@claxedo/workspace-relay 0.1.0 → 0.5.0

package/dist/main.mjs

@@ -13,9 +13,9 @@ import {
 
 // src/bun.ts
 import {
-  isTunnelMessage,
   makeTunnelPong,
-  TUNNEL_PROTOCOL_VERSION
+  TUNNEL_PROTOCOL_VERSION,
+  validateTunnelMessage
 } from "@claxedo/workspace-relay-protocol";
 
 // src/server.ts
@@ -63,6 +63,9 @@ function roleClaim(payload) {
   const value = stringClaim(payload, "role");
   return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
 }
+function isRelayClaimPair(input) {
+  return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
+}
 function checkHostTunnelTarget(payload, expected) {
   if (stringClaim(payload, "host_id") !== expected.hostId) {
     throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
@@ -113,6 +116,18 @@ async function verifyRuntimeAccessToken(token, key, expected) {
   }
   return claims;
 }
+function validateRuntimeAccessTokenClaims(input, expected) {
+  const payload = input;
+  if (stringClaim(payload, "iss") !== runtimeAccessTokenIssuer || stringClaim(payload, "aud") !== runtimeAccessTokenAudience) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token issuer or audience is invalid");
+  }
+  checkTarget(payload, expected);
+  const claims = runtimeClaims(payload);
+  if (!claims) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
+  }
+  return claims;
+}
 async function verifyHostTunnelToken(token, key, expected) {
   const result = await verifyJwt(token, key, {
     issuer: runtimeAccessTokenIssuer,
@@ -126,6 +141,9 @@ async function verifyHostTunnelToken(token, key, expected) {
   return claims;
 }
 async function mintRelayHostToken(input, key, alg) {
+  if (!isRelayClaimPair(input)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token access/backing claims are inconsistent");
+  }
   const now = seconds(input.now);
   const protectedHeader = { alg: requireAlgorithm(alg) };
   if (input.kid) protectedHeader.kid = input.kid;
@@ -197,6 +215,70 @@ function errorBody(code, message) {
 }
 
 // src/server.ts
+var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
+var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
+var RESOLVER_CACHE_MAX_ENTRIES = 8192;
+var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
+var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
+var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
+function pruneExpiringCache(cache, now, maxEntries) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= maxEntries) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+function createCachedRevocationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const at = now();
+    const entry = cache.get(args.jti);
+    if (entry && entry.expiresAt > at) {
+      if (entry.result) return entry.result;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((result) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
+      return result;
+    }).catch((err) => {
+      cache.delete(args.jti);
+      throw err;
+    });
+    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
+function createCachedTargetClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 5e3;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const key = `${args.workspaceId}\0${args.hostId}`;
+    const at = now();
+    const entry = cache.get(key);
+    if (entry && entry.expiresAt > at) {
+      if (entry.result) return entry.result;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((result) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      if (result) cache.set(key, { result, expiresAt: now() + ttlMs });
+      else cache.delete(key);
+      return result;
+    }).catch((err) => {
+      cache.delete(key);
+      throw err;
+    });
+    cache.set(key, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
 function protocolToken(header) {
   return header?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
 }
@@ -209,6 +291,16 @@ var DANGEROUS_INBOUND_HEADERS = [
   "x-forwarded-proto",
   "x-real-ip"
 ];
+var HOP_BY_HOP_HEADERS = [
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+];
 var DANGEROUS_INBOUND_HEADER_PATTERNS = [
   /^x-claxedo-internal-/i,
   /^x-supervisor-/i
@@ -216,6 +308,7 @@ var DANGEROUS_INBOUND_HEADER_PATTERNS = [
 function isDangerousInboundHeader(name) {
   const lower = name.toLowerCase();
   if (DANGEROUS_INBOUND_HEADERS.includes(lower)) return true;
+  if (HOP_BY_HOP_HEADERS.includes(lower)) return true;
   for (const pattern of DANGEROUS_INBOUND_HEADER_PATTERNS) {
     if (pattern.test(lower)) return true;
   }
@@ -231,9 +324,16 @@ function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
   }
   if (options.userHosted) headers2.delete("cookie");
   headers2.set("accept-encoding", "identity");
-  headers2.set("authorization", `Bearer ${relayHostToken}`);
+  headers2.delete("authorization");
+  headers2.delete("Authorization");
+  headers2.set("Authorization", `Bearer ${relayHostToken}`);
   headers2.set("x-workspace-id", workspaceId);
   headers2.set("X-Daytona-Skip-Preview-Warning", "true");
+  headers2.set("X-Daytona-Skip-Last-Activity-Update", "true");
+  for (const [name, value] of Object.entries(options.upstreamHeaders ?? {})) {
+    const trimmed = value.trim();
+    if (trimmed) headers2.set(name, trimmed);
+  }
   headers2.set("x-forwarded-by", "workspace-relay");
   return headers2;
 }
@@ -243,8 +343,155 @@ function targetUrl(target, path, search) {
   return url;
 }
 function roleAllowsRelayRequest(role, method) {
-  if (role !== "viewer") return true;
-  return method === "GET" || method === "HEAD" || method === "OPTIONS";
+  if (role === "owner" || role === "admin" || role === "editor") return true;
+  if (role === "viewer") return method === "GET" || method === "HEAD" || method === "OPTIONS";
+  return false;
+}
+function relayHostTokenCacheTtlMs(options, claims) {
+  const configured = options.relayHostTokenCacheTtlMs ?? 3e4;
+  if (!Number.isFinite(configured) || configured <= 0) return 0;
+  const tokenRemaining = claims.exp * 1e3 - Date.now() - 5e3;
+  return Math.max(0, Math.min(configured, tokenRemaining));
+}
+function relayHostTokenCacheKey(options, claims, target) {
+  return [
+    claims.jti,
+    claims.sub,
+    claims.org_id,
+    claims.role,
+    claims.workspace_id,
+    claims.host_id,
+    target.access,
+    target.backing,
+    options.relayHostMintKid ?? ""
+  ].join("\0");
+}
+function relayHostTokenCache(options) {
+  let cache = relayHostTokenCaches.get(options);
+  if (cache) return cache;
+  cache = /* @__PURE__ */ new Map();
+  relayHostTokenCaches.set(options, cache);
+  return cache;
+}
+function runtimeAccessTokenCache(options) {
+  let cache = runtimeAccessTokenCaches.get(options);
+  if (cache) return cache;
+  cache = /* @__PURE__ */ new Map();
+  runtimeAccessTokenCaches.set(options, cache);
+  return cache;
+}
+function runtimeAccessTokenCacheTtlMs(options, claims, now) {
+  const configured = options.runtimeAccessTokenCacheTtlMs ?? RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
+  if (!Number.isFinite(configured) || configured <= 0) return 0;
+  const tokenRemaining = claims.exp * 1e3 - now - 5e3;
+  return Math.max(0, Math.min(configured, tokenRemaining));
+}
+function pruneRuntimeAccessTokenCache(cache, now) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+async function verifyRuntimeAccessTokenForRequest(options, token, workspaceId) {
+  const verified = options.tokenVerifier ? await options.tokenVerifier.verify(token).then(
+    (result) => validateRuntimeAccessTokenClaims(result.claims, { workspaceId })
+  ) : await verifyRuntimeAccessToken(token, options.runtimeAccessKey, { workspaceId });
+  return verified;
+}
+async function cachedRuntimeAccessTokenClaims(options, token, workspaceId) {
+  const configured = options.runtimeAccessTokenCacheTtlMs ?? RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
+  if (!Number.isFinite(configured) || configured <= 0) {
+    return await verifyRuntimeAccessTokenForRequest(options, token, workspaceId);
+  }
+  const now = Date.now();
+  const cache = runtimeAccessTokenCache(options);
+  const key = `${workspaceId}\0${token}`;
+  const cached = cache.get(key);
+  if (cached && cached.expiresAt > now) {
+    if (cached.claims) return cached.claims;
+    if (cached.promise) return await cached.promise;
+  }
+  let promise;
+  try {
+    promise = verifyRuntimeAccessTokenForRequest(options, token, workspaceId);
+    pruneRuntimeAccessTokenCache(cache, now);
+    cache.set(key, { promise, expiresAt: now + configured });
