[mbradley]

Summary

• The verifier page's four buttons that used inline onclick attributes (Check, Load my links, and the remove dialog's Cancel and Remove) now get their click handlers from the page's script. Each calls the same function as before.
• The handlers are attached before the page's start-up code, so an error during start-up can't leave the buttons without handlers. The Check button also gets type="button", like the other three.
• A new test fails if either page (/ or /verify/...) gains an inline event-handler attribute or a javascript: URL.

Motivation

• This prepares for a Content-Security-Policy that lets the pages run only scripts the verifier serves (fix(page): check event signatures with code served by our own worker, not esm.sh #138). A policy like that blocks inline event-handler attributes, so these buttons would stop working once it's on. Moving them first keeps that later change small.

Related Issue

• Relates to fix(page): check event signatures with code served by our own worker, not esm.sh #138.

Testing

• npm run test:once: 52 files, 1654 tests passed. npx tsc --noEmit: clean.
• A new test runs the page's real wiring code against stand-in buttons and checks that each click reaches its own function. It fails if a listener line is removed or commented out, if the wiring lines don't parse, or if two handlers are swapped. Other new tests fail if an inline onclick returns, if the wiring moves after the start-up code, or if an onclick hides behind a quoted >.
• In Chromium and WebKit on wrangler dev: each of the four buttons, by mouse click, Enter and Space, behaved the same as on main, with no console errors. Firefox was not run.
• Manual check after merge: on the live page, run a check with "Look up someone"'s Check button. Then sign in with an account that has linked accounts, open "Manage verified links", click "Load my links", click "Remove" on one row, then "Cancel" in the dialog.

API / Behavior Notes

• None. The page behaves the same.

Sensitive Information Check

• Confirmed: no partner, customer or brand names, or other sensitive external identities.

[divine-roborev]

roborev: Combined Review (00414ef)

Verdict: No findings at or above high severity.

---

Reviewers: 2 done | Synthesis: opencode | Total: 3m38s

[dcadenas]

The four buttons keep their existing actions, with listeners registered before page startup.
No actionable findings at 00414ef.

Checks

• npm run typecheck: passed.
• npm run test:once: 52 files and 1,654 tests passed. The interactive test command was not run separately.
• CI on the reviewed commit passed, including the executed Typecheck, Test, and semantic-title validation steps. CLA and roborev also passed.
• The regression tests cover the emitted button wiring and both pages' markup, but do not run a browser or the remote-signer flow.

Local checks used Node 26.8.1; CI used Node 24.
I did not rerun browser checks; the description reports Chromium and WebKit testing, with Firefox untested.
This is preparation for #138, not the Content-Security-Policy rollout itself.