[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_166":167,"_168":169},"routes/_app.x.$handle.$name",{"_106":105,"_39":52,"_115":96,"_33":60,"_13":14,"_116":-5,"_11":117,"_118":119,"_120":121,"_122":123,"_124":125,"_26":-5,"_126":-5,"_127":-5,"_128":31,"_129":130,"_131":65,"_132":-5,"_133":-5,"_134":135},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_50":51,"_39":52,"_45":53,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":38,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":89,"_90":91,"_92":93,"_94":31},"version",3,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","f3e4cee0-41c9-43cc-bb8c-adf81858d67e","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":36},"file",{"_37":38,"_39":34,"_40":44,"_42":43,"_45":46,"_47":14,"_48":49,"_30":31},"previous",{"_37":38,"_39":34,"_40":41,"_42":43},"deleted",false,"deletedHere","path","main.ts","latestPath","habit-garden.ts","fileId","ecd1ee8a-83ab-11f1-b2dc-1607ee4eb77e","name","fileType","script","content","/**\n * Habit Garden — Verify Loop MVP\n * -------------------------------\n * Paste this whole file into a new HTTP val on val.town, deploy it,\n * then share the URL with a friend like:\n *\n * https://yourname-habitgarden.val.run/?me=You&key=YOUR_SECRET\n * https://yourname-habitgarden.val.run/?me=Friend&key=YOUR_SECRET\n *\n * How it works:\n * - Anyone can create a goal, naming a friend as the verifier.\n * - The creator \"submits\" proof (a photo, taken/selected on their phone or laptop).\n * - The verifier opens /verify?me=TheirName, sees the photo, taps Verify or Reject.\n * - Every verified goal adds one flower to the single shared garden.\n *\n * SHARED SECRET SETUP (do this before sharing the link):\n * 1. On val.town, open this val → sidebar → Environment Variables.\n * 2. Add a variable named APP_SECRET with any password-like value you pick.\n * 3. Every URL you share must include &key=that-same-value, or requests\n * are rejected with 401. Links inside the app carry the key forward\n * automatically once you're in.\n * 4. If you don't set APP_SECRET at all, the key check is skipped —\n * handy for your first local test, but do set it before sending\n * the link to friends.\n *\n * No accounts, no passwords per-person — identity is just a name in the\n * URL, gated by one shared secret for the whole group. That's intentional\n * for a friends-only test. Don't use this for anything where someone\n * impersonating a specific friend's name (once they have the group's key)\n * would matter.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst TABLE = \"habit_garden_goals_v1\";\n\nasync function ensureTable() {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${TABLE} (\n id TEXT PRIMARY KEY,\n creator TEXT NOT NULL,\n verifier TEXT NOT NULL,\n description TEXT NOT NULL,\n status TEXT NOT NULL DEFAULT 'pending',\n photo_data TEXT,\n created_at TEXT NOT NULL,\n verified_at TEXT\n )\n `);\n}\n\nfunction uid() {\n return crypto.randomUUID();\n}\n\n// Builds a \"?me=...&key=...\" query string, used everywhere a link or form\n// action needs to carry identity + the shared secret forward.\nfunction qs(me: string, key: string) {\n const params = new URLSearchParams({ me });\n if (key) params.set(\"key\", key);\n return `?${params.toString()}`;\n}\n\nfunction escapeHtml(s: string) {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction page(title: string, body: string) {\n return `\n\n\n\n\n${escapeHtml(title)}\n\n\n\n${body}\n\n`;\n}\n\nfunction flowerFor(index: number) {\n const flowers = [\"🌸\", \"🌼\", \"🌻\", \"🌷\", \"🌺\"];\n return flowers[index % flowers.length];\n}\n\nasync function renderGarden() {\n const verified = await sqlite.execute(\n `SELECT id FROM ${TABLE} WHERE status = 'verified' ORDER BY verified_at ASC`,\n );\n const count = verified.rows.length;\n const plots = Array.from(\n { length: 16 },\n (_, i) =>\n i < count\n ? `

${flowerFor(i)}

`\n : `

`,\n ).join(\"\");\n const overflow = count > 16\n ? `

+${count - 16} more flowers beyond the plot

`\n : \"\";\n return `\n

Shared Garden

${plots}

\n ${overflow}\n

\n `;\n}\n\nfunction nav(me: string, key: string, activePath: string) {\n const q = qs(me, key);\n return `\n \n `;\n}\n\nasync function renderHome(me: string, key: string) {\n const goals = await sqlite.execute(\n `SELECT * FROM ${TABLE} WHERE creator = ? ORDER BY created_at DESC`,\n [me],\n );\n\n const goalRows = goals.rows.length\n ? goals.rows\n .map((g: any) => {\n const canSubmitProof = g.status === \"pending\";\n return `\n

${escapeHtml(g.description)}

verifier: ${escapeHtml(g.verifier)}

\n ${g.status}\n ${\n canSubmitProof\n ? ``\n : \"\"\n }\n

`;\n })\n .join(\"\")\n : `

No goals yet — create one below.

