[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_221":222,"_223":224},"routes/_app.x.$handle.$name",{"_97":96,"_32":45,"_105":87,"_27":106,"_13":14,"_107":-5,"_11":108,"_109":110,"_111":112,"_113":114,"_115":116,"_20":-5,"_117":-5,"_118":-5,"_119":25,"_120":121,"_122":123,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",149,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","19c55206-15ca-11f1-92f1-42dde27851f2","name","fileType","http","content","// Cat Wars 2029\n// Single-file HTTP app: auth, economy simulation, debt lifecycle, and retro UI.\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { BREEDS, MARKETS, PIXEL_AVATARS, SESSION_COOKIE } from \"./config.ts\";\nimport { clearSessionCookie, createSession, getAuthedUser, parseCookies, setSessionCookie, type AuthedUser } from \"./auth.ts\";\nimport { applyHeatStreakLimit, computeBorrowTerms } from \"./rules.ts\";\n\ntype User = AuthedUser;\n\ntype PlayerState = {\n user_id: number;\n current_market_id: number;\n cash: number;\n debt: number;\n heat: number;\n day: number;\n cargo_capacity: number;\n debt_due_day: number;\n borrow_count: number;\n heat_max_streak: number;\n};\n\ntype PriceRow = {\n breed_id: number;\n breed_name: string;\n price: number;\n};\n\ntype MarketRow = {\n id: number;\n name: string;\n region_risk: number;\n};\n\n// --- App + session config ---\nconst app = new Hono();\n\nlet dbReady = false;\nconst MARKET_PRICE_RETENTION_DAYS = 45;\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\n// Val Town's sqlite.execute is not guaranteed to hold a multi-statement transaction\n// context across awaited calls, so this wrapper is currently best-effort.\nasync function withTransaction(fn: () => Promise): Promise {\n return fn();\n}\n\nasync function ensureMigrationTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS schema_migrations (\n id TEXT PRIMARY KEY,\n applied_at TEXT NOT NULL\n );`,\n );\n}\n\nasync function isMigrationApplied(id: string): Promise {\n const res = await sqlite.execute(\n `SELECT id FROM schema_migrations WHERE id = '${escapeSql(id)}' LIMIT 1;`,\n );\n return res.rows.length > 0;\n}\n\nasync function markMigrationApplied(id: string) {\n await sqlite.execute(\n `INSERT INTO schema_migrations (id, applied_at) VALUES ('${escapeSql(id)}', '${new Date().toISOString()}');`,\n );\n}\n\nasync function hasColumn(table: string, column: string): Promise {\n const info = await sqlite.execute(`PRAGMA table_info(${table});`);\n for (const row of info.rows) {\n if (String(row[1]) === column) return true;\n }\n return false;\n}\n\nasync function runColumnMigration(id: string, table: string, column: string, alterSql: string) {\n if (await isMigrationApplied(id)) return;\n if (!(await hasColumn(table, column))) {\n await sqlite.execute(alterSql);\n }\n await markMigrationApplied(id);\n}\n\nasync function runSqlMigration(id: string, sql: string) {\n if (await isMigrationApplied(id)) return;\n await sqlite.execute(sql);\n await markMigrationApplied(id);\n}\n\n// --- Database schema + lightweight migrations ---\nasync function initDb() {\n if (dbReady) return;\n\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n avatar_blob_key TEXT,\n created_at TEXT NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS player_state (\n user_id INTEGER PRIMARY KEY,\n current_market_id INTEGER NOT NULL,\n cash INTEGER NOT NULL,\n debt INTEGER NOT NULL,\n heat INTEGER NOT NULL,\n day INTEGER NOT NULL,\n cargo_capacity INTEGER NOT NULL,\n debt_due_day INTEGER NOT NULL DEFAULT 21,\n borrow_count INTEGER NOT NULL DEFAULT 0,\n heat_max_streak INTEGER NOT NULL DEFAULT 0,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS markets (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n region_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS breeds (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n base_price INTEGER NOT NULL,\n volatility REAL NOT NULL,\n legal_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS inventory (\n user_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n qty INTEGER NOT NULL,\n PRIMARY KEY (user_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS market_day_prices (\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (day, market_id, breed_id),\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS user_market_prices (\n user_id INTEGER NOT NULL,\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (user_id, day, market_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n ]);\n\n const marketCount = await sqlite.execute(\"SELECT COUNT(*) FROM markets;\");\n if ((marketCount.rows[0][0] as number) === 0) {\n for (const m of MARKETS) {\n await sqlite.execute(\n `INSERT INTO markets (id, name, region_risk) VALUES (${m.id}, '${escapeSql(m.name)}', ${m.region_risk});`,\n );\n }\n }\n\n const breedCount = await sqlite.execute(\"SELECT COUNT(*) FROM breeds;\");\n if ((breedCount.rows[0][0] as number) === 0) {\n for (const b of BREEDS) {\n await sqlite.execute(\n `INSERT INTO breeds (id, name, base_price, volatility, legal_risk)\n VALUES (${b.id}, '${escapeSql(b.name)}', ${b.base_price}, ${b.volatility}, ${b.legal_risk});`,\n );\n }\n }\n\n await ensureMigrationTable();\n\n await runColumnMigration(\n \"2026-03-02-add-player_state-debt_due_day\",\n \"player_state\",\n \"debt_due_day\",\n \"ALTER TABLE player_state ADD COLUMN debt_due_day INTEGER NOT NULL DEFAULT 21;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-player_state-borrow_count\",\n \"player_state\",\n \"borrow_count\",\n \"ALTER TABLE player_state ADD COLUMN borrow_count INTEGER NOT NULL DEFAULT 0;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-player_state-heat_max_streak\",\n \"player_state\",\n \"heat_max_streak\",\n \"ALTER TABLE player_state ADD COLUMN heat_max_streak INTEGER NOT NULL DEFAULT 0;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-users-role\",\n \"users\",\n \"role\",\n \"ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'player';\",\n );\n await runSqlMigration(\n \"2026-03-02-backfill-super-admin-first-user\",\n \"UPDATE users SET role = 'super_admin' WHERE id = (SELECT id FROM users ORDER BY id ASC LIMIT 1);\",\n );\n await runSqlMigration(\n \"2026-03-02-backfill-debt_due_day\",\n \"UPDATE player_state SET debt_due_day = CASE WHEN debt_due_day < day THEN day + 20 ELSE debt_due_day END;\",\n );\n await runSqlMigration(\n \"2026-03-02-create-market-day-prices\",\n `CREATE TABLE IF NOT EXISTS market_day_prices (\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (day, market_id, breed_id),\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n );\n await runSqlMigration(\n \"2026-03-02-backfill-market-day-prices-from-user-market-prices\",\n `INSERT OR IGNORE INTO market_day_prices (day, market_id, breed_id, price)\n SELECT day, market_id, breed_id, CAST(AVG(price) AS INTEGER)\n FROM user_market_prices\n GROUP BY day, market_id, breed_id;`,\n );\n await runSqlMigration(\n \"2026-03-02-clear-user-market-prices-legacy\",\n \"DELETE FROM user_market_prices;\",\n );\n\n dbReady = true;\n}\n\nasync function sha256(text: string): Promise {\n const bytes = new TextEncoder().encode(text);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPassword(password: string): Promise {\n return sha256(\"catwars-2029::\" + password);\n}\n\nasync function getPlayerState(userId: number): Promise {\n const res = await sqlite.execute(\n `SELECT user_id, current_market_id, cash, debt, heat, day, cargo_capacity, debt_due_day, borrow_count, heat_max_streak\n FROM player_state WHERE user_id = ${userId} LIMIT 1;`,\n );\n return {\n user_id: res.rows[0][0] as number,\n current_market_id: res.rows[0][1] as number,\n cash: res.rows[0][2] as number,\n debt: res.rows[0][3] as number,\n heat: res.rows[0][4] as number,\n day: res.rows[0][5] as number,\n cargo_capacity: res.rows[0][6] as number,\n debt_due_day: res.rows[0][7] as number,\n borrow_count: res.rows[0][8] as number,\n heat_max_streak: res.rows[0][9] as number,\n };\n}\n\nasync function getMarkets(): Promise {\n const res = await sqlite.execute(\n \"SELECT id, name, region_risk FROM markets ORDER BY id ASC;\",\n );\n return res.rows.map((r) => ({\n id: r[0] as number,\n name: r[1] as string,\n region_risk: r[2] as number,\n }));\n}\n\nfunction isAdmin(user: User): boolean {\n return user.role === \"super_admin\" || user.role === \"admin\";\n}\n\n// --- Economy model: market price generation ---\nasync function generatePricesForMarketDay(day: number, marketId: number): Promise {\n const existing = await sqlite.execute(\n `SELECT COUNT(*) FROM market_day_prices WHERE day = ${day} AND market_id = ${marketId};`,\n );\n if ((existing.rows[0][0] as number) > 0) return;\n\n const marketRes = await sqlite.execute(`SELECT region_risk FROM markets WHERE id = ${marketId} LIMIT 1;`);\n const regionRisk = (marketRes.rows[0]?.