@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/host/relayIdentity.cjs

@@ -0,0 +1,496 @@
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { relayMeshAddressFromAddress } = require("@mh-gg/relay-core");
+const { canonicalJson } = require("@mh-gg/event/canonicalJson");
+const { userDataDir } = require("./matterhornrc.cjs");
+
+const RELAY_CLAIM_KIND = "matterhorn.relay-claim.v1";
+const RELAY_CONTROL_KIND = "matterhorn.relay-control.v1";
+const RELAY_IDENTITY_KIND = "matterhorn.relay-identity.v1";
+const RELAY_INVITE_PREFIX = "matterhorn-relay:";
+const RELAY_PUBLIC_KEY_FINGERPRINT_PREFIX = "sha256-spki:";
+const RELAY_CONTROL_MAX_AGE_MS = 120_000;
+const RELAY_CONTROL_MAX_FUTURE_MS = 30_000;
+const DEFAULT_RELAY_ALIAS_DISCRIMINATOR = "0000";
+const PRIVATE_DIR_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+
+function clonePlain(value) {
+  return value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+}
+
+function isObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeRelayAlias(value) {
+  const text = String(value || "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 64);
+  if (!text || !/^[a-z0-9_-]{1,64}$/.test(text)) return undefined;
+  return text;
+}
+
+function normalizeRelayDiscriminator(value) {
+  if (value === undefined || value === null || value === "") return DEFAULT_RELAY_ALIAS_DISCRIMINATOR;
+  const text = String(value).trim();
+  return /^[0-9]{4}$/.test(text) ? text : undefined;
+}
+
+function relayNameParts(value) {
+  const raw = String(value || "").trim();
+  const hashIndex = raw.lastIndexOf("#");
+  const aliasRaw = hashIndex >= 0 ? raw.slice(0, hashIndex) : raw;
+  const discriminatorRaw = hashIndex >= 0 ? raw.slice(hashIndex + 1) : undefined;
+  const alias = normalizeRelayAlias(aliasRaw);
+  const discriminator = normalizeRelayDiscriminator(discriminatorRaw);
+  if (!alias || !discriminator) return undefined;
+  return {
+    alias,
+    discriminator,
+    logicalName: `${alias}#${discriminator}`
+  };
+}
+
+function normalizeRelayName(value) {
+  return relayNameParts(value)?.logicalName;
+}
+
+function chmodPrivate(file, mode) {
+  try {
+    fs.chmodSync(file, mode);
+  } catch {}
+}
+
+function ensurePrivateDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: PRIVATE_DIR_MODE });
+  chmodPrivate(dir, PRIVATE_DIR_MODE);
+}
+
+function atomicWritePrivateJson(file, value) {
+  ensurePrivateDir(path.dirname(file));
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+  fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`, { mode: PRIVATE_FILE_MODE });
+  chmodPrivate(tmp, PRIVATE_FILE_MODE);
+  fs.renameSync(tmp, file);
+  chmodPrivate(file, PRIVATE_FILE_MODE);
+}
+
+function publicKeySpkiDer(publicKeyPem) {
+  return crypto.createPublicKey(String(publicKeyPem || "")).export({ type: "spki", format: "der" });
+}
+
+function publicKeyFingerprint(publicKeyPem) {
+  return `${RELAY_PUBLIC_KEY_FINGERPRINT_PREFIX}${crypto.createHash("sha256").update(publicKeySpkiDer(publicKeyPem)).digest("base64url")}`;
+}
+
+function fingerprintMatches(publicKeyPem, fingerprint) {
+  try {
+    return fingerprint === publicKeyFingerprint(publicKeyPem);
+  } catch {
+    return false;
+  }
+}
+
+// The Ed25519 identity key signs relay claims/control. VAPID push grants are
+// wrapped with X25519 ECDH, which Ed25519 keys cannot do, so the relay also
+// carries a dedicated X25519 grant keypair. Its public key is advertised in the
+// signed claim (as base64url SPKI DER) so clients can wrap grants the relay can
+// later unwrap with the matching private key.
+function generateGrantKeyPair() {
+  return crypto.generateKeyPairSync("x25519", {
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+}
+
+// Adds the X25519 grant keypair to an identity that predates push support,
+// preserving the Ed25519 identity (and its fingerprint/trust pins) untouched.
