@pi-chamber/web 0.1.8

package/server/lib/relay/DOCUMENTATION.md

@@ -0,0 +1,106 @@
+# Relay Module Documentation
+
+## Purpose
+
+The private relay lets an PiChamber client (mobile app, browser, or another desktop) reach a user's PiChamber instance through PiChamber-hosted infrastructure when the instance is not directly reachable (behind NAT, no public URL, no tunnel). The instance dials **outbound** to the relay; nothing needs to be exposed inbound.
+
+Traffic is **end-to-end encrypted between the two endpoints** (client and host instance). The relay infrastructure forwards opaque ciphertext and cannot read application traffic — it is an untrusted transport, not a trusted middlebox.
+
+This module (`packages/web/server/lib/relay/`) is the **host side**: it runs inside the PiChamber web server (so it works for Electron desktop, headless server, and CLI installs alike). The **client side** lives in `packages/ui/src/lib/relay/`. The **relay service itself** is a separate Cloudflare Worker in the `pichamber-website` repo and only brokers connections.
+
+> **Wiring status:** the relay host runtime is not currently started by any
+> runtime entrypoint. The host entrypoint (`createRelayService` — settings
+> persistence, the `/api/pichamber/relay/*` management routes, and lifecycle
+> wiring) and `host-lock.js` (the per-machine host claim) were removed as dead
+> code. The remaining host files below are kept as the implementation and are
+> exercised by their own tests and the TS↔JS cross-compat test; restoring relay
+> host mode means wiring an entrypoint that starts `host-client.js` with the
+> identity and local port from `identity.js`.
+
+## The three layers
+
+Traffic is modeled as three stacked layers. The relay understands only Layer 1; Layers 2–3 exist solely between the client and the host.
+
+1. **Relay routing (Layer 1)** — outbound WebSocket connections to the relay, connection brokering, and host authentication to the relay. The relay routes each client to the correct host and forwards frames verbatim.
+2. **End-to-end encryption (Layer 2)** — an authenticated encrypted channel established directly between client and host, keyed so the relay cannot participate. Built on standard WebCrypto primitives (ECDH key agreement + AEAD framing). The host's encryption public key is distributed to the client out-of-band via the pairing payload and is the client's trust anchor.
+3. **Tunnel multiplexing (Layer 3)** — because an PiChamber client speaks many concurrent HTTP requests, an event stream (SSE), and WebSockets to one origin, the encrypted channel carries a small multiplexing protocol. It frames HTTP request/response (including streamed bodies) and WebSocket sub-streams so the whole app works over one encrypted connection.
+
+## Entrypoints and structure
+
+Host side (`packages/web/server/lib/relay/`):
+- `service.js` — relay endpoint configuration only: exports `DEFAULT_RELAY_URL`. The host entrypoint (`createRelayService`: settings persistence, the `GET/POST /api/pichamber/relay/{status,enable,disable}` management routes, the `getPairingCandidate()` accessor, and host lifecycle wiring) was removed as dead code — no runtime wired it in. The CLI connect-url command resolves the relay endpoint (`DEFAULT_RELAY_URL`, the `PICHAMBER_RELAY_URL` env override, stored `settings.privateRelay.relayUrl`) the same way a host would.
+- `identity.js` — the host's stable identity: the long-lived signing keypair (shared with the push relay, defines the routing id) plus a long-lived encryption keypair (the E2EE trust anchor). Reused across restarts; never rotated implicitly.
+- `signing-key.js` — storage/derivation of the signing keypair and the routing id, shared with the notifications runtime.
+- `host-client.js` — the long-lived connection manager: one outbound control connection to the relay, a per-client data connection for each connected device, reconnect/backoff, and the E2EE responder handshake per connection.
+- `tunnel-host.js` — the per-connection dispatcher: decrypts tunnel frames and forwards HTTP/SSE/WS to the local server over loopback, then streams responses back. Enforces a path allowlist and never injects credentials.
