@claxedo/workspace-relay 0.1.0

package/dist/index.mjs

@@ -0,0 +1,1563 @@
+// src/auth.ts
+import { SignJWT, errors, jwtVerify } from "jose";
+var algorithms = ["EdDSA", "ES256", "RS256"];
+var runtimeAccessTokenIssuer = "claxedo-control-plane";
+var runtimeAccessTokenAudience = "workspace-relay";
+var hostTunnelTokenAudience = "workspace-relay-host-tunnel";
+var relayHostTokenIssuer = "workspace-relay";
+var relayHostTokenAudience = "workspace-host-service";
+var WorkspaceRelayAuthError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+function jti() {
+  return crypto.randomUUID();
+}
+function seconds(input = Date.now()) {
+  return Math.floor(input / 1e3);
+}
+function requireAlgorithm(input) {
+  if (algorithms.includes(input)) return input;
+  throw new WorkspaceRelayAuthError("invalid_relay_token", "Unsupported relay token algorithm");
+}
+function stringClaim(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value : void 0;
+}
+function numberClaim(payload, key) {
+  const value = payload[key];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function stringArrayClaim(payload, key) {
+  const value = payload[key];
+  return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value : void 0;
+}
+function roleClaim(payload) {
+  const value = stringClaim(payload, "role");
+  return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
+}
+function checkHostTunnelTarget(payload, expected) {
+  if (stringClaim(payload, "host_id") !== expected.hostId) {
+    throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
+  }
+  const workspaceIds = stringArrayClaim(payload, "workspace_ids") ?? [];
+  if (expected.workspaceIds.some((workspaceId) => !workspaceIds.includes(workspaceId))) {
+    throw new WorkspaceRelayAuthError("relay_token_workspace_mismatch", "Relay token workspace does not match request");
+  }
+}
+function checkTarget(payload, expected) {
+  if (stringClaim(payload, "workspace_id") !== expected.workspaceId) {
+    throw new WorkspaceRelayAuthError("relay_token_workspace_mismatch", "Relay token workspace does not match request");
+  }
+  if (expected.hostId && stringClaim(payload, "host_id") !== expected.hostId) {
+    throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
+  }
+}
+async function verifyJwt(token, key, input) {
+  try {
+    if (typeof key === "function") {
+      return await jwtVerify(token, key, {
+        issuer: input.issuer,
+        audience: input.audience,
+        algorithms: [...algorithms]
+      });
+    }
+    return await jwtVerify(token, key, {
+      issuer: input.issuer,
+      audience: input.audience,
+      algorithms: [...algorithms]
+    });
+  } catch (err) {
+    if (err instanceof errors.JOSEError) {
+      throw new WorkspaceRelayAuthError("invalid_relay_token", "Relay token is invalid");
+    }
+    throw err;
+  }
+}
+async function mintRuntimeAccessToken(input, key, alg) {
+  const now = seconds(input.now);
+  return await new SignJWT({
+    org_id: input.orgId,
+    workspace_id: input.workspaceId,
+    host_id: input.hostId,
+    role: input.role
+  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
+}
+async function verifyRuntimeAccessToken(token, key, expected) {
+  const result = await verifyJwt(token, key, {
+    issuer: runtimeAccessTokenIssuer,
+    audience: runtimeAccessTokenAudience
+  });
+  checkTarget(result.payload, expected);
+  const claims = runtimeClaims(result.payload);
+  if (!claims) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
+  }
+  return claims;
+}
+async function mintHostTunnelToken(input, key, alg) {
+  const now = seconds(input.now);
+  return await new SignJWT({
+    host_id: input.hostId,
+    workspace_ids: input.workspaceIds
+  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(hostTunnelTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 5 * 60)).setJti(input.jti ?? jti()).sign(key);
+}
+async function verifyHostTunnelToken(token, key, expected) {
+  const result = await verifyJwt(token, key, {
+    issuer: runtimeAccessTokenIssuer,
+    audience: hostTunnelTokenAudience
+  });
+  checkHostTunnelTarget(result.payload, expected);
+  const claims = hostTunnelClaims(result.payload);
+  if (!claims) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Host Tunnel Token claims are incomplete");
+  }
+  return claims;
+}
+async function mintRelayHostToken(input, key, alg) {
+  const now = seconds(input.now);
+  const protectedHeader = { alg: requireAlgorithm(alg) };
+  if (input.kid) protectedHeader.kid = input.kid;
+  return await new SignJWT({
+    org_id: input.orgId,
+    workspace_id: input.workspaceId,
+    host_id: input.hostId,
+    role: input.role,
+    access: input.access,
+    backing: input.backing
+  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
+}
+async function verifyRelayHostToken(token, key, expected) {
+  const result = await verifyJwt(token, key, {
+    issuer: relayHostTokenIssuer,
+    audience: relayHostTokenAudience
+  });
+  checkTarget(result.payload, expected);
+  const claims = relayHostClaims(result.payload);
+  if (!claims) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token claims are incomplete");
+  }
+  return claims;
+}
+function runtimeClaims(payload) {
+  const exp = numberClaim(payload, "exp");
+  const iat = numberClaim(payload, "iat");
+  const sub = stringClaim(payload, "sub");
+  const jti2 = stringClaim(payload, "jti");
+  const org_id = stringClaim(payload, "org_id");
+  const workspace_id = stringClaim(payload, "workspace_id");
+  const host_id = stringClaim(payload, "host_id");
+  const role = roleClaim(payload);
+  if (!exp || !iat || !sub || !jti2 || !org_id || !workspace_id || !host_id || !role) return;
+  return {
+    iss: runtimeAccessTokenIssuer,
+    aud: runtimeAccessTokenAudience,
+    sub,
+    org_id,
+    workspace_id,
+    host_id,
+    role,
+    exp,
+    iat,
+    jti: jti2
+  };
+}
+function relayHostClaims(payload) {
+  const base = runtimeClaims({
+    ...payload,
+    iss: runtimeAccessTokenIssuer,
+    aud: runtimeAccessTokenAudience
+  });
+  const access = stringClaim(payload, "access");
+  const backing = stringClaim(payload, "backing");
+  if (!base || access !== "cloud" && access !== "user-hosted") return;
+  if (backing !== "local-worktree" && backing !== "cloud-vm") return;
+  return {
+    ...base,
+    iss: relayHostTokenIssuer,
+    aud: relayHostTokenAudience,
+    access,
+    backing
+  };
+}
+function hostTunnelClaims(payload) {
+  const exp = numberClaim(payload, "exp");
+  const iat = numberClaim(payload, "iat");
