@mh-gg/host-runtime 0.1.1-alpha.20260613T085325975Z

package/src/runtime/HostPluginRuntime.cjs

@@ -0,0 +1,85 @@
+const { DEFAULT_MAX_ACKS, DEFAULT_MAX_SEEN_OPERATIONS } = require("../constants.cjs");
+const { runtimeError } = require("../errors.cjs");
+const { createMemoryOperationLog, createMemoryPluginEvents, createMemoryPluginStorage, createMemoryRoomStore } = require("../memory.cjs");
+const { validatePlugin } = require("../plugins/definition.cjs");
+const { createRoomStateStandingAuthority } = require("../security/standingAuthority.cjs");
+const { parseRoomState } = require("../state.cjs");
+const { clone } = require("../shared.cjs");
+const { createAuthorityState } = require("@mh-gg/authority");
+const { attachRuntimeMethods } = require("./methods.cjs");
+const { createRuntimeSnowflakeGenerator } = require("./snowflake.cjs");
+
+class HostPluginRuntime {
+  constructor(options = {}) {
+    if (!options.room?.id) throw runtimeError("INVALID_ROOM", "room.id is required");
+    if (!options.room?.appPack?.id || !options.room?.appPack?.hash) throw runtimeError("INVALID_ROOM", "room.appPack id and hash are required");
+    this.room = clone(options.room);
+    this.hostPack = options.hostPack || null;
+    this.playerPacks = options.playerPacks || [];
+    this.operationPublicKey = options.operationPublicKey || null;
+    this.store = options.store || createMemoryRoomStore();
+    this.operationLog = options.operationLog || createMemoryOperationLog();
+    this.productionRuntime = options.productionRuntime === true;
+    this.relayExecuted = options.relayExecuted === true;
+    if ((this.productionRuntime || this.relayExecuted) && typeof this.store.commitStateAndOperation !== "function") {
+      throw runtimeError("ATOMIC_COMMIT_REQUIRED", "Production and relay-executed runtimes require store.commitStateAndOperation");
+    }
+    this.authenticateActor = options.authenticateActor || (async () => {
+      throw runtimeError("AUTHENTICATOR_MISSING", "authenticateActor is required");
+    });
+    this.devUnsafeTrustActorRole = options.devUnsafeTrustActorRole === true;
+    this.strictStanding = options.strictStanding !== undefined
+      ? options.strictStanding === true
+      : (this.productionRuntime || this.relayExecuted || this.authenticateActor.matterhornRoleKeyAuthenticator === true) && !this.devUnsafeTrustActorRole;
+    this.standingAuthority = options.standingAuthority || createRoomStateStandingAuthority({ strict: this.strictStanding });
+    this.initialMembers = options.initialMembers || {};
+    this.initialOwners = Array.isArray(options.initialOwners) ? options.initialOwners.slice() : [];
+    this.initialAuthority = options.initialAuthority || (this.initialOwners.length ? createAuthorityState({ ownerIds: this.initialOwners, grants: options.initialAuthorityGrants || [], createdAt: options.now ? options.now() : Date.now() }) : null);
+    this.replayBaseState = options.replayBaseState ? clone(options.replayBaseState) : null;
+    this.allowHistoricalAppPackHashes = options.allowHistoricalAppPackHashes === true;
+    this.initialRevokedCredentialIds = options.initialRevokedCredentialIds || [];
+    this.maxRevokedCredentialIds = Number.isInteger(options.maxRevokedCredentialIds) ? Math.max(1, options.maxRevokedCredentialIds) : 1000;
+    this.now = options.now || (() => Date.now());
+    this.snowflakes = createRuntimeSnowflakeGenerator(this, options);
+    this.logger = options.logger || { debug() {}, info() {}, warn() {}, error() {} };
+    this.capabilities = new Set(options.capabilities || []);
+    this.maxSeenOperations = Number.isInteger(options.maxSeenOperations) ? Math.max(1, options.maxSeenOperations) : DEFAULT_MAX_SEEN_OPERATIONS;
+    this.maxAcks = Number.isInteger(options.maxAckCache) ? Math.max(1, options.maxAckCache) : (Number.isInteger(options.maxAcks) ? Math.max(1, options.maxAcks) : DEFAULT_MAX_ACKS);
+    this.maxAckCache = Number.isInteger(options.maxAckCache) ? Math.max(1, options.maxAckCache) : this.maxAcks;
+    this.pluginMap = new Map();
+    this.acks = new Map();
+    this.storages = new Map();
+    this.eventStores = new Map();
+    this.started = false;
+
