@mh-gg/protocol 0.1.1-alpha.20260613T085325975Z

package/src/validators/relay.cjs

@@ -0,0 +1,86 @@
+const { assertArray, assertNumber, assertOptionalString, assertRecord, assertString } = require("../assertions.cjs");
+const { MAX_PUSH_PAYLOAD_BYTES, RELAY_PUSH } = require("../constants.cjs");
+const { invalid } = require("../errors.cjs");
+const { assertJsonByteLength } = require("./bounds.cjs");
+const { validateCallSignal, validateClientMessage } = require("./client.cjs");
+const { validateHostMessage } = require("./host.cjs");
+const { validateRoomOperation } = require("./operations.cjs");
+
+function validateRelayEnvelope(message) {
+  const value = assertRecord(message, "relay");
+  const type = assertString(value.type, "relay.type");
+  if (type === "relay.client") {
+    assertString(value.id, "relay.id");
+    assertString(value.roomName, "relay.roomName");
+    assertString(value.peerId, "relay.peerId");
+    const nested = validateClientMessage(value.message);
+    if (nested.roomName !== value.roomName) throw invalid("relay.message.roomName", "does not match relay roomName");
+    return value;
+  }
+  if (type === "relay.host") {
+    assertString(value.id, "relay.id");
+    assertString(value.peerId, "relay.peerId");
+    assertOptionalString(value.roomName, "relay.roomName");
+    validateHostMessage(value.message, "relay.message");
+    return value;
+  }
+  if (type === "relay.broadcast") {
+    assertString(value.id, "relay.id");
+    assertString(value.roomName, "relay.roomName");
+    validateHostMessage(value.message, "relay.message");
+    return value;
+  }
+  if (type === "relay.client.close") {
+    assertOptionalString(value.id, "relay.id");
+    assertOptionalString(value.roomName, "relay.roomName");
+    assertString(value.peerId, "relay.peerId");
+    return value;
+  }
+
+  if (type === "relay.ping" || type === "relay.pong") {
+    assertString(value.id, "relay.id");
+    assertOptionalString(value.requestId, "relay.requestId");
+    assertOptionalString(value.relayAddress, "relay.relayAddress");
+    assertOptionalString(value.targetRelayAddress, "relay.targetRelayAddress");
+    if (value.sentAt !== undefined) assertNumber(value.sentAt, "relay.sentAt");
+    return value;
+  }
+
+  if (type === "relay.matterhorn-operation") {
+    assertString(value.id, "relay.id");
+    assertString(value.roomName, "relay.roomName");
+    validateRoomOperation(value.operation, { roomId: value.roomName });
+    if (value.operations !== undefined) {
+      assertArray(value.operations, "relay.operations").forEach((operation, index) => {
+        validateRoomOperation(operation, { roomId: value.roomName });
+        if (operation.roomId !== value.roomName) throw invalid(`relay.operations[${index}].roomId`, "does not match relay roomName");
+      });
+    }
+    if (value.state !== undefined) {
+      const state = assertRecord(value.state, "relay.state");
+      if (state.roomId !== undefined && state.roomId !== value.roomName) throw invalid("relay.state.roomId", "does not match relay roomName");
+    }
+    return value;
+  }
+  if (type === "relay.peer-signal") {
+    assertOptionalString(value.id, "relay.id");
+    assertString(value.roomName, "relay.roomName");
+    assertString(value.sourceClientId, "relay.sourceClientId");
+    assertOptionalString(value.sourcePeerId, "relay.sourcePeerId");
+    if (value.targetClientId === undefined && value.targetPeerId === undefined) throw invalid("relay.target", "is required");
+    assertOptionalString(value.targetClientId, "relay.targetClientId");
