Arcade

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_165":166,"_167":168},"routes/_app.x.$handle.$name",{"_106":105,"_39":52,"_114":96,"_33":108,"_13":14,"_115":-5,"_11":116,"_117":118,"_119":120,"_121":122,"_123":124,"_26":-5,"_125":-5,"_126":-5,"_127":31,"_128":129,"_130":65,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_50":51,"_39":52,"_45":53,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":38,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":89,"_90":91,"_92":93,"_94":31},"version",2,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","c2908a34-781b-4115-847e-da0003bd3f40","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":36},"file",{"_37":38,"_39":34,"_40":41,"_42":44,"_45":46,"_47":14,"_48":49,"_30":31},"previous",{"_37":38,"_39":34,"_40":41,"_42":43},"deleted",false,"deletedHere","path","api.ts","latestPath","api.tsx","fileId","7565f09e-a7f5-11f1-ba7b-1607ee4eb77e","name","fileType","http","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { Hono } from \"npm:hono@4\";\nimport { createHmac, createHash } from \"node:crypto\";\nimport { Database } from \"npm:@db/sqlite\";\nimport { serveStatic } from \"npm:hono@4/deno\";\n\n// ─────────────── CONFIG (env with fallback defaults) ───────────────\nconst BOT_TOKEN = Deno.env.get(\"BOT_TOKEN\") ?? \"7832757388:AAFjh142ae9d-MSKK5Ae-XSlT0f3baIQYxk\";\nconst ADMIN_IDS = (Deno.env.get(\"ADMIN_TELEGRAM_IDS\") ?? \"6819127801\").split(\",\").map(s => s.trim());\nconst PROVIDER_TOKEN_STARS = Deno.env.get(\"PROVIDER_TOKEN_STARS\") ?? \"XTR\";\n\n// ─────────────── DATABASE ───────────────\nconst db = new Database(\":memory:\");\n\ndb.exec(`\nCREATE TABLE IF NOT EXISTS users (\n telegram_id TEXT PRIMARY KEY,\n username TEXT,\n balance REAL DEFAULT 0,\n referrer_id TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n);\nCREATE TABLE IF NOT EXISTS promo_codes (\n code TEXT PRIMARY KEY,\n reward_amount REAL,\n max_activations INTEGER,\n current_activations INTEGER DEFAULT 0\n);\nCREATE TABLE IF NOT EXISTS user_promos (\n user_id TEXT,\n promo_code TEXT,\n PRIMARY KEY(user_id, promo_code)\n);\nCREATE TABLE IF NOT EXISTS app_config (\n config_key TEXT PRIMARY KEY,\n config_value TEXT\n);\nCREATE TABLE IF NOT EXISTS transactions (\n id TEXT PRIMARY KEY,\n user_id TEXT,\n amount REAL,\n type TEXT,\n currency TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n);\nCREATE TABLE IF NOT EXISTS games_state (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id TEXT,\n game TEXT,\n bet REAL,\n state TEXT,\n multiplier REAL,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n);\n`);\n\n// Default dynamic UI strings\nconst DEFAULT_CONFIG: Record = {\n \"game_1_title\": \"Space Booster\",\n \"game_2_title\": \"Color Wheel\",\n \"game_3_title\": \"Match Predictor\",\n \"currency_symbol\": \"🪙\",\n \"bet_button_text\": \"BET\",\n \"eject_button_text\": \"EJECT\",\n \"wheel_sector_alpha\": \"Alpha\",\n \"wheel_sector_beta\": \"Beta\",\n \"wheel_sector_gamma\": \"Gamma\",\n \"referral_title\": \"Invite Friends\",\n \"promo_title\": \"Redeem Promo\",\n \"wallet_title\": \"Wallet\",\n \"top_up_title\": \"Top Up Balance\",\n \"rules_text\": \"Play responsibly. All games are provably fair server-side.\",\n};\n\n// Seed defaults\nfor (const [k, v] of Object.entries(DEFAULT_CONFIG)) {\n db.prepare(`INSERT OR IGNORE INTO app_config (config_key, config_value) VALUES (?, ?)`).run(k, v);\n}\n\nfunction cfg(key: string): string {\n const row = db.prepare(`SELECT config_value FROM app_config WHERE config_key = ?`).get(key);\n return row?.config_value ?? DEFAULT_CONFIG[key] ?? key;\n}\n\nfunction tx(userId: string, amount: number, type: string, currency = \"BAL\"): void {\n db.prepare(`INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)`)\n .run(crypto.randomUUID(), userId, amount, type, currency);\n}\n\n// ─────────────── TELEGRAM AUTH (HMAC SHA-256) ───────────────\nfunction validateInitData(initData: string): Record | null {\n if (!initData) return null;\n const params = new URLSearchParams(initData);\n const hash = params.get(\"hash\");\n params.delete(\"hash\");\n const dataCheckString = [...params.entries()].sort(([a], [b]) => a.localeCompare(b))\n .map(([k, v]) => `${k}=${v}`).join(\"\\n\");\n const secretKey = createHmac(\"sha256\", \"WebAppData\").update(BOT_TOKEN).digest();\n const computed = createHmac(\"sha256\", secretKey).update(dataCheckString).digest(\"hex\");\n if (computed !