@claxedo/workspace-relay 0.7.0 → 0.8.0

package/dist/main.mjs

@@ -8935,10 +8935,10 @@ var require_abort = __commonJS({
   "../../node_modules/.bun/asynckit@0.4.0/node_modules/asynckit/lib/abort.js"(exports, module) {
     module.exports = abort;
     function abort(state) {
-      Object.keys(state.jobs).forEach(clean2.bind(state));
+      Object.keys(state.jobs).forEach(clean.bind(state));
       state.jobs = {};
     }
-    function clean2(key) {
+    function clean(key) {
       if (typeof this.jobs[key] == "function") {
         this.jobs[key]();
       }
@@ -16548,9 +16548,6 @@ var require_axios = __commonJS({
   }
 });
 
-// src/main.ts
-import { createHash } from "node:crypto";
-
 // ../../node_modules/.bun/posthog-node@4.18.0+302f8eed98f6f908/node_modules/posthog-node/lib/node/index.mjs
 import { posix, dirname, sep } from "path";
 import { createReadStream } from "node:fs";
@@ -20331,12 +20328,12 @@ var PostHog = class extends PostHogBackendClient {
 // src/main.ts
 import {
   createRemoteJWKSet,
-  exportJWK as exportJWK2,
   exportPKCS8,
   generateKeyPair,
   importPKCS8,
   importSPKI
 } from "jose";
+import { trimToUndefined } from "@claxedo/helpers/string";
 
 // src/bun.ts
 import {
@@ -20349,10 +20346,24 @@ import {
 // src/server.ts
 import { Hono } from "hono";
 import { cors } from "hono/cors";
-import { exportJWK } from "jose";
+import { exportJWK as exportJWK2 } from "jose";
+
+// ../claxedo-helpers/dist/guards.mjs
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function asFiniteNumber(value) {
+  return isFiniteNumber(value) ? value : void 0;
+}
+function numberClaim(payload, key) {
+  return asFiniteNumber(payload[key]);
+}
 
 // src/auth.ts
-import { SignJWT, errors, jwtVerify } from "jose";
+import { SignJWT, errors, exportJWK, importJWK, jwtVerify } from "jose";
 var algorithms = ["EdDSA", "ES256", "RS256"];
 var runtimeAccessTokenIssuer = "claxedo-control-plane";
 var runtimeAccessTokenAudience = "workspace-relay";
@@ -20372,25 +20383,51 @@ function seconds(input = Date.now()) {
   return Math.floor(input / 1e3);
 }
 function requireAlgorithm(input) {
-  if (algorithms.includes(input)) return input;
+  const algorithm = algorithms.find((candidate) => candidate === input);
+  if (algorithm) return algorithm;
   throw new WorkspaceRelayAuthError("invalid_relay_token", "Unsupported relay token algorithm");
 }
 function stringClaim(payload, key) {
   const value = payload[key];
   return typeof value === "string" && value.trim() ? value : void 0;
 }
-function numberClaim(payload, key) {
-  const value = payload[key];
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
 function stringArrayClaim(payload, key) {
   const value = payload[key];
   return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value : void 0;
 }
+function isHostGeneration(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function hostGenerationClaims(payload) {
+  const enrollment_id = stringClaim(payload, "enrollment_id");
+  const generation = payload.generation;
+  if (generation === void 0) return enrollment_id ? { enrollment_id } : {};
+  if (!isHostGeneration(generation) || !enrollment_id) return null;
+  return { enrollment_id, generation };
+}
 function roleClaim(payload) {
   const value = stringClaim(payload, "role");
   return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
 }
+function actorProfileClaims(payload) {
+  const actor_public_id = stringClaim(payload, "actor_public_id");
+  const actor_name = stringClaim(payload, "actor_name");
+  const actor_avatar_url = stringClaim(payload, "actor_avatar_url");
+  if (!actor_public_id && !actor_name && !actor_avatar_url) return {};
+  if (!actor_public_id || !actor_name) return void 0;
+  return { actor_public_id, actor_name, ...actor_avatar_url ? { actor_avatar_url } : {} };
+}
+function actorProfilePayload(input) {
+  if (!input.actorPublicId && !input.actorName && !input.actorAvatarUrl) return {};
+  if (!input.actorPublicId || !input.actorName) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Actor display profile claims are incomplete");
+  }
+  return {
+    actor_public_id: input.actorPublicId,
+    actor_name: input.actorName,
+    ...input.actorAvatarUrl ? { actor_avatar_url: input.actorAvatarUrl } : {}
+  };
+}
 function isRelayClaimPair(input) {
   return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
 }
@@ -20411,6 +20448,21 @@ function checkTarget(payload, expected) {
     throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
   }
 }
+async function deriveRelayHostPublicKey(privateKey) {
+  const jwk = await exportJWK(privateKey);
+  const imported = await importJWK({ kty: jwk.kty, crv: jwk.crv, x: jwk.x }, "EdDSA", { extractable: true });
+  if (imported instanceof Uint8Array) {
+    throw new Error("Relay host public key imported as raw bytes; expected an EdDSA public key");
+  }
+  return imported;
+}
+async function deriveRelayHostKid(publicKey) {
+  const jwk = await exportJWK(publicKey);
+  const material = jwk.x ?? jwk.n ?? "";
+  if (!material) throw new Error("Cannot derive kid: public key has no public component");
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(material));
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 16);
+}
 async function verifyJwt(token, key, input) {
   try {
     if (typeof key === "function") {
@@ -20477,28 +20529,40 @@ async function mintRelayHostToken(input, key, alg) {
   const protectedHeader = { alg: requireAlgorithm(alg) };
   if (input.kid) protectedHeader.kid = input.kid;
   return await new SignJWT({
+    principal_kind: input.principalKind,
+    actor_id: input.actorId,
+    actor_kind: input.actorKind,
+    ...actorProfilePayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
     role: input.role,
     access: input.access,
-    backing: input.backing
-  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
+    backing: input.backing,
+    parent_jti: input.parentJti
+  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
 }
 function runtimeClaims(payload) {
   const exp = numberClaim(payload, "exp");
   const iat = numberClaim(payload, "iat");
-  const sub = stringClaim(payload, "sub");
+  const principal_kind = stringClaim(payload, "principal_kind");
+  const actor_id = stringClaim(payload, "actor_id");
+  const actor_kind = stringClaim(payload, "actor_kind");
   const jti2 = stringClaim(payload, "jti");
   const org_id = stringClaim(payload, "org_id");
   const workspace_id = stringClaim(payload, "workspace_id");
   const host_id = stringClaim(payload, "host_id");
   const role = roleClaim(payload);
-  if (!exp || !iat || !sub || !jti2 || !org_id || !workspace_id || !host_id || !role) return;
+  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
+  const actorProfile = actorProfileClaims(payload);
+  if (!actorProfile) return void 0;
   return {
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience,
-    sub,
+    principal_kind,
+    actor_id,
+    actor_kind,
+    ...actorProfile,
     org_id,
     workspace_id,
     host_id,
@@ -20515,13 +20579,15 @@ function hostTunnelClaims(payload) {
   const jti2 = stringClaim(payload, "jti");
   const host_id = stringClaim(payload, "host_id");
   const workspace_ids = stringArrayClaim(payload, "workspace_ids");
-  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length) return;
+  const fence = hostGenerationClaims(payload);
+  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length || fence === null) return void 0;
   return {
     iss: runtimeAccessTokenIssuer,
     aud: hostTunnelTokenAudience,
     sub,
     host_id,
     workspace_ids,
+    ...fence,
     exp,
     iat,
     jti: jti2
@@ -20569,11 +20635,7 @@ function createOriginMatcher(patterns) {
 }
 
 // src/http.ts
-function bearerToken(header) {
-  if (!header) return;
-  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
-  return match?.[1]?.trim() || void 0;
-}
+import { bearerToken } from "@claxedo/helpers/string";
 function errorBody(code, message) {
   return {
     error: {
@@ -20583,7 +20645,76 @@ function errorBody(code, message) {
   };
 }
 
+// src/user-hosted-forwarding.ts
+function isUserHostedTarget(target) {
+  return target.access === "user-hosted";
+}
+
 // src/server.ts
+function parseWorkspaceRelayTarget(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  const { workspaceId, hostId, baseUrl, upstreamHeaders } = row;
+  if (typeof workspaceId !== "string" || typeof hostId !== "string" || typeof baseUrl !== "string") return void 0;
+  if (upstreamHeaders !== void 0 && !isStringRecord(upstreamHeaders)) return void 0;
+  const pair = relayClaimPair(row.access, row.backing);
+  if (!pair) return void 0;
+  return {
+    workspaceId,
+    hostId,
+    baseUrl,
+    ...upstreamHeaders ? { upstreamHeaders } : {},
+    ...pair
+  };
+}
+function parseRuntimeAccessTokenActiveResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (row.active === true) return { active: true };
+  if (row.active !== false) return void 0;
+  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
+  return { active: false, code: row.code, reason: row.reason };
+}
+function parseHostGenerationResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
+  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
+  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+}
+var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
+var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
+function createHostGenerationResolverLookup(url, options) {
+  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
+  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
+  return async ({ enrollmentId }) => {
+    const target = new URL(url);
+    target.searchParams.set("enrollmentId", enrollmentId);
+    const res = await fetcher(target, { headers: options.headers, signal: AbortSignal.timeout(timeoutMs) });
+    if (res.status === 404) {
+      const body = await res.json().catch(() => void 0);
+      const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+      if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
+      throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
+    }
+    if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
+    const result = parseHostGenerationResult(await res.json());
+    if (!result) throw new Error("relay host-generation resolver returned a malformed result");
