@lanes-sh/link 0.6.8 → 0.6.9

package/src/server/index.ts

@@ -4,12 +4,6 @@ import { capabilityIdForToolName } from '#server/mcp';
 import { ATTACHMENTS_PATH, stageAttachment } from './attachments.ts';
 import { allowedHostnamesFor, rebindingRefusal } from './rebinding.ts';
 import { ANY_ORIGIN, corsAware, type CorsPolicy } from './cors.ts';
-import {
-  DASHBOARD_PATH,
-  dashboardSessions,
-  handleDashboard,
-  servesDashboard,
-} from './dashboard.ts';
 import type { Generation } from './generation.ts';
 import type { Generations } from './generations.ts';
 import { callerKey, failedAuthLimiter, FAILED_AUTH_PER_MINUTE, tooManyAttempts } from './edge.ts';
@@ -56,15 +50,6 @@ export interface ServerOptions {
   readonly authorization?: AuthorizationSurface | undefined;
   /** Hostnames this endpoint answers to. See `./rebinding.ts`. */
   readonly allowedHostnames?: readonly string[] | undefined;
-  /**
-   * Serve the dashboard.
-   *
-   * Off unless asked for, and `serve()` withholds it anyway when the bind
-   * address is not loopback. `lanes link start` asks; `container.ts` does not.
-   * See `./dashboard.ts` for why a deployed instance has no browser-shaped door
-   * to put it behind.
-   */
-  readonly dashboard?: boolean | undefined;
 }
 
 type RefusalReason = Extract<AuthOutcome, { ok: false }>['reason'];
@@ -126,7 +111,6 @@ export interface RequestHandler {
 export function createRequestHandler(options: ServerOptions): RequestHandler {
   let probedAt = 0;
   const failedAuth = failedAuthLimiter();
-  const sessions = dashboardSessions();
 
   /**
    * Re-read the config because a call named a tool we do not serve.
@@ -186,19 +170,6 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
         });
       }
 
-      // Above the 404 gate and outside the bearer path below, because a
-      // top-level browser navigation carries no `Authorization` header — so it
-      // authenticates itself, against the same authenticator. Unset, this is
-      // never reached and `/dashboard` is a 404 like any other unknown path.
-      if (options.dashboard && url.pathname === DASHBOARD_PATH) {
-        return await handleDashboard(request, {
-          generations: options.generations,
-          authenticator: options.authenticator,
-          primary: options.primary,
-          sessions,
-        });
-      }
-
       if (
         url.pathname !== MCP_PATH &&
         url.pathname !== ATTACHMENTS_PATH &&
@@ -369,15 +340,14 @@ export function serve(options: ServeOptions): RunningServer {
   const allowedHostnames = options.allowedHostnames ?? allowedHostnamesFor(host, loopback);
 
   // Cross-origin access, and its absence, are decided here for the same reason
-  // `allowedHostnames` and `dashboard` are: they are all properties of what this
-  // is bound to. The two are mutually exclusive and the exclusion is the
-  // decision — see `./cors.ts`, and ADR-039.
+  // `allowedHostnames` is: both are properties of what this is bound to. The
+  // two are mutually exclusive and the exclusion is the decision — see
+  // `./cors.ts`, and ADR-039.
   const cors: CorsPolicy | undefined = loopback
     ? undefined
     : { allowedOrigins: primary.config.auth.allowed_origins ?? [ANY_ORIGIN] };
   const handler = createRequestHandler({
     ...options,
-    dashboard: servesDashboard(options.dashboard, loopback),
     ...(allowedHostnames ? { allowedHostnames } : {}),
   });
 

package/src/server/mcp/index.ts

@@ -28,7 +28,6 @@ export {
   visibleCapabilities,
   visibleToolCount,
   type BuildServerOptions,
-  type ConnectionState,
   type MergedCapability,
   type ProfileRuntime,
 } from './visibility.ts';

package/src/server/mcp/visibility.ts

@@ -20,20 +20,6 @@ import { allowedConnections } from '#policy';
  * still a leak.
  */
 
