open-managed-agents 0.1.0

package/dist/src/control-plane/models/deployment-config.js

@@ -0,0 +1,93 @@
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+export const DEFAULT_MODEL_PROVIDER = "anthropic";
+export const DEFAULT_MODEL_ID = "claude-sonnet-5";
+export const DEFAULT_MODEL_PROVIDERS = ["anthropic", "openai", "openrouter"];
+export const MODEL_DEPLOYMENT_ENV_KEYS = [
+    "OMA_HOME",
+    "OMA_MODEL_PROVIDERS",
+    "OMA_DEFAULT_MODEL_PROVIDER",
+    "OMA_DEFAULT_MODEL",
+    "OMA_PI_AUTH_FILE",
+    "OMA_PI_MODELS_FILE",
+    "OMA_ALLOW_MODEL_AUTH_COMMANDS",
+];
+export function parseModelDeploymentConfigFromEnv(env, opts = {}) {
+    const allowedProviders = parseAllowedProviders(env.OMA_MODEL_PROVIDERS);
+    const defaultModel = parseDefaultModel(env, allowedProviders);
+    const home = optionalEnvString(env.OMA_HOME, "OMA_HOME") ?? opts.home ?? join(homedir(), ".oma");
+    const authPath = optionalEnvString(env.OMA_PI_AUTH_FILE, "OMA_PI_AUTH_FILE") ??
+        join(home, "pi", "auth.json");
+    const modelsPath = optionalEnvString(env.OMA_PI_MODELS_FILE, "OMA_PI_MODELS_FILE") ??
+        join(home, "pi", "models.json");
+    return {
+        allowedProviders,
+        defaultModel,
+        authPath: resolve(authPath),
+        modelsPath: resolve(modelsPath),
+        allowModelAuthCommands: parseBoolean(env.OMA_ALLOW_MODEL_AUTH_COMMANDS, {
+            defaultValue: false,
+            name: "OMA_ALLOW_MODEL_AUTH_COMMANDS",
+        }),
+    };
+}
+export function validateModelDeploymentConfigAgainstCatalog(config, catalog) {
+    for (const provider of config.allowedProviders) {
+        if (!catalog.hasProvider(provider)) {
+            throw new Error(`Model provider ${provider} is not available on this deployment`);
+        }
+    }
+    if (!catalog.hasModel(config.defaultModel)) {
+        throw new Error(`Default model ${config.defaultModel.provider}/${config.defaultModel.id} is not available on this deployment`);
+    }
+    return config;
+}
+function parseAllowedProviders(raw) {
+    const value = optionalEnvString(raw, "OMA_MODEL_PROVIDERS");
+    if (value === undefined)
+        return [...DEFAULT_MODEL_PROVIDERS];
+    const providers = value.split(",").map((entry) => entry.trim());
+    if (providers.some((provider) => provider.length === 0)) {
+        throw new Error("OMA_MODEL_PROVIDERS must be comma-separated provider names");
+    }
+    const seen = new Set();
+    for (const provider of providers) {
+        if (seen.has(provider)) {
+            throw new Error(`Duplicate model provider in OMA_MODEL_PROVIDERS: ${provider}`);
+        }
+        seen.add(provider);
+    }
+    return providers;
+}
+function parseDefaultModel(env, allowedProviders) {
+    const provider = optionalEnvString(env.OMA_DEFAULT_MODEL_PROVIDER, "OMA_DEFAULT_MODEL_PROVIDER");
+    const id = optionalEnvString(env.OMA_DEFAULT_MODEL, "OMA_DEFAULT_MODEL");
+    if (provider === undefined && id === undefined) {
+        return { provider: DEFAULT_MODEL_PROVIDER, id: DEFAULT_MODEL_ID };
+    }
+    if (provider === undefined || id === undefined) {
+        throw new Error("OMA_DEFAULT_MODEL_PROVIDER and OMA_DEFAULT_MODEL must be set together");
+    }
+    if (!allowedProviders.includes(provider)) {
+        throw new Error(`OMA_DEFAULT_MODEL_PROVIDER ${provider} must be listed in OMA_MODEL_PROVIDERS`);
+    }
+    return { provider, id };
+}
+function optionalEnvString(value, name) {
+    if (value === undefined)
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed === "")
+        throw new Error(`${name} must not be empty`);
+    return trimmed;
+}
+function parseBoolean(value, opts) {
+    const parsed = optionalEnvString(value, opts.name);
+    if (parsed === undefined)
+        return opts.defaultValue;
+    if (parsed === "true")
+        return true;
+    if (parsed === "false")
+        return false;
+    throw new Error(`${opts.name} must be "true" or "false"`);
+}

