@claxedo/workspace-relay 0.8.0 → 0.10.1

package/dist/index.mjs

@@ -5,6 +5,9 @@ import { SignJWT, errors, exportJWK, importJWK, jwtVerify } from "jose";
 function isRecord(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function asRecord(value) {
+  return isRecord(value) ? value : void 0;
+}
 function isFiniteNumber(value) {
   return typeof value === "number" && Number.isFinite(value);
 }
@@ -16,12 +19,21 @@ function numberClaim(payload, key) {
 }
 
 // src/auth.ts
+import { CURRENT_CHANNEL_IDENTITY_VERSION } from "@claxedo/workspace-relay-protocol";
 var algorithms = ["EdDSA", "ES256", "RS256"];
 var runtimeAccessTokenIssuer = "claxedo-control-plane";
 var runtimeAccessTokenAudience = "workspace-relay";
 var hostTunnelTokenAudience = "workspace-relay-host-tunnel";
 var relayHostTokenIssuer = "workspace-relay";
 var relayHostTokenAudience = "workspace-host-service";
+var RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS = 1789948800;
+function toChannelIdentityClaim(input) {
+  return {
+    channel: input.channel,
+    external_user_id: input.externalUserId,
+    identity_version: input.identityVersion
+  };
+}
 var WorkspaceRelayAuthError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -53,7 +65,6 @@ function isHostGeneration(value) {
 function hostGenerationClaims(payload) {
   const enrollment_id = stringClaim(payload, "enrollment_id");
   const generation = payload.generation;
-  if (generation === void 0) return enrollment_id ? { enrollment_id } : {};
   if (!isHostGeneration(generation) || !enrollment_id) return null;
   return { enrollment_id, generation };
 }
@@ -80,8 +91,40 @@ function actorProfilePayload(input) {
     ...input.actorAvatarUrl ? { actor_avatar_url: input.actorAvatarUrl } : {}
   };
 }
-function isRelayClaimPair(input) {
-  return input.access === "cloud" && input.backing === "cloud-vm" || input.access === "user-hosted" && input.backing === "local-worktree";
+function channelIdentityPayload(input) {
+  return input.channelIdentity ? { channel_identity: toChannelIdentityClaim(input.channelIdentity) } : {};
+}
+function channelIdentityClaims(payload) {
+  const value = payload.channel_identity;
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Channel provenance claim is not a claims object");
+  }
+  const claim = value;
+  const channel = stringClaim(claim, "channel");
+  const external_user_id = stringClaim(claim, "external_user_id");
+  const identity_version = numberClaim(claim, "identity_version");
+  if (!channel || !external_user_id || identity_version === void 0 || !Number.isInteger(identity_version)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Channel provenance claim is incomplete");
+  }
+  if (identity_version < CURRENT_CHANNEL_IDENTITY_VERSION) {
+    throw new WorkspaceRelayAuthError(
+      "relay_token_claims_invalid",
+      "Channel provenance claim predates the current channel identity version"
+    );
+  }
+  return { channel, external_user_id, identity_version };
+}
+function checkIssuedAtFloor(iat) {
+  if (iat < RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS) {
+    throw new WorkspaceRelayAuthError(
+      "relay_token_claims_invalid",
+      "Runtime Access Token was issued before the channel provenance floor"
+    );
+  }
+}
+function isRelayBacking(input) {
+  return input === "cloud-vm" || input === "local-worktree" || input === "durable-object";
 }
 function checkHostTunnelTarget(payload, expected) {
   if (stringClaim(payload, "host_id") !== expected.hostId) {
@@ -142,12 +185,17 @@ async function mintRuntimeAccessToken(input, key, alg) {
   return await new SignJWT({
     principal_kind: input.principalKind,
     actor_id: input.actorId,
+    ...input.userId ? { user_id: input.userId } : {},
     actor_kind: input.actorKind,
     ...actorProfilePayload(input),
+    ...channelIdentityPayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
-    role: input.role
+    role: input.role,
+    ...tokenScopePayload(input.sessionId),
+    ...input.purpose ? { purpose: input.purpose } : {},
+    ...input.routingId !== void 0 ? { routing_id: input.routingId } : {}
   }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(runtimeAccessTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 30 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyRuntimeAccessToken(token, key, expected) {
@@ -160,8 +208,27 @@ async function verifyRuntimeAccessToken(token, key, expected) {
   if (!claims) {
     throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
   }
+  checkIssuedAtFloor(claims.iat);
   return claims;
 }
+var TOKEN_CLAIMS_CLOCK_SKEW_SECONDS = 60;
+var TOKEN_CLAIMS_MAX_LIFETIME_SECONDS = 24 * 60 * 60;
+function checkTokenTimeClaims(payload, exp, tokenName) {
+  const now = seconds();
+  if (exp <= now - TOKEN_CLAIMS_CLOCK_SKEW_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} is expired`);
+  }
+  const nbf = numberClaim(payload, "nbf");
+  if (payload.nbf !== void 0 && nbf === void 0) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} nbf claim is not a finite number`);
+  }
+  if (nbf !== void 0 && nbf > now + TOKEN_CLAIMS_CLOCK_SKEW_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} is not yet valid`);
+  }
+  if (exp > now + TOKEN_CLAIMS_MAX_LIFETIME_SECONDS) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", `${tokenName} lifetime exceeds the relay maximum`);
+  }
+}
 function validateRuntimeAccessTokenClaims(input, expected) {
   const payload = input;
   if (stringClaim(payload, "iss") !== runtimeAccessTokenIssuer || stringClaim(payload, "aud") !== runtimeAccessTokenAudience) {
@@ -172,18 +239,20 @@ function validateRuntimeAccessTokenClaims(input, expected) {
   if (!claims) {
     throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Runtime Access Token claims are incomplete");
   }
+  checkIssuedAtFloor(claims.iat);
+  checkTokenTimeClaims(payload, claims.exp, "Runtime Access Token");
   return claims;
 }
 async function mintHostTunnelToken(input, key, alg) {
   const now = seconds(input.now);
-  if (input.generation !== void 0 && (!isHostGeneration(input.generation) || !input.enrollmentId)) {
+  if (!isHostGeneration(input.generation) || !input.enrollmentId?.trim()) {
     throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Host Tunnel Token generation requires a non-negative integer and an enrollment id");
   }
   return await new SignJWT({
     host_id: input.hostId,
     workspace_ids: input.workspaceIds,
-    ...input.enrollmentId ? { enrollment_id: input.enrollmentId } : {},
-    ...input.generation !== void 0 ? { generation: input.generation } : {}
+    enrollment_id: input.enrollmentId,
+    generation: input.generation
   }).setProtectedHeader({ alg: requireAlgorithm(alg) }).setIssuer(runtimeAccessTokenIssuer).setAudience(hostTunnelTokenAudience).setSubject(input.subject).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 5 * 60)).setJti(input.jti ?? jti()).sign(key);
 }
 async function verifyHostTunnelToken(token, key, expected) {
@@ -198,9 +267,34 @@ async function verifyHostTunnelToken(token, key, expected) {
   }
   return claims;
 }
+function relayHostInputFromRuntimeClaims(claims) {
+  return {
+    principalKind: claims.principal_kind,
+    actorId: claims.actor_id,
+    ...claims.user_id ? { userId: claims.user_id } : {},
+    actorKind: claims.actor_kind,
+    parentJti: claims.jti,
+    ...claims.actor_public_id && claims.actor_name ? {
+      actorPublicId: claims.actor_public_id,
+      actorName: claims.actor_name,
+      ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
+    } : {},
+    ...claims.channel_identity ? {
+      channelIdentity: {
+        channel: claims.channel_identity.channel,
+        externalUserId: claims.channel_identity.external_user_id,
+        identityVersion: claims.channel_identity.identity_version
+      }
+    } : {},
+    orgId: claims.org_id,
+    role: claims.role,
+    ...claims.session_id ? { sessionId: claims.session_id } : {},
+    ...claims.purpose ? { purpose: claims.purpose } : {}
+  };
+}
 async function mintRelayHostToken(input, key, alg) {
-  if (!isRelayClaimPair(input)) {
-    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token access/backing claims are inconsistent");
+  if (!isRelayBacking(input.backing)) {
+    throw new WorkspaceRelayAuthError("relay_token_claims_invalid", "Relay Host Token backing claim is not a placement");
   }
   const now = seconds(input.now);
   const protectedHeader = { alg: requireAlgorithm(alg) };
@@ -208,13 +302,16 @@ async function mintRelayHostToken(input, key, alg) {
   return await new SignJWT({
     principal_kind: input.principalKind,
     actor_id: input.actorId,
+    ...input.userId ? { user_id: input.userId } : {},
     actor_kind: input.actorKind,
     ...actorProfilePayload(input),
+    ...channelIdentityPayload(input),
     org_id: input.orgId,
     workspace_id: input.workspaceId,
     host_id: input.hostId,
     role: input.role,
-    access: input.access,
+    ...tokenScopePayload(input.sessionId),
+    ...input.purpose ? { purpose: input.purpose } : {},
     backing: input.backing,
     parent_jti: input.parentJti
   }).setProtectedHeader(protectedHeader).setIssuer(relayHostTokenIssuer).setAudience(relayHostTokenAudience).setIssuedAt(now).setExpirationTime(now + (input.ttlSeconds ?? 60)).setJti(input.jti ?? jti()).sign(key);
@@ -236,48 +333,70 @@ function runtimeClaims(payload) {
   const iat = numberClaim(payload, "iat");
   const principal_kind = stringClaim(payload, "principal_kind");
   const actor_id = stringClaim(payload, "actor_id");
+  const user_id = stringClaim(payload, "user_id");
   const actor_kind = stringClaim(payload, "actor_kind");
   const jti2 = stringClaim(payload, "jti");
   const org_id = stringClaim(payload, "org_id");
   const workspace_id = stringClaim(payload, "workspace_id");
   const host_id = stringClaim(payload, "host_id");
   const role = roleClaim(payload);
-  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
+  const reach = tokenScopeClaims(payload);
+  const purpose = tokenPurposeClaims(payload);
+  if (!exp || !iat || !jti2 || !org_id || !workspace_id || !host_id || !role || !actor_id || !reach || !purpose || payload.user_id !== void 0 && !user_id || principal_kind !== "user" && principal_kind !== "service" || actor_kind !== "human" && actor_kind !== "agent" || principal_kind === "user" && actor_kind !== "human" || principal_kind === "service" && actor_kind !== "agent") return void 0;
   const actorProfile = actorProfileClaims(payload);
   if (!actorProfile) return void 0;
+  const channel_identity = channelIdentityClaims(payload);
+  const routing_id = stringClaim(payload, "routing_id");
   return {
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience,
     principal_kind,
     actor_id,
+    ...user_id ? { user_id } : {},
     actor_kind,
     ...actorProfile,
+    ...channel_identity ? { channel_identity } : {},
+    ...routing_id !== void 0 ? { routing_id } : {},
     org_id,
     workspace_id,
     host_id,
     role,
+    ...reach,
+    ...purpose,
     exp,
     iat,
     jti: jti2
   };
 }
+function tokenScopePayload(sessionId) {
+  return sessionId === void 0 ? { scope: "workspace" } : { scope: "session", session_id: sessionId };
+}
+function tokenPurposeClaims(payload) {
+  if (payload.purpose === void 0) return {};
+  return payload.purpose === "turn-execution" ? { purpose: payload.purpose } : void 0;
+}
+function tokenScopeClaims(payload) {
+  const sessionId = stringClaim(payload, "session_id");
+  if (payload.scope === "workspace" && payload.session_id === void 0) return { scope: "workspace" };
+  if (payload.scope === "session" && sessionId) return { scope: "session", session_id: sessionId };
+  return void 0;
+}
 function relayHostClaims(payload) {
   const base = runtimeClaims({
     ...payload,
     iss: runtimeAccessTokenIssuer,
     aud: runtimeAccessTokenAudience
   });
-  const access = stringClaim(payload, "access");
+  if (payload.access !== void 0) return void 0;
   const backing = stringClaim(payload, "backing");
   const parent_jti = stringClaim(payload, "parent_jti");
-  const pair = { access, backing };
-  if (!base || !parent_jti || !isRelayClaimPair(pair)) return void 0;
+  if (!base || !parent_jti || !isRelayBacking(backing)) return void 0;
   return {
     ...base,
     iss: relayHostTokenIssuer,
     aud: relayHostTokenAudience,
     parent_jti,
-    ...pair
+    backing
   };
 }
 function hostTunnelClaims(payload) {
@@ -302,11 +421,114 @@ function hostTunnelClaims(payload) {
   };
 }
 
+// ../claxedo-helpers/dist/api-error.mjs
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRecord2(value) {
+  return isRecord2(value) ? value : void 0;
+}
+var PUBLIC_API_ERRORS = {
+  repository_provider_unauthorized: { status: 502, message: "Repository provider refused authorization" },
+  repository_provider_unavailable: { status: 502, message: "Repository provider is unavailable" },
+  host_tunnel_timeout: { status: 503, retryable: true, message: "Host tunnel timed out" },
+  host_tunnel_response_body_too_large: { status: 413, message: "Host tunnel response body exceeds the relay limit" },
+  host_tunnel_unavailable: { status: 503, retryable: true, message: "Host tunnel is unavailable" },
+  workspace_checkpoint_unavailable: { status: 503, retryable: true, message: "Workspace checkpoint is unavailable" },
+  workspace_checkpoint_conflict: { status: 409, message: "Workspace checkpoint conflicted" },
+  invalid_input: { family: "access", status: 400, message: "The request names an invalid value" },
+  organization_policy_denied: { family: "access", status: 403, message: "Organization creation is disabled for this deployment" },
+  org_admin_required: { family: "access", status: 403, message: "Organization administrator authority is required" },
+  org_owner_required: { family: "access", status: 403, message: "Only an organization owner may grant, change or remove the owner role" },
+  org_owner_protected: { family: "access", status: 409, message: "The organization's founding owner cannot be removed or demoted" },
+  team_member_org_membership_required: { family: "access", status: 403, message: "The team member must belong to the team organization" },
+  project_member_org_membership_required: { family: "access", status: 403, message: "The project member must belong to the project organization" },
+  org_membership_required: { family: "access", status: 403, message: "Organization membership is required" },
+  project_admin_required: { family: "access", status: 403, message: "Project administrator authority is required" },
+  team_not_allowed_on_personal_org: { family: "access", status: 400, message: "Personal organizations cannot contain teams" },
