@claxedo/workspace-relay 0.7.0 → 0.10.0

package/dist/worker.d.ts

@@ -1,6 +1,7 @@
 import { type WorkspaceRelayDurableObjectNamespace, type WorkspaceRelayDurableObjectRoomOptions, type WorkspaceRelayDurableObjectSocket } from "./cloudflare";
-import type { RuntimeAccessTokenActiveResult, WorkspaceRelayTarget } from "./server";
-export type WorkspaceRelayWorkerEnv = Record<string, unknown> & {
+import { type WorkspaceRelayTarget } from "./relay-target";
+import { type HostGenerationLookup, type RuntimeAccessTokenActiveResult } from "./resolver-clients";
+type WorkspaceRelayWorkerBindings = {
     WORKSPACE_RELAY_ROOM?: WorkspaceRelayDurableObjectNamespace;
     CLAXEDO_RELAY_RESOLVER_URL?: string;
     CLAXEDO_CENTRAL_URL?: string;
@@ -18,27 +19,54 @@ export type WorkspaceRelayWorkerEnv = Record<string, unknown> & {
     CLAXEDO_RELAY_TRACE_FORCE_SECRET?: string;
     CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS?: string;
     CLAXEDO_RELAY_TARGET_CACHE_TTL_MS?: string;
+    /**
+     * Absolute URL of the control plane's host-generation lookup. Unset derives
+     * `<resolver base>/host-generation` from the same base `/target` and
+     * `/revocation` are derived from.
+     */
+    CLAXEDO_RELAY_HOST_GENERATION_URL?: string;
+    CLAXEDO_RELAY_HOST_GENERATION_CACHE_TTL_MS?: string;
     CLAXEDO_APP_ORIGINS?: string;
     CLAXEDO_RELAY_ALLOWED_ORIGINS?: string;
 };
+export type WorkspaceRelayWorkerEnv = Record<string, unknown> & WorkspaceRelayWorkerBindings;
 type ResolverClient = {
-    target(workspaceId: string, hostId: string): Promise<WorkspaceRelayTarget | undefined>;
+    target(workspaceId: string, hostId: string, routingId?: string): Promise<WorkspaceRelayTarget | undefined>;
     revocation(args: {
         jti: string;
         workspaceId: string;
         hostId: string;
     }): Promise<RuntimeAccessTokenActiveResult>;
+    hostGeneration: HostGenerationLookup;
 };
 type ResolverFetch = (url: string | URL | Request, init?: RequestInit) => Promise<Response>;
 export declare function workspaceRelayWorkerResolverUrl(env: WorkspaceRelayWorkerEnv): string;
 export declare function workspaceRelayWorkerResolverClient(env: WorkspaceRelayWorkerEnv, fetcher?: ResolverFetch): ResolverClient;
 export declare function workspaceRelayDurableObjectOptions(env: WorkspaceRelayWorkerEnv): Promise<WorkspaceRelayDurableObjectRoomOptions>;
+/**
+ * The `DurableObjectState` workerd hands a room, modelled structurally like the
+ * rest of this package's Cloudflare surface (see `./cloudflare`) — this package
+ * deliberately carries no `@cloudflare/workers-types` dependency.
+ *
+ * Everything is optional because `cloudflare.ts` treats hibernation and alarms
+ * as capabilities to DETECT: an older runtime, or a harness standing in for
+ * one, may provide neither, and the room degrades rather than failing.
+ */
+export type WorkspaceRelayRoomState = {
+    acceptWebSocket?: (socket: WorkspaceRelayDurableObjectSocket) => void;
+    getWebSockets?: () => WorkspaceRelayDurableObjectSocket[];
+    storage?: {
+        getAlarm?: () => Promise<number | null>;
+        setAlarm?: (scheduledTime: number) => Promise<void>;
+        deleteAlarm?: () => Promise<void>;
+    };
+};
 export declare class WorkspaceRelayRoom {
     private state;
     private env;
     private room?;
     private loading?;
-    constructor(state: unknown, env: WorkspaceRelayWorkerEnv);
+    constructor(state: WorkspaceRelayRoomState, env: WorkspaceRelayWorkerEnv);
     private hibernation;
     /**
      * The DO alarm surface, used for the hibernation-safe revocation re-check.

