@claxedo/workspace-relay 0.7.0 → 0.10.0

package/dist/index.mjs

@@ -1,11 +1,39 @@
 // src/auth.ts
-import { SignJWT, errors, jwtVerify } from "jose";
+import { SignJWT, errors, exportJWK, importJWK, jwtVerify } from "jose";
+
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function asFiniteNumber(value) {
+  return isFiniteNumber(value) ? value : void 0;
+}
+function numberClaim(payload, key) {
+  return asFiniteNumber(payload[key]);
+}
+
+// src/auth.ts
+import { CURRENT_CHANNEL_IDENTITY_VERSION } from "@claxedo/workspace-relay-protocol";
 var algorithms = ["EdDSA", "ES256", "RS256"];
 var runtimeAccessTokenIssuer = "claxedo-control-plane";
 var runtimeAccessTokenAudience = "workspace-relay";
 var hostTunnelTokenAudience = "workspace-relay-host-tunnel";
 var relayHostTokenIssuer = "workspace-relay";
 var relayHostTokenAudience = "workspace-host-service";
+var RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS = 1789948800;
+function toChannelIdentityClaim(input) {
+  return {
+    channel: input.channel,
+    external_user_id: input.externalUserId,
+    identity_version: input.identityVersion
+  };
+}
 var WorkspaceRelayAuthError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -19,27 +47,84 @@ function seconds(input = Date.now()) {
   return Math.floor(input / 1e3);
 }
 function requireAlgorithm(input) {
-  if (algorithms.includes(input)) return input;
+  const algorithm = algorithms.find((candidate) => candidate === input);
+  if (algorithm) return algorithm;
   throw new WorkspaceRelayAuthError("invalid_relay_token", "Unsupported relay token algorithm");
 }
 function stringClaim(payload, key) {
   const value = payload[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function numberClaim(payload, key) {
-  const value = payload[key];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function stringArrayClaim(payload, key) {
   const value = payload[key];
   return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value : void 0;
 }
+function isHostGeneration(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function hostGenerationClaims(payload) {
+  const enrollment_id = stringClaim(payload, "enrollment_id");
+  const generation = payload.generation;
+  if (!isHostGeneration(generation) || !enrollment_id) return null;
+  return { enrollment_id, generation };
+}
 function roleClaim(payload) {
   const value = stringClaim(payload, "role");
   return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
 }
-function isRelayClaimPair(input) {
-  return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
+function actorProfileClaims(payload) {
+  const actor_public_id = stringClaim(payload, "actor_public_id");
+  const actor_name = stringClaim(payload, "actor_name");
+  const actor_avatar_url = stringClaim(payload, "actor_avatar_url");
+  if (!actor_public_id && !actor_name && !actor_avatar_url) return {};
+  if (!actor_public_id || !actor_name) return void 0;
+  return { actor_public_id, actor_name, ...actor_avatar_url ? { actor_avatar_url } : {} };
+}
+function actorProfilePayload(input) {
+  if (!input.actorPublicId && !input.actorName && !input.actorAvatarUrl) return {};
+  if (!input.actorPublicId || !input.actorName) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Actor display profile claims are incomplete");
+  }
+  return {
+    actor_public_id: input.actorPublicId,
+    actor_name: input.actorName,
+    ...input.actorAvatarUrl ? { actor_avatar_url: input.actorAvatarUrl } : {}
+  };
+}
+function channelIdentityPayload(input) {
+  return input.channelIdentity ? { channel_identity: toChannelIdentityClaim(input.channelIdentity) } : {};
+}
+function channelIdentityClaims(payload) {
+  const value = payload.channel_identity;
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Channel provenance claim is not a claims object");
+  }
+  const claim = value;
+  const channel = stringClaim(claim, "channel");
+  const external_user_id = stringClaim(claim, "external_user_id");
+  const identity_version = numberClaim(claim, "identity_version");
+  if (!channel || !external_user_id || identity_version === void 0 || !Number.isInteger(identity_version)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Channel provenance claim is incomplete");
+  }
+  if (identity_version < CURRENT_CHANNEL_IDENTITY_VERSION) {
+    throw new WorkspaceRelayAuthError(
+      "relay_token_claims_invalid",
+      "Channel provenance claim predates the current channel identity version"
+    );
+  }
+  return { channel, external_user_id, identity_version };
+}
+function checkIssuedAtFloor(iat) {
+  if (iat < RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS) {
+    throw new WorkspaceRelayAuthError(
+      "relay_token_claims_invalid",
+      "Runtime Access Token was issued before the channel provenance floor"
+    );
+  }
+}
+function isRelayBacking(input) {
+  return input === "cloud-vm" || input === "local-worktree" || input === "durable-object";
 }
 function checkHostTunnelTarget(payload, expected) {
   if (stringClaim(payload, "host_id") !== expected.hostId) {
@@ -58,6 +143,21 @@ function checkTarget(payload, expected) {
     throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
   }
 }
+async function deriveRelayHostPublicKey(privateKey) {
+  const jwk = await exportJWK(privateKey);
+  const imported = await importJWK({ kty: jwk.kty, crv: jwk.crv, x: jwk.x }, "EdDSA", { extractable: true });
+  if (imported instanceof Uint8Array) {
+    throw new Error("Relay host public key imported as raw bytes; expected an EdDSA public key");
+  }
+  return imported;
+}
+async function deriveRelayHostKid(publicKey) {
+  const jwk = await exportJWK(publicKey);
+  const material = jwk.x ?? jwk.n ?? "";
+  if (!material) throw new Error("Cannot derive kid: public key has no public component");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(material));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
 async function verifyJwt(token, key, input) {
   try {
     if (typeof key === "function") {
@@ -83,11 +183,20 @@ async function verifyJwt(token, key, input) {
 async function mintRuntimeAccessToken(input, key, alg) {
   const now = seconds(input.now);
   return await new SignJWT({
+    principal_kind: input.principalKind,
+    actor_id: input.actorId,
+    ...input.userId ? { user_id: input.userId } : {},
+    actor_kind: input.actorKind,
+    ...actorProfilePayload(input),
+    ...channelIdentityPayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
-    role: input.role
-  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
+    role: input.role,
+    ...tokenScopePayload(input.sessionId),
+    ...input.purpose ? { purpose: input.purpose } : {},
+    ...input.routingId !== void 0 ? { routing_id: input.routingId } : {}
+  }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyRuntimeAccessToken(token, key, expected) {
   const result = await verifyJwt(token, key, {
@@ -99,8 +208,27 @@ async function verifyRuntimeAccessToken(token, key, expected) {
   if (!claims) {
     throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
   }
+  checkIssuedAtFloor(claims.iat);
   return claims;
 }
+var TOKEN_CLAIMS_CLOCK_SKEW_SECONDS = 60;
+var TOKEN_CLAIMS_MAX_LIFETIME_SECONDS = 24 * 60 * 60;
+function checkTokenTimeClaims(payload, exp, tokenName) {
+  const now = seconds();
+  if (exp <= now - TOKEN_CLAIMS_CLOCK_SKEW_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} is expired`);
+  }
+  const nbf = numberClaim(payload, "nbf");
+  if (payload.nbf !== void 0 && nbf === void 0) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} nbf claim is not a finite number`);
+  }
+  if (nbf !== void 0 && nbf > now + TOKEN_CLAIMS_CLOCK_SKEW_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} is not yet valid`);
+  }
+  if (exp > now + TOKEN_CLAIMS_MAX_LIFETIME_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} lifetime exceeds the relay maximum`);
+  }
+}
 function validateRuntimeAccessTokenClaims(input, expected) {
   const payload = input;
   if (stringClaim(payload, "iss") !== runtimeAccessTokenIssuer || stringClaim(payload, "aud") !== runtimeAccessTokenAudience) {
@@ -111,13 +239,20 @@ function validateRuntimeAccessTokenClaims(input, expected) {
   if (!claims) {
     throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
   }
+  checkIssuedAtFloor(claims.iat);
+  checkTokenTimeClaims(payload, claims.exp, "Runtime Access Token");
   return claims;
 }
 async function mintHostTunnelToken(input, key, alg) {
   const now = seconds(input.now);
+  if (!isHostGeneration(input.generation) || !input.enrollmentId?.trim()) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Host Tunnel Token generation requires a non-negative integer and an enrollment id");
+  }
   return await new SignJWT({
     host_id: input.hostId,
-    workspace_ids: input.workspaceIds
+    workspace_ids: input.workspaceIds,
+    enrollment_id: input.enrollmentId,
+    generation: input.generation
   }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(hostTunnelTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 5 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyHostTunnelToken(token, key, expected) {
@@ -132,21 +267,54 @@ async function verifyHostTunnelToken(token, key, expected) {
   }
   return claims;
 }
+function relayHostInputFromRuntimeClaims(claims) {
+  return {
+    principalKind: claims.principal_kind,
+    actorId: claims.actor_id,
+    ...claims.user_id ? { userId: claims.user_id } : {},
+    actorKind: claims.actor_kind,
+    parentJti: claims.jti,
+    ...claims.actor_public_id && claims.actor_name ? {
+      actorPublicId: claims.actor_public_id,
+      actorName: claims.actor_name,
+      ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+    } : {},
+    ...claims.channel_identity ? {
+      channelIdentity: {
+        channel: claims.channel_identity.channel,
+        externalUserId: claims.channel_identity.external_user_id,
+        identityVersion: claims.channel_identity.identity_version
+      }
+    } : {},
+    orgId: claims.org_id,
+    role: claims.role,
+    ...claims.session_id ? { sessionId: claims.session_id } : {},
+    ...claims.purpose ? { purpose: claims.purpose } : {}
+  };
+}
 async function mintRelayHostToken(input, key, alg) {
-  if (!isRelayClaimPair(input)) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token access/backing claims are inconsistent");
+  if (!isRelayBacking(input.backing)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token backing claim is not a placement");
   }
   const now = seconds(input.now);
   const protectedHeader = { alg: requireAlgorithm(alg) };
   if (input.kid) protectedHeader.kid = input.kid;
   return await new SignJWT({
+    principal_kind: input.principalKind,
+    actor_id: input.actorId,
+    ...input.userId ? { user_id: input.userId } : {},
+    actor_kind: input.actorKind,
+    ...actorProfilePayload(input),
+    ...channelIdentityPayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
     role: input.role,
-    access: input.access,
-    backing: input.backing
-  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
+    ...tokenScopePayload(input.sessionId),
+    ...input.purpose ? { purpose: input.purpose } : {},
+    backing: input.backing,
+    parent_jti: input.parentJti
+  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyRelayHostToken(token, key, expected) {
   const result = await verifyJwt(token, key, {
@@ -163,41 +331,72 @@ async function verifyRelayHostToken(token, key, expected) {
 function runtimeClaims(payload) {
   const exp = numberClaim(payload, "exp");
   const iat = numberClaim(payload, "iat");
-  const sub = stringClaim(payload, "sub");
+  const principal_kind = stringClaim(payload, "principal_kind");
+  const actor_id = stringClaim(payload, "actor_id");
+  const user_id = stringClaim(payload, "user_id");
+  const actor_kind = stringClaim(payload, "actor_kind");
   const jti2 = stringClaim(payload, "jti");
   const org_id = stringClaim(payload, "org_id");
   const workspace_id = stringClaim(payload, "workspace_id");
   const host_id = stringClaim(payload, "host_id");
   const role = roleClaim(payload);
-  if (!exp || !iat || !sub || !jti2 || !org_id || !workspace_id || !host_id || !role) return;
+  const reach = tokenScopeClaims(payload);
+  const purpose = tokenPurposeClaims(payload);
+  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || !reach || !purpose || payload.user_id !== void 0 && !user_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
+  const actorProfile = actorProfileClaims(payload);
+  if (!actorProfile) return void 0;
+  const channel_identity = channelIdentityClaims(payload);
+  const routing_id = stringClaim(payload, "routing_id");
   return {
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience,
-    sub,
+    principal_kind,
+    actor_id,
+    ...user_id ? { user_id } : {},
+    actor_kind,
+    ...actorProfile,
+    ...channel_identity ? { channel_identity } : {},
+    ...routing_id !== void 0 ? { routing_id } : {},
     org_id,
     workspace_id,
     host_id,
     role,
+    ...reach,
+    ...purpose,
     exp,
     iat,
     jti: jti2
   };
 }
+function tokenScopePayload(sessionId) {
+  return sessionId === void 0 ? { scope: "workspace" } : { scope: "session", session_id: sessionId };
+}
+function tokenPurposeClaims(payload) {
+  if (payload.purpose === void 0) return {};
+  return payload.purpose === "turn-execution" ? { purpose: payload.purpose } : void 0;
+}
+function tokenScopeClaims(payload) {
+  const sessionId = stringClaim(payload, "session_id");
+  if (payload.scope === "workspace" && payload.session_id === void 0) return { scope: "workspace" };
+  if (payload.scope === "session" && sessionId) return { scope: "session", session_id: sessionId };
+  return void 0;
+}
 function relayHostClaims(payload) {
   const base = runtimeClaims({
     ...payload,
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience
   });
-  const access = stringClaim(payload, "access");
+  if (payload.access !== void 0) return void 0;
   const backing = stringClaim(payload, "backing");
-  const pair = { access, backing };
-  if (!base || !isRelayClaimPair(pair)) return;
+  const parent_jti = stringClaim(payload, "parent_jti");
+  if (!base || !parent_jti || !isRelayBacking(backing)) return void 0;
   return {
     ...base,
     iss: relayHostTokenIssuer,
     aud: relayHostTokenAudience,
-    ...pair
+    parent_jti,
+    backing
   };
 }
 function hostTunnelClaims(payload) {
@@ -207,151 +406,309 @@ function hostTunnelClaims(payload) {
   const jti2 = stringClaim(payload, "jti");
   const host_id = stringClaim(payload, "host_id");
   const workspace_ids = stringArrayClaim(payload, "workspace_ids");
-  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length) return;
+  const fence = hostGenerationClaims(payload);
+  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length || fence === null) return void 0;
   return {
     iss: runtimeAccessTokenIssuer,
     aud: hostTunnelTokenAudience,
     sub,
     host_id,
     workspace_ids,
+    ...fence,
     exp,
     iat,
     jti: jti2
   };
 }
 
-// src/bun.ts
+// ../claxedo-helpers/dist/api-error.mjs
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord2(value) {
+  return isRecord2(value) ? value : void 0;
+}
+var PUBLIC_API_ERRORS = {
+  repository_provider_unauthorized: { status: 502, message: "Repository provider refused authorization" },
+  repository_provider_unavailable: { status: 502, message: "Repository provider is unavailable" },
+  host_tunnel_timeout: { status: 503, retryable: true, message: "Host tunnel timed out" },
+  host_tunnel_response_body_too_large: { status: 413, message: "Host tunnel response body exceeds the relay limit" },
+  host_tunnel_unavailable: { status: 503, retryable: true, message: "Host tunnel is unavailable" },
+  workspace_checkpoint_unavailable: { status: 503, retryable: true, message: "Workspace checkpoint is unavailable" },
+  workspace_checkpoint_conflict: { status: 409, message: "Workspace checkpoint conflicted" },
+  invalid_input: { family: "access", status: 400, message: "The request names an invalid value" },
+  organization_policy_denied: { family: "access", status: 403, message: "Organization creation is disabled for this deployment" },
+  org_admin_required: { family: "access", status: 403, message: "Organization administrator authority is required" },
+  org_owner_required: { family: "access", status: 403, message: "Only an organization owner may grant, change or remove the owner role" },
+  org_owner_protected: { family: "access", status: 409, message: "The organization's founding owner cannot be removed or demoted" },
+  team_member_org_membership_required: { family: "access", status: 403, message: "The team member must belong to the team organization" },
+  project_member_org_membership_required: { family: "access", status: 403, message: "The project member must belong to the project organization" },
+  org_membership_required: { family: "access", status: 403, message: "Organization membership is required" },
+  project_admin_required: { family: "access", status: 403, message: "Project administrator authority is required" },
+  team_not_allowed_on_personal_org: { family: "access", status: 400, message: "Personal organizations cannot contain teams" },
+  team_member_target_required: { family: "access", status: 400, message: "Exactly one team member target is required" },
+  org_invitation_invalid: { family: "access", status: 409, message: "Invitation is invalid or unavailable" },
+  org_invitation_pending: { family: "access", status: 409, message: "An invitation to this address is already pending" },
+  org_invitation_rate_limited: { family: "access", status: 429, message: "Organization invitation limit exceeded" },
+  org_invitation_email_mismatch: { family: "access", status: 403, message: "Sign in with the invited verified email address" },
+  org_invitation_delivery_unavailable: { family: "access", status: 503, message: "Invitation delivery is unavailable" },
+  team_not_found: { family: "access", status: 404, message: "Team not found" },
+  team_member_not_found: { family: "access", status: 404, message: "Team member not found" },
+  org_member_not_found: { family: "access", status: 404, message: "Organization member not found" },
+  project_not_found: { family: "access", status: 404, message: "Project not found" },
+  project_member_not_found: { family: "access", status: 404, message: "Project member not found" },
+  project_member_owner_immutable: { family: "access", status: 409, message: "The project owner's access cannot be changed" },
+  resource_conflict: { family: "access", status: 409, message: "Organization or team authority changed concurrently" },
+  session_not_found: { family: "session_share", status: 404, message: "This session is not on the control plane, so it cannot be shared from People yet." },
+  session_share_admin_required: { family: "session_share", status: 403, message: "Only the person who started this session can manage its People." },
+  session_share_target_required: { family: "session_share", status: 400, message: "A session is shared with exactly one person" },
+  session_share_target_not_found: { family: "session_share", status: 404, message: "That person was not found in this organization." },
+  session_share_level_invalid: { family: "session_share", status: 400, message: "A share level is either follow or send." },
+  workspace_backing_conflict: { status: 409, message: "Workspace is provisioned in the cloud and cannot be placed on a machine" },
+  invalid_session_list_cursor: { status: 400, message: "Session list cursor does not match this query" },
+  BAD_REQUEST: { status: 400, message: "Invalid request" },
+  INTERNAL_SERVER_ERROR: { status: 500, message: "Internal error" },
+  CONTROL_PLANE_UNAVAILABLE: { status: 503, message: "Control Plane services are not configured" },
+  credential_verification_unsupported: { status: 400, message: "Credential provider does not support verification" },
+  credential_shape_invalid: { status: 400, message: "Credential secret has an unsupported shape" },
+  credential_provider_unavailable: { status: 502, retryable: true, message: "Credential provider request failed" },
+  credential_verification_failed: { status: 502, message: "Credential provider verification failed" },
+  credential_redirect_denied: { status: 502, message: "Sandbox provider redirects are not allowed" },
+  credential_endpoint_invalid: { status: 400, message: "Invalid credential provider endpoint" },
+  host_attestation_denied: { status: 403, message: "host_attestation_denied" },
+  signature_replayed: { status: 409, message: "signature_replayed" },
+  host_enrollment_not_found: { status: 404, message: "host_enrollment_not_found" },
+  enrollment_revoked: { status: 403, message: "enrollment_revoked" },
+  enrollment_paused: { status: 403, message: "enrollment_paused" },
+  enrollment_owner_ineligible: { status: 403, message: "enrollment_owner_ineligible" },
+  enrollment_key_version_mismatch: { status: 403, message: "enrollment_key_version_mismatch" },
+  invitation_invalid: { status: 403, message: "invitation_invalid" },
+  invitation_expired: { status: 410, message: "invitation_expired" },
+  invitation_revoked: { status: 410, message: "invitation_revoked" },
+  invitation_redeemed: { status: 409, message: "invitation_redeemed" },
+  invitation_host_conflict: { status: 409, message: "invitation_host_conflict" },
+  enrollment_generation_superseded: { status: 409, message: "enrollment_generation_superseded" },
+  host_assignment_outside_scope: { status: 400, message: "host_assignment_outside_scope" },
+  host_sealing_key_undeclared: { status: 409, message: "host_sealing_key_undeclared" },
+  host_provider_config_revision_stale: { status: 409, message: "host_provider_config_revision_stale" },
+  identity_conflict: { status: 409, message: "identity_conflict" },
+  registration_transition_denied: { status: 403, message: "registration_transition_denied" },
+  session_reservation_spent: { status: 409, message: "This session's create was undone; reserve it again to retry" },
+  actor_authorization_denied: { status: 403, message: "actor_authorization_denied" }
+};
+function encodeApiError(error, defaults = {}) {
+  const row = asRecord2(error);
+  return {
+    error: {
+      code: typeof row?.code === "string" && row.code ? row.code : defaults.code ?? "internal_error",
+      message: typeof row?.message === "string" && row.message ? row.message : defaults.message ?? "Internal error",
+      retryable: row?.retryable === true
+    }
+  };
+}
+function publicApiErrorShape(code) {
+  const entry = PUBLIC_API_ERRORS[code];
+  return { status: entry.status, retryable: entry.retryable === true };
+}
