@mh-gg/base-plugins 0.1.1-alpha.20260613T085325975Z

package/README.md

@@ -0,0 +1,247 @@
+# Matterhorn reusable example plugins
+
+`@mh-gg/base-plugins` contains reusable Matterhorn backend plugins for common collaboration, content, media, and workflow features.
+
+The package intentionally lives under `examples/` rather than `packages/` because these are product-facing PoC plugins, not frozen Matterhorn core APIs yet.
+
+
+## Source layout
+
+The package is intentionally organized by composable capability. There is no root `plugins.cjs`, `workflow.cjs`, or `markdown.cjs` catch-all implementation file. Each reusable backend owns a folder with an `index.cjs` barrel, while markdown and embed providers are further split by concern:
+
+```text
+packages/base-plugins/src/
+  comments/
+  presence/
+  media-rooms/
+  screen-share/
+  markdown/
+    parser/
+    documents/
+    providers/
+      video.cjs
+      audio.cjs
+      cloud.cjs
+      images.cjs
+      social.cjs
+      developer.cjs
+      maps.cjs
+      productivity.cjs
+      games.cjs
+      direct.cjs
+  embeds/
+  attachments/
+  files/
+  reactions/
+  labels/
+  approvals/
+  checklists/
+  calendar/
+  composer/
+  shared/
+```
+
+`src/index.cjs` is only a public barrel. New reusable capabilities should be added as a folder, registered in `composer/`, and covered by focused backend tests. The structure test fails if the old generic catch-all files return or if a source file grows beyond the composability budget.
+
+The package also exposes subpath imports for focused consumption, for example `@mh-gg/base-plugins/comments`, `@mh-gg/base-plugins/markdown`, `@mh-gg/base-plugins/embeds`, and `@mh-gg/base-plugins/composer`. Apps can still use the root barrel when they want the full example toolkit.
+
+## Brainstormed plugin families now implemented
+
+| Selection key | Plugin | Provides | Reuse target |
+| --- | --- | --- | --- |
+| `comments` | `com.matterhorn.examples.plugins.comments` | Threaded comments, edit/delete, reactions, resolve/reopen | Kanban cards, wiki pages, polls, expenses, deals, event discussion |
+| `presence` | `com.matterhorn.examples.plugins.presence` | Member status/activity/location | Chat, CRM, live planning, support dashboards |
+| `mediaRooms` | `com.matterhorn.examples.plugins.media-rooms` | Voice/video/stage room state and membership | Discord-like rooms, event ops calls, project standups |
+| `screenShare` | `com.matterhorn.examples.plugins.screen-share` | Screen-share session state | Chat demos, event run-of-show, design reviews |
+| `markdown` | `com.matterhorn.examples.plugins.markdown` | Markdown document storage, sanitized AST, parser extension API, inline/directive embeds | Wiki pages, event briefs, kanban specs, CRM notes |
+| `embeds` | `com.matterhorn.examples.plugins.embeds` | Shareable media/link cards for YouTube, Spotify, Dropbox, Google Drive, Google Photos, generic HTTPS links | Chat channels, wiki pages, event planning, docs |
+| `attachments` | `com.matterhorn.examples.plugins.attachments` | External cloud-file attachment records backed by the embed resolver | Dropbox/Drive/Photos links attached to any app scope |
+| `files` | `com.matterhorn.examples.plugins.files` | Encrypted Nostr file upload events scoped to app objects | Wiki pages, docs, rooms that need key-gated local files |
+| `reactions` | `com.matterhorn.examples.plugins.reactions` | Scoped emoji reactions independent of comments/messages | Cards, pages, polls, events, announcements |
+| `labels` | `com.matterhorn.examples.plugins.labels` | Reusable labels/tags and per-scope assignments | Kanban, CRM, wiki, budget categories |
+| `approvals` | `com.matterhorn.examples.plugins.approvals` | Reusable review/approval requests and decisions | Expenses, event runbooks, wiki docs, CRM deal review |
+| `checklists` | `com.matterhorn.examples.plugins.checklists` | Scoped checklists and item completion | Event tasks, kanban cards, launch plans, CRM onboarding |
+| `calendar` | `com.matterhorn.examples.plugins.calendar` | Scoped scheduled events/timeline entries | Event schedule, project milestones, CRM follow-ups |
+
+## Markdown parser and markdown plugins
+
+The markdown parser is self-contained and returns a sanitized AST instead of HTML. Frontends render nodes/components themselves, which keeps embedded media policy explicit.
+
+Supported core syntax:
+
+- headings
+- paragraphs
+- unordered lists
+- blockquotes
+- fenced code blocks
+- markdown links
+- bare links
+- media directives
+
+Media directive syntax:
+
+```md
+::youtube[Architecture walkthrough](https://youtu.be/dQw4w9WgXcQ)
+::spotify[Launch playlist](https://open.spotify.com/playlist/37i9dQZF1DXcBWIGoYBM5M)
+::drive[Spec](https://drive.google.com/file/d/abc123/view)
+::dropbox[Runbook](https://www.dropbox.com/s/example/runbook.pdf?dl=0)
+::gphotos[Album](https://photos.app.goo.gl/example)
+::embed[Related link](https://example.com/story)
+```
+
+Custom markdown plugins implement:
+
+```js
+const { defineMarkdownPlugin, parseMarkdown } = require("@mh-gg/base-plugins");
+
+const figmaPlugin = defineMarkdownPlugin({
+  id: "markdown.embed.figma",
+  provider: "figma",
+  aliases: ["figma"],
+  matchUrl(url) { return new URL(url).hostname === "www.figma.com"; },
+  toEmbed(url, ctx) {
+    return {
+      provider: "figma",
+      kind: "design",
+      title: ctx.title || "Figma file",
+      url,
+      externalUrl: url,
+      renderMode: "card",
+      metadata: {}
+    };
+  }
+});
+
+const ast = parseMarkdown("::figma[Mockup](https://www.figma.com/file/demo)", {
+  plugins: [figmaPlugin]
+});
+```
+
+
+## RES-inspired embeddable auto-detection
+
+Matterhorn now ships a broad, declarative provider registry inspired by the public Reddit Enhancement Suite media host registry. The implementation is Matterhorn-native and intentionally stores structured embed metadata rather than HTML. RES's list is used as a checklist for coverage: video, audio, image, code, document, map, social, gaming, meme, and direct-file providers.
