@claxedo/workspace-relay 0.6.0 → 0.8.0

package/dist/index.mjs

@@ -1,5 +1,21 @@
 // src/auth.ts
-import { SignJWT, errors, jwtVerify } from "jose";
+import { SignJWT, errors, exportJWK, importJWK, jwtVerify } from "jose";
+
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function asFiniteNumber(value) {
+  return isFiniteNumber(value) ? value : void 0;
+}
+function numberClaim(payload, key) {
+  return asFiniteNumber(payload[key]);
+}
+
+// src/auth.ts
 var algorithms = ["EdDSA", "ES256", "RS256"];
 var runtimeAccessTokenIssuer = "claxedo-control-plane";
 var runtimeAccessTokenAudience = "workspace-relay";
@@ -19,25 +35,51 @@ function seconds(input = Date.now()) {
   return Math.floor(input / 1e3);
 }
 function requireAlgorithm(input) {
-  if (algorithms.includes(input)) return input;
+  const algorithm = algorithms.find((candidate) => candidate === input);
+  if (algorithm) return algorithm;
   throw new WorkspaceRelayAuthError("invalid_relay_token", "Unsupported relay token algorithm");
 }
 function stringClaim(payload, key) {
   const value = payload[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function numberClaim(payload, key) {
-  const value = payload[key];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function stringArrayClaim(payload, key) {
   const value = payload[key];
   return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value : void 0;
 }
+function isHostGeneration(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function hostGenerationClaims(payload) {
+  const enrollment_id = stringClaim(payload, "enrollment_id");
+  const generation = payload.generation;
+  if (generation === void 0) return enrollment_id ? { enrollment_id } : {};
+  if (!isHostGeneration(generation) || !enrollment_id) return null;
+  return { enrollment_id, generation };
+}
 function roleClaim(payload) {
   const value = stringClaim(payload, "role");
   return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
 }
+function actorProfileClaims(payload) {
+  const actor_public_id = stringClaim(payload, "actor_public_id");
+  const actor_name = stringClaim(payload, "actor_name");
+  const actor_avatar_url = stringClaim(payload, "actor_avatar_url");
+  if (!actor_public_id && !actor_name && !actor_avatar_url) return {};
+  if (!actor_public_id || !actor_name) return void 0;
+  return { actor_public_id, actor_name, ...actor_avatar_url ? { actor_avatar_url } : {} };
+}
+function actorProfilePayload(input) {
+  if (!input.actorPublicId && !input.actorName && !input.actorAvatarUrl) return {};
+  if (!input.actorPublicId || !input.actorName) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Actor display profile claims are incomplete");
+  }
+  return {
+    actor_public_id: input.actorPublicId,
+    actor_name: input.actorName,
+    ...input.actorAvatarUrl ? { actor_avatar_url: input.actorAvatarUrl } : {}
+  };
+}
 function isRelayClaimPair(input) {
   return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
 }
@@ -58,6 +100,21 @@ function checkTarget(payload, expected) {
     throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
   }
 }
+async function deriveRelayHostPublicKey(privateKey) {
+  const jwk = await exportJWK(privateKey);
+  const imported = await importJWK({ kty: jwk.kty, crv: jwk.crv, x: jwk.x }, "EdDSA", { extractable: true });
+  if (imported instanceof Uint8Array) {
+    throw new Error("Relay host public key imported as raw bytes; expected an EdDSA public key");
+  }
+  return imported;
+}
+async function deriveRelayHostKid(publicKey) {
+  const jwk = await exportJWK(publicKey);
+  const material = jwk.x ?? jwk.n ?? "";
+  if (!material) throw new Error("Cannot derive kid: public key has no public component");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(material));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
 async function verifyJwt(token, key, input) {
   try {
     if (typeof key === "function") {
@@ -83,11 +140,15 @@ async function verifyJwt(token, key, input) {
 async function mintRuntimeAccessToken(input, key, alg) {
   const now = seconds(input.now);
   return await new SignJWT({
+    principal_kind: input.principalKind,
+    actor_id: input.actorId,
+    actor_kind: input.actorKind,
+    ...actorProfilePayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
     role: input.role
-  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
+  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyRuntimeAccessToken(token, key, expected) {
   const result = await verifyJwt(token, key, {
@@ -115,9 +176,14 @@ function validateRuntimeAccessTokenClaims(input, expected) {
 }
 async function mintHostTunnelToken(input, key, alg) {
   const now = seconds(input.now);
+  if (input.generation !== void 0 && (!isHostGeneration(input.generation) || !input.enrollmentId)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Host Tunnel Token generation requires a non-negative integer and an enrollment id");
+  }
   return await new SignJWT({
     host_id: input.hostId,
-    workspace_ids: input.workspaceIds
+    workspace_ids: input.workspaceIds,
+    ...input.enrollmentId ? { enrollment_id: input.enrollmentId } : {},
+    ...input.generation !== void 0 ? { generation: input.generation } : {}
   }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(hostTunnelTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 5 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyHostTunnelToken(token, key, expected) {
@@ -140,13 +206,18 @@ async function mintRelayHostToken(input, key, alg) {
   const protectedHeader = { alg: requireAlgorithm(alg) };
   if (input.kid) protectedHeader.kid = input.kid;
   return await new SignJWT({
+    principal_kind: input.principalKind,
+    actor_id: input.actorId,
+    actor_kind: input.actorKind,
+    ...actorProfilePayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
     role: input.role,
     access: input.access,
-    backing: input.backing
-  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
+    backing: input.backing,
+    parent_jti: input.parentJti
+  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyRelayHostToken(token, key, expected) {
   const result = await verifyJwt(token, key, {
@@ -163,17 +234,24 @@ async function verifyRelayHostToken(token, key, expected) {
 function runtimeClaims(payload) {
   const exp = numberClaim(payload, "exp");
   const iat = numberClaim(payload, "iat");
-  const sub = stringClaim(payload, "sub");
+  const principal_kind = stringClaim(payload, "principal_kind");
+  const actor_id = stringClaim(payload, "actor_id");
+  const actor_kind = stringClaim(payload, "actor_kind");
   const jti2 = stringClaim(payload, "jti");
   const org_id = stringClaim(payload, "org_id");
   const workspace_id = stringClaim(payload, "workspace_id");
   const host_id = stringClaim(payload, "host_id");
   const role = roleClaim(payload);
-  if (!exp || !iat || !sub || !jti2 || !org_id || !workspace_id || !host_id || !role) return;
+  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
+  const actorProfile = actorProfileClaims(payload);
+  if (!actorProfile) return void 0;
   return {
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience,
-    sub,
+    principal_kind,
+    actor_id,
+    actor_kind,
+    ...actorProfile,
     org_id,
     workspace_id,
     host_id,
@@ -191,12 +269,14 @@ function relayHostClaims(payload) {
   });
   const access = stringClaim(payload, "access");
   const backing = stringClaim(payload, "backing");
+  const parent_jti = stringClaim(payload, "parent_jti");
   const pair = { access, backing };
-  if (!base || !isRelayClaimPair(pair)) return;
+  if (!base || !parent_jti || !isRelayClaimPair(pair)) return void 0;
   return {
     ...base,
     iss: relayHostTokenIssuer,
     aud: relayHostTokenAudience,
+    parent_jti,
     ...pair
   };
 }
@@ -207,22 +287,37 @@ function hostTunnelClaims(payload) {
   const jti2 = stringClaim(payload, "jti");
   const host_id = stringClaim(payload, "host_id");
   const workspace_ids = stringArrayClaim(payload, "workspace_ids");
-  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length) return;
+  const fence = hostGenerationClaims(payload);
+  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length || fence === null) return void 0;
   return {
     iss: runtimeAccessTokenIssuer,
     aud: hostTunnelTokenAudience,
     sub,
     host_id,
     workspace_ids,
+    ...fence,
     exp,
     iat,
     jti: jti2
   };
 }
 
-// src/bun.ts
+// src/cloudflare.ts
+import { trimToUndefined } from "@claxedo/helpers/string";
+
+// src/http.ts
+import { bearerToken } from "@claxedo/helpers/string";
+function errorBody(code, message) {
+  return {
+    error: {
+      code,
+      message
+    }
+  };
+}
+
+// src/cloudflare.ts
 import {
-  makeTunnelPing,
   makeTunnelPong,
   TUNNEL_PROTOCOL_VERSION,
   validateTunnelMessage
@@ -231,14 +326,12 @@ import {
 // src/server.ts
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { exportJWK } from "jose";
+import { exportJWK as exportJWK2 } from "jose";
 
 // src/cors-origins.ts
 var DEFAULT_RELAY_APP_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
-  "https://opencode.ai",
-  "https://*.opencode.ai",
   "https://claxedo.com",
   "https://*.claxedo.com"
 ];
@@ -275,22 +368,76 @@ function createOriginMatcher(patterns) {
   };
 }
 
-// src/http.ts
-function bearerToken(header) {
-  if (!header) return;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  return match?.[1]?.trim() || void 0;
+// src/user-hosted-forwarding.ts
+function isUserHostedTarget(target) {
+  return target.access === "user-hosted";
 }
-function errorBody(code, message) {
+
+// src/server.ts
+function parseWorkspaceRelayTarget(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  const { workspaceId, hostId, baseUrl, upstreamHeaders } = row;
+  if (typeof workspaceId !== "string" || typeof hostId !== "string" || typeof baseUrl !== "string") return void 0;
+  if (upstreamHeaders !== void 0 && !isStringRecord(upstreamHeaders)) return void 0;
+  const pair = relayClaimPair(row.access, row.backing);
+  if (!pair) return void 0;
   return {
-    error: {
-      code,
-      message
-    }
+    workspaceId,
+    hostId,
+    baseUrl,
+    ...upstreamHeaders ? { upstreamHeaders } : {},
+    ...pair
   };
 }
-
-// src/server.ts
+function parseRuntimeAccessTokenActiveResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (row.active === true) return { active: true };
+  if (row.active !== false) return void 0;
+  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
+  return { active: false, code: row.code, reason: row.reason };
+}
+function parseHostGenerationResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
+  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
+  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+}
+var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
+var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
+function createHostGenerationResolverLookup(url, options) {
+  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
+  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
+  return async ({ enrollmentId }) => {
+    const target = new URL(url);
+    target.searchParams.set("enrollmentId", enrollmentId);
+    const res = await fetcher(target, { headers: options.headers, signal: AbortSignal.timeout(timeoutMs) });
+    if (res.status === 404) {
+      const body = await res.json().catch(() => void 0);
+      const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+      if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
+      throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
+    }
+    if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
+    const result = parseHostGenerationResult(await res.json());
+    if (!result) throw new Error("relay host-generation resolver returned a malformed result");
+    return result;
+  };
+}
+function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
+  if (incumbentGeneration === void 0) return false;
+  return candidateGeneration === void 0 || incumbentGeneration > candidateGeneration;
+}
+function relayClaimPair(access, backing) {
+  if (access === "cloud" && backing === "cloud-vm") return { access, backing };
+  if (access === "user-hosted" && backing === "local-worktree") return { access, backing };
+  return void 0;
+}
+function isStringRecord(input) {
+  return isRecord(input) && Object.values(input).every((value) => typeof value === "string");
+}
 var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
 var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
 var RESOLVER_CACHE_MAX_ENTRIES = 8192;
@@ -330,6 +477,71 @@ function createCachedRevocationClient(inner, options = {}) {
     return await promise;
   };
 }
+function createCachedHostGenerationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    for (; ; ) {
+      const at = now();
+      const entry = cache.get(args.enrollmentId);
+      if (entry && entry.expiresAt > at) {
+        if (entry.result && entry.result.generation >= args.generation) return entry.result;
+        if (!entry.result && entry.promise) {
+          const shared = await entry.promise;
+          if (!shared || shared.generation >= args.generation) return shared;
+          continue;
+        }
+      }
+      const promise = inner(args).then((result) => {
+        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
+        else cache.delete(args.enrollmentId);
+        return result;
+      }).catch((err) => {
+        cache.delete(args.enrollmentId);
+        throw err;
+      });
+      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
+      return await promise;
+    }
+  };
+}
+async function checkHostTunnelGeneration(lookup, claims) {
+  if (claims.generation === void 0 || !claims.enrollment_id) return { ok: true };
+  if (!lookup) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "host_generation_unverifiable",
+      reason: "Host tunnel generation cannot be verified by a relay without a host-generation resolver"
+    };
+  }
+  let result;
+  try {
+    result = await lookup({ enrollmentId: claims.enrollment_id, generation: claims.generation });
+  } catch (err) {
+    return {
+      ok: false,
+      retryable: true,
+      code: "host_generation_lookup_unavailable",
+      reason: `Host generation lookup is unavailable: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!result) {
+    return { ok: false, retryable: false, code: "host_enrollment_unknown", reason: "Host enrollment is unknown" };
+  }
+  if (result.revoked) {
+    return { ok: false, retryable: false, code: "host_enrollment_revoked", reason: "Host enrollment was revoked" };
+  }
+  if (result.generation > claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_superseded", reason: "Host tunnel generation was superseded" };
+  }
+  if (result.generation < claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_unknown", reason: "Host tunnel generation is ahead of the control plane" };