+    return result;
+  };
+}
+function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
+  if (incumbentGeneration === void 0) return false;
+  return candidateGeneration === void 0 || incumbentGeneration > candidateGeneration;
+}
+function relayClaimPair(access, backing) {
+  if (access === "cloud" && backing === "cloud-vm") return { access, backing };
+  if (access === "user-hosted" && backing === "local-worktree") return { access, backing };
+  return void 0;
+}
+function isStringRecord(input) {
+  return isRecord(input) && Object.values(input).every((value) => typeof value === "string");
+}
 var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
 var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
 var RESOLVER_CACHE_MAX_ENTRIES = 8192;
@@ -20623,6 +20754,71 @@ function createCachedRevocationClient(inner, options = {}) {
     return await promise;
   };
 }
+function createCachedHostGenerationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    for (; ; ) {
+      const at = now();
+      const entry = cache.get(args.enrollmentId);
+      if (entry && entry.expiresAt > at) {
+        if (entry.result && entry.result.generation >= args.generation) return entry.result;
+        if (!entry.result && entry.promise) {
+          const shared = await entry.promise;
+          if (!shared || shared.generation >= args.generation) return shared;
+          continue;
+        }
+      }
+      const promise = inner(args).then((result) => {
+        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
+        else cache.delete(args.enrollmentId);
+        return result;
+      }).catch((err) => {
+        cache.delete(args.enrollmentId);
+        throw err;
+      });
+      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
+      return await promise;
+    }
+  };
+}
+async function checkHostTunnelGeneration(lookup, claims) {
+  if (claims.generation === void 0 || !claims.enrollment_id) return { ok: true };
+  if (!lookup) {
+    return {
+      ok: false,
+      retryable: false,
+      code: "host_generation_unverifiable",
+      reason: "Host tunnel generation cannot be verified by a relay without a host-generation resolver"
+    };
+  }
+  let result;
+  try {
+    result = await lookup({ enrollmentId: claims.enrollment_id, generation: claims.generation });
+  } catch (err) {
+    return {
+      ok: false,
+      retryable: true,
+      code: "host_generation_lookup_unavailable",
+      reason: `Host generation lookup is unavailable: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!result) {
+    return { ok: false, retryable: false, code: "host_enrollment_unknown", reason: "Host enrollment is unknown" };
+  }
+  if (result.revoked) {
+    return { ok: false, retryable: false, code: "host_enrollment_revoked", reason: "Host enrollment was revoked" };
+  }
+  if (result.generation > claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_superseded", reason: "Host tunnel generation was superseded" };
+  }
+  if (result.generation < claims.generation) {
+    return { ok: false, retryable: false, code: "host_generation_unknown", reason: "Host tunnel generation is ahead of the control plane" };
+  }
+  return { ok: true };
+}
 function createCachedTargetClient(inner, options = {}) {
   const ttlMs = options.ttlMs ?? 5e3;
   const now = options.now ?? Date.now;
@@ -20713,11 +20909,9 @@ function targetUrl(target, path, search) {
 }
 var RELAY_VIEWER_DENIED_PATH = /^\/api\/wr\/pty(?:\/|$)/;
 function relayRuntimePath(request) {
-  return new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/");
-}
-function relayAuthorizationPath(path) {
   try {
-    return decodeURIComponent(path);
+    const decoded2 = decodeURIComponent(new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")).replace(/^\/+/, "/");
+    return new URL(decoded2.replace(/^\/+/, ""), "http://relay.invalid/").pathname;
   } catch {
     return void 0;
   }
@@ -20725,8 +20919,7 @@ function relayAuthorizationPath(path) {
 function roleAllowsRelayRequest(role, method, path) {
   if (role === "owner" || role === "admin" || role === "editor") return true;
   if (role === "viewer") {
-    const authorizationPath = relayAuthorizationPath(path);
-    if (!authorizationPath || RELAY_VIEWER_DENIED_PATH.test(authorizationPath)) return false;
+    if (RELAY_VIEWER_DENIED_PATH.test(path)) return false;
     return method === "GET" || method === "HEAD" || method === "OPTIONS";
   }
   return false;
@@ -20740,7 +20933,9 @@ function relayHostTokenCacheTtlMs(options, claims) {
 function relayHostTokenCacheKey(options, claims, target) {
   return [
     claims.jti,
-    claims.sub,
+    claims.principal_kind,
+    claims.actor_id,
+    claims.actor_kind,
     claims.org_id,
     claims.role,
     claims.workspace_id,
@@ -20845,7 +21040,15 @@ async function relayHostTokenFor(options, claims, target, trace) {
   try {
     const token = await trace.span("rht-mint", async () => {
       promise = mintRelayHostToken({
-        subject: claims.sub,
+        principalKind: claims.principal_kind,
+        actorId: claims.actor_id,
+        actorKind: claims.actor_kind,
+        parentJti: claims.jti,
+        ...claims.actor_public_id && claims.actor_name ? {
+          actorPublicId: claims.actor_public_id,
+          actorName: claims.actor_name,
+          ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+        } : {},
         orgId: claims.org_id,
         role: claims.role,
         ...target,
@@ -20869,7 +21072,15 @@ async function uncachedRelayHostTokenFor(options, claims, target, trace) {
   return await trace.span(
     "rht-mint",
     async () => await mintRelayHostToken({
-      subject: claims.sub,
+      principalKind: claims.principal_kind,
+      actorId: claims.actor_id,
+      actorKind: claims.actor_kind,
+      parentJti: claims.jti,
+      ...claims.actor_public_id && claims.actor_name ? {
+        actorPublicId: claims.actor_public_id,
+        actorName: claims.actor_name,
+        ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+      } : {},
       orgId: claims.org_id,
       role: claims.role,
       ...target,
@@ -21008,13 +21219,30 @@ function originMatcherFor(options) {
   }
   return matcher;
 }
+var RELAY_ALLOWED_REQUEST_HEADER_LIST = [
+  "Accept",
+  "Authorization",
+  "Content-Type",
+  "Last-Event-ID",
+  "Traceparent",
+  "Tracestate",
+  "X-Fetch-Bypass-Throttle",
+  "X-Daytona-Skip-Preview-Warning",
+  "X-Workspace-Id",
+  "X-OpenCode-Directory",
+  "X-Claxedo-Runner",
+  "X-Claxedo-Model",
+  "X-Claxedo-Draft-Id",
+  "X-Claxedo-Binary"
+];
+var RELAY_ALLOWED_REQUEST_HEADERS = RELAY_ALLOWED_REQUEST_HEADER_LIST.join(", ");
 function denyCorsHeaders(request, originAllowed = defaultOriginMatcher) {
   const origin = request.headers.get("origin");
   if (!origin) return void 0;
   if (!originAllowed(origin)) return void 0;
   return {
     "access-control-allow-origin": origin,
-    "access-control-allow-headers": "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary",
+    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
     "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
   };
 }
@@ -21024,7 +21252,9 @@ async function deny(options, input) {
     action: "relay.request.denied",
     result: "deny",
     reason: input.code,
-    subject: input.claims?.sub,
+    actorId: input.claims?.actor_id,
+    actorKind: input.claims?.actor_kind,
+    principalKind: input.claims?.principal_kind,
     ...input.claims ? { role: input.claims.role } : {},
     workspaceId: input.claims?.workspace_id,
     hostId: input.claims?.host_id,
@@ -21073,7 +21303,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       };
     }
     const path = relayRuntimePath(request);
-    if (!roleAllowsRelayRequest(claims.role, request.method, path)) {
+    if (!path || !roleAllowsRelayRequest(claims.role, request.method, path)) {
       return {
         ok: false,
         code: "relay_role_denied",
@@ -21100,7 +21330,7 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
         })
       };
     }
-    if (target.access === "user-hosted" && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+    if (isUserHostedTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
       return {
         ok: false,
         code: "user_hosted_app_offline",
@@ -21116,7 +21346,9 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
     await span("audit", async () => await audit(options, {
       action: "relay.request.accepted",
       result: "allow",
-      subject: claims.sub,
+      actorId: claims.actor_id,
+      actorKind: claims.actor_kind,
+      principalKind: claims.principal_kind,
       role: claims.role,
       workspaceId: claims.workspace_id,
       hostId: claims.host_id,
@@ -21199,7 +21431,7 @@ function isLoopbackAddress(address) {
   if (!address) return false;
   const trimmed = address.trim();
   if (LOOPBACK_REMOTES.has(trimmed)) return true;
-  if (/^127\./.test(trimmed)) return true;
+  if (trimmed.startsWith("127.")) return true;
   if (/^::ffff:127\./i.test(trimmed)) return true;
   return false;
 }
@@ -21255,25 +21487,26 @@ function buildMetricsBody(options) {
   return body;
 }
 function createWorkspaceRelay(options) {
-  const app = new Hono();
+  const app = Object.assign(new Hono(), {
+    disposeAuditSampler: () => disposeAuditSampler(options)
+  });
   const originAllowed = originMatcherFor(options);
+  app.use("*", async (c, next) => {
+    await next();
+    const origin = c.res.headers.get("access-control-allow-origin");
+    if (origin && origin !== "*" && !c.res.headers.has("timing-allow-origin")) {
+      c.res.headers.set("timing-allow-origin", origin);
+    }
+  });
   app.use("*", cors({
     origin: (origin) => {
       if (!origin) return void 0;
       return originAllowed(origin) ? origin : void 0;
     },
-    allowHeaders: [
-      "Accept",
-      "Authorization",
-      "Content-Type",
-      "X-Daytona-Skip-Preview-Warning",
-      "X-Workspace-Id",
-      "X-OpenCode-Directory",
-      "X-Claxedo-Runner",
-      "X-Claxedo-Model",
-      "X-Claxedo-Draft-Id",
-      "X-Claxedo-Binary"
-    ],
+    // Spread from the shared list, not hand-maintained here: a duplicate
+    // array drifts out of sync and silently drops headers like
+    // `Last-Event-ID` or `X-Fetch-Bypass-Throttle`.
