@roamcode.ai/server 1.1.0 → 1.3.0

package/dist/container/relay.js

@@ -1,5 +1,14 @@
 // src/relay-start.ts
-import { readFileSync as readFileSync2, realpathSync } from "fs";
+import {
+  closeSync as closeSync2,
+  constants as constants2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  realpathSync
+} from "fs";
 import { join as join2, resolve } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 
@@ -25,6 +34,7 @@ var PLAN_DEFAULTS = {
   team: { maxRoutes: 25, maxDevicesPerRoute: 64 },
   enterprise: { maxRoutes: 500, maxDevicesPerRoute: 500 }
 };
+var UNSAFE_TERMINAL_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId(value) {
   if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
     throw new Error("invalid relay account id");
@@ -34,7 +44,7 @@ function safeId(value) {
 function safeLabel(value) {
   if (typeof value !== "string") throw new Error("relay account label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 120 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) {
+  if (!label || label.length > 120 || UNSAFE_TERMINAL_TEXT.test(label)) {
     throw new Error("invalid relay account label");
   }
   return label;
@@ -63,6 +73,33 @@ function safeHash(value) {
   }
   return value;
 }
+function safeLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay account credential lookup");
+  }
+  return value;
+}
+function credentialMaterial(input) {
+  if (typeof input === "string") {
+    return {
+      credentialHash: relayAccountCredentialHash(input),
+      credentialLookup: relayAccountCredentialLookup(input)
+    };
+  }
+  if ("credential" in input && input.credential !== void 0) {
+    if (input.credentialHash !== void 0 || input.credentialLookup !== void 0) {
+      throw new Error("relay account credential must be raw or pre-hashed, not both");
+    }
+    return {
+      credentialHash: relayAccountCredentialHash(input.credential),
+      credentialLookup: relayAccountCredentialLookup(input.credential)
+    };
+  }
+  return {
+    credentialHash: safeHash(input.credentialHash),
+    credentialLookup: safeLookup(input.credentialLookup)
+  };
+}
 function hashMatches(expected, credential) {
   try {
     const left = Buffer.from(safeHash(expected));
@@ -72,6 +109,18 @@ function hashMatches(expected, credential) {
     return false;
   }
 }
+function storedCredentialMatches(expectedHash, expectedLookup, credential) {
+  try {
+    const actual = credentialMaterial(credential);
+    const expectedHashBytes = Buffer.from(safeHash(expectedHash));
+    const actualHashBytes = Buffer.from(actual.credentialHash);
+    const expectedLookupBytes = Buffer.from(safeLookup(expectedLookup));
+    const actualLookupBytes = Buffer.from(actual.credentialLookup);
+    return expectedHashBytes.length === actualHashBytes.length && expectedLookupBytes.length === actualLookupBytes.length && timingSafeEqual(expectedHashBytes, actualHashBytes) && timingSafeEqual(expectedLookupBytes, actualLookupBytes);
+  } catch {
+    return false;
+  }
+}
 function safePlan(value) {
   if (value !== "free" && value !== "team" && value !== "enterprise") throw new Error("invalid relay account plan");
   return value;
@@ -90,20 +139,40 @@ function safeStatus(value) {
   return value;
 }
 function clone(record) {
-  return { ...record };
+  return {
+    id: record.id,
+    label: record.label,
+    status: record.status,
+    plan: record.plan,
+    maxRoutes: record.maxRoutes,
+    maxDevicesPerRoute: record.maxDevicesPerRoute,
+    revision: record.revision,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt
+  };
 }
 function createMemoryStore(options) {
   const accounts = /* @__PURE__ */ new Map();
   const lookup = /* @__PURE__ */ new Map();
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const id = lookup.get(credentialLookup);
+    const record = id ? accounts.get(id) : void 0;
+    return record && record.status !== "deleted" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
+  };
   return {
     mode: "memory",
     createAccount(input, now = Date.now()) {
-      const id = safeId(generateAccountId());
+      const id = safeId(input.id ?? generateAccountId());
       if (accounts.has(id)) throw new Error("relay account already exists");
       const plan = safePlan(input.plan ?? "free");
-      const credentialHash = relayAccountCredentialHash(input.credential);
-      const credentialLookup = relayAccountCredentialLookup(input.credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(input);
       if (lookup.has(credentialLookup)) throw new Error("relay account credential already exists");
       const defaults = PLAN_DEFAULTS[plan];
       const record = {
@@ -135,16 +204,18 @@ function createMemoryStore(options) {
     listAccounts({ includeDeleted = false } = {}) {
       return [...accounts.values()].filter((record) => includeDeleted || record.status !== "deleted").sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map(clone);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
+    },
+    credentialMatches(id, credential) {
       try {
-        credentialLookup = relayAccountCredentialLookup(credential);
+        const record = accounts.get(safeId(id));
+        return !!record && storedCredentialMatches(record.credentialHash, record.credentialLookup, credential);
       } catch {
-        return void 0;
+        return false;
       }
-      const id = lookup.get(credentialLookup);
-      const record = id ? accounts.get(id) : void 0;
-      return record?.status === "active" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
       const current = accounts.get(safeId(id));
@@ -182,8 +253,7 @@ function createMemoryStore(options) {
       if (!current) return void 0;
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const credentialHash = relayAccountCredentialHash(credential);
-      const credentialLookup = relayAccountCredentialLookup(credential);
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
       const owner = lookup.get(credentialLookup);
       if (owner && owner !== current.id) throw new Error("relay account credential already exists");
       lookup.delete(current.credentialLookup);
@@ -204,6 +274,17 @@ function createMemoryStore(options) {
     }
   };
 }
+function normalizeSqliteAccountConstraint(error) {
+  const code = error?.code;
+  const message = error instanceof Error ? error.message : "";
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.credential_lookup")) {
+    throw new Error("relay account credential already exists");
+  }
+  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.id")) {
+    throw new Error("relay account already exists");
+  }
+  throw error;
+}
 function fromRow(row) {
   return {
     id: row.id,
@@ -249,10 +330,21 @@ function openRelayAccountStore(options) {
   `);
   const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
   const rowById = (id) => db.prepare("SELECT * FROM relay_accounts WHERE id = ?").get(id);
+  const verifyCredential = (credential) => {
+    let credentialLookup;
+    try {
+      credentialLookup = relayAccountCredentialLookup(credential);
+    } catch {
+      return;
+    }
+    const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status != 'deleted'").get(credentialLookup);
+    return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
+  };
   const createAccount = db.transaction((input, now) => {
-    const id = safeId(generateAccountId());
+    const id = safeId(input.id ?? generateAccountId());
     if (rowById(id)) throw new Error("relay account already exists");
     const plan = safePlan(input.plan ?? "free");
+    const { credentialHash, credentialLookup } = credentialMaterial(input);
     const defaults = PLAN_DEFAULTS[plan];
     const record = {
       id,
@@ -265,24 +357,28 @@ function openRelayAccountStore(options) {
       createdAt: now,
       updatedAt: now
     };
-    db.prepare(
-      `INSERT INTO relay_accounts
-       (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
-        credential_lookup, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(
-      record.id,
-      record.label,
-      record.status,
-      record.plan,
-      record.maxRoutes,
-      record.maxDevicesPerRoute,
-      record.revision,
-      relayAccountCredentialHash(input.credential),
-      relayAccountCredentialLookup(input.credential),
-      record.createdAt,
-      record.updatedAt
-    );
+    try {
+      db.prepare(
+        `INSERT INTO relay_accounts
+         (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
+          credential_lookup, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      ).run(
+        record.id,
+        record.label,
+        record.status,
+        record.plan,
+        record.maxRoutes,
+        record.maxDevicesPerRoute,
+        record.revision,
+        credentialHash,
+        credentialLookup,
+        record.createdAt,
+        record.updatedAt
+      );
+    } catch (error) {
+      normalizeSqliteAccountConstraint(error);
+    }
     return record;
   });
   return {
@@ -299,19 +395,22 @@ function openRelayAccountStore(options) {
       ).all();
       return rows.map(fromRow);
     },
+    verifyCredential,
     authenticate(credential) {
-      let credentialLookup;
+      const record = verifyCredential(credential);
