`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_402":403,"_404":405},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_302":-5,"_20":303,"_22":304,"_305":306,"_307":308,"_26":309,"_24":310,"_311":-5,"_312":-5,"_313":55,"_314":315,"_316":46,"_317":-5,"_318":-5,"_319":320},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","raymondv","name","biljartcompetitie","branchName","main","version","path","server","project",{"_34":245,"_13":14,"_47":246,"_247":-5,"_248":55,"_249":250,"_251":250,"_252":253,"_254":-5,"_255":256,"_257":71,"_258":46,"_259":-5,"_260":-5,"_261":60,"_262":263,"_264":265,"_266":267,"_268":269,"_270":-5,"_271":272,"_273":272,"_274":275,"_276":275,"_277":275,"_278":272,"_279":272,"_280":281,"_282":283,"_284":285,"_286":55},"tree",[64,65,66,67,68],"file",{"_34":58,"_41":42,"_37":40,"_13":19,"_52":-5,"_50":59,"_17":60,"_39":-5,"_47":61,"_43":62,"_56":-5,"_18":63},"contents",[33],"upstream","pull","ahead","behind","envVars",{"_34":35,"_13":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":-5,"_18":57},"id","f4173d65-31f6-41e4-8115-d1b9aaa8d44c","auth.ts","fileId","c7939788-b207-11f1-bb88-1607ee4eb77e","parentId","e248a8f6-c74f-4870-8d35-0fb26178f631","branchId","5ab58193-b7b9-4e57-9c70-3e9498f42f3b","branchVersion",59,"latest",true,"createdAt",["D",1789589115179],2,"fileType","script","content","// Server only. The verifier is supplied through encrypted Val Town environment settings.\nexport const COOKIE = \"__Host-bos-edit\";\nexport const SESSION_MS = 90 * 24 * 60 * 60 * 1000;\nexport const VISITOR_COOKIE = \"__Host-bos-visitor\";\nexport const VISITOR_SECONDS = 90 * 24 * 60 * 60;\nconst hex = (bytes: ArrayBuffer | Uint8Array) =>\n Array.from(\n new Uint8Array(bytes instanceof ArrayBuffer ? bytes : bytes.buffer),\n )\n .map((n) => n.toString(16).padStart(2, \"0\")).join(\"\");\nexport function token() {\n return hex(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport async function digest(value: string) {\n return hex(\n await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)),\n );\n}\nexport async function verifyPassword(password: unknown, verifier: string) {\n if (typeof password !== \"string\" || password.length > 256) return false;\n const [iterations, salt, expected] = verifier.split(\":\");\n if (\n iterations !== \"600000\" || !/^[a-f0-9]{32}$/.test(salt ?? \"\") ||\n !/^[a-f0-9]{64}$/.test(expected ?? \"\")\n ) return false;\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const actual = hex(\n await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n hash: \"SHA-256\",\n salt: new TextEncoder().encode(salt),\n iterations: 600000,\n },\n key,\n 256,\n ),\n );\n let diff = 0;\n for (let i = 0; i < expected.length; i++) {\n diff |= actual.charCodeAt(i) ^ expected.charCodeAt(i);\n }\n return diff === 0;\n}\nexport function sessionToken(req: Request, name = COOKIE) {\n const value = req.headers.get(\"cookie\")?.split(\";\").map((s) => s.trim())\n .find((s) => s.startsWith(name + \"=\"))?.slice(name.length + 1);\n return value && /^[a-f0-9]{64}$/.test(value) ? value : null;\n}\nexport function sessionCookie(value: string, name = COOKIE, seconds?: number) {\n return `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Strict${\n value ? (seconds ? `; Max-Age=${seconds}` : \"\") : \"; Max-Age=0\"\n }`;\n}\nexport function needsEditPassword(action: any) {\n return action?.type === \"deleteMatch\" ||\n (action?.type === \"match\" && !!action.match?.id);\n}\n","deleted",false,"label",[19,36],"a1499eba-25ed-41f8-9482-bd08ca144ab8","directory",0,["D",1789588190789],47,[19],{"_34":105,"_13":106,"_37":107,"_39":-5,"_41":42,"_43":93,"_45":46,"_47":108,"_17":60,"_50":59,"_52":-5,"_54":55,"_56":-5,"_78":109,"_18":110},{"_34":58,"_13":19,"_37":40,"_39":-5,"_41":42,"_43":62,"_45":46,"_47":98,"_17":60,"_50":59,"_52":-5,"_54":55,"_56":-5,"_78":99,"_18":100},{"_34":90,"_13":91,"_37":92,"_39":-5,"_41":42,"_43":93,"_45":46,"_47":94,"_17":60,"_50":24,"_52":95,"_54":55,"_56":-5,"_78":96,"_18":97},{"_34":81,"_13":82,"_37":83,"_39":-5,"_41":42,"_43":84,"_45":46,"_47":85,"_17":86,"_50":24,"_52":87,"_54":55,"_56":-5,"_78":88,"_18":89},{"_34":69,"_13":70,"_37":71,"_39":-5,"_41":42,"_43":72,"_45":46,"_47":73,"_17":74,"_50":75,"_52":76,"_54":55,"_56":77,"_78":79,"_18":80},"7d08e693-0634-483c-b8b3-3142f5539c5e","index.ts","01a0ab70-d5fe-737e-9de0-cce5a2b9f03c",60,["D",1789589116067],8,"http","import {\n parseVal,\n serveImmutableFile,\n} from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono@4\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { applyAction, displayState } from \"./frontend/logic.ts\";\nimport {\n digest,\n needsEditPassword,\n SESSION_MS,\n sessionCookie,\n sessionToken,\n token,\n verifyPassword,\n VISITOR_COOKIE,\n VISITOR_SECONDS,\n} from \"./server/auth.ts\";\nconst app = new Hono();\nasync function visitorSession(c: any) {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (!value) return false;\n const tokenHash = await digest(value);\n const r = await sqlite.execute({\n sql:\n \"SELECT credential_kind,credential_hash FROM visitor_sessions WHERE token_hash=? AND expires_at>?\",\n args: [tokenHash, Date.now()],\n });\n if (!r.rows.length) return false;\n const row = r.rows[0];\n const verifier = Deno.env.get(\n row.credential_kind === \"admin\"\n ? \"BOS_EDIT_PASSWORD_HASH\"\n : \"BOS_VISITOR_PASSWORD_HASH\",\n );\n if (!verifier || row.credential_hash !== await digest(verifier)) return false;\n if (c.req.path === \"/api/state\") {\n await sqlite.execute({\n sql: \"UPDATE visitor_sessions SET expires_at=? WHERE token_hash=?\",\n args: [Date.now() + VISITOR_SECONDS * 1000, tokenHash],\n });\n const adminVerifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n if (adminVerifier) {\n await sqlite.execute({\n sql:\n \"UPDATE edit_sessions SET expires_at=? WHERE token_hash=? AND credential_hash=? AND expires_at>?\",\n args: [\n Date.now() + SESSION_MS,\n tokenHash,\n await digest(adminVerifier),\n Date.now(),\n ],\n });\n }\n c.header(\n \"Set-Cookie\",\n sessionCookie(value, VISITOR_COOKIE, VISITOR_SECONDS),\n { append: true },\n );\n }\n return true;\n}\nasync function startVisitorSession(c: any, verifier: string, kind: string) {\n const value = token();\n await sqlite.batch([\n {\n sql: \"DELETE FROM visitor_sessions WHERE expires_at<=?\",\n args: [Date.now()],\n },\n {\n sql:\n \"INSERT INTO visitor_sessions(token_hash,credential_hash,credential_kind,expires_at) VALUES(?,?,?,?)\",\n args: [\n await digest(value),\n await digest(verifier),\n kind,\n Date.now() + VISITOR_SECONDS * 1000,\n ],\n },\n ], \"write\");\n c.header(\n \"Set-Cookie\",\n sessionCookie(value, VISITOR_COOKIE, VISITOR_SECONDS),\n { append: true },\n );\n return value;\n}\nasync function canEdit(req: Request) {\n const value = sessionToken(req, VISITOR_COOKIE),\n verifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n if (!value || !verifier) return false;\n const r = await sqlite.execute({\n sql:\n \"SELECT 1 FROM edit_sessions WHERE token_hash=? AND credential_hash=? AND expires_at>?