better-dsh 0.2.3 → 0.2.4-b

package/lib/web-trust-BO66y72w.js

@@ -0,0 +1,361 @@
+import { Context } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+
+//#region src/mobile/zoom-guard.ts
+/**
+* Whether a UA string + touch-capability pair is an iOS-class browser
+* (design D2, mirroring Discourse `capabilities.isIOS`): iPhone/iPod/iPad,
+* plus iPadOS 13+ desktop-Safari masquerade (`Macintosh` UA with a
+* multi-touch digitizer). Deliberately NOT `pointer:coarse` — Android Chrome
+* never focus-zooms and `maximum-scale` has historical side effects there,
+* so the gate is tightened to the iOS family. UA-shape drift degrades
+* benignly: a novel UA simply reads as non-iOS and no rewriting happens.
+*
+* @param ua - `navigator.userAgent`.
+* @param maxTouchPoints - `navigator.maxTouchPoints` (0 when absent).
+* @returns `true` for iOS-class browsers.
+*/
+function isIOSClassUA(ua, maxTouchPoints) {
+	return /iPhone|iPod|iPad/.test(ua) || /Macintosh/.test(ua) && maxTouchPoints > 1;
+}
+/**
+* Token-level merge of viewport directives into a viewport meta `content`
+* string (design D4): existing tokens keep their positions, a token whose key
+* (compared case-insensitively) is in `tokens` is REPLACED by the configured
+* key=value, and configured keys not present are APPENDED in insertion order.
+* Idempotent by construction — merging always re-derives from the input, so
+* repeated evaluation cannot accumulate duplicates.
+*
+*   mergeViewportTokens('width=device-width, initial-scale=1', T)
+*   → 'width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no'
+*   mergeViewportTokens('width=device-width, maximum-scale=5', T)
+*   → 'width=device-width, maximum-scale=1, user-scalable=no'   // same-key override, position kept
+*
+* @param content - the stock (or stock-equivalent) content string.
+* @param tokens - the directives to merge, keyed lowercase.
+* @returns the merged content string.
+*/
+function mergeViewportTokens(content, tokens) {
+	var out = [];
+	var seen = {};
+	var parts = content.split(",");
+	for (var i = 0; i < parts.length; i++) {
+		var part = parts[i];
+		var raw = (part === void 0 ? "" : part).replace(/^\s+|\s+$/g, "");
+		if (raw === "") continue;
+		var eq = raw.indexOf("=");
+		var key = eq < 0 ? raw : raw.slice(0, eq).replace(/^\s+|\s+$/g, "");
+		var hit = null;
+		for (var k in tokens) if (tokens.hasOwnProperty(k) && k.toLowerCase() === key.toLowerCase()) {
+			hit = k;
+			break;
+		}
+		if (hit === null) {
+			out[out.length] = raw;
+			continue;
+		}
+		out[out.length] = hit + "=" + tokens[hit];
+		seen[hit] = true;
+	}
+	for (var j in tokens) if (tokens.hasOwnProperty(j) && !seen[j]) out[out.length] = j + "=" + tokens[j];
+	return out.join(", ");
+}
+/**
+* The double gate (design D2/D3 + the `zoomGuard` config): rewrite applies
+* only on an iOS-class browser AND a narrow viewport AND a non-`off`
+* `zoomGuard`. An absent payload (or absent key) means the `'meta'` default —
+* the same default-on posture as the mobile leg itself — so only an explicit
+* `'off'` disarms the guard. Unknown non-`off` values read as `'meta'`
+* (schema validation makes them unreachable in production; benign here).
+*
+* @param config - the `__DASHR_MOBILE__` payload (only `zoomGuard` is read).
+* @param isIOS - {@link isIOSClassUA} verdict for this page load.
+* @param isNarrow - `matchMedia('(max-width: breakpoint-0.02px)')` verdict.
+* @returns `true` when the viewport rewrite should be applied.
