device-center 0.1.0-beta.1 → 0.2.0-beta.2

package/server/drivers/access.mjs

@@ -0,0 +1,84 @@
+import { constants, openSync, closeSync, fstatSync, readFileSync, lstatSync, realpathSync, readSync, writeSync } from 'node:fs';
+import { dirname, isAbsolute, resolve, join } from 'node:path';
+import { isIP } from 'node:net';
+import { publicIdentity, object, fail } from './driverProtocol.mjs';
+import { validateCertificate } from './certificates.mjs';
+import { ensurePrivateDirectory, writeLink } from './cloudLink.mjs';
+
+export const accessFile = linkFile => join(dirname(linkFile), 'access.json');
+export const validFingerprint = fp => typeof fp === 'string' && /^[a-f0-9]{64}$/.test(fp);
+export function privateJson(file, fallback) {
+  let fd;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const s = fstatSync(fd);
+    if (!s.isFile() || s.nlink !== 1 || s.size > 65536 || (s.mode & 0o077) || (process.getuid && s.uid !== process.getuid())) fail('access_private_file_required');
+    return JSON.parse(readFileSync(fd, 'utf8'));
+  } catch(e) { if(e.code === 'ENOENT') return fallback; throw e; }
+  finally { if(fd !== undefined) closeSync(fd); }
+}
+export function readAccess(file) {
+  const value = privateJson(file, { trusts: [], grants: [], listen: null });
+  object(value, ['trusts', 'grants', 'listen']);
+  if (!Array.isArray(value.trusts) || !Array.isArray(value.grants) || value.trusts.length > 16 || value.grants.length > 16) fail('access_invalid');
+  for (const entry of [...value.trusts, ...value.grants]) {
+    if (!validFingerprint(entry.fingerprint) || !/^[a-f0-9-]{36}$/.test(entry.id)) fail('access_invalid');
+    validateCertificate(entry.certificate, entry.fingerprint, Date.now(), true);
+  }
+  return value;
+}
+export function lanEndpoint(value) {
+  object(value, ['host', 'port']);
+  const ip = isIP(value.host);
+  const parts = ip === 4 ? value.host.split('.').map(Number) : [];
+  if (!(ip === 4 && (parts[0] === 10 || parts[0] === 192 && parts[1] === 168 || parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) || ip === 6 && /^(fc|fd)/i.test(value.host)) || !Number.isInteger(value.port) || value.port < 1024 || value.port > 65535) fail('access_private_lan_endpoint_required');
+  return { host: value.host, port: value.port };
+}
+export function safeLogPath(path) {
+  if (typeof path !== 'string' || !isAbsolute(path) || path.length > 4096) fail('access_absolute_log_required');
+  const canonical = realpathSync(path);
+  checkLog(canonical); return canonical;
+}
+function checkLog(path) {
+  if (resolve(path) !== path || realpathSync(path) !== path) fail('access_log_changed');
+  for (let cursor = dirname(path); cursor !== dirname(cursor); cursor = dirname(cursor)) if(lstatSync(cursor).isSymbolicLink()) fail('access_log_changed');
+  const info = lstatSync(path);
+  if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1) fail('access_regular_log_required');
+}
+export function peerFingerprint(socket) {
+  const raw = socket.getPeerX509Certificate();
+  if (!raw || !socket.authorized) fail('access_peer_unauthorized', 403);
+  return publicIdentity(raw.publicKey.export({type:'spki',format:'pem'}).toString()).fingerprint;
+}
+export function audit(file, entry) {
+  ensurePrivateDirectory(dirname(file));
+  const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+  try {
+    const s = fstatSync(fd);
+    if (!s.isFile() || s.nlink !== 1 || s.mode & 0o077 || s.size > 1024 ** 2 || process.getuid && s.uid !== process.getuid()) fail('access_audit_unavailable');
+    writeSync(fd, JSON.stringify({ ...entry, at: Date.now() }) + '\n');
+  } finally { closeSync(fd); }
+}
+export function readGrantedLog({ file, fingerprint, request, route, now = Date.now() }) {
+  object(request, ['operation', 'label', 'bytes']);
+  if (request.operation !== 'read-log' || typeof request.label !== 'string' || !/^[a-zA-Z0-9_-]{1,40}$/.test(request.label) || !Number.isInteger(request.bytes) || request.bytes < 1 || request.bytes > 65536) fail('access_invalid_operation');
+  const grant = readAccess(file).grants.find(g => g.fingerprint === fingerprint && g.label === request.label && g.expiresAt > now);
+  if (!grant) fail('access_log_not_granted', 403);
+  const auditFile = join(dirname(file), 'access-audit.jsonl');
+  audit(auditFile, { fingerprint, label: request.label, route, outcome: 'requested' });
+  let fd;
+  try {
+    checkLog(grant.path);
+    fd = openSync(grant.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const s = fstatSync(fd), current = lstatSync(grant.path);
+    if (!s.isFile() || s.nlink !== 1 || s.ino !== current.ino || s.dev !== current.dev || realpathSync(grant.path) !== grant.path) fail('access_log_changed');
+    const data = Buffer.alloc(Math.min(request.bytes, s.size));
+    const count = readSync(fd, data, 0, data.length, Math.max(0,s.size-data.length));
+    // Revocation/expiry is checked again before releasing file contents.
+    if (!readAccess(file).grants.some(g => g.fingerprint === fingerprint && g.label === request.label && g.path === grant.path && g.expiresAt > Date.now())) fail('access_log_not_granted', 403);
+    audit(auditFile, { fingerprint, label: request.label, route, bytes: count, outcome: 'allowed' });
+    return { label: request.label, bytes: count, text: data.subarray(0,count).toString('utf8'), route, observedAt: Date.now() };
+  } catch(error) { audit(auditFile, { fingerprint, label: request.label, route, outcome: 'denied' }); throw error; }
+  finally { if(fd !== undefined) closeSync(fd); }
+}
+export const writeAccess = (file,value) => writeLink(file,value);

