V1.14.0: spell slots, rests, and a level-up checklist

- Spell slots. Every class that casts has a slot tracker, worked out
  from class and level: the full-caster table for bards, clerics,
  druids, sorcerers and wizards, the half-caster table for paladins and
  rangers (from level 2), and a warlock's few slots of one level. It is
  in the Spellcasting card on the sheet and in the character panel, and
  the party overview has a column for it. A player presses Use to spend
  a slot; only the DM gives one back.
- Rests. The DM's "Rest…" button, beside the character list and on the
  party overview, rests any of the party at once. A short rest shows
  which Hit Dice each character can roll and heals from what they
  rolled (typed in, or rolled by the site), and gives a warlock their
  slots. A long rest puts back HP, every spell slot and half the level
  in Hit Dice, and clears temp HP.
- Hit Dice are counted: one per level, shown on the sheet, the panel
  and the party overview.
- Level Up. "Level Up…" on a sheet takes a character up one level with
  the whole checklist: the new max HP and a full heal, the class's new
  special abilities for levels 2 to 10, a Boon where the level grants
  one (Toughened raises Extra AC, Hardy gives temp HP now and after
  each long rest), fresh spell slots and new spells, and the free
  upgrade of one standard weapon.
- A level typed into the Level field still writes down what the class
  gains on the way up, and leaves a line where a Boon is owed.
- The docs cover all of it, with a generated list of what each class
  gains at each level. The Hollowcrown seed's note no longer says to
  track spell slots on paper.
- New migration: spent spell slots and Hit Dice on a character.
- All packages at version 1.14.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitignore

@@ -6,3 +6,4 @@ build/
 *.log
 .DS_Store
 .idea/
+temp/

README.md

@@ -2,7 +2,7 @@
 
 A web app for a D&D 5e Dungeon Master and their players to run a campaign
 together: campaign management, a guided dice-roll character builder, live
-character sheets, a mid-combat "quick stats" panel, weapons/inventory/spells,
+character sheets, a character panel on every page, weapons/inventory/spells,
 monsters, and a real-time encounter/combat tracker.
 
 ## How it works
@@ -11,13 +11,14 @@ monsters, and a real-time encounter/combat tracker.
 
 | Document | Covers |
 |---|---|
-| `docs/CHARACTERS.md` | Building a character, every number on the sheet, levels, money, permissions |
-| `docs/WEAPONS.md` | The weapon pool, weapon levels and how damage grows |
-| `docs/SPELLS.md` | The spell list, who can use which spells, the spell library |
-| `docs/ITEMS.md` | The item pool and character inventory |
-| `docs/ENCOUNTERS.md` | Battles and NPC quests, turns, rewards, what players see |
+| `docs/CHARACTERS.md` | Building a character, every number on the sheet, levelling up, rests, money, permissions |
+| `docs/WEAPONS.md` | The weapon pool and library, equipping, weapon levels and how damage grows |
+| `docs/SPELLS.md` | The spell list, who can use which spells, spell slots, the spell library |
+| `docs/ITEMS.md` | The item pool and library, armor and other gear effects, what can be equipped, items for sale |
+| `docs/ENCOUNTERS.md` | Battles and NPC quests, turns, rewards, trade, what players see |
 | `docs/MONSTERS.md` | The monster list and built-in bestiary |
-| `docs/NPCS.md` | Non-player characters |
+| `docs/NPCS.md` | Non-player characters, what they sell and the rates they change money at |
+| `docs/SEEDS.md` | World seeds: ready-made campaigns a DM starts from a code, and how to add one |
 
 `CLAUDE_BUILD_PROMPT.md`, `docs/GAME_RULES_REFERENCE.md` and
 `docs/ROLL_YOUR_CHARACTER.md` are the original specifications the first
@@ -25,14 +26,66 @@ version was built from. The app has since moved on in places (gear levels,
 the builder's story steps, picking a motivation); the documents above are the
 current behaviour.
 
+## Getting around
+
+The same four destinations are always on screen: **Campaigns** (the list),
+**Campaign** and **Party** (for the campaign you were last in, from any page,
+including a character sheet or an encounter) and **Account**.
+
+- On a wide screen they are links along the top bar, and the dice roller
+  floats at the bottom left.
+- On a phone or small tablet (900px wide or less) they are a bar along the
+  bottom of the screen, with the **dice roller** as its last button. Nothing
+  floats over the page: the 🧙 character button sits in the top bar.
+- The **🧙 character button** is on every page (floating at the bottom right
+  on a wide screen). It opens a panel with your character's numbers and
+  everything they hold; the DM can open it for any character.
+- The **campaign page shows one part at a time**, picked from a row of
+  buttons under its name: Overview (characters and encounters), NPCs,
+  Locations, Weapons, Items, Spells, Monsters, Notes and Settings for the DM;
+  Overview, Places and Notes for a player. Each button shows how many things
+  are in that part. On a phone the row is one line that scrolls sideways. The
+  part showing is in the address (`?view=weapons`), so it can be bookmarked
+  and the back button steps through the parts.
+- **Search this campaign**, the box above that row, looks through everything
+  that has been added to the campaign at once: characters, encounters,
+  locations and notes, and for the DM also NPCs, weapons, items, spells and
+  monsters. It matches names and descriptions, every word typed, in any
+  order. A result opens that thing. Each of the DM's lists also has a search
+  box of its own.
+- The DM's lists (NPCs, weapons, items, spells, monsters) are short rows: a
+  name and a few words. **Clicking a row opens a pop-out** with everything
+  about it and everything that can be changed. Adding one, by hand or from the
+  library, is a pop-out too. One added by hand opens its own pop-out, with an
+  **"+ Add another"** button at the top that goes straight back to an empty
+  form. A pop-out is a window over the page on a wide
+  screen and the whole screen on a phone; ✕, Escape or a click outside it
+  closes it.
+- Every paged list has Prev and Next, and with three pages or more the page
+  number is a menu to **jump straight to any page**.
+- The DM's **🛏 Rest…** button, beside "Characters" on the campaign page and
+  on the party overview, rests any of the party at once: a short rest says
+  which Hit Dice each character can roll and heals from what they rolled; a
+  long rest puts back HP, spell slots and Hit Dice.
+- A caster's **spell slots** are on their sheet and in the character panel:
+  the player presses Use when they cast, and only the DM gives a slot back.
+- **⬆ Level Up…** on a sheet (DM) takes the character up a level with the
+  whole checklist: HP, the class's new special abilities, a Boon, spells and
+  the free weapon upgrade.
+- The character sheet is long, so it starts with a row of **section links**
+  that jump straight to that part of the page.
+- On a small screen every table (weapons, items, spells, monsters, the party
+  overview) is shown as a stack of cards, one per row, with each figure
+  labelled, and rows of controls wrap rather than run off the side.
+
 ## Stack
 
-- **Backend:** Node.js + Express, JavaScript, Prisma ORM, PostgreSQL, Socket.io, JWT auth (bcrypt + jsonwebtoken), zod validation.
+- **Backend:** Node.js + Express, JavaScript, Prisma ORM (with the `pg` driver adapter), PostgreSQL, Socket.io, JWT auth (bcrypt + jsonwebtoken), zod validation.
 - **Frontend:** React + Vite + TypeScript, React Router, TanStack Query, socket.io-client.
 
 ## Prerequisites
 
-- Node.js 18+ (tested on Node 22)
+- Node.js 20.19+ (tested on Node 24)
 - A running PostgreSQL instance (local install, Docker, or a hosted service like Neon/Supabase)
 
 ## First-time setup
@@ -44,7 +97,8 @@ npm install   # installs both workspaces (backend + frontend)
 cd backend
 cp .env.example .env      # edit DATABASE_URL and JWT_SECRET
 npx prisma migrate dev --name init
-npx prisma db seed        # adds the admin account + the Aldenfell campaign if missing (see output for login/invite code)
+npx prisma generate       # migrate no longer does this itself
+npx prisma db seed        # adds the admin account if it is missing (see output for the login and the world codes)
 
 # Frontend
 cd ../frontend
@@ -61,18 +115,38 @@ npm run dev:frontend   # Vite dev server, prints its own port (5173 by default)
 ```
 
 Open the frontend URL, register an account (or log in with the seeded admin
-account — see the seed script's console output for credentials and invite
-code), and start playing.
+account — see the seed script's console output for the credentials), and
+start playing.
 
-The seed only adds: it never touches an existing account or campaign, so it is
-safe to run on a server with real data. It skips the campaign if the admin
-already has an active "Aldenfell"; archive or delete that one in the app
-(Campaign Settings) and run it again for a fresh copy. `SEED_ADMIN_EMAIL`,
-`SEED_ADMIN_PASSWORD` and `SEED_ADMIN_NAME` set the account it creates.
-`npx prisma db seed -- --reset` wipes every user and campaign first.
+The database seed creates the admin account and nothing else. It only adds: an
+existing account, and its password, is left alone, so it is safe to run on a
+server with real data. `SEED_ADMIN_EMAIL`, `SEED_ADMIN_PASSWORD` and
+`SEED_ADMIN_NAME` set the account it creates. `npx prisma db seed -- --reset`
+wipes every user and campaign first.
 
-On a server, apply new migrations with `npx prisma migrate deploy`. Change
-your password from the account page (click your name in the top bar).
+## Worlds
+
+Campaigns are created in the app: blank, or from a **world seed** by its
+code. On the Campaigns page click "+ New Campaign" and enter a code under "Or
+start from a ready-made world"; the whole world is built for you as its DM.
+
+| Code | World |
+|---|---|
+| `ALDENF` | Aldenfell |
+| `HOLLOW` | Hollowcrown: The Rift Between Worlds |
+
+Each world is one file in `/backend/seeds`. Drop another file in and its code
+works straight away, with no restart; `npm run seeds:check` (from the repo
+root or `backend`) checks every file and says what is wrong with one.
+`docs/SEEDS.md` has the format.
+
+On a server, after pulling a new version, run `npm install` in the repo root
+(when dependencies changed) and then `npm run deploy` in `backend`
+and then restart the backend. It applies new migrations **and** regenerates
+the Prisma client; without the second half the server keeps running with the
+old data model and pages that use anything new fail to load (for example
+"Could not load this encounter"). Change your password from the account page
+("Account" in the navigation).
 
 ## Tests
 
@@ -81,8 +155,9 @@ cd backend
 npm test
 ```
 
