@claxedo/workspace-relay 0.6.0 → 0.7.0

package/dist/index.mjs

@@ -237,8 +237,6 @@ import { exportJWK } from "jose";
 var DEFAULT_RELAY_APP_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
-  "https://opencode.ai",
-  "https://*.opencode.ai",
   "https://claxedo.com",
   "https://*.claxedo.com"
 ];
@@ -1080,7 +1078,22 @@ var TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT = 3e4;
 var DIRECT_HTTP_TIMEOUT_MS_DEFAULT = 3e4;
 var UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT = 1e4;
 var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
 var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
+var relayBufferedBytes = (socket) => {
+  const method = socket.getBufferedAmount;
+  if (typeof method === "function") {
+    const measured = method.call(socket);
+    if (typeof measured === "number" && Number.isFinite(measured)) return measured;
+    return void 0;
+  }
+  const property = socket.bufferedAmount;
+  return typeof property === "number" && Number.isFinite(property) ? property : void 0;
+};
+var relayOverBackpressureLimit = (socket, limitBytes) => {
+  const queued = relayBufferedBytes(socket);
+  return queued !== void 0 && queued > limitBytes;
+};
 var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
 var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
 var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
@@ -1157,6 +1170,9 @@ function corsJsonError(request, code, message, status) {
   headers2.set("content-type", "application/json");
   return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
 }
+function preOpenFrameBytes(message) {
+  return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
+}
 function safeCloseCode(input, fallback = 1011) {
   if (!Number.isInteger(input)) return fallback;
   const code = input;
@@ -1235,11 +1251,10 @@ function isEventStream(input) {
     ([key, value]) => key.toLowerCase() === "content-type" && value.toLowerCase().includes("text/event-stream")
   );
 }
+var defaultRelayOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
 function allowedCorsOrigin(origin) {
   if (!origin) return;
-  if (origin.startsWith("http://localhost:")) return origin;
-  if (origin.startsWith("http://127.0.0.1:")) return origin;
-  if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin)) return origin;
+  if (defaultRelayOriginMatcher(origin)) return origin;
 }
 function requireAllowedOrigin(request) {
   const origin = request.headers.get("origin");
@@ -2012,7 +2027,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
               ws.data.channels.delete(frame.channel_id);
               return;
             }
-            if (channel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
+            if (relayOverBackpressureLimit(channel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
               ws.data.channels.delete(frame.channel_id);
               closeWebSocket(channel, 1011, "Client WebSocket backpressure limit exceeded");
               return;
@@ -2035,7 +2050,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             ws.close(1011, "User-hosted tunnel disconnected");
             return;
           }
-          if (tunnel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
+          if (relayOverBackpressureLimit(tunnel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
             closeWebSocket(ws, 1011, "Host tunnel backpressure limit exceeded");
             return;
           }
@@ -2051,10 +2066,13 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           ws.data.upstream.send(message);
           return;
         }
-        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT)) {
+        const queuedBytes = ws.data.queuedBytes ?? 0;
+        const frameBytes = preOpenFrameBytes(message);
+        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) && queuedBytes + frameBytes > (bunOptions.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
           closeWebSocket(ws, 1011, "Upstream WebSocket queue limit exceeded");
           return;
         }
+        ws.data.queuedBytes = queuedBytes + frameBytes;
         ws.data.queue.push({ payload: message, queuedAt: performance.now() });
       },
       open(ws) {
@@ -2153,6 +2171,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             sendRelayWebSocketTrace(ws);
           }
           for (const item of data.queue.splice(0)) upstream.send(item.payload);
+          data.queuedBytes = 0;
         };
         upstream.onmessage = (event) => {
           const payload = relayWebSocketPayload(event.data);
@@ -2306,6 +2325,66 @@ function disposeWorkspaceRelayDirectory(directory) {
 
 // src/cloudflare.ts
 var DEFAULT_RELAY_LOCATION_HINT = "apac";
+var RELAY_LOCATION_HINTS = ["wnam", "enam", "sam", "weur", "eeur", "apac", "oc", "afr", "me"];
+var relayLocationHintSet = new Set(RELAY_LOCATION_HINTS);
+var RELAY_REGION_TO_LOCATION_HINT = {
+  // Canonical Claxedo regions.
