@neutrome/open-ai-router 0.2.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neutrome/open-ai-router",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"
@@ -9,7 +9,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "hono": "^4.12.18",
     "@neutrome/lil-engine": "0.2.0",
-    "@neutrome/lilsdk-ts": "0.2.0"
+    "@neutrome/lilsdk-ts": "0.2.1"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",

package/src/admission/access.ts

@@ -0,0 +1,14 @@
+import type { AuthPrincipal } from "./types.ts";
+
+export function canAccessPrincipalModel(
+  principal: AuthPrincipal,
+  modelId: string,
+): boolean {
+  const hasModelRestriction = principal.allowedModels !== null;
+  const hasNamespaceRestriction = principal.allowedNamespaces !== null;
+  if (!hasModelRestriction && !hasNamespaceRestriction) return true;
+  if (principal.allowedModels?.includes(modelId)) return true;
+  const namespace = modelId.split("/")[0] ?? "";
+  return principal.allowedNamespaces?.includes(namespace) ?? false;
+}
+

package/src/admission/jwt.test.ts

@@ -0,0 +1,96 @@
+import { describe, expect, it } from "vitest";
+import { createRuntimeJwtAuthenticator } from "./jwt.ts";
+
+describe("runtime JWT admission", () => {
+  it("accepts a valid ES256 runtime token", async () => {
+    const auth = await testAuth();
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(request(auth.token), env(auth.jwksJson));
+
+    expect(principal).toEqual({
+      workspaceId: "workspace_1",
+      keyId: "key_1",
+      allowedModels: ["support/router"],
+      allowedNamespaces: null,
+    });
+  });
+
+  it("rejects revoked key ids", async () => {
+    const auth = await testAuth();
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(
+      request(auth.token),
+      env(auth.jwksJson, JSON.stringify(["key_1"])),
+    );
+
+    expect(principal).toBeNull();
+  });
+
+  it("rejects wrong workspace tokens", async () => {
+    const auth = await testAuth({ workspaceId: "workspace_2" });
+    const principal = await createRuntimeJwtAuthenticator({
+      workspaceId: "workspace_1",
+    }).authenticate(request(auth.token), env(auth.jwksJson));
+
+    expect(principal).toBeNull();
+  });
+});
+
+async function testAuth(
+  options: { workspaceId?: string } = {},
+): Promise<{ token: string; jwksJson: string }> {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: "ECDSA", namedCurve: "P-256" },
+    true,
+    ["sign", "verify"],
+  );
+  const publicJwk = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
+  const header = { alg: "ES256", typ: "JWT", kid: "test-key" };
+  const claims = {
+    iss: "neutrome-platform",
+    aud: "workspace-runtime",
+    sub: options.workspaceId ?? "workspace_1",
+    jti: "key_1",
+    models: ["support/router"],
+    iat: Math.floor(Date.now() / 1000),
+    exp: Math.floor(Date.now() / 1000) + 3600,
+  };
+  const signingInput = `${base64UrlJson(header)}.${base64UrlJson(claims)}`;
+  const signature = new Uint8Array(await crypto.subtle.sign(
+    { name: "ECDSA", hash: "SHA-256" },
+    keyPair.privateKey,
+    new TextEncoder().encode(signingInput),
+  ));
+  return {
+    token: `${signingInput}.${base64UrlBytes(signature)}`,
+    jwksJson: JSON.stringify({ keys: [{ ...publicJwk, kid: "test-key", alg: "ES256", use: "sig" }] }),
+  };
+}
+
+function request(token: string): Request {
+  return new Request("http://runtime.test/v1/models", {
+    headers: { authorization: `Bearer ${token}` },
+  });
+}
+
+function env(jwksJson: string, revoked = "[]"): Record<string, unknown> {
+  return {
+    LIL_RUNTIME_AUTH_JWKS_JSON: jwksJson,
+    LIL_RUNTIME_AUTH_ISSUER: "neutrome-platform",
+    LIL_RUNTIME_AUTH_AUDIENCE: "workspace-runtime",
+    LIL_RUNTIME_REVOKED_KEY_IDS_JSON: revoked,
+  };
+}
+
+function base64UrlJson(value: unknown): string {
+  return base64UrlBytes(new TextEncoder().encode(JSON.stringify(value)));
+}
+
+function base64UrlBytes(value: Uint8Array): string {
+  let binary = "";
+  for (const byte of value) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+