+    assertOptionalString(value.targetPeerId, "relay.targetPeerId");
+    validateCallSignal(value.signal, "relay.signal");
+    return value;
+  }
+  if (type === RELAY_PUSH) {
+    assertString(value.id, "relay.id");
+    const target = assertRecord(value.target, "relay.target");
+    assertString(target.userId, "relay.target.userId");
+    assertJsonByteLength(value.payload, "relay.payload", MAX_PUSH_PAYLOAD_BYTES);
+    return value;
+  }
+  throw invalid("relay.type", "is invalid");
+}
+
+module.exports = { validateRelayEnvelope };

package/src/validators/shared.cjs

@@ -0,0 +1,41 @@
+const { MAX_RELAY_ADDRESS_LENGTH } = require("../constants.cjs");
+const { assertArray, assertNumber, assertOptionalString, assertRecord, assertString } = require("../assertions.cjs");
+const { invalid } = require("../errors.cjs");
+
+function validateProfile(value, path = "profile") {
+  const profile = assertRecord(value, path);
+  assertString(profile.id, `${path}.id`);
+  assertString(profile.name, `${path}.name`);
+  assertString(profile.avatar, `${path}.avatar`);
+  assertOptionalString(profile.callPubkey, `${path}.callPubkey`);
+  return profile;
+}
+
+function validateRelayAddresses(value, path = "relays") {
+  return assertArray(value || [], path).map((relay, index) => assertString(relay, `${path}[${index}]`, MAX_RELAY_ADDRESS_LENGTH));
+}
+
+function validateOperationKeyPin(value, path = "operationKeyPin") {
+  const pin = assertRecord(value, path);
+  if (pin.alg !== "ed25519") throw invalid(`${path}.alg`, "is invalid");
+  assertString(pin.signer, `${path}.signer`);
+  const hash = assertString(pin.publicKeyHash, `${path}.publicKeyHash`);
+  if (!hash.startsWith("sha256-")) throw invalid(`${path}.publicKeyHash`, "must be a sha256 hash");
+  return pin;
+}
+
+function validateOperationSigner(value, path = "operationSigner") {
+  const signer = assertRecord(value, path);
+  assertString(signer.signer, `${path}.signer`);
+  assertString(signer.publicKeyPem, `${path}.publicKeyPem`, 8192);
+  if (signer.alg !== undefined && signer.alg !== "ed25519") throw invalid(`${path}.alg`, "is invalid");
+  if (signer.createdAt !== undefined) assertNumber(signer.createdAt, `${path}.createdAt`);
+  return signer;
+}
+
+module.exports = {
+  validateOperationKeyPin,
+  validateOperationSigner,
+  validateProfile,
+  validateRelayAddresses
+};

package/test/matterhorn-protocol.test.cjs

@@ -0,0 +1,421 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const {
+  MatterhornProtocolError,
+  parseHostOperationBatch,
+  parseHostSnapshot,
+  parseRoomOperation,
+  safeValidate,
+  validateOperationKeyPin,
+  validateOperationSigner,
+  validateClientHello,
+  validateClientMessage,
+  validateClientMutation,
+  validateClientPeerSignal,
+  validateClientPushGrant,
+  validateClientPushRegister,
+  validateClientSnapshotRequest,
+  validateHostInfo,
+  validateHostOperations,
+  validateRelayEnvelope,
+  validateRoomOperation,
+  ensureOperationIdentity
+} = require("../src/index.cjs");
+
+function identified(operation, now = operation.createdAt || 1000) {
+  return ensureOperationIdentity(operation, { nodeId: operation.actor?.deviceId || "test", now });
+}
+
+test("validates shared client wire messages", () => {
+  assert.equal(validateClientHello({
+    type: "client/hello",
+    protocol: 1,
+    roomName: "demo",
+    clientId: "alice",
+    profile: { id: "alice", name: "Alice", avatar: "✨" },
+    relayHints: ["peerjs:relay@wss://peerjs.example"]
+  }).clientId, "alice");
