[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_158":159,"_160":161},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_106":88,"_27":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":25,"_121":122,"_123":124,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",23,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","19c55206-15ca-11f1-92f1-42dde27851f2","name","fileType","http","content","import { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\ntype User = {\n id: number;\n username: string;\n avatar_blob_key: string | null;\n};\n\ntype PlayerState = {\n user_id: number;\n current_market_id: number;\n cash: number;\n debt: number;\n heat: number;\n day: number;\n cargo_capacity: number;\n};\n\ntype PriceRow = {\n breed_id: number;\n breed_name: string;\n price: number;\n};\n\nconst app = new Hono();\nconst SESSION_COOKIE = \"catwars_session\";\nconst SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14;\n\nconst MARKETS = [\n { id: 1, name: \"New York City\", region_risk: 0.25 },\n { id: 2, name: \"Seattle\", region_risk: 0.18 },\n { id: 3, name: \"San Francisco\", region_risk: 0.22 },\n { id: 4, name: \"Miami\", region_risk: 0.3 },\n { id: 5, name: \"Chicago\", region_risk: 0.35 },\n { id: 6, name: \"Austin\", region_risk: 0.2 },\n] as const;\n\nconst BREEDS = [\n { id: 1, name: \"Street Tabby\", base_price: 95, volatility: 0.35, legal_risk: 0.1 },\n { id: 2, name: \"Siamese\", base_price: 300, volatility: 0.45, legal_risk: 0.22 },\n { id: 3, name: \"Maine Coon\", base_price: 520, volatility: 0.4, legal_risk: 0.28 },\n { id: 4, name: \"Bengal\", base_price: 800, volatility: 0.55, legal_risk: 0.35 },\n { id: 5, name: \"Sphynx\", base_price: 1200, volatility: 0.65, legal_risk: 0.42 },\n { id: 6, name: \"Scottish Fold\", base_price: 680, volatility: 0.5, legal_risk: 0.3 },\n] as const;\n\nconst PIXEL_AVATARS = [\n { id: \"street-tabby\", name: \"Street Tabby\", colors: [\"#f6d08d\", \"#925b2d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"neon-sphynx\", name: \"Neon Sphynx\", colors: [\"#ffb6df\", \"#c23888\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"void-panther\", name: \"Void Panther\", colors: [\"#616161\", \"#1f1f1f\", \"#00f7ff\", \"#fefefe\"] },\n { id: \"mint-mouser\", name: \"Mint Mouser\", colors: [\"#b6ffd8\", \"#2e9b6d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"sunset-bengal\", name: \"Sunset Bengal\", colors: [\"#ffc081\", \"#d0682f\", \"#2b1c17\", \"#fefefe\"] },\n { id: \"royal-fold\", name: \"Royal Fold\", colors: [\"#d3c4ff\", \"#6f56d7\", \"#1d1d1d\", \"#fefefe\"] },\n] as const;\n\nlet dbReady = false;\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\nasync function initDb() {\n if (dbReady) return;\n\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n avatar_blob_key TEXT,\n created_at TEXT NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS player_state (\n user_id INTEGER PRIMARY KEY,\n current_market_id INTEGER NOT NULL,\n cash INTEGER NOT NULL,\n debt INTEGER NOT NULL,\n heat INTEGER NOT NULL,\n day INTEGER NOT NULL,\n cargo_capacity INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS markets (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n region_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS breeds (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n base_price INTEGER NOT NULL,\n volatility REAL NOT NULL,\n legal_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS inventory (\n user_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n qty INTEGER NOT NULL,\n PRIMARY KEY (user_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS user_market_prices (\n user_id INTEGER NOT NULL,\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (user_id, day, market_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n ]);\n\n const marketCount = await