@mh-gg/base-plugins 0.1.1-alpha.20260613T085325975Z

package/src/crdt/client.mjs

@@ -0,0 +1,207 @@
+import { canonicalJson } from "@mh-gg/event";
+import { finalizeEvent, generateSecretKey, getPublicKey, verifyEvent } from "nostr-tools/pure";
+import * as Y from "yjs";
+
+export const CRDT_DOCUMENT_CHANGE_KIND = "crdt.document.change";
+export const CRDT_CURSOR_UPDATE_KIND = "crdt.cursor.update";
+export const MATTERHORN_CRDT_NOSTR_KIND = 24313;
+
+const DOCUMENT_UPDATE_FORMAT = "matterhorn.shared-doc.update.v1";
+const CURSOR_FORMAT = "matterhorn.shared-doc.cursor.v1";
+const REMOTE_ORIGIN = "matterhorn-crdt-remote";
+
+function requiredString(value, name) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`${name} is required`);
+  return value.trim();
+}
+
+function requireFunction(value, name) {
+  if (typeof value !== "function") throw new Error(`${name} is required`);
+  return value;
+}
+
+function bytesToBase64(bytes) {
+  if (typeof Buffer !== "undefined") return Buffer.from(bytes).toString("base64");
+  let binary = "";
+  for (let index = 0; index < bytes.length; index += 1) binary += String.fromCharCode(bytes[index]);
+  return btoa(binary);
+}
+
+function base64ToBytes(value) {
+  if (typeof Buffer !== "undefined") return new Uint8Array(Buffer.from(value, "base64"));
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+
+function hexToBytes(value) {
+  if (value instanceof Uint8Array) return value;
+  if (typeof value !== "string" || !/^[0-9a-f]{64}$/i.test(value)) throw new Error("privateKey must be a 32-byte hex string or Uint8Array");
+  const bytes = new Uint8Array(32);
+  for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(value.slice(index * 2, index * 2 + 2), 16);
+  return bytes;
+}
+
+function tagValue(tags, name) {
+  const tag = tags.find((item) => Array.isArray(item) && item[0] === name);
+  return typeof tag?.[1] === "string" ? tag[1] : undefined;
+}
+
+function encryptedPayload(value, kind) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("encryptRoomPayload must return an encrypted payload object");
+  if (value.encrypted !== true || value.alg !== "A256GCM") throw new Error("encryptRoomPayload returned an invalid encrypted payload");
+  if (value.kind !== undefined && value.kind !== kind) throw new Error("encryptRoomPayload returned the wrong kind");
+  if (typeof value.iv !== "string" || typeof value.data !== "string") throw new Error("encrypted payload is missing iv or data");
+  return { ...value, kind };
+}
+
+function changeFromUpdate(update) {
+  return { format: DOCUMENT_UPDATE_FORMAT, updateBase64: bytesToBase64(update) };
+}
+
+function updateFromChange(change) {
+  if (!change || change.format !== DOCUMENT_UPDATE_FORMAT || typeof change.updateBase64 !== "string") throw new Error("Invalid shared document change");
+  return base64ToBytes(change.updateBase64);
+}
+
+export function createSharedTextDocument(options = {}) {
+  const doc = options.doc || new Y.Doc();
+  const text = doc.getText(options.textName || "body");
+  const listeners = new Set();
+  const pendingUpdates = [];
+  let applyingRemote = false;
+
+  function emit() {
+    const snapshot = api.getSnapshot();
+    for (const listener of [...listeners]) listener(snapshot);
+  }
+
+  doc.on("update", (update) => {
+    if (!applyingRemote) pendingUpdates.push(new Uint8Array(update));
+    emit();
+  });
+
+  const api = {
+    getText() { return text.toString(); },
+    getSnapshot() { return { text: text.toString(), pendingUpdateCount: pendingUpdates.length }; },
+    replaceText(value) {
+      const next = String(value ?? "");
