@common-stack/server-stack 9.0.2-alpha.1 → 9.0.2-alpha.12

package/lib/express-adapter.mjs

@@ -0,0 +1,90 @@
+import {createRequire}from'node:module';/**
+ * Express Engine Adapter
+ *
+ * Provides a unified interface for both Express 4 and ultimate-express (uWebSockets.js).
+ * The engine is selected at startup via the `EXPRESS_ENGINE` environment variable:
+ *
+ *   - `EXPRESS_ENGINE=ultimate` (default) — uses ultimate-express + ultimate-ws for best performance
+ *   - `EXPRESS_ENGINE=express` — uses classic Express 4 + ws for maximum compatibility
+ *
+ * All server modules import from this adapter instead of directly from 'express' or 'ultimate-express',
+ * so switching engines requires zero code changes — just set the env var.
+ *
+ * IMPORTANT: ultimate-express does NOT support http.createServer(). The server is started via app.listen().
+ * Classic express works with both http.createServer() and app.listen().
+ * This adapter normalizes both to use app.listen() for consistency.
+ */
+// ─── Engine Detection ────────────────────────────────────────────────────────
+// Read engine choice early (before envalid config is available).
+// This module is loaded at import time, so we read directly from process.env.
+const requestedEngine = (process.env.EXPRESS_ENGINE || 'ultimate').toLowerCase();
+const _require = createRequire(import.meta.url);
+/**
+ * Safely attempt to load the ultimate-* native engine.
+ * These packages are declared as `optionalDependencies` and require a recent glibc;
+ * in stripped-down container images they may be missing or fail to load — in that
+ * case we transparently fall back to classic express + ws.
+ */
+function tryLoadUltimate() {
+    try {
+        const ultimateExpress = _require('ultimate-express');
+        const ultimateWs = _require('ultimate-ws');
+        return { express: ultimateExpress, WebSocketServer: ultimateWs.WebSocketServer };
+    }
+    catch (err) {
+        if (requestedEngine === 'ultimate') {
+            // eslint-disable-next-line no-console
+            console.warn('[express-adapter] ultimate-express/ultimate-ws unavailable, falling back to express + ws.', err?.message);
+        }
+        return null;
+    }
+}
+const ultimate = requestedEngine === 'ultimate' ? tryLoadUltimate() : null;
+/** Whether the ultimate-express (uWebSockets.js) engine is active */
+const isUltimateEngine = ultimate !== null;
+/**
+ * The express factory function — creates an Express application.
+ * When engine='ultimate' (and the native module loaded), this is ultimate-express (uWS.js-backed).
+ * Otherwise this is classic Express 4.
+ */
+const express = ultimate ? ultimate.express : _require('express');
+/**
+ * WebSocketServer class.
+ * When engine='ultimate' (and the native module loaded), this is ultimate-ws (uWS.js-backed).
+ * Otherwise this is the standard `ws` package.
+ */
+const WebSocketServer = ultimate ? ultimate.WebSocketServer : _require('ws').WebSocketServer;
+/**
+ * Create an HTTP server for the given express app.
+ *
+ * - ultimate-express: returns null (uWS manages the server internally via app.listen())
+ * - classic express: returns http.createServer(app)
+ */
+function createHttpServer(app) {
+    if (isUltimateEngine) {
+        // ultimate-express manages its own uWS server; no http.Server is created
+        return null;
+    }
+    const http = _require('http');
+    return http.createServer(app);
+}
+/**
+ * Body parser middleware.
+ *
+ * - ultimate-express: uses built-in express.json() / express.urlencoded() for best perf
+ * - classic express: uses body-parser package (more battle-tested options)
+ */
+function jsonParser(options) {
+    if (isUltimateEngine) {
+        return express.json(options);
+    }
+    const bodyParser = _require('body-parser');
+    return bodyParser.json(options);
+}
+function urlencodedParser(options) {
+    if (isUltimateEngine) {
+        return express.urlencoded(options);
+    }
+    const bodyParser = _require('body-parser');
+    return bodyParser.urlencoded(options);
+}export{WebSocketServer,createHttpServer,express as default,express,isUltimateEngine,jsonParser,urlencodedParser};//# sourceMappingURL=express-adapter.mjs.map

package/lib/express-adapter.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-adapter.mjs","sources":["../src/express-adapter.ts"],"sourcesContent":[null],"names":[],"mappings":"wCAAA;;;;;;;;;;;;;;;AAeG;AAQH;AACA;AACA;AACA,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;AAKjF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhD;;;;;AAKG;AACH,SAAS,eAAe,GAAA;AACpB,IAAA,IAAI;AACA,QAAA,MAAM,eAAe,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;AACrD,QAAA,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC;KACpF;IAAC,OAAO,GAAG,EAAE;AACV,QAAA,IAAI,eAAe,KAAK,UAAU,EAAE;;YAEhC,OAAO,CAAC,IAAI,CACR,2FAA2F,EAC1F,GAAa,EAAE,OAAO,CAC1B,CAAC;SACL;AACD,QAAA,OAAO,IAAI,CAAC;KACf;AACL,CAAC;AAED,MAAM,QAAQ,GAAG,eAAe,KAAK,UAAU,GAAG,eAAe,EAAE,GAAG,IAAI,CAAC;AAE3E;AACa,MAAA,gBAAgB,GAAY,QAAQ,KAAK,KAAK;AAE3D;;;;AAIG;AACU,MAAA,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE;AAIzE;;;;AAIG;MACU,eAAe,GAAG,QAAQ,GAAG,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,gBAAgB;AAKpG;;;;;AAKG;AACG,SAAU,gBAAgB,CAAC,GAAY,EAAA;IACzC,IAAI,gBAAgB,EAAE;;AAElB,QAAA,OAAO,IAAI,CAAC;KACf;AACD,IAAA,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9B,IAAA,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAuBD;;;;;AAKG;AACG,SAAU,UAAU,CAAC,OAAa,EAAA;IACpC,IAAI,gBAAgB,EAAE;AAClB,QAAA,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAChC;AACD,IAAA,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC3C,IAAA,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAEK,SAAU,gBAAgB,CAAC,OAAa,EAAA;IAC1C,IAAI,gBAAgB,EAAE;AAClB,QAAA,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;KACtC;AACD,IAAA,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;AAC3C,IAAA,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC1C"}