package/src/admission/jwt.ts

@@ -0,0 +1,221 @@
+import type { AuthPrincipal, RuntimeAuthenticator } from "./types.ts";
+
+export const DEFAULT_RUNTIME_AUTH_ISSUER = "neutrome-platform";
+export const DEFAULT_RUNTIME_AUTH_AUDIENCE = "workspace-runtime";
+
+export type RuntimeJwtAuthConfig = {
+  jwksJson?: string;
+  issuer?: string;
+  audience?: string;
+  revokedKeyIdsJson?: string;
+  workspaceId?: string;
+};
+
+type JsonWebKeySet = {
+  keys?: JsonWebKey[];
+};
+
+type JwtHeader = {
+  alg?: unknown;
+  kid?: unknown;
+};
+
+type RuntimeJwtClaims = {
+  iss?: unknown;
+  aud?: unknown;
+  sub?: unknown;
+  jti?: unknown;
+  models?: unknown;
+  namespaces?: unknown;
+  exp?: unknown;
+  nbf?: unknown;
+};
+
+type RuntimeJwtEnv = Record<string, unknown> & {
+  LIL_RUNTIME_AUTH_JWKS_JSON?: unknown;
+  LIL_RUNTIME_AUTH_ISSUER?: unknown;
+  LIL_RUNTIME_AUTH_AUDIENCE?: unknown;
+  LIL_RUNTIME_REVOKED_KEY_IDS_JSON?: unknown;
+};
+
+const encoder = new TextEncoder();
+const importedKeys = new Map<string, Promise<CryptoKey>>();
+
+export function createRuntimeJwtAuthenticator(
+  config: RuntimeJwtAuthConfig = {},
+): RuntimeAuthenticator {
+  return {
+    async authenticate(request, env) {
+      const token = readRuntimeToken(request);
+      if (!token) return null;
+      return verifyRuntimeJwt(token, readConfig(config, env));
+    },
+  };
+}
+
+export async function verifyRuntimeJwt(
+  token: string,
+  config: Required<RuntimeJwtAuthConfig>,
+): Promise<AuthPrincipal | null> {
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2]) return null;
+
+  const header = parseJsonPart<JwtHeader>(parts[0]);
+  const claims = parseJsonPart<RuntimeJwtClaims>(parts[1]);
+  if (!header || !claims || header.alg !== "ES256" || typeof header.kid !== "string") return null;
+
+  const key = findJwk(config.jwksJson, header.kid);
+  if (!key) return null;
+
+  const signature = base64UrlToBytes(parts[2]);
+  const signingInput = `${parts[0]}.${parts[1]}`;
+  const verified = await crypto.subtle.verify(
+    { name: "ECDSA", hash: "SHA-256" },
+    await importVerifyKey(key),
+    toArrayBuffer(derToJose(signature)),
+    toArrayBuffer(encoder.encode(signingInput)),
+  ).catch(() => false);
+  if (!verified) return null;
+
+  const now = Math.floor(Date.now() / 1000);
+  if (claims.iss !== config.issuer) return null;
+  if (!audienceMatches(claims.aud, config.audience)) return null;
+  if (typeof claims.sub !== "string" || !claims.sub) return null;
+  if (typeof claims.jti !== "string" || !claims.jti) return null;
+  if (typeof claims.exp !== "number" || claims.exp <= now) return null;
+  if (typeof claims.nbf === "number" && claims.nbf > now) return null;
+  if (config.workspaceId && claims.sub !== config.workspaceId) return null;
+  if (revokedKeyIds(config.revokedKeyIdsJson).has(claims.jti)) return null;
+
+  const allowedModels = readStringArrayClaim(claims.models);
+  const allowedNamespaces = readStringArrayClaim(claims.namespaces);
+  if (allowedModels === undefined || allowedNamespaces === undefined) return null;
+
+  return {
+    workspaceId: claims.sub,
+    keyId: claims.jti,
+    allowedModels,
+    allowedNamespaces,
+  };
+}
+
+export function readRuntimeToken(request: Request): string | null {
+  const authHeader = request.headers.get("authorization");
+  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
+  if (bearerMatch?.[1]) return bearerMatch[1];
+
+  const headerToken = request.headers.get("x-api-key")
+    ?? request.headers.get("x-goog-api-key");
+  if (headerToken) return headerToken;
+
+  const url = new URL(request.url);
+  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
+}
+
+function readConfig(
+  config: RuntimeJwtAuthConfig,
+  env: Record<string, unknown>,
+): Required<RuntimeJwtAuthConfig> {
+  const runtimeEnv = env as RuntimeJwtEnv;
+  return {
+    jwksJson: config.jwksJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_JWKS_JSON) ?? "",
+    issuer: config.issuer ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_ISSUER) ?? DEFAULT_RUNTIME_AUTH_ISSUER,
+    audience: config.audience ?? stringBinding(runtimeEnv.LIL_RUNTIME_AUTH_AUDIENCE) ?? DEFAULT_RUNTIME_AUTH_AUDIENCE,
+    revokedKeyIdsJson: config.revokedKeyIdsJson ?? stringBinding(runtimeEnv.LIL_RUNTIME_REVOKED_KEY_IDS_JSON) ?? "",
+    workspaceId: config.workspaceId ?? "",
+  };
+}
+
+function stringBinding(value: unknown): string | undefined {
+  return typeof value === "string" && value ? value : undefined;
+}
+
+function findJwk(jwksJson: string, kid: string): JsonWebKey | null {
+  try {
+    const parsed = JSON.parse(jwksJson) as JsonWebKeySet;
+    const key = parsed.keys?.find((item) => (item as { kid?: unknown }).kid === kid);
+    return key ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function revokedKeyIds(value: string): Set<string> {
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    return new Set(Array.isArray(parsed) ? parsed.filter((item): item is string => typeof item === "string") : []);
+  } catch {
+    return new Set();
+  }
+}
+
+function audienceMatches(value: unknown, expected: string): boolean {
+  return value === expected || (Array.isArray(value) && value.includes(expected));
+}
+
+function readStringArrayClaim(value: unknown): readonly string[] | null | undefined {
+  if (value === undefined || value === null) return null;
+  if (!Array.isArray(value)) return undefined;
+  return value.every((item) => typeof item === "string") ? value : undefined;
+}
+
+function parseJsonPart<T>(part: string): T | null {
+  try {
+    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(part))) as T;
+  } catch {
+    return null;
+  }
+}
+
+function importVerifyKey(jwk: JsonWebKey): Promise<CryptoKey> {
+  const cacheKey = JSON.stringify(jwk);
+  let imported = importedKeys.get(cacheKey);
+  if (!imported) {
+    imported = crypto.subtle.importKey(
+      "jwk",
+      jwk,
+      { name: "ECDSA", namedCurve: "P-256" },
+      false,
+      ["verify"],
+    );
+    importedKeys.set(cacheKey, imported);
+  }
+  return imported;
+}
+
+function base64UrlToBytes(value: string): Uint8Array {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "=");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i += 1) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+
+function toArrayBuffer(bytes: Uint8Array): ArrayBuffer {
+  return bytes.buffer.slice(
+    bytes.byteOffset,
+    bytes.byteOffset + bytes.byteLength,
+  ) as ArrayBuffer;
+}
+
+function derToJose(signature: Uint8Array): Uint8Array {
+  if (signature.byteLength === 64) return signature;
+  const bytes = [...signature];
+  if (bytes[0] !== 0x30) return signature;
+  let offset = 2;
+  if (bytes[1] === 0x81) offset = 3;
+  if (bytes[offset] !== 0x02) return signature;
+  const rLength = bytes[offset + 1] ?? 0;
+  const r = bytes.slice(offset + 2, offset + 2 + rLength);
+  offset += 2 + rLength;
+  if (bytes[offset] !== 0x02) return signature;
+  const sLength = bytes[offset + 1] ?? 0;
+  const s = bytes.slice(offset + 2, offset + 2 + sLength);
+  return new Uint8Array([...normalizeInteger(r), ...normalizeInteger(s)]);
+}
+
+function normalizeInteger(value: number[]): number[] {
+  const trimmed = value[0] === 0 ? value.slice(1) : value;
+  return [...new Array(Math.max(0, 32 - trimmed.length)).fill(0), ...trimmed].slice(-32);
+}

