Arcade

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_203":204,"_205":206},"routes/_app.x.$handle.$name",{"_102":101,"_37":48,"_110":92,"_32":104,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_26":-5,"_121":-5,"_122":-5,"_123":30,"_124":125,"_126":62,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_46":47,"_37":48,"_41":49,"_50":-5,"_51":30,"_52":53,"_54":53,"_55":56,"_57":-5,"_19":58,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":30},"version",9,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","c2908a34-781b-4115-847e-da0003bd3f40","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":-7,"_29":30,"_31":30,"_32":33,"_34":33},"file",{"_35":36,"_37":33,"_38":26,"_39":40,"_41":42,"_43":14,"_44":45,"_29":30},"previous","deleted",false,"deletedHere","path","README.md","latestPath","fileId","21efb854-a7f6-11f1-b90c-1607ee4eb77e","name","fileType","content","# 🎮 Gamified Arcade — Telegram Mini App\n\nA complete, full-stack Telegram Mini App (TMA) for a gamified arcade platform, built as a single Val Town project.\n\n- **Backend:** Hono + `std/sqlite` (persistent), HMAC-secured Telegram `initData` auth, provably-fair server-side game logic.\n- **Frontend:** React 18 + Tailwind (Twind) + Framer Motion, styled with native Telegram theme variables, Haptic Feedback, skeleton loading.\n- **Payments:** Telegram Stars (`XTR`) invoice generation + TON option + webhook credit handler.\n\n## 🔗 Live app\n[Try the app](url:api.tsx)\n\n## 🧩 Files\n- `api.tsx` — Hono backend: auth, config, admin, promo, referrals, payments, webhook, and all three games.\n- `frontend/root.tsx` — HTML shell (stamps the immutable client entry).\n- `frontend/index.tsx` — the single-file React client (all screens).\n\n## ⚙️ Configuration (env vars, with fallback defaults embedded)\n| Var | Default | Purpose |\n|-----|---------|---------|\n| `BOT_TOKEN` | embedded | Validates Telegram `initData` HMAC SHA-256 |\n| `ADMIN_TELEGRAM_IDS` | `6819127801` | Comma-separated admin IDs (admin dashboard access) |\n| `PROVIDER_TOKEN_STARS` | `XTR` | Telegram Stars provider token |\n| `BOT_USERNAME` | `YourArcadeBot` | Used to build `t.me/bot?start=REF_ID` referral links |\n\n## 🛠️ Setup\n1. Set your real `BOT_TOKEN` and `ADMIN_TELEGRAM_IDS` in the val's environment variables.\n2. Point your Telegram bot's Mini App URL at the live endpoint (see above).\n3. Set your bot's webhook to `…/api/webhook/telegram` to receive Stars `pre_checkout_query` and payment confirmations.\n\n## 🎲 Games\n- **Space Booster** — crash simulator. Server picks a crash point via HMAC; eject before it crashes to win `bet × multiplier`.\n- **Color Wheel** — 3 sectors: Alpha (x2), Beta (x2), Gamma (x14). Server decides the winning sector.\n- **Match Predictor** — stake points on fixture outcomes; correct predictions pay out at the odds.\n\n## 🧑‍💼 Admin Dashboard\nVisible only to users whose Telegram ID is in `ADMIN_TELEGRAM_IDS`:\n- **Dynamic Text Studio** — edit any UI label (game names, currency symbol, buttons) live in `app_config`.\n- **Promo Code Generator** — create codes with reward amount + max activations.\n- **User search & balance management.**\n\nDemo promo code seeded: `WELCOME` (+50 ⭐).\n\n## 🗄️ Database (std/sqlite)\nTables: `users`, `promo_codes`, `user_promos`, `app_config`, `transactions`, `games_state`. All created idempotently with `CREATE TABLE IF NOT EXISTS` on startup.