@roamcode.ai/server 1.2.0 → 1.4.0

package/dist/container/relay.js

@@ -109,6 +109,18 @@ function hashMatches(expected, credential) {
     return false;
   }
 }
+function storedCredentialMatches(expectedHash, expectedLookup, credential) {
+  try {
+    const actual = credentialMaterial(credential);
+    const expectedHashBytes = Buffer.from(safeHash(expectedHash));
+    const actualHashBytes = Buffer.from(actual.credentialHash);
+    const expectedLookupBytes = Buffer.from(safeLookup(expectedLookup));
+    const actualLookupBytes = Buffer.from(actual.credentialLookup);
+    return expectedHashBytes.length === actualHashBytes.length && expectedLookupBytes.length === actualLookupBytes.length && timingSafeEqual(expectedHashBytes, actualHashBytes) && timingSafeEqual(expectedLookupBytes, actualLookupBytes);
+  } catch {
+    return false;
+  }
+}
 function safePlan(value) {
   if (value !== "free" && value !== "team" && value !== "enterprise") throw new Error("invalid relay account plan");
   return value;
@@ -127,7 +139,17 @@ function safeStatus(value) {
   return value;
 }
 function clone(record) {
-  return { ...record };
+  return {
+    id: record.id,
+    label: record.label,
+    status: record.status,
+    plan: record.plan,
+    maxRoutes: record.maxRoutes,
+    maxDevicesPerRoute: record.maxDevicesPerRoute,
+    revision: record.revision,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
 }
 function createMemoryStore(options) {
   const accounts = /* @__PURE__ */ new Map();
@@ -147,7 +169,7 @@ function createMemoryStore(options) {
   return {
     mode: "memory",
     createAccount(input, now = Date.now()) {
-      const id = safeId(generateAccountId());
+      const id = safeId(input.id ?? generateAccountId());
       if (accounts.has(id)) throw new Error("relay account already exists");
       const plan = safePlan(input.plan ?? "free");
       const { credentialHash, credentialLookup } = credentialMaterial(input);
@@ -187,6 +209,14 @@ function createMemoryStore(options) {
       const record = verifyCredential(credential);
       return record?.status === "active" ? record : void 0;
     },
+    credentialMatches(id, credential) {
+      try {
+        const record = accounts.get(safeId(id));
+        return !!record && storedCredentialMatches(record.credentialHash, record.credentialLookup, credential);
+      } catch {
+        return false;
+      }
+    },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const current = accounts.get(safeId(id));
       if (!current) return void 0;
@@ -244,6 +274,17 @@ function createMemoryStore(options) {
     }
   };
 }
+function normalizeSqliteAccountConstraint(error) {
+  const code = error?.code;
+  const message = error instanceof Error ? error.message : "";
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.credential_lookup")) {
+    throw new Error("relay account credential already exists");
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.id")) {
+    throw new Error("relay account already exists");
+  }
+  throw error;
+}
 function fromRow(row) {
   return {
     id: row.id,
@@ -300,7 +341,7 @@ function openRelayAccountStore(options) {
     return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
   };
   const createAccount = db.transaction((input, now) => {
-    const id = safeId(generateAccountId());
+    const id = safeId(input.id ?? generateAccountId());
     if (rowById(id)) throw new Error("relay account already exists");
     const plan = safePlan(input.plan ?? "free");
     const { credentialHash, credentialLookup } = credentialMaterial(input);
@@ -316,24 +357,28 @@ function openRelayAccountStore(options) {
       createdAt: now,
       updatedAt: now
     };
-    db.prepare(
-      `INSERT INTO relay_accounts
-       (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
-        credential_lookup, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(
-      record.id,
-      record.label,
-      record.status,
-      record.plan,
-      record.maxRoutes,
-      record.maxDevicesPerRoute,
-      record.revision,
-      credentialHash,
-      credentialLookup,
-      record.createdAt,
-      record.updatedAt
-    );
+    try {
+      db.prepare(
+        `INSERT INTO relay_accounts
+         (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
+          credential_lookup, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        record.id,
+        record.label,
+        record.status,
+        record.plan,
+        record.maxRoutes,
+        record.maxDevicesPerRoute,
+        record.revision,
+        credentialHash,
+        credentialLookup,
+        record.createdAt,
+        record.updatedAt
+      );
+    } catch (error) {
+      normalizeSqliteAccountConstraint(error);
+    }
     return record;
   });
   return {
@@ -355,9 +400,17 @@ function openRelayAccountStore(options) {
       const record = verifyCredential(credential);
       return record?.status === "active" ? record : void 0;
     },
+    credentialMatches(id, credential) {
+      try {
+        const row = rowById(safeId(id));
+        return !!row && storedCredentialMatches(row.credential_hash, row.credential_lookup, credential);
+      } catch {
+        return false;
+      }
+    },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
-      const safeAccountId = safeId(id);
-      const currentRow = rowById(safeAccountId);
+      const safeAccountId2 = safeId(id);
