@constructive-io/express-context 0.12.1 → 0.13.0

package/context.js

@@ -64,9 +64,9 @@ function buildContext(req, opts = {}) {
     // Build loader context (if registry provided and databaseId known)
     let loaderCtx = null;
     if (opts.loaders && api.databaseId) {
-        const servicesPool = (0, pg_cache_1.getPgPool)(opts.pg);
+        const routingPool = (0, pg_cache_1.getPgPool)(opts.pg);
         loaderCtx = {
-            servicesPool,
+            routingPool,
             tenantPool,
             databaseId: api.databaseId,
             apiId: api.apiId,

package/esm/context.js

@@ -60,9 +60,9 @@ export function buildContext(req, opts = {}) {
     // Build loader context (if registry provided and databaseId known)
     let loaderCtx = null;
     if (opts.loaders && api.databaseId) {
-        const servicesPool = getPgPool(opts.pg);
+        const routingPool = getPgPool(opts.pg);
         loaderCtx = {
-            servicesPool,
+            routingPool,
             tenantPool,
             databaseId: api.databaseId,
             apiId: api.apiId,

package/esm/loaders/auth-settings.js

@@ -7,7 +7,7 @@
  *   2. Query the discovered <schema>.<table> in the tenant DB
  *
  * This is the pattern for any module whose config lives in the tenant
- * database rather than the services database.
+ * database rather than the routing database.
  */
 import { createModuleLoader } from './create-loader';
 // ─── SQL ────────────────────────────────────────────────────────────────────
@@ -56,7 +56,7 @@ export const authSettingsLoader = createModuleLoader({
             cookiePath: row.cookie_path,
             rememberMeDuration: row.remember_me_duration,
             enableCaptcha: row.enable_captcha,
-            captchaSiteKey: row.captcha_site_key,
+            captchaSiteKey: row.captcha_site_key
         };
-    },
+    }
 });

package/esm/loaders/cors.js

@@ -1,27 +1,27 @@
 /**
  * CORS Origins Loader
  *
- * Resolves allowed CORS origins for a database+API combination.
- * Checks per-API settings first, falls back to database-level default,
- * then to the legacy api_modules approach.
+ * Resolves allowed CORS origins for a database+API combination from the
+ * scoped routing plane. Checks per-API settings first, falls back to
+ * database-level default, then to the api_modules approach.
  */
 import { createModuleLoader } from './create-loader';
 // ─── SQL ────────────────────────────────────────────────────────────────────
 const CORS_SETTINGS_SQL = `
   SELECT allowed_origins
-  FROM services_public.cors_settings
+  FROM constructive_routing_public.cors_settings
   WHERE database_id = $1 AND api_id = $2
   LIMIT 1
 `;
 const CORS_SETTINGS_DB_DEFAULT_SQL = `
   SELECT allowed_origins
-  FROM services_public.cors_settings
+  FROM constructive_routing_public.cors_settings
   WHERE database_id = $1 AND api_id IS NULL
   LIMIT 1
 `;
 const CORS_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'cors'
   LIMIT 1
 `;
@@ -30,26 +30,26 @@ export const corsLoader = createModuleLoader({
     name: 'corsOrigins',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try per-API cors_settings first
         try {
             if (apiId) {
-                const perApi = await servicesPool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
+                const perApi = await routingPool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
                 if (perApi.rows[0])
                     return perApi.rows[0].allowed_origins;
             }
-            const dbDefault = await servicesPool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
+            const dbDefault = await routingPool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
             if (dbDefault.rows[0])
                 return dbDefault.rows[0].allowed_origins;
         }
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(CORS_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(CORS_MODULE_SQL, [apiId]);
             return result.rows[0]?.data?.urls;
         }
         return undefined;
-    },
+    }
 });

package/esm/loaders/database-settings.js

@@ -21,8 +21,8 @@ const DATABASE_SETTINGS_SQL = `
     COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
     COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk,
     COALESCE(aps.enable_i18n, ds.enable_i18n) AS resolved_enable_i18n
-  FROM services_public.database_settings ds
-  LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
+  FROM constructive_routing_public.database_settings ds
+  LEFT JOIN constructive_routing_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
   WHERE ds.database_id = $1
   LIMIT 1
 `;
@@ -31,8 +31,8 @@ export const databaseSettingsLoader = createModuleLoader({
     name: 'databaseSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
-        const result = await servicesPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
+        const { routingPool, databaseId, apiId } = ctx;
+        const result = await routingPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
         const row = result.rows[0];
         if (!row)
             return undefined;
@@ -48,7 +48,7 @@ export const databaseSettingsLoader = createModuleLoader({
             enableLlm: row.resolved_enable_llm,
             enableRealtime: row.resolved_enable_realtime,
             enableBulk: row.resolved_enable_bulk,
-            enableI18n: row.resolved_enable_i18n,
+            enableI18n: row.resolved_enable_i18n
         };
-    },
+    }
 });