+      doc.transact(() => {
+        text.delete(0, text.length);
+        if (next) text.insert(0, next);
+      });
+    },
+    insertText(index, value) {
+      const position = Math.max(0, Math.min(Number(index) || 0, text.length));
+      text.insert(position, String(value ?? ""));
+    },
+    deleteText(index, length) {
+      const position = Math.max(0, Math.min(Number(index) || 0, text.length));
+      const count = Math.max(0, Math.min(Number(length) || 0, text.length - position));
+      if (count > 0) text.delete(position, count);
+    },
+    subscribe(listener) {
+      listeners.add(listener);
+      listener(api.getSnapshot());
+      return () => listeners.delete(listener);
+    },
+    takePendingUpdate() {
+      if (!pendingUpdates.length) return null;
+      const update = pendingUpdates.length === 1 ? pendingUpdates[0] : Y.mergeUpdates(pendingUpdates);
+      pendingUpdates.length = 0;
+      return update;
+    },
+    createChange() {
+      const update = api.takePendingUpdate();
+      return update ? changeFromUpdate(update) : null;
+    },
+    applyChange(change) {
+      const update = updateFromChange(change);
+      applyingRemote = true;
+      try {
+        Y.applyUpdate(doc, update, REMOTE_ORIGIN);
+      } finally {
+        applyingRemote = false;
+      }
+      emit();
+    },
+    encodeState() { return bytesToBase64(Y.encodeStateAsUpdate(doc)); },
+    applyEncodedState(value) { api.applyChange(changeFromUpdate(base64ToBytes(value))); }
+  };
+
+  return api;
+}
+
+export function createCrdtEventKey() {
+  return generateSecretKey();
+}
+
+export async function createEncryptedCrdtEvent(input) {
+  const roomName = requiredString(input.roomName || input.roomId, "roomName");
+  const documentId = requiredString(input.documentId, "documentId");
+  const kind = requiredString(input.kind, "kind");
+  const encryptRoomPayload = requireFunction(input.encryptRoomPayload, "encryptRoomPayload");
+  const privateKey = input.privateKey ? hexToBytes(input.privateKey) : generateSecretKey();
+  const value = { documentId, ...(input.value || {}) };
+  const payload = encryptedPayload(await encryptRoomPayload(kind, value), kind);
+  const createdAt = Number.isInteger(input.createdAt) ? input.createdAt : Date.now();
+  const event = finalizeEvent({
+    kind: MATTERHORN_CRDT_NOSTR_KIND,
+    created_at: Math.floor(createdAt / 1000),
+    tags: [
+      ["protocol", "matterhorn-sdk"],
+      ["version", "1"],
+      ["d", roomName],
+      ["crdt-doc", documentId],
+      ["crdt-kind", kind],
+      ["created-at-ms", String(createdAt)]
+    ],
+    content: canonicalJson({ payload })
+  }, privateKey);
+  if (!verifyEvent(event)) throw new Error("CRDT event signature did not verify");
+  return event;
+}
+
+export function encryptedCrdtPayload(event, expectedKind) {
+  if (!event || typeof event !== "object") throw new Error("CRDT event is required");
+  if (!verifyEvent(event)) throw new Error("CRDT event signature did not verify");
+  if (tagValue(event.tags || [], "crdt-kind") !== expectedKind) throw new Error("CRDT event kind is invalid");
+  const content = JSON.parse(event.content || "{}");
+  return encryptedPayload(content.payload, expectedKind);
+}
+
+export async function decryptCrdtEvent(event, expectedKind, decryptRoomPayload) {
+  const decrypt = requireFunction(decryptRoomPayload, "decryptRoomPayload");
+  return decrypt(expectedKind, encryptedCrdtPayload(event, expectedKind));
+}
+
+export async function createDocumentChangeEvent(input) {
+  const document = input.document || input.sharedDocument;
