Cat Wars Admin Console

Super Admin controls for economy and market-force tuning.

Back to Game

\n\n

Overview

\n\n

Markets

\n \n \n \n

ID	Name	Region Risk	Action

\n\n

Breeds

\n \n \n \n

ID	Name	Base Price	Volatility	Legal Risk	Action

\n\n

\n\n \n\n`;\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

\n\n

The Situation

It is 2029. The federal government has outlawed felines nationwide. Cat ownership is now contraband, and the Department of Homeland Security runs aggressive interdiction sweeps across major U.S. cities.

You are an underground courier in a black-market trading ring. Your job is to jet city-to-city, buy cat breeds where prices are low, and sell where prices spike before DHS heat catches up.

How The Game Works

Register or log in to start your run.
Each market has different breed prices each day.
Buy low, travel, then sell high for profit.
Traveling raises Heat and can trigger a DHS bust.
Busts can seize cargo and force cash fines.
Use profits to pay down debt and stay solvent.

\n\n

\n \n \n

\n\n \n\n

DHS BUST IN PROGRESS :: CARGO SEIZURE + FINES APPLIED

VISITOR COUNTER 000042

\n\n \n\n`;\n}\n\n// --- Global middleware ---\napp.use(\"*\", async (_c, next) => {\n await initDb();\n await next();\n});\n\n// --- Page route ---\napp.get(\"/\", (c) => c.html(htmlPage()));\n\napp.get(\"/admin\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return c.text(\"Unauthorized\", 401);\n if (!isAdmin(user)) return c.text(\"Forbidden\", 403);\n return c.html(adminPage());\n});\n\n// --- Admin APIs ---\napp.get(\"/api/admin/overview\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const overview = await getAdminOverview();\n return c.json({ ok: true, overview });\n});\n\napp.get(\"/api/admin/markets\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const markets = await getMarkets();\n return c.json({ ok: true, markets });\n});\n\napp.post(\"/api/admin/markets/:marketId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const marketId = Number(c.req.param(\"marketId\"));\n if (!Number.isFinite(marketId)) return jsonError(\"Invalid market id.\");\n\n const body = await c.req.json().catch(() => null);\n const regionRisk = Number(body?.region_risk);\n if (!Number.isFinite(regionRisk) || regionRisk < 0 || regionRisk > 1) {\n return jsonError(\"region_risk must be between 0 and 1.\");\n }\n\n await sqlite.execute(\n `UPDATE markets SET region_risk = ${regionRisk} WHERE id = ${marketId};`,\n );\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/breeds\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breeds = await getBreeds();\n return c.json({ ok: true, breeds });\n});\n\napp.post(\"/api/admin/breeds/:breedId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breedId = Number(c.req.param(\"breedId\"));\n if (!Number.isFinite(breedId)) return jsonError(\"Invalid breed id.\");\n\n const body = await c.req.json().catch(() => null);\n const basePrice = Number(body?.base_price);\n const volatility = Number(body?.volatility);\n const legalRisk = Number(body?.legal_risk);\n\n if (!Number.isFinite(basePrice) || basePrice < 20) return jsonError(\"base_price must be >= 20.\");\n if (!Number.isFinite(volatility) || volatility < 0 || volatility > 2) return jsonError(\"volatility must be between 0 and 2.\");\n if (!Number.isFinite(legalRisk) || legalRisk < 0 || legalRisk > 1) return jsonError(\"legal_risk must be between 0 and 1.\");\n\n await sqlite.execute(\n `UPDATE breeds\n SET base_price = ${Math.floor(basePrice)}, volatility = ${volatility}, legal_risk = ${legalRisk}\n WHERE id = ${breedId};`,\n );\n return c.json({ ok: true });\n});\n\n// --- Auth routes ---\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n\n if (!username || typeof username !== \"string\" || username.length < 3 || username.length > 24) {\n return jsonError(\"Username must be 3-24 chars.\");\n }\n if (!/^[a-zA-Z0-9_\\-]+$/.test(username)) {\n return jsonError(\"Username can only use letters, numbers, _ and -.\");\n }\n if (typeof password !== \"string\" || password.length < 6) {\n return jsonError(\"Password must be at least 6 chars.\");\n }\n\n const existing = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (existing.rows.length > 0) return jsonError(\"Username already exists.\");\n\n const hash = await hashPassword(password);\n await sqlite.execute(\n `INSERT INTO users (username, password_hash, role, avatar_blob_key, created_at)\n VALUES ('${escapeSql(username)}', '${hash}', 'player', 'preset:street-tabby', '${new Date().toISOString()}');`,\n );\n\n const userRes = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n const userId = userRes.rows[0][0] as number;\n\n await bootstrapUser(userId);\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n if (!username || !password) return jsonError(\"Missing credentials.