\",\n args: [await digest(value), await digest(verifier), Date.now()],\n });\n return r.rows.length > 0;\n}\nasync function identity(req: Request) {\n const session = await getOAuthUserData(req);\n if (!session?.user) return { editor: false, owner: false, username: null };\n const r = await sqlite.execute({\n sql:\n \"SELECT role FROM admins WHERE user_id=? OR (user_id IS NULL AND lower(username)=lower(?))\",\n args: [session.user.id, session.user.username ?? \"\"],\n });\n return {\n editor: r.rows.length > 0,\n owner: r.rows.some((r) => r.role === \"owner\"),\n username: session.user.username,\n };\n}\nasync function current() {\n const r = await sqlite.execute(\n \"SELECT version,data FROM competition WHERE id=1\",\n );\n if (!r.rows.length) throw new Error(\"Competitie nog niet ingericht\");\n return {\n version: Number(r.rows[0].version),\n state: JSON.parse(String(r.rows[0].data)),\n };\n}\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n if (![\"GET\", \"HEAD\"].includes(c.req.method)) {\n if (\n c.req.header(\"Origin\") !== new URL(c.req.url).origin ||\n !c.req.header(\"Content-Type\")?.startsWith(\"application/json\")\n ) return c.json({ error: \"Ongeldige aanvraag.\" }, 403);\n }\n if (\n ![\n \"/api/login\",\n \"/api/logout\",\n \"/api/edit-session\",\n \"/api/edit-session/logout\",\n ].includes(c.req.path) && !await visitorSession(c)\n ) {\n return c.json({\n error: \"Vul het bezoekerswachtwoord in.\",\n code: \"VISITOR_PASSWORD_REQUIRED\",\n }, 401);\n }\n await next();\n});\napp.get(\"/api/state\", async (c) => {\n const data = await current(), user = await identity(c.req.raw);\n return c.json({\n ...data,\n state: displayState(data.state, user.editor),\n user,\n canEdit: await canEdit(c.req.raw),\n });\n});\napp.post(\"/api/login\", login);\napp.post(\"/api/edit-session\", login);\nasync function login(c: any) {\n const adminVerifier = Deno.env.get(\"BOS_EDIT_PASSWORD_HASH\");\n const visitorVerifier = Deno.env.get(\"BOS_VISITOR_PASSWORD_HASH\");\n if (!adminVerifier || !visitorVerifier) {\n return c.json({ error: \"Het wachtwoord is nog niet ingesteld.\" }, 503);\n }\n const raw = await c.req.text();\n if (raw.length > 2048) return c.json({ error: \"Aanvraag te groot.\" }, 413);\n let password;\n try {\n password = JSON.parse(raw).password;\n } catch {\n return c.json({ error: \"Ongeldige aanvraag.\" }, 400);\n }\n // Atomic, account-wide cap; never trust a client-supplied IP header.\n const bucket = Math.floor(Date.now() / (15 * 60 * 1000));\n const attempts = await sqlite.execute({\n sql:\n \"INSERT INTO edit_login_limits(bucket,attempts) VALUES(?,1) ON CONFLICT(bucket) DO UPDATE SET attempts=attempts+1 WHERE attempts<30 RETURNING attempts\",\n args: [bucket],\n });\n if (!attempts.rows.length) {\n c.header(\n \"Retry-After\",\n String(Math.ceil(((bucket + 1) * 900000 - Date.now()) / 1000)),\n );\n return c.json({\n error: \"Te veel pogingen. Probeer het over een kwartier opnieuw.\",\n }, 429);\n }\n const isAdmin = await verifyPassword(password, adminVerifier);\n const isVisitor = c.req.path === \"/api/login\" && !isAdmin &&\n await verifyPassword(password, visitorVerifier);\n if (!isAdmin && !isVisitor) {\n return c.json({ error: \"Het wachtwoord klopt niet.