleep(0.05)
+
+        engine = platform.registry.require(session.game_type)
+        deadline = engine.next_deadline(session)
+        assert deadline is not None
+        member = encode({
+            "game_id": session.id,
+            "kind": deadline.kind,
+            "token": deadline.token,
+        })
+        await store.add_deadline(member, deadline.due_at.timestamp())
+        await store.notify_deadline()
+
+        result = await _wait_for(lambda: _plays_is(store, session.id, 1))
+        self.assertIsNotNone(result, "notification did not wake the consumer")
+
+
 class ProcessDueTest(unittest.TestCase):
     """Direct ``process_due`` behaviour: engine revalidation and idempotency."""
 

server/packages/tavolo-platform/tests/test_routes.py

@@ -44,10 +44,24 @@ class GamesRouteTest(unittest.TestCase):
             self.assertEqual(game_id, snap["id"])
             self.assertEqual("dummy", snap["game_type"])
             self.assertTrue(snap["viewer_seated"])
+            self.assertFalse(snap["spectator"])
+            self.assertIn("join_code", snap)
 
+            # A logged-in non-player is a read-only spectator: the view
+            # marks it and the join code is withheld.
             with oidc_user(platform.oidc, "mallory"):
-                forbidden = await client.get(f"/api/games/{game_id}")
-            self.assertEqual(403, forbidden.status_code)
+                watched = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, watched.status_code)
+            spect = watched.json()
+            self.assertFalse(spect["viewer_seated"])
+            self.assertTrue(spect["spectator"])
+            self.assertNotIn("join_code", spect)
+
+            # Anonymous users may watch too.
+            anonymous = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, anonymous.status_code)
+            self.assertTrue(anonymous.json()["spectator"])
+            self.assertNotIn("join_code", anonymous.json())
 
     @async_test
     async def test_join_starts_game(self) -> None:
@@ -174,6 +188,63 @@ class GamesRouteTest(unittest.TestCase):
                 response = await client.get("/api/games/does-not-exist")
             self.assertEqual(404, response.status_code)
 
+    @async_test
+    async def test_my_games_lists_only_my_ongoing_games(self) -> None:
+        app, platform, _ = make_platform()
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            anonymous = await client.get("/api/me/games")
+            self.assertEqual(401, anonymous.status_code)
+
+            with oidc_user(platform.oidc, "alice"):
+                mine = await client.post(
+                    "/api/games", json={"options": {"target": 5}}
+                )
+            with oidc_user(platform.oidc, "bob"):
+                theirs = await client.post("/api/games", json={})
+            self.assertEqual(201, mine.status_code)
+            self.assertEqual(201, theirs.status_code)
+
+            with oidc_user(platform.oidc, "alice"):
+                listed = await client.get("/api/me/games")
+            self.assertEqual(200, listed.status_code)
+            results = listed.json()["results"]
+            self.assertEqual([mine.json()["id"]], [g["id"] for g in results])
+            entry = results[0]
+            self.assertEqual("dummy", entry["game_type"])
+            self.assertEqual("Dummy game", entry["game_name"])
+            self.assertTrue(entry["game_description"])
+            self.assertEqual("lobby", entry["phase"])
+            self.assertEqual(5, entry["target"])
+            self.assertEqual(1, entry["seats_open"])
+            self.assertEqual(0, entry["your_seat"])
+            self.assertNotIn("join_code", entry)
+            self.assertEqual("alice", entry["players"][0]["sub"])
+
+            # Bob's own game is the only one he sees; Alice's is not his.
+            with oidc_user(platform.oidc, "bob"):
+                bobs = await client.get("/api/me/games")
+            self.assertEqual(
+                [theirs.json()["id"]],
+                [g["id"] for g in bobs.json()["results"]],
+            )
+
+            # Once Bob joins Alice's game it appears for both, now in the
+            # playing phase.
+            with oidc_user(platform.oidc, "bob"):
+                await client.post(
+                    "/api/games/join", json={"code": mine.json()["join_code"]}
+                )
+            with oidc_user(platform.oidc, "bob"):
+                bobs = await client.get("/api/me/games")
+            by_id = {g["id"]: g for g in bobs.json()["results"]}
+            self.assertEqual(
+                {mine.json()["id"], theirs.json()["id"]}, set(by_id)
+            )
+            self.assertEqual("playing", by_id[mine.json()["id"]]["phase"])
+            self.assertEqual(1, by_id[mine.json()["id"]]["your_seat"])
+            self.assertEqual(0, by_id[mine.json()["id"]]["seats_open"])
+
 
 class GameTypesRouteTest(unittest.TestCase):
     @async_test

server/packages/tavolo-platform/tests/test_routes_auth.py

@@ -0,0 +1,67 @@
+"""Tests for the provider-agnostic auth routes.
+
+``GET /api/auth/providers`` feeds the SPA's login buttons; ``/auth/login``
+and ``/auth/logout`` are the generic aliases that redirect to the right
+per-provider kaya route.
+"""
+from __future__ import annotations
+
+import unittest
+from unittest import mock
+
+from httpx import ASGITransport, AsyncClient
+
+from helpers import async_test, make_platform
+
+
+class AuthProvidersRouteTest(unittest.TestCase):
+    @async_test
+    async def test_lists_providers_in_configuration_order(self) -> None:
+        app, _platform, _tortoise = make_platform(oidc_providers=("default", "google"))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            response = await client.get("/api/auth/providers")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual(
+            {
+                "providers": [
+                    {"name": "default", "login_url": "/auth/default/login"},
+                    {"name": "google", "login_url": "/auth/google/login"},
+                ]
+            },
+            response.json(),
+        )
+
+
+class GenericAuthRedirectTest(unittest.TestCase):
+    @async_test
+    async def test_login_redirects_to_the_first_provider(self) -> None:
+        app, _platform, _tortoise = make_platform(oidc_providers=("google", "github"))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            response = await client.get("/auth/login", follow_redirects=False)
+        self.assertEqual(302, response.status_code)
+        self.assertEqual("/auth/google/login", response.headers["location"])
+
+    @async_test
+    async def test_logout_redirects_to_the_logged_in_provider(self) -> None:
+        app, platform, _tortoise = make_platform()
+        with mock.patch.object(
+            platform.oidc, "logged_in_providers", return_value=["default"]
+        ):
+            transport = ASGITransport(app=app)
+            async with AsyncClient(
+                transport=transport, base_url="http://127.0.0.1"
+            ) as client:
+                response = await client.get("/auth/logout", follow_redirects=False)
+        self.assertEqual(302, response.status_code)
+        self.assertEqual("/auth/default/logout", response.headers["location"])
+
+    @async_test
+    async def test_logout_without_a_session_redirects_home(self) -> None:
+        app, _platform, _tortoise = make_platform()
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            response = await client.get("/auth/logout", follow_redirects=False)
+        self.assertEqual(302, response.status_code)
+        self.assertEqual("/", response.headers["location"])

server/packages/tavolo-platform/tests/test_store.py

@@ -4,10 +4,13 @@ from __future__ import annotations
 import asyncio
 import time
 import unittest
+from datetime import datetime, timezone
+from typing import Any, Optional, cast
 
 from tavolo.platform import GameSession, Seat
 from tavolo.platform.registry import GameRegistry
 from tavolo.platform.store import (
+    DEADLINES_KEY,
     ONGOING_GAMES_KEY,
     InMemoryGameStore,
     RedisGameStore,
@@ -46,7 +49,7 @@ class _FakePipeline:
         return False
 
     def set(self, key: str, value: str, ex: object = None) -> None:
-        self._ops.append(("set", key))
+        self._ops.append(("set", key, value))
 
     def zadd(self, key: str, mapping: dict) -> None:
         self._ops.append(("zadd", key, mapping))
@@ -75,14 +78,51 @@ class _FakeRedis:
     def __init__(self) -> None:
         self.keys: dict = {}
         self.zsets: dict = {}
+        self.zrange_calls: list = []
 
     def pipeline(self, transaction: bool = True) -> _FakePipeline:
         return _FakePipeline(self)
 
+    async def zadd(self, key: str, mapping: dict) -> int:
+        return cast(int, self.apply(("zadd", key, mapping)))
+
+    async def zrem(self, key: str, member: str) -> int:
+        return cast(int, self.apply(("zrem", key, member)))
+
+    async def get(self, key: str) -> object:
+        return self.keys.get(key)
+
+    async def zremrangebyscore(
+        self, key: str, minimum: object, maximum: object
+    ) -> int:
+        return cast(int, self.apply(("zremrangebyscore", key)))
+
+    async def zrange(
+        self,
+        name: str,
+        start: Any,
+        end: Any,
+        byscore: bool = False,
+        offset: Optional[int] = None,
+        num: Optional[int] = None,
+        **kwargs: object,
+    ) -> list:
+        self.zrange_calls.append((name, start, end, byscore, offset, num))
+        members = sorted(
+            self.zsets.get(name, {}).items(), key=lambda item: item[1]
+        )
+        if byscore:
+            low = float("-inf") if start == "-inf" else float(start)
+            high = float("inf") if end == "+inf" else float(end)
+            members = [item for item in members if low <= item[1] <= high]
+        if offset is not None and num is not None:
+            members = members[offset : offset + num]
+        return [member for member, _ in members]
+
     def apply(self, op: tuple) -> object:
         name, *args = op
         if name == "set":
-            self.keys[args[0]] = "payload"
+            self.keys[args[0]] = args[1]
             return True
         if name == "zadd":
             self.zsets.setdefault(args[0], {}).update(args[1])
@@ -216,6 +256,28 @@ class InMemoryGameStoreTest(unittest.TestCase):
         await store.save(other)
         self.assertEqual(0, await store.count_ongoing())
 
+    @async_test
+    async def test_list_ongoing_newest_first_and_unfinished_only(self) -> None:
+        store = InMemoryGameStore(_registry())
+        old = _session("old", "CODE01")
+        old.created_at = datetime(2026, 1, 1, tzinfo=timezone.utc)
+        new = _session("new", "CODE02")
+        new.created_at = datetime(2026, 1, 2, tzinfo=timezone.utc)
+        await store.save(old)
+        await store.save(new)
+
+        self.assertEqual(
+            ["new", "old"], [s.id for s in await store.list_ongoing()]
+        )
+        self.assertEqual(
+            ["new"], [s.id for s in await store.list_ongoing(limit=1)]
+        )
+
+        # A finished match retained for the final board is not listed.
+        new.state["finished"] = True
+        await store.save(new)
+        self.assertEqual(["old"], [s.id for s in await store.list_ongoing()])
+
     @async_test
     async def test_deadline_queue(self) -> None:
         store = InMemoryGameStore(_registry())
@@ -239,6 +301,17 @@ class InMemoryGameStoreTest(unittest.TestCase):
         self.assertEqual(60.0, await store.next_deadline())
         self.assertEqual(["b"], await store.due_deadlines(now=100.0))
 
+    @async_test
+    async def test_deadline_notifications_reach_subscribers(self) -> None:
+        store = InMemoryGameStore(_registry())
+        async with store.subscribe_deadlines() as events:
+            await store.notify_deadline()
+            signal = await asyncio.wait_for(anext(events), timeout=1.0)
+            self.assertIsNone(signal)
+        # The subscription is gone after the context exits: notifying
+        # again is a no-op rather than an error.
+        await store.notify_deadline()
+
 
 class RedisGameStoreTest(unittest.TestCase):
     @async_test
@@ -269,6 +342,51 @@ class RedisGameStoreTest(unittest.TestCase):
         self.assertEqual(1, await store.count_ongoing())
         self.assertNotIn("stale", redis.zsets[ONGOING_GAMES_KEY])
 
+    @async_test
+    async def test_list_ongoing_loads_unfinished_sessions(self) -> None:
+        redis = _FakeRedis()
+        store = RedisGameStore(redis, _registry(), ttl_seconds=3600)  # type: ignore[arg-type]
+        old = _session("old", "CODE01")
+        old.created_at = datetime(2026, 1, 1, tzinfo=timezone.utc)
+        new = _session("new", "CODE02")
+        new.created_at = datetime(2026, 1, 2, tzinfo=timezone.utc)
+        await store.save(old)
+        await store.save(new)
+
+        self.assertEqual(
+            ["new", "old"], [s.id for s in await store.list_ongoing()]
+        )
+        self.assertEqual(
+            ["new"], [s.id for s in await store.list_ongoing(limit=1)]
+        )
+
+        # A finished match retained for the final board is not listed.
+        new.state["finished"] = True
+        await store.save(new)
+        self.assertEqual(["old"], [s.id for s in await store.list_ongoing()])
+
+        # An ongoing entry whose game key expired is skipped.
+        redis.zsets[ONGOING_GAMES_KEY]["gone"] = time.time() + 100
+        self.assertEqual(["old"], [s.id for s in await store.list_ongoing()])
+
+    @async_test
+    async def test_due_deadlines_uses_zrange_byscore(self) -> None:
+        redis = _FakeRedis()
+        store = RedisGameStore(redis, _registry())  # type: ignore[arg-type]
+        await store.add_deadline("b", due_at=50.0)
+        await store.add_deadline("a", due_at=10.0)
+        await store.add_deadline("c", due_at=200.0)
+        # Re-adding an existing member only updates its due time.
+        await store.add_deadline("b", due_at=60.0)
+
+        self.assertEqual(["a"], await store.due_deadlines(now=20.0))
+        self.assertEqual(
+            [(DEADLINES_KEY, "-inf", 20.0, True, 0, 32)], redis.zrange_calls
+        )
+        # Matches come back in due-time order and honour the limit.
+        self.assertEqual(["a"], await store.due_deadlines(now=100.0, limit=1))
+        self.assertEqual(["a", "b"], await store.due_deadlines(now=100.0))
+
 
 if __name__ == "__main__":
     unittest.main()

server/packages/tavolo-platform/tests/test_ws.py

@@ -1,15 +1,92 @@
 """WebSocket live-play tests via kaya's ASGI websocket transport."""
 from __future__ import annotations
 
+import json
 import unittest
+from typing import Any, Dict, Mapping, Sequence
 
 from httpx import ASGITransport, AsyncClient
-from httpx_ws import WebSocketDisconnect, aconnect_ws
+from httpx_ws import WebSocketDisconnect as HttpxWebSocketDisconnect, aconnect_ws
 from httpx_ws.transport import ASGIWebSocketTransport
+from kaya.core import WebSocket, WebSocketDisconnect, WebSocketMessage
 
 from helpers import async_test, make_platform, make_user, oidc_user, ws_users
 
 
+class AbruptCloseSocket(WebSocket):
+    """A socket whose peer vanished without a close handshake.
+
+    kaya surfaces this from the transport: ``receive()`` reports a
+    ``close`` message so iteration ends normally, while sends raise
+    ``WebSocketDisconnect``.
+    """
+
+    def __init__(self, path: str, gone: bool = False) -> None:
+        self.path = path
+        self.query_string = ""
+        self.scheme = "ws"
+        self.headers: Mapping[str, Sequence[str]] = {}
+        self.client = ("127.0.0.1", 12345)
+        self.server = ("127.0.0.1", 80)
+        self.sent: list[Dict[str, Any]] = []
+        self.close_codes: list[int] = []
+        self.gone = gone
+
+    async def accept(self, headers: Any = None) -> None:
+        pass
+
+    async def receive(self) -> WebSocketMessage:
+        self.gone = True
+        return WebSocketMessage(kind="close")
+
+    async def send_text(self, data: str) -> None:
+        if self.gone:
+            raise WebSocketDisconnect(code=1006)
+        self.sent.append(json.loads(data))
+
+    async def send_bytes(self, data: bytes) -> None:
+        if self.gone:
+            raise WebSocketDisconnect(code=1006)
+
+    async def close(self, code: int = 1000) -> None:
+        self.close_codes.append(code)
+
+    async def __anext__(self) -> WebSocketMessage:
+        await self.receive()
+        raise StopAsyncIteration
+
+
+class RecordingSocket(WebSocket):
+    """A socket that only records pre-accept rejections."""
+
+    def __init__(self, path: str) -> None:
+        self.path = path
+        self.query_string = ""
+        self.scheme = "ws"
+        self.headers: Mapping[str, Sequence[str]] = {}
+        self.client = ("127.0.0.1", 12345)
+        self.server = ("127.0.0.1", 80)
+        self.close_codes: list[int] = []
+
+    async def accept(self, headers: Any = None) -> None:
+        raise AssertionError("a rejected socket must not be accepted")
+
+    async def receive(self) -> WebSocketMessage:
+        raise AssertionError("a rejected socket must not receive")
+
+    async def send_text(self, data: str) -> None:
+        raise AssertionError("a rejected socket must not send")
+
+    async def send_bytes(self, data: bytes) -> None:
+        raise AssertionError("a rejected socket must not send")
+
+    async def close(self, code: int = 1000) -> None:
+        self.close_codes.append(code)
+
+    async def __anext__(self) -> WebSocketMessage:
+        raise AssertionError("a rejected socket must not receive")
+
+
 class WebSocketTest(unittest.TestCase):
     async def _started_game(self, client: AsyncClient, oidc, target: int = 3) -> dict:
         """Create a game and seat both players; return the started state."""
@@ -39,6 +116,9 @@ class WebSocketTest(unittest.TestCase):
                         self.assertEqual("dummy", first["game"]["game_type"])
                         self.assertEqual(0, first["game"]["plays"])
                         self.assertEqual(game_id, first["game"]["id"])
+                        # Seated players get the join code; spectators don't.
+                        self.assertIn("join_code", first["game"])
+                        self.assertFalse(first["game"]["spectator"])
 
                         async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as alice_ws:
                             alice_first = await alice_ws.receive_json()
@@ -52,6 +132,33 @@ class WebSocketTest(unittest.TestCase):
                             self.assertEqual("state", update["type"])
                             self.assertEqual(1, update["game"]["plays"])
 
+    @async_test
+    async def test_state_reports_open_seats(self) -> None:
+        app, platform, _ = make_platform()
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            with oidc_user(platform.oidc, "alice"):
+                created = await client.post("/api/games", json={})
+            game_id = created.json()["id"]
+            code = created.json()["join_code"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("alice")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual(1, first["game"]["seats_open"])
+
+            # Once the second player joins the match starts and no seat is
+            # left open.
+            with oidc_user(platform.oidc, "bob"):
+                await client.post("/api/games/join", json={"code": code})
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("alice")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual(0, first["game"]["seats_open"])
+
     @async_test
     async def test_unknown_action_returns_error(self) -> None:
         app, platform, _ = make_platform()
@@ -87,6 +194,38 @@ class WebSocketTest(unittest.TestCase):
                         resent = await bob_ws.receive_json()
                         self.assertEqual("state", resent["type"])
 
+    @async_test
+    async def test_abrupt_disconnect_is_not_an_error(self) -> None:
+        app, platform, _ = make_platform()
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_game(client, platform.oidc)
+        game_id = state["id"]
+
+        ws = AbruptCloseSocket(f"/ws/games/{game_id}")
+        with ws_users([make_user("bob")]):
+            # kaya reports a peer that vanished without a close handshake as
+            # a close message; the handler must exit cleanly.
+            await app.handle_websocket(ws)
+        self.assertEqual("state", ws.sent[0]["type"])
+        self.assertEqual([], ws.close_codes)
+
+    @async_test
+    async def test_send_on_vanished_peer_is_ignored(self) -> None:
+        app, platform, _ = make_platform()
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_game(client, platform.oidc)
+        game_id = state["id"]
+
+        ws = AbruptCloseSocket(f"/ws/games/{game_id}", gone=True)
+        with ws_users([make_user("bob")]):
+            # Sending raises WebSocketDisconnect; the handler swallows it
+            # rather than letting it escape the forward task.
+            await app.handle_websocket(ws)
+        self.assertEqual([], ws.sent)
+        self.assertEqual([], ws.close_codes)
+
     @async_test
     async def test_game_over_broadcast(self) -> None:
         app, platform, _ = make_platform()
@@ -121,13 +260,13 @@ class WebSocketTest(unittest.TestCase):
         ws_transport = ASGIWebSocketTransport(app=app)
         async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
             with ws_users([make_user("alice")]):
-                with self.assertRaises(WebSocketDisconnect) as caught:
+                with self.assertRaises(HttpxWebSocketDisconnect) as caught:
                     async with aconnect_ws("/ws/games/no-such-game", ws_client):
                         pass
-                self.assertEqual(4404, caught.exception.code)
+                self.assertEqual(404, caught.exception.code)
 
     @async_test
-    async def test_non_player_is_closed(self) -> None:
+    async def test_non_player_watches_as_spectator(self) -> None:
         app, platform, _ = make_platform()
         api_transport = ASGITransport(app=app)
         async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
@@ -137,21 +276,62 @@ class WebSocketTest(unittest.TestCase):
             ws_transport = ASGIWebSocketTransport(app=app)
             async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
                 with ws_users([make_user("mallory")]):
-                    with self.assertRaises(WebSocketDisconnect) as caught:
-                        async with aconnect_ws(f"/ws/games/{game_id}", ws_client):
-                            pass
-                    self.assertEqual(4403, caught.exception.code)
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertTrue(first["game"]["spectator"])
+                        self.assertFalse(first["game"]["viewer_seated"])
+                        self.assertNotIn("join_code", first["game"])
+                        # Spectators may not act.
+                        await ws.send_json({"action": "play"})
+                        error = await ws.receive_json()
+                        self.assertEqual("error", error["type"])
+                        self.assertEqual("forbidden", error["code"])
 
     @async_test
-    async def test_unauthenticated_is_closed(self) -> None:
+    async def test_anonymous_user_watches_as_spectator(self) -> None:
+        app, platform, _ = make_platform()
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_game(client, platform.oidc)
+            game_id = state["id"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertTrue(first["game"]["spectator"])
+                        self.assertNotIn("join_code", first["game"])
+                        await ws.send_json({"action": "play"})
+                        error = await ws.receive_json()
+                        self.assertEqual("error", error["type"])
+                        self.assertEqual("forbidden", error["code"])
+
+
+class RejectionStatusTest(unittest.TestCase):
+    """Pre-accept rejections must carry HTTP statuses, not close codes.
+
+    Granian's RSGI layer uses the value passed to ``close()`` before
+    ``accept()`` as the HTTP status of the refused upgrade; a WebSocket
+    close code like 4401 is not a valid status and panics the worker
+    (``InvalidStatusCode``, and with ``panic = "abort"`` the whole app
+    dies). Drive the rejection through the app with a recording socket
+    so the invariant is checked without a real server. Spectators are
+    accepted, so the only pre-accept rejection left is an unknown game.
+    """
+
+    @async_test
+    async def test_unknown_game_rejection_is_an_http_status(self) -> None:
         app, _, _ = make_platform()
-        ws_transport = ASGIWebSocketTransport(app=app)
-        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
-            with ws_users([]):
-                with self.assertRaises(WebSocketDisconnect) as caught:
-                    async with aconnect_ws("/ws/games/whatever", ws_client):
-                        pass
-                self.assertEqual(4401, caught.exception.code)
+        for label, users in (("anonymous", []), ("logged in", [make_user("alice")])):
+            ws = RecordingSocket("/ws/games/no-such-game")
+            with ws_users(users):
+                await app.handle_websocket(ws)
+            self.assertEqual([404], ws.close_codes, label)
+            for code in ws.close_codes:
+                self.assertTrue(100 <= code <= 599, f"{label}: {code} is not an HTTP status")
 
 
 if __name__ == "__main__":

server/packages/tavolo-scopone/src/tavolo/scopone/engine.py

@@ -528,13 +528,14 @@ def hand_points(state: ScoponeState) -> Tuple[List[int], Dict[str, object]]:
     return points, details
 
 
-def state_for_player(state: ScoponeState, sub: str) -> Dict[str, object]:
+def state_for_player(state: ScoponeState, sub: Optional[str]) -> Dict[str, object]:
     """Serialize ``state`` hiding other players' hands.
 