\");\n\n const userRes = await sqlite.execute(\n `SELECT id, password_hash FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return jsonError(\"Invalid credentials.\", 401);\n\n const expectedHash = userRes.rows[0][1] as string;\n const passwordHash = await hashPassword(password);\n if (passwordHash !== expectedHash) return jsonError(\"Invalid credentials.\", 401);\n\n const userId = userRes.rows[0][0] as number;\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const cookies = parseCookies(c.req.raw);\n const token = cookies[SESSION_COOKIE];\n if (token) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n }\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n clearSessionCookie(headers);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n const snapshot = await buildSnapshot(user);\n return c.json({ user: { id: user.id, username: user.username }, snapshot, notice });\n});\n\napp.post(\"/api/avatar/preset\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const avatarId = body?.avatarId;\n if (!avatarId || typeof avatarId !== \"string\") return jsonError(\"avatarId required.\");\n if (!PIXEL_AVATARS.some((a) => a.id === avatarId)) return jsonError(\"Unknown pixel avatar.\");\n\n const avatarKey = \"preset:\" + avatarId;\n await sqlite.execute(`UPDATE users SET avatar_blob_key = '${escapeSql(avatarKey)}' WHERE id = ${user.id};`);\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, avatar_key: avatarKey, snapshot });\n});\n\napp.get(\"/api/pixel-avatar/:avatarId\", async (c) => {\n const avatarId = c.req.param(\"avatarId\");\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return c.text(\"No avatar\", 404);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\napp.get(\"/api/avatar/:userId\", async (c) => {\n const userId = Number(c.req.param(\"userId\"));\n if (!Number.isFinite(userId)) return c.text(\"Not found\", 404);\n\n const res = await sqlite.execute(`SELECT avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`);\n if (res.rows.length === 0 || !res.rows[0][0]) return c.text(\"No avatar\", 404);\n\n const avatarKey = res.rows[0][0] as string;\n const presetResponse = avatarResponse(avatarKey);\n if (presetResponse) return presetResponse;\n\n try {\n return await blob.get(avatarKey);\n } catch {\n return c.text(\"No avatar\", 404);\n }\n});\n\napp.post(\"/api/travel\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot, busted: false });\n }\n\n const body = await c.req.json().catch(() => null);\n const marketId = Number(body?.marketId);\n if (!Number.isFinite(marketId)) return jsonError(\"marketId required.\");\n\n const markets = await getMarkets();\n const targetMarket = markets.find((m) => m.id === marketId);\n if (!targetMarket) return jsonError(\"Unknown market.\");\n let message = \"\";\n let wasBusted = false;\n\n try {\n await withTransaction(async () => {\n const current = await getPlayerState(user.id);\n if (marketId === current.current_market_id) throw new Error(\"Already at that market.\");\n\n const newDay = current.day + 1;\n let heat = Math.min(100, current.heat + 8 + Math.floor(Math.random() * 13));\n let bustMessage = \"\";\n let nextCash = current.cash;\n\n const bustChance = Math.min(0.92, heat / 170 + targetMarket.region_risk * 0.28);\n if (Math.random() < bustChance) {\n const invRes = await sqlite.execute(\n `SELECT breed_id, qty FROM inventory WHERE user_id = ${user.id};`,\n );\n for (const row of invRes.rows) {\n const breedId = row[0] as number;\n const qty = row[1] as number;\n const seized = Math.floor(qty * (0.2 + Math.random() * 0.55));\n const kept = Math.max(0, qty - seized);\n await sqlite.execute(\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${kept});`,\n );\n }\n\n const fine = Math.floor(current.cash * (0.08 + Math.random() * 0.22));\n nextCash = Math.max(0, current.cash - fine);\n heat = Math.max(12, heat - 20);\n bustMessage = \"BUSTED by DHS. Fine paid: $\" + fine.toLocaleString() + \", partial cargo seized.\";\n }\n\n const heatResult = applyHeatStreakLimit(heat, current.heat_max_streak);\n heat = heatResult.heat;\n if (heatResult.forcedCooldown && !bustMessage) {\n bustMessage = \"Heat overload forced a cooldown. Heat dropped to 95%.