+- `e2ee.js`, `tunnel-codec.js` — host-side (JS) mirrors of the shared crypto and framing (see "Two implementations" below).
+
+Client side (`packages/ui/src/lib/relay/`):
+- `protocol.ts` — the shared contract: constants, frame types, message shapes. The normative source both implementations follow.
+- `crypto.ts`, `handshake.ts` — the E2EE primitives and handshake state machines (initiator + responder).
+- `tunnel-codec.ts` — Layer 3 frame codec, fragmentation, and outbound frame batching.
+- `tunnel-client.ts` — the client tunnel: exposes a `fetch()`-compatible and a WebSocket-compatible surface backed by the encrypted tunnel.
+- `tunnel-payloads.ts`, `runtime-tunnel.ts`, `runtime-socket.ts` — payload helpers, the active-tunnel singleton, and the shared "open a runtime WebSocket the right way" helper.
+
+Relay is not a separate link format: it is one transport candidate inside the unified **pairing v2** payload (`packages/ui/src/lib/connectionPayload.ts`). A relay candidate is `{ type: 'relay', relayUrl, serverId, hostEncPubJwk }` — no embedded token; the client redeems the one-time pairing secret over the tunnel like any other candidate.
+
+## What travels the tunnel
+
+Everything a client normally sends to the single PiChamber origin:
+- **HTTP** — authenticated PiChamber API endpoints under `/api/*`, plus `/auth/*` and `/health`.
+- **SSE** — long-lived streamed responses (the event stream and notifications). These are just HTTP responses whose body streams; the tunnel needs no special SSE handling.
+- **WebSocket** — the endpoints that use a real socket (the global event stream on platforms that support WS, terminal I/O, dictation).
+
+The host dispatcher restricts tunneled traffic to explicit path allowlists (one for HTTP, one for WS).
+
+## Authentication model
+
+- The tunnel is **transport only**. The PiChamber server still authenticates every tunneled request exactly as it authenticates a direct remote client. The relay path grants reachability, not authorization.
+- Clients carry their normal credential. HTTP and SSE requests authenticate with the client's bearer token (a header). **WebSocket upgrades cannot send headers**, so they authenticate with a short-lived URL-scoped token minted beforehand and passed as a query parameter. This asymmetry is important when adding new WebSocket features (see the skill).
+- The host authenticates itself to the relay with a signed handshake using its long-lived signing key.
+- Enabling the relay is explicit opt-in and disabled by default; disabling it severs all relay reachability immediately.
+
+## End-to-end flow (overview)
+
+1. **Pairing.** The host issues a pairing-v2 link (QR / deep link) carrying a one-time secret and a list of transport candidates. When the relay is enabled, one candidate is the relay transport (its endpoint, routing id, and encryption public key — the E2EE trust anchor). The client redeems the secret over the first reachable candidate; over the relay candidate it opens the E2EE tunnel first, then redeems through it, and stores the connection.
+2. **Presence.** When the relay is enabled, the host opens one outbound control connection and waits.
+3. **Connect.** The client connects for a given routing id; the relay notifies the host over the control connection; the host opens a matching per-client data connection.
+4. **Handshake.** Over that connection pair, client and host run the E2EE handshake and derive a shared encrypted channel the relay cannot read.
+5. **Traffic.** All normal app traffic is multiplexed and encrypted through that channel. On the host, decrypted requests are dispatched to the local server over loopback with the actual loopback origin, so normal origin checks still apply without trusting client-supplied origin metadata; responses stream back encrypted. Reconnects re-establish a fresh channel and the app's existing retry machinery recovers.
+
+## Candidate refresh (staying off the relay when direct works)
+
+Pairing-payload transport candidates are a snapshot: when DHCP hands the host
+machine a new LAN address, a device's saved direct candidate goes stale and the
+device silently degrades to relay-only. To recover, an already-paired client can
+call `GET /api/client-auth/connection/candidates` (UI session or client bearer;
+registered with the auth/access routes) over any live transport — including
+through the tunnel — to learn the server's **current** LAN URLs plus the relay
+candidate, and update its saved candidate set (mobile: `mobileConnections.ts`;
+desktop: `desktopRelayRestore.ts`).
