@3sln/trove 0.0.2

package/packages/web/src/platform/pluginRpc.js

@@ -0,0 +1,377 @@
+// PluginRpcRouter — the trusted boundary: every call a sandboxed plugin makes into
+// the host lands here, is capability-gated against what the user granted at install
+// time, and is then serviced against host APIs the plugin can never reach directly.
+//
+// The frame has NO ambient authority: no host DOM, no cookies, no network
+// (connect-src 'none'), no access to its own package bytes. Everything it can do is
+// one of the methods below, and each one that touches something sensitive calls
+// `cap(...)` first. Extracted from PluginHost so the allow/deny logic is one focused
+// unit rather than sharing a class with iframe lifecycle and DOM placement.
+
+import { networkEndpoints, canExecuteCommand, displayName } from './pluginPackage.js';
+import { isAllowedUrl } from './pluginNet.js';
+import { isSourceModule } from './pluginModules.js';
+import { contribUri, parseContribUri } from '@3sln/trove/core/plugins/identity.js';
+import { assertSafePluginSql } from '@3sln/trove/core/plugins/sql.js';
+
+// Response bodies larger than this are refused, so a plugin can't exhaust host
+// memory through the brokered fetch.
+const MAX_FETCH_BYTES = 25 * 1024 * 1024;
+
+/**
+ * Read a response body, aborting the moment it exceeds `max`.
+ *
+ * `await res.arrayBuffer()` then checking `.byteLength` does not achieve the thing the
+ * cap exists for: by the time the check runs the whole body is already resident, so a
+ * declared endpoint returning a multi-GB stream OOMs the tab before we ever refuse it.
+ * Check the declared length first, then enforce while streaming in case it lied.
+ */
+async function readCappedBody(res, max) {
+  const declared = Number(res.headers.get('content-length') || 0);
+  if (declared && declared > max) throw new Error('Response too large');
+  const reader = res.body?.getReader?.();
+  if (!reader) {
+    const buf = await res.arrayBuffer();
+    if (buf.byteLength > max) throw new Error('Response too large');
+    return buf;
+  }
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > max) { await reader.cancel().catch(() => {}); throw new Error('Response too large'); }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const c of chunks) { out.set(c, at); at += c.byteLength; }
+  return out.buffer;
+}
+
+export class PluginRpcRouter {
+  /**
+   * @param {object} deps
+   * @param {object} deps.platform  host services (api, commands, contributions, settings, …)
+   * @param {object} deps.clientDb  on-device scoped SQLite provider
+   * @param {import('./pluginMedia.js').MediaController} deps.media
+   * @param {import('./pluginDock.js').FrameDock} deps.dock
+   * @param {()=>void} deps.onChange  notify listeners that plugin state changed
+   */
+  constructor({ platform, clientDb, media, dock, onChange } = {}) {
+    this.platform = platform;
+    this.clientDb = clientDb;
+    this.media = media;
+    this.dock = dock;
+    this.onChange = onChange || (() => {});
+  }
+
+  // --- plugin → host RPC (calls: awaited, may return a value) -----------------
+
+  async hostCall(record, method, params, frame) {
+    const cap = (c) => { if (!record.grants.includes(c)) throw new Error(`Capability "${c}" not granted`); };
+    const pid = record.id;
+    switch (method) {
+      case 'activated': {
+        const f = frame || record.frame;
+        clearTimeout(f?._timer);
+        if (params.ok) f?.resolveActivated?.(f);
+        else f?.rejectActivated?.(new Error(params.error || 'activate() failed'));
+        return { ok: true };
+      }
+
+      // Run a command (the SDK's ctx.commands.execute). Gated per COMMAND, not per
+      // capability: the plugin's manifest lists exactly which commands it may run
+      // (plus its own, implicitly). A blanket "commands" grant would let a plugin that
+      // wanted `workbench.view.home` also call `explorer.delete`.