+*/
+function shouldApplyZoomGuard(config, isIOS, isNarrow) {
+	if (!isIOS || !isNarrow) return false;
+	if (!config) return true;
+	return config.zoomGuard !== "off";
+}
+/**
+* Standalone display-mode verdict (design D4 of change
+* `2026-09-03-zoomguard-standalone-font-floor`): standalone PWAs HONOR
+* `user-scalable=no` (the real-device pinch regression that motivated the
+* display-mode split), so they must never enter the meta-rewrite path. Two
+* sources, strict-`true` OR: the `(display-mode: standalone)` media query
+* (primary) and legacy `navigator.standalone` (older iOS Safari exposes only
+* the latter). Anything else — `undefined` (engine without the source),
+* `false`, or truthy junk — reads as NOT standalone.
+*
+* @param mqMatchesStandalone - `matchMedia('(display-mode: standalone)').matches`.
+* @param navStandalone - `navigator.standalone === true`.
+* @returns `true` in standalone display mode (either source).
+*/
+function isStandaloneDisplay(mqMatchesStandalone, navStandalone) {
+	return mqMatchesStandalone === true || navStandalone === true;
+}
+/**
+* The 16px font floor stylesheet (design D3): iOS auto-zooms on focus into
+* ANY control whose computed font-size is below 16px, so in standalone mode
+* — where the meta rewrite is off the table (pinch must stay
+* engine-available) — the floor IS the suppression. Scoped by the same
+* breakpoint band the meta leg uses and derived the same way
+* (`breakpoint - 0.02`: 768 → 767.98, 900 → 899.98); `!important` beats the
+* 13/14px CSS module rules and the body inline var chain;
+* `[contenteditable="true"]` matches only the editable state (React
+* serializes `contentEditable={bool}` to the literal attribute value
+* "true"/"false").
+*
+* @param breakpointPx - the configured `mobile.breakpoint` (raw — this
+* function derives the `-0.02` band itself, do NOT pre-subtract).
+* @returns the complete stylesheet text.
+*/
+function buildFontFloorCss(breakpointPx) {
+	return "@media (max-width:" + (breakpointPx - .02) + "px){ input,textarea,select,[contenteditable=\"true\"]{ font-size:16px !important } }";
+}
+/**
+* Build the boot script's zoomGuard section: the five decision predicates
+* embedded via `toString()` plus the DOM state machine that applies them.
+* The machine implements design D3/D4 with one discovered refinement —
+*
+* **The standalone fork (2026-09-03, change
+* `2026-09-03-zoomguard-standalone-font-floor`).** Real-device datum:
+* standalone (Add to Home Screen) iOS HONORS `user-scalable=no`, so the
+* meta rewrite that is benign in-browser (pinch stays engine-controlled)
+* kills pinch in the PWA — the user's primary surface. The section
+* therefore forks right after the iOS gate, BEFORE any meta machinery: a
+* one-shot startup verdict (display-mode never flips mid-session) via the
+* `(display-mode: standalone)` MQ or legacy `navigator.standalone` (D4).
+* Standalone → inject the `ios-zoom-font-floor` style element into the
+* head (16px floor, media-query-scoped to the same breakpoint band, D3)
+* and RETURN — no provisional meta, no reconcile observer, no ladder
+* timer, no listeners, byte-identical stock meta (D1). The width dimension
+* lives inside the stylesheet's media query, so the injection itself is
+* NOT width-gated: a wide standalone load still gets the element; the rule
+* simply does not match above the breakpoint. Browser mode runs the v0.2.4
+* machinery unchanged.
+* **Why reconciliation exists.** The webserver splices head injections
+* immediately after the opening `<head>` tag, i.e. BEFORE the stock
+* `<meta name="viewport">` in upstream's `index.html`. At boot-script time
+* the stock meta is therefore NOT yet parsed, so the "meta missing"
+* branch is the NORMAL path on the served shell, not an edge case. A
+* provisional meta is created right away (the timing requirement: the
+* suppressive tokens are live before any application bundle can focus an
+* input), and a MutationObserver watches for the parser to insert the stock
+* meta; the moment it appears, the guard records the true stock content,
+* rewrites the STOCK meta (token merge, D4's actual semantics — restore
+* later writes these exact bytes back), and removes the provisional one —
+* leaving a single-meta document instead of relying on engines'
+* unspecified multi-meta merge behavior. Engines without MutationObserver
+* keep the provisional meta for the page's lifetime (degraded but still
+* suppressive); the observer is never started once the stock meta was
+* found synchronously.
