@roamcode.ai/server 1.4.5 → 2.0.0

package/dist/container/relay.js

@@ -1,2742 +0,0 @@
-// src/relay-start.ts
-import {
-  closeSync as closeSync2,
-  constants as constants2,
-  fstatSync as fstatSync2,
-  lstatSync as lstatSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync2,
-  readdirSync,
-  realpathSync
-} from "fs";
-import { join as join2, resolve } from "path";
-import { fileURLToPath, pathToFileURL } from "url";
-
-// src/relay-broker.ts
-import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual3 } from "crypto";
-import Fastify from "fastify";
-import websocket from "@fastify/websocket";
-
-// src/relay-account-store.ts
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
-import { createRequire } from "module";
-var require2 = createRequire(import.meta.url);
-var RelayAccountRevisionConflictError = class extends Error {
-  constructor(current) {
-    super("relay account revision conflict");
-    this.current = current;
-    this.name = "RelayAccountRevisionConflictError";
-  }
-  current;
-};
-var PLAN_DEFAULTS = {
-  free: { maxRoutes: 3, maxDevicesPerRoute: 16 },
-  team: { maxRoutes: 25, maxDevicesPerRoute: 64 },
-  enterprise: { maxRoutes: 500, maxDevicesPerRoute: 500 }
-};
-var UNSAFE_TERMINAL_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
-function safeId(value) {
-  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
-    throw new Error("invalid relay account id");
-  }
-  return value;
-}
-function safeLabel(value) {
-  if (typeof value !== "string") throw new Error("relay account label is required");
-  const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 120 || UNSAFE_TERMINAL_TEXT.test(label)) {
-    throw new Error("invalid relay account label");
-  }
-  return label;
-}
-function safeCredential(value) {
-  if (typeof value !== "string" || !/^rrk_[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay account credential");
-  }
-  return value;
-}
-function digest(label, credential) {
-  return createHash("sha256").update(label).update("\0").update(safeCredential(credential)).digest("base64url");
-}
-function relayAccountCredentialHash(credential) {
-  return `sha256:${digest("roamcode-relay-account-credential-v1", credential)}`;
-}
-function relayAccountCredentialLookup(credential) {
-  return `lookup:${digest("roamcode-relay-account-lookup-v1", credential)}`;
-}
-function generateRelayAccountCredential() {
-  return `rrk_${randomBytes(32).toString("base64url")}`;
-}
-function safeHash(value) {
-  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay account credential hash");
-  }
-  return value;
-}
-function safeLookup(value) {
-  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay account credential lookup");
-  }
-  return value;
-}
-function credentialMaterial(input) {
-  if (typeof input === "string") {
-    return {
-      credentialHash: relayAccountCredentialHash(input),
-      credentialLookup: relayAccountCredentialLookup(input)
-    };
-  }
-  if ("credential" in input && input.credential !== void 0) {
-    if (input.credentialHash !== void 0 || input.credentialLookup !== void 0) {
-      throw new Error("relay account credential must be raw or pre-hashed, not both");
-    }
-    return {
-      credentialHash: relayAccountCredentialHash(input.credential),
-      credentialLookup: relayAccountCredentialLookup(input.credential)
-    };
-  }
-  return {
-    credentialHash: safeHash(input.credentialHash),
-    credentialLookup: safeLookup(input.credentialLookup)
-  };
-}
-function hashMatches(expected, credential) {
-  try {
-    const left = Buffer.from(safeHash(expected));
-    const right = Buffer.from(relayAccountCredentialHash(credential));
-    return left.length === right.length && timingSafeEqual(left, right);
-  } catch {
-    return false;
-  }
-}
-function storedCredentialMatches(expectedHash, expectedLookup, credential) {
-  try {
-    const actual = credentialMaterial(credential);
-    const expectedHashBytes = Buffer.from(safeHash(expectedHash));
-    const actualHashBytes = Buffer.from(actual.credentialHash);
-    const expectedLookupBytes = Buffer.from(safeLookup(expectedLookup));
-    const actualLookupBytes = Buffer.from(actual.credentialLookup);
-    return expectedHashBytes.length === actualHashBytes.length && expectedLookupBytes.length === actualLookupBytes.length && timingSafeEqual(expectedHashBytes, actualHashBytes) && timingSafeEqual(expectedLookupBytes, actualLookupBytes);
-  } catch {
-    return false;
-  }
-}
-function safePlan(value) {
-  if (value !== "free" && value !== "team" && value !== "enterprise") throw new Error("invalid relay account plan");
-  return value;
-}
-function boundedLimit(value, fallback, maximum, field) {
-  const candidate = value === void 0 ? fallback : value;
-  if (!Number.isSafeInteger(candidate) || candidate < 1 || candidate > maximum) {
-    throw new Error(`invalid relay account ${field}`);
-  }
-  return candidate;
-}
-function safeStatus(value) {
-  if (value !== "active" && value !== "suspended" && value !== "deleted") {
-    throw new Error("invalid relay account status");
-  }
-  return value;
-}
-function clone(record) {
-  return {
-    id: record.id,
-    label: record.label,
-    status: record.status,
-    plan: record.plan,
-    maxRoutes: record.maxRoutes,
-    maxDevicesPerRoute: record.maxDevicesPerRoute,
-    revision: record.revision,
-    createdAt: record.createdAt,
-    updatedAt: record.updatedAt
-  };
-}
-function createMemoryStore(options) {
-  const accounts = /* @__PURE__ */ new Map();
-  const lookup = /* @__PURE__ */ new Map();
-  const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
-  const verifyCredential = (credential) => {
-    let credentialLookup;
-    try {
-      credentialLookup = relayAccountCredentialLookup(credential);
-    } catch {
-      return;
-    }
-    const id = lookup.get(credentialLookup);
-    const record = id ? accounts.get(id) : void 0;
-    return record && record.status !== "deleted" && hashMatches(record.credentialHash, credential) ? clone(record) : void 0;
-  };
-  return {
-    mode: "memory",
-    createAccount(input, now = Date.now()) {
-      const id = safeId(input.id ?? generateAccountId());
-      if (accounts.has(id)) throw new Error("relay account already exists");
-      const plan = safePlan(input.plan ?? "free");
-      const { credentialHash, credentialLookup } = credentialMaterial(input);
-      if (lookup.has(credentialLookup)) throw new Error("relay account credential already exists");
-      const defaults = PLAN_DEFAULTS[plan];
-      const record = {
-        id,
-        label: safeLabel(input.label),
-        status: "active",
-        plan,
-        maxRoutes: boundedLimit(input.maxRoutes, defaults.maxRoutes, 1e4, "route limit"),
-        maxDevicesPerRoute: boundedLimit(
-          input.maxDevicesPerRoute,
-          defaults.maxDevicesPerRoute,
-          1e5,
-          "device limit"
-        ),
-        revision: 1,
-        createdAt: now,
-        updatedAt: now,
-        credentialHash,
-        credentialLookup
-      };
-      accounts.set(id, record);
-      lookup.set(credentialLookup, id);
-      return clone(record);
-    },
-    getAccount(id) {
-      const record = accounts.get(safeId(id));
-      return record ? clone(record) : void 0;
-    },
-    listAccounts({ includeDeleted = false } = {}) {
-      return [...accounts.values()].filter((record) => includeDeleted || record.status !== "deleted").sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map(clone);
-    },
-    verifyCredential,
-    authenticate(credential) {
-      const record = verifyCredential(credential);
-      return record?.status === "active" ? record : void 0;
-    },
-    credentialMatches(id, credential) {
-      try {
-        const record = accounts.get(safeId(id));
-        return !!record && storedCredentialMatches(record.credentialHash, record.credentialLookup, credential);
-      } catch {
-        return false;
-      }
-    },
-    updateAccount(id, input, expectedRevision, now = Date.now()) {
-      const current = accounts.get(safeId(id));
-      if (!current) return void 0;
-      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
-      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const plan = input.plan === void 0 ? current.plan : safePlan(input.plan);
-      const status = input.status === void 0 ? current.status : safeStatus(input.status);
-      const defaults = PLAN_DEFAULTS[plan];
-      const next = {
-        ...current,
-        ...input.label === void 0 ? {} : { label: safeLabel(input.label) },
-        status,
-        plan,
-        maxRoutes: boundedLimit(
-          input.maxRoutes,
-          input.plan === void 0 ? current.maxRoutes : defaults.maxRoutes,
-          1e4,
-          "route limit"
-        ),
-        maxDevicesPerRoute: boundedLimit(
-          input.maxDevicesPerRoute,
-          input.plan === void 0 ? current.maxDevicesPerRoute : defaults.maxDevicesPerRoute,
-          1e5,
-          "device limit"
-        ),
-        revision: current.revision + 1,
-        updatedAt: now
-      };
-      accounts.set(current.id, next);
-      return clone(next);
-    },
-    rotateCredential(id, credential, expectedRevision, now = Date.now()) {
-      const current = accounts.get(safeId(id));
-      if (!current) return void 0;
-      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(clone(current));
-      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const { credentialHash, credentialLookup } = credentialMaterial(credential);
-      const owner = lookup.get(credentialLookup);
-      if (owner && owner !== current.id) throw new Error("relay account credential already exists");
-      lookup.delete(current.credentialLookup);
-      lookup.set(credentialLookup, current.id);
-      const next = {
-        ...current,
-        credentialHash,
-        credentialLookup,
-        revision: current.revision + 1,
-        updatedAt: now
-      };
-      accounts.set(current.id, next);
-      return clone(next);
-    },
-    close() {
-      accounts.clear();
-      lookup.clear();
-    }
-  };
-}
-function normalizeSqliteAccountConstraint(error) {
-  const code = error?.code;
-  const message = error instanceof Error ? error.message : "";
-  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.credential_lookup")) {
-    throw new Error("relay account credential already exists");
-  }
-  if (code === "SQLITE_CONSTRAINT_UNIQUE" && message.includes("relay_accounts.id")) {
-    throw new Error("relay account already exists");
-  }
-  throw error;
-}
-function fromRow(row) {
-  return {
-    id: row.id,
-    label: row.label,
-    status: row.status,
-    plan: row.plan,
-    maxRoutes: row.max_routes,
-    maxDevicesPerRoute: row.max_devices_per_route,
-    revision: row.revision,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
-function openRelayAccountStore(options) {
-  let Database;
-  try {
-    if (options.loadDatabase) Database = options.loadDatabase();
-    else {
-      const mod = require2("better-sqlite3");
-      Database = mod.default ?? mod;
-    }
-  } catch {
-    return createMemoryStore(options);
-  }
-  const db = new Database(options.dbPath);
-  db.pragma("journal_mode = WAL");
-  db.pragma("busy_timeout = 5000");
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS relay_accounts (
-      id TEXT PRIMARY KEY,
-      label TEXT NOT NULL,
-      status TEXT NOT NULL CHECK(status IN ('active', 'suspended', 'deleted')),
-      plan TEXT NOT NULL CHECK(plan IN ('free', 'team', 'enterprise')),
-      max_routes INTEGER NOT NULL,
-      max_devices_per_route INTEGER NOT NULL,
-      revision INTEGER NOT NULL,
-      credential_hash TEXT NOT NULL,
-      credential_lookup TEXT NOT NULL UNIQUE,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS relay_accounts_status_idx ON relay_accounts(status);
-  `);
-  const generateAccountId = options.generateAccountId ?? (() => `rra_${randomBytes(18).toString("base64url")}`);
-  const rowById = (id) => db.prepare("SELECT * FROM relay_accounts WHERE id = ?").get(id);
-  const verifyCredential = (credential) => {
-    let credentialLookup;
-    try {
-      credentialLookup = relayAccountCredentialLookup(credential);
-    } catch {
-      return;
-    }
-    const row = db.prepare("SELECT * FROM relay_accounts WHERE credential_lookup = ? AND status != 'deleted'").get(credentialLookup);
-    return row && hashMatches(row.credential_hash, credential) ? fromRow(row) : void 0;
-  };
-  const createAccount = db.transaction((input, now) => {
-    const id = safeId(input.id ?? generateAccountId());
-    if (rowById(id)) throw new Error("relay account already exists");
-    const plan = safePlan(input.plan ?? "free");
-    const { credentialHash, credentialLookup } = credentialMaterial(input);
-    const defaults = PLAN_DEFAULTS[plan];
-    const record = {
-      id,
-      label: safeLabel(input.label),
-      status: "active",
-      plan,
-      maxRoutes: boundedLimit(input.maxRoutes, defaults.maxRoutes, 1e4, "route limit"),
-      maxDevicesPerRoute: boundedLimit(input.maxDevicesPerRoute, defaults.maxDevicesPerRoute, 1e5, "device limit"),
-      revision: 1,
-      createdAt: now,
-      updatedAt: now
-    };
-    try {
-      db.prepare(
-        `INSERT INTO relay_accounts
-         (id, label, status, plan, max_routes, max_devices_per_route, revision, credential_hash,
-          credential_lookup, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-      ).run(
-        record.id,
-        record.label,
-        record.status,
-        record.plan,
-        record.maxRoutes,
-        record.maxDevicesPerRoute,
