@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/host/relayConfig.cjs

@@ -0,0 +1,156 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { userDataDir } = require("./matterhornrc.cjs");
+const { randomRelayPeerId, relayMeshAddressFromAddress, relayMeshAddressForPeerId, relayMeshPeerIdForRoomPeerId } = require("@mh-gg/relay-core");
+const { peerJsSignalingConfig } = require("./peerJsConfig.cjs");
+const { ensureRelayIdentity, normalizeRelayAlias, normalizeRelayName } = require("./relayIdentity.cjs");
+
+const DEFAULT_RELAY_IPC_HOST = "127.0.0.1";
+const DEFAULT_RELAY_IPC_PORT = 42777;
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+
+function relayConfigFile(dataDir = userDataDir()) {
+  return path.join(dataDir, "relay.json");
+}
+
+function readRelayConfig(file = relayConfigFile()) {
+  if (!fs.existsSync(file)) return {};
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function chmodPrivate(file, mode) {
+  try {
+    fs.chmodSync(file, mode);
+  } catch {}
+}
+
+function ensurePrivateDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: PRIVATE_DIR_MODE });
+  chmodPrivate(dir, PRIVATE_DIR_MODE);
+}
+
+function fsyncDir(dir) {
+  if (process.platform === "win32") return;
+  let fd;
+  try {
+    fd = fs.openSync(dir, "r");
+    fs.fsyncSync(fd);
+  } catch {
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function atomicWritePrivateFile(file, data) {
+  ensurePrivateDir(path.dirname(file));
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+  let fd;
+  try {
+    fd = fs.openSync(tmp, "wx", PRIVATE_FILE_MODE);
+    fs.writeFileSync(fd, data);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    chmodPrivate(tmp, PRIVATE_FILE_MODE);
+    fs.renameSync(tmp, file);
+    chmodPrivate(file, PRIVATE_FILE_MODE);
+    fsyncDir(path.dirname(file));
+  } catch (error) {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch {}
+    }
+    try { fs.rmSync(tmp, { force: true }); } catch {}
+    throw error;
+  }
+}
+
+function writeRelayConfig(config, file = relayConfigFile()) {
+  atomicWritePrivateFile(file, `${JSON.stringify(config, null, 2)}\n`);
+}
+
+function randomIpcSecret() {
+  return crypto.randomBytes(32).toString("base64url");
+}
+
+function relayPeerIdForOptions(options, current) {
+  const relayName = options.relayName === undefined ? undefined : normalizeRelayName(options.relayName);
+  const relayAlias = options.relayName === undefined ? undefined : normalizeRelayAlias(String(options.relayName).split("#")[0]);
+  if (options.relayName !== undefined && (!relayName || !relayAlias)) {
+    throw new Error("Relay name must contain an alias and optional four-digit discriminator, such as relay-a#0000.");
+  }
+  if (options.relayPeerId) return options.relayPeerId;
+  if (relayName && normalizeRelayName(current.relayIdentity?.logicalName) === relayName && current.relayPeerId) return current.relayPeerId;
+  if (relayAlias) return relayAlias;
+  return current.relayPeerId || randomRelayPeerId("relay");
+}
+
+function ensureRelayConfig(options = {}) {
+  const file = options.file || relayConfigFile(options.dataDir);
+  const current = readRelayConfig(file);
+  const relayPeerId = relayPeerIdForOptions(options, current);
+  const relayMeshPeerId = relayMeshPeerIdForRoomPeerId(relayPeerId);
+  const peerJsSignaling = options.peerJsSignaling || peerJsSignalingConfig();
+  const forcePeerJsSignaling = options.forcePeerJsSignaling === true;
+  const currentRelayAddress = forcePeerJsSignaling ? undefined : relayMeshAddressFromAddress(current.relayAddress, peerJsSignaling);
+  const shouldRewriteRelayAddress = forcePeerJsSignaling || options.relayPeerId || relayPeerId !== current.relayPeerId;
+  const ipcSecret = typeof current.ipcSecret === "string" && current.ipcSecret
+    ? current.ipcSecret
+    : randomIpcSecret();
