@constructive-io/express-context 0.2.0

package/loaders/auth-settings.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Auth Settings Loader (Tier 2 — tenant DB)
+ *
+ * Two-step discovery:
+ *   1. Query metaschema_modules_public.sessions_module to find the
+ *      schema name and table name for auth settings
+ *   2. Query the discovered <schema>.<table> in the tenant DB
+ *
+ * This is the pattern for any module whose config lives in the tenant
+ * database rather than the services database.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authSettingsLoader = void 0;
+const create_loader_1 = require("./create-loader");
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const AUTH_SETTINGS_DISCOVERY_SQL = `
+  SELECT s.schema_name, sm.auth_settings_table AS table_name
+  FROM metaschema_modules_public.sessions_module sm
+  JOIN metaschema_public.schema s ON s.id = sm.schema_id
+  LIMIT 1
+`;
+const buildAuthSettingsQuery = (schemaName, tableName) => `
+  SELECT
+    cookie_secure,
+    cookie_samesite,
+    cookie_domain,
+    cookie_httponly,
+    cookie_max_age,
+    cookie_path,
+    remember_me_duration,
+    enable_captcha,
+    captcha_site_key
+  FROM "${schemaName}"."${tableName}"
+  LIMIT 1
+`;
+// ─── Loader ─────────────────────────────────────────────────────────────────
+exports.authSettingsLoader = (0, create_loader_1.createModuleLoader)({
+    name: 'authSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { tenantPool } = ctx;
+        // Step 1: Discover schema + table from sessions_module
+        const discovery = await tenantPool.query(AUTH_SETTINGS_DISCOVERY_SQL);
+        const resolved = discovery.rows[0];
+        if (!resolved)
+            return undefined;
+        // Step 2: Query the actual auth settings table
+        const result = await tenantPool.query(buildAuthSettingsQuery(resolved.schema_name, resolved.table_name));
+        const row = result.rows[0];
+        if (!row)
+            return undefined;
+        return {
+            cookieSecure: row.cookie_secure,
+            cookieSamesite: row.cookie_samesite,
+            cookieDomain: row.cookie_domain,
+            cookieHttponly: row.cookie_httponly,
+            cookieMaxAge: row.cookie_max_age,
+            cookiePath: row.cookie_path,
+            rememberMeDuration: row.remember_me_duration,
+            enableCaptcha: row.enable_captcha,
+            captchaSiteKey: row.captcha_site_key,
+        };
+    },
+});

package/loaders/cors.d.ts

@@ -0,0 +1,9 @@
+/**
+ * CORS Origins Loader
+ *
+ * Resolves allowed CORS origins for a database+API combination.
+ * Checks per-API settings first, falls back to database-level default,
+ * then to the legacy api_modules approach.
+ */
+import type { ModuleLoader } from './types';
+export declare const corsLoader: ModuleLoader<string[]>;

package/loaders/cors.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * CORS Origins Loader
+ *
+ * Resolves allowed CORS origins for a database+API combination.
+ * Checks per-API settings first, falls back to database-level default,
+ * then to the legacy api_modules approach.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.corsLoader = void 0;
+const create_loader_1 = require("./create-loader");
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const CORS_SETTINGS_SQL = `
+  SELECT allowed_origins
+  FROM services_public.cors_settings
+  WHERE database_id = $1 AND api_id = $2
+  LIMIT 1
+`;
+const CORS_SETTINGS_DB_DEFAULT_SQL = `
+  SELECT allowed_origins
+  FROM services_public.cors_settings
+  WHERE database_id = $1 AND api_id IS NULL
+  LIMIT 1
+`;
+const CORS_MODULE_SQL = `
+  SELECT data
+  FROM services_public.api_modules
+  WHERE api_id = $1 AND name = 'cors'
+  LIMIT 1
+`;
+// ─── Loader ─────────────────────────────────────────────────────────────────
+exports.corsLoader = (0, create_loader_1.createModuleLoader)({
+    name: 'corsOrigins',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        // Try per-API cors_settings first
+        try {
+            if (apiId) {
+                const perApi = await servicesPool.query(CORS_SETTINGS_SQL, [databaseId, apiId]);
+                if (perApi.rows[0])
+                    return perApi.rows[0].allowed_origins;
+            }
+            const dbDefault = await servicesPool.query(CORS_SETTINGS_DB_DEFAULT_SQL, [databaseId]);
+            if (dbDefault.rows[0])
+                return dbDefault.rows[0].allowed_origins;
+        }
+        catch {
+            // Table may not exist yet
+        }
+        // Fall back to legacy api_modules
+        if (apiId) {
+            const result = await servicesPool.query(CORS_MODULE_SQL, [apiId]);
+            return result.rows[0]?.data?.urls;
+        }
+        return undefined;
+    },
+});

