[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_110":111,"_112":113},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","RT_Brandt","name","throne-ledger","path","lib/api.ts","project",{"_22":48,"_11":12,"_35":49,"_50":-5,"_51":44,"_52":53,"_54":53,"_55":56,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/RT_Brandt/throne-ledger/code/lib/api.ts","extension","id","9192b16a-0b99-41c5-9b51-173ee00c720d","api.ts","fileId","d9426dd6-b010-11f1-9d52-1607ee4eb77e","parentId","36d116d1-be79-439b-af80-39fd2bb6eeb1","branchId","649b81a3-ef64-48e6-b6db-ab0a767348e2","branchVersion",144,"latest",true,"createdAt",["D",1789378218299],"version",16,"fileType","script","content","import { Hono } from \"npm:hono\";\nimport {\n applyLevy,\n MIN_BID,\n queryAll,\n queryOne,\n ready,\n run,\n SELLBACK_RATE,\n sqlite,\n STARTING_BALANCE,\n TAX_RATE,\n} from \"./db.ts\";\nimport { hashPassword, newId, verifyPassword } from \"./crypto.ts\";\nimport {\n clearFailedLogins,\n createSession,\n currentUser,\n destroySession,\n isLockedOut,\n recordFailedLogin,\n requireAdmin,\n requireUser,\n sameOriginOnly,\n type SessionUser,\n} from \"./auth.ts\";\n\nexport const api = new Hono();\n\napi.use(\"*\", async (c, next) => {\n await ready();\n await next();\n});\napi.use(\"*\", sameOriginOnly);\n\nconst USERNAME_RE = /^[A-Za-z0-9_-]{3,24}$/;\nconst MIN_PASSWORD = 8;\n\nfunction bad(c: any, msg: string, code = 400) {\n return c.json({ error: msg }, code);\n}\n\nasync function body(c: any): Promise> {\n try {\n const b = await c.req.json();\n return b && typeof b === \"object\" ? b : {};\n } catch {\n return {};\n }\n}\n\nfunction publicUser(u: SessionUser) {\n return {\n id: u.id,\n username: u.username,\n balance: u.balance,\n isAdmin: !!u.is_admin,\n wins: u.wins,\n losses: u.losses,\n };\n}\n\n/**\n * open - accepting stakes\n * resolving - the clock ran out; waiting on the Overseer to call it\n * resolved - paid out\n */\nfunction lifecycle(bet: any, now: number): string {\n if (bet.status === \"resolved\") return \"resolved\";\n if (Number(bet.closes_at) <= now) return \"resolving\";\n return \"open\";\n}\n\n// ─── auth ────────────────────────────────────────────────────────────\n\napi.post(\"/register\", async (c) => {\n const { username, password } = await body(c);\n\n if (typeof username !== \"string\" || !USERNAME_RE.test(username.trim())) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (typeof password !== \"string\" || password.length < MIN_PASSWORD) {\n return bad(c, `Passphrase must be at least ${MIN_PASSWORD} characters.`);\n }\n if (password.length > 200) return bad(c, \"Passphrase too long.\");\n\n const name = username.trim();\n const lower = name.toLowerCase();\n\n const clash = await queryOne(\"SELECT id FROM users WHERE username_lower = ?\", [lower]);\n if (clash) return bad(c, \"That handle is already registered.\", 409);\n\n const id = newId(\"usr\");\n try {\n await run(\n `INSERT INTO users (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, ?, 0, ?)`,\n [id, name, lower, await hashPassword(password), STARTING_BALANCE, Date.now()],\n );\n } catch {\n return bad(c, \"That handle is already registered.\", 409);\n }\n\n await createSession(c, id);\n return c.json({\n user: { id, username: name, balance: STARTING_BALANCE, isAdmin: false, wins: 0, losses: 0 },\n });\n});\n\napi.post(\"/login\", async (c) => {\n const { username, password } = await body(c);\n if (typeof username !== \"string\" || typeof password !== \"string\") {\n return bad(c, \"Handle and passphrase required.\");\n }\n\n const row = await queryOne(\n `SELECT id, username, password_hash, balance, is_admin, wins, losses,\n failed_attempts, locked_until\n FROM users WHERE username_lower = ?`,\n [username.trim().toLowerCase()],\n );\n\n const REJECT = \"Authentication rejected.\";\n\n if (!row) {\n await verifyPassword(password, \"pbkdf2$120000$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\");\n return bad(c, REJECT, 401);\n }\n if (isLockedOut(row)) {\n return bad(c, \"Too many failed attempts. Try again in a few minutes.