+  const change = input.change || document?.createChange?.();
+  if (!change) return null;
+  return createEncryptedCrdtEvent({ ...input, kind: CRDT_DOCUMENT_CHANGE_KIND, value: change });
+}
+
+export async function applyDocumentChangeEvent(input) {
+  const document = input.document || input.sharedDocument;
+  if (!document?.applyChange) throw new Error("document.applyChange is required");
+  const change = await decryptCrdtEvent(input.event, CRDT_DOCUMENT_CHANGE_KIND, input.decryptRoomPayload);
+  document.applyChange(change);
+  return change;
+}
+
+export async function createCursorEvent(input) {
+  const cursor = input.cursor && typeof input.cursor === "object" ? input.cursor : {};
+  return createEncryptedCrdtEvent({ ...input, kind: CRDT_CURSOR_UPDATE_KIND, value: { format: CURSOR_FORMAT, cursor } });
+}
+
+export async function readCursorEvent(input) {
+  const value = await decryptCrdtEvent(input.event, CRDT_CURSOR_UPDATE_KIND, input.decryptRoomPayload);
+  if (value.format !== CURSOR_FORMAT || !value.cursor || typeof value.cursor !== "object") throw new Error("Invalid cursor event");
+  return value.cursor;
+}
+
+export function publicKeyForCrdtEventKey(privateKey) {
+  return getPublicKey(hexToBytes(privateKey));
+}

package/src/crdt/index.cjs

@@ -0,0 +1,258 @@
+const { validateEvent, verifyEvent } = require("nostr-tools/pure");
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  clone,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  object,
+  readonlyState,
+  string,
+  memberOrBetter,
+  BASE_PLUGIN_VERSION,
+  CRDT_PLUGIN_ID,
+  MAX_CRDT_EVENT_BYTES,
+  MAX_CRDT_UPDATES_PER_DOCUMENT
+} = require("../shared/index.cjs");
+
+const CRDT_DOCUMENT_CHANGE_TYPE = "crdt.document.change";
+const CRDT_CURSOR_UPDATE_TYPE = "crdt.cursor.update";
+const CRDT_CURSOR_CLEAR_TYPE = "crdt.cursor.clear";
+const MATTERHORN_CRDT_NOSTR_KIND = 24313;
+const MAX_CRDT_ACTIVITY = 250;
+const RESERVED_IDS = new Set(["__proto__", "prototype", "constructor"]);
+
+function crdtId(value, name) {
+  const id = string(value, name, 200);
+  if (RESERVED_IDS.has(id)) throw new Error(`${name} is reserved`);
+  return id;
+}
+
+function tagValue(tags, name) {
+  const tag = tags.find((item) => Array.isArray(item) && item[0] === name);
+  return typeof tag?.[1] === "string" ? tag[1] : undefined;
+}
+
+function parseEventContent(event, expectedKind) {
+  let content;
+  try {
+    content = JSON.parse(event.content || "{}");
+  } catch {
+    throw new Error("CRDT event content must be JSON");
+  }
+  const payload = object(content.payload, "event.content.payload");
+  if (payload.encrypted !== true) throw new Error("CRDT event payload must be encrypted");
+  if (payload.alg !== "A256GCM") throw new Error("CRDT event payload algorithm is invalid");
+  if (payload.kind !== expectedKind) throw new Error("CRDT event payload kind is invalid");
+  string(payload.iv, "event.content.payload.iv", 2000);
+  string(payload.data, "event.content.payload.data", MAX_CRDT_EVENT_BYTES);
+  if (payload.epochId !== undefined) string(payload.epochId, "event.content.payload.epochId", 200);
+  return payload;
+}
+
+function eventPayload(value) {
+  const event = object(value, "CRDT event");
+  if (event.kind !== MATTERHORN_CRDT_NOSTR_KIND) throw new Error("CRDT event kind is invalid");
+  if (!Number.isInteger(event.created_at)) throw new Error("CRDT event created_at must be an integer");
+  string(event.id, "event.id", 160);
+  string(event.pubkey, "event.pubkey", 160);
+  string(event.sig, "event.sig", 240);
+  string(event.content, "event.content", MAX_CRDT_EVENT_BYTES);
