@roamcode.ai/server 1.1.0 → 1.2.0

package/dist/index.js

@@ -49,9 +49,27 @@ function hookAuthFileContent(token) {
 }
 
 // src/data-dir.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
 import { randomBytes } from "crypto";
-import { join as join2 } from "path";
+import { dirname, join as join2 } from "path";
+var ACCESS_TOKEN_FILE = "token";
+var MAX_ACCESS_TOKEN_BYTES = 4 * 1024;
+var MAX_ACCESS_TOKEN_FILE_BYTES = MAX_ACCESS_TOKEN_BYTES + 2;
 function resolveDataDir(env, exists = existsSync) {
   if (env.ROAMCODE_DATA_DIR) return env.ROAMCODE_DATA_DIR;
   if (env.REMOTE_CODER_DATA_DIR) return env.REMOTE_CODER_DATA_DIR;
@@ -67,23 +85,164 @@ function ensureDataDir(dir) {
 function generateAccessToken() {
   return randomBytes(32).toString("base64url");
 }
+function fsyncDirectory(path) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY);
+    fsyncSync(descriptor);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && !(process.platform === "win32" && code === "EPERM")) {
+      throw error;
+    }
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function existingTokenStat(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+function validateAccessToken(token) {
+  if (!token || Buffer.byteLength(token, "utf8") > MAX_ACCESS_TOKEN_BYTES || /[\u0000-\u0020\u007f]/u.test(token)) {
+    throw new Error("access token must be non-empty printable text without whitespace");
+  }
+  return token;
+}
+function decodePersistedAccessToken(content) {
+  let token = content;
+  if (token.endsWith("\n")) token = token.slice(0, -1);
+  if (token.endsWith("\r")) token = token.slice(0, -1);
+  return validateAccessToken(token);
+}
+function readPersistedAccessToken(path) {
+  const before = existingTokenStat(path);
+  if (!before) return void 0;
+  if (!before.isFile() || before.isSymbolicLink()) throw new Error("access token path must be a regular file");
+  if (before.size > MAX_ACCESS_TOKEN_FILE_BYTES) throw new Error("access token file is too large");
+  if (typeof process.getuid === "function" && before.uid !== process.getuid()) {
+    throw new Error("access token file must be owned by the current user");
+  }
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const opened = fstatSync(descriptor);
+    if (!opened.isFile() || opened.size > MAX_ACCESS_TOKEN_FILE_BYTES || opened.dev !== before.dev || opened.ino !== before.ino || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
+      throw new Error("access token changed while it was being opened");
+    }
+    fchmodSync(descriptor, 384);
+    return decodePersistedAccessToken(readFileSync(descriptor, "utf8"));
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("access token ")) throw error;
+    throw new Error("access token file could not be read safely");
+  } finally {
+    if (descriptor !== void 0) closeSync(descriptor);
+  }
+}
+function stageAccessToken(path, token) {
+  const temporary = `${path}.${randomBytes(12).toString("hex")}.tmp`;
+  let descriptor;
+  let failed = false;
+  let failure;
+  try {
+    descriptor = openSync(
+      temporary,
+      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0),
+      384
+    );
+    fchmodSync(descriptor, 384);
+    writeFileSync(descriptor, `${validateAccessToken(token)}
+`, "utf8");
+    fsyncSync(descriptor);
+  } catch (error) {
+    failed = true;
+    failure = error;
+  }
+  if (descriptor !== void 0) {
+    try {
+      closeSync(descriptor);
+    } catch (error) {
+      if (!failed) {
+        failed = true;
+        failure = error;
+      }
+    }
+    descriptor = void 0;
+  }
+  if (failed) {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+    throw failure;
+  }
+  return temporary;
+}
 function persistAccessToken(dataDir, token) {
   ensureDataDir(dataDir);
-  const tokenPath = join2(dataDir, "token");
-  writeFileSync(tokenPath, token + "\n", { mode: 384 });
-  chmodSync(tokenPath, 384);
+  const tokenPath = join2(dataDir, ACCESS_TOKEN_FILE);
+  const existing = existingTokenStat(tokenPath);
+  if (existing) {
+    if (!existing.isFile() || existing.isSymbolicLink()) throw new Error("access token path must be a regular file");
+    if (typeof process.getuid === "function" && existing.uid !== process.getuid()) {
+      throw new Error("access token file must be owned by the current user");
+    }
+  }
+  const temporary = stageAccessToken(tokenPath, token);
+  try {
+    renameSync(temporary, tokenPath);
+    try {
+      fsyncDirectory(dirname(tokenPath));
+    } catch (error) {
+      let visible;
+      try {
+        visible = readPersistedAccessToken(tokenPath);
+      } catch {
+      }
+      if (visible !== token) throw error;
+    }
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+  }
+}
+function installAccessTokenIfMissing(dataDir, token) {
+  ensureDataDir(dataDir);
+  const tokenPath = join2(dataDir, ACCESS_TOKEN_FILE);
+  const temporary = stageAccessToken(tokenPath, token);
+  let installed = false;
+  try {
+    try {
+      linkSync(temporary, tokenPath);
+      installed = true;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+  }
+  if (installed) fsyncDirectory(dirname(tokenPath));
+  return installed;
 }
 function resolveAccessToken(opts) {
   if (opts.configured) return { token: opts.configured, generated: false };
-  const tokenPath = join2(opts.dataDir, "token");
-  try {
-    const existing = readFileSync(tokenPath, "utf8").trim();
-    if (existing) return { token: existing, generated: false };
-  } catch {
-  }
-  const token = (opts.generate ?? generateAccessToken)();
-  persistAccessToken(opts.dataDir, token);
-  return { token, generated: true };
+  const tokenPath = join2(opts.dataDir, ACCESS_TOKEN_FILE);
+  const existing = readPersistedAccessToken(tokenPath);
+  if (existing) return { token: existing, generated: false };
+  const token = validateAccessToken((opts.generate ?? generateAccessToken)());
+  if (installAccessTokenIfMissing(opts.dataDir, token)) return { token, generated: true };
+  const winner = readPersistedAccessToken(tokenPath);
+  if (!winner) throw new Error("access token initialization raced with removal; retry startup");
+  return { token: winner, generated: false };
 }
 
 // src/origin-check.ts
@@ -309,7 +468,7 @@ var AuthGate = class {
 // src/fs-service.ts
 import { createWriteStream } from "fs";
 import { readdir, readFile, stat, realpath, open, mkdir, unlink, rename, rmdir } from "fs/promises";
-import { constants } from "fs";
+import { constants as constants2 } from "fs";
 import { resolve, join as join3, sep, basename } from "path";
 import { randomUUID } from "crypto";
 import { pipeline } from "stream/promises";
@@ -430,7 +589,7 @@ var FsService = class {
     const dir = this.resolveWithinRoot(targetDir);
     await this.realWithinRoot(dir);
     const dest = this.resolveWithinRoot(join3(dir, filename));
-    const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
+    const flags = constants2.O_WRONLY | constants2.O_CREAT | constants2.O_TRUNC | constants2.O_NOFOLLOW;
     let fh;
     try {
       fh = await open(dest, flags, 384);
@@ -2669,6 +2828,7 @@ function establishRelayChannel(options) {
 var require3 = createRequire2(import.meta.url);
 var PAIRING_TTL_MS = 5 * 60 * 1e3;
 var LAST_SEEN_WRITE_INTERVAL_MS = 60 * 1e3;
+var UNSAFE_DISPLAY_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 var DevicePairingError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -2724,7 +2884,7 @@ function randomCredential(prefix) {
 function normalizeDeviceName(value) {
   if (typeof value !== "string") return void 0;
   const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(normalized)) return void 0;
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT.test(normalized)) return void 0;
   return normalized;
 }
 function inMemoryStore2(opts) {
@@ -2755,6 +2915,7 @@ function inMemoryStore2(opts) {
       }
       throw new Error("could not allocate a unique pairing credential");
     },
+    cancelPairing: (secret) => pairings.delete(digest(secret)),
     claimPairing(secret, rawName, now = Date.now(), relayIdentityPublicKey) {
       const name = normalizeDeviceName(rawName);
       if (!name) return void 0;
@@ -2804,13 +2965,46 @@ function inMemoryStore2(opts) {
       prune(now);
       return [...pairings.values()].some((pairing) => pairing.deviceId === deviceId && pairing.expiresAt >= now);
     },
+    beginRelayPairingCancellation(deviceId, now = Date.now()) {
+      prune(now);
+      const pairing = [...pairings.values()].find((candidate) => candidate.deviceId === deviceId);
+      if (!pairing || pairing.expiresAt < now) return { status: "missing" };
+      if (pairing.cancellationId) return { status: "busy" };
+      const reservation = { deviceId, reservationId: randomUUID2() };
+      pairing.cancellationId = reservation.reservationId;
+      return { status: "reserved", reservation };
+    },
+    releaseRelayPairingCancellation(reservation) {
+      const pairing = [...pairings.values()].find((candidate) => candidate.deviceId === reservation.deviceId);
+      if (pairing?.cancellationId !== reservation.reservationId) return false;
+      delete pairing.cancellationId;
+      return true;
+    },
+    finishRelayPairingCancellation(reservation) {
+      for (const [secretHash, pairing] of pairings) {
+        if (pairing.deviceId === reservation.deviceId && pairing.cancellationId === reservation.reservationId) {
+          pairings.delete(secretHash);
+          return true;
+        }
+      }
+      return false;
+    },
+    cancelRelayPairing(deviceId) {
+      for (const [secretHash, pairing] of pairings) {
+        if (pairing.deviceId === deviceId) {
+          pairings.delete(secretHash);
+          return true;
+        }
+      }
+      return false;
+    },
     claimRelayPairing(secret, token, rawName, relayIdentityPublicKey, now = Date.now()) {
       const name = normalizeDeviceName(rawName);
       if (!name || !/^rcd_[A-Za-z0-9_-]{43}$/.test(token)) return void 0;
       prune(now);
       const secretHash = digest(secret);
       const pairing = pairings.get(secretHash);
-      if (!pairing?.deviceId || !pairing.tokenHash || pairing.expiresAt < now || pairing.tokenHash !== digest(token))
+      if (!pairing?.deviceId || !pairing.tokenHash || pairing.cancellationId || pairing.expiresAt < now || pairing.tokenHash !== digest(token))
         return void 0;
       const relayIdentity = relayIdentityForClaim(pairing.scopes, relayIdentityPublicKey);
       pairings.delete(secretHash);
@@ -2894,7 +3088,8 @@ function openDeviceStore(opts) {
       expires_at INTEGER NOT NULL,
       scopes_json TEXT NOT NULL DEFAULT '["direct"]',
       device_id TEXT,
-      token_hash TEXT
+      token_hash TEXT,
+      cancellation_id TEXT
     );
     CREATE INDEX IF NOT EXISTS devices_last_seen_idx ON devices(last_seen_at DESC);
     CREATE INDEX IF NOT EXISTS pairing_expiry_idx ON pairing_sessions(expires_at);
@@ -2919,6 +3114,9 @@ function openDeviceStore(opts) {
   if (!pairingColumns.some((column) => column.name === "token_hash")) {
     db.exec("ALTER TABLE pairing_sessions ADD COLUMN token_hash TEXT");
   }
+  if (!pairingColumns.some((column) => column.name === "cancellation_id")) {
+    db.exec("ALTER TABLE pairing_sessions ADD COLUMN cancellation_id TEXT");
+  }
   db.exec(`
     CREATE UNIQUE INDEX IF NOT EXISTS pairing_device_id_idx ON pairing_sessions(device_id) WHERE device_id IS NOT NULL;
     CREATE UNIQUE INDEX IF NOT EXISTS pairing_token_hash_idx ON pairing_sessions(token_hash) WHERE token_hash IS NOT NULL;
@@ -2933,12 +3131,26 @@ function openDeviceStore(opts) {
     "INSERT INTO pairing_sessions (secret_hash, created_at, expires_at, scopes_json, device_id, token_hash) VALUES (?, ?, ?, ?, ?, ?)"
   );
   const prunePairings = db.prepare("DELETE FROM pairing_sessions WHERE expires_at < ?");
+  const cancelPairing = db.prepare("DELETE FROM pairing_sessions WHERE secret_hash = ?");
   const findPairing = db.prepare(
-    "SELECT secret_hash, expires_at, scopes_json, device_id, token_hash FROM pairing_sessions WHERE secret_hash = ?"
+    "SELECT secret_hash, expires_at, scopes_json, device_id, token_hash, cancellation_id FROM pairing_sessions WHERE secret_hash = ?"
   );
   const findPendingRelayPairing = db.prepare(
     "SELECT 1 FROM pairing_sessions WHERE device_id = ? AND expires_at >= ? LIMIT 1"
   );
+  const cancelRelayPairing = db.prepare("DELETE FROM pairing_sessions WHERE device_id = ?");
+  const findRelayPairingByDevice = db.prepare(
+    "SELECT secret_hash, expires_at, scopes_json, device_id, token_hash, cancellation_id FROM pairing_sessions WHERE device_id = ?"
+  );
+  const reserveRelayPairingCancellation = db.prepare(
+    "UPDATE pairing_sessions SET cancellation_id = ? WHERE device_id = ? AND cancellation_id IS NULL"
+  );
+  const releaseRelayPairingCancellation = db.prepare(
+    "UPDATE pairing_sessions SET cancellation_id = NULL WHERE device_id = ? AND cancellation_id = ?"
+  );
+  const finishRelayPairingCancellation = db.prepare(
+    "DELETE FROM pairing_sessions WHERE device_id = ? AND cancellation_id = ?"
+  );
   const deletePairing = db.prepare("DELETE FROM pairing_sessions WHERE secret_hash = ?");
   const insertDevice = db.prepare(
     "INSERT INTO devices (id, name, token_hash, created_at, last_seen_at, scopes_json, relay_public_key, relay_fingerprint) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
@@ -2985,7 +3197,7 @@ function openDeviceStore(opts) {
     (secretHash, token, name, now, relayIdentityPublicKey) => {
       prunePairings.run(now);
       const pairing = findPairing.get(secretHash);
-      if (!pairing?.device_id || !pairing.token_hash || pairing.expires_at < now || pairing.token_hash !== digest(token))
+      if (!pairing?.device_id || !pairing.token_hash || pairing.cancellation_id || pairing.expires_at < now || pairing.token_hash !== digest(token))
         return void 0;
       const scopes = scopesFromJson(pairing.scopes_json);
       const relayIdentity = relayIdentityForClaim(scopes, relayIdentityPublicKey);
@@ -3032,6 +3244,7 @@ function openDeviceStore(opts) {
       }
       throw new Error("could not allocate a unique pairing credential");
     },
+    cancelPairing: (secret) => cancelPairing.run(digest(secret)).changes > 0,
     claimPairing(secret, rawName, now = Date.now(), relayIdentityPublicKey) {
       const name = normalizeDeviceName(rawName);
       if (!name) return void 0;
@@ -3065,6 +3278,20 @@ function openDeviceStore(opts) {
       prunePairings.run(now);
       return findPendingRelayPairing.get(deviceId, now) !== void 0;
     },
+    beginRelayPairingCancellation(deviceId, now = Date.now()) {
+      prunePairings.run(now);
+      const pairing = findRelayPairingByDevice.get(deviceId);
+      if (!pairing || pairing.expires_at < now) return { status: "missing" };
+      if (pairing.cancellation_id) return { status: "busy" };
+      const reservation = { deviceId, reservationId: randomUUID2() };
+      if (reserveRelayPairingCancellation.run(reservation.reservationId, deviceId).changes !== 1) {
+        return findRelayPairingByDevice.get(deviceId) ? { status: "busy" } : { status: "missing" };
+      }
+      return { status: "reserved", reservation };
+    },
+    releaseRelayPairingCancellation: (reservation) => releaseRelayPairingCancellation.run(reservation.deviceId, reservation.reservationId).changes === 1,
+    finishRelayPairingCancellation: (reservation) => finishRelayPairingCancellation.run(reservation.deviceId, reservation.reservationId).changes === 1,
+    cancelRelayPairing: (deviceId) => cancelRelayPairing.run(deviceId).changes > 0,
     claimRelayPairing(secret, token, rawName, relayIdentityPublicKey, now = Date.now()) {
       const name = normalizeDeviceName(rawName);
       if (!name || !/^rcd_[A-Za-z0-9_-]{43}$/.test(token)) return void 0;
@@ -4060,34 +4287,49 @@ var PresenceCoordinator = class {
 