\n","createdAt",["D",1788481099791],"branchVersion","branchId","4dfd1fe9-e137-4b46-9340-d42f83fc4da4","id","d9611aa2-b4b6-41f8-a1f9-370eaf4eb0fc","tma-arcade",["D",1788480712077],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Gamified Arcade Telegram Mini App with Hono, React, SQLite","imageUrl","84cb2ce8-8f92-484d-b328-40c43207f7bd","pinnedFileId","7565f09e-a7f5-11f1-ba7b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a069c1-3a3d-73b9-88b4-cd9f69fa1f0d","tursoName","d9611aa2b4b641f8a1f9370eaf4eb0fc","tursoHostname","d9611aa2b4b641f8a1f9370eaf4eb0fc-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789526460011],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_109":104},"org",{"_102":101,"_103":104,"_105":104,"_19":58,"_106":107,"_108":30},"branch",{"_13":14,"_37":92,"_46":45,"_93":47,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":48,"_100":101},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","yrg7l18b88","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_46":47,"_37":48,"_41":198,"_50":-5,"_51":30,"_52":53,"_54":53,"_55":56,"_57":-5,"_19":58,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":199,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":200,"_87":201,"_89":202,"_91":30},"tree",[167,170,171],"files",[167,168,169,170,171],"counts",{"_156":66,"_157":158,"_159":66,"_160":161,"_162":163},"contents",[131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_46":149,"_37":150,"_35":151,"_136":-5,"_44":45,"_43":152,"_138":62,"_41":153,"_13":66,"_38":154,"_39":-5,"_29":30,"_143":-5,"_32":155},{"_46":146,"_37":33,"_35":36,"_136":-5,"_44":45,"_43":14,"_138":62,"_41":147,"_13":66,"_38":26,"_39":40,"_29":30,"_143":-5,"_32":148},{"_46":134,"_37":135,"_35":60,"_136":-5,"_44":45,"_43":137,"_138":62,"_41":139,"_13":140,"_38":141,"_39":142,"_29":30,"_143":144,"_32":145},"f1280092-e8c8-4fbf-8e82-996c5b21e7e3","api.tsx","parentId",8,"latest",["D",1788481056993],5,"http","/** @jsxImportSource https://esm.sh/hono@4/jsx */\n\n// Gamified Arcade Platform — Telegram Mini App Backend\n// Hono + std/sqlite (persistent) + provably-fair game logic\n\nimport { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\n// ============================================================\n// SECRETS & CONFIGURATION\n// Reads from process.env if present (Node), else Deno.env (Val Town runtime),\n// with fallback defaults embedded.\n// ============================================================\nfunction env(key: string): string | undefined {\n const p = (globalThis as any).process?.env as Record | undefined;\n if (p && key in p) return p[key];\n try {\n const dv = Deno.env.get(key);\n if (dv) return dv;\n } catch {\n /* ignore */\n }\n return undefined;\n}\n\nconst BOT_TOKEN = env(\"BOT_TOKEN\") || \"7832757388:AAFjh142ae9d-MSKK5Ae-XSlT0f3baIQYxk\";\nconst ADMIN_IDS = (env(\"ADMIN_TELEGRAM_IDS\") || \"6819127801\")\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean);\nconst PROVIDER_TOKEN_STARS = env(\"PROVIDER_TOKEN_STARS\") || \"XTR\";\nconst BOT_USERNAME = env(\"BOT_USERNAME\") || \"YourArcadeBot\";\n\n// ============================================================\n// DEFAULT UI CONFIG STRINGS\n// ============================================================\nconst DEFAULT_CONFIG: Record = {\n game_1_title: \"Space Booster\",\n game_1_desc: \"Blast off and cash out before the rocket explodes!\",\n game_2_title: \"Color Wheel\",\n game_2_desc: \"Spin the wheel. Alpha & Beta x2, Gamma x14.\",\n game_3_title: \"Match Predictor\",\n game_3_desc: \"Predict real matches and win big.\",\n currency_symbol: \"⭐\",\n bet_button_text: \"Place Bet\",\n eject_button_text: \"Eject\",\n spin_button_text: \"Spin\",\n topup_button_text: \"Top Up\",\n promo_button_text: \"Claim Promo\",\n wallet_title: \"Wallet\",\n profile_title: \"Profile\",\n arcade_title: \"Arcade Hub\",\n earn_title: \"Earn & Promo\",\n wheel_sector_alpha: \"Alpha\",\n wheel_sector_beta: \"Beta\",\n wheel_sector_gamma: \"Gamma\",\n referral_title: \"Invite Friends\",\n promo_title: \"Redeem Promo\",\n rules_text: \"Play responsibly. All games are provably fair server-side.