package/dist/src/control-plane/models/routes.js

@@ -0,0 +1,32 @@
+import { Hono } from "hono";
+import { invalidRequest } from "../errors.js";
+import { parseLimit } from "../http.js";
+import { workspaceIdFrom } from "../workspace.js";
+export function modelCatalogRoutes(service) {
+    const app = new Hono();
+    app.get("/", (c) => {
+        return c.json(service.list(workspaceIdFrom(c), {
+            provider: nonEmptyQuery(c.req.query("provider"), "provider"),
+            available: parseAvailable(c.req.query("available")),
+            limit: parseLimit(c.req.query("limit")),
+            page: nonEmptyQuery(c.req.query("page"), "page"),
+        }), 200);
+    });
+    return app;
+}
+function nonEmptyQuery(value, name) {
+    if (value === undefined)
+        return undefined;
+    if (value.length === 0)
+        throw invalidRequest(`\`${name}\` must not be empty`);
+    return value;
+}
+function parseAvailable(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "true")
+        return true;
+    if (value === "false")
+        return false;
+    throw invalidRequest("`available` must be `true` or `false`");
+}

package/dist/src/control-plane/models/service.js

@@ -0,0 +1,138 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { invalidRequest } from "../errors.js";
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 100;
+export class DefaultModelCatalogService {
+    catalog;
+    cursorSigningKey = randomBytes(32);
+    constructor(catalog) {
+        this.catalog = catalog;
+    }
+    list(workspaceId, opts = {}) {
+        const context = {
+            provider: opts.provider ?? null,
+            available: opts.available ?? false,
+        };
+        const limit = normalizeLimit(opts.limit);
+        const anchor = opts.page === undefined
+            ? undefined
+            : decodeCursor(opts.page, workspaceId, context, this.cursorSigningKey).anchor;
+        const models = this.catalog
+            .list({
+            ...(context.provider === null ? {} : { provider: context.provider }),
+            availableOnly: context.available,
+        })
+            .slice()
+            .sort(compareModelRefs);
+        const startIndex = anchor === undefined
+            ? 0
+            : models.findIndex((model) => compareModelRefParts(model.provider, model.id, anchor.provider, anchor.id) > 0);
+        const pageModels = models.slice(startIndex < 0 ? models.length : startIndex, (startIndex < 0 ? models.length : startIndex) + limit + 1);
+        const dataModels = pageModels.slice(0, limit);
+        const next = pageModels.length > limit ? dataModels.at(-1) : undefined;
+        return {
+            data: dataModels.map((model) => this.toEntry(model)),
+            next_page: next === undefined
+                ? null
+                : encodeCursor({
+                    v: 1,
+                    provider: context.provider,
+                    available: context.available,
+                    anchor: { provider: next.provider, id: next.id },
+                }, workspaceId, this.cursorSigningKey),
+        };
+    }
+    toEntry(model) {
+        return {
+            type: "model",
+            provider: model.provider,
+            id: model.id,
+            name: model.name,
+            provider_name: this.catalog.modelRegistry.getProviderDisplayName(model.provider),
+            reasoning: model.reasoning,
