Throne Ledger — Battle for the Hive

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_236":237,"_238":239},"routes/_app.x.$handle.$name",{"_105":104,"_32":50,"_114":95,"_27":115,"_13":14,"_116":-5,"_11":117,"_118":119,"_120":121,"_122":123,"_124":125,"_21":-5,"_126":-5,"_127":-5,"_128":25,"_129":130,"_131":64,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_48":49,"_32":50,"_36":51,"_52":-5,"_53":25,"_54":55,"_56":55,"_57":58,"_59":-5,"_18":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":25},"version",8,"changes",[19,20],"aiChatInfo","userId",{"_21":41,"_23":-7,"_24":25,"_26":25,"_27":42,"_29":42},{"_21":22,"_23":-7,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":-5,"_36":37,"_38":14,"_39":40,"_24":25},"previous","deleted",false,"deletedHere","path","scripts","latestPath","fileId","e271c1d7-6014-4994-8caa-07e909b081d1","name","fileType","directory","content","createdAt",["D",1789372426992],"branchVersion","branchId","649b81a3-ef64-48e6-b6db-ab0a767348e2",{"_30":43,"_32":44,"_33":45,"_35":46,"_36":47,"_38":14,"_39":40,"_24":25},"scripts/selftest.ts","6a5524b2-b011-11f1-b315-1607ee4eb77e","selftest.ts","script","/**\n * End-to-end exercise of the ledger's HTTP surface.\n * Run with run_file. Creates throwaway accounts and a throwaway bet,\n * then cleans up after itself.\n */\n\nconst BASE = \"https://rt_brandt--6b608f96b01011f195521607ee4eb77e.web.val.run\";\n\ntype Jar = { cookie: string };\n\nasync function call(\n jar: Jar | null,\n method: string,\n path: string,\n body?: unknown,\n): Promise<{ status: number; data: any }> {\n const headers: Record = {};\n if (body !== undefined) headers[\"Content-Type\"] = \"application/json\";\n if (jar?.cookie) headers[\"Cookie\"] = jar.cookie;\n\n const res = await fetch(BASE + path, {\n method,\n headers,\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n\n if (jar) {\n const set = res.headers.getSetCookie?.() ?? [];\n for (const sc of set) {\n const pair = sc.split(\";\")[0];\n if (pair.startsWith(\"tl_session=\")) jar.cookie = pair;\n }\n }\n\n let data: any = null;\n try { data = await res.json(); } catch { data = null; }\n return { status: res.status, data };\n}\n\nconst results: string[] = [];\nlet pass = 0, fail = 0;\n\nfunction check(name: string, ok: boolean, detail = \"\") {\n if (ok) { pass++; results.push(\" PASS \" + name); }\n else { fail++; results.push(\" FAIL \" + name + (detail ? \" -> \" + detail : \"\")); }\n}\n\nexport default async function selftest() {\n const stamp = Date.now().toString(36);\n const alice = { user: \"tst_a_\" + stamp, pass: \"correct-horse-1\" };\n const bob = { user: \"tst_b_\" + stamp, pass: \"correct-horse-2\" };\n const aliceJar: Jar = { cookie: \"\" };\n const bobJar: Jar = { cookie: \"\" };\n const adminJar: Jar = { cookie: \"\" };\n\n // ── registration ────────────────────────────────────────────────\n let r = await call(aliceJar, \"POST\", \"/api/register\", alice);\n check(\"register alice\", r.status === 200 && r.data?.user?.balance === 1000,\n JSON.stringify(r.data));\n\n r = await call(bobJar, \"POST\", \"/api/register\", bob);\n check(\"register bob\", r.status === 200, JSON.stringify(r.data));\n\n r = await call(null, \"POST\", \"/api/register\", alice);\n check(\"duplicate handle refused\", r.status === 409);\n\n r = await call(null, \"POST\", \"/api/register\", { username: \"ab\", password: \"longenough1\" });\n check(\"short handle refused\", r.status === 400);\n\n r = await call(null, \"POST\", \"/api/register\", { username: \"goodname\", password: \"short\" });\n check(\"short passphrase refused\", r.status === 400);\n\n // ── login ───────────────────────────────────────────────────────\n r = await call(null, \"POST\", \"/api/login\", { username: alice.user, password: \"wrongpass123\" });\n check(\"wrong passphrase rejected\", r.status === 401);\n\n r = await call(null, \"POST\", \"/api/login\", { username: \"ghost_\" + stamp, password: \"whatever1\" });\n check(\"unknown handle rejected\", r.status === 401);\n\n // ── admin ───────────────────────────────────────────────────────\n const adminUser = Deno.env.get(\"ADMIN_USERNAME\") || \"admin\";\n const adminPass = Deno.env.get(\"ADMIN_PASSWORD\") || \"\";\n r = await call(adminJar, \"POST\", \"/api/login\", { username: adminUser, password: adminPass });\n check(\"admin login\", r.status === 200 && r.data?.user?.isAdmin === true, JSON.stringify(r.data));\n\n r = await call(aliceJar, \"GET\", \"/api/admin/users\");\n check(\"non-admin blocked from admin route\", r.status === 403);\n\n r = await call(null, \"GET\", \"/api/admin/users\");\n check(\"anonymous blocked from admin route\", r.status === 401);\n\n // ── create a bet ────────────────────────────────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/bets\", {\n title: \"SELFTEST \" + stamp,\n description: \"throwaway\",\n durationMinutes: 60,\n options: [\n { label: \"Yes\", multiplier: 2.0 },\n { label: \"No\", multiplier: 1.5 },\n ],\n });\n check(\"admin creates bet\", r.status === 200 && !!r.data?.betId, JSON.stringify(r.data));\n const betId = r.data?.betId;\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets\", {\n title: \"bad odds\", durationMinutes: 60,\n options: [{ label: \"a\", multiplier: 0.5 }, { label: \"b\", multiplier: 