sqlite.execute(\"SELECT COUNT(*) FROM markets;\");\n if ((marketCount.rows[0][0] as number) === 0) {\n for (const m of MARKETS) {\n await sqlite.execute(\n `INSERT INTO markets (id, name, region_risk) VALUES (${m.id}, '${escapeSql(m.name)}', ${m.region_risk});`,\n );\n }\n }\n\n const breedCount = await sqlite.execute(\"SELECT COUNT(*) FROM breeds;\");\n if ((breedCount.rows[0][0] as number) === 0) {\n for (const b of BREEDS) {\n await sqlite.execute(\n `INSERT INTO breeds (id, name, base_price, volatility, legal_risk)\n VALUES (${b.id}, '${escapeSql(b.name)}', ${b.base_price}, ${b.volatility}, ${b.legal_risk});`,\n );\n }\n }\n\n dbReady = true;\n}\n\nasync function sha256(text: string): Promise {\n const bytes = new TextEncoder().encode(text);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPassword(password: string): Promise {\n return sha256(\"catwars-2029::\" + password);\n}\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") || \"\";\n const parts = header.split(\";\").map((p) => p.trim()).filter(Boolean);\n const out: Record = {};\n for (const p of parts) {\n const idx = p.indexOf(\"=\");\n if (idx > -1) {\n out[p.slice(0, idx)] = decodeURIComponent(p.slice(idx + 1));\n }\n }\n return out;\n}\n\nfunction setSessionCookie(headers: Headers, token: string) {\n headers.append(\n \"Set-Cookie\",\n SESSION_COOKIE + \"=\" + encodeURIComponent(token) + \"; Path=/; HttpOnly; SameSite=Lax; Max-Age=\" + Math.floor(SESSION_TTL_MS / 1000),\n );\n}\n\nfunction clearSessionCookie(headers: Headers) {\n headers.append(\"Set-Cookie\", SESSION_COOKIE + \"=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\");\n}\n\nasync function createSession(userId: number): Promise {\n const token = crypto.randomUUID() + \"-\" + crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute(\n `INSERT INTO sessions (token, user_id, expires_at) VALUES ('${escapeSql(token)}', ${userId}, ${expiresAt});`,\n );\n return token;\n}\n\nasync function getAuthedUser(req: Request): Promise {\n const cookies = parseCookies(req);\n const token = cookies[SESSION_COOKIE];\n if (!token) return null;\n\n const sessionRes = await sqlite.execute(\n `SELECT user_id, expires_at FROM sessions WHERE token = '${escapeSql(token)}' LIMIT 1;`,\n );\n if (sessionRes.rows.length === 0) return null;\n\n const userId = sessionRes.rows[0][0] as number;\n const expiresAt = sessionRes.rows[0][1] as number;\n if (expiresAt < Date.now()) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n return null;\n }\n\n const userRes = await sqlite.execute(\n `SELECT id, username, avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return null;\n\n return {\n id: userRes.rows[0][0] as number,\n username: userRes.rows[0][1] as string,\n avatar_blob_key: (userRes.rows[0][2] as string | null) ?? null,\n };\n}\n\nasync function getPlayerState(userId: number): Promise {\n const res = await sqlite.execute(\n `SELECT user_id, current_market_id, cash, debt, heat, day, cargo_capacity\n FROM player_state WHERE user_id = ${userId} LIMIT 1;`,\n );\n return {\n user_id: res.rows[0][0] as number,\n current_market_id: res.rows[0][1] as number,\n cash: res.rows[0][2] as number,\n debt: res.rows[0][3] as number,\n heat: res.rows[0][4] as number,\n day: res.rows[0][5] as number,\n cargo_capacity: res.rows[0][6] as number,\n };\n}\n\nasync function generatePricesForState(userId: number, day: number, marketId: number): Promise {\n const marketRes = await sqlite.execute(`SELECT region_risk FROM markets WHERE id = ${marketId} LIMIT 1;`);\n const regionRisk = (marketRes.rows[0]?.[0] as number) ?? 