@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/host/sqliteRelayStorage.cjs

@@ -0,0 +1,352 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { DatabaseSync } = require("node:sqlite");
+const { matchFilters } = require("nostr-tools/filter");
+
+function tagValue(tags, name) {
+  const tag = Array.isArray(tags) ? tags.find((item) => Array.isArray(item) && item[0] === name) : undefined;
+  return tag ? tag[1] : undefined;
+}
+
+function expirationTime(event) {
+  const raw = Number(tagValue(event.tags, "expiration"));
+  return Number.isFinite(raw) && raw > 0 ? Math.trunc(raw) : undefined;
+}
+
+function isModerationEvent(event) {
+  return event.kind === 5;
+}
+
+function eventBytes(event) {
+  return Buffer.byteLength(JSON.stringify(event), "utf8");
+}
+
+function sqliteFile(storagePath) {
+  return path.join(storagePath, "events.sqlite");
+}
+
+function placeholders(values) {
+  return values.map(() => "?").join(", ");
+}
+
+function escapeLike(value) {
+  return String(value).replace(/[\\%_]/g, (match) => `\\${match}`);
+}
+
+function stringValues(value) {
+  return Array.isArray(value) ? value.filter((item) => typeof item === "string") : undefined;
+}
+
+function integerValues(value) {
+  return Array.isArray(value) ? value.filter((item) => Number.isInteger(item)) : undefined;
+}
+
+function parseEvent(row) {
+  if (!row) return undefined;
+  try {
+    return JSON.parse(row.event_json);
+  } catch {
+    return undefined;
+  }
+}
+
+class SqliteRelayStorage {
+  constructor(storagePath) {
+    this.storagePath = storagePath;
+    fs.mkdirSync(storagePath, { recursive: true });
+    this.db = new DatabaseSync(sqliteFile(storagePath));
+    this.db.exec(`
+      PRAGMA journal_mode = WAL;
+      PRAGMA synchronous = NORMAL;
+
+      CREATE TABLE IF NOT EXISTS party_events (
+        id TEXT PRIMARY KEY,
+        party_id TEXT NOT NULL,
+        kind INTEGER NOT NULL,
+        pubkey TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        received_at INTEGER NOT NULL,
+        event_bytes INTEGER NOT NULL DEFAULT 0,
+        expires_at INTEGER,
+        moderation INTEGER NOT NULL DEFAULT 0,
+        event_json TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_party_created
+      ON party_events (party_id, created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_id
+      ON party_events (id);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_kind
+      ON party_events (kind);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_pubkey
+      ON party_events (pubkey);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_created
+      ON party_events (created_at);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_party
+      ON party_events (party_id);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_received
+      ON party_events (received_at);
+
+      CREATE INDEX IF NOT EXISTS idx_party_events_expires
+      ON party_events (expires_at);
+    `);
+    this.ensureColumn("event_bytes", "INTEGER NOT NULL DEFAULT 0");
+    this.ensureColumn("expires_at", "INTEGER");
+    this.ensureColumn("moderation", "INTEGER NOT NULL DEFAULT 0");
+    this.insertStatement = this.db.prepare(`
+      INSERT OR IGNORE INTO party_events
+        (id, party_id, kind, pubkey, created_at, received_at, event_bytes, expires_at, moderation, event_json)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+    this.deleteStatement = this.db.prepare("DELETE FROM party_events WHERE id = ?");
+    this.hasStatement = this.db.prepare("SELECT 1 FROM party_events WHERE id = ? LIMIT 1");
+    this.selectByIdStatement = this.db.prepare("SELECT event_json FROM party_events WHERE id = ? LIMIT 1");
+    this.selectAllStatement = this.db.prepare("SELECT event_json FROM party_events ORDER BY created_at ASC, id ASC");
+  }
+
+  ensureColumn(name, definition) {
+    const columns = this.db.prepare("PRAGMA table_info('party_events')").all().map((row) => row.name);
+    if (!columns.includes(name)) this.db.exec(`ALTER TABLE party_events ADD COLUMN ${name} ${definition}`);
+  }
+
+  loadEvents() {
+    const events = [];
+    for (const row of this.selectAllStatement.all()) {
+      try {
+        events.push(JSON.parse(row.event_json));
+      } catch {
+        // A bad row should not make the relay unbootable.