 // src/relay-identity-store.ts
 import {
-  chmodSync as chmodSync2,
-  closeSync,
-  constants as constants2,
+  closeSync as closeSync2,
+  constants as constants3,
   existsSync as existsSync2,
-  fsyncSync,
-  linkSync,
-  lstatSync,
-  openSync,
+  fchmodSync as fchmodSync2,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync2,
+  linkSync as linkSync2,
+  lstatSync as lstatSync2,
+  openSync as openSync2,
   readFileSync as readFileSync2,
-  unlinkSync,
+  unlinkSync as unlinkSync2,
   writeFileSync as writeFileSync2
 } from "fs";
 import { randomBytes as randomBytes5 } from "crypto";
-import { join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 var RELAY_IDENTITY_FILE = "relay-identity.json";
+var MAX_IDENTITY_BYTES = 32 * 1024;
 function readIdentity(path) {
-  let stat8;
+  let before;
   try {
-    stat8 = lstatSync(path);
+    before = lstatSync2(path);
   } catch {
     throw new Error("relay identity could not be read");
   }
-  if (!stat8.isFile() || stat8.isSymbolicLink()) throw new Error("relay identity path must be a regular file");
+  if (!before.isFile() || before.isSymbolicLink()) throw new Error("relay identity path must be a regular file");
+  if (before.size > MAX_IDENTITY_BYTES) throw new Error("relay identity file is too large");
+  if (typeof process.getuid === "function" && before.uid !== process.getuid()) {
+    throw new Error("relay identity must be owned by the current user");
+  }
+  let descriptor;
   let document;
   try {
-    document = JSON.parse(readFileSync2(path, "utf8"));
+    descriptor = openSync2(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+    const opened = fstatSync2(descriptor);
+    if (!opened.isFile() || opened.size > MAX_IDENTITY_BYTES || opened.dev !== before.dev || opened.ino !== before.ino || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
+      throw new Error("relay identity changed while it was being opened");
+    }
+    fchmodSync2(descriptor, 384);
+    document = JSON.parse(readFileSync2(descriptor, "utf8"));
   } catch {
     throw new Error("relay identity file is corrupt; restore it from backup instead of replacing it");
+  } finally {
+    if (descriptor !== void 0) closeSync2(descriptor);
   }
   if (document.version !== 1 || !Number.isSafeInteger(document.createdAt) || document.createdAt < 0) {
     throw new Error("relay identity file has an unsupported format");
@@ -4098,34 +4340,54 @@ function readIdentity(path) {
   } catch {
     throw new Error("relay identity file contains an invalid or mismatched keypair");
   }
-  chmodSync2(path, 384);
   return { identity: identity2, createdAt: document.createdAt, path, generated: false };
 }
+function fsyncDirectory2(path) {
+  let descriptor;
+  try {
+    descriptor = openSync2(path, constants3.O_RDONLY);
+    fsyncSync2(descriptor);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && !(process.platform === "win32" && code === "EPERM")) {
+      throw error;
+    }
+  } finally {
+    if (descriptor !== void 0) closeSync2(descriptor);
+  }
+}
 function writeDurably(path, document) {
   const temporary = `${path}.${randomBytes5(12).toString("hex")}.tmp`;
   let descriptor;
+  let installed = false;
   try {
-    descriptor = openSync(temporary, constants2.O_CREAT | constants2.O_EXCL | constants2.O_WRONLY, 384);
+    descriptor = openSync2(
+      temporary,
+      constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY | (constants3.O_NOFOLLOW ?? 0),
+      384
+    );
+    fchmodSync2(descriptor, 384);
     writeFileSync2(descriptor, `${JSON.stringify(document)}
 `, "utf8");
-    fsyncSync(descriptor);
-    closeSync(descriptor);
+    fsyncSync2(descriptor);
+    closeSync2(descriptor);
     descriptor = void 0;
-    chmodSync2(temporary, 384);
     try {
-      linkSync(temporary, path);
-      return true;
+      linkSync2(temporary, path);
+      installed = true;
     } catch (error) {
       if (error.code === "EEXIST") return false;
       throw error;
     }
   } finally {
-    if (descriptor !== void 0) closeSync(descriptor);
+    if (descriptor !== void 0) closeSync2(descriptor);
     try {
-      unlinkSync(temporary);
+      unlinkSync2(temporary);
     } catch {
     }
   }
+  if (installed) fsyncDirectory2(dirname2(path));
+  return installed;
 }
 function loadOrCreateRelayIdentity(options) {
   ensureDataDir(options.dataDir);
@@ -4143,6 +4405,7 @@ function loadOrCreateRelayIdentity(options) {
 import { createHash as createHash3, randomBytes as randomBytes6, timingSafeEqual as timingSafeEqual3 } from "crypto";
 import { createRequire as createRequire4 } from "module";
 var require5 = createRequire4(import.meta.url);
+var UNSAFE_DISPLAY_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId4(value, field) {
   if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
   return value;
@@ -4156,7 +4419,7 @@ function safeOwnerAccountId(value) {
 function safeLabel2(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(normalized)) {
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT2.test(normalized)) {
     throw new Error("invalid relay route label");
   }
   return normalized;
@@ -4198,22 +4461,72 @@ function cloneRoute(route) {
   return { ...route };
 }
 function cloneDevice(device) {
-  return { ...device };
+  return {
+    routeId: device.routeId,
+    deviceId: device.deviceId,
+    credentialHash: device.credentialHash,
+    createdAt: device.createdAt,
+    updatedAt: device.updatedAt,
+    ...device.expiresAt === void 0 ? {} : { expiresAt: device.expiresAt }
+  };
+}
+function credentialOverlap(current, credentialHash, expiresAt, now) {
+  if (!current || expiresAt !== void 0) return {};
+  if (current.expiresAt !== void 0) {
+    if (current.credentialHash === credentialHash) {
+      throw new Error("relay bootstrap promotion must rotate the device credential");
+    }
+    return {
+      previousCredentialHash: current.credentialHash,
+      previousCredentialExpiresAt: current.expiresAt
+    };
+  }
+  if (current.previousCredentialHash !== void 0 && current.previousCredentialExpiresAt !== void 0 && current.previousCredentialExpiresAt >= now) {
+    if (current.previousCredentialHash === credentialHash) {
+      throw new Error("relay bootstrap credential cannot become durable");
+    }
+    return {
+      previousCredentialHash: current.previousCredentialHash,
+      previousCredentialExpiresAt: current.previousCredentialExpiresAt
+    };
+  }
+  return {};
 }
 function createMemoryStore2(options) {
   const routes = /* @__PURE__ */ new Map();
   const devices = /* @__PURE__ */ new Map();
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes6(16).toString("base64url")}`);
   const deviceKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
-  const listRoutes = (now, ownerAccountId) => [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
-    id: route.id,
-    label: route.label,
-    deviceCount: [...devices.values()].filter(
-      (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
-    ).length,
-    createdAt: route.createdAt,
-    updatedAt: route.updatedAt
-  }));
+  const pruneExpiredDevices = (now) => {
+    for (const [key, device] of devices) {
+      if (device.expiresAt !== void 0 && device.expiresAt < now) devices.delete(key);
+      else if (device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt < now) {
+        delete device.previousCredentialHash;
+        delete device.previousCredentialExpiresAt;
+      }
+    }
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const key = deviceKey(routeId, deviceId);
+    const device = devices.get(key);
+    if (device?.expiresAt !== void 0 && device.expiresAt < now) {
+      devices.delete(key);
+      return;
+    }
+    return device;
+  };
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
+      id: route.id,
+      label: route.label,
+      deviceCount: [...devices.values()].filter(
+        (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
+      ).length,
+      createdAt: route.createdAt,
+      updatedAt: route.updatedAt
+    }));
+  };
   return {
     mode: "memory",
     createRoute(input, now = Date.now()) {
@@ -4239,6 +4552,7 @@ function createMemoryStore2(options) {
       return listRoutes(now, safeOwnerAccountId(ownerAccountId));
     },
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const safeRouteId = safeId4(routeId, "route id");
       return [...devices.values()].filter(
         (device) => device.routeId === safeRouteId && (device.expiresAt === void 0 || device.expiresAt >= now)
@@ -4262,18 +4576,22 @@ function createMemoryStore2(options) {
       return !!route && hashMatches(route.hostCredentialHash, credential);
     },
     putDevice(input, now = Date.now()) {
+      pruneExpiredDevices(now);
       const routeId = safeId4(input.routeId, "route id");
       if (!routes.has(routeId)) throw new Error("relay route not found");
       const deviceId = safeId4(input.deviceId, "device id");
       const key = deviceKey(routeId, deviceId);
       const current = devices.get(key);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.createdAt ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt },
+        ...credentialOverlap(current, credentialHash, expiresAt, now)
       };
       devices.set(key, device);
       const route = routes.get(routeId);
@@ -4281,12 +4599,12 @@ function createMemoryStore2(options) {
       return cloneDevice(device);
     },
     getDevice(routeId, deviceId, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId4(routeId, "route id"), safeId4(deviceId, "device id")));
-      return device && (device.expiresAt === void 0 || device.expiresAt >= now) ? cloneDevice(device) : void 0;
+      const device = liveDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"), now);
+      return device ? cloneDevice(device) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId4(routeId, "route id"), safeId4(deviceId, "device id")));
-      return !!device && (device.expiresAt === void 0 || device.expiresAt >= now) && hashMatches(device.credentialHash, credential);
+      const device = liveDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"), now);
+      return !!device && (hashMatches(device.credentialHash, credential) || device.previousCredentialHash !== void 0 && device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt >= now && hashMatches(device.previousCredentialHash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId4(routeId, "route id");
@@ -4348,6 +4666,8 @@ function openRelayRouteStore(options) {
       route_id TEXT NOT NULL REFERENCES relay_routes(id) ON DELETE CASCADE,
       device_id TEXT NOT NULL,
       credential_hash TEXT NOT NULL,
+      previous_credential_hash TEXT,
+      previous_credential_expires_at INTEGER,
       created_at INTEGER NOT NULL,
       updated_at INTEGER NOT NULL,
       expires_at INTEGER,
@@ -4358,6 +4678,12 @@ function openRelayRouteStore(options) {
   if (!relayDeviceColumns.some((column) => column.name === "expires_at")) {
     db.exec("ALTER TABLE relay_route_devices ADD COLUMN expires_at INTEGER");
   }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_hash")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_hash TEXT");
+  }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_expires_at")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_expires_at INTEGER");
+  }
   const relayRouteColumns = db.prepare("PRAGMA table_info(relay_routes)").all();
   if (!relayRouteColumns.some((column) => column.name === "owner_account_id")) {
     db.exec("ALTER TABLE relay_routes ADD COLUMN owner_account_id TEXT");
@@ -4366,6 +4692,21 @@ function openRelayRouteStore(options) {
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes6(16).toString("base64url")}`);
   const getRoute = (id) => db.prepare("SELECT * FROM relay_routes WHERE id = ?").get(id);
   const getDevice = (routeId, deviceId) => db.prepare("SELECT * FROM relay_route_devices WHERE route_id = ? AND device_id = ?").get(routeId, deviceId);
+  const pruneExpiredDevices = (now) => {
+    db.prepare("DELETE FROM relay_route_devices WHERE expires_at IS NOT NULL AND expires_at < ?").run(now);
+    db.prepare(
+      `UPDATE relay_route_devices SET previous_credential_hash = NULL, previous_credential_expires_at = NULL
+       WHERE previous_credential_expires_at IS NOT NULL AND previous_credential_expires_at < ?`
+    ).run(now);
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const row = getDevice(routeId, deviceId);
+    if (row?.expires_at !== null && row?.expires_at !== void 0 && row.expires_at < now) {
+      db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(routeId, deviceId);
+      return;
+    }
+    return row;
+  };
   const createRoute = db.transaction(
     (input, now) => {
       const id = safeId4(input.id ?? generateRouteId(), "route id");
@@ -4396,25 +4737,44 @@ function openRelayRouteStore(options) {
     (input, now) => {
       const routeId = safeId4(input.routeId, "route id");
       if (!getRoute(routeId)) throw new Error("relay route not found");
+      pruneExpiredDevices(now);
       const deviceId = safeId4(input.deviceId, "device id");
       const current = getDevice(routeId, deviceId);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
+      const overlap = credentialOverlap(
+        current ? {
+          ...deviceFromRow(current),
+          ...current.previous_credential_hash === null || current.previous_credential_hash === void 0 ? {} : { previousCredentialHash: current.previous_credential_hash },
+          ...current.previous_credential_expires_at === null || current.previous_credential_expires_at === void 0 ? {} : { previousCredentialExpiresAt: current.previous_credential_expires_at }
+        } : void 0,
+        credentialHash,
+        expiresAt,
+        now
+      );
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.created_at ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt }
       };
       db.prepare(
-        `INSERT INTO relay_route_devices (route_id, device_id, credential_hash, created_at, updated_at, expires_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+        `INSERT INTO relay_route_devices
+         (route_id, device_id, credential_hash, previous_credential_hash, previous_credential_expires_at,
+          created_at, updated_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(route_id, device_id) DO UPDATE SET credential_hash = excluded.credential_hash,
+           previous_credential_hash = excluded.previous_credential_hash,
+           previous_credential_expires_at = excluded.previous_credential_expires_at,
            updated_at = excluded.updated_at, expires_at = excluded.expires_at`
       ).run(
         device.routeId,
         device.deviceId,
         device.credentialHash,
+        overlap.previousCredentialHash ?? null,
+        overlap.previousCredentialExpiresAt ?? null,
         device.createdAt,
         device.updatedAt,
         device.expiresAt ?? null
@@ -4423,19 +4783,22 @@ function openRelayRouteStore(options) {
       return device;
     }
   );
-  const listRoutes = (now, ownerAccountId) => db.prepare(
-    `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return db.prepare(
+      `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
            FROM relay_routes r LEFT JOIN relay_route_devices d ON d.route_id = r.id
              AND (d.expires_at IS NULL OR d.expires_at >= ?)
            ${ownerAccountId === void 0 ? "" : "WHERE r.owner_account_id = ?"}
            GROUP BY r.id ORDER BY r.created_at, r.id`
-  ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
-    id: row.id,
-    label: row.label,
-    deviceCount: row.device_count,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  }));
+    ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
+      id: row.id,
+      label: row.label,
+      deviceCount: row.device_count,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    }));
+  };
   return {
     mode: "sqlite",
     createRoute: (input, now = Date.now()) => cloneRoute(createRoute(input, now)),
@@ -4446,6 +4809,7 @@ function openRelayRouteStore(options) {
     listRoutes: (now = Date.now()) => listRoutes(now),
     listRoutesByOwner: (ownerAccountId, now = Date.now()) => listRoutes(now, ownerAccountId),
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const row = db.prepare(
         `SELECT COUNT(*) AS count FROM relay_route_devices
            WHERE route_id = ? AND (expires_at IS NULL OR expires_at >= ?)`
@@ -4464,12 +4828,12 @@ function openRelayRouteStore(options) {
     },
     putDevice: (input, now = Date.now()) => cloneDevice(putDevice(input, now)),
     getDevice(routeId, deviceId, now = Date.now()) {
-      const row = getDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"));
-      return row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) ? deviceFromRow(row) : void 0;
+      const row = liveDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"), now);
+      return row ? deviceFromRow(row) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const row = getDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"));
-      return !!row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) && hashMatches(row.credential_hash, credential);
+      const row = liveDevice(safeId4(routeId, "route id"), safeId4(deviceId, "device id"), now);
+      return !!row && (hashMatches(row.credential_hash, credential) || row.previous_credential_hash !== null && row.previous_credential_hash !== void 0 && row.previous_credential_expires_at !== null && row.previous_credential_expires_at !== void 0 && row.previous_credential_expires_at >= now && hashMatches(row.previous_credential_hash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId4(routeId, "route id");
@@ -4499,6 +4863,7 @@ var PLAN_DEFAULTS = {
   team: { maxRoutes: 25, maxDevicesPerRoute: 64 },
   enterprise: { maxRoutes: 500, maxDevicesPerRoute: 500 }
 };
+var UNSAFE_TERMINAL_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId5(value) {
   if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
     throw new Error("invalid relay account id");
@@ -4508,7 +4873,7 @@ function safeId5(value) {
 function safeLabel3(value) {
   if (typeof value !== "string") throw new Error("relay account label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 120 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) {
+  if (!label || label.length > 120 || UNSAFE_TERMINAL_TEXT.test(label)) {
     throw new Error("invalid relay account label");
   }
   return label;
@@ -4537,6 +4902,33 @@ function safeHash(value) {
   }
   return value;
 }
+function safeLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential lookup");
+  }
+  return value;
+}
+function credentialMaterial(input) {
+  if (typeof input === "string") {
+    return {
+      credentialHash: relayAccountCredentialHash(input),
+      credentialLookup: relayAccountCredentialLookup(input)
+    };
+  }
+  if ("credential" in input && input.credential !== void 0) {
+    if (input.credentialHash !== void 0 || input.credentialLookup !== void 0) {
+      throw new Error("relay account credential must be raw or pre-hashed, not both");
+    }
+    return {
+      credentialHash: relayAccountCredentialHash(input.credential),
+      credentialLookup: relayAccountCredentialLookup(input.credential)
+    };
+  }
+  return {
+    credentialHash: safeHash(input.credentialHash),
+    credentialLookup: safeLookup(input.credentialLookup)
+  };
+}
 function hashMatches2(expected, credential) {
   try {
     const left = Buffer.from(safeHash(expected));
@@ -4570,14 +4962,24 @@ function createMemoryStore3(options) {
   const accounts = /* @__PURE__ */ new Map();
   const lookup = /* @__PURE__ */ new Map();
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes7(18).toString("base64url")}`);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const id = lookup.get(credentialLookup);
+    const record = id ? accounts.get(id) : void 0;
+    return record && record.status !== "deleted" && hashMatches2(record.credentialHash, credential) ? clone3(record) : void 0;
+  };
   return {
     mode: "memory",
     createAccount(input, now = Date.now()) {
       const id = safeId5(generateAccountId());
       if (accounts.has(id)) throw new Error("relay account already exists");
       const plan = safePlan(input.plan ?? "free");
-      const credentialHash = relayAccountCredentialHash(input.credential);
-      const credentialLookup = relayAccountCredentialLookup(input.credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(input);
       if (lookup.has(credentialLookup)) throw new Error("relay account credential already exists");
       const defaults = PLAN_DEFAULTS[plan];
       const record = {
@@ -4609,16 +5011,10 @@ function createMemoryStore3(options) {
     listAccounts({ includeDeleted = false } = {}) {
       return [...accounts.values()].filter((record) => includeDeleted || record.status !== "deleted").sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map(clone3);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
-      try {
-        credentialLookup = relayAccountCredentialLookup(credential);
-      } catch {
-        return void 0;
-      }
-      const id = lookup.get(credentialLookup);
-      const record = id ? accounts.get(id) : void 0;
-      return record?.status === "active" && hashMatches2(record.credentialHash, credential) ? clone3(record) : void 0;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const current = accounts.get(safeId5(id));
@@ -4656,8 +5052,7 @@ function createMemoryStore3(options) {
       if (!current) return void 0;
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone3(current));
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const credentialHash = relayAccountCredentialHash(credential);
-      const credentialLookup = relayAccountCredentialLookup(credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
       const owner = lookup.get(credentialLookup);
       if (owner && owner !== current.id) throw new Error("relay account credential already exists");
       lookup.delete(current.credentialLookup);
@@ -4723,10 +5118,21 @@ function openRelayAccountStore(options) {
   `);
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes7(18).toString("base64url")}`);
   const rowById = (id) => db.prepare("SELECT * FROM relay_accounts WHERE id = ?").get(id);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status != 'deleted'").get(credentialLookup);
+    return row && hashMatches2(row.credential_hash, credential) ? fromRow(row) : void 0;
+  };
   const createAccount = db.transaction((input, now) => {
     const id = safeId5(generateAccountId());
     if (rowById(id)) throw new Error("relay account already exists");
     const plan = safePlan(input.plan ?? "free");
+    const { credentialHash, credentialLookup } = credentialMaterial(input);
     const defaults = PLAN_DEFAULTS[plan];
     const record = {
       id,
@@ -4752,8 +5158,8 @@ function openRelayAccountStore(options) {
       record.maxRoutes,
       record.maxDevicesPerRoute,
       record.revision,
-      relayAccountCredentialHash(input.credential),
-      relayAccountCredentialLookup(input.credential),
+      credentialHash,
+      credentialLookup,
       record.createdAt,
       record.updatedAt
     );
@@ -4773,15 +5179,10 @@ function openRelayAccountStore(options) {
       ).all();
       return rows.map(fromRow);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
-      try {
-        credentialLookup = relayAccountCredentialLookup(credential);
-      } catch {
-        return void 0;
-      }
-      const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status = 'active'").get(credentialLookup);
-      return row && hashMatches2(row.credential_hash, credential) ? fromRow(row) : void 0;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const safeAccountId = safeId5(id);
@@ -4840,16 +5241,11 @@ function openRelayAccountStore(options) {
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
       const result = db.prepare(
         `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
            updated_at = ? WHERE id = ? AND revision = ?`
-      ).run(
-        relayAccountCredentialHash(credential),
-        relayAccountCredentialLookup(credential),
-        now,
-        safeAccountId,
-        expectedRevision
-      );
+      ).run(credentialHash, credentialLookup, now, safeAccountId, expectedRevision);
       if (result.changes !== 1) {
         const latest = rowById(safeAccountId);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
@@ -5018,7 +5414,7 @@ function safeId7(value, field) {
   return value;
 }
 function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+  return hostname === "localhost" || hostname === "[::1]" || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
 }
 function relayConnectUrl(raw) {
   let url;
@@ -5780,6 +6176,7 @@ function createRelayHostConnector(options) {
 
