@opengeni/api-router 0.30.3 → 1.0.0

package/src/http/unmatched-route.ts

@@ -0,0 +1,60 @@
+import type { Context, Hono } from "hono";
+import { matchedRoutes } from "hono/route";
+
+type RegisteredRoute = { method: string; path: string; handler: unknown };
+
+const PROBED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
+
+/**
+ * Whether a matched Hono route is a terminal handler rather than middleware.
+ *
+ * Method-specific registrations (`app.get`, `app.put`, `app.on([...])`) always
+ * belong to a real route. `app.use` and `app.all` both register the `ALL`
+ * method; Hono itself tells them apart by arity - middleware takes
+ * `(context, next)` - so the same rule is applied here.
+ */
+function isTerminalRoute(route: RegisteredRoute): boolean {
+  if (route.method.toUpperCase() !== "ALL") return true;
+  return typeof route.handler === "function" && route.handler.length < 2;
+}
+
+function routesFor(app: Hono, method: string, path: string): RegisteredRoute[] {
+  // Every Hono router returns `[[ [handler, route], params ][], stash?]`.
+  const result = app.router.match(method, path) as unknown as [
+    Array<[[unknown, RegisteredRoute], unknown]>,
+    ...unknown[],
+  ];
+  return result[0].map(([[, route]]) => route);
+}
+
+export type UnmatchedRoute = { status: 404 } | { status: 405; allow: string[] };
+
+/**
+ * Classify a request no registered handler can answer, BEFORE authentication
+ * or authorization middleware runs. Those layers otherwise turn a request for a
+ * route that does not exist into an authorization-shaped failure (for example
+ * the fail-closed session operation classifier answering a retryable 503), so
+ * a client probing an unknown method or path would be told to retry forever.
+ *
+ * Returns null when the request has a handler, or when classification itself
+ * fails (fail open: the request keeps its previous routing behavior).
+ */
+export function unmatchedRoute(app: Hono, c: Context): UnmatchedRoute | null {
+  const method = c.req.method.toUpperCase();
+  // CORS preflights are answered by middleware and have no route handlers.
+  if (method === "OPTIONS") return null;
+  try {
+    if (matchedRoutes(c).some((route) => isTerminalRoute(route as RegisteredRoute))) {
+      return null;
+    }
+    const effectiveMethod = method === "HEAD" ? "GET" : method;
+    const allow = PROBED_METHODS.filter(
+      (candidate) =>
+        candidate !== effectiveMethod &&
+        routesFor(app, candidate, c.req.path).some(isTerminalRoute),
+    );
+    return allow.length > 0 ? { status: 405, allow } : { status: 404 };
+  } catch {
+    return null;
+  }
+}

