trantor 0.18.113 → 0.18.115

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.113",
+  "version": "0.18.115",
   "description": "Trantor — the hub-world for AI agent crews: live message bus, presence, project Kanban/flow board + crew orchestration for independent AI coding agents (Claude, Codex, Gemini, Kimi, DeepSeek)",
   "mcpServers": {
     "relay": {

package/bin/crew/stage.mjs

@@ -4,6 +4,14 @@ import { loadOrCreate } from "../../lib/identity.mjs";
 import { ensureEnrolled } from "../../lib/enroll.mjs";
 import { sfetchJson } from "../../lib/signed-fetch.mjs";
 
+export async function unregisterSwapStage(hub, project, session) {
+  const identity = loadOrCreate(session, "agent");
+  const response = await sfetchJson(`${hub}/unregister`, {
+    identity, payload: { session, project }, signal: AbortSignal.timeout(8000),
+  });
+  if (!response.ok) throw new Error(`replacement deregistration failed: ${response.status}`);
+}
+
 // A replacement registers before it touches the old runner's worktree or queue.
 export async function awaitSwapRelease(env = process.env) {
   if (!env.CREW_SWAP_STAGE) return;
@@ -25,4 +33,5 @@ export async function awaitSwapRelease(env = process.env) {
   }
   const handoff = JSON.parse(readFileSync(`${stage}.release`, "utf8"));
   if (handoff.agent !== env.CREW_SWAP_AGENT) throw new Error("swap release names a different seat");
+  await unregisterSwapStage(env.RELAY_URL, env.RELAY_PROJECT, session);
 }

package/bin/crew/swap.mjs

@@ -1,3 +1,4 @@
+import { unregisterSwapStage } from "./stage.mjs";
 import { updatePersona } from "../../lib/persona.mjs";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -85,7 +86,7 @@ async function hubRequest(ctx, path, body) {
   return response.json;
 }
 
-export function swapRuntime(ctx, adapters, spawn) {
+export function swapRuntime(ctx, adapters, spawn, { now = Date.now, pause = setTimeout, requestTimeoutMs = 8000 } = {}) {
   let pids = [];
   let replacementPid;
   return {
@@ -97,14 +98,23 @@ export function swapRuntime(ctx, adapters, spawn) {
       spawn(staged, { ...seat, persona: stage.label });
     },
     async ready(stage) {
-      const deadline = Date.now() + 30000;
+      const deadline = now() + 30000;
       while (!existsSync(`${stage.path}.ready`)) {
-        if (Date.now() > deadline) throw new Error("replacement did not join the bus within 30s; old seat unchanged");
-        await setTimeout(100);
+        if (now() > deadline) throw new Error("replacement did not join the bus within 30s; old seat unchanged");
+        await pause(100);
       }
       const ready = JSON.parse(readFileSync(`${stage.path}.ready`, "utf8"));
-      const response = await signedGet(`${ctx.hub}/peers?project=${encodeURIComponent(ctx.project)}`, { project: ctx.project });
-      if (!response.ok || !response.json?.peers?.some(p => p.session === ready.session)) throw new Error("replacement registration is not visible on the bus");
+      let failure = "status=0 reason=readiness deadline elapsed timedOut=false";
+      let visible = false;
+      while (now() < deadline) {
+        const response = await signedGet(`${ctx.hub}/peers?project=${encodeURIComponent(ctx.project)}`, {
+          project: ctx.project, timeoutMs: Math.min(requestTimeoutMs, deadline - now()),
+        });
+        if (response.ok && response.json?.peers?.some(p => p.session === ready.session)) { visible = true; break; }
+        failure = `status=${response.status} reason=${response.reason || response.json?.error || "replacement absent from roster"} timedOut=${response.timedOut === true}`;
+        await pause(Math.min(100, Math.max(0, deadline - now())));
+      }
+      if (!visible) throw new Error(`replacement registration is not visible on the bus: ${failure}`);
       process.kill(ready.pid, 0);
       replacementPid = ready.pid;
       return ready.session;
@@ -117,7 +127,10 @@ export function swapRuntime(ctx, adapters, spawn) {
       await down(ctx, [agent], adapters);
       signalProcesses(pids, "SIGKILL");
     },
-    async cancel(stage) { await down(ctx, [stage.label], adapters); },
+    async cancel(stage) {
+      await down(ctx, [stage.label], adapters);
+      await unregisterSwapStage(ctx.hub, ctx.project, `${stage.label}:${ctx.project}`);
+    },
     release(stage, persona, cursor) {
       writeRows(ctx, readRows(ctx).map(row => row.project === ctx.project && row.persona === stage.label ? { ...row, persona } : row));
       writeFileSync(runnerRecord(ctx, ctx.project, persona), JSON.stringify({ label: stage.label, dir: ctx.dir }));
@@ -154,7 +167,10 @@ export async function performSwap(ctx, options, runtime) {
   } catch (error) {
     if (!transferred) {
       if (frozen) await runtime.resume();
-      if (stage) await runtime.cancel(stage);
+      if (stage) {
+        try { await runtime.cancel(stage); }
+        catch (cleanupError) { error.message += `; replacement cleanup failed: ${cleanupError.message}`; }
+      }
     }
     result.reason = error.message;
     if (transferred) result.reason += "; handoff recorded on hub; old seat held for recovery";