package/server/drivers/certificates.mjs

@@ -0,0 +1,32 @@
+import 'reflect-metadata';
+import { X509Certificate, createPrivateKey, createPublicKey, webcrypto, randomBytes } from 'node:crypto';
+import { X509CertificateGenerator, BasicConstraintsExtension, KeyUsagesExtension, KeyUsageFlags, ExtendedKeyUsageExtension, SubjectAlternativeNameExtension, cryptoProvider } from '@peculiar/x509';
+import { publicIdentity, fail } from './driverProtocol.mjs';
+
+cryptoProvider.set(webcrypto);
+export const certificateName = fingerprint => `dc-${fingerprint.slice(0,32)}.${fingerprint.slice(32)}.invalid`;
+export function validateCertificate(pem, fingerprint, now = Date.now(), allowExpired = false) {
+  if (typeof pem !== 'string' || pem.length > 4096 || (pem.match(/BEGIN CERTIFICATE/g) ?? []).length !== 1) fail('driver_certificate_invalid');
+  let certificate;
+  try { certificate = new X509Certificate(pem); } catch { fail('driver_certificate_invalid'); }
+  const identity = publicIdentity(certificate.publicKey.export({ type: 'spki', format: 'pem' }).toString());
+  if (identity.fingerprint !== fingerprint || !certificate.verify(certificate.publicKey) ||
+      Date.parse(certificate.validFrom) > now || !allowExpired && Date.parse(certificate.validTo) <= now ||
+      certificate.checkHost(certificateName(fingerprint)) !== certificateName(fingerprint)) fail('driver_certificate_invalid');
+  return certificate.toString();
+}
+export async function issueCertificate(state) {
+  const privateDer = createPrivateKey(state.privateKey).export({ type: 'pkcs8', format: 'der' });
+  const publicDer = createPublicKey(state.publicKey).export({ type: 'spki', format: 'der' });
+  const keys = {
+    privateKey: await webcrypto.subtle.importKey('pkcs8', privateDer, 'Ed25519', false, ['sign']),
+    publicKey: await webcrypto.subtle.importKey('spki', publicDer, 'Ed25519', true, ['verify']),
+  };
+  const certificate = await X509CertificateGenerator.createSelfSigned({
+    serialNumber: randomBytes(16).toString('hex'), name: `CN=${certificateName(state.fingerprint)}`,
+    notBefore: new Date(Date.now() - 60_000), notAfter: new Date(Date.now() + 365 * 86_400_000),
+    signingAlgorithm: { name: 'Ed25519' }, keys,
+    extensions: [new BasicConstraintsExtension(true, 0, true), new KeyUsagesExtension(KeyUsageFlags.digitalSignature | KeyUsageFlags.keyCertSign, true), new ExtendedKeyUsageExtension(['1.3.6.1.5.5.7.3.1','1.3.6.1.5.5.7.3.2'], true), new SubjectAlternativeNameExtension([{ type: 'dns', value: certificateName(state.fingerprint) }])],
+  });
+  return validateCertificate(certificate.toString('pem'), state.fingerprint);
+}

package/server/drivers/cloudLink.mjs

@@ -4,6 +4,7 @@ import { dirname, join } from 'node:path';
 import { createHash, createPrivateKey, createPublicKey, randomBytes } from 'node:crypto';
 import { cloudOrigin, signedRequest, publicIdentity } from './driverProtocol.mjs';
 import { observeLocalDriver } from './local.mjs';
+import { validateCertificate } from './certificates.mjs';
 