+  }
+  return { ok: true };
+}
 function createCachedTargetClient(inner, options = {}) {
   const ttlMs = options.ttlMs ?? 5e3;
   const now = options.now ?? Date.now;
@@ -391,27 +603,27 @@ function isDangerousInboundHeader(name) {
   return false;
 }
 function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
-  const headers2 = new Headers(input);
-  headers2.delete("host");
+  const headers = new Headers(input);
+  headers.delete("host");
   const inboundNames = /* @__PURE__ */ new Set();
-  headers2.forEach((_value, name) => inboundNames.add(name));
+  headers.forEach((_value, name) => inboundNames.add(name));
   for (const name of inboundNames) {
-    if (isDangerousInboundHeader(name)) headers2.delete(name);
-  }
-  if (options.userHosted) headers2.delete("cookie");
-  headers2.set("accept-encoding", "identity");
-  headers2.delete("authorization");
-  headers2.delete("Authorization");
-  headers2.set("Authorization", `Bearer ${relayHostToken}`);
-  headers2.set("x-workspace-id", workspaceId);
-  headers2.set("X-Daytona-Skip-Preview-Warning", "true");
-  headers2.set("X-Daytona-Skip-Last-Activity-Update", "true");
+    if (isDangerousInboundHeader(name)) headers.delete(name);
+  }
+  if (options.userHosted) headers.delete("cookie");
+  headers.set("accept-encoding", "identity");
+  headers.delete("authorization");
+  headers.delete("Authorization");
+  headers.set("Authorization", `Bearer ${relayHostToken}`);
+  headers.set("x-workspace-id", workspaceId);
+  headers.set("X-Daytona-Skip-Preview-Warning", "true");
+  headers.set("X-Daytona-Skip-Last-Activity-Update", "true");
   for (const [name, value] of Object.entries(options.upstreamHeaders ?? {})) {
     const trimmed = value.trim();
-    if (trimmed) headers2.set(name, trimmed);
+    if (trimmed) headers.set(name, trimmed);
   }
-  headers2.set("x-forwarded-by", "workspace-relay");
-  return headers2;
+  headers.set("x-forwarded-by", "workspace-relay");
+  return headers;
 }
 function targetUrl(target, path, search) {
   const url = new URL(path.replace(/^\/+/, ""), target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
@@ -420,11 +632,9 @@ function targetUrl(target, path, search) {
 }
 var RELAY_VIEWER_DENIED_PATH = /^\/api\/wr\/pty(?:\/|$)/;
 function relayRuntimePath(request) {
-  return new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/");
-}
-function relayAuthorizationPath(path) {
   try {
-    return decodeURIComponent(path);
+    const decoded = decodeURIComponent(new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")).replace(/^\/+/, "/");
+    return new URL(decoded.replace(/^\/+/, ""), "http://relay.invalid/").pathname;
   } catch {
     return void 0;
   }
@@ -432,8 +642,7 @@ function relayAuthorizationPath(path) {
 function roleAllowsRelayRequest(role, method, path) {
   if (role === "owner" || role === "admin" || role === "editor") return true;
   if (role === "viewer") {
-    const authorizationPath = relayAuthorizationPath(path);
-    if (!authorizationPath || RELAY_VIEWER_DENIED_PATH.test(authorizationPath)) return false;
+    if (RELAY_VIEWER_DENIED_PATH.test(path)) return false;
     return method === "GET" || method === "HEAD" || method === "OPTIONS";
   }
   return false;
@@ -447,7 +656,9 @@ function relayHostTokenCacheTtlMs(options, claims) {
 function relayHostTokenCacheKey(options, claims, target) {
   return [
     claims.jti,
-    claims.sub,
+    claims.principal_kind,
+    claims.actor_id,
+    claims.actor_kind,
     claims.org_id,
     claims.role,
     claims.workspace_id,
@@ -552,7 +763,15 @@ async function relayHostTokenFor(options, claims, target, trace) {
   try {
     const token = await trace.span("rht-mint", async () => {
       promise = mintRelayHostToken({
-        subject: claims.sub,
+        principalKind: claims.principal_kind,
+        actorId: claims.actor_id,
+        actorKind: claims.actor_kind,
+        parentJti: claims.jti,
+        ...claims.actor_public_id && claims.actor_name ? {
+          actorPublicId: claims.actor_public_id,
+          actorName: claims.actor_name,
+          ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+        } : {},
         orgId: claims.org_id,
         role: claims.role,
         ...target,
@@ -576,7 +795,15 @@ async function uncachedRelayHostTokenFor(options, claims, target, trace) {
   return await trace.span(
     "rht-mint",
     async () => await mintRelayHostToken({
-      subject: claims.sub,
+      principalKind: claims.principal_kind,
+      actorId: claims.actor_id,
+      actorKind: claims.actor_kind,
+      parentJti: claims.jti,
+      ...claims.actor_public_id && claims.actor_name ? {
+        actorPublicId: claims.actor_public_id,
+        actorName: claims.actor_name,
+        ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+      } : {},
       orgId: claims.org_id,
       role: claims.role,
       ...target,
@@ -682,13 +909,13 @@ function workspaceRelayServerTiming(trace) {
 function workspaceRelayTimingResponse(response, trace) {
   const value = workspaceRelayServerTiming(trace);
   if (!value) return response;
-  const headers2 = new Headers(response.headers);
-  const prev = headers2.get("server-timing");
-  headers2.set("server-timing", prev ? `${prev}, ${value}` : value);
+  const headers = new Headers(response.headers);
+  const prev = headers.get("server-timing");
+  headers.set("server-timing", prev ? `${prev}, ${value}` : value);
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
-    headers: headers2
+    headers
   });
 }
 async function audit(options, event) {
@@ -715,13 +942,30 @@ function originMatcherFor(options) {
   }
   return matcher;
 }
+var RELAY_ALLOWED_REQUEST_HEADER_LIST = [
+  "Accept",
+  "Authorization",
+  "Content-Type",
+  "Last-Event-ID",
+  "Traceparent",
+  "Tracestate",
+  "X-Fetch-Bypass-Throttle",
+  "X-Daytona-Skip-Preview-Warning",
+  "X-Workspace-Id",
+  "X-OpenCode-Directory",
+  "X-Claxedo-Runner",
+  "X-Claxedo-Model",
+  "X-Claxedo-Draft-Id",
+  "X-Claxedo-Binary"
+];
+var RELAY_ALLOWED_REQUEST_HEADERS = RELAY_ALLOWED_REQUEST_HEADER_LIST.join(", ");
 function denyCorsHeaders(request, originAllowed = defaultOriginMatcher) {
   const origin = request.headers.get("origin");
   if (!origin) return void 0;
   if (!originAllowed(origin)) return void 0;
   return {
     "access-control-allow-origin": origin,
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
+    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
     "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
   };
 }
@@ -731,7 +975,9 @@ async function deny(options, input) {
     action: "relay.request.denied",
     result: "deny",
     reason: input.code,
-    subject: input.claims?.sub,
+    actorId: input.claims?.actor_id,
+    actorKind: input.claims?.actor_kind,
+    principalKind: input.claims?.principal_kind,
     ...input.claims ? { role: input.claims.role } : {},
     workspaceId: input.claims?.workspace_id,
     hostId: input.claims?.host_id,
@@ -780,7 +1026,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       };
     }
     const path = relayRuntimePath(request);
-    if (!roleAllowsRelayRequest(claims.role, request.method, path)) {
+    if (!path || !roleAllowsRelayRequest(claims.role, request.method, path)) {
       return {
         ok: false,
         code: "relay_role_denied",
@@ -807,7 +1053,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
         })
       };
     }
-    if (target.access === "user-hosted" && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+    if (isUserHostedTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
       return {
         ok: false,
         code: "user_hosted_app_offline",
@@ -823,7 +1069,9 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
     await span("audit", async () => await audit(options, {
       action: "relay.request.accepted",
       result: "allow",
-      subject: claims.sub,
+      actorId: claims.actor_id,
+      actorKind: claims.actor_kind,
+      principalKind: claims.principal_kind,
       role: claims.role,
       workspaceId: claims.workspace_id,
       hostId: claims.host_id,
@@ -866,20 +1114,20 @@ async function forwardWorkspaceRelayRequest(request, target, relayHostToken, pat
         upstreamHeaders: target.upstreamHeaders
       })
     ));
-    const headers2 = new Headers(upstream.headers);
-    headers2.delete("access-control-allow-origin");
-    headers2.delete("access-control-allow-credentials");
-    headers2.delete("access-control-allow-headers");
-    headers2.delete("access-control-allow-methods");
-    headers2.delete("access-control-expose-headers");
-    headers2.delete("access-control-max-age");
+    const headers = new Headers(upstream.headers);
+    headers.delete("access-control-allow-origin");
+    headers.delete("access-control-allow-credentials");
+    headers.delete("access-control-allow-headers");
+    headers.delete("access-control-allow-methods");
+    headers.delete("access-control-expose-headers");
+    headers.delete("access-control-max-age");
     for (const [key, value] of Object.entries(denyCorsHeaders(request, originAllowed) ?? {})) {
-      headers2.set(key, value);
+      headers.set(key, value);
     }
     return new Response(upstream.body, {
       status: upstream.status,
       statusText: upstream.statusText,
-      headers: headers2
+      headers
     });
   } catch (err) {
     const aborted = err instanceof Error && err.name === "AbortError";
@@ -906,7 +1154,7 @@ function isLoopbackAddress(address) {
   if (!address) return false;
   const trimmed = address.trim();
   if (LOOPBACK_REMOTES.has(trimmed)) return true;
-  if (/^127\./.test(trimmed)) return true;
+  if (trimmed.startsWith("127.")) return true;
   if (/^::ffff:127\./i.test(trimmed)) return true;
   return false;
 }
@@ -962,1295 +1210,140 @@ function buildMetricsBody(options) {
   return body;
 }
 function createWorkspaceRelay(options) {
-  const app = new Hono();
-  const originAllowed = originMatcherFor(options);
-  app.use("*", cors({
-    origin: (origin) => {
-      if (!origin) return void 0;
-      return originAllowed(origin) ? origin : void 0;
-    },
-    allowHeaders: [
-      "Accept",
-      "Authorization",
-      "Content-Type",
-      "X-Daytona-Skip-Preview-Warning",
-      "X-Workspace-Id",
-      "X-OpenCode-Directory",
-      "X-Claxedo-Runner",
-      "X-Claxedo-Model",
-      "X-Claxedo-Draft-Id",
-      "X-Claxedo-Binary"
-    ],
-    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
-  }));
-  app.get("/health", (c) => {
-    if (options.isDraining?.()) {
-      return c.json(
-        { ok: false, service: "workspace-relay", draining: true },
-        503
-      );
-    }
-    return c.json({ ok: true, service: "workspace-relay" });
+  const app = Object.assign(new Hono(), {
+    disposeAuditSampler: () => disposeAuditSampler(options)
   });
-  app.get("/.well-known/jwks.json", async (c) => {
-    const sources = options.relayHostPublicKeys ?? [];
-    if (sources.length === 0) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_no_keys_configured",
-            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
-          }
-        },
-        503
-      );
-    }
-    let keys;
-    try {
-      keys = await Promise.all(sources.map(async (source) => {
-        const jwk = await exportJWK(source.publicKey);
-        return {
-          ...jwk,
-          kid: source.kid,
-          alg: "EdDSA",
-          use: "sig"
-        };
-      }));
-    } catch (err) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_invalid_key",
-            message: "A configured RHT public key could not be exported as a JWK",
-            detail: err instanceof Error ? err.message : String(err)
-          }
-        },
-        500
-      );
-    }
-    c.header("cache-control", "public, max-age=300");
-    return c.json({ keys });
-  });
-  app.disposeAuditSampler = () => disposeAuditSampler(options);
-  app.get("/metrics", (c) => {
-    const authResult = checkMetricsAuth(options, c.req.raw);
-    if (!authResult.ok) {
-      return c.json(
-        errorBody(authResult.code, authResult.message),
-        authResult.status
-      );
-    }
-    return c.json(buildMetricsBody(options));
-  });
-  app.all("/workspaces/:workspaceId/*", async (c) => {
-    const trace = createWorkspaceRelayTrace();
-    if (options.isDraining?.()) {
-      return Response.json(
-        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
-        { status: 503, headers: denyCorsHeaders(c.req.raw, originAllowed) }
-      );
-    }
-    const response = await trace.span("relay-total", async () => {
-      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
-      if (!relay.ok) return relay.response;
-      return await forwardWorkspaceRelayRequest(
-        new Request(c.req.raw),
-        relay.request.target,
-        relay.request.relayHostToken,
-        relay.request.path,
-        options.fetch ?? fetch,
-        options.forwardTimeoutMs ?? 3e4,
-        trace,
-        originAllowed
-      );
-    });
-    return workspaceRelayTimingResponse(response, trace);
-  });
-  return app;
-}
-
-// src/bun.ts
-var TUNNEL_PENDING_HTTP_CAP = 32;
-var TUNNEL_CHANNEL_CAP = 16;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS = 6e4;
-var WS_MAX_PAYLOAD_LENGTH_BYTES = 16 * 1024 * 1024;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT = 3e4;
-var DIRECT_HTTP_TIMEOUT_MS_DEFAULT = 3e4;
-var UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT = 1e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
-var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
-var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
-var HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT = 250;
-function createFragmentationStats() {
-  return {
-    fragmentsBuffered: 0,
-    oversizedClosed: 0
-  };
-}
-function createSlowConsumerStats() {
-  return {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-}
-function readFragmentationStats(stats) {
-  return {
-    fragmentsBuffered: stats.fragmentsBuffered,
-    oversizedClosed: stats.oversizedClosed
-  };
-}
-function resetFragmentationStats(stats) {
-  stats.fragmentsBuffered = 0;
-  stats.oversizedClosed = 0;
-}
-function readSlowConsumerStats(stats) {
-  return { ...stats };
-}
-function resetSlowConsumerStats(stats) {
-  stats.overflowEvents = 0;
-  stats.timerFired = 0;
-  stats.droppedRequests = 0;
-}
-function createDirectHttpLimiter(limit) {
-  if (!Number.isInteger(limit) || !limit || limit <= 0) return void 0;
-  const max = limit;
-  let active = 0;
-  const queue = [];
-  function drain() {
-    if (active >= max) return;
-    const next = queue.shift();
-    if (!next) return;
-    active++;
-    next();
-  }
-  return {
-    async acquire() {
-      if (active < max) {
-        active++;
