A Telegram tap-and-build game where players grow a business from nothing. Progress earns in-game stars through play. Real Telegram Stars buy something different: actual business assets, generated and delivered for real.

THE DESIGN PROBLEM Two currencies in one interface. The earned currency drives the game loop. The real one crosses from simulation into fulfillment — a player running a fictional business can buy a real one's worth of assets without leaving the chat. The two have to feel connected enough that the purchase is a natural next step, and separated enough that nobody confuses play money for a payment.

HOW IT WORKS Node.js, Express, and MongoDB, with a Telegram Mini App front end. The game engine is server-authoritative: the client sends intent — "10 taps" — never outcomes. XP, levels, compounding upgrade costs, passive income, and missions are pure functions, with every balance number in a single catalog file.

The money path is the part worth reading. Telegram Stars invoices run through pre-checkout validation to fulfillment. A unique index on the Telegram charge ID means a replayed payment is caught and ignored. Stars debit through a conditional atomic update, so two concurrent purchases can't both succeed. Generation failures after a successful debit refund automatically.

Claude is treated as untrusted input. The router validates its JSON, overwrites the user ID with the authenticated Telegram ID, re-derives prices from the catalog rather than trusting the model, and rejects any function outside a four-entry allow-list.

Every request carries HMAC-validated Telegram initData, plus a webhook secret. The server returns render-ready screens through a JSON UI contract, so the client holds no prices and no rules.

Verified by 33 unit tests and 20 end-to-end HTTP tests against a real database. Rate limiting, structured logs with secrets redacted, health checks, Docker, deployed on Railway.