+
+Auto-detection works in three places:
+
+1. `parseMarkdown(markdown)` resolves markdown links, bare links, and `::provider[title](url)` directives into `parsed.embeds`.
+2. `autoDetectEmbeds(text)` scans arbitrary chat/comment text and returns deduped embed records, with `includeGeneric: false` available for rich-only detection.
+3. `resolveEmbed(url)` detects one URL and returns a provider-specific record.
+
+The default provider list currently covers YouTube, Spotify, Google Drive, Google Photos, Dropbox, Vimeo, SoundCloud, Bandcamp, Apple Music, Twitch, Dailymotion, Streamable, Streamja, Coub, Imgur, Giphy, Tenor, Redgifs, Gfycat, Gyazo, Flickr, 500px, DeviantArt, Photobucket, Pixiv, Tumblr, Twitter/X media, Instagram, Facebook video, TikTok, Twitter/X posts, Bluesky, Reddit media/gallery/post/poll links, Imgflip, CodePen, JSFiddle, GitHub, Gist, Pastebin, Hastebin, Wikipedia, Google Maps, OpenStreetMap, Ride with GPS, OneDrive, Figma, Notion, Loom, Canva, Miro, Excalidraw, Steam, XboxDVR/GameDVR, xkcd, Strawpoll, PeerTube, Clyp, GetYarn, direct images, direct videos, direct audio, direct PDFs, and generic HTTPS cards.
+
+```js
+const { autoDetectEmbeds, parseMarkdown, resolveEmbed } = require("@mh-gg/base-plugins");
+
+const embeds = autoDetectEmbeds(
+  "Watch https://vimeo.com/123456789 and review https://www.figma.com/file/abc123/demo",
+  { includeGeneric: false }
+);
+
+const ast = parseMarkdown("::twitch[Live room](https://www.twitch.tv/matterhorn)");
+const embed = resolveEmbed("https://codepen.io/user/pen/abc123");
+```
+
+## Composition API
+
+Use the suite API rather than hand-building plugin arrays. It gives every example deterministic ordering, duplicate removal, manifest-friendly plugin entries, and capability summaries.
+
+```js
+const { HostPluginRuntime } = require("@mh-gg/host-runtime");
+const { kanbanHostPlugin } = require("@mh-gg/example-kanban");
+const { createCollaborationPluginSuite, composeHostPlugins } = require("@mh-gg/base-plugins");
+
+const collaboration = createCollaborationPluginSuite(["comments", "markdown", "embeds", "checklists"]);
+
+const runtime = new HostPluginRuntime({
+  room,
+  plugins: composeHostPlugins(kanbanHostPlugin, collaboration),
+  authenticateActor
+});
+```
+
+The app-specific plugin owns domain state. Reusable plugins own cross-cutting collaboration features. For example, a Kanban app does not need to implement card comments itself; it can dispatch `comments.add` with `{ scopeType: "kanban-card", scopeId: cardId, body }`.
+
+### Presets
+
+```js
+createCollaborationPluginSuite("comments");      // comments only
+createCollaborationPluginSuite("collaboration"); // comments + presence
+createCollaborationPluginSuite("media");         // media rooms + screen share
+createCollaborationPluginSuite("content");       // markdown + embeds + files
+createCollaborationPluginSuite("docs");          // markdown + embeds + files + comments + labels
+createCollaborationPluginSuite("workflow");      // labels + approvals + checklists + calendar
+createCollaborationPluginSuite("project");       // comments + presence + workflow helpers
+createCollaborationPluginSuite("community");     // chat/community primitives: comments, presence, media, screen share, markdown, embeds, reactions
+createCollaborationPluginSuite("all");           // every reusable plugin in canonical order
+```
+
+Aliases such as `voice`, `video`, `screen`, `discussion`, `youtube`, `spotify`, `dropbox`, `drive`, `docs`, `workflow`, and each plugin ID are accepted, but the returned suite is always normalized into canonical order.
+
+## Operation examples
+
+```js
+client.dispatch({
+  pluginId: "com.matterhorn.examples.plugins.markdown",
+  type: "markdown.document.upsert",
+  payload: {
+    scopeType: "wiki-page",
+    scopeId: "page_123",
+    title: "Launch brief",
+    markdown: "# Launch\n\n::youtube[Demo](https://youtu.be/dQw4w9WgXcQ)"
+  }
+});
+
+client.dispatch({
+  pluginId: "com.matterhorn.examples.plugins.embeds",
+  type: "embed.add",
+  payload: {
+    scopeType: "channel",
+    scopeId: "general",
+    url: "https://open.spotify.com/track/4uLU6hMCjMI75M1A2tKUQC",
+    title: "Launch song"
+  }
+});
+
+client.dispatch({
+  pluginId: "com.matterhorn.examples.plugins.files",
+  type: "file.upload",
+  payload: {
+    scopeType: "wiki-page",
+    scopeId: "page_123",
+    event: encryptedNostrFileUploadEvent
+  }
+});
+
+client.dispatch({
+  pluginId: "com.matterhorn.examples.plugins.approvals",
+  type: "approval.request",
+  payload: {
+    scopeType: "budget-expense",
+    scopeId: "expense_123",
+    title: "Approve venue deposit",
+    requiredRole: "admin"
+  }
+});
+```
+
+## Tests
+
+```bash
+pnpm --dir packages/base-plugins run test
+pnpm run test:examples
+```
+
+The tests prove that suites normalize composition, reject conflicts, expose capabilities, run together in one Matterhorn host runtime, parse markdown with extension-driven media plugins, resolve YouTube/Spotify/Dropbox/Google Drive/Google Photos links, and let apps reuse backend reducers without copying code.
+
+## Schema-first composition
+
+Reusable plugins also publish JSON-safe micro-plugin schemas and JSON Schema contracts via:
+
+```js
+const { listMicroPluginSchemas, createAppCompositionSchema, loadAppCompositionSchemaFile } = require("@mh-gg/schema");
+```
+
+Apps should compose shared capabilities with `app.json` + `composition.json` instead of importing reusable host plugin implementations directly. `composition.json` may use local `$imports` for `model.json`, `actions.json`, and other fragments. The app builder resolves that JSON through the trusted local registry only at build/install time. This keeps common implementation code inside the micro-plugin package and keeps app packages focused on domain behavior and frontend code.
+
+See `docs/SCHEMA_COMPOSITION.md` and `docs/JSON_SCHEMA_COMPOSITION.md` for the schema format, import rules, and test lanes.

