@claxedo/workspace-relay 0.1.0 → 0.5.1

package/README.md

@@ -1,9 +1,82 @@
 # `@claxedo/workspace-relay`
 
-The Claxedo workspace relay — a single canonical bidirectional tunnel
-between cloud-hosted browsers and workspace-runtime hosts (whether the
-host is a cloud VM or a user laptop). One package, one process, one
-config surface — there is no separate `dev-relay` codepath.
+The Claxedo workspace relay — the single canonical tunnel process between
+cloud-hosted browsers and workspace-runtime hosts, whether the host is a cloud
+VM or a user laptop. One package, one process, one config surface — there is no
+separate `dev-relay` codepath.
+
+Production v1 is deliberately single-instance for user-hosted traffic. The
+relay keeps host presence and host-tunnel sockets in process-local maps, and a
+`hostId` has exactly one active tunnel at a time. Deploy one active relay
+process per user-hosted relay fleet; horizontal scaling needs a future routing
+owner for sticky host tunnels, split-brain prevention, and failover. A relay
+process, VM, or region failure drops existing user-hosted HTTP, WebSocket, SSE,
+and PTY sessions until workspace runtimes reconnect.
+
+## Deployment Security
+
+The relay is a public edge service for workspace traffic, but it is not the
+identity provider or policy database. It verifies short-lived runtime access
+tokens, calls the configured target resolver/revocation callback, and forwards
+accepted traffic to the selected host with a freshly minted relay-host token.
+
+| Token | Default TTL | Issuer | Audience | Purpose |
+| --- | ---: | --- | --- | --- |
+| Runtime Access Token (RAT) | 30 minutes | `claxedo-control-plane` | `workspace-relay` | User/browser authorization to reach one workspace and host through the relay. |
+| Host Tunnel Token (HTT) | 5 minutes | `claxedo-control-plane` | `workspace-relay-host-tunnel` | Workspace runtime authorization to register a user-hosted tunnel. |
+| Relay Host Token (RHT) | 60 seconds | `workspace-relay` | `workspace-host-service` | Per-request relay-to-host authorization minted after RAT validation. |
+
+Runtime access tokens and host tunnel tokens bind issuer, audience, subject,
+workspace id, host id, expiry, issue time, and JTI. Runtime access tokens also
+bind role. Relay-host tokens additionally bind the deployment pair:
+`cloud/cloud-vm` or `user-hosted/local-worktree`.
+
+### Revocation And Active Checks
+
+`isRuntimeAccessTokenActive` is the revocation/target freshness hook. Production
+deployments should implement it by calling the control plane or an equivalent
+authority on every new HTTP request and WebSocket upgrade. A false result
+rejects before forwarding to the host.
+
+Long-lived relayed sockets are authorized at establishment time. Already-open
+SSE, PTY, and WebSocket streams may live until normal close, reconnect, relay
+drain, host disconnect, or process restart. If immediate stream revocation is a
+requirement, the control plane must also close the session/runtime channel.
+
+### Forwarding Boundary
+
+The relay strips client-supplied `x-forwarded-for`, `x-forwarded-host`,
+`x-forwarded-proto`, `x-real-ip`, `x-claxedo-internal-*`, and `x-supervisor-*`
+headers. It replaces `Authorization` with an RHT, sets `x-workspace-id`, and
+adds `x-forwarded-by: workspace-relay`.
+
+For user-hosted targets, `Cookie` is stripped before forwarding. User-hosted
+workspace processes may run near a developer's local browser cookie jar, so
+browser cookies must not be passed through to the local host service. Cloud VM
+targets may receive cookies when the caller intentionally sends them.
+
+### CORS
+
+The relay owns CORS responses for browser-facing workspace requests. Do not
+forward upstream CORS headers as the source of truth. Add allowed product
+origins in the relay/server CORS configuration and keep wildcard origins out of
+credentialed deployments.
+
+### Metrics
+
+`GET /metrics` is privileged operational data. In production, set
+`CLAXEDO_RELAY_METRICS_TOKEN` and scrape with `Authorization: Bearer <token>`.
+When no metrics token is configured, the endpoint only allows callers that the
+adapter identifies as loopback; if no remote-address resolver exists, it fails
+closed.
+
+### User-Hosted Topology
+
+Production v1 supports one active relay instance for user-hosted traffic, or a
+load balancer with strict stickiness that keeps each `hostId` on the relay
+process that owns its tunnel socket. Non-sticky horizontal scaling needs an
+external directory and tunnel routing owner before it is safe to advertise as
+durable.
 