\", 429);\n }\n\n const ok = await verifyPassword(password, String(row.password_hash));\n if (!ok) {\n await recordFailedLogin(String(row.id), Number(row.failed_attempts || 0));\n return bad(c, REJECT, 401);\n }\n\n await clearFailedLogins(String(row.id));\n await createSession(c, String(row.id));\n\n return c.json({\n user: {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n isAdmin: !!Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n },\n });\n});\n\napi.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.json({ ok: true });\n});\n\napi.get(\"/me\", async (c) => {\n const user = await currentUser(c);\n return c.json({ user: user ? publicUser(user) : null });\n});\n\n// ─── market ──────────────────────────────────────────────────────────\n\napi.get(\"/bets\", async (c) => {\n const user = await currentUser(c);\n const now = Date.now();\n\n const bets = await queryAll(\n `SELECT b.*,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = b.id AND w.status = 'pending'), 0) AS active_pool\n FROM bets b\n ORDER BY b.created_at DESC`,\n );\n\n const options = await queryAll(\n `SELECT o.id, o.bet_id, o.label, o.sort_order,\n COALESCE(SUM(CASE WHEN w.status = 'pending' THEN w.stake ELSE 0 END), 0) AS pool,\n COUNT(CASE WHEN w.status = 'pending' THEN 1 END) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id\n ORDER BY o.sort_order`,\n );\n\n const mine = user\n ? await queryAll(\n `SELECT id, bet_id, option_id, stake, tax, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY created_at DESC`,\n [user.id],\n )\n : [];\n\n const optsByBet: Record = {};\n for (const o of options) (optsByBet[String(o.bet_id)] ||= []).push(o);\n\n const mineByBet: Record = {};\n for (const w of mine) {\n (mineByBet[String(w.bet_id)] ||= []).push({\n id: w.id,\n optionId: w.option_id,\n stake: Number(w.stake),\n tax: Number(w.tax || 0),\n paid: Number(w.stake) + Number(w.tax || 0),\n status: w.status,\n payout: Number(w.payout),\n createdAt: Number(w.created_at),\n sellbackValue: Math.floor(Number(w.stake) * SELLBACK_RATE),\n });\n }\n\n return c.json({\n now,\n sellbackRate: SELLBACK_RATE,\n taxRate: TAX_RATE,\n minBid: MIN_BID,\n bets: bets.map((b) => {\n const forfeited = Number(b.forfeited || 0);\n const totalPot = Number(b.active_pool || 0) + forfeited;\n const opts = (optsByBet[String(b.id)] || []).map((o) => {\n const pool = Number(o.pool);\n return {\n id: o.id,\n label: o.label,\n pool,\n backers: Number(o.backers),\n // Share of the pot currently sitting on this outcome. Doubles as\n // the market's implied probability.\n share: totalPot > 0 ? pool / totalPot : 0,\n // What one Gelt on this outcome would return if it won right now.\n payoutPerGelt: pool > 0 ? totalPot / pool : 0,\n };\n });\n return {\n id: b.id,\n title: b.title,\n description: b.description,\n status: lifecycle(b, now),\n closesAt: Number(b.closes_at),\n winningOptionId: b.winning_option_id,\n createdAt: Number(b.created_at),\n resolvedAt: b.resolved_at ? Number(b.resolved_at) : null,\n totalPot,\n forfeited,\n options: opts,\n myWagers: mineByBet[String(b.id)] || [],\n };\n }),\n });\n});\n\napi.get(\"/leaderboard\", async (c) => {\n const byWallet = await queryAll(\n `SELECT username, balance, wins, losses\n FROM users WHERE is_admin = 0\n ORDER BY balance DESC, wins DESC LIMIT 50`,\n );\n\n // Win rate, but only for people who have actually settled something.\n const byRatio = await queryAll(\n `SELECT username, balance, wins, losses,\n CAST(wins AS REAL) / (wins + losses) AS rate\n FROM users\n WHERE is_admin = 0 AND (wins + losses) > 0\n ORDER BY rate DESC, (wins + losses) DESC, balance DESC\n LIMIT 50`,\n );\n\n const shape = (r: any) => ({\n username: r.username,\n balance: Number(r.balance),\n wins: Number(r.wins),\n losses: Number(r.losses),\n rate: r.rate === undefined || r.rate === null ? null : Number(r.rate),\n });\n\n return c.json({ byWallet: byWallet.map(shape), byRatio: byRatio.map(shape) });\n});\n\n// ─── taking a position ───────────────────────────────────────────────\n\napi.post(\"/wagers\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const { betId, optionId, stake } = await body(c);\n\n const gross = Number(stake);\n if (!Number.isInteger(gross) || gross <= 0) {\n return bad(c, \"Bid must be a whole number above zero.