@constructive-io/express-context 0.2.0

package/esm/loaders/database-settings.js

@@ -0,0 +1,52 @@
+/**
+ * Database Settings Loader
+ *
+ * Resolves per-database feature flags (aggregates, postgis, search,
+ * uploads, many-to-many, connection filters, ltree, llm, realtime, bulk).
+ * Merges database-level defaults with optional per-API overrides.
+ */
+import { createModuleLoader } from './create-loader';
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const DATABASE_SETTINGS_SQL = `
+  SELECT
+    COALESCE(aps.enable_aggregates, ds.enable_aggregates) AS resolved_enable_aggregates,
+    COALESCE(aps.enable_postgis, ds.enable_postgis) AS resolved_enable_postgis,
+    COALESCE(aps.enable_search, ds.enable_search) AS resolved_enable_search,
+    COALESCE(aps.enable_direct_uploads, ds.enable_direct_uploads) AS resolved_enable_direct_uploads,
+    COALESCE(aps.enable_presigned_uploads, ds.enable_presigned_uploads) AS resolved_enable_presigned_uploads,
+    COALESCE(aps.enable_many_to_many, ds.enable_many_to_many) AS resolved_enable_many_to_many,
+    COALESCE(aps.enable_connection_filter, ds.enable_connection_filter) AS resolved_enable_connection_filter,
+    COALESCE(aps.enable_ltree, ds.enable_ltree) AS resolved_enable_ltree,
+    COALESCE(aps.enable_llm, ds.enable_llm) AS resolved_enable_llm,
+    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
+    COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk
+  FROM services_public.database_settings ds
+  LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
+  WHERE ds.database_id = $1
+  LIMIT 1
+`;
+// ─── Loader ─────────────────────────────────────────────────────────────────
+export const databaseSettingsLoader = createModuleLoader({
+    name: 'databaseSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        const result = await servicesPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
+        const row = result.rows[0];
+        if (!row)
+            return undefined;
+        return {
+            enableAggregates: row.resolved_enable_aggregates,
+            enablePostgis: row.resolved_enable_postgis,
+            enableSearch: row.resolved_enable_search,
+            enableDirectUploads: row.resolved_enable_direct_uploads,
+            enablePresignedUploads: row.resolved_enable_presigned_uploads,
+            enableManyToMany: row.resolved_enable_many_to_many,
+            enableConnectionFilter: row.resolved_enable_connection_filter,
+            enableLtree: row.resolved_enable_ltree,
+            enableLlm: row.resolved_enable_llm,
+            enableRealtime: row.resolved_enable_realtime,
+            enableBulk: row.resolved_enable_bulk,
+        };
+    },
+});

package/esm/loaders/index.js

@@ -0,0 +1,56 @@
+/**
+ * Module Loaders — pluggable per-database cached lookups.
+ *
+ * Each loader encapsulates a SQL query + type transform + LRU cache
+ * for one piece of per-database configuration. Register loaders in
+ * a LoaderRegistry and pass it to createContextMiddleware().
+ *
+ * Built-in loaders cover the standard Constructive modules:
+ *   - rlsModule       (services_public.rls_settings)
+ *   - corsOrigins     (services_public.cors_settings)
+ *   - databaseSettings(services_public.database_settings)
+ *   - pubkeyChallengeSettings (services_public.pubkey_settings)
+ *   - webauthnSettings(services_public.webauthn_settings)
+ *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
+ *
+ * To add a new per-db lookup, implement a ModuleLoader and register it:
+ *
+ *   const myLoader = createModuleLoader({
+ *     name: 'myModule',
+ *     ttlMs: 60_000,
+ *     async resolve(ctx) {
+ *       const { rows } = await ctx.tenantPool.query(MY_SQL, [ctx.databaseId]);
+ *       return rows[0] ? transform(rows[0]) : undefined;
+ *     },
+ *   });
+ *   registry.register(myLoader);
+ */
+export { createModuleLoader } from './create-loader';
+export { createLoaderRegistry } from './registry';
+// Built-in loaders
+export { rlsLoader } from './rls';
+export { corsLoader } from './cors';
+export { databaseSettingsLoader } from './database-settings';
+export { pubkeyLoader } from './pubkey';
+export { webauthnLoader } from './webauthn';
+export { authSettingsLoader } from './auth-settings';
+/**
+ * Convenience: create a registry pre-loaded with all built-in loaders.
+ */
+import { createLoaderRegistry } from './registry';
+import { rlsLoader } from './rls';
+import { corsLoader } from './cors';
+import { databaseSettingsLoader } from './database-settings';
+import { pubkeyLoader } from './pubkey';
+import { webauthnLoader } from './webauthn';
+import { authSettingsLoader } from './auth-settings';
+export function createDefaultRegistry() {
+    const registry = createLoaderRegistry();
+    registry.register(rlsLoader);
+    registry.register(corsLoader);
+    registry.register(databaseSettingsLoader);
+    registry.register(pubkeyLoader);
+    registry.register(webauthnLoader);
+    registry.register(authSettingsLoader);
+    return registry;
+}