+    const claims = await promise;
+    const ttlMs = runtimeAccessTokenCacheTtlMs(options, claims, now);
+    if (ttlMs > 0) cache.set(key, { claims, expiresAt: now + ttlMs });
+    else cache.delete(key);
+    return claims;
+  } catch (err) {
+    if (promise && cache.get(key)?.promise === promise) cache.delete(key);
+    throw err;
+  }
+}
+function pruneRelayHostTokenCache(cache, now) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+async function relayHostTokenFor(options, claims, target, trace) {
+  const ttlMs = relayHostTokenCacheTtlMs(options, claims);
+  if (ttlMs <= 0) {
+    return await uncachedRelayHostTokenFor(options, claims, target, trace);
+  }
+  const key = relayHostTokenCacheKey(options, claims, target);
+  const now = Date.now();
+  const cache = relayHostTokenCache(options);
+  const cached = cache.get(key);
+  if (cached && cached.expiresAt > now) {
+    if (cached.promise) {
+      return await trace.span("rht-cache", async () => await cached.promise);
+    }
+    await trace.span("rht-cache", async () => {
+    });
+    return cached.token;
+  }
+  let promise;
+  try {
+    const token = await trace.span("rht-mint", async () => {
+      promise = mintRelayHostToken({
+        subject: claims.sub,
+        orgId: claims.org_id,
+        role: claims.role,
+        ...target,
+        ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
+      }, options.relayHostSigningKey, options.relayHostAlgorithm);
+      pruneRelayHostTokenCache(cache, now);
+      cache.set(key, { promise, expiresAt: now + ttlMs });
+      return await promise;
+    });
+    cache.set(key, {
+      token,
+      expiresAt: now + ttlMs
+    });
+    return token;
+  } catch (err) {
+    if (promise && cache.get(key)?.promise === promise) cache.delete(key);
+    throw err;
+  }
+}
+async function uncachedRelayHostTokenFor(options, claims, target, trace) {
+  return await trace.span(
+    "rht-mint",
+    async () => await mintRelayHostToken({
+      subject: claims.sub,
+      orgId: claims.org_id,
+      role: claims.role,
+      ...target,
+      ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
+    }, options.relayHostSigningKey, options.relayHostAlgorithm)
+  );
 }
 function workspaceRelayTargetUrl(target, path, search) {
   return targetUrl(target, path, search);
@@ -252,6 +499,18 @@ function workspaceRelayTargetUrl(target, path, search) {
 function workspaceRelayForwardHeaders(input, relayHostToken, workspaceId, options = {}) {
   return forwardHeaders(input, relayHostToken, workspaceId, options);
 }
+function workspaceRelayForwardRequestInit(request, relayHostToken, workspaceId, options = {}) {
+  const init = {
+    method: request.method,
+    headers: forwardHeaders(request.headers, relayHostToken, workspaceId, options),
+    body: request.body,
+    duplex: "half",
+    redirect: "manual",
+    ...options.signal ? { signal: options.signal } : {}
+  };
+  if (request.method === "GET" || request.method === "HEAD") delete init.body;
+  return init;
+}
 var auditSamplers = /* @__PURE__ */ new WeakMap();
 function getOrCreateAuditSampler(options) {
   let state = auditSamplers.get(options);
@@ -309,6 +568,38 @@ function disposeAuditSampler(options) {
   flushSuppressedSummary(options, state);
   auditSamplers.delete(options);
 }
+function createWorkspaceRelayTrace() {
+  const phases = [];
+  return {
+    phases,
+    async span(name, run) {
+      const startedAt = performance.now();
+      try {
+        return await run();
+      } finally {
+        phases.push({ name, ms: performance.now() - startedAt });
+      }
+    }
+  };
+}
+function roundedMs(value) {
+  return Math.round(value * 100) / 100;
+}
+function workspaceRelayServerTiming(trace) {
+  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
+}
+function workspaceRelayTimingResponse(response, trace) {
+  const value = workspaceRelayServerTiming(trace);
+  if (!value) return response;
+  const headers2 = new Headers(response.headers);
+  const prev = headers2.get("server-timing");
+  headers2.set("server-timing", prev ? `${prev}, ${value}` : value);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: headers2
+  });
+}
 async function audit(options, event) {
   if (event.action === "relay.request.accepted") {
     const state = getOrCreateAuditSampler(options);
@@ -329,7 +620,7 @@ function denyCorsHeaders(request) {
   if (!allowed) return void 0;
   return {
     "access-control-allow-origin": origin,
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, X-Daytona-Skip-Preview-Warning, X-Workspace-Id",
+    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
     "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
   };
 }
@@ -351,11 +642,12 @@ async function deny(options, input) {
     headers: denyCorsHeaders(input.request)
   });
 }
-async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
+async function authorizeWorkspaceRelayRequest(options, request, workspaceId, trace) {
   const token = runtimeAccessToken(request);
   if (!token) {
     return {
       ok: false,
+      code: "runtime_access_token_required",
       response: await deny(options, {
         code: "runtime_access_token_required",
         message: "Runtime Access Token is required",
@@ -365,14 +657,18 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
     };
   }
   try {
-    const claims = options.tokenVerifier ? await (async () => {
-      const verified = await options.tokenVerifier.verify(token);
-      return verified.claims;
-    })() : await verifyRuntimeAccessToken(token, options.runtimeAccessKey, { workspaceId });
-    const active = await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
+    const span = (name, run) => trace ? trace.span(name, run) : run();
+    const claims = await span(
+      "rat-verify",
+      async () => await cachedRuntimeAccessTokenClaims(options, token, workspaceId)
+    );
+    const active = await span("rat-active", async () => {
+      return await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
+    });
     if (!active.active) {
       return {
         ok: false,
+        code: active.code,
         response: await deny(options, {
           code: active.code,
           message: active.reason,
@@ -385,6 +681,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
     if (!roleAllowsRelayRequest(claims.role, request.method)) {
       return {
         ok: false,
+        code: "relay_role_denied",
         response: await deny(options, {
           code: "relay_role_denied",
           message: "Workspace role does not allow this relay request",
@@ -394,10 +691,11 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
         })
       };
     }
-    const target = await options.resolveTarget(claims);
+    const target = await span("target-resolve", async () => await options.resolveTarget(claims));
     if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id) {
       return {
         ok: false,
+        code: "relay_target_unavailable",
         response: await deny(options, {
           code: "relay_target_unavailable",
           message: "Workspace relay target is unavailable",
@@ -410,6 +708,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
     if (target.access === "user-hosted" && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
       return {
         ok: false,
+        code: "user_hosted_app_offline",
         response: await deny(options, {
           code: "user_hosted_app_offline",
           message: "User-hosted workspace is offline",
@@ -419,7 +718,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
         })
       };
     }
-    await audit(options, {
+    await span("audit", async () => await audit(options, {
       action: "relay.request.accepted",
       result: "allow",
       subject: claims.sub,
@@ -428,22 +727,14 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
       hostId: claims.host_id,
       method: request.method,
       path: new URL(request.url).pathname
-    });
+    }));
+    const relayHostToken = await relayHostTokenFor(options, claims, target, { span });
     return {
       ok: true,
       request: {
         claims,
         target,
-        relayHostToken: await mintRelayHostToken({
-          subject: claims.sub,
-          orgId: claims.org_id,
-          workspaceId: claims.workspace_id,
-          hostId: claims.host_id,
-          role: claims.role,
-          access: target.access,
-          backing: target.backing,