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@mh-gg/base-plugins",
+  "version": "0.1.1-alpha.20260613T085325975Z",
+  "description": "Reusable Matterhorn base plugins for comments, presence, media rooms, markdown, embeds, attachments, encrypted files, reactions, labels, approvals, checklists, and calendar state.",
+  "type": "commonjs",
+  "main": "src/index.cjs",
+  "exports": {
+    ".": "./src/index.cjs",
+    "./comments": "./src/comments/index.cjs",
+    "./presence": "./src/presence/index.cjs",
+    "./media-rooms": "./src/media-rooms/index.cjs",
+    "./screen-share": "./src/screen-share/index.cjs",
+    "./markdown": "./src/markdown/index.cjs",
+    "./markdown/parser": "./src/markdown/parser/index.cjs",
+    "./markdown/resolve": "./src/markdown/resolve.cjs",
+    "./embeds": "./src/embeds/index.cjs",
+    "./attachments": "./src/attachments/index.cjs",
+    "./files": "./src/files/index.cjs",
+    "./reactions": "./src/reactions/index.cjs",
+    "./labels": "./src/labels/index.cjs",
+    "./approvals": "./src/approvals/index.cjs",
+    "./checklists": "./src/checklists/index.cjs",
+    "./calendar": "./src/calendar/index.cjs",
+    "./location-pins": "./src/location-pins/index.cjs",
+    "./crdt": "./src/crdt/index.cjs",
+    "./crdt/client": "./src/crdt/client.mjs",
+    "./composer": "./src/composer/index.cjs",
+    "./composer/registry": "./src/composer/registry.cjs"
+  },
+  "dependencies": {
+    "nostr-tools": "^2.23.5",
+    "yjs": "^13.6.27",
+    "@mh-gg/base": "^0.1.1-alpha.20260613T085325975Z",
+    "@mh-gg/event": "^0.1.1-alpha.20260613T085325975Z",
+    "@mh-gg/host-runtime": "^0.1.1-alpha.20260613T085325975Z",
+    "@mh-gg/protocol": "^0.1.1-alpha.20260613T085325975Z"
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "matterhorn-sdk": {
+    "plugins": "./src/index.cjs"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.cjs",
+    "coverage": "node --test --experimental-test-coverage --test-coverage-lines=80 --test-coverage-functions=80 --test-coverage-branches=70 --test-coverage-include=src/**/*.cjs test/*.test.cjs"
+  }
+}

