@claxedo/workspace-relay 0.10.2 → 0.10.3

package/dist/index.mjs

@@ -450,6 +450,11 @@ var PUBLIC_API_ERRORS = {
   org_invitation_invalid: { family: "access", status: 409, message: "Invitation is invalid or unavailable" },
   org_invitation_pending: { family: "access", status: 409, message: "An invitation to this address is already pending" },
   org_invitation_rate_limited: { family: "access", status: 429, message: "Organization invitation limit exceeded" },
+  org_limit_reached: { family: "access", status: 403, message: "An account owns at most 3 organizations" },
+  org_creation_rate_limited: { family: "access", status: 429, message: "Organization creation limit exceeded" },
+  project_limit_reached: { family: "access", status: 402, message: "Free accounts have 3 projects. Get Cloud or Self-host for unlimited projects." },
+  seats_full: { family: "access", status: 402, message: "Add teammate seats to invite more people." },
+  email_verification_required: { family: "access", status: 403, message: "A verified email address is required" },
   org_invitation_email_mismatch: { family: "access", status: 403, message: "Sign in with the invited verified email address" },
   org_invitation_delivery_unavailable: { family: "access", status: 503, message: "Invitation delivery is unavailable" },
   team_not_found: { family: "access", status: 404, message: "Team not found" },
@@ -459,6 +464,12 @@ var PUBLIC_API_ERRORS = {
   project_member_not_found: { family: "access", status: 404, message: "Project member not found" },
   project_member_owner_immutable: { family: "access", status: 409, message: "The project owner's access cannot be changed" },
   resource_conflict: { family: "access", status: 409, message: "Organization or team authority changed concurrently" },
+  org_not_deletable: { family: "access", status: 409, message: "A personal organization goes with its account, and a deployment's with the deployment" },
+  org_has_workspaces: { family: "access", status: 409, message: "Delete the organization's workspaces first" },
+  account_owns_workspaces: { family: "access", status: 409, message: "Delete your workspaces first" },
+  account_founds_organization: { family: "access", status: 409, message: "Delete the organizations you founded first" },
+  account_has_cloud_subscription: { family: "access", status: 409, message: "Cancel Cloud before deleting this account" },
+  recent_sign_in_required: { family: "access", status: 403, message: "Sign in again to confirm this deletion" },
   session_not_found: { family: "session_share", status: 404, message: "This session is not on the control plane, so it cannot be shared from People yet." },
   session_share_admin_required: { family: "session_share", status: 403, message: "Only the person who started this session can manage its People." },
   session_share_target_required: { family: "session_share", status: 400, message: "A session is shared with exactly one person" },
@@ -682,7 +693,7 @@ function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
 }
 var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
 var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
-var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
+var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 3e4;
 var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
 var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
@@ -1089,6 +1100,246 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
   }
 }
 
+// ../claxedo-helpers/dist/deadline.mjs
+async function withDeadlineSignal(timeoutMs, work, parent) {
+  const deadline = new AbortController();
+  const timer = setTimeout(() => deadline.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
+  try {
+    return await work(parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/resolver-clients.ts
+function parseRuntimeAccessTokenActiveResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (row.active === true) return { active: true };
+  if (row.active !== false) return void 0;
+  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
+  return { active: false, code: row.code, reason: row.reason };
+}
+function parseHostGenerationResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
+  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
+  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+}
+var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
+var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
+function createHostGenerationResolverLookup(url, options) {
+  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
+  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
+  return async ({ enrollmentId }) => {
+    const target = new URL(url);
+    target.searchParams.set("enrollmentId", enrollmentId);
+    return withDeadlineSignal(timeoutMs, async (signal) => {
+      const res = await fetcher(target, { headers: options.headers, signal });
+      if (res.status === 404) {
+        const body = await res.json().catch(() => void 0);
+        const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+        if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
+        throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
+      }
+      if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
+      const result = parseHostGenerationResult(await res.json());
+      if (!result) throw new Error("relay host-generation resolver returned a malformed result");
+      return result;
+    });
+  };
+}
+var RESOLVER_CACHE_MAX_ENTRIES = 8192;
+var REVOCATION_CACHE_TTL_MS_DEFAULT = 3e4;
+var TARGET_CACHE_TTL_MS_DEFAULT = 3e4;
+var DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT = 30 * 6e4;
+function pruneExpiringCache(cache, now, maxEntries) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= maxEntries) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+var REVOCATION_RESOLVER_UNAVAILABLE = "relay_revocation_resolver_unavailable";
+function createCachedRevocationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  const ask = (args, at) => {
+    const prior = cache.get(args.jti)?.held;
+    const settle = (standing) => {
+      const settledAt = now();
+      const kept = prior && settledAt - prior.checkedAt < ttlMs ? prior : void 0;
