@roamcode.ai/server 1.0.23 → 1.2.0

package/dist/relay-start.js

@@ -0,0 +1,2023 @@
+#!/usr/bin/env node
+
+// src/relay-start.ts
+import {
+  closeSync as closeSync2,
+  constants as constants2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync
+} from "fs";
+import { join as join2, resolve } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+
+// src/relay-broker.ts
+import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
+import Fastify from "fastify";
+import websocket from "@fastify/websocket";
+
+// src/relay-account-store.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var RelayAccountRevisionConflictError = class extends Error {
+  constructor(current) {
+    super("relay account revision conflict");
+    this.current = current;
+    this.name = "RelayAccountRevisionConflictError";
+  }
+  current;
+};
+var PLAN_DEFAULTS = {
+  free: { maxRoutes: 3, maxDevicesPerRoute: 16 },
+  team: { maxRoutes: 25, maxDevicesPerRoute: 64 },
+  enterprise: { maxRoutes: 500, maxDevicesPerRoute: 500 }
+};
+var UNSAFE_TERMINAL_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+function safeId(value) {
+  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
+    throw new Error("invalid relay account id");
+  }
+  return value;
+}
+function safeLabel(value) {
+  if (typeof value !== "string") throw new Error("relay account label is required");
+  const label = value.trim().replace(/\s+/g, " ");
+  if (!label || label.length > 120 || UNSAFE_TERMINAL_TEXT.test(label)) {
+    throw new Error("invalid relay account label");
+  }
+  return label;
+}
+function safeCredential(value) {
+  if (typeof value !== "string" || !/^rrk_[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential");
+  }
+  return value;
+}
+function digest(label, credential) {
+  return createHash("sha256").update(label).update("\0").update(safeCredential(credential)).digest("base64url");
+}
+function relayAccountCredentialHash(credential) {
+  return `sha256:${digest("roamcode-relay-account-credential-v1", credential)}`;
+}
+function relayAccountCredentialLookup(credential) {
+  return `lookup:${digest("roamcode-relay-account-lookup-v1", credential)}`;
+}
+function generateRelayAccountCredential() {
+  return `rrk_${randomBytes(32).toString("base64url")}`;
+}
+function safeHash(value) {
+  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential hash");
+  }
+  return value;
+}
+function safeLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential lookup");
+  }
+  return value;
+}
+function credentialMaterial(input) {
+  if (typeof input === "string") {
+    return {
+      credentialHash: relayAccountCredentialHash(input),
+      credentialLookup: relayAccountCredentialLookup(input)
+    };
+  }
+  if ("credential" in input && input.credential !== void 0) {
+    if (input.credentialHash !== void 0 || input.credentialLookup !== void 0) {
+      throw new Error("relay account credential must be raw or pre-hashed, not both");
+    }
+    return {
+      credentialHash: relayAccountCredentialHash(input.credential),
+      credentialLookup: relayAccountCredentialLookup(input.credential)
+    };
+  }
+  return {
+    credentialHash: safeHash(input.credentialHash),
+    credentialLookup: safeLookup(input.credentialLookup)
+  };
+}
+function hashMatches(expected, credential) {
+  try {
+    const left = Buffer.from(safeHash(expected));
+    const right = Buffer.from(relayAccountCredentialHash(credential));
+    return left.length === right.length && timingSafeEqual(left, right);
+  } catch {
+    return false;
+  }
+}
+function safePlan(value) {
+  if (value !== "free" && value !== "team" && value !== "enterprise") throw new Error("invalid relay account plan");
+  return value;
+}
+function boundedLimit(value, fallback, maximum, field) {
+  const candidate = value === void 0 ? fallback : value;
+  if (!Number.isSafeInteger(candidate) || candidate < 1 || candidate > maximum) {
+    throw new Error(`invalid relay account ${field}`);
+  }
+  return candidate;
+}
+function safeStatus(value) {
+  if (value !== "active" && value !== "suspended" && value !== "deleted") {
+    throw new Error("invalid relay account status");
+  }
+  return value;
+}
+function clone(record) {
+  return { ...record };
+}
+function createMemoryStore(options) {
+  const accounts = /* @__PURE__ */ new Map();
+  const lookup = /* @__PURE__ */ new Map();
+  const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const id = lookup.get(credentialLookup);
+    const record = id ? accounts.get(id) : void 0;
+    return record && record.status !== "deleted" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
+  };
+  return {
+    mode: "memory",
+    createAccount(input, now = Date.now()) {
+      const id = safeId(generateAccountId());
+      if (accounts.has(id)) throw new Error("relay account already exists");
+      const plan = safePlan(input.plan ?? "free");
+      const { credentialHash, credentialLookup } = credentialMaterial(input);
+      if (lookup.has(credentialLookup)) throw new Error("relay account credential already exists");
+      const defaults = PLAN_DEFAULTS[plan];
+      const record = {
+        id,
+        label: safeLabel(input.label),
+        status: "active",
+        plan,
+        maxRoutes: boundedLimit(input.maxRoutes, defaults.maxRoutes, 1e4, "route limit"),
+        maxDevicesPerRoute: boundedLimit(
+          input.maxDevicesPerRoute,
+          defaults.maxDevicesPerRoute,
+          1e5,
+          "device limit"
+        ),
+        revision: 1,
+        createdAt: now,
+        updatedAt: now,
+        credentialHash,
+        credentialLookup
+      };
+      accounts.set(id, record);
+      lookup.set(credentialLookup, id);
+      return clone(record);
+    },
+    getAccount(id) {
+      const record = accounts.get(safeId(id));
+      return record ? clone(record) : void 0;
+    },
+    listAccounts({ includeDeleted = false } = {}) {
+      return [...accounts.values()].filter((record) => includeDeleted || record.status !== "deleted").sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map(clone);
+    },
+    verifyCredential,
+    authenticate(credential) {
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
+    },
+    updateAccount(id, input, expectedRevision, now = Date.now()) {
+      const current = accounts.get(safeId(id));
+      if (!current) return void 0;
+      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
+      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const plan = input.plan === void 0 ? current.plan : safePlan(input.plan);
+      const status = input.status === void 0 ? current.status : safeStatus(input.status);
+      const defaults = PLAN_DEFAULTS[plan];
+      const next = {
+        ...current,
+        ...input.label === void 0 ? {} : { label: safeLabel(input.label) },
+        status,
+        plan,
+        maxRoutes: boundedLimit(
+          input.maxRoutes,
+          input.plan === void 0 ? current.maxRoutes : defaults.maxRoutes,
+          1e4,
+          "route limit"
+        ),
+        maxDevicesPerRoute: boundedLimit(
+          input.maxDevicesPerRoute,
+          input.plan === void 0 ? current.maxDevicesPerRoute : defaults.maxDevicesPerRoute,
+          1e5,
+          "device limit"
+        ),
+        revision: current.revision + 1,
+        updatedAt: now
+      };
+      accounts.set(current.id, next);
+      return clone(next);
+    },
+    rotateCredential(id, credential, expectedRevision, now = Date.now()) {
+      const current = accounts.get(safeId(id));
+      if (!current) return void 0;
+      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
+      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
+      const owner = lookup.get(credentialLookup);
+      if (owner && owner !== current.id) throw new Error("relay account credential already exists");
+      lookup.delete(current.credentialLookup);
+      lookup.set(credentialLookup, current.id);
+      const next = {
+        ...current,
+        credentialHash,
+        credentialLookup,
+        revision: current.revision + 1,
+        updatedAt: now
+      };
+      accounts.set(current.id, next);
+      return clone(next);
+    },
+    close() {
+      accounts.clear();
+      lookup.clear();
+    }
+  };
+}
+function fromRow(row) {
+  return {
+    id: row.id,
+    label: row.label,
+    status: row.status,
+    plan: row.plan,
+    maxRoutes: row.max_routes,
+    maxDevicesPerRoute: row.max_devices_per_route,
+    revision: row.revision,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function openRelayAccountStore(options) {
+  let Database;
+  try {
+    if (options.loadDatabase) Database = options.loadDatabase();
+    else {
+      const mod = require2("better-sqlite3");
+      Database = mod.default ?? mod;
+    }
+  } catch {
+    return createMemoryStore(options);
+  }
+  const db = new Database(options.dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("busy_timeout = 5000");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS relay_accounts (
+      id TEXT PRIMARY KEY,
+      label TEXT NOT NULL,
+      status TEXT NOT NULL CHECK(status IN ('active', 'suspended', 'deleted')),
+      plan TEXT NOT NULL CHECK(plan IN ('free', 'team', 'enterprise')),
+      max_routes INTEGER NOT NULL,
+      max_devices_per_route INTEGER NOT NULL,
+      revision INTEGER NOT NULL,
+      credential_hash TEXT NOT NULL,
+      credential_lookup TEXT NOT NULL UNIQUE,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS relay_accounts_status_idx ON relay_accounts(status);
+  `);
+  const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
+  const rowById = (id) => db.prepare("SELECT * FROM relay_accounts WHERE id = ?").get(id);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status != 'deleted'").get(credentialLookup);
