@opengeni/api-router 4.1.0 → 4.1.2-canary.36199476632001

package/dist/http/cors.d.ts

@@ -4,3 +4,15 @@ export declare function validateInteractionRequestOrigin(value: string | undefin
     publicBaseUrl?: string | undefined;
     webBaseUrl?: string | undefined;
 }): string | null;
+type BrowserOriginSettings = {
+    corsAllowOriginRegex: string;
+    publicBaseUrl?: string | undefined;
+    webBaseUrl?: string | undefined;
+};
+/**
+ * Whether a present `Origin` header names a browser origin this deployment
+ * serves its web app from: the CORS allowlist, the public base URL, or the
+ * separate web base URL. `null` and malformed values are never allowed.
+ */
+export declare function isAllowedBrowserOrigin(value: string, input: BrowserOriginSettings): boolean;
+export {};

package/dist/http/local-browser-boundary.d.ts

@@ -0,0 +1,72 @@
+import { type Settings } from "@opengeni/config";
+/**
+ * Browser boundary for the unauthenticated local product mode.
+ *
+ * In `local` access mode every request without credentials acts as the local
+ * `dev` user, and the default local sandbox runs agent commands on the host.
+ * Binding the API to loopback keeps other devices out, but a web page open in
+ * the developer's browser can still reach `http://127.0.0.1:<port>`:
+ *
+ * - any site can send cross-origin requests to it (CORS only hides the
+ *   response; a simple POST still runs), and
+ * - a DNS-rebinding site can make its own hostname resolve to 127.0.0.1 and
+ *   read responses as a same-origin page.
+ *
+ * The boundary therefore sorts the `Host` a request is addressed to into two
+ * classes:
+ *
+ * - Browser hosts: loopback, the hosts of the configured web, public, and
+ *   extra origins, the GitHub App callback tunnel, and a specific API bind
+ *   address. A present `Origin` must be this stack's web app, an explicitly
+ *   configured origin, or the API's own address on one of these hosts.
+ * - Sandbox hosts: names only sandboxes and the worker use to reach the API
+ *   (`host.docker.internal` with the Docker sandbox, and the hosts of
+ *   `OPENGENI_MCP_URL` and `OPENGENI_MCP_INTERNAL_URL`). They serve only the
+ *   sandbox routes (Codemode, first-party MCP, and the Git broker) and refuse
+ *   any request that carries browser metadata. A browser cannot tell a
+ *   sandbox name from an attacker's, so a rebinding page on one of these
+ *   names can neither send an accepted `Origin` nor reach the rest of the API.
+ *
+ * Every other `Host` is refused. Non-browser clients (the SDK, curl, sandbox
+ * callbacks, host-app servers) send no `Origin` and are unaffected. The `Host`
+ * port is not compared: a rebinding page controls only the hostname, while
+ * local proxies and forwarders legitimately present their own port.
+ *
+ * It applies only to `local` access mode in the `local` environment (the
+ * `bun run dev` stack and manual local runs). Managed and configured access
+ * modes, and deployments that set another `OPENGENI_ENVIRONMENT`, keep their
+ * existing CORS policy.
+ */
+export type LocalBrowserBoundarySettings = Pick<Settings, "productAccessMode" | "environment" | "apiHost" | "webBaseUrl" | "publicBaseUrl" | "opengeniMcpUrl" | "opengeniMcpInternalUrl" | "githubAppManifestBaseUrl" | "localAllowedOrigins" | "sandboxBackend">;
+export type LocalBrowserBoundaryRejectionCode = "LOCAL_HOST_NOT_ALLOWED" | "LOCAL_ORIGIN_NOT_ALLOWED" | "LOCAL_SANDBOX_ROUTE_ONLY";
+export type LocalBrowserBoundaryRejection = {
+    status: 403;
+    code: LocalBrowserBoundaryRejectionCode;
+    message: string;
+    /** The refused `Host` or `Origin`, for the API log only; never sent back. */
+    refused: string;
+};
+/** Called once per distinct refused value, so an operator can see why. */
+export type LocalBrowserBoundaryWarn = (message: string, attributes: Record<string, string>) => void;
+export type LocalBrowserBoundary = {
+    readonly allowedOrigins: ReadonlySet<string>;
+    /** Hostnames a browser may address. */
+    readonly browserHostnames: ReadonlySet<string>;
+    /** Hostnames only sandboxes and the worker use; sandbox routes only, no browsers. */
+    readonly sandboxHostnames: ReadonlySet<string>;
+    /** Whether a present `Origin` may call the API for a request with this `Host`. */
+    originAllowed(origin: string, host: string | null): boolean;
+    /** The rejection for this request, or null when the boundary admits it. */
+    rejection(request: Request): LocalBrowserBoundaryRejection | null;
+};
+/** Mark a request the API dispatches to itself so the boundary admits it. */
+export declare function markLocalInternalDispatch(request: Request): Request;
+export declare function localBrowserBoundaryApplies(settings: Pick<Settings, "productAccessMode" | "environment">): boolean;
+/** Build the boundary, or null when the deployment is not the local dev product. */
+export declare function createLocalBrowserBoundary(settings: LocalBrowserBoundarySettings, options?: {
+    warn?: LocalBrowserBoundaryWarn;
+}): LocalBrowserBoundary | null;
+/** The standard API error envelope for a boundary rejection outside Hono. */
+export declare function localBrowserBoundaryResponse(rejection: LocalBrowserBoundaryRejection): Response;
+/** The `Host` the boundary checks: the header, else the request URL's authority. */
+export declare function localBrowserRequestHost(request: Request): string | null;