+
+  assert.equal(validateClientMutation({
+    type: "client/mutation",
+    protocol: 1,
+    roomName: "demo",
+    mutation: { id: "m1", clientId: "alice", seq: 1, ts: 100, op: "post.add", payload: { body: "hi" } }
+  }).mutation.op, "post.add");
+  assert.equal(validateClientSnapshotRequest({
+    type: "client/snapshot-request",
+    protocol: 1,
+    roomName: "demo",
+    clientId: "alice",
+    reason: "gap"
+  }).reason, "gap");
+  assert.equal(validateClientPeerSignal({
+    type: "client/peer-signal",
+    protocol: 1,
+    roomName: "demo",
+    clientId: "alice",
+    targetPeerId: "peer-b",
+    signal: { type: "call.cancel", sessionId: "s1" }
+  }).targetPeerId, "peer-b");
+  assert.equal(validateClientMessage({
+    type: "client/hello",
+    protocol: 1,
+    roomName: "demo",
+    clientId: "alice"
+  }).type, "client/hello");
+
+  assert.throws(() => validateClientHello({ type: "client/hello", protocol: 2 }), MatterhornProtocolError);
+  assert.throws(() => validateClientMessage({ type: "client/unknown" }), /client.type/);
+  assert.throws(() => validateClientPeerSignal({ type: "client/peer-signal", protocol: 1, roomName: "demo", clientId: "alice", signal: { type: "call.cancel", sessionId: "s1" } }), /target/);
+  assert.equal(safeValidate(validateClientMutation, { type: "client/mutation", protocol: 1 }).ok, false);
+});
+
+test("validates push client messages and relay envelopes", () => {
+  const subscription = {
+    endpoint: "https://push.example/sub",
+    keys: { p256dh: "p256dh-key", auth: "auth-key" }
+  };
+  const grant = {
+    kind: "matterhorn.vapid-grant",
+    version: 1,
+    relayPublicKey: "relay-spki",
+    createdAt: 1000,
+    wrap: {
+      alg: "x25519+hkdf-sha256+aes-256-gcm",
+      ephemeralPublicKey: "ephemeral-spki",
+      iv: "iv"
+    },
+    wrappedVapidPrivateKey: "wrapped"
+  };
+  assert.equal(validateClientPushRegister({
+    type: "client/push-register",
+    protocol: 1,
+    roomName: "room",
+    clientId: "device-a",
+    userId: "user-a",
+    subscription
+  }).subscription.endpoint, subscription.endpoint);
+  assert.equal(validateClientMessage({
+    type: "client/push-grant",
+    protocol: 1,
+    clientId: "device-a",
+    userId: "user-a",
+    relayId: "relay-a",
+    grant
+  }).type, "client/push-grant");
+  assert.equal(validateClientPushGrant({
+    type: "client/push-grant",
+    protocol: 1,
+    clientId: "device-a",
+    userId: "user-a",
+    relayId: "relay-a",
+    grant
+  }).grant.kind, "matterhorn.vapid-grant");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.push",
+    id: "push-1",
+    target: { userId: "user-a" },
+    payload: { ciphertext: "abc" }
+  }).target.userId, "user-a");
+  assert.throws(() => validateClientPushRegister({
+    type: "client/push-register",
+    protocol: 1,
+    roomName: "room",
+    clientId: "device-a",
+    userId: "user-a",
+    subscription: { endpoint: "https://push.example/sub", keys: {} }
+  }), /p256dh/);
+  assert.throws(() => validateClientPushGrant({
+    type: "client/push-grant",
+    protocol: 1,
+    clientId: "device-a",
+    userId: "user-a",
+    relayId: "relay-a",
+    grant: { ...grant, wrap: { ...grant.wrap, alg: "bad" } }
+  }), /wrap.alg/);
+  assert.throws(() => validateRelayEnvelope({
+    type: "relay.push",
+    id: "push-2",
+    target: {},
+    payload: {}
+  }), /target.userId/);
+});
+
+test("validates SDK room operations and host operations", () => {
+  const op = identified({
+    roomId: "room1",