+function publicApiFailure(code, message = PUBLIC_API_ERRORS[code].message) {
+  return Object.assign(new Error(message), { code, ...publicApiErrorShape(code) });
+}
+
+// src/host-tunnel-failure.ts
+function hostTunnelFailure(code) {
+  return publicApiFailure(code);
+}
+function hostTunnelFailureResponse(error) {
+  const code = asRecord(error)?.code;
+  const failure = hostTunnelFailure(code === "host_tunnel_timeout" || code === "host_tunnel_response_body_too_large" ? code : "host_tunnel_unavailable");
+  return Response.json(encodeApiError(failure), { status: failure.status });
+}
+
+// src/cloudflare.ts
+import { trimToUndefined as trimToUndefined4 } from "@claxedo/helpers/string";
+
+// src/http.ts
+import { bearerToken, trimToUndefined } from "@claxedo/helpers/string";
+function errorBody(code, message) {
+  return {
+    error: {
+      code,
+      message
+    }
+  };
+}
+function hostIdFromTunnelPath(pathname) {
+  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
+}
+function workspaceIdsFromSearch(url) {
+  return [...new Set([
+    ...url.searchParams.getAll("workspaceId"),
+    ...url.searchParams.getAll("workspace_id")
+  ].map(trimToUndefined).filter((item) => !!item))];
+}
+
+// src/cloudflare.ts
 import {
-  makeTunnelPing,
   makeTunnelPong,
   TUNNEL_PROTOCOL_VERSION,
   validateTunnelMessage
 } from "@claxedo/workspace-relay-protocol";
 
 // src/server.ts
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { exportJWK } from "jose";
+import { sessionScopeReaches } from "@claxedo/workspace-relay-protocol";
 
-// src/cors-origins.ts
-var DEFAULT_RELAY_APP_ORIGINS = [
-  "http://localhost:*",
-  "http://127.0.0.1:*",
-  "https://claxedo.com",
-  "https://*.claxedo.com"
-];
-function parseAllowedOrigins(raw) {
-  const entries = (raw ?? "").split(",").map((item) => item.trim()).filter(Boolean);
-  return entries.length ? entries : void 0;
+// src/host-tunnel-forwarding.ts
+function isHostTunnelTarget(target) {
+  return target.backing === "local-worktree";
 }
-function createOriginMatcher(patterns) {
-  const exact = /* @__PURE__ */ new Set();
-  const httpsSuffixes = [];
-  const httpPortPrefixes = [];
-  for (const pattern of patterns) {
-    if (pattern.startsWith("https://*.")) {
-      httpsSuffixes.push(pattern.slice("https://*".length));
-    } else if (pattern.startsWith("http://") && pattern.endsWith(":*")) {
-      httpPortPrefixes.push(pattern.slice(0, -1));
-    } else {
-      exact.add(pattern);
-    }
-  }
-  return (origin) => {
-    if (exact.has(origin)) return true;
-    if (origin.startsWith("https://")) {
-      return httpsSuffixes.some(
-        (suffix) => origin.endsWith(suffix) && origin.length > "https://".length + suffix.length
-      );
-    }
-    if (origin.startsWith("http://")) {
-      return httpPortPrefixes.some(
-        (prefix) => origin.startsWith(prefix) && /^\d+$/.test(origin.slice(prefix.length))
-      );
-    }
-    return false;
+
+// src/relay-target.ts
+function parseWorkspaceRelayTarget(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  const { workspaceId, hostId, baseUrl } = row;
+  if (typeof workspaceId !== "string" || typeof hostId !== "string" || typeof baseUrl !== "string") return void 0;
+  if (row.access !== void 0) return void 0;
+  if (!isRelayBacking(row.backing)) return void 0;
+  if (!isAllowedRelayTargetBaseUrl({ baseUrl, backing: row.backing })) return void 0;
+  return {
+    workspaceId,
+    hostId,
+    baseUrl,
+    backing: row.backing
   };
 }
+function parseAbsoluteHttpUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return void 0;
+  }
+  return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+}
+function isLoopbackTargetHostname(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host === "[::1]" || host.endsWith(".localhost")) return true;
+  const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  return !!ipv4 && ipv4.slice(1).every((octet) => Number(octet) <= 255);
+}
+function isAllowedRelayTargetBaseUrl(target) {
+  if (target.backing === "durable-object") return target.baseUrl === "";
+  if (isHostTunnelTarget(target)) {
+    if (target.baseUrl === "") return true;
+    return parseAbsoluteHttpUrl(target.baseUrl) !== void 0;
+  }
+  const url = parseAbsoluteHttpUrl(target.baseUrl);
+  if (!url) return false;
+  return url.protocol === "https:" || isLoopbackTargetHostname(url.hostname);
+}
 
-// src/http.ts
-function bearerToken(header) {
-  if (!header) return;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  return match?.[1]?.trim() || void 0;
+// src/relay-audit.ts
+var auditSamplers = /* @__PURE__ */ new WeakMap();
+function getOrCreateAuditSampler(options) {
+  let state = auditSamplers.get(options);
+  if (!state) {
+    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
+    state = {
+      suppressedCount: 0,
+      timer: void 0,
+      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
+      random: options.random ?? Math.random,
+      sampleRate
+    };
+    auditSamplers.set(options, state);
+  }
+  return state;
 }
-function errorBody(code, message) {
-  return {
-    error: {
-      code,
-      message
+function clampSampleRate(rate) {
+  if (rate === void 0) return 1;
+  if (!Number.isFinite(rate)) return 1;
+  if (rate < 0) return 0;
+  if (rate > 1) return 1;
+  return rate;
+}
+function ensureFlushTimer(options, state) {
+  if (state.timer) return;
+  if (state.sampleRate >= 1) return;
+  if (state.flushIntervalMs <= 0) return;
+  const timer = setInterval(() => {
+    flushSuppressedSummary(options, state);
+  }, state.flushIntervalMs);
+  if (typeof timer.unref === "function") {
+    timer.unref();
+  }
+  state.timer = timer;
+}
+function flushSuppressedSummary(options, state) {
+  const count = state.suppressedCount;
+  if (count <= 0) return;
+  state.suppressedCount = 0;
+  void options.audit?.({
+    action: "relay.request.suppressed_summary",
+    result: "allow",
+    method: "INTERNAL",
+    path: "/",
+    suppressedCount: count
+  });
+}
+async function audit(options, event) {
+  if (event.action === "relay.request.accepted") {
+    const state = getOrCreateAuditSampler(options);
+    if (state.sampleRate < 1) {
+      ensureFlushTimer(options, state);
+      if (state.random() >= state.sampleRate) {
+        state.suppressedCount += 1;
+        return;
+      }
     }
-  };
+  }
+  await options.audit?.(event);
 }
 
 // src/server.ts
+function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
+  return incumbentGeneration > candidateGeneration;
+}
 var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
 var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
-var RESOLVER_CACHE_MAX_ENTRIES = 8192;
 var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
+var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
 var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
-function pruneExpiringCache(cache, now, maxEntries) {
-  for (const [key, entry] of cache) {
-    if (entry.expiresAt <= now) cache.delete(key);
+async function checkHostTunnelGeneration(lookup, claims) {
+  if (!lookup) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "host_generation_unverifiable",
+      reason: "Host tunnel generation cannot be verified by a relay without a host-generation resolver"
+    };
   }
-  while (cache.size >= maxEntries) {
-    const key = cache.keys().next().value;
-    if (!key) return;
-    cache.delete(key);
+  let result;
+  try {
+    result = await lookup({ enrollmentId: claims.enrollment_id, generation: claims.generation });
+  } catch (err) {
+    return {
+      ok: false,
+      retryable: true,
+      code: "host_generation_lookup_unavailable",
+      reason: `Host generation lookup is unavailable: ${err instanceof Error ? err.message : String(err)}`
+    };
   }
-}
-function createCachedRevocationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 1e4;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const at = now();
-    const entry = cache.get(args.jti);
-    if (entry && entry.expiresAt > at) {
-      if (entry.result) return entry.result;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((result) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
-      return result;
-    }).catch((err) => {
-      cache.delete(args.jti);
-      throw err;
-    });
-    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
-}
-function createCachedTargetClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 5e3;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const key = `${args.workspaceId}\0${args.hostId}`;
-    const at = now();
-    const entry = cache.get(key);
-    if (entry && entry.expiresAt > at) {
-      if (entry.result) return entry.result;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((result) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      if (result) cache.set(key, { result, expiresAt: now() + ttlMs });
-      else cache.delete(key);
-      return result;
-    }).catch((err) => {
-      cache.delete(key);
-      throw err;
-    });
-    cache.set(key, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
+  if (!result) {
+    return { ok: false, retryable: false, code: "host_enrollment_unknown", reason: "Host enrollment is unknown" };
+  }
+  if (result.revoked) {
+    return { ok: false, retryable: false, code: "host_enrollment_revoked", reason: "Host enrollment was revoked" };
+  }
+  if (result.generation > claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_superseded", reason: "Host tunnel generation was superseded" };
+  }
+  if (result.generation < claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_unknown", reason: "Host tunnel generation is ahead of the control plane" };
+  }
+  return { ok: true };
 }
 function protocolToken(header) {
   return header?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
@@ -389,53 +746,38 @@ function isDangerousInboundHeader(name) {
   return false;
 }
 function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
-  const headers2 = new Headers(input);
-  headers2.delete("host");
+  const headers = new Headers(input);
+  headers.delete("host");
   const inboundNames = /* @__PURE__ */ new Set();
-  headers2.forEach((_value, name) => inboundNames.add(name));
+  headers.forEach((_value, name) => inboundNames.add(name));
   for (const name of inboundNames) {
-    if (isDangerousInboundHeader(name)) headers2.delete(name);
-  }
-  if (options.userHosted) headers2.delete("cookie");
-  headers2.set("accept-encoding", "identity");
-  headers2.delete("authorization");
-  headers2.delete("Authorization");
-  headers2.set("Authorization", `Bearer ${relayHostToken}`);
-  headers2.set("x-workspace-id", workspaceId);
-  headers2.set("X-Daytona-Skip-Preview-Warning", "true");
-  headers2.set("X-Daytona-Skip-Last-Activity-Update", "true");
-  for (const [name, value] of Object.entries(options.upstreamHeaders ?? {})) {
-    const trimmed = value.trim();
-    if (trimmed) headers2.set(name, trimmed);
-  }
-  headers2.set("x-forwarded-by", "workspace-relay");
-  return headers2;
+    if (isDangerousInboundHeader(name)) headers.delete(name);
+  }
+  if (options.hostTunnel) headers.delete("cookie");
+  headers.set("accept-encoding", "identity");
+  headers.delete("authorization");
+  headers.delete("Authorization");
+  headers.set("Authorization", `Bearer ${relayHostToken}`);
+  headers.set("x-workspace-id", workspaceId);
+  headers.set("x-forwarded-by", "workspace-relay");
+  return headers;
 }
 function targetUrl(target, path, search) {
-  const url = new URL(path.replace(/^\/+/, ""), target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
+  const base = new URL(target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
+  const url = new URL(base);
+  url.pathname = `${base.pathname}${path.replace(/^\/+/, "")}`;
   url.search = search;
+  url.hash = "";
   return url;
 }
-var RELAY_VIEWER_DENIED_PATH = /^\/api\/wr\/pty(?:\/|$)/;
 function relayRuntimePath(request) {
-  return new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/");
-}
-function relayAuthorizationPath(path) {
   try {
-    return decodeURIComponent(path);
+    const decoded = decodeURIComponent(new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")).replace(/^\/+/, "/");
+    return new URL(decoded.replace(/^\/+/, ""), "http://relay.invalid/").pathname;
   } catch {
     return void 0;
   }
 }
-function roleAllowsRelayRequest(role, method, path) {
-  if (role === "owner" || role === "admin" || role === "editor") return true;
-  if (role === "viewer") {
-    const authorizationPath = relayAuthorizationPath(path);
-    if (!authorizationPath || RELAY_VIEWER_DENIED_PATH.test(authorizationPath)) return false;
-    return method === "GET" || method === "HEAD" || method === "OPTIONS";
-  }
-  return false;
-}
 function relayHostTokenCacheTtlMs(options, claims) {
   const configured = options.relayHostTokenCacheTtlMs ?? 3e4;
   if (!Number.isFinite(configured) || configured <= 0) return 0;
@@ -445,12 +787,13 @@ function relayHostTokenCacheTtlMs(options, claims) {
 function relayHostTokenCacheKey(options, claims, target) {
   return [
     claims.jti,
-    claims.sub,
+    claims.principal_kind,
+    claims.actor_id,
+    claims.actor_kind,
     claims.org_id,
     claims.role,
     claims.workspace_id,
     claims.host_id,
-    target.access,
     target.backing,
     options.relayHostMintKid ?? ""
   ].join("\0");
@@ -529,6 +872,13 @@ function pruneRelayHostTokenCache(cache, now) {
     cache.delete(key);
   }
 }
+function relayHostMintInput(options, claims, target) {
+  return {
+    ...relayHostInputFromRuntimeClaims(claims),
+    ...target,
+    ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
+  };
+}
 async function relayHostTokenFor(options, claims, target, trace) {
   const ttlMs = relayHostTokenCacheTtlMs(options, claims);
   if (ttlMs <= 0) {
@@ -549,13 +899,11 @@ async function relayHostTokenFor(options, claims, target, trace) {
   let promise;
   try {
     const token = await trace.span("rht-mint", async () => {
-      promise = mintRelayHostToken({
-        subject: claims.sub,
-        orgId: claims.org_id,
-        role: claims.role,
-        ...target,
-        ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-      }, options.relayHostSigningKey, options.relayHostAlgorithm);
+      promise = mintRelayHostToken(
+        relayHostMintInput(options, claims, target),
+        options.relayHostSigningKey,
+        options.relayHostAlgorithm
+      );
       pruneRelayHostTokenCache(cache, now);
       cache.set(key, { promise, expiresAt: now + ttlMs });
       return await promise;
@@ -573,13 +921,11 @@ async function relayHostTokenFor(options, claims, target, trace) {
 async function uncachedRelayHostTokenFor(options, claims, target, trace) {
   return await trace.span(
     "rht-mint",
-    async () => await mintRelayHostToken({
-      subject: claims.sub,
-      orgId: claims.org_id,
-      role: claims.role,
-      ...target,
-      ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-    }, options.relayHostSigningKey, options.relayHostAlgorithm)
+    async () => await mintRelayHostToken(
+      relayHostMintInput(options, claims, target),
+      options.relayHostSigningKey,
+      options.relayHostAlgorithm
+    )
   );
 }
 function workspaceRelayTargetUrl(target, path, search) {
@@ -600,146 +946,22 @@ function workspaceRelayForwardRequestInit(request, relayHostToken, workspaceId,
   if (request.method === "GET" || request.method === "HEAD") delete init.body;
   return init;
 }
-var auditSamplers = /* @__PURE__ */ new WeakMap();
-function getOrCreateAuditSampler(options) {
-  let state = auditSamplers.get(options);
-  if (!state) {
-    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
-    state = {
-      suppressedCount: 0,
-      timer: void 0,
-      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
-      random: options.random ?? Math.random,
-      sampleRate
-    };
-    auditSamplers.set(options, state);
-  }
-  return state;
-}
-function clampSampleRate(rate) {
-  if (rate === void 0) return 1;
-  if (!Number.isFinite(rate)) return 1;
-  if (rate < 0) return 0;
-  if (rate > 1) return 1;
-  return rate;
-}
-function ensureFlushTimer(options, state) {
-  if (state.timer) return;
-  if (state.sampleRate >= 1) return;
-  if (state.flushIntervalMs <= 0) return;
-  const timer = setInterval(() => {
-    flushSuppressedSummary(options, state);
-  }, state.flushIntervalMs);
-  if (typeof timer.unref === "function") {
-    timer.unref();
-  }
-  state.timer = timer;
-}
-function flushSuppressedSummary(options, state) {
-  const count = state.suppressedCount;
-  if (count <= 0) return;
-  state.suppressedCount = 0;
-  void options.audit?.({
-    action: "relay.request.suppressed_summary",
-    result: "allow",
-    method: "INTERNAL",
-    path: "/",
-    suppressedCount: count
-  });
-}
-function disposeAuditSampler(options) {
-  const state = auditSamplers.get(options);
-  if (!state) return;
-  if (state.timer) {
-    clearInterval(state.timer);
-    state.timer = void 0;
-  }
-  flushSuppressedSummary(options, state);
-  auditSamplers.delete(options);
-}
-function createWorkspaceRelayTrace() {
-  const phases = [];
-  return {
-    phases,
-    async span(name, run) {
-      const startedAt = performance.now();
-      try {
-        return await run();
-      } finally {
-        phases.push({ name, ms: performance.now() - startedAt });
-      }
-    }
-  };
-}
-function roundedMs(value) {
-  return Math.round(value * 100) / 100;
-}
-function workspaceRelayServerTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
-}
-function workspaceRelayTimingResponse(response, trace) {
-  const value = workspaceRelayServerTiming(trace);
-  if (!value) return response;
-  const headers2 = new Headers(response.headers);
-  const prev = headers2.get("server-timing");
-  headers2.set("server-timing", prev ? `${prev}, ${value}` : value);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: headers2
-  });
-}
-async function audit(options, event) {
-  if (event.action === "relay.request.accepted") {
-    const state = getOrCreateAuditSampler(options);
-    if (state.sampleRate < 1) {
-      ensureFlushTimer(options, state);
-      if (state.random() >= state.sampleRate) {
-        state.suppressedCount += 1;
-        return;
-      }
-    }
-  }
-  await options.audit?.(event);
-}
-var defaultOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-var originMatchers = /* @__PURE__ */ new WeakMap();
-function originMatcherFor(options) {
-  if (!options.allowedOrigins) return defaultOriginMatcher;
-  let matcher = originMatchers.get(options);
-  if (!matcher) {
-    matcher = createOriginMatcher(options.allowedOrigins);
-    originMatchers.set(options, matcher);
-  }
-  return matcher;
-}
-function denyCorsHeaders(request, originAllowed = defaultOriginMatcher) {
-  const origin = request.headers.get("origin");
-  if (!origin) return void 0;
-  if (!originAllowed(origin)) return void 0;
-  return {
-    "access-control-allow-origin": origin,
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
-    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
-  };
-}
 async function deny(options, input) {
   const url = new URL(input.request.url);
   await audit(options, {
     action: "relay.request.denied",
     result: "deny",
     reason: input.code,
-    subject: input.claims?.sub,
+    actorId: input.claims?.actor_id,
+    actorKind: input.claims?.actor_kind,
+    principalKind: input.claims?.principal_kind,
     ...input.claims ? { role: input.claims.role } : {},
     workspaceId: input.claims?.workspace_id,
     hostId: input.claims?.host_id,
     method: input.request.method,
     path: url.pathname
   });
-  return Response.json(errorBody(input.code, input.message), {
-    status: input.status,
-    headers: denyCorsHeaders(input.request, originMatcherFor(options))
-  });
+  return Response.json(errorBody(input.code, input.message), { status: input.status });
 }
 async function authorizeWorkspaceRelayRequest(options, request, workspaceId, trace) {
   const token = runtimeAccessToken(request);
@@ -761,6 +983,8 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       "rat-verify",
       async () => await cachedRuntimeAccessTokenClaims(options, token, workspaceId)
     );
+    const targetLookup = span("target-resolve", async () => await options.resolveTarget(claims));
+    targetLookup.catch(() => void 0);
     const active = await span("rat-active", async () => {
       return await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
     });
@@ -778,21 +1002,21 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       };
     }
     const path = relayRuntimePath(request);
-    if (!roleAllowsRelayRequest(claims.role, request.method, path)) {
+    if (!path || !sessionScopeReaches(claims.session_id, path, new URL(request.url).search)) {
       return {
         ok: false,
-        code: "relay_role_denied",
+        code: "relay_scope_denied",
         response: await deny(options, {
-          code: "relay_role_denied",
-          message: "Workspace role does not allow this relay request",
+          code: "relay_scope_denied",
+          message: "Runtime Access Token scope does not reach this relay request",
           status: 403,
           claims,
           request
         })
       };
     }
-    const target = await span("target-resolve", async () => await options.resolveTarget(claims));
-    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id) {
+    const target = await targetLookup;
+    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id || !isAllowedRelayTargetBaseUrl(target)) {
       return {
         ok: false,
         code: "relay_target_unavailable",
@@ -805,13 +1029,13 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
         })
       };
     }
-    if (target.access === "user-hosted" && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+    if (isHostTunnelTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
       return {
         ok: false,
-        code: "user_hosted_app_offline",
+        code: "host_tunnel_offline",
         response: await deny(options, {
-          code: "user_hosted_app_offline",
-          message: "User-hosted workspace is offline",
+          code: "host_tunnel_offline",
+          message: "The machine serving this workspace is offline",
           status: 503,
           claims,
           request
@@ -821,7 +1045,9 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
     await span("audit", async () => await audit(options, {
       action: "relay.request.accepted",
       result: "allow",
-      subject: claims.sub,
+      actorId: claims.actor_id,
+      actorKind: claims.actor_kind,
+      principalKind: claims.principal_kind,
       role: claims.role,
       workspaceId: claims.workspace_id,