 // src/relay-provision.ts
 var RESPONSE_LIMIT = 16 * 1024;
+var UNSAFE_TERMINAL_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId8(value, field) {
   if (!/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
   return value;
@@ -5794,13 +6191,44 @@ function relayHttpOrigin(raw) {
 }
 async function boundedError(response2) {
   const declared = Number(response2.headers.get("content-length"));
-  if (Number.isFinite(declared) && declared > RESPONSE_LIMIT) return `relay returned ${response2.status}`;
+  if (Number.isFinite(declared) && declared > RESPONSE_LIMIT) {
+    await discardBody(response2);
+    return `relay returned ${response2.status}`;
+  }
+  if (!response2.body) return `relay returned ${response2.status}`;
+  const chunks = [];
+  let total = 0;
+  const reader = response2.body.getReader();
   try {
-    const body = (await response2.text()).slice(0, RESPONSE_LIMIT);
+    while (true) {
+      const next = await reader.read();
+      if (next.done) break;
+      if (!next.value) continue;
+      total += next.value.byteLength;
+      if (total > RESPONSE_LIMIT) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        return `relay returned ${response2.status}`;
+      }
+      chunks.push(Buffer.from(next.value));
+    }
+    const body = Buffer.concat(chunks, total).toString("utf8");
     const parsed = JSON.parse(body);
-    return typeof parsed.error === "string" && parsed.error.length <= 200 ? parsed.error : `relay returned ${response2.status}`;
+    if (typeof parsed.error !== "string") return `relay returned ${response2.status}`;
+    const message = parsed.error.trim().replace(/\s+/g, " ");
+    return message && message.length <= 200 && !UNSAFE_TERMINAL_TEXT2.test(message) && !/\brr[a-z]_[A-Za-z0-9_-]{20,}\b|\bsha256:[A-Za-z0-9_-]{43}\b|\bBearer\s+/i.test(message) ? message : `relay returned ${response2.status}`;
   } catch {
     return `relay returned ${response2.status}`;
+  } finally {
+    reader.releaseLock();
+  }
+}
+async function discardBody(response2) {
+  try {
+    await response2.body?.cancel();
+  } catch {
   }
 }
 function createRelayDeviceProvisioner(options) {
@@ -5826,26 +6254,31 @@ function createRelayDeviceProvisioner(options) {
           "content-type": "application/json"
         },
         body: JSON.stringify({ credentialHash, ...expiresAt === void 0 ? {} : { expiresAt } }),
+        redirect: "error",
         ...requestSignal ? { signal: requestSignal } : {}
       });
       if (!response2.ok) throw new Error(`could not provision relay device: ${await boundedError(response2)}`);
+      await discardBody(response2);
     },
     async revokeDevice(deviceId) {
       const requestSignal = signal();
       const response2 = await request(endpoint(deviceId), {
         method: "DELETE",
         headers: { authorization: `Bearer ${options.hostCredential}` },
+        redirect: "error",
         ...requestSignal ? { signal: requestSignal } : {}
       });
-      if (!response2.ok && response2.status !== 404)
+      if (!response2.ok && response2.status !== 404) {
         throw new Error(`could not revoke relay device: ${await boundedError(response2)}`);
+      }
+      await discardBody(response2);
     }
   };
 }
 