+      const unreachable = !standing || !standing.result.active && standing.result.code === REVOCATION_RESOLVER_UNAVAILABLE;
+      const held = unreachable && kept ? kept : standing;
+      if (!held) {
+        cache.delete(args.jti);
+        return;
+      }
+      pruneExpiringCache(cache, settledAt, RESOLVER_CACHE_MAX_ENTRIES);
+      cache.set(args.jti, { held, expiresAt: held.checkedAt + ttlMs });
+    };
+    const asking = inner(args).then(
+      (result) => {
+        const standing = { result, checkedAt: now() };
+        settle(standing);
+        return standing;
+      },
+      (err) => {
+        settle();
+        throw err;
+      }
+    );
+    cache.set(args.jti, { asking, ...prior ? { held: prior } : {}, expiresAt: at + ttlMs });
+    return asking;
+  };
+  const within = async (args, maxAgeMs) => {
+    const at = now();
+    const entry = cache.get(args.jti);
+    if (entry?.held && at - entry.held.checkedAt < Math.min(maxAgeMs, ttlMs)) return entry.held;
+    return await (entry?.asking ?? ask(args, at));
+  };
+  return Object.assign(async (args) => (await within(args, ttlMs)).result, { within, ttlMs });
+}
+function runtimeAccessTokenRevocationDelayMs(input = {}) {
+  const configuredTtl = input.revocationCacheTtlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const ttlMs = Number.isFinite(configuredTtl) && configuredTtl > 0 ? configuredTtl : 0;
+  if (input.activeCheckIntervalMs === void 0) return ttlMs;
+  if (!Number.isFinite(input.activeCheckIntervalMs) || input.activeCheckIntervalMs <= 0) {
+    return Number.POSITIVE_INFINITY;
+  }
+  return ttlMs + input.activeCheckIntervalMs;
+}
+function createCachedHostGenerationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    for (; ; ) {
+      const at = now();
+      const entry = cache.get(args.enrollmentId);
+      if (entry && entry.expiresAt > at) {
+        if (entry.result && entry.result.generation >= args.generation) return entry.result;
+        if (!entry.result && entry.promise) {
+          const shared = await entry.promise;
+          if (!shared || shared.generation >= args.generation) return shared;
+          continue;
+        }
+      }
+      const promise = inner(args).then((result) => {
+        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
+        else cache.delete(args.enrollmentId);
+        return result;
+      }).catch((err) => {
+        cache.delete(args.enrollmentId);
+        throw err;
+      });
+      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
+      return await promise;
+    }
+  };
+}
+function createCachedTargetClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? TARGET_CACHE_TTL_MS_DEFAULT;
+  const durableObjectTtlMs = options.durableObjectTtlMs ?? DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const key = `${args.workspaceId}\0${args.hostId}\0${args.routingId ?? ""}`;
+    const at = now();
+    const entry = cache.get(key);
+    if (entry && entry.expiresAt > at) {
+      if (entry.target) return entry.target;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((target) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      if (target) cache.set(key, { target, expiresAt: now() + (target.backing === "durable-object" ? durableObjectTtlMs : ttlMs) });
+      else cache.delete(key);
+      return target;
+    }).catch((err) => {
+      cache.delete(key);
+      throw err;
+    });
+    cache.set(key, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
+
+// src/stream-standing.ts
+var STANDING_REFRESH_LEAD_MS = 2e3;
+function guardStreamStanding(response, claims, options) {
+  const source = response.body;
+  const read = options.standing;
+  if (!source || !read) return response;
+  const now = options.now ?? Date.now;
+  const reader = source.getReader();
+  const refreshMs = Math.max(options.boundMs - (options.leadMs ?? STANDING_REFRESH_LEAD_MS), 1);
+  let timer;
+  let failures = 0;
+  let done = false;
+  const body = new ReadableStream({
+    start(controller) {
+      const end = (reason) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        controller.error(new Error(reason));
+        void reader.cancel(reason).catch(() => {
+        });
+      };
+      const wait = (checkedAt) => {
+        if (done) return;
+        const expiresAt = claims.exp * 1e3;
+        const due = Math.min(checkedAt + refreshMs, expiresAt);
+        timer = setTimeout(() => {
+          if (now() >= expiresAt) return end("Runtime Access Token expired");
+          void check(refreshMs);
+        }, Math.max(due - now(), 0));
+      };
+      const check = async (maxAgeMs) => {
+        const standing = await read(claims, maxAgeMs).catch(() => void 0);
+        if (done) return;
+        const unreachable = !standing || !standing.result.active && standing.result.code === REVOCATION_RESOLVER_UNAVAILABLE;
+        if (unreachable) {
+          failures += 1;
+          return failures >= options.graceAttempts ? end("Runtime Access Token could not be checked") : wait(now());
+        }
+        if (!standing.result.active) return end(standing.result.reason);
+        failures = 0;
+        wait(standing.checkedAt);
+      };
+      void check(options.boundMs);
+    },
+    async pull(controller) {
+      try {
+        const chunk = await reader.read();
+        if (done) return;
+        if (!chunk.done) return controller.enqueue(chunk.value);
+        done = true;
+        clearTimeout(timer);
+        controller.close();
+      } catch (err) {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        controller.error(err);
+      }
+    },
+    cancel(reason) {
+      done = true;
+      clearTimeout(timer);
+      return reader.cancel(reason);
+    }
+  });
+  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}
+
 // src/directory.ts
 function presenceKey(hostId, workspaceId) {
   return `${hostId}\0${workspaceId}`;
@@ -1331,18 +1582,17 @@ async function relayRoomPlacement(request, input) {
   const configured = trimToUndefined2(input.configured);
   const region = relayRequestRegion(request);
   const country = relayRequestCountry(request);
-  const floor = relayLocationHint(configured ? { configured } : {});