+      case 'command:execute': {
+        const target = this.#resolveCommand(record, params.id);
+        if (!canExecuteCommand(record.manifest, target)) {
+          throw new Error(`Command "${params.id}" is not in this plugin's declared commands`);
+        }
+        const result = await this.platform.commands.execute(target, ...(params.args || []));
+        return { ok: true, result: result ?? null };
+      }
+
+      // Drive a DECLARED status slot: push sanitized HTML into it, or show/hide it.
+      // The slot itself is a manifest contribution — this only fills one in, so a
+      // plugin can never grow its footprint in the shell past what was approved.
+      case 'ui:status': {
+        cap('ui');
+        const slot = this.#ownContribution(record, params.name, 'statusItem');
+        this.platform.contributions.update(slot.uri, {
+          ...(params.html !== undefined ? { html: String(params.html ?? '') } : {}),
+          ...(params.tooltip !== undefined ? { tooltip: String(params.tooltip ?? '') } : {}),
+          ...(params.visible !== undefined ? { visible: !!params.visible } : { visible: true }),
+        });
+        return { ok: true };
+      }
+
+      // Set a DECLARED register — a context value slot other contributions' when-clauses
+      // can read, addressed by its contribution URI.
+      case 'context:setRegister': {
+        const slot = this.#ownContribution(record, params.name, 'register');
+        this.platform.context.set(slot.uri, params.value);
+        return { ok: true };
+      }
+      // Package resources — opaque byte handles (transferred, no host URLs). Code
+      // under src/ and the manifest are not resources (src/ is loaded as modules).
+      case 'resources:list':
+        return [...record.files.keys()].filter(isResourcePath);
+      case 'resources:read': {
+        if (!isResourcePath(params.path)) throw new Error(`No such resource ${params.path}`);
+        const bytes = record.files.get(params.path);
+        if (!bytes) throw new Error(`No such resource ${params.path}`);
+        return { bytes: bytes.slice().buffer }; // copied into the iframe by structured clone
+      }
+
+      // Files — inherit the host's authenticated API client.
+      case 'files:read': return cap('files'), { text: await this.platform.api.readText(params.id) };
+      // ONE options object — `api.list(opts)`. Called as `list(pathOrId, params)` the
+      // collection became the query string's key and everything else was dropped, so a
+      // plugin asking for `photos` silently got the default collection unsorted.
+      case 'files:list': return cap('files'), this.platform.api.list({
+        collection: params.collection || params.pathOrId || undefined,
+        sort: params.sort, order: params.order, limit: params.limit, cursor: params.cursor,
+      });
+      case 'files:stat': return cap('files'), this.platform.api.stat(params.id);
+      case 'files:downloadUrl': return cap('files'), { url: this.platform.api.downloadUrl(params.id) };
+      case 'files:index': {
+        cap('indexer');
+        const ns = parseContribUri(params.indexerId) ? params.indexerId : contribUri(record.manifest, params.indexerId || 'default');
+        return this.platform.api.pushIndex(ns, params.nodeId, {
+          semanticTexts: params.semanticTexts, tags: params.tags, metadata: params.metadata,
+          documents: params.documents, facet: params.facet, // legacy
+        });
+      }
+
+      // Network — brokered by the host and confined to declared endpoints. The
+      // sandboxed frame has no direct network at all (connect-src 'none').
+      case 'net:fetch': cap('network'); return this.#brokerFetch(record, params);
+
+      // Persistent storage — an isolated SQLite database per scope (plugin/domain),
+      // on the server or on-device. SQL runs only against the plugin's own scoped db.
+      case 'storage:sql': cap('storage'); return this.#pluginSql(record, params);
+
+      // Plugin settings + secrets.
+      case 'settings:get': return this.platform.settings.get(`${pid}.${params.key}`);
+      case 'settings:getSecret': return record.secrets?.[params.key] ?? null;
+      case 'settings:set':
+        this.platform.settings.set(`${pid}.${params.key}`, params.value);
+        return { ok: true };
+
+      // Putting a panel on screen is a UI action, and this was the one `ui:` method with
+      // no check — so a plugin granted nothing at all could open its own panel (and, with
+      // an unvalidated displayName, render into the host page from `activate()`).
