Cat Wars Admin Console

Super Admin controls for economy and market-force tuning.

Back to Game

\n\n

Overview

\n\n

Markets

\n \n \n \n

ID	Name	Region Risk	Action

\n\n

Breeds

\n \n \n \n

ID	Name	Base Price	Volatility	Legal Risk	Action

\n\n

\n\n \n\n`;\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

\n\n

The Situation

It is 2029. After a French cat went mega-viral on YouTube, lawmakers branded the trend \"unamerican\" and rushed through a federal feline ban. Cat ownership is now contraband, and the Department of Homeland Security runs aggressive interdiction sweeps across major U.S. cities.

You are an underground courier in a black-market trading ring. Your job is to jet city-to-city, buy cat breeds where prices are low, and sell where prices spike before DHS heat catches up.

How The Game Works

Register or log in to start your run.
Each market has different breed prices each day.
Buy low, travel, then sell high for profit.
Traveling raises Heat and can trigger a DHS bust.
Busts can seize cargo and force cash fines.
Use profits to pay down debt and stay solvent.

\n\n

\n \n \n

\n\n \n\n

DHS BUST IN PROGRESS :: CARGO SEIZURE + FINES APPLIED

VISITOR COUNTER 000042

\n\n \n\n`;\n}\n\n// --- Global middleware ---\napp.use(\"*\", async (_c, next) => {\n await initDb();\n await next();\n});\n\n// --- Page route ---\napp.get(\"/\", (c) => c.html(htmlPage()));\n\napp.get(\"/admin\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return c.text(\"Unauthorized\", 401);\n if (!isAdmin(user)) return c.text(\"Forbidden\", 403);\n return c.html(adminPage());\n});\n\n// --- Admin APIs ---\napp.get(\"/api/admin/overview\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const overview = await getAdminOverview();\n return c.json({ ok: true, overview });\n});\n\napp.get(\"/api/admin/markets\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const markets = await getMarkets();\n return c.json({ ok: true, markets });\n});\n\napp.post(\"/api/admin/markets/:marketId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const marketId = Number(c.req.param(\"marketId\"));\n if (!Number.isFinite(marketId)) return jsonError(\"Invalid market id.\");\n\n const body = await c.req.json().catch(() => null);\n const regionRisk = Number(body?.region_risk);\n if (!Number.isFinite(regionRisk) || regionRisk < 0 || regionRisk > 1) {\n return jsonError(\"region_risk must be between 0 and 1.\");\n }\n\n await sqlite.execute(\n `UPDATE markets SET region_risk = ${regionRisk} WHERE id = ${marketId};`,\n );\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/breeds\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breeds = await getBreeds();\n return c.json({ ok: true, breeds });\n});\n\napp.post(\"/api/admin/breeds/:breedId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breedId = Number(c.req.param(\"breedId\"));\n if (!Number.isFinite(breedId)) return jsonError(\"Invalid breed id.\");\n\n const body = await c.req.json().catch(() => null);\n const basePrice = Number(body?.base_price);\n const volatility = Number(body?.volatility);\n const legalRisk = Number(body?.legal_risk);\n\n if (!Number.isFinite(basePrice) || basePrice < 20) return jsonError(\"base_price must be >= 20.\");\n if (!Number.isFinite(volatility) || volatility < 0 || volatility > 2) return jsonError(\"volatility must be between 0 and 2.\");\n if (!Number.isFinite(legalRisk) || legalRisk < 0 || legalRisk > 1) return jsonError(\"legal_risk must be between 0 and 1.\");\n\n await sqlite.execute(\n `UPDATE breeds\n SET base_price = ${Math.floor(basePrice)}, volatility = ${volatility}, legal_risk = ${legalRisk}\n WHERE id = ${breedId};`,\n );\n return c.json({ ok: true });\n});\n\n// --- Auth routes ---\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n\n if (!username || typeof username !