[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_240":241,"_242":243},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_108":89,"_26":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":24,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",5,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","lib/auth.ts","latestPath","fileId","fdeef546-afbb-11f1-85b6-1607ee4eb77e","name","auth.ts","fileType","script","content","import type { Context, Next } from \"npm:hono@4\";\nimport { deleteCookie, getCookie, setCookie } from \"npm:hono@4/cookie\";\n\nconst COOKIE = \"nj_admin\";\nconst MAX_AGE = 60 * 60 * 24 * 7;\nconst enc = new TextEncoder();\n\nfunction secret() {\n const s = Deno.env.get(\"SESSION_SECRET\");\n if (!s) throw new Error(\"SESSION_SECRET is not set\");\n return s;\n}\n\nasync function hmac(msg: string) {\n const key = await crypto.subtle.importKey(\"raw\", enc.encode(secret()), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\n \"sign\",\n ]);\n const sig = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, enc.encode(msg)));\n return btoa(String.fromCharCode(...sig)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction safeEqual(a: string, b: string) {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nexport async function checkPassword(password: string) {\n const real = Deno.env.get(\"ADMIN_PASSWORD\");\n if (!real) return false;\n return safeEqual(await hmac(\"pw:\" + password), await hmac(\"pw:\" + real));\n}\n\nexport async function startSession(c: Context) {\n const exp = Math.floor(Date.now() / 1000) + MAX_AGE;\n setCookie(c, COOKIE, `${exp}.${await hmac(\"admin.\" + exp)}`, {\n httpOnly: true,\n secure: true,\n sameSite: \"Strict\",\n path: \"/\",\n maxAge: MAX_AGE,\n });\n}\n\nexport function endSession(c: Context) {\n deleteCookie(c, COOKIE, { path: \"/\" });\n}\n\nasync function isAdmin(c: Context) {\n const value = getCookie(c, COOKIE);\n if (!value) return false;\n const [exp, sig] = value.split(\".\");\n if (!exp || !sig || Number(exp) < Date.now() / 1000) return false;\n return safeEqual(sig, await hmac(\"admin.\" + exp));\n}\n\nexport async function requireAdmin(c: Context, next: Next) {\n if (!(await isAdmin(c))) return c.redirect(\"/admin/login\");\n if (c.req.method !== \"GET\") {\n const origin = c.req.header(\"origin\");\n if (origin && new URL(origin).host !== new URL(c.req.url).host) return c.text(\"forbidden\", 403);\n }\n await next();\n}\n\nexport const clientIp = (c: Context) =>\n (c.req.header(\"x-forwarded-for\") ?? \"\").split(\",\")[0].trim() || \"unknown\";\n","createdAt",["D",1789335737912],"branchVersion","branchId","2fb3b93c-3153-49cc-928f-ccd798836746","id","d8f07974-33ec-460f-a8b5-8a56ac73d9bd","najla-makeup",["D",1789334949320],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","موقع نجلاء الغفيلي ميك اب ارتست — خدمات ونظام حجوزات","imageUrl","cca8102f-07bb-4295-b44a-38d66d1d3405","pinnedFileId","01a09cac-8e2f-7716-b801-b7ea38740c6d","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f1d6e-b169-7628-a2c5-3fdc2bb2972f","tursoName","d8f0797433ec460fa8b58a56ac73d9bd","tursoHostname","d8f0797433ec460fa8b58a56ac73d9bd-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789519256886],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":54,"_104":105,"_106":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",52,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","asnfq50","handle","displayName","mfcbr4krn8-hash","avatar","https://avatars.githubusercontent.com/u/294484094?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":235,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":236,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":237,"_83":238,"_85":239,"_87":24},"tree",[171,176,179,180],"files",[171,172,173,174,175,176,177,178,179,180],"counts",{"_161":62,"_162":137,"_163":62,"_164":165,"_166":167},"contents",[130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":155,"_31":156,"_29":157,"_136":-5,"_40":41,"_39":158,"_138":58,"_37":159,"_13":62,"_33":153,"_35":-5,"_23":24,"_142":-5,"_26":160},{"_42":150,"_31":49,"_29":151,"_136":-5,"_40":41,"_39":137,"_138":58,"_37":152,"_13":62,"_33":153,"_35":-5,"_23":24,"_142":-5,"_26":154},{"_42":144,"_31":145,"_29":146,"_136":-5,"_40":41,"_39":137,"_138":24,"_37":147,"_13":62,"_33":20,"_35":148,"_23":24,"_142":-5,"_26":149},{"_42":134,"_31":135,"_29":56,"_136":-5,"_40":41,"_39":137,"_138":24,"_37":139,"_13":62,"_33":140,"_35":141,"_23":24,"_142":44,"_26":143},"226f6750-65c1-493c-a6db-5287f0367dc2","index.tsx","parentId",1,"latest",["D",1789334949320],"http","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\n\n// In-memory state. Resets whenever the server restarts.\n// For persistence across restarts, use std/sqlite or std/blob.\nlet count = 0;\n\nconst Layout = ({ title, children }: { title: string; children: any }) => (\n \n \n {title}\n \n \n \n \n \n \n \n {children}\n \n \n);\n\nconst app = new Hono();\n\napp.get(\"/\", (c) =>\n c.html(\n \n