\",\n};\n\n// ============================================================\n// DATABASE INITIALIZATION (idempotent)\n// ============================================================\nasync function initDB() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS users (\n telegram_id TEXT PRIMARY KEY,\n username TEXT,\n balance REAL DEFAULT 0,\n referrer_id TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS promo_codes (\n code TEXT PRIMARY KEY,\n reward_amount REAL,\n max_activations INTEGER,\n current_activations INTEGER DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS user_promos (\n user_id TEXT,\n promo_code TEXT,\n PRIMARY KEY (user_id, promo_code)\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS app_config (\n config_key TEXT PRIMARY KEY,\n config_value TEXT\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS transactions (\n id TEXT PRIMARY KEY,\n user_id TEXT,\n amount REAL,\n type TEXT,\n currency TEXT,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS games_state (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id TEXT,\n game TEXT,\n bet REAL,\n state TEXT,\n multiplier REAL,\n created_at DATETIME DEFAULT CURRENT_TIMESTAMP\n )`);\n\n // Seed default config (idempotent)\n for (const [key, value] of Object.entries(DEFAULT_CONFIG)) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO app_config (config_key, config_value) VALUES (?, ?)\",\n args: [key, value],\n });\n }\n}\n\n// ============================================================\n// HELPERS\n// ============================================================\nasync function getConfig(): Promise> {\n const rows = await sqlite.execute(\"SELECT config_key, config_value FROM app_config\");\n const stored: Record = {};\n for (const row of rows.rows) stored[row.config_key as string] = row.config_value as string;\n return { ...DEFAULT_CONFIG, ...stored };\n}\n\nasync function cfg(key: string): Promise {\n const rows = await sqlite.execute({\n sql: \"SELECT config_value FROM app_config WHERE config_key = ?\",\n args: [key],\n });\n return rows.rows.length ? (rows.rows[0].config_value as string) : (DEFAULT_CONFIG[key] ?? key);\n}\n\nasync function getUser(id: string) {\n const rows = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE telegram_id = ?\",\n args: [id],\n });\n return rows.rows.length ? rows.rows[0] : null;\n}\n\nasync function getBal(id: string): Promise {\n const rows = await sqlite.execute({\n sql: \"SELECT balance FROM users WHERE telegram_id = ?\",\n args: [id],\n });\n return rows.rows.length ? Number(rows.rows[0].balance) : 0;\n}\n\nasync function addTx(userId: string, amount: number, type: string, currency = \"BAL\") {\n await sqlite.execute({\n sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\",\n args: [crypto.randomUUID(), userId, amount, type, currency],\n });\n}\n\nasync function getOrCreateUser(id: string, uname?: string, referrerId?: string) {\n let user = await getUser(id);\n if (!user) {\n // FIRST check if this user was referred (start param) — credit both parties\n await sqlite.execute({\n sql: \"INSERT INTO users (telegram_id, username, referrer_id) VALUES (?, ?, ?)\",\n args: [id, uname || null, referrerId || null],\n });\n user = await getUser(id);\n if (referrerId && referrerId !== id) {\n // Credit referrer\n await sqlite.execute({\n sql: \"UPDATE users SET balance = balance + 5 WHERE telegram_id = ?\",\n args: [referrerId],\n });\n await addTx(referrerId, 5, \"REFERRAL_REWARD\");\n // Credit new user too\n await sqlite.execute({\n sql: \"UPDATE users SET balance = balance + 5 WHERE telegram_id = ?