Throne Gelt Ledger

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_209":210,"_211":212},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_157":-5,"_20":158,"_22":159,"_160":161,"_162":163,"_25":164,"_24":-5,"_165":-5,"_166":-5,"_167":56,"_168":169,"_170":47,"_171":-5,"_172":-5,"_173":174},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","RT_Brandt","name","throne-gelt-ledger","branchName","main","version","path","","project",{"_36":99,"_13":14,"_48":100,"_101":-5,"_102":56,"_103":104,"_105":104,"_106":107,"_108":-5,"_109":110,"_111":61,"_112":47,"_113":-5,"_114":-5,"_115":72,"_116":117,"_118":119,"_120":121,"_122":123,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_134":135,"_136":137,"_138":139,"_140":56},"tree",[82,83,84,85],"file","contents",[32,33,34,35],"upstream","pull","ahead","behind","envVars",{"_36":75,"_13":76,"_39":77,"_41":-5,"_42":43,"_44":78,"_46":47,"_48":79,"_17":72,"_51":52,"_53":80,"_55":56,"_57":-5,"_18":81},{"_36":67,"_13":68,"_39":69,"_41":-5,"_42":43,"_44":70,"_46":47,"_48":71,"_17":72,"_51":52,"_53":73,"_55":56,"_57":-5,"_18":74},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":63,"_17":50,"_51":64,"_53":65,"_55":56,"_57":-5,"_18":66},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":49,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_18":58},"id","c939a6c6-63e9-41c0-a5ab-ceb737b3de8a","ui.ts","fileId","418254f8-b00f-11f1-829d-1607ee4eb77e","parentId","branchId","bb0b67fb-350e-4d2b-8d6f-3c56dcf88f85","branchVersion",6,"latest",true,"createdAt",["D",1789371556071],1,"fileType","script","content","export const PAGE = String.raw`\n\n\n\n\nThrone Gelt Ledger\n\n\n\n\n\n\n\n

\n\n

Throne Gelt Ledger

Warrant of Von Brandt · Hive Solenne

\n\n\n

\n\n

\n\n\n\n\n\n`;\n","deleted",false,"label",[38],"d1ee42f7-535c-47d0-9ba8-9b64991c25e1","main.tsx","9c51ffec-b00e-11f1-bc3a-1607ee4eb77e",4,["D",1789371391103],"http","/**\n * Throne Gelt Ledger — server.\n *\n * Every rule that matters is enforced here, not in the browser:\n * - betting closes at closes_at, checked against server time\n * - stake must be <= server-held balance\n * - admin routes check is_admin from the session, not a client flag\n * - balance changes happen in atomic batches with an audit row\n */\nimport { Hono } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite, initDb, nowIso, creditStatements, STARTING_BALANCE } from \"./db.ts\";\nimport {\n hashPassword,\n verifyPassword,\n dummyVerify,\n newSessionToken,\n digestToken,\n SESSION_COOKIE,\n SESSION_TTL_DAYS,\n} from \"./auth.ts\";\nimport { PAGE } from \"./ui.ts\";\n\nconst app = new Hono();\n\nawait initDb();\n\n// ── helpers ──────────────────────────────────────────────────────────\ntype Viewer = { id: number; username: string; balance: number; isAdmin: boolean };\n\nasync function getViewer(c: any): Promise {\n const token = getCookie(c, SESSION_COOKIE);\n if (!token) return null;\n const digest = await digestToken(token);\n const res = await sqlite.execute({\n sql: `SELECT u.id, u.username, u.balance, u.is_admin, s.expires_at\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token_digest = ?`,\n args: [digest],\n });\n if (res.rows.length === 0) return null;\n const r = res.rows[0] as any;\n if (new Date(r.expires_at as string) < new Date()) {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token_digest = ?\", args: [digest] });\n return null;\n }\n return {\n id: r.id as number,\n username: r.username as string,\n balance: r.balance as number,\n isAdmin: (r.is_admin as number) === 1,\n };\n}\n\n/** Reject cross-site posts. Cookies are SameSite=Lax; this is belt and braces. */\nfunction originOk(c: any): boolean {\n const origin = c.req.header(\"origin\");\n if (!origin) return true; // same-origin fetch often omits it\n try {\n return new URL(origin).host === new URL(c.req.url).host;\n } catch {\n return false;\n }\n}\n\nconst bad = (c: any, msg: string, code = 400) => c.json({ error: msg }, code);\n\nasync function requireUser(c: any): Promise {\n const v = await getViewer(c);\n if (!v) return bad(c, \"Not signed in.