[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_387":388,"_389":390},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_110":91,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":-5,"_123":-5,"_124":25,"_125":126,"_127":60,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",120,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","scripts/selftest.ts","latestPath","fileId","6a5524b2-b011-11f1-b315-1607ee4eb77e","name","selftest.ts","fileType","script","content","/**\n * End-to-end exercise of the pool-market ledger.\n * Creates throwaway accounts and markets, then cleans up after itself.\n */\n\nconst BASE = \"https://throne-ledger.val.run\";\n\ntype Jar = { cookie: string };\n\nasync function call(\n jar: Jar | null,\n method: string,\n path: string,\n body?: unknown,\n): Promise<{ status: number; data: any }> {\n const headers: Record = {};\n if (body !== undefined) headers[\"Content-Type\"] = \"application/json\";\n if (jar?.cookie) headers[\"Cookie\"] = jar.cookie;\n\n const res = await fetch(BASE + path, {\n method,\n headers,\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n\n if (jar) {\n for (const sc of res.headers.getSetCookie?.() ?? []) {\n const pair = sc.split(\";\")[0];\n if (pair.startsWith(\"tl_session=\")) jar.cookie = pair;\n }\n }\n\n let data: any = null;\n try { data = await res.json(); } catch { data = null; }\n return { status: res.status, data };\n}\n\nconst results: string[] = [];\nlet pass = 0, fail = 0;\n\nfunction check(name: string, ok: boolean, detail = \"\") {\n if (ok) { pass++; results.push(\" PASS \" + name); }\n else { fail++; results.push(\" FAIL \" + name + (detail ? \" -> \" + detail : \"\")); }\n}\n\nasync function balanceOf(jar: Jar): Promise {\n const r = await call(jar, \"GET\", \"/api/me\");\n return Number(r.data?.user?.balance ?? -1);\n}\n\nasync function getBet(jar: Jar | null, betId: string) {\n const r = await call(jar, \"GET\", \"/api/bets\");\n return (r.data?.bets || []).find((b: any) => b.id === betId);\n}\n\nconst createdBets: string[] = [];\n\nasync function newMarket(adminJar: Jar, labels: string[], minutes = 60) {\n const r = await call(adminJar, \"POST\", \"/api/admin/bets\", {\n title: \"SELFTEST \" + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),\n description: \"throwaway\",\n durationMinutes: minutes,\n options: labels.map((l) => ({ label: l })),\n });\n if (r.data?.betId) createdBets.push(r.data.betId);\n return r;\n}\n\nasync function selftest() {\n const stamp = Date.now().toString(36);\n const alice = { username: \"tst_a_\" + stamp, password: \"correct-horse-1\" };\n const bob = { username: \"tst_b_\" + stamp, password: \"correct-horse-2\" };\n const cara = { username: \"tst_c_\" + stamp, password: \"correct-horse-3\" };\n const aJ: Jar = { cookie: \"\" }, bJ: Jar = { cookie: \"\" }, cJ: Jar = { cookie: \"\" };\n const adminJar: Jar = { cookie: \"\" };\n\n // ── accounts ────────────────────────────────────────────────────\n let r = await call(aJ, \"POST\", \"/api/register\", alice);\n check(\"register alice at 1000\", r.status === 200 && r.data?.user?.balance === 1000,\n JSON.stringify(r.data));\n r = await call(bJ, \"POST\", \"/api/register\", bob);\n check(\"register bob\", r.status === 200);\n r = await call(cJ, \"POST\", \"/api/register\", cara);\n check(\"register cara\", r.status === 200);\n\n r = await call(null, \"POST\", \"/api/register\", alice);\n check(\"duplicate handle refused\", r.status === 409);\n r = await call(null, \"POST\", \"/api/login\", { username: alice.username, password: \"nope12345\" });\n check(\"wrong passphrase rejected\", r.status === 401);\n\n const adminUser = Deno.env.get(\"ADMIN_USERNAME\") || \"admin\";\n const adminPass = Deno.env.get(\"ADMIN_PASSWORD\") || \"\";\n r = await call(adminJar, \"POST\", \"/api/login\", { username: adminUser, password: adminPass });\n check(\"admin login\", r.status === 200 && r.data?.user?.isAdmin === true);\n\n r = await call(aJ, \"GET\", \"/api/admin/users\");\n check(\"non-admin blocked from admin routes\", r.status === 403);\n\n // ── market creation takes no odds ───────────────────────────────\n r = await newMarket(adminJar, [\"Yes\", \"No\"]);\n check(\"admin creates market with labels only\", r.status === 200 && !!r.data?.betId,\n JSON.stringify(r.data));\n const betId = r.data.betId;\n\n r = await newMarket(adminJar, [\"Same\", \"Same\"]);\n check(\"duplicate outcome labels refused\", r.status === 400);\n r = await newMarket(adminJar, [\"Only\"]);\n check(\"single-outcome market refused\", r.status === 400);\n r = await call(aJ, \"POST\", \"/api/admin/bets\", {\n title: \"sneaky\", durationMinutes: 60, options: [{ label: \"a\" }, { label: \"b\" }],\n });\n check(\"non-admin cannot create markets\", r.status === 403);\n\n let bet = await getBet(aJ, betId);\n check(\"new market has zero pot\", bet?.totalPot === 0, JSON.stringify(bet?.totalPot));\n check(\"new market is open\", bet?.status === \"open\", bet?.status);\n const yes = bet.options.find((o: any) => o.label === \"Yes\").id;\n const no = bet.options.find((o: any) => o.label === \"No\").id;\n\n // ── the levy, and how pool odds move with it ────────────────────\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 300 });\n check(\"alice bids 300, full amount leaves the purse\",\n r.status === 200 && r.data?.balance === 700, JSON.stringify(r.data));\n check(\"levy of 3 taken out of the bid, 297 into the pot\",\n r.data?.paid === 300 && r.data?.levy === 3 && r.data?.intoPot === 297,\n JSON.stringify(r.data));\n\n bet = await getBet(aJ, betId);\n let yesOpt = bet.options.find((o: any) => o.id === yes);\n check(\"pot holds the net stake, not the bid\", bet.totalPot === 297, String(bet.totalPot));\n check(\"lone backer sees 1.00x and 100% share\",\n Math.abs(yesOpt.payoutPerGelt - 1) < 1e-9 && Math.abs(yesOpt.share - 1) < 1e-9,\n JSON.stringify(yesOpt));\n\n r = await call(bJ, \"POST\", \"/api/wagers\", { betId, optionId: no, stake: 100 });\n check(\"bob bids 100\", r.status === 200 && r.data?.balance === 900);\n check(\"levy of 1 on a 100 bid\", r.data?.levy === 1 && r.data?.intoPot === 99);\n\n bet = await getBet(aJ, betId);\n check(\"pot is 297 + 99 = 396\", bet.totalPot === 396, String(bet.totalPot));\n yesOpt = bet.options.find((o: any) => o.id === yes);\n const noOpt = bet.options.find((o: any) => o.id === no);\n check(\"Yes pays 396/297 = 1.333x\", Math.abs(yesOpt.payoutPerGelt - 396 / 297) < 1e-9,\n String(yesOpt.payoutPerGelt));\n check(\"No pays 396/99 = 4.00x\", Math.abs(noOpt.payoutPerGelt - 4) < 1e-9,\n String(noOpt.payoutPerGelt));\n check(\"shares sum to 1\", Math.abs(yesOpt.share + noOpt.share - 1) < 1e-9);\n\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 100 });\n check(\"cara bids 100 on Yes\", r.status === 200 && r.data?.balance === 900);\n\n // ── guards ──────────────────────────────────────────────────────\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 99999 });\n check(\"overdraft refused\", r.status === 409);\n check(\"balance untouched after failed overdraft\", (await balanceOf(aJ)) === 700);\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: -5 });\n check(\"negative stake refused\", r.status === 400);\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 2.5 });\n check(\"fractional stake refused\", r.status === 400);\n r = await call(null, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 10 });\n check(\"anonymous cannot wager\", r.status === 401);\n\n // ── selling a position back ─────────────────────────────────────\n const m2 = await newMarket(adminJar, [\"Alpha\", \"Beta\"]);\n const sellBet = m2.data.betId;\n let sb = await getBet(aJ, sellBet);\n const alpha = sb.options.find((o: any) => o.label === \"Alpha\").id;\n\n // A bid too small to levy still takes a position.\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId: sellBet, optionId: alpha, stake: 1 });\n check(\"a 1 Gelt bid is too small to levy\",\n r.status === 200 && r.data?.levy === 0 && r.data?.intoPot === 1, JSON.stringify(r.data));\n\n const beforeSell = await balanceOf(bJ);\n r = await call(bJ, \"POST\", \"/api/wagers\", { betId: sellBet, optionId: alpha, stake: 200 });\n check(\"bob bids 200 to sell back\", r.status === 200 && r.data?.levy === 2 && r.data?.intoPot === 198,\n JSON.stringify(r.data));\n\n sb = await getBet(bJ, sellBet);\n const pos = sb.myWagers.find((w: any) => w.status === \"pending\");\n check(\"sellback is 90% of the net stake, not the bid\",\n pos?.sellbackValue === 178, JSON.stringify(pos));\n check(\"position records both bid and net stake\",\n pos?.paid === 200 && pos?.stake === 198 && pos?.tax === 2, JSON.stringify(pos));\n\n r = await call(bJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"sell returns 178 and forfeits 20\",\n r.status === 200 && r.data?.refund === 178 && r.data?.forfeit === 20, JSON.stringify(r.data));\n check(\"round trip costs the levy plus the exit fee\",\n (await balanceOf(bJ)) === beforeSell - 22, String(await balanceOf(bJ)));\n\n r = await call(bJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"double sell refused\", r.status === 409);\n\n r = await call(aJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"cannot sell someone else's position\", r.status === 403 || r.status === 409);\n\n sb = await getBet(aJ, sellBet);\n check(\"forfeited 20 stays in the pot alongside cara's 1\",\n sb.forfeited === 20 && sb.totalPot === 21,\n JSON.stringify({ pot: sb.totalPot, forfeited: sb.forfeited }));\n\n // ── lifecycle: open -> resolving -> resolved ────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: yes });\n check(\"cannot resolve while still open\", r.status === 409, JSON.stringify(r.data));\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/close\", {});\n check(\"admin closes trading\", r.status === 200);\n\n bet = await getBet(aJ, betId);\n check(\"market moved to resolving\", bet.status === \"resolving\", bet.status);\n\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 10 });\n check(\"cannot wager while resolving\", r.status === 409);\n\n const carasPos = (await getBet(cJ, betId)).myWagers.find((w: any) => w.status === \"pending\");\n r = await call(cJ, \"POST\", \"/api/wagers/\" + carasPos.id + \"/sell\", {});\n check(\"cannot sell while resolving\", r.status === 409, JSON.stringify(r.data));\n\n // ── the payout split ────────────────────────────────────────────\n // Pot 495 (297+99+99 net). Yes pool 396 (alice 297, cara 99). Yes wins.\n // alice = floor(495 * 297/396) = 371, cara = floor(495 * 99/396) = 123.\n const aliceBefore = await balanceOf(aJ);\n const caraBefore = await balanceOf(cJ);\n const bobBefore = await balanceOf(bJ);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: yes });\n check(\"admin resolves\", r.status === 200, JSON.stringify(r.data));\n check(\"pot of 495 paid to 2 winners\",\n r.data?.totalPot === 495 && r.data?.winnersPaid === 2 && r.data?.totalPaid === 494,\n JSON.stringify(r.data));\n\n check(\"alice takes 371 (75% of the winning pool)\", (await balanceOf(aJ)) === aliceBefore + 371,\n String(await balanceOf(aJ)));\n check(\"cara takes 123 (25% of the winning pool)\", (await balanceOf(cJ)) === caraBefore + 123,\n String(await balanceOf(cJ)));\n check(\"bob's losing stake is not returned\", (await balanceOf(bJ)) === bobBefore);\n check(\"rounding never overpays the pot\", 371 + 123 <= 495);\n\n r = await call(aJ, \"GET\", \"/api/me\");\n check(\"winner record 1W/0L\", r.data?.user?.wins === 1 && r.data?.user?.losses === 0);\n r = await call(bJ, \"GET\", \"/api/me\");\n check(\"loser record 0W/1L\", r.data?.user?.wins === 0 && r.data?.user?.losses === 1);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: no });\n check(\"double resolve refused\", r.status === 409);\n\n // ── nobody backed the winner -> the house keeps the pot ─────────\n const m3 = await newMarket(adminJar, [\"Taken\", \"Empty\"]);\n const voidBet = m3.data.betId;\n let vb = await getBet(aJ, voidBet);\n const taken = vb.options.find((o: any) => o.label === \"Taken\").id;\n const empty = vb.options.find((o: any) => o.label === \"Empty\").id;\n\n const voidBefore = await balanceOf(aJ);\n await call(aJ, \"POST\", \"/api/wagers\", { betId: voidBet, optionId: taken, stake: 150 });\n check(\"stake deducted before the ruling\", (await balanceOf(aJ)) === voidBefore - 150);\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + voidBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + voidBet + \"/resolve\",\n { winningOptionId: empty });\n check(\"unbacked winner pays nobody\",\n r.status === 200 && r.data?.houseWins === true && r.data?.winnersPaid === 0 &&\n r.data?.totalPaid === 0, JSON.stringify(r.data));\n check(\"house keeps the pot, no refund\", (await balanceOf(aJ)) === voidBefore - 150,\n String(await balanceOf(aJ)));\n\n vb = await getBet(aJ, voidBet);\n check(\"stake marked lost, not refunded\",\n !!vb.myWagers.find((w: any) => w.status === \"lost\"), JSON.stringify(vb.myWagers));\n\n // ── one throne on a long shot takes the entire pot ──────────────\n const m4 = await newMarket(adminJar, [\"Crowd\", \"Longshot\"]);\n const shotBet = m4.data.betId;\n let shot = await getBet(aJ, shotBet);\n const crowd = shot.options.find((o: any) => o.label === \"Crowd\").id;\n const longshot = shot.options.find((o: any) => o.label === \"Longshot\").id;\n\n await call(aJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: crowd, stake: 400 });\n await call(bJ, \"POST\", \"/api/login\", bob);\n await call(bJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: crowd, stake: 300 });\n const caraBeforeShot = await balanceOf(cJ);\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: longshot, stake: 1 });\n check(\"cara risks a single Gelt on the longshot\", r.status === 200);\n\n shot = await getBet(cJ, shotBet);\n const lsOpt = shot.options.find((o: any) => o.id === longshot);\n check(\"longshot quotes 694x (pot 694 on a 1 Gelt stake)\",\n Math.abs(lsOpt.payoutPerGelt - 694) < 1e-9, String(lsOpt.payoutPerGelt));\n\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + shotBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + shotBet + \"/resolve\",\n { winningOptionId: longshot });\n check(\"longshot lands\", r.status === 200 && r.data?.totalPaid === 694, JSON.stringify(r.data));\n check(\"one untaxed Gelt becomes 694\", (await balanceOf(cJ)) === caraBeforeShot - 1 + 694,\n String(await balanceOf(cJ)));\n\n // ── rankings ────────────────────────────────────────────────────\n r = await call(null, \"GET\", \"/api/leaderboard\");\n check(\"leaderboard returns both columns\",\n Array.isArray(r.data?.byWallet) && Array.isArray(r.data?.byRatio), JSON.stringify(r.data));\n const walletSorted = (r.data.byWallet || []).every((u: any, i: number, a: any[]) =>\n i === 0 || a[i - 1].balance >= u.balance);\n check(\"wallet column sorted descending\", walletSorted);\n const ratioSorted = (r.data.byRatio || []).every((u: any, i: number, a: any[]) =>\n i === 0 || a[i - 1].rate >= u.rate);\n check(\"ratio column sorted descending\", ratioSorted);\n const noZeroSettled = (r.data.byRatio || []).every((u: any) => u.wins + u.losses > 0);\n check(\"ratio column excludes unsettled accounts\", noZeroSettled);\n\n // ── campaign map ────────────────────────────────────────────────\n function fakeSave(round: number){\n const obj = { v:3, gw:13, gh:13, grid:new Array(169).fill(-1), relics:[],\n round:round, seeded:true, fActive:{}, fElim:{}, fCells:{},\n fFormer:{}, pts:{}, overlays:{}, tempDefense:[] };\n return btoa(JSON.stringify(obj));\n }\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"campaign readable by anyone\", r.status === 200, JSON.stringify(r.data));\n\n r = await call(aJ, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: fakeSave(0) });\n check(\"non-admin cannot publish the board\", r.status === 403);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: \"short\" });\n check(\"malformed save code refused\", r.status === 400);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: \"!!!not base64!!!!!!!!!!!