+    return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
+  };
+  const createAccount = db.transaction((input, now) => {
+    const id = safeId(generateAccountId());
+    if (rowById(id)) throw new Error("relay account already exists");
+    const plan = safePlan(input.plan ?? "free");
+    const { credentialHash, credentialLookup } = credentialMaterial(input);
+    const defaults = PLAN_DEFAULTS[plan];
+    const record = {
+      id,
+      label: safeLabel(input.label),
+      status: "active",
+      plan,
+      maxRoutes: boundedLimit(input.maxRoutes, defaults.maxRoutes, 1e4, "route limit"),
+      maxDevicesPerRoute: boundedLimit(input.maxDevicesPerRoute, defaults.maxDevicesPerRoute, 1e5, "device limit"),
+      revision: 1,
+      createdAt: now,
+      updatedAt: now
+    };
+    db.prepare(
+      `INSERT INTO relay_accounts
+       (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
+        credential_lookup, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      record.id,
+      record.label,
+      record.status,
+      record.plan,
+      record.maxRoutes,
+      record.maxDevicesPerRoute,
+      record.revision,
+      credentialHash,
+      credentialLookup,
+      record.createdAt,
+      record.updatedAt
+    );
+    return record;
+  });
+  return {
+    mode: "sqlite",
+    createAccount: (input, now = Date.now()) => clone(createAccount(input, now)),
+    getAccount(id) {
+      const row = rowById(safeId(id));
+      return row ? fromRow(row) : void 0;
+    },
+    listAccounts({ includeDeleted = false } = {}) {
+      const rows = db.prepare(
+        `SELECT * FROM relay_accounts ${includeDeleted ? "" : "WHERE status != 'deleted'"}
+           ORDER BY created_at, id`
+      ).all();
+      return rows.map(fromRow);
+    },
+    verifyCredential,
+    authenticate(credential) {
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
+    },
+    updateAccount(id, input, expectedRevision, now = Date.now()) {
+      const safeAccountId = safeId(id);
+      const currentRow = rowById(safeAccountId);
+      if (!currentRow) return void 0;
+      const current = fromRow(currentRow);
+      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
+      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const plan = input.plan === void 0 ? current.plan : safePlan(input.plan);
+      const defaults = PLAN_DEFAULTS[plan];
+      const next = {
+        ...current,
+        ...input.label === void 0 ? {} : { label: safeLabel(input.label) },
+        status: input.status === void 0 ? current.status : safeStatus(input.status),
+        plan,
+        maxRoutes: boundedLimit(
+          input.maxRoutes,
+          input.plan === void 0 ? current.maxRoutes : defaults.maxRoutes,
+          1e4,
+          "route limit"
+        ),
+        maxDevicesPerRoute: boundedLimit(
+          input.maxDevicesPerRoute,
+          input.plan === void 0 ? current.maxDevicesPerRoute : defaults.maxDevicesPerRoute,
+          1e5,
+          "device limit"
+        ),
+        revision: current.revision + 1,
+        updatedAt: now
+      };
+      const result = db.prepare(
+        `UPDATE relay_accounts SET label = ?, status = ?, plan = ?, max_routes = ?,
+           max_devices_per_route = ?, revision = ?, updated_at = ? WHERE id = ? AND revision = ?`
+      ).run(
+        next.label,
+        next.status,
+        next.plan,
+        next.maxRoutes,
+        next.maxDevicesPerRoute,
+        next.revision,
+        next.updatedAt,
+        next.id,
+        expectedRevision
+      );
+      if (result.changes !== 1) {
+        const latest = rowById(safeAccountId);
+        if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
+        return void 0;
+      }
+      return next;
+    },
+    rotateCredential(id, credential, expectedRevision, now = Date.now()) {
+      const safeAccountId = safeId(id);
+      const currentRow = rowById(safeAccountId);
+      if (!currentRow) return void 0;
+      const current = fromRow(currentRow);
+      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
+      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
+      const result = db.prepare(
+        `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
+           updated_at = ? WHERE id = ? AND revision = ?`
+      ).run(credentialHash, credentialLookup, now, safeAccountId, expectedRevision);
+      if (result.changes !== 1) {
+        const latest = rowById(safeAccountId);
+        if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
+        return void 0;
+      }
+      return fromRow(rowById(safeAccountId));
+    },
+    close: () => db.close()
+  };
+}
+
+// src/relay-store.ts
+import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createRequire as createRequire2 } from "module";
+var require3 = createRequire2(import.meta.url);
+var UNSAFE_DISPLAY_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+function safeId2(value, field) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
+  return value;
+}
+function safeOwnerAccountId(value) {
+  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
+    throw new Error("invalid relay route owner");
+  }
+  return value;
+}
+function safeLabel2(value) {
+  if (typeof value !== "string") throw new Error("relay route label is required");
+  const normalized = value.trim().replace(/\s+/g, " ");
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT.test(normalized)) {
+    throw new Error("invalid relay route label");
+  }
+  return normalized;
+}
+function safeCredential2(value) {
+  if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw new Error("invalid relay credential");
+  }
+  return value;
+}
+function relayCredentialHash(credential) {
+  return `sha256:${createHash2("sha256").update("roamcode-relay-credential-v1\0").update(safeCredential2(credential)).digest("base64url")}`;
+}
+function generateRelayCredential(prefix = "rrd") {
+  return `${prefix}_${randomBytes2(32).toString("base64url")}`;
+}
+function safeCredentialHash(value) {
+  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay credential hash");
+  }
+  return value;
+}
+function safeExpiry(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value < 0) throw new Error("invalid relay device expiry");
+  return value;
+}
+function hashMatches2(expected, credential) {
+  try {
+    const actual = relayCredentialHash(credential);
+    const left = Buffer.from(safeCredentialHash(expected));
+    const right = Buffer.from(actual);
+    return left.length === right.length && timingSafeEqual2(left, right);
+  } catch {
+    return false;
+  }
+}
+function cloneRoute(route) {
+  return { ...route };
+}
+function cloneDevice(device) {
+  return {
+    routeId: device.routeId,
+    deviceId: device.deviceId,
+    credentialHash: device.credentialHash,
+    createdAt: device.createdAt,
+    updatedAt: device.updatedAt,
+    ...device.expiresAt === void 0 ? {} : { expiresAt: device.expiresAt }
+  };
+}
+function credentialOverlap(current, credentialHash, expiresAt, now) {
+  if (!current || expiresAt !== void 0) return {};
+  if (current.expiresAt !== void 0) {
+    if (current.credentialHash === credentialHash) {
+      throw new Error("relay bootstrap promotion must rotate the device credential");
+    }
+    return {
+      previousCredentialHash: current.credentialHash,
+      previousCredentialExpiresAt: current.expiresAt
+    };
+  }
+  if (current.previousCredentialHash !== void 0 && current.previousCredentialExpiresAt !== void 0 && current.previousCredentialExpiresAt >= now) {
+    if (current.previousCredentialHash === credentialHash) {
+      throw new Error("relay bootstrap credential cannot become durable");
+    }
+    return {
+      previousCredentialHash: current.previousCredentialHash,
+      previousCredentialExpiresAt: current.previousCredentialExpiresAt
+    };
+  }
+  return {};
+}
+function createMemoryStore2(options) {
+  const routes = /* @__PURE__ */ new Map();
+  const devices = /* @__PURE__ */ new Map();
+  const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
+  const deviceKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
+  const pruneExpiredDevices = (now) => {
+    for (const [key, device] of devices) {
+      if (device.expiresAt !== void 0 && device.expiresAt < now) devices.delete(key);
+      else if (device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt < now) {
+        delete device.previousCredentialHash;
+        delete device.previousCredentialExpiresAt;
+      }
+    }
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const key = deviceKey(routeId, deviceId);
+    const device = devices.get(key);
+    if (device?.expiresAt !== void 0 && device.expiresAt < now) {
+      devices.delete(key);
+      return;
+    }
+    return device;
+  };
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
+      id: route.id,
+      label: route.label,
+      deviceCount: [...devices.values()].filter(
+        (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
+      ).length,
+      createdAt: route.createdAt,
+      updatedAt: route.updatedAt
+    }));
+  };
+  return {
+    mode: "memory",
+    createRoute(input, now = Date.now()) {
+      const id = safeId2(input.id ?? generateRouteId(), "route id");
+      if (routes.has(id)) throw new Error("relay route already exists");
+      const route = {
+        id,
+        label: safeLabel2(input.label),
+        hostCredentialHash: safeCredentialHash(input.hostCredentialHash),
+        ...input.ownerAccountId === void 0 ? {} : { ownerAccountId: safeOwnerAccountId(input.ownerAccountId) },
+        createdAt: now,
+        updatedAt: now
+      };
+      routes.set(id, route);
+      return cloneRoute(route);
+    },
+    getRoute(id) {
+      const route = routes.get(safeId2(id, "route id"));
+      return route ? cloneRoute(route) : void 0;