package/lib/middleware/services.cjs

@@ -1,12 +1,47 @@
-'use strict';require('isomorphic-fetch');const contextServicesMiddleware = (createContext, serviceContext) => (req, res, next) => {
-    Promise.all([
-        createContext(req, res),
-        serviceContext(req, res),
-    ])
-        .then(([context, services]) => {
-        req.context = context;
-        req.services = services;
+'use strict';require('isomorphic-fetch');/**
+ * Phase-aware context middleware. Runs only the `createContextFunc` factories
+ * whose `phase` property matches the current phase (untagged factories default
+ * to `pre-beforeware`).
+ *
+ * - `pre-beforeware` (default): seeds `req.services` with the container-built
+ *   service map and merges any safe context factories. Lenient: a thrown
+ *   factory is logged and skipped so the request can still reach auth.
+ * - `pre-middleware`: runs after the consumer's beforewares (e.g. auth chain),
+ *   so factories that depend on `req.user` belong here. Strict: errors are
+ *   propagated via `next(err)`.
+ * - `post-middleware`: runs after the consumer's middlewares. Strict.
+ */
+const phasedContextMiddleware = (feature, phase) => async (req, res, next) => {
+    const isPreBeforeware = phase === 'pre-beforeware';
+    try {
+        const { context, matched } = await feature.runContextFactoriesForPhase(req, res, phase);
+        if (isPreBeforeware) {
+            const services = feature.services || {};
+            req.context = { ...(req.context || {}), ...context };
+            req.services = { ...(req.services || {}), ...services, ...context };
+        }
+        else if (matched) {
+            req.context = { ...(req.context || {}), ...context };
+            req.services = { ...(req.services || {}), ...context };
+        }
         next();
-    })
-        .catch((err) => next());
-};exports.contextServicesMiddleware=contextServicesMiddleware;//# sourceMappingURL=services.cjs.map
+    }
+    catch (err) {
+        if (isPreBeforeware) {
+            // Lenient: some factories require auth (which has not run yet).
+            // Seed req.services with the static service map so downstream
+            // beforewares still have a usable services object.
+            // eslint-disable-next-line no-console
+            console.warn(`[phased-context] pre-beforeware factory failed (continuing):`, err?.message);
+            const services = feature.services || {};
+            if (!req.services)
+                req.services = { ...services };
+            else
+                req.services = { ...req.services, ...services };
+            next();
+        }
+        else {
+            next(err);
+        }
+    }
+};exports.phasedContextMiddleware=phasedContextMiddleware;//# sourceMappingURL=services.cjs.map

package/lib/middleware/services.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"services.cjs","sources":["../../src/middleware/services.ts"],"sourcesContent":[null],"names":[],"mappings":"yCAEa,MAAA,yBAAyB,GAAG,CAAC,aAAa,EAAE,cAAc,KAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;IAC5F,OAAO,CAAC,GAAG,CAAC;AACR,QAAA,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC;AACvB,QAAA,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;KAC3B,CAAC;SACG,IAAI,CAAC,CAAC,CAAE,OAAO,EAAE,QAAQ,CAAE,KAAI;AAC5B,QAAA,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;AACtB,QAAA,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAExB,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;AAChC"}
+{"version":3,"file":"services.cjs","sources":["../../src/middleware/services.ts"],"sourcesContent":[null],"names":[],"mappings":"yCAsBA;;;;;;;;;;;;AAYG;AACU,MAAA,uBAAuB,GAAG,CAAC,OAAgB,EAAE,KAAmB,KAAK,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvG,IAAA,MAAM,eAAe,GAAG,KAAK,KAAK,gBAAgB,CAAC;AACnD,IAAA,IAAI;AACA,QAAA,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,eAAe,EAAE;AACjB,YAAA,MAAM,QAAQ,GAAI,OAAe,CAAC,QAAQ,IAAI,EAAE,CAAC;AACjD,YAAA,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACrD,YAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;SACvE;aAAM,IAAI,OAAO,EAAE;AAChB,YAAA,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACrD,YAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;SAC1D;AACD,QAAA,IAAI,EAAE,CAAC;KACV;IAAC,OAAO,GAAG,EAAE;QACV,IAAI,eAAe,EAAE;;;;;YAKjB,OAAO,CAAC,IAAI,CAAC,CAAA,4DAAA,CAA8D,EAAG,GAAa,EAAE,OAAO,CAAC,CAAC;AACtG,YAAA,MAAM,QAAQ,GAAI,OAAe,CAAC,QAAQ,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,QAAQ;AAAE,gBAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;;AAC7C,gBAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,YAAA,IAAI,EAAE,CAAC;SACV;aAAM;YACH,IAAI,CAAC,GAAG,CAAC,CAAC;SACb;KACJ;AACL"}

package/lib/middleware/services.mjs

@@ -1,12 +1,47 @@
-import'isomorphic-fetch';const contextServicesMiddleware = (createContext, serviceContext) => (req, res, next) => {
-    Promise.all([
-        createContext(req, res),
-        serviceContext(req, res),
-    ])
-        .then(([context, services]) => {
-        req.context = context;
-        req.services = services;
+import'isomorphic-fetch';/**
+ * Phase-aware context middleware. Runs only the `createContextFunc` factories
+ * whose `phase` property matches the current phase (untagged factories default
+ * to `pre-beforeware`).
+ *
+ * - `pre-beforeware` (default): seeds `req.services` with the container-built
+ *   service map and merges any safe context factories. Lenient: a thrown
+ *   factory is logged and skipped so the request can still reach auth.
+ * - `pre-middleware`: runs after the consumer's beforewares (e.g. auth chain),
+ *   so factories that depend on `req.user` belong here. Strict: errors are
+ *   propagated via `next(err)`.
+ * - `post-middleware`: runs after the consumer's middlewares. Strict.
+ */
+const phasedContextMiddleware = (feature, phase) => async (req, res, next) => {
+    const isPreBeforeware = phase === 'pre-beforeware';
+    try {
+        const { context, matched } = await feature.runContextFactoriesForPhase(req, res, phase);
+        if (isPreBeforeware) {
+            const services = feature.services || {};
+            req.context = { ...(req.context || {}), ...context };
+            req.services = { ...(req.services || {}), ...services, ...context };
+        }
+        else if (matched) {
+            req.context = { ...(req.context || {}), ...context };
+            req.services = { ...(req.services || {}), ...context };
+        }
         next();
-    })
-        .catch((err) => next());
-};export{contextServicesMiddleware};//# sourceMappingURL=services.mjs.map
+    }
+    catch (err) {
+        if (isPreBeforeware) {
+            // Lenient: some factories require auth (which has not run yet).
+            // Seed req.services with the static service map so downstream
+            // beforewares still have a usable services object.
+            // eslint-disable-next-line no-console
+            console.warn(`[phased-context] pre-beforeware factory failed (continuing):`, err?.message);
+            const services = feature.services || {};
+            if (!req.services)
+                req.services = { ...services };
+            else
+                req.services = { ...req.services, ...services };
+            next();
+        }
+        else {
+            next(err);
+        }
+    }
+};export{phasedContextMiddleware};//# sourceMappingURL=services.mjs.map

package/lib/middleware/services.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"services.mjs","sources":["../../src/middleware/services.ts"],"sourcesContent":[null],"names":[],"mappings":"yBAEa,MAAA,yBAAyB,GAAG,CAAC,aAAa,EAAE,cAAc,KAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;IAC5F,OAAO,CAAC,GAAG,CAAC;AACR,QAAA,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC;AACvB,QAAA,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC;KAC3B,CAAC;SACG,IAAI,CAAC,CAAC,CAAE,OAAO,EAAE,QAAQ,CAAE,KAAI;AAC5B,QAAA,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;AACtB,QAAA,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;AAExB,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC;AAChC"}
+{"version":3,"file":"services.mjs","sources":["../../src/middleware/services.ts"],"sourcesContent":[null],"names":[],"mappings":"yBAsBA;;;;;;;;;;;;AAYG;AACU,MAAA,uBAAuB,GAAG,CAAC,OAAgB,EAAE,KAAmB,KAAK,OAAO,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvG,IAAA,MAAM,eAAe,GAAG,KAAK,KAAK,gBAAgB,CAAC;AACnD,IAAA,IAAI;AACA,QAAA,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,OAAO,CAAC,2BAA2B,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,eAAe,EAAE;AACjB,YAAA,MAAM,QAAQ,GAAI,OAAe,CAAC,QAAQ,IAAI,EAAE,CAAC;AACjD,YAAA,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACrD,YAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;SACvE;aAAM,IAAI,OAAO,EAAE;AAChB,YAAA,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;AACrD,YAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;SAC1D;AACD,QAAA,IAAI,EAAE,CAAC;KACV;IAAC,OAAO,GAAG,EAAE;QACV,IAAI,eAAe,EAAE;;;;;YAKjB,OAAO,CAAC,IAAI,CAAC,CAAA,4DAAA,CAA8D,EAAG,GAAa,EAAE,OAAO,CAAC,CAAC;AACtG,YAAA,MAAM,QAAQ,GAAI,OAAe,CAAC,QAAQ,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,QAAQ;AAAE,gBAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;;AAC7C,gBAAA,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;AACrD,YAAA,IAAI,EAAE,CAAC;SACV;aAAM;YACH,IAAI,CAAC,GAAG,CAAC,CAAC;SACb;KACJ;AACL"}