\" });\n check(\"non-base64 save code refused\", r.status === 400);\n\n for (const n of [0, 1, 2]) {\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\",\n { round: n, saveCode: fakeSave(n), note: \"round \" + n });\n check(\"publish round \" + n, r.status === 200, JSON.stringify(r.data));\n }\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"public sees latest round 2\", r.data?.round === 2, JSON.stringify(r.data?.round));\n\n r = await call(adminJar, \"GET\", \"/api/admin/campaign/history\");\n check(\"history lists 3 rounds\", (r.data?.rounds || []).length === 3,\n JSON.stringify((r.data?.rounds || []).length));\n check(\"history is newest first\", r.data?.rounds?.[0]?.round === 2);\n\n r = await call(aJ, \"GET\", \"/api/admin/campaign/history\");\n check(\"non-admin cannot read history\", r.status === 403);\n\n // Republishing the same round overwrites rather than duplicating.\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\",\n { round: 2, saveCode: fakeSave(2), note: \"redo\" });\n check(\"republishing a round overwrites it\", r.status === 200);\n r = await call(adminJar, \"GET\", \"/api/admin/campaign/history\");\n check(\"history still has 3 rounds\", (r.data?.rounds || []).length === 3);\n\n r = await call(aJ, \"POST\", \"/api/admin/campaign/rollback\", { round: 1 });\n check(\"non-admin cannot roll back\", r.status === 403);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign/rollback\", { round: 1 });\n check(\"rollback to round 1 discards 1 later round\",\n r.status === 200 && r.data?.round === 1 && r.data?.discarded === 1, JSON.stringify(r.data));\n check(\"rollback returns that round's save code\",\n typeof r.data?.saveCode === \"string\" && r.data.saveCode.length > 16);\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"public now sees round 1\", r.data?.round === 1, JSON.stringify(r.data?.round));\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign/rollback\", { round: 99 });\n check(\"rollback to a round that never existed is refused\", r.status === 404);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/campaign\");\n check(\"wipe clears the campaign\", r.status === 200 && r.data?.discarded === 2,\n JSON.stringify(r.data));\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"board is empty after wipe\", r.data?.round === null);\n\n // ── deleting markets ────────────────────────────────────────────\n // Deleting an unsettled market must hand the stakes back.\n const mOpen = await newMarket(adminJar, [\"Alpha\", \"Beta\"]);\n const openBet = mOpen.data.betId;\n let ob = await getBet(aJ, openBet);\n const oAlpha = ob.options.find((o: any) => o.label === \"Alpha\").id;\n const beforeOpenDel = await balanceOf(aJ);\n await call(aJ, \"POST\", \"/api/wagers\", { betId: openBet, optionId: oAlpha, stake: 250 });\n check(\"stake leaves the wallet\", (await balanceOf(aJ)) === beforeOpenDel - 250);\n\n r = await call(aJ, \"DELETE\", \"/api/admin/bets/\" + openBet);\n check(\"non-admin cannot delete a market\", r.status === 403);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + openBet);\n check(\"deleting an open market refunds pending stakes\",\n r.status === 200 && r.data?.stakeReturned === 250, JSON.stringify(r.data));\n check(\"wallet restored after deleting an open market\",\n (await balanceOf(aJ)) === beforeOpenDel, String(await balanceOf(aJ)));\n check(\"deleted market is gone from the listing\",\n !(await getBet(aJ, openBet)), \"still present\");\n\n // Deleting a settled market without reversing leaves balances alone.\n const mKeep = await newMarket(adminJar, [\"Win\", \"Lose\"]);\n const keepBet = mKeep.data.betId;\n let kb = await getBet(aJ, keepBet);\n const kWin = kb.options.find((o: any) => o.label === \"Win\").id;\n const kLose = kb.options.find((o: any) => o.label === \"Lose\").id;\n await call(aJ, \"POST\", \"/api/wagers\", { betId: keepBet, optionId: kWin, stake: 100 });\n await call(bJ, \"POST\", \"/api/wagers\", { betId: keepBet, optionId: kLose, stake: 100 });\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + keepBet + \"/close\", {});\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + keepBet + \"/resolve\", { winningOptionId: kWin });\n\n const keepA = await balanceOf(aJ), keepB = await balanceOf(bJ);\n const meA0 = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + keepBet);\n check(\"plain delete of a settled market reports no reversal\",\n r.status === 200 && r.data?.reversed === false && r.data?.stakeReturned === 0,\n JSON.stringify(r.data));\n check(\"winner keeps their winnings\", (await balanceOf(aJ)) === keepA);\n check(\"loser stays down\", (await balanceOf(bJ)) === keepB);\n const meA1 = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n check(\"win record untouched by a plain delete\", meA1.wins === meA0.wins);\n\n // Deleting with reverse=1 undoes the whole settlement.\n const mUndo = await newMarket(adminJar, [\"Win\", \"Lose\"]);\n const undoBet = mUndo.data.betId;\n let ub = await getBet(aJ, undoBet);\n const uWin = ub.options.find((o: any) => o.label === \"Win\").id;\n const uLose = ub.options.find((o: any) => o.label === \"Lose\").id;\n\n const preA = await balanceOf(aJ), preB = await balanceOf(bJ);\n const preAme = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n const preBme = (await call(bJ, \"GET\", \"/api/me\")).data.user;\n\n await call(aJ, \"POST\", \"/api/wagers\", { betId: undoBet, optionId: uWin, stake: 200 });\n await call(bJ, \"POST\", \"/api/wagers\", { betId: undoBet, optionId: uLose, stake: 300 });\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + undoBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + undoBet + \"/resolve\",\n { winningOptionId: uWin });\n check(\"market settles before the undo test\",\n r.status === 200 && r.data?.totalPaid === 495, JSON.stringify(r.data));\n check(\"winner is up after settlement\", (await balanceOf(aJ)) === preA - 200 + 495);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + undoBet + \"?reverse=1\");\n check(\"reverse delete returns the full bids, levy included\",\n r.status === 200 && r.data?.reversed === true &&\n r.data?.stakeReturned === 500 && r.data?.winningsClawedBack === 495 &&\n r.data?.levyRefunded === 5,\n JSON.stringify(r.data));\n check(\"winner returned to pre-market balance\", (await balanceOf(aJ)) === preA,\n (await balanceOf(aJ)) + \" vs \" + preA);\n check(\"loser returned to pre-market balance\", (await balanceOf(bJ)) === preB,\n (await balanceOf(bJ)) + \" vs \" + preB);\n\n const postAme = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n const postBme = (await call(bJ, \"GET\", \"/api/me\")).data.user;\n check(\"winner's win count rolled back\", postAme.wins === preAme.wins,\n postAme.wins + \" vs \" + preAme.wins);\n check(\"loser's loss count rolled back\", postBme.losses === preBme.losses,\n postBme.losses + \" vs \" + preBme.losses);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/bet_nonexistent\");\n check(\"deleting a market that does not exist is refused\", r.status === 404);\n\n // ── treasury and accounts ───────────────────────────────────────\n const preFund = await balanceOf(aJ);\n r = await call(adminJar, \"POST\", \"/api/admin/fund\", { amount: 500 });\n check(\"fund all succeeds\", r.status === 200 && r.data?.accounts >= 3);\n check(\"alice funded by 500\", (await balanceOf(aJ)) === preFund + 500);\n r = await call(aJ, \"POST\", \"/api/admin/fund\", { amount: 999999 });\n check(\"non-admin cannot fund\", r.status === 403);\n\n r = await call(bJ, \"POST\", \"/api/logout\", {});\n check(\"logout succeeds\", r.status === 200);\n check(\"session dead after logout\", (await call(bJ, \"GET\", \"/api/me\")).data?.user === null);\n\n r = await call(adminJar, \"GET\", \"/api/admin/users\");\n const rows = r.data?.users || [];\n const find = (n: string) => rows.find((u: any) => u.username === n);\n check(\"admin sees all accounts\", !!find(alice.username) && !!find(bob.username));\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/users/\" + find(adminUser)?.id);\n check(\"overseer account cannot be deleted\", r.status === 400);\n\n for (const u of [alice, bob, cara]) {\n const row = find(u.username);\n if (row) await call(adminJar, \"DELETE\", \"/api/admin/users/\" + row.id);\n }\n r = await call(adminJar, \"GET\", \"/api/admin/users\");\n const leftover = (r.data?.users || []).filter((u: any) => u.username.startsWith(\"tst_\"));\n check(\"test accounts removed\", leftover.length === 0, JSON.stringify(leftover));\n\n // ── cleanup ─────────────────────────────────────────────────────\n const { sqlite } = await import(\"https://esm.town/v/std/sqlite/main.ts\");\n for (const id of createdBets) {\n await sqlite.batch([\n { sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] },\n { sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] },\n { sql: \"DELETE FROM bets WHERE id = ?\", args: [id] },\n ], \"write\");\n }\n\n const report = [\n \"\",\n \"THRONE LEDGER - POOL MARKET SELF TEST\",\n \"=====================================\",\n ...results,\n \"\",\n `${pass} passed, ${fail} failed`,\n \"\",\n ].join(\"\\n\");\n console.log(report);\n return report;\n}\n\nexport default await selftest();\n","/**\n * End-to-end exercise of the pool-market ledger.\n * Creates throwaway accounts and markets, then cleans up after itself.\n */\n\nconst BASE = \"https://throne-ledger.val.run\";\n\ntype Jar = { cookie: string };\n\nasync function call(\n jar: Jar | null,\n method: string,\n path: string,\n body?: unknown,\n): Promise<{ status: number; data: any }> {\n const headers: Record = {};\n if (body !== undefined) headers[\"Content-Type\"] = \"application/json\";\n if (jar?.cookie) headers[\"Cookie\"] = jar.cookie;\n\n const res = await fetch(BASE + path, {\n method,\n headers,\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n\n if (jar) {\n for (const sc of res.headers.getSetCookie?.() ?? []) {\n const pair = sc.split(\";\")[0];\n if (pair.startsWith(\"tl_session=\")) jar.cookie = pair;\n }\n }\n\n let data: any = null;\n try { data = await res.json(); } catch { data = null; }\n return { status: res.status, data };\n}\n\nconst results: string[] = [];\nlet pass = 0, fail = 0;\n\nfunction check(name: string, ok: boolean, detail = \"\") {\n if (ok) { pass++; results.push(\" PASS \" + name); }\n else { fail++; results.push(\" FAIL \" + name + (detail ? \" -> \" + detail : \"\")); }\n}\n\nasync function balanceOf(jar: Jar): Promise {\n const r = await call(jar, \"GET\", \"/api/me\");\n return Number(r.data?.user?.balance ?? -1);\n}\n\nasync function getBet(jar: Jar | null, betId: string) {\n const r = await call(jar, \"GET\", \"/api/bets\");\n return (r.data?.bets || []).find((b: any) => b.id === betId);\n}\n\nconst createdBets: string[] = [];\n\nasync function newMarket(adminJar: Jar, labels: string[], minutes = 60) {\n const r = await call(adminJar, \"POST\", \"/api/admin/bets\", {\n title: \"SELFTEST \" + Date.now().toString(36) + Math.random().toString(36).slice(2, 6),\n description: \"throwaway\",\n durationMinutes: minutes,\n options: labels.map((l) => ({ label: l })),\n });\n if (r.data?.betId) createdBets.push(r.data.betId);\n return r;\n}\n\nasync function selftest() {\n const stamp = Date.now().toString(36);\n const alice = { username: \"tst_a_\" + stamp, password: \"correct-horse-1\" };\n const bob = { username: \"tst_b_\" + stamp, password: \"correct-horse-2\" };\n const cara = { username: \"tst_c_\" + stamp, password: \"correct-horse-3\" };\n const aJ: Jar = { cookie: \"\" }, bJ: Jar = { cookie: \"\" }, cJ: Jar = { cookie: \"\" };\n const adminJar: Jar = { cookie: \"\" };\n\n // ── accounts ────────────────────────────────────────────────────\n let r = await call(aJ, \"POST\", \"/api/register\", alice);\n check(\"register alice at 1000\", r.status === 200 && r.data?.user?.balance === 1000,\n JSON.stringify(r.data));\n r = await call(bJ, \"POST\", \"/api/register\", bob);\n check(\"register bob\", r.status === 200);\n r = await call(cJ, \"POST\", \"/api/register\", cara);\n check(\"register cara\", r.status === 200);\n\n r = await call(null, \"POST\", \"/api/register\", alice);\n check(\"duplicate handle refused\", r.status === 409);\n r = await call(null, \"POST\", \"/api/login\", { username: alice.username, password: \"nope12345\" });\n check(\"wrong