package/dist/http/metrics-listener.d.ts

@@ -0,0 +1,22 @@
+import type { Settings } from "@opengeni/config";
+import { Hono } from "hono";
+type PrometheusSource = {
+    prometheusMetrics(): Promise<string>;
+};
+/** Register the Prometheus exposition route on one Hono app. */
+export declare function registerPrometheusMetricsRoute(app: Hono, observability: PrometheusSource): void;
+/**
+ * Whether the public API listener serves `GET /metrics`. A deployment that sets
+ * `OPENGENI_API_METRICS_PORT` moves the exposition to a dedicated internal
+ * listener, so an ingress that forwards every path to the API cannot publish it.
+ */
+export declare function publicListenerServesMetrics(settings: Pick<Settings, "apiMetricsPort">): boolean;
+/**
+ * The dedicated metrics listener: only `GET /metrics`, behind the same
+ * deployment-key perimeter rules as the public listener. Nothing else is
+ * routed here, so exposing this port to a scraper exposes nothing else.
+ */
+export declare function createMetricsListenerApp(settings: Settings, observability: PrometheusSource): Hono;
+/** Start the dedicated listener when configured; returns undefined otherwise. */
+export declare function startApiMetricsListener(settings: Settings, observability: PrometheusSource): ReturnType<typeof Bun.serve> | undefined;
+export {};

package/dist/http/registered-route-label.d.ts

@@ -0,0 +1,16 @@
+import type { Context } from "hono";
+/**
+ * The registered Hono path template of the handler that answers this request.
+ *
+ * Hono resolves every route matching a request before the first middleware
+ * runs, so the metrics middleware can read the exact code-owned template (for
+ * example `/v1/workspaces/:workspaceId/rigs/:rigId`) without re-implementing
+ * routing. Templates come only from route registrations, never from request
+ * data, so they are a closed and bounded metric/log label set.
+ *
+ * Middleware (arity two: `(context, next)`) and global catch-alls never name a
+ * route; the first matched terminal handler is the one Hono dispatches to.
+ */
+export declare function registeredHandlerRoutePath(context: Context): string | null;
+/** Normalize a registered template; drop catch-alls that would name nothing. */
+export declare function boundedRegisteredRouteLabel(path: string | null | undefined): string | null;

