@claxedo/workspace-relay 0.8.0 → 0.10.0

package/dist/bun.mjs

@@ -1,2492 +0,0 @@
-// src/bun.ts
-import {
-  makeTunnelPing,
-  makeTunnelPong,
-  TUNNEL_PROTOCOL_VERSION,
-  validateTunnelMessage
-} from "@claxedo/workspace-relay-protocol";
-
-// src/server.ts
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { exportJWK as exportJWK2 } from "jose";
-
-// ../claxedo-helpers/dist/guards.mjs
-function isFiniteNumber(value) {
-  return typeof value === "number" && Number.isFinite(value);
-}
-function asFiniteNumber(value) {
-  return isFiniteNumber(value) ? value : void 0;
-}
-function numberClaim(payload, key) {
-  return asFiniteNumber(payload[key]);
-}
-
-// src/auth.ts
-import { SignJWT, errors, exportJWK, importJWK, jwtVerify } from "jose";
-var algorithms = ["EdDSA", "ES256", "RS256"];
-var runtimeAccessTokenIssuer = "claxedo-control-plane";
-var runtimeAccessTokenAudience = "workspace-relay";
-var hostTunnelTokenAudience = "workspace-relay-host-tunnel";
-var relayHostTokenIssuer = "workspace-relay";
-var relayHostTokenAudience = "workspace-host-service";
-var WorkspaceRelayAuthError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-  }
-};
-function jti() {
-  return crypto.randomUUID();
-}
-function seconds(input = Date.now()) {
-  return Math.floor(input / 1e3);
-}
-function requireAlgorithm(input) {
-  const algorithm = algorithms.find((candidate) => candidate === input);
-  if (algorithm) return algorithm;
-  throw new WorkspaceRelayAuthError("invalid_relay_token", "Unsupported relay token algorithm");
-}
-function stringClaim(payload, key) {
-  const value = payload[key];
-  return typeof value === "string" && value.trim() ? value : void 0;
-}
-function stringArrayClaim(payload, key) {
-  const value = payload[key];
-  return Array.isArray(value) && value.every((item) => typeof item === "string" && item.trim()) ? value : void 0;
-}
-function isHostGeneration(value) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 0;
-}
-function hostGenerationClaims(payload) {
-  const enrollment_id = stringClaim(payload, "enrollment_id");
-  const generation = payload.generation;
-  if (generation === void 0) return enrollment_id ? { enrollment_id } : {};
-  if (!isHostGeneration(generation) || !enrollment_id) return null;
-  return { enrollment_id, generation };
-}
-function roleClaim(payload) {
-  const value = stringClaim(payload, "role");
-  return value === "viewer" || value === "editor" || value === "admin" || value === "owner" ? value : void 0;
-}
-function actorProfileClaims(payload) {
-  const actor_public_id = stringClaim(payload, "actor_public_id");
-  const actor_name = stringClaim(payload, "actor_name");
-  const actor_avatar_url = stringClaim(payload, "actor_avatar_url");
-  if (!actor_public_id && !actor_name && !actor_avatar_url) return {};
-  if (!actor_public_id || !actor_name) return void 0;
-  return { actor_public_id, actor_name, ...actor_avatar_url ? { actor_avatar_url } : {} };
-}
-function actorProfilePayload(input) {
-  if (!input.actorPublicId && !input.actorName && !input.actorAvatarUrl) return {};
-  if (!input.actorPublicId || !input.actorName) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Actor display profile claims are incomplete");
-  }
-  return {
-    actor_public_id: input.actorPublicId,
-    actor_name: input.actorName,
-    ...input.actorAvatarUrl ? { actor_avatar_url: input.actorAvatarUrl } : {}
-  };
-}
-function isRelayClaimPair(input) {
-  return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
-}
-function checkHostTunnelTarget(payload, expected) {
-  if (stringClaim(payload, "host_id") !== expected.hostId) {
-    throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
-  }
-  const workspaceIds = stringArrayClaim(payload, "workspace_ids") ?? [];
-  if (expected.workspaceIds.some((workspaceId) => !workspaceIds.includes(workspaceId))) {
-    throw new WorkspaceRelayAuthError("relay_token_workspace_mismatch", "Relay token workspace does not match request");
-  }
-}
-function checkTarget(payload, expected) {
-  if (stringClaim(payload, "workspace_id") !== expected.workspaceId) {
-    throw new WorkspaceRelayAuthError("relay_token_workspace_mismatch", "Relay token workspace does not match request");
-  }
-  if (expected.hostId && stringClaim(payload, "host_id") !== expected.hostId) {
-    throw new WorkspaceRelayAuthError("relay_token_host_mismatch", "Relay token host does not match request");
-  }
-}
-async function verifyJwt(token, key, input) {
-  try {
-    if (typeof key === "function") {
-      return await jwtVerify(token, key, {
-        issuer: input.issuer,
-        audience: input.audience,
-        algorithms: [...algorithms]
-      });
-    }
-    return await jwtVerify(token, key, {
-      issuer: input.issuer,
-      audience: input.audience,
-      algorithms: [...algorithms]
-    });
-  } catch (err) {
-    if (err instanceof errors.JWKSTimeout) throw err;
-    if (err instanceof errors.JOSEError) {
-      throw new WorkspaceRelayAuthError("invalid_relay_token", "Relay token is invalid");
-    }
-    throw err;
-  }
-}
-async function verifyRuntimeAccessToken(token, key, expected) {
-  const result = await verifyJwt(token, key, {
-    issuer: runtimeAccessTokenIssuer,
-    audience: runtimeAccessTokenAudience
-  });
-  checkTarget(result.payload, expected);
-  const claims = runtimeClaims(result.payload);
-  if (!claims) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
-  }
-  return claims;
-}
-function validateRuntimeAccessTokenClaims(input, expected) {
-  const payload = input;
-  if (stringClaim(payload, "iss") !== runtimeAccessTokenIssuer || stringClaim(payload, "aud") !== runtimeAccessTokenAudience) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token issuer or audience is invalid");
-  }
-  checkTarget(payload, expected);
-  const claims = runtimeClaims(payload);
-  if (!claims) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
-  }
-  return claims;
-}
-async function verifyHostTunnelToken(token, key, expected) {
-  const result = await verifyJwt(token, key, {
-    issuer: runtimeAccessTokenIssuer,
-    audience: hostTunnelTokenAudience
-  });
-  checkHostTunnelTarget(result.payload, expected);
-  const claims = hostTunnelClaims(result.payload);
-  if (!claims) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Host Tunnel Token claims are incomplete");
-  }
-  return claims;
-}
-async function mintRelayHostToken(input, key, alg) {
-  if (!isRelayClaimPair(input)) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token access/backing claims are inconsistent");
-  }
-  const now = seconds(input.now);
-  const protectedHeader = { alg: requireAlgorithm(alg) };
-  if (input.kid) protectedHeader.kid = input.kid;
-  return await new SignJWT({
-    principal_kind: input.principalKind,
-    actor_id: input.actorId,
-    actor_kind: input.actorKind,
-    ...actorProfilePayload(input),
-    org_id: input.orgId,
-    workspace_id: input.workspaceId,
-    host_id: input.hostId,
-    role: input.role,
-    access: input.access,
-    backing: input.backing,
-    parent_jti: input.parentJti
-  }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
-}
-function runtimeClaims(payload) {
-  const exp = numberClaim(payload, "exp");
-  const iat = numberClaim(payload, "iat");
-  const principal_kind = stringClaim(payload, "principal_kind");
-  const actor_id = stringClaim(payload, "actor_id");
-  const actor_kind = stringClaim(payload, "actor_kind");
-  const jti2 = stringClaim(payload, "jti");
-  const org_id = stringClaim(payload, "org_id");
-  const workspace_id = stringClaim(payload, "workspace_id");
-  const host_id = stringClaim(payload, "host_id");
-  const role = roleClaim(payload);
-  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
-  const actorProfile = actorProfileClaims(payload);
-  if (!actorProfile) return void 0;
-  return {
-    iss: runtimeAccessTokenIssuer,
-    aud: runtimeAccessTokenAudience,
-    principal_kind,
-    actor_id,
-    actor_kind,
-    ...actorProfile,
-    org_id,
-    workspace_id,
-    host_id,
-    role,
-    exp,
-    iat,
-    jti: jti2
-  };
-}
-function hostTunnelClaims(payload) {
-  const exp = numberClaim(payload, "exp");
-  const iat = numberClaim(payload, "iat");
-  const sub = stringClaim(payload, "sub");
-  const jti2 = stringClaim(payload, "jti");
-  const host_id = stringClaim(payload, "host_id");
-  const workspace_ids = stringArrayClaim(payload, "workspace_ids");
-  const fence = hostGenerationClaims(payload);
-  if (!exp || !iat || !sub || !jti2 || !host_id || !workspace_ids?.length || fence === null) return void 0;
-  return {
-    iss: runtimeAccessTokenIssuer,
-    aud: hostTunnelTokenAudience,
-    sub,
-    host_id,
-    workspace_ids,
-    ...fence,
-    exp,
-    iat,
-    jti: jti2
-  };
-}
-
-// src/cors-origins.ts
-var DEFAULT_RELAY_APP_ORIGINS = [
-  "http://localhost:*",
-  "http://127.0.0.1:*",
-  "https://claxedo.com",
-  "https://*.claxedo.com"
-];
-function createOriginMatcher(patterns) {
-  const exact = /* @__PURE__ */ new Set();
-  const httpsSuffixes = [];
-  const httpPortPrefixes = [];
-  for (const pattern of patterns) {
-    if (pattern.startsWith("https://*.")) {
-      httpsSuffixes.push(pattern.slice("https://*".length));
-    } else if (pattern.startsWith("http://") && pattern.endsWith(":*")) {
-      httpPortPrefixes.push(pattern.slice(0, -1));
-    } else {
-      exact.add(pattern);
-    }
-  }
-  return (origin) => {
-    if (exact.has(origin)) return true;
-    if (origin.startsWith("https://")) {
-      return httpsSuffixes.some(
-        (suffix) => origin.endsWith(suffix) && origin.length > "https://".length + suffix.length
-      );
-    }
-    if (origin.startsWith("http://")) {
-      return httpPortPrefixes.some(
-        (prefix) => origin.startsWith(prefix) && /^\d+$/.test(origin.slice(prefix.length))
-      );
-    }
-    return false;
-  };
-}
-
-// src/http.ts
-import { bearerToken } from "@claxedo/helpers/string";
-function errorBody(code, message) {
-  return {
-    error: {
-      code,
-      message
-    }
-  };
-}
-
-// src/user-hosted-forwarding.ts
-function isUserHostedTarget(target) {
-  return target.access === "user-hosted";
-}
-
-// src/server.ts
-function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
-  if (incumbentGeneration === void 0) return false;
-  return candidateGeneration === void 0 || incumbentGeneration > candidateGeneration;
-}
-var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
-var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
-var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
-var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
-var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
-async function checkHostTunnelGeneration(lookup, claims) {
-  if (claims.generation === void 0 || !claims.enrollment_id) return { ok: true };
-  if (!lookup) {
-    return {
-      ok: false,
-      retryable: false,
-      code: "host_generation_unverifiable",
-      reason: "Host tunnel generation cannot be verified by a relay without a host-generation resolver"
-    };
-  }
-  let result;
-  try {
-    result = await lookup({ enrollmentId: claims.enrollment_id, generation: claims.generation });
-  } catch (err) {
-    return {
-      ok: false,
-      retryable: true,
-      code: "host_generation_lookup_unavailable",
-      reason: `Host generation lookup is unavailable: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  if (!result) {
