super-dsh 0.1.12-a → 0.3.0

package/superd-hub/dist/fusion-transport.js

@@ -46,11 +46,10 @@
  * Injection (the web-trust emission path, ordered AFTER it — spec §3.4 hard
  * constraint): the row is a `webserver/index-inject` head script pushed by the
  * `superd-fusion-transport` component, composed through the composite row
- * `super-dsh/fusion-transport` positioned after `super-dsh/web-trust`. Both
- * components defer their listener registration behind `inject(['webServer'])`,
- * so cordis's FIFO effect order guarantees trust pushes first and fusion
- * pushes last — the non-merging `if(!window.__DSH_TRANSPORT__)` verdict in the
- * trust script is always evaluated before anything could own that global.
+ * `super-dsh/fusion-transport` positioned after `better-dsh/web-trust`. Both
+ * components wait for `webServer`; Better Dash prepends its ownership script
+ * to the injection table, so asynchronous module loading cannot place it after
+ * the fusion script. The ownership verdict executes before application boot.
  * Row gate: the row config `enabled`, ON by default — the composite patch
  * composing this row is the switch. `enabled: false` (or `disabled: true`)
  * leaves the component dormant: no listener, no script, no flag global.
@@ -355,9 +354,8 @@ export const inject = [];
 /**
  * Mount the fusion injection: one `webserver/index-inject` listener pushing
  * the rendered head script row — the same emission path as the web-trust
- * component, composed AFTER it (the composite row order is load order, and
- * both components register their listeners behind `inject(['webServer'])`, so
- * cordis's FIFO effect order pushes the fusion row last; spec §3.4) — plus
+ * component, composed AFTER it. Better Dash prepends its ownership verdict to the public injection table,
+ * so asynchronous module loading cannot invert the script order (spec §3.4), plus
  * the {@link FUSION_FLAG_GLOBAL} baked global row (Task 4): one gate, both
  * halves.
  *

package/superd-hub/dist/index.d.ts

@@ -35,7 +35,6 @@ export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL, type AgentLink } from
 export { createOwnershipIndex, type OwnershipIndex, type OwnershipRow } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf, type HostMount } from './world-host.js';
 export { worldMountPatches, superdTrustedHosts, WORLD_WAVE1_DISABLED_ROWS, WORLD_WAVE2_DISABLED_ROWS, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, type WorldPatchLayer, } from './world-mount.js';
-export { buildTrustScript, deriveDefaultPageAuthorities, type BootScriptRow, type TrustConfig, } from './web-trust.js';
 export { withSystemHead, type HeadAwareSessionFace, type HeadPlaceholder, type WithSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName, type Config as WorldEntryConfig } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName, type Config as WorldJoinConfig } from './world-join.js';

package/superd-hub/dist/index.js

@@ -35,7 +35,6 @@ export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL } from './agent-roster.
 export { createOwnershipIndex } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf } from './world-host.js';
 export { worldMountPatches, superdTrustedHosts, WORLD_WAVE1_DISABLED_ROWS, WORLD_WAVE2_DISABLED_ROWS, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, } from './world-mount.js';
-export { buildTrustScript, deriveDefaultPageAuthorities, } from './web-trust.js';
 export { withSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName } from './world-join.js';

package/superd-hub/dist/world-entry.d.ts

@@ -30,9 +30,12 @@ export declare const name = "superd-world-mount";
 /** Row config: which world this root is. */
 export interface Config {
     key: string;
+    /** Optional activation identity from the owning row's world patch. */
+    ownerId?: string;
 }
 /** Apply the world mount. @param ctx - the WORLD root context. @param config - `{ key }`. */
 export declare function apply(ctx: Context, config?: {
     key?: unknown;
+    ownerId?: unknown;
 }): void;
 export default apply;

package/superd-hub/dist/world-entry.js

@@ -11,6 +11,9 @@ export function apply(ctx, config) {
         return;
     }
     const mount = takeHostMount(key);
+    // A delayed old boot must not adopt its replacement's mount capability.
+    if (typeof config?.ownerId === 'string' && mount?.ownerId !== config.ownerId)
+        return;
     if (mount === undefined) {
         ctx.logger?.warn?.(`superd-world-mount: no host mount registered for key ${JSON.stringify(key)}`);
         return;
@@ -37,7 +40,7 @@ export function apply(ctx, config) {
         if (connection === undefined)
             return;
         if (typeof connection.createSharedFetchHandler === 'function') {
-            dropWorldFetch = publishWorldFetch(key, connection.createSharedFetchHandler('/api'));
+            dropWorldFetch = publishWorldFetch(key, connection.createSharedFetchHandler('/api'), mount);
         }
     });
     ctx.effect(() => () => {

