blob: ad7af0c605a72fc3aad0925bdf3e139fa09d5483 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
|
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<!-- `interactive-widget=resizes-content`: on Android the soft keyboard
shrinks the visual viewport and leaves the layout viewport alone, which
is the platform default. `position: sticky` anchors to the layout
viewport, so with a keyboard up the pinned header of a group or of
Search sits at a coordinate the reader can no longer see — it reads as
though it had scrolled away. This asks for the keyboard to resize the
layout viewport instead, so what is pinned stays where it is looked at.
Ignored by browsers that do not know it. -->
<meta name="viewport" content="width=device-width, initial-scale=1, interactive-widget=resizes-content">
<title>MeshBay</title>
<!--
The interface is loaded from this package, never from the hub. That is the
whole point of the application existing (T3): a hub that ships the code can
lift keys from the page whatever the protocol does.
The Content-Security-Policy is NOT here. It is sent as a header by the
protocol handler in src/main.js, because `frame-ancestors` is ignored in a
<meta> element — a policy with a directive that silently does nothing is
worse than one without it. One source, and every directive effective.
-->
<link rel="stylesheet" href="./style.css">
</head>
<body>
<div id="app"></div>
<script src="./vendor/argon2.min.js"></script>
<script src="./keyderive.js"></script>
<script src="./crypto.js"></script>
<script src="./transport.js"></script>
<script type="module" src="./app.js"></script>
</body>
</html>
|