Question: upterm token and ports

[tyb-dev]

Hello!

How does upterm achieve forwarding of encrypted traffic of multiple users on the same port?

It seems the token would be needed to determine where to forward traffic to but the proxy could not get to that if ssh connection were end-to-end encrypted.
The diagram shows two tunnels however does not explain port and purpose.

Is an upterm session comprised of 2 consecutive SSH sessions with data decrypted and reencrypted at the proxy?