Encore.ts backend, batteries included

A single Encore.ts app (apps/api) decomposes into lib, db, health, auth, gateway, and web services with typed api() / api.raw() endpoints auto-discovered from encore.service.ts; no hand-maintained route registry.

Stateless multi-driver auth

RS256 JWT (15-min access plus 7-day DB-backed, rotating / revocable refresh) in httpOnly cookies, CSRF double-submit, and pluggable SSO drivers (mock for dev, rauthy OIDC for production), all gated by an Encore authHandler plus Gateway.

BFF gateway proxy

An api.raw catch-all proxies authenticated /api/v1/data/* requests to a private backend with service-to-service OAuth client-credentials tokens, path-traversal sanitization, 5xx-to-502 masking, timeout-to-504, and per-access audit (INV-10).

Born-with spec-spine governance

A markdown spec corpus (specs/000-019) compiles to a deterministic registry; a PR-time coupling gate refuses changes to owned code whose owning spec is not edited in the same diff, enforced locally via make and in CI.