+    },
+    listRoutes: (now = Date.now()) => listRoutes(now),
+    listRoutesByOwner(ownerAccountId, now = Date.now()) {
+      return listRoutes(now, safeOwnerAccountId(ownerAccountId));
+    },
+    countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
+      const safeRouteId = safeId2(routeId, "route id");
+      return [...devices.values()].filter(
+        (device) => device.routeId === safeRouteId && (device.expiresAt === void 0 || device.expiresAt >= now)
+      ).length;
+    },
+    rotateHostCredential(routeId, credentialHash, now = Date.now()) {
+      const route = routes.get(safeId2(routeId, "route id"));
+      if (!route) return false;
+      route.hostCredentialHash = safeCredentialHash(credentialHash);
+      route.updatedAt = now;
+      return true;
+    },
+    deleteRoute(id) {
+      const safeRouteId = safeId2(id, "route id");
+      if (!routes.delete(safeRouteId)) return false;
+      for (const [key, device] of devices) if (device.routeId === safeRouteId) devices.delete(key);
+      return true;
+    },
+    authenticateHost(routeId, credential) {
+      const route = routes.get(safeId2(routeId, "route id"));
+      return !!route && hashMatches2(route.hostCredentialHash, credential);
+    },
+    putDevice(input, now = Date.now()) {
+      pruneExpiredDevices(now);
+      const routeId = safeId2(input.routeId, "route id");
+      if (!routes.has(routeId)) throw new Error("relay route not found");
+      const deviceId = safeId2(input.deviceId, "device id");
+      const key = deviceKey(routeId, deviceId);
+      const current = devices.get(key);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
+      const device = {
+        routeId,
+        deviceId,
+        credentialHash,
+        createdAt: current?.createdAt ?? now,
+        updatedAt: now,
+        ...expiresAt === void 0 ? {} : { expiresAt },
+        ...credentialOverlap(current, credentialHash, expiresAt, now)
+      };
+      devices.set(key, device);
+      const route = routes.get(routeId);
+      route.updatedAt = now;
+      return cloneDevice(device);
+    },
+    getDevice(routeId, deviceId, now = Date.now()) {
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return device ? cloneDevice(device) : void 0;
+    },
+    authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!device && (hashMatches2(device.credentialHash, credential) || device.previousCredentialHash !== void 0 && device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt >= now && hashMatches2(device.previousCredentialHash, credential));
+    },
+    revokeDevice(routeId, deviceId) {
+      const safeRouteId = safeId2(routeId, "route id");
+      const removed = devices.delete(deviceKey(safeRouteId, safeId2(deviceId, "device id")));
+      if (removed) routes.get(safeRouteId).updatedAt = Date.now();
+      return removed;
+    },
+    close() {
+      routes.clear();
+      devices.clear();
+    }
+  };
+}
+function routeFromRow(row) {
+  return {
+    id: row.id,
+    label: row.label,
+    hostCredentialHash: row.host_credential_hash,
+    ...row.owner_account_id === null ? {} : { ownerAccountId: row.owner_account_id },
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function deviceFromRow(row) {
+  return {
+    routeId: row.route_id,
+    deviceId: row.device_id,
+    credentialHash: row.credential_hash,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ...row.expires_at === null || row.expires_at === void 0 ? {} : { expiresAt: row.expires_at }
+  };
+}
+function openRelayRouteStore(options) {
+  let Database;
+  try {
+    if (options.loadDatabase) Database = options.loadDatabase();
+    else {
+      const mod = require3("better-sqlite3");
+      Database = mod.default ?? mod;
+    }
+  } catch {
+    return createMemoryStore2(options);
+  }
+  const db = new Database(options.dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("busy_timeout = 5000");
+  db.pragma("foreign_keys = ON");
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS relay_routes (
+      id TEXT PRIMARY KEY,
+      label TEXT NOT NULL,
+      host_credential_hash TEXT NOT NULL,
+      owner_account_id TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS relay_route_devices (
+      route_id TEXT NOT NULL REFERENCES relay_routes(id) ON DELETE CASCADE,
+      device_id TEXT NOT NULL,
+      credential_hash TEXT NOT NULL,
+      previous_credential_hash TEXT,
+      previous_credential_expires_at INTEGER,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      expires_at INTEGER,
+      PRIMARY KEY(route_id, device_id)
+    );
+  `);
+  const relayDeviceColumns = db.prepare("PRAGMA table_info(relay_route_devices)").all();
+  if (!relayDeviceColumns.some((column) => column.name === "expires_at")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN expires_at INTEGER");
+  }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_hash")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_hash TEXT");
+  }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_expires_at")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_expires_at INTEGER");
+  }
+  const relayRouteColumns = db.prepare("PRAGMA table_info(relay_routes)").all();
+  if (!relayRouteColumns.some((column) => column.name === "owner_account_id")) {
+    db.exec("ALTER TABLE relay_routes ADD COLUMN owner_account_id TEXT");
+  }
+  db.exec("CREATE INDEX IF NOT EXISTS relay_routes_owner_idx ON relay_routes(owner_account_id)");
+  const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
+  const getRoute = (id) => db.prepare("SELECT * FROM relay_routes WHERE id = ?").get(id);
+  const getDevice = (routeId, deviceId) => db.prepare("SELECT * FROM relay_route_devices WHERE route_id = ? AND device_id = ?").get(routeId, deviceId);
+  const pruneExpiredDevices = (now) => {
+    db.prepare("DELETE FROM relay_route_devices WHERE expires_at IS NOT NULL AND expires_at < ?").run(now);
+    db.prepare(
+      `UPDATE relay_route_devices SET previous_credential_hash = NULL, previous_credential_expires_at = NULL
+       WHERE previous_credential_expires_at IS NOT NULL AND previous_credential_expires_at < ?`
+    ).run(now);
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const row = getDevice(routeId, deviceId);
+    if (row?.expires_at !== null && row?.expires_at !== void 0 && row.expires_at < now) {
+      db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(routeId, deviceId);
+      return;
+    }
+    return row;
+  };
+  const createRoute = db.transaction(
+    (input, now) => {
+      const id = safeId2(input.id ?? generateRouteId(), "route id");
+      if (getRoute(id)) throw new Error("relay route already exists");
+      const route = {
+        id,
+        label: safeLabel2(input.label),
+        hostCredentialHash: safeCredentialHash(input.hostCredentialHash),
+        ...input.ownerAccountId === void 0 ? {} : { ownerAccountId: safeOwnerAccountId(input.ownerAccountId) },
+        createdAt: now,
+        updatedAt: now
+      };
+      db.prepare(
+        `INSERT INTO relay_routes
+         (id, label, host_credential_hash, owner_account_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)`
+      ).run(
+        route.id,
+        route.label,
+        route.hostCredentialHash,
+        route.ownerAccountId ?? null,
+        route.createdAt,
+        route.updatedAt
+      );
+      return route;
+    }
+  );
+  const putDevice = db.transaction(
+    (input, now) => {
+      const routeId = safeId2(input.routeId, "route id");
+      if (!getRoute(routeId)) throw new Error("relay route not found");
+      pruneExpiredDevices(now);
+      const deviceId = safeId2(input.deviceId, "device id");
+      const current = getDevice(routeId, deviceId);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
+      const overlap = credentialOverlap(
+        current ? {
+          ...deviceFromRow(current),
+          ...current.previous_credential_hash === null || current.previous_credential_hash === void 0 ? {} : { previousCredentialHash: current.previous_credential_hash },
+          ...current.previous_credential_expires_at === null || current.previous_credential_expires_at === void 0 ? {} : { previousCredentialExpiresAt: current.previous_credential_expires_at }
+        } : void 0,
+        credentialHash,
+        expiresAt,
+        now
+      );
+      const device = {
+        routeId,
+        deviceId,
+        credentialHash,
+        createdAt: current?.created_at ?? now,
+        updatedAt: now,
+        ...expiresAt === void 0 ? {} : { expiresAt }
+      };
+      db.prepare(
+        `INSERT INTO relay_route_devices
+         (route_id, device_id, credential_hash, previous_credential_hash, previous_credential_expires_at,
+          created_at, updated_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT(route_id, device_id) DO UPDATE SET credential_hash = excluded.credential_hash,
+           previous_credential_hash = excluded.previous_credential_hash,
+           previous_credential_expires_at = excluded.previous_credential_expires_at,
+           updated_at = excluded.updated_at, expires_at = excluded.expires_at`
+      ).run(
+        device.routeId,
+        device.deviceId,
+        device.credentialHash,
+        overlap.previousCredentialHash ?? null,
+        overlap.previousCredentialExpiresAt ?? null,
+        device.createdAt,
+        device.updatedAt,
+        device.expiresAt ?? null
+      );
+      db.prepare("UPDATE relay_routes SET updated_at = ? WHERE id = ?").run(now, routeId);
+      return device;
+    }
+  );
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return db.prepare(
+      `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
+           FROM relay_routes r LEFT JOIN relay_route_devices d ON d.route_id = r.id
+             AND (d.expires_at IS NULL OR d.expires_at >= ?)