+    for (const plugin of options.plugins || []) {
+      validatePlugin(plugin);
+      if (this.pluginMap.has(plugin.id)) throw runtimeError("DUPLICATE_PLUGIN", `Duplicate plugin ${plugin.id}`);
+      this.pluginMap.set(plugin.id, plugin);
+    }
+    if (this.pluginMap.size === 0) throw runtimeError("NO_PLUGINS", "At least one plugin is required");
+  }
+
+  pluginList(options = {}) {
+    const plugins = [...this.pluginMap.values()];
+    return options.reverse ? plugins.reverse() : plugins;
+  }
+
+  validateRoomState(state) {
+    return parseRoomState(state);
+  }
+
+  pluginStorage(pluginId) {
+    if (!this.storages.has(pluginId)) this.storages.set(pluginId, createMemoryPluginStorage());
+    return this.storages.get(pluginId);
+  }
+
+  pluginEvents(pluginId) {
+    if (!this.eventStores.has(pluginId)) this.eventStores.set(pluginId, createMemoryPluginEvents());
+    return this.eventStores.get(pluginId);
+  }
+}
+
+attachRuntimeMethods(HostPluginRuntime);
+
+module.exports = { HostPluginRuntime };

package/src/runtime/authorityReplay/applyAuthority.cjs

@@ -0,0 +1,146 @@
+const { authorizeCoreOperation } = require("../../security/authorization/coreGate.cjs");
+const {
+  CORE_PLUGIN_ID,
+  canSetRole,
+  grantFromOperation,
+  resolveAuthorityOperations,
+  roleFromAuthority
+} = require("@mh-gg/authority");
+const {
+  CORE_ACCESS_ROLE_ASSIGN_TYPE,
+  CORE_ACCESS_ROLE_DEFINE_TYPE,
+  CORE_SCOPE_ROLE_SET_TYPE,
+  applyAccessRoleAssignmentToRoomState,
+  applyAccessRoleDefineToRoomState,
+  applyScopeRoleSetToRoomState,
+  assertScopedRoleManagerCanApply,
+  normalizeScopedRolesState,
+  parseAccessRoleAssignmentPayload,
+  parseAccessRoleDefinePayload,
+  parseScopeRoleSetPayload
+} = require("../../security/scopedRoles.cjs");
+const { stateWithActorMember } = require("../memberProfiles.cjs");
+const { commitVersion, projectionForState, tombstone } = require("./state.cjs");
+
+function authorityRole(state, memberId) {
+  return roleFromAuthority(state.authority, memberId);
+}
+
+function applyAuthorityGrantDuringReplay(runtime, state, operation, voidedGrantIds) {
+  const grant = grantFromOperation(operation);
+  if (!grant) {
+    tombstone(state, operation, "invalid-authority-grant");
+    return false;
+  }
+  if (voidedGrantIds.has(grant.id)) {
+    tombstone(state, operation, "voided-by-revocation");
+    return false;
+  }
+  if (!canSetRole(authorityRole(state, grant.granter), grant.role, authorityRole(state, grant.target))) {
+    tombstone(state, operation, "unauthorized-authority-grant", { granter: grant.granter, target: grant.target, role: grant.role });
+    return false;
+  }
+  state.authority.grants = [...(state.authority.grants || []), grant];
+  projectionForState(state);
+  Object.assign(state, stateWithActorMember(state, operation.actor, operation.createdAt || runtime.now()));
+  commitVersion(state, operation, runtime);
+  return true;
+}
+
+function applyAuthorityRevokeDuringReplay(runtime, state, operation, validRevocationIds) {
+  if (!validRevocationIds.has(operation.id)) {
+    tombstone(state, operation, "unauthorized-authority-revocation");
+    return false;
+  }
+  const resolved = resolveAuthorityOperations({ authority: state.authority, operations: [operation] });
+  state.authority.revocations = resolved.revocations;
+  state.authority.tombstones = { ...(state.authority.tombstones || {}), ...(resolved.tombstones || {}) };
+  projectionForState(state);
+  Object.assign(state, stateWithActorMember(state, operation.actor, operation.createdAt || runtime.now()));
+  commitVersion(state, operation, runtime);
+  return true;
+}
+
+async function applyCredentialRevocationDuringReplay(runtime, state, operation, actor = operation.actor) {
+  const credentialId = operation.payload?.credentialId;
+  if (typeof credentialId !== "string" || credentialId.length === 0) {
+    tombstone(state, operation, "invalid-credential-revocation");
+    return false;
+  }
+  const revoked = Array.isArray(state.revokedCredentialIds) ? state.revokedCredentialIds.filter((id) => id !== credentialId) : [];
+  revoked.push(credentialId);
+  state.revokedCredentialIds = revoked.slice(-runtime.maxRevokedCredentialIds);