-      } else {
-        await new Promise((resolve) => queue.push(resolve));
-      }
-      let released = false;
-      return () => {
-        if (released) return;
-        released = true;
-        active = Math.max(0, active - 1);
-        drain();
-      };
-    }
-  };
-}
-function jsonError(code, message, status) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-function corsJsonError(request, code, message, status) {
-  const headers2 = relayCorsHeaders(request);
-  headers2.set("content-type", "application/json");
-  return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
-}
-function safeCloseCode(input, fallback = 1011) {
-  if (!Number.isInteger(input)) return fallback;
-  const code = input;
-  if (code === 1e3) return code;
-  if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code;
-  if (code >= 3e3 && code <= 4999) return code;
-  return fallback;
-}
-function closeWebSocket(ws, code, reason, fallback = 1011) {
-  try {
-    ws.close(safeCloseCode(code, fallback), reason);
-  } catch {
-    try {
-      ws.close(fallback, reason);
-    } catch {
-    }
-  }
-}
-function upstreamCloseReason(event) {
-  if (event.reason.trim()) return event.reason;
-  if (event.code === 1e3) return "";
-  if (event.code === 1005 || event.code === 1006) return "Upstream WebSocket closed abnormally";
-  return `Upstream WebSocket closed unexpectedly with code ${event.code}`;
-}
-function workspaceIdFromPath(pathname) {
-  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function hostIdFromTunnelPath(pathname) {
-  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function websocketRequest(request) {
-  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
-}
-function roundedMs2(input) {
-  return Math.round(input * 100) / 100;
-}
-function relayWebSocketTraceEnabled(request) {
-  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
-}
-function sendRelayWebSocketTrace(ws) {
-  const trace = ws.data.trace;
-  if (!trace || trace.emitted) return;
-  trace.emitted = true;
-  ws.send(JSON.stringify({
-    type: "relay.trace",
-    wsUpstreamOpenMs: trace.upstreamOpenMs === void 0 ? void 0 : roundedMs2(trace.upstreamOpenMs),
-    queuedFrames: trace.queuedFrames,
-    maxQueuedDelayMs: roundedMs2(trace.maxQueuedDelayMs)
-  }));
-}
-function relayWebSocketPayload(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof ArrayBuffer) return input;
-  if (ArrayBuffer.isView(input)) {
-    const copy = new Uint8Array(input.byteLength);
-    copy.set(new Uint8Array(input.buffer, input.byteOffset, input.byteLength));
-    return copy;
-  }
-}
-function headersRecord(headers2) {
-  const result = {};
-  headers2.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
-}
-function headers(input) {
-  const result = new Headers();
-  for (const [key, value] of Object.entries(input)) {
-    result.set(key, value);
-  }
-  return result;
-}
-function isEventStream(input) {
-  return Object.entries(input).some(
-    ([key, value]) => key.toLowerCase() === "content-type" && value.toLowerCase().includes("text/event-stream")
-  );
-}
-function allowedCorsOrigin(origin) {
-  if (!origin) return;
-  if (origin.startsWith("http://localhost:")) return origin;
-  if (origin.startsWith("http://127.0.0.1:")) return origin;
-  if (/^https:\/\/([a-z0-9-]+\.)*opencode\.ai$/.test(origin)) return origin;
-}
-function requireAllowedOrigin(request) {
-  const origin = request.headers.get("origin");
-  if (allowedCorsOrigin(origin)) return null;
-  return jsonError(
-    "origin_not_allowed",
-    "Origin is not in the allowlist",
-    403
-  );
-}
-function relayCorsHeaders(request, input = new Headers()) {
-  const result = new Headers(input);
-  result.delete("access-control-allow-origin");
-  result.delete("access-control-allow-credentials");
-  result.delete("access-control-allow-headers");
-  result.delete("access-control-allow-methods");
-  result.delete("access-control-expose-headers");
-  result.delete("access-control-max-age");
-  const origin = allowedCorsOrigin(request.headers.get("origin"));
-  if (origin) {
-    result.set("access-control-allow-origin", origin);
-    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary");
-    result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
-  }
-  return result;
-}
-function encoded(input) {
-  return Buffer.from(input).toString("base64");
-}
-function decoded(input) {
-  return new Uint8Array(Buffer.from(input, "base64"));
-}
-function encodedFrame(message) {
-  if (typeof message === "string") {
-    return {
-      binary: false,
-      data_base64: Buffer.from(message).toString("base64")
-    };
-  }
-  return {
-    binary: true,
-    data_base64: Buffer.from(message).toString("base64")
-  };
-}
-function decodedFrame(frame) {
-  const body = Buffer.from(frame.data_base64, "base64");
-  return frame.binary ? new Uint8Array(body) : body.toString("utf8");
-}
-function tunnelMessage(ws, input, stats) {
-  if (typeof input !== "string") return;
-  const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
-  let parsed;
-  try {
-    parsed = JSON.parse(combined);
-  } catch {
-    if (combined.length > TUNNEL_MESSAGE_BUFFER_CAP_BYTES) {
-      stats.oversizedClosed += 1;
-      ws.data.messageBuffer = "";
-      ws.close(1009, "Tunnel message buffer exceeded 4 MB");
-      return;
-    }
-    stats.fragmentsBuffered += 1;
-    ws.data.messageBuffer = combined;
-    return;
-  }
-  ws.data.messageBuffer = "";
-  const validated = validateTunnelMessage(parsed);
-  if (validated.ok) return validated.message;
-  if (validated.reason === "protocol_mismatch") {
-    ws.close(1002, `Tunnel protocol mismatch: expected ${validated.expected_protocol}`);
-  }
-  return;
-}
-function sendTunnelPing(ws) {
-  if (ws.readyState !== WebSocket.OPEN) return;
-  ws.data.missedPongs += 1;
-  ws.send(JSON.stringify(makeTunnelPing()));
-}
-function clearPendingTimers(entry) {
-  clearTimeout(entry.timeout);
-  if (entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function failPendingHttpResponse(input) {
-  clearPendingTimers(input.entry);
-  input.entry.pendingChunks.length = 0;
-  input.entry.bytesQueued = 0;
-  try {
-    input.entry.controller.error(input.error);
-  } catch {
-  }
-  if (!input.entry.responseStarted) {
-    if (input.response) {
-      input.entry.resolve(input.response);
-      return;
-    }
-    input.entry.reject(input.error);
-  }
-}
-function cleanupHostTunnelSocket(input) {
-  if (input.ws.data.heartbeat) {
-    clearInterval(input.ws.data.heartbeat);
-    input.ws.data.heartbeat = void 0;
-  }
-  for (const pending of input.ws.data.pending.values()) {
-    failPendingHttpResponse({
-      entry: pending,
-      response: input.request ? corsJsonError(input.request, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
-      error: new Error("User-hosted tunnel disconnected")
-    });
-  }
-  input.ws.data.pending.clear();
-  for (const channel of input.ws.data.channels.values()) {
-    if (input.closeChannels) closeWebSocket(channel, 1011, "User-hosted tunnel disconnected");
-  }
-  input.ws.data.channels.clear();
-  if (!input.disconnectDirectory) return;
-  if (input.hostTunnels.get(input.ws.data.hostId) === input.ws) {
-    input.hostTunnels.delete(input.ws.data.hostId);
-    input.options.directory?.disconnectHost(input.ws.data.hostId);
-    scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
-      hostId: input.ws.data.hostId,
-      workspaceId: input.ws.data.workspaceIds[0],
-      path: `/host-tunnels/${input.ws.data.hostId}`,
-      state: "disconnected",
-      debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-    });
-  }
-}
-async function audit2(options, input) {
-  await options.audit?.({
-    action: input.action,
-    result: "allow",
-    hostId: input.hostId,
-    workspaceId: input.workspaceId,
-    method: "WEBSOCKET",
-    path: input.path
-  });
-}
-function scheduleHostTunnelStateChange(state, options, input) {
-  const existing = state.get(input.hostId);
-  const entry = existing ?? {
-    intendedState: "disconnected",
-    lastWritten: "disconnected",
-    flushTimer: void 0,
-    pending: { workspaceId: input.workspaceId, path: input.path }
-  };
-  entry.intendedState = input.state;
-  entry.pending = { workspaceId: input.workspaceId, path: input.path };
-  if (entry.flushTimer) clearTimeout(entry.flushTimer);
-  entry.flushTimer = setTimeout(() => {
-    entry.flushTimer = void 0;
-    if (entry.intendedState === entry.lastWritten) {
-      if (entry.intendedState === "disconnected") {
-        state.delete(input.hostId);
-      }
-      return;
-    }
-    entry.lastWritten = entry.intendedState;
-    void audit2(options, {
-      action: entry.intendedState === "connected" ? "host_tunnel.connected" : "host_tunnel.disconnected",
-      hostId: input.hostId,
-      workspaceId: entry.pending.workspaceId,
-      path: entry.pending.path
-    });
-  }, input.debounceMs);
-  state.set(input.hostId, entry);
-}
-function drainPendingChunks(entry) {
-  while (entry.pendingChunks.length > 0) {
-    const desired = entry.controller.desiredSize;
-    if (desired !== null && desired <= 0) break;
-    const next = entry.pendingChunks.shift();
-    entry.bytesQueued -= next.byteLength;
-    try {
-      entry.controller.enqueue(next);
-    } catch {
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      break;
-    }
-  }
-  if (entry.pendingChunks.length === 0 && entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function enqueueChunkWithBackpressure(input) {
-  const { entry, chunk } = input;
-  const desired = entry.controller.desiredSize;
-  const overflowing = desired !== null && desired <= 0;
-  if (overflowing || entry.pendingChunks.length > 0) {
-    entry.pendingChunks.push(chunk);
-    entry.bytesQueued += chunk.byteLength;
-    if (!entry.slowConsumerTimeout) {
-      input.slowConsumerStats.overflowEvents += 1;
-      entry.slowConsumerTimeout = setTimeout(() => {
-        input.slowConsumerStats.timerFired += 1;
-        const error = new Error("slow_consumer_timeout: downstream consumer did not drain in time");
-        try {
-          entry.controller.error(error);
-        } catch {
-        }
-        clearTimeout(entry.timeout);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        if (!entry.responseStarted) {
-          entry.resolve(jsonError("slow_consumer_timeout", "Downstream consumer did not drain in time", 503));
-        }
-        input.ws.data.pending.delete(input.requestId);
-        input.slowConsumerStats.droppedRequests += 1;
-      }, input.slowConsumerTimeoutMs);
-    }
-    return;
-  }
-  try {
-    entry.controller.enqueue(chunk);
-  } catch {
-  }
-}
-var __slowConsumerInternalsForTest = {
-  enqueueChunkWithBackpressure,
-  createSlowConsumerStats
-};
-async function tunnelHttpRequest(input) {
-  if (input.ws.readyState !== WebSocket.OPEN) {
-    return new Response("User-hosted workspace is offline", { status: 503 });
-  }
-  if (input.ws.data.pending.size >= TUNNEL_PENDING_HTTP_CAP) {
-    return jsonError(
-      "too_many_in_flight",
-      "User-hosted tunnel has too many in-flight HTTP requests",
-      429
-    );
-  }
-  const requestId = crypto.randomUUID();
-  let controller;
-  const stream = new ReadableStream({
-    start(next) {
-      controller = next;
-    },
-    pull() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      drainPendingChunks(entry);
-    },
-    cancel() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      clearPendingTimers(entry);
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      if (input.ws.readyState === WebSocket.OPEN) {
-        input.ws.send(JSON.stringify({
-          type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION,
-          request_id: requestId,
-          paused: false,
-          reason: "closed"
-        }));
-      }
-    }
-  }, new ByteLengthQueuingStrategy({ highWaterMark: input.slowConsumerHighWaterMarkBytes }));
-  const pending = new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      if (entry.responseStarted) {
-        clearPendingTimers(entry);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        try {
-          entry.controller.close();
-        } catch {
-        }
-        return;
-      }
-      const error = new Error("User-hosted tunnel response timed out");
-      failPendingHttpResponse({
-        entry,
-        response: corsJsonError(input.request, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
-        error
-      });
-    }, input.responseTimeoutMs);
-    input.ws.data.pending.set(requestId, {
-      controller,
-      stream,
-      resolve,
-      reject,
-      timeout,
-      pendingChunks: [],
-      bytesQueued: 0,
-      responseStarted: false
-    });
-  });
-  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.requestBodyMaxBytes);
-  if (body && "response" in body) {
-    const entry = input.ws.data.pending.get(requestId);
-    if (entry) clearPendingTimers(entry);
-    input.ws.data.pending.delete(requestId);
-    return body.response;
-  }
-  input.ws.send(JSON.stringify({
-    type: "http.request",
-    protocol: TUNNEL_PROTOCOL_VERSION,
-    request_id: requestId,
-    workspace_id: input.workspaceId,
-    method: input.request.method,
-    path: input.path,
-    headers: headersRecord(workspaceRelayForwardHeaders(
-      input.request.headers,
-      input.relayHostToken,
-      input.workspaceId,
-      // T26: user-hosted tunnel — strip Cookie to avoid leaking browser
-      // cookies to the host process running on the user's laptop.
-      { userHosted: true }
-    )),
-    ...body?.bodyBase64 ? { body_base64: body.bodyBase64 } : {},
-    end: true
-  }));
-  return await pending;
-}
-async function readBoundedBody(request, maxBytes) {
-  if (!request.body) return void 0;
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const next = await reader.read();
-    if (next.done) break;
-    total += next.value.byteLength;
-    if (total > maxBytes) {
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      return {
-        response: corsJsonError(request, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
-      };
-    }
-    chunks.push(next.value);
-  }
-  const body = new Uint8Array(total);
-  chunks.reduce((offset, chunk) => {
-    body.set(chunk, offset);
-    return offset + chunk.byteLength;
-  }, 0);
-  return { bodyBase64: encoded(body.buffer) };
-}
-async function directHttpRequest(input) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
-  const span = (name, run) => input.trace ? input.trace.span(name, run) : run();
-  try {
-    const init = workspaceRelayForwardRequestInit(
-      input.request,
-      input.relayHostToken,
-      input.workspaceId,
-      {
-        // T26: cloud-vm direct path. Cookies pass through (default) — workspace
-        // dashboards in the VM may legitimately need session cookies.