+function ensureGrantKeys(identity) {
+  if (!isObject(identity)) return identity;
+  if (typeof identity.grantPrivateKeyPem === "string" && identity.grantPrivateKeyPem
+    && typeof identity.grantPublicKeyPem === "string" && identity.grantPublicKeyPem) {
+    return identity;
+  }
+  const grant = generateGrantKeyPair();
+  return { ...identity, grantPublicKeyPem: grant.publicKey, grantPrivateKeyPem: grant.privateKey };
+}
+
+function generateRelayIdentity(logicalName, now = Date.now()) {
+  const name = relayNameParts(logicalName);
+  if (!name) throw new Error("Relay name must contain an alias and optional four-digit discriminator, such as relay-a#0000.");
+  const keys = crypto.generateKeyPairSync("ed25519", {
+    publicKeyEncoding: { type: "spki", format: "pem" },
+    privateKeyEncoding: { type: "pkcs8", format: "pem" }
+  });
+  const grant = generateGrantKeyPair();
+  return {
+    kind: RELAY_IDENTITY_KIND,
+    alias: name.alias,
+    discriminator: name.discriminator,
+    logicalName: name.logicalName,
+    publicKeyPem: keys.publicKey,
+    privateKeyPem: keys.privateKey,
+    publicKeyFingerprint: publicKeyFingerprint(keys.publicKey),
+    grantPublicKeyPem: grant.publicKey,
+    grantPrivateKeyPem: grant.privateKey,
+    sequence: 1,
+    createdAt: now
+  };
+}
+
+function normalizedRelayIdentity(identity) {
+  if (!isObject(identity)) return undefined;
+  const name = relayNameParts(identity.logicalName || identity.alias);
+  if (!name) return undefined;
+  return {
+    ...identity,
+    alias: name.alias,
+    discriminator: name.discriminator,
+    logicalName: name.logicalName
+  };
+}
+
+function validRelayIdentity(identity, logicalName) {
+  const name = relayNameParts(logicalName);
+  const normalized = normalizedRelayIdentity(identity);
+  if (!name || !normalized || normalized.logicalName !== name.logicalName) return false;
+  if (normalized.kind !== RELAY_IDENTITY_KIND) return false;
+  if (typeof normalized.publicKeyPem !== "string" || !normalized.publicKeyPem) return false;
+  if (typeof normalized.privateKeyPem !== "string" || !normalized.privateKeyPem) return false;
+  if (!fingerprintMatches(normalized.publicKeyPem, normalized.publicKeyFingerprint)) return false;
+  if (!Number.isInteger(normalized.sequence) || normalized.sequence < 1) return false;
+  return true;
+}
+
+function ensureRelayIdentity(current, logicalName, now = Date.now()) {
+  const name = relayNameParts(logicalName);
+  if (!name) throw new Error("Relay name must contain an alias and optional four-digit discriminator, such as relay-a#0000.");
+  const normalized = normalizedRelayIdentity(current);
+  if (validRelayIdentity(normalized, name.logicalName)) return ensureGrantKeys(clonePlain(normalized));
+  return generateRelayIdentity(name.logicalName, now);
+}
+
+function unsignedClaim(claim) {
+  if (!isObject(claim)) return undefined;
+  const { signature, ...unsigned } = claim;
+  return unsigned;
+}
+
+function signRelayClaim(identity, input = {}, now = Date.now()) {
+  if (!validRelayIdentity(identity, identity?.logicalName)) throw new Error("Relay identity is invalid.");
+  const claim = {
+    kind: RELAY_CLAIM_KIND,
+    alias: identity.alias,
+    discriminator: identity.discriminator,
+    logicalName: identity.logicalName,
+    relayAddress: input.relayAddress,
+    roomPeerId: input.roomPeerId,
+    relayMeshPeerId: input.relayMeshPeerId,
+    publicKeyPem: identity.publicKeyPem,
+    publicKeyFingerprint: identity.publicKeyFingerprint,
+    sequence: Number.isInteger(identity.sequence) ? identity.sequence : 1,
+    issuedAt: Number.isFinite(input.issuedAt) ? input.issuedAt : now
+  };
+  if (typeof input.previousRelayAddress === "string" && input.previousRelayAddress) {
+    claim.previousRelayAddress = input.previousRelayAddress;
+  }
+  // X25519 grant key (base64url SPKI DER) clients wrap VAPID grants to. Included
+  // in the signed payload so it is tamper-evident like the rest of the claim.
