Relay

The wire, version 1↑ Why · Alex reaches the laptop at home from a café The relay is the one way through that every network allows.

The contract between every node and every relay, ours included, written down and frozen.

A key attaches only by signing this connection's challenge for this account

Naming a key without its signature would take someone else's frames.

A frame reaches the key in its first 32 bytes, unchanged

The session above numbers and seals every message; the relay's only job is the address.

An unknown `to` is dropped and the socket carries on

A peer that has just left is not worth a reconnect.

Keys attach per account

One account's sockets must never be a way into another's.

The same key attached again replaces the older socket

A node that reconnects after a flap must not wait for its dead socket to time out.

A frame over 64 KiB closes the socket

A bound in the wire tells a sender what every relay takes.

Over its limits a relay closes the socket, never drops in silence

A silent drop would stall a session; a close makes it resend.

Two sockets that meet at one mailbox learn each other's keys, while both are online

A new device pairing has to find the one that made its code, and neither knows the other's key yet. Only waiting sockets hold a meet, so the relay stores nothing, and a pairing needs both devices online. Added to version 1 as 1.1: nothing else changes, and a client that never meets sees nothing new.

A `ping` is answered `pong`, without waking the relay

A socket whose network went quietly looks open for minutes; the only way to know is to ask. Added as 1.2, like meeting.

A relay may say which release is out, as a hint and nothing more

Every node already holds a socket to its relay, so that is where news of a release travels, instead of each node asking every few hours. The hint is only a number: a node still fetches the manifest and checks its signature, and a page still loads only what its origin serves. Added as 1.3.

Version 2↑ Why · Alex loses a phone, and it opens nothing The revocation waits at the relay for the machine that was away.↑ Why · Someone checks every claim before trusting it A relay proves who it is by the account's own log, not by a certificate authority.

Planned: mailboxes for devices that are away, and a relay that proves who it is.

The relay signs its challenge with a key the account's log records

A certificate says who a CA vouched for; the log says who the account chose, and it works the same for ours and yours.

A frame for a key that isn't attached waits in its mailbox, bounded and expiring

A pairing mailbox routes without a key, for one join and its reply

A frame for a device that left a push endpoint wakes it, sealed

Who runs the relay↑ Why · Someone checks every claim before trusting it Anyone can run the relay and check it against the same suite as ours.

Everything is sealed end to end, so trusting a relay with content is not the question; availability and metadata are.

Any relay that passes the suite works

A node must not need to know whose relay it is talking to.

The relay you can run does everything ours does for one account

Can I leave? needs a yes that works today, not a promise to publish later.

Moving to another relay keeps your account, devices and files

The account is its log, and the log takes no relay's word.

What our relay sees is listed, and nothing else reaches it

A service you can't read is believable only where what it can see is stated and checked.

Hole-punching runs in the open client

Nothing that makes a direct pipe work is ours alone.

A relay you run works on your own domain

Restarting the relay costs a redial, not a session

Changing a Durable Object's code restarts it and closes its sockets, so a relay release can't be made invisible; it can be made harmless, and rare. Publishing a node release or a change to the page never touches it.

#The wire, version 1↑ Why · Alex reaches the laptop at home from a café The relay is the one way through that every network allows.

#A key attaches only by signing this connection's challenge for this accountproof

#A frame reaches the key in its first 32 bytes, unchangedproof

#An unknown to is dropped and the socket carries onproof

#Keys attach per accountproof

#The same key attached again replaces the older socketproof

#A frame over 64 KiB closes the socketproof

#Over its limits a relay closes the socket, never drops in silenceproof

#Two sockets that meet at one mailbox learn each other's keys, while both are onlineproof

#A ping is answered pong, without waking the relayproof

#A relay may say which release is out, as a hint and nothing moreproof

#Version 2↑ Why · Alex loses a phone, and it opens nothing The revocation waits at the relay for the machine that was away.↑ Why · Someone checks every claim before trusting it A relay proves who it is by the account's own log, not by a certificate authority.

#The relay signs its challenge with a key the account's log recordsproof

#A frame for a key that isn't attached waits in its mailbox, bounded and expiringproof

#A pairing mailbox routes without a key, for one join and its replyproof

#A frame for a device that left a push endpoint wakes it, sealedproof

#Who runs the relay↑ Why · Someone checks every claim before trusting it Anyone can run the relay and check it against the same suite as ours.

#Any relay that passes the suite worksproof

#The relay you can run does everything ours does for one accountproof

#Moving to another relay keeps your account, devices and filesproof

#What our relay sees is listed, and nothing else reaches itproof

#Hole-punching runs in the open clientproof

#A relay you run works on your own domainproof

#Restarting the relay costs a redial, not a sessionproof