     Hands are reduced to a count, except for the requesting player's own
-    hand. Non-seated viewers simply see no hand at all. The platform
-    merges the session envelope (``id``, ``join_code``, ``game_type``)
-    into the view itself.
+    hand. Non-seated viewers — including spectators, for whom ``sub`` is
+    ``None`` — simply see no hand at all. The platform merges the session
+    envelope (``id``, ``join_code`` for seated players, ``game_type``,
+    ``spectator``) into the view itself.
     """
     viewer = state.player_for(sub)
     players: List[Dict[str, object]] = []

server/packages/tavolo-scopone/src/tavolo/scopone/plugin.py

@@ -171,13 +171,13 @@ class ScoponeEngine(GameEngine):
         else:
             raise IllegalMove(f"unknown action: {action!r}")
 
-    def view_for(self, session: GameSession, user_sub: str) -> Dict[str, Any]:
+    def view_for(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
         return engine.state_for_player(session.state, user_sub)
 
     def is_finished(self, session: GameSession) -> bool:
         return session.state.phase == PHASE_FINISHED
 
-    def game_over_view(self, session: GameSession, user_sub: str) -> Dict[str, Any]:
+    def game_over_view(self, session: GameSession, user_sub: Optional[str]) -> Dict[str, Any]:
         state: ScoponeState = session.state
         return {
             "scores": {"A": state.scores[0], "B": state.scores[1]},

server/packages/tavolo-scopone/src/tavolo/scopone/state.py

@@ -239,7 +239,7 @@ class ScoponeState:
 
     # -- helpers ----------------------------------------------------------
 
-    def player_for(self, sub: str) -> Optional[PlayerState]:
+    def player_for(self, sub: Optional[str]) -> Optional[PlayerState]:
         for player in self.players:
             if player.sub == sub:
                 return player

server/packages/tavolo-scopone/tests/test_engine.py

@@ -574,6 +574,27 @@ class MatchFlowTest(unittest.TestCase):
         self.assertEqual(["07C"], view["table"])
         self.assertTrue(view.get("your_turn"))
 
+    def test_state_for_player_spectator_sees_public_info_only(self) -> None:
+        state = make_state(
+            [["02D", "03C"], ["04D"], ["05D"], ["06D"]],
+            table=["07C"],
+            captured=[["01D"], [], ["02C"], ["03B"]],
+            scope=[1, 0, 2, 0],
+        )
+        view = engine.state_for_player(state, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+        self.assertNotIn("legal_moves", view)
+        # The public table state is still fully visible.
+        self.assertEqual(["07C"], view["table"])
+        self.assertEqual({"A": 0, "B": 0}, view["scores"])
+        players = {p["seat"]: p for p in view["players"]}
+        self.assertEqual(1, players[0]["captured_count"])
+        self.assertEqual(1, players[0]["scope"])
+        self.assertEqual(2, players[2]["scope"])
+        self.assertEqual(1, players[1]["cards_left"])
+
     def test_legal_moves_only_for_player_on_turn(self) -> None:
         state = make_state([["02D", "03C"], ["04D"], ["05D"], ["06D"]],
                            table=["07C"])

server/packages/tavolo-scopone/tests/test_plugin.py

@@ -160,6 +160,17 @@ class ViewTest(unittest.TestCase):
         self.assertNotIn("join_code", view)
         self.assertNotIn("game_type", view)
 
+    def test_view_for_spectator_hides_all_hands(self) -> None:
+        engine = ScoponeEngine()
+        session = _started(engine)
+        view = engine.view_for(session, None)
+        for player in view["players"]:
+            self.assertNotIn("hand", player)
+        self.assertNotIn("your_turn", view)
+        self.assertNotIn("legal_moves", view)
+        self.assertIn("table", view)
+        self.assertEqual({"A": 0, "B": 0}, view["scores"])
+
     def test_lobby_view(self) -> None:
         engine = ScoponeEngine()
         session = _session(engine, target_score=16)

server/requirements.txt

@@ -4,10 +4,11 @@
 #
 #    pip-compile --allow-unsafe --extra otel --extra-index-url=https://pypi.org/simple --index-url=https://gitea.woggioni.net/api/packages/woggioni/pypi/simple --output-file=../../requirements.txt pyproject.toml
 #
-# NOTE: the tavolo-platform, tavolo-scopone and tavolo-app sibling packages
-# are NOT pinned here: they are installed from ./packages in the Dockerfile
-# and in development (pip install -e ./packages/tavolo-platform
-# -e ./packages/tavolo-scopone -e ./packages/tavolo-app). All of their
+# NOTE: the tavolo-platform, tavolo-scopone, tavolo-briscola and tavolo-app
+# sibling packages are NOT pinned here: they are installed from ./packages in
+# the Dockerfile and in development (pip install -e ./packages/tavolo-platform
+# -e ./packages/tavolo-scopone -e ./packages/tavolo-briscola
+# -e ./packages/tavolo-app). All of their
 # third-party dependencies are direct dependencies of tavolo-app, so this
 # lock covers the full closure. The otel extra (kaya-otel and its
 # OpenTelemetry dependencies) IS included, so OTEL_ENABLED works in the
@@ -63,7 +64,7 @@ idna==3.20
     #   httpx
 iso8601==2.1.0
     # via tortoise-orm
-kaya-core==0.0.4
+kaya-core==0.0.7
     # via
     #   kaya-cors
     #   kaya-oidc
@@ -72,22 +73,22 @@ kaya-core==0.0.4
     #   kaya-rsgi
     #   kaya-session
     #   tavolo-app (pyproject.toml)
-kaya-cors==0.0.4
+kaya-cors==0.0.7
     # via tavolo-app (pyproject.toml)
-kaya-oidc==0.0.4
+kaya-oidc==0.0.7
     # via tavolo-app (pyproject.toml)
-kaya-openapi==0.0.4
+kaya-openapi==0.0.7
     # via tavolo-app (pyproject.toml)
-kaya-otel==0.0.4
+kaya-otel==0.0.7
     # via tavolo-app (pyproject.toml)
-kaya-rsgi==0.0.4
+kaya-rsgi==0.0.7
     # via tavolo-app (pyproject.toml)
-kaya-session==0.0.4
+kaya-session==0.0.7
     # via
     #   kaya-oidc
     #   kaya-session-redis
     #   tavolo-app (pyproject.toml)
-kaya-session-redis==0.0.4
+kaya-session-redis==0.0.7
     # via tavolo-app (pyproject.toml)
 opentelemetry-api==1.45.0
     # via
@@ -150,7 +151,7 @@ pwo==0.1.2
     #   tavolo-app (pyproject.toml)
 pycparser==3.0
     # via cffi
-pyjwt[crypto]==2.14.0
+pyjwt[crypto]==2.15.1
     # via
     #   kaya-oidc
     #   tavolo-app (pyproject.toml)

server/tests/__init__.py

@@ -10,8 +10,9 @@ from __future__ import annotations
 import os
 
 os.environ.setdefault("DATABASE_URL", "sqlite://:memory:")
-os.environ.setdefault("OIDC_ISSUER", "http://localhost:8180/tavolo")
-os.environ.setdefault("OIDC_CLIENT_ID", "tavolo")
-os.environ.setdefault("OIDC_REDIRECT_URI", "http://localhost:8080/auth/callback")
+os.environ.setdefault("OIDC_0_PROVIDER", "default")
+os.environ.setdefault("OIDC_0_ISSUER", "http://localhost:8180/tavolo")
+os.environ.setdefault("OIDC_0_CLIENT_ID", "tavolo")
+os.environ.setdefault("OIDC_0_REDIRECT_URI", "http://localhost:8080/auth/default/callback")
 # Unset REDIS_URL: sessions and live games use the in-memory fallbacks.
 os.environ.pop("REDIS_URL", None)

server/tests/helpers/oidc.py

@@ -1,8 +1,9 @@
 """Helpers for faking the OIDC authenticated user during tests.
 
-HTTP handlers funnel through ``oidc_mixin.get_user``; websocket handlers
-through :func:`tavolo.platform.auth.get_ws_user`. Patching those two entry
-points lets route and websocket tests run entirely in-process with no IdP.
+HTTP handlers funnel through ``OIDCProviders.get_users`` (wrapped by
+``tavolo.platform.auth.current_user``); websocket handlers through
+:func:`tavolo.platform.auth.get_ws_user`. Patching those two entry points
+lets route and websocket tests run entirely in-process with no IdP.
 """
 from __future__ import annotations
 
@@ -14,9 +15,13 @@ from kaya.oidc import OIDCUser
 
 # Import the app first: it pulls in the route modules, which import
 # ``tavolo.platform.auth`` themselves.
-from tavolo.app import oidc_mixin
+from tavolo.app import oidc
 from tavolo.platform import auth
 
+# The app's first configured provider (the test environment configures one
+# named "default").
+_PROVIDER = next(iter(oidc.providers))
+
 
 def make_user(sub: str, name: Optional[str] = None) -> OIDCUser:
     return OIDCUser({"sub": sub, "preferred_username": name or sub})
@@ -24,9 +29,9 @@ def make_user(sub: str, name: Optional[str] = None) -> OIDCUser:
 
 @contextlib.contextmanager
 def oidc_user(sub: str, name: Optional[str] = None) -> Iterator[OIDCUser]:
-    """Context manager: patch ``oidc_mixin.get_user`` to return this user."""
+    """Context manager: make ``oidc.get_users`` return this user."""
     user = make_user(sub, name)
-    patcher = _mock.patch.object(oidc_mixin, "get_user", return_value=user)
+    patcher = _mock.patch.object(oidc, "get_users", return_value={_PROVIDER: user})
     patcher.start()
     try:
         yield user

server/tests/test_briscola.py

@@ -0,0 +1,368 @@
+"""Briscola integration tests: lobby, websocket play, timeouts and summaries.
+
+The per-package suites cover the rules and the engine contract; these
+tests wire both briscola variants through the full platform stack (REST,
+WebSocket, deadline scheduler).
+"""
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import unittest
+
+from httpx import ASGITransport, AsyncClient
+from httpx_ws import aconnect_ws
+from httpx_ws.transport import ASGIWebSocketTransport
+
+from tavolo.app import app, game_store, platform
+from tavolo.briscola.state import (
+    PHASE_HAND_END,
+    PHASE_PLAYING,
+    BriscolaState,
+    Card,
+    PlayerState,
+)
+from tavolo.platform import GameSession, Seat
+from tests.helpers import async_test, make_user, oidc_user, ws_users
+
+
+class BriscolaRoutesTest(unittest.TestCase):
+    @async_test
+    async def test_create_and_start_two_player_game(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post(
+                    "/api/games",
+                    json={"game_type": "briscola", "options": {"target_score": 101}},
+                )
+            self.assertEqual(201, created.status_code)
+            body = created.json()
+            self.assertEqual("briscola", body["game_type"])
+            self.assertEqual("lobby", body["phase"])
+            self.assertEqual(1, body["seats_open"])
+            self.assertEqual(101, body["target_score"])
+            self.assertEqual("A", body["players"][0]["team"])
+            code = body["join_code"]
+
+            with oidc_user("bob"):
+                started = await client.post("/api/games/join", json={"code": code})
+            self.assertEqual(200, started.status_code)
+            state = started.json()
+            self.assertEqual("playing", state["phase"])
+            self.assertEqual(2, len(state["players"]))
+            self.assertEqual(["A", "B"], [p["team"] for p in state["players"]])
+            for participant in state["players"]:
+                self.assertEqual(3, participant["cards_left"])
+            self.assertEqual(1, state["turn"])
+            self.assertEqual(33, state["stock_count"])
+            self.assertTrue(state["briscola_suit"])
+            self.assertIsNotNone(state["briscola_card"])
+            # Bob's view carries his own hand only.
+            self.assertIn("hand", state["players"][1])
+            self.assertNotIn("hand", state["players"][0])
+
+            # A non-player watches without a hand or the join code.
+            watched = await client.get(f"/api/games/{state['id']}")
+            self.assertEqual(200, watched.status_code)
+            spectator = watched.json()
+            self.assertTrue(spectator["spectator"])
+            self.assertNotIn("join_code", spectator)
+            for participant in spectator["players"]:
+                self.assertNotIn("hand", participant)
+
+    @async_test
+    async def test_create_and_start_four_player_game(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post(
+                    "/api/games", json={"game_type": "briscola_a_quattro"}
+                )
+            self.assertEqual(201, created.status_code)
+            body = created.json()
+            self.assertEqual("briscola_a_quattro", body["game_type"])
+            self.assertEqual(3, body["seats_open"])
+            code = body["join_code"]
+
+            for player in ("bob", "carol"):
+                with oidc_user(player):
+                    joined = await client.post("/api/games/join", json={"code": code})
+                self.assertEqual("lobby", joined.json()["phase"])
+
+            with oidc_user("dave"):
+                started = await client.post("/api/games/join", json={"code": code})
+            state = started.json()
+            self.assertEqual("playing", state["phase"])
+            self.assertEqual(["A", "B", "A", "B"], [p["team"] for p in state["players"]])
+            for participant in state["players"]:
+                self.assertEqual(3, participant["cards_left"])
+            self.assertEqual(40 - 12 - 1, state["stock_count"])
+
+    @async_test
+    async def test_preview_shows_briscola_options(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post(
+                    "/api/games",
+                    json={"game_type": "briscola", "options": {"target_score": 101}},
+                )
+            code = created.json()["join_code"]
+            with oidc_user("bob"):
+                preview = await client.get(f"/api/games/preview?code={code}")
+            self.assertEqual(200, preview.status_code)
+            body = preview.json()
+            self.assertEqual("briscola", body["game_type"])
+            self.assertEqual("Briscola", body["game_name"])
+            self.assertTrue(body["game_description"])
+            self.assertEqual(101, body["target_score"])
+            self.assertEqual(1, body["seats_open"])
+
+    @async_test
+    async def test_create_rejects_bad_target_score(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            for bad in (60, 121, "sixtyone", True):
+                with oidc_user("alice"):
+                    response = await client.post(
+                        "/api/games",
+                        json={"game_type": "briscola", "options": {"target_score": bad}},
+                    )
+                self.assertEqual(400, response.status_code, bad)
+
+
+class BriscolaWebSocketTest(unittest.TestCase):
+    async def _started_two_player(self, client: AsyncClient) -> dict:
+        with oidc_user("alice"):
+            created = await client.post("/api/games", json={"game_type": "briscola"})
+        code = created.json()["join_code"]
+        with oidc_user("bob"):
+            started = await client.post("/api/games/join", json={"code": code})
+        return started.json()
+
+    @async_test
+    async def test_moves_resolve_the_trick(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_two_player(client)
+            game_id = state["id"]
+            bob_card = state["players"][1]["hand"][0]
+            with oidc_user("alice"):
+                alice_view = await client.get(f"/api/games/{game_id}")
+            alice_card = alice_view.json()["players"][0]["hand"][0]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("bob"), make_user("alice")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as bob_ws:
+                        first = await bob_ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertEqual(1, first["game"]["turn"])
+                        self.assertTrue(first["game"].get("your_turn"))
+
+                        async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as alice_ws:
+                            await alice_ws.receive_json()
+                            await bob_ws.send_json(
+                                {"action": "play", "card": bob_card}
+                            )
+                            bob_update = await bob_ws.receive_json()
+                            alice_update = await alice_ws.receive_json()
+                            for update in (bob_update, alice_update):
+                                self.assertEqual("state", update["type"])
+                                self.assertEqual(0, update["game"]["turn"])
+                                self.assertEqual(
+                                    [{"seat": 1, "card": bob_card}],
+                                    update["game"]["trick"],
+                                )
+
+                            await alice_ws.send_json(
+                                {"action": "play", "card": alice_card}
+                            )
+                            bob_update = await bob_ws.receive_json()
+                            alice_update = await alice_ws.receive_json()
+                            for update in (bob_update, alice_update):
+                                self.assertEqual([], update["game"]["trick"])
+                                last = update["game"]["last_trick"]
+                                self.assertIsNotNone(last)
+                                self.assertIn(last["winner"], (0, 1))
+                                self.assertEqual(2, len(last["cards"]))
+                                self.assertEqual(last["winner"], update["game"]["turn"])
+
+    @async_test
+    async def test_illegal_move_returns_error(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_two_player(client)
+            game_id = state["id"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("alice")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as alice_ws:
+                        await alice_ws.receive_json()
+                        # Bob (seat 1) is on turn, not Alice.
+                        await alice_ws.send_json({"action": "play", "card": "01D"})
+                        error = await alice_ws.receive_json()
+                        self.assertEqual("error", error["type"])
+
+    @async_test
+    async def test_spectator_cannot_act(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_two_player(client)
+            game_id = state["id"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("mallory")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertTrue(first["game"]["spectator"])
+                        self.assertNotIn("join_code", first["game"])
+                        for player in first["game"]["players"]:
+                            self.assertNotIn("hand", player)
+                        await ws.send_json({"action": "play", "card": "01D"})
+                        error = await ws.receive_json()
+                        self.assertEqual("forbidden", error["code"])
+
+
+class BriscolaTurnTimeoutTest(unittest.TestCase):
+    @async_test
+    async def test_turn_timeout_auto_plays_a_card(self) -> None:
+        engine = platform.registry.require("briscola")
+        session = GameSession(
+            id="briscola-turn-timeout-1",
+            game_type=engine.id,
+            join_code="BT0001",
+            creator_sub="alice",
+            players=[
+                Seat(user_sub="alice", display_name="Alice", team="A"),
+            ],
+        )
+        engine.create(session, {})
+        session.state.turn_timeout = 1
+        engine.join(session, "bob", "Bob")
+        await game_store.save(session)
+
+        ws_transport = ASGIWebSocketTransport(app=app)
+        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+            with ws_users([make_user("alice")]):
+                async with aconnect_ws(f"/ws/games/{session.id}", ws_client) as ws:
+                    first = await ws.receive_json()
+                    # Bob (seat 1) is first to act and never connects.
+                    self.assertEqual(1, first["game"]["turn"])
+                    self.assertIsNotNone(first["game"]["turn_deadline"])
+
+                    update = None
+                    for _ in range(20):
+                        try:
+                            update = await asyncio.wait_for(ws.receive_json(), timeout=2)
+                        except asyncio.TimeoutError:
+                            break
+                        if (
+                            update.get("type") == "state"
+                            and update["game"]["last_trick"] is not None
+                        ):
+                            break
+                    self.assertIsNotNone(update)
+                    assert update is not None
+                    # Both absent players were auto-played; the trick
+                    # resolved and the winner leads with a full hand.
+                    self.assertIn(update["game"]["last_trick"]["winner"], (0, 1))
+                    self.assertEqual([], update["game"]["trick"])
+                    for participant in update["game"]["players"]:
+                        self.assertEqual(3, participant["cards_left"])
+
+
+async def _seed_hand_end_state() -> str:
+    """Seed a game where a single trick ends the deal with target 120 so
+    the match continues to the summary."""
+    engine = platform.registry.require("briscola")
+    session = GameSession(
+        id="briscola-hand-end-1",
+        game_type=engine.id,
+        join_code="BH0001",
+        creator_sub="alice",
+        players=[
+            Seat(user_sub="alice", display_name="Alice", team="A"),
+            Seat(user_sub="bob", display_name="Bob", team="B"),
+        ],
+    )
+    session.state = BriscolaState(
+        player_count=2,
+        target_score=120,
+        phase=PHASE_PLAYING,
+        dealer=0,
+        turn=0,
+        briscola_suit="S",
+        players=[
+            PlayerState(
+                sub="alice", name="Alice", seat=0,
+                hand=[Card.parse("02D")], captured=[Card.parse("01C")],
+            ),
+            PlayerState(
+                sub="bob", name="Bob", seat=1,
+                hand=[Card.parse("05D")], captured=[Card.parse("10C")],
+            ),
+        ],
+        hand_ack_timeout=30,
+    )
+    await game_store.save(session)
+    return session.id
+
+
+class BriscolaHandEndTest(unittest.TestCase):
+    @async_test
+    async def test_deal_end_ack_flow(self) -> None:
+        game_id = await _seed_hand_end_state()
+        ws_transport = ASGIWebSocketTransport(app=app)
+        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+            async with contextlib.AsyncExitStack() as stack:
+                with ws_users([make_user("alice"), make_user("bob")]):
+                    sockets = [
+                        await stack.enter_async_context(
+                            aconnect_ws(f"/ws/games/{game_id}", ws_client)
+                        )
+                        for _ in range(2)
+                    ]
+                    for ws in sockets:
+                        await ws.receive_json()  # initial state
+
+                    # Alice leads, Bob takes the trick: the deal ends.
+                    await sockets[0].send_json(
+                        {"action": "play", "card": "02D"}
+                    )
+                    for ws in sockets:
+                        await ws.receive_json()
+                    await sockets[1].send_json(
+                        {"action": "play", "card": "05D"}
+                    )
+                    summaries = [await ws.receive_json() for ws in sockets]
+                    for summary in summaries:
+                        self.assertEqual("state", summary["type"])
+                        self.assertEqual(PHASE_HAND_END, summary["game"]["phase"])
+                        self.assertEqual([], summary["game"]["acknowledged"])
+                        self.assertIsNotNone(summary["game"]["hand_end_deadline"])
+                        deal = summary["game"]["last_deal"]
+                        self.assertEqual({"A": 11, "B": 4}, deal["points"])
+                        self.assertEqual({"A": 11, "B": 4}, deal["totals"])
+                        self.assertFalse(deal["patta"])
+
+                    # Both acknowledge; the second ack deals the next deal.
+                    await sockets[0].send_json({"action": "ack"})
+                    updates = [await ws.receive_json() for ws in sockets]
+                    for update in updates:
+                        self.assertEqual(PHASE_HAND_END, update["game"]["phase"])
+                        self.assertEqual([0], update["game"]["acknowledged"])
+                    await sockets[1].send_json({"action": "ack"})
+                    updates = [await ws.receive_json() for ws in sockets]
+                    for update in updates:
+                        self.assertEqual(PHASE_PLAYING, update["game"]["phase"])
+                        self.assertEqual(2, update["game"]["hand_number"])
+                        for player in update["game"]["players"]:
+                            self.assertEqual(3, player["cards_left"])
+
+
+if __name__ == "__main__":
+    unittest.main()