package/src/http/user-content.ts

@@ -0,0 +1,158 @@
+/**
+ * Response headers for user-controlled bytes served from the API origin.
+ *
+ * Retained files, screenshots, exports, and live frames carry bytes and, for
+ * uploads, a content type chosen by a user or agent. The API shares its origin
+ * with the web console in the default deployment, so a stored `text/html` file
+ * opened by top-level navigation would otherwise run as that origin.
+ *
+ * Every such response therefore:
+ * - is a sandboxed document with no script, form, popup, plugin, or network
+ *   capability (`sandbox` plus `default-src 'none'`). Raster images and text
+ *   still render when a URL is opened directly;
+ * - cannot be embedded by another site as a no-cors subresource (CORP);
+ * - is never re-sniffed into a different type (`nosniff`).
+ *
+ * Audio and video keep their real origin (`sandbox allow-same-origin`, still
+ * without `allow-scripts`): the browser's synthesized media document re-fetches
+ * its own URL, and from an opaque origin that same-origin-only request would be
+ * refused. With scripts disabled and `nosniff`, such a response can only ever
+ * be a media player, never attacker markup.
+ *
+ * Markup types that a browser would render as an active document (HTML, XML,
+ * SVG, multipart) are additionally served as attachments, so a direct
+ * navigation downloads the bytes instead of showing attacker-authored markup on
+ * the app origin. The console never navigates to these routes: it reads bytes
+ * through the SDK and renders them in app-owned elements, so neither header
+ * changes an in-app preview. Signed object-storage GET URLs for active markup
+ * carry the same attachment as a signed response override
+ * (`userContentSignedGetUrlOptions`), because the storage endpoint is not
+ * always a separate site.
+ */
+const USER_CONTENT_FETCH_DIRECTIVES =
+  "default-src 'none'; img-src 'self' data: blob:; media-src 'self' data: blob:; style-src 'unsafe-inline'";
+
+export const USER_CONTENT_SECURITY_POLICY = `${USER_CONTENT_FETCH_DIRECTIVES}; sandbox`;
+
+/** Media players only; scripts stay disabled (see the module comment). */
+export const USER_MEDIA_CONTENT_SECURITY_POLICY = `${USER_CONTENT_FETCH_DIRECTIVES}; sandbox allow-same-origin`;
+
+export const USER_CONTENT_SECURITY_HEADERS = Object.freeze({
+  "Content-Security-Policy": USER_CONTENT_SECURITY_POLICY,
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "X-Content-Type-Options": "nosniff",
+} as const);
+
+const ACTIVE_DOCUMENT_TYPES = new Set(["text/html", "text/xml", "text/xsl", "application/xml"]);
+
+/** Media type essence (no parameters), lowercased. */
+function mediaTypeEssence(contentType: string): string {
+  return (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
+}
+
+/**
+ * True when a browser would render this type as an active document (HTML,
+ * XHTML, SVG, any XML dialect, or multipart replacement streams). Anything that
+ * is not a clean `type/subtype` token is treated as active too.
+ */
+export function isActiveUserContentType(contentType: string): boolean {
+  const essence = mediaTypeEssence(contentType);
+  if (!/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/.test(essence)) return true;
+  return (
+    ACTIVE_DOCUMENT_TYPES.has(essence) ||
+    essence.endsWith("+xml") ||
+    essence.startsWith("multipart/")
+  );
+}
+
+const DISPOSITION_FILENAME_MAX_CHARS = 200;
+
+/** RFC 8187 `attr-char` percent-encoding (stricter than `encodeURIComponent`). */
+function encodeExtendedParameterValue(value: string): string {
+  return encodeURIComponent(value).replace(
+    /['()*]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+}
+
+/**
+ * RFC 6266 filename parameters: an ASCII-only quoted `filename` that cannot
+ * break out of the header, plus an RFC 8187 `filename*` carrying the original
+ * name (for example non-Latin names) whenever the ASCII form had to change it.
+ */
+function dispositionFilenameParameters(filename: string): string {
+  const cleaned = Array.from(
+    filename
+      .replace(/[\u0000-\u001f\u007f/\\]+/g, "_")
+      // Lone surrogates cannot be percent-encoded as UTF-8.
+      .replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "_")
+      .trim(),
+  )
+    .slice(0, DISPOSITION_FILENAME_MAX_CHARS)
+    .join("");
+  const ascii =
+    cleaned
+      .replace(/[^A-Za-z0-9._ -]+/g, "_")
+      .replace(/\s+/g, " ")
+      .trim()
+      .slice(0, DISPOSITION_FILENAME_MAX_CHARS) || "download";
+  if (!cleaned || ascii === cleaned) return `filename="${ascii}"`;
+  return `filename="${ascii}"; filename*=UTF-8''${encodeExtendedParameterValue(cleaned)}`;
+}
+
+/** `Content-Disposition: attachment` for active markup; inline types are unchanged. */
+export function userContentDispositionHeaders(
+  contentType: string,
+  filename?: string | null,
+): { "Content-Disposition": string } | Record<string, never> {
+  if (!isActiveUserContentType(contentType)) return {};
+  return {
+    "Content-Disposition": filename
+      ? `attachment; ${dispositionFilenameParameters(filename)}`
+      : "attachment",
+  };
+}
+
+/**
+ * Signed object-storage GET options for one stored object: active markup gets
+ * a signed `attachment` response override, so a browser that opens the URL
+ * downloads the bytes instead of rendering them with their stored type. The
+ * storage endpoint is not always a separate site (local development serves it
+ * from loopback, and a preview may route the bucket path on the app origin),
+ * so a signed URL follows the same rule as the API routes. Spread into
+ * `createGetUrl`; inline types add nothing.
+ */
+export function userContentSignedGetUrlOptions(
+  contentType: string,
+  filename?: string | null,
+): { responseContentDisposition: string } | Record<string, never> {
+  const headers = userContentDispositionHeaders(contentType, filename);
+  return "Content-Disposition" in headers
+    ? { responseContentDisposition: headers["Content-Disposition"] }
+    : {};
+}
+
+/** True for audio and video types the browser plays in a synthesized media document. */
+export function isPlayableMediaUserContentType(contentType: string): boolean {
+  const essence = mediaTypeEssence(contentType);
+  return !isActiveUserContentType(essence) && /^(audio|video)\//.test(essence);
+}
+
+/** Sandbox policy for one response; only playable media keeps its origin. */
+export function userContentSecurityPolicy(contentType: string): string {
+  return isPlayableMediaUserContentType(contentType)
+    ? USER_MEDIA_CONTENT_SECURITY_POLICY
+    : USER_CONTENT_SECURITY_POLICY;
+}
+
+/** Full header set for one user-content response with the given content type. */
+export function userContentResponseHeaders(
+  contentType: string,
+  filename?: string | null,
+): Record<string, string> {
+  return {
+    ...USER_CONTENT_SECURITY_HEADERS,
+    "Content-Security-Policy": userContentSecurityPolicy(contentType),
+    ...userContentDispositionHeaders(contentType, filename),
+  };
+}

