@neutrome/open-ai-router 0.1.18 → 0.3.0

package/README.md

@@ -1,6 +1,8 @@
 # `@neutrome/open-ai-router`
 
-Deployable router app and reusable router/runtime library surface built on `lil-core` + `lil-exec`.
+Deployable router app and reusable router/runtime library built on
+`@neutrome/lil-engine` for protocol conversion and `@neutrome/lilsdk-ts` for
+executor/tool contracts.
 
 ```ts
 import { createApp, createRouterRuntime, type RouterConfig } from "@neutrome/open-ai-router";
@@ -8,8 +10,9 @@ import { createApp, createRouterRuntime, type RouterConfig } from "@neutrome/ope
 
 Primary runtime model:
 
-- client JSON/SSE -> `lil-core` IR
-- target resolution -> `lil-exec`
+- client JSON/SSE -> `@neutrome/lil-engine` IR
+- target resolution -> router execution runtime
+- SDK executor or upstream provider invocation
 - provider transport -> router host
 
 Development commands:
@@ -22,4 +25,5 @@ pnpm --filter @neutrome/open-ai-router typecheck
 Notes:
 
 - `RouterConfig` is the canonical router config surface.
-- `/v1/models` lists configured executor aliases plus provider `catalog` entries.
+- `/v1/models` lists configured executor aliases.
+- Executor contracts and `connectTools` come from `@neutrome/lilsdk-ts`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neutrome/open-ai-router",
-  "version": "0.1.18",
+  "version": "0.3.0",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"
@@ -8,7 +8,8 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "hono": "^4.12.18",
-    "@neutrome/lil-engine": "0.1.5"
+    "@neutrome/lil-engine": "0.2.0",
+    "@neutrome/lilsdk-ts": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/src/admission/access.ts

@@ -0,0 +1,14 @@
+import type { AuthPrincipal } from "./types.ts";
+
+export function canAccessPrincipalModel(
+  principal: AuthPrincipal,
+  modelId: string,
+): boolean {
+  const hasModelRestriction = principal.allowedModels !== null;
+  const hasNamespaceRestriction = principal.allowedNamespaces !== null;
+  if (!hasModelRestriction && !hasNamespaceRestriction) return true;
+  if (principal.allowedModels?.includes(modelId)) return true;
+  const namespace = modelId.split("/")[0] ?? "";
+  return principal.allowedNamespaces?.includes(namespace) ?? false;
+}
+

package/src/admission/jwt.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from "vitest";
+import { createRuntimeJwtAuthenticator } from "./jwt.ts";
+
+describe("runtime JWT admission", () => {
+  it("accepts a valid ES256 runtime token", async () => {
+    const auth = await testAuth();
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(request(auth.token), env(auth.jwksJson));
+
+    expect(principal).toEqual({
+      workspaceId: "workspace_1",
+      keyId: "key_1",
+      allowedModels: ["support/router"],
+      allowedNamespaces: null,
+    });
+  });
+
+  it("rejects revoked key ids", async () => {
+    const auth = await testAuth();
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(
+      request(auth.token),
+      env(auth.jwksJson, JSON.stringify(["key_1"])),
+    );
+
+    expect(principal).toBeNull();
+  });
+
+  it("rejects wrong workspace tokens", async () => {
+    const auth = await testAuth({ workspaceId: "workspace_2" });
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(request(auth.token), env(auth.jwksJson));
+
+    expect(principal).toBeNull();
+  });
+});
+
+async function testAuth(
+  options: { workspaceId?: string } = {},
+): Promise<{ token: string; jwksJson: string }> {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign", "verify"],
+  );
+  const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  const header = { alg: "ES256", typ: "JWT", kid: "test-key" };
+  const claims = {
+    iss: "neutrome-platform",
+    aud: "workspace-runtime",
+    sub: options.workspaceId ?? "workspace_1",