+      }
+    }
+    return events;
+  }
+
+  hasEvent(id) {
+    return Boolean(this.hasStatement.get(id));
+  }
+
+  getEvent(id) {
+    return parseEvent(this.selectByIdStatement.get(id));
+  }
+
+  queryFilterRows(filter) {
+    const clauses = [];
+    const params = [];
+    const ids = stringValues(filter.ids);
+    const kinds = integerValues(filter.kinds);
+    const authors = stringValues(filter.authors);
+    const partyIds = stringValues(filter["#d"]);
+
+    if (ids) {
+      if (ids.length === 0) return [];
+      clauses.push(`(${ids.map(() => "id LIKE ? ESCAPE '\\'").join(" OR ")})`);
+      params.push(...ids.map((id) => `${escapeLike(id)}%`));
+    }
+    if (kinds) {
+      if (kinds.length === 0) return [];
+      clauses.push(`kind IN (${placeholders(kinds)})`);
+      params.push(...kinds);
+    }
+    if (authors) {
+      if (authors.length === 0) return [];
+      clauses.push(`(${authors.map(() => "pubkey LIKE ? ESCAPE '\\'").join(" OR ")})`);
+      params.push(...authors.map((pubkey) => `${escapeLike(pubkey)}%`));
+    }
+    if (partyIds) {
+      if (partyIds.length === 0) return [];
+      clauses.push(`party_id IN (${placeholders(partyIds)})`);
+      params.push(...partyIds);
+    }
+    if (Number.isInteger(filter.since)) {
+      clauses.push("created_at >= ?");
+      params.push(filter.since);
+    }
+    if (Number.isInteger(filter.until)) {
+      clauses.push("created_at <= ?");
+      params.push(filter.until);
+    }
+
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+    return this.db.prepare(`SELECT event_json FROM party_events ${where} ORDER BY created_at ASC, id ASC`).all(...params);
+  }
+
+  queryEvents(filters) {
+    const events = new Map();
+    for (const filter of filters) {
+      for (const row of this.queryFilterRows(filter)) {
+        const event = parseEvent(row);
+        if (event && matchFilters([filter], event)) events.set(event.id, event);
+      }
+    }
+    return Array.from(events.values()).sort((left, right) => left.created_at - right.created_at || left.id.localeCompare(right.id));
+  }
+
+  insertEvent(event) {
+    const serialized = JSON.stringify(event);
+    const result = this.insertStatement.run(
+      event.id,
+      tagValue(event.tags, "d") || "",
+      event.kind,
+      event.pubkey,
+      event.created_at,
+      Date.now(),
+      Buffer.byteLength(serialized, "utf8"),
+      expirationTime(event) ?? null,
+      isModerationEvent(event) ? 1 : 0,
+      serialized
+    );
+    return result.changes > 0;
+  }
+
+  deleteEvents(ids) {
+    for (const id of ids) this.deleteStatement.run(id);
+  }
+
+  trimEvents(maxEvents) {
+    return this.pruneEvents({ maxEvents });
+  }
+
+  retentionOrder() {
+    return "moderation ASC, MIN(created_at, CAST(received_at / 1000 AS INTEGER)) ASC, id ASC";
+  }
+
+  deleteRows(rows) {
+    const ids = rows.map((row) => row.id);
+    this.deleteEvents(ids);
+    return ids;
+  }
+
+  pruneTotalEvents(maxEvents) {
+    if (!Number.isInteger(maxEvents) || maxEvents < 0) return [];
+    const rows = this.db.prepare(`
+      SELECT id FROM party_events
+      ORDER BY ${this.retentionOrder()}
+      LIMIT (
+        SELECT MAX(COUNT(*) - ?, 0) FROM party_events
+      )
+    `).all(maxEvents);
+    return this.deleteRows(rows);
+  }
+
+  pruneRoomEventCounts(maxEventsPerRoom) {
+    if (!Number.isInteger(maxEventsPerRoom) || maxEventsPerRoom < 1) return [];
+    const removed = [];
+    const rooms = this.db.prepare(`
+      SELECT party_id, COUNT(*) AS count
+      FROM party_events
+      WHERE party_id != ''
+      GROUP BY party_id
+      HAVING count > ?