       hostId: claims.host_id,
@@ -852,1431 +1078,25 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
     };
   }
 }
-async function forwardWorkspaceRelayRequest(request, target, relayHostToken, path, requestFetch, timeoutMs, trace, originAllowed = defaultOriginMatcher) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const span = (name, run) => trace ? trace.span(name, run) : run();
-  try {
-    const upstream = await span("upstream-fetch", async () => await requestFetch(
-      targetUrl(target, path, new URL(request.url).search),
-      workspaceRelayForwardRequestInit(request, relayHostToken, target.workspaceId, {
-        signal: controller.signal,
-        upstreamHeaders: target.upstreamHeaders
-      })
-    ));
-    const headers2 = new Headers(upstream.headers);
-    headers2.delete("access-control-allow-origin");
-    headers2.delete("access-control-allow-credentials");
-    headers2.delete("access-control-allow-headers");
-    headers2.delete("access-control-allow-methods");
-    headers2.delete("access-control-expose-headers");
-    headers2.delete("access-control-max-age");
-    for (const [key, value] of Object.entries(denyCorsHeaders(request, originAllowed) ?? {})) {
-      headers2.set(key, value);
-    }
-    return new Response(upstream.body, {
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers: headers2
-    });
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return Response.json(
-      errorBody(
-        aborted ? "upstream_timeout" : "upstream_unavailable",
-        aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable"
-      ),
-      { status: aborted ? 504 : 503, headers: denyCorsHeaders(request, originAllowed) }
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function getAuditSuppressedCount(options) {
-  return auditSamplers.get(options)?.suppressedCount ?? 0;
-}
-var LOOPBACK_REMOTES = /* @__PURE__ */ new Set([
-  "127.0.0.1",
-  "::1",
-  "::ffff:127.0.0.1"
-]);
-function isLoopbackAddress(address) {
-  if (!address) return false;
-  const trimmed = address.trim();
-  if (LOOPBACK_REMOTES.has(trimmed)) return true;
-  if (/^127\./.test(trimmed)) return true;
-  if (/^::ffff:127\./i.test(trimmed)) return true;
-  return false;
-}
-function checkMetricsAuth(options, request) {
-  if (options.metricsToken) {
-    const presented = bearerToken(request.headers.get("authorization") ?? void 0);
-    if (!presented || presented !== options.metricsToken) {
-      return {
-        ok: false,
-        status: 401,
-        code: "metrics_unauthorized",
-        message: "Metrics endpoint requires a valid bearer token"
-      };
-    }
-    return { ok: true };
-  }
-  if (!options.metricsRemoteAddress) {
-    return {
-      ok: false,
-      status: 401,
-      code: "metrics_unauthorized",
-      message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-    };
-  }
-  const address = options.metricsRemoteAddress(request);
-  if (isLoopbackAddress(address)) return { ok: true };
-  return {
-    ok: false,
-    status: 401,
-    code: "metrics_unauthorized",
-    message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-  };
-}
-function buildMetricsBody(options) {
-  const sources = options.metricsSources ?? {};
-  const fragmentation = sources.fragmentation?.() ?? { fragmentsBuffered: 0, oversizedClosed: 0 };
-  const slowConsumer = sources.slowConsumer?.() ?? {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-  const activeHostCount = options.directory?.size?.() ?? 0;
-  const suppressedAccepts = getAuditSuppressedCount(options);
-  const body = {
-    fragmentation,
-    slowConsumer,
-    directory: { activeHostCount },
-    audit: { suppressedAccepts }
-  };
-  if (sources.drainPending) {
-    body.drain = { pendingCount: sources.drainPending() };
-  }
-  return body;
-}
-function createWorkspaceRelay(options) {
-  const app = new Hono();
-  const originAllowed = originMatcherFor(options);
-  app.use("*", cors({
-    origin: (origin) => {
-      if (!origin) return void 0;
-      return originAllowed(origin) ? origin : void 0;
-    },
-    allowHeaders: [
-      "Accept",
-      "Authorization",
-      "Content-Type",
-      "X-Daytona-Skip-Preview-Warning",
-      "X-Workspace-Id",
-      "X-OpenCode-Directory",
-      "X-Claxedo-Runner",
-      "X-Claxedo-Model",
-      "X-Claxedo-Draft-Id",
-      "X-Claxedo-Binary"
-    ],
-    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
-  }));
-  app.get("/health", (c) => {
-    if (options.isDraining?.()) {
-      return c.json(
-        { ok: false, service: "workspace-relay", draining: true },
-        503
-      );
-    }
-    return c.json({ ok: true, service: "workspace-relay" });
-  });
-  app.get("/.well-known/jwks.json", async (c) => {
-    const sources = options.relayHostPublicKeys ?? [];
-    if (sources.length === 0) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_no_keys_configured",
-            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
-          }
-        },
-        503
-      );
-    }
-    let keys;
-    try {
-      keys = await Promise.all(sources.map(async (source) => {
-        const jwk = await exportJWK(source.publicKey);
-        return {
-          ...jwk,
-          kid: source.kid,
-          alg: "EdDSA",
-          use: "sig"
-        };
-      }));
-    } catch (err) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_invalid_key",
-            message: "A configured RHT public key could not be exported as a JWK",
-            detail: err instanceof Error ? err.message : String(err)
-          }
-        },
-        500
-      );
-    }
-    c.header("cache-control", "public, max-age=300");
-    return c.json({ keys });
-  });
-  app.disposeAuditSampler = () => disposeAuditSampler(options);
-  app.get("/metrics", (c) => {
-    const authResult = checkMetricsAuth(options, c.req.raw);
-    if (!authResult.ok) {
-      return c.json(
-        errorBody(authResult.code, authResult.message),
-        authResult.status
-      );
-    }
-    return c.json(buildMetricsBody(options));
-  });
-  app.all("/workspaces/:workspaceId/*", async (c) => {
-    const trace = createWorkspaceRelayTrace();
-    if (options.isDraining?.()) {
-      return Response.json(
-        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
-        { status: 503, headers: denyCorsHeaders(c.req.raw, originAllowed) }
-      );
-    }
-    const response = await trace.span("relay-total", async () => {
-      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
-      if (!relay.ok) return relay.response;
-      return await forwardWorkspaceRelayRequest(
-        new Request(c.req.raw),
-        relay.request.target,
-        relay.request.relayHostToken,
-        relay.request.path,
-        options.fetch ?? fetch,
-        options.forwardTimeoutMs ?? 3e4,
-        trace,
-        originAllowed
-      );
-    });
-    return workspaceRelayTimingResponse(response, trace);
-  });
-  return app;
-}
-
-// src/bun.ts
-var TUNNEL_PENDING_HTTP_CAP = 32;
-var TUNNEL_CHANNEL_CAP = 16;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS = 6e4;
-var WS_MAX_PAYLOAD_LENGTH_BYTES = 16 * 1024 * 1024;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT = 3e4;
-var DIRECT_HTTP_TIMEOUT_MS_DEFAULT = 3e4;
-var UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT = 1e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var relayBufferedBytes = (socket) => {
-  const method = socket.getBufferedAmount;
-  if (typeof method === "function") {
-    const measured = method.call(socket);
-    if (typeof measured === "number" && Number.isFinite(measured)) return measured;
-    return void 0;
-  }
-  const property = socket.bufferedAmount;
-  return typeof property === "number" && Number.isFinite(property) ? property : void 0;
-};
-var relayOverBackpressureLimit = (socket, limitBytes) => {
-  const queued = relayBufferedBytes(socket);
-  return queued !== void 0 && queued > limitBytes;
-};
-var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
-var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
-var HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT = 250;
-function createFragmentationStats() {
-  return {
-    fragmentsBuffered: 0,
-    oversizedClosed: 0
-  };
-}
-function createSlowConsumerStats() {
-  return {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-}
-function readFragmentationStats(stats) {
-  return {
-    fragmentsBuffered: stats.fragmentsBuffered,
-    oversizedClosed: stats.oversizedClosed
-  };
-}
-function resetFragmentationStats(stats) {
-  stats.fragmentsBuffered = 0;
-  stats.oversizedClosed = 0;
-}
-function readSlowConsumerStats(stats) {
-  return { ...stats };
-}
-function resetSlowConsumerStats(stats) {
-  stats.overflowEvents = 0;
-  stats.timerFired = 0;
-  stats.droppedRequests = 0;
-}
-function createDirectHttpLimiter(limit) {
-  if (!Number.isInteger(limit) || !limit || limit <= 0) return void 0;
-  const max = limit;
-  let active = 0;
-  const queue = [];
-  function drain() {
-    if (active >= max) return;
-    const next = queue.shift();
-    if (!next) return;
-    active++;
-    next();
-  }
-  return {
-    async acquire() {
-      if (active < max) {
-        active++;
-      } else {
-        await new Promise((resolve) => queue.push(resolve));
-      }
-      let released = false;
-      return () => {
-        if (released) return;
-        released = true;
-        active = Math.max(0, active - 1);
-        drain();
-      };
-    }
-  };
-}
-function jsonError(code, message, status) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-function corsJsonError(request, code, message, status) {
-  const headers2 = relayCorsHeaders(request);
-  headers2.set("content-type", "application/json");
-  return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
-}
-function preOpenFrameBytes(message) {
-  return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
-}
-function safeCloseCode(input, fallback = 1011) {
-  if (!Number.isInteger(input)) return fallback;
-  const code = input;
-  if (code === 1e3) return code;
-  if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code;
-  if (code >= 3e3 && code <= 4999) return code;
-  return fallback;
-}
-function closeWebSocket(ws, code, reason, fallback = 1011) {
-  try {
-    ws.close(safeCloseCode(code, fallback), reason);
-  } catch {
-    try {
-      ws.close(fallback, reason);
-    } catch {
-    }
-  }
-}
-function upstreamCloseReason(event) {
-  if (event.reason.trim()) return event.reason;
-  if (event.code === 1e3) return "";
-  if (event.code === 1005 || event.code === 1006) return "Upstream WebSocket closed abnormally";
-  return `Upstream WebSocket closed unexpectedly with code ${event.code}`;
-}
-function workspaceIdFromPath(pathname) {
-  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function hostIdFromTunnelPath(pathname) {
-  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function websocketRequest(request) {
-  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
-}
-function roundedMs2(input) {
-  return Math.round(input * 100) / 100;
-}
-function relayWebSocketTraceEnabled(request) {
-  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
-}
-function sendRelayWebSocketTrace(ws) {
-  const trace = ws.data.trace;
-  if (!trace || trace.emitted) return;
-  trace.emitted = true;
-  ws.send(JSON.stringify({
-    type: "relay.trace",
-    wsUpstreamOpenMs: trace.upstreamOpenMs === void 0 ? void 0 : roundedMs2(trace.upstreamOpenMs),
-    queuedFrames: trace.queuedFrames,
-    maxQueuedDelayMs: roundedMs2(trace.maxQueuedDelayMs)
-  }));
-}
-function relayWebSocketPayload(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof ArrayBuffer) return input;
-  if (ArrayBuffer.isView(input)) {
-    const copy = new Uint8Array(input.byteLength);
-    copy.set(new Uint8Array(input.buffer, input.byteOffset, input.byteLength));
-    return copy;
-  }
-}
-function headersRecord(headers2) {
-  const result = {};
-  headers2.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
-}
-function headers(input) {
-  const result = new Headers();
-  for (const [key, value] of Object.entries(input)) {
-    result.set(key, value);
-  }
-  return result;
-}
-function isEventStream(input) {
-  return Object.entries(input).some(
-    ([key, value]) => key.toLowerCase() === "content-type" && value.toLowerCase().includes("text/event-stream")
-  );
-}
-var defaultRelayOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-function allowedCorsOrigin(origin) {
-  if (!origin) return;
-  if (defaultRelayOriginMatcher(origin)) return origin;
-}
-function requireAllowedOrigin(request) {
-  const origin = request.headers.get("origin");
-  if (allowedCorsOrigin(origin)) return null;
-  return jsonError(
-    "origin_not_allowed",
-    "Origin is not in the allowlist",
-    403
-  );
-}
-function relayCorsHeaders(request, input = new Headers()) {
-  const result = new Headers(input);
-  result.delete("access-control-allow-origin");
-  result.delete("access-control-allow-credentials");
-  result.delete("access-control-allow-headers");
-  result.delete("access-control-allow-methods");
-  result.delete("access-control-expose-headers");
-  result.delete("access-control-max-age");
-  const origin = allowedCorsOrigin(request.headers.get("origin"));
-  if (origin) {
-    result.set("access-control-allow-origin", origin);
-    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary");
-    result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
-  }
-  return result;
-}
-function encoded(input) {
-  return Buffer.from(input).toString("base64");
-}
-function decoded(input) {
-  return new Uint8Array(Buffer.from(input, "base64"));
-}
-function encodedFrame(message) {
-  if (typeof message === "string") {
-    return {
-      binary: false,
-      data_base64: Buffer.from(message).toString("base64")
-    };
-  }
-  return {
-    binary: true,
-    data_base64: Buffer.from(message).toString("base64")
-  };
-}
-function decodedFrame(frame) {
-  const body = Buffer.from(frame.data_base64, "base64");
-  return frame.binary ? new Uint8Array(body) : body.toString("utf8");
-}
-function tunnelMessage(ws, input, stats) {
-  if (typeof input !== "string") return;
-  const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
-  let parsed;
-  try {
-    parsed = JSON.parse(combined);
-  } catch {
-    if (combined.length > TUNNEL_MESSAGE_BUFFER_CAP_BYTES) {
-      stats.oversizedClosed += 1;
-      ws.data.messageBuffer = "";
-      ws.close(1009, "Tunnel message buffer exceeded 4 MB");
-      return;
-    }
-    stats.fragmentsBuffered += 1;
-    ws.data.messageBuffer = combined;
-    return;
-  }
-  ws.data.messageBuffer = "";
-  const validated = validateTunnelMessage(parsed);
-  if (validated.ok) return validated.message;
-  if (validated.reason === "protocol_mismatch") {
-    ws.close(1002, `Tunnel protocol mismatch: expected ${validated.expected_protocol}`);
-  }
-  return;
-}
-function sendTunnelPing(ws) {
-  if (ws.readyState !== WebSocket.OPEN) return;
-  ws.data.missedPongs += 1;
-  ws.send(JSON.stringify(makeTunnelPing()));
-}
-function clearPendingTimers(entry) {
-  clearTimeout(entry.timeout);
-  if (entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function failPendingHttpResponse(input) {
-  clearPendingTimers(input.entry);
-  input.entry.pendingChunks.length = 0;
-  input.entry.bytesQueued = 0;
-  try {
-    input.entry.controller.error(input.error);
-  } catch {
-  }
-  if (!input.entry.responseStarted) {
-    if (input.response) {
-      input.entry.resolve(input.response);
-      return;
-    }
-    input.entry.reject(input.error);
-  }
-}
-function cleanupHostTunnelSocket(input) {
-  if (input.ws.data.heartbeat) {
-    clearInterval(input.ws.data.heartbeat);
-    input.ws.data.heartbeat = void 0;
-  }
-  for (const pending of input.ws.data.pending.values()) {
-    failPendingHttpResponse({
-      entry: pending,
-      response: input.request ? corsJsonError(input.request, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
-      error: new Error("User-hosted tunnel disconnected")
-    });
-  }
-  input.ws.data.pending.clear();
-  for (const channel of input.ws.data.channels.values()) {
-    if (input.closeChannels) closeWebSocket(channel, 1011, "User-hosted tunnel disconnected");
-  }
-  input.ws.data.channels.clear();
-  if (!input.disconnectDirectory) return;
-  if (input.hostTunnels.get(input.ws.data.hostId) === input.ws) {
-    input.hostTunnels.delete(input.ws.data.hostId);
-    input.options.directory?.disconnectHost(input.ws.data.hostId);
-    scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
-      hostId: input.ws.data.hostId,
-      workspaceId: input.ws.data.workspaceIds[0],
-      path: `/host-tunnels/${input.ws.data.hostId}`,
-      state: "disconnected",
-      debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-    });
-  }
-}
-async function audit2(options, input) {
-  await options.audit?.({
-    action: input.action,
-    result: "allow",
-    hostId: input.hostId,
-    workspaceId: input.workspaceId,
-    method: "WEBSOCKET",
-    path: input.path
-  });
-}
-function scheduleHostTunnelStateChange(state, options, input) {
-  const existing = state.get(input.hostId);
-  const entry = existing ?? {
-    intendedState: "disconnected",
-    lastWritten: "disconnected",
-    flushTimer: void 0,
-    pending: { workspaceId: input.workspaceId, path: input.path }
-  };
-  entry.intendedState = input.state;
-  entry.pending = { workspaceId: input.workspaceId, path: input.path };
-  if (entry.flushTimer) clearTimeout(entry.flushTimer);
-  entry.flushTimer = setTimeout(() => {
-    entry.flushTimer = void 0;
-    if (entry.intendedState === entry.lastWritten) {
-      if (entry.intendedState === "disconnected") {
-        state.delete(input.hostId);
-      }
-      return;
-    }
-    entry.lastWritten = entry.intendedState;
-    void audit2(options, {
-      action: entry.intendedState === "connected" ? "host_tunnel.connected" : "host_tunnel.disconnected",
-      hostId: input.hostId,
-      workspaceId: entry.pending.workspaceId,
-      path: entry.pending.path
-    });
-  }, input.debounceMs);
-  state.set(input.hostId, entry);
-}
-function drainPendingChunks(entry) {
-  while (entry.pendingChunks.length > 0) {
-    const desired = entry.controller.desiredSize;
-    if (desired !== null && desired <= 0) break;
-    const next = entry.pendingChunks.shift();
-    entry.bytesQueued -= next.byteLength;
-    try {
-      entry.controller.enqueue(next);
-    } catch {
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      break;
-    }
-  }
-  if (entry.pendingChunks.length === 0 && entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function enqueueChunkWithBackpressure(input) {
-  const { entry, chunk } = input;
-  const desired = entry.controller.desiredSize;
-  const overflowing = desired !== null && desired <= 0;
-  if (overflowing || entry.pendingChunks.length > 0) {
-    entry.pendingChunks.push(chunk);
-    entry.bytesQueued += chunk.byteLength;
-    if (!entry.slowConsumerTimeout) {
-      input.slowConsumerStats.overflowEvents += 1;
-      entry.slowConsumerTimeout = setTimeout(() => {
-        input.slowConsumerStats.timerFired += 1;
-        const error = new Error("slow_consumer_timeout: downstream consumer did not drain in time");
-        try {
-          entry.controller.error(error);
-        } catch {
-        }
-        clearTimeout(entry.timeout);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        if (!entry.responseStarted) {
-          entry.resolve(jsonError("slow_consumer_timeout", "Downstream consumer did not drain in time", 503));
-        }
-        input.ws.data.pending.delete(input.requestId);
-        input.slowConsumerStats.droppedRequests += 1;
-      }, input.slowConsumerTimeoutMs);
-    }
-    return;
-  }
-  try {
-    entry.controller.enqueue(chunk);
-  } catch {
-  }
-}
-var __slowConsumerInternalsForTest = {
-  enqueueChunkWithBackpressure,
-  createSlowConsumerStats
-};
-async function tunnelHttpRequest(input) {
-  if (input.ws.readyState !== WebSocket.OPEN) {
-    return new Response("User-hosted workspace is offline", { status: 503 });
-  }
-  if (input.ws.data.pending.size >= TUNNEL_PENDING_HTTP_CAP) {
-    return jsonError(
-      "too_many_in_flight",
-      "User-hosted tunnel has too many in-flight HTTP requests",
-      429
-    );
-  }
-  const requestId = crypto.randomUUID();
-  let controller;
-  const stream = new ReadableStream({
-    start(next) {
-      controller = next;
-    },
-    pull() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      drainPendingChunks(entry);
-    },
-    cancel() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      clearPendingTimers(entry);
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      if (input.ws.readyState === WebSocket.OPEN) {
-        input.ws.send(JSON.stringify({
-          type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION,
-          request_id: requestId,
-          paused: false,
-          reason: "closed"
-        }));
-      }
-    }
-  }, new ByteLengthQueuingStrategy({ highWaterMark: input.slowConsumerHighWaterMarkBytes }));
-  const pending = new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      if (entry.responseStarted) {
-        clearPendingTimers(entry);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        try {
-          entry.controller.close();
-        } catch {
-        }
-        return;
-      }
-      const error = new Error("User-hosted tunnel response timed out");
-      failPendingHttpResponse({
-        entry,
-        response: corsJsonError(input.request, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
-        error
-      });
-    }, input.responseTimeoutMs);
-    input.ws.data.pending.set(requestId, {
-      controller,
-      stream,
-      resolve,
-      reject,
-      timeout,
-      pendingChunks: [],
-      bytesQueued: 0,
-      responseStarted: false
-    });
-  });
-  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.requestBodyMaxBytes);
-  if (body && "response" in body) {
-    const entry = input.ws.data.pending.get(requestId);
-    if (entry) clearPendingTimers(entry);
-    input.ws.data.pending.delete(requestId);
-    return body.response;
-  }
-  input.ws.send(JSON.stringify({
-    type: "http.request",
-    protocol: TUNNEL_PROTOCOL_VERSION,
-    request_id: requestId,
-    workspace_id: input.workspaceId,
-    method: input.request.method,
-    path: input.path,
-    headers: headersRecord(workspaceRelayForwardHeaders(
-      input.request.headers,
-      input.relayHostToken,
-      input.workspaceId,
-      // T26: user-hosted tunnel — strip Cookie to avoid leaking browser
-      // cookies to the host process running on the user's laptop.