server/tests/test_briscola_chiamata.py

@@ -0,0 +1,343 @@
+"""Briscola chiamata integration tests: lobby, auction, websocket play, timeouts.
+
+The per-package suite covers the rules and the engine contract; these
+tests wire the game through the full platform stack (REST, WebSocket,
+deadline scheduler).
+"""
+from __future__ import annotations
+
+import asyncio
+import unittest
+from datetime import datetime, timedelta, timezone
+
+from httpx import ASGITransport, AsyncClient
+from httpx_ws import aconnect_ws
+from httpx_ws.transport import ASGIWebSocketTransport
+
+from tavolo.app import app, game_store, platform
+from tavolo.briscola.chiamata import (
+    PHASE_AUCTION,
+    PHASE_CALLING,
+    PHASE_PLAYING,
+    Auction,
+    Bid,
+)
+from tavolo.platform import GameSession, Seat
+from tests.helpers import async_test, make_user, oidc_user, ws_users
+
+PLAYERS = ("alice", "bob", "carol", "dave", "erin")
+
+
+async def _create_and_join(client: AsyncClient) -> dict:
+    """Create a chiamata game and seat all five players; return the view."""
+    with oidc_user(PLAYERS[0]):
+        created = await client.post("/api/games", json={"game_type": "briscola_chiamata"})
+    assert created.status_code == 201, created.text
+    code = created.json()["join_code"]
+    body = created.json()
+    for player in PLAYERS[1:]:
+        with oidc_user(player):
+            joined = await client.post("/api/games/join", json={"code": code})
+        assert joined.status_code == 200, joined.text
+        body = joined.json()
+    return body
+
+
+class ChiamataRoutesTest(unittest.TestCase):
+    @async_test
+    async def test_create_and_seat_five_players(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user(PLAYERS[0]):
+                created = await client.post(
+                    "/api/games", json={"game_type": "briscola_chiamata"}
+                )
+            self.assertEqual(201, created.status_code)
+            body = created.json()
+            self.assertEqual("briscola_chiamata", body["game_type"])
+            self.assertEqual("lobby", body["phase"])
+            self.assertEqual(4, body["seats_open"])
+            self.assertIsNone(body["players"][0]["team"])
+            code = body["join_code"]
+
+            for player in PLAYERS[1:4]:
+                with oidc_user(player):
+                    joined = await client.post("/api/games/join", json={"code": code})
+                self.assertEqual("lobby", joined.json()["phase"])
+                self.assertEqual(
+                    4 - (PLAYERS.index(player)), joined.json()["seats_open"]
+                )
+
+            with oidc_user(PLAYERS[4]):
+                started = await client.post("/api/games/join", json={"code": code})
+            state = started.json()
+            self.assertEqual(PHASE_AUCTION, state["phase"])
+            self.assertEqual(0, state["seats_open"])
+            self.assertEqual(5, len(state["players"]))
+            for seat in state["players"]:
+                # Roles are hidden until the called card is played.
+                self.assertEqual("", seat["team"])
+                self.assertEqual(8, seat["cards_left"])
+            # The auction opens with the player after the dealer (seat 0).
+            self.assertEqual(1, state["auction"]["turn"])
+            self.assertEqual([0, 1, 2, 3], state["auction"]["active"][0:4])
+            self.assertIsNone(state["auction"]["current"])
+            self.assertIsNotNone(state["auction_deadline"])
+            # The last joiner's personalized view carries their own hand.
+            self.assertIn("hand", state["players"][4])
+            self.assertEqual(8, len(state["players"][4]["hand"]))
+            self.assertNotIn("hand", state["players"][0])
+            # There is no stock in this variant.
+            self.assertNotIn("stock_count", state)
+
+            # A non-player watches without hands or the join code.
+            with oidc_user("mallory"):
+                watched = await client.get(f"/api/games/{state['id']}")
+            self.assertEqual(200, watched.status_code)
+            spectator = watched.json()
+            self.assertTrue(spectator["spectator"])
+            self.assertNotIn("join_code", spectator)
+            for seat in spectator["players"]:
+                self.assertNotIn("hand", seat)
+
+    @async_test
+    async def test_preview_lists_chiamata(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post(
+                    "/api/games", json={"game_type": "briscola_chiamata"}
+                )
+            code = created.json()["join_code"]
+            with oidc_user("bob"):
+                preview = await client.get(f"/api/games/preview?code={code}")
+            self.assertEqual(200, preview.status_code)
+            body = preview.json()
+            self.assertEqual("briscola_chiamata", body["game_type"])
+            self.assertEqual("Briscola chiamata", body["game_name"])
+            self.assertTrue(body["game_description"])
+            self.assertEqual("lobby", body["phase"])
+            self.assertEqual(4, body["seats_open"])
+
+
+class ChiamataWebSocketTest(unittest.TestCase):
+    @async_test
+    async def test_auction_call_and_play_over_the_socket(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await _create_and_join(client)
+            game_id = state["id"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("bob"), make_user("alice")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as bob_ws:
+                        first = await bob_ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertEqual(PHASE_AUCTION, first["game"]["phase"])
+                        self.assertTrue(first["game"].get("your_turn"))
+                        self.assertIn("legal_bids", first["game"])
+
+                        async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as alice_ws:
+                            await alice_ws.receive_json()
+                            # Bob (seat 1) opens the bidding with the two.
+                            await bob_ws.send_json({"action": "bid", "rank": 2})
+                            update = await bob_ws.receive_json()
+                            self.assertEqual("state", update["type"])
+                            current = update["game"]["auction"]["current"]
+                            self.assertEqual(
+                                {"seat": 1, "rank": 2, "points": 61}, current
+                            )
+                            self.assertEqual(2, update["game"]["auction"]["turn"])
+                            # Alice receives the broadcast of Bob's bid.
+                            broadcast = await alice_ws.receive_json()
+                            self.assertEqual("state", broadcast["type"])
+                            # Alice (seat 0) is not on turn: her bid is an error.
+                            await alice_ws.send_json({"action": "bid", "rank": 3})
+                            error = await alice_ws.receive_json()
+                            self.assertEqual("error", error["type"])
+
+            # The remaining players pass; Bob wins the auction and is
+            # asked to name the card.
+            engine = platform.registry.require("briscola_chiamata")
+            session = await game_store.load(game_id)
+            assert session is not None
+            for sub in ("carol", "dave", "erin", "alice"):
+                engine.handle_action(session, sub, "pass", {})
+            await game_store.save(session)
+            self.assertEqual(PHASE_CALLING, session.state.phase)
+            self.assertEqual(1, session.state.caller)
+
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([make_user("bob")]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual(PHASE_CALLING, first["game"]["phase"])
+                        self.assertTrue(first["game"].get("your_turn"))
+                        self.assertEqual(
+                            ["02D", "02C", "02S", "02B"],
+                            first["game"]["callable_cards"],
+                        )
+                        await ws.send_json(
+                            {"action": "call", "card": "02D"}
+                        )
+                        update = await ws.receive_json()
+                        self.assertEqual(PHASE_PLAYING, update["game"]["phase"])
+                        self.assertEqual("D", update["game"]["briscola_suit"])
+                        self.assertEqual("02D", update["game"]["called_card"])
+                        self.assertEqual(1, update["game"]["turn"])
+
+                        # Bob is first to play (player after the dealer).
+                        bob = next(
+                            p for p in update["game"]["players"] if p["seat"] == 1
+                        )
+                        card = bob["hand"][0]
+                        await ws.send_json({"action": "play", "card": card})
+                        update = await ws.receive_json()
+                        self.assertEqual(
+                            [{"seat": 1, "card": card}], update["game"]["trick"]
+                        )
+
+    @async_test
+    async def test_spectator_cannot_act(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await _create_and_join(client)
+            game_id = state["id"]
+
+        ws_transport = ASGIWebSocketTransport(app=app)
+        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+            with ws_users([make_user("mallory")]):
+                async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                    first = await ws.receive_json()
+                    self.assertTrue(first["game"]["spectator"])
+                    self.assertNotIn("join_code", first["game"])
+                    for seat in first["game"]["players"]:
+                        self.assertNotIn("hand", seat)
+                    await ws.send_json({"action": "bid", "rank": 1})
+                    error = await ws.receive_json()
+                    self.assertEqual("forbidden", error["code"])
+
+
+class ChiamataTimeoutTest(unittest.TestCase):
+    async def _seed(self, game_id: str, join_code: str, state_mutator) -> str:
+        from tavolo.briscola import chiamata as rules
+
+        session = GameSession(
+            id=game_id,
+            game_type="briscola_chiamata",
+            join_code=join_code,
+            creator_sub=PLAYERS[0],
+            players=[
+                Seat(user_sub=name, display_name=name.capitalize())
+                for name in PLAYERS
+            ],
+        )
+        session.state = rules.create_game(PLAYERS[0], "Alice", turn_timeout=1)
+        for name in PLAYERS[1:]:
+            rules.join_game(session.state, name, name.capitalize())
+        state_mutator(session.state)
+        await game_store.save(session)
+        return session.id
+
+    @async_test
+    async def test_auction_timeout_auto_bids(self) -> None:
+        game_id = await self._seed(
+            "chiamata-auction-timeout-1", "CH0001", lambda state: None
+        )
+        ws_transport = ASGIWebSocketTransport(app=app)
+        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+            with ws_users([make_user("bob")]):
+                async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                    first = await ws.receive_json()
+                    self.assertEqual(PHASE_AUCTION, first["game"]["phase"])
+                    self.assertIsNotNone(first["game"]["auction_deadline"])
+
+                    update = None
+                    for _ in range(20):
+                        try:
+                            update = await asyncio.wait_for(
+                                ws.receive_json(), timeout=2
+                            )
+                        except asyncio.TimeoutError:
+                            break
+                        if (
+                            update.get("type") == "state"
+                            and update["game"]["auction"]["current"] is not None
+                        ):
+                            break
+                    self.assertIsNotNone(update)
+                    assert update is not None
+                    # The absent seat 1 was auto-bid for.
+                    current = update["game"]["auction"]["current"]
+                    self.assertEqual(1, current["seat"])
+                    self.assertIn(current["rank"], (1, 3, 10, 9, 8, 7, 6, 5, 4, 2))
+
+    @async_test
+    async def test_call_and_turn_timeouts(self) -> None:
+        def seed(state) -> None:
+            state.phase = PHASE_CALLING
+            state.auction = Auction(
+                turn=1,
+                active=[1],
+                passed=[0, 2, 3, 4],
+                current=Bid(seat=1, rank=2, points=61),
+            )
+            state.caller = 1
+            state.turn = 1
+            state.auction_deadline = None
+            state.call_deadline = (
+                datetime.now(timezone.utc) + timedelta(seconds=1)
+            ).isoformat()
+
+        game_id = await self._seed(
+            "chiamata-call-timeout-1", "CH0002", seed
+        )
+        ws_transport = ASGIWebSocketTransport(app=app)
+        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+            with ws_users([make_user("bob")]):
+                async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                    first = await ws.receive_json()
+                    self.assertEqual(PHASE_CALLING, first["game"]["phase"])
+
+                    called = None
+                    for _ in range(20):
+                        try:
+                            called = await asyncio.wait_for(
+                                ws.receive_json(), timeout=2
+                            )
+                        except asyncio.TimeoutError:
+                            break
+                        if (
+                            called.get("type") == "state"
+                            and called["game"]["phase"] == PHASE_PLAYING
+                        ):
+                            break
+                    self.assertIsNotNone(called)
+                    assert called is not None
+                    self.assertEqual(PHASE_PLAYING, called["game"]["phase"])
+                    card = called["game"]["called_card"]
+                    self.assertIsNotNone(card)
+                    self.assertTrue(card.startswith("02"))
+
+                    played = None
+                    for _ in range(20):
+                        try:
+                            played = await asyncio.wait_for(
+                                ws.receive_json(), timeout=2
+                            )
+                        except asyncio.TimeoutError:
+                            break
+                        if (
+                            played.get("type") == "state"
+                            and len(played["game"]["trick"]) == 1
+                        ):
+                            break
+                    self.assertIsNotNone(played)
+                    assert played is not None
+                    # Seat 1 was on turn and was auto-played for.
+                    self.assertEqual(1, played["game"]["trick"][0]["seat"])
+
+
+if __name__ == "__main__":
+    unittest.main()

server/tests/test_config.py

@@ -178,5 +178,140 @@ class OTelSettingsTests(unittest.TestCase):
         self.assertEqual(3, settings.otel_metrics_poll_interval_seconds)
 
 
+class OidcSettingsTests(unittest.TestCase):
+    def test_defaults_to_the_dev_mock_provider(self):
+        settings = _settings({})
+        self.assertEqual(1, len(settings.oidc_providers))
+        provider = settings.oidc_providers[0]
+        self.assertEqual("default", provider.provider)
+        self.assertEqual("http://localhost:8180/tavolo", provider.issuer)
+        self.assertEqual("tavolo", provider.client_id)
+        self.assertIsNone(provider.client_secret)
+        self.assertEqual(
+            "http://localhost:8080/auth/default/callback", provider.redirect_uri
+        )
+        self.assertEqual("/", provider.post_login_redirect)
+        self.assertEqual("/", provider.post_logout_redirect)
+
+    def test_single_indexed_provider_defaults(self):
+        settings = _settings({
+            "OIDC_0_PROVIDER": "google",
+            "OIDC_0_ISSUER": "https://accounts.google.com",
+            "OIDC_0_CLIENT_ID": "client-id",
+            "OIDC_0_CLIENT_SECRET": "client-secret",
+        })
+        self.assertEqual(1, len(settings.oidc_providers))
+        provider = settings.oidc_providers[0]
+        self.assertEqual("google", provider.provider)
+        self.assertEqual("https://accounts.google.com", provider.issuer)
+        self.assertEqual("client-id", provider.client_id)
+        self.assertEqual("client-secret", provider.client_secret)
+        # The callback default mirrors kaya's /auth/<provider>/callback.
+        self.assertEqual(
+            "http://localhost:8080/auth/google/callback", provider.redirect_uri
+        )
+        self.assertEqual("/", provider.post_login_redirect)
+        self.assertEqual("/", provider.post_logout_redirect)
+
+    def test_multiple_providers_are_ordered_by_index(self):
+        settings = _settings({
+            "OIDC_0_PROVIDER": "google",
+            "OIDC_0_ISSUER": "https://accounts.google.com",
+            "OIDC_0_CLIENT_ID": "g",
+            "OIDC_1_PROVIDER": "github",
+            "OIDC_1_ISSUER": "https://github.com/login/oauth",
+            "OIDC_1_CLIENT_ID": "h",
+            "OIDC_1_REDIRECT_URI": "https://tavolo.example/auth/github/callback",
+            "OIDC_1_POST_LOGIN_REDIRECT": "/lobby",
+            "OIDC_1_POST_LOGOUT_REDIRECT": "/bye",
+        })
+        self.assertEqual(
+            ["google", "github"], [p.provider for p in settings.oidc_providers]
+        )
+        github = settings.oidc_providers[1]
+        self.assertEqual(
+            "https://tavolo.example/auth/github/callback", github.redirect_uri
+        )
+        self.assertEqual("/lobby", github.post_login_redirect)
+        self.assertEqual("/bye", github.post_logout_redirect)
+
+    def test_empty_optional_values_fall_back_to_defaults(self):
+        settings = _settings({
+            "OIDC_0_PROVIDER": "google",
+            "OIDC_0_ISSUER": "https://accounts.google.com",
+            "OIDC_0_CLIENT_ID": "g",
+            "OIDC_0_CLIENT_SECRET": "",
+            "OIDC_0_REDIRECT_URI": "",
+        })
+        provider = settings.oidc_providers[0]
+        self.assertIsNone(provider.client_secret)
+        self.assertEqual(
+            "http://localhost:8080/auth/google/callback", provider.redirect_uri
+        )
+
+    def test_missing_provider_name(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_0_PROVIDER"):
+            _settings({"OIDC_0_ISSUER": "https://idp", "OIDC_0_CLIENT_ID": "c"})
+
+    def test_missing_issuer(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_0_ISSUER"):
+            _settings({"OIDC_0_PROVIDER": "google", "OIDC_0_CLIENT_ID": "c"})
+
+    def test_missing_client_id(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_0_CLIENT_ID"):
+            _settings({"OIDC_0_PROVIDER": "google", "OIDC_0_ISSUER": "https://idp"})
+
+    def test_indices_must_start_at_zero(self):
+        with self.assertRaisesRegex(RuntimeError, "contiguous"):
+            _settings({
+                "OIDC_3_PROVIDER": "google",
+                "OIDC_3_ISSUER": "https://idp",
+                "OIDC_3_CLIENT_ID": "c",
+            })
+
+    def test_indices_must_be_contiguous(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_1_"):
+            _settings({
+                "OIDC_0_PROVIDER": "google",
+                "OIDC_0_ISSUER": "https://idp",
+                "OIDC_0_CLIENT_ID": "c",
+                "OIDC_2_PROVIDER": "github",
+                "OIDC_2_ISSUER": "https://idp2",
+                "OIDC_2_CLIENT_ID": "c2",
+            })
+
+    def test_duplicate_provider_names_are_rejected(self):
+        with self.assertRaisesRegex(RuntimeError, "duplicate"):
+            _settings({
+                "OIDC_0_PROVIDER": "google",
+                "OIDC_0_ISSUER": "https://idp",
+                "OIDC_0_CLIENT_ID": "c",
+                "OIDC_1_PROVIDER": "google",
+                "OIDC_1_ISSUER": "https://idp2",
+                "OIDC_1_CLIENT_ID": "c2",
+            })
+
+    def test_invalid_provider_name_is_rejected(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_0_PROVIDER"):
+            _settings({
+                "OIDC_0_PROVIDER": "not a name",
+                "OIDC_0_ISSUER": "https://idp",
+                "OIDC_0_CLIENT_ID": "c",
+            })
+
+    def test_unknown_indexed_variable_is_rejected(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_0_ISUER"):
+            _settings({
+                "OIDC_0_PROVIDER": "google",
+                "OIDC_0_ISSUER": "https://idp",
+                "OIDC_0_CLIENT_ID": "c",
+                "OIDC_0_ISUER": "typo",
+            })
+
+    def test_legacy_unindexed_variables_get_a_migration_hint(self):
+        with self.assertRaisesRegex(RuntimeError, "OIDC_ISSUER -> OIDC_0_ISSUER"):
+            _settings({"OIDC_ISSUER": "https://idp", "OIDC_CLIENT_ID": "c"})
+
+
 if __name__ == "__main__":
     unittest.main()

server/tests/test_routes_auth.py

@@ -0,0 +1,35 @@
+"""Auth routes on the fully wired application.
+
+The integration suite's app is built from the indexed test environment
+(one provider named ``default``); these tests pin the public surface the
+SPA and bookmarks rely on.
+"""
+from __future__ import annotations
+
+import unittest
+
+from httpx import ASGITransport, AsyncClient
+
+from tavolo.app import app
+from tests.helpers import async_test
+
+
+class AuthRoutesTest(unittest.TestCase):
+    @async_test
+    async def test_providers_endpoint_reports_the_configured_provider(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            response = await client.get("/api/auth/providers")
+        self.assertEqual(200, response.status_code)
+        self.assertEqual(
+            {"providers": [{"name": "default", "login_url": "/auth/default/login"}]},
+            response.json(),
+        )
+
+    @async_test
+    async def test_generic_login_redirects_to_the_provider(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            response = await client.get("/auth/login", follow_redirects=False)
+        self.assertEqual(302, response.status_code)
+        self.assertEqual("/auth/default/login", response.headers["location"])

server/tests/test_routes_games.py

@@ -1,4 +1,4 @@
-"""Game lobby route tests via kaya's ASGI transport (scopone game)."""
+"""Game lobby route tests via kaya's ASGI transport (all registered games)."""
 from __future__ import annotations
 
 import unittest
@@ -39,9 +39,19 @@ class GamesRouteTest(unittest.TestCase):
             self.assertEqual(200, snapshot.status_code)
             self.assertEqual("alice", snapshot.json()["players"][0]["sub"])
 
+            # A logged-in non-player is a read-only spectator: no join
+            # code, and the view is marked as a spectator view.
             with oidc_user("mallory"):
-                forbidden = await client.get(f"/api/games/{game_id}")
-            self.assertEqual(403, forbidden.status_code)
+                watched = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, watched.status_code)
+            self.assertTrue(watched.json()["spectator"])
+            self.assertNotIn("join_code", watched.json())
+
+            # Anonymous users may watch too.
+            anonymous = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, anonymous.status_code)
+            self.assertTrue(anonymous.json()["spectator"])
+            self.assertNotIn("join_code", anonymous.json())
 
     @async_test
     async def test_join_fills_seats_and_starts_game(self) -> None:
@@ -61,6 +71,7 @@ class GamesRouteTest(unittest.TestCase):
                 started = await client.post("/api/games/join", json={"code": code})
             self.assertEqual(200, started.status_code)
             state = started.json()
+            game_id = state["id"]
             self.assertEqual("playing", state["phase"])
             self.assertEqual(4, len(state["players"]))
             self.assertEqual([], state["table"])
@@ -72,6 +83,21 @@ class GamesRouteTest(unittest.TestCase):
             self.assertNotIn("hand", state["players"][0])
             self.assertEqual(1, state["turn"])
 
+            # A spectator sees the table, the score and each player's
+            # captured count and scope — but no hand at all.
+            watched = await client.get(f"/api/games/{game_id}")
+            self.assertEqual(200, watched.status_code)
+            spect = watched.json()
+            self.assertTrue(spect["spectator"])
+            self.assertNotIn("join_code", spect)
+            self.assertEqual([], spect["table"])
+            self.assertEqual({"A": 0, "B": 0}, spect["scores"])
+            for participant in spect["players"]:
+                self.assertNotIn("hand", participant)
+                self.assertEqual(10, participant["cards_left"])
+                self.assertEqual(0, participant["captured_count"])
+                self.assertEqual(0, participant["scope"])
+
     @async_test
     async def test_create_napola_option(self) -> None:
         transport = ASGITransport(app=app)
@@ -210,6 +236,52 @@ class GamesRouteTest(unittest.TestCase):
             self.assertEqual(400, text.status_code)
             self.assertEqual(400, huge.status_code)
 
+    @async_test
+    async def test_my_games_lists_my_ongoing_games(self) -> None:
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                created = await client.post(
+                    "/api/games", json={"game_type": "briscola"}
+                )
+            game_id = created.json()["id"]
+
+            with oidc_user("alice"):
+                listed = await client.get("/api/me/games")
+            self.assertEqual(200, listed.status_code)
+            # The app suite shares one in-memory store, so other tests'
+            # games may be listed too: pick ours by id.
+            by_id = {g["id"]: g for g in listed.json()["results"]}
+            self.assertIn(game_id, by_id)
+            entry = by_id[game_id]
+            self.assertEqual("briscola", entry["game_type"])
+            self.assertEqual("Briscola", entry["game_name"])
+            self.assertTrue(entry["game_description"])
+            self.assertEqual("lobby", entry["phase"])
+            self.assertEqual(1, entry["seats_open"])
+            self.assertEqual(0, entry["your_seat"])
+            self.assertNotIn("join_code", entry)
+
+            # A logged-in non-player does not see the game.
+            with oidc_user("mallory"):
+                others = await client.get("/api/me/games")
+            self.assertNotIn(
+                game_id, [g["id"] for g in others.json()["results"]]
+            )
+
+            # Once the match starts it stays listed, for both players.
+            code = created.json()["join_code"]
+            with oidc_user("bob"):
+                await client.post("/api/games/join", json={"code": code})
+            with oidc_user("bob"):
+                started = await client.get("/api/me/games")
+            bob_entry = next(
+                g for g in started.json()["results"] if g["id"] == game_id
+            )
+            self.assertEqual("playing", bob_entry["phase"])
+            self.assertEqual(1, bob_entry["your_seat"])
+            self.assertEqual(0, bob_entry["seats_open"])
+
     @async_test
     async def test_get_unknown_game(self) -> None:
         transport = ASGITransport(app=app)
@@ -227,16 +299,43 @@ class GameTypesRouteTest(unittest.TestCase):
             response = await client.get("/api/game-types")
         self.assertEqual(200, response.status_code)
         results = response.json()["results"]
-        self.assertEqual(["scopone_scientifico"], [g["id"] for g in results])
-        self.assertEqual("Scopone scientifico", results[0]["name"])
-        self.assertTrue(results[0]["description"])
-        self.assertEqual(4, results[0]["min_players"])
-        self.assertEqual(4, results[0]["max_players"])
-        self.assertIn("target_score", results[0]["options_schema"]["properties"])
-        self.assertIn("napola", results[0]["options_schema"]["properties"])
-        self.assertIn(
-            "asso_pigliatutto", results[0]["options_schema"]["properties"]
+        self.assertEqual(
+            [
+                "scopone_scientifico",
+                "briscola",
+                "briscola_a_quattro",
+                "briscola_chiamata",
+            ],
+            [g["id"] for g in results],
         )
+        scopone = results[0]
+        self.assertEqual("Scopone scientifico", scopone["name"])
+        self.assertTrue(scopone["description"])
+        self.assertEqual(4, scopone["min_players"])
+        self.assertEqual(4, scopone["max_players"])
+        self.assertIn("target_score", scopone["options_schema"]["properties"])
+        self.assertIn("napola", scopone["options_schema"]["properties"])
+        self.assertIn(
+            "asso_pigliatutto", scopone["options_schema"]["properties"]
+        )
+        briscola = results[1]
+        self.assertEqual("Briscola", briscola["name"])
+        self.assertTrue(briscola["description"])
+        self.assertEqual(2, briscola["min_players"])
+        self.assertEqual(2, briscola["max_players"])
+        self.assertIn("target_score", briscola["options_schema"]["properties"])
+        quattro = results[2]
+        self.assertEqual("Briscola a quattro", quattro["name"])
+        self.assertTrue(quattro["description"])
+        self.assertEqual(4, quattro["min_players"])
+        self.assertEqual(4, quattro["max_players"])
+        self.assertIn("target_score", quattro["options_schema"]["properties"])
+        chiamata = results[3]
+        self.assertEqual("Briscola chiamata", chiamata["name"])
+        self.assertTrue(chiamata["description"])
+        self.assertEqual(5, chiamata["min_players"])
+        self.assertEqual(5, chiamata["max_players"])
+        self.assertEqual({}, chiamata["options_schema"])
 
     @async_test
     async def test_create_defaults_game_type(self) -> None:
@@ -268,7 +367,7 @@ class GameTypesRouteTest(unittest.TestCase):
         transport = ASGITransport(app=app)
         async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
             with oidc_user("alice"):
-                unknown = await client.post("/api/games", json={"game_type": "briscola"})
+                unknown = await client.post("/api/games", json={"game_type": "tresette"})
                 non_string = await client.post("/api/games", json={"game_type": 42})
             self.assertEqual(400, unknown.status_code)
             self.assertEqual(400, non_string.status_code)

server/tests/test_stats.py

@@ -12,8 +12,11 @@ import unittest
 from httpx import ASGITransport, AsyncClient
 
 from tavolo.app import app, platform, tortoise_mixin
+from tavolo.briscola.chiamata import PHASE_AUCTION, PHASE_CALLING
+from tavolo.briscola.state import Card
 from tavolo.platform import GameSession, Seat
 from tavolo.platform.elo import INITIAL_RATING
+from tavolo.platform.errors import IllegalMove
 from tavolo.platform.models import Match, MatchPlayer, PlayerRating
 from tavolo.platform.stats import save_match_result
 from tavolo.scopone import engine as rules
@@ -136,5 +139,184 @@ class ScoponeStatsTest(unittest.TestCase):
             self.assertTrue(all(r["matches"] == 1 for r in by_sub.values()))
 