 ## Why one package, no parallel impl
 
@@ -24,7 +97,7 @@ Re-exported from [`src/index.ts`](src/index.ts):
 | Concern | Module | Notable exports |
 | --- | --- | --- |
 | Token issuance / verification | [`src/auth.ts`](src/auth.ts) | `mintRuntimeAccessToken`, `verifyRuntimeAccessToken`, `mintRelayHostToken`, `verifyRelayHostToken`, `mintHostTunnelToken`, `verifyHostTunnelToken`, types `RelayRole`, `RelayAccess`, `RelayBacking`, `RelayJwtAlgorithm`, `RuntimeAccessTokenClaims`, `RelayKey`, `RelayKeyResolver`, error class `WorkspaceRelayAuthError` |
-| Hono HTTP surface | [`src/server.ts`](src/server.ts) | `createWorkspaceRelayServer`, types `WorkspaceRelayOptions`, `WorkspaceRelayTarget`, `RuntimeAccessTokenActiveResult`, `WorkspaceRelayAuditEvent`, `WorkspaceRelayMetricsSources`, `RelayHostPublicKey` |
+| Hono HTTP surface | [`src/server.ts`](src/server.ts) | `createWorkspaceRelay`, `authorizeWorkspaceRelayRequest`, types `WorkspaceRelayOptions`, `WorkspaceRelayTarget`, `RuntimeAccessTokenActiveResult`, `WorkspaceRelayAuditEvent`, `WorkspaceRelayMetricsSources`, `RelayHostPublicKey` |
 | Active-host directory | [`src/directory.ts`](src/directory.ts) | `createWorkspaceRelayDirectory`, `disposeWorkspaceRelayDirectory`, types `WorkspaceRelayDirectory`, `HostTunnelPresence` |
 | Bun-specific server bootstrap | [`src/bun.ts`](src/bun.ts) | `createWorkspaceRelayBun`, type `WorkspaceRelayBunOptions`, `WorkspaceRelayBunDrainController`, metrics `getFragmentationStats`, `getSlowConsumerStats` |
 
@@ -50,14 +123,20 @@ production fail-closed gate at `src/main.ts`.
 | `CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM` | Inline public key (alternative to JWKS). |
 | `CLAXEDO_RELAY_HOST_VERIFY_PEM` | Public PEM the relay uses to verify host-tunnel tokens. |
 | `CLAXEDO_RELAY_HOST_SIGNING_KEY_PEM` | Private PEM the relay uses to mint relay-host tokens. |
+| `CLAXEDO_RELAY_METRICS_TOKEN` | Optional bearer token for `/metrics`. Without it, `/metrics` requires a trusted loopback remote-address resolver. |
+| `CLAXEDO_RELAY_DRAIN_TIMEOUT_MS` | Graceful shutdown wait before force-closing sockets. Defaults to 30000. |
 | `NODE_ENV` | `production` / `development` / `test`. Switches the production fail-closed gate. |
 