 export const defaultLinkFile = (home = homedir(), platform = process.platform) => join(platform === 'darwin' ? join(home, 'Library', 'Application Support', 'Device Center') : join(home, '.local', 'share', 'device-center'), 'driver-link.json');
 export function readLink(file) {
@@ -16,6 +17,7 @@ export function readLink(file) {
     cloudOrigin(state.origin);
     const key = createPrivateKey(state.privateKey), identity = publicIdentity(state.publicKey);
     if (key.asymmetricKeyType !== 'ed25519' || createPublicKey(key).export({ type: 'spki', format: 'pem' }).toString() !== identity.publicKey || identity.fingerprint !== state.fingerprint || typeof state.shareSsh !== 'boolean' || typeof state.disabled !== 'boolean' || (state.driverId != null && !/^[a-f0-9-]{36}$/.test(state.driverId))) throw new Error('driver_private_file_invalid');
+    if (state.certificate) validateCertificate(state.certificate, state.fingerprint, Date.now(), true);
     return state;
   } catch (error) { if (error.code === 'ENOENT') return null; throw new Error('driver_private_file_invalid'); }
   finally { if (fd !== undefined) closeSync(fd); }
@@ -33,7 +35,7 @@ export function writeLink(file, state, { create = false } = {}) {
   renameSync(temp, file);
 }
 export function linkSummary(state) {
-  return { protocol: 'device-center-driver-v1', configured: Boolean(state?.driverId && !state.disabled), origin: state?.origin ?? null, driverId: state?.driverId ?? null, fingerprint: state?.fingerprint ?? null, shareSsh: Boolean(state?.shareSsh), disabled: Boolean(state?.disabled) };
+  return { protocol: 'device-center-driver-v1', configured: Boolean(state?.driverId && !state.disabled), origin: state?.origin ?? null, driverId: state?.driverId ?? null, fingerprint: state?.fingerprint ?? null, secureTransportReady: Boolean(state?.certificate), shareSsh: Boolean(state?.shareSsh), disabled: Boolean(state?.disabled) };
 }
 export async function cloudPost(origin, path, input, fetchImpl = fetch) {
   cloudOrigin(origin);
@@ -42,7 +44,7 @@ export async function cloudPost(origin, path, input, fetchImpl = fetch) {
   const response = await fetchImpl(origin + path, { method: 'POST', headers: { 'content-type': 'application/json' }, body, redirect: 'error', signal: AbortSignal.timeout(10_000) });
   if (!/^application\/json(?:;|$)/i.test(response.headers.get('content-type') ?? '')) throw new Error('driver_cloud_unavailable');
   const chunks = []; let size = 0;
-  for await (const chunk of response.body) { size += chunk.length; if (size > 16_384) throw new Error('driver_response_too_large'); chunks.push(chunk); }
+  for await (const chunk of response.body) { size += chunk.length; if (size > 65_536) throw new Error('driver_response_too_large'); chunks.push(chunk); }
   const data = JSON.parse(Buffer.concat(chunks).toString('utf8'));
   if (!response.ok) throw Object.assign(new Error(typeof data.error === 'string' && /^[a-z_]+$/.test(data.error) ? data.error : 'driver_cloud_unavailable'), { statusCode: response.status });
   return data;
@@ -60,8 +62,9 @@ export function reportPayload({ inventory, shareSsh = false, observe = observeLo
   })) };
 }
 export function createPublisher({ file, inventory, fetchImpl = fetch, read = readLink, write = writeLink, observe = observeLocalDriver }) {
-  let stopped = true, timer, busy = false, backoff = 30_000;
+  let stopped = true, timer, controlTimer, collectionTimer, controlBusy = false, controlUnsupported = false, busy = false, backoff = 30_000;
   const status = { state: 'waiting', lastSuccess: null, error: null };
+  let pendingCollection = null;
   async function tick() {
     if (stopped || busy) return;
     clearTimeout(timer);
@@ -70,7 +73,10 @@ export function createPublisher({ file, inventory, fetchImpl = fetch, read = rea
       const state = read(file);
       if (!state?.driverId || state.disabled) { status.state = state?.disabled ? 'disabled' : 'waiting'; backoff = 30_000; return; }
       const payload = reportPayload({ inventory, shareSsh: state.shareSsh, observe });
+      const collection = pendingCollection?.expiresAt > Date.now() ? pendingCollection : null;
+      if (collection) payload.collectionRequestId = collection.id;
       await cloudPost(state.origin, '/api/driver/report', signedRequest(state.privateKey, state.origin, '/api/driver/report', state.driverId, payload), fetchImpl);
+      if (pendingCollection === collection) pendingCollection = null;
       Object.assign(status, { state: 'connected', lastSuccess: Date.now(), error: null }); backoff = 30_000;
     } catch (error) {
       Object.assign(status, { state: 'retrying', error: ['driver_revoked', 'driver_clock_skew', 'driver_scope_violation', 'driver_private_file_invalid'].includes(error.message) ? error.message : 'driver_cloud_unavailable' });
@@ -81,5 +87,41 @@ export function createPublisher({ file, inventory, fetchImpl = fetch, read = rea
       }
     } finally { busy = false; if (!stopped) timer = setTimeout(() => void tick(), backoff); }
   }
-  return { status: () => ({ ...status }), start() { if (stopped) { stopped = false; void tick(); } }, stop() { stopped = true; clearTimeout(timer); }, tick };
+  function requestCollection(expiresAt = Date.now() + 75_000) {
+    clearTimeout(collectionTimer);
+    if (stopped || Date.now() >= expiresAt) return;
+    // Respect the existing signed telemetry rate limit, including manual collection.
+    const delay = Math.max(busy ? 250 : 0, (status.lastSuccess ?? 0) + 15_050 - Date.now());
+    collectionTimer = setTimeout(() => {
+      if (stopped || Date.now() >= expiresAt) return;
+      if (busy) requestCollection(expiresAt); else void tick();
+    }, delay);
+  }
+  async function controlTick() {
+    if (stopped || controlBusy || controlUnsupported) return;
+    controlBusy = true;
+    try {
+      const state = read(file);
+      if (!state?.driverId || state.disabled) return;
+      const path = '/api/driver/control';
+      const answer = await cloudPost(state.origin, path, signedRequest(state.privateKey, state.origin, path, state.driverId, {}), fetchImpl);
+      const command = answer.request;
+      if (command != null) {
+        // This channel has exactly one operation: collect already-authorized resource fields.
+        if (!command || Object.keys(command).some(k => !['id', 'action', 'expiresAt'].includes(k)) || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(command.id) || command.action !== 'collect-resources' || !Number.isSafeInteger(command.expiresAt) || command.expiresAt > Date.now() + 90_000) throw new Error('driver_invalid_collection');
+        if (command.expiresAt <= Date.now()) return;
+        pendingCollection = command;
+        requestCollection(command.expiresAt);
+      }
+    } catch (error) {
+      // Old control planes keep receiving normal reports; this optional capability fails closed.
+      if (error.statusCode === 404) controlUnsupported = true;
+    } finally {
+      controlBusy = false;
+      if (!stopped && !controlUnsupported) controlTimer = setTimeout(() => void controlTick(), 5000);
+    }
+  }
+  return { status: () => ({ ...status }), requestCollection, controlTick,
+    start() { if (stopped) { stopped = false; void tick(); controlTimer = setTimeout(() => void controlTick(), 5000); } },
+    stop() { stopped = true; pendingCollection = null; clearTimeout(timer); clearTimeout(controlTimer); clearTimeout(collectionTimer); }, tick };
 }

package/server/drivers/cloudRegistry.mjs

@@ -1,8 +1,11 @@
 import { randomBytes, randomUUID, createHash } from 'node:crypto';
 import { fail, object, text, publicIdentity, verifyRequest, normalizeReport } from './driverProtocol.mjs';
+import { validateCertificate } from './certificates.mjs';
+import { createRelay } from './relay.mjs';
+import { createDeviceProfiles } from './deviceProfiles.mjs';
 