+  "apac-south": "apac",
+  "apac-east": "apac",
+  "eu-west": "weur",
+  "us-east": "enam",
+  "us-west": "wnam",
+  // Provider spellings.
+  "us-central": "wnam",
+  "eu-central": "weur",
+  "eu-east": "eeur",
+  "ap-south": "apac",
+  "ap-southeast": "apac",
+  "ap-northeast": "apac",
+  "sa-east": "sam",
+  "af-south": "afr",
+  "me-central": "me",
+  "oceania": "oc",
+  "au-southeast": "oc"
+};
+function locationHintForCountry(country) {
+  const code = country.toUpperCase();
+  if (["US", "CA", "MX"].includes(code)) return code === "US" || code === "CA" ? "enam" : "wnam";
+  if (["BR", "AR", "CL", "CO", "PE", "UY", "PY", "BO", "EC", "VE"].includes(code)) return "sam";
+  if (["GB", "IE", "FR", "ES", "PT", "NL", "BE", "DE", "CH", "AT", "IT", "DK", "NO", "SE", "FI", "IS", "LU"].includes(code)) return "weur";
+  if (["PL", "CZ", "SK", "HU", "RO", "BG", "GR", "UA", "RS", "HR", "SI", "EE", "LV", "LT", "TR", "RU"].includes(code)) return "eeur";
+  if (["IN", "PK", "BD", "LK", "NP", "SG", "MY", "TH", "VN", "PH", "ID", "CN", "HK", "TW", "JP", "KR"].includes(code)) return "apac";
+  if (["AU", "NZ", "FJ", "PG"].includes(code)) return "oc";
+  if (["ZA", "NG", "KE", "GH", "ET", "TZ", "UG", "EG", "MA", "DZ", "TN"].includes(code)) {
+    return ["EG", "MA", "DZ", "TN"].includes(code) ? "me" : "afr";
+  }
+  if (["AE", "SA", "IL", "QA", "KW", "BH", "OM", "JO", "LB", "IQ", "IR"].includes(code)) return "me";
+  return void 0;
+}
+var RELAY_REGION_HEADER = "x-claxedo-workspace-region";
+function relayLocationHint(input) {
+  const configured = clean(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
+  const region = clean(input.region);
+  if (region) {
+    const direct = relayLocationHintSet.has(region.toLowerCase()) ? region.toLowerCase() : void 0;
+    const mapped = direct ?? RELAY_REGION_TO_LOCATION_HINT[region.toLowerCase()];
+    if (mapped) return mapped;
+  }
+  const country = clean(input.country);
+  if (country) {
+    const mapped = locationHintForCountry(country);
+    if (mapped) return mapped;
+  }
+  return configured;
+}
+function relayRequestRegion(request) {
+  const url = new URL(request.url);
+  return clean(request.headers.get(RELAY_REGION_HEADER)) ?? clean(url.searchParams.get("region")) ?? clean(url.searchParams.get("homeRegion"));
+}
+function relayRequestCountry(request) {
+  const cf = request.cf;
+  return typeof cf?.country === "string" ? cf.country : void 0;
+}
 var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
 var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
 var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
@@ -2314,8 +2393,11 @@ var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
 var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT2 = 8 * 1024 * 1024;
 var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT2 = 3e4;
 var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2 = 64;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT2 = 8 * 1024 * 1024;
 var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
+var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
 var TRACE_ID_HEADER = "x-claxedo-trace-id";
 var TRACE_FORCE_HEADER = "x-claxedo-relay-trace";
 function clean(input) {
@@ -2436,14 +2518,31 @@ function headersFromRecord(input) {
   for (const [key, value] of Object.entries(input)) headers2.set(key, value);
   return headers2;
 }
+var BASE64_CHUNK_BYTES = 32768;
 function bytesToBase64(bytes) {
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (let i = 0; i < bytes.length; i += BASE64_CHUNK_BYTES) {
+    binary += String.fromCharCode.apply(
+      null,
+      bytes.subarray(i, i + BASE64_CHUNK_BYTES)
+    );
+  }
   return btoa(binary);
 }
 function base64ToBytes(input) {
   return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
 }
+function preOpenFrameBytes2(input) {
+  if (typeof input === "string") return new TextEncoder().encode(input).byteLength;
+  return input.byteLength;
+}
+function blobLike(input) {
+  if (!input || typeof input !== "object") return void 0;
+  return typeof input.arrayBuffer === "function" ? input : void 0;
+}
+function viewBytes(input) {
+  return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+}
 function socketFrame(input) {
   if (typeof input === "string") {
     return {
@@ -2463,14 +2562,56 @@ function socketFrame(input) {
       data_base64: bytesToBase64(input)
     };
   }
+  if (ArrayBuffer.isView(input)) {
+    return {