-  const declared = relayLocationHint({
-    ...configured ? { configured } : {},
-    ...region ? { region } : {},
-    ...country ? { country } : {}
-  });
   const headers = new Headers(request.headers);
   headers.delete(RELAY_REGION_HEADER);
   const credential = await input.credential();
   const sessionHost = credential !== void 0 && sessionHostRootOf(credential.hostId) !== void 0;
+  const declared = relayLocationHint({
+    ...configured ? { configured } : {},
+    ...credential?.declaresRegion && region ? { region } : {},
+    ...credential && country ? { country } : {}
+  });
   return {
-    locationHint: sessionHost ? SESSION_HOST_LOCATION_HINT : credential || declared === floor ? declared : floor,
+    locationHint: sessionHost ? SESSION_HOST_LOCATION_HINT : declared,
     url: withoutQueryParams(request.url, RELAY_REGION_QUERY_PARAMS),
     headers
   };
@@ -1418,12 +1668,12 @@ async function relayPlacementCredential(request, env, url, workspaceId) {
       const token2 = bearerToken(request.headers.get("authorization"));
       if (!hostId || !token2) return void 0;
       await verifyHostTunnelToken(token2, key, { hostId, workspaceIds: workspaceIdsFromSearch(url) });
-      return { hostId };
+      return { hostId, declaresRegion: true };
     }
     const token = runtimeAccessTokenFrom(request);
     if (!token) return void 0;
     const claims = await verifyRuntimeAccessToken(token, key, { workspaceId });
-    return { hostId: claims.host_id };
+    return { hostId: claims.host_id, declaresRegion: claims.routing_id !== void 0 };
   } catch {
     return void 0;
   }
@@ -1435,6 +1685,136 @@ function workspaceRelayRoomPlacement(request, env, workspaceId) {
   });
 }
 
+// src/relay-bytes.ts
+var BASE64_CHUNK_BYTES = 32768;
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += BASE64_CHUNK_BYTES) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + BASE64_CHUNK_BYTES));
+  }
+  return btoa(binary);
+}
+function base64ToBytes(input) {
+  return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
+}
+function concatBytes(chunks) {
+  const length = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+  const result = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+}
+async function readRequestBodyCapped(request, maxBytes) {
+  if (!request.body) return new Uint8Array(0);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => {
+      });
+      return "too_large";
+    }
+    chunks.push(value);
+  }
+  return concatBytes(chunks);
+}
+
+// src/relay-log.ts
+function relayLogOf(options) {
+  return options.relayLog ?? ((event) => console.log(JSON.stringify(event)));
+}
+function frameDropWorthLogging(dropped) {
+  return dropped <= 3 || dropped % 100 === 0;
+}
+var TIMED_OUT_REQUESTS_REMEMBERED = 32;
+function rememberTimedOut(timedOut, requestId, at) {
+  timedOut.set(requestId, at);
+  if (timedOut.size <= TIMED_OUT_REQUESTS_REMEMBERED) return;
+  const oldest = timedOut.keys().next().value;
+  if (oldest !== void 0) timedOut.delete(oldest);
+}
+
+// src/socket-frames.ts
+var UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES = 64;
+function preOpenFrameBytes(input) {
+  const payload = typeof input === "string" ? new TextEncoder().encode(input).byteLength : input.byteLength;
+  return payload + UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES;
+}
+function isBlobLike(input) {
+  if (!input || typeof input !== "object") return false;
+  return "arrayBuffer" in input && typeof input.arrayBuffer === "function";
+}
+function viewBytes(input) {
+  return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+}
+function socketFrame(input) {
+  if (typeof input === "string") {
+    return {
+      binary: false,
+      data_base64: bytesToBase64(new TextEncoder().encode(input))
+    };
+  }
+  if (input instanceof ArrayBuffer) {
+    return {
+      binary: true,
+      data_base64: bytesToBase64(new Uint8Array(input))
+    };
+  }
+  if (input instanceof Uint8Array) {
+    return {
+      binary: true,
+      data_base64: bytesToBase64(input)
+    };
+  }
+  if (ArrayBuffer.isView(input)) {
+    return {
+      binary: true,
+      data_base64: bytesToBase64(viewBytes(input))
+    };
+  }
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer().then((buffer) => ({
+    binary: true,
+    data_base64: bytesToBase64(new Uint8Array(buffer))
+  }));
+}
+function socketPayload(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof ArrayBuffer) return input;
+  if (input instanceof Uint8Array) return input;
+  if (ArrayBuffer.isView(input)) return viewBytes(input);
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer();
+}
+function orderedFrameDelivery(deliver) {
+  let tail;
+  return (data) => {
+    const payload = socketPayload(data);
+    if (payload === void 0) return;
+    if (tail === void 0 && !(payload instanceof Promise)) {
+      deliver(payload);
+      return;
+    }
+    const queued = (tail ?? Promise.resolve()).then(async () => deliver(await payload)).catch(() => {
+    });
+    tail = queued;
+    void queued.then(() => {
+      if (tail === queued) tail = void 0;
+    });
+  };
+}
+function tunnelFrame(input) {
+  const bytes = base64ToBytes(input.data_base64);
+  return input.binary ? bytes : new TextDecoder().decode(bytes);
+}
+
 // src/relay-trace.ts
 import { trimToUndefined as trimToUndefined4 } from "@claxedo/helpers/string";
 var TRACE_ID_HEADER = "x-claxedo-trace-id";
@@ -1451,12 +1831,15 @@ function traceRequest(request, routeKind, options) {
   const forceSecret = trimToUndefined4(options.traceForceHeaderSecret);
   const forced = !!forceSecret && request.headers.get(TRACE_FORCE_HEADER) === forceSecret;
   const rate = clampRate(options.traceSampleRate);
+  const sampled = forced || rate > 0 && (options.random ?? Math.random)() < rate;
+  const roomColo = sampled ? options.roomColo?.() : void 0;
   return {
     id,
-    sampled: forced || rate > 0 && (options.random ?? Math.random)() < rate,
+    sampled,
     startedAt: performance.now(),
     routeKind,
-    phases: []
+    phases: [],
+    ...roomColo ? { roomColo } : {}
   };
 }
 async function traceSpan(trace, name, fn) {
@@ -1497,7 +1880,8 @@ function webSocketTraceFrame(upstreamStartedAt, queueTimes, openedAt) {