+    allowHeaders: [...RELAY_ALLOWED_REQUEST_HEADER_LIST],
     allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
   }));
   app.get("/health", (c) => {
@@ -21301,7 +21534,7 @@ function createWorkspaceRelay(options) {
     let keys;
     try {
       keys = await Promise.all(sources.map(async (source) => {
-        const jwk = await exportJWK(source.publicKey);
+        const jwk = await exportJWK2(source.publicKey);
         return {
           ...jwk,
           kid: source.kid,
@@ -21324,7 +21557,6 @@ function createWorkspaceRelay(options) {
     c.header("cache-control", "public, max-age=300");
     return c.json({ keys });
   });
-  app.disposeAuditSampler = () => disposeAuditSampler(options);
   app.get("/metrics", (c) => {
     const authResult = checkMetricsAuth(options, c.req.raw);
     if (!authResult.ok) {
@@ -21362,7 +21594,16 @@ function createWorkspaceRelay(options) {
   return app;
 }
 
+// src/upstream-websocket.ts
+function resolveUpstreamWebSocket(override) {
+  return override ?? WebSocket;
+}
+
 // src/bun.ts
+var WORKSPACE_RELAY_IDLE_TIMEOUT_SECONDS = 45;
+var isRelayClientSocket = (ws) => ws.data.kind === "client";
+var isHostTunnelSocket = (ws) => ws.data.kind === "host-tunnel";
+var isUserHostedClientSocket = (ws) => ws.data.kind === "user-hosted-client";
 var TUNNEL_PENDING_HTTP_CAP = 32;
 var TUNNEL_CHANNEL_CAP = 16;
 var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
@@ -21376,12 +21617,12 @@ var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
 var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
 var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
 var relayBufferedBytes = (socket) => {
-  const method = socket.getBufferedAmount;
-  if (typeof method === "function") {
-    const measured = method.call(socket);
-    if (typeof measured === "number" && Number.isFinite(measured)) return measured;
-    return void 0;
+  if (typeof socket !== "object" || socket === null) return void 0;
+  if ("getBufferedAmount" in socket && typeof socket.getBufferedAmount === "function") {
+    const measured = socket.getBufferedAmount();
+    return typeof measured === "number" && Number.isFinite(measured) ? measured : void 0;
   }
+  if (!("bufferedAmount" in socket)) return void 0;
   const property = socket.bufferedAmount;
   return typeof property === "number" && Number.isFinite(property) ? property : void 0;
 };
@@ -21390,6 +21631,8 @@ var relayOverBackpressureLimit = (socket, limitBytes) => {
   return queued !== void 0 && queued > limitBytes;
 };
 var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
+var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var HOST_GENERATION_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
 var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
 var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
 var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
@@ -21460,8 +21703,8 @@ function jsonError(code, message, status) {
     headers: { "content-type": "application/json" }
   });
 }
-function corsJsonError(request, code, message, status) {
-  const headers2 = relayCorsHeaders(request);
+function corsJsonError(request, originAllowed, code, message, status) {
+  const headers2 = relayCorsHeaders(request, originAllowed);
   headers2.set("content-type", "application/json");
   return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
 }
@@ -21469,7 +21712,7 @@ function preOpenFrameBytes(message) {
   return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
 }
 function safeCloseCode(input, fallback = 1011) {
-  if (!Number.isInteger(input)) return fallback;
+  if (input === void 0 || !Number.isInteger(input)) return fallback;
   const code = input;
   if (code === 1e3) return code;
   if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code;
@@ -21498,6 +21741,18 @@ function workspaceIdFromPath(pathname) {
 function hostIdFromTunnelPath(pathname) {
   return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
+function tunnelKey(hostId, workspaceId) {
+  return `${hostId}\0${workspaceId}`;
+}
+function tunnelIdentity(hostId, workspaceIds) {
+  return `${hostId}\0${[...new Set(workspaceIds)].sort().join(",")}`;
+}
+function ownedWorkspaceIds(hostTunnels, ws) {
+  return ws.data.workspaceIds.filter((workspaceId) => hostTunnels.get(tunnelKey(ws.data.hostId, workspaceId)) === ws);
+}
+function outranks(incumbent, candidateGeneration) {
+  return hostTunnelIncumbentOutranks(incumbent.data.generation, candidateGeneration);
+}
 function websocketRequest(request) {
   return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
@@ -21526,6 +21781,7 @@ function relayWebSocketPayload(input) {
     copy.set(new Uint8Array(input.buffer, input.byteOffset, input.byteLength));
     return copy;
   }
+  return void 0;
 }
 function headersRecord(headers2) {
   const result = {};
@@ -21547,20 +21803,20 @@ function isEventStream(input) {
   );
 }
 var defaultRelayOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-function allowedCorsOrigin(origin) {
-  if (!origin) return;
-  if (defaultRelayOriginMatcher(origin)) return origin;
+function allowedCorsOrigin(origin, matcher) {
+  if (!origin) return void 0;
+  return matcher(origin) ? origin : void 0;
 }
-function requireAllowedOrigin(request) {
+function requireAllowedOrigin(request, matcher) {
   const origin = request.headers.get("origin");
-  if (allowedCorsOrigin(origin)) return null;
+  if (allowedCorsOrigin(origin, matcher)) return null;
   return jsonError(
     "origin_not_allowed",
     "Origin is not in the allowlist",
     403
   );
 }
-function relayCorsHeaders(request, input = new Headers()) {
+function relayCorsHeaders(request, originAllowed, input = new Headers()) {
   const result = new Headers(input);
   result.delete("access-control-allow-origin");
   result.delete("access-control-allow-credentials");
@@ -21568,10 +21824,10 @@ function relayCorsHeaders(request, input = new Headers()) {
   result.delete("access-control-allow-methods");
   result.delete("access-control-expose-headers");
   result.delete("access-control-max-age");
-  const origin = allowedCorsOrigin(request.headers.get("origin"));
+  const origin = allowedCorsOrigin(request.headers.get("origin"), originAllowed);
   if (origin) {
     result.set("access-control-allow-origin", origin);
-    result.set("access-control-allow-headers", "Accept, Authorization, Content-Type, Last-Event-ID, X-Fetch-Bypass-Throttle, X-Daytona-Skip-Preview-Warning, X-Workspace-Id, X-OpenCode-Directory, X-Claxedo-Runner, X-Claxedo-Model, X-Claxedo-Draft-Id, X-Claxedo-Binary");
+    result.set("access-control-allow-headers", RELAY_ALLOWED_REQUEST_HEADERS);
     result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
   }
   return result;
@@ -21599,7 +21855,7 @@ function decodedFrame(frame) {
   return frame.binary ? new Uint8Array(body) : body.toString("utf8");
 }
 function tunnelMessage(ws, input, stats) {
-  if (typeof input !== "string") return;
+  if (typeof input !== "string") return void 0;
   const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
   let parsed;
   try {
@@ -21609,11 +21865,11 @@ function tunnelMessage(ws, input, stats) {
       stats.oversizedClosed += 1;
       ws.data.messageBuffer = "";
       ws.close(1009, "Tunnel message buffer exceeded 4 MB");
-      return;
+      return void 0;
     }
     stats.fragmentsBuffered += 1;
     ws.data.messageBuffer = combined;
-    return;
+    return void 0;
   }
   ws.data.messageBuffer = "";
   const validated = validateTunnelMessage(parsed);
@@ -21621,7 +21877,7 @@ function tunnelMessage(ws, input, stats) {
   if (validated.reason === "protocol_mismatch") {
     ws.close(1002, `Tunnel protocol mismatch: expected ${validated.expected_protocol}`);
   }
-  return;
+  return void 0;
 }
 function sendTunnelPing(ws) {
   if (ws.readyState !== WebSocket.OPEN) return;
@@ -21659,7 +21915,7 @@ function cleanupHostTunnelSocket(input) {
   for (const pending of input.ws.data.pending.values()) {
     failPendingHttpResponse({
       entry: pending,
-      response: input.request ? corsJsonError(input.request, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
+      response: input.request ? corsJsonError(input.request, input.originAllowed, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
       error: new Error("User-hosted tunnel disconnected")
     });
   }
@@ -21669,17 +21925,17 @@ function cleanupHostTunnelSocket(input) {
   }
   input.ws.data.channels.clear();
   if (!input.disconnectDirectory) return;
-  if (input.hostTunnels.get(input.ws.data.hostId) === input.ws) {
-    input.hostTunnels.delete(input.ws.data.hostId);
-    input.options.directory?.disconnectHost(input.ws.data.hostId);
-    scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
-      hostId: input.ws.data.hostId,
-      workspaceId: input.ws.data.workspaceIds[0],
-      path: `/host-tunnels/${input.ws.data.hostId}`,
-      state: "disconnected",
-      debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-    });
-  }
+  const owned = ownedWorkspaceIds(input.hostTunnels, input.ws);
+  if (owned.length === 0) return;
+  for (const workspaceId of owned) input.hostTunnels.delete(tunnelKey(input.ws.data.hostId, workspaceId));
+  input.options.directory?.disconnectHost(input.ws.data.hostId, owned);
+  scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
+    hostId: input.ws.data.hostId,
+    workspaceIds: input.ws.data.workspaceIds,
+    path: `/host-tunnels/${input.ws.data.hostId}`,
+    state: "disconnected",
+    debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
+  });
 }
 async function audit2(options, input) {
   await options.audit?.({
@@ -21691,22 +21947,43 @@ async function audit2(options, input) {
     path: input.path
   });
 }
+async function auditHostTunnelDenial(options, input) {
+  await options.audit?.({
+    action: "host_tunnel.denied",
+    result: "deny",
+    reason: input.code,
+    hostId: input.hostId,
+    ...input.workspaceId ? { workspaceId: input.workspaceId } : {},
+    method: "WEBSOCKET",
+    path: `/host-tunnels/${input.hostId}`
+  });
+}
+async function denyHostTunnel(options, input) {
+  await auditHostTunnelDenial(options, input);
+  return jsonError(input.code, input.message, input.status);
+}
+async function refuseHostTunnelSocket(options, ws, input) {
+  await auditHostTunnelDenial(options, { code: input.code, hostId: ws.data.hostId, ...input.workspaceId ? { workspaceId: input.workspaceId } : {} });
+  closeWebSocket(ws, input.close, input.reason, input.close);
+}
 function scheduleHostTunnelStateChange(state, options, input) {
-  const existing = state.get(input.hostId);
+  const identity = tunnelIdentity(input.hostId, input.workspaceIds);
+  const workspaceId = input.workspaceIds[0];
+  const existing = state.get(identity);
   const entry = existing ?? {
     intendedState: "disconnected",
     lastWritten: "disconnected",
     flushTimer: void 0,
-    pending: { workspaceId: input.workspaceId, path: input.path }
+    pending: { workspaceId, path: input.path }
   };
   entry.intendedState = input.state;
-  entry.pending = { workspaceId: input.workspaceId, path: input.path };
+  entry.pending = { workspaceId, path: input.path };
   if (entry.flushTimer) clearTimeout(entry.flushTimer);
   entry.flushTimer = setTimeout(() => {
     entry.flushTimer = void 0;
     if (entry.intendedState === entry.lastWritten) {
       if (entry.intendedState === "disconnected") {
-        state.delete(input.hostId);
+        state.delete(identity);
       }
       return;
     }
@@ -21718,7 +21995,7 @@ function scheduleHostTunnelStateChange(state, options, input) {
       path: entry.pending.path
     });
   }, input.debounceMs);
-  state.set(input.hostId, entry);
+  state.set(identity, entry);
 }
 function drainPendingChunks(entry) {
   while (entry.pendingChunks.length > 0) {
@@ -21830,7 +22107,7 @@ async function tunnelHttpRequest(input) {
       const error = new Error("User-hosted tunnel response timed out");
       failPendingHttpResponse({
         entry,
-        response: corsJsonError(input.request, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
+        response: corsJsonError(input.request, input.originAllowed, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
         error
       });
     }, input.responseTimeoutMs);
@@ -21842,10 +22119,11 @@ async function tunnelHttpRequest(input) {
       timeout,
       pendingChunks: [],
       bytesQueued: 0,
-      responseStarted: false
+      responseStarted: false,
+      corsHeaders: (upstream) => relayCorsHeaders(input.request, input.originAllowed, upstream)
     });
   });
-  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.requestBodyMaxBytes);
+  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.originAllowed, input.requestBodyMaxBytes);
   if (body && "response" in body) {
     const entry = input.ws.data.pending.get(requestId);
     if (entry) clearPendingTimers(entry);
@@ -21863,8 +22141,8 @@ async function tunnelHttpRequest(input) {
       input.request.headers,
       input.relayHostToken,
       input.workspaceId,
-      // T26: user-hosted tunnel — strip Cookie to avoid leaking browser
-      // cookies to the host process running on the user's laptop.