+  team_member_target_required: { family: "access", status: 400, message: "Exactly one team member target is required" },
+  org_invitation_invalid: { family: "access", status: 409, message: "Invitation is invalid or unavailable" },
+  org_invitation_pending: { family: "access", status: 409, message: "An invitation to this address is already pending" },
+  org_invitation_rate_limited: { family: "access", status: 429, message: "Organization invitation limit exceeded" },
+  org_invitation_email_mismatch: { family: "access", status: 403, message: "Sign in with the invited verified email address" },
+  org_invitation_delivery_unavailable: { family: "access", status: 503, message: "Invitation delivery is unavailable" },
+  team_not_found: { family: "access", status: 404, message: "Team not found" },
+  team_member_not_found: { family: "access", status: 404, message: "Team member not found" },
+  org_member_not_found: { family: "access", status: 404, message: "Organization member not found" },
+  project_not_found: { family: "access", status: 404, message: "Project not found" },
+  project_member_not_found: { family: "access", status: 404, message: "Project member not found" },
+  project_member_owner_immutable: { family: "access", status: 409, message: "The project owner's access cannot be changed" },
+  resource_conflict: { family: "access", status: 409, message: "Organization or team authority changed concurrently" },
+  session_not_found: { family: "session_share", status: 404, message: "This session is not on the control plane, so it cannot be shared from People yet." },
+  session_share_admin_required: { family: "session_share", status: 403, message: "Only the person who started this session can manage its People." },
+  session_share_target_required: { family: "session_share", status: 400, message: "A session is shared with exactly one person" },
+  session_share_target_not_found: { family: "session_share", status: 404, message: "That person was not found in this organization." },
+  session_share_level_invalid: { family: "session_share", status: 400, message: "A share level is either follow or send." },
+  workspace_backing_conflict: { status: 409, message: "Workspace is provisioned in the cloud and cannot be placed on a machine" },
+  invalid_session_list_cursor: { status: 400, message: "Session list cursor does not match this query" },
+  BAD_REQUEST: { status: 400, message: "Invalid request" },
+  INTERNAL_SERVER_ERROR: { status: 500, message: "Internal error" },
+  CONTROL_PLANE_UNAVAILABLE: { status: 503, message: "Control Plane services are not configured" },
+  credential_verification_unsupported: { status: 400, message: "Credential provider does not support verification" },
+  credential_shape_invalid: { status: 400, message: "Credential secret has an unsupported shape" },
+  credential_provider_unavailable: { status: 502, retryable: true, message: "Credential provider request failed" },
+  credential_verification_failed: { status: 502, message: "Credential provider verification failed" },
+  credential_redirect_denied: { status: 502, message: "Sandbox provider redirects are not allowed" },
+  credential_endpoint_invalid: { status: 400, message: "Invalid credential provider endpoint" },
+  host_attestation_denied: { status: 403, message: "host_attestation_denied" },
+  signature_replayed: { status: 409, message: "signature_replayed" },
+  host_enrollment_not_found: { status: 404, message: "host_enrollment_not_found" },
+  enrollment_revoked: { status: 403, message: "enrollment_revoked" },
+  enrollment_paused: { status: 403, message: "enrollment_paused" },
+  enrollment_owner_ineligible: { status: 403, message: "enrollment_owner_ineligible" },
+  enrollment_key_version_mismatch: { status: 403, message: "enrollment_key_version_mismatch" },
+  invitation_invalid: { status: 403, message: "invitation_invalid" },
+  invitation_expired: { status: 410, message: "invitation_expired" },
+  invitation_revoked: { status: 410, message: "invitation_revoked" },
+  invitation_redeemed: { status: 409, message: "invitation_redeemed" },
+  invitation_host_conflict: { status: 409, message: "invitation_host_conflict" },
+  enrollment_generation_superseded: { status: 409, message: "enrollment_generation_superseded" },
+  host_assignment_outside_scope: { status: 400, message: "host_assignment_outside_scope" },
+  host_sealing_key_undeclared: { status: 409, message: "host_sealing_key_undeclared" },
+  host_provider_config_revision_stale: { status: 409, message: "host_provider_config_revision_stale" },
+  identity_conflict: { status: 409, message: "identity_conflict" },
+  registration_transition_denied: { status: 403, message: "registration_transition_denied" },
+  session_reservation_spent: { status: 409, message: "This session's create was undone; reserve it again to retry" },
+  actor_authorization_denied: { status: 403, message: "actor_authorization_denied" }
+};
+function encodeApiError(error, defaults = {}) {
+  const row = asRecord2(error);
+  return {
+    error: {
+      code: typeof row?.code === "string" && row.code ? row.code : defaults.code ?? "internal_error",
+      message: typeof row?.message === "string" && row.message ? row.message : defaults.message ?? "Internal error",
+      retryable: row?.retryable === true
+    }
+  };
+}
+function publicApiErrorShape(code) {
+  const entry = PUBLIC_API_ERRORS[code];
+  return { status: entry.status, retryable: entry.retryable === true };
+}
+function publicApiFailure(code, message = PUBLIC_API_ERRORS[code].message) {
+  return Object.assign(new Error(message), { code, ...publicApiErrorShape(code) });
+}
+
+// src/host-tunnel-failure.ts
+function hostTunnelFailure(code) {
+  return publicApiFailure(code);
+}
+function hostTunnelFailureResponse(error) {
+  const code = asRecord(error)?.code;
+  const failure = hostTunnelFailure(code === "host_tunnel_timeout" || code === "host_tunnel_response_body_too_large" ? code : "host_tunnel_unavailable");
+  return Response.json(encodeApiError(failure), { status: failure.status });
+}
+
 // src/cloudflare.ts
-import { trimToUndefined } from "@claxedo/helpers/string";
+import { trimToUndefined as trimToUndefined5 } from "@claxedo/helpers/string";
 
 // src/http.ts
-import { bearerToken } from "@claxedo/helpers/string";
+import { bearerToken, trimToUndefined } from "@claxedo/helpers/string";
 function errorBody(code, message) {
   return {
     error: {
@@ -315,200 +537,148 @@ function errorBody(code, message) {
     }
   };
 }
+function hostIdFromTunnelPath(pathname) {
+  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
+}
+function workspaceIdsFromSearch(url) {
+  return [...new Set([
+    ...url.searchParams.getAll("workspaceId"),
+    ...url.searchParams.getAll("workspace_id")
+  ].map(trimToUndefined).filter((item) => !!item))];
+}
 
 // src/cloudflare.ts
 import {
+  closeCode,
+  closeReason,
   makeTunnelPong,
   TUNNEL_PROTOCOL_VERSION,
   validateTunnelMessage
 } from "@claxedo/workspace-relay-protocol";
 
 // src/server.ts
-import { Hono } from "hono";
-import { cors } from "hono/cors";
-import { exportJWK as exportJWK2 } from "jose";
-
-// src/cors-origins.ts
-var DEFAULT_RELAY_APP_ORIGINS = [
-  "http://localhost:*",
-  "http://127.0.0.1:*",
-  "https://claxedo.com",
-  "https://*.claxedo.com"
-];
-function parseAllowedOrigins(raw) {
-  const entries = (raw ?? "").split(",").map((item) => item.trim()).filter(Boolean);
-  return entries.length ? entries : void 0;
-}
-function createOriginMatcher(patterns) {
-  const exact = /* @__PURE__ */ new Set();
-  const httpsSuffixes = [];
-  const httpPortPrefixes = [];
-  for (const pattern of patterns) {
-    if (pattern.startsWith("https://*.")) {
-      httpsSuffixes.push(pattern.slice("https://*".length));
-    } else if (pattern.startsWith("http://") && pattern.endsWith(":*")) {
-      httpPortPrefixes.push(pattern.slice(0, -1));
-    } else {
-      exact.add(pattern);
-    }
-  }
-  return (origin) => {
-    if (exact.has(origin)) return true;
-    if (origin.startsWith("https://")) {
-      return httpsSuffixes.some(
-        (suffix) => origin.endsWith(suffix) && origin.length > "https://".length + suffix.length
-      );
-    }
-    if (origin.startsWith("http://")) {
-      return httpPortPrefixes.some(
-        (prefix) => origin.startsWith(prefix) && /^\d+$/.test(origin.slice(prefix.length))
-      );
-    }
-    return false;
-  };
-}
+import { sessionScopeReaches } from "@claxedo/workspace-relay-protocol";
 
-// src/user-hosted-forwarding.ts
-function isUserHostedTarget(target) {
-  return target.access === "user-hosted";
+// src/host-tunnel-forwarding.ts
+function isHostTunnelTarget(target) {
+  return target.backing === "local-worktree";
 }
 
-// src/server.ts
+// src/relay-target.ts
 function parseWorkspaceRelayTarget(input) {
   if (!isRecord(input)) return void 0;
   const row = input;
-  const { workspaceId, hostId, baseUrl, upstreamHeaders } = row;
+  const { workspaceId, hostId, baseUrl } = row;
   if (typeof workspaceId !== "string" || typeof hostId !== "string" || typeof baseUrl !== "string") return void 0;
-  if (upstreamHeaders !== void 0 && !isStringRecord(upstreamHeaders)) return void 0;
-  const pair = relayClaimPair(row.access, row.backing);
-  if (!pair) return void 0;
+  if (row.access !== void 0) return void 0;
+  if (!isRelayBacking(row.backing)) return void 0;
+  if (!isAllowedRelayTargetBaseUrl({ baseUrl, backing: row.backing })) return void 0;
   return {
     workspaceId,
     hostId,
     baseUrl,
-    ...upstreamHeaders ? { upstreamHeaders } : {},
-    ...pair
+    backing: row.backing
   };
 }
-function parseRuntimeAccessTokenActiveResult(input) {
-  if (!isRecord(input)) return void 0;
-  const row = input;
-  if (row.active === true) return { active: true };
-  if (row.active !== false) return void 0;
-  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
-  return { active: false, code: row.code, reason: row.reason };
-}
-function parseHostGenerationResult(input) {
-  if (!isRecord(input)) return void 0;
-  const row = input;
-  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
-  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
-  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+function parseAbsoluteHttpUrl(baseUrl) {
+  let url;
+  try {
+    url = new URL(baseUrl);
+  } catch {
+    return void 0;
+  }
+  return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
 }
-var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
-var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
-function createHostGenerationResolverLookup(url, options) {
-  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
-  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
-  return async ({ enrollmentId }) => {
-    const target = new URL(url);
-    target.searchParams.set("enrollmentId", enrollmentId);
-    const res = await fetcher(target, { headers: options.headers, signal: AbortSignal.timeout(timeoutMs) });
-    if (res.status === 404) {
-      const body = await res.json().catch(() => void 0);
-      const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-      if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
-      throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
-    }
-    if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
-    const result = parseHostGenerationResult(await res.json());
-    if (!result) throw new Error("relay host-generation resolver returned a malformed result");
-    return result;
-  };
+function isLoopbackTargetHostname(hostname) {
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host === "[::1]" || host.endsWith(".localhost")) return true;
+  const ipv4 = /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  return !!ipv4 && ipv4.slice(1).every((octet) => Number(octet) <= 255);
 }
-function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
-  if (incumbentGeneration === void 0) return false;
-  return candidateGeneration === void 0 || incumbentGeneration > candidateGeneration;
+function isAllowedRelayTargetBaseUrl(target) {
+  if (target.backing === "durable-object") return target.baseUrl === "";
+  if (isHostTunnelTarget(target)) {
+    if (target.baseUrl === "") return true;
+    return parseAbsoluteHttpUrl(target.baseUrl) !== void 0;
+  }
+  const url = parseAbsoluteHttpUrl(target.baseUrl);
+  if (!url) return false;
+  return url.protocol === "https:" || isLoopbackTargetHostname(url.hostname);
 }
-function relayClaimPair(access, backing) {
-  if (access === "cloud" && backing === "cloud-vm") return { access, backing };
-  if (access === "user-hosted" && backing === "local-worktree") return { access, backing };
-  return void 0;
+
+// src/relay-audit.ts
+var auditSamplers = /* @__PURE__ */ new WeakMap();
+function getOrCreateAuditSampler(options) {
+  let state = auditSamplers.get(options);
+  if (!state) {
+    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
+    state = {
+      suppressedCount: 0,
+      timer: void 0,
+      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
+      random: options.random ?? Math.random,
+      sampleRate
+    };
+    auditSamplers.set(options, state);
+  }
+  return state;
 }
-function isStringRecord(input) {
-  return isRecord(input) && Object.values(input).every((value) => typeof value === "string");
+function clampSampleRate(rate) {
+  if (rate === void 0) return 1;
+  if (!Number.isFinite(rate)) return 1;
+  if (rate < 0) return 0;
+  if (rate > 1) return 1;
+  return rate;
 }
-var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
-var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
-var RESOLVER_CACHE_MAX_ENTRIES = 8192;
-var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
-var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
-var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
-function pruneExpiringCache(cache, now, maxEntries) {
-  for (const [key, entry] of cache) {
-    if (entry.expiresAt <= now) cache.delete(key);
-  }
-  while (cache.size >= maxEntries) {
-    const key = cache.keys().next().value;
-    if (!key) return;
-    cache.delete(key);
+function ensureFlushTimer(options, state) {
+  if (state.timer) return;
+  if (state.sampleRate >= 1) return;
+  if (state.flushIntervalMs <= 0) return;
+  const timer = setInterval(() => {
+    flushSuppressedSummary(options, state);
+  }, state.flushIntervalMs);
+  if (typeof timer.unref === "function") {
+    timer.unref();
   }
+  state.timer = timer;
 }
-function createCachedRevocationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 1e4;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const at = now();
-    const entry = cache.get(args.jti);
-    if (entry && entry.expiresAt > at) {
-      if (entry.result) return entry.result;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((result) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