 function withTraceHeaders(response, trace) {
   const headers = new Headers(response.headers);
   headers.set(TRACE_ID_HEADER, trace.id);
-  const timing = trace.sampled ? serverTiming(trace.phases) : "";
+  const colo = trace.roomColo ? `relay-room-colo;desc=${trace.roomColo}` : "";
+  const timing = trace.sampled ? [serverTiming(trace.phases), colo].filter(Boolean).join(", ") : "";
   if (timing) {
     const existing = headers.get("server-timing");
     headers.set("server-timing", existing ? `${existing}, ${timing}` : timing);
@@ -1509,10 +1893,11 @@ function withTraceHeaders(response, trace) {
     headers
   });
 }
+var SLOW_REQUEST_MS = 5e3;
 function logTrace(options, request, workspaceId, trace, response) {
-  if (!trace.sampled) return;
-  const url = new URL(request.url);
   const totalMs = performance.now() - trace.startedAt;
+  if (!trace.sampled && response.status < 500 && totalMs <= SLOW_REQUEST_MS) return;
+  const url = new URL(request.url);
   const event = {
     event: "workspace_relay_request",
     traceId: trace.id,
@@ -1528,181 +1913,58 @@ function logTrace(options, request, workspaceId, trace, response) {
     options.traceLog(event);
     return;
   }
-  console.log(JSON.stringify(event));
-}
-
-// src/cloudflare.ts
-var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
-var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
-var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 8192;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES = 64;
-var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
-var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
-var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-function unrefTimer(timer) {
-  if (typeof timer.unref === "function") timer.unref();
-}
-function isHostTunnelClient(client) {
-  return "channelId" in client && typeof client.channelId === "string";
-}
-function workspaceIdFromRelayPath(pathname) {
-  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function websocketRequest(request) {
-  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
-}
-function relayWebSocketTraceEnabled(request) {
-  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
-}
-function randomToken() {
-  return crypto.randomUUID();
-}
-function headerRecord(headers) {
-  const result = /* @__PURE__ */ Object.create(null);
-  headers.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
-}
-function headersFromRecord(input) {
-  const headers = new Headers();
-  for (const [key, value] of Object.entries(input)) headers.set(key, value);
-  return headers;
-}
-var BASE64_CHUNK_BYTES = 32768;
-function bytesToBase64(bytes) {
-  let binary = "";
-  for (let i = 0; i < bytes.length; i += BASE64_CHUNK_BYTES) {
-    binary += String.fromCharCode(...bytes.subarray(i, i + BASE64_CHUNK_BYTES));
-  }
-  return btoa(binary);
-}
-function base64ToBytes(input) {
-  return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
-}
-function preOpenFrameBytes(input) {
-  const payload = typeof input === "string" ? new TextEncoder().encode(input).byteLength : input.byteLength;
-  return payload + UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES;
-}
-function isBlobLike(input) {
-  if (!input || typeof input !== "object") return false;
-  return "arrayBuffer" in input && typeof input.arrayBuffer === "function";
-}
-function viewBytes(input) {
-  return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
-}
-function socketFrame(input) {
-  if (typeof input === "string") {
-    return {
-      binary: false,
-      data_base64: bytesToBase64(new TextEncoder().encode(input))
-    };
-  }
-  if (input instanceof ArrayBuffer) {
-    return {
-      binary: true,
-      data_base64: bytesToBase64(new Uint8Array(input))
-    };
-  }
-  if (input instanceof Uint8Array) {
-    return {
-      binary: true,
-      data_base64: bytesToBase64(input)
-    };
-  }
-  if (ArrayBuffer.isView(input)) {
-    return {
-      binary: true,
-      data_base64: bytesToBase64(viewBytes(input))
-    };
-  }
-  if (!isBlobLike(input)) return void 0;
-  return input.arrayBuffer().then((buffer) => ({
-    binary: true,
-    data_base64: bytesToBase64(new Uint8Array(buffer))
-  }));
+  console.log(JSON.stringify(event));
 }
-function socketPayload(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof ArrayBuffer) return input;
-  if (input instanceof Uint8Array) return input;
-  if (ArrayBuffer.isView(input)) return viewBytes(input);
-  if (!isBlobLike(input)) return void 0;
-  return input.arrayBuffer();
+
+// src/cloudflare.ts
+var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
+var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
+var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
+var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
+var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
+var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
+var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 8192;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
+var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
+var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
+var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+function unrefTimer(timer) {
+  if (typeof timer.unref === "function") timer.unref();
 }
-function orderedFrameDelivery(deliver) {
-  let tail;
-  return (data) => {
-    const payload = socketPayload(data);
-    if (payload === void 0) return;
-    if (tail === void 0 && !(payload instanceof Promise)) {
-      deliver(payload);
-      return;
-    }
-    const queued = (tail ?? Promise.resolve()).then(async () => deliver(await payload)).catch(() => {
-    });
-    tail = queued;
-    void queued.then(() => {
-      if (tail === queued) tail = void 0;
-    });
-  };
+function isHostTunnelClient(client) {
+  return "channelId" in client && typeof client.channelId === "string";
 }
-async function relayFrameDiagnostics(data) {
-  const frame = await socketFrame(data);
-  const payload = await socketPayload(data);
-  return {
-    // `undefined` here is exactly the silent drop: every caller treats it as
-    // "nothing to forward" and returns without a throw or a log.