+      return record?.status === "active" ? record : void 0;
+    },
+    credentialMatches(id, credential) {
       try {
-        credentialLookup = relayAccountCredentialLookup(credential);
+        const row = rowById(safeId(id));
+        return !!row && storedCredentialMatches(row.credential_hash, row.credential_lookup, credential);
       } catch {
-        return void 0;
+        return false;
       }
-      const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status = 'active'").get(credentialLookup);
-      return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
     },
     updateAccount(id, input, expectedRevision, now = Date.now()) {
-      const safeAccountId = safeId(id);
-      const currentRow = rowById(safeAccountId);
+      const safeAccountId2 = safeId(id);
+      const currentRow = rowById(safeAccountId2);
       if (!currentRow) return void 0;
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
@@ -353,35 +452,35 @@ function openRelayAccountStore(options) {
         expectedRevision
       );
       if (result.changes !== 1) {
-        const latest = rowById(safeAccountId);
+        const latest = rowById(safeAccountId2);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
         return void 0;
       }
       return next;
     },
     rotateCredential(id, credential, expectedRevision, now = Date.now()) {
-      const safeAccountId = safeId(id);
-      const currentRow = rowById(safeAccountId);
+      const safeAccountId2 = safeId(id);
+      const currentRow = rowById(safeAccountId2);
       if (!currentRow) return void 0;
       const current = fromRow(currentRow);
       if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
       if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const result = db.prepare(
-        `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
-           updated_at = ? WHERE id = ? AND revision = ?`
-      ).run(
-        relayAccountCredentialHash(credential),
-        relayAccountCredentialLookup(credential),
-        now,
-        safeAccountId,
-        expectedRevision
-      );
+      const { credentialHash, credentialLookup } = credentialMaterial(credential);
+      let result;
+      try {
+        result = db.prepare(
+          `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
+             updated_at = ? WHERE id = ? AND revision = ?`
+        ).run(credentialHash, credentialLookup, now, safeAccountId2, expectedRevision);
+      } catch (error) {
+        normalizeSqliteAccountConstraint(error);
+      }
       if (result.changes !== 1) {
-        const latest = rowById(safeAccountId);
+        const latest = rowById(safeAccountId2);
         if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
         return void 0;
       }
-      return fromRow(rowById(safeAccountId));
+      return fromRow(rowById(safeAccountId2));
     },
     close: () => db.close()
   };
@@ -391,6 +490,7 @@ function openRelayAccountStore(options) {
 import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import { createRequire as createRequire2 } from "module";
 var require3 = createRequire2(import.meta.url);
+var UNSAFE_DISPLAY_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeId2(value, field) {
   if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
   return value;
@@ -404,7 +504,7 @@ function safeOwnerAccountId(value) {
 function safeLabel2(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(normalized)) {
+  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT.test(normalized)) {
     throw new Error("invalid relay route label");
   }
   return normalized;
@@ -446,22 +546,72 @@ function cloneRoute(route) {
   return { ...route };
 }
 function cloneDevice(device) {
-  return { ...device };
+  return {
+    routeId: device.routeId,
+    deviceId: device.deviceId,
+    credentialHash: device.credentialHash,
+    createdAt: device.createdAt,
+    updatedAt: device.updatedAt,
+    ...device.expiresAt === void 0 ? {} : { expiresAt: device.expiresAt }
+  };
+}
+function credentialOverlap(current, credentialHash, expiresAt, now) {
+  if (!current || expiresAt !== void 0) return {};
+  if (current.expiresAt !== void 0) {
+    if (current.credentialHash === credentialHash) {
+      throw new Error("relay bootstrap promotion must rotate the device credential");
+    }
+    return {
+      previousCredentialHash: current.credentialHash,
+      previousCredentialExpiresAt: current.expiresAt
+    };
+  }
+  if (current.previousCredentialHash !== void 0 && current.previousCredentialExpiresAt !== void 0 && current.previousCredentialExpiresAt >= now) {
+    if (current.previousCredentialHash === credentialHash) {
+      throw new Error("relay bootstrap credential cannot become durable");
+    }
+    return {
+      previousCredentialHash: current.previousCredentialHash,
+      previousCredentialExpiresAt: current.previousCredentialExpiresAt
+    };
+  }
+  return {};
 }
 function createMemoryStore2(options) {
   const routes = /* @__PURE__ */ new Map();
   const devices = /* @__PURE__ */ new Map();
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
   const deviceKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
-  const listRoutes = (now, ownerAccountId) => [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
-    id: route.id,
-    label: route.label,
-    deviceCount: [...devices.values()].filter(
-      (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
-    ).length,
-    createdAt: route.createdAt,
-    updatedAt: route.updatedAt
-  }));
+  const pruneExpiredDevices = (now) => {
+    for (const [key, device] of devices) {
+      if (device.expiresAt !== void 0 && device.expiresAt < now) devices.delete(key);
+      else if (device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt < now) {
+        delete device.previousCredentialHash;
+        delete device.previousCredentialExpiresAt;
+      }
+    }
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const key = deviceKey(routeId, deviceId);
+    const device = devices.get(key);
+    if (device?.expiresAt !== void 0 && device.expiresAt < now) {
+      devices.delete(key);
+      return;
+    }
+    return device;
+  };
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
+      id: route.id,
+      label: route.label,
+      deviceCount: [...devices.values()].filter(
+        (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
+      ).length,
+      createdAt: route.createdAt,
+      updatedAt: route.updatedAt
+    }));
+  };
   return {
     mode: "memory",
     createRoute(input, now = Date.now()) {
@@ -487,6 +637,7 @@ function createMemoryStore2(options) {
       return listRoutes(now, safeOwnerAccountId(ownerAccountId));
     },
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const safeRouteId = safeId2(routeId, "route id");
       return [...devices.values()].filter(
         (device) => device.routeId === safeRouteId && (device.expiresAt === void 0 || device.expiresAt >= now)
@@ -510,18 +661,22 @@ function createMemoryStore2(options) {
       return !!route && hashMatches2(route.hostCredentialHash, credential);
     },
     putDevice(input, now = Date.now()) {
+      pruneExpiredDevices(now);
       const routeId = safeId2(input.routeId, "route id");
       if (!routes.has(routeId)) throw new Error("relay route not found");
       const deviceId = safeId2(input.deviceId, "device id");
       const key = deviceKey(routeId, deviceId);
       const current = devices.get(key);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.createdAt ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt },
+        ...credentialOverlap(current, credentialHash, expiresAt, now)
       };
       devices.set(key, device);
       const route = routes.get(routeId);
@@ -529,12 +684,12 @@ function createMemoryStore2(options) {
       return cloneDevice(device);
     },
     getDevice(routeId, deviceId, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId2(routeId, "route id"), safeId2(deviceId, "device id")));
-      return device && (device.expiresAt === void 0 || device.expiresAt >= now) ? cloneDevice(device) : void 0;
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return device ? cloneDevice(device) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const device = devices.get(deviceKey(safeId2(routeId, "route id"), safeId2(deviceId, "device id")));
-      return !!device && (device.expiresAt === void 0 || device.expiresAt >= now) && hashMatches2(device.credentialHash, credential);
+      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!device && (hashMatches2(device.credentialHash, credential) || device.previousCredentialHash !== void 0 && device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt >= now && hashMatches2(device.previousCredentialHash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId2(routeId, "route id");
@@ -596,6 +751,8 @@ function openRelayRouteStore(options) {
       route_id TEXT NOT NULL REFERENCES relay_routes(id) ON DELETE CASCADE,
       device_id TEXT NOT NULL,
       credential_hash TEXT NOT NULL,
+      previous_credential_hash TEXT,
+      previous_credential_expires_at INTEGER,
       created_at INTEGER NOT NULL,
       updated_at INTEGER NOT NULL,
       expires_at INTEGER,
@@ -606,6 +763,12 @@ function openRelayRouteStore(options) {