 Token verification is pluggable today via the
 `RelayKey | RelayKeyResolver` pair on `verifyRuntimeAccessToken` and
 friends, **and** via the unified
 [`TokenVerifier`](../workspace-relay-protocol/src/token-verifier.ts)
-interface in `@claxedo/workspace-relay-protocol`. To swap the relay's
-auth backend in a self-hosted deployment:
+interface in `@claxedo/workspace-relay-protocol`. A custom verifier is only the
+crypto/introspection authority; the relay still validates its output into
+`RuntimeAccessTokenClaims`, binds the URL workspace id to the claims, applies
+revocation, and allowlists roles. Missing, unknown, or malformed roles deny.
+
+To swap the relay's auth backend in a self-hosted deployment:
 
 ```ts
 import { createStaticTokenVerifier } from "@claxedo/workspace-relay-protocol"
@@ -67,8 +146,7 @@ const verifier = createStaticTokenVerifier({
     "tok-tenant-1": { subject: "u1", scopes: ["workspace:write"], claims: {} },
   },
 })
-// Pass `verifier` into a future `WorkspaceRelayOptions.tokenVerifier`
-// option when the relay accepts custom verification backends directly.
+// Pass `verifier` as `WorkspaceRelayOptions.tokenVerifier`.
 ```
 
 The `TokenVerifier` interface intentionally contains only `verify(token)`.
@@ -78,6 +156,62 @@ package: `createHttpTokenVerifier` for remote verifiers
 (Clerk-style introspection, custom OIDC), and `createStaticTokenVerifier`
 for tests and self-hosted single-tenant setups.
 
+`createHttpTokenVerifier` is a reference implementation. Its HTTPS endpoint is
+the crypto authority and must enforce issuer, audience, expiry, key selection,
+and replay policy before returning claims. Treat the endpoint as trusted
+operator configuration, not as tenant/user input.
+
+Long-lived relayed sockets are authorized at establishment. Revocation is
+checked for new HTTP requests and WebSocket upgrades; already-established
+WebSocket/SSE/PTY streams may live until their normal close, reconnect, relay
+drain, or process restart.
+
+## Tunnel Lifecycle
+
+Host-tunnel reconnects replace the old socket deterministically. Replacement
+cleans the old socket's pending HTTP responses, child WebSocket channels,
+heartbeat timer, and buffered work before installing the new socket. Stale close
+events identity-check the current owner before deleting presence, so an old
+socket cannot mark a replacement offline.
+
+Relay drain sets `/health` unhealthy, rejects new workspace requests and tunnel
+registrations with `503 relay_draining`, closes active host tunnels so runtimes
+reconnect promptly, waits for pending work up to the configured timeout, then
+stops the server. Truly uncaught exceptions and unhandled rejections are fatal:
+the relay marks itself draining, stops accepting work, disposes timers, and
+exits for supervisor restart.
+
+## External Directory Design
+
+The current `WorkspaceRelayDirectory` is an in-memory implementation of the
+directory contract:
+
+```ts
+type WorkspaceRelayDirectory = {
+  registerHostTunnel(input: { hostId: string; workspaceIds: string[] }): HostTunnelPresence
+  recordPong(hostId: string): HostTunnelPresence | undefined
+  disconnectHost(hostId: string): void
+  activeHost(input: { hostId: string; workspaceId: string }): HostTunnelPresence | undefined
+  sweep(): void
+  dispose(): void
+  size(): number
+}
+```
+
+A Redis, Durable Object, or equivalent implementation should keep the same
+semantics:
+
+- one active owner for a `hostId`;
+- TTL extension on heartbeat pong;
+- immediate removal on disconnect;
+- workspace membership checks before user-hosted forwarding;
+- split-brain prevention when a replacement tunnel connects;
+- observability for active host count and stale owner cleanup.
+
+The missing piece for true multi-instance user-hosted relay is not just durable
+presence storage. HTTP/WebSocket/SSE/PTY traffic must also route to the process
+or durable object that owns the live tunnel socket for that `hostId`.
+
 ## Routing
 