-    frameDropped: frame === void 0,
-    payloadDropped: payload === void 0,
-    ...frame ? { binary: frame.binary, dataBase64: frame.data_base64 } : {},
-    payloadBase64: payload === void 0 ? void 0 : typeof payload === "string" ? bytesToBase64(new TextEncoder().encode(payload)) : bytesToBase64(payload instanceof ArrayBuffer ? new Uint8Array(payload) : payload)
-  };
+function workspaceIdFromRelayPath(pathname) {
+  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
-function tunnelFrame(input) {
-  const bytes = base64ToBytes(input.data_base64);
-  return input.binary ? bytes : new TextDecoder().decode(bytes);
+function websocketRequest(request) {
+  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
-function concatBytes(chunks) {
-  const length = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
-  const result = new Uint8Array(length);
-  let offset = 0;
-  for (const chunk of chunks) {
-    result.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
+function relayWebSocketTraceEnabled(request) {
+  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
+}
+function randomToken() {
+  return crypto.randomUUID();
+}
+function headerRecord(headers) {
+  const result = /* @__PURE__ */ Object.create(null);
+  headers.forEach((value, key) => {
+    result[key] = value;
+  });
   return result;
 }
+function headersFromRecord(input) {
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(input)) headers.set(key, value);
+  return headers;
+}
 function responseMustNotHaveBody(status) {
   return status === 204 || status === 205 || status === 304;
 }
-async function readRequestBodyCapped(request, maxBytes) {
-  if (!request.body) return new Uint8Array(0);
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > maxBytes) {
-      await reader.cancel().catch(() => {
-      });
-      return "too_large";
-    }
-    chunks.push(value);
-  }
-  return concatBytes(chunks);
-}
 function workspaceRelayDurableObjectRoomName(workspaceId) {
-  return `workspace:${workspaceId}`;
+  return `relay-room:${workspaceId}`;
 }
 function workspaceRelayDurableObjectWorkspaceId(request) {
   const url = new URL(request.url);
@@ -1873,7 +2135,22 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       return false;
     }
   };
-  const cleanupTunnelResources = (tunnel, reason) => {
+  const relayLog = relayLogOf(options);
+  const clock = () => options.now?.() ?? Date.now();
+  const cleanupTunnelResources = (tunnel, reason, detail = {}) => {
+    if (!tunnel.ended) {
+      relayLog({
+        event: "tunnel_ended",
+        hostId: tunnel.hostId,
+        generation: tunnel.generation,
+        reason,
+        ageMs: clock() - tunnel.connectedAt,
+        pendingFailed: tunnel.pending.size,
+        channelsClosed: tunnel.channels.size,
+        ...detail
+      });
+    }
+    tunnel.ended = true;
     if (tunnel.generationWatcher) clearInterval(tunnel.generationWatcher);
     tunnel.generationWatcher = void 0;
     for (const pending of tunnel.pending.values()) {
@@ -1919,6 +2196,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           generationCheckFailures: attachment.generationCheckFailures ?? 0,
           socket,
           pending: /* @__PURE__ */ new Map(),
+          timedOut: /* @__PURE__ */ new Map(),
+          droppedFrames: 0,
           channels: /* @__PURE__ */ new Map()
         });
         directory.registerHostTunnel({
@@ -1964,7 +2243,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
   };
   const resolverGraceAttempts = options.resolverOutageGraceAttempts ?? RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT;
-  const resolverUnreachable = (code) => code === "relay_revocation_resolver_unavailable";
+  const resolverUnreachable = (code) => code === REVOCATION_RESOLVER_UNAVAILABLE;
   const watchRuntimeAccessToken = (client, onInactive) => {
     const intervalMs = options.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
     if (intervalMs <= 0) return void 0;
@@ -2256,8 +2535,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }));
   };
   const reportFrameHandlerFailure = (socket, err) => {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(`[workspace-relay] frame handler failed: ${reason}`);
+    options.report(err, "frame_handler");
     closeSocket(socket, 1011, "Workspace relay failed to process a frame");
   };
   const hibernatedRevocationIntervalMs = () => options.hibernatedRevocationCheckIntervalMs ?? HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT;
@@ -2371,10 +2649,23 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   };
   const handleTunnelMessage = async (hostId, socket, event) => {
     const row = parseTunnelMessageData(event.data);
-    if (!row.ok) return;
-    const parsed = validateTunnelMessage(row.value);
+    const parsed = row.ok ? validateTunnelMessage(row.value) : { ok: false, reason: "not_json" };
     const tunnel = hostTunnels.get(hostId);
-    if (!parsed.ok || !tunnel || tunnel.socket !== socket) return;
+    if (!tunnel || tunnel.socket !== socket) return;
+    if (!parsed.ok) {
+      tunnel.droppedFrames++;
+      if (frameDropWorthLogging(tunnel.droppedFrames)) {
+        relayLog({
+          event: "tunnel_frame_dropped",
+          hostId,
+          reason: parsed.reason,
+          dropped: tunnel.droppedFrames,
+          ..."type" in parsed && parsed.type ? { type: parsed.type } : {},