package/src/approvals/index.cjs

@@ -0,0 +1,65 @@
+const { APPROVALS_PLUGIN_ID, APPROVALS_PLUGIN_KEY } = require("../shared/constants.cjs");
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  enumValue,
+  memberOrBetter,
+  moderatorOrBetter,
+  object,
+  optionalString,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  BASE_PLUGIN_VERSION
+} = require("../shared/index.cjs");
+
+const { adminOrOwner } = require("../shared/index.cjs");
+const adminOrBetter = adminOrOwner;
+function parseAssignees(value) { if (value === undefined || value === null) return []; if (!Array.isArray(value)) throw new Error("assigneeIds must be an array"); return value.map((entry, index) => string(entry, `assigneeIds[${index}]`, 120)); }
+
+function approvalRequestPayload(payload) { const value = object(payload, "approval.request payload"); return { ...scopePayload(value), title: string(value.title, "title", 160), description: optionalString(value.description, "description", 1000), requiredRole: enumValue(value.requiredRole || "moderator", "requiredRole", ["moderator", "admin", "owner"]), assigneeIds: parseAssignees(value.assigneeIds) }; }
+function approvalDecisionPayload(payload) { const value = object(payload, "approval.decide payload"); return { requestId: string(value.requestId, "requestId"), decision: enumValue(value.decision, "decision", ["approved", "rejected", "changes-requested"]), note: optionalString(value.note, "note", 1000) }; }
+const approvalsHostPlugin = defineHostPlugin({
+  id: APPROVALS_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable Approval Requests" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["workflow.approvals", "workflow.review"] },
+  stateSchemaDescriptor: { plugin: APPROVALS_PLUGIN_ID, shape: ["requests", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(APPROVALS_PLUGIN_ID, BASE_PLUGIN_VERSION, {
+    "approval.request": {
+      required: { scopeType: { type: "string" }, scopeId: { type: "string" }, title: { type: "string" } },
+      optional: {
+        description: { type: "string" },
+        requiredRole: { type: "enum", values: ["moderator", "admin", "owner"] },
+        assigneeIds: { type: "array", items: { type: "string" } }
+      },
+      authorize: { roles: ["member"] }
+    },
+    "approval.decide": {
+      required: { requestId: { type: "string" }, decision: { type: "enum", values: ["approved", "rejected", "changes-requested"] } },
+      optional: { note: { type: "string" } },
+      authorize: { roles: ["moderator"] }
+    }
+  }),
+  schemas: { state: { parse(value) { const state = object(value, "approvals state"); object(state.requests, "requests"); array(state.activity, "activity"); return state; } }, operations: { "approval.request": { parse: approvalRequestPayload }, "approval.decide": { parse: approvalDecisionPayload } }, publicView: { parse: readonlyState }, queries: { openApprovals: { parse: readonlyState }, approvalsForScope: { parse: readonlyState } } },
+  async createInitialState() { return { requests: {}, activity: [] }; },
+  authorize(_ctx, op) { if (op.type === "approval.request") return memberOrBetter(op.actor) ? allow() : deny("Members only"); if (op.type === "approval.decide") return moderatorOrBetter(op.actor) ? allow() : deny("Moderators only"); return deny("Unsupported approval operation"); },
+  async reduce(_ctx, state, op) {
+    if (op.type === "approval.request") { const request = { id: entityId("approval", op), ...op.payload, requestedBy: op.actor.memberId, requestedByName: actorName(op.actor), requestedAt: op.createdAt, status: "open", decisions: [] }; return { ...state, requests: { ...state.requests, [request.id]: request }, activity: activity(state, op, `${actorName(op.actor)} requested approval: ${request.title}`) }; }
+    const request = state.requests[op.payload.requestId]; if (!request) throw new Error(`Approval request ${op.payload.requestId} not found`);
+    if (request.requiredRole === "admin" && !adminOrBetter(op.actor)) throw new Error("Admins only");
+    const decision = { decision: op.payload.decision, note: op.payload.note, decidedBy: op.actor.memberId, decidedByName: actorName(op.actor), decidedAt: op.createdAt };
+    return { ...state, requests: { ...state.requests, [request.id]: { ...request, status: op.payload.decision, decisions: [...request.decisions, decision], closedAt: op.createdAt } }, activity: activity(state, op, `${actorName(op.actor)} ${op.payload.decision} ${request.title}`) };
+  },
+  getPublicView(_ctx, state) { return state; },
+  queries: { openApprovals(_ctx, state) { return Object.values(state.requests).filter((request) => request.status === "open").sort((a, b) => a.requestedAt - b.requestedAt); }, approvalsForScope(_ctx, state, input = {}) { const scoped = scopePayload(input, "approvalsForScope input"); return Object.values(state.requests).filter((request) => request.scopeType === scoped.scopeType && request.scopeId === scoped.scopeId).sort((a, b) => a.requestedAt - b.requestedAt); } }
+});
+
+module.exports = { APPROVALS_PLUGIN_ID, APPROVALS_PLUGIN_KEY, approvalsHostPlugin };