+    appPackId: "app",
+    appPackHash: "sha256-app",
+    pluginId: "plugin",
+    type: "thing.create",
+    actor: { memberId: "alice", deviceId: "dev", role: "member" },
+    seq: 1,
+    createdAt: 100,
+    payload: {},
+    auth: { credentialId: "cred", signature: "sig" }
+  });
+  assert.equal(validateRoomOperation(op, { roomId: "room1" }).id, op.id);
+  assert.throws(() => validateRoomOperation(identified({ ...op, appPackHash: "wrong" }, 100), { appPackHash: "sha256-app" }), /operation.appPackHash/);
+  assert.equal(validateHostOperations({ type: "host/operations", protocol: 1, baseVersion: 0, operations: [op] }).operations.length, 1);
+
+  const legacyOperation = {
+    kind: "matterhorn.room-operation",
+    version: 1,
+    roomName: "event-room",
+    baseVersion: 0,
+    sequence: 1,
+    issuedAt: 100,
+    signer: "host",
+    role: "admin",
+    mutation: { id: "mut1", clientId: "alice", seq: 1, ts: 100, op: "post.add", payload: { body: "hi" } },
+    signature: "sig"
+  };
+  assert.equal(validateHostOperations({ type: "host/operations", protocol: 1, baseVersion: 0, operations: [legacyOperation] }).operations[0].kind, "matterhorn.room-operation");
+  assert.throws(
+    () => validateHostOperations({ type: "host/operations", protocol: 1, baseVersion: 0, operations: [{ ...legacyOperation, mutation: { ...legacyOperation.mutation, seq: 0 } }] }),
+    /mutation.seq/
+  );
+});
+
+test("validates host info and relay envelopes", () => {
+  assert.equal(validateHostInfo({
+    kind: "matterhorn.host-info",
+    version: "0.1",
+    roomId: "room1",
+    roomVersion: 2,
+    appPack: { id: "app", hash: "sha256-app", protocolHash: "sha256-protocol" },
+    plugins: [],
+    relays: []
+  }).roomVersion, 2);
+  assert.equal(validateRelayEnvelope({
+    type: "relay.client",
+    id: "r1",
+    peerId: "peer",
+    roomName: "room",
+    message: {
+      type: "client/hello",
+      protocol: 1,
+      roomName: "room",
+      clientId: "alice"
+    }
+  }).peerId, "peer");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.broadcast",
+    id: "b1",
+    roomName: "room",
+    message: { type: "host/state", protocol: 1, state: {} }
+  }).roomName, "room");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.host",
+    id: "h1",
+    peerId: "host-peer",
+    roomName: "room",
+    message: { type: "host/state", protocol: 1, state: {} }
+  }).peerId, "host-peer");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.client.close",
+    peerId: "client-peer"
+  }).peerId, "client-peer");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.ping",
+    id: "ping-1",
+    relayAddress: "peerjs:relay-a",
+    targetRelayAddress: "peerjs:relay-b",
+    sentAt: 1000
+  }).id, "ping-1");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.pong",
+    id: "pong-1",
+    requestId: "ping-1",
+    relayAddress: "peerjs:relay-b",
+    sentAt: 1001
+  }).requestId, "ping-1");
+  assert.equal(validateRelayEnvelope({
+    type: "relay.peer-signal",
+    roomName: "room",
+    sourceClientId: "alice",
+    targetPeerId: "peer-b",
+    signal: { type: "call.cancel", sessionId: "s1" }
+  }).sourceClientId, "alice");
+  assert.throws(() => validateRelayEnvelope({
+    type: "relay.client",
+    id: "r2",
+    peerId: "peer",
+    roomName: "room",
+    message: {
+      type: "client/hello",
+      protocol: 1,
+      roomName: "other",
+      clientId: "alice"
+    }
+  }), /relay.message.roomName/);
+  const op = identified({
+    roomId: "room2",
+    appPackId: "app2",
