@mh-gg/base 0.1.1-alpha.20260613T085325975Z

package/src/packs/artifacts.cjs

@@ -0,0 +1,174 @@
+const fs = require("node:fs/promises");
+const path = require("node:path");
+const { fileURLToPath } = require("node:url");
+const { APP_PACK_KIND, HOST_PACK_KIND, PLAYER_PACK_KIND } = require("../constants.cjs");
+const { fail } = require("../errors.cjs");
+const { assertManifestIntegrity, manifestHash, sha256Bytes } = require("../manifest/hashing.cjs");
+const { isObject, requireObject, requireString, requireHash, validateAppPackManifest, validateHostPackManifest, validatePackRef, validatePlayerPackManifest } = require("../manifest/validators.cjs");
+
+function normalizePackRef(ref, name = "packRef") {
+  if (typeof ref === "string") return { url: ref };
+  const value = requireObject(ref, name);
+  const normalized = { url: requireString(value.url, `${name}.url`) };
+  if (value.integrity !== undefined) normalized.integrity = requireHash(value.integrity, `${name}.integrity`);
+  if (value.kind !== undefined) normalized.kind = requireString(value.kind, `${name}.kind`);
+  return normalized;
+}
+
+function isHttpUrl(url) {
+  return /^https?:\/\//.test(url);
+}
+
+function isLocalhost(hostname) {
+  return ["localhost", "127.0.0.1", "::1"].includes(String(hostname || "").toLowerCase());
+}
+
+function assertRemotePackFetchAllowed(packRef, options = {}) {
+  if (!isHttpUrl(packRef.url)) return;
+  let parsed;
+  try { parsed = new URL(packRef.url); } catch { fail(`Invalid remote pack URL ${packRef.url}`); }
+  if (parsed.protocol === "http:" && !isLocalhost(parsed.hostname) && options.allowInsecureHttp !== true) {
+    fail("Insecure HTTP pack references are disabled by default. Use HTTPS or pass allowInsecureHttp for trusted local development.");
+  }
+  const hasIntegrity = Boolean(packRef.integrity || options.expectedIntegrity);
+  if (!hasIntegrity && options.allowRemoteWithoutIntegrity !== true) {
+    fail("Remote pack artifact integrity is required by default.");
+  }
+}
+
+function pathFromFileUrlOrPath(url) {
+  if (url.startsWith("file:")) return fileURLToPath(url);
+  return path.resolve(url);
+}
+
+function isPathInside(child, parent) {
+  const relative = path.relative(parent, child);
+  return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+async function loadPackArtifact(ref, options = {}) {
+  const packRef = normalizePackRef(ref);
+  let bytes;
+  let source = packRef.url;
+
+  if (packRef.url.startsWith("workspace:")) {
+    if (typeof options.workspaceResolver !== "function") fail(`No workspace resolver for ${packRef.url}`);
+    const resolved = await options.workspaceResolver(packRef.url);
+    if (Buffer.isBuffer(resolved)) bytes = resolved;
+    else if (typeof resolved === "string") bytes = Buffer.from(resolved);
+    else bytes = Buffer.from(JSON.stringify(resolved));
+  } else if (isHttpUrl(packRef.url)) {
+    assertRemotePackFetchAllowed(packRef, options);
+    if (typeof options.fetch !== "function") fail(`No fetch implementation for ${packRef.url}`);
+    const response = await options.fetch(packRef.url);
+    if (!response || (response.ok === false)) fail(`Unable to fetch ${packRef.url}`);
+    const arrayBuffer = typeof response.arrayBuffer === "function" ? await response.arrayBuffer() : Buffer.from(await response.text());
+    bytes = Buffer.from(arrayBuffer);
+  } else {
+    bytes = await fs.readFile(pathFromFileUrlOrPath(packRef.url));
+  }
+
+  const contentHash = sha256Bytes(bytes);
+  if (packRef.integrity && packRef.integrity !== contentHash) {
+    return { ok: false, code: "INTEGRITY_MISMATCH", url: source, expected: packRef.integrity, actual: contentHash, bytes };
+  }
+  return { ok: true, url: source, contentHash, bytes };
+}
+
+function validatorForKind(kind) {
+  if (kind === APP_PACK_KIND) return validateAppPackManifest;
+  if (kind === HOST_PACK_KIND) return validateHostPackManifest;
+  if (kind === PLAYER_PACK_KIND) return validatePlayerPackManifest;