+  if (typeof identity.grantPublicKeyPem === "string" && identity.grantPublicKeyPem) {
+    claim.grantPublicKey = publicKeySpkiDer(identity.grantPublicKeyPem).toString("base64url");
+  }
+  const payload = Buffer.from(canonicalJson(claim), "utf8");
+  claim.signature = crypto.sign(null, payload, identity.privateKeyPem).toString("base64url");
+  return claim;
+}
+
+function verifyRelayClaim(claim) {
+  if (!isObject(claim)) return { ok: false, code: "invalid-claim", message: "Relay claim must be an object." };
+  if (claim.kind !== RELAY_CLAIM_KIND) return { ok: false, code: "invalid-claim", message: "Relay claim kind is invalid." };
+  const name = relayNameParts(claim.logicalName);
+  if (!name || name.logicalName !== claim.logicalName) return { ok: false, code: "invalid-claim", message: "Relay claim logicalName is invalid." };
+  if (claim.alias !== undefined && claim.alias !== name.alias) return { ok: false, code: "invalid-claim", message: "Relay claim alias is invalid." };
+  if (claim.discriminator !== undefined && claim.discriminator !== name.discriminator) return { ok: false, code: "invalid-claim", message: "Relay claim discriminator is invalid." };
+  for (const field of ["relayAddress", "roomPeerId", "relayMeshPeerId", "publicKeyPem", "publicKeyFingerprint", "signature"]) {
+    if (typeof claim[field] !== "string" || !claim[field]) return { ok: false, code: "invalid-claim", message: `Relay claim ${field} is invalid.` };
+  }
+  if (!Number.isInteger(claim.sequence) || claim.sequence < 1) return { ok: false, code: "invalid-claim", message: "Relay claim sequence is invalid." };
+  if (!Number.isFinite(claim.issuedAt) || claim.issuedAt <= 0) return { ok: false, code: "invalid-claim", message: "Relay claim issuedAt is invalid." };
+  if (!fingerprintMatches(claim.publicKeyPem, claim.publicKeyFingerprint)) {
+    return { ok: false, code: "invalid-claim", message: "Relay claim public key fingerprint does not match." };
+  }
+  try {
+    const payload = Buffer.from(canonicalJson(unsignedClaim(claim)), "utf8");
+    const signature = Buffer.from(claim.signature, "base64url");
+    if (!crypto.verify(null, payload, claim.publicKeyPem, signature)) {
+      return { ok: false, code: "invalid-signature", message: "Relay claim signature is invalid." };
+    }
+  } catch {
+    return { ok: false, code: "invalid-signature", message: "Relay claim signature is invalid." };
+  }
+  return {
+    ok: true,
+    claim: {
+      ...clonePlain(claim),
+      alias: name.alias,
+      discriminator: name.discriminator,
+      logicalName: name.logicalName
+    }
+  };
+}
+
+function unsignedRelayControl(control) {
+  if (!isObject(control)) return undefined;
+  const { signature, ...unsigned } = control;
+  return unsigned;
+}
+
+function signRelayControl(identity, input = {}, now = Date.now()) {
+  if (!validRelayIdentity(identity, identity?.logicalName)) throw new Error("Relay identity is invalid.");
+  const control = {
+    kind: RELAY_CONTROL_KIND,
+    type: input.type || "relay.disconnecting",
+    relayAddress: input.relayAddress,
+    roomPeerId: input.roomPeerId,
+    relayMeshPeerId: input.relayMeshPeerId,
+    issuedAt: Number.isFinite(input.issuedAt) ? input.issuedAt : now,
+    nonce: typeof input.nonce === "string" && input.nonce ? input.nonce : crypto.randomBytes(16).toString("base64url")
+  };
+  if (typeof input.roomName === "string" && input.roomName) control.roomName = input.roomName;
+  const payload = Buffer.from(canonicalJson(control), "utf8");
+  control.signature = crypto.sign(null, payload, identity.privateKeyPem).toString("base64url");
+  return control;
+}
+
+function verifyRelayControl(control, relayClaim, options = {}) {