+*
+* **Why the re-evaluation ladder exists (2026-09-03 rework, lead CDP
+* finding on the 4999 instance).** The boot script runs during head parsing,
+* BEFORE the engine applies the stock viewport meta — the layout viewport at
+* first evaluation is the pre-meta engine default (980px observed), so
+* `mq.matches` reads false on an initial narrow load, and the narrowing that
+* follows meta application does NOT reliably dispatch `resize` to the page
+* during load (headless Chrome: never). A ~10ms poll ladder therefore
+* re-evaluates until the guard IS applied, `document.readyState` reaches
+* `'complete'`, or ~2s elapse — the first layout always precedes deferred
+* scripts, so the ladder lands the guard before any application bundle can
+* focus an input. Steady-state ticks are idempotent no-ops; a wide load
+* idles to the readyState stop and leaves no timer behind (a pending tick
+* is also cancelled the moment the guard lands). MediaQuery `change` events
+* (with the legacy `addListener` fallback) form a second re-evaluation
+* channel alongside window `resize`.
+*
+* State machine (ES5, zero dependencies, synchronous first evaluation):
+* `meta` is the element under management (provisional or reconciled stock),
+* `stock` its recorded stock content, `mine` whether we created it,
+* `applied` the last applied gate verdict. `apply(on)` is idempotent per
+* state (no-op when the verdict is unchanged); merges always re-derive
+* from the recorded stock, never from the live content, so resize storms
+* cannot accumulate tokens. Non-iOS pages never wire any listener.
+*
+* Emitted only when the mobile payload exists and `zoomGuard !== 'off'`.
+*
+* @returns the inline section text (truthy `var` declarations + IIFE).
+*/
+function buildZoomGuardSection() {
+	return [
+		`var ZI=${isIOSClassUA.toString()};`,
+		`var ZM=${mergeViewportTokens.toString()};`,
+		`var ZS=${shouldApplyZoomGuard.toString()};`,
+		`var ZD=${isStandaloneDisplay.toString()};`,
+		`var ZF=${buildFontFloorCss.toString()};`,
+		"(function(){",
+		"var m=window.__DASHR_MOBILE__;",
+		"var ios=ZI(navigator.userAgent,(navigator.maxTouchPoints||0));",
+		"if(!ios)return;",
+		"var bpx=(m&&typeof m.breakpoint==='number'&&m.breakpoint>0)?m.breakpoint:768;",
+		"var bp=bpx-0.02;",
+		"var sa=ZD((window.matchMedia&&window.matchMedia('(display-mode: standalone)').matches),(navigator.standalone===true));",
+		"if(sa){var f=document.createElement('style');f.setAttribute('id','ios-zoom-font-floor');f.setAttribute('data-plugin','better-dsh');f.setAttribute('data-plugin-css','better-dsh/zoom-font-floor');f.textContent=ZF(bpx);headEl().appendChild(f);return}",
+		"var mq=(typeof window.matchMedia==='function')?window.matchMedia('(max-width:'+bp+'px)'):null;",
+		"var T={'maximum-scale':'1','user-scalable':'no'};",
+		"var meta=null,stock=null,mine=false,applied=false,obs=null,lad=null,lN=0;",
+		"function findStock(){var s=document.getElementsByTagName('meta');for(var i=0;i<s.length;i++){var e=s[i];if(e!==meta&&(e.getAttribute('name')||'').toLowerCase()==='viewport')return e}return null}",
+		"function headEl(){return document.head||document.getElementsByTagName('head')[0]||document.documentElement}",
+		"function stopWatch(){if(obs){obs.disconnect();obs=null}}",
+		"function stopLadder(){if(lad){clearTimeout(lad);lad=null}}",
+		"function dropMine(){if(meta&&mine){if(meta.parentNode)meta.parentNode.removeChild(meta);meta=null;mine=false}}",
+		"function apply(on){",
+		"if(on===applied)return;",
+		"applied=on;",
+		"if(on)stopLadder();",
+		"if(on){",
+		"var el=findStock();",
+		"if(el){meta=el;mine=false;stock=el.getAttribute('content')||''}",
+		"else if(!meta){meta=document.createElement('meta');meta.setAttribute('name','viewport');mine=true;stock='';headEl().appendChild(meta)}",