package/src/admission/types.ts

@@ -0,0 +1,14 @@
+export type AuthPrincipal = {
+  workspaceId: string;
+  keyId: string;
+  allowedModels: readonly string[] | null;
+  allowedNamespaces: readonly string[] | null;
+};
+
+export type RuntimeAuthenticator = {
+  authenticate(
+    request: Request,
+    env: Record<string, unknown>,
+  ): Promise<AuthPrincipal | null>;
+};
+

package/src/app/factory.test.ts

@@ -31,10 +31,7 @@ describe("createRouterApp trace finalization", () => {
       executorImplementations: {},
       auth: {
         async authenticate() {
-          return {};
-        },
-        canAccess() {
-          return true;
+          return principal();
         },
       },
       hooks: { onTrace },
@@ -82,10 +79,7 @@ describe("createRouterApp trace finalization", () => {
       executorImplementations: {},
       auth: {
         async authenticate() {
-          return {};
-        },
-        canAccess() {
-          return true;
+          return principal();
         },
       },
       hooks: { onTrace },
@@ -154,3 +148,12 @@ function createExecutionContext(waited: Promise<unknown>[]) {
     passThroughOnException() {},
   };
 }
+
+function principal() {
+  return {
+    workspaceId: "workspace_1",
+    keyId: "key_1",
+    allowedModels: null,
+    allowedNamespaces: null,
+  };
+}