+           ${ownerAccountId === void 0 ? "" : "WHERE r.owner_account_id = ?"}
+           GROUP BY r.id ORDER BY r.created_at, r.id`
+    ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
+      id: row.id,
+      label: row.label,
+      deviceCount: row.device_count,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    }));
+  };
+  return {
+    mode: "sqlite",
+    createRoute: (input, now = Date.now()) => cloneRoute(createRoute(input, now)),
+    getRoute(id) {
+      const row = getRoute(safeId2(id, "route id"));
+      return row ? routeFromRow(row) : void 0;
+    },
+    listRoutes: (now = Date.now()) => listRoutes(now),
+    listRoutesByOwner: (ownerAccountId, now = Date.now()) => listRoutes(now, ownerAccountId),
+    countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
+      const row = db.prepare(
+        `SELECT COUNT(*) AS count FROM relay_route_devices
+           WHERE route_id = ? AND (expires_at IS NULL OR expires_at >= ?)`
+      ).get(safeId2(routeId, "route id"), now);
+      return row.count;
+    },
+    rotateHostCredential(routeId, credentialHash, now = Date.now()) {
+      return db.prepare("UPDATE relay_routes SET host_credential_hash = ?, updated_at = ? WHERE id = ?").run(safeCredentialHash(credentialHash), now, safeId2(routeId, "route id")).changes > 0;
+    },
+    deleteRoute(id) {
+      return db.prepare("DELETE FROM relay_routes WHERE id = ?").run(safeId2(id, "route id")).changes > 0;
+    },
+    authenticateHost(routeId, credential) {
+      const row = getRoute(safeId2(routeId, "route id"));
+      return !!row && hashMatches2(row.host_credential_hash, credential);
+    },
+    putDevice: (input, now = Date.now()) => cloneDevice(putDevice(input, now)),
+    getDevice(routeId, deviceId, now = Date.now()) {
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return row ? deviceFromRow(row) : void 0;
+    },
+    authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!row && (hashMatches2(row.credential_hash, credential) || row.previous_credential_hash !== null && row.previous_credential_hash !== void 0 && row.previous_credential_expires_at !== null && row.previous_credential_expires_at !== void 0 && row.previous_credential_expires_at >= now && hashMatches2(row.previous_credential_hash, credential));
+    },
+    revokeDevice(routeId, deviceId) {
+      const safeRouteId = safeId2(routeId, "route id");
+      const result = db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(safeRouteId, safeId2(deviceId, "device id"));
+      if (result.changes > 0)
+        db.prepare("UPDATE relay_routes SET updated_at = ? WHERE id = ?").run(Date.now(), safeRouteId);
+      return result.changes > 0;
+    },
+    close: () => db.close()
+  };
+}
+
+// src/relay-broker.ts
+var BLIND_RELAY_PROTOCOL_VERSION = 1;
+var BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 15e5;
+var BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4e6;
+var BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
+var BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
+var BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE = 64 * 1024 * 1024;
+var BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12e3;
+var UNSAFE_DISPLAY_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
+function safeToken(value, field) {
+  if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
+    throw new Error(`invalid relay ${field}`);
+  }
+  return value;
+}
+function safeCredentialHash2(value) {
+  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay credential hash");
+  }
+  return value;
+}
+function safeId3(value, field) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
+  return value;
+}
+function safeLabel3(value) {
+  if (typeof value !== "string") throw new Error("relay route label is required");
+  const label = value.trim().replace(/\s+/g, " ");
+  if (!label || label.length > 80 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay route label");
+  return label;
+}
+function safeExpiry2(value, now) {
+  if (value === void 0 || value === null) return void 0;
+  if (!Number.isSafeInteger(value) || value <= now || value > now + 10 * 6e4) {
+    throw new Error("invalid relay device expiry");
+  }
+  return value;
+}
+function safeRevision(value) {
+  if (!Number.isSafeInteger(value) || value < 1) throw new Error("invalid relay account revision");
+  return value;
+}
+function bearer(request) {
+  const value = request.headers.authorization;
+  if (!value || Array.isArray(value)) return;
+  const match = /^Bearer ([A-Za-z0-9_-]{32,256})$/.exec(value);
+  return match?.[1];
+}
+function tokenMatches(left, right) {
+  if (!right) return false;
+  const a = Buffer.from(left);
+  const b = Buffer.from(right);
+  return a.length === b.length && timingSafeEqual3(a, b);
+}
+function publicRoute(route) {
+  return {
+    id: route.id,
+    label: route.label,
+    deviceCount: route.deviceCount,
+    createdAt: route.createdAt,
+    updatedAt: route.updatedAt
+  };
+}
+function normalizeOrigin(value) {
+  try {
+    const url = new URL(value);
+    const loopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      return;
+    return url.origin;
+  } catch {
+    return;
+  }
+}
+function parseJson(raw, limit) {
+  const buffer = Buffer.isBuffer(raw) ? raw : raw instanceof ArrayBuffer ? Buffer.from(raw) : Buffer.concat(raw);
+  if (buffer.byteLength > limit) throw new Error("relay frame too large");
+  return JSON.parse(buffer.toString("utf8"));
+}
+function parseAuthHello(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid relay hello");
+  const hello = value;
+  if (hello.v !== BLIND_RELAY_PROTOCOL_VERSION || hello.role !== "host" && hello.role !== "device") {
+    throw new Error("invalid relay hello");
+  }
+  const routeId = safeId3(hello.routeId, "route id");
+  const credential = safeToken(hello.credential, "credential");
+  return hello.role === "host" ? { v: 1, role: "host", routeId, credential } : { v: 1, role: "device", routeId, deviceId: safeId3(hello.deviceId, "device id"), credential };
+}
+function parsePayload(value, requireChannel, maxBytes) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid relay frame");
+  const frame = value;
+  if (frame.t !== "frame" || typeof frame.payload !== "string" || !/^[A-Za-z0-9_-]+$/.test(frame.payload)) {
+    throw new Error("invalid relay frame");
+  }
+  const bytes = Math.floor(frame.payload.length * 3 / 4);
+  if (bytes < 1 || bytes > maxBytes) throw new Error("relay frame too large");
+  const canonical = Buffer.from(frame.payload, "base64url").toString("base64url");
+  if (canonical !== frame.payload) throw new Error("invalid relay frame");
+  return {
+    ...requireChannel ? { channelId: safeId3(frame.channelId, "channel id") } : {},
+    payload: frame.payload,
+    bytes
+  };
+}
+function safeSend(socket, value, maxQueueBytes) {
+  if (socket.readyState !== socket.OPEN) return false;
+  const encoded = JSON.stringify(value);
+  if (socket.bufferedAmount + Buffer.byteLength(encoded) > maxQueueBytes) return false;
+  try {
+    socket.send(encoded);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function createBlindRelayServer(options) {
+  const rootTokens = [safeToken(options.rootToken, "root token")];
+  for (const token of options.previousRootTokens ?? []) rootTokens.push(safeToken(token, "previous root token"));
+  if (rootTokens.length > 4 || new Set(rootTokens).size !== rootTokens.length) {
+    throw new Error("invalid relay root token rotation set");
+  }
+  const store = options.store ?? openRelayRouteStore({ dbPath: ":memory:" });
+  const ownsStore = options.store === void 0;
+  const accountStore = options.accountStore;
+  const now = options.now ?? Date.now;
+  const handshakeTimeoutMs = options.handshakeTimeoutMs ?? 5e3;
+  const idleTimeoutMs = options.idleTimeoutMs ?? 2 * 6e4;
+  const maxFrameBytes = options.maxFrameBytes ?? BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES;
+  const maxQueueBytes = options.maxQueueBytes ?? BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES;
+  const maxTotalConnections = options.maxTotalConnections ?? BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS;
+  const maxConnectionsPerRoute = options.maxConnectionsPerRoute ?? BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE;
+  const maxBytesPerMinute = options.maxBytesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE;
+  const maxMessagesPerMinute = options.maxMessagesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE;
+  for (const [value, minimum, maximum, label] of [
+    [handshakeTimeoutMs, 1e3, 3e4, "handshake timeout"],
+    [idleTimeoutMs, 1e4, 60 * 6e4, "idle timeout"],
+    [maxFrameBytes, 1024, 16 * 1024 * 1024, "frame limit"],
+    [maxQueueBytes, 1024, 64 * 1024 * 1024, "queue limit"],
+    [maxTotalConnections, 1, 1e5, "total connection limit"],
+    [maxConnectionsPerRoute, 1, 1e4, "connection limit"],
+    [maxBytesPerMinute, 1024, 1024 * 1024 * 1024, "byte rate"],
+    [maxMessagesPerMinute, 10, 1e6, "message rate"]
+  ]) {
+    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`invalid relay ${label}`);
+  }