-    return { ok: false, retryable: false, code: "host_enrollment_unknown", reason: "Host enrollment is unknown" };
-  }
-  if (result.revoked) {
-    return { ok: false, retryable: false, code: "host_enrollment_revoked", reason: "Host enrollment was revoked" };
-  }
-  if (result.generation > claims.generation) {
-    return { ok: false, retryable: false, code: "host_generation_superseded", reason: "Host tunnel generation was superseded" };
-  }
-  if (result.generation < claims.generation) {
-    return { ok: false, retryable: false, code: "host_generation_unknown", reason: "Host tunnel generation is ahead of the control plane" };
-  }
-  return { ok: true };
-}
-function protocolToken(header) {
-  return header?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
-}
-function runtimeAccessToken(request) {
-  return bearerToken(request.headers.get("authorization") ?? void 0) ?? protocolToken(request.headers.get("sec-websocket-protocol") ?? void 0);
-}
-var DANGEROUS_INBOUND_HEADERS = [
-  "x-forwarded-for",
-  "x-forwarded-host",
-  "x-forwarded-proto",
-  "x-real-ip"
-];
-var HOP_BY_HOP_HEADERS = [
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-];
-var DANGEROUS_INBOUND_HEADER_PATTERNS = [
-  /^x-claxedo-internal-/i,
-  /^x-supervisor-/i
-];
-function isDangerousInboundHeader(name) {
-  const lower = name.toLowerCase();
-  if (DANGEROUS_INBOUND_HEADERS.includes(lower)) return true;
-  if (HOP_BY_HOP_HEADERS.includes(lower)) return true;
-  for (const pattern of DANGEROUS_INBOUND_HEADER_PATTERNS) {
-    if (pattern.test(lower)) return true;
-  }
-  return false;
-}
-function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
-  const headers2 = new Headers(input);
-  headers2.delete("host");
-  const inboundNames = /* @__PURE__ */ new Set();
-  headers2.forEach((_value, name) => inboundNames.add(name));
-  for (const name of inboundNames) {
-    if (isDangerousInboundHeader(name)) headers2.delete(name);
-  }
-  if (options.userHosted) headers2.delete("cookie");
-  headers2.set("accept-encoding", "identity");
-  headers2.delete("authorization");
-  headers2.delete("Authorization");
-  headers2.set("Authorization", `Bearer ${relayHostToken}`);
-  headers2.set("x-workspace-id", workspaceId);
-  headers2.set("X-Daytona-Skip-Preview-Warning", "true");
-  headers2.set("X-Daytona-Skip-Last-Activity-Update", "true");
-  for (const [name, value] of Object.entries(options.upstreamHeaders ?? {})) {
-    const trimmed = value.trim();
-    if (trimmed) headers2.set(name, trimmed);
-  }
-  headers2.set("x-forwarded-by", "workspace-relay");
-  return headers2;
-}
-function targetUrl(target, path, search) {
-  const url = new URL(path.replace(/^\/+/, ""), target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
-  url.search = search;
-  return url;
-}
-var RELAY_VIEWER_DENIED_PATH = /^\/api\/wr\/pty(?:\/|$)/;
-function relayRuntimePath(request) {
-  try {
-    const decoded2 = decodeURIComponent(new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")).replace(/^\/+/, "/");
-    return new URL(decoded2.replace(/^\/+/, ""), "http://relay.invalid/").pathname;
-  } catch {
-    return void 0;
-  }
-}
-function roleAllowsRelayRequest(role, method, path) {
-  if (role === "owner" || role === "admin" || role === "editor") return true;
-  if (role === "viewer") {
-    if (RELAY_VIEWER_DENIED_PATH.test(path)) return false;
-    return method === "GET" || method === "HEAD" || method === "OPTIONS";
-  }
-  return false;
-}
-function relayHostTokenCacheTtlMs(options, claims) {
-  const configured = options.relayHostTokenCacheTtlMs ?? 3e4;
-  if (!Number.isFinite(configured) || configured <= 0) return 0;
-  const tokenRemaining = claims.exp * 1e3 - Date.now() - 5e3;
-  return Math.max(0, Math.min(configured, tokenRemaining));
-}
-function relayHostTokenCacheKey(options, claims, target) {
-  return [
-    claims.jti,
-    claims.principal_kind,
-    claims.actor_id,
-    claims.actor_kind,
-    claims.org_id,
-    claims.role,
-    claims.workspace_id,
-    claims.host_id,
-    target.access,
-    target.backing,
-    options.relayHostMintKid ?? ""
-  ].join("\0");
-}
-function relayHostTokenCache(options) {
-  let cache = relayHostTokenCaches.get(options);
-  if (cache) return cache;
-  cache = /* @__PURE__ */ new Map();
-  relayHostTokenCaches.set(options, cache);
-  return cache;
-}
-function runtimeAccessTokenCache(options) {
-  let cache = runtimeAccessTokenCaches.get(options);
-  if (cache) return cache;
-  cache = /* @__PURE__ */ new Map();
-  runtimeAccessTokenCaches.set(options, cache);
-  return cache;
-}
-function runtimeAccessTokenCacheTtlMs(options, claims, now) {
-  const configured = options.runtimeAccessTokenCacheTtlMs ?? RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
-  if (!Number.isFinite(configured) || configured <= 0) return 0;
-  const tokenRemaining = claims.exp * 1e3 - now - 5e3;
-  return Math.max(0, Math.min(configured, tokenRemaining));
-}
-function pruneRuntimeAccessTokenCache(cache, now) {
-  for (const [key, entry] of cache) {
-    if (entry.expiresAt <= now) cache.delete(key);
-  }
-  while (cache.size >= RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES) {
-    const key = cache.keys().next().value;
-    if (!key) return;
-    cache.delete(key);
-  }
-}
-async function verifyRuntimeAccessTokenForRequest(options, token, workspaceId) {
-  const verified = options.tokenVerifier ? await options.tokenVerifier.verify(token).then(
-    (result) => validateRuntimeAccessTokenClaims(result.claims, { workspaceId })
-  ) : await verifyRuntimeAccessToken(token, options.runtimeAccessKey, { workspaceId });
-  return verified;
-}
-async function cachedRuntimeAccessTokenClaims(options, token, workspaceId) {
-  const configured = options.runtimeAccessTokenCacheTtlMs ?? RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT;
-  if (!Number.isFinite(configured) || configured <= 0) {
-    return await verifyRuntimeAccessTokenForRequest(options, token, workspaceId);
-  }
-  const now = Date.now();
-  const cache = runtimeAccessTokenCache(options);
-  const key = `${workspaceId}\0${token}`;
-  const cached = cache.get(key);
-  if (cached && cached.expiresAt > now) {
-    if (cached.claims) return cached.claims;
-    if (cached.promise) return await cached.promise;
-  }
-  let promise;
-  try {
-    promise = verifyRuntimeAccessTokenForRequest(options, token, workspaceId);
-    pruneRuntimeAccessTokenCache(cache, now);
-    cache.set(key, { promise, expiresAt: now + configured });
-    const claims = await promise;
-    const ttlMs = runtimeAccessTokenCacheTtlMs(options, claims, now);
-    if (ttlMs > 0) cache.set(key, { claims, expiresAt: now + ttlMs });
-    else cache.delete(key);
-    return claims;
-  } catch (err) {
-    if (promise && cache.get(key)?.promise === promise) cache.delete(key);
-    throw err;
-  }
-}
-function pruneRelayHostTokenCache(cache, now) {
-  for (const [key, entry] of cache) {
-    if (entry.expiresAt <= now) cache.delete(key);
-  }
-  while (cache.size >= RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES) {
-    const key = cache.keys().next().value;
-    if (!key) return;
-    cache.delete(key);
-  }
-}
-async function relayHostTokenFor(options, claims, target, trace) {
-  const ttlMs = relayHostTokenCacheTtlMs(options, claims);
-  if (ttlMs <= 0) {
-    return await uncachedRelayHostTokenFor(options, claims, target, trace);
-  }
-  const key = relayHostTokenCacheKey(options, claims, target);
-  const now = Date.now();
-  const cache = relayHostTokenCache(options);
-  const cached = cache.get(key);
-  if (cached && cached.expiresAt > now) {
-    if (cached.promise) {
-      return await trace.span("rht-cache", async () => await cached.promise);
-    }
-    await trace.span("rht-cache", async () => {
-    });
-    return cached.token;
-  }
-  let promise;
-  try {
-    const token = await trace.span("rht-mint", async () => {
-      promise = mintRelayHostToken({
-        principalKind: claims.principal_kind,
-        actorId: claims.actor_id,
-        actorKind: claims.actor_kind,
-        parentJti: claims.jti,
-        ...claims.actor_public_id && claims.actor_name ? {
-          actorPublicId: claims.actor_public_id,
-          actorName: claims.actor_name,
-          ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
-        } : {},
-        orgId: claims.org_id,
-        role: claims.role,
-        ...target,
-        ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-      }, options.relayHostSigningKey, options.relayHostAlgorithm);
-      pruneRelayHostTokenCache(cache, now);
-      cache.set(key, { promise, expiresAt: now + ttlMs });
-      return await promise;
-    });
-    cache.set(key, {
-      token,
-      expiresAt: now + ttlMs
-    });
-    return token;
-  } catch (err) {
-    if (promise && cache.get(key)?.promise === promise) cache.delete(key);
-    throw err;
-  }
-}
-async function uncachedRelayHostTokenFor(options, claims, target, trace) {
-  return await trace.span(
-    "rht-mint",
-    async () => await mintRelayHostToken({
-      principalKind: claims.principal_kind,
-      actorId: claims.actor_id,
-      actorKind: claims.actor_kind,
-      parentJti: claims.jti,
-      ...claims.actor_public_id && claims.actor_name ? {
-        actorPublicId: claims.actor_public_id,
-        actorName: claims.actor_name,
-        ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
-      } : {},
-      orgId: claims.org_id,
-      role: claims.role,
-      ...target,
-      ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-    }, options.relayHostSigningKey, options.relayHostAlgorithm)
-  );
-}
-function workspaceRelayTargetUrl(target, path, search) {
-  return targetUrl(target, path, search);
-}
-function workspaceRelayForwardHeaders(input, relayHostToken, workspaceId, options = {}) {
-  return forwardHeaders(input, relayHostToken, workspaceId, options);
-}
-function workspaceRelayForwardRequestInit(request, relayHostToken, workspaceId, options = {}) {
-  const init = {
-    method: request.method,
-    headers: forwardHeaders(request.headers, relayHostToken, workspaceId, options),
-    body: request.body,
-    duplex: "half",
-    redirect: "manual",
-    ...options.signal ? { signal: options.signal } : {}
-  };
-  if (request.method === "GET" || request.method === "HEAD") delete init.body;
-  return init;
-}
-var auditSamplers = /* @__PURE__ */ new WeakMap();
-function getOrCreateAuditSampler(options) {
-  let state = auditSamplers.get(options);
-  if (!state) {
-    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
-    state = {
-      suppressedCount: 0,
-      timer: void 0,
-      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
-      random: options.random ?? Math.random,
-      sampleRate
-    };
-    auditSamplers.set(options, state);
-  }
-  return state;
-}
-function clampSampleRate(rate) {
-  if (rate === void 0) return 1;
-  if (!Number.isFinite(rate)) return 1;
-  if (rate < 0) return 0;
-  if (rate > 1) return 1;
-  return rate;
-}
-function ensureFlushTimer(options, state) {
-  if (state.timer) return;
-  if (state.sampleRate >= 1) return;
-  if (state.flushIntervalMs <= 0) return;
-  const timer = setInterval(() => {
-    flushSuppressedSummary(options, state);
-  }, state.flushIntervalMs);
-  if (typeof timer.unref === "function") {
-    timer.unref();
-  }
-  state.timer = timer;
-}
-function flushSuppressedSummary(options, state) {
-  const count = state.suppressedCount;
-  if (count <= 0) return;
-  state.suppressedCount = 0;
-  void options.audit?.({
