relay: migrate from Fastify to Bun.serve() native

Dockerfile.relay

@@ -21,22 +21,20 @@ COPY packages/relay/tsconfig.json packages/relay/
 # Build
 RUN pnpm build --filter=@authmesh/relay
 
-# --- Production stage ---
-FROM node:24-slim
+# --- Production stage (Bun runtime) ---
+FROM oven/bun:1.3-slim
 
 WORKDIR /app
 
-COPY --from=build /app/package.json /app/pnpm-workspace.yaml /app/pnpm-lock.yaml ./
+# Only copy the built dist files — relay has zero external runtime deps
 COPY --from=build /app/packages/core/package.json packages/core/
 COPY --from=build /app/packages/core/dist packages/core/dist
 COPY --from=build /app/packages/relay/package.json packages/relay/
 COPY --from=build /app/packages/relay/dist packages/relay/dist
 
-RUN corepack enable pnpm && pnpm install --frozen-lockfile --prod
-
 EXPOSE 3001
 
 ENV PORT=3001
 ENV HOST=0.0.0.0
 
-CMD ["node", "packages/relay/dist/start.js"]
+CMD ["bun", "packages/relay/dist/start.js"]

packages/relay/package.json

@@ -16,7 +16,7 @@
     "relay",
     "websocket",
     "handshake",
-    "fastify",
+    "bun",
     "pairing"
   ],
   "publishConfig": {
@@ -31,26 +31,21 @@
   "files": ["dist"],
   "scripts": {
     "build": "tsc -b",
-    "test": "vitest run",
-    "test:watch": "vitest",
+    "test": "bun test src/__tests__/",
+    "test:watch": "bun test --watch src/__tests__/",
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
     "clean": "rm -rf dist *.tsbuildinfo",
-    "start": "node dist/start.js"
+    "start": "bun dist/start.js"
   },
   "dependencies": {
-    "@authmesh/core": "workspace:*",
-    "fastify": "^5.0.0",
-    "@fastify/websocket": "^11.0.0",
-    "ws": "^8.0.0",
-    "@fastify/rate-limit": "^10.0.0"
+    "@authmesh/core": "workspace:*"
   },
   "devDependencies": {
     "@eslint/js": "^9.0.0",
     "@noble/curves": "2.0.1",
     "@noble/hashes": "2.0.1",
-    "@types/node": "^22.0.0",
-    "@types/ws": "^8.0.0",
+    "@types/bun": "^1.3.0",
     "eslint": "^9.0.0",
     "typescript": "^5.7.0",
     "typescript-eslint": "^8.0.0",

packages/relay/src/__tests__/handshake.integration.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { describe, it, expect, beforeAll, afterAll } from 'bun:test';
 import { p256 } from '@noble/curves/nist.js';
 import { signMessage } from '@authmesh/core';
 import { createRelayServer } from '../server.js';
@@ -8,18 +8,17 @@ import {
   computeSAS,
 } from '../../../cli/src/handshake.js';
 
-let relay: Awaited<ReturnType<typeof createRelayServer>>;
+let relay: ReturnType<typeof createRelayServer>;
 let relayUrl: string;
 
-beforeAll(async () => {
-  relay = await createRelayServer({ host: '127.0.0.1', port: 0 });
-  await relay.app.listen({ host: '127.0.0.1', port: 0 });
-  const port = (relay.app.server.address() as { port: number }).port;
-  relayUrl = `ws://127.0.0.1:${port}/ws`;
+beforeAll(() => {
+  relay = createRelayServer({ host: '127.0.0.1', port: 0 });
+  const addr = relay.start();
+  relayUrl = `ws://127.0.0.1:${addr.port}/ws`;
 });
 
-afterAll(async () => {
-  await relay.stop();
+afterAll(() => {
+  relay.stop();
 });
 
 function makeIdentity() {
@@ -82,7 +81,7 @@ describe('full handshake integration', () => {
   it('controller gets error for nonexistent OTC', async () => {
     const controller = makeIdentity();
 
-    await expect(
+    expect(
       runControllerHandshake(
         relayUrl,
         '999999',

packages/relay/src/index.ts

@@ -1,3 +1,4 @@
 export { createRelayServer } from './server.js';
+export type { WebSocketData } from './server.js';
 export { SessionStore } from './session.js';
 export { RateLimiter } from './rate-limit.js';