-/**
- * A connection's reconciled state, as much of it as a reader needs.
- *
- * Structural rather than the store's own `ConnectionRecord`: `server` does not
- * import `stores` (`src/architecture.test.ts`), and what a surface that reports
- * wants from a connection is its key and whether it is working — not the
- * timestamps and credential expiry the repository keeps behind it.
- */
-export interface ConnectionState {
-  readonly provider: string;
-  readonly id: string;
-  readonly status: string;
-}
-
 /** Everything one profile contributes to the endpoint. */
 export interface ProfileRuntime {
   readonly config: Config;
@@ -49,25 +35,6 @@ export interface ProfileRuntime {
    * how often to ask (ADR-014).
    */
   refreshSkills?(): Promise<void>;
-  /**
-   * Which target's adapters this profile was opened against.
-   *
-   * Not derivable from `config`: a target is *selected* per run, and the config
-   * only says which one is the default. Optional for the same reason the one
-   * below is — a runtime built to answer "what is visible" was never opened
-   * against anything.
-   */
-  readonly target?: string | undefined;
-  /**
-   * Reconciled connection state, for a surface that reports rather than
-   * dispatches.
-   *
-   * Optional exactly as `refreshSkills` is: only a served endpoint holds the
-   * state handle this reads through, and nothing on the dispatch path asks —
-   * a capability's visibility is decided by policy, not by whether the
-   * credential behind it currently works.
-   */
-  connections?(): Promise<readonly ConnectionState[]>;
 }
 