+  const relayName = normalizeRelayName(options.relayName) || normalizeRelayName(current.relayIdentity?.logicalName) || normalizeRelayName(relayPeerId);
+  const relayIdentity = ensureRelayIdentity(current.relayIdentity, relayName);
+  const config = {
+    relayPeerId,
+    relayMeshPeerId,
+    relayAddress: shouldRewriteRelayAddress ? relayMeshAddressForPeerId(relayPeerId, peerJsSignaling) : currentRelayAddress || relayMeshAddressForPeerId(relayPeerId, peerJsSignaling),
+    ipcHost: options.ipcHost || current.ipcHost || DEFAULT_RELAY_IPC_HOST,
+    ipcPort: Number(options.ipcPort ?? current.ipcPort ?? DEFAULT_RELAY_IPC_PORT),
+    ipcSecret,
+    relayIdentity,
+    createdAt: current.createdAt || Date.now()
+  };
+  writeRelayConfig(config, file);
+  return config;
+}
+
+function rotateRelayConfigPeerId(config, options = {}) {
+  const file = options.file || relayConfigFile(options.dataDir);
+  const current = readRelayConfig(file);
+  const peerJsSignaling = options.peerJsSignaling || peerJsSignalingConfig();
+  const logicalName = normalizeRelayName(config?.relayIdentity?.logicalName || current.relayIdentity?.logicalName || "relay") || "relay#0000";
+  const relayAlias = normalizeRelayAlias(logicalName.split("#")[0]) || "relay";
+  const relayPeerId = options.relayPeerId || randomRelayPeerId(relayAlias);
+  const relayMeshPeerId = relayMeshPeerIdForRoomPeerId(relayPeerId);
+  const relayAddress = relayMeshAddressForPeerId(relayPeerId, peerJsSignaling);
+  const relayIdentity = ensureRelayIdentity(current.relayIdentity || config.relayIdentity, logicalName);
+  relayIdentity.sequence = Number.isInteger(relayIdentity.sequence) ? relayIdentity.sequence + 1 : 2;
+  relayIdentity.updatedAt = Date.now();
+  const next = {
+    ...current,
+    relayPeerId,
+    relayMeshPeerId,
+    relayAddress,
+    ipcHost: config.ipcHost || current.ipcHost || DEFAULT_RELAY_IPC_HOST,
+    ipcPort: Number(config.ipcPort ?? current.ipcPort ?? DEFAULT_RELAY_IPC_PORT),
+    ipcSecret: config.ipcSecret || current.ipcSecret || randomIpcSecret(),
+    relayIdentity,
+    createdAt: current.createdAt || config.createdAt || Date.now()
+  };
+  writeRelayConfig(next, file);
+  return next;
+}
+
+module.exports = {
+  DEFAULT_RELAY_IPC_HOST,
+  DEFAULT_RELAY_IPC_PORT,
+  ensureRelayConfig,
+  readRelayConfig,
+  relayConfigFile,
+  rotateRelayConfigPeerId,
+  writeRelayConfig
+};

package/runtime/host/relayHostAuth.cjs

@@ -0,0 +1,39 @@
+const { sendMessage } = require("@mh-gg/relay-core");
+
+function createRelayHostAuth(ipcSecret) {
+  function hasHostIpcAuth(message) {
+    return message?.auth?.type === "relay-ipc" && message.auth.secret === ipcSecret;
+  }
+
+  function sendHostAuthError(conn, type) {
+    sendMessage(conn, {
+      type,
+      code: "auth-required",
+      message: "Relay IPC auth failed"
+    });
+  }
+
+  function requireHostIpcAuth(conn, message) {
+    if (hasHostIpcAuth(message)) {
+      conn.MatterhornHostAuthorized = true;
+      return true;
+    }
+    if (message.type === "host.register") {
+      sendHostAuthError(conn, "host.register.error");
+      return false;
+    }
+    if (message.type === "host.snapshot" || !conn.MatterhornHostAuthorized) {
+      sendHostAuthError(conn, "host.auth.error");
+      return false;
+    }
+    return true;
+  }
+
+  return {
+    requireHostIpcAuth
+  };
+}
+
+module.exports = {
+  createRelayHostAuth
+};

package/runtime/host/relayHostMessages.cjs

@@ -0,0 +1,367 @@
+const { relayRoomStoreSnapshot } = require("@mh-gg/relay-runtime");
+const { sendMessage } = require("@mh-gg/relay-core");
+const { manifestHash } = require("@mh-gg/base");
+const { ROOM_STATE_SCHEMA_VERSION, createRoomDeviceKeyAuthenticator, isRoomDeviceSignedOperation } = require("@mh-gg/host-runtime");
+const { canonicalAppRef, loadMatterhornApp } = require("../bin/matterhornAppLoader.cjs");
+
+function appUsesExampleOperationAuth(appRef, app) {