2 }],\n });\n check(\"multiplier below 1.01 refused\", r.status === 400);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets\", {\n title: \"one option\", durationMinutes: 60,\n options: [{ label: \"only\", multiplier: 2 }],\n });\n check(\"single-option bet refused\", r.status === 400);\n\n r = await call(aliceJar, \"POST\", \"/api/admin/bets\", {\n title: \"sneaky\", durationMinutes: 60,\n options: [{ label: \"a\", multiplier: 2 }, { label: \"b\", multiplier: 2 }],\n });\n check(\"non-admin cannot create bets\", r.status === 403);\n\n // ── find our options ────────────────────────────────────────────\n r = await call(aliceJar, \"GET\", \"/api/bets\");\n const bet = (r.data?.bets || []).find((b: any) => b.id === betId);\n check(\"bet visible in listing\", !!bet && bet.options.length === 2);\n const yesId = bet?.options.find((o: any) => o.label === \"Yes\")?.id;\n const noId = bet?.options.find((o: any) => o.label === \"No\")?.id;\n\n // ── wagering ────────────────────────────────────────────────────\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: 400 });\n check(\"alice backs Yes with 400\", r.status === 200 && r.data?.balance === 600,\n JSON.stringify(r.data));\n check(\"potential return floors to 800\", r.data?.potentialReturn === 800);\n\n r = await call(bobJar, \"POST\", \"/api/wagers\", { betId, optionId: noId, stake: 300 });\n check(\"bob backs No with 300\", r.status === 200 && r.data?.balance === 700);\n\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: 99999 });\n check(\"overdraft refused\", r.status === 409, JSON.stringify(r.data));\n\n r = await call(aliceJar, \"GET\", \"/api/me\");\n check(\"balance unchanged after failed overdraft\", r.data?.user?.balance === 600,\n JSON.stringify(r.data?.user));\n\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: -50 });\n check(\"negative stake refused\", r.status === 400);\n\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: 10.5 });\n check(\"fractional stake refused\", r.status === 400);\n\n r = await call(null, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: 10 });\n check(\"anonymous cannot wager\", r.status === 401);\n\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: \"opt_bogus\", stake: 10 });\n check(\"bogus option refused\", r.status === 404);\n\n // ── closing shuts betting ───────────────────────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/close\", {});\n check(\"admin closes betting\", r.status === 200);\n\n r = await call(aliceJar, \"POST\", \"/api/wagers\", { betId, optionId: yesId, stake: 10 });\n check(\"wager after close refused\", r.status === 409, JSON.stringify(r.data));\n\n // ── resolve ─────────────────────────────────────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: yesId });\n check(\"admin resolves bet\", r.status === 200, JSON.stringify(r.data));\n check(\"one winner paid 800\", r.data?.winnersPaid === 1 && r.data?.totalPaid === 800,\n JSON.stringify(r.data));\n\n r = await call(aliceJar, \"GET\", \"/api/me\");\n check(\"winner balance 600 + 800 = 1400\", r.data?.user?.balance === 1400,\n JSON.stringify(r.data?.user));\n check(\"winner record 1W/0L\", r.data?.user?.wins === 1 && r.data?.user?.losses === 0);\n\n r = await call(bobJar, \"GET\", \"/api/me\");\n check(\"loser balance stays 700 (stake not returned)\", r.data?.user?.balance === 700,\n JSON.stringify(r.data?.user));\n check(\"loser record 0W/1L\", r.data?.user?.wins === 0 && r.data?.user?.losses === 1);\n\n r = await call(adminJar, \"POST\", \"/api/admin/bets/\" + betId + \"/resolve\",\n { winningOptionId: noId });\n check(\"double resolve refused\", r.status === 409);\n\n // ── treasury ────────────────────────────────────────────────────\n r = await call(adminJar, \"POST\", \"/api/admin/fund\", { amount: 500 });\n check(\"fund all succeeds\", r.status === 200 && r.data?.accounts >= 2, JSON.stringify(r.data));\n\n r = await call(aliceJar, \"GET\", \"/api/me\");\n check(\"alice funded to 1900\", r.data?.user?.balance === 1900, JSON.stringify(r.data?.user));\n\n r = await call(aliceJar, \"POST\", \"/api/admin/fund\", { amount: 999999 });\n check(\"non-admin cannot fund\", r.status === 403);\n\n // ── session lifecycle ───────────────────────────────────────────\n r = await call(bobJar, \"POST\", \"/api/logout\", {});\n check(\"logout succeeds\", r.status === 200);\n r = await call(bobJar, \"GET\", \"/api/me\");\n check(\"session dead after logout\", r.data?.user === null);\n\n // ── deletion + cleanup ──────────────────────────────────────────\n r = await call(adminJar, \"GET\", \"/api/admin/users\");\n const aliceRow = (r.data?.users || []).find((u: any) => u.username === alice.user);\n const bobRow = (r.data?.users || []).find((u: any) => u.username === bob.user);\n const adminRow = (r.data?.users || []).find((u: any) => u.isAdmin);\n check(\"admin sees accounts\", !!aliceRow && !!bobRow);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/users/\" + adminRow?.id);\n check(\"admin cannot delete an overseer account\", r.status === 400);\n\n r = await call(adminJar, \"DELETE\", \"/api/admin/users/\" + aliceRow?.id);\n check(\"delete alice\", r.status === 200, JSON.stringify(r.data));\n r = await call(adminJar, \"DELETE\", \"/api/admin/users/\" + bobRow?.id);\n check(\"delete