+
+Identity gating: the response carries the stable `serverId` (base64url SHA-256 of
+the public signing JWK — the same identity the relay routes by, exposed by the
+relay service's `getServerId()` and echoed unauthenticated on `/health` and
+`/api/version`). Clients ignore a refresh whose `serverId` does not match their
+pinned relay identity, and verify `/health`'s `serverId` on a learned address
+**before** sending their bearer token to it — a re-assigned LAN address may now
+belong to a different machine.
+
+## Two implementations, kept in sync
+
+The E2EE and framing logic exists twice: TypeScript in `packages/ui/src/lib/relay/` (shared by the client and the normative reference) and a JavaScript mirror in this module (the host, which is plain JS ESM). They **must stay byte-compatible** — a client encrypted by one must decrypt on the other. A cross-compatibility test (`cross-compat.test.js`) imports the TS modules directly and exercises a full TS-client ↔ JS-host exchange. Any change to the wire format, frame codec, handshake, or batching must update both sides and keep that test green.
+
+## Runtime integration (client)
+
+Relay mode plugs into the existing client transport layer rather than a parallel path: `runtime-switch` activates the tunnel singleton, `runtime-fetch` routes runtime requests through it, `runtime-url`/`runtime-socket` yield tunnel-backed URLs and sockets, and `runtime-auth` mints the URL-scoped token through the tunnel. Direct-URL connections are unaffected.
+
+## Design invariants (do not regress)
+
+- The relay never sees plaintext application traffic; it sees only routing metadata (routing id, connection identifiers, timestamps, coarse counts).
+- Pairing secrets travel in URL fragments only, never in query strings, never logged.
+- The host dispatcher never injects credentials; the server authenticates each tunneled request.
+- The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
+- The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break.
+
+For the operational rules that keep future changes (new WebSocket endpoints, transport refactors, terminal/voice porting) from breaking this, load the `relay-transport` skill.

package/server/lib/relay/cross-compat.test.js

@@ -0,0 +1,135 @@
+// Cross-compatibility: the JS host e2ee must interoperate with the normative TS
+// modules in packages/ui/src/lib/relay. bun runs TS directly, so import the TS
+// client handshake and drive a full TS-client <-> JS-host exchange both ways.
+
+import { describe, expect, it } from 'bun:test';
+
+import { createHostHandshake, exportPublicKeyJwk, generateEcdhKeyPair } from './e2ee.js';
+import { createClientHandshake } from '../../../../ui/src/lib/relay/handshake.ts';
+import {
+  TunnelFrameType as JsFrameType,
+  decodeFrameBatch as jsDecodeBatch,
+  decodeTunnelFrame as jsDecode,
+  encodeFrameBatch as jsEncodeBatch,
+  encodeTunnelFrame as jsEncode,
+} from './tunnel-codec.js';
+import {
+  decodeFrameBatch as tsDecodeBatch,
+  decodeTunnelFrame as tsDecode,
+  encodeFrameBatch as tsEncodeBatch,
+  encodeTunnelFrame as tsEncode,
+} from '../../../../ui/src/lib/relay/tunnel-codec.ts';
+import { TunnelFrameType as TsFrameType } from '../../../../ui/src/lib/relay/protocol.ts';
+
+describe('relay JS-host <-> TS-client cross compatibility', () => {
+  it('completes a handshake and exchanges frames both ways', async () => {
+    const hostKeys = await generateEcdhKeyPair();
+    const hostPubJwk = await exportPublicKeyJwk(hostKeys.publicKey);
+
+    const jsHost = createHostHandshake(hostKeys.privateKey);
+    const tsClient = await createClientHandshake(hostPubJwk);
+
+    // TS client hello -> JS host establishes and replies ready.
+    const hostAction = await jsHost.handleText(tsClient.helloText);
+    expect(hostAction.type).toBe('established');
+    const hostChannel = hostAction.channel;
+
+    // JS host ready -> TS client establishes.