+            input: [...model.input],
+            context_window: model.contextWindow,
+            max_output_tokens: model.maxTokens,
+            credentials_configured: this.catalog.hasConfiguredAuth(model),
+            default: model.provider === this.catalog.defaultModel.provider &&
+                model.id === this.catalog.defaultModel.id,
+        };
+    }
+}
+function normalizeLimit(limit) {
+    if (limit === undefined)
+        return DEFAULT_LIMIT;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_LIMIT) {
+        throw invalidRequest("`limit` must be an integer from 1 through 100");
+    }
+    return limit;
+}
+function compareModelRefs(left, right) {
+    return compareModelRefParts(left.provider, left.id, right.provider, right.id);
+}
+function compareModelRefParts(leftProvider, leftId, rightProvider, rightId) {
+    if (leftProvider !== rightProvider)
+        return leftProvider < rightProvider ? -1 : 1;
+    if (leftId === rightId)
+        return 0;
+    return leftId < rightId ? -1 : 1;
+}
+function encodeCursor(payload, workspaceId, signingKey) {
+    const encodedPayload = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+    const signature = signCursor(encodedPayload, workspaceId, signingKey);
+    return `${encodedPayload}.${signature.toString("base64url")}`;
+}
+function decodeCursor(value, workspaceId, context, signingKey) {
+    let payload;
+    try {
+        const parts = value.split(".");
+        if (parts.length !== 2)
+            throw new Error("invalid cursor");
+        const [encodedPayload, encodedSignature] = parts;
+        const decoded = decodeCanonicalBase64url(encodedPayload);
+        const signature = decodeCanonicalBase64url(encodedSignature);
+        const expected = signCursor(encodedPayload, workspaceId, signingKey);
+        if (signature.length !== expected.length || !timingSafeEqual(signature, expected)) {
+            throw new Error("invalid signature");
+        }
+        payload = JSON.parse(decoded.toString("utf8"));
+    }
+    catch {
+        throw invalidRequest("invalid page cursor");
+    }
+    if (!isCursorPayload(payload))
+        throw invalidRequest("invalid page cursor");
+    if (payload.provider !== context.provider || payload.available !== context.available) {
+        throw invalidRequest("page token filters do not match request");
+    }
+    return payload;
+}
+function signCursor(encodedPayload, workspaceId, signingKey) {
+    return createHmac("sha256", signingKey)
+        .update("oma-model-catalog-page-v1\0", "utf8")
+        .update(workspaceId, "utf8")
+        .update("\0", "utf8")
+        .update(encodedPayload, "utf8")
+        .digest();
+}
+function decodeCanonicalBase64url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        throw new Error("invalid base64url");
+    const decoded = Buffer.from(value, "base64url");
+    if (decoded.toString("base64url") !== value)
+        throw new Error("invalid base64url");
+    return decoded;
+}
+function isCursorPayload(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    const anchor = record.anchor;
+    return (record.v === 1 &&
+        (record.provider === null || typeof record.provider === "string") &&
+        typeof record.available === "boolean" &&
+        typeof anchor === "object" &&
+        anchor !== null &&
+        typeof anchor.provider === "string" &&
+        typeof anchor.id === "string");
+}