+      case 'ui:showPanel':
+        cap('ui');
+        record.hasUi = true;
+        this.platform.openPluginPanel?.(pid);
+        this.onChange();
+        return { ok: true };
+
+      // Media session — the host owns navigator.mediaSession; the calling frame
+      // (a viewer) surfaces its playback so the OS shows transport controls. Actions
+      // fire back over that same frame's RPC channel.
+      // Artwork is a URL the BROWSER fetches on the plugin's behalf, so it is egress
+      // and belongs under the same allowlist the broker enforces. Left open, `media`
+      // alone bought an outbound GET to any URL the plugin chose — the exfiltration
+      // channel `connect-src 'none'` and the broker exist to close.
+      case 'media:metadata': {
+        cap('media');
+        const artwork = (params.artwork || []).filter((a) => this.#artworkAllowed(record, a?.src));
+        return this.media.apply(frame, 'metadata', { ...params, artwork });
+      }
+      case 'media:playbackState': cap('media'); return this.media.apply(frame, 'playbackState', params);
+      case 'media:position': cap('media'); return this.media.apply(frame, 'position', params);
+      case 'media:action': cap('media'); return this.media.apply(frame, 'action', params);
+      case 'media:clear': return this.media.apply(frame, 'clear', params);
+
+      // Dock — the calling frame registers/unregisters itself for the floating dock.
+      case 'dock:enable': cap('dock'); if (frame) frame.dock = { enabled: true, minSize: params.minSize, maxSize: params.maxSize, dismissed: false }; return { ok: true };
+      case 'dock:disable': cap('dock'); if (frame?.dock) frame.dock.enabled = false; if (frame && this.dock.docked === frame) this.dock.closeDock(frame); return { ok: true };
+      case 'dock:close': if (frame) this.dock.closeDock(frame); return { ok: true };
+
+      default:
+        throw new Error(`Unknown host method ${method}`);
+    }
+  }
+
+  // --- plugin → host events (fire-and-forget) --------------------------------
+
+  hostEvent(record, method, params, frame) {
+    switch (method) {
+      case 'manifest':
+        // Only the primary frame's manifest defines the plugin's live feature list;
+        // a viewer frame re-announces its own (opener-only) manifest — ignore it.
+        if (frame && frame.role !== 'primary') break;
+        record.live = params; record.responsive = true;
+        this.onChange();
+        break;
+      case 'ui:toast':
+        this.platform.notifications[params.level || 'info'](`${displayName(record.manifest)}: ${params.text}`);
+        break;
+      case 'ui:badge':
+        record.badge = params.text; this.onChange();
+        break;
+    }
+  }
+
+  // --- addressing ------------------------------------------------------------
+
+  /**
+   * Resolve a command reference from inside a plugin frame. A plugin names its OWN
+   * commands by their short contribution name (that's the only name it knows); anything
+   * else must be a full address — a built-in like `explorer.download`, or another
+   * plugin's contribution URI.
+   */
+  #resolveCommand(record, id) {
+    if (!id || parseContribUri(id)) return id;
+    const own = this.platform.contributions.get(contribUri(record.manifest, id));
+    return own?.type === 'command' ? own.uri : id;
+  }
+
+  /**
+   * The plugin's own contribution called `name`, of the expected type. Anything else —
+   * a name it never declared, or one of the wrong type — is refused: a plugin drives
+   * only slots the user saw and approved at install.
+   */
+  #ownContribution(record, name, type) {
+    const c = name ? this.platform.contributions.get(contribUri(record.manifest, name)) : null;
+    if (!c || c.pluginId !== record.id || c.type !== type) {
+      throw new Error(`"${name}" is not a ${type} declared by this plugin`);
+    }
+    return c;
+  }
+
+  // --- brokered capabilities -------------------------------------------------
+
+  /**
+   * Perform a network request on a plugin's behalf, but only to a URL it declared
+   * in its manifest `network` allowlist. The request runs from the host with
+   * credentials omitted (no ambient cookies/auth), and any redirect that lands
+   * off the allowlist is rejected.