package/src/app/factory.ts

@@ -1,29 +1,34 @@
 import { Hono, type Context } from "hono";
 import type { Executor, ProgramTransform } from "@neutrome/lilsdk-ts";
+import { getModel, setStreaming, type Program, type ProviderStyle } from "@neutrome/lil-engine";
 import { cors } from "./cors.ts";
 import { healthHandler } from "./health.ts";
 import { createTraceCollector, type ExecutionTrace } from "../observer.ts";
+import { canAccessPrincipalModel } from "../admission/access.ts";
 import {
   createRouterRuntime,
   handleAnthropicMessages,
   handleChatCompletions,
   handleGoogleGenAI,
+  parseRequestProgram,
   handleResponses,
   listConfiguredModels,
-  type RouterRuntime,
 } from "../router/index.ts";
-import type { RequestContext } from "../auth/types.ts";
+import type { AuthPrincipal, RuntimeAuthenticator } from "../admission/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import type { RouterConfig } from "../router/config.ts";
 import type { RemoteMcpClientFactory } from "../router/mcp.ts";
 import type { ExecutionRuntimeOptions } from "../router/execution-types.ts";
 
-export type RouterAppAuth = {
-  authenticate(request: Request, env: Record<string, unknown>): Promise<object | null>;
-  canAccess(principal: object, modelId: string): boolean;
-};
+export type RouterAppAuth = RuntimeAuthenticator;
 
 export type RouterAppHooks = {
-  beforeRequest?(ctx: { request: Request; model: string | null; env: Record<string, unknown> }): Promise<Response | void>;
+  beforeRequest?(ctx: {
+    request: Request;
+    model: string | null;
+    principal: AuthPrincipal;
+    env: Record<string, unknown>;
+  }): Promise<Response | void>;
   onTrace?(trace: ExecutionTrace, env: Record<string, unknown>): void | Promise<void>;
 };
 
@@ -60,7 +65,7 @@ export function createRouterApp(options: RouterAppOptions) {
     if (!principal) return unauthorized();
 
     const models = listConfiguredModels(runtime)
-      .filter((id) => options.auth.canAccess(principal, id))
+      .filter((id) => canAccessPrincipalModel(principal, id))
       .map((id) => ({
         id,
         object: "model" as const,
@@ -70,15 +75,15 @@ export function createRouterApp(options: RouterAppOptions) {
     return c.json({ object: "list", data: models });
   });
 
-  app.post("/v1/chat/completions", (c) => runAuthorized(c, c.req.raw, handleChatCompletions));
-  app.post("/v1/responses", (c) => runAuthorized(c, c.req.raw, handleResponses));
-  app.post("/v1/messages", (c) => runAuthorized(c, c.req.raw, handleAnthropicMessages));
+  app.post("/v1/chat/completions", (c) => runAuthorized(c, c.req.raw, "chat-completions", handleChatCompletions));
+  app.post("/v1/responses", (c) => runAuthorized(c, c.req.raw, "responses", handleResponses));
+  app.post("/v1/messages", (c) => runAuthorized(c, c.req.raw, "anthropic-messages", handleAnthropicMessages));
 
   app.post("/v1/models/*", async (c) => {
     const route = parseGoogleGenAIRoute(c.req.raw);
     if (!route) return c.text("Not Found", 404);
     const request = await rewriteGoogleGenAIRequest(c.req.raw, route);
-    return runAuthorized(c, request, handleGoogleGenAI, route.stream);
+    return runAuthorized(c, request, "google-genai", handleGoogleGenAI, route.stream);
   });
 
   app.all("*", (c) => c.text("Not Found", 404));
@@ -86,6 +91,7 @@ export function createRouterApp(options: RouterAppOptions) {
   async function runAuthorized(
     c: Context,
     request: Request,
+    style: ProviderStyle,
     handler: (opts: any) => Promise<Response>,
     forceStreaming?: boolean,
   ): Promise<Response> {
@@ -93,13 +99,21 @@ export function createRouterApp(options: RouterAppOptions) {
     const principal = await options.auth.authenticate(request, env);
     if (!principal) return unauthorized();
 
-    const model = await readModel(request.clone());
-    if (model && !options.auth.canAccess(principal, model)) {
+    let program: Program;
+    try {
+      program = await parseRequestProgram(style, request.clone());
+      if (forceStreaming) program = setStreaming(program, true);
+    } catch {
+      return errorResponse("Invalid request body", 400, "invalid_request_body");
+    }
+
+    const model = getModel(program) || null;
+    if (model && !canAccessPrincipalModel(principal, model)) {
       return errorResponse(`Model \`${model}\` does not exist or you do not have access.`, 404, "model_not_found");
     }
 
     if (options.hooks?.beforeRequest) {
-      const hookResponse = await options.hooks.beforeRequest({ request, model, env });
+      const hookResponse = await options.hooks.beforeRequest({ request, model, principal, env });
       if (hookResponse) return hookResponse;
     }
 