+  Object.assign(state, stateWithActorMember(state, actor, operation.createdAt || runtime.now()));
+  commitVersion(state, operation, runtime);
+  return true;
+}
+
+async function applyCredentialRevocationEnvelope(runtime, state, operation) {
+  try {
+    const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+    const actor = await authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin: { id: CORE_PLUGIN_ID }, roles: ["admin"], operationLabel: `${CORE_PLUGIN_ID}.${operation.type}` });
+    return applyCredentialRevocationDuringReplay(runtime, state, operation, actor);
+  } catch (error) {
+    tombstone(state, operation, "unauthorized-credential-revocation", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+}
+
+async function applyScopeRoleSetEnvelope(runtime, state, operation) {
+  try {
+    const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+    const actor = await authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin: { id: CORE_PLUGIN_ID }, roles: ["moderator"], operationLabel: `${CORE_PLUGIN_ID}.${CORE_SCOPE_ROLE_SET_TYPE}` });
+    const payload = parseScopeRoleSetPayload(operation);
+    assertScopedRoleManagerCanApply(actor, { grants: [{ role: payload.role || payload.defaultRole || "none" }] });
+    const updatedAt = operation.createdAt || runtime.now();
+    Object.assign(state, stateWithActorMember(applyScopeRoleSetToRoomState(state, payload, actor, updatedAt, operation), actor, updatedAt));
+    commitVersion(state, operation, runtime);
+    return true;
+  } catch (error) {
+    tombstone(state, operation, "unauthorized-scope-role-set", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+}
+
+async function applyAccessRoleDefineEnvelope(runtime, state, operation) {
+  try {
+    const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+    const actor = await authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin: { id: CORE_PLUGIN_ID }, roles: ["moderator"], operationLabel: `${CORE_PLUGIN_ID}.${CORE_ACCESS_ROLE_DEFINE_TYPE}` });
+    const payload = parseAccessRoleDefinePayload(operation);
+    assertScopedRoleManagerCanApply(actor, payload);
+    const updatedAt = operation.createdAt || runtime.now();
+    Object.assign(state, stateWithActorMember(applyAccessRoleDefineToRoomState(state, payload, actor, updatedAt, operation), actor, updatedAt));
+    commitVersion(state, operation, runtime);
+    return true;
+  } catch (error) {
+    tombstone(state, operation, "unauthorized-access-role-define", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+}
+
+async function applyAccessRoleAssignmentEnvelope(runtime, state, operation) {
+  try {
+    const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+    const actor = await authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin: { id: CORE_PLUGIN_ID }, roles: ["moderator"], operationLabel: `${CORE_PLUGIN_ID}.${operation.type}` });
+    const payload = parseAccessRoleAssignmentPayload(operation);
+    const compoundRole = normalizeScopedRolesState(state.scopedRoles).roles[payload.roleId];
+    if (!compoundRole) throw new Error(`Compound role ${payload.roleId} is not defined`);
+    assertScopedRoleManagerCanApply(actor, { grants: compoundRole.grants });
+    const updatedAt = operation.createdAt || runtime.now();
+    Object.assign(state, stateWithActorMember(applyAccessRoleAssignmentToRoomState(state, payload, operation.type === CORE_ACCESS_ROLE_ASSIGN_TYPE, actor, updatedAt, operation), actor, updatedAt));
+    commitVersion(state, operation, runtime);
+    return true;
+  } catch (error) {
+    tombstone(state, operation, "unauthorized-access-role-assignment", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+}
+
+module.exports = {
+  applyAccessRoleAssignmentEnvelope,
+  applyAccessRoleDefineEnvelope,
+  applyAuthorityGrantDuringReplay,
+  applyAuthorityRevokeDuringReplay,
+  applyCredentialRevocationEnvelope,
+  applyScopeRoleSetEnvelope
+};

package/src/runtime/authorityReplay/applyContent.cjs

@@ -0,0 +1,49 @@
+const { authorizeCoreOperation } = require("../../security/authorization/coreGate.cjs");
+const { parseWithSchema } = require("../../state.cjs");