bob\", r.status === 200);\n\n r = await call(aliceJar, \"GET\", \"/api/me\");\n check(\"deleted user's session no longer resolves\", r.data?.user === null);\n\n return [\n \"\",\n \"THRONE LEDGER SELF TEST\",\n \"=======================\",\n ...results,\n \"\",\n `${pass} passed, ${fail} failed`,\n \"\",\n ].join(\"\\n\");\n}\n",["D",1789372426992],"id","3acf27cf-bc0f-4f45-b440-a47608349aee","throne-ledger",["D",1789371999223],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger for the Battle for the Hive campaign","imageUrl","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","6b608f96-b010-11f1-9552-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","3acf27cfbc0f4f45b440a47608349aee","tursoHostname","3acf27cfbc0f4f45b440a47608349aee-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789459281818],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_105":104,"_113":109},"org",{"_105":104,"_106":107,"_108":109,"_18":60,"_110":111,"_112":25},"branch",{"_13":94,"_32":95,"_48":40,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"isOwned",173,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","RT_Brandt","handle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_48":49,"_32":50,"_36":231,"_52":-5,"_53":25,"_54":55,"_56":55,"_57":58,"_59":-5,"_18":60,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":232,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":233,"_89":234,"_91":235,"_93":25},"tree",[169,175,177],"files",[169,170,171,172,173,174,175,176,177],"counts",{"_159":68,"_160":145,"_161":68,"_162":163,"_164":165},"contents",[136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_48":153,"_32":154,"_30":155,"_141":-5,"_39":40,"_38":156,"_143":64,"_36":157,"_13":68,"_33":34,"_35":-5,"_24":25,"_148":-5,"_27":158},{"_48":150,"_32":28,"_30":31,"_141":-5,"_39":40,"_38":14,"_143":64,"_36":151,"_13":68,"_33":34,"_35":-5,"_24":25,"_148":-5,"_27":152},{"_48":139,"_32":140,"_30":62,"_141":-5,"_39":40,"_38":142,"_143":25,"_36":144,"_13":145,"_33":146,"_35":147,"_24":25,"_148":50,"_27":149},"036e74ea-1314-4199-a0a0-3a127c5374c3","main.tsx","parentId",7,"latest",["D",1789372307106],1,"http","import { Hono } from \"npm:hono\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { api } from \"./lib/api.ts\";\nimport { PAGE } from \"./lib/ui.ts\";\nimport { ready } from \"./lib/db.ts\";\n\nconst app = new Hono();\n\napp.route(\"/api\", api);\n\napp.get(\"/\", async (c) => {\n await ready();\n return c.html(PAGE);\n});\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Surface real stack traces instead of a generic 500.\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","label",[140],"da4bc700-988d-495b-a48f-a8b28fb515c7",["D",1789372426992],[28],"d40104bc-606a-4d76-b529-424870d4ebb7","lib","36d116d1-be79-439b-af80-39fd2bb6eeb1",2,["D",1789372056135],[154],"pulls","branches","forks","envVars",{"_166":156,"_168":68},"connections",{"_166":68,"_167":68},"count","unfilledCount","emptyCount",{"_48":153,"_32":154,"_30":155,"_141":-5,"_39":40,"_38":156,"_143":64,"_36":228,"_13":68,"_33":34,"_35":-5,"_24":25,"_148":-5,"_179":229,"_27":230},{"_48":220,"_32":221,"_30":222,"_141":155,"_39":40,"_38":223,"_143":25,"_36":224,"_13":68,"_33":45,"_35":225,"_24":25,"_148":-5,"_179":226,"_27":227},{"_48":212,"_32":213,"_30":214,"_141":155,"_39":40,"_38":215,"_143":64,"_36":216,"_13":68,"_33":45,"_35":217,"_24":25,"_148":-5,"_179":218,"_27":219},{"_48":205,"_32":206,"_30":207,"_141":155,"_39":40,"_38":156,"_143":64,"_36":208,"_13":68,"_33":45,"_35":209,"_24":25,"_148":-5,"_179":210,"_27":211},{"_48":197,"_32":198,"_30":199,"_141":155,"_39":40,"_38":200,"_143":25,"_36":201,"_13":68,"_33":45,"_35":202,"_24":25,"_148":-5,"_179":203,"_27":204},{"_48":189,"_32":190,"_30":191,"_141":155,"_39":40,"_38":192,"_143":25,"_36":193,"_13":68,"_33":45,"_35":194,"_24":25,"_148":-5,"_179":195,"_27":196},{"_48":150,"_32":28,"_30":31,"_141":-5,"_39":40,"_38":14,"_143":64,"_36":186,"_13":68,"_33":34,"_35":-5,"_24":25,"_148":-5,"_179":187,"_27":188},{"_48":182,"_32":44,"_30":43,"_141":31,"_39":40,"_38":14,"_143":25,"_36":183,"_13":68,"_33":45,"_35":46,"_24":25,"_148":-5,"_179":184,"_27":185},{"_48":139,"_32":140,"_30":62,"_141":-5,"_39":40,"_38":142,"_143":25,"_36":178,"_13":145,"_33":146,"_35":147,"_24":25,"_148":50,"_179":180,"_27":181},["D",1789372307106],"children",[],[140],"53c56fc1-3260-48f0-b92e-660643273b7d",["D",1789372426992],[],[28,44],["D",1789372426992],[176],[28],"2cc5445c-8201-4a70-a25b-80297a48dc55","ui.ts","1f431eca-b011-11f1-9e31-1607ee4eb77e",6,["D",1789372301052],"export const PAGE = `\n\n\n\n\nThrone Ledger — Battle for the Hive\n\n\n\n\n\n\n\n

Throne LedgerWarrant of Von Brandt · Hive Solenne

\n\n \n