+      ORDER BY party_id ASC
+    `).all(maxEventsPerRoom);
+    for (const room of rooms) {
+      const rows = this.db.prepare(`
+        SELECT id FROM party_events
+        WHERE party_id = ?
+        ORDER BY ${this.retentionOrder()}
+        LIMIT ?
+      `).all(room.party_id, room.count - maxEventsPerRoom);
+      removed.push(...this.deleteRows(rows));
+    }
+    return removed;
+  }
+
+  pruneRoomBytes(maxBytesPerRoom) {
+    if (!Number.isInteger(maxBytesPerRoom) || maxBytesPerRoom < 1) return [];
+    const removed = [];
+    const rooms = this.db.prepare(`
+      SELECT party_id, SUM(event_bytes) AS bytes
+      FROM party_events
+      WHERE party_id != ''
+      GROUP BY party_id
+      HAVING bytes > ?
+      ORDER BY party_id ASC
+    `).all(maxBytesPerRoom);
+    for (const room of rooms) {
+      let remainingBytes = room.bytes;
+      const rows = this.db.prepare(`
+        SELECT id, event_bytes FROM party_events
+        WHERE party_id = ?
+        ORDER BY ${this.retentionOrder()}
+      `).all(room.party_id);
+      const deleteRows = [];
+      for (const row of rows) {
+        if (remainingBytes <= maxBytesPerRoom) break;
+        deleteRows.push(row);
+        remainingBytes -= row.event_bytes;
+      }
+      removed.push(...this.deleteRows(deleteRows));
+    }
+    return removed;
+  }
+
+  pruneExpiredEvents(nowSeconds) {
+    if (!Number.isInteger(nowSeconds)) return [];
+    const rows = this.db.prepare(`
+      SELECT id FROM party_events
+      WHERE expires_at IS NOT NULL
+        AND expires_at <= ?
+        AND moderation = 0
+      ORDER BY ${this.retentionOrder()}
+    `).all(nowSeconds);
+    return this.deleteRows(rows);
+  }
+
+  pruneEvents(policy = {}) {
+    const nowSeconds = Number.isInteger(policy.nowSeconds) ? policy.nowSeconds : Math.floor(Date.now() / 1000);
+    return [
+      ...this.pruneExpiredEvents(nowSeconds),
+      ...this.pruneTotalEvents(policy.maxEvents),
+      ...this.pruneRoomEventCounts(policy.maxEventsPerRoom),
+      ...this.pruneRoomBytes(policy.maxBytesPerRoom)
+    ];
+  }
+
+  countRecentEventsByPubkey(pubkey, sinceSeconds, nowSeconds) {
+    const row = this.db.prepare(`
+      SELECT COUNT(*) AS count
+      FROM party_events
+      WHERE pubkey = ?
+        AND MIN(created_at, CAST(received_at / 1000 AS INTEGER)) >= ?
+        AND MIN(created_at, CAST(received_at / 1000 AS INTEGER)) <= ?