+  const maxEnvelopeBytes = Math.max(8 * 1024, Math.ceil(maxFrameBytes * 4 / 3) + 8 * 1024);
+  const configuredOrigins = options.allowedOrigins ?? [];
+  const normalizedOrigins = configuredOrigins.map(normalizeOrigin);
+  if (normalizedOrigins.some((origin) => origin === void 0)) {
+    throw new Error("invalid relay allowed origin");
+  }
+  const allowedOrigins = new Set(normalizedOrigins);
+  const generateChannelId = options.generateChannelId ?? (() => `rrc_${randomBytes3(16).toString("base64url")}`);
+  const hosts = /* @__PURE__ */ new Map();
+  const devicesByChannel = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const hostRates = /* @__PURE__ */ new Map();
+  const deviceRates = /* @__PURE__ */ new Map();
+  const maxRateIdentities = Math.min(1e5, Math.max(256, maxTotalConnections * 4));
+  const deviceRateKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
+  const clearRouteRates = (routeId) => {
+    hostRates.delete(routeId);
+    for (const key of deviceRates.keys()) if (key.startsWith(`${routeId}\0`)) deviceRates.delete(key);
+  };
+  const rateWindowFor = (windows, key) => {
+    const current = now();
+    if (windows.size >= maxRateIdentities) {
+      for (const [candidate, window] of windows) {
+        if (current - window.lastSeenAt >= 12e4) windows.delete(candidate);
+      }
+    }
+    const existing = windows.get(key);
+    if (existing) {
+      existing.lastSeenAt = current;
+      return existing;
+    }
+    if (windows.size >= maxRateIdentities) return;
+    const created = { startedAt: current, lastSeenAt: current, bytes: 0, messages: 0 };
+    windows.set(key, created);
+    return created;
+  };
+  const consumeRate = (window, bytes) => {
+    const current = now();
+    if (current - window.startedAt >= 6e4) {
+      window.startedAt = current;
+      window.bytes = 0;
+      window.messages = 0;
+    }
+    window.lastSeenAt = current;
+    window.bytes += bytes;
+    window.messages += 1;
+    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
+  };
+  const metrics = {
+    activeConnections: 0,
+    activeHosts: 0,
+    activeDevices: 0,
+    acceptedConnections: 0,
+    rejectedConnections: 0,
+    forwardedFrames: 0,
+    forwardedBytes: 0,
+    droppedFrames: 0
+  };
+  const app = Fastify({ logger: false, trustProxy: false, bodyLimit: 32 * 1024 });
+  const authenticatedAccounts = /* @__PURE__ */ new WeakMap();
+  const routeAccountIsActive = (routeId) => {
+    const ownerAccountId = store.getRoute(routeId)?.ownerAccountId;
+    if (!ownerAccountId) return true;
+    return accountStore?.getAccount(ownerAccountId)?.status === "active";
+  };
+  const requireRoot = async (request, reply) => {
+    const presented = bearer(request);
+    if (rootTokens.some((token) => tokenMatches(token, presented))) return;
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
+  const requireHost = async (request, reply) => {
+    try {
+      if (routeAccountIsActive(request.params.routeId) && store.authenticateHost(request.params.routeId, bearer(request) ?? ""))
+        return;
+    } catch {
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
+  const requireAccount = async (request, reply) => {
+    const account = accountStore?.authenticate(bearer(request) ?? "");
+    if (account) {
+      authenticatedAccounts.set(request, account);
+      return;
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
+  const requireRecoverableAccount = async (request, reply) => {
+    const account = accountStore?.verifyCredential(bearer(request) ?? "");
+    if (account) {
+      authenticatedAccounts.set(request, account);
+      return;
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
+  app.addHook("onSend", async (_request, reply, payload) => {
+    reply.header("cache-control", "no-store");
+    reply.header("content-security-policy", "default-src 'none'");
+    reply.header("x-content-type-options", "nosniff");
+    return payload;
+  });
+  app.get("/health", async () => ({ status: "ok", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }));
+  app.get("/ready", async (_request, reply) => {
+    try {
+      store.listRoutes(now());
+      accountStore?.listAccounts();
+      return { status: "ready", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION };
+    } catch {
+      reply.code(503);
+      return { status: "unavailable", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION };
+    }
+  });
+  app.get("/v1/metrics", { preHandler: requireRoot }, async () => ({
+    protocolVersion: BLIND_RELAY_PROTOCOL_VERSION,
+    metrics: {
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    }
+  }));
+  app.get("/v1/routes", { preHandler: requireRoot }, async () => ({ routes: store.listRoutes().map(publicRoute) }));
+  app.post(
+    "/v1/routes",
+    { preHandler: requireRoot },
+    async (request, reply) => {
+      try {
+        const hostCredential = generateRelayCredential("rrh");
+        const route = store.createRoute({
+          ...request.body?.id === void 0 ? {} : { id: safeId3(request.body.id, "route id") },
+          label: safeLabel3(request.body?.label),
+          hostCredentialHash: relayCredentialHash(hostCredential)
+        });
+        reply.code(201).send({
+          route: {
+            id: route.id,
+            label: route.label,
+            deviceCount: 0,
+            createdAt: route.createdAt,
+            updatedAt: route.updatedAt
+          },
+          hostCredential
+        });
+      } catch (error) {
+        const conflict = error.message === "relay route already exists";
+        reply.code(conflict ? 409 : 400).send({
+          code: conflict ? "RELAY_ROUTE_EXISTS" : "INVALID_RELAY_ROUTE",
+          error: conflict ? "relay route already exists" : "invalid relay route"
+        });
+      }
+    }
+  );
+  app.delete(
+    "/v1/routes/:routeId",
+    { preHandler: requireRoot },
+    async (request, reply) => {
+      let removed = false;
+      try {
+        removed = store.deleteRoute(request.params.routeId);
+      } catch {
+      }
+      if (!removed) {
+        reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+        return;
+      }
+      clearRouteRates(request.params.routeId);
+      const host = hosts.get(request.params.routeId);
+      host?.socket.close(4403, "route deleted");
+      for (const device of host?.devices.values() ?? []) device.socket.close(4403, "route deleted");
+      reply.code(204).send();
+    }
+  );
+  app.get(
+    "/v1/routes/:routeId/status",
+    { preHandler: requireHost },
+    async (request) => ({
+      routeId: request.params.routeId,
+      hostOnline: hosts.has(request.params.routeId),
+      activeDevices: hosts.get(request.params.routeId)?.devices.size ?? 0
+    })
+  );
+  app.put("/v1/routes/:routeId/devices/:deviceId", { preHandler: requireHost }, async (request, reply) => {
+    try {
+      const route = store.getRoute(request.params.routeId);
+      if (route?.ownerAccountId && !store.getDevice(route.id, request.params.deviceId, now())) {
+        const account = accountStore?.getAccount(route.ownerAccountId);
+        if (!account || store.countDevices(route.id, now()) >= account.maxDevicesPerRoute) {
+          reply.code(429).send({ code: "RELAY_DEVICE_LIMIT", error: "relay device limit reached" });
+          return;
+        }
+      }
+      const device = store.putDevice({
+        routeId: request.params.routeId,
+        deviceId: request.params.deviceId,
+        credentialHash: typeof request.body?.credentialHash === "string" ? request.body.credentialHash : "invalid",
+        ...request.body?.expiresAt === void 0 ? {} : { expiresAt: safeExpiry2(request.body.expiresAt, now()) }
+      });
+      reply.code(200).send({
+        device: {
+          routeId: device.routeId,
+          deviceId: device.deviceId,
+          createdAt: device.createdAt,
+          updatedAt: device.updatedAt
+        }
+      });
+    } catch {
+      reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device route" });
+    }
+  });
+  app.delete(
+    "/v1/routes/:routeId/devices/:deviceId",
+    { preHandler: requireHost },
+    async (request, reply) => {
+      let removed = false;
+      try {
+        removed = store.revokeDevice(request.params.routeId, request.params.deviceId);
+      } catch {
+      }
+      if (!removed) {
+        reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
+        return;
+      }
+      deviceRates.delete(deviceRateKey(request.params.routeId, request.params.deviceId));
+      const live = hosts.get(request.params.routeId)?.devices.get(request.params.deviceId);
+      live?.socket.close(4403, "device revoked");
+      reply.code(204).send();
+    }
+  );
+  const closeDevice = (device, code = 1e3, reason = "device disconnected") => {
+    if (device.closed) return;
+    device.closed = true;
+    if (device.idle) clearTimeout(device.idle);
+    devicesByChannel.delete(device.channelId);
+    const host = hosts.get(device.routeId);
+    if (host?.devices.get(device.deviceId) === device) host.devices.delete(device.deviceId);
+    metrics.activeDevices = Math.max(0, metrics.activeDevices - 1);