+      const currentRow = rowById(safeAccountId2);
       if (!currentRow) return void 0;
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
@@ -399,30 +452,35 @@ function openRelayAccountStore(options) {
         expectedRevision
       );
       if (result.changes !== 1) {
-        const latest = rowById(safeAccountId);
+        const latest = rowById(safeAccountId2);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
         return void 0;
       }
       return next;
     },
     rotateCredential(id, credential, expectedRevision, now = Date.now()) {
-      const safeAccountId = safeId(id);
-      const currentRow = rowById(safeAccountId);
+      const safeAccountId2 = safeId(id);
+      const currentRow = rowById(safeAccountId2);
       if (!currentRow) return void 0;
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
       const { credentialHash, credentialLookup } = credentialMaterial(credential);
-      const result = db.prepare(
-        `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
-           updated_at = ? WHERE id = ? AND revision = ?`
-      ).run(credentialHash, credentialLookup, now, safeAccountId, expectedRevision);
+      let result;
+      try {
+        result = db.prepare(
+          `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
+             updated_at = ? WHERE id = ? AND revision = ?`
+        ).run(credentialHash, credentialLookup, now, safeAccountId2, expectedRevision);
+      } catch (error) {
+        normalizeSqliteAccountConstraint(error);
+      }
       if (result.changes !== 1) {
-        const latest = rowById(safeAccountId);
+        const latest = rowById(safeAccountId2);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
         return void 0;
       }
-      return fromRow(rowById(safeAccountId));
+      return fromRow(rowById(safeAccountId2));
     },
     close: () => db.close()
   };
@@ -915,6 +973,59 @@ function safeRevision(value) {
   if (!Number.isSafeInteger(value) || value < 1) throw new Error("invalid relay account revision");
   return value;
 }
+function safeAccountId(value) {
+  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
+    throw new Error("invalid relay account id");
+  }
+  return value;
+}
+function safeAccountLabel(value) {
+  if (typeof value !== "string") throw new Error("relay account label is required");
+  const label = value.trim().replace(/\s+/g, " ");
+  if (!label || label.length > 120 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay account label");
+  return label;
+}
+function safeAccountPlan(value) {
+  if (value !== "free" && value !== "team" && value !== "enterprise") {
+    throw new Error("invalid relay account plan");
+  }
+  return value;
+}
+function safeAccountLimit(value, maximum) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new Error("invalid relay account limit");
+  }
+  return value;
+}
+function strictInternalBody(value, allowedFields) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid internal request body");
+  const body = value;
+  if (Object.keys(body).some((field) => !allowedFields.includes(field))) {
+    throw new Error("unknown internal request field");
+  }
+  return body;
+}
+function safeCredentialLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay credential lookup");
+  }
+  return value;
+}
+function safeAccountCredentialMaterial(body) {
+  if (!body || body.credential !== void 0 || body.accountCredential !== void 0) {
+    throw new Error("client-hashed account credential material is required");
+  }
+  return {
+    credentialHash: safeCredentialHash2(body.credentialHash),
+    credentialLookup: safeCredentialLookup(body.credentialLookup)
+  };
+}
+function safeRouteCredentialHash(body, field = "credentialHash") {
+  if (!body || body.credential !== void 0 || body.hostCredential !== void 0) {
+    throw new Error("client-hashed route credential material is required");
+  }
+  return safeCredentialHash2(body[field]);
+}
 function bearer(request) {
   const value = request.headers.authorization;
   if (!value || Array.isArray(value)) return;
@@ -1227,21 +1338,89 @@ function createBlindRelayServer(options) {
       reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device route" });
     }
   });
+  app.post("/v1/routes/:routeId/devices/:deviceId/promote", { preHandler: requireHost }, async (request, reply) => {
+    try {
+      const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+      const routeId = safeId3(request.params.routeId, "route id");
+      const deviceId = safeId3(request.params.deviceId, "device id");
+      const expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+      const credentialHash = safeCredentialHash2(body.credentialHash);
+      if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
+      const current = store.getDevice(routeId, deviceId, now());
+      if (!current) {
+        reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
+        return;
+      }
+      if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
+        reply.code(200).send({
+          device: {
+            routeId: current.routeId,
+            deviceId: current.deviceId,
+            createdAt: current.createdAt,
+            updatedAt: current.updatedAt,
+            expiresAt: null
+          }
+        });
+        return;
+      }
+      if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+          error: "relay device credential conflict"