@@ -109,7 +123,7 @@ export function createRouterApp(options: RouterAppOptions) {
       env,
       state: new Map(),
     };
-    for (const driver of runtime.authChain) {
+    for (const driver of runtime.upstreamAuthChain) {
       driver.collectIncoming?.(ctx);
     }
 
@@ -135,12 +149,12 @@ export function createRouterApp(options: RouterAppOptions) {
       const response = await handler({
         runtime,
         ctx,
+        program,
         executorImplementations: options.executorImplementations,
         ...(options.transforms ? { transforms: options.transforms } : {}),
         observe,
         ...(options.upstreamTimeoutMs !== undefined ? { upstreamTimeoutMs: options.upstreamTimeoutMs } : {}),
         ...(options.remoteMcpClientFactory ? { remoteMcpClientFactory: options.remoteMcpClientFactory } : {}),
-        ...(forceStreaming ? { forceStreaming: true } : {}),
       });
       if (!isEventStreamResponse(response) || !response.body) {
         finalizeTrace();
@@ -190,15 +204,6 @@ async function rewriteGoogleGenAIRequest(
   return new Request(request.url, { method: request.method, headers, body: bodyText });
 }
 
-async function readModel(request: Request): Promise<string | null> {
-  try {
-    const body = (await request.json()) as { model?: unknown };
-    return typeof body.model === "string" ? body.model : null;
-  } catch {
-    return null;
-  }
-}
-
 function unauthorized(): Response {
   return errorResponse("Authentication required", 401, "auth_required");
 }
@@ -221,7 +226,12 @@ function runBackgroundTask(c: Context, task: () => unknown, label: string): void
     .catch((error) => {
       console.error(`[open-ai-router] ${label} failed:`, error);
     });
-  const executionCtx = c.executionCtx as { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  let executionCtx: { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  try {
+    executionCtx = c.executionCtx as { waitUntil?(promise: Promise<unknown>): void } | undefined;
+  } catch {
+    executionCtx = undefined;
+  }
   if (executionCtx?.waitUntil) {
     executionCtx.waitUntil(tracked);
     return;

package/src/app/handlers.ts

@@ -1,5 +1,5 @@
 import type { Context } from "hono";
-import type { RequestContext } from "../auth/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import {
   handleAnthropicMessages,
   handleChatCompletions,
@@ -145,7 +145,7 @@ function createRequestContext(c: Context, request = c.req.raw): RequestContext {
 }
 
 function collectIncomingAuth(ctx: RequestContext, runtime: RouterRuntime): void {
-  for (const driver of runtime.authChain) {
+  for (const driver of runtime.upstreamAuthChain) {
     driver.collectIncoming?.(ctx);
   }
 }

package/src/example.test.ts

@@ -46,7 +46,7 @@ describe("open-ai-router createApp", () => {
 
     const app = createApp({
       config: {
-        auth: {
+        upstreamAuth: {
           order: ["proxy"],
           proxy: {
             headers: ["authorization"],

package/src/example.ts

@@ -24,6 +24,9 @@ export function createApp(options: CreateAppOptions) {
   if (options.knownSuffixes) {
     routerOptions.knownSuffixes = options.knownSuffixes;
   }
+  if (options.upstreamAuthDrivers) {
+    routerOptions.upstreamAuthDrivers = options.upstreamAuthDrivers;
+  }
 
   const runtime = createRouterRuntime(routerOptions);
   const app = new Hono();

package/src/index.ts

@@ -38,7 +38,6 @@ export {
 export type {
   AuditEvent,
   AuditEventInput,
-  AuthConfig,
   CreateRouterOptions,
   ExecutionErrorDetails,
   ExecutionErrorKind,
@@ -71,6 +70,7 @@ export type {
   RouterConfig,
   RouterExecutionOptions,
   RouterRuntime,
+  UpstreamAuthConfig,
 } from "./router/index.ts";
 export type {
   RemoteMcpClientFactory,
@@ -85,16 +85,27 @@ export {
 } from "./router/index.ts";
 
 export type {
-  AuthDriver,
   AuthResult,
   RequestContext,
   TargetAuthContext,
-} from "./auth/types.ts";
-export { buildAuthChain } from "./auth/registry.ts";
-export { envAuthDriver } from "./auth/env.ts";
-export { proxyAuthDriver } from "./auth/proxy.ts";
-export { createApiKeyAuth } from "./auth/apikey.ts";
-export type { ApiKeyAuth, ApiKeyEntry } from "./auth/apikey.ts";
+  UpstreamAuthDriver,
+} from "./upstream-auth/types.ts";
+export { buildUpstreamAuthChain } from "./upstream-auth/registry.ts";
+export { envAuthDriver } from "./upstream-auth/env.ts";
+export { proxyAuthDriver } from "./upstream-auth/proxy.ts";
+export {
+  createRuntimeJwtAuthenticator,
+  DEFAULT_RUNTIME_AUTH_AUDIENCE,
+  DEFAULT_RUNTIME_AUTH_ISSUER,
+  readRuntimeToken,
+  verifyRuntimeJwt,
+} from "./admission/jwt.ts";
+export { canAccessPrincipalModel } from "./admission/access.ts";
+export type {
+  AuthPrincipal,
+  RuntimeAuthenticator,
+} from "./admission/types.ts";
+export type { RuntimeJwtAuthConfig } from "./admission/jwt.ts";
 