+    appPackHash: "sha256-app2",
+    pluginId: "plugin2",
+    type: "thing.update",
+    actor: { memberId: "bob", deviceId: "dev2", role: "admin" },
+    seq: 2,
+    createdAt: 200,
+    payload: {},
+    auth: { credentialId: "cred2", signature: "sig2" }
+  });
+  assert.equal(validateRelayEnvelope({
+    type: "relay.matterhorn-operation",
+    id: "relay-op",
+    roomName: "room2",
+    operation: op,
+    operations: [op],
+    state: { roomId: "room2" }
+  }).operation.id, op.id);
+  assert.throws(() => validateRelayEnvelope({
+    type: "relay.matterhorn-operation",
+    id: "relay-op-bad",
+    roomName: "room2",
+    operation: op,
+    operations: [identified({ ...op, roomId: "other" }, 200)]
+  }), /relay.operations|operation.roomId/);
+  assert.throws(() => validateRelayEnvelope({ type: "relay.unknown" }), /relay.type/);
+  assert.throws(() => validateRelayEnvelope({
+    type: "relay.peer-signal",
+    roomName: "room",
+    sourceClientId: "alice",
+    signal: { type: "call.cancel", sessionId: "s1" }
+  }), /relay.target/);
+  assert.throws(() => validateHostInfo({ kind: "wrong" }), /host-info.kind/);
+});
+
+test("validates optional profile, relay, operation, batch, and snapshot branches", () => {
+  const op = identified({
+    roomId: "room2",
+    appPackId: "app2",
+    appPackHash: "sha256-app2",
+    pluginId: "plugin2",
+    type: "thing.update",
+    actor: { memberId: "bob", deviceId: "dev2", role: "admin" },
+    seq: 2,
+    createdAt: 200,
+    payload: {},
+    auth: { credentialId: "cred2", signature: "sig2" }
+  });
+  assert.equal(validateClientHello({ type: "client/hello", protocol: 1, roomName: "demo", clientId: "bob" }).clientId, "bob");
+  assert.equal(validateClientHello({
+    type: "client/hello",
+    protocol: 1,
+    roomName: "demo",
+    clientId: "bob",
+    profile: { id: "bob", name: "Bob", avatar: "🧪", callPubkey: "pub" }
+  }).profile.callPubkey, "pub");
+  assert.throws(() => validateClientHello({ type: "client/hello", protocol: 1, roomName: "demo", clientId: "bob", relayHints: ["x".repeat(2050)] }), /relayHints/);
+  assert.throws(() => validateRoomOperation({ ...op, payload: "bad" }), /operation.payload/);
+  assert.throws(() => validateRoomOperation(identified({ ...op, roomId: "wrong" }, 200), { roomId: "room2" }), /operation.roomId/);
+  assert.throws(() => validateRoomOperation(identified({ ...op, appPackId: "wrong" }, 200), { appPackId: "app2" }), /operation.appPackId/);
+  assert.equal(parseRoomOperation(op).id, op.id);
+
+  const roleKeyOp = identified({
+    ...op,
+    auth: {
+      credentialId: "cred-role",
+      signature: "sig-role",
+      kind: "matterhorn.operation-role-key-proof",
+      alg: "ed25519",
+      keyRole: "admin",
+      publicKeyFingerprint: "sha256-role",
+      issuedAt: 201
+    }
+  }, 201);
+  assert.equal(validateRoomOperation(roleKeyOp).auth.keyRole, "admin");
+  assert.throws(() => validateRoomOperation({ ...roleKeyOp, auth: { ...roleKeyOp.auth, issuedAt: "bad" } }), /operation.auth.issuedAt/);
+
+  assert.equal(parseHostOperationBatch({
+    kind: "matterhorn.host-operation-batch",
+    roomId: "room2",
+    appPackId: "app2",
+    appPackHash: "sha256-app2",
+    baseVersion: 0,
+    headVersion: 1,
+    operations: [op]
+  }).headVersion, 1);
+  assert.throws(() => parseHostOperationBatch({ kind: "bad", roomId: "room2", appPackId: "app2", appPackHash: "sha256-app2", operations: [] }), /host-operation-batch.kind/);