+      // User-hosted tunnel: strip Cookie so browser cookies never reach the
+      // host process on the user's laptop.
       { userHosted: true }
     )),
     ...body?.bodyBase64 ? { body_base64: body.bodyBase64 } : {},
@@ -21872,7 +22150,7 @@ async function tunnelHttpRequest(input) {
   }));
   return await pending;
 }
-async function readBoundedBody(request, maxBytes) {
+async function readBoundedBody(request, originAllowed, maxBytes) {
   if (!request.body) return void 0;
   const reader = request.body.getReader();
   const chunks = [];
@@ -21887,7 +22165,7 @@ async function readBoundedBody(request, maxBytes) {
       } catch {
       }
       return {
-        response: corsJsonError(request, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
+        response: corsJsonError(request, originAllowed, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
       };
     }
     chunks.push(next.value);
@@ -21909,8 +22187,8 @@ async function directHttpRequest(input) {
       input.relayHostToken,
       input.workspaceId,
       {
-        // T26: cloud-vm direct path. Cookies pass through (default) — workspace
-        // dashboards in the VM may legitimately need session cookies.
+        // Cloud-vm direct path: cookies pass through — workspace dashboards in
+        // the VM may legitimately need session cookies.
         userHosted: false,
         upstreamHeaders: input.upstreamHeaders,
         signal: controller.signal
@@ -21923,10 +22201,21 @@ async function directHttpRequest(input) {
     const release = limiter ? await span("direct-http-queue", () => limiter.acquire()) : void 0;
     try {
       const upstream = await span("upstream-fetch", async () => await fetch(input.targetUrl, init));
-      return new Response(upstream.body, {
+      const headers2 = relayCorsHeaders(input.request, input.originAllowed, upstream.headers);
+      const contentType = upstream.headers.get("content-type") ?? "";
+      const streamResponse = contentType.includes("text/event-stream") || contentType.includes("application/octet-stream");
+      if (streamResponse) {
+        return new Response(upstream.body, {
+          status: upstream.status,
+          statusText: upstream.statusText,
+          headers: headers2
+        });
+      }
+      const body = await upstream.arrayBuffer();
+      return new Response(body, {
         status: upstream.status,
         statusText: upstream.statusText,
-        headers: relayCorsHeaders(input.request, upstream.headers)
+        headers: headers2
       });
     } finally {
       release?.();
@@ -21935,6 +22224,7 @@ async function directHttpRequest(input) {
     const aborted = err instanceof Error && err.name === "AbortError";
     return corsJsonError(
       input.request,
+      input.originAllowed,
       aborted ? "upstream_timeout" : "upstream_unavailable",
       aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable",
       aborted ? 504 : 503
@@ -21943,23 +22233,82 @@ async function directHttpRequest(input) {
     clearTimeout(timer);
   }
 }
-function hostTunnel(hostTunnels, hostId) {
-  const tunnel = hostTunnels.get(hostId);
+function hostTunnel(hostTunnels, hostId, workspaceId) {
+  const tunnel = hostTunnels.get(tunnelKey(hostId, workspaceId));
   if (tunnel?.readyState === WebSocket.OPEN) return tunnel;
   return void 0;
 }
 async function authorizeHostTunnel(options, bunOptions, request, input) {
-  if (bunOptions.authorizeHostTunnel) return await bunOptions.authorizeHostTunnel(request, input);
+  if (bunOptions.authorizeHostTunnel) {
+    return { authorized: await bunOptions.authorizeHostTunnel(request, input) };
+  }
   const token = bearerToken(request.headers.get("authorization"));
-  if (!token) return false;
+  if (!token) return { authorized: false };
   try {
-    await verifyHostTunnelToken(token, options.runtimeAccessKey, input);
-    return true;
+    return { authorized: true, claims: await verifyHostTunnelToken(token, options.runtimeAccessKey, input) };
   } catch (err) {
-    if (err instanceof WorkspaceRelayAuthError) return false;
+    if (err instanceof WorkspaceRelayAuthError) return { authorized: false };
     throw err;
   }
 }
+function clearHostGenerationWatcher(data) {
+  if (data.generationCheckTimer) clearInterval(data.generationCheckTimer);
+  data.generationCheckTimer = void 0;
+}
+function watchHostGeneration(ws, options, bunOptions) {
+  const intervalMs = bunOptions.hostGenerationCheckIntervalMs ?? HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT;
+  if (ws.data.generationCheckTimer || !options.resolveHostGeneration || ws.data.generation === void 0 || intervalMs <= 0) return;
+  const graceAttempts = bunOptions.hostGenerationOutageGraceAttempts ?? HOST_GENERATION_OUTAGE_GRACE_ATTEMPTS_DEFAULT;
+  ws.data.generationCheckTimer = setInterval(() => {
+    void checkHostTunnelGeneration(options.resolveHostGeneration, {
+      enrollment_id: ws.data.enrollmentId,
+      generation: ws.data.generation
+    }).then((decision) => {
+      if (decision.ok) {
+        ws.data.generationCheckFailures = 0;
+        return;
+      }
+      if (!decision.retryable) {
+        clearHostGenerationWatcher(ws.data);
+        closeWebSocket(ws, 1008, decision.reason, 1008);
+        return;
+      }
+      ws.data.generationCheckFailures += 1;
+      if (ws.data.generationCheckFailures < graceAttempts) return;
+      clearHostGenerationWatcher(ws.data);
+      closeWebSocket(ws, 1012, "Host generation check unavailable", 1012);
+    });
+  }, intervalMs);
+  if (typeof ws.data.generationCheckTimer.unref === "function") ws.data.generationCheckTimer.unref();
+}
+var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+function clearClientAccessWatchers(data) {
+  if (data.accessCheckTimer) clearInterval(data.accessCheckTimer);
+  if (data.expiryTimer) clearTimeout(data.expiryTimer);
+  data.accessCheckTimer = void 0;
+  data.expiryTimer = void 0;
+}
+function watchClientAccess(ws, options, bunOptions) {
+  const now = bunOptions.now ?? Date.now;
+  const close = (reason) => {
+    clearClientAccessWatchers(ws.data);
+    closeWebSocket(ws, 1008, reason, 1008);
+  };
+  ws.data.expiryTimer = setTimeout(
+    () => close("Runtime Access Token expired"),
+    Math.max(0, ws.data.claims.exp * 1e3 - now())
+  );
+  if (typeof ws.data.expiryTimer.unref === "function") ws.data.expiryTimer.unref();
+  const intervalMs = bunOptions.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
+  if (!options.isRuntimeAccessTokenActive || intervalMs <= 0) return;
+  ws.data.accessCheckTimer = setInterval(() => {
+    void Promise.resolve(options.isRuntimeAccessTokenActive(ws.data.claims)).then((active) => {
+      if (!active.active) close(active.reason);
+    }).catch(() => {
+    });
+  }, intervalMs);
+  if (typeof ws.data.accessCheckTimer.unref === "function") ws.data.accessCheckTimer.unref();
+}
 function createWorkspaceRelayBun(options, bunOptions = {}) {
   const hostTunnels = /* @__PURE__ */ new Map();
   const relayClients = /* @__PURE__ */ new Set();
@@ -21968,6 +22317,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
   const hostTunnelStateDebounce = /* @__PURE__ */ new Map();
   const fragmentationStats = createFragmentationStats();
   const slowConsumerStats = createSlowConsumerStats();
+  const relayOriginMatcher = options.allowedOrigins ? createOriginMatcher(options.allowedOrigins) : defaultRelayOriginMatcher;
   const telemetry = {
     getFragmentationStats: () => readFragmentationStats(fragmentationStats),
     resetFragmentationStats: () => resetFragmentationStats(fragmentationStats),
@@ -21980,7 +22330,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
     setDraining: (value) => {
       draining = value;
       if (!value) return;
-      for (const tunnel of hostTunnels.values()) {
+      for (const tunnel of new Set(hostTunnels.values())) {
         closeWebSocket(tunnel, 1012, "Workspace relay is draining", 1012);
       }
       for (const client of relayClients) {
@@ -21989,7 +22339,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
     },
     pendingCount: () => {
       let total = 0;
-      for (const tunnel of hostTunnels.values()) {
+      for (const tunnel of new Set(hostTunnels.values())) {
         total += tunnel.data.pending.size;
       }
       return total;
@@ -22028,6 +22378,90 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
     }
     return tracker;
   }
+  function claimTunnelIdentities(ws, workspaceIds) {
+    const hostId = ws.data.hostId;
+    const displaced = /* @__PURE__ */ new Set();
+    for (const workspaceId of workspaceIds) {
+      const previous = hostTunnels.get(tunnelKey(hostId, workspaceId));
+      if (!previous || previous === ws) continue;
+      if (outranks(previous, ws.data.generation)) return workspaceId;
+      displaced.add(previous);
+    }
+    for (const workspaceId of workspaceIds) hostTunnels.set(tunnelKey(hostId, workspaceId), ws);
+    for (const previous of displaced) {
+      if (ownedWorkspaceIds(hostTunnels, previous).length > 0) continue;
+      cleanupHostTunnelSocket({
+        ws: previous,
+        hostTunnels,
+        hostTunnelStateDebounce,
+        options,
+        bunOptions,
+        originAllowed: relayOriginMatcher,
+        disconnectDirectory: false,
+        closeChannels: true
+      });
+      clearHostGenerationWatcher(previous.data);
+      closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
+    }
+    return void 0;
+  }
+  async function applyRegistrationUpdate(hostSocket, workspaceIds, token) {
+    const hostId = hostSocket.data.hostId;
+    const authorizationRequest = new Request(
+      `http://relay.local/host-tunnels/${encodeURIComponent(hostId)}`,
+      { headers: { authorization: `Bearer ${token}` } }
+    );
+    const authorization = await authorizeHostTunnel(options, bunOptions, authorizationRequest, { hostId, workspaceIds });
+    if (!authorization.authorized) {
+      await refuseHostTunnelSocket(options, hostSocket, {
+        code: "host_tunnel_token_invalid",