 The relay has **no** `/w/{workspaceId}/*` URL prefix of its own. The

package/dist/auth.d.ts

@@ -5,8 +5,15 @@ export declare const runtimeAccessTokenAudience = "workspace-relay";
 export declare const hostTunnelTokenAudience = "workspace-relay-host-tunnel";
 export declare const relayHostTokenIssuer = "workspace-relay";
 export declare const relayHostTokenAudience = "workspace-host-service";
-export type RelayAccess = "cloud" | "user-hosted";
-export type RelayBacking = "local-worktree" | "cloud-vm";
+export type RelayClaimPair = {
+    access: "cloud";
+    backing: "cloud-vm";
+} | {
+    access: "user-hosted";
+    backing: "local-worktree";
+};
+export type RelayAccess = RelayClaimPair["access"];
+export type RelayBacking = RelayClaimPair["backing"];
 export type RelayJwtAlgorithm = (typeof algorithms)[number];
 export type RelayRole = "viewer" | "editor" | "admin" | "owner";
 export type RuntimeAccessTokenClaims = {
@@ -28,12 +35,10 @@ export type RelayHostTokenClaims = {
     org_id: string;
     workspace_id: string;
     host_id: string;
-    access: RelayAccess;
-    backing: RelayBacking;
     exp: number;
     iat: number;
     jti: string;
-};
+} & RelayClaimPair;
 export type HostTunnelTokenClaims = {
     iss: typeof runtimeAccessTokenIssuer;
     aud: typeof hostTunnelTokenAudience;
@@ -58,9 +63,7 @@ type RuntimeInput = {
     jti?: string;
     now?: number;
 };
-type RelayHostInput = RuntimeInput & {
-    access: RelayAccess;
-    backing: RelayBacking;
+type RelayHostInput = RuntimeInput & RelayClaimPair & {
     /**
      * Optional `kid` to embed in the JWT protected header. Verifiers using a
      * JWKS resolver dispatch on this to pick the matching key, so a freshly
@@ -86,6 +89,10 @@ type ExpectedHostTunnel = {
     hostId: string;
     workspaceIds: string[];
 };
+export declare function isRelayClaimPair(input: {
+    access?: unknown;
+    backing?: unknown;
+}): input is RelayClaimPair;
 /**
  * Resolver function returned by `createRemoteJWKSet` / `createLocalJWKSet`.
  * Accepted by `jwtVerify` directly — jose dispatches based on whether the
@@ -100,6 +107,7 @@ export type RelayKey = CryptoKey | Uint8Array | RelayKeyResolver;
 type RelaySigningKey = CryptoKey | Uint8Array;
 export declare function mintRuntimeAccessToken(input: RuntimeInput, key: RelaySigningKey, alg: RelayJwtAlgorithm): Promise<string>;
 export declare function verifyRuntimeAccessToken(token: string, key: RelayKey, expected: ExpectedTarget): Promise<RuntimeAccessTokenClaims>;
+export declare function validateRuntimeAccessTokenClaims(input: Record<string, unknown>, expected: ExpectedTarget): RuntimeAccessTokenClaims;
 export declare function mintHostTunnelToken(input: HostTunnelInput, key: RelaySigningKey, alg: RelayJwtAlgorithm): Promise<string>;
 export declare function verifyHostTunnelToken(token: string, key: RelayKey, expected: ExpectedHostTunnel): Promise<HostTunnelTokenClaims>;
 export declare function mintRelayHostToken(input: RelayHostInput, key: RelaySigningKey, alg: RelayJwtAlgorithm): Promise<string>;