package/esm/loaders/pubkey.js

@@ -0,0 +1,69 @@
+/**
+ * Pubkey Challenge Settings Loader
+ *
+ * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
+ * function names). Tries the new pubkey_settings table first, falls back
+ * to the legacy api_modules approach.
+ */
+import { createModuleLoader } from './create-loader';
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const PUBKEY_SETTINGS_SQL = `
+  SELECT
+    s.schema_name AS schema,
+    ps.crypto_network,
+    sign_up_fn.name AS sign_up_with_key,
+    sign_in_req_fn.name AS sign_in_request_challenge,
+    sign_in_fail_fn.name AS sign_in_record_failure,
+    sign_in_fn.name AS sign_in_with_challenge
+  FROM services_public.pubkey_settings ps
+  LEFT JOIN metaschema_public.schema s ON ps.schema_id = s.id
+  LEFT JOIN metaschema_public.function sign_up_fn ON ps.sign_up_with_key_function_id = sign_up_fn.id
+  LEFT JOIN metaschema_public.function sign_in_req_fn ON ps.sign_in_request_challenge_function_id = sign_in_req_fn.id
+  LEFT JOIN metaschema_public.function sign_in_fail_fn ON ps.sign_in_record_failure_function_id = sign_in_fail_fn.id
+  LEFT JOIN metaschema_public.function sign_in_fn ON ps.sign_in_with_challenge_function_id = sign_in_fn.id
+  WHERE ps.database_id = $1
+  LIMIT 1
+`;
+const PUBKEY_MODULE_SQL = `
+  SELECT data
+  FROM services_public.api_modules
+  WHERE api_id = $1 AND name = 'pubkey_challenge'
+  LIMIT 1
+`;
+// ─── Transforms ─────────────────────────────────────────────────────────────
+function fromRow(row) {
+    if (!row?.schema || !row?.sign_up_with_key)
+        return undefined;
+    return {
+        schema: row.schema,
+        cryptoNetwork: row.crypto_network,
+        signUpWithKey: row.sign_up_with_key,
+        signInRequestChallenge: row.sign_in_request_challenge,
+        signInRecordFailure: row.sign_in_record_failure,
+        signInWithChallenge: row.sign_in_with_challenge,
+    };
+}
+// ─── Loader ─────────────────────────────────────────────────────────────────
+export const pubkeyLoader = createModuleLoader({
+    name: 'pubkeyChallengeSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        // Try new pubkey_settings table first
+        try {
+            const result = await servicesPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
+            const resolved = fromRow(result.rows[0] ?? null);
+            if (resolved)
+                return resolved;
+        }
+        catch {
+            // Table may not exist yet
+        }
+        // Fall back to legacy api_modules
+        if (apiId) {
+            const result = await servicesPool.query(PUBKEY_MODULE_SQL, [apiId]);
+            return fromRow(result.rows[0]?.data ?? null);
+        }
+        return undefined;
+    },
+});