-    action: "relay.request.suppressed_summary",
-    result: "allow",
-    method: "INTERNAL",
-    path: "/",
-    suppressedCount: count
-  });
-}
-function disposeAuditSampler(options) {
-  const state = auditSamplers.get(options);
-  if (!state) return;
-  if (state.timer) {
-    clearInterval(state.timer);
-    state.timer = void 0;
-  }
-  flushSuppressedSummary(options, state);
-  auditSamplers.delete(options);
-}
-function createWorkspaceRelayTrace() {
-  const phases = [];
-  return {
-    phases,
-    async span(name, run) {
-      const startedAt = performance.now();
-      try {
-        return await run();
-      } finally {
-        phases.push({ name, ms: performance.now() - startedAt });
-      }
-    }
-  };
-}
-function roundedMs(value) {
-  return Math.round(value * 100) / 100;
-}
-function workspaceRelayServerTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
-}
-function workspaceRelayTimingResponse(response, trace) {
-  const value = workspaceRelayServerTiming(trace);
-  if (!value) return response;
-  const headers2 = new Headers(response.headers);
-  const prev = headers2.get("server-timing");
-  headers2.set("server-timing", prev ? `${prev}, ${value}` : value);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: headers2
-  });
-}
-async function audit(options, event) {
-  if (event.action === "relay.request.accepted") {
-    const state = getOrCreateAuditSampler(options);
-    if (state.sampleRate < 1) {
-      ensureFlushTimer(options, state);
-      if (state.random() >= state.sampleRate) {
-        state.suppressedCount += 1;
-        return;
-      }
-    }
-  }
-  await options.audit?.(event);
-}
-var defaultOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-var originMatchers = /* @__PURE__ */ new WeakMap();
-function originMatcherFor(options) {
-  if (!options.allowedOrigins) return defaultOriginMatcher;
-  let matcher = originMatchers.get(options);
-  if (!matcher) {
-    matcher = createOriginMatcher(options.allowedOrigins);
-    originMatchers.set(options, matcher);
-  }
-  return matcher;
-}
-var RELAY_ALLOWED_REQUEST_HEADER_LIST = [
-  "Accept",
-  "Authorization",
-  "Content-Type",
-  "Last-Event-ID",
-  "Traceparent",
-  "Tracestate",
-  "X-Fetch-Bypass-Throttle",
-  "X-Daytona-Skip-Preview-Warning",
-  "X-Workspace-Id",
-  "X-OpenCode-Directory",
-  "X-Claxedo-Runner",
-  "X-Claxedo-Model",
-  "X-Claxedo-Draft-Id",
-  "X-Claxedo-Binary"
-];
-var RELAY_ALLOWED_REQUEST_HEADERS = RELAY_ALLOWED_REQUEST_HEADER_LIST.join(", ");
-function denyCorsHeaders(request, originAllowed = defaultOriginMatcher) {
-  const origin = request.headers.get("origin");
-  if (!origin) return void 0;
-  if (!originAllowed(origin)) return void 0;
-  return {
-    "access-control-allow-origin": origin,
-    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
-    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
-  };
-}
-async function deny(options, input) {
-  const url = new URL(input.request.url);
-  await audit(options, {
-    action: "relay.request.denied",
-    result: "deny",
-    reason: input.code,
-    actorId: input.claims?.actor_id,
-    actorKind: input.claims?.actor_kind,
-    principalKind: input.claims?.principal_kind,
-    ...input.claims ? { role: input.claims.role } : {},
-    workspaceId: input.claims?.workspace_id,
-    hostId: input.claims?.host_id,
-    method: input.request.method,
-    path: url.pathname
-  });
-  return Response.json(errorBody(input.code, input.message), {
-    status: input.status,
-    headers: denyCorsHeaders(input.request, originMatcherFor(options))
-  });
-}
-async function authorizeWorkspaceRelayRequest(options, request, workspaceId, trace) {
-  const token = runtimeAccessToken(request);
-  if (!token) {
-    return {
-      ok: false,
-      code: "runtime_access_token_required",
-      response: await deny(options, {
-        code: "runtime_access_token_required",
-        message: "Runtime Access Token is required",
-        status: 401,
-        request
-      })
-    };
-  }
-  try {
-    const span = (name, run) => trace ? trace.span(name, run) : run();
-    const claims = await span(
-      "rat-verify",
-      async () => await cachedRuntimeAccessTokenClaims(options, token, workspaceId)
-    );
-    const active = await span("rat-active", async () => {
-      return await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
-    });
-    if (!active.active) {
-      return {
-        ok: false,
-        code: active.code,
-        response: await deny(options, {
-          code: active.code,
-          message: active.reason,
-          status: 401,
-          claims,
-          request
-        })
-      };
-    }
-    const path = relayRuntimePath(request);
-    if (!path || !roleAllowsRelayRequest(claims.role, request.method, path)) {
-      return {
-        ok: false,
-        code: "relay_role_denied",
-        response: await deny(options, {
-          code: "relay_role_denied",
-          message: "Workspace role does not allow this relay request",
-          status: 403,
-          claims,
-          request
-        })
-      };
-    }
-    const target = await span("target-resolve", async () => await options.resolveTarget(claims));
-    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id) {
-      return {
-        ok: false,
-        code: "relay_target_unavailable",
-        response: await deny(options, {
-          code: "relay_target_unavailable",
-          message: "Workspace relay target is unavailable",
-          status: 403,
-          claims,
-          request
-        })
-      };
-    }
-    if (isUserHostedTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
-      return {
-        ok: false,
-        code: "user_hosted_app_offline",
-        response: await deny(options, {
-          code: "user_hosted_app_offline",
-          message: "User-hosted workspace is offline",
-          status: 503,
-          claims,
-          request
-        })
-      };
-    }
-    await span("audit", async () => await audit(options, {
-      action: "relay.request.accepted",
-      result: "allow",
-      actorId: claims.actor_id,
-      actorKind: claims.actor_kind,
-      principalKind: claims.principal_kind,
-      role: claims.role,
-      workspaceId: claims.workspace_id,
-      hostId: claims.host_id,
-      method: request.method,
-      path: new URL(request.url).pathname
-    }));
-    const relayHostToken = await relayHostTokenFor(options, claims, target, { span });
-    return {
-      ok: true,
-      request: {
-        claims,
-        target,
-        relayHostToken,
-        path
-      }
-    };
-  } catch (err) {
-    const code = err instanceof WorkspaceRelayAuthError ? err.code : "relay_request_failed";
-    return {
-      ok: false,
-      code,
-      response: await deny(options, {
-        code,
-        message: "Workspace relay request was denied",
-        status: code.includes("mismatch") ? 403 : 401,
-        request
-      })
-    };
-  }
-}
-async function forwardWorkspaceRelayRequest(request, target, relayHostToken, path, requestFetch, timeoutMs, trace, originAllowed = defaultOriginMatcher) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const span = (name, run) => trace ? trace.span(name, run) : run();
-  try {
-    const upstream = await span("upstream-fetch", async () => await requestFetch(
-      targetUrl(target, path, new URL(request.url).search),
-      workspaceRelayForwardRequestInit(request, relayHostToken, target.workspaceId, {
-        signal: controller.signal,
-        upstreamHeaders: target.upstreamHeaders
-      })
-    ));
-    const headers2 = new Headers(upstream.headers);
-    headers2.delete("access-control-allow-origin");
-    headers2.delete("access-control-allow-credentials");
-    headers2.delete("access-control-allow-headers");
-    headers2.delete("access-control-allow-methods");
-    headers2.delete("access-control-expose-headers");
-    headers2.delete("access-control-max-age");
-    for (const [key, value] of Object.entries(denyCorsHeaders(request, originAllowed) ?? {})) {
-      headers2.set(key, value);
-    }
-    return new Response(upstream.body, {
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers: headers2
-    });
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return Response.json(
-      errorBody(
-        aborted ? "upstream_timeout" : "upstream_unavailable",
-        aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable"
-      ),
-      { status: aborted ? 504 : 503, headers: denyCorsHeaders(request, originAllowed) }
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function getAuditSuppressedCount(options) {
-  return auditSamplers.get(options)?.suppressedCount ?? 0;
-}
-var LOOPBACK_REMOTES = /* @__PURE__ */ new Set([
-  "127.0.0.1",
-  "::1",
-  "::ffff:127.0.0.1"
-]);
-function isLoopbackAddress(address) {
-  if (!address) return false;
-  const trimmed = address.trim();
-  if (LOOPBACK_REMOTES.has(trimmed)) return true;
-  if (trimmed.startsWith("127.")) return true;
-  if (/^::ffff:127\./i.test(trimmed)) return true;
-  return false;
-}
-function checkMetricsAuth(options, request) {
-  if (options.metricsToken) {
-    const presented = bearerToken(request.headers.get("authorization") ?? void 0);
-    if (!presented || presented !== options.metricsToken) {
-      return {
-        ok: false,
-        status: 401,
-        code: "metrics_unauthorized",
-        message: "Metrics endpoint requires a valid bearer token"
-      };
-    }
-    return { ok: true };
-  }
-  if (!options.metricsRemoteAddress) {
-    return {
-      ok: false,
-      status: 401,
-      code: "metrics_unauthorized",
-      message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-    };
-  }
-  const address = options.metricsRemoteAddress(request);
-  if (isLoopbackAddress(address)) return { ok: true };
-  return {
-    ok: false,
-    status: 401,
-    code: "metrics_unauthorized",
-    message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-  };
-}
-function buildMetricsBody(options) {
-  const sources = options.metricsSources ?? {};
-  const fragmentation = sources.fragmentation?.() ?? { fragmentsBuffered: 0, oversizedClosed: 0 };
-  const slowConsumer = sources.slowConsumer?.() ?? {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-  const activeHostCount = options.directory?.size?.() ?? 0;
-  const suppressedAccepts = getAuditSuppressedCount(options);
-  const body = {
-    fragmentation,
-    slowConsumer,
-    directory: { activeHostCount },
-    audit: { suppressedAccepts }
-  };
-  if (sources.drainPending) {
-    body.drain = { pendingCount: sources.drainPending() };
-  }
-  return body;
-}
-function createWorkspaceRelay(options) {
-  const app = Object.assign(new Hono(), {
-    disposeAuditSampler: () => disposeAuditSampler(options)
-  });
-  const originAllowed = originMatcherFor(options);
-  app.use("*", async (c, next) => {
-    await next();
-    const origin = c.res.headers.get("access-control-allow-origin");
-    if (origin && origin !== "*" && !c.res.headers.has("timing-allow-origin")) {
-      c.res.headers.set("timing-allow-origin", origin);
-    }
-  });
-  app.use("*", cors({
-    origin: (origin) => {
-      if (!origin) return void 0;
-      return originAllowed(origin) ? origin : void 0;
-    },
-    // Spread from the shared list, not hand-maintained here: a duplicate
-    // array drifts out of sync and silently drops headers like
-    // `Last-Event-ID` or `X-Fetch-Bypass-Throttle`.
