[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_387":388,"_389":390},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_110":91,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":-5,"_123":-5,"_124":25,"_125":126,"_127":60,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",122,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","lib/api.ts","latestPath","fileId","d9426dd6-b010-11f1-9d52-1607ee4eb77e","name","api.ts","fileType","script","content","import { Hono } from \"npm:hono\";\nimport {\n applyLevy,\n queryAll,\n queryOne,\n ready,\n run,\n SELLBACK_RATE,\n sqlite,\n STARTING_BALANCE,\n TAX_RATE,\n} from \"./db.ts\";\nimport { hashPassword, newId, verifyPassword } from \"./crypto.ts\";\nimport {\n clearFailedLogins,\n createSession,\n currentUser,\n destroySession,\n isLockedOut,\n recordFailedLogin,\n requireAdmin,\n requireUser,\n sameOriginOnly,\n type SessionUser,\n} from \"./auth.ts\";\n\nexport const api = new Hono();\n\napi.use(\"*\", async (c, next) => {\n await ready();\n await next();\n});\napi.use(\"*\", sameOriginOnly);\n\nconst USERNAME_RE = /^[A-Za-z0-9_-]{3,24}$/;\nconst MIN_PASSWORD = 8;\n\nfunction bad(c: any, msg: string, code = 400) {\n return c.json({ error: msg }, code);\n}\n\nasync function body(c: any): Promise> {\n try {\n const b = await c.req.json();\n return b && typeof b === \"object\" ? b : {};\n } catch {\n return {};\n }\n}\n\nfunction publicUser(u: SessionUser) {\n return {\n id: u.id,\n username: u.username,\n balance: u.balance,\n isAdmin: !!u.is_admin,\n wins: u.wins,\n losses: u.losses,\n };\n}\n\n/**\n * open - accepting stakes\n * resolving - the clock ran out; waiting on the Overseer to call it\n * resolved - paid out\n */\nfunction lifecycle(bet: any, now: number): string {\n if (bet.status === \"resolved\") return \"resolved\";\n if (Number(bet.closes_at) <= now) return \"resolving\";\n return \"open\";\n}\n\n// ─── auth ────────────────────────────────────────────────────────────\n\napi.post(\"/register\", async (c) => {\n const { username, password } = await body(c);\n\n if (typeof username !== \"string\" || !USERNAME_RE.test(username.trim())) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (typeof password !== \"string\" || password.length < MIN_PASSWORD) {\n return bad(c, `Passphrase must be at least ${MIN_PASSWORD} characters.`);\n }\n if (password.length > 200) return bad(c, \"Passphrase too long.\");\n\n const name = username.trim();\n const lower = name.toLowerCase();\n\n const clash = await queryOne(\"SELECT id FROM users WHERE username_lower = ?\", [lower]);\n if (clash) return bad(c, \"That handle is already registered.\", 409);\n\n const id = newId(\"usr\");\n try {\n await run(\n `INSERT INTO users (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, ?, 0, ?)`,\n [id, name, lower, await hashPassword(password), STARTING_BALANCE, Date.now()],\n );\n } catch {\n return bad(c, \"That handle is already registered.\", 409);\n }\n\n await createSession(c, id);\n return c.json({\n user: { id, username: name, balance: STARTING_BALANCE, isAdmin: false, wins: 0, losses: 0 },\n });\n});\n\napi.post(\"/login\", async (c) => {\n const { username, password } = await body(c);\n if (typeof username !== \"string\" || typeof password !== \"string\") {\n return bad(c, \"Handle and passphrase required.\");\n }\n\n const row = await queryOne(\n `SELECT id, username, password_hash, balance, is_admin, wins, losses,\n failed_attempts, locked_until\n FROM users WHERE username_lower = ?`,\n [username.trim().toLowerCase()],\n );\n\n const REJECT = \"Authentication rejected.\";\n\n if (!row) {\n await verifyPassword(password, \"pbkdf2$120000$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\");\n return bad(c, REJECT, 401);\n }\n if (isLockedOut(row)) {\n return bad(c, \"Too many failed attempts. Try again in a few minutes.\", 429);\n }\n\n const ok = await verifyPassword(password, String(row.password_hash));\n if (!ok) {\n await recordFailedLogin(String(row.id), Number(row.failed_attempts || 0));\n return bad(c, REJECT, 401);\n }\n\n await clearFailedLogins(String(row.id));\n await createSession(c, String(row.id));\n\n return c.json({\n user: {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n isAdmin: !!Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n },\n });\n});\n\napi.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.json({ ok: true });\n});\n\napi.get(\"/me\", async (c) => {\n const user = await currentUser(c);\n return c.json({ user: user ? publicUser(user) : null });\n});\n\n// ─── market ──────────────────────────────────────────────────────────\n\napi.get(\"/bets\", async (c) => {\n const user = await currentUser(c);\n const now = Date.now();\n\n const bets = await queryAll(\n `SELECT b.*,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = b.id AND w.status = 'pending'), 0) AS active_pool\n FROM bets b\n ORDER BY b.created_at DESC`,\n );\n\n const options = await queryAll(\n `SELECT o.id, o.bet_id, o.label, o.sort_order,\n COALESCE(SUM(CASE WHEN w.status = 'pending' THEN w.stake ELSE 0 END), 0) AS pool,\n COUNT(CASE WHEN w.status = 'pending' THEN 1 END) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id\n ORDER BY o.sort_order`,\n );\n\n const mine = user\n ? await queryAll(\n `SELECT id, bet_id, option_id, stake, tax, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY created_at DESC`,\n [user.id],\n )\n : [];\n\n const optsByBet: Record = {};\n for (const o of options) (optsByBet[String(o.bet_id)] ||= []).push(o);\n\n const mineByBet: Record = {};\n for (const w of mine) {\n (mineByBet[String(w.bet_id)] ||= []).push({\n id: w.id,\n optionId: w.option_id,\n stake: Number(w.stake),\n tax: Number(w.tax || 0),\n paid: Number(w.stake) + Number(w.tax || 0),\n status: w.status,\n payout: Number(w.payout),\n createdAt: Number(w.created_at),\n sellbackValue: Math.floor(Number(w.stake) * SELLBACK_RATE),\n });\n }\n\n return c.json({\n now,\n sellbackRate: SELLBACK_RATE,\n taxRate: TAX_RATE,\n bets: bets.map((b) => {\n const forfeited = Number(b.forfeited || 0);\n const totalPot = Number(b.active_pool || 0) + forfeited;\n const opts = (optsByBet[String(b.id)] || []).map((o) => {\n const pool = Number(o.pool);\n return {\n id: o.id,\n label: o.label,\n pool,\n backers: Number(o.backers),\n // Share of the pot currently sitting on this outcome. Doubles as\n // the market's implied probability.\n share: totalPot > 0 ? pool / totalPot : 0,\n // What one Gelt on this outcome would return if it won right now.\n payoutPerGelt: pool > 0 ? totalPot / pool : 0,\n };\n });\n return {\n id: b.id,\n title: b.title,\n description: b.description,\n status: lifecycle(b, now),\n closesAt: Number(b.closes_at),\n winningOptionId: b.winning_option_id,\n createdAt: Number(b.created_at),\n resolvedAt: b.resolved_at ? Number(b.resolved_at) : null,\n totalPot,\n forfeited,\n options: opts,\n myWagers: mineByBet[String(b.id)] || [],\n };\n }),\n });\n});\n\napi.get(\"/leaderboard\", async (c) => {\n const byWallet = await queryAll(\n `SELECT username, balance, wins, losses\n FROM users WHERE is_admin = 0\n ORDER BY balance DESC, wins DESC LIMIT 50`,\n );\n\n // Win rate, but only for people who have actually settled something.\n const byRatio = await queryAll(\n `SELECT username, balance, wins, losses,\n CAST(wins AS REAL) / (wins + losses) AS rate\n FROM users\n WHERE is_admin = 0 AND (wins + losses) > 0\n ORDER BY rate DESC, (wins + losses) DESC, balance DESC\n LIMIT 50`,\n );\n\n const shape = (r: any) => ({\n username: r.username,\n balance: Number(r.balance),\n wins: Number(r.wins),\n losses: Number(r.losses),\n rate: r.rate === undefined || r.rate === null ? null : Number(r.rate),\n });\n\n return c.json({ byWallet: byWallet.map(shape), byRatio: byRatio.map(shape) });\n});\n\n// ─── taking a position ───────────────────────────────────────────────\n\napi.post(\"/wagers\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const { betId, optionId, stake } = await body(c);\n\n const gross = Number(stake);\n if (!Number.isInteger(gross) || gross <= 0) {\n return bad(c, \"Stake must be a whole number above zero.\");\n }\n if (gross > 1_000_000_000) return bad(c, \"Stake too large.\");\n\n const option = await queryOne(\n `SELECT o.id, o.bet_id, b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ? AND o.bet_id = ?`,\n [String(optionId ?? \"\"), String(betId ?? \"\")],\n );\n if (!option) return bad(c, \"No such outcome.\", 404);\n if (option.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(option.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed and is awaiting resolution.\", 409);\n }\n\n // The levy comes out of the bid, so the wallet is debited the full\n // amount and only the remainder reaches the pot.\n const { tax, net } = applyLevy(gross);\n const now = Date.now();\n\n // Both statements test the same balance inside one transaction, so they\n // agree: either the bid is affordable and both apply, or neither does.\n const results = await sqlite.batch([\n {\n sql: `INSERT INTO wagers (id, user_id, bet_id, option_id, stake, tax, status, created_at)\n SELECT ?, ?, ?, ?, ?, ?, 'pending', ?\n WHERE (SELECT balance FROM users WHERE id = ?) >= ?`,\n args: [newId(\"wgr\"), user.id, String(option.bet_id), String(option.id),\n net, tax, now, user.id, gross],\n },\n {\n sql: \"UPDATE users SET balance = balance - ? WHERE id = ? AND balance >= ?\",\n args: [gross, user.id, gross],\n },\n ], \"write\");\n\n if (!results[1] || Number(results[1].rowsAffected) !== 1) {\n return bad(c, \"Insufficient Throne Gelt.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({\n ok: true,\n balance: Number(fresh?.balance ?? 0),\n paid: gross,\n levy: tax,\n intoPot: net,\n });\n});\n\n/**\n * Sell a position back to the house while the market is still open.\n *\n * In a parimutuel pool the fair value of a position is simply its stake:\n * the odds move to keep expected value flat, so there is no \"current price\"\n * to mark against. The exit therefore returns a flat 90% of the stake, and\n * the 10% stays in the pot for whoever is still holding at resolution.\n */\napi.post(\"/wagers/:id/sell\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const wagerId = c.req.param(\"id\");\n\n const w = await queryOne(\n `SELECT w.id, w.user_id, w.bet_id, w.stake, w.status, b.status AS bet_status, b.closes_at\n FROM wagers w JOIN bets b ON b.id = w.bet_id\n WHERE w.id = ?`,\n [wagerId],\n );\n if (!w) return bad(c, \"No such position.\", 404);\n if (String(w.user_id) !== user.id) return bad(c, \"That is not your position.\", 403);\n if (w.status !== \"pending\") return bad(c, \"That position is already settled.\", 409);\n if (w.bet_status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(w.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed. Positions can no longer be sold.\", 409);\n }\n\n const stake = Number(w.stake);\n const refund = Math.floor(stake * SELLBACK_RATE);\n const forfeit = stake - refund;\n const now = Date.now();\n\n // The first two statements are guarded on the wager still being pending,\n // and they run before the third flips it. A duplicate request therefore\n // changes nothing at all rather than paying out twice.