package/lib/servers/ExpressApp.cjs

@@ -1,38 +1,53 @@
-'use strict';var express=require('express'),bodyParser=require('body-parser'),error=require('../middleware/error.cjs'),services=require('../middleware/services.cjs');require('../middleware/sentry.cjs');var redisClient=require('../middleware/redis-client.cjs'),cors=require('../middleware/cors.cjs'),Sentry=require('@sentry/node');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var Sentry__namespace=/*#__PURE__*/_interopNamespaceDefault(Sentry);/* eslint-disable @typescript-eslint/no-var-requires */
+'use strict';var expressAdapter=require('../express-adapter.cjs'),error=require('../middleware/error.cjs'),services=require('../middleware/services.cjs');require('../middleware/sentry.cjs');var redisClient=require('../middleware/redis-client.cjs'),cors=require('../middleware/cors.cjs'),Sentry=require('@sentry/node');function _interopNamespaceDefault(e){var n=Object.create(null);if(e){Object.keys(e).forEach(function(k){if(k!=='default'){var d=Object.getOwnPropertyDescriptor(e,k);Object.defineProperty(n,k,d.get?d:{enumerable:true,get:function(){return e[k]}});}})}n.default=e;return Object.freeze(n)}var Sentry__namespace=/*#__PURE__*/_interopNamespaceDefault(Sentry);/* eslint-disable @typescript-eslint/no-var-requires */
 function expressApp(modules, options, middlewares, http, redisClient$1) {
-    const app = express();
+    const app = expressAdapter.express();
     // FIRST PRIORITY: Add Redis client middleware at the very top
     // This ensures req.redisClient is available to ALL downstream middleware
     if (redisClient$1) {
         app.use(redisClient.redisClientMiddleware(redisClient$1));
     }
-    app.use(services.contextServicesMiddleware(options.createContext, options.serviceContext));
+    // CORS must run BEFORE auth/beforewares so that auth-rejected responses
+    // (e.g. 401 from /graphql auth chain) still carry the
+    // Access-Control-Allow-Origin header. Otherwise browsers report a CORS
+    // error instead of surfacing the 401 to the app.
+    app.use(cors.corsMiddleware);
+    app.use((req, res, next) => {
+        res.header('Access-Control-Allow-Credentials', JSON.stringify(true));
+        res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
+        res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, X-CSP-Nonce, Content-Type, Accept');
+        next();
+    });
+    // Phase 1: pre-beforeware — runs default-tagged context factories and
+    // seeds req.services from the static service map. Lenient: a factory
+    // that throws (e.g. one that requires auth) is logged and skipped.
+    app.use(services.phasedContextMiddleware(modules, 'pre-beforeware'));
+    // Consumer beforewares (e.g. auth chains for /graphql, /api/workflow).
     for (const applyBeforeware of modules.beforewares) {
         applyBeforeware(app);
     }
+    // Phase 2: pre-middleware — runs context factories tagged
+    // `phase = 'pre-middleware'` (e.g. ones that read req.user). Strict.
+    app.use(services.phasedContextMiddleware(modules, 'pre-middleware'));
     // Don't rate limit heroku
     app.enable('trust proxy');
     if (middlewares !== null) {
         app.use(middlewares);
     }
-    app.use(cors.corsMiddleware);
-    app.use((req, res, next) => {
-        res.header('Access-Control-Allow-Credentials', JSON.stringify(true));
-        res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
-        res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, X-CSP-Nonce, Content-Type, Accept');
-        next();
-    });
-    app.use(bodyParser.json({
+    app.use(expressAdapter.jsonParser({
         limit: '50mb',
         verify: (req, res, buf) => {
             // #Todo: Find some proper solution for it
             req.rawBody = buf;
         },
     }));
-    app.use(bodyParser.urlencoded({ limit: '50mb', extended: true, parameterLimit: 50000 }));
+    app.use(expressAdapter.urlencodedParser({ limit: '50mb', extended: true, parameterLimit: 50000 }));
     for (const applyMiddleware of modules.middlewares) {
         applyMiddleware(app);
     }
+    // Phase 3: post-middleware — runs context factories tagged
+    // `phase = 'post-middleware'`. Strict. Skipped at zero cost when none
+    // are tagged.
+    app.use(services.phasedContextMiddleware(modules, 'post-middleware'));
     // Sentry error handler must be after all middleware/routes but before generic error handlers
     Sentry__namespace.setupExpressErrorHandler(app);
     if (__DEV__) {

package/lib/servers/ExpressApp.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ExpressApp.cjs","sources":["../../src/servers/ExpressApp.ts"],"sourcesContent":[null],"names":["redisClient","redisClientMiddleware","contextServicesMiddleware","corsMiddleware","Sentry","errorMiddleware"],"mappings":"4qBAAA;AAWM,SAAU,UAAU,CAAC,OAAgB,EAAE,OAAuB,EAAE,WAAW,EAAE,IAAK,EAAEA,aAAY,EAAA;AAClG,IAAA,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;;;IAItB,IAAIA,aAAW,EAAE;QACb,GAAG,CAAC,GAAG,CAACC,iCAAqB,CAACD,aAAW,CAAC,CAAC,CAAC;KAC/C;AAED,IAAA,GAAG,CAAC,GAAG,CAACE,kCAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;AAClF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;AAGD,IAAA,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAE1B,IAAA,IAAI,WAAW,KAAK,IAAI,EAAE;AACtB,QAAA,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;KACxB;AAED,IAAA,GAAG,CAAC,GAAG,CAACC,mBAAc,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvB,QAAA,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,QAAA,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,qBAAqB,CAAC,CAAC;AAClE,QAAA,GAAG,CAAC,MAAM,CACN,8BAA8B,EAC9B,6EAA6E,CAChF,CAAC;AACF,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC,CAAC;AAEH,IAAA,GAAG,CAAC,GAAG,CACH,UAAU,CAAC,IAAI,CAAC;AACZ,QAAA,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAI;;AAErB,YAAA,GAAW,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9B;AACJ,KAAA,CAAC,CACL,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEzF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;AAGD,IAAAC,iBAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,OAAO,EAAE;AACT,QAAA,GAAG,CAAC,GAAG,CAACC,qBAAe,CAAC,CAAC;KAC5B;AAED,IAAA,OAAO,GAAG,CAAC;AACf"}
+{"version":3,"file":"ExpressApp.cjs","sources":["../../src/servers/ExpressApp.ts"],"sourcesContent":[null],"names":["redisClient","express","redisClientMiddleware","corsMiddleware","phasedContextMiddleware","jsonParser","urlencodedParser","Sentry","errorMiddleware"],"mappings":"gqBAAA;AAUM,SAAU,UAAU,CAAC,OAAgB,EAAE,OAAuB,EAAE,WAAW,EAAE,IAAK,EAAEA,aAAY,EAAA;AAClG,IAAA,MAAM,GAAG,GAAGC,sBAAO,EAAE,CAAC;;;IAItB,IAAID,aAAW,EAAE;QACb,GAAG,CAAC,GAAG,CAACE,iCAAqB,CAACF,aAAW,CAAC,CAAC,CAAC;KAC/C;;;;;AAMD,IAAA,GAAG,CAAC,GAAG,CAACG,mBAAc,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvB,QAAA,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,QAAA,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,qBAAqB,CAAC,CAAC;AAClE,QAAA,GAAG,CAAC,MAAM,CACN,8BAA8B,EAC9B,6EAA6E,CAChF,CAAC;AACF,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC,CAAC;;;;IAKH,GAAG,CAAC,GAAG,CAACC,gCAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;AAG5D,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;;IAID,GAAG,CAAC,GAAG,CAACA,gCAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;AAG5D,IAAA,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAE1B,IAAA,IAAI,WAAW,KAAK,IAAI,EAAE;AACtB,QAAA,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;KACxB;AAED,IAAA,GAAG,CAAC,GAAG,CACHC,yBAAU,CAAC;AACP,QAAA,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAI;;AAErB,YAAA,GAAW,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9B;AACJ,KAAA,CAAC,CACL,CAAC;IACF,GAAG,CAAC,GAAG,CAACC,+BAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEpF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;;;IAKD,GAAG,CAAC,GAAG,CAACF,gCAAuB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;;AAG7D,IAAAG,iBAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,OAAO,EAAE;AACT,QAAA,GAAG,CAAC,GAAG,CAACC,qBAAe,CAAC,CAAC;KAC5B;AAED,IAAA,OAAO,GAAG,CAAC;AACf"}