-    allowHeaders: [...RELAY_ALLOWED_REQUEST_HEADER_LIST],
-    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
-  }));
-  app.get("/health", (c) => {
-    if (options.isDraining?.()) {
-      return c.json(
-        { ok: false, service: "workspace-relay", draining: true },
-        503
-      );
-    }
-    return c.json({ ok: true, service: "workspace-relay" });
-  });
-  app.get("/.well-known/jwks.json", async (c) => {
-    const sources = options.relayHostPublicKeys ?? [];
-    if (sources.length === 0) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_no_keys_configured",
-            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
-          }
-        },
-        503
-      );
-    }
-    let keys;
-    try {
-      keys = await Promise.all(sources.map(async (source) => {
-        const jwk = await exportJWK2(source.publicKey);
-        return {
-          ...jwk,
-          kid: source.kid,
-          alg: "EdDSA",
-          use: "sig"
-        };
-      }));
-    } catch (err) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_invalid_key",
-            message: "A configured RHT public key could not be exported as a JWK",
-            detail: err instanceof Error ? err.message : String(err)
-          }
-        },
-        500
-      );
-    }
-    c.header("cache-control", "public, max-age=300");
-    return c.json({ keys });
-  });
-  app.get("/metrics", (c) => {
-    const authResult = checkMetricsAuth(options, c.req.raw);
-    if (!authResult.ok) {
-      return c.json(
-        errorBody(authResult.code, authResult.message),
-        authResult.status
-      );
-    }
-    return c.json(buildMetricsBody(options));
-  });
-  app.all("/workspaces/:workspaceId/*", async (c) => {
-    const trace = createWorkspaceRelayTrace();
-    if (options.isDraining?.()) {
-      return Response.json(
-        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
-        { status: 503, headers: denyCorsHeaders(c.req.raw, originAllowed) }
-      );
-    }
-    const response = await trace.span("relay-total", async () => {
-      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
-      if (!relay.ok) return relay.response;
-      return await forwardWorkspaceRelayRequest(
-        new Request(c.req.raw),
-        relay.request.target,
-        relay.request.relayHostToken,
-        relay.request.path,
-        options.fetch ?? fetch,
-        options.forwardTimeoutMs ?? 3e4,
-        trace,
-        originAllowed
-      );
-    });
-    return workspaceRelayTimingResponse(response, trace);
-  });
-  return app;
-}
-
-// src/upstream-websocket.ts
-function resolveUpstreamWebSocket(override) {
-  return override ?? WebSocket;
-}
-
-// src/bun.ts
-var WORKSPACE_RELAY_IDLE_TIMEOUT_SECONDS = 45;
-var isRelayClientSocket = (ws) => ws.data.kind === "client";
-var isHostTunnelSocket = (ws) => ws.data.kind === "host-tunnel";
-var isUserHostedClientSocket = (ws) => ws.data.kind === "user-hosted-client";
-var TUNNEL_PENDING_HTTP_CAP = 32;
-var TUNNEL_CHANNEL_CAP = 16;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_CAP = 5;
-var HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS = 6e4;
-var WS_MAX_PAYLOAD_LENGTH_BYTES = 16 * 1024 * 1024;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT = 3e4;
-var DIRECT_HTTP_TIMEOUT_MS_DEFAULT = 3e4;
-var UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT = 1e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var relayBufferedBytes = (socket) => {
-  if (typeof socket !== "object" || socket === null) return void 0;
-  if ("getBufferedAmount" in socket && typeof socket.getBufferedAmount === "function") {
-    const measured = socket.getBufferedAmount();
-    return typeof measured === "number" && Number.isFinite(measured) ? measured : void 0;
-  }
-  if (!("bufferedAmount" in socket)) return void 0;
-  const property = socket.bufferedAmount;
-  return typeof property === "number" && Number.isFinite(property) ? property : void 0;
-};
-var relayOverBackpressureLimit = (socket, limitBytes) => {
-  const queued = relayBufferedBytes(socket);
-  return queued !== void 0 && queued > limitBytes;
-};
-var HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT = 2;
-var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-var HOST_GENERATION_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
-var TUNNEL_MESSAGE_BUFFER_CAP_BYTES = 4 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
-var HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT = 250;
-function createFragmentationStats() {
-  return {
-    fragmentsBuffered: 0,
-    oversizedClosed: 0
-  };
-}
-function createSlowConsumerStats() {
-  return {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-}
-function readFragmentationStats(stats) {
-  return {
-    fragmentsBuffered: stats.fragmentsBuffered,
-    oversizedClosed: stats.oversizedClosed
-  };
-}
-function resetFragmentationStats(stats) {
-  stats.fragmentsBuffered = 0;
-  stats.oversizedClosed = 0;
-}
-function readSlowConsumerStats(stats) {
-  return { ...stats };
-}
-function resetSlowConsumerStats(stats) {
-  stats.overflowEvents = 0;
-  stats.timerFired = 0;
-  stats.droppedRequests = 0;
-}
-function createDirectHttpLimiter(limit) {
-  if (!Number.isInteger(limit) || !limit || limit <= 0) return void 0;
-  const max = limit;
-  let active = 0;
-  const queue = [];
-  function drain() {
-    if (active >= max) return;
-    const next = queue.shift();
-    if (!next) return;
-    active++;
-    next();
-  }
-  return {
-    async acquire() {
-      if (active < max) {
-        active++;
-      } else {
-        await new Promise((resolve) => queue.push(resolve));
-      }
-      let released = false;
-      return () => {
-        if (released) return;
-        released = true;
-        active = Math.max(0, active - 1);
-        drain();
-      };
-    }
-  };
-}
-function jsonError(code, message, status) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-function corsJsonError(request, originAllowed, code, message, status) {
-  const headers2 = relayCorsHeaders(request, originAllowed);
-  headers2.set("content-type", "application/json");
-  return new Response(JSON.stringify({ error: { code, message } }), { status, headers: headers2 });
-}
-function preOpenFrameBytes(message) {
-  return typeof message === "string" ? Buffer.byteLength(message) : message.byteLength;
-}
-function safeCloseCode(input, fallback = 1011) {
-  if (input === void 0 || !Number.isInteger(input)) return fallback;
-  const code = input;
-  if (code === 1e3) return code;
-  if (code >= 1001 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) return code;
-  if (code >= 3e3 && code <= 4999) return code;
-  return fallback;
-}
-function closeWebSocket(ws, code, reason, fallback = 1011) {
-  try {
-    ws.close(safeCloseCode(code, fallback), reason);
-  } catch {
-    try {
-      ws.close(fallback, reason);
-    } catch {
-    }
-  }
-}
-function upstreamCloseReason(event) {
-  if (event.reason.trim()) return event.reason;
-  if (event.code === 1e3) return "";
-  if (event.code === 1005 || event.code === 1006) return "Upstream WebSocket closed abnormally";
-  return `Upstream WebSocket closed unexpectedly with code ${event.code}`;
-}
-function workspaceIdFromPath(pathname) {
-  return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function hostIdFromTunnelPath(pathname) {
-  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
-function tunnelKey(hostId, workspaceId) {
-  return `${hostId}\0${workspaceId}`;
-}
-function tunnelIdentity(hostId, workspaceIds) {
-  return `${hostId}\0${[...new Set(workspaceIds)].sort().join(",")}`;
-}
-function ownedWorkspaceIds(hostTunnels, ws) {
-  return ws.data.workspaceIds.filter((workspaceId) => hostTunnels.get(tunnelKey(ws.data.hostId, workspaceId)) === ws);
-}
-function outranks(incumbent, candidateGeneration) {
-  return hostTunnelIncumbentOutranks(incumbent.data.generation, candidateGeneration);
-}
-function websocketRequest(request) {
-  return request.headers.get("upgrade")?.toLowerCase() === "websocket";
-}
-function roundedMs2(input) {
-  return Math.round(input * 100) / 100;
-}
-function relayWebSocketTraceEnabled(request) {
-  return request.headers.get("x-claxedo-relay-ws-trace") === "1";
-}
-function sendRelayWebSocketTrace(ws) {
-  const trace = ws.data.trace;
-  if (!trace || trace.emitted) return;
-  trace.emitted = true;
-  ws.send(JSON.stringify({
-    type: "relay.trace",
-    wsUpstreamOpenMs: trace.upstreamOpenMs === void 0 ? void 0 : roundedMs2(trace.upstreamOpenMs),
-    queuedFrames: trace.queuedFrames,
-    maxQueuedDelayMs: roundedMs2(trace.maxQueuedDelayMs)
-  }));
-}
-function relayWebSocketPayload(input) {
-  if (typeof input === "string") return input;
-  if (input instanceof ArrayBuffer) return input;
-  if (ArrayBuffer.isView(input)) {
-    const copy = new Uint8Array(input.byteLength);
-    copy.set(new Uint8Array(input.buffer, input.byteOffset, input.byteLength));
-    return copy;
-  }
-  return void 0;
-}
-function headersRecord(headers2) {
-  const result = {};
-  headers2.forEach((value, key) => {
-    result[key] = value;
-  });
-  return result;
-}
-function headers(input) {
-  const result = new Headers();
-  for (const [key, value] of Object.entries(input)) {
-    result.set(key, value);
-  }
-  return result;
-}
-function isEventStream(input) {
-  return Object.entries(input).some(
-    ([key, value]) => key.toLowerCase() === "content-type" && value.toLowerCase().includes("text/event-stream")
-  );
-}
-var defaultRelayOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-function allowedCorsOrigin(origin, matcher) {
-  if (!origin) return void 0;
-  return matcher(origin) ? origin : void 0;
-}
-function requireAllowedOrigin(request, matcher) {
-  const origin = request.headers.get("origin");
-  if (allowedCorsOrigin(origin, matcher)) return null;
-  return jsonError(
-    "origin_not_allowed",
-    "Origin is not in the allowlist",
-    403
-  );
-}
-function relayCorsHeaders(request, originAllowed, input = new Headers()) {
-  const result = new Headers(input);
-  result.delete("access-control-allow-origin");
-  result.delete("access-control-allow-credentials");
-  result.delete("access-control-allow-headers");
-  result.delete("access-control-allow-methods");
-  result.delete("access-control-expose-headers");
-  result.delete("access-control-max-age");
-  const origin = allowedCorsOrigin(request.headers.get("origin"), originAllowed);
-  if (origin) {
-    result.set("access-control-allow-origin", origin);
-    result.set("access-control-allow-headers", RELAY_ALLOWED_REQUEST_HEADERS);
-    result.set("access-control-allow-methods", "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS");
-  }
-  return result;
-}
-function encoded(input) {
-  return Buffer.from(input).toString("base64");