-      { userHosted: true }
-    )),
-    ...body?.bodyBase64 ? { body_base64: body.bodyBase64 } : {},
-    end: true
-  }));
-  return await pending;
-}
-async function readBoundedBody(request, maxBytes) {
-  if (!request.body) return void 0;
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const next = await reader.read();
-    if (next.done) break;
-    total += next.value.byteLength;
-    if (total > maxBytes) {
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      return {
-        response: corsJsonError(request, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
-      };
-    }
-    chunks.push(next.value);
-  }
-  const body = new Uint8Array(total);
-  chunks.reduce((offset, chunk) => {
-    body.set(chunk, offset);
-    return offset + chunk.byteLength;
-  }, 0);
-  return { bodyBase64: encoded(body.buffer) };
-}
-async function directHttpRequest(input) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
-  const span = (name, run) => input.trace ? input.trace.span(name, run) : run();
-  try {
-    const init = workspaceRelayForwardRequestInit(
-      input.request,
-      input.relayHostToken,
-      input.workspaceId,
-      {
-        // T26: cloud-vm direct path. Cookies pass through (default) — workspace
-        // dashboards in the VM may legitimately need session cookies.
-        userHosted: false,
-        upstreamHeaders: input.upstreamHeaders,
-        signal: controller.signal
-      }
-    );
-    if (input.request.method !== "GET" && input.request.method !== "HEAD" && input.request.body) {
-      init.body = await input.request.arrayBuffer();
-    }
-    const limiter = input.limiter;
-    const release = limiter ? await span("direct-http-queue", () => limiter.acquire()) : void 0;
-    try {
-      const upstream = await span("upstream-fetch", async () => await fetch(input.targetUrl, init));
-      return new Response(upstream.body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: relayCorsHeaders(input.request, upstream.headers)
-      });
-    } finally {
-      release?.();
-    }
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return corsJsonError(
-      input.request,
-      aborted ? "upstream_timeout" : "upstream_unavailable",
-      aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable",
-      aborted ? 504 : 503
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function hostTunnel(hostTunnels, hostId) {
-  const tunnel = hostTunnels.get(hostId);
-  if (tunnel?.readyState === WebSocket.OPEN) return tunnel;
-  return void 0;
-}
-async function authorizeHostTunnel(options, bunOptions, request, input) {
-  if (bunOptions.authorizeHostTunnel) return await bunOptions.authorizeHostTunnel(request, input);
-  const token = bearerToken(request.headers.get("authorization"));
-  if (!token) return false;
-  try {
-    await verifyHostTunnelToken(token, options.runtimeAccessKey, input);
-    return true;
-  } catch (err) {
-    if (err instanceof WorkspaceRelayAuthError) return false;
-    throw err;
-  }
-}
-function createWorkspaceRelayBun(options, bunOptions = {}) {
-  const hostTunnels = /* @__PURE__ */ new Map();
-  const relayClients = /* @__PURE__ */ new Set();
-  const hostTunnelRegistrations = /* @__PURE__ */ new Map();
-  const directHttpLimiter = createDirectHttpLimiter(bunOptions.directHttpConcurrency);
-  const hostTunnelStateDebounce = /* @__PURE__ */ new Map();
-  const fragmentationStats = createFragmentationStats();
-  const slowConsumerStats = createSlowConsumerStats();
-  const telemetry = {
-    getFragmentationStats: () => readFragmentationStats(fragmentationStats),
-    resetFragmentationStats: () => resetFragmentationStats(fragmentationStats),
-    getSlowConsumerStats: () => readSlowConsumerStats(slowConsumerStats),
-    resetSlowConsumerStats: () => resetSlowConsumerStats(slowConsumerStats)
-  };
-  let draining = false;
-  const drainController = {
-    isDraining: () => draining,
-    setDraining: (value) => {
-      draining = value;
-      if (!value) return;
-      for (const tunnel of hostTunnels.values()) {
-        closeWebSocket(tunnel, 1012, "Workspace relay is draining", 1012);
-      }
-      for (const client of relayClients) {
-        closeWebSocket(client, 1012, "Workspace relay is draining", 1012);
-      }
-    },
-    pendingCount: () => {
-      let total = 0;
-      for (const tunnel of hostTunnels.values()) {
-        total += tunnel.data.pending.size;
-      }
-      return total;
-    },
-    waitForDrain: async (timeoutMs) => {
-      const deadline = Date.now() + Math.max(0, timeoutMs);
-      const pollMs = 50;
-      while (true) {
-        const remaining = drainController.pendingCount();
-        if (remaining === 0) return { drained: true, remaining: 0 };
-        const now = Date.now();
-        if (now >= deadline) return { drained: false, remaining };
-        const sleep = Math.min(pollMs, Math.max(1, deadline - now));
-        await new Promise((resolve) => setTimeout(resolve, sleep));
-      }
-    }
-  };
-  const mergedMetricsSources = {
-    fragmentation: options.metricsSources?.fragmentation ?? telemetry.getFragmentationStats,
-    slowConsumer: options.metricsSources?.slowConsumer ?? telemetry.getSlowConsumerStats,
-    drainPending: options.metricsSources?.drainPending ?? drainController.pendingCount
-  };
-  const requestRemoteAddress = /* @__PURE__ */ new WeakMap();
-  const metricsRemoteAddressResolver = options.metricsRemoteAddress ?? ((request) => requestRemoteAddress.get(request));
-  const app = createWorkspaceRelay({
-    ...options,
-    isDraining: drainController.isDraining,
-    metricsSources: mergedMetricsSources,
-    metricsRemoteAddress: metricsRemoteAddressResolver
-  });
-  function getRegistrationTracker(hostId) {
-    let tracker = hostTunnelRegistrations.get(hostId);
-    if (!tracker) {
-      tracker = { recent: [] };
-      hostTunnelRegistrations.set(hostId, tracker);
-    }
-    return tracker;
-  }
-  function pruneReconnects(tracker, now) {
-    const cutoff = now - HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS;
-    while (tracker.recent.length && tracker.recent[0] < cutoff) {
-      tracker.recent.shift();
-    }
-  }
-  return {
-    async fetch(request, server) {
-      const url = new URL(request.url);
-      const workspaceId = workspaceIdFromPath(url.pathname);
-      const hostId = hostIdFromTunnelPath(url.pathname);
-      try {
-        const ip = server.requestIP(request)?.address;
-        if (ip) requestRemoteAddress.set(request, ip);
-      } catch {
-      }
-      if (url.pathname === "/health") {
-        return Response.json(
-          draining ? { ok: false, service: "workspace-relay", draining: true } : { ok: true, service: "workspace-relay" },
-          { status: draining ? 503 : 200 }
-        );
-      }
-      if (draining && websocketRequest(request) && hostId) {
-        return jsonError(
-          "relay_draining",
-          "Workspace relay is shutting down; new tunnel registrations are not accepted",
-          503
-        );
-      }
-      if (draining && workspaceId) {
-        const headers2 = relayCorsHeaders(request);
-        const body = JSON.stringify({
-          error: {
-            code: "relay_draining",
-            message: "Workspace relay is shutting down; try another instance"
-          }
-        });
-        headers2.set("content-type", "application/json");
-        return new Response(body, { status: 503, headers: headers2 });
-      }
-      if (websocketRequest(request) && hostId) {
-        const workspaceIds = url.searchParams.getAll("workspaceId");
-        if (!workspaceIds.length || !options.directory) {
-          return new Response("Host tunnel registration is unavailable", { status: 503 });
-        }
-        if (!await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds })) {
-          return new Response("Host tunnel registration denied", { status: 403 });
-        }
-        const tracker = getRegistrationTracker(hostId);
-        const now = Date.now();
-        pruneReconnects(tracker, now);
-        if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
-          return jsonError(
-            "too_many_host_tunnel_reconnects",
-            "Too many host-tunnel reconnects for this host within the last 60 seconds",
-            429
-          );
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "host-tunnel",
-            hostId,
-            workspaceIds,
-            pending: /* @__PURE__ */ new Map(),
-            channels: /* @__PURE__ */ new Map(),
-            missedPongs: 0,
-            messageBuffer: ""
-          }
-        })) {
-          tracker.recent.push(now);
-          return;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (!workspaceId) return app.request(request);
-      if (request.method === "OPTIONS") {
-        return new Response(null, {
-          status: 204,
-          headers: relayCorsHeaders(request)
-        });
-      }
-      if (!websocketRequest(request)) {
-        const trace = createWorkspaceRelayTrace();
-        const response = await trace.span("relay-total", async () => {
-          const relay2 = await authorizeWorkspaceRelayRequest(options, request, workspaceId, trace);
-          if (!relay2.ok) return relay2.response;
-          if (relay2.request.target.access === "user-hosted") {
-            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId);
-            return tunnel ? await trace.span("tunnel-http", async () => await tunnelHttpRequest({
-              ws: tunnel,
-              request,
-              workspaceId: relay2.request.target.workspaceId,
-              path: `${relay2.request.path}${url.search}`,
-              relayHostToken: relay2.request.relayHostToken,
-              slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
-              slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-              slowConsumerStats,
-              requestBodyMaxBytes: bunOptions.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT,
-              responseTimeoutMs: bunOptions.tunnelHttpResponseTimeoutMs ?? TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT
-            })) : new Response("User-hosted workspace is offline", { status: 503 });
-          }
-          return await directHttpRequest({
-            request,
-            targetUrl: workspaceRelayTargetUrl(
-              relay2.request.target,
-              relay2.request.path,
-              url.search
-            ).toString(),
-            relayHostToken: relay2.request.relayHostToken,
-            workspaceId: relay2.request.target.workspaceId,
-            upstreamHeaders: relay2.request.target.upstreamHeaders,
-            timeoutMs: bunOptions.directHttpTimeoutMs ?? DIRECT_HTTP_TIMEOUT_MS_DEFAULT,
-            limiter: directHttpLimiter,
-            trace
-          });
-        });
-        return workspaceRelayTimingResponse(response, trace);
-      }
-      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
-      if (!relay.ok) return relay.response;
-      const originDenied = requireAllowedOrigin(request);
-      if (originDenied) return originDenied;
-      if (relay.request.target.access === "user-hosted") {
-        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
-        if (!tunnel) {
-          return new Response("User-hosted workspace is offline", { status: 503 });
-        }
-        if (tunnel.data.channels.size >= TUNNEL_CHANNEL_CAP) {
-          return jsonError(
-            "too_many_channels",
-            "User-hosted tunnel has too many active WebSocket channels",
-            503
-          );
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "user-hosted-client",
-            hostId: relay.request.target.hostId,
-            workspaceId: relay.request.target.workspaceId,
-            channelId: crypto.randomUUID(),
-            path: `${relay.request.path}${url.search}`,
-            relayHostToken: relay.request.relayHostToken
-          }
-        })) {
-          return;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (server.upgrade(request, {
-        data: {
-          kind: "client",
-          upstreamUrl: workspaceRelayTargetUrl(
-            relay.request.target,
-            relay.request.path,
-            url.search
-          ).toString().replace(/^http/, "ws"),
-          headers: headersRecord(workspaceRelayForwardHeaders(
-            new Headers(),
-            relay.request.relayHostToken,
-            relay.request.target.workspaceId,
-            // T26: cloud-vm WS upgrade. Cookies pass through (default).