+    jti: "key_1",
+    models: ["support/router"],
+    iat: Math.floor(Date.now() / 1000),
+    exp: Math.floor(Date.now() / 1000) + 3600,
+  };
+  const signingInput = `${base64UrlJson(header)}.${base64UrlJson(claims)}`;
+  const signature = new Uint8Array(await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    keyPair.privateKey,
+    new TextEncoder().encode(signingInput),
+  ));
+  return {
+    token: `${signingInput}.${base64UrlBytes(signature)}`,
+    jwksJson: JSON.stringify({ keys: [{ ...publicJwk, kid: "test-key", alg: "ES256", use: "sig" }] }),
+  };
+}
+
+function request(token: string): Request {
+  return new Request("http://runtime.test/v1/models", {
+    headers: { authorization: `Bearer ${token}` },
+  });
+}
+
+function env(jwksJson: string, revoked = "[]"): Record<string, unknown> {
+  return {
+    LIL_RUNTIME_AUTH_JWKS_JSON: jwksJson,
+    LIL_RUNTIME_AUTH_ISSUER: "neutrome-platform",
+    LIL_RUNTIME_AUTH_AUDIENCE: "workspace-runtime",
+    LIL_RUNTIME_REVOKED_KEY_IDS_JSON: revoked,
+  };
+}
+
+function base64UrlJson(value: unknown): string {
+  return base64UrlBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function base64UrlBytes(value: Uint8Array): string {
+  let binary = "";
+  for (const byte of value) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+

package/src/admission/jwt.ts

@@ -0,0 +1,221 @@
+import type { AuthPrincipal, RuntimeAuthenticator } from "./types.ts";
+
+export const DEFAULT_RUNTIME_AUTH_ISSUER = "neutrome-platform";
+export const DEFAULT_RUNTIME_AUTH_AUDIENCE = "workspace-runtime";
+
+export type RuntimeJwtAuthConfig = {
+  jwksJson?: string;
+  issuer?: string;
+  audience?: string;
+  revokedKeyIdsJson?: string;
+  workspaceId?: string;
+};
+
+type JsonWebKeySet = {
+  keys?: JsonWebKey[];
+};
+
+type JwtHeader = {
+  alg?: unknown;
+  kid?: unknown;
+};
+
+type RuntimeJwtClaims = {
+  iss?: unknown;
+  aud?: unknown;
+  sub?: unknown;
+  jti?: unknown;
+  models?: unknown;
+  namespaces?: unknown;
+  exp?: unknown;
+  nbf?: unknown;
+};
+
+type RuntimeJwtEnv = Record<string, unknown> & {
+  LIL_RUNTIME_AUTH_JWKS_JSON?: unknown;
+  LIL_RUNTIME_AUTH_ISSUER?: unknown;
+  LIL_RUNTIME_AUTH_AUDIENCE?: unknown;
+  LIL_RUNTIME_REVOKED_KEY_IDS_JSON?: unknown;
+};
+
+const encoder = new TextEncoder();
+const importedKeys = new Map<string, Promise<CryptoKey>>();
+
+export function createRuntimeJwtAuthenticator(
+  config: RuntimeJwtAuthConfig = {},
+): RuntimeAuthenticator {
+  return {
+    async authenticate(request, env) {
+      const token = readRuntimeToken(request);
+      if (!token) return null;
+      return verifyRuntimeJwt(token, readConfig(config, env));
+    },
+  };
+}
+
+export async function verifyRuntimeJwt(
+  token: string,
+  config: Required<RuntimeJwtAuthConfig>,
+): Promise<AuthPrincipal | null> {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) return null;
+
+  const header = parseJsonPart<JwtHeader>(parts[0]);
+  const claims = parseJsonPart<RuntimeJwtClaims>(parts[1]);
+  if (!header || !claims || header.alg !== "ES256" || typeof header.kid !== "string") return null;
+
+  const key = findJwk(config.jwksJson, header.kid);
+  if (!key) return null;
+
+  const signature = base64UrlToBytes(parts[2]);
+  const signingInput = `${parts[0]}.${parts[1]}`;
+  const verified = await crypto.subtle.verify(
+    { name: "ECDSA", hash: "SHA-256" },
+    await importVerifyKey(key),
+    toArrayBuffer(derToJose(signature)),
+    toArrayBuffer(encoder.encode(signingInput)),
+  ).catch(() => false);
+  if (!verified) return null;
+
+  const now = Math.floor(Date.now() / 1000);
+  if (claims.iss !== config.issuer) return null;
+  if (!audienceMatches(claims.aud, config.audience)) return null;
+  if (typeof claims.sub !== "string" || !claims.sub) return null;