0.2;\n\n await sqlite.execute(\n `DELETE FROM user_market_prices WHERE user_id = ${userId} AND day = ${day} AND market_id = ${marketId};`,\n );\n\n const breedsRes = await sqlite.execute(\n `SELECT id, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;`,\n );\n\n for (const row of breedsRes.rows) {\n const breedId = row[0] as number;\n const basePrice = row[1] as number;\n const volatility = row[2] as number;\n const legalRisk = row[3] as number;\n\n const wave = Math.sin((day + breedId * 7 + marketId * 13) * 0.73) * volatility;\n const chaos = (Math.random() - 0.5) * volatility * 1.8;\n const crackdown = (regionRisk + legalRisk) * 0.6;\n const multiplier = Math.max(0.2, 1 + wave + chaos + crackdown);\n const price = Math.max(20, Math.floor(basePrice * multiplier));\n\n await sqlite.execute(\n `INSERT INTO user_market_prices (user_id, day, market_id, breed_id, price)\n VALUES (${userId}, ${day}, ${marketId}, ${breedId}, ${price});`,\n );\n }\n}\n\nasync function getCurrentPrices(userId: number, day: number, marketId: number): Promise {\n const rows = await sqlite.execute(\n `SELECT p.breed_id, b.name, p.price\n FROM user_market_prices p\n JOIN breeds b ON b.id = p.breed_id\n WHERE p.user_id = ${userId} AND p.day = ${day} AND p.market_id = ${marketId}\n ORDER BY p.breed_id ASC;`,\n );\n\n if (rows.rows.length === 0) {\n await generatePricesForState(userId, day, marketId);\n return getCurrentPrices(userId, day, marketId);\n }\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n price: r[2] as number,\n }));\n}\n\nasync function getInventory(userId: number): Promise> {\n const rows = await sqlite.execute(\n `SELECT i.breed_id, b.name, i.qty\n FROM inventory i\n JOIN breeds b ON b.id = i.breed_id\n WHERE i.user_id = ${userId}\n ORDER BY i.breed_id ASC;`,\n );\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n qty: r[2] as number,\n }));\n}\n\nasync function getCargoUsed(userId: number): Promise {\n const res = await sqlite.execute(`SELECT COALESCE(SUM(qty), 0) FROM inventory WHERE user_id = ${userId};`);\n return res.rows[0][0] as number;\n}\n\nasync function bootstrapUser(userId: number): Promise {\n await sqlite.execute(\n `INSERT INTO player_state (user_id, current_market_id, cash, debt, heat, day, cargo_capacity)\n VALUES (${userId}, 1, 2200, 900, 0, 1, 100);`,\n );\n await generatePricesForState(userId, 1, 1);\n}\n\nfunction marketName(marketId: number): string {\n const match = MARKETS.find((m) => m.id === marketId);\n return match ? match.name : \"Unknown\";\n}\n\nfunction pixelAvatarSvg(avatarId: string): string | null {\n const preset = PIXEL_AVATARS.find((p) => p.id === avatarId);\n if (!preset) return null;\n\n const c1 = preset.colors[0];\n const c2 = preset.colors[1];\n const c3 = preset.colors[2];\n const c4 = preset.colors[3];\n\n return `\n`.trim();\n}\n\nfunction avatarResponse(avatarBlobKey: string): Response | null {\n if (avatarBlobKey.startsWith(\"preset:\")) {\n const avatarId = avatarBlobKey.slice(\"preset:\".length);\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return null;\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n }\n return null;\n}\n\nfunction jsonError(message: string, status = 400): Response {\n return new Response(JSON.stringify({ error: message }), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\nasync function buildSnapshot(user: User) {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(user.id, state.day, state.current_market_id);\n const inventory = await getInventory(user.id);\n const cargoUsed = await getCargoUsed(user.id);\n\n return {\n user: { id: user.id, username: user.username },\n market: { id: state.current_market_id, name: marketName(state.current_market_id) },\n markets: MARKETS,\n state,\n prices,\n inventory,\n cargo_used: cargoUsed,\n avatar_url: user.avatar_blob_key ? \"/api/avatar/\" + user.id + \"?v=\" + Date.now() : null,\n avatar_key: user.avatar_blob_key,\n pixel_avatars: PIXEL_AVATARS.map((p) => ({\n id: p.id,\n name: p.name,\n preview_url: \"/api/pixel-avatar/\" + p.id,\n })),\n };\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

