khal-os 1.260324.2

package/packages/os-cli/src/commands/logs.ts

@@ -0,0 +1,96 @@
+import { DeliverPolicy, jetstream } from '@nats-io/jetstream';
+import { Command } from 'commander';
+import { formatLogEntry, meetsLevel } from '../lib/formatter.js';
+import { connectNats, decode } from '../lib/nats.js';
+
+/** Parse a duration string like "5m", "1h", "30s" into milliseconds. */
+function parseDuration(input: string): number {
+	const match = input.match(/^(\d+)(s|m|h|d)$/);
+	if (!match) throw new Error(`Invalid duration: "${input}". Use format like 5m, 1h, 30s`);
+	const value = Number.parseInt(match[1], 10);
+	const unit = match[2];
+	const multipliers: Record<string, number> = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+	return value * multipliers[unit];
+}
+
+export const logsCommand = new Command('logs')
+	.description('Tail structured logs from services')
+	.argument('[service]', 'Service name to tail logs for')
+	.option('--all', 'Tail logs from all services')
+	.option('--since <duration>', 'Replay logs from JetStream (e.g. 5m, 1h, 30s)')
+	.option('--level <level>', 'Minimum log level (debug, info, warn, error)', 'debug')
+	.option('--json', 'Output raw JSON lines')
+	.action(
+		async (service: string | undefined, opts: { all?: boolean; since?: string; level: string; json?: boolean }) => {
+			if (!service && !opts.all) {
+				console.error('Error: specify a service name or use --all');
+				process.exit(1);
+			}
+
+			const nc = await connectNats();
+			const subject = opts.all ? 'os.o11y.logs.>' : `os.o11y.logs.${service}`;
+
+			if (opts.since) {
+				await replayThenTail(nc, subject, opts);
+			} else {
+				await liveTail(nc, subject, opts);
+			}
+		}
+	);
+
+async function liveTail(
+	nc: Awaited<ReturnType<typeof connectNats>>,
+	subject: string,
+	opts: { level: string; json?: boolean }
+): Promise<void> {
+	const sub = nc.subscribe(subject);
+
+	for await (const msg of sub) {
+		try {
+			const entry = JSON.parse(decode(msg.data));
+			if (!meetsLevel(entry.level, opts.level)) continue;
+
+			if (opts.json) {
+				process.stdout.write(decode(msg.data) + '\n');
+			} else {
+				process.stdout.write(formatLogEntry(entry) + '\n');
+			}
+		} catch {
+			// Skip malformed messages
+		}
+	}
+}
+
+async function replayThenTail(
+	nc: Awaited<ReturnType<typeof connectNats>>,
+	subject: string,
+	opts: { since?: string; level: string; json?: boolean }
+): Promise<void> {
+	const sinceMs = parseDuration(opts.since!);
+	const startTime = new Date(Date.now() - sinceMs);
+
+	const js = jetstream(nc);
+
+	const consumer = await js.consumers.get('OS_O11Y_LOGS', {
+		filter_subjects: [subject],
+		deliver_policy: DeliverPolicy.StartTime,
+		opt_start_time: startTime.toISOString(),
+	});
+
+	const messages = await consumer.consume();
+
+	for await (const msg of messages) {
+		try {
+			const entry = JSON.parse(decode(msg.data));
+			if (!meetsLevel(entry.level, opts.level)) continue;
+
+			if (opts.json) {
+				process.stdout.write(decode(msg.data) + '\n');
+			} else {
+				process.stdout.write(formatLogEntry(entry) + '\n');
+			}
+		} catch {
+			// Skip malformed messages
+		}
+	}
+}