+  if (!isObject(control)) return { ok: false, code: "invalid-control", message: "Relay control must be an object." };
+  if (control.kind !== RELAY_CONTROL_KIND) return { ok: false, code: "invalid-control", message: "Relay control kind is invalid." };
+  if (control.type !== "relay.disconnecting") return { ok: false, code: "invalid-control", message: "Relay control type is invalid." };
+  for (const field of ["relayAddress", "roomPeerId", "relayMeshPeerId", "nonce", "signature"]) {
+    if (typeof control[field] !== "string" || !control[field]) return { ok: false, code: "invalid-control", message: `Relay control ${field} is invalid.` };
+  }
+  if (!Number.isFinite(control.issuedAt) || control.issuedAt <= 0) return { ok: false, code: "invalid-control", message: "Relay control issuedAt is invalid." };
+  const now = Number.isFinite(options.now) ? options.now : Date.now();
+  const maxAgeMs = Number.isFinite(options.maxAgeMs) ? options.maxAgeMs : RELAY_CONTROL_MAX_AGE_MS;
+  const maxFutureMs = Number.isFinite(options.maxFutureMs) ? options.maxFutureMs : RELAY_CONTROL_MAX_FUTURE_MS;
+  if (control.issuedAt < now - maxAgeMs || control.issuedAt > now + maxFutureMs) {
+    return { ok: false, code: "stale-control", message: "Relay control is stale." };
+  }
+  if (typeof options.expectedRelayAddress === "string" && options.expectedRelayAddress && control.relayAddress !== options.expectedRelayAddress) {
+    return { ok: false, code: "address-mismatch", message: "Relay control address does not match the current primary relay." };
+  }
+  const claimResult = verifyRelayClaim(relayClaim);
+  if (!claimResult.ok) return claimResult;
+  const claim = claimResult.claim;
+  if (claim.relayAddress !== control.relayAddress) {
+    return { ok: false, code: "address-mismatch", message: "Relay control does not match the relay claim address." };
+  }
+  if (claim.roomPeerId !== control.roomPeerId || claim.relayMeshPeerId !== control.relayMeshPeerId) {
+    return { ok: false, code: "identity-mismatch", message: "Relay control peer identity does not match the relay claim." };
+  }
+  try {
+    const payload = Buffer.from(canonicalJson(unsignedRelayControl(control)), "utf8");
+    const signature = Buffer.from(control.signature, "base64url");
+    if (!crypto.verify(null, payload, claim.publicKeyPem, signature)) {
+      return { ok: false, code: "invalid-signature", message: "Relay control signature is invalid." };
+    }
+  } catch {
+    return { ok: false, code: "invalid-signature", message: "Relay control signature is invalid." };
+  }
+  return { ok: true, control: clonePlain(control), claim };
+}
+
+function encodeRelayInvite(claim) {
+  const verification = verifyRelayClaim(claim);
+  if (!verification.ok) throw new Error(verification.message);
+  return `${RELAY_INVITE_PREFIX}${Buffer.from(JSON.stringify(claim), "utf8").toString("base64url")}`;
+}
+
+function decodeRelayInvite(value) {
+  const text = String(value || "").trim();
+  if (!text.startsWith(RELAY_INVITE_PREFIX)) return { ok: false, code: "not-invite", message: "Relay reference is not an invite." };
+  try {
+    const claim = JSON.parse(Buffer.from(text.slice(RELAY_INVITE_PREFIX.length), "base64url").toString("utf8"));
+    return verifyRelayClaim(claim);
+  } catch {
+    return { ok: false, code: "invalid-invite", message: "Relay invite token is invalid." };
+  }
+}
+
+function relayTrustFile(dataDir = userDataDir()) {
+  return path.join(dataDir, "relay-trust.json");
+}
+
+function readRelayTrust(file = relayTrustFile()) {
+  if (!fs.existsSync(file)) return { relays: {} };
+  try {
+    const trust = JSON.parse(fs.readFileSync(file, "utf8"));
+    return isObject(trust) && isObject(trust.relays) ? trust : { relays: {} };
+  } catch {
+    return { relays: {} };