package/esm/loaders/registry.js

@@ -0,0 +1,69 @@
+/**
+ * Loader Registry — manages a set of ModuleLoader instances.
+ *
+ * Supports two resolution modes:
+ *   - Lazy (preferred): `resolve(name, ctx)` resolves a single loader
+ *     on-demand. Only fires the SQL query if the cache misses. Middleware
+ *     requests only the loaders it actually needs.
+ *   - Eager: `resolveAll(ctx)` resolves every registered loader in
+ *     parallel. Useful for pre-warming or migration from the monolithic
+ *     svcCache pattern.
+ *
+ * Each loader's result is independently cached per databaseId — resolving
+ * one module never invalidates another.
+ */
+import { Logger } from '@pgpmjs/logger';
+const log = new Logger('loader-registry');
+export function createLoaderRegistry() {
+    const loaders = new Map();
+    return {
+        register(loader) {
+            if (loaders.has(loader.name)) {
+                throw new Error(`Loader "${loader.name}" is already registered`);
+            }
+            loaders.set(loader.name, loader);
+            log.debug(`Registered loader: ${loader.name}`);
+        },
+        async resolve(name, ctx) {
+            const loader = loaders.get(name);
+            if (!loader) {
+                log.debug(`Loader "${name}" not registered, returning undefined`);
+                return undefined;
+            }
+            return loader.resolve(ctx);
+        },
+        async resolveAll(ctx) {
+            if (loaders.size === 0)
+                return {};
+            const entries = Array.from(loaders.entries());
+            const results = await Promise.all(entries.map(async ([name, loader]) => {
+                const value = await loader.resolve(ctx);
+                return [name, value];
+            }));
+            const modules = {};
+            for (const [name, value] of results) {
+                if (value !== undefined) {
+                    modules[name] = value;
+                }
+            }
+            return modules;
+        },
+        get(name) {
+            return loaders.get(name);
+        },
+        has(name) {
+            return loaders.has(name);
+        },
+        invalidate(databaseId) {
+            for (const loader of loaders.values()) {
+                loader.invalidate(databaseId);
+            }
+            log.debug(databaseId
+                ? `Invalidated all loaders for databaseId=${databaseId}`
+                : 'Invalidated all loaders');
+        },
+        get names() {
+            return Array.from(loaders.keys());
+        },
+    };
+}