+    const clientAction = await tsClient.handleText(hostAction.replyText);
+    expect(clientAction.type).toBe('established');
+    const clientChannel = clientAction.channel;
+
+    // TS client -> JS host.
+    const up = new TextEncoder().encode('ts client speaking');
+    const upPlain = await hostChannel.decryptor.decrypt(await clientChannel.encryptor.encrypt(up));
+    expect(new TextDecoder().decode(upPlain)).toBe('ts client speaking');
+
+    // JS host -> TS client.
+    const down = new TextEncoder().encode('js host replying');
+    const downPlain = await clientChannel.decryptor.decrypt(await hostChannel.encryptor.encrypt(down));
+    expect(new TextDecoder().decode(downPlain)).toBe('js host replying');
+  });
+
+  it('tunnel frames are byte-compatible across TS and JS codecs', () => {
+    const payload = new TextEncoder().encode('{"method":"GET"}');
+    const tsFrame = tsEncode(TsFrameType.HttpRequest, 5, payload);
+    const jsFrame = jsEncode(JsFrameType.HttpRequest, 5, payload);
+    expect(Array.from(jsFrame)).toEqual(Array.from(tsFrame));
+
+    const decodedByJs = jsDecode(tsFrame);
+    const decodedByTs = tsDecode(jsFrame);
+    expect(decodedByJs.streamId).toBe(5);
+    expect(decodedByTs.streamId).toBe(5);
+    expect(decodedByJs.frameType).toBe(TsFrameType.HttpRequest);
+  });
+
+  it('negotiates batching between a TS client and a JS host, then exchanges a batch', async () => {
+    const hostKeys = await generateEcdhKeyPair();
+    const hostPubJwk = await exportPublicKeyJwk(hostKeys.publicKey);
+
+    const jsHost = createHostHandshake(hostKeys.privateKey);
+    const tsClient = await createClientHandshake(hostPubJwk);
+
+    const hostAction = await jsHost.handleText(tsClient.helloText);
+    expect(hostAction.type).toBe('established');
+    expect(hostAction.batch).toBe(true);
+    const clientAction = await tsClient.handleText(hostAction.replyText);
+    expect(clientAction.type).toBe('established');
+    expect(clientAction.batch).toBe(true);
+
+    // TS client encodes a multi-frame batch -> JS host decodes it byte-identically.
+    const frames = [
+      tsEncode(TsFrameType.HttpBody, 1, new TextEncoder().encode('alpha')),
+      tsEncode(TsFrameType.HttpBody, 1, new TextEncoder().encode('beta')),
+      tsEncode(TsFrameType.HttpBody, 1, new TextEncoder().encode('gamma')),
+    ];
+    const overWire = await hostAction.channel.decryptor.decrypt(
+      await clientAction.channel.encryptor.encrypt(tsEncodeBatch(frames)),
+    );
+    const jsFrames = jsDecodeBatch(overWire);
+    expect(jsFrames.length).toBe(3);
+    jsFrames.forEach((frame, index) => expect(Array.from(frame)).toEqual(Array.from(frames[index])));
+
+    // JS host encodes a batch -> TS client decodes it.
+    const downFrames = [
+      jsEncode(JsFrameType.HttpBody, 1, new TextEncoder().encode('down-1')),
+      jsEncode(JsFrameType.HttpBody, 1, new TextEncoder().encode('down-2')),
+    ];
+    const downWire = await clientAction.channel.decryptor.decrypt(
+      await hostAction.channel.encryptor.encrypt(jsEncodeBatch(downFrames)),
+    );
+    const tsFrames = tsDecodeBatch(downWire);
+    expect(tsFrames.length).toBe(2);
+    tsFrames.forEach((frame, index) => expect(Array.from(frame)).toEqual(Array.from(downFrames[index])));
+  });
+
+  it('falls back to legacy (no batch) when either peer does not advertise batching', async () => {
+    const hostKeys = await generateEcdhKeyPair();
+    const hostPubJwk = await exportPublicKeyJwk(hostKeys.publicKey);
+
+    // Legacy JS host (batch:false) vs batch-capable TS client -> batching off.