[0] as number) ?? 0.2;\n\n const breedsRes = await sqlite.execute(\n `SELECT id, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;`,\n );\n\n for (const row of breedsRes.rows) {\n const breedId = row[0] as number;\n const basePrice = row[1] as number;\n const volatility = row[2] as number;\n const legalRisk = row[3] as number;\n\n const wave = Math.sin((day + breedId * 7 + marketId * 13) * 0.73) * volatility;\n const chaos = (Math.random() - 0.5) * volatility * 1.8;\n const crackdown = (regionRisk + legalRisk) * 0.6;\n const multiplier = Math.max(0.2, 1 + wave + chaos + crackdown);\n const price = Math.max(20, Math.floor(basePrice * multiplier));\n\n await sqlite.execute(\n `INSERT OR IGNORE INTO market_day_prices (day, market_id, breed_id, price)\n VALUES (${day}, ${marketId}, ${breedId}, ${price});`,\n );\n }\n}\n\nasync function getCurrentPrices(day: number, marketId: number): Promise {\n const rows = await sqlite.execute(\n `SELECT p.breed_id, b.name, p.price\n FROM market_day_prices p\n JOIN breeds b ON b.id = p.breed_id\n WHERE p.day = ${day} AND p.market_id = ${marketId}\n ORDER BY p.breed_id ASC;`,\n );\n\n if (rows.rows.length === 0) {\n await generatePricesForMarketDay(day, marketId);\n return getCurrentPrices(day, marketId);\n }\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n price: r[2] as number,\n }));\n}\n\nasync function getInventory(userId: number): Promise> {\n const rows = await sqlite.execute(\n `SELECT i.breed_id, b.name, i.qty\n FROM inventory i\n JOIN breeds b ON b.id = i.breed_id\n WHERE i.user_id = ${userId}\n ORDER BY i.breed_id ASC;`,\n );\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n qty: r[2] as number,\n }));\n}\n\nasync function getCargoUsed(userId: number): Promise {\n const res = await sqlite.execute(`SELECT COALESCE(SUM(qty), 0) FROM inventory WHERE user_id = ${userId};`);\n return res.rows[0][0] as number;\n}\n\nasync function cleanupOldMarketPrices(retentionDays = MARKET_PRICE_RETENTION_DAYS): Promise {\n const maxDayRes = await sqlite.execute(\"SELECT COALESCE(MAX(day), 0) FROM player_state;\");\n const maxDay = (maxDayRes.rows[0][0] as number) ?? 0;\n const cutoffDay = maxDay - retentionDays;\n if (cutoffDay <= 0) return;\n\n await sqlite.execute(`DELETE FROM market_day_prices WHERE day < ${cutoffDay};`);\n}\n\nasync function bootstrapUser(userId: number): Promise {\n await sqlite.execute(\n `INSERT INTO player_state (user_id, current_market_id, cash, debt, heat, day, cargo_capacity, debt_due_day, borrow_count, heat_max_streak)\n VALUES (${userId}, 1, 2200, 900, 0, 1, 100, 21, 0, 0);`,\n );\n await generatePricesForMarketDay(1, 1);\n}\n\n// Bankruptcy reset: wipe inventory and reset run baseline.\nasync function restartRun(userId: number): Promise {\n await sqlite.batch([\n `DELETE FROM inventory WHERE user_id = ${userId};`,\n `UPDATE player_state\n SET current_market_id = 1,\n cash = 2200,\n debt = 900,\n heat = 0,\n day = 1,\n cargo_capacity = 100,\n debt_due_day = 21,\n borrow_count = 0,\n heat_max_streak = 0\n WHERE user_id = ${userId};`,\n ]);\n await generatePricesForMarketDay(1, 1);\n}\n\nasync function enforceDebtDeadline(userId: number): Promise {\n const state = await getPlayerState(userId);\n if (state.debt > 0 && state.day > state.debt_due_day) {\n await restartRun(userId);\n return \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n }\n return null;\n}\n\nfunction pixelAvatarSvg(avatarId: string): string | null {\n const palette = PIXEL_AVATARS.find((p) => p.id === avatarId);\n if (!palette) return null;\n\n const c1 = palette.colors[0];\n const c2 = palette.colors[1];\n const c3 = palette.colors[2];\n const c4 = palette.colors[3];\n\n let sprite = \"\";\n\n if (avatarId === \"street-tabby\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"neon-sphynx\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"void-panther\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"mint-mouser\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"sunset-bengal\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"royal-fold\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else {\n return null;\n }\n\n return `\n`.trim();\n}\n\nfunction avatarResponse(avatarBlobKey: string): Response | null {\n if (avatarBlobKey.startsWith(\"preset:\")) {\n const avatarId = avatarBlobKey.slice(\"preset:\".length);\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return null;\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n }\n return null;\n}\n\nfunction jsonError(message: string, status = 400): Response {\n return new Response(JSON.stringify({ error: message }), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\nasync function getBreeds() {\n const rows = await sqlite.execute(\n \"SELECT id, name, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;\",\n );\n return rows.rows.map((r) => ({\n id: r[0] as number,\n name: r[1] as string,\n base_price: r[2] as number,\n volatility: r[3] as number,\n legal_risk: r[4] as number,\n }));\n}\n\nasync function getAdminOverview() {\n const users = await sqlite.execute(\"SELECT COUNT(*) FROM users;\");\n const players = await sqlite.execute(\"SELECT COUNT(*) FROM player_state;\");\n const econ = await sqlite.execute(\n \"SELECT COALESCE(SUM(cash), 0), COALESCE(SUM(debt), 0), COALESCE(AVG(heat), 0) FROM player_state;\",\n );\n const marketRows = await sqlite.execute(\n `SELECT m.name, COUNT(ps.user_id) AS players_here\n FROM markets m\n LEFT JOIN player_state ps ON ps.current_market_id = m.id\n GROUP BY m.id, m.name\n ORDER BY players_here DESC, m.id ASC;`,\n );\n\n return {\n users: users.rows[0][0] as number,\n active_players: players.rows[0][0] as number,\n total_cash: econ.rows[0][0] as number,\n total_debt: econ.rows[0][1] as number,\n avg_heat: Number(econ.rows[0][2] as number),\n market_distribution: marketRows.rows.map((r) => ({\n market: r[0] as string,\n players: r[1] as number,\n })),\n };\n}\n\nasync function buildSnapshot(user: User) {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const inventory = await getInventory(user.id);\n const cargoUsed = await getCargoUsed(user.id);\n const markets = await getMarkets();\n const currentMarket = markets.find((m) => m.id === state.current_market_id);\n\n return {\n user: { id: user.id, username: user.username, role: user.role },\n market: { id: state.current_market_id, name: currentMarket?.name ?? \"Unknown\" },\n markets,\n state,\n prices,\n inventory,\n cargo_used: cargoUsed,\n debt_days_left: Math.max(0, state.debt_due_day - state.day),\n borrow_level: state.borrow_count,\n avatar_url: user.avatar_blob_key ? \"/api/avatar/\" + user.id + \"?v=\" + Date.now() : null,\n avatar_key: user.avatar_blob_key,\n pixel_avatars: PIXEL_AVATARS.map((p) => ({\n id: p.id,\n name: p.name,\n preview_url: \"/api/pixel-avatar/\" + p.id,\n })),\n };\n}\n\nfunction adminPage(): string {\n return `\n\n\n \n \n Cat Wars Admin Console\n \n\n\n