\");\n }\n if (gross < MIN_BID) {\n return bad(c, `Minimum bid is ${MIN_BID} Gelt. Anything smaller is swallowed whole by the levy.`);\n }\n if (gross > 1_000_000_000) return bad(c, \"Bid too large.\");\n\n const option = await queryOne(\n `SELECT o.id, o.bet_id, b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ? AND o.bet_id = ?`,\n [String(optionId ?? \"\"), String(betId ?? \"\")],\n );\n if (!option) return bad(c, \"No such outcome.\", 404);\n if (option.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(option.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed and is awaiting resolution.\", 409);\n }\n\n // The levy comes out of the bid, so the wallet is debited the full\n // amount and only the remainder reaches the pot.\n const { tax, net } = applyLevy(gross);\n const now = Date.now();\n\n // Both statements test the same balance inside one transaction, so they\n // agree: either the bid is affordable and both apply, or neither does.\n const results = await sqlite.batch([\n {\n sql: `INSERT INTO wagers (id, user_id, bet_id, option_id, stake, tax, status, created_at)\n SELECT ?, ?, ?, ?, ?, ?, 'pending', ?\n WHERE (SELECT balance FROM users WHERE id = ?) >= ?`,\n args: [newId(\"wgr\"), user.id, String(option.bet_id), String(option.id),\n net, tax, now, user.id, gross],\n },\n {\n sql: \"UPDATE users SET balance = balance - ? WHERE id = ? AND balance >= ?\",\n args: [gross, user.id, gross],\n },\n ], \"write\");\n\n if (!results[1] || Number(results[1].rowsAffected) !== 1) {\n return bad(c, \"Insufficient Throne Gelt.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({\n ok: true,\n balance: Number(fresh?.balance ?? 0),\n paid: gross,\n levy: tax,\n intoPot: net,\n });\n});\n\n/**\n * Sell a position back to the house while the market is still open.\n *\n * In a parimutuel pool the fair value of a position is simply its stake:\n * the odds move to keep expected value flat, so there is no \"current price\"\n * to mark against. The exit therefore returns a flat 90% of the stake, and\n * the 10% stays in the pot for whoever is still holding at resolution.\n */\napi.post(\"/wagers/:id/sell\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const wagerId = c.req.param(\"id\");\n\n const w = await queryOne(\n `SELECT w.id, w.user_id, w.bet_id, w.stake, w.status, b.status AS bet_status, b.closes_at\n FROM wagers w JOIN bets b ON b.id = w.bet_id\n WHERE w.id = ?`,\n [wagerId],\n );\n if (!w) return bad(c, \"No such position.\", 404);\n if (String(w.user_id) !== user.id) return bad(c, \"That is not your position.\", 403);\n if (w.status !== \"pending\") return bad(c, \"That position is already settled.\", 409);\n if (w.bet_status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(w.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed. Positions can no longer be sold.\", 409);\n }\n\n const stake = Number(w.stake);\n const refund = Math.floor(stake * SELLBACK_RATE);\n const forfeit = stake - refund;\n const now = Date.now();\n\n // The first two statements are guarded on the wager still being pending,\n // and they run before the third flips it. A duplicate request therefore\n // changes nothing at all rather than paying out twice.\n const results = await sqlite.batch([\n {\n sql: `UPDATE users SET balance = balance + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [refund, user.id, wagerId],\n },\n {\n sql: `UPDATE bets SET forfeited = forfeited + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [forfeit, String(w.bet_id), wagerId],\n },\n {\n sql: `UPDATE wagers SET status = 'sold', payout = ?, settled_at = ?\n WHERE id = ? AND status = 'pending'`,\n args: [refund, now, wagerId],\n },\n ], \"write\");\n\n if (!results[2] || Number(results[2].rowsAffected) !== 1) {\n return bad(c, \"That position is already settled.