+          ..."actual_protocol" in parsed ? { protocol: String(parsed.actual_protocol) } : {}
+        });
+      }
+      return;
+    }
     directory.recordPong(tunnel.hostId);
     if (parsed.message.type === "ping") {
       tunnel.socket.send?.(JSON.stringify(makeTunnelPong(parsed.message)));
@@ -2393,7 +2684,13 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (parsed.message.type === "http.response.start") {
       const message = parsed.message;
       const pending = tunnel.pending.get(message.request_id);
-      if (!pending) return;
+      if (!pending) {
+        const timedOutAt = tunnel.timedOut.get(message.request_id);
+        if (timedOutAt === void 0) return;
+        tunnel.timedOut.delete(message.request_id);
+        relayLog({ event: "tunnel_late_response", hostId: tunnel.hostId, requestId: message.request_id, lateMs: clock() - timedOutAt });
+        return;
+      }
       pending.status = message.status;
       pending.headers = headersFromRecord(message.headers);
       if (responseMustNotHaveBody(pending.status)) return;
@@ -2483,10 +2780,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       return { ok: false };
     }
   };
-  const cleanupHostTunnel = (hostId, socket, reason) => {
+  const cleanupHostTunnel = (hostId, socket, reason, detail) => {
     const tunnel = hostTunnels.get(hostId);
     if (tunnel?.socket !== socket) return;
-    cleanupTunnelResources(tunnel, reason);
+    cleanupTunnelResources(tunnel, reason, detail);
     hostTunnels.delete(hostId);
     directory.disconnectHost(hostId);
   };
@@ -2507,29 +2804,33 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
   };
   const admitHostTunnel = async (request, roomWorkspaceId, url) => {
-    if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
+    const refused = (code, message, status) => {
+      relayLog({ event: "tunnel_refused", code, hostId: trimToUndefined5(hostIdFromTunnelPath(url.pathname)) });
+      return json(code, message, status);
+    };
+    if (!websocketRequest(request)) return refused("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
     const hostId = trimToUndefined5(hostIdFromTunnelPath(url.pathname));
-    if (!hostId) return json("host_tunnel_host_required", "Host tunnel id is required", 400);
+    if (!hostId) return refused("host_tunnel_host_required", "Host tunnel id is required", 400);
     const workspaceIds = workspaceIdsFromSearch(url);
     if (!workspaceIds.includes(roomWorkspaceId)) {
-      return json("host_tunnel_workspace_mismatch", "Host tunnel must include the room workspace id", 403);
+      return refused("host_tunnel_workspace_mismatch", "Host tunnel must include the room workspace id", 403);
     }
     const token = bearerToken(request.headers.get("authorization"));
-    if (!token) return json("host_tunnel_token_required", "Host Tunnel Token is required", 401);
+    if (!token) return refused("host_tunnel_token_required", "Host Tunnel Token is required", 401);
     let claims;
     try {
       claims = await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
     } catch (err) {
       if (err instanceof WorkspaceRelayAuthError) {
-        return json(err.code, "Host Tunnel Token was denied", 403);
+        return refused(err.code, "Host Tunnel Token was denied", 403);
       }
       throw err;
     }
     const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, claims);
-    if (!decision.ok) return json(decision.code, decision.reason, decision.retryable ? 503 : 403);
+    if (!decision.ok) return refused(decision.code, decision.reason, decision.retryable ? 503 : 403);
     const previous = hostTunnels.get(hostId);
     if (previous && hostTunnelIncumbentOutranks(previous.generation, claims.generation)) {
-      return json("host_generation_superseded", "Host tunnel generation was superseded", 403);
+      return refused("host_generation_superseded", "Host tunnel generation was superseded", 403);
     }
     const connectedAt = options.now?.() ?? Date.now();
     const fence = {
@@ -2545,12 +2846,15 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       generationCheckFailures: 0,
       socket: pair.server,
       pending: /* @__PURE__ */ new Map(),
+      timedOut: /* @__PURE__ */ new Map(),
+      droppedFrames: 0,
       channels: /* @__PURE__ */ new Map()
     };
     if (previous) {
       cleanupTunnelResources(previous, "Host tunnel replaced");
       closeSocket(previous.socket, 1012, "Host tunnel replaced");
     }
+    relayLog({ event: "tunnel_admitted", hostId, workspaceIds, generation: claims.generation, ...previous ? { replacedAgeMs: connectedAt - previous.connectedAt } : {} });
     hostTunnels.set(hostId, tunnel);
     directory.registerHostTunnel({ hostId, workspaceIds });
     watchHostGeneration(tunnel);
@@ -2560,7 +2864,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         if (!event || event.data === void 0) return;
         void handleTunnelMessage(hostId, pair.server, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
-      pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
+      pair.server.addEventListener?.("close", (event) => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected", { closeCode: event?.code, closeReason: event?.reason }));
       pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
     }
     return upgradeResponse(pair.client, request);