 const PAIR_AGE = 5 * 60_000;
-export function createCloudRegistry({ db, origin, now = Date.now }) {
+export function createCloudRegistry({ db, origin, now = Date.now, multiUser = false, legacyOwnerMapped = !multiUser }) {
   db.exec(`CREATE TABLE IF NOT EXISTS driver_pairings (
     id TEXT PRIMARY KEY, code_hash TEXT UNIQUE NOT NULL, public_key TEXT NOT NULL, fingerprint TEXT NOT NULL,
     name TEXT NOT NULL, platform TEXT NOT NULL, requested_ssh INTEGER NOT NULL, created_at INTEGER NOT NULL,
@@ -11,9 +14,26 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
     id TEXT PRIMARY KEY, public_key TEXT NOT NULL, fingerprint TEXT NOT NULL, name TEXT NOT NULL, platform TEXT NOT NULL,
     share_ssh INTEGER NOT NULL, created_at INTEGER NOT NULL, revoked_at INTEGER, last_seen INTEGER, report_json TEXT);
     CREATE TABLE IF NOT EXISTS driver_nonces (scope TEXT NOT NULL, nonce TEXT NOT NULL, expires_at INTEGER NOT NULL, PRIMARY KEY(scope, nonce));`);
-  let starts = [], lookups = [];
+  // Additive migration: historical personal rows keep their owner. Never transfer existing devices.
+  if (!db.prepare('PRAGMA table_info(cloud_drivers)').all().some(column => column.name === 'tenant_id')) {
+    db.exec("ALTER TABLE cloud_drivers ADD COLUMN tenant_id TEXT NOT NULL DEFAULT 'cloud-owner'");
+  }
+  db.exec('CREATE INDEX IF NOT EXISTS cloud_drivers_tenant_created ON cloud_drivers(tenant_id, created_at)');
+  for (const table of ['driver_pairings', 'cloud_drivers']) if (!db.prepare(`PRAGMA table_info(${table})`).all().some(c => c.name === 'certificate')) db.exec(`ALTER TABLE ${table} ADD COLUMN certificate TEXT`);
+  if (!db.prepare('PRAGMA table_info(cloud_drivers)').all().some(c => c.name === 'control_seen_at')) db.exec('ALTER TABLE cloud_drivers ADD COLUMN control_seen_at INTEGER');
+  db.exec(`CREATE TABLE IF NOT EXISTS driver_collection_requests (driver_id TEXT PRIMARY KEY, request_id TEXT NOT NULL,
+    requested_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, completed_at INTEGER)`);
+  const profiles = createDeviceProfiles({ db, now, initialize: true });
+  if (multiUser && !legacyOwnerMapped && db.prepare("SELECT 1 FROM cloud_drivers WHERE tenant_id='cloud-owner' LIMIT 1").get()) throw new Error('cloud_legacy_owner_mapping_required');
+  let starts = [], globalLookups = [], globalApprovals = [];
+  const lookups = new Map(), approvals = new Map();
   const polls = new Map();
   const limited = (times, max) => { const recent = times.filter(at => at > now() - 60_000); if (recent.length >= max) fail('driver_rate_limited', 429); recent.push(now()); return recent; };
+  function limitAccount(map, tenantId) {
+    for (const [id, times] of map) if (!times.some(at => at > now() - 60_000)) map.delete(id);
+    if (!map.has(tenantId) && map.size >= 256) fail('driver_rate_limited', 429);
+    map.set(tenantId, limited(map.get(tenantId) ?? [], 8));
+  }
   const hashCode = (code) => {
     if (typeof code !== 'string' || !/^[A-F0-9]{4}-[A-F0-9]{4}$/.test(code)) fail('invalid_pairing_code');
     return publicCodeHash(code);
@@ -39,12 +59,26 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
     if (row.revoked_at != null) fail('driver_revoked', 403);
     return row;
   }
-  const descriptor = row => ({ id: row.id, name: row.name, platform: row.platform, fingerprint: row.fingerprint, shareSsh: Boolean(row.share_ssh), createdAt: row.created_at, revokedAt: row.revoked_at, lastSeen: row.last_seen });
-  return {
+  const descriptor = row => {
+    const profile = profiles.get(row.tenant_id, `${row.id}:host`);
+    return { id: row.id, name: profile.displayName || row.name, reportedName: row.name, profile, platform: row.platform, fingerprint: row.fingerprint, shareSsh: Boolean(row.share_ssh), createdAt: row.created_at, revokedAt: row.revoked_at, lastSeen: row.last_seen };
+  };
+  const collection = row => {
+    const request = db.prepare('SELECT * FROM driver_collection_requests WHERE driver_id=?').get(row.id);
+    const connected = row.last_seen != null && now() - row.last_seen <= 90_000;
+    const supported = connected && row.control_seen_at != null && now() - row.control_seen_at <= 30_000;
+    return { supported, reason: !connected ? 'driver_not_connected' : row.control_seen_at == null ? 'driver_upgrade_required' : !supported ? 'driver_control_unavailable' : null,
+      status: !request ? 'idle' : request.completed_at != null ? 'completed' : request.expires_at <= now() ? 'timeout' : 'pending',
+      requestedAt: request?.requested_at ?? null, completedAt: request?.completed_at ?? null, expiresAt: request?.expires_at ?? null };
+  };
+  const peers = row => db.prepare('SELECT * FROM cloud_drivers WHERE tenant_id=? AND revoked_at IS NULL AND certificate IS NOT NULL').all(row.tenant_id).map(peer => ({ ...descriptor(peer), certificate: peer.certificate }));
+  const relay = createRelay({ db, now, getDriver: id => db.prepare('SELECT * FROM cloud_drivers WHERE id=?').get(id) });
+  const registry = {
     start(input) {
       starts = limited(starts, 8);
-      object(input, ['publicKey', 'name', 'platform', 'shareSsh']);
+      object(input, ['publicKey', 'name', 'platform', 'shareSsh', 'certificate']);
       const identity = publicIdentity(input.publicKey);
+      const certificate = input.certificate == null ? null : validateCertificate(input.certificate, identity.fingerprint, now());
       const name = text(input.name), platform = text(input.platform, 64);
       if (typeof input.shareSsh !== 'boolean') fail('invalid_driver_scope');
       // Only protocol-expired pending requests are removed; registered devices and reports are retained.
@@ -52,7 +86,7 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
       for (const [id, at] of polls) if (at <= now() - PAIR_AGE) polls.delete(id);