package/lib/servers/ExpressApp.mjs

@@ -1,4 +1,4 @@
-import express from'express';import bodyParser from'body-parser';import {errorMiddleware}from'../middleware/error.mjs';import {contextServicesMiddleware}from'../middleware/services.mjs';import'../middleware/sentry.mjs';import {redisClientMiddleware}from'../middleware/redis-client.mjs';import {corsMiddleware}from'../middleware/cors.mjs';import*as Sentry from'@sentry/node';/* eslint-disable @typescript-eslint/no-var-requires */
+import {express,jsonParser,urlencodedParser}from'../express-adapter.mjs';import {errorMiddleware}from'../middleware/error.mjs';import {phasedContextMiddleware}from'../middleware/services.mjs';import'../middleware/sentry.mjs';import {redisClientMiddleware}from'../middleware/redis-client.mjs';import {corsMiddleware}from'../middleware/cors.mjs';import*as Sentry from'@sentry/node';/* eslint-disable @typescript-eslint/no-var-requires */
 function expressApp(modules, options, middlewares, http, redisClient) {
     const app = express();
     // FIRST PRIORITY: Add Redis client middleware at the very top
@@ -6,33 +6,48 @@ function expressApp(modules, options, middlewares, http, redisClient) {
     if (redisClient) {
         app.use(redisClientMiddleware(redisClient));
     }
-    app.use(contextServicesMiddleware(options.createContext, options.serviceContext));
+    // CORS must run BEFORE auth/beforewares so that auth-rejected responses
+    // (e.g. 401 from /graphql auth chain) still carry the
+    // Access-Control-Allow-Origin header. Otherwise browsers report a CORS
+    // error instead of surfacing the 401 to the app.
+    app.use(corsMiddleware);
+    app.use((req, res, next) => {
+        res.header('Access-Control-Allow-Credentials', JSON.stringify(true));
+        res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
+        res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, X-CSP-Nonce, Content-Type, Accept');
+        next();
+    });
+    // Phase 1: pre-beforeware — runs default-tagged context factories and
+    // seeds req.services from the static service map. Lenient: a factory
+    // that throws (e.g. one that requires auth) is logged and skipped.
+    app.use(phasedContextMiddleware(modules, 'pre-beforeware'));
+    // Consumer beforewares (e.g. auth chains for /graphql, /api/workflow).
     for (const applyBeforeware of modules.beforewares) {
         applyBeforeware(app);
     }
+    // Phase 2: pre-middleware — runs context factories tagged
+    // `phase = 'pre-middleware'` (e.g. ones that read req.user). Strict.
+    app.use(phasedContextMiddleware(modules, 'pre-middleware'));
     // Don't rate limit heroku
     app.enable('trust proxy');
     if (middlewares !== null) {
         app.use(middlewares);
     }
-    app.use(corsMiddleware);
-    app.use((req, res, next) => {
-        res.header('Access-Control-Allow-Credentials', JSON.stringify(true));
-        res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
-        res.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, X-CSP-Nonce, Content-Type, Accept');
-        next();
-    });
-    app.use(bodyParser.json({
+    app.use(jsonParser({
         limit: '50mb',
         verify: (req, res, buf) => {
             // #Todo: Find some proper solution for it
             req.rawBody = buf;
         },
     }));
-    app.use(bodyParser.urlencoded({ limit: '50mb', extended: true, parameterLimit: 50000 }));
+    app.use(urlencodedParser({ limit: '50mb', extended: true, parameterLimit: 50000 }));
     for (const applyMiddleware of modules.middlewares) {
         applyMiddleware(app);
     }
+    // Phase 3: post-middleware — runs context factories tagged
+    // `phase = 'post-middleware'`. Strict. Skipped at zero cost when none
+    // are tagged.
+    app.use(phasedContextMiddleware(modules, 'post-middleware'));
     // Sentry error handler must be after all middleware/routes but before generic error handlers
     Sentry.setupExpressErrorHandler(app);
     if (__DEV__) {