+        close: 1008,
+        reason: "Host tunnel registration update denied"
+      });
+      return;
+    }
+    const claims = authorization.claims;
+    if (hostTunnelIncumbentOutranks(hostSocket.data.generation, claims?.generation)) {
+      await refuseHostTunnelSocket(options, hostSocket, {
+        code: "host_generation_superseded",
+        close: 1008,
+        reason: "Host tunnel registration update superseded"
+      });
+      return;
+    }
+    const generation = await checkHostTunnelGeneration(options.resolveHostGeneration, {
+      enrollment_id: claims?.enrollment_id,
+      generation: claims?.generation
+    });
+    if (!generation.ok) {
+      await refuseHostTunnelSocket(options, hostSocket, {
+        code: generation.code,
+        close: generation.retryable ? 1012 : 1008,
+        reason: generation.retryable ? "Host generation check unavailable" : generation.reason
+      });
+      return;
+    }
+    const owned = ownedWorkspaceIds(hostTunnels, hostSocket);
+    if (owned.length === 0 || hostSocket.readyState !== WebSocket.OPEN) return;
+    const released = owned.filter((workspaceId) => !workspaceIds.includes(workspaceId));
+    for (const workspaceId of released) hostTunnels.delete(tunnelKey(hostId, workspaceId));
+    if (released.length) options.directory?.disconnectHost(hostId, released);
+    hostSocket.data.enrollmentId = claims?.enrollment_id;
+    hostSocket.data.generation = claims?.generation;
+    const outranked = claimTunnelIdentities(hostSocket, workspaceIds);
+    if (outranked) {
+      await refuseHostTunnelSocket(options, hostSocket, {
+        code: "host_generation_superseded",
+        close: 1008,
+        reason: "Host tunnel generation was superseded",
+        workspaceId: outranked
+      });
+      return;
+    }
+    hostSocket.data.workspaceIds = workspaceIds;
+    options.directory?.registerHostTunnel({ hostId, workspaceIds });
+    watchHostGeneration(hostSocket, options, bunOptions);
+  }
   function pruneReconnects(tracker, now) {
     const cutoff = now - HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS;
     while (tracker.recent.length && tracker.recent[0] < cutoff) {
@@ -22035,7 +22469,14 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
     }
   }
   return {
-    async fetch(request, server) {
+    // A function-valued property rather than a method: `main.ts` hands it
+    // straight to `Bun.serve({ fetch: handler.fetch })`, detached from this
+    // object, and it closes over the adapter's state rather than reading `this`.
+    //
+    // `undefined` is Bun's contract for "this request became a WebSocket":
+    // `server.upgrade()` has already taken ownership of the socket, so there is
+    // no HTTP response left to return.
+    fetch: async (request, server) => {
       const url = new URL(request.url);
       const workspaceId = workspaceIdFromPath(url.pathname);
       const hostId = hostIdFromTunnelPath(url.pathname);
@@ -22058,7 +22499,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         );
       }
       if (draining && workspaceId) {
-        const headers2 = relayCorsHeaders(request);
+        const headers2 = relayCorsHeaders(request, relayOriginMatcher);
         const body = JSON.stringify({
           error: {
             code: "relay_draining",
@@ -22073,32 +22514,63 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         if (!workspaceIds.length || !options.directory) {
           return new Response("Host tunnel registration is unavailable", { status: 503 });
         }
-        if (!await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds })) {
+        const authorization = await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds });
+        if (!authorization.authorized) {
+          await denyHostTunnel(options, { code: "host_tunnel_token_invalid", message: "Host tunnel registration denied", status: 403, hostId });
           return new Response("Host tunnel registration denied", { status: 403 });
         }
+        const claims = authorization.claims;
+        const generation = await checkHostTunnelGeneration(options.resolveHostGeneration, {
+          enrollment_id: claims?.enrollment_id,
+          generation: claims?.generation
+        });
+        if (!generation.ok) {
+          return denyHostTunnel(options, {
+            code: generation.code,
+            message: generation.reason,
+            status: generation.retryable ? 503 : 403,
+            hostId
+          });
+        }
+        for (const workspaceId2 of workspaceIds) {
+          const incumbent = hostTunnels.get(tunnelKey(hostId, workspaceId2));
+          if (incumbent && outranks(incumbent, claims?.generation)) {
+            return denyHostTunnel(options, {
+              code: "host_generation_superseded",
+              message: "Host tunnel generation was superseded",
+              status: 403,
+              hostId,
+              workspaceId: workspaceId2
+            });
+          }
+        }
         const tracker = getRegistrationTracker(hostId);
         const now = Date.now();
         pruneReconnects(tracker, now);
         if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
-          return jsonError(
-            "too_many_host_tunnel_reconnects",
-            "Too many host-tunnel reconnects for this host within the last 60 seconds",
-            429
-          );
+          return denyHostTunnel(options, {
+            code: "too_many_host_tunnel_reconnects",
+            message: "Too many host-tunnel reconnects for this host within the last 60 seconds",
+            status: 429,
+            hostId
+          });
         }
         if (server.upgrade(request, {
           data: {
             kind: "host-tunnel",
             hostId,
             workspaceIds,
+            ...claims?.enrollment_id ? { enrollmentId: claims.enrollment_id } : {},
+            ...claims?.generation !== void 0 ? { generation: claims.generation } : {},
             pending: /* @__PURE__ */ new Map(),
             channels: /* @__PURE__ */ new Map(),
             missedPongs: 0,
-            messageBuffer: ""
+            messageBuffer: "",
+            generationCheckFailures: 0
           }
         })) {
           tracker.recent.push(now);
-          return;
+          return void 0;
         }
         return new Response("WebSocket upgrade failed", { status: 400 });
       }
@@ -22106,7 +22578,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
       if (request.method === "OPTIONS") {
         return new Response(null, {
           status: 204,
-          headers: relayCorsHeaders(request)
+          headers: relayCorsHeaders(request, relayOriginMatcher)
         });
       }
       if (!websocketRequest(request)) {
@@ -22114,11 +22586,12 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         const response = await trace.span("relay-total", async () => {
           const relay2 = await authorizeWorkspaceRelayRequest(options, request, workspaceId, trace);
           if (!relay2.ok) return relay2.response;
-          if (relay2.request.target.access === "user-hosted") {
-            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId);
+          if (isUserHostedTarget(relay2.request.target)) {
+            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId, relay2.request.target.workspaceId);
             return tunnel ? await trace.span("tunnel-http", async () => await tunnelHttpRequest({
               ws: tunnel,
               request,
+              originAllowed: relayOriginMatcher,
               workspaceId: relay2.request.target.workspaceId,
               path: `${relay2.request.path}${url.search}`,
               relayHostToken: relay2.request.relayHostToken,
@@ -22131,6 +22604,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }
           return await directHttpRequest({
             request,
+            originAllowed: relayOriginMatcher,
             targetUrl: workspaceRelayTargetUrl(
               relay2.request.target,
               relay2.request.path,
@@ -22148,10 +22622,10 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
       }
       const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
       if (!relay.ok) return relay.response;
-      const originDenied = requireAllowedOrigin(request);
+      const originDenied = requireAllowedOrigin(request, relayOriginMatcher);
       if (originDenied) return originDenied;
-      if (relay.request.target.access === "user-hosted") {
-        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId);
+      if (isUserHostedTarget(relay.request.target)) {
+        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId, relay.request.target.workspaceId);
         if (!tunnel) {
           return new Response("User-hosted workspace is offline", { status: 503 });
         }
@@ -22165,6 +22639,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         if (server.upgrade(request, {
           data: {
             kind: "user-hosted-client",
+            claims: relay.request.claims,
             hostId: relay.request.target.hostId,
             workspaceId: relay.request.target.workspaceId,
             channelId: crypto.randomUUID(),
@@ -22172,13 +22647,14 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             relayHostToken: relay.request.relayHostToken
           }
         })) {
-          return;
+          return void 0;
         }
         return new Response("WebSocket upgrade failed", { status: 400 });
       }
       if (server.upgrade(request, {
         data: {
           kind: "client",
+          claims: relay.request.claims,
           upstreamUrl: workspaceRelayTargetUrl(
             relay.request.target,
             relay.request.path,
@@ -22188,7 +22664,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             new Headers(),
             relay.request.relayHostToken,
             relay.request.target.workspaceId,
-            // T26: cloud-vm WS upgrade. Cookies pass through (default).