 // src/relay-pairing.ts
 function isLoopback2(hostname) {
-  return hostname === "localhost" || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+  return hostname === "localhost" || hostname === "::1" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
 }
 function normalizeRelayAppUrl(value) {
   const url = new URL(value.trim());
@@ -5870,9 +6303,11 @@ import websocket from "@fastify/websocket";
 var BLIND_RELAY_PROTOCOL_VERSION = 1;
 var BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 15e5;
 var BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4e6;
+var BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
 var BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
 var BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE = 64 * 1024 * 1024;
 var BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12e3;
+var UNSAFE_DISPLAY_TEXT3 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeToken(value, field) {
   if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
     throw new Error(`invalid relay ${field}`);
@@ -5892,7 +6327,7 @@ function safeId9(value, field) {
 function safeLabel4(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) throw new Error("invalid relay route label");
+  if (!label || label.length > 80 || UNSAFE_DISPLAY_TEXT3.test(label)) throw new Error("invalid relay route label");
   return label;
 }
 function safeExpiry2(value, now) {
@@ -5930,7 +6365,9 @@ function publicRoute(route) {
 function normalizeOrigin2(value) {
   try {
     const url = new URL(value);
-    if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) return;
+    const loopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      return;
     return url.origin;
   } catch {
     return;
@@ -5992,6 +6429,7 @@ function createBlindRelayServer(options) {
   const idleTimeoutMs = options.idleTimeoutMs ?? 2 * 6e4;
   const maxFrameBytes = options.maxFrameBytes ?? BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES;
   const maxQueueBytes = options.maxQueueBytes ?? BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES;
+  const maxTotalConnections = options.maxTotalConnections ?? BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS;
   const maxConnectionsPerRoute = options.maxConnectionsPerRoute ?? BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE;
   const maxBytesPerMinute = options.maxBytesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE;
   const maxMessagesPerMinute = options.maxMessagesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE;
@@ -6000,17 +6438,63 @@ function createBlindRelayServer(options) {
     [idleTimeoutMs, 1e4, 60 * 6e4, "idle timeout"],
     [maxFrameBytes, 1024, 16 * 1024 * 1024, "frame limit"],
     [maxQueueBytes, 1024, 64 * 1024 * 1024, "queue limit"],
+    [maxTotalConnections, 1, 1e5, "total connection limit"],
     [maxConnectionsPerRoute, 1, 1e4, "connection limit"],
     [maxBytesPerMinute, 1024, 1024 * 1024 * 1024, "byte rate"],
     [maxMessagesPerMinute, 10, 1e6, "message rate"]
   ]) {
     if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`invalid relay ${label}`);
   }
-  const allowedOrigins = new Set((options.allowedOrigins ?? []).map(normalizeOrigin2).filter(Boolean));
+  const maxEnvelopeBytes = Math.max(8 * 1024, Math.ceil(maxFrameBytes * 4 / 3) + 8 * 1024);
+  const configuredOrigins = options.allowedOrigins ?? [];
+  const normalizedOrigins = configuredOrigins.map(normalizeOrigin2);
+  if (normalizedOrigins.some((origin) => origin === void 0)) {
+    throw new Error("invalid relay allowed origin");
+  }
+  const allowedOrigins = new Set(normalizedOrigins);
   const generateChannelId = options.generateChannelId ?? (() => `rrc_${randomBytes8(16).toString("base64url")}`);
   const hosts = /* @__PURE__ */ new Map();
   const devicesByChannel = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const hostRates = /* @__PURE__ */ new Map();
+  const deviceRates = /* @__PURE__ */ new Map();
+  const maxRateIdentities = Math.min(1e5, Math.max(256, maxTotalConnections * 4));
+  const deviceRateKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
+  const clearRouteRates = (routeId) => {
+    hostRates.delete(routeId);
+    for (const key of deviceRates.keys()) if (key.startsWith(`${routeId}\0`)) deviceRates.delete(key);
+  };
+  const rateWindowFor = (windows, key) => {
+    const current = now();
+    if (windows.size >= maxRateIdentities) {
+      for (const [candidate, window] of windows) {
+        if (current - window.lastSeenAt >= 12e4) windows.delete(candidate);
+      }
+    }
+    const existing = windows.get(key);
+    if (existing) {
+      existing.lastSeenAt = current;
+      return existing;
+    }
+    if (windows.size >= maxRateIdentities) return;
+    const created = { startedAt: current, lastSeenAt: current, bytes: 0, messages: 0 };
+    windows.set(key, created);
+    return created;
+  };
+  const consumeRate = (window, bytes) => {
+    const current = now();
+    if (current - window.startedAt >= 6e4) {
+      window.startedAt = current;
+      window.bytes = 0;
+      window.messages = 0;
+    }
+    window.lastSeenAt = current;
+    window.bytes += bytes;
+    window.messages += 1;
+    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
+  };
   const metrics = {
+    activeConnections: 0,
     activeHosts: 0,
     activeDevices: 0,
     acceptedConnections: 0,
@@ -6047,6 +6531,14 @@ function createBlindRelayServer(options) {
     }
     reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
   };
+  const requireRecoverableAccount = async (request, reply) => {
+    const account = accountStore?.verifyCredential(bearer(request) ?? "");
+    if (account) {
+      authenticatedAccounts.set(request, account);
+      return;
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
   app.addHook("onSend", async (_request, reply, payload) => {
     reply.header("cache-control", "no-store");
     reply.header("content-security-policy", "default-src 'none'");
@@ -6066,7 +6558,12 @@ function createBlindRelayServer(options) {
   });
   app.get("/v1/metrics", { preHandler: requireRoot }, async () => ({
     protocolVersion: BLIND_RELAY_PROTOCOL_VERSION,
-    metrics: { ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size }
+    metrics: {
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    }
   }));
   app.get("/v1/routes", { preHandler: requireRoot }, async () => ({ routes: store.listRoutes().map(publicRoute) }));
   app.post(
@@ -6112,6 +6609,7 @@ function createBlindRelayServer(options) {
         reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
         return;
       }
+      clearRouteRates(request.params.routeId);
       const host = hosts.get(request.params.routeId);
       host?.socket.close(4403, "route deleted");
       for (const device of host?.devices.values() ?? []) device.socket.close(4403, "route deleted");
@@ -6168,22 +6666,12 @@ function createBlindRelayServer(options) {
         reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
         return;
       }
+      deviceRates.delete(deviceRateKey(request.params.routeId, request.params.deviceId));
       const live = hosts.get(request.params.routeId)?.devices.get(request.params.deviceId);
       live?.socket.close(4403, "device revoked");
       reply.code(204).send();
     }
   );
-  const consumeRate = (window, bytes) => {
-    const current = now();
-    if (current - window.startedAt >= 6e4) {
-      window.startedAt = current;
-      window.bytes = 0;
-      window.messages = 0;
-    }
-    window.bytes += bytes;
-    window.messages += 1;
-    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
-  };
   const closeDevice = (device, code = 1e3, reason = "device disconnected") => {
     if (device.closed) return;
     device.closed = true;
@@ -6192,7 +6680,10 @@ function createBlindRelayServer(options) {
     const host = hosts.get(device.routeId);
     if (host?.devices.get(device.deviceId) === device) host.devices.delete(device.deviceId);
     metrics.activeDevices = Math.max(0, metrics.activeDevices - 1);
-    if (host) safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes);
+    if (host && !safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes)) {
+      metrics.droppedFrames += 1;
+      closeHost(host, 4408, "relay backpressure");
+    }
     if (device.socket.readyState === device.socket.OPEN) device.socket.close(code, reason);
   };
   const touchDevice = (device) => {
@@ -6220,11 +6711,24 @@ function createBlindRelayServer(options) {
       usage: { routes: store.listRoutesByOwner(account.id, now()).length, maxRoutes: account.maxRoutes }
     });
     const closeAccountRoutes = (accountId, reason) => {
+      for (const host of [...hosts.values()]) if (host.ownerAccountId === accountId) closeHost(host, 4403, reason);
+    };
+    const purgeAccountRoutes = (accountId) => {
+      closeAccountRoutes(accountId, "account deleted");
       for (const route of store.listRoutesByOwner(accountId, now())) {
-        const host = hosts.get(route.id);
-        if (host) closeHost(host, 4403, reason);
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
       }
     };
+    for (const listedRoute of store.listRoutes(now())) {
+      const route = store.getRoute(listedRoute.id);
+      if (!route?.ownerAccountId) continue;
+      const owner = accountStore.getAccount(route.ownerAccountId);
+      if (!owner || owner.status === "deleted") {
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
+      }
+    }
     const ownedRoute = (accountId, routeId) => {
       const route = store.getRoute(routeId);
       return route?.ownerAccountId === accountId ? route : void 0;
@@ -6232,18 +6736,47 @@ function createBlindRelayServer(options) {
     app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
       accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
     }));
-    app.post("/v1/accounts", { preHandler: requireRoot }, async (request, reply) => {
-      const accountCredential = generateRelayAccountCredential();
+    const createAccountHandler = (clientHashedOnly) => async (request, reply) => {
       try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
         const account = accountStore.createAccount({
-          ...request.body,
-          credential: accountCredential
+          label: request.body?.label,
+          ...request.body?.plan === void 0 ? {} : { plan: request.body.plan },
+          ...request.body?.maxRoutes === void 0 ? {} : { maxRoutes: request.body.maxRoutes },
+          ...request.body?.maxDevicesPerRoute === void 0 ? {} : { maxDevicesPerRoute: request.body.maxDevicesPerRoute },
+          ...typeof credential === "string" ? { credential } : {
+            credentialHash: credential.credentialHash,
+            credentialLookup: credential.credentialLookup
+          }
+        });
+        reply.code(201).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
         });
-        reply.code(201).send({ ...accountEnvelope(account), accountCredential });
       } catch {
         reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
       }
-    });
+    };
+    app.post(
+      "/v1/accounts",
+      { preHandler: requireRoot },
+      createAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/client-hashed",
+      { preHandler: requireRoot },
+      createAccountHandler(true)
+    );
     app.patch(
       "/v1/accounts/:accountId",
       { preHandler: requireRoot },
@@ -6258,7 +6791,8 @@ function createBlindRelayServer(options) {
             reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
             return;
           }
-          if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
+          if (account.status === "deleted") purgeAccountRoutes(account.id);
+          else if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
           reply.code(200).send(accountEnvelope(account));
         } catch (error) {
           if (error instanceof RelayAccountRevisionConflictError) {
@@ -6273,34 +6807,58 @@ function createBlindRelayServer(options) {
         }
       }
     );
+    const rotateAccountHandler = (clientHashedOnly) => async (request, reply) => {
+      try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
+        const account = accountStore.rotateCredential(
+          request.params.accountId,
+          credential,
+          safeRevision(request.body?.expectedRevision)
+        );
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
+        });
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          reply.code(409).send({
+            code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+            error: "relay account revision conflict",
+            current: accountEnvelope(error.current)
+          });
+          return;
+        }
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+      }
+    };
     app.post(
       "/v1/accounts/:accountId/credential",
       { preHandler: requireRoot },
-      async (request, reply) => {
-        const accountCredential = generateRelayAccountCredential();
-        try {
-          const account = accountStore.rotateCredential(
-            request.params.accountId,
-            accountCredential,
-            safeRevision(request.body?.expectedRevision)
-          );
-          if (!account) {
-            reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-            return;
-          }
-          reply.code(200).send({ ...accountEnvelope(account), accountCredential });
-        } catch (error) {
-          if (error instanceof RelayAccountRevisionConflictError) {
-            reply.code(409).send({
-              code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-              error: "relay account revision conflict",
-              current: accountEnvelope(error.current)
-            });
-            return;
-          }
-          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        }
-      }
+      rotateAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/:accountId/credential/client-hashed",
+      { preHandler: requireRoot },
+      rotateAccountHandler(true)
+    );
+    app.get(
+      "/v1/account/recovery",
+      { preHandler: requireRecoverableAccount },
+      async (request) => accountEnvelope(authenticatedAccounts.get(request))
     );
     app.get(
       "/v1/account",
@@ -6378,6 +6936,7 @@ function createBlindRelayServer(options) {
           reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
           return;
         }
+        clearRouteRates(request.params.routeId);
         const host = hosts.get(request.params.routeId);
         if (host) closeHost(host, 4403, "route deleted");
         reply.code(204).send();
@@ -6414,9 +6973,15 @@ function createBlindRelayServer(options) {
       }
     );
   }
-  app.register(websocket);
+  app.register(websocket, { options: { maxPayload: maxEnvelopeBytes, perMessageDeflate: false } });
   app.register(async (scope) => {
     scope.get("/v1/connect", { websocket: true }, (socket, request) => {
+      if (sockets.size >= maxTotalConnections) {
+        metrics.rejectedConnections += 1;
+        socket.close(4429, "relay connection limit");
+        return;
+      }
+      sockets.add(socket);
       let authenticated = false;
       let liveHost;
       let liveDevice;
@@ -6435,29 +7000,41 @@ function createBlindRelayServer(options) {
         if (!authenticated) {
           try {
             const hello = parseAuthHello(parseJson(raw, 8 * 1024));
-            const origin = typeof request.headers.origin === "string" ? normalizeOrigin2(request.headers.origin) : void 0;
-            if (hello.role === "device" && origin && allowedOrigins.size > 0 && !allowedOrigins.has(origin)) {
+            const presentedOrigin = request.headers.origin;
+            const origin = typeof presentedOrigin === "string" ? normalizeOrigin2(presentedOrigin) : void 0;
+            if (hello.role === "device" && allowedOrigins.size > 0 && presentedOrigin !== void 0 && (!origin || !allowedOrigins.has(origin))) {
               reject(4403, "origin denied");
               return;
             }
             if (hello.role === "host") {
-              if (!routeAccountIsActive(hello.routeId) || !store.authenticateHost(hello.routeId, hello.credential)) {
+              const route = store.getRoute(hello.routeId);
+              if (!route || route.ownerAccountId !== void 0 && accountStore?.getAccount(route.ownerAccountId)?.status !== "active" || !store.authenticateHost(hello.routeId, hello.credential)) {
                 reject(4401, "authentication failed");
                 return;
               }
+              const rate = rateWindowFor(hostRates, hello.routeId);
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = hosts.get(hello.routeId);
               if (previous) closeHost(previous, 4409, "superseded host");
               liveHost = {
                 socket,
                 routeId: hello.routeId,
+                ...route.ownerAccountId === void 0 ? {} : { ownerAccountId: route.ownerAccountId },
                 devices: /* @__PURE__ */ new Map(),
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               hosts.set(hello.routeId, liveHost);
               metrics.activeHosts += 1;
               touchHost(liveHost);
-              safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+                return;
+              }
             } else {
               if (!routeAccountIsActive(hello.routeId) || !store.authenticateDevice(hello.routeId, hello.deviceId, hello.credential, now())) {
                 reject(4401, "authentication failed");
@@ -6472,6 +7049,11 @@ function createBlindRelayServer(options) {
                 reject(4429, "route connection limit");
                 return;
               }
+              const rate = rateWindowFor(deviceRates, deviceRateKey(hello.routeId, hello.deviceId));
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = host.devices.get(hello.deviceId);
               if (previous) closeDevice(previous, 4409, "superseded device");
               const channelId = safeId9(generateChannelId(), "channel id");
@@ -6480,15 +7062,20 @@ function createBlindRelayServer(options) {
                 routeId: hello.routeId,
                 deviceId: hello.deviceId,
                 channelId,
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               host.devices.set(hello.deviceId, liveDevice);
               devicesByChannel.set(channelId, liveDevice);
               metrics.activeDevices += 1;
               touchDevice(liveDevice);
-              safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+                return;
+              }
               if (!safeSend(host.socket, { t: "peer-open", channelId, deviceId: hello.deviceId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
                 closeDevice(liveDevice, 4408, "host backpressure");
                 return;
               }
@@ -6502,11 +7089,18 @@ function createBlindRelayServer(options) {
           return;
         }
         try {
-          const value = parseJson(raw, maxFrameBytes * 2);
+          const value = parseJson(raw, maxEnvelopeBytes);
           if (liveDevice) {
             touchDevice(liveDevice);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveDevice.rate, 1)) {
+                closeDevice(liveDevice, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+              }
               return;
             }
             const frame = parsePayload(value, false, maxFrameBytes);
@@ -6531,7 +7125,14 @@ function createBlindRelayServer(options) {
           if (liveHost) {
             touchHost(liveHost);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveHost.rate, 1)) {
+                closeHost(liveHost, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+              }
               return;
             }
             if (value?.t === "close-peer") {
@@ -6569,6 +7170,7 @@ function createBlindRelayServer(options) {
         }
       });
       socket.once("close", () => {
+        sockets.delete(socket);
         clearTimeout(handshakeTimer);
         if (liveDevice) closeDevice(liveDevice);
         if (liveHost) closeHost(liveHost);
@@ -6579,18 +7181,35 @@ function createBlindRelayServer(options) {
   });
   app.addHook("onClose", async () => {
     for (const host of [...hosts.values()]) closeHost(host, 1001, "relay shutting down");
+    for (const socket of [...sockets]) socket.close(1001, "relay shutting down");
+    hostRates.clear();
+    deviceRates.clear();
     if (ownsStore) store.close();
   });
   return {
     app,
     store,
     ...accountStore ? { accountStore } : {},
-    metrics: () => ({ ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size })
+    metrics: () => ({
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    })
   };
 }
 