-The calculation engine (`src/game/calculations.js`) is fully unit tested and
-runs with no external dependencies. The route-level integration tests in
+The calculation engine (`src/game/calculations.js`) and the world seeds
+(`src/seeds`, which also checks every file in `/backend/seeds`) are unit
+tested and run with no external dependencies. The route-level integration tests in
 `src/routes/api.integration.test.js` need a real, migrated database reachable
 via `DATABASE_URL` — they skip themselves gracefully (with a console warning)
 if the DB isn't reachable, so `npm test` still passes in an environment with
@@ -92,14 +167,17 @@ no database configured.
 
 ```
 /backend    — Express + Prisma API, Socket.io server
-  /prisma   — schema.prisma, seed.js
-  /seed-data — reference JSON (weapons seeded per-campaign; species/classes/skills
-               are ported into src/game/data/*.js and used directly by the
-               calculation engine, not stored as DB rows)
+  prisma.config.js — where the Prisma CLI finds the schema, the database and the seed
+  /prisma   — schema.prisma, migrations, seed.js (the admin account only)
+  /seeds    — world seeds: one file per ready-made campaign, created by code
+  /seed-data — reference JSON (species/classes/skills/weapons, ported into
+               src/game/data/*.js and used directly by the calculation engine,
+               not stored as DB rows)
   /src
-    /game       — calculations.js (the ONLY place D&D formulas live) + buildFlow.js
+    /game       — calculations.js (the ONLY place D&D formulas live) + buildFlow.js + levelUp.js
     /middleware — auth + campaign/character authorization
     /routes     — auth, campaigns, characters, encounters, notes
+    /seeds      — finds, checks and creates campaigns from the world seeds
     /sockets    — Socket.io room wiring
 /frontend   — React + Vite + TypeScript app
 /docs       — game rules & character-builder specs (reference material)

backend/package.json

@@ -1,35 +1,36 @@
 {
   "name": "backend",
-  "version": "1.0.0",
+  "version": "1.14.0",
   "private": true,
   "type": "commonjs",
   "main": "src/index.js",
-  "prisma": {
-    "seed": "node prisma/seed.js"
-  },
   "scripts": {
     "dev": "node --watch src/index.js",
     "start": "node src/index.js",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest",
+    "test": "jest",
     "docs:lists": "node scripts/generate-doc-lists.js",
     "prisma:migrate": "prisma migrate dev",
     "prisma:generate": "prisma generate",
     "prisma:seed": "prisma db seed",
+    "seeds:check": "node scripts/check-seeds.js",
+    "deploy": "prisma migrate deploy && prisma generate",
     "prisma:studio": "prisma studio"
   },
   "dependencies": {
-    "@prisma/client": "^5.20.0",
-    "bcrypt": "^5.1.1",
+    "@prisma/adapter-pg": "^7.10.0",
+    "@prisma/client": "^7.10.0",
+    "bcrypt": "^6.0.0",
+    "compression": "^1.8.2",
     "cors": "^2.8.5",
-    "dotenv": "^16.4.5",
-    "express": "^4.21.0",
+    "dotenv": "^18.0.6",
+    "express": "^5.2.1",
     "jsonwebtoken": "^9.0.2",
     "socket.io": "^4.8.0",
-    "zod": "^3.23.8"
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "jest": "^29.7.0",
-    "prisma": "^5.20.0",
+    "jest": "^30.5.2",
+    "prisma": "^7.10.0",
     "supertest": "^7.0.0"
   }
 }

backend/prisma.config.js

@@ -0,0 +1,15 @@
+// Prisma CLI configuration: where the schema and migrations live, which
+// database to run them against, and the command behind `prisma db seed`.
+require('dotenv').config({ quiet: true });
+const { defineConfig, env } = require('prisma/config');
+
+module.exports = defineConfig({
+  schema: 'prisma/schema.prisma',
+  migrations: {
+    path: 'prisma/migrations',
+    seed: 'node prisma/seed.js',
+  },
+  datasource: {
+    url: env('DATABASE_URL'),
+  },
+});

backend/prisma/migrations/20261006180000_player_visibility/migration.sql

@@ -0,0 +1,23 @@
+-- AlterTable: whether players see a monster's exact hit points or only its health bar
+ALTER TABLE "campaigns" ADD COLUMN "showMonsterHp" BOOLEAN NOT NULL DEFAULT true;
+
+-- AlterTable: where an encounter takes place
+ALTER TABLE "encounters" ADD COLUMN "locationId" TEXT;
+ALTER TABLE "encounters" ADD CONSTRAINT "encounters_locationId_fkey" FOREIGN KEY ("locationId") REFERENCES "locations"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- CreateTable: every location a character has been to
+CREATE TABLE "character_location_visits" (
+    "id" TEXT NOT NULL,
+    "characterId" TEXT NOT NULL,
+    "locationId" TEXT NOT NULL,
+    "firstVisitedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "character_location_visits_pkey" PRIMARY KEY ("id")
+);
+CREATE UNIQUE INDEX "character_location_visits_characterId_locationId_key" ON "character_location_visits"("characterId", "locationId");
+ALTER TABLE "character_location_visits" ADD CONSTRAINT "character_location_visits_characterId_fkey" FOREIGN KEY ("characterId") REFERENCES "characters"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "character_location_visits" ADD CONSTRAINT "character_location_visits_locationId_fkey" FOREIGN KEY ("locationId") REFERENCES "locations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- Characters have been to wherever they are now.
+INSERT INTO "character_location_visits" ("id", "characterId", "locationId")
+SELECT 'visit_' || "id", "id", "currentLocationId" FROM "characters" WHERE "currentLocationId" IS NOT NULL;

backend/prisma/migrations/20261006200000_initiative_roll/migration.sql

@@ -0,0 +1,9 @@
+-- AlterTable: the d20 a combatant rolled for initiative; "initiative" is now roll + bonus
+ALTER TABLE "encounter_participants" ADD COLUMN "initiativeRoll" INTEGER;
+
+-- Initiatives typed in before this were totals. Keep them as they are, and
+-- treat the nearest possible die face as the roll so those combatants still
+-- count as having rolled.
+UPDATE "encounter_participants"
+SET "initiativeRoll" = LEAST(GREATEST("initiative", 1), 20)
+WHERE "initiative" <> 0;

backend/prisma/migrations/20261007090000_silver_and_copper/migration.sql

@@ -0,0 +1,10 @@
+-- CreateEnum: the three coins. Silver is worth 0.1 gold, copper 0.01 gold.
+CREATE TYPE "Currency" AS ENUM ('GOLD', 'SILVER', 'COPPER');
+
+-- AlterTable: a character's purse holds each coin separately
+ALTER TABLE "characters" ADD COLUMN "silver" INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE "characters" ADD COLUMN "copper" INTEGER NOT NULL DEFAULT 0;
+
+-- AlterTable: every ledger entry and coin reward is in one coin; all existing ones are gold
+ALTER TABLE "gold_transactions" ADD COLUMN "currency" "Currency" NOT NULL DEFAULT 'GOLD';
+ALTER TABLE "encounter_rewards" ADD COLUMN "currency" "Currency" NOT NULL DEFAULT 'GOLD';

backend/prisma/migrations/20261007120000_death_saves/migration.sql

@@ -0,0 +1,4 @@
+-- AlterTable: death saves, counted while a character is at 0 HP
+ALTER TABLE "characters" ADD COLUMN "deathSaveSuccesses" INTEGER NOT NULL DEFAULT 0,
+ADD COLUMN "deathSaveFailures" INTEGER NOT NULL DEFAULT 0,
+ADD COLUMN "stable" BOOLEAN NOT NULL DEFAULT false;

backend/prisma/migrations/20261007150000_encounter_target/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable: the combatant currently marked as the target
+ALTER TABLE "encounters" ADD COLUMN "targetParticipantId" TEXT;

backend/prisma/migrations/20261007170000_encounter_targets/migration.sql

@@ -0,0 +1,9 @@
+-- AlterTable: several combatants can be marked as targets at once (an area attack)
+ALTER TABLE "encounters" ADD COLUMN "targetParticipantIds" TEXT[] DEFAULT ARRAY[]::TEXT[];
+
+-- Carry over a single target marked before this.
+UPDATE "encounters"
+SET "targetParticipantIds" = ARRAY["targetParticipantId"]
+WHERE "targetParticipantId" IS NOT NULL;
+
+ALTER TABLE "encounters" DROP COLUMN "targetParticipantId";

backend/prisma/migrations/20261007190000_area_attack_ac_penalty/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable: how much an area attack adds to each AC per extra target
+ALTER TABLE "campaigns" ADD COLUMN "areaAttackAcPenalty" INTEGER NOT NULL DEFAULT 2;

backend/prisma/migrations/20261007210000_spell_revives/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable: spells that bring back the dead
+ALTER TABLE "spells" ADD COLUMN "revives" BOOLEAN NOT NULL DEFAULT false;
+
+-- The library's two revival spells, wherever a campaign already has them.
+UPDATE "spells" SET "revives" = true WHERE "name" IN ('Revivify', 'Raise Dead');

backend/prisma/migrations/20261007230000_cash_currency/migration.sql

@@ -0,0 +1,6 @@
+-- AlterEnum: cash ($), a modern currency for crossover worlds. It has no fixed
+-- worth in gold, so it is never exchanged or used to make change.
+ALTER TYPE "Currency" ADD VALUE 'CASH';
+
+-- AlterTable: cash is counted on its own, like each coin
+ALTER TABLE "characters" ADD COLUMN "cash" INTEGER NOT NULL DEFAULT 0;

backend/prisma/migrations/20261008100000_trade/migration.sql

@@ -0,0 +1,28 @@
+-- AlterTable: an NPC who changes money does it at their own rate, this many
+-- gold for that much cash. Both are null for an NPC who does not.
+ALTER TABLE "npcs" ADD COLUMN "exchangeGold" INTEGER;
+ALTER TABLE "npcs" ADD COLUMN "exchangeCash" INTEGER;
+
+-- CreateTable: something for sale, by an NPC or at an encounter itself
+CREATE TABLE "sale_offers" (
+    "id" TEXT NOT NULL,
+    "campaignId" TEXT NOT NULL,
+    "npcId" TEXT,
+    "encounterId" TEXT,
+    "weaponId" TEXT,
+    "itemId" TEXT,
+    "price" INTEGER NOT NULL,
+    "currency" "Currency" NOT NULL DEFAULT 'GOLD',
+    "level" INTEGER NOT NULL DEFAULT 1,
+    "stock" INTEGER,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "sale_offers_pkey" PRIMARY KEY ("id")
+);
+
+-- AddForeignKey
+ALTER TABLE "sale_offers" ADD CONSTRAINT "sale_offers_campaignId_fkey" FOREIGN KEY ("campaignId") REFERENCES "campaigns"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "sale_offers" ADD CONSTRAINT "sale_offers_npcId_fkey" FOREIGN KEY ("npcId") REFERENCES "npcs"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "sale_offers" ADD CONSTRAINT "sale_offers_encounterId_fkey" FOREIGN KEY ("encounterId") REFERENCES "encounters"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "sale_offers" ADD CONSTRAINT "sale_offers_weaponId_fkey" FOREIGN KEY ("weaponId") REFERENCES "weapons"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "sale_offers" ADD CONSTRAINT "sale_offers_itemId_fkey" FOREIGN KEY ("itemId") REFERENCES "items"("id") ON DELETE CASCADE ON UPDATE CASCADE;

backend/prisma/migrations/20261009090000_gear_effects/migration.sql

@@ -0,0 +1,7 @@
+-- AlterTable: a weapon or item can change the numbers on the sheet of whoever
+-- has it equipped. `effects` is a list of { stat, amount }; `effectNote` is
+-- for what it does that is not a number ("Disadvantage on Stealth").
+ALTER TABLE "weapons" ADD COLUMN "effects" JSONB NOT NULL DEFAULT '[]';
+ALTER TABLE "weapons" ADD COLUMN "effectNote" TEXT;
+ALTER TABLE "items" ADD COLUMN "effects" JSONB NOT NULL DEFAULT '[]';
+ALTER TABLE "items" ADD COLUMN "effectNote" TEXT;

backend/prisma/migrations/20261009140000_equip_limits/migration.sql

@@ -0,0 +1,4 @@
+-- AlterTable: how much a character can have equipped at once. Only equipped
+-- gear can be used in an encounter or gives its effects.
+ALTER TABLE "campaigns" ADD COLUMN "maxEquipped" INTEGER NOT NULL DEFAULT 2;
+ALTER TABLE "campaigns" ADD COLUMN "maxEquippedWeapons" INTEGER NOT NULL DEFAULT 1;

backend/prisma/migrations/20261009150000_foreign_key_indexes/migration.sql

@@ -0,0 +1,20 @@
+-- CreateIndex: the columns every list is looked up by. Postgres does not
+-- index a foreign key on its own.
+CREATE INDEX "locations_campaignId_idx" ON "locations"("campaignId");
+CREATE INDEX "campaign_members_userId_idx" ON "campaign_members"("userId");
+CREATE INDEX "characters_campaignId_idx" ON "characters"("campaignId");
+CREATE INDEX "characters_userId_idx" ON "characters"("userId");
+CREATE INDEX "weapons_campaignId_idx" ON "weapons"("campaignId");
+CREATE INDEX "items_campaignId_idx" ON "items"("campaignId");
+CREATE INDEX "spells_campaignId_idx" ON "spells"("campaignId");
+CREATE INDEX "monsters_campaignId_idx" ON "monsters"("campaignId");
+CREATE INDEX "npcs_campaignId_idx" ON "npcs"("campaignId");
+CREATE INDEX "encounters_campaignId_idx" ON "encounters"("campaignId");
+CREATE INDEX "encounter_rewards_encounterId_idx" ON "encounter_rewards"("encounterId");
+CREATE INDEX "sale_offers_campaignId_idx" ON "sale_offers"("campaignId");
+CREATE INDEX "sale_offers_npcId_idx" ON "sale_offers"("npcId");
+CREATE INDEX "sale_offers_encounterId_idx" ON "sale_offers"("encounterId");
+CREATE INDEX "encounter_participants_encounterId_idx" ON "encounter_participants"("encounterId");
+CREATE INDEX "encounter_participants_characterId_idx" ON "encounter_participants"("characterId");
+CREATE INDEX "notes_campaignId_idx" ON "notes"("campaignId");
+CREATE INDEX "notes_characterId_idx" ON "notes"("characterId");

backend/prisma/migrations/20261010100000_spell_slots_rests/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable: what a character has spent since their last rest. Spell slots
+-- by slot level (the first entry is 1st-level slots), and Hit Dice. How many
+-- of each there are comes from class and level, so only what is used is kept.
+ALTER TABLE "characters" ADD COLUMN "spellSlotsUsed" INTEGER[] DEFAULT ARRAY[]::INTEGER[],
+ADD COLUMN "hitDiceUsed" INTEGER NOT NULL DEFAULT 0;

backend/prisma/schema.prisma

@@ -1,7 +1,8 @@
 // D&D Campaign Manager — Prisma schema
-// Postgres. Run `npx prisma migrate dev --name init` after `DATABASE_URL` is set,
-// then `npx prisma db seed` using the seed script built from /seed-data/*.json
-// (see CLAUDE_BUILD_PROMPT.md, "Database" section).
+// Postgres. The connection (DATABASE_URL) is set in prisma.config.js, not here.
+// Run `npx prisma migrate dev` then `npx prisma generate`; `npx prisma db seed`
+// adds the admin account (prisma/seed.js). Worlds are created in the app from
+// the seeds in /backend/seeds.
 
 generator client {
   provider = "prisma-client-js"
@@ -9,7 +10,6 @@ generator client {
 
 datasource db {
   provider = "postgresql"
-  url      = env("DATABASE_URL")
 }
 
 // ---------------------------------------------------------------------------
@@ -118,6 +118,16 @@ enum RewardType {
   ITEM
 }
 
+// The money a character carries. The coins' worth is fixed in utils/grants.js:
+// 1 gold = 10 silver = 100 copper. Cash ($) is modern money for crossover
+// worlds; it has no worth in coins and is never exchanged for them.
+enum Currency {
+  GOLD
+  SILVER
+  COPPER
+  CASH
+}
+
 enum NoteVisibility {
   DM_ONLY
   SHARED
@@ -158,6 +168,17 @@ model Campaign {
   startingItemCount  Int      @default(0)
   startingSpellCount Int      @default(0)
   skipMotivationRoll Boolean  @default(false)
+  // Off: players see only a health bar for monsters and NPCs, not the numbers.
+  showMonsterHp      Boolean  @default(true)
+  // An attack on several targets is harder to land: each target's AC counts
+  // as this much higher for every target beyond the first. 0 turns it off.
+  areaAttackAcPenalty Int     @default(2)
+  // How much a character can have equipped at once: weapons and items
+  // together, and weapons alone. Only equipped gear can be used in an
+  // encounter or gives its effects, so this is what a character can bring to
+  // bear at one time. A pair of daggers is one weapon, made as such.
+  maxEquipped         Int     @default(2)
+  maxEquippedWeapons  Int     @default(1)
   ownerId            String
   // Set while the campaign is archived: kept in full, but moved off the main
   // list and closed to new members until the DM restores it.
@@ -173,6 +194,7 @@ model Campaign {
   monsters   Monster[]
   npcs       Npc[]
   encounters Encounter[]
+  saleOffers SaleOffer[]
   notes      Note[]
   locations  Location[]
 
@@ -188,10 +210,29 @@ model Location {
 
   campaign   Campaign    @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   characters Character[]
+  encounters Encounter[]
+  visits     CharacterLocationVisit[]
 
+  @@index([campaignId])
   @@map("locations")
 }
 
+// A location a character has been to. Written whenever a character is put
+// somewhere (by the DM, or by an encounter held there), and never removed by
+// moving on: it is what decides which locations a player may see.
+model CharacterLocationVisit {
+  id             String   @id @default(cuid())
+  characterId    String
+  locationId     String
+  firstVisitedAt DateTime @default(now())
+
+  character Character @relation(fields: [characterId], references: [id], onDelete: Cascade)
+  location  Location  @relation(fields: [locationId], references: [id], onDelete: Cascade)
+
+  @@unique([characterId, locationId])
+  @@map("character_location_visits")
+}
+
 model CampaignMember {
   id         String       @id @default(cuid())
   campaignId String
@@ -203,6 +244,7 @@ model CampaignMember {
   user     User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
   @@unique([campaignId, userId])
+  @@index([userId])
   @@map("campaign_members")
 }
 
@@ -236,13 +278,29 @@ model Character {
 
   currentHp     Int     @default(0)
   tempHp        Int     @default(0)
-  armorBonus    Int     @default(0) // flat AC bonus from equipped armor/shield
+  // Death saves, counted while the character is at 0 HP (utils/hp.js). Three
+  // failures is dead; three successes sets `stable` and clears the tallies.
+  deathSaveSuccesses Int     @default(0)
+  deathSaveFailures  Int     @default(0)
+  stable             Boolean @default(false) // at 0 HP but no longer rolling
+  // What has been spent since the last rest. Spell slots by slot level (the
+  // first entry is 1st-level slots); how many there are comes from class and
+  // level (game/calculations.js, spellSlotsFor). A character has one Hit Die
+  // per level, spent on short rests.
+  spellSlotsUsed     Int[]   @default([])
+  hitDiceUsed        Int     @default(0)
+  armorBonus    Int     @default(0) // a flat AC adjustment the DM sets by hand, on top of what equipped gear gives
   speedOverride Int?
 
   // The next three are composed by the builder from the player's picks
   // (game/data/characterOptions.js). After that only the DM can edit them.
   specialAbilities String? // shown in the quick-stats panel
+  // The purse: each coin (and cash) is counted on its own and only changes through the
+  // money ledger (GoldTransaction).
   gold             Int     @default(0)
+  silver           Int     @default(0)
+  copper           Int     @default(0)
+  cash             Int     @default(0) // whole dollars
 
   background   String?
   appearance   String?
@@ -271,7 +329,10 @@ model Character {
   spells             CharacterSpell[]
   notes              Note[]
   encounterEntries   EncounterParticipant[]
+  locationVisits     CharacterLocationVisit[]
 
+  @@index([campaignId])
+  @@index([userId])
   @@map("characters")
 }
 
@@ -323,12 +384,19 @@ model Weapon {
   // Offered in the character builder's starting-equipment step. Off by default:
   // the DM opts entries in, so the pool can hold gear that must be earned.
   isStartingOption Boolean @default(false)
+  // What it does to the sheet of whoever has it equipped: a list of
+  // { stat, amount } (game/calculations.js, GEAR_STATS), and a note for
+  // anything that is not a number.
+  effects      Json     @default("[]")
+  effectNote   String?
   createdAt    DateTime @default(now())
 
   campaign Campaign          @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   assigned CharacterWeapon[]
   rewards  EncounterReward[]
+  offers   SaleOffer[]
 
+  @@index([campaignId])
   @@map("weapons")
 }
 
@@ -357,12 +425,18 @@ model Item {
   damageScaling    Int      @default(1)
   minLevel         Int      @default(1)
   isStartingOption Boolean  @default(false)
+  // As on a weapon: what it does to whoever has it equipped. Armor is an
+  // item with an AC effect.
+  effects          Json     @default("[]")
+  effectNote       String?
   createdAt        DateTime @default(now())
 
   campaign Campaign        @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   held     InventoryItem[]
   rewards  EncounterReward[]
+  offers   SaleOffer[]
 
+  @@index([campaignId])
   @@map("items")
 }
 
@@ -382,12 +456,14 @@ model InventoryItem {
   @@map("inventory_items")
 }
 
-// Ledger behind Character.gold: every change to the balance is one row here.
+// Ledger behind a character's purse: every change to a coin balance is one
+// row here. (The name predates silver and copper.)
 model GoldTransaction {
   id           String   @id @default(cuid())
   characterId  String
+  currency     Currency @default(GOLD) // which coin this entry is in
   amount       Int // signed: positive = gained, negative = spent
-  balanceAfter Int
+  balanceAfter Int // that coin's balance afterwards
   reason       String?
   createdById  String?
   createdAt    DateTime @default(now())
@@ -415,10 +491,14 @@ model Spell {
   duration    String?
   description String?
   isStartingOption Boolean @default(false)
+  // Brings back the dead: a character who can cast it may revive a dead ally
+  // on their turn in a battle (encounters.routes.js).
+  revives     Boolean @default(false)
 
   campaign Campaign         @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   known    CharacterSpell[]
 
+  @@index([campaignId])
   @@map("spells")
 }
 
@@ -461,6 +541,7 @@ model Monster {
   campaign             Campaign               @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   encounterAppearances EncounterParticipant[]
 
+  @@index([campaignId])
   @@map("monsters")
 }
 
@@ -478,11 +559,17 @@ model Npc {
   maxHp       Int?
   attackBonus Int?
   damageDice  String?
+  // A money changer swaps gold and cash at their own rate: exchangeGold gold
+  // for exchangeCash cash, either way. Both null: this NPC does not exchange.
+  exchangeGold Int?
+  exchangeCash Int?
   createdAt   DateTime       @default(now())
 
   campaign             Campaign               @relation(fields: [campaignId], references: [id], onDelete: Cascade)
   encounterAppearances EncounterParticipant[]
+  wares                SaleOffer[]
 
+  @@index([campaignId])
   @@map("npcs")
 }
 
@@ -495,8 +582,15 @@ model Encounter {
   currentRound Int             @default(1)
   // Whose turn it is in a battle; null until the fight starts.
   activeParticipantId String?
+  // Who is being attacked (or healed) right now, shown to everyone, in the
+  // order they were picked. More than one makes it an area attack. Picked by
+  // the DM or by the player on turn, and cleared when the turn passes.
+  targetParticipantIds String[] @default([])
   description  String? // the scene / objective, shown to everyone
   dmNotes      String? // never sent to players
+  // Where the scene takes place. While the encounter is in progress, the
+  // characters in it are there too.
+  locationId   String?
   // Set while archived: kept in full, but off the campaign's list — players
   // no longer see it there at all.
   archivedAt   DateTime?
@@ -506,9 +600,12 @@ model Encounter {
   updatedAt    DateTime        @updatedAt
 
   campaign     Campaign               @relation(fields: [campaignId], references: [id], onDelete: Cascade)
+  location     Location?              @relation(fields: [locationId], references: [id], onDelete: SetNull)
   participants EncounterParticipant[]
   rewards      EncounterReward[]
+  wares        SaleOffer[]
 
+  @@index([campaignId])
   @@map("encounters")
 }
 
@@ -519,7 +616,8 @@ model EncounterReward {
   id          String     @id @default(cuid())
   encounterId String
   type        RewardType
-  gold        Int? // GOLD
+  gold        Int? // GOLD: how many coins
+  currency    Currency   @default(GOLD) // GOLD: which coin they are
   weaponId    String? // WEAPON
   itemId      String? // ITEM
   quantity    Int        @default(1)
@@ -533,9 +631,40 @@ model EncounterReward {
   weapon    Weapon?   @relation(fields: [weaponId], references: [id], onDelete: Cascade)
   item      Item?     @relation(fields: [itemId], references: [id], onDelete: Cascade)
 
+  @@index([encounterId])
   @@map("encounter_rewards")
 }
 
+// Something for sale: a weapon or item from the campaign pools, at a price.
+// It belongs to an NPC (and is on offer wherever that NPC is met) or to an
+// encounter itself (a stall, a vending machine). Only the DM sets these up;
+// players see them, and buy, in a quest encounter in progress
+// (encounters.routes.js).
+model SaleOffer {
+  id          String   @id @default(cuid())
+  campaignId  String
+  npcId       String? // exactly one of npcId / encounterId is set
+  encounterId String?
+  weaponId    String? // exactly one of weaponId / itemId is set
+  itemId      String?
+  price       Int // for one, in `currency`
+  currency    Currency @default(GOLD)
+  level       Int      @default(1) // gear level it is handed over at
+  stock       Int? // how many are left; null = no limit
+  createdAt   DateTime @default(now())
+
+  campaign  Campaign   @relation(fields: [campaignId], references: [id], onDelete: Cascade)
+  npc       Npc?       @relation(fields: [npcId], references: [id], onDelete: Cascade)
+  encounter Encounter? @relation(fields: [encounterId], references: [id], onDelete: Cascade)
+  weapon    Weapon?    @relation(fields: [weaponId], references: [id], onDelete: Cascade)
+  item      Item?      @relation(fields: [itemId], references: [id], onDelete: Cascade)
+
+  @@index([campaignId])
+  @@index([npcId])
+  @@index([encounterId])
+  @@map("sale_offers")
+}
+
 // A row per combatant in an encounter — a character, a monster or an NPC.
 // A monster's currentHp/maxHp live here, per instance. A character's HP has
 // one source of truth, the Character row: encounters read and write that, and
@@ -548,6 +677,10 @@ model EncounterParticipant {
   monsterId   String?
   npcId       String?
   displayName String // denormalized so a monster can be renamed per-instance, e.g. "Goblin #2"
+  // The d20 rolled for initiative (1–20); null until it is rolled.
+  initiativeRoll Int?
+  // The roll plus the combatant's initiative bonus, worked out when the roll
+  // is entered. This is what the turn order sorts on.
   initiative  Int      @default(0)
   currentHp   Int
   maxHp       Int
@@ -559,6 +692,8 @@ model EncounterParticipant {
   monster   Monster?   @relation(fields: [monsterId], references: [id], onDelete: SetNull)
   npc       Npc?       @relation(fields: [npcId], references: [id], onDelete: SetNull)
 
+  @@index([encounterId])
+  @@index([characterId])
   @@map("encounter_participants")
 }
 
@@ -579,5 +714,7 @@ model Note {
   character Character? @relation(fields: [characterId], references: [id], onDelete: Cascade)
   author    User       @relation(fields: [authorId], references: [id])
 
+  @@index([campaignId])
+  @@index([characterId])
   @@map("notes")
 }

backend/prisma/seed.js

@@ -1,207 +1,54 @@
-// Seeds the Aldenfell campaign (seed-data/aldenfell.js) for the admin account.
+// The database seed: makes sure the admin account exists, and nothing else.
 //
-// Safe to run against a live database: it only ever ADDS. The admin account is
-// created if it is missing (an existing one, and its password, is left alone),
-// and the campaign is added unless that account already owns an active
-// campaign of the same name. To get a fresh copy, archive or delete the old
-// one in the app and run the seed again.
-//
-//   npx prisma db seed              add what is missing
+//   npx prisma db seed              create the admin account if it is missing
 //   npx prisma db seed -- --reset   DESTRUCTIVE: delete every user, campaign,
 //                                   character, note, etc. first
 //
-// SEED_ADMIN_EMAIL / SEED_ADMIN_PASSWORD / SEED_ADMIN_NAME override the
-// account that is created.
+// It only ever adds, so it is safe against a live database: an existing
+// account, and its password, is left alone. SEED_ADMIN_EMAIL /
+// SEED_ADMIN_PASSWORD / SEED_ADMIN_NAME override the account that is created.
 //
-// Species/classes/skills are NOT seeded as rows — they're fixed game-rule
-// tables ported into src/game/data/*.js, as is the default weapon/spell/monster
-// library DMs pull from. The default weapons (seed-data/weapons.json) ARE
-// seeded, into the campaign, since weapons are per-campaign in the schema.
-const path = require('path');
+// Worlds are not seeded here. A campaign is created in the app, blank or from
+// one of the world seeds in /backend/seeds by its code (docs/SEEDS.md).
+//
+// Species/classes/skills are not rows either: they are fixed game-rule tables
+// in src/game/data/*.js, as is the library DMs pull weapons, items, spells
+// and monsters from.
 const bcrypt = require('bcrypt');
-const { PrismaClient } = require('@prisma/client');
-const { generateInviteCode } = require('../src/utils/inviteCode');
-const { SPELL_LIBRARY } = require('../src/game/data/library');
-
-const prisma = new PrismaClient();
-const defaultWeapons = require(path.join(__dirname, '..', 'seed-data', 'weapons.json'));
-const aldenfell = require(path.join(__dirname, '..', 'seed-data', 'aldenfell.js'));
+const prisma = require('../src/db');
+const { loadSeeds } = require('../src/seeds');
 
 const ADMIN_EMAIL = process.env.SEED_ADMIN_EMAIL || 'joshua@crosscode.co.za';
 const ADMIN_PASSWORD = process.env.SEED_ADMIN_PASSWORD || '12345678';
 const ADMIN_NAME = process.env.SEED_ADMIN_NAME || 'Joshua';
-const RESET = process.argv.includes('--reset');
 
-async function resetDatabase() {
-  // Truncating the two roots cascades through every table that references them.
-  await prisma.$executeRawUnsafe('TRUNCATE TABLE "users", "campaigns" RESTART IDENTITY CASCADE');
-}
-
-// Notes list newest-first on screen, so they are stamped a second apart,
-// backwards: the first entry in the seed data is the one at the top.
-function bookOrder(index) {
-  return new Date(Date.now() - index * 1000);
-}
-
-function byName(rows) {
-  return new Map(rows.map((row) => [row.name, row]));
-}
-
-function lookup(map, name, what, encounterName) {
-  const row = map.get(name);
-  if (!row) throw new Error(`Encounter "${encounterName}" references unknown ${what} "${name}"`);
-  return row;
-}
-
-async function seedCampaign(db, admin) {
-  const campaign = await db.campaign.create({
-    data: {
-      ...aldenfell.campaign,
-      inviteCode: generateInviteCode(),
-      ownerId: admin.id,
-      members: { create: { userId: admin.id, role: 'DM' } },
-    },
-  });
-  const campaignId = campaign.id;
-
-  await db.location.createMany({ data: aldenfell.locations.map((l) => ({ ...l, campaignId })) });
-
-  // Everyday weapons are what a new character picks from; the rest are earned.
-  await db.weapon.createMany({
-    data: [
-      ...defaultWeapons.map((w) => ({ ...w, isStartingOption: true, campaignId })),
-      ...aldenfell.weapons.map((w) => ({ ...w, campaignId })),
-    ],
-  });
-  await db.item.createMany({
-    data: aldenfell.items.map(({ starting, ...item }) => ({ ...item, isStartingOption: Boolean(starting), campaignId })),
-  });
-
-  const spellRow = (isStartingOption) => (spellKey) => {
-    const template = SPELL_LIBRARY.find((s) => s.key === spellKey);
-    if (!template) throw new Error(`Unknown library spell "${spellKey}"`);
-    const { key, classes, ...spell } = template;
-    return { ...spell, isStartingOption, campaignId };
-  };
-  const spells = [...aldenfell.spells.starting.map(spellRow(true)), ...aldenfell.spells.earned.map(spellRow(false))];
-  await db.spell.createMany({ data: spells });
-
-  await db.monster.createMany({ data: aldenfell.monsters.map((m) => ({ ...m, campaignId })) });
-  await db.npc.createMany({ data: aldenfell.npcs.map((n) => ({ ...n, campaignId })) });
-
-  const monsters = byName(await db.monster.findMany({ where: { campaignId } }));
-  const npcs = byName(await db.npc.findMany({ where: { campaignId } }));
-  const weapons = byName(await db.weapon.findMany({ where: { campaignId } }));
-  const items = byName(await db.item.findMany({ where: { campaignId } }));
-
-  let rewardCount = 0;
-  for (const [index, enc] of aldenfell.encounters.entries()) {
-    const participants = [];
-    for (const [name, count, displayName] of enc.monsters || []) {
-      const monster = lookup(monsters, name, 'monster', enc.name);
-      const label = displayName || monster.name;
-      for (let i = 1; i <= count; i++) {
-        participants.push({
-          monsterId: monster.id,
-          displayName: count > 1 ? `${label} #${i}` : label,
-          currentHp: monster.maxHp,
-          maxHp: monster.maxHp,
-          isMonster: true,
-        });
-      }
-    }
-    for (const name of enc.npcs || []) {
-      const npc = lookup(npcs, name, 'NPC', enc.name);
-      // An NPC with no combat stats takes part with no hit points to track.
-      participants.push({ npcId: npc.id, displayName: npc.name, currentHp: npc.maxHp ?? 0, maxHp: npc.maxHp ?? 0, isMonster: false });
-    }
-
-    // Rewards list oldest-first, so these are stamped forwards.
-    const rewards = (enc.rewards || []).map(({ gold, weapon, item, quantity = 1, level, note }, i) => {
-      const createdAt = new Date(Date.now() + i);
-      if (gold) return { type: 'GOLD', gold, note, createdAt };
-      const entry = weapon ? lookup(weapons, weapon, 'weapon', enc.name) : lookup(items, item, 'item', enc.name);
-      return {
-        type: weapon ? 'WEAPON' : 'ITEM',
-        [weapon ? 'weaponId' : 'itemId']: entry.id,
-        quantity,
-        level: Math.max(level ?? entry.minLevel, entry.minLevel),
-        note,
-        createdAt,
-      };
-    });
-    rewardCount += rewards.length;
-
-    await db.encounter.create({
-      data: {
-        campaignId,
-        name: enc.name,
-        mode: enc.mode,
-        description: enc.description,
-        dmNotes: enc.dmNotes,
-        sortOrder: index,
-        participants: { create: participants },
-        rewards: { create: rewards },
-      },
-    });
-  }
-
-  const notes = [
-    ...aldenfell.sharedNotes.map((body) => ({ body, visibility: 'SHARED' })),
-    ...aldenfell.dmNotes.map((body) => ({ body, visibility: 'DM_ONLY' })),
-  ];
-  await db.note.createMany({
-    data: notes.map((n, i) => ({ ...n, campaignId, authorId: admin.id, createdAt: bookOrder(i) })),
-  });
-
-  console.log(`  Campaign: ${campaign.name} — invite code ${campaign.inviteCode}`);
-  console.log(
-    `  ${defaultWeapons.length} starting + ${aldenfell.weapons.length} earned weapons, ${aldenfell.items.length} items, ` +
-      `${spells.length} spells, ${aldenfell.locations.length} locations`,
-  );
-  console.log(
-    `  ${aldenfell.monsters.length} monsters, ${aldenfell.npcs.length} NPCs, ${aldenfell.encounters.length} encounters ` +
-      `(${rewardCount} rewards lined up), ${notes.length} notes`,
-  );
-}
-
-async function main() {
-  if (RESET) {
-    await resetDatabase();
+async function seed({ reset = false } = {}) {
+  if (reset) {
+    // Truncating the two roots cascades through every table that references them.
+    await prisma.$executeRawUnsafe('TRUNCATE TABLE "users", "campaigns" RESTART IDENTITY CASCADE');
     console.log('Database reset: every user and campaign was deleted.');
   }
 
-  let admin = await prisma.user.findUnique({ where: { email: ADMIN_EMAIL } });
-  if (admin) {
+  if (await prisma.user.findUnique({ where: { email: ADMIN_EMAIL } })) {
     console.log(`Admin account ${ADMIN_EMAIL} already exists — left as it is.`);
   } else {
-    admin = await prisma.user.create({
+    await prisma.user.create({
       data: { email: ADMIN_EMAIL, passwordHash: await bcrypt.hash(ADMIN_PASSWORD, 12), displayName: ADMIN_NAME },
     });
     console.log(`Admin/DM login created: ${ADMIN_EMAIL} / ${ADMIN_PASSWORD}`);
-    console.log('  Change that password from the account page (click your name, top right) once you are logged in.');
+    console.log('  Change that password from the account page ("Account" in the navigation) once you are logged in.');
   }
 
-  const existing = await prisma.campaign.findFirst({
-    where: { ownerId: admin.id, name: aldenfell.campaign.name, archivedAt: null },
-  });
-  if (existing) {
-    console.log(`${ADMIN_EMAIL} already has an active "${existing.name}" campaign — nothing added.`);
-    console.log('  For a fresh copy, archive or delete it under Campaign Settings and run the seed again.');
-    return;
+  const worlds = loadSeeds().filter((world) => !world.error);
+  if (worlds.length) {
+    console.log('Worlds to start a campaign from (Campaigns → New Campaign → world code):');
+    for (const { code, seed: world } of worlds) console.log(`  ${code}  ${world.campaign.name}`);
   }
-
-  // One transaction, so a failed seed doesn't leave half a campaign behind.
-  console.log('Seeding campaign...');
-  await prisma.$transaction((tx) => seedCampaign(tx, admin), { timeout: 120000, maxWait: 20000 });
-  console.log('Seed complete.');
 }
 
-main()
+seed({ reset: process.argv.includes('--reset') })
   .catch((err) => {
     console.error(err);
-    process.exit(1);
+    process.exitCode = 1;
   })
-  .finally(async () => {
-    await prisma.$disconnect();
-  });
+  .finally(() => prisma.$disconnect());

backend/scripts/check-seeds.js

@@ -0,0 +1,27 @@
+// Checks every world seed in /backend/seeds and says what each one holds, or
+// what is wrong with it. Run it after dropping in or editing a seed file:
+//
+//   npm run seeds:check
+const { loadSeeds, SEEDS_DIR } = require('../src/seeds');
+
+const results = loadSeeds();
+if (results.length === 0) console.log(`No seed files in ${SEEDS_DIR}.`);
+
+for (const { file, code, seed, error } of results) {
+  if (error) {
+    console.error(`✗ ${file}\n${error.replace(/^/gm, '    ')}`);
+    process.exitCode = 1;
+    continue;
+  }
+  const starting = (rows) => rows.filter((row) => row.isStartingOption).length;
+  const count = (rows, of) => rows.reduce((sum, row) => sum + (row[of] || []).length, 0);
+  console.log(`✓ ${file} — code ${code} — ${seed.campaign.name}`);
+  console.log(
+    `    ${seed.weapons.length} weapons (${starting(seed.weapons)} starting), ${seed.items.length} items (${starting(seed.items)} starting), ` +
+      `${seed.spells.length} spells (${starting(seed.spells)} starting), ${seed.locations.length} locations`,
+  );
+  console.log(
+    `    ${seed.monsters.length} monsters, ${seed.npcs.length} NPCs (${count(seed.npcs, 'wares')} wares), ${seed.encounters.length} encounters ` +
+      `(${count(seed.encounters, 'rewards')} rewards, ${count(seed.encounters, 'wares')} wares), ${seed.sharedNotes.length + seed.dmNotes.length} notes`,
+  );
+}

backend/scripts/generate-doc-lists.js

@@ -1,4 +1,4 @@
-// Writes the full lists (every library spell, weapon and monster, and every
+// Writes the full lists (every library spell, weapon, item and monster, and every
 // option the character builder offers) into the docs, straight from the data
 // files the app itself uses, so the docs cannot drift from the app.
 //
@@ -10,10 +10,12 @@
 // is written by hand.
 const fs = require('fs');
 const path = require('path');
-const { WEAPON_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY } = require('../src/game/data/library');
+const { WEAPON_LIBRARY, ITEM_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY } = require('../src/game/data/library');
 const options = require('../src/game/data/characterOptions');
 const { SPECIES } = require('../src/game/data/species');
 const { CLASSES } = require('../src/game/data/classes');
+const { BOONS, MAX_FEATURE_LEVEL } = require('../src/game/data/levelFeatures');
+const { featuresAt } = require('../src/game/levelUp');
 
 const DOCS = path.join(__dirname, '..', '..', 'docs');
 
@@ -49,8 +51,31 @@ function weaponLibrary() {
         ATTACK_WITH[w.attackAbility],
         w.properties.join(', '),
         w.rangeNormal ? `${w.rangeNormal}/${w.rangeLong} ft` : null,
+        [effectList(w.effects), w.effectNote].filter(Boolean).join('. ') || null,
       ]);
-      return `### ${category} (${weapons.length})\n\n${table(['Weapon', 'Base damage', 'Type', 'Attacks with', 'Properties', 'Range'], rows)}`;
+      return `### ${category} (${weapons.length})\n\n${table(['Weapon', 'Base damage', 'Type', 'Attacks with', 'Properties', 'Range', 'While equipped'], rows)}`;
+    })
+    .join('\n\n');
+}
+
+// "+6 AC, −10 Speed": what a library entry does while equipped.
+const STAT_NAMES = { AC: 'AC', SPEED: 'Speed', INITIATIVE: 'Initiative', MAX_HP: 'Max HP', PASSIVE_PERCEPTION: 'Passive Perception', SAVES: 'all saves', SKILLS: 'all skill checks' };
+const title = (key) => key.toLowerCase().split('_').map((w, i) => (i > 0 && w === 'of' ? w : w[0].toUpperCase() + w.slice(1))).join(' ');
+function statName(stat) {
+  if (STAT_NAMES[stat]) return STAT_NAMES[stat];
+  if (stat.startsWith('SAVE_')) return `${stat.slice(5)} saves`;
+  if (stat.startsWith('SKILL_')) return title(stat.slice(6));
+  return stat;
+}
+const effectList = (effects = []) => effects.map((e) => `${signed(e.amount).replace('-', '−')} ${statName(e.stat)}`).join(', ');
+
+function itemLibrary() {
+  const categories = [...new Set(ITEM_LIBRARY.map((i) => i.category))];
+  return categories
+    .map((category) => {
+      const items = ITEM_LIBRARY.filter((i) => i.category === category);
+      const rows = items.map((i) => [i.name, effectList(i.effects), i.effectNote, i.damageDice, i.description]);
+      return `### ${category} (${items.length})\n\n${table(['Item', 'While equipped', 'Note', 'Dice', 'Description'], rows)}`;
     })
     .join('\n\n');
 }
@@ -91,11 +116,32 @@ function builderLists() {
   ].join('\n\n');
 }
 
+// What "Level Up" writes for each class at each level, and the Boons.
+function levelFeatures() {
+  const line = (f) => (f.boon ? '**Boon** (choose one)' : `**${f.name}**${f.upgrade ? ' (replaces)' : ''}: ${f.text}`);
+  const classes = Object.keys(CLASSES)
+    .sort()
+    .map((key) => {
+      const rows = [];
+      for (let level = 2; level <= MAX_FEATURE_LEVEL; level++) {
+        const features = featuresAt(key, level);
+        rows.push([level, features.length > 0 ? features.map(line).join('<br>') : 'No new feature']);
+      }
+      return `### ${CLASSES[key].name}\n\n${table(['Level', 'Written into Special Abilities'], rows)}`;
+    });
+  const boons = table(
+    ['Boon', 'First time', 'Can be taken'],
+    BOONS.map((b) => [b.name, b.text(b.per), b.max === 1 ? 'Once' : `${b.max} times`])
+  );
+  return [`### Boons\n\n${boons}`, ...classes].join('\n\n');
+}
+
 const SECTIONS = {
   'SPELLS.md': { 'spell-library': spellLibrary },
   'WEAPONS.md': { 'weapon-library': weaponLibrary },
+  'ITEMS.md': { 'item-library': itemLibrary },
   'MONSTERS.md': { 'monster-library': monsterLibrary },
-  'CHARACTERS.md': { 'builder-lists': builderLists },
+  'CHARACTERS.md': { 'builder-lists': builderLists, 'level-features': levelFeatures },
 };
 
 for (const [file, sections] of Object.entries(SECTIONS)) {

backend/seeds/aldenfell.js

@@ -1,8 +1,9 @@
-// Aldenfell campaign content: the gazetteer, bestiary and notes are condensed
-// from the Aldenfell Campaign Book; the gear, item pool, NPC list and scenes
-// are built out from it to use everything a campaign can hold.
-// Consumed by prisma/seed.js. Shapes match the Prisma models minus ids, except
-// where a section's comment says otherwise.
+// Aldenfell: a world seed (docs/SEEDS.md). A DM starts a campaign from it by
+// entering its code.
+//
+// The gazetteer, bestiary and notes are condensed from the Aldenfell Campaign
+// Book; the gear, item pool, NPC list and scenes are built out from it to use
+// everything a campaign can hold.
 
 const campaign = {
   name: 'Aldenfell',
@@ -137,17 +138,30 @@ const monsters = [
     specialTrait: 'Keen hearing and smell — advantage on Perception checks that rely on them.',
     notes: 'Medium beast, 25 XP. Bite +3 (1d6+1 piercing, DC 11 Str or prone). A chapel mastiff gone half-wild in the Sunken Vaults’ Old Crypt Hall (Room 2). Starving, not vicious — DC 12 Animal Handling or a thrown ration ends the fight.',
   },
+  {
+    name: 'The Hollow King', challengeRating: '10', ac: 16, maxHp: 190, speed: 30,
+    strScore: 18, dexScore: 14, conScore: 18, intScore: 18, wisScore: 18, chaScore: 20, attackBonus: 9, damageDice: '4d8',
+    specialTrait: 'Many, not one — it is the will of everyone the founders sacrificed, so it cannot be charmed or frightened, and it speaks in several voices. Echoing dread — starting a turn within 30 ft: DC 16 Wis or frightened. What the Court remembers (recharge 5–6): each creature within 30 ft, DC 16 Wis or 6d6 psychic and lose its reaction (half on success).',
+    notes: 'A STARTING POINT, NOT THE BOOK’S: the Campaign Book gives no stat block for E26 and tells you to build one to your party’s level and the resources they brought. This one suits four level 7–8 characters; change the numbers freely. Fly 30 ft (hover). Multiattack (two Chilling Touch +9, 4d8 necrotic). Three legendary actions a round: move without provoking, one Chilling Touch, or (2 actions) pull a creature 20 ft toward the seal (DC 16 Str). The fight should never be only a sword fight — what the party does with the truth (E19, E22) matters more than its hit points.',
+  },
 ];
 
 // ---------------------------------------------------------------------------
-// Weapons the party earns. The everyday weapons (seed-data/weapons.json) are
-// seeded as starting options; these are not, so they only reach a character as
-// a reward or a gift. damageDice is the damage at minLevel, and a character
-// must be at least a held copy's level to use it. damageScaling: 1 standard,
-// 2 powerful, 3 legendary.
+// Weapons. The everyday ones are copies from the site library and are what a
+// new character picks from. The rest are not starting options, so they only
+// reach a character as a reward, a gift or a purchase. damageDice is the
+// damage at minLevel, and a character must be at least a held copy's level to
+// use it. damageScaling: 1 standard, 2 powerful, 3 legendary.
 // ---------------------------------------------------------------------------
 
+const everydayWeapons = [
+  'dagger', 'shortsword', 'rapier', 'longsword', 'greatsword', 'battleaxe', 'handaxe', 'warhammer', 'mace',
+  'quarterstaff', 'spear', 'shortbow', 'longbow', 'light-crossbow', 'dart',
+];
+
 const weapons = [
+  ...everydayWeapons.map((library) => ({ library, isStartingOption: true })),
+  { name: 'Unarmed Strike', damageDice: '1', damageType: 'bludgeoning', attackAbility: 'STR', properties: [], isStartingOption: true },
   { name: 'Masterwork Dagger', damageDice: '1d6', damageType: 'piercing', attackAbility: 'FINESSE', properties: ['finesse', 'light', 'thrown'], rangeNormal: 20, rangeLong: 60, minLevel: 2, damageScaling: 1 },
   { name: 'Smuggler’s Cutlass', damageDice: '1d8', damageType: 'slashing', attackAbility: 'FINESSE', properties: ['finesse'], rangeNormal: null, rangeLong: null, minLevel: 2, damageScaling: 1 },
   { name: 'Warden’s Longbow', damageDice: '1d10', damageType: 'piercing', attackAbility: 'DEX', properties: ['ammunition', 'heavy', 'two-handed'], rangeNormal: 150, rangeLong: 600, minLevel: 2, damageScaling: 2 },
@@ -159,38 +173,47 @@ const weapons = [
 ];
 
 // ---------------------------------------------------------------------------
-// Item pool. Items are descriptive: holding one never changes a number on the
-// sheet. `starting: true` offers the item in the character builder.
+// Item pool. Most items are descriptive. The ones with `effects` change the
+// sheet of whoever has them equipped (armor is an item with an AC effect), and
+// `effectNote` says what a number cannot. `isStartingOption: true` offers the
+// item in the character builder.
 // ---------------------------------------------------------------------------
 
 const items = [
   // Starting kit
-  { name: 'Potion of Healing', description: 'A red liquid that glimmers when shaken. Drink it (an action) to regain the hit points shown.', damageDice: '2d4+2', starting: true },
-  { name: 'Traveller’s Pack', description: 'Bedroll, mess kit, tinderbox, waterskin and five days of rations.', starting: true },
-  { name: 'Rope (50 ft)', description: 'Hempen rope. Holds a climber; DC 17 Strength to burst.', starting: true },
-  { name: 'Torches (bundle of 5)', description: 'Each burns for an hour: bright light for 20 feet, dim for 20 more.', starting: true },
-  { name: 'Healer’s Kit', description: 'Ten uses. Spend one to stabilise a creature at 0 hit points without a Medicine check.', starting: true },
-  { name: 'Thieves’ Tools', description: 'Picks, a small file and a mirror on a handle. Needed to pick a lock or disarm a trap.', starting: true },
-  { name: 'Shield', description: 'A wooden or steel shield, +2 Armor Class while carried. Ask the DM to add it to your armor bonus.', starting: true },
-  { name: 'Leather Armor', description: 'Boiled leather, Armor Class 11 + Dexterity. Ask the DM to set your armor bonus.', starting: true },
-  { name: 'Spellcasting Focus', description: 'A wand, holy symbol, crystal or carved staff that your spells are cast through.', starting: true },
-  { name: 'Founding Fair Token', description: 'A stamped brass token from the Lantern Market. Good for one drink at any stall, or a small favour from whoever ran the game you won it at.', starting: true },
+  { name: 'Potion of Healing', description: 'A red liquid that glimmers when shaken. Drink it (an action) to regain the hit points shown.', damageDice: '2d4+2', isStartingOption: true },
+  { name: 'Traveller’s Pack', description: 'Bedroll, mess kit, tinderbox, waterskin and five days of rations.', isStartingOption: true },
+  { name: 'Rope (50 ft)', description: 'Hempen rope. Holds a climber; DC 17 Strength to burst.', isStartingOption: true },
+  { name: 'Torches (bundle of 5)', description: 'Each burns for an hour: bright light for 20 feet, dim for 20 more.', isStartingOption: true },
+  { name: 'Healer’s Kit', description: 'Ten uses. Spend one to stabilise a creature at 0 hit points without a Medicine check.', isStartingOption: true },
+  { name: 'Thieves’ Tools', description: 'Picks, a small file and a mirror on a handle. Needed to pick a lock or disarm a trap.', isStartingOption: true },
+  { name: 'Shield', description: 'A wooden or steel shield carried on one arm.', isStartingOption: true, effects: [{ stat: 'AC', amount: 2 }], effectNote: 'Takes a hand: no two-handed weapon while it is up.' },
+  { name: 'Leather Armor', description: 'Boiled leather, light enough to sleep and sneak in.', isStartingOption: true, effects: [{ stat: 'AC', amount: 1 }] },
+  { name: 'Spellcasting Focus', description: 'A wand, holy symbol, crystal or carved staff that your spells are cast through.', isStartingOption: true },
+  { name: 'Founding Fair Token', description: 'A stamped brass token from the Lantern Market. Good for one drink at any stall, or a small favour from whoever ran the game you won it at.', isStartingOption: true },
 
   // Found and earned
   { name: 'Potion of Greater Healing', description: 'A deeper red than the common potion. Drink it (an action) to regain the hit points shown.', damageDice: '4d4+4', minLevel: 3 },
+  { library: 'studded-leather' },
+  { library: 'chain-shirt' },
+  { library: 'chain-mail' },
   { name: 'Alchemist’s Fire', description: 'A sticky flask that ignites in air. Throw it up to 20 feet: the target burns for the damage shown at the start of each of its turns until someone spends an action putting it out.', damageDice: '1d4' },
   { name: 'Silver Locket', description: 'A tarnished locket from the Old Crypt Hall, worth about 15 gp. The portrait inside has been scratched out.' },
   { name: 'Smugglers’ Ledger Page', description: 'A torn page from a crate in the Sunken Vaults, stamped with a merchant sigil nobody at the Concord Exchange recognises. Half a name survives in the margin.' },
   { name: 'Bell-Ringer’s Keepsake', description: 'A worn brass bell-clapper charm, pressed into your hand with more gratitude than its owner could put into words.' },
   { name: 'Grey Dawn Signet', description: 'An iron ring bearing the Order’s rising sun. Shown at Grey Dawn Hall or to any patrol, it marks you as someone the Order vouches for.' },
   { name: 'Concord Writ of Passage', description: 'A sealed Merchant Concord contract. Waives tolls and gate fees across Aldenfell while the Concord still considers you good for business.' },
-  { name: 'Warden’s Charm', description: 'A knot of greywood bark and red thread. The Wardens will know you by it, and the forest’s paths seem a little easier to find while you carry it.' },
+  { name: 'Warden’s Charm', description: 'A knot of greywood bark and red thread. The Wardens will know you by it, and the forest’s paths seem a little easier to find while you carry it.', effects: [{ stat: 'SKILL_SURVIVAL', amount: 1 }] },
   { name: 'Stonejaw Oath-Token', description: 'A river stone the size of a fist, carved with the Stonejaw clan mark. Proof that your word was tested and held.' },
   { name: 'Half-Burned Letter', description: 'Found among a missing person’s belongings in the Root. Most of it is ash. What is left mentions payments, a shrine, and a family crest.' },
   { name: 'Silver Shrine Relic', description: 'A small silver figure lifted from black water beneath the Greywood, worth about 75 gp. Its style is older than the kingdom.' },
   { name: 'Sealed Letter', description: 'Heavy paper, an unbroken wax seal, and a servant’s whispered warning about who must never know you have it.' },
   { name: 'Root-Fiber Scrap', description: 'A length of pale root that is still, very slightly, moving. It is cold, and it does not rot.' },
   { name: 'Seal-Stone Fragment', description: 'A shard of worked stone from the edge of the breach. Script runs along one face. It is warm, and holding it makes the bell script easier to look at.' },
+  { name: 'Seized House Documents', description: 'Ledgers and letters taken from the noble house after it was confronted. No value in coin; a great deal of value to anyone building a case.' },
+  { name: 'House Records', description: 'The fallen house’s private records: names, payments and meeting places for its contacts across Aldenfell.' },
+  { name: 'Masterwork Chain Mail', description: 'Close-linked mail from the Grey Dawn’s own armoury, fitted rather than issued.', minLevel: 5, effects: [{ stat: 'AC', amount: 7 }, { stat: 'SPEED', amount: -10 }], effectNote: 'Disadvantage on Stealth checks.' },
+  { name: 'The Seal-Stone', description: 'The stone at the heart of the seal, whole again and quiet. It is heavier than it looks, and it is never quite cold.', minLevel: 7, effects: [{ stat: 'SAVE_WIS', amount: 2 }], effectNote: 'Grows warm near anything of the Hollow Below. Its other properties are the DM’s to decide: something tied to binding, warding or detecting.' },
 ];
 
 // ---------------------------------------------------------------------------
@@ -200,7 +223,7 @@ const items = [
 // DM to teach later.
 // ---------------------------------------------------------------------------
 
-const spells = {
+const spellKeys = {
   starting: [
     'chill-touch', 'eldritch-blast', 'fire-bolt', 'guidance', 'light', 'mage-hand', 'minor-illusion',
     'prestidigitation', 'produce-flame', 'ray-of-frost', 'sacred-flame', 'shocking-grasp', 'spare-the-dying',
@@ -216,6 +239,11 @@ const spells = {
   ],
 };
 
+const spells = [
+  ...spellKeys.starting.map((library) => ({ library, isStartingOption: true })),
+  ...spellKeys.earned,
+];
+
 // ---------------------------------------------------------------------------
 // NPCs. `description` is what the party sees once the NPC is in a scene;
 // `dmNotes` never leaves the DM's screen. Combat stats only where a fight is
@@ -242,7 +270,17 @@ const npcs = [
   {
     name: 'Mireille Costa', role: 'Merchant Concord representative', disposition: 'NEUTRAL',
     description: 'Charming and transactional, usually found at the Concord Exchange with a contract already drafted. She always has a job, and she always pays what she promised.',
-    dmNotes: 'Source of paying side work (E4B → The Smugglers’ Tithe). The Concord is neutral and pragmatic, and drops anyone who becomes bad for business — including the party.',
+    dmNotes: 'Source of paying side work (E4B → The Smugglers’ Tithe). The Concord is neutral and pragmatic, and drops anyone who becomes bad for business — including the party. She also sells: Concord goods at Concord prices, in any scene she is in (DC 12 Persuasion to haggle, per the DM Tables).',
+    wares: [
+      { item: 'Potion of Healing', price: 50 },
+      { item: 'Potion of Greater Healing', price: 150 },
+      { item: 'Alchemist’s Fire', price: 50 },
+      { item: 'Healer’s Kit', price: 5 },
+      { item: 'Thieves’ Tools', price: 25 },
+      { item: 'Studded Leather', price: 45 },
+      { item: 'Chain Shirt', price: 50 },
+      { item: 'Chain Mail', price: 75 },
+    ],
   },
   {
     name: 'Ashwen', role: 'Warden of the Greywood', disposition: 'NEUTRAL',
@@ -300,7 +338,9 @@ const npcs = [
 // Encounters — pre-built (PLANNING) scenes for the beats of the Campaign Book,
 // in book order. BATTLE scenes run in initiative order; QUEST scenes are built
 // around NPCs and an objective.
-//   description — the scene, shown to every player who opens it: no spoilers.
+//   location    — a location's name: where the scene is. Its characters move
+//                 there when it begins.
+//   description — the scene, shown to the players in it: no spoilers.
 //   dmNotes     — DCs, branches and secrets, DM only.
 //   monsters    — [monster name, count, optional display name]; a count above
 //                 one gets "#n" suffixes.
@@ -309,37 +349,51 @@ const npcs = [
 //                 handed out. { gold } | { weapon } | { item }, with optional
 //                 quantity, level (defaults to the entry's starting level) and
 //                 note.
+//   wares       — for sale at the scene itself (a stall), as on an NPC:
+//                 { weapon | item, price, currency?, level?, stock? }.
 // ---------------------------------------------------------------------------
 
 const encounters = [
   {
-    name: 'E1 — The Founding Fair', mode: 'QUEST',
+    name: 'E1 — The Founding Fair', mode: 'QUEST', location: 'Highcrown — The Lantern Market',
     description: 'Highcrown’s Lantern Market at the height of the Founding Fair: lantern-strung stalls, contests of strength and skill, minstrels, and strangers from every corner of the kingdom. This is where you meet.',
     dmNotes: 'Character creation happens here (Roll-Your-Character System) — it can be the whole first half of session one. No combat. Let each PC win or lose something small at a stall, and introduce Mireille and Ser Kavan in passing so they are familiar faces by E4. Ends when the chapel bell fails to ring → E2.',
     npcs: ['Mireille Costa', 'Ser Kavan Thorne'],
+    // The market stalls: everyday kit at everyday prices.
+    wares: [
+      { item: 'Traveller’s Pack', price: 2 },
+      { item: 'Rope (50 ft)', price: 1 },
+      { item: 'Torches (bundle of 5)', price: 5, currency: 'COPPER' },
+      { item: 'Spellcasting Focus', price: 10 },
+      { item: 'Shield', price: 10 },
+      { item: 'Leather Armor', price: 10 },
+      { weapon: 'Dagger', price: 2 },
+      { weapon: 'Shortbow', price: 25 },
+      { weapon: 'Longsword', price: 15 },
+    ],
   },
   {
-    name: 'E2 — The Bell That Wasn’t Ringing', mode: 'QUEST',
+    name: 'E2 — The Bell That Wasn’t Ringing', mode: 'QUEST', location: 'Highcrown — The Founding Chapel',
     description: 'The Founding Chapel’s bell has rung every hour for as long as anyone remembers. It has stopped. A crowd is gathering outside, and someone is asking for volunteers to go in and look.',
     dmNotes: 'No break-in. The bell rope is neatly cut and left coiled; the bell-ringer is missing, not dead; a line of unfamiliar script is scratched inside the bell (Hollow King iconography). DC 13 Investigation finds the rope and script; DC 12 Persuasion/Insight gets the “woman who wasn’t blinking”.\n• E2A investigate immediately: full clues; skip Vault Room 1.\n• E2B distracted first: the guard missed the script; DC 13 Investigation to find it; start at Room 1.\n• E2C talk to the crowd first: three witness accounts, no script lead; E10 Insight later at advantage.\nThe trail leads to the cellar → E3.',
     npcs: ['Ser Kavan Thorne', 'A Frightened Local'],
   },
   {
-    name: 'E3 — Sunken Vaults: The Old Crypt Hall', mode: 'BATTLE',
+    name: 'E3 — Sunken Vaults: The Old Crypt Hall', mode: 'BATTLE', location: 'Hollow Below — The Sunken Vaults (Layer 1)',
     description: 'A long hall of burial niches beneath the chapel, some sealed, some broken open. Something is growling in the dark between the pillars.',
-    dmNotes: 'Vault Room 2, the hub (→ Rooms 3, 4, stair to 6). The dog is starving, not vicious: DC 12 Animal Handling or a thrown ration ends it. DC 13 Investigation: the open niches are just old theft. DC 12 Perception finds the locket.',
+    dmNotes: 'Vault Room 2, the hub (→ Rooms 3, 4, stair to 6). The dog is starving, not vicious: DC 12 Animal Handling or a thrown ration ends it. DC 13 Investigation: the open niches are just old theft. DC 12 Investigation spots the locket.',
     monsters: [['Feral Guard Dog', 1]],
-    rewards: [{ item: 'Silver Locket', note: 'Room 2 — DC 12 Perception' }],
+    rewards: [{ item: 'Silver Locket', note: 'Room 2 — DC 12 Investigation' }],
   },
   {
-    name: 'E3 — Sunken Vaults: The Restless Ossuary', mode: 'BATTLE',
+    name: 'E3 — Sunken Vaults: The Restless Ossuary', mode: 'BATTLE', location: 'Hollow Below — The Sunken Vaults (Layer 1)',
     description: 'Bones stacked floor to ceiling, and an offering box furred with dust. The air is still. Then it isn’t.',
     dmNotes: 'Vault Room 4, a dead end. One or two skeletons rise halfway through the room — ordinary restless dead, not tied to the Hollow King. DC 12 Religion: proper deconsecration would settle them without a fight. DC 13 to open the offering box.',
     monsters: [['Skeleton', 2]],
     rewards: [{ gold: 25, note: 'Offering box — DC 13 to open' }],
   },
   {
-    name: 'E3 — Sunken Vaults: The Bell-Ringer’s Refuge', mode: 'QUEST',
+    name: 'E3 — Sunken Vaults: The Bell-Ringer’s Refuge', mode: 'QUEST', location: 'Hollow Below — The Sunken Vaults (Layer 1)',
     description: 'A side chamber with a bedroll, a cold lantern, and a frightened old man who very much hopes you are who you look like.',
     dmNotes: 'Vault Room 5. The bell-ringer is alive but shaken: he saw “someone who looked like his neighbor, except wrong”. Getting him out is the win — the bell rings again, the fair goes on, nothing is solved.\nRoom 3 (Smugglers’ Cache) is on the way: DC 14 Investigation ties the crates’ sigil to a lender linked to the corrupted house.\nRoom 6 (The Descent) leads to the Root: wrong, cold air. Signal the tone shift; the party can always turn back. → E4.',
     npcs: ['The Bell-Ringer'],
@@ -358,6 +412,17 @@ const encounters = [
       { item: 'Concord Writ of Passage', note: 'E4B — on taking Mireille’s contract' },
     ],
   },
+  {
+    name: 'E5 — Omens Montage', mode: 'QUEST', location: 'Greywood — The Old Shrine Sites',
+    description: 'Small things, weeks apart. A farmer’s cattle gone dry overnight out past the shrine road. A stranger at the next table describing, detail for detail, the dream you had last night. None of it is an attack. All of it is wrong.',
+    dmNotes: 'Pure atmosphere, no treasure. Run two or three as short scenes spread across sessions, never back to back:\n• Livestock and crops failing near an old shrine.\n• Shared nightmares around Highcrown — DC 12 Insight for a PC to realise their own dream matched a stranger’s account.\n• A minor noble behaving with odd, unearned loyalty to no one in particular (the corrupted house — a background detail, not a spotlight).\nThe Drowned Shrine (Root Room 5) is a good place to point an omen at. → E6 whenever it feels earned.',
+  },
+  {
+    name: 'E7 — A Closer Look', mode: 'QUEST',
+    description: 'One noble house keeps turning up at the edge of things: generous, quiet, a little too pleased with itself. Asking after it gets polite answers and closed doors.',
+    dmNotes: 'If the party actively investigates the odd house from E5 they find only dead ends at this stage — by design. Stage 1 omens accumulate; they do not resolve.\nException: a party that took E2C makes a DC 13 Insight check (not 15) to catch one real thread — a servant who flinched at the mention of the house’s name. Note what they learn for E10.\n→ E8: once they have engaged with two or more E4 threads and one full E5 omen, advance the clock to Stage 2 and move to Act 2.',
+    npcs: ['King Aldric Veyrmont', 'Princess Isolde Veyrmont'],
+  },
   {
     name: 'E6 — The Bell-Ringer’s Debt: Collectors', mode: 'BATTLE',
     description: 'Three hard-faced men are waiting outside the bell-ringer’s door when you arrive. They are not here to hear him ring.',
@@ -370,14 +435,14 @@ const encounters = [
     ],
   },
   {
-    name: 'Side Quest — The Smugglers’ Tithe: Tidewatch', mode: 'QUEST',
+    name: 'Side Quest — The Smugglers’ Tithe: Tidewatch', mode: 'QUEST', location: 'Salt Coast — Tidewatch',
     description: 'Tidewatch, the Salt Coast’s largest port: proud, salt-stained, and suspicious of anyone asking questions. Someone is skimming the town’s quiet trade, and the Concord wants to know who.',
     dmNotes: 'Lv 1–3. Mireille hires the party to learn why a cut of Tidewatch’s smuggled goods vanishes before reaching buyers. TRUTH: a Bandit Captain is extorting the smugglers and funnelling the “tithe” to arm one side of the Bramble Marches conflict. Smugglers distrust outsiders. Track a shipment to Smuggler’s Cove → next scene.\nOutcome decides whether Greyford is supplied at E11/E16.',
     npcs: ['Mireille Costa'],
     rewards: [{ gold: 100, note: 'Mireille’s fee — paid in full if it ends quietly' }],
   },
   {
-    name: 'Side Quest — The Smugglers’ Tithe: Smuggler’s Cove', mode: 'BATTLE',
+    name: 'Side Quest — The Smugglers’ Tithe: Smuggler’s Cove', mode: 'BATTLE', location: 'Salt Coast — Smuggler’s Cove',
     description: 'A hidden inlet south of Tidewatch. Lanterns hooded, a longboat drawn up on the shingle, and a crew that was not expecting company.',
     dmNotes: 'Fight, negotiate, or both. The Captain leads from the front (multiattack) and bolts for the boat below half HP. End it quietly (Mireille pays well) or expose where the tithe was headed (pulls the Marches plot forward).',
     monsters: [['Bandit Captain', 1], ['Highcrown Cutthroat', 4]],
@@ -387,13 +452,13 @@ const encounters = [
     ],
   },
   {
-    name: 'Side Quest — The Warden’s Silence: Direwolf Pack', mode: 'BATTLE',
+    name: 'Side Quest — The Warden’s Silence: Direwolf Pack', mode: 'BATTLE', location: 'Greywood — The Old Shrine Sites',
     description: 'The trail to the shrine runs through old growth where the light barely reaches the ground. The forest has gone quiet, and there are eyes between the trees.',
     dmNotes: 'Lv 1–2. The pack is agitated by the shrine, not evil — DC 13 Animal Handling or Nature to back away without a fight. Pack tactics make three wolves the clearest action-economy lesson for a new table.',
     monsters: [['Greywood Direwolf', 3]],
   },
   {
-    name: 'Side Quest — The Warden’s Silence: The Shrine', mode: 'BATTLE',
+    name: 'Side Quest — The Warden’s Silence: The Shrine', mode: 'BATTLE', location: 'Greywood — The Old Shrine Sites',
     description: 'A mossed-over shrine older than the kingdom, split by a crack you could lose an arm in. The missing Warden is standing in front of it. She turns and greets you by name.',
     dmNotes: 'HORROR register — signal it. The Warden was Hollowed after investigating the crack alone: the party’s first, sympathetic Hollowed. DC 15 Insight notices the wrongness (no blink, a repeated phrase) before it acts. Fight, restrain and bring back to Ashwen (hard questions), or it escapes to report back. Either way Ashwen is convinced.',
     monsters: [['Hollowed', 1, 'The Missing Warden']],
@@ -403,7 +468,7 @@ const encounters = [
     ],
   },
   {
-    name: 'Side Quest — Trial of Stone', mode: 'QUEST',
+    name: 'Side Quest — Trial of Stone', mode: 'QUEST', location: 'The Spine — Stonejaw Hold',
     description: 'Stonejaw Hold, a giant clan’s valley in the Spine foothills. The chieftain has heard you out. He does not offer agreement. He offers a trial.',
     dmNotes: 'Lv 2–4. A genuine test of character, nothing sinister. Trials (per PC or shared): non-lethal wrestling with a giant (the Hill Giant here — HP is a “pin” clock, nobody dies); a test of honesty; proving their word is good (retrieve something, deliver a message honestly). Beats: arrive → formal challenge → trial → feast.\nSuccess = standing alliance (Spine Clans track, unlocks E9D and E11C). Failure is not fatal: Korgath offers a second, harder trial.',
     monsters: [['Stonejaw Hill Giant', 1, 'Stonejaw Champion']],
@@ -414,7 +479,7 @@ const encounters = [
     ],
   },
   {
-    name: 'Side Quest — Refugees of the Marches', mode: 'QUEST',
+    name: 'Side Quest — Refugees of the Marches', mode: 'QUEST', location: 'Bramble Marches — The Sorrow Camp',
     description: 'The Sorrow Camp: hundreds of people under canvas just inside the border, and a garrison at Greyford Keep that wants them gone. Food sent for the camp is not all arriving.',
     dmNotes: 'Lv 2–4, the clearest moral-choice quest. No clean villain: the commander is not wrong about the strategic liability, and the refugees have nowhere else to go. Beats: tension between camp and garrison → find who is skimming aid (the Captain’s crew) → confront them → broker, or fail to broker, an arrangement.\nIntroduce a named refugee NPC here — they are at risk at E16B.',
     monsters: [['Bandit Captain', 1, 'Aid-Skimmer Boss'], ['Highcrown Cutthroat', 2]],
@@ -422,7 +487,7 @@ const encounters = [
     rewards: [{ gold: 50, note: 'Recovered aid money — keeping it is a choice the camp will notice' }],
   },
   {
-    name: 'Side Quest — What the Tide Brought In: The Reef', mode: 'BATTLE',
+    name: 'Side Quest — What the Tide Brought In: The Reef', mode: 'BATTLE', location: 'Salt Coast — Tidewatch',
     description: 'A fishing boat washed up empty this morning: sails intact, catch in the hold, crew gone. The fishers will point out the reef. None of them will row you there.',
     dmNotes: 'Lv 2–3, horror-lite. NOT connected to the Hollow King — a deliberate palate-cleanser. DC 13 Investigation on the boat finds claw marks, not violence. Confront it at sea (it swims, the party does not) or lure it to the shallows. Outcome: safe fishing reopens and real goodwill in Tidewatch.',
     monsters: [['Reef Terror', 1]],
@@ -432,21 +497,38 @@ const encounters = [
     ],
   },
   {
-    name: 'Audience — Threndir’s Eyrie', mode: 'QUEST',
+    name: 'Audience — Threndir’s Eyrie', mode: 'QUEST', location: 'The Spine — Threndir’s Eyrie',
     description: 'A hard climb above the snow line, and a cave mouth wide enough to sail a ship into. The dragon inside already knows you are here. He has not moved, and he has not told you to leave.',
     dmNotes: 'A negotiation, not a fight: Threndir wants proof the crown can still be trusted (Persuasion DC 15–18; real evidence from E10 lowers it). He talks first unless attacked. If it goes wrong, add the “Threndir Ashclaw (old copper dragon)” monster to this scene — and remember he is far beyond a low-level party.',
     npcs: ['Threndir Ashclaw'],
     rewards: [{ weapon: 'Threndir’s Fang', note: 'A shed tooth, set in a hilt — given only if he comes to respect them' }],
   },
   {
-    name: 'E9 — The Root: Weeping Passage', mode: 'BATTLE',
+    name: 'The Spine — Wyvern Pass', mode: 'BATTLE', location: 'The Spine — Ironvein',
+    description: 'The pass above Ironvein narrows to a ledge, and the ledge runs under a shelf of rock streaked white with droppings. Something large shifts up there and looks down at you.',
+    dmNotes: 'Optional travel encounter (Random Encounters, the Spine). Territorial, not evil: it attacks anything that lingers near the nest and ignores a party that keeps moving — DC 13 Stealth or Survival to pass without a fight. Stinger: DC 15 Con or poisoned for a minute. Ironvein below is the resupply stop, with its own rumours (miners going quiet, deeper tunnels avoided).',
+    monsters: [['Spine Wyvern', 1]],
+  },
+  {
+    name: 'The Spine — Sevrisk’s Hollow', mode: 'BATTLE', location: 'The Spine — Sevrisk’s Hollow',
+    description: 'A low, wet cave mouth breathing green-tinged mist. The bones outside it have been arranged, not dropped. From inside comes a voice like a blade being drawn: slow, amused, and very sure of itself.',
+    dmNotes: 'Optional, and dangerous: Sevrisk is the straightforward dragon fight, in contrast to Threndir. Territorial and opportunistic — she will bargain only to gain an edge, and breaks a bargain the moment it stops paying. Poison breath (recharge 5–6): 30-ft cone, DC 14 Con, 8d6. CR 5: too much for a party below level 4 without help or a plan. Her hoard is the treasure.',
+    monsters: [['Sevrisk (young green dragon)', 1, 'Sevrisk']],
+    rewards: [
+      { gold: 400, note: 'Sevrisk’s hoard — coin and plate' },
+      { item: 'Potion of Greater Healing', quantity: 2, note: 'In the hoard' },
+      { weapon: 'Grey Dawn Longsword', note: 'In the hoard — a knight came here once and did not leave' },
+    ],
+  },
+  {
+    name: 'E9 — The Root: Weeping Passage', mode: 'BATTLE', location: 'Hollow Below — The Weeping Passage',
     description: 'A long tunnel beneath the Greywood where the walls weep, and the sound they make is almost a voice. Somewhere ahead, very faintly, a bell tolls.',
     dmNotes: 'HORROR register — signal the tone shift. Root Room 2. DC 14 Survival: the dripping is a Hollowed’s footsteps. The Bellcrawler uses Stillness (DC 17 Perception to spot) and mimics the bell to lure the curious.\n• E9A retreat: keep what they learned, full rest before re-entry.\n• E9B push through: the marking here matches the bell script (DC 16 Arcana/Religion).\n• E9C (took E4A): Ressa Vane escorts and reports back — remove her from the scene otherwise.\n• E9D (won Trial of Stone): a Spine guide enters via Room 4.',
     monsters: [['Bellcrawler', 1]],
     npcs: ['Corporal Ressa Vane'],
   },
   {
-    name: 'E9 — The Root: Hollowed Nest', mode: 'BATTLE',
+    name: 'E9 — The Root: Hollowed Nest', mode: 'BATTLE', location: 'Hollow Below — The Root (Layer 2)',
     description: 'A cavern kept unnervingly tidy: bedrolls squared away, boots in a row. Two people sit facing the wall. They stand when you enter, and smile at exactly the same moment.',
     dmNotes: 'Root Room 3. DC 15 Insight before combat. Consider making one a named missing person. Slam hits force DC 12 Wis or frightened for a round; each can whisper one sentence in Vessa’s voice. The letter (DC 14) hints at the corrupted house.',
     monsters: [['Hollowed', 2]],
@@ -456,7 +538,7 @@ const encounters = [
     ],
   },
   {
-    name: 'E9 — The Root: Root Stalker’s Warren', mode: 'BATTLE',
+    name: 'E9 — The Root: Root Stalker’s Warren', mode: 'BATTLE', location: 'Hollow Below — The Root (Layer 2)',
     description: 'The roots in this chamber are as thick as a man’s waist, and they are not growing from anything. One of them shifts when your light touches it.',
     dmNotes: 'Root Room 4, a dead end (optional secret passage to Room 6). DC 14 Perception or its first attack has advantage. Run it as a slow, dreadful stalk: tremorsense, burrow, grasping roots (restrained, DC 14 Str). E9D: DC 13 Survival or it wakes at the entrance.',
     monsters: [['Root Stalker', 1]],
@@ -466,24 +548,33 @@ const encounters = [
     ],
   },
   {
-    name: 'E9 — The Root: Bellcrawler Gallery', mode: 'BATTLE',
+    name: 'E9 — The Root: The Drowned Shrine', mode: 'QUEST', location: 'Hollow Below — The Root (Layer 2)',
+    description: 'A shrine older than anything in the vaults above, half sunk in still black water. The altar is whole. The symbol carved into it belongs to no faith anyone above has practised in a very long time.',
+    dmNotes: 'Root Room 5. A pre-kingdom holy site, connected to the Sunken Library in the Greywood. DC 16 History or Religion: the symbol is older than Aldenfell itself — a thread toward the Hollow King’s origin, without the full truth. A good place for a vision or omen (E5 can point here).\nThe relic: DC 13 Athletics or Investigation to lift it without disturbing the water. Disturbing it summons nothing, only ripples that spread wrong. Exits: back to Room 2, or a narrow crawl to Room 6.',
+    rewards: [{ item: 'Silver Shrine Relic', note: 'In the water — DC 13 Athletics or Investigation' }],
+  },
+  {
+    name: 'E9 — The Root: Bellcrawler Gallery', mode: 'BATTLE', location: 'Hollow Below — The Root (Layer 2)',
     description: 'Narrow ledges over a drop your torch cannot find the bottom of. From three different directions at once, a bell begins to toll.',
     dmNotes: 'Root Room 6. DC 15 Perception to place them; DC 13 Dex on the ledges or fall 2d6. They skitter (bonus-action disengage) and freeze when watched — stealth and dread, not a straight fight. → Room 7, the stair to the Hollow Court: let them see it and turn back.',
     monsters: [['Bellcrawler', 3]],
     rewards: [
       { gold: 90, note: 'Scattered along the ledges' },
-      { item: 'Potion of Healing', note: 'In a fallen pack' },
+      { item: 'Potion of Healing', note: 'In a fallen pack — the book has the coin or the potion, DM’s choice' },
     ],
   },
   {
-    name: 'E10 — The House Unmasked', mode: 'QUEST',
+    name: 'E10 — The House Unmasked', mode: 'QUEST', location: 'Highcrown — The Palace of Aldenfell',
     description: 'Back in Highcrown with a name, a ledger, and a question nobody at court wants asked out loud: what do you do with it?',
     dmNotes: 'The ledger: every shrine “donation” falls three days after a livestock death.\n• E10A confront the house directly: DC 16 Persuasion/Intimidation with proof, DC 20 without.\n• E10B report to the crown, Isolde or Kavan: sets up Act 3 politics; if E9C, Kavan already suspected (trust bump).\n• E10C (E2C + the servant thread): private DC 13 check at advantage → confession and the sealed letter; the house never learns it is suspected. Best route into Act 3.',
     npcs: ['Princess Isolde Veyrmont', 'Ser Kavan Thorne'],
-    rewards: [{ item: 'Sealed Letter', note: 'E10C only' }],
+    rewards: [
+      { item: 'Sealed Letter', note: 'E10C only — the servant’s evidence' },
+      { item: 'Seized House Documents', note: 'E10A only — taken at the confrontation' },
+    ],
   },
   {
-    name: 'E11 — Silence on the Border', mode: 'QUEST',
+    name: 'E11 — Silence on the Border', mode: 'QUEST', location: 'Bramble Marches — Greyford Keep',
     description: 'Greyford Keep. The gate stands open. No smoke from the chimneys, no one on the walls, no bodies. A kettle is still warm on a guardroom stove.',
     dmNotes: 'DC 13 Perception: drag marks — the defenders left. The Smugglers’ Tithe outcome decides rescue vs recovery. E11C (Spine allied): the clans are already here and share Root Stalker migration intel. Remove the Commander from the scene if this is a recovery.',
     npcs: ['Greyford’s Commander'],
@@ -506,6 +597,27 @@ const encounters = [
     monsters: [['Hollowed', 4]],
     rewards: [{ item: 'Seal-Stone Fragment', note: 'Key item — from the breach’s edge' }],
   },
+  {
+    name: 'E15 — The House Falls (or Doesn’t)', mode: 'BATTLE',
+    description: 'Word travels faster than truth in Highcrown. By the time you reach the house, half the city already has an opinion about what happened there — and most of them are wrong.',
+    dmNotes: 'Plays very differently by Act 2 route.\n• E15A (took E10A): the house has spent Act 2 preparing — hired guards, an alibi, perhaps a scapegoat servant. DC 18 to break the cover story, or this fight: house guards and one Hollowed-touched retainer.\n• E15B (took E10B): a tense public tribunal, no fight. DC 16 Persuasion or Insight steers it toward exile rather than execution (matters for a returning villain).\n• E15C (took E10C): the house suspects nothing. Move on its masters — the cult in Highcrown. Only this route reaches E15C-1: a cult lieutenant taken alive, who gives up the Hollow Court’s surface entrance (→ E18B).\nRemove the monsters for E15B and E15C. → E16.',
+    monsters: [['Bandit Captain', 2, 'House Guard Sergeant'], ['Highcrown Cutthroat', 4, 'House Guard'], ['Hollowed', 1, 'The Retainer']],
+    npcs: ['Princess Isolde Veyrmont', 'Ser Kavan Thorne'],
+    rewards: [{ item: 'House Records', note: 'Names other cult contacts across Aldenfell — seeds for a side quest, or safely ignored' }],
+  },
+  {
+    name: 'E16 — What the Marches Cost', mode: 'QUEST', location: 'Bramble Marches — Greyford Keep',
+    description: 'Smoke on the horizon means something different out here than it does in Highcrown. Out here, it usually means someone made a choice that can’t be unmade.',
+    dmNotes: 'The consequences of E11. No loot: this is about consequence.\n• E16A — Greyford was reinforced (E11C, Spine Clans allied): the keep holds. A rare unambiguous good outcome; let them feel it. Spine Clan standing rises.\n• E16B — Greyford was under-supplied (Smugglers’ Tithe unresolved): the keep falls or is abandoned for good. The named refugee from Refugees of the Marches is lost unless the party steps in — DC 16 Athletics or Survival chase and rescue.\n→ E17 (pay off any debt the party has run up: the E14A weakening, an unresolved side quest, unchased omens — or a quiet breather with the bell-ringer) → E18.',
+    npcs: ['Greyford’s Commander'],
+  },
+  {
+    name: 'E18 — Into the Hollow Court', mode: 'BATTLE', location: 'Hollow Below — The Hollow Court (Layer 3)',
+    description: 'The stair doesn’t so much end as stop pretending to be a stair. What’s beneath Aldenfell was never built — it grew, the way a wound grows scar tissue, except the scar tissue is watching you.',
+    dmNotes: 'Hollow Court Rooms 1–3. E18A enters by the Bent Stair; E18B (cult lieutenant from E15C-1) skips straight to the Memory Pool.\n• Room 1, The Bent Stair: DC 15 Wis save or lose track of how long the descent took (atmosphere, or 10 minutes lost). No monster.\n• Room 2, The Memory Pool: each PC who looks sees a vision tied to a choice they made — the payoff for the branch points. No damage; DC 17 Insight to understand it.\n• Room 3, The Court of Whispers: Vessa may speak plainly here. DC 16 Insight: she believes what she says. If it comes to a fight it is with these Hollowed guardians, never with her — remove them if the party talks.\n→ E19.',
+    monsters: [['Hollowed', 4, 'Hollowed Guardian']],
+    npcs: ['Vessa Hollow'],
+  },
   {
     name: 'Mid-campaign scare — The Hollow King’s Shadow', mode: 'BATTLE',
     description: 'The light goes thin and the air goes cold. Something tall is standing where the wall should be, and the wall does not seem to mind.',
@@ -513,7 +625,7 @@ const encounters = [
     monsters: [['The Hollow King’s Shadow', 1]],
   },
   {
-    name: 'E19 — Vessa’s Seat', mode: 'QUEST',
+    name: 'E19 — Vessa’s Seat', mode: 'QUEST', location: 'Hollow Below — The Hollow Court (Layer 3)',
     description: 'A single worn stone seat at the heart of the Hollow Court, and a woman who has been expecting you. She asks you to sit. She says she would like to explain.',
     dmNotes: 'Court Room 4. The party learns the Hollow King’s true nature from Vessa: the imprisoned will of everyone the founders sacrificed — a suppression of many, not a prison for one. DC 16 Insight: she believes what she says. A strong candidate for a negotiated outcome.\nRoot-fiber + seal-stone (DC 15 Arcana, automatic with a Religion-proficient caster) → advantage on the first check at E22. Then E20: the clock turns to Stage 4.',
     npcs: ['Vessa Hollow'],
@@ -523,21 +635,40 @@ const encounters = [
     description: 'One last gathering before the descent. Whoever is going to stand with you is here now — and they do not all agree about what happens next.',
     dmNotes: 'Who shows up depends on the branch list — remove anyone the party lost or alienated.\n• E21A Grey Dawn track: Kavan and his wardens, by the book.\n• E21B Spine Clans track: Korgath’s war-band; advantage on the first Survival check at E22.\n• E21C Independent: no reinforcements; every choice stays theirs.\n• Several tracks: the groups arrive and disagree — the party mediates.',
     npcs: ['Princess Isolde Veyrmont', 'Ser Kavan Thorne', 'Korgath Stonejaw', 'Ashwen'],
-    rewards: [{ item: 'Potion of Greater Healing', quantity: 2, note: 'Going-away gift from whoever stands with them' }],
+    rewards: [
+      { item: 'Potion of Greater Healing', quantity: 2, note: 'Going-away gift from whoever stands with them' },
+      { item: 'Masterwork Chain Mail', note: 'E21A — from the Grey Dawn armoury, if the Order stands with them' },
+    ],
   },
   {
-    name: 'E22 — The Seal Chamber', mode: 'QUEST',
+    name: 'E22 — The Seal Chamber', mode: 'QUEST', location: 'Hollow Below — The Hollow Court (Layer 3)',
     description: 'A wound in the world, stitched shut long ago, and coming undone one thread at a time. Whatever you came here to decide, this is where you decide it.',
     dmNotes: 'Court Room 5 — the key branch. DC 18 Arcana/Religion reveals the seal is a suppression of many. Optional DC 14 Wis saves vs disorientation.\n• E22A reinforce (DC 18 Arcana/Religion): the Sealed Ending — time bought.\n• E22B break it deliberately: E23 on the party’s terms — the only path to true victory.\n• E22C do nothing: the seal fails anyway; E24–E25 are harder.\nHollowbane is the campaign’s single most significant magic item: legendary growth, starts at level 7.',
     npcs: ['Vessa Hollow'],
-    rewards: [{ weapon: 'Hollowbane', note: 'Drawn from the seal itself' }],
+    rewards: [
+      { weapon: 'Hollowbane', note: 'Drawn from the seal itself — the campaign’s one significant magic item' },
+      { item: 'The Seal-Stone', note: 'E22A only — the seal, reinforced rather than broken' },
+    ],
   },
   {
-    name: 'E25 — The Last Approach', mode: 'BATTLE',
+    name: 'E25 — The Last Approach', mode: 'BATTLE', location: 'Hollow Below — The Hollow Court (Layer 3)',
     description: 'The final stretch of the Hollow Court, where gravity, light and memory have all stopped agreeing with one another. The things that live here know you are coming.',
     dmNotes: 'A gauntlet of horror-register creatures; whichever faction the party rallied fights alongside them (add those NPCs). Grey Dawn = a disciplined line; Spine Clans = terrain and ritual (collapse passages); Independent = hardest, and entirely theirs. → E26, the Hollow King: build that stat block from DM Secrets, scaled to the party.',
     monsters: [['Root Stalker', 1], ['Bellcrawler', 2]],
   },
+  {
+    name: 'E23–E24 — The Waking', mode: 'QUEST', location: 'Hollow Below — The Hollow Court (Layer 3)',
+    description: 'The Waking isn’t loud. That’s the wrong word for it. It’s the sound of something enormous remembering it has a name.',
+    dmNotes: 'Hollow Court Room 6. The seal gives way, one way or another.\n• Broke it deliberately (E22B): the party arrives prepared, on their own timing — full resources, no surprise round against them.\n• It failed on its own (E22C): the Hollow King is already partly awake — apply one stage of escalation before the party acts, and E25–E26 are noticeably harder.\nE24, What the Court Remembers: not combat. Its memories bleed into the room, fragments of who it was before. DC 14 Insight recognises a fragment as manipulation rather than truth — it is recruiting sympathy, not confessing. → E25.',
+    npcs: ['Vessa Hollow'],
+  },
+  {
+    name: 'E26 — The Hollow King', mode: 'BATTLE', location: 'Hollow Below — The Hollow Court (Layer 3)',
+    description: 'There is no throne and no crown. There is a shape made of everyone who was put down here, and it has finally turned to look at you.',
+    dmNotes: 'The final confrontation. The book gives no stat block — it asks you to build one to the party’s level and what they brought. The “The Hollow King” monster here is a starting point for four level 7–8 characters: change it.\nThree shapes:\n• Grey Dawn track — disciplined tactics: Kavan’s wardens hold a line while the party lands the killing blow. Add Ser Kavan Thorne.\n• Spine Clans track — terrain and ritual: collapsing passages, the Memory Pool as a weapon. Add Korgath Stonejaw.\n• Independent — hardest: no reinforcements, and every choice in the last round is theirs.\nNegotiating through Vessa is a legitimate ending. → E27, Endings: Sealed, Grey Dawn, Spine Clans or Independent — and close where it opened, at the Lantern Market a year later.',
+    monsters: [['The Hollow King', 1]],
+    npcs: ['Vessa Hollow'],
+  },
 ];
 
 // ---------------------------------------------------------------------------
@@ -801,4 +932,4 @@ The Salt Coast: 1 smugglers wary of witnesses · 2 short-handed fishing crew ·
 The Bramble Marches: 1 Bandit Captain’s crew · 2 refugees on the road · 3 tense border patrol · 4 signs of the neighboring power · 5 a skirmish in progress · 6 watchful quiet.`,
 ];
 
-module.exports = { campaign, locations, monsters, weapons, items, spells, npcs, encounters, sharedNotes, dmNotes };
+module.exports = { code: 'ALDENF', campaign, locations, monsters, weapons, items, spells, npcs, encounters, sharedNotes, dmNotes };

backend/src/app.js

@@ -1,5 +1,6 @@
 const express = require('express');
 const cors = require('cors');
+const compression = require('compression');
 
 const authRoutes = require('./routes/auth.routes');
 const campaignsRoutes = require('./routes/campaigns.routes');
@@ -10,7 +11,13 @@ const notesRoutes = require('./routes/notes.routes');
 function createApp() {
   const app = express();
 
-  app.use(cors({ origin: process.env.CORS_ORIGIN || 'http://localhost:5173' }));
+  // The site and the API are on different hosts, so a browser asks leave
+  // before each kind of request. maxAge lets it remember the answer (browsers
+  // cap it at two hours) and not ask again every time.
+  app.use(cors({ origin: process.env.CORS_ORIGIN || 'http://localhost:5173', maxAge: 7200 }));
+  // Nothing in front of the API compresses for it (frp only tunnels), so the
+  // JSON is gzipped here.
+  app.use(compression());
   app.use(express.json());
 
   app.get('/health', (req, res) => res.json({ ok: true }));

backend/src/db.js

@@ -1,5 +1,10 @@
+// Prisma no longer reads .env itself, and this is the first thing to need it.
+require('dotenv').config({ quiet: true });
 const { PrismaClient } = require('@prisma/client');
+const { PrismaPg } = require('@prisma/adapter-pg');
 
-const prisma = new PrismaClient();
+const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL }),
+});
 
 module.exports = prisma;

backend/src/game/calculations.js

@@ -5,6 +5,7 @@
 const { SPECIES } = require('./data/species');
 const { CLASSES } = require('./data/classes');
 const { SKILLS } = require('./data/skills');
+const { FULL_CASTER_SLOTS, HALF_CASTER_SLOTS, PACT_SLOTS, CASTER_KIND, MAX_SLOT_LEVEL } = require('./data/spellSlots');
 
 const ABILITIES = ['STR', 'DEX', 'CON', 'INT', 'WIS', 'CHA'];
 
@@ -121,12 +122,114 @@ function getClassSpellcastingAbility(characterClass) {
   return data ? data.spellcastingAbility : null;
 }
 
+// ---------------------------------------------------------------------------
+// Spell slots and Hit Dice: what a character has to spend between rests.
+// ---------------------------------------------------------------------------
+
+const MAX_LEVEL = 20;
+
+function clampLevel(level) {
+  return Math.min(Math.max(Math.round(Number(level) || 1), 1), MAX_LEVEL);
+}
+
+// How many spell slots a class has at a level, by slot level (1st first), and
+// which rest gives them back. Null for a class that never has any. A warlock's
+// slots are all of one slot level, so the lower ones are 0.
+function spellSlotsFor(characterClass, level) {
+  const kind = CASTER_KIND[characterClass];
+  if (!kind) return null;
+  const row = clampLevel(level) - 1;
+  if (kind === 'PACT') {
+    const [count, slotLevel] = PACT_SLOTS[row];
+    return { kind, restoresOn: 'SHORT', max: Array.from({ length: slotLevel }, (_, i) => (i === slotLevel - 1 ? count : 0)) };
+  }
+  return { kind, restoresOn: 'LONG', max: [...(kind === 'FULL' ? FULL_CASTER_SLOTS : HALF_CASTER_SLOTS)[row]] };
+}
+
+// The slot tracker: for each slot level the character has, how many slots
+// there are and how many are spent. `used` is the stored tally (1st-level
+// first), which may be shorter than the class's row or hold more than it now
+// allows. Null when there are no slots to track (not a caster, or a level 1
+// paladin).
+function spellSlotState(characterClass, level, used = []) {
+  const slots = spellSlotsFor(characterClass, level);
+  if (!slots) return null;
+  const levels = slots.max
+    .map((max, i) => {
+      const spent = Math.min(Math.max(Number((used || [])[i]) || 0, 0), max);
+      return { level: i + 1, max, used: spent, remaining: max - spent };
+    })
+    .filter((slot) => slot.max > 0);
+  return levels.length > 0 ? { kind: slots.kind, restoresOn: slots.restoresOn, levels } : null;
+}
+
+// The highest level of spell a class can cast at a level; 0 for none.
+function maxSpellLevel(characterClass, level) {
+  const slots = spellSlotsFor(characterClass, level);
+  return slots ? slots.max.length : 0;
+}
+
+// One Hit Die per level, of the class's size. Spent ones come back on a long rest.
+function hitDiceState(characterClass, level, used = 0) {
+  const count = clampLevel(level);
+  const spent = Math.min(Math.max(Number(used) || 0, 0), count);
+  return { size: getClassHitDieSize(characterClass), count, used: spent, remaining: count - spent };
+}
+
+// ---------------------------------------------------------------------------
+// Gear effects (house rule). A weapon or item in the campaign pools can carry
+// effects: signed amounts added to one of the numbers on the sheet. They count
+// while a character has the thing equipped and is high enough level to use it;
+// holding two of something does not double it.
+// ---------------------------------------------------------------------------
+
+// What an effect can change. An ability effect changes the score itself, so
+// everything worked out from that ability moves with it.
+const GEAR_STATS = [
+  'AC',
+  'SPEED',
+  'INITIATIVE',
+  'MAX_HP',
+  'PASSIVE_PERCEPTION',
+  ...ABILITIES,
+  'SAVES', // every saving throw
+  ...ABILITIES.map((ability) => `SAVE_${ability}`),
+  'SKILLS', // every skill check
+  ...Object.keys(SKILLS).map((skill) => `SKILL_${skill}`),
+];
+
+// The effects in force for a character, each with the name of what gives it:
+// [{ stat, amount, source }]. Takes a character with `inventoryItems` (each
+// with its item) and `weapons` (each with its weapon) loaded; without them
+// there are none. `notes` are the things gear does that are not a number.
+function activeGear(character) {
+  const level = character.level || 1;
+  const held = [
+    ...(character.inventoryItems || []).map((ii) => ({ ...ii, entry: ii.item })),
+    ...(character.weapons || []).map((cw) => ({ ...cw, entry: cw.weapon })),
+  ].filter((h) => h.entry && h.equipped && canUseGear(level, h.level));
+
+  const effects = [];
+  const notes = [];
+  for (const { entry } of held) {
+    for (const effect of Array.isArray(entry.effects) ? entry.effects : []) {
+      if (GEAR_STATS.includes(effect.stat) && Number.isInteger(effect.amount) && effect.amount !== 0) {
+        effects.push({ stat: effect.stat, amount: effect.amount, source: entry.name });
+      }
+    }
+    if (entry.effectNote) notes.push({ source: entry.name, note: entry.effectNote });
+  }
+  return { effects, notes };
+}
+
 /**
  * Assembles the full derived character sheet from raw stored data. This is
  * the single function the API and quick-stats view should call rather than
  * re-deriving any of the above by hand.
  *
  * @param {object} character - rolled scores, species/class, level, armorBonus, etc.
+ *   With `inventoryItems` and `weapons` loaded (each with its pool entry),
+ *   the effects of equipped gear are applied; see activeGear.
  * @param {Array<{skill: string, proficient: boolean, expertise: boolean}>} skillProficiencies
  * @param {Array<{ability: string, proficient: boolean}>} saveProficiencies
  */
@@ -145,14 +248,21 @@ function computeCharacterSheet(character, skillProficiencies = [], saveProficien
     halfElfBonusAbility2 = null,
     armorBonus = 0,
     speedOverride = null,
+    spellSlotsUsed = [],
+    hitDiceUsed = 0,
   } = character;
 
   const halfElfBonusAbilities = [halfElfBonusAbility1, halfElfBonusAbility2].filter(Boolean);
   const rolled = { STR: strScore, DEX: dexScore, CON: conScore, INT: intScore, WIS: wisScore, CHA: chaScore };
 
+  const gear = activeGear(character);
+  // The total equipped gear adds to (or takes from) one number.
+  const fromGear = (...stats) => gear.effects.filter((e) => stats.includes(e.stat)).reduce((sum, e) => sum + e.amount, 0);
+
   const abilities = {};
   for (const ability of ABILITIES) {
-    const final = finalAbilityScore(rolled[ability], ability, species, halfElfBonusAbilities);
+    // A score never drops below 1, whatever is weighing the character down.
+    const final = Math.max(1, finalAbilityScore(rolled[ability], ability, species, halfElfBonusAbilities) + fromGear(ability));
     abilities[ability] = {
       rolled: rolled[ability],
       final,