+  const sourceRef = canonicalAppRef(appRef || app?.ref || "");
+  return app?.host?.runner === "matterhorn-example-host" ||
+    app?.deployment?.host?.runner === "matterhorn-example-host" ||
+    sourceRef.startsWith("@mh-gg/example-");
+}
+
+function createExampleOperationAuthenticator() {
+  const authenticateRoomDevice = createRoomDeviceKeyAuthenticator();
+  return async function authenticateExampleActor(auth, actor, operation) {
+    if (isRoomDeviceSignedOperation(operation)) return authenticateRoomDevice(auth, actor, operation);
+    if (!auth || auth.signature !== "sig") throw new Error("Bad example signature");
+    return actor;
+  };
+}
+
+function createRelayHostMessageHandler({
+  config,
+  relayPluginRuntimes,
+  hostConnections,
+  clientConnections,
+  mesh,
+  roomStores,
+  sendToClient,
+  catchUpMatterhornRuntime = async () => {},
+  prepareRoomRuntimeInput = (input) => input
+}) {
+  function sendRoomMismatch(conn, expectedRoomName, requestedRoomName) {
+    sendMessage(conn, {
+      type: "host.message.error",
+      code: "room-mismatch",
+      message: `Host connection is registered for ${expectedRoomName || "no room"}, not ${requestedRoomName || "unknown room"}`
+    });
+  }
+
+  function requireRegisteredRoom(conn, requestedRoomName) {
+    if (!conn.hostRoomName) {
+      sendMessage(conn, { type: "host.message.error", code: "host-not-registered", message: "Host must register a room before sending room commands" });
+      return undefined;
+    }
+    const roomName = requestedRoomName || conn.hostRoomName;
+    if (roomName !== conn.hostRoomName) {
+      sendRoomMismatch(conn, conn.hostRoomName, roomName);
+      return undefined;
+    }
+    return roomName;
+  }
+
+  function roomAppSourceRef(roomApp) {
+    if (typeof roomApp?.sourceRef === "string" && roomApp.sourceRef) return roomApp.sourceRef;
+    const frontend = Array.isArray(roomApp?.frontends) ? roomApp.frontends.find((item) => typeof item?.sourceRef === "string" && item.sourceRef) : undefined;
+    return frontend?.sourceRef;
+  }
+
+  function roomRuntimeSourceRef(message) {
+    if (typeof message.appRef === "string" && message.appRef) return message.appRef;
+    return roomAppSourceRef(message.store?.roomApp);
+  }
+
+  function roomExpectsRuntime(message) {
+    return Boolean(relayPluginRuntimes && roomRuntimeSourceRef(message));
+  }
+
+  function matterhornRuntimeState(store, roomName, appPackId) {
+    const state = store?.state;
+    if (!state || typeof state !== "object" || Array.isArray(state)) return undefined;
+    if (state.schemaVersion !== 1) return undefined;
+    if (state.roomId !== roomName) return undefined;
+    if (state.appPack?.id !== appPackId) return undefined;
+    if (!state.appPack?.hash || !Number.isInteger(state.version)) return undefined;
+    if (!state.plugins || typeof state.plugins !== "object" || Array.isArray(state.plugins)) return undefined;
+    if (!state.pluginVersions || typeof state.pluginVersions !== "object" || Array.isArray(state.pluginVersions)) return undefined;
+    if (!Array.isArray(state.seenOperations)) return undefined;
+    return state;
+  }
+
+  function clonePlain(value) {
+    return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+  }
+
+  function roomAppPackForRuntime(app) {
+    return {
+      id: app.appPack.id,
+      version: app.appPack.version,
+      hash: app.appPack.hash || manifestHash(app.appPack),
+      protocolHash: app.appPack.protocolHash || app.appPack.compatibility?.appProtocolHash,
+      ...(app.matterhorn ? { matterhorn: clonePlain(app.matterhorn) } : {}),
+      ...(app.appPack.metadata ? { metadata: clonePlain(app.appPack.metadata) } : {})
+    };
+  }
+
+  function schemaDefinedPrimaryPlugin(app) {
+    return Array.isArray(app.hostPlugins) ? app.hostPlugins.find((plugin) => plugin?.schemaDefined === true) : undefined;
+  }
+