   if (!relayDeviceColumns.some((column) => column.name === "expires_at")) {
     db.exec("ALTER TABLE relay_route_devices ADD COLUMN expires_at INTEGER");
   }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_hash")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_hash TEXT");
+  }
+  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_expires_at")) {
+    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_expires_at INTEGER");
+  }
   const relayRouteColumns = db.prepare("PRAGMA table_info(relay_routes)").all();
   if (!relayRouteColumns.some((column) => column.name === "owner_account_id")) {
     db.exec("ALTER TABLE relay_routes ADD COLUMN owner_account_id TEXT");
@@ -614,6 +777,21 @@ function openRelayRouteStore(options) {
   const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
   const getRoute = (id) => db.prepare("SELECT * FROM relay_routes WHERE id = ?").get(id);
   const getDevice = (routeId, deviceId) => db.prepare("SELECT * FROM relay_route_devices WHERE route_id = ? AND device_id = ?").get(routeId, deviceId);
+  const pruneExpiredDevices = (now) => {
+    db.prepare("DELETE FROM relay_route_devices WHERE expires_at IS NOT NULL AND expires_at < ?").run(now);
+    db.prepare(
+      `UPDATE relay_route_devices SET previous_credential_hash = NULL, previous_credential_expires_at = NULL
+       WHERE previous_credential_expires_at IS NOT NULL AND previous_credential_expires_at < ?`
+    ).run(now);
+  };
+  const liveDevice = (routeId, deviceId, now) => {
+    const row = getDevice(routeId, deviceId);
+    if (row?.expires_at !== null && row?.expires_at !== void 0 && row.expires_at < now) {
+      db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(routeId, deviceId);
+      return;
+    }
+    return row;
+  };
   const createRoute = db.transaction(
     (input, now) => {
       const id = safeId2(input.id ?? generateRouteId(), "route id");
@@ -644,25 +822,44 @@ function openRelayRouteStore(options) {
     (input, now) => {
       const routeId = safeId2(input.routeId, "route id");
       if (!getRoute(routeId)) throw new Error("relay route not found");
+      pruneExpiredDevices(now);
       const deviceId = safeId2(input.deviceId, "device id");
       const current = getDevice(routeId, deviceId);
+      const credentialHash = safeCredentialHash(input.credentialHash);
+      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
+      const overlap = credentialOverlap(
+        current ? {
+          ...deviceFromRow(current),
+          ...current.previous_credential_hash === null || current.previous_credential_hash === void 0 ? {} : { previousCredentialHash: current.previous_credential_hash },
+          ...current.previous_credential_expires_at === null || current.previous_credential_expires_at === void 0 ? {} : { previousCredentialExpiresAt: current.previous_credential_expires_at }
+        } : void 0,
+        credentialHash,
+        expiresAt,
+        now
+      );
       const device = {
         routeId,
         deviceId,
-        credentialHash: safeCredentialHash(input.credentialHash),
+        credentialHash,
         createdAt: current?.created_at ?? now,
         updatedAt: now,
-        ...input.expiresAt === void 0 ? {} : { expiresAt: safeExpiry(input.expiresAt) }
+        ...expiresAt === void 0 ? {} : { expiresAt }
       };
       db.prepare(
-        `INSERT INTO relay_route_devices (route_id, device_id, credential_hash, created_at, updated_at, expires_at)
-         VALUES (?, ?, ?, ?, ?, ?)
+        `INSERT INTO relay_route_devices
+         (route_id, device_id, credential_hash, previous_credential_hash, previous_credential_expires_at,
+          created_at, updated_at, expires_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
          ON CONFLICT(route_id, device_id) DO UPDATE SET credential_hash = excluded.credential_hash,
+           previous_credential_hash = excluded.previous_credential_hash,
+           previous_credential_expires_at = excluded.previous_credential_expires_at,
            updated_at = excluded.updated_at, expires_at = excluded.expires_at`
       ).run(
         device.routeId,
         device.deviceId,
         device.credentialHash,
+        overlap.previousCredentialHash ?? null,
+        overlap.previousCredentialExpiresAt ?? null,
         device.createdAt,
         device.updatedAt,
         device.expiresAt ?? null
@@ -671,19 +868,22 @@ function openRelayRouteStore(options) {
       return device;
     }
   );
-  const listRoutes = (now, ownerAccountId) => db.prepare(
-    `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
+  const listRoutes = (now, ownerAccountId) => {
+    pruneExpiredDevices(now);
+    return db.prepare(
+      `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
            FROM relay_routes r LEFT JOIN relay_route_devices d ON d.route_id = r.id
              AND (d.expires_at IS NULL OR d.expires_at >= ?)
            ${ownerAccountId === void 0 ? "" : "WHERE r.owner_account_id = ?"}
            GROUP BY r.id ORDER BY r.created_at, r.id`
-  ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
-    id: row.id,
-    label: row.label,
-    deviceCount: row.device_count,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  }));
+    ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
+      id: row.id,
+      label: row.label,
+      deviceCount: row.device_count,
+      createdAt: row.created_at,
+      updatedAt: row.updated_at
+    }));
+  };
   return {
     mode: "sqlite",
     createRoute: (input, now = Date.now()) => cloneRoute(createRoute(input, now)),
@@ -694,6 +894,7 @@ function openRelayRouteStore(options) {
     listRoutes: (now = Date.now()) => listRoutes(now),
     listRoutesByOwner: (ownerAccountId, now = Date.now()) => listRoutes(now, ownerAccountId),
     countDevices(routeId, now = Date.now()) {
+      pruneExpiredDevices(now);
       const row = db.prepare(
         `SELECT COUNT(*) AS count FROM relay_route_devices
            WHERE route_id = ? AND (expires_at IS NULL OR expires_at >= ?)`
@@ -712,12 +913,12 @@ function openRelayRouteStore(options) {
     },
     putDevice: (input, now = Date.now()) => cloneDevice(putDevice(input, now)),
     getDevice(routeId, deviceId, now = Date.now()) {
-      const row = getDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"));
-      return row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) ? deviceFromRow(row) : void 0;
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return row ? deviceFromRow(row) : void 0;
     },
     authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const row = getDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"));
-      return !!row && (row.expires_at === null || row.expires_at === void 0 || row.expires_at >= now) && hashMatches2(row.credential_hash, credential);
+      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
+      return !!row && (hashMatches2(row.credential_hash, credential) || row.previous_credential_hash !== null && row.previous_credential_hash !== void 0 && row.previous_credential_expires_at !== null && row.previous_credential_expires_at !== void 0 && row.previous_credential_expires_at >= now && hashMatches2(row.previous_credential_hash, credential));
     },
     revokeDevice(routeId, deviceId) {
       const safeRouteId = safeId2(routeId, "route id");
@@ -734,9 +935,11 @@ function openRelayRouteStore(options) {
 var BLIND_RELAY_PROTOCOL_VERSION = 1;
 var BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 15e5;
 var BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4e6;
+var BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
 var BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
 var BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE = 64 * 1024 * 1024;
 var BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12e3;
+var UNSAFE_DISPLAY_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
 function safeToken(value, field) {
   if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
     throw new Error(`invalid relay ${field}`);
@@ -756,7 +959,7 @@ function safeId3(value, field) {
 function safeLabel3(value) {
   if (typeof value !== "string") throw new Error("relay route label is required");
   const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 80 || /[\p{Cc}\p{Zl}\p{Zp}]/u.test(label)) throw new Error("invalid relay route label");
+  if (!label || label.length > 80 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay route label");
   return label;
 }
 function safeExpiry2(value, now) {
@@ -770,6 +973,59 @@ function safeRevision(value) {
   if (!Number.isSafeInteger(value) || value < 1) throw new Error("invalid relay account revision");
   return value;
 }
+function safeAccountId(value) {
+  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
+    throw new Error("invalid relay account id");
+  }
+  return value;
+}
+function safeAccountLabel(value) {
+  if (typeof value !== "string") throw new Error("relay account label is required");
+  const label = value.trim().replace(/\s+/g, " ");
+  if (!label || label.length > 120 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay account label");
+  return label;
+}
+function safeAccountPlan(value) {
+  if (value !== "free" && value !== "team" && value !== "enterprise") {