+		"meta.setAttribute('content',ZM(stock,T));",
+		"if(mine&&typeof MutationObserver==='function'&&!obs){obs=new MutationObserver(check);obs.observe(document.documentElement,{childList:true,subtree:true})}",
+		"}else{",
+		"stopWatch();",
+		"if(!meta)return;",
+		"if(mine)dropMine();",
+		"else meta.setAttribute('content',stock);",
+		"}",
+		"}",
+		"function check(){",
+		"var el=findStock();",
+		"if(!el)return;",
+		"stopWatch();",
+		"stock=el.getAttribute('content')||'';",
+		"if(applied){dropMine();meta=el;mine=false;meta.setAttribute('content',ZM(stock,T))}",
+		"else{dropMine();meta=null;stock=null}",
+		"}",
+		"function re(){apply(ZS(m,true,mq?mq.matches:false))}",
+		"function tick(){",
+		"lad=null;",
+		"re();",
+		"if(applied)return;",
+		"lN++;",
+		"if(document.readyState==='complete'||lN>=200)return;",
+		"lad=setTimeout(tick,10);",
+		"}",
+		"re();",
+		"window.addEventListener('resize',re);",
+		"if(mq&&mq.addEventListener)mq.addEventListener('change',re);else if(mq&&mq.addListener)mq.addListener(re);",
+		"if(!applied&&typeof setTimeout==='function')lad=setTimeout(tick,10);",
+		"})()"
+	].join("");
+}
+
+//#endregion
+//#region src/web-trust.ts
+/**
+* The schema-level default for `trustedPageAuthorities` (v0.2.2a): derive
+* from the DSH_TRUSTED_HOSTS environment — the SAME single source the
+* fence leg's patch expression reads first — so ONE declaration (e.g. one
+* `Environment=` line in the service unit) drives both legs with zero
+* per-instance plugin config. Bare hostnames only: `location.hostname`
+* carries no port, and `assertBareHostname` would reject a portful entry at
+* boot, so portful/schematic entries are dropped here instead of thrown.
+* Declared in the Config SCHEMA rather than the bundle patch row because a
+* profile/home layer row with the same id whole-row-overrides the row's
+* config object, while schema defaults fill per-key at plugin load and
+* survive every overlay layer. An explicit configured value always wins.
+*
+* @param env - the raw DSH_TRUSTED_HOSTS value (whitespace-separated).
+* @returns the bare-hostname authorities to trust by default.
+*/
+function deriveDefaultPageAuthorities(env) {
+	return (env ?? "").split(/\s+/).filter((h) => h.length > 0 && !/[:/@?#]/.test(h));
+}
+/** Assert one configured authority is a bare hostname (no port/path/scheme). */
+function assertBareHostname(entry) {
+	if (entry.length === 0 || /[:/@?#]/.test(entry)) throw new Error(`dashr-web-trust: trustedPageAuthorities entry ${JSON.stringify(entry)} is not a bare hostname (location.hostname carries no port; an entry with port/path would never match)`);
+}
+/** The IIFE framing shared by both legs (a throwing leg stays invisible). */
+function frame(body) {
+	return [
+		"(function(){try{",
+		...body,
+		"}catch(e){}})();"
+	].join("");
+}
+/**
+* Build the authorities-leg script. Pure: same config in, same script out —
+* the unit tests pin the shape (authority match, no-overwrite guard,
+* inert-when-empty).
+*
+* @param trustedPageAuthorities - the operator-declared hostnames.
+* @returns the script text, or `undefined` when the list is empty (inject
+*   nothing — the feature is fully inert).
+*/
+function buildTrustScript(trustedPageAuthorities) {
+	const authorities = [...trustedPageAuthorities ?? []];
+	if (authorities.length === 0) return void 0;
+	for (const entry of authorities) assertBareHostname(entry);
+	return frame([
+		"if(!window.__DSH_TRANSPORT__){",
+		`var h=location.hostname,a=${JSON.stringify(authorities)};`,
+		"for(var i=0;i<a.length;i++)if(a[i]===h){window.__DSH_TRANSPORT__={ownsHost:true};break}",
+		"}"
+	]);
+}
+/**
+* Build the mobile-leg script. Pure: same config in, same script out — the
+* unit tests pin the shape (mobile global, tuned thresholds, zoomGuard
+* section, disabled-when-off).