\n const results = await sqlite.batch([\n {\n sql: `UPDATE users SET balance = balance + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [refund, user.id, wagerId],\n },\n {\n sql: `UPDATE bets SET forfeited = forfeited + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [forfeit, String(w.bet_id), wagerId],\n },\n {\n sql: `UPDATE wagers SET status = 'sold', payout = ?, settled_at = ?\n WHERE id = ? AND status = 'pending'`,\n args: [refund, now, wagerId],\n },\n ], \"write\");\n\n if (!results[2] || Number(results[2].rowsAffected) !== 1) {\n return bad(c, \"That position is already settled.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({ ok: true, refund, forfeit, balance: Number(fresh?.balance ?? 0) });\n});\n\n// ─── admin ───────────────────────────────────────────────────────────\n\napi.get(\"/admin/users\", requireAdmin, async (c) => {\n const rows = await queryAll(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, u.created_at,\n COALESCE((SELECT COUNT(*) FROM wagers w WHERE w.user_id = u.id), 0) AS wager_count,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.user_id = u.id AND w.status = 'pending'), 0) AS at_risk,\n COALESCE((SELECT SUM(w.tax) FROM wagers w WHERE w.user_id = u.id), 0) AS levied\n FROM users u\n ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(tax), 0) AS levy,\n COALESCE(SUM(stake), 0) AS staked,\n COUNT(*) AS wagers\n FROM wagers`,\n );\n\n return c.json({\n users: rows.map((r) => ({\n id: r.id,\n username: r.username,\n balance: Number(r.balance),\n isAdmin: !!Number(r.is_admin),\n wins: Number(r.wins),\n losses: Number(r.losses),\n wagerCount: Number(r.wager_count),\n atRisk: Number(r.at_risk),\n levied: Number(r.levied),\n createdAt: Number(r.created_at),\n })),\n treasury: {\n levyCollected: Number(totals?.levy ?? 0),\n totalStaked: Number(totals?.staked ?? 0),\n wagers: Number(totals?.wagers ?? 0),\n rate: TAX_RATE,\n },\n });\n});\n\n/** Title, description, outcome labels, duration. No odds: the pot sets those. */\napi.post(\"/admin/bets\", requireAdmin, async (c) => {\n const { title, description, options, durationMinutes } = await body(c);\n\n if (typeof title !== \"string\" || title.trim().length < 3) {\n return bad(c, \"Title must be at least 3 characters.\");\n }\n if (title.length > 200) return bad(c, \"Title too long.\");\n\n const desc = typeof description === \"string\" ? description.trim() : \"\";\n if (desc.length > 2000) return bad(c, \"Description too long.\");\n\n const mins = Number(durationMinutes);\n if (!Number.isFinite(mins) || mins < 1 || mins > 60 * 24 * 60) {\n return bad(c, \"Duration must be between 1 minute and 60 days.\");\n }\n\n if (!Array.isArray(options) || options.length < 2 || options.length > 8) {\n return bad(c, \"A market needs between 2 and 8 outcomes.\");\n }\n\n const labels: string[] = [];\n for (const o of options) {\n const label = (typeof o === \"string\" ? o : o?.label);\n const clean = typeof label === \"string\" ? label.trim() : \"\";\n if (!clean) return bad(c, \"Every outcome needs a label.\");\n if (clean.length > 120) return bad(c, \"Outcome label too long.\");\n if (labels.some((l) => l.toLowerCase() === clean.toLowerCase())) {\n return bad(c, \"Outcome labels must be distinct.\");\n }\n labels.push(clean);\n }\n\n const betId = newId(\"bet\");\n const now = Date.now();\n const closesAt = now + Math.round(mins * 60_000);\n\n const stmts = [{\n sql: `INSERT INTO bets (id, title, description, status, closes_at, forfeited, created_at)\n VALUES (?, ?, ?, 'open', ?, 0, ?)`,\n args: [betId, title.trim(), desc, closesAt, now],\n }];\n labels.forEach((label, i) => {\n stmts.push({\n sql: `INSERT INTO bet_options (id, bet_id, label, sort_order) VALUES (?, ?, ?, ?)`,\n args: [newId(\"opt\"), betId, label, i],\n });\n });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, betId, closesAt });\n});\n\n/** Force the market into resolving ahead of its deadline. */\napi.post(\"/admin/bets/:id/close\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [id]);\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"Already resolved.\", 409);\n\n await run(\"UPDATE bets SET closes_at = ? WHERE id = ?\", [Date.now(), id]);\n return c.json({ ok: true });\n});\n\n/**\n * Pay out the whole pot to backers of the winning outcome, split by each\n * backer's share of that outcome's pool. Losing stakes are not returned.\n *\n * Only legal once the market is closed, which means no new money can\n * arrive between reading the pool sizes and writing the payouts.\n */\napi.post(\"/admin/bets/:id/resolve\", requireAdmin, async (c) => {\n const betId = c.req.param(\"id\");\n const { winningOptionId } = await body(c);\n const optId = String(winningOptionId ?? \"\");\n const now = Date.now();\n\n const bet = await queryOne(\n \"SELECT id, status, closes_at, forfeited FROM bets WHERE id = ?\",\n [betId],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(bet.closes_at) > now) {\n return bad(c, \"This market is still open. Close it first.\", 409);\n }\n\n const option = await queryOne(\n \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n [optId, betId],\n );\n if (!option) return bad(c, \"That outcome does not belong to this market.\", 400);\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(stake), 0) AS active,\n COALESCE(SUM(CASE WHEN option_id = ? THEN stake ELSE 0 END), 0) AS win_pool\n FROM wagers WHERE bet_id = ? AND status = 'pending'`,\n [optId, betId],\n );\n const totalPot = Number(totals?.active ?? 0) + Number(bet.forfeited ?? 0);\n const winPool = Number(totals?.win_pool ?? 0);\n\n // If nobody backed the winning outcome, winPool is 0 and the general\n // path below handles it correctly on its own: the \"won\" update matches\n // no rows (so its divisor is never evaluated), every stake is marked\n // lost, and the pot is forfeit to the house. Back a long shot alone and\n // you take the lot; back nothing that lands and the Warrant keeps it.\n\n await sqlite.batch([\n // Each winner takes the pot in proportion to their share of the\n // winning pool. Truncated, so the pot can never be overdrawn.\n {\n sql: `UPDATE wagers\n SET status = 'won',\n payout = CAST((CAST(stake AS REAL) * ? / ?) AS INTEGER),\n settled_at = ?\n WHERE bet_id = ? AND option_id = ? AND status = 'pending'`,\n args: [totalPot, winPool, now, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'lost', payout = 0, settled_at = ?\n WHERE bet_id = ? AND option_id != ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE users\n SET balance = balance + COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0),\n wins = wins + COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [betId, betId, betId],\n },\n {\n sql: `UPDATE users\n SET losses = losses + (\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost')\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [betId, betId],\n },\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ? WHERE id = ?`,\n args: [optId, now, betId],\n },\n ], \"write\");\n\n const paid = await queryOne(\n `SELECT COUNT(*) AS n, COALESCE(SUM(payout), 0) AS total\n FROM wagers WHERE bet_id = ? AND status = 'won'`,\n [betId],\n );\n\n return c.json({\n ok: true,\n houseWins: winPool === 0,\n winnersPaid: Number(paid?.n ?? 0),\n totalPaid: Number(paid?.total ?? 0),\n totalPot,\n });\n});\n\n/** Immediate stipend to every non-admin account. */\napi.post(\"/admin/fund\", requireAdmin, async (c) => {\n const { amount } = await body(c);\n const value = Number(amount);\n if (!Number.isInteger(value) || value === 0) {\n return bad(c, \"Amount must be a non-zero whole number.\");\n }\n if (Math.abs(value) > 10_000_000) return bad(c, \"Amount too large.\");\n\n const res = await run(\n value > 0\n ? \"UPDATE users SET balance = balance + ? WHERE is_admin = 0\"\n : \"UPDATE users SET balance = MAX(0, balance + ?) WHERE is_admin = 0\",\n [value],\n );\n\n return c.json({ ok: true, accounts: Number(res.rowsAffected ?? 0), amount: value });\n});\n\n// ─── campaign map ────────────────────────────────────────────────────\n\n/** The live board, readable by anyone. */\napi.get(\"/campaign\", async (c) => {\n const row = await queryOne(\n \"SELECT round, save_code, created_at FROM campaign_rounds ORDER BY round DESC LIMIT 1\",\n );\n if (!row) return c.json({ round: null, saveCode: null });\n return c.json({\n round: Number(row.round),\n saveCode: String(row.save_code),\n createdAt: Number(row.created_at),\n });\n});\n\n/** Every snapshot, newest first. Used by the rollback picker. */\napi.get(\"/admin/campaign/history\", requireAdmin, async (c) => {\n const rows = await queryAll(\n \"SELECT round, note, created_at, LENGTH(save_code) AS size FROM campaign_rounds ORDER BY round DESC\",\n );\n return c.json({\n rounds: rows.map((r) => ({\n round: Number(r.round),\n note: r.note,\n createdAt: Number(r.created_at),\n size: Number(r.size),\n })),\n });\n});\n\n/** Publish a new board state. Replaces the snapshot for that round. */\napi.post(\"/admin/campaign\", requireAdmin, async (c) => {\n const { round, saveCode, note } = await body(c);\n const n = Number(round);\n\n if (!Number.isInteger(n) || n < 0 || n > 100000) {\n return bad(c, \"Round must be a whole number.\");\n }\n if (typeof saveCode !== \"string\" || saveCode.length < 16) {\n return bad(c, \"Missing or malformed save code.\");\n }\n if (saveCode.length > 2_000_000) return bad(c, \"Save code too large.\");\n if (!/^[A-Za-z0-9+/=]+$/.test(saveCode)) return bad(c, \"Save code must be base64.\");\n\n await run(\n `INSERT INTO campaign_rounds (round, save_code, note, created_at)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(round) DO UPDATE SET save_code = excluded.save_code,\n note = excluded.note,\n created_at = excluded.created_at`,\n [n, saveCode, typeof note === \"string\" ? note.slice(0, 200) : \"\", Date.now()],\n );\n\n return c.json({ ok: true, round: n });\n});\n\n/**\n * Roll the board back to an earlier round. Everything after it is\n * discarded, so the next advance replays from there.\n */\napi.post(\"/admin/campaign/rollback\", requireAdmin, async (c) => {\n const { round } = await body(c);\n const n = Number(round);\n if (!Number.isInteger(n) || n < 0) return bad(c, \"Round must be a whole number.\");\n\n const target = await queryOne(\n \"SELECT round, save_code FROM campaign_rounds WHERE round = ?\",\n [n],\n );\n if (!target) return bad(c, \"No snapshot for that round.\", 404);\n\n const res = await run(\"DELETE FROM campaign_rounds WHERE round > ?\", [n]);\n return c.json({\n ok: true,\n round: n,\n discarded: Number(res.rowsAffected ?? 0),\n saveCode: String(target.save_code),\n });\n});\n\n/** Wipe the board entirely so a fresh campaign can be generated. */\napi.delete(\"/admin/campaign\", requireAdmin, async (c) => {\n const res = await run(\"DELETE FROM campaign_rounds\");\n return c.json({ ok: true, discarded: Number(res.rowsAffected ?? 0) });\n});\n\n/**\n * Remove a market entirely.\n *\n * Open or resolving markets always refund their pending stakes, because\n * those positions never settled and the Gelt is still owed.\n *\n * For a resolved market, ?reverse=1 undoes the settlement as well:\n * winnings are clawed back, every stake is returned, and the win/loss\n * counters are decremented. Without it the market simply disappears from\n * the archive and whatever was paid out stays paid.