+  event.tags = array(event.tags, "event.tags").map((tag, index) => array(tag, `event.tags[${index}]`).map((part, partIndex) => string(part, `event.tags[${index}][${partIndex}]`, 500)));
+  const json = JSON.stringify(event);
+  if (Buffer.byteLength(json, "utf8") > MAX_CRDT_EVENT_BYTES) throw new Error("CRDT event is too large");
+  if (!validateEvent(event) || !verifyEvent(event)) throw new Error("CRDT event signature did not verify");
+  return event;
+}
+
+function validateRoomEvent(roomId, documentId, event, expectedKind) {
+  if (tagValue(event.tags, "protocol") !== "matterhorn-sdk") throw new Error("CRDT event protocol is invalid");
+  if (tagValue(event.tags, "d") !== roomId) throw new Error("CRDT event room does not match operation room");
+  if (tagValue(event.tags, "crdt-doc") !== documentId) throw new Error("CRDT event document does not match operation document");
+  if (tagValue(event.tags, "crdt-kind") !== expectedKind) throw new Error("CRDT event kind tag is invalid");
+  parseEventContent(event, expectedKind);
+}
+
+function changePayload(payload) {
+  const value = object(payload, "crdt.document.change payload");
+  return { documentId: crdtId(value.documentId, "documentId"), event: eventPayload(value.event) };
+}
+
+function cursorPayload(payload) {
+  const value = object(payload, "crdt.cursor.update payload");
+  return { documentId: crdtId(value.documentId, "documentId"), event: eventPayload(value.event) };
+}
+
+function clearCursorPayload(payload) {
+  const value = object(payload, "crdt.cursor.clear payload");
+  return { documentId: crdtId(value.documentId, "documentId") };
+}
+
+function parseCrdtState(state) {
+  const value = object(state, "CRDT state");
+  object(value.documents, "documents");
+  object(value.cursors, "cursors");
+  array(value.activity, "activity");
+  return value;
+}
+
+function emptyDocument(documentId, op) {
+  return {
+    id: documentId,
+    documentId,
+    createdAt: op.createdAt,
+    createdBy: op.actor.memberId,
+    updatedAt: op.createdAt,
+    updatedBy: op.actor.memberId,
+    changeCount: 0,
+    changes: {},
+    changeOrder: []
+  };
+}
+
+function appendActivity(state, op, message, extra) {
+  return activity(state, op, message, extra).slice(-MAX_CRDT_ACTIVITY);
+}
+
+function cursorKey(actor) {
+  return `${encodeURIComponent(actor.memberId || "member")}:${encodeURIComponent(actor.deviceId || "device")}`;
+}
+
+function appendChange(state, op) {
+  const documentId = op.payload.documentId;
+  const document = state.documents[documentId] || emptyDocument(documentId, op);
+  const eventId = op.payload.event.id;
+  if (document.changes[eventId]) return state;
+  if (document.changeOrder.length >= MAX_CRDT_UPDATES_PER_DOCUMENT) throw new Error("CRDT document update limit reached");
+  const change = {
+    id: eventId,
+    eventId,
+    event: clone(op.payload.event),
+    authorId: op.actor.memberId,
+    authorName: actorName(op.actor),
+    createdAt: op.createdAt
+  };
+  const nextDocument = {
+    ...document,
+    updatedAt: op.createdAt,
+    updatedBy: op.actor.memberId,
+    changeCount: document.changeCount + 1,
+    changes: { ...document.changes, [eventId]: change },
+    changeOrder: [...document.changeOrder, eventId]
+  };
+  return {
+    ...state,
+    documents: { ...state.documents, [documentId]: nextDocument },
+    activity: appendActivity(state, op, `${actorName(op.actor)} updated a shared document`, { documentId, eventId })
+  };
+}
+
+function updateCursor(state, op) {
+  const documentId = op.payload.documentId;
+  const byDocument = state.cursors[documentId] || {};