+  }
+}
+
+function writeRelayTrust(trust, file = relayTrustFile()) {
+  atomicWritePrivateJson(file, { relays: isObject(trust?.relays) ? trust.relays : {} });
+}
+
+function createTrustEntry(claim, pinnedAt = Date.now()) {
+  return {
+    logicalName: claim.logicalName,
+    alias: claim.alias,
+    discriminator: claim.discriminator,
+    publicKeyPem: claim.publicKeyPem,
+    publicKeyFingerprint: claim.publicKeyFingerprint,
+    relayAddress: claim.relayAddress,
+    roomPeerId: claim.roomPeerId,
+    relayMeshPeerId: claim.relayMeshPeerId,
+    sequence: claim.sequence,
+    claim: clonePlain(claim),
+    pinnedAt,
+    updatedAt: pinnedAt
+  };
+}
+
+function createRelayTrustStore(options = {}) {
+  const file = options.file || relayTrustFile(options.dataDir);
+  const defaultSignaling = options.defaultSignaling;
+
+  function read() {
+    return readRelayTrust(file);
+  }
+
+  function write(trust) {
+    writeRelayTrust(trust, file);
+  }
+
+  function rememberClaim(claim, rememberOptions = {}) {
+    if (!claim) return { ok: false, code: "missing-claim", message: "Relay claim is required." };
+    const verification = verifyRelayClaim(claim);
+    if (!verification.ok) return verification;
+    const verified = verification.claim;
+    const expectedName = normalizeRelayName(rememberOptions.expectedLogicalName);
+    if (expectedName && verified.logicalName !== expectedName) {
+      return { ok: false, code: "name-mismatch", message: `Relay claim is for ${verified.logicalName}, not ${expectedName}.` };
+    }
+    if (rememberOptions.expectedRelayAddress) {
+      const expectedAddress = relayMeshAddressFromAddress(rememberOptions.expectedRelayAddress, defaultSignaling);
+      const claimAddress = relayMeshAddressFromAddress(verified.relayAddress, defaultSignaling);
+      if (expectedAddress && claimAddress && expectedAddress !== claimAddress) {
+        return { ok: false, code: "address-mismatch", message: "Relay claim address does not match the connected relay." };
+      }
+    }
+    const trust = read();
+    const existing = trust.relays[verified.logicalName];
+    if (existing && existing.publicKeyFingerprint !== verified.publicKeyFingerprint) {
+      return { ok: false, code: "key-mismatch", message: `Relay ${verified.logicalName} is pinned to a different signing key.` };
+    }
+    if (existing && Number(existing.sequence || 0) >= verified.sequence) {
+      return { ok: true, stale: true, entry: existing, claim: verified };
+    }
+    trust.relays[verified.logicalName] = {
+      ...(existing || {}),
+      ...createTrustEntry(verified, existing?.pinnedAt || Date.now()),
+      updatedAt: Date.now()
+    };
+    write(trust);
+    return { ok: true, entry: trust.relays[verified.logicalName], claim: verified };
+  }
+
+  function claimForName(name) {
+    const logicalName = normalizeRelayName(name);
+    if (!logicalName) return undefined;
+    return read().relays[logicalName]?.claim;
+  }
+
+  function pinForAddress(address) {
+    const normalized = relayMeshAddressFromAddress(address, defaultSignaling);
+    if (!normalized) return undefined;
+    return Object.values(read().relays).find((entry) => {
+      return relayMeshAddressFromAddress(entry?.relayAddress, defaultSignaling) === normalized;
+    });
+  }
+
+  function claims() {
+    return Object.values(read().relays).map((entry) => entry?.claim).filter(Boolean);
+  }
+
+  function remove(name) {
+    const logicalName = normalizeRelayName(name);
+    if (!logicalName) return false;
+    const trust = read();
+    const existed = Boolean(trust.relays[logicalName]);
+    delete trust.relays[logicalName];
+    write(trust);
+    return existed;
+  }
+
+  function resolveReference(reference) {