 // src/relay-start.ts
-import { readFileSync as readFileSync3, realpathSync } from "fs";
+import {
+  closeSync as closeSync3,
+  constants as constants4,
+  fstatSync as fstatSync3,
+  lstatSync as lstatSync3,
+  openSync as openSync3,
+  readFileSync as readFileSync3,
+  readdirSync,
+  realpathSync
+} from "fs";
 import { join as join5, resolve as resolve2 } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 function boundedInteger(value, fallback, minimum, maximum, field) {
@@ -6605,8 +7224,51 @@ function relayDataDir(env) {
 function relayOrigins(env) {
   return (env.ROAMCODE_RELAY_ALLOWED_ORIGINS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
 }
+function privateSecretFile(path, field) {
+  let descriptor;
+  try {
+    const before = lstatSync3(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > 4096 || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret file");
+    }
+    descriptor = openSync3(path, constants4.O_RDONLY | (constants4.O_NOFOLLOW ?? 0));
+    const opened = fstatSync3(descriptor);
+    if (!opened.isFile() || opened.size > 4096 || (opened.mode & 63) !== 0 || typeof process.getuid === "function" && opened.uid !== process.getuid() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("unsafe secret file");
+    }
+    return readFileSync3(descriptor, "utf8").trim();
+  } catch {
+    throw new Error(`${field} could not be read securely`);
+  } finally {
+    if (descriptor !== void 0) closeSync3(descriptor);
+  }
+}
 function previousRootTokens(env) {
-  return (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const inline = (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const directory = env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR?.trim();
+  if (inline.length > 0 && directory) {
+    throw new Error(
+      "ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS and ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR are mutually exclusive"
+    );
+  }
+  if (!directory) return inline;
+  let before;
+  let entries;
+  try {
+    before = lstatSync3(directory);
+    if (!before.isDirectory() || before.isSymbolicLink() || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret directory");
+    }
+    entries = readdirSync(directory, { withFileTypes: true });
+    const after = lstatSync3(directory);
+    if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 63) !== 0 || typeof process.getuid === "function" && after.uid !== process.getuid() || entries.some((entry) => !entry.isFile())) {
+      throw new Error("unsafe secret directory");
+    }
+  } catch {
+    throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR could not be read securely");
+  }
+  if (entries.length > 3) throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR may contain at most three files");
+  return entries.map((entry) => entry.name).sort().map((name) => privateSecretFile(join5(directory, name), "previous relay root capability"));
 }
 function explicitBoolean(value, field) {
   if (value === void 0 || value === "" || value === "0" || value === "false") return false;
@@ -6619,18 +7281,12 @@ function secretValue(env, directKey, fileKey) {
   if (direct && file) throw new Error(`${directKey} and ${fileKey} are mutually exclusive`);
   if (direct) return direct;
   if (!file) return void 0;
-  let contents;
-  try {
-    contents = readFileSync3(file, "utf8");
-  } catch {
-    throw new Error(`${fileKey} could not be read`);
-  }
-  if (Buffer.byteLength(contents) > 4096) throw new Error(`${fileKey} is too large`);
-  return contents.trim();
+  return privateSecretFile(file, fileKey);
 }
 async function startBlindRelay(env = process.env) {
   const rootToken = secretValue(env, "ROAMCODE_RELAY_ROOT_TOKEN", "ROAMCODE_RELAY_ROOT_TOKEN_FILE");
   if (!rootToken) throw new Error("ROAMCODE_RELAY_ROOT_TOKEN or ROAMCODE_RELAY_ROOT_TOKEN_FILE is required");
+  const previousRoots = previousRootTokens(env);
   const allowedOrigins = relayOrigins(env);
   const allowAnyOrigin = explicitBoolean(env.ROAMCODE_RELAY_ALLOW_ANY_ORIGIN, "relay allow-any-origin flag");
   if (env.NODE_ENV === "production" && allowedOrigins.length === 0 && !allowAnyOrigin) {
@@ -6659,7 +7315,7 @@ async function startBlindRelay(env = process.env) {
   try {
     relay = createBlindRelayServer({
       rootToken,
-      previousRootTokens: previousRootTokens(env),
+      previousRootTokens: previousRoots,
       store,
       ...accountStore ? { accountStore } : {},
       allowedOrigins,
@@ -6691,6 +7347,13 @@ async function startBlindRelay(env = process.env) {
         64 * 1024 * 1024,
         "relay queue limit"
       ),
+      maxTotalConnections: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_TOTAL_CONNECTIONS,
+        1024,
+        1,
+        1e5,
+        "relay total connection limit"
+      ),
       maxConnectionsPerRoute: boundedInteger(
         env.ROAMCODE_RELAY_MAX_CONNECTIONS_PER_ROUTE,
         64,
@@ -6759,25 +7422,27 @@ if (isRelayDirectExecution(import.meta.url, process.argv[1], embeddedContainerBu
 