+    `).get(pubkey, sinceSeconds, nowSeconds);
+    return row.count;
+  }
+
+  stats() {
+    const eventRow = this.db.prepare("SELECT COUNT(*) AS count FROM party_events").get();
+    const authorRow = this.db.prepare("SELECT COUNT(DISTINCT pubkey) AS count FROM party_events").get();
+    const partyRow = this.db.prepare("SELECT COUNT(DISTINCT party_id) AS count FROM party_events WHERE party_id != ''").get();
+    const kinds = {};
+    for (const row of this.db.prepare("SELECT kind, COUNT(*) AS count FROM party_events GROUP BY kind").all()) {
+      kinds[row.kind] = row.count;
+    }
+    return {
+      addressableEvents: partyRow.count,
+      authors: authorRow.count,
+      events: eventRow.count,
+      kinds,
+      parties: partyRow.count
+    };
+  }
+
+  close() {
+    this.db.close();
+  }
+}
+
+function createSqliteRelayStorage(storagePath) {
+  return new SqliteRelayStorage(storagePath);
+}
+
+module.exports = {
+  SqliteRelayStorage,
+  createSqliteRelayStorage,
+  sqliteFile
+};

package/runtime/host/wireValidation/client.cjs

@@ -0,0 +1,213 @@
+const { safeValidate, validateClientHello, validateRoomOperation } = require("@mh-gg/protocol");
+const { hasText, invalid, isObject, ok, protocolOne, protocolResult } = require("./shared.cjs");
+const { validatePresenceEvent } = require("./presenceEvent.cjs");
+const { validateClientPeerSignal, validatePeerSignalFields } = require("./peerSignal.cjs");
+const { validateClientPushRegisterMessage, validateClientPushGrantMessage, validateClientPushSendMessage } = require("./push.cjs");
+
+function checkBase(message, type, requireClientId = true) {
+  if (!isObject(message)) return invalid(type, "message must be an object");
+  if (message.type !== type) return invalid(type, "type is invalid");
+  if (!protocolOne(message)) return invalid(type, "protocol is invalid");
+  if (!hasText(message.roomName)) return invalid(type, "roomName is required");
+  if (requireClientId && !hasText(message.clientId)) return invalid(type, "clientId is required");
+  return ok();
+}
+
+function validateClientHelloMessage(message) {
+  const result = safeValidate(validateClientHello, message);
+  if (!result.ok) return protocolResult("client/hello", result);
+  if (!protocolOne(message)) return invalid("client/hello", "protocol is invalid");
+  return ok();
+}
+
+function validateClientOperationMessage(message) {
+  const baseResult = checkBase(message, "client/operation");
+  if (!baseResult.ok) return baseResult;
+  const result = safeValidate(validateRoomOperation, message.operation);
+  if (!result.ok) return protocolResult("client/operation", result);
+  if (message.operation.roomId !== message.roomName) return invalid("client/operation", "operation room does not match roomName");
+  return ok();
+}
+
+function validateSnapshotRequest(message) {
+  const baseResult = checkBase(message, "client/snapshot-request");
+  if (!baseResult.ok) return baseResult;
+  if (message.reason !== undefined && !hasText(message.reason)) return invalid("client/snapshot-request", "reason is invalid");
+  return ok();
+}
+
+function validateMatterhornStateRequest(message) {
+  return checkBase(message, "client/matterhorn-state");
+}
+
+const ROOM_INDEX_NGRAM_SUITE = "matterhorn.ngram.hmac-sha256.v1";
+const ROOM_INDEX_TOKEN_RE = /^[A-Za-z0-9_-]{22,96}$/;
+
+function validateRoomIndexSearchMessage(message) {
+  const baseResult = checkBase(message, "client/room-index-search");
+  if (!baseResult.ok) return baseResult;
+  if (message.suite !== ROOM_INDEX_NGRAM_SUITE) return invalid("client/room-index-search", "suite is invalid");
+  if (!hasText(message.keyId) || message.keyId.length > 80 || !/^[A-Za-z0-9_-]+$/.test(message.keyId)) {
+    return invalid("client/room-index-search", "keyId is invalid");
+  }