Felines are illegal. You are a courier in the underground breed market network.

\n\n

\n \n \n

\n\n \n\n

VISITOR COUNTER 000042

\n\n \n

\n\n \n\n`;\n}\n\napp.use(\"*\", async (_c, next) => {\n await initDb();\n await next();\n});\n\napp.get(\"/\", (c) => c.html(htmlPage()));\n\napp.post(\"/api/register\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n\n if (!username || typeof username !== \"string\" || username.length < 3 || username.length > 24) {\n return jsonError(\"Username must be 3-24 chars.\");\n }\n if (!/^[a-zA-Z0-9_\\-]+$/.test(username)) {\n return jsonError(\"Username can only use letters, numbers, _ and -.\");\n }\n if (typeof password !== \"string\" || password.length < 6) {\n return jsonError(\"Password must be at least 6 chars.\");\n }\n\n const existing = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (existing.rows.length > 0) return jsonError(\"Username already exists.\");\n\n const hash = await hashPassword(password);\n await sqlite.execute(\n `INSERT INTO users (username, password_hash, avatar_blob_key, created_at)\n VALUES ('${escapeSql(username)}', '${hash}', 'preset:street-tabby', '${new Date().toISOString()}');`,\n );\n\n const userRes = await sqlite.execute(\n `SELECT id FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n const userId = userRes.rows[0][0] as number;\n\n await bootstrapUser(userId);\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = body?.username?.trim?.();\n const password = body?.password;\n if (!username || !password) return jsonError(\"Missing credentials.\");\n\n const userRes = await sqlite.execute(\n `SELECT id, password_hash FROM users WHERE username = '${escapeSql(username)}' LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return jsonError(\"Invalid credentials.\", 401);\n\n const expectedHash = userRes.rows[0][1] as string;\n const passwordHash = await hashPassword(password);\n if (passwordHash !== expectedHash) return jsonError(\"Invalid credentials.\", 401);\n\n const userId = userRes.rows[0][0] as number;\n const token = await createSession(userId);\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n setSessionCookie(headers, token);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.post(\"/api/logout\", async (c) => {\n const cookies = parseCookies(c.req.raw);\n const token = cookies[SESSION_COOKIE];\n if (token) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n }\n\n const headers = new Headers({ \"Content-Type\": \"application/json\" });\n clearSessionCookie(headers);\n return new Response(JSON.stringify({ ok: true }), { status: 200, headers });\n});\n\napp.get(\"/api/me\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const snapshot = await buildSnapshot(user);\n return c.json({ user: { id: user.id, username: user.username }, snapshot });\n});\n\napp.post(\"/api/avatar\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.parseBody();\n const file = body.file;\n if (!file || typeof (file as File).arrayBuffer !== \"function\") {\n return jsonError(\"No file uploaded.\");\n }\n\n const typedFile = file as File;\n if (!typedFile.type.startsWith(\"image/\")) {\n return jsonError(\"Avatar must be an image file.\");\n }\n\n const ext = (typedFile.name.split(\".\").pop() || \"png\").slice(0, 8).toLowerCase();\n const key = \"catwars/avatar/\" + user.id + \"/\" + Date.now() + \".\" + ext;\n await blob.set(key, await typedFile.arrayBuffer());\n\n await sqlite.execute(\n `UPDATE users SET avatar_blob_key = '${escapeSql(key)}' WHERE id = ${user.id};`,\n );\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, key, snapshot });\n});\n\napp.post(\"/api/avatar/preset\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const avatarId = body?.avatarId;\n if (!avatarId || typeof avatarId !== \"string\") return jsonError(\"avatarId required.\");\n if (!PIXEL_AVATARS.some((a) => a.id === avatarId)) return jsonError(\"Unknown pixel avatar.