+  if (typeof claims.jti !== "string" || !claims.jti) return null;
+  if (typeof claims.exp !== "number" || claims.exp <= now) return null;
+  if (typeof claims.nbf === "number" && claims.nbf > now) return null;
+  if (config.workspaceId && claims.sub !== config.workspaceId) return null;
+  if (revokedKeyIds(config.revokedKeyIdsJson).has(claims.jti)) return null;
+
+  const allowedModels = readStringArrayClaim(claims.models);
+  const allowedNamespaces = readStringArrayClaim(claims.namespaces);
+  if (allowedModels === undefined || allowedNamespaces === undefined) return null;
+
+  return {
+    workspaceId: claims.sub,
+    keyId: claims.jti,
+    allowedModels,
+    allowedNamespaces,
+  };
+}
+
+export function readRuntimeToken(request: Request): string | null {
+  const authHeader = request.headers.get("authorization");
+  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
+  if (bearerMatch?.[1]) return bearerMatch[1];
+
+  const headerToken = request.headers.get("x-api-key")
+    ?? request.headers.get("x-goog-api-key");
+  if (headerToken) return headerToken;
+
+  const url = new URL(request.url);
+  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
+}
+
+function readConfig(
+  config: RuntimeJwtAuthConfig,
+  env: Record<string, unknown>,
+): Required<RuntimeJwtAuthConfig> {
+  const runtimeEnv = env as RuntimeJwtEnv;
+  return {
+    jwksJson: config.jwksJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_JWKS_JSON) ?? "",
+    issuer: config.issuer ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_ISSUER) ?? DEFAULT_RUNTIME_AUTH_ISSUER,
+    audience: config.audience ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_AUDIENCE) ?? DEFAULT_RUNTIME_AUTH_AUDIENCE,
+    revokedKeyIdsJson: config.revokedKeyIdsJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_REVOKED_KEY_IDS_JSON) ?? "",
+    workspaceId: config.workspaceId ?? "",
+  };
+}
+
+function stringBinding(value: unknown): string | undefined {
+  return typeof value === "string" && value ? value : undefined;
+}
+
+function findJwk(jwksJson: string, kid: string): JsonWebKey | null {
+  try {
+    const parsed = JSON.parse(jwksJson) as JsonWebKeySet;
+    const key = parsed.keys?.find((item) => (item as { kid?: unknown }).kid === kid);
+    return key ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function revokedKeyIds(value: string): Set<string> {
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    return new Set(Array.isArray(parsed) ? parsed.filter((item): item is string => typeof item === "string") : []);
+  } catch {
+    return new Set();
+  }
+}
+
+function audienceMatches(value: unknown, expected: string): boolean {
+  return value === expected || (Array.isArray(value) && value.includes(expected));
+}
+
+function readStringArrayClaim(value: unknown): readonly string[] | null | undefined {
+  if (value === undefined || value === null) return null;
+  if (!Array.isArray(value)) return undefined;
+  return value.every((item) => typeof item === "string") ? value : undefined;
+}
+
+function parseJsonPart<T>(part: string): T | null {
+  try {
+    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(part))) as T;
+  } catch {
+    return null;
+  }
+}
+
+function importVerifyKey(jwk: JsonWebKey): Promise<CryptoKey> {
+  const cacheKey = JSON.stringify(jwk);
+  let imported = importedKeys.get(cacheKey);
+  if (!imported) {
+    imported = crypto.subtle.importKey(
+      "jwk",
+      jwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"],
+    );
+    importedKeys.set(cacheKey, imported);
+  }
+  return imported;
+}
+
+function base64UrlToBytes(value: string): Uint8Array {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}
+
+function derToJose(signature: Uint8Array): Uint8Array {