passphrase rejected\", r.status === 401);\n\n const adminUser = Deno.env.get(\"ADMIN_USERNAME\") || \"admin\";\n const adminPass = Deno.env.get(\"ADMIN_PASSWORD\") || \"\";\n r = await call(adminJar, \"POST\", \"/api/login\", { username: adminUser, password: adminPass });\n check(\"admin login\", r.status === 200 && r.data?.user?.isAdmin === true);\n\n r = await call(aJ, \"GET\", \"/api/admin/users\");\n check(\"non-admin blocked from admin routes\", r.status === 403);\n\n // ── market creation takes no odds ───────────────────────────────\n r = await newMarket(adminJar, [\"Yes\", \"No\"]);\n check(\"admin creates market with labels only\", r.status === 200 && !!r.data?.betId,\n JSON.stringify(r.data));\n const betId = r.data.betId;\n\n r = await newMarket(adminJar, [\"Same\", \"Same\"]);\n check(\"duplicate outcome labels refused\", r.status === 400);\n r = await newMarket(adminJar, [\"Only\"]);\n check(\"single-outcome market refused\", r.status === 400);\n r = await call(aJ, \"POST\", \"/api/admin/bets\", {\n title: \"sneaky\", durationMinutes: 60, options: [{ label: \"a\" }, { label: \"b\" }],\n });\n check(\"non-admin cannot create markets\", r.status === 403);\n\n let bet = await getBet(aJ, betId);\n check(\"new market has zero pot\", bet?.totalPot === 0, JSON.stringify(bet?.totalPot));\n check(\"new market is open\", bet?.status === \"open\", bet?.status);\n const yes = bet.options.find((o: any) => o.label === \"Yes\").id;\n const no = bet.options.find((o: any) => o.label === \"No\").id;\n\n // ── the levy, and how pool odds move with it ────────────────────\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 300 });\n check(\"alice bids 300, full amount leaves the purse\",\n r.status === 200 && r.data?.balance === 700, JSON.stringify(r.data));\n check(\"levy of 3 taken out of the bid, 297 into the pot\",\n r.data?.paid === 300 && r.data?.levy === 3 && r.data?.intoPot === 297,\n JSON.stringify(r.data));\n\n bet = await getBet(aJ, betId);\n let yesOpt = bet.options.find((o: any) => o.id === yes);\n check(\"pot holds the net stake, not the bid\", bet.totalPot === 297, String(bet.totalPot));\n check(\"lone backer sees 1.00x and 100% share\",\n Math.abs(yesOpt.payoutPerGelt - 1) < 1e-9 && Math.abs(yesOpt.share - 1) < 1e-9,\n JSON.stringify(yesOpt));\n\n r = await call(bJ, \"POST\", \"/api/wagers\", { betId, optionId: no, stake: 100 });\n check(\"bob bids 100\", r.status === 200 && r.data?.balance === 900);\n check(\"levy of 1 on a 100 bid\", r.data?.levy === 1 && r.data?.intoPot === 99);\n\n bet = await getBet(aJ, betId);\n check(\"pot is 297 + 99 = 396\", bet.totalPot === 396, String(bet.totalPot));\n yesOpt = bet.options.find((o: any) => o.id === yes);\n const noOpt = bet.options.find((o: any) => o.id === no);\n check(\"Yes pays 396/297 = 1.333x\", Math.abs(yesOpt.payoutPerGelt - 396 / 297) < 1e-9,\n String(yesOpt.payoutPerGelt));\n check(\"No pays 396/99 = 4.00x\", Math.abs(noOpt.payoutPerGelt - 4) < 1e-9,\n String(noOpt.payoutPerGelt));\n check(\"shares sum to 1\", Math.abs(yesOpt.share + noOpt.share - 1) < 1e-9);\n\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 100 });\n check(\"cara bids 100 on Yes\", r.status === 200 && r.data?.balance === 900);\n\n // ── guards ──────────────────────────────────────────────────────\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 99999 });\n check(\"overdraft refused\", r.status === 409);\n check(\"balance untouched after failed overdraft\", (await balanceOf(aJ)) === 700);\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: -5 });\n check(\"negative stake refused\", r.status === 400);\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 2.5 });\n check(\"fractional stake refused\", r.status === 400);\n r = await call(null, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 10 });\n check(\"anonymous cannot wager\", r.status === 401);\n\n // ── selling a position back ─────────────────────────────────────\n const m2 = await newMarket(adminJar, [\"Alpha\", \"Beta\"]);\n const sellBet = m2.data.betId;\n let sb = await getBet(aJ, sellBet);\n const alpha = sb.options.find((o: any) => o.label === \"Alpha\").id;\n\n // A bid too small to levy still takes a position.\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId: sellBet, optionId: alpha, stake: 1 });\n check(\"a 1 Gelt bid is too small to levy\",\n r.status === 200 && r.data?.levy === 0 && r.data?.intoPot === 1, JSON.stringify(r.data));\n\n const beforeSell = await balanceOf(bJ);\n r = await call(bJ, \"POST\", \"/api/wagers\", { betId: sellBet, optionId: alpha, stake: 200 });\n check(\"bob bids 200 to sell back\", r.status === 200 && r.data?.levy === 2 && r.data?.intoPot === 198,\n JSON.stringify(r.data));\n\n sb = await getBet(bJ, sellBet);\n const pos = sb.myWagers.find((w: any) => w.status === \"pending\");\n check(\"sellback is 90% of the net stake, not the bid\",\n pos?.sellbackValue === 178, JSON.stringify(pos));\n check(\"position records both bid and net stake\",\n pos?.paid === 200 && pos?.stake === 198 && pos?.tax === 2, JSON.stringify(pos));\n\n r = await call(bJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"sell returns 178 and forfeits 20\",\n r.status === 200 && r.data?.refund === 178 && r.data?.forfeit === 20, JSON.stringify(r.data));\n check(\"round trip costs the levy plus the exit fee\",\n (await balanceOf(bJ)) === beforeSell - 22, String(await balanceOf(bJ)));\n\n r = await call(bJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"double sell refused\", r.status === 409);\n\n r = await call(aJ, \"POST\", \"/api/wagers/\" + pos.id + \"/sell\", {});\n check(\"cannot sell someone else's position\", r.status === 403 || r.status === 409);\n\n sb = await getBet(aJ, sellBet);\n check(\"forfeited 20 stays in the pot alongside cara's 1\",\n sb.forfeited === 20 && sb.totalPot === 21,\n JSON.stringify({ pot: sb.totalPot, forfeited: sb.forfeited }));\n\n // ── lifecycle: open -> resolving -> resolved ────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: yes });\n check(\"cannot resolve while still open\", r.status === 409, JSON.stringify(r.data));\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/close\", {});\n check(\"admin closes trading\", r.status === 200);\n\n bet = await getBet(aJ, betId);\n check(\"market moved to resolving\", bet.status === \"resolving\", bet.status);\n\n r = await call(aJ, \"POST\", \"/api/wagers\", { betId, optionId: yes, stake: 10 });\n check(\"cannot wager while resolving\", r.status === 409);\n\n const carasPos = (await getBet(cJ, betId)).myWagers.find((w: any) => w.status === \"pending\");\n r = await call(cJ, \"POST\", \"/api/wagers/\" + carasPos.id + \"/sell\", {});\n check(\"cannot sell while resolving\", r.status === 409, JSON.stringify(r.data));\n\n // ── the payout split ────────────────────────────────────────────\n // Pot 495 (297+99+99 net). Yes pool 396 (alice 297, cara 99). Yes wins.\n // alice = floor(495 * 297/396) = 371, cara = floor(495 * 99/396) = 123.\n const aliceBefore = await balanceOf(aJ);\n const caraBefore = await balanceOf(cJ);\n const bobBefore = await balanceOf(bJ);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: yes });\n check(\"admin resolves\", r.status === 200, JSON.stringify(r.data));\n check(\"pot of 495 paid to 2 winners\",\n r.data?.totalPot === 495 && r.data?.winnersPaid === 2 && r.data?.totalPaid === 494,\n JSON.stringify(r.data));\n\n check(\"alice takes 371 (75% of the winning pool)\", (await balanceOf(aJ)) === aliceBefore + 371,\n String(await balanceOf(aJ)));\n check(\"cara takes 123 (25% of the winning pool)\", (await balanceOf(cJ)) === caraBefore + 123,\n String(await balanceOf(cJ)));\n check(\"bob's losing stake is not returned\", (await balanceOf(bJ)) === bobBefore);\n check(\"rounding never overpays the pot\", 371 + 123 <= 495);\n\n r = await call(aJ, \"GET\", \"/api/me\");\n check(\"winner record 1W/0L\", r.data?.user?.wins === 1 && r.data?.user?.losses === 0);\n r = await call(bJ, \"GET\", \"/api/me\");\n check(\"loser record 0W/1L\", r.data?.user?.wins === 0 && r.data?.user?.losses === 1);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: no });\n check(\"double resolve refused\", r.status === 409);\n\n // ── nobody backed the winner -> the house keeps the pot ─────────\n const m3 = await newMarket(adminJar, [\"Taken\", \"Empty\"]);\n const voidBet = m3.data.betId;\n let vb = await getBet(aJ, voidBet);\n const taken = vb.options.find((o: any) => o.label === \"Taken\").id;\n const empty = vb.options.find((o: any) => o.label === \"Empty\").id;\n\n const voidBefore = await balanceOf(aJ);\n await call(aJ, \"POST\", \"/api/wagers\", { betId: voidBet, optionId: taken, stake: 150 });\n check(\"stake deducted before the ruling\", (await balanceOf(aJ)) === voidBefore - 150);\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + voidBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + voidBet + \"/resolve\",\n { winningOptionId: empty });\n check(\"unbacked winner pays nobody\",\n r.status === 200 && r.data?.houseWins === true && r.data?.winnersPaid === 0 &&\n r.data?.totalPaid === 0, JSON.stringify(r.data));\n check(\"house keeps the pot, no refund\", (await balanceOf(aJ)) === voidBefore - 150,\n String(await balanceOf(aJ)));\n\n vb = await getBet(aJ, voidBet);\n check(\"stake marked lost, not refunded\",\n !!vb.myWagers.find((w: any) => w.status === \"lost\"), JSON.stringify(vb.myWagers));\n\n // ── one throne on a long shot takes the entire pot ──────────────\n const m4 = await newMarket(adminJar, [\"Crowd\", \"Longshot\"]);\n const shotBet = m4.data.betId;\n let shot = await getBet(aJ, shotBet);\n const crowd = shot.options.find((o: any) => o.label === \"Crowd\").id;\n const longshot = shot.options.find((o: any) => o.label === \"Longshot\").id;\n\n await call(aJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: crowd, stake: 400 });\n await call(bJ, \"POST\", \"/api/login\", bob);\n await call(bJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: crowd, stake: 300 });\n const caraBeforeShot = await balanceOf(cJ);\n r = await call(cJ, \"POST\", \"/api/wagers\", { betId: shotBet, optionId: longshot, stake: 1 });\n check(\"cara risks a single Gelt on the longshot\", r.status === 200);\n\n shot = await getBet(cJ, shotBet);\n const lsOpt = shot.options.find((o: any) => o.id === longshot);\n check(\"longshot quotes 694x (pot 694 on a 1 Gelt stake)\",\n Math.abs(lsOpt.payoutPerGelt - 694) < 1e-9, String(lsOpt.payoutPerGelt));\n\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + shotBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + shotBet + \"/resolve\",\n { winningOptionId: longshot });\n check(\"longshot lands\", r.status === 200 && r.data?.totalPaid === 694, JSON.stringify(r.data));\n check(\"one untaxed Gelt becomes 694\", (await balanceOf(cJ)) === caraBeforeShot - 1 + 694,\n String(await balanceOf(cJ)));\n\n // ── rankings ────────────────────────────────────────────────────\n r = await call(null, \"GET\", \"/api/leaderboard\");\n check(\"leaderboard returns both columns\",\n Array.isArray(r.data?.byWallet) && Array.isArray(r.data?.byRatio), JSON.stringify(r.data));\n const walletSorted = (r.data.byWallet || []).every((u: any, i: number, a: any[]) =>\n i === 0 || a[i - 1].balance >= u.balance);\n check(\"wallet column sorted descending\", walletSorted);\n const ratioSorted = (r.data.byRatio || []).every((u: any, i: number, a: any[]) =>\n i === 0 || a[i - 1].rate >= u.rate);\n check(\"ratio column sorted descending\", ratioSorted);\n const noZeroSettled = (r.data.byRatio || []).every((u: any) => u.wins + u.losses > 0);\n check(\"ratio column excludes unsettled accounts\", noZeroSettled);\n\n // ── campaign map ────────────────────────────────────────────────\n function fakeSave(round: number){\n const obj = { v:3, gw:13, gh:13, grid:new Array(169).fill(-1), relics:[],\n round:round, seeded:true, fActive:{}, fElim:{}, fCells:{},\n fFormer:{}, pts:{}, overlays:{}, tempDefense:[] };\n return btoa(JSON.stringify(obj));\n }\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"campaign readable by anyone\", r.status === 200, JSON.stringify(r.data));\n\n r = await call(aJ, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: fakeSave(0) });\n check(\"non-admin cannot publish the board\", r.status === 403);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: \"short\" });\n check(\"malformed save code refused\", r.status === 400);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\", { round: 0, saveCode: \"!!!not base64!!!!!!!!!!!\" });\n check(\"non-base64 save code refused\", r.status === 400);\n\n for (const n of [0, 1, 2]) {\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\",\n { round: n, saveCode: fakeSave(n), note: \"round \" + n });\n check(\"publish round \" + n, r.status === 200, JSON.stringify(r.data));\n }\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"public sees latest round 2\", r.data?.round === 2, JSON.stringify(r.data?.round));\n\n r = await call(adminJar, \"GET\", \"/api/admin/campaign/history\");\n check(\"history lists 3 rounds\", (r.data?.rounds || []).length === 3,\n JSON.stringify((r.data?.rounds || []).length));\n check(\"history is newest first\", r.data?.rounds?.[0]?.round === 2);\n\n r = await call(aJ, \"GET\", \"/api/admin/campaign/history\");\n check(\"non-admin cannot read history\", r.status === 403);\n\n // Republishing the same round overwrites rather than duplicating.