@roamcode.ai/server 1.1.0 → 1.2.0

package/dist/container/relay.js

@@ -1,5 +1,14 @@
 // src/relay-start.ts
-import { readFileSync as readFileSync2, realpathSync } from "fs";
+import {
+  closeSync as closeSync2,
+  constants as constants2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync
+} from "fs";
 import { join as join2, resolve } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
@@ -25,6 +34,7 @@ var PLAN_DEFAULTS = {
   team: { maxRoutes: 25, maxDevicesPerRoute: 64 },
   enterprise: { maxRoutes: 500, maxDevicesPerRoute: 500 }
 };
+var UNSAFE_TERMINAL_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId(value) {
   if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
     throw new Error("invalid relay account id");
@@ -34,7 +44,7 @@ function safeId(value) {
 function safeLabel(value) {
   if (typeof value !== "string") throw new Error("relay account label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 120 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) {
+  if (!label || label.length > 120 || UNSAFE_TERMINAL_TEXT.test(label)) {
     throw new Error("invalid relay account label");
   }
   return label;
@@ -63,6 +73,33 @@ function safeHash(value) {
   }
   return value;
 }
+function safeLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential lookup");
+  }
+  return value;
+}
+function credentialMaterial(input) {
+  if (typeof input === "string") {
+    return {
+      credentialHash: relayAccountCredentialHash(input),
+      credentialLookup: relayAccountCredentialLookup(input)
+    };
+  }
+  if ("credential" in input && input.credential !== void 0) {
+    if (input.credentialHash !== void 0 || input.credentialLookup !== void 0) {
+      throw new Error("relay account credential must be raw or pre-hashed, not both");
+    }
+    return {
+      credentialHash: relayAccountCredentialHash(input.credential),
+      credentialLookup: relayAccountCredentialLookup(input.credential)
+    };
+  }
+  return {
+    credentialHash: safeHash(input.credentialHash),
+    credentialLookup: safeLookup(input.credentialLookup)
+  };
+}
 function hashMatches(expected, credential) {
   try {
     const left = Buffer.from(safeHash(expected));
@@ -96,14 +133,24 @@ function createMemoryStore(options) {
   const accounts = /* @__PURE__ */ new Map();
   const lookup = /* @__PURE__ */ new Map();
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const id = lookup.get(credentialLookup);
+    const record = id ? accounts.get(id) : void 0;
+    return record && record.status !== "deleted" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
+  };
   return {
     mode: "memory",
     createAccount(input, now = Date.now()) {
       const id = safeId(generateAccountId());
       if (accounts.has(id)) throw new Error("relay account already exists");
       const plan = safePlan(input.plan ?? "free");
-      const credentialHash = relayAccountCredentialHash(input.credential);
-      const credentialLookup = relayAccountCredentialLookup(input.credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(input);
       if (lookup.has(credentialLookup)) throw new Error("relay account credential already exists");
       const defaults = PLAN_DEFAULTS[plan];
       const record = {
@@ -135,16 +182,10 @@ function createMemoryStore(options) {
     listAccounts({ includeDeleted = false } = {}) {
       return [...accounts.values()].filter((record) => includeDeleted || record.status !== "deleted").sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map(clone);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
-      try {
-        credentialLookup = relayAccountCredentialLookup(credential);
-      } catch {
-        return void 0;
-      }
-      const id = lookup.get(credentialLookup);
-      const record = id ? accounts.get(id) : void 0;
-      return record?.status === "active" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const current = accounts.get(safeId(id));
@@ -182,8 +223,7 @@ function createMemoryStore(options) {
       if (!current) return void 0;
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const credentialHash = relayAccountCredentialHash(credential);
-      const credentialLookup = relayAccountCredentialLookup(credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
       const owner = lookup.get(credentialLookup);
       if (owner && owner !== current.id) throw new Error("relay account credential already exists");
       lookup.delete(current.credentialLookup);
@@ -249,10 +289,21 @@ function openRelayAccountStore(options) {
   `);
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
   const rowById = (id) => db.prepare("SELECT * FROM relay_accounts WHERE id = ?").get(id);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status != 'deleted'").get(credentialLookup);
+    return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
+  };
   const createAccount = db.transaction((input, now) => {
     const id = safeId(generateAccountId());
     if (rowById(id)) throw new Error("relay account already exists");
     const plan = safePlan(input.plan ?? "free");
+    const { credentialHash, credentialLookup } = credentialMaterial(input);
     const defaults = PLAN_DEFAULTS[plan];
     const record = {
       id,
@@ -278,8 +329,8 @@ function openRelayAccountStore(options) {
       record.maxRoutes,
       record.maxDevicesPerRoute,
       record.revision,
-      relayAccountCredentialHash(input.credential),
-      relayAccountCredentialLookup(input.credential),
+      credentialHash,
+      credentialLookup,
       record.createdAt,
       record.updatedAt
     );
@@ -299,15 +350,10 @@ function openRelayAccountStore(options) {
       ).all();
       return rows.map(fromRow);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
-      try {
-        credentialLookup = relayAccountCredentialLookup(credential);
-      } catch {