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({ ok: true, refund, forfeit, balance: Number(fresh?.balance ?? 0) });\n});\n\n// ─── admin ───────────────────────────────────────────────────────────\n\napi.get(\"/admin/users\", requireAdmin, async (c) => {\n const rows = await queryAll(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, u.created_at,\n COALESCE((SELECT COUNT(*) FROM wagers w WHERE w.user_id = u.id), 0) AS wager_count,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.user_id = u.id AND w.status = 'pending'), 0) AS at_risk,\n COALESCE((SELECT SUM(w.tax) FROM wagers w WHERE w.user_id = u.id), 0) AS levied\n FROM users u\n ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(tax), 0) AS levy,\n COALESCE(SUM(stake), 0) AS staked,\n COUNT(*) AS wagers\n FROM wagers`,\n );\n\n return c.json({\n users: rows.map((r) => ({\n id: r.id,\n username: r.username,\n balance: Number(r.balance),\n isAdmin: !!Number(r.is_admin),\n wins: Number(r.wins),\n losses: Number(r.losses),\n wagerCount: Number(r.wager_count),\n atRisk: Number(r.at_risk),\n levied: Number(r.levied),\n createdAt: Number(r.created_at),\n })),\n treasury: {\n levyCollected: Number(totals?.levy ?? 0),\n totalStaked: Number(totals?.staked ?? 0),\n wagers: Number(totals?.wagers ?? 0),\n rate: TAX_RATE,\n },\n });\n});\n\n/** Title, description, outcome labels, duration. No odds: the pot sets those. */\napi.post(\"/admin/bets\", requireAdmin, async (c) => {\n const { title, description, options, durationMinutes } = await body(c);\n\n if (typeof title !== \"string\" || title.trim().length < 3) {\n return bad(c, \"Title must be at least 3 characters.\");\n }\n if (title.length > 200) return bad(c, \"Title too long.\");\n\n const desc = typeof description === \"string\" ? description.trim() : \"\";\n if (desc.length > 2000) return bad(c, \"Description too long.\");\n\n const mins = Number(durationMinutes);\n if (!Number.isFinite(mins) || mins < 1 || mins > 60 * 24 * 60) {\n return bad(c, \"Duration must be between 1 minute and 60 days.\");\n }\n\n if (!Array.isArray(options) || options.length < 2 || options.length > 8) {\n return bad(c, \"A market needs between 2 and 8 outcomes.\");\n }\n\n const labels: string[] = [];\n for (const o of options) {\n const label = (typeof o === \"string\" ? o : o?.label);\n const clean = typeof label === \"string\" ? label.trim() : \"\";\n if (!clean) return bad(c, \"Every outcome needs a label.\");\n if (clean.length > 120) return bad(c, \"Outcome label too long.\");\n if (labels.some((l) => l.toLowerCase() === clean.toLowerCase())) {\n return bad(c, \"Outcome labels must be distinct.\");\n }\n labels.push(clean);\n }\n\n const betId = newId(\"bet\");\n const now = Date.now();\n const closesAt = now + Math.round(mins * 60_000);\n\n const stmts = [{\n sql: `INSERT INTO bets (id, title, description, status, closes_at, forfeited, created_at)\n VALUES (?, ?, ?, 'open', ?, 0, ?)`,\n args: [betId, title.trim(), desc, closesAt, now],\n }];\n labels.forEach((label, i) => {\n stmts.push({\n sql: `INSERT INTO bet_options (id, bet_id, label, sort_order) VALUES (?, ?, ?, ?)`,\n args: [newId(\"opt\"), betId, label, i],\n });\n });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, betId, closesAt });\n});\n\n/** Force the market into resolving ahead of its deadline. */\napi.post(\"/admin/bets/:id/close\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [id]);\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"Already resolved.\", 409);\n\n await run(\"UPDATE bets SET closes_at = ? WHERE id = ?\", [Date.now(), id]);\n return c.json({ ok: true });\n});\n\n/**\n * Pay out the whole pot to backers of the winning outcome, split by each\n * backer's share of that outcome's pool. Losing stakes are not returned.\n *\n * Only legal once the market is closed, which means no new money can\n * arrive between reading the pool sizes and writing the payouts.\n */\napi.post(\"/admin/bets/:id/resolve\", requireAdmin, async (c) => {\n const betId = c.req.param(\"id\");\n const { winningOptionId } = await body(c);\n const optId = String(winningOptionId ?? \"\");\n const now = Date.now();\n\n const bet = await queryOne(\n \"SELECT id, status, closes_at, forfeited FROM bets WHERE id = ?