\");\n\n const avatarKey = \"preset:\" + avatarId;\n await sqlite.execute(`UPDATE users SET avatar_blob_key = '${escapeSql(avatarKey)}' WHERE id = ${user.id};`);\n\n const updatedUser = await getAuthedUser(c.req.raw);\n if (!updatedUser) return jsonError(\"Unauthorized\", 401);\n const snapshot = await buildSnapshot(updatedUser);\n return c.json({ ok: true, avatar_key: avatarKey, snapshot });\n});\n\napp.get(\"/api/pixel-avatar/:avatarId\", async (c) => {\n const avatarId = c.req.param(\"avatarId\");\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return c.text(\"No avatar\", 404);\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n});\n\napp.get(\"/api/avatar/:userId\", async (c) => {\n const userId = Number(c.req.param(\"userId\"));\n if (!Number.isFinite(userId)) return c.text(\"Not found\", 404);\n\n const res = await sqlite.execute(`SELECT avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`);\n if (res.rows.length === 0 || !res.rows[0][0]) return c.text(\"No avatar\", 404);\n\n const avatarKey = res.rows[0][0] as string;\n const presetResponse = avatarResponse(avatarKey);\n if (presetResponse) return presetResponse;\n\n try {\n return await blob.get(avatarKey);\n } catch {\n return c.text(\"No avatar\", 404);\n }\n});\n\napp.post(\"/api/travel\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const marketId = Number(body?.marketId);\n if (!Number.isFinite(marketId)) return jsonError(\"marketId required.\");\n if (!MARKETS.some((m) => m.id === marketId)) return jsonError(\"Unknown market.\");\n\n const current = await getPlayerState(user.id);\n if (marketId === current.current_market_id) return jsonError(\"Already at that market.\");\n\n const targetMarket = MARKETS.find((m) => m.id === marketId)!;\n const newDay = current.day + 1;\n let heat = Math.min(100, current.heat + 8 + Math.floor(Math.random() * 13));\n let bustMessage = \"\";\n\n const bustChance = Math.min(0.92, heat / 170 + targetMarket.region_risk * 0.28);\n if (Math.random() < bustChance) {\n const inv = await getInventory(user.id);\n for (const item of inv) {\n const seized = Math.floor(item.qty * (0.2 + Math.random() * 0.55));\n const kept = Math.max(0, item.qty - seized);\n await sqlite.execute(\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${item.breed_id}, ${kept});`,\n );\n }\n\n const fine = Math.floor(current.cash * (0.08 + Math.random() * 0.22));\n const nextCash = Math.max(0, current.cash - fine);\n heat = Math.max(12, heat - 20);\n\n await sqlite.execute(\n `UPDATE player_state SET current_market_id = ${marketId}, day = ${newDay}, heat = ${heat}, cash = ${nextCash}\n WHERE user_id = ${user.id};`,\n );\n\n bustMessage = \"BUSTED by DHS. Fine paid: $\" + fine.toLocaleString() + \", partial cargo seized.\";\n } else {\n await sqlite.execute(\n `UPDATE player_state SET current_market_id = ${marketId}, day = ${newDay}, heat = ${heat}\n WHERE user_id = ${user.id};`,\n );\n }\n\n await generatePricesForState(user.id, newDay, marketId);\n const snapshot = await buildSnapshot(user);\n const msg = bustMessage || (\"Arrived at \" + targetMarket.name + \". Heat now \" + heat + \"%.\");\n return c.json({ ok: true, message: msg, snapshot });\n});\n\napp.post(\"/api/buy\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid buy request.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(user.id, state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) return jsonError(\"Breed not found in market.\");\n\n const cargoUsed = await getCargoUsed(user.id);\n if (cargoUsed + qty > state.cargo_capacity) return jsonError(\"Not enough cargo space.\");\n\n const total = chosen.price * qty;\n if (total > state.cash) return jsonError(\"Insufficient cash.\");\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash - total} WHERE user_id = ${user.id};`,\n `INSERT INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${qty})\n ON CONFLICT(user_id, breed_id) DO UPDATE SET qty = qty + ${qty};`,\n ]);\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: \"Bought \" + qty + \" \" + chosen.breed_name + \".\", snapshot });\n});\n\napp.post(\"/api/sell\", async (c) => {\n const user = await getAuthedUser(c.req.raw);\n if (!user) return jsonError(\"Unauthorized\", 401);\n\n const body = await c.req.json().catch(() => null);\n const breedId = Number(body?.breedId);\n const qty = Number(body?.qty);\n if (!Number.isFinite(breedId) || !Number.isFinite(qty) || qty <= 0) return jsonError(\"Invalid sell request.\");\n\n const invRes = await sqlite.execute(\n `SELECT qty FROM inventory WHERE user_id = ${user.id} AND breed_id = ${breedId} LIMIT 1;`,\n );\n const owned = (invRes.rows[0]?.[0] as number) ?? 0;\n if (owned < qty) return jsonError(\"Not enough inventory.