+  const key = cursorKey(op.actor);
+  const cursor = {
+    id: key,
+    memberId: op.actor.memberId,
+    deviceId: op.actor.deviceId || null,
+    actorName: actorName(op.actor),
+    eventId: op.payload.event.id,
+    event: clone(op.payload.event),
+    updatedAt: op.createdAt
+  };
+  return { ...state, cursors: { ...state.cursors, [documentId]: { ...byDocument, [key]: cursor } } };
+}
+
+function clearCursor(state, op) {
+  const documentId = op.payload.documentId;
+  const byDocument = { ...(state.cursors[documentId] || {}) };
+  delete byDocument[cursorKey(op.actor)];
+  return { ...state, cursors: { ...state.cursors, [documentId]: byDocument } };
+}
+
+const nostrEventPayloadSchema = {
+  type: "object",
+  required: {
+    kind: { type: "number" },
+    created_at: { type: "number" },
+    tags: { type: "array", items: { type: "array", items: { type: "string" } } },
+    content: { type: "string" },
+    pubkey: { type: "string" },
+    id: { type: "string" },
+    sig: { type: "string" }
+  }
+};
+
+const crdtOperationSchemaDescriptor = {
+  [CRDT_DOCUMENT_CHANGE_TYPE]: {
+    required: { documentId: { type: "string" }, event: nostrEventPayloadSchema },
+    authorize: { roles: ["member"] }
+  },
+  [CRDT_CURSOR_UPDATE_TYPE]: {
+    required: { documentId: { type: "string" }, event: nostrEventPayloadSchema },
+    authorize: { roles: ["member"] }
+  },
+  [CRDT_CURSOR_CLEAR_TYPE]: {
+    required: { documentId: { type: "string" } },
+    authorize: { roles: ["member"] }
+  }
+};
+
+const crdtHostPlugin = defineHostPlugin({
+  id: CRDT_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Encrypted Client CRDT Events" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["crdt.shared-docs", "crdt.cursors", "crdt.encrypted-events"] },
+  stateSchemaDescriptor: { plugin: CRDT_PLUGIN_ID, shape: ["documents", "cursors", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(CRDT_PLUGIN_ID, BASE_PLUGIN_VERSION, crdtOperationSchemaDescriptor),
+  schemas: {
+    state: { parse: parseCrdtState },
+    operations: {
+      [CRDT_DOCUMENT_CHANGE_TYPE]: { parse: changePayload },
+      [CRDT_CURSOR_UPDATE_TYPE]: { parse: cursorPayload },
+      [CRDT_CURSOR_CLEAR_TYPE]: { parse: clearCursorPayload }
+    },
+    publicView: { parse: readonlyState },
+    queries: { documentChanges: { parse: readonlyState }, documentCursors: { parse: readonlyState } }
+  },
+  async createInitialState() { return { documents: {}, cursors: {}, activity: [] }; },
+  authorize(_ctx, op) {
+    return [CRDT_DOCUMENT_CHANGE_TYPE, CRDT_CURSOR_UPDATE_TYPE, CRDT_CURSOR_CLEAR_TYPE].includes(op.type) && memberOrBetter(op.actor) ? allow() : deny("Members only");
+  },
+  async reduce(ctx, state, op) {
+    if (op.type === CRDT_DOCUMENT_CHANGE_TYPE) {
+      validateRoomEvent(ctx.room.id, op.payload.documentId, op.payload.event, CRDT_DOCUMENT_CHANGE_TYPE);
+      return appendChange(state, op);
+    }
+    if (op.type === CRDT_CURSOR_UPDATE_TYPE) {
+      validateRoomEvent(ctx.room.id, op.payload.documentId, op.payload.event, CRDT_CURSOR_UPDATE_TYPE);
+      return updateCursor(state, op);
+    }
+    if (op.type === CRDT_CURSOR_CLEAR_TYPE) return clearCursor(state, op);
+    return state;
+  },
+  getPublicView(_ctx, state) { return readonlyState(state); },
+  queries: {
+    documentChanges(_ctx, state, input = {}) {
+      const documentId = crdtId(object(input, "documentChanges input").documentId, "documentId");
+      const document = state.documents[documentId];
+      return document ? document.changeOrder.map((id) => document.changes[id]) : [];
+    },