\n r = await call(adminJar, \"POST\", \"/api/admin/campaign\",\n { round: 2, saveCode: fakeSave(2), note: \"redo\" });\n check(\"republishing a round overwrites it\", r.status === 200);\n r = await call(adminJar, \"GET\", \"/api/admin/campaign/history\");\n check(\"history still has 3 rounds\", (r.data?.rounds || []).length === 3);\n\n r = await call(aJ, \"POST\", \"/api/admin/campaign/rollback\", { round: 1 });\n check(\"non-admin cannot roll back\", r.status === 403);\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign/rollback\", { round: 1 });\n check(\"rollback to round 1 discards 1 later round\",\n r.status === 200 && r.data?.round === 1 && r.data?.discarded === 1, JSON.stringify(r.data));\n check(\"rollback returns that round's save code\",\n typeof r.data?.saveCode === \"string\" && r.data.saveCode.length > 16);\n\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"public now sees round 1\", r.data?.round === 1, JSON.stringify(r.data?.round));\n\n r = await call(adminJar, \"POST\", \"/api/admin/campaign/rollback\", { round: 99 });\n check(\"rollback to a round that never existed is refused\", r.status === 404);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/campaign\");\n check(\"wipe clears the campaign\", r.status === 200 && r.data?.discarded === 2,\n JSON.stringify(r.data));\n r = await call(null, \"GET\", \"/api/campaign\");\n check(\"board is empty after wipe\", r.data?.round === null);\n\n // ── deleting markets ────────────────────────────────────────────\n // Deleting an unsettled market must hand the stakes back.\n const mOpen = await newMarket(adminJar, [\"Alpha\", \"Beta\"]);\n const openBet = mOpen.data.betId;\n let ob = await getBet(aJ, openBet);\n const oAlpha = ob.options.find((o: any) => o.label === \"Alpha\").id;\n const beforeOpenDel = await balanceOf(aJ);\n await call(aJ, \"POST\", \"/api/wagers\", { betId: openBet, optionId: oAlpha, stake: 250 });\n check(\"stake leaves the wallet\", (await balanceOf(aJ)) === beforeOpenDel - 250);\n\n r = await call(aJ, \"DELETE\", \"/api/admin/bets/\" + openBet);\n check(\"non-admin cannot delete a market\", r.status === 403);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + openBet);\n check(\"deleting an open market refunds pending stakes\",\n r.status === 200 && r.data?.stakeReturned === 250, JSON.stringify(r.data));\n check(\"wallet restored after deleting an open market\",\n (await balanceOf(aJ)) === beforeOpenDel, String(await balanceOf(aJ)));\n check(\"deleted market is gone from the listing\",\n !(await getBet(aJ, openBet)), \"still present\");\n\n // Deleting a settled market without reversing leaves balances alone.\n const mKeep = await newMarket(adminJar, [\"Win\", \"Lose\"]);\n const keepBet = mKeep.data.betId;\n let kb = await getBet(aJ, keepBet);\n const kWin = kb.options.find((o: any) => o.label === \"Win\").id;\n const kLose = kb.options.find((o: any) => o.label === \"Lose\").id;\n await call(aJ, \"POST\", \"/api/wagers\", { betId: keepBet, optionId: kWin, stake: 100 });\n await call(bJ, \"POST\", \"/api/wagers\", { betId: keepBet, optionId: kLose, stake: 100 });\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + keepBet + \"/close\", {});\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + keepBet + \"/resolve\", { winningOptionId: kWin });\n\n const keepA = await balanceOf(aJ), keepB = await balanceOf(bJ);\n const meA0 = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + keepBet);\n check(\"plain delete of a settled market reports no reversal\",\n r.status === 200 && r.data?.reversed === false && r.data?.stakeReturned === 0,\n JSON.stringify(r.data));\n check(\"winner keeps their winnings\", (await balanceOf(aJ)) === keepA);\n check(\"loser stays down\", (await balanceOf(bJ)) === keepB);\n const meA1 = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n check(\"win record untouched by a plain delete\", meA1.wins === meA0.wins);\n\n // Deleting with reverse=1 undoes the whole settlement.\n const mUndo = await newMarket(adminJar, [\"Win\", \"Lose\"]);\n const undoBet = mUndo.data.betId;\n let ub = await getBet(aJ, undoBet);\n const uWin = ub.options.find((o: any) => o.label === \"Win\").id;\n const uLose = ub.options.find((o: any) => o.label === \"Lose\").id;\n\n const preA = await balanceOf(aJ), preB = await balanceOf(bJ);\n const preAme = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n const preBme = (await call(bJ, \"GET\", \"/api/me\")).data.user;\n\n await call(aJ, \"POST\", \"/api/wagers\", { betId: undoBet, optionId: uWin, stake: 200 });\n await call(bJ, \"POST\", \"/api/wagers\", { betId: undoBet, optionId: uLose, stake: 300 });\n await call(adminJar, \"POST\", \"/api/admin/bets/\" + undoBet + \"/close\", {});\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + undoBet + \"/resolve\",\n { winningOptionId: uWin });\n check(\"market settles before the undo test\",\n r.status === 200 && r.data?.totalPaid === 495, JSON.stringify(r.data));\n check(\"winner is up after settlement\", (await balanceOf(aJ)) === preA - 200 + 495);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/\" + undoBet + \"?reverse=1\");\n check(\"reverse delete returns the full bids, levy included\",\n r.status === 200 && r.data?.reversed === true &&\n r.data?.stakeReturned === 500 && r.data?.winningsClawedBack === 495 &&\n r.data?.levyRefunded === 5,\n JSON.stringify(r.data));\n check(\"winner returned to pre-market balance\", (await balanceOf(aJ)) === preA,\n (await balanceOf(aJ)) + \" vs \" + preA);\n check(\"loser returned to pre-market balance\", (await balanceOf(bJ)) === preB,\n (await balanceOf(bJ)) + \" vs \" + preB);\n\n const postAme = (await call(aJ, \"GET\", \"/api/me\")).data.user;\n const postBme = (await call(bJ, \"GET\", \"/api/me\")).data.user;\n check(\"winner's win count rolled back\", postAme.wins === preAme.wins,\n postAme.wins + \" vs \" + preAme.wins);\n check(\"loser's loss count rolled back\", postBme.losses === preBme.losses,\n postBme.losses + \" vs \" + preBme.losses);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/bets/bet_nonexistent\");\n check(\"deleting a market that does not exist is refused\", r.status === 404);\n\n // ── treasury and accounts ───────────────────────────────────────\n const preFund = await balanceOf(aJ);\n r = await call(adminJar, \"POST\", \"/api/admin/fund\", { amount: 500 });\n check(\"fund all succeeds\", r.status === 200 && r.data?.accounts >= 3);\n check(\"alice funded by 500\", (await balanceOf(aJ)) === preFund + 500);\n r = await call(aJ, \"POST\", \"/api/admin/fund\", { amount: 999999 });\n check(\"non-admin cannot fund\", r.status === 403);\n\n r = await call(bJ, \"POST\", \"/api/logout\", {});\n check(\"logout succeeds\", r.status === 200);\n check(\"session dead after logout\", (await call(bJ, \"GET\", \"/api/me\")).data?.user === null);\n\n r = await call(adminJar, \"GET\", \"/api/admin/users\");\n const rows = r.data?.users || [];\n const find = (n: string) => rows.find((u: any) => u.username === n);\n check(\"admin sees all accounts\", !!find(alice.username) && !!find(bob.username));\n check(\"admin sees a treasury summary\",\n r.data?.treasury && r.data.treasury.rate === 0.01 &&\n typeof r.data.treasury.levyCollected === \"number\",\n JSON.stringify(r.data?.treasury));\n check(\"per-account levy is reported\", typeof find(alice.username)?.levied === \"number\",\n JSON.stringify(find(alice.username)));\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/users/\" + find(adminUser)?.id);\n check(\"overseer account cannot be deleted\", r.status === 400);\n\n for (const u of [alice, bob, cara]) {\n const row = find(u.username);\n if (row) await call(adminJar, \"DELETE\", \"/api/admin/users/\" + row.id);\n }\n r = await call(adminJar, \"GET\", \"/api/admin/users\");\n const leftover = (r.data?.users || []).filter((u: any) => u.username.startsWith(\"tst_\"));\n check(\"test accounts removed\", leftover.length === 0, JSON.stringify(leftover));\n\n // ── cleanup ─────────────────────────────────────────────────────\n const { sqlite } = await import(\"https://esm.town/v/std/sqlite/main.ts\");\n for (const id of createdBets) {\n await sqlite.batch([\n { sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] },\n { sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] },\n { sql: \"DELETE FROM bets WHERE id = ?\", args: [id] },\n ], \"write\");\n }\n\n const report = [\n \"\",\n \"THRONE LEDGER - POOL MARKET SELF TEST\",\n \"=====================================\",\n ...results,\n \"\",\n `${pass} passed, ${fail} failed`,\n \"\",\n ].join(\"\\n\");\n console.log(report);\n return report;\n}\n\nexport default await selftest();\n","createdAt",["D",1789377635259],"branchVersion","branchId","649b81a3-ef64-48e6-b6db-ab0a767348e2","id","3acf27cf-bc0f-4f45-b440-a47608349aee","throne-ledger",["D",1789371999223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger for the Battle for the Hive campaign","imageUrl","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","6b608f96-b010-11f1-9552-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","3acf27cfbc0f4f45b440a47608349aee","tursoHostname","3acf27cfbc0f4f45b440a47608349aee-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789459281818],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",173,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","RT_Brandt","handle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":382,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":383,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":384,"_85":385,"_87":386,"_89":25},"tree",[177,184,189,201],"files",[177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201],"counts",{"_166":64,"_167":168,"_169":64,"_170":171,"_172":173},"contents",[132,133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":164,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":165},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":157,"_140":60,"_39":158,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":159},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":151,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":153},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":141,"_13":142,"_34":143,"_36":144,"_24":25,"_145":46,"_27":146},"d77ca5dc-1963-41bb-8266-cb06d4eabd78","main.tsx","parentId",63,"latest",["D",1789376232886],3,"http","import { Hono } from \"npm:hono\";\nimport { parseVal, readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { api } from \"./lib/api.ts\";\nimport { PAGE } from \"./lib/ui.ts\";\nimport { ready } from \"./lib/db.ts\";\n\nconst app = new Hono();\n\napp.route(\"/api\", api);\n\napp.get(\"/\", async (c) => {\n await ready();\n return c.html(PAGE);\n});\n\n/**\n * Warband sigils that aren't in any public icon set are bundled with the\n * val. Served immutable: the filename changes if the art ever does.\n */\nconst SIGIL_FILES = new Set([\n \"custodes\", \"astartes\", \"heretics\", \"mechanicus\", \"ministorum\",\n \"daemons\", \"tyranids\", \"orks\", \"drukhari\", \"tau\", \"necrons\",\n]);\n\napp.get(\"/sigils/:name\", async (c) => {\n const name = c.req.param(\"name\").replace(/\\.svg$/, \"\");\n if (!SIGIL_FILES.has(name)) return c.notFound();\n try {\n const svg = await readFile(`/sigils/${name}.svg`, import.meta.url);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n } catch (e) {\n console.error(\"sigil read failed\", name, e);\n return c.notFound();\n }\n});\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","label",[137],"ab404456-1dde-4768-b7b3-641072a137bf","sigils","9340e4af-2103-4c6a-9cfc-46895ff4673b",44,["D",1789375459829],"directory",[148],"da4bc700-988d-495b-a48f-a8b28fb515c7","scripts","e271c1d7-6014-4994-8caa-07e909b081d1",8,["D",1789372426992],[155],"d40104bc-606a-4d76-b529-424870d4ebb7","lib","36d116d1-be79-439b-af80-39fd2bb6eeb1",2,["D",1789372056135],[161],"pulls","branches",1,"forks","envVars",{"_174":163,"_176":64},"connections",{"_174":64,"_175":64},"count","unfilledCount","emptyCount",{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":379,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":380,"_27":381},{"_44":370,"_32":371,"_30":372,"_138":162,"_42":43,"_41":373,"_140":25,"_39":374,"_13":375,"_34":35,"_36":376,"_24":25,"_145":-5,"_203":377,"_27":378},{"_44":362,"_32":363,"_30":364,"_138":162,"_42":43,"_41":365,"_140":60,"_39":366,"_13":64,"_34":35,"_36":367,"_24":25,"_145":-5,"_203":368,"_27":369},{"_44":355,"_32":356,"_30":357,"_138":162,"_42":43,"_41":163,"_140":60,"_39":358,"_13":64,"_34":35,"_36":359,"_24":25,"_145":-5,"_203":360,"_27":361},{"_44":346,"_32":347,"_30":348,"_138":162,"_42":43,"_41":349,"_140":25,"_39":350,"_13":351,"_34":35,"_36":352,"_24":25,"_145":-5,"_203":353,"_27":354},{"_44":338,"_32":339,"_30":340,"_138":162,"_42":43,"_41":341,"_140":25,"_39":342,"_13":142,"_34":35,"_36":343,"_24":25,"_145":-5,"_203":344,"_27":345},{"_44":329,"_32":330,"_30":331,"_138":162,"_42":43,"_41":332,"_140":25,"_39":333,"_13":334,"_34":35,"_36":335,"_24":25,"_145":-5,"_203":336,"_27":337},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":157,"_140":60,"_39":326,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":327,"_27":328},{"_44":318,"_32":319,"_30":320,"_138":156,"_42":43,"_41":321,"_140":60,"_39":322,"_13":64,"_34":35,"_36":323,"_24":25,"_145":-5,"_203":324,"_27":325},{"_44":310,"_32":311,"_30":312,"_138":156,"_42":43,"_41":313,"_140":60,"_39":314,"_13":64,"_34":35,"_36":315,"_24":25,"_145":-5,"_203":316,"_27":317},{"_44":305,"_32":33,"_30":31,"_138":156,"_42":43,"_41":14,"_140":25,"_39":306,"_13":307,"_34":35,"_36":38,"_24":25,"_145":-5,"_203":308,"_27":309},{"_44":296,"_32":297,"_30":298,"_138":156,"_42":43,"_41":299,"_140":25,"_39":300,"_13":301,"_34":35,"_36":302,"_24":25,"_145":-5,"_203":303,"_27":304},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":293,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":294,"_27":295},{"_44":285,"_32":286,"_30":287,"_138":149,"_42":43,"_41":288,"_140":60,"_39":289,"_13":64,"_34":20,"_36":290,"_24":25,"_145":-5,"_203":291,"_27":292},{"_44":277,"_32":278,"_30":279,"_138":149,"_42":43,"_41":280,"_140":60,"_39":281,"_13":64,"_34":20,"_36":282,"_24":25,"_145":-5,"_203":283,"_27":284},{"_44":269,"_32":270,"_30":271,"_138":149,"_42":43,"_41":272,"_140":60,"_39":273,"_13":64,"_34":20,"_36":274,"_24":25,"_145":-5,"_203":275,"_27":276},{"_44":262,"_32":263,"_30":264,"_138":149,"_42":43,"_41":150,"_140":60,"_39":265,"_13":64,"_34":20,"_36":266,"_24":25,"_145":-5,"_203":267,"_27":268},{"_44":254,"_32":255,"_30":256,"_138":149,"_42":43,"_41":257,"_140":60,"_39":258,"_13":64,"_34":20,"_36":259,"_24":25,"_145":-5,"_203":260,"_27":261},{"_44":246,"_32":247,"_30":248,"_138":149,"_42":43,"_41":249,"_140":60,"_39":250,"_13":64,"_34":20,"_36":251,"_24":25,"_145":-5,"_203":252,"_27":253},{"_44":238,"_32":239,"_30":240,"_138":149,"_42":43,"_41":241,"_140":60,"_39":242,"_13":64,"_34":20,"_36":243,"_24":25,"_145