package/esm/loaders/index.js

@@ -6,11 +6,11 @@
  * a LoaderRegistry and pass it to createContextMiddleware().
  *
  * Built-in loaders cover the standard Constructive modules:
- *   - rlsModule       (services_public.rls_settings)
- *   - corsOrigins     (services_public.cors_settings)
- *   - databaseSettings(services_public.database_settings)
- *   - pubkeyChallengeSettings (services_public.pubkey_settings)
- *   - webauthnSettings(services_public.webauthn_settings)
+ *   - rlsModule       (constructive_routing_public.rls_settings)
+ *   - corsOrigins     (constructive_routing_public.cors_settings)
+ *   - databaseSettings(constructive_routing_public.database_settings)
+ *   - pubkeyChallengeSettings (constructive_routing_public.pubkey_settings)
+ *   - webauthnSettings(constructive_routing_public.webauthn_settings)
  *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
  *
  * To add a new per-db lookup, implement a ModuleLoader and register it:
@@ -28,32 +28,32 @@
 export { createModuleLoader } from './create-loader';
 export { createLoaderRegistry } from './registry';
 // Built-in loaders
-export { rlsLoader } from './rls';
-export { corsLoader } from './cors';
-export { databaseSettingsLoader } from './database-settings';
-export { pubkeyLoader } from './pubkey';
-export { webauthnLoader } from './webauthn';
+export { agentChatLoader } from './agent-chat';
 export { authSettingsLoader } from './auth-settings';
 export { billingLoader } from './billing';
+export { computeLoader } from './compute';
+export { corsLoader } from './cors';
+export { databaseSettingsLoader } from './database-settings';
 export { inferenceLogLoader } from './inference-log';
-export { agentChatLoader } from './agent-chat';
 export { llmLoader } from './llm';
-export { computeLoader } from './compute';
+export { pubkeyLoader } from './pubkey';
+export { rlsLoader } from './rls';
+export { webauthnLoader } from './webauthn';
 /**
  * Convenience: create a registry pre-loaded with all built-in loaders.
  */
-import { createLoaderRegistry } from './registry';
-import { rlsLoader } from './rls';
-import { corsLoader } from './cors';
-import { databaseSettingsLoader } from './database-settings';
-import { pubkeyLoader } from './pubkey';
-import { webauthnLoader } from './webauthn';
+import { agentChatLoader } from './agent-chat';
 import { authSettingsLoader } from './auth-settings';
 import { billingLoader } from './billing';
+import { computeLoader } from './compute';
+import { corsLoader } from './cors';
+import { databaseSettingsLoader } from './database-settings';
 import { inferenceLogLoader } from './inference-log';
-import { agentChatLoader } from './agent-chat';
 import { llmLoader } from './llm';
-import { computeLoader } from './compute';
+import { pubkeyLoader } from './pubkey';
+import { createLoaderRegistry } from './registry';
+import { rlsLoader } from './rls';
+import { webauthnLoader } from './webauthn';
 export function createDefaultRegistry() {
     const registry = createLoaderRegistry();
     registry.register(rlsLoader);

package/esm/loaders/pubkey.js

@@ -2,8 +2,8 @@
  * Pubkey Challenge Settings Loader
  *
  * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
- * function names). Tries the new pubkey_settings table first, falls back
- * to the legacy api_modules approach.
+ * function names) from the scoped routing plane. Tries the pubkey_settings
+ * table first, falls back to the api_modules approach.
  */
 import { createModuleLoader } from './create-loader';
 // ─── SQL ────────────────────────────────────────────────────────────────────
@@ -15,7 +15,7 @@ const PUBKEY_SETTINGS_SQL = `
     sign_in_req_fn.name AS sign_in_request_challenge,
     sign_in_fail_fn.name AS sign_in_record_failure,
     sign_in_fn.name AS sign_in_with_challenge
-  FROM services_public.pubkey_settings ps
+  FROM constructive_routing_public.pubkey_settings ps
   LEFT JOIN metaschema_public.schema s ON ps.schema_id = s.id
   LEFT JOIN metaschema_public.function sign_up_fn ON ps.sign_up_with_key_function_id = sign_up_fn.id
   LEFT JOIN metaschema_public.function sign_in_req_fn ON ps.sign_in_request_challenge_function_id = sign_in_req_fn.id
@@ -26,7 +26,7 @@ const PUBKEY_SETTINGS_SQL = `
 `;
 const PUBKEY_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'pubkey_challenge'
   LIMIT 1
 `;
@@ -40,7 +40,7 @@ function fromRow(row) {
         signUpWithKey: row.sign_up_with_key,
         signInRequestChallenge: row.sign_in_request_challenge,
         signInRecordFailure: row.sign_in_record_failure,
-        signInWithChallenge: row.sign_in_with_challenge,
+        signInWithChallenge: row.sign_in_with_challenge
     };
 }
 // ─── Loader ─────────────────────────────────────────────────────────────────
@@ -48,10 +48,10 @@ export const pubkeyLoader = createModuleLoader({
     name: 'pubkeyChallengeSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try new pubkey_settings table first
         try {
-            const result = await servicesPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
+            const result = await routingPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
             const resolved = fromRow(result.rows[0] ?? null);
             if (resolved)
                 return resolved;
@@ -59,11 +59,11 @@ export const pubkeyLoader = createModuleLoader({
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(PUBKEY_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(PUBKEY_MODULE_SQL, [apiId]);
             return fromRow(result.rows[0]?.data ?? null);
         }
         return undefined;
-    },
+    }
 });