+  if (!Array.isArray(message.tokens) || message.tokens.length === 0 || message.tokens.length > 512) {
+    return invalid("client/room-index-search", "tokens are invalid");
+  }
+  const seen = new Set();
+  for (const token of message.tokens) {
+    if (typeof token !== "string" || !ROOM_INDEX_TOKEN_RE.test(token) || seen.has(token)) {
+      return invalid("client/room-index-search", "tokens are invalid");
+    }
+    seen.add(token);
+  }
+  if (message.stream !== undefined && !hasText(message.stream)) return invalid("client/room-index-search", "stream is invalid");
+  if (message.mode !== undefined && !["all", "any", "threshold"].includes(message.mode)) return invalid("client/room-index-search", "mode is invalid");
+  if (message.order !== undefined && !["newest", "score"].includes(message.order)) return invalid("client/room-index-search", "order is invalid");
+  if (message.minScore !== undefined) {
+    const minScore = Number(message.minScore);
+    if (!Number.isFinite(minScore) || minScore < 0 || minScore > 1) return invalid("client/room-index-search", "minScore is invalid");
+  }
+  if (message.limit !== undefined && (!Number.isInteger(message.limit) || message.limit <= 0 || message.limit > 1000)) {
+    return invalid("client/room-index-search", "limit is invalid");
+  }
+  if (message.offset !== undefined && (!Number.isInteger(message.offset) || message.offset < 0)) {
+    return invalid("client/room-index-search", "offset is invalid");
+  }
+  if (message.requestId !== undefined && !hasText(message.requestId)) return invalid("client/room-index-search", "requestId is invalid");
+  return ok();
+}
+
+function validatePersonalStateMessage(message) {
+  const baseResult = checkBase(message, "client/personal-state");
+  if (!baseResult.ok) return baseResult;
+  if (message.action !== "subscribe" && message.action !== "publish") return invalid("client/personal-state", "action is invalid");
+  if (message.action === "publish") {
+    if (!hasText(message.stateId)) return invalid("client/personal-state", "stateId is required");
+    if (!Number.isFinite(Number(message.updatedAt))) return invalid("client/personal-state", "updatedAt is invalid");
+    if (!isObject(message.payload)) return invalid("client/personal-state", "payload is required");
+  }
+  return ok();
+}
+
+function validatePresenceMessage(message) {
+  const baseResult = checkBase(message, "client/presence");
+  if (!baseResult.ok) return baseResult;
+  if (message.status !== undefined && !["online", "away", "busy", "invisible", "offline"].includes(message.status)) {
+    return invalid("client/presence", "status is invalid");
+  }
+  if (message.activity !== undefined && typeof message.activity !== "string") return invalid("client/presence", "activity is invalid");
+  if (message.actor !== undefined && !isObject(message.actor)) return invalid("client/presence", "actor is invalid");
+  return validatePresenceEvent(message);
+}
+
+function validateEphemeralTokenPayload(payload) {
+  if (payload === undefined) return true;
+  if (!isObject(payload)) return false;
+  return Object.keys(payload).length <= 32;
+}
+
+function validateEphemeralTokenMessage(message) {
+  const baseResult = checkBase(message, "client/ephemeral-token");
+  if (!baseResult.ok) return baseResult;
+  if (message.action !== "upsert" && message.action !== "release") return invalid("client/ephemeral-token", "action is invalid");
+  if (message.action === "release") {
+    if (!hasText(message.tokenId)) return invalid("client/ephemeral-token", "tokenId is required");
+    return ok();
+  }
+  if (!isObject(message.token)) return invalid("client/ephemeral-token", "token is required");
+  if (!hasText(message.token.id)) return invalid("client/ephemeral-token", "token.id is required");
