`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_299":300,"_301":302},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_225":-5,"_20":226,"_22":227,"_228":229,"_230":231,"_26":232,"_24":233,"_234":-5,"_235":-5,"_236":64,"_237":238,"_239":59,"_240":-5,"_241":-5,"_242":243},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","marc1","name","in-good-company","branchName","main","version","path","README.md","project",{"_33":167,"_13":14,"_44":168,"_169":-5,"_170":64,"_171":172,"_173":172,"_174":175,"_176":-5,"_177":178,"_179":56,"_180":59,"_181":-5,"_182":-5,"_183":76,"_184":185,"_186":187,"_188":189,"_190":191,"_192":-5,"_193":194,"_195":194,"_196":197,"_198":197,"_199":197,"_200":194,"_201":194,"_202":203,"_204":205,"_206":207,"_208":64},"tree",[50,51,52,53],"file",{"_33":34,"_35":36,"_37":38,"_13":19,"_39":40,"_41":24,"_17":42,"_43":-5,"_44":45,"_46":47,"_48":-5,"_18":49},"contents",[],"upstream","pull","ahead","behind","envVars","id","6de8755a-34ec-43c6-bcd5-4ffa5bb7a443","branchId","486e705c-045f-4c65-82da-a04d3d617ab8","fileId","01a09cf0-34c2-729a-80d0-523a4f41590f","content","# In Good Company — Marc’s Singapore\n\nLive guide: https://marcs-singapore.val.run/\n\nA personal collection of Singapore recommendations, with an interactive map, friends’ original advice, a private notebook and shared comments.\n\n## What is live\n\n- 73 entries and 82 attributed recommendations from six personal emails.\n- 30 dining entries, 9 bars, 5 outings, 11 escapes, 13 shops and 5 practical tips.\n- 44 mapped entries: 34 in Singapore and 10 regional destinations. Entries at the same building share a marker with a place chooser.\n- Search, category/person/neighbourhood filters, map/list views, and responsive place details.\n- Val Town sign-in. Private saved/visited lists and notes are scoped to each account. Comments are visible to everyone with the guide link; their author or Marc can remove them. Marc can add places.\n- Recommendation data and user content live in the project’s SQLite database. There is no email account connection or inbox access in the deployed app.\n- Only Marc’s signed-in session receives original Gmail message links. Email addresses, signatures, contact details and unrelated conversations are not published.\n\nThe guide is publicly readable and requests no search-engine indexing, matching the existing launcher’s approach. Noindex is not an access restriction.\n\n## Hosting\n\nVal Town project: marc1/in-good-company\n\nHTTP entry: index.ts. Frontend assets use Val Town’s immutable versioned URLs. The /source route opens the project source. The Sites launcher’s Singapore card now opens the live guide; its other links remain as before.\n\nThe UI uses React 18.2, Twind, and Leaflet 1.9.4. SVG illustrations are decorative original drawings rather than venue photography. The map uses OpenStreetMap tiles with visible attribution. Account sessions use Val Town’s OAuth middleware; tokens never reach the client response.\n\n## Map and content notes\n\nThe map now has a definite responsive height, waits for layout before initializing and refreshes after resizing. This fixes the original zero-height container bug. Pins follow active filters and open the corresponding recommendation.\n\nLocations are approximate building, venue, park or destination points. Chains without a selected branch, online services, and ambiguous locations are left without guessed pins. The location note on each entry explains this; directions and venue websites remain available. Prices and planning tips are attributed to the original email, not presented as live menus or opening hours.\n\nA one-time, cached OpenStreetMap location lookup was performed using an identified client at no more than one request every 1.2 seconds. Geocoding is not called by website visitors. Any future use of the public Nominatim service must follow its [usage policy](https://operations.osmfoundation.org/policies/nominatim/): identify the app, cache responses, stay within the shared request limit, and do not use it for autocomplete.\n\n## Validation\n\n- The production page and data endpoint return HTTP 200; the launcher returns 200 and contains the new guide link.\n- Browser verification: map tiles and pins render; pin selection opens the correct place; search/category filtering updates pins; mobile map height is 358px at a 390px viewport without horizontal overflow; desktop map height is 673px.\n- Production rejects unauthenticated writes (401) and cross-origin writes (403). Client console has no errors. Server logs show only a dependency deprecation warning.