-        userHosted: false,
-        upstreamHeaders: input.upstreamHeaders,
-        signal: controller.signal
-      }
-    );
-    if (input.request.method !== "GET" && input.request.method !== "HEAD" && input.request.body) {
-      init.body = await input.request.arrayBuffer();
-    }
-    const limiter = input.limiter;
-    const release = limiter ? await span("direct-http-queue", () => limiter.acquire()) : void 0;
-    try {
-      const upstream = await span("upstream-fetch", async () => await fetch(input.targetUrl, init));
-      return new Response(upstream.body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: relayCorsHeaders(input.request, upstream.headers)
-      });
-    } finally {
-      release?.();
-    }
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return corsJsonError(
-      input.request,
-      aborted ? "upstream_timeout" : "upstream_unavailable",
-      aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable",
-      aborted ? 504 : 503
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function hostTunnel(hostTunnels, hostId) {
-  const tunnel = hostTunnels.get(hostId);
-  if (tunnel?.readyState === WebSocket.OPEN) return tunnel;
-  return void 0;
-}
-async function authorizeHostTunnel(options, bunOptions, request, input) {
-  if (bunOptions.authorizeHostTunnel) return await bunOptions.authorizeHostTunnel(request, input);
-  const token = bearerToken(request.headers.get("authorization"));
-  if (!token) return false;
-  try {
-    await verifyHostTunnelToken(token, options.runtimeAccessKey, input);
-    return true;
-  } catch (err) {
-    if (err instanceof WorkspaceRelayAuthError) return false;
-    throw err;
-  }
-}
-function createWorkspaceRelayBun(options, bunOptions = {}) {
-  const hostTunnels = /* @__PURE__ */ new Map();
-  const relayClients = /* @__PURE__ */ new Set();
-  const hostTunnelRegistrations = /* @__PURE__ */ new Map();
-  const directHttpLimiter = createDirectHttpLimiter(bunOptions.directHttpConcurrency);
-  const hostTunnelStateDebounce = /* @__PURE__ */ new Map();
-  const fragmentationStats = createFragmentationStats();
-  const slowConsumerStats = createSlowConsumerStats();
-  const telemetry = {
-    getFragmentationStats: () => readFragmentationStats(fragmentationStats),
-    resetFragmentationStats: () => resetFragmentationStats(fragmentationStats),
-    getSlowConsumerStats: () => readSlowConsumerStats(slowConsumerStats),
-    resetSlowConsumerStats: () => resetSlowConsumerStats(slowConsumerStats)
-  };
-  let draining = false;
-  const drainController = {
-    isDraining: () => draining,
-    setDraining: (value) => {
-      draining = value;
-      if (!value) return;
-      for (const tunnel of hostTunnels.values()) {
-        closeWebSocket(tunnel, 1012, "Workspace relay is draining", 1012);
-      }
-      for (const client of relayClients) {
-        closeWebSocket(client, 1012, "Workspace relay is draining", 1012);
-      }
-    },
-    pendingCount: () => {
-      let total = 0;
-      for (const tunnel of hostTunnels.values()) {
-        total += tunnel.data.pending.size;
-      }
-      return total;
-    },
-    waitForDrain: async (timeoutMs) => {
-      const deadline = Date.now() + Math.max(0, timeoutMs);
-      const pollMs = 50;
-      while (true) {
-        const remaining = drainController.pendingCount();
-        if (remaining === 0) return { drained: true, remaining: 0 };
-        const now = Date.now();
-        if (now >= deadline) return { drained: false, remaining };
-        const sleep = Math.min(pollMs, Math.max(1, deadline - now));
-        await new Promise((resolve) => setTimeout(resolve, sleep));
-      }
-    }
-  };
-  const mergedMetricsSources = {
-    fragmentation: options.metricsSources?.fragmentation ?? telemetry.getFragmentationStats,
-    slowConsumer: options.metricsSources?.slowConsumer ?? telemetry.getSlowConsumerStats,
-    drainPending: options.metricsSources?.drainPending ?? drainController.pendingCount
-  };
-  const requestRemoteAddress = /* @__PURE__ */ new WeakMap();
-  const metricsRemoteAddressResolver = options.metricsRemoteAddress ?? ((request) => requestRemoteAddress.get(request));
-  const app = createWorkspaceRelay({
-    ...options,
-    isDraining: drainController.isDraining,
-    metricsSources: mergedMetricsSources,
-    metricsRemoteAddress: metricsRemoteAddressResolver
-  });
-  function getRegistrationTracker(hostId) {
-    let tracker = hostTunnelRegistrations.get(hostId);
-    if (!tracker) {
-      tracker = { recent: [] };
-      hostTunnelRegistrations.set(hostId, tracker);
-    }
-    return tracker;
-  }
-  function pruneReconnects(tracker, now) {
-    const cutoff = now - HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS;
-    while (tracker.recent.length && tracker.recent[0] < cutoff) {
-      tracker.recent.shift();
+  const originAllowed = originMatcherFor(options);
+  app.use("*", async (c, next) => {
+    await next();
+    const origin = c.res.headers.get("access-control-allow-origin");
+    if (origin && origin !== "*" && !c.res.headers.has("timing-allow-origin")) {
+      c.res.headers.set("timing-allow-origin", origin);
     }
-  }
-  return {
-    async fetch(request, server) {
-      const url = new URL(request.url);
-      const workspaceId = workspaceIdFromPath(url.pathname);
-      const hostId = hostIdFromTunnelPath(url.pathname);
-      try {
-        const ip = server.requestIP(request)?.address;
-        if (ip) requestRemoteAddress.set(request, ip);
-      } catch {
-      }
-      if (url.pathname === "/health") {
-        return Response.json(
-          draining ? { ok: false, service: "workspace-relay", draining: true } : { ok: true, service: "workspace-relay" },
-          { status: draining ? 503 : 200 }
-        );
-      }
-      if (draining && websocketRequest(request) && hostId) {
-        return jsonError(
-          "relay_draining",
-          "Workspace relay is shutting down; new tunnel registrations are not accepted",
-          503
-        );
-      }
-      if (draining && workspaceId) {
-        const headers2 = relayCorsHeaders(request);
-        const body = JSON.stringify({
-          error: {
-            code: "relay_draining",
-            message: "Workspace relay is shutting down; try another instance"
-          }
-        });
-        headers2.set("content-type", "application/json");
-        return new Response(body, { status: 503, headers: headers2 });
-      }
-      if (websocketRequest(request) && hostId) {
-        const workspaceIds = url.searchParams.getAll("workspaceId");
-        if (!workspaceIds.length || !options.directory) {
-          return new Response("Host tunnel registration is unavailable", { status: 503 });
-        }
-        if (!await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds })) {
-          return new Response("Host tunnel registration denied", { status: 403 });
-        }
-        const tracker = getRegistrationTracker(hostId);
-        const now = Date.now();
-        pruneReconnects(tracker, now);
-        if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
-          return jsonError(
-            "too_many_host_tunnel_reconnects",
-            "Too many host-tunnel reconnects for this host within the last 60 seconds",
-            429
-          );
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "host-tunnel",
-            hostId,
-            workspaceIds,
-            pending: /* @__PURE__ */ new Map(),
-            channels: /* @__PURE__ */ new Map(),
-            missedPongs: 0,
-            messageBuffer: ""
-          }
-        })) {
-          tracker.recent.push(now);
-          return;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (!workspaceId) return app.request(request);
-      if (request.method === "OPTIONS") {
-        return new Response(null, {
-          status: 204,
-          headers: relayCorsHeaders(request)
-        });
-      }
-      if (!websocketRequest(request)) {
-        const trace = createWorkspaceRelayTrace();
-        const response = await trace.span("relay-total", async () => {
-          const relay2 = await authorizeWorkspaceRelayRequest(options, request, workspaceId, trace);
-          if (!relay2.ok) return relay2.response;
-          if (relay2.request.target.access === "user-hosted") {
-            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId);
-            return tunnel ? await trace.span("tunnel-http", async () => await tunnelHttpRequest({
-              ws: tunnel,
-              request,
-              workspaceId: relay2.request.target.workspaceId,
-              path: `${relay2.request.path}${url.search}`,
-              relayHostToken: relay2.request.relayHostToken,
-              slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
-              slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-              slowConsumerStats,
-              requestBodyMaxBytes: bunOptions.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT,
-              responseTimeoutMs: bunOptions.tunnelHttpResponseTimeoutMs ?? TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT
-            })) : new Response("User-hosted workspace is offline", { status: 503 });
-          }
-          return await directHttpRequest({
-            request,
-            targetUrl: workspaceRelayTargetUrl(
-              relay2.request.target,
-              relay2.request.path,
-              url.search
-            ).toString(),
-            relayHostToken: relay2.request.relayHostToken,
-            workspaceId: relay2.request.target.workspaceId,
-            upstreamHeaders: relay2.request.target.upstreamHeaders,
-            timeoutMs: bunOptions.directHttpTimeoutMs ?? DIRECT_HTTP_TIMEOUT_MS_DEFAULT,
-            limiter: directHttpLimiter,
-            trace
-          });
-        });
-        return workspaceRelayTimingResponse(response, trace);
-      }
-      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
-      if (!relay.ok) return relay.response;
-      const originDenied = requireAllowedOrigin(request);
-      if (originDenied) return originDenied;
-      if (relay.request.target.access === "user-hosted") {
-        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
-        if (!tunnel) {
-          return new Response("User-hosted workspace is offline", { status: 503 });
-        }
-        if (tunnel.data.channels.size >= TUNNEL_CHANNEL_CAP) {
-          return jsonError(
-            "too_many_channels",
-            "User-hosted tunnel has too many active WebSocket channels",
-            503
-          );
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "user-hosted-client",
-            hostId: relay.request.target.hostId,
-            workspaceId: relay.request.target.workspaceId,
-            channelId: crypto.randomUUID(),
-            path: `${relay.request.path}${url.search}`,
-            relayHostToken: relay.request.relayHostToken
-          }
-        })) {
-          return;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (server.upgrade(request, {
-        data: {
-          kind: "client",
-          upstreamUrl: workspaceRelayTargetUrl(
-            relay.request.target,
-            relay.request.path,
-            url.search
-          ).toString().replace(/^http/, "ws"),
-          headers: headersRecord(workspaceRelayForwardHeaders(
-            new Headers(),
-            relay.request.relayHostToken,
-            relay.request.target.workspaceId,
-            // T26: cloud-vm WS upgrade. Cookies pass through (default).
-            { userHosted: false, upstreamHeaders: relay.request.target.upstreamHeaders }
-          )),
-          queue: [],
-          ...relayWebSocketTraceEnabled(request) ? {
-            trace: {
-              acceptedAt: performance.now(),
-              queuedFrames: 0,
-              maxQueuedDelayMs: 0,
-              emitted: false
-            }
-          } : {}
-        }
-      })) {
-        return;
-      }
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    },
-    websocket: {
-      maxPayloadLength: WS_MAX_PAYLOAD_LENGTH_BYTES,
-      message(ws, message) {
-        if (ws.data.kind === "host-tunnel") {
-          const parsed = tunnelMessage(
-            ws,
-            message,
-            fragmentationStats
-          );
-          if (parsed?.type === "ping") {
-            options.directory?.recordPong(ws.data.hostId);
-            ws.send(JSON.stringify(makeTunnelPong(parsed)));
-          }
-          if (parsed?.type === "pong") {
-            ws.data.missedPongs = 0;
-            options.directory?.recordPong(ws.data.hostId);
-          }
-          if (parsed?.type === "host.registration.update") {
-            const update = parsed;
-            const workspaceIds = [...new Set(update.workspace_ids)];
-            const hostSocket = ws;
-            const hostId = hostSocket.data.hostId;
-            const authorizationRequest = new Request(
-              `http://relay.local/host-tunnels/${encodeURIComponent(hostId)}`,
-              { headers: { authorization: `Bearer ${update.token}` } }
-            );
-            void authorizeHostTunnel(options, bunOptions, authorizationRequest, {
-              hostId,
-              workspaceIds
-            }).then((authorized) => {
-              if (!authorized) {
-                closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008);
-                return;
-              }
-              if (hostTunnels.get(hostId) !== hostSocket || hostSocket.readyState !== WebSocket.OPEN) return;
-              hostSocket.data.workspaceIds = workspaceIds;
-              options.directory?.registerHostTunnel({ hostId, workspaceIds });
-            }).catch(() => closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008));
-            return;
-          }
-          if (parsed?.type === "error") {
-            if (parsed.request_id) {
-              const pending = ws.data.pending.get(parsed.request_id);
-              if (pending) {
-                ws.data.pending.delete(parsed.request_id);
-                failPendingHttpResponse({
-                  entry: pending,
-                  response: jsonError(parsed.code, parsed.message, 502),
-                  error: new Error(parsed.message)
-                });
-              }
-            }
-          }
-          if (parsed?.type === "http.response.start") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              const response = parsed;
-              pending.responseStarted = true;
-              if (isEventStream(response.headers)) clearTimeout(pending.timeout);
-              pending.resolve(new Response(pending.stream, {
-                status: response.status,
-                headers: headers(response.headers)
-              }));
-            }
-          }
-          if (parsed?.type === "http.response.chunk") {
-            const entry = ws.data.pending.get(parsed.request_id);
-            if (entry) {
-              enqueueChunkWithBackpressure({
-                ws,
-                requestId: parsed.request_id,
-                entry,
-                chunk: decoded(parsed.body_base64),
-                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-                slowConsumerStats
-              });
-            }
-          }
-          if (parsed?.type === "http.response.end") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              clearTimeout(pending.timeout);
-              if (pending.slowConsumerTimeout) {
-                clearTimeout(pending.slowConsumerTimeout);
-                pending.slowConsumerTimeout = void 0;
-              }
-              drainPendingChunks(pending);
-              if (pending.pendingChunks.length > 0) {
-                for (const chunk of pending.pendingChunks) {
-                  try {
-                    pending.controller.enqueue(chunk);
-                  } catch {
-                    break;
-                  }
-                }
-                pending.pendingChunks.length = 0;
-                pending.bytesQueued = 0;
-              }
-              try {
-                pending.controller.close();
-              } catch {
-              }
-              ws.data.pending.delete(parsed.request_id);
-            }
-          }
-          if (parsed?.type === "ws.frame") {
-            const frame = parsed;
-            const channel = ws.data.channels.get(frame.channel_id);
-            if (!channel || channel.readyState !== WebSocket.OPEN) {
-              ws.data.channels.delete(frame.channel_id);
-              return;
-            }
-            if (channel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-              ws.data.channels.delete(frame.channel_id);
-              closeWebSocket(channel, 1011, "Client WebSocket backpressure limit exceeded");
-              return;
-            }
-            channel.send(decodedFrame(frame));
-          }
-          if (parsed?.type === "ws.close") {
-            const close = parsed;
-            const channel = ws.data.channels.get(close.channel_id);
-            if (channel) {
-              ws.data.channels.delete(close.channel_id);
-              closeWebSocket(channel, close.code, close.reason);
-            }
-          }
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          if (tunnel.bufferedAmount > (bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-            closeWebSocket(ws, 1011, "Host tunnel backpressure limit exceeded");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.frame",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            ...encodedFrame(message)
-          }));
-          return;
-        }
-        if (ws.data.upstream?.readyState === WebSocket.OPEN) {
-          ws.data.upstream.send(message);
-          return;
-        }
-        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT)) {
-          closeWebSocket(ws, 1011, "Upstream WebSocket queue limit exceeded");
-          return;
-        }
-        ws.data.queue.push({ payload: message, queuedAt: performance.now() });
-      },
-      open(ws) {
-        if (ws.data.kind === "host-tunnel") {
-          const previous = hostTunnels.get(ws.data.hostId);
-          if (previous && previous !== ws) {
-            cleanupHostTunnelSocket({
-              ws: previous,
-              hostTunnels,
-              hostTunnelStateDebounce,
-              options,
-              bunOptions,
-              disconnectDirectory: false,
-              closeChannels: true
-            });
-            closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
-          }
-          hostTunnels.set(ws.data.hostId, ws);
-          options.directory?.registerHostTunnel({
-            hostId: ws.data.hostId,
-            workspaceIds: ws.data.workspaceIds
-          });
-          ws.data.heartbeat = setInterval(() => {
-            const hostWs = ws;
-            if (hostWs.data.missedPongs > (bunOptions.hostTunnelMaxMissedPongs ?? HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT)) {
-              closeWebSocket(ws, 1001, "Host tunnel heartbeat timed out", 1001);
-              return;
-            }
-            sendTunnelPing(hostWs);
-          }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
-          scheduleHostTunnelStateChange(hostTunnelStateDebounce, options, {
-            hostId: ws.data.hostId,
-            workspaceId: ws.data.workspaceIds[0],
-            path: `/host-tunnels/${ws.data.hostId}`,
-            state: "connected",
-            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-          });
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.data.channels.set(ws.data.channelId, ws);
-          if (tunnel.readyState !== WebSocket.OPEN) {
-            closeWebSocket(ws, 1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.open",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            workspace_id: ws.data.workspaceId,
-            path: ws.data.path,
-            headers: headersRecord(workspaceRelayForwardHeaders(
-              new Headers(),
-              ws.data.relayHostToken,
-              ws.data.workspaceId,
-              // T26: user-hosted tunnel WS upgrade — strip Cookie. Headers are
-              // empty here today, but pass the flag for consistency in case
-              // upstream client headers are forwarded in the future.