package/superd-hub/dist/world-host.d.ts

@@ -24,6 +24,8 @@ export interface HostMount {
     key: string;
     /** Mount root (`/omp`). */
     labelPath: string;
+    /** Owning activation; carried into its world patch to reject obsolete boots. */
+    ownerId?: string;
 }
 /** Publish the host side of one world mount (idempotent replace). */
 export declare function registerHostMount(mount: HostMount): () => void;
@@ -57,8 +59,9 @@ export interface WorldFetchHandler {
  * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
  * world's registered routes (session-log export and friends). Called from
  * inside the world root (`world-entry`); read from the host root
- * (`carrier`). Idempotent replace.
+ * (`carrier`). Idempotent replace. An optional owner mount prevents delayed
+ * publication after that mount was removed or replaced.
  */
-export declare function publishWorldFetch(key: string, handler: WorldFetchHandler): () => void;
+export declare function publishWorldFetch(key: string, handler: WorldFetchHandler, owner?: HostMount): () => void;
 /** The world's published shared `/api` fetch handler, if its root published one yet. */
 export declare function worldFetchHandlerOf(key: string): WorldFetchHandler | undefined;

package/superd-hub/dist/world-host.js

@@ -50,9 +50,13 @@ const worldFetchHandlers = new Map();
  * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
  * world's registered routes (session-log export and friends). Called from
  * inside the world root (`world-entry`); read from the host root
- * (`carrier`). Idempotent replace.
+ * (`carrier`). Idempotent replace. An optional owner mount prevents delayed
+ * publication after that mount was removed or replaced.
  */
-export function publishWorldFetch(key, handler) {
+export function publishWorldFetch(key, handler, owner) {
+    // A connection may activate after its host row was removed or replaced.
+    if (owner !== undefined && mounts.get(key) !== owner)
+        return () => { };
     worldFetchHandlers.set(key, handler);
     return () => {
         if (worldFetchHandlers.get(key) === handler)

package/superd-hub/dist/world-join.d.ts

@@ -9,7 +9,7 @@ export interface Config {
 interface HostContext {
     provide(name: string, value: unknown): void;
     inject(deps: string[], callback: (ctx: unknown) => void): unknown;
-    effect?(callback: () => () => void, label?: string): unknown;
+    effect(callback: () => () => Promise<void>, label?: string): unknown;
     get(name: string): unknown;
 }
 /** Apply the join. @param ctx - the CTX0 root context. @param config - `{ key, label? }`. */

package/superd-hub/dist/world-join.js

@@ -32,11 +32,10 @@
 import { mkdirSync } from 'node:fs';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { join } from 'node:path';
-import { registerAgent, setFailed, setReady } from './roster.js';
-import { registerForeignTarget } from './targets.js';
+import { setFailed } from './roster.js';
 import { spawnWorld } from './spawn-world.js';
 import { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
-import { registerHostMount } from './world-host.js';
+import { ownWorld } from './world-lifecycle.js';
 import { worldMountPatches } from './world-mount.js';
 /** Stable Cordis plugin name. */
 export const name = 'superd-join';
@@ -48,7 +47,6 @@ export function apply(ctx, config) {
         return;
     }
     const label = typeof config?.label === 'string' && config.label !== '' ? config.label : key;
-    registerAgent({ key, label, ready: false });
     // S7 nested home: the world's whole tree lives under `agents/<key>` (its
     // profiles were provisioned there by the line bootstrap; DSH data lands
     // inside the same root via spawnWorld's dataHome override).
@@ -65,33 +63,18 @@ export function apply(ctx, config) {
         adapterPkg: '@pgmi-builds/agent-claude',
         worldHome,
     });
-    const world = (async () => {
-        // T-D: the mount record is addressability only — no ctx0 listening-stack
-        // wait, no webServer instance, no authorize leg (the /hub family wires
-        // its own gate in ctx0, see gateway.ts).
-        const dropHostMount = registerHostMount({ key, labelPath: `/${key}` });
-        const ctxW = await spawnWorld({
-            appName: `superd-${key}`,
-            profileName: 'web',
-            installAnchor: resolveInstallAnchor(ctx), // lazy: never at module scope — import must stay side-effect-free
-            home: worldHome,
-            dataHome: worldHome,
-            // The host's live table carries this world: spawnWorld republishes a
-            // widened successor before boot imports anything (spec §2.1), and
-            // @pgmi-builds rows resolve from the profile-local links written above.
-            host: ctx,
-            extraPatches: worldMountPatches(key),
-        });
-        const gateway = ctxW.get('typertGateway');
-        registerForeignTarget({ key, gateway });
-        // T-C: no per-label mount anymore — the gateway above is the world's
-        // whole ingress, reached through the /hub family's `?agent=<key>` demux.
-        setReady(key, true);
-        ctx.effect?.(() => () => {
-            dropHostMount();
-        }, `superd-join: ${key} mount`);
-        return ctxW;
-    })().catch((cause) => {
+    const world = ownWorld(ctx, { key, label }, (ownerId) => spawnWorld({
+        appName: `superd-${key}`,
+        profileName: 'web',
+        installAnchor: resolveInstallAnchor(ctx), // lazy: never at module scope — import must stay side-effect-free
+        home: worldHome,
+        dataHome: worldHome,
+        // The host's live table carries this world: spawnWorld republishes a
+        // widened successor before boot imports anything (spec §2.1), and
+        // @pgmi-builds rows resolve from the profile-local links written above.
+        host: ctx,
+        extraPatches: worldMountPatches(key, ownerId),
+    }), (cause) => {
         // A failed world degrades to a FAILED roster row (mount stays for
         // diagnosis; ready stays false); a rejected provided promise would fail
         // the entire host boot (loader entry apply).
@@ -100,7 +83,6 @@ export function apply(ctx, config) {
             setFailed(key, true);
         }
         catch { /* roster row already gone */ }
-        return null;
     });
     ctx.provide(`superd.world.${key}`, world);
 }