+  function memberRoleForGuest(guest, adminIds = [], memberId) {
+    if (guest?.role === "admin" || adminIds.includes(guest?.id) || adminIds.includes(guest?.memberId) || adminIds.includes(memberId)) return "admin";
+    if (guest?.role === "owner" || guest?.role === "moderator" || guest?.role === "member") return guest.role;
+    return "member";
+  }
+
+  function legacyMembersFromStore(store) {
+    const members = {};
+    for (const [key, member] of Object.entries(store?.members || {})) {
+      const id = member.profileId || member.memberId || member.id || key;
+      if (!id) continue;
+      members[id] = {
+        ...(members[id] || {}),
+        id,
+        memberId: id,
+        role: member.role || "member",
+        credentialId: member.credentialId,
+        deviceId: member.deviceId
+      };
+    }
+    const guests = store?.state?.guests && typeof store.state.guests === "object" ? store.state.guests : {};
+    const adminIds = Array.isArray(store?.state?.adminIds) ? store.state.adminIds : [];
+    for (const [key, guest] of Object.entries(guests)) {
+      const id = guest.memberId || guest.id || key;
+      if (!id) continue;
+      members[id] = {
+        ...(members[id] || {}),
+        id,
+        memberId: id,
+        name: guest.name,
+        displayName: guest.name,
+        avatar: guest.avatar,
+        role: memberRoleForGuest(guest, adminIds, id),
+        status: guest.bannedAt ? "banned" : undefined,
+        bannedAt: guest.bannedAt
+      };
+    }
+    return members;
+  }
+
+  function legacySeenOperations(store) {
+    const stateSeen = store?.state?.seenOperations;
+    if (Array.isArray(stateSeen)) return stateSeen.filter((id) => typeof id === "string");
+    return (Array.isArray(store?.seenMutations) ? store.seenMutations : [])
+      .map((mutation) => typeof mutation === "string" ? mutation : mutation?.id)
+      .filter((id) => typeof id === "string");
+  }
+
+  function hasLegacyStateData(value) {
+    if (value === null || value === undefined) return false;
+    if (Array.isArray(value)) return value.length > 0 && value.some(hasLegacyStateData);
+    if (typeof value === "object") return Object.keys(value).length > 0 && Object.values(value).some(hasLegacyStateData);
+    if (typeof value === "string") return value.length > 0;
+    return true;
+  }
+
+  const legacyStateMetadataKeys = new Set(["version", "createdAt", "updatedAt", "seenOperations", "adminIds", "guests"]);
+  const weakSchemaMatchKeys = new Set(["activity"]);
+
+  function hasLegacyPrimaryPluginState(state) {
+    return Object.entries(state).some(([key, value]) => !legacyStateMetadataKeys.has(key) && hasLegacyStateData(value));
+  }
+
+  function primaryPluginInitialState(primaryPlugin, app) {
+    const pluginInitial = primaryPlugin?.stateSchemaDescriptor?.state?.initial;
+    if (pluginInitial && typeof pluginInitial === "object" && !Array.isArray(pluginInitial)) return pluginInitial;
+    const modelInitial = app?.appPack?.composition?.primaryPlugin?.model?.state?.initial;
+    if (modelInitial && typeof modelInitial === "object" && !Array.isArray(modelInitial)) return modelInitial;
+    return undefined;
+  }
+
+  function legacyStateMatchesCurrentPrimaryPlugin(state, primaryPlugin, app) {
+    if (primaryPlugin?.schemaDefined !== true) return true;
+    const initial = primaryPluginInitialState(primaryPlugin, app);
+    if (!initial) return true;
+    const modelKeys = Object.keys(initial).filter((key) => !legacyStateMetadataKeys.has(key) && !weakSchemaMatchKeys.has(key));
+    if (modelKeys.length === 0) return true;
+    return modelKeys.some((key) => Object.prototype.hasOwnProperty.call(state, key) && hasLegacyStateData(state[key]));
+  }
+
+  function legacyHostStateAsRuntimeState(store, roomName, app) {
+    const state = store?.state;
+    if (!state || typeof state !== "object" || Array.isArray(state)) return undefined;