-        record.revision,
-        credentialHash,
-        credentialLookup,
-        record.createdAt,
-        record.updatedAt
-      );
-    } catch (error) {
-      normalizeSqliteAccountConstraint(error);
-    }
-    return record;
-  });
-  return {
-    mode: "sqlite",
-    createAccount: (input, now = Date.now()) => clone(createAccount(input, now)),
-    getAccount(id) {
-      const row = rowById(safeId(id));
-      return row ? fromRow(row) : void 0;
-    },
-    listAccounts({ includeDeleted = false } = {}) {
-      const rows = db.prepare(
-        `SELECT * FROM relay_accounts ${includeDeleted ? "" : "WHERE status != 'deleted'"}
-           ORDER BY created_at, id`
-      ).all();
-      return rows.map(fromRow);
-    },
-    verifyCredential,
-    authenticate(credential) {
-      const record = verifyCredential(credential);
-      return record?.status === "active" ? record : void 0;
-    },
-    credentialMatches(id, credential) {
-      try {
-        const row = rowById(safeId(id));
-        return !!row && storedCredentialMatches(row.credential_hash, row.credential_lookup, credential);
-      } catch {
-        return false;
-      }
-    },
-    updateAccount(id, input, expectedRevision, now = Date.now()) {
-      const safeAccountId2 = safeId(id);
-      const currentRow = rowById(safeAccountId2);
-      if (!currentRow) return void 0;
-      const current = fromRow(currentRow);
-      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
-      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const plan = input.plan === void 0 ? current.plan : safePlan(input.plan);
-      const defaults = PLAN_DEFAULTS[plan];
-      const next = {
-        ...current,
-        ...input.label === void 0 ? {} : { label: safeLabel(input.label) },
-        status: input.status === void 0 ? current.status : safeStatus(input.status),
-        plan,
-        maxRoutes: boundedLimit(
-          input.maxRoutes,
-          input.plan === void 0 ? current.maxRoutes : defaults.maxRoutes,
-          1e4,
-          "route limit"
-        ),
-        maxDevicesPerRoute: boundedLimit(
-          input.maxDevicesPerRoute,
-          input.plan === void 0 ? current.maxDevicesPerRoute : defaults.maxDevicesPerRoute,
-          1e5,
-          "device limit"
-        ),
-        revision: current.revision + 1,
-        updatedAt: now
-      };
-      const result = db.prepare(
-        `UPDATE relay_accounts SET label = ?, status = ?, plan = ?, max_routes = ?,
-           max_devices_per_route = ?, revision = ?, updated_at = ? WHERE id = ? AND revision = ?`
-      ).run(
-        next.label,
-        next.status,
-        next.plan,
-        next.maxRoutes,
-        next.maxDevicesPerRoute,
-        next.revision,
-        next.updatedAt,
-        next.id,
-        expectedRevision
-      );
-      if (result.changes !== 1) {
-        const latest = rowById(safeAccountId2);
-        if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
-        return void 0;
-      }
-      return next;
-    },
-    rotateCredential(id, credential, expectedRevision, now = Date.now()) {
-      const safeAccountId2 = safeId(id);
-      const currentRow = rowById(safeAccountId2);
-      if (!currentRow) return void 0;
-      const current = fromRow(currentRow);
-      if (current.revision !== expectedRevision) throw new RelayAccountRevisionConflictError(current);
-      if (current.status === "deleted") throw new Error("deleted relay account is immutable");
-      const { credentialHash, credentialLookup } = credentialMaterial(credential);
-      let result;
-      try {
-        result = db.prepare(
-          `UPDATE relay_accounts SET credential_hash = ?, credential_lookup = ?, revision = revision + 1,
-             updated_at = ? WHERE id = ? AND revision = ?`
-        ).run(credentialHash, credentialLookup, now, safeAccountId2, expectedRevision);
-      } catch (error) {
-        normalizeSqliteAccountConstraint(error);
-      }
-      if (result.changes !== 1) {
-        const latest = rowById(safeAccountId2);
-        if (latest) throw new RelayAccountRevisionConflictError(fromRow(latest));
-        return void 0;
-      }
-      return fromRow(rowById(safeAccountId2));
-    },
-    close: () => db.close()
-  };
-}
-
-// src/relay-store.ts
-import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { createRequire as createRequire2 } from "module";
-var require3 = createRequire2(import.meta.url);
-var UNSAFE_DISPLAY_TEXT = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
-function safeId2(value, field) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
-  return value;
-}
-function safeOwnerAccountId(value) {
-  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
-    throw new Error("invalid relay route owner");
-  }
-  return value;
-}
-function safeLabel2(value) {
-  if (typeof value !== "string") throw new Error("relay route label is required");
-  const normalized = value.trim().replace(/\s+/g, " ");
-  if (!normalized || normalized.length > 80 || UNSAFE_DISPLAY_TEXT.test(normalized)) {
-    throw new Error("invalid relay route label");
-  }
-  return normalized;
-}
-function safeCredential2(value) {
-  if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
-    throw new Error("invalid relay credential");
-  }
-  return value;
-}
-function relayCredentialHash(credential) {
-  return `sha256:${createHash2("sha256").update("roamcode-relay-credential-v1\0").update(safeCredential2(credential)).digest("base64url")}`;
-}
-function generateRelayCredential(prefix = "rrd") {
-  return `${prefix}_${randomBytes2(32).toString("base64url")}`;
-}
-function safeCredentialHash(value) {
-  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay credential hash");
-  }
-  return value;
-}
-function safeExpiry(value) {
-  if (value === void 0) return void 0;
-  if (!Number.isSafeInteger(value) || value < 0) throw new Error("invalid relay device expiry");
-  return value;
-}
-function hashMatches2(expected, credential) {
-  try {
-    const actual = relayCredentialHash(credential);
-    const left = Buffer.from(safeCredentialHash(expected));
-    const right = Buffer.from(actual);
-    return left.length === right.length && timingSafeEqual2(left, right);
-  } catch {
-    return false;
-  }
-}
-function cloneRoute(route) {
-  return { ...route };
-}
-function cloneDevice(device) {
-  return {
-    routeId: device.routeId,
-    deviceId: device.deviceId,
-    credentialHash: device.credentialHash,
-    createdAt: device.createdAt,
-    updatedAt: device.updatedAt,
-    ...device.expiresAt === void 0 ? {} : { expiresAt: device.expiresAt }
-  };
-}
-function credentialOverlap(current, credentialHash, expiresAt, now) {
-  if (!current || expiresAt !== void 0) return {};
-  if (current.expiresAt !== void 0) {
-    if (current.credentialHash === credentialHash) {
-      throw new Error("relay bootstrap promotion must rotate the device credential");
-    }
-    return {
-      previousCredentialHash: current.credentialHash,
-      previousCredentialExpiresAt: current.expiresAt
-    };
-  }
-  if (current.previousCredentialHash !== void 0 && current.previousCredentialExpiresAt !== void 0 && current.previousCredentialExpiresAt >= now) {
-    if (current.previousCredentialHash === credentialHash) {
-      throw new Error("relay bootstrap credential cannot become durable");
-    }
-    return {
-      previousCredentialHash: current.previousCredentialHash,
-      previousCredentialExpiresAt: current.previousCredentialExpiresAt
-    };
-  }
-  return {};
-}
-function createMemoryStore2(options) {
-  const routes = /* @__PURE__ */ new Map();
-  const devices = /* @__PURE__ */ new Map();
-  const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
-  const deviceKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
-  const pruneExpiredDevices = (now) => {
-    for (const [key, device] of devices) {
-      if (device.expiresAt !== void 0 && device.expiresAt < now) devices.delete(key);
-      else if (device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt < now) {
-        delete device.previousCredentialHash;
-        delete device.previousCredentialExpiresAt;
-      }
-    }
-  };
-  const liveDevice = (routeId, deviceId, now) => {
-    const key = deviceKey(routeId, deviceId);
-    const device = devices.get(key);
-    if (device?.expiresAt !== void 0 && device.expiresAt < now) {
-      devices.delete(key);
-      return;
-    }
-    return device;
-  };
-  const listRoutes = (now, ownerAccountId) => {
-    pruneExpiredDevices(now);
-    return [...routes.values()].filter((route) => ownerAccountId === void 0 || route.ownerAccountId === ownerAccountId).sort((a, b) => a.createdAt - b.createdAt || a.id.localeCompare(b.id)).map((route) => ({
-      id: route.id,
-      label: route.label,
-      deviceCount: [...devices.values()].filter(
-        (device) => device.routeId === route.id && (device.expiresAt === void 0 || device.expiresAt >= now)
-      ).length,
-      createdAt: route.createdAt,
-      updatedAt: route.updatedAt
-    }));
-  };
-  return {
-    mode: "memory",
-    createRoute(input, now = Date.now()) {
-      const id = safeId2(input.id ?? generateRouteId(), "route id");
-      if (routes.has(id)) throw new Error("relay route already exists");
-      const route = {
-        id,
-        label: safeLabel2(input.label),
-        hostCredentialHash: safeCredentialHash(input.hostCredentialHash),
-        ...input.ownerAccountId === void 0 ? {} : { ownerAccountId: safeOwnerAccountId(input.ownerAccountId) },
-        createdAt: now,
-        updatedAt: now
-      };
-      routes.set(id, route);
-      return cloneRoute(route);
-    },
-    getRoute(id) {
-      const route = routes.get(safeId2(id, "route id"));
-      return route ? cloneRoute(route) : void 0;
-    },
-    listRoutes: (now = Date.now()) => listRoutes(now),
-    listRoutesByOwner(ownerAccountId, now = Date.now()) {
-      return listRoutes(now, safeOwnerAccountId(ownerAccountId));
-    },
-    countDevices(routeId, now = Date.now()) {
-      pruneExpiredDevices(now);
-      const safeRouteId = safeId2(routeId, "route id");
-      return [...devices.values()].filter(
-        (device) => device.routeId === safeRouteId && (device.expiresAt === void 0 || device.expiresAt >= now)
-      ).length;
-    },
-    rotateHostCredential(routeId, credentialHash, now = Date.now()) {
-      const route = routes.get(safeId2(routeId, "route id"));
-      if (!route) return false;
-      route.hostCredentialHash = safeCredentialHash(credentialHash);
-      route.updatedAt = now;
-      return true;
-    },
-    deleteRoute(id) {
-      const safeRouteId = safeId2(id, "route id");
-      if (!routes.delete(safeRouteId)) return false;
-      for (const [key, device] of devices) if (device.routeId === safeRouteId) devices.delete(key);
-      return true;
-    },
-    authenticateHost(routeId, credential) {
-      const route = routes.get(safeId2(routeId, "route id"));
-      return !!route && hashMatches2(route.hostCredentialHash, credential);
-    },
-    putDevice(input, now = Date.now()) {
-      pruneExpiredDevices(now);
-      const routeId = safeId2(input.routeId, "route id");
-      if (!routes.has(routeId)) throw new Error("relay route not found");
-      const deviceId = safeId2(input.deviceId, "device id");
-      const key = deviceKey(routeId, deviceId);
-      const current = devices.get(key);
-      const credentialHash = safeCredentialHash(input.credentialHash);
-      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
-      const device = {
-        routeId,
-        deviceId,
-        credentialHash,
-        createdAt: current?.createdAt ?? now,
-        updatedAt: now,
-        ...expiresAt === void 0 ? {} : { expiresAt },
-        ...credentialOverlap(current, credentialHash, expiresAt, now)
-      };
-      devices.set(key, device);
-      const route = routes.get(routeId);
-      route.updatedAt = now;
-      return cloneDevice(device);
-    },
-    getDevice(routeId, deviceId, now = Date.now()) {
-      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
-      return device ? cloneDevice(device) : void 0;
-    },
-    authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const device = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
-      return !!device && (hashMatches2(device.credentialHash, credential) || device.previousCredentialHash !== void 0 && device.previousCredentialExpiresAt !== void 0 && device.previousCredentialExpiresAt >= now && hashMatches2(device.previousCredentialHash, credential));
-    },
-    revokeDevice(routeId, deviceId) {
-      const safeRouteId = safeId2(routeId, "route id");
-      const removed = devices.delete(deviceKey(safeRouteId, safeId2(deviceId, "device id")));
-      if (removed) routes.get(safeRouteId).updatedAt = Date.now();
-      return removed;
-    },
-    close() {
-      routes.clear();
-      devices.clear();
-    }
-  };
-}
-function routeFromRow(row) {
-  return {
-    id: row.id,
-    label: row.label,
-    hostCredentialHash: row.host_credential_hash,
-    ...row.owner_account_id === null ? {} : { ownerAccountId: row.owner_account_id },
-    createdAt: row.created_at,
-    updatedAt: row.updated_at
-  };
-}
-function deviceFromRow(row) {
-  return {
-    routeId: row.route_id,
-    deviceId: row.device_id,
-    credentialHash: row.credential_hash,
-    createdAt: row.created_at,
-    updatedAt: row.updated_at,
-    ...row.expires_at === null || row.expires_at === void 0 ? {} : { expiresAt: row.expires_at }
-  };
-}
-function openRelayRouteStore(options) {
-  let Database;
-  try {