@@ -166,7 +276,7 @@ function computeCharacterSheet(character, skillProficiencies = [], saveProficien
   for (const ability of ABILITIES) {
     const entry = saveProficiencies.find((s) => s.ability === ability);
     const proficient = entry ? entry.proficient : false;
-    saves[ability] = { proficient, bonus: saveBonus(abilities[ability].modifier, proficient, profBonus) };
+    saves[ability] = { proficient, bonus: saveBonus(abilities[ability].modifier, proficient, profBonus) + fromGear('SAVES', `SAVE_${ability}`) };
   }
 
   const skills = {};
@@ -179,7 +289,7 @@ function computeCharacterSheet(character, skillProficiencies = [], saveProficien
       ability,
       proficient,
       expertise,
-      bonus: skillBonus(abilities[ability].modifier, proficient, profBonus, expertise),
+      bonus: skillBonus(abilities[ability].modifier, proficient, profBonus, expertise) + fromGear('SKILLS', `SKILL_${skillKey}`),
     };
   }
 
@@ -189,14 +299,16 @@ function computeCharacterSheet(character, skillProficiencies = [], saveProficien
   return {
     abilities,
     proficiencyBonus: profBonus,
-    armorClass: armorClass(abilities.DEX.modifier, armorBonus),
-    initiative: initiative(abilities.DEX.modifier),
-    speed: effectiveSpeed(species, speedOverride),
-    hp: { max: hpMax(level, hitDieSize, abilities.CON.modifier) },
-    hitDice: { size: hitDieSize, count: level },
+    armorClass: armorClass(abilities.DEX.modifier, armorBonus) + fromGear('AC'),
+    initiative: initiative(abilities.DEX.modifier) + fromGear('INITIATIVE'),
+    speed: Math.max(0, effectiveSpeed(species, speedOverride) + fromGear('SPEED')),
+    hp: { max: Math.max(1, hpMax(level, hitDieSize, abilities.CON.modifier) + fromGear('MAX_HP')) },
+    hitDice: hitDiceState(characterClass, level, hitDiceUsed),
     saves,
     skills,
-    passivePerception: passivePerception(skills.PERCEPTION.bonus),
+    passivePerception: passivePerception(skills.PERCEPTION.bonus) + fromGear('PASSIVE_PERCEPTION'),
+    // What equipped gear is doing to the numbers above, and what else it does.
+    gear,
     spellcasting: spellcastingAbility
       ? {
           ability: spellcastingAbility,
@@ -204,6 +316,8 @@ function computeCharacterSheet(character, skillProficiencies = [], saveProficien
           attackBonus: spellAttackBonus(profBonus, abilities[spellcastingAbility].modifier),
         }
       : null,
+    // The slot tracker; null for a character with no spell slots.
+    spellSlots: spellSlotState(characterClass, level, spellSlotsUsed),
   };
 }
 
@@ -350,6 +464,14 @@ module.exports = {
   getClassSaveProficiencies,
   getClassHitDieSize,
   getClassSpellcastingAbility,
+  MAX_LEVEL,
+  MAX_SLOT_LEVEL,
+  spellSlotsFor,
+  spellSlotState,
+  maxSpellLevel,
+  hitDiceState,
+  GEAR_STATS,
+  activeGear,
   computeCharacterSheet,
   computeWeaponStats,
   MAX_GEAR_LEVEL,

backend/src/game/data/itemsLibrary.js

@@ -0,0 +1,78 @@
+// Default item library — armor, shields, a few worn pieces and common
+// supplies, offered to any campaign so a DM isn't hand-typing them. Shape
+// matches the `Item` Prisma model minus `id`/`campaignId`, plus a stable `key`
+// for "add to campaign" lookups and a `category` for the library picker.
+//
+// Armor here is a flat bonus to AC on top of 10 + Dexterity, because that is
+// how gear effects work (game/calculations.js, GEAR_STATS): the standard
+// rules' "replaces 10 + DEX" and "DEX bonus capped at 2" are not modelled.
+// Each suit's bonus is its standard AC less 10, and what the bonus cannot say
+// is in the note. A DM who wants it stricter edits the copy in their campaign.
+
+const STEALTH = 'Disadvantage on Stealth checks.';
+const armor = (key, name, category, ac, description, note = null, more = []) => ({
+  key,
+  name,
+  category,
+  description,
+  damageDice: null,
+  effects: [{ stat: 'AC', amount: ac }, ...more],
+  effectNote: note,
+});
+const gear = (key, name, category, description, effects = [], effectNote = null, damageDice = null) => ({
+  key,
+  name,
+  category,
+  description,
+  damageDice,
+  effects,
+  effectNote,
+});
+
+const ITEM_LIBRARY = [
+  // Light armor
+  armor('padded-armor', 'Padded Armor', 'Light Armor', 1, 'Quilted layers of cloth and batting.', STEALTH),
+  armor('leather-armor', 'Leather Armor', 'Light Armor', 1, 'Boiled leather breastplate and shoulder guards over soft leather.'),
+  armor('studded-leather', 'Studded Leather', 'Light Armor', 2, 'Tough leather set with close rivets and spikes.'),
+
+  // Medium armor
+  armor('hide-armor', 'Hide Armor', 'Medium Armor', 2, 'Thick furs and pelts.', 'Standard rules: counts at most +2 from Dexterity.'),
+  armor('chain-shirt', 'Chain Shirt', 'Medium Armor', 3, 'Interlocking rings worn between layers of clothing.', 'Standard rules: counts at most +2 from Dexterity.'),
+  armor('scale-mail', 'Scale Mail', 'Medium Armor', 4, 'A coat and leggings of leather covered in overlapping metal scales.', `${STEALTH} Standard rules: counts at most +2 from Dexterity.`),
+  armor('breastplate', 'Breastplate', 'Medium Armor', 4, 'A fitted metal chest piece worn with supple leather.', 'Standard rules: counts at most +2 from Dexterity.'),
+  armor('half-plate', 'Half Plate', 'Medium Armor', 5, 'Shaped metal plates covering most of the body.', `${STEALTH} Standard rules: counts at most +2 from Dexterity.`),
+
+  // Heavy armor: slow, loud, and in the standard rules it ignores Dexterity.
+  armor('ring-mail', 'Ring Mail', 'Heavy Armor', 4, 'Leather armor with heavy rings sewn into it.', `${STEALTH} Standard rules: adds no Dexterity.`),
+  armor('chain-mail', 'Chain Mail', 'Heavy Armor', 6, 'Interlocking metal rings over a layer of quilted fabric, with gauntlets.', `${STEALTH} Standard rules: adds no Dexterity, and needs Strength 13.`, [{ stat: 'SPEED', amount: -10 }]),
+  armor('splint-armor', 'Splint Armor', 'Heavy Armor', 7, 'Narrow vertical strips of metal riveted to a leather backing.', `${STEALTH} Standard rules: adds no Dexterity, and needs Strength 15.`, [{ stat: 'SPEED', amount: -10 }]),
+  armor('plate-armor', 'Plate Armor', 'Heavy Armor', 8, 'Shaped, interlocking metal plates covering the whole body.', `${STEALTH} Standard rules: adds no Dexterity, and needs Strength 15.`, [{ stat: 'SPEED', amount: -10 }]),
+
+  // Shields
+  armor('shield', 'Shield', 'Shields', 2, 'Wood or metal, carried in one hand.'),
+  armor('tower-shield', 'Tower Shield', 'Shields', 3, 'A wall of oak and iron, as tall as its bearer.', null, [{ stat: 'SPEED', amount: -5 }]),
+
+  // Worn gear
+  gear('ring-of-protection', 'Ring of Protection', 'Worn Gear', 'A plain band that turns blows aside.', [{ stat: 'AC', amount: 1 }, { stat: 'SAVES', amount: 1 }]),
+  gear('cloak-of-protection', 'Cloak of Protection', 'Worn Gear', 'A heavy cloak that seems to catch what was meant for you.', [{ stat: 'AC', amount: 1 }, { stat: 'SAVES', amount: 1 }]),
+  gear('cloak-of-elvenkind', 'Cloak of Elvenkind', 'Worn Gear', 'With the hood up, its colour shifts to match what is behind it.', [{ stat: 'SKILL_STEALTH', amount: 5 }], 'With the hood up, others have disadvantage on Perception checks to see you.'),
+  gear('boots-of-striding', 'Boots of Striding', 'Worn Gear', 'Light, tireless boots.', [{ stat: 'SPEED', amount: 10 }]),
+  gear('gauntlets-of-might', 'Gauntlets of Might', 'Worn Gear', 'Iron-banded gauntlets that lend a giant’s grip.', [{ stat: 'STR', amount: 2 }]),
+  gear('gloves-of-thievery', 'Gloves of Thievery', 'Worn Gear', 'Thin grey gloves that all but vanish when worn.', [{ stat: 'SKILL_SLEIGHT_OF_HAND', amount: 5 }]),
+  gear('amulet-of-health', 'Amulet of Health', 'Worn Gear', 'A red stone on a golden chain, warm against the skin.', [{ stat: 'CON', amount: 2 }]),
+  gear('headband-of-intellect', 'Headband of Intellect', 'Worn Gear', 'A silver circlet set with a pale blue stone.', [{ stat: 'INT', amount: 2 }]),
+  gear('sentinel-charm', 'Sentinel Charm', 'Worn Gear', 'A brass eye on a cord that never quite closes.', [{ stat: 'INITIATIVE', amount: 2 }, { stat: 'PASSIVE_PERCEPTION', amount: 5 }]),
+  gear('stone-of-good-luck', 'Stone of Good Luck', 'Worn Gear', 'A polished agate that sits well in a pocket.', [{ stat: 'SAVES', amount: 1 }, { stat: 'SKILLS', amount: 1 }]),
+
+  // Supplies: nothing to equip, but every pack has them.
+  gear('healing-potion', 'Healing Potion', 'Supplies', 'A red liquid that glimmers when shaken. Drink it to regain hit points.', [], null, '2d4+2'),
+  gear('rope', 'Rope (50 ft)', 'Supplies', 'Hempen rope. Holds a climber.'),
+  gear('torch', 'Torch', 'Supplies', 'Burns for an hour, lighting 20 feet brightly.', [], 'Held in a hand to give light.'),
+  gear('lantern', 'Hooded Lantern', 'Supplies', 'Bright light for 30 feet; the hood dims it to a glow.', [], 'Held in a hand to give light.'),
+  gear('rations', 'Rations (1 day)', 'Supplies', 'Dried meat, hard biscuit, nuts.'),
+  gear('bedroll', 'Bedroll', 'Supplies', 'A blanket roll for sleeping rough.'),
+  gear('thieves-tools', 'Thieves’ Tools', 'Supplies', 'A file, picks, a small mirror, narrow scissors and pliers.'),
+  gear('healers-kit', 'Healer’s Kit', 'Supplies', 'Bandages, salves and splints. Steadies a dying creature without a check.'),
+];
+
+module.exports = { ITEM_LIBRARY };

backend/src/game/data/levelFeatures.js

@@ -0,0 +1,288 @@
+// What each class gains at each level after the first: the "Levelling-Up
+// Checklist" tables of the Hollowcrown book (Rules Cheat Sheet), levels 2 to
+// 10. The site has no subclasses, so each class follows one simple path (the
+// Champion fighter, the Life cleric...). Level 1 features are in
+// characterOptions.js and are written by the builder.
+//
+// Each entry becomes a line of the character's special abilities, "Name —
+// text". An `upgrade` rewrites the line that already has that name (Sneak
+// Attack growing a die); anything else is added as a new line. `{ boon: true }`
+// is a Boon: the DM picks one from BOONS below.
+//
+// None of this feeds the calculation engine: like the level 1 features, these
+// are table rules in plain words.
+
+const BOON = { boon: true };
+
+const rage = (uses, damage) => ({
+  name: 'Rage',
+  text: `${uses} per day, for one minute: +${damage} melee damage, advantage on Strength checks and saves, and physical damage against you is halved.`,
+  upgrade: true,
+});
+
+const sneakAttack = (dice) => ({
+  name: 'Sneak Attack',
+  text: `Once per turn, deal an extra ${dice} damage to a target you have advantage against, or that has one of your allies next to it.`,
+  upgrade: true,
+});
+
+const bardicInspiration = (die) => ({
+  name: 'Bardic Inspiration',
+  text: `A few times per day, as a bonus action, give an ally a ${die} to add to one attack, check or save.`,
+  upgrade: true,
+});
+
+const wildShape = (limit) => ({
+  name: 'Wild Shape',
+  text: `Twice per short rest, become a beast you have seen of ${limit}, for up to half your level in hours. Use the beast's HP; when it hits 0 you return to your own form.`,
+  upgrade: true,
+});
+
+const EXTRA_ATTACK = { name: 'Extra Attack', text: 'Attack twice when you take the Attack action.' };
+const EVASION = { name: 'Evasion', text: 'On a Dexterity save for half damage, take none on a success and half on a failure.' };
+const LANDS_STRIDE = { name: 'Land’s Stride', text: 'Ordinary difficult terrain and plants do not slow you.' };
+
+const INVOCATIONS =
+  'Agonizing Blast (add your Charisma modifier to each Eldritch Blast hit), Devil’s Sight (see normally in darkness, even magical darkness, to 120 ft), Repelling Blast (Eldritch Blast hits push the target 10 ft away), Mask of Many Faces (cast Disguise Self at will), Beguiling Influence (proficiency in Deception and Persuasion, added by hand), Eyes of the Rune Keeper (read any writing)';
+const invocations = (total) => ({
+  name: 'Eldritch Invocations',
+  text: `Choose one more with your DM (${total} in all). From level 5 the list adds Thirsting Blade (Pact of the Blade: attack twice with your pact weapon) and One with Shadows (become invisible while standing still in dim light or darkness).`,
+});
+
+const LEVEL_FEATURES = {
+  BARBARIAN: {
+    2: [
+      { name: 'Reckless Attack', text: 'On your first attack each turn you may attack with advantage; attacks against you have advantage until your next turn.' },
+      { name: 'Danger Sense', text: 'Advantage on Dexterity saves against effects you can see (traps, breath, spells).' },
+    ],
+    3: [
+      { name: 'Frenzy', text: 'Path of the Berserker. While raging you may make one extra melee attack as a bonus action each turn; when the rage ends, gain one level of exhaustion.' },
+      rage('Three times', 2),
+    ],
+    4: [BOON],
+    5: [EXTRA_ATTACK, { name: 'Fast Movement', text: '+10 ft speed when not in heavy armor (ask your DM to raise your speed).' }],
+    6: [{ name: 'Mindless Rage', text: 'You can’t be charmed or frightened while raging.' }, rage('Four times', 2)],
+    7: [{ name: 'Feral Instinct', text: 'Advantage on initiative; you can act normally in a surprise round if you rage first.' }],
+    8: [BOON],
+    9: [{ name: 'Brutal Critical', text: 'Roll one extra weapon damage die on a critical hit.' }, rage('Four times', 3)],
+    10: [{ name: 'Intimidating Presence', text: 'Action: one creature within 30 ft makes a Wisdom save (DC 8 + proficiency bonus + Charisma modifier) or is frightened of you until the end of your next turn.' }],
+  },
+  BARD: {
+    2: [
+      { name: 'Jack of All Trades', text: 'Add half your proficiency bonus (round down) to any check you are not proficient in.' },
+      { name: 'Song of Rest', text: 'During a short rest, allies who spend Hit Dice heal an extra 1d6.' },
+    ],
+    3: [
+      { name: 'Cutting Words', text: 'College of Lore. Reaction: spend a Bardic Inspiration to subtract the die from an enemy’s attack, check or damage roll.' },
+      { name: 'Bonus Proficiencies', text: 'Treat three extra skills of your choice as proficient (add your proficiency bonus by hand).' },
+      { name: 'Expertise', text: 'Double proficiency on two proficient skills (add by hand).' },
+    ],
+    4: [BOON],
+    5: [bardicInspiration('d8'), { name: 'Font of Inspiration', text: 'Regain Bardic Inspiration on a short rest.' }],
+    6: [
+      { name: 'Countercharm', text: 'Action: allies within 30 ft get advantage on saves against fear and charm until your next turn.' },
+      { name: 'Additional Magical Secrets', text: 'Learn two spells from any class list (the DM grants them within the unlock schedule).' },
+    ],
+    8: [BOON],
+    9: [{ name: 'Song of Rest', text: 'During a short rest, allies who spend Hit Dice heal an extra 1d8.', upgrade: true }],
+    10: [
+      bardicInspiration('d10'),
+      { name: 'Expertise', text: 'Double proficiency on four proficient skills (add by hand).', upgrade: true },
+      { name: 'Magical Secrets', text: 'Learn two more spells from any class (the DM grants them within the unlock schedule).' },
+    ],
+  },
+  CLERIC: {
+    2: [
+      { name: 'Channel Divinity', text: 'Once per short rest, use Turn Undead or Preserve Life.' },
+      { name: 'Turn Undead', text: 'Channel Divinity. Action: undead within 30 ft make a Wisdom save or flee from you for 1 minute.' },
+      { name: 'Preserve Life', text: 'Channel Divinity. Action: share out healing of 5 × your level among creatures within 30 ft (up to half their max HP each).' },
+    ],
+    4: [BOON],
+    5: [{ name: 'Destroy Undead', text: 'Undead of CR 1/2 or lower that fail against your Turn Undead are destroyed.' }],
+    6: [
+      { name: 'Channel Divinity', text: 'Twice per short rest, use Turn Undead or Preserve Life.', upgrade: true },
+      { name: 'Blessed Healer', text: 'When you heal someone else with a spell, you heal yourself 2 + the spell’s level.' },
+    ],
+    8: [
+      BOON,
+      { name: 'Divine Strike', text: 'Once per turn, a weapon hit deals +1d8 radiant damage.' },
+      { name: 'Destroy Undead', text: 'Undead of CR 1 or lower that fail against your Turn Undead are destroyed.', upgrade: true },
+    ],
+    10: [{ name: 'Divine Intervention', text: 'Once per week, call on your god: roll d100; if you roll your level or lower, the god helps (the DM decides how).' }],
+  },
+  DRUID: {
+    2: [
+      wildShape('CR 1/4 or less (no flying or swimming)'),
+      { name: 'Natural Recovery', text: 'Once per day on a short rest, recover spent spell slots totalling up to half your level (rounded up).' },
+      { name: 'Bonus Cantrip', text: 'Learn one extra cantrip (the DM grants it).' },
+    ],
+    4: [BOON, wildShape('CR 1/2 or less (it may swim, not fly)')],
+    6: [{ name: 'Land’s Stride', text: 'Ordinary difficult terrain and plants do not slow you; advantage on saves against magical plants.' }],
+    8: [BOON, wildShape('CR 1 or less (it may swim or fly)')],
+    10: [{ name: 'Nature’s Ward', text: 'Immune to poison and disease; you can’t be charmed or frightened by fey or elementals.' }],
+  },
+  FIGHTER: {
+    2: [{ name: 'Action Surge', text: 'Once per short rest, take one extra action on your turn.' }],
+    3: [{ name: 'Improved Critical', text: 'Your weapon attacks score a critical hit on a roll of 19 or 20.' }],
+    4: [BOON],
+    5: [EXTRA_ATTACK],
+    6: [BOON],
+    7: [{ name: 'Remarkable Athlete', text: 'Add half your proficiency bonus to Strength, Dexterity and Constitution checks you are not proficient in; long jump + Strength modifier feet.' }],
+    8: [BOON],
+    9: [{ name: 'Indomitable', text: 'Once per long rest, reroll a failed saving throw.' }],
+    10: [{ name: 'Additional Fighting Style', text: 'Choose a second option from your Fighting Style list. (If it is +1 AC in armor, the DM raises Extra AC by 1.)' }],
+  },
+  MONK: {
+    2: [
+      { name: 'Ki', text: 'Points equal to your level; they come back on a short rest. Ki save DC is 8 + proficiency bonus + Wisdom modifier.' },
+      { name: 'Flurry of Blows', text: '1 ki: two unarmed strikes as a bonus action.' },
+      { name: 'Patient Defense', text: '1 ki: Dodge as a bonus action.' },
+      { name: 'Step of the Wind', text: '1 ki: Dash or Disengage as a bonus action, jump distance doubled.' },
+      { name: 'Unarmored Movement', text: '+10 ft speed without armor (ask your DM to raise your speed).' },
+    ],
+    3: [
+      { name: 'Open Hand Technique', text: 'Flurry hits can knock a target prone (Dexterity save), push it 15 ft (Strength save) or stop its reactions.' },
+      { name: 'Deflect Missiles', text: 'Reaction: reduce ranged weapon damage by 1d10 + Dexterity modifier + your level.' },
+    ],
+    4: [BOON, { name: 'Slow Fall', text: 'Reaction: reduce falling damage by 5 × your level.' }],
+    5: [
+      EXTRA_ATTACK,
+      { name: 'Stunning Strike', text: '1 ki after a melee hit: the target makes a Constitution save or is stunned until your next turn.' },
+      { name: 'Martial Arts', text: 'Your unarmed strikes deal 1d6 damage and can use Dexterity. After attacking, make one unarmed strike as a bonus action.', upgrade: true },
+    ],
+    6: [
+      { name: 'Ki-Empowered Strikes', text: 'Your unarmed strikes count as magical.' },
+      { name: 'Wholeness of Body', text: 'Once per long rest, heal 3 × your level as an action.' },
+      { name: 'Unarmored Movement', text: '+15 ft speed without armor (ask your DM to raise your speed).', upgrade: true },
+    ],
+    7: [EVASION, { name: 'Stillness of Mind', text: 'Action: end charm or fear on yourself.' }],
+    8: [BOON],
+    9: [{ name: 'Unarmored Movement', text: '+15 ft speed without armor (ask your DM to raise your speed). You can run along walls and across water during your move.', upgrade: true }],
+    10: [
+      { name: 'Purity of Body', text: 'Immune to poison and disease.' },
+      { name: 'Unarmored Movement', text: '+20 ft speed without armor (ask your DM to raise your speed). You can run along walls and across water during your move.', upgrade: true },
+    ],
+  },
+  PALADIN: {
+    2: [
+      { name: 'Divine Smite', text: 'After a melee hit, spend a spell slot to deal +2d8 radiant (+1d8 per slot level above 1st; +1d8 more against undead and fiends).' },
+      { name: 'Fighting Style', text: 'Choose one with your DM: +1 AC in armor (the DM raises Extra AC by 1), +2 damage with a one-handed weapon, or protect an adjacent ally (impose disadvantage on an attack as a reaction).' },
+      { name: 'Spellcasting', text: 'Paladin spells unlock: you now have spell slots.' },
+    ],
+    3: [
+      { name: 'Divine Health', text: 'Immune to disease.' },
+      { name: 'Sacred Weapon', text: 'Oath of Devotion, Channel Divinity. Add your Charisma modifier to attack rolls with your weapon for 1 minute; it sheds light.' },
+      { name: 'Turn the Unholy', text: 'Channel Divinity. Fiends and undead within 30 ft make a Wisdom save or flee for 1 minute.' },
+    ],
+    4: [BOON],
+    5: [EXTRA_ATTACK],
+    6: [{ name: 'Aura of Protection', text: 'You and allies within 10 ft add your Charisma modifier to all saving throws while you are conscious.' }],
+    7: [{ name: 'Aura of Devotion', text: 'You and allies within 10 ft can’t be charmed.' }],
+    8: [BOON],
+    10: [{ name: 'Aura of Courage', text: 'You and allies within 10 ft can’t be frightened.' }],
+  },
+  RANGER: {
+    2: [
+      { name: 'Fighting Style', text: 'Choose one with your DM: +2 to ranged attacks, +1 AC in armor (the DM raises Extra AC by 1), or add your ability modifier again to a paired weapon’s damage (added by hand).' },
+      { name: 'Spellcasting', text: 'Ranger spells unlock: you now have spell slots.' },
+    ],
+    3: [
+      { name: 'Colossus Slayer', text: 'Hunter’s Prey. Once per turn, +1d8 damage to a creature that is already below its max HP.' },
+      { name: 'Primeval Awareness', text: 'Spend a spell slot: sense aberrations, dragons, fey, fiends, undead and elementals within 1 mile for 1 minute per slot level.' },
+    ],
+    4: [BOON],
+    5: [EXTRA_ATTACK],
+    6: [
+      { name: 'Favored Enemy', text: 'Choose a second favored enemy with your DM.' },
+      { name: 'Natural Explorer', text: 'Choose a second favored terrain with your DM.' },
+    ],
+    7: [{ name: 'Escape the Horde', text: 'Defensive Tactics. Opportunity attacks against you have disadvantage.' }],
+    8: [BOON, LANDS_STRIDE],
+    10: [
+      { name: 'Hide in Plain Sight', text: 'Spend 1 minute camouflaging: +10 to Stealth while you stay still.' },
+      { name: 'Natural Explorer', text: 'Choose a third favored terrain with your DM.' },
+    ],
+  },
+  ROGUE: {
+    2: [{ name: 'Cunning Action', text: 'Bonus action: Dash, Disengage or Hide.' }],
+    3: [
+      sneakAttack('2d6'),
+      { name: 'Fast Hands', text: 'Bonus action: Sleight of Hand, pick a lock, disarm a trap or Use an Object.' },
+      { name: 'Second-Story Work', text: 'Climbing costs no extra movement; running jumps + Dexterity modifier feet.' },
+    ],
+    4: [BOON],
+    5: [sneakAttack('3d6'), { name: 'Uncanny Dodge', text: 'Reaction: halve the damage of an attack that hits you.' }],
+    6: [{ name: 'Expertise', text: 'Double proficiency on two more proficient skills (add by hand).' }],
+    7: [sneakAttack('4d6'), EVASION],
+    8: [BOON],
+    9: [sneakAttack('5d6'), { name: 'Supreme Sneak', text: 'Advantage on Stealth if you move no more than half your speed.' }],
+    10: [BOON],
+  },
+  SORCERER: {
+    2: [{ name: 'Font of Magic', text: 'Sorcery points equal to your level; they come back on a long rest. Bonus action: turn points into a spell slot (2 points = 1st, 3 = 2nd, 5 = 3rd, 6 = 4th, 7 = 5th), or a spell slot into points equal to its level.' }],
+    3: [{ name: 'Metamagic', text: 'Choose two with your DM: Quickened Spell (2 points: cast an action spell as a bonus action), Twinned Spell (points = spell level: hit a second target with a single-target spell), Careful Spell (1 point: allies auto-succeed on your spell’s save), Subtle Spell (1 point: cast without words or gestures), Extended Spell (1 point: double duration), Heightened Spell (3 points: one target has disadvantage on its first save).' }],
+    4: [BOON],
+    6: [{ name: 'Elemental Affinity', text: 'Draconic Bloodline. Add your Charisma modifier to one damage roll of your dragon’s element; spend 1 sorcery point to resist that element for 1 hour.' }],
+    8: [BOON],
+    10: [{ name: 'Metamagic', text: 'Choose a third option with your DM.' }],
+  },
+  WARLOCK: {
+    2: [{ name: 'Eldritch Invocations', text: `Choose two with your DM: ${INVOCATIONS}.` }],
+    3: [{ name: 'Pact Boon', text: 'Choose one with your DM: Pact of the Blade (summon a weapon of your choice as an action; it counts as magical), Pact of the Chain (gain a small familiar spirit: an imp, a sprite or a cat-shaped shadow), or Pact of the Tome (a book of three extra cantrips from any class, which the DM grants).' }],
+    4: [BOON],
+    5: [invocations('three')],
+    6: [{ name: 'Patron’s Luck', text: 'Once per short rest, add a d10 to an ability check or saving throw after seeing the roll.' }],
+    7: [invocations('four')],
+    8: [BOON],
+    9: [invocations('five')],
+    10: [{ name: 'Patron’s Resilience', text: 'After each rest, choose one damage type: you resist it until you choose another.' }],
+  },
+  WIZARD: {
+    2: [
+      { name: 'Evocation Savant', text: 'School of Evocation. Copying evocation spells costs half the time and gold.' },
+      { name: 'Sculpt Spells', text: 'When you cast an evocation spell that hits an area, choose 1 + the spell’s level creatures to automatically save and take no damage.' },
+    ],
+    4: [BOON],
+    6: [{ name: 'Potent Cantrip', text: 'Creatures that save against your damaging cantrips still take half damage.' }],
+    8: [BOON],
+    10: [{ name: 'Empowered Evocation', text: 'Add your Intelligence modifier to the damage of your evocation spells.' }],
+  },
+};
+
+// The class tables above stop here; a higher level still raises the numbers.
+const MAX_FEATURE_LEVEL = 10;
+
+// From level 5 a damaging cantrip rolls twice the dice the site shows. Written
+// onto the sheet of every class that casts, so nobody forgets.
+const CANTRIP_LEVEL = 5;
+const CANTRIP_FEATURE = {
+  name: 'Cantrips',
+  text: 'Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll).',
+};
+
+// Boons stand in for ability score increases, which the site does not have
+// (every number on the sheet comes from the scores rolled at the build). Each
+// is worth what +2 to a best ability would be. `max` is how often one can be
+// taken; `per` is what each taking adds, and `text` the line for that many.
+const BOONS = [
+  {
+    key: 'WEAPON_MASTERY',
+    name: 'Weapon Mastery',
+    max: 2,
+    per: 1,
+    text: (amount) => `+${amount} to attack and damage rolls with weapons (add it to the numbers the site shows).`,
+  },
+  {
+    key: 'ARCANE_FOCUS',
+    name: 'Arcane Focus',
+    max: 2,
+    per: 1,
+    text: (amount) => `+${amount} to spell save DC and spell attack bonus (add it to the numbers the site shows).`,
+  },
+  // AC is the most powerful number in the game, so this one is taken once.
+  { key: 'TOUGHENED', name: 'Toughened', max: 1, per: 1, text: (amount) => `+${amount} AC (counted in your Extra AC).` },
+  // The site works max HP out itself, so the extra lives in Temp HP.
+  { key: 'HARDY', name: 'Hardy', max: 2, per: 5, text: (amount) => `+${amount} maximum HP: gain ${amount} Temp HP after each long rest.` },
+];
+
+module.exports = { LEVEL_FEATURES, MAX_FEATURE_LEVEL, CANTRIP_LEVEL, CANTRIP_FEATURE, BOONS };

backend/src/game/data/library.js

@@ -1,7 +1,9 @@
-// Combined default-content library — see weaponsLibrary.js / spellsLibrary.js
-// / monstersLibrary.js for the individual sets and their shape.
+// Combined default-content library — see weaponsLibrary.js / itemsLibrary.js
+// / spellsLibrary.js / monstersLibrary.js for the individual sets and their
+// shape.
 const { WEAPON_LIBRARY } = require('./weaponsLibrary');
+const { ITEM_LIBRARY } = require('./itemsLibrary');
 const { SPELL_LIBRARY } = require('./spellsLibrary');
 const { MONSTER_LIBRARY } = require('./monstersLibrary');
 
-module.exports = { WEAPON_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY };
+module.exports = { WEAPON_LIBRARY, ITEM_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY };

backend/src/game/data/spellSlots.js

@@ -0,0 +1,92 @@
+// Spell slots by class and character level: the standard 5e tables, as the
+// Hollowcrown book's Slot Tracker prints them for levels 1 to 10. Each row is
+// how many slots there are of each slot level, 1st first.
+
+// Bard, Cleric, Druid, Sorcerer, Wizard.
+const FULL_CASTER_SLOTS = [
+  [2],
+  [3],
+  [4, 2],
+  [4, 3],
+  [4, 3, 2],
+  [4, 3, 3],
+  [4, 3, 3, 1],
+  [4, 3, 3, 2],
+  [4, 3, 3, 3, 1],
+  [4, 3, 3, 3, 2],
+  [4, 3, 3, 3, 2, 1],
+  [4, 3, 3, 3, 2, 1],
+  [4, 3, 3, 3, 2, 1, 1],
+  [4, 3, 3, 3, 2, 1, 1],
+  [4, 3, 3, 3, 2, 1, 1, 1],
+  [4, 3, 3, 3, 2, 1, 1, 1],
+  [4, 3, 3, 3, 2, 1, 1, 1, 1],
+  [4, 3, 3, 3, 3, 1, 1, 1, 1],
+  [4, 3, 3, 3, 3, 2, 1, 1, 1],
+  [4, 3, 3, 3, 3, 2, 2, 1, 1],
+];
+
+// Paladin, Ranger: nothing at level 1, then half a full caster's pace.
+const HALF_CASTER_SLOTS = [
+  [],
+  [2],
+  [3],
+  [3],
+  [4, 2],
+  [4, 2],
+  [4, 3],
+  [4, 3],
+  [4, 3, 2],
+  [4, 3, 2],
+  [4, 3, 3],
+  [4, 3, 3],
+  [4, 3, 3, 1],
+  [4, 3, 3, 1],
+  [4, 3, 3, 2],
+  [4, 3, 3, 2],
+  [4, 3, 3, 3, 1],
+  [4, 3, 3, 3, 1],
+  [4, 3, 3, 3, 2],
+  [4, 3, 3, 3, 2],
+];
+
+// Warlock: a few slots, all of one slot level. [how many, which level].
+const PACT_SLOTS = [
+  [1, 1],
+  [2, 1],
+  [2, 2],
+  [2, 2],
+  [2, 3],
+  [2, 3],
+  [2, 4],
+  [2, 4],
+  [2, 5],
+  [2, 5],
+  [3, 5],
+  [3, 5],
+  [3, 5],
+  [3, 5],
+  [3, 5],
+  [3, 5],
+  [4, 5],
+  [4, 5],
+  [4, 5],
+  [4, 5],
+];
+
+// FULL and HALF casters get their slots back on a long rest; a warlock's
+// PACT slots come back on a short rest too.
+const CASTER_KIND = {
+  BARD: 'FULL',
+  CLERIC: 'FULL',
+  DRUID: 'FULL',
+  SORCERER: 'FULL',
+  WIZARD: 'FULL',
+  PALADIN: 'HALF',
+  RANGER: 'HALF',
+  WARLOCK: 'PACT',
+};
+
+const MAX_SLOT_LEVEL = 9;
+
+module.exports = { FULL_CASTER_SLOTS, HALF_CASTER_SLOTS, PACT_SLOTS, CASTER_KIND, MAX_SLOT_LEVEL };

backend/src/game/data/spellsLibrary.js

@@ -115,7 +115,7 @@ const SPELL_LIBRARY = [
   { key: 'nondetection', name: 'Nondetection', level: 3, school: 'Abjuration', castingTime: '1 action', range: 'Touch', duration: '8 hours', description: 'Hide a target from divination magic.', classes: ['BARD', 'RANGER', 'WIZARD'] },
   { key: 'protection-from-energy', name: 'Protection from Energy', level: 3, school: 'Abjuration', castingTime: '1 action', range: 'Touch', duration: 'Concentration, up to 1 hour', description: 'Resistance to one damage type of your choice.', classes: ['CLERIC', 'DRUID', 'RANGER', 'SORCERER', 'WIZARD'] },
   { key: 'remove-curse', name: 'Remove Curse', level: 3, school: 'Abjuration', castingTime: '1 action', range: 'Touch', duration: 'Instantaneous', description: 'Lift a curse from a creature or object.', classes: ['CLERIC', 'PALADIN', 'WARLOCK', 'WIZARD'] },
-  { key: 'revivify', name: 'Revivify', level: 3, school: 'Necromancy', castingTime: '1 action', range: 'Touch', duration: 'Instantaneous', description: 'A creature that died within the last minute returns to life with 1 hit point.', classes: ['CLERIC', 'PALADIN'] },
+  { key: 'revivify', name: 'Revivify', level: 3, school: 'Necromancy', castingTime: '1 action', range: 'Touch', duration: 'Instantaneous', description: 'A creature that died within the last minute returns to life with 1 hit point.', revives: true, classes: ['CLERIC', 'PALADIN'] },
   { key: 'sleet-storm', name: 'Sleet Storm', level: 3, school: 'Conjuration', castingTime: '1 action', range: '150 feet', duration: 'Concentration, up to 1 minute', description: 'Freezing rain falls in a 40-foot-radius cylinder, icing the ground.', classes: ['DRUID', 'SORCERER', 'WIZARD'] },
   { key: 'slow', name: 'Slow', level: 3, school: 'Transmutation', castingTime: '1 action', range: '120 feet', duration: 'Concentration, up to 1 minute', description: 'Up to six creatures are hindered, halving their speed and worse.', classes: ['SORCERER', 'WIZARD'] },
   { key: 'spirit-guardians', name: 'Spirit Guardians', level: 3, school: 'Conjuration', castingTime: '1 action', range: 'Self (15-foot radius)', duration: 'Concentration, up to 10 minutes', description: 'Protective spirits swirl around you, damaging enemies that enter.', damageDice: '3d8', classes: ['CLERIC'] },
@@ -150,7 +150,7 @@ const SPELL_LIBRARY = [
   { key: 'insect-plague', name: 'Insect Plague', level: 5, school: 'Conjuration', castingTime: '1 action', range: '300 feet', duration: 'Concentration, up to 10 minutes', description: 'A swarm of biting, stinging insects fills a 20-foot-radius sphere.', damageDice: '4d10', classes: ['CLERIC', 'DRUID', 'SORCERER'] },
   { key: 'legend-lore', name: 'Legend Lore', level: 5, school: 'Divination', castingTime: '10 minutes', range: 'Self', duration: 'Instantaneous', description: 'Learn what you know, or have heard, about a name, place, or object.', classes: ['BARD', 'CLERIC', 'WIZARD'] },
   { key: 'mass-cure-wounds', name: 'Mass Cure Wounds', level: 5, school: 'Evocation', castingTime: '1 action', range: '60 feet', duration: 'Instantaneous', description: 'Up to six creatures in a 30-foot-radius sphere regain hit points.', classes: ['BARD', 'CLERIC', 'DRUID'] },
-  { key: 'raise-dead', name: 'Raise Dead', level: 5, school: 'Necromancy', castingTime: '1 hour', range: 'Touch', duration: 'Instantaneous', description: 'Return a dead creature to life, as long as its body is mostly intact.', classes: ['BARD', 'CLERIC', 'PALADIN'] },
+  { key: 'raise-dead', name: 'Raise Dead', level: 5, school: 'Necromancy', castingTime: '1 hour', range: 'Touch', duration: 'Instantaneous', description: 'Return a dead creature to life, as long as its body is mostly intact.', revives: true, classes: ['BARD', 'CLERIC', 'PALADIN'] },
   { key: 'wall-of-force', name: 'Wall of Force', level: 5, school: 'Evocation', castingTime: '1 action', range: '120 feet', duration: 'Concentration, up to 10 minutes', description: 'An invisible wall of force springs into existence, impenetrable to physical force.', classes: ['WIZARD'] },
   { key: 'wall-of-stone', name: 'Wall of Stone', level: 5, school: 'Evocation', castingTime: '1 action', range: '120 feet', duration: 'Concentration, up to 10 minutes', description: 'A nonmagical wall of solid stone springs into existence.', classes: ['DRUID', 'SORCERER', 'WIZARD'] },
 ];

backend/src/game/data/weaponsLibrary.js

@@ -3,6 +3,9 @@
 // matches the `Weapon` Prisma model minus `id`/`campaignId`, plus a stable
 // `key` for "add to campaign" lookups and a `category` for the library
 // picker's filter. attackAbility follows the schema's STR|DEX|FINESSE.
+//
+// A character has one weapon equipped at a time (a campaign setting), so a
+// weapon fought with in each hand is a single entry of its own: see "Paired".
 
 const WEAPON_LIBRARY = [
   // Simple Melee
@@ -49,6 +52,12 @@ const WEAPON_LIBRARY = [
   { key: 'heavy-crossbow', name: 'Heavy Crossbow', category: 'Martial Ranged', damageDice: '1d10', damageType: 'piercing', attackAbility: 'DEX', properties: ['ammunition', 'heavy', 'loading', 'two-handed'], rangeNormal: 100, rangeLong: 400 },
   { key: 'longbow', name: 'Longbow', category: 'Martial Ranged', damageDice: '1d8', damageType: 'piercing', attackAbility: 'DEX', properties: ['ammunition', 'heavy', 'two-handed'], rangeNormal: 150, rangeLong: 600 },
   { key: 'net', name: 'Net', category: 'Martial Ranged', damageDice: '-', damageType: 'special', attackAbility: 'DEX', properties: ['special', 'thrown'], rangeNormal: 5, rangeLong: 15 },
+
+  // Paired: one in each hand, as a single weapon. The damage is both blades.
+  { key: 'paired-daggers', name: 'Paired Daggers', category: 'Paired', damageDice: '2d4', damageType: 'piercing', attackAbility: 'FINESSE', properties: ['finesse', 'light', 'paired'], rangeNormal: null, rangeLong: null, effectNote: 'A dagger in each hand: takes both hands.' },
+  { key: 'paired-shortswords', name: 'Paired Shortswords', category: 'Paired', damageDice: '2d6', damageType: 'piercing', attackAbility: 'FINESSE', properties: ['finesse', 'light', 'paired'], rangeNormal: null, rangeLong: null, effectNote: 'A shortsword in each hand: takes both hands.' },
+  { key: 'paired-scimitars', name: 'Paired Scimitars', category: 'Paired', damageDice: '2d6', damageType: 'slashing', attackAbility: 'FINESSE', properties: ['finesse', 'light', 'paired'], rangeNormal: null, rangeLong: null, effectNote: 'A scimitar in each hand: takes both hands.' },
+  { key: 'paired-handaxes', name: 'Paired Handaxes', category: 'Paired', damageDice: '2d6', damageType: 'slashing', attackAbility: 'STR', properties: ['light', 'paired'], rangeNormal: null, rangeLong: null, effectNote: 'A handaxe in each hand: takes both hands.' },
 ];
 
 module.exports = { WEAPON_LIBRARY };

backend/src/game/levelUp.js

@@ -0,0 +1,144 @@
+// Levelling up: the Hollowcrown book's "Levelling-Up Checklist" (Rules Cheat
+// Sheet). Works out what a character gains at a level, and rewrites their
+// special abilities to say so. Pure: no DB calls.
+
+const { LEVEL_FEATURES, MAX_FEATURE_LEVEL, CANTRIP_LEVEL, CANTRIP_FEATURE, BOONS } = require('./data/levelFeatures');
+const { CASTER_KIND } = require('./data/spellSlots');
+const { getClassSpellcastingAbility, maxSpellLevel, scaledDamageDice, MAX_GEAR_LEVEL } = require('./calculations');
+
+// A choice that cannot be made: the message is for whoever made it.
+class LevelUpError extends Error {}
+
+// What a class gains on reaching `level`, in the order it is written down.
+// An entry is { name, text, upgrade? } or { boon: true }.
+function featuresAt(characterClass, level) {
+  const features = [...((LEVEL_FEATURES[characterClass] || {})[level] || [])];
+  if (level === CANTRIP_LEVEL && getClassSpellcastingAbility(characterClass)) features.push(CANTRIP_FEATURE);
+  return features;
+}
+
+// Special abilities are one per line, "Name — what it does". The builder
+// writes a long dash; a DM typing by hand may use "--".
+const featureLine = (feature) => `${feature.name} — ${feature.text}`;
+
+function lineName(line) {
+  const match = /^\s*(.+?)\s*(?:—|–|--)\s/.exec(line);
+  return match ? match[1].toLowerCase() : null;
+}
+
+const toLines = (specialAbilities) => (specialAbilities ? specialAbilities.split(/\r?\n/) : []);
+const fromLines = (lines) => lines.join('\n') || null;
+const findLine = (lines, name) => lines.findIndex((line) => lineName(line) === name.toLowerCase());
+
+// Writes features into the text. An upgrade takes the place of the line with
+// its name (Sneak Attack growing a die); anything else goes on the end, unless
+// that very line is there already.
+function addFeatures(specialAbilities, features) {
+  const lines = toLines(specialAbilities);
+  for (const feature of features) {
+    const line = featureLine(feature);
+    const at = feature.upgrade ? findLine(lines, feature.name) : -1;
+    if (at >= 0) lines[at] = line;
+    else if (!lines.includes(line)) lines.push(line);
+  }
+  return fromLines(lines);
+}
+
+// How many times a Boon has been taken, read off its line ("Hardy — +10
+// maximum HP…" is twice).
+function boonTaken(specialAbilities, boon) {
+  const lines = toLines(specialAbilities);
+  const at = findLine(lines, boon.name);
+  if (at < 0) return 0;
+  const amount = /\+\s*(\d+)/.exec(lines[at]);
+  return Math.max(1, Math.round((amount ? Number(amount[1]) : boon.per) / boon.per));
+}
+
+// Every Boon, with what taking it now would write and whether it still can be.
+function boonOptions(specialAbilities) {
+  return BOONS.map((boon) => {
+    const taken = boonTaken(specialAbilities, boon);
+    return { key: boon.key, name: boon.name, taken, max: boon.max, available: taken < boon.max, text: boon.text((Math.min(taken, boon.max - 1) + 1) * boon.per) };
+  });
+}
+
+// Temp HP the Hardy Boon gives after each long rest; 0 without it.
+function hardyTempHp(specialAbilities) {
+  const hardy = BOONS.find((boon) => boon.key === 'HARDY');
+  return boonTaken(specialAbilities, hardy) * hardy.per;
+}
+
+// What reaching `level` does to a character's special abilities. `boonKey` is
+// the Boon picked, at a level that grants one; without it the line says a
+// choice is still owed. Also returns what the Boon does beyond the text: how
+// much Extra AC it adds, and the Temp HP it gives straight away.
+function advance(specialAbilities, characterClass, level, boonKey) {
+  const entries = featuresAt(characterClass, level);
+  let text = addFeatures(specialAbilities, entries.filter((entry) => !entry.boon));
+  const result = { armorBonus: 0, tempHp: 0 };
+
+  if (entries.some((entry) => entry.boon)) {
+    if (!boonKey) {
+      text = addFeatures(text, [{ name: `Boon (level ${level})`, text: `Choose one with your DM: ${BOONS.map((boon) => boon.name).join(', ')}.` }]);
+    } else {
+      const boon = BOONS.find((b) => b.key === boonKey);
+      if (!boon) throw new LevelUpError('That is not one of the Boons.');
+      const taken = boonTaken(text, boon);
+      if (taken >= boon.max) {
+        throw new LevelUpError(`${boon.name} can be taken ${boon.max === 1 ? 'only once' : `at most ${boon.max} times`}. Pick a different Boon.`);
+      }
+      const amount = (taken + 1) * boon.per;
+      text = addFeatures(text, [{ name: boon.name, text: boon.text(amount), upgrade: true }]);
+      if (boon.key === 'TOUGHENED') result.armorBonus = 1;
+      if (boon.key === 'HARDY') result.tempHp = amount;
+    }
+  }
+  return { specialAbilities: text, ...result };
+}
+
+// The book's unlock schedule: what a caster may be granted on reaching
+// `level`. Null for a class with no spells.
+function spellsGainedAt(characterClass, level) {
+  const kind = CASTER_KIND[characterClass];
+  if (!kind) return null;
+  const highest = maxSpellLevel(characterClass, level);
+  // Half casters: two spells at level 2, then one at each odd level.
+  const halfCasterSpells = level === 2 ? 2 : level > 2 && level % 2 === 1 ? 1 : 0;
+  return {
+    maxSpellLevel: highest,
+    // Set when this level opens up a new level of spells.
+    unlocksSpellLevel: highest > maxSpellLevel(characterClass, level - 1) ? highest : null,
+    newSpells: kind === 'HALF' ? halfCasterSpells : characterClass === 'WIZARD' ? 2 : 1,
+    newCantrips: kind !== 'HALF' && (level === 4 || level === 10) ? 1 : 0,
+  };
+}
+
+// The checklist for a character's next level. Takes the character with its
+// weapons loaded (each with its pool entry).
+function levelUpPlan(character) {
+  const toLevel = character.level + 1;
+  const entries = featuresAt(character.characterClass, toLevel);
+  return {
+    fromLevel: character.level,
+    toLevel,
+    features: entries.filter((entry) => !entry.boon).map(({ name, text, upgrade }) => ({ name, text, upgrade: Boolean(upgrade) })),
+    boon: entries.some((entry) => entry.boon) ? boonOptions(character.specialAbilities) : null,
+    spells: spellsGainedAt(character.characterClass, toLevel),
+    // The free upgrade: one weapon of standard growth goes up a level, never
+    // past its holder.
+    weapons: (character.weapons || [])
+      .filter((cw) => cw.weapon.damageScaling === 1 && cw.level < Math.min(toLevel, MAX_GEAR_LEVEL))
+      .map((cw) => ({
+        weaponId: cw.weaponId,
+        name: cw.weapon.name,
+        equipped: cw.equipped,
+        level: cw.level,
+        damageDice: scaledDamageDice(cw.weapon.damageDice, cw.level, cw.weapon.damageScaling, cw.weapon.minLevel),
+        nextDamageDice: scaledDamageDice(cw.weapon.damageDice, cw.level + 1, cw.weapon.damageScaling, cw.weapon.minLevel),
+      })),
+    // The class tables stop at level 10; past it only the numbers move.
+    beyondTables: toLevel > MAX_FEATURE_LEVEL,
+  };
+}
+
+module.exports = { LevelUpError, featuresAt, addFeatures, boonTaken, boonOptions, hardyTempHp, advance, spellsGainedAt, levelUpPlan };

backend/src/game/levelUp.test.js

@@ -0,0 +1,130 @@
+const { featuresAt, addFeatures, boonTaken, boonOptions, hardyTempHp, advance, spellsGainedAt, levelUpPlan, LevelUpError } = require('./levelUp');
+const { LEVEL_FEATURES, BOONS } = require('./data/levelFeatures');
+const { CLASSES } = require('./data/classes');
+const { composeSpecialAbilities } = require('./buildFlow');
+
+const boon = (key) => BOONS.find((b) => b.key === key);
+
+describe('the class tables', () => {
+  test('cover every class from level 2 to 10, with a Boon at 4 and 8', () => {
+    for (const cls of Object.keys(CLASSES)) {
+      expect(LEVEL_FEATURES[cls]).toBeDefined();
+      for (const level of [4, 8]) expect(featuresAt(cls, level).some((f) => f.boon)).toBe(true);
+      for (const level of Object.keys(LEVEL_FEATURES[cls])) expect(Number(level)).toBeGreaterThanOrEqual(2);
+    }
+    // Fighters get a third Boon at 6, rogues at 10.
+    expect(featuresAt('FIGHTER', 6).some((f) => f.boon)).toBe(true);
+    expect(featuresAt('ROGUE', 10).some((f) => f.boon)).toBe(true);
+    expect(featuresAt('WIZARD', 6).some((f) => f.boon)).toBe(false);
+  });
+
+  test('every feature has a name and a text', () => {
+    for (const levels of Object.values(LEVEL_FEATURES)) {
+      for (const features of Object.values(levels)) {
+        for (const f of features) expect(f.boon || (f.name && f.text)).toBeTruthy();
+      }
+    }
+  });
+
+  test('casters are told at level 5 that cantrips double; others are not', () => {
+    expect(featuresAt('WIZARD', 5).map((f) => f.name)).toContain('Cantrips');
+    expect(featuresAt('PALADIN', 5).map((f) => f.name)).toEqual(['Extra Attack', 'Cantrips']);
+    expect(featuresAt('FIGHTER', 5).map((f) => f.name)).toEqual(['Extra Attack']);
+  });
+
+  test('nothing is written past level 10', () => {
+    expect(featuresAt('FIGHTER', 11)).toEqual([]);
+  });
+});
+
+describe('addFeatures', () => {
+  test('adds a new feature as a line of its own, once', () => {
+    const once = addFeatures('Second Wind — heal.', [{ name: 'Action Surge', text: 'One extra action.' }]);
+    expect(once).toBe('Second Wind — heal.\nAction Surge — One extra action.');
+    expect(addFeatures(once, [{ name: 'Action Surge', text: 'One extra action.' }])).toBe(once);
+  });
+
+  test('an upgrade takes the place of the line with its name, however the dash was typed', () => {
+    const upgrade = { name: 'Sneak Attack', text: '2d6.', upgrade: true };
+    expect(addFeatures('Sneak Attack — 1d6.\nThieves’ Cant — slang.', [upgrade])).toBe('Sneak Attack — 2d6.\nThieves’ Cant — slang.');
+    expect(addFeatures('sneak attack -- 1d6.', [upgrade])).toBe('Sneak Attack — 2d6.');
+    // With no line to rewrite it is simply added.
+    expect(addFeatures(null, [upgrade])).toBe('Sneak Attack — 2d6.');
+  });
+
+  test('a feature that is not an upgrade leaves a line of the same name alone', () => {
+    const text = addFeatures('Favored Enemy — Undead.', [{ name: 'Favored Enemy', text: 'Choose a second.' }]);
+    expect(text).toBe('Favored Enemy — Undead.\nFavored Enemy — Choose a second.');
+  });
+});
+
+describe('advance', () => {
+  test('a rogue reaching level 3 has a bigger Sneak Attack and two new features', () => {
+    const level1 = composeSpecialAbilities('HUMAN', 'ROGUE', []);
+    const { specialAbilities } = advance(advance(level1, 'ROGUE', 2).specialAbilities, 'ROGUE', 3);
+    const lines = specialAbilities.split('\n');
+    expect(lines.filter((l) => l.startsWith('Sneak Attack'))).toEqual([expect.stringContaining('2d6')]);
+    expect(lines.some((l) => l.startsWith('Cunning Action — '))).toBe(true);
+    expect(lines.some((l) => l.startsWith('Fast Hands — '))).toBe(true);
+    expect(lines.some((l) => l.startsWith('Versatile — '))).toBe(true); // what was there stays
+  });
+
+  test('a Boon is written down, and says what it does beyond the text', () => {
+    expect(advance(null, 'FIGHTER', 4, 'TOUGHENED')).toEqual({ specialAbilities: 'Toughened — +1 AC (counted in your Extra AC).', armorBonus: 1, tempHp: 0 });
+    const hardy = advance(null, 'FIGHTER', 4, 'HARDY');
+    expect(hardy).toMatchObject({ armorBonus: 0, tempHp: 5 });
+    // Taken again, its one line grows.
+    const twice = advance(hardy.specialAbilities, 'FIGHTER', 6, 'HARDY');
+    expect(twice.specialAbilities).toBe('Hardy — +10 maximum HP: gain 10 Temp HP after each long rest.');
+    expect(twice.tempHp).toBe(10);
+    expect(hardyTempHp(twice.specialAbilities)).toBe(10);
+  });
+
+  test('a Boon cannot be taken more often than it allows', () => {
+    const toughened = advance(null, 'FIGHTER', 4, 'TOUGHENED').specialAbilities;
+    expect(() => advance(toughened, 'FIGHTER', 6, 'TOUGHENED')).toThrow(LevelUpError);
+    const mastery = advance(advance(null, 'FIGHTER', 4, 'WEAPON_MASTERY').specialAbilities, 'FIGHTER', 6, 'WEAPON_MASTERY').specialAbilities;
+    expect(boonTaken(mastery, boon('WEAPON_MASTERY'))).toBe(2);
+    expect(() => advance(mastery, 'FIGHTER', 8, 'WEAPON_MASTERY')).toThrow(LevelUpError);
+    expect(() => advance(null, 'FIGHTER', 4, 'FLIGHT')).toThrow(LevelUpError);
+    expect(boonOptions(mastery).find((o) => o.key === 'WEAPON_MASTERY').available).toBe(false);
+    expect(boonOptions(mastery).find((o) => o.key === 'HARDY')).toMatchObject({ available: true, taken: 0 });
+  });
+
+  test('with no Boon picked the line says one is owed', () => {
+    const { specialAbilities, armorBonus } = advance(null, 'WIZARD', 4);
+    expect(specialAbilities).toBe('Boon (level 4) — Choose one with your DM: Weapon Mastery, Arcane Focus, Toughened, Hardy.');
+    expect(armorBonus).toBe(0);
+  });
+});
+
+describe('spellsGainedAt', () => {
+  test('follows the unlock schedule', () => {
+    expect(spellsGainedAt('FIGHTER', 3)).toBeNull();
+    expect(spellsGainedAt('WIZARD', 3)).toEqual({ maxSpellLevel: 2, unlocksSpellLevel: 2, newSpells: 2, newCantrips: 0 });
+    expect(spellsGainedAt('CLERIC', 4)).toEqual({ maxSpellLevel: 2, unlocksSpellLevel: null, newSpells: 1, newCantrips: 1 });
+    expect(spellsGainedAt('WARLOCK', 5)).toMatchObject({ maxSpellLevel: 3, unlocksSpellLevel: 3, newSpells: 1 });
+    // Half casters: two spells at level 2, then one at each odd level.
+    expect(spellsGainedAt('PALADIN', 2)).toEqual({ maxSpellLevel: 1, unlocksSpellLevel: 1, newSpells: 2, newCantrips: 0 });
+    expect(spellsGainedAt('RANGER', 4)).toMatchObject({ newSpells: 0, newCantrips: 0 });
+    expect(spellsGainedAt('RANGER', 5)).toMatchObject({ maxSpellLevel: 2, unlocksSpellLevel: 2, newSpells: 1 });
+  });
+});
+
+describe('levelUpPlan', () => {
+  const held = (over) => ({ weaponId: 'w', equipped: true, level: 1, weapon: { name: 'Longsword', damageDice: '1d8', damageScaling: 1, minLevel: 1 }, ...over });
+
+  test('lists the features, the Boon and the weapons that can take the free upgrade', () => {
+    const plan = levelUpPlan({ level: 3, characterClass: 'FIGHTER', specialAbilities: null, weapons: [held(), held({ weaponId: 'p', weapon: { name: 'Dawnblade', damageDice: '1d8', damageScaling: 2, minLevel: 1 } }), held({ weaponId: 'top', level: 4 })] });
+    expect(plan).toMatchObject({ fromLevel: 3, toLevel: 4, features: [], spells: null, beyondTables: false });
+    expect(plan.boon).toHaveLength(4);
+    // Only standard growth, and never past the character's new level.
+    expect(plan.weapons).toEqual([{ weaponId: 'w', name: 'Longsword', equipped: true, level: 1, damageDice: '1d8', nextDamageDice: '1d10' }]);
+  });
+
+  test('has no Boon to pick at a level that grants none', () => {
+    const plan = levelUpPlan({ level: 1, characterClass: 'FIGHTER', specialAbilities: null, weapons: [] });
+    expect(plan.boon).toBeNull();
+    expect(plan.features.map((f) => f.name)).toEqual(['Action Surge']);
+  });
+});

backend/src/game/spellSlots.test.js

@@ -0,0 +1,78 @@
+const { spellSlotsFor, spellSlotState, maxSpellLevel, hitDiceState, computeCharacterSheet } = require('./calculations');
+
+describe('spellSlotsFor', () => {
+  test('full casters follow the standard table', () => {
+    expect(spellSlotsFor('WIZARD', 1)).toEqual({ kind: 'FULL', restoresOn: 'LONG', max: [2] });
+    expect(spellSlotsFor('CLERIC', 3).max).toEqual([4, 2]);
+    expect(spellSlotsFor('BARD', 5).max).toEqual([4, 3, 2]);
+    expect(spellSlotsFor('DRUID', 9).max).toEqual([4, 3, 3, 3, 1]);
+    expect(spellSlotsFor('SORCERER', 10).max).toEqual([4, 3, 3, 3, 2]);
+    expect(spellSlotsFor('WIZARD', 20).max).toEqual([4, 3, 3, 3, 3, 2, 2, 1, 1]);
+  });
+
+  test('half casters start at level 2', () => {
+    expect(spellSlotsFor('PALADIN', 1).max).toEqual([]);
+    expect(spellSlotsFor('PALADIN', 2).max).toEqual([2]);
+    expect(spellSlotsFor('RANGER', 4).max).toEqual([3]);
+    expect(spellSlotsFor('RANGER', 5).max).toEqual([4, 2]);
+    expect(spellSlotsFor('PALADIN', 10).max).toEqual([4, 3, 2]);
+  });
+
+  test('a warlock has a few slots, all of one level, back on a short rest', () => {
+    expect(spellSlotsFor('WARLOCK', 1)).toEqual({ kind: 'PACT', restoresOn: 'SHORT', max: [1] });
+    expect(spellSlotsFor('WARLOCK', 2).max).toEqual([2]);
+    expect(spellSlotsFor('WARLOCK', 3).max).toEqual([0, 2]);
+    expect(spellSlotsFor('WARLOCK', 9).max).toEqual([0, 0, 0, 0, 2]);
+  });
+
+  test('classes without spells have none', () => {
+    for (const cls of ['FIGHTER', 'BARBARIAN', 'ROGUE', 'MONK', null]) expect(spellSlotsFor(cls, 10)).toBeNull();
+  });
+});
+
+describe('spellSlotState', () => {
+  test('counts what is spent against what there is', () => {
+    expect(spellSlotState('WIZARD', 3, [1, 2]).levels).toEqual([
+      { level: 1, max: 4, used: 1, remaining: 3 },
+      { level: 2, max: 2, used: 2, remaining: 0 },
+    ]);
+  });
+
+  test('never counts more spent than the class has, or a level it has lost', () => {
+    expect(spellSlotState('WIZARD', 1, [9, 2]).levels).toEqual([{ level: 1, max: 2, used: 2, remaining: 0 }]);
+  });
+
+  test('lists only the slot levels a warlock actually has', () => {
+    expect(spellSlotState('WARLOCK', 5, [0, 0, 1])).toEqual({ kind: 'PACT', restoresOn: 'SHORT', levels: [{ level: 3, max: 2, used: 1, remaining: 1 }] });
+  });
+
+  test('is null where there is nothing to track', () => {
+    expect(spellSlotState('FIGHTER', 5, [])).toBeNull();
+    expect(spellSlotState('PALADIN', 1, [])).toBeNull();
+  });
+});
+
+describe('maxSpellLevel', () => {
+  test('is the highest slot level, as in the unlock schedule', () => {
+    expect([1, 3, 5, 7, 9].map((level) => maxSpellLevel('WIZARD', level))).toEqual([1, 2, 3, 4, 5]);
+    expect([1, 3, 5, 7, 9].map((level) => maxSpellLevel('WARLOCK', level))).toEqual([1, 2, 3, 4, 5]);
+    expect([1, 2, 5, 9].map((level) => maxSpellLevel('PALADIN', level))).toEqual([0, 1, 2, 3]);
+    expect(maxSpellLevel('ROGUE', 9)).toBe(0);
+  });
+});
+
+describe('hitDiceState', () => {
+  test('one die per level, of the class size, less what is spent', () => {
+    expect(hitDiceState('BARBARIAN', 4, 1)).toEqual({ size: 12, count: 4, used: 1, remaining: 3 });
+    expect(hitDiceState('WIZARD', 2, 9)).toEqual({ size: 6, count: 2, used: 2, remaining: 0 });
+  });
+});
+
+describe('the sheet', () => {
+  test('carries the slot tracker and the Hit Dice', () => {
+    const sheet = computeCharacterSheet({ characterClass: 'CLERIC', level: 3, spellSlotsUsed: [1], hitDiceUsed: 2 });
+    expect(sheet.spellSlots.levels.map((s) => s.remaining)).toEqual([3, 2]);
+    expect(sheet.hitDice).toEqual({ size: 8, count: 3, used: 2, remaining: 1 });
+    expect(computeCharacterSheet({ characterClass: 'ROGUE', level: 3 }).spellSlots).toBeNull();
+  });
+});

backend/src/index.js

@@ -1,4 +1,4 @@
-require('dotenv').config();
+require('dotenv').config({ quiet: true });
 const http = require('http');
 const { Server } = require('socket.io');
 const { createApp } = require('./app');

backend/src/middleware/campaignAccess.js

@@ -12,11 +12,18 @@ function requireCampaignMember() {
   return async (req, res, next) => {
     const campaignId = req.params.campaignId || req.params.id;
     try {
-      const campaign = await prisma.campaign.findUnique({ where: { id: campaignId } });
-      if (!campaign) return res.status(404).json({ error: 'Campaign not found' });
-
-      const membership = await loadCampaignMembership(req.user.id, campaignId);
-      if (!membership) return res.status(403).json({ error: 'Not a member of this campaign' });
+      // One query for a member, which is nearly every request. Only when it
+      // finds nothing is the campaign looked up, to tell a 404 from a 403.
+      const found = await prisma.campaignMember.findUnique({
+        where: { campaignId_userId: { campaignId, userId: req.user.id } },
+        include: { campaign: true },
+      });
+      if (!found) {
+        const exists = await prisma.campaign.findUnique({ where: { id: campaignId }, select: { id: true } });
+        if (!exists) return res.status(404).json({ error: 'Campaign not found' });
+        return res.status(403).json({ error: 'Not a member of this campaign' });
+      }
+      const { campaign, ...membership } = found;
 
       req.campaign = campaign;
       req.membership = membership;

backend/src/routes/campaigns.routes.js

@@ -4,8 +4,16 @@ const prisma = require('../db');
 const { requireAuth } = require('../middleware/auth');
 const { requireCampaignMember, requireDM } = require('../middleware/campaignAccess');
 const { generateInviteCode } = require('../utils/inviteCode');
-const { computeCharacterSheet, MAX_DAMAGE_SCALING, MAX_GEAR_LEVEL } = require('../game/calculations');
-const { WEAPON_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY } = require('../game/data/library');
+const { computeCharacterSheet, GEAR_STATS, MAX_DAMAGE_SCALING, MAX_GEAR_LEVEL, MAX_LEVEL } = require('../game/calculations');
+const { rollDie } = require('../game/buildFlow');
+const { SHEET_INCLUDE, sheetOf, settleHp } = require('../utils/sheet');
+const { WEAPON_LIBRARY, ITEM_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY } = require('../game/data/library');
+const { visitedLocationIds } = require('../utils/locations');
+const { deathSaveInfo, lifeState } = require('../utils/hp');
+const { hitDiceProblem, shortRest, longRest } = require('../utils/rest');
+const { CURRENCIES } = require('../utils/grants');
+const { findSeed, normalizeCode, CODE_LENGTH } = require('../seeds');
+const { createCampaignFromSeed } = require('../seeds/createCampaign');
 
 const router = express.Router();
 
@@ -16,11 +24,16 @@ function campaignSummary(campaign, role) {
     id: campaign.id,
     name: campaign.name,
     description: campaign.description,
-    inviteCode: campaign.inviteCode,
+    // The invite code is the DM's to hand out.
+    inviteCode: role === 'DM' ? campaign.inviteCode : undefined,
     startingGold: campaign.startingGold,
     startingItemCount: campaign.startingItemCount,
     startingSpellCount: campaign.startingSpellCount,
     skipMotivationRoll: campaign.skipMotivationRoll,
+    showMonsterHp: campaign.showMonsterHp,
+    areaAttackAcPenalty: campaign.areaAttackAcPenalty,
+    maxEquipped: campaign.maxEquipped,
+    maxEquippedWeapons: campaign.maxEquippedWeapons,
     ownerId: campaign.ownerId,
     archivedAt: campaign.archivedAt,
     role,
@@ -45,10 +58,17 @@ router.get('/', async (req, res, next) => {
 const createCampaignSchema = z.object({
   name: z.string().min(1).max(120),
   description: z.string().max(2000).optional().nullable(),
-  startingGold: z.number().int().min(0).optional(),
-  startingItemCount: z.number().int().min(0).optional(),
-  startingSpellCount: z.number().int().min(0).optional(),
+  startingGold: z.number().int().min(0).max(1000000).optional(),
+  startingItemCount: z.number().int().min(0).max(50).optional(),
+  startingSpellCount: z.number().int().min(0).max(50).optional(),
   skipMotivationRoll: z.boolean().optional(),
+  showMonsterHp: z.boolean().optional(),
+  areaAttackAcPenalty: z.number().int().min(0).max(10).optional(),
+  // How many weapons and items a character can have equipped together, and
+  // how many of those can be weapons. Lowering them takes nothing off anyone:
+  // they are checked when something is put on.
+  maxEquipped: z.number().int().min(1).max(20).optional(),
+  maxEquippedWeapons: z.number().int().min(0).max(20).optional(),
 });
 
 // POST /campaigns — create, creator becomes DM/owner
@@ -80,6 +100,28 @@ router.post('/', async (req, res, next) => {
   }
 });
 
+// POST /campaigns/from-seed — a ready-made world (a file in /backend/seeds)
+// as a new campaign, by its code. As with a blank campaign, whoever creates
+// it is its DM and owner; the same code can be used again for another copy.
+router.post('/from-seed', async (req, res, next) => {
+  try {
+    const parsed = z.object({ code: z.string().max(40) }).safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    if (normalizeCode(parsed.data.code).length !== CODE_LENGTH) {
+      return res.status(400).json({ error: `A world code is ${CODE_LENGTH} letters or numbers` });
+    }
+    const seed = findSeed(parsed.data.code);
+    if (!seed) return res.status(404).json({ error: 'There is no world with that code' });
+
+    // One transaction, so a failure doesn't leave half a world behind. A big
+    // world is thousands of rows, which is more than the default 5 seconds.
+    const campaign = await prisma.$transaction((tx) => createCampaignFromSeed(tx, req.user, seed), { timeout: 120000, maxWait: 20000 });
+    res.status(201).json({ campaign: campaignSummary(campaign, 'DM') });
+  } catch (err) {
+    next(err);
+  }
+});
+
 // POST /campaigns/join/:inviteCode — must be before requireCampaignMember-gated routes below
 router.post('/join/:inviteCode', async (req, res, next) => {
   try {
@@ -190,9 +232,18 @@ function characterSummary(character) {
     buildStage: character.buildStage,
     currentHp: character.currentHp,
     tempHp: character.tempHp,
+    deathSaves: deathSaveInfo(character),
     gold: character.gold,
+    silver: character.silver,
+    copper: character.copper,
+    cash: character.cash,
     maxHp: character.buildStage === 'COMPLETE' ? sheet.hp.max : null,
     armorClass: character.buildStage === 'COMPLETE' ? sheet.armorClass : null,
+    // What is left to spend before the next rest: the slot tracker (null for
+    // a character with no spell slots) and Hit Dice, with the Constitution
+    // modifier each die healed is rolled with.
+    spellSlots: character.buildStage === 'COMPLETE' ? sheet.spellSlots : null,
+    hitDice: character.buildStage === 'COMPLETE' ? { ...sheet.hitDice, conModifier: sheet.abilities.CON.modifier } : null,
     currentLocationId: character.currentLocationId,
     currentLocationName: character.currentLocation ? character.currentLocation.name : null,
   };
@@ -202,10 +253,22 @@ router.get('/:id/characters', requireCampaignMember(), async (req, res, next) =>
   try {
     const characters = await prisma.character.findMany({
       where: { campaignId: req.campaign.id },
-      include: { skillProficiencies: true, saveProficiencies: true, currentLocation: true },
+      include: { ...SHEET_INCLUDE, currentLocation: true },
       orderBy: { createdAt: 'asc' },
     });
-    res.json({ characters: characters.map(characterSummary) });
+    const summaries = characters.map(characterSummary);
+    if (req.membership.role === 'DM') return res.json({ characters: summaries });
+
+    // A player sees the party's headline numbers, but another character's
+    // purse is their own business, and so is a place this player has not been.
+    const visited = await visitedLocationIds(prisma, req.user.id, req.campaign.id);
+    res.json({
+      characters: summaries.map((c) => {
+        if (c.userId === req.user.id) return c;
+        const knowsPlace = c.currentLocationId && visited.has(c.currentLocationId);
+        return { ...c, gold: null, silver: null, copper: null, cash: null, ...(knowsPlace ? {} : { currentLocationId: null, currentLocationName: null }) };
+      }),
+    });
   } catch (err) {
     next(err);
   }
@@ -252,7 +315,7 @@ router.post('/:id/characters', requireCampaignMember(), async (req, res, next) =
       },
     });
 
-    req.app.get('io').to(`campaign:${req.campaign.id}`).emit('character:created', { character: characterSummary(character) });
+    req.app.get('io').to(`campaign:${req.campaign.id}`).emit('character:created', { characterId: character.id });
     res.status(201).json({ character: characterSummary(character) });
   } catch (err) {
     next(err);
@@ -260,18 +323,122 @@ router.post('/:id/characters', requireCampaignMember(), async (req, res, next) =
 });
 
 // ---------------------------------------------------------------------------
-// Weapons (campaign-level pool; DM manages, anyone in campaign can read)
+// Rests — the DM rests any of the party at once (utils/rest.js)
 // ---------------------------------------------------------------------------
 
+const restSchema = z.object({
+  type: z.enum(['SHORT', 'LONG']),
+  characters: z
+    .array(
+      z.object({
+        characterId: z.string(),
+        // A short rest only: how many Hit Dice this character spends, and what
+        // they added up to if they were rolled at the table. Left out, the
+        // dice are rolled here.
+        hitDice: z.number().int().min(0).max(MAX_LEVEL).default(0),
+        rolled: z.number().int().min(0).max(1000).nullable().optional(),
+      })
+    )
+    .min(1)
+    .max(200),
+});
+
+// A long rest puts HP, spell slots and half the Hit Dice back. A short rest
+// spends Hit Dice to heal and gives a warlock their slots. Nothing is written
+// unless every character asked for can take the rest as asked. The answer
+// says what happened to each, in the party's order.
+router.post('/:id/rest', requireCampaignMember(), requireDM(), async (req, res, next) => {
+  try {
+    const parsed = restSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { type } = parsed.data;
+    const asked = new Map(parsed.data.characters.map((entry) => [entry.characterId, entry]));
+
+    const characters = await prisma.character.findMany({
+      where: { id: { in: [...asked.keys()] }, campaignId: req.campaign.id, buildStage: 'COMPLETE' },
+      include: SHEET_INCLUDE,
+      orderBy: { createdAt: 'asc' },
+    });
+    if (characters.length !== asked.size) {
+      return res.status(400).json({ error: 'Pick finished characters from this campaign.' });
+    }
+
+    const outcomes = [];
+    for (const character of characters) {
+      const who = { characterId: character.id, name: character.name };
+      const sheet = sheetOf(character);
+      if (lifeState(character) === 'DEAD') {
+        outcomes.push({ ...who, skipped: `${character.name} is dead: a rest does nothing for them.` });
+      } else if (type === 'LONG') {
+        outcomes.push({ ...who, skipped: null, ...longRest(character, sheet) });
+      } else {
+        const { hitDice: dice, rolled = null } = asked.get(character.id);
+        const problem = hitDiceProblem(character, sheet, dice, rolled);
+        if (problem) return res.status(400).json({ error: problem });
+        const rolls = dice > 0 && rolled == null ? Array.from({ length: dice }, () => rollDie(sheet.hitDice.size)) : null;
+        outcomes.push({ ...who, skipped: null, ...shortRest(character, sheet, { dice, rolls, rolled }) });
+      }
+    }
+
+    const rested = outcomes.filter((outcome) => outcome.data);
+    await prisma.$transaction(rested.map((outcome) => prisma.character.update({ where: { id: outcome.characterId }, data: outcome.data })));
+    const io = req.app.get('io');
+    for (const { characterId } of rested) io.to(`campaign:${req.campaign.id}`).emit('character:updated', { characterId });
+
+    res.json({ type, results: outcomes.map(({ data, result, ...who }) => ({ ...who, ...result })) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Weapons (campaign-level pool; the DM manages it and sees all of it)
+// ---------------------------------------------------------------------------
+
+// What a player may see of a pool: whatever one of their own characters holds,
+// plus the starting options while they still have a character to build. The
+// rest of the pool — gear yet to be found, spells yet to be learned — is the
+// DM's. `held` is the pool model's relation to the per-character rows.
+async function poolScope(req, held) {
+  const where = { campaignId: req.campaign.id };
+  if (req.membership.role === 'DM') return where;
+
+  const mine = { userId: req.user.id, campaignId: req.campaign.id };
+  const building = await prisma.character.count({ where: { ...mine, buildStage: { not: 'COMPLETE' } } });
+  return {
+    ...where,
+    OR: [{ [held]: { some: { character: mine } } }, ...(building > 0 ? [{ isStartingOption: true }] : [])],
+  };
+}
+
 router.get('/:id/weapons', requireCampaignMember(), async (req, res, next) => {
   try {
-    const weapons = await prisma.weapon.findMany({ where: { campaignId: req.campaign.id }, orderBy: { name: 'asc' } });
+    const weapons = await prisma.weapon.findMany({ where: await poolScope(req, 'assigned'), orderBy: { name: 'asc' } });
     res.json({ weapons });
   } catch (err) {
     next(err);
   }
 });
 
+// What a weapon or item does to the sheet of whoever has it equipped: signed
+// amounts on the numbers in GEAR_STATS (armor is an item with an AC effect),
+// and a note for what is not a number.
+const gearEffects = {
+  effects: z
+    .array(z.object({ stat: z.enum(GEAR_STATS), amount: z.number().int().min(-100).max(100).refine((n) => n !== 0, 'An effect of 0 does nothing') }))
+    .max(12)
+    .optional(),
+  effectNote: z.string().trim().max(300).optional().nullable(),
+};
+
+// A change to what a pool entry does reaches everyone who has it equipped:
+// their maximum HP may have dropped, and every open sheet should refetch.
+async function gearChanged(req, heldModel, poolKey, poolId, holderIds) {
+  const holders = holderIds || (await prisma[heldModel].findMany({ where: { [poolKey]: poolId }, select: { characterId: true } })).map((h) => h.characterId);
+  await settleHp(prisma, holders);
+  req.app.get('io').to(`campaign:${req.campaign.id}`).emit('character:updated', {});
+}
+
 const weaponSchema = z.object({
   name: z.string().min(1).max(80),
   damageDice: z.string().min(1).max(20),
@@ -283,6 +450,7 @@ const weaponSchema = z.object({
   damageScaling: z.number().int().min(1).max(MAX_DAMAGE_SCALING).optional(),
   minLevel: z.number().int().min(1).max(MAX_GEAR_LEVEL).optional(),
   isStartingOption: z.boolean().optional(),
+  ...gearEffects,
 });
 
 // Raising a pool entry's starting level lifts every held copy that is now
@@ -327,6 +495,7 @@ router.patch('/:id/weapons/:weaponId', requireCampaignMember(), requireDM(), asy
     const weapon = await updatePoolEntry('weapon', req.params.weaponId, req.campaign.id, parsed.data);
     if (!weapon) return res.status(404).json({ error: 'Weapon not found in this campaign' });
     await liftHeldCopies('characterWeapon', 'weaponId', weapon.id, parsed.data.minLevel);
+    await gearChanged(req, 'characterWeapon', 'weaponId', weapon.id);
     res.json({ weapon });
   } catch (err) {
     next(err);
@@ -335,9 +504,11 @@ router.patch('/:id/weapons/:weaponId', requireCampaignMember(), requireDM(), asy
 
 router.delete('/:id/weapons/:weaponId', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
+    const holders = (await prisma.characterWeapon.findMany({ where: { weaponId: req.params.weaponId }, select: { characterId: true } })).map((h) => h.characterId);
     if (!(await deletePoolEntry('weapon', req.params.weaponId, req.campaign.id))) {
       return res.status(404).json({ error: 'Weapon not found in this campaign' });
     }
+    await gearChanged(req, 'characterWeapon', 'weaponId', req.params.weaponId, holders);
     res.status(204).end();
   } catch (err) {
     next(err);
@@ -350,7 +521,7 @@ router.delete('/:id/weapons/:weaponId', requireCampaignMember(), requireDM(), as
 
 router.get('/:id/spells', requireCampaignMember(), async (req, res, next) => {
   try {
-    const spells = await prisma.spell.findMany({ where: { campaignId: req.campaign.id }, orderBy: { name: 'asc' } });
+    const spells = await prisma.spell.findMany({ where: await poolScope(req, 'known'), orderBy: { name: 'asc' } });
     res.json({ spells });
   } catch (err) {
     next(err);
@@ -367,6 +538,7 @@ const spellSchema = z.object({
   description: z.string().max(4000).optional().nullable(),
   damageDice: z.string().max(20).optional().nullable(),
   isStartingOption: z.boolean().optional(),
+  revives: z.boolean().optional(), // brings back the dead
 });
 
 router.post('/:id/spells', requireCampaignMember(), requireDM(), async (req, res, next) => {
@@ -409,7 +581,7 @@ router.delete('/:id/spells/:spellId', requireCampaignMember(), requireDM(), asyn
 
 router.get('/:id/items', requireCampaignMember(), async (req, res, next) => {
   try {
-    const items = await prisma.item.findMany({ where: { campaignId: req.campaign.id }, orderBy: { name: 'asc' } });
+    const items = await prisma.item.findMany({ where: await poolScope(req, 'held'), orderBy: { name: 'asc' } });
     res.json({ items });
   } catch (err) {
     next(err);
@@ -423,6 +595,7 @@ const itemSchema = z.object({
   damageScaling: z.number().int().min(1).max(MAX_DAMAGE_SCALING).optional(),
   minLevel: z.number().int().min(1).max(MAX_GEAR_LEVEL).optional(),
   isStartingOption: z.boolean().optional(),
+  ...gearEffects,
 });
 
 router.post('/:id/items', requireCampaignMember(), requireDM(), async (req, res, next) => {
@@ -443,6 +616,7 @@ router.patch('/:id/items/:itemId', requireCampaignMember(), requireDM(), async (
     const item = await updatePoolEntry('item', req.params.itemId, req.campaign.id, parsed.data);
     if (!item) return res.status(404).json({ error: 'Item not found in this campaign' });
     await liftHeldCopies('inventoryItem', 'itemId', item.id, parsed.data.minLevel);
+    await gearChanged(req, 'inventoryItem', 'itemId', item.id);
     res.json({ item });
   } catch (err) {
     next(err);
@@ -451,9 +625,11 @@ router.patch('/:id/items/:itemId', requireCampaignMember(), requireDM(), async (
 
 router.delete('/:id/items/:itemId', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
+    const holders = (await prisma.inventoryItem.findMany({ where: { itemId: req.params.itemId }, select: { characterId: true } })).map((h) => h.characterId);
     if (!(await deletePoolEntry('item', req.params.itemId, req.campaign.id))) {
       return res.status(404).json({ error: 'Item not found in this campaign' });
     }
+    await gearChanged(req, 'inventoryItem', 'itemId', req.params.itemId, holders);
     res.status(204).end();
   } catch (err) {
     next(err);
@@ -476,8 +652,8 @@ router.get('/:id/monsters', requireCampaignMember(), requireDM(), async (req, re
 
 const monsterSchema = z.object({
   name: z.string().min(1).max(80),
-  ac: z.number().int().min(0),
-  maxHp: z.number().int().min(1),
+  ac: z.number().int().min(0).max(50),
+  maxHp: z.number().int().min(1).max(100000),
   speed: z.number().int().min(0).optional(),
   strScore: z.number().int().min(1).max(30).optional(),
   dexScore: z.number().int().min(1).max(30).optional(),
@@ -485,8 +661,8 @@ const monsterSchema = z.object({
   intScore: z.number().int().min(1).max(30).optional(),
   wisScore: z.number().int().min(1).max(30).optional(),
   chaScore: z.number().int().min(1).max(30).optional(),
-  attackBonus: z.number().int().optional(),
-  damageDice: z.string().max(20).optional().nullable(),
+  attackBonus: z.number().int().min(-20).max(50).optional(),
+  damageDice: z.string().max(60).optional().nullable(), // may name its type: "1d6+2 necrotic"
   challengeRating: z.string().max(10).optional().nullable(),
   specialTrait: z.string().max(500).optional().nullable(),
   notes: z.string().max(2000).optional().nullable(),
@@ -533,9 +709,11 @@ router.delete('/:id/monsters/:monsterId', requireCampaignMember(), requireDM(),
 router.get('/:id/encounters', requireCampaignMember(), async (req, res, next) => {
   try {
     const isDM = req.membership.role === 'DM';
-    // Archived encounters are the DM's to see; players only get the live list.
+    // The DM sees every encounter. A player sees the live ones that one of
+    // their own characters is in, and nothing of the rest.
+    const mine = { archivedAt: null, participants: { some: { character: { userId: req.user.id } } } };
     const encounters = await prisma.encounter.findMany({
-      where: { campaignId: req.campaign.id, ...(isDM ? {} : { archivedAt: null }) },
+      where: { campaignId: req.campaign.id, ...(isDM ? {} : mine) },
       orderBy: [{ sortOrder: 'asc' }, { createdAt: 'desc' }],
     });
     // dmNotes never leaves the server for a player.
@@ -549,12 +727,18 @@ const createEncounterSchema = z.object({
   name: z.string().min(1).max(120),
   mode: z.enum(['BATTLE', 'QUEST']).optional(),
   description: z.string().max(4000).optional().nullable(),
+  locationId: z.string().optional().nullable(),
 });
 
 router.post('/:id/encounters', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
     const parsed = createEncounterSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    if (parsed.data.locationId) {
+      const location = await prisma.location.findFirst({ where: { id: parsed.data.locationId, campaignId: req.campaign.id } });
+      if (!location) return res.status(400).json({ error: 'That location is not part of this campaign.' });
+    }
+
     // A new encounter goes to the top of the campaign's order.
     const first = await prisma.encounter.aggregate({ where: { campaignId: req.campaign.id }, _min: { sortOrder: true } });
     const encounter = await prisma.encounter.create({
@@ -597,7 +781,11 @@ router.put('/:id/encounters/order', requireCampaignMember(), requireDM(), async
 
 router.get('/:id/npcs', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
-    const npcs = await prisma.npc.findMany({ where: { campaignId: req.campaign.id }, orderBy: { name: 'asc' } });
+    const npcs = await prisma.npc.findMany({
+      where: { campaignId: req.campaign.id },
+      include: { wares: { include: WARE_INCLUDE, orderBy: { createdAt: 'asc' } } },
+      orderBy: { name: 'asc' },
+    });
     res.json({ npcs });
   } catch (err) {
     next(err);
@@ -610,16 +798,35 @@ const npcSchema = z.object({
   disposition: z.enum(['FRIENDLY', 'NEUTRAL', 'HOSTILE']).optional(),
   description: z.string().max(2000).optional().nullable(),
   dmNotes: z.string().max(4000).optional().nullable(),
-  ac: z.number().int().min(0).optional().nullable(),
-  maxHp: z.number().int().min(1).optional().nullable(),
-  attackBonus: z.number().int().optional().nullable(),
+  ac: z.number().int().min(0).max(50).optional().nullable(),
+  maxHp: z.number().int().min(1).max(100000).optional().nullable(),
+  attackBonus: z.number().int().min(-20).max(50).optional().nullable(),
   damageDice: z.string().max(20).optional().nullable(),
+  // The money changer's rate: exchangeGold gold for exchangeCash cash. Both
+  // null for an NPC who does not change money.
+  exchangeGold: z.number().int().min(1).max(1000000).optional().nullable(),
+  exchangeCash: z.number().int().min(1).max(1000000).optional().nullable(),
 });
 
+// A rate has two sides: both are given, or both are cleared.
+function halfARate(data) {
+  const sides = [data.exchangeGold, data.exchangeCash];
+  return sides.some((side) => side === undefined) !== sides.every((side) => side === undefined) || (sides[0] === null) !== (sides[1] === null);
+}
+const HALF_A_RATE = 'An exchange rate needs both sides: so much gold for so much cash.';
+
+const WARE_INCLUDE = { weapon: true, item: true };
+
+// Open encounter pages refetch: what is for sale in a scene just changed.
+function emitTradeChanged(req) {
+  req.app.get('io').to(`campaign:${req.campaign.id}`).emit('encounter:participant-updated', {});
+}
+
 router.post('/:id/npcs', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
     const parsed = npcSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    if (halfARate(parsed.data)) return res.status(400).json({ error: HALF_A_RATE });
     const npc = await prisma.npc.create({ data: { ...parsed.data, campaignId: req.campaign.id } });
     res.status(201).json({ npc });
   } catch (err) {
@@ -631,8 +838,10 @@ router.patch('/:id/npcs/:npcId', requireCampaignMember(), requireDM(), async (re
   try {
     const parsed = npcSchema.partial().safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    if (halfARate(parsed.data)) return res.status(400).json({ error: HALF_A_RATE });
     const npc = await updatePoolEntry('npc', req.params.npcId, req.campaign.id, parsed.data);
     if (!npc) return res.status(404).json({ error: 'NPC not found in this campaign' });
+    emitTradeChanged(req);
     res.json({ npc });
   } catch (err) {
     next(err);
@@ -676,12 +885,17 @@ router.get('/:id/notes', requireCampaignMember(), async (req, res, next) => {
 });
 
 // ---------------------------------------------------------------------------
-// Locations — DM-managed, used to track where each character currently is
+// Locations — DM-managed, used to track where each character currently is.
+// A player only sees the places one of their own characters has been to.
 // ---------------------------------------------------------------------------
 
 router.get('/:id/locations', requireCampaignMember(), async (req, res, next) => {
   try {
-    const locations = await prisma.location.findMany({ where: { campaignId: req.campaign.id }, orderBy: { name: 'asc' } });
+    const where = { campaignId: req.campaign.id };
+    if (req.membership.role !== 'DM') {
+      where.id = { in: [...(await visitedLocationIds(prisma, req.user.id, req.campaign.id))] };
+    }
+    const locations = await prisma.location.findMany({ where, orderBy: { name: 'asc' } });
     res.json({ locations });
   } catch (err) {
     next(err);
@@ -727,15 +941,100 @@ router.delete('/:id/locations/:locationId', requireCampaignMember(), requireDM()
   }
 });
 
+// ---------------------------------------------------------------------------
+// Wares — weapons and items for sale, by an NPC or at an encounter itself.
+// Only the DM sets them up. Players see them, and buy, on the encounter page
+// (encounters.routes.js); an NPC's wares go wherever the NPC does.
+// ---------------------------------------------------------------------------
+
+const wareSchema = z
+  .object({
+    npcId: z.string().optional(),
+    encounterId: z.string().optional(),
+    weaponId: z.string().optional(),
+    itemId: z.string().optional(),
+    price: z.number().int().min(1).max(1000000),
+    currency: z.enum(CURRENCIES).default('GOLD'),
+    level: z.number().int().min(1).max(MAX_GEAR_LEVEL).optional(),
+    stock: z.number().int().min(0).max(9999).optional().nullable(), // null: no limit
+  })
+  .refine((data) => Boolean(data.npcId) !== Boolean(data.encounterId), { message: 'Say who sells it: an NPC or an encounter, not both' })
+  .refine((data) => Boolean(data.weaponId) !== Boolean(data.itemId), { message: 'Pick one weapon or one item to sell' });
+
+router.post('/:id/wares', requireCampaignMember(), requireDM(), async (req, res, next) => {
+  try {
+    const parsed = wareSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const data = parsed.data;
+    const inCampaign = async (model, id) => (id ? prisma[model].findFirst({ where: { id, campaignId: req.campaign.id } }) : null);
+
+    const seller = (await inCampaign('npc', data.npcId)) || (await inCampaign('encounter', data.encounterId));
+    if (!seller) return res.status(400).json({ error: 'That seller is not part of this campaign.' });
+    const entry = (await inCampaign('weapon', data.weaponId)) || (await inCampaign('item', data.itemId));
+    if (!entry) return res.status(400).json({ error: `That ${data.weaponId ? 'weapon' : 'item'} is not part of this campaign.` });
+    const level = data.level ?? entry.minLevel;
+    if (level < entry.minLevel) {
+      return res.status(400).json({ error: `${entry.name} starts at level ${entry.minLevel} and can't go below it.` });
+    }
+
+    const ware = await prisma.saleOffer.create({ data: { ...data, level, campaignId: req.campaign.id }, include: WARE_INCLUDE });
+    emitTradeChanged(req);
+    res.status(201).json({ ware });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// The price and what is left can change; what is sold, and by whom, cannot.
+const patchWareSchema = z.object({
+  price: z.number().int().min(1).max(1000000).optional(),
+  currency: z.enum(CURRENCIES).optional(),
+  stock: z.number().int().min(0).max(9999).nullable().optional(),
+});
+
+router.patch('/:id/wares/:wareId', requireCampaignMember(), requireDM(), async (req, res, next) => {
+  try {
+    const parsed = patchWareSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    if (!(await updatePoolEntry('saleOffer', req.params.wareId, req.campaign.id, parsed.data))) {
+      return res.status(404).json({ error: 'Nothing like that is for sale in this campaign' });
+    }
+    emitTradeChanged(req);
+    res.json({ ware: await prisma.saleOffer.findUnique({ where: { id: req.params.wareId }, include: WARE_INCLUDE }) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+router.delete('/:id/wares/:wareId', requireCampaignMember(), requireDM(), async (req, res, next) => {
+  try {
+    if (!(await deletePoolEntry('saleOffer', req.params.wareId, req.campaign.id))) {
+      return res.status(404).json({ error: 'Nothing like that is for sale in this campaign' });
+    }
+    emitTradeChanged(req);
+    res.status(204).end();
+  } catch (err) {
+    next(err);
+  }
+});
+
 // ---------------------------------------------------------------------------
 // Default content library — static SRD-style weapons/spells/monsters any
 // campaign can pull from, instead of the DM hand-typing everything. See
 // backend/src/game/data/{weapons,spells,monsters}Library.js for the sets.
 // ---------------------------------------------------------------------------
 
-router.get('/:id/library', requireCampaignMember(), async (req, res, next) => {
+// A library entry goes into a campaign once: it is taken for as long as the
+// pool holds a row by its name, and free again when that row is renamed or
+// deleted.
+async function inPool(model, campaignId, name) {
+  const row = await prisma[model].findFirst({ where: { campaignId, name: { equals: name, mode: 'insensitive' } }, select: { id: true } });
+  return Boolean(row);
+}
+
+router.get('/:id/library', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
-    res.json({ weapons: WEAPON_LIBRARY, spells: SPELL_LIBRARY, monsters: MONSTER_LIBRARY });
+    res.json({ weapons: WEAPON_LIBRARY, items: ITEM_LIBRARY, spells: SPELL_LIBRARY, monsters: MONSTER_LIBRARY });
   } catch (err) {
     next(err);
   }
@@ -747,6 +1046,9 @@ router.post('/:id/weapons/from-library', requireCampaignMember(), requireDM(), a
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
     const template = WEAPON_LIBRARY.find((w) => w.key === parsed.data.key);
     if (!template) return res.status(404).json({ error: 'Unknown library weapon.' });
+    if (await inPool('weapon', req.campaign.id, template.name)) {
+      return res.status(409).json({ error: `${template.name} is already in this campaign.` });
+    }
     const { key, category, ...data } = template;
     const weapon = await prisma.weapon.create({ data: { ...data, campaignId: req.campaign.id } });
     res.status(201).json({ weapon });
@@ -755,12 +1057,32 @@ router.post('/:id/weapons/from-library', requireCampaignMember(), requireDM(), a
   }
 });
 
+router.post('/:id/items/from-library', requireCampaignMember(), requireDM(), async (req, res, next) => {
+  try {
+    const parsed = z.object({ key: z.string() }).safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const template = ITEM_LIBRARY.find((i) => i.key === parsed.data.key);
+    if (!template) return res.status(404).json({ error: 'Unknown library item.' });
+    if (await inPool('item', req.campaign.id, template.name)) {
+      return res.status(409).json({ error: `${template.name} is already in this campaign.` });
+    }
+    const { key, category, ...data } = template;
+    const item = await prisma.item.create({ data: { ...data, campaignId: req.campaign.id } });
+    res.status(201).json({ item });
+  } catch (err) {
+    next(err);
+  }
+});
+
 router.post('/:id/spells/from-library', requireCampaignMember(), requireDM(), async (req, res, next) => {
   try {
     const parsed = z.object({ key: z.string() }).safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
     const template = SPELL_LIBRARY.find((s) => s.key === parsed.data.key);
     if (!template) return res.status(404).json({ error: 'Unknown library spell.' });
+    if (await inPool('spell', req.campaign.id, template.name)) {
+      return res.status(409).json({ error: `${template.name} is already in this campaign.` });
+    }
     const { key, classes, ...data } = template;
     const spell = await prisma.spell.create({ data: { ...data, campaignId: req.campaign.id } });
     res.status(201).json({ spell });
@@ -775,6 +1097,9 @@ router.post('/:id/monsters/from-library', requireCampaignMember(), requireDM(),
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
     const template = MONSTER_LIBRARY.find((m) => m.key === parsed.data.key);
     if (!template) return res.status(404).json({ error: 'Unknown library monster.' });
+    if (await inPool('monster', req.campaign.id, template.name)) {
+      return res.status(409).json({ error: `${template.name} is already in this campaign.` });
+    }
     const { key, ...data } = template;
     const monster = await prisma.monster.create({ data: { ...data, campaignId: req.campaign.id } });
     res.status(201).json({ monster });

backend/src/routes/characters.routes.js

@@ -11,9 +11,13 @@ const {
   getClassSpellcastingAbility,
   scaledDamageDice,
   canUseGear,
+  spellSlotState,
   MAX_GEAR_LEVEL,
+  MAX_LEVEL,
+  MAX_SLOT_LEVEL,
   ABILITIES,
 } = require('../game/calculations');
+const { LevelUpError, advance, levelUpPlan } = require('../game/levelUp');
 const {
   rollDie,
   rollAbilityScore,
@@ -29,7 +33,10 @@ const {
 } = require('../game/buildFlow');
 const characterOptions = require('../game/data/characterOptions');
 const { SKILLS } = require('../game/data/skills');
-const { InsufficientGoldError, adjustGold, giveGear } = require('../utils/grants');
+const { CURRENCIES, COINS, COIN_VALUE, COIN_COLUMN, InsufficientGoldError, adjustGold, spendCoins, worthInGold, giveGear } = require('../utils/grants');
+const { recordVisits } = require('../utils/locations');
+const { SHEET_INCLUDE, sheetOf, settleHp } = require('../utils/sheet');
+const { absorbDamage, NO_DEATH_SAVES, lifeState, deathSaveInfo, settleDeathSaves, changeHp, rollDeathSave } = require('../utils/hp');
 
 const router = express.Router();
 
@@ -51,7 +58,14 @@ async function loadFullCharacter(id) {
 
 // privateNotes is a real privacy boundary, not a UI hide — it's only ever
 // included in the payload for the character's own owning player.
-function serializeCharacter(character, isOwner) {
+//
+// Another player (neither the owner nor the DM) gets the sheet the party can
+// see across the table — who the character is, HP, AC, abilities, what they
+// fight with — but not what is in their pack, their purse, or where they are.
+// `isDM` defaults to true because every caller but the plain read is a write
+// route, which only the owner or the DM can reach.
+function serializeCharacter(character, isOwner, isDM = true) {
+  const restricted = !isOwner && !isDM;
   const sheet = computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies);
   return {
     id: character.id,
@@ -76,22 +90,27 @@ function serializeCharacter(character, isOwner) {
     },
     currentHp: character.currentHp,
     tempHp: character.tempHp,
+    deathSaves: deathSaveInfo(character),
     armorBonus: character.armorBonus,
     specialAbilities: character.specialAbilities,
     background: character.background,
     appearance: character.appearance,
     privateNotes: isOwner ? character.privateNotes : undefined,
     diceMode: character.diceMode,
-    currentLocationId: character.currentLocationId,
-    currentLocation: character.currentLocation || null,
-    gold: character.gold,
+    currentLocationId: restricted ? null : character.currentLocationId,
+    currentLocation: restricted ? null : character.currentLocation || null,
+    gold: restricted ? null : character.gold,
+    silver: restricted ? null : character.silver,
+    copper: restricted ? null : character.copper,
+    cash: restricted ? null : character.cash,
+    restricted,
     buildStage: character.buildStage,
     buildState: character.buildStage === 'COMPLETE' ? null : character.buildState,
     skillProficiencies: character.skillProficiencies,
     saveProficiencies: character.saveProficiencies,
     // Each held entry carries what its level works out to: the dice at that
     // level, and whether this character is high enough level to use it.
-    inventoryItems: character.inventoryItems.map((ii) => ({
+    inventoryItems: (restricted ? [] : character.inventoryItems).map((ii) => ({
       ...ii,
       scaledDamageDice: ii.item.damageDice
         ? scaledDamageDice(ii.item.damageDice, ii.level, ii.item.damageScaling, ii.item.minLevel)
@@ -126,7 +145,7 @@ router.get('/build/options', (req, res) => {
 router.get('/:id', requireCharacterAccess(), async (req, res, next) => {
   try {
     const character = await loadFullCharacter(req.character.id);
-    res.json({ character: serializeCharacter(character, req.isOwner) });
+    res.json({ character: serializeCharacter(character, req.isOwner, req.isDM) });
   } catch (err) {
     next(err);
   }
@@ -135,24 +154,28 @@ router.get('/:id', requireCharacterAccess(), async (req, res, next) => {
 const patchCharacterSchema = z.object({
   name: z.string().min(1).max(80).optional(),
   currentHp: z.number().int().optional(),
-  tempHp: z.number().int().min(0).optional(),
-  armorBonus: z.number().int().min(0).optional(),
+  tempHp: z.number().int().min(0).max(9999).optional(),
+  armorBonus: z.number().int().min(-30).max(30).optional(),
   speedOverride: z.number().int().min(0).nullable().optional(),
   specialAbilities: z.string().max(4000).nullable().optional(),
   background: z.string().max(4000).nullable().optional(),
   appearance: z.string().max(4000).nullable().optional(),
   privateNotes: z.string().max(4000).nullable().optional(),
   currentLocationId: z.string().nullable().optional(),
-  level: z.number().int().min(1).max(20).optional(),
+  level: z.number().int().min(1).max(MAX_LEVEL).optional(),
   xp: z.number().int().min(0).optional(),
+  hitDiceUsed: z.number().int().min(0).max(MAX_LEVEL).optional(),
 });
 
 // Progression and placement are the DM's call, and so is rewriting what the
 // builder composed (special abilities, background, appearance): a player
-// picks those from lists and cannot type their own. The owning player can
+// picks those from lists and cannot type their own. So are HP and temp HP:
+// a player cannot heal or hurt their own character. The owning player can
 // edit the rest of their own sheet. Gold is not patchable at all — it only
-// moves through the ledger (POST /:id/gold).
-const DM_ONLY_PATCH_FIELDS = ['level', 'xp', 'currentLocationId', 'speedOverride', 'specialAbilities', 'background', 'appearance'];
+// moves through the ledger (POST /:id/gold). The armor bonus is the DM's
+// adjustment on top of what equipped gear gives, so it is the DM's too. Hit
+// Dice are spent on a rest, which the DM runs.
+const DM_ONLY_PATCH_FIELDS = ['currentHp', 'tempHp', 'level', 'xp', 'currentLocationId', 'speedOverride', 'armorBonus', 'specialAbilities', 'background', 'appearance', 'hitDiceUsed'];
 
 function clamp(value, min, max) {
   return Math.min(Math.max(value, min), max);
@@ -160,20 +183,62 @@ function clamp(value, min, max) {
 
 router.patch('/:id', requireCharacterAccess({ write: true }), async (req, res, next) => {
   try {
-    if (req.body && req.body.gold !== undefined) {
-      return res.status(400).json({ error: 'Gold changes go through the money tracker.' });
+    if (req.body && Object.values(COIN_COLUMN).some((coin) => req.body[coin] !== undefined)) {
+      return res.status(400).json({ error: 'Gold, silver, copper and cash changes go through the money tracker.' });
     }
     const parsed = patchCharacterSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
 
     if (!req.isDM && DM_ONLY_PATCH_FIELDS.some((field) => parsed.data[field] !== undefined)) {
-      return res.status(403).json({ error: 'Only the DM can change level, XP, speed, location, special abilities, background or appearance.' });
+      return res.status(403).json({ error: 'Only the DM can change HP, temp HP, Hit Dice, level, XP, speed, armor bonus, location, special abilities, background or appearance.' });
     }
 
-    // Current HP stays within 0..max, including when a level change moves max.
-    if (req.character.buildStage === 'COMPLETE' && (parsed.data.currentHp !== undefined || parsed.data.level !== undefined)) {
-      const maxHp = computeCharacterSheet({ ...req.character, ...parsed.data }).hp.max;
-      parsed.data.currentHp = clamp(parsed.data.currentHp ?? req.character.currentHp, 0, maxHp);
+    const newLevel = parsed.data.level ?? req.character.level;
+    if (parsed.data.level !== undefined || parsed.data.hitDiceUsed !== undefined) {
+      // A character has one Hit Die per level, so none can be spent beyond that.
+      parsed.data.hitDiceUsed = Math.min(parsed.data.hitDiceUsed ?? req.character.hitDiceUsed, newLevel);
+    }
+    if (newLevel !== req.character.level) {
+      // Spent slots of a level the character no longer has are forgotten.
+      const slots = spellSlotState(req.character.characterClass, newLevel, req.character.spellSlotsUsed);
+      const tally = [];