+const { clone } = require("../../shared.cjs");
+const { stateWithActorMember } = require("../memberProfiles.cjs");
+const { commitVersion, tombstone } = require("./state.cjs");
+
+async function applyContentDuringReplay(runtime, state, operation) {
+  const plugin = runtime.pluginMap.get(operation.pluginId);
+  if (!plugin) {
+    tombstone(state, operation, "plugin-not-installed");
+    return false;
+  }
+  const operationSchema = plugin.schemas.operations[operation.type];
+  if (!operationSchema) {
+    tombstone(state, operation, "unknown-operation-type");
+    return false;
+  }
+  let actor;
+  try {
+    const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+    actor = await authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin });
+  } catch (error) {
+    tombstone(state, operation, "unauthorized-operation", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+
+  let parsedPayload;
+  try {
+    parsedPayload = parseWithSchema(operationSchema, operation.payload, `${plugin.id}.${operation.type}`);
+  } catch (error) {
+    tombstone(state, operation, "invalid-payload", { code: error?.code, message: error?.message || String(error) });
+    return false;
+  }
+  const parsedOperation = { ...operation, payload: parsedPayload, actor };
+  const pluginState = state.plugins[plugin.id];
+  const authz = await plugin.authorize(runtime.createContext({ plugin, roomState: state, pluginState, actor, operation: parsedOperation }), parsedOperation);
+  if (!authz?.ok) {
+    tombstone(state, operation, "plugin-denied", { message: authz?.reason || "Forbidden" });
+    return false;
+  }
+  const nextPluginState = await plugin.reduce(runtime.createContext({ plugin, roomState: state, pluginState, actor, operation: parsedOperation }), clone(pluginState), parsedOperation);
+  state.plugins[plugin.id] = parseWithSchema(plugin.schemas.state, nextPluginState, `${plugin.id} state`);
+  state.pluginVersions[plugin.id] = plugin.version;
+  Object.assign(state, stateWithActorMember(state, actor, operation.createdAt || runtime.now()));
+  commitVersion(state, operation, runtime);
+  return true;
+}
+
+module.exports = { applyContentDuringReplay };

package/src/runtime/authorityReplay/index.cjs

@@ -0,0 +1,70 @@
+const { clone } = require("../../shared.cjs");
+const {
+  CORE_PLUGIN_ID,
+  CORE_REVOKE_CREDENTIAL_TYPE,
+  computeVoidedGrantIds,
+  createAuthorityState,
+  isAuthorityGrantOperation,
+  isAuthorityRevokeOperation,
+  normalizeAuthorityState,
+  sortOperations
+} = require("@mh-gg/authority");
+const { CORE_ACCESS_ROLE_ASSIGN_TYPE, CORE_ACCESS_ROLE_DEFINE_TYPE, CORE_ACCESS_ROLE_UNASSIGN_TYPE, CORE_SCOPE_ROLE_SET_TYPE } = require("../../security/scopedRoles.cjs");
+const {
+  applyAccessRoleAssignmentEnvelope,
+  applyAccessRoleDefineEnvelope,
+  applyAuthorityGrantDuringReplay,
+  applyAuthorityRevokeDuringReplay,
+  applyCredentialRevocationEnvelope,
+  applyScopeRoleSetEnvelope
+} = require("./applyAuthority.cjs");
+const { applyContentDuringReplay } = require("./applyContent.cjs");
+const { applyDirectCoreEnvelope, isDirectCoreOperation } = require("../directMessages.cjs");
+const { CORE_READ_TAG_SET_TYPE, applyReadTagCoreEnvelope } = require("../readTags.cjs");
+const { normalizeOperationForReplay, projectionForState, resetReplayState, tombstone } = require("./state.cjs");
+
+function isCoreOperation(operation) {
+  return operation?.pluginId === CORE_PLUGIN_ID;
+}
+
+function removeVoidedBaseGrants(state, voidedGrantIds) {
+  if (!state.authority?.grants) return;
+  state.authority.grants = state.authority.grants.filter((grant) => {
+    const keep = !voidedGrantIds.has(grant.id);
+    if (!keep) tombstone(state, { id: grant.id, type: "authority.grant", pluginId: CORE_PLUGIN_ID, actor: { memberId: grant.granter }, createdAt: grant.createdAt }, "voided-by-revocation", { source: "base" });
+    return keep;
+  });
+}
+
+async function applyReplayOperation(runtime, state, operation, voidedGrantIds, validRevocationIds) {
+  if (isAuthorityGrantOperation(operation)) return applyAuthorityGrantDuringReplay(runtime, state, operation, voidedGrantIds);