-    if (options.loadDatabase) Database = options.loadDatabase();
-    else {
-      const mod = require3("better-sqlite3");
-      Database = mod.default ?? mod;
-    }
-  } catch {
-    return createMemoryStore2(options);
-  }
-  const db = new Database(options.dbPath);
-  db.pragma("journal_mode = WAL");
-  db.pragma("busy_timeout = 5000");
-  db.pragma("foreign_keys = ON");
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS relay_routes (
-      id TEXT PRIMARY KEY,
-      label TEXT NOT NULL,
-      host_credential_hash TEXT NOT NULL,
-      owner_account_id TEXT,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS relay_route_devices (
-      route_id TEXT NOT NULL REFERENCES relay_routes(id) ON DELETE CASCADE,
-      device_id TEXT NOT NULL,
-      credential_hash TEXT NOT NULL,
-      previous_credential_hash TEXT,
-      previous_credential_expires_at INTEGER,
-      created_at INTEGER NOT NULL,
-      updated_at INTEGER NOT NULL,
-      expires_at INTEGER,
-      PRIMARY KEY(route_id, device_id)
-    );
-  `);
-  const relayDeviceColumns = db.prepare("PRAGMA table_info(relay_route_devices)").all();
-  if (!relayDeviceColumns.some((column) => column.name === "expires_at")) {
-    db.exec("ALTER TABLE relay_route_devices ADD COLUMN expires_at INTEGER");
-  }
-  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_hash")) {
-    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_hash TEXT");
-  }
-  if (!relayDeviceColumns.some((column) => column.name === "previous_credential_expires_at")) {
-    db.exec("ALTER TABLE relay_route_devices ADD COLUMN previous_credential_expires_at INTEGER");
-  }
-  const relayRouteColumns = db.prepare("PRAGMA table_info(relay_routes)").all();
-  if (!relayRouteColumns.some((column) => column.name === "owner_account_id")) {
-    db.exec("ALTER TABLE relay_routes ADD COLUMN owner_account_id TEXT");
-  }
-  db.exec("CREATE INDEX IF NOT EXISTS relay_routes_owner_idx ON relay_routes(owner_account_id)");
-  const generateRouteId = options.generateRouteId ?? (() => `rrt_${randomBytes2(16).toString("base64url")}`);
-  const getRoute = (id) => db.prepare("SELECT * FROM relay_routes WHERE id = ?").get(id);
-  const getDevice = (routeId, deviceId) => db.prepare("SELECT * FROM relay_route_devices WHERE route_id = ? AND device_id = ?").get(routeId, deviceId);
-  const pruneExpiredDevices = (now) => {
-    db.prepare("DELETE FROM relay_route_devices WHERE expires_at IS NOT NULL AND expires_at < ?").run(now);
-    db.prepare(
-      `UPDATE relay_route_devices SET previous_credential_hash = NULL, previous_credential_expires_at = NULL
-       WHERE previous_credential_expires_at IS NOT NULL AND previous_credential_expires_at < ?`
-    ).run(now);
-  };
-  const liveDevice = (routeId, deviceId, now) => {
-    const row = getDevice(routeId, deviceId);
-    if (row?.expires_at !== null && row?.expires_at !== void 0 && row.expires_at < now) {
-      db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(routeId, deviceId);
-      return;
-    }
-    return row;
-  };
-  const createRoute = db.transaction(
-    (input, now) => {
-      const id = safeId2(input.id ?? generateRouteId(), "route id");
-      if (getRoute(id)) throw new Error("relay route already exists");
-      const route = {
-        id,
-        label: safeLabel2(input.label),
-        hostCredentialHash: safeCredentialHash(input.hostCredentialHash),
-        ...input.ownerAccountId === void 0 ? {} : { ownerAccountId: safeOwnerAccountId(input.ownerAccountId) },
-        createdAt: now,
-        updatedAt: now
-      };
-      db.prepare(
-        `INSERT INTO relay_routes
-         (id, label, host_credential_hash, owner_account_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?)`
-      ).run(
-        route.id,
-        route.label,
-        route.hostCredentialHash,
-        route.ownerAccountId ?? null,
-        route.createdAt,
-        route.updatedAt
-      );
-      return route;
-    }
-  );
-  const putDevice = db.transaction(
-    (input, now) => {
-      const routeId = safeId2(input.routeId, "route id");
-      if (!getRoute(routeId)) throw new Error("relay route not found");
-      pruneExpiredDevices(now);
-      const deviceId = safeId2(input.deviceId, "device id");
-      const current = getDevice(routeId, deviceId);
-      const credentialHash = safeCredentialHash(input.credentialHash);
-      const expiresAt = input.expiresAt === void 0 ? void 0 : safeExpiry(input.expiresAt);
-      const overlap = credentialOverlap(
-        current ? {
-          ...deviceFromRow(current),
-          ...current.previous_credential_hash === null || current.previous_credential_hash === void 0 ? {} : { previousCredentialHash: current.previous_credential_hash },
-          ...current.previous_credential_expires_at === null || current.previous_credential_expires_at === void 0 ? {} : { previousCredentialExpiresAt: current.previous_credential_expires_at }
-        } : void 0,
-        credentialHash,
-        expiresAt,
-        now
-      );
-      const device = {
-        routeId,
-        deviceId,
-        credentialHash,
-        createdAt: current?.created_at ?? now,
-        updatedAt: now,
-        ...expiresAt === void 0 ? {} : { expiresAt }
-      };
-      db.prepare(
-        `INSERT INTO relay_route_devices
-         (route_id, device_id, credential_hash, previous_credential_hash, previous_credential_expires_at,
-          created_at, updated_at, expires_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT(route_id, device_id) DO UPDATE SET credential_hash = excluded.credential_hash,
-           previous_credential_hash = excluded.previous_credential_hash,
-           previous_credential_expires_at = excluded.previous_credential_expires_at,
-           updated_at = excluded.updated_at, expires_at = excluded.expires_at`
-      ).run(
-        device.routeId,
-        device.deviceId,
-        device.credentialHash,
-        overlap.previousCredentialHash ?? null,
-        overlap.previousCredentialExpiresAt ?? null,
-        device.createdAt,
-        device.updatedAt,
-        device.expiresAt ?? null
-      );
-      db.prepare("UPDATE relay_routes SET updated_at = ? WHERE id = ?").run(now, routeId);
-      return device;
-    }
-  );
-  const listRoutes = (now, ownerAccountId) => {
-    pruneExpiredDevices(now);
-    return db.prepare(
-      `SELECT r.id, r.label, r.created_at, r.updated_at, COUNT(d.device_id) AS device_count
-           FROM relay_routes r LEFT JOIN relay_route_devices d ON d.route_id = r.id
-             AND (d.expires_at IS NULL OR d.expires_at >= ?)
-           ${ownerAccountId === void 0 ? "" : "WHERE r.owner_account_id = ?"}
-           GROUP BY r.id ORDER BY r.created_at, r.id`
-    ).all(now, ...ownerAccountId === void 0 ? [] : [safeOwnerAccountId(ownerAccountId)]).map((row) => ({
-      id: row.id,
-      label: row.label,
-      deviceCount: row.device_count,
-      createdAt: row.created_at,
-      updatedAt: row.updated_at
-    }));
-  };
-  return {
-    mode: "sqlite",
-    createRoute: (input, now = Date.now()) => cloneRoute(createRoute(input, now)),
-    getRoute(id) {
-      const row = getRoute(safeId2(id, "route id"));
-      return row ? routeFromRow(row) : void 0;
-    },
-    listRoutes: (now = Date.now()) => listRoutes(now),
-    listRoutesByOwner: (ownerAccountId, now = Date.now()) => listRoutes(now, ownerAccountId),
-    countDevices(routeId, now = Date.now()) {
-      pruneExpiredDevices(now);
-      const row = db.prepare(
-        `SELECT COUNT(*) AS count FROM relay_route_devices
-           WHERE route_id = ? AND (expires_at IS NULL OR expires_at >= ?)`
-      ).get(safeId2(routeId, "route id"), now);
-      return row.count;
-    },
-    rotateHostCredential(routeId, credentialHash, now = Date.now()) {
-      return db.prepare("UPDATE relay_routes SET host_credential_hash = ?, updated_at = ? WHERE id = ?").run(safeCredentialHash(credentialHash), now, safeId2(routeId, "route id")).changes > 0;
-    },
-    deleteRoute(id) {
-      return db.prepare("DELETE FROM relay_routes WHERE id = ?").run(safeId2(id, "route id")).changes > 0;
-    },
-    authenticateHost(routeId, credential) {
-      const row = getRoute(safeId2(routeId, "route id"));
-      return !!row && hashMatches2(row.host_credential_hash, credential);
-    },
-    putDevice: (input, now = Date.now()) => cloneDevice(putDevice(input, now)),
-    getDevice(routeId, deviceId, now = Date.now()) {
-      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
-      return row ? deviceFromRow(row) : void 0;
-    },
-    authenticateDevice(routeId, deviceId, credential, now = Date.now()) {
-      const row = liveDevice(safeId2(routeId, "route id"), safeId2(deviceId, "device id"), now);
-      return !!row && (hashMatches2(row.credential_hash, credential) || row.previous_credential_hash !== null && row.previous_credential_hash !== void 0 && row.previous_credential_expires_at !== null && row.previous_credential_expires_at !== void 0 && row.previous_credential_expires_at >= now && hashMatches2(row.previous_credential_hash, credential));
-    },
-    revokeDevice(routeId, deviceId) {
-      const safeRouteId = safeId2(routeId, "route id");
-      const result = db.prepare("DELETE FROM relay_route_devices WHERE route_id = ? AND device_id = ?").run(safeRouteId, safeId2(deviceId, "device id"));
-      if (result.changes > 0)
-        db.prepare("UPDATE relay_routes SET updated_at = ? WHERE id = ?").run(Date.now(), safeRouteId);
-      return result.changes > 0;
-    },
-    close: () => db.close()
-  };
-}
-
-// src/relay-broker.ts
-var BLIND_RELAY_PROTOCOL_VERSION = 1;
-var BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES = 15e5;
-var BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES = 4e6;
-var BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS = 1024;
-var BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE = 64;
-var BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE = 64 * 1024 * 1024;
-var BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE = 12e3;
-var UNSAFE_DISPLAY_TEXT2 = /[\p{Cc}\p{Zl}\p{Zp}\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/u;
-function safeToken(value, field) {
-  if (typeof value !== "string" || value.length < 32 || value.length > 256 || !/^[A-Za-z0-9_-]+$/.test(value)) {
-    throw new Error(`invalid relay ${field}`);
-  }
-  return value;
-}
-function safeCredentialHash2(value) {
-  if (typeof value !== "string" || !/^sha256:[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay credential hash");
-  }
-  return value;
-}
-function safeId3(value, field) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,256}$/.test(value)) throw new Error(`invalid relay ${field}`);
-  return value;
-}
-function safeLabel3(value) {
-  if (typeof value !== "string") throw new Error("relay route label is required");
-  const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 80 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay route label");
-  return label;
-}
-function safeExpiry2(value, now) {
-  if (value === void 0 || value === null) return void 0;
-  if (!Number.isSafeInteger(value) || value <= now || value > now + 10 * 6e4) {
-    throw new Error("invalid relay device expiry");
-  }
-  return value;
-}
-function safeRevision(value) {
-  if (!Number.isSafeInteger(value) || value < 1) throw new Error("invalid relay account revision");
-  return value;
-}
-function safeAccountId(value) {
-  if (typeof value !== "string" || !/^rra_[A-Za-z0-9_-]{16,128}$/.test(value)) {
-    throw new Error("invalid relay account id");
-  }
-  return value;
-}
-function safeAccountLabel(value) {
-  if (typeof value !== "string") throw new Error("relay account label is required");
-  const label = value.trim().replace(/\s+/g, " ");
-  if (!label || label.length > 120 || UNSAFE_DISPLAY_TEXT2.test(label)) throw new Error("invalid relay account label");
-  return label;
-}
-function safeAccountPlan(value) {
-  if (value !== "free" && value !== "team" && value !== "enterprise") {
-    throw new Error("invalid relay account plan");
-  }
-  return value;
-}
-function safeAccountLimit(value, maximum) {
-  if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
-    throw new Error("invalid relay account limit");
-  }
-  return value;
-}
-function strictInternalBody(value, allowedFields) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid internal request body");
-  const body = value;
-  if (Object.keys(body).some((field) => !allowedFields.includes(field))) {
-    throw new Error("unknown internal request field");
-  }
-  return body;
-}
-function safeCredentialLookup(value) {
-  if (typeof value !== "string" || !/^lookup:[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error("invalid relay credential lookup");
-  }
-  return value;
-}
-function safeAccountCredentialMaterial(body) {
-  if (!body || body.credential !== void 0 || body.accountCredential !== void 0) {
-    throw new Error("client-hashed account credential material is required");
-  }
-  return {
-    credentialHash: safeCredentialHash2(body.credentialHash),
-    credentialLookup: safeCredentialLookup(body.credentialLookup)
-  };
-}
-function safeRouteCredentialHash(body, field = "credentialHash") {
-  if (!body || body.credential !== void 0 || body.hostCredential !== void 0) {
-    throw new Error("client-hashed route credential material is required");
-  }
-  return safeCredentialHash2(body[field]);
-}
-function bearer(request) {
-  const value = request.headers.authorization;
-  if (!value || Array.isArray(value)) return;
-  const match = /^Bearer ([A-Za-z0-9_-]{32,256})$/.exec(value);
-  return match?.[1];
-}
-function tokenMatches(left, right) {