 export interface BuildServerOptions {

package/src/cli/commands/operate/dashboard.ts

@@ -1,107 +0,0 @@
-import { deploymentIdentity, endpointHealth, localUrl } from '../../endpoint-url.ts';
-import { defaultOpenBrowser } from '../../oauth.ts';
-import { announce, ok, print, style, warn } from '../../output.ts';
-import {
-  ensureProfileToken,
-  openRuntime,
-  resolveProfile,
-  type GlobalFlags,
-} from '../../runtime.ts';
-
-/**
- * `lanes link dashboard` — open the page this endpoint serves.
- *
- * The command exists because the page cannot be reached without it. A browser
- * navigating to `/dashboard` carries no `Authorization` header, so the token has
- * to arrive some other way, and the only place it already exists is the
- * credential store this command can read. It puts it in the URL once; the
- * endpoint exchanges it for a session cookie and redirects to a URL without it.
- *
- * Local only, deliberately. See `#server/dashboard.ts` — ADR-018 leaves a
- * deployed instance with no door a person at a browser can come through, and a
- * command that opened a loopback URL for a target that is not there would be
- * reporting success for a page nobody can load.
- */
-
-export interface DashboardFlags extends GlobalFlags {
-  /** Print the URL instead of opening it. */
-  readonly print?: boolean | undefined;
-}
-
-export async function dashboard(flags: DashboardFlags): Promise<void> {
-  // `resolveProfile` rather than `openRuntime`, and the order is the point.
-  // Opening a runtime opens that target's adapters, so a deployed target sends
-  // this command to Secret Manager and a bucket before it can say the one thing
-  // it needs to — that the dashboard is not there. The refusal below would
-  // still be correct and nobody would ever read it, because a storage 403
-  // arrives first. This is the seam `runtime.ts` documents `deploy` and
-  // `secrets push` stopping at, for the same reason.
-  const { resolution, config, target, resolved } = await resolveProfile(flags);
-  announce(resolution);
-
-  const deployed = deploymentIdentity(resolved?.declared.deploy);
-  if (deployed) {
-    throw new Error(
-      `Target "${target}" is deployed to ${deployed.platform}, and the dashboard is served only ` +
-        'by a local endpoint — a browser carries no bearer token, and Cloud Run\'s own gate ' +
-        'admits only a Google-signed identity token it cannot mint either (ADR-018).\n' +
-        `What a deployed target can answer: ` +
-        `lanes link status --profile ${resolution.profile} --target ${target}`,
-    );
-  }
-
-  const runtime = await openRuntime(flags);
-
-  try {
-    const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
-
-    const url = new URL(localUrl(runtime.config));
-    url.pathname = '/dashboard';
-    url.searchParams.set('k', token);
-    // Named rather than left to the endpoint's primary, so the page opens on
-    // the profile this command resolved and printed above.
-    url.searchParams.set('profile', runtime.resolution.profile);
-
-    // The page is served by a running endpoint or by nothing. Saying so here
-    // beats opening a browser at a connection error.
-    const live = await endpointHealth(localUrl(runtime.config), token);
-    if (!live) {
-      // Both flags on both lines. They read as correct without them only
-      // because they were written while a missing one still resolved to the
-      // workspace default; with nothing to fall back on (ADR-037) each is a
-      // paste that refuses, and this one is printed at the moment somebody is
-      // least able to guess what it wanted.
-      const where = `--profile ${runtime.resolution.profile} --target ${target}`;
-
-      print(warn(`nothing is serving this port — run: lanes link start ${where}`));
-      print(style.dim(`  then: lanes link dashboard ${where}`));
-      return;
-    }
-
-    if (!live.profiles.includes(runtime.resolution.profile)) {
-      // `start --only` serves one profile. The URL would 404 on the rest, which
-      // is honest but unhelpful without being told why.
-      print(
-        warn(
-          `the endpoint on this port serves ${live.profiles.join(', ')} — ` +
-            `not "${runtime.resolution.profile}"`,
-        ),
-      );
-      return;
-    }
-
-    if (flags.print) {
-      // Printed, not opened: for a terminal on a machine with no browser, and
-      // for anyone who would rather see what they are about to open. It carries
-      // the token, which is why it is behind a flag rather than always shown.
-      print(url.href);
-      return;
-    }
-
-    defaultOpenBrowser(url.href);
-    print(ok(`opened ${style.bold(`${url.origin}/dashboard`)}`));
-    print(style.dim('  the link carries a one-time key; the page swaps it for a session cookie.'));
-  } finally {
-    await runtime.close();
-  }
-}