\",\n args: [id],\n });\n await addTx(id, 5, \"REFERRAL_BONUS\");\n user = await getUser(id);\n }\n }\n return user;\n}\n\n// ============================================================\n// TELEGRAM INITDATA VALIDATION (HMAC SHA-256)\n// ============================================================\nexport function validateInitData(initData: string): Record | null {\n if (!initData) return null;\n const params = new URLSearchParams(initData);\n const hash = params.get(\"hash\");\n if (!hash) return null;\n params.delete(\"hash\");\n\n const dataCheckString = [...params.entries()]\n .sort(([a], [b]) => a.localeCompare(b))\n .map(([k, v]) => `${k}=${v}`)\n .join(\"\\n\");\n\n const secretKey = createHmac(\"sha256\", \"WebAppData\").update(BOT_TOKEN).digest();\n const computed = createHmac(\"sha256\", secretKey).update(dataCheckString).digest();\n const expected = Buffer.from(computed);\n const provided = Buffer.from(hash, \"hex\");\n if (expected.length !== provided.length || !timingSafeEqual(expected, provided)) {\n return null;\n }\n const user = params.get(\"user\");\n return user ? JSON.parse(user) : null;\n}\n\nconst isAdmin = (id: string) => ADMIN_IDS.includes(id);\n\n// ============================================================\n// PROVABLY FAIR HMAC\n// ============================================================\nfunction randomFloat(seed: string): number {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n return parseInt(h.subarray(0, 8).toString(\"hex\"), 16) / 0xffffffff;\n}\n\nfunction crashMultiplier(seed: string): { multiplier: number; hash: string } {\n const h = createHmac(\"sha256\", BOT_TOKEN).update(seed).digest();\n const hashHex = h.toString(\"hex\").slice(0, 16);\n const rand = randomFloat(seed);\n // Crash curve: low rand -> high multiplier (37% max 100x)\n const multiplier = Math.max(1, Math.floor((100 / (rand * 100 + 1)) * 100) / 100);\n return { multiplier, hash: hashHex };\n}\n\n// ============================================================\n// HONO APP\n// ============================================================\nconst app = new Hono();\n\nconst api = new Hono();\n\n// --- Auth ---\napi.post(\"/auth\", async (c) => {\n const { initData, startParam } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Invalid initData\" }, 401);\n const id = String(user.id);\n const uname = user.username ?? user.first_name ?? `user_${id.slice(-4)}`;\n const u = await getOrCreateUser(id, uname, startParam && startParam !== id ? String(startParam) : undefined);\n return c.json({\n ok: true,\n user: {\n ...u,\n is_admin: isAdmin(id),\n balance: Number(u.balance),\n },\n });\n});\n\n// --- Config ---\napi.get(\"/config\", async (c) => c.json({ ok: true, config: await getConfig() }));\n\n// --- Admin config (protected) ---\napi.post(\"/admin/config\", async (c) => {\n const { initData, updates } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n const stmt = `INSERT INTO app_config (config_key, config_value) VALUES (?, ?)\n ON CONFLICT(config_key) DO UPDATE SET config_value = excluded.config_value`;\n for (const [k, v] of Object.entries(updates || {})) {\n if (typeof k === \"string\" && typeof v === \"string\" && String(v).trim() !== \"\") {\n await sqlite.execute({ sql: stmt, args: [k, String(v).trim()] });\n }\n }\n return c.json({ ok: true, config: await getConfig() });\n});\n\n// --- Promo claim ---\napi.post(\"/promo/claim\", async (c) => {\n const { initData, code } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const up = String(code || \"\").toUpperCase();\n const promo = (await sqlite.execute({ sql: \"SELECT * FROM promo_codes WHERE code = ?\", args: [up] })).rows[0];\n if (!promo) return c.json({ ok: false, error: \"Invalid code\" });\n if ((promo.current_activations as number) >= (promo.max_activations as number))\n return c.json({ ok: false, error: \"Code exhausted\" });\n const claimed = (await sqlite.execute({\n sql: \"SELECT * FROM user_promos WHERE user_id = ? AND promo_code = ?