+      binary: true,
+      data_base64: bytesToBase64(viewBytes(input))
+    };
+  }
+  const blob = blobLike(input);
+  if (!blob) return void 0;
+  return blob.arrayBuffer().then((buffer) => ({
+    binary: true,
+    data_base64: bytesToBase64(new Uint8Array(buffer))
+  }));
 }
 function socketPayload(input) {
   if (typeof input === "string") return input;
   if (input instanceof ArrayBuffer) return input;
   if (input instanceof Uint8Array) return input;
-  if (ArrayBuffer.isView(input)) {
-    return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
-  }
+  if (ArrayBuffer.isView(input)) return viewBytes(input);
+  const blob = blobLike(input);
+  if (!blob) return void 0;
+  return blob.arrayBuffer();
+}
+function orderedFrameDelivery(deliver) {
+  let tail;
+  return (data) => {
+    const payload = socketPayload(data);
+    if (payload === void 0) return;
+    if (tail === void 0 && !(payload instanceof Promise)) {
+      deliver(payload);
+      return;
+    }
+    const queued = (tail ?? Promise.resolve()).then(async () => deliver(await payload)).catch(() => {
+    });
+    tail = queued;
+    void queued.then(() => {
+      if (tail === queued) tail = void 0;
+    });
+  };
+}
+async function relayFrameDiagnostics(data) {
+  const frame = await socketFrame(data);
+  const payload = await socketPayload(data);
+  return {
+    // `undefined` here is exactly the silent drop: every caller treats it as
+    // "nothing to forward" and returns without a throw or a log.
+    frameDropped: frame === void 0,
+    payloadDropped: payload === void 0,
+    ...frame ? { binary: frame.binary, dataBase64: frame.data_base64 } : {},
+    payloadBase64: payload === void 0 ? void 0 : typeof payload === "string" ? bytesToBase64(new TextEncoder().encode(payload)) : bytesToBase64(payload instanceof ArrayBuffer ? new Uint8Array(payload) : payload)
+  };
 }
 function tunnelFrame(input) {
   const bytes = base64ToBytes(input.data_base64);
@@ -2616,7 +2757,13 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       if (url.pathname === "/health") {
         return Response.json({ ok: true, service: "workspace-relay", mode: "cloudflare-durable-object" });
       }
-      const relayLocationHint = typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" && env.CLAXEDO_RELAY_LOCATION_HINT ? env.CLAXEDO_RELAY_LOCATION_HINT : DEFAULT_RELAY_LOCATION_HINT;
+      const requestRegion = relayRequestRegion(request);
+      const requestCountry = relayRequestCountry(request);
+      const locationHint = relayLocationHint({
+        ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
+        ...requestRegion ? { region: requestRegion } : {},
+        ...requestCountry ? { country: requestCountry } : {}
+      });
       const namespace = namespaceFromEnv(env, options);
       if (!namespace) {
         return json(
@@ -2642,7 +2789,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       }
       const routeFinishedAt = performance.now();
       const response = await namespace.get(namespace.idFromName(workspaceRelayDurableObjectRoomName(workspaceId)), {
-        locationHint: relayLocationHint
+        locationHint
       }).fetch(tracedRequest(request, {
         id: gatewayTraceId,
         sampled: request.headers.get("x-claxedo-trace-sampled") === "1",
@@ -2656,7 +2803,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       }
       const headers2 = new Headers(response.headers);
       headers2.set(TRACE_ID_HEADER, headers2.get(TRACE_ID_HEADER) ?? gatewayTraceId);
-      headers2.set("x-claxedo-relay-location-hint", relayLocationHint);
+      headers2.set("x-claxedo-relay-location-hint", locationHint);
       const gatewayResponseStartedAt = performance.now();
       const tracedResponse = new Response(response.body, {
         status: response.status,
@@ -2741,6 +2888,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   const rebuildHibernatedSockets = () => {
     if (!hibernation) return;
     hibernatedSocketsRebuilt = true;
+    for (const tunnel of hostTunnels.values()) {
+      if (tunnel.pending.size === 0) continue;
+      cleanupTunnelResources(tunnel, "Workspace relay restarted while the request was in flight");
+    }
     hostTunnels.clear();
     clients.clear();
     const clientRows = [];
@@ -2798,10 +2949,13 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       }
     }
   };
+  const resolverGraceAttempts = options.resolverOutageGraceAttempts ?? RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT;