+  if (signature.byteLength === 64) return signature;
+  const bytes = [...signature];
+  if (bytes[0] !== 0x30) return signature;
+  let offset = 2;
+  if (bytes[1] === 0x81) offset = 3;
+  if (bytes[offset] !== 0x02) return signature;
+  const rLength = bytes[offset + 1] ?? 0;
+  const r = bytes.slice(offset + 2, offset + 2 + rLength);
+  offset += 2 + rLength;
+  if (bytes[offset] !== 0x02) return signature;
+  const sLength = bytes[offset + 1] ?? 0;
+  const s = bytes.slice(offset + 2, offset + 2 + sLength);
+  return new Uint8Array([...normalizeInteger(r), ...normalizeInteger(s)]);
+}
+
+function normalizeInteger(value: number[]): number[] {
+  const trimmed = value[0] === 0 ? value.slice(1) : value;
+  return [...new Array(Math.max(0, 32 - trimmed.length)).fill(0), ...trimmed].slice(-32);
+}

package/src/admission/types.ts

@@ -0,0 +1,14 @@
+export type AuthPrincipal = {
+  workspaceId: string;
+  keyId: string;
+  allowedModels: readonly string[] | null;
+  allowedNamespaces: readonly string[] | null;
+};
+
+export type RuntimeAuthenticator = {
+  authenticate(
+    request: Request,
+    env: Record<string, unknown>,
+  ): Promise<AuthPrincipal | null>;
+};
+

package/src/app/factory.test.ts

@@ -12,7 +12,7 @@ const config: RouterConfig = {
       exports: ["*"],
     },
   },
-  executors: {
+  modelNamespaces: {
     default: {
       exports: ["*"],
       models: {
@@ -28,13 +28,10 @@ describe("createRouterApp trace finalization", () => {
     const onTrace = vi.fn(async () => {});
     const app = createRouterApp({
       config,
-      executors: {},
+      executorImplementations: {},
       auth: {
         async authenticate() {
-          return {};
-        },
-        canAccess() {
-          return true;
+          return principal();
         },
       },
       hooks: { onTrace },
@@ -79,13 +76,10 @@ describe("createRouterApp trace finalization", () => {
     const onTrace = vi.fn(async () => {});
     const app = createRouterApp({
       config,
-      executors: {},
+      executorImplementations: {},
       auth: {
         async authenticate() {
-          return {};
-        },
-        canAccess() {
-          return true;
+          return principal();
         },
       },
       hooks: { onTrace },
@@ -154,3 +148,12 @@ function createExecutionContext(waited: Promise<unknown>[]) {
     passThroughOnException() {},
   };
 }
+
+function principal() {
+  return {
+    workspaceId: "workspace_1",
+    keyId: "key_1",
+    allowedModels: null,
+    allowedNamespaces: null,
+  };
+}

package/src/app/factory.ts

@@ -1,35 +1,40 @@
 import { Hono, type Context } from "hono";
-import type { Executor, ProgramTransform } from "@neutrome/lil-engine";
-import type { ExecutionRuntimeOptions } from "@neutrome/lil-engine";
+import type { Executor, ProgramTransform } from "@neutrome/lilsdk-ts";
+import { getModel, setStreaming, type Program, type ProviderStyle } from "@neutrome/lil-engine";
 import { cors } from "./cors.ts";
 import { healthHandler } from "./health.ts";
 import { createTraceCollector, type ExecutionTrace } from "../observer.ts";
+import { canAccessPrincipalModel } from "../admission/access.ts";
 import {
   createRouterRuntime,
   handleAnthropicMessages,
   handleChatCompletions,
   handleGoogleGenAI,
+  parseRequestProgram,
   handleResponses,
   listConfiguredModels,
-  type RouterRuntime,
 } from "../router/index.ts";
-import type { RequestContext } from "../auth/types.ts";
+import type { AuthPrincipal, RuntimeAuthenticator } from "../admission/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import type { RouterConfig } from "../router/config.ts";
 import type { RemoteMcpClientFactory } from "../router/mcp.ts";
+import type { ExecutionRuntimeOptions } from "../router/execution-types.ts";
 