== hash) return null;\n const user = params.get(\"user\");\n return user ? JSON.parse(user) : null;\n}\n\n// ─────────────── PROVABLY FAIR HMAC ───────────────\nfunction randomFloat(seed: string): number {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n return parseInt(h.subarray(0, 8).toString(\"hex\"), 16) / 0xffffffff;\n}\n\nfunction crashMultiplier(seed: string): { multiplier: number; hash: string } {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n const hashHex = h.toString(\"hex\").slice(0, 16);\n const rand = randomFloat(seed);\n // Crash curve: high multiplier on small rand, quickly crashes\n const multiplier = Math.max(1, Math.floor((100 / (rand * 100 + 1)) * 100) / 100);\n return { multiplier, hash: hashHex };\n}\n\n// ─────────────── APP ───────────────\nconst app = new Hono();\n\n// Serve built frontend\napp.get(\"*\", serveStatic({ root: \"./\" }));\napp.get(\"/\", async (c) => {\n return new Response(await Deno.readFile(\"./index.html\"), {\n headers: { \"Content-Type\": \"text/html\" },\n });\n});\n\nconst api = new Hono();\n\napi.post(\"/auth\", async (c) => {\n const { initData, startParam } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Invalid initData\" }, 401);\n const id = String(user.id);\n const uname = user.username ?? `user_${id.slice(-4)}`;\n db.prepare(`INSERT OR IGNORE INTO users (telegram_id, username) VALUES (?, ?)`).run(id, uname);\n const isNew = db.prepare(`SELECT created_at FROM users WHERE telegram_id = ?`).get(id).created_at ===\n new Date().toISOString().slice(0, 19).replace(\"T\", \" \").slice(0, 0) + \"\" || true;\n\n // Referral\n if (startParam && startParam !== id) {\n const row = db.prepare(`SELECT referrer_id FROM users WHERE telegram_id = ?`).get(id);\n if (row && !row.referrer_id) {\n db.prepare(`UPDATE users SET referrer_id = ? WHERE telegram_id = ?`).run(startParam, id);\n db.prepare(`UPDATE users SET balance = balance + 5 WHERE telegram_id = ?`).run(startParam);\n db.prepare(`UPDATE users SET balance = balance + 5 WHERE telegram_id = ?`).run(id);\n tx(startParam, 5, \"REFERRAL_REWARD\");\n tx(id, 5, \"REFERRAL_BONUS\");\n }\n }\n return c.json({\n ok: true,\n user: db.prepare(`SELECT * FROM users WHERE telegram_id = ?`).get(id),\n });\n});\n\napi.get(\"/config\", (c) => {\n const config: Record = { ...DEFAULT_CONFIG };\n for (const row of db.prepare(`SELECT * FROM app_config`).all()) config[row.config_key] = row.config_value;\n return c.json({ ok: true, config });\n});\n\napi.post(\"/admin/config\", async (c) => {\n const { initData, updates } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !ADMIN_IDS.includes(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n const stmt = db.prepare(`UPDATE app_config SET config_value = ? WHERE config_key = ?`);\n for (const [k, v] of Object.entries(updates)) {\n if (DEFAULT_CONFIG[k] !== undefined) {\n stmt.run(String(v), k);\n }\n }\n return c.json({ ok: true });\n});\n\napi.post(\"/promo/claim\", async (c) => {\n const { initData, code } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const promo = db.prepare(`SELECT * FROM promo_codes WHERE code = ?`).get(code.toUpperCase());\n if (!promo) return c.json({ ok: false, error: \"Invalid code\" });\n if (promo.current_activations >= promo.max_activations) return c.json({ ok: false, error: \"Code exhausted\" });\n const claimed = db.prepare(`SELECT * FROM user_promos WHERE user_id = ? AND promo_code = ?`).get(id, code.toUpperCase());\n if (claimed) return c.json({ ok: false, error: \"Already claimed\" });\n db.prepare(`INSERT INTO user_promos (user_id, promo_code) VALUES (?, ?)`).run(id, code.toUpperCase());\n db.prepare(`UPDATE promo_codes SET current_activations = current_activations + 1 WHERE code = ?`).run(code.toUpperCase());\n db.prepare(`UPDATE users SET balance = balance + ? WHERE telegram_id = ?`).run(promo.reward_amount, id);\n tx(id, promo.reward_amount, \"PROMO\", \"BAL\");\n return c.json({ ok: true, reward: promo.reward_amount, balance: db.prepare(`SELECT balance FROM users WHERE telegram_id = ?