       if (db.prepare('SELECT count(*) AS n FROM driver_pairings').get().n >= 32) fail('driver_pairing_busy', 429);
       const id = randomUUID(), raw = randomBytes(4).toString('hex').toUpperCase(), code = `${raw.slice(0,4)}-${raw.slice(4)}`;
-      db.prepare('INSERT INTO driver_pairings VALUES (?,?,?,?,?,?,?,?,?,NULL)').run(id, hashCode(code), identity.publicKey, identity.fingerprint, name, platform, Number(input.shareSsh), now(), now() + PAIR_AGE);
+      db.prepare('INSERT INTO driver_pairings (id,code_hash,public_key,fingerprint,name,platform,requested_ssh,created_at,expires_at,certificate) VALUES (?,?,?,?,?,?,?,?,?,?)').run(id, hashCode(code), identity.publicKey, identity.fingerprint, name, platform, Number(input.shareSsh), now(), now() + PAIR_AGE, certificate);
       return { id, code, fingerprint: identity.fingerprint, expiresAt: now() + PAIR_AGE, verificationUrl: origin, pollIntervalMs: 5000 };
     },
     poll(input) {
@@ -66,23 +100,31 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
       if (registered.revoked_at != null) fail('driver_revoked', 403);
       return { state: 'approved', driverId: registered.id, shareSsh: Boolean(registered.share_ssh) };
     },
-    lookup(input) {
-      lookups = limited(lookups, 8); object(input, ['code']);
+    lookup(input, tenantId) {
+      globalLookups = limited(globalLookups, 64);
+      limitAccount(lookups, tenantId); object(input, ['code']);
       const row = db.prepare('SELECT * FROM driver_pairings WHERE code_hash=?').get(hashCode(input.code));
       if (!row || row.expires_at <= now() || row.driver_id) fail('driver_pairing_unavailable', 404);
       return { id: row.id, name: row.name, platform: row.platform, fingerprint: row.fingerprint, requestedSsh: Boolean(row.requested_ssh), expiresAt: row.expires_at };
     },
-    approve(input) {
-      object(input, ['id', 'shareSsh']);
+    approve(input, tenantId) {
+      globalApprovals = limited(globalApprovals, 64); limitAccount(approvals, tenantId);
+      object(input, ['id', 'code', 'fingerprint', 'shareSsh']);
       if (typeof input.id !== 'string' || typeof input.shareSsh !== 'boolean') fail('invalid_driver_approval');
+      if (multiUser && (typeof input.code !== 'string' || typeof input.fingerprint !== 'string')) fail('driver_pairing_confirmation_required');
       db.exec('BEGIN IMMEDIATE');
       try {
         const row = pairing(input.id);
-        if (row.driver_id) fail('driver_pairing_consumed', 409);
+        if (row.driver_id) {
+          if (!db.prepare('SELECT id FROM cloud_drivers WHERE id=? AND tenant_id=?').get(row.driver_id, tenantId)) fail('driver_pairing_unavailable', 404);
+          fail('driver_pairing_consumed', 409);
+        }
+        if (input.code !== undefined && hashCode(input.code) !== row.code_hash) fail('driver_pairing_unavailable', 404);
+        if (input.fingerprint !== undefined && input.fingerprint !== row.fingerprint) fail('driver_pairing_confirmation_required');
         if (input.shareSsh && !row.requested_ssh) fail('driver_scope_violation');
-        if (db.prepare('SELECT count(*) AS n FROM cloud_drivers WHERE revoked_at IS NULL').get().n >= 16) fail('driver_limit', 409);
+        if (db.prepare('SELECT count(*) AS n FROM cloud_drivers WHERE tenant_id=? AND revoked_at IS NULL').get(tenantId).n >= 16) fail('driver_limit', 409);
         const id = randomUUID();
-        db.prepare('INSERT INTO cloud_drivers VALUES (?,?,?,?,?,?,?,NULL,NULL,NULL)').run(id, row.public_key, row.fingerprint, row.name, row.platform, Number(input.shareSsh), now());
+        db.prepare('INSERT INTO cloud_drivers (id,public_key,fingerprint,name,platform,share_ssh,created_at,tenant_id,certificate) VALUES (?,?,?,?,?,?,?,?,?)').run(id, row.public_key, row.fingerprint, row.name, row.platform, Number(input.shareSsh), now(), tenantId, row.certificate);
         db.prepare('UPDATE driver_pairings SET driver_id=? WHERE id=? AND driver_id IS NULL').run(id, row.id);
         db.exec('COMMIT'); return { ok: true, driverId: id };
       } catch (error) { db.exec('ROLLBACK'); throw error; }
@@ -92,6 +134,7 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
       const report = normalizeReport(input.payload, Boolean(row.share_ssh), now());
       if (row.last_seen != null && now() - row.last_seen < 15_000) fail('driver_report_too_frequent', 429);
       db.prepare('UPDATE cloud_drivers SET last_seen=?, report_json=? WHERE id=?').run(now(), JSON.stringify(report), row.id);
+      if (report.collectionRequestId && report.resources[0].observedAt != null) db.prepare('UPDATE driver_collection_requests SET completed_at=? WHERE driver_id=? AND request_id=? AND completed_at IS NULL AND expires_at>?').run(now(), row.id, report.collectionRequestId, now());
       return { ok: true, receivedAt: now() };
     },
     disconnect(input) {
@@ -99,25 +142,69 @@ export function createCloudRegistry({ db, origin, now = Date.now }) {
       db.prepare('UPDATE cloud_drivers SET revoked_at=? WHERE id=?').run(now(), row.id);
       return { ok: true };
     },
-    revoke(input) {
+    revoke(input, tenantId) {
       object(input, ['id']); if (typeof input.id !== 'string') fail('invalid_driver_id');
-      const row = db.prepare('SELECT id FROM cloud_drivers WHERE id=?').get(input.id);
+      const row = db.prepare('SELECT id FROM cloud_drivers WHERE id=? AND tenant_id=?').get(input.id, tenantId);
       if (!row) fail('driver_unknown', 404);
-      db.prepare('UPDATE cloud_drivers SET revoked_at=COALESCE(revoked_at,?) WHERE id=?').run(now(), input.id);
+      db.prepare('UPDATE cloud_drivers SET revoked_at=COALESCE(revoked_at,?) WHERE id=? AND tenant_id=?').run(now(), input.id, tenantId);
       return { ok: true };
     },
-    bindings: () => db.prepare('SELECT * FROM cloud_drivers ORDER BY created_at').all().map(descriptor),
-    devices() {