-          ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-        }, options.relayHostSigningKey, options.relayHostAlgorithm),
+        relayHostToken,
         path: new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")
       }
     };
@@ -451,6 +742,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
     const code = err instanceof WorkspaceRelayAuthError ? err.code : "relay_request_failed";
     return {
       ok: false,
+      code,
       response: await deny(options, {
         code,
         message: "Workspace relay request was denied",
@@ -460,28 +752,45 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
     };
   }
 }
-async function forwardRequest(request, target, relayHostToken, path, requestFetch) {
-  const init = {
-    method: request.method,
-    headers: forwardHeaders(request.headers, relayHostToken, target.workspaceId),
-    body: request.body,
-    duplex: "half",
-    redirect: "manual"
-  };
-  if (request.method === "GET" || request.method === "HEAD") delete init.body;
-  const upstream = await requestFetch(targetUrl(target, path, new URL(request.url).search), init);
-  const headers2 = new Headers(upstream.headers);
-  headers2.delete("access-control-allow-origin");
-  headers2.delete("access-control-allow-credentials");
-  headers2.delete("access-control-allow-headers");
-  headers2.delete("access-control-allow-methods");
-  headers2.delete("access-control-expose-headers");
-  headers2.delete("access-control-max-age");
-  return new Response(upstream.body, {
-    status: upstream.status,
-    statusText: upstream.statusText,
-    headers: headers2
-  });
+async function forwardWorkspaceRelayRequest(request, target, relayHostToken, path, requestFetch, timeoutMs, trace) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const span = (name, run) => trace ? trace.span(name, run) : run();
+  try {
+    const upstream = await span("upstream-fetch", async () => await requestFetch(
+      targetUrl(target, path, new URL(request.url).search),
+      workspaceRelayForwardRequestInit(request, relayHostToken, target.workspaceId, {
+        signal: controller.signal,
+        upstreamHeaders: target.upstreamHeaders
+      })
+    ));
+    const headers2 = new Headers(upstream.headers);
+    headers2.delete("access-control-allow-origin");
+    headers2.delete("access-control-allow-credentials");
+    headers2.delete("access-control-allow-headers");
+    headers2.delete("access-control-allow-methods");
+    headers2.delete("access-control-expose-headers");
+    headers2.delete("access-control-max-age");
+    for (const [key, value] of Object.entries(denyCorsHeaders(request) ?? {})) {
+      headers2.set(key, value);
+    }
+    return new Response(upstream.body, {
+      status: upstream.status,
+      statusText: upstream.statusText,
+      headers: headers2
+    });
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    return Response.json(
+      errorBody(
+        aborted ? "upstream_timeout" : "upstream_unavailable",
+        aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable"
+      ),
+      { status: aborted ? 504 : 503, headers: denyCorsHeaders(request) }
+    );
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function getAuditSuppressedCount(options) {
   return auditSamplers.get(options)?.suppressedCount ?? 0;
@@ -512,7 +821,14 @@ function checkMetricsAuth(options, request) {
     }
     return { ok: true };
   }
-  if (!options.metricsRemoteAddress) return { ok: true };
+  if (!options.metricsRemoteAddress) {
+    return {
+      ok: false,
+      status: 401,
+      code: "metrics_unauthorized",
+      message: "Metrics endpoint is restricted to loopback or bearer-token clients"
+    };
+  }
   const address = options.metricsRemoteAddress(request);
   if (isLoopbackAddress(address)) return { ok: true };
   return {
@@ -551,6 +867,7 @@ function createWorkspaceRelay(options) {
       if (origin.startsWith("http://localhost:")) return origin;
       if (origin.startsWith("http://127.0.0.1:")) return origin;
       if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin)) return origin;
+      if (/^https:\/\/([a-z0-9-]+\.)*claxedo\.com$/.test(origin)) return origin;
       return void 0;
     },
     allowHeaders: [
@@ -558,7 +875,12 @@ function createWorkspaceRelay(options) {
       "Authorization",
       "Content-Type",
       "X-Daytona-Skip-Preview-Warning",
-      "X-Workspace-Id"
+      "X-Workspace-Id",
+      "X-OpenCode-Directory",
+      "X-Claxedo-Runner",
+      "X-Claxedo-Model",
+      "X-Claxedo-Draft-Id",
+      "X-Claxedo-Binary"
     ],
     allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
   }));
@@ -622,21 +944,27 @@ function createWorkspaceRelay(options) {
     return c.json(buildMetricsBody(options));
   });
   app.all("/workspaces/:workspaceId/*", async (c) => {
+    const trace = createWorkspaceRelayTrace();
     if (options.isDraining?.()) {
       return Response.json(
         errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
         { status: 503, headers: denyCorsHeaders(c.req.raw) }
       );
     }
-    const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"));
-    if (!relay.ok) return relay.response;
-    return await forwardRequest(
-      new Request(c.req.raw),
-      relay.request.target,
-      relay.request.relayHostToken,
-      relay.request.path,
-      options.fetch ?? fetch
-    );
+    const response = await trace.span("relay-total", async () => {
+      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
+      if (!relay.ok) return relay.response;
+      return await forwardWorkspaceRelayRequest(
+        new Request(c.req.raw),
+        relay.request.target,
+        relay.request.relayHostToken,
+        relay.request.path,
+        options.fetch ?? fetch,
+        options.forwardTimeoutMs ?? 3e4,
+        trace
+      );
+    });
+    return workspaceRelayTimingResponse(response, trace);
   });
   return app;
 }
@@ -644,31 +972,79 @@ function createWorkspaceRelay(options) {
 // src/bun.ts
 var TUNNEL_PENDING_HTTP_CAP = 32;
 var TUNNEL_CHANNEL_CAP = 16;
-var HOST_TUNNEL_REGISTRATION_CONCURRENT_CAP = 3;
 var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
 var HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS = 6e4;
 var WS_MAX_PAYLOAD_LENGTH_BYTES = 16 * 1024 * 1024;
+var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
+var TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT = 3e4;
+var DIRECT_HTTP_TIMEOUT_MS_DEFAULT = 3e4;
+var UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT = 1e4;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
+var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
+var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
 var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
 var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
 var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
 var HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT = 250;
-var fragmentationStats = {
-  fragmentsBuffered: 0,
-  oversizedClosed: 0
-};
-function getFragmentationStats() {
+function createFragmentationStats() {
   return {
-    fragmentsBuffered: fragmentationStats.fragmentsBuffered,
-    oversizedClosed: fragmentationStats.oversizedClosed
+    fragmentsBuffered: 0,
+    oversizedClosed: 0
   };
 }
-var slowConsumerStats = {
-  overflowEvents: 0,
-  timerFired: 0,
-  droppedRequests: 0
-};
-function getSlowConsumerStats() {
-  return { ...slowConsumerStats };
+function createSlowConsumerStats() {
+  return {
+    overflowEvents: 0,
+    timerFired: 0,
+    droppedRequests: 0
+  };
+}
+function readFragmentationStats(stats) {
+  return {
+    fragmentsBuffered: stats.fragmentsBuffered,
+    oversizedClosed: stats.oversizedClosed
+  };
+}
+function resetFragmentationStats(stats) {
+  stats.fragmentsBuffered = 0;
+  stats.oversizedClosed = 0;
+}
+function readSlowConsumerStats(stats) {
+  return { ...stats };
+}
+function resetSlowConsumerStats(stats) {
+  stats.overflowEvents = 0;
+  stats.timerFired = 0;
+  stats.droppedRequests = 0;
+}
+function createDirectHttpLimiter(limit) {
+  if (!Number.isInteger(limit) || !limit || limit <= 0) return void 0;
+  const max = limit;
+  let active = 0;
+  const queue = [];
+  function drain() {
+    if (active >= max) return;
+    const next = queue.shift();
+    if (!next) return;
+    active++;
+    next();
+  }
+  return {
+    async acquire() {
+      if (active < max) {
+        active++;
+      } else {
