[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_195":196,"_197":198},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_145":-5,"_20":146,"_22":147,"_148":149,"_150":151,"_25":152,"_24":-5,"_153":-5,"_154":-5,"_155":55,"_156":157,"_158":46,"_159":-5,"_160":-5,"_161":162},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","d303","name","dino-galaga-tech-bash","branchName","main","version","path","","project",{"_35":87,"_13":14,"_47":88,"_89":-5,"_90":55,"_91":92,"_93":92,"_94":19,"_95":-5,"_96":97,"_98":-5,"_99":55,"_100":-5,"_101":-5,"_102":103,"_104":105,"_106":107,"_108":109,"_110":111,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":123,"_124":125,"_126":127,"_128":55},"tree",[74,75,76],"file","contents",[32,33,34],"upstream","pull","ahead","behind","envVars",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":24,"_52":72,"_54":55,"_56":-5,"_18":73},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":65},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":57},"id","d4bded80-5dee-45fc-8050-c0da94cae48f","main.http.tsx","fileId","38aae362-65c4-11f1-bc95-1607ee4eb77e","parentId","branchId","ab23cbc1-db35-4b0d-a796-fd9d0e51bffc","branchVersion",10,"latest",true,"createdAt",["D",1781269063231],5,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst MAX_SCORE = 50_000_000;\nconst MAX_WAVE = 500;\nconst MAX_DURATION_MS = 6 * 60 * 60 * 1000; // 6 hours\nconst MAX_PTS_PER_SEC = 5000; // plausibility ceiling\nconst RATE_LIMIT_PER_10_MIN = 20;\n\nlet ready = false;\nasync function init() {\n if (ready) return;\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS scores (\n id TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n score INTEGER NOT NULL,\n wave INTEGER NOT NULL,\n duration_ms INTEGER NOT NULL,\n created_at TEXT NOT NULL,\n user_agent TEXT,\n client_id TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS game_sessions (\n id TEXT PRIMARY KEY,\n created_at TEXT NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )`,\n ]);\n ready = true;\n}\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n};\n\nfunction json(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n ...CORS,\n },\n });\n}\n\nfunction cleanName(raw: unknown): string {\n return String(raw ?? \"\")\n .replace(/<[^>]*>/g, \"\")\n // deno-lint-ignore no-control-regex\n .replace(/[\\u0000-\\u001f\\u007f<>&\"'`\\\\]/g, \"\")\n .replace(/\\s+/g, \" \")\n .trim()\n .slice(0, 24);\n}\n\nasync function topScores(limit: number) {\n const r = await sqlite.execute({\n sql: `SELECT name, score, wave, created_at FROM scores\n ORDER BY score DESC, wave DESC, created_at ASC LIMIT ?`,\n args: [limit],\n });\n return r.rows;\n}\n\nasync function rankFor(score: number, wave: number, createdAt: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT COUNT(*) AS c FROM scores\n WHERE score > ? OR (score = ? AND wave > ?)\n OR (score = ? AND wave = ? AND created_at < ?)`,\n args: [score, score, wave, score, wave, createdAt],\n });\n return Number((r.rows[0] as unknown as { c: number }).c) + 1;\n}\n\nasync function handleSubmit(req: Request): Promise {\n let b: Record;\n try {\n b = await req.json();\n } catch {\n return json({ ok: false, error: \"Invalid JSON body.\" }, 400);\n }\n\n const name = cleanName(b?.name);\n if (!name) return json({ ok: false, error: \"A display name is required.\" }, 400);\n\n const score = Number(b?.score);\n const wave = Number(b?.wave);\n const duration = Number(b?.duration_ms);\n if (!Number.isInteger(score) || score < 0 || score > MAX_SCORE) {\n return json({ ok: false, error: \"Invalid score.\" }, 400);\n }\n if (!Number.isInteger(wave) || wave < 1 || wave > MAX_WAVE) {\n return json({ ok: false, error: \"Invalid wave.