-export type RouterAppAuth = {
-  authenticate(request: Request, env: Record<string, unknown>): Promise<object | null>;
-  canAccess(principal: object, modelId: string): boolean;
-};
+export type RouterAppAuth = RuntimeAuthenticator;
 
 export type RouterAppHooks = {
-  beforeRequest?(ctx: { request: Request; model: string | null; env: Record<string, unknown> }): Promise<Response | void>;
+  beforeRequest?(ctx: {
+    request: Request;
+    model: string | null;
+    principal: AuthPrincipal;
+    env: Record<string, unknown>;
+  }): Promise<Response | void>;
   onTrace?(trace: ExecutionTrace, env: Record<string, unknown>): void | Promise<void>;
 };
 
 export type RouterAppOptions = {
   config: RouterConfig;
-  executors: Readonly<Record<string, Executor>>;
+  executorImplementations: Readonly<Record<string, Executor>>;
   transforms?: Readonly<Record<string, ProgramTransform>>;
   auth: RouterAppAuth;
   hooks?: RouterAppHooks;
@@ -60,7 +65,7 @@ export function createRouterApp(options: RouterAppOptions) {
     if (!principal) return unauthorized();
 
     const models = listConfiguredModels(runtime)
-      .filter((id) => options.auth.canAccess(principal, id))
+      .filter((id) => canAccessPrincipalModel(principal, id))
       .map((id) => ({
         id,
         object: "model" as const,
@@ -70,15 +75,15 @@ export function createRouterApp(options: RouterAppOptions) {
     return c.json({ object: "list", data: models });
   });
 
-  app.post("/v1/chat/completions", (c) => runAuthorized(c, c.req.raw, handleChatCompletions));
-  app.post("/v1/responses", (c) => runAuthorized(c, c.req.raw, handleResponses));
-  app.post("/v1/messages", (c) => runAuthorized(c, c.req.raw, handleAnthropicMessages));
+  app.post("/v1/chat/completions", (c) => runAuthorized(c, c.req.raw, "chat-completions", handleChatCompletions));
+  app.post("/v1/responses", (c) => runAuthorized(c, c.req.raw, "responses", handleResponses));
+  app.post("/v1/messages", (c) => runAuthorized(c, c.req.raw, "anthropic-messages", handleAnthropicMessages));
 
   app.post("/v1/models/*", async (c) => {
     const route = parseGoogleGenAIRoute(c.req.raw);
     if (!route) return c.text("Not Found", 404);
     const request = await rewriteGoogleGenAIRequest(c.req.raw, route);
-    return runAuthorized(c, request, handleGoogleGenAI, route.stream);
+    return runAuthorized(c, request, "google-genai", handleGoogleGenAI, route.stream);
   });
 
   app.all("*", (c) => c.text("Not Found", 404));
@@ -86,6 +91,7 @@ export function createRouterApp(options: RouterAppOptions) {
   async function runAuthorized(
     c: Context,
     request: Request,
+    style: ProviderStyle,
     handler: (opts: any) => Promise<Response>,
     forceStreaming?: boolean,
   ): Promise<Response> {
@@ -93,13 +99,21 @@ export function createRouterApp(options: RouterAppOptions) {
     const principal = await options.auth.authenticate(request, env);
     if (!principal) return unauthorized();
 
-    const model = await readModel(request.clone());
-    if (model && !options.auth.canAccess(principal, model)) {
+    let program: Program;
+    try {
+      program = await parseRequestProgram(style, request.clone());
+      if (forceStreaming) program = setStreaming(program, true);
+    } catch {
+      return errorResponse("Invalid request body", 400, "invalid_request_body");
+    }
+
+    const model = getModel(program) || null;
+    if (model && !canAccessPrincipalModel(principal, model)) {
       return errorResponse(`Model \`${model}\` does not exist or you do not have access.`, 404, "model_not_found");
     }
 
     if (options.hooks?.beforeRequest) {
-      const hookResponse = await options.hooks.beforeRequest({ request, model, env });
+      const hookResponse = await options.hooks.beforeRequest({ request, model, principal, env });