+        await new Promise((resolve) => queue.push(resolve));
+      }
+      let released = false;
+      return () => {
+        if (released) return;
+        released = true;
+        active = Math.max(0, active - 1);
+        drain();
+      };
+    }
+  };
 }
 function jsonError(code, message, status) {
   return new Response(JSON.stringify({ error: { code, message } }), {
@@ -676,6 +1052,35 @@ function jsonError(code, message, status) {
     headers: { "content-type": "application/json" }
   });
 }
+function corsJsonError(request, code, message, status) {
+  const headers2 = relayCorsHeaders(request);
+  headers2.set("content-type", "application/json");
+  return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
+}
+function safeCloseCode(input, fallback = 1011) {
+  if (!Number.isInteger(input)) return fallback;
+  const code = input;
+  if (code === 1e3) return code;
+  if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code;
+  if (code >= 3e3 && code <= 4999) return code;
+  return fallback;
+}
+function closeWebSocket(ws, code, reason, fallback = 1011) {
+  try {
+    ws.close(safeCloseCode(code, fallback), reason);
+  } catch {
+    try {
+      ws.close(fallback, reason);
+    } catch {
+    }
+  }
+}
+function upstreamCloseReason(event) {
+  if (event.reason.trim()) return event.reason;
+  if (event.code === 1e3) return "";
+  if (event.code === 1005 || event.code === 1006) return "Upstream WebSocket closed abnormally";
+  return `Upstream WebSocket closed unexpectedly with code ${event.code}`;
+}
 function workspaceIdFromPath(pathname) {
   return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
@@ -685,6 +1090,23 @@ function hostIdFromTunnelPath(pathname) {
 function websocketRequest(request) {
   return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
+function roundedMs2(input) {
+  return Math.round(input * 100) / 100;
+}
+function relayWebSocketTraceEnabled(request) {
+  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
+}
+function sendRelayWebSocketTrace(ws) {
+  const trace = ws.data.trace;
+  if (!trace || trace.emitted) return;
+  trace.emitted = true;
+  ws.send(JSON.stringify({
+    type: "relay.trace",
+    wsUpstreamOpenMs: trace.upstreamOpenMs === void 0 ? void 0 : roundedMs2(trace.upstreamOpenMs),
+    queuedFrames: trace.queuedFrames,
+    maxQueuedDelayMs: roundedMs2(trace.maxQueuedDelayMs)
+  }));
+}
 function relayWebSocketPayload(input) {
   if (typeof input === "string") return input;
   if (input instanceof ArrayBuffer) return input;
@@ -708,6 +1130,11 @@ function headers(input) {
   }
   return result;
 }
+function isEventStream(input) {
+  return Object.entries(input).some(
+    ([key, value]) => key.toLowerCase() === "content-type" && value.toLowerCase().includes("text/event-stream")
+  );
+}
 function allowedCorsOrigin(origin) {
   if (!origin) return;
   if (origin.startsWith("http://localhost:")) return origin;
@@ -734,7 +1161,7 @@ function relayCorsHeaders(request, input = new Headers()) {
   const origin = allowedCorsOrigin(request.headers.get("origin"));
   if (origin) {
     result.set("access-control-allow-origin", origin);
-    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, X-Daytona-Skip-Preview-Warning, X-Workspace-Id");
+    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary");
     result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
   }
   return result;
@@ -761,7 +1188,7 @@ function decodedFrame(frame) {
   const body = Buffer.from(frame.data_base64, "base64");
   return frame.binary ? new Uint8Array(body) : body.toString("utf8");
 }
-function tunnelMessage(ws, input) {
+function tunnelMessage(ws, input, stats) {
   if (typeof input !== "string") return;
   const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
   let parsed;
@@ -769,20 +1196,26 @@ function tunnelMessage(ws, input) {
     parsed = JSON.parse(combined);
   } catch {
     if (combined.length > TUNNEL_MESSAGE_BUFFER_CAP_BYTES) {
-      fragmentationStats.oversizedClosed += 1;
+      stats.oversizedClosed += 1;
       ws.data.messageBuffer = "";
       ws.close(1009, "Tunnel message buffer exceeded 4 MB");
       return;
     }
-    fragmentationStats.fragmentsBuffered += 1;
+    stats.fragmentsBuffered += 1;
     ws.data.messageBuffer = combined;
     return;
   }
   ws.data.messageBuffer = "";
-  return isTunnelMessage(parsed) ? parsed : void 0;
+  const validated = validateTunnelMessage(parsed);
+  if (validated.ok) return validated.message;
+  if (validated.reason === "protocol_mismatch") {
+    ws.close(1002, `Tunnel protocol mismatch: expected ${validated.expected_protocol}`);
+  }
+  return;
 }
 function sendTunnelPing(ws) {
   if (ws.readyState !== WebSocket.OPEN) return;
+  ws.data.missedPongs += 1;
   ws.send(JSON.stringify({
     type: "ping",
     protocol: TUNNEL_PROTOCOL_VERSION,
@@ -790,6 +1223,59 @@ function sendTunnelPing(ws) {
     sent_at: Date.now()
   }));
 }
+function clearPendingTimers(entry) {
+  clearTimeout(entry.timeout);
+  if (entry.slowConsumerTimeout) {
+    clearTimeout(entry.slowConsumerTimeout);
+    entry.slowConsumerTimeout = void 0;
+  }
+}
+function failPendingHttpResponse(input) {
+  clearPendingTimers(input.entry);
+  input.entry.pendingChunks.length = 0;
+  input.entry.bytesQueued = 0;
+  try {
+    input.entry.controller.error(input.error);
+  } catch {
+  }
+  if (!input.entry.responseStarted) {
+    if (input.response) {
+      input.entry.resolve(input.response);
+      return;
+    }
+    input.entry.reject(input.error);
+  }
+}
+function cleanupHostTunnelSocket(input) {
+  if (input.ws.data.heartbeat) {
+    clearInterval(input.ws.data.heartbeat);
+    input.ws.data.heartbeat = void 0;
+  }
+  for (const pending of input.ws.data.pending.values()) {
+    failPendingHttpResponse({
+      entry: pending,
+      response: input.request ? corsJsonError(input.request, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
+      error: new Error("User-hosted tunnel disconnected")
+    });
+  }
+  input.ws.data.pending.clear();
+  for (const channel of input.ws.data.channels.values()) {
+    if (input.closeChannels) closeWebSocket(channel, 1011, "User-hosted tunnel disconnected");
+  }
+  input.ws.data.channels.clear();
+  if (!input.disconnectDirectory) return;
+  if (input.hostTunnels.get(input.ws.data.hostId) === input.ws) {
+    input.hostTunnels.delete(input.ws.data.hostId);
+    input.options.directory?.disconnectHost(input.ws.data.hostId);
+    scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
+      hostId: input.ws.data.hostId,
+      workspaceId: input.ws.data.workspaceIds[0],
+      path: `/host-tunnels/${input.ws.data.hostId}`,
+      state: "disconnected",
+      debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
+    });
+  }
+}
 async function audit2(options, input) {
   await options.audit?.({
     action: input.action,
@@ -800,9 +1286,8 @@ async function audit2(options, input) {
     path: input.path
   });
 }
-var hostTunnelStateDebounce = /* @__PURE__ */ new Map();
-function scheduleHostTunnelStateChange(options, input) {
-  const existing = hostTunnelStateDebounce.get(input.hostId);
+function scheduleHostTunnelStateChange(state, options, input) {
+  const existing = state.get(input.hostId);
   const entry = existing ?? {
     intendedState: "disconnected",
     lastWritten: "disconnected",
@@ -816,7 +1301,7 @@ function scheduleHostTunnelStateChange(options, input) {
     entry.flushTimer = void 0;
     if (entry.intendedState === entry.lastWritten) {
       if (entry.intendedState === "disconnected") {
-        hostTunnelStateDebounce.delete(input.hostId);
+        state.delete(input.hostId);
       }
       return;
     }
@@ -828,7 +1313,7 @@ function scheduleHostTunnelStateChange(options, input) {
       path: entry.pending.path
     });
   }, input.debounceMs);
-  hostTunnelStateDebounce.set(input.hostId, entry);
+  state.set(input.hostId, entry);
 }
 function drainPendingChunks(entry) {
   while (entry.pendingChunks.length > 0) {
@@ -857,9 +1342,9 @@ function enqueueChunkWithBackpressure(input) {
     entry.pendingChunks.push(chunk);
     entry.bytesQueued += chunk.byteLength;
     if (!entry.slowConsumerTimeout) {
-      slowConsumerStats.overflowEvents += 1;
+      input.slowConsumerStats.overflowEvents += 1;
       entry.slowConsumerTimeout = setTimeout(() => {
-        slowConsumerStats.timerFired += 1;
+        input.slowConsumerStats.timerFired += 1;
