Module surface 

What the two dashboards this server serves do the same way.

docs/web-surfaces.md calls them surface 3 (crate::dashboard, the operations page) and surface 4 (crate::analytics, the read-only picture). They keep their own prefixes, their own routes and their own files; what lives here is the plumbing underneath both: the tri-state panel envelope, the operator session a control is reached behind, the JSON refusal shape an API route answers with, and serving a static asset under its content type.

Enums

PanelState

The tri-state envelope every panel answers in.

Constants

CSRF_HEADER

The header a mutating operator request must echo its session’s CSRF token in. A cookie rides along on a cross-origin form post; this does not.

SESSION_COOKIE

The cookie a signed-in operator’s browser carries.

Functions

acting_operator

The DID this deployment’s operator signed in as, as the ledger records an actor. Only reached behind signed_in, which is what establishes that the caller controls it.

asset

One static asset, served under content_type.

html

An HTML document.

operator

The operator sign-in, or a 503 naming why this deployment has none.

refusal

The {"error": .., "message": ..} shape every route here refuses in.

script

A script.

session_cookie

Reads SESSION_COOKIE out of a request’s Cookie header.

signed_in

Resolves a request to a signed-in session, or the refusal to answer with.

stylesheet

A stylesheet.