package/dist/src/control-plane/observability/instruments.js

@@ -0,0 +1,65 @@
+// The control plane's metric inventory (plan 0121 §3.2). Every label is a
+// closed enum — adding a label with tenant cardinality (workspace, session)
+// requires a plan amendment; per-tenant breakdowns are Arc D.
+import { monitorEventLoopDelay } from "node:perf_hooks";
+import { MetricsRegistry } from "./metrics.js";
+export const ROUTE_CLASSES = ["v1", "admin", "console", "health", "metrics", "other"];
+const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "other"];
+// The statuses OMA actually emits; anything novel buckets to other.
+const STATUSES = [
+    "200", "201", "204", "301", "304",
+    "400", "401", "403", "404", "405", "409", "410", "413", "415", "422", "429",
+    "500", "501", "503", "529",
+    "other",
+];
+const TURN_OUTCOMES = ["completed", "interrupted", "abandoned", "other"];
+const ADMISSION_LIMITS = ["sessions", "turns", "uploads", "streams", "other"];
+const ADMISSION_STATUSES = ["429", "529", "other"];
+const SANDBOX_EVENTS = ["created", "disposed", "reaped", "other"];
+export const SANDBOX_PROVIDERS = [
+    "docker-local", "microsandbox-local", "host-passthrough", "none", "other",
+];
+const LOG_LEVELS = ["debug", "info", "warn", "error", "audit", "other"];
+const MODEL_ADMISSION_REASONS = ["provider_disabled", "model_unavailable", "credentials_missing", "other"];
+const MODEL_PROVIDER_LABELS = ["anthropic", "openai", "google", "openrouter", "custom", "other"];
+const NAMED_MODEL_PROVIDER_LABELS = new Set(["anthropic", "openai", "google", "openrouter"]);
+const HTTP_BUCKETS = [0.005, 0.02, 0.1, 0.5, 2, 10];
+// Extends past the 15-min idle TTL so TTL-adjacent turns don't vanish into
+// +Inf (plan §9 Opus).
+const TURN_BUCKETS = [0.25, 1, 5, 15, 60, 300, 900, 1800, 3600];
+export function createControlPlaneMetrics() {
+    const registry = new MetricsRegistry();
+    return {
+        registry,
+        httpRequests: registry.counter("oma_http_requests_total", "HTTP requests handled, by route class, method, and status.", { route_class: ROUTE_CLASSES, method: METHODS, status: STATUSES }),
+        httpDuration: registry.histogram("oma_http_request_duration_seconds", "HTTP request duration in seconds.", HTTP_BUCKETS, { route_class: ROUTE_CLASSES }),
+        turnsTotal: registry.counter("oma_runtime_turns_total", "Runtime turns closed, by outcome.", { outcome: TURN_OUTCOMES }),
+        turnDuration: registry.histogram("oma_runtime_turn_duration_seconds", "Completed runtime turn duration in seconds (accept to close).", TURN_BUCKETS),
+        admissionRejections: registry.counter("oma_admission_rejections_total", "Admission-limit rejections, by limit and response status.", { limit: ADMISSION_LIMITS, status: ADMISSION_STATUSES }),
+        sandboxes: registry.counter("oma_sandboxes_total", "Sandbox lifecycle events, by event and provider.", { event: SANDBOX_EVENTS, provider: SANDBOX_PROVIDERS }),
+        sandboxProviderErrors: registry.counter("oma_sandbox_provider_errors_total", "Sandbox provider failures during session materialization.", { provider: SANDBOX_PROVIDERS }),
+        logEvents: registry.counter("oma_log_events_total", "Structured log lines emitted, by level.", { level: LOG_LEVELS }),
+        mcpToolCalls: registry.counter("oma_mcp_tool_calls_total", "MCP tool calls, by outcome (plan 0122).", { outcome: MCP_TOOL_CALL_OUTCOMES }),
+        mcpConnections: registry.counter("oma_mcp_connections_total", "MCP server connection attempts, by outcome (plan 0122).", { event: MCP_CONNECTION_EVENTS }),
+        modelAdmissionFailures: registry.counter("oma_model_admission_failures_total", "Model admission failures, by bounded reason and provider class.", { reason: MODEL_ADMISSION_REASONS, provider: MODEL_PROVIDER_LABELS }),
+    };
+}
+export function modelProviderMetricLabel(provider) {
+    if (NAMED_MODEL_PROVIDER_LABELS.has(provider))
+        return provider;
+    return provider.length > 0 ? "custom" : "other";
+}
+const MCP_TOOL_CALL_OUTCOMES = ["ok", "error", "denied", "timeout", "aborted"];
+const MCP_CONNECTION_EVENTS = ["connected", "connect_failed", "auth_failed"];
+export function registerProcessGauges(registry) {
+    const loopDelay = monitorEventLoopDelay({ resolution: 20 });
+    loopDelay.enable();
+    registry.gauge("oma_process_resident_memory_bytes", "Resident set size in bytes.", () => process.memoryUsage().rss);
+    registry.gauge("oma_process_heap_used_bytes", "V8 heap used in bytes.", () => process.memoryUsage().heapUsed);
+    registry.gauge("oma_process_event_loop_delay_seconds", "Mean event-loop delay in seconds since the last scrape.", () => {
+        const mean = loopDelay.mean / 1e9; // ns → s
+        loopDelay.reset();
+        return mean;
+    });
+    registry.gauge("oma_process_uptime_seconds", "Process uptime in seconds.", () => process.uptime());
+}