 
+async def _finished_briscola_session() -> GameSession:
+    engine = platform.registry.require("briscola")
+    session = GameSession(
+        id="stats-briscola-1",
+        game_type=engine.id,
+        join_code="BS0001",
+        creator_sub="alice",
+        players=[Seat(user_sub="alice", display_name="Alice")],
+    )
+    engine.create(session, {})
+    engine.join(session, "bob", "Bob")
+    moves = 0
+    while not engine.is_finished(session) and moves < 200000:
+        state = session.state
+        if state.phase == "hand_end":
+            for player in state.players:
+                engine.handle_action(session, player.sub, "ack", {})
+            continue
+        player = next(p for p in state.players if p.seat == state.turn)
+        engine.handle_action(
+            session, player.sub, "play", {"card": player.hand[0].code}
+        )
+        moves += 1
+    assert engine.is_finished(session)
+    return session
+
+
+class BriscolaStatsTest(unittest.TestCase):
+    @async_test
+    async def test_finished_briscola_match_persisted_with_summary(self) -> None:
+        await tortoise_mixin._bind()
+        ctx = tortoise_mixin._ctx
+        assert ctx is not None
+        engine = platform.registry.require("briscola")
+        session = await _finished_briscola_session()
+        with ctx:
+            await save_match_result(session, engine)
+            self.assertEqual(1, await Match.all().count())
+            self.assertEqual(2, await MatchPlayer.all().count())
+
+            match = await Match.all().first()
+            assert match is not None
+            self.assertEqual("briscola", match.game_type)
+            summary = match.result
+            self.assertIn("team_a_score", summary)
+            self.assertIn("team_b_score", summary)
+            self.assertIn("winner_team", summary)
+            self.assertIn("target_score", summary)
+            self.assertIn("deals_played", summary)
+            self.assertIn("deal_scores", summary)
+
+            winner_team = summary["winner_team"]
+            players = {p.user_sub: p for p in await MatchPlayer.all()}
+            for row in players.values():
+                if row.won:
+                    self.assertEqual(winner_team, row.team)
+                else:
+                    self.assertNotEqual(winner_team, row.team)
+            # A two-player match moves Elo by 16 points each.
+            ratings = {r.user_sub: r.rating for r in await PlayerRating.all()}
+            self.assertEqual(2, len(ratings))
+            self.assertEqual(
+                {INITIAL_RATING + 16, INITIAL_RATING - 16}, set(ratings.values())
+            )
+
+    @async_test
+    async def test_history_exposes_briscola_result(self) -> None:
+        await tortoise_mixin._bind()
+        ctx = tortoise_mixin._ctx
+        assert ctx is not None
+        engine = platform.registry.require("briscola")
+        session = await _finished_briscola_session()
+        with ctx:
+            await save_match_result(session, engine)
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://127.0.0.1") as client:
+            with oidc_user("alice"):
+                history = await client.get("/api/me/matches")
+            self.assertEqual(200, history.status_code)
+            results = history.json()["results"]
+            self.assertEqual(1, len(results))
+            self.assertEqual("briscola", results[0]["game_type"])
+            self.assertIn("team_a_score", results[0]["result"])
+            self.assertEqual(2, len(results[0]["players"]))
+
+
+async def _finished_chiamata_session() -> GameSession:
+    engine = platform.registry.require("briscola_chiamata")
+    session = GameSession(
+        id="stats-chiamata-1",
+        game_type=engine.id,
+        join_code="BC0001",
+        creator_sub="alice",
+        players=[
+            Seat(user_sub=name, display_name=name.capitalize())
+            for name in ("alice", "bob", "carol", "dave", "erin")
+        ],
+    )
+    engine.create(session, {})
+    for name in ("bob", "carol", "dave", "erin"):
+        engine.join(session, name, name.capitalize())
+    moves = 0
+    while not engine.is_finished(session) and moves < 200000:
+        state = session.state
+        if state.phase == PHASE_AUCTION:
+            player = next(p for p in state.players if p.seat == state.turn)
+            try:
+                engine.handle_action(session, player.sub, "pass", {})
+            except IllegalMove:
+                engine.handle_action(session, player.sub, "bid", {"rank": 2})
+        elif state.phase == PHASE_CALLING:
+            assert state.auction is not None and state.auction.current is not None
+            caller = next(p for p in state.players if p.seat == state.caller)
+            card = Card(rank=state.auction.current.rank, suit="D")
+            engine.handle_action(session, caller.sub, "call", {"card": card.code})
+        else:
+            player = next(p for p in state.players if p.seat == state.turn)
+            engine.handle_action(
+                session, player.sub, "play", {"card": player.hand[0].code}
+            )
+        moves += 1
+    assert engine.is_finished(session)
+    return session
+
+
+class ChiamataStatsTest(unittest.TestCase):
+    @async_test
+    async def test_finished_chiamata_match_persisted_with_summary(self) -> None:
+        await tortoise_mixin._bind()
+        ctx = tortoise_mixin._ctx
+        assert ctx is not None
+        engine = platform.registry.require("briscola_chiamata")
+        session = await _finished_chiamata_session()
+        with ctx:
+            await save_match_result(session, engine)
+            self.assertEqual(1, await Match.all().count())
+            self.assertEqual(5, await MatchPlayer.all().count())
+
+            match = await Match.all().first()
+            assert match is not None
+            self.assertEqual("briscola_chiamata", match.game_type)
+            summary = match.result
+            for key in (
+                "team_a_score",
+                "team_b_score",
+                "winner_team",
+                "declared_target",
+                "called_card",
+                "caller",
+                "solo",
+                "deals_played",
+                "deal_scores",
+            ):
+                self.assertIn(key, summary)
+            self.assertIn(summary["winner_team"], ("Chiamante", "Difensori"))
+
+            players = await MatchPlayer.all()
+            roles = {p.team for p in players}
+            self.assertTrue(roles.issubset({"Chiamante", "Socio", "Difensori"}))
+            # Roles match the sides: exactly one caller, the rest defenders
+            # plus at most one partner.
+            self.assertEqual(1, sum(1 for p in players if p.team == "Chiamante"))
+            winner_team = summary["winner_team"]
+            for row in players:
+                on_caller_side = row.team in ("Chiamante", "Socio")
+                self.assertEqual(row.won, on_caller_side == (winner_team == "Chiamante"))
+            # Mean-team Elo: 2v3 or 1v4 moves every winner by +16.
+            ratings = {r.user_sub: r.rating for r in await PlayerRating.all()}
+            self.assertEqual(5, len(ratings))
+            winners = {p.user_sub for p in players if p.won}
+            self.assertEqual(
+                {INITIAL_RATING + 16}, {ratings[sub] for sub in winners}
+            )
+            self.assertEqual(
+                {INITIAL_RATING - 16},
+                {ratings[sub] for sub in ratings if sub not in winners},
+            )
+
+
 if __name__ == "__main__":
     unittest.main()

server/tests/test_telemetry.py

@@ -151,7 +151,7 @@ class SessionTagHookTest(unittest.TestCase):
     def test_tags_authenticated_session(self) -> None:
         span = _RecordedSpan()
         carrier = SimpleNamespace(
-            session=Session("sid", {"oidc_user": {"sub": "alice"}})
+            session=Session("sid", {"oidc:default:user": {"sub": "alice"}})
         )
         session_tag_hook(span, carrier)
         self.assertEqual(
@@ -160,6 +160,23 @@ class SessionTagHookTest(unittest.TestCase):
         )
         self.assertEqual("alice", span.attributes["user.id"])
 
+    def test_tags_user_of_any_provider(self) -> None:
+        span = _RecordedSpan()
+        carrier = SimpleNamespace(
+            session=Session("sid", {"oidc:google:user": {"sub": "alice"}})
+        )
+        session_tag_hook(span, carrier)
+        self.assertEqual("alice", span.attributes["user.id"])
+
+    def test_ignores_legacy_unprefixed_user_key(self) -> None:
+        span = _RecordedSpan()
+        carrier = SimpleNamespace(
+            session=Session("sid", {"oidc_user": {"sub": "alice"}})
+        )
+        session_tag_hook(span, carrier)
+        self.assertIn("session.id", span.attributes)
+        self.assertNotIn("user.id", span.attributes)
+
     def test_tags_session_without_user(self) -> None:
         span = _RecordedSpan()
         session_tag_hook(span, SimpleNamespace(session=Session("sid", {})))
@@ -169,7 +186,7 @@ class SessionTagHookTest(unittest.TestCase):
     def test_tags_user_when_session_id_not_yet_minted(self) -> None:
         span = _RecordedSpan()
         carrier = SimpleNamespace(
-            session=Session(None, {"oidc_user": {"sub": "alice"}})
+            session=Session(None, {"oidc:default:user": {"sub": "alice"}})
         )
         session_tag_hook(span, carrier)
         self.assertNotIn("session.id", span.attributes)
@@ -182,7 +199,7 @@ class SessionTagHookTest(unittest.TestCase):
 
     def test_malformed_user_is_ignored(self) -> None:
         span = _RecordedSpan()
-        carrier = SimpleNamespace(session=Session("sid", {"oidc_user": "alice"}))
+        carrier = SimpleNamespace(session=Session("sid", {"oidc:default:user": "alice"}))
         session_tag_hook(span, carrier)
         self.assertIn("session.id", span.attributes)
         self.assertNotIn("user.id", span.attributes)
@@ -224,7 +241,7 @@ class SessionTagIntegrationTest(unittest.TestCase):
         async def login(ctx: HttpContext) -> None:
             session = ctx.session
             assert session is not None
-            session["oidc_user"] = {"sub": "alice"}
+            session["oidc:default:user"] = {"sub": "alice"}
             await ctx.send_str(200, "ok")
 
         @app.GET("/me")

server/tests/test_websocket.py

@@ -131,10 +131,10 @@ class WebSocketTest(unittest.TestCase):
                 with self.assertRaises(WebSocketDisconnect) as caught:
                     async with aconnect_ws("/ws/games/no-such-game", ws_client):
                         pass
-                self.assertEqual(4404, caught.exception.code)
+                self.assertEqual(404, caught.exception.code)
 
     @async_test
-    async def test_non_player_is_closed(self) -> None:
+    async def test_non_player_watches_as_spectator(self) -> None:
         api_transport = ASGITransport(app=app)
         async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
             state = await self._started_game(client)
@@ -143,20 +143,42 @@ class WebSocketTest(unittest.TestCase):
             ws_transport = ASGIWebSocketTransport(app=app)
             async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
                 with ws_users([make_user("mallory")]):
-                    with self.assertRaises(WebSocketDisconnect) as caught:
-                        async with aconnect_ws(f"/ws/games/{game_id}", ws_client):
-                            pass
-                    self.assertEqual(4403, caught.exception.code)
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertTrue(first["game"]["spectator"])
+                        self.assertNotIn("join_code", first["game"])
+                        self.assertIn("table", first["game"])
+                        self.assertEqual({"A": 0, "B": 0}, first["game"]["scores"])
+                        for player in first["game"]["players"]:
+                            self.assertNotIn("hand", player)
+                        # Spectators may not act.
+                        await ws.send_json({"action": "play", "card": "01D"})
+                        error = await ws.receive_json()
+                        self.assertEqual("error", error["type"])
+                        self.assertEqual("forbidden", error["code"])
 
     @async_test
-    async def test_unauthenticated_is_closed(self) -> None:
-        ws_transport = ASGIWebSocketTransport(app=app)
-        async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
-            with ws_users([]):
-                with self.assertRaises(WebSocketDisconnect) as caught:
-                    async with aconnect_ws("/ws/games/whatever", ws_client):
-                        pass
-                self.assertEqual(4401, caught.exception.code)
+    async def test_anonymous_user_watches_as_spectator(self) -> None:
+        api_transport = ASGITransport(app=app)
+        async with AsyncClient(transport=api_transport, base_url="http://127.0.0.1") as client:
+            state = await self._started_game(client)
+            game_id = state["id"]
+
+            ws_transport = ASGIWebSocketTransport(app=app)
+            async with AsyncClient(transport=ws_transport, base_url="http://testserver") as ws_client:
+                with ws_users([]):
+                    async with aconnect_ws(f"/ws/games/{game_id}", ws_client) as ws:
+                        first = await ws.receive_json()
+                        self.assertEqual("state", first["type"])
+                        self.assertTrue(first["game"]["spectator"])
+                        self.assertNotIn("join_code", first["game"])
+                        for player in first["game"]["players"]:
+                            self.assertNotIn("hand", player)
+                        await ws.send_json({"action": "play", "card": "01D"})
+                        error = await ws.receive_json()
+                        self.assertEqual("error", error["type"])
+                        self.assertEqual("forbidden", error["code"])
 
 
 async def _seed_last_play_state(hand_ack_timeout: int = 30) -> str:

web/src/api.rs

@@ -22,6 +22,19 @@ pub async fn me() -> Result<Option<User>, String> {
     resp.json().await.map(Some).map_err(|e| e.to_string())
 }
 
+/// Fetch the configured OIDC login providers (public endpoint).
+pub async fn auth_providers() -> Result<Vec<AuthProvider>, String> {
+    let resp = Request::get("/api/auth/providers")
+        .send()
+        .await
+        .map_err(|e| e.to_string())?;
+    if !resp.ok() {
+        return Err(server_error(resp.status()));
+    }
+    let page: AuthProvidersPage = resp.json().await.map_err(|e| e.to_string())?;
+    Ok(page.providers)
+}
+
 /// Fetch the card games the platform can host (for the creation dropdown).
 pub async fn game_types() -> Result<Vec<GameTypeInfo>, String> {
     let resp = Request::get("/api/game-types")
@@ -87,16 +100,46 @@ pub async fn join_preview(code: &str) -> Result<Option<JoinPreview>, String> {
     resp.json().await.map(Some).map_err(|e| e.to_string())
 }
 
-#[allow(dead_code)]
-pub async fn game_state(game_id: &str) -> Result<GameView, String> {
-    let resp = Request::get(&format!("/api/games/{game_id}"))
+/// Why a game connection failed before the first snapshot arrived.
+///
+/// A refused WebSocket handshake is invisible to the browser: the close
+/// event reports an abnormal closure (1006) with no HTTP status, so the
+/// game page asks the REST API to tell a deliberate rejection from a
+/// transient network problem. Anonymous users and non-players are
+/// welcome as spectators, so the only deliberate refusal is an unknown
+/// game.
+pub enum GameEntry {
+    /// Unknown game (`404`): the id is wrong or the game's TTL expired.
+    Unavailable,
+    /// The API could not be asked (or answered unexpectedly): treat the
+    /// connection loss as transient and retry.
+    Transient,
+}
+
+/// Classify a failed game connection via `GET /api/games/{game_id}`,
+/// mirroring the status used to refuse the websocket upgrade.
+pub async fn probe_game(game_id: &str) -> GameEntry {
+    match Request::get(&format!("/api/games/{game_id}")).send().await {
+        Ok(resp) => match resp.status() {
+            404 => GameEntry::Unavailable,
+            _ => GameEntry::Transient,
+        },
+        Err(_) => GameEntry::Transient,
+    }
+}
+
+/// Fetch the live games the caller is seated in, for the lobby's
+/// "Continue" list.
+pub async fn my_games() -> Result<Vec<MyGame>, String> {
+    let resp = Request::get("/api/me/games")
         .send()
         .await
         .map_err(|e| e.to_string())?;
     if !resp.ok() {
         return Err(server_error(resp.status()));
     }
-    resp.json().await.map_err(|e| e.to_string())
+    let page: MyGamesPage = resp.json().await.map_err(|e| e.to_string())?;
+    Ok(page.results)
 }
 
 pub async fn my_matches(cursor: Option<&str>) -> Result<MatchesPage, String> {
@@ -123,8 +166,10 @@ pub async fn my_ratings() -> Result<RatingsPage, String> {
     resp.json().await.map_err(|e| e.to_string())
 }
 
-pub async fn leaderboard() -> Result<LeaderboardPage, String> {
-    let resp = Request::get("/api/leaderboard")
+/// Fetch the leaderboard for one game type: Elo, wins, matches and points
+/// are all scoped to that game.
+pub async fn leaderboard(game_type: &str) -> Result<LeaderboardPage, String> {
+    let resp = Request::get(&format!("/api/leaderboard?game_type={game_type}"))
         .send()
         .await
         .map_err(|e| e.to_string())?;

web/src/components/briscola.rs

@@ -0,0 +1,232 @@
+//! The briscola deal-end summary screen.
+//!
+//! Shown when a deal finishes but the match continues: the points won in
+//! the deal just played, the running totals toward the target and the
+//! acknowledgement button (the server deals on when everyone is ready, or
+//! after the hand-end timeout).
+use sycamore::prelude::*;
+
+use crate::components::card::{card_back, card_img};
+use crate::model::{card_label, is_chiamata, is_individual_game, DealSummary, GameView};
+use crate::ws::GameSocket;
+
+/// Names of the two sides: the caller and partner for briscola chiamata,
+/// the players' names for games without partnerships (classic two-player
+/// briscola), "Team A"/"Team B" otherwise.
+fn side_names(game: &GameView) -> (String, String) {
+    if is_chiamata(&game.game_type) {
+        game.chiamata_sides()
+    } else if is_individual_game(&game.game_type) {
+        (
+            game.player_name_for_team("A"),
+            game.player_name_for_team("B"),
+        )
+    } else {
+        ("Team A".to_string(), "Team B".to_string())
+    }
+}
+
+/// One explanatory row: icon, title, plain-language sentence, points chip.
+fn summary_row(
+    icon: View,
+    title: &'static str,
+    text: String,
+    cls: &'static str,
+    chip: String,
+) -> View {
+    view! {
+        div(class=cls) {
+            div(class="score-icon") { (icon) }
+            div(class="score-body") {
+                div(class="score-title") { (title) }
+                div(class="score-text") { (text) }
+            }
+            div(class="score-points") { (chip) }
+        }
+    }
+}
+
+/// The scoring rows of one completed deal (also used by the final screen).
+pub fn deal_rows(game: &GameView, summary: &DealSummary) -> View {
+    let a = summary.points.a;
+    let b = summary.points.b;
+    let (name_a, name_b) = side_names(game);
+    let cls = if summary.patta {
+        "score-row tie"
+    } else if a > b {
+        "score-row team-a"
+    } else {
+        "score-row team-b"
+    };
+    let chip = if summary.patta {
+        "patta".to_string()
+    } else {
+        format!("+{a} · +{b}")
+    };
+    let patta_note = summary.patta.then(|| view! {
+        p(class="text-warning small mb-0") {
+            "60–60: patta — the deal is replayed and its points do not count."
+        }
+    });
+    let called_row = if is_chiamata(&game.game_type) {
+        game.called_card.clone().map(|code| {
+            let label = card_label(&code);
+            let text = if game.solo {
+                format!("{name_a} called {label} in hand and plays alone.")
+            } else {
+                format!("{label}: its holder is the secret partner; its suit is trump.")
+            };
+            summary_row(
+                card_img(code, "score-mini"),
+                "Chiamata",
+                text,
+                "score-row chiamata-row",
+                label,
+            )
+        })
+    } else {
+        None
+    };
+    let points_row = summary_row(
+        card_img("01D".to_string(), "score-mini"),
+        "Deal points",
+        format!("{name_a} {a} · {name_b} {b}"),
+        cls,
+        chip,
+    );
+    let cards = summary.cards.map(|c| {
+        summary_row(
+            card_back("score-mini"),
+            "Cards captured",
+            format!("{name_a} {} · {name_b} {}", c.a, c.b),
+            "score-row",
+            format!("{} · {}", c.a, c.b),
+        )
+    });
+    view! {
+        div(class="score-rows") {
+            (called_row)
+            (points_row)
+            (patta_note)
+            (cards)
+        }
+    }
+}
+
+/// Running totals with progress toward the target, including the points
+/// gained in the deal just played (zero for a patta).
+fn totals(game: &GameView, summary: &DealSummary) -> View {
+    // Briscola chiamata plays a single deal: there is no running total.
+    let Some(running) = summary.totals else {
+        return view! {};
+    };
+    let target = game.target_score.max(1);
+    let pct_a = (100 * running.a / target).min(100);
+    let pct_b = (100 * running.b / target).min(100);
+    let (gained_a, gained_b) = if summary.patta {
+        (0, 0)
+    } else {
+        (summary.points.a, summary.points.b)
+    };
+    let (name_a, name_b) = side_names(game);
+    view! {
+        div(class="totals") {
+            div(class="total-row team-a") {
+                span(class="total-label") { (name_a) }
+                div(class="progress") {
+                    div(class="progress-fill", style=format!("width: {pct_a}%")) {}
+                }
+                span(class="total-value") {
+                    (running.a) " / " (target)
+                    span(class="gained") { "+" (gained_a) }
+                }
+            }
+            div(class="total-row team-b") {
+                span(class="total-label") { (name_b) }
+                div(class="progress") {
+                    div(class="progress-fill", style=format!("width: {pct_b}%")) {}
+                }
+                span(class="total-value") {
+                    (running.b) " / " (target)
+                    span(class="gained") { "+" (gained_b) }
+                }
+            }
+        }
+    }
+}
+
+/// The full deal-end modal: points + totals + acknowledgement button.
+pub fn deal_summary_modal(
+    game: GameView,
+    socket: Signal<Option<GameSocket>>,
+    now: Signal<f64>,
+) -> View {
+    let Some(summary) = game.last_deal.clone() else {
+        return view! {};
+    };
+    let viewer_seat = game
+        .players
+        .iter()
+        .find(|p| p.hand.is_some())
+        .map(|p| p.seat);
+    let acked = game.acknowledged.clone();
+    let already_acked = viewer_seat.is_some_and(|s| acked.contains(&s));
+    let waiting: Vec<String> = game
+        .players
+        .iter()
+        .filter(|p| !acked.contains(&p.seat))
+        .map(|p| p.name.clone())
+        .collect();
+    let countdown = game.hand_end_deadline.as_ref().map(|deadline| {
+        // A dynamic closure so only the ticking number re-renders, not the
+        // whole modal (which would swap DOM nodes under the user's cursor).
+        let deadline_ms = js_sys::Date::parse(deadline);
+        view! {
+            p(class="text-secondary small") {
+                "Auto-continuing in "
+                (move || {
+                    ((deadline_ms - now.get_clone()) / 1000.0).ceil().max(0.0) as i32
+                })
+                "s"
+            }
+        }
+    });
+
+    let title = format!("Deal {} — results", summary.deal);
+    let rows = deal_rows(&game, &summary);
+    let totals_view = totals(&game, &summary);
+
+    let action = if game.spectator {
+        // Spectators cannot acknowledge; they just watch the summary.
+        view! {
+            p(class="text-secondary small mb-0") {
+                "Spectating — the next deal is dealt when every player is ready."
+            }
+        }
+    } else if already_acked {
+        let waiting_text = format!("Waiting for {}…", waiting.join(", "));
+        view! {
+            button(class="btn btn-warning", disabled=true) { (waiting_text) }
+        }
+    } else {
+        view! {
+            button(class="btn btn-warning", on:click=move |_| {
+                if let Some(s) = socket.get_clone() {
+                    s.ack();
+                }
+            }) { "Understood, next deal" }
+        }
+    };
+
+    view! {
+        div(class="overlay") {
+            div(class="picker summary-panel") {
+                h2 { (title) }
+                (rows)
+                (totals_view)
+                div(class="summary-actions") { (action) }
+                (countdown)
+            }
+        }
+    }
+}

web/src/components/copy.rs

@@ -0,0 +1,45 @@
+//! Clipboard copy button, shared by the join-code and watch-link actions.
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use sycamore::prelude::*;
+
+/// A button that copies `text` to the clipboard and shows "Copied!" for a
+/// moment. `label` is the idle caption.
+#[component(inline_props)]
+pub fn CopyButton(text: String, label: String) -> View {
+    let copied = create_signal(false);
+    // Held so the reset timer is cancelled if the button is rebuilt (e.g.
+    // another player joins) while the "Copied!" feedback is showing:
+    // firing it afterwards would set a disposed signal and panic.
+    let reset_timer: Rc<RefCell<Option<gloo_timers::callback::Timeout>>> =
+        Rc::new(RefCell::new(None));
+    on_cleanup({
+        let reset_timer = reset_timer.clone();
+        move || {
+            reset_timer.borrow_mut().take();
+        }
+    });
+
+    let on_click = {
+        let text = text.clone();
+        move |_| {
+            if let Some(win) = web_sys::window() {
+                let _ = win.navigator().clipboard().write_text(&text);
+            }
+            copied.set(true);
+            *reset_timer.borrow_mut() = Some(gloo_timers::callback::Timeout::new(
+                1500,
+                move || {
+                    copied.set(false);
+                },
+            ));
+        }
+    };
+
+    view! {
+        button(class="btn btn-outline-light", on:click=on_click) {
+            (move || if copied.get() { "Copied!".to_string() } else { label.clone() })
+        }
+    }
+}

web/src/components/mod.rs

@@ -1,4 +1,6 @@
+pub mod briscola;
 pub mod card;
+pub mod copy;
 pub mod nav;
 pub mod summary;
 pub mod toast;

web/src/components/summary.rs

@@ -260,7 +260,14 @@ pub fn hand_summary_modal(
     let totals_view = totals(&game);
     let title = format!("Hand {} — results", summary.hand);
 