-      return db.prepare('SELECT * FROM cloud_drivers WHERE revoked_at IS NULL ORDER BY created_at').all().flatMap(row => {
+    bindings: tenantId => db.prepare('SELECT * FROM cloud_drivers WHERE tenant_id=? ORDER BY created_at').all(tenantId).map(descriptor),
+    saveProfile(input, tenantId) {
+      if (!registry.devices(tenantId).some(d => d.id === input?.deviceId)) fail('device_not_found', 404);
+      return { profile: profiles.save(tenantId, input) };
+    },
+    collect(input, tenantId) {
+      object(input, ['deviceId']);
+      if (typeof input.deviceId !== 'string') fail('invalid_device_id');
+      const device = registry.devices(tenantId).find(d => d.id === input.deviceId);
+      if (!device) fail('device_not_found', 404);
+      if (device.kind !== 'management') fail('collection_requires_local_ssh_check', 409);
+      const row = db.prepare('SELECT * FROM cloud_drivers WHERE id=? AND tenant_id=? AND revoked_at IS NULL').get(device.managementDriver.id, tenantId);
+      const current = collection(row);
+      if (!current.supported) fail(current.reason, 409);
+      if (current.status === 'pending') return { status: 'pending', collection: current };
+      if (current.requestedAt != null && now() - current.requestedAt < 10_000) fail('collection_rate_limited', 429);
+      db.prepare('INSERT INTO driver_collection_requests VALUES (?,?,?,?,NULL) ON CONFLICT(driver_id) DO UPDATE SET request_id=excluded.request_id,requested_at=excluded.requested_at,expires_at=excluded.expires_at,completed_at=NULL').run(row.id, randomUUID(), now(), now() + 75_000);
+      return { status: 'pending', collection: collection(row) };
+    },
+    devices(tenantId) {
+      return db.prepare('SELECT * FROM cloud_drivers WHERE tenant_id=? AND revoked_at IS NULL ORDER BY created_at').all(tenantId).flatMap(row => {
         const report = row.report_json ? JSON.parse(row.report_json).resources : [{ id: 'host', name: row.name, platform: row.platform, kind: 'management', observedAt: null, memory: { status: 'unobserved', usedMb: null, totalMb: null }, disk: { status: 'unobserved', usedGb: null, totalGb: null } }];
         return report.map(resource => {
           const latest = resource.observedAt == null || row.last_seen == null ? null : Math.min(resource.observedAt, row.last_seen);
           const age = latest == null ? null : Math.max(0, now() - latest);
           const connected = row.last_seen != null && now() - row.last_seen <= 90_000;
-          return { ...resource, id: `${row.id}:${resource.id}`, role: resource.kind === 'management' ? 'driver' : 'resource', source: 'driver-report', transport: 'driver', scope: 'host', state: age == null ? 'unknown' : !connected || age > (resource.kind === 'management' ? 90_000 : 300_000) ? 'expired' : 'online', lastHeartbeat: latest, heartbeatAgeMs: age, memory: resource.memory, disk: resource.disk, synthetic: false, managementDriver: { ...descriptor(row), origin, connected }, capabilities: { observation: true, remoteExecution: false } };
+          return profiles.apply(tenantId, { ...resource, id: `${row.id}:${resource.id}`, role: resource.kind === 'management' ? 'driver' : 'resource', source: 'driver-report', transport: 'driver', scope: 'host', state: age == null ? 'unknown' : !connected || age > (resource.kind === 'management' ? 90_000 : 300_000) ? 'expired' : 'online', lastHeartbeat: latest, heartbeatAgeMs: age, memory: resource.memory, disk: resource.disk, synthetic: false, managementDriver: { ...descriptor(row), origin, connected }, collection: resource.kind === 'management' ? collection(row) : { supported: false, reason: 'collection_requires_local_ssh_check', status: 'idle' }, capabilities: { observation: true, remoteExecution: false } });
         });
       });
     },
   };
+  return {
+    start: registry.start, poll: registry.poll, report: registry.report, disconnect: registry.disconnect,
+    machine(action, input) {
+      const row = driver(input, `/api/driver/${action}`);
+      if (action === 'control') {
+        object(input.payload, []);
+        if (row.control_seen_at != null && now() - row.control_seen_at < 3000) fail('driver_control_too_frequent', 429);
+        db.prepare('UPDATE cloud_drivers SET control_seen_at=? WHERE id=?').run(now(), row.id);
+        const request = db.prepare('SELECT * FROM driver_collection_requests WHERE driver_id=? AND completed_at IS NULL AND expires_at>?').get(row.id, now());
+        return { request: request ? { id: request.request_id, action: 'collect-resources', expiresAt: request.expires_at } : null };
+      }
+      if (action === 'certificate') { object(input.payload, ['certificate']); const cert = validateCertificate(input.payload.certificate, row.fingerprint, now()); db.prepare('UPDATE cloud_drivers SET certificate=? WHERE id=?').run(cert, row.id); return { ok: true }; }
+      if (action === 'peers') { object(input.payload, []); return { peers: peers(row) }; }
+      if (!row.certificate) fail('driver_certificate_required', 409);
+      return relay.handle(action, row, input.payload);
+    },
+    // Only server-verified principals reach this scope; no default global inventory API.
+    forTenant(tenantId) {
+      if (typeof tenantId !== 'string' || !/^(cloud-owner|account-[a-f0-9]{64})$/.test(tenantId)) fail('driver_account_required', 403);
+      return {
+        lookup: input => registry.lookup(input, tenantId), approve: input => registry.approve(input, tenantId),
+        revoke: input => registry.revoke(input, tenantId), bindings: () => registry.bindings(tenantId), devices: () => registry.devices(tenantId), relayUsage: () => relay.usage(tenantId),
+        saveProfile: input => registry.saveProfile(input, tenantId), collect: input => registry.collect(input, tenantId),
+      };
+    },
+  };
 }
 const publicCodeHash = code => createHash('sha256').update(code).digest('hex');