\n\n\n\n\n\n`;\n",[],[154,190],"30e10629-d3d2-44fe-991e-c37d072b647d","db.ts","9a6a2df6-b010-11f1-af0e-1607ee4eb77e",3,["D",1789372078163],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { hashPassword, newId } from \"./crypto.ts\";\n\nexport { sqlite };\n\nexport const STARTING_BALANCE = 1000;\nexport const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14; // 14 days\n\nconst DDL = [\n `CREATE TABLE IF NOT EXISTS users (\n id TEXT PRIMARY KEY,\n username TEXT NOT NULL,\n username_lower TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n balance INTEGER NOT NULL DEFAULT ${STARTING_BALANCE},\n is_admin INTEGER NOT NULL DEFAULT 0,\n wins INTEGER NOT NULL DEFAULT 0,\n losses INTEGER NOT NULL DEFAULT 0,\n failed_attempts INTEGER NOT NULL DEFAULT 0,\n locked_until INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token_hash TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n expires_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_user ON sessions(user_id)`,\n `CREATE TABLE IF NOT EXISTS bets (\n id TEXT PRIMARY KEY,\n title TEXT NOT NULL,\n description TEXT NOT NULL DEFAULT '',\n status TEXT NOT NULL DEFAULT 'open',\n closes_at INTEGER NOT NULL,\n winning_option_id TEXT,\n created_at INTEGER NOT NULL,\n resolved_at INTEGER\n )`,\n `CREATE TABLE IF NOT EXISTS bet_options (\n id TEXT PRIMARY KEY,\n bet_id TEXT NOT NULL,\n label TEXT NOT NULL,\n multiplier REAL NOT NULL,\n sort_order INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE INDEX IF NOT EXISTS idx_options_bet ON bet_options(bet_id)`,\n `CREATE TABLE IF NOT EXISTS wagers (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n bet_id TEXT NOT NULL,\n option_id TEXT NOT NULL,\n stake INTEGER NOT NULL,\n multiplier REAL NOT NULL,\n potential_return INTEGER NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n payout INTEGER NOT NULL DEFAULT 0,\n created_at INTEGER NOT NULL,\n settled_at INTEGER\n )`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_bet ON wagers(bet_id)`,\n `CREATE INDEX IF NOT EXISTS idx_wagers_user ON wagers(user_id)`,\n];\n\nlet readyPromise: Promise | null = null;\n\n/** Idempotent. Safe to await on every request; the work happens once per isolate. */\nexport function ready(): Promise {\n if (!readyPromise) readyPromise = boot();\n return readyPromise;\n}\n\nasync function boot(): Promise {\n for (const stmt of DDL) await sqlite.execute(stmt);\n await seedAdmin();\n await pruneSessions();\n}\n\n/**\n * The admin account is created from environment variables, never from\n * source code. If ADMIN_PASSWORD is absent the account is simply not\n * created and the admin panel stays unreachable.\n */\nasync function seedAdmin(): Promise {\n const username = (Deno.env.get(\"ADMIN_USERNAME\") || \"admin\").trim();\n const password = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!password) {\n console.warn(\"ADMIN_PASSWORD not set - no admin account will exist.\");\n return;\n }\n\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n if (existing.rows.length > 0) {\n // Make sure the account still carries the admin flag.\n await sqlite.execute({\n sql: \"UPDATE users SET is_admin = 1 WHERE username_lower = ?\",\n args: [username.toLowerCase()],\n });\n return;\n }\n\n await sqlite.execute({\n sql: `INSERT INTO users\n (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, 0, 1, ?)`,\n args: [\n newId(\"usr\"),\n username,\n username.toLowerCase(),\n await hashPassword(password),\n Date.now(),\n ],\n });\n console.log(`Seeded admin account \"${username}\".`);\n}\n\nasync function pruneSessions(): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE expires_at < ?\",\n args: [Date.now()],\n });\n}\n\nexport type Row = Record;\n\nexport async function queryOne(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows.length ? (res.rows[0] as Row) : null;\n}\n\nexport async function queryAll(sql: string, args: any[] = []): Promise {\n const res = await sqlite.execute({ sql, args });\n return res.rows as Row[];\n}\n\nexport async function run(sql: string, args: any[] = []) {\n return await sqlite.execute({ sql, args });\n}\n",[],[154,198],"95f9c229-6fc1-4ddb-8a5f-ad327142a98d","crypto.ts","8d488cd0-b010-11f1-9715-1607ee4eb77e",["D",1789372056135],"/**\n * Password hashing and token helpers.\n *\n * Passwords are stored as PBKDF2-HMAC-SHA256 digests with a random\n * per-user salt. Nothing reversible ever touches the database.\n * Session tokens are stored as SHA-256 digests, so a database leak\n * does not hand over live sessions.\n */\n\nconst enc = new TextEncoder();\n\nconst PBKDF2_ITERATIONS = 120_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s);\n}\n\nfunction fromB64(s: string): Uint8Array {\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\n\nfunction toHex(bytes: Uint8Array): string {\n let s = \"\";\n for (const b of bytes) s += b.toString(16).padStart(2, \"0\");\n return s;\n}\n\nasync function deriveBits(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Returns a self-describing string: pbkdf2$$$ */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await deriveBits(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const parts = stored.split(\"$\");\n if (parts.length !== 4 || parts[0] !