-}
-function decoded(input) {
-  return new Uint8Array(Buffer.from(input, "base64"));
-}
-function encodedFrame(message) {
-  if (typeof message === "string") {
-    return {
-      binary: false,
-      data_base64: Buffer.from(message).toString("base64")
-    };
-  }
-  return {
-    binary: true,
-    data_base64: Buffer.from(message).toString("base64")
-  };
-}
-function decodedFrame(frame) {
-  const body = Buffer.from(frame.data_base64, "base64");
-  return frame.binary ? new Uint8Array(body) : body.toString("utf8");
-}
-function tunnelMessage(ws, input, stats) {
-  if (typeof input !== "string") return void 0;
-  const combined = ws.data.messageBuffer.length > 0 ? ws.data.messageBuffer + input : input;
-  let parsed;
-  try {
-    parsed = JSON.parse(combined);
-  } catch {
-    if (combined.length > TUNNEL_MESSAGE_BUFFER_CAP_BYTES) {
-      stats.oversizedClosed += 1;
-      ws.data.messageBuffer = "";
-      ws.close(1009, "Tunnel message buffer exceeded 4 MB");
-      return void 0;
-    }
-    stats.fragmentsBuffered += 1;
-    ws.data.messageBuffer = combined;
-    return void 0;
-  }
-  ws.data.messageBuffer = "";
-  const validated = validateTunnelMessage(parsed);
-  if (validated.ok) return validated.message;
-  if (validated.reason === "protocol_mismatch") {
-    ws.close(1002, `Tunnel protocol mismatch: expected ${validated.expected_protocol}`);
-  }
-  return void 0;
-}
-function sendTunnelPing(ws) {
-  if (ws.readyState !== WebSocket.OPEN) return;
-  ws.data.missedPongs += 1;
-  ws.send(JSON.stringify(makeTunnelPing()));
-}
-function clearPendingTimers(entry) {
-  clearTimeout(entry.timeout);
-  if (entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function failPendingHttpResponse(input) {
-  clearPendingTimers(input.entry);
-  input.entry.pendingChunks.length = 0;
-  input.entry.bytesQueued = 0;
-  try {
-    input.entry.controller.error(input.error);
-  } catch {
-  }
-  if (!input.entry.responseStarted) {
-    if (input.response) {
-      input.entry.resolve(input.response);
-      return;
-    }
-    input.entry.reject(input.error);
-  }
-}
-function cleanupHostTunnelSocket(input) {
-  if (input.ws.data.heartbeat) {
-    clearInterval(input.ws.data.heartbeat);
-    input.ws.data.heartbeat = void 0;
-  }
-  for (const pending of input.ws.data.pending.values()) {
-    failPendingHttpResponse({
-      entry: pending,
-      response: input.request ? corsJsonError(input.request, input.originAllowed, "user_hosted_app_offline", "User-hosted workspace is offline", 503) : jsonError("user_hosted_app_offline", "User-hosted workspace is offline", 503),
-      error: new Error("User-hosted tunnel disconnected")
-    });
-  }
-  input.ws.data.pending.clear();
-  for (const channel of input.ws.data.channels.values()) {
-    if (input.closeChannels) closeWebSocket(channel, 1011, "User-hosted tunnel disconnected");
-  }
-  input.ws.data.channels.clear();
-  if (!input.disconnectDirectory) return;
-  const owned = ownedWorkspaceIds(input.hostTunnels, input.ws);
-  if (owned.length === 0) return;
-  for (const workspaceId of owned) input.hostTunnels.delete(tunnelKey(input.ws.data.hostId, workspaceId));
-  input.options.directory?.disconnectHost(input.ws.data.hostId, owned);
-  scheduleHostTunnelStateChange(input.hostTunnelStateDebounce, input.options, {
-    hostId: input.ws.data.hostId,
-    workspaceIds: input.ws.data.workspaceIds,
-    path: `/host-tunnels/${input.ws.data.hostId}`,
-    state: "disconnected",
-    debounceMs: input.bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-  });
-}
-async function audit2(options, input) {
-  await options.audit?.({
-    action: input.action,
-    result: "allow",
-    hostId: input.hostId,
-    workspaceId: input.workspaceId,
-    method: "WEBSOCKET",
-    path: input.path
-  });
-}
-async function auditHostTunnelDenial(options, input) {
-  await options.audit?.({
-    action: "host_tunnel.denied",
-    result: "deny",
-    reason: input.code,
-    hostId: input.hostId,
-    ...input.workspaceId ? { workspaceId: input.workspaceId } : {},
-    method: "WEBSOCKET",
-    path: `/host-tunnels/${input.hostId}`
-  });
-}
-async function denyHostTunnel(options, input) {
-  await auditHostTunnelDenial(options, input);
-  return jsonError(input.code, input.message, input.status);
-}
-async function refuseHostTunnelSocket(options, ws, input) {
-  await auditHostTunnelDenial(options, { code: input.code, hostId: ws.data.hostId, ...input.workspaceId ? { workspaceId: input.workspaceId } : {} });
-  closeWebSocket(ws, input.close, input.reason, input.close);
-}
-function scheduleHostTunnelStateChange(state, options, input) {
-  const identity = tunnelIdentity(input.hostId, input.workspaceIds);
-  const workspaceId = input.workspaceIds[0];
-  const existing = state.get(identity);
-  const entry = existing ?? {
-    intendedState: "disconnected",
-    lastWritten: "disconnected",
-    flushTimer: void 0,
-    pending: { workspaceId, path: input.path }
-  };
-  entry.intendedState = input.state;
-  entry.pending = { workspaceId, path: input.path };
-  if (entry.flushTimer) clearTimeout(entry.flushTimer);
-  entry.flushTimer = setTimeout(() => {
-    entry.flushTimer = void 0;
-    if (entry.intendedState === entry.lastWritten) {
-      if (entry.intendedState === "disconnected") {
-        state.delete(identity);
-      }
-      return;
-    }
-    entry.lastWritten = entry.intendedState;
-    void audit2(options, {
-      action: entry.intendedState === "connected" ? "host_tunnel.connected" : "host_tunnel.disconnected",
-      hostId: input.hostId,
-      workspaceId: entry.pending.workspaceId,
-      path: entry.pending.path
-    });
-  }, input.debounceMs);
-  state.set(identity, entry);
-}
-function drainPendingChunks(entry) {
-  while (entry.pendingChunks.length > 0) {
-    const desired = entry.controller.desiredSize;
-    if (desired !== null && desired <= 0) break;
-    const next = entry.pendingChunks.shift();
-    entry.bytesQueued -= next.byteLength;
-    try {
-      entry.controller.enqueue(next);
-    } catch {
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      break;
-    }
-  }
-  if (entry.pendingChunks.length === 0 && entry.slowConsumerTimeout) {
-    clearTimeout(entry.slowConsumerTimeout);
-    entry.slowConsumerTimeout = void 0;
-  }
-}
-function enqueueChunkWithBackpressure(input) {
-  const { entry, chunk } = input;
-  const desired = entry.controller.desiredSize;
-  const overflowing = desired !== null && desired <= 0;
-  if (overflowing || entry.pendingChunks.length > 0) {
-    entry.pendingChunks.push(chunk);
-    entry.bytesQueued += chunk.byteLength;
-    if (!entry.slowConsumerTimeout) {
-      input.slowConsumerStats.overflowEvents += 1;
-      entry.slowConsumerTimeout = setTimeout(() => {
-        input.slowConsumerStats.timerFired += 1;
-        const error = new Error("slow_consumer_timeout: downstream consumer did not drain in time");
-        try {
-          entry.controller.error(error);
-        } catch {
-        }
-        clearTimeout(entry.timeout);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        if (!entry.responseStarted) {
-          entry.resolve(jsonError("slow_consumer_timeout", "Downstream consumer did not drain in time", 503));
-        }
-        input.ws.data.pending.delete(input.requestId);
-        input.slowConsumerStats.droppedRequests += 1;
-      }, input.slowConsumerTimeoutMs);
-    }
-    return;
-  }
-  try {
-    entry.controller.enqueue(chunk);
-  } catch {
-  }
-}
-var __slowConsumerInternalsForTest = {
-  enqueueChunkWithBackpressure,
-  createSlowConsumerStats
-};
-async function tunnelHttpRequest(input) {
-  if (input.ws.readyState !== WebSocket.OPEN) {
-    return new Response("User-hosted workspace is offline", { status: 503 });
-  }
-  if (input.ws.data.pending.size >= TUNNEL_PENDING_HTTP_CAP) {
-    return jsonError(
-      "too_many_in_flight",
-      "User-hosted tunnel has too many in-flight HTTP requests",
-      429
-    );
-  }
-  const requestId = crypto.randomUUID();
-  let controller;
-  const stream = new ReadableStream({
-    start(next) {
-      controller = next;
-    },
-    pull() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      drainPendingChunks(entry);
-    },
-    cancel() {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      clearPendingTimers(entry);
-      entry.pendingChunks.length = 0;
-      entry.bytesQueued = 0;
-      if (input.ws.readyState === WebSocket.OPEN) {
-        input.ws.send(JSON.stringify({
-          type: "http.response.flow",
-          protocol: TUNNEL_PROTOCOL_VERSION,
-          request_id: requestId,
-          paused: false,
-          reason: "closed"
-        }));
-      }
-    }
-  }, new ByteLengthQueuingStrategy({ highWaterMark: input.slowConsumerHighWaterMarkBytes }));
-  const pending = new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      const entry = input.ws.data.pending.get(requestId);
-      if (!entry) return;
-      input.ws.data.pending.delete(requestId);
-      if (entry.responseStarted) {
-        clearPendingTimers(entry);
-        entry.pendingChunks.length = 0;
-        entry.bytesQueued = 0;
-        try {
-          entry.controller.close();
-        } catch {
-        }
-        return;
-      }
-      const error = new Error("User-hosted tunnel response timed out");
-      failPendingHttpResponse({
-        entry,
-        response: corsJsonError(input.request, input.originAllowed, "user_hosted_tunnel_timeout", "User-hosted tunnel response timed out", 504),
-        error
-      });
-    }, input.responseTimeoutMs);
-    input.ws.data.pending.set(requestId, {
-      controller,
-      stream,
-      resolve,
-      reject,
-      timeout,
-      pendingChunks: [],
-      bytesQueued: 0,
-      responseStarted: false,
-      corsHeaders: (upstream) => relayCorsHeaders(input.request, input.originAllowed, upstream)
-    });
-  });
-  const body = input.request.method === "GET" || input.request.method === "HEAD" ? void 0 : await readBoundedBody(input.request, input.originAllowed, input.requestBodyMaxBytes);
-  if (body && "response" in body) {
-    const entry = input.ws.data.pending.get(requestId);
-    if (entry) clearPendingTimers(entry);
-    input.ws.data.pending.delete(requestId);
-    return body.response;
-  }
-  input.ws.send(JSON.stringify({
-    type: "http.request",
-    protocol: TUNNEL_PROTOCOL_VERSION,
-    request_id: requestId,
-    workspace_id: input.workspaceId,
-    method: input.request.method,
-    path: input.path,
-    headers: headersRecord(workspaceRelayForwardHeaders(
-      input.request.headers,
-      input.relayHostToken,
-      input.workspaceId,
-      // User-hosted tunnel: strip Cookie so browser cookies never reach the
-      // host process on the user's laptop.