+    const legacyHost = createHostHandshake(hostKeys.privateKey, { batch: false });
+    const tsClient = await createClientHandshake(hostPubJwk);
+    const hostAction = await legacyHost.handleText(tsClient.helloText);
+    expect(hostAction.type).toBe('established');
+    expect(hostAction.batch).toBe(false);
+    const clientAction = await tsClient.handleText(hostAction.replyText);
+    expect(clientAction.type).toBe('established');
+    expect(clientAction.batch).toBe(false);
+
+    // Legacy wire: plaintext is a single raw tunnel frame (no container tag).
+    const frame = tsEncode(TsFrameType.HttpBody, 1, new TextEncoder().encode('legacy'));
+    const overWire = await hostAction.channel.decryptor.decrypt(
+      await clientAction.channel.encryptor.encrypt(frame),
+    );
+    expect(jsDecode(overWire).frameType).toBe(JsFrameType.HttpBody);
+
+    // Batch-capable JS host vs legacy TS client (batch:false) -> also off.
+    const host2 = createHostHandshake(hostKeys.privateKey);
+    const legacyClient = await createClientHandshake(hostPubJwk, { batch: false });
+    const host2Action = await host2.handleText(legacyClient.helloText);
+    expect(host2Action.batch).toBe(false);
+    const client2Action = await legacyClient.handleText(host2Action.replyText);
+    expect(client2Action.batch).toBe(false);
+  });
+});

package/server/lib/relay/e2ee.js

@@ -0,0 +1,341 @@
+// E2EE primitives + responder handshake for the private relay (Layer 2).
+// JS mirror of the normative TS implementation in
+// packages/ui/src/lib/relay/{protocol,crypto,handshake}.ts — the web server is
+// plain JS and cannot import from packages/ui, so the logic is copied verbatim
+// (converted to JSDoc'd JS) and MUST stay byte-compatible with those modules.
+// WebCrypto only: `globalThis.crypto.subtle` (Node >= 22).
+// Protocol: PiChamber private relay (Layer 2).
+
+const subtle = globalThis.crypto.subtle;
+
+export const RELAY_PROTOCOL_VERSION = 1;
+export const RELAY_HKDF_INFO = 'pichamber-relay-v1';
+
+// Encrypted frame layout: [1 byte version][12 byte IV][ciphertext + 16 byte GCM tag].
+export const ENCRYPTED_FRAME_VERSION = 1;
+export const ENCRYPTED_FRAME_IV_BYTES = 12;
+export const ENCRYPTED_FRAME_HEADER_BYTES = 1 + ENCRYPTED_FRAME_IV_BYTES;
+export const MAX_PLAINTEXT_FRAME_BYTES = 64 * 1024;
+
+// Relay-assigned WebSocket close codes (subset the host needs).
+export const RelayCloseCode = {
+  RekeyMismatch: 1008,
+  ChannelFailure: 1011,
+};
+
+const ECDH_PARAMS = { name: 'ECDH', namedCurve: 'P-256' };
+const HANDSHAKE_NONCE_BYTES = 16;
+const SESSION_KEY_BYTES = 32;
+const GCM_TAG_BYTES = 16;
+// IV = 4-byte random per-direction prefix || 8-byte big-endian frame counter.