-        return void 0;
-      }
-      const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status = 'active'").get(credentialLookup);
-      return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const safeAccountId = safeId(id);
@@ -366,16 +412,11 @@ function openRelayAccountStore(options) {
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
       const result = db.prepare(
         `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
            updated_at = ? WHERE id = ? AND revision = ?`
-      ).run(
-        relayAccountCredentialHash(credential),
-        relayAccountCredentialLookup(credential),
-        now,
-        safeAccountId,
-        expectedRevision
-      );
+      ).run(credentialHash, credentialLookup, now, safeAccountId, expectedRevision);
       if (result.changes !== 1) {
         const latest = rowById(safeAccountId);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
@@ -391,6 +432,7 @@ function openRelayAccountStore(options) {
 import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { createRequire as createRequire2 } from "module";
 var require3 = createRequire2(import.meta.url);
+var UNSAFE_DISPLAY_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId2(value, field) {
   if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
   return value;
@@ -404,7 +446,7 @@ function safeOwnerAccountId(value) {
 function safeLabel2(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(normalized)) {
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT.test(normalized)) {
     throw new Error("invalid relay route label");
   }
   return normalized;
@@ -446,22 +488,72 @@ function cloneRoute(route) {
   return { ...route };
 }
 function cloneDevice(device) {
-  return { ...device };
+  return {
+    routeId: device.routeId,
+    deviceId: device.deviceId,
+    credentialHash: device.credentialHash,
+    createdAt: device.createdAt,
+    updatedAt: device.updatedAt,
+    ...device.expiresAt === void 0 ? {} : { expiresAt: device.expiresAt }
+  };
+}
+function credentialOverlap(current, credentialHash, expiresAt, now) {
+  if (!current || expiresAt !== void 0) return {};
+  if (current.expiresAt !== void 0) {
+    if (current.credentialHash === credentialHash) {
+      throw new Error("relay bootstrap promotion must rotate the device credential");
+    }
+    return {
+      previousCredentialHash: current.credentialHash,
+      previousCredentialExpiresAt: current.expiresAt
+    };
+  }
+  if (current.previousCredentialHash !== void 0 && current.previousCredentialExpiresAt !== void 0 && current.previousCredentialExpiresAt >= now) {
+    if (current.previousCredentialHash === credentialHash) {
+      throw new Error("relay bootstrap credential cannot become durable");
+    }
+    return {
+      previousCredentialHash: current.previousCredentialHash,
+      previousCredentialExpiresAt: current.previousCredentialExpiresAt
+    };
+  }
+  return {};
 }
 function createMemoryStore2(options) {
   const routes = /* @__PURE__ */ new Map();
   const devices = /* @__PURE__ */ new Map();
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
   const deviceKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
-  const listRoutes = (now, ownerAccountId) => [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
-    id: route.id,
-    label: route.label,
-    deviceCount: [...devices.values()].filter(
-      (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
-    ).length,
-    createdAt: route.createdAt,
-    updatedAt: route.updatedAt
-  }));
+  const pruneExpiredDevices = (now) => {
+    for (const [key, device] of devices) {
+      if (device.expiresAt !== void 0 && device.expiresAt < now) devices.delete(key);
+      else if (device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt < now) {
+        delete device.previousCredentialHash;
+        delete device.previousCredentialExpiresAt;
+      }
+    }
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const key = deviceKey(routeId, deviceId);
+    const device = devices.get(key);
+    if (device?.expiresAt !== void 0 && device.expiresAt < now) {
+      devices.delete(key);
+      return;
+    }
+    return device;
+  };
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
+      id: route.id,
+      label: route.label,
+      deviceCount: [...devices.values()].filter(
+        (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
+      ).length,
+      createdAt: route.createdAt,
+      updatedAt: route.updatedAt
+    }));
+  };
   return {
     mode: "memory",
     createRoute(input, now = Date.now()) {
@@ -487,6 +579,7 @@ function createMemoryStore2(options) {
       return listRoutes(now, safeOwnerAccountId(ownerAccountId));
     },
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const safeRouteId = safeId2(routeId, "route id");
       return [...devices.values()].filter(
         (device) => device.routeId === safeRouteId && (device.expiresAt === void 0 || device.expiresAt >= now)
@@ -510,18 +603,22 @@ function createMemoryStore2(options) {
       return !!route && hashMatches2(route.hostCredentialHash, credential);
     },
     putDevice(input, now = Date.now()) {
+      pruneExpiredDevices(now);
       const routeId = safeId2(input.routeId, "route id");
       if (!routes.has(routeId)) throw new Error("relay route not found");
       const deviceId = safeId2(input.deviceId, "device id");
       const key = deviceKey(routeId, deviceId);
       const current = devices.get(key);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.createdAt ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt },
+        ...credentialOverlap(current, credentialHash, expiresAt, now)
       };
       devices.set(key, device);
       const route = routes.get(routeId);
@@ -529,12 +626,12 @@ function createMemoryStore2(options) {
       return cloneDevice(device);