\", 401);\n return v;\n}\n\nasync function requireAdmin(c: any): Promise {\n const v = await getViewer(c);\n if (!v) return bad(c, \"Not signed in.\", 401);\n if (!v.isAdmin) return bad(c, \"Overseer clearance required.\", 403);\n return v;\n}\n\n// Mutating routes must be same-origin.\napp.use(\"/api/*\", async (c, next) => {\n if (c.req.method !== \"GET\" && !originOk(c)) return bad(c, \"Bad origin.\", 403);\n await next();\n});\n\n// ── page ─────────────────────────────────────────────────────────────\napp.get(\"/\", (c) => c.html(PAGE));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// ── auth ─────────────────────────────────────────────────────────────\napp.post(\"/api/register\", async (c) => {\n const { username, password } = await c.req.json().catch(() => ({}));\n const name = String(username ?? \"\").trim();\n const pass = String(password ?? \"\");\n\n if (!/^[A-Za-z0-9_\\-]{3,24}$/.test(name)) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (pass.length < 8) return bad(c, \"Passphrase must be at least 8 characters.\");\n if (pass.length > 200) return bad(c, \"Passphrase too long.\");\n\n const dupe = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username = ?\",\n args: [name],\n });\n if (dupe.rows.length) return bad(c, \"That handle is already registered.\", 409);\n\n const hash = await hashPassword(pass);\n const now = nowIso();\n await sqlite.execute({\n sql: `INSERT INTO users (username, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, 0, ?)`,\n args: [name, hash, STARTING_BALANCE, now],\n });\n const created = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username = ?\",\n args: [name],\n });\n const userId = created.rows[0].id as number;\n\n await sqlite.execute({\n sql: `INSERT INTO ledger (user_id, delta, reason, ref, created_at) VALUES (?, ?, ?, ?, ?)`,\n args: [userId, STARTING_BALANCE, \"sign-on stipend\", null, now],\n });\n\n await startSession(c, userId);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/login\", async (c) => {\n const { username, password } = await c.req.json().catch(() => ({}));\n const name = String(username ?? \"\").trim();\n const pass = String(password ?? \"\");\n if (!name || !pass) return bad(c, \"Handle and passphrase required.\");\n\n // Throttle: 10 failures per handle per 15 minutes.\n const since = new Date(Date.now() - 15 * 60_000).toISOString();\n const fails = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS n FROM login_attempts WHERE username = ? AND at > ?\",\n args: [name, since],\n });\n if (((fails.rows[0] as any).n as number) >= 10) {\n return bad(c, \"Too many failed attempts. Wait 15 minutes.\", 429);\n }\n\n const res = await sqlite.execute({\n sql: \"SELECT id, password_hash FROM users WHERE username = ?\",\n args: [name],\n });\n\n let ok = false;\n let userId = 0;\n if (res.rows.length === 0) {\n await dummyVerify(); // equalise timing\n } else {\n const row = res.rows[0] as any;\n ok = await verifyPassword(pass, row.password_hash as string);\n userId = row.id as number;\n }\n\n if (!ok) {\n await sqlite.execute({\n sql: \"INSERT INTO login_attempts (username, at) VALUES (?, ?)\",\n args: [name, nowIso()],\n });\n // Same message whether or not the handle exists.\n return bad(c, \"Handle or passphrase incorrect.\", 401);\n }\n\n await sqlite.execute({ sql: \"DELETE FROM login_attempts WHERE username = ?\", args: [name] });\n await startSession(c, userId);\n return c.json({ ok: true });\n});\n\nasync function startSession(c: any, userId: number) {\n const { token, digest } = await newSessionToken();\n const expires = new Date(Date.now() + SESSION_TTL_DAYS * 86400_000);\n await sqlite.execute({\n sql: `INSERT INTO sessions (token_digest, user_id, created_at, expires_at)\n VALUES (?, ?, ?, ?)