-            { userHosted: false, upstreamHeaders: relay.request.target.upstreamHeaders }
-          )),
-          queue: [],
-          ...relayWebSocketTraceEnabled(request) ? {
-            trace: {
-              acceptedAt: performance.now(),
-              queuedFrames: 0,
-              maxQueuedDelayMs: 0,
-              emitted: false
-            }
-          } : {}
-        }
-      })) {
-        return;
-      }
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    },
-    websocket: {
-      maxPayloadLength: WS_MAX_PAYLOAD_LENGTH_BYTES,
-      message(ws, message) {
-        if (ws.data.kind === "host-tunnel") {
-          const parsed = tunnelMessage(
-            ws,
-            message,
-            fragmentationStats
-          );
-          if (parsed?.type === "ping") {
-            options.directory?.recordPong(ws.data.hostId);
-            ws.send(JSON.stringify(makeTunnelPong(parsed)));
-          }
-          if (parsed?.type === "pong") {
-            ws.data.missedPongs = 0;
-            options.directory?.recordPong(ws.data.hostId);
-          }
-          if (parsed?.type === "host.registration.update") {
-            const update = parsed;
-            const workspaceIds = [...new Set(update.workspace_ids)];
-            const hostSocket = ws;
-            const hostId = hostSocket.data.hostId;
-            const authorizationRequest = new Request(
-              `http://relay.local/host-tunnels/${encodeURIComponent(hostId)}`,
-              { headers: { authorization: `Bearer ${update.token}` } }
-            );
-            void authorizeHostTunnel(options, bunOptions, authorizationRequest, {
-              hostId,
-              workspaceIds
-            }).then((authorized) => {
-              if (!authorized) {
-                closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008);
-                return;
-              }
-              if (hostTunnels.get(hostId) !== hostSocket || hostSocket.readyState !== WebSocket.OPEN) return;
-              hostSocket.data.workspaceIds = workspaceIds;
-              options.directory?.registerHostTunnel({ hostId, workspaceIds });
-            }).catch(() => closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008));
-            return;
-          }
-          if (parsed?.type === "error") {
-            if (parsed.request_id) {
-              const pending = ws.data.pending.get(parsed.request_id);
-              if (pending) {
-                ws.data.pending.delete(parsed.request_id);
-                failPendingHttpResponse({
-                  entry: pending,
-                  response: jsonError(parsed.code, parsed.message, 502),
-                  error: new Error(parsed.message)
-                });
-              }
-            }
-          }
-          if (parsed?.type === "http.response.start") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              const response = parsed;
-              pending.responseStarted = true;
-              if (isEventStream(response.headers)) clearTimeout(pending.timeout);
-              pending.resolve(new Response(pending.stream, {
-                status: response.status,
-                headers: headers(response.headers)
-              }));
-            }
-          }
-          if (parsed?.type === "http.response.chunk") {
-            const entry = ws.data.pending.get(parsed.request_id);
-            if (entry) {
-              enqueueChunkWithBackpressure({
-                ws,
-                requestId: parsed.request_id,
-                entry,
-                chunk: decoded(parsed.body_base64),
-                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-                slowConsumerStats
-              });
-            }
-          }
-          if (parsed?.type === "http.response.end") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              clearTimeout(pending.timeout);
-              if (pending.slowConsumerTimeout) {
-                clearTimeout(pending.slowConsumerTimeout);
-                pending.slowConsumerTimeout = void 0;
-              }
-              drainPendingChunks(pending);
-              if (pending.pendingChunks.length > 0) {
-                for (const chunk of pending.pendingChunks) {
-                  try {
-                    pending.controller.enqueue(chunk);
-                  } catch {
-                    break;
-                  }
-                }
-                pending.pendingChunks.length = 0;
-                pending.bytesQueued = 0;
-              }
-              try {
-                pending.controller.close();
-              } catch {
-              }
-              ws.data.pending.delete(parsed.request_id);
-            }
-          }
-          if (parsed?.type === "ws.frame") {
-            const frame = parsed;
-            const channel = ws.data.channels.get(frame.channel_id);
-            if (!channel || channel.readyState !== WebSocket.OPEN) {
-              ws.data.channels.delete(frame.channel_id);
-              return;
-            }
-            if (relayOverBackpressureLimit(channel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-              ws.data.channels.delete(frame.channel_id);
-              closeWebSocket(channel, 1011, "Client WebSocket backpressure limit exceeded");
-              return;
-            }
-            channel.send(decodedFrame(frame));
-          }
-          if (parsed?.type === "ws.close") {
-            const close = parsed;
-            const channel = ws.data.channels.get(close.channel_id);
-            if (channel) {
-              ws.data.channels.delete(close.channel_id);
-              closeWebSocket(channel, close.code, close.reason);
-            }
-          }
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          if (relayOverBackpressureLimit(tunnel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-            closeWebSocket(ws, 1011, "Host tunnel backpressure limit exceeded");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.frame",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            ...encodedFrame(message)
-          }));
-          return;
-        }
-        if (ws.data.upstream?.readyState === WebSocket.OPEN) {
-          ws.data.upstream.send(message);
-          return;
-        }
-        const queuedBytes = ws.data.queuedBytes ?? 0;
-        const frameBytes = preOpenFrameBytes(message);
-        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) && queuedBytes + frameBytes > (bunOptions.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
-          closeWebSocket(ws, 1011, "Upstream WebSocket queue limit exceeded");
-          return;
-        }
-        ws.data.queuedBytes = queuedBytes + frameBytes;
-        ws.data.queue.push({ payload: message, queuedAt: performance.now() });
-      },
-      open(ws) {
-        if (ws.data.kind === "host-tunnel") {
-          const previous = hostTunnels.get(ws.data.hostId);
-          if (previous && previous !== ws) {
-            cleanupHostTunnelSocket({
-              ws: previous,
-              hostTunnels,
-              hostTunnelStateDebounce,
-              options,
-              bunOptions,
-              disconnectDirectory: false,
-              closeChannels: true
-            });
-            closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
-          }
-          hostTunnels.set(ws.data.hostId, ws);
-          options.directory?.registerHostTunnel({
-            hostId: ws.data.hostId,
-            workspaceIds: ws.data.workspaceIds
-          });
-          ws.data.heartbeat = setInterval(() => {
-            const hostWs = ws;
-            if (hostWs.data.missedPongs > (bunOptions.hostTunnelMaxMissedPongs ?? HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT)) {
-              closeWebSocket(ws, 1001, "Host tunnel heartbeat timed out", 1001);
-              return;
-            }
-            sendTunnelPing(hostWs);
-          }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
-          scheduleHostTunnelStateChange(hostTunnelStateDebounce, options, {
-            hostId: ws.data.hostId,
-            workspaceId: ws.data.workspaceIds[0],
-            path: `/host-tunnels/${ws.data.hostId}`,
-            state: "connected",
-            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-          });
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.data.channels.set(ws.data.channelId, ws);
-          if (tunnel.readyState !== WebSocket.OPEN) {
-            closeWebSocket(ws, 1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.open",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            workspace_id: ws.data.workspaceId,
-            path: ws.data.path,
-            headers: headersRecord(workspaceRelayForwardHeaders(
-              new Headers(),
-              ws.data.relayHostToken,
-              ws.data.workspaceId,
-              // T26: user-hosted tunnel WS upgrade — strip Cookie. Headers are
-              // empty here today, but pass the flag for consistency in case
-              // upstream client headers are forwarded in the future.
-              { userHosted: true }
-            ))
-          }));
-          return;
-        }
-        relayClients.add(ws);
-        const data = ws.data;
-        const UpstreamWebSocket = bunOptions.upstreamWebSocket ?? WebSocket;
-        if (data.trace) data.trace.upstreamStartedAt = performance.now();
-        const upstream = new UpstreamWebSocket(data.upstreamUrl, {
-          headers: data.headers
-        });
-        upstream.binaryType = "arraybuffer";
-        data.upstream = upstream;
-        data.upstreamOpenTimer = setTimeout(() => {
-          if (upstream.readyState === WebSocket.OPEN) return;
-          closeWebSocket(upstream, 1001, "Upstream WebSocket open timed out", 1001);
-          closeWebSocket(ws, 1011, "Upstream WebSocket open timed out");
-        }, bunOptions.upstreamWebSocketOpenTimeoutMs ?? UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT);
-        upstream.onopen = () => {
-          const openedAt = performance.now();
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          if (data.trace) {
-            data.trace.upstreamOpenMs = openedAt - (data.trace.upstreamStartedAt ?? data.trace.acceptedAt);
-            data.trace.queuedFrames = data.queue.length;
-            data.trace.maxQueuedDelayMs = data.queue.reduce(
-              (max, item) => Math.max(max, openedAt - item.queuedAt),
-              0
-            );
-            sendRelayWebSocketTrace(ws);
-          }
-          for (const item of data.queue.splice(0)) upstream.send(item.payload);
-          data.queuedBytes = 0;
-        };
-        upstream.onmessage = (event) => {
-          const payload = relayWebSocketPayload(event.data);
-          if (payload !== void 0) ws.send(payload);
-        };
-        upstream.onclose = (event) => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          closeWebSocket(ws, event.code, upstreamCloseReason(event));
-        };
-        upstream.onerror = () => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          closeWebSocket(ws, 1011, "Upstream WebSocket connection failed");
-        };
-      },
-      close(ws, code, reason) {
-        if (ws.data.kind === "host-tunnel") {
-          cleanupHostTunnelSocket({
-            ws,
-            hostTunnels,
-            hostTunnelStateDebounce,
-            options,
-            bunOptions,
-            disconnectDirectory: true,
-            closeChannels: true
-          });
-          const tracker = hostTunnelRegistrations.get(ws.data.hostId);
-          if (tracker) {
-            pruneReconnects(tracker, Date.now());
-            if (tracker.recent.length === 0) hostTunnelRegistrations.delete(ws.data.hostId);
-          }
-          return;
-        }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
-          tunnel?.data.channels.delete(ws.data.channelId);
-          if (tunnel?.readyState === WebSocket.OPEN) {
-            tunnel.send(JSON.stringify({
-              type: "ws.close",
-              protocol: TUNNEL_PROTOCOL_VERSION,
-              channel_id: ws.data.channelId,
-              code: safeCloseCode(code, 1e3),
-              reason
-            }));
-          }
-          return;
-        }
-        relayClients.delete(ws);
-        if (ws.data.upstreamOpenTimer) clearTimeout(ws.data.upstreamOpenTimer);
-        if (ws.data.upstream) closeWebSocket(ws.data.upstream, code, reason, 1e3);
-      }
-    },
-    drain: drainController,
-    telemetry
-  };
-}
-
-// src/cloudflare.ts
-import {
-  makeTunnelPong as makeTunnelPong2,
-  TUNNEL_PROTOCOL_VERSION as TUNNEL_PROTOCOL_VERSION2,
-  validateTunnelMessage as validateTunnelMessage2
-} from "@claxedo/workspace-relay-protocol";
 
 // src/directory.ts
+function presenceKey(hostId, workspaceId) {
+  return `${hostId}\0${workspaceId}`;
+}
 function createWorkspaceRelayDirectory(options = {}) {
   const ttlMs = Math.max(1, options.ttlMs ?? 45e3);
   const now = options.now ?? Date.now;
-  const sweepIntervalMs = options.sweepIntervalMs ?? 3e4;
-  const hosts = /* @__PURE__ */ new Map();
-  const alive = (presence) => {
-    if (!presence) return;
+  const entries = /* @__PURE__ */ new Map();
+  const alive = (key) => {
+    const presence = entries.get(key);
+    if (!presence) return void 0;
     if (presence.expiresAt <= now()) {
-      hosts.delete(presence.hostId);
-      return;
+      entries.delete(key);
+      return void 0;
     }
     return presence;
   };
-  const touch = (presence) => {
-    const timestamp = now();
-    const next = {
-      ...presence,
-      lastPongAt: timestamp,
-      expiresAt: timestamp + ttlMs
-    };
-    hosts.set(next.hostId, next);
-    return next;
-  };
-  const sweep = () => {
-    const at = now();
-    for (const [hostId, presence] of hosts) {
-      if (presence.expiresAt <= at) {
-        hosts.delete(hostId);
-      }
-    }
-  };
-  let intervalHandle;
-  if (sweepIntervalMs > 0) {
-    intervalHandle = setInterval(sweep, sweepIntervalMs);
-  }
+  const keysOf = (hostId) => [...entries].filter(([, presence]) => presence.hostId === hostId).map(([key]) => key);
   return {
     registerHostTunnel(input) {
       const timestamp = now();
@@ -2287,46 +1107,160 @@ function createWorkspaceRelayDirectory(options = {}) {
         lastPongAt: timestamp,
         expiresAt: timestamp + ttlMs
       };
-      hosts.set(next.hostId, next);
+      for (const workspaceId of next.workspaceIds) entries.set(presenceKey(next.hostId, workspaceId), next);
       return next;
     },
     recordPong(hostId) {
-      const presence = alive(hosts.get(hostId));
-      return presence ? touch(presence) : void 0;
+      const timestamp = now();
+      let touched;
+      for (const key of keysOf(hostId)) {
+        const presence = alive(key);
+        if (!presence) continue;
+        const next = { ...presence, lastPongAt: timestamp, expiresAt: timestamp + ttlMs };
+        entries.set(key, next);
+        touched ??= next;
+      }
+      return touched;
     },
     disconnectHost(hostId) {
-      hosts.delete(hostId);
+      for (const key of keysOf(hostId)) entries.delete(key);
     },
     activeHost(input) {
-      const presence = alive(hosts.get(input.hostId));
-      if (!presence?.workspaceIds.includes(input.workspaceId)) return;
-      return presence;
-    },
-    sweep,
-    size() {
-      const at = now();
-      let count = 0;
-      for (const presence of hosts.values()) {
-        if (presence.expiresAt > at) count += 1;
-      }
-      return count;
-    },
-    dispose() {
-      if (intervalHandle !== void 0) {
-        clearInterval(intervalHandle);
-        intervalHandle = void 0;
-      }
+      return alive(presenceKey(input.hostId, input.workspaceId));
+    }
+  };
+}
+
+// src/cors-origins.ts
+var DEFAULT_RELAY_APP_ORIGINS = [
+  "https://claxedo.com",
+  "https://*.claxedo.com"
+];
+var RELAY_ALLOWED_REQUEST_HEADERS = [
+  "Accept",
+  "Authorization",
+  "Content-Type",
+  "Last-Event-ID",
+  "Traceparent",
+  "Tracestate",
+  "X-Fetch-Bypass-Throttle",
+  "X-Workspace-Id",
+  "X-OpenCode-Directory",
+  "X-Claxedo-Runner",
+  "X-Claxedo-Model",
+  "X-Claxedo-Draft-Id",
+  "X-Claxedo-Session-Registration-Operation",
+  "X-Claxedo-Binary"
+].join(", ");
+function parseAllowedOrigins(raw) {
+  const entries = (raw ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+  return entries.length ? entries : void 0;
+}
+function createOriginMatcher(patterns) {
+  const exact = /* @__PURE__ */ new Set();
+  const httpsSuffixes = [];
+  const httpPortPrefixes = [];
+  for (const pattern of patterns) {
+    if (pattern.startsWith("https://*.")) {
+      httpsSuffixes.push(pattern.slice("https://*".length));
+    } else if (pattern.startsWith("http://") && pattern.endsWith(":*")) {
+      httpPortPrefixes.push(pattern.slice(0, -1));
+    } else {
+      exact.add(pattern);
+    }
+  }
+  return (origin) => {
+    if (exact.has(origin)) return true;
+    if (origin.startsWith("https://")) {
+      return httpsSuffixes.some(
+        (suffix) => origin.endsWith(suffix) && origin.length > "https://".length + suffix.length
+      );
+    }
+    if (origin.startsWith("http://")) {
+      return httpPortPrefixes.some(
+        (prefix) => origin.startsWith(prefix) && /^\d+$/.test(origin.slice(prefix.length))
+      );
     }
+    return false;
+  };
+}
+
+// src/relay-cors.ts
+var RELAY_EXPOSED_RESPONSE_HEADERS = "X-Event-Cursor, X-Next-Cursor, X-Max-Event-Ordinal, Server-Timing, X-Claxedo-Trace-Id, X-Claxedo-Relay-Location-Hint";
+var configuredAppOriginAllowed = () => false;
+function setWorkspaceRelayAppOrigins(raw) {
+  configuredAppOriginAllowed = raw?.trim() ? createOriginMatcher(parseAllowedOrigins(raw) ?? []) : () => false;
+}
+var defaultOriginAllowed = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
+var baseOriginAllowed = defaultOriginAllowed;
+function setWorkspaceRelayAllowedOrigins(raw) {
+  const patterns = parseAllowedOrigins(raw);
+  baseOriginAllowed = patterns ? createOriginMatcher(patterns) : defaultOriginAllowed;
+}
+function allowedCorsOrigin(origin) {
+  if (!origin) return void 0;
+  return baseOriginAllowed(origin) || configuredAppOriginAllowed(origin) ? origin : void 0;
+}
+function workspaceUpgradeOriginDenied(request) {
+  const origin = request.headers.get("origin");
+  if (origin === null || allowedCorsOrigin(origin)) return null;
+  return Response.json(errorBody("origin_not_allowed", "Origin is not in the allowlist"), { status: 403 });
+}
+function corsHeaders(request) {
+  const origin = allowedCorsOrigin(request.headers.get("origin"));
+  if (!origin) return void 0;
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
+    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
+    "access-control-expose-headers": RELAY_EXPOSED_RESPONSE_HEADERS,
+    "access-control-max-age": "86400",
+    "timing-allow-origin": origin,
+    vary: "Origin"
   };
 }
-function disposeWorkspaceRelayDirectory(directory) {
-  directory.dispose();
+function corsPreflight(request) {
+  const headers = corsHeaders(request);
+  return new Response(null, { status: headers ? 204 : 403, ...headers ? { headers } : {} });
+}
+var UPSTREAM_OWNED_RESPONSE_HEADERS = [
+  "set-cookie",
+  "access-control-allow-origin",
+  "access-control-allow-credentials",
+  "access-control-allow-headers",
+  "access-control-allow-methods",
+  "access-control-expose-headers",
+  "access-control-max-age"
+];
+var RELAY_DOCUMENT_LOCKDOWN_HEADERS = {
+  "x-content-type-options": "nosniff",
+  "content-security-policy": "sandbox"
+};
+function withRelayResponseHeaders(request, response) {
+  if (response.status === 101 || "webSocket" in response && response.webSocket) return response;
+  const next = new Headers(response.headers);
+  for (const name of UPSTREAM_OWNED_RESPONSE_HEADERS) next.delete(name);
+  for (const [key, value] of Object.entries({ ...RELAY_DOCUMENT_LOCKDOWN_HEADERS, ...corsHeaders(request) })) next.set(key, value);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: next
+  });
 }
 
-// src/cloudflare.ts
+// src/session-host-forwarding.ts
+import { sessionHostRootOf as sessionHostRootOf2 } from "@claxedo/workspace-relay-protocol";
+
+// src/relay-location.ts
+import { trimToUndefined as trimToUndefined2 } from "@claxedo/helpers/string";
+import { sessionHostRootOf } from "@claxedo/workspace-relay-protocol";
 var DEFAULT_RELAY_LOCATION_HINT = "apac";
+var SESSION_HOST_LOCATION_HINT = "enam";
 var RELAY_LOCATION_HINTS = ["wnam", "enam", "sam", "weur", "eeur", "apac", "oc", "afr", "me"];
 var relayLocationHintSet = new Set(RELAY_LOCATION_HINTS);
+function isRelayLocationHint(input) {
+  return relayLocationHintSet.has(input);
+}
 var RELAY_REGION_TO_LOCATION_HINT = {
   // Canonical Claxedo regions.