       if (hookResponse) return hookResponse;
     }
 
@@ -109,7 +123,7 @@ export function createRouterApp(options: RouterAppOptions) {
       env,
       state: new Map(),
     };
-    for (const driver of runtime.authChain) {
+    for (const driver of runtime.upstreamAuthChain) {
       driver.collectIncoming?.(ctx);
     }
 
@@ -135,12 +149,12 @@ export function createRouterApp(options: RouterAppOptions) {
       const response = await handler({
         runtime,
         ctx,
-        executors: options.executors,
+        program,
+        executorImplementations: options.executorImplementations,
         ...(options.transforms ? { transforms: options.transforms } : {}),
         observe,
         ...(options.upstreamTimeoutMs !== undefined ? { upstreamTimeoutMs: options.upstreamTimeoutMs } : {}),
         ...(options.remoteMcpClientFactory ? { remoteMcpClientFactory: options.remoteMcpClientFactory } : {}),
-        ...(forceStreaming ? { forceStreaming: true } : {}),
       });
       if (!isEventStreamResponse(response) || !response.body) {
         finalizeTrace();
@@ -190,15 +204,6 @@ async function rewriteGoogleGenAIRequest(
   return new Request(request.url, { method: request.method, headers, body: bodyText });
 }
 
-async function readModel(request: Request): Promise<string | null> {
-  try {
-    const body = (await request.json()) as { model?: unknown };
-    return typeof body.model === "string" ? body.model : null;
-  } catch {
-    return null;
-  }
-}
-
 function unauthorized(): Response {
   return errorResponse("Authentication required", 401, "auth_required");
 }
@@ -221,7 +226,12 @@ function runBackgroundTask(c: Context, task: () => unknown, label: string): void
     .catch((error) => {
       console.error(`[open-ai-router] ${label} failed:`, error);
     });
-  const executionCtx = c.executionCtx as { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  let executionCtx: { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  try {
+    executionCtx = c.executionCtx as { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  } catch {
+    executionCtx = undefined;
+  }
   if (executionCtx?.waitUntil) {
     executionCtx.waitUntil(tracked);
     return;

package/src/app/handlers.ts

@@ -1,6 +1,5 @@
 import type { Context } from "hono";
-import type { Executor, ProgramTransform } from "@neutrome/lil-engine";
-import type { RequestContext } from "../auth/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import {
   handleAnthropicMessages,
   handleChatCompletions,
@@ -18,10 +17,7 @@ type OpenAiModel = {
   owned_by: string;
 };
 
-export type ChatCompletionsHandlerOptions = RouterExecutionOptions & {
-  executors?: Readonly<Record<string, Executor>>;
-  transforms?: Readonly<Record<string, ProgramTransform>>;
-};
+export type ChatCompletionsHandlerOptions = RouterExecutionOptions;
 
 export type ResponsesHandlerOptions = ChatCompletionsHandlerOptions;
 export type AnthropicMessagesHandlerOptions = ChatCompletionsHandlerOptions;
@@ -111,8 +107,8 @@ function createExecutionHandlerOptions(
     ctx,
   } as Parameters<typeof handleChatCompletions>[0];
 
-  if (options.executors) {
-    handlerOptions.executors = options.executors;
+  if (options.executorImplementations) {
+    handlerOptions.executorImplementations = options.executorImplementations;
   }
   if (options.resolveExecutor) {
     handlerOptions.resolveExecutor = options.resolveExecutor;
@@ -149,7 +145,7 @@ function createRequestContext(c: Context, request = c.req.raw): RequestContext {
 }
 
 function collectIncomingAuth(ctx: RequestContext, runtime: RouterRuntime): void {
-  for (const driver of runtime.authChain) {
+  for (const driver of runtime.upstreamAuthChain) {
     driver.collectIncoming?.(ctx);
   }
 }