Cat Wars Admin Console

Super Admin controls for economy and market-force tuning.

Back to Game

\n\n

Overview

\n\n

Markets

\n \n \n \n

ID	Name	Region Risk	Action

\n\n

Breeds

\n \n \n \n

ID	Name	Base Price	Volatility	Legal Risk	Action

\n\n

\n\n \n\n`;\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

\n\n

The Situation

It is 2029. The federal government has outlawed felines nationwide. Cat ownership is now contraband, and the Department of Homeland Security runs aggressive interdiction sweeps across major U.S. cities.

You are an underground courier in a black-market trading ring. Your job is to jet city-to-city, buy cat breeds where prices are low, and sell where prices spike before DHS heat catches up.

How The Game Works

Register or log in to start your run.
Each market has different breed prices each day.
Buy low, travel, then sell high for profit.
Traveling raises Heat and can trigger a DHS bust.
Busts can seize cargo and force cash fines.
Use profits to pay down debt and stay solvent.

\n\n

\n \n \n

\n\n \n\n

DHS BUST IN PROGRESS :: CARGO SEIZURE + FINES APPLIED

VISITOR COUNTER 000042

\n\n \n\n`;\n}\n\n// --- Global middleware ---\napp.use(\"*\", async (_c, next) => {\n await initDb();\n await next();\n});\n\n// --- Page route ---\napp.get(\"/\", (c) => c.html(htmlPage()));\n\napp.get(\"/admin\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return c.text(\"Unauthorized\", 401);\n if (!isAdmin(user)) return c.text(\"Forbidden\", 403);\n return c.html(adminPage());\n});\n\n// --- Admin APIs ---\napp.get(\"/api/admin/overview\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const overview = await getAdminOverview();\n return c.json({ ok: true, overview });\n});\n\napp.get(\"/api/admin/markets\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const markets = await getMarkets();\n return c.json({ ok: true, markets });\n});\n\napp.post(\"/api/admin/markets/:marketId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const marketId = Number(c.req.param(\"marketId\"));\n if (!Number.isFinite(marketId)) return jsonError(\"Invalid market id.\");\n\n const body = await c.req.json().catch(() => null);\n const regionRisk = Number(body?.region_risk);\n if (!Number.isFinite(regionRisk) || regionRisk < 0 || regionRisk > 1) {\n return jsonError(\"region_risk must be between 0 and 1.\");\n }\n\n await sqlite.execute(\n `UPDATE markets SET region_risk = ${regionRisk} WHERE id = ${marketId};`,\n );\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/breeds\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breeds = await getBreeds();\n return c.json({ ok: true, breeds });\n});\n\napp.post(\"/api/admin/breeds/:breedId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breedId = Number(c.req.param(\"breedId\"));\n if (!Number.isFinite(breedId)) return jsonError(\"Invalid breed id.\");\n\n const body = await c.req.json().catch(() => null);\n const basePrice = Number(body?.base_price);\n const volatility = Number(body?.volatility);\n const legalRisk = Number(body?.legal_risk);\n\n if (!Number.isFinite(basePrice) || basePrice < 20) return jsonError(\"base_price must be >= 20.\");\n if (!Number.isFinite(volatility) || volatility < 0 || volatility > 2) return jsonError(\"volatility must be between 0 and 2.\");\n if (!Number.isFinite(legalRisk) || legalRisk < 0 || legalRisk > 1) return jsonError(\"legal_risk must be between 0 and 1.\");\n\n await sqlite.execute(\n `UPDATE breeds\n SET base_price = ${Math.floor(basePrice)}, volatility = ${volatility}, legal_risk = ${legalRisk}\n WHERE id = ${breedId};`,\n );\n return c.json({ ok: true });\n});\n\n// --- Auth routes ---\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n\n if (!username || typeof username !== \"string\" || username.length < 3 || username.length > 24) {\n return jsonError(\"Username must be 3-24 chars.\");\n }\n if (!/^[a-zA-Z0-9_\\-]+$/.test(username)) {\n return jsonError(\"Username can only use letters, numbers, _ and -.\");\n }\n if (typeof password !== \"string\" || password.length < 6) {\n return jsonError(\"Password must be at least 6 chars.\");\n }\n\n const existing = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (existing.rows.length > 0) return jsonError(\"Username already exists.\");\n\n const hash = await hashPassword(password);\n await sqlite.execute(\n `INSERT INTO users (username, password_hash, role, avatar_blob_key, created_at)\n VALUES ('${escapeSql(username)}', '${hash}', 'player', 'preset:street-tabby', '${new Date().toISOString()}');`,\n );\n\n const userRes = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n const userId = userRes.rows[0][0] as number;\n\n await bootstrapUser(userId);\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n if (!username || !password) return jsonError(\"Missing credentials.\");\n\n const userRes = await sqlite.execute(\n `SELECT id, password_hash FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return jsonError(\"Invalid credentials.\", 401);\n\n const expectedHash = userRes.rows[0][1] as string;\n const passwordHash = await hashPassword(password);\n if (passwordHash !== expectedHash) return jsonError(\"Invalid credentials.\", 401);\n\n const userId = userRes.rows[0][0] as number;\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const cookies = parseCookies(c.req.raw);\n const token = cookies[SESSION_COOKIE];\n if (token) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n }\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n clearSessionCookie(headers);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n const snapshot = await buildSnapshot(user);\n return c.json({ user: { id: user.id, username: user.username }, snapshot, notice });\n});\n\napp.post(\"/api/avatar/preset\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const avatarId = body?.avatarId;\n if (!avatarId || typeof avatarId !== \"string\") return jsonError(\"avatarId required.\");\n if (!PIXEL_AVATARS.some((a) => a.id === avatarId)) return jsonError(\"Unknown pixel avatar.\");\n\n const avatarKey = \"preset:\" + avatarId;\n await sqlite.execute(`UPDATE users SET avatar_blob_key = '${escapeSql(avatarKey)}' WHERE id = ${user.id};`);\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, avatar_key: avatarKey, snapshot });\n});\n\napp.get(\"/api/pixel-avatar/:avatarId\", async (c) => {\n const avatarId = c.req.param(\"avatarId\");\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return c.text(\"No avatar\", 404);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\napp.get(\"/api/avatar/:userId\", async (c) => {\n const userId = Number(c.req.param(\"userId\"));\n if (!Number.isFinite(userId)) return c.text(\"Not found\", 404);\n\n const res = await sqlite.execute(`SELECT avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`);\n if (res.rows.length === 0 || !res.rows[0][0]) return c.text(\"No avatar\", 404);\n\n const avatarKey = res.rows[0][0] as string;\n const presetResponse = avatarResponse(avatarKey);\n if (presetResponse) return presetResponse;\n\n try {\n return await blob.get(avatarKey);\n } catch {\n return c.text(\"No avatar\", 404);\n }\n});\n\napp.post(\"/api/travel\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot, busted: false });\n }\n\n const body = await c.req.json().catch(() => null);\n const marketId = Number(body?.marketId);\n if (!Number.isFinite(marketId)) return jsonError(\"marketId required.\");\n\n const markets = await getMarkets();\n const targetMarket = markets.find((m) => m.id === marketId);\n if (!targetMarket) return jsonError(\"Unknown market.\");\n let message = \"\";\n let wasBusted = false;\n\n try {\n await withTransaction(async () => {\n const current = await getPlayerState(user.id);\n if (marketId === current.current_market_id) throw new Error(\"Already at that market.\");\n\n const newDay = current.day + 1;\n let heat = Math.min(100, current.heat + 8 + Math.floor(Math.random() * 13));\n let bustMessage = \"\";\n let nextCash = current.cash;\n\n const bustChance = Math.min(0.92, heat / 170 + targetMarket.region_risk * 0.28);\n if (Math.random() < bustChance) {\n const invRes = await sqlite.execute(\n `SELECT breed_id, qty FROM inventory WHERE user_id = ${user.id};`,\n );\n for (const row of invRes.rows) {\n const breedId = row[0] as number;\n const qty = row[1] as number;\n const seized = Math.floor(qty * (0.2 + Math.random() * 0.55));\n const kept = Math.max(0, qty - seized);\n await sqlite.execute(\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${kept});`,\n );\n }\n\n const fine = Math.floor(current.cash * (0.08 + Math.random() * 0.22));\n nextCash = Math.max(0, current.cash - fine);\n heat = Math.max(12, heat - 20);\n bustMessage = \"BUSTED by DHS. Fine paid: $\" + fine.toLocaleString() + \", partial cargo seized.\";\n }\n\n const heatResult = applyHeatStreakLimit(heat, current.heat_max_streak);\n heat = heatResult.heat;\n if (heatResult.forcedCooldown && !bustMessage) {\n bustMessage = \"Heat overload forced a cooldown. Heat dropped to 95%.\";\n }\n\n if (current.debt > 0 && newDay > current.debt_due_day) {\n await restartRun(user.id);\n message = \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n wasBusted = false;\n return;\n }\n\n await sqlite.execute(\n `UPDATE player_state\n SET current_market_id = ${marketId},\n day = ${newDay},\n heat = ${heat},\n cash = ${nextCash},\n heat_max_streak = ${heatResult.nextStreak}\n WHERE user_id = ${user.id};`,\n );\n\n await generatePricesForMarketDay(newDay, marketId);\n await cleanupOldMarketPrices();\n\n wasBusted = bustMessage.length > 0;\n message = bustMessage || (\"Arrived at \" + targetMarket.name + \". Heat now \" + heat + \"%.