== \"string\" || username.length < 3 || username.length > 24) {\n return jsonError(\"Username must be 3-24 chars.\");\n }\n if (!/^[a-zA-Z0-9_\\-]+$/.test(username)) {\n return jsonError(\"Username can only use letters, numbers, _ and -.\");\n }\n if (typeof password !== \"string\" || password.length < 6) {\n return jsonError(\"Password must be at least 6 chars.\");\n }\n\n const existing = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (existing.rows.length > 0) return jsonError(\"Username already exists.\");\n\n const hash = await hashPassword(password);\n await sqlite.execute(\n `INSERT INTO users (username, password_hash, role, avatar_blob_key, created_at)\n VALUES ('${escapeSql(username)}', '${hash}', 'player', 'preset:street-tabby', '${new Date().toISOString()}');`,\n );\n\n const userRes = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n const userId = userRes.rows[0][0] as number;\n\n await bootstrapUser(userId);\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n if (!username || !password) return jsonError(\"Missing credentials.\");\n\n const userRes = await sqlite.execute(\n `SELECT id, password_hash FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return jsonError(\"Invalid credentials.\", 401);\n\n const expectedHash = userRes.rows[0][1] as string;\n const passwordHash = await hashPassword(password);\n if (passwordHash !== expectedHash) return jsonError(\"Invalid credentials.\", 401);\n\n const userId = userRes.rows[0][0] as number;\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const cookies = parseCookies(c.req.raw);\n const token = cookies[SESSION_COOKIE];\n if (token) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n }\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n clearSessionCookie(headers);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n const snapshot = await buildSnapshot(user);\n return c.json({ user: { id: user.id, username: user.username }, snapshot, notice });\n});\n\napp.post(\"/api/avatar/preset\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const avatarId = body?.avatarId;\n if (!avatarId || typeof avatarId !== \"string\") return jsonError(\"avatarId required.\");\n if (!PIXEL_AVATARS.some((a) => a.id === avatarId)) return jsonError(\"Unknown pixel avatar.\");\n\n const avatarKey = \"preset:\" + avatarId;\n await sqlite.execute(`UPDATE users SET avatar_blob_key = '${escapeSql(avatarKey)}' WHERE id = ${user.id};`);\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, avatar_key: avatarKey, snapshot });\n});\n\napp.get(\"/api/pixel-avatar/:avatarId\", async (c) => {\n const avatarId = c.req.param(\"avatarId\");\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return c.text(\"No avatar\", 404);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\napp.get(\"/api/avatar/:userId\", async (c) => {\n const userId = Number(c.req.param(\"userId\"));\n if (!Number.isFinite(userId)) return c.text(\"Not found\", 404);\n\n const res = await sqlite.execute(`SELECT avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`);\n if (res.rows.length === 0 || !res.rows[0][0]) return c.text(\"No avatar\", 404);\n\n const avatarKey = res.rows[0][0] as string;\n const presetResponse = avatarResponse(avatarKey);\n if (presetResponse) return presetResponse;\n\n try {\n return await blob.get(avatarKey);\n } catch {\n return c.text(\"No avatar\", 404);\n }\n});\n\napp.post(\"/api/travel\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot, busted: false });\n }\n\n const body = await c.req.json().catch(() => null);\n const marketId = Number(body?.marketId);\n if (!Number.isFinite(marketId)) return jsonError(\"marketId required.