+    documentCursors(_ctx, state, input = {}) {
+      const documentId = crdtId(object(input, "documentCursors input").documentId, "documentId");
+      return Object.values(state.cursors[documentId] || {}).sort((a, b) => a.actorName.localeCompare(b.actorName));
+    }
+  }
+});
+
+module.exports = {
+  CRDT_CURSOR_CLEAR_TYPE,
+  CRDT_CURSOR_UPDATE_TYPE,
+  CRDT_DOCUMENT_CHANGE_TYPE,
+  CRDT_PLUGIN_ID,
+  MATTERHORN_CRDT_NOSTR_KIND,
+  crdtHostPlugin
+};

package/src/embeds/index.cjs

@@ -0,0 +1,90 @@
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  normalizeUrl,
+  object,
+  optionalString,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  memberOrBetter,
+  moderatorOrBetter,
+  EMBEDS_PLUGIN_ID,
+  BASE_PLUGIN_VERSION
+} = require("../shared/index.cjs");
+const { EMBED_PROVIDER_CAPABILITIES } = require("../markdown/providers/index.cjs");
+const { resolveEmbed } = require("../markdown/resolve.cjs");
+
+function parseEmbedsState(state) {
+  const value = object(state, "embeds state");
+  object(value.embeds, "embeds");
+  array(value.activity, "activity");
+  return value;
+}
+function embedAddPayload(payload) {
+  const value = object(payload, "embed.add payload");
+  return { ...scopePayload(value, "embed scope"), url: normalizeUrl(value.url), title: optionalString(value.title, "title", 180), provider: optionalString(value.provider, "provider", 80), note: optionalString(value.note, "note", 500) };
+}
+function embedRemovePayload(payload) { return { embedId: string(object(payload, "embed.remove payload").embedId, "embedId") }; }
+const embedsStateSchemaDescriptor = { plugin: EMBEDS_PLUGIN_ID, shape: ["embeds", "activity"] };
+const embedsOperationSchemaDescriptor = { "embed.add": { required: ["scopeType", "scopeId", "url"], optional: ["title", "provider", "note"], authorize: { roles: ["member"] } }, "embed.remove": { required: ["embedId"], authorize: { roles: ["member"] } } };
+const embedsHostPlugin = defineHostPlugin({
+  id: EMBEDS_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Reusable Rich Embeds" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["content.embeds", ...EMBED_PROVIDER_CAPABILITIES] },
+  stateSchemaDescriptor: embedsStateSchemaDescriptor,
+  operationSchemaDescriptor: createOperationSchemaDescriptor(EMBEDS_PLUGIN_ID, BASE_PLUGIN_VERSION, embedsOperationSchemaDescriptor),
+  schemas: {
+    state: { parse: parseEmbedsState },
+    operations: { "embed.add": { parse: embedAddPayload }, "embed.remove": { parse: embedRemovePayload } },
+    publicView: { parse: readonlyState },
+    queries: { embedsForScope: { parse: readonlyState }, embedsByProvider: { parse: readonlyState } }
+  },
+  async createInitialState() { return { embeds: {}, activity: [] }; },
+  authorize(_ctx, op) {
+    if (op.type === "embed.add") return memberOrBetter(op.actor) ? allow() : deny("Members only");
+    if (op.type === "embed.remove") return memberOrBetter(op.actor) ? allow() : deny("Members only");
+    return deny("Unsupported embed operation");
+  },
+  async reduce(_ctx, state, op) {
+    if (op.type === "embed.add") {
+      const resolved = resolveEmbed(op.payload.url, { provider: op.payload.provider, title: op.payload.title });
+      const embed = { id: entityId("embed", op), ...resolved, scopeType: op.payload.scopeType, scopeId: op.payload.scopeId, scopeKey: scopeKey(op.payload.scopeType, op.payload.scopeId), note: op.payload.note, addedBy: op.actor.memberId, addedByName: actorName(op.actor), addedAt: op.createdAt };
+      return { ...state, embeds: { ...state.embeds, [embed.id]: embed }, activity: activity(state, op, `${actorName(op.actor)} embedded ${embed.title}`, { embedId: embed.id, provider: embed.provider }) };