\");\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot, busted: wasBusted });\n});\n\n// --- Economy action routes ---\napp.post(\"/api/borrow\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid borrow amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested < 100) return jsonError(\"Minimum borrow is $100.\");\n if (requested > 5000) return jsonError(\"Maximum per borrow is $5,000.\");\n\n let borrowed = 0;\n let fee = 0;\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const maxDebt = 50000;\n if (state.debt >= maxDebt) throw new Error(\"Debt ceiling reached.\");\n\n const terms = computeBorrowTerms({\n requested,\n borrowCount: state.borrow_count,\n currentDebt: state.debt,\n debtDueDay: state.debt_due_day,\n currentDay: state.day,\n maxDebt,\n });\n\n if (terms.debtIncrease <= 0) throw new Error(\"Cannot borrow more right now.\");\n if (terms.principalGranted < 100) throw new Error(\"Borrow amount too high for current debt ceiling.\");\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash + terms.principalGranted},\n debt = ${state.debt + terms.debtIncrease},\n debt_due_day = ${terms.nextDueDay},\n borrow_count = ${state.borrow_count + 1}\n WHERE user_id = ${user.id};`,\n );\n\n borrowed = terms.principalGranted;\n fee = terms.fee;\n message = \"Borrowed $\" + terms.principalGranted.toLocaleString() +\n \" with fee $\" + terms.fee.toLocaleString() +\n \" (tier \" + (state.borrow_count + 1) + \"). Debt due in \" + terms.dueFromToday + \" days.\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, borrowed, fee, message, snapshot });\n});\n\napp.post(\"/api/pay-debt\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid payment amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested <= 0) return jsonError(\"Invalid payment amount.\");\n\n let payment = 0;\n let remainingDebt = 0;\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n if (state.debt <= 0) throw new Error(\"Debt already cleared.\");\n if (state.cash <= 0) throw new Error(\"No cash available to pay debt.\");\n\n payment = Math.min(requested, state.debt, state.cash);\n remainingDebt = state.debt - payment;\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash - payment}, debt = ${remainingDebt}\n WHERE user_id = ${user.id};`,\n );\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n const message = \"Paid $\" + payment.toLocaleString() + \" toward debt. Remaining debt: $\" + remainingDebt.toLocaleString() + \".\";\n return c.json({ ok: true, payment, message, snapshot });\n});\n\napp.post(\"/api/buy\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid buy request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const cargoUsed = await getCargoUsed(user.id);\n if (cargoUsed + qty > state.cargo_capacity) throw new Error(\"Not enough cargo space.\");\n\n const total = chosen.price * qty;\n if (total > state.cash) throw new Error(\"Insufficient cash.\");\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash - total} WHERE user_id = ${user.id};`,\n `INSERT INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${qty})\n ON CONFLICT(user_id, breed_id) DO UPDATE SET qty = qty + ${qty};`,\n ]);\n\n message = \"Bought \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\napp.post(\"/api/sell\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid sell request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const invRes = await sqlite.execute(\n `SELECT qty FROM inventory WHERE user_id = ${user.id} AND breed_id = ${breedId} LIMIT 1;`,\n );\n const owned = (invRes.rows[0]?.[0] as number) ?? 0;\n if (owned < qty) throw new Error(\"Not enough inventory.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const total = chosen.price * qty;\n const nextQty = owned - qty;\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash + total} WHERE user_id = ${user.id};`,\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${nextQty});`,\n ]);\n\n message = \"Sold \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\nexport default app.fetch;\n","// Cat Wars 2029\n// Single-file HTTP app: auth, economy simulation, debt lifecycle, and retro UI.\nimport { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { BREEDS, MARKETS, PIXEL_AVATARS, SESSION_COOKIE } from \"./config.ts\";\nimport { clearSessionCookie, createSession, getAuthedUser, parseCookies, setSessionCookie, type AuthedUser } from \"./auth.ts\";\nimport { applyHeatStreakLimit, computeBorrowTerms } from \"./rules.ts\";\n\ntype User = AuthedUser;\n\ntype PlayerState = {\n user_id: number;\n current_market_id: number;\n cash: number;\n debt: number;\n heat: number;\n day: number;\n cargo_capacity: number;\n debt_due_day: number;\n borrow_count: number;\n heat_max_streak: number;\n};\n\ntype PriceRow = {\n breed_id: number;\n breed_name: string;\n price: number;\n};\n\ntype MarketRow = {\n id: number;\n name: string;\n region_risk: number;\n};\n\n// --- App + session config ---\nconst app = new Hono();\n\nlet dbReady = false;\nconst MARKET_PRICE_RETENTION_DAYS = 45;\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\n// Val Town's sqlite.execute is not guaranteed to hold a multi-statement transaction\n// context across awaited calls, so this wrapper is currently best-effort.\nasync function withTransaction(fn: () => Promise): Promise {\n return fn();\n}\n\nasync function ensureMigrationTable() {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS schema_migrations (\n id TEXT PRIMARY KEY,\n applied_at TEXT NOT NULL\n );`,\n );\n}\n\nasync function isMigrationApplied(id: string): Promise {\n const res = await sqlite.execute(\n `SELECT id FROM schema_migrations WHERE id = '${escapeSql(id)}' LIMIT 1;`,\n );\n return res.rows.length > 0;\n}\n\nasync function markMigrationApplied(id: string) {\n await sqlite.execute(\n `INSERT INTO schema_migrations (id, applied_at) VALUES ('${escapeSql(id)}', '${new Date().toISOString()}');`,\n );\n}\n\nasync function hasColumn(table: string, column: string): Promise {\n const info = await sqlite.execute(`PRAGMA table_info(${table});`);\n for (const row of info.rows) {\n if (String(row[1]) === column) return true;\n }\n return false;\n}\n\nasync function runColumnMigration(id: string, table: string, column: string, alterSql: string) {\n if (await isMigrationApplied(id)) return;\n if (!(await hasColumn(table, column))) {\n await sqlite.execute(alterSql);\n }\n await markMigrationApplied(id);\n}\n\nasync function runSqlMigration(id: string, sql: string) {\n if (await isMigrationApplied(id)) return;\n await sqlite.execute(sql);\n await markMigrationApplied(id);\n}\n\n// --- Database schema + lightweight migrations ---\nasync function initDb() {\n if (dbReady) return;\n\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n avatar_blob_key TEXT,\n created_at TEXT NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS player_state (\n user_id INTEGER PRIMARY KEY,\n current_market_id INTEGER NOT NULL,\n cash INTEGER NOT NULL,\n debt INTEGER NOT NULL,\n heat INTEGER NOT NULL,\n day INTEGER NOT NULL,\n cargo_capacity INTEGER NOT NULL,\n debt_due_day INTEGER NOT NULL DEFAULT 21,\n borrow_count INTEGER NOT NULL DEFAULT 0,\n heat_max_streak INTEGER NOT NULL DEFAULT 0,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS markets (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n region_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS breeds (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n base_price INTEGER NOT NULL,\n volatility REAL NOT NULL,\n legal_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS inventory (\n user_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n qty INTEGER NOT NULL,\n PRIMARY KEY (user_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS market_day_prices (\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (day, market_id, breed_id),\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS user_market_prices (\n user_id INTEGER NOT NULL,\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (user_id, day, market_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n ]);\n\n const marketCount = await sqlite.execute(\"SELECT COUNT(*) FROM markets;\");\n if ((marketCount.rows[0][0] as number) === 0) {\n for (const m of MARKETS) {\n await sqlite.execute(\n `INSERT INTO markets (id, name, region_risk) VALUES (${m.id}, '${escapeSql(m.name)}', ${m.region_risk});`,\n );\n }\n }\n\n const breedCount = await sqlite.execute(\"SELECT COUNT(*) FROM breeds;\");\n if ((breedCount.rows[0][0] as number) === 0) {\n for (const b of BREEDS) {\n await sqlite.execute(\n `INSERT INTO breeds (id, name, base_price, volatility, legal_risk)\n VALUES (${b.id}, '${escapeSql(b.name)}', ${b.base_price}, ${b.volatility}, ${b.legal_risk});`,\n );\n }\n }\n\n await ensureMigrationTable();\n\n await runColumnMigration(\n \"2026-03-02-add-player_state-debt_due_day\",\n \"player_state\",\n \"debt_due_day\",\n \"ALTER TABLE player_state ADD COLUMN debt_due_day INTEGER NOT NULL DEFAULT 21;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-player_state-borrow_count\",\n \"player_state\",\n \"borrow_count\",\n \"ALTER TABLE player_state ADD COLUMN borrow_count INTEGER NOT NULL DEFAULT 0;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-player_state-heat_max_streak\",\n \"player_state\",\n \"heat_max_streak\",\n \"ALTER TABLE player_state ADD COLUMN heat_max_streak INTEGER NOT NULL DEFAULT 0;\",\n );\n await runColumnMigration(\n \"2026-03-02-add-users-role\",\n \"users\",\n \"role\",\n \"ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'player';\",\n );\n await runSqlMigration(\n \"2026-03-02-backfill-super-admin-first-user\",\n \"UPDATE users SET role = 'super_admin' WHERE id = (SELECT id FROM