 export { cors } from "./app/cors.ts";
 export { healthHandler } from "./app/health.ts";

package/src/model.example.ts

@@ -1,8 +1,8 @@
 import {
   createTwoPassExecutor,
   INTERNAL_DRAFT_TOOL_NAME,
-  type Executor,
-} from "@neutrome/lilsdk-ts";
+} from "@neutrome/lilsdk-ts/managed";
+import type { Executor } from "@neutrome/lilsdk-ts";
 
 const LOCALIZED_MODEL = "default/openai/gpt-oss-20b";
 const REASONING_MODEL = "default/openai/gpt-oss-120b";

package/src/router/config.ts

@@ -1,9 +1,9 @@
 import type { ProviderStyle } from "@neutrome/lil-engine";
-import type { AuthConfigShape } from "../auth/config.ts";
+import type { UpstreamAuthConfigShape } from "../upstream-auth/config.ts";
 
 export type ProviderApiStyle = ProviderStyle;
 
-export type AuthConfig = AuthConfigShape;
+export type UpstreamAuthConfig = UpstreamAuthConfigShape;
 
 export type ProviderTargetConfig = {
   api_base_url: string;
@@ -46,7 +46,7 @@ export type RemoteMcpServerConfig = {
 
 export type RouterConfig = {
   trace?: boolean;
-  auth?: AuthConfig;
+  upstreamAuth?: UpstreamAuthConfig;
   providers: Record<string, ProviderTargetConfig>;
   modelNamespaces: Record<string, ModelNamespaceConfig>;
   mcps?: Record<string, RemoteMcpServerConfig>;

package/src/router/execute.test.ts

@@ -1,6 +1,6 @@
 import { appendAssistantMessage } from "@neutrome/lilsdk-ts/synthetic";
 import { describe, expect, it, vi } from "vitest";
-import type { RequestContext } from "../auth/types.ts";
+import type { RequestContext } from "../upstream-auth/types.ts";
 import { handleChatCompletions } from "./execute.ts";
 import type { RemoteMcpClientFactory } from "./mcp.ts";
 import { createRouterRuntime } from "./runtime.ts";

package/src/router/execute.ts

@@ -30,7 +30,7 @@ import type {
   ProviderInvoker,
 } from "./execution-types.ts";
 import { createAuditEvent } from "./audit.ts";
-import type { RequestContext, TargetAuthContext } from "../auth/types.ts";
+import type { RequestContext, TargetAuthContext } from "../upstream-auth/types.ts";
 import { cloneForwardHeaders, isSse } from "../util/headers.ts";
 import { eventDataLines, splitSseEvents } from "../util/sse.ts";
 import { renderProgramAsLil } from "../observer.ts";
@@ -58,21 +58,25 @@ export type RouterExecutionOptions = Pick<
 export type HandleChatCompletionsOptions = RouterExecutionOptions & {
   runtime: RouterRuntime;
   ctx: RequestContext;
+  program?: Program;
 };
 
 export type HandleResponsesOptions = RouterExecutionOptions & {
   runtime: RouterRuntime;
   ctx: RequestContext;
+  program?: Program;
 };
 
 export type HandleAnthropicMessagesOptions = RouterExecutionOptions & {
   runtime: RouterRuntime;
   ctx: RequestContext;
+  program?: Program;
 };
 
 export type HandleGoogleGenAIOptions = RouterExecutionOptions & {
   runtime: RouterRuntime;
   ctx: RequestContext;
+  program?: Program;
   forceStreaming?: boolean;
 };
 