+  if (!hasText(message.token.kind)) return invalid("client/ephemeral-token", "token.kind is required");
+  if (!hasText(message.token.scope)) return invalid("client/ephemeral-token", "token.scope is required");
+  if (!hasText(message.token.ownerId)) return invalid("client/ephemeral-token", "token.ownerId is required");
+  if (!hasText(message.token.ownerName)) return invalid("client/ephemeral-token", "token.ownerName is required");
+  if (!hasText(message.token.clientId)) return invalid("client/ephemeral-token", "token.clientId is required");
+  if (!Number.isFinite(Number(message.token.updatedAt))) return invalid("client/ephemeral-token", "token.updatedAt is invalid");
+  if (!Number.isFinite(Number(message.token.expiresAt))) return invalid("client/ephemeral-token", "token.expiresAt is invalid");
+  if (!validateEphemeralTokenPayload(message.token.payload)) return invalid("client/ephemeral-token", "token.payload is invalid");
+  return ok();
+}
+
+function validateClientMemberKeyMessage(message) {
+  const baseResult = checkBase(message, "client/member-key");
+  if (!baseResult.ok) return baseResult;
+  if (!isObject(message.claim)) return invalid("client/member-key", "claim is required");
+  if (message.claim.kind !== "matterhorn.member-key-claim" && message.claim.type !== "matterhorn/member-key/v1") return invalid("client/member-key", "claim kind is invalid");
+  if (message.claim.scheme !== "matterhorn.device-signing.v1") return invalid("client/member-key", "claim scheme is invalid");
+  if (message.claim.alg !== "nostr-secp256k1") return invalid("client/member-key", "claim alg is invalid");
+  const claimRoom = message.claim.roomName || message.claim.roomId;
+  if (claimRoom !== message.roomName) return invalid("client/member-key", "claim room mismatch");
+  for (const field of ["memberId", "deviceId", "keyId", "rootPublicKey", "publicKey", "publicKeyFingerprint", "encryptionKeyId", "encryptionPublicKey"]) {
+    if (!hasText(message.claim[field])) return invalid("client/member-key", `claim ${field} is required`);
+  }
+  if (message.claim.encryptionAlg !== "x25519") return invalid("client/member-key", "claim encryptionAlg is invalid");
+  if (!Number.isFinite(Number(message.claim.createdAt))) return invalid("client/member-key", "claim createdAt is invalid");
+  if (!isObject(message.claim.rootProof) || !hasText(message.claim.rootProof.eventId) || !hasText(message.claim.rootProof.sig)) return invalid("client/member-key", "claim root proof is required");
+  if (!isObject(message.claim.proof) || !hasText(message.claim.proof.eventId) || !hasText(message.claim.proof.sig)) return invalid("client/member-key", "claim device proof is required");
+  return ok();
+}
+
+function validateRoomInfoRequest(message) {
+  const baseResult = checkBase(message, "client/room-info", false);
+  if (!baseResult.ok) return baseResult;
+  if (message.clientId !== undefined && !hasText(message.clientId)) return invalid("client/room-info", "clientId is invalid");
+  if (message.cachedFrontend !== undefined) {
+    if (!isObject(message.cachedFrontend)) return invalid("client/room-info", "cachedFrontend is invalid");
+    if (!hasText(message.cachedFrontend.id)) return invalid("client/room-info", "cachedFrontend.id is invalid");
+    if (!hasText(message.cachedFrontend.integrity)) return invalid("client/room-info", "cachedFrontend.integrity is invalid");
+    if (message.cachedFrontend.byteLength !== undefined && (!Number.isInteger(message.cachedFrontend.byteLength) || message.cachedFrontend.byteLength < 0)) {
+      return invalid("client/room-info", "cachedFrontend.byteLength is invalid");
+    }
+  }
+  return ok();
+}
+
+function validateFrontendManifestRequest(message) {
+  const baseResult = checkBase(message, "client/frontend-manifest", false);