\");\n\n const markets = await getMarkets();\n const targetMarket = markets.find((m) => m.id === marketId);\n if (!targetMarket) return jsonError(\"Unknown market.\");\n let message = \"\";\n let wasBusted = false;\n\n try {\n await withTransaction(async () => {\n const current = await getPlayerState(user.id);\n if (marketId === current.current_market_id) throw new Error(\"Already at that market.\");\n\n const newDay = current.day + 1;\n let heat = Math.min(100, current.heat + 8 + Math.floor(Math.random() * 13));\n let bustMessage = \"\";\n let nextCash = current.cash;\n\n const bustChance = Math.min(0.92, heat / 170 + targetMarket.region_risk * 0.28);\n if (Math.random() < bustChance) {\n const invRes = await sqlite.execute(\n `SELECT breed_id, qty FROM inventory WHERE user_id = ${user.id};`,\n );\n for (const row of invRes.rows) {\n const breedId = row[0] as number;\n const qty = row[1] as number;\n const seized = Math.floor(qty * (0.2 + Math.random() * 0.55));\n const kept = Math.max(0, qty - seized);\n await sqlite.execute(\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${kept});`,\n );\n }\n\n const fine = Math.floor(current.cash * (0.08 + Math.random() * 0.22));\n nextCash = Math.max(0, current.cash - fine);\n heat = Math.max(12, heat - 20);\n bustMessage = \"BUSTED by DHS. Fine paid: $\" + fine.toLocaleString() + \", partial cargo seized.\";\n }\n\n const heatResult = applyHeatStreakLimit(heat, current.heat_max_streak);\n heat = heatResult.heat;\n if (heatResult.forcedCooldown && !bustMessage) {\n bustMessage = \"Heat overload forced a cooldown. Heat dropped to 95%.\";\n }\n\n if (current.debt > 0 && newDay > current.debt_due_day) {\n await restartRun(user.id);\n message = \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n wasBusted = false;\n return;\n }\n\n await sqlite.execute(\n `UPDATE player_state\n SET current_market_id = ${marketId},\n day = ${newDay},\n heat = ${heat},\n cash = ${nextCash},\n heat_max_streak = ${heatResult.nextStreak}\n WHERE user_id = ${user.id};`,\n );\n\n await generatePricesForMarketDay(newDay, marketId);\n await cleanupOldMarketPrices();\n\n wasBusted = bustMessage.length > 0;\n message = bustMessage || (\"Arrived at \" + targetMarket.name + \". Heat now \" + heat + \"%.\");\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot, busted: wasBusted });\n});\n\n// --- Economy action routes ---\napp.post(\"/api/borrow\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid borrow amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested < 100) return jsonError(\"Minimum borrow is $100.\");\n if (requested > 5000) return jsonError(\"Maximum per borrow is $5,000.\");\n\n let borrowed = 0;\n let fee = 0;\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const maxDebt = 50000;\n if (state.debt >= maxDebt) throw new Error(\"Debt ceiling reached.\");\n\n const terms = computeBorrowTerms({\n requested,\n borrowCount: state.borrow_count,\n currentDebt: state.debt,\n debtDueDay: state.debt_due_day,\n currentDay: state.day,\n maxDebt,\n });\n\n if (terms.debtIncrease <= 0) throw new Error(\"Cannot borrow more right now.\");\n if (terms.principalGranted < 100) throw new Error(\"Borrow amount too high for current debt ceiling.\");\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash + terms.principalGranted},\n debt = ${state.debt + terms.debtIncrease},\n debt_due_day = ${terms.nextDueDay},\n borrow_count = ${state.borrow_count + 1}\n WHERE user_id = ${user.id};`,\n );\n\n borrowed = terms.principalGranted;\n fee = terms.fee;\n message = \"Borrowed $\" + terms.principalGranted.toLocaleString() +\n \" with fee $\" + terms.fee.toLocaleString() +\n \" (tier \" + (state.borrow_count + 1) + \"). Debt due in \" + terms.dueFromToday + \" days.