-  if (!right) return false;
-  const a = Buffer.from(left);
-  const b = Buffer.from(right);
-  return a.length === b.length && timingSafeEqual3(a, b);
-}
-function publicRoute(route) {
-  return {
-    id: route.id,
-    label: route.label,
-    deviceCount: route.deviceCount,
-    createdAt: route.createdAt,
-    updatedAt: route.updatedAt
-  };
-}
-function normalizeOrigin(value) {
-  try {
-    const url = new URL(value);
-    const loopback = url.hostname === "localhost" || url.hostname === "::1" || url.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(url.hostname);
-    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
-      return;
-    return url.origin;
-  } catch {
-    return;
-  }
-}
-function parseJson(raw, limit) {
-  const buffer = Buffer.isBuffer(raw) ? raw : raw instanceof ArrayBuffer ? Buffer.from(raw) : Buffer.concat(raw);
-  if (buffer.byteLength > limit) throw new Error("relay frame too large");
-  return JSON.parse(buffer.toString("utf8"));
-}
-function parseAuthHello(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid relay hello");
-  const hello = value;
-  if (hello.v !== BLIND_RELAY_PROTOCOL_VERSION || hello.role !== "host" && hello.role !== "device") {
-    throw new Error("invalid relay hello");
-  }
-  const routeId = safeId3(hello.routeId, "route id");
-  const credential = safeToken(hello.credential, "credential");
-  return hello.role === "host" ? { v: 1, role: "host", routeId, credential } : { v: 1, role: "device", routeId, deviceId: safeId3(hello.deviceId, "device id"), credential };
-}
-function parsePayload(value, requireChannel, maxBytes) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid relay frame");
-  const frame = value;
-  if (frame.t !== "frame" || typeof frame.payload !== "string" || !/^[A-Za-z0-9_-]+$/.test(frame.payload)) {
-    throw new Error("invalid relay frame");
-  }
-  const bytes = Math.floor(frame.payload.length * 3 / 4);
-  if (bytes < 1 || bytes > maxBytes) throw new Error("relay frame too large");
-  const canonical = Buffer.from(frame.payload, "base64url").toString("base64url");
-  if (canonical !== frame.payload) throw new Error("invalid relay frame");
-  return {
-    ...requireChannel ? { channelId: safeId3(frame.channelId, "channel id") } : {},
-    payload: frame.payload,
-    bytes
-  };
-}
-function safeSend(socket, value, maxQueueBytes) {
-  if (socket.readyState !== socket.OPEN) return false;
-  const encoded = JSON.stringify(value);
-  if (socket.bufferedAmount + Buffer.byteLength(encoded) > maxQueueBytes) return false;
-  try {
-    socket.send(encoded);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function createBlindRelayServer(options) {
-  const rootTokens = [safeToken(options.rootToken, "root token")];
-  for (const token of options.previousRootTokens ?? []) rootTokens.push(safeToken(token, "previous root token"));
-  if (rootTokens.length > 4 || new Set(rootTokens).size !== rootTokens.length) {
-    throw new Error("invalid relay root token rotation set");
-  }
-  const store = options.store ?? openRelayRouteStore({ dbPath: ":memory:" });
-  const ownsStore = options.store === void 0;
-  const accountStore = options.accountStore;
-  const now = options.now ?? Date.now;
-  const handshakeTimeoutMs = options.handshakeTimeoutMs ?? 5e3;
-  const idleTimeoutMs = options.idleTimeoutMs ?? 2 * 6e4;
-  const maxFrameBytes = options.maxFrameBytes ?? BLIND_RELAY_DEFAULT_MAX_FRAME_BYTES;
-  const maxQueueBytes = options.maxQueueBytes ?? BLIND_RELAY_DEFAULT_MAX_QUEUE_BYTES;
-  const maxTotalConnections = options.maxTotalConnections ?? BLIND_RELAY_DEFAULT_MAX_TOTAL_CONNECTIONS;
-  const maxConnectionsPerRoute = options.maxConnectionsPerRoute ?? BLIND_RELAY_DEFAULT_MAX_CONNECTIONS_PER_ROUTE;
-  const maxBytesPerMinute = options.maxBytesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_BYTES_PER_MINUTE;
-  const maxMessagesPerMinute = options.maxMessagesPerMinute ?? BLIND_RELAY_DEFAULT_MAX_MESSAGES_PER_MINUTE;
-  for (const [value, minimum, maximum, label] of [
-    [handshakeTimeoutMs, 1e3, 3e4, "handshake timeout"],
-    [idleTimeoutMs, 1e4, 60 * 6e4, "idle timeout"],
-    [maxFrameBytes, 1024, 16 * 1024 * 1024, "frame limit"],
-    [maxQueueBytes, 1024, 64 * 1024 * 1024, "queue limit"],
-    [maxTotalConnections, 1, 1e5, "total connection limit"],
-    [maxConnectionsPerRoute, 1, 1e4, "connection limit"],
-    [maxBytesPerMinute, 1024, 1024 * 1024 * 1024, "byte rate"],
-    [maxMessagesPerMinute, 10, 1e6, "message rate"]
-  ]) {
-    if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`invalid relay ${label}`);
-  }
-  const maxEnvelopeBytes = Math.max(8 * 1024, Math.ceil(maxFrameBytes * 4 / 3) + 8 * 1024);
-  const configuredOrigins = options.allowedOrigins ?? [];
-  const normalizedOrigins = configuredOrigins.map(normalizeOrigin);
-  if (normalizedOrigins.some((origin) => origin === void 0)) {
-    throw new Error("invalid relay allowed origin");
-  }
-  const allowedOrigins = new Set(normalizedOrigins);
-  const generateChannelId = options.generateChannelId ?? (() => `rrc_${randomBytes3(16).toString("base64url")}`);
-  const hosts = /* @__PURE__ */ new Map();
-  const devicesByChannel = /* @__PURE__ */ new Map();
-  const sockets = /* @__PURE__ */ new Set();
-  const hostRates = /* @__PURE__ */ new Map();
-  const deviceRates = /* @__PURE__ */ new Map();
-  const maxRateIdentities = Math.min(1e5, Math.max(256, maxTotalConnections * 4));
-  const deviceRateKey = (routeId, deviceId) => `${routeId}\0${deviceId}`;
-  const clearRouteRates = (routeId) => {
-    hostRates.delete(routeId);
-    for (const key of deviceRates.keys()) if (key.startsWith(`${routeId}\0`)) deviceRates.delete(key);
-  };
-  const rateWindowFor = (windows, key) => {
-    const current = now();
-    if (windows.size >= maxRateIdentities) {
-      for (const [candidate, window] of windows) {
-        if (current - window.lastSeenAt >= 12e4) windows.delete(candidate);
-      }
-    }
-    const existing = windows.get(key);
-    if (existing) {
-      existing.lastSeenAt = current;
-      return existing;
-    }
-    if (windows.size >= maxRateIdentities) return;
-    const created = { startedAt: current, lastSeenAt: current, bytes: 0, messages: 0 };
-    windows.set(key, created);
-    return created;
-  };
-  const consumeRate = (window, bytes) => {
-    const current = now();
-    if (current - window.startedAt >= 6e4) {
-      window.startedAt = current;
-      window.bytes = 0;
-      window.messages = 0;
-    }
-    window.lastSeenAt = current;
-    window.bytes += bytes;
-    window.messages += 1;
-    return window.bytes <= maxBytesPerMinute && window.messages <= maxMessagesPerMinute;
-  };
-  const metrics = {
-    activeConnections: 0,
-    activeHosts: 0,
-    activeDevices: 0,
-    acceptedConnections: 0,
-    rejectedConnections: 0,
-    forwardedFrames: 0,
-    forwardedBytes: 0,
-    droppedFrames: 0
-  };
-  const app = Fastify({ logger: false, trustProxy: false, bodyLimit: 32 * 1024 });
-  const authenticatedAccounts = /* @__PURE__ */ new WeakMap();
-  const routeAccountIsActive = (routeId) => {
-    const ownerAccountId = store.getRoute(routeId)?.ownerAccountId;
-    if (!ownerAccountId) return true;
-    return accountStore?.getAccount(ownerAccountId)?.status === "active";
-  };
-  const requireRoot = async (request, reply) => {
-    const presented = bearer(request);
-    if (rootTokens.some((token) => tokenMatches(token, presented))) return;
-    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
-  };
-  const requireHost = async (request, reply) => {
-    try {
-      if (routeAccountIsActive(request.params.routeId) && store.authenticateHost(request.params.routeId, bearer(request) ?? ""))
-        return;
-    } catch {
-    }
-    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
-  };
-  const requireAccount = async (request, reply) => {
-    const account = accountStore?.authenticate(bearer(request) ?? "");
-    if (account) {
-      authenticatedAccounts.set(request, account);
-      return;
-    }
-    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
-  };
-  const requireRecoverableAccount = async (request, reply) => {
-    const account = accountStore?.verifyCredential(bearer(request) ?? "");
-    if (account) {
-      authenticatedAccounts.set(request, account);
-      return;
-    }
-    reply.header("www-authenticate", "Bearer").code(401).send({ code: "RELAY_UNAUTHORIZED", error: "unauthorized" });
-  };
-  app.addHook("onSend", async (_request, reply, payload) => {
-    reply.header("cache-control", "no-store");
-    reply.header("content-security-policy", "default-src 'none'");
-    reply.header("x-content-type-options", "nosniff");
-    return payload;
-  });
-  app.get("/health", async () => ({ status: "ok", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }));
-  app.get("/ready", async (_request, reply) => {
-    try {
-      store.listRoutes(now());
-      accountStore?.listAccounts();
-      return { status: "ready", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION };
-    } catch {
-      reply.code(503);
-      return { status: "unavailable", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION };
-    }
-  });
-  app.get("/v1/metrics", { preHandler: requireRoot }, async () => ({
-    protocolVersion: BLIND_RELAY_PROTOCOL_VERSION,
-    metrics: {
-      ...metrics,
-      activeConnections: sockets.size,
-      activeHosts: hosts.size,
-      activeDevices: devicesByChannel.size
-    }
-  }));
-  app.get("/v1/routes", { preHandler: requireRoot }, async () => ({ routes: store.listRoutes().map(publicRoute) }));
-  app.post(
-    "/v1/routes",
-    { preHandler: requireRoot },
-    async (request, reply) => {
-      try {
-        const hostCredential = generateRelayCredential("rrh");
-        const route = store.createRoute({
-          ...request.body?.id === void 0 ? {} : { id: safeId3(request.body.id, "route id") },
-          label: safeLabel3(request.body?.label),
-          hostCredentialHash: relayCredentialHash(hostCredential)
-        });
-        reply.code(201).send({
-          route: {
-            id: route.id,
-            label: route.label,
-            deviceCount: 0,
-            createdAt: route.createdAt,
-            updatedAt: route.updatedAt
-          },
-          hostCredential
-        });
-      } catch (error) {
-        const conflict = error.message === "relay route already exists";
-        reply.code(conflict ? 409 : 400).send({
-          code: conflict ? "RELAY_ROUTE_EXISTS" : "INVALID_RELAY_ROUTE",
-          error: conflict ? "relay route already exists" : "invalid relay route"
-        });
-      }
-    }
-  );
-  app.delete(
-    "/v1/routes/:routeId",
-    { preHandler: requireRoot },
-    async (request, reply) => {
-      let removed = false;
-      try {
-        removed = store.deleteRoute(request.params.routeId);
-      } catch {
-      }
-      if (!removed) {
-        reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-        return;
-      }
-      clearRouteRates(request.params.routeId);
-      const host = hosts.get(request.params.routeId);
-      host?.socket.close(4403, "route deleted");
-      for (const device of host?.devices.values() ?? []) device.socket.close(4403, "route deleted");
-      reply.code(204).send();
-    }
-  );
-  app.get(
-    "/v1/routes/:routeId/status",
-    { preHandler: requireHost },
-    async (request) => ({
-      routeId: request.params.routeId,
-      hostOnline: hosts.has(request.params.routeId),
-      activeDevices: hosts.get(request.params.routeId)?.devices.size ?? 0
-    })
-  );
-  app.put("/v1/routes/:routeId/devices/:deviceId", { preHandler: requireHost }, async (request, reply) => {
-    try {
-      const route = store.getRoute(request.params.routeId);
-      if (route?.ownerAccountId && !store.getDevice(route.id, request.params.deviceId, now())) {
-        const account = accountStore?.getAccount(route.ownerAccountId);
-        if (!account || store.countDevices(route.id, now()) >= account.maxDevicesPerRoute) {
-          reply.code(429).send({ code: "RELAY_DEVICE_LIMIT", error: "relay device limit reached" });
-          return;
-        }
-      }
-      const device = store.putDevice({
-        routeId: request.params.routeId,
-        deviceId: request.params.deviceId,
-        credentialHash: typeof request.body?.credentialHash === "string" ? request.body.credentialHash : "invalid",
-        ...request.body?.expiresAt === void 0 ? {} : { expiresAt: safeExpiry2(request.body.expiresAt, now()) }
-      });
-      reply.code(200).send({
-        device: {
-          routeId: device.routeId,
-          deviceId: device.deviceId,
-          createdAt: device.createdAt,
-          updatedAt: device.updatedAt
-        }
-      });
-    } catch {
-      reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device route" });
-    }
-  });
-  app.post("/v1/routes/:routeId/devices/:deviceId/promote", { preHandler: requireHost }, async (request, reply) => {
-    try {
-      const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
-      const routeId = safeId3(request.params.routeId, "route id");
-      const deviceId = safeId3(request.params.deviceId, "device id");
-      const expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
-      const credentialHash = safeCredentialHash2(body.credentialHash);
-      if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
-      const current = store.getDevice(routeId, deviceId, now());
-      if (!current) {
-        reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
-        return;
-      }
-      if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