package/dist/workerd-fixture/boot.d.ts

@@ -0,0 +1,18 @@
+import { Miniflare, type MiniflareOptions } from "miniflare";
+/**
+ * Kill this process's workerd children outright. The `afterAll` replacement
+ * for `Miniflare#dispose()`, which must never be called (see header). Only
+ * direct children of this process whose command line names workerd can match,
+ * so nothing outside this test process is touched — and because `bun test`
+ * runs files sequentially, the only children alive when a file's `afterAll`
+ * runs are ones whose tests have already finished.
+ */
+export declare function reapWorkerd(): void;
+/**
+ * Boot workerd once and return the ready Miniflare. Call it exactly once per
+ * test file, from `beforeAll`, with a `workers` array hosting every
+ * configuration the file tests. Do NOT dispose the result — not in `afterAll`,
+ * not anywhere: disposal wedges every later boot in the process (see header).
+ * Tear down with `reapWorkerd()` in `afterAll` instead.
+ */
+export declare function bootWorkerd(options: MiniflareOptions): Promise<Miniflare>;

package/package.json

@@ -1,8 +1,6 @@
 {
-  "name": "@claxedo/workspace-relay",
-  "version": "0.7.0",
   "type": "module",
-  "description": "Relay/tunnel server that routes authenticated traffic to workspace runtimes: JWT workspace tokens, header-stripping trust boundary, Bun and Cloudflare adapters",
+  "description": "Relay/tunnel that routes authenticated traffic to workspace runtimes on Cloudflare: JWT workspace tokens and a header-stripping trust boundary",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -19,16 +17,13 @@
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
+      "development": "./src/index.ts",
+      "bun": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "bun": "./dist/index.mjs",
-      "development": "./dist/index.mjs",
       "import": "./dist/index.mjs",
       "default": "./dist/index.mjs"
     }
   },
-  "bin": {
-    "workspace-relay": "dist/main.mjs"
-  },
   "files": [
     "README.md",
     "LICENSE",
@@ -37,26 +32,20 @@
   "publishConfig": {
     "access": "public"
   },
+  "name": "@claxedo/workspace-relay",
+  "version": "0.10.0",
   "scripts": {
-    "start": "bun run src/main.ts",
-    "dev": "bun run --hot src/main.ts",
     "build": "tsx scripts/build.ts",
     "prepublishOnly": "npm run build",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "typecheck:bench": "tsc --noEmit -p bench/tsconfig.json",
-    "test": "mkdir -p .artifacts/unit && bun test src bench --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml",
-    "bench:gate": "bun bench/local-dry-run.ts",
-    "bench:gate:cf": "bun bench/cf-dev-smoke.ts"
+    "test": "mkdir -p .artifacts/unit && node ../../script/test-deadline.mjs bun test src scripts --path-ignore-patterns='**/relay-workerd-*' --timeout 30000 --reporter=junit --reporter-outfile=.artifacts/unit/junit.xml && node ../../script/test-deadline.mjs bun test src/relay-workerd-backpressure.test.ts src/relay-workerd-binary.test.ts src/relay-workerd-session-host.test.ts --timeout 240000 --reporter=junit --reporter-outfile=.artifacts/unit/junit-workerd.xml"
   },
   "dependencies": {
-    "@claxedo/workspace-relay-protocol": "0.7.0",
-    "hono": "4.10.7",
-    "jose": "6.0.11",
-    "posthog-node": "4.18.0"
+    "@claxedo/helpers": "0.2.0",
+    "@claxedo/workspace-relay-protocol": "0.10.0",
+    "jose": "6.0.11"
   },
   "devDependencies": {
-    "@claxedo/sandbox-manager": "0.7.0",
-    "@daytona/sdk": "0.192.0",
     "@tsconfig/node-lts": "22.0.4",
     "@types/bun": "1.3.13",
     "esbuild": "0.25.12",

package/dist/bun.d.ts

@@ -1,170 +0,0 @@
-import { type WorkspaceRelayOptions } from "./server";
-type RelayClientWebSocketData = {
-    kind: "client";
