@xnetjs/trust 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Chris Smothers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,22 @@
+# @xnetjs/trust
+
+The shared provenance→trust-tier primitives for xNet's extensibility systems
+(exploration 0194).
+
+Trust follows **provenance** — where an extension came from — never anything the
+code declares about itself. A `synced` extension always re-derives its tier
+locally (sync is not consent).
+
+```ts
+import { deriveTrustTier, requiresCapabilityReprompt, sandboxForTier } from '@xnetjs/trust'
+
+deriveTrustTier('marketplace') // 'marketplace'  → sandboxForTier → 'iframe'
+deriveTrustTier('authored') //    'user'         → 'ses-worker'
+deriveTrustTier('builtin') //     'first-party'  → 'host'
+requiresCapabilityReprompt('synced') // true
+```
+
+This package is the single source of truth consumed by `@xnetjs/plugins`
+(ecosystem layer, 0192) and `@xnetjs/labs` (0180), which previously carried
+byte-for-byte identical copies of this logic. It is intentionally zero-dependency
+and policy-only (no runtime) so it never becomes a coupling magnet.

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @xnetjs/trust — the shared provenance→trust primitives for xNet extensibility
+ * (exploration 0194).
+ *
+ * The load-bearing invariant of the whole extensibility story: an extension's
+ * trust tier follows its PROVENANCE — where it came from — never anything the
+ * code declares about itself. Something you (or an AI you approved) authored
+ * locally installs at the `user` tier; something pulled from a marketplace
+ * installs at the `marketplace` tier (and runs in the iframe).
+ *
+ * Critically, when an extension node SYNCS to another device, the receiver must
+ * RE-DERIVE the tier from its own local install action — never trust a tier
+ * carried in the synced payload. {@link deriveTrustTier} is that single choke
+ * point.
+ *
+ * This package exists because `@xnetjs/labs` (0180) and `@xnetjs/plugins`'s
+ * ecosystem layer (0192) had *byte-for-byte identical* copies of this logic —
+ * 0192 mirrored it to avoid a `plugins → labs` dependency edge (labs already
+ * depends on plugins). A tiny zero-dep leaf both can depend on is the clean fix.
+ * Keep it policy-only (no runtime) so it never becomes a coupling magnet.
+ */
+/** Where an extension came from — the only input to its trust tier. */
+type InstallProvenance = 
+/** Bundled with the app. */
+'builtin'
+/** Authored in this workspace by the user. */
+ | 'authored'
+/** Generated by an AI agent and explicitly approved by the user. */
+ | 'ai-generated'
+/** Imported from a file/manifest the user pasted or opened. */
+ | 'imported'
+/** Installed from a public marketplace. */
+ | 'marketplace'
+/** Arrived via P2P sync from another device/peer. */
+ | 'synced';
+/** The execution trust tier an extension runs at. */
+type TrustTier = 'first-party' | 'user' | 'marketplace';
+/** The sandbox a tier maps to (mirrors the dashboard widget tiers). */
+type SandboxKind = 'host' | 'ses-worker' | 'iframe';
+/**
+ * Map install provenance to a trust tier. `synced` does NOT inherit any tier —
+ * it lands at `user` and the host must re-confirm capabilities locally before
+ * activating (sync is not consent). `authored`/`ai-generated`/`imported` also
+ * land at `user`; only `builtin` is first-party and only `marketplace` is
+ * marketplace.
+ */
+declare function deriveTrustTier(provenance: InstallProvenance): TrustTier;
+/**
+ * Whether installing from `provenance` must re-prompt the user for the
+ * extension's capabilities before activation. True for anything not authored on
+ * this device in this session — especially synced and marketplace nodes.
+ */
+declare function requiresCapabilityReprompt(provenance: InstallProvenance): boolean;
+/** Map a trust tier to the sandbox its code should run in. */
+declare function sandboxForTier(tier: TrustTier): SandboxKind;
+
+export { type InstallProvenance, type SandboxKind, type TrustTier, deriveTrustTier, requiresCapabilityReprompt, sandboxForTier };

package/dist/index.js

@@ -0,0 +1,19 @@
+// src/index.ts
+function deriveTrustTier(provenance) {
+  if (provenance === "builtin") return "first-party";
+  if (provenance === "marketplace") return "marketplace";
+  return "user";
+}
+function requiresCapabilityReprompt(provenance) {
+  return provenance !== "builtin" && provenance !== "authored";
+}
+function sandboxForTier(tier) {
+  if (tier === "first-party") return "host";
+  if (tier === "marketplace") return "iframe";
+  return "ses-worker";
+}
+export {
+  deriveTrustTier,
+  requiresCapabilityReprompt,
+  sandboxForTier
+};

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@xnetjs/trust",
+  "version": "0.0.1",
+  "description": "Shared provenance→trust-tier primitives for xNet extensibility — the single source of truth consumed by @xnetjs/plugins and @xnetjs/labs.",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "tsup": "^8.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^4.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/crs48/xNet"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}