     },
     getDevice(routeId, deviceId, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId2(routeId, "route id"), safeId2(deviceId, "device id")));
-      return device && (device.expiresAt === void 0 || device.expiresAt >= now) ? cloneDevice(device) : void 0;
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return device ? cloneDevice(device) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId2(routeId, "route id"), safeId2(deviceId, "device id")));
-      return !!device && (device.expiresAt === void 0 || device.expiresAt >= now) && hashMatches2(device.credentialHash, credential);
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!device && (hashMatches2(device.credentialHash, credential) || device.previousCredentialHash !== void 0 && device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt >= now && hashMatches2(device.previousCredentialHash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId2(routeId, "route id");
@@ -596,6 +693,8 @@ function openRelayRouteStore(options) {
       route_id TEXT NOT NULL REFERENCES relay_routes(id) ON DELETE CASCADE,
       device_id TEXT NOT NULL,
       credential_hash TEXT NOT NULL,
+      previous_credential_hash TEXT,
+      previous_credential_expires_at INTEGER,
       created_at INTEGER NOT NULL,
       updated_at INTEGER NOT NULL,
       expires_at INTEGER,
@@ -606,6 +705,12 @@ function openRelayRouteStore(options) {
   if (!relayDeviceColumns.some((column) => column.name === "expires_at")) {
     db.exec("ALTER TABLE relay_route_devices ADD COLUMN expires_at INTEGER");
   }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_hash")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_hash TEXT");
+  }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_expires_at")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_expires_at INTEGER");
+  }
   const relayRouteColumns = db.prepare("PRAGMA table_info(relay_routes)").all();
   if (!relayRouteColumns.some((column) => column.name === "owner_account_id")) {
     db.exec("ALTER TABLE relay_routes ADD COLUMN owner_account_id TEXT");
@@ -614,6 +719,21 @@ function openRelayRouteStore(options) {
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
   const getRoute = (id) => db.prepare("SELECT * FROM relay_routes WHERE id = ?").get(id);
   const getDevice = (routeId, deviceId) => db.prepare("SELECT * FROM relay_route_devices WHERE route_id = ? AND device_id = ?").get(routeId, deviceId);
+  const pruneExpiredDevices = (now) => {
+    db.prepare("DELETE FROM relay_route_devices WHERE expires_at IS NOT NULL AND expires_at < ?").run(now);
+    db.prepare(
+      `UPDATE relay_route_devices SET previous_credential_hash = NULL, previous_credential_expires_at = NULL
+       WHERE previous_credential_expires_at IS NOT NULL AND previous_credential_expires_at < ?`
+    ).run(now);
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const row = getDevice(routeId, deviceId);
+    if (row?.expires_at !== null && row?.expires_at !== void 0 && row.expires_at < now) {
+      db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(routeId, deviceId);
+      return;
+    }
+    return row;
+  };
   const createRoute = db.transaction(
     (input, now) => {
       const id = safeId2(input.id ?? generateRouteId(), "route id");
@@ -644,25 +764,44 @@ function openRelayRouteStore(options) {
     (input, now) => {
       const routeId = safeId2(input.routeId, "route id");
       if (!getRoute(routeId)) throw new Error("relay route not found");
+      pruneExpiredDevices(now);
       const deviceId = safeId2(input.deviceId, "device id");
       const current = getDevice(routeId, deviceId);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
+      const overlap = credentialOverlap(
+        current ? {
+          ...deviceFromRow(current),
+          ...current.previous_credential_hash === null || current.previous_credential_hash === void 0 ? {} : { previousCredentialHash: current.previous_credential_hash },
+          ...current.previous_credential_expires_at === null || current.previous_credential_expires_at === void 0 ? {} : { previousCredentialExpiresAt: current.previous_credential_expires_at }
+        } : void 0,
+        credentialHash,
+        expiresAt,
+        now
+      );
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.created_at ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt }
       };
       db.prepare(
-        `INSERT INTO relay_route_devices (route_id, device_id, credential_hash, created_at, updated_at, expires_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+        `INSERT INTO relay_route_devices
+         (route_id, device_id, credential_hash, previous_credential_hash, previous_credential_expires_at,
+          created_at, updated_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(route_id, device_id) DO UPDATE SET credential_hash = excluded.credential_hash,
+           previous_credential_hash = excluded.previous_credential_hash,
+           previous_credential_expires_at = excluded.previous_credential_expires_at,
            updated_at = excluded.updated_at, expires_at = excluded.expires_at`
       ).run(
         device.routeId,
         device.deviceId,
         device.credentialHash,
+        overlap.previousCredentialHash ?? null,
+        overlap.previousCredentialExpiresAt ?? null,
         device.createdAt,
         device.updatedAt,
         device.expiresAt ?? null
@@ -671,19 +810,22 @@ function openRelayRouteStore(options) {
       return device;
     }
   );
-  const listRoutes = (now, ownerAccountId) => db.prepare(
-    `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return db.prepare(
+      `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
            FROM relay_routes r LEFT JOIN relay_route_devices d ON d.route_id = r.id
              AND (d.expires_at IS NULL OR d.expires_at >= ?)