-              { userHosted: true }
-            ))
-          }));
-          return;
-        }
-        relayClients.add(ws);
-        const data = ws.data;
-        const UpstreamWebSocket = bunOptions.upstreamWebSocket ?? WebSocket;
-        if (data.trace) data.trace.upstreamStartedAt = performance.now();
-        const upstream = new UpstreamWebSocket(data.upstreamUrl, {
-          headers: data.headers
-        });
-        upstream.binaryType = "arraybuffer";
-        data.upstream = upstream;
-        data.upstreamOpenTimer = setTimeout(() => {
-          if (upstream.readyState === WebSocket.OPEN) return;
-          closeWebSocket(upstream, 1001, "Upstream WebSocket open timed out", 1001);
-          closeWebSocket(ws, 1011, "Upstream WebSocket open timed out");
-        }, bunOptions.upstreamWebSocketOpenTimeoutMs ?? UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT);
-        upstream.onopen = () => {
-          const openedAt = performance.now();
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          if (data.trace) {
-            data.trace.upstreamOpenMs = openedAt - (data.trace.upstreamStartedAt ?? data.trace.acceptedAt);
-            data.trace.queuedFrames = data.queue.length;
-            data.trace.maxQueuedDelayMs = data.queue.reduce(
-              (max, item) => Math.max(max, openedAt - item.queuedAt),
-              0
-            );
-            sendRelayWebSocketTrace(ws);
-          }
-          for (const item of data.queue.splice(0)) upstream.send(item.payload);
-        };
-        upstream.onmessage = (event) => {
-          const payload = relayWebSocketPayload(event.data);
-          if (payload !== void 0) ws.send(payload);
-        };
-        upstream.onclose = (event) => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          closeWebSocket(ws, event.code, upstreamCloseReason(event));
-        };
-        upstream.onerror = () => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
+  });
+  app.use("*", cors({
+    origin: (origin) => {
+      if (!origin) return void 0;
+      return originAllowed(origin) ? origin : void 0;
+    },
+    // Spread from the shared list, not hand-maintained here: a duplicate
+    // array drifts out of sync and silently drops headers like
+    // `Last-Event-ID` or `X-Fetch-Bypass-Throttle`.
+    allowHeaders: [...RELAY_ALLOWED_REQUEST_HEADER_LIST],
+    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+  }));
+  app.get("/health", (c) => {
+    if (options.isDraining?.()) {
+      return c.json(
+        { ok: false, service: "workspace-relay", draining: true },
+        503
+      );
+    }
+    return c.json({ ok: true, service: "workspace-relay" });
+  });
+  app.get("/.well-known/jwks.json", async (c) => {
+    const sources = options.relayHostPublicKeys ?? [];
+    if (sources.length === 0) {
+      return c.json(
+        {
+          error: {
+            code: "jwks_no_keys_configured",
+            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
           }
-          closeWebSocket(ws, 1011, "Upstream WebSocket connection failed");
+        },
+        503
+      );
+    }
+    let keys;
+    try {
+      keys = await Promise.all(sources.map(async (source) => {
+        const jwk = await exportJWK2(source.publicKey);
+        return {
+          ...jwk,
+          kid: source.kid,
+          alg: "EdDSA",
+          use: "sig"
         };
-      },
-      close(ws, code, reason) {
-        if (ws.data.kind === "host-tunnel") {
-          cleanupHostTunnelSocket({
-            ws,
-            hostTunnels,
-            hostTunnelStateDebounce,
-            options,
-            bunOptions,
-            disconnectDirectory: true,
-            closeChannels: true
-          });
-          const tracker = hostTunnelRegistrations.get(ws.data.hostId);
-          if (tracker) {
-            pruneReconnects(tracker, Date.now());
-            if (tracker.recent.length === 0) hostTunnelRegistrations.delete(ws.data.hostId);
-          }
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          tunnel?.data.channels.delete(ws.data.channelId);
-          if (tunnel?.readyState === WebSocket.OPEN) {
-            tunnel.send(JSON.stringify({
-              type: "ws.close",
-              protocol: TUNNEL_PROTOCOL_VERSION,
-              channel_id: ws.data.channelId,
-              code: safeCloseCode(code, 1e3),
-              reason
-            }));
+      }));
+    } catch (err) {
+      return c.json(
+        {
+          error: {
+            code: "jwks_invalid_key",
+            message: "A configured RHT public key could not be exported as a JWK",
+            detail: err instanceof Error ? err.message : String(err)
           }
-          return;
-        }
-        relayClients.delete(ws);
-        if (ws.data.upstreamOpenTimer) clearTimeout(ws.data.upstreamOpenTimer);
-        if (ws.data.upstream) closeWebSocket(ws.data.upstream, code, reason, 1e3);
-      }
-    },
-    drain: drainController,
-    telemetry
-  };
+        },
+        500
+      );
+    }
+    c.header("cache-control", "public, max-age=300");
+    return c.json({ keys });
+  });
+  app.get("/metrics", (c) => {
+    const authResult = checkMetricsAuth(options, c.req.raw);
+    if (!authResult.ok) {
+      return c.json(
+        errorBody(authResult.code, authResult.message),
+        authResult.status
+      );
+    }
+    return c.json(buildMetricsBody(options));
+  });
+  app.all("/workspaces/:workspaceId/*", async (c) => {
+    const trace = createWorkspaceRelayTrace();
+    if (options.isDraining?.()) {
+      return Response.json(
+        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
+        { status: 503, headers: denyCorsHeaders(c.req.raw, originAllowed) }
+      );
+    }
+    const response = await trace.span("relay-total", async () => {
+      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
+      if (!relay.ok) return relay.response;
+      return await forwardWorkspaceRelayRequest(
+        new Request(c.req.raw),
+        relay.request.target,
+        relay.request.relayHostToken,
+        relay.request.path,
+        options.fetch ?? fetch,
+        options.forwardTimeoutMs ?? 3e4,
+        trace,
+        originAllowed
+      );
+    });
+    return workspaceRelayTimingResponse(response, trace);
+  });
+  return app;
 }
 
-// src/cloudflare.ts
-import {
-  makeTunnelPong as makeTunnelPong2,
-  TUNNEL_PROTOCOL_VERSION as TUNNEL_PROTOCOL_VERSION2,
-  validateTunnelMessage as validateTunnelMessage2
-} from "@claxedo/workspace-relay-protocol";
-
 // src/directory.ts
+function presenceKey(hostId, workspaceId) {
+  return `${hostId}\0${workspaceId}`;
+}
 function createWorkspaceRelayDirectory(options = {}) {
   const ttlMs = Math.max(1, options.ttlMs ?? 45e3);
   const now = options.now ?? Date.now;
   const sweepIntervalMs = options.sweepIntervalMs ?? 3e4;
-  const hosts = /* @__PURE__ */ new Map();
-  const alive = (presence) => {
-    if (!presence) return;
+  const entries = /* @__PURE__ */ new Map();
+  const alive = (key) => {
+    const presence = entries.get(key);
+    if (!presence) return void 0;
     if (presence.expiresAt <= now()) {
-      hosts.delete(presence.hostId);
-      return;
+      entries.delete(key);
+      return void 0;
     }
     return presence;
   };
-  const touch = (presence) => {
-    const timestamp = now();
-    const next = {
-      ...presence,
-      lastPongAt: timestamp,
-      expiresAt: timestamp + ttlMs
-    };
-    hosts.set(next.hostId, next);
-    return next;
+  const keysOf = (hostId, workspaceIds) => {
+    if (workspaceIds) return [...new Set(workspaceIds)].map((workspaceId) => presenceKey(hostId, workspaceId));
+    return [...entries].filter(([, presence]) => presence.hostId === hostId).map(([key]) => key);
   };
   const sweep = () => {
     const at = now();
-    for (const [hostId, presence] of hosts) {
+    for (const [key, presence] of entries) {
       if (presence.expiresAt <= at) {
-        hosts.delete(hostId);
+        entries.delete(key);
       }
     }
   };
@@ -2268,29 +1361,35 @@ function createWorkspaceRelayDirectory(options = {}) {
         lastPongAt: timestamp,
         expiresAt: timestamp + ttlMs
       };
-      hosts.set(next.hostId, next);
+      for (const workspaceId of next.workspaceIds) entries.set(presenceKey(next.hostId, workspaceId), next);
       return next;
     },
-    recordPong(hostId) {
-      const presence = alive(hosts.get(hostId));
-      return presence ? touch(presence) : void 0;
+    recordPong(hostId, workspaceIds) {
+      const timestamp = now();
+      let touched;
+      for (const key of keysOf(hostId, workspaceIds)) {
+        const presence = alive(key);
+        if (!presence) continue;
+        const next = { ...presence, lastPongAt: timestamp, expiresAt: timestamp + ttlMs };
+        entries.set(key, next);
+        touched ??= next;
+      }
+      return touched;
     },
-    disconnectHost(hostId) {
-      hosts.delete(hostId);
+    disconnectHost(hostId, workspaceIds) {
+      for (const key of keysOf(hostId, workspaceIds)) entries.delete(key);
     },
     activeHost(input) {
-      const presence = alive(hosts.get(input.hostId));
-      if (!presence?.workspaceIds.includes(input.workspaceId)) return;
-      return presence;
+      return alive(presenceKey(input.hostId, input.workspaceId));
     },
     sweep,
     size() {
       const at = now();
-      let count = 0;
-      for (const presence of hosts.values()) {
-        if (presence.expiresAt > at) count += 1;
+      const hosts = /* @__PURE__ */ new Set();
+      for (const presence of entries.values()) {
+        if (presence.expiresAt > at) hosts.add(presence.hostId);
       }
-      return count;
+      return hosts.size;
     },
     dispose() {
       if (intervalHandle !== void 0) {
@@ -2306,21 +1405,91 @@ function disposeWorkspaceRelayDirectory(directory) {
 
 // src/cloudflare.ts
 var DEFAULT_RELAY_LOCATION_HINT = "apac";
+var RELAY_LOCATION_HINTS = ["wnam", "enam", "sam", "weur", "eeur", "apac", "oc", "afr", "me"];
+var relayLocationHintSet = new Set(RELAY_LOCATION_HINTS);
+function isRelayLocationHint(input) {
+  return relayLocationHintSet.has(input);
+}
+var RELAY_REGION_TO_LOCATION_HINT = {
+  // Canonical Claxedo regions.
+  "apac-south": "apac",
+  "apac-east": "apac",
+  "eu-west": "weur",
+  "us-east": "enam",
+  "us-west": "wnam",
+  // Provider spellings.