\n */\napi.delete(\"/admin/bets/:id\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const reverse = c.req.query(\"reverse\") === \"1\";\n\n const bet = await queryOne(\n \"SELECT id, title, status FROM bets WHERE id = ?\",\n [id],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n\n const resolved = bet.status === \"resolved\";\n const undo = resolved && reverse;\n\n // What was staked and paid, recorded before anything is deleted.\n const tally = await queryOne(\n `SELECT COUNT(*) AS n,\n COALESCE(SUM(CASE WHEN status != 'sold' THEN stake + tax ELSE 0 END), 0) AS staked,\n COALESCE(SUM(CASE WHEN status = 'won' THEN payout ELSE 0 END), 0) AS paid,\n COALESCE(SUM(tax), 0) AS levied\n FROM wagers WHERE bet_id = ?`,\n [id],\n );\n\n const stmts: { sql: string; args: any[] }[] = [];\n\n if (!resolved) {\n // Never settled: hand back the full amount paid, levy included.\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'pending')`,\n args: [id, id],\n });\n } else if (undo) {\n // Return everything paid in, levy included, on positions that weren't\n // voluntarily sold out of...\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status IN ('won','lost')), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status IN ('won','lost'))`,\n args: [id, id],\n });\n // ...then take back the winnings that were paid on top.\n stmts.push({\n sql: `UPDATE users SET balance = MAX(0, balance - COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET wins = MAX(0, wins - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET losses = MAX(0, losses - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [id, id],\n });\n }\n\n stmts.push({ sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bets WHERE id = ?\", args: [id] });\n\n await sqlite.batch(stmts, \"write\");\n\n return c.json({\n ok: true,\n deleted: bet.title,\n wasResolved: resolved,\n reversed: undo,\n wagers: Number(tally?.n ?? 0),\n stakeReturned: (!resolved || undo) ? Number(tally?.staked ?? 0) : 0,\n winningsClawedBack: undo ? Number(tally?.paid ?? 0) : 0,\n levyRefunded: (!resolved || undo) ? Number(tally?.levied ?? 0) : 0,\n });\n});\n\napi.delete(\"/admin/users/:id\", requireAdmin, async (c) => {\n const actor = c.get(\"user\") as SessionUser;\n const id = c.req.param(\"id\");\n\n const target = await queryOne(\n \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n [id],\n );\n if (!target) return bad(c, \"No such account.\", 404);\n if (String(target.id) === actor.id) return bad(c, \"You cannot delete your own account.\", 400);\n if (Number(target.is_admin)) return bad(c, \"Overseer accounts cannot be deleted here.\", 400);\n\n // Open positions leave the pot with them; the stake is not refunded to\n // anyone, so fold it into forfeited to keep each pot's arithmetic honest.\n await sqlite.batch([\n {\n sql: `UPDATE bets SET forfeited = forfeited + COALESCE((\n SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = bets.id AND w.user_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT bet_id FROM wagers WHERE user_id = ? AND status = 'pending')`,\n args: [id, id],\n },\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [id] },\n ], \"write\");\n\n return c.json({ ok: true, deleted: target.username });\n});\n","import { Hono } from \"npm:hono\";\nimport {\n applyLevy,\n queryAll,\n queryOne,\n ready,\n run,\n SELLBACK_RATE,\n sqlite,\n STARTING_BALANCE,\n TAX_RATE,\n} from \"./db.ts\";\nimport { hashPassword, newId, verifyPassword } from \"./crypto.ts\";\nimport {\n clearFailedLogins,\n createSession,\n currentUser,\n destroySession,\n isLockedOut,\n recordFailedLogin,\n requireAdmin,\n requireUser,\n sameOriginOnly,\n type SessionUser,\n} from \"./auth.ts\";\n\nexport const api = new Hono();\n\napi.use(\"*\", async (c, next) => {\n await ready();\n await next();\n});\napi.use(\"*\", sameOriginOnly);\n\nconst USERNAME_RE = /^[A-Za-z0-9_-]{3,24}$/;\nconst MIN_PASSWORD = 8;\n\nfunction bad(c: any, msg: string, code = 400) {\n return c.json({ error: msg }, code);\n}\n\nasync function body(c: any): Promise> {\n try {\n const b = await c.req.json();\n return b && typeof b === \"object\" ? b : {};\n } catch {\n return {};\n }\n}\n\nfunction publicUser(u: SessionUser) {\n return {\n id: u.id,\n username: u.username,\n balance: u.balance,\n isAdmin: !!u.is_admin,\n wins: u.wins,\n losses: u.losses,\n };\n}\n\n/**\n * open - accepting stakes\n * resolving - the clock ran out; waiting on the Overseer to call it\n * resolved - paid out\n */\nfunction lifecycle(bet: any, now: number): string {\n if (bet.status === \"resolved\") return \"resolved\";\n if (Number(bet.closes_at) <= now) return \"resolving\";\n return \"open\";\n}\n\n// ─── auth ────────────────────────────────────────────────────────────\n\napi.post(\"/register\", async (c) => {\n const { username, password } = await body(c);\n\n if (typeof username !== \"string\" || !USERNAME_RE.test(username.trim())) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (typeof password !== \"string\" || password.length < MIN_PASSWORD) {\n return bad(c, `Passphrase must be at least ${MIN_PASSWORD} characters.`);\n }\n if (password.length > 200) return bad(c, \"Passphrase too long.\");\n\n const name = username.trim();\n const lower = name.toLowerCase();\n\n const clash = await queryOne(\"SELECT id FROM users WHERE username_lower = ?\", [lower]);\n if (clash) return bad(c, \"That handle is already registered.\", 409);\n\n const id = newId(\"usr\");\n try {\n await run(\n `INSERT INTO users (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, ?, 0, ?)`,\n [id, name, lower, await hashPassword(password), STARTING_BALANCE, Date.now()],\n );\n } catch {\n return bad(c, \"That handle is already registered.\", 409);\n }\n\n await createSession(c, id);\n return c.json({\n user: { id, username: name, balance: STARTING_BALANCE, isAdmin: false, wins: 0, losses: 0 },\n });\n});\n\napi.post(\"/login\", async (c) => {\n const { username, password } = await body(c);\n if (typeof username !== \"string\" || typeof password !== \"string\") {\n return bad(c, \"Handle and passphrase required.\");\n }\n\n const row = await queryOne(\n `SELECT id, username, password_hash, balance, is_admin, wins, losses,\n failed_attempts, locked_until\n FROM users WHERE username_lower = ?`,\n [username.trim().toLowerCase()],\n );\n\n const REJECT = \"Authentication rejected.\";\n\n if (!row) {\n await verifyPassword(password, \"pbkdf2$120000$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\");\n return bad(c, REJECT, 401);\n }\n if (isLockedOut(row)) {\n return bad(c, \"Too many failed attempts. Try again in a few minutes.\", 429);\n }\n\n const ok = await verifyPassword(password, String(row.password_hash));\n if (!ok) {\n await recordFailedLogin(String(row.id), Number(row.failed_attempts || 0));\n return bad(c, REJECT, 401);\n }\n\n await clearFailedLogins(String(row.id));\n await createSession(c, String(row.id));\n\n return c.json({\n user: {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n isAdmin: !!Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n },\n });\n});\n\napi.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.json({ ok: true });\n});\n\napi.get(\"/me\", async (c) => {\n const user = await currentUser(c);\n return c.json({ user: user ? publicUser(user) : null });\n});\n\n// ─── market ──────────────────────────────────────────────────────────\n\napi.get(\"/bets\", async (c) => {\n const user = await currentUser(c);\n const now = Date.now();\n\n const bets = await queryAll(\n `SELECT b.*,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = b.id AND w.status = 'pending'), 0) AS active_pool\n FROM bets b\n ORDER BY b.created_at DESC`,\n );\n\n const options = await queryAll(\n `SELECT o.id, o.bet_id, o.label, o.sort_order,\n COALESCE(SUM(CASE WHEN w.status = 'pending' THEN w.stake ELSE 0 END), 0) AS pool,\n COUNT(CASE WHEN w.status = 'pending' THEN 1 END) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id\n ORDER BY o.sort_order`,\n );\n\n const mine = user\n ? await queryAll(\n `SELECT id, bet_id, option_id, stake, tax, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY created_at DESC`,\n [user.id],\n )\n : [];\n\n const optsByBet: Record = {};\n for (const o of options) (optsByBet[String(o.bet_id)] ||= []).push(o);\n\n const mineByBet: Record = {};\n for (const w of mine) {\n (mineByBet[String(w.bet_id)] ||= []).push({\n id: w.id,\n optionId: w.option_id,\n stake: Number(w.stake),\n tax: Number(w.tax || 0),\n paid: Number(w.stake) + Number(w.tax || 0),\n status: w.status,\n payout: Number(w.payout),\n createdAt: Number(w.created_at),\n sellbackValue: Math.floor(Number(w.stake) * SELLBACK_RATE),\n });\n }\n\n return c.json({\n now,\n sellbackRate: SELLBACK_RATE,\n taxRate: TAX_RATE,\n bets: bets.map((b) => {\n const forfeited = Number(b.forfeited || 0);\n const totalPot = Number(b.active_pool || 0) + forfeited;\n const opts = (optsByBet[String(b.id)] || []).map((o) => {\n const pool = Number(o.pool);\n return {\n id: o.id,\n label: o.label,\n pool,\n backers: Number(o.backers),\n // Share of the pot currently sitting on this outcome. Doubles as\n // the market's implied probability.\n share: totalPot > 0 ? pool / totalPot : 0,\n // What one Gelt on this outcome would return if it won right now.\n payoutPerGelt: pool > 0 ? totalPot / pool : 0,\n };\n });\n return {\n id: b.id,\n title: b.title,\n description: b.description,\n status: lifecycle(b, now),\n closesAt: Number(b.closes_at),\n winningOptionId: b.winning_option_id,\n createdAt: Number(b.created_at),\n resolvedAt: b.resolved_at ? Number(b.resolved_at) : null,\n totalPot,\n forfeited,\n options: opts,\n myWagers: mineByBet[String(b.id)] || [],\n };\n }),\n });\n});\n\napi.get(\"/leaderboard\", async (c) => {\n const byWallet = await queryAll(\n `SELECT username, balance, wins, losses\n FROM users WHERE is_admin = 0\n ORDER BY balance DESC, wins DESC LIMIT 50`,\n );\n\n // Win rate, but only for people who have actually settled something.\n const byRatio = await queryAll(\n `SELECT username, balance, wins, losses,\n CAST(wins AS REAL) / (wins + losses) AS rate\n FROM users\n WHERE is_admin = 0 AND (wins + losses) > 0\n ORDER BY rate DESC, (wins + losses) DESC, balance DESC\n LIMIT 50`,\n );\n\n const shape = (r: any) => ({\n username: r.username,\n balance: Number(r.balance),\n wins: Number(r.wins),\n losses: Number(r.losses),\n rate: r.rate === undefined || r.rate === null ? null : Number(r.rate),\n });\n\n return c.json({ byWallet: byWallet.map(shape), byRatio: byRatio.map(shape) });\n});\n\n// ─── taking a position ───────────────────────────────────────────────\n\napi.post(\"/wagers\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const { betId, optionId, stake } = await body(c);\n\n const gross = Number(stake);\n if (!Number.isInteger(gross) || gross <= 0) {\n return bad(c, \"Bid must be a whole number above zero.\");\n }\n if (gross < MIN_BID) {\n return bad(c, `Minimum bid is ${MIN_BID} Gelt. Anything smaller is swallowed whole by the levy.`);\n }\n if (gross > 1_000_000_000) return bad(c, \"Bid too large.\");\n\n const option = await queryOne(\n `SELECT o.id, o.bet_id, b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ? AND o.bet_id = ?`,\n [String(optionId ?? \"\"), String(betId ?? \"\")],\n );\n if (!option) return bad(c, \"No such outcome.\", 404);\n if (option.