+  fail(`Unsupported manifest kind ${kind}`);
+}
+
+async function loadPackManifest(ref, options = {}) {
+  const packRef = normalizePackRef(ref);
+  const artifact = await loadPackArtifact({ ...packRef, integrity: undefined }, { ...options, expectedIntegrity: packRef.integrity || options.expectedIntegrity });
+  if (!artifact.ok) return artifact;
+  let manifest;
+  try {
+    manifest = JSON.parse(artifact.bytes.toString("utf8"));
+  } catch (error) {
+    return { ok: false, code: "MALFORMED_JSON", url: artifact.url, error: error.message };
+  }
+  if (!manifest || typeof manifest.kind !== "string") return { ok: false, code: "MANIFEST_KIND_MISSING", url: artifact.url };
+  if (packRef.kind && manifest.kind !== packRef.kind) return { ok: false, code: "MANIFEST_KIND_MISMATCH", url: artifact.url, expected: packRef.kind, actual: manifest.kind };
+  try {
+    validatorForKind(manifest.kind)(manifest);
+  } catch (error) {
+    return { ok: false, code: "MANIFEST_INVALID", url: artifact.url, error: error.message };
+  }
+  const contentHash = artifact.contentHash;
+  const hash = manifestHash(manifest);
+  if (packRef.integrity && packRef.integrity !== contentHash && packRef.integrity !== hash) {
+    return { ok: false, code: "INTEGRITY_MISMATCH", url: artifact.url, expected: packRef.integrity, actual: contentHash, manifestHash: hash };
+  }
+  return { ok: true, url: artifact.url, contentHash, manifestHash: hash, manifest };
+}
+
+function parsePackReferenceUrl(url) {
+  const text = requireString(url, "url");
+  const hashIndex = text.indexOf("#");
+  const base = hashIndex === -1 ? text : text.slice(0, hashIndex);
+  const exportName = hashIndex === -1 ? undefined : text.slice(hashIndex + 1);
+
+  if (text.startsWith("workspace:")) {
+    const body = base.slice("workspace:".length);
+    if (!body) fail("workspace pack reference is missing a package name");
+    return { scheme: "workspace", packageName: body, exportName };
+  }
+  if (text.startsWith("file:")) {
+    const filePath = base.slice("file:".length);
+    if (!filePath) fail("file pack reference is missing a path");
+    return { scheme: "file", path: filePath, exportName };
+  }
+  if (text.startsWith("http://") || text.startsWith("https://")) return { scheme: "http", url: base, exportName };
+  fail(`Unsupported pack reference URL ${text}`);
+}
+
+async function readJsonFile(filePath, options = {}) {
+  const baseDir = options.baseDir || process.cwd();
+  const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(baseDir, filePath);
+  if (options.baseDir && options.allowFileOutsideBase !== true && !isPathInside(resolved, path.resolve(baseDir))) {
+    fail("File pack reference escapes the configured base directory");
+  }
+  return JSON.parse(await fs.readFile(resolved, "utf8"));
+}
+
+function resolveWorkspaceExport(registry, parsed, originalUrl) {
+  if (registry?.[originalUrl] !== undefined) return registry[originalUrl];
+  const packageEntry = registry?.[parsed.packageName];
+  if (packageEntry === undefined) fail(`Workspace pack ${parsed.packageName} is not registered`);
+  if (!parsed.exportName) return packageEntry;
+  if (packageEntry[parsed.exportName] === undefined) fail(`Workspace pack ${parsed.packageName} does not export ${parsed.exportName}`);
+  return packageEntry[parsed.exportName];
+}
+
+async function loadPackReference(ref, options = {}) {
+  const packRef = validatePackRef(ref, "pack reference");
+  const parsed = parsePackReferenceUrl(packRef.url);
+  let manifest;
+  if (parsed.scheme === "workspace") manifest = resolveWorkspaceExport(options.workspace || options.registry, parsed, packRef.url);
+  else if (parsed.scheme === "file") {
+    manifest = await readJsonFile(parsed.path, options);
+    if (parsed.exportName) manifest = manifest[parsed.exportName];
+  } else if (parsed.scheme === "http") {
+    assertRemotePackFetchAllowed({ url: parsed.url, integrity: packRef.integrity }, options);