package/src/attachments/index.cjs

@@ -0,0 +1,75 @@
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  normalizeUrl,
+  object,
+  optionalString,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  memberOrBetter,
+  moderatorOrBetter,
+  ATTACHMENTS_PLUGIN_ID,
+  BASE_PLUGIN_VERSION,
+  MAX_ATTACHMENTS
+} = require("../shared/index.cjs");
+const { resolveEmbed } = require("../markdown/resolve.cjs");
+
+function parseAttachmentsState(state) {
+  const value = object(state, "attachments state");
+  object(value.attachments, "attachments");
+  array(value.activity, "activity");
+  return value;
+}
+function attachmentAddPayload(payload) {
+  const value = object(payload, "attachment.add payload");
+  return { ...scopePayload(value, "attachment scope"), url: normalizeUrl(value.url), title: string(value.title, "title", 180), mimeType: optionalString(value.mimeType, "mimeType", 120), sizeBytes: value.sizeBytes === undefined ? null : Number(value.sizeBytes), provider: optionalString(value.provider, "provider", 80), note: optionalString(value.note, "note", 500) };
+}
+function attachmentRemovePayload(payload) { return { attachmentId: string(object(payload, "attachment.remove payload").attachmentId, "attachmentId") }; }
+const attachmentsHostPlugin = defineHostPlugin({
+  id: ATTACHMENTS_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable External Attachments" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["content.attachments", "attachment.external-links", "attachment.cloud-media"] },
+  stateSchemaDescriptor: { plugin: ATTACHMENTS_PLUGIN_ID, shape: ["attachments", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(ATTACHMENTS_PLUGIN_ID, BASE_PLUGIN_VERSION, {
+    "attachment.add": {
+      required: { scopeType: { type: "string" }, scopeId: { type: "string" }, url: { type: "string" }, title: { type: "string" } },
+      optional: { mimeType: { type: "string" }, sizeBytes: { type: "number" }, provider: { type: "string" }, note: { type: "string" } },
+      authorize: { roles: ["member"] }
+    },
+    "attachment.remove": { required: { attachmentId: { type: "string" } }, authorize: { roles: ["member"] } }
+  }),
+  schemas: { state: { parse: parseAttachmentsState }, operations: { "attachment.add": { parse: attachmentAddPayload }, "attachment.remove": { parse: attachmentRemovePayload } }, publicView: { parse: readonlyState }, queries: { attachmentsForScope: { parse: readonlyState } } },
+  async createInitialState() { return { attachments: {}, activity: [] }; },
+  authorize(_ctx, op) { return ["attachment.add", "attachment.remove"].includes(op.type) ? (memberOrBetter(op.actor) ? allow() : deny("Members only")) : deny("Unsupported attachment operation"); },
+  async reduce(_ctx, state, op) {
+    if (op.type === "attachment.add") {
+      if (Object.keys(state.attachments).filter((id) => !state.attachments[id].removedAt).length >= MAX_ATTACHMENTS) throw new Error("Attachment limit reached");
+      const resolved = resolveEmbed(op.payload.url, { provider: op.payload.provider, title: op.payload.title });
+      const attachment = { id: entityId("att", op), scopeType: op.payload.scopeType, scopeId: op.payload.scopeId, scopeKey: scopeKey(op.payload.scopeType, op.payload.scopeId), title: op.payload.title, url: op.payload.url, provider: op.payload.provider || resolved.provider, kind: resolved.kind, renderMode: resolved.renderMode, embed: resolved, mimeType: op.payload.mimeType, sizeBytes: op.payload.sizeBytes, note: op.payload.note, addedBy: op.actor.memberId, addedByName: actorName(op.actor), addedAt: op.createdAt };
+      return { ...state, attachments: { ...state.attachments, [attachment.id]: attachment }, activity: activity(state, op, `${actorName(op.actor)} attached ${attachment.title}`) };
+    }
+    if (op.type === "attachment.remove") {
+      const attachment = state.attachments[op.payload.attachmentId];
+      if (!attachment || attachment.removedAt) throw new Error(`Attachment ${op.payload.attachmentId} not found`);
+      if (!moderatorOrBetter(op.actor) && attachment.addedBy !== op.actor.memberId) throw new Error("Only attachment authors or moderators can remove attachments");
+      return { ...state, attachments: { ...state.attachments, [attachment.id]: { ...attachment, removedAt: op.createdAt, removedBy: op.actor.memberId } }, activity: activity(state, op, `${actorName(op.actor)} removed ${attachment.title}`) };
+    }
+    return state;
+  },
+  getPublicView(_ctx, state) { return { ...state, attachments: Object.fromEntries(Object.entries(state.attachments).filter(([, attachment]) => !attachment.removedAt)) }; },
+  queries: { attachmentsForScope(_ctx, state, input = {}) { const scoped = scopePayload(input, "attachmentsForScope input"); return Object.values(state.attachments).filter((attachment) => !attachment.removedAt && attachment.scopeType === scoped.scopeType && attachment.scopeId === scoped.scopeId).sort((a, b) => a.addedAt - b.addedAt); } }
+});
+
+module.exports = {
+  ATTACHMENTS_PLUGIN_ID,
+  attachmentsHostPlugin
+};