+  "us-central": "wnam",
+  "eu-central": "weur",
+  "eu-east": "eeur",
+  "ap-south": "apac",
+  "ap-southeast": "apac",
+  "ap-northeast": "apac",
+  "sa-east": "sam",
+  "af-south": "afr",
+  "me-central": "me",
+  "oceania": "oc",
+  "au-southeast": "oc"
+};
+function locationHintForCountry(country) {
+  const code = country.toUpperCase();
+  if (["US", "CA", "MX"].includes(code)) return code === "US" || code === "CA" ? "enam" : "wnam";
+  if (["BR", "AR", "CL", "CO", "PE", "UY", "PY", "BO", "EC", "VE"].includes(code)) return "sam";
+  if (["GB", "IE", "FR", "ES", "PT", "NL", "BE", "DE", "CH", "AT", "IT", "DK", "NO", "SE", "FI", "IS", "LU"].includes(code)) return "weur";
+  if (["PL", "CZ", "SK", "HU", "RO", "BG", "GR", "UA", "RS", "HR", "SI", "EE", "LV", "LT", "TR", "RU"].includes(code)) return "eeur";
+  if (["IN", "PK", "BD", "LK", "NP", "SG", "MY", "TH", "VN", "PH", "ID", "CN", "HK", "TW", "JP", "KR"].includes(code)) return "apac";
+  if (["AU", "NZ", "FJ", "PG"].includes(code)) return "oc";
+  if (["ZA", "NG", "KE", "GH", "ET", "TZ", "UG", "EG", "MA", "DZ", "TN"].includes(code)) {
+    return ["EG", "MA", "DZ", "TN"].includes(code) ? "me" : "afr";
+  }
+  if (["AE", "SA", "IL", "QA", "KW", "BH", "OM", "JO", "LB", "IQ", "IR"].includes(code)) return "me";
+  return void 0;
+}
+var RELAY_REGION_HEADER = "x-claxedo-workspace-region";
+function relayLocationHint(input) {
+  const configured = trimToUndefined(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
+  const region = trimToUndefined(input.region);
+  if (region) {
+    const lowered = region.toLowerCase();
+    const direct = isRelayLocationHint(lowered) ? lowered : void 0;
+    const mapped = direct ?? RELAY_REGION_TO_LOCATION_HINT[lowered];
+    if (mapped) return mapped;
+  }
+  const country = trimToUndefined(input.country);
+  if (country) {
+    const mapped = locationHintForCountry(country);
+    if (mapped) return mapped;
+  }
+  return configured;
+}
+function relayRequestRegion(request) {
+  const url = new URL(request.url);
+  return trimToUndefined(request.headers.get(RELAY_REGION_HEADER)) ?? trimToUndefined(url.searchParams.get("region")) ?? trimToUndefined(url.searchParams.get("homeRegion"));
+}
+function relayRequestCountry(request) {
+  const cf = request.cf;
+  return typeof cf?.country === "string" ? cf.country : void 0;
+}
 var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
 var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
 var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT2 = 16 * 1024 * 1024;
+var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
 var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT2 = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT2 = 3e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2 = 64;
+var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
+var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
 var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
+var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
+var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var TRACE_ID_HEADER = "x-claxedo-trace-id";
 var TRACE_FORCE_HEADER = "x-claxedo-relay-trace";
-function clean(input) {
-  const value = input?.trim();
-  return value ? value : void 0;
+function unrefTimer(timer) {
+  if (typeof timer.unref === "function") timer.unref();
+}
+function isUserHostedClient(client) {
+  return "channelId" in client && typeof client.channelId === "string";
 }
 function clampRate(input) {
   if (input === void 0 || !Number.isFinite(input)) return 0;
@@ -2329,8 +1498,8 @@ function clampRate(input) {
   return input;
 }
 function traceRequest(request, routeKind, options) {
-  const id = clean(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
-  const forceSecret = clean(options.traceForceHeaderSecret);
+  const id = trimToUndefined(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+  const forceSecret = trimToUndefined(options.traceForceHeaderSecret);
   const forced = !!forceSecret && request.headers.get(TRACE_FORCE_HEADER) === forceSecret;
   const rate = clampRate(options.traceSampleRate);
   return {
@@ -2350,36 +1519,36 @@ async function traceSpan(trace, name, fn) {
   }
 }
 function tracedRequest(request, trace) {
-  const headers2 = new Headers(request.headers);
-  headers2.set(TRACE_ID_HEADER, trace.id);
-  if (trace.sampled) headers2.set("x-claxedo-trace-sampled", "1");
-  else headers2.delete("x-claxedo-trace-sampled");
+  const headers = new Headers(request.headers);
+  headers.set(TRACE_ID_HEADER, trace.id);
+  if (trace.sampled) headers.set("x-claxedo-trace-sampled", "1");
+  else headers.delete("x-claxedo-trace-sampled");
   return new Request(request.url, {
     method: request.method,
-    headers: headers2,
+    headers,
     body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
     redirect: request.redirect,
     duplex: "half"
   });
 }
-function roundedMs3(value) {
+function roundedMs2(value) {
   return Math.round(value * 100) / 100;
 }
 function serverTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs3(phase.ms)}`).join(", ");
+  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs2(phase.ms)}`).join(", ");
 }
 function withTraceHeaders(response, trace) {
-  const headers2 = new Headers(response.headers);
-  headers2.set(TRACE_ID_HEADER, trace.id);
+  const headers = new Headers(response.headers);
+  headers.set(TRACE_ID_HEADER, trace.id);
   const timing = trace.sampled ? serverTiming(trace) : "";
   if (timing) {
-    const existing = headers2.get("server-timing");
-    headers2.set("server-timing", existing ? `${existing}, ${timing}` : timing);
+    const existing = headers.get("server-timing");
+    headers.set("server-timing", existing ? `${existing}, ${timing}` : timing);
   }
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
-    headers: headers2
+    headers
   });
 }
 function logTrace(options, request, workspaceId, trace, response) {
@@ -2394,8 +1563,8 @@ function logTrace(options, request, workspaceId, trace, response) {
     method: request.method,
     path: url.pathname,
     status: response.status,
-    totalMs: roundedMs3(totalMs),
-    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs3(phase.ms)]))
+    totalMs: roundedMs2(totalMs),
+    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs2(phase.ms)]))
   };
   if (options.traceLog) {
     options.traceLog(event);
@@ -2406,44 +1575,58 @@ function logTrace(options, request, workspaceId, trace, response) {
 function workspaceIdFromRelayPath(pathname) {
   return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
-function hostIdFromTunnelPath2(pathname) {
+function hostIdFromTunnelPath(pathname) {
   return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
-function websocketRequest2(request) {
+function websocketRequest(request) {
   return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
-function relayWebSocketTraceEnabled2(request) {
+function relayWebSocketTraceEnabled(request) {
   return request.headers.get("x-claxedo-relay-ws-trace") === "1";
 }
 function workspaceIdsFromSearch(url) {
   return [...new Set([
     ...url.searchParams.getAll("workspaceId"),
     ...url.searchParams.getAll("workspace_id")
-  ].map(clean).filter((item) => !!item))];
+  ].map(trimToUndefined).filter((item) => !!item))];
 }
 function randomToken() {
   return crypto.randomUUID();
 }
-function headerRecord(headers2) {
+function headerRecord(headers) {
   const result = {};
-  headers2.forEach((value, key) => {
+  headers.forEach((value, key) => {
     result[key] = value;
   });
   return result;
 }
 function headersFromRecord(input) {
-  const headers2 = new Headers();
-  for (const [key, value] of Object.entries(input)) headers2.set(key, value);
-  return headers2;
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(input)) headers.set(key, value);
+  return headers;
 }
+var BASE64_CHUNK_BYTES = 32768;
 function bytesToBase64(bytes) {
   let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
+  for (let i = 0; i < bytes.length; i += BASE64_CHUNK_BYTES) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + BASE64_CHUNK_BYTES));
+  }
   return btoa(binary);
 }
 function base64ToBytes(input) {
   return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
 }
+function preOpenFrameBytes(input) {
+  if (typeof input === "string") return new TextEncoder().encode(input).byteLength;
+  return input.byteLength;
+}
+function isBlobLike(input) {
+  if (!input || typeof input !== "object") return false;
+  return "arrayBuffer" in input && typeof input.arrayBuffer === "function";
+}
+function viewBytes(input) {
+  return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
+}
 function socketFrame(input) {
   if (typeof input === "string") {
     return {
@@ -2463,14 +1646,54 @@ function socketFrame(input) {
       data_base64: bytesToBase64(input)
     };
   }
+  if (ArrayBuffer.isView(input)) {
+    return {
+      binary: true,
+      data_base64: bytesToBase64(viewBytes(input))
+    };
+  }
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer().then((buffer) => ({
+    binary: true,
+    data_base64: bytesToBase64(new Uint8Array(buffer))
+  }));
 }
 function socketPayload(input) {
   if (typeof input === "string") return input;
   if (input instanceof ArrayBuffer) return input;
   if (input instanceof Uint8Array) return input;
-  if (ArrayBuffer.isView(input)) {
-    return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
-  }
+  if (ArrayBuffer.isView(input)) return viewBytes(input);
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer();
+}
+function orderedFrameDelivery(deliver) {
+  let tail;
+  return (data) => {
+    const payload = socketPayload(data);
+    if (payload === void 0) return;
+    if (tail === void 0 && !(payload instanceof Promise)) {
+      deliver(payload);
+      return;
+    }
+    const queued = (tail ?? Promise.resolve()).then(async () => deliver(await payload)).catch(() => {
+    });
+    tail = queued;
+    void queued.then(() => {
+      if (tail === queued) tail = void 0;
+    });
+  };
+}
+async function relayFrameDiagnostics(data) {
+  const frame = await socketFrame(data);
+  const payload = await socketPayload(data);
+  return {
+    // `undefined` here is exactly the silent drop: every caller treats it as
+    // "nothing to forward" and returns without a throw or a log.
+    frameDropped: frame === void 0,
+    payloadDropped: payload === void 0,
+    ...frame ? { binary: frame.binary, dataBase64: frame.data_base64 } : {},
+    payloadBase64: payload === void 0 ? void 0 : typeof payload === "string" ? bytesToBase64(new TextEncoder().encode(payload)) : bytesToBase64(payload instanceof ArrayBuffer ? new Uint8Array(payload) : payload)
+  };
 }
 function tunnelFrame(input) {
   const bytes = base64ToBytes(input.data_base64);
@@ -2507,7 +1730,7 @@ async function readRequestBodyCapped(request, maxBytes) {
   }
   return concatBytes(chunks);
 }
-function safeCloseCode2(code, fallback = 1011) {
+function safeCloseCode(code, fallback = 1011) {
   if (code === void 0) return fallback;
   if (code >= 1e3 && code <= 4999 && ![1004, 1005, 1006].includes(code)) return code;
   return fallback;
@@ -2517,15 +1740,19 @@ function workspaceRelayDurableObjectRoomName(workspaceId) {
 }
 function workspaceRelayDurableObjectWorkspaceId(request) {
   const url = new URL(request.url);
-  const workspaceId = clean(workspaceIdFromRelayPath(url.pathname));
+  const workspaceId = trimToUndefined(workspaceIdFromRelayPath(url.pathname));
   if (workspaceId) return decodeURIComponent(workspaceId);
-  if (!hostIdFromTunnelPath2(url.pathname)) return;
-  return clean(url.searchParams.get("workspaceId")) ?? clean(url.searchParams.get("workspace_id"));
+  if (!hostIdFromTunnelPath(url.pathname)) return void 0;
+  return trimToUndefined(url.searchParams.get("workspaceId")) ?? trimToUndefined(url.searchParams.get("workspace_id"));
 }
 function namespaceFromEnv(env, options) {
   if (options.namespace) return options.namespace;
   const binding = env[options.bindingName ?? "WORKSPACE_RELAY_ROOM"];
-  return binding && typeof binding === "object" ? binding : void 0;
+  return isDurableObjectNamespace(binding) ? binding : void 0;
+}
+function isDurableObjectNamespace(value) {
+  if (!value || typeof value !== "object") return false;
+  return "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
 }
 function json(code, message, status) {
   return Response.json(errorBody(code, message), { status });
@@ -2540,32 +1767,31 @@ function setWorkspaceRelayAllowedOrigins(raw) {
   const patterns = parseAllowedOrigins(raw);
   baseOriginAllowed = patterns ? createOriginMatcher(patterns) : defaultOriginAllowed;
 }
-function allowedCorsOrigin2(origin) {
-  if (!origin) return;
-  if (baseOriginAllowed(origin)) return origin;
-  if (configuredAppOriginAllowed(origin)) return origin;
+function allowedCorsOrigin(origin) {
+  if (!origin) return void 0;
+  return baseOriginAllowed(origin) || configuredAppOriginAllowed(origin) ? origin : void 0;
 }
 function corsHeaders(request) {
-  const origin = allowedCorsOrigin2(request.headers.get("origin"));
-  if (!origin) return;
+  const origin = allowedCorsOrigin(request.headers.get("origin"));
+  if (!origin) return void 0;
   return {
     "access-control-allow-origin": origin,
     "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
+    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
     "access-control-max-age": "86400",
     vary: "Origin"
   };
 }
 function corsPreflight(request) {
-  const headers2 = corsHeaders(request);
-  return new Response(null, { status: headers2 ? 204 : 403, ...headers2 ? { headers: headers2 } : {} });
+  const headers = corsHeaders(request);
+  return new Response(null, { status: headers ? 204 : 403, ...headers ? { headers } : {} });
 }
 function withCors(request, response) {
-  const headers2 = corsHeaders(request);
-  if (!headers2) return response;
-  if (response.status === 101 || response.webSocket) return response;
+  const headers = corsHeaders(request);
+  if (!headers) return response;
+  if (response.status === 101 || "webSocket" in response && response.webSocket) return response;
   const next = new Headers(response.headers);
-  for (const [key, value] of Object.entries(headers2)) next.set(key, value);
+  for (const [key, value] of Object.entries(headers)) next.set(key, value);
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
@@ -2573,7 +1799,7 @@ function withCors(request, response) {
   });
 }
 function defaultWebSocketPair() {
-  const pair = new globalThis.WebSocketPair();
+  const pair = new WebSocketPair();
   return {
     client: pair[0],
     server: pair[1]
@@ -2581,7 +1807,7 @@ function defaultWebSocketPair() {
 }
 function selectedSubprotocol(request) {
   const offered = request.headers.get("sec-websocket-protocol")?.split(",").map((item) => item.trim()).filter(Boolean);
-  if (!offered?.length) return;
+  if (!offered?.length) return void 0;
   return offered.find((item) => item.startsWith("claxedo-rat.")) ?? offered[0];
 }
 function upgradeResponse(socket, request) {
@@ -2608,7 +1834,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
   return {
     async fetch(request, env = {}) {
       const gatewayStartedAt = performance.now();
-      const gatewayTraceId = clean(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+      const gatewayTraceId = trimToUndefined(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
       const url = new URL(request.url);
       if (request.method === "OPTIONS" && (url.pathname.startsWith("/workspaces/") || url.pathname.startsWith("/host-tunnels/"))) {
         return corsPreflight(request);
@@ -2616,7 +1842,13 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       if (url.pathname === "/health") {
         return Response.json({ ok: true, service: "workspace-relay", mode: "cloudflare-durable-object" });
       }
-      const relayLocationHint = typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" && env.CLAXEDO_RELAY_LOCATION_HINT ? env.CLAXEDO_RELAY_LOCATION_HINT : DEFAULT_RELAY_LOCATION_HINT;
+      const requestRegion = relayRequestRegion(request);
+      const requestCountry = relayRequestCountry(request);
+      const locationHint = relayLocationHint({
+        ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
+        ...requestRegion ? { region: requestRegion } : {},
+        ...requestCountry ? { country: requestCountry } : {}
+      });
       const namespace = namespaceFromEnv(env, options);
       if (!namespace) {
         return json(
@@ -2642,7 +1874,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       }
       const routeFinishedAt = performance.now();
       const response = await namespace.get(namespace.idFromName(workspaceRelayDurableObjectRoomName(workspaceId)), {
-        locationHint: relayLocationHint
+        locationHint
       }).fetch(tracedRequest(request, {
         id: gatewayTraceId,
         sampled: request.headers.get("x-claxedo-trace-sampled") === "1",
@@ -2651,26 +1883,26 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