@@ -170,8 +174,7 @@ export async function handleChatCompletions(
   options: HandleChatCompletionsOptions,
 ): Promise<Response> {
   try {
-    const requestBody = new Uint8Array(await options.ctx.request.arrayBuffer());
-    const request = parseChatCompletionsRequest(requestBody);
+    const request = options.program ?? await parseRequestProgram("chat-completions", options.ctx.request);
     const incomingExecutionId = `incoming_${crypto.randomUUID()}`;
     emitObservedProgram(options.observe, "request.received", request, {
       requestId: incomingExecutionId,
@@ -243,14 +246,13 @@ async function handleProviderStyle(
   options: RouterExecutionOptions & {
     runtime: RouterRuntime;
     ctx: RequestContext;
+    program?: Program;
   },
   mutateRequest?: (request: Program) => Program,
 ): Promise<Response> {
   try {
-    const requestBody = new Uint8Array(await options.ctx.request.arrayBuffer());
-    const request = mutateRequest
-      ? mutateRequest(parseProviderRequest(style, requestBody))
-      : parseProviderRequest(style, requestBody);
+    const baseRequest = options.program ?? await parseRequestProgram(style, options.ctx.request);
+    const request = mutateRequest ? mutateRequest(baseRequest) : baseRequest;
     const incomingExecutionId = `incoming_${crypto.randomUUID()}`;
     emitObservedProgram(options.observe, "request.received", request, {
       requestId: incomingExecutionId,
@@ -315,6 +317,16 @@ export function resolveRequestTarget(
   }
 }
 
+export async function parseRequestProgram(
+  style: ProviderStyle,
+  request: Request,
+): Promise<Program> {
+  const body = new Uint8Array(await request.arrayBuffer());
+  return style === "chat-completions"
+    ? parseChatCompletionsRequest(body)
+    : parseProviderRequest(style, body);
+}
+
 export function createFetchProviderInvoker(
   runtime: RouterRuntime,
   ctx: RequestContext,
@@ -625,7 +637,7 @@ async function fetchProvider(
     headers.set(key, value);
   }
 
-  for (const driver of runtime.authChain) {
+  for (const driver of runtime.upstreamAuthChain) {
     const targetCtx: TargetAuthContext = { ...ctx, providerName: provider.name };
     const auth = await driver.collectTarget(targetCtx);
     if (!auth) {

package/src/router/index.ts

@@ -8,6 +8,7 @@ export {
   handleAnthropicMessages,
   handleChatCompletions,
   handleGoogleGenAI,
+  parseRequestProgram,
   handleResponses,
   ProviderHttpError,
   resolveRequestTarget,
@@ -22,7 +23,6 @@ export {
   wireToolName,
 } from "./mcp.ts";
 export type {
-  AuthConfig,
   ModelNamespaceConfig,
   ModelRouteConfig,
   ProviderApiStyle,
@@ -30,6 +30,7 @@ export type {
   RemoteMcpServerConfig,
   RemoteMcpToolConfig,
   RouterConfig,
+  UpstreamAuthConfig,
 } from "./config.ts";
 export type {
   CreateRouterOptions,

package/src/router/runtime.ts

@@ -1,6 +1,6 @@
 import type { ExecutionTarget } from "@neutrome/lilsdk-ts";
-import type { AuthDriver } from "../auth/types.ts";
-import { buildAuthChain } from "../auth/registry.ts";
+import type { UpstreamAuthDriver } from "../upstream-auth/types.ts";
+import { buildUpstreamAuthChain } from "../upstream-auth/registry.ts";
 import { createExportsMatcher } from "../util/glob.ts";
 import type {
   ModelNamespaceConfig,
@@ -39,7 +39,7 @@ export type RouterRuntime = {
   modelNamespaces: ReadonlyMap<string, ModelNamespaceRuntime>;
   modelNamespaceOrder: readonly string[];
   mcps: ReadonlyMap<string, RemoteMcpServerRuntime>;
-  authChain: readonly AuthDriver[];
+  upstreamAuthChain: readonly UpstreamAuthDriver[];
   knownSuffixes: ReadonlySet<string>;
   fetchImpl: typeof fetch;
 };
@@ -52,7 +52,7 @@ export type CreateRouterOptions = {
   config: RouterConfig;
   fetchImpl?: typeof fetch;
   knownSuffixes?: string[];
-  authDrivers?: readonly AuthDriver[];
+  upstreamAuthDrivers?: readonly UpstreamAuthDriver[];
 };
 
 export function createRouterRuntime(options: CreateRouterOptions): RouterRuntime {
@@ -82,7 +82,7 @@ export function createRouterRuntime(options: CreateRouterOptions): RouterRuntime
     modelNamespaces,
     modelNamespaceOrder,
     mcps,
-    authChain: options.authDrivers ?? buildAuthChain(options.config.auth),
+    upstreamAuthChain: options.upstreamAuthDrivers ?? buildUpstreamAuthChain(options.config.upstreamAuth),
     knownSuffixes: new Set(options.knownSuffixes ?? ["slwin", "kvtools"]),
     fetchImpl: options.fetchImpl ?? globalThis.fetch.bind(globalThis),
   };

package/src/{auth → upstream-auth}/config.ts

@@ -1,4 +1,4 @@
-export type AuthConfigShape = {
+export type UpstreamAuthConfigShape = {
   order?: string[];
   proxy?: {
     headers?: string[];

package/src/{auth → upstream-auth}/env.ts

@@ -1,6 +1,6 @@
-import type { AuthDriver, TargetAuthContext, AuthResult } from "./types.ts";
+import type { AuthResult, TargetAuthContext, UpstreamAuthDriver } from "./types.ts";
 