package/dist/http/request-source.d.ts

@@ -1,14 +1,52 @@
+import { type Settings } from "@opengeni/config";
 import type { Context } from "hono";
 declare const TRANSPORT_PEER_ADDRESS_BINDING = "opengeniTransportPeerAddress";
+/** Returned when the runtime supplied no transport peer (for example an
+ * in-process test request). Callers treat it as one shared bucket. */
+export declare const UNKNOWN_REQUEST_SOURCE_ADDRESS = "unknown";
+/**
+ * App-owned request header carrying the server-resolved client address into
+ * Better Auth, which reads client addresses only from request headers. It is
+ * removed from every inbound request and re-stamped on managed-auth routes, so
+ * a caller-supplied value never reaches the auth rate limiter or session IP.
+ */
+export declare const TRUSTED_CLIENT_ADDRESS_HEADER = "x-opengeni-trusted-client-address";
 type ApiRequestBindings = {
     [TRANSPORT_PEER_ADDRESS_BINDING]?: string | null;
 };
+/** The deployment's declared proxy chain (`OPENGENI_API_TRUSTED_PROXY_*`). */
+export type RequestSourceTrust = Pick<Settings, "apiTrustedProxyHops" | "apiTrustedProxyCidrs">;
 export declare function apiRequestBindingsForTransportPeer(address: string | null | undefined): ApiRequestBindings;
 /**
  * Resolve a quota/audit source from the server-owned transport peer. Forwarded
  * values are considered only when the operator declares an exact trusted proxy
- * hop count; the chain is then walked from the server side so caller-prepended
- * values cannot replace the address inserted by the trusted edge.
+ * hop count (`OPENGENI_API_TRUSTED_PROXY_HOPS`) and, when
+ * `OPENGENI_API_TRUSTED_PROXY_CIDRS` is set, only for a transport peer inside
+ * those ranges. Each trusted proxy must append the address of the peer that
+ * connected to it, or overwrite the header with the original client address;
+ * the chain is then walked from the server side so caller-prepended values
+ * cannot replace the address observed by the trusted edge. A missing, short,
+ * or malformed chain falls back to the transport peer.
+ */
+export declare function trustedRequestSourceAddress(c: Context, trust: RequestSourceTrust): string;
+/**
+ * Rate-limit key for a trusted source address. An IPv6 address keys on its
+ * /64, the block one subscriber normally holds and the granularity Better
+ * Auth applies to the same stamped address, so rotating addresses inside one
+ * /64 cannot mint fresh buckets. An IPv4-mapped IPv6 address (how a
+ * dual-stack listener reports an IPv4 peer) keys on the embedded IPv4 address
+ * instead of collapsing every IPv4 client into one /64. Anything else,
+ * including {@link UNKNOWN_REQUEST_SOURCE_ADDRESS}, is returned unchanged.
+ */
+export declare function requestSourceRateLimitKey(address: string): string;
+/** {@link trustedRequestSourceAddress} as an application rate-limit key. */
+export declare function trustedRequestSourceRateLimitKey(c: Context, trust: RequestSourceTrust): string;
+/**
+ * Replace any caller-supplied {@link TRUSTED_CLIENT_ADDRESS_HEADER}. When
+ * `stamp` is true the header is set to the trusted source address, so every
+ * Better Auth request derived from this request (direct handler calls,
+ * isolated provider requests, and `auth.api.*` calls built from its headers)
+ * keys rate limits and session records on the real client.
  */
-export declare function trustedRequestSourceAddress(c: Context, trustedProxyHops: number): string;
+export declare function replaceTrustedClientAddressHeader(c: Context, trust: RequestSourceTrust, stamp: boolean): void;
 export {};