package/src/cli/dashboard-page.ts

@@ -1,293 +0,0 @@
-import { PROVIDER_MANIFESTS } from '#providers/index.ts';
-import { planAll, type ProviderPlan } from '#providers/setup/plan.ts';
-import { PROVIDER_MARKS } from './provider-marks.ts';
-import { escapeHtml } from './brand.ts';
-import { shell } from './dashboard-shell.ts';
-
-/**
- * The dashboard — one page answering what `status`, `setup plan` and
- * `target list` answer between them.
- *
- * It renders and it does not act. Every state-changing thing on it is a command
- * to paste, for two reasons that are not the same. Connecting is ADR-005: the
- * consent belongs to whoever owns the browser, and the loopback listener that
- * receives the code is the CLI's. Everything else is ADR-007: config is written
- * from the control plane, and a page served by the endpoint is not it.
- *
- * So this is a reader, and the honest shape of a reader is a page that tells you
- * the line to run. What it saves is not typing — it is knowing which line.
- *
- * The design is `callback-page.ts`'s, because that is the product's page and
- * this is the same product: nothing painted (`color-scheme: light dark` over a
- * transparent background, correct in either mode with no theme switch), Lora on
- * the heading, and colour reserved for status rather than spent on emphasis.
- * What differs is the width — a card centred at 460px is right for one sentence
- * and wrong for four sections.
- */
-
-export interface DashboardConnection {
-  /** `provider.id`, the key everything else addresses this by. */
-  readonly key: string;
-  readonly provider: string;
-  readonly account: string;
-  /** What the operator calls it, where that is not just the account. */
-  readonly label?: string | undefined;
-  /** `active`, `unauthorized`, `disabled`, or `not reconciled`. */
-  readonly state: string;
-}
-
-export interface DashboardView {
-  /** The profile being rendered, which `?profile=` may have chosen. */
-  readonly profile: string;
-  /** Every profile this endpoint serves, for the switcher. */
-  readonly profiles: readonly string[];
-  /** The target whose adapters are open. */
-  readonly target: string;
-  /** Every target the profile declares, live or not. */
-  readonly targets: readonly string[];
-  readonly connections: readonly DashboardConnection[];
-  /** `oauth_apps` keys, so a profile with its own client is described as having one. */
-  readonly ownClients: readonly string[];
-}
-
-/**
- * Every command this page renders, built in one place.
- *
- * `--profile` and `--target` on all of them, unconditionally. The shell a line
- * is pasted into resolves both for itself — from `LANES_LINK_PROFILE` and
- * `LANES_LINK_TARGET`, or from the workspace default — and a page that shows
- * you one profile while handing you a command that silently acts on another is
- * worse than one that shows nothing. It is also the rule `resolveSelection`
- * already follows by refusing to guess.
- */
-function command(view: DashboardView, rest: string): string {
-  return `lanes link ${rest} --profile ${view.profile} --target ${view.target}`;
-}
-
-/**
- * A command, shown in full.
- *
- * Kept for the two places where the command *is* the label — the sign-in page
- * and the footer — because there is no provider name to carry it. Everywhere
- * else the line is on the button, not on the page; see `copyButton`.
- */
-function commandLine(line: string): string {
-  const text = escapeHtml(line);
-  return (
-    `<div class="cmd"><code>${text}</code>` +
-    `<button class="btn copy" type="button" data-copy="${text}" aria-label="Copy command">copy</button></div>`
-  );
-}
-
-/**
- * The command, on the button rather than beside it.
- *
- * What this trades away is worth naming: the line is no longer selectable by
- * hand, so a browser with no clipboard API leaves no way to get it. That is
- * narrower than it sounds — `navigator.clipboard` needs a secure context, and
- * `http://127.0.0.1` is one by definition, which is the only address this page
- * is ever served on. The `title` carries the text for anyone who wants to read
- * before pasting, and `lanes link setup plan` prints the same lines.