-    upstreamUrl: string;
-    headers: Record<string, string>;
-    queue: Array<{
-        payload: string | Buffer<ArrayBuffer>;
-        queuedAt: number;
-    }>;
-    /** Running byte size of `queue`; reset when the queue is flushed upstream. */
-    queuedBytes?: number;
-    upstream?: WebSocket;
-    upstreamOpenTimer?: ReturnType<typeof setTimeout>;
-    trace?: RelayClientWebSocketTrace;
-};
-type RelayClientWebSocketTrace = {
-    acceptedAt: number;
-    upstreamStartedAt?: number;
-    upstreamOpenMs?: number;
-    queuedFrames: number;
-    maxQueuedDelayMs: number;
-    emitted: boolean;
-};
-type RelayHostTunnelWebSocketData = {
-    kind: "host-tunnel";
-    hostId: string;
-    workspaceIds: string[];
-    pending: Map<string, PendingTunnelHttpResponse>;
-    channels: Map<string, Bun.ServerWebSocket<RelayUserHostedClientWebSocketData>>;
-    heartbeat?: ReturnType<typeof setInterval>;
-    missedPongs: number;
-    messageBuffer: string;
-};
-type RelayUserHostedClientWebSocketData = {
-    kind: "user-hosted-client";
-    hostId: string;
-    workspaceId: string;
-    channelId: string;
-    path: string;
-    relayHostToken: string;
-};
-type RelayWebSocketData = RelayClientWebSocketData | RelayHostTunnelWebSocketData | RelayUserHostedClientWebSocketData;
-type UpstreamWebSocketConstructor = {
-    new (url: string, options: Bun.WebSocketOptions): WebSocket;
-};
-type PendingTunnelHttpResponse = {
-    controller: ReadableStreamDefaultController<Uint8Array>;
-    stream: ReadableStream<Uint8Array>;
-    resolve: (response: Response) => void;
-    reject: (error: Error) => void;
-    timeout: ReturnType<typeof setTimeout>;
-    pendingChunks: Uint8Array[];
-    bytesQueued: number;
-    slowConsumerTimeout?: ReturnType<typeof setTimeout>;
-    responseStarted: boolean;
-};
-export type WorkspaceRelayHostTunnelOptions = {
-    authorizeHostTunnel?: (request: Request, input: {
-        hostId: string;
-        workspaceIds: string[];
-    }) => boolean | Promise<boolean>;
-    hostTunnelPingIntervalMs?: number;
-    hostTunnelMaxMissedPongs?: number;
-    hostTunnelStateDebounceMs?: number;
-};
-export type WorkspaceRelayBackpressureOptions = {
-    slowConsumerHighWaterMarkBytes?: number;
-    slowConsumerTimeoutMs?: number;
-    tunnelRequestBodyMaxBytes?: number;
-    tunnelHttpResponseTimeoutMs?: number;
-    directHttpTimeoutMs?: number;
-    directHttpConcurrency?: number;
-    upstreamWebSocketOpenTimeoutMs?: number;
-    upstreamWebSocketPreOpenQueueMaxFrames?: number;
-    upstreamWebSocketPreOpenQueueMaxBytes?: number;
-    upstreamWebSocket?: UpstreamWebSocketConstructor;
-    webSocketBufferedAmountMaxBytes?: number;
-};
-export type WorkspaceRelayBunOptions = WorkspaceRelayHostTunnelOptions & WorkspaceRelayBackpressureOptions;
-export type WorkspaceRelayBunTelemetry = {
-    getFragmentationStats(): FragmentationStats;
-    resetFragmentationStats(): void;
-    getSlowConsumerStats(): SlowConsumerStats;
-    resetSlowConsumerStats(): void;
-};
-/**
- * T9: drain controller exposed by `createWorkspaceRelayBun`.
- *
- * On SIGTERM the operator (see `installShutdownDrainHandler` in main.ts)
- * flips `setDraining(true)`; from that point onward the relay
- *   - returns 503 from `/health` so Fly removes the instance from routing
- *   - rejects new HTTP requests with 503 (`relay_draining`) before doing auth
- *   - rejects new host-tunnel WebSocket upgrades with 503
- *   - closes active host tunnels with 1012 so host clients reconnect promptly
- *
- * `pendingCount()` reports the total number of in-flight tunnel HTTP
- * responses across every connected host tunnel — this is what the operator
- * polls via `waitForDrain(timeoutMs)` before hard-closing remaining sockets.