+    throw new Error("invalid relay account plan");
+  }
+  return value;
+}
+function safeAccountLimit(value, maximum) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+    throw new Error("invalid relay account limit");
+  }
+  return value;
+}
+function strictInternalBody(value, allowedFields) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid internal request body");
+  const body = value;
+  if (Object.keys(body).some((field) => !allowedFields.includes(field))) {
+    throw new Error("unknown internal request field");
+  }
+  return body;
+}
+function safeCredentialLookup(value) {
+  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error("invalid relay credential lookup");
+  }
+  return value;
+}
+function safeAccountCredentialMaterial(body) {
+  if (!body || body.credential !== void 0 || body.accountCredential !== void 0) {
+    throw new Error("client-hashed account credential material is required");
+  }
+  return {
+    credentialHash: safeCredentialHash2(body.credentialHash),
+    credentialLookup: safeCredentialLookup(body.credentialLookup)
+  };
+}
+function safeRouteCredentialHash(body, field = "credentialHash") {
+  if (!body || body.credential !== void 0 || body.hostCredential !== void 0) {
+    throw new Error("client-hashed route credential material is required");
+  }
+  return safeCredentialHash2(body[field]);
+}
 function bearer(request) {
   const value = request.headers.authorization;
   if (!value || Array.isArray(value)) return;
@@ -794,7 +1050,9 @@ function publicRoute(route) {
 function normalizeOrigin(value) {
   try {
     const url = new URL(value);
-    if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) return;
+    const loopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      return;
     return url.origin;
   } catch {
     return;
@@ -856,6 +1114,7 @@ function createBlindRelayServer(options) {
   const idleTimeoutMs = options.idleTimeoutMs ?? 2 * 6e4;
   const maxFrameBytes = options.maxFrameBytes ?? BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES;
   const maxQueueBytes = options.maxQueueBytes ?? BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES;
+  const maxTotalConnections = options.maxTotalConnections ?? BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS;
   const maxConnectionsPerRoute = options.maxConnectionsPerRoute ?? BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE;
   const maxBytesPerMinute = options.maxBytesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE;
   const maxMessagesPerMinute = options.maxMessagesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE;
@@ -864,17 +1123,63 @@ function createBlindRelayServer(options) {
     [idleTimeoutMs, 1e4, 60 * 6e4, "idle timeout"],
     [maxFrameBytes, 1024, 16 * 1024 * 1024, "frame limit"],
     [maxQueueBytes, 1024, 64 * 1024 * 1024, "queue limit"],
+    [maxTotalConnections, 1, 1e5, "total connection limit"],
     [maxConnectionsPerRoute, 1, 1e4, "connection limit"],
     [maxBytesPerMinute, 1024, 1024 * 1024 * 1024, "byte rate"],
     [maxMessagesPerMinute, 10, 1e6, "message rate"]
   ]) {
     if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`invalid relay ${label}`);
   }
-  const allowedOrigins = new Set((options.allowedOrigins ?? []).map(normalizeOrigin).filter(Boolean));
+  const maxEnvelopeBytes = Math.max(8 * 1024, Math.ceil(maxFrameBytes * 4 / 3) + 8 * 1024);
+  const configuredOrigins = options.allowedOrigins ?? [];
+  const normalizedOrigins = configuredOrigins.map(normalizeOrigin);
+  if (normalizedOrigins.some((origin) => origin === void 0)) {
+    throw new Error("invalid relay allowed origin");
+  }
+  const allowedOrigins = new Set(normalizedOrigins);
   const generateChannelId = options.generateChannelId ?? (() => `rrc_${randomBytes3(16).toString("base64url")}`);
   const hosts = /* @__PURE__ */ new Map();
   const devicesByChannel = /* @__PURE__ */ new Map();
+  const sockets = /* @__PURE__ */ new Set();
+  const hostRates = /* @__PURE__ */ new Map();
+  const deviceRates = /* @__PURE__ */ new Map();
+  const maxRateIdentities = Math.min(1e5, Math.max(256, maxTotalConnections * 4));
+  const deviceRateKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
+  const clearRouteRates = (routeId) => {
+    hostRates.delete(routeId);
+    for (const key of deviceRates.keys()) if (key.startsWith(`${routeId}\0`)) deviceRates.delete(key);
+  };
+  const rateWindowFor = (windows, key) => {
+    const current = now();
+    if (windows.size >= maxRateIdentities) {
+      for (const [candidate, window] of windows) {
+        if (current - window.lastSeenAt >= 12e4) windows.delete(candidate);
+      }
+    }
+    const existing = windows.get(key);
+    if (existing) {
+      existing.lastSeenAt = current;
+      return existing;
+    }
+    if (windows.size >= maxRateIdentities) return;
+    const created = { startedAt: current, lastSeenAt: current, bytes: 0, messages: 0 };
+    windows.set(key, created);
+    return created;
+  };
+  const consumeRate = (window, bytes) => {
+    const current = now();
+    if (current - window.startedAt >= 6e4) {
+      window.startedAt = current;
+      window.bytes = 0;
+      window.messages = 0;
+    }
+    window.lastSeenAt = current;
+    window.bytes += bytes;
+    window.messages += 1;
+    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
+  };
   const metrics = {
+    activeConnections: 0,
     activeHosts: 0,
     activeDevices: 0,
     acceptedConnections: 0,
@@ -911,6 +1216,14 @@ function createBlindRelayServer(options) {
     }
     reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
   };
+  const requireRecoverableAccount = async (request, reply) => {
+    const account = accountStore?.verifyCredential(bearer(request) ?? "");
+    if (account) {
+      authenticatedAccounts.set(request, account);
+      return;
+    }
+    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
+  };
   app.addHook("onSend", async (_request, reply, payload) => {
     reply.header("cache-control", "no-store");
     reply.header("content-security-policy", "default-src 'none'");
@@ -930,7 +1243,12 @@ function createBlindRelayServer(options) {
   });
   app.get("/v1/metrics", { preHandler: requireRoot }, async () => ({
     protocolVersion: BLIND_RELAY_PROTOCOL_VERSION,
-    metrics: { ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size }
+    metrics: {
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    }
   }));
   app.get("/v1/routes", { preHandler: requireRoot }, async () => ({ routes: store.listRoutes().map(publicRoute) }));
   app.post(
@@ -976,6 +1294,7 @@ function createBlindRelayServer(options) {
         reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
         return;
       }
+      clearRouteRates(request.params.routeId);
       const host = hosts.get(request.params.routeId);
       host?.socket.close(4403, "route deleted");
       for (const device of host?.devices.values() ?? []) device.socket.close(4403, "route deleted");
@@ -1019,35 +1338,93 @@ function createBlindRelayServer(options) {
       reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device route" });
     }
   });
+  app.post("/v1/routes/:routeId/devices/:deviceId/promote", { preHandler: requireHost }, async (request, reply) => {
+    try {
+      const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+      const routeId = safeId3(request.params.routeId, "route id");
+      const deviceId = safeId3(request.params.deviceId, "device id");
+      const expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+      const credentialHash = safeCredentialHash2(body.credentialHash);
+      if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
+      const current = store.getDevice(routeId, deviceId, now());
+      if (!current) {
+        reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
+        return;
+      }
+      if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
+        reply.code(200).send({
+          device: {
+            routeId: current.routeId,
+            deviceId: current.deviceId,
+            createdAt: current.createdAt,
+            updatedAt: current.updatedAt,
+            expiresAt: null
+          }
+        });
+        return;
+      }
+      if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+          error: "relay device credential conflict"
+        });
+        return;
+      }
+      const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
+      reply.code(200).send({
+        device: {
+          routeId: device.routeId,
+          deviceId: device.deviceId,
+          createdAt: device.createdAt,
+          updatedAt: device.updatedAt,
+          expiresAt: null
+        }
+      });
+    } catch {
+      reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
+    }
+  });
   app.delete(
     "/v1/routes/:routeId/devices/:deviceId",
     { preHandler: requireHost },
     async (request, reply) => {
-      let removed = false;
+      let routeId;
+      let deviceId;
+      let expectedCredentialHash;
       try {
-        removed = store.revokeDevice(request.params.routeId, request.params.deviceId);
+        routeId = safeId3(request.params.routeId, "route id");
+        deviceId = safeId3(request.params.deviceId, "device id");
