feat(builderlab): tenant table — a login origin per hosted relay, granted natively and accepted by the binding signer - #1817

…Builderlab hosts it

Correction to `50bad0cdb`, whose message called sign-in "always at
BUZZ_BUILDERLAB_URL" for a hosted URL as intended: for another
deployment's relay that auto-sign-in was wrong. A public release
(`app.builderlab.xyz`, bb-public) given a `block.builderlab.xyz`
community URL signed in at once at bb-public, then linked the user's
new or imported key to that bb-public account and offered to back it
up there. `main` cannot do this (its key-setup gate never calls
Builderlab); the auto-sign-in came in with `builderlab-hosted.ts` in
`75127a4d4`, after #1817 closed saying a typed address always gets the
connect choice.

Rule: a known Builderlab relay signs in at once only when its owning
portal is the origin of `VITE_BUZZ_BUILDERLAB_URL`. Host x build:

  typed host \ build           app.builderlab  block.builderlab  test.blockstaging
  *.communities.buzz.xyz        sign in         key only          key only
  *.block.builderlab.xyz        key only        sign in           key only
  *.test.blockstaging.build     key only        key only          sign in
  any other host                Connect         Connect           Connect

(was: every hosted cell signed in at the build portal). A relay
publishing a listed `self` key follows its row; an FI or unconfigured
build matches no portal, so every known host is key only.

- `builderlab-hosted.ts`: each row names its portal;
  `builderlabHosting(found, build)` answers `{ portal, here }` or
  `undefined` (hostname first, then `self`; default port only).
- `Welcome.tsx`: `onFound` signs in only when `here`; otherwise it keeps
  the other portal's host in `elsewhere` and pauses on the connect
  choice. A join admitted after a landing sign-in is not saved to this
  account when another Builderlab hosts it (`ProfileStepState.found`
  keeps `self` so the guard can use the relay-key fallback).
- `ConnectChoice.tsx`: with `elsewhere`, the page names that portal and
  offers only a prominent "I already have a key" (and Back); title,
  host line, page key and `data-return-focus="import"` are unchanged.
  Shared `Button` only, no new tokens or variants.

Tests: `builderlab-hosted.test.ts` asserts each accepted host's portal,
the 3x3 host x build `here` matrix, empty/invalid/path-bearing build
URLs and the `self` fallback. `identity.test.tsx`: the hosted journey is
now a 3-case `it.each` with the build URL stubbed to each portal; a new
2-case journey (bb-block URL in a public build, bb-public URL in a Block
build) shows the key-only page, returns focus to "I already have a key"
from the import page's Back, imports, reaches Join Community with
`connect` and `account` never called and exactly
`identity_restore, identity_legacy_available, relay_http x2,
identity_import, relay_http x2`, all to the typed origin. It fails on
`50bad0cdb` (no "Connect to your community" heading: sign-in started)
and passes now. A third journey joins a bb-block community after
signing in at a public build and asserts nothing is saved to the
account; it fails with the guard removed.

Docs: `docs/identity.md` (portal per deployment, sign in only for this
build's, key only for another's, no save) and one sentence in
`docs/buzz-help.md`.

Validation: `tsc --noEmit`; Biome on the changed files; `vitest run`
of `identity.test.tsx`, `builderlab-hosted.test.ts`,
`first-run-join-handoff.test.tsx` and `first-run-navigation.test.tsx`
(4 files, 171 tests) pass. Not run: the full suite, hooks,
`design:check`, and a rendered check of the key-only page (themes,
480/1100 px, 150 % text, keyboard and pointer).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>

…Builderlab hosts it

Correction to `50bad0cdb`, whose message called sign-in "always at
BUZZ_BUILDERLAB_URL" for a hosted URL as intended: for another
deployment's relay that auto-sign-in was wrong. A public release
(`app.builderlab.xyz`, bb-public) given a `block.builderlab.xyz`
community URL signed in at once at bb-public, then linked the user's
new or imported key to that bb-public account and offered to back it
up there. `main` cannot do this (its key-setup gate never calls
Builderlab); the auto-sign-in came in with `builderlab-hosted.ts` in
`75127a4d4`, after #1817 closed saying a typed address always gets the
connect choice.

Rule: a known Builderlab relay signs in at once only when its owning
portal is the origin of `VITE_BUZZ_BUILDERLAB_URL`. Host x build:

  typed host \ build           app.builderlab  block.builderlab  test.blockstaging
  *.communities.buzz.xyz        sign in         key only          key only
  *.block.builderlab.xyz        key only        sign in           key only
  *.test.blockstaging.build     key only        key only          sign in
  any other host                Connect         Connect           Connect

(was: every hosted cell signed in at the build portal). A relay
publishing a listed `self` key follows its row; an FI or unconfigured
build matches no portal, so every known host is key only.

- `builderlab-hosted.ts`: each row names its portal;
  `builderlabHosting(found, build)` answers `{ portal, here }` or
  `undefined` (hostname first, then `self`; default port only).
- `Welcome.tsx`: `onFound` signs in only when `here`; otherwise it keeps
  the other portal's host in `elsewhere` and pauses on the connect
  choice. A join admitted after a landing sign-in is not saved to this
  account when another Builderlab hosts it (`ProfileStepState.found`
  keeps `self` so the guard can use the relay-key fallback).
- `ConnectChoice.tsx`: with `elsewhere`, the page names that portal and
  offers only a prominent "I already have a key" (and Back); title,
  host line, page key and `data-return-focus="import"` are unchanged.
  Shared `Button` only, no new tokens or variants.