package/packages/os-cli/src/commands/status.ts

@@ -0,0 +1,53 @@
+import chalk from 'chalk';
+import { Command } from 'commander';
+import { formatHealthTable } from '../lib/formatter.js';
+import { connectNats, decode } from '../lib/nats.js';
+
+export const statusCommand = new Command('status')
+	.description('Show service health status')
+	.option('--watch', 'Continuously watch for health updates')
+	.action(async (opts: { watch?: boolean }) => {
+		const nc = await connectNats();
+		const subject = 'khal._internal.system.health';
+
+		if (opts.watch) {
+			await watchHealth(nc, subject);
+		} else {
+			await snapshotHealth(nc, subject);
+		}
+	});
+
+async function snapshotHealth(nc: Awaited<ReturnType<typeof connectNats>>, subject: string): Promise<void> {
+	const sub = nc.subscribe(subject, { max: 1, timeout: 5000 });
+
+	process.stdout.write(chalk.dim('Waiting for health data...\n'));
+
+	try {
+		for await (const msg of sub) {
+			const data = JSON.parse(decode(msg.data));
+			process.stdout.write('\n');
+			process.stdout.write(chalk.bold('Service Health') + chalk.dim(` (${data.ts})\n\n`));
+			process.stdout.write(formatHealthTable(data.services) + '\n');
+		}
+	} catch {
+		process.stdout.write(chalk.yellow('No health data received within 5s. Is the service-loader running?\n'));
+	}
+
+	await nc.close();
+}
+
+async function watchHealth(nc: Awaited<ReturnType<typeof connectNats>>, subject: string): Promise<void> {
+	const sub = nc.subscribe(subject);
+
+	for await (const msg of sub) {
+		try {
+			const data = JSON.parse(decode(msg.data));
+			// Clear screen and redraw
+			process.stdout.write('\x1b[2J\x1b[H');
+			process.stdout.write(chalk.bold('Service Health') + chalk.dim(` (${data.ts})\n\n`));
+			process.stdout.write(formatHealthTable(data.services) + '\n');
+		} catch {
+			// Skip malformed messages
+		}
+	}
+}

package/packages/os-cli/src/commands/traces.ts

@@ -0,0 +1,115 @@
+import { DeliverPolicy, jetstream } from '@nats-io/jetstream';
+import chalk from 'chalk';
+import { Command } from 'commander';
+import { connectNats, decode } from '../lib/nats.js';
+import { buildSpanTree, renderSpanTree, type SpanEntry } from '../lib/trace-tree.js';
+
+export const tracesCommand = new Command('traces')
+	.description('Show distributed trace span tree')
+	.argument('<trace-id>', 'Trace ID to look up')
+	.option('--json', 'Output raw JSON entries')
+	.option('--since <duration>', 'How far back to search in JetStream (default: 1h)', '1h')
+	.action(async (traceId: string, opts: { json?: boolean; since: string }) => {
+		const nc = await connectNats();
+		const entries = await collectTraceEntries(nc, traceId, opts.since);
+
+		if (entries.length === 0) {
+			process.stdout.write(chalk.yellow(`No entries found for trace ${traceId}\n`));
+			process.stdout.write(chalk.dim('Hint: events may have expired from the JetStream ring buffer\n'));