+    if (typeof options.fetchJson !== "function") fail("fetchJson is required for HTTP pack references");
+    manifest = await options.fetchJson(parsed.url);
+    if (parsed.exportName) manifest = manifest[parsed.exportName];
+  }
+  if (!isObject(manifest)) fail("Pack reference did not resolve to a manifest object");
+  assertManifestIntegrity(manifest, packRef.integrity);
+  return manifest;
+}
+
+module.exports = {
+  assertRemotePackFetchAllowed,
+  loadPackArtifact,
+  loadPackManifest,
+  loadPackReference,
+  normalizePackRef,
+  parsePackReferenceUrl
+};

package/src/packs/registry.cjs

@@ -0,0 +1,28 @@
+const { fail } = require("../errors.cjs");
+const { manifestHash } = require("../manifest/hashing.cjs");
+const { requireString } = require("../manifest/validators.cjs");
+
+function createInMemoryPackRegistry(initial = {}) {
+  const manifests = new Map();
+  for (const [url, manifest] of Object.entries(initial)) manifests.set(url, JSON.parse(JSON.stringify(manifest)));
+  return {
+    publish(url, manifest) {
+      requireString(url, "url");
+      manifests.set(url, JSON.parse(JSON.stringify(manifest)));
+      return { url, integrity: manifestHash(manifest) };
+    },
+    async fetchJson(url) {
+      if (!manifests.has(url)) fail(`Manifest ${url} not found`);
+      return JSON.parse(JSON.stringify(manifests.get(url)));
+    },
+    ref(url) {
+      if (!manifests.has(url)) fail(`Manifest ${url} not found`);
+      return { url, integrity: manifestHash(manifests.get(url)) };
+    },
+    list() {
+      return [...manifests.keys()];
+    }
+  };
+}
+
+module.exports = { createInMemoryPackRegistry };

package/src/players/index.cjs

@@ -0,0 +1,80 @@
+const { fail } = require("../errors.cjs");
+const { requireArray, requireObject, requireString, validateAppPackManifest, validatePlayerPackManifest, validatePlayerSupport } = require("../manifest/validators.cjs");
+
+function definePlayerPlugin(plugin) {
+  const value = requireObject(plugin, "player plugin");
+  requireString(value.id, "player plugin.id");
+  requireString(value.version, "player plugin.version");
+  if (value.supports !== undefined) requireArray(value.supports, "player plugin.supports").forEach((support, index) => validatePlayerSupport(support, `player plugin.supports[${index}]`));
+  return value;
+}
+
+function parseSemver(value, name) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(requireString(value, name));
+  if (!match) fail(`${name} must be a x.y.z version`);
+  return match.slice(1).map((part) => Number(part));
+}
+
+function compareSemver(left, right) {
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] - right[index];
+  }
+  return 0;
+}
+
+function satisfiesVersion(version, range) {
+  if (range === "*") return true;
+  if (range.startsWith("^")) {
+    const actual = parseSemver(version, "version");
+    const base = parseSemver(range.slice(1), "range");
+    return actual[0] === base[0] && compareSemver(actual, base) >= 0;
+  }
+  return version === range;
+}
+
+function playerSupportsApp(playerPack, appPack) {
+  const player = validatePlayerPackManifest(playerPack);
+  const app = validateAppPackManifest(appPack);
+  return player.supports.some((support) =>
+    support.appPackId === app.id &&
+    support.appProtocolHash === app.compatibility.appProtocolHash &&
+    satisfiesVersion(app.version, support.appPackRange)
+  );
+}
+
+function includes(value, candidate) {
+  return Array.isArray(value) && value.includes(candidate);
+}
+
+function scorePlayerPack(player, input) {
+  let score = 0;
+  const roomId = input.room?.id;
+  if (roomId && input.userPreferences?.defaultByRoom?.[roomId] === player.id) score += 1000;
+  if (input.userPreferences?.defaultByAppPack?.[input.appPack.id] === player.id) score += 500;
+  if (input.groupPreferences?.recommendedFrontends?.[input.appPack.id] === player.id) score += 250;
+  if (includes(player.recommendedFor?.devices, input.device?.class)) score += 100;
+  if (input.actor && includes(player.recommendedFor?.roles, input.actor.role)) score += 100;