-      { userHosted: true }
-    )),
-    ...body?.bodyBase64 ? { body_base64: body.bodyBase64 } : {},
-    end: true
-  }));
-  return await pending;
-}
-async function readBoundedBody(request, originAllowed, maxBytes) {
-  if (!request.body) return void 0;
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  for (; ; ) {
-    const next = await reader.read();
-    if (next.done) break;
-    total += next.value.byteLength;
-    if (total > maxBytes) {
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      return {
-        response: corsJsonError(request, originAllowed, "request_body_too_large", "Tunnel request body exceeds the relay limit", 413)
-      };
-    }
-    chunks.push(next.value);
-  }
-  const body = new Uint8Array(total);
-  chunks.reduce((offset, chunk) => {
-    body.set(chunk, offset);
-    return offset + chunk.byteLength;
-  }, 0);
-  return { bodyBase64: encoded(body.buffer) };
-}
-async function directHttpRequest(input) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
-  const span = (name, run) => input.trace ? input.trace.span(name, run) : run();
-  try {
-    const init = workspaceRelayForwardRequestInit(
-      input.request,
-      input.relayHostToken,
-      input.workspaceId,
-      {
-        // Cloud-vm direct path: cookies pass through — workspace dashboards in
-        // the VM may legitimately need session cookies.
-        userHosted: false,
-        upstreamHeaders: input.upstreamHeaders,
-        signal: controller.signal
-      }
-    );
-    if (input.request.method !== "GET" && input.request.method !== "HEAD" && input.request.body) {
-      init.body = await input.request.arrayBuffer();
-    }
-    const limiter = input.limiter;
-    const release = limiter ? await span("direct-http-queue", () => limiter.acquire()) : void 0;
-    try {
-      const upstream = await span("upstream-fetch", async () => await fetch(input.targetUrl, init));
-      const headers2 = relayCorsHeaders(input.request, input.originAllowed, upstream.headers);
-      const contentType = upstream.headers.get("content-type") ?? "";
-      const streamResponse = contentType.includes("text/event-stream") || contentType.includes("application/octet-stream");
-      if (streamResponse) {
-        return new Response(upstream.body, {
-          status: upstream.status,
-          statusText: upstream.statusText,
-          headers: headers2
-        });
-      }
-      const body = await upstream.arrayBuffer();
-      return new Response(body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: headers2
-      });
-    } finally {
-      release?.();
-    }
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return corsJsonError(
-      input.request,
-      input.originAllowed,
-      aborted ? "upstream_timeout" : "upstream_unavailable",
-      aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable",
-      aborted ? 504 : 503
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function hostTunnel(hostTunnels, hostId, workspaceId) {
-  const tunnel = hostTunnels.get(tunnelKey(hostId, workspaceId));
-  if (tunnel?.readyState === WebSocket.OPEN) return tunnel;
-  return void 0;
-}
-async function authorizeHostTunnel(options, bunOptions, request, input) {
-  if (bunOptions.authorizeHostTunnel) {
-    return { authorized: await bunOptions.authorizeHostTunnel(request, input) };
-  }
-  const token = bearerToken(request.headers.get("authorization"));
-  if (!token) return { authorized: false };
-  try {
-    return { authorized: true, claims: await verifyHostTunnelToken(token, options.runtimeAccessKey, input) };
-  } catch (err) {
-    if (err instanceof WorkspaceRelayAuthError) return { authorized: false };
-    throw err;
-  }
-}
-function clearHostGenerationWatcher(data) {
-  if (data.generationCheckTimer) clearInterval(data.generationCheckTimer);
-  data.generationCheckTimer = void 0;
-}
-function watchHostGeneration(ws, options, bunOptions) {
-  const intervalMs = bunOptions.hostGenerationCheckIntervalMs ?? HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT;
-  if (ws.data.generationCheckTimer || !options.resolveHostGeneration || ws.data.generation === void 0 || intervalMs <= 0) return;
-  const graceAttempts = bunOptions.hostGenerationOutageGraceAttempts ?? HOST_GENERATION_OUTAGE_GRACE_ATTEMPTS_DEFAULT;
-  ws.data.generationCheckTimer = setInterval(() => {
-    void checkHostTunnelGeneration(options.resolveHostGeneration, {
-      enrollment_id: ws.data.enrollmentId,
-      generation: ws.data.generation
-    }).then((decision) => {
-      if (decision.ok) {
-        ws.data.generationCheckFailures = 0;
-        return;
-      }
-      if (!decision.retryable) {
-        clearHostGenerationWatcher(ws.data);
-        closeWebSocket(ws, 1008, decision.reason, 1008);
-        return;
-      }
-      ws.data.generationCheckFailures += 1;
-      if (ws.data.generationCheckFailures < graceAttempts) return;
-      clearHostGenerationWatcher(ws.data);
-      closeWebSocket(ws, 1012, "Host generation check unavailable", 1012);
-    });
-  }, intervalMs);
-  if (typeof ws.data.generationCheckTimer.unref === "function") ws.data.generationCheckTimer.unref();
-}
-var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-function clearClientAccessWatchers(data) {
-  if (data.accessCheckTimer) clearInterval(data.accessCheckTimer);
-  if (data.expiryTimer) clearTimeout(data.expiryTimer);
-  data.accessCheckTimer = void 0;
-  data.expiryTimer = void 0;
-}
-function watchClientAccess(ws, options, bunOptions) {
-  const now = bunOptions.now ?? Date.now;
-  const close = (reason) => {
-    clearClientAccessWatchers(ws.data);
-    closeWebSocket(ws, 1008, reason, 1008);
-  };
-  ws.data.expiryTimer = setTimeout(
-    () => close("Runtime Access Token expired"),
-    Math.max(0, ws.data.claims.exp * 1e3 - now())
-  );
-  if (typeof ws.data.expiryTimer.unref === "function") ws.data.expiryTimer.unref();
-  const intervalMs = bunOptions.runtimeAccessTokenActiveCheckIntervalMs ?? RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
-  if (!options.isRuntimeAccessTokenActive || intervalMs <= 0) return;
-  ws.data.accessCheckTimer = setInterval(() => {
-    void Promise.resolve(options.isRuntimeAccessTokenActive(ws.data.claims)).then((active) => {
-      if (!active.active) close(active.reason);
-    }).catch(() => {
-    });
-  }, intervalMs);
-  if (typeof ws.data.accessCheckTimer.unref === "function") ws.data.accessCheckTimer.unref();
-}
-function createWorkspaceRelayBun(options, bunOptions = {}) {
-  const hostTunnels = /* @__PURE__ */ new Map();
-  const relayClients = /* @__PURE__ */ new Set();
-  const hostTunnelRegistrations = /* @__PURE__ */ new Map();
-  const directHttpLimiter = createDirectHttpLimiter(bunOptions.directHttpConcurrency);
-  const hostTunnelStateDebounce = /* @__PURE__ */ new Map();
-  const fragmentationStats = createFragmentationStats();
-  const slowConsumerStats = createSlowConsumerStats();
-  const relayOriginMatcher = options.allowedOrigins ? createOriginMatcher(options.allowedOrigins) : defaultRelayOriginMatcher;
-  const telemetry = {
-    getFragmentationStats: () => readFragmentationStats(fragmentationStats),
-    resetFragmentationStats: () => resetFragmentationStats(fragmentationStats),
-    getSlowConsumerStats: () => readSlowConsumerStats(slowConsumerStats),
-    resetSlowConsumerStats: () => resetSlowConsumerStats(slowConsumerStats)
-  };
-  let draining = false;
-  const drainController = {
-    isDraining: () => draining,
-    setDraining: (value) => {
-      draining = value;
-      if (!value) return;
-      for (const tunnel of new Set(hostTunnels.values())) {
-        closeWebSocket(tunnel, 1012, "Workspace relay is draining", 1012);
-      }
-      for (const client of relayClients) {
-        closeWebSocket(client, 1012, "Workspace relay is draining", 1012);
-      }
-    },
-    pendingCount: () => {
-      let total = 0;
-      for (const tunnel of new Set(hostTunnels.values())) {
-        total += tunnel.data.pending.size;
-      }
-      return total;
-    },
-    waitForDrain: async (timeoutMs) => {
-      const deadline = Date.now() + Math.max(0, timeoutMs);
-      const pollMs = 50;
-      while (true) {
-        const remaining = drainController.pendingCount();
-        if (remaining === 0) return { drained: true, remaining: 0 };
-        const now = Date.now();
-        if (now >= deadline) return { drained: false, remaining };
-        const sleep = Math.min(pollMs, Math.max(1, deadline - now));
-        await new Promise((resolve) => setTimeout(resolve, sleep));
-      }
-    }
-  };
-  const mergedMetricsSources = {
-    fragmentation: options.metricsSources?.fragmentation ?? telemetry.getFragmentationStats,
-    slowConsumer: options.metricsSources?.slowConsumer ?? telemetry.getSlowConsumerStats,
-    drainPending: options.metricsSources?.drainPending ?? drainController.pendingCount
-  };
-  const requestRemoteAddress = /* @__PURE__ */ new WeakMap();
-  const metricsRemoteAddressResolver = options.metricsRemoteAddress ?? ((request) => requestRemoteAddress.get(request));
-  const app = createWorkspaceRelay({
-    ...options,
-    isDraining: drainController.isDraining,
-    metricsSources: mergedMetricsSources,
-    metricsRemoteAddress: metricsRemoteAddressResolver
-  });
-  function getRegistrationTracker(hostId) {
-    let tracker = hostTunnelRegistrations.get(hostId);
-    if (!tracker) {
-      tracker = { recent: [] };
-      hostTunnelRegistrations.set(hostId, tracker);
-    }
-    return tracker;
-  }
-  function claimTunnelIdentities(ws, workspaceIds) {
-    const hostId = ws.data.hostId;
-    const displaced = /* @__PURE__ */ new Set();
-    for (const workspaceId of workspaceIds) {
-      const previous = hostTunnels.get(tunnelKey(hostId, workspaceId));
-      if (!previous || previous === ws) continue;
-      if (outranks(previous, ws.data.generation)) return workspaceId;
-      displaced.add(previous);
-    }
-    for (const workspaceId of workspaceIds) hostTunnels.set(tunnelKey(hostId, workspaceId), ws);
-    for (const previous of displaced) {
-      if (ownedWorkspaceIds(hostTunnels, previous).length > 0) continue;
-      cleanupHostTunnelSocket({
-        ws: previous,
-        hostTunnels,
-        hostTunnelStateDebounce,
-        options,
-        bunOptions,
-        originAllowed: relayOriginMatcher,
-        disconnectDirectory: false,
-        closeChannels: true
-      });
-      clearHostGenerationWatcher(previous.data);
-      closeWebSocket(previous, 1012, "Host tunnel replaced by a newer connection", 1012);
-    }
-    return void 0;
-  }
-  async function applyRegistrationUpdate(hostSocket, workspaceIds, token) {
-    const hostId = hostSocket.data.hostId;
-    const authorizationRequest = new Request(
-      `http://relay.local/host-tunnels/${encodeURIComponent(hostId)}`,
-      { headers: { authorization: `Bearer ${token}` } }
-    );
-    const authorization = await authorizeHostTunnel(options, bunOptions, authorizationRequest, { hostId, workspaceIds });
-    if (!authorization.authorized) {
-      await refuseHostTunnelSocket(options, hostSocket, {
-        code: "host_tunnel_token_invalid",
-        close: 1008,
-        reason: "Host tunnel registration update denied"
-      });
-      return;
-    }
-    const claims = authorization.claims;
-    if (hostTunnelIncumbentOutranks(hostSocket.data.generation, claims?.generation)) {
-      await refuseHostTunnelSocket(options, hostSocket, {
-        code: "host_generation_superseded",
-        close: 1008,
-        reason: "Host tunnel registration update superseded"
-      });
-      return;
-    }
-    const generation = await checkHostTunnelGeneration(options.resolveHostGeneration, {
-      enrollment_id: claims?.enrollment_id,
-      generation: claims?.generation
-    });
-    if (!generation.ok) {
-      await refuseHostTunnelSocket(options, hostSocket, {
-        code: generation.code,
-        close: generation.retryable ? 1012 : 1008,
-        reason: generation.retryable ? "Host generation check unavailable" : generation.reason
-      });
-      return;
-    }
-    const owned = ownedWorkspaceIds(hostTunnels, hostSocket);
-    if (owned.length === 0 || hostSocket.readyState !== WebSocket.OPEN) return;
-    const released = owned.filter((workspaceId) => !workspaceIds.includes(workspaceId));
-    for (const workspaceId of released) hostTunnels.delete(tunnelKey(hostId, workspaceId));
-    if (released.length) options.directory?.disconnectHost(hostId, released);
-    hostSocket.data.enrollmentId = claims?.enrollment_id;
-    hostSocket.data.generation = claims?.generation;
-    const outranked = claimTunnelIdentities(hostSocket, workspaceIds);
-    if (outranked) {
-      await refuseHostTunnelSocket(options, hostSocket, {
-        code: "host_generation_superseded",
-        close: 1008,
-        reason: "Host tunnel generation was superseded",
-        workspaceId: outranked
-      });
-      return;
-    }
-    hostSocket.data.workspaceIds = workspaceIds;
-    options.directory?.registerHostTunnel({ hostId, workspaceIds });
-    watchHostGeneration(hostSocket, options, bunOptions);
-  }
-  function pruneReconnects(tracker, now) {
-    const cutoff = now - HOST_TUNNEL_REGISTRATION_RECONNECT_WINDOW_MS;
-    while (tracker.recent.length && tracker.recent[0] < cutoff) {
-      tracker.recent.shift();
-    }
-  }
-  return {
-    // A function-valued property rather than a method: `main.ts` hands it
-    // straight to `Bun.serve({ fetch: handler.fetch })`, detached from this
-    // object, and it closes over the adapter's state rather than reading `this`.