         const error = new Error("slow_consumer_timeout: downstream consumer did not drain in time");
         try {
           entry.controller.error(error);
@@ -872,7 +1357,7 @@ function enqueueChunkWithBackpressure(input) {
           entry.resolve(jsonError("slow_consumer_timeout", "Downstream consumer did not drain in time", 503));
         }
         input.ws.data.pending.delete(input.requestId);
-        slowConsumerStats.droppedRequests += 1;
+        input.slowConsumerStats.droppedRequests += 1;
       }, input.slowConsumerTimeoutMs);
     }
     return;
@@ -903,13 +1388,47 @@ async function tunnelHttpRequest(input) {
       const entry = input.ws.data.pending.get(requestId);
       if (!entry) return;
       drainPendingChunks(entry);
+    },
+    cancel() {
+      const entry = input.ws.data.pending.get(requestId);
+      if (!entry) return;
+      input.ws.data.pending.delete(requestId);
+      clearPendingTimers(entry);
+      entry.pendingChunks.length = 0;
+      entry.bytesQueued = 0;
+      if (input.ws.readyState === WebSocket.OPEN) {
+        input.ws.send(JSON.stringify({
+          type: "http.response.flow",
+          protocol: TUNNEL_PROTOCOL_VERSION,
+          request_id: requestId,
+          paused: false,
+          reason: "closed"
+        }));
+      }
     }
   }, new ByteLengthQueuingStrategy({ highWaterMark: input.slowConsumerHighWaterMarkBytes }));
   const pending = new Promise((resolve, reject) => {
     const timeout = setTimeout(() => {
+      const entry = input.ws.data.pending.get(requestId);
+      if (!entry) return;
       input.ws.data.pending.delete(requestId);
-      reject(new Error("User-hosted tunnel response timed out"));
-    }, 3e4);
+      if (entry.responseStarted) {
+        clearPendingTimers(entry);
+        entry.pendingChunks.length = 0;
+        entry.bytesQueued = 0;
+        try {
+          entry.controller.close();
+        } catch {
+        }
+        return;
+      }
+      const error = new Error("User-hosted tunnel response timed out");
+      failPendingHttpResponse({
+        entry,
+        response: corsJsonError(input.request, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
+        error
+      });
+    }, input.responseTimeoutMs);
     input.ws.data.pending.set(requestId, {
       controller,
       stream,
@@ -921,7 +1440,13 @@ async function tunnelHttpRequest(input) {
       responseStarted: false
     });
   });
-  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : encoded(await input.request.arrayBuffer());
+  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.requestBodyMaxBytes);
+  if (body && "response" in body) {
+    const entry = input.ws.data.pending.get(requestId);
+    if (entry) clearPendingTimers(entry);
+    input.ws.data.pending.delete(requestId);
+    return body.response;
+  }
   input.ws.send(JSON.stringify({
     type: "http.request",
     protocol: TUNNEL_PROTOCOL_VERSION,
@@ -937,33 +1462,81 @@ async function tunnelHttpRequest(input) {
       // cookies to the host process running on the user's laptop.
       { userHosted: true }
     )),
-    ...body ? { body_base64: body } : {},
+    ...body?.bodyBase64 ? { body_base64: body.bodyBase64 } : {},
     end: true
   }));
   return await pending;
 }
+async function readBoundedBody(request, maxBytes) {
+  if (!request.body) return void 0;
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const next = await reader.read();
+    if (next.done) break;
+    total += next.value.byteLength;
+    if (total > maxBytes) {
+      try {
+        await reader.cancel();
+      } catch {
+      }
+      return {
+        response: corsJsonError(request, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
+      };
+    }
+    chunks.push(next.value);
+  }
+  const body = new Uint8Array(total);
+  chunks.reduce((offset, chunk) => {
+    body.set(chunk, offset);
+    return offset + chunk.byteLength;
+  }, 0);
+  return { bodyBase64: encoded(body.buffer) };
+}
 async function directHttpRequest(input) {
-  const init = {
-    method: input.request.method,
-    headers: workspaceRelayForwardHeaders(
-      input.request.headers,
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
+  const span = (name, run) => input.trace ? input.trace.span(name, run) : run();
+  try {
+    const init = workspaceRelayForwardRequestInit(
+      input.request,
       input.relayHostToken,
       input.workspaceId,
-      // T26: cloud-vm direct path. Cookies pass through (default) — workspace
-      // dashboards in the VM may legitimately need session cookies.
-      { userHosted: false }
-    ),
-    body: input.request.body,
-    duplex: "half",
-    redirect: "manual"
-  };
-  if (input.request.method === "GET" || input.request.method === "HEAD") delete init.body;
-  const upstream = await fetch(input.targetUrl, init);
-  return new Response(upstream.body, {
-    status: upstream.status,
-    statusText: upstream.statusText,
-    headers: relayCorsHeaders(input.request, upstream.headers)
-  });
+      {
+        // T26: cloud-vm direct path. Cookies pass through (default) — workspace
+        // dashboards in the VM may legitimately need session cookies.
+        userHosted: false,
+        upstreamHeaders: input.upstreamHeaders,
+        signal: controller.signal
+      }
+    );
+    if (input.request.method !== "GET" && input.request.method !== "HEAD" && input.request.body) {
+      init.body = await input.request.arrayBuffer();
+    }
+    const limiter = input.limiter;
+    const release = limiter ? await span("direct-http-queue", () => limiter.acquire()) : void 0;
+    try {
+      const upstream = await span("upstream-fetch", async () => await fetch(input.targetUrl, init));
+      return new Response(upstream.body, {
+        status: upstream.status,
+        statusText: upstream.statusText,
+        headers: relayCorsHeaders(input.request, upstream.headers)
+      });
+    } finally {
+      release?.();
+    }
+  } catch (err) {
+    const aborted = err instanceof Error && err.name === "AbortError";
+    return corsJsonError(
+      input.request,
+      aborted ? "upstream_timeout" : "upstream_unavailable",
+      aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable",
+      aborted ? 504 : 503
+    );
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function hostTunnel(hostTunnels, hostId) {
   const tunnel = hostTunnels.get(hostId);
@@ -984,12 +1557,30 @@ async function authorizeHostTunnel(options, bunOptions, request, input) {
 }
 function createWorkspaceRelayBun(options, bunOptions = {}) {
   const hostTunnels = /* @__PURE__ */ new Map();
+  const relayClients = /* @__PURE__ */ new Set();
   const hostTunnelRegistrations = /* @__PURE__ */ new Map();
+  const directHttpLimiter = createDirectHttpLimiter(bunOptions.directHttpConcurrency);
+  const hostTunnelStateDebounce = /* @__PURE__ */ new Map();
+  const fragmentationStats = createFragmentationStats();
+  const slowConsumerStats = createSlowConsumerStats();
+  const telemetry = {
+    getFragmentationStats: () => readFragmentationStats(fragmentationStats),
+    resetFragmentationStats: () => resetFragmentationStats(fragmentationStats),
+    getSlowConsumerStats: () => readSlowConsumerStats(slowConsumerStats),
+    resetSlowConsumerStats: () => resetSlowConsumerStats(slowConsumerStats)
+  };
   let draining = false;
   const drainController = {
     isDraining: () => draining,
     setDraining: (value) => {
       draining = value;
+      if (!value) return;
+      for (const tunnel of hostTunnels.values()) {
+        closeWebSocket(tunnel, 1012, "Workspace relay is draining", 1012);
+      }
+      for (const client of relayClients) {
+        closeWebSocket(client, 1012, "Workspace relay is draining", 1012);
+      }
     },
     pendingCount: () => {
       let total = 0;
@@ -1012,8 +1603,8 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
     }
   };
   const mergedMetricsSources = {
-    fragmentation: options.metricsSources?.fragmentation ?? getFragmentationStats,
-    slowConsumer: options.metricsSources?.slowConsumer ?? getSlowConsumerStats,
+    fragmentation: options.metricsSources?.fragmentation ?? telemetry.getFragmentationStats,
+    slowConsumer: options.metricsSources?.slowConsumer ?? telemetry.getSlowConsumerStats,
     drainPending: options.metricsSources?.drainPending ?? drainController.pendingCount
   };
   const requestRemoteAddress = /* @__PURE__ */ new WeakMap();
@@ -1027,7 +1618,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