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(option.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed and is awaiting resolution.\", 409);\n }\n\n // The levy comes out of the bid, so the wallet is debited the full\n // amount and only the remainder reaches the pot.\n const { tax, net } = applyLevy(gross);\n const now = Date.now();\n\n // Both statements test the same balance inside one transaction, so they\n // agree: either the bid is affordable and both apply, or neither does.\n const results = await sqlite.batch([\n {\n sql: `INSERT INTO wagers (id, user_id, bet_id, option_id, stake, tax, status, created_at)\n SELECT ?, ?, ?, ?, ?, ?, 'pending', ?\n WHERE (SELECT balance FROM users WHERE id = ?) >= ?`,\n args: [newId(\"wgr\"), user.id, String(option.bet_id), String(option.id),\n net, tax, now, user.id, gross],\n },\n {\n sql: \"UPDATE users SET balance = balance - ? WHERE id = ? AND balance >= ?\",\n args: [gross, user.id, gross],\n },\n ], \"write\");\n\n if (!results[1] || Number(results[1].rowsAffected) !== 1) {\n return bad(c, \"Insufficient Throne Gelt.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({\n ok: true,\n balance: Number(fresh?.balance ?? 0),\n paid: gross,\n levy: tax,\n intoPot: net,\n });\n});\n\n/**\n * Sell a position back to the house while the market is still open.\n *\n * In a parimutuel pool the fair value of a position is simply its stake:\n * the odds move to keep expected value flat, so there is no \"current price\"\n * to mark against. The exit therefore returns a flat 90% of the stake, and\n * the 10% stays in the pot for whoever is still holding at resolution.\n */\napi.post(\"/wagers/:id/sell\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const wagerId = c.req.param(\"id\");\n\n const w = await queryOne(\n `SELECT w.id, w.user_id, w.bet_id, w.stake, w.status, b.status AS bet_status, b.closes_at\n FROM wagers w JOIN bets b ON b.id = w.bet_id\n WHERE w.id = ?`,\n [wagerId],\n );\n if (!w) return bad(c, \"No such position.\", 404);\n if (String(w.user_id) !== user.id) return bad(c, \"That is not your position.\", 403);\n if (w.status !== \"pending\") return bad(c, \"That position is already settled.\", 409);\n if (w.bet_status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(w.closes_at) <= Date.now()) {\n return bad(c, \"This market has closed. Positions can no longer be sold.\", 409);\n }\n\n const stake = Number(w.stake);\n const refund = Math.floor(stake * SELLBACK_RATE);\n const forfeit = stake - refund;\n const now = Date.now();\n\n // The first two statements are guarded on the wager still being pending,\n // and they run before the third flips it. A duplicate request therefore\n // changes nothing at all rather than paying out twice.\n const results = await sqlite.batch([\n {\n sql: `UPDATE users SET balance = balance + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [refund, user.id, wagerId],\n },\n {\n sql: `UPDATE bets SET forfeited = forfeited + ?\n WHERE id = ? AND (SELECT status FROM wagers WHERE id = ?) = 'pending'`,\n args: [forfeit, String(w.bet_id), wagerId],\n },\n {\n sql: `UPDATE wagers SET status = 'sold', payout = ?, settled_at = ?\n WHERE id = ? AND status = 'pending'`,\n args: [refund, now, wagerId],\n },\n ], \"write\");\n\n if (!results[2] || Number(results[2].rowsAffected) !== 1) {\n return bad(c, \"That position is already settled.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({ ok: true, refund, forfeit, balance: Number(fresh?.balance ?? 0) });\n});\n\n// ─── admin ───────────────────────────────────────────────────────────\n\napi.get(\"/admin/users\", requireAdmin, async (c) => {\n const rows = await queryAll(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, u.created_at,\n COALESCE((SELECT COUNT(*) FROM wagers w WHERE w.user_id = u.id), 0) AS wager_count,\n COALESCE((SELECT SUM(w.stake) FROM wagers w\n WHERE w.user_id = u.id AND w.status = 'pending'), 0) AS at_risk,\n COALESCE((SELECT SUM(w.tax) FROM wagers w WHERE w.user_id = u.id), 0) AS levied\n FROM users u\n ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(tax), 0) AS levy,\n COALESCE(SUM(stake), 0) AS staked,\n COUNT(*) AS wagers\n FROM wagers`,\n );\n\n return c.json({\n users: rows.map((r) => ({\n id: r.id,\n username: r.username,\n balance: Number(r.balance),\n isAdmin: !!Number(r.is_admin),\n wins: Number(r.wins),\n losses: Number(r.losses),\n wagerCount: Number(r.wager_count),\n atRisk: Number(r.at_risk),\n levied: Number(r.levied),\n createdAt: Number(r.created_at),\n })),\n treasury: {\n levyCollected: Number(totals?.levy ?? 0),\n totalStaked: Number(totals?.staked ?? 0),\n wagers: Number(totals?.wagers ?? 0),\n rate: TAX_RATE,\n },\n });\n});\n\n/** Title, description, outcome labels, duration. No odds: the pot sets those. */\napi.post(\"/admin/bets\", requireAdmin, async (c) => {\n const { title, description, options, durationMinutes } = await body(c);\n\n if (typeof title !== \"string\" || title.trim().length < 3) {\n return bad(c, \"Title must be at least 3 characters.\");\n }\n if (title.length > 200) return bad(c, \"Title too long.\");\n\n const desc = typeof description === \"string\" ? description.trim() : \"\";\n if (desc.length > 2000) return bad(c, \"Description too long.\");\n\n const mins = Number(durationMinutes);\n if (!Number.isFinite(mins) || mins < 1 || mins > 60 * 24 * 60) {\n return bad(c, \"Duration must be between 1 minute and 60 days.\");\n }\n\n if (!Array.isArray(options) || options.length < 2 || options.length > 8) {\n return bad(c, \"A market needs between 2 and 8 outcomes.\");\n }\n\n const labels: string[] = [];\n for (const o of options) {\n const label = (typeof o === \"string\" ? o : o?.label);\n const clean = typeof label === \"string\" ? label.trim() : \"\";\n if (!clean) return bad(c, \"Every outcome needs a label.\");\n if (clean.length > 120) return bad(c, \"Outcome label too long.\");\n if (labels.some((l) => l.toLowerCase() === clean.toLowerCase())) {\n return bad(c, \"Outcome labels must be distinct.\");\n }\n labels.push(clean);\n }\n\n const betId = newId(\"bet\");\n const now = Date.now();\n const closesAt = now + Math.round(mins * 60_000);\n\n const stmts = [{\n sql: `INSERT INTO bets (id, title, description, status, closes_at, forfeited, created_at)\n VALUES (?, ?, ?, 'open', ?, 0, ?)`,\n args: [betId, title.trim(), desc, closesAt, now],\n }];\n labels.forEach((label, i) => {\n stmts.push({\n sql: `INSERT INTO bet_options (id, bet_id, label, sort_order) VALUES (?, ?, ?, ?)`,\n args: [newId(\"opt\"), betId, label, i],\n });\n });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, betId, closesAt });\n});\n\n/** Force the market into resolving ahead of its deadline. */\napi.post(\"/admin/bets/:id/close\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [id]);\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"Already resolved.\", 409);\n\n await run(\"UPDATE bets SET closes_at = ? WHERE id = ?\", [Date.now(), id]);\n return c.json({ ok: true });\n});\n\n/**\n * Pay out the whole pot to backers of the winning outcome, split by each\n * backer's share of that outcome's pool. Losing stakes are not returned.\n *\n * Only legal once the market is closed, which means no new money can\n * arrive between reading the pool sizes and writing the payouts.\n */\napi.post(\"/admin/bets/:id/resolve\", requireAdmin, async (c) => {\n const betId = c.req.param(\"id\");\n const { winningOptionId } = await body(c);\n const optId = String(winningOptionId ?? \"\");\n const now = Date.now();\n\n const bet = await queryOne(\n \"SELECT id, status, closes_at, forfeited FROM bets WHERE id = ?\",\n [betId],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"This market is already resolved.\", 409);\n if (Number(bet.closes_at) > now) {\n return bad(c, \"This market is still open. Close it first.\", 409);\n }\n\n const option = await queryOne(\n \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n [optId, betId],\n );\n if (!option) return bad(c, \"That outcome does not belong to this market.\", 400);\n\n const totals = await queryOne(\n `SELECT COALESCE(SUM(stake), 0) AS active,\n COALESCE(SUM(CASE WHEN option_id = ? THEN stake ELSE 0 END), 0) AS win_pool\n FROM wagers WHERE bet_id = ? AND status = 'pending'`,\n [optId, betId],\n );\n const totalPot = Number(totals?.active ?? 0) + Number(bet.forfeited ?? 0);\n const winPool = Number(totals?.win_pool ?? 0);\n\n // If nobody backed the winning outcome, winPool is 0 and the general\n // path below handles it correctly on its own: the \"won\" update matches\n // no rows (so its divisor is never evaluated), every stake is marked\n // lost, and the pot is forfeit to the house. Back a long shot alone and\n // you take the lot; back nothing that lands and the Warrant keeps it.\n\n await sqlite.batch([\n // Each winner takes the pot in proportion to their share of the\n // winning pool. Truncated, so the pot can never be overdrawn.\n {\n sql: `UPDATE wagers\n SET status = 'won',\n payout = CAST((CAST(stake AS REAL) * ? / ?) AS INTEGER),\n settled_at = ?\n WHERE bet_id = ? AND option_id = ? AND status = 'pending'`,\n args: [totalPot, winPool, now, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'lost', payout = 0, settled_at = ?\n WHERE bet_id = ? AND option_id != ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE users\n SET balance = balance + COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0),\n wins = wins + COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [betId, betId, betId],\n },\n {\n sql: `UPDATE users\n SET losses = losses + (\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost')\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [betId, betId],\n },\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ? WHERE id = ?`,\n args: [optId, now, betId],\n },\n ], \"write\");\n\n const paid = await queryOne(\n `SELECT COUNT(*) AS n, COALESCE(SUM(payout), 0) AS total\n FROM wagers WHERE bet_id = ? AND status = 'won'`,\n [betId],\n );\n\n return c.json({\n ok: true,\n houseWins: winPool === 0,\n winnersPaid: Number(paid?.n ?? 0),\n totalPaid: Number(paid?.total ?? 0),\n totalPot,\n });\n});\n\n/** Immediate stipend to every non-admin account. */\napi.post(\"/admin/fund\", requireAdmin, async (c) => {\n const { amount } = await body(c);\n const value = Number(amount);\n if (!Number.isInteger(value) || value === 0) {\n return bad(c, \"Amount must be a non-zero whole number.\");\n }\n if (Math.abs(value) > 10_000_000) return bad(c, \"Amount too large.\");\n\n const res = await run(\n value > 0\n ? \"UPDATE users SET balance = balance + ? WHERE is_admin = 0\"\n : \"UPDATE users SET balance = MAX(0, balance + ?) WHERE is_admin = 0\",\n [value],\n );\n\n return c.json({ ok: true, accounts: Number(res.rowsAffected ?? 