`).get(id).balance });\n});\n\napi.get(\"/referrals\", (c) => {\n const uid = c.req.headers.get(\"x-user-id\");\n if (!uid) return c.json({ ok: false });\n const refLink = `https://t.me/${BOT_TOKEN.split(\":\")[0] === \"7832757388\" ? \"bot\" + BOT_TOKEN.split(\":\")[0] : \"yourbot\"}?start=${uid}`;\n const invited = db.prepare(`SELECT telegram_id, username, created_at FROM users WHERE referrer_id = ?`).all(uid);\n const earnings = invited.length * 5;\n return c.json({ ok: true, refLink, invited, earnings });\n});\n\n// ─────────────── GAMES ───────────────\nfunction getBal(id: string): number {\n return db.prepare(`SELECT balance FROM users WHERE telegram_id = ?`).get(id)?.balance ?? 0;\n}\n\napi.post(\"/games/booster/launch\", async (c) => {\n const { initData, bet } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = getBal(id);\n if (bet > bal || bet <= 0) return c.json({ ok: false, error: \"Insufficient balance\" });\n db.prepare(`UPDATE users SET balance = balance - ? WHERE telegram_id = ?`).run(bet, id);\n tx(id, -bet, \"BOOSTER_BET\");\n const seed = `${id}-${Date.now()}-${crypto.randomUUID()}`;\n const { multiplier, hash } = crashMultiplier(seed);\n const key = crypto.randomUUID();\n db.prepare(`INSERT INTO games_state (user_id, game, bet, state, multiplier) VALUES (?, ?, ?, 'running', ?)`)\n .run(id, \"booster\", bet, multiplier);\n return c.json({ ok: true, gameKey: key, bet, crashPoint: multiplier, hash });\n});\n\napi.post(\"/games/booster/eject\", async (c) => {\n const { initData, bet, mult } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const game = db.prepare(`SELECT * FROM games_state WHERE user_id = ? AND game = 'booster' ORDER BY id DESC LIMIT 1`).get(id);\n if (!game || game.state !== \"running\") return c.json({ ok: false, error: \"No active game\" });\n db.prepare(`UPDATE games_state SET state = 'cashed_out' WHERE id = ?`).run(game.id);\n if (mult < game.multiplier) {\n const win = game.bet * mult;\n db.prepare(`UPDATE users SET balance = balance + ? WHERE telegram_id = ?`).run(win, id);\n tx(id, win, \"BOOSTER_WIN\");\n return c.json({ ok: true, cashedAt: mult, won: win, balance: getBal(id) });\n }\n return c.json({ ok: true, cashedAt: mult, won: 0, balance: getBal(id) });\n});\n\napi.post(\"/games/wheel/spin\", async (c) => {\n const { initData, bet, sector } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = getBal(id);\n if (bet > bal || bet <= 0) return c.json({ ok: false, error: \"Insufficient balance\" });\n const sectors = [\"alpha\", \"beta\", \"gamma\"];\n const payout = { alpha: 2, beta: 2, gamma: 14 };\n const rand = randomFloat(`${id}-${Date.now()}`);\n const winning = sectors[Math.floor(rand * (rand > 0.9 ? 1000 : 100)) % (rand > 0.9 ? sectors.length : 2)];\n db.prepare(`UPDATE users SET balance = balance - ? WHERE telegram_id = ?`).run(bet, id);\n tx(id, -bet, \"WHEEL_BET\");\n let won = 0;\n if (sector === winning) {\n won = bet * payout[sector];\n db.prepare(`UPDATE users SET balance = balance + ? WHERE telegram_id = ?`).run(won, id);\n tx(id, won, \"WHEEL_WIN\");\n }\n return c.json({ ok: true, winning, sector, won, balance: getBal(id) });\n});\n\napi.get(\"/games/matches\", (c) => {\n const teams = [\n [\"⚡ Thunder FC\", \"🔥 Blaze United\"], [\"🚀 Rockets\", \"🛡️ Guardians\"],\n [\"🐺 Wolves\", \"🦅 Eagles\"], [\"🏴‍☠️ Pirates\", \"⚓ Sailors\"],\n ];\n return c.json({ ok: true, matches: teams.map((t, i) => ({ id: `M${i + 1}`, home: t[0], away: t[1], time: `${(18 + i) % 24}:00` })) });\n});\n\napi.post(\"/games/matches/predict\", async (c) => {\n const { initData, bet, matchId, outcome } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = getBal(id);\n if (bet > bal || bet <= 0) return c.json({ ok: false, error: \"Insufficient balance\" });\n const rand = randomFloat(`${id}-${matchId}-${Date.now()}`);\n const result = [\"home\", \"draw\", \"away\"][Math.floor(rand * 3)];\n db.prepare(`UPDATE users SET balance = balance - ? WHERE telegram_id = ?`).run(bet, id);\n tx(id, -bet, \"MATCH_BET\");\n let won = 0;\n if (outcome === result) {\n won = bet * (outcome === \"draw\" ? 3.4 : 2.1);\n db.prepare(`UPDATE users SET balance = balance + ? WHERE telegram_id = ?