`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_254":255,"_256":257},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_110":91,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":-5,"_123":-5,"_124":25,"_125":126,"_127":60,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",26,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","frontend/index.tsx","latestPath","fileId","01a09189-5663-7486-bd31-5b379d348565","name","index.tsx","fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { App } from \"./components/App.tsx\";\n\nconst root = document.getElementById(\"root\");\nif (!root) {\n throw new Error(\"No root element found\");\n}\n\ncreateRoot(root).render();","/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client\";\nimport { App } from \"./components/App.tsx\";\nimport { PatternGate } from \"./components/PatternGate.tsx\";\n\nconst root = document.getElementById(\"root\");\nif (!root) {\n throw new Error(\"No root element found\");\n}\n\ncreateRoot(root).render(\n \n \n ,\n);","createdAt",["D",1789149866404],"branchVersion","branchId","35ff6f46-dcdc-4cd7-a4a5-2561eb24a897","id","3632ee8b-d3b0-4a9d-b80b-ecc4536ce5a6","sami-tech-retours",["D",1789148091907],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Scanner mobile pour valider les retours Ecotrack","imageUrl","d1a4e165-322f-4bea-a472-a3bfe065b80a","pinnedFileId","01a09189-5663-7486-bd31-6d54914632cb","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04a3a-ab09-722d-b08e-d53e0c46d95a","tursoName","3632ee8bd3b04a9db80becc4536ce5a6","tursoHostname","3632ee8bd3b04a9db80becc4536ce5a6-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789495880338],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",105,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","emller","handle","displayName","E. Müller","avatar","https://lh3.googleusercontent.com/a/ACg8ocLJnTmCFn0ipeSgvNaIC4rYdYukPA7khbo2Fye1VgNbr6ozzQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":249,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":250,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":251,"_85":252,"_87":253,"_89":25},"tree",[176,184,185,186],"files",[176,177,178,179,180,181,182,183,184,185,186],"counts",{"_166":64,"_167":150,"_168":64,"_169":170,"_171":172},"contents",[132,133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":163,"_13":64,"_34":164,"_36":-5,"_24":25,"_145":-5,"_27":165},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":157,"_13":64,"_34":20,"_36":158,"_24":25,"_145":-5,"_27":159},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":151,"_13":64,"_34":20,"_36":152,"_24":25,"_145":-5,"_27":153},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":25,"_39":141,"_13":142,"_34":143,"_36":144,"_24":25,"_145":46,"_27":146},"29cb37dd-3728-412c-9f8b-43557a2f5cda","index.ts","parentId",24,"latest",["D",1789149831841],4,"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\n\nconst app = new Hono();\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_MS = 12 * 60 * 60 * 1000;\n\nfunction hex(bytes: Uint8Array) {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(size = 32) {\n return hex(crypto.getRandomValues(new Uint8Array(size)));\n}\n\nasync function sha256(value: string) {\n const data = new TextEncoder().encode(value);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return hex(new Uint8Array(digest));\n}\n\nfunction parseCookies(request: Request) {\n const raw = request.headers.get(\"cookie\") || \"\";\n const cookies: Record = {};\n for (const part of raw.split(\";\")) {\n const i = part.indexOf(\"=\");\n if (i <= 0) continue;\n cookies[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());\n }\n return cookies;\n}\n\nfunction validPattern(pattern: unknown) {\n if (!Array.isArray(pattern)) return false;\n if (pattern.length < 4 || pattern.length > 9) return false;\n if (!pattern.every((n) => Number.isInteger(n) && n >= 0 && n <= 8)) return false;\n return new Set(pattern).size === pattern.length;\n}\n\nasync function getPatternRecord() {\n const result = await sqlite.execute({\n sql: \"SELECT value FROM app_settings WHERE key = ? LIMIT 1\",\n args: [\"pattern_auth\"],\n });\n if (!result.rows.length) return null;\n try {\n return JSON.parse(String(result.rows[0].value));\n } catch {\n return null;\n }\n}\n\nasync function createSession() {\n const token = randomHex(32);\n const tokenHash = await sha256(token);\n const now = Date.now();\n const expiresAt = now + SESSION_MS;\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, expiresAt, now],\n });\n return { token, expiresAt };\n}\n\nasync function isAuthenticated(request: Request) {\n const token = parseCookies(request)[SESSION_COOKIE];\n if (!token) return false;\n const tokenHash = await sha256(token);\n const now = Date.now();\n const result = await sqlite.execute({\n sql: \"SELECT token_hash FROM app_sessions WHERE token_hash = ? AND expires_at > ? LIMIT 1\",\n args: [tokenHash, now],\n });\n return result.rows.length > 0;\n}\n\nfunction sessionCookie(token: string) {\n const maxAge = Math.floor(SESSION_MS / 1000);\n return `${SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Lax`;\n}\n\nfunction clearSessionCookie() {\n return `${SESSION_COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax`;\n}\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/health\", (c) => c.json({ ok: true }));\n\napp.get(\"/api/access/status\", async (c) => {\n const configured = Boolean(await getPatternRecord());\n const authenticated = configured ? await isAuthenticated(c.req.raw) : false;\n return c.json({ ok: true, configured, authenticated });\n});\n\napp.post(\"/api/access/setup\", async (c) => {\n if (await getPatternRecord()) {\n return c.json({ ok: false, message: \"Le schéma est déjà configuré.\" }, 409);\n }\n\n let body: any;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ ok: false, message: \"Requête invalide.\" }, 400);\n }\n\n if (!validPattern(body.pattern)) {\n return c.json({ ok: false, message: \"Le schéma doit relier au moins 4 points différents.\" }, 400);\n }\n\n const pattern = body.pattern.join(\"-\");\n const salt = randomHex(16);\n const hash = await sha256(`${salt}:${pattern}`);\n const value = JSON.stringify({ salt, hash });\n\n const insert = await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO app_settings (key, value) VALUES (?, ?)\",\n args: [\"pattern_auth\", value],\n });\n\n if (insert.rowsAffected === 0) {\n return c.json({ ok: false, message: \"Le schéma est déjà configuré.\" }, 409);\n }\n\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookie(session.token));\n return c.json({ ok: true, authenticated: true });\n});\n\napp.post(\"/api/access/unlock\", async (c) => {\n const record = await getPatternRecord();\n if (!record) {\n return c.json({ ok: false, code: \"NOT_CONFIGURED\", message: \"Aucun schéma configuré.\" }, 409);\n }\n\n let body: any;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ ok: false, message: \"Requête invalide.\" }, 400);\n }\n\n if (!validPattern(body.pattern)) {\n return c.json({ ok: false, message: \"Schéma incorrect.\" }, 401);\n }\n\n const candidate = await sha256(`${record.salt}:${body.pattern.join(\"-\")}`);\n if (candidate !== record.hash) {\n return c.json({ ok: false, message: \"Schéma incorrect.\" }, 401);\n }\n\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookie(session.token));\n return c.json({ ok: true, authenticated: true });\n});\n\napp.post(\"/api/access/logout\", async (c) => {\n const token = parseCookies(c.req.raw)[SESSION_COOKIE];\n if (token) {\n const tokenHash = await sha256(token);\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n }\n c.header(\"Set-Cookie\", clearSessionCookie());\n return c.json({ ok: true });\n});\n\napp.get(\"/api/config\", async (c) => {\n const authenticated = await isAuthenticated(c.req.raw);\n return c.json({ ok: true, integrationReady: false, authenticated });\n});\n\napp.post(\"/api/validate\", async (c) => {\n if (!(await isAuthenticated(c.req.raw))) {\n return c.json({ ok: false, code: \"LOCKED\", message: \"Application verrouillée.\" }, 401);\n }\n\n let payload: { tracking?: unknown };\n try {\n payload = await c.req.json();\n } catch {\n return c.json({ ok: false, message: \"Requête invalide.\" }, 400);\n }\n\n const tracking = String(payload.tracking ?? \"\").trim().toUpperCase();\n console.log(\"QR_TRACKING\", tracking);\n if (!/^[A-Z0-9_-]{6,64}$/.test(tracking)) {\n return c.json({ ok: false, message: \"Numéro de tracking invalide.\" }, 400);\n }\n\n return c.json(\n {\n ok: false,\n tracking,\n code: \"INTEGRATION_PENDING\",\n message: \"Le scan fonctionne. La connexion Ecotrack sécurisée reste à brancher.\",\n },\n 503,\n );\n});\n\napp.onError((err) => Promise.reject(err));\nexport default app.fetch;\n","label",[137],"a373e6a5-2b4c-4ec4-8183-faccde24322d","README.md","01a09189-5663-7486-bd31-6b2de115ed27",1,["D",1789148091907],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[148],"273ebb44-c518-4a33-a45f-2755ef99712f","CHANGELOG.md","01a09189-5663-7486-bd31-67a9b60befea",["D",1789148091907],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v26