package/bin/pair.mjs

@@ -9,10 +9,11 @@ import { spawnSync } from "node:child_process";
 
 const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
 const args = process.argv.slice(2);
-const USAGE = "usage: trantor pair [--role owner] [--sim] [--json]";
+const USAGE = "usage: trantor pair [--role owner] [--sim] [--tailnet] [--json]";
 if (args.includes("--help") || args.includes("-h")) { console.log(USAGE); process.exit(0); }
 const asJson = args.includes("--json");
 const openSim = args.includes("--sim");
+const forceTailnet = args.includes("--tailnet");
 const roleIdx = args.indexOf("--role");
 const role = roleIdx >= 0 ? (args[roleIdx + 1] || "") : "approver";
 if (!role || role.startsWith("--")) {
@@ -63,14 +64,30 @@ if (!r.ok) {
   process.exit(1);
 }
 
-const link = `trantor://enroll?hub=${encodeURIComponent(hub)}&token=${j.token}`;
+// v1.4: the link carries the hub's public address (Tailscale Funnel) so the phone pairs without
+// Tailscale. /invite itself always goes to the tailnet hub — owner routes never answer in public.
+// /health reports publicUrl; --tailnet forces the tailnet address. No publicUrl (or /health
+// unreachable — the invite already minted) falls back to the tailnet hub.
+const linkHub = (async () => {
+  if (forceTailnet) return { hub, public: false };
+  try {
+    const h = await fetch(`${hub}/health`).then((r) => r.json()).catch(() => ({}));
+    const pub = String(h.publicUrl || "").trim().replace(/\/+$/, "");
+    if (pub) return { hub: pub, public: true };
+  } catch {}
+  return { hub, public: false };
+})();
+
+const used = await linkHub;
+const link = `trantor://enroll?hub=${encodeURIComponent(used.hub)}&token=${j.token}`;
 const expiresAt = Number(j.expiresAt) || Date.now() + 600000;
 const mins = Math.max(0, Math.round((expiresAt - Date.now()) / 60000));
 
 if (asJson) {
-  console.log(JSON.stringify({ link, token: j.token, hub, expiresAt }));
+  console.log(JSON.stringify({ link, token: j.token, hub: used.hub, hubPublic: used.public, expiresAt }));
 } else {
-  console.log(`Pair link (single use):\n${link}\nExpires in ${mins} minute${mins === 1 ? "" : "s"}.`);
+  const where = used.public ? "public — the phone needs no Tailscale" : "tailnet — the phone needs Tailscale";
+  console.log(`Pair link (single use):\n${link}\nHub in the link: ${used.hub} (${where}).\nExpires in ${mins} minute${mins === 1 ? "" : "s"}.`);
 }
 
 if (openSim) {

package/hub/auth.mjs

@@ -5,7 +5,7 @@ import { timingSafeEqual, randomBytes } from "node:crypto";
 import { publicView } from "../lib/identity.mjs";
 import { IDENTITY_KINDS } from "../lib/store-contract.mjs";
 
-export function createAuthRuntime({ state, markDirty, AUTH_MODE, SUPERSEDE_GRACE_MS, LOOPBACK_BIND, ENROLL_MODE }) {
+export function createAuthRuntime({ state, markDirty, AUTH_MODE, SUPERSEDE_GRACE_MS, LOOPBACK_BIND, ENROLL_MODE, seenNonces = new Map() }) {
 const now = () => Date.now();
 function rawBody(req) {
   if (req._rawBody !== undefined) return Promise.resolve(req._rawBody);
@@ -287,13 +287,13 @@ function inboxReadable(auth, msg, session) {
 function canUseInboxSession(auth, session) {
   return !auth?.identity || String(auth.identity.name || "") === String(session || "");
 }
-const seenNonces = new Map();
 
