`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_419":420,"_421":422},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_108":89,"_26":103,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",18,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","backend/auth.ts","latestPath","fileId","9c9d2db8-afbf-11f1-acfa-1607ee4eb77e","name","auth.ts","fileType","script","content","import type { MiddlewareHandler } from \"npm:hono\";\nimport { countLoginFails, recordLoginFail } from \"./db.ts\";\n\nconst FAIL_WINDOW_MS = 15 * 60 * 1000;\nconst MAX_FAILS_PER_IP = 5;\nconst MAX_FAILS_TOTAL = 30;\n\nfunction timingSafeEqual(a: string, b: string) {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n// Adding and hiding events needs the PIN; the phone sends it in a header after the first entry\nexport const requirePin: MiddlewareHandler = async (c, next) => {\n const expected = Deno.env.get(\"ADD_PIN\")?.trim();\n if (!expected) return c.json({ error: \"Dodawanie jest wyłączone (brak ADD_PIN).\" }, 503);\n\n const ip = c.req.header(\"x-forwarded-for\")?.split(\",\")[0].trim() || \"unknown\";\n const fails = await countLoginFails(ip, Date.now() - FAIL_WINDOW_MS);\n if (fails.mine >= MAX_FAILS_PER_IP || fails.total >= MAX_FAILS_TOTAL) {\n return c.json({ error: \"Za dużo nieudanych prób. Spróbuj za 15 minut.\" }, 429);\n }\n\n const pin = c.req.header(\"x-pin\")?.trim() ?? \"\";\n if (!timingSafeEqual(pin, expected)) {\n await recordLoginFail(ip);\n return c.json({ error: \"Nieprawidłowy PIN.\", pin: true }, 401);\n }\n await next();\n};\n","createdAt",["D",1789337292623],"branchVersion","branchId","255405a6-055f-4761-b8d5-94d1ffe681e3","id","25f66c95-84fd-4431-a007-b1f4e010323a","co-w-zamosciu",["D",1789336184443],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Co dziś w Zamościu i na Roztoczu — koncerty, kino, wydarzenia","imageUrl","5dd5cdfa-b36a-42e1-a911-81ba86e3b64c","pinnedFileId","01a09cbf-66da-7600-85d1-7a5d4b41e0de","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09aab-d118-725d-b44f-c12d328bfdc6","tursoName","25f66c9584fd4431a007b1f4e010323a","tursoHostname","25f66c9584fd4431a007b1f4e010323a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789519256886],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":54,"_104":105,"_106":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",150,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","dominik1","handle","displayName","Dominik","avatar","","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_31":44,"_37":414,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":415,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":416,"_83":417,"_85":418,"_87":24},"tree",[200,214,216,223,225,227,228,229],"files",[200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229],"counts",{"_189":62,"_190":140,"_191":62,"_192":193,"_194":195},"contents",[129,130,131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":183,"_31":184,"_29":185,"_139":-5,"_40":41,"_39":186,"_141":58,"_37":187,"_13":62,"_33":164,"_35":-5,"_23":24,"_145":-5,"_26":188},{"_42":177,"_31":178,"_29":179,"_139":-5,"_40":41,"_39":180,"_141":58,"_37":181,"_13":62,"_33":164,"_35":-5,"_23":24,"_145":-5,"_26":182},{"_42":172,"_31":173,"_29":174,"_139":-5,"_40":41,"_39":140,"_141":58,"_37":175,"_13":62,"_33":164,"_35":-5,"_23":24,"_145":-5,"_26":176},{"_42":166,"_31":167,"_29":168,"_139":-5,"_40":41,"_39":169,"_141":58,"_37":170,"_13":62,"_33":164,"_35":-5,"_23":24,"_145":-5,"_26":171},{"_42":159,"_31":160,"_29":161,"_139":-5,"_40":41,"_39":162,"_141":58,"_37":163,"_13":62,"_33":164,"_35":-5,"_23":24,"_145":-5,"_26":165},{"_42":153,"_31":154,"_29":155,"_139":-5,"_40":41,"_39":140,"_141":58,"_37":156,"_13":62,"_33":20,"_35":157,"_23":24,"_145":-5,"_26":158},{"_42":147,"_31":148,"_29":149,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":150,"_13":62,"_33":20,"_35":151,"_23":24,"_145":-5,"_26":152},{"_42":137,"_31":138,"_29":56,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":142,"_13":62,"_33":143,"_35":144,"_23":24,"_145":44,"_26":146},"c32ff9f8-6fbb-4039-be8e-8daae2d99007","index.ts","parentId",1,"latest",["D",1789336184443],"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Serve the (never-cached) HTML shell at the root /\napp.get(\"/\", (c) => c.html(Root()));\n\n// Serve frontend files at the version-addressed URLs Root() stamps, cached immutably\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Add your API routes here\n// app.get(\"/api/data\", c => c.json({ hello: \"world\" }));\n\n// Unwrap and rethrow Hono errors as the original error\n// If you delete this, all errors will be \"Internal Server Error\"\napp.onError((err) => Promise.reject(err));\n\n// HTTP vals expect an exported \"fetch handler\"\n// This is how you \"run the server\" in Val Town with Hono\nexport default app.fetch;\n","label",[138],"6f9cf8c5-cc6d-47ba-b106-6d7e24b7f39b","README.md","01a09cbf-66da-7600-85d1-77f7ef9c20ff",["D",1789336184443],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[148],"42cea312-1aaf-4642-b2da-e3bba05e69b9","CHANGELOG.md","01a09cbf-66da-7600-85d1-72302458f448",["D",1789336184443],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v18