+			await nc.close();
+			return;
+		}
+
+		if (opts.json) {
+			for (const entry of entries) {
+				process.stdout.write(JSON.stringify(entry) + '\n');
+			}
+		} else {
+			process.stdout.write(chalk.bold('Trace ') + chalk.cyan(traceId) + chalk.dim(` (${entries.length} spans)\n\n`));
+			const tree = buildSpanTree(entries);
+			process.stdout.write(renderSpanTree(tree) + '\n');
+		}
+
+		await nc.close();
+	});
+
+/** Parse a duration string like "5m", "1h", "30s" into milliseconds. */
+function parseDuration(input: string): number {
+	const match = input.match(/^(\d+)(s|m|h|d)$/);
+	if (!match) throw new Error(`Invalid duration: "${input}". Use format like 5m, 1h, 30s`);
+	const value = Number.parseInt(match[1], 10);
+	const unit = match[2];
+	const multipliers: Record<string, number> = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
+	return value * multipliers[unit];
+}
+
+/**
+ * Collect all events and logs matching a trace_id from JetStream.
+ * Queries both OS_O11Y_EVENTS and OS_O11Y_LOGS streams.
+ */
+async function collectTraceEntries(
+	nc: Awaited<ReturnType<typeof connectNats>>,
+	traceId: string,
+	sinceDuration: string
+): Promise<SpanEntry[]> {
+	const sinceMs = parseDuration(sinceDuration);
+	const startTime = new Date(Date.now() - sinceMs);
+	const js = jetstream(nc);
+	const entries: SpanEntry[] = [];
+
+	// Query events stream
+	await drainStream(js, 'OS_O11Y_EVENTS', 'os.o11y.events.>', startTime, traceId, entries, 'event');
+
+	// Query logs stream
+	await drainStream(js, 'OS_O11Y_LOGS', 'os.o11y.logs.>', startTime, traceId, entries, 'log');
+
+	return entries;
+}
+
+async function drainStream(
+	js: ReturnType<typeof jetstream>,
+	stream: string,
+	subject: string,
+	startTime: Date,
+	traceId: string,
+	entries: SpanEntry[],
+	type: 'event' | 'log'
+): Promise<void> {
+	try {
+		const consumer = await js.consumers.get(stream, {
+			filter_subjects: [subject],
+			deliver_policy: DeliverPolicy.StartTime,
+			opt_start_time: startTime.toISOString(),
+		});
+
+		const messages = await consumer.consume({ max_messages: 5000, expires: 3000 });
+
+		for await (const msg of messages) {
+			try {
+				const raw = decode(msg.data);
+				const entry = JSON.parse(raw);
+
+				if (entry.trace_id === traceId) {
+					entries.push({
+						subject: entry.subject || msg.subject,
+						service: entry.service || 'unknown',
+						duration_ms: entry.duration_ms ?? 0,
+						payload_bytes: entry.payload_bytes,
+						trace_id: entry.trace_id,
+						span_id: entry.span_id || msg.subject + '-' + entry.ts,
+						parent_span_id: entry.parent_span_id,
+						ts: entry.ts,
+						error: entry.error,
+						level: entry.level,
+						msg: entry.msg,
+						type,
+					});
+				}
+			} catch {
+				// Skip malformed messages
+			}
+		}
+	} catch {
+		// Stream may not exist or be empty — that's OK
+	}
+}