+  const sub = stringClaim(payload, "sub");
+  const jti2 = stringClaim(payload, "jti");
+  const host_id = stringClaim(payload, "host_id");
+  const workspace_ids = stringArrayClaim(payload, "workspace_ids");
+  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length) return;
+  return {
+    iss: runtimeAccessTokenIssuer,
+    aud: hostTunnelTokenAudience,
+    sub,
+    host_id,
+    workspace_ids,
+    exp,
+    iat,
+    jti: jti2
+  };
+}
+
+// src/bun.ts
+import {
+  isTunnelMessage,
+  makeTunnelPong,
+  TUNNEL_PROTOCOL_VERSION
+} from "@claxedo/workspace-relay-protocol";
+
+// src/server.ts
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { exportJWK } from "jose";
+
+// src/http.ts
+function bearerToken(header) {
+  if (!header) return;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  return match?.[1]?.trim() || void 0;
+}
+function errorBody(code, message) {
+  return {
+    error: {
+      code,
+      message
+    }
+  };
+}
+
+// src/server.ts
+function protocolToken(header) {
+  return header?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
+}
+function runtimeAccessToken(request) {
+  return bearerToken(request.headers.get("authorization") ?? void 0) ?? protocolToken(request.headers.get("sec-websocket-protocol") ?? void 0);
+}
+var DANGEROUS_INBOUND_HEADERS = [
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip"
+];
+var DANGEROUS_INBOUND_HEADER_PATTERNS = [
+  /^x-claxedo-internal-/i,
+  /^x-supervisor-/i
+];
+function isDangerousInboundHeader(name) {
+  const lower = name.toLowerCase();
+  if (DANGEROUS_INBOUND_HEADERS.includes(lower)) return true;
+  for (const pattern of DANGEROUS_INBOUND_HEADER_PATTERNS) {
+    if (pattern.test(lower)) return true;
+  }
+  return false;
+}
+function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
+  const headers2 = new Headers(input);
+  headers2.delete("host");
+  const inboundNames = /* @__PURE__ */ new Set();
+  headers2.forEach((_value, name) => inboundNames.add(name));
+  for (const name of inboundNames) {
+    if (isDangerousInboundHeader(name)) headers2.delete(name);
+  }
+  if (options.userHosted) headers2.delete("cookie");
+  headers2.set("accept-encoding", "identity");
+  headers2.set("authorization", `Bearer ${relayHostToken}`);
+  headers2.set("x-workspace-id", workspaceId);
+  headers2.set("X-Daytona-Skip-Preview-Warning", "true");
+  headers2.set("x-forwarded-by", "workspace-relay");
+  return headers2;
+}
+function targetUrl(target, path, search) {
+  const url = new URL(path.replace(/^\/+/, ""), target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
+  url.search = search;
+  return url;
+}
+function roleAllowsRelayRequest(role, method) {
+  if (role !== "viewer") return true;
+  return method === "GET" || method === "HEAD" || method === "OPTIONS";
+}
+function workspaceRelayTargetUrl(target, path, search) {
+  return targetUrl(target, path, search);
+}
+function workspaceRelayForwardHeaders(input, relayHostToken, workspaceId, options = {}) {
+  return forwardHeaders(input, relayHostToken, workspaceId, options);
+}
+var auditSamplers = /* @__PURE__ */ new WeakMap();
+function getOrCreateAuditSampler(options) {
+  let state = auditSamplers.get(options);
+  if (!state) {
+    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
+    state = {
+      suppressedCount: 0,
+      timer: void 0,
+      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
+      random: options.random ?? Math.random,
+      sampleRate
+    };
+    auditSamplers.set(options, state);
+  }
+  return state;
+}
+function clampSampleRate(rate) {
+  if (rate === void 0) return 1;
+  if (!Number.isFinite(rate)) return 1;
+  if (rate < 0) return 0;
+  if (rate > 1) return 1;
+  return rate;
+}
+function ensureFlushTimer(options, state) {
+  if (state.timer) return;
+  if (state.sampleRate >= 1) return;
+  if (state.flushIntervalMs <= 0) return;
+  const timer = setInterval(() => {
+    flushSuppressedSummary(options, state);
+  }, state.flushIntervalMs);
+  if (typeof timer.unref === "function") {
+    timer.unref();
+  }
+  state.timer = timer;
+}
+function flushSuppressedSummary(options, state) {
+  const count = state.suppressedCount;
+  if (count <= 0) return;
+  state.suppressedCount = 0;
+  void options.audit?.({
+    action: "relay.request.suppressed_summary",
+    result: "allow",
+    method: "INTERNAL",
+    path: "/",
+    suppressedCount: count
+  });
+}
+function disposeAuditSampler(options) {
+  const state = auditSamplers.get(options);
+  if (!state) return;
+  if (state.timer) {
+    clearInterval(state.timer);
+    state.timer = void 0;
+  }
+  flushSuppressedSummary(options, state);
+  auditSamplers.delete(options);
+}
+async function audit(options, event) {
+  if (event.action === "relay.request.accepted") {
+    const state = getOrCreateAuditSampler(options);
+    if (state.sampleRate < 1) {
+      ensureFlushTimer(options, state);
+      if (state.random() >= state.sampleRate) {
+        state.suppressedCount += 1;
+        return;
+      }
+    }
+  }
+  await options.audit?.(event);
+}
+function denyCorsHeaders(request) {
+  const origin = request.headers.get("origin");
+  if (!origin) return void 0;
+  const allowed = origin.startsWith("http://localhost:") || origin.startsWith("http://127.0.0.1:") || /^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin);
+  if (!allowed) return void 0;
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-allow-headers": "Accept, Authorization, Content-Type, X-Daytona-Skip-Preview-Warning, X-Workspace-Id",
+    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
+  };
+}
+async function deny(options, input) {
+  const url = new URL(input.request.url);
+  await audit(options, {
+    action: "relay.request.denied",
+    result: "deny",
+    reason: input.code,
+    subject: input.claims?.sub,
+    ...input.claims ? { role: input.claims.role } : {},
+    workspaceId: input.claims?.workspace_id,
+    hostId: input.claims?.host_id,
+    method: input.request.method,
+    path: url.pathname
+  });
+  return Response.json(errorBody(input.code, input.message), {
+    status: input.status,
+    headers: denyCorsHeaders(input.request)
+  });
+}
+async function authorizeWorkspaceRelayRequest(options, request, workspaceId) {
+  const token = runtimeAccessToken(request);
+  if (!token) {
+    return {
+      ok: false,
+      response: await deny(options, {
+        code: "runtime_access_token_required",
+        message: "Runtime Access Token is required",
+        status: 401,
+        request