- */
-function copyButton(line: string, label: string): string {
-  const text = escapeHtml(line);
-  return (
-    `<button class="btn copy" type="button" data-copy="${text}" title="${text}" ` +
-    `aria-label="Copy the command that connects ${escapeHtml(label)}">copy</button>`
-  );
-}
-
-/**
- * The provider's mark, or letters standing in for one.
- *
- * `aria-hidden` on both: every caller puts the name beside it, and a screen
- * reader announcing "GitHub, GitHub" is worse than one announcing it once.
- *
- * The fallback takes the first letter of the family and two of the member,
- * because the plain two collapse a catalogue holding four `icloud_*` entries
- * and two `*_mcp` ones into a handful of identical marks — `ICA` and `ICO`
- * rather than `IC` twice.
- */
-function mark(id: string): string {
-  const path = PROVIDER_MARKS[id];
-  if (path) {
-    return (
-      '<svg class="glyph" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">' +
-      `<path d="${path}"/></svg>`
-    );
-  }
-
-  const [family, member] = id.split('_');
-  const letters = member ? `${family![0]}${member.slice(0, 2)}` : id.slice(0, 2);
-  return `<span class="glyph letters" aria-hidden="true">${escapeHtml(letters.toUpperCase())}</span>`;
-}
-
-/**
- * The state, as one of the design system's badge variants.
- *
- * "Gold for positive, neutral tokens otherwise" — so `active` is the only gold
- * one, and `unauthorized` is *neutral* rather than red. It is not an error: the
- * credential is absent from this target's store, which is a thing to do, and
- * `--destructive` is reserved for something having gone wrong. `disabled` is
- * quieter still, being a row that config no longer declares.
- */
-function statusPill(state: string): string {
-  const kind = state === 'active' ? 'positive' : state === 'disabled' ? 'quiet' : 'neutral';
-  return `<span class="pill ${kind}">${escapeHtml(state)}</span>`;
-}
-
-function connectionsSection(view: DashboardView): string {
-  if (view.connections.length === 0) {
-    return '<p class="empty">Nothing connected in this profile yet. Pick one below.</p>';
-  }
-
-  const rows = view.connections
-    .map((connection) => {
-      // A connection that is not active is one the reader can act on, and the
-      // action is the same `connect` that made it — re-running against an
-      // existing key repairs it rather than adding a second account. An active
-      // one has nothing to do, so it carries no button.
-      const repair =
-        connection.state === 'active'
-          ? ''
-          : copyButton(command(view, `connect ${connection.key}`), connection.key);
-
-      return (
-        '<div class="row">' +
-        mark(connection.provider) +
-        `<code class="key">${escapeHtml(connection.key)}</code>` +
-        statusPill(connection.state) +
-        // The label reads, the account hovers: the row is one line wide and the
-        // address is the longer of the two, so putting both in it wraps every
-        // row to make one of them legible.
-        `<span class="account"${
-          connection.label && connection.label !== connection.account
-            ? ` title="${escapeHtml(connection.account)}"`
-            : ''
-        }>${escapeHtml(connection.label ?? connection.account)}</span>` +
-        repair +
-        '</div>'
-      );
-    })
-    .join('\n');
-
-  return `<div class="rows">${rows}</div>`;
-}
-
-/**
- * One provider, one line: what it is called and the line that connects it.
- *
- * Everything else a card used to carry is gone — the description, whether it
- * opens a browser, who operates its OAuth client. None of it is lost: it is all
- * in `lanes link setup plan` and in the `setup_provider` capability, both of
- * which exist to answer "what does connecting this involve" at the length that
- * question deserves. This page answers a different one — what is there, and
- * what would I paste — and a paragraph per provider buried it.
- *
- * `plan.command` is built by the same `planFor` those two render, so the line
- * copied here and the line an agent suggests cannot drift.
- */