`,\n args: [digest, userId, nowIso(), expires.toISOString()],\n });\n setCookie(c, SESSION_COOKIE, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n expires,\n });\n}\n\napp.post(\"/api/logout\", async (c) => {\n const token = getCookie(c, SESSION_COOKIE);\n if (token) {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE token_digest = ?\",\n args: [await digestToken(token)],\n });\n }\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n return c.json({ ok: true });\n});\n\napp.get(\"/api/me\", async (c) => {\n const v = await getViewer(c);\n return c.json({ user: v });\n});\n\n// ── bets ─────────────────────────────────────────────────────────────\napp.get(\"/api/bets\", async (c) => {\n const v = await getViewer(c);\n\n const bets = await sqlite.execute(\n `SELECT id, title, description, closes_at, status, winning_option_id, created_at, resolved_at\n FROM bets ORDER BY (status = 'open') DESC, closes_at DESC, id DESC`,\n );\n const options = await sqlite.execute(\n `SELECT o.id, o.bet_id, o.label, o.payout_rate,\n COALESCE(SUM(w.stake), 0) AS pool,\n COUNT(w.id) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id ORDER BY o.sort_order, o.id`,\n );\n\n let mine: any[] = [];\n if (v) {\n const res = await sqlite.execute({\n sql: `SELECT id, bet_id, option_id, stake, payout_rate, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY id DESC`,\n args: [v.id],\n });\n mine = res.rows;\n }\n\n const byBet = new Map();\n for (const o of options.rows as any[]) {\n if (!byBet.has(o.bet_id)) byBet.set(o.bet_id, []);\n byBet.get(o.bet_id)!.push(o);\n }\n\n const now = Date.now();\n const payload = (bets.rows as any[]).map((b) => ({\n ...b,\n isClosed: b.status !== \"open\" || new Date(b.closes_at).getTime() <= now,\n options: byBet.get(b.id) ?? [],\n }));\n\n return c.json({ bets: payload, myWagers: mine, serverTime: nowIso() });\n});\n\napp.get(\"/api/leaderboard\", async (c) => {\n const res = await sqlite.execute(\n `SELECT u.username, u.balance,\n COALESCE(SUM(CASE WHEN w.status = 'won' THEN 1 ELSE 0 END), 0) AS wins,\n COALESCE(SUM(CASE WHEN w.status = 'lost' THEN 1 ELSE 0 END), 0) AS losses\n FROM users u LEFT JOIN wagers w ON w.user_id = u.id\n WHERE u.is_admin = 0\n GROUP BY u.id ORDER BY u.balance DESC, u.username`,\n );\n return c.json({ standings: res.rows });\n});\n\n// ── placing a wager ──────────────────────────────────────────────────\napp.post(\"/api/wagers\", async (c) => {\n const v = await requireUser(c);\n if (v instanceof Response) return v;\n\n const { optionId, stake } = await c.req.json().catch(() => ({}));\n const optId = Number(optionId);\n const amount = Math.floor(Number(stake));\n\n if (!Number.isInteger(optId) || optId <= 0) return bad(c, \"Pick an outcome.\");\n if (!Number.isFinite(amount) || amount <= 0) {\n return bad(c, \"Stake must be a positive whole number.\");\n }\n\n const res = await sqlite.execute({\n sql: `SELECT o.id AS option_id, o.payout_rate, o.bet_id,\n b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ?`,\n args: [optId],\n });\n if (res.rows.length === 0) return bad(c, \"No such outcome.\", 404);\n const row = res.rows[0] as any;\n\n // Server time decides. A stale page cannot sneak a late wager through.\n if (row.status !== \"open\") return bad(c, \"This wager has been resolved.\", 409);\n if (new Date(row.closes_at as string).getTime() <= Date.now()) {\n return bad(c, \"Betting has closed on this wager.\", 409);\n }\n\n // Re-read balance in the write path rather than trusting the session copy.\n const bal = await sqlite.execute({ sql: \"SELECT balance FROM users WHERE id = ?\", args: [v.id] });\n const balance = (bal.rows[0] as any).balance as number;\n if (amount > balance) return bad(c, \"Insufficient thrones.\", 409);\n\n await sqlite.batch(\n [\n ...creditStatements(v.id, -amount, \"wager placed\", `option:${optId}`),\n {\n sql: `INSERT INTO wagers (user_id, bet_id, option_id, stake, payout_rate, status, payout, created_at)\n VALUES (?, ?, ?, ?, ?, 'pending', 0, ?)