+  if (input.device?.lowBandwidth && includes(player.recommendedFor?.devices, "low-bandwidth")) score += 50;
+  return score;
+}
+
+function choosePlayerPacks(input) {
+  const value = requireObject(input, "input");
+  const appPack = validateAppPackManifest(value.appPack);
+  const playerPacks = requireArray(value.playerPacks, "playerPacks");
+  const isTrustedPublisher = value.isTrustedPublisher || (() => true);
+
+  return playerPacks
+    .filter((player) => playerSupportsApp(player, appPack))
+    .filter((player) => isTrustedPublisher(player.publisher))
+    .map((player) => ({ player, score: scorePlayerPack(player, { ...value, appPack }) }))
+    .sort((left, right) => right.score - left.score || left.player.id.localeCompare(right.player.id))
+    .map((entry) => entry.player);
+}
+
+module.exports = {
+  choosePlayerPacks,
+  definePlayerPlugin,
+  playerSupportsApp,
+  satisfiesVersion
+};

package/src/plugins/graph.cjs

@@ -0,0 +1,194 @@
+const { fail } = require("../errors.cjs");
+const { createCapabilityPrompt, evaluateCapabilityGrant } = require("../capabilities.cjs");
+const { hashCanonical, manifestHash } = require("../manifest/hashing.cjs");
+const { satisfiesVersion } = require("../players/index.cjs");
+const { requireArray, requireHash, requireObject, requireString, validateAppPackManifest, validateHostPackManifest } = require("../manifest/validators.cjs");
+
+function normalizePluginDependency(dep, name) {
+  const value = requireObject(dep, name);
+  return {
+    id: requireString(value.id, `${name}.id`),
+    range: value.range === undefined ? "*" : requireString(value.range, `${name}.range`),
+    optional: Boolean(value.optional)
+  };
+}
+
+function pluginIdentity(plugin) {
+  const value = requireObject(plugin, "plugin");
+  return {
+    id: requireString(value.id, "plugin.id"),
+    version: requireString(value.version, "plugin.version"),
+    stateSchemaHash: value.stateSchemaHash || hashCanonical(value.schemas?.state?.descriptor || value.schemas?.state || {}),
+    operationSchemaHash: value.operationSchemaHash || hashCanonical(value.operationSchemaDescriptor || {}),
+    eventSchemaHash: value.eventSchemaHash
+  };
+}
+
+function pluginDependencies(plugin) {
+  const raw = plugin.dependencies || {};
+  const required = (raw.required || []).map((dep, index) => normalizePluginDependency(dep, `${plugin.id}.dependencies.required[${index}]`));
+  const optional = (raw.optional || []).map((dep, index) => ({ ...normalizePluginDependency(dep, `${plugin.id}.dependencies.optional[${index}]`), optional: true }));
+  const conflicts = (plugin.conflicts || []).map((dep, index) => normalizePluginDependency(dep, `${plugin.id}.conflicts[${index}]`));
+  return { required, optional, conflicts };
+}
+
+function resolvePluginGraph(plugins) {
+  const input = requireArray(plugins, "plugins", { nonEmpty: true });
+  const byId = new Map();
+  for (const plugin of input) {
+    const id = requireString(plugin.id, "plugin.id");
+    if (byId.has(id)) fail(`Duplicate plugin ${id}`);
+    byId.set(id, plugin);
+  }
+
+  for (const plugin of byId.values()) {
+    const deps = pluginDependencies(plugin);
+    for (const dep of deps.required) {
+      const target = byId.get(dep.id);
+      if (!target) fail(`Plugin ${plugin.id} requires missing dependency ${dep.id}`);
+      if (!satisfiesVersion(target.version, dep.range)) fail(`Plugin ${plugin.id} requires ${dep.id} ${dep.range}, got ${target.version}`);
+    }
+    for (const conflict of deps.conflicts) {
+      const target = byId.get(conflict.id);
+      if (target && satisfiesVersion(target.version, conflict.range)) fail(`Plugin ${plugin.id} conflicts with ${conflict.id} ${target.version}`);
+    }
+  }
+
+  const ordered = [];
+  const visiting = new Set();
+  const visited = new Set();
+  function visit(plugin, pathStack = []) {
+    if (visited.has(plugin.id)) return;