package/superd-hub/dist/world-lifecycle.d.ts

@@ -0,0 +1,20 @@
+/** Cordis owns the effect and awaits its disposer when the row unloads. */
+interface WorldOwner {
+    effect(callback: () => () => Promise<void>, label?: string): unknown;
+}
+interface OwnedWorld {
+    get(name: string): unknown;
+    effect(callback: () => () => void, label?: string): unknown;
+    fiber: {
+        dispose(): Promise<void>;
+    };
+}
+/**
+ * One row owns its roster membership, mount, target and sibling world. Install
+ * cleanup before starting boot: completion can arrive after the owner unloads.
+ */
+export declare function ownWorld<T extends OwnedWorld>(ctx: WorldOwner, entry: {
+    key: string;
+    label: string;
+}, spawn: (ownerId: string) => Promise<T>, onFailure: (cause: unknown) => void): Promise<T | null>;
+export {};

package/superd-hub/dist/world-lifecycle.js

@@ -0,0 +1,69 @@
+import { randomUUID } from 'node:crypto';
+import { registerAgent, unregisterAgent, setReady } from './roster.js';
+import { getTarget, registerForeignTarget, unregisterForeignTarget } from './targets.js';
+import { registerHostMount } from './world-host.js';
+/**
+ * One row owns its roster membership, mount, target and sibling world. Install
+ * cleanup before starting boot: completion can arrive after the owner unloads.
+ */
+export function ownWorld(ctx, entry, spawn, onFailure) {
+    const { key } = entry;
+    const ownerId = randomUUID();
+    let active = true;
+    let target;
+    let world;
+    let teardown;
+    let started;
+    let dropMount;
+    const disposeWorld = () => teardown ??= world?.fiber.dispose() ?? Promise.resolve();
+    ctx.effect(() => {
+        registerAgent({ ...entry, ready: false });
+        dropMount = registerHostMount({ key, labelPath: `/${key}`, ownerId });
+        return async () => {
+            // Remove addressability synchronously. Old boot/teardown must never
+            // mutate a later activation's maps or readiness, even while it awaits.
+            active = false;
+            dropMount();
+            if (target && getTarget(key) === target)
+                unregisterForeignTarget(key);
+            unregisterAgent(key);
+            await started;
+            await disposeWorld();
+        };
+    }, `superd.world.${key}: ownership`);
+    started = (async () => {
+        try {
+            world = await spawn(ownerId);
+            if (!active) {
+                await disposeWorld();
+                return null;
+            }
+            // A sibling root can also be disposed independently. The loaded owner
+            // remains in the roster, but its gateway must cease being addressable.
+            world.effect(() => () => {
+                if (!active)
+                    return;
+                dropMount();
+                if (target && getTarget(key) === target)
+                    unregisterForeignTarget(key);
+                setReady(key, false);
+            }, `superd.world.${key}: availability`);
+            target = { key, gateway: world.get('typertGateway') };
+            registerForeignTarget(target);
+            setReady(key, true);
+            return world;
+        }
+        catch (cause) {
+            // Disposal failure must reach the owner's async disposer. Swallowing it
+            // as a cancelled boot would hide a transport that could still be alive.
+            if (!active && teardown !== undefined)
+                throw cause;
+            // A cancelled boot cannot mark a replacement ready/failed or recreate
+            // its routing entry. Active failures remain observable and fail-soft.
+            if (active)
+                onFailure(cause);
+            return null;
+        }
+    })();
+    return started;
+}