`,\n args: [v.id, row.bet_id, optId, amount, row.payout_rate, nowIso()],\n },\n ],\n \"write\",\n );\n\n return c.json({ ok: true });\n});\n\n// ── admin ────────────────────────────────────────────────────────────\napp.get(\"/api/admin/users\", async (c) => {\n const v = await requireAdmin(c);\n if (v instanceof Response) return v;\n const res = await sqlite.execute(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.created_at,\n COUNT(w.id) AS wager_count\n FROM users u LEFT JOIN wagers w ON w.user_id = u.id\n GROUP BY u.id ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n return c.json({ users: res.rows });\n});\n\napp.post(\"/api/admin/bets\", async (c) => {\n const v = await requireAdmin(c);\n if (v instanceof Response) return v;\n\n const body = await c.req.json().catch(() => ({}));\n const title = String(body.title ?? \"\").trim();\n const description = String(body.description ?? \"\").trim();\n const closesAt = String(body.closesAt ?? \"\");\n const options = Array.isArray(body.options) ? body.options : [];\n\n if (title.length < 3) return bad(c, \"Title required.\");\n if (title.length > 200) return bad(c, \"Title too long.\");\n if (description.length > 2000) return bad(c, \"Description too long.\");\n\n const closes = new Date(closesAt);\n if (isNaN(closes.getTime())) return bad(c, \"Valid closing time required.\");\n if (closes.getTime() <= Date.now()) return bad(c, \"Closing time must be in the future.\");\n\n if (options.length < 2 || options.length > 8) return bad(c, \"Between 2 and 8 outcomes.\");\n const clean = options.map((o: any) => ({\n label: String(o.label ?? \"\").trim(),\n rate: Number(o.payoutRate),\n }));\n for (const o of clean) {\n if (!o.label) return bad(c, \"Every outcome needs a label.\");\n if (o.label.length > 120) return bad(c, \"Outcome label too long.\");\n if (!Number.isFinite(o.rate) || o.rate <= 1 || o.rate > 100) {\n return bad(c, \"Payout rate must be between 1.01 and 100.\");\n }\n }\n\n await sqlite.execute({\n sql: `INSERT INTO bets (title, description, closes_at, status, created_by, created_at)\n VALUES (?, ?, ?, 'open', ?, ?)`,\n args: [title, description, closes.toISOString(), v.id, nowIso()],\n });\n const idRes = await sqlite.execute(\"SELECT last_insert_rowid() AS id\");\n const betId = (idRes.rows[0] as any).id as number;\n\n await sqlite.batch(\n clean.map((o, i) => ({\n sql: `INSERT INTO bet_options (bet_id, label, payout_rate, sort_order) VALUES (?, ?, ?, ?)`,\n args: [betId, o.label, o.rate, i],\n })),\n \"write\",\n );\n\n return c.json({ ok: true, betId });\n});\n\napp.post(\"/api/admin/bets/:id/resolve\", async (c) => {\n const v = await requireAdmin(c);\n if (v instanceof Response) return v;\n\n const betId = Number(c.req.param(\"id\"));\n const { winningOptionId } = await c.req.json().catch(() => ({}));\n const winId = Number(winningOptionId);\n\n const betRes = await sqlite.execute({\n sql: \"SELECT id, status FROM bets WHERE id = ?\",\n args: [betId],\n });\n if (betRes.rows.length === 0) return bad(c, \"No such wager.\", 404);\n if ((betRes.rows[0] as any).status !== \"open\") return bad(c, \"Already resolved.\", 409);\n\n const optRes = await sqlite.execute({\n sql: \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n args: [winId, betId],\n });\n if (optRes.rows.length === 0) return bad(c, \"That outcome is not on this wager.\", 400);\n\n const wagers = await sqlite.execute({\n sql: `SELECT id, user_id, option_id, stake, payout_rate\n FROM wagers WHERE bet_id = ? AND status = 'pending'`,\n args: [betId],\n });\n\n const stmts: any[] = [\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ? WHERE id = ?`,\n args: [winId, nowIso(), betId],\n },\n ];\n\n let paidOut = 0;\n let winners = 0;\n for (const w of wagers.rows as any[]) {\n if ((w.option_id as number) === winId) {\n // Gross return: stake x rate. Losing stakes are not returned.\n const payout = Math.floor((w.stake as number) * (w.payout_rate as number));\n paidOut += payout;\n winners += 1;\n stmts.push({\n sql: \"UPDATE wagers SET status = 'won', payout = ? WHERE id = ?