== \"pbkdf2\") return false;\n const iterations = parseInt(parts[1], 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const salt = fromB64(parts[2]);\n const expected = fromB64(parts[3]);\n const actual = await deriveBits(password, salt, iterations);\n return timingSafeEqual(actual, expected);\n } catch {\n return false;\n }\n}\n\n/** Comparison whose duration does not depend on where the first mismatch is. */\nexport function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** 256 bits of CSPRNG output, hex encoded. */\nexport function randomToken(): string {\n return toHex(crypto.getRandomValues(new Uint8Array(32)));\n}\n\nexport function newId(prefix: string): string {\n return prefix + \"_\" + toHex(crypto.getRandomValues(new Uint8Array(9)));\n}\n\nexport async function sha256Hex(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", enc.encode(input));\n return toHex(new Uint8Array(digest));\n}\n",[],[154,206],"79233704-83fc-451a-a0f1-79fc7cce376c","auth.ts","a6009bbe-b010-11f1-9806-1607ee4eb77e",4,["D",1789372097607],"import type { Context, Next } from \"npm:hono\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono/cookie\";\nimport { queryOne, run, SESSION_TTL_MS } from \"./db.ts\";\nimport { randomToken, sha256Hex } from \"./crypto.ts\";\n\nexport const COOKIE_NAME = \"tl_session\";\n\n/** Failed logins lock the account briefly. Blunt, but it kills guessing. */\nexport const MAX_FAILED_ATTEMPTS = 8;\nexport const LOCKOUT_MS = 1000 * 60 * 10; // 10 minutes\n\nexport interface SessionUser {\n id: string;\n username: string;\n balance: number;\n is_admin: number;\n wins: number;\n losses: number;\n}\n\nexport async function createSession(c: Context, userId: string): Promise {\n const token = randomToken();\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n\n await run(\n `INSERT INTO sessions (token_hash, user_id, created_at, expires_at)\n VALUES (?, ?, ?, ?)`,\n [tokenHash, userId, now, now + SESSION_TTL_MS],\n );\n\n setCookie(c, COOKIE_NAME, token, {\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n path: \"/\",\n maxAge: Math.floor(SESSION_TTL_MS / 1000),\n });\n}\n\nexport async function destroySession(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (token) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [\n await sha256Hex(token),\n ]);\n }\n deleteCookie(c, COOKIE_NAME, { path: \"/\" });\n}\n\n/** Resolves the cookie to a user, or null. Expired sessions are swept. */\nexport async function currentUser(c: Context): Promise {\n const token = getCookie(c, COOKIE_NAME);\n if (!token) return null;\n\n const tokenHash = await sha256Hex(token);\n const row = await queryOne(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, s.expires_at\n FROM sessions s\n JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n\n if (!row) return null;\n if (Number(row.expires_at) < Date.now()) {\n await run(\"DELETE FROM sessions WHERE token_hash = ?\", [tokenHash]);\n return null;\n }\n\n return {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n is_admin: Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n };\n}\n\nexport async function requireUser(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n c.set(\"user\", user);\n await next();\n}\n\nexport async function requireAdmin(c: Context, next: Next) {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Authentication required.\" }, 401);\n if (!user.is_admin) return c.json({ error: \"Overseer clearance required.\" }, 403);\n c.set(\"user\", user);\n await next();\n}\n\n/**\n * Cross-site request guard. The session cookie is SameSite=Lax, which\n * already blocks cross-site POSTs, but browsers are not the only clients\n * and defence in depth is cheap.\n */\nexport async function sameOriginOnly(c: Context, next: Next) {\n const method = c.req.method.toUpperCase();\n if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n return await next();\n }\n const origin = c.req.header(\"origin\");\n if (origin) {\n try {\n if (new URL(origin).host !== new URL(c.req.url).host) {\n return c.json({ error: \"Cross-origin request refused.\" }, 403);\n }\n } catch {\n return c.json({ error: \"Malformed origin.\" }, 403);\n }\n }\n await next();\n}\n\nexport function isLockedOut(row: { locked_until?: any }): boolean {\n return Number(row.locked_until || 0) > Date.now();\n}\n\nexport async function recordFailedLogin(userId: string, attempts: number) {\n const next = attempts + 1;\n const lockUntil = next >= MAX_FAILED_ATTEMPTS ? Date.now() + LOCKOUT_MS : 0;\n await run(\n \"UPDATE users SET failed_attempts = ?, locked_until = ? WHERE id = ?\",\n [next >= MAX_FAILED_ATTEMPTS ? 0 : next, lockUntil, userId],\n );\n}\n\nexport async function clearFailedLogins(userId: string) {\n await run(\n \"UPDATE users SET failed_attempts = 0, locked_until = 0 WHERE id = ?\",\n [userId],\n );\n}\n",[],[154,213],"1d4bbff2-54a8-4c2c-8b3a-fd5c36b44e28","api.ts","d9426dd6-b010-11f1-9d52-1607ee4eb77e",5,["D",1789372183603],"import { Hono } from \"npm:hono\";\nimport {\n queryAll,\n queryOne,\n ready,\n run,\n sqlite,\n STARTING_BALANCE,\n} from \"./db.ts\";\nimport { hashPassword, newId, verifyPassword } from \"./crypto.ts\";\nimport {\n clearFailedLogins,\n createSession,\n currentUser,\n destroySession,\n isLockedOut,\n recordFailedLogin,\n requireAdmin,\n requireUser,\n sameOriginOnly,\n type SessionUser,\n} from \"./auth.ts\";\n\nexport const api = new Hono();\n\napi.use(\"*\", async (c, next) => {\n await ready();\n await next();\n});\napi.use(\"*\", sameOriginOnly);\n\n// ─── validation ──────────────────────────────────────────────────────\nconst USERNAME_RE = /^[A-Za-z0-9_-]{3,24}$/;\nconst MIN_PASSWORD = 8;\n\nfunction bad(c: any, msg: string, code = 400) {\n return c.json({ error: msg }, code);\n}\n\nasync function body(c: any): Promise> {\n try {\n const b = await c.req.json();\n return b && typeof b === \"object\" ? b : {};\n } catch {\n return {};\n }\n}\n\nfunction publicUser(u: SessionUser) {\n return {\n id: u.id,\n username: u.username,\n balance: u.balance,\n isAdmin: !!u.is_admin,\n wins: u.wins,\n losses: u.losses,\n };\n}\n\n/** A bet is bettable only while open AND before its close time. */\nfunction effectiveStatus(bet: any, now: number): string {\n if (bet.status === \"resolved\") return \"resolved\";\n if (Number(bet.closes_at) <= now) return \"closed\";\n return \"open\";\n}\n\n// ─── auth ────────────────────────────────────────────────────────────\n\napi.post(\"/register\", async (c) => {\n const { username, password } = await body(c);\n\n if (typeof username !