+      })
+    };
+  }
+  try {
+    const claims = options.tokenVerifier ? await (async () => {
+      const verified = await options.tokenVerifier.verify(token);
+      return verified.claims;
+    })() : await verifyRuntimeAccessToken(token, options.runtimeAccessKey, { workspaceId });
+    const active = await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
+    if (!active.active) {
+      return {
+        ok: false,
+        response: await deny(options, {
+          code: active.code,
+          message: active.reason,
+          status: 401,
+          claims,
+          request
+        })
+      };
+    }
+    if (!roleAllowsRelayRequest(claims.role, request.method)) {
+      return {
+        ok: false,
+        response: await deny(options, {
+          code: "relay_role_denied",
+          message: "Workspace role does not allow this relay request",
+          status: 403,
+          claims,
+          request
+        })
+      };
+    }
+    const target = await options.resolveTarget(claims);
+    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id) {
+      return {
+        ok: false,
+        response: await deny(options, {
+          code: "relay_target_unavailable",
+          message: "Workspace relay target is unavailable",
+          status: 403,
+          claims,
+          request
+        })
+      };
+    }
+    if (target.access === "user-hosted" && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+      return {
+        ok: false,
+        response: await deny(options, {
+          code: "user_hosted_app_offline",
+          message: "User-hosted workspace is offline",
+          status: 503,
+          claims,
+          request
+        })
+      };
+    }
+    await audit(options, {
+      action: "relay.request.accepted",
+      result: "allow",
+      subject: claims.sub,
+      role: claims.role,
+      workspaceId: claims.workspace_id,
+      hostId: claims.host_id,
+      method: request.method,
+      path: new URL(request.url).pathname
+    });
+    return {
+      ok: true,
+      request: {
+        claims,
+        target,
+        relayHostToken: await mintRelayHostToken({
+          subject: claims.sub,
+          orgId: claims.org_id,
+          workspaceId: claims.workspace_id,
+          hostId: claims.host_id,
+          role: claims.role,
+          access: target.access,
+          backing: target.backing,
+          ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
+        }, options.relayHostSigningKey, options.relayHostAlgorithm),
+        path: new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")
+      }
+    };
+  } catch (err) {
+    const code = err instanceof WorkspaceRelayAuthError ? err.code : "relay_request_failed";
+    return {
+      ok: false,
+      response: await deny(options, {
+        code,
+        message: "Workspace relay request was denied",
+        status: code.includes("mismatch") ? 403 : 401,
+        request
+      })
+    };
+  }
+}
+async function forwardRequest(request, target, relayHostToken, path, requestFetch) {
+  const init = {
+    method: request.method,
+    headers: forwardHeaders(request.headers, relayHostToken, target.workspaceId),
+    body: request.body,
+    duplex: "half",
+    redirect: "manual"
+  };
+  if (request.method === "GET" || request.method === "HEAD") delete init.body;
+  const upstream = await requestFetch(targetUrl(target, path, new URL(request.url).search), init);
+  const headers2 = new Headers(upstream.headers);
+  headers2.delete("access-control-allow-origin");
+  headers2.delete("access-control-allow-credentials");
+  headers2.delete("access-control-allow-headers");
+  headers2.delete("access-control-allow-methods");
+  headers2.delete("access-control-expose-headers");
+  headers2.delete("access-control-max-age");
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: headers2
+  });
+}
+function getAuditSuppressedCount(options) {
+  return auditSamplers.get(options)?.suppressedCount ?? 0;
+}
+var LOOPBACK_REMOTES = /* @__PURE__ */ new Set([
+  "127.0.0.1",
+  "::1",
+  "::ffff:127.0.0.1"
+]);
+function isLoopbackAddress(address) {
+  if (!address) return false;
+  const trimmed = address.trim();
+  if (LOOPBACK_REMOTES.has(trimmed)) return true;
+  if (/^127\./.test(trimmed)) return true;
+  if (/^::ffff:127\./i.test(trimmed)) return true;
+  return false;
+}
+function checkMetricsAuth(options, request) {
+  if (options.metricsToken) {
+    const presented = bearerToken(request.headers.get("authorization") ?? void 0);
+    if (!presented || presented !== options.metricsToken) {
+      return {
+        ok: false,
+        status: 401,
+        code: "metrics_unauthorized",
+        message: "Metrics endpoint requires a valid bearer token"
+      };
+    }
+    return { ok: true };
+  }
+  if (!options.metricsRemoteAddress) return { ok: true };
+  const address = options.metricsRemoteAddress(request);
+  if (isLoopbackAddress(address)) return { ok: true };
+  return {
+    ok: false,
+    status: 401,
+    code: "metrics_unauthorized",
+    message: "Metrics endpoint is restricted to loopback or bearer-token clients"
+  };
+}
+function buildMetricsBody(options) {
+  const sources = options.metricsSources ?? {};
+  const fragmentation = sources.fragmentation?.() ?? { fragmentsBuffered: 0, oversizedClosed: 0 };
+  const slowConsumer = sources.slowConsumer?.() ?? {
+    overflowEvents: 0,
+    timerFired: 0,
+    droppedRequests: 0
+  };
+  const activeHostCount = options.directory?.size?.() ?? 0;
+  const suppressedAccepts = getAuditSuppressedCount(options);
+  const body = {
+    fragmentation,
+    slowConsumer,
+    directory: { activeHostCount },
+    audit: { suppressedAccepts }
+  };
+  if (sources.drainPending) {
+    body.drain = { pendingCount: sources.drainPending() };
+  }
+  return body;
+}
+function createWorkspaceRelay(options) {
+  const app = new Hono();
+  app.use("*", cors({
+    origin: (origin) => {
+      if (!origin) return void 0;
+      if (origin.startsWith("http://localhost:")) return origin;
+      if (origin.startsWith("http://127.0.0.1:")) return origin;
+      if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin)) return origin;
+      return void 0;
+    },
+    allowHeaders: [
+      "Accept",
+      "Authorization",
+      "Content-Type",
+      "X-Daytona-Skip-Preview-Warning",
+      "X-Workspace-Id"
+    ],
+    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+  }));
+  app.get("/health", (c) => {
+    if (options.isDraining?.()) {
+      return c.json(