+            // Cloud-vm WS upgrade: cookies pass through.
             { userHosted: false, upstreamHeaders: relay.request.target.upstreamHeaders }
           )),
           queue: [],
@@ -22202,48 +22678,30 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           } : {}
         }
       })) {
-        return;
+        return void 0;
       }
       return new Response("WebSocket upgrade failed", { status: 400 });
     },
     websocket: {
       maxPayloadLength: WS_MAX_PAYLOAD_LENGTH_BYTES,
       message(ws, message) {
-        if (ws.data.kind === "host-tunnel") {
+        if (isHostTunnelSocket(ws)) {
           const parsed = tunnelMessage(
             ws,
             message,
             fragmentationStats
           );
           if (parsed?.type === "ping") {
-            options.directory?.recordPong(ws.data.hostId);
+            options.directory?.recordPong(ws.data.hostId, ownedWorkspaceIds(hostTunnels, ws));
             ws.send(JSON.stringify(makeTunnelPong(parsed)));
           }
           if (parsed?.type === "pong") {
             ws.data.missedPongs = 0;
-            options.directory?.recordPong(ws.data.hostId);
+            options.directory?.recordPong(ws.data.hostId, ownedWorkspaceIds(hostTunnels, ws));
           }
           if (parsed?.type === "host.registration.update") {
-            const update = parsed;
-            const workspaceIds = [...new Set(update.workspace_ids)];
             const hostSocket = ws;
-            const hostId = hostSocket.data.hostId;
-            const authorizationRequest = new Request(
-              `http://relay.local/host-tunnels/${encodeURIComponent(hostId)}`,
-              { headers: { authorization: `Bearer ${update.token}` } }
-            );
-            void authorizeHostTunnel(options, bunOptions, authorizationRequest, {
-              hostId,
-              workspaceIds
-            }).then((authorized) => {
-              if (!authorized) {
-                closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008);
-                return;
-              }
-              if (hostTunnels.get(hostId) !== hostSocket || hostSocket.readyState !== WebSocket.OPEN) return;
-              hostSocket.data.workspaceIds = workspaceIds;
-              options.directory?.registerHostTunnel({ hostId, workspaceIds });
-            }).catch(() => closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008));
+            void applyRegistrationUpdate(hostSocket, [...new Set(parsed.workspace_ids)], parsed.token).catch(() => closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008));
             return;
           }
           if (parsed?.type === "error") {
@@ -22267,7 +22725,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
               if (isEventStream(response.headers)) clearTimeout(pending.timeout);
               pending.resolve(new Response(pending.stream, {
                 status: response.status,
-                headers: headers(response.headers)
+                headers: pending.corsHeaders(headers(response.headers))
               }));
             }
           }
@@ -22335,8 +22793,8 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }
           return;
         }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+        if (isUserHostedClientSocket(ws)) {
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
           if (!tunnel) {
             ws.close(1011, "User-hosted tunnel disconnected");
             return;
@@ -22353,6 +22811,7 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }));
           return;
         }
+        if (!isRelayClientSocket(ws)) return;
         if (ws.data.upstream?.readyState === WebSocket.OPEN) {
           ws.data.upstream.send(message);
           return;
@@ -22367,21 +22826,17 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         ws.data.queue.push({ payload: message, queuedAt: performance.now() });
       },
       open(ws) {
-        if (ws.data.kind === "host-tunnel") {
-          const previous = hostTunnels.get(ws.data.hostId);
-          if (previous && previous !== ws) {
-            cleanupHostTunnelSocket({
-              ws: previous,
-              hostTunnels,
-              hostTunnelStateDebounce,
-              options,
-              bunOptions,
-              disconnectDirectory: false,
-              closeChannels: true
+        if (isHostTunnelSocket(ws)) {
+          const outranked = claimTunnelIdentities(ws, ws.data.workspaceIds);
+          if (outranked) {
+            void refuseHostTunnelSocket(options, ws, {
+              code: "host_generation_superseded",
+              close: 1008,
+              reason: "Host tunnel generation was superseded",
+              workspaceId: outranked
             });
-            closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
+            return;
           }
-          hostTunnels.set(ws.data.hostId, ws);
           options.directory?.registerHostTunnel({
             hostId: ws.data.hostId,
             workspaceIds: ws.data.workspaceIds
@@ -22394,17 +22849,19 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
             }
             sendTunnelPing(hostWs);
           }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
+          watchHostGeneration(ws, options, bunOptions);
           scheduleHostTunnelStateChange(hostTunnelStateDebounce, options, {
             hostId: ws.data.hostId,
-            workspaceId: ws.data.workspaceIds[0],
+            workspaceIds: ws.data.workspaceIds,
             path: `/host-tunnels/${ws.data.hostId}`,
             state: "connected",
             debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
           });
           return;
         }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+        if (isUserHostedClientSocket(ws)) {
+          watchClientAccess(ws, options, bunOptions);
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
           if (!tunnel) {
             ws.close(1011, "User-hosted tunnel disconnected");
             return;
@@ -22424,17 +22881,18 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
               new Headers(),
               ws.data.relayHostToken,
               ws.data.workspaceId,
-              // T26: user-hosted tunnel WS upgrade — strip Cookie. Headers are
-              // empty here today, but pass the flag for consistency in case
-              // upstream client headers are forwarded in the future.
+              // User-hosted tunnel WS upgrade: strip Cookie. Headers are empty
+              // here today; the flag keeps the rule uniform.
               { userHosted: true }
             ))
           }));
           return;
         }
+        if (!isRelayClientSocket(ws)) return;
         relayClients.add(ws);
+        watchClientAccess(ws, options, bunOptions);
         const data = ws.data;
-        const UpstreamWebSocket = bunOptions.upstreamWebSocket ?? WebSocket;
+        const UpstreamWebSocket = resolveUpstreamWebSocket(bunOptions.upstreamWebSocket);
         if (data.trace) data.trace.upstreamStartedAt = performance.now();
         const upstream = new UpstreamWebSocket(data.upstreamUrl, {
           headers: data.headers
@@ -22484,13 +22942,15 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
         };
       },
       close(ws, code, reason) {
-        if (ws.data.kind === "host-tunnel") {
+        if (isHostTunnelSocket(ws)) {
+          clearHostGenerationWatcher(ws.data);
           cleanupHostTunnelSocket({
             ws,
             hostTunnels,
             hostTunnelStateDebounce,
             options,
             bunOptions,
+            originAllowed: relayOriginMatcher,
             disconnectDirectory: true,
             closeChannels: true
           });
@@ -22501,8 +22961,9 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }
           return;
         }
-        if (ws.data.kind === "user-hosted-client") {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId);
+        if (isUserHostedClientSocket(ws)) {
+          clearClientAccessWatchers(ws.data);
+          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
           tunnel?.data.channels.delete(ws.data.channelId);
           if (tunnel?.readyState === WebSocket.OPEN) {
             tunnel.send(JSON.stringify({
@@ -22515,7 +22976,9 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
           }
           return;
         }
+        if (!isRelayClientSocket(ws)) return;
         relayClients.delete(ws);
+        clearClientAccessWatchers(ws.data);
         if (ws.data.upstreamOpenTimer) clearTimeout(ws.data.upstreamOpenTimer);
         if (ws.data.upstream) closeWebSocket(ws.data.upstream, code, reason, 1e3);
       }
@@ -22526,34 +22989,32 @@ function createWorkspaceRelayBun(options, bunOptions = {}) {
 }
 
 // src/directory.ts
+function presenceKey(hostId, workspaceId) {
+  return `${hostId}\0${workspaceId}`;
+}
 function createWorkspaceRelayDirectory(options = {}) {
   const ttlMs = Math.max(1, options.ttlMs ?? 45e3);
   const now = options.now ?? Date.now;
   const sweepIntervalMs = options.sweepIntervalMs ?? 3e4;
-  const hosts = /* @__PURE__ */ new Map();
-  const alive = (presence) => {
-    if (!presence) return;
+  const entries = /* @__PURE__ */ new Map();
+  const alive = (key) => {
+    const presence = entries.get(key);
+    if (!presence) return void 0;
     if (presence.expiresAt <= now()) {
-      hosts.delete(presence.hostId);
-      return;