\",\n args: [payout, w.id],\n });\n stmts.push(...creditStatements(w.user_id as number, payout, \"wager won\", `bet:${betId}`));\n } else {\n stmts.push({\n sql: \"UPDATE wagers SET status = 'lost', payout = 0 WHERE id = ?\",\n args: [w.id],\n });\n }\n }\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, winners, paidOut, settled: wagers.rows.length });\n});\n\napp.post(\"/api/admin/fund\", async (c) => {\n const v = await requireAdmin(c);\n if (v instanceof Response) return v;\n\n const { amount } = await c.req.json().catch(() => ({}));\n const delta = Math.floor(Number(amount));\n if (!Number.isFinite(delta) || delta === 0) return bad(c, \"Amount required.\");\n if (Math.abs(delta) > 1_000_000) return bad(c, \"Amount out of range.\");\n\n const users = await sqlite.execute(\"SELECT id FROM users WHERE is_admin = 0\");\n const stmts: any[] = [];\n for (const u of users.rows as any[]) {\n stmts.push(...creditStatements(u.id as number, delta, \"overseer tithe\", null));\n }\n if (stmts.length === 0) return c.json({ ok: true, funded: 0 });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, funded: users.rows.length, amount: delta });\n});\n\napp.delete(\"/api/admin/users/:id\", async (c) => {\n const v = await requireAdmin(c);\n if (v instanceof Response) return v;\n\n const userId = Number(c.req.param(\"id\"));\n const target = await sqlite.execute({\n sql: \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n args: [userId],\n });\n if (target.rows.length === 0) return bad(c, \"No such account.\", 404);\n const t = target.rows[0] as any;\n\n if ((t.is_admin as number) === 1) {\n return bad(c, \"Admin accounts cannot be deleted here. Change the env var instead.\", 403);\n }\n\n await sqlite.batch(\n [\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [userId] },\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [userId] },\n { sql: \"DELETE FROM ledger WHERE user_id = ?\", args: [userId] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [userId] },\n ],\n \"write\",\n );\n\n return c.json({ ok: true, deleted: t.username });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n",[60],"e2b4f8cb-a746-4ba9-943f-f7f39e79bedd","db.ts","b5278fa0-b00e-11f1-8702-1607ee4eb77e",3,["D",1789371264023],0,"/**\n * Schema and data access.\n *\n * Money is stored as INTEGER thrones. No floats for balances — payout\n * rates are floats, but every credit is floored to a whole throne before\n * it touches a balance.\n *\n * Every balance change also writes a `ledger` row, so the books can\n * always be reconciled against the users table.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword } from \"./auth.ts\";\n\nexport const STARTING_BALANCE = 1000;\n\nlet initialised = false;\n\nexport async function initDb(): Promise {\n if (initialised) return;\n\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL COLLATE NOCASE UNIQUE,\n password_hash TEXT NOT NULL,\n balance INTEGER NOT NULL DEFAULT ${STARTING_BALANCE},\n is_admin INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token_digest TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS bets (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n closes_at TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'open',\n winning_option_id INTEGER,\n created_by INTEGER,\n created_at TEXT NOT NULL,\n resolved_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS bet_options (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n bet_id INTEGER NOT NULL,\n label TEXT NOT NULL,\n payout_rate REAL NOT NULL,\n sort_order INTEGER NOT NULL DEFAULT 0\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS wagers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n bet_id INTEGER NOT NULL,\n option_id INTEGER NOT NULL,\n stake INTEGER NOT NULL,\n payout_rate REAL NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS ledger (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL,\n delta INTEGER NOT NULL,\n reason TEXT NOT NULL,\n ref TEXT,\n created_at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_ledger_user ON ledger(user_id)` },\n {\n sql: `CREATE TABLE IF NOT EXISTS login_attempts (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL,\n at TEXT NOT NULL\n )`,\n },\n { sql: `CREATE INDEX IF NOT EXISTS idx_attempts ON login_attempts(username, at)` },\n ]);\n\n await ensureAdmin();\n initialised = true;\n}\n\n/**\n * Create or update the admin account from environment variables.