package/packages/os-cli/src/index.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { eventsCommand } from './commands/events.js';
+import { logsCommand } from './commands/logs.js';
+import { statusCommand } from './commands/status.js';
+import { tracesCommand } from './commands/traces.js';
+
+const program = new Command().name('genie-os').description('Genie OS observability CLI').version('0.0.1');
+
+program.addCommand(eventsCommand);
+program.addCommand(logsCommand);
+program.addCommand(statusCommand);
+program.addCommand(tracesCommand);
+
+program.parse();

package/packages/os-cli/src/lib/formatter.ts

@@ -0,0 +1,123 @@
+import chalk from 'chalk';
+
+/** Log level icons for human-readable output. */
+const LEVEL_ICONS: Record<string, string> = {
+	debug: chalk.gray('DBG'),
+	info: chalk.blue('INF'),
+	warn: chalk.yellow('WRN'),
+	error: chalk.red('ERR'),
+};
+
+/** Palette of distinct colors for service names. */
+const SERVICE_COLORS = [
+	chalk.cyan,
+	chalk.magenta,
+	chalk.green,
+	chalk.yellow,
+	chalk.blue,
+	chalk.red,
+	chalk.white,
+	chalk.gray,
+];
+
+/** Consistent color assignment per service name. */
+const serviceColorMap = new Map<string, (text: string) => string>();
+let colorIndex = 0;
+
+function getServiceColor(service: string): (text: string) => string {
+	const existing = serviceColorMap.get(service);
+	if (existing) return existing;
+	const color = SERVICE_COLORS[colorIndex % SERVICE_COLORS.length];
+	serviceColorMap.set(service, color);
+	colorIndex++;
+	return color;
+}
+
+interface LogEntry {
+	ts: string;
+	level: string;
+	service: string;
+	msg: string;
+	error?: { message: string; stack?: string };
+	trace_id?: string;
+	span_id?: string;
+	req_id?: string;
+	meta?: Record<string, unknown>;
+}
+
+/**
+ * Format a log entry as a colored human-readable line.
+ * Format: HH:MM:SS.mmm LVL [service] message {context}
+ */
+export function formatLogEntry(entry: LogEntry): string {
+	const ts = formatTimestamp(entry.ts);
+	const level = LEVEL_ICONS[entry.level] || chalk.gray(entry.level.toUpperCase().slice(0, 3));
+	const serviceColor = getServiceColor(entry.service);
+	const service = serviceColor(`[${entry.service}]`);
+	const msg = entry.level === 'error' ? chalk.red(entry.msg) : entry.msg;
+
+	let line = `${chalk.dim(ts)} ${level} ${service} ${msg}`;
+
+	if (entry.error) {
+		line += ` ${chalk.red(entry.error.message)}`;
+		if (entry.error.stack) {
+			line += `\n${chalk.dim(entry.error.stack)}`;
+		}
+	}
+
+	if (entry.meta && Object.keys(entry.meta).length > 0) {
+		line += ` ${chalk.dim(JSON.stringify(entry.meta))}`;
+	}
+
+	if (entry.trace_id) {
+		line += chalk.dim(` trace=${entry.trace_id.slice(0, 8)}`);
+	}
+
+	return line;
+}
+
+function formatTimestamp(ts: string): string {
+	try {
+		const d = new Date(ts);
+		const h = String(d.getHours()).padStart(2, '0');
+		const m = String(d.getMinutes()).padStart(2, '0');
+		const s = String(d.getSeconds()).padStart(2, '0');
+		const ms = String(d.getMilliseconds()).padStart(3, '0');
+		return `${h}:${m}:${s}.${ms}`;
+	} catch {
+		return ts;
+	}
+}
+
+/** Ordered log level values for filtering. */
+const LEVEL_VALUES: Record<string, number> = {
+	debug: 0,
+	info: 1,
+	warn: 2,
+	error: 3,
+};
+
+/** Check if a log level meets the minimum threshold. */
+export function meetsLevel(entryLevel: string, minLevel: string): boolean {
+	const entryVal = LEVEL_VALUES[entryLevel] ?? 0;
+	const minVal = LEVEL_VALUES[minLevel] ?? 0;
+	return entryVal >= minVal;
+}
+
+/**
+ * Format a health status table row.
+ */
+export function formatHealthTable(
+	services: Array<{ name: string; running: boolean; retries: number; pid: number | null }>
+): string {
+	const header = `${chalk.bold('Service'.padEnd(25))} ${chalk.bold('Status'.padEnd(10))} ${chalk.bold('PID'.padEnd(10))} ${chalk.bold('Retries')}`;
+	const separator = chalk.dim('-'.repeat(60));
+	const rows = services.map((s) => {
+		const status = s.running ? chalk.green('running') : chalk.red('stopped');
+		const pid = s.pid ? String(s.pid) : chalk.dim('-');
+		const retries = s.retries > 0 ? chalk.yellow(String(s.retries)) : chalk.dim('0');
+		return `${s.name.padEnd(25)} ${status.padEnd(19)} ${pid.padEnd(10)} ${retries}`;
+	});
+
+	return [header, separator, ...rows].join('\n');
+}

package/packages/os-cli/src/lib/nats.ts

@@ -0,0 +1,16 @@
+import { connect, type NatsConnection } from '@nats-io/transport-node';
+
+const DEFAULT_NATS_URL = 'nats://localhost:4222';
+
+/**
+ * Connect to the NATS server. Uses NATS_URL env var or defaults to localhost.
+ */
+export async function connectNats(): Promise<NatsConnection> {
+	const servers = process.env.NATS_URL || DEFAULT_NATS_URL;
+	return connect({ servers });
+}
+
+/** Decode NATS message data to a UTF-8 string. */
+export function decode(data: Uint8Array): string {
+	return new TextDecoder().decode(data);
+}

