[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","mokudeli","name","h153plants","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","663e25e7-7d3b-48f4-9f78-7d683081b608","main.ts","fileId","a0126bfe-88c6-11f1-a82c-1607ee4eb77e","parentId","branchId","08160583-a9b4-48a2-b214-85013afee77a","branchVersion",10,"latest",true,"createdAt",["D",1785613046122],9,"fileType","http","content","/**\n * Plant checklist — deploy-once shell.\n *\n * You paste this ONE time. After that the page content is pushed over HTTP and\n * this code never needs to change again.\n *\n * Setup:\n * 1. val.town -> New -> HTTP val, paste this whole file, save\n * 2. In the val's settings sidebar, add an environment variable:\n * name: PLANT_SECRET\n * value: any passphrase you like\n * Then make any trivial edit and save again — Val Town only picks up new\n * env vars on redeploy, so a fresh variable is invisible to a running instance.\n * 3. Send me the *.val.run URL and the passphrase. I push the page from there on.\n *\n * Routes\n * GET / -> the stored page (or a setup notice if nothing pushed yet)\n * GET /state?week= -> this week's checkmarks\n * POST /state -> {week,id,checked,by} or {week,reset:true}\n * GET /content -> {configured,version,bytes,at} (metadata only, no secret needed)\n * POST /content -> {secret,html} replaces the page, bumps version\n *\n * Why the secret lives in an env var: on Val Town's free tier new vals are\n * PUBLIC, so anything hardcoded here is readable by anyone. Env vars are not —\n * others can see that the variable is referenced, never its value.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst CHECKS = \"plant_check_v1\";\nconst PAGES = \"plant_page_v1\";\nconst MAX_BYTES = 2_000_000;\n\nlet ready: Promise | null = null;\nfunction init() {\n ready ??= (async () => {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS ${CHECKS} (\n id TEXT PRIMARY KEY,\n week TEXT NOT NULL,\n who TEXT,\n at INTEGER\n )`,\n );\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS ${PAGES} (\n id TEXT PRIMARY KEY,\n html TEXT NOT NULL,\n version INTEGER NOT NULL,\n at INTEGER NOT NULL\n )`,\n );\n })();\n return ready;\n}\n\nconst json = (body: unknown, status = 200) =>\n new Response(JSON.stringify(body), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Cache-Control\": \"no-store\",\n },\n });\n\nconst html = (body: string, status = 200) =>\n new Response(body, {\n status,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n\n/** Hash both sides before comparing so the check doesn't leak length or prefix by timing. */\nasync function sha(s: string): Promise {\n const buf = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(s),\n );\n return Array.from(new Uint8Array(buf)).map((b) =>\n b.toString(16).padStart(2, \"0\")\n ).join(\"\");\n}\n\nasync function readWeek(week: string) {\n const res = await sqlite.execute({\n sql: `SELECT id, who, at FROM ${CHECKS} WHERE week = ?`,\n args: [week],\n });\n const done: Record = {};\n for (const row of res.rows as unknown[][]) {\n done[String(row[0])] = {\n by: String(row[1] ?? \"\"),\n at: Number(row[2] ?? 0),\n };\n }\n return { week, done };\n}\n\nasync function storedPage(): Promise<\n { html: string; version: number; at: number } | null\n> {\n const res = await sqlite.execute({\n sql: `SELECT html, version, at FROM ${PAGES} WHERE id = 'current'`,\n args: [],\n });\n const row = (res.rows as unknown[][])[0];\n if (!row) return null;\n return { html: String(row[0]), version: Number(row[1]), at: Number(row[2]) };\n}\n\nconst SETUP_NOTICE = `\n\n\nPlant checklist — not configured\n

Shell is live — no page pushed yet

The server half is running. It just hasn't been given any content.

Add an environment variable PLANT_SECRET in this val's settings sidebar.
Make any trivial edit and save, so the running instance picks the variable up.
Send Claude this URL and the passphrase — the checklist gets pushed here.

Checkmark storage is already working; only the page is missing.