+    if (host && !safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes)) {
+      metrics.droppedFrames += 1;
+      closeHost(host, 4408, "relay backpressure");
+    }
+    if (device.socket.readyState === device.socket.OPEN) device.socket.close(code, reason);
+  };
+  const touchDevice = (device) => {
+    if (device.idle) clearTimeout(device.idle);
+    device.idle = setTimeout(() => closeDevice(device, 4408, "idle timeout"), idleTimeoutMs);
+    device.idle.unref?.();
+  };
+  const closeHost = (host, code = 1e3, reason = "host disconnected") => {
+    if (host.closed) return;
+    host.closed = true;
+    if (host.idle) clearTimeout(host.idle);
+    if (hosts.get(host.routeId) === host) hosts.delete(host.routeId);
+    for (const device of [...host.devices.values()]) closeDevice(device, 4412, "host unavailable");
+    metrics.activeHosts = Math.max(0, metrics.activeHosts - 1);
+    if (host.socket.readyState === host.socket.OPEN) host.socket.close(code, reason);
+  };
+  const touchHost = (host) => {
+    if (host.idle) clearTimeout(host.idle);
+    host.idle = setTimeout(() => closeHost(host, 4408, "idle timeout"), idleTimeoutMs);
+    host.idle.unref?.();
+  };
+  if (accountStore) {
+    const accountEnvelope = (account) => ({
+      account,
+      usage: { routes: store.listRoutesByOwner(account.id, now()).length, maxRoutes: account.maxRoutes }
+    });
+    const closeAccountRoutes = (accountId, reason) => {
+      for (const host of [...hosts.values()]) if (host.ownerAccountId === accountId) closeHost(host, 4403, reason);
+    };
+    const purgeAccountRoutes = (accountId) => {
+      closeAccountRoutes(accountId, "account deleted");
+      for (const route of store.listRoutesByOwner(accountId, now())) {
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
+      }
+    };
+    for (const listedRoute of store.listRoutes(now())) {
+      const route = store.getRoute(listedRoute.id);
+      if (!route?.ownerAccountId) continue;
+      const owner = accountStore.getAccount(route.ownerAccountId);
+      if (!owner || owner.status === "deleted") {
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
+      }
+    }
+    const ownedRoute = (accountId, routeId) => {
+      const route = store.getRoute(routeId);
+      return route?.ownerAccountId === accountId ? route : void 0;
+    };
+    app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
+      accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
+    }));
+    const createAccountHandler = (clientHashedOnly) => async (request, reply) => {
+      try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
+        const account = accountStore.createAccount({
+          label: request.body?.label,
+          ...request.body?.plan === void 0 ? {} : { plan: request.body.plan },
+          ...request.body?.maxRoutes === void 0 ? {} : { maxRoutes: request.body.maxRoutes },
+          ...request.body?.maxDevicesPerRoute === void 0 ? {} : { maxDevicesPerRoute: request.body.maxDevicesPerRoute },
+          ...typeof credential === "string" ? { credential } : {
+            credentialHash: credential.credentialHash,
+            credentialLookup: credential.credentialLookup
+          }
+        });
+        reply.code(201).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
+        });
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+      }
+    };
+    app.post(
+      "/v1/accounts",
+      { preHandler: requireRoot },
+      createAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/client-hashed",
+      { preHandler: requireRoot },
+      createAccountHandler(true)
+    );
+    app.patch(
+      "/v1/accounts/:accountId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        try {
+          const account = accountStore.updateAccount(
+            request.params.accountId,
+            request.body,
+            safeRevision(request.body?.expectedRevision)
+          );
+          if (!account) {
+            reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+            return;
+          }
+          if (account.status === "deleted") purgeAccountRoutes(account.id);
+          else if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
+          reply.code(200).send(accountEnvelope(account));
+        } catch (error) {
+          if (error instanceof RelayAccountRevisionConflictError) {
+            reply.code(409).send({
+              code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+              error: "relay account revision conflict",
+              current: accountEnvelope(error.current)
+            });
+            return;
+          }
+          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        }
+      }
+    );
+    const rotateAccountHandler = (clientHashedOnly) => async (request, reply) => {
+      try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
+        const account = accountStore.rotateCredential(
+          request.params.accountId,
+          credential,
+          safeRevision(request.body?.expectedRevision)
+        );
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
+        });
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          reply.code(409).send({
+            code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+            error: "relay account revision conflict",
+            current: accountEnvelope(error.current)
+          });
+          return;
+        }
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+      }
+    };
+    app.post(
+      "/v1/accounts/:accountId/credential",
+      { preHandler: requireRoot },
+      rotateAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/:accountId/credential/client-hashed",
+      { preHandler: requireRoot },
+      rotateAccountHandler(true)
+    );
+    app.get(
+      "/v1/account/recovery",
+      { preHandler: requireRecoverableAccount },
+      async (request) => accountEnvelope(authenticatedAccounts.get(request))
+    );
+    app.get(
+      "/v1/account",
+      { preHandler: requireAccount },
+      async (request) => accountEnvelope(authenticatedAccounts.get(request))
+    );
+    app.get("/v1/account/routes", { preHandler: requireAccount }, async (request) => ({
+      routes: store.listRoutesByOwner(authenticatedAccounts.get(request).id, now()).map((route) => ({
+        ...publicRoute(route),
+        hostOnline: hosts.has(route.id)
+      }))
+    }));
+    app.post(
+      "/v1/account/routes",
+      { preHandler: requireAccount },
+      async (request, reply) => {
+        const account = authenticatedAccounts.get(request);
+        let id;
+        let label;
+        let credentialHash;
+        try {
+          id = safeId3(request.body?.id, "route id");
+          label = safeLabel3(request.body?.label);
+          credentialHash = safeCredentialHash2(request.body?.credentialHash);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+          return;
+        }
+        const existing = store.getRoute(id);
+        if (existing) {
+          if (existing.ownerAccountId !== account.id || existing.label !== label || !tokenMatches(existing.hostCredentialHash, credentialHash)) {
+            reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
+            return;
+          }
+          reply.code(200).send({
+            route: {
+              ...publicRoute({ ...existing, deviceCount: store.countDevices(existing.id, now()) }),
+              hostOnline: hosts.has(id)
+            },
+            connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
+          });
+          return;
+        }
+        if (store.listRoutesByOwner(account.id, now()).length >= account.maxRoutes) {
+          reply.code(429).send({ code: "RELAY_ROUTE_LIMIT", error: "relay route limit reached" });
+          return;
+        }
+        try {
+          const route = store.createRoute({
+            id,
+            label,
+            hostCredentialHash: credentialHash,
+            ownerAccountId: account.id
+          });
+          reply.code(201).send({
+            route: { ...publicRoute({ ...route, deviceCount: 0 }), hostOnline: false },
+            connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
+          });
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+        }
+      }
+    );
+    app.delete(
+      "/v1/account/routes/:routeId",
+      { preHandler: requireAccount },
+      async (request, reply) => {
+        const account = authenticatedAccounts.get(request);
+        let removed = false;
+        try {
+          removed = !!ownedRoute(account.id, request.params.routeId) && store.deleteRoute(request.params.routeId);
+        } catch {
+        }
+        if (!removed) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        clearRouteRates(request.params.routeId);
+        const host = hosts.get(request.params.routeId);
+        if (host) closeHost(host, 4403, "route deleted");
+        reply.code(204).send();
+      }
+    );
+    app.post(
+      "/v1/account/routes/:routeId/credential",
+      { preHandler: requireAccount },
+      async (request, reply) => {
+        const account = authenticatedAccounts.get(request);
+        try {