+        { ok: false, service: "workspace-relay", draining: true },
+        503
+      );
+    }
+    return c.json({ ok: true, service: "workspace-relay" });
+  });
+  app.get("/.well-known/jwks.json", async (c) => {
+    const sources = options.relayHostPublicKeys ?? [];
+    if (sources.length === 0) {
+      return c.json(
+        {
+          error: {
+            code: "jwks_no_keys_configured",
+            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
+          }
+        },
+        503
+      );
+    }
+    let keys;
+    try {
+      keys = await Promise.all(sources.map(async (source) => {
+        const jwk = await exportJWK(source.publicKey);
+        return {
+          ...jwk,
+          kid: source.kid,
+          alg: "EdDSA",
+          use: "sig"
+        };
+      }));
+    } catch (err) {
+      return c.json(
+        {
+          error: {
+            code: "jwks_invalid_key",
+            message: "A configured RHT public key could not be exported as a JWK",
+            detail: err instanceof Error ? err.message : String(err)
+          }
+        },
+        500
+      );
+    }
+    c.header("cache-control", "public, max-age=300");
+    return c.json({ keys });
+  });
+  app.disposeAuditSampler = () => disposeAuditSampler(options);
+  app.get("/metrics", (c) => {
+    const authResult = checkMetricsAuth(options, c.req.raw);
+    if (!authResult.ok) {
+      return c.json(
+        errorBody(authResult.code, authResult.message),
+        authResult.status
+      );
+    }
+    return c.json(buildMetricsBody(options));
+  });
+  app.all("/workspaces/:workspaceId/*", async (c) => {
+    if (options.isDraining?.()) {
+      return Response.json(
+        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
+        { status: 503, headers: denyCorsHeaders(c.req.raw) }
+      );
+    }
+    const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"));
+    if (!relay.ok) return relay.response;
+    return await forwardRequest(
+      new Request(c.req.raw),
+      relay.request.target,
+      relay.request.relayHostToken,
+      relay.request.path,
+      options.fetch ?? fetch
+    );
+  });
+  return app;
+}
+
+// src/bun.ts
+var TUNNEL_PENDING_HTTP_CAP = 32;
+var TUNNEL_CHANNEL_CAP = 16;
+var HOST_TUNNEL_REGISTRATION_CONCURRENT_CAP = 3;
+var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
+var HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS = 6e4;
+var WS_MAX_PAYLOAD_LENGTH_BYTES = 16 * 1024 * 1024;
+var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
+var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
+var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
+var HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT = 250;
+var fragmentationStats = {
+  fragmentsBuffered: 0,
+  oversizedClosed: 0
+};
+function getFragmentationStats() {
+  return {
+    fragmentsBuffered: fragmentationStats.fragmentsBuffered,
+    oversizedClosed: fragmentationStats.oversizedClosed
+  };
+}
+function resetFragmentationStats() {
+  fragmentationStats.fragmentsBuffered = 0;
+  fragmentationStats.oversizedClosed = 0;
+}
+var slowConsumerStats = {
+  overflowEvents: 0,
+  timerFired: 0,
+  droppedRequests: 0
+};
+function getSlowConsumerStats() {
+  return { ...slowConsumerStats };
+}
+function resetSlowConsumerStats() {
+  slowConsumerStats = { overflowEvents: 0, timerFired: 0, droppedRequests: 0 };
+}
+function jsonError(code, message, status) {
+  return new Response(JSON.stringify({ error: { code, message } }), {
+    status,
+    headers: { "content-type": "application/json" }
+  });
+}
+function workspaceIdFromPath(pathname) {
+  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
+}
+function hostIdFromTunnelPath(pathname) {
+  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
+}
+function websocketRequest(request) {
+  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
+}
+function relayWebSocketPayload(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof ArrayBuffer) return input;
+  if (ArrayBuffer.isView(input)) {
+    const copy = new Uint8Array(input.byteLength);
+    copy.set(new Uint8Array(input.buffer, input.byteOffset, input.byteLength));
+    return copy;
+  }
+}
+function headersRecord(headers2) {
+  const result = {};
+  headers2.forEach((value, key) => {
+    result[key] = value;
+  });
+  return result;
+}
+function headers(input) {
+  const result = new Headers();
+  for (const [key, value] of Object.entries(input)) {
+    result.set(key, value);
+  }
+  return result;
+}
+function allowedCorsOrigin(origin) {
+  if (!origin) return;
+  if (origin.startsWith("http://localhost:")) return origin;
+  if (origin.startsWith("http://127.0.0.1:")) return origin;
+  if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin)) return origin;
+}
+function requireAllowedOrigin(request) {
+  const origin = request.headers.get("origin");
+  if (allowedCorsOrigin(origin)) return null;
+  return jsonError(
+    "origin_not_allowed",
+    "Origin is not in the allowlist",
+    403
+  );
+}
+function relayCorsHeaders(request, input = new Headers()) {
+  const result = new Headers(input);
+  result.delete("access-control-allow-origin");
+  result.delete("access-control-allow-credentials");
+  result.delete("access-control-allow-headers");
+  result.delete("access-control-allow-methods");
+  result.delete("access-control-expose-headers");
+  result.delete("access-control-max-age");
+  const origin = allowedCorsOrigin(request.headers.get("origin"));
+  if (origin) {
+    result.set("access-control-allow-origin", origin);
+    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, X-Daytona-Skip-Preview-Warning, X-Workspace-Id");
+    result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
+  }
+  return result;
+}
+function encoded(input) {
+  return Buffer.from(input).toString("base64");
+}
+function decoded(input) {
+  return new Uint8Array(Buffer.from(input, "base64"));
+}
+function encodedFrame(message) {
+  if (typeof message === "string") {
+    return {
+      binary: false,
+      data_base64: Buffer.from(message).toString("base64")
+    };
+  }
+  return {
+    binary: true,
+    data_base64: Buffer.from(message).toString("base64")
+  };
+}
+function decodedFrame(frame) {
+  const body = Buffer.from(frame.data_base64, "base64");
+  return frame.binary ? new Uint8Array(body) : body.toString("utf8");
+}
+function tunnelMessage(ws, input) {
+  if (typeof input !== "string") return;
+  const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
+  let parsed;