+    if (!hasLegacyPrimaryPluginState(state)) return undefined;
+    const primaryPlugin = schemaDefinedPrimaryPlugin(app);
+    if (!primaryPlugin?.id) return undefined;
+    if (!legacyStateMatchesCurrentPrimaryPlugin(state, primaryPlugin, app)) return undefined;
+    const timestamp = Number(state.updatedAt || state.createdAt || Date.now());
+    return {
+      schemaVersion: ROOM_STATE_SCHEMA_VERSION,
+      roomId: roomName,
+      appPack: roomAppPackForRuntime(app),
+      version: Number.isInteger(state.version) && state.version >= 0 ? state.version : 0,
+      createdAt: Number(state.createdAt || timestamp),
+      updatedAt: timestamp,
+      members: legacyMembersFromStore(store),
+      revokedCredentialIds: [],
+      pluginVersions: { [primaryPlugin.id]: primaryPlugin.version },
+      plugins: { [primaryPlugin.id]: clonePlain(state) },
+      seenOperations: legacySeenOperations(store)
+    };
+  }
+
+  function operationAuthFromMessage(message) {
+    const auth = message.store?.roomApp?.operationAuth || message.operationAuth;
+    const grants = message.operationRoleKeyGrants || auth?.grants;
+    const authorities = message.operationGrantAuthorities || auth?.authorities;
+    const requireSignedGrants = message.requireSignedOperationRoleKeyGrants ?? auth?.requireSignedGrants;
+    const grantCount = Array.isArray(grants) ? grants.length : grants ? Object.keys(grants).length : 0;
+    return { grants, authorities, requireSignedGrants, hasGrants: grantCount > 0 };
+  }
+
+  function enableRoomAppRuntime(message) {
+    const appRef = roomRuntimeSourceRef(message);
+    if (!relayPluginRuntimes || !appRef) return undefined;
+
+    const app = loadMatterhornApp(appRef, { cwd: message.appCwd || process.cwd() });
+    const auth = operationAuthFromMessage(message);
+    const appPack = roomAppPackForRuntime(app);
+    const storeRoomApp = message.store?.roomApp || {};
+    const composition = {
+      roomName: message.roomName,
+      appPack,
+      hostPack: app.hostPack,
+      plugins: app.hostPlugins,
+      expectedPlugins: app.hostPlugins,
+      playerPacks: app.playerPacks,
+      roomApp: storeRoomApp.matterhorn ? storeRoomApp : (app.matterhorn ? { ...storeRoomApp, matterhorn: app.matterhorn } : storeRoomApp),
+      capabilities: ["room.state", "room.roles"]
+    };
+    const state = matterhornRuntimeState(message.store, message.roomName, appPack.id) || legacyHostStateAsRuntimeState(message.store, message.roomName, app);
+    if (state) composition.state = state;
+    if (auth.hasGrants) {
+      composition.operationRoleKeyGrants = auth.grants;
+      composition.operationGrantAuthorities = auth.authorities;
+      if (auth.requireSignedGrants === false) composition.allowUnsignedOperationRoleKeyGrants = true;
+    } else if (appUsesExampleOperationAuth(appRef, app)) {
+      composition.authenticateActor = createExampleOperationAuthenticator();
+    }
+    const ready = relayPluginRuntimes.enableRoomComposition(prepareRoomRuntimeInput(composition));
+    return Promise.resolve(ready).then(async (result) => {
+      await catchUpMatterhornRuntime(message.roomName, message.store?.roomSecret);
+      return result;
+    });
+  }
+
+  function finishRegister(conn, message, incomingStore) {
+    if (incomingStore) roomStores.set(message.roomName, incomingStore);
+    hostConnections.set(message.roomName, conn);
+    conn.hostRoomName = message.roomName;
+    sendMessage(conn, {
+      type: "host.register.ok",
+      roomName: message.roomName,
+      relayPeerId: config.relayPeerId,
+      relayAddress: config.relayAddress
+    });
+  }
+
+  function sendRuntimeError(conn, error) {
+    sendMessage(conn, {
+      type: "host.register.error",
+      code: "room-app-runtime",
+      message: error?.message || "Room app runtime registration failed."