-      return result;
-    }).catch((err) => {
-      cache.delete(args.jti);
-      throw err;
-    });
-    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
+function flushSuppressedSummary(options, state) {
+  const count = state.suppressedCount;
+  if (count <= 0) return;
+  state.suppressedCount = 0;
+  void options.audit?.({
+    action: "relay.request.suppressed_summary",
+    result: "allow",
+    method: "INTERNAL",
+    path: "/",
+    suppressedCount: count
+  });
 }
-function createCachedHostGenerationClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 1e4;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    for (; ; ) {
-      const at = now();
-      const entry = cache.get(args.enrollmentId);
-      if (entry && entry.expiresAt > at) {
-        if (entry.result && entry.result.generation >= args.generation) return entry.result;
-        if (!entry.result && entry.promise) {
-          const shared = await entry.promise;
-          if (!shared || shared.generation >= args.generation) return shared;
-          continue;
-        }
+async function audit(options, event) {
+  if (event.action === "relay.request.accepted") {
+    const state = getOrCreateAuditSampler(options);
+    if (state.sampleRate < 1) {
+      ensureFlushTimer(options, state);
+      if (state.random() >= state.sampleRate) {
+        state.suppressedCount += 1;
+        return;
       }
-      const promise = inner(args).then((result) => {
-        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
-        else cache.delete(args.enrollmentId);
-        return result;
-      }).catch((err) => {
-        cache.delete(args.enrollmentId);
-        throw err;
-      });
-      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
-      return await promise;
     }
-  };
+  }
+  await options.audit?.(event);
+}
+
+// src/server.ts
+function hostTunnelIncumbentOutranks(incumbentGeneration, candidateGeneration) {
+  return incumbentGeneration > candidateGeneration;
 }
+var RELAY_HOST_TOKEN_CACHE_MAX_ENTRIES = 4096;
+var RUNTIME_ACCESS_TOKEN_CACHE_MAX_ENTRIES = 8192;
+var RUNTIME_ACCESS_TOKEN_CACHE_TTL_MS_DEFAULT = 1e4;
+var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var relayHostTokenCaches = /* @__PURE__ */ new WeakMap();
+var runtimeAccessTokenCaches = /* @__PURE__ */ new WeakMap();
 async function checkHostTunnelGeneration(lookup, claims) {
-  if (claims.generation === void 0 || !claims.enrollment_id) return { ok: true };
   if (!lookup) {
     return {
       ok: false,
@@ -542,31 +712,6 @@ async function checkHostTunnelGeneration(lookup, claims) {
   }
   return { ok: true };
 }
-function createCachedTargetClient(inner, options = {}) {
-  const ttlMs = options.ttlMs ?? 5e3;
-  const now = options.now ?? Date.now;
-  const cache = /* @__PURE__ */ new Map();
-  return async (args) => {
-    const key = `${args.workspaceId}\0${args.hostId}`;
-    const at = now();
-    const entry = cache.get(key);
-    if (entry && entry.expiresAt > at) {
-      if (entry.result) return entry.result;
-      if (entry.promise) return await entry.promise;
-    }
-    const promise = inner(args).then((result) => {
-      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
-      if (result) cache.set(key, { result, expiresAt: now() + ttlMs });
-      else cache.delete(key);
-      return result;
-    }).catch((err) => {
-      cache.delete(key);
-      throw err;
-    });
-    cache.set(key, { promise, expiresAt: at + ttlMs });
-    return await promise;
-  };
-}
 function protocolToken(header) {
   return header?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
 }
@@ -610,27 +755,23 @@ function forwardHeaders(input, relayHostToken, workspaceId, options = {}) {
   for (const name of inboundNames) {
     if (isDangerousInboundHeader(name)) headers.delete(name);
   }
-  if (options.userHosted) headers.delete("cookie");
+  if (options.hostTunnel) headers.delete("cookie");
   headers.set("accept-encoding", "identity");
   headers.delete("authorization");
   headers.delete("Authorization");
   headers.set("Authorization", `Bearer ${relayHostToken}`);
   headers.set("x-workspace-id", workspaceId);
-  headers.set("X-Daytona-Skip-Preview-Warning", "true");
-  headers.set("X-Daytona-Skip-Last-Activity-Update", "true");
-  for (const [name, value] of Object.entries(options.upstreamHeaders ?? {})) {
-    const trimmed = value.trim();
-    if (trimmed) headers.set(name, trimmed);
-  }
   headers.set("x-forwarded-by", "workspace-relay");
   return headers;
 }
 function targetUrl(target, path, search) {
-  const url = new URL(path.replace(/^\/+/, ""), target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
+  const base = new URL(target.baseUrl.endsWith("/") ? target.baseUrl : `${target.baseUrl}/`);
+  const url = new URL(base);
+  url.pathname = `${base.pathname}${path.replace(/^\/+/, "")}`;
   url.search = search;
+  url.hash = "";
   return url;
 }
-var RELAY_VIEWER_DENIED_PATH = /^\/api\/wr\/pty(?:\/|$)/;
 function relayRuntimePath(request) {
   try {
     const decoded = decodeURIComponent(new URL(request.url).pathname.replace(/^\/workspaces\/[^/]+\/?/, "/")).replace(/^\/+/, "/");
@@ -639,14 +780,6 @@ function relayRuntimePath(request) {
     return void 0;
   }
 }
-function roleAllowsRelayRequest(role, method, path) {
-  if (role === "owner" || role === "admin" || role === "editor") return true;
-  if (role === "viewer") {
-    if (RELAY_VIEWER_DENIED_PATH.test(path)) return false;
-    return method === "GET" || method === "HEAD" || method === "OPTIONS";
-  }
-  return false;
-}
 function relayHostTokenCacheTtlMs(options, claims) {
   const configured = options.relayHostTokenCacheTtlMs ?? 3e4;
   if (!Number.isFinite(configured) || configured <= 0) return 0;
@@ -663,7 +796,6 @@ function relayHostTokenCacheKey(options, claims, target) {
     claims.role,
     claims.workspace_id,
     claims.host_id,
-    target.access,
     target.backing,
     options.relayHostMintKid ?? ""
   ].join("\0");
@@ -742,6 +874,13 @@ function pruneRelayHostTokenCache(cache, now) {
     cache.delete(key);
   }
 }
+function relayHostMintInput(options, claims, target) {
+  return {
+    ...relayHostInputFromRuntimeClaims(claims),
+    ...target,
+    ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
+  };
+}
 async function relayHostTokenFor(options, claims, target, trace) {
   const ttlMs = relayHostTokenCacheTtlMs(options, claims);
   if (ttlMs <= 0) {
@@ -762,21 +901,11 @@ async function relayHostTokenFor(options, claims, target, trace) {
   let promise;
   try {
     const token = await trace.span("rht-mint", async () => {
-      promise = mintRelayHostToken({
-        principalKind: claims.principal_kind,
-        actorId: claims.actor_id,
-        actorKind: claims.actor_kind,
-        parentJti: claims.jti,
-        ...claims.actor_public_id && claims.actor_name ? {
-          actorPublicId: claims.actor_public_id,
-          actorName: claims.actor_name,
-          ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
-        } : {},
-        orgId: claims.org_id,
-        role: claims.role,
-        ...target,
-        ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-      }, options.relayHostSigningKey, options.relayHostAlgorithm);
+      promise = mintRelayHostToken(
+        relayHostMintInput(options, claims, target),
+        options.relayHostSigningKey,
+        options.relayHostAlgorithm
+      );
       pruneRelayHostTokenCache(cache, now);
       cache.set(key, { promise, expiresAt: now + ttlMs });
       return await promise;
@@ -794,21 +923,11 @@ async function relayHostTokenFor(options, claims, target, trace) {
 async function uncachedRelayHostTokenFor(options, claims, target, trace) {
   return await trace.span(
     "rht-mint",
-    async () => await mintRelayHostToken({
-      principalKind: claims.principal_kind,
-      actorId: claims.actor_id,
-      actorKind: claims.actor_kind,
-      parentJti: claims.jti,
-      ...claims.actor_public_id && claims.actor_name ? {
-        actorPublicId: claims.actor_public_id,
-        actorName: claims.actor_name,
-        ...claims.actor_avatar_url ? { actorAvatarUrl: claims.actor_avatar_url } : {}
-      } : {},
-      orgId: claims.org_id,
-      role: claims.role,
-      ...target,
-      ...options.relayHostMintKid ? { kid: options.relayHostMintKid } : {}
-    }, options.relayHostSigningKey, options.relayHostAlgorithm)
+    async () => await mintRelayHostToken(
+      relayHostMintInput(options, claims, target),
+      options.relayHostSigningKey,
+      options.relayHostAlgorithm
+    )
   );
 }
 function workspaceRelayTargetUrl(target, path, search) {
@@ -829,146 +948,6 @@ function workspaceRelayForwardRequestInit(request, relayHostToken, workspaceId,
   if (request.method === "GET" || request.method === "HEAD") delete init.body;
   return init;
 }
-var auditSamplers = /* @__PURE__ */ new WeakMap();
-function getOrCreateAuditSampler(options) {
-  let state = auditSamplers.get(options);
-  if (!state) {
-    const sampleRate = clampSampleRate(options.auditAcceptSampleRate);
-    state = {
-      suppressedCount: 0,
-      timer: void 0,
-      flushIntervalMs: options.auditFlushIntervalMs ?? 6e4,
-      random: options.random ?? Math.random,
-      sampleRate
-    };
-    auditSamplers.set(options, state);
-  }
-  return state;
-}
-function clampSampleRate(rate) {
-  if (rate === void 0) return 1;
-  if (!Number.isFinite(rate)) return 1;
-  if (rate < 0) return 0;
-  if (rate > 1) return 1;
-  return rate;
-}
-function ensureFlushTimer(options, state) {
-  if (state.timer) return;
-  if (state.sampleRate >= 1) return;
-  if (state.flushIntervalMs <= 0) return;
-  const timer = setInterval(() => {
-    flushSuppressedSummary(options, state);
-  }, state.flushIntervalMs);
-  if (typeof timer.unref === "function") {
-    timer.unref();
-  }
-  state.timer = timer;
-}
-function flushSuppressedSummary(options, state) {
-  const count = state.suppressedCount;
-  if (count <= 0) return;
-  state.suppressedCount = 0;
-  void options.audit?.({
-    action: "relay.request.suppressed_summary",
-    result: "allow",
-    method: "INTERNAL",
-    path: "/",
-    suppressedCount: count
-  });
-}
-function disposeAuditSampler(options) {
-  const state = auditSamplers.get(options);
-  if (!state) return;
-  if (state.timer) {
-    clearInterval(state.timer);
-    state.timer = void 0;
-  }
-  flushSuppressedSummary(options, state);
-  auditSamplers.delete(options);
-}
-function createWorkspaceRelayTrace() {
-  const phases = [];
-  return {
-    phases,
-    async span(name, run) {
-      const startedAt = performance.now();
-      try {
-        return await run();
-      } finally {
-        phases.push({ name, ms: performance.now() - startedAt });
-      }
-    }
-  };
-}
-function roundedMs(value) {
-  return Math.round(value * 100) / 100;
-}
-function workspaceRelayServerTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
-}
-function workspaceRelayTimingResponse(response, trace) {
-  const value = workspaceRelayServerTiming(trace);
-  if (!value) return response;
-  const headers = new Headers(response.headers);
-  const prev = headers.get("server-timing");
-  headers.set("server-timing", prev ? `${prev}, ${value}` : value);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
-async function audit(options, event) {
-  if (event.action === "relay.request.accepted") {
-    const state = getOrCreateAuditSampler(options);
-    if (state.sampleRate < 1) {
-      ensureFlushTimer(options, state);
-      if (state.random() >= state.sampleRate) {
-        state.suppressedCount += 1;
-        return;
-      }
-    }
-  }
-  await options.audit?.(event);
-}
-var defaultOriginMatcher = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-var originMatchers = /* @__PURE__ */ new WeakMap();
-function originMatcherFor(options) {
-  if (!options.allowedOrigins) return defaultOriginMatcher;
-  let matcher = originMatchers.get(options);
-  if (!matcher) {
-    matcher = createOriginMatcher(options.allowedOrigins);
-    originMatchers.set(options, matcher);
-  }
-  return matcher;
-}
-var RELAY_ALLOWED_REQUEST_HEADER_LIST = [
-  "Accept",
-  "Authorization",
-  "Content-Type",
-  "Last-Event-ID",
-  "Traceparent",
-  "Tracestate",
-  "X-Fetch-Bypass-Throttle",
-  "X-Daytona-Skip-Preview-Warning",
-  "X-Workspace-Id",
-  "X-OpenCode-Directory",
-  "X-Claxedo-Runner",
-  "X-Claxedo-Model",
-  "X-Claxedo-Draft-Id",
-  "X-Claxedo-Binary"
-];
-var RELAY_ALLOWED_REQUEST_HEADERS = RELAY_ALLOWED_REQUEST_HEADER_LIST.join(", ");
-function denyCorsHeaders(request, originAllowed = defaultOriginMatcher) {
-  const origin = request.headers.get("origin");
-  if (!origin) return void 0;
-  if (!originAllowed(origin)) return void 0;
-  return {
-    "access-control-allow-origin": origin,
-    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
-    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS"
-  };
-}
 async function deny(options, input) {
   const url = new URL(input.request.url);
   await audit(options, {
@@ -984,10 +963,7 @@ async function deny(options, input) {
     method: input.request.method,
     path: url.pathname
   });
-  return Response.json(errorBody(input.code, input.message), {
-    status: input.status,
-    headers: denyCorsHeaders(input.request, originMatcherFor(options))
-  });
+  return Response.json(errorBody(input.code, input.message), { status: input.status });
 }
 async function authorizeWorkspaceRelayRequest(options, request, workspaceId, trace) {
   const token = runtimeAccessToken(request);
@@ -1009,6 +985,8 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       "rat-verify",
       async () => await cachedRuntimeAccessTokenClaims(options, token, workspaceId)
     );
+    const targetLookup = span("target-resolve", async () => await options.resolveTarget(claims));
+    targetLookup.catch(() => void 0);
     const active = await span("rat-active", async () => {
       return await options.isRuntimeAccessTokenActive?.(claims) ?? { active: true };
     });
@@ -1026,21 +1004,21 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
       };
     }
     const path = relayRuntimePath(request);
-    if (!path || !roleAllowsRelayRequest(claims.role, request.method, path)) {
+    if (!path || !sessionScopeReaches(claims.session_id, path, new URL(request.url).search)) {
       return {
         ok: false,
-        code: "relay_role_denied",
+        code: "relay_scope_denied",
         response: await deny(options, {
-          code: "relay_role_denied",
-          message: "Workspace role does not allow this relay request",
+          code: "relay_scope_denied",