+   */
+  /** blob:/data: carry their own bytes; anything else must be a declared endpoint. */
+  #artworkAllowed(record, src) {
+    if (!src) return false;
+    if (/^(blob:|data:image\/)/i.test(src)) return true;
+    return isAllowedUrl(networkEndpoints(record.manifest), src);
+  }
+
+  async #brokerFetch(record, { url, method = 'GET', headers, body }) {
+    const allow = networkEndpoints(record.manifest);
+    // The drive itself is never a "network endpoint".
+    //
+    // The broker runs in the HOST page, which is same-origin with the API. A manifest
+    // declaring `network: ["https://*.com/"]` matches essentially any drive host, so a
+    // plugin approved only for "connect to the internet" could call /api/items,
+    // /api/items/delete, and other plugins' /api/plugins/:id/sql directly — collecting
+    // the whole `files` capability, the per-command grant system, and every other
+    // plugin's server-side store in one hop, none of which the user approved. Those
+    // routes have a legitimate caller: the host, through the capability-gated methods
+    // above.
+    if (sameOrigin(url, this.platform.api?.baseUrl)) {
+      throw new Error('Blocked: a plugin may not call the drive\'s own API through the network broker');
+    }
+    if (!isAllowedUrl(allow, url)) {
+      throw new Error(`Blocked: "${url}" is not one of this plugin's declared network endpoints`);
+    }
+    const init = { method, credentials: 'omit', redirect: 'follow', headers: sanitizeHeaders(headers) };
+    if (body != null && method !== 'GET' && method !== 'HEAD') {
+      init.body = body instanceof ArrayBuffer ? new Uint8Array(body) : body;
+    }
+    const res = await fetch(url, init);
+    // A redirect chain must not escape the declared endpoints — nor land back on the
+    // drive, which a declared endpoint is free to redirect to.
+    if (res.url && res.url !== url) {
+      if (sameOrigin(res.url, this.platform.api?.baseUrl)) {
+        throw new Error('Blocked: request redirected onto the drive\'s own API');
+      }
+      if (!isAllowedUrl(allow, res.url)) {
+        throw new Error(`Blocked: request redirected off this plugin's declared endpoints (${res.url})`);
+      }
+    }
+    const buf = await readCappedBody(res, MAX_FETCH_BYTES);
+    const outHeaders = {};
+    res.headers.forEach((v, k) => { outHeaders[k] = v; });
+    return { ok: res.ok, status: res.status, statusText: res.statusText, url: res.url, headers: outHeaders, bytes: buf };
+  }
+
+  /**
+   * Plugin storage: run a SQL op against one scoped, isolated database. `scope` is
+   * 'plugin' or 'domain' (each granted separately); `side` is 'server' or 'client'.
+   */
+  async #pluginSql(record, { scope = 'plugin', side = 'server', op, sql, params = [], statements }) {
+    if (!record.storage?.[scope]) {
+      throw new Error(`Storage scope "${scope}" not granted${scope === 'domain' ? ' (needs a verified domain)' : ''}`);
+    }
+    if (side === 'client') {
+      // On-device: an isolated wasm SQLite db per scope, held by the host. Domain
+      // scope keys by the verified domain so a vendor's plugins share it.
+      //
+      // Same guard as the server path. The client dbs share ONE emscripten module
+      // across every scope, so ATTACH / VACUUM INTO / PRAGMA are an isolation escape
+      // here for the same reason they are on disk — the blast radius is the browser's
+      // in-memory filesystem rather than the host's, which makes it smaller, not fine.
+      if (op === 'batch') for (const s of (Array.isArray(statements) ? statements : [])) assertSafePluginSql(s?.sql);
+      else assertSafePluginSql(sql);
+      const key = scope === 'domain' ? `dom:${record.manifest.domain}` : `plg:${record.id}`;
+      const db = await this.clientDb.obtain(key);
+      return runSqlOp(db, op, sql, params, statements);
+    }
+    // Server: the host proxies to the scoped db over the authenticated API; the
+    // domain (for the shared scope) comes from the verified install record, never
+    // the plugin.