- */
-export type WorkspaceRelayBunDrainController = {
-    isDraining(): boolean;
-    setDraining(value: boolean): void;
-    pendingCount(): number;
-    waitForDrain(timeoutMs: number): Promise<{
-        drained: boolean;
-        remaining: number;
-    }>;
-};
-/**
- * Bytes queued in a socket's send buffer, or `undefined` if it cannot report.
- *
- * Bun spells this `getBufferedAmount()` — a method, not the browser's
- * `bufferedAmount` property. The two guards below used to read the property
- * behind a non-null assertion, which typechecked and then evaluated
- * `undefined > 8388608` forever: neither had ever closed a connection. Measured
- * in `relay-workerd-backpressure.test.ts` at 16.8 MB queued, twice the limit,
- * guard silent.
- *
- * FAILS OPEN on a socket that cannot report, deliberately. Test doubles and any
- * exotic socket must not be closed for lacking the accessor — an unguarded
- * healthy connection beats a guard that kills healthy connections. Note this is
- * also why the same guard is NOT portable to `cloudflare.ts`: workerd's
- * WebSocket exposes no buffer depth in any form, so there it would fail open
- * unconditionally. Bounding the Cloudflare path needs a protocol-level
- * credit/ack window instead.
- */
-export declare const relayBufferedBytes: (socket: unknown) => number | undefined;
-/**
- * True only when the socket reports a depth over the limit. Unknown ⇒ false.
- *
- * Exported for `bun.test.ts`. Forcing a real over-limit buffer through the
- * server's own sockets is not achievable locally — a loopback peer drains far
- * faster than a test can outrun it, which is precisely why the dead guard went
- * unnoticed for so long — so the decision itself is asserted directly.
- */
-export declare const relayOverBackpressureLimit: (socket: unknown, limitBytes: number) => boolean;
-export type FragmentationStats = {
-    fragmentsBuffered: number;
-    oversizedClosed: number;
-};
-export type SlowConsumerStats = {
-    overflowEvents: number;
-    timerFired: number;
-    droppedRequests: number;
-};
-declare function createSlowConsumerStats(): SlowConsumerStats;
-declare function enqueueChunkWithBackpressure(input: {
-    ws: Bun.ServerWebSocket<RelayHostTunnelWebSocketData>;
-    requestId: string;
-    entry: PendingTunnelHttpResponse;
-    chunk: Uint8Array;
-    slowConsumerTimeoutMs: number;
-    slowConsumerStats: SlowConsumerStats;
-}): void;
-export declare const __slowConsumerInternalsForTest: {
-    enqueueChunkWithBackpressure: typeof enqueueChunkWithBackpressure;
-    createSlowConsumerStats: typeof createSlowConsumerStats;
-};
-export declare function createWorkspaceRelayBun(options: WorkspaceRelayOptions, bunOptions?: WorkspaceRelayBunOptions): {
-    fetch(request: Request, server: Bun.Server<RelayWebSocketData>): Promise<Response | undefined>;
-    websocket: {
-        maxPayloadLength: number;
-        message(ws: Bun.ServerWebSocket<RelayWebSocketData>, message: string | Buffer<ArrayBuffer>): void;
-        open(ws: Bun.ServerWebSocket<RelayWebSocketData>): void;
-        close(ws: Bun.ServerWebSocket<RelayWebSocketData>, code: number, reason: string): void;
-    };
-    drain: WorkspaceRelayBunDrainController;
-    telemetry: WorkspaceRelayBunTelemetry;
-};
-export {};

package/dist/main.d.ts

@@ -1,246 +0,0 @@
-import { type WorkspaceRelayBunDrainController } from "./bun";
-import { type WorkspaceRelayDirectory } from "./directory";
-import { type RelayHostPublicKey, type RevocationLookup, type WorkspaceRelayTarget } from "./server";
-import type { RelayKey } from "./auth";
-export { createCachedRevocationClient, createCachedTargetClient } from "./server";
-/**
- * W2c (2026-07-28-001): PostHog is the relay's error sink — one vendor
- * carries error tracking for every runtime behind one distinct_id space.