-  function handleEnrollment({ req, res, P, u, b0 }) {
+  function handleEnrollment({ req, res, P, u, b0, inviteOnly = false }) {
     if (req.method !== "POST" || P !== "/enroll") return false;
     const raw = req._rawBody || "";
     const verified = verifyRequest({ headers: req.headers, method: req.method, path: authPath(u), body: raw });
     if (!verified.ok) return json(res, 401, { error: verified.reason || "bad signature" });
+    if (inviteOnly && !b0?.token) return json(res, 403, { error: "invite token required" });
     const requestedKind = String(b0.kind || "agent").slice(0, 40);
     if (!IDENTITY_KINDS.includes(requestedKind)) {
       return json(res, 400, { error: `kind must be one of: ${IDENTITY_KINDS.join(", ")}`, allowedKinds: IDENTITY_KINDS });
@@ -305,9 +305,9 @@ const seenNonces = new Map();
     const token = String(b0.token || "");
     const bootstrap = String(process.env.RELAY_BOOTSTRAP_TOKEN || "");
     const noIdentitiesYet = Object.keys(state.identities || {}).length === 0;
-    const tokenMatchesBootstrap = !!bootstrap && !!token && token.length === bootstrap.length &&
+    const tokenMatchesBootstrap = !inviteOnly && !!bootstrap && !!token && token.length === bootstrap.length &&
       timingSafeEqual(Buffer.from(token), Buffer.from(bootstrap));
-    if (bootstrap && noIdentitiesYet && tokenMatchesBootstrap) {
+    if (!inviteOnly && bootstrap && noIdentitiesYet && tokenMatchesBootstrap) {
       scopes = [cleanScope({ project: "*", role: "owner" })].filter(Boolean);
       enrolledBy = "bootstrap";
     } else if (token) {

package/hub/public.mjs

@@ -0,0 +1,108 @@
+import { isIP } from "node:net";
+
+const ALLOWED = new Set([
+  ...["/health", "/projects", "/catchup", "/tasks", "/card", "/events", "/stream",
+    "/inbox", "/poll", "/recent", "/peers", "/holds", "/verify-gates", "/proposals",
+    "/balances", "/economics", "/session/chat", "/session/prompt", "/crew/roster", "/_op"]
+    .map(path => `GET ${path}`),
+  ...["/enroll", "/task/update", "/task/checklist-toggle", "/send", "/delivered",
+    "/verify-gate", "/hold/decide", "/proposal/decide", "/session/prompt", "/session/answer",
+    "/crew/command", "/device/register", "/device/unregister"].map(path => `POST ${path}`),
+]);
+const WINDOW_MS = 60000;
+const MAX_CLIENTS = 10000;
+
+function normalizedIP(address) {
+  if (!isIP(address) || address.includes("%")) return "";
+  if (isIP(address) === 4) return address;
+  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+  if (!canonical.startsWith("::ffff:")) return canonical;
+  const words = canonical.slice(7).split(":").map(word => parseInt(word, 16));
+  return [words[0] >> 8, words[0] & 255, words[1] >> 8, words[1] & 255].join(".");
+}
+
+export function publicClientIP(req) {
+  const socket = normalizedIP(req.socket.remoteAddress || "") || "unknown";
+  const loopback = socket === "::1" || socket.startsWith("127.");
+  if (!loopback) return socket;
+  // The proxy (tailscale serve/funnel) APPENDS the address it saw, so only the last entry is
+  // trustworthy; the first is whatever the caller sent and would let anyone dodge the limits.
+  const forwarded = String(req.headers["x-forwarded-for"] || "").split(",").pop().trim();
+  return normalizedIP(forwarded) || socket;
+}
+
+export function createPublicGate({ now = Date.now, log = line => process.stderr.write(`${line}\n`) } = {}) {
+  const clients = new Map();
+  const admissions = new WeakMap();
+  const refusals = new Map();
+  function count(kind) { refusals.set(kind, (refusals.get(kind) || 0) + 1); }
+  function prune() {
+    const cutoff = now() - WINDOW_MS;
+    for (const [ip, bucket] of clients) {
+      if (!bucket.streams && bucket.lastSeen <= cutoff) clients.delete(ip);
+    }
+  }
+  function report() {
+    prune();
+    for (const [kind, total] of refusals) log(`[trantor] public refusal ${kind}: count=${total}`);
+    refusals.clear();
+  }
+  const timer = setInterval(report, WINDOW_MS);
+  timer.unref();
+
+  function refuse(res, code, kind, retry = 0) {
+    count(kind);
+    const headers = { "content-type": "application/json" };
+    if (retry) headers["retry-after"] = String(retry);
+    res.writeHead(code, headers);
+    res.end(JSON.stringify({ error: code === 404 ? "not found" : "rate limit exceeded" }));
+    return false;
+  }
+
+  function admit(req, res, path) {
+    const ts = now();
+    const ip = publicClientIP(req);
+    let bucket = clients.get(ip);
+    if (!bucket) {
+      if (clients.size >= MAX_CLIENTS) prune();
+      // Fail closed at capacity; evicting a live bucket would reset its limit.
+      if (clients.size >= MAX_CLIENTS) return refuse(res, 429, "capacity", 60);
+      bucket = { start: ts, lastSeen: ts, requests: 0, enrolls: 0, streams: 0 };
+      clients.set(ip, bucket);
+    }
+    bucket.lastSeen = ts;
+    if (ts - bucket.start >= WINDOW_MS) {
+      bucket.start = ts;
+      bucket.requests = 0;
+      bucket.enrolls = 0;
+    }
+    const retry = Math.max(1, Math.ceil((bucket.start + WINDOW_MS - ts) / 1000));
+    if (bucket.requests >= 120) return refuse(res, 429, "general-limit", retry);
+    bucket.requests++;
+    if (!ALLOWED.has(`${req.method} ${path}`)) return refuse(res, 404, "route");
+    if (path === "/enroll") {
+      if (bucket.enrolls >= 10) return refuse(res, 429, "enroll-limit", retry);
+      bucket.enrolls++;
+    }
+    admissions.set(req, bucket);
+    res.once("finish", () => {
+      if (res.statusCode === 401) {
+        // The first unit was charged at admission; a failed signature costs one more.
+        if (bucket.start + WINDOW_MS > now()) bucket.requests++;
+        count("auth");
+      } else if (res.statusCode === 403) count(path === "/enroll" ? "enrollment" : "authorization");
+    });
+    return true;
+  }
+
+  function openStream(req, res) {
+    if (res.destroyed) return false;
+    const bucket = admissions.get(req);
+    if (bucket.streams >= 5) return refuse(res, 429, "stream-limit", 60);
+    bucket.streams++;
+    res.once("close", () => { bucket.streams--; bucket.lastSeen = now(); });
+    return true;
+  }
+
+  return { admit, openStream, close: () => clearInterval(timer) };
+}