\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, borrowed, fee, message, snapshot });\n});\n\napp.post(\"/api/pay-debt\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid payment amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested <= 0) return jsonError(\"Invalid payment amount.\");\n\n let payment = 0;\n let remainingDebt = 0;\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n if (state.debt <= 0) throw new Error(\"Debt already cleared.\");\n if (state.cash <= 0) throw new Error(\"No cash available to pay debt.\");\n\n payment = Math.min(requested, state.debt, state.cash);\n remainingDebt = state.debt - payment;\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash - payment}, debt = ${remainingDebt}\n WHERE user_id = ${user.id};`,\n );\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n const message = \"Paid $\" + payment.toLocaleString() + \" toward debt. Remaining debt: $\" + remainingDebt.toLocaleString() + \".\";\n return c.json({ ok: true, payment, message, snapshot });\n});\n\napp.post(\"/api/buy\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid buy request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const cargoUsed = await getCargoUsed(user.id);\n if (cargoUsed + qty > state.cargo_capacity) throw new Error(\"Not enough cargo space.\");\n\n const total = chosen.price * qty;\n if (total > state.cash) throw new Error(\"Insufficient cash.\");\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash - total} WHERE user_id = ${user.id};`,\n `INSERT INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${qty})\n ON CONFLICT(user_id, breed_id) DO UPDATE SET qty = qty + ${qty};`,\n ]);\n\n message = \"Bought \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\napp.post(\"/api/sell\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid sell request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const invRes = await sqlite.execute(\n `SELECT qty FROM inventory WHERE user_id = ${user.id} AND breed_id = ${breedId} LIMIT 1;`,\n );\n const owned = (invRes.rows[0]?.[0] as number) ?? 0;\n if (owned < qty) throw new Error(\"Not enough inventory.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const total = chosen.price * qty;\n const nextQty = owned - qty;\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash + total} WHERE user_id = ${user.id};`,\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${nextQty});`,\n ]);\n\n message = \"Sold \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\nexport default app.fetch;\n",[78],"889ad4be-1645-11f1-ad88-42dde27851f2","config.ts","889ad586-1645-11f1-ad88-42dde27851f2",86,["D",1772462332554],"export const SESSION_COOKIE = \"catwars_session\";\nexport const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14;\n\nexport const MARKETS = [\n { id: 1, name: \"New York City\", region_risk: 0.25 },\n { id: 2, name: \"Seattle\", region_risk: 0.18 },\n { id: 3, name: \"San Francisco\", region_risk: 0.22 },\n { id: 4, name: \"Miami\", region_risk: 0.3 },\n { id: 5, name: \"Chicago\", region_risk: 0.35 },\n { id: 6, name: \"Austin\", region_risk: 0.2 },\n] as const;\n\nexport const BREEDS = [\n { id: 1, name: \"Street Tabby\", base_price: 95, volatility: 0.35, legal_risk: 0.1 },\n { id: 2, name: \"Siamese\", base_price: 300, volatility: 0.45, legal_risk: 0.22 },\n { id: 3, name: \"Maine Coon\", base_price: 520, volatility: 0.4, legal_risk: 0.28 },\n { id: 4, name: \"Bengal\", base_price: 800, volatility: 0.55, legal_risk: 0.35 },\n { id: 5, name: \"Sphynx\", base_price: 1200, volatility: 0.65, legal_risk: 0.42 },\n { id: 6, name: \"Scottish Fold\", base_price: 680, volatility: 0.5, legal_risk: 0.3 },\n] as const;\n\nexport const PIXEL_AVATARS = [\n { id: \"street-tabby\", name: \"Street Tabby\", colors: [\"#f6d08d\", \"#925b2d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"neon-sphynx\", name: \"Neon Sphynx\", colors: [\"#ffb6df\", \"#c23888\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"void-panther\", name: \"Void Panther\", colors: [\"#616161\", \"#1f1f1f\", \"#00f7ff\", \"#fefefe\"] },\n { id: \"mint-mouser\", name: \"Mint Mouser\", colors: [\"#b6ffd8\", \"#2e9b6d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"sunset-bengal\", name: \"Sunset Bengal\", colors: [\"#ffc081\", \"#d0682f\", \"#2b1c17\", \"#fefefe\"] },\n { id: \"royal-fold\", name: \"Royal Fold\", colors: [\"#d3c4ff\", \"#6f56d7\", \"#1d1d1d\", \"#fefefe\"] },\n] as const;\n",[330],"d45c2064-1664-11f1-8e4b-42dde27851f2","auth.ts","e2002cc0-1645-11f1-9ac0-42dde27851f2",134,["D",1772475774040],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { SESSION_COOKIE, SESSION_TTL_MS } from \"./config.ts\";\n\nexport type AuthedUser = {\n id: number;\n username: string;\n role: string;\n avatar_blob_key: string | null;\n};\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\n/** Parses the Cookie header into a key/value map. */\nexport function parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") || \"\";\n const parts = header.split(\";\").map((p) => p.trim()).filter(Boolean);\n const out: Record = {};\n for (const p of parts) {\n const idx = p.indexOf(\"=\");\n if (idx > -1) {\n out[p.slice(0, idx)] = decodeURIComponent(p.slice(idx + 1));\n }\n }\n return out;\n}\n\n/** Writes the auth session cookie using configured TTL. */\nexport function setSessionCookie(headers: Headers, token: string) {\n headers.append(\n \"Set-Cookie\",\n SESSION_COOKIE + \"=\" + encodeURIComponent(token) + \"; Path=/; HttpOnly; SameSite=Lax; Max-Age=\" + Math.floor(SESSION_TTL_MS / 1000),\n );\n}\n\n/** Clears the auth session cookie immediately. */\nexport function clearSessionCookie(headers: Headers) {\n headers.append(\"Set-Cookie\", SESSION_COOKIE + \"=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\");\n}\n\n/** Creates a new persisted session token for a user ID. */\nexport async function createSession(userId: number): Promise {\n const token = crypto.randomUUID() + \"-\" + crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute(\n `INSERT INTO sessions (token, user_id, expires_at) VALUES ('${escapeSql(token)}', ${userId}, ${expiresAt});`,\n );\n return token;\n}\n\n/** Resolves the authenticated user from cookie session token, or null if invalid/expired. */\nexport async function getAuthedUser(req: Request): Promise {\n const cookies = parseCookies(req);\n const token = cookies[SESSION_COOKIE];\n if (!token) return null;\n\n const sessionRes = await sqlite.execute(\n `SELECT user_id, expires_at FROM sessions WHERE token = '${escapeSql(token)}' LIMIT 1;`,\n );\n if (sessionRes.rows.length === 0) return null;\n\n const userId = sessionRes.rows[0][0] as number;\n const expiresAt = sessionRes.rows[0][1] as number;\n if (expiresAt < Date.now()) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n return null;\n }\n\n const userRes = await sqlite.execute(\n `SELECT id, username, role, avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return null;\n\n return {\n id: userRes.rows[0][0] as number,\n username: userRes.rows[0][1] as string,\n role: (userRes.rows[0][2] as string) || \"player\",\n avatar_blob_key: (userRes.rows[0][3] as string | null) ?? null,\n };\n}\n",[337],"4a8a0b02-1665-11f1-87d4-42dde27851f2","README.md","836a4b08-1638-11f1-9ce6-42dde27851f2",147,["D",1772475972307],"# Cat Wars 2029\n\nA retro-styled browser trading game inspired by the Drug Wars gameplay loop.\n\nPlayers move between real U.S. city markets, buy/sell illegal cat breeds, manage heat risk, and survive escalating debt pressure.