package/src/calendar/index.cjs

@@ -0,0 +1,48 @@
+const { CALENDAR_PLUGIN_ID, CALENDAR_PLUGIN_KEY } = require("../shared/constants.cjs");
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  memberOrBetter,
+  moderatorOrBetter,
+  object,
+  optionalString,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  BASE_PLUGIN_VERSION
+} = require("../shared/index.cjs");
+
+const { number } = require("../shared/index.cjs");
+
+function calendarEventPayload(payload) { const value = object(payload, "calendar.event payload"); return { ...scopePayload(value), title: string(value.title, "title", 180), startsAt: number(value.startsAt, "startsAt", { min: 0 }), endsAt: value.endsAt === undefined ? null : number(value.endsAt, "endsAt", { min: 0 }), location: optionalString(value.location, "location", 240), description: optionalString(value.description, "description", 1000) }; }
+function calendarIdPayload(payload) { return { eventId: string(object(payload, "calendar id payload").eventId, "eventId") }; }
+const calendarHostPlugin = defineHostPlugin({
+  id: CALENDAR_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable Calendar Timeline" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["calendar.events", "timeline.schedule"] },
+  stateSchemaDescriptor: { plugin: CALENDAR_PLUGIN_ID, shape: ["events", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(CALENDAR_PLUGIN_ID, BASE_PLUGIN_VERSION, {
+    "calendar.event.create": {
+      required: { scopeType: { type: "string" }, scopeId: { type: "string" }, title: { type: "string" }, startsAt: { type: "number" } },
+      optional: { endsAt: { type: "number" }, location: { type: "string" }, description: { type: "string" } },
+      authorize: { roles: ["member"] }
+    },
+    "calendar.event.cancel": { required: { eventId: { type: "string" } }, authorize: { roles: ["moderator"] } }
+  }),
+  schemas: { state: { parse(value) { const state = object(value, "calendar state"); object(state.events, "events"); array(state.activity, "activity"); return state; } }, operations: { "calendar.event.create": { parse: calendarEventPayload }, "calendar.event.cancel": { parse: calendarIdPayload } }, publicView: { parse: readonlyState }, queries: { upcomingEvents: { parse: readonlyState }, eventsForScope: { parse: readonlyState } } },
+  async createInitialState() { return { events: {}, activity: [] }; },
+  authorize(_ctx, op) { if (op.type === "calendar.event.create") return memberOrBetter(op.actor) ? allow() : deny("Members only"); if (op.type === "calendar.event.cancel") return moderatorOrBetter(op.actor) ? allow() : deny("Moderators only"); return deny("Unsupported calendar operation"); },
+  async reduce(_ctx, state, op) { if (op.type === "calendar.event.create") { const event = { id: entityId("cal", op), ...op.payload, createdBy: op.actor.memberId, createdByName: actorName(op.actor), createdAt: op.createdAt }; return { ...state, events: { ...state.events, [event.id]: event }, activity: activity(state, op, `${actorName(op.actor)} scheduled ${event.title}`) }; } const event = state.events[op.payload.eventId]; if (!event || event.cancelledAt) throw new Error(`Calendar event ${op.payload.eventId} not found`); return { ...state, events: { ...state.events, [event.id]: { ...event, cancelledAt: op.createdAt, cancelledBy: op.actor.memberId } }, activity: activity(state, op, `${actorName(op.actor)} cancelled ${event.title}`) }; },
+  getPublicView(_ctx, state) { return { ...state, events: Object.fromEntries(Object.entries(state.events).filter(([, event]) => !event.cancelledAt)) }; },
+  queries: { upcomingEvents(_ctx, state, input = {}) { const now = Number(input.now || 0); return Object.values(state.events).filter((event) => !event.cancelledAt && event.startsAt >= now).sort((a, b) => a.startsAt - b.startsAt); }, eventsForScope(_ctx, state, input = {}) { const scoped = scopePayload(input, "eventsForScope input"); return Object.values(state.events).filter((event) => !event.cancelledAt && event.scopeType === scoped.scopeType && event.scopeId === scoped.scopeId).sort((a, b) => a.startsAt - b.startsAt); } }
+});
+
+module.exports = { CALENDAR_PLUGIN_ID, CALENDAR_PLUGIN_KEY, calendarHostPlugin };