+      for (const slot of slots ? slots.levels : []) tally[slot.level - 1] = slot.used;
+      parsed.data.spellSlotsUsed = Array.from(tally, (used) => used || 0);
+    }
+    if (req.character.buildStage === 'COMPLETE' && newLevel > req.character.level && parsed.data.specialAbilities === undefined) {
+      // Setting a higher level by hand still writes down what the class gains
+      // on the way there. A Boon is left as a line saying one is owed: picking
+      // it is part of levelling up properly (POST /:id/level-up).
+      let abilities = req.character.specialAbilities;
+      for (let level = req.character.level + 1; level <= newLevel; level++) {
+        abilities = advance(abilities, req.character.characterClass, level).specialAbilities;
+      }
+      parsed.data.specialAbilities = abilities;
+    }
+
+    // Damage is soaked by temp HP before it reaches real HP — unless this
+    // same request sets temp HP outright.
+    const settingHp = parsed.data.currentHp !== undefined;
+    const settingTempHp = parsed.data.tempHp !== undefined;
+    if (req.character.buildStage === 'COMPLETE' && (settingHp || parsed.data.level !== undefined)) {
+      // Current HP stays within 0..max, including when a level change moves max.
+      const geared = await prisma.character.findUnique({ where: { id: req.character.id }, include: SHEET_INCLUDE });
+      const maxHp = computeCharacterSheet({ ...geared, ...parsed.data }, geared.skillProficiencies, geared.saveProficiencies).hp.max;
+      if (!settingHp) {
+        parsed.data.currentHp = clamp(req.character.currentHp, 0, maxHp);
+      } else {
+        if (lifeState(req.character) === 'DEAD' && parsed.data.currentHp > 0) {
+          return res.status(400).json({ error: `${req.character.name} is dead. The DM has to revive them before they can be healed.` });
+        }
+        // Reaching 0, being hit while there, and being healed back up all
+        // move the death saves along with the HP.
+        const { tempHp, ...after } = changeHp(settingTempHp ? { ...req.character, tempHp: 0 } : req.character, parsed.data.currentHp, maxHp);
+        Object.assign(parsed.data, after, settingTempHp ? {} : { tempHp });
+      }
+    } else if (settingHp && !settingTempHp) {
+      const after = absorbDamage(req.character.currentHp, req.character.tempHp, parsed.data.currentHp);
+      parsed.data.currentHp = after.currentHp;
+      if (after.tempHp !== req.character.tempHp) parsed.data.tempHp = after.tempHp;
     }
 
     // privateNotes is for the owning player only — a DM editing someone
@@ -191,6 +256,7 @@ router.patch('/:id', requireCharacterAccess({ write: true }), async (req, res, n
     }
 
     const updated = await prisma.character.update({ where: { id: req.character.id }, data: parsed.data });
+    if (parsed.data.currentLocationId) await recordVisits(prisma, [updated.id], parsed.data.currentLocationId);
     if (updated.level < req.character.level) {
       // Dropping a level can put equipped gear and prepared spells out of reach.
       const tooHigh = { characterId: updated.id, level: { gt: updated.level } };
@@ -200,13 +266,230 @@ router.patch('/:id', requireCharacterAccess({ write: true }), async (req, res, n
         where: { characterId: updated.id, spell: { level: { gt: updated.level } } },
         data: { prepared: false },
       });
+      // Gear that came off may have been holding the maximum HP up.
+      await settleHp(prisma, [updated.id]);
     }
     const full = await loadFullCharacter(updated.id);
 
     // Broadcast payload never includes privateNotes — a socket room has
     // every campaign member in it, not just the owner. Only the direct HTTP
     // response (below) is allowed to include it.
-    req.app.get('io').to(`campaign:${updated.campaignId}`).emit('character:updated', { character: serializeCharacter(full, false) });
+    req.app.get('io').to(`campaign:${updated.campaignId}`).emit('character:updated', { characterId: full.id });
+    res.json({ character: serializeCharacter(full, req.isOwner) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Death saves — what happens to a character at 0 HP (utils/hp.js)
+// ---------------------------------------------------------------------------
+
+const deathSaveTally = z.number().int().min(0).max(3);
+const deathSaveRoll = z.number().int().min(1, 'A death save is a d20: 1 to 20').max(20, 'A death save is a d20: 1 to 20');
+
+const deathSaveSchema = z.discriminatedUnion('action', [
+  // What the d20 showed; the server works out what it means.
+  z.object({ action: z.literal('roll'), roll: deathSaveRoll }),
+  // Steadied by someone else: a Medicine check, a healer's kit, a spell.
+  z.object({ action: z.literal('stabilize') }),
+  // The DM setting the tallies by hand: a critical hit's second failure, or
+  // undoing a mistake.
+  z.object({ action: z.literal('set'), successes: deathSaveTally, failures: deathSaveTally }),
+  // The DM bringing back the dead, at 1 HP.
+  z.object({ action: z.literal('revive') }),
+]);
+
+// The owning player rolls their own death saves and can be steadied; setting
+// the tallies by hand and raising the dead are the DM's.
+router.post('/:id/death-saves', requireCharacterAccess({ write: true }), async (req, res, next) => {
+  try {
+    const parsed = deathSaveSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { character } = req;
+    if (character.buildStage !== 'COMPLETE') return res.status(400).json({ error: 'Character build is not finished yet.' });
+
+    const input = parsed.data;
+    const state = lifeState(character);
+    if ((input.action === 'set' || input.action === 'revive') && !req.isDM) {
+      return res.status(403).json({ error: 'Only the DM can do that.' });
+    }
+
+    let data;
+    if (input.action === 'roll' || input.action === 'stabilize') {
+      if (state !== 'DYING') return res.status(400).json({ error: `${character.name} is not dying, so there is no death save to make.` });
+      data = input.action === 'roll' ? rollDeathSave(character, input.roll) : { ...NO_DEATH_SAVES, stable: true };
+    } else if (input.action === 'set') {
+      if (state === 'UP') return res.status(400).json({ error: `${character.name} is not at 0 HP.` });
+      data = settleDeathSaves(input.successes, input.failures);
+    } else {
+      if (state !== 'DEAD') return res.status(400).json({ error: `${character.name} is not dead.` });
+      data = { currentHp: 1, ...NO_DEATH_SAVES };
+    }
+
+    await prisma.character.update({ where: { id: character.id }, data });
+    const full = await loadFullCharacter(character.id);
+    req.app.get('io').to(`campaign:${full.campaignId}`).emit('character:updated', { characterId: full.id });
+    res.json({ character: serializeCharacter(full, req.isOwner) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Spell slots — the slot tracker. How many slots there are comes from class
+// and level (game/calculations.js); the character row keeps how many are spent.
+// ---------------------------------------------------------------------------
+
+const ORDINALS = ['1st', '2nd', '3rd', '4th', '5th', '6th', '7th', '8th', '9th'];
+const slotLevelSchema = z.number().int().min(1).max(MAX_SLOT_LEVEL);
+
+const spellSlotSchema = z.discriminatedUnion('action', [
+  // Casting a spell: one slot of that level is spent.
+  z.object({ action: z.literal('use'), level: slotLevelSchema }),
+  // The DM setting how many of a level are spent: giving one back, or fixing a mistake.
+  z.object({ action: z.literal('set'), level: slotLevelSchema, used: z.number().int().min(0).max(9) }),
+  // The DM giving every slot back.
+  z.object({ action: z.literal('restore') }),
+]);
+
+// The owning player spends their own slots, one at a time. Getting one back
+// is the DM's: by hand here, or for everyone with a rest
+// (POST /campaigns/:id/rest).
+router.post('/:id/spell-slots', requireCharacterAccess({ write: true }), async (req, res, next) => {
+  try {
+    const parsed = spellSlotSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { character } = req;
+    if (character.buildStage !== 'COMPLETE') return res.status(400).json({ error: 'Character build is not finished yet.' });
+
+    const input = parsed.data;
+    if (input.action !== 'use' && !req.isDM) {
+      return res.status(403).json({ error: 'Only the DM can give a spell slot back.' });
+    }
+    const slots = spellSlotState(character.characterClass, character.level, character.spellSlotsUsed);
+    if (!slots) return res.status(400).json({ error: `${character.name} has no spell slots.` });
+
+    // The stored tally, squared up with what the class has at this level.
+    const used = Array.from({ length: slots.levels[slots.levels.length - 1].level }, (_, i) => {
+      const slot = slots.levels.find((s) => s.level === i + 1);
+      return slot ? slot.used : 0;
+    });
+    if (input.action === 'restore') {
+      used.fill(0);
+    } else {
+      const slot = slots.levels.find((s) => s.level === input.level);
+      if (!slot) return res.status(400).json({ error: `${character.name} has no ${ORDINALS[input.level - 1]}-level spell slots.` });
+      if (input.action === 'use') {
+        if (slot.remaining === 0) {
+          return res.status(400).json({
+            error: `${character.name} has no ${ORDINALS[input.level - 1]}-level spell slots left. They come back on a ${slots.restoresOn === 'SHORT' ? 'short or long' : 'long'} rest.`,
+          });
+        }
+        used[input.level - 1] = slot.used + 1;
+      } else {
+        used[input.level - 1] = Math.min(input.used, slot.max);
+      }
+    }
+
+    await prisma.character.update({ where: { id: character.id }, data: { spellSlotsUsed: used } });
+    const full = await loadFullCharacter(character.id);
+    emitCharacterUpdated(req);
+    res.json({ character: serializeCharacter(full, req.isOwner) });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Levelling up — one level at a time, with the checklist that goes with it
+// (game/levelUp.js): the new level, full HP, the class's new special
+// abilities, a Boon where the level grants one, new spells, fresh spell slots
+// and the free weapon upgrade.
+// ---------------------------------------------------------------------------
+
+// Answers the request and returns false when this character cannot be levelled up.
+function canLevelUp(req, res, character) {
+  let refusal = null;
+  if (!req.isDM) refusal = [403, 'Only the DM can level a character up.'];
+  else if (character.buildStage !== 'COMPLETE') refusal = [400, 'Character build is not finished yet.'];
+  else if (character.level >= MAX_LEVEL) refusal = [400, `${character.name} is already level ${MAX_LEVEL}, the highest there is.`];
+  if (refusal) res.status(refusal[0]).json({ error: refusal[1] });
+  return !refusal;
+}
+
+// What the next level brings, for the DM to look over before saying yes.
+router.get('/:id/level-up', requireCharacterAccess(), async (req, res, next) => {
+  try {
+    const character = await loadFullCharacter(req.character.id);
+    if (!canLevelUp(req, res, character)) return;
+    const plan = levelUpPlan(character);
+    const after = sheetOf({ ...character, level: plan.toLevel, spellSlotsUsed: [] });
+    res.json({ plan: { ...plan, maxHp: { from: sheetOf(character).hp.max, to: after.hp.max }, spellSlots: after.spellSlots } });
+  } catch (err) {
+    next(err);
+  }
+});
+
+const levelUpSchema = z.object({
+  boon: z.string().optional(), // which Boon, at a level that grants one
+  weaponId: z.string().nullable().optional(), // the weapon that gets the free upgrade
+  spellIds: z.array(z.string()).max(50).default([]), // spells newly granted
+});
+
+router.post('/:id/level-up', requireCharacterAccess({ write: true }), async (req, res, next) => {
+  try {
+    const parsed = levelUpSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { boon, weaponId, spellIds } = parsed.data;
+    const character = await loadFullCharacter(req.character.id);
+    if (!canLevelUp(req, res, character)) return;
+
+    const plan = levelUpPlan(character);
+    if (plan.boon && !boon) return res.status(400).json({ error: `Level ${plan.toLevel} grants a Boon: pick one.` });
+    if (!plan.boon && boon) return res.status(400).json({ error: `Level ${plan.toLevel} does not grant a Boon.` });
+    if (weaponId && !plan.weapons.some((w) => w.weaponId === weaponId)) {
+      return res.status(400).json({ error: 'That weapon cannot take the free upgrade: it has to be one this character holds, of standard growth, below their new level.' });
+    }
+    const spellsFound = await prisma.spell.count({ where: { id: { in: spellIds }, campaignId: character.campaignId } });
+    if (new Set(spellIds).size !== spellIds.length || spellsFound !== spellIds.length) {
+      return res.status(400).json({ error: "Pick the new spells from this campaign's spell list, each once." });
+    }
+
+    let gained;
+    try {
+      gained = advance(character.specialAbilities, character.characterClass, plan.toLevel, boon);
+    } catch (err) {
+      if (!(err instanceof LevelUpError)) throw err;
+      return res.status(400).json({ error: err.message });
+    }
+    const armorBonus = clamp(character.armorBonus + gained.armorBonus, -30, 30);
+    const maxHp = sheetOf({ ...character, level: plan.toLevel, armorBonus }).hp.max;
+
+    await prisma.$transaction(async (tx) => {
+      if (weaponId) {
+        await tx.characterWeapon.update({
+          where: { characterId_weaponId: { characterId: character.id, weaponId } },
+          data: { level: { increment: 1 } },
+        });
+      }
+      await tx.characterSpell.createMany({ data: spellIds.map((spellId) => ({ characterId: character.id, spellId })), skipDuplicates: true });
+      await tx.character.update({
+        where: { id: character.id },
+        data: {
+          level: plan.toLevel,
+          specialAbilities: gained.specialAbilities,
+          armorBonus,
+          tempHp: Math.max(character.tempHp, gained.tempHp),
+          spellSlotsUsed: [],
+          // The new maximum, and healed to it. Levelling does not raise the dead.
+          ...(lifeState(character) === 'DEAD' ? {} : { currentHp: maxHp, ...NO_DEATH_SAVES }),
+        },
+      });
+    });
+
+    const full = await loadFullCharacter(character.id);
+    emitCharacterUpdated(req);
     res.json({ character: serializeCharacter(full, req.isOwner) });
   } catch (err) {
     next(err);
@@ -336,6 +619,9 @@ router.post('/:id/copy', requireCharacterAccess(), async (req, res, next) => {
           speedOverride: source.speedOverride,
           specialAbilities: source.specialAbilities,
           gold: source.gold,
+          silver: source.silver,
+          copper: source.copper,
+          cash: source.cash,
           background: source.background,
           appearance: source.appearance,
           // Same privacy boundary as serializeCharacter: a DM copying a
@@ -351,10 +637,13 @@ router.post('/:id/copy', requireCharacterAccess(), async (req, res, next) => {
           },
           inventoryItems: { create: [...items.values()] },
           goldTransactions: {
-            create:
-              source.gold > 0
-                ? [{ amount: source.gold, balanceAfter: source.gold, reason: 'Carried over from another campaign', createdById: req.user.id }]
-                : [],
+            create: CURRENCIES.filter((currency) => source[COIN_COLUMN[currency]] > 0).map((currency) => ({
+              currency,
+              amount: source[COIN_COLUMN[currency]],
+              balanceAfter: source[COIN_COLUMN[currency]],
+              reason: 'Carried over from another campaign',
+              createdById: req.user.id,
+            })),
           },
           weapons: { create: [...weapons.values()] },
           spells: { create: [...spells.values()] },
@@ -364,7 +653,7 @@ router.post('/:id/copy', requireCharacterAccess(), async (req, res, next) => {
     });
 
     const full = await loadFullCharacter(copyId);
-    req.app.get('io').to(`campaign:${targetCampaignId}`).emit('character:created', { character: serializeCharacter(full, false) });
+    req.app.get('io').to(`campaign:${targetCampaignId}`).emit('character:created', { characterId: full.id });
     res.status(201).json({ character: serializeCharacter(full, true) });
   } catch (err) {
     next(err);
@@ -503,8 +792,8 @@ const chooseSchemas = {
       .optional(),
   }),
   CHOOSING_ABILITIES: z.object({ talents: z.array(z.string()) }),
-  CHOOSING_BACKGROUND: z.object({ picks: z.record(z.array(z.string())) }),
-  CHOOSING_APPEARANCE: z.object({ picks: z.record(z.array(z.string())) }),
+  CHOOSING_BACKGROUND: z.object({ picks: z.record(z.string(), z.array(z.string())) }),
+  CHOOSING_APPEARANCE: z.object({ picks: z.record(z.string(), z.array(z.string())) }),
   CHOOSING_EQUIPMENT: z.object({
     weaponIds: z.array(z.string()).default([]),
     itemIds: z.array(z.string()).default([]),
@@ -781,7 +1070,7 @@ router.post('/:id/build/finalize', requireCharacterAccess({ write: true }), asyn
     });
 
     const full = await loadFullCharacter(result.id);
-    req.app.get('io').to(`campaign:${result.campaignId}`).emit('character:created', { character: serializeCharacter(full, false) });
+    req.app.get('io').to(`campaign:${result.campaignId}`).emit('character:created', { characterId: full.id });
     res.json({ character: serializeCharacter(full, req.isOwner) });
   } catch (err) {
     next(err);
@@ -799,32 +1088,74 @@ router.get('/:id/quick-stats', requireCharacterAccess(), async (req, res, next)
       return res.status(400).json({ error: 'Character build is not finished yet.' });
     }
     const sheet = computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies);
+    // The pack, the spell list and the purse are the owner's and the DM's to
+    // see, as on the sheet; anyone else gets what is visible across the table.
+    const restricted = !req.isOwner && !req.isDM;
+    const effectsOf = (entry) => ({ effects: Array.isArray(entry.effects) ? entry.effects : [], effectNote: entry.effectNote || null });
 
-    const weapons = character.weapons
-      .filter((cw) => canUseGear(character.level, cw.level))
-      .map((cw) => ({
-        characterWeaponId: cw.id,
-        weaponId: cw.weaponId,
-        name: cw.weapon.name,
-        level: cw.level,
-        equipped: cw.equipped,
-        quantity: cw.quantity,
-        ...computeWeaponStats(cw.weapon, sheet.abilities, sheet.proficiencyBonus, true, cw.level),
-      }));
+    // Everything held is listed, usable or not: `usable` says whether the
+    // character is high enough level for it.
+    const weapons = character.weapons.map((cw) => ({
+      characterWeaponId: cw.id,
+      weaponId: cw.weaponId,
+      name: cw.weapon.name,
+      level: cw.level,
+      equipped: cw.equipped,
+      quantity: cw.quantity,
+      usable: canUseGear(character.level, cw.level),
+      ...effectsOf(cw.weapon),
+      ...computeWeaponStats(cw.weapon, sheet.abilities, sheet.proficiencyBonus, true, cw.level),
+    }));
+    const inventory = character.inventoryItems.map((ii) => ({
+      inventoryItemId: ii.id,
+      itemId: ii.itemId,
+      name: ii.item.name,
+      description: ii.item.description,
+      level: ii.level,
+      equipped: ii.equipped,
+      quantity: ii.quantity,
+      usable: canUseGear(character.level, ii.level),
+      damageDice: ii.item.damageDice ? scaledDamageDice(ii.item.damageDice, ii.level, ii.item.damageScaling, ii.item.minLevel) : null,
+      ...effectsOf(ii.item),
+    }));
+    const spells = character.spells.map((cs) => ({
+      characterSpellId: cs.id,
+      name: cs.spell.name,
+      level: cs.spell.level,
+      damageDice: cs.spell.damageDice,
+      description: cs.spell.description,
+      prepared: cs.prepared,
+      usable: canUseGear(character.level, cs.spell.level),
+    }));
 
     res.json({
       quickStats: {
+        id: character.id,
         name: character.name,
+        level: character.level,
+        species: character.species,
+        characterClass: character.characterClass,
         currentHp: character.currentHp,
         maxHp: sheet.hp.max,
         tempHp: character.tempHp,
+        deathSaves: deathSaveInfo(character),
         armorClass: sheet.armorClass,
         initiative: sheet.initiative,
         speed: sheet.speed,
         proficiencyBonus: sheet.proficiencyBonus,
         spellcasting: sheet.spellcasting,
+        spellSlots: sheet.spellSlots,
+        hitDice: sheet.hitDice,
+        passivePerception: sheet.passivePerception,
+        abilities: sheet.abilities,
         specialAbilities: character.specialAbilities,
+        // What equipped gear is adding and taking away, and what else it does.
+        gear: sheet.gear,
         weapons,
+        restricted,
+        inventory: restricted ? [] : inventory,
+        spells: restricted ? [] : spells,
+        purse: restricted ? null : { gold: character.gold, silver: character.silver, copper: character.copper, cash: character.cash },
       },
     });
   } catch (err) {
@@ -838,45 +1169,109 @@ router.get('/:id/quick-stats', requireCharacterAccess(), async (req, res, next)
 
 const GOLD_TRANSACTION_INCLUDE = { createdBy: { select: { displayName: true } } };
 
+// Which coin an amount is in; gold when none is given.
+const currencySchema = z.enum(CURRENCIES).default('GOLD');
+
+function coinName(currency) {
+  return currency.toLowerCase();
+}
+
+const PURSE_SELECT = { gold: true, silver: true, copper: true, cash: true };
+
+// For a payment the whole purse can't cover. Cash stands apart from the coins.
+function notEnoughMoney(character, amount, currency) {
+  if (currency === 'CASH') return `Not enough cash — ${character.name} has $${character.cash}, which doesn't cover $${amount}.`;
+  return `Not enough money — ${character.name} has ${character.gold} gold, ${character.silver} silver and ${character.copper} copper (worth ${worthInGold(character)} gold), which doesn't cover ${amount} ${coinName(currency)}.`;
+}
+
 router.get('/:id/gold', requireCharacterAccess(), async (req, res, next) => {
   try {
+    if (!req.isDM && !req.isOwner) return res.status(403).json({ error: "Only the character's player and the DM can see its money" });
     const transactions = await prisma.goldTransaction.findMany({
       where: { characterId: req.character.id },
       include: GOLD_TRANSACTION_INCLUDE,
       orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
     });
-    res.json({ gold: req.character.gold, transactions });
+    res.json({ gold: req.character.gold, silver: req.character.silver, copper: req.character.copper, cash: req.character.cash, transactions });
   } catch (err) {
     next(err);
   }
 });
 
-// amount is signed: positive = gained, negative = spent. The owning player
-// and the DM can both record entries; each one is stamped with who made it.
+// amount is signed: positive = gained, negative = spent. Only the DM records
+// entries here — a player cannot add money to their own purse or write it
+// off; theirs moves by giving, buying and exchanging. Each entry is stamped
+// with who made it. A spend is paid from the whole purse: if there aren't enough of the coin
+// named, bigger coins are broken (or smaller ones counted out) to cover it.
+// Cash is only ever paid in cash.
 router.post('/:id/gold', requireCharacterAccess({ write: true }), async (req, res, next) => {
   try {
     const parsed = z
       .object({
-        amount: z.number().int().refine((n) => n !== 0, 'Amount cannot be zero'),
+        amount: z.number().int().min(-1000000).max(1000000).refine((n) => n !== 0, 'Amount cannot be zero'),
+        currency: currencySchema,
         reason: z.string().trim().max(200).optional().nullable(),
       })
       .safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
-    const { amount, reason } = parsed.data;
+    const { amount, currency, reason } = parsed.data;
+    if (!req.isDM) return res.status(403).json({ error: 'Only the DM can record a gain or a spend.' });
 
-    let transaction;
+    let transactions;
     try {
       // Throwing inside the transaction rolls the balance change back.
-      transaction = await prisma.$transaction((tx) =>
-        adjustGold(tx, { characterId: req.character.id, amount, reason, userId: req.user.id, include: GOLD_TRANSACTION_INCLUDE })
-      );
+      transactions = await prisma.$transaction(async (tx) => {
+        const entry = { characterId: req.character.id, currency, reason, userId: req.user.id, include: GOLD_TRANSACTION_INCLUDE };
+        return amount > 0 ? [await adjustGold(tx, { ...entry, amount })] : spendCoins(tx, { ...entry, amount: -amount });
+      });
     } catch (err) {
       if (!(err instanceof InsufficientGoldError)) throw err;
-      return res.status(400).json({ error: `Not enough gold — the balance is ${req.character.gold}.` });
+      return res.status(400).json({ error: notEnoughMoney(req.character, -amount, currency) });
     }
 
     emitCharacterUpdated(req);
-    res.status(201).json({ gold: transaction.balanceAfter, transaction });
+    const purse = await prisma.character.findUnique({ where: { id: req.character.id }, select: PURSE_SELECT });
+    res.status(201).json({ ...purse, transaction: transactions[0], transactions });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// Changes coins of one kind into another at their fixed worth (1 gold = 10
+// silver = 100 copper). `amount` is how many `from` coins to hand over; it has
+// to come to a whole number of `to` coins. Both sides go on the ledger. Unlike
+// a spend, this moves exactly the coins named: no change is made. Cash has no
+// worth in coins, so it can't be exchanged.
+router.post('/:id/gold/exchange', requireCharacterAccess({ write: true }), async (req, res, next) => {
+  try {
+    const parsed = z
+      .object({ from: z.enum(COINS), to: z.enum(COINS), amount: z.number().int().min(1).max(1000000) })
+      .refine((data) => data.from !== data.to, { message: 'Pick two different coins' })
+      .safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { from, to, amount } = parsed.data;
+
+    const worth = amount * COIN_VALUE[from];
+    if (worth % COIN_VALUE[to] !== 0) {
+      const step = COIN_VALUE[to] / COIN_VALUE[from];
+      return res.status(400).json({ error: `${amount} ${coinName(from)} doesn't make a whole number of ${coinName(to)} — exchange in multiples of ${step}.` });
+    }
+    const received = worth / COIN_VALUE[to];
+
+    try {
+      await prisma.$transaction(async (tx) => {
+        const base = { characterId: req.character.id, userId: req.user.id };
+        await adjustGold(tx, { ...base, currency: from, amount: -amount, reason: `Exchanged for ${received} ${coinName(to)}` });
+        await adjustGold(tx, { ...base, currency: to, amount: received, reason: `Exchanged from ${amount} ${coinName(from)}` });
+      });
+    } catch (err) {
+      if (!(err instanceof InsufficientGoldError)) throw err;
+      return res.status(400).json({ error: `Not enough ${coinName(from)} — the balance is ${req.character[COIN_COLUMN[from]]}.` });
+    }
+
+    emitCharacterUpdated(req);
+    const character = await loadFullCharacter(req.character.id);
+    res.status(201).json({ character: serializeCharacter(character, req.isOwner, req.isDM), received });
   } catch (err) {
     next(err);
   }
@@ -911,6 +1306,29 @@ const GEAR = [
 
 const gearLevelSchema = z.number().int().min(1).max(MAX_GEAR_LEVEL);
 
+// A character can only have so much equipped at once (campaign settings:
+// weapons and items together, and weapons alone). Returns why `adding` — a
+// weapon or an item, not yet counted — cannot go on as well, or null if it
+// can. `exceptPoolId` is the pool entry being equipped, in case it already is.
+async function equipBlocked(req, kind, exceptPoolId) {
+  const { maxEquipped, maxEquippedWeapons } = req.campaign;
+  const where = { characterId: req.character.id, equipped: true };
+  const [weapons, items] = await Promise.all([
+    prisma.characterWeapon.findMany({ where: { ...where, ...(kind === 'weapon' ? { weaponId: { not: exceptPoolId } } : {}) }, include: { weapon: true } }),
+    prisma.inventoryItem.findMany({ where: { ...where, ...(kind === 'item' ? { itemId: { not: exceptPoolId } } : {}) }, include: { item: true } }),
+  ]);
+  const names = (rows, key) => rows.map((row) => row[key].name).join(', ');
+  if (kind === 'weapon' && weapons.length >= maxEquippedWeapons) {
+    if (maxEquippedWeapons === 0) return 'Nobody can equip a weapon in this campaign.';
+    return `${req.character.name} already has ${names(weapons, 'weapon')} equipped, and can hold ${maxEquippedWeapons === 1 ? 'one weapon' : `${maxEquippedWeapons} weapons`} at a time. Unequip it first.`;
+  }
+  if (weapons.length + items.length >= maxEquipped) {
+    const on = [names(weapons, 'weapon'), names(items, 'item')].filter(Boolean).join(', ');
+    return `${req.character.name} already has ${maxEquipped === 1 ? 'something' : `${maxEquipped} things`} equipped (${on}). Unequip one first.`;
+  }
+  return null;
+}
+
 for (const gear of GEAR) {
   const uniqueKey = `characterId_${gear.key}`;
   const whereHeld = (req) => ({ [uniqueKey]: { characterId: req.character.id, [gear.key]: req.params.poolId } });
@@ -948,6 +1366,10 @@ for (const gear of GEAR) {
       if (parsed.data[gear.flag] && !canUseGear(req.character.level, requiredLevel(parsed.data, entry))) {
         return res.status(400).json({ error: tooHighMessage(requiredLevel(parsed.data, entry)) });
       }
+      if (gear.ownLevel && parsed.data.equipped) {
+        const blocked = await equipBlocked(req, gear.pool, poolId);
+        if (blocked) return res.status(400).json({ error: blocked });
+      }
 
       // Giving something the character already holds adds to the stack (the
       // stack keeps the level it has).
@@ -957,6 +1379,7 @@ for (const gear of GEAR) {
         update: gear.ownLevel ? { quantity: { increment: parsed.data.quantity } } : { [gear.flag]: parsed.data[gear.flag] },
         include,
       });
+      if (gear.ownLevel) await settleHp(prisma, [req.character.id]);
       emitCharacterUpdated(req);
       res.status(201).json({ [gear.held]: row });
     } catch (err) {
@@ -988,8 +1411,13 @@ for (const gear of GEAR) {
         if (data[gear.flag]) return res.status(400).json({ error: tooHighMessage(needed) });
         data[gear.flag] = false; // levelled past its holder: it comes off
       }
+      if (gear.ownLevel && data.equipped && !existing.equipped) {
+        const blocked = await equipBlocked(req, gear.pool, req.params.poolId);
+        if (blocked) return res.status(400).json({ error: blocked });
+      }
 
       const row = await prisma[gear.held].update({ where: whereHeld(req), data, include });
+      if (gear.ownLevel) await settleHp(prisma, [req.character.id]);
       emitCharacterUpdated(req);
       res.json({ [gear.held]: row });
     } catch (err) {
@@ -1004,6 +1432,7 @@ for (const gear of GEAR) {
         where: { characterId: req.character.id, [gear.key]: req.params.poolId },
       });
       if (count === 0) return res.status(404).json({ error: `This character doesn't have that ${gear.label}.` });
+      if (gear.ownLevel) await settleHp(prisma, [req.character.id]);
       emitCharacterUpdated(req);
       res.status(204).end();
     } catch (err) {
@@ -1020,7 +1449,7 @@ for (const gear of GEAR) {
 // ---------------------------------------------------------------------------
 
 const giveSchema = z.discriminatedUnion('kind', [
-  z.object({ kind: z.literal('gold'), toCharacterId: z.string(), amount: z.number().int().min(1) }),
+  z.object({ kind: z.literal('gold'), toCharacterId: z.string(), amount: z.number().int().min(1), currency: z.enum(CURRENCIES).default('GOLD') }),
   z.object({ kind: z.literal('weapon'), toCharacterId: z.string(), id: z.string(), quantity: z.number().int().min(1).default(1) }),
   z.object({ kind: z.literal('item'), toCharacterId: z.string(), id: z.string(), quantity: z.number().int().min(1).default(1) }),
   z.object({ kind: z.literal('spell'), toCharacterId: z.string(), id: z.string() }),
@@ -1047,8 +1476,10 @@ router.post('/:id/give', requireCharacterAccess({ write: true }), async (req, re
     try {
       await prisma.$transaction(async (tx) => {
         if (give.kind === 'gold') {
-          await adjustGold(tx, { characterId: giver.id, amount: -give.amount, reason: `Gave to ${recipient.name}`, userId: req.user.id });
-          await adjustGold(tx, { characterId: recipient.id, amount: give.amount, reason: `Received from ${giver.name}`, userId: req.user.id });
+          // The giver pays from their whole purse, with change; the recipient gets the coins named.
+          const coins = { amount: give.amount, currency: give.currency, userId: req.user.id };
+          await spendCoins(tx, { ...coins, characterId: giver.id, reason: `Gave to ${recipient.name}` });
+          await adjustGold(tx, { ...coins, characterId: recipient.id, reason: `Received from ${giver.name}` });
           return;
         }
 
@@ -1082,12 +1513,14 @@ router.post('/:id/give', requireCharacterAccess({ write: true }), async (req, re
       });
     } catch (err) {
       if (err instanceof InsufficientGoldError) {
-        return res.status(400).json({ error: `Not enough gold — ${giver.name} has ${giver.gold}.` });
+        return res.status(400).json({ error: notEnoughMoney(giver, give.amount, give.currency || 'GOLD') });
       }
       if (err instanceof GiveError) return res.status(400).json({ error: err.message });
       throw err;
     }
 
+    // What was handed over may have been equipped, and holding the giver's maximum HP up.
+    await settleHp(prisma, [giver.id]);
     const io = req.app.get('io');
     for (const characterId of [giver.id, recipient.id]) {
       io.to(`campaign:${giver.campaignId}`).emit('character:updated', { characterId });

backend/src/routes/encounters.routes.js

@@ -3,8 +3,11 @@ const { z } = require('zod');
 const prisma = require('../db');
 const { requireAuth } = require('../middleware/auth');
 const { loadCampaignMembership } = require('../middleware/campaignAccess');
-const { computeCharacterSheet, computeWeaponStats, canUseGear, MAX_GEAR_LEVEL } = require('../game/calculations');
-const { adjustGold, giveGear } = require('../utils/grants');
+const { computeCharacterSheet, computeWeaponStats, scaledDamageDice, canUseGear, abilityModifier, MAX_GEAR_LEVEL } = require('../game/calculations');
+const { CURRENCIES, InsufficientGoldError, adjustGold, spendCoins, giveGear } = require('../utils/grants');
+const { moveCharacters, visitedLocationIds } = require('../utils/locations');
+const { SHEET_INCLUDE } = require('../utils/sheet');
+const { NO_DEATH_SAVES, lifeState, deathSaveInfo, changeHp } = require('../utils/hp');
 
 const router = express.Router();
 
@@ -18,9 +21,20 @@ async function requireEncounterAccess(req, res, next) {
     const membership = await loadCampaignMembership(req.user.id, encounter.campaignId);
     if (!membership) return res.status(403).json({ error: 'Not a member of this campaign' });
 
+    // A player only gets into a scene one of their own characters is in. To
+    // anyone else it doesn't exist — the name alone can be a spoiler.
+    const isDM = membership.role === 'DM';
+    if (!isDM) {
+      const present = await prisma.encounterParticipant.findFirst({
+        where: { encounterId: encounter.id, character: { userId: req.user.id } },
+        select: { id: true },
+      });
+      if (!present) return res.status(404).json({ error: 'Encounter not found' });
+    }
+
     req.encounter = encounter;
     req.membership = membership;
-    req.isDM = membership.role === 'DM';
+    req.isDM = isDM;
     return next();
   } catch (err) {
     return next(err);
@@ -37,20 +51,82 @@ function clamp(value, min, max) {
 }
 
 // Highest initiative first; ties keep the order combatants were added in.
+// Anyone who has not rolled yet waits at the bottom.
 function inTurnOrder(participants) {
-  return [...participants].sort((a, b) => b.initiative - a.initiative || (a.id < b.id ? -1 : 1));
+  const rolled = (p) => (p.initiativeRoll == null ? 0 : 1);
+  return [...participants].sort((a, b) => rolled(b) - rolled(a) || b.initiative - a.initiative || (a.id < b.id ? -1 : 1));
 }
 
+// What is added to a combatant's d20 for initiative: the sheet's initiative
+// bonus for a character, the Dexterity modifier for a monster, and nothing for
+// an NPC (they have no ability scores). Takes a participant with its
+// character (and proficiencies) and monster loaded.
+function initiativeBonus({ character, monster }) {
+  if (character) return computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies).initiative;
+  if (monster) return abilityModifier(monster.dexScore);
+  return 0;
+}
+
+// Out of the fight: a dead character, or a monster or NPC brought to 0 HP.
+// The fallen are hidden from the players and skipped in the turn order; the
+// DM still sees them. It is worked out from HP each time, never stored, so
+// healing a monster or reviving a character brings them straight back. Takes
+// a participant with its character loaded.
+function isFallen(p) {
+  if (p.character) return lifeState(p.character) === 'DEAD';
+  return p.maxHp > 0 && p.currentHp <= 0;
+}
+
+// The first combatant still standing at or after `from` in the order, going
+// round to the top when the end is reached. If nobody is standing, whoever is
+// at `from`.
+function standingFrom(order, from) {
+  for (let step = 0; step < order.length; step += 1) {
+    const p = order[(from + step) % order.length];
+    if (!isFallen(p)) return p;
+  }
+  return order[from % order.length] ?? null;
+}
+
+// An encounter's combatants in turn order, with what isFallen needs.
+async function loadTurnOrder(encounterId) {
+  const participants = await prisma.encounterParticipant.findMany({
+    where: { encounterId },
+    include: { character: { select: { currentHp: true, deathSaveFailures: true, stable: true } } },
+  });
+  return inTurnOrder(participants);
+}
+
+// The spell a character would raise the dead with: one flagged as reviving
+// in the campaign's spell list, at a level they can cast. Takes a character
+// with its spells loaded.
+function revivalSpell(character) {
+  return character.spells.map((cs) => cs.spell).find((spell) => spell.revives && canUseGear(character.level, spell.level));
+}
+
+const initiativeRollSchema = z.number().int().min(1, 'An initiative roll is a d20: 1 to 20').max(20, 'An initiative roll is a d20: 1 to 20');
+
 // What every campaign member sees about a character in an encounter: the
-// sheet's headline numbers plus the weapons and spells it can actually use —
-// so the party can plan around each other mid-fight, not only the DM. Uses the
+// sheet's headline numbers plus what it has in hand — the weapons and items
+// it has equipped — and the spells it can cast, so the party can plan around
+// each other mid-fight, not only the DM. A weapon has to be equipped to be
+// used; what is still in the pack is in the character panel, for the
+// character's own player and the DM. Uses the
 // same calculation-engine functions as the sheet, never re-deriving formulas.
 function characterCombatInfo(character) {
   const sheet = computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies);
   // Gear and spells above the character's level are held but can't be used,
-  // so they stay out of the fight.
+  // so they stay out of the fight; so does anything not equipped.
+  const inHand = (held) => held.equipped && canUseGear(character.level, held.level);
+  const items = character.inventoryItems.filter(inHand).map((ii) => ({
+    inventoryItemId: ii.id,
+    name: ii.item.name,
+    level: ii.level,
+    quantity: ii.quantity,
+    damageDice: ii.item.damageDice ? scaledDamageDice(ii.item.damageDice, ii.level, ii.item.damageScaling, ii.item.minLevel) : null,
+  }));
   const weapons = character.weapons
-    .filter((cw) => canUseGear(character.level, cw.level))
+    .filter(inHand)
     .map((cw) => ({
       characterWeaponId: cw.id,
       name: cw.weapon.name,
@@ -76,6 +152,8 @@ function characterCombatInfo(character) {
     armorClass: sheet.armorClass,
     maxHp: sheet.hp.max,
     tempHp: character.tempHp,
+    deathSaves: deathSaveInfo(character),
+    canRevive: Boolean(revivalSpell(character)),
     speed: sheet.speed,
     initiativeBonus: sheet.initiative,
     passivePerception: sheet.passivePerception,
@@ -83,48 +161,73 @@ function characterCombatInfo(character) {
     abilities: sheet.abilities,
     saves: sheet.saves,
     specialAbilities: character.specialAbilities,
+    // What equipped gear is adding and taking away. The numbers above already include it.
+    gear: sheet.gear,
     weapons,
+    items,
     spells,
     spellcasting: sheet.spellcasting,
   };
 }
 
+// What is for sale, oldest first, with the weapon or item itself.
+const WARES = { include: { weapon: true, item: true }, orderBy: { createdAt: 'asc' } };
+
 // The DM gets everything. Players get the scene as their characters see it:
 // no DM notes, no monster stat blocks, no NPC secrets or stats, and only the
-// rewards that have actually been handed out.
-async function serializeEncounter(encounterId, isDM) {
+// rewards that have actually been handed out. What an NPC sells and the rate
+// they change money at are for everyone: `npc.wares`, `npc.exchangeGold` and
+// `npc.exchangeCash`, and the scene's own `wares`. The fallen (isFallen) are left
+// out of a player's list altogether; of those, only the dead characters are
+// named, in `fallen`, so an ally can try to revive them.
+//
+// `viewerId` is the user the payload is for. A player is told where a scene
+// is once one of their characters has been there, and — when the campaign
+// hides monster hit points — gets a percentage for the health bar in place of
+// the numbers for anyone who is not a character.
+async function serializeEncounter(encounterId, isDM, viewerId) {
   const encounter = await prisma.encounter.findUnique({
     where: { id: encounterId },
     include: {
+      campaign: { select: { showMonsterHp: true } },
+      location: { select: { id: true, name: true, description: true } },
       participants: {
         include: {
           character: {
             include: {
-              skillProficiencies: true,
-              saveProficiencies: true,
-              weapons: { include: { weapon: true } },
+              ...SHEET_INCLUDE,
               spells: { include: { spell: true } },
             },
           },
           monster: true,
-          npc: true,
+          npc: { include: { wares: WARES } },
         },
       },
       rewards: { include: { weapon: true, item: true }, orderBy: { createdAt: 'asc' } },
+      wares: WARES,
     },
   });
   if (!encounter) return encounter;
 
-  const participants = inTurnOrder(encounter.participants).map((p) => {
+  const hideHp = !isDM && !encounter.campaign.showMonsterHp;
+  const inOrder = inTurnOrder(encounter.participants);
+  const hiddenIds = new Set(inOrder.filter(isFallen).map((p) => p.id));
+  const fallen = inOrder
+    .filter((p) => p.character && hiddenIds.has(p.id))
+    .map((p) => ({ participantId: p.id, characterId: p.character.id, name: p.displayName }));
+  const participants = inOrder.filter((p) => isDM || !hiddenIds.has(p.id)).map((p) => {
     const { character, monster, npc, ...row } = p;
-    const out = { ...row, kind: npc || p.npcId ? 'NPC' : p.isMonster ? 'MONSTER' : 'CHARACTER' };
+    // The bonus is part of a monster's stat block, so only the DM gets it for
+    // those; a character's is on their sheet for all to see.
+    const bonus = isDM || character ? { initiativeBonus: initiativeBonus(p) } : {};
+    const out = { ...row, ...bonus, kind: npc || p.npcId ? 'NPC' : p.isMonster ? 'MONSTER' : 'CHARACTER', hidden: hiddenIds.has(p.id) };
     if (character) {
       // A character combatant's HP is the character's own HP, not a
       // per-encounter copy, so the tracker and the sheet can never disagree.
       const { maxHp, ...combatInfo } = characterCombatInfo(character);
       out.currentHp = character.currentHp;
       out.maxHp = maxHp;
-      out.character = { id: character.id, name: character.name };
+      out.character = { id: character.id, name: character.name, userId: character.userId };
       out.characterCombatInfo = combatInfo;
     }
     if (monster) out.monster = isDM ? monster : { id: monster.id, name: monster.name };
@@ -132,14 +235,26 @@ async function serializeEncounter(encounterId, isDM) {
       const { dmNotes, ac, maxHp, attackBonus, damageDice, campaignId, createdAt, ...publicNpc } = npc;
       out.npc = isDM ? { ...publicNpc, dmNotes, ac, maxHp, attackBonus, damageDice } : publicNpc;
     }
+    if (hideHp && !character) {
+      // Rounded up, so anything still standing shows a sliver of bar.
+      out.hpPercent = p.maxHp > 0 ? Math.ceil((clamp(p.currentHp, 0, p.maxHp) / p.maxHp) * 100) : null;
+      out.currentHp = null;
+      out.maxHp = null;
+    }
     return out;
   });
 
-  const { dmNotes, rewards, ...scene } = encounter;
+  const { dmNotes, rewards, campaign, location, ...scene } = encounter;
+  const knowsPlace = isDM || (location && (await visitedLocationIds(prisma, viewerId, encounter.campaignId)).has(location.id));
   return {
     ...scene,
+    locationId: knowsPlace ? scene.locationId : null,
+    location: knowsPlace ? location : null,
     ...(isDM ? { dmNotes } : {}),
+    // A player is not told that someone they cannot see is being targeted.
+    targetParticipantIds: isDM ? scene.targetParticipantIds : scene.targetParticipantIds.filter((id) => !hiddenIds.has(id)),
     participants,
+    fallen,
     rewards: isDM ? rewards : rewards.filter((r) => r.awardedAt),
   };
 }
@@ -154,15 +269,31 @@ function emitCharacterUpdated(req, characterId) {
   req.app.get('io').to(`campaign:${req.encounter.campaignId}`).emit('character:updated', { characterId });
 }
 
+// While an encounter with a location is in progress, the characters in it
+// are at that location: starting it, moving it, or adding someone to it puts
+// them there, and that goes on their record of places visited.
+async function syncCharacterLocations(req) {
+  const encounter = await prisma.encounter.findUnique({
+    where: { id: req.encounter.id },
+    include: { participants: { where: { characterId: { not: null } }, include: { character: { select: { id: true, currentLocationId: true } } } } },
+  });
+  if (!encounter || encounter.status !== 'ACTIVE' || !encounter.locationId) return;
+
+  const elsewhere = encounter.participants.map((p) => p.character).filter((c) => c.currentLocationId !== encounter.locationId);
+  await moveCharacters(prisma, elsewhere.map((c) => c.id), encounter.locationId);
+  for (const character of elsewhere) emitCharacterUpdated(req, character.id);
+}
+
 async function respondWithEncounter(req, res, status = 200, extra = {}) {
-  const encounter = await serializeEncounter(req.encounter.id, req.isDM);
+  await syncCharacterLocations(req);
+  const encounter = await serializeEncounter(req.encounter.id, req.isDM, req.user.id);
   emitEncounterUpdated(req);
   res.status(status).json({ ...extra, encounter });
 }
 
 router.get('/:id', requireEncounterAccess, async (req, res, next) => {
   try {
-    res.json({ encounter: await serializeEncounter(req.encounter.id, req.isDM) });
+    res.json({ encounter: await serializeEncounter(req.encounter.id, req.isDM, req.user.id) });
   } catch (err) {
     next(err);
   }
@@ -174,6 +305,7 @@ const patchEncounterSchema = z.object({
   name: z.string().min(1).max(120).optional(),
   description: z.string().max(4000).nullable().optional(),
   dmNotes: z.string().max(4000).nullable().optional(),
+  locationId: z.string().nullable().optional(),
   archived: z.boolean().optional(), // put away (true) or bring back (false)
 });
 
@@ -185,13 +317,20 @@ router.patch('/:id', requireEncounterAccess, requireDM, async (req, res, next) =
     if (archived === true && !req.encounter.archivedAt) data.archivedAt = new Date();
     if (archived === false) data.archivedAt = null;
 
-    // Starting a battle puts the first combatant in the initiative order on turn.
+    if (data.locationId) {
+      const location = await prisma.location.findFirst({ where: { id: data.locationId, campaignId: req.encounter.campaignId } });
+      if (!location) return res.status(400).json({ error: 'That location is not part of this campaign.' });
+    }
+
+    // Starting a battle puts the first combatant still standing on turn.
     const mode = data.mode ?? req.encounter.mode;
     if (data.status === 'ACTIVE' && mode === 'BATTLE' && !req.encounter.activeParticipantId) {
-      const participants = await prisma.encounterParticipant.findMany({ where: { encounterId: req.encounter.id } });
-      data.activeParticipantId = inTurnOrder(participants)[0]?.id ?? null;
+      data.activeParticipantId = standingFrom(await loadTurnOrder(req.encounter.id), 0)?.id ?? null;
     }
 
+    // Targets belong to the moment; beginning, ending or reopening clears them.
+    if (data.status && data.status !== req.encounter.status) data.targetParticipantIds = [];
+
     await prisma.encounter.update({ where: { id: req.encounter.id }, data });
     await respondWithEncounter(req, res);
   } catch (err) {
@@ -221,7 +360,7 @@ const participantSchema = z
     monsterId: z.string().optional(),
     npcId: z.string().optional(),
     displayName: z.string().min(1).max(80).optional(),
-    initiative: z.number().int().default(0),
+    initiativeRoll: initiativeRollSchema.optional(),
   })
   .refine((data) => [data.characterId, data.monsterId, data.npcId].filter(Boolean).length === 1, {
     message: 'Provide exactly one of characterId, monsterId or npcId',
@@ -231,21 +370,27 @@ router.post('/:id/participants', requireEncounterAccess, requireDM, async (req,
   try {
     const parsed = participantSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
-    const { characterId, monsterId, npcId, displayName, initiative } = parsed.data;
+    const { characterId, monsterId, npcId, displayName, initiativeRoll } = parsed.data;
 
     let currentHp, maxHp, resolvedName;
+    let bonus = 0;
 
     if (characterId) {
       const character = await prisma.character.findUnique({
         where: { id: characterId },
-        include: { skillProficiencies: true, saveProficiencies: true },
+        include: SHEET_INCLUDE,
       });
       if (!character || character.campaignId !== req.encounter.campaignId) {
         return res.status(400).json({ error: 'That character is not part of this campaign.' });
       }
+      // The dead stay where they fell: they join no new scene until revived.
+      if (lifeState(character) === 'DEAD') {
+        return res.status(400).json({ error: `${character.name} is dead and cannot join an encounter. Revive them first.` });
+      }
       currentHp = character.currentHp;
       maxHp = computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies).hp.max;
       resolvedName = displayName || character.name;
+      bonus = initiativeBonus({ character });
     } else if (monsterId) {
       const monster = await prisma.monster.findUnique({ where: { id: monsterId } });
       if (!monster || monster.campaignId !== req.encounter.campaignId) {
@@ -254,6 +399,7 @@ router.post('/:id/participants', requireEncounterAccess, requireDM, async (req,
       currentHp = monster.maxHp;
       maxHp = monster.maxHp;
       resolvedName = displayName || monster.name;
+      bonus = initiativeBonus({ monster });
     } else {
       const npc = await prisma.npc.findUnique({ where: { id: npcId } });
       if (!npc || npc.campaignId !== req.encounter.campaignId) {
@@ -272,7 +418,8 @@ router.post('/:id/participants', requireEncounterAccess, requireDM, async (req,
         monsterId: monsterId || null,
         npcId: npcId || null,
         displayName: resolvedName,
-        initiative,
+        initiativeRoll: initiativeRoll ?? null,
+        initiative: initiativeRoll == null ? 0 : initiativeRoll + bonus,
         currentHp,
         maxHp,
         isMonster: Boolean(monsterId),
@@ -287,34 +434,53 @@ router.post('/:id/participants', requireEncounterAccess, requireDM, async (req,
 
 const updateParticipantSchema = z.object({
   currentHp: z.number().int().optional(),
-  maxHp: z.number().int().min(1).optional(),
-  initiative: z.number().int().optional(),
+  maxHp: z.number().int().min(1).max(100000).optional(),
+  initiativeRoll: initiativeRollSchema.nullable().optional(), // null clears the roll
   conditions: z.array(z.string().trim().min(1).max(40)).max(20).optional(),
   displayName: z.string().min(1).max(80).optional(),
 });
 
-router.patch('/:id/participants/:participantId', requireEncounterAccess, requireDM, async (req, res, next) => {
+// The DM runs every combatant. A player may do one thing here: enter the
+// initiative roll for their own character.
+router.patch('/:id/participants/:participantId', requireEncounterAccess, async (req, res, next) => {
   try {
     const parsed = updateParticipantSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
 
     const existing = await prisma.encounterParticipant.findUnique({
       where: { id: req.params.participantId },
-      include: { character: { include: { skillProficiencies: true, saveProficiencies: true } } },
+      include: { character: { include: SHEET_INCLUDE }, monster: true },
     });
     if (!existing || existing.encounterId !== req.encounter.id) {
       return res.status(404).json({ error: 'Combatant not found in this encounter' });
     }
+    if (!req.isDM) {
+      const onlyTheRoll = Object.keys(parsed.data).every((key) => key === 'initiativeRoll');
+      const ownCharacter = existing.character && existing.character.userId === req.user.id;
+      if (!onlyTheRoll || !ownCharacter) {
+        return res.status(403).json({ error: 'You can only enter the initiative roll for your own character' });
+      }
+    }
 
     const data = { ...parsed.data };
+    // The roll is what was on the die; the bonus is added here.
+    if (data.initiativeRoll !== undefined) {
+      data.initiative = data.initiativeRoll == null ? 0 : data.initiativeRoll + initiativeBonus(existing);
+    }
     if (existing.character) {
       // Max HP comes from the sheet, and damage/healing lands on the character.
       const { character } = existing;
       const maxHp = computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies).hp.max;
       data.maxHp = maxHp;
       if (data.currentHp !== undefined) {
-        data.currentHp = clamp(data.currentHp, 0, maxHp);
-        await prisma.character.update({ where: { id: character.id }, data: { currentHp: data.currentHp } });
+        if (lifeState(character) === 'DEAD' && data.currentHp > 0) {
+          return res.status(400).json({ error: `${character.name} is dead. Revive them before healing.` });
+        }
+        // Temp HP soaks damage first; what is left lands on the character,
+        // and at 0 HP it moves their death saves too.
+        const after = changeHp(character, data.currentHp, maxHp);
+        data.currentHp = after.currentHp;
+        await prisma.character.update({ where: { id: character.id }, data: after });
         emitCharacterUpdated(req, character.id);
       }
     } else if (data.currentHp !== undefined) {
@@ -332,15 +498,20 @@ router.patch('/:id/participants/:participantId', requireEncounterAccess, require
 
 router.delete('/:id/participants/:participantId', requireEncounterAccess, requireDM, async (req, res, next) => {
   try {
-    const participants = await prisma.encounterParticipant.findMany({ where: { encounterId: req.encounter.id } });
-    const order = inTurnOrder(participants);
+    const order = await loadTurnOrder(req.encounter.id);
     const index = order.findIndex((p) => p.id === req.params.participantId);
     if (index === -1) return res.status(404).json({ error: 'Combatant not found in this encounter' });
 
-    // Removing whoever is on turn passes the turn to the next combatant.
-    if (req.encounter.activeParticipantId === req.params.participantId) {
-      const next = order.length > 1 ? order[(index + 1) % order.length] : null;
-      await prisma.encounter.update({ where: { id: req.encounter.id }, data: { activeParticipantId: next ? next.id : null } });
+    // Removing whoever is on turn passes the turn to the next combatant still
+    // standing, and their targets go with the turn. Removing a target just
+    // unmarks it.
+    const { activeParticipantId, targetParticipantIds } = req.encounter;
+    if (activeParticipantId === req.params.participantId) {
+      const next = standingFrom([...order.slice(index + 1), ...order.slice(0, index)], 0);
+      await prisma.encounter.update({ where: { id: req.encounter.id }, data: { activeParticipantId: next ? next.id : null, targetParticipantIds: [] } });
+    } else if (targetParticipantIds.includes(req.params.participantId)) {
+      const left = targetParticipantIds.filter((id) => id !== req.params.participantId);
+      await prisma.encounter.update({ where: { id: req.encounter.id }, data: { targetParticipantIds: left } });
     }
     await prisma.encounterParticipant.delete({ where: { id: req.params.participantId } });
     await respondWithEncounter(req, res);
@@ -349,25 +520,118 @@ router.delete('/:id/participants/:participantId', requireEncounterAccess, requir
   }
 });
 
+// A dead character can be brought back in the middle of a battle by an ally:
+// the character on turn, if they are on their feet and can cast a spell that
+// raises the dead (revivalSpell). The dead come back at 1 HP, and with that
+// are back in everyone's list. A player tries it for their own character; the
+// DM for whoever is on turn. (The DM can also revive anyone outright, through
+// the character's death saves.)
+router.post('/:id/participants/:participantId/revive', requireEncounterAccess, async (req, res, next) => {
+  try {
+    const { mode, status, activeParticipantId } = req.encounter;
+    const onTurnId = mode === 'BATTLE' && status === 'ACTIVE' ? activeParticipantId : null;
+    const onTurn = onTurnId
+      ? await prisma.encounterParticipant.findFirst({
+          where: { id: onTurnId, encounterId: req.encounter.id },
+          include: { character: { include: { spells: { include: { spell: true } } } } },
+        })
+      : null;
+    const reviver = onTurn?.character;
+    if (!req.isDM && (!reviver || reviver.userId !== req.user.id)) {
+      return res.status(403).json({ error: "You can only try to revive someone on your own character's turn" });
+    }
+    if (!reviver) return res.status(400).json({ error: 'Only a character on turn in a battle can try to revive someone.' });
+
+    const target = await prisma.encounterParticipant.findUnique({ where: { id: req.params.participantId }, include: { character: true } });
+    if (!target || target.encounterId !== req.encounter.id) {
+      return res.status(404).json({ error: 'Combatant not found in this encounter' });
+    }
+    if (!target.character || lifeState(target.character) !== 'DEAD') {
+      return res.status(400).json({ error: `${target.displayName} is not dead.` });
+    }
+    if (lifeState(reviver) !== 'UP') return res.status(400).json({ error: `${reviver.name} is in no state to revive anyone.` });
+
+    const spell = revivalSpell(reviver);
+    if (!spell) return res.status(400).json({ error: `${reviver.name} has no spell that can bring back the dead.` });
+
+    await prisma.character.update({ where: { id: target.character.id }, data: { currentHp: 1, ...NO_DEATH_SAVES } });
+    await prisma.encounterParticipant.update({ where: { id: target.id }, data: { currentHp: 1 } });
+    emitCharacterUpdated(req, target.character.id);
+    await respondWithEncounter(req, res, 200, { revivedWith: spell.name });
+  } catch (err) {
+    next(err);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// Targets — who the combatant on turn is going for
+// ---------------------------------------------------------------------------
+
+// The whole list, in the order picked; an empty one clears it.
+const targetsSchema = z.object({ participantIds: z.array(z.string()).max(50) });
+
+// Combatants can be marked as targets, for everyone to see; the DM's screen
+// then offers to apply damage to them. One is an ordinary attack, more is an
+// area attack. The DM can mark anyone at any time. A player can while their
+// own character is on turn in a battle. Nobody can mark the combatant who is
+// on turn: you don't target yourself.
+router.put('/:id/targets', requireEncounterAccess, async (req, res, next) => {
+  try {
+    const parsed = targetsSchema.safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const participantIds = [...new Set(parsed.data.participantIds)];
+
+    // Whoever is on turn, when a battle is under way.
+    const { mode, status, activeParticipantId } = req.encounter;
+    const onTurnId = mode === 'BATTLE' && status === 'ACTIVE' ? activeParticipantId : null;
+
+    if (!req.isDM) {
+      const ownTurn = onTurnId
+        ? await prisma.encounterParticipant.findFirst({
+            where: { id: onTurnId, encounterId: req.encounter.id, character: { userId: req.user.id } },
+            select: { id: true },
+          })
+        : null;
+      if (!ownTurn) return res.status(403).json({ error: "You can only pick targets on your own character's turn" });
+    }
+
+    if (onTurnId && participantIds.includes(onTurnId)) {
+      return res.status(400).json({ error: 'The combatant on turn cannot be their own target' });
+    }
+
+    // A player can only mark who they can see: to them the fallen are not there.
+    const order = await loadTurnOrder(req.encounter.id);
+    const markable = new Set(order.filter((p) => req.isDM || !isFallen(p)).map((p) => p.id));
+    if (!participantIds.every((id) => markable.has(id))) return res.status(400).json({ error: 'Combatant not found in this encounter' });
+
+    await prisma.encounter.update({ where: { id: req.encounter.id }, data: { targetParticipantIds: participantIds } });
+    await respondWithEncounter(req, res);
+  } catch (err) {
+    next(err);
+  }
+});
+
 // ---------------------------------------------------------------------------
 // Turns and rounds
 // ---------------------------------------------------------------------------
 
-// Passes the turn down the initiative order; going past the last combatant
-// starts the next round.
+// Passes the turn down the initiative order to the next combatant still
+// standing (the fallen have no turn); going past the last combatant starts
+// the next round.
 router.post('/:id/next-turn', requireEncounterAccess, requireDM, async (req, res, next) => {
   try {
-    const participants = await prisma.encounterParticipant.findMany({ where: { encounterId: req.encounter.id } });
-    const order = inTurnOrder(participants);
+    const order = await loadTurnOrder(req.encounter.id);
     if (order.length === 0) return res.status(400).json({ error: 'Add combatants before taking turns.' });
 
     const index = order.findIndex((p) => p.id === req.encounter.activeParticipantId);
-    const wrapped = index === order.length - 1;
+    const upNext = standingFrom(order, index + 1);
+    const wrapped = index !== -1 && order.indexOf(upNext) <= index;
     await prisma.encounter.update({
       where: { id: req.encounter.id },
       data: {
         status: 'ACTIVE',
-        activeParticipantId: order[wrapped || index === -1 ? 0 : index + 1].id,
+        activeParticipantId: upNext.id,
+        targetParticipantIds: [], // the next combatant picks their own
         ...(wrapped ? { currentRound: { increment: 1 } } : {}),
       },
     });
@@ -379,21 +643,23 @@ router.post('/:id/next-turn', requireEncounterAccess, requireDM, async (req, res
 
 router.post('/:id/advance-round', requireEncounterAccess, requireDM, async (req, res, next) => {
   try {
-    const participants = await prisma.encounterParticipant.findMany({ where: { encounterId: req.encounter.id } });
+    const order = await loadTurnOrder(req.encounter.id);
     const updated = await prisma.encounter.update({
       where: { id: req.encounter.id },
       data: {
         currentRound: { increment: 1 },
         status: 'ACTIVE',
+        targetParticipantIds: [],
         // A new round starts back at the top of the initiative order.
-        ...(req.encounter.mode === 'BATTLE' ? { activeParticipantId: inTurnOrder(participants)[0]?.id ?? null } : {}),
+        ...(req.encounter.mode === 'BATTLE' ? { activeParticipantId: standingFrom(order, 0)?.id ?? null } : {}),
       },
     });
+    await syncCharacterLocations(req);
     req.app.get('io').to(`campaign:${req.encounter.campaignId}`).emit('encounter:round-advanced', {
       encounterId: updated.id,
       currentRound: updated.currentRound,
     });
-    res.json({ encounter: await serializeEncounter(updated.id, req.isDM) });
+    res.json({ encounter: await serializeEncounter(updated.id, req.isDM, req.user.id) });
   } catch (err) {
     next(err);
   }
@@ -404,18 +670,18 @@ router.post('/:id/advance-round', requireEncounterAccess, requireDM, async (req,
 // ---------------------------------------------------------------------------
 
 const rewardSchema = z.discriminatedUnion('type', [
-  z.object({ type: z.literal('GOLD'), gold: z.number().int().min(1), note: z.string().trim().max(200).optional().nullable() }),
+  z.object({ type: z.literal('GOLD'), gold: z.number().int().min(1).max(1000000), currency: z.enum(CURRENCIES).default('GOLD'), note: z.string().trim().max(200).optional().nullable() }),
   z.object({
     type: z.literal('WEAPON'),
     weaponId: z.string(),
-    quantity: z.number().int().min(1).default(1),
+    quantity: z.number().int().min(1).max(999).default(1),
     level: z.number().int().min(1).max(MAX_GEAR_LEVEL).optional(),
     note: z.string().trim().max(200).optional().nullable(),
   }),
   z.object({
     type: z.literal('ITEM'),
     itemId: z.string(),
-    quantity: z.number().int().min(1).default(1),
+    quantity: z.number().int().min(1).max(999).default(1),
     level: z.number().int().min(1).max(MAX_GEAR_LEVEL).optional(),
     note: z.string().trim().max(200).optional().nullable(),
   }),
@@ -481,7 +747,7 @@ router.post('/:id/rewards/:rewardId/award', requireEncounterAccess, requireDM, a
 
     let recipients;
     if (parsed.data.split) {
-      if (reward.type !== 'GOLD') return res.status(400).json({ error: 'Only gold can be split.' });
+      if (reward.type !== 'GOLD') return res.status(400).json({ error: 'Only coins can be split.' });
       const participants = await prisma.encounterParticipant.findMany({
         where: { encounterId: req.encounter.id, characterId: { not: null } },
         include: { character: true },
@@ -510,7 +776,7 @@ router.post('/:id/rewards/:rewardId/award', requireEncounterAccess, requireDM, a
         const remainder = reward.gold % recipients.length;
         for (const [i, character] of recipients.entries()) {
           const amount = share + (i < remainder ? 1 : 0);
-          if (amount > 0) await adjustGold(tx, { characterId: character.id, amount, reason, userId: req.user.id });
+          if (amount > 0) await adjustGold(tx, { characterId: character.id, amount, currency: reward.currency, reason, userId: req.user.id });
         }
       } else {
         const kind = reward.type === 'WEAPON' ? 'weapon' : 'item';
@@ -530,4 +796,146 @@ router.post('/:id/rewards/:rewardId/award', requireEncounterAccess, requireDM, a
   }
 });
 
+// ---------------------------------------------------------------------------
+// Trade — changing gold and cash with an NPC, and buying what is for sale.
+// The DM sets the rates and the wares up (campaigns.routes.js); here the
+// players, or the DM for them, use them.
+// ---------------------------------------------------------------------------
+
+class TradeError extends Error {
+  constructor(message, status = 400) {
+    super(message);
+    this.status = status;
+  }
+}
+
+function money(amount, currency) {
+  return currency === 'CASH' ? `$${amount}` : `${amount} ${currency.toLowerCase()}`;
+}
+
+// Trading takes someone to trade with and the time to do it, so it happens
+// in a quest in progress and never in a battle.
+function assertTradeOpen(encounter) {
+  if (encounter.mode !== 'QUEST') throw new TradeError('Trading happens in a quest, not in a battle.');
+  if (encounter.status !== 'ACTIVE') throw new TradeError('Trading opens once the quest is in progress.');
+}
+
+// The character doing the trading: in this scene, alive, and the player's
+// own (the DM can trade for anyone).
+async function loadTrader(req, characterId) {
+  const row = await prisma.encounterParticipant.findFirst({ where: { encounterId: req.encounter.id, characterId }, include: { character: true } });
+  if (!row) throw new TradeError('That character is not in this encounter.');
+  if (!req.isDM && row.character.userId !== req.user.id) throw new TradeError('You can only trade for your own character.', 403);
+  if (isFallen(row)) throw new TradeError(`${row.character.name} is dead.`);
+  return row.character;
+}
+
+// An NPC to trade with has to be in the scene and still standing.
+async function loadTradingNpc(req, npcId) {
+  const row = await prisma.encounterParticipant.findFirst({ where: { encounterId: req.encounter.id, npcId }, include: { npc: true } });
+  if (!row || isFallen(row)) throw new TradeError('That NPC is not here to trade with.');
+  return row.npc;
+}
+
+function tradeRoute(handler) {
+  return async (req, res, next) => {
+    try {
+      assertTradeOpen(req.encounter);
+      await handler(req, res);
+    } catch (err) {
+      if (err instanceof TradeError) return res.status(err.status).json({ error: err.message });
+      next(err);
+    }
+  };
+}
+
+// Changes gold into cash, or cash into gold, at the NPC's own rate. Only
+// gold counts: silver and copper are not taken, and none come back. `amount`
+// is what is handed over, and has to come to a whole number the other way.
+router.post(
+  '/:id/exchange',
+  requireEncounterAccess,
+  tradeRoute(async (req, res) => {
+    const parsed = z
+      .object({ characterId: z.string(), npcId: z.string(), from: z.enum(['GOLD', 'CASH']), amount: z.number().int().min(1).max(1000000) })
+      .safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { characterId, npcId, from, amount } = parsed.data;
+    const to = from === 'GOLD' ? 'CASH' : 'GOLD';
+
+    const character = await loadTrader(req, characterId);
+    const npc = await loadTradingNpc(req, npcId);
+    if (!npc.exchangeGold || !npc.exchangeCash) throw new TradeError(`${npc.name} does not change money.`);
+    const rate = { GOLD: npc.exchangeGold, CASH: npc.exchangeCash };
+    if (amount % rate[from] !== 0) {
+      throw new TradeError(
+        `${npc.name} gives ${money(rate.CASH, 'CASH')} for ${money(rate.GOLD, 'GOLD')}: hand over ${from.toLowerCase()} in multiples of ${rate[from]}.`
+      );
+    }
+    const received = (amount / rate[from]) * rate[to];
+
+    try {
+      await prisma.$transaction(async (tx) => {
+        const base = { characterId: character.id, userId: req.user.id };
+        await adjustGold(tx, { ...base, currency: from, amount: -amount, reason: `Changed with ${npc.name} for ${money(received, to)}` });
+        await adjustGold(tx, { ...base, currency: to, amount: received, reason: `Changed with ${npc.name} from ${money(amount, from)}` });
+      });
+    } catch (err) {
+      if (!(err instanceof InsufficientGoldError)) throw err;
+      throw new TradeError(`${character.name} only has ${money(from === 'GOLD' ? character.gold : character.cash, from)}.`);
+    }
+
+    emitCharacterUpdated(req, character.id);
+    await respondWithEncounter(req, res, 201, { received, currency: to });
+  })
+);
+
+// Buys something that is for sale here: from an NPC in the scene, or from the
+// scene itself. The price is paid from the purse (coins make change; a cash
+// price takes cash), and the weapon or item joins what the character holds.
+router.post(
+  '/:id/wares/:wareId/buy',
+  requireEncounterAccess,
+  tradeRoute(async (req, res) => {
+    const parsed = z.object({ characterId: z.string(), quantity: z.number().int().min(1).max(999).default(1) }).safeParse(req.body);
+    if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
+    const { characterId, quantity } = parsed.data;
+
+    const character = await loadTrader(req, characterId);
+    const ware = await prisma.saleOffer.findUnique({ where: { id: req.params.wareId }, include: { weapon: true, item: true } });
+    if (!ware || ware.campaignId !== req.encounter.campaignId || (ware.encounterId && ware.encounterId !== req.encounter.id)) {
+      throw new TradeError('That is not for sale here.', 404);
+    }
+    const seller = ware.npcId ? (await loadTradingNpc(req, ware.npcId)).name : null;
+    const kind = ware.weapon ? 'weapon' : 'item';
+    const entry = ware[kind];
+    const total = ware.price * quantity;
+
+    try {
+      await prisma.$transaction(async (tx) => {
+        if (ware.stock !== null) {
+          // The atomic decrement is the stock check: two buyers can't both take the last one.
+          const taken = await tx.saleOffer.updateMany({ where: { id: ware.id, stock: { gte: quantity } }, data: { stock: { decrement: quantity } } });
+          if (taken.count === 0) throw new TradeError(ware.stock === 0 ? `${entry.name} is sold out.` : `Only ${ware.stock} of ${entry.name} left.`);
+        }
+        const what = `${quantity > 1 ? `${quantity} × ` : ''}${entry.name}`;
+        await spendCoins(tx, {
+          characterId: character.id,
+          amount: total,
+          currency: ware.currency,
+          reason: seller ? `Bought ${what} from ${seller}` : `Bought ${what}`,
+          userId: req.user.id,
+        });
+        await giveGear(tx, kind, { characterId: character.id, entry, quantity, level: ware.level });
+      });
+    } catch (err) {
+      if (!(err instanceof InsufficientGoldError)) throw err;
+      throw new TradeError(`${character.name} can't afford that: it costs ${money(total, ware.currency)}.`);
+    }
+
+    emitCharacterUpdated(req, character.id);
+    await respondWithEncounter(req, res, 201);
+  })
+);
+
 module.exports = router;

backend/src/seeds/createCampaign.js

@@ -0,0 +1,121 @@
+// Creates one campaign, fully built, from a checked seed (seeds/index.js,
+// buildSeed), with `owner` as its DM. `db` is a transaction client, so a
+// failure leaves nothing behind.
+const { generateInviteCode } = require('../utils/inviteCode');
+
+// Notes list newest-first on screen, so they are stamped a second apart,
+// backwards: the first entry in the seed is the one at the top.
+function bookOrder(index) {
+  return new Date(Date.now() - index * 1000);
+}
+
+function byName(rows) {
+  return new Map(rows.map((row) => [row.name, row]));
+}
+
+const MONEY = { gold: 'GOLD', silver: 'SILVER', copper: 'COPPER', cash: 'CASH' };
+
+async function createCampaignFromSeed(db, owner, seed) {
+  let inviteCode = generateInviteCode();
+  while (await db.campaign.findUnique({ where: { inviteCode } })) inviteCode = generateInviteCode();
+
+  const campaign = await db.campaign.create({
+    data: { ...seed.campaign, inviteCode, ownerId: owner.id, members: { create: { userId: owner.id, role: 'DM' } } },
+  });
+  const campaignId = campaign.id;
+  const inCampaign = (rows) => rows.map((row) => ({ ...row, campaignId }));
+
+  await db.location.createMany({ data: inCampaign(seed.locations) });
+  await db.weapon.createMany({ data: inCampaign(seed.weapons) });
+  await db.item.createMany({ data: inCampaign(seed.items) });
+  await db.spell.createMany({ data: inCampaign(seed.spells) });
+  await db.monster.createMany({ data: inCampaign(seed.monsters) });
+  await db.npc.createMany({ data: inCampaign(seed.npcs.map(({ wares, ...npc }) => npc)) });
+
+  const where = { where: { campaignId } };
+  const monsters = byName(await db.monster.findMany(where));
+  const npcs = byName(await db.npc.findMany(where));
+  const weapons = byName(await db.weapon.findMany(where));
+  const items = byName(await db.item.findMany(where));
+  const locations = byName(await db.location.findMany(where));
+
+  // A weapon or item named in a reward or a ware, with the level it is handed
+  // over at: its own starting level unless the seed asks for higher.
+  const gear = ({ weapon, item, level }) => {
+    const entry = weapon ? weapons.get(weapon) : items.get(item);
+    return { [weapon ? 'weaponId' : 'itemId']: entry.id, level: level ?? entry.minLevel };
+  };
+  const wares = (list, seller) =>
+    (list || []).map(({ price, currency, stock, ...ware }, i) => ({
+      ...seller,
+      ...gear(ware),
+      campaignId,
+      price,
+      currency: currency || 'GOLD',
+      stock: stock ?? null,
+      createdAt: new Date(Date.now() + i), // wares list in the order written
+    }));
+
+  for (const npc of seed.npcs) {
+    if (npc.wares) await db.saleOffer.createMany({ data: wares(npc.wares, { npcId: npcs.get(npc.name).id }) });
+  }
+
+  for (const [index, enc] of seed.encounters.entries()) {
+    const participants = [];
+    for (const [name, count, displayName, hp] of enc.monsters || []) {
+      const monster = monsters.get(name);
+      const label = displayName || monster.name;
+      const maxHp = hp ?? monster.maxHp;
+      for (let i = 1; i <= count; i++) {
+        participants.push({
+          monsterId: monster.id,
+          displayName: count > 1 ? `${label} #${i}` : label,
+          currentHp: maxHp,
+          maxHp,
+          isMonster: true,
+        });
+      }
+    }
+    for (const entry of enc.npcs || []) {
+      const { name, hp } = typeof entry === 'string' ? { name: entry } : entry;
+      const npc = npcs.get(name);
+      // An NPC with no combat stats takes part with no hit points to track.
+      const maxHp = hp ?? npc.maxHp ?? 0;
+      participants.push({ npcId: npc.id, displayName: npc.name, currentHp: maxHp, maxHp, isMonster: false });
+    }
+
+    // Rewards list oldest-first, so these are stamped forwards.
+    const rewards = (enc.rewards || []).map(({ quantity, note, ...reward }, i) => {
+      const createdAt = new Date(Date.now() + i);
+      const coin = Object.keys(MONEY).find((key) => reward[key]);
+      if (coin) return { type: 'GOLD', gold: reward[coin], currency: MONEY[coin], note, createdAt };
+      return { type: reward.weapon ? 'WEAPON' : 'ITEM', ...gear(reward), quantity: quantity ?? 1, note, createdAt };
+    });
+
+    const encounter = await db.encounter.create({
+      data: {
+        campaignId,
+        name: enc.name,
+        mode: enc.mode,
+        description: enc.description,
+        dmNotes: enc.dmNotes,
+        locationId: enc.location ? locations.get(enc.location).id : null,
+        sortOrder: index,
+        participants: { create: participants },
+        rewards: { create: rewards },
+      },
+    });
+    if (enc.wares) await db.saleOffer.createMany({ data: wares(enc.wares, { encounterId: encounter.id }) });
+  }
+
+  await db.note.createMany({
+    data: [
+      ...seed.sharedNotes.map((body) => ({ body, visibility: 'SHARED' })),
+      ...seed.dmNotes.map((body) => ({ body, visibility: 'DM_ONLY' })),
+    ].map((note, i) => ({ ...note, campaignId, authorId: owner.id, createdAt: bookOrder(i) })),
+  });
+
+  return campaign;
+}
+
+module.exports = { createCampaignFromSeed };

backend/src/seeds/index.js

@@ -0,0 +1,317 @@
+// World seeds: ready-made campaigns a DM starts from by typing a code.
+//
+// Every .js file in /backend/seeds is one world (docs/SEEDS.md has the full
+// format). It exports its `code` and the campaign's content; this module
+// finds the files, checks them, and turns one into rows for
+// createCampaign.js. The folder is read again on every lookup, so a file
+// dropped in is live without a restart.
+const fs = require('fs');
+const path = require('path');
+const { z } = require('zod');
+const { GEAR_STATS, MAX_DAMAGE_SCALING, MAX_GEAR_LEVEL } = require('../game/calculations');
+const { WEAPON_LIBRARY, ITEM_LIBRARY, SPELL_LIBRARY, MONSTER_LIBRARY } = require('../game/data/library');
+const { CURRENCIES } = require('../utils/grants');
+
+const SEEDS_DIR = path.join(__dirname, '..', '..', 'seeds');
+const CODE_LENGTH = 6;
+const CODE_PATTERN = /^[A-Z0-9]{6}$/;
+
+// What someone types, as a seed file would have it.
+function normalizeCode(code) {
+  return String(code || '').replace(/[\s-]/g, '').toUpperCase();
+}
+
+// ---------------------------------------------------------------------------
+// The shape of a seed file. Objects are strict, so a misspelt field is an
+// error rather than something silently left out of the campaign. The limits
+// are the ones the app itself enforces (routes/*.js), so whatever a seed
+// creates can still be edited on screen.
+// ---------------------------------------------------------------------------
+
+const text = (max) => z.string().trim().min(1).max(max);
+const optionalText = (max) => z.string().max(max).nullish();
+const dice = z.string().min(1).max(20).nullish();
+// A creature's damage may name its type: "1d6+2 necrotic".
+const damage = z.string().min(1).max(60).nullish();
+const score = z.number().int().min(1).max(30).optional();
+const gearLevel = z.number().int().min(1).max(MAX_GEAR_LEVEL);
+
+const gear = {
+  damageScaling: z.number().int().min(1).max(MAX_DAMAGE_SCALING).optional(),
+  minLevel: gearLevel.optional(),
+  isStartingOption: z.boolean().optional(),
+  effects: z.array(z.strictObject({ stat: z.enum(GEAR_STATS), amount: z.number().int().min(-100).max(100) })).max(12).optional(),
+  effectNote: optionalText(300),
+};
+
+const POOLS = {
+  weapons: {
+    library: WEAPON_LIBRARY,
+    row: z.strictObject({
+      name: text(80),
+      damageDice: z.string().min(1).max(20),
+      damageType: text(40),
+      attackAbility: z.enum(['STR', 'DEX', 'FINESSE']),
+      properties: z.array(z.string()).optional(),
+      rangeNormal: z.number().int().min(0).nullish(),
+      rangeLong: z.number().int().min(0).nullish(),
+      ...gear,
+    }),
+  },
+  items: {
+    library: ITEM_LIBRARY,
+    row: z.strictObject({ name: text(120), description: optionalText(2000), damageDice: dice, ...gear }),
+  },
+  spells: {
+    library: SPELL_LIBRARY,
+    row: z.strictObject({
+      name: text(80),
+      level: z.number().int().min(0).max(9),
+      damageDice: dice,
+      school: optionalText(40),
+      castingTime: optionalText(80),
+      range: optionalText(80),
+      duration: optionalText(80),
+      description: optionalText(4000),
+      isStartingOption: z.boolean().optional(),
+      revives: z.boolean().optional(),
+    }),
+  },
+  monsters: {
+    library: MONSTER_LIBRARY,
+    row: z.strictObject({
+      name: text(80),
+      ac: z.number().int().min(0).max(40),
+      maxHp: z.number().int().min(1).max(10000),
+      speed: z.number().int().min(0).max(500).optional(),
+      strScore: score,
+      dexScore: score,
+      conScore: score,
+      intScore: score,
+      wisScore: score,
+      chaScore: score,
+      attackBonus: z.number().int().min(-10).max(30).optional(),
+      damageDice: damage,
+      challengeRating: optionalText(10),
+      specialTrait: optionalText(500),
+      notes: optionalText(2000),
+    }),
+  },
+};
+
+const moneyAmount = z.number().int().min(1).max(1000000);
+
+// Something for sale: one weapon or one item from this seed's pools, by name.
+const wareSchema = z
+  .strictObject({
+    weapon: z.string().optional(),
+    item: z.string().optional(),
+    price: moneyAmount,
+    currency: z.enum(CURRENCIES).optional(),
+    level: gearLevel.nullish(),
+    stock: z.number().int().min(0).max(9999).nullish(),
+  })
+  .refine((ware) => Boolean(ware.weapon) !== Boolean(ware.item), { message: 'A ware sells one weapon or one item' });
+
+// Loot: money ({ gold: 25 }, or silver / copper / cash), a weapon or an item.
+const rewardSchema = z
+  .strictObject({
+    gold: moneyAmount.nullish(),
+    silver: moneyAmount.nullish(),
+    copper: moneyAmount.nullish(),
+    cash: moneyAmount.nullish(),
+    weapon: z.string().nullish(),
+    item: z.string().nullish(),
+    quantity: z.number().int().min(1).max(999).nullish(),
+    level: gearLevel.nullish(),
+    note: optionalText(200),
+  })
+  .refine((reward) => ['gold', 'silver', 'copper', 'cash', 'weapon', 'item'].filter((key) => reward[key] != null).length === 1, {
+    message: 'A reward is one thing: gold, silver, copper, cash, a weapon or an item',
+  });
+
+const npcSchema = z.strictObject({
+  name: text(80),
+  role: optionalText(80),
+  disposition: z.enum(['FRIENDLY', 'NEUTRAL', 'HOSTILE']).optional(),
+  description: optionalText(2000),
+  dmNotes: optionalText(4000),
+  ac: z.number().int().min(0).max(40).nullish(),
+  maxHp: z.number().int().min(1).max(10000).nullish(),
+  attackBonus: z.number().int().min(-10).max(30).nullish(),
+  damageDice: damage,
+  // A money changer: exchangeGold gold for exchangeCash cash, either way.
+  exchangeGold: moneyAmount.nullish(),
+  exchangeCash: moneyAmount.nullish(),
+  wares: z.array(wareSchema).optional(),
+});
+
+const encounterSchema = z.strictObject({
+  name: text(120),
+  mode: z.enum(['BATTLE', 'QUEST']).optional(),
+  description: optionalText(4000),
+  dmNotes: optionalText(4000),
+  location: z.string().nullish(),
+  // [monster name, how many, display name?, max HP?]
+  monsters: z
+    .array(z.tuple([z.string(), z.number().int().min(1).max(50)]).rest(z.union([z.string(), z.number().int().min(1), z.null(), z.undefined()])))
+    .optional(),
+  npcs: z.array(z.union([z.string(), z.strictObject({ name: z.string(), hp: z.number().int().min(0).optional() })])).optional(),
+  rewards: z.array(rewardSchema).optional(),
+  wares: z.array(wareSchema).optional(),
+});
+
+// A pool entry is a full row, or one copied from the site library: its key
+// alone, or { library: key } with fields to change on the copy. The rows
+// themselves are checked once the copies are made (resolvePool).
+const poolSchema = z.array(z.union([z.string(), z.record(z.string(), z.any())])).default([]);
+
+const seedSchema = z.strictObject({
+  code: z.string().regex(CODE_PATTERN, `The code is ${CODE_LENGTH} capital letters or digits`),
+  campaign: z.strictObject({
+    name: text(120),
+    description: optionalText(2000),
+    startingGold: z.number().int().min(0).max(1000000).optional(),
+    startingItemCount: z.number().int().min(0).max(50).optional(),
+    startingSpellCount: z.number().int().min(0).max(50).optional(),
+    skipMotivationRoll: z.boolean().optional(),
+    showMonsterHp: z.boolean().optional(),
+    areaAttackAcPenalty: z.number().int().min(0).max(10).optional(),
+    maxEquipped: z.number().int().min(1).max(20).optional(),
+    maxEquippedWeapons: z.number().int().min(0).max(20).optional(),
+  }),
+  locations: z.array(z.strictObject({ name: text(80), description: optionalText(2000) })).default([]),
+  weapons: poolSchema,
+  items: poolSchema,
+  spells: poolSchema,
+  monsters: poolSchema,
+  npcs: z.array(npcSchema).default([]),
+  encounters: z.array(encounterSchema).default([]),
+  // Note bodies, in reading order.
+  sharedNotes: z.array(text(10000)).default([]),
+  dmNotes: z.array(text(10000)).default([]),
+});
+
+class SeedError extends Error {}
+
+function issueList(error) {
+  return error.issues.map((issue) => `${issue.path.join('.') || '(file)'}: ${issue.message}`);
+}
+
+// Swaps library references for copies of the library's rows (less the key and
+// the picker-only tags) and checks every row. Problems are pushed to `problems`.
+function resolvePool(pool, entries, problems) {
+  const { library, row } = POOLS[pool];
+  const rows = [];
+  entries.forEach((entry, index) => {
+    let candidate = entry;
+    if (typeof entry === 'string' || (entry && entry.library)) {
+      const { library: key, ...changes } = typeof entry === 'string' ? { library: entry } : entry;
+      const template = library.find((item) => item.key === key);
+      if (!template) return problems.push(`${pool}.${index}: there is no "${key}" in the ${pool} library`);
+      const { key: _key, category, classes, ...copy } = template;
+      candidate = { ...copy, ...changes };
+    }
+    const parsed = row.safeParse(candidate);
+    if (!parsed.success) return problems.push(...issueList(parsed.error).map((issue) => `${pool}.${index} (${candidate.name || '?'}): ${issue}`));
+    rows.push(parsed.data);
+  });
+  return rows;
+}
+
+// Checks a seed file's export and returns it ready to create: library
+// references filled in, defaults applied. Throws a SeedError listing
+// everything wrong with it.
+function buildSeed(raw) {
+  const parsed = seedSchema.safeParse(raw);
+  if (!parsed.success) throw new SeedError(issueList(parsed.error).join('\n'));
+  const seed = parsed.data;
+  const problems = [];
+  for (const pool of Object.keys(POOLS)) seed[pool] = resolvePool(pool, seed[pool], problems);
+
+  // Encounters, rewards and wares point at things by name, so within a pool a
+  // name can only be used once.
+  const names = {};
+  for (const pool of ['locations', 'weapons', 'items', 'spells', 'monsters', 'npcs']) {
+    names[pool] = new Set();
+    for (const { name } of seed[pool]) {
+      if (names[pool].has(name)) problems.push(`${pool}: "${name}" is there twice`);
+      names[pool].add(name);
+    }
+  }
+  const gearByName = { weapon: new Map(seed.weapons.map((w) => [w.name, w])), item: new Map(seed.items.map((i) => [i.name, i])) };
+  const checkGear = (where, { weapon, item, level }) => {
+    const kind = weapon ? 'weapon' : 'item';
+    const entry = gearByName[kind].get(weapon || item);
+    if (!entry) return problems.push(`${where}: there is no ${kind} called "${weapon || item}"`);
+    if (level && level < (entry.minLevel || 1)) problems.push(`${where}: "${entry.name}" starts at level ${entry.minLevel}, so it can't be level ${level}`);
+  };
+
+  for (const npc of seed.npcs) {
+    if (Boolean(npc.exchangeGold) !== Boolean(npc.exchangeCash)) problems.push(`NPC "${npc.name}": an exchange rate needs both exchangeGold and exchangeCash`);
+    (npc.wares || []).forEach((ware) => checkGear(`NPC "${npc.name}" wares`, ware));
+  }
+  for (const encounter of seed.encounters) {
+    const where = `Encounter "${encounter.name}"`;
+    if (encounter.location && !names.locations.has(encounter.location)) problems.push(`${where}: there is no location called "${encounter.location}"`);
+    for (const [monster] of encounter.monsters || []) {
+      if (!names.monsters.has(monster)) problems.push(`${where}: there is no monster called "${monster}"`);
+    }
+    for (const entry of encounter.npcs || []) {
+      const name = typeof entry === 'string' ? entry : entry.name;
+      if (!names.npcs.has(name)) problems.push(`${where}: there is no NPC called "${name}"`);
+    }
+    for (const reward of encounter.rewards || []) if (reward.weapon || reward.item) checkGear(`${where} rewards`, reward);
+    (encounter.wares || []).forEach((ware) => checkGear(`${where} wares`, ware));
+  }
+
+  if (problems.length) throw new SeedError(problems.join('\n'));
+  return seed;
+}
+
+// ---------------------------------------------------------------------------
+// The folder
+// ---------------------------------------------------------------------------
+
+// Every seed file, good or bad: [{ file, code, seed } | { file, error }].
+// A file is only built again when it has changed on disk.
+const built = new Map();
+
+function loadSeeds(dir = SEEDS_DIR) {
+  if (!fs.existsSync(dir)) return [];
+  const results = [];
+  const codes = new Map();
+  for (const file of fs.readdirSync(dir).filter((name) => name.endsWith('.js')).sort()) {
+    const fullPath = path.join(dir, file);
+    const { mtimeMs } = fs.statSync(fullPath);
+    let entry = built.get(fullPath);
+    if (!entry || entry.mtimeMs !== mtimeMs) {
+      try {
+        delete require.cache[require.resolve(fullPath)];
+        const seed = buildSeed(require(fullPath));
+        entry = { mtimeMs, result: { file, code: seed.code, seed } };
+      } catch (err) {
+        entry = { mtimeMs, result: { file, error: err.message } };
+      }
+      built.set(fullPath, entry);
+    }
+    let { result } = entry;
+    if (result.code && codes.has(result.code)) {
+      result = { file, error: `Its code ${result.code} is already used by ${codes.get(result.code)}` };
+    } else if (result.code) {
+      codes.set(result.code, file);
+    }
+    results.push(result);
+  }
+  return results;
+}
+
+// The world behind a code, or null. A file with something wrong in it is
+// never offered; `npm run seeds:check` says what is wrong.
+function findSeed(code, dir = SEEDS_DIR) {
+  const wanted = normalizeCode(code);
+  const match = loadSeeds(dir).find((result) => result.code === wanted && !result.error);
+  return match ? match.seed : null;
+}
+
+module.exports = { SEEDS_DIR, CODE_LENGTH, SeedError, normalizeCode, buildSeed, loadSeeds, findSeed };

backend/src/seeds/seeds.test.js

@@ -0,0 +1,138 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { buildSeed, loadSeeds, findSeed, normalizeCode, SeedError } = require('./index');
+
+// The smallest seed there is, with whatever a test adds or changes.
+function seedWith(extra = {}) {
+  return { code: 'TEST01', campaign: { name: 'Test World' }, ...extra };
+}
+
+describe('the seeds in /backend/seeds', () => {
+  const results = loadSeeds();
+
+  test('every file is a valid world', () => {
+    expect(results.length).toBeGreaterThan(0);
+    for (const { file, error } of results) expect({ file, error }).toEqual({ file, error: undefined });
+  });
+
+  test('each has its own code', () => {
+    const codes = results.map((result) => result.code);
+    expect(new Set(codes).size).toBe(codes.length);
+  });
+});
+
+describe('buildSeed', () => {
+  test('fills in what is left out', () => {
+    const seed = buildSeed(seedWith());
+    expect(seed.weapons).toEqual([]);
+    expect(seed.encounters).toEqual([]);
+    expect(seed.sharedNotes).toEqual([]);
+  });
+
+  test('copies library entries, with changes, and drops the library-only fields', () => {
+    const seed = buildSeed(seedWith({ weapons: ['dagger', { library: 'longsword', isStartingOption: true, minLevel: 2 }], monsters: ['goblin'] }));
+    expect(seed.weapons[0]).toMatchObject({ name: 'Dagger', damageDice: '1d4' });
+    expect(seed.weapons[1]).toMatchObject({ name: 'Longsword', isStartingOption: true, minLevel: 2 });
+    expect(seed.weapons[0]).not.toHaveProperty('key');
+    expect(seed.weapons[0]).not.toHaveProperty('category');
+    expect(seed.monsters[0].name).toBe('Goblin');
+  });
+
+  test('refuses a code that is not six capital letters or digits', () => {
+    for (const code of ['abc123', 'ABC12', 'ABC1234', 'ABC-12', undefined]) {
+      expect(() => buildSeed(seedWith({ code }))).toThrow(SeedError);
+    }
+  });
+
+  test('refuses a misspelt field rather than leaving it out', () => {
+    expect(() => buildSeed(seedWith({ npcs: [{ name: 'Mira', desciption: 'A baker' }] }))).toThrow(/desciption/);
+    expect(() => buildSeed(seedWith({ items: [{ name: 'Rope', starting: true }] }))).toThrow(/starting/);
+  });
+
+  test('refuses an unknown library key', () => {
+    expect(() => buildSeed(seedWith({ spells: ['fire-bolt', 'not-a-spell'] }))).toThrow(/no "not-a-spell" in the spells library/);
+  });
+
+  test('refuses the same name twice in a pool', () => {
+    expect(() => buildSeed(seedWith({ weapons: ['dagger', 'dagger'] }))).toThrow(/"Dagger" is there twice/);
+  });
+
+  test('refuses an encounter that points at something the seed does not have', () => {
+    const encounter = (extra) => seedWith({ encounters: [{ name: 'The Bridge', ...extra }] });
+    expect(() => buildSeed(encounter({ location: 'Nowhere' }))).toThrow(/no location called "Nowhere"/);
+    expect(() => buildSeed(encounter({ monsters: [['Troll', 1]] }))).toThrow(/no monster called "Troll"/);
+    expect(() => buildSeed(encounter({ npcs: ['Mira'] }))).toThrow(/no NPC called "Mira"/);
+    expect(() => buildSeed(encounter({ rewards: [{ item: 'Rope' }] }))).toThrow(/no item called "Rope"/);
+    expect(() => buildSeed(encounter({ wares: [{ weapon: 'Dagger', price: 2 }] }))).toThrow(/no weapon called "Dagger"/);
+  });
+
+  test('a reward is exactly one thing', () => {
+    const rewards = (list) => seedWith({ items: [{ name: 'Rope' }], encounters: [{ name: 'The Bridge', rewards: list }] });
+    expect(buildSeed(rewards([{ gold: 5 }, { cash: 20 }, { item: 'Rope', quantity: 2 }])).encounters[0].rewards).toHaveLength(3);
+    expect(() => buildSeed(rewards([{ gold: 5, item: 'Rope' }]))).toThrow(SeedError);
+    expect(() => buildSeed(rewards([{ note: 'nothing' }]))).toThrow(SeedError);
+  });
+
+  test('gear cannot be sold or handed out below its starting level', () => {
+    const world = (ware) => seedWith({ items: [{ name: 'Old Crown', minLevel: 4 }], npcs: [{ name: 'Mira', wares: [ware] }] });
+    expect(buildSeed(world({ item: 'Old Crown', price: 100, level: 5 })).npcs[0].wares).toHaveLength(1);
+    expect(() => buildSeed(world({ item: 'Old Crown', price: 100, level: 2 }))).toThrow(/starts at level 4/);
+  });
+
+  test('an exchange rate needs both halves', () => {
+    expect(() => buildSeed(seedWith({ npcs: [{ name: 'Mira', exchangeGold: 1 }] }))).toThrow(/exchange rate/);
+    expect(buildSeed(seedWith({ npcs: [{ name: 'Mira', exchangeGold: 1, exchangeCash: 20 }] })).npcs[0].exchangeCash).toBe(20);
+  });
+
+  test('an effect has to be on a number the sheet has', () => {
+    const item = (effects) => seedWith({ items: [{ name: 'Shield', effects }] });
+    expect(buildSeed(item([{ stat: 'AC', amount: 2 }])).items[0].effects).toEqual([{ stat: 'AC', amount: 2 }]);
+    expect(() => buildSeed(item([{ stat: 'LUCK', amount: 2 }]))).toThrow(SeedError);