+  try {
+    parsed = JSON.parse(combined);
+  } catch {
+    if (combined.length > TUNNEL_MESSAGE_BUFFER_CAP_BYTES) {
+      fragmentationStats.oversizedClosed += 1;
+      ws.data.messageBuffer = "";
+      ws.close(1009, "Tunnel message buffer exceeded 4 MB");
+      return;
+    }
+    fragmentationStats.fragmentsBuffered += 1;
+    ws.data.messageBuffer = combined;
+    return;
+  }
+  ws.data.messageBuffer = "";
+  return isTunnelMessage(parsed) ? parsed : void 0;
+}
+function sendTunnelPing(ws) {
+  if (ws.readyState !== WebSocket.OPEN) return;
+  ws.send(JSON.stringify({
+    type: "ping",
+    protocol: TUNNEL_PROTOCOL_VERSION,
+    id: crypto.randomUUID(),
+    sent_at: Date.now()
+  }));
+}
+async function audit2(options, input) {
+  await options.audit?.({
+    action: input.action,
+    result: "allow",
+    hostId: input.hostId,
+    workspaceId: input.workspaceId,
+    method: "WEBSOCKET",
+    path: input.path
+  });
+}
+var hostTunnelStateDebounce = /* @__PURE__ */ new Map();
+function scheduleHostTunnelStateChange(options, input) {
+  const existing = hostTunnelStateDebounce.get(input.hostId);
+  const entry = existing ?? {
+    intendedState: "disconnected",
+    lastWritten: "disconnected",
+    flushTimer: void 0,
+    pending: { workspaceId: input.workspaceId, path: input.path }
+  };
+  entry.intendedState = input.state;
+  entry.pending = { workspaceId: input.workspaceId, path: input.path };
+  if (entry.flushTimer) clearTimeout(entry.flushTimer);
+  entry.flushTimer = setTimeout(() => {
+    entry.flushTimer = void 0;
+    if (entry.intendedState === entry.lastWritten) {
+      if (entry.intendedState === "disconnected") {
+        hostTunnelStateDebounce.delete(input.hostId);
+      }
+      return;
+    }
+    entry.lastWritten = entry.intendedState;
+    void audit2(options, {
+      action: entry.intendedState === "connected" ? "host_tunnel.connected" : "host_tunnel.disconnected",
+      hostId: input.hostId,
+      workspaceId: entry.pending.workspaceId,
+      path: entry.pending.path
+    });
+  }, input.debounceMs);
+  hostTunnelStateDebounce.set(input.hostId, entry);
+}
+function __resetHostTunnelStateDebounce() {
+  for (const entry of hostTunnelStateDebounce.values()) {
+    if (entry.flushTimer) clearTimeout(entry.flushTimer);
+  }
+  hostTunnelStateDebounce.clear();
+}
+function drainPendingChunks(entry) {
+  while (entry.pendingChunks.length > 0) {
+    const desired = entry.controller.desiredSize;
+    if (desired !== null && desired <= 0) break;
+    const next = entry.pendingChunks.shift();
+    entry.bytesQueued -= next.byteLength;
+    try {
+      entry.controller.enqueue(next);
+    } catch {
+      entry.pendingChunks.length = 0;
+      entry.bytesQueued = 0;
+      break;
+    }
+  }
+  if (entry.pendingChunks.length === 0 && entry.slowConsumerTimeout) {
+    clearTimeout(entry.slowConsumerTimeout);
+    entry.slowConsumerTimeout = void 0;
+  }
+}
+function enqueueChunkWithBackpressure(input) {
+  const { entry, chunk } = input;
+  const desired = entry.controller.desiredSize;
+  const overflowing = desired !== null && desired <= 0;
+  if (overflowing || entry.pendingChunks.length > 0) {
+    entry.pendingChunks.push(chunk);
+    entry.bytesQueued += chunk.byteLength;
+    if (!entry.slowConsumerTimeout) {
+      slowConsumerStats.overflowEvents += 1;
+      entry.slowConsumerTimeout = setTimeout(() => {
+        slowConsumerStats.timerFired += 1;
+        const error = new Error("slow_consumer_timeout: downstream consumer did not drain in time");
+        try {
+          entry.controller.error(error);
+        } catch {
+        }
+        clearTimeout(entry.timeout);
+        entry.pendingChunks.length = 0;
+        entry.bytesQueued = 0;
+        if (!entry.responseStarted) {
+          entry.resolve(jsonError("slow_consumer_timeout", "Downstream consumer did not drain in time", 503));
+        }
+        input.ws.data.pending.delete(input.requestId);
+        slowConsumerStats.droppedRequests += 1;
+      }, input.slowConsumerTimeoutMs);
+    }
+    return;
+  }
+  try {
+    entry.controller.enqueue(chunk);
+  } catch {
+  }
+}
+var __slowConsumerInternalsForTest = {
+  enqueueChunkWithBackpressure
+};
+async function tunnelHttpRequest(input) {
+  if (input.ws.readyState !== WebSocket.OPEN) {
+    return new Response("User-hosted workspace is offline", { status: 503 });
+  }
+  if (input.ws.data.pending.size >= TUNNEL_PENDING_HTTP_CAP) {
+    return jsonError(
+      "too_many_in_flight",
+      "User-hosted tunnel has too many in-flight HTTP requests",
+      429
+    );
+  }
+  const requestId = crypto.randomUUID();
+  let controller;
+  const stream = new ReadableStream({
+    start(next) {
+      controller = next;
+    },
+    pull() {
+      const entry = input.ws.data.pending.get(requestId);
+      if (!entry) return;
+      drainPendingChunks(entry);
+    }
+  }, new ByteLengthQueuingStrategy({ highWaterMark: input.slowConsumerHighWaterMarkBytes }));
+  const pending = new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      input.ws.data.pending.delete(requestId);
+      reject(new Error("User-hosted tunnel response timed out"));
+    }, 3e4);
+    input.ws.data.pending.set(requestId, {
+      controller,
+      stream,
+      resolve,
+      reject,
+      timeout,
+      pendingChunks: [],
+      bytesQueued: 0,
+      responseStarted: false
+    });
+  });
+  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : encoded(await input.request.arrayBuffer());
+  input.ws.send(JSON.stringify({
+    type: "http.request",
+    protocol: TUNNEL_PROTOCOL_VERSION,
+    request_id: requestId,
+    workspace_id: input.workspaceId,
+    method: input.request.method,
+    path: input.path,
+    headers: headersRecord(workspaceRelayForwardHeaders(
+      input.request.headers,
+      input.relayHostToken,
+      input.workspaceId,
+      // T26: user-hosted tunnel — strip Cookie to avoid leaking browser
+      // cookies to the host process running on the user's laptop.
+      { userHosted: true }
+    )),
+    ...body ? { body_base64: body } : {},
+    end: true
+  }));
+  return await pending;
+}
+async function directHttpRequest(input) {
+  const init = {
+    method: input.request.method,
+    headers: workspaceRelayForwardHeaders(
+      input.request.headers,
+      input.relayHostToken,
+      input.workspaceId,
+      // T26: cloud-vm direct path. Cookies pass through (default) — workspace
+      // dashboards in the VM may legitimately need session cookies.