+          message: "Runtime Access Token scope does not reach this relay request",
           status: 403,
           claims,
           request
         })
       };
     }
-    const target = await span("target-resolve", async () => await options.resolveTarget(claims));
-    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id) {
+    const target = await targetLookup;
+    if (!target || target.workspaceId !== claims.workspace_id || target.hostId !== claims.host_id || !isAllowedRelayTargetBaseUrl(target)) {
       return {
         ok: false,
         code: "relay_target_unavailable",
@@ -1053,13 +1031,13 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
         })
       };
     }
-    if (isUserHostedTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+    if (isHostTunnelTarget(target) && !options.directory?.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
       return {
         ok: false,
-        code: "user_hosted_app_offline",
+        code: "host_tunnel_offline",
         response: await deny(options, {
-          code: "user_hosted_app_offline",
-          message: "User-hosted workspace is offline",
+          code: "host_tunnel_offline",
+          message: "The machine serving this workspace is offline",
           status: 503,
           claims,
           request
@@ -1102,220 +1080,6 @@ async function authorizeWorkspaceRelayRequest(options, request, workspaceId, tra
     };
   }
 }
-async function forwardWorkspaceRelayRequest(request, target, relayHostToken, path, requestFetch, timeoutMs, trace, originAllowed = defaultOriginMatcher) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const span = (name, run) => trace ? trace.span(name, run) : run();
-  try {
-    const upstream = await span("upstream-fetch", async () => await requestFetch(
-      targetUrl(target, path, new URL(request.url).search),
-      workspaceRelayForwardRequestInit(request, relayHostToken, target.workspaceId, {
-        signal: controller.signal,
-        upstreamHeaders: target.upstreamHeaders
-      })
-    ));
-    const headers = new Headers(upstream.headers);
-    headers.delete("access-control-allow-origin");
-    headers.delete("access-control-allow-credentials");
-    headers.delete("access-control-allow-headers");
-    headers.delete("access-control-allow-methods");
-    headers.delete("access-control-expose-headers");
-    headers.delete("access-control-max-age");
-    for (const [key, value] of Object.entries(denyCorsHeaders(request, originAllowed) ?? {})) {
-      headers.set(key, value);
-    }
-    return new Response(upstream.body, {
-      status: upstream.status,
-      statusText: upstream.statusText,
-      headers
-    });
-  } catch (err) {
-    const aborted = err instanceof Error && err.name === "AbortError";
-    return Response.json(
-      errorBody(
-        aborted ? "upstream_timeout" : "upstream_unavailable",
-        aborted ? "Workspace upstream timed out" : "Workspace upstream is unavailable"
-      ),
-      { status: aborted ? 504 : 503, headers: denyCorsHeaders(request, originAllowed) }
-    );
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function getAuditSuppressedCount(options) {
-  return auditSamplers.get(options)?.suppressedCount ?? 0;
-}
-var LOOPBACK_REMOTES = /* @__PURE__ */ new Set([
-  "127.0.0.1",
-  "::1",
-  "::ffff:127.0.0.1"
-]);
-function isLoopbackAddress(address) {
-  if (!address) return false;
-  const trimmed = address.trim();
-  if (LOOPBACK_REMOTES.has(trimmed)) return true;
-  if (trimmed.startsWith("127.")) return true;
-  if (/^::ffff:127\./i.test(trimmed)) return true;
-  return false;
-}
-function checkMetricsAuth(options, request) {
-  if (options.metricsToken) {
-    const presented = bearerToken(request.headers.get("authorization") ?? void 0);
-    if (!presented || presented !== options.metricsToken) {
-      return {
-        ok: false,
-        status: 401,
-        code: "metrics_unauthorized",
-        message: "Metrics endpoint requires a valid bearer token"
-      };
-    }
-    return { ok: true };
-  }
-  if (!options.metricsRemoteAddress) {
-    return {
-      ok: false,
-      status: 401,
-      code: "metrics_unauthorized",
-      message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-    };
-  }
-  const address = options.metricsRemoteAddress(request);
-  if (isLoopbackAddress(address)) return { ok: true };
-  return {
-    ok: false,
-    status: 401,
-    code: "metrics_unauthorized",
-    message: "Metrics endpoint is restricted to loopback or bearer-token clients"
-  };
-}
-function buildMetricsBody(options) {
-  const sources = options.metricsSources ?? {};
-  const fragmentation = sources.fragmentation?.() ?? { fragmentsBuffered: 0, oversizedClosed: 0 };
-  const slowConsumer = sources.slowConsumer?.() ?? {
-    overflowEvents: 0,
-    timerFired: 0,
-    droppedRequests: 0
-  };
-  const activeHostCount = options.directory?.size?.() ?? 0;
-  const suppressedAccepts = getAuditSuppressedCount(options);
-  const body = {
-    fragmentation,
-    slowConsumer,
-    directory: { activeHostCount },
-    audit: { suppressedAccepts }
-  };
-  if (sources.drainPending) {
-    body.drain = { pendingCount: sources.drainPending() };
-  }
-  return body;
-}
-function createWorkspaceRelay(options) {
-  const app = Object.assign(new Hono(), {
-    disposeAuditSampler: () => disposeAuditSampler(options)
-  });
-  const originAllowed = originMatcherFor(options);
-  app.use("*", async (c, next) => {
-    await next();
-    const origin = c.res.headers.get("access-control-allow-origin");
-    if (origin && origin !== "*" && !c.res.headers.has("timing-allow-origin")) {
-      c.res.headers.set("timing-allow-origin", origin);
-    }
-  });
-  app.use("*", cors({
-    origin: (origin) => {
-      if (!origin) return void 0;
-      return originAllowed(origin) ? origin : void 0;
-    },
-    // Spread from the shared list, not hand-maintained here: a duplicate
-    // array drifts out of sync and silently drops headers like
-    // `Last-Event-ID` or `X-Fetch-Bypass-Throttle`.
-    allowHeaders: [...RELAY_ALLOWED_REQUEST_HEADER_LIST],
-    allowMethods: ["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
-  }));
-  app.get("/health", (c) => {
-    if (options.isDraining?.()) {
-      return c.json(
-        { ok: false, service: "workspace-relay", draining: true },
-        503
-      );
-    }
-    return c.json({ ok: true, service: "workspace-relay" });
-  });
-  app.get("/.well-known/jwks.json", async (c) => {
-    const sources = options.relayHostPublicKeys ?? [];
-    if (sources.length === 0) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_no_keys_configured",
-            message: "No Relay Host Token public keys are configured for the JWKS endpoint"
-          }
-        },
-        503
-      );
-    }
-    let keys;
-    try {
-      keys = await Promise.all(sources.map(async (source) => {
-        const jwk = await exportJWK2(source.publicKey);
-        return {
-          ...jwk,
-          kid: source.kid,
-          alg: "EdDSA",
-          use: "sig"
-        };
-      }));
-    } catch (err) {
-      return c.json(
-        {
-          error: {
-            code: "jwks_invalid_key",
-            message: "A configured RHT public key could not be exported as a JWK",
-            detail: err instanceof Error ? err.message : String(err)
-          }
-        },
-        500
-      );
-    }
-    c.header("cache-control", "public, max-age=300");
-    return c.json({ keys });
-  });
-  app.get("/metrics", (c) => {
-    const authResult = checkMetricsAuth(options, c.req.raw);
-    if (!authResult.ok) {
-      return c.json(
-        errorBody(authResult.code, authResult.message),
-        authResult.status
-      );
-    }
-    return c.json(buildMetricsBody(options));
-  });
-  app.all("/workspaces/:workspaceId/*", async (c) => {
-    const trace = createWorkspaceRelayTrace();
-    if (options.isDraining?.()) {
-      return Response.json(
-        errorBody("relay_draining", "Workspace relay is shutting down; try another instance"),
-        { status: 503, headers: denyCorsHeaders(c.req.raw, originAllowed) }
-      );
-    }
-    const response = await trace.span("relay-total", async () => {
-      const relay = await authorizeWorkspaceRelayRequest(options, c.req.raw, c.req.param("workspaceId"), trace);
-      if (!relay.ok) return relay.response;
-      return await forwardWorkspaceRelayRequest(
-        new Request(c.req.raw),
-        relay.request.target,
-        relay.request.relayHostToken,
-        relay.request.path,
-        options.fetch ?? fetch,
-        options.forwardTimeoutMs ?? 3e4,
-        trace,
-        originAllowed
-      );
-    });
-    return workspaceRelayTimingResponse(response, trace);
-  });
-  return app;
-}
 
 // src/directory.ts
 function presenceKey(hostId, workspaceId) {
@@ -1324,7 +1088,6 @@ function presenceKey(hostId, workspaceId) {
 function createWorkspaceRelayDirectory(options = {}) {
   const ttlMs = Math.max(1, options.ttlMs ?? 45e3);
   const now = options.now ?? Date.now;
-  const sweepIntervalMs = options.sweepIntervalMs ?? 3e4;
   const entries = /* @__PURE__ */ new Map();
   const alive = (key) => {
     const presence = entries.get(key);
@@ -1335,22 +1098,7 @@ function createWorkspaceRelayDirectory(options = {}) {
     }
     return presence;
   };
-  const keysOf = (hostId, workspaceIds) => {
-    if (workspaceIds) return [...new Set(workspaceIds)].map((workspaceId) => presenceKey(hostId, workspaceId));
-    return [...entries].filter(([, presence]) => presence.hostId === hostId).map(([key]) => key);
-  };
-  const sweep = () => {
-    const at = now();
-    for (const [key, presence] of entries) {
-      if (presence.expiresAt <= at) {
-        entries.delete(key);
-      }
-    }
-  };
-  let intervalHandle;
-  if (sweepIntervalMs > 0) {
-    intervalHandle = setInterval(sweep, sweepIntervalMs);
-  }
+  const keysOf = (hostId) => [...entries].filter(([, presence]) => presence.hostId === hostId).map(([key]) => key);
   return {
     registerHostTunnel(input) {
       const timestamp = now();
@@ -1364,10 +1112,10 @@ function createWorkspaceRelayDirectory(options = {}) {
       for (const workspaceId of next.workspaceIds) entries.set(presenceKey(next.hostId, workspaceId), next);
       return next;
     },
-    recordPong(hostId, workspaceIds) {
+    recordPong(hostId) {
       const timestamp = now();
       let touched;
-      for (const key of keysOf(hostId, workspaceIds)) {
+      for (const key of keysOf(hostId)) {
         const presence = alive(key);
         if (!presence) continue;
         const next = { ...presence, lastPongAt: timestamp, expiresAt: timestamp + ttlMs };
@@ -1376,35 +1124,140 @@ function createWorkspaceRelayDirectory(options = {}) {
       }
       return touched;
     },
-    disconnectHost(hostId, workspaceIds) {
-      for (const key of keysOf(hostId, workspaceIds)) entries.delete(key);
+    disconnectHost(hostId) {
+      for (const key of keysOf(hostId)) entries.delete(key);
     },
     activeHost(input) {
       return alive(presenceKey(input.hostId, input.workspaceId));
-    },
-    sweep,
-    size() {
-      const at = now();
-      const hosts = /* @__PURE__ */ new Set();
-      for (const presence of entries.values()) {
-        if (presence.expiresAt > at) hosts.add(presence.hostId);
-      }
-      return hosts.size;
-    },
-    dispose() {
-      if (intervalHandle !== void 0) {
-        clearInterval(intervalHandle);
-        intervalHandle = void 0;
-      }
     }
   };
 }
-function disposeWorkspaceRelayDirectory(directory) {
-  directory.dispose();
+
+// src/cors-origins.ts
+var DEFAULT_RELAY_APP_ORIGINS = [
+  "https://claxedo.com",
+  "https://*.claxedo.com"
+];
+var RELAY_ALLOWED_REQUEST_HEADERS = [
+  "Accept",
+  "Authorization",
+  "Content-Type",
+  "Last-Event-ID",
+  "Traceparent",
+  "Tracestate",
+  "X-Fetch-Bypass-Throttle",
+  "X-Workspace-Id",
+  "X-OpenCode-Directory",
+  "X-Claxedo-Runner",
+  "X-Claxedo-Model",
+  "X-Claxedo-Draft-Id",
+  "X-Claxedo-Session-Registration-Operation",
+  "X-Claxedo-Binary"
+].join(", ");
+function parseAllowedOrigins(raw) {
+  const entries = (raw ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+  return entries.length ? entries : void 0;
+}
+function createOriginMatcher(patterns) {
+  const exact = /* @__PURE__ */ new Set();
+  const httpsSuffixes = [];
+  const httpPortPrefixes = [];
+  for (const pattern of patterns) {
+    if (pattern.startsWith("https://*.")) {
+      httpsSuffixes.push(pattern.slice("https://*".length));
+    } else if (pattern.startsWith("http://") && pattern.endsWith(":*")) {
+      httpPortPrefixes.push(pattern.slice(0, -1));
+    } else {
+      exact.add(pattern);
+    }
+  }
+  return (origin) => {
+    if (exact.has(origin)) return true;
+    if (origin.startsWith("https://")) {
+      return httpsSuffixes.some(
+        (suffix) => origin.endsWith(suffix) && origin.length > "https://".length + suffix.length
+      );
+    }
+    if (origin.startsWith("http://")) {
+      return httpPortPrefixes.some(
+        (prefix) => origin.startsWith(prefix) && /^\d+$/.test(origin.slice(prefix.length))
+      );
+    }
+    return false;
+  };
+}
+
+// src/relay-cors.ts
+var RELAY_EXPOSED_RESPONSE_HEADERS = "X-Event-Cursor, X-Next-Cursor, X-Max-Event-Ordinal, Server-Timing, X-Claxedo-Trace-Id, X-Claxedo-Relay-Location-Hint";
+var configuredAppOriginAllowed = () => false;
+function setWorkspaceRelayAppOrigins(raw) {
+  configuredAppOriginAllowed = raw?.trim() ? createOriginMatcher(parseAllowedOrigins(raw) ?? []) : () => false;
+}
+var defaultOriginAllowed = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
+var baseOriginAllowed = defaultOriginAllowed;
+function setWorkspaceRelayAllowedOrigins(raw) {
+  const patterns = parseAllowedOrigins(raw);
+  baseOriginAllowed = patterns ? createOriginMatcher(patterns) : defaultOriginAllowed;
+}
+function allowedCorsOrigin(origin) {
+  if (!origin) return void 0;
+  return baseOriginAllowed(origin) || configuredAppOriginAllowed(origin) ? origin : void 0;
+}
+function workspaceUpgradeOriginDenied(request) {
+  const origin = request.headers.get("origin");
+  if (origin === null || allowedCorsOrigin(origin)) return null;
+  return Response.json(errorBody("origin_not_allowed", "Origin is not in the allowlist"), { status: 403 });
+}
+function corsHeaders(request) {
+  const origin = allowedCorsOrigin(request.headers.get("origin"));
+  if (!origin) return void 0;
+  return {
+    "access-control-allow-origin": origin,
+    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
+    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
+    "access-control-expose-headers": RELAY_EXPOSED_RESPONSE_HEADERS,