package/src/http/websocket-upgrade-dispatch.ts

@@ -0,0 +1,29 @@
+import { localBrowserBoundaryResponse, type LocalBrowserBoundary } from "./local-browser-boundary";
+
+export type ApiWebSocketUpgradeRoute<Server> = {
+  handles(request: Request): boolean;
+  upgrade(request: Request, server: Server): Response | undefined;
+};
+
+export type ApiWebSocketUpgradeDispatch =
+  | { handled: false }
+  | { handled: true; response: Response | undefined };
+
+/**
+ * WebSocket upgrades bypass the Hono app, so the local-mode browser boundary
+ * (./local-browser-boundary.ts) is applied here before a transport upgrades.
+ * Returns `{ handled: false }` when no transport claims the request, so the
+ * caller dispatches it to the app, where the boundary runs as middleware.
+ */
+export function dispatchApiWebSocketUpgrade<Server>(
+  request: Request,
+  server: Server,
+  routes: ReadonlyArray<ApiWebSocketUpgradeRoute<Server>>,
+  localBrowserBoundary: LocalBrowserBoundary | null,
+): ApiWebSocketUpgradeDispatch {
+  const route = routes.find((candidate) => candidate.handles(request));
+  if (!route) return { handled: false };
+  const rejection = localBrowserBoundary?.rejection(request);
+  if (rejection) return { handled: true, response: localBrowserBoundaryResponse(rejection) };
+  return { handled: true, response: route.upgrade(request, server) };
+}