+  const resolverUnreachable = (code) => code === "relay_revocation_resolver_unavailable";
   const watchRuntimeAccessToken = (client, onInactive) => {
     const intervalMs = options.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
     if (intervalMs <= 0) return;
     const now = options.now ?? Date.now;
+    let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       if (client.request.claims.exp * 1e3 <= now()) {
         clearInterval(timer);
@@ -2809,14 +2963,25 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         return;
       }
       if (!options.isRuntimeAccessTokenActive) return;
+      const tolerate = (reason) => {
+        consecutiveUnreachable += 1;
+        if (consecutiveUnreachable < resolverGraceAttempts) return;
+        clearInterval(timer);
+        onInactive(reason);
+      };
       void Promise.resolve(options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
-        if (active.active) return;
+        if (active.active) {
+          consecutiveUnreachable = 0;
+          return;
+        }
+        if (resolverUnreachable(active.code)) {
+          tolerate(`Runtime Access Token active check unavailable: ${active.reason}`);
+          return;
+        }
+        consecutiveUnreachable = 0;
         clearInterval(timer);
         onInactive(active.reason);
-      }).catch(() => {
-        clearInterval(timer);
-        onInactive("Runtime Access Token active check failed");
-      });
+      }).catch(() => tolerate("Runtime Access Token active check failed"));
     }, intervalMs);
     if (typeof timer.unref === "function") {
       timer.unref();
@@ -2827,14 +2992,19 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const intervalMs = options.workspaceTargetActiveCheckIntervalMs ?? WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
     if (intervalMs <= 0) return;
     const target = client.request.target;
+    let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       void Promise.resolve(options.resolveTarget(client.request.claims)).then((activeTarget) => {
         if (activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+          consecutiveUnreachable = 0;
           return;
         }
+        consecutiveUnreachable = 0;
         clearInterval(timer);
         onInactive("User-hosted workspace is offline");
       }).catch(() => {
+        consecutiveUnreachable += 1;
+        if (consecutiveUnreachable < resolverGraceAttempts) return;
         clearInterval(timer);
         onInactive("Workspace relay target active check failed");
       });
@@ -3019,6 +3189,67 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTarget = await options.resolveTarget(client.request.claims);
     return !!(activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
   };
+  const dropUserHostedChannel = (tunnel, channelId, client, code, reason) => {
+    tunnel.channels.delete(channelId);
+    clients.delete(client);
+    closeSocket(client.socket, code, reason);
+    sendSocket(tunnel.socket, JSON.stringify({
+      type: "ws.close",
+      protocol: TUNNEL_PROTOCOL_VERSION2,
+      channel_id: channelId,
+      code,
+      reason
+    }));
+  };
+  const reportFrameHandlerFailure = (socket, err) => {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[workspace-relay] frame handler failed: ${reason}`);
+    closeSocket(socket, 1011, "Workspace relay failed to process a frame");
+  };
+  const hibernatedRevocationIntervalMs = () => options.hibernatedRevocationCheckIntervalMs ?? HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT;
+  const scheduleHibernatedRevocationCheck = async () => {
+    const intervalMs = hibernatedRevocationIntervalMs();
+    if (!hibernation || !options.alarms || intervalMs <= 0) return;
+    if (clients.size === 0) return;
+    const now = options.now ?? Date.now;
+    const at = now() + intervalMs;
+    try {
+      const existing = await options.alarms.getAlarm();
+      if (typeof existing === "number" && existing > 0 && existing <= at) return;
+      await options.alarms.setAlarm(at);
+    } catch {
+    }
+  };
+  const runHibernatedRevocationCheck = async () => {
+    ensureHibernatedSocketsRebuilt();
+    const now = options.now ?? Date.now;
+    const revoke = (client, reason) => {
+      const channelId = client.channelId;
+      for (const tunnel of hostTunnels.values()) {