\" }, 401);\n }\n const verifier = isAdmin ? adminVerifier : visitorVerifier;\n const value = await startVisitorSession(\n c,\n verifier,\n isAdmin ? \"admin\" : \"visitor\",\n );\n if (!isAdmin) return c.json({ canEdit: false });\n await sqlite.batch([\n {\n sql: \"DELETE FROM edit_sessions WHERE expires_at<=?\",\n args: [Date.now()],\n },\n { sql: \"DELETE FROM edit_login_limits WHERE bucket {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM visitor_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM edit_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n c.header(\"Set-Cookie\", sessionCookie(\"\", VISITOR_COOKIE), { append: true });\n return c.json({ ok: true });\n});\napp.post(\"/api/edit-session/logout\", async (c) => {\n const value = sessionToken(c.req.raw, VISITOR_COOKIE);\n if (value) {\n await sqlite.execute({\n sql: \"DELETE FROM edit_sessions WHERE token_hash=?\",\n args: [await digest(value)],\n });\n }\n return c.json({ canEdit: false });\n});\napp.get(\"/api/history\", async (c) => {\n if (!(await identity(c.req.raw)).editor) {\n return c.json({ error: \"Log in als beheerder.\" }, 401);\n }\n const r = await sqlite.execute(\n \"SELECT id,version,actor,action,created_at FROM history ORDER BY id DESC LIMIT 150\",\n );\n return c.json(r.rows);\n});\napp.get(\"/api/export\", async (c) => {\n if (!(await identity(c.req.raw)).editor) {\n return c.json({ error: \"Log in als beheerder.\" }, 401);\n }\n const results = await sqlite.batch([{\n sql: \"SELECT version,data FROM competition WHERE id=1\",\n }, { sql: \"SELECT * FROM history ORDER BY id\" }], \"read\");\n return new Response(\n JSON.stringify(\n {\n format: \"biljartcompetitie-v1\",\n exportedAt: new Date().toISOString(),\n version: Number(results[0].rows[0].version),\n state: JSON.parse(String(results[0].rows[0].data)),\n history: results[1].rows,\n },\n null,\n 2,\n ),\n {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Content-Disposition\":\n 'attachment; filename=\"biljartcompetitie-backup.json\"',\n \"Cache-Control\": \"no-store\",\n },\n },\n );\n});\napp.get(\"/api/results.csv\", async (c) => {\n const { state: raw } = await current();\n const state = displayState(raw);\n const q = (s: any) =>\n '\"' + String(s).replace(/^([=+@-])/, \"'$1\").replaceAll('\"', '\"\"') + '\"';\n const name = (id: number) => state.players.find((p: any) => p.id === id).name;\n const lines = [\n [\n \"Demonstratie\",\n \"Datum\",\n \"Speler A\",\n \"Caramboles A\",\n \"Speler B\",\n \"Caramboles B\",\n ],\n ...state.matches.map((\n m: any,\n ) => [state.demo ? \"JA\" : \"NEE\", m.date, name(m.a), m.ca, name(m.b), m.cb]),\n ];\n return new Response(\n \"\\uFEFF\" + lines.map((r) => r.map(q).join(\";\")).join(\"\\r\\n\"),\n {\n headers: {\n \"Content-Type\": \"text/csv; charset=utf-8\",\n \"Content-Disposition\": 'attachment; filename=\"uitslagen.csv\"',\n },\n },\n );\n});\napp.post(\"/api/action\", async (c) => {\n const u = await identity(c.req.raw);\n if (Number(c.req.header(\"Content-Length\") ?? 0) > 10000) {\n return c.json({ error: \"Aanvraag te groot.\" }, 413);\n }\n const body = await c.req.json();\n if (needsEditPassword(body?.action) && !await canEdit(c.req.raw)) {\n return c.json({\n error: \"Vul het wachtwoord in om een partij te wijzigen of verwijderen.\",\n code: \"EDIT_PASSWORD_REQUIRED\",\n }, 401);\n }\n if (!u.editor && ![\"match\", \"deleteMatch\"].includes(body?.action?.type)) {\n return c.json({ error: \"Deze wijziging is alleen voor beheerders.