+  });
+});
+
+describe('the seeds folder', () => {
+  let dir;
+  const drop = (file, seed) => fs.writeFileSync(path.join(dir, file), `module.exports = ${JSON.stringify(seed)};`);
+
+  beforeEach(() => {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'seeds-'));
+  });
+  afterEach(() => {
+    fs.rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('a code finds its world however it is typed', () => {
+    drop('one.js', seedWith({ code: 'AB12CD' }));
+    expect(normalizeCode(' ab1-2cd ')).toBe('AB12CD');
+    expect(findSeed(' ab1-2cd ', dir).campaign.name).toBe('Test World');
+    expect(findSeed('ZZZZZZ', dir)).toBeNull();
+    expect(findSeed('', dir)).toBeNull();
+  });
+
+  test('a file dropped in later is picked up', () => {
+    expect(findSeed('LATER1', dir)).toBeNull();
+    drop('later.js', seedWith({ code: 'LATER1' }));
+    expect(findSeed('LATER1', dir)).not.toBeNull();
+  });
+
+  test('a broken file is reported and never offered, without hiding the good ones', () => {
+    drop('bad.js', seedWith({ code: 'BAD001', encounters: [{ name: 'X', monsters: [['Nobody', 1]] }] }));
+    drop('good.js', seedWith({ code: 'GOOD01' }));
+    fs.writeFileSync(path.join(dir, 'syntax.js'), 'module.exports = {');
+    const byFile = Object.fromEntries(loadSeeds(dir).map((result) => [result.file, result]));
+    expect(byFile['bad.js'].error).toMatch(/no monster called "Nobody"/);
+    expect(byFile['syntax.js'].error).toBeTruthy();
+    expect(byFile['good.js'].error).toBeUndefined();
+    expect(findSeed('BAD001', dir)).toBeNull();
+    expect(findSeed('GOOD01', dir)).not.toBeNull();
+  });
+
+  test('two files cannot share a code: the first keeps it', () => {
+    drop('a.js', seedWith({ code: 'SAME01', campaign: { name: 'First' } }));
+    drop('b.js', seedWith({ code: 'SAME01', campaign: { name: 'Second' } }));
+    expect(loadSeeds(dir)[1].error).toMatch(/already used by a\.js/);
+    expect(findSeed('SAME01', dir).campaign.name).toBe('First');
+  });
+});

backend/src/sockets/index.js

@@ -1,8 +1,11 @@
 const jwt = require('jsonwebtoken');
+const { loadCampaignMembership } = require('../middleware/campaignAccess');
 
 // Clients join a room per campaign (`campaign:<id>`) after authenticating with
 // the same JWT issued by /auth/login. Server-side route handlers emit into
 // these rooms (see character:updated, encounter:*-updated, character:created).
+// Events only ever carry ids: each client refetches its own view, since what
+// the DM, an owner and another player may see of the same thing differs.
 function attachSockets(io) {
   io.use((socket, next) => {
     const token = socket.handshake.auth && socket.handshake.auth.token;
@@ -17,8 +20,11 @@ function attachSockets(io) {
   });
 
   io.on('connection', (socket) => {
-    socket.on('campaign:join', (campaignId) => {
-      if (typeof campaignId === 'string') socket.join(`campaign:${campaignId}`);
+    socket.on('campaign:join', async (campaignId) => {
+      if (typeof campaignId !== 'string') return;
+      // Members only: a room's events are not for anyone who knows the id.
+      const membership = await loadCampaignMembership(socket.user.id, campaignId).catch(() => null);
+      if (membership) socket.join(`campaign:${campaignId}`);
     });
     socket.on('campaign:leave', (campaignId) => {
       if (typeof campaignId === 'string') socket.leave(`campaign:${campaignId}`);

backend/src/utils/grants.js

@@ -1,24 +1,120 @@
-// The two ways a character's belongings change: gold through the ledger, and
+// The two ways a character's belongings change: coins through the ledger, and
 // gear from the campaign pools. Shared by the character sheet routes and by
 // encounter rewards so both follow the same rules. Every function takes a
 // Prisma client or transaction client as `db`.
 
+// The coins, and what each is worth counted in copper: silver is 0.1 gold and
+// copper is 0.01 gold, so 1 gold = 10 silver = 100 copper and 1 silver = 10
+// copper. Whole numbers keep exchanges exact.
+const COINS = ['GOLD', 'SILVER', 'COPPER'];
+const COIN_VALUE = { GOLD: 100, SILVER: 10, COPPER: 1 };
+// Everything a purse can hold: the coins, plus cash ($) — modern money for
+// crossover worlds. Cash has no worth in coins, so it is never exchanged for
+// them and never used to make change.
+const CURRENCIES = [...COINS, 'CASH'];
+// Each currency is its own column on the character.
+const COIN_COLUMN = { GOLD: 'gold', SILVER: 'silver', COPPER: 'copper', CASH: 'cash' };
+
 class InsufficientGoldError extends Error {}
 
-// amount is signed: positive = gained, negative = spent. Writes the ledger row
-// and returns it; throws InsufficientGoldError if the balance would go below 0
-// (inside a transaction, that rolls the whole thing back).
-async function adjustGold(db, { characterId, amount, reason, userId, include }) {
+// amount is signed: positive = gained, negative = spent, in `currency` coins.
+// Writes the ledger row and returns it; throws InsufficientGoldError if that
+// coin's balance would go below 0 (inside a transaction, that rolls the whole
+// thing back). This moves exactly the coins named and nothing else; to pay a
+// price out of whatever coins the purse holds, use spendCoins.
+async function adjustGold(db, { characterId, amount, currency = 'GOLD', reason, userId, include }) {
+  const column = COIN_COLUMN[currency];
   // The atomic increment is the balance check: two spends racing each other
   // can't both pass a stale read.
-  const updated = await db.character.update({ where: { id: characterId }, data: { gold: { increment: amount } } });
-  if (updated.gold < 0) throw new InsufficientGoldError();
+  const updated = await db.character.update({ where: { id: characterId }, data: { [column]: { increment: amount } } });
+  if (updated[column] < 0) throw new InsufficientGoldError();
   return db.goldTransaction.create({
-    data: { characterId, amount, balanceAfter: updated.gold, reason: reason || null, createdById: userId },
+    data: { characterId, currency, amount, balanceAfter: updated[column], reason: reason || null, createdById: userId },
     include,
   });
 }
 
+// Works out which coins leave (and come back as change) when a purse pays
+// `amount` coins of `currency`. Returns the change to each balance, e.g.
+// { GOLD: -1, SILVER: 7, COPPER: 0 } for 3 silver paid from a purse with only
+// gold in it — or null if the whole purse isn't worth that much.
+//   1. Coins of the kind asked for go first.
+//   2. Any shortfall is met by breaking the nearest bigger coin; the change
+//      comes back in as few coins as possible.
+//   3. Only if there are no bigger coins left are smaller ones counted out.
+function planPayment(purse, currency, amount) {
+  const worth = (coin) => COIN_VALUE[coin];
+  const delta = { GOLD: 0, SILVER: 0, COPPER: 0 };
+  const left = (coin) => purse[coin] + delta[coin];
+  let owed = amount * worth(currency);
+  if (COINS.reduce((sum, coin) => sum + purse[coin] * worth(coin), 0) < owed) return null;
+
+  const pay = (coin, count) => {
+    delta[coin] -= count;
+    owed -= count * worth(coin);
+  };
+  pay(currency, Math.min(purse[currency], amount));
+
+  const bigger = COINS.filter((coin) => worth(coin) > worth(currency)).reverse(); // nearest first
+  for (const coin of bigger) {
+    if (owed <= 0) break;
+    pay(coin, Math.min(left(coin), Math.ceil(owed / worth(coin))));
+    // Overpaid: hand the difference back, biggest coins first.
+    let change = -owed;
+    for (const small of COINS.filter((c) => worth(c) < worth(coin))) {
+      if (change <= 0) break;
+      const count = Math.floor(change / worth(small));
+      delta[small] += count;
+      change -= count * worth(small);
+    }
+    if (owed < 0) owed = 0;
+  }
+
+  for (const coin of COINS.filter((c) => worth(c) < worth(currency))) {
+    if (owed <= 0) break;
+    pay(coin, Math.min(left(coin), Math.floor(owed / worth(coin))));
+  }
+  return delta;
+}
+
+// Pays `amount` coins of `currency` out of a character's purse, making change
+// as needed (see planPayment). Every coin that moved gets its own ledger row;
+// the rows are returned, the one in `currency` first when there is one. Throws
+// InsufficientGoldError if the purse as a whole can't cover it. Cash is paid in
+// cash alone: coins don't cover it, and it doesn't cover coins.
+async function spendCoins(db, { characterId, amount, currency = 'GOLD', reason, userId, include }) {
+  if (!COINS.includes(currency)) return [await adjustGold(db, { characterId, amount: -amount, currency, reason, userId, include })];
+  const character = await db.character.findUnique({ where: { id: characterId }, select: { gold: true, silver: true, copper: true } });
+  const purse = { GOLD: character.gold, SILVER: character.silver, COPPER: character.copper };
+  const delta = planPayment(purse, currency, amount);
+  if (!delta) throw new InsufficientGoldError();
+
+  const moved = COINS.filter((coin) => delta[coin] !== 0).sort((a, b) => (b === currency) - (a === currency));
+  const madeChange = moved.some((coin) => coin !== currency);
+  const label = reason || 'Spent';
+  const rows = [];
+  for (const coin of moved) {
+    rows.push(
+      await adjustGold(db, {
+        characterId,
+        amount: delta[coin],
+        currency: coin,
+        // Says what the payment was when the coins that moved aren't the ones asked for.
+        reason: madeChange ? `${label} (paid ${amount} ${currency.toLowerCase()}, with change)` : reason,
+        userId,
+        include,
+      })
+    );
+  }
+  return rows;
+}
+
+// A purse's coins as one figure in gold, for messages: 265 copper-worth -> 2.65.
+function worthInGold(character) {
+  const copper = COINS.reduce((sum, coin) => sum + character[COIN_COLUMN[coin]] * COIN_VALUE[coin], 0);
+  return copper / COIN_VALUE.GOLD;
+}
+
 const HELD = {
   weapon: { model: 'characterWeapon', key: 'weaponId' },
   item: { model: 'inventoryItem', key: 'itemId' },
@@ -37,4 +133,4 @@ async function giveGear(db, kind, { characterId, entry, quantity = 1, level, equ
   });
 }
 
-module.exports = { InsufficientGoldError, adjustGold, giveGear };
+module.exports = { CURRENCIES, COINS, COIN_VALUE, COIN_COLUMN, InsufficientGoldError, adjustGold, planPayment, spendCoins, worthInGold, giveGear };

backend/src/utils/hp.js

@@ -0,0 +1,78 @@
+// Temporary hit points are a buffer: damage comes off them first, and only
+// what is left over reaches real HP. Takes the character's HP and temp HP as
+// they are and the HP a damage/heal asked for (which may be below zero), and
+// returns what both should become. Healing never touches temp HP.
+function absorbDamage(currentHp, tempHp, requestedHp) {
+  const damage = currentHp - requestedHp;
+  if (damage <= 0 || tempHp <= 0) return { currentHp: requestedHp, tempHp };
+  const absorbed = Math.min(tempHp, damage);
+  return { currentHp: requestedHp + absorbed, tempHp: tempHp - absorbed };
+}
+
+// ---------------------------------------------------------------------------
+// At 0 HP — death saves
+// ---------------------------------------------------------------------------
+//
+// A character at 0 HP is dying: they roll a d20 each turn, and three successes
+// or three failures settle it. The tallies and the "stable" flag live on the
+// Character row, next to the HP they belong to.
+
+// Three successes steady a character; three failures kill them.
+const DEATH_SAVE_LIMIT = 3;
+
+const NO_DEATH_SAVES = { deathSaveSuccesses: 0, deathSaveFailures: 0, stable: false };
+
+// UP: on their feet. DYING: at 0 HP and rolling death saves. STABLE: at 0 HP
+// but no longer rolling. DEAD: three failures, or one blow too big to survive.
+function lifeState(character) {
+  if (character.deathSaveFailures >= DEATH_SAVE_LIMIT) return 'DEAD';
+  if (character.currentHp > 0) return 'UP';
+  return character.stable ? 'STABLE' : 'DYING';
+}
+
+// What the API sends about it, the same shape wherever a character's HP goes.
+function deathSaveInfo(character) {
+  return { state: lifeState(character), successes: character.deathSaveSuccesses, failures: character.deathSaveFailures };
+}
+
+// Turns a pair of tallies into what gets stored: the third failure is death,
+// and the third success makes the character stable, which clears the tallies.
+function settleDeathSaves(successes, failures) {
+  if (failures >= DEATH_SAVE_LIMIT) return { deathSaveSuccesses: successes, deathSaveFailures: DEATH_SAVE_LIMIT, stable: false };
+  if (successes >= DEATH_SAVE_LIMIT) return { ...NO_DEATH_SAVES, stable: true };
+  return { deathSaveSuccesses: successes, deathSaveFailures: failures, stable: false };
+}
+
+// Damage or healing on a finished character. `requestedHp` is the HP that was
+// asked for, which may be below zero or above max. Returns every column that
+// should be written: HP and temp HP, plus the death-save columns when the
+// change touches them.
+//
+// - Damage comes off temp HP first.
+// - Dropping to 0 starts the death saves from a clean slate.
+// - Damage taken while already at 0 is one failed save, and ends "stable".
+// - Damage that would leave as much as max HP still to take once HP is at 0
+//   kills outright.
+// - Any healing from 0 puts the character back up and clears the tallies.
+function changeHp(character, requestedHp, maxHp) {
+  const soaked = absorbDamage(character.currentHp, character.tempHp, requestedHp);
+  const after = { currentHp: Math.min(Math.max(soaked.currentHp, 0), maxHp), tempHp: soaked.tempHp };
+  if (after.currentHp > 0) return { ...after, ...NO_DEATH_SAVES };
+
+  const damage = character.currentHp - soaked.currentHp; // what got past temp HP
+  if (damage <= 0) return after;
+  if (-soaked.currentHp >= maxHp) return { ...after, ...settleDeathSaves(0, DEATH_SAVE_LIMIT) };
+  if (character.currentHp > 0) return { ...after, ...NO_DEATH_SAVES };
+  return { ...after, ...settleDeathSaves(character.deathSaveSuccesses, character.deathSaveFailures + 1) };
+}
+
+// A dying character's death save, from what the d20 showed: 10 or more is a
+// success, less is a failure, a 1 is two failures, and a 20 puts them back on
+// their feet with 1 HP.
+function rollDeathSave(character, roll) {
+  if (roll === 20) return { currentHp: 1, ...NO_DEATH_SAVES };
+  if (roll >= 10) return settleDeathSaves(character.deathSaveSuccesses + 1, character.deathSaveFailures);
+  return settleDeathSaves(character.deathSaveSuccesses, character.deathSaveFailures + (roll === 1 ? 2 : 1));
+}
+
+module.exports = { absorbDamage, DEATH_SAVE_LIMIT, NO_DEATH_SAVES, lifeState, deathSaveInfo, settleDeathSaves, changeHp, rollDeathSave };

backend/src/utils/hp.test.js

@@ -0,0 +1,84 @@
+const { lifeState, settleDeathSaves, changeHp, rollDeathSave } = require('./hp');
+
+const CLEAR = { deathSaveSuccesses: 0, deathSaveFailures: 0, stable: false };
+const hero = (over = {}) => ({ currentHp: 10, tempHp: 0, ...CLEAR, ...over });
+
+describe('lifeState', () => {
+  test('reads up, dying, stable and dead off the row', () => {
+    expect(lifeState(hero())).toBe('UP');
+    expect(lifeState(hero({ currentHp: 0 }))).toBe('DYING');
+    expect(lifeState(hero({ currentHp: 0, stable: true }))).toBe('STABLE');
+    expect(lifeState(hero({ currentHp: 0, deathSaveFailures: 3 }))).toBe('DEAD');
+  });
+});
+
+describe('changeHp', () => {
+  test('ordinary damage and healing leave the death saves clear', () => {
+    expect(changeHp(hero(), 4, 20)).toEqual({ currentHp: 4, tempHp: 0, ...CLEAR });
+    expect(changeHp(hero(), 99, 20)).toEqual({ currentHp: 20, tempHp: 0, ...CLEAR });
+  });
+
+  test('dropping to 0 starts the saves from nothing', () => {
+    expect(changeHp(hero(), -5, 20)).toEqual({ currentHp: 0, tempHp: 0, ...CLEAR });
+  });
+
+  test('damage at 0 HP is a failed save and ends stable', () => {
+    const down = hero({ currentHp: 0, deathSaveSuccesses: 2, deathSaveFailures: 1 });
+    expect(changeHp(down, -3, 20)).toMatchObject({ currentHp: 0, deathSaveSuccesses: 2, deathSaveFailures: 2, stable: false });
+    expect(changeHp(hero({ currentHp: 0, stable: true }), -3, 20)).toMatchObject({ deathSaveFailures: 1, stable: false });
+    expect(lifeState(changeHp(hero({ currentHp: 0, deathSaveFailures: 2 }), -1, 20))).toBe('DEAD');
+  });
+
+  test('temp HP that soaks the whole blow costs no save', () => {
+    const down = hero({ currentHp: 0, tempHp: 5, deathSaveFailures: 1 });
+    expect(changeHp(down, -5, 20)).toEqual({ currentHp: 0, tempHp: 0 });
+  });
+
+  test('asking for the HP they already have at 0 changes nothing', () => {
+    expect(changeHp(hero({ currentHp: 0, deathSaveFailures: 2 }), 0, 20)).toEqual({ currentHp: 0, tempHp: 0 });
+  });
+
+  test('damage of max HP or more past zero kills outright', () => {
+    expect(lifeState(changeHp(hero(), -19, 20))).toBe('DYING');
+    expect(lifeState(changeHp(hero(), -20, 20))).toBe('DEAD');
+    expect(lifeState(changeHp(hero({ currentHp: 0 }), -20, 20))).toBe('DEAD');
+    // Temp HP counts against the blow first.
+    expect(lifeState(changeHp(hero({ tempHp: 1 }), -20, 20))).toBe('DYING');
+  });
+
+  test('healing from 0 puts them back up with a clean slate', () => {
+    const down = hero({ currentHp: 0, deathSaveSuccesses: 1, deathSaveFailures: 2 });
+    expect(changeHp(down, 1, 20)).toEqual({ currentHp: 1, tempHp: 0, ...CLEAR });
+    expect(changeHp(hero({ currentHp: 0, stable: true }), 6, 20)).toEqual({ currentHp: 6, tempHp: 0, ...CLEAR });
+  });
+});
+
+describe('rollDeathSave', () => {
+  const down = (successes, failures) => hero({ currentHp: 0, deathSaveSuccesses: successes, deathSaveFailures: failures });
+
+  test('10 or more succeeds, less fails, a 1 fails twice', () => {
+    expect(rollDeathSave(down(0, 0), 10)).toEqual({ deathSaveSuccesses: 1, deathSaveFailures: 0, stable: false });
+    expect(rollDeathSave(down(0, 0), 19)).toEqual({ deathSaveSuccesses: 1, deathSaveFailures: 0, stable: false });
+    expect(rollDeathSave(down(0, 0), 9)).toEqual({ deathSaveSuccesses: 0, deathSaveFailures: 1, stable: false });
+    expect(rollDeathSave(down(0, 0), 1)).toEqual({ deathSaveSuccesses: 0, deathSaveFailures: 2, stable: false });
+  });
+
+  test('the third success makes them stable and clears the tallies', () => {
+    expect(rollDeathSave(down(2, 2), 14)).toEqual({ ...CLEAR, stable: true });
+  });
+
+  test('the third failure is death, and never counts past three', () => {
+    expect(rollDeathSave(down(2, 2), 5)).toMatchObject({ deathSaveFailures: 3 });
+    expect(rollDeathSave(down(0, 2), 1)).toMatchObject({ deathSaveFailures: 3 });
+  });
+
+  test('a 20 is 1 HP and a clean slate', () => {
+    expect(rollDeathSave(down(0, 2), 20)).toEqual({ currentHp: 1, ...CLEAR });
+  });
+});
+
+describe('settleDeathSaves', () => {
+  test('failures win a tie at three', () => {
+    expect(settleDeathSaves(3, 3)).toMatchObject({ deathSaveFailures: 3, stable: false });
+  });
+});

backend/src/utils/locations.js

@@ -0,0 +1,30 @@
+// Where characters are, and where they have been. A visit is recorded every
+// time a character is put somewhere and is never removed by moving on: the
+// set of visited locations is what a player is allowed to see. Every function
+// takes a Prisma client or transaction client as `db`.
+
+async function recordVisits(db, characterIds, locationId) {
+  if (characterIds.length === 0) return;
+  await db.characterLocationVisit.createMany({
+    data: characterIds.map((characterId) => ({ characterId, locationId })),
+    skipDuplicates: true,
+  });
+}
+
+async function moveCharacters(db, characterIds, locationId) {
+  if (characterIds.length === 0) return;
+  await db.character.updateMany({ where: { id: { in: characterIds } }, data: { currentLocationId: locationId } });
+  await recordVisits(db, characterIds, locationId);
+}
+
+// Ids of the locations any of this user's characters in the campaign has been to.
+async function visitedLocationIds(db, userId, campaignId) {
+  const visits = await db.characterLocationVisit.findMany({
+    where: { character: { userId, campaignId } },
+    select: { locationId: true },
+    distinct: ['locationId'],
+  });
+  return new Set(visits.map((v) => v.locationId));
+}
+
+module.exports = { recordVisits, moveCharacters, visitedLocationIds };

backend/src/utils/rest.js

@@ -0,0 +1,84 @@
+// Resting (the Hollowcrown book's Rules Cheat Sheet, "Resting"). Each function
+// takes a finished character and its sheet and returns the columns to write
+// plus an account of what happened, for the DM to read. Pure: no DB calls.
+//
+// Short rest (an hour): spend Hit Dice to heal, each one the class's die plus
+// the Constitution modifier. A warlock's spell slots come back.
+// Long rest (a night): all HP, all spell slots, Hit Dice up to half the level
+// (at least one), and temp HP is gone, except what the Hardy Boon gives.
+
+const { changeHp, lifeState, NO_DEATH_SAVES } = require('./hp');
+const { hardyTempHp } = require('../game/levelUp');
+
+// Once a day on a short rest a wizard or a druid (from level 2) gets some
+// spent slots back. Which ones is the player's choice, so the DM puts them
+// back on the sheet; this is the reminder, or null when it does not apply.
+function recoveryNote(character, sheet) {
+  const feature = character.characterClass === 'WIZARD' ? 'Arcane Recovery' : character.characterClass === 'DRUID' && character.level >= 2 ? 'Natural Recovery' : null;
+  if (!feature || !sheet.spellSlots || !sheet.spellSlots.levels.some((slot) => slot.used > 0)) return null;
+  const budget = Math.ceil(character.level / 2);
+  return `${feature}: once per day, ${character.name} can regain spent slots adding up to ${budget} slot level${budget === 1 ? '' : 's'} (none of 6th level or higher). Put them back on the sheet.`;
+}
+
+// A problem with the Hit Dice asked for, or null. `rolled` is the total the
+// dice showed, for dice rolled at the table.
+function hitDiceProblem(character, sheet, dice, rolled) {
+  if (dice === 0) return null;
+  const { size, remaining } = sheet.hitDice;
+  if (lifeState(character) === 'DYING') return `${character.name} is dying: steady or heal them before they spend Hit Dice.`;
+  if (dice > remaining) return `${character.name} has ${remaining} Hit ${remaining === 1 ? 'Die' : 'Dice'} left, not ${dice}.`;
+  if (rolled != null && (rolled < dice || rolled > dice * size)) {
+    return `${character.name}: ${dice}d${size} adds up to between ${dice} and ${dice * size}, not ${rolled}.`;
+  }
+  return null;
+}
+
+// `rolls` is what each Hit Die showed, or `rolled` their total when they were
+// rolled at the table. The Constitution modifier is added once per die, and
+// the rest never takes HP away.
+function shortRest(character, sheet, { dice = 0, rolls = null, rolled = null } = {}) {
+  const total = dice === 0 ? 0 : rolls ? rolls.reduce((sum, roll) => sum + roll, 0) : rolled;
+  const conBonus = dice * sheet.abilities.CON.modifier;
+  const healed = Math.max(0, total + conBonus);
+  const pact = Boolean(sheet.spellSlots) && sheet.spellSlots.restoresOn === 'SHORT';
+  const slotsRestored = pact && sheet.spellSlots.levels.some((slot) => slot.used > 0);
+
+  const data = {
+    ...(healed > 0 ? changeHp(character, character.currentHp + healed, sheet.hp.max) : {}),
+    hitDiceUsed: sheet.hitDice.used + dice,
+    ...(pact ? { spellSlotsUsed: [] } : {}),
+  };
+  const hpAfter = data.currentHp ?? character.currentHp;
+  return {
+    data,
+    result: {
+      hpBefore: character.currentHp,
+      hpAfter,
+      maxHp: sheet.hp.max,
+      tempHp: character.tempHp,
+      hitDice: { size: sheet.hitDice.size, spent: dice, rolls, total, conBonus, healed: hpAfter - character.currentHp, left: sheet.hitDice.remaining - dice, of: sheet.hitDice.count, regained: 0 },
+      slotsRestored,
+      notes: [recoveryNote(character, sheet)].filter(Boolean),
+    },
+  };
+}
+
+function longRest(character, sheet) {
+  const regained = Math.min(sheet.hitDice.used, Math.max(1, Math.floor(character.level / 2)));
+  const tempHp = hardyTempHp(character.specialAbilities);
+  const data = { currentHp: sheet.hp.max, tempHp, ...NO_DEATH_SAVES, hitDiceUsed: sheet.hitDice.used - regained, spellSlotsUsed: [] };
+  return {
+    data,
+    result: {
+      hpBefore: character.currentHp,
+      hpAfter: sheet.hp.max,
+      maxHp: sheet.hp.max,
+      tempHp,
+      hitDice: { size: sheet.hitDice.size, spent: 0, rolls: null, total: 0, conBonus: 0, healed: 0, left: sheet.hitDice.remaining + regained, of: sheet.hitDice.count, regained },
+      slotsRestored: Boolean(sheet.spellSlots) && sheet.spellSlots.levels.some((slot) => slot.used > 0),
+      notes: tempHp > 0 ? [`Hardy: ${tempHp} Temp HP for the day.`] : [],
+    },
+  };
+}
+
+module.exports = { hitDiceProblem, shortRest, longRest };

backend/src/utils/rest.test.js

@@ -0,0 +1,109 @@
+const { hitDiceProblem, shortRest, longRest } = require('./rest');
+const { computeCharacterSheet } = require('../game/calculations');
+
+const CLEAR = { deathSaveSuccesses: 0, deathSaveFailures: 0, stable: false };
+// A level 5 fighter (d10) with CON 14 (+2): 10 + 2 + 4 × (6 + 2) = 44 HP.
+const hero = (over = {}) => ({
+  name: 'Aria',
+  characterClass: 'FIGHTER',
+  level: 5,
+  conScore: 14,
+  currentHp: 10,
+  tempHp: 0,
+  hitDiceUsed: 0,
+  spellSlotsUsed: [],
+  specialAbilities: null,
+  ...CLEAR,
+  ...over,
+});
+const sheet = (character) => computeCharacterSheet(character);
+
+describe('shortRest', () => {
+  test('spent Hit Dice heal what they rolled plus Constitution for each', () => {
+    const c = hero();
+    const { data, result } = shortRest(c, sheet(c), { dice: 2, rolls: [7, 4] });
+    expect(data).toMatchObject({ currentHp: 25, hitDiceUsed: 2 });
+    expect(result).toMatchObject({ hpBefore: 10, hpAfter: 25, maxHp: 44 });
+    expect(result.hitDice).toMatchObject({ size: 10, spent: 2, total: 11, conBonus: 4, healed: 15, left: 3, of: 5 });
+  });
+
+  test('takes a total rolled at the table, stops at max HP, and never takes HP away', () => {
+    const c = hero({ currentHp: 40 });
+    expect(shortRest(c, sheet(c), { dice: 1, rolled: 9 }).data.currentHp).toBe(44);
+    const frail = hero({ conScore: 3, currentHp: 10 }); // CON -4
+    const rest = shortRest(frail, sheet(frail), { dice: 1, rolled: 2 });
+    expect(rest.data.currentHp).toBeUndefined();
+    expect(rest.data.hitDiceUsed).toBe(1);
+    expect(rest.result.hitDice.healed).toBe(0);
+  });
+
+  test('with no dice spent nothing changes for a fighter', () => {
+    const c = hero({ hitDiceUsed: 3 });
+    expect(shortRest(c, sheet(c)).data).toEqual({ hitDiceUsed: 3 });
+  });
+
+  test('gives a warlock their slots back, and nobody else', () => {
+    const warlock = hero({ characterClass: 'WARLOCK', spellSlotsUsed: [0, 0, 2] });
+    const rest = shortRest(warlock, sheet(warlock));
+    expect(rest.data.spellSlotsUsed).toEqual([]);
+    expect(rest.result.slotsRestored).toBe(true);
+
+    const wizard = hero({ characterClass: 'WIZARD', spellSlotsUsed: [2, 1] });
+    const wizardRest = shortRest(wizard, sheet(wizard));
+    expect(wizardRest.data.spellSlotsUsed).toBeUndefined();
+    expect(wizardRest.result.slotsRestored).toBe(false);
+    // ...but a wizard is reminded of Arcane Recovery: half their level, rounded up.
+    expect(wizardRest.result.notes).toEqual([expect.stringContaining('Arcane Recovery')]);
+    expect(wizardRest.result.notes[0]).toContain('3 slot levels');
+    const fresh = hero({ characterClass: 'WIZARD' });
+    expect(shortRest(fresh, sheet(fresh)).result.notes).toEqual([]);
+  });
+
+  test('wakes a stable character who spends a Hit Die', () => {
+    const c = hero({ currentHp: 0, stable: true });
+    expect(shortRest(c, sheet(c), { dice: 1, rolled: 5 }).data).toMatchObject({ currentHp: 7, ...CLEAR });
+  });
+});
+
+describe('hitDiceProblem', () => {
+  test('refuses more dice than are left, an impossible total, and the dying', () => {
+    const c = hero({ hitDiceUsed: 4 });
+    expect(hitDiceProblem(c, sheet(c), 0)).toBeNull();
+    expect(hitDiceProblem(c, sheet(c), 1, 10)).toBeNull();
+    expect(hitDiceProblem(c, sheet(c), 1)).toBeNull();
+    expect(hitDiceProblem(c, sheet(c), 2)).toMatch(/1 Hit Die left/);
+    expect(hitDiceProblem(c, sheet(c), 1, 11)).toMatch(/between 1 and 10/);
+    expect(hitDiceProblem(c, sheet(c), 1, 0)).toMatch(/between 1 and 10/);
+    const dying = hero({ currentHp: 0 });
+    expect(hitDiceProblem(dying, sheet(dying), 1)).toMatch(/dying/);
+  });
+});
+
+describe('longRest', () => {
+  test('heals to full, gives back every slot and half the level in Hit Dice', () => {
+    const c = hero({ characterClass: 'WIZARD', currentHp: 3, tempHp: 4, hitDiceUsed: 5, spellSlotsUsed: [4, 3, 2] });
+    const { data, result } = longRest(c, sheet(c));
+    expect(data).toEqual({ currentHp: sheet(c).hp.max, tempHp: 0, ...CLEAR, hitDiceUsed: 3, spellSlotsUsed: [] });
+    expect(result.hitDice).toMatchObject({ regained: 2, left: 2, of: 5 });
+    expect(result.slotsRestored).toBe(true);
+  });
+
+  test('gives back at least one Hit Die, and no more than were spent', () => {
+    const novice = hero({ level: 1, hitDiceUsed: 1 });
+    expect(longRest(novice, sheet(novice)).data.hitDiceUsed).toBe(0);
+    const rested = hero({ hitDiceUsed: 1 });
+    expect(longRest(rested, sheet(rested)).result.hitDice).toMatchObject({ regained: 1, left: 5 });
+  });
+
+  test('gets a dying character back on their feet', () => {
+    const c = hero({ currentHp: 0, deathSaveFailures: 2, deathSaveSuccesses: 1 });
+    expect(longRest(c, sheet(c)).data).toMatchObject({ currentHp: 44, ...CLEAR });
+  });
+
+  test('leaves the Hardy Boon its Temp HP', () => {
+    const c = hero({ tempHp: 2, specialAbilities: 'Hardy — +10 maximum HP: gain 10 Temp HP after each long rest.' });
+    const { data, result } = longRest(c, sheet(c));
+    expect(data.tempHp).toBe(10);
+    expect(result.notes).toEqual(['Hardy: 10 Temp HP for the day.']);
+  });
+});

backend/src/utils/sheet.js

@@ -0,0 +1,35 @@
+// Loading a character so that its sheet comes out right. The sheet depends on
+// what the character has equipped (game/calculations.js, activeGear), so every
+// query that feeds computeCharacterSheet includes the same relations.
+
+const { computeCharacterSheet } = require('../game/calculations');
+
+const SHEET_INCLUDE = {
+  skillProficiencies: true,
+  saveProficiencies: true,
+  inventoryItems: { include: { item: true } },
+  weapons: { include: { weapon: true } },
+};
+
+function sheetOf(character) {
+  return computeCharacterSheet(character, character.skillProficiencies, character.saveProficiencies);
+}
+
+// Equipping, unequipping or changing gear can lower a character's maximum HP.
+// Brings current HP back down to the new maximum where it is now above it,
+// and returns the ids of the characters that changed. Takes a Prisma client or
+// transaction client as `db`.
+async function settleHp(db, characterIds) {
+  const changed = [];
+  const characters = await db.character.findMany({ where: { id: { in: [...new Set(characterIds)] }, buildStage: 'COMPLETE' }, include: SHEET_INCLUDE });
+  for (const character of characters) {
+    const max = sheetOf(character).hp.max;
+    if (character.currentHp > max) {
+      await db.character.update({ where: { id: character.id }, data: { currentHp: max } });
+      changed.push(character.id);
+    }
+  }
+  return changed;
+}
+
+module.exports = { SHEET_INCLUDE, sheetOf, settleHp };

docs/CHARACTERS.md

@@ -7,7 +7,10 @@ This describes the code as it stands. The formulas live in
 `backend/src/game/calculations.js`; the build flow lives in
 `backend/src/game/buildFlow.js` and `backend/src/routes/characters.routes.js`;
 the lists the story steps pick from are in
-`backend/src/game/data/characterOptions.js`.
+`backend/src/game/data/characterOptions.js`. Levelling up is
+`backend/src/game/levelUp.js` (the class tables are in
+`backend/src/game/data/levelFeatures.js`), and resting is
+`backend/src/utils/rest.js`.
 
 Related: [WEAPONS.md](WEAPONS.md), [SPELLS.md](SPELLS.md),
 [ITEMS.md](ITEMS.md), [ENCOUNTERS.md](ENCOUNTERS.md),
@@ -39,6 +42,7 @@ is the current behaviour.
 18. [Deleting](#18-deleting)
 19. [What is not modelled](#19-what-is-not-modelled)
 20. [Everything the builder offers](#20-everything-the-builder-offers)
+21. [What each class gains as it levels](#21-what-each-class-gains-as-it-levels)
 
 ---
 
@@ -137,7 +141,7 @@ this order:
 
 These are table rules written in plain words for the DM to apply. The app
 does not calculate anything from them: Rage does not add damage by itself, and
-Unarmored Defense does not change AC unless the DM sets the armor bonus.
+Unarmored Defense does not change AC unless the DM sets the extra AC.
 
 **Background** is five lines, one per question:
 
@@ -278,11 +282,77 @@ Ability scores cannot be changed after the build is finalized.
 ## 6. Level and XP
 
 - Every character starts at **level 1**. The range is 1 to 20.
-- Levelling is **manual**: the DM changes the Level field on the sheet. Only
-  the DM can change level or XP.
+- Only the DM can change level or XP. There are two ways to change a level,
+  both on the sheet: the **⬆ Level Up…** button, and the Level field.
 - **XP** is stored but no screen shows or edits it, and it does not drive level.
 
-Level feeds two things:
+### Level Up: the checklist
+
+"⬆ Level Up…" takes a character up **one level** and does everything that
+goes with it. It opens a pop-out that lists the five steps and asks for the
+choices; nothing changes until the DM presses "Level up to N".
+
+| Step | What the site does | What the DM chooses |
+|---|---|---|
+| 1. Level | Raises the level by one. Proficiency bonus, saves, skills and spell DC follow | Nothing |
+| 2. Hit points | Works out the new max HP and heals to it (a dead character stays dead). One more Hit Die | Nothing |
+| 3. Special abilities | Writes the class's new features for that level into Special Abilities ([section 21](#21-what-each-class-gains-as-it-levels)) | The **Boon**, at a level that grants one |
+| 4. Spells | Gives a caster a fresh set of spell slots for the new level, and grants the spells ticked | Which spells to grant, from the campaign's spell list |
+| 5. Gear | Raises one weapon by one gear level | Which weapon, or none |
+
+**Special abilities.** Each feature is one line, "Name — what it does". A
+feature that grows (Sneak Attack gaining a die, Rage gaining a use) rewrites
+the line it already has; anything else is added at the end. Where a line says
+"choose" (a fighting style, metamagic, an invocation), the DM edits it once
+the player has chosen. From level 5 every class that casts also gets a
+"Cantrips" line: damaging cantrips roll double the dice shown.
+
+The class tables run from **level 2 to level 10** and follow one path per
+class (there are no subclasses): Berserker barbarian, Lore bard, Life cleric,
+Land druid, Champion fighter, Open Hand monk, Devotion paladin, Hunter ranger,
+Thief rogue, Draconic sorcerer, a fiend-like warlock patron, Evocation wizard.
+Above level 10 the numbers still move but no feature is written; add them by
+hand.
+
+**Boons** stand in for ability score increases, which the site does not have
+(every number on the sheet comes from the scores rolled at the build). Most
+classes get one at levels 4 and 8; a fighter also at 6, a rogue also at 10.
+
+| Boon | What it is | What the site does |
+|---|---|---|
+| Weapon Mastery | +1 to attack and damage rolls with weapons | Writes the line. The player adds the +1 to the numbers shown |
+| Arcane Focus | +1 to spell save DC and spell attack bonus | Writes the line. The player adds the +1 to the numbers shown |
+| Toughened | +1 AC | Writes the line and raises **Extra AC** by 1 |
+| Hardy | +5 maximum HP, as temp HP | Writes the line, gives 5 **temp HP** now and again after every long rest |
+
+Toughened can be taken once; each of the others twice (its one line then
+reads +2, or +10).
+
+**Spells.** The pop-out says what the book's unlock schedule allows at the new
+level, and lists the campaign's spells the character does not yet know, up to
+the highest slot level they now have. What is ticked is granted; the count is
+the DM's to keep.
+
+| Class | New spells each level | Extra cantrip |
+|---|---|---|
+| Bard, Cleric, Druid, Sorcerer, Warlock | 1 | At levels 4 and 10 |
+| Wizard | 2 | At levels 4 and 10 |
+| Paladin, Ranger | 2 at level 2, then 1 at each odd level | None |
+
+**Gear.** The free upgrade goes to one held weapon of **standard growth**
+whose gear level is below the character's new level (the equipped one is
+offered first). Powerful and legendary weapons never get it.
+
+### The Level field
+
+Typing a number into Level sets it outright: for a character who joins late,
+or to put a mistake right. Going **up** this way still writes down every
+feature the class gains on the way, but it asks nothing: a Boon is left as a
+line saying one is owed ("Boon (level 4) — Choose one with your DM…"), HP is
+not healed, no spell is granted and no weapon is raised. Going **down** takes
+no special ability away; the DM edits the text.
+
+Level feeds these things:
 
 **Proficiency bonus** — `2 + (level − 1) ÷ 4`, rounded down.
 
@@ -294,7 +364,9 @@ Level feeds two things:
 | 13–16 | +5 |
 | 17–20 | +6 |
 
-**Max HP** — see the next section.
+**Max HP** and **Hit Dice** — see the next section.
+
+**Spell slots** — how many a caster has ([SPELLS.md](SPELLS.md), section 8).
 
 ## 7. Hit points
 
@@ -315,31 +387,128 @@ Example: a Fighter (d10) with CON 14 (+2) has 12 at level 1 and 28 at level 3.
 **Current HP** is a stored number, separate from max:
 
 - Set to max when the build is finalized, and when a character is copied.
-- Changed with the Damage and Heal buttons on the sheet, or by the DM in an
-  encounter (section 15). Both change the same number.
+- Changed by the **DM only**: with the Damage and Heal buttons on the sheet,
+  or in an encounter (section 15). Both change the same number. A player sees
+  their HP but has no buttons to change it, and the server refuses the change.
 - Always kept between **0 and max**: healing stops at max and damage stops at 0.
-- A level-up raises max but leaves current HP where it was; the DM clicks
-  "Recompute Max HP" to set current HP to the new max (a full heal). If a
-  level change lowers max below current HP, current HP drops to the new max.
+- "⬆ Level Up…" heals to the new max. A level typed into the Level field
+  raises max but leaves current HP where it was; the DM clicks "Recompute Max
+  HP" to set current HP to the new max (a full heal). If a level change lowers
+  max below current HP, current HP drops to the new max.
 
-**Temp HP** is a tracked number shown beside HP. Damage is not taken from it
-automatically.
+**Temp HP** is a tracked number shown beside HP, set by the DM. Damage comes
+off it first. A long rest clears it.
+
+### Hit Dice and rests
+
+A character has **one Hit Die per level**, of their class's size (the same die
+as in the table above). The sheet, the character panel and the party overview
+show how many are left. Only the DM changes that number: with a rest, or by
+typing into "Hit Dice left" on the sheet.
+
+The DM's **🛏 Rest…** button is on the campaign page (beside "Characters") and
+on the party overview. It opens a pop-out: tick who rests, pick short or long,
+and press the button. Everyone ticked rests at once, and the pop-out then says
+what it did for each of them. Dead characters start unticked, and a rest does
+nothing for them.
+
+| | Short rest (1 hour) | Long rest (8 hours) |
+|---|---|---|
+| HP | Each Hit Die spent heals what it rolled + the CON modifier | Back to max; death saves cleared |
+| Hit Dice | The ones spent are used up | Spent ones come back, up to half the level (at least 1) |
+| Spell slots | A warlock gets all of theirs back | Everyone gets all of theirs back |
+| Temp HP | Unchanged | Cleared, then the Hardy Boon gives its 5 or 10 |
+
+**Spending Hit Dice.** On a short rest each resting character has a line that
+says what they can roll: "Spend [ ] of 3 d10". The DM types how many dice the
+player spends, and the pop-out shows what to roll ("Roll 2d10") and the
+Constitution that will be added. Then either:
+
+- the player rolls real dice and the DM types **what they added up to**, or
+- the total is left empty and **the site rolls** them, and shows each die.
+
+The healing is the total, plus the CON modifier once for each die, and never
+less than nothing. It stops at max HP. A dying character cannot spend Hit
+Dice until they are steadied or healed; a stable one can, and wakes up.
+
+A short rest is refused as a whole, with nothing changed for anyone, if a
+character is asked to spend more dice than they have or the total typed is not
+one those dice could show.
+
+After a short rest a wizard (Arcane Recovery) or a druid of level 2 or more
+(Natural Recovery) with spent slots gets a reminder: once per day they may
+regain slots adding up to half their level, rounded up. Which slots is the
+player's choice, so the DM puts them back on the sheet.
+
+### At 0 HP: death saves
+
+A character at 0 HP is in one of three states, shown on the sheet under the
+HP bar, on their encounter card, in the quick stats and in the party lists.
+
+| State | Meaning | How it ends |
+|---|---|---|
+| Dying | Rolling death saves | Three successes, three failures, healing, or being stabilised |
+| Stable | At 0 HP, no longer rolling | Healing wakes them; damage makes them Dying again |
+| Dead | Three failures, or one blow too big to survive | The DM's **Revive at 1 HP**, or an ally's reviving spell in a battle |
+
+**Rolling.** While Dying, type what the d20 showed and click **Death save**.
+The app does not roll it.
+
+| Roll | Result |
+|---|---|
+| 1 | Two failures |
+| 2 to 9 | One failure |
+| 10 to 19 | One success |
+| 20 | Back up with 1 HP, tallies cleared |
+
+- **Three successes:** Stable. The tallies are cleared.
+- **Three failures:** Dead.
+- **Stabilise** makes a Dying character Stable without a roll, for when
+  someone steadies them (a Medicine check, a healer's kit, a spell).
+- **Damage at 0 HP** is one failed save, and makes a Stable character Dying
+  again. Damage soaked entirely by temp HP does not count. The app cannot tell
+  a critical hit; the DM adds its second failure by clicking a pip.
+- **Massive damage:** if a blow leaves as much as the character's max HP
+  still to take once HP reaches 0, they are Dead at once. A character with
+  12 max HP on 5 HP dies from 17 damage or more.
+- **Healing** from 0, by any amount, puts the character back up and clears
+  the tallies and Stable.
+- **Dead** characters cannot be healed: Heal is refused with a message. The
+  DM clicks **Revive at 1 HP**, then heals as normal. In a battle, an ally
+  with a reviving spell can do the same on their own turn, and until then the
+  dead are hidden from the players' encounter screen: see
+  [ENCOUNTERS.md](ENCOUNTERS.md), section 6.
+- The **DM** can click a pip to set either tally by hand, to fix a mistake.
+
+Dropping to 0 always starts from empty tallies. None of this changes any
+other number on the sheet, and nothing is added to the conditions in an
+encounter.
 
 ## 8. Other derived stats
 
 | Stat | Formula |
 |---|---|
-| Armor Class | 10 + DEX modifier + armor bonus |
-| Initiative | DEX modifier |
-| Speed | Species speed, unless a speed override is set |
-| Passive Perception | 10 + Perception skill bonus |
+| Armor Class | 10 + DEX modifier + equipped gear + the DM's extra AC |
+| Initiative | DEX modifier + equipped gear |
+| Speed | Species speed, unless a speed override is set, + equipped gear |
+| Passive Perception | 10 + Perception skill bonus + equipped gear |
 | Hit dice | One per level, of the class's die size (shown only; not spent or tracked) |
 | Spell save DC | 8 + proficiency bonus + spellcasting ability modifier |
 | Spell attack bonus | Proficiency bonus + spellcasting ability modifier |
 
-**Armor bonus** is a single number typed in on the sheet to stand for armor and
-shield. There are no armor items, and equipping an inventory item does not
-change AC.
+**Equipped gear.** Armor, shields and other gear are items (and weapons) with
+**effects**: bonuses and penalties to AC, speed, initiative, max HP, passive
+Perception, ability scores, saving throws and skills. They apply on their own
+while the thing is equipped, and stop when it comes off. Every number on the
+sheet already includes them, and the "From Equipped Gear" card says which
+item is doing what. An effect on an ability score changes the score itself,
+so everything in sections 5 to 10 that is built on that ability moves too.
+The full rules are in [ITEMS.md](ITEMS.md), section 5.
+
+**Extra AC** is a number only the DM can set on the sheet, added to AC on top
+of gear, for anything an item does not cover. It can be negative. (It used to
+be called "armor bonus" and stood in for all armor; characters keep whatever
+it was set to.)
 
 **Speed override** exists in the data and API (DM only) but has no field on
 the sheet.
@@ -366,7 +535,9 @@ calculations but is only ever set if the DM supplies it during step 5.
 
 ## 10. Gear pools, starting options and gear levels
 
-Each campaign has three **pools**, managed by the DM on the campaign page:
+Each campaign has three **pools**, managed by the DM on the campaign page,
+each in a part of its own ("Weapons", "Items", "Spells") where every entry
+opens in a pop-out:
 
 | Pool | What an entry holds | How entries are added |
 |---|---|---|
@@ -383,7 +554,10 @@ character.
   characters from the pool, changes how many a character has, levels them up,
   and takes them away.
 - **The owning player** can tick and untick Equipped (weapons, items) and
-  Prepared (spells) on gear their character can use, and can **give** what
+  Prepared (spells) on gear their character can use, at any time, including
+  mid-encounter. Only so much can be equipped at once: by default two things,
+  one of them a weapon (a campaign setting; [ITEMS.md](ITEMS.md), section 3).
+  A weapon has to be equipped to be used in an encounter, and can **give** what
   their character holds to another character (section 12).
 - Removing an entry from a pool removes it from every character holding it.
 
@@ -418,8 +592,9 @@ starting level, copies below it are lifted to it and unequipped.
 | … | … |
 
 Gear above the character's level can still be **held**, but it shows
-"Requires level N", cannot be equipped, and is left out of quick stats and
-encounters. If the DM levels a piece of gear past its holder, or lowers the
+"Requires level N", cannot be equipped, gives none of its effects, and is
+left out of the character's encounter card. The character panel still lists
+it, marked "needs level N". If the DM levels a piece of gear past its holder, or lowers the
 character's level, anything now out of reach is unequipped automatically.
 
 **How damage grows.** The dice in the pool are the damage at the gear's
@@ -475,6 +650,10 @@ value, which is fixed.
 ## 11. Weapons and spells
 
 A character holds weapons, each with a quantity, a level and an equipped flag.
+Only an **equipped** weapon is in hand: it is the one shown on the character's
+encounter card and offered in the DM's attack bar. One weapon can be equipped
+at a time unless the campaign allows more, so a weapon for each hand is one
+weapon made as a pair ([WEAPONS.md](WEAPONS.md), sections 3 and 4).
 
 | Number | Formula |
 |---|---|
@@ -499,27 +678,66 @@ A character knows spells, each with a prepared flag.
 - A spell's damage, if it has one, is shown beside it. It is fixed.
 - Spell save DC and attack bonus are shown only for classes with a
   spellcasting ability.
-- There are no spell slots.
+- A caster has **spell slots**, from class and level, tracked on the sheet
+  and in the character panel ([SPELLS.md](SPELLS.md), section 8).
 
 ## 12. Inventory and money
 
 **Inventory** is the items a character holds from the campaign's item pool,
 each with a quantity, a level and an equipped flag. Giving an item the
-character already has adds to the stack. Items have no effect on any stat. An
+character already has adds to the stack. An item can have **effects** that
+change the sheet while it is equipped: this is how armor works
+([ITEMS.md](ITEMS.md), section 5). An
 item can carry optional dice (a potion's healing, a bomb's damage) that grow
 with its level exactly like a weapon's (section 10).
 
-**Money** is a single gold balance with a log behind it.
+**Money** is a purse of three coins, each counted on its own, with a log
+behind it.
 
-- The sheet's Money card shows the balance and every change to it: the amount,
-  what it was for, who recorded it, when, and the balance afterwards.
-- The **owning player and the DM** can both record a gain or a spend. Other
-  members can see the log but not add to it.
-- The balance **cannot go below zero**; a spend larger than the balance is
-  refused.
-- The log is the only way the balance changes. Entries cannot be edited or
-  deleted; to correct a mistake, record the opposite entry.
-- There is one currency (gold). Silver, copper and so on are not tracked.
+| Coin | Worth |
+|---|---|
+| Gold (gp) | 1 gold |
+| Silver (sp) | 0.1 gold — 10 to the gold |
+| Copper (cp) | 0.01 gold — 100 to the gold, 10 to the silver |
+
+- The sheet's Money card shows the three balances, what the purse is worth in
+  gold altogether, and every change: the amount and coin, what it was for, who
+  recorded it, when, and that coin's balance afterwards.
+- Only the **DM** records a gain or a spend, choosing the coin: a player
+  cannot add money to their own purse or write it off. A player's money
+  moves by exchanging coins, giving to another character, and trading with
+  an NPC; it arrives from the DM, an encounter reward, a gift or an NPC.
+  Other players cannot see the purse or the log.
+- **Spending makes change for you.** A spend (or a gift to another character)
+  is paid from the whole purse. Coins of the kind named go first; if there
+  aren't enough, the nearest bigger coin is broken and the change comes back
+  in as few coins as possible; if there are no bigger coins, smaller ones are
+  counted out. Spending 3 silver from a purse of 5 gold leaves 4 gold and 7
+  silver. Each coin that moved gets its own log entry, marked "with change".
+- A spend is refused only when the **whole purse** isn't worth enough.
+- **Exchange** turns coins of one kind into another at the worth above, and
+  logs both sides. It moves exactly the coins named and has to come to whole
+  coins: silver into gold goes in tens, copper into silver in tens, copper
+  into gold in hundreds.
+- The log is the only way a balance changes. Entries cannot be edited or
+  deleted; to correct a mistake, the DM records the opposite entry.
+- Starting gold (a campaign setting) is gold only. Encounter rewards and gifts
+  between characters can be in any coin, or in cash.
+- **Cash ($)** is a fourth balance for crossover worlds, counted in whole
+  dollars and shown as `$40`. It is gained, spent, given and awarded like a
+  coin and has its own log entries, but it has no worth in coins: it cannot
+  be exchanged on the sheet, a cash spend is paid from cash alone, and cash
+  is never broken to cover a coin spend. It shows in the purse only when
+  held.
+- **Gold and cash are changed for each other by an NPC**, not on the sheet.
+  An NPC the DM has given an exchange rate ("1 gold = $5") changes them
+  either way at that rate, in an NPC quest in progress that both the NPC and
+  the character are in. Only gold and cash: silver and copper are not taken.
+  Each NPC has their own rate. See [NPCS.md](NPCS.md), section 5.
+- **Buying.** In the same kind of scene a character can buy the weapons and
+  items an NPC, or the encounter itself, has for sale. The price is paid from
+  the purse like any other spend and logged as "Bought <thing> from <NPC>".
+  See [ENCOUNTERS.md](ENCOUNTERS.md), section 10.
 
 ### Giving to another character
 
@@ -552,7 +770,7 @@ character in the same campaign.
 | Appearance | Everyone in the campaign | Built from picks; afterwards the DM only |
 | Special abilities | Everyone in the campaign (sheet and quick stats) | Built from picks; afterwards the DM only |
 | Private notes | **The owner only — not even the DM** | Owner only |
-| Current location | Everyone in the campaign | DM picks it on the sheet, from the campaign's locations |
+| Current location | The owner and the DM. Another player sees it in the party list only if their own character has been to that place | DM picks it on the sheet; an encounter in progress with a location also moves its characters there |
 
 **Character notes** are a separate, running log on the sheet:
 
@@ -565,11 +783,11 @@ character in the same campaign.
 
 | Screen | What it shows |
 |---|---|
-| Campaign page | Character list: species, class, level, HP, AC, location. Players see their own first, then the rest of the party. |
-| Party overview | One table of every character with an HP bar, AC, gold and location. |
+| Campaign page | On its "Overview". Character list: species, class, level, HP, AC, location. A player's own characters are under "Your Characters" and nowhere else; "Rest of the Party" is everyone else's. |
+| Party overview | One table of every character with an HP bar, AC, Hit Dice left, spell slots left, gold and location. The DM's "🛏 Rest…" button is here too. A player's own characters are highlighted and marked "★ Yours". |
 | Character sheet | Everything in this document. |
 | Character builder | A character that is still being built (section 2). |
-| Quick stats drawer | A combat summary: HP, AC, initiative, speed, proficiency bonus, spellcasting numbers, special abilities, and each weapon's attack and damage. |
+| Character panel (the floating 🧙 button, on every page: bottom right, or in the top bar on a phone) | One character at a glance: HP, AC, initiative, speed, proficiency bonus, passive Perception, ability scores, Hit Dice left, what equipped gear is doing, spellcasting numbers with the spell slot tracker, and special abilities; then **everything the character holds**: every weapon with its attack and damage, every item, every spell and the purse, with what is equipped and what each thing does. Gear can be equipped and unequipped from here. A player gets their own characters in the campaign they are in; the DM gets every character, with a menu to switch. Another player's panel shows the numbers and weapons only. It replaced the quick stats drawer. |
 | Encounter page | Characters taking part in a battle or quest (next section). |
 
 Changes are pushed live to everyone who has the campaign open, so sheets and
@@ -620,7 +838,9 @@ players never receive.
 - "Begin Battle" puts the highest initiative on turn. "Next Turn" passes the
   turn down the order, and going past the last combatant starts the next
   round. "Next Round" jumps straight to the top of the next round.
-- A combatant at 0 HP is marked Down but still takes its turn in the order.
+- A monster or NPC at 0 HP is marked Down; a character is Dying and makes
+  death saves on its card (section 7). Either still has its place in the
+  order.
 - Conditions (Prone, Poisoned, …) are picked from a list and removed with a
   click.
 
@@ -670,14 +890,25 @@ Another Campaign" card on its sheet.
 | View the sheet and quick stats | Yes | Yes | Yes |
 | View private notes | Yes | No | No |
 | Run the builder | Yes | Yes | No |
-| Change HP, temp HP, armor bonus | Yes | Yes | No |
+| Change HP, temp HP | No | Yes | No |
+| Set the extra AC | No | Yes | No |
+| Open the character panel with the full inventory | Yes | Yes | No (numbers and weapons only) |
+| Enter a death save, or stabilise | Yes | Yes | No |
+| Set death-save tallies by hand, revive from dead | No | Yes | No |
+| Spend a spell slot | Yes | Yes | No |
+| Give a spell slot back, or all of them | No | Yes | No |
+| Call a short or long rest | No | Yes | No |
+| Change the Hit Dice left | No | Yes | No |
+| Level a character up (the checklist), pick a Boon | No | Yes | No |
 | Edit special abilities, background, appearance (after the build) | No | Yes | No |
 | Tick Equipped / Prepared | Yes | Yes | No |
 | Give, remove or re-count weapons, spells and items | No | Yes | No |
 | Level a weapon or item up or down | No | Yes | No |
-| Record a gold gain or spend | Yes | Yes | No |
+| Record a money gain or spend | No | Yes | No |
+| Exchange coins (gold, silver, copper) | Yes | Yes | No |
 | Give gold, weapons, items or spells to another character | Yes | Yes | No |
-| View the money log | Yes | Yes | Yes |
+| Change gold and cash with an NPC, or buy what is for sale, in a quest in progress | Yes | Yes | No |
+| View the money log, gold and inventory | Yes | Yes | No |
 | Change level, XP, location or speed override | No | Yes | No |
 | Post a character note | Yes | Yes | Yes |
 | Copy to another campaign | Yes | Yes | No |
@@ -700,20 +931,24 @@ calculations for them.
 
 - The effects of special abilities: species traits and class features are
   written on the sheet for the DM to apply, but nothing is calculated from them
-- Class features beyond level 1 (the DM adds them to the sheet by hand),
-  subclasses and multiclassing
-- Spell slots, spell preparation limits and concentration
-- Ability score increases and feats on level-up
-- Armor and shields as items (only the single armor bonus number)
+- Class features beyond level 10 (the DM adds them to the sheet by hand), a
+  choice of subclass (each class follows one path) and multiclassing
+- Spell preparation limits and concentration
+- Ability score increases and feats on level-up (a Boon is given in their
+  place, and Weapon Mastery and Arcane Focus are added by the player, not by
+  the site)
+- Ki, sorcery points, rages and other class counters (the lines say how many;
+  the player keeps count)
+- Armor rules beyond a flat bonus to AC (no "replaces 10 + DEX", no cap on DEX)
 - Weapon proficiency (everyone is proficient with everything)
 - Rolling attacks, damage, saves or checks for a character (the dice roller,
-  bottom left of every page, is a plain roller that knows nothing about the
-  sheet)
-- Death saves, conditions on the sheet, and resting
+  bottom left of every page, or the last button of the bottom bar on a phone,
+  is a plain roller that knows nothing about the sheet)
+- Conditions on the sheet, and exhaustion
 - Automatic levelling from XP
 - Alignment, languages, tool proficiencies and backgrounds-as-rules
 - Encumbrance and item weight
-- Currencies other than gold, and item prices
+- Cents, and changing silver or copper for cash
 
 ## 20. Everything the builder offers
 
@@ -959,3 +1194,190 @@ This list is written from the app's own data by `npm run docs:lists` (in `/backe
 | Bright colours | — |
 | Plain, practical clothes | — |
 <!-- END GENERATED: builder-lists -->
+
+## 21. What each class gains as it levels
+
+What "⬆ Level Up…" writes into Special Abilities at each level (section 6),
+and the Boons. "Replaces" means the line the character already has by that
+name is rewritten.
+
+This list is written from the app's own data by `npm run docs:lists` (in `/backend`). Re-run it after changing the data; do not edit the list by hand.
+
+<!-- BEGIN GENERATED: level-features -->
+### Boons
+
+| Boon | First time | Can be taken |
+|---|---|---|
+| Weapon Mastery | +1 to attack and damage rolls with weapons (add it to the numbers the site shows). | 2 times |
+| Arcane Focus | +1 to spell save DC and spell attack bonus (add it to the numbers the site shows). | 2 times |
+| Toughened | +1 AC (counted in your Extra AC). | Once |
+| Hardy | +5 maximum HP: gain 5 Temp HP after each long rest. | 2 times |
+
+### Barbarian
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Reckless Attack**: On your first attack each turn you may attack with advantage; attacks against you have advantage until your next turn.<br>**Danger Sense**: Advantage on Dexterity saves against effects you can see (traps, breath, spells). |
+| 3 | **Frenzy**: Path of the Berserker. While raging you may make one extra melee attack as a bonus action each turn; when the rage ends, gain one level of exhaustion.<br>**Rage** (replaces): Three times per day, for one minute: +2 melee damage, advantage on Strength checks and saves, and physical damage against you is halved. |
+| 4 | **Boon** (choose one) |
+| 5 | **Extra Attack**: Attack twice when you take the Attack action.<br>**Fast Movement**: +10 ft speed when not in heavy armor (ask your DM to raise your speed). |
+| 6 | **Mindless Rage**: You can’t be charmed or frightened while raging.<br>**Rage** (replaces): Four times per day, for one minute: +2 melee damage, advantage on Strength checks and saves, and physical damage against you is halved. |
+| 7 | **Feral Instinct**: Advantage on initiative; you can act normally in a surprise round if you rage first. |
+| 8 | **Boon** (choose one) |
+| 9 | **Brutal Critical**: Roll one extra weapon damage die on a critical hit.<br>**Rage** (replaces): Four times per day, for one minute: +3 melee damage, advantage on Strength checks and saves, and physical damage against you is halved. |
+| 10 | **Intimidating Presence**: Action: one creature within 30 ft makes a Wisdom save (DC 8 + proficiency bonus + Charisma modifier) or is frightened of you until the end of your next turn. |
+
+### Bard
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Jack of All Trades**: Add half your proficiency bonus (round down) to any check you are not proficient in.<br>**Song of Rest**: During a short rest, allies who spend Hit Dice heal an extra 1d6. |
+| 3 | **Cutting Words**: College of Lore. Reaction: spend a Bardic Inspiration to subtract the die from an enemy’s attack, check or damage roll.<br>**Bonus Proficiencies**: Treat three extra skills of your choice as proficient (add your proficiency bonus by hand).<br>**Expertise**: Double proficiency on two proficient skills (add by hand). |
+| 4 | **Boon** (choose one) |
+| 5 | **Bardic Inspiration** (replaces): A few times per day, as a bonus action, give an ally a d8 to add to one attack, check or save.<br>**Font of Inspiration**: Regain Bardic Inspiration on a short rest.<br>**Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Countercharm**: Action: allies within 30 ft get advantage on saves against fear and charm until your next turn.<br>**Additional Magical Secrets**: Learn two spells from any class list (the DM grants them within the unlock schedule). |
+| 7 | No new feature |
+| 8 | **Boon** (choose one) |
+| 9 | **Song of Rest** (replaces): During a short rest, allies who spend Hit Dice heal an extra 1d8. |
+| 10 | **Bardic Inspiration** (replaces): A few times per day, as a bonus action, give an ally a d10 to add to one attack, check or save.<br>**Expertise** (replaces): Double proficiency on four proficient skills (add by hand).<br>**Magical Secrets**: Learn two more spells from any class (the DM grants them within the unlock schedule). |
+
+### Cleric
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Channel Divinity**: Once per short rest, use Turn Undead or Preserve Life.<br>**Turn Undead**: Channel Divinity. Action: undead within 30 ft make a Wisdom save or flee from you for 1 minute.<br>**Preserve Life**: Channel Divinity. Action: share out healing of 5 × your level among creatures within 30 ft (up to half their max HP each). |
+| 3 | No new feature |
+| 4 | **Boon** (choose one) |
+| 5 | **Destroy Undead**: Undead of CR 1/2 or lower that fail against your Turn Undead are destroyed.<br>**Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Channel Divinity** (replaces): Twice per short rest, use Turn Undead or Preserve Life.<br>**Blessed Healer**: When you heal someone else with a spell, you heal yourself 2 + the spell’s level. |
+| 7 | No new feature |
+| 8 | **Boon** (choose one)<br>**Divine Strike**: Once per turn, a weapon hit deals +1d8 radiant damage.<br>**Destroy Undead** (replaces): Undead of CR 1 or lower that fail against your Turn Undead are destroyed. |
+| 9 | No new feature |
+| 10 | **Divine Intervention**: Once per week, call on your god: roll d100; if you roll your level or lower, the god helps (the DM decides how). |
+
+### Druid
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Wild Shape** (replaces): Twice per short rest, become a beast you have seen of CR 1/4 or less (no flying or swimming), for up to half your level in hours. Use the beast's HP; when it hits 0 you return to your own form.<br>**Natural Recovery**: Once per day on a short rest, recover spent spell slots totalling up to half your level (rounded up).<br>**Bonus Cantrip**: Learn one extra cantrip (the DM grants it). |
+| 3 | No new feature |
+| 4 | **Boon** (choose one)<br>**Wild Shape** (replaces): Twice per short rest, become a beast you have seen of CR 1/2 or less (it may swim, not fly), for up to half your level in hours. Use the beast's HP; when it hits 0 you return to your own form. |
+| 5 | **Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Land’s Stride**: Ordinary difficult terrain and plants do not slow you; advantage on saves against magical plants. |
+| 7 | No new feature |
+| 8 | **Boon** (choose one)<br>**Wild Shape** (replaces): Twice per short rest, become a beast you have seen of CR 1 or less (it may swim or fly), for up to half your level in hours. Use the beast's HP; when it hits 0 you return to your own form. |
+| 9 | No new feature |
+| 10 | **Nature’s Ward**: Immune to poison and disease; you can’t be charmed or frightened by fey or elementals. |
+
+### Fighter
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Action Surge**: Once per short rest, take one extra action on your turn. |
+| 3 | **Improved Critical**: Your weapon attacks score a critical hit on a roll of 19 or 20. |
+| 4 | **Boon** (choose one) |
+| 5 | **Extra Attack**: Attack twice when you take the Attack action. |
+| 6 | **Boon** (choose one) |
+| 7 | **Remarkable Athlete**: Add half your proficiency bonus to Strength, Dexterity and Constitution checks you are not proficient in; long jump + Strength modifier feet. |
+| 8 | **Boon** (choose one) |
+| 9 | **Indomitable**: Once per long rest, reroll a failed saving throw. |
+| 10 | **Additional Fighting Style**: Choose a second option from your Fighting Style list. (If it is +1 AC in armor, the DM raises Extra AC by 1.) |
+
+### Monk
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Ki**: Points equal to your level; they come back on a short rest. Ki save DC is 8 + proficiency bonus + Wisdom modifier.<br>**Flurry of Blows**: 1 ki: two unarmed strikes as a bonus action.<br>**Patient Defense**: 1 ki: Dodge as a bonus action.<br>**Step of the Wind**: 1 ki: Dash or Disengage as a bonus action, jump distance doubled.<br>**Unarmored Movement**: +10 ft speed without armor (ask your DM to raise your speed). |
+| 3 | **Open Hand Technique**: Flurry hits can knock a target prone (Dexterity save), push it 15 ft (Strength save) or stop its reactions.<br>**Deflect Missiles**: Reaction: reduce ranged weapon damage by 1d10 + Dexterity modifier + your level. |
+| 4 | **Boon** (choose one)<br>**Slow Fall**: Reaction: reduce falling damage by 5 × your level. |
+| 5 | **Extra Attack**: Attack twice when you take the Attack action.<br>**Stunning Strike**: 1 ki after a melee hit: the target makes a Constitution save or is stunned until your next turn.<br>**Martial Arts** (replaces): Your unarmed strikes deal 1d6 damage and can use Dexterity. After attacking, make one unarmed strike as a bonus action. |
+| 6 | **Ki-Empowered Strikes**: Your unarmed strikes count as magical.<br>**Wholeness of Body**: Once per long rest, heal 3 × your level as an action.<br>**Unarmored Movement** (replaces): +15 ft speed without armor (ask your DM to raise your speed). |
+| 7 | **Evasion**: On a Dexterity save for half damage, take none on a success and half on a failure.<br>**Stillness of Mind**: Action: end charm or fear on yourself. |
+| 8 | **Boon** (choose one) |
+| 9 | **Unarmored Movement** (replaces): +15 ft speed without armor (ask your DM to raise your speed). You can run along walls and across water during your move. |
+| 10 | **Purity of Body**: Immune to poison and disease.<br>**Unarmored Movement** (replaces): +20 ft speed without armor (ask your DM to raise your speed). You can run along walls and across water during your move. |
+
+### Paladin
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Divine Smite**: After a melee hit, spend a spell slot to deal +2d8 radiant (+1d8 per slot level above 1st; +1d8 more against undead and fiends).<br>**Fighting Style**: Choose one with your DM: +1 AC in armor (the DM raises Extra AC by 1), +2 damage with a one-handed weapon, or protect an adjacent ally (impose disadvantage on an attack as a reaction).<br>**Spellcasting**: Paladin spells unlock: you now have spell slots. |
+| 3 | **Divine Health**: Immune to disease.<br>**Sacred Weapon**: Oath of Devotion, Channel Divinity. Add your Charisma modifier to attack rolls with your weapon for 1 minute; it sheds light.<br>**Turn the Unholy**: Channel Divinity. Fiends and undead within 30 ft make a Wisdom save or flee for 1 minute. |
+| 4 | **Boon** (choose one) |
+| 5 | **Extra Attack**: Attack twice when you take the Attack action.<br>**Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Aura of Protection**: You and allies within 10 ft add your Charisma modifier to all saving throws while you are conscious. |
+| 7 | **Aura of Devotion**: You and allies within 10 ft can’t be charmed. |
+| 8 | **Boon** (choose one) |
+| 9 | No new feature |
+| 10 | **Aura of Courage**: You and allies within 10 ft can’t be frightened. |
+
+### Ranger
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Fighting Style**: Choose one with your DM: +2 to ranged attacks, +1 AC in armor (the DM raises Extra AC by 1), or add your ability modifier again to a paired weapon’s damage (added by hand).<br>**Spellcasting**: Ranger spells unlock: you now have spell slots. |
+| 3 | **Colossus Slayer**: Hunter’s Prey. Once per turn, +1d8 damage to a creature that is already below its max HP.<br>**Primeval Awareness**: Spend a spell slot: sense aberrations, dragons, fey, fiends, undead and elementals within 1 mile for 1 minute per slot level. |
+| 4 | **Boon** (choose one) |
+| 5 | **Extra Attack**: Attack twice when you take the Attack action.<br>**Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Favored Enemy**: Choose a second favored enemy with your DM.<br>**Natural Explorer**: Choose a second favored terrain with your DM. |
+| 7 | **Escape the Horde**: Defensive Tactics. Opportunity attacks against you have disadvantage. |
+| 8 | **Boon** (choose one)<br>**Land’s Stride**: Ordinary difficult terrain and plants do not slow you. |
+| 9 | No new feature |
+| 10 | **Hide in Plain Sight**: Spend 1 minute camouflaging: +10 to Stealth while you stay still.<br>**Natural Explorer**: Choose a third favored terrain with your DM. |
+
+### Rogue
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Cunning Action**: Bonus action: Dash, Disengage or Hide. |
+| 3 | **Sneak Attack** (replaces): Once per turn, deal an extra 2d6 damage to a target you have advantage against, or that has one of your allies next to it.<br>**Fast Hands**: Bonus action: Sleight of Hand, pick a lock, disarm a trap or Use an Object.<br>**Second-Story Work**: Climbing costs no extra movement; running jumps + Dexterity modifier feet. |
+| 4 | **Boon** (choose one) |
+| 5 | **Sneak Attack** (replaces): Once per turn, deal an extra 3d6 damage to a target you have advantage against, or that has one of your allies next to it.<br>**Uncanny Dodge**: Reaction: halve the damage of an attack that hits you. |
+| 6 | **Expertise**: Double proficiency on two more proficient skills (add by hand). |
+| 7 | **Sneak Attack** (replaces): Once per turn, deal an extra 4d6 damage to a target you have advantage against, or that has one of your allies next to it.<br>**Evasion**: On a Dexterity save for half damage, take none on a success and half on a failure. |
+| 8 | **Boon** (choose one) |
+| 9 | **Sneak Attack** (replaces): Once per turn, deal an extra 5d6 damage to a target you have advantage against, or that has one of your allies next to it.<br>**Supreme Sneak**: Advantage on Stealth if you move no more than half your speed. |
+| 10 | **Boon** (choose one) |
+
+### Sorcerer
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Font of Magic**: Sorcery points equal to your level; they come back on a long rest. Bonus action: turn points into a spell slot (2 points = 1st, 3 = 2nd, 5 = 3rd, 6 = 4th, 7 = 5th), or a spell slot into points equal to its level. |
+| 3 | **Metamagic**: Choose two with your DM: Quickened Spell (2 points: cast an action spell as a bonus action), Twinned Spell (points = spell level: hit a second target with a single-target spell), Careful Spell (1 point: allies auto-succeed on your spell’s save), Subtle Spell (1 point: cast without words or gestures), Extended Spell (1 point: double duration), Heightened Spell (3 points: one target has disadvantage on its first save). |
+| 4 | **Boon** (choose one) |
+| 5 | **Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Elemental Affinity**: Draconic Bloodline. Add your Charisma modifier to one damage roll of your dragon’s element; spend 1 sorcery point to resist that element for 1 hour. |
+| 7 | No new feature |
+| 8 | **Boon** (choose one) |
+| 9 | No new feature |
+| 10 | **Metamagic**: Choose a third option with your DM. |
+
+### Warlock
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Eldritch Invocations**: Choose two with your DM: Agonizing Blast (add your Charisma modifier to each Eldritch Blast hit), Devil’s Sight (see normally in darkness, even magical darkness, to 120 ft), Repelling Blast (Eldritch Blast hits push the target 10 ft away), Mask of Many Faces (cast Disguise Self at will), Beguiling Influence (proficiency in Deception and Persuasion, added by hand), Eyes of the Rune Keeper (read any writing). |
+| 3 | **Pact Boon**: Choose one with your DM: Pact of the Blade (summon a weapon of your choice as an action; it counts as magical), Pact of the Chain (gain a small familiar spirit: an imp, a sprite or a cat-shaped shadow), or Pact of the Tome (a book of three extra cantrips from any class, which the DM grants). |
+| 4 | **Boon** (choose one) |
+| 5 | **Eldritch Invocations**: Choose one more with your DM (three in all). From level 5 the list adds Thirsting Blade (Pact of the Blade: attack twice with your pact weapon) and One with Shadows (become invisible while standing still in dim light or darkness).<br>**Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Patron’s Luck**: Once per short rest, add a d10 to an ability check or saving throw after seeing the roll. |
+| 7 | **Eldritch Invocations**: Choose one more with your DM (four in all). From level 5 the list adds Thirsting Blade (Pact of the Blade: attack twice with your pact weapon) and One with Shadows (become invisible while standing still in dim light or darkness). |
+| 8 | **Boon** (choose one) |
+| 9 | **Eldritch Invocations**: Choose one more with your DM (five in all). From level 5 the list adds Thirsting Blade (Pact of the Blade: attack twice with your pact weapon) and One with Shadows (become invisible while standing still in dim light or darkness). |
+| 10 | **Patron’s Resilience**: After each rest, choose one damage type: you resist it until you choose another. |
+
+### Wizard
+
+| Level | Written into Special Abilities |
+|---|---|
+| 2 | **Evocation Savant**: School of Evocation. Copying evocation spells costs half the time and gold.<br>**Sculpt Spells**: When you cast an evocation spell that hits an area, choose 1 + the spell’s level creatures to automatically save and take no damage. |
+| 3 | No new feature |
+| 4 | **Boon** (choose one) |
+| 5 | **Cantrips**: Double dice. Roll twice the damage dice the site shows for a damaging cantrip (Eldritch Blast becomes two beams, each with its own attack roll). |
+| 6 | **Potent Cantrip**: Creatures that save against your damaging cantrips still take half damage. |
+| 7 | No new feature |
+| 8 | **Boon** (choose one) |
+| 9 | No new feature |
+| 10 | **Empowered Evocation**: Add your Intelligence modifier to the damage of your evocation spells. |
+<!-- END GENERATED: level-features -->

docs/ENCOUNTERS.md

@@ -19,9 +19,10 @@ This describes the code as it stands. The rules live in
 7. [Initiative, turns and rounds](#7-initiative-turns-and-rounds)
 8. [Conditions](#8-conditions)
 9. [Rewards](#9-rewards)
-10. [What each side sees](#10-what-each-side-sees)
-11. [Permissions](#11-permissions)
-12. [What is not modelled](#12-what-is-not-modelled)
+10. [Trade](#10-trade)
+11. [What each side sees](#11-what-each-side-sees)
+12. [Permissions](#12-permissions)
+13. [What is not modelled](#13-what-is-not-modelled)
 
 ---
 
@@ -30,7 +31,11 @@ This describes the code as it stands. The rules live in
 - An encounter is one **scene** the DM runs: a fight, or a meeting with
   people who want something.
 - Encounters belong to a campaign and are listed on the campaign page. The DM
-  creates them; every member can open them.
+  creates them and sees all of them.
+- A player only sees an encounter that **one of their own characters is in**.
+  Until the DM adds their character it is not in their list and its page will
+  not open, so scenes the DM is still preparing stay hidden, name included.
+  Taking their character out hides it again.
 - The encounter page updates live for everyone who has it open.
 - The DM runs everything. Players watch, and see less than the DM does.
 
@@ -42,11 +47,12 @@ time from the top of the page.
 | | Battle | NPC quest |
 |---|---|---|
 | For | A fight | A scene built around people and an objective |
-| Layout | Everyone in one list, in initiative order | Three groups: "People you meet", "The party", "Creatures" |
+| Layout | Everyone in one list, in initiative order; once in progress, those who have had their turn move to "Next Round" at the bottom | Three groups: "People you meet", "The party", "Creatures" |
 | Rounds and turns | Yes | No |
-| Initiative | Typed in per combatant | Not shown |
+| Initiative | The d20 roll, typed in per combatant; the bonus is added | The same; each group lists highest first |
 | Start button | Begin Battle | Begin Quest |
 | End button | End Battle | Complete Quest |
+| Trade (section 10) | No | Yes, while in progress |
 
 Everything else (hit points, conditions, rewards, the scene description, DM
 notes) works the same in both.
@@ -63,18 +69,35 @@ Status is a label. Nothing is locked when an encounter is complete: the DM
 can still change HP, add people and award rewards. Encounters cannot be
 renamed from the screen.
 
+### Location
+
+The DM can give an encounter a location from the campaign's list, with the
+picker at the top of the page. While the encounter is **in progress** its
+characters are at that location: beginning it, changing its location, or
+adding a character to it moves them there. Each place a character is moved to
+(this way or by the DM on the sheet) is remembered, and a player can see only
+the locations one of their own characters has been to — on the campaign page
+under "Places", and on the encounter itself. Archiving or deleting
+the encounter does not take a visited place away again.
+
 ### Order, archive and delete
 
-**Order.** The campaign page lists encounters in the **campaign order**, which
+**Order.** The campaign page lists encounters on its "Overview", under the
+characters, in the **campaign order**, which
 the DM arranges with the ▲ and ▼ buttons and everyone sees. A new encounter
 goes to the top. The "Sort by" menu re-sorts the list by name, status, type or
 date instead; that choice is remembered per browser and changes nothing for
 anyone else. ▲ and ▼ only show while sorting by campaign order.
 
+The list shows **ten encounters a page**, with Prev and Next beneath it (and,
+with three pages or more, a menu to jump to any page), and
+the DM's archived list is paged the same way. The order runs on across pages:
+moving the last encounter on a page down carries it to the top of the next.
+
 **Archive.** "Archive" (on the list or the encounter page) puts an encounter
 away without changing it. It moves to the DM's "Archived" section and
-disappears from the players' list; anyone who already has its page open or
-bookmarked can still open it. "Restore" puts it back on the list.
+disappears from the players' list; a player whose character is in it can still
+open its page from a bookmark. "Restore" puts it back on the list.
 
 **Delete.** "Delete" (on the encounter page, or on an archived encounter in
 the list) removes the scene, who was in it and its reward list, after a
@@ -96,16 +119,33 @@ The DM adds people from the "Add to the scene" panel.
 
 | Kind | Comes from | Can be added more than once |
 |---|---|---|
-| Character | The campaign's finished characters | No |
+| Character | The campaign's finished characters, except dead ones | No |
 | Monster | The campaign's monster list ([MONSTERS.md](MONSTERS.md)) | Yes |
 | NPC | The campaign's NPC list ([NPCS.md](NPCS.md)) | No |
 
+**Finding your own character.** A player's own characters stand out: their
+cards have a blue border and background and say "★ Your character", and a row
+of buttons at the top of the page names each one with its HP ("★ Aria · 12/12
+HP", plus "your turn" when it is) and scrolls to its card. The DM sees the
+same for any character of their own.
+
+**Inventory.** A character's card has an "🎒 Inventory" button for the DM and
+for that character's own player. It opens the character panel on that
+character: everything they hold, what is equipped and what each thing does
+([CHARACTERS.md](CHARACTERS.md), section 14). The floating 🧙 button opens the
+same panel from anywhere. A card's details also list what the character's
+equipped gear is doing; the AC, speed and other numbers on the card already
+include it.
+
 Each has a card. The card's left edge is coloured by kind, and it shows:
 
 - **Characters:** level, species and class; HP, AC, speed, initiative bonus,
   passive perception, proficiency bonus and spell save DC. Under "details":
-  ability scores, saves, the weapons and spells the character can use (with
-  attack and damage numbers), and special abilities. The name links to the
+  ability scores, saves, the weapon and items the character has **equipped**
+  (with attack and damage numbers), the spells they can cast, and special
+  abilities. A weapon that is not equipped is not on the card and cannot be
+  used; "No weapon equipped" shows when there is none. Equipping is changed
+  from "🎒 Inventory", at any point in the scene. The name links to the
   character sheet.
 - **Monsters:** for the DM, AC, speed, attack and damage, and under "details"
   ability scores, trait and notes.
@@ -116,6 +156,10 @@ Details start open for the DM and closed for players. Weapons and spells
 above a character's level are left out, because the character cannot use
 them.
 
+A **dead character cannot be added** to any encounter: they are left out of
+the list to pick from and the server refuses them, until they are revived. A
+character who dies stays in the encounters they were already in.
+
 The DM removes someone with "Remove" on their card. Removing whoever is on
 turn passes the turn to the next combatant.
 
@@ -130,23 +174,168 @@ The DM types an amount and clicks Damage or Heal on a card.
 | NPC | In the encounter. An NPC with no HP set has no health bar. |
 
 - HP always stays between 0 and max.
-- At 0 HP a combatant is marked **Down** and dimmed. It keeps its place in
-  the order; nothing is removed automatically.
+- **What players see of it.** A character's HP is always shown in numbers. For
+  monsters and NPCs it depends on the campaign setting "Players see the exact
+  hit points of monsters and NPCs": on (the default) shows the numbers, off
+  shows only the health bar. The DM always sees the numbers.
+- At 0 HP a monster or NPC is **out of the fight**: see "The fallen" below.
+- A **character** at 0 HP is **Dying** instead, and its card grows a death-save
+  box: see below.
 - A character's temporary HP is shown beside its HP but is not used up
   automatically.
 
+### A character at 0 HP
+
+The full rules are in [CHARACTERS.md](CHARACTERS.md), section 7; the box on
+the card is the same one as on the sheet, and both change the same character.
+
+- **Dying.** The box shows two tallies, Saved and Failed, three pips each.
+  Type what the d20 showed and click **Death save**: 10 or more is a success,
+  less is a failure, a 1 is two failures, a 20 puts the character back up at
+  1 HP. The DM can do this for anyone; a player for their own character.
+- **Damage while down** is one failed save, added when the DM clicks Damage.
+  For a critical hit the DM clicks the next Failed pip to add the second.
+- **Stabilise** stops the saves without a roll (a Medicine check, a spell).
+  Three successes do the same. A stable character stays at 0 HP.
+- **Heal** on a dying or stable character puts them back up and clears the
+  tallies.
+- **Dead** after three failures, or when one blow leaves as much as the
+  character's max HP still to take after reaching 0. Healing is refused; the
+  DM clicks **Revive at 1 HP**, or an ally revives them (below).
+- The DM can click any pip to set a tally by hand.
+
+Nothing rolls by itself: the app does not prompt for a save when the turn
+comes round. A dying or stable character keeps its place in the order and
+still gets its turn.
+
+### The fallen
+
+A combatant is **out of the fight** when it is:
+
+- a **monster or NPC at 0 HP** (one with hit points to track), or
+- a **dead character**. Dying and stable characters are not: they stay in
+  view.
+
+What that does:
+
+- **Players no longer see it.** Its card is gone from their screen, along
+  with any target mark on it; the server does not send it to them at all.
+- **The DM's screen leaves it out as well**, until the DM ticks **Show dead**
+  above the list (the box shows how many there are, and only appears when
+  there are any). Ticked, they are listed in a group of their own at the
+  bottom, "Out of the fight, hidden from players", each with a "Hidden from
+  players" badge, and everything on the card still works. The tick is not
+  remembered: it is off again when the page is reopened.
+- **It has no turn.** Next Turn, Next Round and Begin Battle pass over it.
+- It stays in the encounter: nothing is removed, and gold is still split with
+  a dead character.
+
+It is worked out from hit points each time, not stored, so it undoes itself:
+heal a monster or NPC above 0, or revive a character, and they are back on
+everyone's screen and back in the turn order.
+
+**Reviving a dead character.** Players see dead characters by name only, in a
+**☠ Fallen** box above the list. There are two ways back:
+
+- The **DM** ticks Show dead and clicks **Revive at 1 HP** on the dead
+  character's card (or does it on the sheet), at any time.
+- An **ally** tries it: in a battle in progress, the player whose character is
+  **on turn** gets a **Try revive** button beside each name in the Fallen box,
+  if that character is capable. Capable means on their feet (above 0 HP) and
+  knowing a spell that is ticked **Revives** in the campaign's spell list
+  ([SPELLS.md](SPELLS.md)), at a level they can cast. The library's Revivify
+  (level 3) and Raise Dead (level 5) are ticked already.
+
+Either way the character comes back at 1 HP with the death saves cleared. The
+app does not use up the spell, check how long ago they died, or end the
+reviver's turn.
+
 ## 7. Initiative, turns and rounds
 
-Battles only.
+Initiative is entered in battles and quests alike. Turns and rounds are for
+battles only.
 
-- The DM types each combatant's **initiative** when adding them, and can
-  change it on the card. The app does not roll it. The list is ordered
-  highest first; ties keep the order they were added in.
+- Each combatant has an **initiative roll** field. Type what the d20 showed,
+  1 to 20; the field accepts nothing else. The app does not roll the die, but
+  it adds the bonus for you and shows the total, which can go past 20 (a 20 on
+  the die with a +3 bonus is 23): a character's initiative
+  bonus from their sheet, a monster's Dexterity modifier, nothing for an NPC.
+- The DM can enter the roll for anyone, when adding them or on the card. A
+  player can enter the roll for **their own character** on its card.
+- The list is ordered by the total, highest first; ties keep the order they
+  were added in. Anyone who has not rolled yet waits at the bottom.
+- The bonus is worked out when the roll is entered. If a character's sheet
+  changes afterwards, enter the roll again to pick up the new bonus.
 - **Begin Battle** puts the first combatant on turn. Their card is
   highlighted and the header names them.
 - **Next Turn** passes the turn to the next in the order. After the last
   combatant it returns to the top and the **round** goes up by one.
 - **Next Round** skips straight to the top of the next round.
+- Anyone out of the fight (section 6, "The fallen") is passed over.
+- **The list follows the turn.** While a battle is in progress, whoever is on
+  turn is at the top of "Initiative order" with those still to act this round
+  beneath them. Each combatant whose turn has passed moves down to a **Next
+  Round** section at the bottom, still in initiative order. When the round
+  rolls over everyone is back in "Initiative order". Everyone sees the same
+  arrangement. Before the battle begins, and once it is complete, it is one
+  plain list.
+
+### Targets
+
+Combatants can be marked as **targets**: whoever is being attacked (or
+healed) right now. One target is an ordinary attack; more than one is an
+**area attack**.
+
+- Click **🎯 Target** beside a combatant's name to mark them; click it again
+  to unmark. Each one marked is added to the targets.
+- The **DM** can mark anyone at any time, in a battle or a quest. A **player**
+  can while their own character is on turn in a battle, so they can show the
+  DM who they are going for. A player cannot mark someone who is out of the
+  fight, and is not shown a mark the DM leaves on one.
+- The combatant **on turn** cannot be marked: nobody targets themselves, and
+  their card has no Target button until the turn passes. To heal or hurt them
+  on their own turn, use the buttons on their card.
+- A target's card is outlined in red for everyone and reads "Targeted by
+  <whoever is on turn>".
+- While anyone is marked the DM gets an **attack bar** above the list, which
+  stays in view while scrolling. It shows who is attacking whom, each target's
+  AC and HP, and the attacker's attacks: a character's equipped weapons (none,
+  if nothing is equipped) and damaging spells, or a monster's or NPC's
+  attack and damage. The amount box is ready to type in; **Damage** (or
+  Enter) and **Heal** change HP exactly as the buttons on a card do.
+- Targets stay marked after damage, for a second attack. They are cleared
+  when the turn or round moves on, when the encounter begins, ends or is
+  reopened; a target that is removed from the encounter is unmarked.
+
+**Area attacks**
+
+An attack on several targets is harder to land and its damage is shared.
+
+- **Harder to hit.** Every target's AC counts as higher for each target
+  beyond the first, by the campaign's **area attack AC penalty**. The DM sets
+  it in the campaign settings, from 0 (no penalty) to 10; it starts at 2, which
+  gives:
+
+  | Targets | Added to each AC |
+  |---|---|
+  | 1 | 0 |
+  | 2 | +2 |
+  | 3 | +4 |
+  | 4 | +6 |
+
+  The attack bar shows the AC to beat with the penalty already added
+  ("17 (15 +2)"), and each target's card says "area attack, AC +2".
+- **Who was hit.** Each target has a tick box, ticked to begin with. Untick
+  anyone the roll missed; they take nothing.
+- **Sharing the amount.** Type the total. "Split between those hit" (the
+  default) shares it evenly, any remainder going one point each to the first
+  targets marked: 7 between three is 3, 2 and 2. "Full amount to each" gives
+  every target hit the whole amount. Each target's share is shown before it
+  is applied.
+- A target with no hit points to track is left out of the sharing.
+
+The app does not roll the attack or decide whether it hits: the DM compares
+the roll with the AC shown and types the damage.
 
 ## 8. Conditions
 
@@ -166,7 +355,7 @@ The DM lines up loot in the Rewards panel, on any encounter at any time.
 
 | Reward | What the DM sets |
 |---|---|
-| Gold | An amount |
+| Coins or cash | An amount, and which: gold, silver, copper or cash ($) |
 | Weapon | A weapon from the pool, a level (not below its starting level), a quantity |
 | Item | An item from the pool, a level, a quantity |
 
@@ -177,9 +366,9 @@ Each can carry a short note ("Goblin chief's purse").
 | Button | What happens |
 |---|---|
 | Award (pick a character) | The whole reward goes to that character. It can be any finished character in the campaign, not only those in the encounter. |
-| Split (gold only) | Shared evenly between the characters in the encounter. Any remainder goes one gold each, highest initiative first: 101 gold between two is 51 and 50. |
+| Split (coins and cash only) | Shared evenly between the characters in the encounter. Any remainder goes one each, highest initiative first: 101 gold between two is 51 and 50. |
 
-- **Gold** is added to the character's balance with a money-log entry reading
+- **Coins or cash** are added to the character's balance with a money-log entry reading
   "Reward: <encounter name>".
 - A **weapon or item** is added to what the character holds, at the reward's
   level, stacking with any they already have. If the character is below that
@@ -190,46 +379,103 @@ Each can carry a short note ("Goblin chief's purse").
 Until a reward is awarded only the DM can see it. Afterwards players see what
 it was and who received it.
 
-## 10. What each side sees
+## 10. Trade
+
+In an NPC quest the party can **change money** and **buy things**. Both take
+someone to deal with and the time to do it, so:
+
+- Trading is open only in an **NPC quest that is in progress**. Before "Begin
+  Quest" and after "Complete Quest" everything on offer is still shown, but
+  the buttons are off.
+- There is **no trading in a battle**. Switching a quest to a battle hides the
+  Trade card and the server refuses any trade; switching back brings it back.
+- An NPC trades only while they are **in the scene and not at 0 HP**.
+- The character trading has to be **in the encounter** and alive.
+
+The "Trade" card sits beside the scene, above Rewards. It appears for players
+when there is something to trade, and always for the DM in a quest.
+
+| Part of the card | What it does |
+|---|---|
+| Who is trading | Picks the character. A player chooses among their own characters in the scene; the DM among all of them. Their purse is shown beside it |
+| 💱 A money changer | One row per NPC in the scene who has an exchange rate. Type an amount, choose "gold into cash" or "cash into gold", and the button shows what comes back |
+| 🛒 "<NPC> sells" | Everything that NPC has for sale: what it is, its level and dice, the price, and how many are left. "Buy" buys one |
+| 🛒 "For sale here" | Things sold by the scene itself rather than by anyone in it |
+| Set up (DM only) | Puts weapons and items from the campaign pools up for sale at this encounter, and edits their price and stock |
+
+- **Changing money** uses the NPC's own rate, the same both ways, and only
+  gold and cash: no silver, no copper, no change. The amount handed over has
+  to be a whole multiple of that side of the rate. The full rules and
+  examples are in [NPCS.md](NPCS.md), section 5.
+- **Buying** pays the price from the character's purse (coins make change; a
+  cash price takes cash only), adds the weapon or item to what the character
+  holds at the level it is sold at, and uses up stock. A character below that
+  level holds it but cannot use it yet.
+- Every trade is written to the character's money log.
+- **An NPC's rate and wares are set on the campaign page**, in the NPC's
+  pop-out, and follow the NPC into every quest they are in. **An
+  encounter's own wares are set here**, in the DM's part of the card, and
+  exist only in this encounter: a market stall, a vending machine, a chest
+  with a price tag.
+- Removing an NPC from the scene takes their rate and wares out of it.
+  Deleting the encounter deletes its own wares; what was bought stays bought.
+
+## 11. What each side sees
 
 | | DM | Players |
 |---|---|---|
 | Scene description | Yes | Yes |
 | DM notes | Yes | Never |
 | Characters | Full card | Full card |
+| A character's inventory, spells and purse | Yes, for everyone | Their own characters only |
 | Monsters | Full stat block | Name, HP, conditions |
 | NPCs | Everything | Name, role, attitude, description, HP bar |
+| Monsters and NPCs at 0 HP | With "Show dead" ticked, marked hidden | Nothing |
+| Dead characters | Full card with "Show dead" ticked, marked hidden | The name only, in the Fallen box |
 | Rewards | All | Only awarded ones |
+| Exchange rates and things for sale | Yes | Yes, for NPCs they can see and for the scene itself |
 | Controls (add, damage, turns, rewards) | Yes | None |
 
 The server only sends a player what the right-hand column lists, so hidden
 information cannot be dug out of the page.
 
-## 11. Permissions
+## 12. Permissions
 
 | Action | DM | Players |
 |---|---|---|
 | Create an encounter | Yes | No |
-| Open an encounter | Yes | Yes |
+| See and open an encounter | Yes, all of them | Only ones their own character is in |
 | Change mode, status, scene or DM notes | Yes | No |