            ${ownerAccountId === void 0 ? "" : "WHERE r.owner_account_id = ?"}
            GROUP BY r.id ORDER BY r.created_at, r.id`
-  ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
-    id: row.id,
-    label: row.label,
-    deviceCount: row.device_count,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  }));
+    ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
+      id: row.id,
+      label: row.label,
+      deviceCount: row.device_count,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    }));
+  };
   return {
     mode: "sqlite",
     createRoute: (input, now = Date.now()) => cloneRoute(createRoute(input, now)),
@@ -694,6 +836,7 @@ function openRelayRouteStore(options) {
     listRoutes: (now = Date.now()) => listRoutes(now),
     listRoutesByOwner: (ownerAccountId, now = Date.now()) => listRoutes(now, ownerAccountId),
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const row = db.prepare(
         `SELECT COUNT(*) AS count FROM relay_route_devices
            WHERE route_id = ? AND (expires_at IS NULL OR expires_at >= ?)`
@@ -712,12 +855,12 @@ function openRelayRouteStore(options) {
     },
     putDevice: (input, now = Date.now()) => cloneDevice(putDevice(input, now)),
     getDevice(routeId, deviceId, now = Date.now()) {
-      const row = getDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"));
-      return row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) ? deviceFromRow(row) : void 0;
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return row ? deviceFromRow(row) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const row = getDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"));
-      return !!row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) && hashMatches2(row.credential_hash, credential);
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!row && (hashMatches2(row.credential_hash, credential) || row.previous_credential_hash !== null && row.previous_credential_hash !== void 0 && row.previous_credential_expires_at !== null && row.previous_credential_expires_at !== void 0 && row.previous_credential_expires_at >= now && hashMatches2(row.previous_credential_hash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId2(routeId, "route id");
@@ -734,9 +877,11 @@ function openRelayRouteStore(options) {
 var BLIND_RELAY_PROTOCOL_VERSION = 1;
 var BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 15e5;
 var BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4e6;
+var BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
 var BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
 var BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE = 64 * 1024 * 1024;
 var BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12e3;
+var UNSAFE_DISPLAY_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeToken(value, field) {
   if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
     throw new Error(`invalid relay ${field}`);
@@ -756,7 +901,7 @@ function safeId3(value, field) {
 function safeLabel3(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) throw new Error("invalid relay route label");
+  if (!label || label.length > 80 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay route label");
   return label;
 }
 function safeExpiry2(value, now) {
@@ -794,7 +939,9 @@ function publicRoute(route) {
 function normalizeOrigin(value) {
   try {
     const url = new URL(value);
-    if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) return;
+    const loopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      return;
     return url.origin;
   } catch {
     return;
@@ -856,6 +1003,7 @@ function createBlindRelayServer(options) {
   const idleTimeoutMs = options.idleTimeoutMs ?? 2 * 6e4;
   const maxFrameBytes = options.maxFrameBytes ?? BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES;
   const maxQueueBytes = options.maxQueueBytes ?? BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES;
+  const maxTotalConnections = options.maxTotalConnections ?? BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS;
   const maxConnectionsPerRoute = options.maxConnectionsPerRoute ?? BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE;
   const maxBytesPerMinute = options.maxBytesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE;
   const maxMessagesPerMinute = options.maxMessagesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE;
@@ -864,17 +1012,63 @@ function createBlindRelayServer(options) {
     [idleTimeoutMs, 1e4, 60 * 6e4, "idle timeout"],
     [maxFrameBytes, 1024, 16 * 1024 * 1024, "frame limit"],
     [maxQueueBytes, 1024, 64 * 1024 * 1024, "queue limit"],
+    [maxTotalConnections, 1, 1e5, "total connection limit"],
     [maxConnectionsPerRoute, 1, 1e4, "connection limit"],
     [maxBytesPerMinute, 1024, 1024 * 1024 * 1024, "byte rate"],
     [maxMessagesPerMinute, 10, 1e6, "message rate"]
   ]) {
     if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`invalid relay ${label}`);
   }
-  const allowedOrigins = new Set((options.allowedOrigins ?? []).map(normalizeOrigin).filter(Boolean));
+  const maxEnvelopeBytes = Math.max(8 * 1024, Math.ceil(maxFrameBytes * 4 / 3) + 8 * 1024);
+  const configuredOrigins = options.allowedOrigins ?? [];
+  const normalizedOrigins = configuredOrigins.map(normalizeOrigin);
+  if (normalizedOrigins.some((origin) => origin === void 0)) {
+    throw new Error("invalid relay allowed origin");
+  }
+  const allowedOrigins = new Set(normalizedOrigins);