@@ -2744,13 +3048,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       })
     );
     if (!authorized.ok) return authorized.response;
-    if (isHostTunnelTarget(authorized.request.target)) {
+    const response = await forwardAuthorizedHttp(request, workspaceId, authorized.request, trace);
+    if (!options.streamStanding) return response;
+    return guardStreamStanding(response, authorized.request.claims, { ...options.streamStanding, graceAttempts: resolverGraceAttempts, ...options.now ? { now: options.now } : {} });
+  };
+  const forwardAuthorizedHttp = async (request, workspaceId, authorized, trace) => {
+    if (isHostTunnelTarget(authorized.target)) {
       trace && (trace.routeKind = "host-tunnel-http");
-      return forwardHostTunnelHttp(request, authorized.request, trace);
+      return forwardHostTunnelHttp(request, authorized, trace);
     }
-    if (isSessionHostTarget(authorized.request.target)) {
+    if (isSessionHostTarget(authorized.target)) {
       trace && (trace.routeKind = "session-host-http");
-      return traceSpan(trace, "session-host-fetch", () => forwardSessionHostHttp(options.sessionHost, request, authorized.request));
+      return traceSpan(trace, "session-host-fetch", () => forwardSessionHostHttp(options.sessionHost, request, authorized));
     }
     trace && (trace.routeKind = "cloud-http");
     const controller = new AbortController();
@@ -2758,11 +3067,11 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     try {
       const upstream = await traceSpan(trace, "upstream-fetch", () => (options.fetch ?? fetch)(
         workspaceRelayTargetUrl(
-          authorized.request.target,
-          authorized.request.path,
+          authorized.target,
+          authorized.path,
           new URL(request.url).search
         ),
-        workspaceRelayForwardRequestInit(request, authorized.request.relayHostToken, workspaceId, {
+        workspaceRelayForwardRequestInit(request, authorized.relayHostToken, workspaceId, {
           signal: controller.signal
         })
       ));
@@ -2807,9 +3116,23 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       return json("request_body_too_large", "Host tunnel request body exceeds the relay limit", 413);
     }
     const body = bodyBytes ? bytesToBase64(bodyBytes) : void 0;
+    const forwardTimeoutMs = options.forwardTimeoutMs ?? 3e4;
     const pending = new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         tunnel.pending.delete(requestId);
+        rememberTimedOut(tunnel.timedOut, requestId, clock());
+        relayLog({
+          event: "tunnel_timeout",
+          hostId: tunnel.hostId,
+          ...trace ? { traceId: trace.id } : {},
+          requestId,
+          method: request.method,
+          path: authorized.path,
+          bodyBytes: bodyBytes ? bodyBytes.byteLength : 0,
+          timeoutMs: forwardTimeoutMs,
+          tunnelAgeMs: clock() - tunnel.connectedAt,
+          pending: tunnel.pending.size
+        });
         tunnel.socket.send?.(JSON.stringify({
           type: "http.response.flow",
           protocol: TUNNEL_PROTOCOL_VERSION,
@@ -2818,7 +3141,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           reason: "closed"
         }));
         reject(hostTunnelFailure("host_tunnel_timeout"));
-      }, options.forwardTimeoutMs ?? 3e4);
+      }, forwardTimeoutMs);
       tunnel.pending.set(requestId, {
         chunks: [],
         bytes: 0,
@@ -2902,7 +3225,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       try {
         await runHibernatedRevocationCheck();
       } catch (err) {
-        console.error(`[workspace-relay] revocation alarm failed: ${err instanceof Error ? err.message : String(err)}`);
+        options.report(err, "revocation_alarm");
       }
     },
     webSocketClose(socket, code, reason) {
@@ -2911,17 +3234,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected", { closeCode: code, closeReason: reason });
         return;
       }
       cleanupHostTunnelClient(attachment.channelId, socket, { code, reason });
     },
-    webSocketError(socket) {
+    webSocketError(socket, error) {
       ensureHibernatedSocketsRebuilt();
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected", { socketError: error instanceof Error ? error.message : typeof error === "string" ? error : "unknown" });
         return;
       }
       cleanupHostTunnelClient(attachment.channelId, socket, { code: 1011, reason: "WebSocket error" });
@@ -2938,171 +3261,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     drain: drainController
   };
 }
-
-// ../claxedo-helpers/dist/deadline.mjs
-async function withDeadlineSignal(timeoutMs, work, parent) {
-  const deadline = new AbortController();
-  const timer = setTimeout(() => deadline.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
-  try {
-    return await work(parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/resolver-clients.ts
-function parseRuntimeAccessTokenActiveResult(input) {
-  if (!isRecord(input)) return void 0;
-  const row = input;
-  if (row.active === true) return { active: true };
-  if (row.active !== false) return void 0;
-  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
-  return { active: false, code: row.code, reason: row.reason };
-}
-function parseHostGenerationResult(input) {
-  if (!isRecord(input)) return void 0;
-  const row = input;
-  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