package/esm/loaders/rls.js

@@ -2,8 +2,8 @@
  * RLS Module Loader
  *
  * Resolves RLS authentication function names and schema references for
- * a given database. Tries the new rls_settings table first, falls back
- * to the legacy api_modules approach.
+ * a given database from the scoped routing plane. Tries the rls_settings
+ * table first, falls back to the api_modules approach.
  */
 import { createModuleLoader } from './create-loader';
 // ─── SQL ────────────────────────────────────────────────────────────────────
@@ -17,7 +17,7 @@ const RLS_SETTINGS_SQL = `
     role_id_fn.name AS current_role_id,
     ua_fn.name AS current_user_agent,
     ip_fn.name AS current_ip_address
-  FROM services_public.rls_settings rs
+  FROM constructive_routing_public.rls_settings rs
   LEFT JOIN metaschema_public.schema auth_schema ON rs.authenticate_schema_id = auth_schema.id
   LEFT JOIN metaschema_public.schema role_schema ON rs.role_schema_id = role_schema.id
   LEFT JOIN metaschema_public.function auth_fn ON rs.authenticate_function_id = auth_fn.id
@@ -31,7 +31,7 @@ const RLS_SETTINGS_SQL = `
 `;
 const RLS_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'rls_module'
   LIMIT 1
 `;
@@ -49,7 +49,7 @@ function fromSettings(row) {
         currentRole: row.current_role,
         currentRoleId: row.current_role_id,
         currentIpAddress: row.current_ip_address,
-        currentUserAgent: row.current_user_agent,
+        currentUserAgent: row.current_user_agent
     };
 }
 function fromModule(row) {
@@ -64,7 +64,7 @@ function fromModule(row) {
         currentRole: d.current_role,
         currentRoleId: d.current_role_id,
         currentIpAddress: d.current_ip_address,
-        currentUserAgent: d.current_user_agent,
+        currentUserAgent: d.current_user_agent
     };
 }
 // ─── Loader ─────────────────────────────────────────────────────────────────
@@ -72,10 +72,10 @@ export const rlsLoader = createModuleLoader({
     name: 'rlsModule',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try new rls_settings table first
         try {
-            const result = await servicesPool.query(RLS_SETTINGS_SQL, [databaseId]);
+            const result = await routingPool.query(RLS_SETTINGS_SQL, [databaseId]);
             const resolved = fromSettings(result.rows[0] ?? null);
             if (resolved)
                 return resolved;
@@ -83,11 +83,11 @@ export const rlsLoader = createModuleLoader({
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(RLS_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(RLS_MODULE_SQL, [apiId]);
             return fromModule(result.rows[0] ?? null);
         }
         return undefined;
-    },
+    }
 });

package/esm/loaders/types.js

@@ -2,7 +2,7 @@
  * Module Loader Types
  *
  * A ModuleLoader is a per-database cached lookup that resolves config
- * from the services DB or tenant DB. Each loader owns its own LRU cache
+ * from the routing DB or tenant DB. Each loader owns its own LRU cache
  * keyed by databaseId, with independent TTL and eviction.
  *
  * Loaders are registered in a LoaderRegistry and resolved in parallel

package/esm/loaders/webauthn.js

@@ -19,7 +19,7 @@ const WEBAUTHN_SETTINGS_SQL = `
     ws.require_user_verification,
     ws.resident_key,
     ws.challenge_expiry_seconds
-  FROM services_public.webauthn_settings ws
+  FROM constructive_routing_public.webauthn_settings ws
   LEFT JOIN metaschema_public.schema s ON ws.schema_id = s.id
   LEFT JOIN metaschema_public.schema cred_s ON ws.credentials_schema_id = cred_s.id
   LEFT JOIN metaschema_public.schema sess_s ON ws.sessions_schema_id = sess_s.id
@@ -32,8 +32,8 @@ export const webauthnLoader = createModuleLoader({
     name: 'webauthnSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId } = ctx;
-        const result = await servicesPool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
+        const { routingPool, databaseId } = ctx;
+        const result = await routingPool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
         const row = result.rows[0];
         if (!row?.schema)
             return undefined;
@@ -48,7 +48,7 @@ export const webauthnLoader = createModuleLoader({
             attestationType: row.attestation_type,
             requireUserVerification: row.require_user_verification,
             residentKey: row.resident_key,
-            challengeExpirySeconds: row.challenge_expiry_seconds,
+            challengeExpirySeconds: row.challenge_expiry_seconds
         };
-    },
+    }
 });