-export function envAuthDriver(suffix = "_API_KEY", prefix = ""): AuthDriver {
+export function envAuthDriver(suffix = "_API_KEY", prefix = ""): UpstreamAuthDriver {
   const counters = new Map<string, number>();
 
   return {

package/src/{auth → upstream-auth}/proxy.ts

@@ -1,6 +1,6 @@
-import type { AuthDriver, RequestContext, TargetAuthContext, AuthResult } from "./types.ts";
+import type { AuthResult, RequestContext, TargetAuthContext, UpstreamAuthDriver } from "./types.ts";
 
-export function proxyAuthDriver(headers: string[]): AuthDriver {
+export function proxyAuthDriver(headers: string[]): UpstreamAuthDriver {
   return {
     name: "proxy",
     collectIncoming(ctx: RequestContext) {

package/src/{auth → upstream-auth}/registry.ts

@@ -1,12 +1,12 @@
-import type { AuthConfigShape } from "./config.ts";
-import type { AuthDriver } from "./types.ts";
+import type { UpstreamAuthConfigShape } from "./config.ts";
+import type { UpstreamAuthDriver } from "./types.ts";
 import { proxyAuthDriver } from "./proxy.ts";
 import { envAuthDriver } from "./env.ts";
 
-export function buildAuthChain(config?: AuthConfigShape): AuthDriver[] {
+export function buildUpstreamAuthChain(config?: UpstreamAuthConfigShape): UpstreamAuthDriver[] {
   if (!config) return [proxyAuthDriver(["authorization"]), envAuthDriver()];
   const order = config.order ?? ["proxy", "env"];
-  const drivers: AuthDriver[] = [];
+  const drivers: UpstreamAuthDriver[] = [];
   for (const name of order) {
     switch (name) {
       case "proxy":

package/src/{auth → upstream-auth}/types.ts

@@ -14,7 +14,7 @@ export type TargetAuthContext = RequestContext & {
   providerName: string;
 };
 
-export interface AuthDriver {
+export interface UpstreamAuthDriver {
   name: string;
   collectIncoming?(ctx: RequestContext): void;
   collectTarget(

package/src/worker.ts

@@ -5,7 +5,7 @@ import { createApp } from "./example.ts";
 
 const config: RouterConfig = {
   trace: true,
-  auth: {
+  upstreamAuth: {
     order: ["proxy", "env"],
     proxy: {
       headers: ["authorization", "x-openairouter-token"],

package/src/auth/apikey.ts

@@ -1,51 +0,0 @@
-export type ApiKeyEntry = {
-  tokenHash: string;
-  allowedModels: string[] | null;
-  allowedNamespaces: string[] | null;
-};
-
-export type ApiKeyAuth = {
-  authenticate(request: Request): Promise<ApiKeyEntry | null>;
-  canAccess(key: ApiKeyEntry, modelId: string): boolean;
-};
-
-export function createApiKeyAuth(keys: readonly ApiKeyEntry[]): ApiKeyAuth {
-  return {
-    async authenticate(request) {
-      const token = readApiToken(request);
-      if (!token) return null;
-      const hash = await sha256Hex(token);
-      return keys.find((k) => k.tokenHash === hash) ?? null;
-    },
-
-    canAccess(key, modelId) {
-      const hasModelRestriction = key.allowedModels && key.allowedModels.length > 0;
-      const hasNamespaceRestriction = key.allowedNamespaces && key.allowedNamespaces.length > 0;
-      if (!hasModelRestriction && !hasNamespaceRestriction) return true;
-      if (hasModelRestriction && key.allowedModels!.includes(modelId)) return true;
-      const ns = modelId.split("/")[0] ?? "";
-      return !!(hasNamespaceRestriction && key.allowedNamespaces!.includes(ns));
-    },
-  };
-}
-
-function readApiToken(request: Request): string | null {
-  const authHeader = request.headers.get("authorization");
-  const bearerMatch = authHeader?.match(/^Bearer\s+(.+)$/i);
-  if (bearerMatch?.[1]) return bearerMatch[1];
-
-  const headerToken = request.headers.get("x-api-key")
-    ?? request.headers.get("x-goog-api-key");
-  if (headerToken) return headerToken;
-
-  const url = new URL(request.url);
-  return url.searchParams.get("key") ?? url.searchParams.get("api_key");
-}
-
-async function sha256Hex(value: string): Promise<string> {
-  const bytes = new TextEncoder().encode(value);
-  const digest = await crypto.subtle.digest("SHA-256", bytes);
-  return Array.from(new Uint8Array(digest))
-    .map((b) => b.toString(16).padStart(2, "0"))
-    .join("");
-}