package/src/index.ts

@@ -1,6 +1,8 @@
+import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
 import {
   dbSearchPath,
   getSettings,
+  resolveFirstPartyDelegationSecret,
   resolveNatsCalloutConfig,
   resolveNatsControlPlaneAuth,
   retryStartupDependency,
@@ -14,16 +16,24 @@ import type {
 } from "@opengeni/contracts";
 import {
   assertRuntimeDatabasePosture,
+  isRetryableRuntimeDatabaseStartupError,
   createDb,
   markSessionWorkflowWakeDelivered,
   runtimeDatabaseReadyCheck,
   type Database,
 } from "@opengeni/db";
 import { createNatsEventBus, type ResponderConnection } from "@opengeni/events";
-import { createObservability, logStartupDependencyRetry } from "@opengeni/observability";
+import {
+  createObservability,
+  logStartupDependencyRetry,
+  type Observability,
+} from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { isArtifactRuntimeConfigured } from "@opengeni/artifact-tool/runtime/development";
-import { SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID } from "@opengeni/core";
+import {
+  resolveCatalogSettings,
+  SESSION_WORKFLOW_WAKE_DISPATCHER_SCHEDULE_ID,
+} from "@opengeni/core";
 import {
   Connection,
   Client as TemporalClient,
@@ -33,21 +43,31 @@ import {
 } from "@temporalio/client";
 import type { ScheduleOptions, ScheduleSpec, ScheduleUpdateOptions } from "@temporalio/client";
 import { createAppComposition, type DocumentIndexClient, type SessionWorkflowClient } from "./app";
-import { observabilityEventLogger } from "./observability";
+import { observabilityEventBusOptions } from "./observability";
 import { startAuthCalloutResponder } from "./sandbox/auth-callout";
 import { startHelloIngestion, startMetricsIngestion } from "./sandbox/metrics-ingestion";
 import { startSlackInteractionPump } from "./integrations/slack-interactions";
 import { startMemorySlackPublicationPump } from "./memory-slack-delivery";
 import { startTemporalScheduleCleanupPump } from "./temporal-schedule-cleanup";
+import { createTemporalScheduleSynchronizer } from "./temporal-schedule-sync";
+import { startWorkspaceWebhookDispatchPump } from "./workspace-webhook-dispatch";
+import { cleanupScheduledTaskConnectorAuthorization } from "./scheduled-task-deletion";
 import {
   EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,
   EditableArtifactWebSocketTransport,
-  type EditableArtifactWebSocketConnection,
 } from "./editable-artifact-websocket";
+import { editableArtifactSourceSessionAuthorizer } from "./editable-artifact-source-session";
+import type { ApiWebSocketConnection } from "./api-websocket";
+import { InteractionFrameProxyTransport } from "./interaction-frame-proxy";
+import { apiRequestBindingsForTransportPeer } from "./http/request-source";
+import { startApiMetricsListener } from "./http/metrics-listener";
+import { createLocalBrowserBoundary } from "./http/local-browser-boundary";
+import { dispatchApiWebSocketUpgrade } from "./http/websocket-upgrade-dispatch";
 import {
   createStandaloneEditableArtifactApplication,
   type StandaloneEditableArtifactApplication,
 } from "./editable-artifact-production";
+import { installApiFatalProcessBoundary } from "./fatal-process-boundary";
 