+    if (visiting.has(plugin.id)) fail(`Plugin dependency cycle: ${[...pathStack, plugin.id].join(" -> ")}`);
+    visiting.add(plugin.id);
+    const deps = pluginDependencies(plugin);
+    for (const dep of [...deps.required, ...deps.optional].sort((a, b) => a.id.localeCompare(b.id))) {
+      const target = byId.get(dep.id);
+      if (target) visit(target, [...pathStack, plugin.id]);
+    }
+    visiting.delete(plugin.id);
+    visited.add(plugin.id);
+    ordered.push(plugin);
+  }
+  for (const plugin of [...byId.values()].sort((a, b) => a.id.localeCompare(b.id))) visit(plugin);
+
+  const descriptors = ordered.map(pluginIdentity);
+  return { plugins: ordered, descriptors, pluginGraphHash: hashCanonical(descriptors) };
+}
+
+function normalizeHostPluginDescriptor(value, name = "hostPlugins[]") {
+  const plugin = requireObject(value, name);
+  return {
+    id: requireString(plugin.id, `${name}.id`),
+    version: requireString(plugin.version, `${name}.version`),
+    stateSchemaHash: requireHash(plugin.stateSchemaHash, `${name}.stateSchemaHash`),
+    operationSchemaHash: requireHash(plugin.operationSchemaHash, `${name}.operationSchemaHash`),
+    ...(plugin.eventSchemaHash === undefined ? {} : { eventSchemaHash: requireHash(plugin.eventSchemaHash, `${name}.eventSchemaHash`) })
+  };
+}
+
+function normalizeHostPluginDescriptors(hostPlugins) {
+  return requireArray(hostPlugins, "hostPlugins", { nonEmpty: true })
+    .map((plugin, index) => normalizeHostPluginDescriptor(plugin, `hostPlugins[${index}]`))
+    .sort((left, right) => left.id.localeCompare(right.id) || left.version.localeCompare(right.version));
+}
+
+function computeAppProtocolHash(input) {
+  const value = requireObject(input, "input");
+  const appPackId = requireString(value.appPackId, "appPackId");
+  const appVersion = requireString(value.appVersion, "appVersion");
+  const plugins = normalizeHostPluginDescriptors(value.hostPlugins);
+  return hashCanonical({ appPackId, appVersion, plugins });
+}
+
+function createMatterhornAppContract(input) {
+  const value = requireObject(input, "input");
+  const appPack = validateAppPackManifest(value.appPack);
+  const hostPlugins = normalizeHostPluginDescriptors(value.hostPlugins);
+  const appProtocolHash = computeAppProtocolHash({ appPackId: appPack.id, appVersion: appPack.version, hostPlugins });
+  if (appPack.compatibility.appProtocolHash !== appProtocolHash) {
+    fail(`App protocol hash mismatch: expected ${appPack.compatibility.appProtocolHash}, got ${appProtocolHash}`);
+  }
+  return { appPackId: appPack.id, appPackVersion: appPack.version, appPackHash: manifestHash(appPack), hostPlugins, appProtocolHash };
+}
+
+function normalizePluginRef(ref) {
+  return {
+    id: ref.id,
+    version: ref.version,
+    source: ref.source,
+    integrity: ref.integrity,
+    dependsOn: (ref.dependsOn || []).map((dependency) => ({
+      id: dependency.id,
+      ...(dependency.version === undefined ? {} : { version: dependency.version }),
+      ...(dependency.optional === undefined ? {} : { optional: dependency.optional })
+    })),
+    conflictsWith: [...(ref.conflictsWith || [])],
+    capabilities: ref.capabilities ? {
+      required: [...(ref.capabilities.required || [])],
+      optional: [...(ref.capabilities.optional || [])]
+    } : undefined
+  };
+}
+
+function resolveHostPluginGraph(hostPack, pluginRegistry = {}) {
+  const pack = validateHostPackManifest(hostPack);
+  const refs = pack.plugins.map((plugin, index) => normalizePluginRef(require("../manifest/validators.cjs").validateHostPluginRef(plugin, `plugins[${index}]`)));
+  const byId = new Map();
+
+  for (const ref of refs) {
+    if (byId.has(ref.id)) fail(`Duplicate host plugin ${ref.id}`);
+    byId.set(ref.id, ref);
+  }
+
+  for (const ref of refs) {
+    for (const conflictId of ref.conflictsWith || []) {
+      if (byId.has(conflictId)) fail(`Host plugin ${ref.id} conflicts with ${conflictId}`);
+    }
+    for (const dependency of ref.dependsOn || []) {