package/esm/pg-settings.js

@@ -39,8 +39,9 @@ export function buildPgSettings(input) {
         settings['jwt.claims.database_id'] = api.databaseId;
     }
     // API provenance — which API surface this request arrived through.
-    // Derived server-side from hostname -> services_public.domains -> api_id;
-    // never taken from client-supplied headers, body, or token payload.
+    // Derived server-side by resolving the hostname through the scoped routing
+    // plane (resolve_route -> api_id); never taken from client-supplied headers,
+    // body, or token payload.
     if (api.apiId) {
         settings['jwt.claims.api_id'] = api.apiId;
     }

package/loaders/auth-settings.d.ts

@@ -7,7 +7,7 @@
  *   2. Query the discovered <schema>.<table> in the tenant DB
  *
  * This is the pattern for any module whose config lives in the tenant
- * database rather than the services database.
+ * database rather than the routing database.
  */
 import type { AuthSettings } from '../types';
 import type { ModuleLoader } from './types';

package/loaders/auth-settings.js

@@ -8,7 +8,7 @@
  *   2. Query the discovered <schema>.<table> in the tenant DB
  *
  * This is the pattern for any module whose config lives in the tenant
- * database rather than the services database.
+ * database rather than the routing database.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authSettingsLoader = void 0;
@@ -59,7 +59,7 @@ exports.authSettingsLoader = (0, create_loader_1.createModuleLoader)({
             cookiePath: row.cookie_path,
             rememberMeDuration: row.remember_me_duration,
             enableCaptcha: row.enable_captcha,
-            captchaSiteKey: row.captcha_site_key,
+            captchaSiteKey: row.captcha_site_key
         };
-    },
+    }
 });

package/loaders/cors.d.ts

@@ -1,9 +1,9 @@
 /**
  * CORS Origins Loader
  *
- * Resolves allowed CORS origins for a database+API combination.
- * Checks per-API settings first, falls back to database-level default,
- * then to the legacy api_modules approach.
+ * Resolves allowed CORS origins for a database+API combination from the
+ * scoped routing plane. Checks per-API settings first, falls back to
+ * database-level default, then to the api_modules approach.
  */
 import type { ModuleLoader } from './types';
 export declare const corsLoader: ModuleLoader<string[]>;

package/loaders/cors.js

@@ -2,9 +2,9 @@
 /**
  * CORS Origins Loader
  *
- * Resolves allowed CORS origins for a database+API combination.
- * Checks per-API settings first, falls back to database-level default,
- * then to the legacy api_modules approach.
+ * Resolves allowed CORS origins for a database+API combination from the
+ * scoped routing plane. Checks per-API settings first, falls back to
+ * database-level default, then to the api_modules approach.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.corsLoader = void 0;
@@ -12,19 +12,19 @@ const create_loader_1 = require("./create-loader");
 // ─── SQL ────────────────────────────────────────────────────────────────────
 const CORS_SETTINGS_SQL = `
   SELECT allowed_origins
-  FROM services_public.cors_settings
+  FROM constructive_routing_public.cors_settings
   WHERE database_id = $1 AND api_id = $2
   LIMIT 1
 `;
 const CORS_SETTINGS_DB_DEFAULT_SQL = `
   SELECT allowed_origins
-  FROM services_public.cors_settings
+  FROM constructive_routing_public.cors_settings
   WHERE database_id = $1 AND api_id IS NULL
   LIMIT 1
 `;
 const CORS_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'cors'
   LIMIT 1
 `;
@@ -33,26 +33,26 @@ exports.corsLoader = (0, create_loader_1.createModuleLoader)({
     name: 'corsOrigins',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try per-API cors_settings first
         try {
             if (apiId) {
-                const perApi = await servicesPool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
+                const perApi = await routingPool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
                 if (perApi.rows[0])
                     return perApi.rows[0].allowed_origins;
             }
-            const dbDefault = await servicesPool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
+            const dbDefault = await routingPool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
             if (dbDefault.rows[0])
                 return dbDefault.rows[0].allowed_origins;
         }
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(CORS_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(CORS_MODULE_SQL, [apiId]);
             return result.rows[0]?.data?.urls;
         }
         return undefined;
-    },
+    }
 });

package/loaders/database-settings.js

@@ -24,8 +24,8 @@ const DATABASE_SETTINGS_SQL = `
     COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
     COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk,
     COALESCE(aps.enable_i18n, ds.enable_i18n) AS resolved_enable_i18n
-  FROM services_public.database_settings ds
-  LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
+  FROM constructive_routing_public.database_settings ds
+  LEFT JOIN constructive_routing_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
   WHERE ds.database_id = $1
   LIMIT 1
 `;
@@ -34,8 +34,8 @@ exports.databaseSettingsLoader = (0, create_loader_1.createModuleLoader)({
     name: 'databaseSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
-        const result = await servicesPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
+        const { routingPool, databaseId, apiId } = ctx;
+        const result = await routingPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
         const row = result.rows[0];
         if (!row)
             return undefined;
@@ -51,7 +51,7 @@ exports.databaseSettingsLoader = (0, create_loader_1.createModuleLoader)({
             enableLlm: row.resolved_enable_llm,
             enableRealtime: row.resolved_enable_realtime,
             enableBulk: row.resolved_enable_bulk,
-            enableI18n: row.resolved_enable_i18n,
+            enableI18n: row.resolved_enable_i18n
         };
-    },
+    }
 });