users ORDER BY id ASC LIMIT 1);\",\n );\n await runSqlMigration(\n \"2026-03-02-backfill-debt_due_day\",\n \"UPDATE player_state SET debt_due_day = CASE WHEN debt_due_day < day THEN day + 20 ELSE debt_due_day END;\",\n );\n await runSqlMigration(\n \"2026-03-02-create-market-day-prices\",\n `CREATE TABLE IF NOT EXISTS market_day_prices (\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (day, market_id, breed_id),\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n );\n await runSqlMigration(\n \"2026-03-02-backfill-market-day-prices-from-user-market-prices\",\n `INSERT OR IGNORE INTO market_day_prices (day, market_id, breed_id, price)\n SELECT day, market_id, breed_id, CAST(AVG(price) AS INTEGER)\n FROM user_market_prices\n GROUP BY day, market_id, breed_id;`,\n );\n await runSqlMigration(\n \"2026-03-02-clear-user-market-prices-legacy\",\n \"DELETE FROM user_market_prices;\",\n );\n\n dbReady = true;\n}\n\nasync function sha256(text: string): Promise {\n const bytes = new TextEncoder().encode(text);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPassword(password: string): Promise {\n return sha256(\"catwars-2029::\" + password);\n}\n\nasync function getPlayerState(userId: number): Promise {\n const res = await sqlite.execute(\n `SELECT user_id, current_market_id, cash, debt, heat, day, cargo_capacity, debt_due_day, borrow_count, heat_max_streak\n FROM player_state WHERE user_id = ${userId} LIMIT 1;`,\n );\n return {\n user_id: res.rows[0][0] as number,\n current_market_id: res.rows[0][1] as number,\n cash: res.rows[0][2] as number,\n debt: res.rows[0][3] as number,\n heat: res.rows[0][4] as number,\n day: res.rows[0][5] as number,\n cargo_capacity: res.rows[0][6] as number,\n debt_due_day: res.rows[0][7] as number,\n borrow_count: res.rows[0][8] as number,\n heat_max_streak: res.rows[0][9] as number,\n };\n}\n\nasync function getMarkets(): Promise {\n const res = await sqlite.execute(\n \"SELECT id, name, region_risk FROM markets ORDER BY id ASC;\",\n );\n return res.rows.map((r) => ({\n id: r[0] as number,\n name: r[1] as string,\n region_risk: r[2] as number,\n }));\n}\n\nfunction isAdmin(user: User): boolean {\n return user.role === \"super_admin\" || user.role === \"admin\";\n}\n\n// --- Economy model: market price generation ---\nasync function generatePricesForMarketDay(day: number, marketId: number): Promise {\n const existing = await sqlite.execute(\n `SELECT COUNT(*) FROM market_day_prices WHERE day = ${day} AND market_id = ${marketId};`,\n );\n if ((existing.rows[0][0] as number) > 0) return;\n\n const marketRes = await sqlite.execute(`SELECT region_risk FROM markets WHERE id = ${marketId} LIMIT 1;`);\n const regionRisk = (marketRes.rows[0]?.[0] as number) ?? 0.2;\n\n const breedsRes = await sqlite.execute(\n `SELECT id, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;`,\n );\n\n for (const row of breedsRes.rows) {\n const breedId = row[0] as number;\n const basePrice = row[1] as number;\n const volatility = row[2] as number;\n const legalRisk = row[3] as number;\n\n const wave = Math.sin((day + breedId * 7 + marketId * 13) * 0.73) * volatility;\n const chaos = (Math.random() - 0.5) * volatility * 1.8;\n const crackdown = (regionRisk + legalRisk) * 0.6;\n const multiplier = Math.max(0.2, 1 + wave + chaos + crackdown);\n const price = Math.max(20, Math.floor(basePrice * multiplier));\n\n await sqlite.execute(\n `INSERT OR IGNORE INTO market_day_prices (day, market_id, breed_id, price)\n VALUES (${day}, ${marketId}, ${breedId}, ${price});`,\n );\n }\n}\n\nasync function getCurrentPrices(day: number, marketId: number): Promise {\n const rows = await sqlite.execute(\n `SELECT p.breed_id, b.name, p.price\n FROM market_day_prices p\n JOIN breeds b ON b.id = p.breed_id\n WHERE p.day = ${day} AND p.market_id = ${marketId}\n ORDER BY p.breed_id ASC;`,\n );\n\n if (rows.rows.length === 0) {\n await generatePricesForMarketDay(day, marketId);\n return getCurrentPrices(day, marketId);\n }\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n price: r[2] as number,\n }));\n}\n\nasync function getInventory(userId: number): Promise> {\n const rows = await sqlite.execute(\n `SELECT i.breed_id, b.name, i.qty\n FROM inventory i\n JOIN breeds b ON b.id = i.breed_id\n WHERE i.user_id = ${userId}\n ORDER BY i.breed_id ASC;`,\n );\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n qty: r[2] as number,\n }));\n}\n\nasync function getCargoUsed(userId: number): Promise {\n const res = await sqlite.execute(`SELECT COALESCE(SUM(qty), 0) FROM inventory WHERE user_id = ${userId};`);\n return res.rows[0][0] as number;\n}\n\nasync function cleanupOldMarketPrices(retentionDays = MARKET_PRICE_RETENTION_DAYS): Promise {\n const maxDayRes = await sqlite.execute(\"SELECT COALESCE(MAX(day), 0) FROM player_state;\");\n const maxDay = (maxDayRes.rows[0][0] as number) ?? 0;\n const cutoffDay = maxDay - retentionDays;\n if (cutoffDay <= 0) return;\n\n await sqlite.execute(`DELETE FROM market_day_prices WHERE day < ${cutoffDay};`);\n}\n\nasync function bootstrapUser(userId: number): Promise {\n await sqlite.execute(\n `INSERT INTO player_state (user_id, current_market_id, cash, debt, heat, day, cargo_capacity, debt_due_day, borrow_count, heat_max_streak)\n VALUES (${userId}, 1, 2200, 900, 0, 1, 100, 21, 0, 0);`,\n );\n await generatePricesForMarketDay(1, 1);\n}\n\n// Bankruptcy reset: wipe inventory and reset run baseline.\nasync function restartRun(userId: number): Promise {\n await sqlite.batch([\n `DELETE FROM inventory WHERE user_id = ${userId};`,\n `UPDATE player_state\n SET current_market_id = 1,\n cash = 2200,\n debt = 900,\n heat = 0,\n day = 1,\n cargo_capacity = 100,\n debt_due_day = 21,\n borrow_count = 0,\n heat_max_streak = 0\n WHERE user_id = ${userId};`,\n ]);\n await generatePricesForMarketDay(1, 1);\n}\n\nasync function enforceDebtDeadline(userId: number): Promise {\n const state = await getPlayerState(userId);\n if (state.debt > 0 && state.day > state.debt_due_day) {\n await restartRun(userId);\n return \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n }\n return null;\n}\n\nfunction pixelAvatarSvg(avatarId: string): string | null {\n const palette = PIXEL_AVATARS.find((p) => p.id === avatarId);\n if (!palette) return null;\n\n const c1 = palette.colors[0];\n const c2 = palette.colors[1];\n const c3 = palette.colors[2];\n const c4 = palette.colors[3];\n\n let sprite = \"\";\n\n if (avatarId === \"street-tabby\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"neon-sphynx\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"void-panther\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"mint-mouser\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"sunset-bengal\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else if (avatarId === \"royal-fold\") {\n sprite = `\n \n \n \n \n \n \n \n \n \n \n \n \n \n `;\n } else {\n return null;\n }\n\n return `\n`.trim();\n}\n\nfunction avatarResponse(avatarBlobKey: string): Response | null {\n if (avatarBlobKey.startsWith(\"preset:\")) {\n const avatarId = avatarBlobKey.slice(\"preset:\".length);\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return null;\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n }\n return null;\n}\n\nfunction jsonError(message: string, status = 400): Response {\n return new Response(JSON.stringify({ error: message }), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\nasync function getBreeds() {\n const rows = await sqlite.execute(\n \"SELECT id, name, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;\",\n );\n return rows.rows.map((r) => ({\n id: r[0] as number,\n name: r[1] as string,\n base_price: r[2] as number,\n volatility: r[3] as number,\n legal_risk: r[4] as number,\n }));\n}\n\nasync function getAdminOverview() {\n const users = await sqlite.execute(\"SELECT COUNT(*) FROM users;\");\n const players = await sqlite.execute(\"SELECT COUNT(*) FROM player_state;\");\n const econ = await sqlite.execute(\n \"SELECT COALESCE(SUM(cash), 0), COALESCE(SUM(debt), 0), COALESCE(AVG(heat), 0) FROM player_state;\",\n );\n const marketRows = await sqlite.execute(\n `SELECT m.name, COUNT(ps.user_id) AS players_here\n FROM markets m\n LEFT JOIN player_state ps ON ps.current_market_id = m.id\n GROUP BY m.id, m.name\n ORDER BY players_here DESC, m.id ASC;`,\n );\n\n return {\n users: users.rows[0][0] as number,\n active_players: players.rows[0][0] as number,\n total_cash: econ.rows[0][0] as number,\n total_debt: econ.rows[0][1] as number,\n avg_heat: Number(econ.rows[0][2] as number),\n market_distribution: marketRows.rows.map((r) => ({\n market: r[0] as string,\n players: r[1] as number,\n })),\n };\n}\n\nasync function buildSnapshot(user: User) {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const inventory = await getInventory(user.id);\n const cargoUsed = await getCargoUsed(user.id);\n const markets = await getMarkets();\n const currentMarket = markets.find((m) => m.id === state.current_market_id);\n\n return {\n user: { id: user.id, username: user.username, role: user.role },\n market: { id: state.current_market_id, name: currentMarket?.name ?? \"Unknown\" },\n markets,\n state,\n prices,\n inventory,\n cargo_used: cargoUsed,\n debt_days_left: Math.max(0, state.debt_due_day - state.day),\n borrow_level: state.borrow_count,\n avatar_url: user.avatar_blob_key ? \"/api/avatar/\" + user.id + \"?v=\" + Date.now() : null,\n avatar_key: user.avatar_blob_key,\n pixel_avatars: PIXEL_AVATARS.map((p) => ({\n id: p.id,\n name: p.name,\n preview_url: \"/api/pixel-avatar/\" + p.id,\n })),\n };\n}\n\nfunction adminPage(): string {\n return `\n\n\n \n \n Cat Wars Admin Console\n \n\n\n