\",\n [betId],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(bet.closes_at) > now) {\n return bad(c, \"This market is still open. Close it first.\", 409);\n }\n\n const option = await queryOne(\n \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n [optId, betId],\n );\n if (!option) return bad(c, \"That outcome does not belong to this market.\", 400);\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(stake), 0) AS active,\n COALESCE(SUM(CASE WHEN option_id = ? THEN stake ELSE 0 END), 0) AS win_pool\n FROM wagers WHERE bet_id = ? AND status = 'pending'`,\n [optId, betId],\n );\n const totalPot = Number(totals?.active ?? 0) + Number(bet.forfeited ?? 0);\n const winPool = Number(totals?.win_pool ?? 0);\n\n // If nobody backed the winning outcome, winPool is 0 and the general\n // path below handles it correctly on its own: the \"won\" update matches\n // no rows (so its divisor is never evaluated), every stake is marked\n // lost, and the pot is forfeit to the house. Back a long shot alone and\n // you take the lot; back nothing that lands and the Warrant keeps it.\n\n await sqlite.batch([\n // Each winner takes the pot in proportion to their share of the\n // winning pool. Truncated, so the pot can never be overdrawn.\n {\n sql: `UPDATE wagers\n SET status = 'won',\n payout = CAST((CAST(stake AS REAL) * ? / ?) AS INTEGER),\n settled_at = ?\n WHERE bet_id = ? AND option_id = ? AND status = 'pending'`,\n args: [totalPot, winPool, now, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'lost', payout = 0, settled_at = ?\n WHERE bet_id = ? AND option_id != ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE users\n SET balance = balance + COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0),\n wins = wins + COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [betId, betId, betId],\n },\n {\n sql: `UPDATE users\n SET losses = losses + (\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost')\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [betId, betId],\n },\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ? WHERE id = ?`,\n args: [optId, now, betId],\n },\n ], \"write\");\n\n const paid = await queryOne(\n `SELECT COUNT(*) AS n, COALESCE(SUM(payout), 0) AS total\n FROM wagers WHERE bet_id = ? AND status = 'won'`,\n [betId],\n );\n\n return c.json({\n ok: true,\n houseWins: winPool === 0,\n winnersPaid: Number(paid?.n ?? 0),\n totalPaid: Number(paid?.total ?? 0),\n totalPot,\n });\n});\n\n/** Immediate stipend to every non-admin account. */\napi.post(\"/admin/fund\", requireAdmin, async (c) => {\n const { amount } = await body(c);\n const value = Number(amount);\n if (!Number.isInteger(value) || value === 0) {\n return bad(c, \"Amount must be a non-zero whole number.\");\n }\n if (Math.abs(value) > 10_000_000) return bad(c, \"Amount too large.\");\n\n const res = await run(\n value > 0\n ? \"UPDATE users SET balance = balance + ? WHERE is_admin = 0\"\n : \"UPDATE users SET balance = MAX(0, balance + ?) WHERE is_admin = 0\",\n [value],\n );\n\n return c.json({ ok: true, accounts: Number(res.rowsAffected ?? 0), amount: value });\n});\n\n// ─── campaign map ────────────────────────────────────────────────────\n\n/** The live board, readable by anyone. */\napi.get(\"/campaign\", async (c) => {\n const row = await queryOne(\n \"SELECT round, save_code, created_at FROM campaign_rounds ORDER BY round DESC LIMIT 1\",\n );\n if (!row) return c.json({ round: null, saveCode: null });\n return c.json({\n round: Number(row.round),\n saveCode: String(row.save_code),\n createdAt: Number(row.created_at),\n });\n});\n\n/** Every published round, oldest first. Public: the history tab uses it. */\napi.get(\"/campaign/rounds\", async (c) => {\n const rows = await queryAll(\n `SELECT round, note, created_at, LENGTH(log) AS log_size\n FROM campaign_rounds ORDER BY round ASC`,\n );\n return c.json({\n rounds: rows.map((r) => ({\n round: Number(r.round),\n note: r.note,\n createdAt: Number(r.created_at),\n hasLog: Number(r.log_size) > 0,\n })),\n });\n});\n\n/** One round in full, board and log. Public. */\napi.get(\"/campaign/rounds/:round\", async (c) => {\n const n = Number(c.req.param(\"round\"));\n if (!Number.isInteger(n)) return bad(c, \"Round must be a whole number.