package/server/drivers/deviceProfiles.mjs

@@ -0,0 +1,47 @@
+// Descriptive owner metadata. It never changes device identity or grants access.
+export const DEVICE_TYPES = ['unspecified', 'personal', 'server', 'workstation', 'other'];
+const fail = (message, statusCode = 400) => { throw Object.assign(new Error(message), { statusCode }); };
+function string(value, max, multiline = false) {
+  if (typeof value !== 'string' || value.length > max || (multiline ? /[\x00-\x09\x0b-\x1f\x7f]/ : /[\x00-\x1f\x7f]/).test(value)) fail('invalid_device_profile');
+  return value.trim();
+}
+export function normalizeDeviceProfile(value) {
+  if (!value || Array.isArray(value) || Object.keys(value).some(k => !['displayName', 'type', 'purpose', 'tags', 'services'].includes(k)) || !DEVICE_TYPES.includes(value.type)) fail('invalid_device_profile');
+  const list = (items, max, length) => {
+    if (!Array.isArray(items) || items.length > max) fail('invalid_device_profile');
+    const result = items.map(v => string(v, length));
+    if (result.some(v => !v)) fail('invalid_device_profile');
+    return [...new Set(result)];
+  };
+  return { displayName: string(value.displayName, 80), type: value.type, purpose: string(value.purpose, 240, true), tags: list(value.tags, 8, 24), services: list(value.services, 12, 40) };
+}
+const EMPTY = { displayName: '', type: 'unspecified', purpose: '', tags: [], services: [], revision: 0, updatedAt: null, servicesSource: 'user-declared' };
+export function createDeviceProfiles({ db, now = Date.now, initialize = false }) {
+  const ensure = () => db.exec(`CREATE TABLE IF NOT EXISTS device_profiles (
+    tenant_id TEXT NOT NULL, device_id TEXT NOT NULL, profile_json TEXT NOT NULL,
+    revision INTEGER NOT NULL, updated_at INTEGER NOT NULL, PRIMARY KEY(tenant_id, device_id))`);
+  if (initialize) ensure();
+  const get = (tenantId, id) => {
+    if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='device_profiles'").get()) return { ...EMPTY, tags: [], services: [] };
+    const row = db.prepare('SELECT * FROM device_profiles WHERE tenant_id=? AND device_id=?').get(tenantId, id);
+    return row ? { ...normalizeDeviceProfile(JSON.parse(row.profile_json)), revision: row.revision, updatedAt: row.updated_at, servicesSource: 'user-declared' } : { ...EMPTY, tags: [], services: [] };
+  };
+  return {
+    get,
+    apply(tenantId, device) {
+      const profile = get(tenantId, device.id);
+      return { ...device, reportedName: device.reportedName ?? device.name, name: profile.displayName || device.name, profile };
+    },
+    save(tenantId, input) {
+      if (!input || Array.isArray(input) || Object.keys(input).some(k => !['deviceId', 'profile', 'revision'].includes(k)) || typeof input.deviceId !== 'string' || !input.deviceId || input.deviceId.length > 200 || !Number.isSafeInteger(input.revision) || input.revision < 0) fail('invalid_device_profile');
+      const profile = normalizeDeviceProfile(input.profile); ensure();
+      db.exec('BEGIN IMMEDIATE');
+      try {
+        if (get(tenantId, input.deviceId).revision !== input.revision) fail('device_profile_conflict', 409);
+        db.prepare('INSERT INTO device_profiles VALUES (?,?,?,?,?) ON CONFLICT(tenant_id,device_id) DO UPDATE SET profile_json=excluded.profile_json,revision=excluded.revision,updated_at=excluded.updated_at').run(tenantId, input.deviceId, JSON.stringify(profile), input.revision + 1, now());
+        db.exec('COMMIT');
+        return get(tenantId, input.deviceId);
+      } catch (error) { db.exec('ROLLBACK'); throw error; }
+    },
+  };
+}

package/server/drivers/driverProtocol.mjs

@@ -50,7 +50,8 @@ function metric(input, kind) {
   return { status: input.status, [used]: input.status === 'ok' ? input[used] : null, [total]: input.status === 'ok' ? input[total] : null };
 }
 export function normalizeReport(payload, shareSsh, now) {
-  object(payload, ['resources']);
+  object(payload, ['resources', 'collectionRequestId']);
+  if (payload.collectionRequestId !== undefined && (typeof payload.collectionRequestId !== 'string' || !/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(payload.collectionRequestId))) fail('invalid_collection_request');
   if (!Array.isArray(payload.resources) || !payload.resources.length || payload.resources.length > 16) fail('invalid_driver_resources');
   const ids = new Set();
   const resources = payload.resources.map((value, index) => {
@@ -62,5 +63,5 @@ export function normalizeReport(payload, shareSsh, now) {
     if (observedAt !== null && (!Number.isSafeInteger(observedAt) || observedAt < 0 || observedAt > now + 90_000)) fail('invalid_driver_observation_time');
     return { id: value.id, name: text(value.name), platform: text(value.platform, 64), kind: value.kind, observedAt: observedAt == null ? null : Math.min(observedAt, now), memory: metric(value.memory, 'memory'), disk: metric(value.disk, 'disk') };
   });
-  return { resources };
+  return { resources, ...(payload.collectionRequestId ? { collectionRequestId: payload.collectionRequestId } : {}) };
 }

package/server/drivers/inventory.mjs

@@ -4,12 +4,14 @@ import { discoverSsh } from './sshConfig.mjs';
 import { prepareSshProfile, probeSsh } from './sshProbe.mjs';
 import { normalizeConnectionPlan, readConnectionPlan, writeConnectionPlan } from './connectionPlans.mjs';
 import { inspectSshImport } from './sshInitialization.mjs';
+import { createDeviceProfiles } from './deviceProfiles.mjs';
 
 function associations(db, tenantId) {
   if (!db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='ssh_associations'").get()) return [];
   return db.prepare('SELECT alias, created_at AS createdAt FROM ssh_associations WHERE tenant_id = ? ORDER BY alias COLLATE NOCASE').all(tenantId);
 }
 export function createInventory({ db, tenantId, runtime = 'native', sshHome, sshProbe = probeSsh }) {
+  const profiles = createDeviceProfiles({ db });
   const activeChecks = new Set();
   const pendingChecks = new Set();
   const exclusions = () => db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='ssh_exclusions'").get()
@@ -48,7 +50,7 @@ export function createInventory({ db, tenantId, runtime = 'native', sshHome, ssh
         capabilities: { observation: Boolean(profile), remoteExecution: false },
       };
     });
-    return [observeLocalDriver({ runtime }), ...remote, ...listDevices(db, tenantId)];
+    return [observeLocalDriver({ runtime }), ...remote, ...listDevices(db, tenantId)].map(device => profiles.apply(tenantId, device));
   };
   const check = async (input) => {
     if (!input || Array.isArray(input) || Object.keys(input).some((key) => key !== 'alias') || typeof input.alias !== 'string') throw Object.assign(new Error('invalid_ssh_check'), { statusCode: 400 });
@@ -149,5 +151,22 @@ export function createInventory({ db, tenantId, runtime = 'native', sshHome, ssh
       return { removed, excluded: chosen.length, systemConfigurationChanged: false };
     } catch (cause) { db.exec('ROLLBACK'); throw cause; }
   };
-  return { list, discovery, associate, check, checkBatch, remove, associateAndCheck: (input) => configure(input, false), initializeAndCheck: (input) => configure(input, true), saveConnections, initialization, initialize };
+  const find = input => {
+    if (!input || Array.isArray(input) || typeof input.deviceId !== 'string') throw Object.assign(new Error('invalid_device_id'), { statusCode: 400 });
+    const device = list().find(d => d.id === input.deviceId);
+    if (!device) throw Object.assign(new Error('device_not_found'), { statusCode: 404 });
+    return device;
+  };
+  const saveProfile = input => { find(input); return { profile: profiles.save(tenantId, input) }; };
+  const collect = async input => {
+    if (Object.keys(input ?? {}).some(k => k !== 'deviceId')) throw Object.assign(new Error('invalid_collection_request'), { statusCode: 400 });
+    const device = find(input);
+    if (device.transport === 'ssh') {
+      const result = await check({ alias: device.ssh.alias });
+      if (!result.ok) return { status: 'failed', error: result.error, device: list().find(d => d.id === device.id) };
+    }
+    else if (device.source !== 'local-runtime' || runtime !== 'native') throw Object.assign(new Error('collection_unavailable'), { statusCode: 409 });
+    return { status: 'completed', device: list().find(d => d.id === device.id) };
+  };
+  return { list, discovery, associate, check, checkBatch, remove, saveProfile, collect, associateAndCheck: (input) => configure(input, false), initializeAndCheck: (input) => configure(input, true), saveConnections, initialization, initialize };
 }