 // src/relay-host-config.ts
 import {
-  chmodSync as chmodSync3,
-  closeSync as closeSync2,
-  constants as constants3,
-  fsyncSync as fsyncSync2,
-  lstatSync as lstatSync2,
-  openSync as openSync2,
+  closeSync as closeSync4,
+  constants as constants5,
+  fchmodSync as fchmodSync3,
+  fstatSync as fstatSync4,
+  fsyncSync as fsyncSync3,
+  lstatSync as lstatSync4,
+  openSync as openSync4,
   readFileSync as readFileSync4,
-  renameSync,
-  unlinkSync as unlinkSync2,
+  renameSync as renameSync2,
+  unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync3
 } from "fs";
 import { randomBytes as randomBytes9 } from "crypto";
-import { join as join6 } from "path";
+import { dirname as dirname3, join as join6 } from "path";
 var RELAY_HOST_CONFIG_FILE = "relay-host.json";
 var MAX_CONFIG_BYTES = 16 * 1024;
+var UNSAFE_DISPLAY_TEXT4 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeHostLabel(value) {
   if (typeof value !== "string") throw new Error("relay host label is required");
   const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(normalized)) {
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT4.test(normalized)) {
     throw new Error("relay host label must be 1-80 printable characters");
   }
   return normalized;
@@ -6804,23 +7469,49 @@ function relayHostConfigPath(dataDir) {
 }
 function existingConfigStat(path) {
   try {
-    return lstatSync2(path);
+    return lstatSync4(path);
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
 }
+function fsyncDirectory3(path) {
+  let descriptor;
+  try {
+    descriptor = openSync4(path, constants5.O_RDONLY);
+    fsyncSync3(descriptor);
+  } catch (error) {
+    const code = error.code;
+    if (code !== "EINVAL" && code !== "ENOTSUP" && !(process.platform === "win32" && code === "EPERM")) {
+      throw error;
+    }
+  } finally {
+    if (descriptor !== void 0) closeSync4(descriptor);
+  }
+}
 function readRelayHostConfig(dataDir) {
   const path = relayHostConfigPath(dataDir);
-  const stat8 = existingConfigStat(path);
-  if (!stat8) return void 0;
-  if (!stat8.isFile() || stat8.isSymbolicLink()) throw new Error("relay host config path must be a regular file");
-  if (stat8.size > MAX_CONFIG_BYTES) throw new Error("relay host config is too large");
+  const before = existingConfigStat(path);
+  if (!before) return void 0;
+  if (!before.isFile() || before.isSymbolicLink()) throw new Error("relay host config path must be a regular file");
+  if (before.size > MAX_CONFIG_BYTES) throw new Error("relay host config is too large");
+  if (typeof process.getuid === "function" && before.uid !== process.getuid()) {
+    throw new Error("relay host config must be owned by the current user");
+  }
+  let descriptor;
   let value;
   try {
-    value = JSON.parse(readFileSync4(path, "utf8"));
+    descriptor = openSync4(path, constants5.O_RDONLY | (constants5.O_NOFOLLOW ?? 0));
+    const opened = fstatSync4(descriptor);
+    if (!opened.isFile() || opened.size > MAX_CONFIG_BYTES || opened.dev !== before.dev || opened.ino !== before.ino || typeof process.getuid === "function" && opened.uid !== process.getuid()) {
+      throw new Error("relay host config changed while it was being opened");
+    }
+    fchmodSync3(descriptor, 384);
+    value = JSON.parse(readFileSync4(descriptor, "utf8"));
   } catch {
     throw new Error("relay host config is corrupt");
+  } finally {
+    if (descriptor !== void 0) closeSync4(descriptor);
   }
   if (value.version !== 1) throw new Error("relay host config has an unsupported version");
   const validated = validateCore({
@@ -6830,7 +7521,6 @@ function readRelayHostConfig(dataDir) {
     appUrl: value.appUrl,
     hostLabel: value.hostLabel
   });
-  chmodSync3(path, 384);
   return { version: 1, ...validated };
 }
 function writeRelayHostConfig(dataDir, input) {
@@ -6841,24 +7531,31 @@ function writeRelayHostConfig(dataDir, input) {
   if (existing) {
     const stat8 = existing;
     if (!stat8.isFile() || stat8.isSymbolicLink()) throw new Error("relay host config path must be a regular file");
+    if (typeof process.getuid === "function" && stat8.uid !== process.getuid()) {
+      throw new Error("relay host config must be owned by the current user");
+    }
   }
   const temporary = `${path}.${randomBytes9(12).toString("hex")}.tmp`;
   let descriptor;
   try {
-    descriptor = openSync2(temporary, constants3.O_CREAT | constants3.O_EXCL | constants3.O_WRONLY, 384);
+    descriptor = openSync4(
+      temporary,
+      constants5.O_CREAT | constants5.O_EXCL | constants5.O_WRONLY | (constants5.O_NOFOLLOW ?? 0),
+      384
+    );
+    fchmodSync3(descriptor, 384);
     writeFileSync3(descriptor, `${JSON.stringify(document)}
 `, "utf8");
-    fsyncSync2(descriptor);
-    closeSync2(descriptor);
+    fsyncSync3(descriptor);
+    closeSync4(descriptor);
     descriptor = void 0;
-    chmodSync3(temporary, 384);
-    renameSync(temporary, path);
-    chmodSync3(path, 384);
+    renameSync2(temporary, path);
+    fsyncDirectory3(dirname3(path));
     return { ...document };
   } finally {
-    if (descriptor !== void 0) closeSync2(descriptor);
+    if (descriptor !== void 0) closeSync4(descriptor);
     try {
-      unlinkSync2(temporary);
+      unlinkSync3(temporary);
     } catch {
     }
   }
@@ -6868,7 +7565,11 @@ function removeRelayHostConfig(dataDir) {
   const stat8 = existingConfigStat(path);
   if (!stat8) return false;
   if (!stat8.isFile() || stat8.isSymbolicLink()) throw new Error("relay host config path must be a regular file");
-  unlinkSync2(path);
+  if (typeof process.getuid === "function" && stat8.uid !== process.getuid()) {
+    throw new Error("relay host config must be owned by the current user");
+  }
+  unlinkSync3(path);
+  fsyncDirectory3(dirname3(path));
   return true;
 }
 function resolveRelayHostConfig(env, dataDir) {
@@ -7317,7 +8018,7 @@ function openPolicyStore(options) {
 
 // src/peer-store.ts
 import { randomBytes as randomBytes10 } from "crypto";
-import { chmodSync as chmodSync4 } from "fs";
+import { chmodSync } from "fs";
 import { createRequire as createRequire7 } from "module";
 var require8 = createRequire7(import.meta.url);
 var PeerRevisionConflictError = class extends Error {
@@ -7344,7 +8045,7 @@ function safeLabel5(value) {
   return label;
 }
 function isLoopback3(hostname) {
-  return hostname === "localhost" || hostname === "::1" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+  return hostname === "localhost" || hostname === "::1" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
 }
 function normalizePeerBaseUrl(value) {
   if (typeof value !== "string") throw new Error("peer URL is required");
@@ -7542,7 +8243,7 @@ function openPeerStore(options) {
     return createMemoryStore5(options);
   }
   const db = new Database(options.dbPath);
-  if (options.dbPath !== ":memory:") chmodSync4(options.dbPath, 384);
+  if (options.dbPath !== ":memory:") chmodSync(options.dbPath, 384);
   db.pragma("journal_mode = WAL");
   db.pragma("busy_timeout = 5000");
   db.exec(`
@@ -8608,7 +9309,7 @@ var normalizeCommandCenterLabel = normalizeLabel;
 // src/worktree-service.ts
 import { spawn } from "child_process";
 import { realpath as realpath2, stat as stat2 } from "fs/promises";
-import { basename as basename3, dirname, isAbsolute, relative, resolve as resolve4 } from "path";
+import { basename as basename3, dirname as dirname4, isAbsolute, relative, resolve as resolve4 } from "path";
 var MAX_GIT_OUTPUT_BYTES = 256 * 1024;
 var GIT_TIMEOUT_MS = 6e4;
 var WorktreeError = class extends Error {
@@ -8649,7 +9350,7 @@ function createWorktreeService(options) {
   };
   const confinedTarget = async (value) => {
     const lexical = resolve4(value);
-    const parent = await realpath2(dirname(lexical)).catch(() => void 0);
+    const parent = await realpath2(dirname4(lexical)).catch(() => void 0);
     if (!parent || !inside(await root(), parent)) {
       throw new WorktreeError("WORKTREE_OUTSIDE_ROOT", "worktree parent is outside FS_ROOT", 403);
     }
@@ -8724,7 +9425,7 @@ function createWorktreeService(options) {
     const gitRaw = (await runGit(candidate, ["rev-parse", "--git-dir"])).stdout.trim();
     const commonDir = await realpath2(resolve4(candidate, commonRaw));
     const gitDir = await realpath2(resolve4(candidate, gitRaw));
-    const repositoryPath = dirname(commonDir);
+    const repositoryPath = dirname4(commonDir);
     if (!inside(await root(), repositoryPath)) {
       throw new WorktreeError("WORKTREE_OUTSIDE_ROOT", "repository metadata is outside FS_ROOT", 403);
     }
@@ -8808,7 +9509,7 @@ function createWorktreeService(options) {
 import { createHash as createHash5, createPublicKey as createPublicKey2, verify as verifySignature } from "crypto";
 import { createRequire as createRequire9 } from "module";
 import { access, mkdir as mkdir2, open as open2, opendir, readFile as readFile2, realpath as realpath3, rename as rename2, rm, stat as stat3 } from "fs/promises";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join as join7, relative as relative2, resolve as resolve5 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join7, relative as relative2, resolve as resolve5 } from "path";
 import { z as z4 } from "zod";
 var require10 = createRequire9(import.meta.url);
 var MAX_PACKAGE_FILES = 512;
@@ -9080,7 +9781,7 @@ async function materialize(snapshot, target) {
   try {
     for (const file of snapshot.files) {
       const output = join7(temporary, ...file.path.split("/"));
-      await mkdir2(dirname2(output), { recursive: true, mode: 448 });
+      await mkdir2(dirname5(output), { recursive: true, mode: 448 });
       const handle = await open2(output, "wx", file.mode);
       try {
         await handle.writeFile(file.bytes);
@@ -9088,7 +9789,7 @@ async function materialize(snapshot, target) {
         await handle.close();
       }
     }
-    await mkdir2(dirname2(target), { recursive: true, mode: 448 });
+    await mkdir2(dirname5(target), { recursive: true, mode: 448 });
     await rename2(temporary, target).catch(async (error) => {
       if (error.code !== "EEXIST" && error.code !== "ENOTEMPTY")
         throw error;
@@ -10056,7 +10757,7 @@ var RateLimiter = class {
 };
 
 // src/vapid.ts
-import { chmodSync as chmodSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { join as join8 } from "path";
 import webpush from "web-push";
 function defaultGenerate() {
@@ -10075,7 +10776,7 @@ function resolveVapidKeys(opts) {
   const keys = (opts.generate ?? defaultGenerate)();
   ensureDataDir(opts.dataDir);
   writeFileSync4(path, JSON.stringify(keys), { mode: 384 });
-  chmodSync5(path, 384);
+  chmodSync2(path, 384);
   return keys;
 }
 