package/hub/routes/admin.mjs

@@ -36,6 +36,18 @@ export async function routeAdmin({ req, res, q, P, auth, ctx }) {
       }
       return json(res, 200, keyUsageSnapshot(state, now(), ONLINE_MS));
     }
+    if (req.method === "POST" && P === "/unregister") {
+      const b = await body(req);
+      if (!b.session || !b.project) return json(res, 400, { error: "session and project required" });
+      if (AUTH_MODE !== "off" && (auth?.identity?.name !== b.session || !scopeAllows(auth.identity, b.project, "write"))) {
+        return json(res, 403, { error: "only the session owner can unregister its peer" });
+      }
+      const peer = state.peers[b.session];
+      if (peer && peer.project !== canon(b.project)) return json(res, 403, { error: "peer belongs to a different project" });
+      delete state.peers[b.session];
+      markDirty();
+      return json(res, 200, { ok: true });
+    }
     if (req.method === "POST" && P === "/register") {
       const b = await body(req);
       const cpg = crossProjectGuard(auth, P, b);

package/hub/routes/messages.mjs

@@ -9,7 +9,7 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
     appendEvent, appendCardEvent, appendTaskLog, markDelivered, contractsFor, canUseInboxSession, inboxWindow,
     deliverable, inboxReadable, inboxResponse, filterReadable, canRead, streams, UI,
     AUTH_MODE, persistHealth, duty, now, markDirty, assertNoSecrets, PEER_TTL_MS,
-    CONTRACT_WINDOW_MS,
+    CONTRACT_WINDOW_MS, PUBLIC_URL,
   } = ctx;
     if (req.method === "POST" && P === "/send") {
       const b = await body(req);
@@ -168,6 +168,8 @@ export async function routeMessages({ req, res, q, P, auth, ctx }) {
     // #8723: the count is a listing in aggregate — memory rows (past PEER_TTL_MS) never count.
     if (P === "/health") return json(res, 200, { ok: true, authMode: AUTH_MODE, peers: Object.values(state.peers).filter(v => (v.lastSeen || 0) >= now() - PEER_TTL_MS).length, messages: state.messages.length, streams: streams.length,
       persist: persistHealth.view(),
+      // v1.4: the public front door, empty when RELAY_PUBLIC_URL is unset — pairing hands it out.
+      publicUrl: PUBLIC_URL,
       // #5686: duty liveness rides /health so the app's Home strip and doctor read one truth.
       duty: { ...duty.dutyLiveness(), darkSinceMs: duty.darkSince ? now() - duty.darkSince : 0, queuedEscalations: duty.dutyQueuedEscalations() } });
     return false;