+    "access-control-max-age": "86400",
+    "timing-allow-origin": origin,
+    vary: "Origin"
+  };
+}
+function corsPreflight(request) {
+  const headers = corsHeaders(request);
+  return new Response(null, { status: headers ? 204 : 403, ...headers ? { headers } : {} });
+}
+var UPSTREAM_OWNED_RESPONSE_HEADERS = [
+  "set-cookie",
+  "access-control-allow-origin",
+  "access-control-allow-credentials",
+  "access-control-allow-headers",
+  "access-control-allow-methods",
+  "access-control-expose-headers",
+  "access-control-max-age"
+];
+var RELAY_DOCUMENT_LOCKDOWN_HEADERS = {
+  "x-content-type-options": "nosniff",
+  "content-security-policy": "sandbox"
+};
+function withRelayResponseHeaders(request, response) {
+  if (response.status === 101 || "webSocket" in response && response.webSocket) return response;
+  const next = new Headers(response.headers);
+  for (const name of UPSTREAM_OWNED_RESPONSE_HEADERS) next.delete(name);
+  for (const [key, value] of Object.entries({ ...RELAY_DOCUMENT_LOCKDOWN_HEADERS, ...corsHeaders(request) })) next.set(key, value);
+  return new Response(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: next
+  });
 }
 
-// src/cloudflare.ts
+// src/session-host-forwarding.ts
+import { sessionHostRootOf as sessionHostRootOf2 } from "@claxedo/workspace-relay-protocol";
+
+// src/relay-location.ts
+import { trimToUndefined as trimToUndefined2 } from "@claxedo/helpers/string";
+import { sessionHostRootOf } from "@claxedo/workspace-relay-protocol";
 var DEFAULT_RELAY_LOCATION_HINT = "apac";
+var SESSION_HOST_LOCATION_HINT = "enam";
 var RELAY_LOCATION_HINTS = ["wnam", "enam", "sam", "weur", "eeur", "apac", "oc", "afr", "me"];
 var relayLocationHintSet = new Set(RELAY_LOCATION_HINTS);
 function isRelayLocationHint(input) {
@@ -1446,51 +1299,139 @@ function locationHintForCountry(country) {
 }
 var RELAY_REGION_HEADER = "x-claxedo-workspace-region";
 function relayLocationHint(input) {
-  const configured = trimToUndefined(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
-  const region = trimToUndefined(input.region);
+  const configured = trimToUndefined2(input.configured) ?? DEFAULT_RELAY_LOCATION_HINT;
+  const region = trimToUndefined2(input.region);
   if (region) {
     const lowered = region.toLowerCase();
     const direct = isRelayLocationHint(lowered) ? lowered : void 0;
     const mapped = direct ?? RELAY_REGION_TO_LOCATION_HINT[lowered];
     if (mapped) return mapped;
   }
-  const country = trimToUndefined(input.country);
+  const country = trimToUndefined2(input.country);
   if (country) {
     const mapped = locationHintForCountry(country);
     if (mapped) return mapped;
   }
   return configured;
 }
+var RELAY_REGION_QUERY_PARAMS = ["region", "homeRegion"];
 function relayRequestRegion(request) {
   const url = new URL(request.url);
-  return trimToUndefined(request.headers.get(RELAY_REGION_HEADER)) ?? trimToUndefined(url.searchParams.get("region")) ?? trimToUndefined(url.searchParams.get("homeRegion"));
+  return trimToUndefined2(request.headers.get(RELAY_REGION_HEADER)) ?? trimToUndefined2(url.searchParams.get(RELAY_REGION_QUERY_PARAMS[0])) ?? trimToUndefined2(url.searchParams.get(RELAY_REGION_QUERY_PARAMS[1]));
+}
+async function relayRoomPlacement(request, input) {
+  const configured = trimToUndefined2(input.configured);
+  const region = relayRequestRegion(request);
+  const country = relayRequestCountry(request);
+  const floor = relayLocationHint(configured ? { configured } : {});
+  const declared = relayLocationHint({
+    ...configured ? { configured } : {},
+    ...region ? { region } : {},
+    ...country ? { country } : {}
+  });
+  const headers = new Headers(request.headers);
+  headers.delete(RELAY_REGION_HEADER);
+  const credential = await input.credential();
+  const sessionHost = credential !== void 0 && sessionHostRootOf(credential.hostId) !== void 0;
+  return {
+    locationHint: sessionHost ? SESSION_HOST_LOCATION_HINT : credential || declared === floor ? declared : floor,
+    url: withoutQueryParams(request.url, RELAY_REGION_QUERY_PARAMS),
+    headers
+  };
+}
+function withoutQueryParams(url, names) {
+  const target = new URL(url);
+  if (!names.some((name) => target.searchParams.has(name))) return url;
+  const kept = target.search.slice(1).split("&").filter((pair) => !names.includes(pair.split("=")[0] ?? ""));
+  target.search = kept.length ? `?${kept.join("&")}` : "";
+  return target.toString();
 }
 function relayRequestCountry(request) {
   const cf = request.cf;
   return typeof cf?.country === "string" ? cf.country : void 0;
 }
-var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
-var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
-var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
-var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
-var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
-var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 64;
-var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
-var RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
-var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
-var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
-var TRACE_ID_HEADER = "x-claxedo-trace-id";
-var TRACE_FORCE_HEADER = "x-claxedo-relay-trace";
-function unrefTimer(timer) {
-  if (typeof timer.unref === "function") timer.unref();
+
+// src/session-host-forwarding.ts
+var SESSION_HOST_LOCATION = { locationHint: SESSION_HOST_LOCATION_HINT };
+var SESSION_HOST_ORIGIN = "https://session-host.invalid";
+function unavailable() {
+  return Response.json(errorBody("session_host_unavailable", "The session host is unavailable"), { status: 503 });
+}
+function isSessionHostTarget(target) {
+  return target.backing === "durable-object";
+}
+async function forwardSessionHostHttp(namespace, request, authorized) {
+  const root = sessionHostRootOf2(authorized.target.hostId);
+  if (!namespace || !root) return unavailable();
+  const url = workspaceRelayTargetUrl({ ...authorized.target, baseUrl: SESSION_HOST_ORIGIN }, authorized.path, new URL(request.url).search);
+  const init = workspaceRelayForwardRequestInit(request, authorized.relayHostToken, authorized.target.workspaceId, { hostTunnel: true });
+  let upstream;
+  try {
+    upstream = await namespace.getByName(root, SESSION_HOST_LOCATION).fetch(url.toString(), init);
+  } catch {
+    return unavailable();
+  }
+  return new Response(upstream.body, { status: upstream.status, statusText: upstream.statusText, headers: upstream.headers });
 }
-function isUserHostedClient(client) {
-  return "channelId" in client && typeof client.channelId === "string";
+
+// src/gateway-placement.ts
+import { createRemoteJWKSet, importSPKI } from "jose";
+import { trimToUndefined as trimToUndefined3 } from "@claxedo/helpers/string";
+var placementAuthKeys = /* @__PURE__ */ new Map();
+function placementAuthKey(env) {
+  const jwksUrl = typeof env.CLAXEDO_CONTROL_PLANE_JWKS_URL === "string" ? trimToUndefined3(env.CLAXEDO_CONTROL_PLANE_JWKS_URL) : void 0;
+  const pem = (typeof env.CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM === "string" ? trimToUndefined3(env.CLAXEDO_RUNTIME_ACCESS_TOKEN_PUBLIC_KEY_PEM) : void 0)?.replaceAll("\\n", "\n");
+  const id = jwksUrl ? `jwks:${jwksUrl}` : pem ? `pem:${pem}` : void 0;
+  if (!id) return void 0;
+  const cached = placementAuthKeys.get(id);
+  if (cached) return cached;
+  if (placementAuthKeys.size >= 32) placementAuthKeys.clear();
+  const loaded = (async () => {
+    try {
+      if (jwksUrl) return createRemoteJWKSet(new URL(jwksUrl));
+      if (!pem) return void 0;
+      return await importSPKI(pem, "EdDSA");
+    } catch {
+      return void 0;
+    }
+  })();
+  placementAuthKeys.set(id, loaded);
+  return loaded;
+}
+function runtimeAccessTokenFrom(request) {
+  return bearerToken(request.headers.get("authorization") ?? void 0) ?? request.headers.get("sec-websocket-protocol")?.split(",").map((item) => item.trim()).find((item) => item.startsWith("claxedo-rat."))?.slice("claxedo-rat.".length);
+}
+async function relayPlacementCredential(request, env, url, workspaceId) {
+  const key = await placementAuthKey(env);
+  if (!key) return void 0;
+  try {
+    if (url.pathname.startsWith("/host-tunnels/")) {
+      const hostId = trimToUndefined3(hostIdFromTunnelPath(url.pathname));
+      const token2 = bearerToken(request.headers.get("authorization"));
+      if (!hostId || !token2) return void 0;
+      await verifyHostTunnelToken(token2, key, { hostId, workspaceIds: workspaceIdsFromSearch(url) });
+      return { hostId };
+    }
+    const token = runtimeAccessTokenFrom(request);
+    if (!token) return void 0;
+    const claims = await verifyRuntimeAccessToken(token, key, { workspaceId });
+    return { hostId: claims.host_id };
+  } catch {
+    return void 0;
+  }
+}
+function workspaceRelayRoomPlacement(request, env, workspaceId) {
+  return relayRoomPlacement(request, {
+    ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
+    credential: () => relayPlacementCredential(request, env, new URL(request.url), workspaceId)
+  });
 }
+
+// src/relay-trace.ts
+import { trimToUndefined as trimToUndefined4 } from "@claxedo/helpers/string";
+var TRACE_ID_HEADER = "x-claxedo-trace-id";
+var TRACE_FORCE_HEADER = "x-claxedo-relay-trace";
+var TRACE_SAMPLED_RESPONSE_HEADER = "x-claxedo-relay-sampled";
 function clampRate(input) {
   if (input === void 0 || !Number.isFinite(input)) return 0;
   if (input <= 0) return 0;
@@ -1498,8 +1439,8 @@ function clampRate(input) {
   return input;
 }
 function traceRequest(request, routeKind, options) {
-  const id = trimToUndefined(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
-  const forceSecret = trimToUndefined(options.traceForceHeaderSecret);
+  const id = trimToUndefined4(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+  const forceSecret = trimToUndefined4(options.traceForceHeaderSecret);
   const forced = !!forceSecret && request.headers.get(TRACE_FORCE_HEADER) === forceSecret;
   const rate = clampRate(options.traceSampleRate);
   return {
@@ -1518,12 +1459,12 @@ async function traceSpan(trace, name, fn) {
     trace?.phases.push({ name, ms: performance.now() - startedAt });
   }
 }
-function tracedRequest(request, trace) {
-  const headers = new Headers(request.headers);
+function tracedRequest(request, trace, forwarded = request) {
+  const headers = new Headers(forwarded.headers);
   headers.set(TRACE_ID_HEADER, trace.id);
   if (trace.sampled) headers.set("x-claxedo-trace-sampled", "1");
   else headers.delete("x-claxedo-trace-sampled");
-  return new Request(request.url, {
+  return new Request(forwarded.url, {
     method: request.method,
     headers,
     body: request.method === "GET" || request.method === "HEAD" ? void 0 : request.body,
@@ -1531,19 +1472,28 @@ function tracedRequest(request, trace) {
     duplex: "half"
   });
 }
-function roundedMs2(value) {
+function roundedMs(value) {
   return Math.round(value * 100) / 100;
 }
-function serverTiming(trace) {
-  return trace.phases.map((phase) => `${phase.name};dur=${roundedMs2(phase.ms)}`).join(", ");
+function serverTiming(phases) {
+  return phases.map((phase) => `${phase.name};dur=${roundedMs(phase.ms)}`).join(", ");
+}
+function webSocketTraceFrame(upstreamStartedAt, queueTimes, openedAt) {
+  return {
+    type: "relay.trace",
+    wsUpstreamOpenMs: roundedMs(openedAt - upstreamStartedAt),
+    queuedFrames: queueTimes.length,
+    maxQueuedDelayMs: roundedMs(queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
+  };
 }
 function withTraceHeaders(response, trace) {
   const headers = new Headers(response.headers);
   headers.set(TRACE_ID_HEADER, trace.id);
-  const timing = trace.sampled ? serverTiming(trace) : "";
+  const timing = trace.sampled ? serverTiming(trace.phases) : "";
   if (timing) {
     const existing = headers.get("server-timing");
     headers.set("server-timing", existing ? `${existing}, ${timing}` : timing);
+    headers.set(TRACE_SAMPLED_RESPONSE_HEADER, "1");
   }
   return new Response(response.body, {
     status: response.status,
@@ -1563,8 +1513,8 @@ function logTrace(options, request, workspaceId, trace, response) {
     method: request.method,
     path: url.pathname,
     status: response.status,
-    totalMs: roundedMs2(totalMs),
-    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs2(phase.ms)]))
+    totalMs: roundedMs(totalMs),
+    phases: Object.fromEntries(trace.phases.map((phase) => [phase.name, roundedMs(phase.ms)]))
   };
   if (options.traceLog) {
     options.traceLog(event);
@@ -1572,29 +1522,42 @@ function logTrace(options, request, workspaceId, trace, response) {
   }
   console.log(JSON.stringify(event));
 }
+
+// src/cloudflare.ts
+var TUNNEL_PENDING_HTTP_CAP_DEFAULT = 32;
+var TUNNEL_STARTED_STREAM_CAP_DEFAULT = 16;
+var TUNNEL_CHANNEL_CAP_DEFAULT = 16;
+var TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
+var TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT = 16 * 1024 * 1024;
+var SLOW_CONSUMER_HIGH_WATER_MARK_BYTES_DEFAULT = 8 * 1024 * 1024;
+var SLOW_CONSUMER_TIMEOUT_MS_DEFAULT = 3e4;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT = 8192;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT = 8 * 1024 * 1024;
+var UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES = 64;
+var WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+var RESOLVER_OUTAGE_GRACE_ATTEMPTS_DEFAULT = 3;
+var HIBERNATED_REVOCATION_ALARM_INTERVAL_MS_DEFAULT = 3e4;
+var HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT = 3e4;
+function unrefTimer(timer) {
+  if (typeof timer.unref === "function") timer.unref();
+}
+function isHostTunnelClient(client) {
+  return "channelId" in client && typeof client.channelId === "string";
+}
 function workspaceIdFromRelayPath(pathname) {
   return /^\/workspaces\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
 }
-function hostIdFromTunnelPath(pathname) {
-  return /^\/host-tunnels\/([^/]+)(?:\/|$)/.exec(pathname)?.[1];
-}
 function websocketRequest(request) {
   return request.headers.get("upgrade")?.toLowerCase() === "websocket";
 }
 function relayWebSocketTraceEnabled(request) {
   return request.headers.get("x-claxedo-relay-ws-trace") === "1";
 }
-function workspaceIdsFromSearch(url) {
-  return [...new Set([
-    ...url.searchParams.getAll("workspaceId"),
-    ...url.searchParams.getAll("workspace_id")
-  ].map(trimToUndefined).filter((item) => !!item))];
-}
 function randomToken() {
   return crypto.randomUUID();
 }
 function headerRecord(headers) {
-  const result = {};
+  const result = /* @__PURE__ */ Object.create(null);
   headers.forEach((value, key) => {
     result[key] = value;
   });
@@ -1617,8 +1580,8 @@ function base64ToBytes(input) {