-function providerCard(plan: ProviderPlan): string {
-  return (
-    '<div class="row">' +
-    mark(plan.id) +
-    `<span class="name">${escapeHtml(plan.name)}</span>` +
-    copyButton(plan.command, plan.name) +
-    '</div>'
-  );
-}
-
-function catalogue(view: DashboardView): { available: string; another: string } {
-  const plans = planAll(PROVIDER_MANIFESTS, {
-    profile: view.profile,
-    connections: view.connections.map((connection) => connection.key),
-    ownClients: view.ownClients,
-    target: view.target,
-  });
-
-  // The same split `setup_overview` makes: never connected is an invitation,
-  // and already connected is only an invitation when a second account means
-  // something (ADR — `multiAccount` is the credential test, not a preference).
-  const available = plans.filter((plan) => plan.connected.length === 0);
-  const more = plans.filter((plan) => plan.connected.length > 0 && plan.multiAccount);
-
-  return {
-    available: available.map(providerCard).join('\n'),
-    another: more.map(providerCard).join('\n'),
-  };
-}
-
-function switcher(view: DashboardView): string {
-  // Links, not a form: choosing a profile here changes what this page shows and
-  // nothing else. The workspace default is config, and config is written from
-  // the CLI.
-  const profiles = view.profiles
-    .map((name) => {
-      const current = name === view.profile;
-      const label = escapeHtml(name);
-      return current
-        ? `<span class="chip on">${label}</span>`
-        : `<a class="chip" href="?profile=${encodeURIComponent(name)}">${label}</a>`;
-    })
-    .join('');
-
-  // Every declared target, with the one whose adapters are actually open marked.
-  // The others are real — they are where `--target` would write — but nothing on
-  // this page is reading from them.
-  const targets = view.targets
-    .map((name) =>
-      name === view.target
-        ? `<span class="chip on">${escapeHtml(name)}</span>`
-        : `<span class="chip off" title="declared, but not the one this endpoint opened">${escapeHtml(name)}</span>`,
-    )
-    .join('');
-
-  return (
-    '<div class="switch">' +
-    `<div class="group"><span class="eyebrow">profile</span>${profiles}</div>` +
-    `<div class="group"><span class="eyebrow">target</span>${targets}</div>` +
-    '</div>'
-  );
-}
-
-export function dashboardPage(view: DashboardView): Response {
-  const { available, another } = catalogue(view);
-
-  const body =
-    `<h1>Lanes Link</h1>${switcher(view)}` +
-    `<h2 class="eyebrow">Connections</h2>${connectionsSection(view)}` +
-    (available ? `<h2 class="eyebrow">Available</h2><div class="rows">${available}</div>` : '') +
-    (another ? `<h2 class="eyebrow">Connect another account</h2><div class="rows">${another}</div>` : '') +
-    '<h2 class="eyebrow">Elsewhere</h2>' +
-    '<p class="empty">What is reachable, and what is wrong with it:</p>' +
-    commandLine(command(view, 'status')) +
-    commandLine(command(view, 'doctor'));
-
-  return shell(body, 'Lanes Link', 200);
-}
-
-/**
- * What an unauthenticated browser gets.
- *
- * The narrow card rather than the wide page, because it is one sentence — and
- * it names the command instead of asking for the token, since the command is
- * what puts the token in the URL in the first place. A password field here
- * would be a second way in to guard for no benefit: whoever can run the command
- * is already whoever the token would prove them to be.
- *
- * The one command on this page carries neither `--profile` nor `--target`,
- * against the rule every other command here follows. Both are names, and this
- * page answers before authentication — ADR-018 stopped `/health` naming
- * profiles to an anonymous caller for exactly that reason, and a 401 that
- * recites the workspace's profile list would put it back.
- */
-export function dashboardSignInPage(status: number): Response {
-  return shell(
-    '<div class="narrow"><h1>Not signed in</h1>' +
-      '<p class="desc">This page opens from the terminal that is serving it.</p>' +
-      commandLine('lanes link dashboard') +
-      '</div>',
-    'Lanes Link',
-    status,
-  );
-}