+      { userHosted: false }
+    ),
+    body: input.request.body,
+    duplex: "half",
+    redirect: "manual"
+  };
+  if (input.request.method === "GET" || input.request.method === "HEAD") delete init.body;
+  const upstream = await fetch(input.targetUrl, init);
+  return new Response(upstream.body, {
+    status: upstream.status,
+    statusText: upstream.statusText,
+    headers: relayCorsHeaders(input.request, upstream.headers)
+  });
+}
+function hostTunnel(hostTunnels, hostId) {
+  const tunnel = hostTunnels.get(hostId);
+  if (tunnel?.readyState === WebSocket.OPEN) return tunnel;
+  return void 0;
+}
+async function authorizeHostTunnel(options, bunOptions, request, input) {
+  if (bunOptions.authorizeHostTunnel) return await bunOptions.authorizeHostTunnel(request, input);
+  const token = bearerToken(request.headers.get("authorization"));
+  if (!token) return false;
+  try {
+    await verifyHostTunnelToken(token, options.runtimeAccessKey, input);
+    return true;
+  } catch (err) {
+    if (err instanceof WorkspaceRelayAuthError) return false;
+    throw err;
+  }
+}
+function createWorkspaceRelayBun(options, bunOptions = {}) {
+  const hostTunnels = /* @__PURE__ */ new Map();
+  const hostTunnelRegistrations = /* @__PURE__ */ new Map();
+  let draining = false;
+  const drainController = {
+    isDraining: () => draining,
+    setDraining: (value) => {
+      draining = value;
+    },
+    pendingCount: () => {
+      let total = 0;
+      for (const tunnel of hostTunnels.values()) {
+        total += tunnel.data.pending.size;
+      }
+      return total;
+    },
+    waitForDrain: async (timeoutMs) => {
+      const deadline = Date.now() + Math.max(0, timeoutMs);
+      const pollMs = 50;
+      while (true) {
+        const remaining = drainController.pendingCount();
+        if (remaining === 0) return { drained: true, remaining: 0 };
+        const now = Date.now();
+        if (now >= deadline) return { drained: false, remaining };
+        const sleep = Math.min(pollMs, Math.max(1, deadline - now));
+        await new Promise((resolve) => setTimeout(resolve, sleep));
+      }
+    }
+  };
+  const mergedMetricsSources = {
+    fragmentation: options.metricsSources?.fragmentation ?? getFragmentationStats,
+    slowConsumer: options.metricsSources?.slowConsumer ?? getSlowConsumerStats,
+    drainPending: options.metricsSources?.drainPending ?? drainController.pendingCount
+  };
+  const requestRemoteAddress = /* @__PURE__ */ new WeakMap();
+  const metricsRemoteAddressResolver = options.metricsRemoteAddress ?? ((request) => requestRemoteAddress.get(request));
+  const app = createWorkspaceRelay({
+    ...options,
+    isDraining: drainController.isDraining,
+    metricsSources: mergedMetricsSources,
+    metricsRemoteAddress: metricsRemoteAddressResolver
+  });
+  function getRegistrationTracker(hostId) {
+    let tracker = hostTunnelRegistrations.get(hostId);
+    if (!tracker) {
+      tracker = { current: 0, recent: [] };
+      hostTunnelRegistrations.set(hostId, tracker);
+    }
+    return tracker;
+  }
+  function pruneReconnects(tracker, now) {
+    const cutoff = now - HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS;
+    while (tracker.recent.length && tracker.recent[0] < cutoff) {
+      tracker.recent.shift();
+    }
+  }
+  return {
+    async fetch(request, server) {
+      const url = new URL(request.url);
+      const workspaceId = workspaceIdFromPath(url.pathname);
+      const hostId = hostIdFromTunnelPath(url.pathname);
+      try {
+        const ip = server.requestIP(request)?.address;
+        if (ip) requestRemoteAddress.set(request, ip);
+      } catch {
+      }
+      if (draining && websocketRequest(request) && hostId) {
+        return jsonError(
+          "relay_draining",
+          "Workspace relay is shutting down; new tunnel registrations are not accepted",
+          503
+        );
+      }
+      if (draining && workspaceId) {
+        const headers2 = relayCorsHeaders(request);
+        const body = JSON.stringify({
+          error: {
+            code: "relay_draining",
+            message: "Workspace relay is shutting down; try another instance"
+          }
+        });
+        headers2.set("content-type", "application/json");
+        return new Response(body, { status: 503, headers: headers2 });
+      }
+      if (websocketRequest(request) && hostId) {
+        const workspaceIds = url.searchParams.getAll("workspaceId");
+        if (!workspaceIds.length || !options.directory) {
+          return new Response("Host tunnel registration is unavailable", { status: 503 });
+        }
+        if (!await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds })) {
+          return new Response("Host tunnel registration denied", { status: 403 });
+        }
+        const tracker = getRegistrationTracker(hostId);
+        const now = Date.now();
+        pruneReconnects(tracker, now);
+        if (tracker.current >= HOST_TUNNEL_REGISTRATION_CONCURRENT_CAP) {
+          return jsonError(
+            "too_many_concurrent_host_tunnels",
+            "Too many concurrent host-tunnel registrations for this host",
+            429
+          );
+        }
+        if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
+          return jsonError(
+            "too_many_host_tunnel_reconnects",
+            "Too many host-tunnel reconnects for this host within the last 60 seconds",
+            429
+          );
+        }
+        if (server.upgrade(request, {
+          data: {
+            kind: "host-tunnel",
+            hostId,
+            workspaceIds,
+            pending: /* @__PURE__ */ new Map(),
+            channels: /* @__PURE__ */ new Map(),
+            messageBuffer: ""
+          }
+        })) {
+          tracker.current += 1;
+          tracker.recent.push(now);
+          return;
+        }
+        return new Response("WebSocket upgrade failed", { status: 400 });
+      }
+      if (!workspaceId) return app.request(request);
+      if (request.method === "OPTIONS") {
+        return new Response(null, {
+          status: 204,
+          headers: relayCorsHeaders(request)
+        });
+      }
+      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
+      if (!relay.ok) return relay.response;
+      if (!websocketRequest(request) && relay.request.target.access === "user-hosted") {
+        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
+        return tunnel ? await tunnelHttpRequest({
+          ws: tunnel,
+          request,
+          workspaceId: relay.request.target.workspaceId,
+          path: `${relay.request.path}${url.search}`,
+          relayHostToken: relay.request.relayHostToken,
+          slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
+          slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
+        }) : new Response("User-hosted workspace is offline", { status: 503 });
+      }
+      if (!websocketRequest(request)) {
+        return await directHttpRequest({
+          request,
+          targetUrl: workspaceRelayTargetUrl(
+            relay.request.target,
+            relay.request.path,
+            url.search
+          ).toString(),