   return Uint8Array.from(atob(input), (char) => char.charCodeAt(0));
 }
 function preOpenFrameBytes(input) {
-  if (typeof input === "string") return new TextEncoder().encode(input).byteLength;
-  return input.byteLength;
+  const payload = typeof input === "string" ? new TextEncoder().encode(input).byteLength : input.byteLength;
+  return payload + UPSTREAM_WS_PRE_OPEN_QUEUE_FRAME_OVERHEAD_BYTES;
 }
 function isBlobLike(input) {
   if (!input || typeof input !== "object") return false;
@@ -1730,20 +1693,15 @@ async function readRequestBodyCapped(request, maxBytes) {
   }
   return concatBytes(chunks);
 }
-function safeCloseCode(code, fallback = 1011) {
-  if (code === void 0) return fallback;
-  if (code >= 1e3 && code <= 4999 && ![1004, 1005, 1006].includes(code)) return code;
-  return fallback;
-}
 function workspaceRelayDurableObjectRoomName(workspaceId) {
   return `workspace:${workspaceId}`;
 }
 function workspaceRelayDurableObjectWorkspaceId(request) {
   const url = new URL(request.url);
-  const workspaceId = trimToUndefined(workspaceIdFromRelayPath(url.pathname));
+  const workspaceId = trimToUndefined5(workspaceIdFromRelayPath(url.pathname));
   if (workspaceId) return decodeURIComponent(workspaceId);
   if (!hostIdFromTunnelPath(url.pathname)) return void 0;
-  return trimToUndefined(url.searchParams.get("workspaceId")) ?? trimToUndefined(url.searchParams.get("workspace_id"));
+  return trimToUndefined5(url.searchParams.get("workspaceId")) ?? trimToUndefined5(url.searchParams.get("workspace_id"));
 }
 function namespaceFromEnv(env, options) {
   if (options.namespace) return options.namespace;
@@ -1757,47 +1715,6 @@ function isDurableObjectNamespace(value) {
 function json(code, message, status) {
   return Response.json(errorBody(code, message), { status });
 }
-var configuredAppOriginAllowed = () => false;
-function setWorkspaceRelayAppOrigins(raw) {
-  configuredAppOriginAllowed = raw?.trim() ? createOriginMatcher(parseAllowedOrigins(raw) ?? []) : () => false;
-}
-var defaultOriginAllowed = createOriginMatcher(DEFAULT_RELAY_APP_ORIGINS);
-var baseOriginAllowed = defaultOriginAllowed;
-function setWorkspaceRelayAllowedOrigins(raw) {
-  const patterns = parseAllowedOrigins(raw);
-  baseOriginAllowed = patterns ? createOriginMatcher(patterns) : defaultOriginAllowed;
-}
-function allowedCorsOrigin(origin) {
-  if (!origin) return void 0;
-  return baseOriginAllowed(origin) || configuredAppOriginAllowed(origin) ? origin : void 0;
-}
-function corsHeaders(request) {
-  const origin = allowedCorsOrigin(request.headers.get("origin"));
-  if (!origin) return void 0;
-  return {
-    "access-control-allow-origin": origin,
-    "access-control-allow-methods": "GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS",
-    "access-control-allow-headers": RELAY_ALLOWED_REQUEST_HEADERS,
-    "access-control-max-age": "86400",
-    vary: "Origin"
-  };
-}
-function corsPreflight(request) {
-  const headers = corsHeaders(request);
-  return new Response(null, { status: headers ? 204 : 403, ...headers ? { headers } : {} });
-}
-function withCors(request, response) {
-  const headers = corsHeaders(request);
-  if (!headers) return response;
-  if (response.status === 101 || "webSocket" in response && response.webSocket) return response;
-  const next = new Headers(response.headers);
-  for (const [key, value] of Object.entries(headers)) next.set(key, value);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: next
-  });
-}
 function defaultWebSocketPair() {
   const pair = new WebSocketPair();
   return {
@@ -1834,7 +1751,7 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
   return {
     async fetch(request, env = {}) {
       const gatewayStartedAt = performance.now();
-      const gatewayTraceId = trimToUndefined(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
+      const gatewayTraceId = trimToUndefined5(request.headers.get(TRACE_ID_HEADER)) ?? crypto.randomUUID();
       const url = new URL(request.url);
       if (request.method === "OPTIONS" && (url.pathname.startsWith("/workspaces/") || url.pathname.startsWith("/host-tunnels/"))) {
         return corsPreflight(request);
@@ -1842,13 +1759,6 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
       if (url.pathname === "/health") {
         return Response.json({ ok: true, service: "workspace-relay", mode: "cloudflare-durable-object" });
       }
-      const requestRegion = relayRequestRegion(request);
-      const requestCountry = relayRequestCountry(request);
-      const locationHint = relayLocationHint({
-        ...typeof env.CLAXEDO_RELAY_LOCATION_HINT === "string" ? { configured: env.CLAXEDO_RELAY_LOCATION_HINT } : {},
-        ...requestRegion ? { region: requestRegion } : {},
-        ...requestCountry ? { country: requestCountry } : {}
-      });
       const namespace = namespaceFromEnv(env, options);
       if (!namespace) {
         return json(
@@ -1872,6 +1782,8 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
           url.pathname.startsWith("/workspaces/") || url.pathname.startsWith("/host-tunnels/") ? 400 : 404
         );
       }
+      const placement = await workspaceRelayRoomPlacement(request, env, workspaceId);
+      const locationHint = placement.locationHint;
       const routeFinishedAt = performance.now();
       const response = await namespace.get(namespace.idFromName(workspaceRelayDurableObjectRoomName(workspaceId)), {
         locationHint
@@ -1881,10 +1793,10 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
         startedAt: gatewayStartedAt,
         routeKind: "gateway",
         phases: []
-      }));
+      }, placement));
       const fetchFinishedAt = performance.now();
       if (response.status === 101 || "webSocket" in response && response.webSocket) {
-        return url.pathname.startsWith("/workspaces/") ? withCors(request, response) : response;
+        return url.pathname.startsWith("/workspaces/") ? withRelayResponseHeaders(request, response) : response;
       }
       const headers = new Headers(response.headers);
       headers.set(TRACE_ID_HEADER, headers.get(TRACE_ID_HEADER) ?? gatewayTraceId);
@@ -1896,22 +1808,24 @@ function createWorkspaceRelayDurableObjectGateway(options = {}) {
         headers
       });
       const gatewayFinishedAt = performance.now();
-      const roomTiming = tracedResponse.headers.get("server-timing");
-      if (roomTiming) {
-        const gatewayTiming = [
-          `relay-gateway-route;dur=${roundedMs2(routeFinishedAt - gatewayStartedAt)}`,
-          `relay-gateway-do-fetch;dur=${roundedMs2(fetchFinishedAt - routeFinishedAt)}`,
-          `relay-gateway-response;dur=${roundedMs2(gatewayFinishedAt - gatewayResponseStartedAt)}`,
-          `relay-gateway;dur=${roundedMs2(gatewayFinishedAt - gatewayStartedAt)}`
-        ].join(", ");
+      const sampled = tracedResponse.headers.get(TRACE_SAMPLED_RESPONSE_HEADER) === "1";
+      tracedResponse.headers.delete(TRACE_SAMPLED_RESPONSE_HEADER);
+      const roomTiming = tracedResponse.headers.get("server-timing") ?? "";
+      if (sampled) {
+        const gatewayTiming = serverTiming([
+          { name: "relay-gateway-route", ms: routeFinishedAt - gatewayStartedAt },
+          { name: "relay-gateway-do-fetch", ms: fetchFinishedAt - routeFinishedAt },
+          { name: "relay-gateway-response", ms: gatewayFinishedAt - gatewayResponseStartedAt },
+          { name: "relay-gateway", ms: gatewayFinishedAt - gatewayStartedAt }
+        ]);
         tracedResponse.headers.set("server-timing", `${roomTiming}, ${gatewayTiming}`);
       }
-      return url.pathname.startsWith("/workspaces/") ? withCors(request, tracedResponse) : tracedResponse;
+      return url.pathname.startsWith("/workspaces/") ? withRelayResponseHeaders(request, tracedResponse) : tracedResponse;
     }
   };
 }
 function createWorkspaceRelayDurableObjectRoom(options) {
-  const directory = options.directory ?? createWorkspaceRelayDirectory({ sweepIntervalMs: 0 });
+  const directory = options.directory ?? createWorkspaceRelayDirectory();
   const relayOptions = { ...options, directory };
   const hostTunnels = /* @__PURE__ */ new Map();
   const clients = /* @__PURE__ */ new Set();
@@ -1939,7 +1853,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   };
   const closeSocket = (socket, code, reason) => {
     try {
-      socket.close?.(code, reason);
+      socket.close?.(code, closeReason(reason));
     } catch {
     }
   };
@@ -1986,12 +1900,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const attachment = socketAttachment(socket);
       if (!attachment) continue;
       if (attachment.kind === "host-tunnel") {
+        const incumbent = hostTunnels.get(attachment.hostId);
+        if (incumbent && incumbent.connectedAt > attachment.connectedAt) continue;
         hostTunnels.set(attachment.hostId, {
           hostId: attachment.hostId,
           workspaceIds: attachment.workspaceIds,
           connectedAt: attachment.connectedAt,
-          ...attachment.enrollmentId ? { enrollmentId: attachment.enrollmentId } : {},
-          ...attachment.generation !== void 0 ? { generation: attachment.generation } : {},
+          enrollmentId: attachment.enrollmentId,
+          generation: attachment.generation,
           generationCheckFailures: attachment.generationCheckFailures ?? 0,
           socket,
           pending: /* @__PURE__ */ new Map(),
@@ -2008,7 +1924,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     for (const row of clientRows) {
       const tunnel = hostTunnels.get(row.attachment.target.hostId);
       if (!tunnel) {
-        closeSocket(row.socket, 1011, "User-hosted tunnel unavailable");
+        closeSocket(row.socket, 1011, "Host tunnel unavailable");
         continue;
       }
       const client = {
@@ -2059,7 +1975,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         clearInterval(timer);
         onInactive(reason);
       };
-      void Promise.resolve(options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
+      void Promise.resolve().then(() => options.isRuntimeAccessTokenActive(client.request.claims)).then((active) => {
         if (active.active) {
           consecutiveUnreachable = 0;
           return;
@@ -2076,20 +1992,20 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     unrefTimer(timer);
     return timer;
   };
-  const watchUserHostedTarget = (client, onInactive) => {
+  const watchHostTunnelTarget = (client, onInactive) => {
     const intervalMs = options.workspaceTargetActiveCheckIntervalMs ?? WORKSPACE_TARGET_ACTIVE_CHECK_INTERVAL_MS_DEFAULT;
     if (intervalMs <= 0) return void 0;
     const target = client.request.target;
     let consecutiveUnreachable = 0;
     const timer = setInterval(() => {
       void Promise.resolve(options.resolveTarget(client.request.claims)).then((activeTarget) => {
-        if (activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
+        if (activeTarget?.backing === "local-worktree" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId })) {
           consecutiveUnreachable = 0;
           return;
         }
         consecutiveUnreachable = 0;
         clearInterval(timer);
-        onInactive("User-hosted workspace is offline");
+        onInactive("The machine serving this workspace is offline");
       }).catch(() => {
         consecutiveUnreachable += 1;
         if (consecutiveUnreachable < resolverGraceAttempts) return;
@@ -2105,13 +2021,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     hostId: tunnel.hostId,
     workspaceIds: tunnel.workspaceIds,
     connectedAt: tunnel.connectedAt,
-    ...tunnel.enrollmentId ? { enrollmentId: tunnel.enrollmentId } : {},
-    ...tunnel.generation !== void 0 ? { generation: tunnel.generation } : {},
+    enrollmentId: tunnel.enrollmentId,
+    generation: tunnel.generation,
     ...tunnel.generationCheckFailures ? { generationCheckFailures: tunnel.generationCheckFailures } : {}
   });
-  const fenced = (tunnel) => Boolean(options.resolveHostGeneration) && tunnel.generation !== void 0;
   const recheckHostGeneration = async (tunnel) => {
-    if (!fenced(tunnel) || hostTunnels.get(tunnel.hostId) !== tunnel) return;
+    if (hostTunnels.get(tunnel.hostId) !== tunnel) return;
     const decision = await checkHostTunnelGeneration(options.resolveHostGeneration, {
       enrollment_id: tunnel.enrollmentId,
       generation: tunnel.generation
@@ -2138,7 +2053,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   };
   const watchHostGeneration = (tunnel) => {
     const intervalMs = options.hostGenerationCheckIntervalMs ?? HOST_GENERATION_CHECK_INTERVAL_MS_DEFAULT;
-    if (tunnel.generationWatcher || hibernation || !fenced(tunnel) || intervalMs <= 0) return;
+    if (tunnel.generationWatcher || hibernation || intervalMs <= 0) return;
     tunnel.generationWatcher = setInterval(() => {
       void recheckHostGeneration(tunnel).catch(() => {
       });
@@ -2315,12 +2230,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const active = await options.isRuntimeAccessTokenActive(client.request.claims);
     return active.active ? { active: true } : { active: false, reason: active.reason };
   };
-  const userHostedTargetActive = async (client) => {
+  const hostTunnelTargetActive = async (client) => {
     const target = client.request.target;
     const activeTarget = await options.resolveTarget(client.request.claims);
-    return !!(activeTarget?.access === "user-hosted" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
+    return !!(activeTarget?.backing === "local-worktree" && activeTarget.workspaceId === target.workspaceId && activeTarget.hostId === target.hostId && directory.activeHost({ hostId: target.hostId, workspaceId: target.workspaceId }));
   };
-  const dropUserHostedChannel = (tunnel, channelId, client, code, reason) => {
+  const dropHostTunnelChannel = (tunnel, channelId, client, code, reason) => {
     tunnel.channels.delete(channelId);
     clients.delete(client);
     closeSocket(client.socket, code, reason);
@@ -2341,7 +2256,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   const scheduleHibernatedRevocationCheck = async () => {
     const intervalMs = hibernatedRevocationIntervalMs();
     if (!hibernation || !options.alarms || intervalMs <= 0) return;
-    if (clients.size === 0 && ![...hostTunnels.values()].some(fenced)) return;
+    if (clients.size === 0 && hostTunnels.size === 0) return;
     const now = options.now ?? Date.now;
     const at = now() + intervalMs;
     try {
@@ -2355,10 +2270,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     ensureHibernatedSocketsRebuilt();
     const now = options.now ?? Date.now;
     const revoke = (client, reason) => {
-      if (isUserHostedClient(client)) {