\n\n## Stack\n\n- Runtime: Val Town HTTP Val (`main.ts`)\n- Web framework: `Hono`\n- Persistence: Val-scoped SQLite via `https://esm.town/v/std/sqlite/main.ts`\n- Binary/media: Val Town `blob` (avatar path still supports blob keys, UI uses pixel presets)\n- Frontend: server-rendered HTML + vanilla JS\n\n## Project Files\n\n- `main.ts`: HTTP routes, DB bootstrap/migrations, rendering, game actions, and admin dashboard/API\n- `auth.ts`: session cookie parsing, session token lifecycle, authenticated user lookup\n- `config.ts`: static game config (markets, breeds, pixel avatar metadata)\n- `rules.ts`: pure game logic helpers (borrow terms and heat streak cap)\n- `rules_test.ts`: script-based regression tests for `rules.ts`\n\n## Core Gameplay Loop\n\n1. Register or log in.\n2. Check market prices for each breed.\n3. Buy cats where prices are low.\n4. Travel to another city (travel advances day and raises heat).\n5. Sell for profit.\n6. Manage debt before deadline.\n\n## Travel Economics\n\n- There is no fixed dollar travel fee.\n- Each travel action increments `day` by 1.\n- Travel raises heat and may trigger a DHS bust.\n- Bust outcomes can reduce cash (fine) and inventory (seizure).\n\n## Market Forces And Fast-Profit Playstyle\n\n- High-volatility breeds (`Sphynx`, `Bengal`) produce the largest swings.\n- Early borrowing increases buying power but fees escalate per borrow tier.\n- Low-risk travel hubs (`Seattle`, `Austin`) help reduce bust frequency while hunting good exits.\n- Over-traveling increases bust risk and can erase profits quickly.\n\n## Debt System\n\n- Debt has a due day (`debt_due_day`).\n- Borrowing:\n - increases cash and debt\n - applies escalating fee by borrow tier (capped)\n - extends due window, capped to at most 90 days ahead\n- Missing debt deadline while debt > 0 triggers bankruptcy:\n - inventory wiped\n - run reset to baseline state\n\n## Heat and Bust Rules\n\n- Travel increases heat and can trigger a DHS bust event.\n- Bust events may seize inventory and fine cash.\n- Heat cannot stay at 100% for more than 2 consecutive turns; on the 3rd turn it is forced down to 95%.\n\n## Schema\n\n### `users`\nAccount identity, role (`player`/`admin`/`super_admin`), and avatar key.\n\n### `sessions`\nCookie-token sessions with expiry.\n\n### `player_state`\nCurrent market, cash, debt, heat, day, cargo, debt due day, borrow tier, and heat max streak.\n\n### `markets`\nCity list and enforcement risk profile.\n\n### `breeds`\nBase economy metadata for each cat breed.\n\n### `inventory`\nOwned quantity per breed per user.\n\n### `market_day_prices`\nShared daily per-market prices across all users (multiplayer-ready market tape).\n\n### `user_market_prices` (legacy)\nDeprecated table kept only for migration compatibility. Active writes no longer target this table.\n\n### `schema_migrations`\nTracks one-way migration IDs that have been applied.\n\n## API Surface\n\n### Auth/session\n- `POST /api/register`\n- `POST /api/login`\n- `POST /api/logout`\n- `GET /api/me`\n\n### Admin\n- `GET /admin` (dashboard UI; admin-only)\n- `GET /api/admin/overview`\n- `GET /api/admin/markets`\n- `POST /api/admin/markets/:marketId`\n- `GET /api/admin/breeds`\n- `POST /api/admin/breeds/:breedId`\n\n### Economy/actions\n- `POST /api/buy`\n- `POST /api/sell`\n- `POST /api/travel`\n- `POST /api/borrow`\n- `POST /api/pay-debt`\n\n### Avatar/presets\n- `POST /api/avatar/preset`\n- `GET /api/pixel-avatar/:avatarId`\n- `GET /api/avatar/:userId`\n\n## Migrations\n\n`initDb()` creates base tables and then runs idempotent tracked migrations:\n\n- `2026-03-02-add-player_state-debt_due_day`\n- `2026-03-02-add-player_state-borrow_count`\n- `2026-03-02-add-player_state-heat_max_streak`\n- `2026-03-02-backfill-debt_due_day`\n- `2026-03-02-add-users-role`\n- `2026-03-02-backfill-super-admin-first-user`\n- `2026-03-02-create-market-day-prices`\n- `2026-03-02-backfill-market-day-prices-from-user-market-prices`\n- `2026-03-02-clear-user-market-prices-legacy`\n\nApplied migrations are recorded in `schema_migrations`.