+        if (request.body !== void 0) {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+        }
       } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+        return;
       }
-      if (!removed) {
+      const current = store.getDevice(routeId, deviceId, now());
+      if (!current) {
+        if (expectedCredentialHash) {
+          reply.code(204).send();
+          return;
+        }
         reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
         return;
       }
-      const live = hosts.get(request.params.routeId)?.devices.get(request.params.deviceId);
+      if (expectedCredentialHash && !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+          error: "relay device credential conflict"
+        });
+        return;
+      }
+      store.revokeDevice(routeId, deviceId);
+      deviceRates.delete(deviceRateKey(routeId, deviceId));
+      const live = hosts.get(routeId)?.devices.get(deviceId);
       live?.socket.close(4403, "device revoked");
       reply.code(204).send();
     }
   );
-  const consumeRate = (window, bytes) => {
-    const current = now();
-    if (current - window.startedAt >= 6e4) {
-      window.startedAt = current;
-      window.bytes = 0;
-      window.messages = 0;
-    }
-    window.bytes += bytes;
-    window.messages += 1;
-    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
-  };
   const closeDevice = (device, code = 1e3, reason = "device disconnected") => {
     if (device.closed) return;
     device.closed = true;
@@ -1056,7 +1433,10 @@ function createBlindRelayServer(options) {
     const host = hosts.get(device.routeId);
     if (host?.devices.get(device.deviceId) === device) host.devices.delete(device.deviceId);
     metrics.activeDevices = Math.max(0, metrics.activeDevices - 1);
-    if (host) safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes);
+    if (host && !safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes)) {
+      metrics.droppedFrames += 1;
+      closeHost(host, 4408, "relay backpressure");
+    }
     if (device.socket.readyState === device.socket.OPEN) device.socket.close(code, reason);
   };
   const touchDevice = (device) => {
@@ -1084,30 +1464,607 @@ function createBlindRelayServer(options) {
       usage: { routes: store.listRoutesByOwner(account.id, now()).length, maxRoutes: account.maxRoutes }
     });
     const closeAccountRoutes = (accountId, reason) => {
+      for (const host of [...hosts.values()]) if (host.ownerAccountId === accountId) closeHost(host, 4403, reason);
+    };
+    const purgeAccountRoutes = (accountId) => {
+      closeAccountRoutes(accountId, "account deleted");
       for (const route of store.listRoutesByOwner(accountId, now())) {
-        const host = hosts.get(route.id);
-        if (host) closeHost(host, 4403, reason);
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
       }
     };
+    for (const listedRoute of store.listRoutes(now())) {
+      const route = store.getRoute(listedRoute.id);
+      if (!route?.ownerAccountId) continue;
+      const owner = accountStore.getAccount(route.ownerAccountId);
+      if (!owner || owner.status === "deleted") {
+        store.deleteRoute(route.id);
+        clearRouteRates(route.id);
+      }
+    }
     const ownedRoute = (accountId, routeId) => {
       const route = store.getRoute(routeId);
       return route?.ownerAccountId === accountId ? route : void 0;
     };
+    const internalRouteEnvelope = (accountId, routeId) => {
+      const route = ownedRoute(accountId, routeId);
+      if (!route) return;
+      return {
+        accountId,
+        route: publicRoute({ ...route, deviceCount: store.countDevices(route.id, now()) }),
+        status: {
+          hostOnline: hosts.has(route.id),
+          activeDevices: hosts.get(route.id)?.devices.size ?? 0
+        },
+        connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
+      };
+    };
+    const internalDeviceEnvelope = (accountId, device) => ({
+      accountId,
+      device: {
+        routeId: device.routeId,
+        deviceId: device.deviceId,
+        createdAt: device.createdAt,
+        updatedAt: device.updatedAt,
+        expiresAt: device.expiresAt ?? null
+      }
+    });
+    const closeAndDeleteRoute = (routeId, reason) => {
+      const route = store.getRoute(routeId);
+      if (!route) return false;
+      const host = hosts.get(routeId);
+      if (host) closeHost(host, 4403, reason);
+      const deleted = store.deleteRoute(routeId);
+      if (deleted) clearRouteRates(routeId);
+      return deleted;
+    };
+    const accountRevisionConflict = (reply, account) => reply.code(409).send({
+      code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+      error: "relay account revision conflict",
+      current: accountEnvelope(account)
+    });
+    app.put(
+      "/internal/v1/accounts/:accountId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let input;
+        try {
+          const body = strictInternalBody(request.body, [
+            "label",
+            "plan",
+            "maxRoutes",
+            "maxDevicesPerRoute",
+            "credentialHash",
+            "credentialLookup"
+          ]);
+          accountId = safeAccountId(request.params.accountId);
+          input = {
+            id: accountId,
+            label: safeAccountLabel(body.label),
+            plan: safeAccountPlan(body.plan),
+            maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
+            maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5),
+            ...safeAccountCredentialMaterial(body)
+          };
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+          return;
+        }
+        const existing = accountStore.getAccount(accountId);
+        if (existing) {
+          const matches = existing.status !== "deleted" && existing.label === input.label && existing.plan === input.plan && existing.maxRoutes === input.maxRoutes && existing.maxDevicesPerRoute === input.maxDevicesPerRoute && accountStore.credentialMatches(accountId, input);
+          if (!matches) {
+            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
+            return;
+          }
+          reply.code(200).send(accountEnvelope(existing));
+          return;
+        }
+        try {
+          const account = accountStore.createAccount(input);
+          reply.code(201).send(accountEnvelope(account));
+        } catch (error) {
+          if (error.message === "relay account already exists" || error.message === "relay account credential already exists") {
+            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
+            return;
+          }
+          throw error;
+        }
+      }
+    );
+    app.get(
+      "/internal/v1/accounts/:accountId/status",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let account;
+        try {
+          account = accountStore.getAccount(safeAccountId(request.params.accountId));
+        } catch {
+        }
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      }
+    );
+    app.put("/internal/v1/accounts/:accountId/metadata", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      let update;
+      try {
+        const body = strictInternalBody(request.body, [
+          "expectedRevision",
+          "label",
+          "plan",
+          "maxRoutes",
+          "maxDevicesPerRoute"
+        ]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+        update = {
+          label: safeAccountLabel(body.label),
+          plan: safeAccountPlan(body.plan),
+          maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
+          maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5)
+        };
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      const matches = current.label === update.label && current.plan === update.plan && current.maxRoutes === update.maxRoutes && current.maxDevicesPerRoute === update.maxDevicesPerRoute;
+      if (matches && (current.revision === expectedRevision || current.revision === expectedRevision + 1)) {
+        reply.code(200).send(accountEnvelope(current));
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.updateAccount(accountId, update, expectedRevision);
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        throw error;
+      }
+    });
+    app.put("/internal/v1/accounts/:accountId/credential", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      let credential;
+      try {
+        const body = strictInternalBody(request.body, ["expectedRevision", "credentialHash", "credentialLookup"]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+        credential = safeAccountCredentialMaterial(body);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      if (accountStore.credentialMatches(accountId, credential)) {
+        if (current.revision === expectedRevision || current.revision === expectedRevision + 1) {
+          reply.code(200).send(accountEnvelope(current));
+          return;
+        }
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.rotateCredential(accountId, credential, expectedRevision);
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send(accountEnvelope(account));