":-5,"_203":244,"_27":245},{"_44":230,"_32":231,"_30":232,"_138":149,"_42":43,"_41":233,"_140":60,"_39":234,"_13":64,"_34":20,"_36":235,"_24":25,"_145":-5,"_203":236,"_27":237},{"_44":222,"_32":223,"_30":224,"_138":149,"_42":43,"_41":225,"_140":60,"_39":226,"_13":64,"_34":20,"_36":227,"_24":25,"_145":-5,"_203":228,"_27":229},{"_44":214,"_32":215,"_30":216,"_138":149,"_42":43,"_41":217,"_140":60,"_39":218,"_13":64,"_34":20,"_36":219,"_24":25,"_145":-5,"_203":220,"_27":221},{"_44":206,"_32":207,"_30":208,"_138":149,"_42":43,"_41":209,"_140":60,"_39":210,"_13":64,"_34":20,"_36":211,"_24":25,"_145":-5,"_203":212,"_27":213},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":202,"_13":142,"_34":143,"_36":144,"_24":25,"_145":46,"_203":204,"_27":205},["D",1789376232886],"children",[],[137],"dca6681e-9be1-4594-8c3d-729cc869ec14","tyranids.svg","ae826d8c-b018-11f1-91d0-1607ee4eb77e",45,["D",1789375547846],"\n",[],[148,207],"9bc332e0-9789-46bf-84dc-b7140f546403","tau.svg","aaae15ac-b019-11f1-937a-1607ee4eb77e",57,["D",1789375970929],"\n",[],[148,215],"5a4158fb-b067-43b1-81db-fe8238ce8c07","orks.svg","17447464-b019-11f1-95b2-1607ee4eb77e",46,["D",1789375723608],"\n",[],[148,223],"445422fd-cad6-4683-a5d2-8c9db8e66d6c","necrons.svg","b0a4f430-b019-11f1-b3d0-1607ee4eb77e",58,["D",1789375980892],"\n",[],[148,231],"01c278c8-6b72-4403-bbc4-ca24c67b35db","ministorum.svg","cafbb7e2-b019-11f1-b754-1607ee4eb77e",60,["D",1789376025122],"\n",[],[148,239],"714f3cc3-8b01-42a9-85eb-e53c372d0b6d","mechanicus.svg","dfd88b54-b019-11f1-aa20-1607ee4eb77e",61,["D",1789376060117],"\n",[],[148,247],"fbc30734-f2ed-4b7d-bc89-bbad435e476f","heretics.svg","8f4f85c0-b019-11f1-b134-1607ee4eb77e",55,["D",1789375924952],"\n",[],[148,255],"b5409e11-e24d-43ff-9cba-4d0cb2515221","drukhari.svg","7a0a6bd6-b018-11f1-881c-1607ee4eb77e",["D",1789375459829],"\n",[],[148,263],"aa5b02ea-b3eb-462c-819e-8fe93236cc55","daemons.svg","9ef133e8-b019-11f1-a090-1607ee4eb77e",56,["D",1789375951233],"\n",[],[148,270],"59fca74c-32da-48c2-9962-0b19a1fb9427","custodes.svg","bb141072-b019-11f1-b11c-1607ee4eb77e",59,["D",1789375998438],"\n",[],[148,278],"355ba2de-7c38-4b25-9dd9-d953846e5910","astartes.svg","43a92508-b01a-11f1-bd57-1607ee4eb77e",62,["D",1789376227420],"\n",[],[148,286],["D",1789375459829],[190,191,192,193,194,195,196,197,198,199,200],[148],"d3f67627-1218-4cdf-ae97-562695071253","sigilcheck.ts","b305c300-b017-11f1-a508-1607ee4eb77e",94,["D",1789377195695],9,"/**\n * Executes the page's client JS in a fake DOM and checks:\n * - every sigil URL resolves and returns SVG\n * - the engine can load a v3 save code and read it back correctly\n * - save -> load -> save round-trips without drift\n */\nimport { PAGE } from \"../lib/ui.ts\";\n\nconst out: string[] = [\"\", \"SIGIL + IMPORT CHECK\", \"====================\"];\nlet fail = 0;\nconst ok = (n: string, c: boolean, d = \"\") => {\n if (c) out.push(\" PASS \" + n);\n else { fail++; out.push(\" FAIL \" + n + (d ? \" -> \" + d : \"\")); }\n};\n\nconst blocks = [...PAGE.matchAll(/\n\n\n\n

Throne LedgerBy the Warrant of Von Brandt · Hive Solenne

\n \n

\n\n\n\n\n\n\n\n`;\n",[],[161,330],"16b8be99-ba1f-45e4-8c8a-e1e4e9ffe91d","engine.ts","5efcee7e-b016-11f1-97b9-1607ee4eb77e",87,["D",1789377125133],"/**\n * The war engine, as a browser-side module.\n *\n * This is the same simulation that ran in the standalone HTML file, with\n * one change: it no longer reads its state out of form inputs. Points per\n * faction live in E.pts, logging goes through a hook, and drawing takes a\n * canvas element. That lets the public page render a read-only board from\n * a saved snapshot while the Overseer panel drives the same code forward.\n *\n * Save codes are the v3 base64 format the standalone file already wrote,\n * so existing saves import cleanly.\n */\nexport const ENGINE_JS = String.raw`\nvar E = (function(){\n\nvar FACS=[\n {id:'custodians',name:'Golden Vigil', subfacs:'Custodes', color:'#D4A017',defence:6,attack:0,random:0,special:'static', reclaim:false,desc:'Guard the relic sites. Never expand, never attack.'},\n {id:'marines', name:'Iron Fangs', subfacs:'Space Marines', color:'#1560BD',defence:1,attack:2,random:0,special:'sworn', reclaim:false,desc:'Sworn enemy of Chaos. Priority placement.'},\n {id:'chaos', name:'Raiders of Ruin', subfacs:'Renegade Raiders & Chaos Knights', color:'#6A0DAD',defence:1,attack:2,random:0,special:'sworn', reclaim:false,desc:'Sworn enemy of Marines. Priority placement.'},\n {id:'admech', name:'Planetary Defense Force', subfacs:'AdMech, Imperial Guard & Knights',color:'#B22222',defence:2,attack:1,random:0,special:null, reclaim:false,desc:'Balanced force. No special rules.'},\n {id:'gk', name:'Argent Salvation', subfacs:'Grey Knights, Deathwatch & Sisters', color:'#00BFFF',defence:0,attack:2,random:1,special:null, reclaim:true, desc:'Reclaims lost ground. 1 random rift per round.'},\n {id:'nids', name:'Hive Fleet Cetea', subfacs:'Tyranids & Genestealers', color:'#8B0040',defence:0,attack:3,random:0,special:'priority',reclaim:true, desc:'Priority placement. Reclaims former feeding grounds.'},\n {id:'daemons', name:'Daemon Incursions', subfacs:'Daemons', color:'#FF4500',defence:1,attack:2,random:3,special:null, reclaim:false,desc:'3 random rifts per round, drawn toward relics.'},\n {id:'orks', name:'Spinechoppa Waaagh', subfacs:'Orks', color:'#228B22',defence:0,attack:3,random:0,special:'priority',reclaim:false,desc:'Priority placement. Maximum aggression, no defence.'},\n {id:'eldar', name:\"Kurnous' Spear\", subfacs:'Dark Eldar, Eldar & Exodites', color:'#008B8B',defence:2,attack:0,random:1,special:null, reclaim:true, desc:'Strikes with no attack bonus, but hard to dislodge. Reclaims lost ground and opens 1 rift per round.'},\n {id:'tau', name:'Xenos Accord', subfacs:'Ordo Xenos, Squats & Tau', color:'#FF8C00',defence:3,attack:0,random:0,special:null, reclaim:true, desc:'No attack bonus, but the hardest force on the board to dig out. Reclaims former mining claims first.'},\n {id:'necrons', name:'Ramaneb Dynasty', subfacs:'Necrons', color:'#39FF14',defence:2,attack:1,random:0,special:null, reclaim:true, desc:'Reclaims ancient tomb worlds before expanding.'},\n];\n\nvar BUDGET=3, PRIORITY_IDS=['orks','nids','marines','chaos'], PRESEED_TARGET=16,\n RELIC_COUNT=9, ATTACKS_PER_FACTION=4, MAP_URL='https://i.ibb.co/4R6ngzdV/40k-map.png';\n\nvar GW=13, GH=13, CELL=18;\nvar grid=null, fCells={}, fElim={}, fActive={}, fFormer={}, relicSites=new Set();\nvar round=0, seeded=false, lines=[], overlays={};\nvar tempDefense=new Map();\nvar PTS={};\nvar onLog=null;\n\nFACS.forEach(function(f){ fActive[f.id]=true; fCells[f.id]=new Set(); fElim[f.id]=0; fFormer[f.id]=new Set(); PTS[f.id]=50; });\n\nfunction log(msg){\n lines.push(msg);\n if(lines.length>400) lines.shift();\n if(onLog) onLog(msg);\n}\n\nfunction getPts(id){ var v=PTS[id]; return Math.max(1, Number(v)||50); }\nfunction setPts(id,v){ PTS[id]=Math.max(0, Math.min(100, Number(v)||0)); }\n\nfunction rollAttack(fid){\n var f=FACS.find(function(x){return x.id===fid;});\n return (Math.random()*100)*(getPts(fid)/100)+(f?f.attack:0);\n}\nfunction rollDefence(fid, cellIndex){\n var f=FACS.find(function(x){return x.id===fid;});\n var bonus = 1.5*(f?f.defence:0);\n if(cellIndex!==undefined) bonus += tempDefense.get(cellIndex)||0;\n return (Math.random()*100)*(getPts(fid)/100)+bonus;\n}\nfunction relicsHeldBy(fid){\n var fi=FACS.findIndex(function(f){return f.id===fid;})+1;\n return Array.from(relicSites).filter(function(r){return grid[r]===fi;}).length;\n}\nfunction boardControl(fid){ return (fCells[fid]?fCells[fid].size:0)+relicsHeldBy(fid)*3; }\nfunction relicExpansionBonus(fid){ return Math.floor(relicsHeldBy(fid)/2); }\nfunction isElim(id){ return !fActive[id]; }\nfunction rnd(a){ return a.length?a[Math.floor(Math.random()*a.length)]:undefined; }\nfunction adj4(i){\n var x=i%GW, y=Math.floor(i/GW), r=[];\n if(x>0)r.push(i-1); if(x0)r.push(i-GW); if(y=0&&FACS[old]){ var oid=FACS[old].id; if(fCells[oid])fCells[oid].delete(i); if(fFormer[oid])fFormer[oid].add(i); }\n var fi=FACS.findIndex(function(f){return f.id===fid;}); if(fi<0)return;\n grid[i]=fi+1;\n if(!fCells[fid])fCells[fid]=new Set();\n fCells[fid].add(i); if(fFormer[fid])fFormer[fid].delete(i);\n}\nfunction addOverlay(i,icon){\n if(!overlays[i])overlays[i]=[];\n if(overlays[i].indexOf(icon)<0)overlays[i].push(icon);\n if(overlays[i].length>3)overlays[i]=overlays[i].slice(-3);\n}\nfunction fadeColor(c,a){\n var r=parseInt(c.slice(1,3),16),g=parseInt(c.slice(3,5),16),b=parseInt(c.slice(5,7),16);\n return 'rgba('+r+','+g+','+b+','+a+')';\n}\n\nvar LOC13 = [\n 'Water Purification','Water Purification','Water Purification','Temple District','Temple District','Temple District','Temple District','Habs 6B','Habs 6B','Habs 6B','Mines','Mines','Mines',\n 'Water Purification','Water Purification','Water Purification','Temple District','Temple District','Defence Fortress','Defence Fortress','Defence Fortress','Habs 6B','Habs 6B','Mines','Mines','Mines',\n 'Water Purification','Water Purification','Habs 8Y','Habs 8Y','Defence Fortress','Defence Fortress','Defence Fortress','Defence Fortress','Administratum','Administratum','Mines','Mines','Mines',\n 'Incarcerum','Incarcerum','Habs 8Y','Habs 8Y','Habs 8Y','Palace','Palace','Palace','Administratum','Administratum','Administratum','Waste Processing','Waste Processing',\n 'Incarcerum','Incarcerum','Museum','Museum','Museum','Palace','Palace','Palace','Palace','Administratum','Administratum','Waste Processing','Waste Processing',\n 'Incarcerum','Incarcerum','Museum','Museum','Museum','Palace','Palace','Palace','Data Stacks','Data Stacks','Data Stacks','Waste Processing','Waste Processing',\n 'Market District','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Data Stacks','Data Stacks','Data Stacks','Data Stacks','Data Stacks',\n 'Market District','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Habs 5T','Data Stacks','Data Stacks','Data Stacks','Data Stacks',\n 'Prometheum','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Habs 5T','Habs 5T','Habs 5T','Habs 3L','Habs 3L',\n 'Prometheum','Prometheum','Market District','Market District','Manufactorum','Habs IX','Habs IX','Power','Power','Habs 5T','Habs 5T','Habs 3L','Habs 3L',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport'\n];\nfunction getCoords(i){\n var x=i%GW, y=Math.floor(i/GW);\n if(GW===13&&GH===13){ var n=LOC13[y*13+x]; if(n) return n; }\n return '('+x+','+y+')';\n}\n\nfunction getBlobs(fid){\n var owned=new Set(fCells[fid]), visited=new Set(), blobs=[];\n owned.forEach(function(start){\n if(visited.has(start))return;\n var blob=[], q=[start]; visited.add(start);\n while(q.length){\n var c=q.pop(); blob.push(c);\n adj4(c).forEach(function(n){ if(owned.has(n)&&!visited.has(n)){ visited.add(n); q.push(n); } });\n }\n blobs.push(blob);\n });\n return blobs.sort(function(a,b){return b.length-a.length;});\n}\nfunction nearestRelicTarget(fid){\n var relicEmp=relicAdjacentEmpty(); if(!relicEmp.length)return null;\n var owned=Array.from(fCells[fid]); if(!owned.length)return null;\n var best=null,bestD=999999;\n owned.forEach(function(c){\n var cx=c%GW, cy=Math.floor(c/GW);\n relicEmp.forEach(function(t){\n var d=Math.pow(cx-t%GW,2)+Math.pow(cy-Math.floor(t/GW),2);\n if(d0){\n var tgts=[];\n fCells[fid].forEach(function(c){\n adj4(c).forEach(function(n){ if(grid[n]===-1&&former.has(n)&&!relicSites.has(n)) tgts.push(n); });\n });\n if(tgts.length)return rnd(tgts);\n }\n return pickExpansionTarget(fid);\n}\n\n// ── drawing ────────────────────────────────────────────────────────\nvar cachedBg=null;\n\nfunction draw(canvas, maxWidth){\n if(!canvas||!grid)return;\n maxWidth = maxWidth || 600;\n CELL = Math.max(10, Math.floor(maxWidth/GW));\n var mapW=GW*CELL, mapH=GH*CELL;\n canvas.width=mapW; canvas.height=mapH;\n canvas.style.width=mapW+'px'; canvas.style.height=mapH+'px';\n var ctx=canvas.getContext('2d');\n\n function layers(){\n // Fill pass. Grid lines are kept very faint so the territory\n // outlines below are what the eye actually follows.\n for(var y=0;y0){\n ctx.drawImage(cachedBg,0,0,mapW,mapH); layers();\n } else {\n var img=new Image(); img.crossOrigin='Anonymous';\n img.onload=function(){ cachedBg=img; ctx.drawImage(img,0,0,mapW,mapH); layers(); };\n img.onerror=function(){ ctx.fillStyle='#181818'; ctx.fillRect(0,0,mapW,mapH); layers(); };\n img.src=MAP_URL;\n }\n}\n\n// ── save / load ────────────────────────────────────────────────────\nfunction save(){\n var o={ v:3, gw:GW, gh:GH, grid:Array.from(grid), relics:Array.from(relicSites),\n round:round, seeded:seeded, fActive:{}, fElim:{}, fCells:{}, fFormer:{},\n pts:{}, overlays:overlays, tempDefense:Array.from(tempDefense.entries()) };\n FACS.forEach(function(f){\n o.fActive[f.id]=fActive[f.id];\n o.fElim[f.id]=fElim[f.id];\n o.fCells[f.id]=Array.from(fCells[f.id]);\n o.fFormer[f.id]=Array.from(fFormer[f.id]);\n o.pts[f.id]=getPts(f.id);\n });\n var bytes=new TextEncoder().encode(JSON.stringify(o));\n var s=''; for(var i=0;i0&&f.special!=='static'; })\n .forEach(function(f){ place(f,BUDGET-f.random,f.random); });\n seeded=true;\n}\n\nfunction advance(n){\n if(!seeded) throw new Error('Run preseed first.');\n for(var i=0;idfn){\n log(' \\u2694\\uFE0F '+f.name.split(' ')[0]+' took '+where+' from '+def.name.split(' ')[0]+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(target,'\\u2694\\uFE0F');\n claim(target,f.id);\n if(f.random>0){\n addTempDefense(target,3); addOverlay(target,'\\u26A1');\n log(' \\u26A1 Ambush buff at '+where+' (+3 defence next round)');\n }\n } else {\n log(' \\uD83D\\uDEE1\\uFE0F '+def.name.split(' ')[0]+' held '+where+' vs '+f.name.split(' ')[0]+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(target,'\\uD83D\\uDEE1\\uFE0F');\n }\n }\n });\n\n // Phase 3: one free swing at a Custodian relic\n var champ=strongestRelicBorder(cfi);\n if(champ){\n var cf=FACS.find(function(f){return f.id===champ;});\n var cust=FACS.find(function(f){return f.id==='custodians';});\n var reach=Array.from(relicSites).filter(function(r){\n return grid[r]===cfi&&adj4(r).some(function(n){\n return grid[n]>0&&FACS[grid[n]-1]&&FACS[grid[n]-1].id===champ;\n });\n });\n if(reach.length){\n var t=rnd(reach);\n var atk=rollAttack(champ), dfn=rollDefence('custodians',t);\n var where=getCoords(t);\n if(atk>dfn){\n log(' \\u2B50 '+cf.name+' seized the RELIC at '+where+'! ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(t,'\\u2B50'); claim(t,champ);\n if(cf.random>0){ addTempDefense(t,3); addOverlay(t,'\\u26A1'); }\n } else {\n log(' \\uD83D\\uDEE1\\uFE0F '+cust.name+' held the relic at '+where+' vs '+cf.name+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(t,'\\uD83D\\uDEE1\\uFE0F');\n }\n }\n }\n}\n\nfunction strongestRelicBorder(cfi){\n var cRelics=Array.from(relicSites).filter(function(r){return grid[r]===cfi;});\n if(!cRelics.length)return null;\n var bord=new Set();\n cRelics.forEach(function(r){\n adj4(r).forEach(function(n){\n var v=grid[n];\n if(v>0&&v!==cfi&&FACS[v-1]){\n var fid=FACS[v-1].id;\n if(fActive[fid]&&!isElim(fid)) bord.add(fid);\n }\n });\n });\n if(!bord.size)return null;\n var best=-1, bestF=[];\n bord.forEach(function(fid){\n var p=getPts(fid);\n if(p>best){best=p;bestF=[fid];} else if(p===best) bestF.push(fid);\n });\n return bestF[Math.floor(Math.random()*bestF.length)];\n}\n\nfunction checkElim(){\n FACS.forEach(function(f){\n if(!fActive[f.id]||f.special==='static')return;\n var c=fCells[f.id]?fCells[f.id].size:0;\n if(c===0){\n fElim[f.id]=(fElim[f.id]||0)+1;\n if(fElim[f.id]>=2){ log('\\uD83D\\uDC80 ELIMINATED: '+f.name); fActive[f.id]=false; }\n } else fElim[f.id]=0;\n });\n}\n\nfunction standings(){\n return FACS.filter(function(f){ return fActive[f.id]; })\n .map(function(f){\n return { id:f.id, name:f.name, subfacs:f.subfacs, color:f.color,\n control:boardControl(f.id), cells:(fCells[f.id]?fCells[f.id].size:0),\n relics:relicsHeldBy(f.id), pts:getPts(f.id) };\n })\n .sort(function(a,b){ return b.control-a.control; });\n}\n\nreturn {\n FACS: FACS,\n RELIC_COUNT: RELIC_COUNT,\n ATTACKS_PER_FACTION: ATTACKS_PER_FACTION,\n BUDGET: BUDGET,\n PRESEED_TARGET: PRESEED_TARGET,\n draw: draw,\n save: save,\n load: load,\n generate: generate,\n preseed: preseed,\n advance: advance,\n standings: standings,\n setPts: setPts,\n getPts: getPts,\n setActive: function(id,on){ fActive[id]=!!on; },\n isActive: function(id){ return !!fActive[id]; },\n getRound: function(){ return round; },\n isSeeded: function(){ return seeded; },\n dims: function(){ return { w:GW, h:GH }; },\n relicsWithCustodes: function(){\n var cfi=FACS.findIndex(function(f){return f.id==='custodians';})+1;\n return Array.from(relicSites).filter(function(r){return grid[r]===cfi;}).length;\n },\n getLines: function(){ return lines.slice(); },\n setLogSink: function(fn){ onLog=fn; },\n hasGrid: function(){ return !!grid; }\n};\n\n})();\n`;\n",[],[161,339],"40987122-a5ab-4c53-b523-fde381b18b0e","db.ts","9a6a2df6-b010-11f1-af0e-1607ee4eb77e",97,["D",1789377385620],5,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword, newId } from \"./crypto.ts\";\n\nexport { sqlite };\n\nexport const STARTING_BALANCE = 1000;\nexport const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14; // 14 days\n\n/** Selling a position back to the house returns this fraction of the stake. */\nexport const SELLBACK_RATE = 0.9;\n\n/**\n * The Overseer's levy on every wager. Taken out of the stake, not the\n * wallet: bid 100 and 100 leaves your purse, 1 is levied, and 99 is what\n * actually sits in the pot and earns you a share of it. The levy leaves\n * circulation entirely; it does not join the pot.\n */\nexport const TAX_RATE = 0.01;\n\n/** gross -> { tax, net }. Floors the levy so a 1 Gelt bid is never zeroed. */\nexport function applyLevy(gross: number): { tax: number; net: number } {\n const tax = Math.floor(gross * TAX_RATE);\n return { tax, net: gross - tax };\n}\n\n/**\n * Schema notes\n *\n * This is a parimutuel (pool) market, not a fixed-odds book. Nobody sets\n * payout rates: every stake on a bet goes into one pot, and when the bet\n * resolves the whole pot is split among backers of the winning outcome in\n * proportion to what each of them put in. So odds are an emergent property\n * of where the money sits, and they move as people bet.\n *\n * bets.forfeited holds the 10% skimmed from positions sold back early.\n * It stays in the pot and is paid out to whoever eventually wins, which\n * gives holders a small edge over churners.\n *\n * wagers.status: pending | won | lost | sold | void\n */\n\nconst DDL = [\n `CREATE TABLE IF NOT EXISTS meta (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS users (\n id TEXT PRIMARY KEY,\n username TEXT NOT NULL,\n username_lower TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n balance INTEGER NOT NULL DEFAULT ${STARTING_BALANCE},\n is_admin INTEGER NOT NULL DEFAULT 0,\n wins INTEGER NOT NULL DEFAULT 0,\n losses INTEGER NOT NULL DEFAULT 0,\n failed_attempts INTEGER NOT NULL DEFAULT 0,\n locked_until INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token_hash TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,\n `CREATE TABLE IF NOT EXISTS bets (\n id TEXT PRIMARY KEY,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n status TEXT NOT NULL DEFAULT 'open',\n closes_at INTEGER NOT NULL,\n winning_option_id TEXT,\n forfeited INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL,\n resolved_at INTEGER\n )`,\n `CREATE TABLE IF NOT EXISTS bet_options (\n id TEXT PRIMARY KEY,\n bet_id TEXT NOT NULL,\n label TEXT NOT NULL,\n sort_order INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)`,\n `CREATE TABLE IF NOT EXISTS wagers (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n bet_id TEXT NOT NULL,\n option_id TEXT NOT NULL,\n stake INTEGER NOT NULL,\n tax INTEGER NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL,\n settled_at INTEGER\n )`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)`,\n // One snapshot per round of the war engine. Keeping every round means\n // the Overseer can roll back a bad advance instead of rebuilding.\n `CREATE TABLE IF NOT EXISTS campaign_rounds (\n round INTEGER PRIMARY KEY,\n save_code TEXT NOT NULL,\n note TEXT NOT NULL DEFAULT '',\n created_at INTEGER NOT NULL\n )`,\n];\n\nlet readyPromise: Promise | null = null;\n\n/** Idempotent. Safe to await on every request; the work happens once per isolate. */\nexport function ready(): Promise {\n if (!readyPromise) readyPromise = boot();\n return readyPromise;\n}\n\nasync function boot(): Promise {\n for (const stmt of DDL) await sqlite.execute(stmt);\n await migrate();\n await seedAdmin();\n await pruneSessions();\n}\n\nasync function columnsOf(table: string): Promise {\n const res = await sqlite.execute(`PRAGMA table_info(${table})`);\n return res.rows.map((r: any) => String(r.name ?? r[1]));\n}\n\n/**\n * Moves a fixed-odds database (multipliers baked into each option and\n * wager) onto the pool model. Existing rows are preserved.\n */\nasync function migrate(): Promise {\n // bets.forfeited\n const betCols = await columnsOf(\"bets\");\n if (!betCols.includes(\"forfeited\")) {\n await sqlite.execute(\n \"ALTER TABLE bets ADD COLUMN forfeited INTEGER NOT NULL DEFAULT 0\",\n );\n console.log(\"migration: added bets.forfeited\");\n }\n\n // bet_options loses multiplier\n const optCols = await columnsOf(\"bet_options\");\n if (optCols.includes(\"multiplier\")) {\n await sqlite.batch([\n { sql: `CREATE TABLE bet_options_new (\n id TEXT PRIMARY KEY, bet_id TEXT NOT NULL,\n label TEXT NOT NULL, sort_order INTEGER NOT NULL DEFAULT 0)` },\n { sql: `INSERT INTO bet_options_new (id, bet_id, label, sort_order)\n SELECT id, bet_id, label, sort_order FROM bet_options` },\n { sql: `DROP TABLE bet_options` },\n { sql: `ALTER TABLE bet_options_new RENAME TO bet_options` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)` },\n ], \"write\");\n console.log(\"migration: dropped bet_options.multiplier\");\n }\n\n // wagers lose multiplier + potential_return (payouts are now computed at resolve)\n const wagerCols = await columnsOf(\"wagers\");\n if (wagerCols.includes(\"multiplier\") || wagerCols.includes(\"potential_return\")) {\n await sqlite.batch([\n { sql: `CREATE TABLE wagers_new (\n id TEXT PRIMARY KEY, user_id TEXT NOT NULL, bet_id TEXT NOT NULL,\n option_id TEXT NOT NULL, stake INTEGER NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL, settled_at INTEGER)` },\n { sql: `INSERT INTO wagers_new (id, user_id, bet_id, option_id, stake, status, payout, created_at, settled_at)\n SELECT id, user_id, bet_id, option_id, stake, status, payout, created_at, settled_at FROM wagers` },\n { sql: `DROP TABLE wagers` },\n { sql: `ALTER TABLE wagers_new RENAME TO wagers` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)` },\n ], \"write\");\n console.log(\"migration: dropped wagers.multiplier and potential_return\");\n }\n\n // wagers.tax: pre-levy wagers simply recorded nothing, which is correct\n // for them since no levy was taken.\n const wagerCols2 = await columnsOf(\"wagers\");\n if (!wagerCols2.includes(\"tax\")) {\n await sqlite.execute(\n \"ALTER TABLE wagers ADD COLUMN tax INTEGER NOT NULL DEFAULT 0\",\n );\n console.log(\"migration: added wagers.tax\");\n }\n\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '3')\",\n args: [],\n });\n}\n\n/**\n * The admin account is created from environment variables, never from\n * source code. If ADMIN_PASSWORD is absent the account is simply not\n * created and the admin panel stays unreachable.\n */\nasync function seedAdmin(): Promise {\n const username = (Deno.env.get(\"ADMIN_USERNAME\") || \"admin\").trim();\n const password = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!password) {\n console.warn(\"ADMIN_PASSWORD not set - no admin account will exist.\");\n return;\n }\n\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n if (existing.rows.length > 0) {\n await sqlite.execute({\n sql: \"UPDATE users SET is_admin = 1 WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n return;\n }\n\n await sqlite.execute({\n sql: `INSERT INTO users\n (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, 0, 1, ?)`,\n args: [\n newId(\"usr\"),\n username,\n username.toLowerCase(),\n await hashPassword(password),\n Date.now(),\n ],\n });\n console.log(`Seeded admin account \"${username}\".`);\n}\n\nasync function pruneSessions(): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE expires_at < ?\",\n args: [Date.now()],\n });\n}\n\nexport type Row = Record;\n\nexport async function queryOne(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows.length ? (res.rows[0] as Row) : null;\n}\n\nexport async function queryAll(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows as Row[];\n}\n\nexport async function run(sql: string, args: any[] = []) {\n return await sqlite.execute({ sql, args });\n}\n",[],[161,347],"95f9c229-6fc1-4ddb-8a5f-ad327142a98d","crypto.ts","8d488cd0-b010-11f1-9715-1607ee4eb77e",["D",1789372056135],"/**\n * Password hashing and token helpers.\n *\n * Passwords are stored as PBKDF2-HMAC-SHA256 digests with a random\n * per-user salt. Nothing reversible ever touches the database.\n * Session tokens are stored as SHA-256 digests, so a database leak\n * does not hand over live sessions.\n */\n\nconst enc = new TextEncoder();\n\nconst PBKDF2_ITERATIONS = 120_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s);\n}\n\nfunction fromB64(s: string): Uint8Array {\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction toHex(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += b.toString(16).padStart(2, \"0\");\n return s;\n}\n\nasync function deriveBits(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Returns a self-describing string: pbkdf2$$$ */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await deriveBits(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const parts = stored.split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const salt = fromB64(parts[2]);\n const expected = fromB64(parts[3]);\n const actual = await deriveBits(password, salt, iterations);\n return timingSafeEqual(actual, expected);\n } catch {\n return false;\n }\n}\n\n/** Comparison whose duration does not depend on where the first mismatch is. */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** 256 bits of CSPRNG output, hex encoded. */\nexport function randomToken(): string {\n return toHex(crypto.getRandomValues(new Uint8Array(32)));\n}\n\nexport function newId(prefix: string): string {\n return prefix + \"_\" + toHex(crypto.getRandomValues(new Uint8Array(9)));\n}\n\nexport async function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", enc.encode(input));\n return toHex(new Uint8Array(digest));\n}\n",[],[161,356],"79233704-83fc-451a-a0f1-79fc7cce376c","auth.ts","a6009bbe-b010-11f1-9806-1607ee4eb77e",4,["D",1789372097607],"import type { Context, Next } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { queryOne, run, SESSION_TTL_MS } from \"./db.ts\";\nimport { randomToken, sha256Hex } from \"./crypto.ts\";\n\nexport const COOKIE_NAME = \"tl_session\";\n\n/** Failed logins lock the account briefly. Blunt, but it kills guessing. */\nexport const MAX_FAILED_ATTEMPTS = 8;\nexport const LOCKOUT_MS = 1000 * 60 * 10; // 10 minutes\n\nexport interface SessionUser {\n id: string;\n username: string;\n balance: number;\n is_admin: number;\n wins: number;\n losses: number;\n}\n\nexport async function createSession(c: Context, userId: string): Promise {\n const token = randomToken();\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n\n await run(\n `INSERT INTO sessions (token_hash, user_id, created_at, expires_at)\n VALUES (?, ?, ?, ?)