\n * The credentials never appear in source. If ADMIN_PASSWORD changes,\n * the stored hash is updated on next boot.\n */\nasync function ensureAdmin(): Promise {\n const username = Deno.env.get(\"ADMIN_USERNAME\");\n const password = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!username || !password) {\n console.warn(\"ADMIN_USERNAME / ADMIN_PASSWORD not set — no admin account.\");\n return;\n }\n\n const hash = await hashPassword(password);\n const now = new Date().toISOString();\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username = ?\",\n args: [username],\n });\n\n if (existing.rows.length === 0) {\n await sqlite.execute({\n sql: `INSERT INTO users (username, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, 0, 1, ?)`,\n args: [username, hash, now],\n });\n } else {\n await sqlite.execute({\n sql: \"UPDATE users SET password_hash = ?, is_admin = 1 WHERE id = ?\",\n args: [hash, existing.rows[0].id as number],\n });\n }\n}\n\nexport const nowIso = () => new Date().toISOString();\n\n/** Record a balance change and its audit row atomically. */\nexport function creditStatements(\n userId: number,\n delta: number,\n reason: string,\n ref: string | null,\n) {\n return [\n {\n sql: \"UPDATE users SET balance = balance + ? WHERE id = ?\",\n args: [delta, userId],\n },\n {\n sql: `INSERT INTO ledger (user_id, delta, reason, ref, created_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [userId, delta, reason, ref, nowIso()],\n },\n ];\n}\n\nexport { sqlite };\n",[68],"a9d77305-8592-418d-8486-8b521c6fd867","auth.ts","a744625a-b00e-11f1-b65d-1607ee4eb77e",2,["D",1789371240670],"/**\n * Password hashing and session tokens.\n *\n * Passwords: PBKDF2-SHA256, per-user random salt, stored as\n * pbkdf2$$$\n * Nothing reversible is ever written to the database.\n *\n * Sessions: 32 random bytes given to the browser, only the SHA-256\n * digest is stored. A database leak does not yield usable sessions.\n */\n\nconst PBKDF2_ITERATIONS = 210_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes));\n}\n\nfunction fromB64(s: string): Uint8Array {\n return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Hash a password for storage. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await pbkdf2(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\n/** Constant-time byte comparison. */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Verify a password against a stored hash. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const [scheme, iterStr, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const iterations = parseInt(iterStr, 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const candidate = await pbkdf2(password, fromB64(saltB64), iterations);\n return timingSafeEqual(candidate, fromB64(hashB64));\n } catch {\n return false;\n }\n}\n\n/**\n * Burn roughly the same time as a real verification when the username\n * doesn't exist, so response timing doesn't reveal which handles are real.\n */\nexport async function dummyVerify(): Promise {\n const salt = new Uint8Array(SALT_BYTES);\n await pbkdf2(\"decoy-value-for-timing\", salt, PBKDF2_ITERATIONS);\n}\n\n/** A fresh session token. Returns the plaintext (for the cookie) and its digest (for the DB). */\nexport async function newSessionToken(): Promise<{ token: string; digest: string }> {\n const raw = crypto.getRandomValues(new Uint8Array(32));\n const token = toB64(raw).