         phases: []
       }));
       const fetchFinishedAt = performance.now();
-      if (response.status === 101 || response.webSocket) {
+      if (response.status === 101 || "webSocket" in response && response.webSocket) {
         return url.pathname.startsWith("/workspaces/") ? withCors(request, response) : response;
       }
-      const headers2 = new Headers(response.headers);
-      headers2.set(TRACE_ID_HEADER, headers2.get(TRACE_ID_HEADER) ?? gatewayTraceId);
-      headers2.set("x-claxedo-relay-location-hint", relayLocationHint);
+      const headers = new Headers(response.headers);
+      headers.set(TRACE_ID_HEADER, headers.get(TRACE_ID_HEADER) ?? gatewayTraceId);
+      headers.set("x-claxedo-relay-location-hint", locationHint);
       const gatewayResponseStartedAt = performance.now();
       const tracedResponse = new Response(response.body, {
         status: response.status,
         statusText: response.statusText,
-        headers: headers2
+        headers
       });
       const gatewayFinishedAt = performance.now();
       const roomTiming = tracedResponse.headers.get("server-timing");
       if (roomTiming) {
         const gatewayTiming = [
-          `relay-gateway-route;dur=${roundedMs3(routeFinishedAt - gatewayStartedAt)}`,
-          `relay-gateway-do-fetch;dur=${roundedMs3(fetchFinishedAt - routeFinishedAt)}`,
-          `relay-gateway-response;dur=${roundedMs3(gatewayFinishedAt - gatewayResponseStartedAt)}`,
-          `relay-gateway;dur=${roundedMs3(gatewayFinishedAt - gatewayStartedAt)}`
+          `relay-gateway-route;dur=${roundedMs2(routeFinishedAt - gatewayStartedAt)}`,
+          `relay-gateway-do-fetch;dur=${roundedMs2(fetchFinishedAt - routeFinishedAt)}`,
+          `relay-gateway-response;dur=${roundedMs2(gatewayFinishedAt - gatewayResponseStartedAt)}`,
+          `relay-gateway;dur=${roundedMs2(gatewayFinishedAt - gatewayStartedAt)}`
         ].join(", ");
         tracedResponse.headers.set("server-timing", `${roomTiming}, ${gatewayTiming}`);
       }
@@ -2720,6 +1952,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
   };
   const cleanupTunnelResources = (tunnel, reason) => {
+    if (tunnel.generationWatcher) clearInterval(tunnel.generationWatcher);
+    tunnel.generationWatcher = void 0;
     for (const pending of tunnel.pending.values()) {
       clearTimeout(pending.timeout);
       if (pending.stream?.slowConsumerTimeout) clearTimeout(pending.stream.slowConsumerTimeout);
@@ -2741,6 +1975,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   const rebuildHibernatedSockets = () => {
     if (!hibernation) return;
     hibernatedSocketsRebuilt = true;
+    for (const tunnel of hostTunnels.values()) {
+      if (tunnel.pending.size === 0) continue;
+      cleanupTunnelResources(tunnel, "Workspace relay restarted while the request was in flight");
+    }
     hostTunnels.clear();
     clients.clear();
     const clientRows = [];
@@ -2752,6 +1990,9 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           hostId: attachment.hostId,
           workspaceIds: attachment.workspaceIds,
           connectedAt: attachment.connectedAt,
+          ...attachment.enrollmentId ? { enrollmentId: attachment.enrollmentId } : {},
+          ...attachment.generation !== void 0 ? { generation: attachment.generation } : {},
+          generationCheckFailures: attachment.generationCheckFailures ?? 0,
           socket,
           pending: /* @__PURE__ */ new Map(),
           channels: /* @__PURE__ */ new Map()
@@ -2798,10 +2039,13 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       }
     }
   };
+  const resolverGraceAttempts = options.resolverOutageGraceAttempts ?? RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT;
+  const resolverUnreachable = (code) => code === "relay_revocation_resolver_unavailable";
   const watchRuntimeAccessToken = (client, onInactive) => {
     const intervalMs = options.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
-    if (intervalMs <= 0) return;
+    if (intervalMs <= 0) return void 0;
     const now = options.now ?? Date.now;
+    let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       if (client.request.claims.exp * 1e3 <= now()) {
         clearInterval(timer);
@@ -2809,41 +2053,98 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         return;
       }
       if (!options.isRuntimeAccessTokenActive) return;
+      const tolerate = (reason) => {
+        consecutiveUnreachable += 1;
+        if (consecutiveUnreachable < resolverGraceAttempts) return;
+        clearInterval(timer);
+        onInactive(reason);
+      };
       void Promise.resolve(options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
-        if (active.active) return;
+        if (active.active) {
+          consecutiveUnreachable = 0;
+          return;
+        }
+        if (resolverUnreachable(active.code)) {
+          tolerate(`Runtime Access Token active check unavailable: ${active.reason}`);
+          return;
+        }
+        consecutiveUnreachable = 0;
         clearInterval(timer);
         onInactive(active.reason);
-      }).catch(() => {
-        clearInterval(timer);
-        onInactive("Runtime Access Token active check failed");
-      });
+      }).catch(() => tolerate("Runtime Access Token active check failed"));
     }, intervalMs);
-    if (typeof timer.unref === "function") {
-      timer.unref();
-    }
+    unrefTimer(timer);
     return timer;
   };
   const watchUserHostedTarget = (client, onInactive) => {
     const intervalMs = options.workspaceTargetActiveCheckIntervalMs ?? WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
-    if (intervalMs <= 0) return;
+    if (intervalMs <= 0) return void 0;
     const target = client.request.target;
+    let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       void Promise.resolve(options.resolveTarget(client.request.claims)).then((activeTarget) => {
         if (activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+          consecutiveUnreachable = 0;
           return;
         }
+        consecutiveUnreachable = 0;
         clearInterval(timer);
         onInactive("User-hosted workspace is offline");
       }).catch(() => {
+        consecutiveUnreachable += 1;
+        if (consecutiveUnreachable < resolverGraceAttempts) return;
         clearInterval(timer);
         onInactive("Workspace relay target active check failed");
       });
     }, intervalMs);
-    if (typeof timer.unref === "function") {
-      timer.unref();
-    }
+    unrefTimer(timer);
     return timer;
   };
+  const hostTunnelAttachment = (tunnel) => ({
+    kind: "host-tunnel",
+    hostId: tunnel.hostId,
+    workspaceIds: tunnel.workspaceIds,
+    connectedAt: tunnel.connectedAt,
+    ...tunnel.enrollmentId ? { enrollmentId: tunnel.enrollmentId } : {},
+    ...tunnel.generation !== void 0 ? { generation: tunnel.generation } : {},
+    ...tunnel.generationCheckFailures ? { generationCheckFailures: tunnel.generationCheckFailures } : {}
+  });
+  const fenced = (tunnel) => Boolean(options.resolveHostGeneration) && tunnel.generation !== void 0;
+  const recheckHostGeneration = async (tunnel) => {
+    if (!fenced(tunnel) || hostTunnels.get(tunnel.hostId) !== tunnel) return;
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, {
+      enrollment_id: tunnel.enrollmentId,
+      generation: tunnel.generation
+    });
+    if (hostTunnels.get(tunnel.hostId) !== tunnel) return;
+    if (decision.ok) {
+      if (tunnel.generationCheckFailures === 0) return;
+      tunnel.generationCheckFailures = 0;
+      tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+      return;
+    }
+    if (decision.retryable) {
+      tunnel.generationCheckFailures += 1;
+      if (tunnel.generationCheckFailures < resolverGraceAttempts) {
+        tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+        return;
+      }
+      cleanupHostTunnel(tunnel.hostId, tunnel.socket, "Host generation check unavailable");
+      closeSocket(tunnel.socket, 1012, "Host generation check unavailable");
+      return;
+    }
+    cleanupHostTunnel(tunnel.hostId, tunnel.socket, decision.reason);
+    closeSocket(tunnel.socket, 1008, decision.reason);
+  };
+  const watchHostGeneration = (tunnel) => {
+    const intervalMs = options.hostGenerationCheckIntervalMs ?? HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT;
+    if (tunnel.generationWatcher || hibernation || !fenced(tunnel) || intervalMs <= 0) return;
+    tunnel.generationWatcher = setInterval(() => {
+      void recheckHostGeneration(tunnel).catch(() => {
+      });
+    }, intervalMs);
+    unrefTimer(tunnel.generationWatcher);
+  };
   const clearSlowConsumerTimer = (pending) => {
     if (!pending.stream?.slowConsumerTimeout) return;
     clearTimeout(pending.stream.slowConsumerTimeout);
@@ -2858,7 +2159,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     pending.stream.flowPaused = paused;
     tunnel.socket.send?.(JSON.stringify({
       type: "http.response.flow",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       request_id: requestId,
       paused,
       reason
@@ -2879,7 +2180,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (pending.stream?.slowConsumerTimeout) return;
     pending.stream.slowConsumerTimeout = setTimeout(
       () => failSlowConsumer(tunnel, requestId, pending),
-      options.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT2
+      options.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
     );
   };
   const drainPendingStreamChunks = (tunnel, requestId, pending) => {
@@ -2933,7 +2234,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       failPendingTunnelResponse(tunnel, oldestId, oldest, new Error("stream_evicted: tunnel started-stream cap reached"));
     }
   };
-  const resolvePendingTunnelStream = (tunnel, requestId, pending, status, headers2) => {
+  const resolvePendingTunnelStream = (tunnel, requestId, pending, status, headers) => {
     if (pending.stream) return;
     pending.startedSeq = ++startedSeqCounter;
     evictOldestStartedStream(tunnel, requestId);
@@ -2957,18 +2258,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         }
         tunnel.socket.send?.(JSON.stringify({
           type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION2,
+          protocol: TUNNEL_PROTOCOL_VERSION,
           request_id: requestId,
           paused: false,
           reason: "closed"
         }));
       }
     }, new ByteLengthQueuingStrategy({
-      highWaterMark: options.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT2
+      highWaterMark: options.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT
     }));
     pending.resolve(new Response(stream, {
       status,
-      headers: headers2
+      headers
     }));
   };
   const failPendingTunnelResponse = (tunnel, requestId, pending, error) => {
@@ -3019,11 +2320,77 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTarget = await options.resolveTarget(client.request.claims);
     return !!(activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
   };
+  const dropUserHostedChannel = (tunnel, channelId, client, code, reason) => {
+    tunnel.channels.delete(channelId);
+    clients.delete(client);
+    closeSocket(client.socket, code, reason);
+    sendSocket(tunnel.socket, JSON.stringify({
+      type: "ws.close",
+      protocol: TUNNEL_PROTOCOL_VERSION,
+      channel_id: channelId,
+      code,
+      reason
+    }));
+  };
+  const reportFrameHandlerFailure = (socket, err) => {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[workspace-relay] frame handler failed: ${reason}`);
+    closeSocket(socket, 1011, "Workspace relay failed to process a frame");
+  };
+  const hibernatedRevocationIntervalMs = () => options.hibernatedRevocationCheckIntervalMs ?? HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT;
+  const scheduleHibernatedRevocationCheck = async () => {
+    const intervalMs = hibernatedRevocationIntervalMs();
+    if (!hibernation || !options.alarms || intervalMs <= 0) return;
+    if (clients.size === 0 && ![...hostTunnels.values()].some(fenced)) return;
+    const now = options.now ?? Date.now;
+    const at = now() + intervalMs;
+    try {
+      const existing = await options.alarms.getAlarm();
+      if (typeof existing === "number" && existing > 0 && existing <= at) return;
+      await options.alarms.setAlarm(at);
+    } catch {
+    }
+  };
+  const runHibernatedRevocationCheck = async () => {
+    ensureHibernatedSocketsRebuilt();
+    const now = options.now ?? Date.now;
+    const revoke = (client, reason) => {
+      if (isUserHostedClient(client)) {
+        for (const tunnel of hostTunnels.values()) {
+          if (tunnel.channels.get(client.channelId) !== client) continue;
+          dropUserHostedChannel(tunnel, client.channelId, client, 1008, reason);
+          return;
+        }
+      }
+      closeSocket(client.socket, 1008, reason);
+      clients.delete(client);
+    };
+    for (const client of Array.from(clients)) {
+      if (client.request.claims.exp * 1e3 <= now()) {
+        revoke(client, "Runtime Access Token expired");
+        continue;
+      }
+      if (!options.isRuntimeAccessTokenActive) continue;
+      let active;
+      try {
+        active = await options.isRuntimeAccessTokenActive(client.request.claims);
+      } catch {
+        continue;
+      }
+      if (active.active || resolverUnreachable(active.code)) continue;
+      revoke(client, active.reason);
+    }
+    for (const tunnel of Array.from(hostTunnels.values())) {
+      await recheckHostGeneration(tunnel);
+    }
+    await scheduleHibernatedRevocationCheck();
+  };
   const activeUserHostedClient = (channelId, socket) => {
     for (const tunnel of hostTunnels.values()) {
       const client = tunnel.channels.get(channelId);
       if (client?.socket === socket) return { tunnel, client };
     }
+    return void 0;
   };
   const handleUserHostedClientMessage = async (channelId, socket, data) => {
     const active = activeUserHostedClient(channelId, socket);
@@ -3037,45 +2404,61 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       closeSocket(socket, 1011, "User-hosted workspace is offline");
       return;
     }
-    const frame = socketFrame(data);
+    const frame = await socketFrame(data);
     if (!frame) return;
     const sent = sendSocket(active.tunnel.socket, JSON.stringify({
       type: "ws.frame",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       channel_id: channelId,
       ...frame
     }));
     if (!sent) closeSocket(socket, 1011, "User-hosted tunnel unavailable");
   };
+  const applyRegistrationUpdate = async (tunnel, workspaceIds, token) => {
+    const hostId = tunnel.hostId;
+    const refuse = (code, reason) => {
+      cleanupHostTunnel(hostId, tunnel.socket, reason);
+      closeSocket(tunnel.socket, code, reason);
+    };
+    let claims;
+    try {
+      claims = await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
+    } catch {
+      if (hostTunnels.get(hostId) === tunnel) refuse(1008, "Host tunnel registration update denied");
+      return;
+    }
+    if (hostTunnels.get(hostId) !== tunnel) return;
+    if (hostTunnelIncumbentOutranks(tunnel.generation, claims.generation)) {
+      refuse(1008, "Host tunnel registration update superseded");
+      return;
+    }
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, claims);
+    if (hostTunnels.get(hostId) !== tunnel) return;
+    if (!decision.ok) {
+      refuse(decision.retryable ? 1012 : 1008, decision.retryable ? "Host generation check unavailable" : decision.reason);
+      return;
+    }
+    tunnel.workspaceIds = workspaceIds;
+    tunnel.enrollmentId = claims.enrollment_id;
+    tunnel.generation = claims.generation;
+    tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+    directory.registerHostTunnel({ hostId, workspaceIds });
+    watchHostGeneration(tunnel);
+    void scheduleHibernatedRevocationCheck();
+  };
   const handleTunnelMessage = async (hostId, event) => {
     const row = parseTunnelMessageData(event.data);
     if (!row.ok) return;
-    const parsed = validateTunnelMessage2(row.value);
+    const parsed = validateTunnelMessage(row.value);
     const tunnel = hostTunnels.get(hostId);
     if (!parsed.ok || !tunnel) return;
     directory.recordPong(tunnel.hostId);
     if (parsed.message.type === "ping") {
-      tunnel.socket.send?.(JSON.stringify(makeTunnelPong2(parsed.message)));
+      tunnel.socket.send?.(JSON.stringify(makeTunnelPong(parsed.message)));
       return;
     }
     if (parsed.message.type === "host.registration.update") {
-      const update = parsed.message;
-      const workspaceIds = [...new Set(update.workspace_ids)];
-      try {
-        await verifyHostTunnelToken(update.token, options.runtimeAccessKey, { hostId, workspaceIds });
-      } catch {
-        closeSocket(tunnel.socket, 1008, "Host tunnel registration update denied");
-        return;
-      }
-      if (hostTunnels.get(hostId) !== tunnel) return;
-      tunnel.workspaceIds = workspaceIds;