+    const body = { scope, op, sql, params, statements, domain: scope === 'domain' ? record.manifest.domain : undefined };
+    const res = await this.platform.api.request('POST', `/api/plugins/${encodeURIComponent(record.id)}/sql`, { body });
+    return res.result;
+  }
+}
+
+/**
+ * Is `url` on the drive's own origin?
+ *
+ * `baseUrl` is '' in the shipped app (the API is served from the same origin as the
+ * page), so the comparison is against `location.origin`; a library caller pointing the
+ * client at another host gets that one. A redirect is checked separately, on the way
+ * back, since a declared endpoint could redirect here.
+ */
+function sameOrigin(url, baseUrl) {
+  try {
+    const here = new URL(baseUrl || '', globalThis.location?.href || 'http://localhost/');
+    return new URL(url, here).origin === here.origin;
+  } catch {
+    return false;
+  }
+}
+
+/** True for files a plugin can read as opaque resources (not code, not manifest). */
+function isResourcePath(path) {
+  return path !== 'manifest.json' && !isSourceModule(path);
+}
+
+// Drop headers the plugin isn't allowed to set (the browser forbids most of these
+// anyway; we strip explicitly so intent is clear and cookies never ride along).
+const FORBIDDEN_HEADERS = new Set(['host', 'cookie', 'cookie2', 'set-cookie', 'origin', 'referer', 'content-length', 'connection']);
+function sanitizeHeaders(headers) {
+  const out = {};
+  for (const [k, v] of Object.entries(headers || {})) {
+    if (!FORBIDDEN_HEADERS.has(String(k).toLowerCase())) out[k] = v;
+  }
+  return out;
+}
+
+// Dispatch one SQL op onto a SqliteDatabase-shaped handle (the client store; the
+// server mirrors this in routes.js).
+function runSqlOp(db, op, sql, params = [], statements) {
+  switch (op) {
+    case 'exec': return db.exec(sql);
+    case 'run': return db.run(sql, ...params);
+    case 'get': return db.get(sql, ...params);
+    case 'all': return db.all(sql, ...params);
+    case 'batch': return db.batch(statements);
+    default: throw new Error(`Unknown storage op "${op}"`);
+  }
+}

package/packages/web/src/platform/pluginSigning.js

@@ -0,0 +1,168 @@
+// Plugin package signing + domain verification, on Web Crypto.
+//
+// A package is a zip of files including manifest.json. Signing binds two things:
+//   1. every non-manifest file, via `contentHash` (SHA-256 over the sorted file
+//      set) recorded in the manifest — tamper any file and it breaks;
+//   2. the manifest itself, via an ECDSA-P256 `signature` over its canonical
+//      JSON (with `signature` removed) — tamper the manifest and it breaks.
+// The signer's public key (SPKI) travels in the manifest; its fingerprint is
+// SHA-256 of that key. A plugin is "domain verified" when the manifest declares
+// a `domain` and that domain publishes the signer's fingerprint at
+//   https://<domain>/.well-known/trove-assetlinks.json
+// (Digital-Asset-Links style), proving the domain owner vouches for the key.
+//
+// Verification is best-effort and layered: unsigned → "unverified"; signed but
+// the domain doesn't list the key → "signed (self)"; signed + listed → "verified
+// · <domain>". None of this sandboxes the plugin (the iframe does); it's a trust
+// signal for the human deciding whether to install.