Tests: `builderlab-hosted.test.ts` asserts each accepted host's portal,
the 3x3 host x build `here` matrix, empty/invalid/path-bearing build
URLs and the `self` fallback. `identity.test.tsx`: the hosted journey is
now a 3-case `it.each` with the build URL stubbed to each portal; a new
2-case journey (bb-block URL in a public build, bb-public URL in a Block
build) shows the key-only page, returns focus to "I already have a key"
from the import page's Back, imports, reaches Join Community with
`connect` and `account` never called and exactly
`identity_restore, identity_legacy_available, relay_http x2,
identity_import, relay_http x2`, all to the typed origin. It fails on
`50bad0cdb` (no "Connect to your community" heading: sign-in started)
and passes now. A third journey joins a bb-block community after
signing in at a public build and asserts nothing is saved to the
account; it fails with the guard removed.

Docs: `docs/identity.md` (portal per deployment, sign in only for this
build's, key only for another's, no save) and one sentence in
`docs/buzz-help.md`.

Validation: `tsc --noEmit`; Biome on the changed files; `vitest run`
of `identity.test.tsx`, `builderlab-hosted.test.ts`,
`first-run-join-handoff.test.tsx` and `first-run-navigation.test.tsx`
(4 files, 171 tests) pass. Not run: the full suite, hooks,
`design:check`, and a rendered check of the key-only page (themes,
480/1100 px, 150 % text, keyboard and pointer).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>

…Builderlab hosts it

Correction to `50bad0cdb`, whose message called sign-in "always at
BUZZ_BUILDERLAB_URL" for a hosted URL as intended: for another
deployment's relay that auto-sign-in was wrong. A public release
(`app.builderlab.xyz`, bb-public) given a `block.builderlab.xyz`
community URL signed in at once at bb-public, then linked the user's
new or imported key to that bb-public account and offered to back it
up there. `main` cannot do this (its key-setup gate never calls
Builderlab); the auto-sign-in came in with `builderlab-hosted.ts` in
`75127a4d4`, after #1817 closed saying a typed address always gets the
connect choice.

Rule: a known Builderlab relay signs in at once only when its owning
portal is the origin of `VITE_BUZZ_BUILDERLAB_URL`. Host x build:

  typed host \ build           app.builderlab  block.builderlab  test.blockstaging
  *.communities.buzz.xyz        sign in         key only          key only
  *.block.builderlab.xyz        key only        sign in           key only
  *.test.blockstaging.build     key only        key only          sign in
  any other host                Connect         Connect           Connect

(was: every hosted cell signed in at the build portal). A relay
publishing a listed `self` key follows its row; an FI or unconfigured
build matches no portal, so every known host is key only.

- `builderlab-hosted.ts`: each row names its portal;
  `builderlabHosting(found, build)` answers `{ portal, here }` or
  `undefined` (hostname first, then `self`; default port only).
- `Welcome.tsx`: `onFound` signs in only when `here`; otherwise it keeps
  the other portal's host in `elsewhere` and pauses on the connect
  choice. A join admitted after a landing sign-in is not saved to this
  account when another Builderlab hosts it (`ProfileStepState.found`
  keeps `self` so the guard can use the relay-key fallback).
- `ConnectChoice.tsx`: with `elsewhere`, the page names that portal and
  offers only a prominent "I already have a key" (and Back); title,
  host line, page key and `data-return-focus="import"` are unchanged.
  Shared `Button` only, no new tokens or variants.

Tests: `builderlab-hosted.test.ts` asserts each accepted host's portal,
the 3x3 host x build `here` matrix, empty/invalid/path-bearing build
URLs and the `self` fallback. `identity.test.tsx`: the hosted journey is
now a 3-case `it.each` with the build URL stubbed to each portal; a new
2-case journey (bb-block URL in a public build, bb-public URL in a Block
build) shows the key-only page, returns focus to "I already have a key"
from the import page's Back, imports, reaches Join Community with
`connect` and `account` never called and exactly
`identity_restore, identity_legacy_available, relay_http x2,
identity_import, relay_http x2`, all to the typed origin. It fails on
`50bad0cdb` (no "Connect to your community" heading: sign-in started)
and passes now. A third journey joins a bb-block community after
signing in at a public build and asserts nothing is saved to the
account; it fails with the guard removed.

Docs: `docs/identity.md` (portal per deployment, sign in only for this
build's, key only for another's, no save) and one sentence in
`docs/buzz-help.md`.

Validation: `tsc --noEmit`; Biome on the changed files; `vitest run`
of `identity.test.tsx`, `builderlab-hosted.test.ts`,
`first-run-join-handoff.test.tsx` and `first-run-navigation.test.tsx`
(4 files, 171 tests) pass. Not run: the full suite, hooks,
`design:check`, and a rendered check of the key-only page (themes,
480/1100 px, 150 % text, keyboard and pointer).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Matt Toohey <[email protected]>