0), amount: value });\n});\n\n// ─── campaign map ────────────────────────────────────────────────────\n\n/** The live board, readable by anyone. */\napi.get(\"/campaign\", async (c) => {\n const row = await queryOne(\n \"SELECT round, save_code, created_at FROM campaign_rounds ORDER BY round DESC LIMIT 1\",\n );\n if (!row) return c.json({ round: null, saveCode: null });\n return c.json({\n round: Number(row.round),\n saveCode: String(row.save_code),\n createdAt: Number(row.created_at),\n });\n});\n\n/** Every snapshot, newest first. Used by the rollback picker. */\napi.get(\"/admin/campaign/history\", requireAdmin, async (c) => {\n const rows = await queryAll(\n \"SELECT round, note, created_at, LENGTH(save_code) AS size FROM campaign_rounds ORDER BY round DESC\",\n );\n return c.json({\n rounds: rows.map((r) => ({\n round: Number(r.round),\n note: r.note,\n createdAt: Number(r.created_at),\n size: Number(r.size),\n })),\n });\n});\n\n/** Publish a new board state. Replaces the snapshot for that round. */\napi.post(\"/admin/campaign\", requireAdmin, async (c) => {\n const { round, saveCode, note } = await body(c);\n const n = Number(round);\n\n if (!Number.isInteger(n) || n < 0 || n > 100000) {\n return bad(c, \"Round must be a whole number.\");\n }\n if (typeof saveCode !== \"string\" || saveCode.length < 16) {\n return bad(c, \"Missing or malformed save code.\");\n }\n if (saveCode.length > 2_000_000) return bad(c, \"Save code too large.\");\n if (!/^[A-Za-z0-9+/=]+$/.test(saveCode)) return bad(c, \"Save code must be base64.\");\n\n await run(\n `INSERT INTO campaign_rounds (round, save_code, note, created_at)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(round) DO UPDATE SET save_code = excluded.save_code,\n note = excluded.note,\n created_at = excluded.created_at`,\n [n, saveCode, typeof note === \"string\" ? note.slice(0, 200) : \"\", Date.now()],\n );\n\n return c.json({ ok: true, round: n });\n});\n\n/**\n * Roll the board back to an earlier round. Everything after it is\n * discarded, so the next advance replays from there.\n */\napi.post(\"/admin/campaign/rollback\", requireAdmin, async (c) => {\n const { round } = await body(c);\n const n = Number(round);\n if (!Number.isInteger(n) || n < 0) return bad(c, \"Round must be a whole number.\");\n\n const target = await queryOne(\n \"SELECT round, save_code FROM campaign_rounds WHERE round = ?\",\n [n],\n );\n if (!target) return bad(c, \"No snapshot for that round.\", 404);\n\n const res = await run(\"DELETE FROM campaign_rounds WHERE round > ?\", [n]);\n return c.json({\n ok: true,\n round: n,\n discarded: Number(res.rowsAffected ?? 0),\n saveCode: String(target.save_code),\n });\n});\n\n/** Wipe the board entirely so a fresh campaign can be generated. */\napi.delete(\"/admin/campaign\", requireAdmin, async (c) => {\n const res = await run(\"DELETE FROM campaign_rounds\");\n return c.json({ ok: true, discarded: Number(res.rowsAffected ?? 0) });\n});\n\n/**\n * Remove a market entirely.\n *\n * Open or resolving markets always refund their pending stakes, because\n * those positions never settled and the Gelt is still owed.\n *\n * For a resolved market, ?reverse=1 undoes the settlement as well:\n * winnings are clawed back, every stake is returned, and the win/loss\n * counters are decremented. Without it the market simply disappears from\n * the archive and whatever was paid out stays paid.\n */\napi.delete(\"/admin/bets/:id\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const reverse = c.req.query(\"reverse\") === \"1\";\n\n const bet = await queryOne(\n \"SELECT id, title, status FROM bets WHERE id = ?\",\n [id],\n );\n if (!bet) return bad(c, \"No such market.\", 404);\n\n const resolved = bet.status === \"resolved\";\n const undo = resolved && reverse;\n\n // What was staked and paid, recorded before anything is deleted.\n const tally = await queryOne(\n `SELECT COUNT(*) AS n,\n COALESCE(SUM(CASE WHEN status != 'sold' THEN stake + tax ELSE 0 END), 0) AS staked,\n COALESCE(SUM(CASE WHEN status = 'won' THEN payout ELSE 0 END), 0) AS paid,\n COALESCE(SUM(tax), 0) AS levied\n FROM wagers WHERE bet_id = ?`,\n [id],\n );\n\n const stmts: { sql: string; args: any[] }[] = [];\n\n if (!resolved) {\n // Never settled: hand back the full amount paid, levy included.\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'pending')`,\n args: [id, id],\n });\n } else if (undo) {\n // Return everything paid in, levy included, on positions that weren't\n // voluntarily sold out of...\n stmts.push({\n sql: `UPDATE users SET balance = balance + COALESCE((\n SELECT SUM(w.stake + w.tax) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status IN ('won','lost')), 0)\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status IN ('won','lost'))`,\n args: [id, id],\n });\n // ...then take back the winnings that were paid on top.\n stmts.push({\n sql: `UPDATE users SET balance = MAX(0, balance - COALESCE((\n SELECT SUM(w.payout) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET wins = MAX(0, wins - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'won'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'won')`,\n args: [id, id],\n });\n stmts.push({\n sql: `UPDATE users SET losses = MAX(0, losses - COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.status = 'lost'), 0))\n WHERE id IN (SELECT user_id FROM wagers WHERE bet_id = ? AND status = 'lost')`,\n args: [id, id],\n });\n }\n\n stmts.push({ sql: \"DELETE FROM wagers WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bet_options WHERE bet_id = ?\", args: [id] });\n stmts.push({ sql: \"DELETE FROM bets WHERE id = ?\", args: [id] });\n\n await sqlite.batch(stmts, \"write\");\n\n return c.json({\n ok: true,\n deleted: bet.title,\n wasResolved: resolved,\n reversed: undo,\n wagers: Number(tally?.n ?? 0),\n stakeReturned: (!resolved || undo) ? Number(tally?.staked ?? 0) : 0,\n winningsClawedBack: undo ? Number(tally?.paid ?? 0) : 0,\n levyRefunded: (!resolved || undo) ? Number(tally?.levied ?? 0) : 0,\n });\n});\n\napi.delete(\"/admin/users/:id\", requireAdmin, async (c) => {\n const actor = c.get(\"user\") as SessionUser;\n const id = c.req.param(\"id\");\n\n const target = await queryOne(\n \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n [id],\n );\n if (!target) return bad(c, \"No such account.\", 404);\n if (String(target.id) === actor.id) return bad(c, \"You cannot delete your own account.\", 400);\n if (Number(target.is_admin)) return bad(c, \"Overseer accounts cannot be deleted here.\", 400);\n\n // Open positions leave the pot with them; the stake is not refunded to\n // anyone, so fold it into forfeited to keep each pot's arithmetic honest.\n await sqlite.batch([\n {\n sql: `UPDATE bets SET forfeited = forfeited + COALESCE((\n SELECT SUM(w.stake) FROM wagers w\n WHERE w.bet_id = bets.id AND w.user_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (SELECT bet_id FROM wagers WHERE user_id = ? AND status = 'pending')`,\n args: [id, id],\n },\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [id] },\n ], \"write\");\n\n return c.json({ ok: true, deleted: target.username });\n});\n","createdAt",["D",1789377753466],"branchVersion","branchId","649b81a3-ef64-48e6-b6db-ab0a767348e2","id","3acf27cf-bc0f-4f45-b440-a47608349aee","throne-ledger",["D",1789371999223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger for the Battle for the Hive campaign","imageUrl","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","6b608f96-b010-11f1-9552-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","3acf27cfbc0f4f45b440a47608349aee","tursoHostname","3acf27cfbc0f4f45b440a47608349aee-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789546246980],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",173,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","RT_Brandt","handle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":382,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":383,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":384,"_85":385,"_87":386,"_89":25},"tree",[177,184,189,201],"files",[177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201],"counts",{"_166":64,"_167":168,"_169":64,"_170":171,"_172":173},"contents",[132,133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":164,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":165},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":157,"_140":60,"_39":158,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":159},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":151,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_27":153},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":141,"_13":142,"_34":143,"_36":144,"_24":25,"_145":46,"_27":146},"d77ca5dc-1963-41bb-8266-cb06d4eabd78","main.tsx","parentId",63,"latest",["D",1789376232886],3,"http","import { Hono } from \"npm:hono\";\nimport { parseVal, readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { api } from \"./lib/api.ts\";\nimport { PAGE } from \"./lib/ui.ts\";\nimport { ready } from \"./lib/db.ts\";\n\nconst app = new Hono();\n\napp.route(\"/api\", api);\n\napp.get(\"/\", async (c) => {\n await ready();\n return c.html(PAGE);\n});\n\n/**\n * Warband sigils that aren't in any public icon set are bundled with the\n * val. Served immutable: the filename changes if the art ever does.\n */\nconst SIGIL_FILES = new Set([\n \"custodes\", \"astartes\", \"heretics\", \"mechanicus\", \"ministorum\",\n \"daemons\", \"tyranids\", \"orks\", \"drukhari\", \"tau\", \"necrons\",\n]);\n\napp.get(\"/sigils/:name\", async (c) => {\n const name = c.req.param(\"name\").replace(/\\.svg$/, \"\");\n if (!SIGIL_FILES.has(name)) return c.notFound();\n try {\n const svg = await readFile(`/sigils/${name}.svg`, import.meta.url);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=31536000, immutable\",\n },\n });\n } catch (e) {\n console.error(\"sigil read failed\", name, e);\n return c.notFound();\n }\n});\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","label",[137],"ab404456-1dde-4768-b7b3-641072a137bf","sigils","9340e4af-2103-4c6a-9cfc-46895ff4673b",44,["D",1789375459829],"directory",[148],"da4bc700-988d-495b-a48f-a8b28fb515c7","scripts","e271c1d7-6014-4994-8caa-07e909b081d1",8,["D",1789372426992],[155],"d40104bc-606a-4d76-b529-424870d4ebb7","lib","36d116d1-be79-439b-af80-39fd2bb6eeb1",2,["D",1789372056135],[161],"pulls","branches",1,"forks","envVars",{"_174":163,"_176":64},"connections",{"_174":64,"_175":64},"count","unfilledCount","emptyCount",{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":379,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":380,"_27":381},{"_44":374,"_32":33,"_30":31,"_138":162,"_42":43,"_41":14,"_140":25,"_39":375,"_13":376,"_34":35,"_36":38,"_24":25,"_145":-5,"_203":377,"_27":378},{"_44":366,"_32":367,"_30":368,"_138":162,"_42":43,"_41":369,"_140":60,"_39":370,"_13":64,"_34":35,"_36":371,"_24":25,"_145":-5,"_203":372,"_27":373},{"_44":359,"_32":360,"_30":361,"_138":162,"_42":43,"_41":163,"_140":60,"_39":362,"_13":64,"_34":35,"_36":363,"_24":25,"_145":-5,"_203":364,"_27":365},{"_44":350,"_32":351,"_30":352,"_138":162,"_42":43,"_41":353,"_140":25,"_39":354,"_13":355,"_34":35,"_36":356,"_24":25,"_145":-5,"_203":357,"_27":358},{"_44":342,"_32":343,"_30":344,"_138":162,"_42":43,"_41":345,"_140":25,"_39":346,"_13":142,"_34":35,"_36":347,"_24":25,"_145":-5,"_203":348,"_27":349},{"_44":333,"_32":334,"_30":335,"_138":162,"_42":43,"_41":336,"_140":25,"_39":337,"_13":338,"_34":35,"_36":339,"_24":25,"_145":-5,"_203":340,"_27":341},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":157,"_140":60,"_39":330,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":331,"_27":332},{"_44":322,"_32":323,"_30":324,"_138":156,"_42":43,"_41":325,"_140":60,"_39":326,"_13":64,"_34":35,"_36":327,"_24":25,"_145