package/dist/http/user-content.d.ts

@@ -0,0 +1,36 @@
+export declare const USER_CONTENT_SECURITY_POLICY = "default-src 'none'; img-src 'self' data: blob:; media-src 'self' data: blob:; style-src 'unsafe-inline'; sandbox";
+/** Media players only; scripts stay disabled (see the module comment). */
+export declare const USER_MEDIA_CONTENT_SECURITY_POLICY = "default-src 'none'; img-src 'self' data: blob:; media-src 'self' data: blob:; style-src 'unsafe-inline'; sandbox allow-same-origin";
+export declare const USER_CONTENT_SECURITY_HEADERS: Readonly<{
+    readonly "Content-Security-Policy": "default-src 'none'; img-src 'self' data: blob:; media-src 'self' data: blob:; style-src 'unsafe-inline'; sandbox";
+    readonly "Cross-Origin-Resource-Policy": "same-origin";
+    readonly "X-Content-Type-Options": "nosniff";
+}>;
+/**
+ * True when a browser would render this type as an active document (HTML,
+ * XHTML, SVG, any XML dialect, or multipart replacement streams). Anything that
+ * is not a clean `type/subtype` token is treated as active too.
+ */
+export declare function isActiveUserContentType(contentType: string): boolean;
+/** `Content-Disposition: attachment` for active markup; inline types are unchanged. */
+export declare function userContentDispositionHeaders(contentType: string, filename?: string | null): {
+    "Content-Disposition": string;
+} | Record<string, never>;
+/**
+ * Signed object-storage GET options for one stored object: active markup gets
+ * a signed `attachment` response override, so a browser that opens the URL
+ * downloads the bytes instead of rendering them with their stored type. The
+ * storage endpoint is not always a separate site (local development serves it
+ * from loopback, and a preview may route the bucket path on the app origin),
+ * so a signed URL follows the same rule as the API routes. Spread into
+ * `createGetUrl`; inline types add nothing.
+ */
+export declare function userContentSignedGetUrlOptions(contentType: string, filename?: string | null): {
+    responseContentDisposition: string;
+} | Record<string, never>;
+/** True for audio and video types the browser plays in a synthesized media document. */
+export declare function isPlayableMediaUserContentType(contentType: string): boolean;
+/** Sandbox policy for one response; only playable media keeps its origin. */
+export declare function userContentSecurityPolicy(contentType: string): string;
+/** Full header set for one user-content response with the given content type. */
+export declare function userContentResponseHeaders(contentType: string, filename?: string | null): Record<string, string>;

package/dist/http/websocket-upgrade-dispatch.d.ts

@@ -0,0 +1,18 @@
+import { type LocalBrowserBoundary } from "./local-browser-boundary.js";
+export type ApiWebSocketUpgradeRoute<Server> = {
+    handles(request: Request): boolean;
+    upgrade(request: Request, server: Server): Response | undefined;
+};
+export type ApiWebSocketUpgradeDispatch = {
+    handled: false;
+} | {
+    handled: true;
+    response: Response | undefined;
+};
+/**
+ * WebSocket upgrades bypass the Hono app, so the local-mode browser boundary
+ * (./local-browser-boundary.ts) is applied here before a transport upgrades.
+ * Returns `{ handled: false }` when no transport claims the request, so the
+ * caller dispatches it to the app, where the boundary runs as middleware.
+ */
+export declare function dispatchApiWebSocketUpgrade<Server>(request: Request, server: Server, routes: ReadonlyArray<ApiWebSocketUpgradeRoute<Server>>, localBrowserBoundary: LocalBrowserBoundary | null): ApiWebSocketUpgradeDispatch;

package/dist/index.js

@@ -4,10 +4,13 @@ import {
   apiRequestBindingsForTransportPeer,
   cleanupScheduledTaskConnectorAuthorization,
   createAppComposition,
+  createLocalBrowserBoundary,
   createOpenGeniSlackBotInteractionClient,
+  localBrowserBoundaryResponse,
+  startApiMetricsListener,
   startSlackInteractionPump,
   startTemporalScheduleCleanupPump
-} from "./chunk-24C5LPNE.js";
+} from "./chunk-QDIBJSM4.js";
 
 // src/index.ts
 import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
@@ -48,6 +51,15 @@ import {
 } from "@temporalio/client";
 
 // src/observability.ts
+import {
+  natsSubscriptionTerminationCounter
+} from "@opengeni/events";
+function observabilityEventBusOptions(observability) {
+  return {
+    logger: observabilityEventLogger(observability),
+    onSubscriptionTerminated: natsSubscriptionTerminationCounter(observability)
+  };
+}
 function observabilityEventLogger(observability) {
   return {
     debug: (message, attributes) => observability.debug(message, eventAttributes(attributes)),
@@ -76,6 +88,8 @@ function eventAttributeValue(value) {
 }
 