package/src/checklists/index.cjs

@@ -0,0 +1,58 @@
+const { CHECKLISTS_PLUGIN_ID, CHECKLISTS_PLUGIN_KEY } = require("../shared/constants.cjs");
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  enumValue,
+  memberOrBetter,
+  moderatorOrBetter,
+  object,
+  optionalString,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  BASE_PLUGIN_VERSION
+} = require("../shared/index.cjs");
+
+const { boolean } = require("../shared/index.cjs");
+const bool = boolean;
+
+function checklistCreatePayload(payload) { const value = object(payload, "checklist.create payload"); return { ...scopePayload(value), title: string(value.title, "title", 160), items: (value.items || []).map((item, index) => string(item, `items[${index}]`, 240)) }; }
+function checklistItemPayload(payload) { const value = object(payload, "checklist.item payload"); return { checklistId: string(value.checklistId, "checklistId"), text: string(value.text, "text", 240) }; }
+function checklistTogglePayload(payload) { const value = object(payload, "checklist.toggle payload"); return { checklistId: string(value.checklistId, "checklistId"), itemId: string(value.itemId, "itemId"), completed: value.completed === undefined ? true : bool(value.completed) }; }
+const checklistsHostPlugin = defineHostPlugin({
+  id: CHECKLISTS_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable Checklists" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["workflow.checklists", "task.check-items"] },
+  stateSchemaDescriptor: { plugin: CHECKLISTS_PLUGIN_ID, shape: ["checklists", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(CHECKLISTS_PLUGIN_ID, BASE_PLUGIN_VERSION, {
+    "checklist.create": {
+      required: { scopeType: { type: "string" }, scopeId: { type: "string" }, title: { type: "string" } },
+      optional: { items: { type: "array", items: { type: "string" } } },
+      authorize: { roles: ["member"] }
+    },
+    "checklist.item.add": { required: { checklistId: { type: "string" }, text: { type: "string" } }, authorize: { roles: ["member"] } },
+    "checklist.item.toggle": { required: { checklistId: { type: "string" }, itemId: { type: "string" } }, optional: { completed: { type: "boolean" } }, authorize: { roles: ["member"] } }
+  }),
+  schemas: { state: { parse(value) { const state = object(value, "checklists state"); object(state.checklists, "checklists"); array(state.activity, "activity"); return state; } }, operations: { "checklist.create": { parse: checklistCreatePayload }, "checklist.item.add": { parse: checklistItemPayload }, "checklist.item.toggle": { parse: checklistTogglePayload } }, publicView: { parse: readonlyState }, queries: { checklistsForScope: { parse: readonlyState } } },
+  async createInitialState() { return { checklists: {}, activity: [] }; },
+  authorize(_ctx, op) { return ["checklist.create", "checklist.item.add", "checklist.item.toggle"].includes(op.type) ? (memberOrBetter(op.actor) ? allow() : deny("Members only")) : deny("Unsupported checklist operation"); },
+  async reduce(_ctx, state, op) {
+    if (op.type === "checklist.create") { const checklistId = entityId("checklist", op); const checklist = { id: checklistId, scopeType: op.payload.scopeType, scopeId: op.payload.scopeId, scopeKey: scopeKey(op.payload.scopeType, op.payload.scopeId), title: op.payload.title, items: op.payload.items.map((text, index) => ({ id: `${checklistId}_item_${index + 1}`, text, completed: false })), createdBy: op.actor.memberId, createdAt: op.createdAt }; return { ...state, checklists: { ...state.checklists, [checklist.id]: checklist }, activity: activity(state, op, `${actorName(op.actor)} created checklist ${checklist.title}`) }; }
+    const checklist = state.checklists[op.payload.checklistId]; if (!checklist) throw new Error(`Checklist ${op.payload.checklistId} not found`);
+    if (op.type === "checklist.item.add") { const item = { id: `${op.payload.checklistId}_item_${checklist.items.length + 1}_${op.id.replace(/[^a-zA-Z0-9_-]/g, "_")}`, text: op.payload.text, completed: false }; return { ...state, checklists: { ...state.checklists, [checklist.id]: { ...checklist, items: [...checklist.items, item], updatedAt: op.createdAt } } }; }
+    const item = checklist.items.find((candidate) => candidate.id === op.payload.itemId); if (!item) throw new Error(`Checklist item ${op.payload.itemId} not found`);
+    return { ...state, checklists: { ...state.checklists, [checklist.id]: { ...checklist, items: checklist.items.map((candidate) => candidate.id === item.id ? { ...candidate, completed: op.payload.completed, completedBy: op.payload.completed ? op.actor.memberId : undefined, completedAt: op.payload.completed ? op.createdAt : undefined } : candidate), updatedAt: op.createdAt } } };
+  },
+  getPublicView(_ctx, state) { return state; },
+  queries: { checklistsForScope(_ctx, state, input = {}) { const scoped = scopePayload(input, "checklistsForScope input"); return Object.values(state.checklists).filter((checklist) => checklist.scopeType === scoped.scopeType && checklist.scopeId === scoped.scopeId); } }
+});
+
+module.exports = { CHECKLISTS_PLUGIN_ID, CHECKLISTS_PLUGIN_KEY, checklistsHostPlugin };