package/superd-hub/dist/world-mount.d.ts

@@ -107,4 +107,4 @@ export declare const WORLD_WAVE1_DISABLED_ROWS: readonly string[];
  * `inject: [webServer]` keeps it waiting forever, superseding a disable).
  */
 export declare const WORLD_WAVE2_DISABLED_ROWS: readonly string[];
-export declare function worldMountPatches(key: string): readonly WorldPatchLayer[];
+export declare function worldMountPatches(key: string, ownerId?: string): readonly WorldPatchLayer[];

package/superd-hub/dist/world-mount.js

@@ -125,7 +125,7 @@ export const WORLD_WAVE2_DISABLED_ROWS = [
     'ui-sidebar-right', 'ui-sidebar-terminal', 'ui-theme', 'ui-tool',
     'ui-trajectory', 'ui-user-questions', 'ui-workflow-run', 'ui-workspace',
 ];
-export function worldMountPatches(key) {
+export function worldMountPatches(key, ownerId) {
     if (typeof key !== 'string' || key === '' || key.includes('/')) {
         throw new Error(`world-mount: invalid key ${JSON.stringify(key)}`);
     }
@@ -159,7 +159,7 @@ export function worldMountPatches(key) {
         // without a startup failure (2026-09-27 wave-2 rig evidence).
         { id: 'modules', inject: ['webServer'] },
         { insert: [
-                { id: WORLD_MOUNT_ROW_ID, name: WORLD_MOUNT_PLUGIN, config: { key } },
+                { id: WORLD_MOUNT_ROW_ID, name: WORLD_MOUNT_PLUGIN, config: { key, ...(ownerId === undefined ? {} : { ownerId }) } },
                 { id: WORLD_HUB_ROW_ID, name: WORLD_HUB_PLUGIN },
             ] },
         // Wave-1 minimization: the foreign runtimes replace the native agent

package/superd-hub/package.json

@@ -8,7 +8,6 @@
     "./client": "./lib/client/index.js",
     "./world": "./dist/world-entry.js",
     "./join": "./dist/world-join.js",
-    "./web-trust": "./dist/web-trust.js",
     "./a2a": "./dist/a2a-row.js",
     "./foreign-hub": "./dist/foreign-hub.js",
     "./foreign-native": "./dist/foreign-native.js",

package/superd-hub/dist/connection-trust.d.ts

@@ -1,8 +0,0 @@
-import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
-/**
- * Use the native index authenticator as a cookie-only admission delegate.
- * A fixed, query-free index path prevents token exchange or redirects here;
- * original Host and Cookie headers preserve the native authority binding and
- * lifetime. No upstream private fields or cookie-format copies are needed.
- */
-export declare function installAuthenticationOnlyAdmission(connection: HostConnectionHandle): () => void;

package/superd-hub/dist/connection-trust.js

@@ -1,16 +0,0 @@
-/**
- * Use the native index authenticator as a cookie-only admission delegate.
- * A fixed, query-free index path prevents token exchange or redirects here;
- * original Host and Cookie headers preserve the native authority binding and
- * lifetime. No upstream private fields or cookie-format copies are needed.
- */
-export function installAuthenticationOnlyAdmission(connection) {
-    const original = connection.requestRejection;
-    const response = { writeHead() { }, end() { } };
-    connection.requestRejection = (request) => connection.authorizeIndex({
-        headers: request.headers,
-        method: 'GET',
-        url: '/index.html',
-    }, response) ? undefined : 401;
-    return () => { connection.requestRejection = original; };
-}