   function getRegistrationTracker(hostId) {
     let tracker = hostTunnelRegistrations.get(hostId);
     if (!tracker) {
-      tracker = { current: 0, recent: [] };
+      tracker = { recent: [] };
       hostTunnelRegistrations.set(hostId, tracker);
     }
     return tracker;
@@ -1048,6 +1639,12 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         if (ip) requestRemoteAddress.set(request, ip);
       } catch {
       }
+      if (url.pathname === "/health") {
+        return Response.json(
+          draining ? { ok: false, service: "workspace-relay", draining: true } : { ok: true, service: "workspace-relay" },
+          { status: draining ? 503 : 200 }
+        );
+      }
       if (draining && websocketRequest(request) && hostId) {
         return jsonError(
           "relay_draining",
@@ -1077,13 +1674,6 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         const tracker = getRegistrationTracker(hostId);
         const now = Date.now();
         pruneReconnects(tracker, now);
-        if (tracker.current >= HOST_TUNNEL_REGISTRATION_CONCURRENT_CAP) {
-          return jsonError(
-            "too_many_concurrent_host_tunnels",
-            "Too many concurrent host-tunnel registrations for this host",
-            429
-          );
-        }
         if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
           return jsonError(
             "too_many_host_tunnel_reconnects",
@@ -1098,10 +1688,10 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             workspaceIds,
             pending: /* @__PURE__ */ new Map(),
             channels: /* @__PURE__ */ new Map(),
+            missedPongs: 0,
             messageBuffer: ""
           }
         })) {
-          tracker.current += 1;
           tracker.recent.push(now);
           return;
         }
@@ -1114,32 +1704,45 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           headers: relayCorsHeaders(request)
         });
       }
-      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
-      if (!relay.ok) return relay.response;
-      if (!websocketRequest(request) && relay.request.target.access === "user-hosted") {
-        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
-        return tunnel ? await tunnelHttpRequest({
-          ws: tunnel,
-          request,
-          workspaceId: relay.request.target.workspaceId,
-          path: `${relay.request.path}${url.search}`,
-          relayHostToken: relay.request.relayHostToken,
-          slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
-          slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
-        }) : new Response("User-hosted workspace is offline", { status: 503 });
-      }
       if (!websocketRequest(request)) {
-        return await directHttpRequest({
-          request,
-          targetUrl: workspaceRelayTargetUrl(
-            relay.request.target,
-            relay.request.path,
-            url.search
-          ).toString(),
-          relayHostToken: relay.request.relayHostToken,
-          workspaceId: relay.request.target.workspaceId
+        const trace = createWorkspaceRelayTrace();
+        const response = await trace.span("relay-total", async () => {
+          const relay2 = await authorizeWorkspaceRelayRequest(options, request, workspaceId, trace);
+          if (!relay2.ok) return relay2.response;
+          if (relay2.request.target.access === "user-hosted") {
+            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId);
+            return tunnel ? await trace.span("tunnel-http", async () => await tunnelHttpRequest({
+              ws: tunnel,
+              request,
+              workspaceId: relay2.request.target.workspaceId,
+              path: `${relay2.request.path}${url.search}`,
+              relayHostToken: relay2.request.relayHostToken,
+              slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
+              slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
+              slowConsumerStats,
+              requestBodyMaxBytes: bunOptions.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT,
+              responseTimeoutMs: bunOptions.tunnelHttpResponseTimeoutMs ?? TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT
+            })) : new Response("User-hosted workspace is offline", { status: 503 });
+          }
+          return await directHttpRequest({
+            request,
+            targetUrl: workspaceRelayTargetUrl(
+              relay2.request.target,
+              relay2.request.path,
+              url.search
+            ).toString(),
+            relayHostToken: relay2.request.relayHostToken,
+            workspaceId: relay2.request.target.workspaceId,
+            upstreamHeaders: relay2.request.target.upstreamHeaders,
+            timeoutMs: bunOptions.directHttpTimeoutMs ?? DIRECT_HTTP_TIMEOUT_MS_DEFAULT,
+            limiter: directHttpLimiter,
+            trace
+          });
         });
+        return workspaceRelayTimingResponse(response, trace);
       }
+      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
+      if (!relay.ok) return relay.response;
       const originDenied = requireAllowedOrigin(request);
       if (originDenied) return originDenied;
       if (relay.request.target.access === "user-hosted") {
@@ -1181,9 +1784,17 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             relay.request.relayHostToken,
             relay.request.target.workspaceId,
             // T26: cloud-vm WS upgrade. Cookies pass through (default).
-            { userHosted: false }
+            { userHosted: false, upstreamHeaders: relay.request.target.upstreamHeaders }
           )),
-          queue: []
+          queue: [],
+          ...relayWebSocketTraceEnabled(request) ? {
+            trace: {
+              acceptedAt: performance.now(),
+              queuedFrames: 0,
+              maxQueuedDelayMs: 0,
+              emitted: false
+            }
+          } : {}
         }
       })) {
         return;
@@ -1196,22 +1807,39 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         if (ws.data.kind === "host-tunnel") {
           const parsed = tunnelMessage(
             ws,
-            message
+            message,
+            fragmentationStats
           );
           if (parsed?.type === "ping") {
             options.directory?.recordPong(ws.data.hostId);
             ws.send(JSON.stringify(makeTunnelPong(parsed)));
           }
           if (parsed?.type === "pong") {
+            ws.data.missedPongs = 0;
             options.directory?.recordPong(ws.data.hostId);
           }
+          if (parsed?.type === "error") {
+            if (parsed.request_id) {
+              const pending = ws.data.pending.get(parsed.request_id);
+              if (pending) {
+                ws.data.pending.delete(parsed.request_id);
+                failPendingHttpResponse({
+                  entry: pending,
+                  response: jsonError(parsed.code, parsed.message, 502),
+                  error: new Error(parsed.message)
+                });
+              }
+            }
+          }
           if (parsed?.type === "http.response.start") {
             const pending = ws.data.pending.get(parsed.request_id);
             if (pending) {
+              const response = parsed;
               pending.responseStarted = true;
+              if (isEventStream(response.headers)) clearTimeout(pending.timeout);
               pending.resolve(new Response(pending.stream, {
-                status: parsed.status,
-                headers: headers(parsed.headers)
+                status: response.status,
+                headers: headers(response.headers)
               }));
             }
           }
@@ -1223,7 +1851,8 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
                 requestId: parsed.request_id,
                 entry,
                 chunk: decoded(parsed.body_base64),
-                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
+                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
+                slowConsumerStats
               });
             }
           }
@@ -1256,14 +1885,24 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }
           if (parsed?.type === "ws.frame") {
             const frame = parsed;
-            ws.data.channels.get(frame.channel_id)?.send(decodedFrame(frame));
+            const channel = ws.data.channels.get(frame.channel_id);