package/dist/bun.d.ts

@@ -3,8 +3,21 @@ type RelayClientWebSocketData = {
     kind: "client";
     upstreamUrl: string;
     headers: Record<string, string>;
-    queue: Array<string | Buffer<ArrayBuffer>>;
+    queue: Array<{
+        payload: string | Buffer<ArrayBuffer>;
+        queuedAt: number;
+    }>;
     upstream?: WebSocket;
+    upstreamOpenTimer?: ReturnType<typeof setTimeout>;
+    trace?: RelayClientWebSocketTrace;
+};
+type RelayClientWebSocketTrace = {
+    acceptedAt: number;
+    upstreamStartedAt?: number;
+    upstreamOpenMs?: number;
+    queuedFrames: number;
+    maxQueuedDelayMs: number;
+    emitted: boolean;
 };
 type RelayHostTunnelWebSocketData = {
     kind: "host-tunnel";
@@ -13,6 +26,7 @@ type RelayHostTunnelWebSocketData = {
     pending: Map<string, PendingTunnelHttpResponse>;
     channels: Map<string, Bun.ServerWebSocket<RelayUserHostedClientWebSocketData>>;
     heartbeat?: ReturnType<typeof setInterval>;
+    missedPongs: number;
     messageBuffer: string;
 };
 type RelayUserHostedClientWebSocketData = {
@@ -24,6 +38,9 @@ type RelayUserHostedClientWebSocketData = {
     relayHostToken: string;
 };
 type RelayWebSocketData = RelayClientWebSocketData | RelayHostTunnelWebSocketData | RelayUserHostedClientWebSocketData;
+type UpstreamWebSocketConstructor = {
+    new (url: string, options: Bun.WebSocketOptions): WebSocket;
+};
 type PendingTunnelHttpResponse = {
     controller: ReadableStreamDefaultController<Uint8Array>;
     stream: ReadableStream<Uint8Array>;
@@ -41,13 +58,28 @@ export type WorkspaceRelayHostTunnelOptions = {
         workspaceIds: string[];
     }) => boolean | Promise<boolean>;
     hostTunnelPingIntervalMs?: number;
+    hostTunnelMaxMissedPongs?: number;
     hostTunnelStateDebounceMs?: number;
 };
 export type WorkspaceRelayBackpressureOptions = {
     slowConsumerHighWaterMarkBytes?: number;
     slowConsumerTimeoutMs?: number;
+    tunnelRequestBodyMaxBytes?: number;
+    tunnelHttpResponseTimeoutMs?: number;
+    directHttpTimeoutMs?: number;
+    directHttpConcurrency?: number;
+    upstreamWebSocketOpenTimeoutMs?: number;
+    upstreamWebSocketPreOpenQueueMaxFrames?: number;
+    upstreamWebSocket?: UpstreamWebSocketConstructor;
+    webSocketBufferedAmountMaxBytes?: number;
 };
 export type WorkspaceRelayBunOptions = WorkspaceRelayHostTunnelOptions & WorkspaceRelayBackpressureOptions;
+export type WorkspaceRelayBunTelemetry = {
+    getFragmentationStats(): FragmentationStats;
+    resetFragmentationStats(): void;
+    getSlowConsumerStats(): SlowConsumerStats;
+    resetSlowConsumerStats(): void;
+};
 /**
  * T9: drain controller exposed by `createWorkspaceRelayBun`.
  *
@@ -56,8 +88,7 @@ export type WorkspaceRelayBunOptions = WorkspaceRelayHostTunnelOptions & Workspa
  *   - returns 503 from `/health` so Fly removes the instance from routing
  *   - rejects new HTTP requests with 503 (`relay_draining`) before doing auth
  *   - rejects new host-tunnel WebSocket upgrades with 503
- *   - leaves all existing in-flight HTTP requests, host tunnels, and
- *     multiplexed WS channels alone so they can complete naturally
+ *   - closes active host tunnels with 1012 so host clients reconnect promptly
  *
  * `pendingCount()` reports the total number of in-flight tunnel HTTP
  * responses across every connected host tunnel — this is what the operator
@@ -72,27 +103,27 @@ export type WorkspaceRelayBunDrainController = {
         remaining: number;
     }>;
 };
-export declare function getFragmentationStats(): {
+export type FragmentationStats = {
     fragmentsBuffered: number;
     oversizedClosed: number;
 };
-export declare function resetFragmentationStats(): void;
-export declare function getSlowConsumerStats(): {
+export type SlowConsumerStats = {
     overflowEvents: number;
     timerFired: number;
     droppedRequests: number;
 };
-export declare function resetSlowConsumerStats(): void;
-export declare function __resetHostTunnelStateDebounce(): void;
+declare function createSlowConsumerStats(): SlowConsumerStats;
 declare function enqueueChunkWithBackpressure(input: {
     ws: Bun.ServerWebSocket<RelayHostTunnelWebSocketData>;
     requestId: string;
     entry: PendingTunnelHttpResponse;
     chunk: Uint8Array;
     slowConsumerTimeoutMs: number;
+    slowConsumerStats: SlowConsumerStats;
 }): void;
 export declare const __slowConsumerInternalsForTest: {
     enqueueChunkWithBackpressure: typeof enqueueChunkWithBackpressure;
+    createSlowConsumerStats: typeof createSlowConsumerStats;
 };
 export declare function createWorkspaceRelayBun(options: WorkspaceRelayOptions, bunOptions?: WorkspaceRelayBunOptions): {
     fetch(request: Request, server: Bun.Server<RelayWebSocketData>): Promise<Response | undefined>;
@@ -103,5 +134,6 @@ export declare function createWorkspaceRelayBun(options: WorkspaceRelayOptions,
         close(ws: Bun.ServerWebSocket<RelayWebSocketData>, code: number, reason: string): void;
     };
     drain: WorkspaceRelayBunDrainController;
+    telemetry: WorkspaceRelayBunTelemetry;
 };
 export {};