+  if (isAuthorityRevokeOperation(operation)) return applyAuthorityRevokeDuringReplay(runtime, state, operation, validRevocationIds);
+  if (isCoreOperation(operation) && operation.type === CORE_REVOKE_CREDENTIAL_TYPE) return applyCredentialRevocationEnvelope(runtime, state, operation);
+  if (isCoreOperation(operation) && operation.type === CORE_SCOPE_ROLE_SET_TYPE) return applyScopeRoleSetEnvelope(runtime, state, operation);
+  if (isCoreOperation(operation) && operation.type === CORE_ACCESS_ROLE_DEFINE_TYPE) return applyAccessRoleDefineEnvelope(runtime, state, operation);
+  if (isCoreOperation(operation) && (operation.type === CORE_ACCESS_ROLE_ASSIGN_TYPE || operation.type === CORE_ACCESS_ROLE_UNASSIGN_TYPE)) return applyAccessRoleAssignmentEnvelope(runtime, state, operation);
+  if (isDirectCoreOperation(operation)) return applyDirectCoreEnvelope(runtime, state, operation);
+  if (isCoreOperation(operation) && operation.type === CORE_READ_TAG_SET_TYPE) return applyReadTagCoreEnvelope(runtime, state, operation);
+  return applyContentDuringReplay(runtime, state, operation);
+}
+
+async function rebuildStateFromAuthorityLog(runtime, baseState, operations = []) {
+  const sorted = sortOperations(operations.map(clone));
+  const authority = normalizeAuthorityState(baseState.authority) || createAuthorityState({ ownerIds: [] });
+  const { voidedGrantIds, validRevocationIds } = computeVoidedGrantIds(authority, sorted);
+  const state = resetReplayState({ ...baseState, authority });
+  removeVoidedBaseGrants(state, voidedGrantIds);
+  projectionForState(state);
+
+  for (const original of sorted) {
+    try {
+      await applyReplayOperation(runtime, state, normalizeOperationForReplay(runtime, original), voidedGrantIds, validRevocationIds);
+    } catch (error) {
+      tombstone(state, original, "invalid-operation", { code: error?.code, message: error?.message || String(error) });
+    }
+  }
+  projectionForState(state);
+  return runtime.validateRoomState(state);
+}
+
+module.exports = { rebuildStateFromAuthorityLog };

package/src/runtime/authorityReplay/state.cjs

@@ -0,0 +1,56 @@
+const { validateRoomOperation } = require("@mh-gg/protocol");
+const { runtimeError } = require("../../errors.cjs");
+const { clone, rememberBounded } = require("../../shared.cjs");
+const { applyAuthorityProjection, normalizeAuthorityState } = require("@mh-gg/authority");
+
+function resetReplayState(baseState) {
+  return {
+    ...clone(baseState),
+    version: 0,
+    updatedAt: baseState.createdAt,
+    seenOperations: [],
+    revokedCredentialIds: Array.isArray(baseState.revokedCredentialIds) ? baseState.revokedCredentialIds.slice() : [],
+    plugins: clone(baseState.plugins || {}),
+    pluginVersions: clone(baseState.pluginVersions || {}),
+    members: clone(baseState.members || {}),
+    authority: normalizeAuthorityState(baseState.authority)
+  };
+}
+
+function normalizeOperationForReplay(runtime, operation) {
+  validateRoomOperation(operation);
+  if (operation.roomId !== runtime.room.id) throw runtimeError("ROOM_MISMATCH", "Operation room does not match runtime room");
+  if (operation.appPackId !== runtime.room.appPack.id) throw runtimeError("APP_PACK_MISMATCH", "Operation app pack id does not match runtime app");
+  if (operation.appPackHash !== runtime.room.appPack.hash) throw runtimeError("APP_PACK_HASH_MISMATCH", "Operation app pack hash does not match runtime app");
+  return operation;
+}
+
+function tombstone(state, operation, reason, details = {}) {
+  if (!state.authority) return;
+  state.authority.tombstones = { ...(state.authority.tombstones || {}) };
+  if (!state.authority.tombstones[operation.id]) {
+    state.authority.tombstones[operation.id] = {
+      reason,
+      operationType: operation.type,
+      pluginId: operation.pluginId,
+      actor: operation.actor?.memberId,
+      at: operation.createdAt,
+      ...details
+    };
+  }
+}
+
+function commitVersion(state, operation, runtime) {
+  state.version += 1;
+  state.updatedAt = operation.createdAt || runtime.now();
+  state.seenOperations = rememberBounded(state.seenOperations, operation.id, runtime.maxSeenOperations);
+}
+
+function projectionForState(state) {