package/loaders/index.d.ts

@@ -6,11 +6,11 @@
  * a LoaderRegistry and pass it to createContextMiddleware().
  *
  * Built-in loaders cover the standard Constructive modules:
- *   - rlsModule       (services_public.rls_settings)
- *   - corsOrigins     (services_public.cors_settings)
- *   - databaseSettings(services_public.database_settings)
- *   - pubkeyChallengeSettings (services_public.pubkey_settings)
- *   - webauthnSettings(services_public.webauthn_settings)
+ *   - rlsModule       (constructive_routing_public.rls_settings)
+ *   - corsOrigins     (constructive_routing_public.cors_settings)
+ *   - databaseSettings(constructive_routing_public.database_settings)
+ *   - pubkeyChallengeSettings (constructive_routing_public.pubkey_settings)
+ *   - webauthnSettings(constructive_routing_public.webauthn_settings)
  *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
  *
  * To add a new per-db lookup, implement a ModuleLoader and register it:
@@ -30,15 +30,15 @@ export type { CreateLoaderOptions } from './create-loader';
 export { createModuleLoader } from './create-loader';
 export type { LoaderRegistry } from './registry';
 export { createLoaderRegistry } from './registry';
-export { rlsLoader } from './rls';
-export { corsLoader } from './cors';
-export { databaseSettingsLoader } from './database-settings';
-export { pubkeyLoader } from './pubkey';
-export { webauthnLoader } from './webauthn';
+export { agentChatLoader } from './agent-chat';
 export { authSettingsLoader } from './auth-settings';
 export { billingLoader } from './billing';
+export { computeLoader } from './compute';
+export { corsLoader } from './cors';
+export { databaseSettingsLoader } from './database-settings';
 export { inferenceLogLoader } from './inference-log';
-export { agentChatLoader } from './agent-chat';
 export { llmLoader } from './llm';
-export { computeLoader } from './compute';
+export { pubkeyLoader } from './pubkey';
+export { rlsLoader } from './rls';
+export { webauthnLoader } from './webauthn';
 export declare function createDefaultRegistry(): import("./registry").LoaderRegistry;