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return { token, digest: await digestToken(token) };\n}\n\n/** SHA-256 of a session token, hex encoded. */\nexport async function digestToken(token: string): Promise {\n const bytes = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(token),\n );\n return Array.from(new Uint8Array(bytes))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport const SESSION_TTL_DAYS = 30;\nexport const SESSION_COOKIE = \"tg_session\";\n",[76],{"_36":75,"_13":76,"_39":77,"_41":-5,"_42":43,"_44":78,"_46":47,"_48":96,"_17":72,"_51":52,"_53":80,"_55":56,"_57":-5,"_87":97,"_18":98},{"_36":67,"_13":68,"_39":69,"_41":-5,"_42":43,"_44":70,"_46":47,"_48":93,"_17":72,"_51":52,"_53":73,"_55":56,"_57":-5,"_87":94,"_18":95},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":90,"_17":50,"_51":64,"_53":65,"_55":56,"_57":-5,"_87":91,"_18":92},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":86,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_87":88,"_18":89},["D",1789371556071],"children",[],[38],["D",1789371391103],[],[60],["D",1789371264023],[],[68],["D",1789371240670],[],[76],"bfa39e45-7092-4aeb-b689-37287ba7acba",["D",1789371222313],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger — accounts, bets, payouts","imageUrl","userId","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","bfa39e4570924aebb68937287ba7acba","tursoHostname","bfa39e4570924aebb68937287ba7acba-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789458641386],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_156":152},"org",{"_11":12,"_149":150,"_151":152,"_109":110,"_153":154,"_155":56},"branch",{"_17":45,"_13":16,"_36":43,"_141":99,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":14,"_148":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":99,"_13":14,"_48":204,"_101":-5,"_102":56,"_103":104,"_105":104,"_106":107,"_108":-5,"_109":110,"_111":61,"_112":47,"_113":-5,"_114":-5,"_115":72,"_116":117,"_118":119,"_120":121,"_122":205,"_124":-5,"_125":126,"_127":126,"_128":129,"_130":129,"_131":129,"_132":126,"_133":126,"_134":206,"_136":207,"_138":208,"_140":56},[192,193,194,195],"files",[192,193,194,195],"counts",{"_183":72,"_184":50,"_185":72,"_31":186,"_187":188},[175,176,177,178],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_36":75,"_13":76,"_39":77,"_41":-5,"_42":43,"_44":78,"_46":47,"_48":79,"_17":72,"_51":52,"_53":80,"_55":56,"_57":-5,"_18":182},{"_36":67,"_13":68,"_39":69,"_41":-5,"_42":43,"_44":70,"_46":47,"_48":71,"_17":72,"_51":52,"_53":73,"_55":56,"_57":-5,"_18":181},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":63,"_17":50,"_51":64,"_53":65,"_55":56,"_57":-5,"_18":180},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":49,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_18":179},[38],[60],[68],[76],"pulls","branches","forks",{"_189":78,"_191":72},"connections",{"_189":72,"_190":72},"count","unfilledCount","emptyCount",{"_36":75,"_13":76,"_39":77,"_41":-5,"_42":43,"_44":78,"_46":47,"_48":96,"_17":72,"_51":52,"_53":80,"_55":56,"_57":-5,"_87":202,"_18":203},{"_36":67,"_13":68,"_39":69,"_41":-5,"_42":43,"_44":70,"_46":47,"_48":93,"_17":72,"_51":52,"_53":73,"_55":56,"_57":-5,"_87":200,"_18":201},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":90,"_17":50,"_51":64,"_53":65,"_55":56,"_57":-5,"_87":198,"_18":199},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":86,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_87":196,"_18":197},[],[38],[],[60],[],[68],[],[76],["D",1789371222313],["D",1789458641386],{"_11":12,"_156":152},{"_11":12,"_149":150,"_151":152,"_109":110,"_153":154,"_155":56},{"_17":45,"_13":16,"_36":43,"_141":99,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":14,"_148":12},"ctx",{"_134":-5,"_172":242,"_243":244,"_245":246,"_247":56,"_248":56,"_249":56,"_250":47,"_251":-5,"_252":-7,"_253":-7,"_254":72,"_255":56,"_256":56,"_257":-5,"_258":56,"_259":56,"_260":56,"_261":-5},"ENV",{"_213":214,"_215":216,"_217":16,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]