\n- Local integration checks exercise the actual production handlers against a temporary SQLite database: private-note and notebook isolation, note removal, comment visibility and moderation, owner-only place creation, and input limits all pass. Platform OAuth is stubbed only in this local test.\n- The live sign-in link reaches the Val Town login page. Completing a signed-in browser session requires the account holder’s login and was not performed during deployment.\n\n## Local maintenance\n\nRun the local preview with node preview-server.cjs and open http://127.0.0.1:4317/. It is read-only and uses the local content/seed.json snapshot. Production user data is never written by this preview.\n\nRun node check-source.cjs for syntax checks and node check-backend.cjs for the integration checks described above. Both run locally; the latter uses a disposable in-memory database.\n\nThe content directory is a local import snapshot with private source references; do not upload it as a public asset or commit it to a public repository. The one-time build/refinement scripts document the import work and are not the production data store. Make future content changes through the app or explicitly scoped SQLite updates; do not rerun the initial seed over newer content.\n","fileType",1,"parentId","createdAt",["D",1789341639223],"branchVersion",10,"label",[19],{"_33":80,"_13":81,"_37":82,"_43":-5,"_35":36,"_46":42,"_58":59,"_44":83,"_17":76,"_41":84,"_39":-5,"_63":64,"_48":-5,"_66":85,"_18":86},{"_33":72,"_13":73,"_37":74,"_43":-5,"_35":36,"_46":42,"_58":59,"_44":75,"_17":76,"_41":24,"_39":77,"_63":64,"_48":-5,"_66":78,"_18":79},{"_33":34,"_13":19,"_37":38,"_43":-5,"_35":36,"_46":47,"_58":59,"_44":69,"_17":42,"_41":24,"_39":40,"_63":64,"_48":-5,"_66":70,"_18":71},{"_33":54,"_13":55,"_37":56,"_43":-5,"_35":36,"_46":57,"_58":59,"_44":60,"_17":42,"_41":61,"_39":62,"_63":64,"_48":65,"_66":67,"_18":68},"6e97bad7-8c89-4e07-b9d3-c73ce190618f","index.ts","01a09cf0-34c2-729a-80d0-57a4a755a616",8,"latest",true,["D",1789341158715],"http","import { Hono } from 'npm:hono@4';\nimport { parseVal, serveImmutableFile } from 'https://esm.town/v/std/utils/index.ts';\nimport { sqlite } from 'https://esm.town/v/std/sqlite/main.ts';\nimport { getOAuthUserData, oauthMiddleware } from 'https://esm.town/v/std/oauth/middleware.ts';\nimport { Root } from './frontend/root.tsx';\n\nconst OWNER = '09d0017f-b431-4bfe-98be-204d22547721';\nconst app = new Hono();\napp.use('*',async(c,next)=>{c.header('X-Robots-Tag','noindex, nofollow, noarchive, nosnippet');c.header('X-Content-Type-Options','nosniff');c.header('Referrer-Policy','strict-origin-when-cross-origin');await next();});\napp.get('/',c=>{c.header('Cache-Control','no-store');return c.html(Root());});\napp.get('/robots.txt',c=>c.text('User-agent: *\\nDisallow: /\\n'));\napp.get('/__immutable/*',c=>serveImmutableFile(c.req.path));\napp.get('/source',c=>c.redirect(parseVal().links.self.val));\napp.use('/api/*',async(c,next)=>{\n c.header('Cache-Control','private, no-store');\n if(!['GET','HEAD'].includes(c.req.method)){\n if(c.req.header('origin')!==new URL(c.req.url).origin || c.req.header('sec-fetch-site')==='cross-site')return c.json({error:'Please make this change from the guide itself.'},403);\n if(!c.req.header('content-type')?.startsWith('application/json'))return c.json({error:'Expected JSON.'},415);\n }\n const session=await getOAuthUserData(c.req.raw);\n c.set('viewer',session?.user ? {id:session.user.id,name:session.user.username||'Visitor',isOwner:session.user.id===OWNER}:null);\n if(c.req.method!=='GET'&&!c.get('viewer'))return c.json({error:'Sign in to save or comment.'},401);\n await next();\n});\napp.get('/api/bootstrap',async c=>{\n const viewer=c.get('viewer');\n const [ppl,loc,comments]=await Promise.all([\n sqlite.execute('SELECT body FROM people ORDER BY rowid'),\n sqlite.execute('SELECT body FROM places ORDER BY rowid'),\n sqlite.execute('SELECT id,place_id,user_id,author,text,created_at FROM comments WHERE deleted=0 ORDER BY created_at DESC LIMIT 1000')\n ]);\n const people=ppl.rows.map(r=>{const p=JSON.parse(String(r.body));if(!viewer?.isOwner)delete p.email;return p;});\n const places=loc.rows.map(r=>JSON.parse(String(r.body)));\n const statuses={},notes={},shared={};\n for(const r of comments.rows){(shared[String(r.place_id)]||=[]).push({id:r.id,author:r.author,text:r.text,date:r.created_at,canRemove:viewer?.isOwner||viewer?.id===r.user_id});}\n if(viewer){\n const [saved,privateNotes]=await Promise.all([\n sqlite.execute({sql:'SELECT place_id,status FROM notebook WHERE user_id=?',args:[viewer.id]}),\n sqlite.execute({sql:'SELECT id,place_id,text,created_at FROM private_notes WHERE user_id=? AND deleted=0 ORDER BY created_at',args:[viewer.id]})\n ]);\n for(const r of saved.rows)statuses[String(r.place_id)]=r.status;\n for(const r of privateNotes.rows)(notes[String(r.place_id)]||=[]).push({id:r.id,text:r.text,date:r.created_at});\n }\n return c.json({people,places,statuses,notes,comments:shared,user:viewer});\n});\nasync function body(c){\n const raw=await c.req.text();if(raw.length>6000)throw new Error('That entry is too long.');\n try{return JSON.parse(raw);}catch{throw new Error('Could not read this entry.');}\n}\nconst clean=(v,max)=>{if(typeof v!