+      if (isHostTunnelClient(client)) {
         for (const tunnel of hostTunnels.values()) {
           if (tunnel.channels.get(client.channelId) !== client) continue;
-          dropUserHostedChannel(tunnel, client.channelId, client, 1008, reason);
+          dropHostTunnelChannel(tunnel, client.channelId, client, 1008, reason);
           return;
         }
       }
@@ -2385,23 +2300,23 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
     await scheduleHibernatedRevocationCheck();
   };
-  const activeUserHostedClient = (channelId, socket) => {
+  const activeHostTunnelClient = (channelId, socket) => {
     for (const tunnel of hostTunnels.values()) {
       const client = tunnel.channels.get(channelId);
       if (client?.socket === socket) return { tunnel, client };
     }
     return void 0;
   };
-  const handleUserHostedClientMessage = async (channelId, socket, data) => {
-    const active = activeUserHostedClient(channelId, socket);
+  const handleHostTunnelClientMessage = async (channelId, socket, data) => {
+    const active = activeHostTunnelClient(channelId, socket);
     if (!active) return;
     const token = await runtimeAccessTokenActive(active.client);
     if (!token.active) {
       closeSocket(socket, 1008, token.reason);
       return;
     }
-    if (!await userHostedTargetActive(active.client)) {
-      closeSocket(socket, 1011, "User-hosted workspace is offline");
+    if (!await hostTunnelTargetActive(active.client)) {
+      closeSocket(socket, 1011, "The machine serving this workspace is offline");
       return;
     }
     const frame = await socketFrame(data);
@@ -2412,7 +2327,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       channel_id: channelId,
       ...frame
     }));
-    if (!sent) closeSocket(socket, 1011, "User-hosted tunnel unavailable");
+    if (!sent) closeSocket(socket, 1011, "Host tunnel unavailable");
   };
   const applyRegistrationUpdate = async (tunnel, workspaceIds, token) => {
     const hostId = tunnel.hostId;
@@ -2446,12 +2361,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     watchHostGeneration(tunnel);
     void scheduleHibernatedRevocationCheck();
   };
-  const handleTunnelMessage = async (hostId, event) => {
+  const handleTunnelMessage = async (hostId, socket, event) => {
     const row = parseTunnelMessageData(event.data);
     if (!row.ok) return;
     const parsed = validateTunnelMessage(row.value);
     const tunnel = hostTunnels.get(hostId);
-    if (!parsed.ok || !tunnel) return;
+    if (!parsed.ok || !tunnel || tunnel.socket !== socket) return;
     directory.recordPong(tunnel.hostId);
     if (parsed.message.type === "ping") {
       tunnel.socket.send?.(JSON.stringify(makeTunnelPong(parsed.message)));
@@ -2483,7 +2398,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!pending) return;
       const chunk = base64ToBytes(message.body_base64);
       if (pending.bytes + chunk.byteLength > (options.tunnelResponseBodyMaxBytes ?? TUNNEL_RESPONSE_BODY_MAX_BYTES_DEFAULT)) {
-        failPendingTunnelResponse(tunnel, message.request_id, pending, new Error("User-hosted response body exceeds the relay limit"));
+        failPendingTunnelResponse(tunnel, message.request_id, pending, hostTunnelFailure("host_tunnel_response_body_too_large"));
         return;
       }
       pending.bytes += chunk.byteLength;
@@ -2529,7 +2444,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         return;
       }
       if (!sendSocket(channel.socket, tunnelFrame(message))) {
-        dropUserHostedChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
+        dropHostTunnelChannel(tunnel, message.channel_id, channel, 1013, "Client WebSocket delivery failed");
       }
       return;
     }
@@ -2539,7 +2454,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       if (!channel) return;
       tunnel.channels.delete(message.channel_id);
       clients.delete(channel);
-      closeSocket(channel.socket, safeCloseCode(message.code), message.reason ?? "");
+      closeSocket(channel.socket, closeCode(message.code), message.reason ?? "");
       return;
     }
     if (parsed.message.type === "error" && parsed.message.channel_id) {
@@ -2567,7 +2482,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     hostTunnels.delete(hostId);
     directory.disconnectHost(hostId);
   };
-  const cleanupUserHostedClient = (channelId, socket, event) => {
+  const cleanupHostTunnelClient = (channelId, socket, event) => {
     for (const tunnel of hostTunnels.values()) {
       const active = tunnel.channels.get(channelId);
       if (!active || active.socket !== socket) continue;
@@ -2577,7 +2492,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         type: "ws.close",
         protocol: TUNNEL_PROTOCOL_VERSION,
         channel_id: channelId,
-        code: safeCloseCode(event?.code, 1e3),
+        code: closeCode(event?.code, 1e3),
         reason: event?.reason ?? "Client WebSocket closed"
       }));
       return;
@@ -2585,7 +2500,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
   };
   const admitHostTunnel = async (request, roomWorkspaceId, url) => {
     if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
-    const hostId = trimToUndefined(hostIdFromTunnelPath(url.pathname));
+    const hostId = trimToUndefined5(hostIdFromTunnelPath(url.pathname));
     if (!hostId) return json("host_tunnel_host_required", "Host tunnel id is required", 400);
     const workspaceIds = workspaceIdsFromSearch(url);
     if (!workspaceIds.includes(roomWorkspaceId)) {
@@ -2610,8 +2525,8 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     }
     const connectedAt = options.now?.() ?? Date.now();
     const fence = {
-      ...claims.enrollment_id ? { enrollmentId: claims.enrollment_id } : {},
-      ...claims.generation !== void 0 ? { generation: claims.generation } : {}
+      enrollmentId: claims.enrollment_id,
+      generation: claims.generation
     };
     const pair = acceptSocket({ kind: "host-tunnel", hostId, workspaceIds, connectedAt, ...fence });
     const tunnel = {
@@ -2635,10 +2550,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (!hibernation) {
       pair.server.addEventListener?.("message", (event) => {
         if (!event || event.data === void 0) return;
-        void handleTunnelMessage(hostId, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
+        void handleTunnelMessage(hostId, pair.server, { data: event.data }).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
-      pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
-      pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "User-hosted tunnel disconnected"));
+      pair.server.addEventListener?.("close", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
+      pair.server.addEventListener?.("error", () => cleanupHostTunnel(hostId, pair.server, "Host tunnel disconnected"));
     }
     return upgradeResponse(pair.client, request);
   };
@@ -2646,7 +2561,12 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (!websocketRequest(request)) return json("websocket_upgrade_required", "Workspace Relay requires a WebSocket upgrade", 426);
     const authorized = await authorizeWorkspaceRelayRequest(relayOptions, request, workspaceId);
     if (!authorized.ok) return authorized.response;
-    if (isUserHostedTarget(authorized.request.target)) return admitUserHostedClient(request, authorized.request);
+    const originDenied = workspaceUpgradeOriginDenied(request);
+    if (originDenied) return originDenied;
+    if (isHostTunnelTarget(authorized.request.target)) return admitHostTunnelClient(request, authorized.request);
+    if (isSessionHostTarget(authorized.request.target)) {
+      return json("durable_object_websocket_unsupported", "A session host serves its events over HTTP streams, not WebSockets", 400);
+    }
     return await admitCloudClient(request, authorized.request);
   };
   const admitCloudClient = async (request, authorized) => {
@@ -2664,7 +2584,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
             new Headers(),
             authorized.relayHostToken,
             authorized.target.workspaceId,
-            { userHosted: false, upstreamHeaders: authorized.target.upstreamHeaders }
+            { hostTunnel: false }
           ))
         }
       );
@@ -2682,12 +2602,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const emitTrace = (openedAt) => {
       if (!trace || trace.emitted) return;
       trace.emitted = true;
-      sendSocket(pair.server, JSON.stringify({
-        type: "relay.trace",
-        wsUpstreamOpenMs: roundedMs2(openedAt - trace.upstreamStartedAt),
-        queuedFrames: trace.queueTimes.length,
-        maxQueuedDelayMs: roundedMs2(trace.queueTimes.reduce((max, at) => Math.max(max, openedAt - at), 0))
-      }));
+      sendSocket(pair.server, JSON.stringify(webSocketTraceFrame(trace.upstreamStartedAt, trace.queueTimes, openedAt)));
     };
     const activeTokenTimer = watchRuntimeAccessToken(client, (reason) => {
       closeSocket(pair.server, 1008, reason);
@@ -2697,14 +2612,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(upstream, safeCloseCode(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
+      closeSocket(upstream, closeCode(event?.code, 1e3), event?.reason ?? "Client WebSocket closed");
     };
     const cleanupUpstream = (event) => {
       if (closed) return;
       closed = true;
       if (activeTokenTimer) clearInterval(activeTokenTimer);
       clients.delete(client);
-      closeSocket(pair.server, safeCloseCode(event?.code), event?.reason ?? "");
+      closeSocket(pair.server, closeCode(event?.code), event?.reason ?? "");
     };
     const flushQueue = () => {
       upstreamOpen = true;
@@ -2720,7 +2635,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const deliverClientFrame = orderedFrameDelivery((payload) => {
       if (!upstreamOpen) {
         const frameBytes = preOpenFrameBytes(payload);
-        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) && queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
+        if (queue.length >= (options.upstreamWebSocketPreOpenQueueMaxFrames ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_FRAMES_DEFAULT) || queuedBytes + frameBytes > (options.upstreamWebSocketPreOpenQueueMaxBytes ?? UPSTREAM_WS_PRE_OPEN_QUEUE_MAX_BYTES_DEFAULT)) {
           closeSocket(pair.server, 1011, "Upstream WebSocket queue limit exceeded");
           cleanupClient({ code: 1011, reason: "Upstream WebSocket queue limit exceeded" });
           return;
@@ -2747,17 +2662,17 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     if (trace && upstreamOpen) emitTrace(upstreamConnectedAt);
     return upgradeResponse(pair.client, request);
   };
-  const admitUserHostedClient = (request, authorized) => {
+  const admitHostTunnelClient = (request, authorized) => {
     const tunnel = hostTunnels.get(authorized.target.hostId);
     if (!tunnel || !directory.activeHost({ hostId: authorized.target.hostId, workspaceId: authorized.target.workspaceId })) {
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     if (tunnel.channels.size >= (options.tunnelChannelCap ?? TUNNEL_CHANNEL_CAP_DEFAULT)) {
-      return json("too_many_channels", "User-hosted tunnel has too many active WebSocket channels", 503);
+      return json("too_many_channels", "Host tunnel has too many active WebSocket channels", 503);
     }
     const channelId = randomToken();
     const pair = acceptSocket({
-      kind: "user-hosted-client",
+      kind: "host-tunnel-client",
       channelId,
       claims: authorized.claims,
       target: authorized.target,
@@ -2774,7 +2689,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     const activeTokenTimer = hibernation ? void 0 : watchRuntimeAccessToken(client, (reason) => {
       closeSocket(pair.server, 1008, reason);
     });
-    const activeTargetTimer = hibernation ? void 0 : watchUserHostedTarget(client, (reason) => {
+    const activeTargetTimer = hibernation ? void 0 : watchHostTunnelTarget(client, (reason) => {
       closeSocket(pair.server, 1011, reason);
     });
     if (hibernation) void scheduleHibernatedRevocationCheck();
@@ -2782,11 +2697,11 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       const cleanup = (event) => {
         if (activeTokenTimer) clearInterval(activeTokenTimer);
         if (activeTargetTimer) clearInterval(activeTargetTimer);
-        cleanupUserHostedClient(channelId, pair.server, event);
+        cleanupHostTunnelClient(channelId, pair.server, event);
       };
       pair.server.addEventListener?.("message", (event) => {
         if (!event) return;
-        void handleUserHostedClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
+        void handleHostTunnelClientMessage(channelId, pair.server, event.data).catch((err) => reportFrameHandlerFailure(pair.server, err));
       });
       pair.server.addEventListener?.("close", cleanup);
       pair.server.addEventListener?.("error", cleanup);
@@ -2801,14 +2716,14 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         new Headers(),
         authorized.relayHostToken,
         authorized.target.workspaceId,
-        { userHosted: true }
+        { hostTunnel: true }
       ))
     }));
     if (!opened) {
       tunnel.channels.delete(channelId);
       clients.delete(client);
-      closeSocket(pair.server, 1011, "User-hosted tunnel unavailable");
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      closeSocket(pair.server, 1011, "Host tunnel unavailable");
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     return upgradeResponse(pair.client, request);
   };
@@ -2821,9 +2736,13 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       })
     );
     if (!authorized.ok) return authorized.response;
-    if (isUserHostedTarget(authorized.request.target)) {
-      trace && (trace.routeKind = "user-hosted-http");
-      return forwardUserHostedHttp(request, authorized.request, trace);
+    if (isHostTunnelTarget(authorized.request.target)) {
+      trace && (trace.routeKind = "host-tunnel-http");
+      return forwardHostTunnelHttp(request, authorized.request, trace);
+    }
+    if (isSessionHostTarget(authorized.request.target)) {
+      trace && (trace.routeKind = "session-host-http");
+      return traceSpan(trace, "session-host-fetch", () => forwardSessionHostHttp(options.sessionHost, request, authorized.request));
     }
     trace && (trace.routeKind = "cloud-http");
     const controller = new AbortController();
@@ -2836,8 +2755,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           new URL(request.url).search
         ),
         workspaceRelayForwardRequestInit(request, authorized.request.relayHostToken, workspaceId, {
-          signal: controller.signal,