+      entries.delete(key);
+      return void 0;
     }
     return presence;
   };
-  const touch = (presence) => {
-    const timestamp = now();
-    const next = {
-      ...presence,
-      lastPongAt: timestamp,
-      expiresAt: timestamp + ttlMs
-    };
-    hosts.set(next.hostId, next);
-    return next;
+  const keysOf = (hostId, workspaceIds) => {
+    if (workspaceIds) return [...new Set(workspaceIds)].map((workspaceId) => presenceKey(hostId, workspaceId));
+    return [...entries].filter(([, presence]) => presence.hostId === hostId).map(([key]) => key);
   };
   const sweep = () => {
     const at = now();
-    for (const [hostId, presence] of hosts) {
+    for (const [key, presence] of entries) {
       if (presence.expiresAt <= at) {
-        hosts.delete(hostId);
+        entries.delete(key);
       }
     }
   };
@@ -22571,29 +23032,35 @@ function createWorkspaceRelayDirectory(options = {}) {
         lastPongAt: timestamp,
         expiresAt: timestamp + ttlMs
       };
-      hosts.set(next.hostId, next);
+      for (const workspaceId of next.workspaceIds) entries.set(presenceKey(next.hostId, workspaceId), next);
       return next;
     },
-    recordPong(hostId) {
-      const presence = alive(hosts.get(hostId));
-      return presence ? touch(presence) : void 0;
+    recordPong(hostId, workspaceIds) {
+      const timestamp = now();
+      let touched;
+      for (const key of keysOf(hostId, workspaceIds)) {
+        const presence = alive(key);
+        if (!presence) continue;
+        const next = { ...presence, lastPongAt: timestamp, expiresAt: timestamp + ttlMs };
+        entries.set(key, next);
+        touched ??= next;
+      }
+      return touched;
     },
-    disconnectHost(hostId) {
-      hosts.delete(hostId);
+    disconnectHost(hostId, workspaceIds) {
+      for (const key of keysOf(hostId, workspaceIds)) entries.delete(key);
     },
     activeHost(input) {
-      const presence = alive(hosts.get(input.hostId));
-      if (!presence?.workspaceIds.includes(input.workspaceId)) return;
-      return presence;
+      return alive(presenceKey(input.hostId, input.workspaceId));
     },
     sweep,
     size() {
       const at = now();
-      let count = 0;
-      for (const presence of hosts.values()) {
-        if (presence.expiresAt > at) count += 1;
+      const hosts = /* @__PURE__ */ new Set();
+      for (const presence of entries.values()) {
+        if (presence.expiresAt > at) hosts.add(presence.hostId);
       }
-      return count;
+      return hosts.size;
     },
     dispose() {
       if (intervalHandle !== void 0) {
@@ -22725,20 +23192,17 @@ function startSyntheticProbe(options) {
 // src/main.ts
 var BUN_TARGET_CACHE_TTL_MS_DEFAULT = 3e4;
 var BUN_REVOCATION_CACHE_TTL_MS_DEFAULT = 1e4;
+var BUN_HOST_GENERATION_CACHE_TTL_MS_DEFAULT = 1e4;
 var BUN_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
-function clean(input) {
-  const value = input?.trim();
-  return value ? value : void 0;
-}
 function positiveInteger(input) {
-  const parsed = Number(clean(input));
+  const parsed = Number(trimToUndefined(input));
   return Number.isInteger(parsed) && parsed > 0 ? parsed : void 0;
 }
 function pem(input) {
-  return clean(input)?.replaceAll("\\n", "\n");
+  return trimToUndefined(input)?.replaceAll("\\n", "\n");
 }
 function requireEnv(name) {
-  const value = clean(process.env[name]);
+  const value = trimToUndefined(process.env[name]);
   if (!value) {
     console.error(`[workspace-relay] missing required env: ${name}`);
     process.exit(2);
@@ -22746,17 +23210,17 @@ function requireEnv(name) {
   return value;
 }
 function relayTelemetryOptions(env) {
-  if (clean(env.CLAXEDO_TELEMETRY_MODE)?.toLowerCase() !== "on") return void 0;
-  const key = clean(env.CLAXEDO_POSTHOG_KEY) ?? clean(env.POSTHOG_KEY);
+  if (trimToUndefined(env.CLAXEDO_TELEMETRY_MODE)?.toLowerCase() !== "on") return void 0;
+  const key = trimToUndefined(env.CLAXEDO_POSTHOG_KEY) ?? trimToUndefined(env.POSTHOG_KEY);
   if (!key) return void 0;
-  const release = clean(env.CLAXEDO_RELEASE) ?? clean(env.GIT_SHA);
+  const release = trimToUndefined(env.CLAXEDO_RELEASE) ?? trimToUndefined(env.GIT_SHA);
   return {
     key,
-    host: clean(env.CLAXEDO_POSTHOG_HOST) ?? "https://us.i.posthog.com",
+    host: trimToUndefined(env.CLAXEDO_POSTHOG_HOST) ?? "https://us.i.posthog.com",
     ...release ? { release } : {},
     tags: {
       unit: "relay",
-      deployment_mode: clean(env.CLAXEDO_DEPLOYMENT_MODE)?.toLowerCase() ?? "self-host"
+      deployment_mode: trimToUndefined(env.CLAXEDO_DEPLOYMENT_MODE)?.toLowerCase() ?? "local"
     }
   };
 }
@@ -22783,9 +23247,9 @@ async function reportFatal(error) {
   }
 }
 function validateProductionEnv(env) {
-  const isProduction = clean(env.NODE_ENV) === "production";
+  const isProduction = trimToUndefined(env.NODE_ENV) === "production";
   if (!isProduction) return { ok: true };
-  const resolverToken = clean(env.CLAXEDO_RELAY_RESOLVER_TOKEN);
+  const resolverToken = trimToUndefined(env.CLAXEDO_RELAY_RESOLVER_TOKEN);
   if (!resolverToken) {
     return {
       ok: false,
@@ -22796,7 +23260,7 @@ function validateProductionEnv(env) {
   return { ok: true };
 }
 async function loadRuntimeAccessKeyOrJwks(env) {
-  const jwksUrl = clean(env.CLAXEDO_CONTROL_PLANE_JWKS_URL);
+  const jwksUrl = trimToUndefined(env.CLAXEDO_CONTROL_PLANE_JWKS_URL);
   if (jwksUrl) {
     return createRemoteJWKSet(new URL(jwksUrl));
   }
@@ -22808,14 +23272,6 @@ async function loadRuntimeAccessKeyOrJwks(env) {
   }
   return importSPKI(verifyPem, "EdDSA");
 }
-async function deriveKidFromPublicKey(publicKey) {
-  const jwk = await exportJWK2(publicKey);
-  const material = String(jwk.x ?? jwk.n ?? "");
-  if (!material) {
-    throw new Error("Cannot derive kid: public key has no public component");
-  }
-  return createHash("sha256").update(material).digest("hex").slice(0, 16);
-}
 async function loadRelayHostKeyMaterial(env) {
   const privatePem = pem(env.CLAXEDO_RELAY_HOST_SIGNING_KEY_PEM);
   let privateKey;
@@ -22823,7 +23279,7 @@ async function loadRelayHostKeyMaterial(env) {
   if (privatePem) {
     privateKey = await importPKCS8(privatePem, "EdDSA", { extractable: true });
   } else {
-    if (clean(env.NODE_ENV) === "production") {
+    if (trimToUndefined(env.NODE_ENV) === "production") {
       console.error(
         "[workspace-relay] CLAXEDO_RELAY_HOST_SIGNING_KEY_PEM required in production; refusing to start with an ephemeral key"
       );
@@ -22841,21 +23297,18 @@ async function loadRelayHostKeyMaterial(env) {
   } else if (derivedPublicKey) {
     publicKey = derivedPublicKey;
   } else {
-    const jwk = await exportJWK2(privateKey);
-    const publicJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
-    const { importJWK } = await import("jose");
-    publicKey = await importJWK(publicJwk, "EdDSA", { extractable: true });
+    publicKey = await deriveRelayHostPublicKey(privateKey);
   }
-  const explicitCurrentKid = clean(env.CLAXEDO_RELAY_HOST_KID);
-  const currentKid = explicitCurrentKid ?? await deriveKidFromPublicKey(publicKey);
+  const explicitCurrentKid = trimToUndefined(env.CLAXEDO_RELAY_HOST_KID);
+  const currentKid = explicitCurrentKid ?? await deriveRelayHostKid(publicKey);
   const nextPem = pem(env.CLAXEDO_RELAY_HOST_NEXT_PUBLIC_KEY_PEM);
   let next;
   if (nextPem) {
     const nextPublicKey = await importSPKI(nextPem, "EdDSA", { extractable: true });
-    const explicitNextKid = clean(env.CLAXEDO_RELAY_HOST_NEXT_KID);
+    const explicitNextKid = trimToUndefined(env.CLAXEDO_RELAY_HOST_NEXT_KID);
     next = {
       publicKey: nextPublicKey,
-      kid: explicitNextKid ?? await deriveKidFromPublicKey(nextPublicKey)
+      kid: explicitNextKid ?? await deriveRelayHostKid(nextPublicKey)
     };
   }
   return {
@@ -22865,9 +23318,9 @@ async function loadRelayHostKeyMaterial(env) {
   };
 }
 function parseAuditAcceptSampleRate(env) {
-  const isProduction = clean(env.NODE_ENV) === "production";
+  const isProduction = trimToUndefined(env.NODE_ENV) === "production";
   const fallback = isProduction ? 0.1 : 1;
-  const raw = clean(env.CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE);
+  const raw = trimToUndefined(env.CLAXEDO_RELAY_AUDIT_ACCEPT_SAMPLE_RATE);
   if (!raw) return fallback;
   const value = Number(raw);
   if (!Number.isFinite(value)) return fallback;
@@ -22875,7 +23328,7 @@ function parseAuditAcceptSampleRate(env) {
   return value;
 }
 function parseMetricsToken(env) {
-  return clean(env.CLAXEDO_RELAY_METRICS_TOKEN);
+  return trimToUndefined(env.CLAXEDO_RELAY_METRICS_TOKEN);
 }
 function runtimeAccessTokenCacheTtlMsFromEnv(env) {
   return positiveInteger(env.CLAXEDO_RELAY_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS) ?? BUN_RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
@@ -22884,9 +23337,12 @@ function directHttpConcurrencyFromEnv(env) {
   return positiveInteger(env.CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY);
 }
 function resolverClientCacheOptionsFromEnv(env) {
+  const hostGenerationUrl = trimToUndefined(env.CLAXEDO_RELAY_HOST_GENERATION_URL);
   return {
     targetCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_TARGET_CACHE_TTL_MS) ?? BUN_TARGET_CACHE_TTL_MS_DEFAULT,
-    revocationCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS) ?? BUN_REVOCATION_CACHE_TTL_MS_DEFAULT
+    revocationCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS) ?? BUN_REVOCATION_CACHE_TTL_MS_DEFAULT,