+        });
+        return;
+      }
+      const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
+      reply.code(200).send({
+        device: {
+          routeId: device.routeId,
+          deviceId: device.deviceId,
+          createdAt: device.createdAt,
+          updatedAt: device.updatedAt,
+          expiresAt: null
+        }
+      });
+    } catch {
+      reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
+    }
+  });
   app.delete(
     "/v1/routes/:routeId/devices/:deviceId",
     { preHandler: requireHost },
     async (request, reply) => {
-      let removed = false;
+      let routeId;
+      let deviceId;
+      let expectedCredentialHash;
       try {
-        removed = store.revokeDevice(request.params.routeId, request.params.deviceId);
+        routeId = safeId3(request.params.routeId, "route id");
+        deviceId = safeId3(request.params.deviceId, "device id");
+        if (request.body !== void 0) {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+        }
       } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+        return;
       }
-      if (!removed) {
+      const current = store.getDevice(routeId, deviceId, now());
+      if (!current) {
+        if (expectedCredentialHash) {
+          reply.code(204).send();
+          return;
+        }
         reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
         return;
       }
-      deviceRates.delete(deviceRateKey(request.params.routeId, request.params.deviceId));
-      const live = hosts.get(request.params.routeId)?.devices.get(request.params.deviceId);
+      if (expectedCredentialHash && !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+          error: "relay device credential conflict"
+        });
+        return;
+      }
+      store.revokeDevice(routeId, deviceId);
+      deviceRates.delete(deviceRateKey(routeId, deviceId));
+      const live = hosts.get(routeId)?.devices.get(deviceId);
       live?.socket.close(4403, "device revoked");
       reply.code(204).send();
     }
@@ -1307,6 +1486,541 @@ function createBlindRelayServer(options) {
       const route = store.getRoute(routeId);
       return route?.ownerAccountId === accountId ? route : void 0;
     };
+    const internalRouteEnvelope = (accountId, routeId) => {
+      const route = ownedRoute(accountId, routeId);
+      if (!route) return;
+      return {
+        accountId,
+        route: publicRoute({ ...route, deviceCount: store.countDevices(route.id, now()) }),
+        status: {
+          hostOnline: hosts.has(route.id),
+          activeDevices: hosts.get(route.id)?.devices.size ?? 0
+        },
+        connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
+      };
+    };
+    const internalDeviceEnvelope = (accountId, device) => ({
+      accountId,
+      device: {
+        routeId: device.routeId,
+        deviceId: device.deviceId,
+        createdAt: device.createdAt,
+        updatedAt: device.updatedAt,
+        expiresAt: device.expiresAt ?? null
+      }
+    });
+    const closeAndDeleteRoute = (routeId, reason) => {
+      const route = store.getRoute(routeId);
+      if (!route) return false;
+      const host = hosts.get(routeId);
+      if (host) closeHost(host, 4403, reason);
+      const deleted = store.deleteRoute(routeId);
+      if (deleted) clearRouteRates(routeId);
+      return deleted;
+    };
+    const accountRevisionConflict = (reply, account) => reply.code(409).send({
+      code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+      error: "relay account revision conflict",
+      current: accountEnvelope(account)
+    });
+    app.put(
+      "/internal/v1/accounts/:accountId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let input;
+        try {
+          const body = strictInternalBody(request.body, [
+            "label",
+            "plan",
+            "maxRoutes",
+            "maxDevicesPerRoute",
+            "credentialHash",
+            "credentialLookup"
+          ]);
+          accountId = safeAccountId(request.params.accountId);
+          input = {
+            id: accountId,
+            label: safeAccountLabel(body.label),
+            plan: safeAccountPlan(body.plan),
+            maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
+            maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5),
+            ...safeAccountCredentialMaterial(body)
+          };
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+          return;
+        }
+        const existing = accountStore.getAccount(accountId);
+        if (existing) {
+          const matches = existing.status !== "deleted" && existing.label === input.label && existing.plan === input.plan && existing.maxRoutes === input.maxRoutes && existing.maxDevicesPerRoute === input.maxDevicesPerRoute && accountStore.credentialMatches(accountId, input);
+          if (!matches) {
+            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
+            return;
+          }
+          reply.code(200).send(accountEnvelope(existing));
+          return;
+        }
+        try {
+          const account = accountStore.createAccount(input);
+          reply.code(201).send(accountEnvelope(account));
+        } catch (error) {
+          if (error.message === "relay account already exists" || error.message === "relay account credential already exists") {
+            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