   const generateChannelId = options.generateChannelId ?? (() => `rrc_${randomBytes3(16).toString("base64url")}`);
   const hosts = /* @__PURE__ */ new Map();
   const devicesByChannel = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const hostRates = /* @__PURE__ */ new Map();
+  const deviceRates = /* @__PURE__ */ new Map();
+  const maxRateIdentities = Math.min(1e5, Math.max(256, maxTotalConnections * 4));
+  const deviceRateKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
+  const clearRouteRates = (routeId) => {
+    hostRates.delete(routeId);
+    for (const key of deviceRates.keys()) if (key.startsWith(`${routeId}\0`)) deviceRates.delete(key);
+  };
+  const rateWindowFor = (windows, key) => {
+    const current = now();
+    if (windows.size >= maxRateIdentities) {
+      for (const [candidate, window] of windows) {
+        if (current - window.lastSeenAt >= 12e4) windows.delete(candidate);
+      }
+    }
+    const existing = windows.get(key);
+    if (existing) {
+      existing.lastSeenAt = current;
+      return existing;
+    }
+    if (windows.size >= maxRateIdentities) return;
+    const created = { startedAt: current, lastSeenAt: current, bytes: 0, messages: 0 };
+    windows.set(key, created);
+    return created;
+  };
+  const consumeRate = (window, bytes) => {
+    const current = now();
+    if (current - window.startedAt >= 6e4) {
+      window.startedAt = current;
+      window.bytes = 0;
+      window.messages = 0;
+    }
+    window.lastSeenAt = current;
+    window.bytes += bytes;
+    window.messages += 1;
+    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
+  };
   const metrics = {
+    activeConnections: 0,
     activeHosts: 0,
     activeDevices: 0,
     acceptedConnections: 0,
@@ -911,6 +1105,14 @@ function createBlindRelayServer(options) {
     }
     reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
   };
+  const requireRecoverableAccount = async (request, reply) => {
+    const account = accountStore?.verifyCredential(bearer(request) ?? "");
+    if (account) {
+      authenticatedAccounts.set(request, account);
+      return;
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
   app.addHook("onSend", async (_request, reply, payload) => {
     reply.header("cache-control", "no-store");
     reply.header("content-security-policy", "default-src 'none'");
@@ -930,7 +1132,12 @@ function createBlindRelayServer(options) {
   });
   app.get("/v1/metrics", { preHandler: requireRoot }, async () => ({
     protocolVersion: BLIND_RELAY_PROTOCOL_VERSION,
-    metrics: { ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size }
+    metrics: {
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    }
   }));
   app.get("/v1/routes", { preHandler: requireRoot }, async () => ({ routes: store.listRoutes().map(publicRoute) }));
   app.post(
@@ -976,6 +1183,7 @@ function createBlindRelayServer(options) {
         reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
         return;
       }
+      clearRouteRates(request.params.routeId);
       const host = hosts.get(request.params.routeId);
       host?.socket.close(4403, "route deleted");
       for (const device of host?.devices.values() ?? []) device.socket.close(4403, "route deleted");
@@ -1032,22 +1240,12 @@ function createBlindRelayServer(options) {
         reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
         return;
       }
+      deviceRates.delete(deviceRateKey(request.params.routeId, request.params.deviceId));
       const live = hosts.get(request.params.routeId)?.devices.get(request.params.deviceId);
       live?.socket.close(4403, "device revoked");
       reply.code(204).send();
     }
   );
-  const consumeRate = (window, bytes) => {
-    const current = now();
-    if (current - window.startedAt >= 6e4) {
-      window.startedAt = current;
-      window.bytes = 0;
-      window.messages = 0;
-    }
-    window.bytes += bytes;
-    window.messages += 1;
-    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
-  };
   const closeDevice = (device, code = 1e3, reason = "device disconnected") => {
     if (device.closed) return;
     device.closed = true;
@@ -1056,7 +1254,10 @@ function createBlindRelayServer(options) {
     const host = hosts.get(device.routeId);
     if (host?.devices.get(device.deviceId) === device) host.devices.delete(device.deviceId);
     metrics.activeDevices = Math.max(0, metrics.activeDevices - 1);
-    if (host) safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes);
+    if (host && !safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes)) {
+      metrics.droppedFrames += 1;
+      closeHost(host, 4408, "relay backpressure");
+    }
     if (device.socket.readyState === device.socket.OPEN) device.socket.close(code, reason);
   };
   const touchDevice = (device) => {
@@ -1084,11 +1285,24 @@ function createBlindRelayServer(options) {
       usage: { routes: store.listRoutesByOwner(account.id, now()).length, maxRoutes: account.maxRoutes }
     });
     const closeAccountRoutes = (accountId, reason) => {
+      for (const host of [...hosts.values()]) if (host.ownerAccountId === accountId) closeHost(host, 4403, reason);
+    };
+    const purgeAccountRoutes = (accountId) => {
+      closeAccountRoutes(accountId, "account deleted");
       for (const route of store.listRoutesByOwner(accountId, now())) {
-        const host = hosts.get(route.id);
-        if (host) closeHost(host, 4403, reason);
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
       }
     };