package/src/cli/dashboard-shell.ts

@@ -1,125 +0,0 @@
-import { escapeHtml, FONTS, FOOTER, PAGE_CSP, PAGE_HEADERS, TOKENS } from './brand.ts';
-
-/**
- * The dashboard's chrome: its layout, its one listener, and the document they
- * hang in.
- *
- * Split from `dashboard-page.ts` because the two answer different questions —
- * that file decides what a row says, this one decides what a row looks like and
- * what the response is allowed to load. Everything shared with the two
- * authorization pages, which is every colour and every face, is in `brand.ts`;
- * what is left here is the one thing this surface does not share with them, a
- * wide list rather than a centred card.
- */
-
-const STYLE = `
-body { padding: 40px 24px; }
-.wrap { width: 100%; max-width: 620px; margin: 0 auto; }
-.narrow { text-align: center; padding: 32px 0; }
-h1 { margin: 0 0 20px; }
-h2 { margin: 30px 0 8px; }
-.desc { margin: 0 0 12px; font-size: 14px; line-height: 1.6; color: var(--muted-foreground); }
-.empty { margin: 0 0 12px; font-size: 14px; line-height: 1.6; color: var(--muted-foreground);
-         opacity: 0.8; }
-
-/* Profile and target selectors. The current one is not gold: gold says a thing
-   is good, and which profile you are looking at is not a verdict. */
-.switch { display: flex; flex-wrap: wrap; gap: 20px; padding-bottom: 4px; }
-.group { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; }
-.chip { display: inline-block; padding: 3px 10px; font-size: 13px; border-radius: 999px;
-        border: 1px solid var(--border); color: var(--muted-foreground); text-decoration: none; }
-.chip:hover { color: var(--foreground); background: var(--muted); }
-.chip.on { color: var(--foreground); background: var(--muted); font-weight: 500; }
-.chip.off { border-style: dashed; opacity: 0.5; }
-
-/* One line per item: mark, name, whatever qualifies it, then the button hard
-   right. \`min-width: 0\` on the row lets the name ellipsize rather than push
-   the button off the end. */
-.rows { display: flex; flex-direction: column; }
-.row { display: flex; align-items: center; gap: 10px; min-width: 0;
-       padding: 7px 10px 7px 4px; border-radius: 6px; }
-.row:hover { background: var(--muted); }
-.glyph { flex: none; display: inline-flex; align-items: center; justify-content: center;
-         width: 17px; height: 17px; margin: 0 3px; opacity: 0.85; }
-/* The stand-in wants the box the real marks do not: bare letters read as a mark
-   that failed to load, where a brand mark reads as itself. */
-.glyph.letters { width: 23px; height: 23px; margin: 0; border-radius: 6px; font-size: 8.5px;
-                 font-weight: 500; letter-spacing: 0.02em; color: var(--muted-foreground);
-                 border: 1px solid var(--border); opacity: 1; }
-.name, .key { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.name { font-size: 14px; }
-.key { font-family: var(--mono); font-size: 13px; }
-.account { font-size: 12.5px; color: var(--muted-foreground); opacity: 0.8; min-width: 0;
-           overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-
-/* Always visible, never revealed on hover: the button is the only way to get the
-   command now that the line itself is not on the page, and an affordance you
-   have to find by sweeping the mouse is one most readers never find. */
-.copy { margin-left: auto; opacity: 0.6; }
-.row:hover .copy { opacity: 1; }
-.copy:hover, .copy:focus-visible { opacity: 1; }
-
-/* The two places the command is still the label, so it stays visible. */
-.cmd { display: flex; align-items: center; gap: 8px; margin-top: 8px; padding: 8px 10px;
-       background: var(--card); border: 1px dashed var(--border); border-radius: 10px; }
-.cmd code { flex: 1; font-size: 12.5px; line-height: 1.5; word-break: break-all; }
-.cmd .copy { opacity: 0.8; margin-left: 0; }
-`.trim();
-
-/**
- * The copy button, and nothing else.
- *
- * Inline because a separate file would be the first static asset this
- * repository serves, and one listener is not worth that. It reads the command
- * from a data attribute rather than from the DOM text so that what is copied is
- * exactly what was rendered, whitespace included.
- */
-const SCRIPT = `
-document.addEventListener('click', function (event) {
-  var button = event.target.closest('.copy');
-  if (!button || !navigator.clipboard) return;
-  navigator.clipboard.writeText(button.dataset.copy).then(function () {
-    button.textContent = 'copied';
-    setTimeout(function () { button.textContent = 'copy'; }, 1200);
-  });
-});
-`.trim();
-
-export function shell(inner: string, title: string, status: number): Response {
-  return new Response(
-    `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-${FONTS}
-<title>${escapeHtml(title)}</title>
-<style>
-${TOKENS}
-${STYLE}
-</style>
-</head>
-<body>
-<div class="wrap">
-${inner}
-${FOOTER}
-</div>
-<script>
-${SCRIPT}
-</script>
-</body>
-</html>`,
-    {
-      status,
-      headers: {
-        ...PAGE_HEADERS,
-        // The shared policy plus the one thing this page has that the others do
-        // not: an inline listener, for the copy button.
-        'content-security-policy': `${PAGE_CSP}; script-src 'unsafe-inline'`,
-        // Connection keys and account names are not something to leave in a
-        // shared browser's back-forward cache.
-        'cache-control': 'no-store',
-      },
-    },
-  );
-}