+          if (!ownedRoute(account.id, request.params.routeId)) {
+            reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+            return;
+          }
+        } catch {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        let credentialHash;
+        try {
+          credentialHash = safeCredentialHash2(request.body?.credentialHash);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_CREDENTIAL", error: "invalid relay credential hash" });
+          return;
+        }
+        if (!store.rotateHostCredential(request.params.routeId, credentialHash, now())) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const host = hosts.get(request.params.routeId);
+        if (host) closeHost(host, 4409, "host credential rotated");
+        reply.code(204).send();
+      }
+    );
+  }
+  app.register(websocket, { options: { maxPayload: maxEnvelopeBytes, perMessageDeflate: false } });
+  app.register(async (scope) => {
+    scope.get("/v1/connect", { websocket: true }, (socket, request) => {
+      if (sockets.size >= maxTotalConnections) {
+        metrics.rejectedConnections += 1;
+        socket.close(4429, "relay connection limit");
+        return;
+      }
+      sockets.add(socket);
+      let authenticated = false;
+      let liveHost;
+      let liveDevice;
+      const handshakeTimer = setTimeout(() => socket.close(4401, "authentication timeout"), handshakeTimeoutMs);
+      handshakeTimer.unref?.();
+      const reject = (code, reason) => {
+        metrics.rejectedConnections += 1;
+        socket.close(code, reason);
+      };
+      socket.on("message", (raw, isBinary) => {
+        if (isBinary) {
+          metrics.droppedFrames += 1;
+          reject(4400, "text envelope required");
+          return;
+        }
+        if (!authenticated) {
+          try {
+            const hello = parseAuthHello(parseJson(raw, 8 * 1024));
+            const presentedOrigin = request.headers.origin;
+            const origin = typeof presentedOrigin === "string" ? normalizeOrigin(presentedOrigin) : void 0;
+            if (hello.role === "device" && allowedOrigins.size > 0 && presentedOrigin !== void 0 && (!origin || !allowedOrigins.has(origin))) {
+              reject(4403, "origin denied");
+              return;
+            }
+            if (hello.role === "host") {
+              const route = store.getRoute(hello.routeId);
+              if (!route || route.ownerAccountId !== void 0 && accountStore?.getAccount(route.ownerAccountId)?.status !== "active" || !store.authenticateHost(hello.routeId, hello.credential)) {
+                reject(4401, "authentication failed");
+                return;
+              }
+              const rate = rateWindowFor(hostRates, hello.routeId);
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
+              const previous = hosts.get(hello.routeId);
+              if (previous) closeHost(previous, 4409, "superseded host");
+              liveHost = {
+                socket,
+                routeId: hello.routeId,
+                ...route.ownerAccountId === void 0 ? {} : { ownerAccountId: route.ownerAccountId },
+                devices: /* @__PURE__ */ new Map(),
+                rate,
+                closed: false
+              };
+              hosts.set(hello.routeId, liveHost);
+              metrics.activeHosts += 1;
+              touchHost(liveHost);
+              if (!safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+                return;
+              }
+            } else {
+              if (!routeAccountIsActive(hello.routeId) || !store.authenticateDevice(hello.routeId, hello.deviceId, hello.credential, now())) {
+                reject(4401, "authentication failed");
+                return;
+              }
+              const host = hosts.get(hello.routeId);
+              if (!host || host.socket.readyState !== host.socket.OPEN) {
+                reject(4412, "host unavailable");
+                return;
+              }
+              if (host.devices.size >= maxConnectionsPerRoute && !host.devices.has(hello.deviceId)) {
+                reject(4429, "route connection limit");
+                return;
+              }
+              const rate = rateWindowFor(deviceRates, deviceRateKey(hello.routeId, hello.deviceId));
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
+              const previous = host.devices.get(hello.deviceId);
+              if (previous) closeDevice(previous, 4409, "superseded device");
+              const channelId = safeId3(generateChannelId(), "channel id");
+              liveDevice = {
+                socket,
+                routeId: hello.routeId,
+                deviceId: hello.deviceId,
+                channelId,
+                rate,
+                closed: false
+              };
+              host.devices.set(hello.deviceId, liveDevice);
+              devicesByChannel.set(channelId, liveDevice);
+              metrics.activeDevices += 1;
+              touchDevice(liveDevice);
+              if (!safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+                return;
+              }
+              if (!safeSend(host.socket, { t: "peer-open", channelId, deviceId: hello.deviceId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeDevice(liveDevice, 4408, "host backpressure");
+                return;
+              }
+            }
+            authenticated = true;
+            metrics.acceptedConnections += 1;
+            clearTimeout(handshakeTimer);
+          } catch {
+            reject(4400, "invalid authentication frame");
+          }
+          return;
+        }
+        try {
+          const value = parseJson(raw, maxEnvelopeBytes);
+          if (liveDevice) {
+            touchDevice(liveDevice);
+            if (value?.t === "ping") {
+              if (!consumeRate(liveDevice.rate, 1)) {
+                closeDevice(liveDevice, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+              }
+              return;
+            }
+            const frame = parsePayload(value, false, maxFrameBytes);
+            if (!consumeRate(liveDevice.rate, frame.bytes)) {
+              closeDevice(liveDevice, 4429, "rate limit");
+              return;
+            }
+            const host = hosts.get(liveDevice.routeId);
+            if (!host || !safeSend(
+              host.socket,
+              { t: "frame", channelId: liveDevice.channelId, payload: frame.payload },
+              maxQueueBytes
+            )) {
+              metrics.droppedFrames += 1;
+              closeDevice(liveDevice, 4408, "host unavailable or slow");
+              return;
+            }
+            metrics.forwardedFrames += 1;
+            metrics.forwardedBytes += frame.bytes;
+            return;
+          }
+          if (liveHost) {
+            touchHost(liveHost);
+            if (value?.t === "ping") {
+              if (!consumeRate(liveHost.rate, 1)) {
+                closeHost(liveHost, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+              }
+              return;
+            }
+            if (value?.t === "close-peer") {
+              const channelId = safeId3(value.channelId, "channel id");
+              if (!consumeRate(liveHost.rate, 1)) {
+                closeHost(liveHost, 4429, "rate limit");
+                return;
+              }
+              const device2 = devicesByChannel.get(channelId);
+              if (device2?.routeId === liveHost.routeId) closeDevice(device2, 4400, "host closed channel");
+              return;
+            }
+            const frame = parsePayload(value, true, maxFrameBytes);
+            if (!consumeRate(liveHost.rate, frame.bytes)) {
+              closeHost(liveHost, 4429, "rate limit");
+              return;
+            }
+            const device = devicesByChannel.get(frame.channelId);
+            if (!device || device.routeId !== liveHost.routeId) {
+              metrics.droppedFrames += 1;
+              return;
+            }
+            if (!safeSend(device.socket, { t: "frame", payload: frame.payload }, maxQueueBytes)) {
+              metrics.droppedFrames += 1;
+              closeDevice(device, 4408, "device backpressure");
+              return;
+            }
+            metrics.forwardedFrames += 1;
+            metrics.forwardedBytes += frame.bytes;
+          }
+        } catch {
+          metrics.droppedFrames += 1;
+          if (liveDevice) closeDevice(liveDevice, 4400, "invalid relay frame");
+          else if (liveHost) closeHost(liveHost, 4400, "invalid relay frame");
+        }
+      });
+      socket.once("close", () => {
+        sockets.delete(socket);
+        clearTimeout(handshakeTimer);
+        if (liveDevice) closeDevice(liveDevice);
+        if (liveHost) closeHost(liveHost);
+      });
+      socket.once("error", () => {
+      });
+    });
+  });
+  app.addHook("onClose", async () => {
+    for (const host of [...hosts.values()]) closeHost(host, 1001, "relay shutting down");
+    for (const socket of [...sockets]) socket.close(1001, "relay shutting down");
+    hostRates.clear();
+    deviceRates.clear();
+    if (ownsStore) store.close();
+  });