@@ -10091,6 +10792,22 @@ import multipart from "@fastify/multipart";
 import fastifyStatic from "@fastify/static";
 import { existsSync as existsSync3 } from "fs";
 import { resolve as resolve7, sep as sep2 } from "path";
+var PWA_BOOT_WATCHDOG_SHA256 = "sha256-tcgQYptaPeNGqJtts8Ft/5H4tf+s+jfSWQSguIhTp8k=";
+var PWA_CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  `script-src 'self' '${PWA_BOOT_WATCHDOG_SHA256}'`,
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data: blob:",
+  "font-src 'self' data:",
+  "connect-src 'self' https: wss: http://localhost:* http://127.0.0.1:* ws://localhost:* ws://127.0.0.1:*",
+  "worker-src 'self' blob:",
+  "manifest-src 'self'",
+  "frame-src 'self' https: blob:",
+  "object-src 'none'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'"
+].join("; ");
 var API_PATH_DENYLIST = [
   /^\/sessions/,
   /^\/resumable/,
@@ -10145,6 +10862,9 @@ function registerStatic(app, opts) {
   app.register(fastifyStatic, { root: opts.webDir, wildcard: false });
   app.addHook("onSend", (request, reply, payload, done) => {
     const contentType = String(reply.getHeader("content-type") ?? "");
+    if (isPublicForRequest(request.url)) {
+      reply.header("content-security-policy", PWA_CONTENT_SECURITY_POLICY).header("permissions-policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()").header("referrer-policy", "no-referrer").header("x-content-type-options", "nosniff").header("x-frame-options", "DENY").header("x-permitted-cross-domain-policies", "none");
+    }
     if (pathForGate(request.url) === "/sw.js" || contentType.includes("text/html")) {
       reply.header("cache-control", "no-store, no-cache, must-revalidate");
     }
@@ -10253,35 +10973,35 @@ import {
   renameSync as nodeRenameSync,
   writeFileSync as nodeWriteFileSync
 } from "fs";
-import { dirname as dirname5, join as join12 } from "path";
+import { dirname as dirname8, join as join12 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/managed-runtime.ts
 import { spawn as spawn3 } from "child_process";
 import { randomUUID as randomUUID5 } from "crypto";
 import {
-  chmodSync as chmodSync7,
+  chmodSync as chmodSync4,
   existsSync as existsSync5,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync5,
   mkdirSync as mkdirSync3,
-  openSync as openSync3,
-  closeSync as closeSync3,
-  readdirSync,
+  openSync as openSync5,
+  closeSync as closeSync5,
+  readdirSync as readdirSync2,
   readFileSync as readFileSync7,
   realpathSync as realpathSync2,
-  renameSync as renameSync2,
+  renameSync as renameSync3,
   rmSync,
   symlinkSync,
-  unlinkSync as unlinkSync3,
+  unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync6
 } from "fs";
 import { homedir as homedir2, tmpdir } from "os";
-import { basename as basename4, dirname as dirname4, join as join11, relative as relative4, resolve as resolve9 } from "path";
+import { basename as basename4, dirname as dirname7, join as join11, relative as relative4, resolve as resolve9 } from "path";
 
 // src/service-install.ts
-import { chmodSync as chmodSync6, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { homedir, platform } from "os";
-import { dirname as dirname3, join as join10 } from "path";
+import { dirname as dirname6, join as join10 } from "path";
 import { spawnSync } from "child_process";
 function escapeXml(value) {
   return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\"/g, "&quot;").replace(/'/g, "&apos;");
@@ -10291,7 +11011,7 @@ function quoteSystemd(value) {
 }
 function buildServicePath(nodePath, home) {
   return [
-    dirname3(nodePath),
+    dirname6(nodePath),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     join10(home, ".local", "bin"),
@@ -10365,7 +11085,7 @@ function persistRecord(dataDir, record) {
   mkdirSync2(dataDir, { recursive: true, mode: 448 });
   const path = join10(dataDir, "service.json");
   writeFileSync5(path, JSON.stringify(record, null, 2) + "\n", { mode: 384 });
-  chmodSync6(path, 384);
+  chmodSync3(path, 384);
 }
 function installService(ctx) {
   const home = ctx.home ?? homedir();
@@ -10388,7 +11108,7 @@ function installService(ctx) {
         servicePath
       })
     );
-    chmodSync6(path, 420);
+    chmodSync3(path, 420);
     const record = {
       manager: "launchd",
       label,
@@ -10420,7 +11140,7 @@ launchctl unload -w "${path}"  # stop`
         servicePath
       })
     );
-    chmodSync6(path, 420);
+    chmodSync3(path, 420);
     const record = {
       manager: "systemd",
       label,
@@ -10534,11 +11254,11 @@ function compareVersions(a, b) {
   return 0;
 }
 function atomicWrite(path, value, mode = 384) {
-  mkdirSync3(dirname4(path), { recursive: true, mode: 448 });
+  mkdirSync3(dirname7(path), { recursive: true, mode: 448 });
   const temp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
   writeFileSync6(temp, value, { mode });
-  chmodSync7(temp, mode);
-  renameSync2(temp, path);
+  chmodSync4(temp, mode);
+  renameSync3(temp, path);
 }
 function renderManagedLauncher(root, nodePath) {
   const q = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
@@ -10603,15 +11323,15 @@ function readPreviousVersion(root) {
   }
 }
 function acquireLock(path, now) {
-  mkdirSync3(dirname4(path), { recursive: true, mode: 448 });
+  mkdirSync3(dirname7(path), { recursive: true, mode: 448 });
   try {
-    const fd = openSync3(path, "wx", 384);
+    const fd = openSync5(path, "wx", 384);
     writeFileSync6(fd, JSON.stringify({ pid: process.pid, at: now }) + "\n");
-    closeSync3(fd);
+    closeSync5(fd);
   } catch {
     try {
-      if (now - lstatSync3(path).mtimeMs > LOCK_STALE_MS) {
-        unlinkSync3(path);
+      if (now - lstatSync5(path).mtimeMs > LOCK_STALE_MS) {
+        unlinkSync4(path);
         return acquireLock(path, now);
       }
     } catch {
@@ -10624,7 +11344,7 @@ function acquireLock(path, now) {
   }
   return () => {
     try {
-      unlinkSync3(path);
+      unlinkSync4(path);
     } catch {
     }
   };
@@ -10732,13 +11452,13 @@ async function smokeServer(serverEntry, dataDir, nodePath, log) {
 function replaceSymlink(link2, target) {
   const temp = `${link2}.${process.pid}.${randomUUID5()}.new`;
   try {
-    unlinkSync3(temp);
+    unlinkSync4(temp);
   } catch {
   }
-  const parent = realpathSync2(dirname4(link2));
+  const parent = realpathSync2(dirname7(link2));
   const canonicalTarget = realpathSync2(target);
   symlinkSync(relative4(parent, canonicalTarget), temp, "dir");
-  renameSync2(temp, link2);
+  renameSync3(temp, link2);
 }
 function trimLog(log) {
   return log.split("\n").slice(-20).join("\n").slice(-8e3);
@@ -10829,7 +11549,7 @@ async function installManagedRelease(opts) {
         ) + "\n"
       );
       if (existsSync5(release)) rmSync(release, { recursive: true, force: true });
-      renameSync2(stage, release);
+      renameSync3(stage, release);
     } else {
       const serverEntry = join11(release, "node_modules", "@roamcode.ai", "server", "dist", "start.js");
       if (!existsSync5(serverEntry)) throw new Error(`managed release ${opts.version} is incomplete`);
@@ -10861,7 +11581,7 @@ async function installManagedRelease(opts) {
     }
     status("done", "done");
     const keep = new Set([opts.version, fromVersion].filter((value) => !!value));
-    for (const name of readdirSync(paths.releases)) {
+    for (const name of readdirSync2(paths.releases)) {
       if (isStableVersion(name) && !keep.has(name))
         rmSync(join11(paths.releases, name), { recursive: true, force: true });
     }
@@ -10890,7 +11610,7 @@ async function installManagedRelease(opts) {
 }
 
 // src/updater.ts
-var RUNNING_VERSION = "1.1.0" ? "1.1.0".replace(/^v/, "") : packageVersion();
+var RUNNING_VERSION = "1.2.0" ? "1.2.0".replace(/^v/, "") : packageVersion();
 var RUNNING_BUILD = RUNNING_VERSION;
 var RELEASES_API = "https://api.github.com/repos/burakgon/roamcode/releases?per_page=100";
 var RELEASE_MANIFEST_ASSET = "roamcode-release.json";
@@ -11007,7 +11727,7 @@ function manifestIntegrities(value, version) {
   return integrities;
 }
 function moduleDir() {
-  return dirname5(fileURLToPath2(import.meta.url));
+  return dirname8(fileURLToPath2(import.meta.url));
 }
 var Updater = class {
   fs;
@@ -11393,7 +12113,7 @@ function createClaudeVersionProbe(deps) {
 }
 
 // src/terminal-manager.ts
-import { unlinkSync as unlinkSync4, readdirSync as readdirSync2 } from "fs";
+import { unlinkSync as unlinkSync5, readdirSync as readdirSync3 } from "fs";
 import { join as join14 } from "path";
 
 // src/terminal-process.ts
@@ -11402,17 +12122,21 @@ import { EventEmitter } from "events";
 import { createRequire as createRequire12 } from "module";
 
 // src/node-pty-runtime.ts
-import { chmodSync as chmodSync8, existsSync as existsSync6 } from "fs";
+import { accessSync, chmodSync as chmodSync5, constants as constants6, existsSync as existsSync6 } from "fs";
 import { createRequire as createRequire11 } from "module";
-import { dirname as dirname6, join as join13, resolve as resolve10 } from "path";
+import { dirname as dirname9, join as join13, resolve as resolve10 } from "path";
 var require12 = createRequire11(import.meta.url);
 function ensureNodePtySpawnHelperExecutable(resolveNodePty = () => require12.resolve("node-pty"), platform2 = process.platform, arch = process.arch) {
-  if (platform2 !== "darwin") return;
+  if (platform2 !== "darwin") return true;
   try {
-    const packageRoot = resolve10(dirname6(resolveNodePty()), "..");
+    const packageRoot = resolve10(dirname9(resolveNodePty()), "..");
     const helper = join13(packageRoot, "prebuilds", `${platform2}-${arch}`, "spawn-helper");
-    if (existsSync6(helper)) chmodSync8(helper, 493);
+    if (!existsSync6(helper)) return true;
+    chmodSync5(helper, 493);
+    accessSync(helper, constants6.X_OK);
+    return true;
   } catch {
+    return false;
   }
 }
 
@@ -11589,7 +12313,7 @@ var TerminalProcess = class extends EventEmitter {
   }
 };
 var defaultPtySpawn = (file, args, opts) => {
-  ensureNodePtySpawnHelperExecutable();
+  if (!ensureNodePtySpawnHelperExecutable()) throw new Error("node-pty spawn helper is not executable");
   const pty = require13("node-pty");
   return pty.spawn(file, args, opts);
 };
@@ -12025,7 +12749,7 @@ var TerminalManager = class {
     const dir = this.attachConfig.dataDir;
     let names;
     try {
-      names = readdirSync2(dir);
+      names = readdirSync3(dir);
     } catch {
       return 0;
     }
@@ -12036,7 +12760,7 @@ var TerminalManager = class {
       const sessionId = m?.[1] ?? (name.startsWith(CODEX_MCP_TOKEN_PREFIX) ? name.slice(CODEX_MCP_TOKEN_PREFIX.length) : void 0);
       if (!sessionId || liveIds.has(sessionId)) continue;
       try {
-        unlinkSync4(join14(dir, name));
+        unlinkSync5(join14(dir, name));
         removed += 1;
       } catch {
       }
@@ -12697,7 +13421,9 @@ function tmuxOnPath() {
 }
 function ptyLoads() {
   try {
-    require14.resolve("node-pty");
+    const entry = require14.resolve("node-pty");
+    if (!ensureNodePtySpawnHelperExecutable(() => entry)) return false;
+    require14("node-pty");
     return true;
   } catch {
     return false;
@@ -12729,11 +13455,11 @@ function listTmuxSessions(run = defaultRun) {
 }
 