\n\n## Testing\n\nRun the script file directly in Val Town:\n\n- `rules_test.ts`\n\nIt validates:\n- borrow fee escalation and cap behavior\n- debt-ceiling clamping\n- due-date 90-day cap\n- heat 100% streak cooldown behavior\n\n## Runtime Guarantees\n\n- Market prices are shared by `day + market` for all users.\n- Price history retention is enforced by deleting rows older than `MARKET_PRICE_RETENTION_DAYS` (currently 45) relative to the active max player day.\n- Mutating routes (`travel`, `borrow`, `pay-debt`, `buy`, `sell`) centralize write coordination and use `sqlite.batch` for multi-write updates where possible.\n- Full cross-statement transaction boundaries are pending a runtime-safe transaction primitive in Val Town's sqlite helper.\n\n## Current Status\n\n- Val is public: `pchinjr/cat-wars`\n- Auth/session logic extracted into `auth.ts`\n- Static game config extracted into `config.ts`\n- Core deterministic rules extracted into `rules.ts`\n- Regression coverage added for extracted rules via `rules_test.ts`\n\n## Next Suggested Improvements\n\n1. Add tests for route-level behaviors (`/api/travel`, `/api/borrow`, bankruptcy reset).\n2. Introduce a tiny data-access layer to remove inline SQL from route handlers.\n3. Add structured event logging for travel, bust, borrow, and bankruptcy actions.\n4. Add multiplayer-ready turn clock abstraction for synchronized city market ticks.\n",[344],"pulls","branches","forks","envVars",{"_357":239,"_359":239},"connections",{"_357":239,"_358":239},"count","unfilledCount","emptyCount",{"_47":343,"_13":344,"_76":345,"_57":-5,"_49":50,"_308":346,"_310":294,"_51":382,"_53":149,"_79":67,"_313":348,"_81":24,"_315":-5,"_367":383,"_276":384},{"_47":336,"_13":337,"_76":338,"_57":-5,"_49":50,"_308":339,"_310":294,"_51":379,"_53":107,"_79":312,"_313":341,"_81":24,"_315":-5,"_367":380,"_276":381},{"_47":329,"_13":330,"_76":331,"_57":-5,"_49":50,"_308":332,"_310":294,"_51":376,"_53":239,"_79":312,"_313":334,"_81":24,"_315":-5,"_367":377,"_276":378},{"_47":324,"_13":78,"_76":77,"_57":-5,"_49":50,"_308":262,"_310":294,"_51":373,"_53":326,"_79":80,"_313":327,"_81":24,"_315":-5,"_367":374,"_276":375},{"_47":317,"_13":318,"_76":319,"_57":-5,"_49":50,"_308":320,"_310":294,"_51":370,"_53":54,"_79":312,"_313":322,"_81":24,"_315":-5,"_367":371,"_276":372},{"_47":305,"_13":306,"_76":307,"_57":-5,"_49":50,"_308":309,"_310":294,"_51":366,"_53":94,"_79":312,"_313":314,"_81":24,"_315":-5,"_367":368,"_276":369},["D",1772462712049],"children",[],[306],["D",1772463591435],[],[318],["D",1772539795880],[],[78],["D",1772462332554],[],[330],["D",1772475774040],[],[337],["D",1772475972307],[],[344],["D",1772409318475],["D",1789555877593],{"_11":12,"_275":84},{"_11":12,"_271":-5,"_83":84,"_25":82,"_272":273,"_274":24},{"_53":262,"_13":16,"_47":50,"_263":224,"_264":-5,"_265":-5,"_266":-5,"_267":-5,"_268":-5,"_269":14,"_270":12},"ctx",{"_65":-5,"_296":423,"_424":425,"_426":427,"_428":24,"_429":24,"_430":24,"_431":294,"_432":-5,"_433":-7,"_434":-7,"_435":239,"_436":24,"_437":24,"_438":-5,"_439":24,"_440":24,"_441":24,"_442":-5},"ENV",{"_394":395,"_396":397,"_398":16,"_399":400,"_401":402,"_403":404,"_405":406,"_407":408,"_409":410,"_411":412,"_413":414,"_415":416,"_417":418,"_419":420,"_421":422},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Cat Wars Admin Console

Overview

Markets

Breeds

CAT WARS 2029

Street Terminal

The Situation

How The Game Works

Register

Log In

Market Prices

Travel

Session

History