-    //
-    // `undefined` is Bun's contract for "this request became a WebSocket":
-    // `server.upgrade()` has already taken ownership of the socket, so there is
-    // no HTTP response left to return.
-    fetch: async (request, server) => {
-      const url = new URL(request.url);
-      const workspaceId = workspaceIdFromPath(url.pathname);
-      const hostId = hostIdFromTunnelPath(url.pathname);
-      try {
-        const ip = server.requestIP(request)?.address;
-        if (ip) requestRemoteAddress.set(request, ip);
-      } catch {
-      }
-      if (url.pathname === "/health") {
-        return Response.json(
-          draining ? { ok: false, service: "workspace-relay", draining: true } : { ok: true, service: "workspace-relay" },
-          { status: draining ? 503 : 200 }
-        );
-      }
-      if (draining && websocketRequest(request) && hostId) {
-        return jsonError(
-          "relay_draining",
-          "Workspace relay is shutting down; new tunnel registrations are not accepted",
-          503
-        );
-      }
-      if (draining && workspaceId) {
-        const headers2 = relayCorsHeaders(request, relayOriginMatcher);
-        const body = JSON.stringify({
-          error: {
-            code: "relay_draining",
-            message: "Workspace relay is shutting down; try another instance"
-          }
-        });
-        headers2.set("content-type", "application/json");
-        return new Response(body, { status: 503, headers: headers2 });
-      }
-      if (websocketRequest(request) && hostId) {
-        const workspaceIds = url.searchParams.getAll("workspaceId");
-        if (!workspaceIds.length || !options.directory) {
-          return new Response("Host tunnel registration is unavailable", { status: 503 });
-        }
-        const authorization = await authorizeHostTunnel(options, bunOptions, request, { hostId, workspaceIds });
-        if (!authorization.authorized) {
-          await denyHostTunnel(options, { code: "host_tunnel_token_invalid", message: "Host tunnel registration denied", status: 403, hostId });
-          return new Response("Host tunnel registration denied", { status: 403 });
-        }
-        const claims = authorization.claims;
-        const generation = await checkHostTunnelGeneration(options.resolveHostGeneration, {
-          enrollment_id: claims?.enrollment_id,
-          generation: claims?.generation
-        });
-        if (!generation.ok) {
-          return denyHostTunnel(options, {
-            code: generation.code,
-            message: generation.reason,
-            status: generation.retryable ? 503 : 403,
-            hostId
-          });
-        }
-        for (const workspaceId2 of workspaceIds) {
-          const incumbent = hostTunnels.get(tunnelKey(hostId, workspaceId2));
-          if (incumbent && outranks(incumbent, claims?.generation)) {
-            return denyHostTunnel(options, {
-              code: "host_generation_superseded",
-              message: "Host tunnel generation was superseded",
-              status: 403,
-              hostId,
-              workspaceId: workspaceId2
-            });
-          }
-        }
-        const tracker = getRegistrationTracker(hostId);
-        const now = Date.now();
-        pruneReconnects(tracker, now);
-        if (tracker.recent.length >= HOST_TUNNEL_REGISTRATION_RECONNECT_CAP) {
-          return denyHostTunnel(options, {
-            code: "too_many_host_tunnel_reconnects",
-            message: "Too many host-tunnel reconnects for this host within the last 60 seconds",
-            status: 429,
-            hostId
-          });
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "host-tunnel",
-            hostId,
-            workspaceIds,
-            ...claims?.enrollment_id ? { enrollmentId: claims.enrollment_id } : {},
-            ...claims?.generation !== void 0 ? { generation: claims.generation } : {},
-            pending: /* @__PURE__ */ new Map(),
-            channels: /* @__PURE__ */ new Map(),
-            missedPongs: 0,
-            messageBuffer: "",
-            generationCheckFailures: 0
-          }
-        })) {
-          tracker.recent.push(now);
-          return void 0;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (!workspaceId) return app.request(request);
-      if (request.method === "OPTIONS") {
-        return new Response(null, {
-          status: 204,
-          headers: relayCorsHeaders(request, relayOriginMatcher)
-        });
-      }
-      if (!websocketRequest(request)) {
-        const trace = createWorkspaceRelayTrace();
-        const response = await trace.span("relay-total", async () => {
-          const relay2 = await authorizeWorkspaceRelayRequest(options, request, workspaceId, trace);
-          if (!relay2.ok) return relay2.response;
-          if (isUserHostedTarget(relay2.request.target)) {
-            const tunnel = hostTunnel(hostTunnels, relay2.request.target.hostId, relay2.request.target.workspaceId);
-            return tunnel ? await trace.span("tunnel-http", async () => await tunnelHttpRequest({
-              ws: tunnel,
-              request,
-              originAllowed: relayOriginMatcher,
-              workspaceId: relay2.request.target.workspaceId,
-              path: `${relay2.request.path}${url.search}`,
-              relayHostToken: relay2.request.relayHostToken,
-              slowConsumerHighWaterMarkBytes: bunOptions.slowConsumerHighWaterMarkBytes ?? SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT,
-              slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-              slowConsumerStats,
-              requestBodyMaxBytes: bunOptions.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT,
-              responseTimeoutMs: bunOptions.tunnelHttpResponseTimeoutMs ?? TUNNEL_HTTP_RESPONSE_TIMEOUT_MS_DEFAULT
-            })) : new Response("User-hosted workspace is offline", { status: 503 });
-          }
-          return await directHttpRequest({
-            request,
-            originAllowed: relayOriginMatcher,
-            targetUrl: workspaceRelayTargetUrl(
-              relay2.request.target,
-              relay2.request.path,
-              url.search
-            ).toString(),
-            relayHostToken: relay2.request.relayHostToken,
-            workspaceId: relay2.request.target.workspaceId,
-            upstreamHeaders: relay2.request.target.upstreamHeaders,
-            timeoutMs: bunOptions.directHttpTimeoutMs ?? DIRECT_HTTP_TIMEOUT_MS_DEFAULT,
-            limiter: directHttpLimiter,
-            trace
-          });
-        });
-        return workspaceRelayTimingResponse(response, trace);
-      }
-      const relay = await authorizeWorkspaceRelayRequest(options, request, workspaceId);
-      if (!relay.ok) return relay.response;
-      const originDenied = requireAllowedOrigin(request, relayOriginMatcher);
-      if (originDenied) return originDenied;
-      if (isUserHostedTarget(relay.request.target)) {
-        const tunnel = hostTunnel(hostTunnels, relay.request.target.hostId, relay.request.target.workspaceId);
-        if (!tunnel) {
-          return new Response("User-hosted workspace is offline", { status: 503 });
-        }
-        if (tunnel.data.channels.size >= TUNNEL_CHANNEL_CAP) {
-          return jsonError(
-            "too_many_channels",
-            "User-hosted tunnel has too many active WebSocket channels",
-            503
-          );
-        }
-        if (server.upgrade(request, {
-          data: {
-            kind: "user-hosted-client",
-            claims: relay.request.claims,
-            hostId: relay.request.target.hostId,
-            workspaceId: relay.request.target.workspaceId,
-            channelId: crypto.randomUUID(),
-            path: `${relay.request.path}${url.search}`,
-            relayHostToken: relay.request.relayHostToken
-          }
-        })) {
-          return void 0;
-        }
-        return new Response("WebSocket upgrade failed", { status: 400 });
-      }
-      if (server.upgrade(request, {
-        data: {
-          kind: "client",
-          claims: relay.request.claims,
-          upstreamUrl: workspaceRelayTargetUrl(
-            relay.request.target,
-            relay.request.path,
-            url.search
-          ).toString().replace(/^http/, "ws"),
-          headers: headersRecord(workspaceRelayForwardHeaders(
-            new Headers(),
-            relay.request.relayHostToken,
-            relay.request.target.workspaceId,
-            // Cloud-vm WS upgrade: cookies pass through.