 // src/providers/provider-artifacts.ts
-import { chmodSync as chmodSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "fs";
+import { chmodSync as chmodSync6, unlinkSync as unlinkSync6, writeFileSync as writeFileSync7 } from "fs";
 function cleanupProviderArtifacts(paths) {
   for (const path of paths) {
     try {
-      unlinkSync5(path);
+      unlinkSync6(path);
     } catch {
     }
   }
@@ -12748,7 +13474,7 @@ function writeProviderArtifact0600(path, content, context, ownedPaths) {
   ownedPaths.push(path);
   try {
     writeFileSync7(path, content, { mode: 384 });
-    chmodSync9(path, 384);
+    chmodSync6(path, 384);
     return true;
   } catch {
     cleanupProviderArtifacts([path]);
@@ -13780,6 +14506,30 @@ function buildOpenApiDocument(options) {
           }
         }
       },
+      "/api/v1/relay/pairing/cancel": {
+        post: {
+          operationId: "cancelRelayPairing",
+          description: "Revokes an unused broker bootstrap before deleting its local one-use pairing state. A raced completed enrollment is never silently revoked.",
+          parameters: [idempotency],
+          requestBody: {
+            required: true,
+            content: json({
+              type: "object",
+              required: ["deviceId"],
+              additionalProperties: false,
+              properties: { deviceId: { type: "string", minLength: 1, maxLength: 128 } }
+            })
+          },
+          responses: { "204": response("Cancelled remote pairing"), ...errorResponses }
+        }
+      },
+      "/api/v1/relay/status": {
+        get: {
+          operationId: "getRelayStatus",
+          description: "Returns privacy-bounded host connector health without routing identifiers or capabilities.",
+          responses: { "200": response("Relay connector health", ref("RelayStatus")), ...errorResponses }
+        }
+      },
       "/api/v1/team": {
         get: {
           operationId: "getTeam",
@@ -14335,6 +15085,18 @@ function buildOpenApiDocument(options) {
             hostIdentityFingerprint: { type: "string", pattern: "^sha256:[A-Za-z0-9_-]{43}$" }
           }
         },
+        RelayStatus: {
+          type: "object",
+          required: ["configured", "pairingAvailable", "status", "activeDevices", "reconnects"],
+          additionalProperties: false,
+          properties: {
+            configured: { type: "boolean" },
+            pairingAvailable: { type: "boolean" },
+            status: { enum: ["not-configured", "idle", "connecting", "online", "reconnecting", "stopped"] },
+            activeDevices: { type: "integer", minimum: 0 },
+            reconnects: { type: "integer", minimum: 0 }
+          }
+        },
         WorkspaceCreate: {
           type: "object",
           required: ["cwd"],
@@ -15879,6 +16641,10 @@ function createServer(config, deps = {}) {
     if (device) return { actorType: "device", actorId: device.id, label: device.name };
     return hostPrincipal();
   };
+  const currentDeviceIdForRequest = (request) => {
+    const principal = authenticatedPrincipals.get(request);
+    return principal?.actorType === "device" || principal?.actorType === "relay" ? principal.actorId : void 0;
+  };
   const teamResourceForSession = (sessionId) => ({
     hostId: commandStore.getHost().id,
     ...commandStore.placementForSession(sessionId)?.workspaceId ? { workspaceId: commandStore.placementForSession(sessionId).workspaceId } : {}
@@ -16810,6 +17576,25 @@ function createServer(config, deps = {}) {
       reply.code(500).send({ error: "could not start device pairing" });
     }
   });
+  app.post("/pairing/cancel", { bodyLimit: 8 * 1024 }, async (request, reply) => {
+    const secret = request.body?.secret;
+    if (typeof secret !== "string" || !/^rcp_[A-Za-z0-9_-]{43}$/.test(secret)) {
+      reply.code(400).send({ code: "INVALID_PAIRING", error: "valid pairing capability is required" });
+      return;
+    }
+    let cancelled = false;
+    try {
+      cancelled = deviceStore.cancelPairing(secret);
+    } catch {
+      reply.code(500).send({ code: "PAIRING_CANCEL_FAILED", error: "could not cancel pairing" });
+      return;
+    }
+    if (!cancelled) {
+      reply.code(404).send({ code: "PAIRING_NOT_FOUND", error: "pairing is expired, cancelled, or already used" });
+      return;
+    }
+    reply.header("cache-control", "no-store").code(204).send();
+  });
   app.post("/api/v1/relay/pairing", async (_request, reply) => {
     const relay = deps.relayPairing;
     if (!relay) {
@@ -16819,9 +17604,14 @@ function createServer(config, deps = {}) {
       });
       return;
     }
+    let pendingDeviceId;
     try {
       const pairing = deviceStore.issueRelayPairing();
+      pendingDeviceId = pairing.deviceId;
       const deviceCredential = (relay.generateDeviceCredential ?? (() => generateRelayCredential("rrd")))();
+      if (!/^rrd_[A-Za-z0-9_-]{43}$/.test(deviceCredential)) {
+        throw new Error("invalid generated relay device credential");
+      }
       await relay.provisioner.putDevice(pairing.deviceId, relayCredentialHash(deviceCredential), pairing.expiresAt);
       const payload = {
         v: 1,
@@ -16838,9 +17628,65 @@ function createServer(config, deps = {}) {
       };
       reply.header("cache-control", "no-store").code(201).send({ pairing: payload, url: buildRelayPairingUrl(relay.appUrl, payload) });
     } catch {
+      if (pendingDeviceId) {
+        try {
+          deviceStore.cancelRelayPairing(pendingDeviceId);
+        } catch {
+        }
+        await relay.provisioner.revokeDevice(pendingDeviceId).catch(() => {
+        });
+      }
       reply.code(502).send({ code: "RELAY_PAIRING_FAILED", error: "could not prepare relay pairing" });
     }
   });
+  app.post(
+    "/api/v1/relay/pairing/cancel",
+    { bodyLimit: 8 * 1024 },
+    async (request, reply) => {
+      const relay = deps.relayPairing;
+      if (!relay) {
+        reply.code(409).send({ code: "RELAY_PAIRING_UNAVAILABLE", error: "relay pairing is not configured" });
+        return;
+      }
+      const deviceId = request.body?.deviceId;
+      if (typeof deviceId !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(deviceId)) {
+        reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "valid relay device id is required" });
+        return;
+      }
+      try {
+        const cancellation = deviceStore.beginRelayPairingCancellation(deviceId);
+        if (cancellation.status === "busy") {
+          reply.code(409).send({ code: "RELAY_PAIRING_CANCEL_IN_PROGRESS", error: "relay pairing cancellation is in progress" });
+          return;
+        }
+        if (cancellation.status === "missing") {
+          reply.code(404).send({ code: "RELAY_PAIRING_NOT_FOUND", error: "relay pairing is expired or already used" });
+          return;
+        }
+        try {
+          await relay.provisioner.revokeDevice(deviceId);
+        } catch {
+          deviceStore.releaseRelayPairingCancellation(cancellation.reservation);
+          throw new Error("broker revocation failed");
+        }
+        deviceStore.finishRelayPairingCancellation(cancellation.reservation);
+        reply.header("cache-control", "no-store").code(204).send();
+      } catch {
+        reply.code(502).send({ code: "RELAY_PAIRING_CANCEL_FAILED", error: "could not cancel relay pairing" });
+      }
+    }
+  );
+  app.get("/api/v1/relay/status", async (_request, reply) => {
+    const configured = deps.relayEnabled === true;
+    const metrics = configured ? deps.relayStatus?.() : void 0;
+    return reply.header("cache-control", "no-store").send({
+      configured,
+      pairingAvailable: configured && deps.relayPairing !== void 0,
+      status: configured ? metrics?.status ?? "connecting" : "not-configured",
+      activeDevices: metrics?.activeChannels ?? 0,
+      reconnects: metrics?.reconnects ?? 0
+    });
+  });
   app.post(
     "/pairing/claim",
     { bodyLimit: 8 * 1024 },
@@ -16875,8 +17721,7 @@ function createServer(config, deps = {}) {
     }
   );
   app.get("/devices", async (request, reply) => {
-    const presented = extractBearerToken(request.headers.authorization);
-    const currentDeviceId = presented ? deviceStore.authenticate(presented)?.id : void 0;
+    const currentDeviceId = currentDeviceIdForRequest(request);
     reply.header("cache-control", "no-store").send({
       devices: deviceStore.list(),
       ...currentDeviceId ? { currentDeviceId } : {}
@@ -18248,8 +19093,7 @@ data: ${JSON.stringify(data)}
     }
   });
   app.get("/api/v1/devices", async (request, reply) => {
-    const presented = extractBearerToken(request.headers.authorization);
-    const currentDeviceId = presented ? deviceStore.authenticate(presented)?.id : void 0;
+    const currentDeviceId = currentDeviceIdForRequest(request);
     reply.header("cache-control", "no-store").send({
       devices: deviceStore.list(),
       ...currentDeviceId ? { currentDeviceId } : {}
@@ -20617,7 +21461,7 @@ function createUsageRunner(opts) {
     let child;
     try {
       const ptySpawn = opts.ptySpawn ?? ((file, args, options) => {
-        ensureNodePtySpawnHelperExecutable();
+        if (!ensureNodePtySpawnHelperExecutable()) throw new Error("node-pty spawn helper is not executable");
         const pty = require16("node-pty");
         return pty.spawn(file, args, options);
       });
@@ -22578,10 +23422,10 @@ var CodexLatestService = class {
 
 // src/providers/codex-executable.ts
 import { execFile } from "child_process";
-import { constants as constants4 } from "fs";
+import { constants as constants7 } from "fs";
 import { access as access2, chmod, copyFile, link, realpath as realpath7, rename as rename3, rm as rm2, rmdir as rmdir2, stat as stat7 } from "fs/promises";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename5, delimiter, dirname as dirname7, isAbsolute as isAbsolute9, join as join17, sep as sep5 } from "path";
+import { basename as basename5, delimiter, dirname as dirname10, isAbsolute as isAbsolute9, join as join17, sep as sep5 } from "path";
 var CODEX_EXECUTABLE_PROBE_TIMEOUT_MS = 5e3;
 var OPENAI_CODE_SIGNING_TEAM_ID = "2DC432GLL2";
 var MAX_CODEX_BYTES = 1024 * 1024 * 1024;
@@ -22633,7 +23477,7 @@ async function defaultResolveExecutable(command, env) {
   const candidates = isAbsolute9(command) || command.includes(sep5) ? [command] : (env.PATH ?? process.env.PATH ?? "").split(delimiter).filter(Boolean).map((entry) => join17(entry, command));
   for (const candidate of candidates) {
     try {
-      await access2(candidate, constants4.X_OK);
+      await access2(candidate, constants7.X_OK);
       return await realpath7(candidate);
     } catch {
     }
@@ -22691,7 +23535,7 @@ async function removeLegacyManagedCopy(dataDir) {
 async function repairHomebrewExecutable(source, sourceStat, env, deps) {
   if (!await deps.verifyOfficialSignature(source)) return false;
   const nonce = randomUUID10();
-  const directory = dirname7(source);
+  const directory = dirname10(source);
   const name = basename5(source);
   const temporary = join17(directory, `.${name}.roamcode-repair-${nonce}`);
   const backup = join17(directory, `.${name}.roamcode-backup-${nonce}`);
@@ -22700,7 +23544,7 @@ async function repairHomebrewExecutable(source, sourceStat, env, deps) {
   let committed = false;
   let preserveBackup = false;
   try {
-    await copyFile(source, temporary, constants4.COPYFILE_EXCL);
+    await copyFile(source, temporary, constants7.COPYFILE_EXCL);
     await chmod(temporary, sourceStat.mode & 511);
     if (!await deps.clearExtendedAttributes(temporary)) return false;
     if (!await deps.verifyOfficialSignature(temporary)) return false;
@@ -23128,6 +23972,11 @@ async function startServer(env = process.env) {
     codexThreadResolver: (cwd) => new CodexThreadResolver({ inventory: createCodexThreadInventory(codexRpc, { cwd }) }),
     disposeProviders: () => codexClient.stop(),
     relayEnabled: relayConfig !== void 0,
+    relayStatus: () => relayHost?.metrics() ?? {
+      status: relayConfig ? "connecting" : "stopped",
+      activeChannels: 0,
+      reconnects: 0
+    },
     relayPairing: relayConfig?.appUrl && relayProvisioner ? {
       appUrl: relayConfig.appUrl,
       label: relayConfig.hostLabel,
@@ -23227,6 +24076,7 @@ export {
   BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES,
   BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE,
   BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES,
+  BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS,
   BLIND_RELAY_PROTOCOL_VERSION,
   CHECK_CACHE_MS,
   CLASSIFIER_TESTED_UP_TO,
@@ -23257,6 +24107,8 @@ export {
   PAIRING_TTL_MS,
   PRESENCE_HEARTBEAT_MS,
   PRESENCE_TTL_MS,
+  PWA_BOOT_WATCHDOG_SHA256,
+  PWA_CONTENT_SECURITY_POLICY,
   PeerRequestError,
   PeerRevisionConflictError,
   PluginRuntimeError,