+      const target = byId.get(dependency.id);
+      if (!target) {
+        if (dependency.optional) continue;
+        fail(`Host plugin ${ref.id} depends on missing plugin ${dependency.id}`);
+      }
+      if (dependency.version !== undefined && target.version !== dependency.version) {
+        fail(`Host plugin ${ref.id} depends on ${dependency.id}@${dependency.version}, got ${target.version}`);
+      }
+    }
+  }
+
+  const ordered = [];
+  const visiting = new Set();
+  const visited = new Set();
+  function visit(ref) {
+    if (visited.has(ref.id)) return;
+    if (visiting.has(ref.id)) fail(`Host plugin dependency cycle at ${ref.id}`);
+    visiting.add(ref.id);
+    for (const dependency of ref.dependsOn || []) {
+      const target = byId.get(dependency.id);
+      if (target) visit(target);
+    }
+    visiting.delete(ref.id);
+    visited.add(ref.id);
+    const plugin = pluginRegistry[ref.id] || pluginRegistry[ref.source];
+    ordered.push({ ref, plugin });
+  }
+  for (const ref of refs) visit(ref);
+
+  return {
+    appPackId: pack.appPackId,
+    hostPackId: pack.id,
+    pluginGraphHash: pack.compatibility.pluginGraphHash,
+    refs: ordered.map((entry) => entry.ref),
+    plugins: ordered.map((entry) => entry.plugin).filter(Boolean),
+    missingImplementations: ordered.filter((entry) => !entry.plugin).map((entry) => entry.ref.id)
+  };
+}
+
+module.exports = {
+  computeAppProtocolHash,
+  createMatterhornAppContract,
+  pluginIdentity,
+  resolveHostPluginGraph,
+  resolvePluginGraph
+};

package/src/trust/store.cjs

@@ -0,0 +1,124 @@
+const { PUBLISHER_TRUST } = require("../constants.cjs");
+const { fail } = require("../errors.cjs");
+const { manifestHash, verifySignedManifest } = require("../manifest/hashing.cjs");
+const { validateHostPackManifest, validatePublisherRef, requireString } = require("../manifest/validators.cjs");
+const { capabilityAudit } = require("../capabilities.cjs");
+
+function createMemoryTrustStore(initial = []) {
+  const records = new Map();
+  for (const item of initial) {
+    const key = `${item.scope || "user"}:${item.publisherId}:${item.publicKey || "*"}`;
+    records.set(key, { scope: "user", trusted: true, blocked: false, ...item });
+  }
+  return {
+    trustPublisher(record) {
+      const item = { scope: "user", trusted: true, blocked: false, createdAt: Date.now(), ...record };
+      if (!item.publisherId && item.id) item.publisherId = item.id;
+      requireString(item.publisherId, "publisherId");
+      const key = `${item.scope}:${item.publisherId}:${item.publicKey || "*"}`;
+      records.set(key, item);
+      return item;
+    },
+    blockPublisher(record) {
+      return this.trustPublisher({ ...record, trusted: false, blocked: true });
+    },
+    isTrusted(publisher, options = {}) {
+      if (!publisher) return false;
+      const scopes = [options.scope, "group", "user"].filter(Boolean);
+      const candidates = [];
+      for (const scope of scopes) {
+        candidates.push(`${scope}:${publisher.id}:${publisher.publicKey}`);
+        candidates.push(`${scope}:${publisher.id}:*`);
+      }
+      const values = candidates.map((key) => records.get(key)).filter(Boolean);
+      if (values.some((record) => record.blocked)) return false;
+      return values.some((record) => record.trusted);
+    },
+    export() {
+      return [...records.values()].map((record) => JSON.parse(JSON.stringify(record)));
+    }
+  };
+}
+
+function createPublisherTrustStore(initial = {}) {
+  const publishers = new Map();
+  for (const [publisherId, record] of Object.entries(initial.publishers || initial)) {
+    const status = typeof record === "string" ? record : record.status;
+    if (!PUBLISHER_TRUST.has(status)) fail(`Invalid trust status ${status}`);
+    publishers.set(publisherId, { publisherId, status, ...(typeof record === "object" ? record : {}) });
+  }
+  return {
+    trust(publisherId, details = {}) {