":-5,"_203":328,"_27":329},{"_44":314,"_32":315,"_30":316,"_138":156,"_42":43,"_41":317,"_140":60,"_39":318,"_13":64,"_34":35,"_36":319,"_24":25,"_145":-5,"_203":320,"_27":321},{"_44":305,"_32":306,"_30":307,"_138":156,"_42":43,"_41":308,"_140":25,"_39":309,"_13":310,"_34":35,"_36":311,"_24":25,"_145":-5,"_203":312,"_27":313},{"_44":296,"_32":297,"_30":298,"_138":156,"_42":43,"_41":299,"_140":25,"_39":300,"_13":301,"_34":35,"_36":302,"_24":25,"_145":-5,"_203":303,"_27":304},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":293,"_13":64,"_34":152,"_36":-5,"_24":25,"_145":-5,"_203":294,"_27":295},{"_44":285,"_32":286,"_30":287,"_138":149,"_42":43,"_41":288,"_140":60,"_39":289,"_13":64,"_34":20,"_36":290,"_24":25,"_145":-5,"_203":291,"_27":292},{"_44":277,"_32":278,"_30":279,"_138":149,"_42":43,"_41":280,"_140":60,"_39":281,"_13":64,"_34":20,"_36":282,"_24":25,"_145":-5,"_203":283,"_27":284},{"_44":269,"_32":270,"_30":271,"_138":149,"_42":43,"_41":272,"_140":60,"_39":273,"_13":64,"_34":20,"_36":274,"_24":25,"_145":-5,"_203":275,"_27":276},{"_44":262,"_32":263,"_30":264,"_138":149,"_42":43,"_41":150,"_140":60,"_39":265,"_13":64,"_34":20,"_36":266,"_24":25,"_145":-5,"_203":267,"_27":268},{"_44":254,"_32":255,"_30":256,"_138":149,"_42":43,"_41":257,"_140":60,"_39":258,"_13":64,"_34":20,"_36":259,"_24":25,"_145":-5,"_203":260,"_27":261},{"_44":246,"_32":247,"_30":248,"_138":149,"_42":43,"_41":249,"_140":60,"_39":250,"_13":64,"_34":20,"_36":251,"_24":25,"_145":-5,"_203":252,"_27":253},{"_44":238,"_32":239,"_30":240,"_138":149,"_42":43,"_41":241,"_140":60,"_39":242,"_13":64,"_34":20,"_36":243,"_24":25,"_145":-5,"_203":244,"_27":245},{"_44":230,"_32":231,"_30":232,"_138":149,"_42":43,"_41":233,"_140":60,"_39":234,"_13":64,"_34":20,"_36":235,"_24":25,"_145":-5,"_203":236,"_27":237},{"_44":222,"_32":223,"_30":224,"_138":149,"_42":43,"_41":225,"_140":60,"_39":226,"_13":64,"_34":20,"_36":227,"_24":25,"_145":-5,"_203":228,"_27":229},{"_44":214,"_32":215,"_30":216,"_138":149,"_42":43,"_41":217,"_140":60,"_39":218,"_13":64,"_34":20,"_36":219,"_24":25,"_145":-5,"_203":220,"_27":221},{"_44":206,"_32":207,"_30":208,"_138":149,"_42":43,"_41":209,"_140":60,"_39":210,"_13":64,"_34":20,"_36":211,"_24":25,"_145":-5,"_203":212,"_27":213},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":202,"_13":142,"_34":143,"_36":144,"_24":25,"_145":46,"_203":204,"_27":205},["D",1789376232886],"children",[],[137],"dca6681e-9be1-4594-8c3d-729cc869ec14","tyranids.svg","ae826d8c-b018-11f1-91d0-1607ee4eb77e",45,["D",1789375547846],"\n",[],[148,207],"9bc332e0-9789-46bf-84dc-b7140f546403","tau.svg","aaae15ac-b019-11f1-937a-1607ee4eb77e",57,["D",1789375970929],"\n",[],[148,215],"5a4158fb-b067-43b1-81db-fe8238ce8c07","orks.svg","17447464-b019-11f1-95b2-1607ee4eb77e",46,["D",1789375723608],"\n",[],[148,223],"445422fd-cad6-4683-a5d2-8c9db8e66d6c","necrons.svg","b0a4f430-b019-11f1-b3d0-1607ee4eb77e",58,["D",1789375980892],"\n",[],[148,231],"01c278c8-6b72-4403-bbc4-ca24c67b35db","ministorum.svg","cafbb7e2-b019-11f1-b754-1607ee4eb77e",60,["D",1789376025122],"\n",[],[148,239],"714f3cc3-8b01-42a9-85eb-e53c372d0b6d","mechanicus.svg","dfd88b54-b019-11f1-aa20-1607ee4eb77e",61,["D",1789376060117],"\n",[],[148,247],"fbc30734-f2ed-4b7d-bc89-bbad435e476f","heretics.svg","8f4f85c0-b019-11f1-b134-1607ee4eb77e",55,["D",1789375924952],"\n",[],[148,255],"b5409e11-e24d-43ff-9cba-4d0cb2515221","drukhari.svg","7a0a6bd6-b018-11f1-881c-1607ee4eb77e",["D",1789375459829],"\n",[],[148,263],"aa5b02ea-b3eb-462c-819e-8fe93236cc55","daemons.svg","9ef133e8-b019-11f1-a090-1607ee4eb77e",56,["D",1789375951233],"\n",[],[148,270],"59fca74c-32da-48c2-9962-0b19a1fb9427","custodes.svg","bb141072-b019-11f1-b11c-1607ee4eb77e",59,["D",1789375998438],"\n",[],[148,278],"355ba2de-7c38-4b25-9dd9-d953846e5910","astartes.svg","43a92508-b01a-11f1-bd57-1607ee4eb77e",62,["D",1789376227420],"\n",[],[148,286],["D",1789375459829],[190,191,192,193,194,195,196,197,198,199,200],[148],"d3f67627-1218-4cdf-ae97-562695071253","sigilcheck.ts","b305c300-b017-11f1-a508-1607ee4eb77e",94,["D",1789377195695],9,"/**\n * Executes the page's client JS in a fake DOM and checks:\n * - every sigil URL resolves and returns SVG\n * - the engine can load a v3 save code and read it back correctly\n * - save -> load -> save round-trips without drift\n */\nimport { PAGE } from \"../lib/ui.ts\";\n\nconst out: string[] = [\"\", \"SIGIL + IMPORT CHECK\", \"====================\"];\nlet fail = 0;\nconst ok = (n: string, c: boolean, d = \"\") => {\n if (c) out.push(\" PASS \" + n);\n else { fail++; out.push(\" FAIL \" + n + (d ? \" -> \" + d : \"\")); }\n};\n\nconst blocks = [...PAGE.matchAll(/\n\n\n\n

Throne LedgerBy the Warrant of Von Brandt · Hive Solenne

\n \n

\n\n\n\n\n\n\n\n`;\n",[],[161,334],"16b8be99-ba1f-45e4-8c8a-e1e4e9ffe91d","engine.ts","5efcee7e-b016-11f1-97b9-1607ee4eb77e",87,["D",1789377125133],"/**\n * The war engine, as a browser-side module.\n *\n * This is the same simulation that ran in the standalone HTML file, with\n * one change: it no longer reads its state out of form inputs. Points per\n * faction live in E.pts, logging goes through a hook, and drawing takes a\n * canvas element. That lets the public page render a read-only board from\n * a saved snapshot while the Overseer panel drives the same code forward.\n *\n * Save codes are the v3 base64 format the standalone file already wrote,\n * so existing saves import cleanly.\n */\nexport const ENGINE_JS = String.raw`\nvar E = (function(){\n\nvar FACS=[\n {id:'custodians',name:'Golden Vigil', subfacs:'Custodes', color:'#D4A017',defence:6,attack:0,random:0,special:'static', reclaim:false,desc:'Guard the relic sites. Never expand, never attack.'},\n {id:'marines', name:'Iron Fangs', subfacs:'Space Marines', color:'#1560BD',defence:1,attack:2,random:0,special:'sworn', reclaim:false,desc:'Sworn enemy of Chaos. Priority placement.'},\n {id:'chaos', name:'Raiders of Ruin', subfacs:'Renegade Raiders & Chaos Knights', color:'#6A0DAD',defence:1,attack:2,random:0,special:'sworn', reclaim:false,desc:'Sworn enemy of Marines. Priority placement.'},\n {id:'admech', name:'Planetary Defense Force', subfacs:'AdMech, Imperial Guard & Knights',color:'#B22222',defence:2,attack:1,random:0,special:null, reclaim:false,desc:'Balanced force. No special rules.'},\n {id:'gk', name:'Argent Salvation', subfacs:'Grey Knights, Deathwatch & Sisters', color:'#00BFFF',defence:0,attack:2,random:1,special:null, reclaim:true, desc:'Reclaims lost ground. 1 random rift per round.'},\n {id:'nids', name:'Hive Fleet Cetea', subfacs:'Tyranids & Genestealers', color:'#8B0040',defence:0,attack:3,random:0,special:'priority',reclaim:true, desc:'Priority placement. Reclaims former feeding grounds.'},\n {id:'daemons', name:'Daemon Incursions', subfacs:'Daemons', color:'#FF4500',defence:1,attack:2,random:3,special:null, reclaim:false,desc:'3 random rifts per round, drawn toward relics.'},\n {id:'orks', name:'Spinechoppa Waaagh', subfacs:'Orks', color:'#228B22',defence:0,attack:3,random:0,special:'priority',reclaim:false,desc:'Priority placement. Maximum aggression, no defence.'},\n {id:'eldar', name:\"Kurnous' Spear\", subfacs:'Dark Eldar, Eldar & Exodites', color:'#008B8B',defence:2,attack:0,random:1,special:null, reclaim:true, desc:'Strikes with no attack bonus, but hard to dislodge. Reclaims lost ground and opens 1 rift per round.'},\n {id:'tau', name:'Xenos Accord', subfacs:'Ordo Xenos, Squats & Tau', color:'#FF8C00',defence:3,attack:0,random:0,special:null, reclaim:true, desc:'No attack bonus, but the hardest force on the board to dig out. Reclaims former mining claims first.'},\n {id:'necrons', name:'Ramaneb Dynasty', subfacs:'Necrons', color:'#39FF14',defence:2,attack:1,random:0,special:null, reclaim:true, desc:'Reclaims ancient tomb worlds before expanding.'},\n];\n\nvar BUDGET=3, PRIORITY_IDS=['orks','nids','marines','chaos'], PRESEED_TARGET=16,\n RELIC_COUNT=9, ATTACKS_PER_FACTION=4, MAP_URL='https://i.ibb.co/4R6ngzdV/40k-map.png';\n\nvar GW=13, GH=13, CELL=18;\nvar grid=null, fCells={}, fElim={}, fActive={}, fFormer={}, relicSites=new Set();\nvar round=0, seeded=false, lines=[], overlays={};\nvar tempDefense=new Map();\nvar PTS={};\nvar onLog=null;\n\nFACS.forEach(function(f){ fActive[f.id]=true; fCells[f.id]=new Set(); fElim[f.id]=0; fFormer[f.id]=new Set(); PTS[f.id]=50; });\n\nfunction log(msg){\n lines.push(msg);\n if(lines.length>400) lines.shift();\n if(onLog) onLog(msg);\n}\n\nfunction getPts(id){ var v=PTS[id]; return Math.max(1, Number(v)||50); }\nfunction setPts(id,v){ PTS[id]=Math.max(0, Math.min(100, Number(v)||0)); }\n\nfunction rollAttack(fid){\n var f=FACS.find(function(x){return x.id===fid;});\n return (Math.random()*100)*(getPts(fid)/100)+(f?f.attack:0);\n}\nfunction rollDefence(fid, cellIndex){\n var f=FACS.find(function(x){return x.id===fid;});\n var bonus = 1.5*(f?f.defence:0);\n if(cellIndex!==undefined) bonus += tempDefense.get(cellIndex)||0;\n return (Math.random()*100)*(getPts(fid)/100)+bonus;\n}\nfunction relicsHeldBy(fid){\n var fi=FACS.findIndex(function(f){return f.id===fid;})+1;\n return Array.from(relicSites).filter(function(r){return grid[r]===fi;}).length;\n}\nfunction boardControl(fid){ return (fCells[fid]?fCells[fid].size:0)+relicsHeldBy(fid)*3; }\nfunction relicExpansionBonus(fid){ return Math.floor(relicsHeldBy(fid)/2); }\nfunction isElim(id){ return !fActive[id]; }\nfunction rnd(a){ return a.length?a[Math.floor(Math.random()*a.length)]:undefined; }\nfunction adj4(i){\n var x=i%GW, y=Math.floor(i/GW), r=[];\n if(x>0)r.push(i-1); if(x0)r.push(i-GW); if(y=0&&FACS[old]){ var oid=FACS[old].id; if(fCells[oid])fCells[oid].delete(i); if(fFormer[oid])fFormer[oid].add(i); }\n var fi=FACS.findIndex(function(f){return f.id===fid;}); if(fi<0)return;\n grid[i]=fi+1;\n if(!fCells[fid])fCells[fid]=new Set();\n fCells[fid].add(i); if(fFormer[fid])fFormer[fid].delete(i);\n}\nfunction addOverlay(i,icon){\n if(!overlays[i])overlays[i]=[];\n if(overlays[i].indexOf(icon)<0)overlays[i].push(icon);\n if(overlays[i].length>3)overlays[i]=overlays[i].slice(-3);\n}\nfunction fadeColor(c,a){\n var r=parseInt(c.slice(1,3),16),g=parseInt(c.slice(3,5),16),b=parseInt(c.slice(5,7),16);\n return 'rgba('+r+','+g+','+b+','+a+')';\n}\n\nvar LOC13 = [\n 'Water Purification','Water Purification','Water Purification','Temple District','Temple District','Temple District','Temple District','Habs 6B','Habs 6B','Habs 6B','Mines','Mines','Mines',\n 'Water Purification','Water Purification','Water Purification','Temple District','Temple District','Defence Fortress','Defence Fortress','Defence Fortress','Habs 6B','Habs 6B','Mines','Mines','Mines',\n 'Water Purification','Water Purification','Habs 8Y','Habs 8Y','Defence Fortress','Defence Fortress','Defence Fortress','Defence Fortress','Administratum','Administratum','Mines','Mines','Mines',\n 'Incarcerum','Incarcerum','Habs 8Y','Habs 8Y','Habs 8Y','Palace','Palace','Palace','Administratum','Administratum','Administratum','Waste Processing','Waste Processing',\n 'Incarcerum','Incarcerum','Museum','Museum','Museum','Palace','Palace','Palace','Palace','Administratum','Administratum','Waste Processing','Waste Processing',\n 'Incarcerum','Incarcerum','Museum','Museum','Museum','Palace','Palace','Palace','Data Stacks','Data Stacks','Data