+            return;
+          }
+          throw error;
+        }
+      }
+    );
+    app.get(
+      "/internal/v1/accounts/:accountId/status",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let account;
+        try {
+          account = accountStore.getAccount(safeAccountId(request.params.accountId));
+        } catch {
+        }
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      }
+    );
+    app.put("/internal/v1/accounts/:accountId/metadata", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      let update;
+      try {
+        const body = strictInternalBody(request.body, [
+          "expectedRevision",
+          "label",
+          "plan",
+          "maxRoutes",
+          "maxDevicesPerRoute"
+        ]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+        update = {
+          label: safeAccountLabel(body.label),
+          plan: safeAccountPlan(body.plan),
+          maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
+          maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5)
+        };
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      const matches = current.label === update.label && current.plan === update.plan && current.maxRoutes === update.maxRoutes && current.maxDevicesPerRoute === update.maxDevicesPerRoute;
+      if (matches && (current.revision === expectedRevision || current.revision === expectedRevision + 1)) {
+        reply.code(200).send(accountEnvelope(current));
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.updateAccount(accountId, update, expectedRevision);
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        throw error;
+      }
+    });
+    app.put("/internal/v1/accounts/:accountId/credential", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      let credential;
+      try {
+        const body = strictInternalBody(request.body, ["expectedRevision", "credentialHash", "credentialLookup"]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+        credential = safeAccountCredentialMaterial(body);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      if (accountStore.credentialMatches(accountId, credential)) {
+        if (current.revision === expectedRevision || current.revision === expectedRevision + 1) {
+          reply.code(200).send(accountEnvelope(current));
+          return;
+        }
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.rotateCredential(accountId, credential, expectedRevision);
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        if (error.message === "relay account credential already exists") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_CREDENTIAL_CONFLICT", error: "relay credential conflict" });
+          return;
+        }
+        throw error;
+      }
+    });
+    app.delete("/internal/v1/accounts/:accountId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      try {
+        const body = strictInternalBody(request.body, ["expectedRevision"]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(204).send();
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.updateAccount(accountId, { status: "deleted" }, expectedRevision);
+        if (account) purgeAccountRoutes(account.id);
+        reply.code(204).send();
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        throw error;
+      }
+    });
+    app.put("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let routeId;
+      let label;
+      let credentialHash;
+      try {
+        const body = strictInternalBody(request.body, ["label", "credentialHash"]);
+        accountId = safeAccountId(request.params.accountId);
+        routeId = safeId3(request.params.routeId, "route id");
+        label = safeLabel3(body.label);
+        credentialHash = safeRouteCredentialHash(body);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+        return;
+      }
+      const account = accountStore.getAccount(accountId);
+      if (!account || account.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      if (account.status !== "active") {
+        reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+        return;
+      }
+      const existing = store.getRoute(routeId);
+      if (existing) {
+        if (existing.ownerAccountId !== accountId || existing.label !== label || !tokenMatches(existing.hostCredentialHash, credentialHash)) {
+          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
+          return;
+        }
+        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+        return;
+      }
+      if (store.listRoutesByOwner(accountId, now()).length >= account.maxRoutes) {
+        reply.code(429).send({ code: "RELAY_ROUTE_LIMIT", error: "relay route limit reached" });
+        return;
+      }
+      try {
+        store.createRoute({ id: routeId, label, hostCredentialHash: credentialHash, ownerAccountId: accountId });
+        reply.code(201).send(internalRouteEnvelope(accountId, routeId));
+      } catch (error) {
+        if (error.message === "relay route already exists") {
+          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
+          return;
+        }
+        throw error;
+      }
+    });
+    app.get(
+      "/internal/v1/accounts/:accountId/routes/:routeId/status",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let route;
+        try {
+          route = internalRouteEnvelope(
+            safeAccountId(request.params.accountId),