 // src/sandbox/auth-callout.ts
+import { createHash } from "crypto";
+import { createLogThrottle } from "@opengeni/observability";
 import {
   resolveEnrollmentSigningSecret
 } from "@opengeni/config";
@@ -96,6 +110,23 @@ var AGENT_CONNECTION_LEASE_MS = 2e4;
 // src/sandbox/auth-callout.ts
 var AUTH_CALLOUT_SUBJECT = "$SYS.REQ.USER.AUTH";
 var NATS_USER_JWT_TTL_SECONDS = 5 * 60;
+var AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS = 6e4;
+var processDenialWarningThrottle = createLogThrottle({
+  intervalMs: AUTH_CALLOUT_DENIAL_WARNING_INTERVAL_MS,
+  maxKeys: 1024
+});
+function warnDenial(deps, key, reason, message, attributes = {}) {
+  const admission = (deps.denialWarningThrottle ?? processDenialWarningThrottle).admit(key);
+  if (!admission) return;
+  deps.observability?.warn?.(message, {
+    ...attributes,
+    reason,
+    ...admission.suppressedCount > 0 ? { suppressedCount: admission.suppressedCount } : {}
+  });
+}
+function rejectedBearerKey(bearer) {
+  return `invalid-bearer:${createHash("sha256").update(bearer).digest("hex").slice(0, 32)}`;
+}
 async function handleAuthorizationRequest(deps, requestBytes) {
   const requestJwt = Buffer.from(requestBytes).toString("utf8");
   const decoded = decodeAuthRequest(requestJwt);
@@ -122,15 +153,23 @@ async function handleAuthorizationRequest(deps, requestBytes) {
   }
   const claims = await verifyEnrollmentBearer(secret, bearer);
   if (!claims) {
-    deps.observability?.warn?.("auth-callout: rejected an invalid enrollment bearer", {});
+    warnDenial(
+      deps,
+      rejectedBearerKey(bearer),
+      "invalid_bearer",
+      "auth-callout: rejected an invalid enrollment bearer"
+    );
     return deny("invalid or expired enrollment bearer");
   }
   const enrollment = await getEnrollment(deps.db, claims.workspaceId, claims.enrollmentId);
   if (!enrollment || enrollment.status !== "active") {
-    deps.observability?.warn?.("auth-callout: denied a revoked or unknown enrollment", {
-      workspaceId: claims.workspaceId,
-      agentId: claims.agentId
-    });
+    warnDenial(
+      deps,
+      `inactive:${claims.workspaceId}:${claims.agentId}`,
+      "inactive_enrollment",
+      "auth-callout: denied a revoked or unknown enrollment",
+      { workspaceId: claims.workspaceId, agentId: claims.agentId }
+    );
     return deny("enrollment is not active");
   }
   if (enrollment.workspaceId !== claims.workspaceId || enrollment.id !== claims.enrollmentId || enrollment.id !== claims.agentId || claims.agentId !== claims.enrollmentId || claims.subjectPrefix !== `agent.${claims.workspaceId}.${claims.agentId}`) {
@@ -151,10 +190,13 @@ async function handleAuthorizationRequest(deps, requestBytes) {
     leaseMs: AGENT_CONNECTION_LEASE_MS
   });
   if (!claim.claimed) {
-    deps.observability?.warn?.("auth-callout: denied a duplicate live runner", {
-      workspaceId: claims.workspaceId,
-      agentId: claims.agentId
-    });
+    warnDenial(
+      deps,
+      `duplicate:${claims.workspaceId}:${claims.agentId}`,
+      "duplicate_runner",
+      "auth-callout: denied a duplicate live runner",
+      { workspaceId: claims.workspaceId, agentId: claims.agentId }
+    );
     return deny("another runner instance currently owns this enrollment");
   }
   const permissions = workspaceAgentPermissions(
@@ -198,7 +240,7 @@ async function startAuthCalloutResponder(deps, natsUrl) {
     (bytes) => handleAuthorizationRequest(deps, bytes),
     {
       name: "opengeni-auth-callout",
-      ...deps.observability ? { logger: observabilityEventLogger(deps.observability) } : {}
+      ...deps.observability ? observabilityEventBusOptions(deps.observability) : {}
     }
   );
   deps.observability?.info?.("OpenGeni NATS auth-callout responder started", {
@@ -1249,8 +1291,17 @@ function closeCode(reason) {
   return 4400;
 }
 