 /**
  * A REJECT_DUPLICATE start collides on the deterministic workflowId when the
@@ -87,7 +107,42 @@ export async function createTemporalWorkflowClient(
     connection,
     namespace: settings.temporalNamespace,
   });
+  const scheduledTasks = createTemporalScheduleSynchronizer({
+    db,
+    withDeadline: (deadline, work) => temporal.withDeadline(deadline, work),
+    upsert: async (task) => {
+      const options = temporalScheduleOptions(task, settings.temporalTaskQueue);
+      try {
+        await temporal.schedule
+          .getHandle(task.temporalScheduleId)
+          .update(() => temporalScheduleUpdateOptions(options));
+      } catch (error) {
+        if (!shouldCreateScheduleAfterUpdateError(error)) throw error;
+        await temporal.schedule.create(options);
+      }
+    },
+    remove: async (temporalScheduleId) => {
+      try {
+        await temporal.schedule.getHandle(temporalScheduleId).delete();
+      } catch (error) {
+        if (!(error instanceof ScheduleNotFoundError)) throw error;
+      }
+    },
+  });
   const client: SessionWorkflowClient = {
+    triggerAutomationRun: async ({ accountId, workspaceId, runId }) => {
+      try {
+        await temporal.workflow.start("automationRunWorkflow", {
+          taskQueue: settings.temporalTaskQueue,
+          workflowId: `automation-run:${runId}`,
+          workflowIdReusePolicy: "REJECT_DUPLICATE",
+          args: [{ accountId, workspaceId, runId }],
+        });
+      } catch (error) {
+        if (isWorkflowAlreadyStarted(error)) return;
+        throw error;
+      }
+    },
     signalUserMessage: async ({ eventId, workflowId }) => {
       await temporal.workflow.getHandle(workflowId).signal("userMessage", eventId);
     },
@@ -98,6 +153,7 @@ export async function createTemporalWorkflowClient(
       workflowId,
       wakeRevision,
       interruptionRequested,
+      onSignalAccepted,
     }) => {
       await temporal.workflow.signalWithStart("sessionWorkflow", {
         taskQueue: settings.temporalTaskQueue,
@@ -106,7 +162,8 @@ export async function createTemporalWorkflowClient(
         args: [{ accountId, workspaceId, sessionId }],
         signal: interruptionRequested ? "sessionControl" : "queueChanged",
       });
-      await markSessionWorkflowWakeDelivered(db, {
+      onSignalAccepted?.();
+      return await markSessionWorkflowWakeDelivered(db, {
         accountId,
         workspaceId,
         sessionId,
@@ -167,41 +224,15 @@ export async function createTemporalWorkflowClient(
         wakeRevision: workflowWakeRevision,
       });
     },
-    syncScheduledTask: async ({ task }) => {
-      const schedule = temporal.schedule.getHandle(task.temporalScheduleId);
-      if (task.schedule.type === "manual") {
-        try {
-          await schedule.delete();
-        } catch (error) {
-          if (!(error instanceof ScheduleNotFoundError)) throw error;
-        }
-        return;
-      }
-      const options = temporalScheduleOptions(task, settings.temporalTaskQueue);
-      try {
-        await schedule.update(() => temporalScheduleUpdateOptions(options));
-      } catch (error) {
-        if (!shouldCreateScheduleAfterUpdateError(error)) {
-          throw error;
-        }
-        await temporal.schedule.create(options);
-      }
-    },
-    deleteScheduledTaskSchedule: async ({ temporalScheduleId }) => {
-      try {
-        await temporal.withDeadline(Date.now() + 5_000, async () => {
-          await temporal.schedule.getHandle(temporalScheduleId).delete();
-        });
-      } catch (error) {
-        if (error instanceof ScheduleNotFoundError) return;
-        throw error;
-      }
-    },
+    syncScheduledTask: async ({ task, onFailure }) => scheduledTasks.sync(task, onFailure),
+    deleteScheduledTaskSchedule: async ({ temporalScheduleId }) =>
+      scheduledTasks.remove(temporalScheduleId),
     triggerScheduledTask: async ({
       task,
       agentRunUsageIdempotencyKey,
       triggerWorkflowId,
       initiator,
+      credentialRestriction,
       triggerType = "manual",
     }) => {
       // Deterministic workflowId (derived from the trigger token by the
@@ -222,6 +253,7 @@ export async function createTemporalWorkflowClient(
               triggerType,
               agentRunUsageIdempotencyKey,
               initiator,
+              ...(credentialRestriction ? { credentialRestriction } : {}),
             },
           ],
         });
@@ -237,7 +269,7 @@ export async function createTemporalWorkflowClient(
     startRigVerification: async ({ workspaceId, changeId, versionId, workflowId }) => {
       const targetId = changeId ?? versionId;
       if (!targetId) {
-        throw new Error("rig verification requires changeId or versionId");
+        throw new Error("sandbox environment verification requires changeId or versionId");
       }
       try {
         await temporal.workflow.start("rigVerificationWorkflow", {
@@ -283,14 +315,21 @@ export async function createTemporalWorkflowClient(
   };
 }
 