-  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
-  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
-}
-var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
-var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
-function createHostGenerationResolverLookup(url, options) {
-  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
-  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
-  return async ({ enrollmentId }) => {
-    const target = new URL(url);
-    target.searchParams.set("enrollmentId", enrollmentId);
-    return withDeadlineSignal(timeoutMs, async (signal) => {
-      const res = await fetcher(target, { headers: options.headers, signal });
-      if (res.status === 404) {
-        const body = await res.json().catch(() => void 0);
-        const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-        if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
-        throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
-      }
-      if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
-      const result = parseHostGenerationResult(await res.json());
-      if (!result) throw new Error("relay host-generation resolver returned a malformed result");
-      return result;
-    });
-  };
-}
-var RESOLVER_CACHE_MAX_ENTRIES = 8192;
-var REVOCATION_CACHE_TTL_MS_DEFAULT = 1e4;
-var TARGET_CACHE_TTL_MS_DEFAULT = 1e4;
-var DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT = 30 * 6e4;
-function pruneExpiringCache(cache, now, maxEntries) {
-  for (const [key, entry] of cache) {
-    if (entry.expiresAt <= now) cache.delete(key);
-  }
-  while (cache.size >= maxEntries) {
-    const key = cache.keys().next().value;
-    if (!key) return;
-    cache.delete(key);
-  }
-}
-function createCachedRevocationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const at = now();
-    const entry = cache.get(args.jti);
-    if (entry && entry.expiresAt > at) {
-      if (entry.result) return entry.result;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((result) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
-      return result;
-    }).catch((err) => {
-      cache.delete(args.jti);
-      throw err;
-    });
-    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
-}
-function runtimeAccessTokenRevocationDelayMs(input = {}) {
-  const configuredTtl = input.revocationCacheTtlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
-  const ttlMs = Number.isFinite(configuredTtl) && configuredTtl > 0 ? configuredTtl : 0;
-  if (input.activeCheckIntervalMs === void 0) return ttlMs;
-  if (!Number.isFinite(input.activeCheckIntervalMs) || input.activeCheckIntervalMs <= 0) {
-    return Number.POSITIVE_INFINITY;
-  }
-  return ttlMs + input.activeCheckIntervalMs;
-}
-function createCachedHostGenerationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 1e4;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    for (; ; ) {
-      const at = now();
-      const entry = cache.get(args.enrollmentId);
-      if (entry && entry.expiresAt > at) {
-        if (entry.result && entry.result.generation >= args.generation) return entry.result;
-        if (!entry.result && entry.promise) {
-          const shared = await entry.promise;
-          if (!shared || shared.generation >= args.generation) return shared;
-          continue;
-        }
-      }
-      const promise = inner(args).then((result) => {
-        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
-        else cache.delete(args.enrollmentId);
-        return result;
-      }).catch((err) => {
-        cache.delete(args.enrollmentId);
-        throw err;
-      });
-      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
-      return await promise;
-    }
-  };
-}
-function createCachedTargetClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? TARGET_CACHE_TTL_MS_DEFAULT;
-  const durableObjectTtlMs = options.durableObjectTtlMs ?? DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const key = `${args.workspaceId}\0${args.hostId}\0${args.routingId ?? ""}`;
-    const at = now();
-    const entry = cache.get(key);
-    if (entry && entry.expiresAt > at) {
-      if (entry.target) return entry.target;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((target) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      if (target) cache.set(key, { target, expiresAt: now() + (target.backing === "durable-object" ? durableObjectTtlMs : ttlMs) });
-      else cache.delete(key);
-      return target;
-    }).catch((err) => {
-      cache.delete(key);
-      throw err;
-    });
-    cache.set(key, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
-}
 export {
   DEFAULT_RELAY_APP_ORIGINS,
   DEFAULT_RELAY_LOCATION_HINT,
   RELAY_ALLOWED_REQUEST_HEADERS,
   RELAY_LOCATION_HINTS,
   RELAY_REGION_HEADER,
+  REVOCATION_RESOLVER_UNAVAILABLE,
   RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT,
   RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS,
   SESSION_HOST_LOCATION_HINT,
   WorkspaceRelayAuthError,
   authorizeWorkspaceRelayRequest,
-  bytesToBase64,
   checkHostTunnelGeneration,
   corsPreflight,
   createCachedHostGenerationClient,
@@ -3127,7 +3297,6 @@ export {
   parseRuntimeAccessTokenActiveResult,
   parseWorkspaceRelayTarget,
   pruneExpiringCache,
-  relayFrameDiagnostics,
   relayHostInputFromRuntimeClaims,
   relayHostTokenAudience,
   relayHostTokenIssuer,