\";\n }\n\n if (current.debt > 0 && newDay > current.debt_due_day) {\n await restartRun(user.id);\n message = \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n wasBusted = false;\n return;\n }\n\n await sqlite.execute(\n `UPDATE player_state\n SET current_market_id = ${marketId},\n day = ${newDay},\n heat = ${heat},\n cash = ${nextCash},\n heat_max_streak = ${heatResult.nextStreak}\n WHERE user_id = ${user.id};`,\n );\n\n await generatePricesForMarketDay(newDay, marketId);\n await cleanupOldMarketPrices();\n\n wasBusted = bustMessage.length > 0;\n message = bustMessage || (\"Arrived at \" + targetMarket.name + \". Heat now \" + heat + \"%.\");\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot, busted: wasBusted });\n});\n\n// --- Economy action routes ---\napp.post(\"/api/borrow\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid borrow amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested < 100) return jsonError(\"Minimum borrow is $100.\");\n if (requested > 5000) return jsonError(\"Maximum per borrow is $5,000.\");\n\n let borrowed = 0;\n let fee = 0;\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const maxDebt = 50000;\n if (state.debt >= maxDebt) throw new Error(\"Debt ceiling reached.\");\n\n const terms = computeBorrowTerms({\n requested,\n borrowCount: state.borrow_count,\n currentDebt: state.debt,\n debtDueDay: state.debt_due_day,\n currentDay: state.day,\n maxDebt,\n });\n\n if (terms.debtIncrease <= 0) throw new Error(\"Cannot borrow more right now.\");\n if (terms.principalGranted < 100) throw new Error(\"Borrow amount too high for current debt ceiling.\");\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash + terms.principalGranted},\n debt = ${state.debt + terms.debtIncrease},\n debt_due_day = ${terms.nextDueDay},\n borrow_count = ${state.borrow_count + 1}\n WHERE user_id = ${user.id};`,\n );\n\n borrowed = terms.principalGranted;\n fee = terms.fee;\n message = \"Borrowed $\" + terms.principalGranted.toLocaleString() +\n \" with fee $\" + terms.fee.toLocaleString() +\n \" (tier \" + (state.borrow_count + 1) + \"). Debt due in \" + terms.dueFromToday + \" days.\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, borrowed, fee, message, snapshot });\n});\n\napp.post(\"/api/pay-debt\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid payment amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested <= 0) return jsonError(\"Invalid payment amount.\");\n\n let payment = 0;\n let remainingDebt = 0;\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n if (state.debt <= 0) throw new Error(\"Debt already cleared.\");\n if (state.cash <= 0) throw new Error(\"No cash available to pay debt.\");\n\n payment = Math.min(requested, state.debt, state.cash);\n remainingDebt = state.debt - payment;\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash - payment}, debt = ${remainingDebt}\n WHERE user_id = ${user.id};`,\n );\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n const message = \"Paid $\" + payment.toLocaleString() + \" toward debt. Remaining debt: $\" + remainingDebt.toLocaleString() + \".\";\n return c.json({ ok: true, payment, message, snapshot });\n});\n\napp.post(\"/api/buy\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid buy request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const cargoUsed = await getCargoUsed(user.id);\n if (cargoUsed + qty > state.cargo_capacity) throw new Error(\"Not enough cargo space.\");\n\n const total = chosen.price * qty;\n if (total > state.cash) throw new Error(\"Insufficient cash.\");\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash - total} WHERE user_id = ${user.id};`,\n `INSERT INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${qty})\n ON CONFLICT(user_id, breed_id) DO UPDATE SET qty = qty + ${qty};`,\n ]);\n\n message = \"Bought \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\napp.post(\"/api/sell\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid sell request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const invRes = await sqlite.execute(\n `SELECT qty FROM inventory WHERE user_id = ${user.id} AND breed_id = ${breedId} LIMIT 1;`,\n );\n const owned = (invRes.rows[0]?.[0] as number) ?? 0;\n if (owned < qty) throw new Error(\"Not enough inventory.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const total = chosen.price * qty;\n const nextQty = owned - qty;\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash + total} WHERE user_id = ${user.id};`,\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${nextQty});`,\n ]);\n\n message = \"Sold \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\nexport default app.fetch;\n","deleted","label",[100],"permalink","https://www.val.town/x/pchinjr/cat-wars/code/main.ts","extension","actionData","errors"]

Cat Wars Admin Console

Overview

Markets

Breeds

CAT WARS 2029

Street Terminal

The Situation

How The Game Works

Register

Log In

Market Prices

Travel

Session