\",\n args: [id, up],\n })).rows[0];\n if (claimed) return c.json({ ok: false, error: \"Already claimed\" });\n\n const reward = Number(promo.reward_amount);\n await sqlite.batch([\n { sql: \"INSERT INTO user_promos (user_id, promo_code) VALUES (?, ?)\", args: [id, up] },\n { sql: \"UPDATE promo_codes SET current_activations = current_activations + 1 WHERE code = ?\", args: [up] },\n { sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [reward, id] },\n { sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\", args: [crypto.randomUUID(), id, reward, \"PROMO\", \"BAL\"] },\n ]);\n return c.json({ ok: true, reward, balance: await getBal(id) });\n});\n\n// --- Referrals ---\napi.get(\"/referrals\", async (c) => {\n const uid = c.req.header(\"x-user-id\");\n if (!uid) return c.json({ ok: false });\n const refLink = `https://t.me/${BOT_USERNAME}?start=${uid}`;\n const invited = (await sqlite.execute({\n sql: \"SELECT telegram_id, username, created_at FROM users WHERE referrer_id = ?\",\n args: [uid],\n })).rows;\n const earnings = (await sqlite.execute({\n sql: \"SELECT COALESCE(SUM(amount),0) AS s FROM transactions WHERE user_id = ? AND type = 'REFERRAL_REWARD'\",\n args: [uid],\n })).rows[0]?.s ?? 0;\n return c.json({ ok: true, refLink, invited, earnings });\n});\n\n// --- Payments / Stars invoice ---\napi.post(\"/payments/create-invoice\", async (c) => {\n const { telegram_id, amount } = await c.req.json();\n if (!telegram_id || !amount || amount <= 0) return c.json({ ok: false, error: \"Invalid amount\" }, 400);\n const sym = await cfg(\"currency_symbol\");\n return c.json({\n ok: true,\n title: `Top Up — add ${amount} ${sym}`,\n payload: JSON.stringify({ user_id: String(telegram_id), amount, method: \"stars\" }),\n currency: \"XTR\",\n amount: amount * 100,\n provider: PROVIDER_TOKEN_STARS,\n // In production: call Bot API sendInvoice and return invoice_link.\n invoice_link: null,\n });\n});\n\n// --- Telegram webhook ---\napi.post(\"/webhook/telegram\", async (c) => {\n const update = await c.req.json();\n if (update.pre_checkout_query) {\n return c.json({ ok: true });\n }\n if (update.message?.successful_payment) {\n const pay = update.message.successful_payment;\n let payload: any = {};\n try { payload = JSON.parse(pay.invoice_payload || \"{}\"); } catch {}\n const userId = payload.user_id || String(update.message.from?.id || \"\");\n const amount = Number(payload.amount || 0);\n if (userId && amount > 0) {\n await sqlite.batch([\n { sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [amount, userId] },\n { sql: \"INSERT INTO transactions (id, user_id, amount, type, currency) VALUES (?, ?, ?, ?, ?)\", args: [crypto.randomUUID(), userId, amount, \"DEPOSIT\", \"STARS\"] },\n ]);\n }\n return c.json({ ok: true, credited: amount, user_id: userId });\n }\n return c.json({ ok: true, received: true });\n});\n\n// ============================================================\n// GAMES\n// ============================================================\n\n// --- Space Booster: launch ---\napi.post(\"/games/booster/launch\", async (c) => {\n const { initData, bet } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"BOOSTER_BET\");\n const seed = `${id}-${Date.now()}-${crypto.randomUUID()}`;\n const { multiplier, hash } = crashMultiplier(seed);\n await sqlite.execute({\n sql: \"INSERT INTO games_state (user_id, game, bet, state, multiplier) VALUES (?, ?, ?, 'running', ?)\",\n args: [id, \"booster\", bet, multiplier],\n });\n return c.json({ ok: true, bet, crashPoint: multiplier, hash });\n});\n\n// --- Space Booster: eject ---\napi.post(\"/games/booster/eject\", async (c) => {\n const { initData, mult } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const game = (await sqlite.execute({\n sql: \"SELECT * FROM games_state WHERE user_id = ? AND game = 'booster' ORDER BY id DESC LIMIT 1\",\n args: [id],\n })).rows[0];\n if (!game || game.state !