+  const projected = applyAuthorityProjection(state.authority, state.members);
+  state.authority = projected.authority;
+  state.members = projected.members;
+  state.adminIds = projected.adminIds;
+}
+
+module.exports = { commitVersion, normalizeOperationForReplay, projectionForState, resetReplayState, tombstone };

package/src/runtime/context.cjs

@@ -0,0 +1,65 @@
+const { hashCanonical } = require("@mh-gg/base");
+const { runtimeError } = require("../errors.cjs");
+const { clone } = require("../shared.cjs");
+const { canEditScope, canViewScope, scopedRoleForActor } = require("../security/scopedRoles.cjs");
+const { entityIdForOperation } = require("./snowflake.cjs");
+
+function createContext({ plugin, roomState, pluginState, actor, operation }) {
+  const runtime = this;
+  let randomIndex = 0;
+  return {
+    room: {
+      id: this.room.id,
+      appPackId: this.room.appPack.id,
+      appPackHash: this.room.appPack.hash
+    },
+    plugin: { id: plugin.id, version: plugin.version, ...(plugin.config === undefined ? {} : { config: clone(plugin.config) }) },
+    actor,
+    logger: this.logger,
+    roomState: clone(roomState),
+    pluginState: clone(pluginState),
+    now: operation?.createdAt ?? this.now(),
+    crypto: {
+      hash: hashCanonical,
+      verifySignature() { return false; },
+      randomId(prefix = "id") {
+        randomIndex += 1;
+        if (operation?.ledgerId || operation?.snowflakeId || operation?.createdAt) return entityIdForOperation(prefix, operation, randomIndex > 1 ? randomIndex : 0);
+        const digest = hashCanonical({ operationId: operation?.id || "initial", pluginId: plugin.id, prefix, randomIndex })
+          .slice("sha256-".length, "sha256-".length + 16);
+        return `${prefix}_${digest}`;
+      }
+    },
+    storage: this.pluginStorage(plugin.id),
+    events: this.pluginEvents(plugin.id),
+    access: {
+      roleForScope(scopeType, scopeId, inputActor = actor) {
+        return scopedRoleForActor(roomState, inputActor, scopeType, scopeId);
+      },
+      canView(scopeType, scopeId, inputActor = actor) {
+        return canViewScope(roomState, inputActor, scopeType, scopeId);
+      },
+      canEdit(scopeType, scopeId, inputActor = actor) {
+        return canEditScope(roomState, inputActor, scopeType, scopeId);
+      }
+    },
+    plugins: {
+      has(pluginId) { return runtime.pluginMap.has(pluginId); },
+      async call(pluginId, method, input) {
+        const target = runtime.pluginMap.get(pluginId);
+        if (!target) throw runtimeError("PLUGIN_NOT_INSTALLED", `Plugin ${pluginId} is not installed`);
+        const fn = target.methods?.[method];
+        if (typeof fn !== "function") throw runtimeError("PLUGIN_METHOD_NOT_FOUND", `Plugin method ${pluginId}.${method} is not available`);
+        return await fn({ actor: clone(actor), roomState: clone(roomState), state: clone(roomState.plugins?.[pluginId]), capabilities: runtime.capabilities }, clone(input));
+      }
+    },
+    capabilities: {
+      has: (capability) => this.capabilities.has(capability),
+      require: (capability) => {
+        if (!this.capabilities.has(capability)) throw runtimeError("CAPABILITY_MISSING", `Missing capability ${capability}`);
+      }
+    }
+  };
+}
+
+module.exports = { createContext };

package/src/runtime/coreOperations.cjs

@@ -0,0 +1,169 @@
+const { authorizeCoreOperation } = require("../security/authorization/coreGate.cjs");
+const { runtimeError } = require("../errors.cjs");
+const { clone, pruneMap, rememberBounded } = require("../shared.cjs");
+const { rebuildStateFromAuthorityLog } = require("./authorityReplay/index.cjs");
+const {
+  CORE_AUTHORITY_GRANT_TYPE,
+  CORE_AUTHORITY_REVOKE_TYPE,
+  CORE_PLUGIN_ID,
+  CORE_REVOKE_CREDENTIAL_TYPE,
+  canSetRole,
+  roleFromAuthority
+} = require("@mh-gg/authority");
+const { stateWithActorMember } = require("./memberProfiles.cjs");
+const {
+  CORE_ACCESS_ROLE_ASSIGN_TYPE,
+  CORE_ACCESS_ROLE_DEFINE_TYPE,
+  CORE_ACCESS_ROLE_UNASSIGN_TYPE,
+  CORE_SCOPE_ROLE_SET_TYPE,
+} = require("../security/scopedRoles.cjs");
+const {
+  commitAccessRoleAssignment,
+  commitAccessRoleDefine,
+  commitScopeRoleSet