+    for (const listedRoute of store.listRoutes(now())) {
+      const route = store.getRoute(listedRoute.id);
+      if (!route?.ownerAccountId) continue;
+      const owner = accountStore.getAccount(route.ownerAccountId);
+      if (!owner || owner.status === "deleted") {
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
+      }
+    }
     const ownedRoute = (accountId, routeId) => {
       const route = store.getRoute(routeId);
       return route?.ownerAccountId === accountId ? route : void 0;
@@ -1096,18 +1310,47 @@ function createBlindRelayServer(options) {
     app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
       accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
     }));
-    app.post("/v1/accounts", { preHandler: requireRoot }, async (request, reply) => {
-      const accountCredential = generateRelayAccountCredential();
+    const createAccountHandler = (clientHashedOnly) => async (request, reply) => {
       try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
         const account = accountStore.createAccount({
-          ...request.body,
-          credential: accountCredential
+          label: request.body?.label,
+          ...request.body?.plan === void 0 ? {} : { plan: request.body.plan },
+          ...request.body?.maxRoutes === void 0 ? {} : { maxRoutes: request.body.maxRoutes },
+          ...request.body?.maxDevicesPerRoute === void 0 ? {} : { maxDevicesPerRoute: request.body.maxDevicesPerRoute },
+          ...typeof credential === "string" ? { credential } : {
+            credentialHash: credential.credentialHash,
+            credentialLookup: credential.credentialLookup
+          }
+        });
+        reply.code(201).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
         });
-        reply.code(201).send({ ...accountEnvelope(account), accountCredential });
       } catch {
         reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
       }
-    });
+    };
+    app.post(
+      "/v1/accounts",
+      { preHandler: requireRoot },
+      createAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/client-hashed",
+      { preHandler: requireRoot },
+      createAccountHandler(true)
+    );
     app.patch(
       "/v1/accounts/:accountId",
       { preHandler: requireRoot },
@@ -1122,7 +1365,8 @@ function createBlindRelayServer(options) {
             reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
             return;
           }
-          if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
+          if (account.status === "deleted") purgeAccountRoutes(account.id);
+          else if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
           reply.code(200).send(accountEnvelope(account));
         } catch (error) {
           if (error instanceof RelayAccountRevisionConflictError) {
@@ -1137,34 +1381,58 @@ function createBlindRelayServer(options) {
         }
       }
     );
+    const rotateAccountHandler = (clientHashedOnly) => async (request, reply) => {
+      try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
+        const account = accountStore.rotateCredential(
+          request.params.accountId,
+          credential,
+          safeRevision(request.body?.expectedRevision)
+        );
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
+        });
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          reply.code(409).send({
+            code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+            error: "relay account revision conflict",
+            current: accountEnvelope(error.current)
+          });
+          return;
+        }
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+      }
+    };
     app.post(
       "/v1/accounts/:accountId/credential",
       { preHandler: requireRoot },
-      async (request, reply) => {
-        const accountCredential = generateRelayAccountCredential();
-        try {
-          const account = accountStore.rotateCredential(
-            request.params.accountId,
-            accountCredential,
-            safeRevision(request.body?.expectedRevision)
-          );
-          if (!account) {
-            reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-            return;
-          }
-          reply.code(200).send({ ...accountEnvelope(account), accountCredential });
-        } catch (error) {
-          if (error instanceof RelayAccountRevisionConflictError) {
-            reply.code(409).send({
-              code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-              error: "relay account revision conflict",
-              current: accountEnvelope(error.current)
-            });
-            return;
-          }
-          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        }
-      }
+      rotateAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/:accountId/credential/client-hashed",
+      { preHandler: requireRoot },
+      rotateAccountHandler(true)
+    );
+    app.get(
+      "/v1/account/recovery",
+      { preHandler: requireRecoverableAccount },
+      async (request) => accountEnvelope(authenticatedAccounts.get(request))
     );
     app.get(
       "/v1/account",
@@ -1242,6 +1510,7 @@ function createBlindRelayServer(options) {
           reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
           return;
         }
+        clearRouteRates(request.params.routeId);
         const host = hosts.get(request.params.routeId);
         if (host) closeHost(host, 4403, "route deleted");
         reply.code(204).send();