+    }
+    if (op.type === "embed.remove") {
+      const embed = state.embeds[op.payload.embedId];
+      if (!embed || embed.removedAt) throw new Error(`Embed ${op.payload.embedId} not found`);
+      if (!moderatorOrBetter(op.actor) && embed.addedBy !== op.actor.memberId) throw new Error("Only embed authors or moderators can remove embeds");
+      return { ...state, embeds: { ...state.embeds, [embed.id]: { ...embed, removedAt: op.createdAt, removedBy: op.actor.memberId } }, activity: activity(state, op, `${actorName(op.actor)} removed ${embed.title}`) };
+    }
+    return state;
+  },
+  getPublicView(_ctx, state) { return { ...state, embeds: Object.fromEntries(Object.entries(state.embeds).filter(([, embed]) => !embed.removedAt)) }; },
+  queries: {
+    embedsForScope(_ctx, state, input = {}) {
+      const scoped = scopePayload(input, "embedsForScope input");
+      return Object.values(state.embeds).filter((embed) => !embed.removedAt && embed.scopeType === scoped.scopeType && embed.scopeId === scoped.scopeId).sort((a, b) => a.addedAt - b.addedAt);
+    },
+    embedsByProvider(_ctx, state, input = {}) {
+      const provider = string(input.provider, "provider", 80);
+      return Object.values(state.embeds).filter((embed) => !embed.removedAt && embed.provider === provider).sort((a, b) => b.addedAt - a.addedAt);
+    }
+  },
+  methods: { resolve(_ctx, input = {}) { return resolveEmbed(object(input, "resolve input").url, input); } }
+});
+
+module.exports = {
+  EMBEDS_PLUGIN_ID,
+  embedsHostPlugin,
+  embedsOperationSchemaDescriptor,
+  embedsStateSchemaDescriptor
+};

package/src/files/index.cjs

@@ -0,0 +1,133 @@
+const {
+  allow,
+  activity,
+  actorName,
+  array,
+  createOperationSchemaDescriptor,
+  defineHostPlugin,
+  deny,
+  entityId,
+  object,
+  readonlyState,
+  scopeKey,
+  scopePayload,
+  string,
+  memberOrBetter,
+  moderatorOrBetter,
+  BASE_PLUGIN_VERSION,
+  FILES_PLUGIN_ID,
+  MAX_FILE_EVENT_BYTES,
+  MAX_FILES
+} = require("../shared/index.cjs");
+const { nostrEventToPartyEvent, validatePartyEvent } = require("@mh-gg/event");
+
+function parseFilesState(state) {
+  const value = object(state, "files state");
+  object(value.files, "files");
+  array(value.activity, "activity");
+  return value;
+}
+
+function eventPayload(value) {
+  const event = object(value, "file event");
+  string(event.id, "event.id", 160);
+  string(event.pubkey, "event.pubkey", 160);
+  string(event.sig, "event.sig", 240);
+  string(event.content, "event.content", MAX_FILE_EVENT_BYTES);
+  array(event.tags, "event.tags");
+  return event;
+}
+
+function fileUploadPayload(payload) {
+  const value = object(payload, "file.upload payload");
+  return {
+    ...scopePayload(value, "file scope"),
+    event: eventPayload(value.event)
+  };
+}
+
+function fileRemovePayload(payload) {
+  return { fileId: string(object(payload, "file.remove payload").fileId, "fileId") };
+}
+
+function validateUploadEvent(roomId, op) {
+  const partyEvent = nostrEventToPartyEvent(op.payload.event);
+  const result = validatePartyEvent(partyEvent, { now: op.createdAt, maxEventBytes: MAX_FILE_EVENT_BYTES });
+  if (!result.ok) throw new Error(result.message || "Invalid file upload event");
+  if (partyEvent.kind !== "file.upload") throw new Error("File upload event kind is invalid");
+  if (partyEvent.partyId !== roomId) throw new Error("File upload event room does not match operation room");
+  return partyEvent;
+}
+
+const nostrEventPayloadSchema = {
+  type: "object",