package/esm/loaders/rls.js

@@ -0,0 +1,93 @@
+/**
+ * RLS Module Loader
+ *
+ * Resolves RLS authentication function names and schema references for
+ * a given database. Tries the new rls_settings table first, falls back
+ * to the legacy api_modules approach.
+ */
+import { createModuleLoader } from './create-loader';
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const RLS_SETTINGS_SQL = `
+  SELECT
+    auth_schema.schema_name AS authenticate_schema,
+    role_schema.schema_name AS role_schema,
+    auth_fn.name AS authenticate,
+    auth_strict_fn.name AS authenticate_strict,
+    role_fn.name AS current_role,
+    role_id_fn.name AS current_role_id,
+    ua_fn.name AS current_user_agent,
+    ip_fn.name AS current_ip_address
+  FROM services_public.rls_settings rs
+  LEFT JOIN metaschema_public.schema auth_schema ON rs.authenticate_schema_id = auth_schema.id
+  LEFT JOIN metaschema_public.schema role_schema ON rs.role_schema_id = role_schema.id
+  LEFT JOIN metaschema_public.function auth_fn ON rs.authenticate_function_id = auth_fn.id
+  LEFT JOIN metaschema_public.function auth_strict_fn ON rs.authenticate_strict_function_id = auth_strict_fn.id
+  LEFT JOIN metaschema_public.function role_fn ON rs.current_role_function_id = role_fn.id
+  LEFT JOIN metaschema_public.function role_id_fn ON rs.current_role_id_function_id = role_id_fn.id
+  LEFT JOIN metaschema_public.function ua_fn ON rs.current_user_agent_function_id = ua_fn.id
+  LEFT JOIN metaschema_public.function ip_fn ON rs.current_ip_address_function_id = ip_fn.id
+  WHERE rs.database_id = $1
+  LIMIT 1
+`;
+const RLS_MODULE_SQL = `
+  SELECT data
+  FROM services_public.api_modules
+  WHERE api_id = $1 AND name = 'rls_module'
+  LIMIT 1
+`;
+// ─── Transforms ─────────────────────────────────────────────────────────────
+function fromSettings(row) {
+    if (!row)
+        return undefined;
+    if (!row.authenticate || !row.authenticate_schema)
+        return undefined;
+    return {
+        authenticate: row.authenticate,
+        authenticateStrict: row.authenticate_strict,
+        privateSchema: { schemaName: row.authenticate_schema },
+        publicSchema: { schemaName: row.role_schema },
+        currentRole: row.current_role,
+        currentRoleId: row.current_role_id,
+        currentIpAddress: row.current_ip_address,
+        currentUserAgent: row.current_user_agent,
+    };
+}
+function fromModule(row) {
+    if (!row?.data)
+        return undefined;
+    const d = row.data;
+    return {
+        authenticate: d.authenticate,
+        authenticateStrict: d.authenticate_strict,
+        privateSchema: { schemaName: d.authenticate_schema },
+        publicSchema: { schemaName: d.role_schema },
+        currentRole: d.current_role,
+        currentRoleId: d.current_role_id,
+        currentIpAddress: d.current_ip_address,
+        currentUserAgent: d.current_user_agent,
+    };
+}
+// ─── Loader ─────────────────────────────────────────────────────────────────
+export const rlsLoader = createModuleLoader({
+    name: 'rlsModule',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        // Try new rls_settings table first
+        try {
+            const result = await servicesPool.query(RLS_SETTINGS_SQL, [databaseId]);
+            const resolved = fromSettings(result.rows[0] ?? null);
+            if (resolved)
+                return resolved;
+        }
+        catch {
+            // Table may not exist yet
+        }
+        // Fall back to legacy api_modules
+        if (apiId) {
+            const result = await servicesPool.query(RLS_MODULE_SQL, [apiId]);
+            return fromModule(result.rows[0] ?? null);
+        }
+        return undefined;
+    },
+});

package/esm/loaders/types.js

@@ -0,0 +1,12 @@
+/**
+ * Module Loader Types
+ *
+ * A ModuleLoader is a per-database cached lookup that resolves config
+ * from the services DB or tenant DB. Each loader owns its own LRU cache
+ * keyed by databaseId, with independent TTL and eviction.
+ *
+ * Loaders are registered in a LoaderRegistry and resolved in parallel
+ * during context building. The result is a typed modules map on
+ * `req.constructive.modules`.
+ */
+export {};