@@ -1278,9 +1547,15 @@ function createBlindRelayServer(options) {
       }
     );
   }
-  app.register(websocket);
+  app.register(websocket, { options: { maxPayload: maxEnvelopeBytes, perMessageDeflate: false } });
   app.register(async (scope) => {
     scope.get("/v1/connect", { websocket: true }, (socket, request) => {
+      if (sockets.size >= maxTotalConnections) {
+        metrics.rejectedConnections += 1;
+        socket.close(4429, "relay connection limit");
+        return;
+      }
+      sockets.add(socket);
       let authenticated = false;
       let liveHost;
       let liveDevice;
@@ -1299,29 +1574,41 @@ function createBlindRelayServer(options) {
         if (!authenticated) {
           try {
             const hello = parseAuthHello(parseJson(raw, 8 * 1024));
-            const origin = typeof request.headers.origin === "string" ? normalizeOrigin(request.headers.origin) : void 0;
-            if (hello.role === "device" && origin && allowedOrigins.size > 0 && !allowedOrigins.has(origin)) {
+            const presentedOrigin = request.headers.origin;
+            const origin = typeof presentedOrigin === "string" ? normalizeOrigin(presentedOrigin) : void 0;
+            if (hello.role === "device" && allowedOrigins.size > 0 && presentedOrigin !== void 0 && (!origin || !allowedOrigins.has(origin))) {
               reject(4403, "origin denied");
               return;
             }
             if (hello.role === "host") {
-              if (!routeAccountIsActive(hello.routeId) || !store.authenticateHost(hello.routeId, hello.credential)) {
+              const route = store.getRoute(hello.routeId);
+              if (!route || route.ownerAccountId !== void 0 && accountStore?.getAccount(route.ownerAccountId)?.status !== "active" || !store.authenticateHost(hello.routeId, hello.credential)) {
                 reject(4401, "authentication failed");
                 return;
               }
+              const rate = rateWindowFor(hostRates, hello.routeId);
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = hosts.get(hello.routeId);
               if (previous) closeHost(previous, 4409, "superseded host");
               liveHost = {
                 socket,
                 routeId: hello.routeId,
+                ...route.ownerAccountId === void 0 ? {} : { ownerAccountId: route.ownerAccountId },
                 devices: /* @__PURE__ */ new Map(),
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               hosts.set(hello.routeId, liveHost);
               metrics.activeHosts += 1;
               touchHost(liveHost);
-              safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+                return;
+              }
             } else {
               if (!routeAccountIsActive(hello.routeId) || !store.authenticateDevice(hello.routeId, hello.deviceId, hello.credential, now())) {
                 reject(4401, "authentication failed");
@@ -1336,6 +1623,11 @@ function createBlindRelayServer(options) {
                 reject(4429, "route connection limit");
                 return;
               }
+              const rate = rateWindowFor(deviceRates, deviceRateKey(hello.routeId, hello.deviceId));
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = host.devices.get(hello.deviceId);
               if (previous) closeDevice(previous, 4409, "superseded device");
               const channelId = safeId3(generateChannelId(), "channel id");
@@ -1344,15 +1636,20 @@ function createBlindRelayServer(options) {
                 routeId: hello.routeId,
                 deviceId: hello.deviceId,
                 channelId,
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               host.devices.set(hello.deviceId, liveDevice);
               devicesByChannel.set(channelId, liveDevice);
               metrics.activeDevices += 1;
               touchDevice(liveDevice);
-              safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+                return;
+              }
               if (!safeSend(host.socket, { t: "peer-open", channelId, deviceId: hello.deviceId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
                 closeDevice(liveDevice, 4408, "host backpressure");
                 return;
               }
@@ -1366,11 +1663,18 @@ function createBlindRelayServer(options) {
           return;
         }
         try {
-          const value = parseJson(raw, maxFrameBytes * 2);
+          const value = parseJson(raw, maxEnvelopeBytes);
           if (liveDevice) {
             touchDevice(liveDevice);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveDevice.rate, 1)) {
+                closeDevice(liveDevice, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+              }
               return;
             }
             const frame = parsePayload(value, false, maxFrameBytes);
@@ -1395,7 +1699,14 @@ function createBlindRelayServer(options) {
           if (liveHost) {
             touchHost(liveHost);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveHost.rate, 1)) {
+                closeHost(liveHost, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+              }
               return;
             }
             if (value?.t === "close-peer") {
@@ -1433,6 +1744,7 @@ function createBlindRelayServer(options) {
         }
       });
       socket.once("close", () => {
+        sockets.delete(socket);
         clearTimeout(handshakeTimer);
         if (liveDevice) closeDevice(liveDevice);
         if (liveHost) closeHost(liveHost);