+  assert.throws(() => parseHostOperationBatch({ roomId: "room2", appPackId: "app2", appPackHash: "sha256-app2", operations: [identified({ ...op, appPackHash: "wrong" }, 200)] }), /operation.appPackHash/);
+
+  assert.equal(parseHostSnapshot({
+    kind: "matterhorn.host-snapshot",
+    roomId: "room2",
+    appPackId: "app2",
+    appPackHash: "sha256-app2",
+    version: 1,
+    state: {}
+  }).version, 1);
+  assert.throws(() => parseHostSnapshot({ kind: "bad", roomId: "room2", appPackId: "app2", appPackHash: "sha256-app2", version: 1, state: {} }), /host-snapshot.kind/);
+});
+
+test("safeValidate handles non-Matterhorn errors", () => {
+  const result = safeValidate(() => { throw new TypeError("plain failure"); }, {});
+  assert.equal(result.ok, false);
+  assert.equal(result.code, "invalid-message");
+  assert.equal(result.message, "plain failure");
+});
+
+
+test("validates operation key pins and signer anchors", () => {
+  assert.equal(validateOperationKeyPin({ alg: "ed25519", signer: "host_a", publicKeyHash: "sha256-abc" }).signer, "host_a");
+  assert.equal(validateOperationSigner({ signer: "host_a", publicKeyPem: "-----BEGIN PUBLIC KEY-----\nabc\n-----END PUBLIC KEY-----", alg: "ed25519", createdAt: 1 }).alg, "ed25519");
+  assert.throws(() => validateOperationKeyPin({ alg: "rsa", signer: "host", publicKeyHash: "sha256-x" }), /operationKeyPin.alg/);
+  assert.throws(() => validateOperationKeyPin({ alg: "ed25519", signer: "host", publicKeyHash: "not-a-hash" }), /publicKeyHash/);
+  assert.throws(() => validateOperationSigner({ signer: "host", publicKeyPem: "pem", alg: "rsa" }), /operationSigner.alg/);
+
+  const op = identified({
+    roomId: "room3",
+    appPackId: "app3",
+    appPackHash: "sha256-app3",
+    pluginId: "plugin3",
+    type: "thing.update",
+    actor: { memberId: "bob", deviceId: "dev3", role: "admin" },
+    seq: 3,
+    createdAt: 300,
+    payload: {},
+    auth: { credentialId: "cred3", signature: "sig3" }
+  }, 300);
+  assert.equal(validateHostOperations({
+    type: "host/operations",
+    protocol: 1,
+    baseVersion: 0,
+    operations: [op],
+    operationKeyPin: { alg: "ed25519", signer: "host_a", publicKeyHash: "sha256-abc" }
+  }).operationKeyPin.signer, "host_a");
+});
+
+test("validates operation trust pins on host operation batches", () => {
+  const op = identified({
+    roomId: "room-trust",
+    appPackId: "app",
+    appPackHash: "sha256-app",
+    pluginId: "plugin",
+    type: "thing.create",
+    actor: { memberId: "alice", deviceId: "dev", role: "admin" },
+    seq: 1,
+    createdAt: 300,
+    payload: {},
+    auth: { credentialId: "cred", signature: "sig" }
+  }, 300);
+  const batch = validateHostOperations({
+    type: "host/operations",
+    protocol: 1,
+    baseVersion: 0,
+    operations: [op],
+    operationTrustPin: {
+      kind: "matterhorn.operation-key-pin",
+      version: 1,
+      roomName: "room-trust",
+      signer: "host",
+      alg: "ed25519",
+      publicKeyPem: "-----BEGIN PUBLIC KEY-----\nabc\n-----END PUBLIC KEY-----",
+      fingerprint: "sha256:abc",
+      pinnedAt: 300
+    }
+  });
+  assert.equal(batch.operationTrustPin.signer, "host");
+  assert.throws(() => validateHostOperations({ ...batch, operationTrustPin: { ...batch.operationTrustPin, alg: "rsa" } }), /operationTrustPin.alg/);
+});

package/test/operation-bounds.test.cjs

@@ -0,0 +1,87 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+
+const {
+  MAX_OPERATION_BYTES,
+  MAX_OPERATION_DEPTH,
+  ensureOperationIdentity,
+  validateRelayEnvelope,
+  validateRoomOperation
+} = require("../src/index.cjs");