package/dist/cloudflare.d.ts

@@ -0,0 +1,116 @@
+import { type AuthorizedWorkspaceRelayRequest, type WorkspaceRelayOptions } from "./server";
+export type WorkspaceRelayDurableObjectId = unknown;
+export type WorkspaceRelayDurableObjectStub = {
+    fetch: (request: Request) => Promise<Response>;
+};
+export type WorkspaceRelayDurableObjectGetOptions = {
+    locationHint?: string;
+};
+export type WorkspaceRelayDurableObjectNamespace = {
+    idFromName: (name: string) => WorkspaceRelayDurableObjectId;
+    get: (id: WorkspaceRelayDurableObjectId, options?: WorkspaceRelayDurableObjectGetOptions) => WorkspaceRelayDurableObjectStub;
+};
+export declare const DEFAULT_RELAY_LOCATION_HINT = "apac";
+export type WorkspaceRelayDurableObjectEnv = Record<string, unknown>;
+export type WorkspaceRelayDurableObjectGatewayOptions = {
+    bindingName?: string;
+    namespace?: WorkspaceRelayDurableObjectNamespace;
+};
+export type WorkspaceRelayDurableObjectSocketEvent = {
+    data?: unknown;
+    code?: number;
+    reason?: string;
+};
+export type WorkspaceRelayDurableObjectSocket = {
+    accept?: () => void;
+    readyState?: number;
+    binaryType?: string;
+    send?: (message: string | ArrayBuffer | Uint8Array) => void;
+    addEventListener?: (type: "open" | "message" | "close" | "error", listener: (event?: WorkspaceRelayDurableObjectSocketEvent) => void) => void;
+    close?: (code?: number, reason?: string) => void;
+    serializeAttachment?: (attachment: WorkspaceRelaySocketAttachment) => void;
+    deserializeAttachment?: () => WorkspaceRelaySocketAttachment | undefined;
+};
+export type WorkspaceRelayDurableObjectSocketPair = {
+    client: WorkspaceRelayDurableObjectSocket;
+    server: WorkspaceRelayDurableObjectSocket;
+};
+export type WorkspaceRelayDurableObjectConnectWebSocket = (url: string, init: {
+    headers: Record<string, string>;
+}) => WorkspaceRelayDurableObjectSocket | Promise<WorkspaceRelayDurableObjectSocket>;
+export type WorkspaceRelayDurableObjectRoomOptions = WorkspaceRelayOptions & {
+    createWebSocketPair?: () => WorkspaceRelayDurableObjectSocketPair;
+    connectWebSocket?: WorkspaceRelayDurableObjectConnectWebSocket;
+    hibernation?: WorkspaceRelayDurableObjectHibernation;
+    upstreamWebSocketPreOpenQueueMaxFrames?: number;
+    tunnelPendingHttpCap?: number;
+    tunnelStartedStreamCap?: number;
+    tunnelChannelCap?: number;
+    tunnelRequestBodyMaxBytes?: number;
+    tunnelResponseBodyMaxBytes?: number;
+    slowConsumerHighWaterMarkBytes?: number;
+    slowConsumerTimeoutMs?: number;
+    runtimeAccessTokenActiveCheckIntervalMs?: number;
+    workspaceTargetActiveCheckIntervalMs?: number;