+// src/http/websocket-upgrade-dispatch.ts
+function dispatchApiWebSocketUpgrade(request, server, routes, localBrowserBoundary) {
+  const route = routes.find((candidate) => candidate.handles(request));
+  if (!route) return { handled: false };
+  const rejection = localBrowserBoundary?.rejection(request);
+  if (rejection) return { handled: true, response: localBrowserBoundaryResponse(rejection) };
+  return { handled: true, response: route.upgrade(request, server) };
+}
+
 // src/editable-artifact-production.ts
-import { createHash as createHash4, randomUUID } from "crypto";
+import { createHash as createHash5, randomUUID } from "crypto";
 import {
   editableArtifactMaterializerCapabilitiesForRuntime
 } from "@opengeni/artifact-tool/runtime/materializer";
@@ -1352,7 +1403,7 @@ async function requireFlushBarrier(connection) {
 }
 
 // src/editable-artifact-native-kernel.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { pathToFileURL } from "url";
 import {
   createNativeArtifactSession,
@@ -1476,7 +1527,7 @@ var NativeEditableArtifactKernelAdapter = class {
         canonicalChunks: fixedChunks(snapshot, input.signal),
         canonicalByteSize: snapshot.byteLength,
         canonicalContentHash: editableArtifactContentHash(
-          `sha256:${createHash("sha256").update(snapshot).digest("hex")}`
+          `sha256:${createHash2("sha256").update(snapshot).digest("hex")}`
         ),
         stateHash: editableArtifactStateHash(session.stateHash()),
         coveredHeadSequence: 0,
@@ -1523,7 +1574,7 @@ var NativeEditableArtifactKernelAdapter = class {
         canonicalChunks: fixedChunks(canonical, input.signal),
         canonicalByteSize: canonical.byteLength,
         canonicalContentHash: editableArtifactContentHash(
-          `sha256:${createHash("sha256").update(canonical).digest("hex")}`
+          `sha256:${createHash2("sha256").update(canonical).digest("hex")}`
         ),
         stateHash: editableArtifactStateHash(session.stateHash()),
         coveredHeadSequence: input.state.artifact.headSequence,
@@ -1570,7 +1621,7 @@ var NativeEditableArtifactKernelAdapter = class {
       const stateHash = editableArtifactStateHash(session.stateHash());
       if (stateHash !== expected.stateHash) throw new Error("Snapshot state hash mismatch");
       const canonicalContentHash = editableArtifactContentHash(
-        `sha256:${createHash("sha256").update(canonical).digest("hex")}`
+        `sha256:${createHash2("sha256").update(canonical).digest("hex")}`
       );
       if (session.modality === "spreadsheet") {
         const coveredCausalFrontier = domainFrontier(session.frontier());
@@ -1786,7 +1837,7 @@ async function readVerifiedSnapshot(objects, snapshot, signal) {
       snapshot.byteSize,
       signal
     );
-    const contentHash = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+    const contentHash = `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
     if (contentHash !== snapshot.contentHash) throw new Error("Snapshot content hash mismatch");
     await object.assertUnchanged(signal);
     return bytes;
@@ -1822,7 +1873,7 @@ async function* fixedChunks(bytes, signal) {
   }
 }
 function namespaceForArtifact(artifactId) {
-  const digest = createHash("sha256").update(artifactId).digest();
+  const digest = createHash2("sha256").update(artifactId).digest();
   let value = 0n;
   for (let index = 0; index < 8; index += 1) value = value << 8n | BigInt(digest[index]);
   return value === 0n ? 1n : value;
@@ -1846,7 +1897,7 @@ function throwIfAborted(signal) {
 }
 
 // src/editable-artifact-office-import.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import {
   ArtifactOfficeSourceUnsupportedError,
   prepareArtifactOfficeImport
@@ -2012,7 +2063,7 @@ async function readVerifiedWorkspaceFile(storage, file, signal) {
     throw new EditableArtifactOfficeImportError("source_changed");
   }
   const bytes = new Uint8Array(file.sizeBytes);
-  const digest = createHash2("sha256");
+  const digest = createHash3("sha256");
   for (let start = 0; start < file.sizeBytes; start += MAX_BOUNDED_OBJECT_CHUNK_BYTES) {
     throwIfAborted2(signal);
     const end = Math.min(file.sizeBytes, start + MAX_BOUNDED_OBJECT_CHUNK_BYTES) - 1;
@@ -2073,7 +2124,7 @@ function throwIfAborted2(signal) {
 }
 