+const IV_PREFIX_BYTES = 4;
+const IV_COUNTER_BYTES = 8;
+
+export class RelayCryptoError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'RelayCryptoError';
+  }
+}
+
+/** @returns {Promise<CryptoKeyPair>} */
+export const generateEcdhKeyPair = () => subtle.generateKey(ECDH_PARAMS, true, ['deriveBits']);
+
+/**
+ * @param {CryptoKey} key
+ * @returns {Promise<JsonWebKey>} public JWK reduced to the fields that define the point
+ */
+export const exportPublicKeyJwk = async (key) => {
+  const jwk = await subtle.exportKey('jwk', key);
+  return { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+};
+
+/** @param {JsonWebKey} jwk */
+export const importEcdhPublicKey = async (jwk) => {
+  if (jwk.kty !== 'EC' || jwk.crv !== 'P-256' || typeof jwk.x !== 'string' || typeof jwk.y !== 'string') {
+    throw new RelayCryptoError('invalid ECDH public key JWK');
+  }
+  try {
+    return await subtle.importKey(
+      'jwk',
+      { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y, ext: true },
+      ECDH_PARAMS,
+      true,
+      [],
+    );
+  } catch {
+    throw new RelayCryptoError('invalid ECDH public key JWK');
+  }
+};
+
+/** @param {JsonWebKey} jwk private ECDH JWK (d + point) */
+export const importEcdhPrivateKey = async (jwk) => {
+  try {
+    return await subtle.importKey('jwk', jwk, ECDH_PARAMS, false, ['deriveBits']);
+  } catch {
+    throw new RelayCryptoError('invalid ECDH private key JWK');
+  }
+};
+
+// Stable fingerprint of a public key, used to detect rekey attempts on re-hello.
+/** @param {JsonWebKey} jwk */
+export const publicKeyJwkFingerprint = (jwk) =>
+  JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+
+export const generateHandshakeNonce = () => {
+  const nonce = new Uint8Array(HANDSHAKE_NONCE_BYTES);
+  globalThis.crypto.getRandomValues(nonce);
+  return nonce;
+};
+
+/**
+ * Both sides call this with their own private key and the peer's public key;
+ * ECDH yields the same shared secret, so the derived key pair matches.
+ * @param {CryptoKey} ownPrivateKey
+ * @param {CryptoKey} peerPublicKey
+ * @param {Uint8Array} handshakeNonce
+ * @returns {Promise<{ clientToHost: CryptoKey, hostToClient: CryptoKey }>}
+ */
+export const deriveSessionKeys = async (ownPrivateKey, peerPublicKey, handshakeNonce) => {
+  if (handshakeNonce.length !== HANDSHAKE_NONCE_BYTES) {
+    throw new RelayCryptoError('invalid handshake nonce length');
+  }
+  const sharedSecret = await subtle.deriveBits({ name: 'ECDH', public: peerPublicKey }, ownPrivateKey, 256);
+  const hkdfKey = await subtle.importKey('raw', sharedSecret, 'HKDF', false, ['deriveBits']);
+  const keyMaterial = new Uint8Array(
+    await subtle.deriveBits(
+      {
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: handshakeNonce,
+        info: new TextEncoder().encode(RELAY_HKDF_INFO),
+      },
+      hkdfKey,
+      SESSION_KEY_BYTES * 2 * 8,
+    ),
+  );
+  const importAesKey = (bytes, usage) => subtle.importKey('raw', bytes, { name: 'AES-GCM' }, false, usage);
+  return {
+    clientToHost: await importAesKey(keyMaterial.slice(0, SESSION_KEY_BYTES), ['encrypt', 'decrypt']),
+    hostToClient: await importAesKey(keyMaterial.slice(SESSION_KEY_BYTES), ['encrypt', 'decrypt']),
+  };
+};
+
+const writeCounter = (target, offset, counter) => {
+  for (let i = IV_COUNTER_BYTES - 1; i >= 0; i -= 1) {
+    target[offset + i] = Number(counter & 0xffn);
+    counter >>= 8n;
+  }
+};
+
+const readCounter = (source, offset) => {
+  let value = 0n;
+  for (let i = 0; i < IV_COUNTER_BYTES; i += 1) {
+    value = (value << 8n) | BigInt(source[offset + i]);
+  }
+  return value;
+};
+
+/** @param {CryptoKey} key AES-256-GCM key for this direction */
+export const createFrameEncryptor = (key) => {
+  const ivPrefix = new Uint8Array(IV_PREFIX_BYTES);
+  globalThis.crypto.getRandomValues(ivPrefix);
+  let counter = 0n;
+  return {
+    /** @param {Uint8Array} plaintext */
+    async encrypt(plaintext) {
+      if (plaintext.length > MAX_PLAINTEXT_FRAME_BYTES) {
+        throw new RelayCryptoError('plaintext frame exceeds maximum size');
+      }
+      counter += 1n;
+      const iv = new Uint8Array(ENCRYPTED_FRAME_IV_BYTES);
+      iv.set(ivPrefix, 0);
+      writeCounter(iv, IV_PREFIX_BYTES, counter);
+      const ciphertext = new Uint8Array(await subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext));
+      const frame = new Uint8Array(ENCRYPTED_FRAME_HEADER_BYTES + ciphertext.length);
+      frame[0] = ENCRYPTED_FRAME_VERSION;
+      frame.set(iv, 1);
+      frame.set(ciphertext, ENCRYPTED_FRAME_HEADER_BYTES);
+      return frame;
+    },
+  };
+};
+
+// Enforces strictly increasing per-direction counters: the relay WS preserves
+// ordering, so any regression or replay means tampering and must fail closed.