-    let action = if already_acked {
+    let action = if game.spectator {
+        // Spectators cannot acknowledge; they just watch the summary.
+        view! {
+            p(class="text-secondary small mb-0") {
+                "Spectating — the next hand is dealt when every player is ready."
+            }
+        }
+    } else if already_acked {
         let waiting_text = format!("Waiting for {}…", waiting.join(", "));
         view! {
             button(class="btn btn-warning", disabled=true) { (waiting_text) }

web/src/model.rs

@@ -19,19 +19,25 @@ pub struct PlayerView {
     pub sub: String,
     pub name: String,
     pub seat: usize,
-    pub team: String,
+    /// Game-defined role/team label; empty before briscola chiamata
+    /// reveals the roles.
+    #[serde(default)]
+    pub team: Option<String>,
     #[serde(default)]
     pub cards_left: usize,
     #[serde(default)]
     pub captured_count: usize,
     #[serde(default)]
     pub scope: i32,
+    /// Briscola: point value of the player's captured pile.
+    #[serde(default)]
+    pub points: i32,
     /// Own hand only; absent for the other players.
     #[serde(default)]
     pub hand: Option<Vec<String>>,
 }
 
-#[derive(Debug, Clone, Copy, Deserialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Deserialize)]
 pub struct Scores {
     #[serde(rename = "A")]
     pub a: i32,
@@ -54,6 +60,50 @@ pub struct MoveView {
     pub pigliatutto: bool,
 }
 
+/// One card played in the current briscola trick, in play order.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct TrickCard {
+    pub seat: usize,
+    pub card: String,
+}
+
+/// The most recently completed briscola trick.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct LastTrick {
+    pub winner: usize,
+    #[serde(default)]
+    pub cards: Vec<TrickCard>,
+}
+
+/// The scoring breakdown of one completed briscola deal.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct DealSummary {
+    #[serde(default)]
+    pub deal: i32,
+    /// A 60-60 deal: its points are discarded and the deal is replayed.
+    #[serde(default)]
+    pub patta: bool,
+    pub points: Scores,
+    /// Running match totals; absent for briscola chiamata, whose match is
+    /// a single deal.
+    #[serde(default)]
+    pub totals: Option<Scores>,
+    #[serde(default)]
+    pub cards: Option<TeamCounts>,
+    /// Briscola chiamata: the points target of the played deal.
+    #[serde(default)]
+    pub declared_target: Option<i32>,
+    /// Briscola chiamata: the card named by the caller.
+    #[serde(default)]
+    pub called_card: Option<String>,
+    /// Briscola chiamata: the caller played without a partner.
+    #[serde(default)]
+    pub solo: bool,
+}
+
 #[derive(Debug, Clone, Copy, Deserialize)]
 pub struct TeamCounts {
     #[serde(rename = "A")]
@@ -112,11 +162,16 @@ pub struct HandSummary {
 #[allow(dead_code)]
 pub struct GameView {
     pub id: String,
+    /// The lobby join code; withheld by the server from spectators.
     #[serde(default)]
     pub join_code: String,
     /// Which card game this match is (id from /api/game-types).
     #[serde(default)]
     pub game_type: String,
+    /// Whether the viewer is watching without a seat: no hand, no join
+    /// code, and actions are rejected by the server.
+    #[serde(default)]
+    pub spectator: bool,
     /// Whether the napola rule is scored in this match.
     #[serde(default = "default_true")]
     pub napola: bool,
@@ -163,6 +218,147 @@ pub struct GameView {
     /// Legal captures per hand card; present only for the player on turn.
     #[serde(default)]
     pub legal_moves: Option<HashMap<String, Vec<Vec<String>>>>,
+    /// Briscola: number of seats at the table (2 or 4).
+    #[serde(default)]
+    pub player_count: usize,
+    /// Briscola: trump suit of the current deal (empty for other games).
+    #[serde(default)]
+    pub briscola_suit: String,
+    /// Briscola: the face-up trump card, until it is drawn.
+    #[serde(default)]
+    pub briscola_card: Option<String>,
+    /// Briscola: face-down cards left in the stock.
+    #[serde(default)]
+    pub stock_count: usize,
+    /// Briscola: cards of the trick in progress, in play order.
+    #[serde(default)]
+    pub trick: Vec<TrickCard>,
+    /// Briscola: seat that led the current trick.
+    #[serde(default)]
+    pub trick_leader: Option<usize>,
+    /// Briscola: the most recently completed trick.
+    #[serde(default)]
+    pub last_trick: Option<LastTrick>,
+    /// Briscola: scoring breakdown of the most recent deal.
+    #[serde(default)]
+    pub last_deal: Option<DealSummary>,
+    /// Briscola chiamata: the calling auction of the current deal.
+    #[serde(default)]
+    pub auction: Option<AuctionView>,
+    /// Briscola chiamata: seat that won the auction.
+    #[serde(default)]
+    pub caller: Option<usize>,
+    /// Briscola chiamata: the named card; its suit is the trump.
+    #[serde(default)]
+    pub called_card: Option<String>,
+    /// Briscola chiamata: points the calling side must reach.
+    #[serde(default)]
+    pub declared_target: i32,
+    /// Briscola chiamata: the called card has been played; roles are
+    /// public from then on.
+    #[serde(default)]
+    pub called_played: bool,
+    /// Briscola chiamata: the partner's seat, once revealed.
+    #[serde(default)]
+    pub partner: Option<usize>,
+    /// Briscola chiamata: the caller named one of their own cards.
+    #[serde(default)]
+    pub solo: bool,
+    /// Briscola chiamata: legal bids for the player on turn.
+    #[serde(default)]
+    pub legal_bids: Option<LegalBids>,
+    /// Briscola chiamata: the cards the auction winner may name.
+    #[serde(default)]
+    pub callable_cards: Option<Vec<String>>,
+    /// Briscola chiamata: ISO-8601 deadline of the auction turn.
+    #[serde(default)]
+    pub auction_deadline: Option<String>,
+    /// Briscola chiamata: ISO-8601 deadline of the auction winner's call.
+    #[serde(default)]
+    pub call_deadline: Option<String>,
+}
+
+/// One bid of the briscola chiamata auction.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct AuctionBid {
+    pub seat: usize,
+    /// Rank bid: 1 ace, 3 three, 10 king, ... 2 two.
+    pub rank: i32,
+    /// Points target the bid commits its side to.
+    #[serde(default)]
+    pub points: i32,
+}
+
+/// The briscola chiamata calling auction.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct AuctionView {
+    /// Seat to act.
+    pub turn: usize,
+    #[serde(default)]
+    pub active: Vec<usize>,
+    #[serde(default)]
+    pub passed: Vec<usize>,
+    /// The standing bid, if any.
+    #[serde(default)]
+    pub current: Option<AuctionBid>,
+    #[serde(default)]
+    pub history: Vec<AuctionBid>,
+}
+
+/// The bids available to the player on turn.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct LegalBids {
+    /// Ranks that may be bid, strongest first (empty at the point stage).
+    #[serde(default)]
+    pub ranks: Vec<i32>,
+    /// Lowest legal points raise, when the standing bid is the two.
+    #[serde(default)]
+    pub points_min: Option<i32>,
+    #[serde(default)]
+    pub points_max: Option<i32>,
+}
+
+impl GameView {
+    /// Display name of the player on team `team` ("A"/"B"), for games
+    /// without partnerships; falls back to the team label itself.
+    pub fn player_name_for_team(&self, team: &str) -> String {
+        self.players
+            .iter()
+            .find(|p| p.team.as_deref() == Some(team))
+            .map(|p| p.name.clone())
+            .unwrap_or_else(|| team.to_string())
+    }
+
+    /// Display name of the player in `seat`.
+    pub fn player_name_for_seat(&self, seat: usize) -> String {
+        self.players
+            .iter()
+            .find(|p| p.seat == seat)
+            .map(|p| p.name.clone())
+            .unwrap_or_else(|| format!("Seat {seat}"))
+    }
+
+    /// Side labels for briscola chiamata: the caller (with the partner's
+    /// name once revealed, or "(solo)") against the defenders.
+    pub fn chiamata_sides(&self) -> (String, String) {
+        let side_a = match self.caller {
+            Some(caller) => {
+                let caller_name = self.player_name_for_seat(caller);
+                match self.partner {
+                    Some(partner) => {
+                        format!("{caller_name} & {}", self.player_name_for_seat(partner))
+                    }
+                    None if self.called_played => format!("{caller_name} (solo)"),
+                    None => caller_name,
+                }
+            }
+            None => "Chiamante".to_string(),
+        };
+        (side_a, "Difensori".to_string())
+    }
 }
 
 #[derive(Debug, Deserialize)]
@@ -344,6 +540,59 @@ pub struct GameTypesPage {
     pub results: Vec<GameTypeInfo>,
 }
 
+/// The games to show in the lobby's and leaderboard's game selectors when
+/// the `/api/game-types` fetch fails: match creation and per-game views
+/// must still work.
+pub fn fallback_game_types() -> Vec<GameTypeInfo> {
+    vec![
+        GameTypeInfo {
+            id: "scopone_scientifico".to_string(),
+            name: "Scopone scientifico".to_string(),
+            description: String::new(),
+            min_players: 4,
+            max_players: 4,
+            options_schema: serde_json::Value::Null,
+        },
+        GameTypeInfo {
+            id: "briscola".to_string(),
+            name: "Briscola".to_string(),
+            description: String::new(),
+            min_players: 2,
+            max_players: 2,
+            options_schema: serde_json::Value::Null,
+        },
+        GameTypeInfo {
+            id: "briscola_a_quattro".to_string(),
+            name: "Briscola a quattro".to_string(),
+            description: String::new(),
+            min_players: 4,
+            max_players: 4,
+            options_schema: serde_json::Value::Null,
+        },
+        GameTypeInfo {
+            id: "briscola_chiamata".to_string(),
+            name: "Briscola chiamata".to_string(),
+            description: String::new(),
+            min_players: 5,
+            max_players: 5,
+            options_schema: serde_json::Value::Null,
+        },
+    ]
+}
+
+/// One configured OIDC login provider (GET /api/auth/providers).
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+pub struct AuthProvider {
+    pub name: String,
+    pub login_url: String,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct AuthProvidersPage {
+    #[serde(default)]
+    pub providers: Vec<AuthProvider>,
+}
+
 /// A join-code lookup result (GET /api/games/preview): the game's lobby
 /// payload plus its display name, for the pre-join summary. The options
 /// echoed by the engine land in `details` under their `options_schema`
@@ -377,6 +626,66 @@ pub struct PreviewPlayer {
     pub team: Option<String>,
 }
 
+/// One ongoing game the caller is seated in (GET /api/me/games): the
+/// lobby payload plus the game's display name, for the "Continue" list.
+#[derive(Debug, Clone, Deserialize)]
+#[allow(dead_code)]
+pub struct MyGame {
+    pub id: String,
+    #[serde(default)]
+    pub game_type: String,
+    #[serde(default)]
+    pub game_name: String,
+    #[serde(default)]
+    pub game_description: String,
+    #[serde(default)]
+    pub phase: String,
+    #[serde(default)]
+    pub players: Vec<PreviewPlayer>,
+    #[serde(default)]
+    pub seats_open: Option<usize>,
+    #[serde(default)]
+    pub your_seat: Option<usize>,
+    #[serde(default)]
+    pub created_at: Option<String>,
+}
+
+impl MyGame {
+    /// Human-readable phase for the lobby list.
+    pub fn phase_label(&self) -> &'static str {
+        match self.phase.as_str() {
+            "lobby" => "Waiting for players",
+            "hand_end" => "Between hands",
+            _ => "In progress",
+        }
+    }
+
+    /// Seated/total note, e.g. `"2/4 seated"`.
+    pub fn seats_text(&self) -> String {
+        match self.seats_open {
+            Some(open) => {
+                format!("{}/{} seated", self.players.len(), self.players.len() + open)
+            }
+            None => format!("{} seated", self.players.len()),
+        }
+    }
+
+    /// The seated players' names, for the list subtitle.
+    pub fn players_text(&self) -> String {
+        self.players
+            .iter()
+            .map(|p| p.name.clone())
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct MyGamesPage {
+    #[serde(default)]
+    pub results: Vec<MyGame>,
+}
+
 /// One option to show in the join preview, rendered from the game's
 /// schema and the engine-echoed value.
 #[derive(Debug, Clone, PartialEq)]
@@ -549,8 +858,70 @@ pub fn card_asset(code: &str) -> String {
     format!("/assets/cards/{code}.svg")
 }
 
+/// Whether a game type is one of the briscola variants.
+pub fn is_briscola(game_type: &str) -> bool {
+    game_type == "briscola" || game_type == "briscola_a_quattro"
+}
+
+/// Whether a game type is five-player briscola chiamata, which has its
+/// own table view (auction, secret partner, five seats).
+pub fn is_chiamata(game_type: &str) -> bool {
+    game_type == "briscola_chiamata"
+}
+
+/// The Italian rank name used by the auction UI: `1` -> "Asso", `3` ->
+/// "Tre", `10` -> "Re", and so on.
+pub fn rank_name(rank: i32) -> String {
+    match rank {
+        1 => "Asso".to_string(),
+        2 => "Due".to_string(),
+        3 => "Tre".to_string(),
+        4 => "Quattro".to_string(),
+        5 => "Cinque".to_string(),
+        6 => "Sei".to_string(),
+        7 => "Sette".to_string(),
+        8 => "Fante".to_string(),
+        9 => "Cavallo".to_string(),
+        10 => "Re".to_string(),
+        other => other.to_string(),
+    }
+}
+
+/// Whether a game is played by two individuals rather than partnerships
+/// (classic two-player briscola): team labels and team messages are
+/// replaced by the players' names.
+pub fn is_individual_game(game_type: &str) -> bool {
+    game_type == "briscola"
+}
+
+/// Human-readable suit name for a one-letter code (`D` -> "denari").
+pub fn suit_name(suit: &str) -> String {
+    match suit {
+        "D" => "denari".to_string(),
+        "C" => "coppe".to_string(),
+        "S" => "spade".to_string(),
+        "B" => "bastoni".to_string(),
+        _ => suit.to_string(),
+    }
+}
+
 pub const CARD_BACK: &str = "/assets/cards/back.svg";
 
+/// Display order key for a hand: rank ascending (01..10, i.e. 1..7 then
+/// Fante, Cavallo, Re), then suit (denari, coppe, spade, bastoni).
+/// Malformed codes sort last.
+pub fn hand_sort_key(code: &str) -> (u8, u8) {
+    let rank = code.get(..2).and_then(|r| r.parse().ok()).unwrap_or(u8::MAX);
+    let suit = match code.get(2..3) {
+        Some("D") => 0,
+        Some("C") => 1,
+        Some("S") => 2,
+        Some("B") => 3,
+        _ => u8::MAX,
+    };
+    (rank, suit)
+}
+
 /// Human-friendly rank+suit label, e.g. `07D` -> "7 of denari".
 pub fn card_label(code: &str) -> String {
     if code.len() != 3 {
@@ -600,6 +971,38 @@ mod tests {
         assert_eq!("7 di denari", card_label("07D"));
     }
 
+    #[test]
+    fn hand_sort_orders_ranks_ascending() {
+        let mut hand = vec![
+            "10B".to_string(),
+            "01S".to_string(),
+            "07D".to_string(),
+            "08C".to_string(),
+        ];
+        hand.sort_by_key(|c| hand_sort_key(c));
+        assert_eq!(vec!["01S", "07D", "08C", "10B"], hand);
+    }
+
+    #[test]
+    fn hand_sort_breaks_ties_by_suit() {
+        let mut hand = vec![
+            "02B".to_string(),
+            "02S".to_string(),
+            "02C".to_string(),
+            "02D".to_string(),
+            "01S".to_string(),
+        ];
+        hand.sort_by_key(|c| hand_sort_key(c));
+        assert_eq!(vec!["01S", "02D", "02C", "02S", "02B"], hand);
+    }
+
+    #[test]
+    fn hand_sort_puts_malformed_codes_last() {
+        let mut hand = vec!["07D".to_string(), "xx".to_string(), "AB1".to_string()];
+        hand.sort_by_key(|c| hand_sort_key(c));
+        assert_eq!(vec!["07D", "xx", "AB1"], hand);
+    }
+
     fn scopone_match() -> MatchSummary {
         serde_json::from_value(json!({
             "id": "m1",
@@ -782,7 +1185,7 @@ mod tests {
         assert_eq!(16, g.target_score);
         assert!(!g.napola);
         assert!(g.asso_pigliatutto);
-        assert_eq!("A", g.players[0].team);
+        assert_eq!(Some("A".to_string()), g.players[0].team);
     }
 
     #[test]
@@ -820,11 +1223,39 @@ mod tests {
         .unwrap();
         assert_eq!("playing", g.phase);
         assert!(g.asso_pigliatutto);
+        assert!(!g.spectator);
         assert_eq!(None, g.players[0].hand);
         assert_eq!(Some(vec!["01D".to_string()]), g.players[1].hand);
         assert_eq!(Some(true), g.your_turn);
     }
 