package/src/comments/index.cjs

@@ -0,0 +1,15 @@
+const { COMMENTS_PLUGIN_ID } = require("../shared/index.cjs");
+const schemas = require("./schemas.cjs");
+const state = require("./state.cjs");
+const { commentsHostPlugin } = require("./plugin.cjs");
+const threads = require("./threads.cjs");
+const views = require("./views.cjs");
+
+module.exports = {
+  COMMENTS_PLUGIN_ID,
+  ...schemas,
+  ...state,
+  ...threads,
+  ...views,
+  commentsHostPlugin
+};

package/src/comments/plugin.cjs

@@ -0,0 +1,66 @@
+const { allow, createOperationSchemaDescriptor,
+  defineHostPlugin, deny, memberOrBetter, moderatorOrBetter, readonlyState, BASE_PLUGIN_VERSION, COMMENTS_PLUGIN_ID } = require("../shared/index.cjs");
+const {
+  commentsAddPayload,
+  commentsDeletePayload,
+  commentsEditPayload,
+  commentsOperationSchemaDescriptor,
+  commentsReactPayload,
+  commentsResolvePayload,
+  commentsThreadPayload
+} = require("./schemas.cjs");
+const { commentsStateSchemaDescriptor, createInitialCommentsState, parseCommentsState } = require("./state.cjs");
+const { reduceCommentsState } = require("./reducer.cjs");
+const { commentsForScope, countForScope, publicCommentsView, unresolvedThreads } = require("./views.cjs");
+
+function commentScope(state, payload = {}) {
+  if (payload.scopeType && payload.scopeId) return { scopeType: payload.scopeType, scopeId: payload.scopeId };
+  const thread = state.threads?.[payload.threadId] || state.threads?.[state.comments?.[payload.commentId]?.threadId];
+  return thread ? { scopeType: thread.scopeType, scopeId: thread.scopeId } : undefined;
+}
+
+function requireScopeEdit(ctx, op) {
+  const scope = commentScope(ctx.pluginState || {}, op.payload || {});
+  if (!scope) return deny("Comment scope is required");
+  return ctx.access.canEdit(scope.scopeType, scope.scopeId) ? allow() : deny("Scoped edit access required");
+}
+
+function authorizeCommentsOperation(ctx, op) {
+  if (["comments.thread.create", "comments.add", "comments.react"].includes(op.type)) return memberOrBetter(op.actor) ? requireScopeEdit(ctx, op) : deny("Members only");
+  if (["comments.edit", "comments.delete"].includes(op.type)) return memberOrBetter(op.actor) ? requireScopeEdit(ctx, op) : deny("Members only");
+  if (op.type === "comments.resolve") {
+    if (!moderatorOrBetter(op.actor)) return deny("Moderators only");
+    return requireScopeEdit(ctx, op);
+  }
+  return deny("Unsupported comments operation");
+}
+
+const commentsHostPlugin = defineHostPlugin({
+  id: COMMENTS_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable Comments" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["comments.threaded", "comments.reactions", "comments.attachable"] },
+  stateSchemaDescriptor: commentsStateSchemaDescriptor,
+  operationSchemaDescriptor: createOperationSchemaDescriptor(COMMENTS_PLUGIN_ID, BASE_PLUGIN_VERSION, commentsOperationSchemaDescriptor),
+  schemas: {
+    state: { parse: parseCommentsState },
+    operations: {
+      "comments.thread.create": { parse: commentsThreadPayload },
+      "comments.add": { parse: commentsAddPayload },
+      "comments.edit": { parse: commentsEditPayload },
+      "comments.react": { parse: commentsReactPayload },
+      "comments.delete": { parse: commentsDeletePayload },
+      "comments.resolve": { parse: commentsResolvePayload }
+    },
+    publicView: { parse: readonlyState },
+    queries: { commentsForScope: { parse: readonlyState }, unresolvedThreads: { parse: readonlyState } }
+  },
+  async createInitialState() { return createInitialCommentsState(); },
+  authorize: authorizeCommentsOperation,
+  reduce: reduceCommentsState,
+  getPublicView: publicCommentsView,
+  queries: { commentsForScope, unresolvedThreads },
+  methods: { countForScope }
+});
+
+module.exports = { authorizeCommentsOperation, commentsHostPlugin };