-      tunnel.socket.serializeAttachment?.({
-        kind: "host-tunnel",
-        hostId,
-        workspaceIds,
-        connectedAt: tunnel.connectedAt
-      });
-      directory.registerHostTunnel({ hostId, workspaceIds });
+      await applyRegistrationUpdate(tunnel, [...new Set(parsed.message.workspace_ids)], parsed.message.token);
       return;
     }
     if (parsed.message.type === "error" && parsed.message.request_id) {
@@ -3145,7 +2528,9 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         closeSocket(channel.socket, 1008, token.reason);
         return;
       }
-      sendSocket(channel.socket, tunnelFrame(message));
+      if (!sendSocket(channel.socket, tunnelFrame(message))) {
+        dropUserHostedChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
+      }
       return;
     }
     if (parsed.message.type === "ws.close") {
@@ -3154,7 +2539,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!channel) return;
       tunnel.channels.delete(message.channel_id);
       clients.delete(channel);
-      closeSocket(channel.socket, safeCloseCode2(message.code), message.reason ?? "");
+      closeSocket(channel.socket, safeCloseCode(message.code), message.reason ?? "");
       return;
     }
     if (parsed.message.type === "error" && parsed.message.channel_id) {
@@ -3190,17 +2575,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       clients.delete(active);
       sendSocket(tunnel.socket, JSON.stringify({
         type: "ws.close",
-        protocol: TUNNEL_PROTOCOL_VERSION2,
+        protocol: TUNNEL_PROTOCOL_VERSION,
         channel_id: channelId,
-        code: safeCloseCode2(event?.code, 1e3),
+        code: safeCloseCode(event?.code, 1e3),
         reason: event?.reason ?? "Client WebSocket closed"
       }));
       return;
     }
   };
   const admitHostTunnel = async (request, roomWorkspaceId, url) => {
-    if (!websocketRequest2(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
-    const hostId = clean(hostIdFromTunnelPath2(url.pathname));
+    if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
+    const hostId = trimToUndefined(hostIdFromTunnelPath(url.pathname));
     if (!hostId) return json("host_tunnel_host_required", "Host tunnel id is required", 400);
     const workspaceIds = workspaceIdsFromSearch(url);
     if (!workspaceIds.includes(roomWorkspaceId)) {
@@ -3208,38 +2593,49 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
     const token = bearerToken(request.headers.get("authorization"));
     if (!token) return json("host_tunnel_token_required", "Host Tunnel Token is required", 401);
+    let claims;
     try {
-      await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
+      claims = await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
     } catch (err) {
       if (err instanceof WorkspaceRelayAuthError) {
         return json(err.code, "Host Tunnel Token was denied", 403);
       }
       throw err;
     }
-    const connectedAt = options.now?.() ?? Date.now();
-    const pair = acceptSocket({
-      kind: "host-tunnel",
-      hostId,
-      workspaceIds,
-      connectedAt
-    });
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, claims);
+    if (!decision.ok) return json(decision.code, decision.reason, decision.retryable ? 503 : 403);
     const previous = hostTunnels.get(hostId);
-    if (previous) {
-      cleanupTunnelResources(previous, "Host tunnel replaced");
-      closeSocket(previous.socket, 1012, "Host tunnel replaced");
+    if (previous && hostTunnelIncumbentOutranks(previous.generation, claims.generation)) {
+      return json("host_generation_superseded", "Host tunnel generation was superseded", 403);
     }
-    hostTunnels.set(hostId, {
+    const connectedAt = options.now?.() ?? Date.now();
+    const fence = {
+      ...claims.enrollment_id ? { enrollmentId: claims.enrollment_id } : {},
+      ...claims.generation !== void 0 ? { generation: claims.generation } : {}
+    };
+    const pair = acceptSocket({ kind: "host-tunnel", hostId, workspaceIds, connectedAt, ...fence });
+    const tunnel = {
       hostId,
       workspaceIds,
       connectedAt,
+      ...fence,
+      generationCheckFailures: 0,
       socket: pair.server,
       pending: /* @__PURE__ */ new Map(),
       channels: /* @__PURE__ */ new Map()
-    });
+    };
+    if (previous) {
+      cleanupTunnelResources(previous, "Host tunnel replaced");
+      closeSocket(previous.socket, 1012, "Host tunnel replaced");
+    }
+    hostTunnels.set(hostId, tunnel);
     directory.registerHostTunnel({ hostId, workspaceIds });
+    watchHostGeneration(tunnel);
+    void scheduleHibernatedRevocationCheck();
     if (!hibernation) {
       pair.server.addEventListener?.("message", (event) => {
-        if (event && event.data !== void 0) void handleTunnelMessage(hostId, { data: event.data });
+        if (!event || event.data === void 0) return;
+        void handleTunnelMessage(hostId, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
       pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
@@ -3247,14 +2643,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     return upgradeResponse(pair.client, request);
   };
   const admitClient = async (request, workspaceId) => {
-    if (!websocketRequest2(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
+    if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
     const authorized = await authorizeWorkspaceRelayRequest(relayOptions, request, workspaceId);
     if (!authorized.ok) return authorized.response;
-    if (authorized.request.target.access !== "cloud") return admitUserHostedClient(request, authorized.request);
+    if (isUserHostedTarget(authorized.request.target)) return admitUserHostedClient(request, authorized.request);
     return await admitCloudClient(request, authorized.request);
   };
   const admitCloudClient = async (request, authorized) => {
-    const trace = relayWebSocketTraceEnabled2(request) ? { upstreamStartedAt: performance.now(), queueTimes: [], emitted: false } : void 0;
+    const trace = relayWebSocketTraceEnabled(request) ? { upstreamStartedAt: performance.now(), queueTimes: [], emitted: false } : void 0;
     let upstream;
     try {
       upstream = await connectWebSocket(
@@ -3282,14 +2678,15 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     let closed = false;
     let upstreamOpen = upstream.readyState === void 0 || upstream.readyState === 1;
     const queue = [];
+    let queuedBytes = 0;
     const emitTrace = (openedAt) => {
       if (!trace || trace.emitted) return;
       trace.emitted = true;
       sendSocket(pair.server, JSON.stringify({
         type: "relay.trace",
-        wsUpstreamOpenMs: roundedMs3(openedAt - trace.upstreamStartedAt),
+        wsUpstreamOpenMs: roundedMs2(openedAt - trace.upstreamStartedAt),
         queuedFrames: trace.queueTimes.length,
-        maxQueuedDelayMs: roundedMs3(trace.queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
+        maxQueuedDelayMs: roundedMs2(trace.queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
       }));
     };
     const activeTokenTimer = watchRuntimeAccessToken(client, (reason) => {
@@ -3300,18 +2697,19 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(upstream, safeCloseCode2(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
+      closeSocket(upstream, safeCloseCode(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
     };
     const cleanupUpstream = (event) => {
       if (closed) return;
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(pair.server, safeCloseCode2(event?.code), event?.reason ?? "");
+      closeSocket(pair.server, safeCloseCode(event?.code), event?.reason ?? "");
     };
     const flushQueue = () => {
       upstreamOpen = true;
       if (trace) emitTrace(performance.now());
+      queuedBytes = 0;
       for (const item of queue.splice(0)) {
         if (!sendSocket(upstream, item)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket connection failed");
@@ -3319,28 +2717,31 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         }
       }
     };
-    pair.server.addEventListener?.("message", (event) => {
-      const payload = socketPayload(event?.data);
-      if (payload === void 0) return;
+    const deliverClientFrame = orderedFrameDelivery((payload) => {
       if (!upstreamOpen) {
-        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2)) {
+        const frameBytes = preOpenFrameBytes(payload);
+        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) && queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket queue limit exceeded");
           cleanupClient({ code: 1011, reason: "Upstream WebSocket queue limit exceeded" });
           return;
         }
+        queuedBytes += frameBytes;
         if (trace) trace.queueTimes.push(performance.now());
         queue.push(payload);
         return;
       }
       if (!sendSocket(upstream, payload)) closeSocket(pair.server, 1011, "Upstream WebSocket connection failed");
     });
+    pair.server.addEventListener?.("message", (event) => deliverClientFrame(event?.data));
     pair.server.addEventListener?.("close", cleanupClient);
     pair.server.addEventListener?.("error", cleanupClient);
     upstream.addEventListener?.("open", flushQueue);
-    upstream.addEventListener?.("message", (event) => {
-      const payload = socketPayload(event?.data);
-      if (payload !== void 0) sendSocket(pair.server, payload);
+    const deliverUpstreamFrame = orderedFrameDelivery((payload) => {
+      if (!sendSocket(pair.server, payload)) {
+        closeSocket(pair.server, 1011, "Client WebSocket send failed");
+      }
     });
+    upstream.addEventListener?.("message", (event) => deliverUpstreamFrame(event?.data));
     upstream.addEventListener?.("close", cleanupUpstream);
     upstream.addEventListener?.("error", () => cleanupUpstream({ code: 1011, reason: "Upstream WebSocket connection failed" }));
     if (trace && upstreamOpen) emitTrace(upstreamConnectedAt);
@@ -3376,6 +2777,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTargetTimer = hibernation ? void 0 : watchUserHostedTarget(client, (reason) => {
       closeSocket(pair.server, 1011, reason);
     });
+    if (hibernation) void scheduleHibernatedRevocationCheck();
     if (!hibernation) {
       const cleanup = (event) => {
         if (activeTokenTimer) clearInterval(activeTokenTimer);
@@ -3384,14 +2786,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       };
       pair.server.addEventListener?.("message", (event) => {
         if (!event) return;
-        void handleUserHostedClientMessage(channelId, pair.server, event.data);
+        void handleUserHostedClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", cleanup);
       pair.server.addEventListener?.("error", cleanup);
     }
-    sendSocket(tunnel.socket, JSON.stringify({
+    const opened = sendSocket(tunnel.socket, JSON.stringify({
       type: "ws.open",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       channel_id: channelId,
       workspace_id: authorized.target.workspaceId,
       path: authorized.path,
@@ -3402,6 +2804,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         { userHosted: true }
       ))
     }));
+    if (!opened) {
+      tunnel.channels.delete(channelId);
+      clients.delete(client);
+      closeSocket(pair.server, 1011, "User-hosted tunnel unavailable");
+      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+    }
     return upgradeResponse(pair.client, request);
   };
   const forwardCloudHttp = async (request, workspaceId, trace) => {
@@ -3413,7 +2821,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       })
     );
     if (!authorized.ok) return authorized.response;
-    if (authorized.request.target.access !== "cloud") {
+    if (isUserHostedTarget(authorized.request.target)) {
       trace && (trace.routeKind = "user-hosted-http");
       return forwardUserHostedHttp(request, authorized.request, trace);
     }
@@ -3463,7 +2871,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const init = workspaceRelayForwardRequestInit(request, authorized.relayHostToken, authorized.target.workspaceId, {
       userHosted: true
     });
-    const bodyMaxBytes = options.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT2;
+    const bodyMaxBytes = options.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT;
     const contentLength = Number(request.headers.get("content-length") ?? Number.NaN);
     if (Number.isFinite(contentLength) && contentLength > bodyMaxBytes) {
       return json("request_body_too_large", "User-hosted request body exceeds the relay limit", 413);
@@ -3478,7 +2886,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         tunnel.pending.delete(requestId);
         tunnel.socket.send?.(JSON.stringify({
           type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION2,
+          protocol: TUNNEL_PROTOCOL_VERSION,
           request_id: requestId,
           paused: false,
           reason: "closed"
@@ -3495,7 +2903,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     });
     tunnel.socket.send?.(JSON.stringify({
       type: "http.request",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       request_id: requestId,
       workspace_id: authorized.target.workspaceId,
       method: request.method,
@@ -3542,7 +2950,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!roomWorkspaceId) return json("relay_workspace_required", "Workspace Relay requests must include a workspace id", 400);
       if (url.pathname.startsWith("/host-tunnels/")) return admitHostTunnel(request, roomWorkspaceId, url);
       if (url.pathname.startsWith("/workspaces/")) {
-        if (websocketRequest2(request)) return admitClient(request, roomWorkspaceId);
+        if (websocketRequest(request)) return admitClient(request, roomWorkspaceId);
         const trace = traceRequest(request, "workspace-http", options);
         const roomTotalStartedAt = performance.now();
         const nextRequest = tracedRequest(request, trace);
@@ -3555,14 +2963,29 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       return json("relay_route_not_found", "Workspace Relay route not found", 404);
     },
     async webSocketMessage(socket, message) {
-      ensureHibernatedSocketsRebuilt();
-      const attachment = socketAttachment(socket);
-      if (!attachment) return;
-      if (attachment.kind === "host-tunnel") {
-        await handleTunnelMessage(attachment.hostId, { data: message });
-        return;
+      try {
+        ensureHibernatedSocketsRebuilt();
+        const attachment = socketAttachment(socket);
+        if (!attachment) return;
+        if (attachment.kind === "host-tunnel") {
+          await handleTunnelMessage(attachment.hostId, { data: message });
+          return;
+        }
+        await handleUserHostedClientMessage(attachment.channelId, socket, message);
+      } catch (err) {
+        reportFrameHandlerFailure(socket, err);
+      }
+    },
+    /**
+     * Durable Object alarm entry point. Runs the hibernation-safe revocation
+     * sweep. The Worker must forward `alarm()` here.
+     */
+    async alarm() {
+      try {
+        await runHibernatedRevocationCheck();
+      } catch (err) {
+        console.error(`[workspace-relay] revocation alarm failed: ${err instanceof Error ? err.message : String(err)}`);
       }
-      await handleUserHostedClientMessage(attachment.channelId, socket, message);
     },
     webSocketClose(socket, code, reason) {
       ensureHibernatedSocketsRebuilt();
@@ -3599,30 +3022,47 @@ function createWorkspaceRelayDurableObjectRoom(options) {
 export {
   DEFAULT_RELAY_APP_ORIGINS,
   DEFAULT_RELAY_LOCATION_HINT,
+  RELAY_ALLOWED_REQUEST_HEADERS,
+  RELAY_ALLOWED_REQUEST_HEADER_LIST,
+  RELAY_LOCATION_HINTS,
+  RELAY_REGION_HEADER,
   WorkspaceRelayAuthError,
-  __slowConsumerInternalsForTest,
   authorizeWorkspaceRelayRequest,
+  bytesToBase64,
+  checkHostTunnelGeneration,
+  createCachedHostGenerationClient,
   createCachedRevocationClient,
   createCachedTargetClient,
+  createHostGenerationResolverLookup,
   createOriginMatcher,
   createWorkspaceRelay,
-  createWorkspaceRelayBun,
   createWorkspaceRelayDirectory,
   createWorkspaceRelayDurableObjectGateway,
   createWorkspaceRelayDurableObjectRoom,
   createWorkspaceRelayTrace,
+  deriveRelayHostKid,
+  deriveRelayHostPublicKey,
   disposeAuditSampler,
   disposeWorkspaceRelayDirectory,
   forwardWorkspaceRelayRequest,
   getAuditSuppressedCount,
+  hostTunnelIncumbentOutranks,
   hostTunnelTokenAudience,
+  isHostGeneration,
   isRelayClaimPair,
   mintHostTunnelToken,
   mintRelayHostToken,
   mintRuntimeAccessToken,
   parseAllowedOrigins,
+  parseHostGenerationResult,
+  parseRuntimeAccessTokenActiveResult,
+  parseWorkspaceRelayTarget,
+  relayFrameDiagnostics,
   relayHostTokenAudience,
   relayHostTokenIssuer,
+  relayLocationHint,
+  relayRequestCountry,
+  relayRequestRegion,
   runtimeAccessTokenAudience,
   runtimeAccessTokenIssuer,
   setWorkspaceRelayAllowedOrigins,