+    });
+  }
+
+  function handleRegister(conn, message) {
+    if (typeof message.roomName !== "string" || !message.roomName) {
+      sendMessage(conn, { type: "host.register.error", message: "roomName is required" });
+      return;
+    }
+    if (conn.hostRoomName && conn.hostRoomName !== message.roomName) {
+      sendRoomMismatch(conn, conn.hostRoomName, message.roomName);
+      return;
+    }
+
+    const incomingStore = relayRoomStoreSnapshot(message.roomName, message.store);
+    mesh.learnRelayHints(message.relayHints);
+    let runtimeReady;
+    try {
+      runtimeReady = enableRoomAppRuntime({ ...message, store: incomingStore || message.store });
+    } catch (error) {
+      sendRuntimeError(conn, error);
+      return;
+    }
+    if (!runtimeReady && roomExpectsRuntime(message)) {
+      sendRuntimeError(conn, new Error(`Room "${message.roomName}" has an app composition but the relay could not enable its plugin runtime. Provide a loadable appRef or roomApp.sourceRef.`));
+      return;
+    }
+    if (runtimeReady && typeof runtimeReady.then === "function") {
+      void runtimeReady
+        .then(() => finishRegister(conn, message, incomingStore))
+        .catch((error) => sendRuntimeError(conn, error));
+      return;
+    }
+    finishRegister(conn, message, incomingStore);
+  }
+
+  function handleSnapshot(conn, message) {
+    const roomName = requireRegisteredRoom(conn, typeof message.roomName === "string" ? message.roomName : undefined);
+    if (!roomName) return;
+    const incomingStore = relayRoomStoreSnapshot(roomName, message.store);
+    const snapshotMessage = { ...message, roomName, store: incomingStore || message.store };
+    const finishSnapshot = () => {
+      if (incomingStore) roomStores.set(roomName, incomingStore);
+      if (incomingStore?.roomApp) relayPluginRuntimes?.updateRoomApp?.(roomName, incomingStore.roomApp);
+    };
+    let runtimeReady;
+    try {
+      runtimeReady = enableRoomAppRuntime(snapshotMessage);
+    } catch (error) {
+      sendRuntimeError(conn, error);
+      return;
+    }
+    if (runtimeReady && typeof runtimeReady.then === "function") {
+      void runtimeReady
+        .then(finishSnapshot)
+        .catch((error) => sendRuntimeError(conn, error));
+      return;
+    }
+    finishSnapshot();
+  }
+
+  function closeClient(peerId) {
+    const client = clientConnections.get(peerId);
+    if (client) {
+      client.close?.();
+      return;
+    }
+    mesh.sendEnvelope({
+      type: "relay.client.close",
+      peerId
+    });
+  }
+
+  function handleHostMessage(conn, message) {
+    switch (message.type) {
+      case "host.register":
+        handleRegister(conn, message);
+        return;
+      case "host.snapshot":
+        handleSnapshot(conn, message);
+        return;
+      case "host.send": {
+        const roomName = requireRegisteredRoom(conn, message.roomName);
+        if (!roomName) return;
+        sendToClient(message.peerId, message.message, roomName);
+        return;
+      }
+      case "host.close":
+        if (!requireRegisteredRoom(conn, message.roomName)) return;
+        closeClient(message.peerId);
+        return;
+      default:
+        return;
+    }
+  }
+
+  return {
+    handleHostMessage
+  };
+}
+
+module.exports = {
+  createRelayHostMessageHandler
+};

package/runtime/host/relayHttp.cjs

@@ -0,0 +1,48 @@
+const http = require("node:http");
+
+function createRelayHttpServer({ wss, relayInformation, health, allowedWebSocketPaths = ["/room", "/nostr"] }) {
+  const server = http.createServer((request, response) => {
+    const acceptsNip11 = String(request.headers.accept || "").includes("application/nostr+json");
+    if (request.method === "GET" && request.url === "/" && acceptsNip11) {
+      response.writeHead(200, {
+        "access-control-allow-origin": "*",
+        "content-type": "application/nostr+json"
+      });
+      response.end(JSON.stringify(relayInformation()));
+      return;
+    }
+
+    if (request.method === "GET" && request.url === "/health") {
+      response.writeHead(200, { "content-type": "application/json" });
+      response.end(JSON.stringify(health()));
+      return;
+    }
+
+    if (request.method === "GET" && request.url === "/") {
+      response.writeHead(200, { "content-type": "text/plain; charset=utf-8" });
+      response.end("matterhorn peer relay\n\nThis is a Nostr relay bridge for matterhorn PeerJS data channels.\n");
+      return;
+    }
+
+    response.writeHead(404, { "content-type": "text/plain; charset=utf-8" });
+    response.end("not found\n");
+  });
+
+  server.on("upgrade", (request, socket, head) => {
+    const url = new URL(request.url || "/", "http://127.0.0.1");
+    if (!allowedWebSocketPaths.includes(url.pathname)) {
+      socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+    wss.handleUpgrade(request, socket, head, (ws) => {
+      wss.emit("connection", ws, request);
+    });
+  });
+
+  return server;
+}
+
+module.exports = {
+  createRelayHttpServer
+};