== \"running\") return c.json({ ok: false, error: \"No active game\" });\n await sqlite.execute({ sql: \"UPDATE games_state SET state = 'cashed_out' WHERE id = ?\", args: [game.id as number] });\n if (Number(mult) < Number(game.multiplier)) {\n const win = Number((game.bet as number) * Number(mult));\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [win, id] });\n await addTx(id, win, \"BOOSTER_WIN\");\n return c.json({ ok: true, cashedAt: mult, won: win, balance: await getBal(id) });\n }\n return c.json({ ok: true, cashedAt: mult, won: 0, balance: await getBal(id) });\n});\n\n// --- Color Wheel: spin ---\napi.post(\"/games/wheel/spin\", async (c) => {\n const { initData, bet, sector } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const sectors = [\"alpha\", \"beta\", \"gamma\"];\n const payout: Record = { alpha: 2, beta: 2, gamma: 14 };\n if (!sectors.includes(sector)) return c.json({ ok: false, error: \"Invalid sector\" });\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n const rand = randomFloat(`${id}-${Date.now()}-${crypto.randomUUID()}`);\n // Gamma much rarer (14x)\n const weighted = rand < 0.45 ? \"alpha\" : rand < 0.9 ? \"beta\" : \"gamma\";\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"WHEEL_BET\");\n let won = 0;\n if (sector === weighted) {\n won = bet * payout[sector];\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [won, id] });\n await addTx(id, won, \"WHEEL_WIN\");\n }\n return c.json({ ok: true, winning: weighted, sector, won, balance: await getBal(id) });\n});\n\n// --- Match Predictor ---\napi.get(\"/games/matches\", (c) => {\n const teams = [\n [\"⚡ Thunder FC\", \"🔥 Blaze United\"], [\"🚀 Rockets\", \"🛡️ Guardians\"],\n [\"🐺 Wolves\", \"🦅 Eagles\"], [\"🏴☠️ Pirates\", \"⚓ Sailors\"],\n ];\n return c.json({ ok: true, matches: teams.map((t, i) => ({\n id: `M${i + 1}`, home: t[0], away: t[1], time: `${(18 + i) % 24}:00`,\n })) });\n});\n\napi.post(\"/games/matches/predict\", async (c) => {\n const { initData, bet, matchId, outcome } = await c.req.json();\n const user = validateInitData(initData);\n if (!user) return c.json({ ok: false, error: \"Unauthorized\" }, 401);\n const id = String(user.id);\n const bal = await getBal(id);\n if (!bet || bet <= 0 || bet > bal) return c.json({ ok: false, error: \"Insufficient balance\" });\n if (![\"home\", \"draw\", \"away\"].includes(outcome)) return c.json({ ok: false, error: \"Invalid outcome\" });\n const rand = randomFloat(`${id}-${matchId}-${Date.now()}`);\n const result = [\"home\", \"draw\", \"away\"][Math.floor(rand * 3)];\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance - ? WHERE telegram_id = ?\", args: [bet, id] });\n await addTx(id, -bet, \"MATCH_BET\");\n let won = 0;\n if (outcome === result) {\n won = bet * (outcome === \"draw\" ? 3.4 : 2.1);\n await sqlite.execute({ sql: \"UPDATE users SET balance = balance + ? WHERE telegram_id = ?\", args: [won, id] });\n await addTx(id, won, \"MATCH_WIN\");\n }\n return c.json({ ok: true, result, outcome, won, balance: await getBal(id) });\n});\n\n// --- Admin tools: create promo, user search, balance manage ---\napi.post(\"/admin/promo\", async (c) => {\n const { initData, code, reward, maxActivations } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n await sqlite.execute({\n sql: \"INSERT OR REPLACE INTO promo_codes (code, reward_amount, max_activations, current_activations) VALUES (?, ?, ?, 0)\",\n args: [String(code).toUpperCase(), Number(reward), Number(maxActivations)],\n });\n return c.json({ ok: true });\n});\n\napi.post(\"/admin/set-balance\", async (c) => {\n const { initData, telegram_id, balance } = await c.req.json();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n await sqlite.execute({\n sql: \"INSERT INTO users (telegram_id, username) VALUES (?, 'admin-set') ON CONFLICT(telegram_id) DO UPDATE SET balance = ?