+  if (!baseResult.ok) return baseResult;
+  if (message.clientId !== undefined && !hasText(message.clientId)) return invalid("client/frontend-manifest", "clientId is invalid");
+  if (message.frontendId !== undefined && !hasText(message.frontendId)) return invalid("client/frontend-manifest", "frontendId is invalid");
+  if (message.integrity !== undefined && !hasText(message.integrity)) return invalid("client/frontend-manifest", "integrity is invalid");
+  return ok();
+}
+
+function validateFrontendChunkRequest(message) {
+  const baseResult = checkBase(message, "client/frontend-chunk", false);
+  if (!baseResult.ok) return baseResult;
+  if (message.clientId !== undefined && !hasText(message.clientId)) return invalid("client/frontend-chunk", "clientId is invalid");
+  if (message.frontendId !== undefined && !hasText(message.frontendId)) return invalid("client/frontend-chunk", "frontendId is invalid");
+  if (message.integrity !== undefined && !hasText(message.integrity)) return invalid("client/frontend-chunk", "integrity is invalid");
+  if (!Number.isInteger(message.offset) || message.offset < 0) return invalid("client/frontend-chunk", "offset is invalid");
+  if (message.length !== undefined && (!Number.isInteger(message.length) || message.length <= 0)) return invalid("client/frontend-chunk", "length is invalid");
+  return ok();
+}
+
+function validateClientMessage(message) {
+  if (!isObject(message)) return invalid("client", "message must be an object");
+  switch (message.type) {
+    case "client/hello": return validateClientHelloMessage(message);
+    case "client/room-info": return validateRoomInfoRequest(message);
+    case "client/member-key": return validateClientMemberKeyMessage(message);
+    case "client/frontend-manifest": return validateFrontendManifestRequest(message);
+    case "client/frontend-chunk": return validateFrontendChunkRequest(message);
+    case "client/operation": return validateClientOperationMessage(message);
+    case "client/snapshot-request": return validateSnapshotRequest(message);
+    case "client/matterhorn-state": return validateMatterhornStateRequest(message);
+    case "client/room-index-search": return validateRoomIndexSearchMessage(message);
+    case "client/personal-state": return validatePersonalStateMessage(message);
+    case "client/presence": return validatePresenceMessage(message);
+    case "client/ephemeral-token": return validateEphemeralTokenMessage(message);
+    case "client/peer-signal": return validateClientPeerSignal(message);
+    case "client/push-register": return validateClientPushRegisterMessage(message);
+    case "client/push-grant": return validateClientPushGrantMessage(message);
+    case "client/push-send": return validateClientPushSendMessage(message);
+    default: return invalid("client", `unknown client message type ${JSON.stringify(message.type)} with keys ${Object.keys(message).sort().join(",") || "none"}`);
+  }
+}
+
+module.exports = {
+  validateClientMessage,
+  validateClientMemberKeyMessage,
+  validateClientOperationMessage,
+  validateEphemeralTokenMessage,
+  validatePeerSignalFields
+};

package/runtime/host/wireValidation/host.cjs

@@ -0,0 +1,33 @@
+const { safeValidate, validateHostOperations, validateRelayAddresses } = require("@mh-gg/protocol");
+const { hasText, invalid, isObject, ok, protocolResult } = require("./shared.cjs");
+
+function validateHostMessage(message, scope = "host") {
+  if (!isObject(message)) return invalid(scope, "message must be an object");
+  if (!hasText(message.type)) return invalid(scope, "type is required");
+  if (message.protocol !== undefined && message.protocol !== require("@mh-gg/host-config").PROTOCOL) return invalid(scope, "protocol is invalid");
+  if (message.type === "host/operations") {