+    #[test]
+    fn game_view_parses_spectator_snapshot() {
+        // A spectator payload: no hand anywhere, no join code, but the
+        // public table state is present.
+        let g: GameView = serde_json::from_value(json!({
+            "id": "11111111-2222-3333-4444-555555555555",
+            "game_type": "scopone_scientifico",
+            "spectator": true,
+            "phase": "playing",
+            "target_score": 11,
+            "scores": {"A": 2, "B": 1},
+            "table": ["07C"],
+            "players": [
+                {"sub": "alice", "name": "Alice", "seat": 0, "team": "A",
+                 "cards_left": 5, "captured_count": 12, "scope": 1},
+            ],
+        }))
+        .unwrap();
+        assert!(g.spectator);
+        assert_eq!("", g.join_code);
+        assert_eq!(Some(Scores { a: 2, b: 1 }), g.scores);
+        assert_eq!(vec!["07C".to_string()], g.table);
+        assert_eq!(None, g.players[0].hand);
+        assert_eq!(12, g.players[0].captured_count);
+        assert_eq!(1, g.players[0].scope);
+    }
+
     #[test]
     fn move_view_parses_pigliatutto() {
         let mv: MoveView = serde_json::from_value(json!({
@@ -961,4 +1392,336 @@ mod tests {
         assert!(g.default_options().is_empty());
         assert_eq!(0, g.min_players);
     }
+
+    #[test]
+    fn is_briscola_matches_both_variants() {
+        assert!(is_briscola("briscola"));
+        assert!(is_briscola("briscola_a_quattro"));
+        assert!(!is_briscola("briscola_chiamata"));
+        assert!(!is_briscola("scopone_scientifico"));
+        assert!(is_chiamata("briscola_chiamata"));
+        assert!(!is_chiamata("briscola"));
+        assert_eq!("denari", suit_name("D"));
+        assert_eq!("coppe", suit_name("C"));
+        assert_eq!("spade", suit_name("S"));
+        assert_eq!("bastoni", suit_name("B"));
+        assert_eq!("?", suit_name("?"));
+    }
+
+    #[test]
+    fn rank_names_cover_the_ladder() {
+        assert_eq!("Asso", rank_name(1));
+        assert_eq!("Due", rank_name(2));
+        assert_eq!("Tre", rank_name(3));
+        assert_eq!("Fante", rank_name(8));
+        assert_eq!("Cavallo", rank_name(9));
+        assert_eq!("Re", rank_name(10));
+    }
+
+    #[test]
+    fn is_individual_game_only_matches_two_player_briscola() {
+        assert!(is_individual_game("briscola"));
+        assert!(!is_individual_game("briscola_a_quattro"));
+        assert!(!is_individual_game("scopone_scientifico"));
+    }
+
+    #[test]
+    fn player_name_for_team_resolves_names() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "b1",
+            "game_type": "briscola",
+            "phase": "playing",
+            "players": [
+                {"sub": "alice", "name": "Alice", "seat": 0, "team": "A"},
+                {"sub": "bob", "name": "Bob", "seat": 1, "team": "B"},
+            ],
+        }))
+        .unwrap();
+        assert_eq!("Alice", g.player_name_for_team("A"));
+        assert_eq!("Bob", g.player_name_for_team("B"));
+        // Unknown labels fall back to the label itself.
+        assert_eq!("C", g.player_name_for_team("C"));
+    }
+
+    #[test]
+    fn my_game_phase_and_seats_text() {
+        let g: MyGame = serde_json::from_value(json!({
+            "id": "g1",
+            "game_type": "briscola_a_quattro",
+            "game_name": "Briscola a quattro",
+            "phase": "lobby",
+            "players": [
+                {"name": "Alice", "seat": 0, "team": "A"},
+                {"name": "Bob", "seat": 1, "team": "B"},
+            ],
+            "seats_open": 2,
+        }))
+        .unwrap();
+        assert_eq!("Waiting for players", g.phase_label());
+        assert_eq!("2/4 seated", g.seats_text());
+        assert_eq!("Alice, Bob", g.players_text());
+
+        let playing: MyGame = serde_json::from_value(json!({
+            "id": "g2",
+            "game_type": "briscola",
+            "phase": "playing",
+        }))
+        .unwrap();
+        assert_eq!("In progress", playing.phase_label());
+        assert_eq!("0 seated", playing.seats_text());
+
+        let between: MyGame = serde_json::from_value(json!({
+            "id": "g3",
+            "phase": "hand_end",
+        }))
+        .unwrap();
+        assert_eq!("Between hands", between.phase_label());
+    }
+
+    #[test]
+    fn fallback_game_types_cover_the_registered_games() {
+        let types = fallback_game_types();
+        let ids: Vec<&str> = types.iter().map(|g| g.id.as_str()).collect();
+        assert_eq!(
+            vec![
+                "scopone_scientifico",
+                "briscola",
+                "briscola_a_quattro",
+                "briscola_chiamata",
+            ],
+            ids
+        );
+        // The lobby's first game (the creation default) must exist.
+        assert_eq!("scopone_scientifico", types[0].id);
+        assert_eq!(5, types[3].max_players);
+    }
+
+    #[test]
+    fn game_view_parses_briscola_payload() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "b1",
+            "join_code": "ABC123",
+            "game_type": "briscola",
+            "phase": "playing",
+            "target_score": 61,
+            "player_count": 2,
+            "hand_number": 1,
+            "dealer": 0,
+            "turn": 1,
+            "scores": {"A": 0, "B": 0},
+            "briscola_suit": "D",
+            "briscola_card": "07D",
+            "stock_count": 33,
+            "trick": [{"seat": 1, "card": "04C"}],
+            "trick_leader": 1,
+            "last_trick": null,
+            "players": [
+                {"sub": "alice", "name": "Alice", "seat": 0, "team": "A",
+                 "cards_left": 3, "captured_count": 0, "points": 0,
+                 "hand": ["01D"]},
+                {"sub": "bob", "name": "Bob", "seat": 1, "team": "B",
+                 "cards_left": 3, "captured_count": 0, "points": 0},
+            ],
+            "last_deal": null,
+            "acknowledged": [],
+            "hand_end_deadline": null,
+            "turn_deadline": "2026-01-01T00:00:30+00:00",
+            "your_turn": true,
+        }))
+        .unwrap();
+        assert!(is_briscola(&g.game_type));
+        assert_eq!("D", g.briscola_suit);
+        assert_eq!(Some("07D".to_string()), g.briscola_card);
+        assert_eq!(33, g.stock_count);
+        assert_eq!(1, g.trick.len());
+        assert_eq!(1, g.trick[0].seat);
+        assert_eq!("04C", g.trick[0].card);
+        assert_eq!(Some(1), g.trick_leader);
+        assert_eq!(0, g.players[0].points);
+        assert_eq!(Some(true), g.your_turn);
+    }
+
+    #[test]
+    fn game_view_parses_briscola_deal_summary() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "b1",
+            "game_type": "briscola_a_quattro",
+            "phase": "hand_end",
+            "player_count": 4,
+            "scores": {"A": 55, "B": 65},
+            "last_deal": {
+                "deal": 1,
+                "patta": false,
+                "points": {"A": 55, "B": 65},
+                "totals": {"A": 55, "B": 65},
+                "cards": {"A": 19, "B": 21},
+            },
+            "last_trick": {
+                "winner": 3,
+                "cards": [
+                    {"seat": 0, "card": "02D"},
+                    {"seat": 1, "card": "05D"},
+                    {"seat": 2, "card": "04D"},
+                    {"seat": 3, "card": "07D"},
+                ],
+            },
+        }))
+        .unwrap();
+        let deal = g.last_deal.unwrap();
+        assert_eq!(1, deal.deal);
+        assert!(!deal.patta);
+        assert_eq!(Scores { a: 55, b: 65 }, deal.points);
+        assert_eq!(Some(Scores { a: 55, b: 65 }), deal.totals);
+        let cards = deal.cards.unwrap();
+        assert_eq!(19, cards.a);
+        assert_eq!(21, cards.b);
+        let trick = g.last_trick.unwrap();
+        assert_eq!(3, trick.winner);
+        assert_eq!(4, trick.cards.len());
+    }
+
+    #[test]
+    fn deal_summary_defaults() {
+        let d: DealSummary = serde_json::from_value(json!({
+            "points": {"A": 60, "B": 60},
+            "totals": {"A": 10, "B": 20},
+        }))
+        .unwrap();
+        assert!(!d.patta);
+        assert_eq!(0, d.deal);
+        assert!(d.cards.is_none());
+    }
+
+    #[test]
+    fn chiamata_deal_summary_has_no_totals() {
+        let d: DealSummary = serde_json::from_value(json!({
+            "deal": 2,
+            "patta": true,
+            "points": {"A": 60, "B": 60},
+            "declared_target": 61,
+            "called_card": "01D",
+            "caller": "Alice",
+            "solo": false,
+        }))
+        .unwrap();
+        assert!(d.patta);
+        assert_eq!(2, d.deal);
+        assert!(d.totals.is_none());
+        assert!(d.cards.is_none());
+        assert_eq!(Some(61), d.declared_target);
+        assert_eq!(Some("01D".to_string()), d.called_card);
+        assert!(!d.solo);
+    }
+
+    #[test]
+    fn game_view_parses_chiamata_auction() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "c1",
+            "join_code": "ABC123",
+            "game_type": "briscola_chiamata",
+            "phase": "auction",
+            "player_count": 5,
+            "dealer": 0,
+            "hand_number": 1,
+            "turn": 1,
+            "declared_target": 61,
+            "auction": {
+                "turn": 2,
+                "active": [0, 1, 2, 3, 4],
+                "passed": [],
+                "current": {"seat": 1, "rank": 10, "points": 61},
+                "history": [{"seat": 1, "rank": 10, "points": 61}],
+            },
+            "your_turn": true,
+            "legal_bids": {"ranks": [9, 8, 7, 6, 5, 4, 2], "points_min": null, "points_max": 120},
+            "players": [
+                {"sub": "alice", "name": "Alice", "seat": 0, "team": "",
+                 "cards_left": 8, "captured_count": 0, "points": 0, "hand": ["01D"]},
+                {"sub": "bob", "name": "Bob", "seat": 1, "team": "Chiamante",
+                 "cards_left": 8, "captured_count": 0, "points": 0},
+            ],
+            "auction_deadline": "2026-01-01T00:00:30+00:00",
+            "call_deadline": null,
+            "turn_deadline": null,
+        }))
+        .unwrap();
+        assert!(is_chiamata(&g.game_type));
+        assert!(!is_briscola(&g.game_type));
+        let auction = g.auction.unwrap();
+        assert_eq!(2, auction.turn);
+        assert_eq!(5, auction.active.len());
+        let current = auction.current.unwrap();
+        assert_eq!(1, current.seat);
+        assert_eq!(10, current.rank);
+        assert_eq!(61, current.points);
+        assert_eq!(1, auction.history.len());
+        let bids = g.legal_bids.unwrap();
+        assert_eq!(vec![9, 8, 7, 6, 5, 4, 2], bids.ranks);
+        assert!(bids.points_min.is_none());
+        assert_eq!(Some(120), bids.points_max);
+        assert_eq!(Some("".to_string()), g.players[0].team);
+        assert_eq!(Some("Chiamante".to_string()), g.players[1].team);
+    }
+
+    #[test]
+    fn game_view_parses_chiamata_playing_and_reveal() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "c2",
+            "game_type": "briscola_chiamata",
+            "phase": "playing",
+            "player_count": 5,
+            "dealer": 0,
+            "hand_number": 1,
+            "turn": 3,
+            "caller": 1,
+            "called_card": "03C",
+            "briscola_suit": "C",
+            "declared_target": 64,
+            "called_played": true,
+            "partner": 3,
+            "solo": false,
+            "scores": {"A": 45, "B": 30},
+            "players": [
+                {"sub": "a", "name": "A", "seat": 0, "team": "Difensori"},
+                {"sub": "b", "name": "B", "seat": 1, "team": "Chiamante"},
+                {"sub": "c", "name": "C", "seat": 2, "team": "Difensori"},
+                {"sub": "d", "name": "D", "seat": 3, "team": "Socio"},
+                {"sub": "e", "name": "E", "seat": 4, "team": "Difensori"},
+            ],
+        }))
+        .unwrap();
+        assert_eq!(Some(1), g.caller);
+        assert_eq!(Some("03C".to_string()), g.called_card);
+        assert_eq!("C", g.briscola_suit);
+        assert_eq!(64, g.declared_target);
+        assert!(g.called_played);
+        assert_eq!(Some(3), g.partner);
+        assert!(!g.solo);
+        assert_eq!(Some(Scores { a: 45, b: 30 }), g.scores);
+        assert_eq!(("B & D".to_string(), "Difensori".to_string()), g.chiamata_sides());
+    }
+
+    #[test]
+    fn chiamata_sides_label_the_solo_caller() {
+        let g: GameView = serde_json::from_value(json!({
+            "id": "c3",
+            "game_type": "briscola_chiamata",
+            "phase": "finished",
+            "scores": {"A": 70, "B": 50},
+            "winner": "Chiamante",
+            "caller": 2,
+            "called_played": true,
+            "solo": true,
+            "players": [
+                {"sub": "a", "name": "Alice", "seat": 0, "team": "Difensori"},
+                {"sub": "b", "name": "Bob", "seat": 1, "team": "Difensori"},
+                {"sub": "c", "name": "Carol", "seat": 2, "team": "Chiamante"},
+            ],
+        }))
+        .unwrap();
+        let (a, b) = g.chiamata_sides();
+        assert_eq!("Carol (solo)", a);
+        assert_eq!("Difensori", b);
+        assert_eq!(Some("Chiamante".to_string()), g.winner);
+    }
 }

web/src/pages/briscola.rs

@@ -0,0 +1,274 @@
+//! Briscola table view: classic two-player and four-player partnership.
+//!
+//! The two variants share this view: four seats render in the usual cross
+//! (partners opposite), two seats stack opponent over player. The center
+//! holds the trick in progress, the stock pile and the face-up briscola.
+use sycamore::prelude::*;
+
+use crate::components::card::{card_back, card_img};
+use crate::components::copy::CopyButton;
+use crate::model::{
+    hand_sort_key, is_individual_game, suit_name, GameView, PlayerView, Scores,
+};
+use crate::pages::game::watch_link;
+
+fn player_for_seat(game: &GameView, seat: usize) -> Option<PlayerView> {
+    game.players.iter().find(|p| p.seat == seat).cloned()
+}
+
+/// Panel for one player seat (name, team, hidden card count, points).
+fn seat_panel(game: GameView, seat: usize, position: &'static str) -> View {
+    let Some(player) = player_for_seat(&game, seat) else {
+        return view! {};
+    };
+    let active = game.phase == "playing" && game.turn == seat;
+    let cls = format!(
+        "seat seat-{position}{}",
+        if active { " active" } else { "" }
+    );
+    let name = player.name.clone();
+    let team_badge = (!is_individual_game(&game.game_type))
+        .then(|| player.team.clone())
+        .flatten()
+        .filter(|team| !team.is_empty())
+        .map(|team| view! { span(class="team-badge") { "Team " (team) } });
+    let points = player.points;
+    let captured = player.captured_count;
+    let backs = (0..player.cards_left)
+        .map(|_| card_back("mini"))
+        .collect::<Vec<_>>();
+    view! {
+        div(class=cls) {
+            div(class="seat-name") {
+                (name)
+                (team_badge)
+            }
+            div(class="seat-cards") { (backs) }
+            div(class="seat-stats") {
+                (points) " points · " (captured) " cards"
+            }
+        }
+    }
+}
+
+/// The stock pile with the face-up briscola card beside it.
+fn stock_view(game: &GameView) -> View {
+    let backs = (0..game.stock_count.min(3))
+        .map(|_| card_back("stock-card"))
+        .collect::<Vec<_>>();
+    let trump = game
+        .briscola_card
+        .clone()
+        .map(|code| card_img(code, "briscola-card"));
+    let label = format!("{} in stock", game.stock_count);
+    view! {
+        div(class="stock") {
+            div(class="stock-pile") { (backs) }
+            (trump)
+            span(class="stock-count") { (label) }
+        }
+    }
+}
+
+/// The cards of the trick in progress, in play order, with player names.
+fn trick_view(game: &GameView) -> View {
+    if game.trick.is_empty() {
+        return view! { p(class="table-empty") { "Empty table" } };
+    }
+    let cards = game
+        .trick
+        .iter()
+        .map(|tc| {
+            let name = player_for_seat(game, tc.seat)
+                .map(|p| p.name)
+                .unwrap_or_default();
+            let card = card_img(tc.card.clone(), "table-card");
+            view! {
+                div(class="trick-slot") {
+                    span(class="trick-name") { (name) }
+                    (card)
+                }
+            }
+        })
+        .collect::<Vec<_>>();
+    view! { (cards) }
+}
+
+/// Announcement strip for the most recently completed trick.
+fn last_trick_banner(game: &GameView) -> View {
+    let Some(trick) = game.last_trick.clone() else {
+        return view! {};
+    };
+    let name = player_for_seat(game, trick.winner)
+        .map(|p| p.name)
+        .unwrap_or_default();
+    let cards = trick
+        .cards
+        .iter()
+        .map(|tc| card_img(tc.card.clone(), "move-card"))
+        .collect::<Vec<_>>();
+    view! {
+        div(class="move-banner") {
+            strong { (name) }
+            span { " takes the trick " }
+            (cards)
+        }
+    }
+}
+
+/// The main briscola table.
+pub fn briscola_table(
+    game: GameView,
+    on_hand_card: impl Fn(String) + Copy + 'static,
+    now: Signal<f64>,
+) -> View {
+    // Own seat: the only player entry carrying a hand. Spectators have no
+    // hand, so they watch from seat 0's perspective.
+    let viewer_seat = game
+        .players
+        .iter()
+        .find(|p| p.hand.is_some())
+        .map(|p| p.seat)
+        .unwrap_or(0);
+    let player_count = if game.player_count > 0 {
+        game.player_count
+    } else {
+        game.players.len().max(1)
+    };
+    let my_turn = game.your_turn == Some(true);
+    let turn_note = if game.phase == "finished" {
+        "Match finished".to_string()
+    } else if game.phase == "hand_end" {
+        "Deal finished".to_string()
+    } else if my_turn {
+        "Your turn".to_string()
+    } else {
+        let name = player_for_seat(&game, game.turn)
+            .map(|p| p.name)
+            .unwrap_or_default();
+        format!("{name}'s turn")
+    };
+    let turn_cls = if my_turn { "turn-note you" } else { "turn-note" };
+    let countdown = game.turn_deadline.as_ref().map(|deadline| {
+        // A dynamic closure so only the ticking number re-renders.
+        let deadline_ms = js_sys::Date::parse(deadline);
+        view! {
+            span(class="turn-timer") {
+                "Auto-play in "
+                (move || {
+                    ((deadline_ms - now.get_clone()) / 1000.0).ceil().max(0.0) as i32
+                })
+                "s"
+            }
+        }
+    });
+
+    let scores = game.scores.unwrap_or(Scores { a: 0, b: 0 });
+    let target = game.target_score;
+    let deal = game.hand_number;
+    // Two-player briscola has no partnerships: show the players' names.
+    let score_line = if is_individual_game(&game.game_type) {
+        format!(
+            "{} {} — {} {} (target {})",
+            game.player_name_for_team("A"),
+            scores.a,
+            scores.b,
+            game.player_name_for_team("B"),
+            target
+        )
+    } else {
+        format!("Team A {} — {} Team B (target {})", scores.a, scores.b, target)
+    };
+
+    let (grid_cls, top, left, right) = if player_count == 2 {
+        (
+            "table-grid duo",
+            seat_panel(game.clone(), (viewer_seat + 1) % 2, "top"),
+            view! {},
+            view! {},
+        )
+    } else {
+        (
+            "table-grid",
+            seat_panel(game.clone(), (viewer_seat + 2) % 4, "top"),
+            seat_panel(game.clone(), (viewer_seat + 1) % 4, "left"),
+            seat_panel(game.clone(), (viewer_seat + 3) % 4, "right"),
+        )
+    };
+
+    let viewer = player_for_seat(&game, viewer_seat);
+    let my_points = viewer.as_ref().map(|p| p.points).unwrap_or(0);
+    let mut hand = viewer.and_then(|p| p.hand).unwrap_or_default();
+    hand.sort_by_key(|c| hand_sort_key(c));
+    let hand_cards = hand
+        .into_iter()
+        .map(|code| {
+            let card_view = card_img(code.clone(), "hand-card");
+            view! {
+                button(class="hand-slot", on:click=move |_| {
+                    if my_turn {
+                        on_hand_card(code.clone());
+                    }
+                }) { (card_view) }
+            }
+        })
+        .collect::<Vec<_>>();
+    let hint = my_turn.then(|| view! {
+        p(class="text-secondary small text-center") {
+            "Click a card to play it."
+        }
+    });
+
+    // Spectators have no hand: render the pivot seat as a regular panel so
+    // its points stay visible where the hand would be.
+    let bottom = if game.spectator {
+        seat_panel(game.clone(), viewer_seat, "bottom")
+    } else {
+        view! {
+            div(class="seat-bottom") {
+                div(class="seat-stats own-stats") { (my_points) " points" }
+                div(class="hand") { (hand_cards) }
+                (hint)
+            }
+        }
+    };
+
+    let spectator_badge = game.spectator.then(|| view! {
+        span(class="spectator-badge") { "Spectating" }
+    });
+    let watch_link = watch_link(&game.id);
+    let trump_badge = (!game.briscola_suit.is_empty()).then(|| {
+        let suit = suit_name(&game.briscola_suit);
+        view! { span(class="briscola-badge") { "Briscola: " (suit) } }
+    });
+    // Precomputed so the final view's closures only capture owned views.
+    let banner = last_trick_banner(&game);
+    let trick = trick_view(&game);
+    let stock = stock_view(&game);
+
+    view! {
+        div(class="table-wrap") {
+            div(class="hud") {
+                a(href="/") { "← Lobby" }
+                span { "Deal " (deal) }
+                (trump_badge)
+                (spectator_badge)
+                span(class="hud-scores") { (score_line) }
+                span(class=turn_cls) { (turn_note) }
+                (countdown)
+                CopyButton(text=watch_link, label="Copy watch link".to_string())
+            }
+            div(class=grid_cls) {
+                (top)
+                (left)
+                div(class="center") {
+                    (banner)
+                    div(class="table-cards") { (trick) }
+                    (stock)
+                }
+                (right)
+                (bottom)
+            }
+        }
+    }
+}

web/src/pages/chiamata.rs

@@ -0,0 +1,512 @@
+//! Briscola chiamata table: five seats, the calling auction and the
+//! secret-partner reveal.
+//!
+//! The auction starts with the player after the dealer: each player bids
+//! a lower rank than the standing bid (A > 3 > K > H > J > 7 > 6 > 5 >
+//! 4 > 2) or passes, and once the standing bid is the two the bidding
+//! continues on points. The last bidder names a card of the won rank:
+//! its holder is the secret partner, or the caller plays alone when it
+//! is one of their own cards, and its suit is the trump. The partner's
+//! identity is only revealed when the called card is played.
+use sycamore::prelude::*;
+
+use crate::components::card::{card_back, card_img};
+use crate::components::copy::CopyButton;
+use crate::model::{
+    card_label, hand_sort_key, rank_name, suit_name, AuctionBid, GameView, PlayerView,
+};
+use crate::pages::game::watch_link;
+use crate::ws::GameSocket;
+
+fn player_for_seat(game: &GameView, seat: usize) -> Option<PlayerView> {
+    game.players.iter().find(|p| p.seat == seat).cloned()
+}
+
+fn player_name(game: &GameView, seat: usize) -> String {
+    player_for_seat(game, seat)
+        .map(|p| p.name)
+        .unwrap_or_else(|| format!("Seat {seat}"))
+}
+
+/// Human label of one auction bid.
+fn bid_label(bid: &AuctionBid) -> String {
+    if bid.rank == 2 {
+        format!("2 at {} pts", bid.points)
+    } else {
+        rank_name(bid.rank)
+    }
+}
+
+/// Panel for one player seat (name, revealed role, hidden cards, points).
+fn seat_panel(game: GameView, seat: usize, position: &'static str) -> View {
+    let Some(player) = player_for_seat(&game, seat) else {
+        return view! {};
+    };
+    let active = game.phase == "playing" && game.turn == seat;
+    let cls = format!(
+        "seat seat-{position}{}",
+        if active { " active" } else { "" }
+    );
+    let name = player.name.clone();
+    // Role labels only appear once the server makes them public.
+    let role_badge = player
+        .team
+        .clone()
+        .filter(|role| !role.is_empty())
+        .map(|role| view! { span(class="team-badge role-badge") { (role) } });
+    let points = player.points;
+    let captured = player.captured_count;
+    let backs = (0..player.cards_left)
+        .map(|_| card_back("mini"))
+        .collect::<Vec<_>>();
+    view! {
+        div(class=cls) {
+            div(class="seat-name") {
+                (name)
+                (role_badge)
+            }
+            div(class="seat-cards") { (backs) }
+            div(class="seat-stats") {
+                (points) " points · " (captured) " cards"
+            }
+        }
+    }
+}
+
+/// The cards of the trick in progress, in play order, with player names.
+fn trick_view(game: &GameView) -> View {
+    if game.trick.is_empty() {
+        return view! { p(class="table-empty") { "Empty table" } };
+    }
+    let cards = game
+        .trick
+        .iter()
+        .map(|tc| {
+            let name = player_name(game, tc.seat);
+            let card = card_img(tc.card.clone(), "table-card");
+            view! {
+                div(class="trick-slot") {
+                    span(class="trick-name") { (name) }
+                    (card)
+                }
+            }
+        })
+        .collect::<Vec<_>>();
+    view! { (cards) }
+}
+
+/// Announcement strip for the most recently completed trick.
+fn last_trick_banner(game: &GameView) -> View {
+    let Some(trick) = game.last_trick.clone() else {
+        return view! {};
+    };
+    let name = player_name(game, trick.winner);
+    let cards = trick
+        .cards
+        .iter()
+        .map(|tc| card_img(tc.card.clone(), "move-card"))
+        .collect::<Vec<_>>();
+    view! {
+        div(class="move-banner") {
+            strong { (name) }
+            span { " takes the trick " }
+            (cards)
+        }
+    }
+}
+
+/// "Patta — the deal is replayed" after a 60-60 deal.
+fn patta_banner(game: &GameView) -> View {
+    let patta = game
+        .last_deal
+        .as_ref()
+        .is_some_and(|deal| deal.patta);
+    if !patta || game.phase != "auction" {
+        return view! {};
+    }
+    view! {
+        div(class="move-banner patta-banner") {
+            strong { "Patta!" }
+            span { " 60–60 — the deal is replayed." }
+        }
+    }
+}
+
+/// Announcement of the partner (or the solo caller) once the called card
+/// has hit the table.
+fn reveal_banner(game: &GameView) -> View {
+    if !game.called_played || game.phase == "auction" || game.phase == "calling" {
+        return view! {};
+    }
+    let caller = game
+        .caller
+        .map(|seat| player_name(game, seat))
+        .unwrap_or_default();
+    let text = if game.solo {
+        format!("{caller} is playing alone")
+    } else {
+        let partner = game
+            .partner
+            .map(|seat| player_name(game, seat))
+            .unwrap_or_default();
+        format!("{partner} is the partner of {caller}")
+    };
+    view! {
+        div(class="move-banner reveal-banner") {
+            span(class="reveal-text") { (text) }
+        }
+    }
+}
+
+/// The calling auction panel: standing bid, trail and, on turn, the bids.
+fn auction_panel(
+    game: &GameView,
+    on_bid_rank: impl Fn(i32) + Copy + 'static,
+    on_bid_points: impl Fn(i32) + Copy + 'static,
+    on_pass: impl Fn() + Copy + 'static,
+) -> View {
+    let Some(auction) = game.auction.clone() else {
+        return view! {};
+    };
+    let standing = match &auction.current {
+        Some(bid) => format!(
+            "Standing bid: {} — {}",
+            player_name(game, bid.seat),
+            bid_label(bid)
+        ),
+        None => "No bids yet".to_string(),
+    };
+    let waiting_for = player_name(game, auction.turn);
+    let history = auction
+        .history
+        .iter()
+        .map(|bid| {
+            let text = format!("{}: {}", player_name(game, bid.seat), bid_label(bid));
+            view! { span(class="auction-chip") { (text) } }
+        })
+        .collect::<Vec<_>>();
+
+    let actions = if game.your_turn == Some(true) {
+        let legal = game.legal_bids.clone();
+        let (rank_buttons, point_buttons) = match legal {
+            Some(bids) => {
+                let ranks = bids
+                    .ranks
+                    .iter()
+                    .map(|rank| {
+                        let rank = *rank;
+                        let name = rank_name(rank);
+                        view! {
+                            button(
+                                class="bid-button",
+                                on:click=move |_| on_bid_rank(rank),
+                            ) { (name) }
+                        }
+                    })
+                    .collect::<Vec<_>>();
+                let points = match (bids.points_min, bids.points_max) {
+                    (Some(min), Some(max)) => (0..=2)
+                        .map(|step| min + 2 * step)
+                        .filter(|points| *points <= max)
+                        .map(|points| {
+                            view! {
+                                button(
+                                    class="bid-button points",
+                                    on:click=move |_| on_bid_points(points),
+                                ) { (points) " pts" }
+                            }
+                        })
+                        .collect::<Vec<_>>(),
+                    _ => Vec::new(),
+                };
+                (ranks, points)
+            }
+            None => (Vec::new(), Vec::new()),
+        };
+        view! {
+            div(class="bid-options") {
+                (rank_buttons)
+                (point_buttons)
+                button(class="pass-button", on:click=move |_| on_pass()) { "Pass" }
+            }
+        }
+    } else {
+        view! {
+            p(class="text-secondary small mb-0") {
+                "Waiting for " (waiting_for) " to bid…"
+            }
+        }
+    };
+
+    view! {
+        div(class="auction-panel") {
+            div(class="auction-standing") { (standing) }
+            div(class="auction-history") { (history) }
+            (actions)
+        }
+    }
+}
+
+/// The main briscola chiamata table.
+pub fn chiamata_table(
+    game: GameView,
+    on_hand_card: impl Fn(String) + Copy + 'static,
+    on_bid_rank: impl Fn(i32) + Copy + 'static,
+    on_bid_points: impl Fn(i32) + Copy + 'static,
+    on_pass: impl Fn() + Copy + 'static,
+    now: Signal<f64>,
+) -> View {
+    // Own seat: the only player entry carrying a hand. Spectators have no
+    // hand, so they watch from seat 0's perspective.
+    let viewer_seat = game
+        .players
+        .iter()
+        .find(|p| p.hand.is_some())
+        .map(|p| p.seat)
+        .unwrap_or(0);
+    let my_turn = game.your_turn == Some(true);
+    let can_play = game.phase == "playing" && my_turn;
+
+    let turn_note = if game.phase == "finished" {
+        "Match finished".to_string()
+    } else if game.phase == "auction" {
+        if my_turn {
+            "Your bid".to_string()
+        } else {
+            let name = game
+                .auction
+                .as_ref()
+                .map(|a| player_name(&game, a.turn))
+                .unwrap_or_default();
+            format!("{name} to bid")
+        }
+    } else if game.phase == "calling" {
+        if my_turn {
+            "Name the called card".to_string()
+        } else {
+            let name = game
+                .caller
+                .map(|seat| player_name(&game, seat))
+                .unwrap_or_default();
+            format!("{name} is calling")
+        }
+    } else if my_turn {
+        "Your turn".to_string()
+    } else {
+        format!("{}'s turn", player_name(&game, game.turn))
+    };
+    let turn_cls = if my_turn { "turn-note you" } else { "turn-note" };
+
+    let deadline = if game.phase == "auction" {
+        game.auction_deadline.clone()
+    } else if game.phase == "calling" {
+        game.call_deadline.clone()
+    } else {
+        game.turn_deadline.clone()
+    };
+    let countdown = deadline.map(|deadline| {
+        // A dynamic closure so only the ticking number re-renders.
+        let deadline_ms = js_sys::Date::parse(&deadline);
+        view! {
+            span(class="turn-timer") {
+                "Auto in "
+                (move || {
+                    ((deadline_ms - now.get_clone()) / 1000.0).ceil().max(0.0) as i32
+                })
+                "s"
+            }
+        }
+    });
+
+    let score_line = match game.scores {
+        Some(scores) => {
+            let (side_a, side_b) = game.chiamata_sides();
+            format!(
+                "{side_a} {} — {} {side_b} (target {})",
+                scores.a, scores.b, game.declared_target
+            )
+        }
+        // Before the called card is played the side totals would leak the
+        // partner's identity; only the target is shown.
+        None => format!("Target {}", game.declared_target),
+    };
+
+    // Four opponents around the table: next player on the left, then
+    // clockwise up to the player before us on the right.
+    let left = seat_panel(game.clone(), (viewer_seat + 1) % 5, "left");
+    let top_left = seat_panel(game.clone(), (viewer_seat + 2) % 5, "tl");
+    let top_right = seat_panel(game.clone(), (viewer_seat + 3) % 5, "tr");
+    let right = seat_panel(game.clone(), (viewer_seat + 4) % 5, "right");
+
+    let patta = patta_banner(&game);
+    let reveal = reveal_banner(&game);
+    let center_content = match game.phase.as_str() {
+        "auction" => auction_panel(&game, on_bid_rank, on_bid_points, on_pass),
+        "calling" => {
+            let caller = game
+                .caller
+                .map(|seat| player_name(&game, seat))
+                .unwrap_or_default();
+            view! {
+                div(class="auction-panel") {
+                    div(class="auction-standing") { (caller) " won the auction" }
+                    p(class="text-secondary small mb-0") {
+                        "Choosing the called card…"
+                    }
+                }
+            }
+        }
+        _ => {
+            let banner = last_trick_banner(&game);
+            let trick = trick_view(&game);
+            view! {
+                (banner)
+                div(class="table-cards") { (trick) }
+            }
+        }
+    };
+
+    let viewer = player_for_seat(&game, viewer_seat);
+    let my_points = viewer.as_ref().map(|p| p.points).unwrap_or(0);
+    let mut hand = viewer.and_then(|p| p.hand).unwrap_or_default();
+    hand.sort_by_key(|c| hand_sort_key(c));
+    let hand_cards = hand
+        .into_iter()
+        .map(|code| {
+            let card_view = card_img(code.clone(), "hand-card");
+            let click_code = code.clone();
+            view! {
+                button(class="hand-slot", on:click=move |_| {
+                    if can_play {
+                        on_hand_card(click_code.clone());
+                    }
+                }) { (card_view) }
+            }
+        })
+        .collect::<Vec<_>>();
+    let hint = if can_play {
+        Some(view! {
+            p(class="text-secondary small text-center") {
+                "Click a card to play it."
+            }
+        })
+    } else if game.phase == "auction" {
+        Some(view! {
+            p(class="text-secondary small text-center") {
+                "Bid or pass, then play the cards."
+            }
+        })
+    } else if game.phase == "calling" && my_turn {
+        Some(view! {
+            p(class="text-secondary small text-center") {
+                "Name a card: its holder will be your secret partner."
+            }
+        })
+    } else {
+        None
+    };
+
+    // Spectators have no hand: render the pivot seat as a regular panel so
+    // its points stay visible where the hand would be.
+    let bottom = if game.spectator {
+        seat_panel(game.clone(), viewer_seat, "bottom")
+    } else {
+        view! {
+            div(class="seat-bottom") {
+                div(class="seat-stats own-stats") { (my_points) " points" }
+                div(class="hand") { (hand_cards) }
+                (hint)
+            }
+        }
+    };
+
+    let spectator_badge = game.spectator.then(|| view! {
+        span(class="spectator-badge") { "Spectating" }
+    });
+    let watch_link = watch_link(&game.id);
+    let trump_badge = (!game.briscola_suit.is_empty()).then(|| {
+        let suit = suit_name(&game.briscola_suit);
+        view! { span(class="briscola-badge") { "Briscola: " (suit) } }
+    });
+    let called_badge = game.called_card.clone().map(|code| {
+        let label = card_label(&code);
+        view! { span(class="called-badge") { "Chiamata: " (label) } }
+    });
+    let deal = game.hand_number;
+
+    view! {
+        div(class="table-wrap") {
+            div(class="hud") {
+                a(href="/") { "← Lobby" }
+                span { "Deal " (deal) }
+                (trump_badge)
+                (called_badge)
+                (spectator_badge)
+                span(class="hud-scores") { (score_line) }
+                span(class=turn_cls) { (turn_note) }
+                (countdown)
+                CopyButton(text=watch_link, label="Copy watch link".to_string())
+            }
+            div(class="table-grid cinque") {
+                (top_left)
+                (top_right)
+                (left)
+                div(class="center") {
+                    (patta)
+                    (reveal)
+                    (center_content)
+                }
+                (right)
+                (bottom)
+            }
+        }
+    }
+}
+
+/// Overlay for the auction winner: name the called card.
+pub fn call_picker(game: GameView, socket: Signal<Option<GameSocket>>) -> View {
+    let Some(cards) = game.callable_cards.clone().filter(|cards| !cards.is_empty()) else {
+        return view! {};
+    };
+    let own_hand = game
+        .players
+        .iter()
+        .find(|p| p.hand.is_some())
+        .and_then(|p| p.hand.clone())
+        .unwrap_or_default();
+    let options = cards
+        .into_iter()
+        .map(|code| {
+            let held = own_hand.contains(&code);
+            let label = card_label(&code);
+            let img = card_img(code.clone(), "hand-card");
+            let solo_note = held.then(|| view! {
+                span(class="solo-note") { "plays alone" }
+            });
+            let click_code = code.clone();
+            view! {
+                button(class="capture-option call-option", on:click=move |_| {
+                    if let Some(s) = socket.get_clone() {
+                        s.call_card(&click_code);
+                    }
+                }) {
+                    (img)
+                    span(class="call-label") { (label) }
+                    (solo_note)
+                }
+            }
+        })
+        .collect::<Vec<_>>();
+    view! {
+        div(class="overlay") {
+            div(class="picker") {
+                h3 { "Name the called card" }
+                p(class="text-secondary small") {
+                    "Its holder becomes your secret partner; name one of your "
+                    "own cards to play alone."
+                }
+                div(class="capture-options") { (options) }
+            }
+        }
+    }
+}