-        reply.code(200).send({
-          device: {
-            routeId: current.routeId,
-            deviceId: current.deviceId,
-            createdAt: current.createdAt,
-            updatedAt: current.updatedAt,
-            expiresAt: null
-          }
-        });
-        return;
-      }
-      if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
-        reply.code(409).send({
-          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
-          error: "relay device credential conflict"
-        });
-        return;
-      }
-      const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
-      reply.code(200).send({
-        device: {
-          routeId: device.routeId,
-          deviceId: device.deviceId,
-          createdAt: device.createdAt,
-          updatedAt: device.updatedAt,
-          expiresAt: null
-        }
-      });
-    } catch {
-      reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
-    }
-  });
-  app.delete(
-    "/v1/routes/:routeId/devices/:deviceId",
-    { preHandler: requireHost },
-    async (request, reply) => {
-      let routeId;
-      let deviceId;
-      let expectedCredentialHash;
-      try {
-        routeId = safeId3(request.params.routeId, "route id");
-        deviceId = safeId3(request.params.deviceId, "device id");
-        if (request.body !== void 0) {
-          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
-          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
-        }
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
-        return;
-      }
-      const current = store.getDevice(routeId, deviceId, now());
-      if (!current) {
-        if (expectedCredentialHash) {
-          reply.code(204).send();
-          return;
-        }
-        reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
-        return;
-      }
-      if (expectedCredentialHash && !tokenMatches(current.credentialHash, expectedCredentialHash)) {
-        reply.code(409).send({
-          code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
-          error: "relay device credential conflict"
-        });
-        return;
-      }
-      store.revokeDevice(routeId, deviceId);
-      deviceRates.delete(deviceRateKey(routeId, deviceId));
-      const live = hosts.get(routeId)?.devices.get(deviceId);
-      live?.socket.close(4403, "device revoked");
-      reply.code(204).send();
-    }
-  );
-  const closeDevice = (device, code = 1e3, reason = "device disconnected") => {
-    if (device.closed) return;
-    device.closed = true;
-    if (device.idle) clearTimeout(device.idle);
-    devicesByChannel.delete(device.channelId);
-    const host = hosts.get(device.routeId);
-    if (host?.devices.get(device.deviceId) === device) host.devices.delete(device.deviceId);
-    metrics.activeDevices = Math.max(0, metrics.activeDevices - 1);
-    if (host && !safeSend(host.socket, { t: "peer-close", channelId: device.channelId, code }, maxQueueBytes)) {
-      metrics.droppedFrames += 1;
-      closeHost(host, 4408, "relay backpressure");
-    }
-    if (device.socket.readyState === device.socket.OPEN) device.socket.close(code, reason);
-  };
-  const touchDevice = (device) => {
-    if (device.idle) clearTimeout(device.idle);
-    device.idle = setTimeout(() => closeDevice(device, 4408, "idle timeout"), idleTimeoutMs);
-    device.idle.unref?.();
-  };
-  const closeHost = (host, code = 1e3, reason = "host disconnected") => {
-    if (host.closed) return;
-    host.closed = true;
-    if (host.idle) clearTimeout(host.idle);
-    if (hosts.get(host.routeId) === host) hosts.delete(host.routeId);
-    for (const device of [...host.devices.values()]) closeDevice(device, 4412, "host unavailable");
-    metrics.activeHosts = Math.max(0, metrics.activeHosts - 1);
-    if (host.socket.readyState === host.socket.OPEN) host.socket.close(code, reason);
-  };
-  const touchHost = (host) => {
-    if (host.idle) clearTimeout(host.idle);
-    host.idle = setTimeout(() => closeHost(host, 4408, "idle timeout"), idleTimeoutMs);
-    host.idle.unref?.();
-  };
-  if (accountStore) {
-    const accountEnvelope = (account) => ({
-      account,
-      usage: { routes: store.listRoutesByOwner(account.id, now()).length, maxRoutes: account.maxRoutes }
-    });
-    const closeAccountRoutes = (accountId, reason) => {
-      for (const host of [...hosts.values()]) if (host.ownerAccountId === accountId) closeHost(host, 4403, reason);
-    };
-    const purgeAccountRoutes = (accountId) => {
-      closeAccountRoutes(accountId, "account deleted");
-      for (const route of store.listRoutesByOwner(accountId, now())) {
-        store.deleteRoute(route.id);
-        clearRouteRates(route.id);
-      }
-    };
-    for (const listedRoute of store.listRoutes(now())) {
-      const route = store.getRoute(listedRoute.id);
-      if (!route?.ownerAccountId) continue;
-      const owner = accountStore.getAccount(route.ownerAccountId);
-      if (!owner || owner.status === "deleted") {
-        store.deleteRoute(route.id);
-        clearRouteRates(route.id);
-      }
-    }
-    const ownedRoute = (accountId, routeId) => {
-      const route = store.getRoute(routeId);
-      return route?.ownerAccountId === accountId ? route : void 0;
-    };
-    const internalRouteEnvelope = (accountId, routeId) => {
-      const route = ownedRoute(accountId, routeId);
-      if (!route) return;
-      return {
-        accountId,
-        route: publicRoute({ ...route, deviceCount: store.countDevices(route.id, now()) }),
-        status: {
-          hostOnline: hosts.has(route.id),
-          activeDevices: hosts.get(route.id)?.devices.size ?? 0
-        },
-        connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
-      };
-    };
-    const internalDeviceEnvelope = (accountId, device) => ({
-      accountId,
-      device: {
-        routeId: device.routeId,
-        deviceId: device.deviceId,
-        createdAt: device.createdAt,
-        updatedAt: device.updatedAt,
-        expiresAt: device.expiresAt ?? null
-      }
-    });
-    const closeAndDeleteRoute = (routeId, reason) => {
-      const route = store.getRoute(routeId);
-      if (!route) return false;
-      const host = hosts.get(routeId);
-      if (host) closeHost(host, 4403, reason);
-      const deleted = store.deleteRoute(routeId);
-      if (deleted) clearRouteRates(routeId);
-      return deleted;
-    };
-    const accountRevisionConflict = (reply, account) => reply.code(409).send({
-      code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-      error: "relay account revision conflict",
-      current: accountEnvelope(account)
-    });
-    app.put(
-      "/internal/v1/accounts/:accountId",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let accountId;
-        let input;
-        try {
-          const body = strictInternalBody(request.body, [
-            "label",
-            "plan",
-            "maxRoutes",
-            "maxDevicesPerRoute",
-            "credentialHash",
-            "credentialLookup"
-          ]);
-          accountId = safeAccountId(request.params.accountId);
-          input = {
-            id: accountId,
-            label: safeAccountLabel(body.label),
-            plan: safeAccountPlan(body.plan),
-            maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
-            maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5),
-            ...safeAccountCredentialMaterial(body)
-          };
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-          return;
-        }
-        const existing = accountStore.getAccount(accountId);
-        if (existing) {
-          const matches = existing.status !== "deleted" && existing.label === input.label && existing.plan === input.plan && existing.maxRoutes === input.maxRoutes && existing.maxDevicesPerRoute === input.maxDevicesPerRoute && accountStore.credentialMatches(accountId, input);
-          if (!matches) {
-            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
-            return;
-          }
-          reply.code(200).send(accountEnvelope(existing));
-          return;
-        }
-        try {
-          const account = accountStore.createAccount(input);
-          reply.code(201).send(accountEnvelope(account));
-        } catch (error) {
-          if (error.message === "relay account already exists" || error.message === "relay account credential already exists") {
-            reply.code(409).send({ code: "RELAY_ACCOUNT_EXISTS", error: "relay account already exists" });
-            return;
-          }
-          throw error;
-        }
-      }
-    );
-    app.get(
-      "/internal/v1/accounts/:accountId/status",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let account;
-        try {
-          account = accountStore.getAccount(safeAccountId(request.params.accountId));
-        } catch {
-        }
-        if (!account || account.status === "deleted") {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        reply.code(200).send(accountEnvelope(account));
-      }
-    );
-    app.put("/internal/v1/accounts/:accountId/metadata", { preHandler: requireRoot }, async (request, reply) => {
-      let accountId;
-      let expectedRevision;
-      let update;
-      try {
-        const body = strictInternalBody(request.body, [
-          "expectedRevision",
-          "label",
-          "plan",
-          "maxRoutes",
-          "maxDevicesPerRoute"
-        ]);
-        accountId = safeAccountId(request.params.accountId);
-        expectedRevision = safeRevision(body.expectedRevision);
-        update = {
-          label: safeAccountLabel(body.label),
-          plan: safeAccountPlan(body.plan),
-          maxRoutes: safeAccountLimit(body.maxRoutes, 1e4),
-          maxDevicesPerRoute: safeAccountLimit(body.maxDevicesPerRoute, 1e5)
-        };
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        return;
-      }
-      const current = accountStore.getAccount(accountId);
-      if (!current || current.status === "deleted") {
-        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-        return;
-      }
-      const matches = current.label === update.label && current.plan === update.plan && current.maxRoutes === update.maxRoutes && current.maxDevicesPerRoute === update.maxDevicesPerRoute;
-      if (matches && (current.revision === expectedRevision || current.revision === expectedRevision + 1)) {
-        reply.code(200).send(accountEnvelope(current));
-        return;
-      }
-      if (current.revision !== expectedRevision) {
-        accountRevisionConflict(reply, current);
-        return;
-      }
-      try {
-        const account = accountStore.updateAccount(accountId, update, expectedRevision);
-        if (!account) {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        reply.code(200).send(accountEnvelope(account));
-      } catch (error) {
-        if (error instanceof RelayAccountRevisionConflictError) {
-          accountRevisionConflict(reply, error.current);
-          return;
-        }
-        throw error;
-      }
-    });
-    app.put("/internal/v1/accounts/:accountId/credential", { preHandler: requireRoot }, async (request, reply) => {
-      let accountId;
-      let expectedRevision;
-      let credential;
-      try {
-        const body = strictInternalBody(request.body, ["expectedRevision", "credentialHash", "credentialLookup"]);
-        accountId = safeAccountId(request.params.accountId);
-        expectedRevision = safeRevision(body.expectedRevision);
-        credential = safeAccountCredentialMaterial(body);
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        return;
-      }
-      const current = accountStore.getAccount(accountId);
-      if (!current || current.status === "deleted") {
-        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-        return;
-      }
-      if (accountStore.credentialMatches(accountId, credential)) {
-        if (current.revision === expectedRevision || current.revision === expectedRevision + 1) {
-          reply.code(200).send(accountEnvelope(current));
-          return;
-        }
-        accountRevisionConflict(reply, current);
-        return;
-      }
-      if (current.revision !== expectedRevision) {
-        accountRevisionConflict(reply, current);
-        return;
-      }
-      try {
-        const account = accountStore.rotateCredential(accountId, credential, expectedRevision);
-        if (!account) {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        reply.code(200).send(accountEnvelope(account));
-      } catch (error) {
-        if (error instanceof RelayAccountRevisionConflictError) {
-          accountRevisionConflict(reply, error.current);
-          return;
-        }
-        if (error.message === "relay account credential already exists") {
-          reply.code(409).send({ code: "RELAY_ACCOUNT_CREDENTIAL_CONFLICT", error: "relay credential conflict" });
-          return;
-        }
-        throw error;
-      }
-    });
-    app.delete("/internal/v1/accounts/:accountId", { preHandler: requireRoot }, async (request, reply) => {
-      let accountId;
-      let expectedRevision;
-      try {
-        const body = strictInternalBody(request.body, ["expectedRevision"]);
-        accountId = safeAccountId(request.params.accountId);
-        expectedRevision = safeRevision(body.expectedRevision);
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        return;
-      }
-      const current = accountStore.getAccount(accountId);
-      if (!current || current.status === "deleted") {
-        reply.code(204).send();
-        return;
-      }