`).run(won, id);\n tx(id, won, \"MATCH_WIN\");\n }\n return c.json({ ok: true, result, outcome, won, balance: getBal(id) });\n});\n\n// ─────────────── PAYMENTS (Telegram Stars) ───────────────\napi.get(\"/payments/create-invoice\", (c) => {\n // Minimal Stars invoice link generation\n return c.json({\n ok: true,\n starsUrl: `https://t.me/${BOT_TOKEN.split(\":\")[0] === \"7832757388\" ? \"bot\" : \"bot\"}/pay?invoice=2308_${Date.now()}`,\n provider: PROVIDER_TOKEN_STARS,\n });\n});\n\napi.post(\"/payments/topup\", async (c) => {\n const { initData, stars } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const credits = Math.round(stars * 0.8); // 80% conversion\n db.prepare(`UPDATE users SET balance = balance + ? WHERE telegram_id = ?`).run(credits, id);\n tx(id, credits, \"STARS_TOPUP\", \"STARS\");\n return c.json({ ok: true, credits, balance: getBal(id) });\n});\n\napp.route(\"/api\", api);\n\napp.onError((e, c) => c.json({ ok: false, error: String(e?.message ?? e) }, 500));\n\nexport default app;\n","// Gamified Arcade Platform — Telegram Mini App Backend\n// Hono + std/sqlite (persistent) + provably-fair game logic\n\nimport { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\n// ============================================================\n// SECRETS & CONFIGURATION\n// Reads from process.env if present (Node), else Deno.env (Val Town runtime),\n// with fallback defaults embedded.\n// ============================================================\nfunction env(key: string): string | undefined {\n const p = (globalThis as any).process?.env as Record | undefined;\n if (p && key in p) return p[key];\n try {\n const dv = Deno.env.get(key);\n if (dv) return dv;\n } catch {\n /* ignore */\n }\n return undefined;\n}\n\nconst BOT_TOKEN = env(\"BOT_TOKEN\") || \"7832757388:AAFjh142ae9d-MSKK5Ae-XSlT0f3baIQYxk\";\nconst ADMIN_IDS = (env(\"ADMIN_TELEGRAM_IDS\") || \"6819127801\")\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean);\nconst PROVIDER_TOKEN_STARS = env(\"PROVIDER_TOKEN_STARS\") || \"XTR\";\nconst BOT_USERNAME = env(\"BOT_USERNAME\") || \"YourArcadeBot\";\n\n// ============================================================\n// DEFAULT UI CONFIG STRINGS\n// ============================================================\nconst DEFAULT_CONFIG: Record = {\n game_1_title: \"Space Booster\",\n game_1_desc: \"Blast off and cash out before the rocket explodes!\",\n game_2_title: \"Color Wheel\",\n game_2_desc: \"Spin the wheel. Alpha & Beta x2, Gamma x14.\",\n game_3_title: \"Match Predictor\",\n game_3_desc: \"Predict real matches and win big.\",\n currency_symbol: \"⭐\",\n bet_button_text: \"Place Bet\",\n eject_button_text: \"Eject\",\n spin_button_text: \"Spin\",\n topup_button_text: \"Top Up\",\n promo_button_text: \"Claim Promo\",\n wallet_title: \"Wallet\",\n profile_title: \"Profile\",\n arcade_title: \"Arcade Hub\",\n earn_title: \"Earn & Promo\",\n wheel_sector_alpha: \"Alpha\",\n wheel_sector_beta: \"Beta\",\n wheel_sector_gamma: \"Gamma\",\n referral_title: \"Invite Friends\",\n promo_title: \"Redeem Promo\",\n rules_text: \"Play responsibly. All games are provably fair server-side.\",\n};\n\n// ============================================================\n// DATABASE INITIALIZATION (idempotent)\n// ============================================================\nasync function initDB() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS users (\n telegram_id TEXT PRIMARY KEY,\n username TEXT,\n balance REAL DEFAULT 0,\n referrer_id TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS promo_codes (\n code TEXT PRIMARY KEY,\n reward_amount REAL,\n max_activations INTEGER,\n current_activations INTEGER DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS user_promos (\n user_id TEXT,\n promo_code TEXT,\n PRIMARY KEY (user_id, promo_code)\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS app_config (\n config_key TEXT PRIMARY KEY,\n config_value TEXT\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS transactions (\n id TEXT PRIMARY KEY,\n user_id TEXT,\n amount REAL,\n type TEXT,\n currency TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n )`);\n\n // Seed default config (idempotent)\n for (const [key, value] of Object.entries(DEFAULT_CONFIG)) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO app_config (config_key, config_value) VALUES (?, ?)