package/lib/servers/ExpressApp.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ExpressApp.mjs","sources":["../../src/servers/ExpressApp.ts"],"sourcesContent":[null],"names":[],"mappings":"sXAAA;AAWM,SAAU,UAAU,CAAC,OAAgB,EAAE,OAAuB,EAAE,WAAW,EAAE,IAAK,EAAE,WAAY,EAAA;AAClG,IAAA,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;;;IAItB,IAAI,WAAW,EAAE;QACb,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;KAC/C;AAED,IAAA,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;AAClF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;AAGD,IAAA,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAE1B,IAAA,IAAI,WAAW,KAAK,IAAI,EAAE;AACtB,QAAA,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;KACxB;AAED,IAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvB,QAAA,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,QAAA,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,qBAAqB,CAAC,CAAC;AAClE,QAAA,GAAG,CAAC,MAAM,CACN,8BAA8B,EAC9B,6EAA6E,CAChF,CAAC;AACF,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC,CAAC;AAEH,IAAA,GAAG,CAAC,GAAG,CACH,UAAU,CAAC,IAAI,CAAC;AACZ,QAAA,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAI;;AAErB,YAAA,GAAW,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9B;AACJ,KAAA,CAAC,CACL,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEzF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;AAGD,IAAA,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,OAAO,EAAE;AACT,QAAA,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAC5B;AAED,IAAA,OAAO,GAAG,CAAC;AACf"}
+{"version":3,"file":"ExpressApp.mjs","sources":["../../src/servers/ExpressApp.ts"],"sourcesContent":[null],"names":[],"mappings":"4XAAA;AAUM,SAAU,UAAU,CAAC,OAAgB,EAAE,OAAuB,EAAE,WAAW,EAAE,IAAK,EAAE,WAAY,EAAA;AAClG,IAAA,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;;;IAItB,IAAI,WAAW,EAAE;QACb,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;KAC/C;;;;;AAMD,IAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,KAAI;AACvB,QAAA,GAAG,CAAC,MAAM,CAAC,kCAAkC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,QAAA,GAAG,CAAC,MAAM,CAAC,8BAA8B,EAAE,qBAAqB,CAAC,CAAC;AAClE,QAAA,GAAG,CAAC,MAAM,CACN,8BAA8B,EAC9B,6EAA6E,CAChF,CAAC;AACF,QAAA,IAAI,EAAE,CAAC;AACX,KAAC,CAAC,CAAC;;;;IAKH,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;AAG5D,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;;IAID,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;;AAG5D,IAAA,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAE1B,IAAA,IAAI,WAAW,KAAK,IAAI,EAAE;AACtB,QAAA,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;KACxB;AAED,IAAA,GAAG,CAAC,GAAG,CACH,UAAU,CAAC;AACP,QAAA,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,KAAI;;AAErB,YAAA,GAAW,CAAC,OAAO,GAAG,GAAG,CAAC;SAC9B;AACJ,KAAA,CAAC,CACL,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEpF,IAAA,KAAK,MAAM,eAAe,IAAI,OAAO,CAAC,WAAW,EAAE;QAC/C,eAAe,CAAC,GAAG,CAAC,CAAC;KACxB;;;;IAKD,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC;;AAG7D,IAAA,MAAM,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,OAAO,EAAE;AACT,QAAA,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;KAC5B;AAED,IAAA,OAAO,GAAG,CAAC;AACf"}

package/lib/servers/GraphqlServer.cjs

@@ -1,4 +1,4 @@
-'use strict';var server=require('@apollo/server'),express4=require('@apollo/server/express4'),cacheControl=require('@apollo/server/plugin/cacheControl'),drainHttpServer=require('@apollo/server/plugin/drainHttpServer');require('isomorphic-fetch');var express=require('express'),cors=require('cors'),Keyv=require('keyv'),KeyvRedis=require('@keyv/redis'),utils_keyvadapter=require('@apollo/utils.keyvadapter'),ws=require('ws'),storeRedis=require('@common-stack/store-redis'),GraphqlWs=require('./GraphqlWs.cjs'),envConfig=require('../config/env-config.cjs');if ((process.env.LOG_LEVEL && process.env.LOG_LEVEL === 'trace') || process.env.LOG_LEVEL === 'debug') ;
+'use strict';var server=require('@apollo/server'),express4=require('@apollo/server/express4'),cacheControl=require('@apollo/server/plugin/cacheControl');require('isomorphic-fetch');var expressAdapter=require('../express-adapter.cjs'),cors=require('../middleware/cors.cjs'),Keyv=require('keyv'),KeyvRedis=require('@keyv/redis'),utils_keyvadapter=require('@apollo/utils.keyvadapter'),storeRedis=require('@common-stack/store-redis'),GraphqlWs=require('./GraphqlWs.cjs'),envConfig=require('../config/env-config.cjs');if ((process.env.LOG_LEVEL && process.env.LOG_LEVEL === 'trace') || process.env.LOG_LEVEL === 'debug') ;
 // @workaround as the `dataSources` not available in Subscription (websocket) Context.
 // https://github.com/apollographql/apollo-server/issues/1526 need to revisit in Apollo-Server v3.
 const constructDataSourcesForSubscriptions = (context, cache, dataSources) => {
@@ -12,7 +12,7 @@ const constructDataSourcesForSubscriptions = (context, cache, dataSources) => {
 };
 class GraphqlServer {
     app;
-    httpServer;
+    wsServerHost;
     redisClient;
     moduleService;
     enableSubscription;
@@ -21,9 +21,10 @@ class GraphqlServer {
     plugins;
     logger;
     graphqlWsServer;
-    constructor(app, httpServer, redisClient, moduleService, enableSubscription = true, cacheKeyGenerator, invalidateCacheKeyGenerator, plugins) {
+    constructor(app, wsServerHost, // ultimate-express app or http.Server
+    redisClient, moduleService, enableSubscription = true, cacheKeyGenerator, invalidateCacheKeyGenerator, plugins) {
         this.app = app;
-        this.httpServer = httpServer;
+        this.wsServerHost = wsServerHost;
         this.redisClient = redisClient;
         this.moduleService = moduleService;
         this.enableSubscription = enableSubscription;
@@ -32,8 +33,11 @@ class GraphqlServer {
         this.plugins = plugins;
         this.logger = this.moduleService.logger.child({ className: 'GraphqlServer' });
         if (enableSubscription) {
-            const wsServer = new ws.WebSocketServer({
-                server: this.httpServer,
+            // WebSocketServer binds to different hosts depending on engine:
+            // - ultimate-express: pass the app as 'server' (ultimate-ws)
+            // - classic express: pass the httpServer as 'server' (ws)
+            const wsServer = new expressAdapter.WebSocketServer({
+                server: this.wsServerHost,
                 path: envConfig.config.GRAPHQL_ENDPOINT,
             });
             this.graphqlWsServer = new GraphqlWs.GraphqlWs(wsServer, this.moduleService, this.redisClient);
@@ -46,11 +50,7 @@ class GraphqlServer {
         }
         const apolloServer = this.configureApolloServer();
         await apolloServer.start();
-        const corsOptions = {
-            origin: [envConfig.config.CLIENT_URL],
-            credentials: true,
-        };
-        this.app.use(__GRAPHQL_ENDPOINT__, cors(corsOptions), express.json(), express4.expressMiddleware(apolloServer, {
+        this.app.use(__GRAPHQL_ENDPOINT__, cors.corsMiddleware, expressAdapter.express.json(), express4.expressMiddleware(apolloServer, {
             context: async ({ req, res, connection }) => {
                 let context;
                 let addons = {};
@@ -117,17 +117,29 @@ class GraphqlServer {
         const cacheSet = cacheAdapter.set.bind(cacheAdapter);
         cacheAdapter.set = (key, value, opts) => cacheSet(key.replaceAll('fqc:', ''), value, opts);
         const { cacheKeyGenerator, invalidateCacheKeyGenerator, logger } = this;
+        const serverPlugins = [
+            cacheControl.ApolloServerPluginCacheControl(),
+            storeRedis.invalidateCachePlugin({ cache: this.redisClient, invalidateCacheKeyGenerator }),
+            storeRedis.responseCachePlugin({ logger, cacheKeyGenerator }),
+            ...(this.plugins ?? []),
+        ];
+        // For classic express, add drain plugin to gracefully close the HTTP server.
+        // ultimate-express (uWebSockets.js) handles connection draining natively.
+        if (!expressAdapter.isUltimateEngine && this.wsServerHost) {
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                const { ApolloServerPluginDrainHttpServer } = require('@apollo/server/plugin/drainHttpServer');
+                serverPlugins.push(ApolloServerPluginDrainHttpServer({ httpServer: this.wsServerHost }));
+            }
+            catch {
+                // Plugin not available — skip
+            }
+        }
         const serverConfig = {
             schema: this.moduleService.schema,
             allowBatchedHttpRequests: true,
             cache: cacheAdapter,
-            plugins: [
-                drainHttpServer.ApolloServerPluginDrainHttpServer({ httpServer: this.httpServer }),
-                cacheControl.ApolloServerPluginCacheControl(),
-                storeRedis.invalidateCachePlugin({ cache: this.redisClient, invalidateCacheKeyGenerator }),
-                storeRedis.responseCachePlugin({ logger, cacheKeyGenerator }),
-                ...(this.plugins ?? []),
-            ],
+            plugins: serverPlugins,
         };
         if (this.enableSubscription) {
             serverConfig.plugins.push({