package/dist/src/control-plane/observability/metrics.js

@@ -0,0 +1,125 @@
+// Hand-rolled Prometheus registry (plan 0121 §3.2). Deliberately not
+// prom-client (dissent recorded in the plan): zero dependencies, and the
+// label-safety property that makes exposition escaping unnecessary by
+// construction — every label value is a CLOSED ENUM declared at metric
+// registration. A value outside the declared set is bucketed to "other" at
+// record time; dynamic strings can never reach the exposition. Record
+// paths never throw. If this file outgrows ~150 lines of real logic or
+// needs a fourth metric shape, switch to prom-client (plan §9).
+export const EXPOSITION_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+const OTHER = "other";
+// Validated, ordered label values → stable series key.
+function seriesKey(values) {
+    return values.join("\u0000");
+}
+function validateLabels(schema, names, labels) {
+    return names.map((name) => {
+        const value = labels?.[name];
+        return value !== undefined && schema[name].includes(value) ? value : OTHER;
+    });
+}
+function renderLabels(names, values) {
+    if (names.length === 0)
+        return "";
+    const parts = names.map((name, i) => `${name}="${values[i]}"`);
+    return `{${parts.join(",")}}`;
+}
+export class MetricsRegistry {
+    names = new Set();
+    renderers = [];
+    claim(name) {
+        if (this.names.has(name)) {
+            throw new Error(`Metric ${name} is already registered`);
+        }
+        this.names.add(name);
+    }
+    counter(name, help, schema = {}) {
+        this.claim(name);
+        const labelNames = Object.keys(schema);
+        const series = new Map();
+        this.renderers.push(() => {
+            const lines = [`# HELP ${name} ${help}`, `# TYPE ${name} counter`];
+            for (const { values, total } of series.values()) {
+                lines.push(`${name}${renderLabels(labelNames, values)} ${total}`);
+            }
+            return lines.join("\n");
+        });
+        return {
+            inc: (labels, delta = 1) => {
+                const values = validateLabels(schema, labelNames, labels);
+                const key = seriesKey(values);
+                const entry = series.get(key);
+                if (entry)
+                    entry.total += delta;
+                else
+                    series.set(key, { values, total: delta });
+            },
+        };
+    }
+    // All gauges are scrape-time collectors: counters drift across crash and
+    // recovery paths, so gauge truth lives wherever the state lives (DB,
+    // InFlightGauge, process) and is read at exposition time. A collector
+    // that throws reports NaN rather than breaking the whole scrape.
+    gauge(name, help, collect) {
+        this.claim(name);
+        this.renderers.push(() => {
+            let value;
+            try {
+                value = collect();
+            }
+            catch {
+                value = Number.NaN;
+            }
+            return [
+                `# HELP ${name} ${help}`,
+                `# TYPE ${name} gauge`,
+                `${name} ${value}`,
+            ].join("\n");
+        });
+    }
+    histogram(name, help, buckets, schema = {}) {
+        this.claim(name);
+        const labelNames = Object.keys(schema);
+        const sorted = [...buckets].sort((a, b) => a - b);
+        const series = new Map();
+        this.renderers.push(() => {
+            const lines = [`# HELP ${name} ${help}`, `# TYPE ${name} histogram`];
+            for (const s of series.values()) {
+                let cumulative = 0;
+                for (let i = 0; i < sorted.length; i++) {
+                    cumulative += s.counts[i];
+                    const values = [...s.values, String(sorted[i])];
+                    lines.push(`${name}_bucket${renderLabels([...labelNames, "le"], values)} ${cumulative}`);
+                }
+                lines.push(`${name}_bucket${renderLabels([...labelNames, "le"], [...s.values, "+Inf"])} ${s.count}`);
+                lines.push(`${name}_sum${renderLabels(labelNames, s.values)} ${s.sum}`);
+                lines.push(`${name}_count${renderLabels(labelNames, s.values)} ${s.count}`);
+            }
+            return lines.join("\n");
+        });
+        return {
+            observe: (seconds, labels) => {
+                if (!Number.isFinite(seconds))
+                    return;
+                const values = validateLabels(schema, labelNames, labels);
+                const key = seriesKey(values);
+                let s = series.get(key);
+                if (!s) {
+                    s = { values, counts: sorted.map(() => 0), sum: 0, count: 0 };
+                    series.set(key, s);
+                }
+                for (let i = 0; i < sorted.length; i++) {
+                    if (seconds <= sorted[i]) {
+                        s.counts[i] += 1;
+                        break;
+                    }
+                }
+                s.sum += seconds;
+                s.count += 1;
+            },
+        };
+    }
+    exposition() {
+        return this.renderers.map((render) => render()).join("\n") + "\n";
+    }
+}