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        if (error.message === "relay account credential already exists") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_CREDENTIAL_CONFLICT", error: "relay credential conflict" });
+          return;
+        }
+        throw error;
+      }
+    });
+    app.delete("/internal/v1/accounts/:accountId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let expectedRevision;
+      try {
+        const body = strictInternalBody(request.body, ["expectedRevision"]);
+        accountId = safeAccountId(request.params.accountId);
+        expectedRevision = safeRevision(body.expectedRevision);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+        return;
+      }
+      const current = accountStore.getAccount(accountId);
+      if (!current || current.status === "deleted") {
+        reply.code(204).send();
+        return;
+      }
+      if (current.revision !== expectedRevision) {
+        accountRevisionConflict(reply, current);
+        return;
+      }
+      try {
+        const account = accountStore.updateAccount(accountId, { status: "deleted" }, expectedRevision);
+        if (account) purgeAccountRoutes(account.id);
+        reply.code(204).send();
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          accountRevisionConflict(reply, error.current);
+          return;
+        }
+        throw error;
+      }
+    });
+    app.put("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let routeId;
+      let label;
+      let credentialHash;
+      try {
+        const body = strictInternalBody(request.body, ["label", "credentialHash"]);
+        accountId = safeAccountId(request.params.accountId);
+        routeId = safeId3(request.params.routeId, "route id");
+        label = safeLabel3(body.label);
+        credentialHash = safeRouteCredentialHash(body);
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+        return;
+      }
+      const account = accountStore.getAccount(accountId);
+      if (!account || account.status === "deleted") {
+        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+        return;
+      }
+      if (account.status !== "active") {
+        reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+        return;
+      }
+      const existing = store.getRoute(routeId);
+      if (existing) {
+        if (existing.ownerAccountId !== accountId || existing.label !== label || !tokenMatches(existing.hostCredentialHash, credentialHash)) {
+          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
+          return;
+        }
+        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+        return;
+      }
+      if (store.listRoutesByOwner(accountId, now()).length >= account.maxRoutes) {
+        reply.code(429).send({ code: "RELAY_ROUTE_LIMIT", error: "relay route limit reached" });
+        return;
+      }
+      try {
+        store.createRoute({ id: routeId, label, hostCredentialHash: credentialHash, ownerAccountId: accountId });
+        reply.code(201).send(internalRouteEnvelope(accountId, routeId));
+      } catch (error) {
+        if (error.message === "relay route already exists") {
+          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
+          return;
+        }
+        throw error;
+      }
+    });
+    app.get(
+      "/internal/v1/accounts/:accountId/routes/:routeId/status",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let route;
+        try {
+          route = internalRouteEnvelope(
+            safeAccountId(request.params.accountId),
+            safeId3(request.params.routeId, "route id")
+          );
+        } catch {
+        }
+        if (!route) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        reply.code(200).send(route);
+      }
+    );
+    app.put(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let credentialHash;
+        let expiresAt;
+        try {
+          const body = strictInternalBody(request.body, ["credentialHash", "expiresAt"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          credentialHash = safeCredentialHash2(body.credentialHash);
+          const parsedExpiry = safeExpiry2(body.expiresAt, now());
+          if (parsedExpiry === void 0) throw new Error("temporary relay device expiry is required");
+          expiresAt = parsedExpiry;
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (account.status !== "active") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (current) {
+          if (tokenMatches(current.credentialHash, credentialHash) && current.expiresAt === expiresAt) {
+            reply.code(200).send(internalDeviceEnvelope(accountId, current));
+            return;
+          }
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        if (store.countDevices(routeId, now()) >= account.maxDevicesPerRoute) {
+          reply.code(429).send({ code: "RELAY_DEVICE_LIMIT", error: "relay device limit reached" });
+          return;
+        }
+        const device = store.putDevice({ routeId, deviceId, credentialHash, expiresAt }, now());
+        reply.code(201).send(internalDeviceEnvelope(accountId, device));
+      }
+    );
+    app.post(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId/promote",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let expectedCredentialHash;
+        let credentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+          credentialHash = safeCredentialHash2(body.credentialHash);
+          if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (account.status !== "active") {
+          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (!current) {
+          reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
+          return;
+        }
+        if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
+          reply.code(200).send(internalDeviceEnvelope(accountId, current));
+          return;
+        }
+        if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
+        reply.code(200).send(internalDeviceEnvelope(accountId, device));
+      }
+    );
+    app.delete(
+      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let deviceId;
+        let expectedCredentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          deviceId = safeId3(request.params.deviceId, "device id");
+          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
+          return;
+        }
+        const account = accountStore.getAccount(accountId);
+        if (!account || account.status === "deleted") {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        if (!ownedRoute(accountId, routeId)) {
+          reply.code(204).send();
+          return;
+        }
+        const current = store.getDevice(routeId, deviceId, now());
+        if (!current) {
+          reply.code(204).send();
+          return;
+        }
+        if (!tokenMatches(current.credentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
+            error: "relay device credential conflict",
+            current: internalDeviceEnvelope(accountId, current)
+          });
+          return;
+        }
+        store.revokeDevice(routeId, deviceId);
+        deviceRates.delete(deviceRateKey(routeId, deviceId));
+        const live = hosts.get(routeId)?.devices.get(deviceId);
+        live?.socket.close(4403, "device revoked");
+        reply.code(204).send();
+      }
+    );
+    app.put(
+      "/internal/v1/accounts/:accountId/routes/:routeId/credential",
+      { preHandler: requireRoot },
+      async (request, reply) => {
+        let accountId;
+        let routeId;
+        let expectedCredentialHash;
+        let credentialHash;
+        try {
+          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
+          accountId = safeAccountId(request.params.accountId);
+          routeId = safeId3(request.params.routeId, "route id");
+          expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
+          credentialHash = safeRouteCredentialHash(body);
+        } catch {
+          reply.code(400).send({ code: "INVALID_RELAY_CREDENTIAL", error: "invalid relay credential hash" });
+          return;
+        }
+        const route = ownedRoute(accountId, routeId);
+        if (!route) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        if (tokenMatches(route.hostCredentialHash, credentialHash)) {
+          reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+          return;
+        }
+        if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
+          reply.code(409).send({
+            code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
+            error: "relay route credential conflict",
+            current: internalRouteEnvelope(accountId, routeId)
+          });
+          return;
+        }
+        if (!store.rotateHostCredential(routeId, credentialHash, now())) {
+          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
+          return;
+        }
+        const host = hosts.get(routeId);
+        if (host) closeHost(host, 4409, "host credential rotated");
+        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
+      }
+    );
+    app.delete("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
+      let accountId;
+      let routeId;
+      let expectedCredentialHash;
+      try {
+        const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
+        accountId = safeAccountId(request.params.accountId);