package/loaders/index.js

@@ -7,11 +7,11 @@
  * a LoaderRegistry and pass it to createContextMiddleware().
  *
  * Built-in loaders cover the standard Constructive modules:
- *   - rlsModule       (services_public.rls_settings)
- *   - corsOrigins     (services_public.cors_settings)
- *   - databaseSettings(services_public.database_settings)
- *   - pubkeyChallengeSettings (services_public.pubkey_settings)
- *   - webauthnSettings(services_public.webauthn_settings)
+ *   - rlsModule       (constructive_routing_public.rls_settings)
+ *   - corsOrigins     (constructive_routing_public.cors_settings)
+ *   - databaseSettings(constructive_routing_public.database_settings)
+ *   - pubkeyChallengeSettings (constructive_routing_public.pubkey_settings)
+ *   - webauthnSettings(constructive_routing_public.webauthn_settings)
  *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
  *
  * To add a new per-db lookup, implement a ModuleLoader and register it:
@@ -27,50 +27,50 @@
  *   registry.register(myLoader);
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.computeLoader = exports.llmLoader = exports.agentChatLoader = exports.inferenceLogLoader = exports.billingLoader = exports.authSettingsLoader = exports.webauthnLoader = exports.pubkeyLoader = exports.databaseSettingsLoader = exports.corsLoader = exports.rlsLoader = exports.createLoaderRegistry = exports.createModuleLoader = void 0;
+exports.webauthnLoader = exports.rlsLoader = exports.pubkeyLoader = exports.llmLoader = exports.inferenceLogLoader = exports.databaseSettingsLoader = exports.corsLoader = exports.computeLoader = exports.billingLoader = exports.authSettingsLoader = exports.agentChatLoader = exports.createLoaderRegistry = exports.createModuleLoader = void 0;
 exports.createDefaultRegistry = createDefaultRegistry;
 var create_loader_1 = require("./create-loader");
 Object.defineProperty(exports, "createModuleLoader", { enumerable: true, get: function () { return create_loader_1.createModuleLoader; } });
 var registry_1 = require("./registry");
 Object.defineProperty(exports, "createLoaderRegistry", { enumerable: true, get: function () { return registry_1.createLoaderRegistry; } });
 // Built-in loaders
-var rls_1 = require("./rls");
-Object.defineProperty(exports, "rlsLoader", { enumerable: true, get: function () { return rls_1.rlsLoader; } });
-var cors_1 = require("./cors");
-Object.defineProperty(exports, "corsLoader", { enumerable: true, get: function () { return cors_1.corsLoader; } });
-var database_settings_1 = require("./database-settings");
-Object.defineProperty(exports, "databaseSettingsLoader", { enumerable: true, get: function () { return database_settings_1.databaseSettingsLoader; } });
-var pubkey_1 = require("./pubkey");
-Object.defineProperty(exports, "pubkeyLoader", { enumerable: true, get: function () { return pubkey_1.pubkeyLoader; } });
-var webauthn_1 = require("./webauthn");
-Object.defineProperty(exports, "webauthnLoader", { enumerable: true, get: function () { return webauthn_1.webauthnLoader; } });
+var agent_chat_1 = require("./agent-chat");
+Object.defineProperty(exports, "agentChatLoader", { enumerable: true, get: function () { return agent_chat_1.agentChatLoader; } });
 var auth_settings_1 = require("./auth-settings");
 Object.defineProperty(exports, "authSettingsLoader", { enumerable: true, get: function () { return auth_settings_1.authSettingsLoader; } });
 var billing_1 = require("./billing");
 Object.defineProperty(exports, "billingLoader", { enumerable: true, get: function () { return billing_1.billingLoader; } });
+var compute_1 = require("./compute");
+Object.defineProperty(exports, "computeLoader", { enumerable: true, get: function () { return compute_1.computeLoader; } });
+var cors_1 = require("./cors");
+Object.defineProperty(exports, "corsLoader", { enumerable: true, get: function () { return cors_1.corsLoader; } });
+var database_settings_1 = require("./database-settings");
+Object.defineProperty(exports, "databaseSettingsLoader", { enumerable: true, get: function () { return database_settings_1.databaseSettingsLoader; } });
 var inference_log_1 = require("./inference-log");
 Object.defineProperty(exports, "inferenceLogLoader", { enumerable: true, get: function () { return inference_log_1.inferenceLogLoader; } });
-var agent_chat_1 = require("./agent-chat");
-Object.defineProperty(exports, "agentChatLoader", { enumerable: true, get: function () { return agent_chat_1.agentChatLoader; } });
 var llm_1 = require("./llm");
 Object.defineProperty(exports, "llmLoader", { enumerable: true, get: function () { return llm_1.llmLoader; } });
-var compute_1 = require("./compute");
-Object.defineProperty(exports, "computeLoader", { enumerable: true, get: function () { return compute_1.computeLoader; } });
+var pubkey_1 = require("./pubkey");
+Object.defineProperty(exports, "pubkeyLoader", { enumerable: true, get: function () { return pubkey_1.pubkeyLoader; } });
+var rls_1 = require("./rls");
+Object.defineProperty(exports, "rlsLoader", { enumerable: true, get: function () { return rls_1.rlsLoader; } });
+var webauthn_1 = require("./webauthn");
+Object.defineProperty(exports, "webauthnLoader", { enumerable: true, get: function () { return webauthn_1.webauthnLoader; } });
 /**
  * Convenience: create a registry pre-loaded with all built-in loaders.
  */
-const registry_2 = require("./registry");
-const rls_2 = require("./rls");
-const cors_2 = require("./cors");
-const database_settings_2 = require("./database-settings");
-const pubkey_2 = require("./pubkey");
-const webauthn_2 = require("./webauthn");
+const agent_chat_2 = require("./agent-chat");
 const auth_settings_2 = require("./auth-settings");
 const billing_2 = require("./billing");
+const compute_2 = require("./compute");
+const cors_2 = require("./cors");
+const database_settings_2 = require("./database-settings");
 const inference_log_2 = require("./inference-log");
-const agent_chat_2 = require("./agent-chat");
 const llm_2 = require("./llm");
-const compute_2 = require("./compute");
+const pubkey_2 = require("./pubkey");
+const registry_2 = require("./registry");
+const rls_2 = require("./rls");
+const webauthn_2 = require("./webauthn");
 function createDefaultRegistry() {
     const registry = (0, registry_2.createLoaderRegistry)();
     registry.register(rls_2.rlsLoader);

package/loaders/pubkey.d.ts

@@ -2,8 +2,8 @@
  * Pubkey Challenge Settings Loader
  *
  * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
- * function names). Tries the new pubkey_settings table first, falls back
- * to the legacy api_modules approach.
+ * function names) from the scoped routing plane. Tries the pubkey_settings
+ * table first, falls back to the api_modules approach.
  */
 import type { PubkeyChallengeSettings } from '../types';
 import type { ModuleLoader } from './types';