   "apac-south": "apac",
@@ -2363,46 +1297,157 @@ function locationHintForCountry(country) {
 }
 var RELAY_REGION_HEADER = "x-claxedo-workspace-region";
 function relayLocationHint(input) {
-  const configured = clean(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
-  const region = clean(input.region);
+  const configured = trimToUndefined2(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
+  const region = trimToUndefined2(input.region);
   if (region) {
-    const direct = relayLocationHintSet.has(region.toLowerCase()) ? region.toLowerCase() : void 0;
-    const mapped = direct ?? RELAY_REGION_TO_LOCATION_HINT[region.toLowerCase()];
+    const lowered = region.toLowerCase();
+    const direct = isRelayLocationHint(lowered) ? lowered : void 0;
+    const mapped = direct ?? RELAY_REGION_TO_LOCATION_HINT[lowered];
     if (mapped) return mapped;
   }
-  const country = clean(input.country);
+  const country = trimToUndefined2(input.country);
   if (country) {
     const mapped = locationHintForCountry(country);
     if (mapped) return mapped;
   }
   return configured;
 }
+var RELAY_REGION_QUERY_PARAMS = ["region", "homeRegion"];
 function relayRequestRegion(request) {
   const url = new URL(request.url);
-  return clean(request.headers.get(RELAY_REGION_HEADER)) ?? clean(url.searchParams.get("region")) ?? clean(url.searchParams.get("homeRegion"));
+  return trimToUndefined2(request.headers.get(RELAY_REGION_HEADER)) ?? trimToUndefined2(url.searchParams.get(RELAY_REGION_QUERY_PARAMS[0])) ?? trimToUndefined2(url.searchParams.get(RELAY_REGION_QUERY_PARAMS[1]));
+}
+async function relayRoomPlacement(request, input) {
+  const configured = trimToUndefined2(input.configured);
+  const region = relayRequestRegion(request);
+  const country = relayRequestCountry(request);
+  const floor = relayLocationHint(configured ? { configured } : {});
+  const declared = relayLocationHint({
+    ...configured ? { configured } : {},
+    ...region ? { region } : {},
+    ...country ? { country } : {}
+  });
+  const headers = new Headers(request.headers);
+  headers.delete(RELAY_REGION_HEADER);
+  const credential = await input.credential();
+  const sessionHost = credential !== void 0 && sessionHostRootOf(credential.hostId) !== void 0;
+  return {
+    locationHint: sessionHost ? SESSION_HOST_LOCATION_HINT : credential || declared === floor ? declared : floor,
+    url: withoutQueryParams(request.url, RELAY_REGION_QUERY_PARAMS),
+    headers
+  };
+}
+function withoutQueryParams(url, names) {
+  const target = new URL(url);
+  if (!names.some((name) => target.searchParams.has(name))) return url;
+  const kept = target.search.slice(1).split("&").filter((pair) => !names.includes(pair.split("=")[0] ?? ""));
+  target.search = kept.length ? `?${kept.join("&")}` : "";
+  return target.toString();
 }
 function relayRequestCountry(request) {
   const cf = request.cf;
   return typeof cf?.country === "string" ? cf.country : void 0;
 }
+
+// src/session-host-forwarding.ts
+var SESSION_HOST_LOCATION = { locationHint: SESSION_HOST_LOCATION_HINT };
+var SESSION_HOST_ORIGIN = "https://session-host.invalid";
+function unavailable() {
+  return Response.json(errorBody("session_host_unavailable", "The session host is unavailable"), { status: 503 });
+}
+function isSessionHostTarget(target) {
+  return target.backing === "durable-object";
+}
+async function forwardSessionHostHttp(namespace, request, authorized) {
+  const root = sessionHostRootOf2(authorized.target.hostId);
+  if (!namespace || !root) return unavailable();
+  const url = workspaceRelayTargetUrl({ ...authorized.target, baseUrl: SESSION_HOST_ORIGIN }, authorized.path, new URL(request.url).search);
+  const init = workspaceRelayForwardRequestInit(request, authorized.relayHostToken, authorized.target.workspaceId, { hostTunnel: true });
+  let upstream;
+  try {
+    upstream = await namespace.getByName(root, SESSION_HOST_LOCATION).fetch(url.toString(), init);
+  } catch {
+    return unavailable();
+  }
+  return new Response(upstream.body, { status: upstream.status, statusText: upstream.statusText, headers: upstream.headers });
+}
+
+// src/gateway-placement.ts
+import { createRemoteJWKSet, importSPKI } from "jose";
+import { trimToUndefined as trimToUndefined3 } from "@claxedo/helpers/string";
+var placementAuthKeys = /* @__PURE__ */ new Map();
+function placementAuthKey(env) {
+  const jwksUrl = typeof env.CLAXEDO_CONTROL_PLANE_JWKS_URL === "string" ? trimToUndefined3(env.CLAXEDO_CONTROL_PLANE_JWKS_URL) : void 0;
+  const pem = (typeof env.CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM === "string" ? trimToUndefined3(env.CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM) : void 0)?.replaceAll("\\n", "\n");
+  const id = jwksUrl ? `jwks:${jwksUrl}` : pem ? `pem:${pem}` : void 0;
+  if (!id) return void 0;
+  const cached = placementAuthKeys.get(id);
+  if (cached) return cached;
+  if (placementAuthKeys.size >= 32) placementAuthKeys.clear();
+  const loaded = (async () => {
+    try {
+      if (jwksUrl) return createRemoteJWKSet(new URL(jwksUrl));
+      if (!pem) return void 0;
+      return await importSPKI(pem, "EdDSA");
+    } catch {
+      return void 0;
+    }
+  })();
+  placementAuthKeys.set(id, loaded);
+  return loaded;
+}
+function runtimeAccessTokenFrom(request) {
+  return bearerToken(request.headers.get("authorization") ?? void 0) ?? request.headers.get("sec-websocket-protocol")?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
+}
+async function relayPlacementCredential(request, env, url, workspaceId) {
+  const key = await placementAuthKey(env);
+  if (!key) return void 0;
+  try {
+    if (url.pathname.startsWith("/host-tunnels/")) {
+      const hostId = trimToUndefined3(hostIdFromTunnelPath(url.pathname));
+      const token2 = bearerToken(request.headers.get("authorization"));
+      if (!hostId || !token2) return void 0;
+      await verifyHostTunnelToken(token2, key, { hostId, workspaceIds: workspaceIdsFromSearch(url) });
+      return { hostId };
+    }
+    const token = runtimeAccessTokenFrom(request);
+    if (!token) return void 0;
+    const claims = await verifyRuntimeAccessToken(token, key, { workspaceId });
+    return { hostId: claims.host_id };
+  } catch {
+    return void 0;
+  }
+}
+function workspaceRelayRoomPlacement(request, env, workspaceId) {
+  return relayRoomPlacement(request, {
+    ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
+    credential: () => relayPlacementCredential(request, env, new URL(request.url), workspaceId)
+  });
+}
+
+// src/cloudflare.ts
 var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
 var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
 var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT2 = 16 * 1024 * 1024;
+var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
 var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT2 = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT2 = 3e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2 = 64;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT2 = 8 * 1024 * 1024;
-var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
+var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 8192;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES = 64;
 var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
 var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
+var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
 var TRACE_ID_HEADER = "x-claxedo-trace-id";
 var TRACE_FORCE_HEADER = "x-claxedo-relay-trace";
-function clean(input) {
-  const value = input?.trim();
-  return value ? value : void 0;
+var TRACE_SAMPLED_RESPONSE_HEADER = "x-claxedo-relay-sampled";
+function unrefTimer(timer) {
+  if (typeof timer.unref === "function") timer.unref();
+}
+function isHostTunnelClient(client) {
+  return "channelId" in client && typeof client.channelId === "string";
 }
 function clampRate(input) {
   if (input === void 0 || !Number.isFinite(input)) return 0;
@@ -2411,8 +1456,8 @@ function clampRate(input) {
   return input;
 }
 function traceRequest(request, routeKind, options) {
-  const id = clean(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
-  const forceSecret = clean(options.traceForceHeaderSecret);
+  const id = trimToUndefined4(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+  const forceSecret = trimToUndefined4(options.traceForceHeaderSecret);
   const forced = !!forceSecret && request.headers.get(TRACE_FORCE_HEADER) === forceSecret;
   const rate = clampRate(options.traceSampleRate);
   return {
@@ -2431,37 +1476,38 @@ async function traceSpan(trace, name, fn) {
     trace?.phases.push({ name, ms: performance.now() - startedAt });
   }
 }
-function tracedRequest(request, trace) {
-  const headers2 = new Headers(request.headers);
-  headers2.set(TRACE_ID_HEADER, trace.id);
-  if (trace.sampled) headers2.set("x-claxedo-trace-sampled", "1");
-  else headers2.delete("x-claxedo-trace-sampled");
-  return new Request(request.url, {
+function tracedRequest(request, trace, forwarded = request) {
+  const headers = new Headers(forwarded.headers);
+  headers.set(TRACE_ID_HEADER, trace.id);
+  if (trace.sampled) headers.set("x-claxedo-trace-sampled", "1");
+  else headers.delete("x-claxedo-trace-sampled");
+  return new Request(forwarded.url, {
     method: request.method,
-    headers: headers2,
+    headers,
     body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
     redirect: request.redirect,
     duplex: "half"
   });
 }
-function roundedMs3(value) {
+function roundedMs(value) {
   return Math.round(value * 100) / 100;
 }
 function serverTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs3(phase.ms)}`).join(", ");
+  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
 }
 function withTraceHeaders(response, trace) {
-  const headers2 = new Headers(response.headers);
-  headers2.set(TRACE_ID_HEADER, trace.id);
+  const headers = new Headers(response.headers);
+  headers.set(TRACE_ID_HEADER, trace.id);
   const timing = trace.sampled ? serverTiming(trace) : "";
   if (timing) {
-    const existing = headers2.get("server-timing");
-    headers2.set("server-timing", existing ? `${existing}, ${timing}` : timing);
+    const existing = headers.get("server-timing");
+    headers.set("server-timing", existing ? `${existing}, ${timing}` : timing);
+    headers.set(TRACE_SAMPLED_RESPONSE_HEADER, "1");
   }
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,
-    headers: headers2
+    headers
   });
 }
 function logTrace(options, request, workspaceId, trace, response) {
@@ -2476,8 +1522,8 @@ function logTrace(options, request, workspaceId, trace, response) {
     method: request.method,
     path: url.pathname,
     status: response.status,
-    totalMs: roundedMs3(totalMs),
-    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs3(phase.ms)]))
+    totalMs: roundedMs(totalMs),
+    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs(phase.ms)]))
   };
   if (options.traceLog) {
     options.traceLog(event);
@@ -2488,57 +1534,45 @@ function logTrace(options, request, workspaceId, trace, response) {
 function workspaceIdFromRelayPath(pathname) {
   return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
-function hostIdFromTunnelPath2(pathname) {
-  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function websocketRequest2(request) {
+function websocketRequest(request) {
   return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
-function relayWebSocketTraceEnabled2(request) {
+function relayWebSocketTraceEnabled(request) {
   return request.headers.get("x-claxedo-relay-ws-trace") === "1";
 }
-function workspaceIdsFromSearch(url) {
-  return [...new Set([
-    ...url.searchParams.getAll("workspaceId"),
-    ...url.searchParams.getAll("workspace_id")
-  ].map(clean).filter((item) => !!item))];
-}
 function randomToken() {
   return crypto.randomUUID();
 }
-function headerRecord(headers2) {
-  const result = {};
-  headers2.forEach((value, key) => {
+function headerRecord(headers) {
+  const result = /* @__PURE__ */ Object.create(null);
+  headers.forEach((value, key) => {
     result[key] = value;
   });
   return result;
 }
 function headersFromRecord(input) {
-  const headers2 = new Headers();
-  for (const [key, value] of Object.entries(input)) headers2.set(key, value);
-  return headers2;
+  const headers = new Headers();
+  for (const [key, value] of Object.entries(input)) headers.set(key, value);
+  return headers;
 }
 var BASE64_CHUNK_BYTES = 32768;
 function bytesToBase64(bytes) {
   let binary = "";
   for (let i = 0; i < bytes.length; i += BASE64_CHUNK_BYTES) {
-    binary += String.fromCharCode.apply(
-      null,
-      bytes.subarray(i, i + BASE64_CHUNK_BYTES)
-    );
+    binary += String.fromCharCode(...bytes.subarray(i, i + BASE64_CHUNK_BYTES));
   }
   return btoa(binary);
 }
 function base64ToBytes(input) {
   return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
 }
-function preOpenFrameBytes2(input) {
-  if (typeof input === "string") return new TextEncoder().encode(input).byteLength;
-  return input.byteLength;
+function preOpenFrameBytes(input) {
+  const payload = typeof input === "string" ? new TextEncoder().encode(input).byteLength : input.byteLength;
+  return payload + UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES;
 }
-function blobLike(input) {
-  if (!input || typeof input !== "object") return void 0;
-  return typeof input.arrayBuffer === "function" ? input : void 0;
+function isBlobLike(input) {
+  if (!input || typeof input !== "object") return false;
+  return "arrayBuffer" in input && typeof input.arrayBuffer === "function";
 }
 function viewBytes(input) {
   return new Uint8Array(input.buffer.slice(input.byteOffset, input.byteOffset + input.byteLength));
@@ -2568,9 +1602,8 @@ function socketFrame(input) {
       data_base64: bytesToBase64(viewBytes(input))
     };
   }
-  const blob = blobLike(input);
-  if (!blob) return void 0;
-  return blob.arrayBuffer().then((buffer) => ({
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer().then((buffer) => ({
     binary: true,
     data_base64: bytesToBase64(new Uint8Array(buffer))
   }));
@@ -2580,9 +1613,8 @@ function socketPayload(input) {
   if (input instanceof ArrayBuffer) return input;
   if (input instanceof Uint8Array) return input;
   if (ArrayBuffer.isView(input)) return viewBytes(input);
-  const blob = blobLike(input);
-  if (!blob) return void 0;
-  return blob.arrayBuffer();
+  if (!isBlobLike(input)) return void 0;
+  return input.arrayBuffer();
 }
 function orderedFrameDelivery(deliver) {
   let tail;
@@ -2648,7 +1680,7 @@ async function readRequestBodyCapped(request, maxBytes) {
   }
   return concatBytes(chunks);
 }
-function safeCloseCode2(code, fallback = 1011) {
+function safeCloseCode(code, fallback = 1011) {
   if (code === void 0) return fallback;
   if (code >= 1e3 && code <= 4999 && ![1004, 1005, 1006].includes(code)) return code;
   return fallback;
@@ -2658,63 +1690,25 @@ function workspaceRelayDurableObjectRoomName(workspaceId) {
 }
 function workspaceRelayDurableObjectWorkspaceId(request) {
   const url = new URL(request.url);
-  const workspaceId = clean(workspaceIdFromRelayPath(url.pathname));
+  const workspaceId = trimToUndefined4(workspaceIdFromRelayPath(url.pathname));
   if (workspaceId) return decodeURIComponent(workspaceId);
-  if (!hostIdFromTunnelPath2(url.pathname)) return;
-  return clean(url.searchParams.get("workspaceId")) ?? clean(url.searchParams.get("workspace_id"));
+  if (!hostIdFromTunnelPath(url.pathname)) return void 0;
+  return trimToUndefined4(url.searchParams.get("workspaceId")) ?? trimToUndefined4(url.searchParams.get("workspace_id"));
 }
 function namespaceFromEnv(env, options) {
   if (options.namespace) return options.namespace;
   const binding = env[options.bindingName ?? "WORKSPACE_RELAY_ROOM"];
-  return binding && typeof binding === "object" ? binding : void 0;
+  return isDurableObjectNamespace(binding) ? binding : void 0;
+}
+function isDurableObjectNamespace(value) {
+  if (!value || typeof value !== "object") return false;
+  return "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
 }
 function json(code, message, status) {
   return Response.json(errorBody(code, message), { status });
 }
-var configuredAppOriginAllowed = () => false;
-function setWorkspaceRelayAppOrigins(raw) {
-  configuredAppOriginAllowed = raw?.trim() ? createOriginMatcher(parseAllowedOrigins(raw) ?? []) : () => false;
-}
-var defaultOriginAllowed = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-var baseOriginAllowed = defaultOriginAllowed;
-function setWorkspaceRelayAllowedOrigins(raw) {
-  const patterns = parseAllowedOrigins(raw);
-  baseOriginAllowed = patterns ? createOriginMatcher(patterns) : defaultOriginAllowed;
-}
-function allowedCorsOrigin2(origin) {
-  if (!origin) return;
-  if (baseOriginAllowed(origin)) return origin;
-  if (configuredAppOriginAllowed(origin)) return origin;
-}
-function corsHeaders(request) {
-  const origin = allowedCorsOrigin2(request.headers.get("origin"));
-  if (!origin) return;
-  return {
-    "access-control-allow-origin": origin,
-    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
-    "access-control-max-age": "86400",
-    vary: "Origin"
-  };
-}
-function corsPreflight(request) {
-  const headers2 = corsHeaders(request);
-  return new Response(null, { status: headers2 ? 204 : 403, ...headers2 ? { headers: headers2 } : {} });
-}
-function withCors(request, response) {
-  const headers2 = corsHeaders(request);
-  if (!headers2) return response;
-  if (response.status === 101 || response.webSocket) return response;
-  const next = new Headers(response.headers);
-  for (const [key, value] of Object.entries(headers2)) next.set(key, value);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: next
-  });
-}
 function defaultWebSocketPair() {
-  const pair = new globalThis.WebSocketPair();
+  const pair = new WebSocketPair();
   return {
     client: pair[0],
     server: pair[1]
@@ -2722,7 +1716,7 @@ function defaultWebSocketPair() {
 }
 function selectedSubprotocol(request) {
   const offered = request.headers.get("sec-websocket-protocol")?.split(",").map((item) => item.trim()).filter(Boolean);
-  if (!offered?.length) return;
+  if (!offered?.length) return void 0;
   return offered.find((item) => item.startsWith("claxedo-rat.")) ?? offered[0];
 }
 function upgradeResponse(socket, request) {
@@ -2749,7 +1743,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
   return {
     async fetch(request, env = {}) {
       const gatewayStartedAt = performance.now();
-      const gatewayTraceId = clean(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+      const gatewayTraceId = trimToUndefined4(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
       const url = new URL(request.url);
       if (request.method === "OPTIONS" && (url.pathname.startsWith("/workspaces/") || url.pathname.startsWith("/host-tunnels/"))) {
         return corsPreflight(request);
@@ -2757,13 +1751,6 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       if (url.pathname === "/health") {
         return Response.json({ ok: true, service: "workspace-relay", mode: "cloudflare-durable-object" });
       }
-      const requestRegion = relayRequestRegion(request);
-      const requestCountry = relayRequestCountry(request);
-      const locationHint = relayLocationHint({
-        ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
-        ...requestRegion ? { region: requestRegion } : {},
-        ...requestCountry ? { country: requestCountry } : {}
-      });
       const namespace = namespaceFromEnv(env, options);
       if (!namespace) {
         return json(
@@ -2787,6 +1774,8 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
           url.pathname.startsWith("/workspaces/") || url.pathname.startsWith("/host-tunnels/") ? 400 : 404
         );
       }
+      const placement = await workspaceRelayRoomPlacement(request, env, workspaceId);
+      const locationHint = placement.locationHint;
       const routeFinishedAt = performance.now();
       const response = await namespace.get(namespace.idFromName(workspaceRelayDurableObjectRoomName(workspaceId)), {
         locationHint
@@ -2796,37 +1785,39 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
         startedAt: gatewayStartedAt,
         routeKind: "gateway",
         phases: []
-      }));
+      }, placement));
       const fetchFinishedAt = performance.now();
-      if (response.status === 101 || response.webSocket) {
-        return url.pathname.startsWith("/workspaces/") ? withCors(request, response) : response;
+      if (response.status === 101 || "webSocket" in response && response.webSocket) {
+        return url.pathname.startsWith("/workspaces/") ? withRelayResponseHeaders(request, response) : response;
       }
-      const headers2 = new Headers(response.headers);
-      headers2.set(TRACE_ID_HEADER, headers2.get(TRACE_ID_HEADER) ?? gatewayTraceId);
-      headers2.set("x-claxedo-relay-location-hint", locationHint);
+      const headers = new Headers(response.headers);
+      headers.set(TRACE_ID_HEADER, headers.get(TRACE_ID_HEADER) ?? gatewayTraceId);
+      headers.set("x-claxedo-relay-location-hint", locationHint);
       const gatewayResponseStartedAt = performance.now();
       const tracedResponse = new Response(response.body, {
         status: response.status,
         statusText: response.statusText,
-        headers: headers2
+        headers
       });
       const gatewayFinishedAt = performance.now();
-      const roomTiming = tracedResponse.headers.get("server-timing");
-      if (roomTiming) {
+      const sampled = tracedResponse.headers.get(TRACE_SAMPLED_RESPONSE_HEADER) === "1";
+      tracedResponse.headers.delete(TRACE_SAMPLED_RESPONSE_HEADER);
+      const roomTiming = tracedResponse.headers.get("server-timing") ?? "";
+      if (sampled) {
         const gatewayTiming = [
-          `relay-gateway-route;dur=${roundedMs3(routeFinishedAt - gatewayStartedAt)}`,
-          `relay-gateway-do-fetch;dur=${roundedMs3(fetchFinishedAt - routeFinishedAt)}`,
-          `relay-gateway-response;dur=${roundedMs3(gatewayFinishedAt - gatewayResponseStartedAt)}`,
-          `relay-gateway;dur=${roundedMs3(gatewayFinishedAt - gatewayStartedAt)}`
+          `relay-gateway-route;dur=${roundedMs(routeFinishedAt - gatewayStartedAt)}`,
+          `relay-gateway-do-fetch;dur=${roundedMs(fetchFinishedAt - routeFinishedAt)}`,
+          `relay-gateway-response;dur=${roundedMs(gatewayFinishedAt - gatewayResponseStartedAt)}`,
+          `relay-gateway;dur=${roundedMs(gatewayFinishedAt - gatewayStartedAt)}`