\",\n args: [key, value],\n });\n }\n}\n\n// ============================================================\n// HELPERS\n// ============================================================\nasync function getConfig(): Promise> {\n const rows = await sqlite.execute(\"SELECT config_key, config_value FROM app_config\");\n const stored: Record = {};\n for (const row of rows.rows) stored[row.config_key as string] = row.config_value as string;\n return { ...DEFAULT_CONFIG, ...stored };\n}\n\nasync function cfg(key: string): Promise {\n const rows = await sqlite.execute({\n sql: \"SELECT config_value FROM app_config WHERE config_key = ?\",\n args: [key],\n });\n return rows.rows.length ? (rows.rows[0].config_value as string) : (DEFAULT_CONFIG[key] ?? key);\n}\n\nasync function getUser(id: string) {\n const rows = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE telegram_id = ?\",\n args: [id],\n });\n return rows.rows.length ? rows.rows[0] : null;\n}\n\nasync function getBal(id: string): Promise {\n const rows = await sqlite.execute({\n sql: \"SELECT balance FROM users WHERE telegram_id = ?\",\n args: [id],\n });\n return rows.rows.length ? Number(rows.rows[0].balance) : 0;\n}\n\nasync function addTx(userId: string, amount: number, type: string, currency = \"BAL\") {\n await sqlite.execute({\n sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\",\n args: [crypto.randomUUID(), userId, amount, type, currency],\n });\n}\n\nasync function getOrCreateUser(id: string, uname?: string, referrerId?: string) {\n let user = await getUser(id);\n if (!user) {\n // FIRST check if this user was referred (start param) — credit both parties\n await sqlite.execute({\n sql: \"INSERT INTO users (telegram_id, username, referrer_id) VALUES (?, ?, ?)\",\n args: [id, uname || null, referrerId || null],\n });\n user = await getUser(id);\n if (referrerId && referrerId !== id) {\n // Credit referrer\n await sqlite.execute({\n sql: \"UPDATE users SET balance = balance + 5 WHERE telegram_id = ?\",\n args: [referrerId],\n });\n await addTx(referrerId, 5, \"REFERRAL_REWARD\");\n // Credit new user too\n await sqlite.execute({\n sql: \"UPDATE users SET balance = balance + 5 WHERE telegram_id = ?\",\n args: [id],\n });\n await addTx(id, 5, \"REFERRAL_BONUS\");\n user = await getUser(id);\n }\n }\n return user;\n}\n\n// ============================================================\n// TELEGRAM INITDATA VALIDATION (HMAC SHA-256)\n// ============================================================\nexport function validateInitData(initData: string): Record | null {\n if (!initData) return null;\n const params = new URLSearchParams(initData);\n const hash = params.get(\"hash\");\n if (!hash) return null;\n params.delete(\"hash\");\n\n const dataCheckString = [...params.entries()]\n .sort(([a], [b]) => a.localeCompare(b))\n .map(([k, v]) => `${k}=${v}`)\n .join(\"\\n\");\n\n const secretKey = createHmac(\"sha256\", \"WebAppData\").update(BOT_TOKEN).digest();\n const computed = createHmac(\"sha256\", secretKey).update(dataCheckString).digest();\n const expected = Buffer.from(computed);\n const provided = Buffer.from(hash, \"hex\");\n if (expected.length !== provided.length || !timingSafeEqual(expected, provided)) {\n return null;\n }\n const user = params.get(\"user\");\n return user ? JSON.parse(user) : null;\n}\n\nconst isAdmin = (id: string) => ADMIN_IDS.includes(id);\n\n// ============================================================\n// PROVABLY FAIR HMAC\n// ============================================================\nfunction randomFloat(seed: string): number {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n return parseInt(h.subarray(0, 8).toString(\"hex\"), 16) / 0xffffffff;\n}\n\nfunction crashMultiplier(seed: string): { multiplier: number; hash: string } {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n const hashHex = h.toString(\"hex\").slice(0, 16);\n const rand = randomFloat(seed);\n // Crash curve: low rand -> high multiplier (37% max 100x)\n const multiplier = Math.max(1, Math.floor((100 / (rand * 100 + 1)) * 100) / 100);\n return { multiplier, hash: hashHex };\n}\n\n// ============================================================\n// HONO APP\n// ============================================================\nconst app = new Hono();\n\nconst api = new Hono();\n\n// --- Auth ---\napi.post(\"/auth\", async (c) => {\n const { initData, startParam } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Invalid initData\" }, 401);\n const id = String(user.id);\n const uname = user.username ?? user.first_name ?? `user_${id.slice(-4)}`;\n const u = await getOrCreateUser(id, uname, startParam && startParam !