Cat Wars Admin Console

Super Admin controls for economy and market-force tuning.

Back to Game

\n\n

Overview

\n\n

Markets

\n \n \n \n

ID	Name	Region Risk	Action

\n\n

Breeds

\n \n \n \n

ID	Name	Base Price	Volatility	Legal Risk	Action

\n\n

\n\n \n\n`;\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

\n\n

The Situation

It is 2029. After a French cat went mega-viral on YouTube, lawmakers branded the trend \"unamerican\" and rushed through a federal feline ban. Cat ownership is now contraband, and the Department of Homeland Security runs aggressive interdiction sweeps across major U.S. cities.

You are an underground courier in a black-market trading ring. Your job is to jet city-to-city, buy cat breeds where prices are low, and sell where prices spike before DHS heat catches up.

How The Game Works

Register or log in to start your run.
Each market has different breed prices each day.
Buy low, travel, then sell high for profit.
Traveling raises Heat and can trigger a DHS bust.
Busts can seize cargo and force cash fines.
Use profits to pay down debt and stay solvent.

\n\n

\n \n \n

\n\n \n\n

DHS BUST IN PROGRESS :: CARGO SEIZURE + FINES APPLIED

VISITOR COUNTER 000042

\n\n \n\n`;\n}\n\n// --- Global middleware ---\napp.use(\"*\", async (_c, next) => {\n await initDb();\n await next();\n});\n\n// --- Page route ---\napp.get(\"/\", (c) => c.html(htmlPage()));\n\napp.get(\"/admin\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return c.text(\"Unauthorized\", 401);\n if (!isAdmin(user)) return c.text(\"Forbidden\", 403);\n return c.html(adminPage());\n});\n\n// --- Admin APIs ---\napp.get(\"/api/admin/overview\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const overview = await getAdminOverview();\n return c.json({ ok: true, overview });\n});\n\napp.get(\"/api/admin/markets\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const markets = await getMarkets();\n return c.json({ ok: true, markets });\n});\n\napp.post(\"/api/admin/markets/:marketId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const marketId = Number(c.req.param(\"marketId\"));\n if (!Number.isFinite(marketId)) return jsonError(\"Invalid market id.\");\n\n const body = await c.req.json().catch(() => null);\n const regionRisk = Number(body?.region_risk);\n if (!Number.isFinite(regionRisk) || regionRisk < 0 || regionRisk > 1) {\n return jsonError(\"region_risk must be between 0 and 1.\");\n }\n\n await sqlite.execute(\n `UPDATE markets SET region_risk = ${regionRisk} WHERE id = ${marketId};`,\n );\n return c.json({ ok: true });\n});\n\napp.get(\"/api/admin/breeds\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breeds = await getBreeds();\n return c.json({ ok: true, breeds });\n});\n\napp.post(\"/api/admin/breeds/:breedId\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n if (!isAdmin(user)) return jsonError(\"Forbidden\", 403);\n\n const breedId = Number(c.req.param(\"breedId\"));\n if (!Number.isFinite(breedId)) return jsonError(\"Invalid breed id.\");\n\n const body = await c.req.json().catch(() => null);\n const basePrice = Number(body?.base_price);\n const volatility = Number(body?.volatility);\n const legalRisk = Number(body?.legal_risk);\n\n if (!Number.isFinite(basePrice) || basePrice < 20) return jsonError(\"base_price must be >= 20.\");\n if (!Number.isFinite(volatility) || volatility < 0 || volatility > 2) return jsonError(\"volatility must be between 0 and 2.\");\n if (!Number.isFinite(legalRisk) || legalRisk < 0 || legalRisk > 1) return jsonError(\"legal_risk must be between 0 and 1.\");\n\n await sqlite.execute(\n `UPDATE breeds\n SET base_price = ${Math.floor(basePrice)}, volatility = ${volatility}, legal_risk = ${legalRisk}\n WHERE id = ${breedId};`,\n );\n return c.json({ ok: true });\n});\n\n// --- Auth routes ---\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n\n if (!username || typeof username !== \"string\" || username.length < 3 || username.length > 24) {\n return jsonError(\"Username must be 3-24 chars.\");\n }\n if (!/^[a-zA-Z0-9_\\-]+$/.test(username)) {\n return jsonError(\"Username can only use letters, numbers, _ and -.\");\n }\n if (typeof password !== \"string\" || password.length < 6) {\n return jsonError(\"Password must be at least 6 chars.\");\n }\n\n const existing = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (existing.rows.length > 0) return jsonError(\"Username already exists.\");\n\n const hash = await hashPassword(password);\n await sqlite.execute(\n `INSERT INTO users (username, password_hash, role, avatar_blob_key, created_at)\n VALUES ('${escapeSql(username)}', '${hash}', 'player', 'preset:street-tabby', '${new Date().toISOString()}');`,\n );\n\n const userRes = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n const userId = userRes.rows[0][0] as number;\n\n await bootstrapUser(userId);\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n if (!username || !password) return jsonError(\"Missing credentials.\");\n\n const userRes = await sqlite.execute(\n `SELECT id, password_hash FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return jsonError(\"Invalid credentials.\", 401);\n\n const expectedHash = userRes.rows[0][1] as string;\n const passwordHash = await hashPassword(password);\n if (passwordHash !== expectedHash) return jsonError(\"Invalid credentials.\", 401);\n\n const userId = userRes.rows[0][0] as number;\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const cookies = parseCookies(c.req.raw);\n const token = cookies[SESSION_COOKIE];\n if (token) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n }\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n clearSessionCookie(headers);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n const snapshot = await buildSnapshot(user);\n return c.json({ user: { id: user.id, username: user.username }, snapshot, notice });\n});\n\napp.post(\"/api/avatar/preset\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const avatarId = body?.avatarId;\n if (!avatarId || typeof avatarId !== \"string\") return jsonError(\"avatarId required.\");\n if (!PIXEL_AVATARS.some((a) => a.id === avatarId)) return jsonError(\"Unknown pixel avatar.\");\n\n const avatarKey = \"preset:\" + avatarId;\n await sqlite.execute(`UPDATE users SET avatar_blob_key = '${escapeSql(avatarKey)}' WHERE id = ${user.id};`);\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, avatar_key: avatarKey, snapshot });\n});\n\napp.get(\"/api/pixel-avatar/:avatarId\", async (c) => {\n const avatarId = c.req.param(\"avatarId\");\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return c.text(\"No avatar\", 404);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\napp.get(\"/api/avatar/:userId\", async (c) => {\n const userId = Number(c.req.param(\"userId\"));\n if (!Number.isFinite(userId)) return c.text(\"Not found\", 404);\n\n const res = await sqlite.execute(`SELECT avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`);\n if (res.rows.length === 0 || !res.rows[0][0]) return c.text(\"No avatar\", 404);\n\n const avatarKey = res.rows[0][0] as string;\n const presetResponse = avatarResponse(avatarKey);\n if (presetResponse) return presetResponse;\n\n try {\n return await blob.get(avatarKey);\n } catch {\n return c.text(\"No avatar\", 404);\n }\n});\n\napp.post(\"/api/travel\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot, busted: false });\n }\n\n const body = await c.req.json().catch(() => null);\n const marketId = Number(body?.marketId);\n if (!Number.isFinite(marketId)) return jsonError(\"marketId required.\");\n\n const markets = await getMarkets();\n const targetMarket = markets.find((m) => m.id === marketId);\n if (!targetMarket) return jsonError(\"Unknown market.\");\n let message = \"\";\n let wasBusted = false;\n\n try {\n await withTransaction(async () => {\n const current = await getPlayerState(user.id);\n if (marketId === current.current_market_id) throw new Error(\"Already at that market.\");\n\n const newDay = current.day + 1;\n let heat = Math.min(100, current.heat + 8 + Math.floor(Math.random() * 13));\n let bustMessage = \"\";\n let nextCash = current.cash;\n\n const bustChance = Math.min(0.92, heat / 170 + targetMarket.region_risk * 0.28);\n if (Math.random() < bustChance) {\n const invRes = await sqlite.execute(\n `SELECT breed_id, qty FROM inventory WHERE user_id = ${user.id};`,\n );\n for (const row of invRes.rows) {\n const breedId = row[0] as number;\n const qty = row[1] as number;\n const seized = Math.floor(qty * (0.2 + Math.random() * 0.55));\n const kept = Math.max(0, qty - seized);\n await sqlite.execute(\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${kept});`,\n );\n }\n\n const fine = Math.floor(current.cash * (0.08 + Math.random() * 0.22));\n nextCash = Math.max(0, current.cash - fine);\n heat = Math.max(12, heat - 20);\n bustMessage = \"BUSTED by DHS. Fine paid: $\" + fine.toLocaleString() + \", partial cargo seized.\";\n }\n\n const heatResult = applyHeatStreakLimit(heat, current.heat_max_streak);\n heat = heatResult.heat;\n if (heatResult.forcedCooldown && !bustMessage) {\n bustMessage = \"Heat overload forced a cooldown. Heat dropped to 95%.\";\n }\n\n if (current.debt > 0 && newDay > current.debt_due_day) {\n await restartRun(user.id);\n message = \"Debt deadline missed. You went broke, lost all inventory, and restarted your run.\";\n wasBusted = false;\n return;\n }\n\n await sqlite.execute(\n `UPDATE player_state\n SET current_market_id = ${marketId},\n day = ${newDay},\n heat = ${heat},\n cash = ${nextCash},\n heat_max_streak = ${heatResult.nextStreak}\n WHERE user_id = ${user.id};`,\n );\n\n await generatePricesForMarketDay(newDay, marketId);\n await cleanupOldMarketPrices();\n\n wasBusted = bustMessage.length > 0;\n message = bustMessage || (\"Arrived at \" + targetMarket.name + \". Heat now \" + heat + \"%.\");\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot, busted: wasBusted });\n});\n\n// --- Economy action routes ---\napp.post(\"/api/borrow\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid borrow amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested < 100) return jsonError(\"Minimum borrow is $100.\");\n if (requested > 5000) return jsonError(\"Maximum per borrow is $5,000.\");\n\n let borrowed = 0;\n let fee = 0;\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const maxDebt = 50000;\n if (state.debt >= maxDebt) throw new Error(\"Debt ceiling reached.\");\n\n const terms = computeBorrowTerms({\n requested,\n borrowCount: state.borrow_count,\n currentDebt: state.debt,\n debtDueDay: state.debt_due_day,\n currentDay: state.day,\n maxDebt,\n });\n\n if (terms.debtIncrease <= 0) throw new Error(\"Cannot borrow more right now.\");\n if (terms.principalGranted < 100) throw new Error(\"Borrow amount too high for current debt ceiling.\");\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash + terms.principalGranted},\n debt = ${state.debt + terms.debtIncrease},\n debt_due_day = ${terms.nextDueDay},\n borrow_count = ${state.borrow_count + 1}\n WHERE user_id = ${user.id};`,\n );\n\n borrowed = terms.principalGranted;\n fee = terms.fee;\n message = \"Borrowed $\" + terms.principalGranted.toLocaleString() +\n \" with fee $\" + terms.fee.toLocaleString() +\n \" (tier \" + (state.borrow_count + 1) + \"). Debt due in \" + terms.dueFromToday + \" days.\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, borrowed, fee, message, snapshot });\n});\n\napp.post(\"/api/pay-debt\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const amountRaw = Number(body?.amount);\n if (!Number.isFinite(amountRaw) || amountRaw <= 0) return jsonError(\"Invalid payment amount.