+          relayHostToken: relay.request.relayHostToken,
+          workspaceId: relay.request.target.workspaceId
+        });
+      }
+      const originDenied = requireAllowedOrigin(request);
+      if (originDenied) return originDenied;
+      if (relay.request.target.access === "user-hosted") {
+        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
+        if (!tunnel) {
+          return new Response("User-hosted workspace is offline", { status: 503 });
+        }
+        if (tunnel.data.channels.size >= TUNNEL_CHANNEL_CAP) {
+          return jsonError(
+            "too_many_channels",
+            "User-hosted tunnel has too many active WebSocket channels",
+            503
+          );
+        }
+        if (server.upgrade(request, {
+          data: {
+            kind: "user-hosted-client",
+            hostId: relay.request.target.hostId,
+            workspaceId: relay.request.target.workspaceId,
+            channelId: crypto.randomUUID(),
+            path: `${relay.request.path}${url.search}`,
+            relayHostToken: relay.request.relayHostToken
+          }
+        })) {
+          return;
+        }
+        return new Response("WebSocket upgrade failed", { status: 400 });
+      }
+      if (server.upgrade(request, {
+        data: {
+          kind: "client",
+          upstreamUrl: workspaceRelayTargetUrl(
+            relay.request.target,
+            relay.request.path,
+            url.search
+          ).toString().replace(/^http/, "ws"),
+          headers: headersRecord(workspaceRelayForwardHeaders(
+            new Headers(),
+            relay.request.relayHostToken,
+            relay.request.target.workspaceId,
+            // T26: cloud-vm WS upgrade. Cookies pass through (default).
+            { userHosted: false }
+          )),
+          queue: []
+        }
+      })) {
+        return;
+      }
+      return new Response("WebSocket upgrade failed", { status: 400 });
+    },
+    websocket: {
+      maxPayloadLength: WS_MAX_PAYLOAD_LENGTH_BYTES,
+      message(ws, message) {
+        if (ws.data.kind === "host-tunnel") {
+          const parsed = tunnelMessage(
+            ws,
+            message
+          );
+          if (parsed?.type === "ping") {
+            options.directory?.recordPong(ws.data.hostId);
+            ws.send(JSON.stringify(makeTunnelPong(parsed)));
+          }
+          if (parsed?.type === "pong") {
+            options.directory?.recordPong(ws.data.hostId);
+          }
+          if (parsed?.type === "http.response.start") {
+            const pending = ws.data.pending.get(parsed.request_id);
+            if (pending) {
+              pending.responseStarted = true;
+              pending.resolve(new Response(pending.stream, {
+                status: parsed.status,
+                headers: headers(parsed.headers)
+              }));
+            }
+          }
+          if (parsed?.type === "http.response.chunk") {
+            const entry = ws.data.pending.get(parsed.request_id);
+            if (entry) {
+              enqueueChunkWithBackpressure({
+                ws,
+                requestId: parsed.request_id,
+                entry,
+                chunk: decoded(parsed.body_base64),
+                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
+              });
+            }
+          }
+          if (parsed?.type === "http.response.end") {
+            const pending = ws.data.pending.get(parsed.request_id);
+            if (pending) {
+              clearTimeout(pending.timeout);
+              if (pending.slowConsumerTimeout) {
+                clearTimeout(pending.slowConsumerTimeout);
+                pending.slowConsumerTimeout = void 0;
+              }
+              drainPendingChunks(pending);
+              if (pending.pendingChunks.length > 0) {
+                for (const chunk of pending.pendingChunks) {
+                  try {
+                    pending.controller.enqueue(chunk);
+                  } catch {
+                    break;
+                  }
+                }
+                pending.pendingChunks.length = 0;
+                pending.bytesQueued = 0;
+              }
+              try {
+                pending.controller.close();
+              } catch {
+              }
+              ws.data.pending.delete(parsed.request_id);
+            }
+          }
+          if (parsed?.type === "ws.frame") {
+            const frame = parsed;
+            ws.data.channels.get(frame.channel_id)?.send(decodedFrame(frame));
+          }
+          if (parsed?.type === "ws.close") {
+            const close = parsed;
+            const channel = ws.data.channels.get(close.channel_id);
+            if (channel) {
+              ws.data.channels.delete(close.channel_id);
+              channel.close(close.code, close.reason);
+            }
+          }
+          return;
+        }
+        if (ws.data.kind === "user-hosted-client") {
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+          if (!tunnel) {
+            ws.close(1011, "User-hosted tunnel disconnected");
+            return;
+          }
+          tunnel.send(JSON.stringify({
+            type: "ws.frame",
+            protocol: TUNNEL_PROTOCOL_VERSION,
+            channel_id: ws.data.channelId,
+            ...encodedFrame(message)
+          }));
+          return;
+        }
+        if (ws.data.upstream?.readyState === WebSocket.OPEN) {
+          ws.data.upstream.send(message);
+          return;
+        }
+        ws.data.queue.push(message);
+      },
+      open(ws) {
+        if (ws.data.kind === "host-tunnel") {
+          hostTunnels.set(ws.data.hostId, ws);
+          options.directory?.registerHostTunnel({
+            hostId: ws.data.hostId,
+            workspaceIds: ws.data.workspaceIds
+          });
+          ws.data.heartbeat = setInterval(() => {
+            sendTunnelPing(ws);
+          }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
+          scheduleHostTunnelStateChange(options, {
+            hostId: ws.data.hostId,
+            workspaceId: ws.data.workspaceIds[0],
+            path: `/host-tunnels/${ws.data.hostId}`,
+            state: "connected",
+            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
+          });
+          return;
+        }
+        if (ws.data.kind === "user-hosted-client") {
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+          if (!tunnel) {
+            ws.close(1011, "User-hosted tunnel disconnected");
+            return;
+          }
+          tunnel.data.channels.set(ws.data.channelId, ws);
+          tunnel.send(JSON.stringify({
+            type: "ws.open",
+            protocol: TUNNEL_PROTOCOL_VERSION,
+            channel_id: ws.data.channelId,
+            workspace_id: ws.data.workspaceId,
+            path: ws.data.path,
+            headers: headersRecord(workspaceRelayForwardHeaders(
+              new Headers(),
+              ws.data.relayHostToken,
+              ws.data.workspaceId,
+              // T26: user-hosted tunnel WS upgrade — strip Cookie. Headers are
+              // empty here today, but pass the flag for consistency in case
+              // upstream client headers are forwarded in the future.