-      if (current.revision !== expectedRevision) {
-        accountRevisionConflict(reply, current);
-        return;
-      }
-      try {
-        const account = accountStore.updateAccount(accountId, { status: "deleted" }, expectedRevision);
-        if (account) purgeAccountRoutes(account.id);
-        reply.code(204).send();
-      } catch (error) {
-        if (error instanceof RelayAccountRevisionConflictError) {
-          accountRevisionConflict(reply, error.current);
-          return;
-        }
-        throw error;
-      }
-    });
-    app.put("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
-      let accountId;
-      let routeId;
-      let label;
-      let credentialHash;
-      try {
-        const body = strictInternalBody(request.body, ["label", "credentialHash"]);
-        accountId = safeAccountId(request.params.accountId);
-        routeId = safeId3(request.params.routeId, "route id");
-        label = safeLabel3(body.label);
-        credentialHash = safeRouteCredentialHash(body);
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
-        return;
-      }
-      const account = accountStore.getAccount(accountId);
-      if (!account || account.status === "deleted") {
-        reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-        return;
-      }
-      if (account.status !== "active") {
-        reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
-        return;
-      }
-      const existing = store.getRoute(routeId);
-      if (existing) {
-        if (existing.ownerAccountId !== accountId || existing.label !== label || !tokenMatches(existing.hostCredentialHash, credentialHash)) {
-          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
-          return;
-        }
-        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
-        return;
-      }
-      if (store.listRoutesByOwner(accountId, now()).length >= account.maxRoutes) {
-        reply.code(429).send({ code: "RELAY_ROUTE_LIMIT", error: "relay route limit reached" });
-        return;
-      }
-      try {
-        store.createRoute({ id: routeId, label, hostCredentialHash: credentialHash, ownerAccountId: accountId });
-        reply.code(201).send(internalRouteEnvelope(accountId, routeId));
-      } catch (error) {
-        if (error.message === "relay route already exists") {
-          reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
-          return;
-        }
-        throw error;
-      }
-    });
-    app.get(
-      "/internal/v1/accounts/:accountId/routes/:routeId/status",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let route;
-        try {
-          route = internalRouteEnvelope(
-            safeAccountId(request.params.accountId),
-            safeId3(request.params.routeId, "route id")
-          );
-        } catch {
-        }
-        if (!route) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        reply.code(200).send(route);
-      }
-    );
-    app.put(
-      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let accountId;
-        let routeId;
-        let deviceId;
-        let credentialHash;
-        let expiresAt;
-        try {
-          const body = strictInternalBody(request.body, ["credentialHash", "expiresAt"]);
-          accountId = safeAccountId(request.params.accountId);
-          routeId = safeId3(request.params.routeId, "route id");
-          deviceId = safeId3(request.params.deviceId, "device id");
-          credentialHash = safeCredentialHash2(body.credentialHash);
-          const parsedExpiry = safeExpiry2(body.expiresAt, now());
-          if (parsedExpiry === void 0) throw new Error("temporary relay device expiry is required");
-          expiresAt = parsedExpiry;
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
-          return;
-        }
-        const account = accountStore.getAccount(accountId);
-        if (!account || account.status === "deleted") {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        if (account.status !== "active") {
-          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
-          return;
-        }
-        if (!ownedRoute(accountId, routeId)) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        const current = store.getDevice(routeId, deviceId, now());
-        if (current) {
-          if (tokenMatches(current.credentialHash, credentialHash) && current.expiresAt === expiresAt) {
-            reply.code(200).send(internalDeviceEnvelope(accountId, current));
-            return;
-          }
-          reply.code(409).send({
-            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
-            error: "relay device credential conflict",
-            current: internalDeviceEnvelope(accountId, current)
-          });
-          return;
-        }
-        if (store.countDevices(routeId, now()) >= account.maxDevicesPerRoute) {
-          reply.code(429).send({ code: "RELAY_DEVICE_LIMIT", error: "relay device limit reached" });
-          return;
-        }
-        const device = store.putDevice({ routeId, deviceId, credentialHash, expiresAt }, now());
-        reply.code(201).send(internalDeviceEnvelope(accountId, device));
-      }
-    );
-    app.post(
-      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId/promote",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let accountId;
-        let routeId;
-        let deviceId;
-        let expectedCredentialHash;
-        let credentialHash;
-        try {
-          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
-          accountId = safeAccountId(request.params.accountId);
-          routeId = safeId3(request.params.routeId, "route id");
-          deviceId = safeId3(request.params.deviceId, "device id");
-          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
-          credentialHash = safeCredentialHash2(body.credentialHash);
-          if (tokenMatches(expectedCredentialHash, credentialHash)) throw new Error("relay credentials must differ");
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device promotion" });
-          return;
-        }
-        const account = accountStore.getAccount(accountId);
-        if (!account || account.status === "deleted") {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        if (account.status !== "active") {
-          reply.code(409).send({ code: "RELAY_ACCOUNT_UNAVAILABLE", error: "relay account unavailable" });
-          return;
-        }
-        if (!ownedRoute(accountId, routeId)) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        const current = store.getDevice(routeId, deviceId, now());
-        if (!current) {
-          reply.code(404).send({ code: "RELAY_DEVICE_NOT_FOUND", error: "relay device not found" });
-          return;
-        }
-        if (current.expiresAt === void 0 && tokenMatches(current.credentialHash, credentialHash)) {
-          reply.code(200).send(internalDeviceEnvelope(accountId, current));
-          return;
-        }
-        if (current.expiresAt === void 0 || !tokenMatches(current.credentialHash, expectedCredentialHash)) {
-          reply.code(409).send({
-            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
-            error: "relay device credential conflict",
-            current: internalDeviceEnvelope(accountId, current)
-          });
-          return;
-        }
-        const device = store.putDevice({ routeId, deviceId, credentialHash }, now());
-        reply.code(200).send(internalDeviceEnvelope(accountId, device));
-      }
-    );
-    app.delete(
-      "/internal/v1/accounts/:accountId/routes/:routeId/devices/:deviceId",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let accountId;
-        let routeId;
-        let deviceId;
-        let expectedCredentialHash;
-        try {
-          const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
-          accountId = safeAccountId(request.params.accountId);
-          routeId = safeId3(request.params.routeId, "route id");
-          deviceId = safeId3(request.params.deviceId, "device id");
-          expectedCredentialHash = safeCredentialHash2(body.expectedCredentialHash);
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_DEVICE", error: "invalid relay device" });
-          return;
-        }
-        const account = accountStore.getAccount(accountId);
-        if (!account || account.status === "deleted") {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        if (!ownedRoute(accountId, routeId)) {
-          reply.code(204).send();
-          return;
-        }
-        const current = store.getDevice(routeId, deviceId, now());
-        if (!current) {
-          reply.code(204).send();
-          return;
-        }
-        if (!tokenMatches(current.credentialHash, expectedCredentialHash)) {
-          reply.code(409).send({
-            code: "RELAY_DEVICE_CREDENTIAL_CONFLICT",
-            error: "relay device credential conflict",
-            current: internalDeviceEnvelope(accountId, current)
-          });
-          return;
-        }
-        store.revokeDevice(routeId, deviceId);
-        deviceRates.delete(deviceRateKey(routeId, deviceId));
-        const live = hosts.get(routeId)?.devices.get(deviceId);
-        live?.socket.close(4403, "device revoked");
-        reply.code(204).send();
-      }
-    );
-    app.put(
-      "/internal/v1/accounts/:accountId/routes/:routeId/credential",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        let accountId;
-        let routeId;
-        let expectedCredentialHash;
-        let credentialHash;
-        try {
-          const body = strictInternalBody(request.body, ["expectedCredentialHash", "credentialHash"]);
-          accountId = safeAccountId(request.params.accountId);
-          routeId = safeId3(request.params.routeId, "route id");
-          expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
-          credentialHash = safeRouteCredentialHash(body);
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_CREDENTIAL", error: "invalid relay credential hash" });
-          return;
-        }
-        const route = ownedRoute(accountId, routeId);
-        if (!route) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        if (tokenMatches(route.hostCredentialHash, credentialHash)) {
-          reply.code(200).send(internalRouteEnvelope(accountId, routeId));
-          return;
-        }
-        if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
-          reply.code(409).send({
-            code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
-            error: "relay route credential conflict",
-            current: internalRouteEnvelope(accountId, routeId)
-          });
-          return;
-        }
-        if (!store.rotateHostCredential(routeId, credentialHash, now())) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        const host = hosts.get(routeId);
-        if (host) closeHost(host, 4409, "host credential rotated");
-        reply.code(200).send(internalRouteEnvelope(accountId, routeId));
-      }
-    );
-    app.delete("/internal/v1/accounts/:accountId/routes/:routeId", { preHandler: requireRoot }, async (request, reply) => {
-      let accountId;
-      let routeId;
-      let expectedCredentialHash;
-      try {
-        const body = strictInternalBody(request.body, ["expectedCredentialHash"]);
-        accountId = safeAccountId(request.params.accountId);
-        routeId = safeId3(request.params.routeId, "route id");
-        expectedCredentialHash = safeRouteCredentialHash(body, "expectedCredentialHash");
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
-        return;
-      }
-      const route = ownedRoute(accountId, routeId);
-      if (!route) {
-        reply.code(204).send();
-        return;
-      }
-      if (!tokenMatches(route.hostCredentialHash, expectedCredentialHash)) {
-        reply.code(409).send({
-          code: "RELAY_ROUTE_CREDENTIAL_CONFLICT",
-          error: "relay route credential conflict",
-          current: internalRouteEnvelope(accountId, routeId)
-        });
-        return;
-      }
-      closeAndDeleteRoute(routeId, "route deleted");
-      reply.code(204).send();
-    });
-    app.get("/v1/accounts", { preHandler: requireRoot }, async () => ({
-      accounts: accountStore.listAccounts().map((account) => accountEnvelope(account))
-    }));
-    const createAccountHandler = (clientHashedOnly) => async (request, reply) => {
-      try {
-        const hasCredentialHash = request.body?.credentialHash !== void 0;
-        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
-        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
-          throw new Error("client-hashed account credential material is required");
-        }
-        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
-        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
-        const credential = suppliedCredentialMaterial ? {
-          credentialHash: request.body?.credentialHash,
-          credentialLookup: request.body?.credentialLookup
-        } : accountCredential;
-        const account = accountStore.createAccount({
-          label: request.body?.label,
-          ...request.body?.plan === void 0 ? {} : { plan: request.body.plan },
-          ...request.body?.maxRoutes === void 0 ? {} : { maxRoutes: request.body.maxRoutes },
-          ...request.body?.maxDevicesPerRoute === void 0 ? {} : { maxDevicesPerRoute: request.body.maxDevicesPerRoute },
-          ...typeof credential === "string" ? { credential } : {
-            credentialHash: credential.credentialHash,
-            credentialLookup: credential.credentialLookup
-          }
-        });