package/server/drivers/relay.mjs

@@ -0,0 +1,59 @@
+import { randomUUID } from 'node:crypto';
+import { fail, object } from './driverProtocol.mjs';
+
+// Opaque TLS records only. Membership, revocation and persisted quotas are checked on every exchange.
+export function createRelay({ db, getDriver, now = Date.now, accountLimit = 100 * 1024 ** 2, globalLimit = 1024 ** 3 }) {
+  db.exec('CREATE TABLE IF NOT EXISTS relay_usage (day TEXT NOT NULL, tenant TEXT NOT NULL, bytes INTEGER NOT NULL, PRIMARY KEY(day,tenant))');
+  const channels = new Map(), lastAccept = new Map();
+  const day = () => new Date(now()).toISOString().slice(0,10);
+  function usage(tenant) {
+    const used = db.prepare('SELECT bytes FROM relay_usage WHERE day=? AND tenant=?').get(day(), tenant)?.bytes ?? 0;
+    return { day: day(), bytes: used, limitBytes: accountLimit, bytesPerSecond: 16_384, maxSessionSeconds: 60, active: [...channels.values()].filter(c => c.tenant === tenant).length };
+  }
+  function charge(tenant, bytes) {
+    if (usage(tenant).bytes + bytes > accountLimit || (db.prepare('SELECT sum(bytes) AS n FROM relay_usage WHERE day=?').get(day()).n ?? 0) + bytes > globalLimit) fail('relay_quota_exceeded', 429);
+    db.prepare('INSERT INTO relay_usage VALUES (?,?,?) ON CONFLICT(day,tenant) DO UPDATE SET bytes=bytes+excluded.bytes').run(day(), tenant, bytes);
+  }
+  function sweep() {
+    for (const [id,c] of channels) if (c.expires <= now() || [c.a,c.b].some(id => { const d = getDriver(id); return !d || d.revoked_at != null || d.tenant_id !== c.tenant; })) channels.delete(id);
+    for (const [id,at] of lastAccept) if (at < now()-60_000) lastAccept.delete(id);
+  }
+  function channel(row, id) {
+    const c = channels.get(id);
+    if (!c || c.tenant !== row.tenant_id || ![c.a,c.b].includes(row.id)) fail('relay_unavailable', 404);
+    return c;
+  }
+  return { usage, handle(action, row, payload) {
+    sweep();
+    if (action === 'relay/open') {
+      object(payload, ['targetId']);
+      const target = typeof payload.targetId === 'string' ? getDriver(payload.targetId) : null;
+      if (!target || target.id === row.id || target.tenant_id !== row.tenant_id || target.revoked_at != null || !target.certificate) fail('relay_peer_unavailable', 404);
+      if (usage(row.tenant_id).bytes >= accountLimit) fail('relay_quota_exceeded', 429);
+      if (channels.size >= 8 || [...channels.values()].filter(c => c.tenant === row.tenant_id).length >= 2 || [...channels.values()].some(c => [c.a,c.b].includes(row.id))) fail('relay_busy', 429);
+      const id = randomUUID(); channels.set(id, { a: row.id, b: target.id, tenant: row.tenant_id, expires: now()+60_000, accepted: false, qa: [], qb: [], last: {} });
+      return { channelId: id, expiresAt: now()+60_000 };
+    }
+    if (action === 'relay/accept') {
+      object(payload, []);
+      if (now()-(lastAccept.get(row.id) ?? -Infinity) < 2000) fail('relay_rate_limited', 429);
+      lastAccept.set(row.id, now());
+      const entry = [...channels].find(([,c]) => c.b === row.id && !c.accepted);
+      if (!entry) return { incoming: null };
+      const [id,c] = entry; c.accepted = true;
+      const peer = getDriver(c.a);
+      return { incoming: { channelId: id, fingerprint: peer.fingerprint, certificate: peer.certificate } };
+    }
+    if (action === 'relay/close') { object(payload, ['channelId']); channel(row, payload.channelId); channels.delete(payload.channelId); return { ok: true }; }
+    if (action !== 'relay/exchange') fail('not_found', 404);
+    object(payload, ['channelId', 'frames']);
+    const c = channel(row, payload.channelId);
+    if (now()-(c.last[row.id] ?? -Infinity) < 500) fail('relay_rate_limited', 429);
+    if (!Array.isArray(payload.frames) || payload.frames.length > 2 || payload.frames.some(f => typeof f !== 'string' || f.length > 5464 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(f) || Buffer.from(f,'base64').length > 4096)) fail('relay_invalid_frames');
+    const into = row.id === c.a ? c.qb : c.qa, out = row.id === c.a ? c.qa : c.qb;
+    if (into.length + payload.frames.length > 32) fail('relay_backpressure', 429);
+    charge(c.tenant, payload.frames.reduce((n,f) => n+Buffer.from(f,'base64').length, 0));
+    c.last[row.id] = now(); into.push(...payload.frames);
+    return { frames: out.splice(0,2), expiresAt: c.expires };
+  } };
+}