package/lib/servers/GraphqlServer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GraphqlServer.cjs","sources":["../../src/servers/GraphqlServer.ts"],"sourcesContent":[null],"names":["WebSocketServer","config","GraphqlWs","expressMiddleware","KeyvAdapter","ApolloServerPluginDrainHttpServer","ApolloServerPluginCacheControl","invalidateCachePlugin","responseCachePlugin","ApolloServer"],"mappings":"2iBAwBA,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAEtG;AAED;AACA;AACA,MAAM,oCAAoC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,KAAI;AACzE,IAAA,MAAM,oBAAoB,GAAG,CAAC,QAAQ,KAAI;QACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,KAAC,CAAC;AACF,IAAA,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;AAC5B,QAAA,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3C;AACD,IAAA,OAAO,WAAW,CAAC;AACvB,CAAC,CAAC;MAEW,aAAa,CAAA;AAMD,IAAA,GAAA,CAAA;AACA,IAAA,UAAA,CAAA;AACA,IAAA,WAAA,CAAA;AACA,IAAA,aAAA,CAAA;AACA,IAAA,kBAAA,CAAA;AACA,IAAA,iBAAA,CAAA;AACA,IAAA,2BAAA,CAAA;AACA,IAAA,OAAA,CAAA;AAZb,IAAA,MAAM,CAAU;AAEhB,IAAA,eAAe,CAAmB;AAE1C,IAAA,WAAA,CACqB,GAAY,EACZ,UAAuB,EACvB,WAA4C,EAC5C,aAA6B,EAC7B,kBAAA,GAAqB,IAAI,EACzB,iBAA6C,EAC7C,2BAAsD,EACtD,OAAmC,EAAA;QAPnC,IAAG,CAAA,GAAA,GAAH,GAAG,CAAS;QACZ,IAAU,CAAA,UAAA,GAAV,UAAU,CAAa;QACvB,IAAW,CAAA,WAAA,GAAX,WAAW,CAAiC;QAC5C,IAAa,CAAA,aAAA,GAAb,aAAa,CAAgB;QAC7B,IAAkB,CAAA,kBAAA,GAAlB,kBAAkB,CAAO;QACzB,IAAiB,CAAA,iBAAA,GAAjB,iBAAiB,CAA4B;QAC7C,IAA2B,CAAA,2BAAA,GAA3B,2BAA2B,CAA2B;QACtD,IAAO,CAAA,OAAA,GAAP,OAAO,CAA4B;AAEpD,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9E,IAAI,kBAAkB,EAAE;AACpB,YAAA,MAAM,QAAQ,GAAG,IAAIA,kBAAe,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,UAAU;gBACvB,IAAI,EAAEC,gBAAM,CAAC,gBAAgB;AAChC,aAAA,CAAC,CAAC;AACH,YAAA,IAAI,CAAC,eAAe,GAAG,IAAIC,mBAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;SACxF;KACJ;AAEM,IAAA,MAAM,UAAU,GAAA;AACnB,QAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAClD,QAAA,IAAI,IAAI,CAAC,eAAe,EAAE;AACtB,YAAA,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;SACjC;AACD,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;AAClD,QAAA,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;AAC3B,QAAA,MAAM,WAAW,GAAG;AAChB,YAAA,MAAM,EAAE,CAACD,gBAAM,CAAC,UAAU,CAAC;AAC3B,YAAA,WAAW,EAAE,IAAI;SACpB,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,GAAG,CACR,oBAAoB,EACpB,IAAI,CAAC,WAAW,CAAC,EACjB,OAAO,CAAC,IAAI,EAAE,EACdE,0BAAiB,CAAC,YAAY,EAAE;YAC5B,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAO,KAAI;AAC7C,gBAAA,IAAI,OAAO,CAAC;gBACZ,IAAI,MAAM,GAAG,EAAE,CAAC;AAChB,gBAAA,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;AAClD,gBAAA,IAAI;oBACA,IAAI,UAAU,EAAE;AACZ,wBAAA,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;AAC7B,wBAAA,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;AACtB,4BAAA,MAAM,GAAG;AACL,gCAAA,WAAW,EAAE,oCAAoC,CAC7C,UAAU,CAAC,OAAO,EAClB,IAAI,CAAC,WAAW,EAChB,WAAW,CACd;6BACJ,CAAC;yBACL;6BAAM;AACH,4BAAA,MAAM,GAAG;gCACL,WAAW;6BACd,CAAC;yBACL;qBACJ;yBAAM;AACH,wBAAA,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACrE,wBAAA,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1E,wBAAA,OAAO,GAAG;AACN,4BAAA,GAAG,WAAW;AACd,4BAAA,GAAG,eAAe;AAClB,4BAAA,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB;yBACrD,CAAC;qBACL;oBACD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;iBAC/C;gBAAC,OAAO,GAAG,EAAE;AACV,oBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,8CAA8C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACpF,oBAAA,MAAM,GAAG,CAAC;iBACb;gBACD,OAAO;oBACH,GAAG;oBACH,GAAG;oBACH,WAAW;AACX,oBAAA,GAAG,OAAO;AACV,oBAAA,GAAG,MAAM;iBACZ,CAAC;aACL;AACJ,SAAA,CAAC,CACL,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAEF,gBAAM,CAAC,UAAU,CAAC,CAAC;KACvE;AAED,IAAA,gBAAgB,CAAC,GAAG,EAAA;QAChB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,aAAa,CAAC;QACjG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE;AAC/B,YAAA,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACrB;AACD,QAAA,IAAI,EAAE,KAAK,KAAK,EAAE;YACd,EAAE,GAAG,WAAW,CAAC;SACpB;AACD,QAAA,OAAO,EAAE,CAAC;KACb;IAEO,qBAAqB,GAAA;QACzB,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAI;YAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;AACtD,SAAC,CAAC,CAAC;AAEH,QAAA,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAEA,gBAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE9E,QAAA,MAAM,YAAY,GAAG,IAAIG,6BAAW,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrD,QAAA,YAAY,CAAC,GAAG,GAAG,CAAC,GAAW,KAAK,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,YAAY,CAAC,GAAG,GAAG,CAAC,GAAW,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEnG,MAAM,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;AACxE,QAAA,MAAM,YAAY,GAAqC;AACnD,YAAA,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;AACjC,YAAA,wBAAwB,EAAE,IAAI;AAC9B,YAAA,KAAK,EAAE,YAAY;AACnB,YAAA,OAAO,EAAE;gBACLC,iDAAiC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAClE,gBAAAC,2CAA8B,EAAE;gBAChCC,gCAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,2BAA2B,EAAE,CAAC;AAC/E,gBAAAC,8BAAmB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAClD,gBAAA,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;AAC1B,aAAA;SACJ,CAAC;AAEF,QAAA,IAAI,IAAI,CAAC,kBAAkB,EAAE;AACzB,YAAA,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;AACtB,gBAAA,MAAM,eAAe,GAAA;AACjB,oBAAA,MAAM,QAAQ,GAAG;AACb,wBAAA,MAAM,WAAW,GAAA;AACb,4BAAA,MAAM,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;yBAC7C;qBACJ,CAAC;AACF,oBAAA,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,oBAAA,OAAO,QAAQ,CAAC;iBACnB;AACJ,aAAA,CAAC,CAAC;SACN;AAED,QAAA,OAAO,IAAIC,mBAAY,CAAC,YAAY,CAAC,CAAC;KACzC;AACJ"}