package/loaders/pubkey.js

@@ -3,8 +3,8 @@
  * Pubkey Challenge Settings Loader
  *
  * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
- * function names). Tries the new pubkey_settings table first, falls back
- * to the legacy api_modules approach.
+ * function names) from the scoped routing plane. Tries the pubkey_settings
+ * table first, falls back to the api_modules approach.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pubkeyLoader = void 0;
@@ -18,7 +18,7 @@ const PUBKEY_SETTINGS_SQL = `
     sign_in_req_fn.name AS sign_in_request_challenge,
     sign_in_fail_fn.name AS sign_in_record_failure,
     sign_in_fn.name AS sign_in_with_challenge
-  FROM services_public.pubkey_settings ps
+  FROM constructive_routing_public.pubkey_settings ps
   LEFT JOIN metaschema_public.schema s ON ps.schema_id = s.id
   LEFT JOIN metaschema_public.function sign_up_fn ON ps.sign_up_with_key_function_id = sign_up_fn.id
   LEFT JOIN metaschema_public.function sign_in_req_fn ON ps.sign_in_request_challenge_function_id = sign_in_req_fn.id
@@ -29,7 +29,7 @@ const PUBKEY_SETTINGS_SQL = `
 `;
 const PUBKEY_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'pubkey_challenge'
   LIMIT 1
 `;
@@ -43,7 +43,7 @@ function fromRow(row) {
         signUpWithKey: row.sign_up_with_key,
         signInRequestChallenge: row.sign_in_request_challenge,
         signInRecordFailure: row.sign_in_record_failure,
-        signInWithChallenge: row.sign_in_with_challenge,
+        signInWithChallenge: row.sign_in_with_challenge
     };
 }
 // ─── Loader ─────────────────────────────────────────────────────────────────
@@ -51,10 +51,10 @@ exports.pubkeyLoader = (0, create_loader_1.createModuleLoader)({
     name: 'pubkeyChallengeSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try new pubkey_settings table first
         try {
-            const result = await servicesPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
+            const result = await routingPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
             const resolved = fromRow(result.rows[0] ?? null);
             if (resolved)
                 return resolved;
@@ -62,11 +62,11 @@ exports.pubkeyLoader = (0, create_loader_1.createModuleLoader)({
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(PUBKEY_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(PUBKEY_MODULE_SQL, [apiId]);
             return fromRow(result.rows[0]?.data ?? null);
         }
         return undefined;
-    },
+    }
 });

package/loaders/rls.d.ts

@@ -2,8 +2,8 @@
  * RLS Module Loader
  *
  * Resolves RLS authentication function names and schema references for
- * a given database. Tries the new rls_settings table first, falls back
- * to the legacy api_modules approach.
+ * a given database from the scoped routing plane. Tries the rls_settings
+ * table first, falls back to the api_modules approach.
  */
 import type { RlsModule } from '../types';
 import type { ModuleLoader } from './types';

package/loaders/rls.js

@@ -3,8 +3,8 @@
  * RLS Module Loader
  *
  * Resolves RLS authentication function names and schema references for
- * a given database. Tries the new rls_settings table first, falls back
- * to the legacy api_modules approach.
+ * a given database from the scoped routing plane. Tries the rls_settings
+ * table first, falls back to the api_modules approach.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rlsLoader = void 0;
@@ -20,7 +20,7 @@ const RLS_SETTINGS_SQL = `
     role_id_fn.name AS current_role_id,
     ua_fn.name AS current_user_agent,
     ip_fn.name AS current_ip_address
-  FROM services_public.rls_settings rs
+  FROM constructive_routing_public.rls_settings rs
   LEFT JOIN metaschema_public.schema auth_schema ON rs.authenticate_schema_id = auth_schema.id
   LEFT JOIN metaschema_public.schema role_schema ON rs.role_schema_id = role_schema.id
   LEFT JOIN metaschema_public.function auth_fn ON rs.authenticate_function_id = auth_fn.id
@@ -34,7 +34,7 @@ const RLS_SETTINGS_SQL = `
 `;
 const RLS_MODULE_SQL = `
   SELECT data
-  FROM services_public.api_modules
+  FROM constructive_routing_public.api_modules
   WHERE api_id = $1 AND name = 'rls_module'
   LIMIT 1
 `;
@@ -52,7 +52,7 @@ function fromSettings(row) {
         currentRole: row.current_role,
         currentRoleId: row.current_role_id,
         currentIpAddress: row.current_ip_address,
-        currentUserAgent: row.current_user_agent,
+        currentUserAgent: row.current_user_agent
     };
 }
 function fromModule(row) {
@@ -67,7 +67,7 @@ function fromModule(row) {
         currentRole: d.current_role,
         currentRoleId: d.current_role_id,
         currentIpAddress: d.current_ip_address,
-        currentUserAgent: d.current_user_agent,
+        currentUserAgent: d.current_user_agent
     };
 }
 // ─── Loader ─────────────────────────────────────────────────────────────────
@@ -75,10 +75,10 @@ exports.rlsLoader = (0, create_loader_1.createModuleLoader)({
     name: 'rlsModule',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId, apiId } = ctx;
+        const { routingPool, databaseId, apiId } = ctx;
         // Try new rls_settings table first
         try {
-            const result = await servicesPool.query(RLS_SETTINGS_SQL, [databaseId]);
+            const result = await routingPool.query(RLS_SETTINGS_SQL, [databaseId]);
             const resolved = fromSettings(result.rows[0] ?? null);
             if (resolved)
                 return resolved;
@@ -86,11 +86,11 @@ exports.rlsLoader = (0, create_loader_1.createModuleLoader)({
         catch {
             // Table may not exist yet
         }
-        // Fall back to legacy api_modules
+        // Fall back to api_modules
         if (apiId) {
-            const result = await servicesPool.query(RLS_MODULE_SQL, [apiId]);
+            const result = await routingPool.query(RLS_MODULE_SQL, [apiId]);
             return fromModule(result.rows[0] ?? null);
         }
         return undefined;
-    },
+    }
 });