+    const result = safeValidate(validateHostOperations, message);
+    if (!result.ok) return protocolResult(scope, result);
+  }
+  return ok();
+}
+
+function validateRelayHints(message) {
+  if (!isObject(message)) return invalid("relay.hints", "message must be an object");
+  if (message.type !== "relay.hints") return invalid("relay.hints", "type is invalid");
+  if (!hasText(message.roomName)) return invalid("relay.hints", "roomName is required");
+  const result = safeValidate(validateRelayAddresses, message.relayHints || [], "relay.hints.relayHints");
+  if (!result.ok) return invalid("relay.hints", "relayHints is invalid");
+  return ok();
+}
+
+function validateOperationBatch(message) {
+  const result = safeValidate(validateHostOperations, message);
+  return result.ok ? ok() : protocolResult("host/operations", result);
+}
+
+module.exports = {
+  validateHostMessage,
+  validateOperationBatch,
+  validateRelayHints
+};

package/runtime/host/wireValidation/index.cjs

@@ -0,0 +1,13 @@
+const { validateClientMessage } = require("./client.cjs");
+const { validateHostMessage, validateOperationBatch, validateRelayHints } = require("./host.cjs");
+const { validateRelayEnvelope } = require("./relay.cjs");
+const { INVALID_MESSAGE_CODE } = require("./shared.cjs");
+
+module.exports = {
+  INVALID_MESSAGE_CODE,
+  validateClientMessage,
+  validateHostMessage,
+  validateOperationBatch,
+  validateRelayEnvelope,
+  validateRelayHints
+};

package/runtime/host/wireValidation/peerSignal.cjs

@@ -0,0 +1,35 @@
+const { hasText, invalid, isObject, ok, protocolOne } = require("./shared.cjs");
+
+function validatePeerSignalFields(message, scope, { relay = false } = {}) {
+  if (!isObject(message)) return invalid(scope, "message must be an object");
+  if (!hasText(message.roomName)) return invalid(scope, "roomName is required");
+  const sourceField = relay ? "sourceClientId" : "clientId";
+  if (!hasText(message[sourceField])) return invalid(scope, `${sourceField} is required`);
+  if (!hasText(message.targetClientId)) return invalid(scope, "target is required");
+  if (relay && message.sourcePeerId !== undefined && !hasText(message.sourcePeerId)) return invalid(scope, "sourcePeerId is invalid");
+  if (message.targetPeerId !== undefined && !hasText(message.targetPeerId)) return invalid(scope, "targetPeerId is invalid");
+  if (!isObject(message.signal)) return invalid(scope, "signal is required");
+  if (!hasText(message.signal.type)) return invalid(scope, "signal.type is required");
+  if (!hasText(message.signal.sessionId)) return invalid(scope, "signal.sessionId is required");
+  if (message.encryptedSignal !== undefined) {
+    if (!isObject(message.encryptedSignal)) return invalid(scope, "encryptedSignal is invalid");
+    if (message.encryptedSignal.encrypted !== true) return invalid(scope, "encryptedSignal.encrypted is invalid");
+    if (message.encryptedSignal.alg !== "A256GCM") return invalid(scope, "encryptedSignal.alg is invalid");
+    if (message.encryptedSignal.kind !== "call.signal") return invalid(scope, "encryptedSignal.kind is invalid");
+    if (!hasText(message.encryptedSignal.iv)) return invalid(scope, "encryptedSignal.iv is invalid");
+    if (!hasText(message.encryptedSignal.data)) return invalid(scope, "encryptedSignal.data is invalid");
+    if (message.auth !== undefined) return invalid(scope, "auth must be encrypted");
+  }
+  return ok();
+}
+
+function validateClientPeerSignal(message) {
+  if (message.type !== "client/peer-signal") return invalid("client/peer-signal", "type is invalid");
+  if (!protocolOne(message)) return invalid("client/peer-signal", "protocol is invalid");
+  return validatePeerSignalFields(message, "client/peer-signal");
+}
+
+module.exports = {
+  validateClientPeerSignal,
+  validatePeerSignalFields
+};