package/packages/os-cli/src/lib/trace-tree.ts

@@ -0,0 +1,144 @@
+import chalk from 'chalk';
+
+export interface SpanEntry {
+	subject: string;
+	service: string;
+	duration_ms: number;
+	payload_bytes?: number;
+	trace_id: string;
+	span_id: string;
+	parent_span_id?: string;
+	ts: string;
+	error?: { message: string; stack?: string };
+	level?: string;
+	msg?: string;
+	type: 'event' | 'log';
+}
+
+interface SpanNode {
+	entry: SpanEntry;
+	children: SpanNode[];
+}
+
+/**
+ * Build a tree of spans from a flat list of entries.
+ * Entries without a parent_span_id become roots.
+ * Orphan entries (parent not found) also become roots.
+ */
+export function buildSpanTree(entries: SpanEntry[]): SpanNode[] {
+	// Sort by timestamp
+	entries.sort((a, b) => new Date(a.ts).getTime() - new Date(b.ts).getTime());
+
+	const nodeMap = new Map<string, SpanNode>();
+	const roots: SpanNode[] = [];
+
+	// Create nodes
+	for (const entry of entries) {
+		const node: SpanNode = { entry, children: [] };
+		nodeMap.set(entry.span_id, node);
+	}
+
+	// Build tree
+	for (const entry of entries) {
+		const node = nodeMap.get(entry.span_id)!;
+		if (entry.parent_span_id) {
+			const parent = nodeMap.get(entry.parent_span_id);
+			if (parent) {
+				parent.children.push(node);
+			} else {
+				roots.push(node);
+			}
+		} else {
+			roots.push(node);
+		}
+	}
+
+	return roots;
+}
+
+/** Get the tree connector character based on position. */
+function connector(isRoot: boolean, isLast: boolean): string {
+	if (isRoot) return '';
+	return isLast ? '└─ ' : '├─ ';
+}
+
+/** Get the continuation prefix for child nodes. */
+function childPrefix(prefix: string, isRoot: boolean, isLast: boolean): string {
+	if (isRoot) return prefix;
+	return prefix + (isLast ? '   ' : '│  ');
+}
+
+/** Format a single span entry as a display line. */
+function formatSpanLine(entry: SpanEntry, linePrefix: string): string {
+	const ts = formatTime(entry.ts);
+	const service = chalk.cyan(`[${entry.service}]`);
+
+	if (entry.type === 'log' && entry.msg) {
+		const levelTag = entry.level ? chalk.dim(`[${entry.level}]`) : '';
+		return `${linePrefix}${ts} ${service} ${levelTag} ${entry.msg}`;
+	}
+
+	const subject = entry.error ? chalk.red(entry.subject) : chalk.white(entry.subject);
+	const duration = formatDuration(entry.duration_ms);
+	const spanId = chalk.dim(`span=${entry.span_id.slice(0, 8)}`);
+	let line = `${linePrefix}${ts} ${service} ${subject} ${duration} ${spanId}`;
+
+	if (entry.error) {
+		line += ` ${chalk.red('ERROR: ' + entry.error.message)}`;
+	}
+
+	return line;
+}
+
+/** Append error stack trace lines to the output. */
+function appendErrorStack(lines: string[], entry: SpanEntry, stackPfx: string): void {
+	if (!entry.error?.stack) return;
+	for (const stackLine of entry.error.stack.split('\n').slice(1, 6)) {
+		lines.push(`${stackPfx}   ${chalk.dim(stackLine.trim())}`);
+	}
+}
+
+/**
+ * Render a span tree as an indented, colored string for terminal output.
+ */
+export function renderSpanTree(roots: SpanNode[]): string {
+	const lines: string[] = [];
+
+	function render(node: SpanNode, prefix: string, isLast: boolean, isRoot: boolean): void {
+		const linePrefix = prefix + connector(isRoot, isLast);
+		lines.push(formatSpanLine(node.entry, linePrefix));
+
+		const nextPrefix = childPrefix(prefix, isRoot, isLast);
+		appendErrorStack(lines, node.entry, nextPrefix);
+
+		for (let i = 0; i < node.children.length; i++) {
+			render(node.children[i], nextPrefix, i === node.children.length - 1, false);
+		}
+	}
+
+	for (let i = 0; i < roots.length; i++) {
+		render(roots[i], '', i === roots.length - 1, i === 0 && roots.length === 1);
+	}
+
+	return lines.join('\n');
+}
+
+function formatTime(ts: string): string {
+	try {
+		const d = new Date(ts);
+		const h = String(d.getHours()).padStart(2, '0');
+		const m = String(d.getMinutes()).padStart(2, '0');
+		const s = String(d.getSeconds()).padStart(2, '0');
+		const ms = String(d.getMilliseconds()).padStart(3, '0');
+		return chalk.dim(`${h}:${m}:${s}.${ms}`);
+	} catch {
+		return chalk.dim(ts);
+	}
+}
+
+function formatDuration(ms: number): string {
+	if (ms < 1) return chalk.green(`${ms.toFixed(2)}ms`);
+	if (ms < 100) return chalk.green(`${ms.toFixed(1)}ms`);
+	if (ms < 1000) return chalk.yellow(`${ms.toFixed(0)}ms`);
+	return chalk.red(`${(ms / 1000).toFixed(2)}s`);
+}