         ].join(", ");
         tracedResponse.headers.set("server-timing", `${roomTiming}, ${gatewayTiming}`);
       }
-      return url.pathname.startsWith("/workspaces/") ? withCors(request, tracedResponse) : tracedResponse;
+      return url.pathname.startsWith("/workspaces/") ? withRelayResponseHeaders(request, tracedResponse) : tracedResponse;
     }
   };
 }
 function createWorkspaceRelayDurableObjectRoom(options) {
-  const directory = options.directory ?? createWorkspaceRelayDirectory({ sweepIntervalMs: 0 });
+  const directory = options.directory ?? createWorkspaceRelayDirectory();
   const relayOptions = { ...options, directory };
   const hostTunnels = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Set();
@@ -2867,6 +1858,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
   };
   const cleanupTunnelResources = (tunnel, reason) => {
+    if (tunnel.generationWatcher) clearInterval(tunnel.generationWatcher);
+    tunnel.generationWatcher = void 0;
     for (const pending of tunnel.pending.values()) {
       clearTimeout(pending.timeout);
       if (pending.stream?.slowConsumerTimeout) clearTimeout(pending.stream.slowConsumerTimeout);
@@ -2899,10 +1892,15 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const attachment = socketAttachment(socket);
       if (!attachment) continue;
       if (attachment.kind === "host-tunnel") {
+        const incumbent = hostTunnels.get(attachment.hostId);
+        if (incumbent && incumbent.connectedAt > attachment.connectedAt) continue;
         hostTunnels.set(attachment.hostId, {
           hostId: attachment.hostId,
           workspaceIds: attachment.workspaceIds,
           connectedAt: attachment.connectedAt,
+          enrollmentId: attachment.enrollmentId,
+          generation: attachment.generation,
+          generationCheckFailures: attachment.generationCheckFailures ?? 0,
           socket,
           pending: /* @__PURE__ */ new Map(),
           channels: /* @__PURE__ */ new Map()
@@ -2918,7 +1916,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     for (const row of clientRows) {
       const tunnel = hostTunnels.get(row.attachment.target.hostId);
       if (!tunnel) {
-        closeSocket(row.socket, 1011, "User-hosted tunnel unavailable");
+        closeSocket(row.socket, 1011, "Host tunnel unavailable");
         continue;
       }
       const client = {
@@ -2953,7 +1951,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   const resolverUnreachable = (code) => code === "relay_revocation_resolver_unavailable";
   const watchRuntimeAccessToken = (client, onInactive) => {
     const intervalMs = options.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
-    if (intervalMs <= 0) return;
+    if (intervalMs <= 0) return void 0;
     const now = options.now ?? Date.now;
     let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
@@ -2969,7 +1967,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         clearInterval(timer);
         onInactive(reason);
       };
-      void Promise.resolve(options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
+      void Promise.resolve().then(() => options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
         if (active.active) {
           consecutiveUnreachable = 0;
           return;
@@ -2983,25 +1981,23 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         onInactive(active.reason);
       }).catch(() => tolerate("Runtime Access Token active check failed"));
     }, intervalMs);
-    if (typeof timer.unref === "function") {
-      timer.unref();
-    }
+    unrefTimer(timer);
     return timer;
   };
-  const watchUserHostedTarget = (client, onInactive) => {
+  const watchHostTunnelTarget = (client, onInactive) => {
     const intervalMs = options.workspaceTargetActiveCheckIntervalMs ?? WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
-    if (intervalMs <= 0) return;
+    if (intervalMs <= 0) return void 0;
     const target = client.request.target;
     let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       void Promise.resolve(options.resolveTarget(client.request.claims)).then((activeTarget) => {
-        if (activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+        if (activeTarget?.backing === "local-worktree" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
           consecutiveUnreachable = 0;
           return;
         }
         consecutiveUnreachable = 0;
         clearInterval(timer);
-        onInactive("User-hosted workspace is offline");
+        onInactive("The machine serving this workspace is offline");
       }).catch(() => {
         consecutiveUnreachable += 1;
         if (consecutiveUnreachable < resolverGraceAttempts) return;
@@ -3009,11 +2005,53 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         onInactive("Workspace relay target active check failed");
       });
     }, intervalMs);
-    if (typeof timer.unref === "function") {
-      timer.unref();
-    }
+    unrefTimer(timer);
     return timer;
   };
+  const hostTunnelAttachment = (tunnel) => ({
+    kind: "host-tunnel",
+    hostId: tunnel.hostId,
+    workspaceIds: tunnel.workspaceIds,
+    connectedAt: tunnel.connectedAt,
+    enrollmentId: tunnel.enrollmentId,
+    generation: tunnel.generation,
+    ...tunnel.generationCheckFailures ? { generationCheckFailures: tunnel.generationCheckFailures } : {}
+  });
+  const recheckHostGeneration = async (tunnel) => {
+    if (hostTunnels.get(tunnel.hostId) !== tunnel) return;
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, {
+      enrollment_id: tunnel.enrollmentId,
+      generation: tunnel.generation
+    });
+    if (hostTunnels.get(tunnel.hostId) !== tunnel) return;
+    if (decision.ok) {
+      if (tunnel.generationCheckFailures === 0) return;
+      tunnel.generationCheckFailures = 0;
+      tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+      return;
+    }
+    if (decision.retryable) {
+      tunnel.generationCheckFailures += 1;
+      if (tunnel.generationCheckFailures < resolverGraceAttempts) {
+        tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+        return;
+      }
+      cleanupHostTunnel(tunnel.hostId, tunnel.socket, "Host generation check unavailable");
+      closeSocket(tunnel.socket, 1012, "Host generation check unavailable");
+      return;
+    }
+    cleanupHostTunnel(tunnel.hostId, tunnel.socket, decision.reason);
+    closeSocket(tunnel.socket, 1008, decision.reason);
+  };
+  const watchHostGeneration = (tunnel) => {
+    const intervalMs = options.hostGenerationCheckIntervalMs ?? HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT;
+    if (tunnel.generationWatcher || hibernation || intervalMs <= 0) return;
+    tunnel.generationWatcher = setInterval(() => {
+      void recheckHostGeneration(tunnel).catch(() => {
+      });
+    }, intervalMs);
+    unrefTimer(tunnel.generationWatcher);
+  };
   const clearSlowConsumerTimer = (pending) => {
     if (!pending.stream?.slowConsumerTimeout) return;
     clearTimeout(pending.stream.slowConsumerTimeout);
@@ -3028,7 +2066,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     pending.stream.flowPaused = paused;
     tunnel.socket.send?.(JSON.stringify({
       type: "http.response.flow",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       request_id: requestId,
       paused,
       reason
@@ -3049,7 +2087,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (pending.stream?.slowConsumerTimeout) return;
     pending.stream.slowConsumerTimeout = setTimeout(
       () => failSlowConsumer(tunnel, requestId, pending),
-      options.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT2
+      options.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT
     );
   };
   const drainPendingStreamChunks = (tunnel, requestId, pending) => {
@@ -3103,7 +2141,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       failPendingTunnelResponse(tunnel, oldestId, oldest, new Error("stream_evicted: tunnel started-stream cap reached"));
     }
   };
-  const resolvePendingTunnelStream = (tunnel, requestId, pending, status, headers2) => {
+  const resolvePendingTunnelStream = (tunnel, requestId, pending, status, headers) => {
     if (pending.stream) return;
     pending.startedSeq = ++startedSeqCounter;
     evictOldestStartedStream(tunnel, requestId);
@@ -3127,18 +2165,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         }
         tunnel.socket.send?.(JSON.stringify({
           type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION2,
+          protocol: TUNNEL_PROTOCOL_VERSION,
           request_id: requestId,
           paused: false,
           reason: "closed"
         }));
       }
     }, new ByteLengthQueuingStrategy({
-      highWaterMark: options.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT2
+      highWaterMark: options.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT
     }));
     pending.resolve(new Response(stream, {
       status,
-      headers: headers2
+      headers
     }));
   };
   const failPendingTunnelResponse = (tunnel, requestId, pending, error) => {
@@ -3184,18 +2222,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const active = await options.isRuntimeAccessTokenActive(client.request.claims);
     return active.active ? { active: true } : { active: false, reason: active.reason };
   };
-  const userHostedTargetActive = async (client) => {
+  const hostTunnelTargetActive = async (client) => {
     const target = client.request.target;
     const activeTarget = await options.resolveTarget(client.request.claims);
-    return !!(activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
+    return !!(activeTarget?.backing === "local-worktree" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
   };
-  const dropUserHostedChannel = (tunnel, channelId, client, code, reason) => {
+  const dropHostTunnelChannel = (tunnel, channelId, client, code, reason) => {
     tunnel.channels.delete(channelId);
     clients.delete(client);
     closeSocket(client.socket, code, reason);
     sendSocket(tunnel.socket, JSON.stringify({
       type: "ws.close",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       channel_id: channelId,
       code,
       reason
@@ -3210,7 +2248,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   const scheduleHibernatedRevocationCheck = async () => {
     const intervalMs = hibernatedRevocationIntervalMs();
     if (!hibernation || !options.alarms || intervalMs <= 0) return;
-    if (clients.size === 0) return;
+    if (clients.size === 0 && hostTunnels.size === 0) return;
     const now = options.now ?? Date.now;
     const at = now() + intervalMs;
     try {
@@ -3224,16 +2262,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     ensureHibernatedSocketsRebuilt();
     const now = options.now ?? Date.now;
     const revoke = (client, reason) => {
-      const channelId = client.channelId;
-      for (const tunnel of hostTunnels.values()) {
-        if (!channelId || tunnel.channels.get(channelId) !== client) continue;
-        dropUserHostedChannel(tunnel, channelId, client, 1008, reason);
-        return;
+      if (isHostTunnelClient(client)) {
+        for (const tunnel of hostTunnels.values()) {
+          if (tunnel.channels.get(client.channelId) !== client) continue;
+          dropHostTunnelChannel(tunnel, client.channelId, client, 1008, reason);
+          return;
+        }
       }
       closeSocket(client.socket, 1008, reason);
       clients.delete(client);
     };
-    for (const client of [...clients]) {
+    for (const client of Array.from(clients)) {
       if (client.request.claims.exp * 1e3 <= now()) {
         revoke(client, "Runtime Access Token expired");
         continue;
@@ -3248,65 +2287,85 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (active.active || resolverUnreachable(active.code)) continue;
       revoke(client, active.reason);
     }
+    for (const tunnel of Array.from(hostTunnels.values())) {
+      await recheckHostGeneration(tunnel);
+    }
     await scheduleHibernatedRevocationCheck();
   };
-  const activeUserHostedClient = (channelId, socket) => {
+  const activeHostTunnelClient = (channelId, socket) => {
     for (const tunnel of hostTunnels.values()) {
       const client = tunnel.channels.get(channelId);
       if (client?.socket === socket) return { tunnel, client };
     }
+    return void 0;
   };
-  const handleUserHostedClientMessage = async (channelId, socket, data) => {
-    const active = activeUserHostedClient(channelId, socket);
+  const handleHostTunnelClientMessage = async (channelId, socket, data) => {
+    const active = activeHostTunnelClient(channelId, socket);
     if (!active) return;
     const token = await runtimeAccessTokenActive(active.client);
     if (!token.active) {
       closeSocket(socket, 1008, token.reason);
       return;
     }
-    if (!await userHostedTargetActive(active.client)) {
-      closeSocket(socket, 1011, "User-hosted workspace is offline");
+    if (!await hostTunnelTargetActive(active.client)) {
+      closeSocket(socket, 1011, "The machine serving this workspace is offline");
       return;
     }
     const frame = await socketFrame(data);
     if (!frame) return;
     const sent = sendSocket(active.tunnel.socket, JSON.stringify({
       type: "ws.frame",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       channel_id: channelId,
       ...frame
     }));
-    if (!sent) closeSocket(socket, 1011, "User-hosted tunnel unavailable");
+    if (!sent) closeSocket(socket, 1011, "Host tunnel unavailable");
+  };
+  const applyRegistrationUpdate = async (tunnel, workspaceIds, token) => {
+    const hostId = tunnel.hostId;
+    const refuse = (code, reason) => {
+      cleanupHostTunnel(hostId, tunnel.socket, reason);
+      closeSocket(tunnel.socket, code, reason);
+    };
+    let claims;
+    try {
+      claims = await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
+    } catch {
+      if (hostTunnels.get(hostId) === tunnel) refuse(1008, "Host tunnel registration update denied");
+      return;
+    }
+    if (hostTunnels.get(hostId) !== tunnel) return;
+    if (hostTunnelIncumbentOutranks(tunnel.generation, claims.generation)) {
+      refuse(1008, "Host tunnel registration update superseded");
+      return;
+    }
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, claims);
+    if (hostTunnels.get(hostId) !== tunnel) return;
+    if (!decision.ok) {
+      refuse(decision.retryable ? 1012 : 1008, decision.retryable ? "Host generation check unavailable" : decision.reason);
+      return;
+    }
+    tunnel.workspaceIds = workspaceIds;
+    tunnel.enrollmentId = claims.enrollment_id;
+    tunnel.generation = claims.generation;
+    tunnel.socket.serializeAttachment?.(hostTunnelAttachment(tunnel));
+    directory.registerHostTunnel({ hostId, workspaceIds });
+    watchHostGeneration(tunnel);
+    void scheduleHibernatedRevocationCheck();
   };
-  const handleTunnelMessage = async (hostId, event) => {
+  const handleTunnelMessage = async (hostId, socket, event) => {
     const row = parseTunnelMessageData(event.data);
     if (!row.ok) return;
-    const parsed = validateTunnelMessage2(row.value);
+    const parsed = validateTunnelMessage(row.value);
     const tunnel = hostTunnels.get(hostId);
-    if (!parsed.ok || !tunnel) return;
+    if (!parsed.ok || !tunnel || tunnel.socket !== socket) return;
     directory.recordPong(tunnel.hostId);
     if (parsed.message.type === "ping") {
-      tunnel.socket.send?.(JSON.stringify(makeTunnelPong2(parsed.message)));
+      tunnel.socket.send?.(JSON.stringify(makeTunnelPong(parsed.message)));
       return;
     }
     if (parsed.message.type === "host.registration.update") {
-      const update = parsed.message;
-      const workspaceIds = [...new Set(update.workspace_ids)];
-      try {
-        await verifyHostTunnelToken(update.token, options.runtimeAccessKey, { hostId, workspaceIds });
-      } catch {
-        closeSocket(tunnel.socket, 1008, "Host tunnel registration update denied");
-        return;
-      }
-      if (hostTunnels.get(hostId) !== tunnel) return;
-      tunnel.workspaceIds = workspaceIds;
-      tunnel.socket.serializeAttachment?.({
-        kind: "host-tunnel",
-        hostId,
-        workspaceIds,
-        connectedAt: tunnel.connectedAt
-      });
-      directory.registerHostTunnel({ hostId, workspaceIds });
+      await applyRegistrationUpdate(tunnel, [...new Set(parsed.message.workspace_ids)], parsed.message.token);
       return;
     }
     if (parsed.message.type === "error" && parsed.message.request_id) {
@@ -3331,7 +2390,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!pending) return;
       const chunk = base64ToBytes(message.body_base64);
       if (pending.bytes + chunk.byteLength > (options.tunnelResponseBodyMaxBytes ?? TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT)) {
-        failPendingTunnelResponse(tunnel, message.request_id, pending, new Error("User-hosted response body exceeds the relay limit"));
+        failPendingTunnelResponse(tunnel, message.request_id, pending, hostTunnelFailure("host_tunnel_response_body_too_large"));
         return;
       }
       pending.bytes += chunk.byteLength;
@@ -3377,7 +2436,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         return;
       }
       if (!sendSocket(channel.socket, tunnelFrame(message))) {
-        dropUserHostedChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
+        dropHostTunnelChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
       }
       return;
     }
@@ -3387,7 +2446,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!channel) return;
       tunnel.channels.delete(message.channel_id);
       clients.delete(channel);
-      closeSocket(channel.socket, safeCloseCode2(message.code), message.reason ?? "");
+      closeSocket(channel.socket, safeCloseCode(message.code), message.reason ?? "");
       return;
     }
     if (parsed.message.type === "error" && parsed.message.channel_id) {
@@ -3415,7 +2474,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     hostTunnels.delete(hostId);
     directory.disconnectHost(hostId);
   };
-  const cleanupUserHostedClient = (channelId, socket, event) => {
+  const cleanupHostTunnelClient = (channelId, socket, event) => {
     for (const tunnel of hostTunnels.values()) {
       const active = tunnel.channels.get(channelId);
       if (!active || active.socket !== socket) continue;
@@ -3423,17 +2482,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       clients.delete(active);
       sendSocket(tunnel.socket, JSON.stringify({
         type: "ws.close",
-        protocol: TUNNEL_PROTOCOL_VERSION2,
+        protocol: TUNNEL_PROTOCOL_VERSION,
         channel_id: channelId,
-        code: safeCloseCode2(event?.code, 1e3),
+        code: safeCloseCode(event?.code, 1e3),
         reason: event?.reason ?? "Client WebSocket closed"
       }));
       return;
     }
   };
   const admitHostTunnel = async (request, roomWorkspaceId, url) => {
-    if (!websocketRequest2(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
-    const hostId = clean(hostIdFromTunnelPath2(url.pathname));
+    if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
+    const hostId = trimToUndefined4(hostIdFromTunnelPath(url.pathname));
     if (!hostId) return json("host_tunnel_host_required", "Host tunnel id is required", 400);
     const workspaceIds = workspaceIdsFromSearch(url);
     if (!workspaceIds.includes(roomWorkspaceId)) {
@@ -3441,54 +2500,69 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
     const token = bearerToken(request.headers.get("authorization"));
     if (!token) return json("host_tunnel_token_required", "Host Tunnel Token is required", 401);
+    let claims;
     try {
-      await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
+      claims = await verifyHostTunnelToken(token, options.runtimeAccessKey, { hostId, workspaceIds });
     } catch (err) {
       if (err instanceof WorkspaceRelayAuthError) {
         return json(err.code, "Host Tunnel Token was denied", 403);
       }
       throw err;
     }
-    const connectedAt = options.now?.() ?? Date.now();
-    const pair = acceptSocket({
-      kind: "host-tunnel",
-      hostId,
-      workspaceIds,
-      connectedAt
-    });
+    const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, claims);
+    if (!decision.ok) return json(decision.code, decision.reason, decision.retryable ? 503 : 403);
     const previous = hostTunnels.get(hostId);
-    if (previous) {
-      cleanupTunnelResources(previous, "Host tunnel replaced");
-      closeSocket(previous.socket, 1012, "Host tunnel replaced");
+    if (previous && hostTunnelIncumbentOutranks(previous.generation, claims.generation)) {
+      return json("host_generation_superseded", "Host tunnel generation was superseded", 403);
     }
-    hostTunnels.set(hostId, {
+    const connectedAt = options.now?.() ?? Date.now();
+    const fence = {
+      enrollmentId: claims.enrollment_id,
+      generation: claims.generation
+    };
+    const pair = acceptSocket({ kind: "host-tunnel", hostId, workspaceIds, connectedAt, ...fence });
+    const tunnel = {
       hostId,
       workspaceIds,
       connectedAt,
+      ...fence,
+      generationCheckFailures: 0,
       socket: pair.server,
       pending: /* @__PURE__ */ new Map(),
       channels: /* @__PURE__ */ new Map()
-    });
+    };
+    if (previous) {
+      cleanupTunnelResources(previous, "Host tunnel replaced");
+      closeSocket(previous.socket, 1012, "Host tunnel replaced");
+    }
+    hostTunnels.set(hostId, tunnel);
     directory.registerHostTunnel({ hostId, workspaceIds });
+    watchHostGeneration(tunnel);
+    void scheduleHibernatedRevocationCheck();
     if (!hibernation) {
       pair.server.addEventListener?.("message", (event) => {
         if (!event || event.data === void 0) return;
-        void handleTunnelMessage(hostId, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
+        void handleTunnelMessage(hostId, pair.server, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
-      pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
-      pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
+      pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
+      pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
     }
     return upgradeResponse(pair.client, request);
   };
   const admitClient = async (request, workspaceId) => {
-    if (!websocketRequest2(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
+    if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