- *
- * Sending requires two independent opt-ins: `CLAXEDO_TELEMETRY_MODE=on` AND
- * `CLAXEDO_POSTHOG_KEY` (`POSTHOG_KEY` accepted as a fallback — the same
- * unprefixed name claxedo-server's posthog.ts already reads). Any other
- * combination → no `PostHog` client is ever constructed: zero SDK overhead,
- * zero network — a clean no-op safe to ship before the telemetry account
- * exists. Host defaults to `https://us.i.posthog.com` (the canonical ingest
- * host — NOT the legacy `app.posthog.com` default some SDKs ship). Release =
- * git SHA passed by the D11 deploy workflow (`CLAXEDO_RELEASE`; `GIT_SHA`
- * accepted as alias); captures are tagged unit=relay + deployment_mode
- * (absent → "self-host", mirroring D9's default).
- *
- * `posthog-node` runs fine on Bun (`Bun.serve`), unlike the Cloudflare
- * Worker, which keeps it off its import graph entirely (see worker.ts).
- */
-export type RelayObservabilityEnv = {
-    /** Only `on` permits sending, matched case-insensitively after trimming. */
-    CLAXEDO_TELEMETRY_MODE?: string | undefined;
-    CLAXEDO_POSTHOG_KEY?: string | undefined;
-    POSTHOG_KEY?: string | undefined;
-    CLAXEDO_POSTHOG_HOST?: string | undefined;
-    CLAXEDO_RELEASE?: string | undefined;
-    GIT_SHA?: string | undefined;
-    CLAXEDO_DEPLOYMENT_MODE?: string | undefined;
-    /** Accept process.env verbatim (extra keys are ignored). */
-    [key: string]: string | undefined;
-};
-export type RelayTelemetryOptions = {
-    key: string;
-    host: string;
-    release?: string;
-    tags: {
-        unit: "relay";
-        deployment_mode: string;
-    };
-};
-/**
- * Pure env → PostHog options resolver. `undefined` = do NOT construct a client
- * (no client, no network), which is the answer unless BOTH opt-ins are
- * present. The mode is read before the key so that a deployment which has not
- * said `on` stays silent no matter which keys reach its environment.
- * Exported for tests.
- */
-export declare function relayTelemetryOptions(env: RelayObservabilityEnv): RelayTelemetryOptions | undefined;
-export declare function initRelayObservability(env?: RelayObservabilityEnv): {
-    enabled: boolean;
-};
-/**
- * Capture-and-flush used by the fatal handlers and the startup catch. With no
- * initialized client (key absent) this is a documented no-op. Never throws —
- * observability must not preempt the exit path.
- *
- * `distinctId: "system"` mirrors the ops-plane convention: process-fatal
- * events carry no user identity. `client.flush()` has no built-in timeout,
- * so it races a 2s timer; the flush promise's
- * rejection is swallowed even when the timer wins the race, so a slow network
- * failure that resolves after the timeout never surfaces as a second
- * unhandledRejection mid-shutdown.
- */
-export declare function reportFatal(error: unknown): Promise<void>;
-/**
- * Production fail-closed gate for the relay → claxedo-server resolver channel.
- *
- * If `CLAXEDO_RELAY_RESOLVER_TOKEN` is missing/empty in production the relay
- * would otherwise call the resolver unauthenticated. Refuse to boot.
- *
- * Allowed in dev/test for ergonomics — the resolver itself falls back to a
- * loopback-only check when no token is configured.
- */
-export type ValidateProductionEnvInput = {
-    NODE_ENV?: string | undefined;
-    CLAXEDO_RELAY_RESOLVER_TOKEN?: string | undefined;
-};
-export type ValidateProductionEnvResult = {
-    ok: true;
-} | {
-    ok: false;
-    exitCode: 2;
-    message: string;
-};
-export declare function validateProductionEnv(env: ValidateProductionEnvInput): ValidateProductionEnvResult;
-/**
- * Resolve the verification key (or keyset resolver) for Runtime Access Tokens.
