Adopt existing Framework capabilities and upgrade to 4.4.3

[andrewzolotukhin]

Summary

Upgrade Xpenser to the latest published Cleverbrush Framework release and adopt existing Framework capabilities without changing Framework source.

Original request

Use the existing-capability improvements from proposal section 8, upgrade to the latest npm release, and adopt native multi-scheme authentication while preserving Xpenser's existing security rules.

What changed

• Pin all 15 directly used Cleverbrush packages to 4.4.3 across API, web, bot, contracts, client, and UI. All 17 resolved Cleverbrush packages are now 4.4.3; unrelated package versions are unchanged.
• Replace one favorite-currency query per budget with one ORM whereIn query over unique authorized budget IDs. Preserve normalization, sorting, empty lists, and zero queries for empty input.
• Register app-owned api-key and jwt schemes with native trySchemes. Preserve explicit API-key precedence, API keys in bearer headers, claims, revocation/last-used behavior, single-user restrictions, and the Bearer challenge. An invalid or revoked selected API key cannot fall through to a valid JWT.
• Keep MCP OAuth tokens restricted to MCP and leave its separate authentication unchanged.
• Make API/bot Docker builds tolerate fully hoisted dependencies while retaining workspace-local dependency copies.
• Add HTTP middleware regressions, currency/query-count and SQL tests, Docker packaging guards, and two preview Playwright request tests. Credential-bearing request tests disable traces.
• Update authentication reference documentation. Native trySchemes already existed in 4.4.0; the separate 4.4.3 upgrade includes published routing and prototype-pollution fixes.

Reasoning

Use existing Framework APIs rather than introducing app-specific Framework abstractions. Native scheme fallback continues after a failed scheme, so Xpenser keeps its credential-selection guard to avoid weakening authentication.

No public response-shape changes, migrations, production configuration changes, or Framework source edits. The main checkout's proposal document and unrelated files are preserved outside this PR.

The first preview build exposed a packaging assumption: npm deduplication removed the API workspace's node_modules directory. The follow-up creates the optional directory after installation in both API and bot builders. The corrected preview build/deployment passed.

Blog post

Skipped: internal dependency, performance, and authentication refactor with no new user-facing feature.

Screenshots / preview evidence

Preview · Playwright report

Screenshots are not applicable to the requested non-visual changes: query counts and credential-selection policies cannot be demonstrated by a screenshot, and the UI is unchanged. Browser QA confirmed login, Dashboard/Transactions navigation, Preferences → Manage budgets, and the existing currency display. No browser console errors. The new request tests verify the precise authentication and currency behavior and clean up their temporary resources.

Validation

Final head: ea46acf.

• npm run lint
• npm run typecheck across all workspaces
• npm test: 108 files / 595 tests passed
• npm run build: all seven workspaces, including the production web build
• Standalone TypeScript check for the new Playwright spec
• Lockfile audit: every Cleverbrush package 4.4.3, no unrelated version changes
• Required GitHub checks: Lint and test, Deploy PR environment, Playwright e2e — passing run
• Full CI Playwright suite: 26 passed
• Independent preview rerun of the two new request tests: 2 passed
• Manual preview regression QA
• SigNoz API/web traces, correlated logs, and request metrics verified during deployment/QA on 2026-09-06, approximately 15:20–15:30 UTC. No API/web 5xx responses or error/fatal logs. Request-log p95: budget lists 5–6.9 ms, auth/me 7–9 ms (small preview sample, not a production benchmark).

Caveats / explicit skips

• Five outgoing Brandfetch calls returned 400 during existing vendor E2E tests. Correlated vendor creation still returned 201, taking roughly 1.2–1.9 seconds. That integration path is unchanged here and remains a separate follow-up; telemetry is not being represented as completely error-free.
• The invalid email-confirmation test produced its expected 400 and CredentialsSignin warning.
• SigNoz's histogram query returned a backend 500. Request count/max metrics and correlated request logs provided the alternative validation; maximum request duration was about 1.95 seconds, consistent with vendor enrichment.
• Optional local API/bot Docker builds compiled but ran out of disk during image assembly. Only this task's temporary images were removed, restoring 2.5 GB. The corrected API/web images built and deployed in GitHub. Bot preview telemetry is skipped because PR environments start only API/web/Postgres.
• PR-ready notification: sent through the configured local notifier (HTTP 200).

Checklist

• Kept the change focused.
• Updated documentation and regression tests.
• Checked for secrets, local env files, and generated build output.
• API contracts, endpoint metadata, and handlers remain aligned.
• No merge or production deployment performed.