+  required: {
+    kind: { type: "number" },
+    created_at: { type: "number" },
+    tags: { type: "array", items: { type: "array", items: { type: "string" } } },
+    content: { type: "string" },
+    pubkey: { type: "string" },
+    id: { type: "string" },
+    sig: { type: "string" }
+  }
+};
+
+const filesHostPlugin = defineHostPlugin({
+  id: FILES_PLUGIN_ID,
+  version: BASE_PLUGIN_VERSION,
+  meta: { name: "Encrypted Nostr File Uploads" },
+  capabilities: { requires: ["room.state", "room.roles"], provides: ["content.files", "file.uploads", "file.nostr-events"] },
+  stateSchemaDescriptor: { plugin: FILES_PLUGIN_ID, shape: ["files", "activity"] },
+  operationSchemaDescriptor: createOperationSchemaDescriptor(FILES_PLUGIN_ID, BASE_PLUGIN_VERSION, {
+    "file.upload": {
+      required: { scopeType: { type: "string" }, scopeId: { type: "string" }, event: nostrEventPayloadSchema },
+      authorize: { roles: ["member"] }
+    },
+    "file.remove": { required: { fileId: { type: "string" } }, authorize: { roles: ["member"] } }
+  }),
+  schemas: {
+    state: { parse: parseFilesState },
+    operations: { "file.upload": { parse: fileUploadPayload }, "file.remove": { parse: fileRemovePayload } },
+    publicView: { parse: readonlyState },
+    queries: { filesForScope: { parse: readonlyState } }
+  },
+  async createInitialState() { return { files: {}, activity: [] }; },
+  authorize(_ctx, op) { return ["file.upload", "file.remove"].includes(op.type) ? (memberOrBetter(op.actor) ? allow() : deny("Members only")) : deny("Unsupported file operation"); },
+  async reduce(ctx, state, op) {
+    if (op.type === "file.upload") {
+      if (Object.keys(state.files).filter((id) => !state.files[id].removedAt).length >= MAX_FILES) throw new Error("File limit reached");
+      const partyEvent = validateUploadEvent(ctx.room.id, op);
+      const file = {
+        id: entityId("file", op),
+        scopeType: op.payload.scopeType,
+        scopeId: op.payload.scopeId,
+        scopeKey: scopeKey(op.payload.scopeType, op.payload.scopeId),
+        eventId: partyEvent.id,
+        event: op.payload.event,
+        uploadedBy: op.actor.memberId,
+        uploadedByName: actorName(op.actor),
+        uploadedAt: op.createdAt
+      };
+      return { ...state, files: { ...state.files, [file.id]: file }, activity: activity(state, op, `${actorName(op.actor)} uploaded an encrypted file`, { fileId: file.id, eventId: file.eventId }) };
+    }
+    if (op.type === "file.remove") {
+      const file = state.files[op.payload.fileId];
+      if (!file || file.removedAt) throw new Error(`File ${op.payload.fileId} not found`);
+      if (!moderatorOrBetter(op.actor) && file.uploadedBy !== op.actor.memberId) throw new Error("Only file uploaders or moderators can remove files");
+      return { ...state, files: { ...state.files, [file.id]: { ...file, removedAt: op.createdAt, removedBy: op.actor.memberId } }, activity: activity(state, op, `${actorName(op.actor)} removed an encrypted file`) };
+    }
+    return state;
+  },
+  getPublicView(_ctx, state) { return { ...state, files: Object.fromEntries(Object.entries(state.files).filter(([, file]) => !file.removedAt)) }; },
+  queries: {
+    filesForScope(_ctx, state, input = {}) {
+      const scoped = scopePayload(input, "filesForScope input");
+      return Object.values(state.files).filter((file) => !file.removedAt && file.scopeType === scoped.scopeType && file.scopeId === scoped.scopeId).sort((a, b) => a.uploadedAt - b.uploadedAt);
+    }
+  }
+});
+
+module.exports = {
+  FILES_PLUGIN_ID,
+  filesHostPlugin
+};