\");\n\n const row = await queryOne(\n \"SELECT round, save_code, log, note, created_at FROM campaign_rounds WHERE round = ?\",\n [n],\n );\n if (!row) return bad(c, \"No snapshot for that round.\", 404);\n\n return c.json({\n round: Number(row.round),\n saveCode: String(row.save_code),\n log: String(row.log || \"\"),\n note: row.note,\n createdAt: Number(row.created_at),\n });\n});\n\n/** Every snapshot, newest first. Used by the rollback picker. */\napi.get(\"/admin/campaign/history\", requireAdmin, async (c) => {\n const rows = await queryAll(\n \"SELECT round, note, created_at, LENGTH(save_code) AS size FROM campaign_rounds ORDER BY round DESC\",\n );\n return c.json({\n rounds: rows.map((r) => ({\n round: Number(r.round),\n note: r.note,\n createdAt: Number(r.created_at),\n size: Number(r.size),\n })),\n });\n});\n\n/** Publish a new board state. Replaces the snapshot for that round. */\napi.post(\"/admin/campaign\", requireAdmin, async (c) => {\n const { round, saveCode, note, log } = await body(c);\n const n = Number(round);\n\n if (!Number.isInteger(n) || n < 0 || n > 100000) {\n return bad(c, \"Round must be a whole number.\");\n }\n if (typeof saveCode !== \"string\" || saveCode.length < 16) {\n return bad(c, \"Missing or malformed save code.\");\n }\n if (saveCode.length > 2_000_000) return bad(c, \"Save code too large.\");\n if (!/^[A-Za-z0-9+/=]+$/.test(saveCode)) return bad(c, \"Save code must be base64.\");\n\n const roundLog = typeof log === \"string\" ? log.slice(0, 200_000) : \"\";\n\n await run(\n `INSERT INTO campaign_rounds (round, save_code, log, note, created_at)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(round) DO UPDATE SET save_code = excluded.save_code,\n log = excluded.log,\n note = excluded.note,\n created_at = excluded.created_at`,\n [n, saveCode, roundLog, typeof note === \"string\" ? note.slice(0, 200) : \"\", Date.now()],\n );\n\n return c.json({ ok: true, round: n, logLines: roundLog ? roundLog.split(\"\\n\").length : 0 });\n});\n\n/**\n * Roll the board back to an earlier round. Everything after it is\n * discarded, so the next advance replays from there.\n */\napi.post(\"/admin/campaign/rollback\", requireAdmin, async (c) => {\n const { round } = await body(c);\n const n = Number(round);\n if (!Number.isInteger(n) || n < 0) return bad(c, \"Round must be a whole number.\");\n\n const target = await queryOne(\n \"SELECT round, save_code FROM campaign_rounds WHERE round = ?\",\n [n],\n );\n if (!target) return bad(c, \"No snapshot for that round.\", 404);\n\n const res = await run(\"DELETE FROM campaign_rounds WHERE round > ?\", [n]);\n return c.json({\n ok: true,\n round: n,\n discarded: Number(res.rowsAffected ?? 0),\n saveCode: String(target.save_code),\n });\n});\n\n/** Wipe the board entirely so a fresh campaign can be generated. */\napi.delete(\"/admin/campaign\", requireAdmin, async (c) => {\n const res = await run(\"DELETE FROM campaign_rounds\");\n return c.json({ ok: true, discarded: Number(res.rowsAffected ?? 0) });\n});\n\n/**\n * Remove a market entirely.\n *\n * Open or resolving markets always refund their pending stakes, because\n * those positions never settled and the Gelt is still owed.\n *\n * For a resolved market, ?reverse=1 undoes the settlement as well:\n * winnings are clawed back, every stake is returned, and the win/loss\n * counters are decremented. Without it the market simply disappears from\n * the archive and whatever was paid out stays paid.\n */\napi.delete(\"/admin/bets/:id\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const reverse = c.req.query(\"reverse\") === \"1\";\n\n const bet = await queryOne(\n \"SELECT id, title, status FROM bets WHERE id = ?