+*
+* @param mobile - the resolved mobile config.
+* @returns the script text, or `undefined` when the feature is explicitly
+*   disabled (inject nothing).
+*/
+function buildMobileScript(mobile) {
+	if (!(mobile?.enabled !== false)) return void 0;
+	const payload = {
+		enabled: true,
+		...mobile?.swipeDistancePx !== void 0 ? { swipeDistancePx: mobile.swipeDistancePx } : {},
+		...mobile?.dominanceRatio !== void 0 ? { dominanceRatio: mobile.dominanceRatio } : {},
+		...mobile?.leftEdgeBandPx !== void 0 ? { leftEdgeBandPx: mobile.leftEdgeBandPx } : {},
+		...mobile?.rightZoneRatio !== void 0 ? { rightZoneRatio: mobile.rightZoneRatio } : {},
+		...mobile?.swipeVelocityPxPerMs !== void 0 ? { swipeVelocityPxPerMs: mobile.swipeVelocityPxPerMs } : {},
+		...mobile?.zoomGuard !== void 0 ? { zoomGuard: mobile.zoomGuard } : {}
+	};
+	const body = [`window.__DASHR_MOBILE__=${JSON.stringify(payload)};`];
+	if (mobile?.zoomGuard !== "off") body.push(buildZoomGuardSection());
+	return frame(body);
+}
+/** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
+const Config = z.object({ trustedPageAuthorities: z.array(String).default(deriveDefaultPageAuthorities(process.env.DSH_TRUSTED_HOSTS)) });
+/** Cordis plugin name. */
+const name = "dashr-web-trust";
+/**
+* No static injects: `webServer` is composed conditionally inside
+* {@link apply}, so the row loads (dormant) in compositions without one.
+*/
+const inject = [];
+/**
+* Mount the authorities-leg injection: one `webserver/index-inject` listener
+* pushing the rendered row.
+* @param ctx - host plugin context.
+* @param config - the row config.
+*/
+function apply(ctx, config) {
+	const authorities = config?.trustedPageAuthorities;
+	ctx.inject(["webServer"], () => {
+		ctx.on("webserver/index-inject", (table) => {
+			const text = buildTrustScript(authorities);
+			if (text !== void 0) table.push({
+				kind: "script",
+				placement: "head",
+				text
+			});
+		});
+	});
+}
+var web_trust_default = {
+	name,
+	inject,
+	Config,
+	apply
+};
+
+//#endregion
+export { deriveDefaultPageAuthorities as a, web_trust_default as c, buildTrustScript as i, apply as n, inject as o, buildMobileScript as r, name as s, Config as t };

package/lib/web-trust-CgpBoFv3.d.ts

@@ -0,0 +1,106 @@
+import { Context } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+
+//#region src/web-trust.d.ts
+
+/**
+ * The schema-level default for `trustedPageAuthorities` (v0.2.2a): derive
+ * from the DSH_TRUSTED_HOSTS environment — the SAME single source the
+ * fence leg's patch expression reads first — so ONE declaration (e.g. one
+ * `Environment=` line in the service unit) drives both legs with zero
+ * per-instance plugin config. Bare hostnames only: `location.hostname`
+ * carries no port, and `assertBareHostname` would reject a portful entry at
+ * boot, so portful/schematic entries are dropped here instead of thrown.
+ * Declared in the Config SCHEMA rather than the bundle patch row because a
+ * profile/home layer row with the same id whole-row-overrides the row's
+ * config object, while schema defaults fill per-key at plugin load and
+ * survive every overlay layer. An explicit configured value always wins.
+ *
+ * @param env - the raw DSH_TRUSTED_HOSTS value (whitespace-separated).
+ * @returns the bare-hostname authorities to trust by default.
+ */
+declare function deriveDefaultPageAuthorities(env: string | undefined): string[];
+/** Mobile page-config knobs (the `dashr-mobile` row's config shape). */
+interface MobileConfig {
+  enabled?: boolean;
+  swipeDistancePx?: number;
+  dominanceRatio?: number;
+  leftEdgeBandPx?: number;
+  rightZoneRatio?: number;
+  swipeVelocityPxPerMs?: number;
+  /**
+   * iOS focus auto-zoom suppression mode (change
+   * `2026-09-03-ios-focus-zoom-suppression`): `'meta'` (default) rewrites
+   * the viewport meta on iOS-class narrow viewports; `'off'` is the escape
+   * hatch. `'font'` (16px floor, solution A) is a RESERVED value slot,
+   * deliberately not in the schema enum — unimplemented values fail loud
+   * at config load rather than no-op silently.