\" }, 400);\n }\n if (!Number.isFinite(duration) || duration <= 0 || duration > MAX_DURATION_MS) {\n return json({ ok: false, error: \"Invalid duration.\" }, 400);\n }\n if (score > 1000 && score / (duration / 1000) > MAX_PTS_PER_SEC) {\n return json({ ok: false, error: \"Score rejected (not plausible).\" }, 400);\n }\n\n const clientId = typeof b?.client_id === \"string\" ? b.client_id.slice(0, 64) : null;\n const sessionId = typeof b?.session_id === \"string\" ? b.session_id.slice(0, 64) : null;\n const createdAt = new Date().toISOString();\n\n // Light rate limit per client_id.\n if (clientId) {\n const since = new Date(Date.now() - 10 * 60 * 1000).toISOString();\n const r = await sqlite.execute({\n sql: `SELECT COUNT(*) AS c FROM scores WHERE client_id = ? AND created_at > ?`,\n args: [clientId, since],\n });\n if (Number((r.rows[0] as unknown as { c: number }).c) >= RATE_LIMIT_PER_10_MIN) {\n return json({ ok: false, error: \"Too many submissions. Take a breather!\" }, 429);\n }\n }\n\n // One submission per game session: duplicates are acknowledged but not re-inserted.\n if (sessionId) {\n const s = await sqlite.execute({\n sql: `SELECT used FROM game_sessions WHERE id = ?`,\n args: [sessionId],\n });\n if (s.rows.length && Number((s.rows[0] as unknown as { used: number }).used) === 1) {\n const rank = await rankFor(score, wave, createdAt);\n return json({\n ok: true,\n duplicate: true,\n rank,\n score: { name, score, wave, created_at: createdAt },\n });\n }\n if (s.rows.length) {\n await sqlite.execute({\n sql: `UPDATE game_sessions SET used = 1 WHERE id = ?`,\n args: [sessionId],\n });\n }\n }\n\n await sqlite.execute({\n sql: `INSERT INTO scores (id, name, score, wave, duration_ms, created_at, user_agent, client_id)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n crypto.randomUUID(),\n name,\n score,\n wave,\n Math.floor(duration),\n createdAt,\n (req.headers.get(\"user-agent\") ?? \"\").slice(0, 200),\n clientId,\n ],\n });\n\n const rank = await rankFor(score, wave, createdAt);\n return json({\n ok: true,\n rank,\n score: { name, score, wave, created_at: createdAt },\n });\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n\n const url = new URL(req.url);\n const path = url.pathname;\n\n try {\n await init();\n\n if (req.method === \"GET\" && (path === \"/\" || path === \"/index.html\")) {\n const html = await readFile(\"/index.html\", import.meta.url);\n return new Response(html, {\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-cache\",\n },\n });\n }\n\n if (req.method === \"GET\" && path === \"/api/health\") {\n return json({ ok: true });\n }\n\n if (req.method === \"GET\" && path === \"/api/leaderboard\") {\n const limit = Math.max(1, Math.min(100, Number(url.searchParams.get(\"limit\")) || 50));\n return json({ scores: await topScores(limit) });\n }\n\n if (req.method === \"POST\" && path === \"/api/session\") {\n const id = crypto.randomUUID();\n await sqlite.execute({\n sql: `INSERT INTO game_sessions (id, created_at, used) VALUES (?, ?, 0)`,\n args: [id, new Date().toISOString()],\n });\n return json({ session_id: id });\n }\n\n if (req.method === \"POST\" && path === \"/api/score\") {\n return await handleSubmit(req);\n }\n\n return json({ ok: false, error: \"Not found.\" }, 404);\n } catch (err) {\n console.error(\"Unhandled error:\", err);\n return json({ ok: false, error: \"Server error. Try again.\" }, 500);\n }\n}\n","deleted",false,"label",[37],"22b8d352-817b-43a9-a894-5f26131ed467","index.html","38bedb56-65c4-11f1-9675-1607ee4eb77e",12,["D",1781794840961],3,"\n\n\n\n\n\n\n\nDino Galaga: Tech Bash Extinction Run\n\n\n\n