+
+const enc = new TextEncoder();
+
+function b64ToBytes(b64) {
+  const bin = atob(b64.replace(/-/g, '+').replace(/_/g, '/'));
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function bytesToB64(bytes) {
+  let s = '';
+  const b = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);
+  return btoa(s);
+}
+function hex(buf) {
+  const b = new Uint8Array(buf);
+  let s = '';
+  for (let i = 0; i < b.length; i++) s += b[i].toString(16).padStart(2, '0');
+  return s;
+}
+async function sha256(bytes) {
+  return new Uint8Array(await crypto.subtle.digest('SHA-256', bytes));
+}
+
+/** Stable JSON: recursively sorted keys, `signature` stripped from the top. */
+export function canonicalManifest(manifest) {
+  const strip = { ...manifest };
+  delete strip.signature;
+  return JSON.stringify(sortKeys(strip));
+}
+function sortKeys(v) {
+  if (Array.isArray(v)) return v.map(sortKeys);
+  if (v && typeof v === 'object') {
+    const out = {};
+    for (const k of Object.keys(v).sort()) out[k] = sortKeys(v[k]);
+    return out;
+  }
+  return v;
+}
+
+/** SHA-256 over every file except manifest.json, in sorted-path order. */
+export async function contentHash(files) {
+  const paths = [...files.keys()].filter((p) => p !== 'manifest.json').sort();
+  const chunks = [];
+  for (const p of paths) {
+    const bytes = files.get(p);
+    const pathBytes = enc.encode(p);
+    const len = new Uint8Array(4);
+    new DataView(len.buffer).setUint32(0, bytes.length);
+    chunks.push(pathBytes, new Uint8Array([0]), len, bytes);
+  }
+  const total = chunks.reduce((n, c) => n + c.length, 0);
+  const buf = new Uint8Array(total);
+  let o = 0;
+  for (const c of chunks) {
+    buf.set(c, o);
+    o += c.length;
+  }
+  return hex(await sha256(buf));
+}
+
+/** SHA-256 fingerprint of an SPKI public key (lowercase hex). */
+export async function fingerprintOf(publicKeyB64) {
+  return hex(await sha256(b64ToBytes(publicKeyB64)));
+}
+export function displayFingerprint(hexStr) {
+  return (hexStr.match(/.{2}/g) || []).join(':');
+}
+
+/**
+ * Verify a package's integrity + signature (does NOT check the domain).
+ * @returns {Promise<{signed:boolean, valid:boolean, fingerprint?:string, reason?:string}>}
+ */
+export async function verifyPackage({ manifest, files }) {
+  if (!manifest.signature || !manifest.publicKey) return { signed: false, valid: false };
+  // 1. content hash binds all other files.
+  const expected = await contentHash(files);
+  if (manifest.contentHash && manifest.contentHash !== expected) {
+    return { signed: true, valid: false, reason: 'File contents do not match the manifest hash' };
+  }
+  // 2. signature binds the manifest.
+  try {
+    const key = await crypto.subtle.importKey('spki', b64ToBytes(manifest.publicKey), { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
+    const ok = await crypto.subtle.verify({ name: 'ECDSA', hash: 'SHA-256' }, key, b64ToBytes(manifest.signature), enc.encode(canonicalManifest(manifest)));
+    if (!ok) return { signed: true, valid: false, reason: 'Signature does not verify' };
+    return { signed: true, valid: true, fingerprint: await fingerprintOf(manifest.publicKey) };
+  } catch (err) {
+    return { signed: true, valid: false, reason: 'Bad key/signature: ' + err.message };
+  }
+}
+
+/**
+ * Given the domain's assetlinks doc, is this key fingerprint vouched for this plugin?
+ * Format:
+ *   { "version": 1, "keys": [ { "fingerprint": "<hex|colon-hex>", "plugins": ["docs" | "*"] } ] }
+ *
+ * The doc is served BY the domain, so a plugin is named by its name within that domain
+ * ("docs"); the fully-qualified "acme.com/docs" is accepted too, for docs that prefer
+ * to be explicit.
+ */
+export function checkAssetlinks(assetlinks, fingerprint, manifest) {
+  const norm = (f) => (f || '').toLowerCase().replace(/:/g, '');
+  const want = norm(fingerprint);
+  const names = [manifest.name, `${manifest.domain}/${manifest.name}`];
+  for (const k of assetlinks?.keys || []) {
+    if (norm(k.fingerprint) !== want) continue;
+    if ((k.plugins || []).some((p) => p === '*' || names.includes(p))) return true;
+  }
+  return false;
+}
+
+/**
+ * Full trust status for a package.
+ * @param {(domain:string)=>Promise<object|null>} fetchAssetlinks  resolves the domain's assetlinks doc (or null)
+ * @returns {Promise<{status:'unverified'|'invalid'|'signed'|'verified', domain?:string, fingerprint?:string, reason?:string}>}
+ */
+export async function assessTrust({ manifest, files }, fetchAssetlinks) {
+  const sig = await verifyPackage({ manifest, files });
+  if (!sig.signed) return { status: 'unverified', reason: 'Package is not signed' };
+  // A present-but-failed signature is evidence of tampering — a distinct, alarming
+  // status, NOT the same grey "unverified" as an ordinary unsigned package.