+    const value = String(reference || "").trim();
+    if (!value) return { ok: false, code: "missing-reference", message: "Relay reference is required." };
+    if (value.startsWith(RELAY_INVITE_PREFIX)) {
+      const decoded = decodeRelayInvite(value);
+      if (!decoded.ok) return decoded;
+      const remembered = rememberClaim(decoded.claim);
+      if (!remembered.ok) return remembered;
+      return { ok: true, relayAddress: decoded.claim.relayAddress, relayClaim: decoded.claim, pinned: true };
+    }
+    if (value.startsWith("peerjs:")) {
+      const relayAddress = relayMeshAddressFromAddress(value, defaultSignaling);
+      if (!relayAddress) return { ok: false, code: "invalid-address", message: `Relay address is invalid: ${value}` };
+      return { ok: true, relayAddress };
+    }
+    const logicalName = normalizeRelayName(value);
+    if (!logicalName) return { ok: false, code: "invalid-alias", message: `Relay alias is invalid: ${value}` };
+    const claim = claimForName(logicalName);
+    if (!claim) {
+      return {
+        ok: false,
+        code: "alias-unpinned",
+        message: `Relay alias "${logicalName}" is not pinned yet. Run "matterhorn-sdk relay invite" on that relay and pass the matterhorn-relay: token, or use an explicit signed relay address first.`
+      };
+    }
+    return { ok: true, relayAddress: claim.relayAddress, relayClaim: claim, alias: logicalName };
+  }
+
+  return {
+    claimForName,
+    claims,
+    file,
+    pinForAddress,
+    read,
+    rememberClaim,
+    remove,
+    resolveReference
+  };
+}
+
+module.exports = {
+  DEFAULT_RELAY_ALIAS_DISCRIMINATOR,
+  RELAY_CLAIM_KIND,
+  RELAY_CONTROL_KIND,
+  RELAY_IDENTITY_KIND,
+  RELAY_INVITE_PREFIX,
+  RELAY_PUBLIC_KEY_FINGERPRINT_PREFIX,
+  createRelayTrustStore,
+  decodeRelayInvite,
+  encodeRelayInvite,
+  ensureRelayIdentity,
+  generateRelayIdentity,
+  normalizeRelayAlias,
+  normalizeRelayDiscriminator,
+  normalizeRelayName,
+  publicKeyFingerprint,
+  readRelayTrust,
+  relayTrustFile,
+  signRelayClaim,
+  signRelayControl,
+  verifyRelayControl,
+  verifyRelayClaim,
+  writeRelayTrust
+};

package/runtime/host/relayIncomingGate.cjs

@@ -0,0 +1,153 @@
+const { PROTOCOL } = require("@mh-gg/host-config");
+const {
+  isNostrMessage,
+  messageJsonByteLength,
+  sendMessage
+} = require("@mh-gg/relay-core");
+
+function isHostMessage(message) {
+  return typeof message?.type === "string" && message.type.startsWith("host.");
+}
+
+function isCallSignalMessage(message) {
+  return message?.type === "client/peer-signal";
+}
+
+function isFrontendDownloadRequest(message) {
+  return message?.type === "client/frontend-chunk";
+}
+
+function isPresenceMessage(message) {
+  return message?.type === "client/presence";
+}
+
+function isRuntimeRoomRequest(message) {
+  return message?.type === "client/operation"
+    || message?.type === "client/matterhorn-state"
+    || message?.type === "client/snapshot-request";
+}
+
+function isRelayEnvelopeMessage(message) {
+  return message?.type === "relay.client"
+    || message?.type === "relay.host"
+    || message?.type === "relay.peer-signal"
+    || message?.type === "relay.broadcast"
+    || message?.type === "relay.client.close"
+    || message?.type === "relay.ping"
+    || message?.type === "relay.pong"
+    || message?.type === "relay.matterhorn-operation"
+    || message?.type === "relay.push"
+    || message?.type === "relay.push.ack";
+}
+
+function incomingMessageClass(message) {
+  if (isNostrMessage(message)) return "nostr";
+  if (isHostMessage(message)) return "host";
+  if (isRelayEnvelopeMessage(message) || (typeof message?.type === "string" && message.type.startsWith("relay."))) return "mesh";