+        routeId = safeId3(request.params.routeId, "route id");
+        expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
+      } catch {
+        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
+        return;
+      }
+      const route = ownedRoute(accountId, routeId);
+      if (!route) {
+        reply.code(204).send();
+        return;
+      }
+      if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
+        reply.code(409).send({
+          code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
+          error: "relay route credential conflict",
+          current: internalRouteEnvelope(accountId, routeId)
+        });
+        return;
+      }
+      closeAndDeleteRoute(routeId, "route deleted");
+      reply.code(204).send();
+    });
     app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
       accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
     }));
-    app.post("/v1/accounts", { preHandler: requireRoot }, async (request, reply) => {
-      const accountCredential = generateRelayAccountCredential();
+    const createAccountHandler = (clientHashedOnly) => async (request, reply) => {
       try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
         const account = accountStore.createAccount({
-          ...request.body,
-          credential: accountCredential
+          label: request.body?.label,
+          ...request.body?.plan === void 0 ? {} : { plan: request.body.plan },
+          ...request.body?.maxRoutes === void 0 ? {} : { maxRoutes: request.body.maxRoutes },
+          ...request.body?.maxDevicesPerRoute === void 0 ? {} : { maxDevicesPerRoute: request.body.maxDevicesPerRoute },
+          ...typeof credential === "string" ? { credential } : {
+            credentialHash: credential.credentialHash,
+            credentialLookup: credential.credentialLookup
+          }
+        });
+        reply.code(201).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
         });
-        reply.code(201).send({ ...accountEnvelope(account), accountCredential });
       } catch {
         reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
       }
-    });
+    };
+    app.post(
+      "/v1/accounts",
+      { preHandler: requireRoot },
+      createAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/client-hashed",
+      { preHandler: requireRoot },
+      createAccountHandler(true)
+    );
     app.patch(
       "/v1/accounts/:accountId",
       { preHandler: requireRoot },
@@ -1122,7 +2079,8 @@ function createBlindRelayServer(options) {
             reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
             return;
           }
-          if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
+          if (account.status === "deleted") purgeAccountRoutes(account.id);
+          else if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
           reply.code(200).send(accountEnvelope(account));
         } catch (error) {
           if (error instanceof RelayAccountRevisionConflictError) {
@@ -1137,34 +2095,58 @@ function createBlindRelayServer(options) {
         }
       }
     );
+    const rotateAccountHandler = (clientHashedOnly) => async (request, reply) => {
+      try {
+        const hasCredentialHash = request.body?.credentialHash !== void 0;
+        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
+        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
+          throw new Error("client-hashed account credential material is required");
+        }
+        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
+        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
+        const credential = suppliedCredentialMaterial ? {
+          credentialHash: request.body?.credentialHash,
+          credentialLookup: request.body?.credentialLookup
+        } : accountCredential;
+        const account = accountStore.rotateCredential(
+          request.params.accountId,
+          credential,
+          safeRevision(request.body?.expectedRevision)
+        );
+        if (!account) {
+          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
+          return;
+        }
+        reply.code(200).send({
+          ...accountEnvelope(account),
+          ...accountCredential === void 0 ? {} : { accountCredential }
+        });
+      } catch (error) {
+        if (error instanceof RelayAccountRevisionConflictError) {
+          reply.code(409).send({
+            code: "RELAY_ACCOUNT_REVISION_CONFLICT",
+            error: "relay account revision conflict",
+            current: accountEnvelope(error.current)
+          });
+          return;
+        }
+        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
+      }
+    };
     app.post(
       "/v1/accounts/:accountId/credential",
       { preHandler: requireRoot },
-      async (request, reply) => {
-        const accountCredential = generateRelayAccountCredential();
-        try {
-          const account = accountStore.rotateCredential(
-            request.params.accountId,
-            accountCredential,
-            safeRevision(request.body?.expectedRevision)
-          );
-          if (!account) {
-            reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-            return;
-          }
-          reply.code(200).send({ ...accountEnvelope(account), accountCredential });
-        } catch (error) {
-          if (error instanceof RelayAccountRevisionConflictError) {
-            reply.code(409).send({
-              code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-              error: "relay account revision conflict",
-              current: accountEnvelope(error.current)
-            });
-            return;
-          }
-          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        }
-      }
+      rotateAccountHandler(false)
+    );
+    app.post(
+      "/v1/accounts/:accountId/credential/client-hashed",
+      { preHandler: requireRoot },
+      rotateAccountHandler(true)
+    );
+    app.get(
+      "/v1/account/recovery",
+      { preHandler: requireRecoverableAccount },
+      async (request) => accountEnvelope(authenticatedAccounts.get(request))
     );
     app.get(
       "/v1/account",
@@ -1242,6 +2224,7 @@ function createBlindRelayServer(options) {
           reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
           return;
         }
+        clearRouteRates(request.params.routeId);
         const host = hosts.get(request.params.routeId);
         if (host) closeHost(host, 4403, "route deleted");
         reply.code(204).send();
@@ -1278,9 +2261,15 @@ function createBlindRelayServer(options) {
       }
     );
   }
-  app.register(websocket);
+  app.register(websocket, { options: { maxPayload: maxEnvelopeBytes, perMessageDeflate: false } });
   app.register(async (scope) => {
     scope.get("/v1/connect", { websocket: true }, (socket, request) => {
+      if (sockets.size >= maxTotalConnections) {
+        metrics.rejectedConnections += 1;
+        socket.close(4429, "relay connection limit");
+        return;
+      }
+      sockets.add(socket);
       let authenticated = false;
       let liveHost;
       let liveDevice;
@@ -1299,29 +2288,41 @@ function createBlindRelayServer(options) {
         if (!authenticated) {
           try {
             const hello = parseAuthHello(parseJson(raw, 8 * 1024));
-            const origin = typeof request.headers.origin === "string" ? normalizeOrigin(request.headers.origin) : void 0;
-            if (hello.role === "device" && origin && allowedOrigins.size > 0 && !allowedOrigins.has(origin)) {
+            const presentedOrigin = request.headers.origin;
+            const origin = typeof presentedOrigin === "string" ? normalizeOrigin(presentedOrigin) : void 0;
+            if (hello.role === "device" && allowedOrigins.size > 0 && presentedOrigin !== void 0 && (!origin || !allowedOrigins.has(origin))) {
               reject(4403, "origin denied");
               return;
             }
             if (hello.role === "host") {
-              if (!routeAccountIsActive(hello.routeId) || !store.authenticateHost(hello.routeId, hello.credential)) {
+              const route = store.getRoute(hello.routeId);
+              if (!route || route.ownerAccountId !== void 0 && accountStore?.getAccount(route.ownerAccountId)?.status !== "active" || !store.authenticateHost(hello.routeId, hello.credential)) {
                 reject(4401, "authentication failed");
                 return;
               }
+              const rate = rateWindowFor(hostRates, hello.routeId);
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = hosts.get(hello.routeId);
               if (previous) closeHost(previous, 4409, "superseded host");
               liveHost = {
                 socket,
                 routeId: hello.routeId,
+                ...route.ownerAccountId === void 0 ? {} : { ownerAccountId: route.ownerAccountId },
                 devices: /* @__PURE__ */ new Map(),
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               hosts.set(hello.routeId, liveHost);
               metrics.activeHosts += 1;
               touchHost(liveHost);
-              safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+                return;