`;\n\n return page(\n \"Habit Garden\",\n `\n

🌱 Habit Garden

Signed in as ${\n escapeHtml(me)\n }

\n ${nav(me, key, \"/\")}\n\n

New goal

\n \n

\n\n

Your goals

\n ${goalRows}\n

\n\n ${await renderGarden()}\n `,\n );\n}\n\nasync function renderVerify(me: string, key: string) {\n const pending = await sqlite.execute(\n `SELECT * FROM ${TABLE} WHERE verifier = ? AND status = 'submitted' ORDER BY created_at ASC`,\n [me],\n );\n\n const rows = pending.rows.length\n ? pending.rows\n .map(\n (g: any) => `\n

${escapeHtml(g.creator)} — ${\n escapeHtml(g.description)\n }

\n ${\n g.photo_data\n ? `

`\n : `

No photo attached

`\n }\n

\n \n \n

`,\n )\n .join(\"\")\n : `

Nothing waiting on you right now.

`;\n\n return page(\n \"Verify\",\n `\n

🌱 Habit Garden

Signed in as ${\n escapeHtml(me)\n }

\n ${nav(me, key, \"/verify\")}\n

Pending your verification

\n ${rows}\n `,\n );\n}\n\nasync function fileToDataUrl(file: File): Promise {\n const buf = await file.arrayBuffer();\n const bytes = new Uint8Array(buf);\n let binary = \"\";\n for (let i = 0; i < bytes.length; i++) {\n binary += String.fromCharCode(bytes[i]);\n }\n const base64 = btoa(binary);\n return `data:${file.type};base64,${base64}`;\n}\n\nexport default async function (req: Request): Promise {\n await ensureTable();\n const url = new URL(req.url);\n const path = url.pathname;\n const me = (url.searchParams.get(\"me\") || \"\").trim();\n const key = (url.searchParams.get(\"key\") || \"\").trim();\n\n // --- Shared secret check ---\n // If APP_SECRET is set as an environment variable on this val, every\n // request must include a matching ?key=... or it's rejected. If\n // APP_SECRET isn't set, the check is skipped (useful for your very\n // first local test, but set it before sharing the link with friends).\n const requiredSecret = Deno.env.get(\"APP_SECRET\");\n if (requiredSecret && key !== requiredSecret) {\n return new Response(\n page(\n \"Locked\",\n `

🔒 Locked

This link needs a valid key. Ask whoever set up the app for the shared link.

`,\n ),\n { status: 401, headers: { \"content-type\": \"text/html\" } },\n );\n }\n\n // --- Pages ---\n if (path === \"/\" && req.method === \"GET\") {\n if (!me) {\n return new Response(\n page(\n \"Habit Garden\",\n `