\",\n args: [String(telegram_id), Number(balance)],\n });\n return c.json({ ok: true, balance: await getBal(String(telegram_id)) });\n});\n\napi.get(\"/admin/search\", async (c) => {\n const { initData, q } = c.req.query();\n const user = validateInitData(initData);\n if (!user || !isAdmin(String(user.id))) return c.json({ ok: false, error: \"Forbidden\" }, 403);\n const rows = (await sqlite.execute({\n sql: \"SELECT telegram_id, username, balance, created_at FROM users WHERE telegram_id LIKE ? OR username LIKE ? LIMIT 20\",\n args: [`%${q}%`, `%${q}%`],\n })).rows;\n return c.json({ ok: true, users: rows });\n});\n\n// --- Transactions / wallet ---\napi.get(\"/transactions\", async (c) => {\n const uid = c.req.header(\"x-user-id\");\n if (!uid) return c.json({ ok: false });\n const rows = (await sqlite.execute({\n sql: \"SELECT * FROM transactions WHERE user_id = ? ORDER BY created_at DESC, id DESC LIMIT 50\",\n args: [uid],\n })).rows;\n return c.json({ ok: true, transactions: rows });\n});\n\n// ============================================================\n// Serve frontend & wire up\n// ============================================================\nimport { serveImmutableFile, parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Root } from \"./frontend/root.tsx\";\n\napp.route(\"/api\", api);\n\napp.get(\"/\", (c) => c.html());\n\n// Immutable client assets (the React app) — cached forever per version\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.onError((e) => {\n console.error(e);\n return new Response(JSON.stringify({ ok: false, error: String(e?.message ?? e) }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" },\n });\n});\n\nawait initDB();\n\nexport default app.fetch;\n","label","tma-arcade-42",[135],"108e9e21-3c78-4425-8a48-5613ee06cf86",["D",1788481099791],[33],"089974ac-38d2-4229-a80f-99f69c4fd242","frontend","79c00869-def6-4521-ae23-0b5506863e1b",4,["D",1788481003461],"directory",[150],"pulls","branches",1,"forks","envVars",{"_164":152,"_166":66},"connections",{"_164":66,"_165":66},"count","unfilledCount","emptyCount",{"_46":149,"_37":150,"_35":151,"_136":-5,"_44":45,"_43":152,"_138":62,"_41":195,"_13":66,"_38":154,"_39":-5,"_29":30,"_143":-5,"_173":196,"_32":197},{"_46":187,"_37":188,"_35":189,"_136":151,"_44":45,"_43":190,"_138":62,"_41":191,"_13":66,"_38":183,"_39":192,"_29":30,"_143":-5,"_173":193,"_32":194},{"_46":179,"_37":180,"_35":181,"_136":151,"_44":45,"_43":152,"_138":62,"_41":182,"_13":66,"_38":183,"_39":184,"_29":30,"_143":-5,"_173":185,"_32":186},{"_46":146,"_37":33,"_35":36,"_136":-5,"_44":45,"_43":14,"_138":62,"_41":176,"_13":66,"_38":26,"_39":40,"_29":30,"_143":-5,"_173":177,"_32":178},{"_46":134,"_37":135,"_35":60,"_136":-5,"_44":45,"_43":137,"_138":62,"_41":172,"_13":140,"_38":141,"_39":142,"_29":30,"_143":144,"_173":174,"_32":175},["D",1788481056993],"children",[],[135],["D",1788481099791],[],[33],"74e193eb-737e-40d9-a0f6-d9a157c620fb","root.tsx","e8808b48-a7f5-11f1-974a-1607ee4eb77e",["D",1788481003461],"script","/**\n * @jsxImportSource https://esm.sh/hono@4/jsx\n *\n * HTML shell for the client-side React app. Served never-cached; it stamps the\n * entry module so the browser can cache the app immutably across versions.\n */\nimport type { FC } from \"https://esm.sh/hono@4/jsx\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\nexport const Root: FC = () => {\n const entry = immutableFileUrl(\"/frontend/index.tsx\");\n return (\n \n \n \n \n Arcade\n {/* Telegram Mini App script (loads window.Telegram.WebApp) */}\n

Diff · v9