+            if (!channel || channel.readyState !== WebSocket.OPEN) {
+              ws.data.channels.delete(frame.channel_id);
+              return;
+            }
+            if (channel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
+              ws.data.channels.delete(frame.channel_id);
+              closeWebSocket(channel, 1011, "Client WebSocket backpressure limit exceeded");
+              return;
+            }
+            channel.send(decodedFrame(frame));
           }
           if (parsed?.type === "ws.close") {
             const close = parsed;
             const channel = ws.data.channels.get(close.channel_id);
             if (channel) {
               ws.data.channels.delete(close.channel_id);
-              channel.close(close.code, close.reason);
+              closeWebSocket(channel, close.code, close.reason);
             }
           }
           return;
@@ -1274,6 +1913,10 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             ws.close(1011, "User-hosted tunnel disconnected");
             return;
           }
+          if (tunnel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
+            closeWebSocket(ws, 1011, "Host tunnel backpressure limit exceeded");
+            return;
+          }
           tunnel.send(JSON.stringify({
             type: "ws.frame",
             protocol: TUNNEL_PROTOCOL_VERSION,
@@ -1286,19 +1929,41 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           ws.data.upstream.send(message);
           return;
         }
-        ws.data.queue.push(message);
+        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT)) {
+          closeWebSocket(ws, 1011, "Upstream WebSocket queue limit exceeded");
+          return;
+        }
+        ws.data.queue.push({ payload: message, queuedAt: performance.now() });
       },
       open(ws) {
         if (ws.data.kind === "host-tunnel") {
+          const previous = hostTunnels.get(ws.data.hostId);
+          if (previous && previous !== ws) {
+            cleanupHostTunnelSocket({
+              ws: previous,
+              hostTunnels,
+              hostTunnelStateDebounce,
+              options,
+              bunOptions,
+              disconnectDirectory: false,
+              closeChannels: true
+            });
+            closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
+          }
           hostTunnels.set(ws.data.hostId, ws);
           options.directory?.registerHostTunnel({
             hostId: ws.data.hostId,
             workspaceIds: ws.data.workspaceIds
           });
           ws.data.heartbeat = setInterval(() => {
-            sendTunnelPing(ws);
+            const hostWs = ws;
+            if (hostWs.data.missedPongs > (bunOptions.hostTunnelMaxMissedPongs ?? HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT)) {
+              closeWebSocket(ws, 1001, "Host tunnel heartbeat timed out", 1001);
+              return;
+            }
+            sendTunnelPing(hostWs);
           }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
-          scheduleHostTunnelStateChange(options, {
+          scheduleHostTunnelStateChange(hostTunnelStateDebounce, options, {
             hostId: ws.data.hostId,
             workspaceId: ws.data.workspaceIds[0],
             path: `/host-tunnels/${ws.data.hostId}`,
@@ -1314,6 +1979,10 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             return;
           }
           tunnel.data.channels.set(ws.data.channelId, ws);
+          if (tunnel.readyState !== WebSocket.OPEN) {
+            closeWebSocket(ws, 1011, "User-hosted tunnel disconnected");
+            return;
+          }
           tunnel.send(JSON.stringify({
             type: "ws.open",
             protocol: TUNNEL_PROTOCOL_VERSION,
@@ -1332,73 +2001,95 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }));
           return;
         }
+        relayClients.add(ws);
         const data = ws.data;
-        const upstream = new WebSocket(data.upstreamUrl, {
+        const UpstreamWebSocket = bunOptions.upstreamWebSocket ?? WebSocket;
+        if (data.trace) data.trace.upstreamStartedAt = performance.now();
+        const upstream = new UpstreamWebSocket(data.upstreamUrl, {
           headers: data.headers
         });
         upstream.binaryType = "arraybuffer";
         data.upstream = upstream;
+        data.upstreamOpenTimer = setTimeout(() => {
+          if (upstream.readyState === WebSocket.OPEN) return;
+          closeWebSocket(upstream, 1001, "Upstream WebSocket open timed out", 1001);
+          closeWebSocket(ws, 1011, "Upstream WebSocket open timed out");
+        }, bunOptions.upstreamWebSocketOpenTimeoutMs ?? UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT);
         upstream.onopen = () => {
-          for (const item of data.queue.splice(0)) upstream.send(item);
+          const openedAt = performance.now();
+          if (data.upstreamOpenTimer) {
+            clearTimeout(data.upstreamOpenTimer);
+            data.upstreamOpenTimer = void 0;
+          }
+          if (data.trace) {
+            data.trace.upstreamOpenMs = openedAt - (data.trace.upstreamStartedAt ?? data.trace.acceptedAt);
+            data.trace.queuedFrames = data.queue.length;
+            data.trace.maxQueuedDelayMs = data.queue.reduce(
+              (max, item) => Math.max(max, openedAt - item.queuedAt),
+              0
+            );
+            sendRelayWebSocketTrace(ws);
+          }
+          for (const item of data.queue.splice(0)) upstream.send(item.payload);
         };
         upstream.onmessage = (event) => {
           const payload = relayWebSocketPayload(event.data);
           if (payload !== void 0) ws.send(payload);
         };
         upstream.onclose = (event) => {
-          ws.close(event.code, event.reason);
+          if (data.upstreamOpenTimer) {
+            clearTimeout(data.upstreamOpenTimer);
+            data.upstreamOpenTimer = void 0;
+          }
+          closeWebSocket(ws, event.code, upstreamCloseReason(event));
         };
         upstream.onerror = () => {
-          ws.close(1011, "Upstream WebSocket connection failed");
+          if (data.upstreamOpenTimer) {
+            clearTimeout(data.upstreamOpenTimer);
+            data.upstreamOpenTimer = void 0;
+          }
+          closeWebSocket(ws, 1011, "Upstream WebSocket connection failed");
         };
       },
       close(ws, code, reason) {
         if (ws.data.kind === "host-tunnel") {
-          if (ws.data.heartbeat) clearInterval(ws.data.heartbeat);
-          hostTunnels.delete(ws.data.hostId);
+          cleanupHostTunnelSocket({
+            ws,
+            hostTunnels,
+            hostTunnelStateDebounce,
+            options,
+            bunOptions,
+            disconnectDirectory: true,
+            closeChannels: true
+          });
           const tracker = hostTunnelRegistrations.get(ws.data.hostId);
           if (tracker) {
-            tracker.current = Math.max(0, tracker.current - 1);
             pruneReconnects(tracker, Date.now());
-            if (tracker.current === 0 && tracker.recent.length === 0) {
-              hostTunnelRegistrations.delete(ws.data.hostId);
-            }
-          }
-          for (const pending of ws.data.pending.values()) {
-            clearTimeout(pending.timeout);
-            pending.reject(new Error("User-hosted tunnel disconnected"));
+            if (tracker.recent.length === 0) hostTunnelRegistrations.delete(ws.data.hostId);
           }
-          ws.data.pending.clear();
-          for (const channel of ws.data.channels.values()) {
-            channel.close(1011, "User-hosted tunnel disconnected");
-          }
-          ws.data.channels.clear();
-          options.directory?.disconnectHost(ws.data.hostId);
-          scheduleHostTunnelStateChange(options, {
-            hostId: ws.data.hostId,
-            workspaceId: ws.data.workspaceIds[0],
-            path: `/host-tunnels/${ws.data.hostId}`,
-            state: "disconnected",
-            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-          });
           return;
         }
         if (ws.data.kind === "user-hosted-client") {
           const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
           tunnel?.data.channels.delete(ws.data.channelId);
-          tunnel?.send(JSON.stringify({
-            type: "ws.close",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            code,
-            reason
-          }));