🌱 Habit Garden

Open this link with your name, e.g. ?me=Sahana

\n `,\n ),\n { headers: { \"content-type\": \"text/html\" } },\n );\n }\n return new Response(await renderHome(me, key), {\n headers: { \"content-type\": \"text/html\" },\n });\n }\n\n if (path === \"/verify\" && req.method === \"GET\") {\n if (!me) return Response.redirect(url.origin + \"/\" + qs(\"\", key), 302);\n return new Response(await renderVerify(me, key), {\n headers: { \"content-type\": \"text/html\" },\n });\n }\n\n // --- API: create goal ---\n if (path === \"/api/goals\" && req.method === \"POST\") {\n const form = await req.formData();\n const description = String(form.get(\"description\") || \"\").trim();\n const verifier = String(form.get(\"verifier\") || \"\").trim();\n if (!description || !verifier || !me) {\n return new Response(\"Missing fields\", { status: 400 });\n }\n await sqlite.execute(\n `INSERT INTO ${TABLE} (id, creator, verifier, description, status, created_at)\n VALUES (?, ?, ?, ?, 'pending', ?)`,\n [uid(), me, verifier, description, new Date().toISOString()],\n );\n return Response.redirect(url.origin + \"/\" + qs(me, key), 303);\n }\n\n // --- API: submit proof photo ---\n const proofMatch = path.match(/^\\/api\\/goals\\/([\\w-]+)\\/proof$/);\n if (proofMatch && req.method === \"POST\") {\n const goalId = proofMatch[1];\n const form = await req.formData();\n const file = form.get(\"photo\") as File | null;\n\n // Only the creator of this specific goal should be able to submit proof for it.\n const existing = await sqlite.execute(\n `SELECT * FROM ${TABLE} WHERE id = ?`,\n [goalId],\n );\n const goal = existing.rows[0] as any;\n if (!goal || goal.creator !== me) {\n return new Response(\"Not authorized to submit proof for this goal\", {\n status: 403,\n });\n }\n\n let photoData: string | null = null;\n if (file && file.size > 0) {\n photoData = await fileToDataUrl(file);\n }\n\n await sqlite.execute(\n `UPDATE ${TABLE} SET status = 'submitted', photo_data = ? WHERE id = ?`,\n [photoData, goalId],\n );\n return Response.redirect(url.origin + \"/\" + qs(me, key), 303);\n }\n\n // --- API: verify/reject ---\n const verifyMatch = path.match(/^\\/api\\/goals\\/([\\w-]+)\\/verify$/);\n if (verifyMatch && req.method === \"POST\") {\n const goalId = verifyMatch[1];\n const form = await req.formData();\n const decision = String(form.get(\"decision\") || \"\");\n\n const existing = await sqlite.execute(\n `SELECT * FROM ${TABLE} WHERE id = ?`,\n [goalId],\n );\n const goal = existing.rows[0] as any;\n if (!goal || goal.verifier !== me) {\n return new Response(\"Not authorized to verify this goal\", {\n status: 403,\n });\n }\n if (goal.status !== \"submitted\") {\n return new Response(\"Goal is not awaiting verification\", { status: 400 });\n }\n\n const newStatus = decision === \"approve\" ? \"verified\" : \"rejected\";\n await sqlite.execute(\n `UPDATE ${TABLE} SET status = ?, verified_at = ? WHERE id = ?`,\n [newStatus, new Date().toISOString(), goalId],\n );\n return Response.redirect(url.origin + \"/verify\" + qs(me, key), 303);\n }\n\n return new Response(\"Not found\", { status: 404 });\n}","http","createdAt",["D",1784491971082],"branchVersion","branchId","efe493e9-1375-40d5-b64b-21a7897524dc","id","b82a2490-3698-48ab-891d-4350bbac0100","sahana",["D",1784490986084],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","3bdcfd42-ff69-4074-adab-66c464655abd","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f7bf1-7aaa-775b-94a7-41c5a0aea91d","tursoName","b82a2490369848ab891d4350bbac0100","tursoHostname","b82a2490369848ab891d4350bbac0100-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789559472742],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_106":105,"_114":110},"org",{"_106":105,"_107":108,"_109":110,"_19":62,"_111":112,"_113":31},"branch",{"_13":95,"_39":96,"_50":49,"_97":51,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":52,"_104":105},"isOwned",40,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sahanasbrmnym","handle","displayName","Sahana Subramanyam","avatar","https://avatars.githubusercontent.com/u/41452026?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_50":51,"_39":52,"_45":161,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":38,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":73,"_74":75,"_76":162,"_78":-5,"_79":80,"_81":80,"_82":83,"_84":83,"_85":83,"_86":80,"_87":80,"_88":163,"_90":164,"_92":165,"_94":31},"tree",[156],"files",[156],"counts",{"_145":69,"_146":147,"_148":69,"_149":150,"_151":152},"contents",[136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_50":137,"_39":34,"_37":38,"_138":-5,"_48":49,"_47":14,"_139":31,"_45":140,"_13":141,"_40":44,"_42":43,"_30":31,"_142":143,"_33":144},"db6bd88e-64a8-42dc-82a5-6a10b3fe4740","parentId","latest",["D",1784491971082],2,"label","habitgarden",[34],"pulls","branches",1,"forks","envVars",{"_153":147,"_155":69},"connections",{"_153":69,"_154":69},"count","unfilledCount","emptyCount",{"_50":137,"_39":34,"_37":38,"_138":-5,"_48":49,"_47":14,"_139":31,"_45":157,"_13":141,"_40":44,"_42":43,"_30":31,"_142":143,"_158":159,"_33":160},["D",1784491971082],"children",[],[34],["D",1784490986084],["D",1789559472742],{"_106":105,"_114":110},{"_106":105,"_107":108,"_109":110,"_19":62,"_111":112,"_113":31},{"_13":95,"_39":96,"_50":49,"_97":51,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":52,"_104":105},"ctx",{"_88":-5,"_133":199,"_200":201,"_202":203,"_204":31,"_205":31,"_206":31,"_207":65,"_208":-5,"_209":-7,"_210":-7,"_211":69,"_212":31,"_213":31,"_214":-5,"_215":31,"_216":31,"_217":31,"_218":-5},"ENV",{"_170":171,"_172":173,"_174":96,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3