+      publishers.set(requireString(publisherId, "publisherId"), { publisherId, status: "trusted", ...details });
+    },
+    block(publisherId, details = {}) {
+      publishers.set(requireString(publisherId, "publisherId"), { publisherId, status: "blocked", ...details });
+    },
+    review(publisherId, details = {}) {
+      publishers.set(requireString(publisherId, "publisherId"), { publisherId, status: "review", ...details });
+    },
+    status(publisher) {
+      const publisherId = typeof publisher === "string" ? publisher : publisher?.id;
+      return publishers.get(publisherId)?.status || "review";
+    },
+    isTrusted(publisher) {
+      return this.status(publisher) === "trusted";
+    },
+    isBlocked(publisher) {
+      return this.status(publisher) === "blocked";
+    },
+    snapshot() {
+      return { publishers: Object.fromEntries(publishers.entries()) };
+    }
+  };
+}
+
+function publisherTrustStatus(trustStore, publisher, options = {}) {
+  if (!trustStore) return options.requireTrusted === false ? "unverified" : "review";
+  if (typeof trustStore.isBlocked === "function" && trustStore.isBlocked(publisher, options)) return "blocked";
+  if (typeof trustStore.status === "function") return trustStore.status(publisher);
+  if (typeof trustStore.isTrusted === "function") return trustStore.isTrusted(publisher, options) ? "trusted" : "review";
+  return "review";
+}
+
+function publisherMayUseSignatureKey(trustStore, publisher, publicKey, options = {}) {
+  if (publicKey === publisher.publicKey) return true;
+  if (typeof trustStore?.status === "function") return false;
+  if (typeof trustStore?.isTrusted === "function") return trustStore.isTrusted({ ...publisher, publicKey }, options);
+  return false;
+}
+
+function assertTrustedManifest(manifest, trustStore, options = {}) {
+  const publisher = validatePublisherRef(manifest.publisher || { id: manifest.id, name: manifest.id, publicKey: "unknown" });
+  const status = publisherTrustStatus(trustStore, publisher, options);
+  if (status === "blocked") fail(`Publisher ${publisher.id} is blocked`);
+  if (status !== "trusted" && options.requireTrusted !== false) fail(`Publisher ${publisher.id} is not trusted`);
+  if (options.requireSignature !== false) {
+    const verified = verifySignedManifest(manifest, {
+      isTrustedPublicKey: (publicKey) => publisherMayUseSignatureKey(trustStore, publisher, publicKey, options)
+    });
+    if (!verified.ok) fail(`Manifest ${manifest.id || manifest.kind} does not have a trusted signature`);
+  }
+  return { ok: true, publisher, status, hash: manifestHash(manifest) };
+}
+
+function assertProductionPluginGates(input = {}) {
+  const hostPack = validateHostPackManifest(input.hostPack);
+  const sandbox = hostPack.runtime?.sandbox || "none";
+  const production = input.production !== false;
+  const trustStore = input.trustStore;
+  if (production && !trustStore && input.allowUntrustedLocal !== true) fail("Production host pack trust store is required");
+  if (trustStore && input.requireSignature !== false && !input.publisher) fail("Production host pack publisher is required for signature verification");
+  const trustResult = trustStore ? assertTrustedManifest({ ...hostPack, publisher: input.publisher || { id: hostPack.id, name: hostPack.id, publicKey: "unknown" } }, trustStore, { requireSignature: input.requireSignature }) : { ok: true };
+  if (production && sandbox === "none" && input.allowUnsafeSandbox !== true) fail("Production mode refuses host packs without a sandbox");
+  const audit = capabilityAudit({ capabilities: hostPack.capabilities, available: input.availableCapabilities || [] });
+  if (!audit.ok && input.allowMissingCapabilities !== true) fail(`Missing required capabilities: ${audit.missingRequired.join(", ")}`);
+  return { ok: true, sandbox, trust: trustResult, capabilityAudit: audit };
+}
+
+module.exports = {
+  assertProductionPluginGates,
+  assertTrustedManifest,
+  createMemoryTrustStore,
+  createPublisherTrustStore
+};