 | Rearrange, archive, restore or delete encounters | Yes | No |
 | See archived encounters in the list | Yes | No |
 | Add or remove anyone | Yes | No |
-| Change HP, initiative or conditions | Yes | No |
+| Change HP or conditions | Yes | No |
+| Enter an initiative roll | Yes, for anyone | For their own character only |
+| Mark targets | Yes, any time | On their own character's turn |
+| Enter a death save, or stabilise | Yes, for anyone | For their own character only |
+| Set death-save tallies by hand | Yes | No |
+| Revive a dead character outright | Yes | No |
+| Try to revive a dead character | Yes, for the character on turn | On their own character's turn, if it has a reviving spell |
 | Advance turns and rounds | Yes | No |
 | Add, remove or award rewards | Yes | No |
+| Set exchange rates, and put things up for sale | Yes | No |
+| Change money or buy, in a quest in progress | Yes, for any character in it | For their own character in it |
 
 People outside the campaign cannot open its encounters.
 
-## 12. What is not modelled
+## 13. What is not modelled
 
 - Rolling initiative, attacks, damage or saves (use the dice roller, bottom
-  left of every page)
+  left of every page, or in the bottom bar on a phone)
 - Applying an attack's damage automatically
-- Death saves and stabilising
+- Death saves for monsters and NPCs, and prompting for a save on a dying
+  character's turn
+- A roll, a spell slot or a time limit for reviving the dead
 - Conditions with durations or mechanical effects
 - Maps, positions, distances and areas of effect
 - Experience points and encounter difficulty
-- Spells as rewards
+- Spells as rewards, and spells for sale
+- Selling to an NPC, haggling, and buying more than one of a thing in a
+  single step
 - Renaming an encounter from the screen
 - A log of what happened during the encounter

docs/ITEMS.md

@@ -14,10 +14,12 @@ level up the same way weapons do), [SPELLS.md](SPELLS.md),
 3. [A character's inventory](#3-a-characters-inventory)
 4. [Item levels](#4-item-levels)
 5. [Dice on items](#5-dice-on-items)
+   - [Effects: armor and other gear that changes the sheet](#effects-armor-and-other-gear-that-changes-the-sheet)
 6. [Starting items](#6-starting-items)
-7. [Items as rewards](#7-items-as-rewards)
+7. [Items as rewards and for sale](#7-items-as-rewards-and-for-sale)
 8. [Permissions](#8-permissions)
 9. [What is not modelled](#9-what-is-not-modelled)
+10. [The complete item library](#10-the-complete-item-library)
 
 ---
 
@@ -27,13 +29,18 @@ level up the same way weapons do), [SPELLS.md](SPELLS.md),
   anything that is not a weapon or a spell.
 - A character's **inventory** is the items it holds from that pool. Players
   cannot type in items of their own.
-- The DM creates items and hands them out. Players can only tick Equipped.
+- The DM creates items and hands them out. Players can only tick Equipped,
+  and only so much can be equipped at once (section 3).
 - Items are **descriptive**. Holding or equipping one never changes a number
   on the sheet.
 
 ## 2. The item pool
 
-The pool is the "Items Pool" card on the campaign page (DM only).
+The pool is the "Items" part of the campaign page (DM only). It lists each
+item as a short row: its name, then what it does, its dice and its
+description, as far as they fit on a line. The list has a search box, shows
+ten to a page, and clicking a row opens the item's **pop-out**, which shows
+everything below and is where it is changed.
 
 | Field | What it is |
 |---|---|
@@ -43,13 +50,26 @@ The pool is the "Items Pool" card on the campaign page (DM only).
 | Starts at level | 1 to 9. The lowest level this item can be (section 4) |
 | Growth | Standard, Powerful or Legendary. Only matters if the item has dice |
 | Starting option | Whether a brand-new character may pick it in the builder (section 6) |
+| Effects | What it does to whoever has it equipped: bonuses and penalties to the sheet's numbers, and a note (section 5) |
 
-- **Adding:** the "+ Add Item" form. There is no built-in library of items.
+- **Adding:** by hand with "+ Add Item", or with "📚 From Library". Both open
+  in a pop-out; an item added by hand opens its own pop-out straight away, to
+  set what it does, and "+ Add another item" at its top goes straight back
+  to an empty form. The library offers 32 ready-made items: light, medium and heavy armor, shields,
+  worn gear such as a Ring of Protection, and common supplies. Each is copied
+  into the pool with its effects already set (Chain Mail: +6 AC, −10 Speed,
+  and a note about Stealth), at starting level 1 and not ticked as a starting
+  option. The copy is yours to change. The full list is in section 10. Each
+  can be added once: an item the pool already has by that name is left out of
+  the library list, and comes back if the pool's item is renamed or deleted.
+- **Effects:** under "While equipped" in the item's pop-out, saved with "Save
+  Effects". The item's row shows what it does under its name.
 - **Changing:** starting level, growth (when the item has dice) and the
-  starting-option tick box can be changed in the table. Name, description and
-  dice cannot be changed on screen once created (the API accepts it); remove
-  and re-add instead.
-- **Removing:** the ✕ button. This takes the item out of **every inventory**
+  starting-option tick box are changed in the pop-out, and saved as they are
+  changed. Name, description and dice cannot be changed on screen once
+  created (the API accepts it); remove and re-add instead.
+- **Removing:** "Remove from campaign" at the foot of the pop-out, after a
+  confirmation. This takes the item out of **every inventory**
   and off every encounter's reward list. There is no undo.
 
 ## 3. A character's inventory
@@ -67,8 +87,39 @@ On a character's sheet, the DM picks an item from the pool and clicks Give.
 - Quantity cannot go below 1; to take the last one away the DM uses ✕.
 - **Using up** an item (drinking a potion) is not automatic: the DM lowers the
   quantity or removes it.
-- **Equipped** is a label. It does not change Armor Class or anything else;
-  armor is represented by the single "armor bonus" number on the sheet.
+- **Equipped** is what switches an item's effects on (section 5), and what
+  shows the item on the character's encounter card.
+- **Only what is equipped counts.** A weapon has to be equipped to be used
+  in an encounter, and gear only gives its effects while equipped. What is
+  not equipped stays in the pack: still the character's, still listed on the
+  sheet and in the character panel, but not in hand.
+- **There is a limit on how much can be equipped at once**, set per campaign
+  in Campaign Settings ("Equipped at once"):
+
+  | Setting | Starts at | Means |
+  |---|---|---|
+  | Things equipped at once | 2 | Weapons and items together |
+  | Of which weapons | 1 | So: one weapon, or one weapon and one item, or two items |
+
+  Armor and shields are items and count toward the limit. With the starting
+  numbers a character can have a weapon and a shield, or a weapon and armor,
+  but not all three; a DM who wants armor, shield and weapon together sets
+  the first number to 3.
+- **Putting something on when the limit is reached is refused**, with a
+  message naming what is already equipped. Take something off first.
+- **Equipping can be changed at any time, including in the middle of an
+  encounter**, by the owning player or the DM: on the sheet, or in the
+  character panel (the 🧙 button, or "🎒 Inventory" on the character's
+  encounter card).
+- Lowering the limits takes nothing off anyone. A character with more on
+  than the new limit keeps it until they change what they have equipped.
+- Everything arrives unequipped: gear from the DM, from a reward, bought, or
+  given by another character.
+- The whole pack is always listed: on the sheet, and in the **character
+  panel** (the floating 🧙 button, on every page), which the owning player and
+  the DM can open from anywhere, including from the character's card in an
+  encounter. Things the character is too low level to use are shown and
+  marked "needs level N", not hidden.
 
 **Passing items on.** A character's owner (or the DM) can give some or all of
 a held stack to another character in the campaign from the "Give to Another
@@ -111,6 +162,48 @@ rungs per level depending on Growth. The full ladder is in
 The dice are shown beside the item in the inventory. Nothing is rolled or
 applied automatically; use the dice roller.
 
+### Effects: armor and other gear that changes the sheet
+
+Armor, shields, rings, cloaks and the like are ordinary items that have
+**effects**. An effect is a whole number, positive for a bonus and negative
+for a penalty, on one of the sheet's numbers:
+
+| It can change | Examples |
+|---|---|
+| AC | Chain mail +6, a shield +2, a cursed cloak −1 |
+| Speed | Heavy armor −10, boots of speed +10. Speed never goes below 0 |
+| Initiative | +2 |
+| Max HP | +5. Max HP never goes below 1 |
+| Passive Perception | +5 |
+| An ability score (STR, DEX, CON, INT, WIS, CHA) | Gauntlets +2 STR. The score changes, so its modifier and everything built on it (saves, skills, attacks, HP from CON, AC from DEX) change with it. A score never goes below 1 |
+| All saving throws, or one ability's saves | A ring: +1 to all saves |
+| All skill checks, or one skill | Noisy armor: −2 Stealth |
+
+An item can have up to 12 effects, one per number, each from −100 to +100,
+plus a **note** for what is not a number ("Disadvantage on Stealth",
+"Resistance to fire").
+
+- **They apply on their own.** While a character has the item **equipped**
+  and is high enough level to use it, its effects are part of every number
+  the app shows for that character: the sheet, the character panel, the party
+  overview and their encounter card. Nothing has to be typed in.
+- **Unequipping takes them away again**, as does giving the item away, the DM
+  removing it, or the character dropping below its level.
+- **Effects add up.** Two different items with +1 AC give +2. Carrying two of
+  the same item does not double it: a stack counts once.
+- **The sheet says where each change comes from.** A "From Equipped Gear"
+  card lists every item in force with what it is doing, and its note.
+- **Max HP can move.** If taking something off lowers a character's maximum
+  HP below their current HP, current HP comes down to the new maximum.
+- **Only the DM sets effects**, under "While equipped" in the item's pop-out
+  on the campaign page. Changing them changes the sheet of everyone wearing the item,
+  straight away.
+- The DM also has an **Extra AC** number on each sheet, added on top of gear,
+  for anything an item does not cover. It can be negative.
+
+Weapons can carry effects in exactly the same way
+([WEAPONS.md](WEAPONS.md), section 2).
+
 ## 6. Starting items
 
 In the builder's equipment step a new character can pick items that are:
@@ -121,31 +214,124 @@ In the builder's equipment step a new character can pick items that are:
 Starting items and starting weapons share the campaign's "starting items"
 allowance. Each arrives at level 1, quantity 1, unequipped.
 
-## 7. Items as rewards
+## 7. Items as rewards and for sale
 
 On an encounter the DM can line up an item as a reward, at a chosen level and
 quantity, and later award it to a character. Awarding adds it to the
 character's inventory, stacking with any they already hold. See
 [ENCOUNTERS.md](ENCOUNTERS.md).
 
+The DM can also put an item **up for sale**, at a level, a price (in gold,
+silver, copper or cash) and an optional stock. An NPC can sell it, wherever
+that NPC is met, or an encounter can sell it itself. Players see what is for
+sale and buy it in an NPC quest that is in progress: the price leaves their
+purse and the item joins their inventory. See [NPCS.md](NPCS.md), section 5,
+and [ENCOUNTERS.md](ENCOUNTERS.md), section 10.
+
 ## 8. Permissions
 
 | Action | DM | Owning player | Other players |
 |---|---|---|---|
-| See the item pool | Yes | Yes | Yes |
+| See the item pool | Yes | Only what their own character holds, plus the starting options while they have a character to build | The same, for their own character |
 | Add, change or remove pool items | Yes | No | No |
 | Give an item from the pool, or take one away | Yes | No | No |
 | Give a held item to another character | Yes | Yes | No |
+| Put an item up for sale | Yes | No | No |
+| Buy an item that is for sale, in a quest in progress | Yes, for any character in it | Yes, if the character is in it | No |
 | Change quantity or level | Yes | No | No |
 | Equip or unequip | Yes | Yes, if the character can use it | No |
 | See a character's inventory | Yes | Yes | Yes |
 
 ## 9. What is not modelled
 
-- Any effect of an item on stats (AC, speed, abilities)
-- Armor and shields as items
+- Armor rules beyond a flat bonus: armor does not replace 10 + DEX, cap the
+  DEX bonus or need a Strength score (set the AC effect to match)
+- Effects on attack rolls, damage, spell save DC or proficiency bonus
+- Effects that depend on something (only at night, only against undead), or
+  that grow with the item's level
+- Advantage and disadvantage as rules (write them in the note)
 - Using up items automatically, charges, and attunement
 - Weight, carrying capacity and containers
-- Prices, buying and selling (record the gold change in the money log)
+- A price on the item itself: a price is set each time it is put up for sale
+- Selling items back (record the gold change in the money log)
 - Swaps as a single step (each side gives separately), and asking the
   recipient to accept
+- Hands and body slots: the limit is a plain count, so nothing stops two
+  suits of armor being equipped if the count allows it
+- Swapping automatically: equipping at the limit is refused, not exchanged
+
+## 10. The complete item library
+
+Everything "📚 From Library" offers. "While equipped" is what the item does
+to the sheet of whoever has it on.
+
+Armor is a flat bonus to AC on top of 10 + Dexterity: each suit's bonus is its
+standard AC less 10. What a flat bonus cannot say (heavy armor ignoring
+Dexterity, a Strength requirement, disadvantage on Stealth) is in the note,
+for the DM to apply or to build into the numbers of their own copy.
+
+This list is written from the app's own data by `npm run docs:lists` (in `/backend`). Re-run it after changing the data; do not edit the list by hand.
+
+<!-- BEGIN GENERATED: item-library -->
+### Light Armor (3)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Padded Armor | +1 AC | Disadvantage on Stealth checks. | — | Quilted layers of cloth and batting. |
+| Leather Armor | +1 AC | — | — | Boiled leather breastplate and shoulder guards over soft leather. |
+| Studded Leather | +2 AC | — | — | Tough leather set with close rivets and spikes. |
+
+### Medium Armor (5)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Hide Armor | +2 AC | Standard rules: counts at most +2 from Dexterity. | — | Thick furs and pelts. |
+| Chain Shirt | +3 AC | Standard rules: counts at most +2 from Dexterity. | — | Interlocking rings worn between layers of clothing. |
+| Scale Mail | +4 AC | Disadvantage on Stealth checks. Standard rules: counts at most +2 from Dexterity. | — | A coat and leggings of leather covered in overlapping metal scales. |
+| Breastplate | +4 AC | Standard rules: counts at most +2 from Dexterity. | — | A fitted metal chest piece worn with supple leather. |
+| Half Plate | +5 AC | Disadvantage on Stealth checks. Standard rules: counts at most +2 from Dexterity. | — | Shaped metal plates covering most of the body. |
+
+### Heavy Armor (4)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Ring Mail | +4 AC | Disadvantage on Stealth checks. Standard rules: adds no Dexterity. | — | Leather armor with heavy rings sewn into it. |
+| Chain Mail | +6 AC, −10 Speed | Disadvantage on Stealth checks. Standard rules: adds no Dexterity, and needs Strength 13. | — | Interlocking metal rings over a layer of quilted fabric, with gauntlets. |
+| Splint Armor | +7 AC, −10 Speed | Disadvantage on Stealth checks. Standard rules: adds no Dexterity, and needs Strength 15. | — | Narrow vertical strips of metal riveted to a leather backing. |
+| Plate Armor | +8 AC, −10 Speed | Disadvantage on Stealth checks. Standard rules: adds no Dexterity, and needs Strength 15. | — | Shaped, interlocking metal plates covering the whole body. |
+
+### Shields (2)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Shield | +2 AC | — | — | Wood or metal, carried in one hand. |
+| Tower Shield | +3 AC, −5 Speed | — | — | A wall of oak and iron, as tall as its bearer. |
+
+### Worn Gear (10)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Ring of Protection | +1 AC, +1 all saves | — | — | A plain band that turns blows aside. |
+| Cloak of Protection | +1 AC, +1 all saves | — | — | A heavy cloak that seems to catch what was meant for you. |
+| Cloak of Elvenkind | +5 Stealth | With the hood up, others have disadvantage on Perception checks to see you. | — | With the hood up, its colour shifts to match what is behind it. |
+| Boots of Striding | +10 Speed | — | — | Light, tireless boots. |
+| Gauntlets of Might | +2 STR | — | — | Iron-banded gauntlets that lend a giant’s grip. |
+| Gloves of Thievery | +5 Sleight of Hand | — | — | Thin grey gloves that all but vanish when worn. |
+| Amulet of Health | +2 CON | — | — | A red stone on a golden chain, warm against the skin. |
+| Headband of Intellect | +2 INT | — | — | A silver circlet set with a pale blue stone. |
+| Sentinel Charm | +2 Initiative, +5 Passive Perception | — | — | A brass eye on a cord that never quite closes. |
+| Stone of Good Luck | +1 all saves, +1 all skill checks | — | — | A polished agate that sits well in a pocket. |
+
+### Supplies (8)
+
+| Item | While equipped | Note | Dice | Description |
+|---|---|---|---|---|
+| Healing Potion | — | — | 2d4+2 | A red liquid that glimmers when shaken. Drink it to regain hit points. |
+| Rope (50 ft) | — | — | — | Hempen rope. Holds a climber. |
+| Torch | — | Held in a hand to give light. | — | Burns for an hour, lighting 20 feet brightly. |
+| Hooded Lantern | — | Held in a hand to give light. | — | Bright light for 30 feet; the hood dims it to a glow. |
+| Rations (1 day) | — | — | — | Dried meat, hard biscuit, nuts. |
+| Bedroll | — | — | — | A blanket roll for sleeping rough. |
+| Thieves’ Tools | — | — | — | A file, picks, a small mirror, narrow scissors and pliers. |
+| Healer’s Kit | — | — | — | Bandages, salves and splints. Steadies a dying creature without a check. |
+<!-- END GENERATED: item-library -->

docs/MONSTERS.md

@@ -36,10 +36,10 @@ This describes the code as it stands. The built-in list is
 | Name | Up to 80 characters |
 | AC | Armor Class |
 | Max HP | Hit points each copy starts an encounter with |
-| Speed | In feet. 30 unless set otherwise |
+| Speed | Walking speed in feet. 30 unless set otherwise. Other speeds (fly, swim, climb) go in Notes |
 | Ability scores | STR, DEX, CON, INT, WIS, CHA. 10 unless set otherwise |
 | Attack bonus | Added to the monster's attack roll |
-| Damage | Dice for its main attack, e.g. `1d6+2` |
+| Damage | Dice for its main attack, e.g. `1d6+2`, with the damage type if you like: `1d6+2 necrotic` |
 | Challenge rating | A rough danger rating, e.g. `1/4`, `2` |
 | Special trait | A short note such as "Pack Tactics" |
 | Notes | Anything else: what it attacks with, how it behaves |
@@ -50,23 +50,39 @@ from its scores for display only.
 
 ## 3. Managing monsters
 
-The list is the "Monsters" card on the campaign page (DM only).
+The list is the "Monsters" part of the campaign page (DM only). Each monster
+is a short row: its name, challenge rating, AC, HP and attack. The list has a
+search box, shows ten to a page, and clicking a row opens the monster's
+**pop-out** with its whole stat block.
 
-- **Adding by hand:** "+ Add Monster" asks for name, AC, max HP, attack bonus
-  and damage. Speed is set to 30 and every ability score to 10; challenge
-  rating, trait and notes are left empty.
-- **Adding from the bestiary:** "📚 From Library" copies a complete stat block.
-- **Changing:** there is no edit form (the API accepts changes, but no screen
-  offers them). Remove and re-add, or add from the library.
-- **Removing:** the ✕ button, immediately, with no confirmation. Copies
+- **Adding by hand:** "+ Add Monster" opens a pop-out with the whole stat
+  block: name,
+  challenge rating, AC, HP, speed, attack bonus, damage, the six ability
+  scores, special trait and notes. Only name, AC and HP must be typed; speed
+  starts at 30, attack bonus at 0 and each ability score at 10.
+- Once added by hand, the monster's own pop-out opens. "+ Add another
+  monster" at its top goes straight back to an empty form.
+- **Adding from the bestiary:** "📚 From Library" opens the bestiary in a
+  pop-out, and "+ Add" copies a complete stat block.
+  Each monster can be added once: one the campaign already has by that name is
+  left out of the list, and comes back if the campaign's monster is renamed or
+  deleted.
+- **Changing:** "Edit stat block" in a monster's pop-out opens the same form
+  filled in.
+  Saving changes the template, and copies already in encounters show the new
+  stat block straight away; their current HP is left alone.
+- The pop-out shows the full stat block: the numbers, the six ability scores,
+  the trait and the notes.
+- **Removing:** "Remove from campaign" at the foot of the pop-out, after a
+  confirmation. Copies
   already in encounters stay there with their name and HP, but lose their
   stat block.
 
 ## 4. The built-in bestiary
 
-38 monsters, from harmless to dangerous. Each library row shows challenge
-rating, AC, HP, attack and damage, plus its trait and notes, before you add
-it. Adding copies the monster into your campaign; the copy is yours, and later
+38 monsters, from harmless to dangerous, every one with a complete stat
+block. Each library row shows challenge rating, AC, HP, speed, attack, damage
+and the six ability scores, plus its trait and notes, before you add it. Adding copies the monster into your campaign; the copy is yours, and later
 changes to the library do not affect it.
 
 The full bestiary, weakest first. "Attack" is the bonus added to the
@@ -146,8 +162,9 @@ and its notes.
 This is enforced by the server: stat blocks are never sent to a player's
 browser.
 
-Players do see a monster's exact HP numbers. If you would rather keep those
-secret, that is not currently possible.
+Players see a monster's exact HP numbers unless the campaign setting "Players
+see the exact hit points of monsters and NPCs in encounters" is unticked.
+Then they get the health bar only.
 
 ## 7. Permissions
 
@@ -163,6 +180,7 @@ secret, that is not currently possible.
 ## 8. What is not modelled
 
 - Multiple attacks, spells, legendary actions and resistances (use Notes)
+- Trade: monsters do not sell things or change money (NPCs do)
 - Rolling a monster's attacks or damage (use the dice roller)
 - Saving throw bonuses and skills
 - Experience points for defeating monsters

docs/NPCS.md

@@ -1,7 +1,8 @@
 # NPCs
 
 How non-player characters work in this app: what the DM records about them,
-how they are brought into a scene, and what players can and cannot see.
+how they are brought into a scene, what they sell and the rate they change
+money at, and what players can and cannot see.
 
 This describes the code as it stands. Related: [ENCOUNTERS.md](ENCOUNTERS.md),
 [MONSTERS.md](MONSTERS.md).
@@ -12,10 +13,11 @@ This describes the code as it stands. Related: [ENCOUNTERS.md](ENCOUNTERS.md),
 2. [What an NPC holds](#2-what-an-npc-holds)
 3. [Managing NPCs](#3-managing-npcs)
 4. [NPCs in encounters](#4-npcs-in-encounters)
-5. [What players see](#5-what-players-see)
-6. [NPC or monster?](#6-npc-or-monster)
-7. [Permissions](#7-permissions)
-8. [What is not modelled](#8-what-is-not-modelled)
+5. [Trade: changing money and selling](#5-trade-changing-money-and-selling)
+6. [What players see](#6-what-players-see)
+7. [NPC or monster?](#7-npc-or-monster)
+8. [Permissions](#8-permissions)
+9. [What is not modelled](#9-what-is-not-modelled)
 
 ---
 
@@ -27,6 +29,8 @@ This describes the code as it stands. Related: [ENCOUNTERS.md](ENCOUNTERS.md),
 - An NPC does nothing by sitting in the list. Players meet one when the DM
   **adds it to an encounter**.
 - NPCs are mainly for talking to. Combat stats are optional.
+- An NPC can also **trade**: change gold and cash at a rate of their own, and
+  sell weapons and items (section 5).
 
 ## 2. What an NPC holds
 
@@ -38,22 +42,34 @@ This describes the code as it stands. Related: [ENCOUNTERS.md](ENCOUNTERS.md),
 | Description | What the party can see and knows | Everyone |
 | DM notes | Secrets, motives, what they are hiding | **DM only** |
 | AC | Optional | DM only |
-| HP | Optional. Without it the NPC has no health bar | See section 5 |
+| HP | Optional. Without it the NPC has no health bar | See section 6 |
 | Attack bonus | Optional | DM only |
 | Damage | Optional dice, e.g. `1d6` | DM only |
+| Exchange rate | Optional: so much gold for so much cash (section 5) | Everyone, in an encounter |
+| Wares | Optional: weapons and items for sale, each with a price (section 5) | Everyone, in an encounter |
 
 A new NPC is Neutral unless you choose otherwise.
 
 ## 3. Managing NPCs
 
-The NPC list is the "NPCs" card on the campaign page (DM only).
+The NPC list is the "NPCs" part of the campaign page (DM only). Each NPC is a
+short row: name, role, the start of their description, and badges for their
+attitude, a 💱 with their exchange rate and a 🛒 with how many things they
+have for sale. The list has a search box and shows ten to a page.
 
-- **Adding:** "+ Add NPC" opens a form with every field above. Only the name
-  is required.
-- **Changing:** there is no edit form. To change an NPC, remove it and add it
-  again (the API accepts changes, but no screen offers them).
-- **Removing:** the ✕ button, after a confirmation. This also **removes the
-  NPC from every encounter** it was in.
+- **The pop-out:** clicking a row opens the NPC's pop-out, with everything
+  above: description, DM notes, combat stats, and their trade.
+- **Adding:** "+ Add NPC" opens a pop-out with every field above except the
+  exchange rate and wares. Only the name is required. Once added, the NPC's
+  own pop-out opens, to set their trade; "+ Add another NPC" at its top goes
+  straight back to an empty form.
+- **Trade:** the exchange rate and the wares are set in the NPC's pop-out,
+  under "Changes money" and "For sale" (section 5).
+- **Changing:** there is no edit form for the other fields. To change them,
+  remove the NPC and add it again (the API accepts changes, but no screen
+  offers them). Removing an NPC removes their wares too.
+- **Removing:** "Remove from campaign" at the foot of the pop-out, after a
+  confirmation. This also **removes the NPC from every encounter** it was in.
 
 ## 4. NPCs in encounters
 
@@ -73,7 +89,73 @@ An NPC's card shows its attitude as a coloured badge, its role under its
 name, and its description in full. The DM's card also shows AC, attack,
 damage and the DM notes.
 
-## 5. What players see
+## 5. Trade: changing money and selling
+
+Only the DM sets trade up. Players see it and use it on the encounter page,
+in the "Trade" card. The rules for when trading is open are in
+[ENCOUNTERS.md](ENCOUNTERS.md), section 10: in short, in an **NPC quest that
+is in progress**, never in a battle, and only with an NPC who is in the scene
+and not at 0 HP.
+
+### Changing money
+
+An NPC with an **exchange rate** changes gold into cash ($) and cash into
+gold. The rate is two whole numbers, "this much gold = this much cash", and
+each NPC has their own, so one money changer can be a better deal than
+another.
+
+| Rate | Hand over | Get |
+|---|---|---|
+| 1 gold = $5 | 3 gold | $15 |
+| 1 gold = $5 | $20 | 4 gold |
+| 2 gold = $15 | 6 gold | $45 |
+| 2 gold = $15 | $30 | 4 gold |
+
+- The same rate is used both ways.
+- **Only gold and cash.** Silver and copper are not taken, a gold coin is not
+  broken to make up an amount, and no change is given.
+- What is handed over has to be a whole multiple of that side of the rate: at
+  2 gold = $15, gold goes in twos and cash in fifteens.
+- Both sides go on the character's money log, naming the NPC: "Changed with
+  Vex for $45" and "Changed with Vex from 6 gold".
+- An NPC never runs out of gold or cash to change.
+- To set a rate, type both numbers under "Changes money" in the NPC's pop-out
+  and press "Save rate".
+  "Stop changing money" clears it. An NPC with no rate does not change money.
+
+### Selling
+
+An NPC's **wares** are weapons and items from the campaign's own pools, each
+put up for sale with:
+
+| Field | What it is |
+|---|---|
+| What | One weapon or item from the pool |
+| Level | The gear level it is handed over at, not below its starting level |
+| Price | For one, in gold, silver, copper or cash |
+| Stock | How many can be bought. Empty means no limit |
+
+- Wares belong to the NPC, not to an encounter: they are on offer in every
+  quest that NPC is in.
+- Buying pays the price from the character's purse, adds the weapon or item
+  to what they hold (stacking with any they already have) and lowers the
+  stock. A price in coins is paid with change, exactly like any other spend;
+  a price in cash takes cash only.
+- At 0 stock a ware shows as sold out and cannot be bought. It stays listed
+  until the DM removes it.
+- The ✕ beside a ware stops it being sold. Things already bought stay bought.
+- "Edit" beside a ware changes its price, the coin (or cash) the price is in,
+  and its stock: restock a sold-out ware, or clear the stock for no limit.
+  What is sold, its level and who sells it cannot be changed; remove the ware
+  and put it up again for that.
+- Removing a weapon or item from the campaign pool removes it from sale
+  everywhere.
+
+A stall or a machine with nobody behind it can sell things too: those wares
+belong to an encounter rather than an NPC, and are set up on the encounter
+page. See [ENCOUNTERS.md](ENCOUNTERS.md), section 10.
+
+## 6. What players see
 
 Players only ever see an NPC through an encounter it is in:
 
@@ -81,6 +163,7 @@ Players only ever see an NPC through an encounter it is in:
 |---|---|
 | Name, role, attitude, description | DM notes |
 | Health bar and conditions, if the NPC has HP | AC, attack bonus, damage |
+| The exchange rate, and everything the NPC has for sale with its price and stock | The NPC list, and wares of NPCs who are not in the scene |
 
 This is enforced by the server, not just hidden on screen: the hidden fields
 are never sent to a player's browser.
@@ -88,7 +171,7 @@ are never sent to a player's browser.
 Changing an NPC's attitude changes what players see straight away, so
 flipping a "Friendly" NPC to "Hostile" is itself a reveal.
 
-## 6. NPC or monster?
+## 7. NPC or monster?
 
 | | NPC | Monster |
 |---|---|---|
@@ -99,11 +182,12 @@ flipping a "Friendly" NPC to "Hostile" is itself a reveal.
 | Combat stats | Optional, basic | Full stat block |
 | Can be in an encounter more than once | No | Yes (a pack of goblins) |
 | Built-in library | No | Yes |
+| Can change money and sell things | Yes | No |
 
 A named villain the party will both talk to and fight works well as an NPC
 with HP, AC, attack and damage filled in.
 
-## 7. Permissions
+## 8. Permissions
 
 | Action | DM | Players |
 |---|---|---|
@@ -111,12 +195,18 @@ with HP, AC, attack and damage filled in.
 | Add or remove NPCs | Yes | No |
 | Add an NPC to an encounter | Yes | No |
 | Change an NPC's HP or conditions in an encounter | Yes | No |
-| See an NPC in an encounter | Everything | Name, role, attitude, description, health bar |
+| See an NPC in an encounter | Everything | Name, role, attitude, description, health bar, exchange rate, wares |
+| Set an NPC's exchange rate | Yes | No |
+| Put things up for sale, or take them down | Yes | No |
+| Change money with an NPC, or buy from one | Yes, for any character in the scene | For their own character in the scene |
 
-## 8. What is not modelled
+## 9. What is not modelled
 
 - Ability scores, saves, skills and spells for NPCs
-- NPC inventory, gold and shops
+- An NPC's own purse: they never run short of gold or cash
+- Selling things to an NPC, haggling, and different rates for buying and
+  selling cash
+- Changing silver or copper for cash
 - Where an NPC is (they are not tied to locations)
 - Relationships, reputation and attitude toward individual characters
 - A record of which NPCs the party has met, outside of encounters

docs/SEEDS.md

@@ -0,0 +1,233 @@
+# World Seeds
+
+A world seed is a ready-made campaign: locations, weapons, items, spells,
+monsters, NPCs with their wares, encounters with their rewards, and notes. A
+DM starts a campaign from one by typing its code.
+
+This describes the code as it stands. Related: [ITEMS.md](ITEMS.md),
+[WEAPONS.md](WEAPONS.md), [SPELLS.md](SPELLS.md), [MONSTERS.md](MONSTERS.md),
+[NPCS.md](NPCS.md), [ENCOUNTERS.md](ENCOUNTERS.md).
+
+## Contents
+
+1. [The basics](#1-the-basics)
+2. [Starting a campaign from a code](#2-starting-a-campaign-from-a-code)
+3. [Adding a world](#3-adding-a-world)
+4. [What a seed file holds](#4-what-a-seed-file-holds)
+5. [Checking a seed](#5-checking-a-seed)
+6. [The database seed](#6-the-database-seed)
+7. [The worlds that come with the app](#7-the-worlds-that-come-with-the-app)
+
+---
+
+## 1. The basics
+
+- Every `.js` file in `/backend/seeds` is one world. The file says what its
+  **code** is: six capital letters or digits.
+- Anyone who is logged in and knows a code can create that world as a new
+  campaign. They become its DM and owner, exactly as with a blank campaign.
+- The same code can be used any number of times. Each use makes a separate
+  campaign with its own invite code; nothing is shared between copies.
+- A seed only says what a campaign **starts** as. Once created, the campaign
+  is the DM's to change, and changing the seed file later does not touch
+  campaigns already made from it.
+- The folder is read each time a code is entered, so a new file is live as
+  soon as it is on the server. No restart, no migration.
+
+## 2. Starting a campaign from a code
+
+On the **Campaigns** page, click **+ New Campaign**. Under the form for a
+blank campaign is **Or start from a ready-made world**: type the code and
+click **Create From Code**. Capitals and spaces do not matter (`aldenf`,
+`ALDENF` and `ald-enf` are the same code).
+
+The whole world is created in one go, and you land on its campaign page. If
+anything in it fails, nothing is created.
+
+| Reply | Meaning |
+|---|---|
+| "A world code is 6 letters or numbers" | What was typed is not six characters long |
+| "There is no world with that code" | No valid seed file has that code |
+
+The API is `POST /campaigns/from-seed` with `{ "code": "ALDENF" }`. It
+answers with the new campaign, as `POST /campaigns` does.
+
+## 3. Adding a world
+
+1. Write the world as a file in `/backend/seeds`, for example
+   `/backend/seeds/my-world.js` (section 4).
+2. Run `npm run seeds:check` (section 5) and fix whatever it reports.
+3. Put the file on the server. The code works straight away.
+
+A file with a mistake in it is never offered: its code simply answers "There
+is no world with that code" until the file is fixed. Two files cannot share a
+code; the one whose file name comes first keeps it.
+
+To retire a world, delete its file. Campaigns already made from it stay.
+
+## 4. What a seed file holds
+
+A seed file is a JavaScript module that exports one object. Only `code` and
+`campaign.name` are required; every list can be left out.
+
+```js
+module.exports = {
+  code: 'MYWRLD',
+  campaign: { name: 'My World', description: '...', startingGold: 20, startingItemCount: 2, startingSpellCount: 2 },
+  locations: [{ name: 'The Old Mill', description: '...' }],
+  weapons: [
+    'dagger',                                      // a copy from the site library
+    { library: 'longsword', isStartingOption: true }, // a copy, with changes
+    { name: 'Millstone Hammer', damageDice: '2d6', damageType: 'bludgeoning', attackAbility: 'STR', minLevel: 3 },
+  ],
+  items: [
+    { library: 'shield', isStartingOption: true },
+    { name: 'Miller’s Charm', description: '...', effects: [{ stat: 'SKILL_PERCEPTION', amount: 1 }] },
+  ],
+  spells: [{ library: 'fire-bolt', isStartingOption: true }, 'fireball'],
+  monsters: ['goblin', { name: 'Mill Wraith', ac: 13, maxHp: 30, attackBonus: 4, damageDice: '1d8+2 necrotic' }],
+  npcs: [
+    {
+      name: 'Old Hob', role: 'Miller', disposition: 'FRIENDLY', description: '...', dmNotes: '...',
+      wares: [{ item: 'Shield', price: 10 }, { weapon: 'Dagger', price: 2, stock: 3 }],
+    },
+  ],
+  encounters: [
+    {
+      name: 'The Mill at Night', mode: 'BATTLE', location: 'The Old Mill', description: '...', dmNotes: '...',
+      monsters: [['Goblin', 3], ['Mill Wraith', 1, 'The Miller’s Wife', 40]],
+      npcs: ['Old Hob'],
+      rewards: [{ gold: 25 }, { silver: 40 }, { weapon: 'Millstone Hammer', note: 'Behind the wheel' }],
+    },
+  ],
+  sharedNotes: ['Welcome to My World...'],
+  dmNotes: ['The secret of the mill...'],
+};
+```
+
+The file is ordinary JavaScript, so it can build its lists however it likes
+(the Hollowcrown seed adds the whole spell library with a `map`).
+
+### Top level
+
+| Field | What it is |
+|---|---|
+| `code` | Six capital letters or digits. What a DM types |
+| `campaign` | The campaign's settings: `name`, and optionally `description`, `startingGold`, `startingItemCount`, `startingSpellCount`, `skipMotivationRoll`, `showMonsterHp`, `areaAttackAcPenalty`, `maxEquipped`, `maxEquippedWeapons`. Anything left out takes the app's default |
+| `locations` | `{ name, description }` |
+| `weapons`, `items`, `spells`, `monsters` | The pools. Each entry is a row or a library copy (below) |
+| `npcs` | NPC rows, each optionally with `wares` |
+| `encounters` | In the order they should list |
+| `sharedNotes`, `dmNotes` | Note bodies, in reading order: the first is shown at the top. Shared notes are for everyone, DM notes for the DM |
+
+### Pool entries
+
+An entry in `weapons`, `items`, `spells` or `monsters` is one of:
+
+- **A library key** such as `'longsword'`: a copy of that entry from the
+  site's built-in library (`src/game/data/*Library.js`).
+- **A library copy with changes**: `{ library: 'longsword', isStartingOption: true, minLevel: 2 }`.
+  Any field of the row can be changed, including its name.
+- **A full row**, with the same fields the app's own forms have:
+
+| Pool | Fields (required in bold) |
+|---|---|
+| Weapon | **`name`**, **`damageDice`**, **`damageType`**, **`attackAbility`** (`STR`, `DEX` or `FINESSE`), `properties`, `rangeNormal`, `rangeLong`, `damageScaling` (1 to 3), `minLevel` (1 to 9), `isStartingOption`, `effects`, `effectNote` |
+| Item | **`name`**, `description`, `damageDice`, `damageScaling`, `minLevel`, `isStartingOption`, `effects`, `effectNote` |
+| Spell | **`name`**, **`level`** (0 to 9), `damageDice`, `school`, `castingTime`, `range`, `duration`, `description`, `isStartingOption`, `revives` |
+| Monster | **`name`**, **`ac`**, **`maxHp`**, `speed`, `strScore` ... `chaScore`, `attackBonus`, `damageDice` (may name its type: `"1d6+2 necrotic"`), `challengeRating`, `specialTrait`, `notes` |
+
+`effects` is a list of `{ stat, amount }`, as described in
+[ITEMS.md](ITEMS.md): armor is an item with an `AC` effect.
+
+Within a pool a name can only be used once, because everything else in the
+file points at pool entries **by name**.
+
+### NPCs
+
+**`name`**, `role`, `disposition` (`FRIENDLY`, `NEUTRAL` or `HOSTILE`),
+`description` (what players see), `dmNotes`, and for those who might fight
+`ac`, `maxHp`, `attackBonus`, `damageDice`.
+
+- **A money changer** has `exchangeGold` and `exchangeCash` together:
+  `exchangeGold: 1, exchangeCash: 50` is 1 gold for $50, either way.
+- **A shopkeeper** has `wares`, a list of things for sale (below).
+
+### Encounters
+
+| Field | What it is |
+|---|---|
+| **`name`** | |
+| `mode` | `BATTLE` (the default) or `QUEST`. Buying and money changing only happen in a quest |
+| `description` | The scene, shown to the players in it |
+| `dmNotes` | DM only |
+| `location` | A location's name |
+| `monsters` | `[monster name, how many, display name, max HP]`. The last two are optional; more than one gets "#1", "#2"... |
+| `npcs` | NPC names, or `{ name, hp }` to set the hit points for this scene |
+| `rewards` | Lined up unawarded (below) |
+| `wares` | For sale at the scene itself, with nobody behind it: a market, a vending machine |
+
+A **reward** is exactly one of `gold`, `silver`, `copper`, `cash` (an amount),
+`weapon` or `item` (a name), with an optional `note`. A weapon or item can also
+have `quantity` and `level`.
+
+A **ware** is `{ weapon | item, price }` with optional `currency` (`GOLD`, the
+default, `SILVER`, `COPPER` or `CASH`), `level` and `stock` (left out: no
+limit).
+
+A reward's or ware's `level` defaults to the entry's own starting level, and
+cannot be below it.
+
+### Limits
+
+Text fields have the same length limits as the app's forms (for example 4,000
+characters for an encounter's DM notes and 10,000 for a note), so that
+everything a seed creates can still be edited on screen. The checker says
+which field is over.
+
+## 5. Checking a seed
+
+```bash
+npm run seeds:check
+```
+
+lists every file in `/backend/seeds` with its code and what it holds, or
+everything wrong with it:
+
+```
+✓ aldenfell.js — code ALDENF — Aldenfell
+    24 weapons (16 starting), 31 items (10 starting), 45 spells (30 starting), 21 locations
+    15 monsters, 13 NPCs (8 wares), 38 encounters (40 rewards, 9 wares), 23 notes
+✗ my-world.js
+    npcs.0.desciption: Unrecognized key: "desciption"
+    Encounter "The Mill at Night": there is no monster called "Gobblin"
+```
+
+It checks the things that would otherwise only show up as a half-working
+campaign:
+
+- A field name that is not one of the fields above (a typo).
+- A library key that is not in the library.
+- The same name twice in one pool.
+- An encounter, reward or ware that names a location, monster, NPC, weapon or
+  item the file does not have.
+- A reward that is not exactly one thing, or gear handed out below its
+  starting level.
+- An exchange rate with only one half.
+
+`npm test` runs the same check on every seed in the folder.
+
+## 6. The database seed
+
+`npx prisma db seed` creates the admin account if it is missing, and nothing
+else. It never adds a campaign: worlds come from codes, in the app. See the
+README for the account it creates and `--reset`.
+
+## 7. The worlds that come with the app
+
+| Code | World | From |
+|---|---|---|
+| `ALDENF` | Aldenfell | The Aldenfell Campaign Book |
+| `HOLLOW` | Hollowcrown: The Rift Between Worlds | The Hollowcrown Dungeon Master's Book (V3) |
+
+Change a world's code by editing `code` in its file.

docs/SPELLS.md

@@ -17,10 +17,11 @@ This describes the code as it stands. The built-in list is
 5. [Spell level and who can use it](#5-spell-level-and-who-can-use-it)
 6. [Damage](#6-damage)
 7. [Spellcasting numbers](#7-spellcasting-numbers)
-8. [Starting spells](#8-starting-spells)
-9. [Permissions](#9-permissions)
-10. [What is not modelled](#10-what-is-not-modelled)
-11. [The complete spell library](#11-the-complete-spell-library)
+8. [Spell slots](#8-spell-slots)
+9. [Starting spells](#9-starting-spells)
+10. [Permissions](#10-permissions)
+11. [What is not modelled](#11-what-is-not-modelled)
+12. [The complete spell library](#12-the-complete-spell-library)
 
 ---
 
@@ -36,7 +37,10 @@ This describes the code as it stands. The built-in list is
 
 ## 2. The spell list
 
-The list is the "Spell List" card on the campaign page (DM only).
+The list is the "Spells" part of the campaign page (DM only). Each spell is a
+short row: its name, level, damage and the start of what it does. The list
+has a search box, shows ten to a page, and clicking a row opens the spell's
+**pop-out**, which shows everything below and is where it is changed.
 
 | Field | What it is |
 |---|---|
@@ -45,16 +49,19 @@ The list is the "Spell List" card on the campaign page (DM only).
 | School | Free text: Evocation, Illusion… |
 | What it does | One sentence. Shown wherever the spell is shown |
 | Damage | Picked from a list, or "No damage". Fixed; it does not grow |
-| Starting option | Whether a brand-new character may pick it in the builder (section 8) |
-| Casting time, range, duration | Stored for library spells but not shown on any screen |
+| Starting option | Whether a brand-new character may pick it in the builder (section 9) |
+| Revives | Whether it brings back the dead. A character who can cast one may revive a dead ally on their turn in a battle ([ENCOUNTERS.md](ENCOUNTERS.md), section 6). Ticked already on the library's Revivify and Raise Dead |
+| Casting time, range, duration | Stored for library spells. Shown to the DM in the spell's pop-out on the campaign page, and nowhere else |
 
 A cantrip is a spell of level 0. The app always calls it a **cantrip**, never
 "level 0" or "level 1".
 
-- **Adding:** by hand with the "+ Add Spell" form (name, level, school,
-  damage and what it does), or from the library.
-- **Changing:** damage (the drop-down in the table) and the starting-option
-  tick box. Name, level, school and description cannot be changed on screen
+- **Adding:** by hand with "+ Add Spell" (name, level, school, damage, what
+  it does and the two tick boxes), or from the library. Both open in a
+  pop-out. A spell added by hand opens its own pop-out, and "+ Add another
+  spell" at its top goes straight back to an empty form.
+- **Changing:** in the spell's pop-out: damage (the drop-down) and the Revives
+  and starting-option tick boxes, saved as they are changed. Name, level, school and description cannot be changed on screen
   once created (the API accepts it); remove and re-add instead.
 - **Damage choices:** the drop-down offers "No damage", then 1 to 6, 8 or 10
   dice of d4, d6, d8, d10 or d12 (1d4 up to 10d12), plus the three unusual
@@ -83,7 +90,7 @@ Before you add one, each row shows:
 - **what it does**, in a sentence.
 
 Every library spell is listed in full in
-[section 11](#11-the-complete-spell-library).
+[section 12](#12-the-complete-spell-library).
 
 35 of the library spells deal damage and come with a default, taken from the
 standard rules at the spell's own level. For example:
@@ -106,6 +113,10 @@ one shown.
 A spell added from the library is **not** a starting option until ticked. The
 library has nothing above level 5; add higher spells by hand.
 
+Each library spell can be added once. A spell the list already has by that
+name is left out of the library list, and comes back if the campaign's spell
+is renamed or deleted.
+
 ## 4. Granting spells to characters
 
 On a character's sheet, the DM picks a spell from the list and clicks Grant.
@@ -172,7 +183,83 @@ Shown only for classes with a spellcasting ability:
 A character without a spellcasting class can still be granted spells, but has
 no save DC or attack bonus shown.
 
-## 8. Starting spells
+## 8. Spell slots
+
+A spell slot is one casting of a spell of that level or lower. Cantrips never
+use one. How many slots a character has is worked out from **class and
+level**; the site keeps count of how many are spent.
+
+**Where.** The tracker is in the Spellcasting card on the sheet and in the
+character panel (the 🧙 button, on every page, so it is at hand in an
+encounter). The party overview has a "Spell slots" column for the whole party.
+Each slot level is a row of diamonds: filled is a slot still there to spend,
+empty is one that is spent.
+
+**Who does what.**
+
+- The character's **player** (and the DM) presses **Use** on a row when a
+  spell is cast: one slot of that level is spent. That is all a player can do;
+  a slot once used stays used.
+- Only the **DM** gives a slot back: by clicking a diamond (it sets how many
+  are left; clicking the last filled one empties it), with "All back", or with
+  a rest.
+- Casting a low spell with a higher slot is spending the higher slot. Nothing
+  ties a slot to a spell: the site does not check which spell was cast.
+
+**Getting them back.** The DM's 🛏 Rest… button ([CHARACTERS.md](CHARACTERS.md),
+section 7): a **long rest** gives every slot back; a **short rest** gives a
+warlock theirs. Levelling up with "⬆ Level Up…" gives a fresh set. Changing
+the Level field keeps what was spent, as far as the new level has those slots.
+
+**Bard, Cleric, Druid, Sorcerer, Wizard** (back on a long rest):
+
+| Character level | 1st | 2nd | 3rd | 4th | 5th |
+|---|---|---|---|---|---|
+| 1 | 2 | — | — | — | — |
+| 2 | 3 | — | — | — | — |
+| 3 | 4 | 2 | — | — | — |
+| 4 | 4 | 3 | — | — | — |
+| 5 | 4 | 3 | 2 | — | — |
+| 6 | 4 | 3 | 3 | — | — |
+| 7 | 4 | 3 | 3 | 1 | — |
+| 8 | 4 | 3 | 3 | 2 | — |
+| 9 | 4 | 3 | 3 | 3 | 1 |
+| 10 | 4 | 3 | 3 | 3 | 2 |
+
+**Paladin, Ranger** (back on a long rest; none at level 1):
+
+| Character level | 1st | 2nd | 3rd |
+|---|---|---|---|
+| 1 | — | — | — |
+| 2 | 2 | — | — |
+| 3–4 | 3 | — | — |
+| 5–6 | 4 | 2 | — |
+| 7–8 | 4 | 3 | — |
+| 9–10 | 4 | 3 | 2 |
+
+**Warlock** (back on a short or long rest). All of a warlock's slots are the
+same level, and every spell cast with one is cast at that level:
+
+| Character level | Slots | Slot level |
+|---|---|---|
+| 1 | 1 | 1st |
+| 2 | 2 | 1st |
+| 3–4 | 2 | 2nd |
+| 5–6 | 2 | 3rd |
+| 7–8 | 2 | 4th |
+| 9–10 | 2 | 5th |
+
+Above level 10 the tables carry on as in standard 5e, up to 9th-level slots at
+character level 17 (a warlock has 3 slots from level 11 and 4 from level 17).
+Barbarians, fighters, monks and rogues have no slots, whatever spells they are
+granted.
+
+Slots do not decide what a character may **know or prepare**: that is still
+section 5. A wizard of level 3 can be granted a 3rd-level spell and prepare it,
+but has no 3rd-level slot to cast it with until level 5. Holding the players
+to that is the DM's.
+
+## 9. Starting spells
 
 In the builder's equipment step a new character can pick spells that are:
 
@@ -183,20 +270,26 @@ In the builder's equipment step a new character can pick spells that are:
 The number allowed is the campaign's "starting spells" setting. Starting
 spells arrive unprepared.
 
-## 9. Permissions
+## 10. Permissions
 
 | Action | DM | Owning player | Other players |
 |---|---|---|---|
-| See the spell list and the library | Yes | Yes | Yes |
+| See the spell list | Yes | Only what their own character holds, plus the starting options while they have a character to build | The same, for their own character |
+| See the built-in library | Yes | No | No |
 | Add, change or remove spells in the list | Yes | No | No |
 | Grant a spell from the list, or remove one | Yes | No | No |
 | Give a known spell to another character | Yes | Yes | No |
 | Prepare or unprepare | Yes | Yes, if the character can use it | No |
+| Spend a spell slot | Yes | Yes | No |
+| Give a spell slot back | Yes | No | No |
 | See a character's spells | Yes | Yes | Yes |
 
-## 10. What is not modelled
+## 11. What is not modelled
 
-- Spell slots, and casting a spell at a higher level
+- Which spell a slot was spent on, and what casting at a higher level adds
+  (the player adds the extra dice)
+- Sorcery points, and Arcane or Natural Recovery (the DM gives those slots
+  back by hand)
 - Cantrip damage increasing at higher character levels
 - Limits on how many spells can be prepared or known
 - Concentration, components, rituals
@@ -205,7 +298,7 @@ spells arrive unprepared.
   shown)
 - Applying spell damage to a target automatically
 
-## 11. The complete spell library
+## 12. The complete spell library
 
 Every spell "📚 From Library" offers, with the damage it arrives with.
 

docs/WEAPONS.md

@@ -19,7 +19,7 @@ This describes the code as it stands. The formulas live in
 6. [How damage grows](#6-how-damage-grows)
 7. [Attack and damage numbers](#7-attack-and-damage-numbers)
 8. [Starting weapons](#8-starting-weapons)
-9. [Weapons as rewards](#9-weapons-as-rewards)
+9. [Weapons as rewards and for sale](#9-weapons-as-rewards-and-for-sale)
 10. [Permissions](#10-permissions)
 11. [What is not modelled](#11-what-is-not-modelled)
 12. [The complete weapon library](#12-the-complete-weapon-library)
@@ -37,7 +37,11 @@ This describes the code as it stands. The formulas live in
 
 ## 2. The weapon pool
 
-The pool is the "Weapons Pool" card on the campaign page (DM only).
+The pool is the "Weapons" part of the campaign page (DM only). It lists each
+weapon as a short row: its name, base damage, starting level and what it does
+while equipped. The list has a search box, shows ten to a page, and clicking a
+row opens the weapon's **pop-out**, which shows everything below and is where
+it is changed.
 
 | Field | What it is |
 |---|---|
@@ -48,20 +52,30 @@ The pool is the "Weapons Pool" card on the campaign page (DM only).
 | Starts at level | 1 to 9. The lowest level this weapon can be (section 5) |
 | Growth | Standard, Powerful or Legendary: how fast the dice climb per level (section 6) |
 | Starting option | Whether a brand-new character may pick it in the builder (section 8) |
-| Properties, range | Stored for library weapons (light, thrown, 20/60 ft…) but not shown or used anywhere |
+| Properties, range | Stored for library weapons (light, thrown, 20/60 ft…). Shown in the weapon's pop-out, and not used anywhere |
+| Effects | What it does to whoever has it equipped: bonuses and penalties to the sheet's numbers, and a note. Works exactly as for items ([ITEMS.md](ITEMS.md), section 5) |
 
-- **Adding:** by hand with the "+ Add Weapon" form, or from the library.
-- **Changing:** starting level, growth and the starting-option tick box can be
-  changed in the table. Name, damage, type and ability cannot be changed on
-  screen once created (the API accepts it); remove and re-add instead.
-- **Removing:** the ✕ button. This takes the weapon away from **every
+- **Adding:** by hand with "+ Add Weapon", or from the library. Both open in
+  a pop-out. A weapon added by hand opens its own pop-out straight away, to
+  set what it does; "+ Add another weapon" at its top goes straight back to
+  an empty form.
+- **Effects:** under "While equipped" in the weapon's pop-out, saved with
+  "Save Effects". A defending blade can give +1 AC, a heavy maul −5 speed.
+  They count only while the weapon is equipped, and do not change its own
+  attack or damage.
+- **Changing:** starting level, growth and the starting-option tick box are
+  changed in the pop-out, and saved as they are changed. Name, damage, type
+  and ability cannot be changed on screen once created (the API accepts it);
+  remove and re-add instead.
+- **Removing:** "Remove from campaign" at the foot of the pop-out, after a
+  confirmation. This takes the weapon away from **every
   character holding it** and off every encounter's reward list. There is no
   undo.
 - The same weapon can be added twice; nothing stops duplicate names.
 
 ## 3. The built-in library
 
-"📚 From Library" offers 37 standard weapons to copy into the pool:
+"📚 From Library" offers 41 weapons to copy into the pool:
 
 | Category | Count | Examples |
 |---|---|---|
@@ -69,12 +83,23 @@ The pool is the "Weapons Pool" card on the campaign page (DM only).
 | Simple ranged | 4 | Shortbow, Light Crossbow, Dart, Sling |
 | Martial melee | 18 | Longsword 1d8, Rapier 1d8, Greataxe 1d12, Greatsword 2d6 |
 | Martial ranged | 5 | Longbow, Heavy Crossbow, Hand Crossbow |
+| Paired | 4 | Paired Daggers 2d4, Paired Shortswords 2d6, Paired Scimitars 2d6, Paired Handaxes 2d6 |
+
+**Paired weapons.** A character has one weapon equipped at a time (section
+4), so fighting with a weapon in each hand is not two weapons: it is **one
+weapon made as a pair**, whose damage is both blades. The library has four,
+and a DM makes others the same way with "+ Add Weapon" ("Twin Hammers",
+2d4 bludgeoning).
 
 A weapon added from the library arrives with starting level 1, Standard
 growth, and **not** ticked as a starting option. Change those in the table
 afterwards. Every library weapon is listed in
 [section 12](#12-the-complete-weapon-library).
 
+Each library weapon can be added once. A weapon the pool already has by that
+name is left out of the library list, and comes back if the pool's weapon is
+renamed or deleted.
+
 ## 4. Giving weapons to characters
 
 On a character's sheet, the DM picks a weapon from the pool and clicks Give.
@@ -84,8 +109,33 @@ On a character's sheet, the DM picks a weapon from the pool and clicks Give.
   keeps the level it has. A character holds one stack per weapon, so two
   copies of the same weapon at different levels is not possible.
 - The DM can take a weapon away with ✕ on the sheet.
-- The owning player ticks **Equipped**. Equipped is a label only: unequipped
-  weapons still show their numbers, and nothing limits how many are equipped.
+- The owning player, or the DM, ticks **Equipped**.
+- **Only what is equipped counts.** A weapon has to be equipped to be used
+  in an encounter, and gear only gives its effects while equipped. What is
+  not equipped stays in the pack: still the character's, still listed on the
+  sheet and in the character panel, but not in hand.
+- **There is a limit on how much can be equipped at once**, set per campaign
+  in Campaign Settings ("Equipped at once"):
+
+  | Setting | Starts at | Means |
+  |---|---|---|
+  | Things equipped at once | 2 | Weapons and items together |
+  | Of which weapons | 1 | So: one weapon, or one weapon and one item, or two items |
+
+  Armor and shields are items and count toward the limit. With the starting
+  numbers a character can have a weapon and a shield, or a weapon and armor,
+  but not all three; a DM who wants armor, shield and weapon together sets
+  the first number to 3.
+- **Putting something on when the limit is reached is refused**, with a
+  message naming what is already equipped. Take something off first.
+- **Equipping can be changed at any time, including in the middle of an
+  encounter**, by the owning player or the DM: on the sheet, or in the
+  character panel (the 🧙 button, or "🎒 Inventory" on the character's
+  encounter card).
+- Lowering the limits takes nothing off anyone. A character with more on
+  than the new limit keeps it until they change what they have equipped.
+- Everything arrives unequipped: gear from the DM, from a reward, bought, or
+  given by another character.
 
 **Passing a weapon on.** A character's owner (or the DM) can give a held
 weapon to another character in the campaign from the "Give to Another
@@ -115,7 +165,8 @@ This is a house rule of this app, not standard D&D.
 | 9 and above | 1–9 |
 
 A weapon above its holder's level is still held, but it shows "Requires level
-N", cannot be equipped, and is left out of quick stats and encounters. If the
+N", cannot be equipped, and so is never on its holder's encounter card. The
+character panel lists it, marked "needs level N". If the
 DM levels a weapon past its holder, or lowers the character's level, it is
 unequipped automatically.
 
@@ -185,21 +236,31 @@ In the builder's equipment step a new character can pick weapons that are:
 Starting weapons and starting items share the campaign's "starting items"
 allowance. They arrive at level 1, unequipped.
 
-## 9. Weapons as rewards
+## 9. Weapons as rewards and for sale
 
 On an encounter the DM can line up a weapon as a reward, at a chosen level
 (not below its starting level) and quantity, and later award it to a
 character. Awarding adds it to what the character holds, exactly as giving it
 on the sheet would. See [ENCOUNTERS.md](ENCOUNTERS.md).
 
+The DM can also put a weapon **up for sale**, at a level, a price (in gold,
+silver, copper or cash) and an optional stock. An NPC can sell it, wherever
+that NPC is met, or an encounter can sell it itself. Players see what is for
+sale and buy it in an NPC quest that is in progress: the price leaves their
+purse and the weapon joins what they hold, unequipped. See
+[NPCS.md](NPCS.md), section 5, and [ENCOUNTERS.md](ENCOUNTERS.md), section 10.
+
 ## 10. Permissions
 
 | Action | DM | Owning player | Other players |
 |---|---|---|---|
-| See the pool and the library | Yes | Yes | Yes |
+| See the pool | Yes | Only what their own character holds, plus the starting options while they have a character to build | The same, for their own character |
+| See the built-in library | Yes | No | No |
 | Add, change or remove pool entries | Yes | No | No |
 | Give a weapon from the pool, or take one away | Yes | No | No |
 | Give a held weapon to another character | Yes | Yes | No |
+| Put a weapon up for sale | Yes | No | No |
+| Buy a weapon that is for sale, in a quest in progress | Yes, for any character in it | Yes, if the character is in it | No |
 | Change a held weapon's level or quantity | Yes | No | No |
 | Equip or unequip | Yes | Yes, if the character can use it | No |
 | See a character's weapons | Yes | Yes | Yes |
@@ -207,74 +268,86 @@ on the sheet would. See [ENCOUNTERS.md](ENCOUNTERS.md).
 ## 11. What is not modelled
 
 - Weapon proficiency by class (everyone is proficient with everything)
-- Properties: two-handed, versatile, light, reach, loading, thrown
+- Properties: two-handed, versatile, light, reach, loading, thrown (a
+  two-handed weapon counts as one thing equipped, like any other)
 - Range and ammunition
 - Critical hits, advantage, and rolling the attack itself (use the dice roller)
-- Magic bonuses such as +1 weapons (use a higher level or growth instead)
-- Price and weight
+- Magic bonuses to a weapon's own attack or damage, such as +1 weapons (use a
+  higher level or growth instead)
+- A price on the weapon itself (a price is set each time it is put up for sale), and weight
 
 ## 12. The complete weapon library
 
 Every weapon "📚 From Library" offers. Base damage is the damage at level 1.
 Properties and range are carried into the campaign but not shown or used.
+"While equipped" is the weapon's effects and note, which are carried in too.
 
 This list is written from the app's own data by `npm run docs:lists` (in `/backend`). Re-run it after changing the data; do not edit the list by hand.
 
 <!-- BEGIN GENERATED: weapon-library -->
 ### Simple Melee (10)
 
-| Weapon | Base damage | Type | Attacks with | Properties | Range |
-|---|---|---|---|---|---|
-| Club | 1d4 | bludgeoning | Strength | light | — |
-| Dagger | 1d4 | piercing | Strength or Dexterity (finesse) | finesse, light, thrown | 20/60 ft |
-| Greatclub | 1d8 | bludgeoning | Strength | two-handed | — |
-| Handaxe | 1d6 | slashing | Strength | light, thrown | 20/60 ft |
-| Javelin | 1d6 | piercing | Strength | thrown | 30/120 ft |
-| Light Hammer | 1d4 | bludgeoning | Strength | light, thrown | 20/60 ft |
-| Mace | 1d6 | bludgeoning | Strength | — | — |
-| Quarterstaff | 1d6 | bludgeoning | Strength | versatile (1d8) | — |
-| Sickle | 1d4 | slashing | Strength | light | — |
-| Spear | 1d6 | piercing | Strength | thrown, versatile (1d8) | 20/60 ft |
+| Weapon | Base damage | Type | Attacks with | Properties | Range | While equipped |
+|---|---|---|---|---|---|---|
+| Club | 1d4 | bludgeoning | Strength | light | — | — |
+| Dagger | 1d4 | piercing | Strength or Dexterity (finesse) | finesse, light, thrown | 20/60 ft | — |
+| Greatclub | 1d8 | bludgeoning | Strength | two-handed | — | — |
+| Handaxe | 1d6 | slashing | Strength | light, thrown | 20/60 ft | — |
+| Javelin | 1d6 | piercing | Strength | thrown | 30/120 ft | — |
+| Light Hammer | 1d4 | bludgeoning | Strength | light, thrown | 20/60 ft | — |
+| Mace | 1d6 | bludgeoning | Strength | — | — | — |
+| Quarterstaff | 1d6 | bludgeoning | Strength | versatile (1d8) | — | — |
+| Sickle | 1d4 | slashing | Strength | light | — | — |
+| Spear | 1d6 | piercing | Strength | thrown, versatile (1d8) | 20/60 ft | — |
 
 ### Simple Ranged (4)
 
-| Weapon | Base damage | Type | Attacks with | Properties | Range |
-|---|---|---|---|---|---|
-| Light Crossbow | 1d8 | piercing | Dexterity | ammunition, loading, two-handed | 80/320 ft |
-| Dart | 1d4 | piercing | Strength or Dexterity (finesse) | finesse, thrown | 20/60 ft |
-| Shortbow | 1d6 | piercing | Dexterity | ammunition, two-handed | 80/320 ft |
-| Sling | 1d4 | bludgeoning | Dexterity | ammunition | 30/120 ft |
+| Weapon | Base damage | Type | Attacks with | Properties | Range | While equipped |
+|---|---|---|---|---|---|---|
+| Light Crossbow | 1d8 | piercing | Dexterity | ammunition, loading, two-handed | 80/320 ft | — |
+| Dart | 1d4 | piercing | Strength or Dexterity (finesse) | finesse, thrown | 20/60 ft | — |
+| Shortbow | 1d6 | piercing | Dexterity | ammunition, two-handed | 80/320 ft | — |
+| Sling | 1d4 | bludgeoning | Dexterity | ammunition | 30/120 ft | — |
 
 ### Martial Melee (18)
 
-| Weapon | Base damage | Type | Attacks with | Properties | Range |
-|---|---|---|---|---|---|
-| Battleaxe | 1d8 | slashing | Strength | versatile (1d10) | — |
-| Flail | 1d8 | bludgeoning | Strength | — | — |
-| Glaive | 1d10 | slashing | Strength | heavy, reach, two-handed | — |
-| Greataxe | 1d12 | slashing | Strength | heavy, two-handed | — |
-| Greatsword | 2d6 | slashing | Strength | heavy, two-handed | — |
-| Halberd | 1d10 | slashing | Strength | heavy, reach, two-handed | — |
-| Lance | 1d12 | piercing | Strength | reach, special | — |
-| Longsword | 1d8 | slashing | Strength | versatile (1d10) | — |
-| Maul | 2d6 | bludgeoning | Strength | heavy, two-handed | — |
-| Morningstar | 1d8 | piercing | Strength | — | — |
-| Pike | 1d10 | piercing | Strength | heavy, reach, two-handed | — |
-| Rapier | 1d8 | piercing | Strength or Dexterity (finesse) | finesse | — |
-| Scimitar | 1d6 | slashing | Strength or Dexterity (finesse) | finesse, light | — |
-| Shortsword | 1d6 | piercing | Strength or Dexterity (finesse) | finesse, light | — |
-| Trident | 1d6 | piercing | Strength | thrown, versatile (1d8) | 20/60 ft |
-| War Pick | 1d8 | piercing | Strength | — | — |
-| Warhammer | 1d8 | bludgeoning | Strength | versatile (1d10) | — |
-| Whip | 1d4 | slashing | Strength or Dexterity (finesse) | finesse, reach | — |
+| Weapon | Base damage | Type | Attacks with | Properties | Range | While equipped |
+|---|---|---|---|---|---|---|
+| Battleaxe | 1d8 | slashing | Strength | versatile (1d10) | — | — |
+| Flail | 1d8 | bludgeoning | Strength | — | — | — |
+| Glaive | 1d10 | slashing | Strength | heavy, reach, two-handed | — | — |
+| Greataxe | 1d12 | slashing | Strength | heavy, two-handed | — | — |
+| Greatsword | 2d6 | slashing | Strength | heavy, two-handed | — | — |
+| Halberd | 1d10 | slashing | Strength | heavy, reach, two-handed | — | — |
+| Lance | 1d12 | piercing | Strength | reach, special | — | — |
+| Longsword | 1d8 | slashing | Strength | versatile (1d10) | — | — |
+| Maul | 2d6 | bludgeoning | Strength | heavy, two-handed | — | — |
+| Morningstar | 1d8 | piercing | Strength | — | — | — |
+| Pike | 1d10 | piercing | Strength | heavy, reach, two-handed | — | — |
+| Rapier | 1d8 | piercing | Strength or Dexterity (finesse) | finesse | — | — |
+| Scimitar | 1d6 | slashing | Strength or Dexterity (finesse) | finesse, light | — | — |
+| Shortsword | 1d6 | piercing | Strength or Dexterity (finesse) | finesse, light | — | — |
+| Trident | 1d6 | piercing | Strength | thrown, versatile (1d8) | 20/60 ft | — |
+| War Pick | 1d8 | piercing | Strength | — | — | — |
+| Warhammer | 1d8 | bludgeoning | Strength | versatile (1d10) | — | — |
+| Whip | 1d4 | slashing | Strength or Dexterity (finesse) | finesse, reach | — | — |
 
 ### Martial Ranged (5)
 
-| Weapon | Base damage | Type | Attacks with | Properties | Range |
-|---|---|---|---|---|---|
-| Blowgun | 1 | piercing | Dexterity | ammunition, loading | 25/100 ft |
-| Hand Crossbow | 1d6 | piercing | Dexterity | ammunition, light, loading | 30/120 ft |
-| Heavy Crossbow | 1d10 | piercing | Dexterity | ammunition, heavy, loading, two-handed | 100/400 ft |
-| Longbow | 1d8 | piercing | Dexterity | ammunition, heavy, two-handed | 150/600 ft |
-| Net | - | special | Dexterity | special, thrown | 5/15 ft |
+| Weapon | Base damage | Type | Attacks with | Properties | Range | While equipped |
+|---|---|---|---|---|---|---|
+| Blowgun | 1 | piercing | Dexterity | ammunition, loading | 25/100 ft | — |
+| Hand Crossbow | 1d6 | piercing | Dexterity | ammunition, light, loading | 30/120 ft | — |
+| Heavy Crossbow | 1d10 | piercing | Dexterity | ammunition, heavy, loading, two-handed | 100/400 ft | — |
+| Longbow | 1d8 | piercing | Dexterity | ammunition, heavy, two-handed | 150/600 ft | — |
+| Net | - | special | Dexterity | special, thrown | 5/15 ft | — |
+
+### Paired (4)
+
+| Weapon | Base damage | Type | Attacks with | Properties | Range | While equipped |
+|---|---|---|---|---|---|---|
+| Paired Daggers | 2d4 | piercing | Strength or Dexterity (finesse) | finesse, light, paired | — | A dagger in each hand: takes both hands. |
+| Paired Shortswords | 2d6 | piercing | Strength or Dexterity (finesse) | finesse, light, paired | — | A shortsword in each hand: takes both hands. |
+| Paired Scimitars | 2d6 | slashing | Strength or Dexterity (finesse) | finesse, light, paired | — | A scimitar in each hand: takes both hands. |
+| Paired Handaxes | 2d6 | slashing | Strength | light, paired | — | A handaxe in each hand: takes both hands. |
 <!-- END GENERATED: weapon-library -->

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "0.0.0",
+  "version": "1.14.0",
   "type": "module",
   "scripts": {
     "dev": "vite",
@@ -18,12 +18,14 @@
     "socket.io-client": "^4.8.3"
   },
   "devDependencies": {
+    "@types/compression": "^1.8.1",
     "@types/node": "^24.13.3",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.7",
     "@vitejs/plugin-react": "^6.1.1",
+    "compression": "^1.8.2",
     "oxlint": "^1.81.0",
-    "typescript": "~6.0.2",
+    "typescript": "~7.0.2",
     "vite": "^8.3.0"
   }
 }

frontend/src/App.tsx

@@ -1,35 +1,41 @@
+import { lazy, Suspense } from 'react';
 import { Navigate, Route, Routes } from 'react-router-dom';
 import { Layout } from './components/Layout';
 import { ProtectedRoute } from './components/ProtectedRoute';
 import { LoginPage } from './pages/LoginPage';
-import { RegisterPage } from './pages/RegisterPage';
-import { CampaignListPage } from './pages/CampaignListPage';
-import { CampaignHomePage } from './pages/CampaignHomePage';
-import { PartyOverviewPage } from './pages/PartyOverviewPage';
-import { CharacterSheetPage } from './pages/CharacterSheetPage';
-import { CharacterBuilderPage } from './pages/CharacterBuilderPage';
-import { EncounterPage } from './pages/EncounterPage';
-import { AccountPage } from './pages/AccountPage';
+
+// Each page is its own file to download, fetched the first time it is opened,
+// so signing in does not wait on the encounter tracker or the character builder.
+const RegisterPage = lazy(() => import('./pages/RegisterPage').then((m) => ({ default: m.RegisterPage })));
+const CampaignListPage = lazy(() => import('./pages/CampaignListPage').then((m) => ({ default: m.CampaignListPage })));
+const CampaignHomePage = lazy(() => import('./pages/CampaignHomePage').then((m) => ({ default: m.CampaignHomePage })));
+const PartyOverviewPage = lazy(() => import('./pages/PartyOverviewPage').then((m) => ({ default: m.PartyOverviewPage })));
+const CharacterSheetPage = lazy(() => import('./pages/CharacterSheetPage').then((m) => ({ default: m.CharacterSheetPage })));
+const CharacterBuilderPage = lazy(() => import('./pages/CharacterBuilderPage').then((m) => ({ default: m.CharacterBuilderPage })));
+const EncounterPage = lazy(() => import('./pages/EncounterPage').then((m) => ({ default: m.EncounterPage })));
+const AccountPage = lazy(() => import('./pages/AccountPage').then((m) => ({ default: m.AccountPage })));
 
 function App() {
   return (
-    <Routes>
-      <Route path="/login" element={<LoginPage />} />
-      <Route path="/register" element={<RegisterPage />} />
-      <Route element={<ProtectedRoute />}>
-        <Route element={<Layout />}>
-          <Route path="/" element={<Navigate to="/campaigns" replace />} />
-          <Route path="/campaigns" element={<CampaignListPage />} />
-          <Route path="/campaigns/:campaignId" element={<CampaignHomePage />} />
-          <Route path="/campaigns/:campaignId/party" element={<PartyOverviewPage />} />
-          <Route path="/characters/:characterId" element={<CharacterSheetPage />} />
-          <Route path="/characters/:characterId/build" element={<CharacterBuilderPage />} />
-          <Route path="/encounters/:encounterId" element={<EncounterPage />} />
-          <Route path="/account" element={<AccountPage />} />
+    <Suspense fallback={null}>
+      <Routes>
+        <Route path="/login" element={<LoginPage />} />
+        <Route path="/register" element={<RegisterPage />} />
+        <Route element={<ProtectedRoute />}>
+          <Route element={<Layout />}>
+            <Route path="/" element={<Navigate to="/campaigns" replace />} />
+            <Route path="/campaigns" element={<CampaignListPage />} />
+            <Route path="/campaigns/:campaignId" element={<CampaignHomePage />} />
+            <Route path="/campaigns/:campaignId/party" element={<PartyOverviewPage />} />
+            <Route path="/characters/:characterId" element={<CharacterSheetPage />} />
+            <Route path="/characters/:characterId/build" element={<CharacterBuilderPage />} />
+            <Route path="/encounters/:encounterId" element={<EncounterPage />} />
+            <Route path="/account" element={<AccountPage />} />
+          </Route>
         </Route>
-      </Route>
-      <Route path="*" element={<Navigate to="/" replace />} />
-    </Routes>
+        <Route path="*" element={<Navigate to="/" replace />} />
+      </Routes>
+    </Suspense>
   );
 }
 

frontend/src/api/queries.ts

@@ -1,4 +1,4 @@
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useMutation, useQuery, useQueryClient, type QueryClient } from '@tanstack/react-query';
 import { apiClient } from './client';
 import type {
   BuildOptions,
@@ -7,17 +7,23 @@ import type {
   CampaignMemberSummary,
   CharacterDetail,
   CharacterSummary,
+  Currency,
   DiceMode,
   Encounter,
   EncounterMode,
   EncounterParticipant,
+  GearEffect,
   GoldTransaction,
   Item,
+  LevelUpPlan,
   Location,
   Monster,
   Note,
   Npc,
+  SaleOffer,
   QuickStats,
+  RestResult,
+  RestType,
   Spell,
   Weapon,
 } from './types';
@@ -59,6 +65,16 @@ export function useCreateCampaign() {
   });
 }
 
+// A ready-made world (a seed file on the server) as a new campaign, by its code.
+export function useCreateCampaignFromSeed() {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (code: string) =>
+      (await apiClient.post<{ campaign: Campaign }>('/campaigns/from-seed', { code })).data.campaign,
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['campaigns'] }),
+  });
+}
+
 export function useUpdateCampaign(campaignId: string) {
   const qc = useQueryClient();
   return useMutation({
@@ -153,7 +169,7 @@ export function useCharacter(characterId: string | undefined) {
 export function usePatchCharacter(characterId: string) {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: async (data: Partial<Omit<CharacterDetail, 'gold'>>) =>
+    mutationFn: async (data: Partial<Omit<CharacterDetail, 'gold'>> & { hitDiceUsed?: number }) =>
       (await apiClient.patch<{ character: CharacterDetail }>(`/characters/${characterId}`, data)).data.character,
     onSuccess: (character) => {
       qc.setQueryData(['character', characterId], character);
@@ -162,6 +178,84 @@ export function usePatchCharacter(characterId: string) {
   });
 }
 
+// What can be done for a character at 0 HP: enter a death save (what the d20
+// showed), steady them, or — the DM only — set the tallies by hand or bring
+// back the dead.
+export type DeathSaveAction =
+  | { action: 'roll'; roll: number }
+  | { action: 'stabilize' }
+  | { action: 'set'; successes: number; failures: number }
+  | { action: 'revive' };
+
+export function useDeathSave(characterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: DeathSaveAction) =>
+      (await apiClient.post<{ character: CharacterDetail }>(`/characters/${characterId}/death-saves`, data)).data.character,
+    onSuccess: (character) => {
+      invalidateCharacter(qc, characterId); // the sheet and its quick stats
+      qc.invalidateQueries({ queryKey: ['encounter'] }); // a character combatant shows the sheet's HP
+      qc.invalidateQueries({ queryKey: ['campaign', character.campaignId, 'characters'] });
+    },
+  });
+}
+
+// The slot tracker. Spending a slot is the player's (or the DM's); setting how
+// many are spent, and giving them all back, are the DM's alone.
+export type SpellSlotAction = { action: 'use'; level: number } | { action: 'set'; level: number; used: number } | { action: 'restore' };
+
+export function useSpellSlots(characterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: SpellSlotAction) =>
+      (await apiClient.post<{ character: CharacterDetail }>(`/characters/${characterId}/spell-slots`, data)).data.character,
+    onSuccess: (character) => {
+      invalidateCharacter(qc, characterId); // the sheet and its quick stats
+      qc.invalidateQueries({ queryKey: ['campaign', character.campaignId, 'characters'] });
+    },
+  });
+}
+
+// What a character's next level brings. DM only.
+export function useLevelUpPlan(characterId: string, enabled: boolean) {
+  return useQuery({
+    queryKey: ['character', characterId, 'level-up'],
+    enabled,
+    gcTime: 0, // never open on the plan for a level the character has already reached
+    queryFn: async () => (await apiClient.get<{ plan: LevelUpPlan }>(`/characters/${characterId}/level-up`)).data.plan,
+  });
+}
+
+// Takes the character up one level, with the choices that go with it.
+export function useLevelUp(characterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: { boon?: string; weaponId?: string | null; spellIds?: string[] }) =>
+      (await apiClient.post<{ character: CharacterDetail }>(`/characters/${characterId}/level-up`, data)).data.character,
+    onSuccess: (character) => {
+      invalidateCharacter(qc, characterId);
+      qc.invalidateQueries({ queryKey: ['encounter'] }); // a character combatant shows the sheet's HP
+      qc.invalidateQueries({ queryKey: ['campaign', character.campaignId, 'characters'] });
+    },
+  });
+}
+
+// A short or long rest for any of the party at once. On a short rest each
+// character spends `hitDice` Hit Dice; `rolled` is what they added up to at
+// the table, and left out the site rolls them.
+export function useRest(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: { type: RestType; characters: { characterId: string; hitDice?: number; rolled?: number | null }[] }) =>
+      (await apiClient.post<{ type: RestType; results: RestResult[] }>(`/campaigns/${campaignId}/rest`, data)).data,
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['character'] });
+      qc.invalidateQueries({ queryKey: ['encounter'] });
+      qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'characters'] });
+    },
+  });
+}
+
 export function useDeleteCharacter(campaignId: string) {
   const qc = useQueryClient();
   return useMutation({
@@ -172,7 +266,7 @@ export function useDeleteCharacter(campaignId: string) {
 
 // What one character can hand to another. Whatever is given leaves the giver.
 export type Gift =
-  | { kind: 'gold'; amount: number }
+  | { kind: 'gold'; amount: number; currency?: Currency }
   | { kind: 'weapon' | 'item'; id: string; quantity: number }
   | { kind: 'spell'; id: string };
 
@@ -211,6 +305,16 @@ export function useQuickStats(characterId: string | undefined, enabled: boolean)
   });
 }
 
+// Changes `amount` coins of one kind into another at their fixed worth.
+export function useExchangeCoins(characterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: { from: Currency; to: Currency; amount: number }) =>
+      (await apiClient.post<{ character: CharacterDetail; received: number }>(`/characters/${characterId}/gold/exchange`, data)).data,
+    onSuccess: () => invalidateCharacter(qc, characterId),
+  });
+}
+
 // --------------------------------------------------------------------------
 // Character build flow
 // --------------------------------------------------------------------------
@@ -373,10 +477,11 @@ export function useRemoveCharacterSpell(characterId: string) {
 // Money tracker
 // --------------------------------------------------------------------------
 
-export function useGoldLedger(characterId: string | undefined) {
+// Only the character's own player and the DM may read it.
+export function useGoldLedger(characterId: string | undefined, enabled = true) {
   return useQuery({
     queryKey: ['character', characterId, 'gold'],
-    enabled: Boolean(characterId),
+    enabled: Boolean(characterId) && enabled,
     queryFn: async () =>
       (await apiClient.get<{ gold: number; transactions: GoldTransaction[] }>(`/characters/${characterId}/gold`)).data
         .transactions,
@@ -387,8 +492,8 @@ export function useGoldLedger(characterId: string | undefined) {
 export function useAdjustGold(characterId: string) {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: async (data: { amount: number; reason?: string }) =>
-      (await apiClient.post<{ gold: number; transaction: GoldTransaction }>(`/characters/${characterId}/gold`, data)).data,
+    mutationFn: async (data: { amount: number; currency?: Currency; reason?: string }) =>
+      (await apiClient.post<{ transaction: GoldTransaction }>(`/characters/${characterId}/gold`, data)).data,
     onSuccess: () => invalidateCharacter(qc, characterId), // prefix match also refreshes the ledger
   });
 }
@@ -429,12 +534,22 @@ export function usePatchPoolEntry(campaignId: string, pool: Pool) {
       isStartingOption?: boolean;
       damageDice?: string | null;
       damageScaling?: number;
+      revives?: boolean;
       minLevel?: number;
       name?: string;
       description?: string | null;
+      exchangeGold?: number | null;
+      exchangeCash?: number | null;
+      effects?: GearEffect[];
+      effectNote?: string | null;
     }) =>
       (await apiClient.patch(`/campaigns/${campaignId}/${pool}/${id}`, data)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['campaign', campaignId, pool] }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['campaign', campaignId, pool] });
+      // What an entry does while equipped changes the sheet of whoever holds it.
+      qc.invalidateQueries({ queryKey: ['character'] });
+      qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'characters'] });
+    },
   });
 }
 
@@ -502,6 +617,20 @@ export function useCreateMonster(campaignId: string) {
   });
 }
 
+// Changes a monster's stat block. Encounters read it live, so copies already
+// in a scene show the new numbers (their HP stays as it was).
+export function useUpdateMonster(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ id, ...data }: { id: string } & Partial<Omit<Monster, 'id' | 'campaignId'>>) =>
+      (await apiClient.patch<{ monster: Monster }>(`/campaigns/${campaignId}/monsters/${id}`, data)).data.monster,
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'monsters'] });
+      qc.invalidateQueries({ queryKey: ['encounter'] });
+    },
+  });
+}
+
 export function useDeleteMonster(campaignId: string) {
   const qc = useQueryClient();
   return useMutation({
@@ -514,10 +643,10 @@ export function useDeleteMonster(campaignId: string) {
 // Default content library — search/browse, "add to campaign"
 // --------------------------------------------------------------------------
 
-export function useCampaignLibrary(campaignId: string | undefined) {
+export function useCampaignLibrary(campaignId: string | undefined, enabled = true) {
   return useQuery({
     queryKey: ['campaign', campaignId, 'library'],
-    enabled: Boolean(campaignId),
+    enabled: Boolean(campaignId) && enabled, // DM only
     staleTime: Infinity, // static reference data — never changes under a campaign
     queryFn: async () => (await apiClient.get<CampaignLibrary>(`/campaigns/${campaignId}/library`)).data,
   });
@@ -533,6 +662,14 @@ export function useAddWeaponFromLibrary(campaignId: string) {
   });
 }
 
+export function useAddItemFromLibrary(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (key: string) => (await apiClient.post<{ item: Item }>(`/campaigns/${campaignId}/items/from-library`, { key })).data.item,
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'items'] }),
+  });
+}
+
 export function useAddSpellFromLibrary(campaignId: string) {
   const qc = useQueryClient();
   return useMutation({
@@ -657,12 +794,21 @@ export function useEncounter(encounterId: string | undefined) {
   });
 }
 
+// Every change to an encounter is answered with the encounter as this viewer
+// sees it, so the cache takes that as it is: no second request for what just
+// came back.
+function keepEncounter(qc: QueryClient, encounterId: string, data: unknown) {
+  const encounter = (data as { encounter?: Encounter } | undefined)?.encounter;
+  if (encounter) qc.setQueryData(['encounter', encounterId], encounter);
+  else qc.invalidateQueries({ queryKey: ['encounter', encounterId] });
+}
+
 export function useAddParticipant(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: async (data: { characterId?: string; monsterId?: string; npcId?: string; displayName?: string; initiative?: number }) =>
+    mutationFn: async (data: { characterId?: string; monsterId?: string; npcId?: string; displayName?: string; initiativeRoll?: number }) =>
       (await apiClient.post(`/encounters/${encounterId}/participants`, data)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -671,7 +817,7 @@ export function usePatchParticipant(encounterId: string) {
   return useMutation({
     mutationFn: async ({ participantId, ...data }: Partial<EncounterParticipant> & { participantId: string }) =>
       (await apiClient.patch(`/encounters/${encounterId}/participants/${participantId}`, data)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -679,8 +825,8 @@ export function useRemoveParticipant(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: async (participantId: string) =>
-      apiClient.delete(`/encounters/${encounterId}/participants/${participantId}`),
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+      (await apiClient.delete(`/encounters/${encounterId}/participants/${participantId}`)).data,
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -688,7 +834,7 @@ export function useAdvanceRound(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: async () => (await apiClient.post(`/encounters/${encounterId}/advance-round`)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -701,21 +847,49 @@ export function usePatchEncounter(encounterId: string) {
       name?: string;
       description?: string | null;
       dmNotes?: string | null;
+      locationId?: string | null;
     }) => (await apiClient.patch(`/encounters/${encounterId}`, data)).data,
-    onSuccess: (_data, variables) => {
-      qc.invalidateQueries({ queryKey: ['encounter', encounterId] });
-      // The campaign page lists encounters by name, mode and status.
-      if (variables.status || variables.mode || variables.name) qc.invalidateQueries({ queryKey: ['campaign'] });
+    onSuccess: (data, variables) => {
+      keepEncounter(qc, encounterId, data);
+      // The campaign page lists encounters by name, mode and status, and an
+      // encounter in progress carries its characters to its location.
+      if (variables.status || variables.mode || variables.name || variables.locationId !== undefined) {
+        qc.invalidateQueries({ queryKey: ['campaign'] });
+        qc.invalidateQueries({ queryKey: ['character'] });
+      }
     },
   });
 }
 type EncounterStatusInput = 'PLANNING' | 'ACTIVE' | 'COMPLETE';
 
+// Sets which combatants are marked as targets (an empty list clears them).
+// The DM at any time; a player while their own character is on turn.
+export function useSetTargets(encounterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (participantIds: string[]) => (await apiClient.put(`/encounters/${encounterId}/targets`, { participantIds })).data,
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
+  });
+}
+
+// The character on turn trying to bring a dead ally back; the server decides
+// whether they have the means.
+export function useReviveParticipant(encounterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (participantId: string) => (await apiClient.post(`/encounters/${encounterId}/participants/${participantId}/revive`)).data,
+    onSuccess: (data) => {
+      keepEncounter(qc, encounterId, data);
+      qc.invalidateQueries({ queryKey: ['character'] }); // the revived character's sheet
+    },
+  });
+}
+
 export function useNextTurn(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: async () => (await apiClient.post(`/encounters/${encounterId}/next-turn`)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -724,7 +898,7 @@ export function useNextTurn(encounterId: string) {
 // --------------------------------------------------------------------------
 
 export type NewReward =
-  | { type: 'GOLD'; gold: number; note?: string }
+  | { type: 'GOLD'; gold: number; currency?: Currency; note?: string }
   | { type: 'WEAPON'; weaponId: string; quantity?: number; level?: number; note?: string }
   | { type: 'ITEM'; itemId: string; quantity?: number; level?: number; note?: string };
 
@@ -732,15 +906,15 @@ export function useAddReward(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
     mutationFn: async (data: NewReward) => (await apiClient.post(`/encounters/${encounterId}/rewards`, data)).data,
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
 export function useDeleteReward(encounterId: string) {
   const qc = useQueryClient();
   return useMutation({
-    mutationFn: async (rewardId: string) => apiClient.delete(`/encounters/${encounterId}/rewards/${rewardId}`),
-    onSuccess: () => qc.invalidateQueries({ queryKey: ['encounter', encounterId] }),
+    mutationFn: async (rewardId: string) => (await apiClient.delete(`/encounters/${encounterId}/rewards/${rewardId}`)).data,
+    onSuccess: (data) => keepEncounter(qc, encounterId, data),
   });
 }
 
@@ -751,8 +925,8 @@ export function useAwardReward(encounterId: string) {
   return useMutation({
     mutationFn: async ({ rewardId, ...target }: { rewardId: string } & ({ characterId: string } | { split: true })) =>
       (await apiClient.post(`/encounters/${encounterId}/rewards/${rewardId}/award`, target)).data,
-    onSuccess: () => {
-      qc.invalidateQueries({ queryKey: ['encounter', encounterId] });
+    onSuccess: (data) => {
+      keepEncounter(qc, encounterId, data);
       qc.invalidateQueries({ queryKey: ['character'] });
       qc.invalidateQueries({ queryKey: ['campaign'] });
     },
@@ -780,6 +954,72 @@ export function useCreateNpc(campaignId: string) {
   });
 }
 
+// --------------------------------------------------------------------------
+// Trade — an NPC's exchange rate and wares are set up by the DM; in a quest
+// in progress, characters in the scene change money and buy
+// --------------------------------------------------------------------------
+
+export type NewWare = ({ npcId: string } | { encounterId: string }) &
+  ({ weaponId: string } | { itemId: string }) & { price: number; currency: Currency; level?: number; stock: number | null };
+
+// Wares reach the screen inside the NPC list and inside each encounter.
+function invalidateWares(qc: QueryClient, campaignId: string) {
+  qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'npcs'] });
+  qc.invalidateQueries({ queryKey: ['encounter'] });
+}
+
+export function useCreateWare(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: NewWare) => (await apiClient.post<{ ware: SaleOffer }>(`/campaigns/${campaignId}/wares`, data)).data.ware,
+    onSuccess: () => invalidateWares(qc, campaignId),
+  });
+}
+
+// The price and what is left can change; what is sold, and by whom, cannot.
+export function usePatchWare(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ id, ...data }: { id: string; price?: number; currency?: Currency; stock?: number | null }) =>
+      (await apiClient.patch<{ ware: SaleOffer }>(`/campaigns/${campaignId}/wares/${id}`, data)).data.ware,
+    onSuccess: () => invalidateWares(qc, campaignId),
+  });
+}
+
+export function useDeleteWare(campaignId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (wareId: string) => apiClient.delete(`/campaigns/${campaignId}/wares/${wareId}`),
+    onSuccess: () => invalidateWares(qc, campaignId),
+  });
+}
+
+// Both change what a character holds, so the sheet and the party list refresh too.
+function invalidateAfterTrade(qc: QueryClient, encounterId: string, data: unknown) {
+  keepEncounter(qc, encounterId, data);
+  qc.invalidateQueries({ queryKey: ['character'] });
+  qc.invalidateQueries({ queryKey: ['campaign'] });
+}
+
+// Changes gold into cash or cash into gold with an NPC in the scene, at their rate.
+export function useExchangeWithNpc(encounterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async (data: { characterId: string; npcId: string; from: 'GOLD' | 'CASH'; amount: number }) =>
+      (await apiClient.post<{ received: number; currency: Currency }>(`/encounters/${encounterId}/exchange`, data)).data,
+    onSuccess: (data) => invalidateAfterTrade(qc, encounterId, data),
+  });
+}
+
+export function useBuyWare(encounterId: string) {
+  const qc = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ wareId, ...data }: { wareId: string; characterId: string; quantity?: number }) =>
+      (await apiClient.post(`/encounters/${encounterId}/wares/${wareId}/buy`, data)).data,
+    onSuccess: (data) => invalidateAfterTrade(qc, encounterId, data),
+  });
+}
+
 // --------------------------------------------------------------------------
 // Notes
 // --------------------------------------------------------------------------

frontend/src/api/types.ts

@@ -87,11 +87,18 @@ export interface Campaign {
   id: string;
   name: string;
   description: string | null;
-  inviteCode: string;
+  inviteCode?: string; // DM only
   startingGold: number;
   startingItemCount: number;
   startingSpellCount: number;
   skipMotivationRoll: boolean;
+  showMonsterHp: boolean; // off: players get a health bar for monsters and NPCs, no numbers
+  // Added to each target's AC for every target beyond the first in an area attack; 0 is off.
+  areaAttackAcPenalty: number;
+  // How many weapons and items a character can have equipped together, and
+  // how many of those can be weapons. Only equipped gear is used in a fight.
+  maxEquipped: number;
+  maxEquippedWeapons: number;
   ownerId: string;
   archivedAt: string | null; // set while the campaign is archived
   role: 'DM' | 'PLAYER';
@@ -104,6 +111,47 @@ export interface CampaignMemberSummary {
   role: 'DM' | 'PLAYER';
 }
 
+// The coins a character carries. 1 gold = 10 silver = 100 copper.
+export type Coin = 'GOLD' | 'SILVER' | 'COPPER';
+// Coins, plus cash ($): modern money for crossover worlds, with no worth in coins.
+export type Currency = Coin | 'CASH';
+
+// Where a character stands at 0 HP. UP: on their feet. DYING: rolling death
+// saves, three of either kind settles it. STABLE: at 0 HP but no longer
+// rolling. DEAD: three failures, or one blow too big to survive.
+export type LifeState = 'UP' | 'DYING' | 'STABLE' | 'DEAD';
+
+export interface DeathSaves {
+  state: LifeState;
+  successes: number;
+  failures: number;
+}
+
+// One slot level on the slot tracker: how many slots there are, and how many
+// are spent.
+export interface SpellSlotLevel {
+  level: number; // 1 is a 1st-level slot
+  max: number;
+  used: number;
+  remaining: number;
+}
+
+// A character's spell slots, from class and level. A warlock's (PACT) are all
+// of one slot level and come back on a short rest; everyone else's on a long one.
+export interface SpellSlots {
+  kind: 'FULL' | 'HALF' | 'PACT';
+  restoresOn: 'SHORT' | 'LONG';
+  levels: SpellSlotLevel[];
+}
+
+// One Hit Die per level, of the class's size, spent on short rests to heal.
+export interface HitDice {
+  size: number;
+  count: number;
+  used: number;
+  remaining: number;
+}
+
 export interface CharacterSummary {
   id: string;
   campaignId: string;
@@ -117,9 +165,17 @@ export interface CharacterSummary {
   buildStage: BuildStage;
   currentHp: number;
   tempHp: number;
-  gold: number;
+  deathSaves: DeathSaves;
+  // The purse; all four are null for another player's character.
+  gold: number | null;
+  silver: number | null;
+  copper: number | null;
+  cash: number | null;
   maxHp: number | null;
   armorClass: number | null;
+  // What is left before the next rest; both null until the character is built.
+  spellSlots: SpellSlots | null; // also null for a character with no spell slots
+  hitDice: (HitDice & { conModifier: number }) | null; // each die heals its roll plus this
   currentLocationId: string | null;
   currentLocationName: string | null;
 }
@@ -138,6 +194,21 @@ export interface AbilityDetail {
   modifier: number;
 }
 
+// One thing a weapon or item does to whoever has it equipped: a signed amount
+// on one of the sheet's numbers ("AC", "SPEED", "STR", "SAVE_DEX",
+// "SKILL_STEALTH"...). The full list is GEAR_STATS on the server.
+export interface GearEffect {
+  stat: string;
+  amount: number;
+}
+
+// What a character's equipped gear is doing right now. The sheet's numbers
+// already include it; this says where each change comes from.