Hello from Hono JSX

\n A minimal Val Town starter.{\" \"}\n \n Remix this val.\n \n

\n Server count:{\" \"}\n {count}\n

\n \n Increment\n \n

\n Lives in memory on the server. Resets when the val restarts.\n

\n \n ,\n ));\n\napp.get(\"/about\", (c) =>\n c.html(\n \n

About

Server-rendered with Hono JSX on Val Town.

\n ,\n ));\n\n// API routes\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n\n// Serve static files\napp.get(\"/public/*\", (c) => serveFile(c.req.path));\n\n// View source on Val Town\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;","label",[135],"3045bc29-8ad5-46f0-9f97-5a77966bb223","README.md","01a09cac-8e2f-7716-b801-b39afe182f45",["D",1789334949320],"# hono-jsx-starter\n\nA minimal [Hono](https://hono.dev) + Hono JSX starter for Val Town.\nServer-rendered HTML, no build step, no React.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| **[`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter)** *(you're here)* | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| [`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter) | Client-side React SPA with a Hono API backend. |\n\n## What's here\n\n```\nindex.tsx Hono app, Layout, routes\npublic/\n favicon.svg Static asset\n counter.ts Tiny client-side script\n```\n\nThe whole app fits in one file. As you grow it, the natural next moves are:\n\n- Pull `Layout` into its own `.tsx` file once you have 3+ pages.\n- Split routes with `app.route(\"/api\", api)` if `/api/*` grows.\n- Add more files under `public/` — they're served by a single\n `app.get(\"/public/*\", ...)` route.\n\n## Patterns worth knowing\n\n**JSX pragma.** Every `.tsx` file that uses JSX needs this at the top:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\n```\n\n**Server state.** The counter on `/` is `let count = 0` at module scope. It\nlives in memory on the Val Town server and survives across requests — but resets\nwhenever the val restarts (deploys, idle timeouts, etc.). For persistent state,\nswap it for [`std/sqlite`](https://www.val.town/x/std/sqlite) or\n[`std/blob`](https://www.val.town/x/std/blob).\n\n**API routes.** The `Increment` button POSTs to `/api/increment`, which returns\nJSON. Mix server-rendered pages and JSON endpoints in the same Hono app:\n\n```ts\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n```\n\n**Static files.** `serveFile` reads the file by path and serves it with the\nright content-type. `.ts` files are transpiled to JS on request by Val Town — so\nyou can write `public/counter.ts` and reference it as\n`

Diff · v5