+  return {
+    app,
+    store,
+    ...accountStore ? { accountStore } : {},
+    metrics: () => ({
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    })
+  };
+}
+
+// src/data-dir.ts
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
+import { randomBytes as randomBytes4 } from "crypto";
+import { dirname, join } from "path";
+var MAX_ACCESS_TOKEN_BYTES = 4 * 1024;
+var MAX_ACCESS_TOKEN_FILE_BYTES = MAX_ACCESS_TOKEN_BYTES + 2;
+function resolveDataDir(env, exists = existsSync) {
+  if (env.ROAMCODE_DATA_DIR) return env.ROAMCODE_DATA_DIR;
+  if (env.REMOTE_CODER_DATA_DIR) return env.REMOTE_CODER_DATA_DIR;
+  const pick = (next, legacy) => !exists(next) && exists(legacy) ? legacy : next;
+  if (env.XDG_CONFIG_HOME)
+    return pick(join(env.XDG_CONFIG_HOME, "roamcode"), join(env.XDG_CONFIG_HOME, "remote-coder"));
+  if (env.HOME) return pick(join(env.HOME, ".config", "roamcode"), join(env.HOME, ".config", "remote-coder"));
+  return pick(join(process.cwd(), ".roamcode"), join(process.cwd(), ".remote-coder"));
+}
+function ensureDataDir(dir) {
+  mkdirSync(dir, { recursive: true, mode: 448 });
+}
+
+// src/relay-start.ts
+function boundedInteger(value, fallback, minimum, maximum, field) {
+  const parsed = value === void 0 ? fallback : Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) throw new Error(`invalid ${field}`);
+  return parsed;
+}
+function relayDataDir(env) {
+  const configured = env.ROAMCODE_RELAY_DATA_DIR?.trim();
+  return configured ? resolve(configured) : join2(resolveDataDir(env), "relay");
+}
+function relayOrigins(env) {
+  return (env.ROAMCODE_RELAY_ALLOWED_ORIGINS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+}
+function privateSecretFile(path, field) {
+  let descriptor;
+  try {
+    const before = lstatSync2(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > 4096 || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret file");
+    }
+    descriptor = openSync2(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    const opened = fstatSync2(descriptor);
+    if (!opened.isFile() || opened.size > 4096 || (opened.mode & 63) !== 0 || typeof process.getuid === "function" && opened.uid !== process.getuid() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("unsafe secret file");
+    }
+    return readFileSync2(descriptor, "utf8").trim();
+  } catch {
+    throw new Error(`${field} could not be read securely`);
+  } finally {
+    if (descriptor !== void 0) closeSync2(descriptor);
+  }
+}
+function previousRootTokens(env) {
+  const inline = (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const directory = env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR?.trim();
+  if (inline.length > 0 && directory) {
+    throw new Error(
+      "ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS and ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR are mutually exclusive"
+    );
+  }
+  if (!directory) return inline;
+  let before;
+  let entries;
+  try {
+    before = lstatSync2(directory);
+    if (!before.isDirectory() || before.isSymbolicLink() || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret directory");
+    }
+    entries = readdirSync(directory, { withFileTypes: true });
+    const after = lstatSync2(directory);
+    if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 63) !== 0 || typeof process.getuid === "function" && after.uid !== process.getuid() || entries.some((entry) => !entry.isFile())) {
+      throw new Error("unsafe secret directory");
+    }
+  } catch {
+    throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR could not be read securely");
+  }
+  if (entries.length > 3) throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR may contain at most three files");
+  return entries.map((entry) => entry.name).sort().map((name) => privateSecretFile(join2(directory, name), "previous relay root capability"));
+}
+function explicitBoolean(value, field) {
+  if (value === void 0 || value === "" || value === "0" || value === "false") return false;
+  if (value === "1" || value === "true") return true;
+  throw new Error(`invalid ${field}`);
+}
+function secretValue(env, directKey, fileKey) {
+  const direct = env[directKey]?.trim();
+  const file = env[fileKey]?.trim();
+  if (direct && file) throw new Error(`${directKey} and ${fileKey} are mutually exclusive`);
+  if (direct) return direct;
+  if (!file) return void 0;
+  return privateSecretFile(file, fileKey);
+}
+async function startBlindRelay(env = process.env) {
+  const rootToken = secretValue(env, "ROAMCODE_RELAY_ROOT_TOKEN", "ROAMCODE_RELAY_ROOT_TOKEN_FILE");
+  if (!rootToken) throw new Error("ROAMCODE_RELAY_ROOT_TOKEN or ROAMCODE_RELAY_ROOT_TOKEN_FILE is required");
+  const previousRoots = previousRootTokens(env);
+  const allowedOrigins = relayOrigins(env);
+  const allowAnyOrigin = explicitBoolean(env.ROAMCODE_RELAY_ALLOW_ANY_ORIGIN, "relay allow-any-origin flag");
+  if (env.NODE_ENV === "production" && allowedOrigins.length === 0 && !allowAnyOrigin) {
+    throw new Error(
+      "ROAMCODE_RELAY_ALLOWED_ORIGINS is required in production; explicitly set ROAMCODE_RELAY_ALLOW_ANY_ORIGIN=1 only for a reviewed deployment"
+    );
+  }
+  const dataDir = relayDataDir(env);
+  ensureDataDir(dataDir);
+  const store = openRelayRouteStore({ dbPath: join2(dataDir, "routes.db") });
+  if (store.mode !== "sqlite") {
+    store.close();
+    throw new Error("relay requires durable SQLite; rebuild better-sqlite3 before starting");
+  }
+  const accountsEnabled = explicitBoolean(env.ROAMCODE_RELAY_ACCOUNTS_ENABLED, "relay accounts-enabled flag");
+  let accountStore;
+  if (accountsEnabled) {
+    accountStore = openRelayAccountStore({ dbPath: join2(dataDir, "accounts.db") });
+    if (accountStore.mode !== "sqlite") {
+      accountStore.close();
+      store.close();
+      throw new Error("relay accounts require durable SQLite; rebuild better-sqlite3 before starting");
+    }
+  }
+  let relay;
+  try {
+    relay = createBlindRelayServer({
+      rootToken,
+      previousRootTokens: previousRoots,
+      store,
+      ...accountStore ? { accountStore } : {},
+      allowedOrigins,
+      handshakeTimeoutMs: boundedInteger(
+        env.ROAMCODE_RELAY_HANDSHAKE_TIMEOUT_MS,
+        5e3,
+        1e3,
+        3e4,
+        "relay handshake timeout"
+      ),
+      idleTimeoutMs: boundedInteger(
+        env.ROAMCODE_RELAY_IDLE_TIMEOUT_MS,
+        12e4,
+        1e4,
+        36e5,
+        "relay idle timeout"
+      ),
+      maxFrameBytes: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_FRAME_BYTES,
+        15e5,
+        1024,
+        16 * 1024 * 1024,
+        "relay frame limit"
+      ),
+      maxQueueBytes: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_QUEUE_BYTES,
+        4e6,
+        1024,
+        64 * 1024 * 1024,
+        "relay queue limit"
+      ),
+      maxTotalConnections: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_TOTAL_CONNECTIONS,
+        1024,
+        1,
+        1e5,
+        "relay total connection limit"
+      ),
+      maxConnectionsPerRoute: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_CONNECTIONS_PER_ROUTE,
+        64,
+        1,
+        1e4,
+        "relay route connection limit"
+      ),
+      maxBytesPerMinute: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_BYTES_PER_MINUTE,
+        64 * 1024 * 1024,
+        1024,
+        1024 * 1024 * 1024,
+        "relay byte rate"
+      ),
+      maxMessagesPerMinute: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_MESSAGES_PER_MINUTE,
+        12e3,
+        10,
+        1e6,
+        "relay message rate"
+      )
+    });
+  } catch (error) {
+    accountStore?.close();
+    store.close();
+    throw error;
+  }
+  relay.app.addHook("onClose", async () => {
+    accountStore?.close();
+    store.close();
+  });
+  const host = env.ROAMCODE_RELAY_BIND?.trim() || "127.0.0.1";
+  const port = boundedInteger(env.ROAMCODE_RELAY_PORT, 4281, 0, 65535, "relay port");
+  try {
+    const url = await relay.app.listen({ host, port });
+    return { ...relay, url };
+  } catch (error) {
+    accountStore?.close();
+    store.close();
+    throw error;
+  }
+}
+function isRelayDirectExecution(moduleUrl, argv1, embeddedContainerBuild2 = false) {
+  if (embeddedContainerBuild2) return false;
+  if (!argv1) return false;
+  try {
+    return realpathSync(fileURLToPath(moduleUrl)) === realpathSync(argv1);
+  } catch {
+    return moduleUrl === pathToFileURL(argv1).href;
+  }
+}
+var embeddedContainerBuild = typeof __RELAY_CONTAINER_BUILD__ === "boolean" && __RELAY_CONTAINER_BUILD__ === true;
+if (isRelayDirectExecution(import.meta.url, process.argv[1], embeddedContainerBuild)) {
+  void startBlindRelay().then((relay) => {
+    process.stdout.write(`RoamCode blind relay is listening at ${relay.url}
+`);
+    const shutdown = () => relay.app.close().finally(() => process.exit(0));
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+  }).catch((error) => {
+    process.stderr.write(`roamcode relay failed to start: ${error.message}
+`);
+    process.exitCode = 1;
+  });
+}
+export {
+  isRelayDirectExecution,
+  startBlindRelay
+};