+export interface ActiveGear {
+  effects: (GearEffect & { source: string })[];
+  notes: { source: string; note: string }[];
+}
+
 export interface CharacterSheet {
   abilities: Record<Ability, AbilityDetail>;
   proficiencyBonus: number;
@@ -145,11 +216,13 @@ export interface CharacterSheet {
   initiative: number;
   speed: number;
   hp: { max: number };
-  hitDice: { size: number; count: number };
+  hitDice: HitDice;
   saves: Record<Ability, { proficient: boolean; bonus: number }>;
   skills: Record<string, { ability: Ability; proficient: boolean; expertise: boolean; bonus: number }>;
   passivePerception: number;
   spellcasting: { ability: Ability; saveDC: number; attackBonus: number } | null;
+  spellSlots: SpellSlots | null; // null for a character with no spell slots
+  gear: ActiveGear;
 }
 
 export interface Weapon {
@@ -168,6 +241,8 @@ export interface Weapon {
   damageScaling: number;
   minLevel: number;
   isStartingOption: boolean;
+  effects: GearEffect[]; // what it does to whoever has it equipped
+  effectNote: string | null; // and what it does that is not a number
 }
 
 export interface CharacterWeapon {
@@ -194,6 +269,7 @@ export interface Spell {
   description: string | null;
   damageDice: string | null;
   isStartingOption: boolean;
+  revives: boolean; // brings back the dead: lets its caster revive a dead ally in a battle
 }
 
 export interface CharacterSpell {
@@ -215,6 +291,8 @@ export interface Item {
   damageScaling: number;
   minLevel: number;
   isStartingOption: boolean;
+  effects: GearEffect[]; // armor is an item with an AC effect
+  effectNote: string | null;
 }
 
 export interface InventoryItem {
@@ -232,8 +310,9 @@ export interface InventoryItem {
 export interface GoldTransaction {
   id: string;
   characterId: string;
+  currency: Currency; // which coin this entry is in
   amount: number; // signed: positive = gained, negative = spent
-  balanceAfter: number;
+  balanceAfter: number; // that coin's balance afterwards
   reason: string | null;
   createdAt: string;
   createdBy: { displayName: string } | null;
@@ -266,6 +345,7 @@ export interface CharacterDetail {
   rolledScores: Record<Ability, number>;
   currentHp: number;
   tempHp: number;
+  deathSaves: DeathSaves;
   armorBonus: number;
   specialAbilities: string | null;
   background: string | null;
@@ -276,7 +356,13 @@ export interface CharacterDetail {
   diceMode: DiceMode;
   currentLocationId: string | null;
   currentLocation: Location | null;
-  gold: number;
+  gold: number | null;
+  silver: number | null;
+  copper: number | null;
+  cash: number | null;
+  // True when this is another player's character: no gold, inventory or
+  // location is sent, only what the party can see across the table.
+  restricted: boolean;
   buildStage: BuildStage;
   buildState: Record<string, unknown> | null;
   skillProficiencies: SkillProficiency[];
@@ -311,6 +397,23 @@ export type EncounterStatus = 'PLANNING' | 'ACTIVE' | 'COMPLETE';
 export type EncounterMode = 'BATTLE' | 'QUEST';
 export type NpcDisposition = 'FRIENDLY' | 'NEUTRAL' | 'HOSTILE';
 
+// Something for sale: a weapon or item from the campaign pools, at a price.
+// It is an NPC's (on offer wherever they are met) or an encounter's own.
+export interface SaleOffer {
+  id: string;
+  campaignId: string;
+  npcId: string | null;
+  encounterId: string | null;
+  weaponId: string | null;
+  itemId: string | null;
+  price: number; // for one, in `currency`
+  currency: Currency;
+  level: number; // the gear level it is handed over at
+  stock: number | null; // how many are left; null is no limit
+  weapon: Weapon | null;
+  item: Item | null;
+}
+
 // What players see of an NPC in an encounter.
 export interface NpcPublic {
   id: string;
@@ -318,6 +421,11 @@ export interface NpcPublic {
   role: string | null;
   disposition: NpcDisposition;
   description: string | null;
+  // A money changer's rate: exchangeGold gold for exchangeCash cash, either
+  // way. Both null for an NPC who does not change money.
+  exchangeGold: number | null;
+  exchangeCash: number | null;
+  wares?: SaleOffer[]; // what they have for sale
 }
 
 // The DM's full record. dmNotes and the combat stats never reach a player.
@@ -333,7 +441,8 @@ export interface EncounterReward {
   id: string;
   encounterId: string;
   type: 'GOLD' | 'WEAPON' | 'ITEM';
-  gold: number | null;
+  gold: number | null; // for a GOLD reward: how many coins...
+  currency: Currency; // ...and which coin
   weaponId: string | null;
   itemId: string | null;
   quantity: number;
@@ -357,6 +466,15 @@ export interface CombatWeapon {
   damageType: string;
 }
 
+// An item a character has equipped, as everyone in an encounter sees it.
+export interface CombatItem {
+  inventoryItemId: string;
+  name: string;
+  level: number;
+  quantity: number;
+  damageDice: string | null;
+}
+
 export interface CombatSpell {
   characterSpellId: string;
   name: string;
@@ -372,6 +490,8 @@ export interface CharacterCombatInfo {
   characterClass: CharacterClass | null;
   armorClass: number;
   tempHp: number;
+  deathSaves: DeathSaves;
+  canRevive: boolean; // has a spell that brings back the dead, at a level they can cast
   speed: number;
   initiativeBonus: number;
   passivePerception: number;
@@ -379,7 +499,9 @@ export interface CharacterCombatInfo {
   abilities: Record<Ability, AbilityDetail>;
   saves: Record<Ability, { proficient: boolean; bonus: number }>;
   specialAbilities: string | null;
-  weapons: CombatWeapon[];
+  gear: ActiveGear;
+  weapons: CombatWeapon[]; // the equipped ones: a weapon has to be in hand to be used
+  items: CombatItem[]; // likewise
   spells: CombatSpell[];
   spellcasting: { ability: Ability; saveDC: number; attackBonus: number } | null;
 }
@@ -390,14 +512,24 @@ export interface EncounterParticipant {
   characterId: string | null;
   monsterId: string | null;
   displayName: string;
+  // The d20 rolled for initiative (1–20), null until rolled. `initiative` is
+  // that roll plus the combatant's bonus, and is what the order sorts on.
+  initiativeRoll: number | null;
   initiative: number;
-  currentHp: number;
-  maxHp: number;
+  initiativeBonus?: number; // a monster's or NPC's is sent to the DM only
+  // Null for a player when the campaign hides monster hit points; hpPercent
+  // (0–100) is sent in their place to draw the health bar.
+  currentHp: number | null;
+  maxHp: number | null;
+  hpPercent?: number | null;
   conditions: string[];
   isMonster: boolean;
   kind: 'CHARACTER' | 'MONSTER' | 'NPC';
+  // Out of the fight (a dead character, or a monster or NPC at 0 HP) and so
+  // hidden from the players. Only the DM is ever sent one of these.
+  hidden: boolean;
   npcId: string | null;
-  character?: { id: string; name: string } | null;
+  character?: { id: string; name: string; userId: string | null } | null;
   // The DM gets the whole stat block; players only the id and name.
   monster?: ({ id: string; name: string } & Partial<Monster>) | null;
   npc?: (NpcPublic & Partial<Npc>) | null;
@@ -412,13 +544,23 @@ export interface Encounter {
   status: EncounterStatus;
   currentRound: number;
   activeParticipantId: string | null;
+  // The combatants marked as targets right now, for everyone to see, in the
+  // order they were picked. More than one is an area attack.
+  targetParticipantIds: string[];
   description: string | null;
   dmNotes?: string | null; // DM only
+  // Where the scene is. A player is only told once their character has been there.
+  locationId: string | null;
+  location?: Pick<Location, 'id' | 'name' | 'description'> | null;
   archivedAt: string | null; // archived encounters only reach the DM's list
   sortOrder: number; // place in the campaign's own order, lowest first
   createdAt: string;
-  participants?: EncounterParticipant[];
+  participants?: EncounterParticipant[]; // a player's list leaves out the fallen
+  // The dead characters in the scene. Players do not get their cards, only
+  // this, so that an ally can try to revive them.
+  fallen?: { participantId: string; characterId: string; name: string }[];
   rewards?: EncounterReward[]; // players only receive the awarded ones
+  wares?: SaleOffer[]; // for sale at the scene itself, not by an NPC in it
 }
 
 export interface Note {
@@ -442,6 +584,18 @@ export interface LibraryWeapon {
   properties: string[];
   rangeNormal: number | null;
   rangeLong: number | null;
+  effects?: GearEffect[];
+  effectNote?: string | null;
+}
+
+export interface LibraryItem {
+  key: string;
+  name: string;
+  category: string;
+  description: string | null;
+  damageDice: string | null;
+  effects: GearEffect[];
+  effectNote: string | null;
 }
 
 export interface LibrarySpell {
@@ -454,6 +608,7 @@ export interface LibrarySpell {
   duration: string | null;
   description: string | null;
   damageDice?: string; // default damage; absent for spells that deal none
+  revives?: boolean; // brings back the dead
   classes: CharacterClass[];
 }
 
@@ -478,6 +633,7 @@ export interface LibraryMonster {
 
 export interface CampaignLibrary {
   weapons: LibraryWeapon[];
+  items: LibraryItem[];
   spells: LibrarySpell[];
   monsters: LibraryMonster[];
 }
@@ -489,22 +645,118 @@ export interface QuickStatsWeapon {
   level: number;
   equipped: boolean;
   quantity: number;
+  usable: boolean; // false while the character is below this copy's level
+  effects: GearEffect[];
+  effectNote: string | null;
   attackBonus: number;
   damageBonus: number;
   damageDice: string;
   damageType: string;
 }
 
-export interface QuickStats {
+export interface QuickStatsItem {
+  inventoryItemId: string;
+  itemId: string;
   name: string;
+  description: string | null;
+  level: number;
+  equipped: boolean;
+  quantity: number;
+  usable: boolean;
+  damageDice: string | null; // at this copy's level
+  effects: GearEffect[];
+  effectNote: string | null;
+}
+
+export interface QuickStatsSpell {
+  characterSpellId: string;
+  name: string;
+  level: number;
+  damageDice: string | null;
+  description: string | null;
+  prepared: boolean;
+  usable: boolean;
+}
+
+// A character at a glance, with everything it holds. The pack, the spell
+// list and the purse are only sent to the owning player and the DM
+// (`restricted` is true for anyone else).
+export interface QuickStats {
+  id: string;
+  name: string;
+  level: number;
+  species: Species | null;
+  characterClass: CharacterClass | null;
   currentHp: number;
   maxHp: number;
   tempHp: number;
+  deathSaves: DeathSaves;
   armorClass: number;
   initiative: number;
   speed: number;
   proficiencyBonus: number;
   spellcasting: { ability: Ability; saveDC: number; attackBonus: number } | null;
+  spellSlots: SpellSlots | null;
+  hitDice: HitDice;
+  passivePerception: number;
+  abilities: Record<Ability, AbilityDetail>;
   specialAbilities: string | null;
+  gear: ActiveGear;
   weapons: QuickStatsWeapon[];
+  restricted: boolean;
+  inventory: QuickStatsItem[];
+  spells: QuickStatsSpell[];
+  purse: { gold: number; silver: number; copper: number; cash: number } | null;
+}
+
+// One of the four Boons that stand in for an ability score increase.
+export interface BoonOption {
+  key: string;
+  name: string;
+  text: string; // the line taking it now would write
+  taken: number; // how many times this character already has
+  max: number;
+  available: boolean;
+}
+
+// The checklist for a character's next level (GET /characters/:id/level-up).
+export interface LevelUpPlan {
+  fromLevel: number;
+  toLevel: number;
+  maxHp: { from: number; to: number };
+  // What the class gains. An upgrade rewrites the line that has its name.
+  features: { name: string; text: string; upgrade: boolean }[];
+  boon: BoonOption[] | null; // null at a level that grants no Boon
+  // What the book lets a caster be granted now; null for a class with no spells.
+  spells: { maxSpellLevel: number; unlocksSpellLevel: number | null; newSpells: number; newCantrips: number } | null;
+  spellSlots: SpellSlots | null; // the slots at the new level
+  // Held weapons that can take the free upgrade of one level.
+  weapons: { weaponId: string; name: string; equipped: boolean; level: number; damageDice: string; nextDamageDice: string }[];
+  beyondTables: boolean; // past level 10, where the class tables stop
+}
+
+export type RestType = 'SHORT' | 'LONG';
+
+// What a rest did for one character (POST /campaigns/:id/rest).
+export interface RestResult {
+  characterId: string;
+  name: string;
+  skipped: string | null; // why the rest did nothing for them; the rest is absent then
+  hpBefore: number;
+  hpAfter: number;
+  maxHp: number;
+  tempHp: number;
+  hitDice: {
+    size: number;
+    spent: number;
+    rolls: number[] | null; // what each die showed, when the site rolled them
+    total: number;
+    conBonus: number;
+    healed: number;
+    left: number;
+    of: number;
+    regained: number;
+  };
+  slotsRestored: boolean;
+  notes: string[];
 }

frontend/src/auth/AuthContext.tsx

@@ -1,28 +1,17 @@
-import { createContext, useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
+import { useEffect, useMemo, useState, type ReactNode } from 'react';
 import { apiClient, getStoredToken, setAuthToken } from '../api/client';
 import type { User } from '../api/types';
-
-interface AuthContextValue {
-  user: User | null;
-  token: string | null;
-  loading: boolean;
-  login: (token: string, user: User) => void;
-  logout: () => void;
-}
-
-const AuthContext = createContext<AuthContextValue | undefined>(undefined);
+import { AuthContext } from './useAuth';
 
 export function AuthProvider({ children }: { children: ReactNode }) {
   const [token, setToken] = useState<string | null>(getStoredToken());
   const [user, setUser] = useState<User | null>(null);
-  const [loading, setLoading] = useState(true);
+  // With no stored token there is nothing to check, so nothing to wait for.
+  const [loading, setLoading] = useState(() => getStoredToken() !== null);
 
   useEffect(() => {
     const stored = getStoredToken();
-    if (!stored) {
-      setLoading(false);
-      return;
-    }
+    if (!stored) return;
     setAuthToken(stored);
     apiClient
       .get<{ user: User }>('/auth/me')
@@ -53,9 +42,3 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
 }
-
-export function useAuth() {
-  const ctx = useContext(AuthContext);
-  if (!ctx) throw new Error('useAuth must be used within AuthProvider');
-  return ctx;
-}

frontend/src/auth/useAuth.ts

@@ -0,0 +1,18 @@
+import { createContext, useContext } from 'react';
+import type { User } from '../api/types';
+
+export interface AuthContextValue {
+  user: User | null;
+  token: string | null;
+  loading: boolean;
+  login: (token: string, user: User) => void;
+  logout: () => void;
+}
+
+export const AuthContext = createContext<AuthContextValue | undefined>(undefined);
+
+export function useAuth() {
+  const ctx = useContext(AuthContext);
+  if (!ctx) throw new Error('useAuth must be used within AuthProvider');
+  return ctx;
+}

frontend/src/components/CharacterPanel.tsx

@@ -0,0 +1,311 @@
+import { Link, useMatch } from 'react-router-dom';
+import { useCampaign, useCampaignCharacters, usePatchCharacterWeapon, usePatchInventoryItem, useQuickStats } from '../api/queries';
+import { useAuth } from '../auth/useAuth';
+import { useLastCampaignId } from '../lib/lastCampaign';
+import { closeCharacterPanel, openCharacterPanel, useCharacterPanelId } from '../lib/characterPanel';
+import { CLASS_LABELS, SPECIES_LABELS, fmtMod, formatPurse, spellLevelLabel } from '../lib/format';
+import { effectLabel, effectsSummary } from '../lib/gear';
+import { speciesIcon } from '../lib/speciesIcons';
+import { Spinner, ErrorBanner } from './Spinner';
+import { HpBar } from './HpBar';
+import { DeathSaves } from './DeathSaves';
+import { SpellSlotTracker } from './SpellSlots';
+import { useState } from 'react';
+import { extractErrorMessage } from '../lib/format';
+import type { ActiveGear } from '../api/types';
+
+// What equipped gear is doing, one line per thing: "Chain Mail: +6 AC · −10 Speed".
+export function GearInForce({ gear }: { gear: ActiveGear }) {
+  const sources = [...new Set([...gear.effects.map((e) => e.source), ...gear.notes.map((n) => n.source)])];
+  if (sources.length === 0) return null;
+  return (
+    <>
+      {sources.map((source) => (
+        <div key={source} className="detail-row">
+          <strong>{source}</strong>
+          <span>
+            {[...gear.effects.filter((e) => e.source === source).map(effectLabel), ...gear.notes.filter((n) => n.source === source).map((n) => n.note)].join(' · ')}
+          </span>
+        </div>
+      ))}
+    </>
+  );
+}
+
+function Flags({ equipped, usable, level }: { equipped: boolean; usable: boolean; level: number }) {
+  return (
+    <>
+      {equipped && <span className="badge badge-live" style={{ marginLeft: 6 }}>equipped</span>}
+      {!usable && <span className="badge badge-hostile" style={{ marginLeft: 6 }}>needs level {level}</span>}
+    </>
+  );
+}
+
+// One character at a glance: the numbers for a fight, and everything they
+// hold. The pack, spells and purse are there for the character's own player
+// and the DM, who can also put gear on and take it off from here.
+function PanelBody({ characterId, isDM }: { characterId: string; isDM: boolean }) {
+  const { data, isLoading, error } = useQuickStats(characterId, true);
+  const patchWeapon = usePatchCharacterWeapon(characterId);
+  const patchItem = usePatchInventoryItem(characterId);
+  // Why something could not be equipped: too much on already.
+  const [equipError, setEquipError] = useState<string | null>(null);
+  const equip = { onError: (err: unknown) => setEquipError(extractErrorMessage(err)), onSuccess: () => setEquipError(null) };
+
+  if (isLoading) return <Spinner label="Reading the sheet…" />;
+  if (error || !data) return <ErrorBanner message="Could not load this character." />;
+
+  const canEquip = !data.restricted;
+  const stats: [string, string | number][] = [
+    ['AC', data.armorClass],
+    ['Initiative', fmtMod(data.initiative)],
+    ['Speed', data.speed],
+    ['Prof.', fmtMod(data.proficiencyBonus)],
+    ['Passive Perc.', data.passivePerception],
+    ['Hit Dice', `${data.hitDice.remaining}/${data.hitDice.count} d${data.hitDice.size}`],
+  ];
+
+  return (
+    <div className="mt-md">
+      <div className="flex-between flex-wrap">
+        <div>
+          <h3 style={{ margin: 0 }}>
+            <span aria-hidden="true">{speciesIcon(data.species)}</span> {data.name}
+          </h3>
+          <div className="combatant-sub">
+            {data.species && SPECIES_LABELS[data.species]} {data.characterClass && CLASS_LABELS[data.characterClass]} · Level {data.level}
+          </div>
+        </div>
+        <Link to={`/characters/${data.id}`} className="btn" onClick={closeCharacterPanel}>
+          Full sheet
+        </Link>
+      </div>
+
+      <div className="stat-chips mt-sm">
+        <span className="stat-chip">
+          <span>HP</span>
+          <b>
+            {data.currentHp}/{data.maxHp}
+            {data.tempHp > 0 && ` +${data.tempHp}`}
+          </b>
+        </span>
+        {stats.map(([label, value]) => (
+          <span key={label} className="stat-chip">
+            <span>{label}</span>
+            <b>{value}</b>
+          </span>
+        ))}
+      </div>
+      <div className="mt-sm">
+        <HpBar current={data.currentHp} max={data.maxHp} temp={data.tempHp} />
+      </div>
+      {/* Read-only here; the saves are rolled on the sheet or in the encounter. */}
+      <DeathSaves characterId={characterId} name={data.name} deathSaves={data.deathSaves} canAct={false} isDM={false} />
+
+      <div className="stat-chips mt-sm">
+        {(Object.keys(data.abilities) as (keyof typeof data.abilities)[]).map((a) => (
+          <span key={a} className="stat-chip">
+            <span>{a}</span>
+            <b>
+              {data.abilities[a].final} ({fmtMod(data.abilities[a].modifier)})
+            </b>
+          </span>
+        ))}
+      </div>
+
+      {(data.gear.effects.length > 0 || data.gear.notes.length > 0) && (
+        <div className="card mt-md">
+          <div className="card-title">From equipped gear</div>
+          <GearInForce gear={data.gear} />
+          <p className="combatant-sub" style={{ margin: '0.4rem 0 0' }}>Already counted in the numbers above.</p>
+        </div>
+      )}
+
+      {data.spellcasting && (
+        <div className="card mt-md">
+          <div className="card-title">Spellcasting</div>
+          <p style={{ margin: 0 }}>
+            Save DC {data.spellcasting.saveDC} · Attack {fmtMod(data.spellcasting.attackBonus)}
+          </p>
+          {/* The character's own player and the DM spend slots here; the DM can also give them back. */}
+          {data.spellSlots && (
+            <SpellSlotTracker
+              characterId={characterId}
+              name={data.name}
+              slots={data.spellSlots}
+              canUse={!data.restricted}
+              isDM={isDM}
+              onError={(err) => setEquipError(extractErrorMessage(err))}
+            />
+          )}
+        </div>
+      )}
+
+      {canEquip && (
+        <p className="combatant-sub mt-md" style={{ marginBottom: 0 }}>
+          Tick what is equipped. Only equipped weapons can be used in an encounter, and only equipped gear gives its effects.
+        </p>
+      )}
+      {equipError && <ErrorBanner message={equipError} />}
+      <div className="card mt-md">
+        <div className="card-title">Weapons · {data.weapons.length}</div>
+        {data.weapons.length === 0 && <p className="combatant-sub" style={{ margin: 0 }}>No weapons.</p>}
+        {data.weapons.map((w) => (
+          <div key={w.characterWeaponId} className="reward-row">
+            <div className="flex-between">
+              <div>
+                <strong>{w.name}</strong>
+                {w.quantity > 1 && <span className="combatant-sub"> ×{w.quantity}</span>}
+                <Flags equipped={w.equipped} usable={w.usable} level={w.level} />
+                <div className="combatant-sub">
+                  Lv {w.level} · attack {fmtMod(w.attackBonus)} · {w.damageDice} {fmtMod(w.damageBonus)} {w.damageType}
+                </div>
+                {effectsSummary(w.effects, w.effectNote) && <div className="combatant-sub">✦ {effectsSummary(w.effects, w.effectNote)}</div>}
+              </div>
+              {canEquip && (
+                <input
+                  type="checkbox"
+                  aria-label={`${w.name} is equipped`}
+                  title="Equipped"
+                  checked={w.equipped}
+                  disabled={!w.usable || patchWeapon.isPending}
+                  onChange={(e) => patchWeapon.mutate({ weaponId: w.weaponId, equipped: e.target.checked }, equip)}
+                />
+              )}
+            </div>
+          </div>
+        ))}
+      </div>
+
+      {data.restricted ? (
+        <p className="combatant-sub mt-md">Their pack, spells and purse are their own business.</p>
+      ) : (
+        <>
+          <div className="card mt-md">
+            <div className="card-title">Inventory · {data.inventory.length}</div>
+            {data.inventory.length === 0 && <p className="combatant-sub" style={{ margin: 0 }}>Nothing carried.</p>}
+            {data.inventory.map((item) => (
+              <div key={item.inventoryItemId} className="reward-row">
+                <div className="flex-between">
+                  <div>
+                    <strong>{item.name}</strong>
+                    <span className="combatant-sub"> ×{item.quantity}</span>
+                    <Flags equipped={item.equipped} usable={item.usable} level={item.level} />
+                    <div className="combatant-sub">
+                      Lv {item.level}
+                      {item.damageDice && ` · ${item.damageDice}`}
+                    </div>
+                    {effectsSummary(item.effects, item.effectNote) && <div className="combatant-sub">✦ {effectsSummary(item.effects, item.effectNote)}</div>}
+                    {item.description && <div className="combatant-sub">{item.description}</div>}
+                  </div>
+                  <input
+                    type="checkbox"
+                    aria-label={`${item.name} is equipped`}
+                    title="Equipped"
+                    checked={item.equipped}
+                    disabled={!item.usable || patchItem.isPending}
+                    onChange={(e) => patchItem.mutate({ itemId: item.itemId, equipped: e.target.checked }, equip)}
+                  />
+                </div>
+              </div>
+            ))}
+          </div>
+
+          <div className="card mt-md">
+            <div className="card-title">
+              <span>Money</span>
+              {data.purse && <span className="mono">{formatPurse(data.purse)}</span>}
+            </div>
+          </div>
+
+          {data.spells.length > 0 && (
+            <div className="card mt-md">
+              <div className="card-title">Spells · {data.spells.length}</div>
+              {data.spells.map((s) => (
+                <div key={s.characterSpellId} className="reward-row">
+                  <strong>{s.name}</strong>
+                  <span className="combatant-sub">
+                    {' '}
+                    {spellLevelLabel(s.level)}
+                    {s.damageDice && ` · ${s.damageDice}`}
+                  </span>
+                  {s.prepared && <span className="badge badge-live" style={{ marginLeft: 6 }}>prepared</span>}
+                  {!s.usable && <span className="badge badge-hostile" style={{ marginLeft: 6 }}>needs level {s.level}</span>}
+                  {s.description && <div className="combatant-sub">{s.description}</div>}
+                </div>
+              ))}
+            </div>
+          )}
+        </>
+      )}
+
+      {data.specialAbilities && (
+        <div className="card mt-md">
+          <div className="card-title">Special Abilities</div>
+          <p style={{ margin: 0, whiteSpace: 'pre-wrap' }}>{data.specialAbilities}</p>
+        </div>
+      )}
+    </div>
+  );
+}
+
+// The floating character button, on every page, and the panel it opens. A
+// player gets their own characters in the campaign they are in; the DM gets
+// everyone's. Other pages can open the panel for a particular character with
+// openCharacterPanel (lib/characterPanel.ts).
+export function CharacterPanel() {
+  const { user } = useAuth();
+  const campaignId = useLastCampaignId() ?? undefined;
+  const { data: campaignData } = useCampaign(campaignId);
+  const { data: characters } = useCampaignCharacters(campaignId);
+  const onSheet = useMatch('/characters/:characterId');
+  const openId = useCharacterPanelId();
+
+  const isDM = campaignData?.campaign.role === 'DM';
+  const choices = (characters ?? []).filter((c) => c.buildStage === 'COMPLETE' && (isDM || c.userId === user?.id));
+  if (choices.length === 0 && !openId) return null;
+
+  // On a character's own sheet the button opens that character; otherwise the first of yours.
+  const fallback = choices.find((c) => c.id === onSheet?.params.characterId) ?? choices.find((c) => c.userId === user?.id) ?? choices[0];
+  const shown = openId ?? undefined;
+
+  return (
+    <>
+      {fallback && (
+        <button
+          className="fab-quickstats"
+          onClick={() => openCharacterPanel(fallback.id)}
+          title={isDM ? 'Characters: stats and inventory' : 'Your character: stats and inventory'}
+          aria-label="Open the character panel"
+        >
+          🧙
+        </button>
+      )}
+      {shown && (
+        <>
+          <div className="drawer-backdrop" onClick={closeCharacterPanel} />
+          <div className="drawer" role="dialog" aria-label="Character panel">
+            <div className="flex-between">
+              {choices.length > 1 && choices.some((c) => c.id === shown) ? (
+                <select aria-label="Which character" value={shown} onChange={(e) => openCharacterPanel(e.target.value)} style={{ flex: 1, minWidth: 0 }}>
+                  {choices.map((c) => (
+                    <option key={c.id} value={c.id}>
+                      {c.name}
+                      {isDM && c.userId === user?.id ? ' (yours)' : ''}
+                    </option>
+                  ))}
+                </select>
+              ) : (
+                <h2 style={{ margin: 0 }}>Character</h2>
+              )}
+              <button className="btn btn-ghost" onClick={closeCharacterPanel} aria-label="Close the character panel">
+                ✕
+              </button>
+            </div>
+            <PanelBody key={shown} characterId={shown} isDM={isDM} />
+          </div>
+        </>
+      )}
+    </>
+  );
+}

frontend/src/components/DeathSaves.tsx

@@ -0,0 +1,118 @@
+import { useState } from 'react';
+import { useDeathSave } from '../api/queries';
+import { InfoTip } from './InfoTip';
+import { NumberInput } from './NumberInput';
+import type { DeathSaves as DeathSavesInfo } from '../api/types';
+
+const STATE_LABELS = { DYING: 'Dying', STABLE: 'Stable', DEAD: '☠ Dead' } as const;
+
+// Nothing for a character on their feet; otherwise where they stand at 0 HP.
+export function LifeBadge({ deathSaves }: { deathSaves: DeathSavesInfo }) {
+  if (deathSaves.state === 'UP') return null;
+  return <span className={`badge ${deathSaves.state === 'STABLE' ? '' : 'badge-hostile'}`}>{STATE_LABELS[deathSaves.state]}</span>;
+}
+
+// Three pips for one tally. For the DM each is a button: clicking a pip sets
+// the tally to it, and clicking the last filled one takes it back off.
+function Pips({ kind, count, onSet }: { kind: 'success' | 'failure'; count: number; onSet?: (count: number) => void }) {
+  const noun = kind === 'success' ? 'successes' : 'failures';
+  return (
+    <span className="death-pips" role="group" aria-label={`${count} of 3 ${noun}`}>
+      {[1, 2, 3].map((n) => {
+        const className = `death-pip is-${kind}${n <= count ? ' is-filled' : ''}`;
+        return onSet ? (
+          <button key={n} type="button" className={className} aria-label={`Set ${noun} to ${n === count ? n - 1 : n}`} onClick={() => onSet(n === count ? n - 1 : n)} />
+        ) : (
+          <span key={n} className={className} />
+        );
+      })}
+    </span>
+  );
+}
+
+// What happens to a character at 0 HP: the death-save tallies, and the ways
+// out of them. `canAct` is the character's own player or the DM; setting the
+// tallies by hand and raising the dead from here are the DM's alone.
+export function DeathSaves({
+  characterId,
+  name,
+  deathSaves,
+  canAct,
+  isDM,
+  onError,
+}: {
+  characterId: string;
+  name: string;
+  deathSaves: DeathSavesInfo;
+  canAct: boolean;
+  isDM: boolean;
+  onError?: (err: unknown) => void;
+}) {
+  const deathSave = useDeathSave(characterId);
+  const [roll, setRoll] = useState('');
+  const { state, successes, failures } = deathSaves;
+  if (state === 'UP') return null;
+
+  const send = (action: Parameters<typeof deathSave.mutate>[0]) => deathSave.mutate(action, { onError });
+
+  function handleRoll() {
+    const value = Number(roll);
+    if (!roll || !Number.isInteger(value)) return;
+    send({ action: 'roll', roll: value });
+    setRoll('');
+  }
+
+  return (
+    <div className={`death-saves is-${state.toLowerCase()}`}>
+      <div className="flex-row flex-wrap">
+        <LifeBadge deathSaves={deathSaves} />
+        {state === 'DYING' && (
+          <>
+            <span className="death-tally">
+              Saved <Pips kind="success" count={successes} onSet={isDM ? (n) => send({ action: 'set', successes: n, failures }) : undefined} />
+            </span>
+            <span className="death-tally">
+              Failed <Pips kind="failure" count={failures} onSet={isDM ? (n) => send({ action: 'set', successes, failures: n }) : undefined} />
+            </span>
+            <InfoTip term="DEATH_SAVES" />
+          </>
+        )}
+        {state === 'STABLE' && <span className="combatant-sub">Out cold at 0 HP, but no longer rolling. Any healing wakes them; damage starts the saves again.</span>}
+        {state === 'DEAD' && <span className="combatant-sub">{isDM ? 'Healing does nothing now.' : 'The DM can bring them back, or an ally with a reviving spell on their turn in a battle.'}</span>}
+      </div>
+
+      {state === 'DYING' && canAct && (
+        <div className="flex-row flex-wrap gap-sm mt-sm">
+          <NumberInput
+            min={1}
+            max={20}
+            placeholder="d20"
+            aria-label={`Death save roll for ${name}`}
+            title="Type what the d20 showed (1 to 20)."
+            value={roll}
+            onChange={(e) => setRoll(e.target.value)}
+            onKeyDown={(e) => e.key === 'Enter' && handleRoll()}
+            style={{ width: 64 }}
+          />
+          <button className="btn" onClick={handleRoll} disabled={!roll || deathSave.isPending}>
+            Death save
+          </button>
+          <button
+            className="btn btn-ghost"
+            title="Someone steadied them: a Medicine check, a healer's kit or a spell. They stay at 0 HP but stop rolling."
+            onClick={() => send({ action: 'stabilize' })}
+            disabled={deathSave.isPending}
+          >
+            Stabilise
+          </button>
+        </div>
+      )}
+
+      {state === 'DEAD' && isDM && (
+        <button className="btn mt-sm" onClick={() => send({ action: 'revive' })} disabled={deathSave.isPending}>
+          Revive at 1 HP
+        </button>
+      )}
+    </div>
+  );
+}

frontend/src/components/EffectsEditor.tsx

@@ -0,0 +1,87 @@
+import { useState } from 'react';
+import { NumberInput } from './NumberInput';
+import { GEAR_STAT_GROUPS, effectLabel, gearStatLabel } from '../lib/gear';
+import type { GearEffect } from '../api/types';
+
+// The DM's editor for what a weapon or item does to whoever has it equipped:
+// a list of signed amounts on the sheet's numbers (armor is "+6 AC"), and a
+// note for anything that is not a number. It holds nothing itself: the list
+// and the note live with whoever renders it.
+export function EffectsEditor({
+  effects,
+  note,
+  onChange,
+}: {
+  effects: GearEffect[];
+  note: string;
+  onChange: (effects: GearEffect[], note: string) => void;
+}) {
+  const [stat, setStat] = useState('AC');
+  const [amount, setAmount] = useState('');
+
+  function handleAdd() {
+    const value = Math.trunc(Number(amount));
+    if (!value) return;
+    // One line per number: adding to one already listed replaces it.
+    onChange([...effects.filter((e) => e.stat !== stat), { stat, amount: value }], note);
+    setAmount('');
+  }
+
+  return (
+    <div>
+      <div className="section-label">While equipped</div>
+      {effects.length === 0 && (
+        <p className="combatant-sub" style={{ marginTop: 0 }}>
+          No effects. Add a bonus (armor: +AC) or a penalty (heavy armor: −Speed).
+        </p>
+      )}
+      {effects.length > 0 && (
+        <div className="stat-chips" style={{ marginBottom: '0.5rem' }}>
+          {effects.map((effect) => (
+            <span key={effect.stat} className={`condition-chip ${effect.amount > 0 ? 'is-bonus' : ''}`}>
+              {effectLabel(effect)}
+              <button type="button" aria-label={`Remove the ${gearStatLabel(effect.stat)} effect`} onClick={() => onChange(effects.filter((e) => e !== effect), note)}>
+                ✕
+              </button>
+            </span>
+          ))}
+        </div>
+      )}
+      <div className="flex-row flex-wrap gap-sm">
+        <select aria-label="What it changes" value={stat} onChange={(e) => setStat(e.target.value)} style={{ flex: 1, minWidth: 130 }}>
+          {GEAR_STAT_GROUPS.map((group) => (
+            <optgroup key={group.label} label={group.label}>
+              {group.stats.map((s) => (
+                <option key={s} value={s}>
+                  {gearStatLabel(s)}
+                </option>
+              ))}
+            </optgroup>
+          ))}
+        </select>
+        <NumberInput
+          min={-100}
+          max={100}
+          placeholder="+ or −"
+          aria-label="By how much (negative for a penalty)"
+          title="By how much. A negative number is a penalty."
+          value={amount}
+          onChange={(e) => setAmount(e.target.value)}
+          style={{ width: 90 }}
+        />
+        <button type="button" className="btn" onClick={handleAdd} disabled={!Math.trunc(Number(amount))}>
+          Add effect
+        </button>
+      </div>
+      <input
+        className="mt-sm"
+        style={{ width: '100%' }}
+        placeholder="Anything else it does (e.g. Disadvantage on Stealth)"
+        aria-label="What else it does, in words"
+        maxLength={300}
+        value={note}
+        onChange={(e) => onChange(effects, e.target.value)}
+      />
+    </div>
+  );
+}

frontend/src/components/HpBar.tsx

@@ -0,0 +1,24 @@
+import { hpBarClass } from '../lib/format';
+
+// A health bar with temporary hit points on it. Temp HP sits on top of real
+// HP, so it is drawn as its own blue segment after the HP fill, and the bar
+// stretches to fit when the two together come to more than the maximum (full
+// health plus a buffer). The fill's colour still reflects real HP only: temp
+// HP doesn't make a bloodied character look healthy.
+export function HpBar({ current, max, temp = 0, height, className = 'mt-sm' }: {
+  current: number;
+  max: number;
+  temp?: number;
+  height?: number;
+  className?: string;
+}) {
+  const hp = Math.max(0, Math.min(current, max));
+  const buffer = Math.max(0, temp);
+  const scale = Math.max(max, hp + buffer, 1);
+  return (
+    <div className={`hp-bar-track ${className}`} style={height ? { height } : undefined}>
+      <div className={hpBarClass(hp, max)} style={{ width: `${(hp / scale) * 100}%` }} />
+      {buffer > 0 && <div className="hp-bar-fill hp-temp" style={{ width: `${(buffer / scale) * 100}%` }} title="Temporary HP" />}
+    </div>
+  );
+}

frontend/src/components/InfoTip.tsx

@@ -1,12 +1,14 @@
-import { useId, useState } from 'react';
+import { useEffect, useId, useRef, useState, type CSSProperties } from 'react';
+import { createPortal } from 'react-dom';
 
 // Short explanations for the stat labels sprinkled across the sheet, quick
 // stats, party table, and builder — "what is this, and how is it worked
 // out" for someone who doesn't already know D&D 5e by heart.
-export const STAT_HELP: Record<string, string> = {
+const STAT_HELP: Record<string, string> = {
   AC: 'Armor Class — how hard you are to hit. 10 + your Dexterity modifier + any armor bonus.',
   HP: 'Hit Points — damage you can take before falling unconscious. Max HP is set by your class hit die, Constitution modifier, and level.',
   TEMP_HP: 'Temporary Hit Points — an extra buffer that absorbs damage first and disappears when it runs out (it does not stack with more temp HP).',
+  DEATH_SAVES: 'Death saves — at 0 HP you roll a d20 at the start of each of your turns. 10 or more is a success, less is a failure; a 1 counts as two failures and a 20 puts you back up with 1 HP. Three successes and you are stable; three failures and you die. Being hit while down is a failure (two if it was a critical hit). Any healing ends it.',
   INITIATIVE: 'Initiative — added to a d20 roll at the start of a fight to decide turn order. Equal to your Dexterity modifier.',
   PROFICIENCY_BONUS: 'Proficiency Bonus — added to attacks, saves, and skills you are trained in. Grows with level (+2 at level 1, up to +6 at level 20).',
   PASSIVE_PERCEPTION: 'Passive Perception — your always-on alertness score, used instead of rolling when you are not actively searching. 10 + your Perception skill bonus.',
@@ -14,7 +16,7 @@ export const STAT_HELP: Record<string, string> = {
   SKILL_BONUS: 'Skill Bonus — added when you roll to use a skill. The governing ability modifier, plus your proficiency bonus if you are proficient (doubled if you have expertise).',
   EXPERTISE: 'Expertise — doubles your proficiency bonus for this skill, on top of being proficient.',
   ABILITY_MODIFIER: 'Ability Modifier — the number added to rolls that use this ability. floor((score − 10) / 2).',
-  ARMOR_BONUS: 'Armor Bonus — a flat bonus to AC from equipped armor or a shield, added on top of 10 + Dex modifier.',
+  ARMOR_BONUS: 'Extra AC — a number the DM sets, added to AC on top of 10 + Dex modifier and whatever equipped gear gives. Armor itself is an equipped item.',
   SPEED: 'Speed — how far you can move on your turn, in feet. Set by your species, unless overridden.',
   SPELL_SAVE_DC: 'Spell Save DC — the difficulty a target must beat to resist your spell. 8 + proficiency bonus + your spellcasting ability modifier.',
   SPELL_ATTACK_BONUS: 'Spell Attack Bonus — added when you make a spell attack roll. Proficiency bonus + your spellcasting ability modifier.',
@@ -22,6 +24,8 @@ export const STAT_HELP: Record<string, string> = {
   DAMAGE_BONUS: 'Damage Bonus — added to the weapon’s damage dice on a hit. Same ability modifier as the attack bonus.',
   CHALLENGE_RATING: 'Challenge Rating — a rough measure of how dangerous a monster is on its own, used to gauge encounter difficulty.',
   HIT_DICE: 'Hit Dice — the die your class rolls (or uses the fixed average of) when your HP increases at each level.',
+  HIT_DICE_LEFT: 'Hit Dice — you have one per level. On a short rest you can spend any you have left: roll each one, add your Constitution modifier, and heal that much. A long rest gives back half your level in spent dice (at least one).',
+  SPELL_SLOTS: 'Spell slots — each one is one casting of a spell of that level or lower. Cantrips never use a slot. How many you have comes from your class and level. Spent slots come back on a long rest (a warlock’s on a short rest too).',
   // Character builder
   DICE_MODE: 'Digital dice are rolled by the app. Physical dice are rolled by you at the table, and you type in what came up. Either way a roll is final once it is made.',
   WILDCARD: 'Wildcard — the luckiest result. Instead of choosing between two options you may pick any of them.',
@@ -38,8 +42,36 @@ export const STAT_HELP: Record<string, string> = {
 // (a species, a skill, an ability) without adding it to the shared list.
 export function InfoTip({ term, text: custom, label = 'What is this?' }: { term?: keyof typeof STAT_HELP; text?: string; label?: string }) {
   const [open, setOpen] = useState(false);
+  const [place, setPlace] = useState<CSSProperties | null>(null);
+  const trigger = useRef<HTMLButtonElement>(null);
   const id = useId();
   const text = custom ?? (term ? STAT_HELP[term] : undefined);
+
+  // The bubble is drawn on the page itself, fixed to where the ⓘ is on
+  // screen, rather than inside whatever holds the ⓘ: a scrolling table or a
+  // drawer would otherwise cut it off. It sits above the ⓘ when there is room
+  // and below when there isn't, and never runs off the sides.
+  useEffect(() => {
+    if (!open || !trigger.current) return;
+    const rect = trigger.current.getBoundingClientRect();
+    const halfWidth = Math.min(130, window.innerWidth / 2 - 8);
+    const centre = Math.min(Math.max(rect.left + rect.width / 2, halfWidth + 8), window.innerWidth - halfWidth - 8);
+    const above = rect.top > 160;
+    setPlace({
+      left: centre,
+      ...(above ? { bottom: window.innerHeight - rect.top + 8 } : { top: rect.bottom + 8 }),
+    });
+    // Its position is only right until the page moves.
+    const close = () => setOpen(false);
+    window.addEventListener('scroll', close, true);
+    window.addEventListener('resize', close);
+    return () => {
+      window.removeEventListener('scroll', close, true);
+      window.removeEventListener('resize', close);
+      setPlace(null); // so the next opening is measured afresh, not shown where the last one was
+    };
+  }, [open]);
+
   if (!text) return null;
 
   return (
@@ -49,6 +81,7 @@ export function InfoTip({ term, text: custom, label = 'What is this?' }: { term?
         className="info-tip-trigger"
         aria-describedby={id}
         aria-label={label}
+        ref={trigger}
         onMouseEnter={() => setOpen(true)}
         onFocus={() => setOpen(true)}
         onBlur={() => setOpen(false)}
@@ -56,11 +89,14 @@ export function InfoTip({ term, text: custom, label = 'What is this?' }: { term?
       >
         ⓘ
       </button>
-      {open && (
-        <span role="tooltip" id={id} className="info-tip-bubble">
-          {text}
-        </span>
-      )}
+      {open &&
+        place &&
+        createPortal(
+          <span role="tooltip" id={id} className="info-tip-bubble" style={place}>
+            {text}
+          </span>,
+          document.body,
+        )}
     </span>
   );
 }

frontend/src/components/JumpNav.tsx

@@ -0,0 +1,36 @@
+import { useEffect, useState } from 'react';
+
+// A row of links to the sections of a long page. It finds them itself: any
+// element with a `data-jump="Label"` attribute that is on the page right now
+// gets a link, so sections only some people see need no special handling.
+export function JumpNav() {
+  const [labels, setLabels] = useState<string[]>([]);
+
+  // Sections come and go as data loads, so the page is watched for them.
+  useEffect(() => {
+    const look = () => {
+      const found = [...document.querySelectorAll<HTMLElement>('[data-jump]')].map((el) => el.dataset.jump ?? '');
+      setLabels((current) => (current.join('|') === found.join('|') ? current : found));
+    };
+    const observer = new MutationObserver(look);
+    observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['data-jump'] });
+    look();
+    return () => observer.disconnect();
+  }, []);
+
+  if (labels.length < 3) return null;
+  return (
+    <nav className="jump-nav" aria-label="Sections of this page">
+      {labels.map((label) => (
+        <button
+          key={label}
+          type="button"
+          className="jump-link"
+          onClick={() => document.querySelector(`[data-jump="${label}"]`)?.scrollIntoView({ behavior: 'smooth', block: 'start' })}
+        >
+          {label}
+        </button>
+      ))}
+    </nav>
+  );
+}

frontend/src/components/Layout.tsx

@@ -1,10 +1,41 @@
-import { Link, Outlet } from 'react-router-dom';
-import { useAuth } from '../auth/AuthContext';
+import { Suspense } from 'react';
+import { Link, NavLink, Outlet, useMatch } from 'react-router-dom';
+import { useAuth } from '../auth/useAuth';
+import { useLastCampaignId, useRememberCampaign } from '../lib/lastCampaign';
 import { DiceRoller } from './DiceRoller';
+import { CharacterPanel } from './CharacterPanel';
 
 export function Layout() {
   const { user, logout } = useAuth();
 
+  // The campaign pages say which campaign they are in their address; sheets
+  // and encounters report theirs themselves (useRememberCampaign).
+  const onCampaign = useMatch('/campaigns/:campaignId/*');
+  useRememberCampaign(onCampaign?.params.campaignId);
+  const campaignId = useLastCampaignId();
+
+  // The same destinations twice: along the top bar on a wide screen, and as a
+  // bar along the bottom, in reach of a thumb, on a phone.
+  const destinations = [
+    { to: '/campaigns', end: true, icon: '🗺', label: 'Campaigns' },
+    ...(campaignId
+      ? [
+          { to: `/campaigns/${campaignId}`, end: true, icon: '🏰', label: 'Campaign' },
+          { to: `/campaigns/${campaignId}/party`, end: true, icon: '👥', label: 'Party' },
+        ]
+      : []),
+    { to: '/account', end: true, icon: '👤', label: 'Account' },
+  ];
+  const links = (className: string) =>
+    destinations.map((d) => (
+      <NavLink key={d.to} to={d.to} end={d.end} className={({ isActive }) => `${className}${isActive ? ' is-active' : ''}`}>
+        <span className="nav-icon" aria-hidden>
+          {d.icon}
+        </span>
+        <span>{d.label}</span>
+      </NavLink>
+    ));
+
   return (
     <div className="app-shell">
       <header className="topbar">
@@ -14,23 +45,31 @@ export function Layout() {
           </span>
           The Sunken Reach
         </Link>
-        <nav className="topbar-nav">
-          {user && (
+        {user && (
+          <nav className="topbar-nav" aria-label="Main">
+            <div className="topbar-links">{links('topbar-link')}</div>
             <div className="topbar-user">
-              <Link to="/account" title="Account settings">
-                {user.displayName}
-              </Link>
+              <span className="topbar-name">{user.displayName}</span>
               <button className="btn btn-ghost" onClick={logout}>
                 Log out
               </button>
             </div>
-          )}
-        </nav>
+          </nav>
+        )}
       </header>
       <main className="page">
-        <Outlet />
+        {/* The bars stay put while a page that has not been opened before downloads. */}
+        <Suspense fallback={null}>
+          <Outlet />
+        </Suspense>
       </main>
+      {user && (
+        <nav className="bottom-nav" aria-label="Main">
+          {links('bottom-nav-link')}
+        </nav>
+      )}
       <DiceRoller />
+      {user && <CharacterPanel />}
     </div>
   );
 }

frontend/src/components/LevelUpModal.tsx

@@ -0,0 +1,188 @@
+import { useState, type ReactNode } from 'react';
+import { useLevelUp, useLevelUpPlan } from '../api/queries';
+import { extractErrorMessage, slotLevelLabel, slotsSummary, spellLevelLabel } from '../lib/format';
+import { Modal } from './Modal';
+import { Spinner, ErrorBanner } from './Spinner';
+import type { CharacterDetail, LevelUpPlan, Spell } from '../api/types';
+
+// One numbered step of the checklist.
+function Step({ n, title, children }: { n: number; title: string; children: ReactNode }) {
+  return (
+    <div className="level-step">
+      <h3 className="section-label" style={{ margin: 0 }}>
+        {n}. {title}
+      </h3>
+      {children}
+    </div>
+  );
+}
+
+function allowance(spells: NonNullable<LevelUpPlan['spells']>): string {
+  const parts = [];
+  if (spells.newSpells > 0) parts.push(`${spells.newSpells} new spell${spells.newSpells === 1 ? '' : 's'} of up to ${slotLevelLabel(spells.maxSpellLevel)} level`);
+  if (spells.newCantrips > 0) parts.push(`${spells.newCantrips} extra cantrip`);
+  return parts.length > 0 ? `The book allows ${parts.join(' and ')}.` : 'No new spell at this level.';
+}
+
+// The levelling-up checklist for one character, one level at a time: the
+// level, HP, the class's new special abilities (and a Boon where the level
+// grants one), new spells and fresh slots, and the free weapon upgrade. The
+// site does every step; the DM makes the choices and says yes.
+export function LevelUpModal({ character, campaignSpells, onClose }: { character: CharacterDetail; campaignSpells: Spell[]; onClose: () => void }) {
+  const { data: plan, isLoading, error: planError } = useLevelUpPlan(character.id, true);
+  const levelUp = useLevelUp(character.id);
+  const [boon, setBoon] = useState('');
+  // undefined until picked: the equipped weapon is offered first.
+  const [weaponChoice, setWeaponChoice] = useState<string | undefined>(undefined);
+  const [spellIds, setSpellIds] = useState<Set<string>>(new Set());
+  const [error, setError] = useState<string | null>(null);
+
+  if (isLoading || !plan) {
+    return (
+      <Modal title={`Level up ${character.name}`} onClose={onClose}>
+        {planError ? <ErrorBanner message={extractErrorMessage(planError)} /> : <Spinner label="Reading the class tables…" />}
+      </Modal>
+    );
+  }
+
+  const weaponId = weaponChoice ?? plan.weapons.find((w) => w.equipped)?.weaponId ?? plan.weapons[0]?.weaponId ?? '';
+  const known = new Set(character.spells.map((s) => s.spellId));
+  const grantable = plan.spells
+    ? campaignSpells.filter((s) => !known.has(s.id) && s.level <= plan.spells!.maxSpellLevel).sort((a, b) => a.level - b.level || a.name.localeCompare(b.name))
+    : [];
+  const pickedBoon = plan.boon?.find((b) => b.key === boon);
+
+  function toggleSpell(id: string) {
+    setSpellIds((current) => {
+      const next = new Set(current);
+      if (!next.delete(id)) next.add(id);
+      return next;
+    });
+  }
+
+  async function handleLevelUp() {
+    setError(null);
+    try {
+      await levelUp.mutateAsync({ boon: plan!.boon ? boon : undefined, weaponId: weaponId || null, spellIds: [...spellIds] });
+      onClose();
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  return (
+    <Modal title={`Level up ${character.name}`} subtitle={`Level ${plan.fromLevel} → ${plan.toLevel} · the levelling-up checklist`} wide onClose={onClose}>
+      {error && <ErrorBanner message={error} />}
+
+      <Step n={1} title="Level">
+        <p>
+          Level <strong>{plan.fromLevel}</strong> → <strong>{plan.toLevel}</strong>. Proficiency bonus, saves, skills and spell DC follow by themselves.
+        </p>
+      </Step>
+
+      <Step n={2} title="Hit points">
+        <p>
+          Max HP <strong>{plan.maxHp.from}</strong> → <strong>{plan.maxHp.to}</strong>, and healed to full. One more Hit Die.
+        </p>
+      </Step>
+
+      <Step n={3} title="Special abilities">
+        {plan.features.length === 0 && !plan.boon && (
+          <p className="combatant-sub">
+            {plan.beyondTables ? 'The class tables stop at level 10. Add anything new to the special abilities by hand.' : 'No new feature at this level.'}
+          </p>
+        )}
+        {plan.features.map((feature) => (
+          <div key={feature.name + feature.text} className="reward-row">
+            <strong>{feature.name}</strong>
+            {feature.upgrade && <span className="badge" style={{ marginLeft: 6 }}>replaces the line it has now</span>}
+            <div className="combatant-sub">{feature.text}</div>
+          </div>
+        ))}
+        {plan.boon && (
+          <div className="mt-sm" role="radiogroup" aria-label="Boon">
+            <p style={{ margin: '0 0 0.3rem' }}>
+              <strong>Boon</strong> <span className="combatant-sub">in place of an ability score increase. Choose one:</span>
+            </p>
+            {plan.boon.map((option) => (
+              <label key={option.key} className="checkbox-row level-choice" style={option.available ? undefined : { opacity: 0.55 }}>
+                <input type="radio" name="boon" value={option.key} checked={boon === option.key} disabled={!option.available} onChange={() => setBoon(option.key)} />
+                <span>
+                  <strong>{option.name}</strong>
+                  {option.taken > 0 && <span className="badge" style={{ marginLeft: 6 }}>{option.available ? `taken ${option.taken} of ${option.max}` : 'already taken'}</span>}
+                  <span className="combatant-sub" style={{ display: 'block' }}>{option.text}</span>
+                </span>
+              </label>
+            ))}
+            {pickedBoon?.key === 'TOUGHENED' && <p className="combatant-sub">Extra AC goes up by 1 with it.</p>}
+            {pickedBoon?.key === 'HARDY' && <p className="combatant-sub">The Temp HP is given now, and again after every long rest taken with the Rest button.</p>}
+          </div>
+        )}
+        {(plan.features.length > 0 || plan.boon) && (
+          <p className="combatant-sub">Written into Special Abilities for you. Where a line says "choose", edit it there once the player has.</p>
+        )}
+      </Step>
+
+      <Step n={4} title="Spells">
+        {!plan.spells ? (
+          <p className="combatant-sub">This class has no spells.</p>
+        ) : (
+          <>
+            <p>
+              {plan.spellSlots ? (
+                <>
+                  Fresh spell slots: <strong>{slotsSummary(plan.spellSlots)}</strong>.
+                </>
+              ) : (
+                'No spell slots yet.'
+              )}{' '}
+              {plan.spells.unlocksSpellLevel && <strong>{slotLevelLabel(plan.spells.unlocksSpellLevel)}-level spells unlock. </strong>}
+              {allowance(plan.spells)}
+            </p>
+            {grantable.length === 0 ? (
+              <p className="combatant-sub">Nothing in the campaign's spell list to grant that {character.name} does not already know. Spells can be granted on the sheet later.</p>
+            ) : (
+              <div className="level-spells">
+                {grantable.map((spell) => (
+                  <label key={spell.id} className="checkbox-row level-choice">
+                    <input type="checkbox" checked={spellIds.has(spell.id)} onChange={() => toggleSpell(spell.id)} />
+                    <span>
+                      {spell.name} <span className="combatant-sub">{spellLevelLabel(spell.level)}</span>
+                    </span>
+                  </label>
+                ))}
+              </div>
+            )}
+            <p className="combatant-sub">
+              {spellIds.size > 0 && `${spellIds.size} picked. `}A player may also swap one known spell for another: take the old one away on the sheet.
+            </p>
+          </>
+        )}
+      </Step>
+
+      <Step n={5} title="Gear">
+        {plan.weapons.length === 0 ? (
+          <p className="combatant-sub">No weapon can take the free upgrade: it goes to a held weapon of standard growth that is below level {plan.toLevel}.</p>
+        ) : (
+          <label className="flex-row flex-wrap gap-sm">
+            Free upgrade for the main weapon
+            <select value={weaponId} onChange={(e) => setWeaponChoice(e.target.value)} style={{ flex: 1, minWidth: 180 }}>
+              {plan.weapons.map((w) => (
+                <option key={w.weaponId} value={w.weaponId}>
+                  {w.name}: Lv {w.level} → {w.level + 1} ({w.damageDice} → {w.nextDamageDice}){w.equipped ? ' · equipped' : ''}
+                </option>
+              ))}
+              <option value="">No upgrade</option>
+            </select>
+          </label>
+        )}
+      </Step>
+
+      <div className="modal-foot">
+        <button className="btn btn-primary" onClick={handleLevelUp} disabled={levelUp.isPending || Boolean(plan.boon && !boon)}>
+          {levelUp.isPending ? 'Levelling…' : plan.boon && !boon ? 'Choose a Boon first' : `Level up to ${plan.toLevel}`}
+        </button>
+      </div>
+    </Modal>
+  );
+}

frontend/src/components/Modal.tsx

@@ -0,0 +1,73 @@
+import { useEffect, useId, useRef, type ReactNode } from 'react';
+import { createPortal } from 'react-dom';
+
+// A pop-out over the page: a centred window on a wide screen, the whole
+// screen on a phone. Escape, the ✕ and a click outside all close it, and the
+// page behind stays where it was.
+export function Modal({
+  title,
+  subtitle,
+  wide,
+  onClose,
+  children,
+}: {
+  title: ReactNode;
+  subtitle?: ReactNode;
+  wide?: boolean;
+  onClose: () => void;
+  children: ReactNode;
+}) {
+  const titleId = useId();
+  const windowRef = useRef<HTMLDivElement>(null);
+  // A click only closes if it both started and ended outside the window, so
+  // dragging to select text in a field never does.
+  const pressedOutside = useRef(false);
+  const close = useRef(onClose);
+  useEffect(() => {
+    close.current = onClose;
+  });
+
+  useEffect(() => {
+    const opener = document.activeElement as HTMLElement | null;
+    const onKey = (e: KeyboardEvent) => {
+      if (e.key === 'Escape') close.current();
+    };
+    document.addEventListener('keydown', onKey);
+    const scroll = document.body.style.overflow;
+    document.body.style.overflow = 'hidden';
+    windowRef.current?.focus();
+    return () => {
+      document.removeEventListener('keydown', onKey);
+      document.body.style.overflow = scroll;
+      opener?.focus?.();
+    };
+  }, []);
+
+  return createPortal(
+    <div
+      className="modal-backdrop"
+      onMouseDown={(e) => {
+        pressedOutside.current = e.target === e.currentTarget;
+      }}
+      onClick={(e) => {
+        if (pressedOutside.current && e.target === e.currentTarget) onClose();
+      }}
+    >
+      <div ref={windowRef} className={`modal${wide ? ' is-wide' : ''}`} role="dialog" aria-modal="true" aria-labelledby={titleId} tabIndex={-1}>
+        <div className="modal-head">
+          <div style={{ minWidth: 0 }}>
+            <h2 id={titleId} className="modal-title">
+              {title}
+            </h2>
+            {subtitle && <div className="combatant-sub">{subtitle}</div>}
+          </div>
+          <button type="button" className="btn btn-ghost" aria-label="Close" onClick={onClose}>
+            ✕
+          </button>
+        </div>
+        <div className="modal-body">{children}</div>
+      </div>
+    </div>,
+    document.body
+  );
+}

frontend/src/components/NumberInput.tsx

@@ -0,0 +1,48 @@
+import type { ChangeEvent, FocusEvent, InputHTMLAttributes } from 'react';
+
+type NumberInputProps = Omit<InputHTMLAttributes<HTMLInputElement>, 'type' | 'min' | 'max' | 'step'> & {
+  min?: number;
+  max?: number;
+  // For a field that always holds a number (a level, a bonus): if it is left
+  // empty, it goes back to its starting value instead of being saved blank.
+  keepValue?: boolean;
+};
+
+// A whole-number field that cannot hold a value outside its limits. A plain
+// <input type="number" max={20}> only limits the arrow buttons; typing 500
+// into it works. This one corrects the text as it is typed: anything above
+// `max` becomes `max`, anything below `min` becomes `min`, decimals are
+// dropped. Works the same whether the field is controlled (`value`) or not
+// (`defaultValue`): the handlers passed in see the corrected value.
+export function NumberInput({ min, max, keepValue, onChange, onBlur, ...rest }: NumberInputProps) {
+  function limit(input: HTMLInputElement, leaving: boolean) {
+    const raw = input.value;
+    if (raw === '' || raw === '-') {
+      // Nothing typed yet, or the start of a negative number.
+      if (leaving) input.value = keepValue ? String(rest.defaultValue ?? rest.value ?? min ?? 0) : '';
+      return;
+    }
+    let value = Math.trunc(Number(raw));
+    if (Number.isNaN(value)) {
+      input.value = '';
+      return;
+    }
+    if (max !== undefined && value > max) value = max;
+    // While typing, a value below a minimum above 1 may just be unfinished
+    // ("1" on the way to "15"), so that case waits until the field is left.
+    if (min !== undefined && value < min && (leaving || min <= 1)) value = min;
+    if (String(value) !== raw) input.value = String(value);
+  }
+
+  function handleChange(e: ChangeEvent<HTMLInputElement>) {
+    limit(e.target, false);
+    onChange?.(e);
+  }
+
+  function handleBlur(e: FocusEvent<HTMLInputElement>) {
+    limit(e.target, true);
+    onBlur?.(e);
+  }
+
+  return <input {...rest} type="number" inputMode="numeric" step={1} min={min} max={max} onChange={handleChange} onBlur={handleBlur} />;
+}

frontend/src/components/Paginated.tsx

@@ -1,37 +1,17 @@
-import { useMemo, useState } from 'react';
-
-// Small generic pager shared by every list-turned-table in the app, so page
-// state isn't hand-rolled per screen. Resets to page 1 whenever the
-// underlying item count shrinks below the current page (e.g. after a delete
-// or a filter change).
-export function usePagination<T>(items: T[] | undefined, pageSize = 10) {
-  const [page, setPage] = useState(1);
-  const all = items || [];
-  const pageCount = Math.max(1, Math.ceil(all.length / pageSize));
-  const safePage = Math.min(page, pageCount);
-  const pageItems = useMemo(() => all.slice((safePage - 1) * pageSize, safePage * pageSize), [all, safePage, pageSize]);
-
-  return {
-    page: safePage,
-    pageCount,
-    pageItems,
-    total: all.length,
-    setPage,
-    nextPage: () => setPage((p) => Math.min(pageCount, p + 1)),
-    prevPage: () => setPage((p) => Math.max(1, p - 1)),
-  };
-}
-
+// The controls for a paged list; the page state itself is hooks/usePagination.
 export function Pagination({
   page,
   pageCount,
   onPrev,
   onNext,
+  onJump,
 }: {
   page: number;
   pageCount: number;
   onPrev: () => void;
   onNext: () => void;
+  // Given this, the page number is a list to pick any page from.
+  onJump?: (page: number) => void;
 }) {
   if (pageCount <= 1) return null;
   return (
@@ -39,9 +19,23 @@ export function Pagination({
       <button type="button" className="btn btn-ghost" onClick={onPrev} disabled={page <= 1}>
         ← Prev
       </button>
-      <span className="pagination-status">
-        Page {page} of {pageCount}
-      </span>
+      {onJump && pageCount > 2 ? (
+        <label className="pagination-status flex-row gap-sm">
+          Page
+          <select aria-label="Go to page" value={page} onChange={(e) => onJump(Number(e.target.value))}>
+            {Array.from({ length: pageCount }, (_, i) => i + 1).map((n) => (
+              <option key={n} value={n}>
+                {n}
+              </option>
+            ))}
+          </select>
+          of {pageCount}
+        </label>
+      ) : (
+        <span className="pagination-status">
+          Page {page} of {pageCount}
+        </span>
+      )}
       <button type="button" className="btn btn-ghost" onClick={onNext} disabled={page >= pageCount}>
         Next →
       </button>

frontend/src/components/ProtectedRoute.tsx

@@ -1,5 +1,5 @@
 import { Navigate, Outlet } from 'react-router-dom';
-import { useAuth } from '../auth/AuthContext';
+import { useAuth } from '../auth/useAuth';
 import { Spinner } from './Spinner';
 
 export function ProtectedRoute() {

frontend/src/components/QuickStatsDrawer.tsx

@@ -1,96 +0,0 @@
-import { useState } from 'react';
-import { useQuickStats } from '../api/queries';
-import { Spinner, ErrorBanner } from './Spinner';
-import { fmtMod, hpBarClass } from '../lib/format';
-
-export function QuickStatsFab({ characterId }: { characterId: string }) {
-  const [open, setOpen] = useState(false);
-  return (
-    <>
-      <button className="fab-quickstats" onClick={() => setOpen(true)} title="Quick Stats" aria-label="Open quick stats">
-        ⚡
-      </button>
-      {open && <QuickStatsDrawer characterId={characterId} onClose={() => setOpen(false)} />}
-    </>
-  );
-}
-
-export function QuickStatsDrawer({ characterId, onClose }: { characterId: string; onClose: () => void }) {
-  const { data, isLoading, error } = useQuickStats(characterId, true);
-
-  return (
-    <>
-      <div className="drawer-backdrop" onClick={onClose} />
-      <div className="drawer">
-        <div className="flex-between">
-          <h2 style={{ margin: 0 }}>Quick Stats</h2>
-          <button className="btn btn-ghost" onClick={onClose}>
-            ✕
-          </button>
-        </div>
-        {isLoading && <Spinner label="Reading the sheet…" />}
-        {error && <ErrorBanner message="Could not load quick stats." />}
-        {data && (
-          <div className="mt-md">
-            <h3 style={{ margin: 0 }}>{data.name}</h3>
-            <div className="grid grid-cols-3 mt-sm">
-              <div className="stat-block">
-                <span className="stat-label">HP</span>
-                <span className="stat-value">
-                  {data.currentHp}/{data.maxHp}
-                </span>
-                {data.tempHp > 0 && <span className="stat-sub">+{data.tempHp} temp</span>}
-              </div>
-              <div className="stat-block">
-                <span className="stat-label">AC</span>
-                <span className="stat-value">{data.armorClass}</span>
-              </div>
-              <div className="stat-block">
-                <span className="stat-label">Initiative</span>
-                <span className="stat-value">{fmtMod(data.initiative)}</span>
-              </div>
-            </div>
-            <div className="hp-bar-track mt-sm">
-              <div className={hpBarClass(data.currentHp, data.maxHp)} style={{ width: `${Math.max(0, Math.min(100, (data.currentHp / data.maxHp) * 100))}%` }} />
-            </div>
-
-            {data.spellcasting && (
-              <div className="card mt-md">
-                <div className="card-title">Spellcasting</div>
-                <p style={{ margin: 0 }}>
-                  Save DC {data.spellcasting.saveDC} · Attack {fmtMod(data.spellcasting.attackBonus)}
-                </p>
-              </div>
-            )}
-
-            <div className="card mt-md">
-              <div className="card-title">Weapons</div>
-              {data.weapons.length === 0 && <p style={{ color: 'var(--text-muted)', margin: 0 }}>No weapons equipped.</p>}
-              {data.weapons.map((w) => (
-                <div key={w.characterWeaponId} className="flex-between mt-sm">
-                  <div>
-                    <strong>{w.name}</strong>
-                    {w.equipped && <span className="badge" style={{ marginLeft: 6 }}>equipped</span>}
-                    <p style={{ margin: 0, fontSize: '0.85rem', color: 'var(--text-muted)' }}>
-                      Lv {w.level} · {w.damageDice} {w.damageType} {fmtMod(w.damageBonus)}
-                    </p>
-                  </div>
-                  <span className="stat-value" style={{ fontSize: '1.1rem' }}>
-                    {fmtMod(w.attackBonus)}
-                  </span>
-                </div>
-              ))}
-            </div>
-
-            {data.specialAbilities && (
-              <div className="card mt-md">
-                <div className="card-title">Special Abilities</div>
-                <p style={{ margin: 0, whiteSpace: 'pre-wrap' }}>{data.specialAbilities}</p>
-              </div>
-            )}
-          </div>
-        )}
-      </div>
-    </>
-  );
-}

frontend/src/components/RestModal.tsx

@@ -0,0 +1,234 @@
+import { useState } from 'react';
+import { useRest } from '../api/queries';
+import { CLASS_LABELS, extractErrorMessage, fmtMod, slotsSummary } from '../lib/format';
+import { Modal } from './Modal';
+import { NumberInput } from './NumberInput';
+import { ErrorBanner } from './Spinner';
+import { LifeBadge } from './DeathSaves';
+import type { CharacterSummary, RestResult, RestType } from '../api/types';
+
+const REST_LABELS: Record<RestType, string> = { SHORT: 'Short rest', LONG: 'Long rest' };
+
+// What a rest did for one character, in a line or two.
+function ResultRow({ result, type }: { result: RestResult; type: RestType }) {
+  if (result.skipped) {
+    return (
+      <div className="reward-row">
+        <strong>{result.name}</strong>
+        <div className="combatant-sub">{result.skipped}</div>
+      </div>
+    );
+  }
+  const { hitDice } = result;
+  const lines: string[] = [];
+  if (hitDice.spent > 0) {
+    const dice = `${hitDice.spent}d${hitDice.size}`;
+    const rolled = hitDice.rolls ? `the site rolled ${hitDice.rolls.join(' + ')}` : `rolled ${hitDice.total}`;
+    const con = hitDice.conBonus === 0 ? '' : ` ${hitDice.conBonus > 0 ? '+' : '−'} ${Math.abs(hitDice.conBonus)} Constitution`;
+    lines.push(`Spent ${dice}: ${rolled}${con}, healing ${hitDice.healed}.`);
+  }
+  if (hitDice.regained > 0) lines.push(`${hitDice.regained} Hit ${hitDice.regained === 1 ? 'Die' : 'Dice'} back.`);
+  lines.push(`Hit Dice left: ${hitDice.left} of ${hitDice.of}.`);
+  if (result.slotsRestored) lines.push('All spell slots back.');
+  if (type === 'SHORT' && hitDice.spent === 0 && !result.slotsRestored) lines.unshift('Rested, with no Hit Dice spent.');
+
+  return (
+    <div className="reward-row">
+      <div className="flex-between">
+        <strong>{result.name}</strong>
+        <span className="mono">
+          HP {result.hpBefore === result.hpAfter ? result.hpAfter : `${result.hpBefore} → ${result.hpAfter}`}/{result.maxHp}
+          {result.tempHp > 0 && ` +${result.tempHp}`}
+        </span>
+      </div>
+      <div className="combatant-sub">{lines.join(' ')}</div>
+      {result.notes.map((note) => (
+        <div key={note} className="combatant-sub">
+          ✦ {note}
+        </div>
+      ))}
+    </div>
+  );
+}
+
+// The DM's rest button: pick who rests and for how long. A long rest is
+// worked out by the site. A short rest says which Hit Dice each character can
+// roll; the DM types how many they spend and what they rolled (or leaves the
+// roll to the site), and the healing is added up from that.
+export function RestModal({ campaignId, characters, onClose }: { campaignId: string; characters: CharacterSummary[]; onClose: () => void }) {
+  const rest = useRest(campaignId);
+  const party = characters.filter((c) => c.buildStage === 'COMPLETE');
+  const [type, setType] = useState<RestType>('SHORT');
+  // The dead are left out to begin with: a rest does nothing for them.
+  const [picked, setPicked] = useState<Set<string>>(() => new Set(party.filter((c) => c.deathSaves.state !== 'DEAD').map((c) => c.id)));
+  const [dice, setDice] = useState<Record<string, string>>({});
+  const [rolled, setRolled] = useState<Record<string, string>>({});
+  const [error, setError] = useState<string | null>(null);
+  const [done, setDone] = useState<{ type: RestType; results: RestResult[] } | null>(null);
+
+  function toggle(id: string) {
+    setPicked((current) => {
+      const next = new Set(current);
+      if (!next.delete(id)) next.add(id);
+      return next;
+    });
+  }
+
+  async function handleRest() {
+    setError(null);
+    try {
+      const resting = party.filter((c) => picked.has(c.id));
+      setDone(
+        await rest.mutateAsync({
+          type,
+          characters: resting.map((c) => {
+            const spent = type === 'SHORT' ? Number(dice[c.id]) || 0 : 0;
+            return { characterId: c.id, hitDice: spent, rolled: spent > 0 && rolled[c.id] ? Number(rolled[c.id]) : null };
+          }),
+        })
+      );
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  if (done) {
+    return (
+      <Modal title={`${REST_LABELS[done.type]} taken`} subtitle="What it did for each character" onClose={onClose}>
+        {done.results.map((result) => (
+          <ResultRow key={result.characterId} result={result} type={done.type} />
+        ))}
+        {done.type === 'SHORT' && (
+          <p className="combatant-sub mt-md" style={{ marginBottom: 0 }}>
+            Also back on a short rest, for the players to note: a fighter's Second Wind and Action Surge, a monk's ki, a cleric's Channel
+            Divinity, a druid's Wild Shape.
+          </p>
+        )}
+        {done.type === 'LONG' && (
+          <p className="combatant-sub mt-md" style={{ marginBottom: 0 }}>
+            "Per day" abilities are back too. One long rest per 24 hours.
+          </p>
+        )}
+        <div className="modal-foot">
+          <button className="btn btn-primary" onClick={onClose}>
+            Done
+          </button>
+        </div>
+      </Modal>
+    );
+  }
+
+  return (
+    <Modal title="Rest" subtitle="Pick who rests, and for how long" wide onClose={onClose}>
+      <div className="flex-row flex-wrap" role="radiogroup" aria-label="Rest type">
+        {(['SHORT', 'LONG'] as const).map((option) => (
+          <button
+            key={option}
+            type="button"
+            role="radio"
+            aria-checked={type === option}
+            className={`btn ${type === option ? 'btn-primary' : ''}`}
+            onClick={() => setType(option)}
+          >
+            {option === 'SHORT' ? '☕ Short rest (1 hour)' : '🛏 Long rest (8 hours)'}
+          </button>
+        ))}
+      </div>
+      <p className="subtitle">
+        {type === 'SHORT'
+          ? 'Each character can spend Hit Dice to heal: they roll each die and add their Constitution modifier. Type how many dice they spend and what the dice added up to, or leave the total empty and the site rolls them. A warlock gets every spell slot back.'
+          : 'Everyone resting goes to full HP, gets every spell slot back, and regains spent Hit Dice up to half their level (at least one). Temp HP is gone, except what the Hardy Boon gives.'}
+      </p>
+
+      {error && <ErrorBanner message={error} />}
+
+      <div className="flex-between">
+        <h3 className="section-label" style={{ margin: 0 }}>
+          Who rests ({party.filter((c) => picked.has(c.id)).length} of {party.length})
+        </h3>
+        <span className="flex-row gap-sm">
+          <button className="btn btn-ghost" onClick={() => setPicked(new Set(party.map((c) => c.id)))}>
+            All
+          </button>
+          <button className="btn btn-ghost" onClick={() => setPicked(new Set())}>
+            None
+          </button>
+        </span>
+      </div>
+      {party.length === 0 && <p className="combatant-sub">No finished characters in this campaign yet.</p>}
+      {party.map((c) => {
+        const isPicked = picked.has(c.id);
+        const hitDice = c.hitDice;
+        const spent = Math.min(Number(dice[c.id]) || 0, hitDice?.remaining ?? 0);
+        const slots = slotsSummary(c.spellSlots);
+        return (
+          <div key={c.id} className={`reward-row${isPicked ? '' : ' is-awarded'}`}>
+            <label className="checkbox-row" style={{ margin: 0 }}>
+              <input type="checkbox" checked={isPicked} onChange={() => toggle(c.id)} />
+              <span style={{ flex: 1, minWidth: 0 }}>
+                <strong>{c.name}</strong>{' '}
+                <span className="combatant-sub">
+                  {c.characterClass && CLASS_LABELS[c.characterClass]} · Level {c.level}
+                </span>{' '}
+                <LifeBadge deathSaves={c.deathSaves} />
+                <span className="combatant-sub" style={{ display: 'block' }}>
+                  HP {c.currentHp}/{c.maxHp}
+                  {c.tempHp > 0 && ` +${c.tempHp}`}
+                  {hitDice && ` · Hit Dice ${hitDice.remaining} of ${hitDice.count} (d${hitDice.size}) left`}
+                  {slots && ` · Slots ${slots}`}
+                </span>
+              </span>
+            </label>
+            {type === 'SHORT' && isPicked && hitDice && (
+              <div className="flex-row flex-wrap gap-sm mt-sm rest-dice">
+                {hitDice.remaining === 0 ? (
+                  <span className="combatant-sub">No Hit Dice left to spend until a long rest.</span>
+                ) : (
+                  <>
+                    <label className="flex-row gap-sm">
+                      Spend
+                      <NumberInput
+                        min={0}
+                        max={hitDice.remaining}
+                        placeholder="0"
+                        aria-label={`Hit Dice ${c.name} spends`}
+                        value={dice[c.id] ?? ''}
+                        onChange={(e) => setDice((d) => ({ ...d, [c.id]: e.target.value }))}
+                        style={{ width: 64 }}
+                      />
+                      of {hitDice.remaining} d{hitDice.size}
+                    </label>
+                    {spent > 0 && (
+                      <label className="flex-row gap-sm">
+                        Roll {spent}d{hitDice.size}:
+                        <NumberInput
+                          min={spent}
+                          max={spent * hitDice.size}
+                          placeholder="site rolls"
+                          aria-label={`What ${c.name}'s Hit Dice added up to`}
+                          title={`What the ${spent}d${hitDice.size} added up to (${spent} to ${spent * hitDice.size}). Leave empty and the site rolls.`}
+                          value={rolled[c.id] ?? ''}
+                          onChange={(e) => setRolled((r) => ({ ...r, [c.id]: e.target.value }))}
+                          style={{ width: 96 }}
+                        />
+                        <span className="combatant-sub">
+                          {fmtMod(spent * hitDice.conModifier)} Constitution ({fmtMod(hitDice.conModifier)} a die)
+                        </span>
+                      </label>
+                    )}
+                  </>
+                )}
+              </div>
+            )}
+          </div>
+        );
+      })}
+
+      <div className="modal-foot">
+        <button className="btn btn-primary" onClick={handleRest} disabled={picked.size === 0 || rest.isPending}>
+          {rest.isPending ? 'Resting…' : `Take the ${REST_LABELS[type].toLowerCase()}`}
+        </button>
+      </div>
+    </Modal>
+  );
+}

frontend/src/components/SectionNav.tsx

@@ -0,0 +1,37 @@
+import { useEffect, useRef } from 'react';
+
+export interface Section {
+  id: string;
+  label: string;
+  icon: string;
+  // How many things are in it, shown beside its name.
+  count?: number;
+}
+
+// The parts of a page that shows one part at a time. A row of buttons on a
+// wide screen; on a phone a single line that scrolls sideways, with the
+// current part kept in view.
+export function SectionNav({ sections, current, onSelect }: { sections: Section[]; current: string; onSelect: (id: string) => void }) {
+  const currentRef = useRef<HTMLButtonElement>(null);
+  useEffect(() => {
+    currentRef.current?.scrollIntoView({ block: 'nearest', inline: 'center' });
+  }, [current]);
+
+  return (
+    <nav className="section-nav" aria-label="Parts of this campaign">
+      {sections.map((section) => (
+        <button
+          key={section.id}
+          ref={section.id === current ? currentRef : undefined}
+          type="button"
+          className={`jump-link${section.id === current ? ' is-active' : ''}`}
+          aria-current={section.id === current ? 'page' : undefined}
+          onClick={() => onSelect(section.id)}
+        >
+          <span aria-hidden>{section.icon}</span> {section.label}
+          {section.count !== undefined && <span className="section-count">{section.count}</span>}
+        </button>
+      ))}
+    </nav>
+  );
+}

frontend/src/components/SpellSlots.tsx

@@ -0,0 +1,90 @@
+import { useSpellSlots } from '../api/queries';
+import { slotLevelLabel } from '../lib/format';
+import { InfoTip } from './InfoTip';
+import type { SpellSlots as SpellSlotsInfo } from '../api/types';
+
+// The slot tracker: a row of pips for each level of slot the character has,
+// filled while the slot is still there to spend. `canUse` is the character's
+// own player or the DM: "Use" spends one. Getting a slot back is the DM's
+// alone: for them each pip is a button that sets how many are left (clicking
+// the last filled one takes it off), and "All back" refills the lot.
+export function SpellSlotTracker({
+  characterId,
+  name,
+  slots,
+  canUse,
+  isDM,
+  onError,
+}: {
+  characterId: string;
+  name: string;
+  slots: SpellSlotsInfo;
+  canUse: boolean;
+  isDM: boolean;
+  onError?: (err: unknown) => void;
+}) {
+  const spellSlots = useSpellSlots(characterId);
+  const send = (action: Parameters<typeof spellSlots.mutate>[0]) => spellSlots.mutate(action, { onError });
+  const anySpent = slots.levels.some((slot) => slot.used > 0);
+
+  return (
+    <div className="spell-slots">
+      <div className="flex-between flex-wrap">
+        <span className="death-tally">
+          Spell slots <InfoTip term="SPELL_SLOTS" />
+        </span>
+        {isDM && anySpent && (
+          <button className="btn btn-ghost" onClick={() => send({ action: 'restore' })} disabled={spellSlots.isPending} title={`Give ${name} every spell slot back`}>
+            All back
+          </button>
+        )}
+      </div>
+      {slots.levels.map((slot) => {
+        const label = slotLevelLabel(slot.level);
+        return (
+          <div key={slot.level} className="slot-row">
+            <span className="slot-level">{label}</span>
+            <span className="slot-pips" role="group" aria-label={`${slot.remaining} of ${slot.max} ${label}-level slots left`}>
+              {Array.from({ length: slot.max }, (_, i) => i + 1).map((n) => {
+                const className = `slot-pip${n <= slot.remaining ? ' is-filled' : ''}`;
+                const left = n === slot.remaining ? n - 1 : n;
+                return isDM ? (
+                  <button
+                    key={n}
+                    type="button"
+                    className={className}
+                    aria-label={`Set ${label}-level slots left to ${left}`}
+                    disabled={spellSlots.isPending}
+                    onClick={() => send({ action: 'set', level: slot.level, used: slot.max - left })}
+                  />
+                ) : (
+                  <span key={n} className={className} />
+                );
+              })}
+            </span>
+            <span className="mono slot-count">
+              {slot.remaining}/{slot.max}
+            </span>
+            {canUse && (
+              <button
+                className="btn"
+                onClick={() => send({ action: 'use', level: slot.level })}
+                disabled={slot.remaining === 0 || spellSlots.isPending}
+                title={slot.remaining === 0 ? `No ${label}-level slots left` : `Spend one ${label}-level slot`}
+                aria-label={`Use a ${label}-level slot`}
+              >
+                Use
+              </button>
+            )}
+          </div>
+        );
+      })}
+      <p className="combatant-sub" style={{ margin: '0.4rem 0 0' }}>
+        {slots.kind === 'PACT'
+          ? 'Every spell cast with one of these is cast at that level. They all come back on a short or long rest.'
+          : 'A higher slot can cast a lower spell. Cantrips need no slot. They all come back on a long rest.'}
+        {canUse && !isDM && ' Once used, only the DM can give one back.'}
+      </p>
+    </div>
+  );
+}

frontend/src/components/TradePanel.tsx

@@ -0,0 +1,196 @@
+import { useState } from 'react';
+import { Link } from 'react-router-dom';
+import { useBuyWare, useExchangeWithNpc } from '../api/queries';
+import { NumberInput } from './NumberInput';
+import { WaresEditor } from './Wares';
+import { stockLabel, wareName } from '../lib/wares';
+import { formatMoney, formatPurse } from '../lib/format';
+import type { CharacterSummary, Encounter, Item, SaleOffer, Weapon } from '../api/types';
+
+type ExchangeSide = 'GOLD' | 'CASH';
+
+// Trade in a quest: changing gold and cash with an NPC who does that, at
+// their own rate, and buying what the NPCs in the scene — or the scene itself
+// — have for sale. Everyone sees what is on offer; a player trades for their
+// own character, the DM for anyone. Trading is open only while the quest is in
+// progress, and there is none in a battle. The DM sets it all up: an NPC's
+// rate and wares on the campaign page, the scene's own wares here.
+export function TradePanel({
+  encounter,
+  isDM,
+  userId,
+  characters,
+  weapons,
+  items,
+  onError,
+}: {
+  encounter: Encounter;
+  isDM: boolean;
+  userId: string | undefined;
+  characters: CharacterSummary[];
+  weapons: Weapon[];
+  items: Item[];
+  onError: (err: unknown) => void;
+}) {
+  const exchange = useExchangeWithNpc(encounter.id);
+  const buy = useBuyWare(encounter.id);
+
+  const [traderId, setTraderId] = useState('');
+  const [amounts, setAmounts] = useState<Record<string, string>>({});
+  const [sides, setSides] = useState<Record<string, ExchangeSide>>({});
+  const [done, setDone] = useState<string | null>(null);
+
+  if (encounter.mode !== 'QUEST') return null;
+
+  const here = (encounter.participants ?? []).filter((p) => !p.hidden);
+  const npcs = here.flatMap((p) => (p.npc ? [p.npc] : []));
+  const changers = npcs.filter((npc) => npc.exchangeGold && npc.exchangeCash);
+  const stalls: [string, string, SaleOffer[]][] = [
+    ...npcs.map((npc): [string, string, SaleOffer[]] => [npc.id, `${npc.name} sells`, npc.wares ?? []]),
+    ['here', 'For sale here', encounter.wares ?? []],
+  ];
+  const openStalls = stalls.filter(([, , wares]) => wares.length > 0);
+  if (!isDM && changers.length === 0 && openStalls.length === 0) return null;
+
+  // Who can do the trading: a player's own characters in the scene, or for the DM anyone's.
+  const traders = here.flatMap((p) => (p.character && (isDM || p.character.userId === userId) ? [p.character] : []));
+  const trader = traders.find((c) => c.id === traderId) ?? traders[0];
+  const purse = characters.find((c) => c.id === trader?.id);
+  const open = encounter.status === 'ACTIVE';
+  const busy = exchange.isPending || buy.isPending;
+
+  function handleExchange(npc: (typeof changers)[number]) {
+    const from = sides[npc.id] ?? 'GOLD';
+    const amount = Math.floor(Number(amounts[npc.id]));
+    if (!trader || !(amount > 0)) return;
+    setDone(null);
+    exchange.mutate(
+      { characterId: trader.id, npcId: npc.id, from, amount },
+      {
+        onError,
+        onSuccess: ({ received, currency }) => {
+          setDone(`${trader.name} changed ${formatMoney(amount, from, true)} for ${formatMoney(received, currency, true)} with ${npc.name}.`);
+          setAmounts((a) => ({ ...a, [npc.id]: '' }));
+        },
+      }
+    );
+  }
+
+  function handleBuy(ware: SaleOffer) {
+    if (!trader) return;
+    setDone(null);
+    buy.mutate(
+      { wareId: ware.id, characterId: trader.id },
+      { onError, onSuccess: () => setDone(`${trader.name} bought ${(ware.weapon ?? ware.item)?.name} for ${formatMoney(ware.price, ware.currency, true)}.`) }
+    );
+  }
+
+  return (
+    <div className="card">
+      <div className="card-title">Trade</div>
+      {!open && (
+        <p className="combatant-sub" style={{ marginTop: 0 }}>
+          {encounter.status === 'PLANNING' ? 'Trading opens once the quest is in progress.' : 'The quest is over; trading is closed.'}
+        </p>
+      )}
+      {traders.length > 0 && (
+        <div className="flex-row flex-wrap gap-sm">
+          <select aria-label="Who is trading" value={trader?.id ?? ''} onChange={(e) => setTraderId(e.target.value)} style={{ flex: 1, minWidth: 110 }}>
+            {traders.map((c) => (
+              <option key={c.id} value={c.id}>
+                {c.name}
+              </option>
+            ))}
+          </select>
+          {purse && purse.gold !== null && <span className="mono">{formatPurse(purse)}</span>}
+        </div>
+      )}
+      {traders.length === 0 && (changers.length > 0 || openStalls.length > 0) && (
+        <p className="combatant-sub">{isDM ? 'Add a character to the scene to trade for them.' : 'Your character has to be in the scene to trade.'}</p>
+      )}
+      {done && <p className="combatant-sub">✓ {done}</p>}
+
+      {changers.map((npc) => {
+        const from = sides[npc.id] ?? 'GOLD';
+        const to = from === 'GOLD' ? 'CASH' : 'GOLD';
+        const rate = { GOLD: npc.exchangeGold ?? 1, CASH: npc.exchangeCash ?? 1 };
+        const amount = Math.floor(Number(amounts[npc.id]));
+        const whole = amount > 0 && amount % rate[from] === 0;
+        return (
+          <div key={npc.id} className="reward-row">
+            <strong>💱 {npc.name}</strong>
+            <span className="combatant-sub">
+              {' '}
+              changes {formatMoney(rate.GOLD, 'GOLD', true)} for {formatMoney(rate.CASH, 'CASH')}, either way. No silver or copper.
+            </span>
+            <div className="flex-row flex-wrap gap-sm mt-sm">
+              <NumberInput
+                min={1}
+                max={1000000}
+                placeholder="Amount"
+                aria-label={`How much to change with ${npc.name}`}
+                value={amounts[npc.id] ?? ''}
+                onChange={(e) => setAmounts((a) => ({ ...a, [npc.id]: e.target.value }))}
+                style={{ width: 90 }}
+              />
+              <select
+                aria-label={`What to hand ${npc.name}`}
+                value={from}
+                onChange={(e) => setSides((s) => ({ ...s, [npc.id]: e.target.value as ExchangeSide }))}
+              >
+                <option value="GOLD">gold into cash</option>
+                <option value="CASH">cash into gold</option>
+              </select>
+              <button className="btn" disabled={!open || !trader || !whole || busy} onClick={() => handleExchange(npc)}>
+                {whole ? `Get ${formatMoney((amount / rate[from]) * rate[to], to, true)}` : 'Exchange'}
+              </button>
+            </div>
+            {amount > 0 && !whole && (
+              <div className="combatant-sub">
+                Hand over {from.toLowerCase()} in multiples of {rate[from]}.
+              </div>
+            )}
+          </div>
+        );
+      })}
+
+      {openStalls.map(([key, label, wares]) => (
+        <div key={key} className="mt-sm">
+          <div className="section-label">🛒 {label}</div>
+          {wares.map((ware) => (
+            <div key={ware.id} className="reward-row">
+              <div className="flex-between">
+                <span>
+                  <strong>{wareName(ware)}</strong>
+                  <span className="combatant-sub"> · {stockLabel(ware)}</span>
+                </span>
+                <button className="btn" disabled={!open || !trader || ware.stock === 0 || busy} onClick={() => handleBuy(ware)}>
+                  Buy · {formatMoney(ware.price, ware.currency)}
+                </button>
+              </div>
+              {ware.item?.description && <div className="combatant-sub">{ware.item.description}</div>}
+            </div>
+          ))}
+        </div>
+      ))}
+
+      {isDM && (
+        <div className="mt-md">
+          <div className="section-label">Set up: for sale at this encounter</div>
+          <p className="combatant-sub" style={{ marginTop: 0 }}>
+            For a stall or a machine with nobody behind it. An NPC's wares and exchange rate are set under "Trade" on the{' '}
+            <Link to={`/campaigns/${encounter.campaignId}`}>campaign page</Link>, and follow the NPC into every quest.
+          </p>
+          <WaresEditor
+            campaignId={encounter.campaignId}
+            seller={{ encounterId: encounter.id }}
+            wares={encounter.wares ?? []}
+            weapons={weapons}
+            items={items}
+            onError={onError}
+          />
+        </div>
+      )}
+    </div>
+  );
+}

frontend/src/components/Wares.tsx

@@ -0,0 +1,204 @@
+import { useState } from 'react';
+import { useCreateWare, useDeleteWare, usePatchWare } from '../api/queries';
+import { NumberInput } from './NumberInput';
+import { COIN_LABELS, CURRENCIES, formatMoney } from '../lib/format';
+import { scaledDamageDice, MAX_GEAR_LEVEL } from '../lib/previewCalc';
+import { stockLabel, wareName } from '../lib/wares';
+import type { Currency, Item, SaleOffer, Weapon } from '../api/types';
+
+// One ware in the DM's list. "Edit" swaps the line for its price and stock.
+function WareRow({ campaignId, ware, onError }: { campaignId: string; ware: SaleOffer; onError: (err: unknown) => void }) {
+  const patchWare = usePatchWare(campaignId);
+  const deleteWare = useDeleteWare(campaignId);
+  const [editing, setEditing] = useState(false);
+  const [price, setPrice] = useState('');
+  const [currency, setCurrency] = useState<Currency>(ware.currency);
+  const [stock, setStock] = useState('');
+
+  function startEditing() {
+    setPrice(String(ware.price));
+    setCurrency(ware.currency);
+    setStock(ware.stock === null ? '' : String(ware.stock));
+    setEditing(true);
+  }
+
+  function handleSave() {
+    const amount = Math.floor(Number(price));
+    if (!(amount > 0)) return;
+    patchWare.mutate({ id: ware.id, price: amount, currency, stock: stock === '' ? null : Number(stock) }, { onError, onSuccess: () => setEditing(false) });
+  }
+
+  return (
+    <div style={{ padding: '0.3rem 0', borderBottom: '1px solid var(--border-soft)' }}>
+      <div className="flex-between">
+        <span>
+          {wareName(ware)} — <strong className="mono">{formatMoney(ware.price, ware.currency)}</strong>
+          <span className="combatant-sub"> · {stockLabel(ware)}</span>
+        </span>
+        <span className="flex-row">
+          <button className="btn btn-ghost" aria-label={`Edit the price and stock of ${wareName(ware)}`} onClick={() => (editing ? setEditing(false) : startEditing())}>
+            {editing ? 'Cancel' : 'Edit'}
+          </button>
+          <button className="btn btn-ghost" aria-label={`Stop selling ${wareName(ware)}`} onClick={() => deleteWare.mutate(ware.id, { onError })}>
+            ✕
+          </button>
+        </span>
+      </div>
+      {editing && (
+        <div className="flex-row flex-wrap gap-sm mt-sm">
+          <NumberInput min={1} max={1000000} placeholder="Price" aria-label="Price for one" value={price} onChange={(e) => setPrice(e.target.value)} style={{ width: 90 }} />
+          <select aria-label="Price is in" value={currency} onChange={(e) => setCurrency(e.target.value as Currency)}>
+            {CURRENCIES.map((c) => (
+              <option key={c} value={c}>
+                {COIN_LABELS[c]}
+              </option>
+            ))}
+          </select>
+          <NumberInput
+            min={0}
+            max={9999}
+            placeholder="Stock (empty = no limit)"
+            aria-label="How many are in stock"
+            title="How many can be bought. Leave empty for no limit."
+            value={stock}
+            onChange={(e) => setStock(e.target.value)}
+            style={{ flex: 1, minWidth: 120 }}
+          />
+          <button className="btn btn-primary" onClick={handleSave} disabled={!price || patchWare.isPending}>
+            Save
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}
+
+// The DM's list of what one seller has for sale — an NPC, or an encounter
+// itself — with a form to put something from the campaign pools up for sale.
+export function WaresEditor({
+  campaignId,
+  seller,
+  wares,
+  weapons,
+  items,
+  onError,
+}: {
+  campaignId: string;
+  seller: { npcId: string } | { encounterId: string };