Stacks','Waste Processing','Waste Processing',\n 'Market District','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Data Stacks','Data Stacks','Data Stacks','Data Stacks','Data Stacks',\n 'Market District','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Habs 5T','Data Stacks','Data Stacks','Data Stacks','Data Stacks',\n 'Prometheum','Market District','Market District','Market District','Habs IX','Habs IX','Habs IX','Habs IX','Habs 5T','Habs 5T','Habs 5T','Habs 3L','Habs 3L',\n 'Prometheum','Prometheum','Market District','Market District','Manufactorum','Habs IX','Habs IX','Power','Power','Habs 5T','Habs 5T','Habs 3L','Habs 3L',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport',\n 'Prometheum','Prometheum','Prometheum','Manufactorum','Manufactorum','Manufactorum','Manufactorum','Power','Power','Power','Spaceport','Spaceport','Spaceport'\n];\nfunction getCoords(i){\n var x=i%GW, y=Math.floor(i/GW);\n if(GW===13&&GH===13){ var n=LOC13[y*13+x]; if(n) return n; }\n return '('+x+','+y+')';\n}\n\nfunction getBlobs(fid){\n var owned=new Set(fCells[fid]), visited=new Set(), blobs=[];\n owned.forEach(function(start){\n if(visited.has(start))return;\n var blob=[], q=[start]; visited.add(start);\n while(q.length){\n var c=q.pop(); blob.push(c);\n adj4(c).forEach(function(n){ if(owned.has(n)&&!visited.has(n)){ visited.add(n); q.push(n); } });\n }\n blobs.push(blob);\n });\n return blobs.sort(function(a,b){return b.length-a.length;});\n}\nfunction nearestRelicTarget(fid){\n var relicEmp=relicAdjacentEmpty(); if(!relicEmp.length)return null;\n var owned=Array.from(fCells[fid]); if(!owned.length)return null;\n var best=null,bestD=999999;\n owned.forEach(function(c){\n var cx=c%GW, cy=Math.floor(c/GW);\n relicEmp.forEach(function(t){\n var d=Math.pow(cx-t%GW,2)+Math.pow(cy-Math.floor(t/GW),2);\n if(d0){\n var tgts=[];\n fCells[fid].forEach(function(c){\n adj4(c).forEach(function(n){ if(grid[n]===-1&&former.has(n)&&!relicSites.has(n)) tgts.push(n); });\n });\n if(tgts.length)return rnd(tgts);\n }\n return pickExpansionTarget(fid);\n}\n\n// ── drawing ────────────────────────────────────────────────────────\nvar cachedBg=null;\n\nfunction draw(canvas, maxWidth){\n if(!canvas||!grid)return;\n maxWidth = maxWidth || 600;\n CELL = Math.max(10, Math.floor(maxWidth/GW));\n var mapW=GW*CELL, mapH=GH*CELL;\n canvas.width=mapW; canvas.height=mapH;\n canvas.style.width=mapW+'px'; canvas.style.height=mapH+'px';\n var ctx=canvas.getContext('2d');\n\n function layers(){\n // Fill pass. Grid lines are kept very faint so the territory\n // outlines below are what the eye actually follows.\n for(var y=0;y0){\n ctx.drawImage(cachedBg,0,0,mapW,mapH); layers();\n } else {\n var img=new Image(); img.crossOrigin='Anonymous';\n img.onload=function(){ cachedBg=img; ctx.drawImage(img,0,0,mapW,mapH); layers(); };\n img.onerror=function(){ ctx.fillStyle='#181818'; ctx.fillRect(0,0,mapW,mapH); layers(); };\n img.src=MAP_URL;\n }\n}\n\n// ── save / load ────────────────────────────────────────────────────\nfunction save(){\n var o={ v:3, gw:GW, gh:GH, grid:Array.from(grid), relics:Array.from(relicSites),\n round:round, seeded:seeded, fActive:{}, fElim:{}, fCells:{}, fFormer:{},\n pts:{}, overlays:overlays, tempDefense:Array.from(tempDefense.entries()) };\n FACS.forEach(function(f){\n o.fActive[f.id]=fActive[f.id];\n o.fElim[f.id]=fElim[f.id];\n o.fCells[f.id]=Array.from(fCells[f.id]);\n o.fFormer[f.id]=Array.from(fFormer[f.id]);\n o.pts[f.id]=getPts(f.id);\n });\n var bytes=new TextEncoder().encode(JSON.stringify(o));\n var s=''; for(var i=0;i0&&f.special!=='static'; })\n .forEach(function(f){ place(f,BUDGET-f.random,f.random); });\n seeded=true;\n}\n\nfunction advance(n){\n if(!seeded) throw new Error('Run preseed first.');\n for(var i=0;idfn){\n log(' \\u2694\\uFE0F '+f.name.split(' ')[0]+' took '+where+' from '+def.name.split(' ')[0]+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(target,'\\u2694\\uFE0F');\n claim(target,f.id);\n if(f.random>0){\n addTempDefense(target,3); addOverlay(target,'\\u26A1');\n log(' \\u26A1 Ambush buff at '+where+' (+3 defence next round)');\n }\n } else {\n log(' \\uD83D\\uDEE1\\uFE0F '+def.name.split(' ')[0]+' held '+where+' vs '+f.name.split(' ')[0]+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(target,'\\uD83D\\uDEE1\\uFE0F');\n }\n }\n });\n\n // Phase 3: one free swing at a Custodian relic\n var champ=strongestRelicBorder(cfi);\n if(champ){\n var cf=FACS.find(function(f){return f.id===champ;});\n var cust=FACS.find(function(f){return f.id==='custodians';});\n var reach=Array.from(relicSites).filter(function(r){\n return grid[r]===cfi&&adj4(r).some(function(n){\n return grid[n]>0&&FACS[grid[n]-1]&&FACS[grid[n]-1].id===champ;\n });\n });\n if(reach.length){\n var t=rnd(reach);\n var atk=rollAttack(champ), dfn=rollDefence('custodians',t);\n var where=getCoords(t);\n if(atk>dfn){\n log(' \\u2B50 '+cf.name+' seized the RELIC at '+where+'! ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(t,'\\u2B50'); claim(t,champ);\n if(cf.random>0){ addTempDefense(t,3); addOverlay(t,'\\u26A1'); }\n } else {\n log(' \\uD83D\\uDEE1\\uFE0F '+cust.name+' held the relic at '+where+' vs '+cf.name+\n ' ('+atk.toFixed(0)+' vs '+dfn.toFixed(0)+')');\n addOverlay(t,'\\uD83D\\uDEE1\\uFE0F');\n }\n }\n }\n}\n\nfunction strongestRelicBorder(cfi){\n var cRelics=Array.from(relicSites).filter(function(r){return grid[r]===cfi;});\n if(!cRelics.length)return null;\n var bord=new Set();\n cRelics.forEach(function(r){\n adj4(r).forEach(function(n){\n var v=grid[n];\n if(v>0&&v!==cfi&&FACS[v-1]){\n var fid=FACS[v-1].id;\n if(fActive[fid]&&!isElim(fid)) bord.add(fid);\n }\n });\n });\n if(!bord.size)return null;\n var best=-1, bestF=[];\n bord.forEach(function(fid){\n var p=getPts(fid);\n if(p>best){best=p;bestF=[fid];} else if(p===best) bestF.push(fid);\n });\n return bestF[Math.floor(Math.random()*bestF.length)];\n}\n\nfunction checkElim(){\n FACS.forEach(function(f){\n if(!fActive[f.id]||f.special==='static')return;\n var c=fCells[f.id]?fCells[f.id].size:0;\n if(c===0){\n fElim[f.id]=(fElim[f.id]||0)+1;\n if(fElim[f.id]>=2){ log('\\uD83D\\uDC80 ELIMINATED: '+f.name); fActive[f.id]=false; }\n } else fElim[f.id]=0;\n });\n}\n\nfunction standings(){\n return FACS.filter(function(f){ return fActive[f.id]; })\n .map(function(f){\n return { id:f.id, name:f.name, subfacs:f.subfacs, color:f.color,\n control:boardControl(f.id), cells:(fCells[f.id]?fCells[f.id].size:0),\n relics:relicsHeldBy(f.id), pts:getPts(f.id) };\n })\n .sort(function(a,b){ return b.control-a.control; });\n}\n\nreturn {\n FACS: FACS,\n RELIC_COUNT: RELIC_COUNT,\n ATTACKS_PER_FACTION: ATTACKS_PER_FACTION,\n BUDGET: BUDGET,\n PRESEED_TARGET: PRESEED_TARGET,\n draw: draw,\n save: save,\n load: load,\n generate: generate,\n preseed: preseed,\n advance: advance,\n standings: standings,\n setPts: setPts,\n getPts: getPts,\n setActive: function(id,on){ fActive[id]=!!on; },\n isActive: function(id){ return !!fActive[id]; },\n getRound: function(){ return round; },\n isSeeded: function(){ return seeded; },\n dims: function(){ return { w:GW, h:GH }; },\n relicsWithCustodes: function(){\n var cfi=FACS.findIndex(function(f){return f.id==='custodians';})+1;\n return Array.from(relicSites).filter(function(r){return grid[r]===cfi;}).length;\n },\n getLines: function(){ return lines.slice(); },\n setLogSink: function(fn){ onLog=fn; },\n hasGrid: function(){ return !!grid; }\n};\n\n})();\n`;\n",[],[161,343],"77c90c0a-1646-4506-9ff1-3a119d32b860","db.ts","9a6a2df6-b010-11f1-af0e-1607ee4eb77e",121,["D",1789377747693],6,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword, newId } from \"./crypto.ts\";\n\nexport { sqlite };\n\nexport const STARTING_BALANCE = 1000;\nexport const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14; // 14 days\n\n/** Selling a position back to the house returns this fraction of the stake. */\nexport const SELLBACK_RATE = 0.9;\n\n/**\n * The Overseer's levy on every wager. Taken out of the stake, not the\n * wallet: bid 100 and 100 leaves your purse, 1 is levied, and 99 is what\n * actually sits in the pot and earns you a share of it. The levy leaves\n * circulation entirely; it does not join the pot.\n *\n * The levy always rounds UP to a whole Gelt, so the Overseer is never\n * shorted by a fractional remainder.\n */\nexport const TAX_RATE = 0.01;\n\n/** gross -> { tax, net }. The levy rounds up; the pot gets the rest. */\nexport function applyLevy(gross: number): { tax: number; net: number } {\n const tax = Math.ceil(gross * TAX_RATE);\n return { tax, net: gross - tax };\n}\n\n/**\n * Rounding up means a small enough bid would be entirely consumed by the\n * levy, leaving a position with nothing in the pot. That is not merely\n * useless: a zero stake pays nothing, and if it were the only backing on\n * the winning outcome the pool would read as empty and the whole pot\n * would go to the house instead. So bids below this are refused outright.\n * Derived from the rate rather than hardcoded, so changing TAX_RATE\n * cannot silently reopen the hole.\n */\nexport const MIN_BID = (() => {\n for (let g = 1; g <= 10000; g++) {\n if (g - Math.ceil(g * TAX_RATE) >= 1) return g;\n }\n return 2;\n})();\n\n/**\n * Schema notes\n *\n * This is a parimutuel (pool) market, not a fixed-odds book. Nobody sets\n * payout rates: every stake on a bet goes into one pot, and when the bet\n * resolves the whole pot is split among backers of the winning outcome in\n * proportion to what each of them put in. So odds are an emergent property\n * of where the money sits, and they move as people bet.\n *\n * bets.forfeited holds the 10% skimmed from positions sold back early.\n * It stays in the pot and is paid out to whoever eventually wins, which\n * gives holders a small edge over churners.\n *\n * wagers.status: pending | won | lost | sold | void\n */\n\nconst DDL = [\n `CREATE TABLE IF NOT EXISTS meta (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS users (\n id TEXT PRIMARY KEY,\n username TEXT NOT NULL,\n username_lower TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n balance INTEGER NOT NULL DEFAULT ${STARTING_BALANCE},\n is_admin INTEGER NOT NULL DEFAULT 0,\n wins INTEGER NOT NULL DEFAULT 0,\n losses INTEGER NOT NULL DEFAULT 0,\n failed_attempts INTEGER NOT NULL DEFAULT 0,\n locked_until INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token_hash TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,\n `CREATE TABLE IF NOT EXISTS bets (\n id TEXT PRIMARY KEY,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n status TEXT NOT NULL DEFAULT 'open',\n closes_at INTEGER NOT NULL,\n winning_option_id TEXT,\n forfeited INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL,\n resolved_at INTEGER\n )`,\n `CREATE TABLE IF NOT EXISTS bet_options (\n id TEXT PRIMARY KEY,\n bet_id TEXT NOT NULL,\n label TEXT NOT NULL,\n sort_order INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)`,\n `CREATE TABLE IF NOT EXISTS wagers (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n bet_id TEXT NOT NULL,\n option_id TEXT NOT NULL,\n stake INTEGER NOT NULL,\n tax INTEGER NOT NULL DEFAULT 0,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL,\n settled_at INTEGER\n )`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)`,\n // One snapshot per round of the war engine. Keeping every round means\n // the Overseer can roll back a bad advance instead of rebuilding.