== id ? String(startParam) : undefined);\n return c.json({\n ok: true,\n user: {\n ...u,\n is_admin: isAdmin(id),\n balance: Number(u.balance),\n },\n });\n});\n\n// --- Config ---\napi.get(\"/config\", async (c) => c.json({ ok: true, config: await getConfig() }));\n\n// --- Admin config (protected) ---\napi.post(\"/admin/config\", async (c) => {\n const { initData, updates } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n const stmt = `INSERT INTO app_config (config_key, config_value) VALUES (?, ?)\n ON CONFLICT(config_key) DO UPDATE SET config_value = excluded.config_value`;\n for (const [k, v] of Object.entries(updates || {})) {\n if (typeof k === \"string\" && typeof v === \"string\" && String(v).trim() !== \"\") {\n await sqlite.execute({ sql: stmt, args: [k, String(v).trim()] });\n }\n }\n return c.json({ ok: true, config: await getConfig() });\n});\n\n// --- Promo claim ---\napi.post(\"/promo/claim\", async (c) => {\n const { initData, code } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const up = String(code || \"\").toUpperCase();\n const promo = (await sqlite.execute({ sql: \"SELECT * FROM promo_codes WHERE code = ?\", args: [up] })).rows[0];\n if (!promo) return c.json({ ok: false, error: \"Invalid code\" });\n if ((promo.current_activations as number) >= (promo.max_activations as number))\n return c.json({ ok: false, error: \"Code exhausted\" });\n const claimed = (await sqlite.execute({\n sql: \"SELECT * FROM user_promos WHERE user_id = ? AND promo_code = ?\",\n args: [id, up],\n })).rows[0];\n if (claimed) return c.json({ ok: false, error: \"Already claimed\" });\n\n const reward = Number(promo.reward_amount);\n await sqlite.batch([\n { sql: \"INSERT INTO user_promos (user_id, promo_code) VALUES (?, ?)\", args: [id, up] },\n { sql: \"UPDATE promo_codes SET current_activations = current_activations + 1 WHERE code = ?\", args: [up] },\n { sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [reward, id] },\n { sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\", args: [crypto.randomUUID(), id, reward, \"PROMO\", \"BAL\"] },\n ]);\n return c.json({ ok: true, reward, balance: await getBal(id) });\n});\n\n// --- Referrals ---\napi.get(\"/referrals\", async (c) => {\n const uid = c.req.header(\"x-user-id\");\n if (!uid) return c.json({ ok: false });\n const refLink = `https://t.me/${BOT_USERNAME}?start=${uid}`;\n const invited = (await sqlite.execute({\n sql: \"SELECT telegram_id, username, created_at FROM users WHERE referrer_id = ?\",\n args: [uid],\n })).rows;\n const earnings = (await sqlite.execute({\n sql: \"SELECT COALESCE(SUM(amount),0) AS s FROM transactions WHERE user_id = ? AND type = 'REFERRAL_REWARD'\",\n args: [uid],\n })).rows[0]?.s ?? 0;\n return c.json({ ok: true, refLink, invited, earnings });\n});\n\n// --- Payments / Stars invoice ---\napi.post(\"/payments/create-invoice\", async (c) => {\n const { telegram_id, amount } = await c.req.json();\n if (!telegram_id || !amount || amount <= 0) return c.json({ ok: false, error: \"Invalid amount\" }, 400);\n const sym = await cfg(\"currency_symbol\");\n return c.json({\n ok: true,\n title: `Top Up — add ${amount} ${sym}`,\n payload: JSON.stringify({ user_id: String(telegram_id), amount, method: \"stars\" }),\n currency: \"XTR\",\n amount: amount * 100,\n provider: PROVIDER_TOKEN_STARS,\n // In production: call Bot API sendInvoice and return invoice_link.\n invoice_link: null,\n });\n});\n\n// --- Telegram webhook ---\napi.post(\"/webhook/telegram\", async (c) => {\n const update = await c.req.json();\n if (update.pre_checkout_query) {\n return c.json({ ok: true });\n }\n if (update.message?.successful_payment) {\n const pay = update.message.successful_payment;\n let payload: any = {};\n try { payload = JSON.parse(pay.invoice_payload || \"{}\"); } catch {}\n const userId = payload.user_id || String(update.message.from?.id || \"\");\n const amount = Number(payload.amount || 0);\n if (userId && amount > 0) {\n await sqlite.batch([\n { sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [amount, userId] },\n { sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\", args: [crypto.randomUUID(), userId, amount, \"DEPOSIT\", \"STARS\"] },\n ]);\n }\n return c.json({ ok: true, credited: amount, user_id: userId });\n }\n return c.json({ ok: true, received: true });\n});\n\n// ============================================================\n// GAMES\n// ============================================================\n\n// --- Space Booster: launch ---\napi.post(\"/games/booster/launch\", async (c) => {\n const { initData, bet } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"BOOSTER_BET\");\n const seed = `${id}-${Date.now()}-${crypto.randomUUID()}`;\n const { multiplier, hash } = crashMultiplier(seed);\n await sqlite.execute({\n sql: \"INSERT INTO games_state (user_id, game, bet, state, multiplier) VALUES (?, ?, ?, 'running', ?)\",\n args: [id, \"booster\", bet, multiplier],\n });\n return c.json({ ok: true, bet, crashPoint: multiplier, hash });\n});\n\n// --- Space Booster: eject ---\napi.post(\"/games/booster/eject\", async (c) => {\n const { initData, mult } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const game = (await sqlite.execute({\n sql: \"SELECT * FROM games_state WHERE user_id = ? AND game = 'booster' ORDER BY id DESC LIMIT 1\",\n args: [id],\n })).rows[0];\n if (!game || game.state !== \"running\") return c.json({ ok: false, error: \"No active game\" });\n await sqlite.execute({ sql: \"UPDATE games_state SET state = 'cashed_out' WHERE id = ?\", args: [game.id as number] });\n if (Number(mult) < Number(game.multiplier)) {\n const win = Number((game.bet as number) * Number(mult));\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [win, id] });\n await addTx(id, win, \"BOOSTER_WIN\");\n return c.json({ ok: true, cashedAt: mult, won: win, balance: await getBal(id) });\n }\n return c.json({ ok: true, cashedAt: mult, won: 0, balance: await getBal(id) });\n});\n\n// --- Color Wheel: spin ---\napi.post(\"/games/wheel/spin\", async (c) => {\n const { initData, bet, sector } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const sectors = [\"alpha\", \"beta\", \"gamma\"];\n const payout: Record = { alpha: 2, beta: 2, gamma: 14 };\n if (!sectors.includes(sector)) return c.json({ ok: false, error: \"Invalid sector\" });\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n const rand = randomFloat(`${id}-${Date.now()}-${crypto.randomUUID()}`);\n // Gamma much rarer (14x)\n const weighted = rand < 0.45 ? \"alpha\" : rand < 0.9 ? \"beta\" : \"gamma\";\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"WHEEL_BET\");\n let won = 0;\n if (sector === weighted) {\n won = bet * payout[sector];\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [won, id] });\n await addTx(id, won, \"WHEEL_WIN\");\n }\n return c.json({ ok: true, winning: weighted, sector, won, balance: await getBal(id) });\n});\n\n// --- Match Predictor ---\napi.get(\"/games/matches\", (c) => {\n const teams = [\n [\"⚡ Thunder FC\", \"🔥 Blaze United\"], [\"🚀 Rockets\", \"🛡️ Guardians\"],\n [\"🐺 Wolves\", \"🦅 Eagles\"], [\"🏴☠️ Pirates\", \"⚓ Sailors\"],\n ];\n return c.json({ ok: true, matches: teams.map((t, i) => ({\n id: `M${i + 1}`, home: t[0], away: t[1], time: `${(18 + i) % 24}:00`,\n })) });\n});\n\napi.post(\"/games/matches/predict\", async (c) => {\n const { initData, bet, matchId, outcome } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n if (![\"home\", \"draw\", \"away\"].includes(outcome)) return c.json({ ok: false, error: \"Invalid outcome\" });\n const rand = randomFloat(`${id}-${matchId}-${Date.now()}`);\n const result = [\"home\", \"draw\", \"away\"][Math.floor(rand * 3)];\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"MATCH_BET\");\n let won = 0;\n if (outcome === result) {\n won = bet * (outcome === \"draw\" ? 3.4 : 2.1);\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [won, id] });\n await addTx(id, won, \"MATCH_WIN\");\n }\n return c.json({ ok: true, result, outcome, won, balance: await getBal(id) });\n});\n\n// --- Admin tools: create promo, user search, balance manage ---\napi.post(\"/admin/promo\", async (c) => {\n const { initData, code, reward, maxActivations } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO promo_codes (code, reward_amount, max_activations, current_activations) VALUES (?, ?, ?, 0)\",\n args: [String(code).toUpperCase(), Number(reward), Number(maxActivations)],\n });\n return c.json({ ok: true });\n});\n\napi.post(\"/admin/set-balance\", async (c) => {\n const { initData, telegram_id, balance } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n await sqlite.execute({\n sql: \"INSERT INTO users (telegram_id, username) VALUES (?, 'admin-set') ON CONFLICT(telegram_id) DO UPDATE SET balance = ?