 // src/editable-artifact-workspace-files.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { completeFileUpload, prepareGeneratedWorkspaceFile } from "@opengeni/db";
 import { retryWhileMissing as retryWhileMissing2 } from "@opengeni/storage";
 var UPLOAD_INTENT_TTL_MS = 60 * 6e4;
@@ -2209,7 +2260,7 @@ function plainSha256(value) {
   return match[1];
 }
 function deterministicUuid(seed) {
-  const bytes = createHash3("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  const bytes = createHash4("sha256").update(seed, "utf8").digest().subarray(0, 16);
   bytes[6] = (bytes[6] ?? 0) & 15 | 80;
   bytes[8] = (bytes[8] ?? 0) & 63 | 128;
   const hex = bytes.toString("hex");
@@ -2484,7 +2535,7 @@ function snapshotBytesPort(objects) {
           throw new Error("Editable artifact snapshot content type mismatch");
         }
         const bytes = new Uint8Array(snapshot.byteSize);
-        const digest = createHash4("sha256");
+        const digest = createHash5("sha256");
         let offset = 0;
         for await (const chunk of object.chunks({
           chunkBytes: MAX_BOUNDED_OBJECT_CHUNK_BYTES2
@@ -2947,7 +2998,7 @@ async function startApi(options = {}) {
       () => createNatsEventBus(
         settings.natsUrl,
         controlPlaneAuth ? { user: controlPlaneAuth.user, pass: controlPlaneAuth.password } : void 0,
-        { logger: observabilityEventLogger(observability) }
+        observabilityEventBusOptions(observability)
       ),
       {
         ...retryOptions,
@@ -3012,17 +3063,22 @@ async function startApi(options = {}) {
   const interactionFrameProxies = new InteractionFrameProxyTransport(
     resolveFirstPartyDelegationSecret(settings)
   );
+  const localBrowserBoundary = createLocalBrowserBoundary(settings, {
+    warn: (message, attributes) => observability.warn(message, attributes)
+  });
+  const webSocketUpgrades = [interactionFrameProxies, artifactWebSockets];
   const server = Bun.serve({
     hostname: settings.apiHost,
     port: settings.apiPort,
     idleTimeout: 255,
     fetch: (request, bunServer) => {
-      if (interactionFrameProxies.handles(request)) {
-        return interactionFrameProxies.upgrade(request, bunServer);
-      }
-      if (artifactWebSockets.handles(request)) {
-        return artifactWebSockets.upgrade(request, bunServer);
-      }
+      const upgrade = dispatchApiWebSocketUpgrade(
+        request,
+        bunServer,
+        webSocketUpgrades,
+        localBrowserBoundary
+      );
+      if (upgrade.handled) return upgrade.response;
       return app.fetch(
         request,
         apiRequestBindingsForTransportPeer(bunServer.requestIP(request)?.address)
@@ -3037,6 +3093,7 @@ async function startApi(options = {}) {
       close: (socket) => socket.data.transportClosed()
     }
   });
+  const metricsServer = startApiMetricsListener(settings, observability);
   const stopSlackInteractionPump = settings.slackSigningSecret ? startSlackInteractionPump(routeDeps) : void 0;
   const stopMemorySlackPublicationPump = startMemorySlackPublicationPump(routeDeps);
   const stopTemporalScheduleCleanupPump = startTemporalScheduleCleanupPump({
@@ -3085,12 +3142,14 @@ async function startApi(options = {}) {
   }
   observability.info("OpenGeni API listening", {
     host: settings.apiHost,
-    port: settings.apiPort
+    port: settings.apiPort,
+    ...metricsServer ? { metricsPort: settings.apiMetricsPort } : {}
   });
   return {
     server,
     close: async () => {
       server.stop(true);
+      metricsServer?.stop(true);
       stopSlackInteractionPump?.();
       await stopMemorySlackPublicationPump();
       stopMetricsIngestion?.();