package/packages/os-cli/tsconfig.json

@@ -0,0 +1,12 @@
+{
+	"compilerOptions": {
+		"target": "ES2022",
+		"module": "esnext",
+		"moduleResolution": "bundler",
+		"strict": true,
+		"noEmit": true,
+		"esModuleInterop": true,
+		"skipLibCheck": true
+	},
+	"include": ["src/**/*.ts"]
+}

package/packages/os-sdk/package.json

@@ -0,0 +1,27 @@
+{
+	"name": "@genie-os/sdk",
+	"version": "0.0.1",
+	"private": true,
+	"main": "./src/index.ts",
+	"exports": {
+		".": "./src/index.ts",
+		"./config": "./src/config.ts",
+		"./service": "./src/service/runtime.ts",
+		"./service/logger": "./src/service/logger.ts",
+		"./service/console-intercept": "./src/service/console-intercept.ts",
+		"./service/o11y-streams": "./src/service/o11y-streams.ts",
+		"./service/trace": "./src/service/trace.ts",
+		"./db": "./src/db/factory.ts",
+		"./db/migrate": "./src/db/migrate.ts",
+		"./db/provision": "./src/db/provision.ts"
+	},
+	"peerDependencies": {
+		"@nats-io/jetstream": ">=3",
+		"@nats-io/nats-core": ">=3",
+		"@nats-io/transport-node": ">=3",
+		"@workos-inc/authkit-nextjs": ">=2",
+		"drizzle-orm": ">=0.45",
+		"next": ">=16",
+		"postgres": ">=3"
+	}
+}

package/packages/os-sdk/src/api/handler.ts

@@ -0,0 +1,67 @@
+import { withAuth } from '@workos-inc/authkit-nextjs';
+import { type NextRequest, NextResponse } from 'next/server';
+import { type Database, getDb } from '../db/factory';
+
+export interface ApiContext {
+	/** Authenticated WorkOS user. Always present (401 returned if not). */
+	user: NonNullable<Awaited<ReturnType<typeof withAuth>>['user']>;
+	/** Original Next.js request. */
+	req: NextRequest;
+}
+
+export interface ApiContextWithDb extends ApiContext {
+	/** Drizzle database instance. */
+	db: Database;
+}
+
+type RouteHandler = (req: NextRequest, ...args: unknown[]) => Promise<Response>;
+
+/** Synthetic machine user for headless Chrome bypass. */
+const MACHINE_USER = {
+	id: 'machine',
+	email: 'machine@localhost',
+	emailVerified: true,
+	firstName: 'Machine',
+	lastName: 'User',
+	createdAt: new Date().toISOString(),
+	updatedAt: new Date().toISOString(),
+	object: 'user' as const,
+} as NonNullable<Awaited<ReturnType<typeof withAuth>>['user']>;
+
+/** Check if the request is from d3k's headless Chrome with OS_SECRET enabled. */
+function isHeadlessChrome(req: NextRequest): boolean {
+	return Boolean(process.env.OS_SECRET && (req.headers.get('user-agent') ?? '').includes('HeadlessChrome'));
+}
+
+/**
+ * Wraps an API route handler with auth.
+ * Returns 401 if the user is not authenticated.
+ */
+export function apiHandler(fn: (ctx: ApiContext) => Promise<Response>): RouteHandler {
+	return async (req: NextRequest, ..._args: unknown[]) => {
+		const auth = await withAuth();
+		if (!auth.user && !isHeadlessChrome(req)) {
+			return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+		}
+
+		const user = auth.user ?? MACHINE_USER;
+		return fn({ user, req });
+	};
+}
+
+/**
+ * Wraps an API route handler with auth + db resolution.
+ * Returns 401 if the user is not authenticated.
+ */
+export function apiHandlerWithDb(fn: (ctx: ApiContextWithDb) => Promise<Response>): RouteHandler {
+	return async (req: NextRequest, ..._args: unknown[]) => {
+		const auth = await withAuth();
+		if (!auth.user && !isHeadlessChrome(req)) {
+			return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+		}
+
+		const user = auth.user ?? MACHINE_USER;
+		const db = getDb();
+		return fn({ user, db, req });
+	};
+}