\");\n\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(user.id, state.day, state.current_market_id);\n const chosen = prices.find((p) => p.breed_id === breedId);\n if (!chosen) return jsonError(\"Breed not found in market.\");\n\n const total = chosen.price * qty;\n const nextQty = owned - qty;\n\n await sqlite.batch([\n `UPDATE player_state SET cash = ${state.cash + total} WHERE user_id = ${user.id};`,\n `INSERT OR REPLACE INTO inventory (user_id, breed_id, qty)\n VALUES (${user.id}, ${breedId}, ${nextQty});`,\n ]);\n\n const snapshot = await buildSnapshot(user);\n return c.json({ ok: true, message: \"Sold \" + qty + \" \" + chosen.breed_name + \".\", snapshot });\n});\n\nexport default app.fetch;\n","import { Hono } from \"npm:hono\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\ntype User = {\n id: number;\n username: string;\n avatar_blob_key: string | null;\n};\n\ntype PlayerState = {\n user_id: number;\n current_market_id: number;\n cash: number;\n debt: number;\n heat: number;\n day: number;\n cargo_capacity: number;\n};\n\ntype PriceRow = {\n breed_id: number;\n breed_name: string;\n price: number;\n};\n\nconst app = new Hono();\nconst SESSION_COOKIE = \"catwars_session\";\nconst SESSION_TTL_MS = 1000 * 60 * 60 * 24 * 14;\n\nconst MARKETS = [\n { id: 1, name: \"New York City\", region_risk: 0.25 },\n { id: 2, name: \"Seattle\", region_risk: 0.18 },\n { id: 3, name: \"San Francisco\", region_risk: 0.22 },\n { id: 4, name: \"Miami\", region_risk: 0.3 },\n { id: 5, name: \"Chicago\", region_risk: 0.35 },\n { id: 6, name: \"Austin\", region_risk: 0.2 },\n] as const;\n\nconst BREEDS = [\n { id: 1, name: \"Street Tabby\", base_price: 95, volatility: 0.35, legal_risk: 0.1 },\n { id: 2, name: \"Siamese\", base_price: 300, volatility: 0.45, legal_risk: 0.22 },\n { id: 3, name: \"Maine Coon\", base_price: 520, volatility: 0.4, legal_risk: 0.28 },\n { id: 4, name: \"Bengal\", base_price: 800, volatility: 0.55, legal_risk: 0.35 },\n { id: 5, name: \"Sphynx\", base_price: 1200, volatility: 0.65, legal_risk: 0.42 },\n { id: 6, name: \"Scottish Fold\", base_price: 680, volatility: 0.5, legal_risk: 0.3 },\n] as const;\n\nconst PIXEL_AVATARS = [\n { id: \"street-tabby\", name: \"Street Tabby\", colors: [\"#f6d08d\", \"#925b2d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"neon-sphynx\", name: \"Neon Sphynx\", colors: [\"#ffb6df\", \"#c23888\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"void-panther\", name: \"Void Panther\", colors: [\"#616161\", \"#1f1f1f\", \"#00f7ff\", \"#fefefe\"] },\n { id: \"mint-mouser\", name: \"Mint Mouser\", colors: [\"#b6ffd8\", \"#2e9b6d\", \"#1d1d1d\", \"#fefefe\"] },\n { id: \"sunset-bengal\", name: \"Sunset Bengal\", colors: [\"#ffc081\", \"#d0682f\", \"#2b1c17\", \"#fefefe\"] },\n { id: \"royal-fold\", name: \"Royal Fold\", colors: [\"#d3c4ff\", \"#6f56d7\", \"#1d1d1d\", \"#fefefe\"] },\n] as const;\n\nlet dbReady = false;\n\nfunction escapeSql(value: string): string {\n return value.replace(/'/g, \"''\");\n}\n\nasync function initDb() {\n if (dbReady) return;\n\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n avatar_blob_key TEXT,\n created_at TEXT NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS player_state (\n user_id INTEGER PRIMARY KEY,\n current_market_id INTEGER NOT NULL,\n cash INTEGER NOT NULL,\n debt INTEGER NOT NULL,\n heat INTEGER NOT NULL,\n day INTEGER NOT NULL,\n cargo_capacity INTEGER NOT NULL,\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS markets (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n region_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS breeds (\n id INTEGER PRIMARY KEY,\n name TEXT NOT NULL,\n base_price INTEGER NOT NULL,\n volatility REAL NOT NULL,\n legal_risk REAL NOT NULL\n );`,\n `CREATE TABLE IF NOT EXISTS inventory (\n user_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n qty INTEGER NOT NULL,\n PRIMARY KEY (user_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n `CREATE TABLE IF NOT EXISTS user_market_prices (\n user_id INTEGER NOT NULL,\n day INTEGER NOT NULL,\n market_id INTEGER NOT NULL,\n breed_id INTEGER NOT NULL,\n price INTEGER NOT NULL,\n PRIMARY KEY (user_id, day, market_id, breed_id),\n FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,\n FOREIGN KEY (breed_id) REFERENCES breeds(id) ON DELETE CASCADE\n );`,\n ]);\n\n const marketCount = await sqlite.execute(\"SELECT COUNT(*) FROM markets;\");\n if ((marketCount.rows[0][0] as number) === 0) {\n for (const m of MARKETS) {\n await sqlite.execute(\n `INSERT INTO markets (id, name, region_risk) VALUES (${m.id}, '${escapeSql(m.name)}', ${m.region_risk});`,\n );\n }\n }\n\n const breedCount = await sqlite.execute(\"SELECT COUNT(*) FROM breeds;\");\n if ((breedCount.rows[0][0] as number) === 0) {\n for (const b of BREEDS) {\n await sqlite.execute(\n `INSERT INTO breeds (id, name, base_price, volatility, legal_risk)\n VALUES (${b.id}, '${escapeSql(b.name)}', ${b.base_price}, ${b.volatility}, ${b.legal_risk});`,\n );\n }\n }\n\n dbReady = true;\n}\n\nasync function sha256(text: string): Promise {\n const bytes = new TextEncoder().encode(text);\n const digest = await crypto.subtle.digest(\"SHA-256\", bytes);\n return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function hashPassword(password: string): Promise {\n return sha256(\"catwars-2029::\" + password);\n}\n\nfunction parseCookies(req: Request): Record {\n const header = req.headers.get(\"cookie\") || \"\";\n const parts = header.split(\";\").map((p) => p.trim()).filter(Boolean);\n const out: Record = {};\n for (const p of parts) {\n const idx = p.indexOf(\"=\");\n if (idx > -1) {\n out[p.slice(0, idx)] = decodeURIComponent(p.slice(idx + 1));\n }\n }\n return out;\n}\n\nfunction setSessionCookie(headers: Headers, token: string) {\n headers.append(\n \"Set-Cookie\",\n SESSION_COOKIE + \"=\" + encodeURIComponent(token) + \"; Path=/; HttpOnly; SameSite=Lax; Max-Age=\" + Math.floor(SESSION_TTL_MS / 1000),\n );\n}\n\nfunction clearSessionCookie(headers: Headers) {\n headers.append(\"Set-Cookie\", SESSION_COOKIE + \"=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0\");\n}\n\nasync function createSession(userId: number): Promise {\n const token = crypto.randomUUID() + \"-\" + crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute(\n `INSERT INTO sessions (token, user_id, expires_at) VALUES ('${escapeSql(token)}', ${userId}, ${expiresAt});`,\n );\n return token;\n}\n\nasync function getAuthedUser(req: Request): Promise {\n const cookies = parseCookies(req);\n const token = cookies[SESSION_COOKIE];\n if (!token) return null;\n\n const sessionRes = await sqlite.execute(\n `SELECT user_id, expires_at FROM sessions WHERE token = '${escapeSql(token)}' LIMIT 1;`,\n );\n if (sessionRes.rows.length === 0) return null;\n\n const userId = sessionRes.rows[0][0] as number;\n const expiresAt = sessionRes.rows[0][1] as number;\n if (expiresAt < Date.now()) {\n await sqlite.execute(`DELETE FROM sessions WHERE token = '${escapeSql(token)}';`);\n return null;\n }\n\n const userRes = await sqlite.execute(\n `SELECT id, username, avatar_blob_key FROM users WHERE id = ${userId} LIMIT 1;`,\n );\n if (userRes.rows.length === 0) return null;\n\n return {\n id: userRes.rows[0][0] as number,\n username: userRes.rows[0][1] as string,\n avatar_blob_key: (userRes.rows[0][2] as string | null) ?? null,\n };\n}\n\nasync function getPlayerState(userId: number): Promise {\n const res = await sqlite.execute(\n `SELECT user_id, current_market_id, cash, debt, heat, day, cargo_capacity\n FROM player_state WHERE user_id = ${userId} LIMIT 1;`,\n );\n return {\n user_id: res.rows[0][0] as number,\n current_market_id: res.rows[0][1] as number,\n cash: res.rows[0][2] as number,\n debt: res.rows[0][3] as number,\n heat: res.rows[0][4] as number,\n day: res.rows[0][5] as number,\n cargo_capacity: res.rows[0][6] as number,\n };\n}\n\nasync function generatePricesForState(userId: number, day: number, marketId: number): Promise {\n const marketRes = await sqlite.execute(`SELECT region_risk FROM markets WHERE id = ${marketId} LIMIT 1;`);\n const regionRisk = (marketRes.rows[0]?.[0] as number) ?? 