package/dist/src/control-plane/observability/routes.js

@@ -0,0 +1,95 @@
+// /health + /metrics (plan 0121 §3.1–3.2).
+//
+// /health is deliberately unauthenticated (LB and compose probes can't send
+// keys; the body carries no tenant data). /metrics is FAIL-CLOSED: the
+// deployment assembly resolves the exposure mode from the configured bind
+// host — never from request headers or socket data — and this module only
+// ever sees the resolved decision.
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readFileSync, statfsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { EXPOSITION_CONTENT_TYPE } from "./metrics.js";
+export const METRICS_TOKEN_ENV = "OMA_METRICS_TOKEN";
+export const METRICS_TOKEN_FILE_ENV = "OMA_METRICS_TOKEN_FILE";
+export function loadMetricsToken(env) {
+    const direct = env[METRICS_TOKEN_ENV];
+    const file = env[METRICS_TOKEN_FILE_ENV];
+    if (direct !== undefined && file !== undefined) {
+        throw new Error(`set exactly one of ${METRICS_TOKEN_ENV} or ${METRICS_TOKEN_FILE_ENV}, not both`);
+    }
+    if (direct === undefined && file === undefined)
+        return undefined;
+    const value = direct === undefined ? readFileSync(file, "utf8").trim() : direct.trim();
+    if (value.length === 0) {
+        throw new Error(`${direct === undefined ? METRICS_TOKEN_FILE_ENV : METRICS_TOKEN_ENV} must not be empty`);
+    }
+    return value;
+}
+export function sha256Token(token) {
+    return createHash("sha256").update(token).digest();
+}
+// package.json is app-root-relative so the same derivation works from a
+// checkout and inside the image (same pattern as bundledConsoleRoot).
+export function packageVersion() {
+    try {
+        const raw = readFileSync(fileURLToPath(new URL("../../../package.json", import.meta.url)), "utf8");
+        return String(JSON.parse(raw).version ?? "unknown");
+    }
+    catch {
+        return "unknown";
+    }
+}
+// Reported, never gating: a disk-threshold 503 would flap the single node
+// and drive compose restart loops — alert on it instead (plan §3.1).
+export function storageFreeBytes(root) {
+    try {
+        const stat = statfsSync(root);
+        return stat.bavail * stat.bsize;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function registerObservabilityRoutes(app, config) {
+    const version = packageVersion();
+    app.get("/health", (c) => {
+        const storage = runCheck(config.health.storage);
+        const runtime = runCheck(config.health.runtime);
+        const ok = storage.status === "ok" && runtime.status === "ok";
+        c.header("cache-control", "no-store");
+        return c.json({
+            status: ok ? "ok" : "degraded",
+            version,
+            uptime_seconds: Math.round(process.uptime()),
+            checks: { storage, runtime },
+        }, ok ? 200 : 503);
+    });
+    const metrics = config.metrics;
+    if (metrics === undefined)
+        return;
+    app.get("/metrics", (c) => {
+        if (metrics.tokenSha256 !== undefined) {
+            const authorization = c.req.header("authorization");
+            const presented = authorization?.match(/^Bearer\s+(\S+)$/i)?.[1];
+            if (presented === undefined ||
+                !timingSafeEqual(sha256Token(presented), metrics.tokenSha256)) {
+                // No body detail: an unauthenticated caller learns nothing about
+                // the endpoint beyond its existence.
+                return c.body(null, 401, { "cache-control": "no-store" });
+            }
+        }
+        return c.body(metrics.registry.exposition(), 200, {
+            "content-type": EXPOSITION_CONTENT_TYPE,
+            "cache-control": "no-store",
+        });
+    });
+}
+function runCheck(check) {
+    try {
+        return check();
+    }
+    catch {
+        // Coarse on purpose: no stacks, no paths on an unauthenticated endpoint.
+        return { status: "failed" };
+    }
+}