package/superd-hub/dist/web-trust.d.ts

@@ -1,84 +0,0 @@
-/**
- * Browser ownership and opt-in authentication-only server admission.
- * trustAllHosts skips Host/Origin restrictions while retaining native cookie
- * authentication. Existing transports and declared-authority mode are preserved.
- * Mounted on ctx0, whose connection also gates the /hub routes.
- */
-import type { Context } from '@deepseek-ai/cordis';
-import z from '@deepseek-ai/schemastery';
-/**
- * The schema-level default for `trustedPageAuthorities` (better-dsh v0.2.2a
- * shape): derive from the trusted-hosts environment — the SAME single source
- * the server-side fence legs read (`SUPERD_TRUSTED_HOSTS` on this line, upstream
- * spelling `DSH_TRUSTED_HOSTS` honored first) — so ONE declaration (e.g. one
- * `Environment=` line in the service unit) drives the server fence and the
- * page leg with zero per-instance plugin config. Bare hostnames only:
- * `location.hostname` carries no port, and {@link assertBareHostname} would
- * reject a portful entry at boot, so portful/schematic entries are dropped
- * here instead of thrown. Declared in the Config SCHEMA rather than the
- * bundle patch row because a profile/home layer row with the same id
- * whole-row-overrides the row's config object, while schema defaults fill
- * per-key at plugin load and survive every overlay layer. An explicit
- * configured value always wins.
- *
- * @param env - the raw trusted-hosts value (whitespace/comma separated).
- * @returns the bare-hostname authorities to trust by default.
- */
-export declare function deriveDefaultPageAuthorities(env: string | undefined): string[];
-/** The `webserver/index-inject` row shape this component pushes. */
-export interface BootScriptRow {
-    kind: 'script';
-    placement: 'head';
-    text: string;
-}
-/**
- * Build the authorities-leg script. Pure: same config in, same script out —
- * the unit tests pin the shape (authority match, no-overwrite guard,
- * inert-when-empty, hostile-string escaping).
- *
- * @param trustedPageAuthorities - the operator-declared hostnames.
- * @param trustAllHosts - enable browser ownership for every hostname.
- * @returns script text, or undefined for an empty declared-authority list.
- */
-export declare function buildTrustScript(trustedPageAuthorities: readonly string[] | undefined, trustAllHosts?: boolean): string | undefined;
-/** Row config schema. */
-export interface TrustConfig {
-    /** Skip address fences on server and browser; native authentication remains. */
-    trustAllHosts?: boolean;
-    /** Hostnames this operator declares their own devices' pages run on. */
-    trustedPageAuthorities?: readonly string[];
-}
-/** Row config schema (schema-level default derives from the trusted-hosts env). */
-export declare const Config: z<Schemastery.ObjectS<NoInfer<{
-    trustAllHosts: z<boolean, boolean, "defined">;
-    trustedPageAuthorities: z<string[], string[], "defined">;
-}>>, Schemastery.ObjectT<NoInfer<{
-    trustAllHosts: z<boolean, boolean, "defined">;
-    trustedPageAuthorities: z<string[], string[], "defined">;
-}>>, "plain">;
-/** Cordis plugin name. */
-export declare const name = "superd-web-trust";
-/**
- * No static injects: `webServer` is composed conditionally inside
- * {@link apply}, so the row loads (dormant) in compositions without one.
- */
-export declare const inject: string[];
-/**
- * Mount browser ownership and, when opted in, native authentication-only admission.
- * @param ctx - host plugin context.
- * @param config - the row config.
- */
-export declare function apply(ctx: Context, config: TrustConfig | undefined): void;
-declare const _default: {
-    name: string;
-    inject: string[];
-    Config: z<Schemastery.ObjectS<NoInfer<{
-        trustAllHosts: z<boolean, boolean, "defined">;
-        trustedPageAuthorities: z<string[], string[], "defined">;
-    }>>, Schemastery.ObjectT<NoInfer<{
-        trustAllHosts: z<boolean, boolean, "defined">;
-        trustedPageAuthorities: z<string[], string[], "defined">;
-    }>>, "plain">;
-    apply: typeof apply;
-};
-export default _default;