\" }, 403);\n }\n const old = await current();\n if (!Number.isSafeInteger(body.version) || body.version !== old.version) {\n return c.json({\n error:\n \"Iemand heeft intussen gegevens gewijzigd. Vernieuw de pagina en voer je wijziging opnieuw in.\",\n }, 409);\n }\n let state;\n try {\n state = applyAction(old.state, body.action, u.owner);\n } catch (e) {\n return c.json({ error: e.message }, 400);\n }\n const r = await sqlite.execute({\n sql:\n \"UPDATE competition SET data=?,version=version+1,actor=?,action=? WHERE id=1 AND version=? RETURNING version\",\n args: [\n JSON.stringify(state),\n u.username ??\n (needsEditPassword(body.action)\n ? \"spelleider (wachtwoord)\"\n : \"openbare invoer\"),\n JSON.stringify(body.action),\n body.version,\n ],\n });\n if (!r.rows.length) {\n return c.json({\n error:\n \"Gelijktijdige wijziging. Vernieuw de pagina voordat je opnieuw opslaat.\",\n }, 409);\n }\n return c.json({\n state: displayState(state, u.editor),\n version: Number(r.rows[0].version),\n user: u,\n });\n});\napp.get(\"/api/admins\", async (c) => {\n if (!(await identity(c.req.raw)).owner) {\n return c.json({ error: \"Alleen de eigenaar.\" }, 403);\n }\n return c.json(\n (await sqlite.execute(\n \"SELECT username,role FROM admins ORDER BY role,username\",\n )).rows,\n );\n});\napp.post(\"/api/admins\", async (c) => {\n const u = await identity(c.req.raw);\n if (!u.owner) return c.json({ error: \"Alleen de eigenaar.\" }, 403);\n const b = await c.req.json();\n if (\n typeof b.username !== \"string\" || !/^[a-zA-Z0-9_-]{1,40}$/.test(b.username)\n ) {\n return c.json(\n { error: \"Vul een geldige Val Town-gebruikersnaam in.\" },\n 400,\n );\n }\n if (b.remove) {\n await sqlite.execute({\n sql:\n \"DELETE FROM admins WHERE lower(username)=lower(?) AND role='editor'\",\n args: [b.username],\n });\n } else {await sqlite.execute({\n sql:\n \"INSERT OR IGNORE INTO admins(username,role) VALUES(lower(?),'editor')\",\n args: [b.username],\n });}\n return c.json({ ok: true });\n});\napp.get(\"/\", (c) => {\n c.header(\"Cache-Control\", \"no-store\");\n return c.html(Root());\n});\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.onError((err) => {\n console.error(err);\n return Response.json({\n error:\n \"Opslaan of laden is niet gelukt. Probeer opnieuw; je invoer blijft staan.\",\n }, { status: 500 });\n});\nexport default oauthMiddleware(app.fetch);\n","bos","children",[],[70],"eb5daa04-66b8-439f-ba01-4b49fd912161","README.md","01a0ab70-d5fe-737e-9de0-cbc1b6eaafd1",46,["D",1789587970208],4,"# Biljartcompetitie\n\nApp: [Open de app](url:index.ts) — https://bos.val.run/ Val:\nhttps://www.val.town/x/raymondv/biljartcompetitie\n\n## Actuele richting: eenvoudig mobiel ontwerp\n\nDe homepage toont nu de tussenstand en daaronder alle partijen, nieuwste datum\neerst. **Nieuwe partij** is voor iedereen klikbaar: kies jezelf, kies een nog\nbeschikbare tegenstander, vul beide scores en de datum in. Vandaag is vooraf\ningevuld.\n\nDit is bewust een frontendprototype: toevoegen past uitsluitend de tijdelijke\nbrowserweergave aan. Vernieuwen herstelt de online stand. Er worden geen\nopenbare wijzigingen naar de database geschreven. Formulieren, login en beheer\nzijn uit de nieuwe voorkant gehaald; de eerdere serverfuncties zijn behouden\nvoor later.\n\nVormgeving: `frontend/style.css`. Invoer: `frontend/components/PartyForm.tsx`.\nLokale voorbeeldserver: `node tests/preview-server.ts` (poort 4173), met een\nkopie van de getranspileerde clientmodules in `preview/`. Testdata blijven\nlokaal.