+{"version":3,"file":"GraphqlServer.cjs","sources":["../../src/servers/GraphqlServer.ts"],"sourcesContent":[null],"names":["WebSocketServer","config","GraphqlWs","corsMiddleware","express","expressMiddleware","KeyvAdapter","ApolloServerPluginCacheControl","invalidateCachePlugin","responseCachePlugin","isUltimateEngine","ApolloServer"],"mappings":"igBAsBA,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,EAAE,CAEtG;AAED;AACA;AACA,MAAM,oCAAoC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,KAAI;AACzE,IAAA,MAAM,oBAAoB,GAAG,CAAC,QAAQ,KAAI;QACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,KAAC,CAAC;AACF,IAAA,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE;AAC5B,QAAA,oBAAoB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3C;AACD,IAAA,OAAO,WAAW,CAAC;AACvB,CAAC,CAAC;MAEW,aAAa,CAAA;AAMD,IAAA,GAAA,CAAA;AACA,IAAA,YAAA,CAAA;AACA,IAAA,WAAA,CAAA;AACA,IAAA,aAAA,CAAA;AACA,IAAA,kBAAA,CAAA;AACA,IAAA,iBAAA,CAAA;AACA,IAAA,2BAAA,CAAA;AACA,IAAA,OAAA,CAAA;AAZb,IAAA,MAAM,CAAU;AAEhB,IAAA,eAAe,CAAmB;AAE1C,IAAA,WAAA,CACqB,GAAY,EACZ,YAAiB;IACjB,WAA4C,EAC5C,aAA6B,EAC7B,kBAAqB,GAAA,IAAI,EACzB,iBAA6C,EAC7C,2BAAsD,EACtD,OAAmC,EAAA;QAPnC,IAAG,CAAA,GAAA,GAAH,GAAG,CAAS;QACZ,IAAY,CAAA,YAAA,GAAZ,YAAY,CAAK;QACjB,IAAW,CAAA,WAAA,GAAX,WAAW,CAAiC;QAC5C,IAAa,CAAA,aAAA,GAAb,aAAa,CAAgB;QAC7B,IAAkB,CAAA,kBAAA,GAAlB,kBAAkB,CAAO;QACzB,IAAiB,CAAA,iBAAA,GAAjB,iBAAiB,CAA4B;QAC7C,IAA2B,CAAA,2BAAA,GAA3B,2BAA2B,CAA2B;QACtD,IAAO,CAAA,OAAA,GAAP,OAAO,CAA4B;AAEpD,QAAA,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9E,IAAI,kBAAkB,EAAE;;;;AAIpB,YAAA,MAAM,QAAQ,GAAG,IAAIA,8BAAe,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,IAAI,EAAEC,gBAAM,CAAC,gBAAgB;AAChC,aAAA,CAAC,CAAC;AACH,YAAA,IAAI,CAAC,eAAe,GAAG,IAAIC,mBAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;SACxF;KACJ;AAEM,IAAA,MAAM,UAAU,GAAA;AACnB,QAAA,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAClD,QAAA,IAAI,IAAI,CAAC,eAAe,EAAE;AACtB,YAAA,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;SACjC;AACD,QAAA,MAAM,YAAY,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;AAClD,QAAA,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;AAE3B,QAAA,IAAI,CAAC,GAAG,CAAC,GAAG,CACR,oBAAoB,EACpBC,mBAAc,EACdC,sBAAO,CAAC,IAAI,EAAE,EACdC,0BAAiB,CAAC,YAAY,EAAE;YAC5B,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAO,KAAI;AAC7C,gBAAA,IAAI,OAAO,CAAC;gBACZ,IAAI,MAAM,GAAG,EAAE,CAAC;AAChB,gBAAA,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC;AAClD,gBAAA,IAAI;oBACA,IAAI,UAAU,EAAE;AACZ,wBAAA,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;AAC7B,wBAAA,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;AACtB,4BAAA,MAAM,GAAG;AACL,gCAAA,WAAW,EAAE,oCAAoC,CAC7C,UAAU,CAAC,OAAO,EAClB,IAAI,CAAC,WAAW,EAChB,WAAW,CACd;6BACJ,CAAC;yBACL;6BAAM;AACH,4BAAA,MAAM,GAAG;gCACL,WAAW;6BACd,CAAC;yBACL;qBACJ;yBAAM;AACH,wBAAA,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AACrE,wBAAA,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1E,wBAAA,OAAO,GAAG;AACN,4BAAA,GAAG,WAAW;AACd,4BAAA,GAAG,eAAe;AAClB,4BAAA,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,kBAAkB;yBACrD,CAAC;qBACL;oBACD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;iBAC/C;gBAAC,OAAO,GAAG,EAAE;AACV,oBAAA,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,8CAA8C,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACpF,oBAAA,MAAM,GAAG,CAAC;iBACb;gBACD,OAAO;oBACH,GAAG;oBACH,GAAG;oBACH,WAAW;AACX,oBAAA,GAAG,OAAO;AACV,oBAAA,GAAG,MAAM;iBACZ,CAAC;aACL;AACJ,SAAA,CAAC,CACL,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAEJ,gBAAM,CAAC,UAAU,CAAC,CAAC;KACvE;AAED,IAAA,gBAAgB,CAAC,GAAG,EAAA;QAChB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,UAAU,EAAE,aAAa,CAAC;QACjG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS,EAAE;AAC/B,YAAA,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SACrB;AACD,QAAA,IAAI,EAAE,KAAK,KAAK,EAAE;YACd,EAAE,GAAG,WAAW,CAAC;SACpB;AACD,QAAA,OAAO,EAAE,CAAC;KACb;IAEO,qBAAqB,GAAA;QACzB,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAI;YAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;AACtD,SAAC,CAAC,CAAC;AAEH,QAAA,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAEA,gBAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;AAE9E,QAAA,MAAM,YAAY,GAAG,IAAIK,6BAAW,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AACrD,QAAA,YAAY,CAAC,GAAG,GAAG,CAAC,GAAW,KAAK,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrD,YAAY,CAAC,GAAG,GAAG,CAAC,GAAW,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEnG,MAAM,EAAE,iBAAiB,EAAE,2BAA2B,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;AAExE,QAAA,MAAM,aAAa,GAA8B;AAC7C,YAAAC,2CAA8B,EAAE;YAChCC,gCAAqB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,2BAA2B,EAAE,CAAC;AAC/E,YAAAC,8BAAmB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AAClD,YAAA,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SAC1B,CAAC;;;AAIF,QAAA,IAAI,CAACC,+BAAgB,IAAI,IAAI,CAAC,YAAY,EAAE;AACxC,YAAA,IAAI;;gBAEA,MAAM,EAAE,iCAAiC,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAAC,CAAC;AAC/F,gBAAA,aAAa,CAAC,IAAI,CAAC,iCAAiC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;aAC5F;AAAC,YAAA,MAAM;;aAEP;SACJ;AAED,QAAA,MAAM,YAAY,GAAqC;AACnD,YAAA,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM;AACjC,YAAA,wBAAwB,EAAE,IAAI;AAC9B,YAAA,KAAK,EAAE,YAAY;AACnB,YAAA,OAAO,EAAE,aAAa;SACzB,CAAC;AAEF,QAAA,IAAI,IAAI,CAAC,kBAAkB,EAAE;AACzB,YAAA,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;AACtB,gBAAA,MAAM,eAAe,GAAA;AACjB,oBAAA,MAAM,QAAQ,GAAG;AACb,wBAAA,MAAM,WAAW,GAAA;AACb,4BAAA,MAAM,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;yBAC7C;qBACJ,CAAC;AACF,oBAAA,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,oBAAA,OAAO,QAAQ,CAAC;iBACnB;AACJ,aAAA,CAAC,CAAC;SACN;AAED,QAAA,OAAO,IAAIC,mBAAY,CAAC,YAAY,CAAC,CAAC;KACzC;AACJ"}