web/src/pages/game.rs

@@ -1,14 +1,22 @@
 //! Live game page: table view over the websocket.
 use std::cell::Cell;
-use std::cell::RefCell;
 use std::rc::Rc;
 
 use sycamore::prelude::*;
+use wasm_bindgen_futures::spawn_local;
 
+use crate::api;
+use crate::components::briscola::{deal_rows, deal_summary_modal};
 use crate::components::card::{card_back, card_img};
+use crate::components::copy::CopyButton;
 use crate::components::summary::{hand_summary_modal, summary_rows};
 use crate::components::toast::toast;
-use crate::model::{card_label, GameView, MoveView, PlayerView, Scores, ServerMessage};
+use crate::model::{
+    card_label, hand_sort_key, is_briscola, is_chiamata, is_individual_game, GameView, MoveView,
+    PlayerView, Scores, ServerMessage,
+};
+use crate::pages::briscola::briscola_table;
+use crate::pages::chiamata::{call_picker, chiamata_table};
 use crate::ws::{self, GameSocket};
 
 fn send_play(socket: Signal<Option<GameSocket>>, card: String, capture: Option<Vec<String>>) {
@@ -17,6 +25,14 @@ fn send_play(socket: Signal<Option<GameSocket>>, card: String, capture: Option<V
     }
 }
 
+/// The absolute, shareable URL of this game's page, for the clipboard.
+pub(crate) fn watch_link(id: &str) -> String {
+    let origin = web_sys::window()
+        .and_then(|w| w.location().origin().ok())
+        .unwrap_or_default();
+    format!("{origin}/game/{id}")
+}
+
 /// Panel for one player seat (name, team, hidden card count, stats).
 fn seat_panel(game: GameView, seat: usize, position: &'static str) -> View {
     let Some(player) = game.players.iter().find(|p| p.seat == seat).cloned() else {
@@ -28,7 +44,7 @@ fn seat_panel(game: GameView, seat: usize, position: &'static str) -> View {
         if active { " active" } else { "" }
     );
     let name = player.name.clone();
-    let team = player.team.clone();
+    let team = player.team.clone().unwrap_or_default();
     let captured = player.captured_count;
     let scope = player.scope;
     let backs = (0..player.cards_left)
@@ -135,23 +151,33 @@ fn start_connect(id: Rc<String>, ctx: ConnCtx, alive: Rc<Cell<bool>>) {
     let on_close = {
         let id = id.clone();
         let alive = alive.clone();
-        move |code: Option<u16>| {
+        move |_code: Option<u16>| {
             if !alive.get() {
                 return;
             }
             ctx.closed.set(true);
-            match code {
-                Some(4401) => {
-                    ctx.fatal.set(true);
-                    ctx.error
-                        .set(Some("Session expired — please log in again.".to_string()));
-                }
-                Some(4403) | Some(4404) => {
-                    ctx.fatal.set(true);
-                    ctx.error
-                        .set(Some("This game is no longer available.".to_string()));
-                }
-                _ => schedule_retry(id.clone(), ctx, alive.clone()),
+            if ctx.game.get_clone().is_none() && ctx.attempts.get() == 0 {
+                // The connection ended before any snapshot arrived. A
+                // refused handshake looks exactly like a network drop to
+                // the browser (close code 1006, no HTTP status), so ask
+                // the API whether the server deliberately rejected us —
+                // in which case retrying is pointless — or the loss was
+                // transient. Only on the first failure: later attempts
+                // are governed by the retry backoff.
+                let id = id.clone();
+                let alive = alive.clone();
+                spawn_local(async move {
+                    match api::probe_game(&id).await {
+                        api::GameEntry::Unavailable => {
+                            ctx.fatal.set(true);
+                            ctx.error
+                                .set(Some("This game is no longer available.".to_string()));
+                        }
+                        api::GameEntry::Transient => schedule_retry(id, ctx, alive),
+                    }
+                });
+            } else {
+                schedule_retry(id.clone(), ctx, alive.clone());
             }
         }
     };
@@ -299,6 +325,32 @@ pub fn GamePage(id: String) -> View {
         }
     };
 
+    // Briscola chiamata: auction and call actions.
+    let on_bid_rank = move |rank: i32| {
+        if closed.get() || game.get_clone().and_then(|g| g.your_turn) != Some(true) {
+            return;
+        }
+        if let Some(s) = socket.get_clone() {
+            s.bid_rank(rank);
+        }
+    };
+    let on_bid_points = move |points: i32| {
+        if closed.get() || game.get_clone().and_then(|g| g.your_turn) != Some(true) {
+            return;
+        }
+        if let Some(s) = socket.get_clone() {
+            s.bid_points(points);
+        }
+    };
+    let on_pass = move || {
+        if closed.get() || game.get_clone().and_then(|g| g.your_turn) != Some(true) {
+            return;
+        }
+        if let Some(s) = socket.get_clone() {
+            s.pass();
+        }
+    };
+
     let reconnect_banner = reconnect.clone();
     view! {
         div(class="game-page") {
@@ -367,6 +419,15 @@ pub fn GamePage(id: String) -> View {
                     }
                 }
                 Some(g) if g.phase == "lobby" => view! { LobbyView(game=g) },
+                // Briscola chiamata has its own five-seat table with the
+                // calling auction and the secret-partner reveal.
+                Some(g) if is_chiamata(&g.game_type) => {
+                    chiamata_table(g, on_hand_card, on_bid_rank, on_bid_points, on_pass, now)
+                }
+                // Briscola has its own table view for both variants.
+                Some(g) if is_briscola(&g.game_type) => {
+                    briscola_table(g, on_hand_card, now)
+                }
                 // The live table is scopone-specific; other games get a
                 // fallback until they ship their own play view.
                 Some(g) if g.game_type == "scopone_scientifico" => {
@@ -377,10 +438,24 @@ pub fn GamePage(id: String) -> View {
             (move || capture_choice.get_clone().map(|(card, options)| {
                 capture_picker(card, options, socket, capture_choice)
             }))
+            // Briscola chiamata: the auction winner names the called card.
+            (move || match game.get_clone() {
+                Some(g)
+                    if is_chiamata(&g.game_type)
+                        && g.phase == "calling"
+                        && g.your_turn == Some(true) =>
+                {
+                    call_picker(g, socket)
+                }
+                _ => view! {},
+            })
             (move || match game.get_clone() {
                 Some(g) if g.phase == "hand_end" && g.game_type == "scopone_scientifico" => {
                     hand_summary_modal(g, socket, now)
                 }
+                Some(g) if g.phase == "hand_end" && is_briscola(&g.game_type) => {
+                    deal_summary_modal(g, socket, now)
+                }
                 _ => view! {},
             })
             (move || game_over_view(over.get_clone(), game.get_clone()))
@@ -390,52 +465,35 @@ pub fn GamePage(id: String) -> View {
 
 /// Lobby view while waiting for the remaining players. The seat count
 /// comes from the payload (`seats_open`), so games with other player
-/// counts render correctly.
+/// counts render correctly. Spectators (no seat, no join code) get a
+/// "not started yet" note and the watch link instead.
 #[component(inline_props)]
 fn LobbyView(game: GameView) -> View {
     let seats_open = game
         .seats_open
         .unwrap_or_else(|| 4usize.saturating_sub(game.players.len()));
+    let spectator = game.spectator;
     let join_code = game.join_code.clone();
-    let copied = create_signal(false);
-    // Held so the reset timer is cancelled if the waiting room is rebuilt
-    // (e.g. another player joins) while the "Copied!" feedback is showing:
-    // firing it afterwards would set a disposed signal and panic.
-    let reset_timer: Rc<RefCell<Option<gloo_timers::callback::Timeout>>> =
-        Rc::new(RefCell::new(None));
-    on_cleanup({
-        let reset_timer = reset_timer.clone();
-        move || {
-            reset_timer.borrow_mut().take();
-        }
-    });
-
-    let copy = {
-        let join_code = join_code.clone();
-        move |_| {
-            if let Some(win) = web_sys::window() {
-                let _ = win.navigator().clipboard().write_text(&join_code);
-            }
-            copied.set(true);
-            *reset_timer.borrow_mut() = Some(gloo_timers::callback::Timeout::new(1500, move || {
-                copied.set(false);
-            }));
-        }
-    };
+    let watch_link = watch_link(&game.id);
 
+    let show_teams = !is_individual_game(&game.game_type);
     let players = game
         .players
         .iter()
         .map(|p| {
             let name = p.name.clone();
             let seat = p.seat;
-            let team = p.team.clone();
+            let team_badge = show_teams
+                .then(|| p.team.clone())
+                .flatten()
+                .filter(|team| !team.is_empty())
+                .map(|team| view! { span(class="badge text-bg-info") { "Team " (team) } });
             view! {
                 li(class="list-group-item d-flex justify-content-between align-items-center") {
                     strong { (name) }
                     span {
                         span(class="badge text-bg-secondary me-2") { "Seat " (seat) }
-                        span(class="badge text-bg-info") { "Team " (team) }
+                        (team_badge)
                     }
                 }
             }
@@ -455,18 +513,39 @@ fn LobbyView(game: GameView) -> View {
     };
     let percent_style = format!("width: {percent}%");
 
+    // The server withholds the join code from spectators; they get a
+    // "not started yet" note and can share the watch link instead.
+    let share = if spectator {
+        view! {
+            p(class="text-secondary") {
+                "This game hasn't started yet — waiting for the players to take their seats."
+            }
+            div(class="d-grid mb-4") {
+                CopyButton(text=watch_link, label="Copy watch link".to_string())
+            }
+        }
+    } else {
+        // Separate clones: each interpolation/prop captures its own copy.
+        let display_code = join_code.clone();
+        let copy_code = join_code.clone();
+        view! {
+            p(class="text-secondary") { "Share this join code with your friends:" }
+            p(class="code-display") { (display_code) }
+            div(class="d-grid gap-2 mb-4") {
+                CopyButton(text=copy_code, label="Copy code".to_string())
+                CopyButton(text=watch_link, label="Copy watch link".to_string())
+            }
+        }
+    };
+
     view! {
         div(class="container page-shell py-4") {
             div(class="card status-card") {
                 div(class="card-body p-4") {
-                    h1(class="h4 mb-3") { "Waiting for players" }
-                    p(class="text-secondary") { "Share this join code with your friends:" }
-                    p(class="code-display") { (join_code) }
-                    div(class="d-grid mb-4") {
-                        button(class="btn btn-outline-light", on:click=copy) {
-                            (move || if copied.get() { "Copied!" } else { "Copy code" })
-                        }
+                    h1(class="h4 mb-3") {
+                        (if spectator { "Game not started yet" } else { "Waiting for players" })
                     }
+                    (share)
                     ul(class="list-group list-group-flush text-start mb-3") {
                         (players)
                         (open_seats)
@@ -519,7 +598,8 @@ fn table_view(
     selected: Signal<Option<String>>,
     now: Signal<f64>,
 ) -> View {
-    // Own seat: the only player entry carrying a hand.
+    // Own seat: the only player entry carrying a hand. Spectators have no
+    // hand, so they watch from seat 0's perspective.
     let viewer_seat = game
         .players
         .iter()
@@ -576,7 +656,8 @@ fn table_view(
     let viewer = player_for_seat(&game, viewer_seat);
     let my_captured = viewer.as_ref().map(|p| p.captured_count).unwrap_or(0);
     let my_scope = viewer.as_ref().map(|p| p.scope).unwrap_or(0);
-    let hand = viewer.and_then(|p| p.hand).unwrap_or_default();
+    let mut hand = viewer.and_then(|p| p.hand).unwrap_or_default();
+    hand.sort_by_key(|c| hand_sort_key(c));
     let current_selection = selected.get_clone();
     let hand_cards = hand
         .into_iter()
@@ -604,18 +685,41 @@ fn table_view(
         }
     });
 
+    // Spectators have no hand: render the pivot seat as a regular panel
+    // so its captured count and scope stay visible where the hand would be.
+    let bottom = if game.spectator {
+        seat_panel(game.clone(), viewer_seat, "bottom")
+    } else {
+        view! {
+            div(class="seat-bottom") {
+                div(class="seat-stats own-stats") {
+                    (my_captured) " captured · " (my_scope) " scope"
+                }
+                div(class="hand") { (hand_cards) }
+                (hint)
+            }
+        }
+    };
+
+    let spectator_badge = game.spectator.then(|| view! {
+        span(class="spectator-badge") { "Spectating" }
+    });
+    let watch_link = watch_link(&game.id);
+
     view! {
         div(class="table-wrap") {
             div(class="hud") {
                 a(href="/") { "← Lobby" }
                 span { "Hand " (hand_number) }
                 (rule_badge)
+                (spectator_badge)
                 span(class="hud-scores") {
                     "Team A " (scores.a) " — " (scores.b) " Team B (target "
                     (target_score) ")"
                 }
                 span(class=turn_cls) { (turn_note) }
                 (countdown)
+                CopyButton(text=watch_link, label="Copy watch link".to_string())
             }
             div(class="table-grid") {
                 (top)
@@ -628,13 +732,7 @@ fn table_view(
                     }
                 }
                 (right)
-                div(class="seat-bottom") {
-                    div(class="seat-stats own-stats") {
-                        (my_captured) " captured · " (my_scope) " scope"
-                    }
-                    div(class="hand") { (hand_cards) }
-                    (hint)
-                }
+                (bottom)
             }
         }
     }
@@ -677,11 +775,12 @@ fn capture_picker(
     }
 }
 
-/// End-of-match overlay (scopone's team score; other games render
-/// nothing until they ship their own play view).
+/// End-of-match overlay: the final hand/deal breakdown and the winner.
 fn game_over_view(over: Option<(Scores, Option<String>)>, game: Option<GameView>) -> View {
+    let briscola = game.as_ref().is_some_and(|g| is_briscola(&g.game_type));
+    let chiamata = game.as_ref().is_some_and(|g| is_chiamata(&g.game_type));
     if let Some(g) = &game {
-        if g.game_type != "scopone_scientifico" {
+        if g.game_type != "scopone_scientifico" && !briscola && !chiamata {
             return view! {};
         }
     }
@@ -694,14 +793,37 @@ fn game_over_view(over: Option<(Scores, Option<String>)>, game: Option<GameView>
         None => view! {},
         Some((scores, winner)) => {
             let winner = winner.unwrap_or_else(|| "?".to_string());
-            let line = format!("Team {winner} wins {} – {}", scores.a, scores.b);
-            // Explain the final hand's scoring before the result.
-            let final_summary = game
-                .and_then(|g| g.last_hand)
-                .map(|s| {
-                    let rows = summary_rows(s);
-                    view! { (rows) }
-                });
+            // Two-player briscola has no teams: name the winner instead.
+            // Briscola chiamata names the caller's side (or the defenders).
+            let winner_label = match game.as_ref() {
+                Some(g) if is_individual_game(&g.game_type) => {
+                    g.player_name_for_team(&winner)
+                }
+                Some(g) if is_chiamata(&g.game_type) => winner.clone(),
+                _ => format!("Team {winner}"),
+            };
+            let line = format!("{winner_label} wins {} – {}", scores.a, scores.b);
+            // Spectators have no match history to look at.
+            let spectator = game.as_ref().is_some_and(|g| g.spectator);
+            // Explain the final hand's (scopone) or deal's (briscola,
+            // briscola chiamata) scoring before the result.
+            let final_summary: View = if briscola || chiamata {
+                match game.as_ref() {
+                    Some(g) => match g.last_deal.clone() {
+                        Some(deal) => deal_rows(g, &deal),
+                        None => view! {},
+                    },
+                    None => view! {},
+                }
+            } else {
+                match game.as_ref().and_then(|g| g.last_hand.clone()) {
+                    Some(hand) => summary_rows(hand),
+                    None => view! {},
+                }
+            };
+            let my_matches = (!spectator).then(|| view! {
+                a(class="btn btn-outline-light", href="/history") { "My matches" }
+            });
             view! {
                 div(class="overlay") {
                     div(class="picker summary-panel") {
@@ -710,7 +832,7 @@ fn game_over_view(over: Option<(Scores, Option<String>)>, game: Option<GameView>
                         p(class="final-score") { (line) }
                         div(class="gameover-actions") {
                             a(class="btn btn-warning", href="/") { "Back to lobby" }
-                            a(class="btn btn-outline-light", href="/history") { "My matches" }
+                            (my_matches)
                         }
                     }
                 }

web/src/pages/history.rs

@@ -39,7 +39,10 @@ fn team_names(m: &MatchSummary, team: &Option<String>) -> String {
 
 fn team_header(team: &Option<String>) -> String {
     match team {
-        Some(t) => format!("Team {t}"),
+        // Single-letter labels are the A/B team names; longer labels
+        // (e.g. briscola chiamata's "Chiamante"/"Socio") read on their own.
+        Some(t) if t.len() <= 2 => format!("Team {t}"),
+        Some(t) => t.clone(),
         None => "Players".to_string(),
     }
 }
@@ -55,7 +58,11 @@ fn score_text(m: &MatchSummary) -> String {
 /// "Team A" from `winner_team`, a plain `winner`, or "—".
 fn winner_text(m: &MatchSummary) -> String {
     if let Some(team) = m.result_str("winner_team") {
-        return format!("Team {team}");
+        return if team.len() <= 2 {
+            format!("Team {team}")
+        } else {
+            team
+        };
     }
     m.result_str("winner").unwrap_or_else(|| "—".to_string())
 }

web/src/pages/leaderboard.rs

@@ -1,20 +1,53 @@
-//! Global leaderboard page.
+//! Per-game leaderboard page.
+//!
+//! Elo ratings are stored per game type, so the board is scoped to the
+//! game chosen in the dropdown: Elo, wins, matches and points all come
+//! from that game's matches only.
 use wasm_bindgen_futures::spawn_local;
 use sycamore::prelude::*;
 
 use crate::api;
 use crate::components::toast::toast;
-use crate::model::{fmt_points, LeaderboardPage};
+use crate::model::{fallback_game_types, fmt_points, LeaderboardPage};
 