+          if (tunnel?.readyState === WebSocket.OPEN) {
+            tunnel.send(JSON.stringify({
+              type: "ws.close",
+              protocol: TUNNEL_PROTOCOL_VERSION,
+              channel_id: ws.data.channelId,
+              code: safeCloseCode(code, 1e3),
+              reason
+            }));
+          }
           return;
         }
-        ws.data.upstream?.close(code, reason);
+        relayClients.delete(ws);
+        if (ws.data.upstreamOpenTimer) clearTimeout(ws.data.upstreamOpenTimer);
+        if (ws.data.upstream) closeWebSocket(ws.data.upstream, code, reason, 1e3);
       }
     },
-    drain: drainController
+    drain: drainController,
+    telemetry
   };
 }
 
@@ -1600,10 +2291,17 @@ function startSyntheticProbe(options) {
 }
 
 // src/main.ts
+var BUN_TARGET_CACHE_TTL_MS_DEFAULT = 3e4;
+var BUN_REVOCATION_CACHE_TTL_MS_DEFAULT = 1e4;
+var BUN_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
 function clean(input) {
   const value = input?.trim();
   return value ? value : void 0;
 }
+function positiveInteger(input) {
+  const parsed = Number(clean(input));
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : void 0;
+}
 function pem(input) {
   return clean(input)?.replaceAll("\\n", "\n");
 }
@@ -1710,25 +2408,31 @@ function parseAuditAcceptSampleRate(env) {
 function parseMetricsToken(env) {
   return clean(env.CLAXEDO_RELAY_METRICS_TOKEN);
 }
-function createCachedRevocationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 1e4;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const entry = cache.get(args.jti);
-    const at = now();
-    if (entry && entry.expiresAt > at) {
-      return entry.result;
-    }
-    const result = await inner(args);
-    cache.set(args.jti, { result, expiresAt: at + ttlMs });
-    return result;
+function runtimeAccessTokenCacheTtlMsFromEnv(env) {
+  return positiveInteger(env.CLAXEDO_RELAY_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS) ?? BUN_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
+}
+function directHttpConcurrencyFromEnv(env) {
+  return positiveInteger(env.CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY);
+}
+function resolverClientCacheOptionsFromEnv(env) {
+  return {
+    targetCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_TARGET_CACHE_TTL_MS) ?? BUN_TARGET_CACHE_TTL_MS_DEFAULT,
+    revocationCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS) ?? BUN_REVOCATION_CACHE_TTL_MS_DEFAULT
   };
 }
-function createResolverClient(baseUrl, token) {
+function createResolverClient(baseUrl, token, options = {}) {
   const headers2 = { accept: "application/json" };
   if (token) headers2.authorization = `Bearer ${token}`;
   const root = baseUrl.replace(/\/+$/, "");
+  const targetUncached = async (args) => {
+    const url = new URL(`${root}/target`);
+    url.searchParams.set("workspaceId", args.workspaceId);
+    url.searchParams.set("hostId", args.hostId);
+    const res = await fetch(url, { headers: headers2 });
+    if (res.status === 404) return void 0;
+    if (!res.ok) throw new Error(`relay target resolver failed: ${res.status} ${await res.text()}`);
+    return await res.json();
+  };
   const revocationUncached = async (args) => {
     const url = new URL(`${root}/revocation`);
     url.searchParams.set("jti", args.jti);
@@ -1744,17 +2448,14 @@ function createResolverClient(baseUrl, token) {
     }
     return await res.json();
   };
-  const revocation = createCachedRevocationClient(revocationUncached);
+  const target = createCachedTargetClient(targetUncached, {
+    ttlMs: options.targetCacheTtlMs ?? BUN_TARGET_CACHE_TTL_MS_DEFAULT
+  });
+  const revocation = createCachedRevocationClient(revocationUncached, {
+    ttlMs: options.revocationCacheTtlMs ?? BUN_REVOCATION_CACHE_TTL_MS_DEFAULT
+  });
   return {
-    async target(workspaceId, hostId) {
-      const url = new URL(`${root}/target`);
-      url.searchParams.set("workspaceId", workspaceId);
-      url.searchParams.set("hostId", hostId);
-      const res = await fetch(url, { headers: headers2 });
-      if (res.status === 404) return void 0;
-      if (!res.ok) throw new Error(`relay target resolver failed: ${res.status} ${await res.text()}`);
-      return await res.json();
-    },
+    target: (workspaceId, hostId) => target({ workspaceId, hostId }),
     revocation
   };
 }
@@ -1806,6 +2507,47 @@ function installShutdownDrainHandler(options) {
     isShuttingDown: () => shuttingDown
   };
 }
+function installFatalProcessHandlers(options) {
+  const exit = options.exit ?? ((code) => process.exit(code));
+  const log = options.log ?? (() => {
+  });
+  const register = options.register ?? true;
+  let fatal = false;
+  let pending;
+  async function trigger(error, source) {
+    if (pending) return pending;
+    fatal = true;
+    pending = (async () => {
+      const message = error instanceof Error ? `${error.name}: ${error.message}` : String(error);
+      log(`[workspace-relay] fatal ${source}: ${message}`);
+      options.drain.setDraining(true);
+      try {
+        await options.stopServer?.();
+      } catch (err) {
+        log(`[workspace-relay] fatal stopServer failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      try {
+        options.directory.dispose();
+      } catch (err) {
+        log(`[workspace-relay] fatal directory.dispose() failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+      exit(1);
+    })();
+    return pending;
+  }
+  if (register) {
+    process.on("uncaughtException", (err) => {
+      void trigger(err, "uncaughtException");
+    });
+    process.on("unhandledRejection", (err) => {
+      void trigger(err, "unhandledRejection");
+    });
+  }
+  return {
+    trigger,
+    isFatal: () => fatal
+  };
+}
 async function main() {
   const validation = validateProductionEnv({
     NODE_ENV: process.env.NODE_ENV,
@@ -1850,7 +2592,10 @@ async function main() {
   const relayHostSigningKey = relayHostMaterial.privateKey;
   const relayHostPublicKeys = [relayHostMaterial.current];
   if (relayHostMaterial.next) relayHostPublicKeys.push(relayHostMaterial.next);
-  const resolver = createResolverClient(resolverUrl, resolverToken);
+  const resolver = createResolverClient(resolverUrl, resolverToken, resolverClientCacheOptionsFromEnv({
+    CLAXEDO_RELAY_TARGET_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_TARGET_CACHE_TTL_MS,
+    CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS
+  }));
   const directory = createWorkspaceRelayDirectory();
   const auditAcceptSampleRate = parseAuditAcceptSampleRate({
     CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE: process.env.CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE,
@@ -1859,8 +2604,15 @@ async function main() {
   const metricsToken = parseMetricsToken({
     CLAXEDO_RELAY_METRICS_TOKEN: process.env.CLAXEDO_RELAY_METRICS_TOKEN
   });
+  const runtimeAccessTokenCacheTtlMs2 = runtimeAccessTokenCacheTtlMsFromEnv({
+    CLAXEDO_RELAY_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS
+  });
+  const directHttpConcurrency = directHttpConcurrencyFromEnv({
+    CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY: process.env.CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY
+  });
   const handler = createWorkspaceRelayBun({
     runtimeAccessKey,
+    runtimeAccessTokenCacheTtlMs: runtimeAccessTokenCacheTtlMs2,
     relayHostSigningKey,
     relayHostAlgorithm: "EdDSA",
     relayHostPublicKeys,
@@ -1881,6 +2633,8 @@ async function main() {
         );
       }
     }
+  }, {
+    ...directHttpConcurrency ? { directHttpConcurrency } : {}
   });
   const server = Bun.serve({
     port,
@@ -1914,6 +2668,15 @@ async function main() {
       syntheticProbe?.stop();
     }
   });
+  installFatalProcessHandlers({
+    drain: handler.drain,
+    directory,
+    log: (message) => console.error(message),
+    stopServer: async () => {
+      server.stop(true);
+      syntheticProbe?.stop();
+    }
+  });
   void exportPKCS8;
 }
 if (import.meta.main) {
@@ -1924,10 +2687,16 @@ if (import.meta.main) {
 }
 export {
   createCachedRevocationClient,
+  createCachedTargetClient,
+  createResolverClient,
+  directHttpConcurrencyFromEnv,
+  installFatalProcessHandlers,
   installShutdownDrainHandler,
   loadRelayHostKeyMaterial,
   loadRuntimeAccessKeyOrJwks,
   parseAuditAcceptSampleRate,
   parseMetricsToken,
+  resolverClientCacheOptionsFromEnv,
+  runtimeAccessTokenCacheTtlMsFromEnv,
   validateProductionEnv
 };