0.2;\n\n await sqlite.execute(\n `DELETE FROM user_market_prices WHERE user_id = ${userId} AND day = ${day} AND market_id = ${marketId};`,\n );\n\n const breedsRes = await sqlite.execute(\n `SELECT id, base_price, volatility, legal_risk FROM breeds ORDER BY id ASC;`,\n );\n\n for (const row of breedsRes.rows) {\n const breedId = row[0] as number;\n const basePrice = row[1] as number;\n const volatility = row[2] as number;\n const legalRisk = row[3] as number;\n\n const wave = Math.sin((day + breedId * 7 + marketId * 13) * 0.73) * volatility;\n const chaos = (Math.random() - 0.5) * volatility * 1.8;\n const crackdown = (regionRisk + legalRisk) * 0.6;\n const multiplier = Math.max(0.2, 1 + wave + chaos + crackdown);\n const price = Math.max(20, Math.floor(basePrice * multiplier));\n\n await sqlite.execute(\n `INSERT INTO user_market_prices (user_id, day, market_id, breed_id, price)\n VALUES (${userId}, ${day}, ${marketId}, ${breedId}, ${price});`,\n );\n }\n}\n\nasync function getCurrentPrices(userId: number, day: number, marketId: number): Promise {\n const rows = await sqlite.execute(\n `SELECT p.breed_id, b.name, p.price\n FROM user_market_prices p\n JOIN breeds b ON b.id = p.breed_id\n WHERE p.user_id = ${userId} AND p.day = ${day} AND p.market_id = ${marketId}\n ORDER BY p.breed_id ASC;`,\n );\n\n if (rows.rows.length === 0) {\n await generatePricesForState(userId, day, marketId);\n return getCurrentPrices(userId, day, marketId);\n }\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n price: r[2] as number,\n }));\n}\n\nasync function getInventory(userId: number): Promise> {\n const rows = await sqlite.execute(\n `SELECT i.breed_id, b.name, i.qty\n FROM inventory i\n JOIN breeds b ON b.id = i.breed_id\n WHERE i.user_id = ${userId}\n ORDER BY i.breed_id ASC;`,\n );\n\n return rows.rows.map((r) => ({\n breed_id: r[0] as number,\n breed_name: r[1] as string,\n qty: r[2] as number,\n }));\n}\n\nasync function getCargoUsed(userId: number): Promise {\n const res = await sqlite.execute(`SELECT COALESCE(SUM(qty), 0) FROM inventory WHERE user_id = ${userId};`);\n return res.rows[0][0] as number;\n}\n\nasync function bootstrapUser(userId: number): Promise {\n await sqlite.execute(\n `INSERT INTO player_state (user_id, current_market_id, cash, debt, heat, day, cargo_capacity)\n VALUES (${userId}, 1, 2200, 900, 0, 1, 100);`,\n );\n await generatePricesForState(userId, 1, 1);\n}\n\nfunction marketName(marketId: number): string {\n const match = MARKETS.find((m) => m.id === marketId);\n return match ? match.name : \"Unknown\";\n}\n\nfunction pixelAvatarSvg(avatarId: string): string | null {\n const preset = PIXEL_AVATARS.find((p) => p.id === avatarId);\n if (!preset) return null;\n\n const c1 = preset.colors[0];\n const c2 = preset.colors[1];\n const c3 = preset.colors[2];\n const c4 = preset.colors[3];\n\n return `\n`.trim();\n}\n\nfunction avatarResponse(avatarBlobKey: string): Response | null {\n if (avatarBlobKey.startsWith(\"preset:\")) {\n const avatarId = avatarBlobKey.slice(\"preset:\".length);\n const svg = pixelAvatarSvg(avatarId);\n if (!svg) return null;\n return new Response(svg, {\n headers: {\n \"Content-Type\": \"image/svg+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n }\n return null;\n}\n\nfunction jsonError(message: string, status = 400): Response {\n return new Response(JSON.stringify({ error: message }), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\nasync function buildSnapshot(user: User) {\n const state = await getPlayerState(user.id);\n const prices = await getCurrentPrices(user.id, state.day, state.current_market_id);\n const inventory = await getInventory(user.id);\n const cargoUsed = await getCargoUsed(user.id);\n\n return {\n user: { id: user.id, username: user.username },\n market: { id: state.current_market_id, name: marketName(state.current_market_id) },\n markets: MARKETS,\n state,\n prices,\n inventory,\n cargo_used: cargoUsed,\n avatar_url: user.avatar_blob_key ? \"/api/avatar/\" + user.id + \"?v=\" + Date.now() : null,\n avatar_key: user.avatar_blob_key,\n pixel_avatars: PIXEL_AVATARS.map((p) => ({\n id: p.id,\n name: p.name,\n preview_url: \"/api/pixel-avatar/\" + p.id,\n })),\n };\n}\n\nfunction htmlPage(): string {\n return `\n\n\n \n \n Cat Wars 2029\n \n\n\n \n

CAT WARS 2029

[ underground feline exchange terminal ] [ best viewed with CRT monitor vibes ]

\n\n

Street Terminal

Felines are illegal. You are a courier in the underground breed market network.

\n\n

\n \n \n

\n\n \n\n

VISITOR COUNTER 000042

\n\n \n

CAT WARS 2029

Street Terminal

Register

Log In

Market Prices

Travel

Session

CAT WARS 2029

Street Terminal

Register

Log In

Market Prices

Travel

Session

Diff · v23