+} = require("./scopedRoleOperations.cjs");
+const {
+  CORE_DIRECT_MESSAGE_SEND_TYPE,
+  CORE_DIRECT_MESSAGE_PUBLISH_TYPE,
+  CORE_DM_MESSAGE_TYPE,
+  CORE_MEMBER_KEY_PUBLISH_TYPE,
+  commitDirectCoreOperation,
+  isDirectCoreOperation,
+} = require("./directMessages.cjs");
+const { CORE_READ_TAG_SET_TYPE, applyReadTagToRoomState, parseReadTagPayload } = require("./readTags.cjs");
+const {
+  parseAuthorityGrantPayload,
+  parseAuthorityRevokePayload,
+  parseCorePayload,
+  parseCredentialRevokePayload
+} = require("./corePayloads.cjs");
+
+const CORE_OPERATION_ROLES = Object.freeze({
+  [CORE_REVOKE_CREDENTIAL_TYPE]: ["admin"],
+  [CORE_AUTHORITY_GRANT_TYPE]: ["admin"],
+  [CORE_AUTHORITY_REVOKE_TYPE]: ["admin"],
+  [CORE_SCOPE_ROLE_SET_TYPE]: ["moderator"],
+  [CORE_ACCESS_ROLE_DEFINE_TYPE]: ["moderator"],
+  [CORE_ACCESS_ROLE_ASSIGN_TYPE]: ["moderator"],
+  [CORE_ACCESS_ROLE_UNASSIGN_TYPE]: ["moderator"],
+  [CORE_MEMBER_KEY_PUBLISH_TYPE]: ["member"],
+  [CORE_DIRECT_MESSAGE_PUBLISH_TYPE]: ["member"],
+  [CORE_DIRECT_MESSAGE_SEND_TYPE]: ["member"],
+  [CORE_DM_MESSAGE_TYPE]: ["member"],
+  [CORE_READ_TAG_SET_TYPE]: ["member"]
+});
+function isCoreOperation(operation) {
+  return operation?.pluginId === CORE_PLUGIN_ID;
+}
+
+function revokedCredentialList(state) {
+  if (Array.isArray(state.revokedCredentialIds)) return state.revokedCredentialIds.slice();
+  if (state.revokedCredentialIds && typeof state.revokedCredentialIds === "object") return Object.entries(state.revokedCredentialIds).filter(([, enabled]) => Boolean(enabled)).map(([credentialId]) => credentialId);
+  return [];
+}
+async function operationLogEntries(runtime) {
+  if (typeof runtime.operationLog.list === "function") return await runtime.operationLog.list();
+  return runtime.operationLog.entries || [];
+}
+async function commitAuthorityCoreOperation(operation, actor, state, signedOperationForLog) {
+  const payload = parseCorePayload(operation);
+  if (operation.type === CORE_AUTHORITY_GRANT_TYPE && !canSetRole(actor.role, payload.role, roleFromAuthority(state.authority, payload.target))) {
+    throw runtimeError("FORBIDDEN", `authority.grant ${payload.target} -> ${payload.role} exceeds actor authority ${actor.role}`);
+  }
+  const parsedOperation = { ...operation, payload, actor };
+  const createdAt = parsedOperation.createdAt || this.now();
+  const logEntry = { ...signedOperationForLog, payload, committedAt: createdAt };
+  const rebuilt = await rebuildStateFromAuthorityLog(this, this.replayBaseState || state, [...(await operationLogEntries(this)), logEntry]);
+  const memberState = stateWithActorMember(rebuilt, actor, createdAt);
+  const nextRoomState = this.validateRoomState({ ...memberState, updatedAt: createdAt, seenOperations: rememberBounded(memberState.seenOperations, parsedOperation.id, this.maxSeenOperations) });
+  await this.commitStateAndOperation({
+    logEntry: { ...logEntry, committedRoomVersion: nextRoomState.version, committedAt: nextRoomState.updatedAt },
+    nextState: nextRoomState
+  });
+  const ack = { ok: true, acceptedOperationId: parsedOperation.id, roomVersion: nextRoomState.version, ...(parsedOperation.ledgerId ? { acceptedLedgerId: parsedOperation.ledgerId, acceptedSnowflakeId: parsedOperation.ledgerId } : {}) };
+  this.acks.set(parsedOperation.id, ack);
+  pruneMap(this.acks, Math.min(this.maxAcks, this.maxAckCache));
+  return clone(ack);
+}
+
+async function commitCredentialRevocation(operation, actor, state, signedOperationForLog) {
+  const payload = parseCorePayload(operation);
+  const parsedOperation = { ...operation, payload, actor };
+  const revoked = revokedCredentialList(state).filter((credentialId) => credentialId !== payload.credentialId);
+  revoked.push(payload.credentialId);
+  const updatedAt = parsedOperation.createdAt || this.now();
+  const memberState = stateWithActorMember(state, actor, updatedAt);
+  const nextRoomState = this.validateRoomState({ ...memberState, revokedCredentialIds: revoked.slice(-this.maxRevokedCredentialIds), version: state.version + 1, updatedAt, seenOperations: rememberBounded(state.seenOperations, parsedOperation.id, this.maxSeenOperations) });