+        if (!channelId || tunnel.channels.get(channelId) !== client) continue;
+        dropUserHostedChannel(tunnel, channelId, client, 1008, reason);
+        return;
+      }
+      closeSocket(client.socket, 1008, reason);
+      clients.delete(client);
+    };
+    for (const client of [...clients]) {
+      if (client.request.claims.exp * 1e3 <= now()) {
+        revoke(client, "Runtime Access Token expired");
+        continue;
+      }
+      if (!options.isRuntimeAccessTokenActive) continue;
+      let active;
+      try {
+        active = await options.isRuntimeAccessTokenActive(client.request.claims);
+      } catch {
+        continue;
+      }
+      if (active.active || resolverUnreachable(active.code)) continue;
+      revoke(client, active.reason);
+    }
+    await scheduleHibernatedRevocationCheck();
+  };
   const activeUserHostedClient = (channelId, socket) => {
     for (const tunnel of hostTunnels.values()) {
       const client = tunnel.channels.get(channelId);
@@ -3037,7 +3268,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       closeSocket(socket, 1011, "User-hosted workspace is offline");
       return;
     }
-    const frame = socketFrame(data);
+    const frame = await socketFrame(data);
     if (!frame) return;
     const sent = sendSocket(active.tunnel.socket, JSON.stringify({
       type: "ws.frame",
@@ -3145,7 +3376,9 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         closeSocket(channel.socket, 1008, token.reason);
         return;
       }
-      sendSocket(channel.socket, tunnelFrame(message));
+      if (!sendSocket(channel.socket, tunnelFrame(message))) {
+        dropUserHostedChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
+      }
       return;
     }
     if (parsed.message.type === "ws.close") {
@@ -3239,7 +3472,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     directory.registerHostTunnel({ hostId, workspaceIds });
     if (!hibernation) {
       pair.server.addEventListener?.("message", (event) => {
-        if (event && event.data !== void 0) void handleTunnelMessage(hostId, { data: event.data });
+        if (!event || event.data === void 0) return;
+        void handleTunnelMessage(hostId, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
       pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
@@ -3282,6 +3516,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     let closed = false;
     let upstreamOpen = upstream.readyState === void 0 || upstream.readyState === 1;
     const queue = [];
+    let queuedBytes = 0;
     const emitTrace = (openedAt) => {
       if (!trace || trace.emitted) return;
       trace.emitted = true;
@@ -3312,6 +3547,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const flushQueue = () => {
       upstreamOpen = true;
       if (trace) emitTrace(performance.now());
+      queuedBytes = 0;
       for (const item of queue.splice(0)) {
         if (!sendSocket(upstream, item)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket connection failed");
@@ -3319,28 +3555,31 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         }
       }
     };
-    pair.server.addEventListener?.("message", (event) => {
-      const payload = socketPayload(event?.data);
-      if (payload === void 0) return;
+    const deliverClientFrame = orderedFrameDelivery((payload) => {
       if (!upstreamOpen) {
-        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2)) {
+        const frameBytes = preOpenFrameBytes2(payload);
+        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2) && queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT2)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket queue limit exceeded");
           cleanupClient({ code: 1011, reason: "Upstream WebSocket queue limit exceeded" });
           return;
         }
+        queuedBytes += frameBytes;
         if (trace) trace.queueTimes.push(performance.now());
         queue.push(payload);
         return;
       }
       if (!sendSocket(upstream, payload)) closeSocket(pair.server, 1011, "Upstream WebSocket connection failed");
     });
+    pair.server.addEventListener?.("message", (event) => deliverClientFrame(event?.data));
     pair.server.addEventListener?.("close", cleanupClient);
     pair.server.addEventListener?.("error", cleanupClient);
     upstream.addEventListener?.("open", flushQueue);
-    upstream.addEventListener?.("message", (event) => {
-      const payload = socketPayload(event?.data);