\n \n \n

\n\n

DINO GALAGA

Tech Bash Extinction Run

\n \n

Drag to fly · auto-fire while touching.
Keys: ←→/A D move, Space shoot, P pause.

Top Pilots

Loading scores…

\n\n

PAUSED

\n \n \n

\n\n

Extinction Achieved

Wave 1

\n \n

\n \n \n

\n\n

Leaderboard

\n \n \n

\n\n\n\n\n",[59],"ed38eb35-fa4b-45c8-bba6-2f438101a7fa","README.md","389a984a-65c4-11f1-8977-1607ee4eb77e",9,["D",1781269033649],1,"# Dino Galaga: Tech Bash Extinction Run\n\nA mobile-first, Galaga-style arcade shooter with a dinosaur theme, hosted entirely on\n[Val Town](https://val.town). One HTML file for the game, one HTTP val for hosting +\nthe live leaderboard (Val Town SQLite).\n\n**Play it:** https://tinyurl.com/29c4qac2\n(full URL: https://d303--38aae36265c411f1bc951607ee4eb77e.web.val.run/)\n\n## Files\n\n- `index.html` — the complete game client (HTML + CSS + JS, no build step, no external assets).\n- `main.http.tsx` — Val Town HTTP handler: serves the game at `/` and provides the API.\n\n## API\n\n- `GET /` — the game.\n- `GET /api/leaderboard?limit=50` — top scores (sorted score desc, wave desc, created_at asc).\n- `POST /api/score` — `{ name, score, wave, duration_ms, client_id, session_id }` → `{ ok, rank, score }`.\n- `POST /api/session` — creates a game session id (one score submission per session).\n- `GET /api/health` — health check.\n\nServer-side validation: name required/sanitized/max 24 chars, score 0..50,000,000,\nwave >= 1, sane duration, plausibility cap on points-per-second, light per-client\nrate limiting. Duplicate submissions for the same session are acknowledged without\nre-inserting.\n\n## Controls\n\n- **Desktop:** Arrow keys / A,D to move (W,S for limited vertical), Space to shoot, P pause, M mute, Enter start.\n- **Mobile:** drag anywhere to fly (ship floats above your finger), auto-fire while touching, big pause/mute buttons.\n\n## Deploy\n\n```bash\nexport PATH=\"$HOME/.deno/bin:$PATH\"\nvt push # from this directory\nvt tail # watch logs during the event\n```\n\nThe live URL comes from the Val Town files API (`links.endpoint` of `main.http.tsx`):\n\n```bash\nVAL_ID=\"$(python3 -c \"import json;print(json.load(open('.vt/state.json'))['val']['id'])\")\"\ncurl -s \"https://api.val.town/v2/vals/$VAL_ID/files?path=&recursive=true\" | python3 -m json.tool\n```\n",[67],{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":84,"_17":71,"_50":24,"_52":72,"_54":55,"_56":-5,"_78":85,"_18":86},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":81,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_78":82,"_18":83},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":77,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_78":79,"_18":80},["D",1781269063231],"children",[],[37],["D",1781794840961],[],[59],["D",1781269033649],[],[67],"0fb8a63d-82ef-4401-875a-8ea881e14fa3",["D",1781201995909],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","897e2fa3-2473-4708-b5ef-7761fa0f807a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eacf2-a6f2-717d-b165-27fd94533b31","tursoName","0fb8a63d82ef4401875a8ea881e14fa3","tursoHostname","0fb8a63d82ef4401875a8ea881e14fa3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500119686],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_144":140},"org",{"_11":12,"_137":138,"_139":140,"_96":97,"_141":142,"_143":55},"branch",{"_17":61,"_13":16,"_35":42,"_129":87,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":-5,"_135":14,"_136":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Nic Borg","avatar","https://lh3.googleusercontent.com/a/ACg8ocJj5sPkSvBVBBg85bKDCntXEdLMmthzGboRhVHdXMb1GzYqFw=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_35":87,"_13":14,"_47":190,"_89":-5,"_90":55,"_91":92,"_93":92,"_94":19,"_95":-5,"_96":97,"_98":-5,"_99":55,"_100":-5,"_101":-5,"_102":103,"_104":105,"_106":107,"_108":109,"_110":191,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":192,"_124":193,"_126":194,"_128":55},[181,182,183],"files",[181,182,183],"counts",{"_172":103,"_173":71,"_174":103,"_31":175,"_176":177},[166,167,168],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[163],"hasHttpFiles","grants","orgs","customDomains",{},{"_35":164,"_165":-5},"09c136e9-d336-4800-928e-9e65b8182436","reporterId",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":71,"_50":24,"_52":72,"_54":55,"_56":-5,"_18":171},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":170},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":169},[37],[59],[67],"pulls","branches","forks",{"_178":103,"_180":103},"connections",{"_178":103,"_179":103},"count","unfilledCount","emptyCount",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":84,"_17":71,"_50":24,"_52":72,"_54":55,"_56":-5,"_78":188,"_18":189},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":81,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_78":186,"_18":187},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":77,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_78":184,"_18":185},[],[37],[],[59],[],[67],["D",1781201995909],["D",1789500119686],{"_11":12,"_144":140},{"_11":12,"_137":138,"_139":140,"_96":97,"_141":142,"_143":55},{"_17":61,"_13":16,"_35":42,"_129":87,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":-5,"_135":14,"_136":12},"ctx",{"_122":-5,"_160":228,"_229":230,"_231":232,"_233":55,"_234":55,"_235":55,"_236":46,"_237":-5,"_238":-7,"_239":-7,"_240":103,"_241":55,"_242":55,"_243":-5,"_244":55,"_245":55,"_246":55,"_247":-5},"ENV",{"_199":200,"_201":202,"_203":16,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code