package/hub.mjs

@@ -7,6 +7,7 @@ import { assertNoSecrets } from "./lib/scrub.mjs";
 import { DEFAULT_ORG } from "./lib/store-contract.mjs";
 import { createStoreRuntime } from "./hub/store.mjs";
 import { createAuthRuntime } from "./hub/auth.mjs";
+import { createPublicGate } from "./hub/public.mjs";
 import { createEventRuntime } from "./hub/events.mjs";
 import { createReaper } from "./hub/reaper.mjs";
 import { createDuty } from "./hub/duty.mjs";
@@ -31,6 +32,9 @@ const PG_URL = process.env.RELAY_DATABASE_URL || process.env.POSTGRES_URL ||
 const STORE_KIND = RAW_STORE_KIND || (PG_URL ? "pg" : "json");
 const ORG_ID = process.env.RELAY_ORG_ID || DEFAULT_ORG;
 const AUTH_MODE = ["off", "warn", "enforce"].includes(process.env.RELAY_AUTH) ? process.env.RELAY_AUTH : "enforce";
+// The public front door (Tailscale Funnel, v1.4) — /health reports it so clients learn the
+// address the phone can reach without Tailscale. Empty when the hub has none.
+const PUBLIC_URL = String(process.env.RELAY_PUBLIC_URL || "").trim().replace(/\/+$/, "");
 const ENROLL_MODE = process.env.RELAY_ENROLL || "tofu";
 const ONLINE_MS = Number(process.env.RELAY_ONLINE_MS || 5 * 60 * 1000);
 const PEER_TTL_DEFAULT_MS = 21600000;
@@ -62,9 +66,10 @@ if (!LOOPBACK_BIND && AUTH_MODE !== "enforce") {
 }
 
 const store = await createStoreRuntime({ STORE_KIND, PG_URL, ORG_ID, DATA });
+const seenNonces = new Map();
 const authRuntime = createAuthRuntime({
   state: store.state, markDirty: store.markDirty, AUTH_MODE, SUPERSEDE_GRACE_MS,
-  LOOPBACK_BIND, ENROLL_MODE,
+  LOOPBACK_BIND, ENROLL_MODE, seenNonces,
 });
 const notifier = createNotifier({ state: store.state, markDirty: store.markDirty, canRead: authRuntime.canRead });
 const events = createEventRuntime({ state: store.state, markDirty: store.markDirty, AUTH_MODE, ONLINE_MS, canon: authRuntime.canon, notifier });
@@ -124,7 +129,7 @@ try { UI = readFileSync(new URL("./ui.html", import.meta.url), "utf8"); } catch
 const context = {
   ...store, ...authRuntime, ...events, ...reaper, duty, overseer, derivePhases,
   hubSend: duty.hubSend, assertNoSecrets, UI, AUTH_MODE, ONLINE_MS, PEER_TTL_MS,
-  REAP_GRACE_MS, CONTRACT_WINDOW_MS,
+  REAP_GRACE_MS, CONTRACT_WINDOW_MS, PUBLIC_URL,
 };
 const sessionChat = createSessionRuntime({
   state: store.state, markDirty: store.markDirty,
@@ -132,33 +137,50 @@ const sessionChat = createSessionRuntime({
 });
 const routes = [routeDevices, routeAdmin, routeCards, routeInsights, routeMessages, sessionChat.route];
 