@@ -1443,20 +1755,45 @@ function createBlindRelayServer(options) {
   });
   app.addHook("onClose", async () => {
     for (const host of [...hosts.values()]) closeHost(host, 1001, "relay shutting down");
+    for (const socket of [...sockets]) socket.close(1001, "relay shutting down");
+    hostRates.clear();
+    deviceRates.clear();
     if (ownsStore) store.close();
   });
   return {
     app,
     store,
     ...accountStore ? { accountStore } : {},
-    metrics: () => ({ ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size })
+    metrics: () => ({
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    })
   };
 }
 
 // src/data-dir.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
 import { randomBytes as randomBytes4 } from "crypto";
-import { join } from "path";
+import { dirname, join } from "path";
+var MAX_ACCESS_TOKEN_BYTES = 4 * 1024;
+var MAX_ACCESS_TOKEN_FILE_BYTES = MAX_ACCESS_TOKEN_BYTES + 2;
 function resolveDataDir(env, exists = existsSync) {
   if (env.ROAMCODE_DATA_DIR) return env.ROAMCODE_DATA_DIR;
   if (env.REMOTE_CODER_DATA_DIR) return env.REMOTE_CODER_DATA_DIR;
@@ -1483,8 +1820,51 @@ function relayDataDir(env) {
 function relayOrigins(env) {
   return (env.ROAMCODE_RELAY_ALLOWED_ORIGINS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
 }
+function privateSecretFile(path, field) {
+  let descriptor;
+  try {
+    const before = lstatSync2(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > 4096 || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret file");
+    }
+    descriptor = openSync2(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    const opened = fstatSync2(descriptor);
+    if (!opened.isFile() || opened.size > 4096 || (opened.mode & 63) !== 0 || typeof process.getuid === "function" && opened.uid !== process.getuid() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("unsafe secret file");
+    }
+    return readFileSync2(descriptor, "utf8").trim();
+  } catch {
+    throw new Error(`${field} could not be read securely`);
+  } finally {
+    if (descriptor !== void 0) closeSync2(descriptor);
+  }
+}
 function previousRootTokens(env) {
-  return (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const inline = (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const directory = env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR?.trim();
+  if (inline.length > 0 && directory) {
+    throw new Error(
+      "ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS and ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR are mutually exclusive"
+    );
+  }
+  if (!directory) return inline;
+  let before;
+  let entries;
+  try {
+    before = lstatSync2(directory);
+    if (!before.isDirectory() || before.isSymbolicLink() || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret directory");
+    }
+    entries = readdirSync(directory, { withFileTypes: true });
+    const after = lstatSync2(directory);
+    if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 63) !== 0 || typeof process.getuid === "function" && after.uid !== process.getuid() || entries.some((entry) => !entry.isFile())) {
+      throw new Error("unsafe secret directory");
+    }
+  } catch {
+    throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR could not be read securely");
+  }
+  if (entries.length > 3) throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR may contain at most three files");
+  return entries.map((entry) => entry.name).sort().map((name) => privateSecretFile(join2(directory, name), "previous relay root capability"));
 }
 function explicitBoolean(value, field) {
   if (value === void 0 || value === "" || value === "0" || value === "false") return false;
@@ -1497,18 +1877,12 @@ function secretValue(env, directKey, fileKey) {
   if (direct && file) throw new Error(`${directKey} and ${fileKey} are mutually exclusive`);
   if (direct) return direct;
   if (!file) return void 0;
-  let contents;
-  try {
-    contents = readFileSync2(file, "utf8");
-  } catch {
-    throw new Error(`${fileKey} could not be read`);
-  }
-  if (Buffer.byteLength(contents) > 4096) throw new Error(`${fileKey} is too large`);
-  return contents.trim();
+  return privateSecretFile(file, fileKey);
 }
 async function startBlindRelay(env = process.env) {
   const rootToken = secretValue(env, "ROAMCODE_RELAY_ROOT_TOKEN", "ROAMCODE_RELAY_ROOT_TOKEN_FILE");
   if (!rootToken) throw new Error("ROAMCODE_RELAY_ROOT_TOKEN or ROAMCODE_RELAY_ROOT_TOKEN_FILE is required");
+  const previousRoots = previousRootTokens(env);
   const allowedOrigins = relayOrigins(env);
   const allowAnyOrigin = explicitBoolean(env.ROAMCODE_RELAY_ALLOW_ANY_ORIGIN, "relay allow-any-origin flag");
   if (env.NODE_ENV === "production" && allowedOrigins.length === 0 && !allowAnyOrigin) {
@@ -1537,7 +1911,7 @@ async function startBlindRelay(env = process.env) {
   try {
     relay = createBlindRelayServer({
       rootToken,
-      previousRootTokens: previousRootTokens(env),
+      previousRootTokens: previousRoots,
       store,
       ...accountStore ? { accountStore } : {},
       allowedOrigins,
@@ -1569,6 +1943,13 @@ async function startBlindRelay(env = process.env) {
         64 * 1024 * 1024,
         "relay queue limit"
       ),
+      maxTotalConnections: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_TOTAL_CONNECTIONS,
+        1024,
+        1,
+        1e5,
+        "relay total connection limit"
+      ),
       maxConnectionsPerRoute: boundedInteger(
         env.ROAMCODE_RELAY_MAX_CONNECTIONS_PER_ROUTE,
         64,