+  if (isCallSignalMessage(message)) return "call";
+  return "room";
+}
+
+function incomingMessageLimit(config, messageClass) {
+  switch (messageClass) {
+    case "host": return config.maxHostIpcMessageBytes;
+    case "mesh": return config.maxMeshMessageBytes;
+    case "nostr": return config.maxNostrMessageBytes;
+    case "call": return config.maxCallSignalBytes;
+    default: return config.maxRoomMessageBytes;
+  }
+}
+
+function rateLimitForMessage(config, conn, messageClass) {
+  if (messageClass === "host") return { key: "host", limit: config.maxHostIpcMessagesPerWindow };
+  if (messageClass === "mesh" || messageClass === "nostr") return { key: messageClass, limit: config.maxMeshMessagesPerWindow };
+  if (isFrontendDownloadRequest(conn.MatterhornIncomingMessage)) {
+    return { key: "frontend", limit: Math.max(config.maxRoomMessagesPerWindow * 4, 512) };
+  }
+  if (isPresenceMessage(conn.MatterhornIncomingMessage)) {
+    return { key: "presence", limit: Math.max(config.maxRoomMessagesPerWindow * 4, 128) };
+  }
+  if (isRuntimeRoomRequest(conn.MatterhornIncomingMessage)) return { key: "room", limit: config.maxRoomMessagesPerWindow };
+  if (conn.MatterhornAuthenticated) return { key: "room", limit: config.maxRoomMessagesPerWindow };
+  return { key: "unauthenticated", limit: config.maxUnauthenticatedMessagesPerWindow };
+}
+
+function sendIncomingRejection(conn, messageClass, code, message) {
+  if (messageClass === "nostr") {
+    sendMessage(conn, ["NOTICE", message]);
+    return;
+  }
+  if (messageClass === "host") {
+    sendMessage(conn, { type: "host.message.error", code, message });
+    return;
+  }
+  if (messageClass === "mesh") {
+    sendMessage(conn, { type: "relay.error", code, message });
+    return;
+  }
+  if (messageClass === "room" || messageClass === "call") {
+    sendMessage(conn, {
+      type: "host/error",
+      protocol: PROTOCOL,
+      code,
+      message
+    });
+  }
+}
+
+function createRelayIncomingGate(config) {
+  const connectionRates = new WeakMap();
+
+  function rateStateFor(conn, now) {
+    let state = connectionRates.get(conn);
+    if (!state || now - state.startedAt >= config.rateWindowMs) {
+      state = { startedAt: now, counts: Object.create(null) };
+      connectionRates.set(conn, state);
+    }
+    return state;
+  }
+
+  function acceptsMessageRate(conn, messageClass) {
+    const { key, limit } = rateLimitForMessage(config, conn, messageClass);
+    if (!Number.isFinite(limit) || limit <= 0) return true;
+    const state = rateStateFor(conn, Date.now());
+    state.counts[key] = (state.counts[key] || 0) + 1;
+    return state.counts[key] <= limit;
+  }
+
+  function accept(conn, message) {
+    conn.MatterhornIncomingMessage = message;
+    const messageClass = incomingMessageClass(message);
+    const messageBytes = messageJsonByteLength(message);
+    const maxBytes = incomingMessageLimit(config, messageClass);
+    if (messageBytes === undefined || messageBytes > maxBytes) {
+      const label = messageClass === "host"
+        ? "Host IPC message is too large"
+        : messageClass === "nostr"
+          ? "Nostr message is too large"
+          : "Room message is too large.";
+      sendIncomingRejection(conn, messageClass, "message-too-large", label);
+      return false;
+    }
+    if (!acceptsMessageRate(conn, messageClass)) {
+      sendIncomingRejection(conn, messageClass, "rate-limited", "Too many messages; slow down.");
+      return false;
+    }
+    return true;
+  }
+
+  function cleanup(conn) {
+    connectionRates.delete(conn);
+  }
+
+  return {
+    accept,
+    cleanup
+  };
+}
+
+module.exports = {
+  createRelayIncomingGate,
+  incomingMessageClass,
+  isRelayEnvelopeMessage
+};