 #[component]
 pub fn LeaderboardPage() -> View {
     let page = create_signal(Option::<LeaderboardPage>::None);
     let error = create_signal(Option::<String>::None);
+    let game_types = create_signal(fallback_game_types());
+    let selected_game = create_signal("scopone_scientifico".to_string());
+
+    // Reload whenever the selection changes; a response for a game the
+    // user has already switched away from is dropped.
+    create_effect(move || {
+        let game_type = selected_game.get_clone();
+        page.set(None);
+        spawn_local(async move {
+            match api::leaderboard(&game_type).await {
+                Ok(p) => {
+                    if selected_game.get_clone() == game_type {
+                        page.set(Some(p));
+                    }
+                }
+                Err(e) => {
+                    if selected_game.get_clone() == game_type {
+                        error.set(Some(e));
+                    }
+                }
+            }
+        });
+    });
 
     spawn_local(async move {
-        match api::leaderboard().await {
-            Ok(p) => page.set(Some(p)),
-            Err(e) => error.set(Some(e)),
+        match api::game_types().await {
+            Ok(types) if !types.is_empty() => {
+                let current = selected_game.get_clone();
+                if !types.iter().any(|g| g.id == current) {
+                    selected_game.set(types[0].id.clone());
+                }
+                game_types.set(types);
+            }
+            _ => {} // keep the fallback list
         }
     });
 
@@ -22,7 +55,30 @@ pub fn LeaderboardPage() -> View {
         div {
             (crate::components::nav::app_nav("/leaderboard", || view! {}))
             div(class="container page-shell py-4") {
-                h1(class="h3 mb-4") { "Leaderboard" }
+                div(
+                    class="d-flex flex-wrap gap-3 align-items-center \
+                           justify-content-between mb-4"
+                ) {
+                    h1(class="h3 mb-0") { "Leaderboard" }
+                    div(class="d-flex align-items-center gap-2") {
+                        label(class="form-label mb-0", r#for="leaderboard-game") {
+                            "Game"
+                        }
+                        select(
+                            class="form-select w-auto",
+                            id="leaderboard-game",
+                            bind:value=selected_game,
+                        ) {
+                            Keyed(
+                                list=game_types,
+                                view=|g| view! {
+                                    option(value=g.id.clone()) { (g.name) }
+                                },
+                                key=|g| g.id.clone(),
+                            )
+                        }
+                    }
+                }
                 (toast(error))
                 (move || match page.get_clone() {
                     None => view! {

web/src/pages/lobby.rs

@@ -14,18 +14,18 @@ use sycamore_router::navigate;
 use crate::api;
 use crate::components::card::card_back;
 use crate::components::toast::toast;
-use crate::model::{GameTypeInfo, JoinPreview, OptionField, OptionKind, PlayerRating, User};
+use crate::model::{
+    fallback_game_types, is_individual_game, AuthProvider, GameTypeInfo, JoinPreview,
+    MyGame, OptionField, OptionKind, PlayerRating, User,
+};
 
-/// Used when the game-types fetch fails: match creation must still work.
-fn fallback_game_types() -> Vec<GameTypeInfo> {
-    vec![GameTypeInfo {
-        id: "scopone_scientifico".to_string(),
-        name: "Scopone scientifico".to_string(),
-        description: String::new(),
-        min_players: 4,
-        max_players: 4,
-        options_schema: serde_json::Value::Null,
-    }]
+/// Human-readable label for a provider name ("google" -> "Google").
+fn provider_label(name: &str) -> String {
+    let mut chars = name.chars();
+    match chars.next() {
+        Some(first) => first.to_uppercase().collect::<String>() + chars.as_str(),
+        None => String::new(),
+    }
 }
 
 fn json_to_string(value: &serde_json::Value) -> String {
@@ -237,15 +237,20 @@ fn join_preview_panel(
         })
         .collect::<Vec<_>>();
     let seated = p.players.len();
+    let show_teams = !is_individual_game(&p.game_type);
     let players = p
         .players
         .iter()
         .map(|player| {
             let name = player.name.clone();
-            let team = player.team.as_ref().map(|t| {
-                let label = t.clone();
-                view! { span(class="badge text-bg-info ms-2") { "Team " (label) } }
-            });
+            let team = if show_teams {
+                player.team.as_ref().map(|t| {
+                    let label = t.clone();
+                    view! { span(class="badge text-bg-info ms-2") { "Team " (label) } }
+                })
+            } else {
+                None
+            };
             view! {
                 li(
                     class="list-group-item d-flex justify-content-between \
@@ -283,8 +288,12 @@ fn join_preview_panel(
 pub fn LobbyPage() -> View {
     // Outer None = still loading; Some(None) = logged out.
     let user = create_signal(Option::<Option<User>>::None);
+    // Configured login providers, for the logged-out card's buttons.
+    let auth_providers = create_signal(Vec::<AuthProvider>::new());
     // The player's Elo ratings, one row per game type played.
     let ratings = create_signal(Vec::<PlayerRating>::new());
+    // Live games the player is seated in, for the "Continue" list.
+    let my_games = create_signal(Vec::<MyGame>::new());
     let error = create_signal(Option::<String>::None);
     let code = create_signal(String::new());
     let game_types = create_signal(fallback_game_types());
@@ -379,6 +388,9 @@ pub fn LobbyPage() -> View {
                         if let Ok(p) = api::my_ratings().await {
                             ratings.set(p.results);
                         }
+                        if let Ok(games) = api::my_games().await {
+                            my_games.set(games);
+                        }
                     });
                 }
                 user.set(Some(me));
@@ -400,6 +412,12 @@ pub fn LobbyPage() -> View {
         }
     });
 
+    spawn_local(async move {
+        if let Ok(list) = api::auth_providers().await {
+            auth_providers.set(list);
+        }
+    });
+
     let on_create = move |_| {
         let game_type = selected_game.get_clone();
         let opts: serde_json::Map<String, serde_json::Value> =
@@ -462,15 +480,39 @@ pub fn LobbyPage() -> View {
                                 }
                                 p(class="text-secondary") { "Log in with your account to play." }
                                 // rel="external" opts out of the SPA router's click
-                                // interception: this must be a full page navigation
-                                // to the backend's OIDC login endpoint.
-                                a(
-                                    class="btn btn-warning btn-lg w-100",
-                                    href="/auth/login",
-                                    rel="external",
-                                ) {
-                                    "Log in"
-                                }
+                                // interception: these must be full page navigations
+                                // to the backend's OIDC login endpoints.
+                                (move || {
+                                    let providers = auth_providers.get_clone();
+                                    if providers.is_empty() {
+                                        // Providers could not be fetched: the
+                                        // generic route redirects to the first
+                                        // configured provider.
+                                        view! {
+                                            a(
+                                                class="btn btn-warning btn-lg w-100",
+                                                href="/auth/login",
+                                                rel="external",
+                                            ) {
+                                                "Log in"
+                                            }
+                                        }
+                                    } else {
+                                        view! {
+                                            div(class="d-grid gap-2") {
+                                                (providers.iter().cloned().map(|p| view! {
+                                                    a(
+                                                        class="btn btn-warning btn-lg w-100",
+                                                        href=p.login_url,
+                                                        rel="external",
+                                                    ) {
+                                                        "Log in with " (provider_label(&p.name))
+                                                    }
+                                                }).collect::<Vec<_>>())
+                                            }
+                                        }
+                                    }
+                                })
                             }
                         }
                     }
@@ -509,9 +551,72 @@ pub fn LobbyPage() -> View {
                             div(class="lobby-hero text-center") {
                                 h1(class="display-5 fw-bold") { "tavolo" }
                                 p(class="lead text-secondary mb-0") {
-                                    "Play scopone scientifico with friends."
+                                    "Play scopone scientifico and briscola with friends."
                                 }
                             }
+                            // Ongoing games: a "Continue" link back into a
+                            // match whose page was accidentally closed.
+                            (move || {
+                                let games = my_games.get_clone();
+                                if games.is_empty() {
+                                    return view! {};
+                                }
+                                let types = game_types.get_clone();
+                                let rows = games
+                                    .into_iter()
+                                    .map(|g| {
+                                        let name = if g.game_name.is_empty() {
+                                            types
+                                                .iter()
+                                                .find(|t| t.id == g.game_type)
+                                                .map(|t| t.name.clone())
+                                                .unwrap_or_else(|| g.game_type.clone())
+                                        } else {
+                                            g.game_name.clone()
+                                        };
+                                        let phase = g.phase_label();
+                                        let seats = g.seats_text();
+                                        let players = g.players_text();
+                                        let players_note = if players.is_empty() {
+                                            String::new()
+                                        } else {
+                                            format!(" · {players}")
+                                        };
+                                        let href = format!("/game/{}", g.id);
+                                        view! {
+                                            li(
+                                                class="list-group-item d-flex flex-wrap \
+                                                       justify-content-between \
+                                                       align-items-center gap-2"
+                                            ) {
+                                                div {
+                                                    div(class="fw-semibold") { (name) }
+                                                    div(class="text-secondary small") {
+                                                        (phase) " · " (seats)
+                                                        (players_note)
+                                                    }
+                                                }
+                                                a(
+                                                    class="btn btn-sm btn-warning",
+                                                    href=href,
+                                                ) {
+                                                    "Continue"
+                                                }
+                                            }
+                                        }
+                                    })
+                                    .collect::<Vec<_>>();
+                                view! {
+                                    div(class="card mb-4") {
+                                        div(class="card-header") { "Your games" }
+                                        div(class="card-body p-0") {
+                                            ul(class="list-group list-group-flush") {
+                                                (rows)
+                                            }
+                                        }
+                                    }
+                                }
+                            })
                             div(class="row g-4") {
                                 div(class="col-lg-7") {
                                     div(class="card h-100") {
@@ -566,13 +671,21 @@ pub fn LobbyPage() -> View {
                                                         div(class="mb-3") { (players_note) }
                                                     }
                                                 }))
-                                            Keyed(
-                                                list=fields,
-                                                view=move |f| view! {
-                                                    OptionInput(field=f.clone(), options=options)
-                                                },
-                                                key=|f| f.key.clone(),
-                                            )
+                                            // Recreate the option inputs on every
+                                            // game switch: keyed rendering kept
+                                            // the previous game's field (value,
+                                            // min/max) for shared keys such as
+                                            // target_score.
+                                            (move || {
+                                                let _game = selected_game.get_clone();
+                                                fields
+                                                    .get_clone()
+                                                    .into_iter()
+                                                    .map(|f| view! {
+                                                        OptionInput(field=f, options=options)
+                                                    })
+                                                    .collect::<Vec<_>>()
+                                            })
                                             button(
                                                 class="btn btn-warning btn-lg w-100 mt-auto",
                                                 on:click=on_create,

web/src/pages/mod.rs

@@ -1,3 +1,5 @@
+pub mod briscola;
+pub mod chiamata;
 pub mod game;
 pub mod history;
 pub mod leaderboard;

web/src/ws.rs

@@ -45,6 +45,26 @@ impl GameSocket {
         self.send_json(serde_json::json!({ "action": "ack" }));
     }
 
+    /// Briscola chiamata: bid a rank in the calling auction.
+    pub fn bid_rank(&self, rank: i32) {
+        self.send_json(serde_json::json!({ "action": "bid", "rank": rank }));
+    }
+
+    /// Briscola chiamata: raise the points target (standing bid is the 2).
+    pub fn bid_points(&self, points: i32) {
+        self.send_json(serde_json::json!({ "action": "bid", "points": points }));
+    }
+
+    /// Briscola chiamata: leave the auction.
+    pub fn pass(&self) {
+        self.send_json(serde_json::json!({ "action": "pass" }));
+    }
+
+    /// Briscola chiamata: name the called card.
+    pub fn call_card(&self, card: &str) {
+        self.send_json(serde_json::json!({ "action": "call", "card": card }));
+    }
+
     fn send_json(&self, value: serde_json::Value) {
         let _ = self.sender.borrow_mut().unbounded_send(value.to_string());
     }
@@ -55,8 +75,11 @@ impl GameSocket {
 /// could not be created.
 ///
 /// `on_close` fires exactly once when the connection ends; it receives the
-/// server close code when one was sent (e.g. 4401 unauthenticated, 4403 not
-/// seated, 4404 unknown game) or `None` for an abnormal network loss.
+/// server close code when one was sent (e.g. 1000 for a normal closure) or
+/// `None` for an abnormal loss. A *refused* handshake is not distinguishable
+/// here: browsers report it as an abnormal closure (1006) and never expose
+/// the HTTP status the server answered with, so callers must classify the
+/// failure out of band.
 pub fn connect(
     game_id: &str,
     on_message: impl Fn(ServerMessage) + 'static,
@@ -80,8 +103,14 @@ pub fn connect(
         while let Some(msg) = read.next().await {
             match msg {
                 Ok(Message::Text(text)) => {
-                    if let Ok(parsed) = serde_json::from_str::<ServerMessage>(&text) {
-                        on_message(parsed);
+                    match serde_json::from_str::<ServerMessage>(&text) {
+                        Ok(parsed) => on_message(parsed),
+                        // A silently dropped message would leave the page
+                        // waiting forever; surface the parse error so it is
+                        // visible in the browser console.
+                        Err(err) => web_sys::console::error_1(
+                            &format!("unparseable server message: {err}").into(),
+                        ),
                     }
                 }
                 Ok(Message::Bytes(_)) => {}

web/style.css

@@ -1,4 +1,4 @@
-/* Scopone scientifico frontend — game table, cards and scoring summary.
+/* tavolo frontend — game tables, cards and scoring summaries.
  *
  * The felt palette and the Bootstrap theme overrides live in theme.css,
  * which is loaded before this file. */
@@ -37,7 +37,8 @@ body {
 
 .hud {
     display: flex;
-    gap: 1.5rem;
+    flex-wrap: wrap;
+    gap: 0.4rem 1.5rem;
     align-items: center;
     justify-content: center;
     padding: 0.6rem 1rem;
@@ -76,7 +77,10 @@ body {
 .table-grid {
     flex: 1;
     display: grid;
-    grid-template-columns: 1fr 2.4fr 1fr;
+    /* minmax(0, …) lets the tracks shrink below their content's
+     * min-content width; without it the center's move banner and the
+     * seat panels push the grid wider than the screen on phones. */
+    grid-template-columns: minmax(0, 1fr) minmax(0, 2.4fr) minmax(0, 1fr);
     grid-template-rows: auto 1fr auto;
     grid-template-areas:
         ". top ."
@@ -114,6 +118,7 @@ body {
     flex-direction: column;
     justify-content: flex-start;
     min-height: 116px;
+    min-width: 0;
     align-self: center;
     width: 100%;
 }
@@ -126,7 +131,8 @@ body {
 .seat-name {
     font-weight: 600;
     display: flex;
-    gap: 0.5rem;
+    flex-wrap: wrap;
+    gap: 0.15rem 0.5rem;
     align-items: center;
     justify-content: center;
 }
@@ -167,6 +173,7 @@ body {
     justify-content: center;
     gap: 0.75rem;
     min-height: 230px;
+    min-width: 0;
 }
 
 .table-cards {
@@ -240,8 +247,11 @@ body {
 
 .move-banner {
     display: flex;
+    flex-wrap: wrap;
     align-items: center;
+    justify-content: center;
     gap: 0.4rem;
+    max-width: 100%;
     background: rgba(0, 0, 0, 0.35);
     border-radius: 999px;
     padding: 0.35rem 1rem;
@@ -266,6 +276,15 @@ body {
     margin-left: 0.25rem;
 }
 
+.spectator-badge {
+    background: var(--panel-light);
+    color: var(--muted);
+    font-weight: 700;
+    border-radius: 999px;
+    padding: 0.15rem 0.6rem;
+    border: 1px solid var(--muted);
+}
+
 /* ---------- overlays ---------- */
 
 .overlay {
@@ -283,7 +302,8 @@ body {
     border-radius: 14px;
     padding: 1.5rem 2rem;
     text-align: center;
-    min-width: 320px;
+    min-width: min(320px, calc(100vw - 1.5rem));
+    max-width: calc(100vw - 1.5rem);
 }
 
 .capture-options {
@@ -318,8 +338,8 @@ body {
 /* ---------- hand-end scoring summary ---------- */
 
 .summary-panel {
-    min-width: 420px;
-    max-width: 560px;
+    min-width: min(420px, calc(100vw - 1.5rem));
+    max-width: min(560px, calc(100vw - 1.5rem));
     text-align: left;
 }
 
@@ -465,3 +485,344 @@ body {
     font-size: 1.25rem;
     font-weight: 700;
 }
+
+/* ---------- briscola ---------- */
+
+.briscola-badge {
+    background: var(--panel-light);
+    color: var(--accent);
+    font-weight: 700;
+    border-radius: 999px;
+    padding: 0.15rem 0.6rem;
+    border: 1px solid var(--accent);
+}
+
+/* The face-down stock with the face-up trump card beside it. */
+.stock {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+}
+
+.stock-pile {
+    display: flex;
+}
+
+.playing-card.stock-card {
+    height: 48px;
+    margin-left: -18px;
+}
+
+.playing-card.stock-card:first-child {
+    margin-left: 0;
+}
+
+.playing-card.briscola-card {
+    height: 64px;
+    outline: 2px solid var(--accent);
+    outline-offset: 2px;
+}
+
+.stock-count {
+    color: var(--muted);
+    font-size: 0.8rem;
+    font-variant-numeric: tabular-nums;
+}
+
+/* Current-trick cards with the player's name above each. */
+.trick-slot {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.15rem;
+}
+
+.trick-name {
+    font-size: 0.7rem;
+    color: var(--muted);
+}
+
+/* Two-player table: opponent on top, player at the bottom. */
+.table-grid.duo {
+    grid-template-columns: 1fr;
+    grid-template-rows: auto 1fr auto;
+    grid-template-areas:
+        "top"
+        "center"
+        "bottom";
+}
+
+/* ---------- phones ---------- */
+
+@media (max-width: 576px) {
+    .hud {
+        gap: 0.3rem 0.75rem;
+        padding: 0.45rem 0.5rem;
+        font-size: 0.85rem;
+    }
+
+    .table-grid {
+        gap: 0.35rem;
+        padding: 0.4rem;
+    }
+
+    .seat {
+        min-height: 92px;
+        padding: 0.35rem 0.4rem;
+    }
+
+    .seat-name {
+        font-size: 0.85rem;
+    }
+
+    .team-badge {
+        font-size: 0.6rem;
+    }
+
+    .seat-stats {
+        font-size: 0.7rem;
+    }
+
+    /* Flex-wrap lets the hidden-hand backs drop to the next row instead
+     * of forcing the seat wider than its track. */
+    .seat-cards {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 2px;
+        justify-content: center;
+        margin: 0.2rem 0;
+    }
+
+    .center {
+        min-height: 180px;
+        gap: 0.45rem;
+    }
+
+    .move-banner {
+        font-size: 0.8rem;
+        padding: 0.25rem 0.6rem;
+    }
+
+    .playing-card.mini {
+        height: 26px;
+    }
+
+    .playing-card.table-card {
+        height: 62px;
+    }
+
+    .playing-card.move-card {
+        height: 42px;
+    }
+
+    .playing-card.hand-card {
+        height: 92px;
+    }
+
+    .hand {
+        min-height: 100px;
+        gap: 0.35rem;
+    }
+
+    .stock {
+        gap: 0.4rem;
+    }
+
+    .playing-card.stock-card {
+        height: 38px;
+        margin-left: -12px;
+    }
+
+    .playing-card.briscola-card {
+        height: 50px;
+    }
+
+    .picker {
+        padding: 1rem 1.1rem;
+    }
+
+    .summary-panel h2 {
+        font-size: 1.25rem;
+    }
+
+    .score-row {
+        gap: 0.5rem;
+        padding: 0.35rem 0.5rem;
+    }
+
+    .score-text {
+        font-size: 0.85rem;
+    }
+
+    .score-icon {
+        width: 26px;
+    }
+
+    .playing-card.score-mini {
+        height: 30px;
+    }
+
+    .total-row {
+        grid-template-columns: 3.5rem 1fr 3.2rem;
+        gap: 0.4rem;
+    }
+}
+
+/* ---------- briscola chiamata ---------- */
+
+/* Five seats: two across the top and one on each side of the viewer. */
+.table-grid.cinque {
+    grid-template-columns: minmax(0, 1fr) minmax(0, 2fr) minmax(0, 1fr);
+    grid-template-rows: auto 1fr auto;
+    grid-template-areas:
+        "tl . tr"
+        "left center right"
+        "bottom bottom bottom";
+}
+
+.seat-tl {
+    grid-area: tl;
+}
+
+.seat-tr {
+    grid-area: tr;
+}
+
+.called-badge {
+    background: var(--panel-light);
+    color: var(--accent);
+    font-weight: 700;
+    border-radius: 999px;
+    padding: 0.15rem 0.6rem;
+    border: 1px solid var(--accent);
+}
+
+.role-badge {
+    background: var(--accent);
+    color: var(--felt-dark);
+}
+
+.reveal-banner {
+    background: rgba(232, 197, 71, 0.15);
+    border: 1px solid var(--accent);
+    border-radius: 8px;
+    padding: 0.35rem 0.75rem;
+}
+
+.patta-banner {
+    background: rgba(217, 83, 79, 0.25);
+}
+
+/* The calling auction: standing bid, trail and the bid buttons. */
+.auction-panel {
+    background: rgba(0, 0, 0, 0.25);
+    border-radius: 10px;
+    padding: 0.75rem 1rem;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 0.5rem;
+    max-width: 32rem;
+}
+
+.auction-standing {
+    font-weight: 600;
+    text-align: center;
+}
+
+.auction-history {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.3rem;
+    justify-content: center;
+}
+
+.auction-chip {
+    background: var(--panel-light);
+    color: var(--muted);
+    border-radius: 4px;
+    padding: 0.1rem 0.4rem;
+    font-size: 0.75rem;
+}
+
+.bid-options {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.35rem;
+    justify-content: center;
+}
+
+.bid-button {
+    background: var(--panel-light);
+    color: var(--text);
+    border: 1px solid var(--accent);
+    border-radius: 6px;
+    padding: 0.25rem 0.6rem;
+    cursor: pointer;
+}
+
+.bid-button:hover {
+    background: var(--accent);
+    color: var(--felt-dark);
+}
+
+.bid-button.points {
+    border-color: var(--team-a);
+}
+
+.pass-button {
+    background: transparent;
+    color: var(--muted);
+    border: 1px solid var(--muted);
+    border-radius: 6px;
+    padding: 0.25rem 0.6rem;
+    cursor: pointer;
+}
+
+.pass-button:hover {
+    color: var(--text);
+    border-color: var(--text);
+}
+
+/* The auction winner's call picker: one card per suit. */
+.call-option {
+    flex-direction: column;
+    align-items: center;
+}
+
+.call-option .playing-card {
+    margin: 0 auto;
+}
+
+.call-label {
+    display: block;
+    font-size: 0.85rem;
+    color: var(--text);
+    margin-top: 0.25rem;
+}
+
+.solo-note {
+    display: block;
+    font-size: 0.7rem;
+    color: var(--accent);
+}
+
+.chiamata-row .score-title {
+    color: var(--accent);
+}
+
+@media (max-width: 576px) {
+    .table-grid.cinque {
+        grid-template-columns: 1fr 1fr;
+        grid-template-areas:
+            "tl tr"
+            "left right"
+            "center center"
+            "bottom bottom";
+    }
+
+    .auction-panel {
+        padding: 0.5rem;
+        max-width: 100%;
+    }
+}