`,\n [tokenHash, userId, now, now + SESSION_TTL_MS],\n );\n\n setCookie(c, COOKIE_NAME, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: Math.floor(SESSION_TTL_MS / 1000),\n });\n}\n\nexport async function destroySession(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (token) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [\n await sha256Hex(token),\n ]);\n }\n deleteCookie(c, COOKIE_NAME, { path: \"/\" });\n}\n\n/** Resolves the cookie to a user, or null. Expired sessions are swept. */\nexport async function currentUser(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (!token) return null;\n\n const tokenHash = await sha256Hex(token);\n const row = await queryOne(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, s.expires_at\n FROM sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n\n if (!row) return null;\n if (Number(row.expires_at) < Date.now()) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [tokenHash]);\n return null;\n }\n\n return {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n is_admin: Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n };\n}\n\nexport async function requireUser(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n c.set(\"user\", user);\n await next();\n}\n\nexport async function requireAdmin(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n if (!user.is_admin) return c.json({ error: \"Overseer clearance required.\" }, 403);\n c.set(\"user\", user);\n await next();\n}\n\n/**\n * Cross-site request guard. The session cookie is SameSite=Lax, which\n * already blocks cross-site POSTs, but browsers are not the only clients\n * and defence in depth is cheap.\n */\nexport async function sameOriginOnly(c: Context, next: Next) {\n const method = c.req.method.toUpperCase();\n if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n return await next();\n }\n const origin = c.req.header(\"origin\");\n if (origin) {\n try {\n if (new URL(origin).host !== new URL(c.req.url).host) {\n return c.json({ error: \"Cross-origin request refused.\" }, 403);\n }\n } catch {\n return c.json({ error: \"Malformed origin.\" }, 403);\n }\n }\n await next();\n}\n\nexport function isLockedOut(row: { locked_until?: any }): boolean {\n return Number(row.locked_until || 0) > Date.now();\n}\n\nexport async function recordFailedLogin(userId: string, attempts: number) {\n const next = attempts + 1;\n const lockUntil = next >= MAX_FAILED_ATTEMPTS ? Date.now() + LOCKOUT_MS : 0;\n await run(\n \"UPDATE users SET failed_attempts = ?, locked_until = ? WHERE id = ?\",\n [next >= MAX_FAILED_ATTEMPTS ? 0 : next, lockUntil, userId],\n );\n}\n\nexport async function clearFailedLogins(userId: string) {\n await run(\n \"UPDATE users SET failed_attempts = 0, locked_until = 0 WHERE id = ?\",\n [userId],\n );\n}\n",[],[161,363],"ad5fa2a8-a901-47c4-8980-eaa39d9b8f67","api.ts","d9426dd6-b010-11f1-9d52-1607ee4eb77e",103,["D",1789377452596],11,"import { Hono } from \"npm:hono\";\nimport {\n applyLevy,\n queryAll,\n queryOne,\n ready,\n run,\n SELLBACK_RATE,\n sqlite,\n STARTING_BALANCE,\n TAX_RATE,\n} from \"./db.ts\";\nimport { hashPassword, newId, verifyPassword } from \"./crypto.ts\";\nimport {\n clearFailedLogins,\n createSession,\n currentUser,\n destroySession,\n isLockedOut,\n recordFailedLogin,\n requireAdmin,\n requireUser,\n sameOriginOnly,\n type SessionUser,\n} from \"./auth.ts\";\n\nexport const api = new Hono();\n\napi.use(\"*\", async (c, next) => {\n await ready();\n await next();\n});\napi.use(\"*\", sameOriginOnly);\n\nconst USERNAME_RE = /^[A-Za-z0-9_-]{3,24}$/;\nconst MIN_PASSWORD = 8;\n\nfunction bad(c: any, msg: string, code = 400) {\n return c.json({ error: msg }, code);\n}\n\nasync function body(c: any): Promise> {\n try {\n const b = await c.req.json();\n return b && typeof b === \"object\" ? b : {};\n } catch {\n return {};\n }\n}\n\nfunction publicUser(u: SessionUser) {\n return {\n id: u.id,\n username: u.username,\n balance: u.balance,\n isAdmin: !!u.is_admin,\n wins: u.wins,\n losses: u.losses,\n };\n}\n\n/**\n * open - accepting stakes\n * resolving - the clock ran out; waiting on the Overseer to call it\n * resolved - paid out\n */\nfunction lifecycle(bet: any, now: number): string {\n if (bet.status === \"resolved\") return \"resolved\";\n if (Number(bet.closes_at) <= now) return \"resolving\";\n return \"open\";\n}\n\n// ─── auth ────────────────────────────────────────────────────────────\n\napi.post(\"/register\", async (c) => {\n const { username, password } = await body(c);\n\n if (typeof username !== \"string\" || !USERNAME_RE.test(username.trim())) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (typeof password !== \"string\" || password.length < MIN_PASSWORD) {\n return bad(c, `Passphrase must be at least ${MIN_PASSWORD} characters.`);\n }\n if (password.length > 200) return bad(c, \"Passphrase too long.\");\n\n const name = username.trim();\n const lower = name.toLowerCase();\n\n const clash = await queryOne(\"SELECT id FROM users WHERE username_lower = ?\", [lower]);\n if (clash) return bad(c, \"That handle is already registered.\", 409);\n\n const id = newId(\"usr\");\n try {\n await run(\n `INSERT INTO users (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, ?, 0, ?)`,\n [id, name, lower, await hashPassword(password), STARTING_BALANCE, Date.now()],\n );\n } catch {\n return bad(c, \"That handle is already registered.\", 409);\n }\n\n await createSession(c, id);\n return c.json({\n user: { id, username: name, balance: STARTING_BALANCE, isAdmin: false, wins: 0, losses: 0 },\n });\n});\n\napi.post(\"/login\", async (c) => {\n const { username, password } = await body(c);\n if (typeof username !== \"string\" || typeof password !== \"string\") {\n return bad(c, \"Handle and passphrase required.\");\n }\n\n const row = await queryOne(\n `SELECT id, username, password_hash, balance, is_admin, wins, losses,\n failed_attempts, locked_until\n FROM users WHERE username_lower = ?`,\n [username.trim().toLowerCase()],\n );\n\n const REJECT = \"Authentication rejected.\";\n\n if (!row) {\n await verifyPassword(password, \"pbkdf2$120000$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\");\n return bad(c, REJECT, 401);\n }\n if (isLockedOut(row)) {\n return bad(c, \"Too many failed attempts. Try again in a few minutes.\", 429);\n }\n\n const ok = await verifyPassword(password, String(row.password_hash));\n if (!ok) {\n await recordFailedLogin(String(row.id), Number(row.failed_attempts || 0));\n return bad(c, REJECT, 401);\n }\n\n await clearFailedLogins(String(row.id));\n await createSession(c, String(row.id));\n\n return c.json({\n user: {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n isAdmin: !!Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n },\n });\n});\n\napi.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.json({ ok: true });\n});\n\napi.get(\"/me\", async (c) => {\n const user = await currentUser(c);\n return c.json({ user: user ? publicUser(user) : null });\n});\n\n// ─── market ──────────────────────────────────────────────────────────\n\napi.get(\"/bets\", async (c) => {\n const user = await currentUser(c);\n const now = Date.now();\n\n const bets = await queryAll(\n `SELECT b.*,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = b.id AND w.status = 'pending'), 0) AS active_pool\n FROM bets b\n ORDER BY b.created_at DESC`,\n );\n\n const options = await queryAll(\n `SELECT o.id, o.bet_id, o.label, o.sort_order,\n COALESCE(SUM(CASE WHEN w.status = 'pending' THEN w.stake ELSE 0 END), 0) AS pool,\n COUNT(CASE WHEN w.status = 'pending' THEN 1 END) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id\n ORDER BY o.sort_order`,\n );\n\n const mine = user\n ? await queryAll(\n `SELECT id, bet_id, option_id, stake, tax, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY created_at DESC`,\n [user.id],\n )\n : [];\n\n const optsByBet: Record = {};\n for (const o of options) (optsByBet[String(o.bet_id)] ||= []).push(o);\n\n const mineByBet: Record = {};\n for (const w of mine) {\n (mineByBet[String(w.bet_id)] ||= []).push({\n id: w.id,\n optionId: w.option_id,\n stake: Number(w.stake),\n tax: Number(w.tax || 0),\n paid: Number(w.stake) + Number(w.tax || 0),\n status: w.status,\n payout: Number(w.payout),\n createdAt: Number(w.created_at),\n sellbackValue: Math.floor(Number(w.stake) * SELLBACK_RATE),\n });\n }\n\n return c.json({\n now,\n sellbackRate: SELLBACK_RATE,\n taxRate: TAX_RATE,\n bets: bets.map((b) => {\n const forfeited = Number(b.forfeited || 0);\n const totalPot = Number(b.active_pool || 0) + forfeited;\n const opts = (optsByBet[String(b.id)] || []).map((o) => {\n const pool = Number(o.pool);\n return {\n id: o.id,\n label: o.label,\n pool,\n backers: Number(o.backers),\n // Share of the pot currently sitting on this outcome. Doubles as\n // the market's implied probability.\n share: totalPot > 0 ? pool / totalPot : 0,\n // What one Gelt on this outcome would return if it won right now.\n payoutPerGelt: pool > 0 ? totalPot / pool : 0,\n };\n });\n return {\n id: b.id,\n title: b.title,\n description: b.description,\n status: lifecycle(b, now),\n closesAt: Number(b.closes_at),\n winningOptionId: b.winning_option_id,\n createdAt: Number(b.created_at),\n resolvedAt: b.resolved_at ? Number(b.resolved_at) : null,\n totalPot,\n forfeited,\n options: opts,\n myWagers: mineByBet[String(b.id)] || [],\n };\n }),\n });\n});\n\napi.get(\"/leaderboard\", async (c) => {\n const byWallet = await queryAll(\n `SELECT username, balance, wins, losses\n FROM users WHERE is_admin = 0\n ORDER BY balance DESC, wins DESC LIMIT 50`,\n );\n\n // Win rate, but only for people who have actually settled something.\n const byRatio = await queryAll(\n `SELECT username, balance, wins, losses,\n CAST(wins AS REAL) / (wins + losses) AS rate\n FROM users\n WHERE is_admin = 0 AND (wins + losses) > 0\n ORDER BY rate DESC, (wins + losses) DESC, balance DESC\n LIMIT 50`,\n );\n\n const shape = (r: any) => ({\n username: r.username,\n balance: Number(r.balance),\n wins: Number(r.wins),\n losses: Number(r.losses),\n rate: r.rate === undefined || r.rate === null ? null : Number(r.rate),\n });\n\n return c.json({ byWallet: byWallet.map(shape), byRatio: byRatio.map(shape) });\n});\n\n// ─── taking a position ───────────────────────────────────────────────\n\napi.post(\"/wagers\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const { betId, optionId, stake } = await body(c);\n\n const gross = Number(stake);\n if (!Number.isInteger(gross) || gross <= 0) {\n return bad(c, \"Stake must be a whole number above zero.\");\n }\n if (gross > 1_000_000_000) return bad(c, \"Stake too large.\");\n\n const option = await queryOne(\n `SELECT o.id, o.bet_id, b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ? AND o.bet_id = ?`,\n [String(optionId ?? \"\"), String(betId ?? \"\")],\n );\n if (!option) return bad(c, \"No such outcome.\", 404);\n if (option.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(option.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed and is awaiting resolution.\", 409);\n }\n\n // The levy comes out of the bid, so the wallet is debited the full\n // amount and only the remainder reaches the pot.\n const { tax, net } = applyLevy(gross);\n const now = Date.now();\n\n // Both statements test the same balance inside one transaction, so they\n // agree: either the bid is affordable and both apply, or neither does.\n const results = await sqlite.batch([\n {\n sql: `INSERT INTO wagers (id, user_id, bet_id, option_id, stake, tax, status, created_at)\n SELECT ?, ?, ?, ?, ?, ?, 'pending', ?\n WHERE (SELECT balance FROM users WHERE id = ?) >= ?`,\n args: [newId(\"wgr\"), user.id, String(option.bet_id), String(option.id),\n net, tax, now, user.id, gross],\n },\n {\n sql: \"UPDATE users SET balance = balance - ? WHERE id = ? AND balance >= ?\",\n args: [gross, user.id, gross],\n },\n ], \"write\");\n\n if (!results[1] || Number(results[1].rowsAffected) !== 1) {\n return bad(c, \"Insufficient Throne Gelt.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({\n ok: true,\n balance: Number(fresh?.balance ?? 0),\n paid: gross,\n levy: tax,\n intoPot: net,\n });\n});\n\n/**\n * Sell a position back to the house while the market is still open.\n *\n * In a parimutuel pool the fair value of a position is simply its stake:\n * the odds move to keep expected value flat, so there is no \"current price\"\n * to mark against. The exit therefore returns a flat 90% of the stake, and\n * the 10% stays in the pot for whoever is still holding at resolution.\n */\napi.post(\"/wagers/:id/sell\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const wagerId = c.req.param(\"id\");\n\n const w = await queryOne(\n `SELECT w.id, w.user_id, w.bet_id, w.stake, w.status, b.status AS bet_status, b.closes_at\n FROM wagers w JOIN bets b ON b.id = w.bet_id\n WHERE w.id = ?`,\n [wagerId],\n );\n if (!w) return bad(c, \"No such position.\", 404);\n if (String(w.user_id) !== user.id) return bad(c, \"That is not your position.\", 403);\n if (w.status !== \"pending\") return bad(c, \"That position is already settled.\", 409);\n if (w.bet_status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(w.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed. Positions can no longer be sold.\", 409);\n }\n\n const stake = Number(w.stake);\n const refund = Math.floor(stake * SELLBACK_RATE);\n const forfeit = stake - refund;\n const now = Date.now();\n\n // The first two statements are guarded on the wager still being pending,\n // and they run before the third flips it. A duplicate request therefore\n // changes nothing at all rather than paying out twice.\n const results = await sqlite.batch([\n {\n sql: `UPDATE users SET balance = balance + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [refund, user.id, wagerId],\n },\n {\n sql: `UPDATE bets SET forfeited = forfeited + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [forfeit, String(w.bet_id), wagerId],\n },\n {\n sql: `UPDATE wagers SET status = 'sold', payout = ?, settled_at = ?\n WHERE id = ? AND status = 'pending'`,\n args: [refund, now, wagerId],\n },\n ], \"write\");\n\n if (!results[2] || Number(results[2].rowsAffected) !== 1) {\n return bad(c, \"That position is already settled.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({ ok: true, refund, forfeit, balance: Number(fresh?.balance ?? 