=='string'||!v.trim()||v.trim().length>max)throw new Error('Please enter text within the allowed length.');return v.trim();};\nasync function placeId(v){const id=clean(v,100);const p=await sqlite.execute({sql:'SELECT id FROM places WHERE id=?',args:[id]});if(!p.rows.length)throw new Error('This place is no longer in the guide.');return id;}\napp.post('/api/status',async c=>{\n const b=await body(c),id=await placeId(b.placeId),user=c.get('viewer');\n if(b.status!==null&&!['saved','visited'].includes(b.status))return c.json({error:'Unknown notebook status.'},400);\n if(b.status===null)await sqlite.execute({sql:'DELETE FROM notebook WHERE user_id=? AND place_id=?',args:[user.id,id]});\n else await sqlite.execute({sql:'INSERT INTO notebook(user_id,place_id,status) VALUES(?,?,?) ON CONFLICT(user_id,place_id) DO UPDATE SET status=excluded.status',args:[user.id,id,b.status]});\n return c.json({ok:true});\n});\napp.post('/api/notes',async c=>{\n const b=await body(c),id=await placeId(b.placeId),text=clean(b.text,2000);\n await sqlite.execute({sql:'INSERT INTO private_notes(id,user_id,place_id,text,created_at) VALUES(?,?,?,?,?)',args:[crypto.randomUUID(),c.get('viewer').id,id,text,new Date().toISOString()]});return c.json({ok:true});\n});\napp.post('/api/notes/remove',async c=>{\n const b=await body(c);await sqlite.execute({sql:'UPDATE private_notes SET deleted=1 WHERE id=? AND user_id=?',args:[clean(b.id,100),c.get('viewer').id]});return c.json({ok:true});\n});\napp.post('/api/comments',async c=>{\n const b=await body(c),id=await placeId(b.placeId),text=clean(b.text,2000),u=c.get('viewer');\n const recent=await sqlite.execute({sql:'SELECT count(*) AS n FROM comments WHERE user_id=? AND created_at>?',args:[u.id,new Date(Date.now()-60000).toISOString()]});\n if(Number(recent.rows[0].n)>=5)return c.json({error:'Give it a moment before adding another comment.'},429);\n await sqlite.execute({sql:'INSERT INTO comments(id,place_id,user_id,author,text,created_at) VALUES(?,?,?,?,?,?)',args:[crypto.randomUUID(),id,u.id,u.name,text,new Date().toISOString()]});return c.json({ok:true});\n});\napp.post('/api/comments/remove',async c=>{\n const b=await body(c),u=c.get('viewer');await sqlite.execute({sql:u.isOwner?'UPDATE comments SET deleted=1 WHERE id=?':'UPDATE comments SET deleted=1 WHERE id=? AND user_id=?',args:u.isOwner?[clean(b.id,100)]:[clean(b.id,100),u.id]});return c.json({ok:true});\n});\napp.post('/api/places',async c=>{\n const u=c.get('viewer');if(!u.isOwner)return c.json({error:'Only Marc can add places to this guide.'},403);\n const b=await body(c),name=clean(b.name,100),text=clean(b.note,2000),category=b.category;\n if(!['Eat','Drink','Explore','Escape','Shop','Essentials'].includes(category))return c.json({error:'Choose a category.'},400);\n const item={id:crypto.randomUUID(),name,category,area:typeof b.area==='string'&&b.area.trim()?clean(b.area,80):'To explore',setting:'Singapore',cuisine:'Marc’s discovery',price:null,lat:null,lng:null,art:category==='Drink'?'cocktail':category==='Escape'?'coast':category==='Explore'?'garden':'shophouse',tags:['Marc’s discovery'],summary:text,notes:[{person:'marc',quote:text}],locationNote:'Location to confirm · use Find on Maps'};\n await sqlite.execute({sql:'INSERT INTO places(id,body) VALUES(?,?)',args:[item.id,JSON.stringify(item)]});return c.json({ok:true,id:item.id});\n});\napp.onError((err,c)=>{const known=/allowed length|entry|no longer in the guide/.test(err.message);if(!known)console.error('Guide API error',err.message);return c.json({error:known?err.message:'The change could not be saved. Please try again.'},known?400:500);});\nexport default oauthMiddleware(app.fetch);\n\r\n","deleted",false,"marcs-singapore","children",[],[55],["D",1789341639223],[],[19],"70b7f9ca-25ae-4893-8dc3-0d3b6e8d5732","CHANGELOG.md","01a09cf0-34c2-729a-80d0-4da036befce7",["D",1789339382932],0,"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n