package/esm/loaders/webauthn.js

@@ -0,0 +1,54 @@
+/**
+ * WebAuthn Settings Loader
+ *
+ * Resolves WebAuthn/passkey configuration for a database — RP identity,
+ * schema references, attestation policy, and challenge expiry.
+ */
+import { createModuleLoader } from './create-loader';
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const WEBAUTHN_SETTINGS_SQL = `
+  SELECT
+    s.schema_name AS schema,
+    cred_s.schema_name AS credentials_schema,
+    sess_s.schema_name AS sessions_schema,
+    sec_s.schema_name AS session_secrets_schema,
+    ws.rp_id,
+    ws.rp_name,
+    ws.origin_allowlist,
+    ws.attestation_type,
+    ws.require_user_verification,
+    ws.resident_key,
+    ws.challenge_expiry_seconds
+  FROM services_public.webauthn_settings ws
+  LEFT JOIN metaschema_public.schema s ON ws.schema_id = s.id
+  LEFT JOIN metaschema_public.schema cred_s ON ws.credentials_schema_id = cred_s.id
+  LEFT JOIN metaschema_public.schema sess_s ON ws.sessions_schema_id = sess_s.id
+  LEFT JOIN metaschema_public.schema sec_s ON ws.session_secrets_schema_id = sec_s.id
+  WHERE ws.database_id = $1
+  LIMIT 1
+`;
+// ─── Loader ─────────────────────────────────────────────────────────────────
+export const webauthnLoader = createModuleLoader({
+    name: 'webauthnSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId } = ctx;
+        const result = await servicesPool.query(WEBAUTHN_SETTINGS_SQL, [databaseId]);
+        const row = result.rows[0];
+        if (!row?.schema)
+            return undefined;
+        return {
+            schema: row.schema,
+            credentialsSchema: row.credentials_schema,
+            sessionsSchema: row.sessions_schema,
+            sessionSecretsSchema: row.session_secrets_schema,
+            rpId: row.rp_id,
+            rpName: row.rp_name,
+            originAllowlist: row.origin_allowlist,
+            attestationType: row.attestation_type,
+            requireUserVerification: row.require_user_verification,
+            residentKey: row.resident_key,
+            challengeExpirySeconds: row.challenge_expiry_seconds,
+        };
+    },
+});

package/esm/pg-client.js

@@ -0,0 +1,8 @@
+/**
+ * pg-client — Re-exports withPgClient from pg-query-context
+ *
+ * This module exists for backwards compatibility. The implementation
+ * lives in pg-query-context which provides both the single-query API
+ * and the callback-based withPgClient API.
+ */
+export { withPgClient } from 'pg-query-context';

package/esm/pg-settings.js

@@ -0,0 +1,44 @@
+/**
+ * pg-settings — Build pgSettings from resolved API + auth token
+ *
+ * pgSettings are key-value pairs passed to PostgreSQL via SET LOCAL
+ * within each transaction. They carry the JWT claims, role, database_id,
+ * and request_id so that RLS policies and SQL functions can reference
+ * the current user context via `current_setting('jwt.claims.user_id')`.
+ *
+ * This module extracts the pgSettings construction so it's reusable
+ * across the PostGraphile server, LLM sidecar, or any Express service.
+ */
+/**
+ * Build pgSettings from the resolved API + auth token.
+ *
+ * These settings are applied via SET LOCAL in each transaction,
+ * making them available to RLS policies and SQL functions.
+ */
+export function buildPgSettings(input) {
+    const { api, token, requestId, clientIp } = input;
+    const settings = {};
+    // Role: from token (authenticated) or api (anonymous fallback)
+    if (token?.user_id) {
+        settings['role'] = api.roleName || 'authenticated';
+        settings['jwt.claims.user_id'] = token.user_id;
+    }
+    else {
+        settings['role'] = api.anonRole || 'anonymous';
+    }
+    // Session claims
+    if (token?.session_id) {
+        settings['jwt.claims.session_id'] = token.session_id;
+    }
+    // Database context
+    if (api.databaseId) {
+        settings['jwt.claims.database_id'] = api.databaseId;
+    }
+    // Distributed tracing
+    settings['request.id'] = requestId;
+    // Client metadata (for audit functions)
+    if (clientIp) {
+        settings['jwt.claims.ip_address'] = clientIp;
+    }
+    return settings;
+}

package/esm/request-id.js

@@ -0,0 +1,19 @@
+/**
+ * request-id — Per-request correlation ID middleware
+ *
+ * Generates a UUID v4 request ID (or uses an incoming X-Request-Id header)
+ * and attaches it to `req.requestId`. This ID propagates through pgSettings
+ * into billing ledger entries and inference logs for distributed tracing.
+ */
+import { randomUUID } from 'crypto';
+/**
+ * Middleware that ensures every request has a correlation ID.
+ *
+ * Priority: `X-Request-Id` header → new UUID v4
+ */
+export function requestIdMiddleware() {
+    return (req, _res, next) => {
+        req.requestId = (req.get('X-Request-Id') || randomUUID());
+        next();
+    };
+}