-            { userHosted: false, upstreamHeaders: relay.request.target.upstreamHeaders }
-          )),
-          queue: [],
-          ...relayWebSocketTraceEnabled(request) ? {
-            trace: {
-              acceptedAt: performance.now(),
-              queuedFrames: 0,
-              maxQueuedDelayMs: 0,
-              emitted: false
-            }
-          } : {}
-        }
-      })) {
-        return void 0;
-      }
-      return new Response("WebSocket upgrade failed", { status: 400 });
-    },
-    websocket: {
-      maxPayloadLength: WS_MAX_PAYLOAD_LENGTH_BYTES,
-      message(ws, message) {
-        if (isHostTunnelSocket(ws)) {
-          const parsed = tunnelMessage(
-            ws,
-            message,
-            fragmentationStats
-          );
-          if (parsed?.type === "ping") {
-            options.directory?.recordPong(ws.data.hostId, ownedWorkspaceIds(hostTunnels, ws));
-            ws.send(JSON.stringify(makeTunnelPong(parsed)));
-          }
-          if (parsed?.type === "pong") {
-            ws.data.missedPongs = 0;
-            options.directory?.recordPong(ws.data.hostId, ownedWorkspaceIds(hostTunnels, ws));
-          }
-          if (parsed?.type === "host.registration.update") {
-            const hostSocket = ws;
-            void applyRegistrationUpdate(hostSocket, [...new Set(parsed.workspace_ids)], parsed.token).catch(() => closeWebSocket(hostSocket, 1008, "Host tunnel registration update denied", 1008));
-            return;
-          }
-          if (parsed?.type === "error") {
-            if (parsed.request_id) {
-              const pending = ws.data.pending.get(parsed.request_id);
-              if (pending) {
-                ws.data.pending.delete(parsed.request_id);
-                failPendingHttpResponse({
-                  entry: pending,
-                  response: jsonError(parsed.code, parsed.message, 502),
-                  error: new Error(parsed.message)
-                });
-              }
-            }
-          }
-          if (parsed?.type === "http.response.start") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              const response = parsed;
-              pending.responseStarted = true;
-              if (isEventStream(response.headers)) clearTimeout(pending.timeout);
-              pending.resolve(new Response(pending.stream, {
-                status: response.status,
-                headers: pending.corsHeaders(headers(response.headers))
-              }));
-            }
-          }
-          if (parsed?.type === "http.response.chunk") {
-            const entry = ws.data.pending.get(parsed.request_id);
-            if (entry) {
-              enqueueChunkWithBackpressure({
-                ws,
-                requestId: parsed.request_id,
-                entry,
-                chunk: decoded(parsed.body_base64),
-                slowConsumerTimeoutMs: bunOptions.slowConsumerTimeoutMs ?? SLOW_CONSUMER_TIMEOUT_MS_DEFAULT,
-                slowConsumerStats
-              });
-            }
-          }
-          if (parsed?.type === "http.response.end") {
-            const pending = ws.data.pending.get(parsed.request_id);
-            if (pending) {
-              clearTimeout(pending.timeout);
-              if (pending.slowConsumerTimeout) {
-                clearTimeout(pending.slowConsumerTimeout);
-                pending.slowConsumerTimeout = void 0;
-              }
-              drainPendingChunks(pending);
-              if (pending.pendingChunks.length > 0) {
-                for (const chunk of pending.pendingChunks) {
-                  try {
-                    pending.controller.enqueue(chunk);
-                  } catch {
-                    break;
-                  }
-                }
-                pending.pendingChunks.length = 0;
-                pending.bytesQueued = 0;
-              }
-              try {
-                pending.controller.close();
-              } catch {
-              }
-              ws.data.pending.delete(parsed.request_id);
-            }
-          }
-          if (parsed?.type === "ws.frame") {
-            const frame = parsed;
-            const channel = ws.data.channels.get(frame.channel_id);
-            if (!channel || channel.readyState !== WebSocket.OPEN) {
-              ws.data.channels.delete(frame.channel_id);
-              return;
-            }
-            if (relayOverBackpressureLimit(channel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-              ws.data.channels.delete(frame.channel_id);
-              closeWebSocket(channel, 1011, "Client WebSocket backpressure limit exceeded");
-              return;
-            }
-            channel.send(decodedFrame(frame));
-          }
-          if (parsed?.type === "ws.close") {
-            const close = parsed;
-            const channel = ws.data.channels.get(close.channel_id);
-            if (channel) {
-              ws.data.channels.delete(close.channel_id);
-              closeWebSocket(channel, close.code, close.reason);
-            }
-          }
-          return;
-        }
-        if (isUserHostedClientSocket(ws)) {
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          if (relayOverBackpressureLimit(tunnel, bunOptions.webSocketBufferedAmountMaxBytes ?? WS_BUFFERED_AMOUNT_MAX_BYTES_DEFAULT)) {
-            closeWebSocket(ws, 1011, "Host tunnel backpressure limit exceeded");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.frame",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            ...encodedFrame(message)
-          }));
-          return;
-        }
-        if (!isRelayClientSocket(ws)) return;
-        if (ws.data.upstream?.readyState === WebSocket.OPEN) {
-          ws.data.upstream.send(message);
-          return;
-        }
-        const queuedBytes = ws.data.queuedBytes ?? 0;
-        const frameBytes = preOpenFrameBytes(message);
-        if (ws.data.queue.length >= (bunOptions.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) && queuedBytes + frameBytes > (bunOptions.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
-          closeWebSocket(ws, 1011, "Upstream WebSocket queue limit exceeded");
-          return;
-        }
-        ws.data.queuedBytes = queuedBytes + frameBytes;
-        ws.data.queue.push({ payload: message, queuedAt: performance.now() });
-      },
-      open(ws) {
-        if (isHostTunnelSocket(ws)) {
-          const outranked = claimTunnelIdentities(ws, ws.data.workspaceIds);
-          if (outranked) {
-            void refuseHostTunnelSocket(options, ws, {
-              code: "host_generation_superseded",
-              close: 1008,
-              reason: "Host tunnel generation was superseded",
-              workspaceId: outranked
-            });
-            return;
-          }
-          options.directory?.registerHostTunnel({
-            hostId: ws.data.hostId,
-            workspaceIds: ws.data.workspaceIds
-          });
-          ws.data.heartbeat = setInterval(() => {
-            const hostWs = ws;
-            if (hostWs.data.missedPongs > (bunOptions.hostTunnelMaxMissedPongs ?? HOST_TUNNEL_MAX_MISSED_PONGS_DEFAULT)) {
-              closeWebSocket(ws, 1001, "Host tunnel heartbeat timed out", 1001);
-              return;
-            }
-            sendTunnelPing(hostWs);
-          }, bunOptions.hostTunnelPingIntervalMs ?? 15e3);
-          watchHostGeneration(ws, options, bunOptions);
-          scheduleHostTunnelStateChange(hostTunnelStateDebounce, options, {
-            hostId: ws.data.hostId,
-            workspaceIds: ws.data.workspaceIds,
-            path: `/host-tunnels/${ws.data.hostId}`,
-            state: "connected",
-            debounceMs: bunOptions.hostTunnelStateDebounceMs ?? HOST_TUNNEL_STATE_DEBOUNCE_MS_DEFAULT
-          });
-          return;
-        }
-        if (isUserHostedClientSocket(ws)) {
-          watchClientAccess(ws, options, bunOptions);
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
-          if (!tunnel) {
-            ws.close(1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.data.channels.set(ws.data.channelId, ws);
-          if (tunnel.readyState !== WebSocket.OPEN) {
-            closeWebSocket(ws, 1011, "User-hosted tunnel disconnected");
-            return;
-          }
-          tunnel.send(JSON.stringify({
-            type: "ws.open",
-            protocol: TUNNEL_PROTOCOL_VERSION,
-            channel_id: ws.data.channelId,
-            workspace_id: ws.data.workspaceId,
-            path: ws.data.path,
-            headers: headersRecord(workspaceRelayForwardHeaders(
-              new Headers(),
-              ws.data.relayHostToken,
-              ws.data.workspaceId,
-              // User-hosted tunnel WS upgrade: strip Cookie. Headers are empty
-              // here today; the flag keeps the rule uniform.
-              { userHosted: true }
-            ))
-          }));
-          return;
-        }
-        if (!isRelayClientSocket(ws)) return;
-        relayClients.add(ws);
-        watchClientAccess(ws, options, bunOptions);
-        const data = ws.data;
-        const UpstreamWebSocket = resolveUpstreamWebSocket(bunOptions.upstreamWebSocket);
-        if (data.trace) data.trace.upstreamStartedAt = performance.now();
-        const upstream = new UpstreamWebSocket(data.upstreamUrl, {
-          headers: data.headers
-        });
-        upstream.binaryType = "arraybuffer";
-        data.upstream = upstream;
-        data.upstreamOpenTimer = setTimeout(() => {
-          if (upstream.readyState === WebSocket.OPEN) return;
-          closeWebSocket(upstream, 1001, "Upstream WebSocket open timed out", 1001);
-          closeWebSocket(ws, 1011, "Upstream WebSocket open timed out");
-        }, bunOptions.upstreamWebSocketOpenTimeoutMs ?? UPSTREAM_WS_OPEN_TIMEOUT_MS_DEFAULT);
-        upstream.onopen = () => {
-          const openedAt = performance.now();
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          if (data.trace) {
-            data.trace.upstreamOpenMs = openedAt - (data.trace.upstreamStartedAt ?? data.trace.acceptedAt);
-            data.trace.queuedFrames = data.queue.length;
-            data.trace.maxQueuedDelayMs = data.queue.reduce(
-              (max, item) => Math.max(max, openedAt - item.queuedAt),
-              0
-            );
-            sendRelayWebSocketTrace(ws);
-          }
-          for (const item of data.queue.splice(0)) upstream.send(item.payload);
-          data.queuedBytes = 0;
-        };
-        upstream.onmessage = (event) => {
-          const payload = relayWebSocketPayload(event.data);
-          if (payload !== void 0) ws.send(payload);
-        };
-        upstream.onclose = (event) => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          closeWebSocket(ws, event.code, upstreamCloseReason(event));
-        };
-        upstream.onerror = () => {
-          if (data.upstreamOpenTimer) {
-            clearTimeout(data.upstreamOpenTimer);
-            data.upstreamOpenTimer = void 0;
-          }
-          closeWebSocket(ws, 1011, "Upstream WebSocket connection failed");
-        };
-      },
-      close(ws, code, reason) {
-        if (isHostTunnelSocket(ws)) {
-          clearHostGenerationWatcher(ws.data);
-          cleanupHostTunnelSocket({
-            ws,
-            hostTunnels,
-            hostTunnelStateDebounce,
-            options,
-            bunOptions,
-            originAllowed: relayOriginMatcher,
-            disconnectDirectory: true,
-            closeChannels: true
-          });
-          const tracker = hostTunnelRegistrations.get(ws.data.hostId);
-          if (tracker) {
-            pruneReconnects(tracker, Date.now());
-            if (tracker.recent.length === 0) hostTunnelRegistrations.delete(ws.data.hostId);
-          }
-          return;
-        }
-        if (isUserHostedClientSocket(ws)) {
-          clearClientAccessWatchers(ws.data);
-          const tunnel = hostTunnel(hostTunnels, ws.data.hostId, ws.data.workspaceId);
-          tunnel?.data.channels.delete(ws.data.channelId);
-          if (tunnel?.readyState === WebSocket.OPEN) {
-            tunnel.send(JSON.stringify({
-              type: "ws.close",
-              protocol: TUNNEL_PROTOCOL_VERSION,
-              channel_id: ws.data.channelId,
-              code: safeCloseCode(code, 1e3),
-              reason
-            }));
-          }
-          return;
-        }
-        if (!isRelayClientSocket(ws)) return;
-        relayClients.delete(ws);
-        clearClientAccessWatchers(ws.data);
-        if (ws.data.upstreamOpenTimer) clearTimeout(ws.data.upstreamOpenTimer);
-        if (ws.data.upstream) closeWebSocket(ws.data.upstream, code, reason, 1e3);
-      }
-    },
-    drain: drainController,
-    telemetry
-  };
-}
-export {
-  WORKSPACE_RELAY_IDLE_TIMEOUT_SECONDS,
-  __slowConsumerInternalsForTest,
-  createWorkspaceRelayBun,
-  relayBufferedBytes,
-  relayOverBackpressureLimit
-};