template.html

<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <!--
      The enforced Content-Security-Policy and the report-only rollout policy are
      set as response HEADERS by the serving nginx (see nginx.conf), not here:
      frame-ancestors and report-only are ignored in a <meta> CSP. The app runs
      entirely in the browser and talks only to Hive RPC nodes over fetch, so
      connect-src is the directive that matters.
    -->
    <!--
      Applies a saved light/dark choice before the first paint. A separate file
      rather than an inline script because the CSP is `script-src 'self'`; see
      public/theme-boot.js. Render-blocking on purpose, and tiny.
    -->
    <script src="/theme-boot.js"></script>

    <title>Hivesigner - Sign in to Hive apps without sharing your keys</title>
    <meta name="description" content="Hivesigner keeps your Hive keys on your own device, shows you exactly what a transaction does before you sign it, and lets apps ask for only the permission they need." />
    <link rel="canonical" href="<%= siteUrl %>/" />
    <meta name="theme-color" media="(prefers-color-scheme: light)" content="#ffffff" />
    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="#0d1117" />
    <meta name="application-name" content="Hivesigner" />
    <meta name="apple-mobile-web-app-title" content="Hivesigner" />

    <meta property="og:type" content="website" />
    <meta property="og:site_name" content="Hivesigner" />
    <meta property="og:title" content="Hivesigner - Sign in to Hive apps without sharing your keys" />
    <meta property="og:description" content="Keys stay on your device. Review what you sign. Apps get only posting access." />
    <meta property="og:url" content="<%= siteUrl %>/" />
    <meta property="og:image" content="<%= siteUrl %>/og-image.png" />
    <meta property="og:image:width" content="1200" />
    <meta property="og:image:height" content="630" />
    <meta property="og:image:alt" content="Hivesigner: sign in to Hive apps without sharing your keys" />
    <meta name="twitter:card" content="summary_large_image" />
    <meta name="twitter:title" content="Hivesigner - Sign in to Hive apps without sharing your keys" />
    <meta name="twitter:description" content="Keys stay on your device. Review what you sign. Apps get only posting access." />
    <meta name="twitter:image" content="<%= siteUrl %>/og-image.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/favicon.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/icons/icon-16.png" />
    <link rel="icon" type="image/png" sizes="48x48" href="/icons/icon-48.png" />
    <link rel="icon" type="image/png" sizes="128x128" href="/icons/icon-128.png" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="manifest" href="/manifest.json" />
  </head>
  <body>
    <div id="root"></div>
  </body>
</html>