package/superd-hub/dist/web-trust.js

@@ -1,101 +0,0 @@
-/**
- * Browser ownership and opt-in authentication-only server admission.
- * trustAllHosts skips Host/Origin restrictions while retaining native cookie
- * authentication. Existing transports and declared-authority mode are preserved.
- * Mounted on ctx0, whose connection also gates the /hub routes.
- */
-import z from '@deepseek-ai/schemastery';
-import { installAuthenticationOnlyAdmission } from './connection-trust.js';
-/**
- * The schema-level default for `trustedPageAuthorities` (better-dsh v0.2.2a
- * shape): derive from the trusted-hosts environment — the SAME single source
- * the server-side fence legs read (`SUPERD_TRUSTED_HOSTS` on this line, upstream
- * spelling `DSH_TRUSTED_HOSTS` honored first) — so ONE declaration (e.g. one
- * `Environment=` line in the service unit) drives the server fence and the
- * page leg with zero per-instance plugin config. Bare hostnames only:
- * `location.hostname` carries no port, and {@link assertBareHostname} would
- * reject a portful entry at boot, so portful/schematic entries are dropped
- * here instead of thrown. Declared in the Config SCHEMA rather than the
- * bundle patch row because a profile/home layer row with the same id
- * whole-row-overrides the row's config object, while schema defaults fill
- * per-key at plugin load and survive every overlay layer. An explicit
- * configured value always wins.
- *
- * @param env - the raw trusted-hosts value (whitespace/comma separated).
- * @returns the bare-hostname authorities to trust by default.
- */
-export function deriveDefaultPageAuthorities(env) {
-    return (env ?? '').split(/[\s,]+/).filter(h => h.length > 0 && !/[:/@?#]/.test(h));
-}
-/** Assert one configured authority is a bare hostname (no port/path/scheme). */
-function assertBareHostname(entry) {
-    if (entry.length === 0 || /[:/@?#]/.test(entry)) {
-        throw new Error(`superd-web-trust: trustedPageAuthorities entry ${JSON.stringify(entry)} is not a bare hostname `
-            + '(location.hostname carries no port; an entry with port/path would never match)');
-    }
-}
-/** The IIFE framing (a throwing leg stays invisible on the page). */
-function frame(body) {
-    return ['(function(){try{', ...body, '}catch(e){}})();'].join('');
-}
-/**
- * Build the authorities-leg script. Pure: same config in, same script out —
- * the unit tests pin the shape (authority match, no-overwrite guard,
- * inert-when-empty, hostile-string escaping).
- *
- * @param trustedPageAuthorities - the operator-declared hostnames.
- * @param trustAllHosts - enable browser ownership for every hostname.
- * @returns script text, or undefined for an empty declared-authority list.
- */
-export function buildTrustScript(trustedPageAuthorities, trustAllHosts = false) {
-    if (trustAllHosts)
-        return frame(['if(!window.__DSH_TRANSPORT__)window.__DSH_TRANSPORT__={ownsHost:true};']);
-    const authorities = [...(trustedPageAuthorities ?? [])];
-    if (authorities.length === 0)
-        return undefined;
-    for (const entry of authorities)
-        assertBareHostname(entry);
-    return frame([
-        'if(!window.__DSH_TRANSPORT__){',
-        `var h=location.hostname,a=${JSON.stringify(authorities)};`,
-        'for(var i=0;i<a.length;i++)if(a[i]===h){window.__DSH_TRANSPORT__={ownsHost:true};break}',
-        '}',
-    ]);
-}
-/** The trusted-hosts single source: upstream spelling first, this line's second. */
-function trustedHostsEnv() {
-    return process.env.DSH_TRUSTED_HOSTS ?? process.env.SUPERD_TRUSTED_HOSTS;
-}
-/** Row config schema (schema-level default derives from the trusted-hosts env). */
-export const Config = z.object({
-    trustAllHosts: z.boolean().default(false),
-    trustedPageAuthorities: z.array(String).default(deriveDefaultPageAuthorities(trustedHostsEnv())),
-});
-/** Cordis plugin name. */
-export const name = 'superd-web-trust';
-/**
- * No static injects: `webServer` is composed conditionally inside
- * {@link apply}, so the row loads (dormant) in compositions without one.
- */
-export const inject = [];
-/**
- * Mount browser ownership and, when opted in, native authentication-only admission.
- * @param ctx - host plugin context.
- * @param config - the row config.
- */
-export function apply(ctx, config) {
-    if (config?.trustAllHosts) {
-        ctx.inject(['connection'], owner => {
-            owner.effect(() => installAuthenticationOnlyAdmission(owner.connection), 'superd-web-trust: authentication-only admission');
-        });
-    }
-    const authorities = config?.trustedPageAuthorities;
-    ctx.inject(['webServer'], () => {
-        ctx.on('webserver/index-inject', (table) => {
-            const text = buildTrustScript(authorities, config?.trustAllHosts);
-            if (text !== undefined)
-                table.push({ kind: 'script', placement: 'head', text });
-        });
-    });
-}
-export default { name, inject, Config, apply };