+  if (!sig.valid) return { status: 'invalid', reason: sig.reason || 'Invalid signature — the package may have been tampered with' };
+  let doc = null;
+  try {
+    doc = await fetchAssetlinks(manifest.domain);
+  } catch { /* unreachable domain */ }
+  if (doc && checkAssetlinks(doc, sig.fingerprint, manifest)) {
+    return { status: 'verified', domain: manifest.domain, fingerprint: sig.fingerprint };
+  }
+  return { status: 'signed', domain: manifest.domain, fingerprint: sig.fingerprint, reason: doc ? 'Domain does not list this key' : 'Could not reach the domain' };
+}
+
+// --- signing (tooling / tests) ---------------------------------------------
+
+export async function generateSigningKey() {
+  return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+}
+
+/** Produce a signed manifest for a package. Returns the manifest with
+ *  contentHash + publicKey + signature filled in. */
+export async function signManifest(manifest, files, keyPair) {
+  const withHash = { ...manifest, contentHash: await contentHash(files) };
+  const spki = new Uint8Array(await crypto.subtle.exportKey('spki', keyPair.publicKey));
+  withHash.publicKey = bytesToB64(spki);
+  const sig = new Uint8Array(await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, keyPair.privateKey, enc.encode(canonicalManifest(withHash))));
+  withHash.signature = bytesToB64(sig);
+  return withHash;
+}
+
+export { b64ToBytes, bytesToB64 };

package/packages/web/src/platform/pluginStore.js

@@ -0,0 +1,67 @@
+// PluginRegistry — install records (manifest, package files, granted caps, trust
+// status, settings, secrets) persisted in IndexedDB so plugins survive reloads on
+// this device. Package bytes stay on-device (they can be large); non-secret
+// settings can also be mirrored to the server (see the settings service) so they
+// follow the user. A plugin's OWN data lives in per-scope SQLite databases (server
+// via the host API; on-device via the wasm store) — not here.
+
+const DB = 'trove-plugins';
+const STORE = 'installs';
+
+function openDb() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(DB, 1);
+    req.onupgradeneeded = () => {
+      const db = req.result;
+      if (!db.objectStoreNames.contains(STORE)) db.createObjectStore(STORE, { keyPath: 'id' });
+    };
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+function tx(db, mode, fn) {
+  return new Promise((resolve, reject) => {
+    const t = db.transaction(STORE, mode);
+    const s = t.objectStore(STORE);
+    let out;
+    Promise.resolve(fn(s)).then((r) => (out = r));
+    t.oncomplete = () => resolve(out);
+    t.onerror = () => reject(t.error);
+  });
+}
+const reqP = (r) => new Promise((res, rej) => { r.onsuccess = () => res(r.result); r.onerror = () => rej(r.error); });
+
+export class PluginRegistry {
+  constructor() {
+    this._db = null;
+  }
+  async #db() {
+    return (this._db ??= await openDb());
+  }
+  /** record: { id, manifest, files:{path:Uint8Array}, grants, trust, settings, secrets, installedAt } */
+  async save(record) {
+    const db = await this.#db();
+    await tx(db, 'readwrite', (s) => s.put(record));
+    return record;
+  }
+  async get(id) {
+    const db = await this.#db();
+    return tx(db, 'readonly', (s) => reqP(s.get(id)));
+  }
+  async list() {
+    const db = await this.#db();
+    return tx(db, 'readonly', (s) => reqP(s.getAll()));
+  }
+  async remove(id) {
+    const db = await this.#db();
+    await tx(db, 'readwrite', (s) => s.delete(id));
+  }
+  async patch(id, patch) {
+    const rec = await this.get(id);
+    if (!rec) return null;
+    const next = { ...rec, ...patch };
+    await this.save(next);
+    return next;
+  }
+}
+