-        reply.code(201).send({
-          ...accountEnvelope(account),
-          ...accountCredential === void 0 ? {} : { accountCredential }
-        });
-      } catch {
-        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-      }
-    };
-    app.post(
-      "/v1/accounts",
-      { preHandler: requireRoot },
-      createAccountHandler(false)
-    );
-    app.post(
-      "/v1/accounts/client-hashed",
-      { preHandler: requireRoot },
-      createAccountHandler(true)
-    );
-    app.patch(
-      "/v1/accounts/:accountId",
-      { preHandler: requireRoot },
-      async (request, reply) => {
-        try {
-          const account = accountStore.updateAccount(
-            request.params.accountId,
-            request.body,
-            safeRevision(request.body?.expectedRevision)
-          );
-          if (!account) {
-            reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-            return;
-          }
-          if (account.status === "deleted") purgeAccountRoutes(account.id);
-          else if (account.status !== "active") closeAccountRoutes(account.id, "account unavailable");
-          reply.code(200).send(accountEnvelope(account));
-        } catch (error) {
-          if (error instanceof RelayAccountRevisionConflictError) {
-            reply.code(409).send({
-              code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-              error: "relay account revision conflict",
-              current: accountEnvelope(error.current)
-            });
-            return;
-          }
-          reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-        }
-      }
-    );
-    const rotateAccountHandler = (clientHashedOnly) => async (request, reply) => {
-      try {
-        const hasCredentialHash = request.body?.credentialHash !== void 0;
-        const hasCredentialLookup = request.body?.credentialLookup !== void 0;
-        if (clientHashedOnly && (!hasCredentialHash || !hasCredentialLookup)) {
-          throw new Error("client-hashed account credential material is required");
-        }
-        const suppliedCredentialMaterial = hasCredentialHash || hasCredentialLookup;
-        const accountCredential = suppliedCredentialMaterial ? void 0 : generateRelayAccountCredential();
-        const credential = suppliedCredentialMaterial ? {
-          credentialHash: request.body?.credentialHash,
-          credentialLookup: request.body?.credentialLookup
-        } : accountCredential;
-        const account = accountStore.rotateCredential(
-          request.params.accountId,
-          credential,
-          safeRevision(request.body?.expectedRevision)
-        );
-        if (!account) {
-          reply.code(404).send({ code: "RELAY_ACCOUNT_NOT_FOUND", error: "relay account not found" });
-          return;
-        }
-        reply.code(200).send({
-          ...accountEnvelope(account),
-          ...accountCredential === void 0 ? {} : { accountCredential }
-        });
-      } catch (error) {
-        if (error instanceof RelayAccountRevisionConflictError) {
-          reply.code(409).send({
-            code: "RELAY_ACCOUNT_REVISION_CONFLICT",
-            error: "relay account revision conflict",
-            current: accountEnvelope(error.current)
-          });
-          return;
-        }
-        reply.code(400).send({ code: "INVALID_RELAY_ACCOUNT", error: "invalid relay account" });
-      }
-    };
-    app.post(
-      "/v1/accounts/:accountId/credential",
-      { preHandler: requireRoot },
-      rotateAccountHandler(false)
-    );
-    app.post(
-      "/v1/accounts/:accountId/credential/client-hashed",
-      { preHandler: requireRoot },
-      rotateAccountHandler(true)
-    );
-    app.get(
-      "/v1/account/recovery",
-      { preHandler: requireRecoverableAccount },
-      async (request) => accountEnvelope(authenticatedAccounts.get(request))
-    );
-    app.get(
-      "/v1/account",
-      { preHandler: requireAccount },
-      async (request) => accountEnvelope(authenticatedAccounts.get(request))
-    );
-    app.get("/v1/account/routes", { preHandler: requireAccount }, async (request) => ({
-      routes: store.listRoutesByOwner(authenticatedAccounts.get(request).id, now()).map((route) => ({
-        ...publicRoute(route),
-        hostOnline: hosts.has(route.id)
-      }))
-    }));
-    app.post(
-      "/v1/account/routes",
-      { preHandler: requireAccount },
-      async (request, reply) => {
-        const account = authenticatedAccounts.get(request);
-        let id;
-        let label;
-        let credentialHash;
-        try {
-          id = safeId3(request.body?.id, "route id");
-          label = safeLabel3(request.body?.label);
-          credentialHash = safeCredentialHash2(request.body?.credentialHash);
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
-          return;
-        }
-        const existing = store.getRoute(id);
-        if (existing) {
-          if (existing.ownerAccountId !== account.id || existing.label !== label || !tokenMatches(existing.hostCredentialHash, credentialHash)) {
-            reply.code(409).send({ code: "RELAY_ROUTE_EXISTS", error: "relay route already exists" });
-            return;
-          }
-          reply.code(200).send({
-            route: {
-              ...publicRoute({ ...existing, deviceCount: store.countDevices(existing.id, now()) }),
-              hostOnline: hosts.has(id)
-            },
-            connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
-          });
-          return;
-        }
-        if (store.listRoutesByOwner(account.id, now()).length >= account.maxRoutes) {
-          reply.code(429).send({ code: "RELAY_ROUTE_LIMIT", error: "relay route limit reached" });
-          return;
-        }
-        try {
-          const route = store.createRoute({
-            id,
-            label,
-            hostCredentialHash: credentialHash,
-            ownerAccountId: account.id
-          });
-          reply.code(201).send({
-            route: { ...publicRoute({ ...route, deviceCount: 0 }), hostOnline: false },
-            connection: { path: "/v1/connect", protocolVersion: BLIND_RELAY_PROTOCOL_VERSION }
-          });
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_ROUTE", error: "invalid relay route" });
-        }
-      }
-    );
-    app.delete(
-      "/v1/account/routes/:routeId",
-      { preHandler: requireAccount },
-      async (request, reply) => {
-        const account = authenticatedAccounts.get(request);
-        let removed = false;
-        try {
-          removed = !!ownedRoute(account.id, request.params.routeId) && store.deleteRoute(request.params.routeId);
-        } catch {
-        }
-        if (!removed) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        clearRouteRates(request.params.routeId);
-        const host = hosts.get(request.params.routeId);
-        if (host) closeHost(host, 4403, "route deleted");
-        reply.code(204).send();
-      }
-    );
-    app.post(
-      "/v1/account/routes/:routeId/credential",
-      { preHandler: requireAccount },
-      async (request, reply) => {
-        const account = authenticatedAccounts.get(request);
-        try {
-          if (!ownedRoute(account.id, request.params.routeId)) {
-            reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-            return;
-          }
-        } catch {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        let credentialHash;
-        try {
-          credentialHash = safeCredentialHash2(request.body?.credentialHash);
-        } catch {
-          reply.code(400).send({ code: "INVALID_RELAY_CREDENTIAL", error: "invalid relay credential hash" });
-          return;
-        }
-        if (!store.rotateHostCredential(request.params.routeId, credentialHash, now())) {
-          reply.code(404).send({ code: "RELAY_ROUTE_NOT_FOUND", error: "relay route not found" });
-          return;
-        }
-        const host = hosts.get(request.params.routeId);
-        if (host) closeHost(host, 4409, "host credential rotated");
-        reply.code(204).send();
-      }
-    );
-  }
-  app.register(websocket, { options: { maxPayload: maxEnvelopeBytes, perMessageDeflate: false } });
-  app.register(async (scope) => {
-    scope.get("/v1/connect", { websocket: true }, (socket, request) => {
-      if (sockets.size >= maxTotalConnections) {
-        metrics.rejectedConnections += 1;
-        socket.close(4429, "relay connection limit");
-        return;
-      }
-      sockets.add(socket);
-      let authenticated = false;
-      let liveHost;
-      let liveDevice;
-      const handshakeTimer = setTimeout(() => socket.close(4401, "authentication timeout"), handshakeTimeoutMs);
-      handshakeTimer.unref?.();
-      const reject = (code, reason) => {
-        metrics.rejectedConnections += 1;
-        socket.close(code, reason);
-      };
-      socket.on("message", (raw, isBinary) => {
-        if (isBinary) {
-          metrics.droppedFrames += 1;
-          reject(4400, "text envelope required");
-          return;
-        }
-        if (!authenticated) {
-          try {
-            const hello = parseAuthHello(parseJson(raw, 8 * 1024));
-            const presentedOrigin = request.headers.origin;
-            const origin = typeof presentedOrigin === "string" ? normalizeOrigin(presentedOrigin) : void 0;
-            if (hello.role === "device" && allowedOrigins.size > 0 && presentedOrigin !== void 0 && (!origin || !allowedOrigins.has(origin))) {
-              reject(4403, "origin denied");
-              return;
-            }
-            if (hello.role === "host") {
-              const route = store.getRoute(hello.routeId);
-              if (!route || route.ownerAccountId !== void 0 && accountStore?.getAccount(route.ownerAccountId)?.status !== "active" || !store.authenticateHost(hello.routeId, hello.credential)) {
-                reject(4401, "authentication failed");
-                return;
-              }
-              const rate = rateWindowFor(hostRates, hello.routeId);
-              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
-                reject(4429, "relay identity rate limit");
-                return;
-              }
-              const previous = hosts.get(hello.routeId);
-              if (previous) closeHost(previous, 4409, "superseded host");
-              liveHost = {
-                socket,
-                routeId: hello.routeId,
-                ...route.ownerAccountId === void 0 ? {} : { ownerAccountId: route.ownerAccountId },
-                devices: /* @__PURE__ */ new Map(),
-                rate,
-                closed: false
-              };
-              hosts.set(hello.routeId, liveHost);
-              metrics.activeHosts += 1;
-              touchHost(liveHost);
-              if (!safeSend(socket, { t: "ready", role: "host", protocolVersion: 1 }, maxQueueBytes)) {
-                metrics.rejectedConnections += 1;
-                closeHost(liveHost, 4408, "relay backpressure");
-                return;
-              }
-            } else {
-              if (!routeAccountIsActive(hello.routeId) || !store.authenticateDevice(hello.routeId, hello.deviceId, hello.credential, now())) {
-                reject(4401, "authentication failed");
-                return;
-              }
-              const host = hosts.get(hello.routeId);
-              if (!host || host.socket.readyState !== host.socket.OPEN) {
-                reject(4412, "host unavailable");
-                return;
-              }
-              if (host.devices.size >= maxConnectionsPerRoute && !host.devices.has(hello.deviceId)) {
-                reject(4429, "route connection limit");
-                return;
-              }
-              const rate = rateWindowFor(deviceRates, deviceRateKey(hello.routeId, hello.deviceId));
-              if (!rate || !consumeRate(rate, Buffer.byteLength(raw.toString()))) {
-                reject(4429, "relay identity rate limit");
-                return;
-              }
-              const previous = host.devices.get(hello.deviceId);
-              if (previous) closeDevice(previous, 4409, "superseded device");
-              const channelId = safeId3(generateChannelId(), "channel id");
-              liveDevice = {
-                socket,
-                routeId: hello.routeId,
-                deviceId: hello.deviceId,
-                channelId,
-                rate,
-                closed: false
-              };
-              host.devices.set(hello.deviceId, liveDevice);
-              devicesByChannel.set(channelId, liveDevice);
-              metrics.activeDevices += 1;
-              touchDevice(liveDevice);
-              if (!safeSend(socket, { t: "ready", role: "device", protocolVersion: 1, channelId }, maxQueueBytes)) {
-                metrics.rejectedConnections += 1;
-                closeDevice(liveDevice, 4408, "relay backpressure");
-                return;
-              }
-              if (!safeSend(host.socket, { t: "peer-open", channelId, deviceId: hello.deviceId }, maxQueueBytes)) {
-                metrics.rejectedConnections += 1;
-                closeDevice(liveDevice, 4408, "host backpressure");
-                return;
-              }
-            }
-            authenticated = true;
-            metrics.acceptedConnections += 1;
-            clearTimeout(handshakeTimer);
-          } catch {
-            reject(4400, "invalid authentication frame");
-          }
-          return;
-        }
-        try {
-          const value = parseJson(raw, maxEnvelopeBytes);
-          if (liveDevice) {