-export async function startApi() {
-  const settings = getSettings();
-  const observability = createObservability(settings, { component: "api" });
+export async function startApi(
+  options: {
+    settings?: ReturnType<typeof getSettings>;
+    observability?: Observability;
+  } = {},
+) {
+  const settings = options.settings ?? getSettings();
+  const observability =
+    options.observability ?? createObservability(settings, { component: "api" });
   // Step I: standalone → dbSchema unset → searchPath undefined → today's plain
   // handle (public). Embedded → scoped to the dedicated schema + the host's RLS
   // strategy.
   const searchPath = dbSearchPath(settings);
   const dbClient = createDb(settings.databaseUrl, {
+    max: settings.apiDatabasePoolMax,
     ...(searchPath ? { searchPath } : {}),
     rlsStrategy: settings.rlsStrategy,
   });
@@ -303,17 +342,41 @@ export async function startApi() {
     rlsStrategy: settings.rlsStrategy,
     expectedRole: settings.runtimeDatabaseRole,
     targetSchema: settings.dbSchema.trim() || "public",
+    organizationTenancyCanonicalActivationEnabled:
+      settings.organizationTenancyCanonicalActivationEnabled,
   } as const;
   // The PRIVILEGED control-plane NATS login (M-AUTH): when the server runs with
   // auth_callout, api/worker authenticate as a static account user permitted to
-  // request `agent.*.rpc`. Null in local dev (anonymous connect — the bus default).
+  // request exact generation-fenced agent RPC subjects. Null in local dev
+  // (anonymous connect — the bus default).
   const controlPlaneAuth = resolveNatsControlPlaneAuth(settings);
   try {
+    // Browser, Computer, Terminal, and Files can cold-create the home sandbox
+    // directly from this API process. Resolve the same private-registry Modal
+    // image before the API becomes reachable so the first human interaction
+    // does not pay the provider import/build latency. This mirrors the turn
+    // worker's startup boundary and is a no-op for provider-native image IDs,
+    // public images, and non-Modal backends.
+    const { ensureModalRegistryImage } = await import("@opengeni/runtime/sandbox");
+    await retryStartupDependency(
+      "Modal private-registry image",
+      () => ensureModalRegistryImage(settings),
+      { ...retryOptions, onRetry },
+    );
     await retryStartupDependency(
       "PostgreSQL runtime posture",
       () => assertRuntimeDatabasePosture(dbClient.db, databasePosture),
+      { ...retryOptions, onRetry, shouldRetry: isRetryableRuntimeDatabaseStartupError },
+    );
+    const resolvedCatalog = await retryStartupDependency(
+      "model catalog",
+      () => resolveCatalogSettings(dbClient.db, settings),
       { ...retryOptions, onRetry },
     );
+    observability.info("OpenGeni model catalog resolved", {
+      catalogSource: resolvedCatalog.source,
+      catalogVersion: resolvedCatalog.version,
+    });
     bus = await retryStartupDependency(
       "NATS",
       () =>
@@ -322,7 +385,7 @@ export async function startApi() {
           controlPlaneAuth
             ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password }
             : undefined,
-          { logger: observabilityEventLogger(observability) },
+          observabilityEventBusOptions(observability),
         ),
       {
         ...retryOptions,
@@ -385,32 +448,60 @@ export async function startApi() {
       behavior: "http_and_websocket_fail_closed",
     });
   }
-  const artifactWebSockets = new EditableArtifactWebSocketTransport(routeDeps.editableArtifacts);
-  const server = Bun.serve<EditableArtifactWebSocketConnection>({
+  const artifactWebSockets = new EditableArtifactWebSocketTransport(
+    routeDeps.editableArtifacts,
+    editableArtifactSourceSessionAuthorizer(routeDeps),
+  );
+  const interactionFrameProxies = new InteractionFrameProxyTransport(
+    resolveFirstPartyDelegationSecret(settings),
+  );
+  // WebSocket upgrades bypass the Hono app, so the local-mode browser boundary
+  // (http/local-browser-boundary.ts) is applied to them in the dispatcher;
+  // every other request meets it in the Hono middleware.
+  const localBrowserBoundary = createLocalBrowserBoundary(settings, {