+              { userHosted: true }
+            ))
+          }));
+          return;
+        }
+        const data = ws.data;
+        const upstream = new WebSocket(data.upstreamUrl, {
+          headers: data.headers
+        });
+        upstream.binaryType = "arraybuffer";
+        data.upstream = upstream;
+        upstream.onopen = () => {
+          for (const item of data.queue.splice(0)) upstream.send(item);
+        };
+        upstream.onmessage = (event) => {
+          const payload = relayWebSocketPayload(event.data);
+          if (payload !== void 0) ws.send(payload);
+        };
+        upstream.onclose = (event) => {
+          ws.close(event.code, event.reason);
+        };
+        upstream.onerror = () => {
+          ws.close(1011, "Upstream WebSocket connection failed");
+        };
+      },
+      close(ws, code, reason) {
+        if (ws.data.kind === "host-tunnel") {
+          if (ws.data.heartbeat) clearInterval(ws.data.heartbeat);
+          hostTunnels.delete(ws.data.hostId);
+          const tracker = hostTunnelRegistrations.get(ws.data.hostId);
+          if (tracker) {
+            tracker.current = Math.max(0, tracker.current - 1);
+            pruneReconnects(tracker, Date.now());
+            if (tracker.current === 0 && tracker.recent.length === 0) {
+              hostTunnelRegistrations.delete(ws.data.hostId);
+            }
+          }
+          for (const pending of ws.data.pending.values()) {
+            clearTimeout(pending.timeout);
+            pending.reject(new Error("User-hosted tunnel disconnected"));
+          }
+          ws.data.pending.clear();
+          for (const channel of ws.data.channels.values()) {
+            channel.close(1011, "User-hosted tunnel disconnected");
+          }
+          ws.data.channels.clear();
+          options.directory?.disconnectHost(ws.data.hostId);
+          scheduleHostTunnelStateChange(options, {
+            hostId: ws.data.hostId,
+            workspaceId: ws.data.workspaceIds[0],
+            path: `/host-tunnels/${ws.data.hostId}`,
+            state: "disconnected",
+            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
+          });
+          return;
+        }
+        if (ws.data.kind === "user-hosted-client") {
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+          tunnel?.data.channels.delete(ws.data.channelId);
+          tunnel?.send(JSON.stringify({
+            type: "ws.close",
+            protocol: TUNNEL_PROTOCOL_VERSION,
+            channel_id: ws.data.channelId,
+            code,
+            reason
+          }));
+          return;
+        }
+        ws.data.upstream?.close(code, reason);
+      }
+    },
+    drain: drainController
+  };
+}
+
+// src/directory.ts
+function createWorkspaceRelayDirectory(options = {}) {
+  const ttlMs = Math.max(1, options.ttlMs ?? 45e3);
+  const now = options.now ?? Date.now;
+  const sweepIntervalMs = options.sweepIntervalMs ?? 3e4;
+  const hosts = /* @__PURE__ */ new Map();
+  const alive = (presence) => {
+    if (!presence) return;
+    if (presence.expiresAt <= now()) {
+      hosts.delete(presence.hostId);
+      return;
+    }
+    return presence;
+  };
+  const touch = (presence) => {
+    const timestamp = now();
+    const next = {
+      ...presence,
+      lastPongAt: timestamp,
+      expiresAt: timestamp + ttlMs
+    };
+    hosts.set(next.hostId, next);
+    return next;
+  };
+  const sweep = () => {
+    const at = now();
+    for (const [hostId, presence] of hosts) {
+      if (presence.expiresAt <= at) {
+        hosts.delete(hostId);
+      }
+    }
+  };
+  let intervalHandle;
+  if (sweepIntervalMs > 0) {
+    intervalHandle = setInterval(sweep, sweepIntervalMs);
+  }
+  return {
+    registerHostTunnel(input) {
+      const timestamp = now();
+      const next = {
+        hostId: input.hostId,
+        workspaceIds: [...new Set(input.workspaceIds)],
+        connectedAt: timestamp,
+        lastPongAt: timestamp,
+        expiresAt: timestamp + ttlMs
+      };
+      hosts.set(next.hostId, next);
+      return next;
+    },
+    recordPong(hostId) {
+      const presence = alive(hosts.get(hostId));
+      return presence ? touch(presence) : void 0;
+    },
+    disconnectHost(hostId) {
+      hosts.delete(hostId);
+    },
+    activeHost(input) {
+      const presence = alive(hosts.get(input.hostId));
+      if (!presence?.workspaceIds.includes(input.workspaceId)) return;
+      return presence;
+    },
+    sweep,
+    size() {
+      const at = now();
+      let count = 0;
+      for (const presence of hosts.values()) {
+        if (presence.expiresAt > at) count += 1;
+      }
+      return count;
+    },
+    dispose() {
+      if (intervalHandle !== void 0) {
+        clearInterval(intervalHandle);
+        intervalHandle = void 0;
+      }
+    }
+  };
+}
+function disposeWorkspaceRelayDirectory(directory) {
+  directory.dispose();
+}
+export {
+  WorkspaceRelayAuthError,
+  __resetHostTunnelStateDebounce,
+  __slowConsumerInternalsForTest,
+  authorizeWorkspaceRelayRequest,
+  createWorkspaceRelay,
+  createWorkspaceRelayBun,
+  createWorkspaceRelayDirectory,
+  disposeAuditSampler,
+  disposeWorkspaceRelayDirectory,
+  getAuditSuppressedCount,
+  getFragmentationStats,
+  getSlowConsumerStats,
+  hostTunnelTokenAudience,
+  mintHostTunnelToken,
+  mintRelayHostToken,
+  mintRuntimeAccessToken,
+  relayHostTokenAudience,
+  relayHostTokenIssuer,
+  resetFragmentationStats,
+  resetSlowConsumerStats,
+  runtimeAccessTokenAudience,
+  runtimeAccessTokenIssuer,
+  verifyHostTunnelToken,
+  verifyRelayHostToken,
+  verifyRuntimeAccessToken,
+  workspaceRelayForwardHeaders,
+  workspaceRelayTargetUrl
+};