- *
- * Precedence: `CLAXEDO_CONTROL_PLANE_JWKS_URL` > `CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM`.
- * The PEM env var is kept as a fallback so JWKS rollouts can ship gradually.
- *
- * Exported for tests.
- */
-export type LoadRuntimeAccessKeyEnv = {
-    CLAXEDO_CONTROL_PLANE_JWKS_URL?: string | undefined;
-    CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM?: string | undefined;
-};
-export declare function loadRuntimeAccessKeyOrJwks(env: LoadRuntimeAccessKeyEnv): Promise<RelayKey>;
-/**
- * Resolve the RHT key material — both the private key used to sign RHTs and
- * the public key(s) we publish at `/.well-known/jwks.json`.
- *
- * Precedence for the public counterpart:
- *   1. `CLAXEDO_RELAY_HOST_PUBLIC_KEY_PEM` (explicit override; useful when
- *      the private key is held in an HSM-style import that strips public bits).
- *   2. Derived from the private key via `exportJWK` (works because we now
- *      load the private key with `extractable: true`).
- *
- * `kid` is the explicit `CLAXEDO_RELAY_HOST_KID` env var if set, otherwise
- * SHA-256(public-key-x).slice(0, 16). Mint and JWKS use the same derivation
- * so they always agree.
- *
- * `next` is optional and is included in JWKS only — never used to mint. It
- * exists to support rolling rotation: publish the next key, drain the
- * current one, swap signing key, retire the old.
- *
- * Exported for tests.
- */
-export type LoadRelayHostKeyMaterialEnv = {
-    /**
-     * Used to gate the production fail-closed check for the RHT signing key.
-     * If `production` and no signing key PEM is configured, the loader exits
-     * with code 2 rather than silently generating an ephemeral key (which
-     * would be different on every instance and break verification across a
-     * multi-instance deploy).
-     *
-     * Note: T2's `validateProductionEnv` is the canonical home for top-level
-     * env validation, but this check lives here because the loader already
-     * inspects the signing-key env var and the failure mode is local. The
-     * boot path could optionally re-route through `validateProductionEnv` in
-     * a future refactor.
-     */
-    NODE_ENV?: string | undefined;
-    CLAXEDO_RELAY_HOST_SIGNING_KEY_PEM?: string | undefined;
-    CLAXEDO_RELAY_HOST_PUBLIC_KEY_PEM?: string | undefined;
-    CLAXEDO_RELAY_HOST_NEXT_PUBLIC_KEY_PEM?: string | undefined;
-    CLAXEDO_RELAY_HOST_KID?: string | undefined;
-    CLAXEDO_RELAY_HOST_NEXT_KID?: string | undefined;
-};
-export type RelayHostKeyMaterial = {
-    privateKey: CryptoKey;
-    current: RelayHostPublicKey;
-    next?: RelayHostPublicKey;
-};
-export declare function loadRelayHostKeyMaterial(env: LoadRelayHostKeyMaterialEnv): Promise<RelayHostKeyMaterial>;
-/**
- * T16: parse `CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE` into a number in [0, 1].
- * Falls back to a NODE_ENV-gated default (production: 0.1, dev/test: 1.0) if
- * unset, empty, or out of range. Exported for tests.
- */
-export type ParseAuditAcceptSampleRateEnv = {
-    CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE?: string | undefined;
-    NODE_ENV?: string | undefined;
-};
-export declare function parseAuditAcceptSampleRate(env: ParseAuditAcceptSampleRateEnv): number;
-/**
- * T31: parse the `CLAXEDO_RELAY_METRICS_TOKEN` env var. Returns `undefined`
- * for missing/empty/whitespace-only values so the relay can fall back to its
- * loopback-only `/metrics` access policy.