\n\nDe onderstaande beschrijving documenteert de eerdere versie en backend.\n\n## Eerdere versie: gebruik\n\n- Bezoekers zien standen, uitslagen, nog mogelijke tegenstanders en\n weekformulieren.\n- Alle openbare namen zijn unieke afkortingen van 4 letters; bij botsingen 5\n letters en zo nodig een deelnemersnummer. Volledige namen worden uitsluitend\n aan ingelogde beheerders geleverd.\n- Log in met Val Town. De eigenaar beheert de toegang van spelleiders via hun\n exacte Val Town-gebruikersnaam. Een gratis account volstaat.\n- De app start als demonstratie met 60 fictieve uitslagen uit het aangeleverde\n Excelbestand. De eigenaar kan via Beheer expliciet een lege echte competitie\n starten. Startmoyennes zijn onbekend en worden niet verzonnen.\n- De 16 deelnemers kunnen hernoemd worden en hebben bewerkbare startmoyennes.\n Naamscorrecties gelden ook voor eerdere uitslagen; een persoon vervangen\n midden in een seizoen vereist aparte migratie.\n- Elke speler heeft 20 beurten. Winst 2 punten, gelijk 1, verlies 0. Sortering:\n punten, actueel moyenne, bij volledige gelijkstand oorspronkelijke\n deelnemersvolgorde. Geen handicapberekening.\n- Download wekelijks de JSON-back-up onder Beheer. Deze bevat de volledige stand\n en alle wijzigingsmomenten. CSV bevat uitslagen met afkortingen. Geen\n automatische externe back-up ingesteld.\n- Print: Weekformulier, kies actueel of blanco. A4 staand, 100%, browserkop- en\n voetteksten uit. Het blanco formulier toont geen uitslagstatus of actuele\n punten.\n\n## Techniek en onderhoud\n\nReact 18.2, Hono en Val Town SQLite (`std/sqlite/main.ts`, val-scoped). Geen\nbetaald extern systeem, geen persoonlijke cloudschijven.\n\n- `index.ts`: API, OAuth-rollencontrole, CSRF-controle, export en\n frontend-routes.\n- `frontend/logic.ts`: spelregels, validatie en afkortingen.\n- `frontend/components/App.tsx`: navigatie en schermen.\n- `frontend/components/Forms.tsx`: uitslagformulier, stand, deelnemersbeheer.\n- `frontend/components/WeekForm.tsx` en `frontend/print.css`: A4-formulieren.\n- `frontend/root.tsx`: HTML-shell en versiegebonden assets.\n\nDatabase:\n\n- `competition`: één JSON-document met spelers/uitslagen en een integer\n `version`.\n- `history`: SQLite-trigger bewaart elke wijziging atomair met oude/nieuwe\n stand, actor en actie.\n- `admins`: eigenaar op onveranderlijk Val Town-user-ID; spelleiders op\n toegekende gebruikersnaam.\n- `access_check`: lege tabel voor toegangstests.\n\nUpdates gebruiken `WHERE version = ?` plus `RETURNING`; een verouderde update\ngeeft HTTP 409. Servervalidatie weigert ontbrekende scores,\nnegatieve/breuk-scores, ongeldige datums, dezelfde speler en dubbele paren in\nbeide richtingen.\n\nCodex kan via de Val Town-plugin code en de val-database onderhouden. Namen en\nuitslagen staan in de database, niet in de publieke broncode. Publiceer geen\nlokale `data/` of back-upbestanden als broncode.\n\nHerstel door Codex: valideer een JSON-back-up, exporteer eerst de huidige stand,\nvoer daarna een parametergebonden update van `competition` uit met\nversiecontrole, hogere versie en herstelactie. De trigger bewaart de eerdere\nstand. Verwijder de geschiedenis niet stilzwijgend.\n",[],[82],"acbbe75b-ff67-4cfd-b38a-7945edc6d22a","CHANGELOG.md","01a0ab70-d5fe-737e-9de0-c50f1a113208",1,["D",1789582693703],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n