+    ...hostGenerationUrl ? { hostGenerationUrl } : {},
+    hostGenerationCacheTtlMs: positiveInteger(env.CLAXEDO_RELAY_HOST_GENERATION_CACHE_TTL_MS) ?? BUN_HOST_GENERATION_CACHE_TTL_MS_DEFAULT
   };
 }
 function createResolverClient(baseUrl, token, options = {}) {
@@ -22900,7 +23356,9 @@ function createResolverClient(baseUrl, token, options = {}) {
     const res = await fetch(url, { headers: headers2 });
     if (res.status === 404) return void 0;
     if (!res.ok) throw new Error(`relay target resolver failed: ${res.status} ${await res.text()}`);
-    return await res.json();
+    const target2 = parseWorkspaceRelayTarget(await res.json());
+    if (!target2) throw new Error("relay target resolver returned a malformed target");
+    return target2;
   };
   const revocationUncached = async (args) => {
     const url = new URL(`${root}/revocation`);
@@ -22915,7 +23373,9 @@ function createResolverClient(baseUrl, token, options = {}) {
         reason: `revocation resolver returned ${res.status}`
       };
     }
-    return await res.json();
+    const result = parseRuntimeAccessTokenActiveResult(await res.json());
+    if (!result) throw new Error("relay revocation resolver returned a malformed result");
+    return result;
   };
   const target = createCachedTargetClient(targetUncached, {
     ttlMs: options.targetCacheTtlMs ?? BUN_TARGET_CACHE_TTL_MS_DEFAULT
@@ -22923,11 +23383,39 @@ function createResolverClient(baseUrl, token, options = {}) {
   const revocation = createCachedRevocationClient(revocationUncached, {
     ttlMs: options.revocationCacheTtlMs ?? BUN_REVOCATION_CACHE_TTL_MS_DEFAULT
   });
+  const hostGeneration = createCachedHostGenerationClient(
+    createHostGenerationResolverLookup(options.hostGenerationUrl ?? `${root}/host-generation`, { headers: headers2 }),
+    { ttlMs: options.hostGenerationCacheTtlMs ?? BUN_HOST_GENERATION_CACHE_TTL_MS_DEFAULT }
+  );
   return {
     target: (workspaceId, hostId) => target({ workspaceId, hostId }),
-    revocation
+    revocation,
+    hostGeneration
   };
 }
+var STOP_SERVER_TIMEOUT_MS_DEFAULT = 5e3;
+async function runBoundedTeardown(step, label, timeoutMs, log) {
+  if (!step) return;
+  let timer;
+  const attempt = (async () => {
+    await step();
+  })().catch((err) => {
+    log(`[workspace-relay] ${label} failed: ${err instanceof Error ? err.message : String(err)}`);
+  });
+  try {
+    await Promise.race([
+      attempt,
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          log(`[workspace-relay] ${label} did not finish within ${timeoutMs}ms; exiting anyway`);
+          resolve();
+        }, timeoutMs);
+      })
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
 function installShutdownDrainHandler(options) {
   const exit = options.exit ?? ((code) => process.exit(code));
   const log = options.log ?? (() => {
@@ -22950,11 +23438,12 @@ function installShutdownDrainHandler(options) {
           `[workspace-relay] drain timeout: ${result.remaining} pending request(s) remaining after ${options.drainTimeoutMs}ms; force-closing`
         );
       }
-      try {
-        await options.stopServer?.();
-      } catch (err) {
-        log(`[workspace-relay] stopServer failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
+      await runBoundedTeardown(
+        options.stopServer,
+        "stopServer",
+        options.stopTimeoutMs ?? STOP_SERVER_TIMEOUT_MS_DEFAULT,
+        log
+      );
       try {
         options.directory.dispose();
       } catch (err) {
@@ -22995,11 +23484,12 @@ function installFatalProcessHandlers(options) {
         log(`[workspace-relay] fatal report failed: ${err instanceof Error ? err.message : String(err)}`);
       }
       options.drain.setDraining(true);
-      try {
-        await options.stopServer?.();
-      } catch (err) {
-        log(`[workspace-relay] fatal stopServer failed: ${err instanceof Error ? err.message : String(err)}`);
-      }
+      await runBoundedTeardown(
+        options.stopServer,
+        "fatal stopServer",
+        options.stopTimeoutMs ?? STOP_SERVER_TIMEOUT_MS_DEFAULT,
+        log
+      );
       try {
         options.directory.dispose();
       } catch (err) {
@@ -23035,14 +23525,14 @@ async function main() {
     console.error(`[workspace-relay] ${validation.message}`);
     process.exit(validation.exitCode);
   }
-  const port = Number(clean(process.env.CLAXEDO_WORKSPACE_RELAY_PORT) ?? "7777");
+  const port = Number(trimToUndefined(process.env.CLAXEDO_WORKSPACE_RELAY_PORT) ?? "7777");
   if (!Number.isFinite(port) || port <= 0) {
     console.error(`[workspace-relay] invalid CLAXEDO_WORKSPACE_RELAY_PORT: ${process.env.CLAXEDO_WORKSPACE_RELAY_PORT}`);
     process.exit(2);
   }
-  const hostname = clean(process.env.CLAXEDO_WORKSPACE_RELAY_HOST) ?? "127.0.0.1";
+  const hostname = trimToUndefined(process.env.CLAXEDO_WORKSPACE_RELAY_HOST) ?? "127.0.0.1";
   const resolverUrl = requireEnv("CLAXEDO_RELAY_RESOLVER_URL");
-  const resolverToken = clean(process.env.CLAXEDO_RELAY_RESOLVER_TOKEN);
+  const resolverToken = trimToUndefined(process.env.CLAXEDO_RELAY_RESOLVER_TOKEN);
   let runtimeAccessKey;
   try {
     runtimeAccessKey = await loadRuntimeAccessKeyOrJwks({
@@ -23072,7 +23562,9 @@ async function main() {
   if (relayHostMaterial.next) relayHostPublicKeys.push(relayHostMaterial.next);
   const resolver = createResolverClient(resolverUrl, resolverToken, resolverClientCacheOptionsFromEnv({
     CLAXEDO_RELAY_TARGET_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_TARGET_CACHE_TTL_MS,
-    CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS
+    CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_REVOCATION_CACHE_TTL_MS,
+    CLAXEDO_RELAY_HOST_GENERATION_URL: process.env.CLAXEDO_RELAY_HOST_GENERATION_URL,
+    CLAXEDO_RELAY_HOST_GENERATION_CACHE_TTL_MS: process.env.CLAXEDO_RELAY_HOST_GENERATION_CACHE_TTL_MS
   }));
   const directory = createWorkspaceRelayDirectory();
   const auditAcceptSampleRate = parseAuditAcceptSampleRate({
@@ -23088,7 +23580,7 @@ async function main() {
   const directHttpConcurrency = directHttpConcurrencyFromEnv({
     CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY: process.env.CLAXEDO_RELAY_DIRECT_HTTP_CONCURRENCY
   });
-  const allowedOrigins = parseAllowedOrigins(clean(process.env.CLAXEDO_RELAY_ALLOWED_ORIGINS));
+  const allowedOrigins = parseAllowedOrigins(trimToUndefined(process.env.CLAXEDO_RELAY_ALLOWED_ORIGINS));
   const handler = createWorkspaceRelayBun({
     runtimeAccessKey,
     runtimeAccessTokenCacheTtlMs: runtimeAccessTokenCacheTtlMs2,
@@ -23106,6 +23598,7 @@ async function main() {
       workspaceId: claims.workspace_id,
       hostId: claims.host_id
     }),
+    resolveHostGeneration: resolver.hostGeneration,
     audit: (event) => {
       if (event.result === "deny") {
         console.warn(
@@ -23113,23 +23606,25 @@ async function main() {
         );
       }
     }
-  }, {
-    ...directHttpConcurrency ? { directHttpConcurrency } : {}
-  });
+  }, directHttpConcurrency ? { directHttpConcurrency } : {});
   const server = Bun.serve({
     port,
     hostname,
+    // Runtime SSE heartbeats are intentionally 30s apart. Keep a bounded
+    // timeout above that interval so quiet streams survive without leaving
+    // unauthenticated or incomplete HTTP sockets open indefinitely.
+    idleTimeout: WORKSPACE_RELAY_IDLE_TIMEOUT_SECONDS,
     fetch: handler.fetch,
     websocket: handler.websocket
   });
   console.log(`[workspace-relay] listening on http://${hostname}:${port} resolver=${resolverUrl}`);
-  const rawDrainTimeout = clean(process.env.CLAXEDO_RELAY_DRAIN_TIMEOUT_MS);
+  const rawDrainTimeout = trimToUndefined(process.env.CLAXEDO_RELAY_DRAIN_TIMEOUT_MS);
   const parsedDrainTimeout = rawDrainTimeout ? Number(rawDrainTimeout) : NaN;
   const drainTimeoutMs = Number.isFinite(parsedDrainTimeout) && parsedDrainTimeout > 0 ? parsedDrainTimeout : 3e4;
   let syntheticProbe;
-  const syntheticDisabled = clean(process.env.CLAXEDO_RELAY_SYNTHETIC_PROBE_DISABLED) === "1";
+  const syntheticDisabled = trimToUndefined(process.env.CLAXEDO_RELAY_SYNTHETIC_PROBE_DISABLED) === "1";
   if (!syntheticDisabled) {
-    const rawProbeInterval = clean(process.env.CLAXEDO_RELAY_SYNTHETIC_PROBE_INTERVAL_MS);
+    const rawProbeInterval = trimToUndefined(process.env.CLAXEDO_RELAY_SYNTHETIC_PROBE_INTERVAL_MS);
     const parsedProbeInterval = rawProbeInterval ? Number(rawProbeInterval) : NaN;
     const probeIntervalMs = Number.isFinite(parsedProbeInterval) && parsedProbeInterval > 0 ? parsedProbeInterval : 6e4;
     syntheticProbe = startSyntheticProbe({
@@ -23144,7 +23639,7 @@ async function main() {
     drainTimeoutMs,
     log: (message) => console.log(message),
     stopServer: async () => {
-      server.stop(true);
+      await server.stop(true);
       syntheticProbe?.stop();
     }
   });
@@ -23152,11 +23647,10 @@ async function main() {
     drain: handler.drain,
     directory,
     log: (message) => console.error(message),
-    // W2c: fatal crashes are exactly the events a solo operator never sees in
-    // a log buffer — flush them to PostHog (no-op when no key) before exiting.
+    // Flush fatal crashes to PostHog (no-op without a key) before exiting.
     report: (error) => reportFatal(error),
     stopServer: async () => {
-      server.stop(true);
+      await server.stop(true);
       syntheticProbe?.stop();
     }
   });