+/** @param {CryptoKey} key AES-256-GCM key for this direction */
+export const createFrameDecryptor = (key) => {
+  let lastCounter = 0n;
+  return {
+    /** @param {Uint8Array} frame */
+    async decrypt(frame) {
+      if (frame.length < ENCRYPTED_FRAME_HEADER_BYTES + GCM_TAG_BYTES) {
+        throw new RelayCryptoError('encrypted frame too short');
+      }
+      if (frame[0] !== ENCRYPTED_FRAME_VERSION) {
+        throw new RelayCryptoError('unsupported encrypted frame version');
+      }
+      const iv = frame.slice(1, ENCRYPTED_FRAME_HEADER_BYTES);
+      const counter = readCounter(iv, IV_PREFIX_BYTES);
+      if (counter <= lastCounter) {
+        throw new RelayCryptoError('frame counter regression');
+      }
+      let plaintext;
+      try {
+        plaintext = await subtle.decrypt({ name: 'AES-GCM', iv }, key, frame.slice(ENCRYPTED_FRAME_HEADER_BYTES));
+      } catch {
+        throw new RelayCryptoError('frame decryption failed');
+      }
+      lastCounter = counter;
+      return new Uint8Array(plaintext);
+    },
+  };
+};
+
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+/** @param {Uint8Array} bytes */
+export const bytesToBase64Url = (bytes) => {
+  let out = '';
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : undefined;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : undefined;
+    out += BASE64URL_ALPHABET[b0 >> 2];
+    out += BASE64URL_ALPHABET[((b0 & 0x03) << 4) | ((b1 ?? 0) >> 4)];
+    if (b1 !== undefined) out += BASE64URL_ALPHABET[((b1 & 0x0f) << 2) | ((b2 ?? 0) >> 6)];
+    if (b2 !== undefined) out += BASE64URL_ALPHABET[b2 & 0x3f];
+  }
+  return out;
+};
+
+/** @param {string} value */
+export const base64UrlToBytes = (value) => {
+  if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1) {
+    throw new RelayCryptoError('invalid base64url input');
+  }
+  const out = new Uint8Array(Math.floor((value.length * 3) / 4));
+  let outIndex = 0;
+  let buffer = 0;
+  let bits = 0;
+  for (const char of value) {
+    buffer = (buffer << 6) | BASE64URL_ALPHABET.indexOf(char);
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[outIndex] = (buffer >> bits) & 0xff;
+      outIndex += 1;
+    }
+  }
+  return out;
+};
+
+// ---------------------------------------------------------------------------
+// Responder handshake state machine (host side). Mirror of createHostHandshake
+// in packages/ui/src/lib/relay/handshake.ts.
+//
+// Fail-closed rules (from the spec):
+// - a repeated identical `hello` re-sends `ready` (client retry race);
+// - a `hello` with a DIFFERENT key on an established channel is a rekey
+//   attack -> close 1008, never rekey in place;
+// - plaintext after `ready`, or any decrypt failure -> close 1011.