\n `CREATE TABLE IF NOT EXISTS campaign_rounds (\n round INTEGER PRIMARY KEY,\n save_code TEXT NOT NULL,\n note TEXT NOT NULL DEFAULT '',\n created_at INTEGER NOT NULL\n )`,\n];\n\nlet readyPromise: Promise | null = null;\n\n/** Idempotent. Safe to await on every request; the work happens once per isolate. */\nexport function ready(): Promise {\n if (!readyPromise) readyPromise = boot();\n return readyPromise;\n}\n\nasync function boot(): Promise {\n for (const stmt of DDL) await sqlite.execute(stmt);\n await migrate();\n await seedAdmin();\n await pruneSessions();\n}\n\nasync function columnsOf(table: string): Promise {\n const res = await sqlite.execute(`PRAGMA table_info(${table})`);\n return res.rows.map((r: any) => String(r.name ?? r[1]));\n}\n\n/**\n * Moves a fixed-odds database (multipliers baked into each option and\n * wager) onto the pool model. Existing rows are preserved.\n */\nasync function migrate(): Promise {\n // bets.forfeited\n const betCols = await columnsOf(\"bets\");\n if (!betCols.includes(\"forfeited\")) {\n await sqlite.execute(\n \"ALTER TABLE bets ADD COLUMN forfeited INTEGER NOT NULL DEFAULT 0\",\n );\n console.log(\"migration: added bets.forfeited\");\n }\n\n // bet_options loses multiplier\n const optCols = await columnsOf(\"bet_options\");\n if (optCols.includes(\"multiplier\")) {\n await sqlite.batch([\n { sql: `CREATE TABLE bet_options_new (\n id TEXT PRIMARY KEY, bet_id TEXT NOT NULL,\n label TEXT NOT NULL, sort_order INTEGER NOT NULL DEFAULT 0)` },\n { sql: `INSERT INTO bet_options_new (id, bet_id, label, sort_order)\n SELECT id, bet_id, label, sort_order FROM bet_options` },\n { sql: `DROP TABLE bet_options` },\n { sql: `ALTER TABLE bet_options_new RENAME TO bet_options` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)` },\n ], \"write\");\n console.log(\"migration: dropped bet_options.multiplier\");\n }\n\n // wagers lose multiplier + potential_return (payouts are now computed at resolve)\n const wagerCols = await columnsOf(\"wagers\");\n if (wagerCols.includes(\"multiplier\") || wagerCols.includes(\"potential_return\")) {\n await sqlite.batch([\n { sql: `CREATE TABLE wagers_new (\n id TEXT PRIMARY KEY, user_id TEXT NOT NULL, bet_id TEXT NOT NULL,\n option_id TEXT NOT NULL, stake INTEGER NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL, settled_at INTEGER)` },\n { sql: `INSERT INTO wagers_new (id, user_id, bet_id, option_id, stake, status, payout, created_at, settled_at)\n SELECT id, user_id, bet_id, option_id, stake, status, payout, created_at, settled_at FROM wagers` },\n { sql: `DROP TABLE wagers` },\n { sql: `ALTER TABLE wagers_new RENAME TO wagers` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)` },\n { sql: `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)` },\n ], \"write\");\n console.log(\"migration: dropped wagers.multiplier and potential_return\");\n }\n\n // wagers.tax: pre-levy wagers simply recorded nothing, which is correct\n // for them since no levy was taken.\n const wagerCols2 = await columnsOf(\"wagers\");\n if (!wagerCols2.includes(\"tax\")) {\n await sqlite.execute(\n \"ALTER TABLE wagers ADD COLUMN tax INTEGER NOT NULL DEFAULT 0\",\n );\n console.log(\"migration: added wagers.tax\");\n }\n\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '3')\",\n args: [],\n });\n}\n\n/**\n * The admin account is created from environment variables, never from\n * source code. If ADMIN_PASSWORD is absent the account is simply not\n * created and the admin panel stays unreachable.\n */\nasync function seedAdmin(): Promise {\n const username = (Deno.env.get(\"ADMIN_USERNAME\") || \"admin\").trim();\n const password = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!password) {\n console.warn(\"ADMIN_PASSWORD not set - no admin account will exist.\");\n return;\n }\n\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n if (existing.rows.length > 0) {\n await sqlite.execute({\n sql: \"UPDATE users SET is_admin = 1 WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n return;\n }\n\n await sqlite.execute({\n sql: `INSERT INTO users\n (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, 0, 1, ?)`,\n args: [\n newId(\"usr\"),\n username,\n username.toLowerCase(),\n await hashPassword(password),\n Date.now(),\n ],\n });\n console.log(`Seeded admin account \"${username}\".`);\n}\n\nasync function pruneSessions(): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE expires_at < ?\",\n args: [Date.now()],\n });\n}\n\nexport type Row = Record;\n\nexport async function queryOne(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows.length ? (res.rows[0] as Row) : null;\n}\n\nexport async function queryAll(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows as Row[];\n}\n\nexport async function run(sql: string, args: any[] = []) {\n return await sqlite.execute({ sql, args });\n}\n",[],[161,351],"95f9c229-6fc1-4ddb-8a5f-ad327142a98d","crypto.ts","8d488cd0-b010-11f1-9715-1607ee4eb77e",["D",1789372056135],"/**\n * Password hashing and token helpers.\n *\n * Passwords are stored as PBKDF2-HMAC-SHA256 digests with a random\n * per-user salt. Nothing reversible ever touches the database.\n * Session tokens are stored as SHA-256 digests, so a database leak\n * does not hand over live sessions.\n */\n\nconst enc = new TextEncoder();\n\nconst PBKDF2_ITERATIONS = 120_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s);\n}\n\nfunction fromB64(s: string): Uint8Array {\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction toHex(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += b.toString(16).padStart(2, \"0\");\n return s;\n}\n\nasync function deriveBits(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Returns a self-describing string: pbkdf2$$$ */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await deriveBits(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const parts = stored.split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const salt = fromB64(parts[2]);\n const expected = fromB64(parts[3]);\n const actual = await deriveBits(password, salt, iterations);\n return timingSafeEqual(actual, expected);\n } catch {\n return false;\n }\n}\n\n/** Comparison whose duration does not depend on where the first mismatch is. */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** 256 bits of CSPRNG output, hex encoded. */\nexport function randomToken(): string {\n return toHex(crypto.getRandomValues(new Uint8Array(32)));\n}\n\nexport function newId(prefix: string): string {\n return prefix + \"_\" + toHex(crypto.getRandomValues(new Uint8Array(9)));\n}\n\nexport async function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", enc.encode(input));\n return toHex(new Uint8Array(digest));\n}\n",[],[161,360],"79233704-83fc-451a-a0f1-79fc7cce376c","auth.ts","a6009bbe-b010-11f1-9806-1607ee4eb77e",4,["D",1789372097607],"import type { Context, Next } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { queryOne, run, SESSION_TTL_MS } from \"./db.ts\";\nimport { randomToken, sha256Hex } from \"./crypto.ts\";\n\nexport const COOKIE_NAME = \"tl_session\";\n\n/** Failed logins lock the account briefly. Blunt, but it kills guessing. */\nexport const MAX_FAILED_ATTEMPTS = 8;\nexport const LOCKOUT_MS = 1000 * 60 * 10; // 10 minutes\n\nexport interface SessionUser {\n id: string;\n username: string;\n balance: number;\n is_admin: number;\n wins: number;\n losses: number;\n}\n\nexport async function createSession(c: Context, userId: string): Promise {\n const token = randomToken();\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n\n await run(\n `INSERT INTO sessions (token_hash, user_id, created_at, expires_at)\n VALUES (?, ?, ?, ?)`,\n [tokenHash, userId, now, now + SESSION_TTL_MS],\n );\n\n setCookie(c, COOKIE_NAME, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: Math.floor(SESSION_TTL_MS / 1000),\n });\n}\n\nexport async function destroySession(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (token) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [\n await sha256Hex(token),\n ]);\n }\n deleteCookie(c, COOKIE_NAME, { path: \"/\" });\n}\n\n/** Resolves the cookie to a user, or null. Expired sessions are swept. */\nexport async function currentUser(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (!token) return null;\n\n const tokenHash = await sha256Hex(token);\n const row = await queryOne(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, s.expires_at\n FROM sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n\n if (!row) return null;\n if (Number(row.expires_at) < Date.now()) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [tokenHash]);\n return null;\n }\n\n return {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n is_admin: Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n };\n}\n\nexport async function requireUser(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n c.set(\"user\", user);\n await next();\n}\n\nexport async function requireAdmin(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n if (!user.is_admin) return c.json({ error: \"Overseer clearance required.\" }, 403);\n c.set(\"user\", user);\n await next();\n}\n\n/**\n * Cross-site request guard. The session cookie is SameSite=Lax, which\n * already blocks cross-site POSTs, but browsers are not the only clients\n * and defence in depth is cheap.\n */\nexport async function sameOriginOnly(c: Context, next: Next) {\n const method = c.req.method.toUpperCase();\n if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n return await next();\n }\n const origin = c.req.header(\"origin\");\n if (origin) {\n try {\n if (new URL(origin).host !== new URL(c.req.url).host) {\n return c.json({ error: \"Cross-origin request refused.\" }, 403);\n }\n } catch {\n return c.json({ error: \"Malformed origin.\" }, 403);\n }\n }\n await next();\n}\n\nexport function isLockedOut(row: { locked_until?: any }): boolean {\n return Number(row.locked_until || 0) > Date.now();\n}\n\nexport async function recordFailedLogin(userId: string, attempts: number) {\n const next = attempts + 1;\n const lockUntil = next >= MAX_FAILED_ATTEMPTS ? Date.now() + LOCKOUT_MS : 0;\n await run(\n \"UPDATE users SET failed_attempts = ?, locked_until = ? WHERE id = ?\",\n [next >= MAX_FAILED_ATTEMPTS ? 0 : next, lockUntil, userId],\n );\n}\n\nexport async function clearFailedLogins(userId: string) {\n await run(\n \"UPDATE users SET failed_attempts = 0, locked_until = 0 WHERE id = ?\",\n [userId],\n );\n}\n",[],[161,367],"ebe9e1fd-4c12-4733-b147-a9e145c9ad43",["D",1789377753466],12,[],[161,33],["D",1789372056135],[178,179,180,181,182,183],[161],["D",1789371999223],["D",1789546246980],{"_101":100,"_109":105},{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"ctx",{"_83":-5,"_129":420,"_421":422,"_423":424,"_425":25,"_426":25,"_427":25,"_428":60,"_429":-5,"_430":-7,"_431":-7,"_432":64,"_433":25,"_434":25,"_435":-5,"_436":25,"_437":25,"_438":25,"_439":-5},"ENV",{"_391":392,"_393":394,"_395":91,"_396":397,"_398":399,"_400":401,"_402":403,"_404":405,"_406":407,"_408":409,"_410":411,"_412":413,"_414":415,"_416":417,"_418":419},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Operative Authentication

Diff · v122