== \"string\" || !USERNAME_RE.test(username.trim())) {\n return bad(c, \"Handle must be 3-24 characters: letters, numbers, _ or - only.\");\n }\n if (typeof password !== \"string\" || password.length < MIN_PASSWORD) {\n return bad(c, `Passphrase must be at least ${MIN_PASSWORD} characters.`);\n }\n if (password.length > 200) return bad(c, \"Passphrase too long.\");\n\n const name = username.trim();\n const lower = name.toLowerCase();\n\n const clash = await queryOne(\n \"SELECT id FROM users WHERE username_lower = ?\",\n [lower],\n );\n if (clash) return bad(c, \"That handle is already registered.\", 409);\n\n const id = newId(\"usr\");\n try {\n await run(\n `INSERT INTO users (id, username, username_lower, password_hash, balance, is_admin, created_at)\n VALUES (?, ?, ?, ?, ?, 0, ?)`,\n [id, name, lower, await hashPassword(password), STARTING_BALANCE, Date.now()],\n );\n } catch {\n // UNIQUE violation from a concurrent signup\n return bad(c, \"That handle is already registered.\", 409);\n }\n\n await createSession(c, id);\n return c.json({\n user: {\n id,\n username: name,\n balance: STARTING_BALANCE,\n isAdmin: false,\n wins: 0,\n losses: 0,\n },\n });\n});\n\napi.post(\"/login\", async (c) => {\n const { username, password } = await body(c);\n if (typeof username !== \"string\" || typeof password !== \"string\") {\n return bad(c, \"Handle and passphrase required.\");\n }\n\n const row = await queryOne(\n `SELECT id, username, password_hash, balance, is_admin, wins, losses,\n failed_attempts, locked_until\n FROM users WHERE username_lower = ?`,\n [username.trim().toLowerCase()],\n );\n\n // Same response whether the handle exists or the passphrase is wrong.\n const REJECT = \"Authentication rejected.\";\n\n if (!row) {\n // Burn comparable time so absence isn't detectable by response speed.\n await verifyPassword(password, \"pbkdf2$120000$AAAAAAAAAAAAAAAAAAAAAA==$AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=\");\n return bad(c, REJECT, 401);\n }\n\n if (isLockedOut(row)) {\n return bad(c, \"Too many failed attempts. Try again in a few minutes.\", 429);\n }\n\n const ok = await verifyPassword(password, String(row.password_hash));\n if (!ok) {\n await recordFailedLogin(String(row.id), Number(row.failed_attempts || 0));\n return bad(c, REJECT, 401);\n }\n\n await clearFailedLogins(String(row.id));\n await createSession(c, String(row.id));\n\n return c.json({\n user: {\n id: String(row.id),\n username: String(row.username),\n balance: Number(row.balance),\n isAdmin: !!Number(row.is_admin),\n wins: Number(row.wins),\n losses: Number(row.losses),\n },\n });\n});\n\napi.post(\"/logout\", async (c) => {\n await destroySession(c);\n return c.json({ ok: true });\n});\n\napi.get(\"/me\", async (c) => {\n const user = await currentUser(c);\n return c.json({ user: user ? publicUser(user) : null });\n});\n\n// ─── bets ────────────────────────────────────────────────────────────\n\napi.get(\"/bets\", async (c) => {\n const user = await currentUser(c);\n const now = Date.now();\n\n const bets = await queryAll(\"SELECT * FROM bets ORDER BY created_at DESC\");\n const options = await queryAll(\n `SELECT o.id, o.bet_id, o.label, o.multiplier, o.sort_order,\n COALESCE(SUM(w.stake), 0) AS pool,\n COUNT(w.id) AS backers\n FROM bet_options o\n LEFT JOIN wagers w ON w.option_id = o.id\n GROUP BY o.id\n ORDER BY o.sort_order`,\n );\n\n const mine = user\n ? await queryAll(\n `SELECT id, bet_id, option_id, stake, multiplier, potential_return, status, payout, created_at\n FROM wagers WHERE user_id = ? ORDER BY created_at DESC`,\n [user.id],\n )\n : [];\n\n const byBet: Record = {};\n for (const o of options) {\n (byBet[String(o.bet_id)] ||= []).push({\n id: o.id,\n label: o.label,\n multiplier: Number(o.multiplier),\n pool: Number(o.pool),\n backers: Number(o.backers),\n });\n }\n\n const mineByBet: Record = {};\n for (const w of mine) {\n (mineByBet[String(w.bet_id)] ||= []).push({\n id: w.id,\n optionId: w.option_id,\n stake: Number(w.stake),\n multiplier: Number(w.multiplier),\n potentialReturn: Number(w.potential_return),\n status: w.status,\n payout: Number(w.payout),\n createdAt: Number(w.created_at),\n });\n }\n\n return c.json({\n now,\n bets: bets.map((b) => ({\n id: b.id,\n title: b.title,\n description: b.description,\n status: effectiveStatus(b, now),\n closesAt: Number(b.closes_at),\n winningOptionId: b.winning_option_id,\n createdAt: Number(b.created_at),\n resolvedAt: b.resolved_at ? Number(b.resolved_at) : null,\n options: byBet[String(b.id)] || [],\n myWagers: mineByBet[String(b.id)] || [],\n })),\n });\n});\n\napi.get(\"/leaderboard\", async (c) => {\n const rows = await queryAll(\n `SELECT username, balance, wins, losses\n FROM users WHERE is_admin = 0\n ORDER BY balance DESC, wins DESC\n LIMIT 100`,\n );\n return c.json({\n leaderboard: rows.map((r) => ({\n username: r.username,\n balance: Number(r.balance),\n wins: Number(r.wins),\n losses: Number(r.losses),\n })),\n });\n});\n\n// ─── placing a wager ─────────────────────────────────────────────────\n\napi.post(\"/wagers\", requireUser, async (c) => {\n const user = c.get(\"user\") as SessionUser;\n const { betId, optionId, stake } = await body(c);\n\n const amount = Number(stake);\n if (!Number.isInteger(amount) || amount <= 0) {\n return bad(c, \"Stake must be a whole number above zero.