`;\n\nexport default async function (req: Request): Promise {\n await init();\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\");\n\n // ---------------- content: metadata (public) ----------------\n if (path.endsWith(\"/content\") && req.method === \"GET\") {\n const cur = await storedPage();\n return json({\n configured: !!cur,\n version: cur?.version ?? 0,\n bytes: cur?.html.length ?? 0,\n at: cur?.at ?? 0,\n secretSet: !!Deno.env.get(\"PLANT_SECRET\"),\n });\n }\n\n // ---------------- content: replace the page ----------------\n if (path.endsWith(\"/content\") && req.method === \"POST\") {\n const secret = Deno.env.get(\"PLANT_SECRET\");\n if (!secret) {\n return json({\n error:\n \"PLANT_SECRET is not set on this running instance. Add it in the val's settings sidebar, \" +\n \"then make any trivial code edit and save — env vars only reach a val on redeploy.\",\n }, 503);\n }\n\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"malformed request body\" }, 400);\n }\n\n const given = typeof body?.secret === \"string\" ? body.secret : \"\";\n if (!given || (await sha(given)) !== (await sha(secret))) {\n return json({ error: \"bad secret\" }, 401);\n }\n\n const page = typeof body?.html === \"string\" ? body.html : \"\";\n if (!page) return json({ error: \"missing html\" }, 400);\n if (page.length > MAX_BYTES) {\n return json({\n error: \"page too large\",\n bytes: page.length,\n max: MAX_BYTES,\n }, 413);\n }\n\n await sqlite.execute({\n sql:\n `INSERT INTO ${PAGES} (id, html, version, at) VALUES ('current', ?, 1, ?)\n ON CONFLICT(id) DO UPDATE SET html = excluded.html,\n version = ${PAGES}.version + 1,\n at = excluded.at`,\n args: [page, Math.floor(Date.now() / 1000)],\n });\n\n const cur = await storedPage();\n return json({ ok: true, version: cur?.version ?? 1, bytes: page.length });\n }\n\n // ---------------- checkmark state ----------------\n if (path.endsWith(\"/state\")) {\n if (req.method === \"GET\") {\n const week = url.searchParams.get(\"week\") ?? \"\";\n if (!week) return json({ week: \"\", done: {} });\n // Sweep finished weeks so the table never grows without bound.\n await sqlite.execute({\n sql: `DELETE FROM ${CHECKS} WHERE week <> ?`,\n args: [week],\n });\n return json(await readWeek(week));\n }\n\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"malformed request body\" }, 400);\n }\n\n const week = typeof body?.week === \"string\" ? body.week : \"\";\n if (!week) return json({ error: \"missing week\" }, 400);\n\n if (body?.reset) {\n await sqlite.execute({\n sql: `DELETE FROM ${CHECKS} WHERE week = ?`,\n args: [week],\n });\n return json(await readWeek(week));\n }\n\n if (typeof body?.id === \"string\" && body.id) {\n const id = body.id.slice(0, 96);\n if (body.checked) {\n const who = String(body.by ?? \"\").trim().slice(0, 24);\n await sqlite.execute({\n sql: `INSERT INTO ${CHECKS} (id, week, who, at) VALUES (?, ?, ?, ?)\n ON CONFLICT(id) DO UPDATE SET week = excluded.week,\n who = excluded.who,\n at = excluded.at`,\n args: [id, week, who, Math.floor(Date.now() / 1000)],\n });\n } else {\n await sqlite.execute({\n sql: `DELETE FROM ${CHECKS} WHERE id = ?`,\n args: [id],\n });\n }\n }\n\n return json(await readWeek(week));\n }\n\n return json({ error: \"method not allowed\" }, 405);\n }\n\n // ---------------- everything else is the page ----------------\n const cur = await storedPage();\n return html(cur ? cur.html : SETUP_NOTICE, cur ? 200 : 503);\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1785613046122],"children",[],[35],"7c1df035-a884-4a1c-b1a1-b584e44e440e",["D",1785052209002],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","plants","imageUrl","userId","5fdf5b52-4bb0-4792-b85d-eb84870504ab","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f9d62-bf04-748a-a37b-1956d775cfeb","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_109":12,"_110":111,"_71":72,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/1e788f7e-ed80-40f9-c984-228c00f83200/square512?exp=1789577999&sig=fdd144d5fde4a04cb84b22b76ed3997df0c507bd4aea486f3497a219b79a5d4f","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":149,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":150,"_96":151,"_98":152,"_100":53},[146],"files",[146],"counts",{"_136":78,"_137":138,"_139":78,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":135},[35],"pulls","branches",1,"forks",{"_143":138,"_145":78},"connections",{"_143":78,"_144":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":147,"_18":148},[],[35],["D",1785052209002],{"_11":12,"_115":111},{"_11":12,"_109":12,"_110":111,"_71":72,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_101":61,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_131":186,"_187":188,"_189":190,"_191":53,"_192":53,"_193":53,"_194":44,"_195":-5,"_196":-7,"_197":-7,"_198":78,"_199":53,"_200":53,"_201":-5,"_202":53,"_203":53,"_204":53,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":16,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code