+              }
             } else {
               if (!routeAccountIsActive(hello.routeId) || !store.authenticateDevice(hello.routeId, hello.deviceId, hello.credential, now())) {
                 reject(4401, "authentication failed");
@@ -1336,6 +2337,11 @@ function createBlindRelayServer(options) {
                 reject(4429, "route connection limit");
                 return;
               }
+              const rate = rateWindowFor(deviceRates, deviceRateKey(hello.routeId, hello.deviceId));
+              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
+                reject(4429, "relay identity rate limit");
+                return;
+              }
               const previous = host.devices.get(hello.deviceId);
               if (previous) closeDevice(previous, 4409, "superseded device");
               const channelId = safeId3(generateChannelId(), "channel id");
@@ -1344,15 +2350,20 @@ function createBlindRelayServer(options) {
                 routeId: hello.routeId,
                 deviceId: hello.deviceId,
                 channelId,
-                rate: { startedAt: now(), bytes: 0, messages: 0 },
+                rate,
                 closed: false
               };
               host.devices.set(hello.deviceId, liveDevice);
               devicesByChannel.set(channelId, liveDevice);
               metrics.activeDevices += 1;
               touchDevice(liveDevice);
-              safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes);
+              if (!safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+                return;
+              }
               if (!safeSend(host.socket, { t: "peer-open", channelId, deviceId: hello.deviceId }, maxQueueBytes)) {
+                metrics.rejectedConnections += 1;
                 closeDevice(liveDevice, 4408, "host backpressure");
                 return;
               }
@@ -1366,11 +2377,18 @@ function createBlindRelayServer(options) {
           return;
         }
         try {
-          const value = parseJson(raw, maxFrameBytes * 2);
+          const value = parseJson(raw, maxEnvelopeBytes);
           if (liveDevice) {
             touchDevice(liveDevice);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveDevice.rate, 1)) {
+                closeDevice(liveDevice, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeDevice(liveDevice, 4408, "relay backpressure");
+              }
               return;
             }
             const frame = parsePayload(value, false, maxFrameBytes);
@@ -1395,7 +2413,14 @@ function createBlindRelayServer(options) {
           if (liveHost) {
             touchHost(liveHost);
             if (value?.t === "ping") {
-              safeSend(socket, { t: "pong", at: now() }, maxQueueBytes);
+              if (!consumeRate(liveHost.rate, 1)) {
+                closeHost(liveHost, 4429, "rate limit");
+                return;
+              }
+              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
+                metrics.droppedFrames += 1;
+                closeHost(liveHost, 4408, "relay backpressure");
+              }
               return;
             }
             if (value?.t === "close-peer") {
@@ -1433,6 +2458,7 @@ function createBlindRelayServer(options) {
         }
       });
       socket.once("close", () => {
+        sockets.delete(socket);
         clearTimeout(handshakeTimer);
         if (liveDevice) closeDevice(liveDevice);
         if (liveHost) closeHost(liveHost);
@@ -1443,20 +2469,45 @@ function createBlindRelayServer(options) {
   });
   app.addHook("onClose", async () => {
     for (const host of [...hosts.values()]) closeHost(host, 1001, "relay shutting down");
+    for (const socket of [...sockets]) socket.close(1001, "relay shutting down");
+    hostRates.clear();
+    deviceRates.clear();
     if (ownsStore) store.close();
   });
   return {
     app,
     store,
     ...accountStore ? { accountStore } : {},
-    metrics: () => ({ ...metrics, activeHosts: hosts.size, activeDevices: devicesByChannel.size })
+    metrics: () => ({
+      ...metrics,
+      activeConnections: sockets.size,
+      activeHosts: hosts.size,
+      activeDevices: devicesByChannel.size
+    })
   };
 }
 
 // src/data-dir.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fchmodSync,
+  fstatSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeFileSync
+} from "fs";
 import { randomBytes as randomBytes4 } from "crypto";
-import { join } from "path";
+import { dirname, join } from "path";
+var MAX_ACCESS_TOKEN_BYTES = 4 * 1024;
+var MAX_ACCESS_TOKEN_FILE_BYTES = MAX_ACCESS_TOKEN_BYTES + 2;
 function resolveDataDir(env, exists = existsSync) {
   if (env.ROAMCODE_DATA_DIR) return env.ROAMCODE_DATA_DIR;
   if (env.REMOTE_CODER_DATA_DIR) return env.REMOTE_CODER_DATA_DIR;
@@ -1483,8 +2534,51 @@ function relayDataDir(env) {
 function relayOrigins(env) {
   return (env.ROAMCODE_RELAY_ALLOWED_ORIGINS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
 }
+function privateSecretFile(path, field) {
+  let descriptor;
+  try {
+    const before = lstatSync2(path);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > 4096 || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret file");
+    }
+    descriptor = openSync2(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+    const opened = fstatSync2(descriptor);
+    if (!opened.isFile() || opened.size > 4096 || (opened.mode & 63) !== 0 || typeof process.getuid === "function" && opened.uid !== process.getuid() || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("unsafe secret file");
+    }
+    return readFileSync2(descriptor, "utf8").trim();
+  } catch {
+    throw new Error(`${field} could not be read securely`);
+  } finally {
+    if (descriptor !== void 0) closeSync2(descriptor);
+  }
+}
 function previousRootTokens(env) {
-  return (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const inline = (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+  const directory = env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR?.trim();
+  if (inline.length > 0 && directory) {
+    throw new Error(
+      "ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS and ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR are mutually exclusive"
+    );
+  }
+  if (!directory) return inline;
+  let before;
+  let entries;
+  try {
+    before = lstatSync2(directory);
+    if (!before.isDirectory() || before.isSymbolicLink() || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
+      throw new Error("unsafe secret directory");
+    }
+    entries = readdirSync(directory, { withFileTypes: true });
+    const after = lstatSync2(directory);
+    if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 63) !== 0 || typeof process.getuid === "function" && after.uid !== process.getuid() || entries.some((entry) => !entry.isFile())) {
+      throw new Error("unsafe secret directory");
+    }
+  } catch {
+    throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR could not be read securely");
+  }
+  if (entries.length > 3) throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR may contain at most three files");
+  return entries.map((entry) => entry.name).sort().map((name) => privateSecretFile(join2(directory, name), "previous relay root capability"));
 }
 function explicitBoolean(value, field) {
   if (value === void 0 || value === "" || value === "0" || value === "false") return false;
@@ -1497,18 +2591,12 @@ function secretValue(env, directKey, fileKey) {
   if (direct && file) throw new Error(`${directKey} and ${fileKey} are mutually exclusive`);
   if (direct) return direct;
   if (!file) return void 0;
-  let contents;
-  try {
-    contents = readFileSync2(file, "utf8");
-  } catch {
-    throw new Error(`${fileKey} could not be read`);
-  }
-  if (Buffer.byteLength(contents) > 4096) throw new Error(`${fileKey} is too large`);
-  return contents.trim();
+  return privateSecretFile(file, fileKey);
 }
 async function startBlindRelay(env = process.env) {
   const rootToken = secretValue(env, "ROAMCODE_RELAY_ROOT_TOKEN", "ROAMCODE_RELAY_ROOT_TOKEN_FILE");
   if (!rootToken) throw new Error("ROAMCODE_RELAY_ROOT_TOKEN or ROAMCODE_RELAY_ROOT_TOKEN_FILE is required");
+  const previousRoots = previousRootTokens(env);
   const allowedOrigins = relayOrigins(env);
   const allowAnyOrigin = explicitBoolean(env.ROAMCODE_RELAY_ALLOW_ANY_ORIGIN, "relay allow-any-origin flag");
   if (env.NODE_ENV === "production" && allowedOrigins.length === 0 && !allowAnyOrigin) {
@@ -1537,7 +2625,7 @@ async function startBlindRelay(env = process.env) {
   try {
     relay = createBlindRelayServer({
       rootToken,
-      previousRootTokens: previousRootTokens(env),
+      previousRootTokens: previousRoots,
       store,
       ...accountStore ? { accountStore } : {},
       allowedOrigins,
@@ -1569,6 +2657,13 @@ async function startBlindRelay(env = process.env) {
         64 * 1024 * 1024,
         "relay queue limit"
       ),
+      maxTotalConnections: boundedInteger(
+        env.ROAMCODE_RELAY_MAX_TOTAL_CONNECTIONS,
+        1024,
+        1,
+        1e5,
+        "relay total connection limit"
+      ),
       maxConnectionsPerRoute: boundedInteger(
         env.ROAMCODE_RELAY_MAX_CONNECTIONS_PER_ROUTE,
         64,