+    traceSampleRate?: number;
+    traceLog?: (event: WorkspaceRelayTraceLogEvent) => void;
+    now?: () => number;
+};
+export type WorkspaceRelayTraceLogEvent = {
+    event: "workspace_relay_request";
+    traceId: string;
+    workspaceId?: string;
+    routeKind: string;
+    method: string;
+    path: string;
+    status: number;
+    totalMs: number;
+    phases: Record<string, number>;
+};
+export type WorkspaceRelayDurableObjectHibernation = {
+    acceptWebSocket: (socket: WorkspaceRelayDurableObjectSocket) => void;
+    getWebSockets: () => WorkspaceRelayDurableObjectSocket[];
+};
+export type WorkspaceRelaySocketAttachment = {
+    kind: "host-tunnel";
+    hostId: string;
+    workspaceIds: string[];
+    connectedAt: number;
+} | {
+    kind: "user-hosted-client";
+    channelId: string;
+    claims: RuntimeAccessAttachmentClaims;
+    target: WorkspaceRelayTargetAttachment;
+    path: string;
+    connectedAt: number;
+};
+type RuntimeAccessAttachmentClaims = AuthorizedWorkspaceRelayRequest["claims"];
+type WorkspaceRelayTargetAttachment = AuthorizedWorkspaceRelayRequest["target"];
+export type WorkspaceRelayDurableObjectDrainController = {
+    isDraining(): boolean;
+    setDraining(value: boolean): void;
+    pendingCount(): number;
+    waitForDrain(timeoutMs: number): Promise<{
+        drained: boolean;
+        remaining: number;
+    }>;
+};
+export declare function workspaceRelayDurableObjectRoomName(workspaceId: string): string;
+export declare function workspaceRelayDurableObjectWorkspaceId(request: Request): string | undefined;
+export declare function setWorkspaceRelayAppOrigins(raw: string | undefined): void;
+export declare function createWorkspaceRelayDurableObjectGateway(options?: WorkspaceRelayDurableObjectGatewayOptions): {
+    fetch(request: Request, env?: WorkspaceRelayDurableObjectEnv): Promise<Response>;
+};
+export declare function createWorkspaceRelayDurableObjectRoom(options: WorkspaceRelayDurableObjectRoomOptions): {
+    fetch(request: Request): Promise<Response>;
+    webSocketMessage(socket: WorkspaceRelayDurableObjectSocket, message: string | ArrayBuffer): Promise<void>;
+    webSocketClose(socket: WorkspaceRelayDurableObjectSocket, code: number, reason: string): void;
+    webSocketError(socket: WorkspaceRelayDurableObjectSocket): void;
+    state(): {
+        hostTunnelCount: number;
+        clientCount: number;
+        hostIds: string[];
+    };
+    drain: WorkspaceRelayDurableObjectDrainController;
+};
+export {};

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./auth";
 export * from "./bun";
+export * from "./cloudflare";
 export * from "./directory";
 export * from "./server";