- */
-export type ParseMetricsTokenEnv = {
-    CLAXEDO_RELAY_METRICS_TOKEN?: string | undefined;
-};
-export declare function parseMetricsToken(env: ParseMetricsTokenEnv): string | undefined;
-export type RuntimeAccessTokenCacheEnv = {
-    CLAXEDO_RELAY_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS?: string | undefined;
-};
-export declare function runtimeAccessTokenCacheTtlMsFromEnv(env: RuntimeAccessTokenCacheEnv): number;
-export type DirectHttpConcurrencyEnv = {
-    CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY?: string | undefined;
-};
-export declare function directHttpConcurrencyFromEnv(env: DirectHttpConcurrencyEnv): number | undefined;
-export type ResolverClientCacheOptions = {
-    targetCacheTtlMs?: number;
-    revocationCacheTtlMs?: number;
-};
-export type ResolverClientCacheEnv = {
-    CLAXEDO_RELAY_TARGET_CACHE_TTL_MS?: string | undefined;
-    CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS?: string | undefined;
-};
-export declare function resolverClientCacheOptionsFromEnv(env: ResolverClientCacheEnv): ResolverClientCacheOptions;
-export declare function createResolverClient(baseUrl: string, token: string | undefined, options?: ResolverClientCacheOptions): {
-    target: (workspaceId: string, hostId: string) => Promise<WorkspaceRelayTarget | undefined>;
-    revocation: RevocationLookup;
-};
-/**
- * T9: graceful SIGTERM drain wiring.
- *
- * On `SIGTERM` (or `SIGINT` for local dev) the relay must:
- *   1. Flip the drain flag so `/health` reports 503 and Fly removes the
- *      machine from routing, and so new HTTP requests + tunnel registrations
- *      fast-path to 503 before doing any auth or upstream work.
- *   2. Wait up to `drainTimeoutMs` (default 30 s, override via
- *      `CLAXEDO_RELAY_DRAIN_TIMEOUT_MS`) for the in-flight tunnel HTTP
- *      response map to empty across every connected host tunnel.
- *   3. Release the directory's TTL sweep timer (T18 added `dispose()`) so
- *      the process can exit cleanly without a dangling `setInterval`.
- *   4. Exit with code 0.
- *
- * Exposed for tests so the trigger logic can be exercised without actually
- * raising signals or stopping the process. Pass `register: false` in tests
- * to skip the real `process.on(...)` registration.
- */
-export type ShutdownDrainHandlerOptions = {
-    drain: WorkspaceRelayBunDrainController;
-    directory: Pick<WorkspaceRelayDirectory, "dispose">;
-    drainTimeoutMs: number;
-    /** Defaults to `process.exit`. Override for tests. */
-    exit?: (code?: number) => void;
-    /** Defaults to a no-op log. */
-    log?: (message: string) => void;
-    /** When true (default), register `SIGTERM` and `SIGINT` handlers on `process`. */
-    register?: boolean;
-    /** Signals to listen for. Defaults to `["SIGTERM", "SIGINT"]`. */
-    signals?: NodeJS.Signals[];
-    /** Defaults to a no-op (we let Bun.serve get GC'd as part of process exit). */
-    stopServer?: () => Promise<void> | void;
-};
-export type ShutdownDrainHandle = {
-    trigger(): Promise<void>;
-    isShuttingDown(): boolean;
-};
-export declare function installShutdownDrainHandler(options: ShutdownDrainHandlerOptions): ShutdownDrainHandle;
-export type FatalProcessHandlerOptions = {
-    drain: WorkspaceRelayBunDrainController;
-    directory: Pick<WorkspaceRelayDirectory, "dispose">;
-    exit?: (code?: number) => void;
-    log?: (message: string) => void;
-    register?: boolean;
-    /**
-     * W2c: error-tracker hook, invoked (and awaited) before teardown so a fatal
-     * crash reaches PostHog before the process exits. Failures are logged and
-     * never block the exit path. Defaults to none (tests, key-absent runs).
-     */
-    report?: (error: unknown, source: "uncaughtException" | "unhandledRejection") => void | Promise<void>;
-    stopServer?: () => Promise<void> | void;
-};
-export type FatalProcessHandle = {
-    trigger(error: unknown, source: "uncaughtException" | "unhandledRejection"): Promise<void>;
-    isFatal(): boolean;
-};
-export declare function installFatalProcessHandlers(options: FatalProcessHandlerOptions): FatalProcessHandle;