+  wares: SaleOffer[];
+  weapons: Weapon[];
+  items: Item[];
+  onError: (err: unknown) => void;
+}) {
+  const createWare = useCreateWare(campaignId);
+
+  const [kind, setKind] = useState<'item' | 'weapon'>('item');
+  const [poolId, setPoolId] = useState('');
+  const [level, setLevel] = useState('');
+  const [price, setPrice] = useState('');
+  const [currency, setCurrency] = useState<Currency>('GOLD');
+  const [stock, setStock] = useState('');
+
+  const pool: (Weapon | Item)[] = kind === 'weapon' ? weapons : items;
+  const picked = pool.find((entry) => entry.id === poolId);
+
+  function handleAdd() {
+    const amount = Math.floor(Number(price));
+    if (!picked || !(amount > 0)) return;
+    createWare.mutate(
+      {
+        ...seller,
+        ...(kind === 'weapon' ? { weaponId: picked.id } : { itemId: picked.id }),
+        price: amount,
+        currency,
+        level: level ? Number(level) : undefined,
+        stock: stock === '' ? null : Number(stock),
+      },
+      {
+        onError,
+        onSuccess: () => {
+          setPoolId('');
+          setLevel('');
+          setPrice('');
+          setStock('');
+        },
+      }
+    );
+  }
+
+  return (
+    <div>
+      {wares.length === 0 && (
+        <p className="combatant-sub" style={{ marginTop: 0 }}>
+          Nothing for sale yet.
+        </p>
+      )}
+      {wares.map((ware) => (
+        <WareRow key={ware.id} campaignId={campaignId} ware={ware} onError={onError} />
+      ))}
+      <div className="flex-row flex-wrap gap-sm mt-sm">
+        <select
+          aria-label="What kind of thing to sell"
+          value={kind}
+          onChange={(e) => {
+            setKind(e.target.value as typeof kind);
+            setPoolId('');
+            setLevel('');
+          }}
+        >
+          <option value="item">Item</option>
+          <option value="weapon">Weapon</option>
+        </select>
+        <select
+          aria-label={kind === 'weapon' ? 'Weapon to sell' : 'Item to sell'}
+          value={poolId}
+          onChange={(e) => {
+            setPoolId(e.target.value);
+            setLevel('');
+          }}
+          style={{ flex: 1, minWidth: 110 }}
+        >
+          <option value="">{pool.length ? 'Choose…' : 'The pool is empty'}</option>
+          {pool.map((entry) => (
+            <option key={entry.id} value={entry.id}>
+              {entry.name}
+            </option>
+          ))}
+        </select>
+        {picked && (
+          <select aria-label="Level" value={level || picked.minLevel} onChange={(e) => setLevel(e.target.value)}>
+            {Array.from({ length: MAX_GEAR_LEVEL - picked.minLevel + 1 }, (_, i) => picked.minLevel + i).map((l) => (
+              <option key={l} value={l}>
+                Lv {l}
+                {picked.damageDice ? ` · ${scaledDamageDice(picked.damageDice, l, picked.damageScaling, picked.minLevel)}` : ''}
+              </option>
+            ))}
+          </select>
+        )}
+      </div>
+      <div className="flex-row flex-wrap gap-sm mt-sm">
+        <NumberInput min={1} max={1000000} placeholder="Price" aria-label="Price for one" value={price} onChange={(e) => setPrice(e.target.value)} style={{ width: 90 }} />
+        <select aria-label="Price is in" value={currency} onChange={(e) => setCurrency(e.target.value as Currency)}>
+          {CURRENCIES.map((c) => (
+            <option key={c} value={c}>
+              {COIN_LABELS[c]}
+            </option>
+          ))}
+        </select>
+        <NumberInput
+          min={0}
+          max={9999}
+          placeholder="Stock (empty = no limit)"
+          aria-label="How many are in stock"
+          title="How many can be bought. Leave empty for no limit."
+          value={stock}
+          onChange={(e) => setStock(e.target.value)}
+          style={{ flex: 1, minWidth: 120 }}
+        />
+        <button className="btn btn-primary" onClick={handleAdd} disabled={!picked || !price || createWare.isPending}>
+          Put up for sale
+        </button>
+      </div>
+    </div>
+  );
+}

frontend/src/components/campaign/CampaignSearch.tsx

@@ -0,0 +1,55 @@
+import type { ReactNode } from 'react';
+import { EntryRow } from './parts';
+
+export interface SearchHit {
+  key: string;
+  title: string;
+  detail?: ReactNode;
+  badges?: ReactNode;
+  // Where it goes: a page of its own, or whatever `onPick` opens.
+  to?: string;
+  onPick?: () => void;
+}
+
+export interface SearchGroup {
+  label: string;
+  icon: string;
+  hits: SearchHit[];
+}
+
+// More than this of one kind and the rest are counted, not listed.
+const SHOWN_PER_GROUP = 12;
+
+// Everything in the campaign that a search found, a kind at a time.
+export function CampaignSearch({ query, groups }: { query: string; groups: SearchGroup[] }) {
+  const found = groups.filter((g) => g.hits.length > 0);
+  const total = found.reduce((sum, g) => sum + g.hits.length, 0);
+
+  return (
+    <div className="card" aria-live="polite">
+      <div className="card-title">
+        <span>
+          {total} {total === 1 ? 'result' : 'results'} for "{query}"
+        </span>
+      </div>
+      {total === 0 && <p style={{ color: 'var(--text-muted)', margin: 0 }}>Nothing in this campaign matches. Try fewer words, or part of a name.</p>}
+      {found.map((group) => (
+        <div key={group.label} className="search-group">
+          <div className="section-label">
+            <span aria-hidden>{group.icon}</span> {group.label} ({group.hits.length})
+          </div>
+          <div className="entry-list">
+            {group.hits.slice(0, SHOWN_PER_GROUP).map((hit) => (
+              <EntryRow key={hit.key} name={hit.title} meta={hit.detail} badges={hit.badges} to={hit.to} onOpen={hit.onPick} />
+            ))}
+          </div>
+          {group.hits.length > SHOWN_PER_GROUP && (
+            <p className="combatant-sub" style={{ margin: '0.4rem 0 0' }}>
+              …and {group.hits.length - SHOWN_PER_GROUP} more. Add a word to narrow it down.
+            </p>
+          )}
+        </div>
+      ))}
+    </div>
+  );
+}

frontend/src/components/campaign/EntryDetail.tsx

@@ -0,0 +1,363 @@
+import { useState, type ReactNode } from 'react';
+import { useDeleteMonster, useDeletePoolEntry, usePatchPoolEntry, useUpdateMonster } from '../../api/queries';
+import { Modal } from '../Modal';
+import { NumberInput } from '../NumberInput';
+import { ErrorBanner } from '../Spinner';
+import { EffectsEditor } from '../EffectsEditor';
+import { WaresEditor } from '../Wares';
+import { extractErrorMessage, fmtMod, spellLevelLabel, spellRequirementLabel } from '../../lib/format';
+import { abilityLine, rateLabel, type EntryKind, type EntryRef } from '../../lib/campaignEntries';
+import { Field, MonsterForm, ScalingSelect, SpellDamageSelect, StartLevelSelect } from './parts';
+import type { GearEffect, Item, Monster, Npc, Spell, Weapon } from '../../api/types';
+
+const KIND_NOUNS: Record<EntryKind, string> = { weapon: 'weapon', item: 'item', spell: 'spell', monster: 'monster', npc: 'NPC' };
+const ATTACK_ABILITY_LABELS: Record<Weapon['attackAbility'], string> = { STR: 'STR', DEX: 'DEX', FINESSE: 'Finesse (the better of STR and DEX)' };
+
+function Chip({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <div className="stat-chip">
+      <span>{label}</span>
+      <b>{children}</b>
+    </div>
+  );
+}
+
+// The foot of every pop-out: taking the thing out of the campaign.
+function RemoveButton({ name, warning, pending, onRemove }: { name: string; warning: string; pending: boolean; onRemove: () => void }) {
+  return (
+    <div className="modal-foot">
+      <button className="btn btn-danger" disabled={pending} onClick={() => window.confirm(`Remove ${name}? ${warning}`) && onRemove()}>
+        Remove from campaign
+      </button>
+    </div>
+  );
+}
+
+// A weapon or an item: the two share levels, growth and effects.
+function GearDetail({ campaignId, pool, entry, added, onClose }: { added: ReactNode; campaignId: string; pool: 'weapons' | 'items'; entry: Weapon | Item; onClose: () => void }) {
+  const patch = usePatchPoolEntry(campaignId, pool);
+  const remove = useDeletePoolEntry(campaignId, pool);
+  const [effects, setEffects] = useState<GearEffect[]>(entry.effects ?? []);
+  const [note, setNote] = useState(entry.effectNote ?? '');
+  const [effectsSaved, setEffectsSaved] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const onError = (err: unknown) => setError(extractErrorMessage(err));
+  const weapon = 'damageType' in entry ? entry : null;
+
+  return (
+    <Modal title={entry.name} subtitle={weapon ? 'Weapon' : 'Item'} onClose={onClose}>
+      {added}
+      {error && <ErrorBanner message={error} />}
+      <div className="stat-chips">
+        {weapon ? (
+          <>
+            <Chip label="Base damage">
+              {weapon.damageDice} {weapon.damageType}
+            </Chip>
+            <Chip label="Attacks with">{ATTACK_ABILITY_LABELS[weapon.attackAbility]}</Chip>
+            {weapon.rangeNormal && (
+              <Chip label="Range">
+                {weapon.rangeNormal}
+                {weapon.rangeLong ? `/${weapon.rangeLong}` : ''} ft
+              </Chip>
+            )}
+            {weapon.properties.length > 0 && <Chip label="Properties">{weapon.properties.join(', ')}</Chip>}
+          </>
+        ) : (
+          entry.damageDice && <Chip label="Base dice">{entry.damageDice}</Chip>
+        )}
+      </div>
+      {!weapon && 'description' in entry && entry.description && <p className="mt-sm" style={{ whiteSpace: 'pre-wrap' }}>{entry.description}</p>}
+
+      <div className="grid grid-cols-2 mt-md">
+        <Field label="Level it starts at">
+          {(id) => <StartLevelSelect id={id} value={entry.minLevel} onChange={(minLevel) => patch.mutate({ id: entry.id, minLevel }, { onError })} />}
+        </Field>
+        {entry.damageDice && (
+          <Field label="Growth per level">
+            {(id) => <ScalingSelect id={id} value={entry.damageScaling} onChange={(damageScaling) => patch.mutate({ id: entry.id, damageScaling }, { onError })} />}
+          </Field>
+        )}
+      </div>
+      <p className="combatant-sub mt-sm">
+        A character must be at least its level to use it.
+        {entry.damageDice &&
+          ' The dice above are what it does at the level it starts at. When you level up a character\'s copy they grow one small step per level (1d4 → 1d6 → 1d8 → 1d10 → 1d12 → 2d6 → …): two steps for Powerful gear, three for Legendary.'}
+      </p>
+      <label className="checkbox-row mt-md">
+        <input type="checkbox" checked={entry.isStartingOption} onChange={(e) => patch.mutate({ id: entry.id, isStartingOption: e.target.checked }, { onError })} />
+        Starting option: a player may pick it while building a character
+      </label>
+
+      <div className="section-label mt-md">While equipped</div>
+      <p className="combatant-sub" style={{ marginTop: 0 }}>
+        These count for a character only while it is equipped and they are high enough level to use it. Armor is an item with
+        +AC; a penalty is a negative number.
+      </p>
+      <EffectsEditor
+        effects={effects}
+        note={note}
+        onChange={(nextEffects, nextNote) => {
+          setEffects(nextEffects);
+          setNote(nextNote);
+          setEffectsSaved(false);
+        }}
+      />
+      <div className="flex-row mt-sm">
+        <button
+          className="btn btn-primary"
+          disabled={patch.isPending}
+          onClick={() => patch.mutate({ id: entry.id, effects, effectNote: note.trim() || null }, { onError, onSuccess: () => setEffectsSaved(true) })}
+        >
+          Save Effects
+        </button>
+        {effectsSaved && <span className="combatant-sub">Saved.</span>}
+      </div>
+
+      <RemoveButton name={entry.name} warning="Any character holding it loses it." pending={remove.isPending} onRemove={() => remove.mutate(entry.id, { onError, onSuccess: onClose })} />
+    </Modal>
+  );
+}
+
+function SpellDetail({ campaignId, spell, added, onClose }: { added: ReactNode; campaignId: string; spell: Spell; onClose: () => void }) {
+  const patch = usePatchPoolEntry(campaignId, 'spells');
+  const remove = useDeletePoolEntry(campaignId, 'spells');
+  const [error, setError] = useState<string | null>(null);
+  const onError = (err: unknown) => setError(extractErrorMessage(err));
+
+  return (
+    <Modal title={spell.name} subtitle={[spellLevelLabel(spell.level), spell.school, spellRequirementLabel(spell.level)].filter(Boolean).join(' · ')} onClose={onClose}>
+      {added}
+      {error && <ErrorBanner message={error} />}
+      <div className="stat-chips">
+        {spell.castingTime && <Chip label="Casting time">{spell.castingTime}</Chip>}
+        {spell.range && <Chip label="Range">{spell.range}</Chip>}
+        {spell.duration && <Chip label="Duration">{spell.duration}</Chip>}
+      </div>
+      <p className="mt-sm" style={{ whiteSpace: 'pre-wrap' }}>{spell.description || 'No description.'}</p>
+
+      <div className="grid grid-cols-2 mt-md">
+        <Field label="Damage">
+          {(id) => <SpellDamageSelect id={id} spellName={spell.name} value={spell.damageDice} onChange={(damageDice) => patch.mutate({ id: spell.id, damageDice }, { onError })} />}
+        </Field>
+      </div>
+      <label className="checkbox-row mt-md">
+        <input type="checkbox" checked={spell.isStartingOption} onChange={(e) => patch.mutate({ id: spell.id, isStartingOption: e.target.checked }, { onError })} />
+        Starting option: a player may pick it while building a character
+      </label>
+      <label className="checkbox-row mt-sm">
+        <input type="checkbox" checked={spell.revives} onChange={(e) => patch.mutate({ id: spell.id, revives: e.target.checked }, { onError })} />
+        Revives the dead: a character who can cast it may revive a dead ally on their turn in a battle
+      </label>
+
+      <RemoveButton name={spell.name} warning="Any character holding it loses it." pending={remove.isPending} onRemove={() => remove.mutate(spell.id, { onError, onSuccess: onClose })} />
+    </Modal>
+  );
+}
+
+function MonsterDetail({ campaignId, monster, added, onClose }: { added: ReactNode; campaignId: string; monster: Monster; onClose: () => void }) {
+  const update = useUpdateMonster(campaignId);
+  const remove = useDeleteMonster(campaignId);
+  const [editing, setEditing] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const onError = (err: unknown) => setError(extractErrorMessage(err));
+
+  return (
+    <Modal title={editing ? `Editing ${monster.name}` : monster.name} subtitle="Monster" wide onClose={onClose}>
+      {added}
+      {error && <ErrorBanner message={error} />}
+      {editing ? (
+        <MonsterForm
+          monster={monster}
+          saving={update.isPending}
+          onCancel={() => setEditing(false)}
+          onSave={async (stats) => {
+            setError(null);
+            try {
+              await update.mutateAsync({ id: monster.id, ...stats });
+              setEditing(false);
+            } catch (err) {
+              onError(err);
+              throw err;
+            }
+          }}
+        />
+      ) : (
+        <>
+          <div className="stat-chips">
+            <Chip label="CR">{monster.challengeRating || '—'}</Chip>
+            <Chip label="AC">{monster.ac}</Chip>
+            <Chip label="HP">{monster.maxHp}</Chip>
+            <Chip label="Speed">{monster.speed}</Chip>
+            <Chip label="Attack">{fmtMod(monster.attackBonus)}</Chip>
+            <Chip label="Damage">{monster.damageDice || '—'}</Chip>
+          </div>
+          <p className="mono mt-sm" style={{ color: 'var(--text-muted)', fontSize: '0.9rem' }}>{abilityLine(monster)}</p>
+          {monster.specialTrait && (
+            <p>
+              <strong>Trait:</strong> {monster.specialTrait}
+            </p>
+          )}
+          {monster.notes && <p style={{ color: 'var(--text-muted)', whiteSpace: 'pre-wrap' }}>{monster.notes}</p>}
+          <button className="btn" onClick={() => setEditing(true)}>
+            Edit stat block
+          </button>
+          <RemoveButton
+            name={monster.name}
+            warning="Copies already in encounters stay, but lose their stat block."
+            pending={remove.isPending}
+            onRemove={() => remove.mutate(monster.id, { onError, onSuccess: onClose })}
+          />
+        </>
+      )}
+    </Modal>
+  );
+}
+
+// An NPC: who they are, and what they trade — the rate they change gold and
+// cash at, and their wares. Players meet both on the encounter page, in a
+// quest the NPC is part of.
+function NpcDetail({ campaignId, npc, weapons, items, added, onClose }: { added: ReactNode; campaignId: string; npc: Npc; weapons: Weapon[]; items: Item[]; onClose: () => void }) {
+  const patch = usePatchPoolEntry(campaignId, 'npcs');
+  const remove = useDeletePoolEntry(campaignId, 'npcs');
+  const [gold, setGold] = useState(npc.exchangeGold ? String(npc.exchangeGold) : '');
+  const [cash, setCash] = useState(npc.exchangeCash ? String(npc.exchangeCash) : '');
+  const [error, setError] = useState<string | null>(null);
+  const onError = (err: unknown) => setError(extractErrorMessage(err));
+  const rate = rateLabel(npc);
+  const hasStats = npc.ac !== null || npc.maxHp !== null || npc.attackBonus !== null || Boolean(npc.damageDice);
+
+  return (
+    <Modal
+      title={npc.name}
+      subtitle={
+        <span className="flex-row flex-wrap gap-sm">
+          {npc.role || 'NPC'}
+          <span className={`badge badge-${npc.disposition.toLowerCase()}`}>{npc.disposition}</span>
+          {rate && <span className="badge">💱 {rate}</span>}
+        </span>
+      }
+      wide
+      onClose={onClose}
+    >
+      {added}
+      {error && <ErrorBanner message={error} />}
+      {npc.description ? <p style={{ whiteSpace: 'pre-wrap' }}>{npc.description}</p> : <p style={{ color: 'var(--text-muted)' }}>No description for the players.</p>}
+      {npc.dmNotes && <p style={{ color: 'var(--text-muted)', whiteSpace: 'pre-wrap' }}>🔒 {npc.dmNotes}</p>}
+      {hasStats && (
+        <div className="stat-chips">
+          {npc.ac !== null && <Chip label="AC">{npc.ac}</Chip>}
+          {npc.maxHp !== null && <Chip label="HP">{npc.maxHp}</Chip>}
+          {npc.attackBonus !== null && <Chip label="Attack">{fmtMod(npc.attackBonus)}</Chip>}
+          {npc.damageDice && <Chip label="Damage">{npc.damageDice}</Chip>}
+        </div>
+      )}
+
+      <div className="section-label mt-md">Changes money</div>
+      <p className="combatant-sub" style={{ marginTop: 0 }}>
+        Set a rate and the party can change gold into cash, or cash into gold, with {npc.name}. Silver and copper are not
+        taken. Leave it empty for someone who does not change money.
+      </p>
+      <div className="flex-row flex-wrap gap-sm">
+        <NumberInput min={1} max={1000000} aria-label="Gold side of the rate" placeholder="Gold" value={gold} onChange={(e) => setGold(e.target.value)} style={{ width: 90 }} />
+        <span>gold =</span>
+        <span>$</span>
+        <NumberInput min={1} max={1000000} aria-label="Cash side of the rate" placeholder="Cash" value={cash} onChange={(e) => setCash(e.target.value)} style={{ width: 90 }} />
+        <button
+          className="btn"
+          disabled={!gold || !cash || patch.isPending}
+          onClick={() => patch.mutate({ id: npc.id, exchangeGold: Number(gold), exchangeCash: Number(cash) }, { onError })}
+        >
+          Save rate
+        </button>
+        {rate && (
+          <button
+            className="btn btn-ghost"
+            disabled={patch.isPending}
+            onClick={() =>
+              patch.mutate(
+                { id: npc.id, exchangeGold: null, exchangeCash: null },
+                {
+                  onError,
+                  onSuccess: () => {
+                    setGold('');
+                    setCash('');
+                  },
+                }
+              )
+            }
+          >
+            Stop changing money
+          </button>
+        )}
+      </div>
+
+      <div className="section-label mt-md">For sale</div>
+      <WaresEditor campaignId={campaignId} seller={{ npcId: npc.id }} wares={npc.wares ?? []} weapons={weapons} items={items} onError={onError} />
+
+      <RemoveButton
+        name={npc.name}
+        warning="They leave every encounter they are in, and their wares go with them."
+        pending={remove.isPending}
+        onRemove={() => remove.mutate(npc.id, { onError, onSuccess: onClose })}
+      />
+    </Modal>
+  );
+}
+
+// The pop-out for whichever weapon, item, spell, monster or NPC is open.
+// Nothing shows if it is no longer in the campaign.
+export function EntryDetail({
+  campaignId,
+  entry,
+  weapons,
+  items,
+  spells,
+  monsters,
+  npcs,
+  onAddAnother,
+  onClose,
+}: {
+  campaignId: string;
+  entry: EntryRef;
+  weapons: Weapon[];
+  items: Item[];
+  spells: Spell[];
+  monsters: Monster[];
+  npcs: Npc[];
+  // Given for something added by hand a moment ago: opens the form it came from again.
+  onAddAnother?: () => void;
+  onClose: () => void;
+}) {
+  const added = onAddAnother && (
+    <div className="added-bar">
+      <span>✓ Added to the campaign.</span>
+      <button className="btn btn-primary" onClick={onAddAnother}>
+        + Add another {KIND_NOUNS[entry.kind]}
+      </button>
+    </div>
+  );
+  const find = <T extends { id: string }>(list: T[]) => list.find((e) => e.id === entry.id);
+  switch (entry.kind) {
+    case 'weapon': {
+      const weapon = find(weapons);
+      return weapon ? <GearDetail key={weapon.id} added={added} campaignId={campaignId} pool="weapons" entry={weapon} onClose={onClose} /> : null;
+    }
+    case 'item': {
+      const item = find(items);
+      return item ? <GearDetail key={item.id} added={added} campaignId={campaignId} pool="items" entry={item} onClose={onClose} /> : null;
+    }
+    case 'spell': {
+      const spell = find(spells);
+      return spell ? <SpellDetail key={spell.id} added={added} campaignId={campaignId} spell={spell} onClose={onClose} /> : null;
+    }
+    case 'monster': {
+      const monster = find(monsters);
+      return monster ? <MonsterDetail key={monster.id} added={added} campaignId={campaignId} monster={monster} onClose={onClose} /> : null;
+    }
+    case 'npc': {
+      const npc = find(npcs);
+      return npc ? <NpcDetail key={npc.id} added={added} campaignId={campaignId} npc={npc} weapons={weapons} items={items} onClose={onClose} /> : null;
+    }
+  }
+}

frontend/src/components/campaign/PoolSections.tsx

@@ -0,0 +1,584 @@
+import { useState, type FormEvent, type ReactNode } from 'react';
+import {
+  useAddItemFromLibrary,
+  useAddMonsterFromLibrary,
+  useAddSpellFromLibrary,
+  useAddWeaponFromLibrary,
+  useCampaignLibrary,
+  useCreateItem,
+  useCreateMonster,
+  useCreateNpc,
+  useCreateSpell,
+  useCreateWeapon,
+} from '../../api/queries';
+import { Modal } from '../Modal';
+import { NumberInput } from '../NumberInput';
+import { ErrorBanner, Spinner } from '../Spinner';
+import { effectsSummary } from '../../lib/gear';
+import { extractErrorMessage, fmtMod, spellLevelLabel, spellRequirementLabel } from '../../lib/format';
+import { MAX_GEAR_LEVEL } from '../../lib/previewCalc';
+import { abilityLine, rateLabel, type EntryRef } from '../../lib/campaignEntries';
+import { EntryList, Field, LibraryPicker, MonsterForm, ScalingSelect, SpellDamageSelect, StartLevelSelect } from './parts';
+import type { CampaignLibrary, Item, LibraryItem, LibraryMonster, LibrarySpell, LibraryWeapon, Monster, Npc, NpcDisposition, Spell, Weapon } from '../../api/types';
+
+interface SectionProps<T> {
+  campaignId: string;
+  entries: T[] | undefined;
+  onOpen: (entry: EntryRef) => void;
+  // The "add by hand" pop-out is wanted from outside: "add another", pressed
+  // in the pop-out of the one just added.
+  formRequested: boolean;
+  onFormClosed: () => void;
+}
+
+// Which of a list's two "add" pop-outs is open: the form, or the library.
+type Adding = 'form' | 'library' | null;
+
+// Which "add" pop-out a list has open, and what went wrong in it.
+function useAdding(formRequested: boolean, onFormClosed: () => void) {
+  const [adding, setAdding] = useState<Adding>(null);
+  const [error, setError] = useState<string | null>(null);
+  return {
+    adding: formRequested ? ('form' as const) : adding,
+    error,
+    setError,
+    open: (next: Adding) => {
+      setError(null);
+      setAdding(next);
+    },
+    close: () => {
+      setError(null);
+      setAdding(null);
+      onFormClosed();
+    },
+  };
+}
+
+function SectionCard({
+  title,
+  addLabel,
+  hasLibrary = true,
+  onAdd,
+  intro,
+  children,
+}: {
+  title: string;
+  addLabel: string;
+  hasLibrary?: boolean;
+  onAdd: (adding: Adding) => void;
+  intro: ReactNode;
+  children: ReactNode;
+}) {
+  return (
+    <div className="card">
+      <div className="card-title">
+        <span>{title}</span>
+        <div className="flex-row gap-sm">
+          {hasLibrary && (
+            <button className="btn" onClick={() => onAdd('library')}>
+              📚 From Library
+            </button>
+          )}
+          <button className="btn btn-primary" onClick={() => onAdd('form')}>
+            {addLabel}
+          </button>
+        </div>
+      </div>
+      <p className="subtitle" style={{ marginTop: 0 }}>
+        {intro}
+      </p>
+      {children}
+    </div>
+  );
+}
+
+// The built-in library in a pop-out. It is a large download, so it is only
+// asked for once one of these is opened.
+function LibraryModal<T extends { key: string; name: string }>({
+  campaignId,
+  title,
+  pick,
+  taken,
+  adding,
+  onAdd,
+  placeholder,
+  renderMeta,
+  renderDetail,
+  error,
+  onClose,
+}: {
+  campaignId: string;
+  title: string;
+  pick: (library: CampaignLibrary) => T[];
+  taken: { name: string }[] | undefined;
+  adding: boolean;
+  onAdd: (key: string) => void;
+  placeholder: string;
+  renderMeta: (item: T) => string;
+  renderDetail?: (item: T) => string | null;
+  error: string | null;
+  onClose: () => void;
+}) {
+  const { data: library, isError } = useCampaignLibrary(campaignId);
+  return (
+    <Modal title={title} subtitle="Each entry can be added once. This stays open so you can add several." wide onClose={onClose}>
+      {error && <ErrorBanner message={error} />}
+      {isError && <ErrorBanner message="Could not load the library." />}
+      {!library && !isError && <Spinner label="Fetching the library…" />}
+      {library && (
+        <LibraryPicker<T> items={pick(library)} taken={taken} adding={adding} onAdd={onAdd} placeholder={placeholder} renderMeta={renderMeta} renderDetail={renderDetail} />
+      )}
+    </Modal>
+  );
+}
+
+const StartingOption = () => (
+  <label className="checkbox-row" style={{ alignSelf: 'end', paddingBottom: '0.6rem' }}>
+    <input type="checkbox" name="isStartingOption" />
+    Starting option (a player may pick it while building a character)
+  </label>
+);
+
+const startingBadge = (entry: { isStartingOption: boolean }) => entry.isStartingOption && <span className="badge">Starting</span>;
+
+export function WeaponsSection({ campaignId, entries, onOpen, formRequested, onFormClosed }: SectionProps<Weapon>) {
+  const createWeapon = useCreateWeapon(campaignId);
+  const addFromLibrary = useAddWeaponFromLibrary(campaignId);
+  const { adding, error, setError, open, close } = useAdding(formRequested, onFormClosed);
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault();
+    const fd = new FormData(e.target as HTMLFormElement);
+    setError(null);
+    try {
+      const weapon = await createWeapon.mutateAsync({
+        name: String(fd.get('name')).trim(),
+        damageDice: String(fd.get('damageDice')).trim(),
+        damageType: String(fd.get('damageType')).trim(),
+        attackAbility: fd.get('attackAbility') as Weapon['attackAbility'],
+        properties: [],
+        rangeNormal: null,
+        rangeLong: null,
+        damageScaling: Number(fd.get('damageScaling')),
+        minLevel: Number(fd.get('minLevel')),
+        isStartingOption: fd.get('isStartingOption') === 'on',
+        effects: [],
+        effectNote: null,
+      });
+      close();
+      onOpen({ kind: 'weapon', id: weapon.id, isNew: true });
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  return (
+    <SectionCard
+      title="Weapons"
+      addLabel="+ Add Weapon"
+      onAdd={open}
+      intro={
+        <>
+          The weapons you hand out on each character's sheet. Open one to set the level it starts at, how fast its damage grows
+          (levels 1–{MAX_GEAR_LEVEL}), whether a new character may start with it, and what it does while equipped.
+        </>
+      }
+    >
+      <EntryList
+        entries={entries}
+        noun="weapons"
+        emptyText="No weapons yet. Add one by hand, or copy some from the library."
+        searchText={(w) => [w.name, w.damageDice, w.damageType, effectsSummary(w.effects, w.effectNote)]}
+        renderMeta={(w) => [`${w.damageDice} ${w.damageType}`, `Lv ${w.minLevel}`, effectsSummary(w.effects, w.effectNote) && `✦ ${effectsSummary(w.effects, w.effectNote)}`].filter(Boolean).join(' · ')}
+        renderBadges={startingBadge}
+        onOpen={(id) => onOpen({ kind: 'weapon', id })}
+      />
+      {adding === 'library' && (
+        <LibraryModal<LibraryWeapon>
+          campaignId={campaignId}
+          title="Weapon library"
+          pick={(library) => library.weapons}
+          taken={entries}
+          adding={addFromLibrary.isPending}
+          onAdd={(key) => addFromLibrary.mutate(key, { onError: (err) => setError(extractErrorMessage(err)) })}
+          placeholder="Search the weapon library…"
+          renderMeta={(w) => `${w.category} · ${w.damageDice} ${w.damageType} · starts at level 1`}
+          renderDetail={(w) => effectsSummary(w.effects, w.effectNote)}
+          error={error}
+          onClose={close}
+        />
+      )}
+      {adding === 'form' && (
+        <Modal title="Add a weapon" subtitle="What it does while equipped is set once it is added." onClose={close}>
+          {error && <ErrorBanner message={error} />}
+          <form onSubmit={handleSubmit}>
+            <div className="grid grid-cols-2">
+              <Field label="Name">{(id) => <input id={id} name="name" required maxLength={80} />}</Field>
+              <Field label="Damage at its starting level">{(id) => <input id={id} name="damageDice" placeholder="e.g. 1d8" required />}</Field>
+              <Field label="Damage type">{(id) => <input id={id} name="damageType" placeholder="e.g. slashing" required />}</Field>
+              <Field label="Attacks with">
+                {(id) => (
+                  <select id={id} name="attackAbility" defaultValue="STR">
+                    <option value="STR">STR</option>
+                    <option value="DEX">DEX</option>
+                    <option value="FINESSE">Finesse (the better of the two)</option>
+                  </select>
+                )}
+              </Field>
+              <Field label="Level it starts at">{(id) => <StartLevelSelect id={id} name="minLevel" />}</Field>
+              <Field label="Growth per level">{(id) => <ScalingSelect id={id} name="damageScaling" />}</Field>
+              <StartingOption />
+            </div>
+            <button type="submit" className="btn btn-primary mt-md" disabled={createWeapon.isPending}>
+              Add Weapon
+            </button>
+          </form>
+        </Modal>
+      )}
+    </SectionCard>
+  );
+}
+
+export function ItemsSection({ campaignId, entries, onOpen, formRequested, onFormClosed }: SectionProps<Item>) {
+  const createItem = useCreateItem(campaignId);
+  const addFromLibrary = useAddItemFromLibrary(campaignId);
+  const { adding, error, setError, open, close } = useAdding(formRequested, onFormClosed);
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault();
+    const fd = new FormData(e.target as HTMLFormElement);
+    setError(null);
+    try {
+      const item = await createItem.mutateAsync({
+        name: String(fd.get('name')).trim(),
+        description: String(fd.get('description') || '').trim() || null,
+        damageDice: String(fd.get('damageDice') || '').trim() || null,
+        damageScaling: Number(fd.get('damageScaling')),
+        minLevel: Number(fd.get('minLevel')),
+        isStartingOption: fd.get('isStartingOption') === 'on',
+        effects: [],
+        effectNote: null,
+      });
+      close();
+      onOpen({ kind: 'item', id: item.id, isNew: true });
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  return (
+    <SectionCard
+      title="Items"
+      addLabel="+ Add Item"
+      onAdd={open}
+      intro={
+        <>
+          Rope, potions, armor, quest items. Armor, shields, rings and the like are items with effects: open the item and set
+          what it does while equipped (chain mail: +6 AC, −10 Speed).
+        </>
+      }
+    >
+      <EntryList
+        entries={entries}
+        noun="items"
+        emptyText="No items yet. Add rope, potions, armor, quest items…"
+        searchText={(i) => [i.name, i.description, i.damageDice, effectsSummary(i.effects, i.effectNote)]}
+        renderMeta={(i) => [effectsSummary(i.effects, i.effectNote) && `✦ ${effectsSummary(i.effects, i.effectNote)}`, i.damageDice, i.description].filter(Boolean).join(' · ') || `Lv ${i.minLevel}`}
+        renderBadges={startingBadge}
+        onOpen={(id) => onOpen({ kind: 'item', id })}
+      />
+      {adding === 'library' && (
+        <LibraryModal<LibraryItem>
+          campaignId={campaignId}
+          title="Item library"
+          pick={(library) => library.items}
+          taken={entries}
+          adding={addFromLibrary.isPending}
+          onAdd={(key) => addFromLibrary.mutate(key, { onError: (err) => setError(extractErrorMessage(err)) })}
+          placeholder="Search the item library: armor, shields, worn gear, supplies…"
+          renderMeta={(i) => [i.category, effectsSummary(i.effects, i.effectNote), i.damageDice].filter(Boolean).join(' · ')}
+          renderDetail={(i) => i.description}
+          error={error}
+          onClose={close}
+        />
+      )}
+      {adding === 'form' && (
+        <Modal title="Add an item" subtitle="What it does while equipped is set once it is added." onClose={close}>
+          {error && <ErrorBanner message={error} />}
+          <form onSubmit={handleSubmit}>
+            <div className="grid grid-cols-2">
+              <Field label="Name">{(id) => <input id={id} name="name" required maxLength={80} />}</Field>
+              <Field label="Dice (optional)">{(id) => <input id={id} name="damageDice" placeholder="e.g. 2d4+2" maxLength={20} />}</Field>
+              <Field label="Description (optional)" style={{ gridColumn: '1 / -1' }}>
+                {(id) => <input id={id} name="description" />}
+              </Field>
+              <Field label="Level it starts at">{(id) => <StartLevelSelect id={id} name="minLevel" />}</Field>
+              <Field label="Growth of its dice per level">{(id) => <ScalingSelect id={id} name="damageScaling" />}</Field>
+              <StartingOption />
+            </div>
+            <button type="submit" className="btn btn-primary mt-md" disabled={createItem.isPending}>
+              Add Item
+            </button>
+          </form>
+        </Modal>
+      )}
+    </SectionCard>
+  );
+}
+
+export function SpellsSection({ campaignId, entries, onOpen, formRequested, onFormClosed }: SectionProps<Spell>) {
+  const createSpell = useCreateSpell(campaignId);
+  const addFromLibrary = useAddSpellFromLibrary(campaignId);
+  const { adding, error, setError, open, close } = useAdding(formRequested, onFormClosed);
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault();
+    const fd = new FormData(e.target as HTMLFormElement);
+    setError(null);
+    try {
+      const spell = await createSpell.mutateAsync({
+        name: String(fd.get('name')).trim(),
+        level: Number(fd.get('level')),
+        school: String(fd.get('school') || '').trim() || null,
+        castingTime: null,
+        range: null,
+        duration: null,
+        description: String(fd.get('description') || '').trim() || null,
+        damageDice: String(fd.get('damageDice') || '') || null,
+        isStartingOption: fd.get('isStartingOption') === 'on',
+        revives: fd.get('revives') === 'on',
+      });
+      close();
+      onOpen({ kind: 'spell', id: spell.id, isNew: true });
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  return (
+    <SectionCard
+      title="Spells"
+      addLabel="+ Add Spell"
+      onAdd={open}
+      intro="The spells you hand out on each character's sheet. A character must be at least a spell's level to cast it. Open one to change its damage, or whether a new character may start with it."
+    >
+      <EntryList
+        entries={entries}
+        noun="spells"
+        emptyText="No spells yet. Add one by hand, or copy some from the library."
+        searchText={(s) => [s.name, s.school, s.description, spellLevelLabel(s.level)]}
+        renderMeta={(s) => [spellLevelLabel(s.level), s.damageDice && `${s.damageDice} damage`, s.description].filter(Boolean).join(' · ')}
+        renderBadges={(s) => (
+          <>
+            {s.revives && <span className="badge">Revives</span>}
+            {startingBadge(s)}
+          </>
+        )}
+        onOpen={(id) => onOpen({ kind: 'spell', id })}
+      />
+      {adding === 'library' && (
+        <LibraryModal<LibrarySpell>
+          campaignId={campaignId}
+          title="Spell library"
+          pick={(library) => library.spells}
+          taken={entries}
+          adding={addFromLibrary.isPending}
+          onAdd={(key) => addFromLibrary.mutate(key, { onError: (err) => setError(extractErrorMessage(err)) })}
+          placeholder="Search the spell library…"
+          renderMeta={(s) =>
+            [spellLevelLabel(s.level), spellRequirementLabel(s.level), s.damageDice ? `${s.damageDice} damage` : 'no damage', s.school].filter(Boolean).join(' · ')
+          }
+          renderDetail={(s) => s.description}
+          error={error}
+          onClose={close}
+        />
+      )}
+      {adding === 'form' && (
+        <Modal title="Add a spell" onClose={close}>
+          {error && <ErrorBanner message={error} />}
+          <form onSubmit={handleSubmit}>
+            <div className="grid grid-cols-2">
+              <Field label="Name">{(id) => <input id={id} name="name" required maxLength={80} />}</Field>
+              <Field label="Level">
+                {(id) => (
+                  <select id={id} name="level" defaultValue={0}>
+                    {[0, 1, 2, 3, 4, 5, 6, 7, 8, 9].map((level) => (
+                      <option key={level} value={level}>
+                        {spellLevelLabel(level)}
+                      </option>
+                    ))}
+                  </select>
+                )}
+              </Field>
+              <Field label="School (optional)">{(id) => <input id={id} name="school" />}</Field>
+              <Field label="Damage">{(id) => <SpellDamageSelect id={id} name="damageDice" />}</Field>
+              <Field label="What it does (one sentence)" style={{ gridColumn: '1 / -1' }}>
+                {(id) => <input id={id} name="description" maxLength={4000} required />}
+              </Field>
+              <StartingOption />
+              <label className="checkbox-row" style={{ alignSelf: 'end', paddingBottom: '0.6rem' }}>
+                <input type="checkbox" name="revives" />
+                Revives the dead (its caster may revive a dead ally on their turn in a battle)
+              </label>
+            </div>
+            <button type="submit" className="btn btn-primary mt-md" disabled={createSpell.isPending}>
+              Add Spell
+            </button>
+          </form>
+        </Modal>
+      )}
+    </SectionCard>
+  );
+}
+
+export function MonstersSection({ campaignId, entries, onOpen, formRequested, onFormClosed }: SectionProps<Monster>) {
+  const createMonster = useCreateMonster(campaignId);
+  const addFromLibrary = useAddMonsterFromLibrary(campaignId);
+  const { adding, error, setError, open, close } = useAdding(formRequested, onFormClosed);
+
+  return (
+    <SectionCard
+      title="Monsters"
+      addLabel="+ Add Monster"
+      onAdd={open}
+      intro="The stat blocks you bring into battles. Players never see them. Open one for the whole block, or to change it."
+    >
+      <EntryList
+        entries={entries}
+        noun="monsters"
+        emptyText="No monsters yet. Add one by hand, or copy some from the library."
+        searchText={(m) => [m.name, m.challengeRating && `CR ${m.challengeRating}`, m.specialTrait, m.notes]}
+        renderMeta={(m) => `CR ${m.challengeRating || '—'} · AC ${m.ac} · HP ${m.maxHp} · attack ${fmtMod(m.attackBonus)}${m.damageDice ? ` for ${m.damageDice}` : ''}`}
+        onOpen={(id) => onOpen({ kind: 'monster', id })}
+      />
+      {adding === 'library' && (
+        <LibraryModal<LibraryMonster>
+          campaignId={campaignId}
+          title="Monster library"
+          pick={(library) => library.monsters}
+          taken={entries}
+          adding={addFromLibrary.isPending}
+          onAdd={(key) => addFromLibrary.mutate(key, { onError: (err) => setError(extractErrorMessage(err)) })}
+          placeholder="Search the monster library…"
+          renderMeta={(m) =>
+            `CR ${m.challengeRating ?? '—'} · AC ${m.ac} · HP ${m.maxHp} · speed ${m.speed} · attack ${fmtMod(m.attackBonus)}${m.damageDice ? ` for ${m.damageDice}` : ''} · ${abilityLine(m)}`
+          }
+          renderDetail={(m) => [m.specialTrait, m.notes].filter(Boolean).join(' — ') || null}
+          error={error}
+          onClose={close}
+        />
+      )}
+      {adding === 'form' && (
+        <Modal title="Add a monster" wide onClose={close}>
+          {error && <ErrorBanner message={error} />}
+          <MonsterForm
+            saving={createMonster.isPending}
+            onSave={async (stats) => {
+              setError(null);
+              try {
+                const monster = await createMonster.mutateAsync(stats);
+                close();
+                onOpen({ kind: 'monster', id: monster.id, isNew: true });
+              } catch (err) {
+                setError(extractErrorMessage(err));
+                throw err;
+              }
+            }}
+          />
+        </Modal>
+      )}
+    </SectionCard>
+  );
+}
+
+export function NpcsSection({ campaignId, entries, onOpen, formRequested, onFormClosed }: SectionProps<Npc>) {
+  const createNpc = useCreateNpc(campaignId);
+  const { adding, error, setError, open, close } = useAdding(formRequested, onFormClosed);
+
+  async function handleSubmit(e: FormEvent) {
+    e.preventDefault();
+    const fd = new FormData(e.target as HTMLFormElement);
+    const text = (key: string) => String(fd.get(key) || '').trim() || null;
+    const num = (key: string) => (fd.get(key) ? Number(fd.get(key)) : null);
+    setError(null);
+    try {
+      const npc = await createNpc.mutateAsync({
+        name: String(fd.get('name')).trim(),
+        role: text('role'),
+        disposition: fd.get('disposition') as NpcDisposition,
+        description: text('description'),
+        dmNotes: text('dmNotes'),
+        ac: num('ac'),
+        maxHp: num('maxHp'),
+        attackBonus: num('attackBonus'),
+        damageDice: text('damageDice'),
+      });
+      close();
+      onOpen({ kind: 'npc', id: npc.id, isNew: true });
+    } catch (err) {
+      setError(extractErrorMessage(err));
+    }
+  }
+
+  return (
+    <SectionCard
+      title="NPCs"
+      addLabel="+ Add NPC"
+      hasLibrary={false}
+      onAdd={open}
+      intro="The people your party meets. Add them to an encounter to bring them into a scene. Players never see your notes or an NPC's stats. Open one to set what they sell and the rate they change gold and cash at; players see both when they meet the NPC in a quest."
+    >
+      <EntryList
+        entries={entries}
+        noun="NPCs"
+        emptyText="No NPCs yet."
+        searchText={(n) => [n.name, n.role, n.disposition, n.description, n.dmNotes]}
+        renderMeta={(n) => [n.role, n.description].filter(Boolean).join(' · ')}
+        renderBadges={(n) => (
+          <>
+            {rateLabel(n) && <span className="badge">💱 {rateLabel(n)}</span>}
+            {(n.wares?.length ?? 0) > 0 && <span className="badge">🛒 {n.wares?.length}</span>}
+            <span className={`badge badge-${n.disposition.toLowerCase()}`}>{n.disposition}</span>
+          </>
+        )}
+        onOpen={(id) => onOpen({ kind: 'npc', id })}
+      />
+      {adding === 'form' && (
+        <Modal title="Add an NPC" subtitle="Only the name is needed. What they sell is set once they are added." onClose={close}>
+          {error && <ErrorBanner message={error} />}
+          <form onSubmit={handleSubmit}>
+            <div className="grid grid-cols-2">
+              <Field label="Name">{(id) => <input id={id} name="name" required maxLength={80} />}</Field>
+              <Field label="Role">{(id) => <input id={id} name="role" placeholder="innkeeper, captain…" maxLength={80} />}</Field>
+              <Field label="Attitude toward the party">
+                {(id) => (
+                  <select id={id} name="disposition" defaultValue="NEUTRAL">
+                    <option value="FRIENDLY">Friendly</option>
+                    <option value="NEUTRAL">Neutral</option>
+                    <option value="HOSTILE">Hostile</option>
+                  </select>
+                )}
+              </Field>
+            </div>
+            <Field label="What the party sees and knows (shown to players)" style={{ marginTop: '0.75rem' }}>
+              {(id) => <textarea id={id} name="description" rows={2} className="textarea-block" />}
+            </Field>
+            <Field label="Secrets and motives (only you see this)" style={{ marginTop: '0.75rem' }}>
+              {(id) => <textarea id={id} name="dmNotes" rows={2} className="textarea-block" />}
+            </Field>
+            <div className="section-label mt-md">Combat stats (optional)</div>
+            <div className="grid" style={{ gridTemplateColumns: 'repeat(auto-fit, minmax(110px, 1fr))' }}>
+              <Field label="AC">{(id) => <NumberInput id={id} name="ac" min={0} max={50} />}</Field>
+              <Field label="HP">{(id) => <NumberInput id={id} name="maxHp" min={1} max={100000} />}</Field>
+              <Field label="Attack bonus">{(id) => <NumberInput id={id} name="attackBonus" min={-20} max={50} />}</Field>
+              <Field label="Damage">{(id) => <input id={id} name="damageDice" placeholder="e.g. 1d6" maxLength={20} />}</Field>
+            </div>
+            <button type="submit" className="btn btn-primary mt-md" disabled={createNpc.isPending}>
+              Add NPC
+            </button>
+          </form>
+        </Modal>
+      )}
+    </SectionCard>
+  );
+}

frontend/src/components/campaign/parts.tsx

@@ -0,0 +1,363 @@
+import { useId, useState, type CSSProperties, type ReactNode } from 'react';
+import { Link } from 'react-router-dom';
+import { NumberInput } from '../NumberInput';
+import { Pagination } from '../Paginated';
+import { usePagination } from '../../hooks/usePagination';
+import { SPELL_DAMAGE_GROUPS, SPELL_DAMAGE_SPECIALS } from '../../lib/format';
+import { ABILITY_ORDER, DAMAGE_SCALING_LABELS, MAX_GEAR_LEVEL } from '../../lib/previewCalc';
+import { matchesSearch, scoreField, type MonsterInput } from '../../lib/campaignEntries';
+import type { Monster } from '../../api/types';
+
+// A labelled field in a pop-out form. The child is handed the id its label points at.
+export function Field({ label, style, children }: { label: string; style?: CSSProperties; children: (id: string) => ReactNode }) {
+  const id = useId();
+  return (
+    <div className="field" style={{ marginBottom: 0, ...style }}>
+      <label htmlFor={id}>{label}</label>
+      {children(id)}
+    </div>
+  );
+}
+
+// How fast a weapon's or item's dice grow as the DM levels a held copy up.
+export function ScalingSelect({ id, name, value, onChange }: { id?: string; name?: string; value?: number; onChange?: (scaling: number) => void }) {
+  return (
+    <select
+      id={id}
+      name={name}
+      aria-label="How fast the dice grow per level"
+      title="How fast the dice grow each time a held copy is levelled up"
+      {...(onChange ? { value, onChange: (e) => onChange(Number(e.target.value)) } : { defaultValue: 1 })}
+    >
+      {Object.entries(DAMAGE_SCALING_LABELS).map(([scaling, label]) => (
+        <option key={scaling} value={scaling}>
+          {label}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+const GEAR_LEVELS = Array.from({ length: MAX_GEAR_LEVEL }, (_, i) => i + 1);
+
+// The level a weapon or item starts at. A held copy is never below it, and a
+// character must be at least this level to use it.
+export function StartLevelSelect({ id, name, value, onChange }: { id?: string; name?: string; value?: number; onChange?: (minLevel: number) => void }) {
+  return (
+    <select
+      id={id}
+      name={name}
+      aria-label="Level it starts at"
+      title="The level this starts at — a character must be at least this level to use it"
+      {...(onChange ? { value, onChange: (e) => onChange(Number(e.target.value)) } : { defaultValue: 1 })}
+    >
+      {GEAR_LEVELS.map((level) => (
+        <option key={level} value={level}>
+          Starts at Lv {level}
+        </option>
+      ))}
+    </select>
+  );
+}
+
+// A spell's damage is picked from a list rather than typed. A value that is
+// not in the list (set through the API, say) is still shown and kept.
+export function SpellDamageSelect({
+  id,
+  name,
+  spellName,
+  value,
+  onChange,
+}: {
+  id?: string;
+  name?: string;
+  spellName?: string;
+  value?: string | null;
+  onChange?: (damageDice: string | null) => void;
+}) {
+  const known = [...SPELL_DAMAGE_GROUPS.flatMap((g) => g.options), ...SPELL_DAMAGE_SPECIALS];
+  const others = value && !known.includes(value) ? [...SPELL_DAMAGE_SPECIALS, value] : SPELL_DAMAGE_SPECIALS;
+  return (
+    <select
+      id={id}
+      name={name}
+      aria-label={spellName ? `${spellName} damage` : 'Damage'}
+      {...(onChange ? { value: value ?? '', onChange: (e) => onChange(e.target.value || null) } : { defaultValue: '' })}
+    >
+      <option value="">No damage</option>
+      {SPELL_DAMAGE_GROUPS.map((group) => (
+        <optgroup key={group.label} label={group.label}>
+          {group.options.map((dice) => (
+            <option key={dice} value={dice}>
+              {dice}
+            </option>
+          ))}
+        </optgroup>
+      ))}
+      <optgroup label="Other">
+        {others.map((dice) => (
+          <option key={dice} value={dice}>
+            {dice}
+          </option>
+        ))}
+      </optgroup>
+    </select>
+  );
+}
+
+// The whole stat block, field for field as a printed one gives it. Adds a
+// monster, or edits one when `monster` is passed (its values fill the form).
+export function MonsterForm({
+  monster,
+  saving,
+  onSave,
+  onCancel,
+}: {
+  monster?: Monster;
+  saving: boolean;
+  // Rejects if the save failed, so the form keeps what was typed.
+  onSave: (data: MonsterInput) => Promise<void>;
+  onCancel?: () => void;
+}) {
+  const field = (name: string, label: string, input: ReactNode, style?: CSSProperties) => (
+    <div className="field" style={{ marginBottom: 0, ...style }}>
+      <label htmlFor={`monster-${name}`}>{label}</label>
+      {input}
+    </div>
+  );
+  const number = (name: keyof MonsterInput, label: string, min: number, max: number, fallback?: number) =>
+    field(
+      name,
+      label,
+      <NumberInput
+        id={`monster-${name}`}
+        name={name}
+        min={min}
+        max={max}
+        defaultValue={(monster?.[name] as number | undefined) ?? fallback}
+        keepValue={fallback !== undefined}
+        required
+      />
+    );
+
+  return (
+    <form
+      onSubmit={async (e) => {
+        e.preventDefault();
+        const fd = new FormData(e.target as HTMLFormElement);
+        const text = (key: string) => String(fd.get(key) || '').trim() || null;
+        const num = (key: string) => Number(fd.get(key));
+        try {
+          await onSave({
+            name: String(fd.get('name')).trim(),
+            challengeRating: text('challengeRating'),
+            ac: num('ac'),
+            maxHp: num('maxHp'),
+            speed: num('speed'),
+            attackBonus: num('attackBonus'),
+            damageDice: text('damageDice'),
+            strScore: num('strScore'),
+            dexScore: num('dexScore'),
+            conScore: num('conScore'),
+            intScore: num('intScore'),
+            wisScore: num('wisScore'),
+            chaScore: num('chaScore'),
+            specialTrait: text('specialTrait'),
+            notes: text('notes'),
+          });
+        } catch {
+          // Whoever opened the form shows the error; what was typed stays.
+        }
+      }}
+    >
+      <div className="grid grid-cols-3">
+        {field('name', 'Name', <input id="monster-name" name="name" defaultValue={monster?.name} required maxLength={80} />)}
+        {field(
+          'challengeRating',
+          'CR (Challenge Rating)',
+          <input id="monster-challengeRating" name="challengeRating" defaultValue={monster?.challengeRating ?? ''} placeholder="e.g. 1/4 or 3" maxLength={10} />
+        )}
+        {number('ac', 'AC (Armor Class)', 0, 50)}
+        {number('maxHp', 'HP (Hit Points)', 1, 100000)}
+        {number('speed', 'Speed (feet)', 0, 1000, 30)}
+        {number('attackBonus', 'Attack bonus', -20, 50, 0)}
+        {field(
+          'damageDice',
+          'Damage',
+          <input id="monster-damageDice" name="damageDice" defaultValue={monster?.damageDice ?? ''} placeholder="e.g. 1d6+2 necrotic" maxLength={60} />
+        )}
+      </div>
+      <div className="grid mt-sm" style={{ gridTemplateColumns: 'repeat(auto-fit, minmax(80px, 1fr))' }}>
+        {ABILITY_ORDER.map((a) => number(scoreField(a), a, 1, 30, 10))}
+      </div>
+      {field(
+        'specialTrait',
+        'Special trait',
+        <input
+          id="monster-specialTrait"
+          name="specialTrait"
+          defaultValue={monster?.specialTrait ?? ''}
+          placeholder="The one thing that makes it different"
+          maxLength={500}
+        />,
+        { marginTop: '0.5rem' }
+      )}
+      {field(
+        'notes',
+        'Notes',
+        <textarea
+          id="monster-notes"
+          name="notes"
+          rows={3}
+          className="textarea-block"
+          defaultValue={monster?.notes ?? ''}
+          placeholder="Everything else: other speeds (fly 30, swim 40), extra attacks, spells, tactics, resistances, senses, what it drops"
+          maxLength={2000}
+        />,
+        { marginTop: '0.5rem' }
+      )}
+      <div className="flex-row mt-md">
+        <button type="submit" className="btn btn-primary" disabled={saving}>
+          {monster ? 'Save Changes' : 'Add Monster'}
+        </button>
+        {onCancel && (
+          <button type="button" className="btn btn-ghost" onClick={onCancel}>
+            Cancel
+          </button>
+        )}
+      </div>
+    </form>
+  );
+}
+
+// The built-in library, searched by name, with what the campaign already
+// holds left out. It stays open after an add, for adding several in a row.
+export function LibraryPicker<T extends { key: string; name: string }>({
+  items,
+  taken,
+  onAdd,
+  adding,
+  renderMeta,
+  renderDetail,
+  placeholder,
+}: {
+  items: T[];
+  // What the campaign already holds: a library entry by one of these names is
+  // left out, since each can be added once.
+  taken: { name: string }[] | undefined;
+  onAdd: (key: string) => void;
+  adding: boolean;
+  renderMeta: (item: T) => string;
+  // A sentence on what the entry is or does, shown under its name.
+  renderDetail?: (item: T) => string | null;
+  placeholder: string;
+}) {
+  const [query, setQuery] = useState('');
+  const takenNames = new Set((taken ?? []).map((t) => t.name.toLowerCase()));
+  const available = items.filter((i) => !takenNames.has(i.name.toLowerCase()));
+  const filtered = available.filter((i) => matchesSearch(query, i.name));
+  const { pageItems, page, pageCount, prevPage, nextPage, setPage } = usePagination(filtered, 8);
+
+  return (
+    <div>
+      <input type="search" placeholder={placeholder} aria-label={placeholder} value={query} onChange={(e) => setQuery(e.target.value)} style={{ width: '100%' }} />
+      <div className="mt-sm">
+        {pageItems.map((item) => (
+          <div key={item.key} className="flex-between" style={{ padding: '0.45rem 0', borderBottom: '1px solid var(--border-soft)', flexWrap: 'nowrap' }}>
+            <div style={{ minWidth: 0 }}>
+              <strong>{item.name}</strong>
+              <span style={{ color: 'var(--text-muted)', marginLeft: 6, fontSize: '0.85rem' }}>{renderMeta(item)}</span>
+              {renderDetail?.(item) && <div style={{ fontSize: '0.9rem' }}>{renderDetail(item)}</div>}
+            </div>
+            <button className="btn" style={{ flex: 'none' }} disabled={adding} aria-label={`Add ${item.name}`} onClick={() => onAdd(item.key)}>
+              + Add
+            </button>
+          </div>
+        ))}
+        {filtered.length === 0 && (
+          <p style={{ color: 'var(--text-muted)' }}>
+            {available.length === 0 ? 'Everything in the library is already in this campaign.' : 'No matches.'}
+          </p>
+        )}
+      </div>
+      <Pagination page={page} pageCount={pageCount} onPrev={prevPage} onNext={nextPage} onJump={setPage} />
+    </div>
+  );
+}
+
+// One line of a list: what it is and a few words about it. The rest is in
+// the pop-out it opens, or on the page it links to when given `to`.
+export function EntryRow({ name, meta, badges, onOpen, to }: { name: string; meta?: ReactNode; badges?: ReactNode; onOpen?: () => void; to?: string }) {
+  const inner = (
+    <>
+      <span className="entry-row-main">
+        <span className="entry-row-name">{name}</span>
+        {meta && <span className="entry-row-meta">{meta}</span>}
+      </span>
+      {badges && <span className="entry-row-badges">{badges}</span>}
+      <span className="entry-row-chevron" aria-hidden>
+        ›
+      </span>
+    </>
+  );
+  return to ? (
+    <Link to={to} className="entry-row">
+      {inner}
+    </Link>
+  ) : (
+    <button type="button" className="entry-row" onClick={onOpen}>
+      {inner}
+    </button>
+  );
+}
+
+// A campaign list as short rows: searched by a box of its own, paged, and
+// each row opening its pop-out.
+export function EntryList<T extends { id: string; name: string }>({
+  entries,
+  noun,
+  emptyText,
+  searchText,
+  renderMeta,
+  renderBadges,
+  onOpen,
+}: {
+  entries: T[] | undefined;
+  // What the list holds, in the plural: "weapons".
+  noun: string;
+  emptyText: string;
+  // Everything about an entry that a search should find it by.
+  searchText: (entry: T) => (string | number | null | undefined)[];
+  renderMeta: (entry: T) => ReactNode;
+  renderBadges?: (entry: T) => ReactNode;
+  onOpen: (id: string) => void;
+}) {
+  const [query, setQuery] = useState('');
+  const filtered = (entries ?? []).filter((entry) => matchesSearch(query, ...searchText(entry)));
+  const { pageItems, page, pageCount, prevPage, nextPage, setPage } = usePagination(filtered, 10);
+
+  if (entries && entries.length === 0) return <p className="mt-sm" style={{ color: 'var(--text-muted)' }}>{emptyText}</p>;
+  return (
+    <>
+      <input
+        type="search"
+        className="mt-sm"
+        style={{ width: '100%' }}
+        placeholder={`Search the ${noun} in this campaign…`}
+        aria-label={`Search the ${noun} in this campaign`}
+        value={query}
+        onChange={(e) => {
+          setQuery(e.target.value);
+          setPage(1);
+        }}
+      />
+      <div className="entry-list mt-sm">
+        {pageItems.map((entry) => (
+          <EntryRow key={entry.id} name={entry.name} meta={renderMeta(entry)} badges={renderBadges?.(entry)} onOpen={() => onOpen(entry.id)} />
+        ))}
+      </div>
+      {entries && filtered.length === 0 && <p style={{ color: 'var(--text-muted)' }}>No {noun} match "{query}".</p>}
+      <Pagination page={page} pageCount={pageCount} onPrev={prevPage} onNext={nextPage} onJump={setPage} />
+    </>
+  );
+}

frontend/src/hooks/useCampaignSocket.ts

@@ -1,18 +1,25 @@
 import { useEffect } from 'react';
-import { useQueryClient } from '@tanstack/react-query';
+import { useQueryClient, type QueryKey } from '@tanstack/react-query';
 import { io, type Socket } from 'socket.io-client';
 import { API_URL } from '../api/client';
-import { useAuth } from '../auth/AuthContext';
+import { useAuth } from '../auth/useAuth';
 
 let sharedSocket: Socket | null = null;
 
 function getSocket(token: string): Socket {
   if (!sharedSocket) {
-    sharedSocket = io(API_URL, { auth: { token }, transports: ['websocket', 'polling'] });
+    // Starts on plain requests and moves up to a websocket when one gets
+    // through. Asking for the websocket first leaves no way back: behind a
+    // proxy that does not pass the upgrade, nothing live arrives at all.
+    sharedSocket = io(API_URL, { auth: { token } });
   }
   return sharedSocket;
 }
 
+// One change on the server often sends two or three events together. They are
+// gathered for this long and answered with one refetch per query.
+const FLUSH_MS = 50;
+
 // Joins the Socket.io room for a campaign and keeps React Query's cache in
 // sync with server-pushed events (HP/condition changes, encounter rounds,
 // new characters) so every open tab in the campaign updates live.
@@ -25,23 +32,44 @@ export function useCampaignSocket(campaignId: string | undefined) {
     const socket = getSocket(token);
     socket.emit('campaign:join', campaignId);
 
-    const onCharacterUpdated = () => {
-      qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'characters'] });
-      qc.invalidateQueries({ queryKey: ['character'] });
-      qc.invalidateQueries({ queryKey: ['encounter'] }); // a character combatant shows the sheet HP
+    const pending = new Map<string, QueryKey>();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const flush = () => {
+      timer = undefined;
+      const keys = [...pending.values()];
+      pending.clear();
+      // A wider key covers a narrower one waiting beside it: ['encounter'] takes in ['encounter', id].
+      const covered = (key: QueryKey) => keys.some((other) => other.length < key.length && other.every((part, i) => part === key[i]));
+      for (const queryKey of keys) if (!covered(queryKey)) qc.invalidateQueries({ queryKey });
+    };
+    const invalidate = (queryKey: QueryKey) => {
+      pending.set(JSON.stringify(queryKey), queryKey);
+      timer ??= setTimeout(flush, FLUSH_MS);
+    };
+    // An event names what changed when it is one thing, and nothing when it may be many.
+    const one = (root: string, id?: string) => invalidate(id ? [root, id] : [root]);
+
+    const onCharacterUpdated = ({ characterId }: { characterId?: string } = {}) => {
+      invalidate(['campaign', campaignId, 'characters']);
+      one('character', characterId);
+      invalidate(['encounter']); // a character combatant shows the sheet HP
+      // A character arriving somewhere new adds it to the places their player can see.
+      invalidate(['campaign', campaignId, 'locations']);
     };
     const onCharacterCreated = () => {
-      qc.invalidateQueries({ queryKey: ['campaign', campaignId, 'characters'] });
+      invalidate(['campaign', campaignId, 'characters']);
     };
-    const onParticipantUpdated = () => {
-      qc.invalidateQueries({ queryKey: ['encounter'] });
+    const onParticipantUpdated = ({ encounterId }: { encounterId?: string } = {}) => {
+      one('encounter', encounterId);
+      // A player's list only holds the encounters their characters are in.
+      invalidate(['campaign', campaignId, 'encounters']);
     };
-    const onRoundAdvanced = () => {
-      qc.invalidateQueries({ queryKey: ['encounter'] });
+    const onRoundAdvanced = ({ encounterId }: { encounterId?: string } = {}) => {
+      one('encounter', encounterId);
     };
     const onCampaignDeleted = () => {
-      qc.invalidateQueries({ queryKey: ['campaigns'] });
-      qc.invalidateQueries({ queryKey: ['campaign', campaignId] });
+      invalidate(['campaigns']);
+      invalidate(['campaign', campaignId]);
     };
 
     socket.on('character:updated', onCharacterUpdated);
@@ -51,6 +79,10 @@ export function useCampaignSocket(campaignId: string | undefined) {
     socket.on('campaign:deleted', onCampaignDeleted);
 
     return () => {
+      if (timer) {
+        clearTimeout(timer);
+        flush();
+      }
       socket.emit('campaign:leave', campaignId);
       socket.off('character:updated', onCharacterUpdated);
       socket.off('character:created', onCharacterCreated);

frontend/src/hooks/usePagination.ts

@@ -0,0 +1,26 @@
+import { useMemo, useState } from 'react';
+
+// Small generic pager shared by every list-turned-table in the app, so page
+// state isn't hand-rolled per screen. Resets to page 1 whenever the
+// underlying item count shrinks below the current page (e.g. after a delete
+// or a filter change).
+export function usePagination<T>(items: T[] | undefined, pageSize = 10) {
+  const [page, setPage] = useState(1);
+  const total = items?.length ?? 0;
+  const pageCount = Math.max(1, Math.ceil(total / pageSize));
+  const safePage = Math.min(page, pageCount);
+  const pageItems = useMemo(
+    () => (items || []).slice((safePage - 1) * pageSize, safePage * pageSize),
+    [items, safePage, pageSize],
+  );
+
+  return {
+    page: safePage,
+    pageCount,
+    pageItems,
+    total,
+    setPage,
+    nextPage: () => setPage((p) => Math.min(pageCount, p + 1)),
+    prevPage: () => setPage((p) => Math.max(1, p - 1)),
+  };
+}

frontend/src/index.css

@@ -1,4 +1,6 @@
 :root {
+  /* Dark throughout, so the browser draws its own controls dark too. */
+  color-scheme: dark;
   --bg: #131009;
   --bg-elevated: #1b160e;
   --bg-card: #221b12;
@@ -347,10 +349,8 @@ textarea {
   color: var(--text-muted);
 }
 
-input[type='text'],
-input[type='email'],
-input[type='password'],
-input[type='number'],
+/* Every text-like field, including an <input> with no type given. */
+input:not([type='checkbox']):not([type='radio']):not([type='range']):not([type='file']),
 select,
 textarea {
   background: var(--bg-inset);
@@ -450,6 +450,7 @@ input[type='radio'] {
 }
 
 .hp-bar-track {
+  display: flex;
   width: 100%;
   height: 10px;
   background: var(--bg-inset);
@@ -470,6 +471,10 @@ input[type='radio'] {
 .hp-bar-fill.hp-critical {
   background: var(--danger-strong);
 }
+/* Temporary HP: a separate segment after the real HP. */
+.hp-bar-fill.hp-temp {
+  background: var(--arcane-strong);
+}
 
 .divider {
   border: none;
@@ -626,10 +631,9 @@ input[type='radio'] {
   color: var(--accent-strong);
   outline: none;
 }
+/* Placed by InfoTip.tsx against the viewport, so no scrolling container can clip it. */
 .info-tip-bubble {
-  position: absolute;
-  bottom: calc(100% + 8px);
-  left: 50%;
+  position: fixed;
   transform: translateX(-50%);
   width: max-content;
   max-width: 260px;
@@ -643,7 +647,7 @@ input[type='radio'] {
   letter-spacing: normal;
   color: var(--text);
   box-shadow: var(--shadow-deep);
-  z-index: 100;
+  z-index: 200;
   pointer-events: none;
 }
 
@@ -801,6 +805,57 @@ table.data-table tbody tr:hover {
 .combatant.is-down {
   opacity: 0.6;
 }
+/* The marked target stands out even when it is down or not on turn. */
+.combatant.is-targeted {
+  opacity: 1;
+  border-color: var(--danger-strong);
+  box-shadow: 0 0 0 1px var(--danger-strong), 0 0 22px rgba(216, 84, 84, 0.3), var(--shadow-deep);
+}
+.target-marker {
+  color: var(--danger-strong);
+  font-family: var(--font-display);
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+}
+.btn-target {
+  padding: 0.15rem 0.6rem;
+  font-size: 0.8rem;
+}
+.btn-target.is-on {
+  border-color: var(--danger-strong);
+  color: var(--danger-strong);
+  background: var(--danger-soft);
+}
+
+/* What players see of the dead: names, and a way to try to bring them back. */
+.fallen-bar {
+  border-color: var(--danger);
+}
+
+/* The DM's attack bar stays in reach while scrolling the initiative order. */
+.attack-bar {
+  position: sticky;
+  top: 4.5rem;
+  z-index: 20;
+  border-color: var(--danger-strong);
+}
+.attack-target {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+  margin-top: 0.5rem;
+}
+.attack-target-name {
+  font-family: var(--font-display);
+}
+.attack-bar-title {
+  font-family: var(--font-display);
+  font-size: 1.1rem;
+  color: var(--text);
+}
 .combatant-name {
   font-family: var(--font-display);
   font-size: 1.1rem;
@@ -865,6 +920,55 @@ table.data-table tbody tr:hover {
   line-height: 1;
 }
 
+/* At 0 HP: the death-save tallies and what can be done about them. */
+.death-saves {
+  margin-top: 0.6rem;
+  padding: 0.6rem 0.75rem;
+  border: 1px solid var(--danger);
+  border-radius: 6px;
+  background: var(--danger-soft);
+}
+.death-saves.is-stable {
+  border-color: var(--border);
+  background: var(--bg-inset);
+}
+.death-tally {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--text-muted);
+}
+.death-pips {
+  display: inline-flex;
+  gap: 0.25rem;
+}
+.death-pip {
+  width: 0.9rem;
+  height: 0.9rem;
+  padding: 0;
+  border-radius: 50%;
+  border: 2px solid var(--text-dim);
+  background: transparent;
+}
+button.death-pip {
+  cursor: pointer;
+}
+.death-pip.is-success {
+  border-color: var(--success-strong);
+}
+.death-pip.is-failure {
+  border-color: var(--danger-strong);
+}
+.death-pip.is-success.is-filled {
+  background: var(--success-strong);
+}
+.death-pip.is-failure.is-filled {
+  background: var(--danger-strong);
+}
+
 .combatant-details {
   margin-top: 0.75rem;
   padding-top: 0.75rem;
@@ -1186,3 +1290,775 @@ table.data-table tbody tr:hover {
   margin: 0;
   white-space: pre-wrap;
 }
+
+/* ---------------------------------------------------------------------- */
+/* Navigation: links along the top bar on a wide screen, a bar along the   */
+/* bottom on a phone; and a row of links to the sections of a long page    */
+/* ---------------------------------------------------------------------- */
+
+.topbar-links {
+  display: flex;
+  align-items: center;
+  gap: 0.25rem;
+}
+.topbar-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.35rem 0.7rem;
+  border-radius: 6px;
+  border: 1px solid transparent;
+  color: var(--text-muted);
+  font-family: var(--font-display);
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+.topbar-link:hover {
+  text-decoration: none;
+  color: var(--accent-strong);
+  border-color: var(--border);
+}
+.topbar-link.is-active {
+  color: var(--accent-strong);
+  border-color: var(--accent);
+  background: var(--accent-soft);
+}
+.topbar-name {
+  max-width: 14ch;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.bottom-nav {
+  display: none;
+}
+
+.jump-nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin-bottom: 1.25rem;
+}
+.jump-link {
+  font-family: var(--font-display);
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  padding: 0.4rem 0.75rem;
+  border-radius: 999px;
+  border: 1px solid var(--border);
+  background: var(--bg-inset);
+  color: var(--text-muted);
+  cursor: pointer;
+}
+.jump-link:hover {
+  border-color: var(--accent);
+  color: var(--accent-strong);
+}
+/* A section jumped to stops below the sticky top bar, not under it. */
+[data-jump] {
+  scroll-margin-top: 4.5rem;
+}
+
+/* A table cell that holds a sentence rather than a figure may wrap. */
+table.data-table td.cell-title,
+table.data-table td.cell-wide {
+  white-space: normal;
+  min-width: 12rem;
+}
+
+/* ---------------------------------------------------------------------- */
+/* Small screens. Nothing may be wider than the screen: rows of controls   */
+/* wrap, fields shrink to fit, tables become stacked cards, and the main   */
+/* destinations move to a bar along the bottom.                            */
+/* ---------------------------------------------------------------------- */
+
+html {
+  -webkit-text-size-adjust: 100%;
+  text-size-adjust: 100%;
+}
+body,
+#root,
+.app-shell {
+  min-height: 100dvh;
+}
+/* A field never forces its row wider than the space there is. */
+input,
+select,
+textarea {
+  max-width: 100%;
+  min-width: 0;
+}
+
+@media (max-width: 900px) {
+  :root {
+    --bottom-nav-height: calc(3.6rem + env(safe-area-inset-bottom, 0px));
+    --dice-slot: 4.2rem;
+  }
+
+  body {
+    overflow-wrap: break-word;
+  }
+
+  .page {
+    padding: 1rem 0.85rem calc(var(--bottom-nav-height) + 1.5rem);
+  }
+  .topbar {
+    padding: 0.5rem 0.85rem;
+    gap: 0.5rem;
+  }
+  .topbar-brand {
+    font-size: 1rem;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+  }
+  .topbar-links,
+  .topbar-name {
+    display: none;
+  }
+  .topbar-nav {
+    flex-wrap: nowrap;
+  }
+
+  .bottom-nav {
+    position: fixed;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    z-index: 70;
+    display: flex;
+    height: var(--bottom-nav-height);
+    padding-bottom: env(safe-area-inset-bottom, 0px);
+    background: linear-gradient(180deg, #1e1810 0%, #120e08 100%);
+    border-top: 1px solid var(--border);
+    box-shadow: 0 -4px 16px rgba(0, 0, 0, 0.45);
+  }
+  .bottom-nav-link {
+    flex: 1 1 0;
+    min-width: 0;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    gap: 0.1rem;
+    color: var(--text-muted);
+    font-family: var(--font-display);
+    font-size: 0.68rem;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    border-top: 2px solid transparent;
+  }
+  .bottom-nav-link:hover {
+    text-decoration: none;
+  }
+  .bottom-nav-link .nav-icon {
+    font-size: 1.25rem;
+    line-height: 1.2;
+  }
+  .bottom-nav-link.is-active {
+    color: var(--accent-strong);
+    border-top-color: var(--accent-strong);
+    background: var(--accent-soft);
+  }
+
+  /* Nothing floats over the page on a phone. The dice roller takes the last
+     place in the bottom bar, and quick stats a place in the top bar. */
+  .bottom-nav {
+    padding-right: var(--dice-slot);
+  }
+  .fab-dice {
+    left: auto;
+    right: 0;
+    bottom: 0;
+    z-index: 71;
+    width: var(--dice-slot);
+    height: var(--bottom-nav-height);
+    padding: 0 0 env(safe-area-inset-bottom, 0px);
+    flex-direction: column;
+    gap: 0.1rem;
+    border: none;
+    border-top: 2px solid transparent;
+    border-radius: 0;
+    background: transparent;
+    box-shadow: none;
+    font-size: 1.25rem;
+    line-height: 1.2;
+    color: var(--text-muted);
+  }
+  .fab-dice::after {
+    content: 'Dice';
+    font-family: var(--font-display);
+    font-size: 0.68rem;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+  }
+  .fab-dice:hover {
+    transform: none;
+  }
+  .dice-panel {
+    left: 0.85rem;
+    bottom: calc(var(--bottom-nav-height) + 0.6rem);
+    width: calc(100vw - 1.7rem);
+    max-height: calc(100dvh - var(--bottom-nav-height) - 5rem);
+  }
+  .fab-quickstats {
+    top: 0.3rem;
+    bottom: auto;
+    right: 6.4rem;
+    z-index: 31;
+    width: 40px;
+    height: 40px;
+    font-size: 1.15rem;
+    box-shadow: none;
+  }
+  /* The brand makes room for it. */
+  .app-shell:has(.fab-quickstats) .topbar-brand {
+    max-width: calc(100vw - 11rem);
+  }
+  .drawer {
+    width: 100vw;
+    padding: 1rem 0.85rem calc(var(--bottom-nav-height) + 1rem);
+    z-index: 95;
+  }
+  .drawer-backdrop {
+    z-index: 94;
+  }
+
+  h1 {
+    font-size: 1.5rem;
+  }
+  .card {
+    padding: 0.9rem 0.85rem;
+  }
+  .card-title {
+    flex-wrap: wrap;
+  }
+  .page-header {
+    margin-bottom: 1rem;
+  }
+
+  /* Rows of controls wrap instead of running off the side, and what is in
+     them may shrink: an inline min-width never beats the screen. */
+  .flex-row,
+  .flex-between,
+  .detail-row {
+    flex-wrap: wrap;
+  }
+  .flex-row > *,
+  .flex-between > * {
+    max-width: 100%;
+  }
+  .flex-row > input,
+  .flex-row > select,
+  .flex-row > textarea,
+  .flex-row > a,
+  .flex-between > a {
+    min-width: min(100%, 8rem) !important;
+  }
+  .btn {
+    white-space: normal;
+    padding: 0.6rem 0.9rem;
+  }
+  .grid-cols-2 {
+    grid-template-columns: minmax(0, 1fr);
+  }
+  .grid-cols-3 {
+    grid-template-columns: repeat(auto-fit, minmax(min(100%, 130px), 1fr));
+  }
+  .choice-grid {
+    grid-template-columns: 1fr;
+  }
+  .btn-roll {
+    font-size: 1.1rem;
+    padding: 1.1rem 1.25rem;
+    max-width: 100%;
+  }
+  .step-footer > * {
+    flex: 1 1 auto;
+  }
+
+  /* Things to tap are big enough to hit with a thumb. */
+  input[type='checkbox'],
+  input[type='radio'] {
+    width: 22px;
+    height: 22px;
+    flex: none;
+  }
+  .death-pip {
+    width: 1.5rem;
+    height: 1.5rem;
+  }
+  .btn-target {
+    padding: 0.4rem 0.75rem;
+  }
+  .condition-chip {
+    padding: 0.3rem 0.6rem;
+  }
+  .condition-chip button {
+    padding: 0.15rem 0.35rem;
+    font-size: 1rem;
+  }
+  .info-tip-trigger {
+    font-size: 1.05em;
+    padding: 0.2rem;
+  }
+  .pick-chip {
+    padding: 0.5rem 0.9rem;
+  }
+  .jump-link {
+    padding: 0.5rem 0.8rem;
+  }
+  .attack-bar {
+    top: 3.4rem;
+    max-height: 55dvh;
+    overflow-y: auto;
+  }
+  [data-jump] {
+    scroll-margin-top: 3.8rem;
+  }
+
+  /* Tables: every row becomes a card. The first cell is its heading; the
+     rest carry their column's name from data-label. */
+  .table-wrap {
+    overflow: visible;
+    border: none;
+  }
+  table.data-table,
+  table.data-table tbody {
+    display: block;
+  }
+  table.data-table thead {
+    display: none;
+  }
+  table.data-table tbody tr {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: 0.35rem 0.9rem;
+    padding: 0.7rem 0.75rem;
+    margin-bottom: 0.6rem;
+    background: var(--bg-inset);
+    border: 1px solid var(--border-soft);
+    border-radius: var(--radius);
+  }
+  table.data-table tbody tr:last-child {
+    border-bottom: 1px solid var(--border-soft);
+    margin-bottom: 0;
+  }
+  table.data-table tbody tr:hover {
+    background: var(--bg-inset);
+  }
+  table.data-table td {
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    padding: 0;
+    white-space: normal;
+    min-width: 0;
+  }
+  table.data-table td:empty {
+    display: none;
+  }
+  table.data-table td.cell-title,
+  table.data-table td.cell-wide {
+    display: block;
+    flex: 1 1 100%;
+    min-width: 0;
+  }
+  table.data-table td.cell-title {
+    font-size: 1.05rem;
+  }
+  table.data-table td[data-label]::before {
+    content: attr(data-label);
+    font-size: 0.65rem;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    color: var(--text-dim);
+    flex: none;
+  }
+  table.data-table td.cell-actions {
+    margin-left: auto;
+  }
+}
+
+/* The narrowest phones: five places in the bottom bar still fit. */
+@media (max-width: 380px) {
+  :root {
+    --dice-slot: 3.4rem;
+  }
+  .bottom-nav-link,
+  .fab-dice::after {
+    font-size: 0.58rem;
+    letter-spacing: 0;
+  }
+}
+
+/* Between a phone and a full desktop the top bar drops the name to stay on one line. */
+@media (max-width: 1080px) {
+  .topbar-name {
+    display: none;
+  }
+  .topbar-nav {
+    flex-wrap: nowrap;
+  }
+}
+
+/* ---------------------------------------------------------------------- */
+/* "This one is yours": a player's own character, wherever it is listed    */
+/* ---------------------------------------------------------------------- */
+
+.badge-mine {
+  border-color: var(--arcane-strong);
+  color: var(--arcane-strong);
+  background: rgba(92, 127, 176, 0.18);
+}
+.mine-marker {
+  color: var(--arcane-strong);
+  font-family: var(--font-display);
+  font-size: 0.75rem;
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+}
+.combatant.is-mine {
+  border-color: var(--arcane-strong);
+  background: linear-gradient(160deg, #1d2431 0%, var(--bg-elevated) 100%);
+  box-shadow: 0 0 0 1px var(--arcane-strong), 0 0 20px rgba(127, 163, 214, 0.22), var(--shadow-deep);
+}
+/* Whose turn it is and who is targeted still win the border. */
+.combatant.is-mine.is-active {
+  border-color: var(--accent-strong);
+  box-shadow: 0 0 0 1px var(--accent-strong), 0 0 22px rgba(201, 162, 39, 0.25), var(--shadow-deep);
+}
+.combatant.is-mine.is-targeted {
+  border-color: var(--danger-strong);
+  box-shadow: 0 0 0 1px var(--danger-strong), 0 0 22px rgba(216, 84, 84, 0.3), var(--shadow-deep);
+}
+.jump-link.is-mine {
+  border-color: var(--arcane-strong);
+  color: var(--arcane-strong);
+  background: rgba(92, 127, 176, 0.18);
+}
+table.data-table tbody tr.is-mine,
+table.data-table tbody tr.is-mine:hover {
+  background: rgba(92, 127, 176, 0.16);
+  box-shadow: inset 4px 0 0 var(--arcane-strong);
+}
+
+/* A bonus from gear reads green; a penalty keeps the red of a condition. */
+.condition-chip.is-bonus {
+  border-color: var(--success);
+  color: var(--success-strong);
+  background: rgba(95, 138, 79, 0.18);
+}
+
+/* ---------------------------------------------------------------------- */
+/* The campaign page: one part at a time, picked from a row of buttons;    */
+/* lists as short rows; and the pop-out a row opens                        */
+/* ---------------------------------------------------------------------- */
+
+.campaign-search {
+  width: 100%;
+  margin-bottom: 0.75rem;
+}
+.section-nav {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+  margin-bottom: 1.25rem;
+}
+.section-nav .jump-link {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  white-space: nowrap;
+}
+.jump-link.is-active {
+  border-color: var(--accent);
+  color: var(--accent-strong);
+  background: var(--accent-soft);
+}
+.section-count {
+  font-family: var(--font-body);
+  font-size: 0.75rem;
+  color: var(--text-dim);
+}
+.section-block + .section-block {
+  margin-top: 2rem;
+}
+.search-group + .search-group {
+  margin-top: 1.25rem;
+}
+
+.entry-list {
+  border: 1px solid var(--border-soft);
+  border-radius: var(--radius);
+  overflow: hidden;
+}
+.entry-list:empty {
+  display: none;
+}
+.entry-row {
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+  width: 100%;
+  padding: 0.6rem 0.75rem;
+  background: transparent;
+  border: none;
+  border-bottom: 1px solid var(--border-soft);
+  color: var(--text);
+  text-align: left;
+  cursor: pointer;
+}
+.entry-row:last-child {
+  border-bottom: none;
+}
+.entry-row:hover,
+.entry-row:focus-visible {
+  background: var(--bg-card-hover);
+  text-decoration: none;
+  outline: none;
+}
+.entry-row-main {
+  flex: 1 1 auto;
+  min-width: 0;
+  display: flex;
+  flex-direction: column;
+}
+.entry-row-name {
+  font-family: var(--font-display);
+  color: var(--accent-strong);
+}
+/* A few words only: the whole of it is in the pop-out. */
+.entry-row-meta {
+  color: var(--text-muted);
+  font-size: 0.85rem;
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.entry-row-badges {
+  flex: none;
+  display: flex;
+  flex-wrap: wrap;
+  justify-content: flex-end;
+  gap: 0.3rem;
+  max-width: 45%;
+}
+.entry-row-chevron {
+  flex: none;
+  color: var(--text-dim);
+  font-size: 1.3rem;
+  line-height: 1;
+}
+
+.modal-backdrop {
+  position: fixed;
+  inset: 0;
+  z-index: 96;
+  display: flex;
+  align-items: flex-start;
+  justify-content: center;
+  padding: 5vh 1rem;
+  background: rgba(0, 0, 0, 0.65);
+  backdrop-filter: blur(2px);
+}
+.modal {
+  display: flex;
+  flex-direction: column;
+  width: min(620px, 100%);
+  max-height: 90dvh;
+  background: linear-gradient(180deg, #1c160d 0%, #120e08 100%);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-deep);
+}
+.modal:focus {
+  outline: none;
+}
+.modal.is-wide {
+  width: min(860px, 100%);
+}
+.modal-head {
+  flex: none;
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.9rem 0.6rem 0.75rem 1.2rem;
+  border-bottom: 1px solid var(--border-soft);
+}
+.modal-title {
+  font-size: 1.2rem;
+  margin: 0;
+  overflow-wrap: anywhere;
+}
+.modal-body {
+  overflow-y: auto;
+  padding: 1rem 1.2rem 1.25rem;
+}
+.modal-body .field input,
+.modal-body .field select {
+  width: 100%;
+}
+.modal-foot {
+  margin-top: 1.5rem;
+  padding-top: 1rem;
+  border-top: 1px solid var(--border-soft);
+  display: flex;
+  justify-content: flex-end;
+}
+/* ---------------------------------------------------------------------- */
+/* Spell slots, rests and levelling up                                    */
+/* ---------------------------------------------------------------------- */
+
+.spell-slots {
+  margin-top: 0.75rem;
+  padding-top: 0.6rem;
+  border-top: 1px solid var(--border-soft);
+}
+.slot-row {
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+  padding: 0.3rem 0;
+}
+.slot-level {
+  width: 2.2rem;
+  font-family: var(--font-display);
+  color: var(--accent-strong);
+}
+.slot-pips {
+  display: inline-flex;
+  flex-wrap: wrap;
+  gap: 0.3rem;
+  flex: 1;
+  min-width: 0;
+}
+/* A slot still there to spend is filled; a spent one is an empty ring. */
+.slot-pip {
+  width: 1rem;
+  height: 1rem;
+  padding: 0;
+  border-radius: 3px;
+  border: 2px solid var(--accent);
+  background: transparent;
+  transform: rotate(45deg);
+  margin: 0.15rem;
+}
+.slot-pip.is-filled {
+  background: var(--accent-strong);
+}
+button.slot-pip {
+  cursor: pointer;
+}
+button.slot-pip:disabled {
+  cursor: default;
+}
+.slot-count {
+  color: var(--text-muted);
+}
+.slot-row .btn {
+  padding: 0.25rem 0.7rem;
+}
+
+.rest-dice {
+  padding-left: 1.75rem;
+}
+.level-step {
+  padding: 0.75rem 0;
+  border-bottom: 1px solid var(--border-soft);
+}
+.level-step:last-of-type {
+  border-bottom: none;
+}
+.level-step p {
+  margin: 0.4rem 0 0;
+}
+.level-choice {
+  align-items: flex-start;
+  margin: 0.35rem 0;
+}
+.level-choice input {
+  margin-top: 0.25rem;
+}
+.level-spells {
+  max-height: 14rem;
+  overflow-y: auto;
+  margin-top: 0.4rem;
+  padding: 0.2rem 0.6rem;
+  border: 1px solid var(--border-soft);
+  border-radius: 6px;
+}
+
+@media (max-width: 900px) {
+  .slot-pip {
+    width: 1.3rem;
+    height: 1.3rem;
+  }
+  .rest-dice {
+    padding-left: 0;
+  }
+}
+
+.pagination .pagination-status > select {
+  min-width: 0 !important;
+  padding: 0.3rem 0.5rem;
+}
+
+@media (max-width: 900px) {
+  /* The parts of the campaign are one line that scrolls sideways, edge to edge. */
+  .section-nav {
+    flex-wrap: nowrap;
+    overflow-x: auto;
+    margin: 0 -0.85rem 1rem;
+    padding: 0 0.85rem 0.35rem;
+    scrollbar-width: none;
+  }
+  .section-nav::-webkit-scrollbar {
+    display: none;
+  }
+  .section-nav .jump-link {
+    flex: none;
+  }
+  .entry-row {
+    padding: 0.75rem 0.7rem;
+  }
+  /* A pop-out is the whole screen, over the bottom bar too. */
+  .modal-backdrop {
+    padding: 0;
+  }
+  .modal,
+  .modal.is-wide {
+    width: 100%;
+    height: 100dvh;
+    max-height: none;
+    border: none;
+    border-radius: 0;
+  }
+  .modal-head {
+    padding: 0.7rem 0.4rem 0.6rem 0.85rem;
+  }
+  .modal-body {
+    flex: 1;
+    padding: 0.9rem 0.85rem calc(1.5rem + env(safe-area-inset-bottom, 0px));
+  }
+}
+
+/* At the top of the pop-out of something added a moment ago. */
+.added-bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+  margin-bottom: 1rem;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--success);
+  border-radius: var(--radius);
+  background: rgba(95, 138, 79, 0.14);
+  color: var(--success-strong);
+}

frontend/src/lib/campaignEntries.ts

@@ -0,0 +1,35 @@
+import { ABILITY_ORDER } from './previewCalc';
+import { formatMoney } from './format';
+import type { Monster, Npc } from '../api/types';
+
+// One thing in a campaign's lists that opens in a pop-out.
+export type EntryKind = 'weapon' | 'item' | 'spell' | 'monster' | 'npc';
+export interface EntryRef {
+  kind: EntryKind;
+  id: string;
+  // It was added by hand a moment ago: its pop-out offers to add another.
+  isNew?: boolean;
+}
+
+export type MonsterInput = Omit<Monster, 'id' | 'campaignId'>;
+export type AbilityScores = Pick<Monster, 'strScore' | 'dexScore' | 'conScore' | 'intScore' | 'wisScore' | 'chaScore'>;
+export const scoreField = (ability: string) => `${ability.toLowerCase()}Score` as keyof AbilityScores;
+
+// "STR 8 · DEX 14 · …", in stat-block order.
+export function abilityLine(scores: AbilityScores): string {
+  return ABILITY_ORDER.map((a) => `${a} ${scores[scoreField(a)]}`).join(' · ');
+}
+
+// "1 gp = $5": the rate an NPC changes gold and cash at, or null if they don't.
+export function rateLabel(npc: Pick<Npc, 'exchangeGold' | 'exchangeCash'>): string | null {
+  if (!npc.exchangeGold || !npc.exchangeCash) return null;
+  return `${formatMoney(npc.exchangeGold, 'GOLD')} = ${formatMoney(npc.exchangeCash, 'CASH')}`;
+}
+
+// Whether every word of a search is somewhere in the text given: "fire bolt"
+// finds "Fire Bolt", and "bolt fire" does too.
+export function matchesSearch(query: string, ...fields: (string | number | null | undefined)[]): boolean {
+  const words = query.toLowerCase().split(/\s+/).filter(Boolean);
+  const text = fields.filter((f) => f !== null && f !== undefined).join(' ').toLowerCase();
+  return words.every((word) => text.includes(word));
+}

frontend/src/lib/characterPanel.ts

@@ -0,0 +1,29 @@
+import { useSyncExternalStore } from 'react';
+
+// Which character the floating character panel is showing, if it is open.
+// Kept outside React so that any page — an encounter card, say — can open the
+// panel for a particular character without being wired to the layout.
+let openId: string | null = null;
+const listeners = new Set<() => void>();
+
+function set(id: string | null) {
+  openId = id;
+  listeners.forEach((listener) => listener());
+}
+
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+export function openCharacterPanel(characterId: string) {
+  set(characterId);
+}
+
+export function closeCharacterPanel() {
+  set(null);
+}
+
+export function useCharacterPanelId(): string | null {
+  return useSyncExternalStore(subscribe, () => openId);
+}

frontend/src/lib/format.ts

@@ -1,3 +1,5 @@
+import type { Coin, Currency } from '../api/types';
+
 export const SPECIES_LABELS: Record<string, string> = {
   HUMAN: 'Human',
   HALF_ELF: 'Half-Elf',
@@ -70,6 +72,38 @@ export function hpBarClass(current: number, max: number): string {
   return 'hp-bar-fill';
 }
 
+// Coins. Silver is worth 0.1 gold and copper 0.01 gold.
+export const COINS: Coin[] = ['GOLD', 'SILVER', 'COPPER'];
+// Everything a purse can hold: the coins, plus cash ($) for crossover worlds.
+// Cash has no worth in coins, so it is never exchanged or used to make change.
+export const CURRENCIES: Currency[] = [...COINS, 'CASH'];
+export const COIN_LABELS: Record<Currency, string> = { GOLD: 'Gold', SILVER: 'Silver', COPPER: 'Copper', CASH: 'Cash ($)' };
+export const COIN_FIELD: Record<Currency, 'gold' | 'silver' | 'copper' | 'cash'> = { GOLD: 'gold', SILVER: 'silver', COPPER: 'copper', CASH: 'cash' };
+// What one coin is worth, counted in copper.
+export const COIN_VALUE: Record<Coin, number> = { GOLD: 100, SILVER: 10, COPPER: 1 };
+const COIN_SHORT: Record<Coin, string> = { GOLD: 'gp', SILVER: 'sp', COPPER: 'cp' };
+
+// "12 gp", "5 sp", "$40". With `long`, coins are spelled out: "12 gold".
+export function formatMoney(amount: number, currency: Currency, long = false): string {
+  if (currency === 'CASH') return `$${amount}`;
+  return `${amount} ${long ? COIN_LABELS[currency].toLowerCase() : COIN_SHORT[currency]}`;
+}
+
+type Purse = { gold: number | null; silver: number | null; copper: number | null; cash: number | null };
+
+// "12 gp · 5 sp · 3 cp · $40". Gold always shows; the rest only when held.
+export function formatPurse(purse: Purse): string {
+  return CURRENCIES.filter((c) => c === 'GOLD' || (purse[COIN_FIELD[c]] ?? 0) > 0)
+    .map((c) => formatMoney(purse[COIN_FIELD[c]] ?? 0, c))
+    .join(' · ');
+}
+
+// The purse's coins as one figure in gold, e.g. 12.65. Cash is not counted.
+export function purseWorthInGold(purse: Purse): number {
+  const copper = COINS.reduce((sum, c) => sum + (purse[COIN_FIELD[c]] ?? 0) * COIN_VALUE[c], 0);
+  return copper / COIN_VALUE.GOLD;
+}
+
 export function extractErrorMessage(err: unknown): string {
   const anyErr = err as { response?: { data?: { error?: unknown } } };
   const apiError = anyErr?.response?.data?.error;
@@ -93,6 +127,17 @@ export function spellLevelLabel(level: number): string {
   return level === 0 ? 'Cantrip' : `Level ${level}`;
 }
 
+// A spell slot's level: "1st", "2nd"…
+const ORDINALS = ['1st', '2nd', '3rd', '4th', '5th', '6th', '7th', '8th', '9th'];
+export function slotLevelLabel(level: number): string {
+  return ORDINALS[level - 1] ?? `${level}th`;
+}
+
+// A character's spell slots in a few words: "1st 3/4 · 2nd 2/2" (left / in all).
+export function slotsSummary(slots: { levels: { level: number; max: number; remaining: number }[] } | null): string {
+  return slots ? slots.levels.map((s) => `${slotLevelLabel(s.level)} ${s.remaining}/${s.max}`).join(' · ') : '';
+}
+
 // Who can use a spell: a character of at least its level; cantrips, anyone.
 export function spellRequirementLabel(level: number): string {
   return level === 0 ? 'any character can use it' : `needs character level ${level}`;

frontend/src/lib/gear.ts

@@ -0,0 +1,43 @@
+import { ABILITY_LABELS, SKILL_LABELS, fmtMod } from './format';
+import type { GearEffect } from '../api/types';
+
+// What a weapon or item can change on the sheet of whoever has it equipped.
+// Mirrors GEAR_STATS in backend/src/game/calculations.js; the server is what
+// applies them, this is only for naming them and offering them in a form.
+const ABILITIES = Object.keys(ABILITY_LABELS);
+const SKILLS = Object.keys(SKILL_LABELS);
+
+export const GEAR_STAT_GROUPS: { label: string; stats: string[] }[] = [
+  { label: 'Combat', stats: ['AC', 'SPEED', 'INITIATIVE', 'MAX_HP', 'PASSIVE_PERCEPTION'] },
+  { label: 'Ability scores', stats: ABILITIES },
+  { label: 'Saving throws', stats: ['SAVES', ...ABILITIES.map((a) => `SAVE_${a}`)] },
+  { label: 'Skills', stats: ['SKILLS', ...SKILLS.map((s) => `SKILL_${s}`)] },
+];
+
+const FIXED_LABELS: Record<string, string> = {
+  AC: 'AC',
+  SPEED: 'Speed',
+  INITIATIVE: 'Initiative',
+  MAX_HP: 'Max HP',
+  PASSIVE_PERCEPTION: 'Passive Perception',
+  SAVES: 'All saving throws',
+  SKILLS: 'All skill checks',
+};
+
+export function gearStatLabel(stat: string): string {
+  if (FIXED_LABELS[stat]) return FIXED_LABELS[stat];
+  if (stat.startsWith('SAVE_')) return `${ABILITY_LABELS[stat.slice(5)] ?? stat} saves`;
+  if (stat.startsWith('SKILL_')) return SKILL_LABELS[stat.slice(6)] ?? stat;
+  return ABILITY_LABELS[stat] ?? stat;
+}
+
+// "+6 AC", "−10 Speed".
+export function effectLabel(effect: GearEffect): string {
+  return `${fmtMod(effect.amount).replace('-', '−')} ${gearStatLabel(effect.stat)}`;
+}
+
+// "+6 AC · −10 Speed · Disadvantage on Stealth", or null when it does nothing.
+export function effectsSummary(effects: GearEffect[] | undefined, note?: string | null): string | null {
+  const parts = [...(effects ?? []).map(effectLabel), ...(note ? [note] : [])];
+  return parts.length ? parts.join(' · ') : null;
+}

frontend/src/lib/lastCampaign.ts

@@ -0,0 +1,34 @@
+import { useEffect, useSyncExternalStore } from 'react';
+
+// The campaign the user was last in, so the navigation can always offer a way
+// back to it — from a character sheet or an encounter, whose addresses don't
+// say which campaign they belong to. Kept per browser.
+const KEY = 'dnd_last_campaign';
+const listeners = new Set<() => void>();
+
+function read(): string | null {
+  return localStorage.getItem(KEY);
+}
+
+function subscribe(listener: () => void) {
+  listeners.add(listener);
+  return () => listeners.delete(listener);
+}
+
+export function forgetCampaign() {
+  localStorage.removeItem(KEY);
+  listeners.forEach((listener) => listener());
+}
+
+export function useLastCampaignId(): string | null {
+  return useSyncExternalStore(subscribe, read);
+}
+
+// Call from any page that knows which campaign it is showing.
+export function useRememberCampaign(campaignId: string | null | undefined) {
+  useEffect(() => {
+    if (!campaignId || read() === campaignId) return;
+    localStorage.setItem(KEY, campaignId);
+    listeners.forEach((listener) => listener());
+  }, [campaignId]);
+}

frontend/src/lib/wares.ts

@@ -0,0 +1,14 @@
+import { scaledDamageDice } from './previewCalc';
+import type { SaleOffer } from '../api/types';
+
+// "🗡 Longsword · Lv 2 · 1d10": what a ware is, for anyone looking at it.
+export function wareName(ware: SaleOffer): string {
+  const entry = ware.weapon ?? ware.item;
+  if (!entry) return 'Removed from the pool';
+  const dice = entry.damageDice ? ` · ${scaledDamageDice(entry.damageDice, ware.level, entry.damageScaling, entry.minLevel)}` : '';
+  return `${ware.weapon ? '🗡' : '🎒'} ${entry.name} · Lv ${ware.level}${dice}`;
+}
+
+export function stockLabel(ware: SaleOffer): string {
+  return ware.stock === null ? 'always in stock' : ware.stock === 0 ? 'sold out' : `${ware.stock} left`;
+}

frontend/src/pages/AccountPage.tsx

@@ -1,6 +1,6 @@
 import { useState, type FormEvent } from 'react';
 import { apiClient } from '../api/client';
-import { useAuth } from '../auth/AuthContext';
+import { useAuth } from '../auth/useAuth';
 import { extractErrorMessage } from '../lib/format';
 import { ErrorBanner } from '../components/Spinner';