     const authorized = await authorizeWorkspaceRelayRequest(relayOptions, request, workspaceId);
     if (!authorized.ok) return authorized.response;
-    if (authorized.request.target.access !== "cloud") return admitUserHostedClient(request, authorized.request);
+    const originDenied = workspaceUpgradeOriginDenied(request);
+    if (originDenied) return originDenied;
+    if (isHostTunnelTarget(authorized.request.target)) return admitHostTunnelClient(request, authorized.request);
+    if (isSessionHostTarget(authorized.request.target)) {
+      return json("durable_object_websocket_unsupported", "A session host serves its events over HTTP streams, not WebSockets", 400);
+    }
     return await admitCloudClient(request, authorized.request);
   };
   const admitCloudClient = async (request, authorized) => {
-    const trace = relayWebSocketTraceEnabled2(request) ? { upstreamStartedAt: performance.now(), queueTimes: [], emitted: false } : void 0;
+    const trace = relayWebSocketTraceEnabled(request) ? { upstreamStartedAt: performance.now(), queueTimes: [], emitted: false } : void 0;
     let upstream;
     try {
       upstream = await connectWebSocket(
@@ -3502,7 +2576,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
             new Headers(),
             authorized.relayHostToken,
             authorized.target.workspaceId,
-            { userHosted: false, upstreamHeaders: authorized.target.upstreamHeaders }
+            { hostTunnel: false }
           ))
         }
       );
@@ -3522,9 +2596,9 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       trace.emitted = true;
       sendSocket(pair.server, JSON.stringify({
         type: "relay.trace",
-        wsUpstreamOpenMs: roundedMs3(openedAt - trace.upstreamStartedAt),
+        wsUpstreamOpenMs: roundedMs(openedAt - trace.upstreamStartedAt),
         queuedFrames: trace.queueTimes.length,
-        maxQueuedDelayMs: roundedMs3(trace.queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
+        maxQueuedDelayMs: roundedMs(trace.queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
       }));
     };
     const activeTokenTimer = watchRuntimeAccessToken(client, (reason) => {
@@ -3535,14 +2609,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(upstream, safeCloseCode2(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
+      closeSocket(upstream, safeCloseCode(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
     };
     const cleanupUpstream = (event) => {
       if (closed) return;
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(pair.server, safeCloseCode2(event?.code), event?.reason ?? "");
+      closeSocket(pair.server, safeCloseCode(event?.code), event?.reason ?? "");
     };
     const flushQueue = () => {
       upstreamOpen = true;
@@ -3557,8 +2631,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     };
     const deliverClientFrame = orderedFrameDelivery((payload) => {
       if (!upstreamOpen) {
-        const frameBytes = preOpenFrameBytes2(payload);
-        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT2) && queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT2)) {
+        const frameBytes = preOpenFrameBytes(payload);
+        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) || queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket queue limit exceeded");
           cleanupClient({ code: 1011, reason: "Upstream WebSocket queue limit exceeded" });
           return;
@@ -3585,17 +2659,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (trace && upstreamOpen) emitTrace(upstreamConnectedAt);
     return upgradeResponse(pair.client, request);
   };
-  const admitUserHostedClient = (request, authorized) => {
+  const admitHostTunnelClient = (request, authorized) => {
     const tunnel = hostTunnels.get(authorized.target.hostId);
     if (!tunnel || !directory.activeHost({ hostId: authorized.target.hostId, workspaceId: authorized.target.workspaceId })) {
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     if (tunnel.channels.size >= (options.tunnelChannelCap ?? TUNNEL_CHANNEL_CAP_DEFAULT)) {
-      return json("too_many_channels", "User-hosted tunnel has too many active WebSocket channels", 503);
+      return json("too_many_channels", "Host tunnel has too many active WebSocket channels", 503);
     }
     const channelId = randomToken();
     const pair = acceptSocket({
-      kind: "user-hosted-client",
+      kind: "host-tunnel-client",
       channelId,
       claims: authorized.claims,
       target: authorized.target,
@@ -3612,7 +2686,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTokenTimer = hibernation ? void 0 : watchRuntimeAccessToken(client, (reason) => {
       closeSocket(pair.server, 1008, reason);
     });
-    const activeTargetTimer = hibernation ? void 0 : watchUserHostedTarget(client, (reason) => {
+    const activeTargetTimer = hibernation ? void 0 : watchHostTunnelTarget(client, (reason) => {
       closeSocket(pair.server, 1011, reason);
     });
     if (hibernation) void scheduleHibernatedRevocationCheck();
@@ -3620,18 +2694,18 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const cleanup = (event) => {
         if (activeTokenTimer) clearInterval(activeTokenTimer);
         if (activeTargetTimer) clearInterval(activeTargetTimer);
-        cleanupUserHostedClient(channelId, pair.server, event);
+        cleanupHostTunnelClient(channelId, pair.server, event);
       };
       pair.server.addEventListener?.("message", (event) => {
         if (!event) return;
-        void handleUserHostedClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
+        void handleHostTunnelClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", cleanup);
       pair.server.addEventListener?.("error", cleanup);
     }
     const opened = sendSocket(tunnel.socket, JSON.stringify({
       type: "ws.open",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       channel_id: channelId,
       workspace_id: authorized.target.workspaceId,
       path: authorized.path,
@@ -3639,14 +2713,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         new Headers(),
         authorized.relayHostToken,
         authorized.target.workspaceId,
-        { userHosted: true }
+        { hostTunnel: true }
       ))
     }));
     if (!opened) {
       tunnel.channels.delete(channelId);
       clients.delete(client);
-      closeSocket(pair.server, 1011, "User-hosted tunnel unavailable");
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      closeSocket(pair.server, 1011, "Host tunnel unavailable");
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     return upgradeResponse(pair.client, request);
   };
@@ -3659,9 +2733,13 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       })
     );
     if (!authorized.ok) return authorized.response;
-    if (authorized.request.target.access !== "cloud") {
-      trace && (trace.routeKind = "user-hosted-http");
-      return forwardUserHostedHttp(request, authorized.request, trace);
+    if (isHostTunnelTarget(authorized.request.target)) {
+      trace && (trace.routeKind = "host-tunnel-http");
+      return forwardHostTunnelHttp(request, authorized.request, trace);
+    }
+    if (isSessionHostTarget(authorized.request.target)) {
+      trace && (trace.routeKind = "session-host-http");
+      return traceSpan(trace, "session-host-fetch", () => forwardSessionHostHttp(options.sessionHost, request, authorized.request));
     }
     trace && (trace.routeKind = "cloud-http");
     const controller = new AbortController();
@@ -3674,8 +2752,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           new URL(request.url).search
         ),
         workspaceRelayForwardRequestInit(request, authorized.request.relayHostToken, workspaceId, {
-          signal: controller.signal,
-          upstreamHeaders: authorized.request.target.upstreamHeaders
+          signal: controller.signal
         })
       ));
       return new Response(upstream.body, {
@@ -3696,27 +2773,27 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       clearTimeout(timer);
     }
   };
-  const forwardUserHostedHttp = async (request, authorized, trace) => {
+  const forwardHostTunnelHttp = async (request, authorized, trace) => {
     const tunnel = hostTunnels.get(authorized.target.hostId);
     if (!tunnel || !directory.activeHost({ hostId: authorized.target.hostId, workspaceId: authorized.target.workspaceId })) {
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     const awaitingStart = [...tunnel.pending.values()].filter((entry) => entry.startedSeq === void 0).length;
     if (awaitingStart >= (options.tunnelPendingHttpCap ?? TUNNEL_PENDING_HTTP_CAP_DEFAULT)) {
-      return json("too_many_pending_requests", "User-hosted tunnel has too many pending HTTP requests", 503);
+      return json("too_many_pending_requests", "Host tunnel has too many pending HTTP requests", 503);
     }
     const requestId = randomToken();
     const init = workspaceRelayForwardRequestInit(request, authorized.relayHostToken, authorized.target.workspaceId, {
-      userHosted: true
+      hostTunnel: true
     });
-    const bodyMaxBytes = options.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT2;
+    const bodyMaxBytes = options.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT;
     const contentLength = Number(request.headers.get("content-length") ?? Number.NaN);
     if (Number.isFinite(contentLength) && contentLength > bodyMaxBytes) {
-      return json("request_body_too_large", "User-hosted request body exceeds the relay limit", 413);
+      return json("request_body_too_large", "Host tunnel request body exceeds the relay limit", 413);
     }
     const bodyBytes = request.method === "GET" || request.method === "HEAD" ? void 0 : await traceSpan(trace, "request-body", () => readRequestBodyCapped(request, bodyMaxBytes));
     if (bodyBytes === "too_large") {
-      return json("request_body_too_large", "User-hosted request body exceeds the relay limit", 413);
+      return json("request_body_too_large", "Host tunnel request body exceeds the relay limit", 413);
     }
     const body = bodyBytes ? bytesToBase64(bodyBytes) : void 0;
     const pending = new Promise((resolve, reject) => {
@@ -3724,12 +2801,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         tunnel.pending.delete(requestId);
         tunnel.socket.send?.(JSON.stringify({
           type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION2,
+          protocol: TUNNEL_PROTOCOL_VERSION,
           request_id: requestId,
           paused: false,
           reason: "closed"
         }));
-        reject(new Error("User-hosted tunnel timed out"));
+        reject(hostTunnelFailure("host_tunnel_timeout"));
       }, options.forwardTimeoutMs ?? 3e4);
       tunnel.pending.set(requestId, {
         chunks: [],
@@ -3741,7 +2818,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     });
     tunnel.socket.send?.(JSON.stringify({
       type: "http.request",
-      protocol: TUNNEL_PROTOCOL_VERSION2,
+      protocol: TUNNEL_PROTOCOL_VERSION,
       request_id: requestId,
       workspace_id: authorized.target.workspaceId,
       method: request.method,
@@ -3753,15 +2830,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     try {
       return await traceSpan(trace, "tunnel-wait", () => pending);
     } catch (err) {
-      const timeout = err instanceof Error && err.message.includes("timed out");
-      const responseTooLarge = err instanceof Error && err.message.includes("response body exceeds");
-      return Response.json(
-        errorBody(
-          timeout ? "user_hosted_tunnel_timeout" : responseTooLarge ? "user_hosted_response_body_too_large" : "user_hosted_tunnel_unavailable",
-          timeout ? "User-hosted tunnel timed out" : responseTooLarge ? "User-hosted response body exceeds the relay limit" : "User-hosted tunnel is unavailable"
-        ),
-        { status: responseTooLarge ? 413 : 503 }
-      );
+      return hostTunnelFailureResponse(err);
     }
   };
   return {
@@ -3788,7 +2857,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!roomWorkspaceId) return json("relay_workspace_required", "Workspace Relay requests must include a workspace id", 400);
       if (url.pathname.startsWith("/host-tunnels/")) return admitHostTunnel(request, roomWorkspaceId, url);
       if (url.pathname.startsWith("/workspaces/")) {
-        if (websocketRequest2(request)) return admitClient(request, roomWorkspaceId);
+        if (websocketRequest(request)) return admitClient(request, roomWorkspaceId);
         const trace = traceRequest(request, "workspace-http", options);
         const roomTotalStartedAt = performance.now();
         const nextRequest = tracedRequest(request, trace);
@@ -3796,7 +2865,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         trace.phases.push({ name: "relay-room-total", ms: performance.now() - roomTotalStartedAt });
         const tracedResponse = withTraceHeaders(response, trace);
         logTrace(options, nextRequest, roomWorkspaceId, trace, tracedResponse);
-        return withCors(request, tracedResponse);
+        return withRelayResponseHeaders(request, tracedResponse);
       }
       return json("relay_route_not_found", "Workspace Relay route not found", 404);
     },
@@ -3806,17 +2875,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         const attachment = socketAttachment(socket);
         if (!attachment) return;
         if (attachment.kind === "host-tunnel") {
-          await handleTunnelMessage(attachment.hostId, { data: message });
+          await handleTunnelMessage(attachment.hostId, socket, { data: message });
           return;
         }
-        await handleUserHostedClientMessage(attachment.channelId, socket, message);
+        await handleHostTunnelClientMessage(attachment.channelId, socket, message);
       } catch (err) {
         reportFrameHandlerFailure(socket, err);
       }
     },
     /**
      * Durable Object alarm entry point. Runs the hibernation-safe revocation
-     * sweep (W6b.2). The Worker must forward `alarm()` here.
+     * sweep. The Worker must forward `alarm()` here.
      */
     async alarm() {
       try {
@@ -3830,20 +2899,20 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "User-hosted tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
         return;
       }
-      cleanupUserHostedClient(attachment.channelId, socket, { code, reason });
+      cleanupHostTunnelClient(attachment.channelId, socket, { code, reason });
     },
     webSocketError(socket) {
       ensureHibernatedSocketsRebuilt();
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "User-hosted tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
         return;
       }
-      cleanupUserHostedClient(attachment.channelId, socket, { code: 1011, reason: "WebSocket error" });
+      cleanupHostTunnelClient(attachment.channelId, socket, { code: 1011, reason: "WebSocket error" });
     },
     state() {
       ensureHibernatedSocketsRebuilt();
@@ -3857,55 +2926,222 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     drain: drainController
   };
 }
+
+// ../claxedo-helpers/dist/deadline.mjs
+async function withDeadlineSignal(timeoutMs, work, parent) {
+  const deadline = new AbortController();
+  const timer = setTimeout(() => deadline.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
+  try {
+    return await work(parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/resolver-clients.ts
+function parseRuntimeAccessTokenActiveResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (row.active === true) return { active: true };
+  if (row.active !== false) return void 0;
+  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
+  return { active: false, code: row.code, reason: row.reason };
+}
+function parseHostGenerationResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
+  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
+  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+}
+var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
+var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
+function createHostGenerationResolverLookup(url, options) {
+  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
+  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
+  return async ({ enrollmentId }) => {
+    const target = new URL(url);
+    target.searchParams.set("enrollmentId", enrollmentId);
+    return withDeadlineSignal(timeoutMs, async (signal) => {
+      const res = await fetcher(target, { headers: options.headers, signal });
+      if (res.status === 404) {
+        const body = await res.json().catch(() => void 0);
+        const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+        if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
+        throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
+      }
+      if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
+      const result = parseHostGenerationResult(await res.json());
+      if (!result) throw new Error("relay host-generation resolver returned a malformed result");
+      return result;
+    });
+  };
+}
+var RESOLVER_CACHE_MAX_ENTRIES = 8192;
+var REVOCATION_CACHE_TTL_MS_DEFAULT = 1e4;
+var TARGET_CACHE_TTL_MS_DEFAULT = 1e4;
+var DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT = 30 * 6e4;
+function pruneExpiringCache(cache, now, maxEntries) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= maxEntries) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+function createCachedRevocationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const at = now();
+    const entry = cache.get(args.jti);
+    if (entry && entry.expiresAt > at) {
+      if (entry.result) return entry.result;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((result) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
+      return result;
+    }).catch((err) => {
+      cache.delete(args.jti);
+      throw err;
+    });
+    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
+function runtimeAccessTokenRevocationDelayMs(input = {}) {
+  const configuredTtl = input.revocationCacheTtlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const ttlMs = Number.isFinite(configuredTtl) && configuredTtl > 0 ? configuredTtl : 0;
+  if (input.activeCheckIntervalMs === void 0) return ttlMs;
+  if (!Number.isFinite(input.activeCheckIntervalMs) || input.activeCheckIntervalMs <= 0) {
+    return Number.POSITIVE_INFINITY;
+  }
+  return ttlMs + input.activeCheckIntervalMs;
+}
+function createCachedHostGenerationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    for (; ; ) {
+      const at = now();
+      const entry = cache.get(args.enrollmentId);
+      if (entry && entry.expiresAt > at) {
+        if (entry.result && entry.result.generation >= args.generation) return entry.result;
+        if (!entry.result && entry.promise) {
+          const shared = await entry.promise;
+          if (!shared || shared.generation >= args.generation) return shared;
+          continue;
+        }
+      }
+      const promise = inner(args).then((result) => {
+        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
+        else cache.delete(args.enrollmentId);
+        return result;
+      }).catch((err) => {
+        cache.delete(args.enrollmentId);
+        throw err;
+      });
+      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
+      return await promise;
+    }
+  };
+}
+function createCachedTargetClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? TARGET_CACHE_TTL_MS_DEFAULT;
+  const durableObjectTtlMs = options.durableObjectTtlMs ?? DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const key = `${args.workspaceId}\0${args.hostId}\0${args.routingId ?? ""}`;
+    const at = now();
+    const entry = cache.get(key);
+    if (entry && entry.expiresAt > at) {
+      if (entry.target) return entry.target;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((target) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      if (target) cache.set(key, { target, expiresAt: now() + (target.backing === "durable-object" ? durableObjectTtlMs : ttlMs) });
+      else cache.delete(key);
+      return target;
+    }).catch((err) => {
+      cache.delete(key);
+      throw err;
+    });
+    cache.set(key, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
 export {
   DEFAULT_RELAY_APP_ORIGINS,
   DEFAULT_RELAY_LOCATION_HINT,
+  RELAY_ALLOWED_REQUEST_HEADERS,
   RELAY_LOCATION_HINTS,
   RELAY_REGION_HEADER,
+  RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT,
+  RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS,
+  SESSION_HOST_LOCATION_HINT,
   WorkspaceRelayAuthError,
-  __slowConsumerInternalsForTest,
   authorizeWorkspaceRelayRequest,
   bytesToBase64,
+  checkHostTunnelGeneration,
+  corsPreflight,
+  createCachedHostGenerationClient,
   createCachedRevocationClient,
   createCachedTargetClient,
+  createHostGenerationResolverLookup,
   createOriginMatcher,
-  createWorkspaceRelay,
-  createWorkspaceRelayBun,
   createWorkspaceRelayDirectory,
   createWorkspaceRelayDurableObjectGateway,
   createWorkspaceRelayDurableObjectRoom,
-  createWorkspaceRelayTrace,
-  disposeAuditSampler,
-  disposeWorkspaceRelayDirectory,
-  forwardWorkspaceRelayRequest,
-  getAuditSuppressedCount,
+  deriveRelayHostKid,
+  deriveRelayHostPublicKey,
+  hostTunnelIncumbentOutranks,
   hostTunnelTokenAudience,
-  isRelayClaimPair,
+  isAllowedRelayTargetBaseUrl,
+  isHostGeneration,
+  isRelayBacking,
   mintHostTunnelToken,
   mintRelayHostToken,
   mintRuntimeAccessToken,
   parseAllowedOrigins,
-  relayBufferedBytes,
+  parseRuntimeAccessTokenActiveResult,
+  parseWorkspaceRelayTarget,
+  pruneExpiringCache,
   relayFrameDiagnostics,
+  relayHostInputFromRuntimeClaims,
   relayHostTokenAudience,
   relayHostTokenIssuer,
   relayLocationHint,
-  relayOverBackpressureLimit,
   relayRequestCountry,
   relayRequestRegion,
+  relayRoomPlacement,
   runtimeAccessTokenAudience,
   runtimeAccessTokenIssuer,
+  runtimeAccessTokenRevocationDelayMs,
   setWorkspaceRelayAllowedOrigins,
   setWorkspaceRelayAppOrigins,
+  toChannelIdentityClaim,
+  tokenPurposeClaims,
+  tokenScopeClaims,
+  tokenScopePayload,
   validateRuntimeAccessTokenClaims,
   verifyHostTunnelToken,
   verifyRelayHostToken,
   verifyRuntimeAccessToken,
+  withRelayResponseHeaders,
   workspaceRelayDurableObjectRoomName,
   workspaceRelayDurableObjectWorkspaceId,
   workspaceRelayForwardHeaders,
   workspaceRelayForwardRequestInit,
-  workspaceRelayServerTiming,
+  workspaceRelayRoomPlacement,
   workspaceRelayTargetUrl,
-  workspaceRelayTimingResponse
+  workspaceUpgradeOriginDenied
 };