package/esm/types.js

@@ -0,0 +1,9 @@
+/**
+ * Shared types for Constructive Express middleware.
+ *
+ * These types describe the resolved API structure, RLS module, auth settings,
+ * database feature flags, and other config that middleware attaches to the
+ * Express request. Extracted from graphql/server so any Express-based service
+ * (PostGraphile, LLM sidecar, etc.) can share the same context.
+ */
+export {};

package/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @constructive-io/express-context
+ *
+ * Extractable Express middleware for Constructive tenant context.
+ *
+ * Provides:
+ *   - Shared types (ApiStructure, RlsModule, AuthSettings, etc.)
+ *   - pgSettings builder (role, JWT claims, request_id, database_id)
+ *   - withPgClient (tenant-scoped RLS transaction helper)
+ *   - requestId middleware (UUID correlation ID)
+ *   - Context middleware (composes all of the above into req.constructive)
+ *   - Module loaders (pluggable per-database cached lookups)
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   createContextMiddleware,
+ *   requestIdMiddleware,
+ *   createDefaultRegistry,
+ * } from '@constructive-io/express-context';
+ *
+ * const loaders = createDefaultRegistry();
+ *
+ * app.use(requestIdMiddleware());
+ * app.use(apiMiddleware);        // sets req.api (your domain resolver)
+ * app.use(authMiddleware);       // sets req.token (your JWT verifier)
+ * app.use(createContextMiddleware({ loaders })); // builds req.constructive
+ *
+ * app.post('/v1/chat', async (req, res) => {
+ *   const ctx = req.constructive;
+ *   const rls = await ctx.useModule('rlsModule');       // only fires if not cached
+ *   const auth = await ctx.useModule('authSettings');    // only fires if not cached
+ *   // webauthnSettings loader never fires if nobody asks for it
+ * });
+ * ```
+ */
+export type { ApiConfigResult, ApiError, ApiModule, ApiStructure, AuthSettings, ConstructiveAPIToken, ConstructiveContext, CorsModuleData, DatabaseSettings, GenericModuleData, PublicKeyChallengeData, PubkeyChallengeSettings, BuiltinModuleMap, RlsModule, WebauthnSettings, WithPgClient, } from './types';
+export type { PgSettingsInput } from './pg-settings';
+export { buildPgSettings } from './pg-settings';
+export { withPgClient } from './pg-client';
+export { requestIdMiddleware } from './request-id';
+export type { ContextMiddlewareOptions } from './context';
+export { buildContext, createContextMiddleware } from './context';
+export type { CreateLoaderOptions, LoaderContext, LoaderRegistry, ModuleLoader, } from './loaders';
+export { authSettingsLoader, corsLoader, createDefaultRegistry, createLoaderRegistry, createModuleLoader, databaseSettingsLoader, pubkeyLoader, rlsLoader, webauthnLoader, } from './loaders';
+import './types';