\");\n\n const requested = Math.floor(amountRaw);\n if (requested <= 0) return jsonError(\"Invalid payment amount.\");\n\n let payment = 0;\n let remainingDebt = 0;\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n if (state.debt <= 0) throw new Error(\"Debt already cleared.\");\n if (state.cash <= 0) throw new Error(\"No cash available to pay debt.\");\n\n payment = Math.min(requested, state.debt, state.cash);\n remainingDebt = state.debt - payment;\n\n await sqlite.execute(\n `UPDATE player_state\n SET cash = ${state.cash - payment}, debt = ${remainingDebt}\n WHERE user_id = ${user.id};`,\n );\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n const message = \"Paid $\" + payment.toLocaleString() + \" toward debt. Remaining debt: $\" + remainingDebt.toLocaleString() + \".\";\n return c.json({ ok: true, payment, message, snapshot });\n});\n\napp.post(\"/api/buy\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid buy request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const cargoUsed = await getCargoUsed(user.id);\n if (cargoUsed + qty > state.cargo_capacity) throw new Error(\"Not enough cargo space.\");\n\n const total = chosen.price * qty;\n if (total > state.cash) throw new Error(\"Insufficient cash.\");\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash - total} WHERE user_id = ${user.id};`,\n `INSERT INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${qty})\n ON CONFLICT(user_id, breed_id) DO UPDATE SET qty = qty + ${qty};`,\n ]);\n\n message = \"Bought \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\napp.post(\"/api/sell\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const notice = await enforceDebtDeadline(user.id);\n if (notice) {\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: notice, snapshot });\n }\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid sell request.\");\n\n let message = \"\";\n\n try {\n await withTransaction(async () => {\n const invRes = await sqlite.execute(\n `SELECT qty FROM inventory WHERE user_id = ${user.id} AND breed_id = ${breedId} LIMIT 1;`,\n );\n const owned = (invRes.rows[0]?.[0] as number) ?? 0;\n if (owned < qty) throw new Error(\"Not enough inventory.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) throw new Error(\"Breed not found in market.\");\n\n const total = chosen.price * qty;\n const nextQty = owned - qty;\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash + total} WHERE user_id = ${user.id};`,\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${nextQty});`,\n ]);\n\n message = \"Sold \" + qty + \" \" + chosen.breed_name + \".\";\n });\n } catch (err) {\n return jsonError((err as Error).message);\n }\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message, snapshot });\n});\n\nexport default app.fetch;\n","createdAt",["D",1772539795880],"branchVersion","branchId","19c078f8-15ca-11f1-92f1-42dde27851f2","id","19bfdd94-15ca-11f1-92f1-42dde27851f2","cat-wars",["D",1772409318475],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Cat Wars 2029 trading game MVP","imageUrl","40e69d1a-3254-4858-920b-7b1449761575","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","54bae3d1-8223-41e5-b22d-81eb28a263c7","tursoName","19bfdd9415ca11f192f142dde27851f2","tursoHostname","19bfdd9415ca11f192f142dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789469441210],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_104":100},"org",{"_97":96,"_98":-5,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":14,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","pchinjr","handle","displayName","avatar","https://images.clerk.dev/oauth_github/img_2OaSpooJk6yZ5KFqyjtIVA4z3SH.jpeg","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":216,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":217,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":218,"_82":219,"_84":220,"_86":25},"tree",[191,192,193,194,195,196],"files",[191,192,193,194,195,196],"counts",{"_181":61,"_182":151,"_183":61,"_184":185,"_186":187},"contents",[128,129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":173,"_32":174,"_30":175,"_137":-5,"_41":42,"_40":176,"_139":123,"_38":177,"_13":178,"_33":20,"_35":179,"_24":25,"_144":-5,"_27":180},{"_43":165,"_32":166,"_30":167,"_137":-5,"_41":42,"_40":168,"_139":123,"_38":169,"_13":170,"_33":142,"_35":171,"_24":25,"_144":-5,"_27":172},{"_43":158,"_32":159,"_30":160,"_137":-5,"_41":42,"_40":161,"_139":123,"_38":162,"_13":61,"_33":142,"_35":163,"_24":25,"_144":-5,"_27":164},{"_43":154,"_32":28,"_30":31,"_137":-5,"_41":42,"_40":14,"_139":123,"_38":155,"_13":156,"_33":34,"_35":37,"_24":25,"_144":-5,"_27":157},{"_43":146,"_32":147,"_30":148,"_137":-5,"_41":42,"_40":149,"_139":123,"_38":150,"_13":151,"_33":142,"_35":152,"_24":25,"_144":-5,"_27":153},{"_43":134,"_32":135,"_30":136,"_137":-5,"_41":42,"_40":138,"_139":123,"_38":140,"_13":141,"_33":142,"_35":143,"_24":25,"_144":-5,"_27":145},"6ace1dbe-1646-11f1-8efa-42dde27851f2","rules_test.ts","5d89342c-1646-11f1-8efa-42dde27851f2","parentId",102,"latest",["D",1772462712049],3,"script","import { applyHeatStreakLimit, computeBorrowTerms } from \"./rules.ts\";\n\nfunction assert(condition: boolean, message: string) {\n if (!condition) {\n throw new Error(message);\n }\n}\n\nfunction assertApprox(actual: number, expected: number, epsilon: number, message: string) {\n if (Math.abs(actual - expected) > epsilon) {\n throw new Error(message + \" (actual=\" + actual + \", expected=\" + expected + \")\");\n }\n}\n\nfunction testBorrowTermsBaseCase() {\n const terms = computeBorrowTerms({\n requested: 1000,\n borrowCount: 0,\n currentDebt: 900,\n debtDueDay: 21,\n currentDay: 1,\n maxDebt: 50000,\n });\n\n assertApprox(terms.feeRate, 0.1, 1e-9, \"feeRate should start at 10%.\");\n assert(terms.fee === 100, \"fee should be 100 for $1000 request at tier 0.\");\n assert(terms.debtIncrease === 1100, \"debtIncrease should include principal + fee.\");\n assert(terms.principalGranted === 1000, \"principalGranted should equal requested when under cap.\");\n assert(terms.dueFromToday === 25, \"initial borrow should extend deadline by 5 days (20 -> 25).\");\n assert(terms.nextDueDay === 26, \"next due day should equal currentDay + dueFromToday.\");\n}\n\nfunction testBorrowTermsCapAndCeiling() {\n const terms = computeBorrowTerms({\n requested: 5000,\n borrowCount: 12,\n currentDebt: 49500,\n debtDueDay: 160,\n currentDay: 100,\n maxDebt: 50000,\n });\n\n assertApprox(terms.feeRate, 0.7, 1e-9, \"feeRate should escalate with borrow count.\");\n assert(terms.debtIncrease === 500, \"debt increase should clamp to debt ceiling remainder.\");\n assert(terms.principalGranted === 0, \"if ceiling room is below fee, granted principal can be 0.\");\n assert(terms.dueFromToday === 80, \"deadline should be capped by remaining runway and extension.\");\n assert(terms.nextDueDay === 180, \"next due day should respect dueFromToday math.\");\n}\n\nfunction testBorrowTermsHardNinetyDayCap() {\n const terms = computeBorrowTerms({\n requested: 300,\n borrowCount: 30,\n currentDebt: 1000,\n debtDueDay: 600,\n currentDay: 100,\n maxDebt: 50000,\n });\n\n assert(terms.feeRate === 0.75, \"feeRate must clamp at 75%.\");\n assert(terms.dueFromToday === 90, \"debt cycle cannot exceed 90 days.\");\n assert(terms.nextDueDay === 190, \"next due day should follow 90-day cap.\");\n}\n\nfunction testHeatStreakLimit() {\n const first = applyHeatStreakLimit(100, 0);\n assert(first.heat === 100 && first.nextStreak === 1 && !first.forcedCooldown, \"first 100% heat turn should increment streak.\");\n\n const second = applyHeatStreakLimit(100, first.nextStreak);\n assert(second.heat === 100 && second.nextStreak === 2 && !second.forcedCooldown, \"second 100% heat turn should increment streak to 2.\");\n\n const third = applyHeatStreakLimit(100, second.nextStreak);\n assert(third.heat === 95 && third.nextStreak === 0 && third.forcedCooldown, \"third consecutive 100% heat turn should trigger cooldown.\");\n\n const recover = applyHeatStreakLimit(82, third.nextStreak);\n assert(recover.heat === 82 && recover.nextStreak === 0 && !recover.forcedCooldown, \"non-100 heat should reset streak.\");\n}\n\ntestBorrowTermsBaseCase();\ntestBorrowTermsCapAndCeiling();\ntestBorrowTermsHardNinetyDayCap();\ntestHeatStreakLimit();\n\nconsole.log(\"rules_test.ts passed\");\n","label",[135],"76f5a6aa-1648-11f1-af51-42dde27851f2","rules.ts","279104c6-1646-11f1-bbdd-42dde27851f2",109,["D",1772463591435],1,"export type BorrowTermsInput = {\n requested: number;\n borrowCount: number;\n currentDebt: number;\n debtDueDay: number;\n currentDay: number;\n maxDebt?: number;\n};\n\nexport type BorrowTerms = {\n feeRate: number;\n fee: number;\n principalGranted: number;\n debtIncrease: number;\n dueFromToday: number;\n nextDueDay: number;\n};\n\n/**\n * Computes borrowing outcomes for one loan action.\n *\n * Rules:\n * - Fee rate starts at 10% and increases by 5% per prior borrow (capped at 75%).\n * - New debt increase = principal + fee, clamped to debt ceiling.\n * - Due-day extension increases with borrow count but due horizon is capped at 90 days.\n */\nexport function computeBorrowTerms(input: BorrowTermsInput): BorrowTerms {\n const maxDebt = input.maxDebt ?? 50000;\n const feeRate = Math.min(0.75, 0.1 + input.borrowCount * 0.05);\n const fee = Math.floor(input.requested * feeRate);\n const debtIncreaseRaw = input.requested + fee;\n const debtIncrease = Math.min(debtIncreaseRaw, Math.max(0, maxDebt - input.currentDebt));\n const principalGranted = Math.max(0, debtIncrease - fee);\n\n const extensionDays = Math.min(20, 5 + input.borrowCount * 2);\n const dueFromToday = Math.min(\n 90,\n Math.max(1, input.debtDueDay - input.currentDay) + extensionDays,\n );\n\n return {\n feeRate,\n fee,\n principalGranted,\n debtIncrease,\n dueFromToday,\n nextDueDay: input.currentDay + dueFromToday,\n };\n}\n\n/**\n * Prevents heat from staying maxed indefinitely.\n * If heat reaches 100% for more than two consecutive turns, force cooldown to 95%.