0) });\n});\n\n// ─── admin ───────────────────────────────────────────────────────────\n\napi.get(\"/admin/users\", requireAdmin, async (c) => {\n const rows = await queryAll(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, u.created_at,\n COALESCE((SELECT COUNT(*) FROM wagers w WHERE w.user_id = u.id), 0) AS wager_count,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.user_id = u.id AND w.status = 'pending'), 0) AS at_risk,\n COALESCE((SELECT SUM(w.tax) FROM wagers w WHERE w.user_id = u.id), 0) AS levied\n FROM users u\n ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(tax), 0) AS levy,\n COALESCE(SUM(stake), 0) AS staked,\n COUNT(*) AS wagers\n FROM wagers`,\n );\n\n return c.json({\n users: rows.map((r) => ({\n id: r.id,\n username: r.username,\n balance: Number(r.balance),\n isAdmin: !!Number(r.is_admin),\n wins: Number(r.wins),\n losses: Number(r.losses),\n wagerCount: Number(r.wager_count),\n atRisk: Number(r.at_risk),\n levied: Number(r.levied),\n createdAt: Number(r.created_at),\n })),\n treasury: {\n levyCollected: Number(totals?.levy ?? 0),\n totalStaked: Number(totals?.staked ?? 0),\n wagers: Number(totals?.wagers ?? 0),\n rate: TAX_RATE,\n },\n });\n});\n\n/** Title, description, outcome labels, duration. No odds: the pot sets those. */\napi.post(\"/admin/bets\", requireAdmin, async (c) => {\n const { title, description, options, durationMinutes } = await body(c);\n\n if (typeof title !== \"string\" || title.trim().length < 3) {\n return bad(c, \"Title must be at least 3 characters.\");\n }\n if (title.length > 200) return bad(c, \"Title too long.\");\n\n const desc = typeof description === \"string\" ? description.trim() : \"\";\n if (desc.length > 2000) return bad(c, \"Description too long.\");\n\n const mins = Number(durationMinutes);\n if (!Number.isFinite(mins) || mins < 1 || mins > 60 * 24 * 60) {\n return bad(c, \"Duration must be between 1 minute and 60 days.\");\n }\n\n if (!Array.isArray(options) || options.length < 2 || options.length > 8) {\n return bad(c, \"A market needs between 2 and 8 outcomes.\");\n }\n\n const labels: string[] = [];\n for (const o of options) {\n const label = (typeof o === \"string\" ? o : o?.label);\n const clean = typeof label === \"string\" ? label.trim() : \"\";\n if (!clean) return bad(c, \"Every outcome needs a label.\");\n if (clean.length > 120) return bad(c, \"Outcome label too long.\");\n if (labels.some((l) => l.toLowerCase() === clean.toLowerCase())) {\n return bad(c, \"Outcome labels must be distinct.\");\n }\n labels.push(clean);\n }\n\n const betId = newId(\"bet\");\n const now = Date.now();\n const closesAt = now + Math.round(mins * 60_000);\n\n const stmts = [{\n sql: `INSERT INTO bets (id, title, description, status, closes_at, forfeited, created_at)\n VALUES (?, ?, ?, 'open', ?, 0, ?)`,\n args: [betId, title.trim(), desc, closesAt, now],\n }];\n labels.forEach((label, i) => {\n stmts.push({\n sql: `INSERT INTO bet_options (id, bet_id, label, sort_order) VALUES (?, ?, ?, ?)`,\n args: [newId(\"opt\"), betId, label, i],\n });\n });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, betId, closesAt });\n});\n\n/** Force the market into resolving ahead of its deadline. */\napi.post(\"/admin/bets/:id/close\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [id]);\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"Already resolved.\", 409);\n\n await run(\"UPDATE bets SET closes_at = ? WHERE id = ?\", [Date.now(), id]);\n return c.json({ ok: true });\n});\n\n/**\n * Pay out the whole pot to backers of the winning outcome, split by each\n * backer's share of that outcome's pool. Losing stakes are not returned.\n *\n * Only legal once the market is closed, which means no new money can\n * arrive between reading the pool sizes and writing the payouts.\n */\napi.post(\"/admin/bets/:id/resolve\", requireAdmin, async (c) => {\n const betId = c.req.param(\"id\");\n const { winningOptionId } = await body(c);\n const optId = String(winningOptionId ?? \"\");\n const now = Date.now();\n\n const bet = await queryOne(\n \"SELECT id, status, closes_at, forfeited FROM bets WHERE id = ?\",\n [betId],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(bet.closes_at) > now) {\n return bad(c, \"This market is still open. Close it first.\", 409);\n }\n\n const option = await queryOne(\n \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n [optId, betId],\n );\n if (!option) return bad(c, \"That outcome does not belong to this market.\", 400);\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(stake), 0) AS active,\n COALESCE(SUM(CASE WHEN option_id = ? THEN stake ELSE 0 END), 0) AS win_pool\n FROM wagers WHERE bet_id = ? AND status = 'pending'`,\n [optId, betId],\n );\n const totalPot = Number(totals?.active ?? 0) + Number(bet.forfeited ?? 0);\n const winPool = Number(totals?.win_pool ?? 0);\n\n // If nobody backed the winning outcome, winPool is 0 and the general\n // path below handles it correctly on its own: the \"won\" update matches\n // no rows (so its divisor is never evaluated), every stake is marked\n // lost, and the pot is forfeit to the house. Back a long shot alone and\n // you take the lot; back nothing that lands and the Warrant keeps it.\n\n await sqlite.batch([\n // Each winner takes the pot in proportion to their share of the\n // winning pool. Truncated, so the pot can never be overdrawn.\n {\n sql: `UPDATE wagers\n SET status = 'won',\n payout = CAST((CAST(stake AS REAL) * ? / ?) AS INTEGER),\n settled_at = ?\n WHERE bet_id = ? AND option_id = ? AND status = 'pending'`,\n args: [totalPot, winPool, now, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'lost', payout = 0, settled_at = ?\n WHERE bet_id = ? AND option_id != ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE users\n SET balance = balance + COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0),\n wins = wins + COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [betId, betId, betId],\n },\n {\n sql: `UPDATE users\n SET losses = losses + (\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost')\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [betId, betId],\n },\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ? WHERE id = ?`,\n args: [optId, now, betId],\n },\n ], \"write\");\n\n const paid = await queryOne(\n `SELECT COUNT(*) AS n, COALESCE(SUM(payout), 0) AS total\n FROM wagers WHERE bet_id = ? AND status = 'won'`,\n [betId],\n );\n\n return c.json({\n ok: true,\n houseWins: winPool === 0,\n winnersPaid: Number(paid?.n ?? 0),\n totalPaid: Number(paid?.total ?? 0),\n totalPot,\n });\n});\n\n/** Immediate stipend to every non-admin account. */\napi.post(\"/admin/fund\", requireAdmin, async (c) => {\n const { amount } = await body(c);\n const value = Number(amount);\n if (!Number.isInteger(value) || value === 0) {\n return bad(c, \"Amount must be a non-zero whole number.\");\n }\n if (Math.abs(value) > 10_000_000) return bad(c, \"Amount too large.\");\n\n const res = await run(\n value > 0\n ? \"UPDATE users SET balance = balance + ? WHERE is_admin = 0\"\n : \"UPDATE users SET balance = MAX(0, balance + ?) WHERE is_admin = 0\",\n [value],\n );\n\n return c.json({ ok: true, accounts: Number(res.rowsAffected ?? 0), amount: value });\n});\n\n// ─── campaign map ────────────────────────────────────────────────────\n\n/** The live board, readable by anyone. */\napi.get(\"/campaign\", async (c) => {\n const row = await queryOne(\n \"SELECT round, save_code, created_at FROM campaign_rounds ORDER BY round DESC LIMIT 1\",\n );\n if (!row) return c.json({ round: null, saveCode: null });\n return c.json({\n round: Number(row.round),\n saveCode: String(row.save_code),\n createdAt: Number(row.created_at),\n });\n});\n\n/** Every snapshot, newest first. Used by the rollback picker. */\napi.get(\"/admin/campaign/history\", requireAdmin, async (c) => {\n const rows = await queryAll(\n \"SELECT round, note, created_at, LENGTH(save_code) AS size FROM campaign_rounds ORDER BY round DESC\",\n );\n return c.json({\n rounds: rows.map((r) => ({\n round: Number(r.round),\n note: r.note,\n createdAt: Number(r.created_at),\n size: Number(r.size),\n })),\n });\n});\n\n/** Publish a new board state. Replaces the snapshot for that round. */\napi.post(\"/admin/campaign\", requireAdmin, async (c) => {\n const { round, saveCode, note } = await body(c);\n const n = Number(round);\n\n if (!Number.isInteger(n) || n < 0 || n > 100000) {\n return bad(c, \"Round must be a whole number.\");\n }\n if (typeof saveCode !== \"string\" || saveCode.length < 16) {\n return bad(c, \"Missing or malformed save code.\");\n }\n if (saveCode.length > 2_000_000) return bad(c, \"Save code too large.\");\n if (!/^[A-Za-z0-9+/=]+$/.test(saveCode)) return bad(c, \"Save code must be base64.\");\n\n await run(\n `INSERT INTO campaign_rounds (round, save_code, note, created_at)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(round) DO UPDATE SET save_code = excluded.save_code,\n note = excluded.note,\n created_at = excluded.created_at`,\n [n, saveCode, typeof note === \"string\" ? note.slice(0, 200) : \"\", Date.now()],\n );\n\n return c.json({ ok: true, round: n });\n});\n\n/**\n * Roll the board back to an earlier round. Everything after it is\n * discarded, so the next advance replays from there.\n */\napi.post(\"/admin/campaign/rollback\", requireAdmin, async (c) => {\n const { round } = await body(c);\n const n = Number(round);\n if (!Number.isInteger(n) || n < 0) return bad(c, \"Round must be a whole number.\");\n\n const target = await queryOne(\n \"SELECT round, save_code FROM campaign_rounds WHERE round = ?\",\n [n],\n );\n if (!target) return bad(c, \"No snapshot for that round.\", 404);\n\n const res = await run(\"DELETE FROM campaign_rounds WHERE round > ?\", [n]);\n return c.json({\n ok: true,\n round: n,\n discarded: Number(res.rowsAffected ?? 0),\n saveCode: String(target.save_code),\n });\n});\n\n/** Wipe the board entirely so a fresh campaign can be generated. */\napi.delete(\"/admin/campaign\", requireAdmin, async (c) => {\n const res = await run(\"DELETE FROM campaign_rounds\");\n return c.json({ ok: true, discarded: Number(res.rowsAffected ?? 0) });\n});\n\n/**\n * Remove a market entirely.\n *\n * Open or resolving markets always refund their pending stakes, because\n * those positions never settled and the Gelt is still owed.\n *\n * For a resolved market, ?reverse=1 undoes the settlement as well:\n * winnings are clawed back, every stake is returned, and the win/loss\n * counters are decremented. Without it the market simply disappears from\n * the archive and whatever was paid out stays paid.\n */\napi.delete(\"/admin/bets/:id\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const reverse = c.req.query(\"reverse\") === \"1\";\n\n const bet = await queryOne(\n \"SELECT id, title, status FROM bets WHERE id = ?\",\n [id],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n\n const resolved = bet.status === \"resolved\";\n const undo = resolved && reverse;\n\n // What was staked and paid, recorded before anything is deleted.\n const tally = await queryOne(\n `SELECT COUNT(*) AS n,\n COALESCE(SUM(CASE WHEN status != 'sold' THEN stake + tax ELSE 0 END), 0) AS staked,\n COALESCE(SUM(CASE WHEN status = 'won' THEN payout ELSE 0 END), 0) AS paid,\n COALESCE(SUM(tax), 0) AS levied\n FROM wagers WHERE bet_id = ?`,\n [id],\n );\n\n const stmts: { sql: string; args: any[] }[] = [];\n\n if (!resolved) {\n // Never settled: hand back the full amount paid, levy included.\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'pending')`,\n args: [id, id],\n });\n } else if (undo) {\n // Return everything paid in, levy included, on positions that weren't\n // voluntarily sold out of...\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status IN ('won','lost')), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status IN ('won','lost'))`,\n args: [id, id],\n });\n // ...then take back the winnings that were paid on top.\n stmts.push({\n sql: `UPDATE users SET balance = MAX(0, balance - COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET wins = MAX(0, wins - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET losses = MAX(0, losses - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [id, id],\n });\n }\n\n stmts.push({ sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bets WHERE id = ?\", args: [id] });\n\n await sqlite.batch(stmts, \"write\");\n\n return c.json({\n ok: true,\n deleted: bet.title,\n wasResolved: resolved,\n reversed: undo,\n wagers: Number(tally?.n ?? 0),\n stakeReturned: (!resolved || undo) ? Number(tally?.staked ?? 0) : 0,\n winningsClawedBack: undo ? Number(tally?.paid ?? 0) : 0,\n levyRefunded: (!resolved || undo) ? Number(tally?.levied ?? 0) : 0,\n });\n});\n\napi.delete(\"/admin/users/:id\", requireAdmin, async (c) => {\n const actor = c.get(\"user\") as SessionUser;\n const id = c.req.param(\"id\");\n\n const target = await queryOne(\n \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n [id],\n );\n if (!target) return bad(c, \"No such account.\", 404);\n if (String(target.id) === actor.id) return bad(c, \"You cannot delete your own account.\", 400);\n if (Number(target.is_admin)) return bad(c, \"Overseer accounts cannot be deleted here.\", 400);\n\n // Open positions leave the pot with them; the stake is not refunded to\n // anyone, so fold it into forfeited to keep each pot's arithmetic honest.\n await sqlite.batch([\n {\n sql: `UPDATE bets SET forfeited = forfeited + COALESCE((\n SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = bets.id AND w.user_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT bet_id FROM wagers WHERE user_id = ? AND status = 'pending')`,\n args: [id, id],\n },\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [id] },\n ], \"write\");\n\n return c.json({ ok: true, deleted: target.username });\n});\n",[],[161,371],["D",1789372056135],[178,179,180,181,182,183],[161],["D",1789371999223],["D",1789459281818],{"_101":100,"_109":105},{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"ctx",{"_83":-5,"_129":420,"_421":422,"_423":424,"_425":25,"_426":25,"_427":25,"_428":60,"_429":-5,"_430":-7,"_431":-7,"_432":64,"_433":25,"_434":25,"_435":-5,"_436":25,"_437":25,"_438":25,"_439":-5},"ENV",{"_391":392,"_393":394,"_395":91,"_396":397,"_398":399,"_400":401,"_402":403,"_404":405,"_406":407,"_408":409,"_410":411,"_412":413,"_414":415,"_416":417,"_418":419},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Operative Authentication

Diff · v120