\");\n }\n if (amount > 1_000_000_000) return bad(c, \"Stake too large.\");\n\n const option = await queryOne(\n `SELECT o.id, o.bet_id, o.multiplier, b.status, b.closes_at\n FROM bet_options o JOIN bets b ON b.id = o.bet_id\n WHERE o.id = ? AND o.bet_id = ?`,\n [String(optionId ?? \"\"), String(betId ?? \"\")],\n );\n if (!option) return bad(c, \"No such wager option.\", 404);\n\n // Server clock decides whether betting is still open. The client's\n // opinion is irrelevant.\n if (option.status === \"resolved\") return bad(c, \"This bet is already resolved.\", 409);\n if (Number(option.closes_at) <= Date.now()) {\n return bad(c, \"Betting on this wager has closed.\", 409);\n }\n\n const multiplier = Number(option.multiplier);\n const potentialReturn = Math.floor(amount * multiplier);\n const now = Date.now();\n\n // Both statements test the same balance inside one transaction, so\n // they agree: either the stake is affordable and both apply, or\n // neither does. No overdraft, no orphaned wager row.\n const results = await sqlite.batch([\n {\n sql: `INSERT INTO wagers\n (id, user_id, bet_id, option_id, stake, multiplier, potential_return, status, created_at)\n SELECT ?, ?, ?, ?, ?, ?, ?, 'pending', ?\n WHERE (SELECT balance FROM users WHERE id = ?) >= ?`,\n args: [\n newId(\"wgr\"), user.id, String(option.bet_id), String(option.id),\n amount, multiplier, potentialReturn, now, user.id, amount,\n ],\n },\n {\n sql: \"UPDATE users SET balance = balance - ? WHERE id = ? AND balance >= ?\",\n args: [amount, user.id, amount],\n },\n ], \"write\");\n\n if (!results[1] || Number(results[1].rowsAffected) !== 1) {\n return bad(c, \"Insufficient Throne Gelt.\", 409);\n }\n\n const fresh = await queryOne(\"SELECT balance FROM users WHERE id = ?\", [user.id]);\n return c.json({\n ok: true,\n balance: Number(fresh?.balance ?? 0),\n potentialReturn,\n });\n});\n\n// ─── admin ───────────────────────────────────────────────────────────\n\napi.get(\"/admin/users\", requireAdmin, async (c) => {\n const rows = await queryAll(\n `SELECT u.id, u.username, u.balance, u.is_admin, u.wins, u.losses, u.created_at,\n COALESCE((SELECT COUNT(*) FROM wagers w WHERE w.user_id = u.id), 0) AS wager_count,\n COALESCE((SELECT SUM(w.stake) FROM wagers w WHERE w.user_id = u.id AND w.status = 'pending'), 0) AS at_risk\n FROM users u\n ORDER BY u.is_admin DESC, u.balance DESC`,\n );\n return c.json({\n users: rows.map((r) => ({\n id: r.id,\n username: r.username,\n balance: Number(r.balance),\n isAdmin: !!Number(r.is_admin),\n wins: Number(r.wins),\n losses: Number(r.losses),\n wagerCount: Number(r.wager_count),\n atRisk: Number(r.at_risk),\n createdAt: Number(r.created_at),\n })),\n });\n});\n\napi.post(\"/admin/bets\", requireAdmin, async (c) => {\n const { title, description, options, durationMinutes } = await body(c);\n\n if (typeof title !== \"string\" || title.trim().length < 3) {\n return bad(c, \"Title must be at least 3 characters.\");\n }\n if (title.length > 200) return bad(c, \"Title too long.\");\n\n const desc = typeof description === \"string\" ? description.trim() : \"\";\n if (desc.length > 2000) return bad(c, \"Description too long.\");\n\n const mins = Number(durationMinutes);\n if (!Number.isFinite(mins) || mins < 1 || mins > 60 * 24 * 60) {\n return bad(c, \"Duration must be between 1 minute and 60 days.\");\n }\n\n if (!Array.isArray(options) || options.length < 2 || options.length > 8) {\n return bad(c, \"A bet needs between 2 and 8 outcomes.\");\n }\n\n const clean: { label: string; multiplier: number }[] = [];\n for (const o of options) {\n const label = typeof o?.label === \"string\" ? o.label.trim() : \"\";\n const multiplier = Number(o?.multiplier);\n if (!label) return bad(c, \"Every outcome needs a label.\");\n if (label.length > 120) return bad(c, \"Outcome label too long.\");\n if (!Number.isFinite(multiplier) || multiplier < 1.01 || multiplier > 100) {\n return bad(c, \"Payout rates must be between 1.01 and 100.\");\n }\n clean.push({ label, multiplier: Math.round(multiplier * 100) / 100 });\n }\n\n const betId = newId(\"bet\");\n const now = Date.now();\n const closesAt = now + Math.round(mins * 60_000);\n\n const stmts = [{\n sql: `INSERT INTO bets (id, title, description, status, closes_at, created_at)\n VALUES (?, ?, ?, 'open', ?, ?)`,\n args: [betId, title.trim(), desc, closesAt, now],\n }];\n clean.forEach((o, i) => {\n stmts.push({\n sql: `INSERT INTO bet_options (id, bet_id, label, multiplier, sort_order)\n VALUES (?, ?, ?, ?, ?)