\n */\nexport function applyHeatStreakLimit(heat: number, currentStreak: number): {\n heat: number;\n nextStreak: number;\n forcedCooldown: boolean;\n} {\n const streak = heat === 100 ? currentStreak + 1 : 0;\n if (streak > 2) {\n return { heat: 95, nextStreak: 0, forcedCooldown: true };\n }\n return { heat, nextStreak: streak, forcedCooldown: false };\n}\n",[147],"e4593eee-16f9-11f1-bdd7-42dde27851f2",["D",1772539795880],123,[28],"889ad4be-1645-11f1-ad88-42dde27851f2","config.ts","889ad586-1645-11f1-ad88-42dde27851f2",86,["D",1772462332554],"export const SESSION_COOKIE = \"catwars_session\";\nexport const SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14;\n\nexport const MARKETS = [\n { id: 1, name: \"New York City\", region_risk: 0.25 },\n { id: 2, name: \"Seattle\", region_risk: 0.18 },\n { id: 3, name: \"San Francisco\", region_risk: 0.22 },\n { id: 4, name: \"Miami\", region_risk: 0.3 },\n { id: 5, name: \"Chicago\", region_risk: 0.35 },\n { id: 6, name: \"Austin\", region_risk: 0.2 },\n] as const;\n\nexport const BREEDS = [\n { id: 1, name: \"Street Tabby\", base_price: 95, volatility: 0.35, legal_risk: 0.1 },\n { id: 2, name: \"Siamese\", base_price: 300, volatility: 0.45, legal_risk: 0.22 },\n { id: 3, name: \"Maine Coon\", base_price: 520, volatility: 0.4, legal_risk: 0.28 },\n { id: 4, name: \"Bengal\", base_price: 800, volatility: 0.55, legal_risk: 0.35 },\n { id: 5, name: \"Sphynx\", base_price: 1200, volatility: 0.65, legal_risk: 0.42 },\n { id: 6, name: \"Scottish Fold\", base_price: 680, volatility: 0.5, legal_risk: 0.3 },\n] as const;\n\nexport const PIXEL_AVATARS = [\n { id: \"street-tabby\", name: \"Street Tabby\", colors: [\"#f6d08d\", \"#925b2d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"neon-sphynx\", name: \"Neon Sphynx\", colors: [\"#ffb6df\", \"#c23888\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"void-panther\", name: \"Void Panther\", colors: [\"#616161\", \"#1f1f1f\", \"#00f7ff\", \"#fefefe\"] },\n { id: \"mint-mouser\", name: \"Mint Mouser\", colors: [\"#b6ffd8\", \"#2e9b6d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"sunset-bengal\", name: \"Sunset Bengal\", colors: [\"#ffc081\", \"#d0682f\", \"#2b1c17\", \"#fefefe\"] },\n { id: \"royal-fold\", name: \"Royal Fold\", colors: [\"#d3c4ff\", \"#6f56d7\", \"#1d1d1d\", \"#fefefe\"] },\n] as const;\n",[159],"d45c2064-1664-11f1-8e4b-42dde27851f2","auth.ts","e2002cc0-1645-11f1-9ac0-42dde27851f2",134,["D",1772475774040],5,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { SESSION_COOKIE, SESSION_TTL_MS } from \"./config.ts\";\n\nexport type AuthedUser = {\n id: number;\n username: string;\n role: string;\n avatar_blob_key: string | null;\n};\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\n/** Parses the Cookie header into a key/value map. */\nexport function parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") || \"\";\n const parts = header.split(\";\").map((p) => p.trim()).filter(Boolean);\n const out: Record = {};\n for (const p of parts) {\n const idx = p.indexOf(\"=\");\n if (idx > -1) {\n out[p.slice(0, idx)] = decodeURIComponent(p.slice(idx + 1));\n }\n }\n return out;\n}\n\n/** Writes the auth session cookie using configured TTL. */\nexport function setSessionCookie(headers: Headers, token: string) {\n headers.append(\n \"Set-Cookie\",\n SESSION_COOKIE + \"=\" + encodeURIComponent(token) + \"; Path=/; HttpOnly; SameSite=Lax; Max-Age=\" + Math.floor(SESSION_TTL_MS / 1000),\n );\n}\n\n/** Clears the auth session cookie immediately. */\nexport function clearSessionCookie(headers: Headers) {\n headers.append(\"Set-Cookie\", SESSION_COOKIE + \"=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\");\n}\n\n/** Creates a new persisted session token for a user ID. */\nexport async function createSession(userId: number): Promise {\n const token = crypto.randomUUID() + \"-\" + crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute(\n `INSERT INTO sessions (token, user_id, expires_at) VALUES ('${escapeSql(token)}', ${userId}, ${expiresAt});`,\n );\n return token;\n}\n\n/** Resolves the authenticated user from cookie session token, or null if invalid/expired. */\nexport async function getAuthedUser(req: Request): Promise {\n const cookies = parseCookies(req);\n const token = cookies[SESSION_COOKIE];\n if (!token) return null;\n\n const sessionRes = await sqlite.execute(\n `SELECT user_id, expires_at FROM sessions WHERE token = '${escapeSql(token)}' LIMIT 1;`,\n );\n if (sessionRes.rows.length === 0) return null;\n\n const userId = sessionRes.rows[0][0] as number;\n const expiresAt = sessionRes.rows[0][1] as number;\n if (expiresAt < Date.now()) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n return null;\n }\n\n const userRes = await sqlite.execute(\n `SELECT id, username, role, avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return null;\n\n return {\n id: userRes.rows[0][0] as number,\n username: userRes.rows[0][1] as string,\n role: (userRes.rows[0][2] as string) || \"player\",\n avatar_blob_key: (userRes.rows[0][3] as string | null) ?? null,\n };\n}\n",[166],"4a8a0b02-1665-11f1-87d4-42dde27851f2","README.md","836a4b08-1638-11f1-9ce6-42dde27851f2",147,["D",1772475972307],11,"# Cat Wars 2029\n\nA retro-styled browser trading game inspired by the Drug Wars gameplay loop.\n\nPlayers move between real U.S. city markets, buy/sell illegal cat breeds, manage heat risk, and survive escalating debt pressure.\n\n## Stack\n\n- Runtime: Val Town HTTP Val (`main.ts`)\n- Web framework: `Hono`\n- Persistence: Val-scoped SQLite via `https://esm.town/v/std/sqlite/main.ts`\n- Binary/media: Val Town `blob` (avatar path still supports blob keys, UI uses pixel presets)\n- Frontend: server-rendered HTML + vanilla JS\n\n## Project Files\n\n- `main.ts`: HTTP routes, DB bootstrap/migrations, rendering, game actions, and admin dashboard/API\n- `auth.ts`: session cookie parsing, session token lifecycle, authenticated user lookup\n- `config.ts`: static game config (markets, breeds, pixel avatar metadata)\n- `rules.ts`: pure game logic helpers (borrow terms and heat streak cap)\n- `rules_test.ts`: script-based regression tests for `rules.ts`\n\n## Core Gameplay Loop\n\n1. Register or log in.\n2. Check market prices for each breed.\n3. Buy cats where prices are low.\n4. Travel to another city (travel advances day and raises heat).\n5. Sell for profit.\n6. Manage debt before deadline.\n\n## Travel Economics\n\n- There is no fixed dollar travel fee.\n- Each travel action increments `day` by 1.\n- Travel raises heat and may trigger a DHS bust.\n- Bust outcomes can reduce cash (fine) and inventory (seizure).\n\n## Market Forces And Fast-Profit Playstyle\n\n- High-volatility breeds (`Sphynx`, `Bengal`) produce the largest swings.\n- Early borrowing increases buying power but fees escalate per borrow tier.\n- Low-risk travel hubs (`Seattle`, `Austin`) help reduce bust frequency while hunting good exits.\n- Over-traveling increases bust risk and can erase profits quickly.\n\n## Debt System\n\n- Debt has a due day (`debt_due_day`).\n- Borrowing:\n - increases cash and debt\n - applies escalating fee by borrow tier (capped)\n - extends due window, capped to at most 90 days ahead\n- Missing debt deadline while debt > 0 triggers bankruptcy:\n - inventory wiped\n - run reset to baseline state\n\n## Heat and Bust Rules\n\n- Travel increases heat and can trigger a DHS bust event.\n- Bust events may seize inventory and fine cash.\n- Heat cannot stay at 100% for more than 2 consecutive turns; on the 3rd turn it is forced down to 95%.\n\n## Schema\n\n### `users`\nAccount identity, role (`player`/`admin`/`super_admin`), and avatar key.\n\n### `sessions`\nCookie-token sessions with expiry.\n\n### `player_state`\nCurrent market, cash, debt, heat, day, cargo, debt due day, borrow tier, and heat max streak.\n\n### `markets`\nCity list and enforcement risk profile.\n\n### `breeds`\nBase economy metadata for each cat breed.\n\n### `inventory`\nOwned quantity per breed per user.\n\n### `market_day_prices`\nShared daily per-market prices across all users (multiplayer-ready market tape).\n\n### `user_market_prices` (legacy)\nDeprecated table kept only for migration compatibility. Active writes no longer target this table.\n\n### `schema_migrations`\nTracks one-way migration IDs that have been applied.\n\n## API Surface\n\n### Auth/session\n- `POST /api/register`\n- `POST /api/login`\n- `POST /api/logout`\n- `GET /api/me`\n\n### Admin\n- `GET /admin` (dashboard UI; admin-only)\n- `GET /api/admin/overview`\n- `GET /api/admin/markets`\n- `POST /api/admin/markets/:marketId`\n- `GET /api/admin/breeds`\n- `POST /api/admin/breeds/:breedId`\n\n### Economy/actions\n- `POST /api/buy`\n- `POST /api/sell`\n- `POST /api/travel`\n- `POST /api/borrow`\n- `POST /api/pay-debt`\n\n### Avatar/presets\n- `POST /api/avatar/preset`\n- `GET /api/pixel-avatar/:avatarId`\n- `GET /api/avatar/:userId`\n\n## Migrations\n\n`initDb()` creates base tables and then runs idempotent tracked migrations:\n\n- `2026-03-02-add-player_state-debt_due_day`\n- `2026-03-02-add-player_state-borrow_count`\n- `2026-03-02-add-player_state-heat_max_streak`\n- `2026-03-02-backfill-debt_due_day`\n- `2026-03-02-add-users-role`\n- `2026-03-02-backfill-super-admin-first-user`\n- `2026-03-02-create-market-day-prices`\n- `2026-03-02-backfill-market-day-prices-from-user-market-prices`\n- `2026-03-02-clear-user-market-prices-legacy`\n\nApplied migrations are recorded in `schema_migrations`.\n\n## Testing\n\nRun the script file directly in Val Town:\n\n- `rules_test.ts`\n\nIt validates:\n- borrow fee escalation and cap behavior\n- debt-ceiling clamping\n- due-date 90-day cap\n- heat 100% streak cooldown behavior\n\n## Runtime Guarantees\n\n- Market prices are shared by `day + market` for all users.\n- Price history retention is enforced by deleting rows older than `MARKET_PRICE_RETENTION_DAYS` (currently 45) relative to the active max player day.\n- Mutating routes (`travel`, `borrow`, `pay-debt`, `buy`, `sell`) centralize write coordination and use `sqlite.batch` for multi-write updates where possible.\n- Full cross-statement transaction boundaries are pending a runtime-safe transaction primitive in Val Town's sqlite helper.\n\n## Current Status\n\n- Val is public: `pchinjr/cat-wars`\n- Auth/session logic extracted into `auth.ts`\n- Static game config extracted into `config.ts`\n- Core deterministic rules extracted into `rules.ts`\n- Regression coverage added for extracted rules via `rules_test.ts`\n\n## Next Suggested Improvements\n\n1. Add tests for route-level behaviors (`/api/travel`, `/api/borrow`, bankruptcy reset).\n2. Introduce a tiny data-access layer to remove inline SQL from route handlers.\n3. Add structured event logging for travel, bust, borrow, and bankruptcy actions.\n4. Add multiplayer-ready turn clock abstraction for synchronized city market ticks.\n",[174],"pulls","branches","forks","envVars",{"_188":61,"_190":61},"connections",{"_188":61,"_189":61},"count","unfilledCount","emptyCount",{"_43":173,"_32":174,"_30":175,"_137":-5,"_41":42,"_40":176,"_139":123,"_38":213,"_13":178,"_33":20,"_35":179,"_24":25,"_144":-5,"_198":214,"_27":215},{"_43":165,"_32":166,"_30":167,"_137":-5,"_41":42,"_40":168,"_139":123,"_38":210,"_13":170,"_33":142,"_35":171,"_24":25,"_144":-5,"_198":211,"_27":212},{"_43":158,"_32":159,"_30":160,"_137":-5,"_41":42,"_40":161,"_139":123,"_38":207,"_13":61,"_33":142,"_35":163,"_24":25,"_144":-5,"_198":208,"_27":209},{"_43":154,"_32":28,"_30":31,"_137":-5,"_41":42,"_40":14,"_139":123,"_38":204,"_13":156,"_33":34,"_35":37,"_24":25,"_144":-5,"_198":205,"_27":206},{"_43":146,"_32":147,"_30":148,"_137":-5,"_41":42,"_40":149,"_139":123,"_38":201,"_13":151,"_33":142,"_35":152,"_24":25,"_144":-5,"_198":202,"_27":203},{"_43":134,"_32":135,"_30":136,"_137":-5,"_41":42,"_40":138,"_139":123,"_38":197,"_13":141,"_33":142,"_35":143,"_24":25,"_144":-5,"_198":199,"_27":200},["D",1772462712049],"children",[],[135],["D",1772463591435],[],[147],["D",1772539795880],[],[28],["D",1772462332554],[],[159],["D",1772475774040],[],[166],["D",1772475972307],[],[174],["D",1772409318475],["D",1789469441210],{"_97":96,"_104":100},{"_97":96,"_98":-5,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":14,"_32":87,"_43":42,"_88":44,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":45,"_95":96},"ctx",{"_80":-5,"_125":254,"_255":256,"_257":258,"_259":25,"_260":25,"_261":25,"_262":123,"_263":-5,"_264":-7,"_265":-7,"_266":61,"_267":25,"_268":25,"_269":-5,"_270":25,"_271":25,"_272":25,"_273":-5},"ENV",{"_225":226,"_227":228,"_229":87,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Cat Wars Admin Console

Overview

Markets

Breeds

CAT WARS 2029

Street Terminal

The Situation

How The Game Works

Register

Log In

Market Prices

Travel

Session

Cat Wars Admin Console

Overview

Markets

Breeds

CAT WARS 2029

Street Terminal

The Situation

How The Game Works

Register

Log In

Market Prices

Travel

Session

Diff · v149