-          upstreamHeaders: authorized.request.target.upstreamHeaders
+          signal: controller.signal
         })
       ));
       return new Response(upstream.body, {
@@ -2858,27 +2776,27 @@ function createWorkspaceRelayDurableObjectRoom(options) {
       clearTimeout(timer);
     }
   };
-  const forwardUserHostedHttp = async (request, authorized, trace) => {
+  const forwardHostTunnelHttp = async (request, authorized, trace) => {
     const tunnel = hostTunnels.get(authorized.target.hostId);
     if (!tunnel || !directory.activeHost({ hostId: authorized.target.hostId, workspaceId: authorized.target.workspaceId })) {
-      return json("user_hosted_app_offline", "User-hosted workspace is offline", 503);
+      return json("host_tunnel_offline", "The machine serving this workspace is offline", 503);
     }
     const awaitingStart = [...tunnel.pending.values()].filter((entry) => entry.startedSeq === void 0).length;
     if (awaitingStart >= (options.tunnelPendingHttpCap ?? TUNNEL_PENDING_HTTP_CAP_DEFAULT)) {
-      return json("too_many_pending_requests", "User-hosted tunnel has too many pending HTTP requests", 503);
+      return json("too_many_pending_requests", "Host tunnel has too many pending HTTP requests", 503);
     }
     const requestId = randomToken();
     const init = workspaceRelayForwardRequestInit(request, authorized.relayHostToken, authorized.target.workspaceId, {
-      userHosted: true
+      hostTunnel: true
     });
     const bodyMaxBytes = options.tunnelRequestBodyMaxBytes ?? TUNNEL_REQUEST_BODY_MAX_BYTES_DEFAULT;
     const contentLength = Number(request.headers.get("content-length") ?? Number.NaN);
     if (Number.isFinite(contentLength) && contentLength > bodyMaxBytes) {
-      return json("request_body_too_large", "User-hosted request body exceeds the relay limit", 413);
+      return json("request_body_too_large", "Host tunnel request body exceeds the relay limit", 413);
     }
     const bodyBytes = request.method === "GET" || request.method === "HEAD" ? void 0 : await traceSpan(trace, "request-body", () => readRequestBodyCapped(request, bodyMaxBytes));
     if (bodyBytes === "too_large") {
-      return json("request_body_too_large", "User-hosted request body exceeds the relay limit", 413);
+      return json("request_body_too_large", "Host tunnel request body exceeds the relay limit", 413);
     }
     const body = bodyBytes ? bytesToBase64(bodyBytes) : void 0;
     const pending = new Promise((resolve, reject) => {
@@ -2891,7 +2809,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
           paused: false,
           reason: "closed"
         }));
-        reject(new Error("User-hosted tunnel timed out"));
+        reject(hostTunnelFailure("host_tunnel_timeout"));
       }, options.forwardTimeoutMs ?? 3e4);
       tunnel.pending.set(requestId, {
         chunks: [],
@@ -2915,15 +2833,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     try {
       return await traceSpan(trace, "tunnel-wait", () => pending);
     } catch (err) {
-      const timeout = err instanceof Error && err.message.includes("timed out");
-      const responseTooLarge = err instanceof Error && err.message.includes("response body exceeds");
-      return Response.json(
-        errorBody(
-          timeout ? "user_hosted_tunnel_timeout" : responseTooLarge ? "user_hosted_response_body_too_large" : "user_hosted_tunnel_unavailable",
-          timeout ? "User-hosted tunnel timed out" : responseTooLarge ? "User-hosted response body exceeds the relay limit" : "User-hosted tunnel is unavailable"
-        ),
-        { status: responseTooLarge ? 413 : 503 }
-      );
+      return hostTunnelFailureResponse(err);
     }
   };
   return {
@@ -2958,7 +2868,7 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         trace.phases.push({ name: "relay-room-total", ms: performance.now() - roomTotalStartedAt });
         const tracedResponse = withTraceHeaders(response, trace);
         logTrace(options, nextRequest, roomWorkspaceId, trace, tracedResponse);
-        return withCors(request, tracedResponse);
+        return withRelayResponseHeaders(request, tracedResponse);
       }
       return json("relay_route_not_found", "Workspace Relay route not found", 404);
     },
@@ -2968,10 +2878,10 @@ function createWorkspaceRelayDurableObjectRoom(options) {
         const attachment = socketAttachment(socket);
         if (!attachment) return;
         if (attachment.kind === "host-tunnel") {
-          await handleTunnelMessage(attachment.hostId, { data: message });
+          await handleTunnelMessage(attachment.hostId, socket, { data: message });
           return;
         }
-        await handleUserHostedClientMessage(attachment.channelId, socket, message);
+        await handleHostTunnelClientMessage(attachment.channelId, socket, message);
       } catch (err) {
         reportFrameHandlerFailure(socket, err);
       }
@@ -2989,23 +2899,24 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     },
     webSocketClose(socket, code, reason) {
       ensureHibernatedSocketsRebuilt();
+      closeSocket(socket, closeCode(code, 1e3), reason);
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "User-hosted tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
         return;
       }
-      cleanupUserHostedClient(attachment.channelId, socket, { code, reason });
+      cleanupHostTunnelClient(attachment.channelId, socket, { code, reason });
     },
     webSocketError(socket) {
       ensureHibernatedSocketsRebuilt();
       const attachment = socketAttachment(socket);
       if (!attachment) return;
       if (attachment.kind === "host-tunnel") {
-        cleanupHostTunnel(attachment.hostId, socket, "User-hosted tunnel disconnected");
+        cleanupHostTunnel(attachment.hostId, socket, "Host tunnel disconnected");
         return;
       }
-      cleanupUserHostedClient(attachment.channelId, socket, { code: 1011, reason: "WebSocket error" });
+      cleanupHostTunnelClient(attachment.channelId, socket, { code: 1011, reason: "WebSocket error" });
     },
     state() {
       ensureHibernatedSocketsRebuilt();
@@ -3019,63 +2930,222 @@ function createWorkspaceRelayDurableObjectRoom(options) {
     drain: drainController
   };
 }
+
+// ../claxedo-helpers/dist/deadline.mjs
+async function withDeadlineSignal(timeoutMs, work, parent) {
+  const deadline = new AbortController();
+  const timer = setTimeout(() => deadline.abort(new DOMException("The operation timed out.", "TimeoutError")), timeoutMs);
+  try {
+    return await work(parent ? AbortSignal.any([parent, deadline.signal]) : deadline.signal);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/resolver-clients.ts
+function parseRuntimeAccessTokenActiveResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (row.active === true) return { active: true };
+  if (row.active !== false) return void 0;
+  if (typeof row.code !== "string" || typeof row.reason !== "string") return void 0;
+  return { active: false, code: row.code, reason: row.reason };
+}
+function parseHostGenerationResult(input) {
+  if (!isRecord(input)) return void 0;
+  const row = input;
+  if (typeof row.enrollmentId !== "string" || !row.enrollmentId.trim()) return void 0;
+  if (!isHostGeneration(row.generation) || typeof row.revoked !== "boolean") return void 0;
+  return { enrollmentId: row.enrollmentId, generation: row.generation, revoked: row.revoked };
+}
+var HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT = 5e3;
+var HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE = "relay_resolver_enrollment_not_found";
+function createHostGenerationResolverLookup(url, options) {
+  const fetcher = options.fetch ?? ((target, init) => fetch(target, init));
+  const timeoutMs = options.timeoutMs ?? HOST_GENERATION_LOOKUP_TIMEOUT_MS_DEFAULT;
+  return async ({ enrollmentId }) => {
+    const target = new URL(url);
+    target.searchParams.set("enrollmentId", enrollmentId);
+    return withDeadlineSignal(timeoutMs, async (signal) => {
+      const res = await fetcher(target, { headers: options.headers, signal });
+      if (res.status === 404) {
+        const body = await res.json().catch(() => void 0);
+        const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+        if (error?.code === HOST_GENERATION_ENROLLMENT_NOT_FOUND_CODE) return void 0;
+        throw new Error(`relay host-generation resolver failed: 404 (no host-generation route at ${url})`);
+      }
+      if (!res.ok) throw new Error(`relay host-generation resolver failed: ${res.status} ${await res.text()}`);
+      const result = parseHostGenerationResult(await res.json());
+      if (!result) throw new Error("relay host-generation resolver returned a malformed result");
+      return result;
+    });
+  };
+}
+var RESOLVER_CACHE_MAX_ENTRIES = 8192;
+var REVOCATION_CACHE_TTL_MS_DEFAULT = 1e4;
+var TARGET_CACHE_TTL_MS_DEFAULT = 1e4;
+var DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT = 30 * 6e4;
+function pruneExpiringCache(cache, now, maxEntries) {
+  for (const [key, entry] of cache) {
+    if (entry.expiresAt <= now) cache.delete(key);
+  }
+  while (cache.size >= maxEntries) {
+    const key = cache.keys().next().value;
+    if (!key) return;
+    cache.delete(key);
+  }
+}
+function createCachedRevocationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const at = now();
+    const entry = cache.get(args.jti);
+    if (entry && entry.expiresAt > at) {
+      if (entry.result) return entry.result;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((result) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      cache.set(args.jti, { result, expiresAt: now() + ttlMs });
+      return result;
+    }).catch((err) => {
+      cache.delete(args.jti);
+      throw err;
+    });
+    cache.set(args.jti, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
+function runtimeAccessTokenRevocationDelayMs(input = {}) {
+  const configuredTtl = input.revocationCacheTtlMs ?? REVOCATION_CACHE_TTL_MS_DEFAULT;
+  const ttlMs = Number.isFinite(configuredTtl) && configuredTtl > 0 ? configuredTtl : 0;
+  if (input.activeCheckIntervalMs === void 0) return ttlMs;
+  if (!Number.isFinite(input.activeCheckIntervalMs) || input.activeCheckIntervalMs <= 0) {
+    return Number.POSITIVE_INFINITY;
+  }
+  return ttlMs + input.activeCheckIntervalMs;
+}
+function createCachedHostGenerationClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? 1e4;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    for (; ; ) {
+      const at = now();
+      const entry = cache.get(args.enrollmentId);
+      if (entry && entry.expiresAt > at) {
+        if (entry.result && entry.result.generation >= args.generation) return entry.result;
+        if (!entry.result && entry.promise) {
+          const shared = await entry.promise;
+          if (!shared || shared.generation >= args.generation) return shared;
+          continue;
+        }
+      }
+      const promise = inner(args).then((result) => {
+        pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+        if (result) cache.set(args.enrollmentId, { result, expiresAt: now() + ttlMs });
+        else cache.delete(args.enrollmentId);
+        return result;
+      }).catch((err) => {
+        cache.delete(args.enrollmentId);
+        throw err;
+      });
+      cache.set(args.enrollmentId, { promise, expiresAt: at + ttlMs });
+      return await promise;
+    }
+  };
+}
+function createCachedTargetClient(inner, options = {}) {
+  const ttlMs = options.ttlMs ?? TARGET_CACHE_TTL_MS_DEFAULT;
+  const durableObjectTtlMs = options.durableObjectTtlMs ?? DURABLE_OBJECT_TARGET_CACHE_TTL_MS_DEFAULT;
+  const now = options.now ?? Date.now;
+  const cache = /* @__PURE__ */ new Map();
+  return async (args) => {
+    const key = `${args.workspaceId}\0${args.hostId}\0${args.routingId ?? ""}`;
+    const at = now();
+    const entry = cache.get(key);
+    if (entry && entry.expiresAt > at) {
+      if (entry.target) return entry.target;
+      if (entry.promise) return await entry.promise;
+    }
+    const promise = inner(args).then((target) => {
+      pruneExpiringCache(cache, now(), RESOLVER_CACHE_MAX_ENTRIES);
+      if (target) cache.set(key, { target, expiresAt: now() + (target.backing === "durable-object" ? durableObjectTtlMs : ttlMs) });
+      else cache.delete(key);
+      return target;
+    }).catch((err) => {
+      cache.delete(key);
+      throw err;
+    });
+    cache.set(key, { promise, expiresAt: at + ttlMs });
+    return await promise;
+  };
+}
 export {
   DEFAULT_RELAY_APP_ORIGINS,
   DEFAULT_RELAY_LOCATION_HINT,
   RELAY_ALLOWED_REQUEST_HEADERS,
-  RELAY_ALLOWED_REQUEST_HEADER_LIST,
   RELAY_LOCATION_HINTS,
   RELAY_REGION_HEADER,
+  RUNTIME_ACCESS_TOKEN_ACTIVE_CHECK_INTERVAL_MS_DEFAULT,
+  RUNTIME_ACCESS_TOKEN_ISSUED_AT_FLOOR_SECONDS,
+  SESSION_HOST_LOCATION_HINT,
   WorkspaceRelayAuthError,
   authorizeWorkspaceRelayRequest,
   bytesToBase64,
   checkHostTunnelGeneration,
+  corsPreflight,
   createCachedHostGenerationClient,
   createCachedRevocationClient,
   createCachedTargetClient,
   createHostGenerationResolverLookup,
   createOriginMatcher,
-  createWorkspaceRelay,
   createWorkspaceRelayDirectory,
   createWorkspaceRelayDurableObjectGateway,
   createWorkspaceRelayDurableObjectRoom,
-  createWorkspaceRelayTrace,
   deriveRelayHostKid,
   deriveRelayHostPublicKey,
-  disposeAuditSampler,
-  disposeWorkspaceRelayDirectory,
-  forwardWorkspaceRelayRequest,
-  getAuditSuppressedCount,
   hostTunnelIncumbentOutranks,
   hostTunnelTokenAudience,
+  isAllowedRelayTargetBaseUrl,
   isHostGeneration,
-  isRelayClaimPair,
+  isRelayBacking,
   mintHostTunnelToken,
   mintRelayHostToken,
   mintRuntimeAccessToken,
   parseAllowedOrigins,
-  parseHostGenerationResult,
   parseRuntimeAccessTokenActiveResult,
   parseWorkspaceRelayTarget,
+  pruneExpiringCache,
   relayFrameDiagnostics,
+  relayHostInputFromRuntimeClaims,
   relayHostTokenAudience,
   relayHostTokenIssuer,
   relayLocationHint,
   relayRequestCountry,
   relayRequestRegion,
+  relayRoomPlacement,
   runtimeAccessTokenAudience,
   runtimeAccessTokenIssuer,
+  runtimeAccessTokenRevocationDelayMs,
   setWorkspaceRelayAllowedOrigins,
   setWorkspaceRelayAppOrigins,
+  toChannelIdentityClaim,
+  tokenPurposeClaims,
+  tokenScopeClaims,
+  tokenScopePayload,
   validateRuntimeAccessTokenClaims,
   verifyHostTunnelToken,
   verifyRelayHostToken,
   verifyRuntimeAccessToken,
+  withRelayResponseHeaders,
   workspaceRelayDurableObjectRoomName,
   workspaceRelayDurableObjectWorkspaceId,
   workspaceRelayForwardHeaders,
   workspaceRelayForwardRequestInit,
-  workspaceRelayServerTiming,
+  workspaceRelayRoomPlacement,
   workspaceRelayTargetUrl,
-  workspaceRelayTimingResponse
+  workspaceUpgradeOriginDenied
 };