`,\n args: [newId(\"opt\"), betId, o.label, o.multiplier, i],\n });\n });\n\n await sqlite.batch(stmts, \"write\");\n return c.json({ ok: true, betId, closesAt });\n});\n\n/** Shut betting early without picking a winner. */\napi.post(\"/admin/bets/:id/close\", requireAdmin, async (c) => {\n const id = c.req.param(\"id\");\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [id]);\n if (!bet) return bad(c, \"No such bet.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"Already resolved.\", 409);\n\n await run(\"UPDATE bets SET closes_at = ? WHERE id = ?\", [Date.now(), id]);\n return c.json({ ok: true });\n});\n\n/**\n * Resolving pays stake x multiplier to everyone on the winning outcome.\n * Losing stakes are not returned - they were already deducted when the\n * wager was placed and simply stay gone.\n */\napi.post(\"/admin/bets/:id/resolve\", requireAdmin, async (c) => {\n const betId = c.req.param(\"id\");\n const { winningOptionId } = await body(c);\n const optId = String(winningOptionId ?? \"\");\n\n const bet = await queryOne(\"SELECT id, status FROM bets WHERE id = ?\", [betId]);\n if (!bet) return bad(c, \"No such bet.\", 404);\n if (bet.status === \"resolved\") return bad(c, \"This bet is already resolved.\", 409);\n\n const option = await queryOne(\n \"SELECT id FROM bet_options WHERE id = ? AND bet_id = ?\",\n [optId, betId],\n );\n if (!option) return bad(c, \"That outcome does not belong to this bet.\", 400);\n\n const now = Date.now();\n\n await sqlite.batch([\n // Credit winners and bump their win counts.\n {\n sql: `UPDATE users SET\n balance = balance + COALESCE((\n SELECT SUM(w.potential_return) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.option_id = ? AND w.status = 'pending'), 0),\n wins = wins + COALESCE((\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.option_id = ? AND w.status = 'pending'), 0)\n WHERE id IN (\n SELECT user_id FROM wagers WHERE bet_id = ? AND option_id = ? AND status = 'pending')`,\n args: [betId, optId, betId, optId, betId, optId],\n },\n // Bump loss counts. No balance change: the stake is already gone.\n {\n sql: `UPDATE users SET\n losses = losses + (\n SELECT COUNT(*) FROM wagers w\n WHERE w.user_id = users.id AND w.bet_id = ? AND w.option_id != ? AND w.status = 'pending')\n WHERE id IN (\n SELECT user_id FROM wagers WHERE bet_id = ? AND option_id != ? AND status = 'pending')`,\n args: [betId, optId, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'won', payout = potential_return, settled_at = ?\n WHERE bet_id = ? AND option_id = ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE wagers SET status = 'lost', payout = 0, settled_at = ?\n WHERE bet_id = ? AND option_id != ? AND status = 'pending'`,\n args: [now, betId, optId],\n },\n {\n sql: `UPDATE bets SET status = 'resolved', winning_option_id = ?, resolved_at = ?, closes_at = MIN(closes_at, ?)\n WHERE id = ?`,\n args: [optId, now, now, betId],\n },\n ], \"write\");\n\n const paid = await queryOne(\n `SELECT COUNT(*) AS n, COALESCE(SUM(payout), 0) AS total\n FROM wagers WHERE bet_id = ? AND status = 'won'`,\n [betId],\n );\n\n return c.json({\n ok: true,\n winnersPaid: Number(paid?.n ?? 0),\n totalPaid: Number(paid?.total ?? 0),\n });\n});\n\n/** Immediate stipend to every non-admin account. */\napi.post(\"/admin/fund\", requireAdmin, async (c) => {\n const { amount } = await body(c);\n const value = Number(amount);\n if (!Number.isInteger(value) || value === 0) {\n return bad(c, \"Amount must be a non-zero whole number.\");\n }\n if (Math.abs(value) > 10_000_000) return bad(c, \"Amount too large.\");\n\n const res = await run(\n value > 0\n ? \"UPDATE users SET balance = balance + ? WHERE is_admin = 0\"\n : \"UPDATE users SET balance = MAX(0, balance + ?) WHERE is_admin = 0\",\n [value],\n );\n\n return c.json({ ok: true, accounts: Number(res.rowsAffected ?? 0), amount: value });\n});\n\napi.delete(\"/admin/users/:id\", requireAdmin, async (c) => {\n const actor = c.get(\"user\") as SessionUser;\n const id = c.req.param(\"id\");\n\n const target = await queryOne(\n \"SELECT id, username, is_admin FROM users WHERE id = ?\",\n [id],\n );\n if (!target) return bad(c, \"No such account.\", 404);\n if (String(target.id) === actor.id) return bad(c, \"You cannot delete your own account.\", 400);\n if (Number(target.is_admin)) return bad(c, \"Overseer accounts cannot be deleted here.\", 400);\n\n await sqlite.batch([\n { sql: \"DELETE FROM sessions WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM wagers WHERE user_id = ?\", args: [id] },\n { sql: \"DELETE FROM users WHERE id = ?\", args: [id] },\n ], \"write\");\n\n return c.json({ ok: true, deleted: target.username });\n});\n",[],[154,221],["D",1789372056135],[170,171,172,173,174],[154],["D",1789371999223],["D",1789459281818],{"_105":104,"_113":109},{"_105":104,"_106":107,"_108":109,"_18":60,"_110":111,"_112":25},{"_13":94,"_32":95,"_48":40,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":50,"_103":104},"ctx",{"_87":-5,"_133":269,"_270":271,"_272":273,"_274":25,"_275":25,"_276":25,"_277":64,"_278":-5,"_279":-7,"_280":-7,"_281":68,"_282":25,"_283":25,"_284":-5,"_285":25,"_286":25,"_287":25,"_288":-5},"ENV",{"_240":241,"_242":243,"_244":95,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Operative Authentication

Diff · v8