-      if (payload !== void 0) sendSocket(pair.server, payload);
+    const deliverUpstreamFrame = orderedFrameDelivery((payload) => {
+      if (!sendSocket(pair.server, payload)) {
+        closeSocket(pair.server, 1011, "Client WebSocket send failed");
+      }
     });
+    upstream.addEventListener?.("message", (event) => deliverUpstreamFrame(event?.data));
     upstream.addEventListener?.("close", cleanupUpstream);
     upstream.addEventListener?.("error", () => cleanupUpstream({ code: 1011, reason: "Upstream WebSocket connection failed" }));
     if (trace && upstreamOpen) emitTrace(upstreamConnectedAt);
@@ -3376,6 +3615,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTargetTimer = hibernation ? void 0 : watchUserHostedTarget(client, (reason) => {
       closeSocket(pair.server, 1011, reason);
     });
+    if (hibernation) void scheduleHibernatedRevocationCheck();
     if (!hibernation) {
       const cleanup = (event) => {
         if (activeTokenTimer) clearInterval(activeTokenTimer);
@@ -3384,12 +3624,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       };
       pair.server.addEventListener?.("message", (event) => {
         if (!event) return;
-        void handleUserHostedClientMessage(channelId, pair.server, event.data);
+        void handleUserHostedClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", cleanup);
       pair.server.addEventListener?.("error", cleanup);
     }
-    sendSocket(tunnel.socket, JSON.stringify({
+    const opened = sendSocket(tunnel.socket, JSON.stringify({
       type: "ws.open",
       protocol: TUNNEL_PROTOCOL_VERSION2,
       channel_id: channelId,
@@ -3402,6 +3642,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         { userHosted: true }
       ))
     }));
+    if (!opened) {
+      tunnel.channels.delete(channelId);
+      clients.delete(client);
+      closeSocket(pair.server, 1011, "User-hosted tunnel unavailable");
+      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+    }
     return upgradeResponse(pair.client, request);
   };
   const forwardCloudHttp = async (request, workspaceId, trace) => {
@@ -3555,14 +3801,29 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       return json("relay_route_not_found", "Workspace Relay route not found", 404);
     },
     async webSocketMessage(socket, message) {
-      ensureHibernatedSocketsRebuilt();
-      const attachment = socketAttachment(socket);
-      if (!attachment) return;
-      if (attachment.kind === "host-tunnel") {
-        await handleTunnelMessage(attachment.hostId, { data: message });
-        return;
+      try {
+        ensureHibernatedSocketsRebuilt();
+        const attachment = socketAttachment(socket);
+        if (!attachment) return;
+        if (attachment.kind === "host-tunnel") {
+          await handleTunnelMessage(attachment.hostId, { data: message });
+          return;
+        }
+        await handleUserHostedClientMessage(attachment.channelId, socket, message);
+      } catch (err) {
+        reportFrameHandlerFailure(socket, err);
+      }
+    },
+    /**
+     * Durable Object alarm entry point. Runs the hibernation-safe revocation
+     * sweep (W6b.2). The Worker must forward `alarm()` here.
+     */
+    async alarm() {
+      try {
+        await runHibernatedRevocationCheck();
+      } catch (err) {
+        console.error(`[workspace-relay] revocation alarm failed: ${err instanceof Error ? err.message : String(err)}`);
       }
-      await handleUserHostedClientMessage(attachment.channelId, socket, message);
     },
     webSocketClose(socket, code, reason) {
       ensureHibernatedSocketsRebuilt();
@@ -3599,9 +3860,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
 export {
   DEFAULT_RELAY_APP_ORIGINS,
   DEFAULT_RELAY_LOCATION_HINT,
+  RELAY_LOCATION_HINTS,
+  RELAY_REGION_HEADER,
   WorkspaceRelayAuthError,
   __slowConsumerInternalsForTest,
   authorizeWorkspaceRelayRequest,
+  bytesToBase64,
   createCachedRevocationClient,
   createCachedTargetClient,
   createOriginMatcher,
@@ -3621,8 +3885,14 @@ export {
   mintRelayHostToken,
   mintRuntimeAccessToken,
   parseAllowedOrigins,
+  relayBufferedBytes,
+  relayFrameDiagnostics,
   relayHostTokenAudience,
   relayHostTokenIssuer,
+  relayLocationHint,
+  relayOverBackpressureLimit,
+  relayRequestCountry,
+  relayRequestRegion,
   runtimeAccessTokenAudience,
   runtimeAccessTokenIssuer,
   setWorkspaceRelayAllowedOrigins,