package/lib/servers/GraphqlServer.mjs

@@ -1,4 +1,4 @@
-import {ApolloServer}from'@apollo/server';import {expressMiddleware}from'@apollo/server/express4';import {ApolloServerPluginCacheControl}from'@apollo/server/plugin/cacheControl';import {ApolloServerPluginDrainHttpServer}from'@apollo/server/plugin/drainHttpServer';import'isomorphic-fetch';import express from'express';import cors from'cors';import Keyv from'keyv';import KeyvRedis from'@keyv/redis';import {KeyvAdapter}from'@apollo/utils.keyvadapter';import {WebSocketServer}from'ws';import {invalidateCachePlugin,responseCachePlugin}from'@common-stack/store-redis';import {GraphqlWs}from'./GraphqlWs.mjs';import {config}from'../config/env-config.mjs';if ((process.env.LOG_LEVEL && process.env.LOG_LEVEL === 'trace') || process.env.LOG_LEVEL === 'debug') ;
+import {ApolloServer}from'@apollo/server';import {expressMiddleware}from'@apollo/server/express4';import {ApolloServerPluginCacheControl}from'@apollo/server/plugin/cacheControl';import'isomorphic-fetch';import {WebSocketServer,express,isUltimateEngine}from'../express-adapter.mjs';import {corsMiddleware}from'../middleware/cors.mjs';import Keyv from'keyv';import KeyvRedis from'@keyv/redis';import {KeyvAdapter}from'@apollo/utils.keyvadapter';import {invalidateCachePlugin,responseCachePlugin}from'@common-stack/store-redis';import {GraphqlWs}from'./GraphqlWs.mjs';import {config}from'../config/env-config.mjs';if ((process.env.LOG_LEVEL && process.env.LOG_LEVEL === 'trace') || process.env.LOG_LEVEL === 'debug') ;
 // @workaround as the `dataSources` not available in Subscription (websocket) Context.
 // https://github.com/apollographql/apollo-server/issues/1526 need to revisit in Apollo-Server v3.
 const constructDataSourcesForSubscriptions = (context, cache, dataSources) => {
@@ -12,7 +12,7 @@ const constructDataSourcesForSubscriptions = (context, cache, dataSources) => {
 };
 class GraphqlServer {
     app;
-    httpServer;
+    wsServerHost;
     redisClient;
     moduleService;
     enableSubscription;
@@ -21,9 +21,10 @@ class GraphqlServer {
     plugins;
     logger;
     graphqlWsServer;
-    constructor(app, httpServer, redisClient, moduleService, enableSubscription = true, cacheKeyGenerator, invalidateCacheKeyGenerator, plugins) {
+    constructor(app, wsServerHost, // ultimate-express app or http.Server
+    redisClient, moduleService, enableSubscription = true, cacheKeyGenerator, invalidateCacheKeyGenerator, plugins) {
         this.app = app;
-        this.httpServer = httpServer;
+        this.wsServerHost = wsServerHost;
         this.redisClient = redisClient;
         this.moduleService = moduleService;
         this.enableSubscription = enableSubscription;
@@ -32,8 +33,11 @@ class GraphqlServer {
         this.plugins = plugins;
         this.logger = this.moduleService.logger.child({ className: 'GraphqlServer' });
         if (enableSubscription) {
+            // WebSocketServer binds to different hosts depending on engine:
+            // - ultimate-express: pass the app as 'server' (ultimate-ws)
+            // - classic express: pass the httpServer as 'server' (ws)
             const wsServer = new WebSocketServer({
-                server: this.httpServer,
+                server: this.wsServerHost,
                 path: config.GRAPHQL_ENDPOINT,
             });
             this.graphqlWsServer = new GraphqlWs(wsServer, this.moduleService, this.redisClient);
@@ -46,11 +50,7 @@ class GraphqlServer {
         }
         const apolloServer = this.configureApolloServer();
         await apolloServer.start();
-        const corsOptions = {
-            origin: [config.CLIENT_URL],
-            credentials: true,
-        };
-        this.app.use(__GRAPHQL_ENDPOINT__, cors(corsOptions), express.json(), expressMiddleware(apolloServer, {
+        this.app.use(__GRAPHQL_ENDPOINT__, corsMiddleware, express.json(), expressMiddleware(apolloServer, {
             context: async ({ req, res, connection }) => {
                 let context;
                 let addons = {};
@@ -117,17 +117,29 @@ class GraphqlServer {
         const cacheSet = cacheAdapter.set.bind(cacheAdapter);
         cacheAdapter.set = (key, value, opts) => cacheSet(key.replaceAll('fqc:', ''), value, opts);
         const { cacheKeyGenerator, invalidateCacheKeyGenerator, logger } = this;
+        const serverPlugins = [
+            ApolloServerPluginCacheControl(),
+            invalidateCachePlugin({ cache: this.redisClient, invalidateCacheKeyGenerator }),
+            responseCachePlugin({ logger, cacheKeyGenerator }),
+            ...(this.plugins ?? []),
+        ];
+        // For classic express, add drain plugin to gracefully close the HTTP server.
+        // ultimate-express (uWebSockets.js) handles connection draining natively.
+        if (!isUltimateEngine && this.wsServerHost) {
+            try {
+                // eslint-disable-next-line @typescript-eslint/no-var-requires
+                const { ApolloServerPluginDrainHttpServer } = require('@apollo/server/plugin/drainHttpServer');
+                serverPlugins.push(ApolloServerPluginDrainHttpServer({ httpServer: this.wsServerHost }));
+            }
+            catch {
+                // Plugin not available — skip
+            }
+        }
         const serverConfig = {
             schema: this.moduleService.schema,
             allowBatchedHttpRequests: true,
             cache: cacheAdapter,
-            plugins: [
-                ApolloServerPluginDrainHttpServer({ httpServer: this.httpServer }),
-                ApolloServerPluginCacheControl(),
-                invalidateCachePlugin({ cache: this.redisClient, invalidateCacheKeyGenerator }),
-                responseCachePlugin({ logger, cacheKeyGenerator }),
-                ...(this.plugins ?? []),
-            ],
+            plugins: serverPlugins,
         };
         if (this.enableSubscription) {
             serverConfig.plugins.push({