+
+function baseOperation(overrides = {}) {
+  return {
+    roomId: "room",
+    appPackId: "app",
+    appPackHash: "sha256-app",
+    pluginId: "plugin",
+    type: "thing.create",
+    actor: { memberId: "alice", deviceId: "dev_alice", role: "admin" },
+    seq: 1,
+    createdAt: 1000,
+    payload: {},
+    auth: { credentialId: "cred", signature: "sig" },
+    ...overrides
+  };
+}
+
+function identified(operation = baseOperation(), now = operation.createdAt || 1000) {
+  return ensureOperationIdentity(operation, { nodeId: operation.actor?.deviceId || "test", now });
+}
+
+function nestedPayload(depth) {
+  let value = { leaf: true };
+  for (let index = 0; index < depth; index += 1) value = { child: value };
+  return value;
+}
+
+test("operation validator exposes and applies default byte and depth limits", () => {
+  assert.equal(MAX_OPERATION_BYTES, 64 * 1024);
+  assert.equal(MAX_OPERATION_DEPTH, 64);
+
+  const op = identified(baseOperation({ payload: nestedPayload(8) }));
+  assert.equal(validateRoomOperation(op, { now: 1000 }).id, op.id);
+});
+
+test("operation validator rejects oversized payloads before content hash work", () => {
+  let hashCalls = 0;
+  const op = { ...baseOperation({ payload: { text: "x".repeat(200) } }), id: "sha256:bad", hlc: "000000000001000:000000:dev_alice" };
+  assert.throws(() => validateRoomOperation(op, {
+    maxOperationBytes: 128,
+    operationContentHash() { hashCalls += 1; return "sha256:never"; }
+  }), /operation: is too large/);
+  assert.equal(hashCalls, 0);
+});
+
+test("operation validator rejects over-deep payloads before content hash work without RangeError", () => {
+  let hashCalls = 0;
+  const op = { ...baseOperation({ payload: nestedPayload(100_000) }), id: "sha256:bad", hlc: "000000000001000:000000:dev_alice" };
+  assert.throws(() => validateRoomOperation(op, {
+    operationContentHash() { hashCalls += 1; return "sha256:never"; }
+  }), (error) => {
+    assert.equal(error instanceof RangeError, false);
+    assert.match(error.message, /operation: max depth exceeded/);
+    return true;
+  });
+  assert.equal(hashCalls, 0);
+});
+
+test("depth probe is iterative and rejects hostile input before JSON.stringify", () => {
+  const op = { ...baseOperation({ payload: nestedPayload(100_000) }), id: "sha256:bad", hlc: "000000000001000:000000:dev_alice" };
+  assert.throws(() => validateRoomOperation(op, { maxOperationDepth: 12, validateId: false }), /max depth exceeded/);
+});
+
+test("relay room-operation envelopes use the same operation bounds", () => {
+  const op = identified(baseOperation({ roomId: "room", payload: { text: "ok" } }));
+  assert.equal(validateRelayEnvelope({ type: "relay.matterhorn-operation", id: "relay-op", roomName: "room", operation: op }).operation.id, op.id);
+
+  const deepOp = { ...baseOperation({ roomId: "room", payload: nestedPayload(100_000) }), id: "sha256:bad", hlc: "000000000001000:000000:dev_alice" };
+  assert.throws(() => validateRelayEnvelope({ type: "relay.matterhorn-operation", id: "relay-deep", roomName: "room", operation: deepOp }), /max depth exceeded/);
+});
+
+test("a valid operation below relay-sized caps passes the host validator", () => {
+  const op = identified(baseOperation({ payload: { text: "x".repeat(1024) } }));
+  const bytes = Buffer.byteLength(JSON.stringify(op), "utf8");
+  assert.ok(bytes < MAX_OPERATION_BYTES);
+  assert.equal(validateRoomOperation(op, { maxOperationBytes: MAX_OPERATION_BYTES, maxOperationDepth: MAX_OPERATION_DEPTH }).id, op.id);
+});