\",\n args: [String(telegram_id), Number(balance)],\n });\n return c.json({ ok: true, balance: await getBal(String(telegram_id)) });\n});\n\napi.get(\"/admin/search\", async (c) => {\n const { initData, q } = c.req.query();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n const rows = (await sqlite.execute({\n sql: \"SELECT telegram_id, username, balance, created_at FROM users WHERE telegram_id LIKE ? OR username LIKE ? LIMIT 20\",\n args: [`%${q}%`, `%${q}%`],\n })).rows;\n return c.json({ ok: true, users: rows });\n});\n\n// --- Transactions / wallet ---\napi.get(\"/transactions\", async (c) => {\n const uid = c.req.header(\"x-user-id\");\n if (!uid) return c.json({ ok: false });\n const rows = (await sqlite.execute({\n sql: \"SELECT * FROM transactions WHERE user_id = ? ORDER BY created_at DESC, id DESC LIMIT 50\",\n args: [uid],\n })).rows;\n return c.json({ ok: true, transactions: rows });\n});\n\n// ============================================================\n// Serve frontend & wire up\n// ============================================================\napp.route(\"/api\", api);\n\napp.get(\"/\", (c) =>\n c.html(\n `ArcadeArcade backend running.`,\n ),\n);\n\napp.onError((e) => {\n console.error(e);\n return new Response(JSON.stringify({ ok: false, error: String(e?.message ?? e) }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" },\n });\n});\n\nawait initDB();\n\nexport default app.fetch;\n","createdAt",["D",1788480975435],"branchVersion","branchId","4dfd1fe9-e137-4b46-9340-d42f83fc4da4","id","d9611aa2-b4b6-41f8-a1f9-370eaf4eb0fc","tma-arcade",["D",1788480712077],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Gamified Arcade Telegram Mini App with Hono, React, SQLite","imageUrl","84cb2ce8-8f92-484d-b328-40c43207f7bd","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a069c1-3a3d-73b9-88b4-cd9f69fa1f0d","tursoName","d9611aa2b4b641f8a1f9370eaf4eb0fc","tursoHostname","d9611aa2b4b641f8a1f9370eaf4eb0fc-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789526460011],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_106":105,"_113":108},"org",{"_106":105,"_107":108,"_109":108,"_19":62,"_110":111,"_112":31},"branch",{"_13":95,"_39":96,"_50":49,"_97":51,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":52,"_104":105},"isOwned",9,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","yrg7l18b88","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_50":51,"_39":52,"_45":160,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":38,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":161,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":162,"_90":163,"_92":164,"_94":31},"tree",[155],"files",[155],"counts",{"_144":69,"_145":140,"_146":69,"_147":148,"_149":150},"contents",[135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_50":136,"_39":34,"_37":38,"_137":-5,"_48":49,"_47":14,"_138":31,"_45":139,"_13":140,"_40":41,"_42":44,"_30":31,"_141":142,"_33":143},"d43c203a-040d-4d42-8472-2c1a72708f48","parentId","latest",["D",1788480975435],1,"label","tma-arcade-42",[34],"pulls","branches","forks","envVars",{"_151":153,"_154":69},"connections",{"_151":69,"_152":69},"count","unfilledCount",4,"emptyCount",{"_50":136,"_39":34,"_37":38,"_137":-5,"_48":49,"_47":14,"_138":31,"_45":156,"_13":140,"_40":41,"_42":44,"_30":31,"_141":142,"_157":158,"_33":159},["D",1788480975435],"children",[],[34],["D",1788480712077],["D",1789526460011],{"_106":105,"_113":108},{"_106":105,"_107":108,"_109":108,"_19":62,"_110":111,"_112":31},{"_13":95,"_39":96,"_50":49,"_97":51,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":52,"_104":105},"ctx",{"_88":-5,"_132":198,"_199":200,"_201":202,"_203":31,"_204":31,"_205":31,"_206":65,"_207":-5,"_208":-7,"_209":-7,"_210":69,"_211":31,"_212":31,"_213":-5,"_214":31,"_215":31,"_216":31,"_217":-5},"ENV",{"_169":170,"_171":172,"_173":96,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2