+   */
+  zoomGuard?: 'meta' | 'off';
+}
+/** The `webserver/index-inject` row shape these features push. */
+interface BootScriptRow {
+  kind: 'script';
+  placement: 'head';
+  text: string;
+}
+/**
+ * Build the authorities-leg script. Pure: same config in, same script out —
+ * the unit tests pin the shape (authority match, no-overwrite guard,
+ * inert-when-empty).
+ *
+ * @param trustedPageAuthorities - the operator-declared hostnames.
+ * @returns the script text, or `undefined` when the list is empty (inject
+ *   nothing — the feature is fully inert).
+ */
+declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined): string | undefined;
+/**
+ * Build the mobile-leg script. Pure: same config in, same script out — the
+ * unit tests pin the shape (mobile global, tuned thresholds, zoomGuard
+ * section, disabled-when-off).
+ *
+ * @param mobile - the resolved mobile config.
+ * @returns the script text, or `undefined` when the feature is explicitly
+ *   disabled (inject nothing).
+ */
+declare function buildMobileScript(mobile: MobileConfig | undefined): string | undefined;
+/**
+ * `dashr-web-trust` row config schema. Only the authorities leg lives here —
+ * the mobile knobs are the `dashr-mobile` row's own config.
+ */
+interface TrustConfig {
+  /** Hostnames this operator declares their own devices' pages run on. */
+  trustedPageAuthorities?: readonly string[];
+}
+/** Row config schema (schema-level default derives from `DSH_TRUSTED_HOSTS`). */
+declare const Config: z<Schemastery.ObjectS<{
+  trustedPageAuthorities: z<string[], string[]>;
+}>, Schemastery.ObjectT<{
+  trustedPageAuthorities: z<string[], string[]>;
+}>>;
+/** Cordis plugin name. */
+declare const name = "dashr-web-trust";
+/**
+ * No static injects: `webServer` is composed conditionally inside
+ * {@link apply}, so the row loads (dormant) in compositions without one.
+ */
+declare const inject: string[];
+/**
+ * Mount the authorities-leg injection: one `webserver/index-inject` listener
+ * pushing the rendered row.
+ * @param ctx - host plugin context.
+ * @param config - the row config.
+ */
+declare function apply(ctx: Context, config: TrustConfig | undefined): void;
+declare const _default: {
+  name: string;
+  inject: string[];
+  Config: z<Schemastery.ObjectS<{
+    trustedPageAuthorities: z<string[], string[]>;
+  }>, Schemastery.ObjectT<{
+    trustedPageAuthorities: z<string[], string[]>;
+  }>>;
+  apply: typeof apply;
+};
+//#endregion
+export { _default as a, buildTrustScript as c, name as d, TrustConfig as i, deriveDefaultPageAuthorities as l, Config as n, apply as o, MobileConfig as r, buildMobileScript as s, BootScriptRow as t, inject as u };

package/lib/web-trust.d.ts

@@ -0,0 +1,2 @@
+import { a as _default, c as buildTrustScript, d as name, i as TrustConfig, l as deriveDefaultPageAuthorities, n as Config, o as apply, r as MobileConfig, s as buildMobileScript, t as BootScriptRow, u as inject } from "./web-trust-CgpBoFv3.js";
+export { BootScriptRow, Config, MobileConfig, TrustConfig, apply, buildMobileScript, buildTrustScript, _default as default, deriveDefaultPageAuthorities, inject, name };

package/lib/web-trust.js

@@ -0,0 +1,3 @@
+import { a as deriveDefaultPageAuthorities, c as web_trust_default, i as buildTrustScript, n as apply, o as inject, r as buildMobileScript, s as name, t as Config } from "./web-trust-BO66y72w.js";
+
+export { Config, apply, buildMobileScript, buildTrustScript, web_trust_default as default, deriveDefaultPageAuthorities, inject, name };