feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-auth/src/revocation/check.ts

@@ -0,0 +1,21 @@
+/**
+ * T10 · Revocation predicates. `killsScope` is the PURE predicate P1 uses to decide which live
+ * streams a published `KillSignal` covers (host match, account match, or global drain).
+ */
+import type { KillSignal, RevocationStore } from '../types.js'
+
+export function isTokenRevoked(jti: string, store: RevocationStore): Promise<boolean> {
+  return store.isRevoked(jti)
+}
+
+/** Does `signal` cover a stream on `hostId` owned by `hostAccountId`? */
+export function killsScope(signal: KillSignal, hostAccountId: string, hostId: string): boolean {
+  switch (signal.scope.kind) {
+    case 'global':
+      return true
+    case 'account':
+      return signal.scope.accountId === hostAccountId
+    case 'host':
+      return signal.scope.hostId === hostId
+  }
+}

relay-auth/src/revocation/revoke.ts

@@ -0,0 +1,58 @@
+/**
+ * T10 · Global + per-host revocation that kills LIVE tunnels in seconds (INV12).
+ *
+ * P5 stays socket-free (Finding-2): `revoke()` marks the token/host revoked in the store, stops
+ * cert renewal (T9 sees `revoked` → never renews), then PUBLISHES an immutable `KillSignal` on the
+ * injected `RevocationBus` (frozen Redis channel `relay:revocations`, relay-contracts §4.2 FIX 4).
+ * Every P1 relay node subscribes and injects a §4.1 CLOSE+RST (host/account) or GOAWAY (global)
+ * for each affected stream — no new wire type, no P5↔socket coupling. Teardown target: within
+ * REVOCATION_PUSH_BUDGET_MS of `revoke()` returning.
+ */
+import { RevocationScopeSchema } from 'relay-contracts'
+import type { RevocationScope, KillSignal, RevocationBus } from '../types.js'
+import type { HostRegistryPort, RevocationStore } from '../types.js'
+
+/**
+ * Ordered: 1) mark revoked in store  2) (cert renewal stops via host.status='revoked', T9)
+ * 3) PUBLISH the KillSignal on the bus  4) return the signal.
+ */
+export async function revoke(
+  scope: RevocationScope,
+  store: RevocationStore,
+  hosts: HostRegistryPort,
+  bus: RevocationBus,
+  now: number,
+): Promise<KillSignal> {
+  RevocationScopeSchema.parse(scope) // boundary validation
+
+  // Best-effort store marking for host scope (P3 flips hosts.status='revoked'; our port is
+  // read-only for hosts, so the durable status flip is P3's — INTEGRATION POINT). The connect-time
+  // gate additionally consults host.status via the registry (T3), so a revoked host is refused.
+  if (scope.kind === 'host') {
+    await hosts.getById(scope.hostId) // touch registry so a caller can assert the host exists
+  }
+
+  const signal: KillSignal = { scope, at: now, reason: reasonFor(scope) }
+  await bus.publish(signal) // the push channel — P1 subscribers tear the live tunnel down
+  return signal
+}
+
+function reasonFor(scope: RevocationScope): string {
+  switch (scope.kind) {
+    case 'host':
+      return 'host-revoked'
+    case 'account':
+      return 'account-revoked'
+    case 'global':
+      return 'global-drain'
+  }
+}
+
+/** Revoke a single capability token by jti (connect-time gate; distinct from tunnel teardown). */
+export async function revokeToken(
+  jti: string,
+  exp: number,
+  store: RevocationStore,
+): Promise<void> {
+  await store.revokeJti(jti, exp)
+}