+    warn: (message, attributes) => observability.warn(message, attributes),
+  });
+  const webSocketUpgrades = [interactionFrameProxies, artifactWebSockets];
+  const server = Bun.serve<ApiWebSocketConnection>({
     hostname: settings.apiHost,
     port: settings.apiPort,
     idleTimeout: 255,
     fetch: (request, bunServer) => {
-      if (artifactWebSockets.handles(request)) {
-        return artifactWebSockets.upgrade(request, bunServer);
-      }
-      return app.fetch(request);
+      const upgrade = dispatchApiWebSocketUpgrade(
+        request,
+        bunServer,
+        webSocketUpgrades,
+        localBrowserBoundary,
+      );
+      if (upgrade.handled) return upgrade.response;
+      return app.fetch(
+        request,
+        apiRequestBindingsForTransportPeer(bunServer.requestIP(request)?.address),
+      );
     },
     websocket: {
       maxPayloadLength: EDITABLE_ARTIFACT_LIVE_WEBSOCKET_MAX_MESSAGE_BYTES,
       backpressureLimit: 16 * 1024 * 1024,
       closeOnBackpressureLimit: true,
-      open: (socket) => artifactWebSockets.websocket.open(socket),
-      message: (socket, message) => artifactWebSockets.websocket.message(socket, message),
-      close: (socket) => artifactWebSockets.websocket.close(socket),
+      open: (socket) => socket.data.attach(socket),
+      message: (socket, message) => socket.data.receive(message),
+      close: (socket) => socket.data.transportClosed(),
     },
   });
+  const metricsServer = startApiMetricsListener(settings, observability);
   const stopSlackInteractionPump = settings.slackSigningSecret
     ? startSlackInteractionPump(routeDeps)
     : undefined;
   const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);
+  const stopWorkspaceWebhookDispatchPump = startWorkspaceWebhookDispatchPump({
+    db: dbClient.db,
+    settings,
+    observability,
+  });
   const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({
     db: dbClient.db,
+    cleanupConnectorAuthorization: async (claim) =>
+      await cleanupScheduledTaskConnectorAuthorization(routeDeps, claim),
     deleteSchedule: async (temporalScheduleId) => {
       await workflowClient.client.deleteScheduledTaskSchedule({ temporalScheduleId });
     },
@@ -469,16 +560,21 @@ export async function startApi() {
   observability.info("OpenGeni API listening", {
     host: settings.apiHost,
     port: settings.apiPort,
+    ...(metricsServer ? { metricsPort: settings.apiMetricsPort } : {}),
   });
   return {
     server,
     close: async () => {
       server.stop(true);
+      metricsServer?.stop(true);
       stopSlackInteractionPump?.();
       await stopMemorySlackPublicationPump();
       stopMetricsIngestion?.();
       stopHelloIngestion?.();
       await stopTemporalScheduleCleanupPump();
+      await stopWorkspaceWebhookDispatchPump();
+      // Write queued presence before the database pool closes.
+      await routeDeps.userPresence?.close().catch(() => undefined);
       await Promise.allSettled([
         Promise.resolve(editableArtifactComposition?.close()),
         authCalloutResponder?.close(),
@@ -491,7 +587,16 @@ export async function startApi() {
 }
 
 if (import.meta.main) {
-  await startApi();
+  const fatalBoundary = installApiFatalProcessBoundary();
+  try {
+    const settings = getSettings();
+    const observability = createObservability(settings, { component: "api" });
+    fatalBoundary.attachObservability(observability);
+    await startApi({ settings, observability });
+    fatalBoundary.markRunning();
+  } catch (error) {
+    await fatalBoundary.reportStartupFailure(error);
+  }
 }
 
 export function temporalOverlapPolicy(policy: ScheduledTaskOverlapPolicy): ScheduleOverlapPolicy {
@@ -612,7 +717,7 @@ function temporalScheduleOptions(task: ScheduledTask, taskQueue: string): Schedu
 
 function scheduledTaskEffectivelyPaused(task: ScheduledTask): boolean {
   if (task.status === "paused") return true;
-  if (task.action.kind !== "knowledge_source_sync") return false;
+  if (!scheduledTaskKnowledgeSource(task)) return false;
   const control = task.metadata.knowledgeSourceSync;
   if (!control || typeof control !== "object") return false;
   const record = control as Record<string, unknown>;