package/index.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * @constructive-io/express-context
+ *
+ * Extractable Express middleware for Constructive tenant context.
+ *
+ * Provides:
+ *   - Shared types (ApiStructure, RlsModule, AuthSettings, etc.)
+ *   - pgSettings builder (role, JWT claims, request_id, database_id)
+ *   - withPgClient (tenant-scoped RLS transaction helper)
+ *   - requestId middleware (UUID correlation ID)
+ *   - Context middleware (composes all of the above into req.constructive)
+ *   - Module loaders (pluggable per-database cached lookups)
+ *
+ * @example
+ * ```typescript
+ * import {
+ *   createContextMiddleware,
+ *   requestIdMiddleware,
+ *   createDefaultRegistry,
+ * } from '@constructive-io/express-context';
+ *
+ * const loaders = createDefaultRegistry();
+ *
+ * app.use(requestIdMiddleware());
+ * app.use(apiMiddleware);        // sets req.api (your domain resolver)
+ * app.use(authMiddleware);       // sets req.token (your JWT verifier)
+ * app.use(createContextMiddleware({ loaders })); // builds req.constructive
+ *
+ * app.post('/v1/chat', async (req, res) => {
+ *   const ctx = req.constructive;
+ *   const rls = await ctx.useModule('rlsModule');       // only fires if not cached
+ *   const auth = await ctx.useModule('authSettings');    // only fires if not cached
+ *   // webauthnSettings loader never fires if nobody asks for it
+ * });
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webauthnLoader = exports.rlsLoader = exports.pubkeyLoader = exports.databaseSettingsLoader = exports.createModuleLoader = exports.createLoaderRegistry = exports.createDefaultRegistry = exports.corsLoader = exports.authSettingsLoader = exports.createContextMiddleware = exports.buildContext = exports.requestIdMiddleware = exports.withPgClient = exports.buildPgSettings = void 0;
+var pg_settings_1 = require("./pg-settings");
+Object.defineProperty(exports, "buildPgSettings", { enumerable: true, get: function () { return pg_settings_1.buildPgSettings; } });
+// withPgClient helper
+var pg_client_1 = require("./pg-client");
+Object.defineProperty(exports, "withPgClient", { enumerable: true, get: function () { return pg_client_1.withPgClient; } });
+// Request ID middleware
+var request_id_1 = require("./request-id");
+Object.defineProperty(exports, "requestIdMiddleware", { enumerable: true, get: function () { return request_id_1.requestIdMiddleware; } });
+var context_1 = require("./context");
+Object.defineProperty(exports, "buildContext", { enumerable: true, get: function () { return context_1.buildContext; } });
+Object.defineProperty(exports, "createContextMiddleware", { enumerable: true, get: function () { return context_1.createContextMiddleware; } });
+var loaders_1 = require("./loaders");
+Object.defineProperty(exports, "authSettingsLoader", { enumerable: true, get: function () { return loaders_1.authSettingsLoader; } });
+Object.defineProperty(exports, "corsLoader", { enumerable: true, get: function () { return loaders_1.corsLoader; } });
+Object.defineProperty(exports, "createDefaultRegistry", { enumerable: true, get: function () { return loaders_1.createDefaultRegistry; } });
+Object.defineProperty(exports, "createLoaderRegistry", { enumerable: true, get: function () { return loaders_1.createLoaderRegistry; } });
+Object.defineProperty(exports, "createModuleLoader", { enumerable: true, get: function () { return loaders_1.createModuleLoader; } });
+Object.defineProperty(exports, "databaseSettingsLoader", { enumerable: true, get: function () { return loaders_1.databaseSettingsLoader; } });
+Object.defineProperty(exports, "pubkeyLoader", { enumerable: true, get: function () { return loaders_1.pubkeyLoader; } });
+Object.defineProperty(exports, "rlsLoader", { enumerable: true, get: function () { return loaders_1.rlsLoader; } });
+Object.defineProperty(exports, "webauthnLoader", { enumerable: true, get: function () { return loaders_1.webauthnLoader; } });
+// Side-effect: Express type augmentation
+require("./types");

package/loaders/auth-settings.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Auth Settings Loader (Tier 2 — tenant DB)
+ *
+ * Two-step discovery:
+ *   1. Query metaschema_modules_public.sessions_module to find the
+ *      schema name and table name for auth settings
+ *   2. Query the discovered <schema>.<table> in the tenant DB
+ *
+ * This is the pattern for any module whose config lives in the tenant
+ * database rather than the services database.
+ */
+import type { AuthSettings } from '../types';
+import type { ModuleLoader } from './types';
+export declare const authSettingsLoader: ModuleLoader<AuthSettings>;