+            safeId3(request.params.routeId, "route id")
+          );
+        } catch {
+        }
+        if (!route) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        reply.code(200).send(route);
+      }
+    );
+    app.put(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let credentialHash;
+        let expiresAt;
+        try {
+          const body = strictInternalBody(request.body, ["credentialHash", "expiresAt"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          credentialHash = safeCredentialHash2(body.credentialHash);
+          const parsedExpiry = safeExpiry2(body.expiresAt, now());
+          if (parsedExpiry === void 0) throw new Error("temporary relay device expiry is required");
+          expiresAt = parsedExpiry;
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (account.status !== "active") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (current) {
+          if (tokenMatches(current.credentialHash, credentialHash) && current.expiresAt === expiresAt) {
+            reply.code(200).send(internalDeviceEnvelope(accountId, current));
+            return;
+          }
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        if (store.countDevices(routeId, now()) >= account.maxDevicesPerRoute) {
+          reply.code(429).send({ code: "RELAY_DEVICE_LIMIT", error: "relay device limit reached" });
+          return;
+        }
+        const device = store.putDevice({ routeId, deviceId, credentialHash, expiresAt }, now());
+        reply.code(201).send(internalDeviceEnvelope(accountId, device));
+      }
+    );
+    app.post(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId/promote",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let expectedCredentialHash;
+        let credentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+          credentialHash = safeCredentialHash2(body.credentialHash);
+          if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (account.status !== "active") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (!current) {
+          reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
+          return;
+        }
+        if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
+          reply.code(200).send(internalDeviceEnvelope(accountId, current));
+          return;
+        }
+        if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
+        reply.code(200).send(internalDeviceEnvelope(accountId, device));
+      }
+    );
+    app.delete(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let expectedCredentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(204).send();
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (!current) {
+          reply.code(204).send();
+          return;
+        }
+        if (!tokenMatches(current.credentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        store.revokeDevice(routeId, deviceId);
+        deviceRates.delete(deviceRateKey(routeId, deviceId));
+        const live = hosts.get(routeId)?.devices.get(deviceId);
+        live?.socket.close(4403, "device revoked");
+        reply.code(204).send();
+      }
+    );
+    app.put(
+      "/internal/v1/accounts/:accountId/routes/:routeId/credential",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let expectedCredentialHash;
+        let credentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
+          credentialHash = safeRouteCredentialHash(body);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_CREDENTIAL", error: "invalid relay credential hash" });
+          return;
+        }
+        const route = ownedRoute(accountId, routeId);
+        if (!route) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        if (tokenMatches(route.hostCredentialHash, credentialHash)) {
+          reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+          return;
+        }
+        if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
+            error: "relay route credential conflict",
+            current: internalRouteEnvelope(accountId, routeId)
+          });
+          return;
+        }
+        if (!store.rotateHostCredential(routeId, credentialHash, now())) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const host = hosts.get(routeId);
+        if (host) closeHost(host, 4409, "host credential rotated");
+        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+      }
+    );
+    app.delete("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let routeId;
+      let expectedCredentialHash;
+      try {
+        const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+        accountId = safeAccountId(request.params.accountId);
+        routeId = safeId3(request.params.routeId, "route id");
+        expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+        return;
+      }
+      const route = ownedRoute(accountId, routeId);
+      if (!route) {
+        reply.code(204).send();
+        return;
+      }
+      if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
+          error: "relay route credential conflict",
+          current: internalRouteEnvelope(accountId, routeId)
+        });
+        return;
+      }
+      closeAndDeleteRoute(routeId, "route deleted");
+      reply.code(204).send();
+    });
     app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
       accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
     }));