-const server = http.createServer(async (req, res) => {
-  const u = new URL(req.url, "http://x");
-  const q = Object.fromEntries(u.searchParams);
-  const P = u.pathname;
-  try {
-    const b0 = req.method === "POST" ? await authRuntime.body(req) : {};
-    if (authRuntime.handleEnrollment({ req, res, P, u, b0 })) return;
-    const auth = authRuntime.PUBLIC_ENDPOINTS.has(P)
-      ? { ok: true, mode: AUTH_MODE, trusted: false }
-      : await authRuntime.authenticate(req, authRuntime.authPath(u));
-    if (authRuntime.handleInvite({ req, res, P, auth, b0 })) return;
-    if (!auth.ok) return authRuntime.json(res, auth.code || 401, { error: auth.error || "unauthorized" });
-    const authorization = authRuntime.authorize(auth, req.method, P, authRuntime.projectFromRequest(P, q, b0));
-    if (!authorization.ok) return authRuntime.json(res, authorization.code || 403, { error: authorization.error || "forbidden" });
-    if (req.method === "GET" && P === "/_op") {
-      const o = opOutcomes.get(String(q.id || "").slice(0, 80));
-      return authRuntime.json(res, 200, o ? { status: o.status, code: o.code, body: o.body } : { status: "unknown" });
-    }
-    const op = req.method === "POST" ? opIdOf(b0) : null;
-    const seen = op ? opOutcomes.get(op) : null;
-    if (seen) return authRuntime.json(res, seen.code, seen.body);
-    if (op) recordOpOutcome(res, op);
-    for (const route of routes) if (await route({ req, res, q, P, auth, ctx: context })) return;
-    authRuntime.json(res, 404, { error: "not found" });
-  } catch (error) {
-    authRuntime.json(res, 500, { error: String(error?.message || error) });
-  }
+const publicAuth = createAuthRuntime({
+  state: store.state, markDirty: store.markDirty, AUTH_MODE: "enforce", SUPERSEDE_GRACE_MS,
+  LOOPBACK_BIND: true, ENROLL_MODE: "invite", seenNonces,
 });
+const publicContext = { ...context, ...publicAuth, AUTH_MODE: "enforce" };
 
+function requestHandler(runtime, ctx, gate = null) {
+  return async (req, res) => {
+    try {
+      const u = new URL(req.url, "http://x");
+      const q = Object.fromEntries(u.searchParams);
+      const P = u.pathname;
+      if (gate && !gate.admit(req, res, P)) return;
+      const b0 = req.method === "POST" ? await runtime.body(req) : {};
+      if (runtime.handleEnrollment({ req, res, P, u, b0, inviteOnly: !!gate })) return;
+      const auth = runtime.PUBLIC_ENDPOINTS.has(P)
+        ? { ok: true, mode: ctx.AUTH_MODE, trusted: false }
+        : await runtime.authenticate(req, runtime.authPath(u));
+      if (runtime.handleInvite({ req, res, P, auth, b0 })) return;
+      if (!auth.ok) return runtime.json(res, auth.code || 401, { error: auth.error || "unauthorized" });
+      const authorization = runtime.authorize(auth, req.method, P, runtime.projectFromRequest(P, q, b0));
+      if (!authorization.ok) return runtime.json(res, authorization.code || 403, { error: authorization.error || "forbidden" });
+      if (gate && P === "/stream" && !gate.openStream(req, res)) return;
+      if (req.method === "GET" && P === "/_op") {
+        const o = opOutcomes.get(String(q.id || "").slice(0, 80));
+        return runtime.json(res, 200, o ? { status: o.status, code: o.code, body: o.body } : { status: "unknown" });
+      }
+      const op = req.method === "POST" ? opIdOf(b0) : null;
+      const seen = op ? opOutcomes.get(op) : null;
+      if (seen) return runtime.json(res, seen.code, seen.body);
+      if (op) recordOpOutcome(res, op);
+      for (const route of routes) if (await route({ req, res, q, P, auth, ctx })) return;
+      runtime.json(res, 404, { error: "not found" });
+    } catch (error) {
+      runtime.json(res, 500, { error: String(error?.message || error) });
+    }
+  };
+}
+
+const server = http.createServer(requestHandler(authRuntime, context));
 server.listen(PORT, HOST, () => console.error(`[trantor] hub on http://${HOST}:${PORT} (auth: ${AUTH_MODE}; data: ${DATA})`));
+
+if (process.env.RELAY_PUBLIC_PORT) {
+  const publicPort = Number(process.env.RELAY_PUBLIC_PORT);
+  const publicServer = http.createServer(requestHandler(publicAuth, publicContext, createPublicGate()));
+  publicServer.listen(publicPort, "127.0.0.1", () => console.error(`[trantor] public hub on http://127.0.0.1:${publicServer.address().port} (auth: enforce)`));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trantor",
-  "version": "0.18.113",
+  "version": "0.18.115",
   "type": "module",
   "bin": {
     "trantor": "bin/cli.mjs"