\",\n [id],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n\n const resolved = bet.status === \"resolved\";\n const undo = resolved && reverse;\n\n // What was staked and paid, recorded before anything is deleted.\n const tally = await queryOne(\n `SELECT COUNT(*) AS n,\n COALESCE(SUM(CASE WHEN status != 'sold' THEN stake + tax ELSE 0 END), 0) AS staked,\n COALESCE(SUM(CASE WHEN status = 'won' THEN payout ELSE 0 END), 0) AS paid,\n COALESCE(SUM(tax), 0) AS levied\n FROM wagers WHERE bet_id = ?`,\n [id],\n );\n\n const stmts: { sql: string; args: any[] }[] = [];\n\n if (!resolved) {\n // Never settled: hand back the full amount paid, levy included.\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'pending')`,\n args: [id, id],\n });\n } else if (undo) {\n // Return everything paid in, levy included, on positions that weren't\n // voluntarily sold out of...\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status IN ('won','lost')), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status IN ('won','lost'))`,\n args: [id, id],\n });\n // ...then take back the winnings that were paid on top.\n stmts.push({\n sql: `UPDATE users SET balance = MAX(0, balance - COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET wins = MAX(0, wins - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET losses = MAX(0, losses - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [id, id],\n });\n }\n\n stmts.push({ sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bets WHERE id = ?\", args: [id] });\n\n await sqlite.batch(stmts, \"write\");\n\n return c.json({\n ok: true,\n deleted: bet.title,\n wasResolved: resolved,\n reversed: undo,\n wagers: Number(tally?.n ?? 0),\n stakeReturned: (!resolved || undo) ? Number(tally?.staked ?? 0) : 0,\n winningsClawedBack: undo ? Number(tally?.paid ?? 0) : 0,\n levyRefunded: (!resolved || undo) ? Number(tally?.levied ?? 0) : 0,\n });\n});\n\napi.delete(\"/admin/users/:id\", requireAdmin, async (c) => {\n const actor = c.get(\"user\") as SessionUser;\n const id = c.req.param(\"id\");\n\n const target = await queryOne(\n \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n [id],\n );\n if (!target) return bad(c, \"No such account.\", 404);\n if (String(target.id) === actor.id) return bad(c, \"You cannot delete your own account.\", 400);\n if (Number(target.is_admin)) return bad(c, \"Overseer accounts cannot be deleted here.\", 400);\n\n // Open positions leave the pot with them; the stake is not refunded to\n // anyone, so fold it into forfeited to keep each pot's arithmetic honest.\n await sqlite.batch([\n {\n sql: `UPDATE bets SET forfeited = forfeited + COALESCE((\n SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = bets.id AND w.user_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT bet_id FROM wagers WHERE user_id = ? AND status = 'pending')`,\n args: [id, id],\n },\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [id] },\n ], \"write\");\n\n return c.json({ ok: true, deleted: target.username });\n});\n","deleted",false,"label",[47,24],"lib","3acf27cf-bc0f-4f45-b440-a47608349aee",["D",1789371999223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger for the Battle for the Hive campaign","imageUrl","userId","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","6b608f96-b010-11f1-9552-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","3acf27cfbc0f4f45b440a47608349aee","tursoHostname","3acf27cfbc0f4f45b440a47608349aee-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789459281818],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_109":105},"org",{"_9":10,"_102":103,"_104":105,"_58":59,"_106":107,"_108":44},"branch",{"_37":92,"_11":93,"_22":30,"_94":48,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":12,"_101":10},"isOwned",173,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_85":-5,"_143":144,"_145":146,"_147":148,"_149":44,"_150":44,"_151":44,"_152":34,"_153":-5,"_154":-7,"_155":-7,"_156":66,"_157":44,"_158":44,"_159":-5,"_160":44,"_161":44,"_162":44,"_163":-5},"ENV",{"_114":115,"_116":117,"_118":93,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]