+// ---------------------------------------------------------------------------
+
+const parseHandshakeMessage = (raw) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== 'object' || parsed === null) return null;
+  if (parsed.v !== RELAY_PROTOCOL_VERSION) return null;
+  // Unknown/missing capability flag = false = legacy behavior.
+  const batch = parsed.batch === true;
+  if (parsed.t === 'ready') {
+    return { t: 'ready', v: RELAY_PROTOCOL_VERSION, batch };
+  }
+  if (parsed.t === 'hello' && typeof parsed.nonce === 'string' && typeof parsed.clientPubJwk === 'object' && parsed.clientPubJwk !== null) {
+    return { t: 'hello', v: RELAY_PROTOCOL_VERSION, clientPubJwk: parsed.clientPubJwk, nonce: parsed.nonce, batch };
+  }
+  return null;
+};
+
+const failClosed = (reason) => ({
+  type: 'fail',
+  closeCode: RelayCloseCode.ChannelFailure,
+  reason,
+});
+
+/**
+ * Host (responder) handshake. Feed every inbound text frame to `handleText`;
+ * it returns one of:
+ *   { type: 'send-text', text }                       — send this plaintext frame
+ *   { type: 'established', channel, replyText }       — send replyText first, then switch to encrypted frames
+ *   { type: 'ignore' }                                — drop the frame
+ *   { type: 'fail', closeCode, reason }               — close the socket with closeCode
+ * @param {CryptoKey} hostEncPrivateKey long-lived ECDH private key
+ * @param {{ batch?: boolean }} [options] `batch` defaults true; set false to force legacy behavior
+ */
+export const createHostHandshake = (hostEncPrivateKey, options = {}) => {
+  const localBatch = options.batch !== false;
+  let established = false;
+  let acceptedClientKeyFingerprint = null;
+  let readyText = null;
+  let negotiatedBatch = false;
+  return {
+    get established() {
+      return established;
+    },
+    /** @param {string} raw */
+    async handleText(raw) {
+      const message = parseHandshakeMessage(raw);
+      if (message?.t !== 'hello') {
+        if (established) {
+          return failClosed('plaintext frame on established channel');
+        }
+        return { type: 'ignore' };
+      }
+      const fingerprint = publicKeyJwkFingerprint(message.clientPubJwk);
+      if (acceptedClientKeyFingerprint !== null) {
+        if (fingerprint === acceptedClientKeyFingerprint && readyText !== null) {
+          // Client retried `hello` before our `ready` arrived — answer again.
+          return { type: 'send-text', text: readyText };
+        }
+        return { type: 'fail', closeCode: RelayCloseCode.RekeyMismatch, reason: 'rekey mismatch' };
+      }
+      let clientPublicKey;
+      let nonce;
+      try {
+        clientPublicKey = await importEcdhPublicKey(message.clientPubJwk);
+        nonce = base64UrlToBytes(message.nonce);
+      } catch {
+        return failClosed('malformed hello');
+      }
+      let keys;
+      try {
+        keys = await deriveSessionKeys(hostEncPrivateKey, clientPublicKey, nonce);
+      } catch {
+        return failClosed('key derivation failed');
+      }
+      acceptedClientKeyFingerprint = fingerprint;
+      // Batching runs only if both peers advertised it.
+      negotiatedBatch = localBatch && message.batch === true;
+      readyText = JSON.stringify(
+        negotiatedBatch
+          ? { t: 'ready', v: RELAY_PROTOCOL_VERSION, batch: true }
+          : { t: 'ready', v: RELAY_PROTOCOL_VERSION },
+      );
+      established = true;
+      return {
+        type: 'established',
+        batch: negotiatedBatch,
+        replyText: readyText,
+        channel: {
+          encryptor: createFrameEncryptor(keys.hostToClient),
+          decryptor: createFrameDecryptor(keys.clientToHost),
+        },
+      };
+    },
+  };
+};