package/loaders/types.d.ts

@@ -2,7 +2,7 @@
  * Module Loader Types
  *
  * A ModuleLoader is a per-database cached lookup that resolves config
- * from the services DB or tenant DB. Each loader owns its own LRU cache
+ * from the routing DB or tenant DB. Each loader owns its own LRU cache
  * keyed by databaseId, with independent TTL and eviction.
  *
  * Loaders are registered in a LoaderRegistry and resolved in parallel
@@ -16,8 +16,8 @@ import type { Pool } from 'pg';
  * database tier it needs.
  */
 export interface LoaderContext {
-    /** Services database pool (for services_public.* lookups) */
-    servicesPool: Pool;
+    /** Routing/configuration database pool (for constructive_routing_public.* lookups) */
+    routingPool: Pool;
     /** Tenant database pool (for metaschema_modules_public.* lookups) */
     tenantPool: Pool;
     /** UUID of the database being resolved */

package/loaders/types.js

@@ -3,7 +3,7 @@
  * Module Loader Types
  *
  * A ModuleLoader is a per-database cached lookup that resolves config
- * from the services DB or tenant DB. Each loader owns its own LRU cache
+ * from the routing DB or tenant DB. Each loader owns its own LRU cache
  * keyed by databaseId, with independent TTL and eviction.
  *
  * Loaders are registered in a LoaderRegistry and resolved in parallel

package/loaders/webauthn.js

@@ -22,7 +22,7 @@ const WEBAUTHN_SETTINGS_SQL = `
     ws.require_user_verification,
     ws.resident_key,
     ws.challenge_expiry_seconds
-  FROM services_public.webauthn_settings ws
+  FROM constructive_routing_public.webauthn_settings ws
   LEFT JOIN metaschema_public.schema s ON ws.schema_id = s.id
   LEFT JOIN metaschema_public.schema cred_s ON ws.credentials_schema_id = cred_s.id
   LEFT JOIN metaschema_public.schema sess_s ON ws.sessions_schema_id = sess_s.id
@@ -35,8 +35,8 @@ exports.webauthnLoader = (0, create_loader_1.createModuleLoader)({
     name: 'webauthnSettings',
     ttlMs: 5 * 60_000,
     async resolve(ctx) {
-        const { servicesPool, databaseId } = ctx;
-        const result = await servicesPool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
+        const { routingPool, databaseId } = ctx;
+        const result = await routingPool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
         const row = result.rows[0];
         if (!row?.schema)
             return undefined;
@@ -51,7 +51,7 @@ exports.webauthnLoader = (0, create_loader_1.createModuleLoader)({
             attestationType: row.attestation_type,
             requireUserVerification: row.require_user_verification,
             residentKey: row.resident_key,
-            challengeExpirySeconds: row.challenge_expiry_seconds,
+            challengeExpirySeconds: row.challenge_expiry_seconds
         };
-    },
+    }
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/express-context",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "Extractable Express middleware for Constructive tenant context — domain resolution, JWT auth, pgSettings, and withPgClient",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -30,13 +30,13 @@
   },
   "dependencies": {
     "@constructive-io/url-domains": "^2.19.0",
-    "@pgpmjs/env": "^2.28.1",
+    "@pgpmjs/env": "^2.29.0",
     "@pgpmjs/logger": "^2.14.0",
-    "@pgpmjs/server-utils": "^3.15.2",
-    "@pgpmjs/types": "^2.35.0",
+    "@pgpmjs/server-utils": "^3.15.4",
+    "@pgpmjs/types": "^2.36.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.15.1",
+    "pg-cache": "^3.15.3",
     "pg-query-context": "^2.19.0"
   },
   "devDependencies": {
@@ -59,5 +59,5 @@
     "jwt",
     "pgSettings"
   ],
-  "gitHead": "dd2accb683fe20c7278a0d58fd36a04a3b07ac63"
+  "gitHead": "39db6d576bce7bc1de8123849f237b1695779d88"
 }

package/pg-settings.js

@@ -42,8 +42,9 @@ function buildPgSettings(input) {
         settings['jwt.claims.database_id'] = api.databaseId;
     }
     // API provenance — which API surface this request arrived through.
-    // Derived server-side from hostname -> services_public.domains -> api_id;
-    // never taken from client-supplied headers, body, or token payload.
+    // Derived server-side by resolving the hostname through the scoped routing
+    // plane (resolve_route -> api_id); never taken from client-supplied headers,
+    // body, or token payload.
     if (api.apiId) {
         settings['jwt.claims.api_id'] = api.apiId;
     }