-            touchDevice(liveDevice);
-            if (value?.t === "ping") {
-              if (!consumeRate(liveDevice.rate, 1)) {
-                closeDevice(liveDevice, 4429, "rate limit");
-                return;
-              }
-              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
-                metrics.droppedFrames += 1;
-                closeDevice(liveDevice, 4408, "relay backpressure");
-              }
-              return;
-            }
-            const frame = parsePayload(value, false, maxFrameBytes);
-            if (!consumeRate(liveDevice.rate, frame.bytes)) {
-              closeDevice(liveDevice, 4429, "rate limit");
-              return;
-            }
-            const host = hosts.get(liveDevice.routeId);
-            if (!host || !safeSend(
-              host.socket,
-              { t: "frame", channelId: liveDevice.channelId, payload: frame.payload },
-              maxQueueBytes
-            )) {
-              metrics.droppedFrames += 1;
-              closeDevice(liveDevice, 4408, "host unavailable or slow");
-              return;
-            }
-            metrics.forwardedFrames += 1;
-            metrics.forwardedBytes += frame.bytes;
-            return;
-          }
-          if (liveHost) {
-            touchHost(liveHost);
-            if (value?.t === "ping") {
-              if (!consumeRate(liveHost.rate, 1)) {
-                closeHost(liveHost, 4429, "rate limit");
-                return;
-              }
-              if (!safeSend(socket, { t: "pong", at: now() }, maxQueueBytes)) {
-                metrics.droppedFrames += 1;
-                closeHost(liveHost, 4408, "relay backpressure");
-              }
-              return;
-            }
-            if (value?.t === "close-peer") {
-              const channelId = safeId3(value.channelId, "channel id");
-              if (!consumeRate(liveHost.rate, 1)) {
-                closeHost(liveHost, 4429, "rate limit");
-                return;
-              }
-              const device2 = devicesByChannel.get(channelId);
-              if (device2?.routeId === liveHost.routeId) closeDevice(device2, 4400, "host closed channel");
-              return;
-            }
-            const frame = parsePayload(value, true, maxFrameBytes);
-            if (!consumeRate(liveHost.rate, frame.bytes)) {
-              closeHost(liveHost, 4429, "rate limit");
-              return;
-            }
-            const device = devicesByChannel.get(frame.channelId);
-            if (!device || device.routeId !== liveHost.routeId) {
-              metrics.droppedFrames += 1;
-              return;
-            }
-            if (!safeSend(device.socket, { t: "frame", payload: frame.payload }, maxQueueBytes)) {
-              metrics.droppedFrames += 1;
-              closeDevice(device, 4408, "device backpressure");
-              return;
-            }
-            metrics.forwardedFrames += 1;
-            metrics.forwardedBytes += frame.bytes;
-          }
-        } catch {
-          metrics.droppedFrames += 1;
-          if (liveDevice) closeDevice(liveDevice, 4400, "invalid relay frame");
-          else if (liveHost) closeHost(liveHost, 4400, "invalid relay frame");
-        }
-      });
-      socket.once("close", () => {
-        sockets.delete(socket);
-        clearTimeout(handshakeTimer);
-        if (liveDevice) closeDevice(liveDevice);
-        if (liveHost) closeHost(liveHost);
-      });
-      socket.once("error", () => {
-      });
-    });
-  });
-  app.addHook("onClose", async () => {
-    for (const host of [...hosts.values()]) closeHost(host, 1001, "relay shutting down");
-    for (const socket of [...sockets]) socket.close(1001, "relay shutting down");
-    hostRates.clear();
-    deviceRates.clear();
-    if (ownsStore) store.close();
-  });
-  return {
-    app,
-    store,
-    ...accountStore ? { accountStore } : {},
-    metrics: () => ({
-      ...metrics,
-      activeConnections: sockets.size,
-      activeHosts: hosts.size,
-      activeDevices: devicesByChannel.size
-    })
-  };
-}
-
-// src/data-dir.ts
-import {
-  closeSync,
-  constants,
-  existsSync,
-  fchmodSync,
-  fstatSync,
-  fsyncSync,
-  linkSync,
-  lstatSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { randomBytes as randomBytes4 } from "crypto";
-import { dirname, join } from "path";
-var MAX_ACCESS_TOKEN_BYTES = 4 * 1024;
-var MAX_ACCESS_TOKEN_FILE_BYTES = MAX_ACCESS_TOKEN_BYTES + 2;
-function resolveDataDir(env, exists = existsSync) {
-  if (env.ROAMCODE_DATA_DIR) return env.ROAMCODE_DATA_DIR;
-  if (env.REMOTE_CODER_DATA_DIR) return env.REMOTE_CODER_DATA_DIR;
-  const pick = (next, legacy) => !exists(next) && exists(legacy) ? legacy : next;
-  if (env.XDG_CONFIG_HOME)
-    return pick(join(env.XDG_CONFIG_HOME, "roamcode"), join(env.XDG_CONFIG_HOME, "remote-coder"));
-  if (env.HOME) return pick(join(env.HOME, ".config", "roamcode"), join(env.HOME, ".config", "remote-coder"));
-  return pick(join(process.cwd(), ".roamcode"), join(process.cwd(), ".remote-coder"));
-}
-function ensureDataDir(dir) {
-  mkdirSync(dir, { recursive: true, mode: 448 });
-}
-
-// src/relay-start.ts
-function boundedInteger(value, fallback, minimum, maximum, field) {
-  const parsed = value === void 0 ? fallback : Number(value);
-  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) throw new Error(`invalid ${field}`);
-  return parsed;
-}
-function relayDataDir(env) {
-  const configured = env.ROAMCODE_RELAY_DATA_DIR?.trim();
-  return configured ? resolve(configured) : join2(resolveDataDir(env), "relay");
-}
-function relayOrigins(env) {
-  return (env.ROAMCODE_RELAY_ALLOWED_ORIGINS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
-}
-function privateSecretFile(path, field) {
-  let descriptor;
-  try {
-    const before = lstatSync2(path);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > 4096 || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
-      throw new Error("unsafe secret file");
-    }
-    descriptor = openSync2(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
-    const opened = fstatSync2(descriptor);
-    if (!opened.isFile() || opened.size > 4096 || (opened.mode & 63) !== 0 || typeof process.getuid === "function" && opened.uid !== process.getuid() || opened.dev !== before.dev || opened.ino !== before.ino) {
-      throw new Error("unsafe secret file");
-    }
-    return readFileSync2(descriptor, "utf8").trim();
-  } catch {
-    throw new Error(`${field} could not be read securely`);
-  } finally {
-    if (descriptor !== void 0) closeSync2(descriptor);
-  }
-}
-function previousRootTokens(env) {
-  const inline = (env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS ?? "").split(",").map((value) => value.trim()).filter(Boolean);
-  const directory = env.ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR?.trim();
-  if (inline.length > 0 && directory) {
-    throw new Error(
-      "ROAMCODE_RELAY_PREVIOUS_ROOT_TOKENS and ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR are mutually exclusive"
-    );
-  }
-  if (!directory) return inline;
-  let before;
-  let entries;
-  try {
-    before = lstatSync2(directory);
-    if (!before.isDirectory() || before.isSymbolicLink() || (before.mode & 63) !== 0 || typeof process.getuid === "function" && before.uid !== process.getuid()) {
-      throw new Error("unsafe secret directory");
-    }
-    entries = readdirSync(directory, { withFileTypes: true });
-    const after = lstatSync2(directory);
-    if (after.dev !== before.dev || after.ino !== before.ino || (after.mode & 63) !== 0 || typeof process.getuid === "function" && after.uid !== process.getuid() || entries.some((entry) => !entry.isFile())) {
-      throw new Error("unsafe secret directory");
-    }
-  } catch {
-    throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR could not be read securely");
-  }
-  if (entries.length > 3) throw new Error("ROAMCODE_RELAY_PREVIOUS_ROOT_TOKEN_DIR may contain at most three files");
-  return entries.map((entry) => entry.name).sort().map((name) => privateSecretFile(join2(directory, name), "previous relay root capability"));
-}
-function explicitBoolean(value, field) {
-  if (value === void 0 || value === "" || value === "0" || value === "false") return false;
-  if (value === "1" || value === "true") return true;
-  throw new Error(`invalid ${field}`);
-}
-function secretValue(env, directKey, fileKey) {
-  const direct = env[directKey]?.trim();
-  const file = env[fileKey]?.trim();
-  if (direct && file) throw new Error(`${directKey} and ${fileKey} are mutually exclusive`);
-  if (direct) return direct;
-  if (!file) return void 0;
-  return privateSecretFile(file, fileKey);
-}
-async function startBlindRelay(env = process.env) {
-  const rootToken = secretValue(env, "ROAMCODE_RELAY_ROOT_TOKEN", "ROAMCODE_RELAY_ROOT_TOKEN_FILE");
-  if (!rootToken) throw new Error("ROAMCODE_RELAY_ROOT_TOKEN or ROAMCODE_RELAY_ROOT_TOKEN_FILE is required");
-  const previousRoots = previousRootTokens(env);
-  const allowedOrigins = relayOrigins(env);
-  const allowAnyOrigin = explicitBoolean(env.ROAMCODE_RELAY_ALLOW_ANY_ORIGIN, "relay allow-any-origin flag");
-  if (env.NODE_ENV === "production" && allowedOrigins.length === 0 && !allowAnyOrigin) {
-    throw new Error(
-      "ROAMCODE_RELAY_ALLOWED_ORIGINS is required in production; explicitly set ROAMCODE_RELAY_ALLOW_ANY_ORIGIN=1 only for a reviewed deployment"
-    );
-  }
-  const dataDir = relayDataDir(env);
-  ensureDataDir(dataDir);
-  const store = openRelayRouteStore({ dbPath: join2(dataDir, "routes.db") });
-  if (store.mode !== "sqlite") {
-    store.close();
-    throw new Error("relay requires durable SQLite; rebuild better-sqlite3 before starting");
-  }
-  const accountsEnabled = explicitBoolean(env.ROAMCODE_RELAY_ACCOUNTS_ENABLED, "relay accounts-enabled flag");
-  let accountStore;
-  if (accountsEnabled) {
-    accountStore = openRelayAccountStore({ dbPath: join2(dataDir, "accounts.db") });
-    if (accountStore.mode !== "sqlite") {
-      accountStore.close();
-      store.close();
-      throw new Error("relay accounts require durable SQLite; rebuild better-sqlite3 before starting");
-    }
-  }
-  let relay;
-  try {
-    relay = createBlindRelayServer({
-      rootToken,
-      previousRootTokens: previousRoots,
-      store,
-      ...accountStore ? { accountStore } : {},
-      allowedOrigins,
-      handshakeTimeoutMs: boundedInteger(
-        env.ROAMCODE_RELAY_HANDSHAKE_TIMEOUT_MS,
-        5e3,
-        1e3,
-        3e4,
-        "relay handshake timeout"
-      ),
-      idleTimeoutMs: boundedInteger(
-        env.ROAMCODE_RELAY_IDLE_TIMEOUT_MS,
-        12e4,
-        1e4,
-        36e5,
-        "relay idle timeout"
-      ),
-      maxFrameBytes: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_FRAME_BYTES,
-        15e5,
-        1024,
-        16 * 1024 * 1024,
-        "relay frame limit"
-      ),
-      maxQueueBytes: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_QUEUE_BYTES,
-        4e6,
-        1024,
-        64 * 1024 * 1024,
-        "relay queue limit"
-      ),
-      maxTotalConnections: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_TOTAL_CONNECTIONS,
-        1024,
-        1,
-        1e5,
-        "relay total connection limit"
-      ),
-      maxConnectionsPerRoute: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_CONNECTIONS_PER_ROUTE,
-        64,
-        1,
-        1e4,
-        "relay route connection limit"
-      ),
-      maxBytesPerMinute: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_BYTES_PER_MINUTE,
-        64 * 1024 * 1024,
-        1024,
-        1024 * 1024 * 1024,
-        "relay byte rate"
-      ),
-      maxMessagesPerMinute: boundedInteger(
-        env.ROAMCODE_RELAY_MAX_MESSAGES_PER_MINUTE,
-        12e3,
-        10,
-        1e6,
-        "relay message rate"
-      )
-    });
-  } catch (error) {
-    accountStore?.close();
-    store.close();
-    throw error;
-  }
-  relay.app.addHook("onClose", async () => {
-    accountStore?.close();
-    store.close();
-  });
-  const host = env.ROAMCODE_RELAY_BIND?.trim() || "127.0.0.1";
-  const port = boundedInteger(env.ROAMCODE_RELAY_PORT, 4281, 0, 65535, "relay port");
-  try {
-    const url = await relay.app.listen({ host, port });
-    return { ...relay, url };
-  } catch (error) {
-    accountStore?.close();
-    store.close();
-    throw error;
-  }
-}
-function isRelayDirectExecution(moduleUrl, argv1, embeddedContainerBuild2 = false) {
-  if (embeddedContainerBuild2) return false;
-  if (!argv1) return false;
-  try {
-    return realpathSync(fileURLToPath(moduleUrl)) === realpathSync(argv1);
-  } catch {
-    return moduleUrl === pathToFileURL(argv1).href;
-  }
-}
-var embeddedContainerBuild = true;
-if (isRelayDirectExecution(import.meta.url, process.argv[1], embeddedContainerBuild)) {
-  void startBlindRelay().then((relay) => {
-    process.stdout.write(`RoamCode blind relay is listening at ${relay.url}
-`);
-    const shutdown = () => relay.app.close().finally(() => process.exit(0));
-    process.once("SIGINT", shutdown);
-    process.once("SIGTERM", shutdown);
-  }).catch((error) => {
-    process.stderr.write(`roamcode relay failed to start: ${error.message}
-`);
-    process.exitCode = 1;
-  });
-}
-
-// src/relay-container.ts
-void startBlindRelay().then((relay) => {
-  const shutdown = () => relay.app.close().finally(() => process.exit(0));
-  process.once("SIGINT", shutdown);
-  process.once("SIGTERM", shutdown);
-}).catch((error) => {
-  process.stderr.write(`roamcode relay failed to start: ${error.message}
-`);
-  process.exitCode = 1;
-});