+  await this.commitStateAndOperation({
+    logEntry: { ...signedOperationForLog, committedRoomVersion: nextRoomState.version, committedAt: nextRoomState.updatedAt },
+    nextState: nextRoomState,
+    expectedPreviousVersion: state.version
+  });
+  const ack = { ok: true, acceptedOperationId: parsedOperation.id, roomVersion: nextRoomState.version, ...(parsedOperation.ledgerId ? { acceptedLedgerId: parsedOperation.ledgerId, acceptedSnowflakeId: parsedOperation.ledgerId } : {}) };
+  this.acks.set(parsedOperation.id, ack);
+  pruneMap(this.acks, Math.min(this.maxAcks, this.maxAckCache));
+  return clone(ack);
+}
+
+async function commitReadTagCoreOperation(operation, actor, state, signedOperationForLog) {
+  const payload = parseReadTagPayload(operation);
+  const parsedOperation = { ...operation, payload, actor };
+  const updatedAt = parsedOperation.createdAt || this.now();
+  const memberState = stateWithActorMember(state, actor, updatedAt);
+  const readState = applyReadTagToRoomState(memberState, payload, actor, parsedOperation, updatedAt);
+  const nextRoomState = this.validateRoomState({
+    ...readState,
+    version: state.version + 1,
+    updatedAt,
+    seenOperations: rememberBounded(state.seenOperations, parsedOperation.id, this.maxSeenOperations)
+  });
+  await this.commitStateAndOperation({
+    logEntry: { ...signedOperationForLog, payload, committedRoomVersion: nextRoomState.version, committedAt: nextRoomState.updatedAt },
+    nextState: nextRoomState,
+    expectedPreviousVersion: state.version
+  });
+  const ack = { ok: true, acceptedOperationId: parsedOperation.id, roomVersion: nextRoomState.version, ...(parsedOperation.ledgerId ? { acceptedLedgerId: parsedOperation.ledgerId, acceptedSnowflakeId: parsedOperation.ledgerId } : {}) };
+  this.acks.set(parsedOperation.id, ack);
+  pruneMap(this.acks, Math.min(this.maxAcks, this.maxAckCache));
+  return clone(ack);
+}
+
+async function commitCoreOperation(operation, actor, state, signedOperationForLog) {
+  if (operation.type === CORE_AUTHORITY_GRANT_TYPE || operation.type === CORE_AUTHORITY_REVOKE_TYPE) return this.commitAuthorityCoreOperation(operation, actor, state, signedOperationForLog);
+  if (operation.type === CORE_SCOPE_ROLE_SET_TYPE) return this.commitScopeRoleSet(operation, actor, state, signedOperationForLog);
+  if (operation.type === CORE_ACCESS_ROLE_DEFINE_TYPE) return this.commitAccessRoleDefine(operation, actor, state, signedOperationForLog);
+  if (operation.type === CORE_ACCESS_ROLE_ASSIGN_TYPE || operation.type === CORE_ACCESS_ROLE_UNASSIGN_TYPE) return this.commitAccessRoleAssignment(operation, actor, state, signedOperationForLog);
+  if (isDirectCoreOperation(operation)) return this.commitDirectCoreOperation(operation, actor, state, signedOperationForLog);
+  if (operation.type === CORE_READ_TAG_SET_TYPE) return this.commitReadTagCoreOperation(operation, actor, state, signedOperationForLog);
+  return this.commitCredentialRevocation(operation, actor, state, signedOperationForLog);
+}
+
+async function authenticateAndGateOperation(runtime, { operation, state, plugin }) {
+  const rawActor = await runtime.authenticateActor(operation.auth, operation.actor, operation);
+  if (!isCoreOperation(operation)) return authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin });
+  return authorizeCoreOperation(runtime, { operation, actor: rawActor, state, plugin: { id: CORE_PLUGIN_ID }, roles: CORE_OPERATION_ROLES[operation.type], operationLabel: `${CORE_PLUGIN_ID}.${operation.type}` });
+}
+
+module.exports = {
+  CORE_ACCESS_ROLE_ASSIGN_TYPE,
+  CORE_ACCESS_ROLE_DEFINE_TYPE,
+  CORE_ACCESS_ROLE_UNASSIGN_TYPE,
+  CORE_AUTHORITY_GRANT_TYPE,
+  CORE_AUTHORITY_REVOKE_TYPE,
+  CORE_PLUGIN_ID,
+  CORE_READ_TAG_SET_TYPE,
+  CORE_REVOKE_CREDENTIAL_TYPE,
+  CORE_SCOPE_ROLE_SET_TYPE,
+  authenticateAndGateOperation,
+  commitAccessRoleAssignment,
+  commitAccessRoleDefine,
+  commitAuthorityCoreOperation,
+  commitCoreOperation,
+  commitCredentialRevocation,
+  commitDirectCoreOperation,
+  commitReadTagCoreOperation,
+  commitScopeRoleSet,
+  isCoreOperation,
+  isDirectCoreOperation,
+  parseCorePayload
+};