package/loaders/create-loader.d.ts

@@ -0,0 +1,19 @@
+/**
+ * create-loader — Factory for building cached ModuleLoader instances.
+ *
+ * Wraps a raw resolve function with an LRU cache keyed by databaseId.
+ * Each loader gets its own independent cache with configurable TTL and
+ * max entries.
+ */
+import type { LoaderContext, ModuleLoader } from './types';
+export interface CreateLoaderOptions<T> {
+    /** Unique loader name (used in log prefix and modules map key) */
+    name: string;
+    /** TTL in milliseconds (default: 60_000 — 1 minute) */
+    ttlMs?: number;
+    /** Max cache entries before LRU eviction (default: 100) */
+    max?: number;
+    /** The actual resolution function. Called on cache miss. */
+    resolve: (ctx: LoaderContext) => Promise<T | undefined>;
+}
+export declare function createModuleLoader<T>(opts: CreateLoaderOptions<T>): ModuleLoader<T>;

package/loaders/create-loader.js

@@ -0,0 +1,56 @@
+"use strict";
+/**
+ * create-loader — Factory for building cached ModuleLoader instances.
+ *
+ * Wraps a raw resolve function with an LRU cache keyed by databaseId.
+ * Each loader gets its own independent cache with configurable TTL and
+ * max entries.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createModuleLoader = createModuleLoader;
+const lru_cache_1 = require("lru-cache");
+const logger_1 = require("@pgpmjs/logger");
+const DEFAULT_TTL_MS = 60_000;
+const DEFAULT_MAX = 100;
+function createModuleLoader(opts) {
+    const log = new logger_1.Logger(`loader:${opts.name}`);
+    const cache = new lru_cache_1.LRUCache({
+        max: opts.max ?? DEFAULT_MAX,
+        ttl: opts.ttlMs ?? DEFAULT_TTL_MS,
+        updateAgeOnGet: true,
+        allowStale: false,
+    });
+    return {
+        name: opts.name,
+        async resolve(ctx) {
+            const key = ctx.databaseId;
+            if (cache.has(key)) {
+                log.debug(`Cache HIT databaseId=${key}`);
+                return cache.get(key);
+            }
+            log.debug(`Cache MISS databaseId=${key}, resolving`);
+            try {
+                const value = await opts.resolve(ctx);
+                cache.set(key, value);
+                return value;
+            }
+            catch (e) {
+                log.warn(`Failed to resolve databaseId=${key}: ${e.message}`);
+                return undefined;
+            }
+        },
+        invalidate(databaseId) {
+            if (databaseId) {
+                cache.delete(databaseId);
+                log.debug(`Invalidated databaseId=${databaseId}`);
+            }
+            else {
+                cache.clear();
+                log.debug(`Invalidated all entries (was size=${cache.size})`);
+            }
+        },
+        get cacheSize() {
+            return cache.size;
+        },
+    };
+}

package/loaders/database-settings.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Database Settings Loader
+ *
+ * Resolves per-database feature flags (aggregates, postgis, search,
+ * uploads, many-to-many, connection filters, ltree, llm, realtime, bulk).
+ * Merges database-level defaults with optional per-API overrides.
+ */
+import type { DatabaseSettings } from '../types';
+import type { ModuleLoader } from './types';
+export declare const databaseSettingsLoader: ModuleLoader<DatabaseSettings>;

package/loaders/database-settings.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Database Settings Loader
+ *
+ * Resolves per-database feature flags (aggregates, postgis, search,
+ * uploads, many-to-many, connection filters, ltree, llm, realtime, bulk).
+ * Merges database-level defaults with optional per-API overrides.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.databaseSettingsLoader = void 0;
+const create_loader_1 = require("./create-loader");
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const DATABASE_SETTINGS_SQL = `
+  SELECT
+    COALESCE(aps.enable_aggregates, ds.enable_aggregates) AS resolved_enable_aggregates,
+    COALESCE(aps.enable_postgis, ds.enable_postgis) AS resolved_enable_postgis,
+    COALESCE(aps.enable_search, ds.enable_search) AS resolved_enable_search,
+    COALESCE(aps.enable_direct_uploads, ds.enable_direct_uploads) AS resolved_enable_direct_uploads,
+    COALESCE(aps.enable_presigned_uploads, ds.enable_presigned_uploads) AS resolved_enable_presigned_uploads,
+    COALESCE(aps.enable_many_to_many, ds.enable_many_to_many) AS resolved_enable_many_to_many,
+    COALESCE(aps.enable_connection_filter, ds.enable_connection_filter) AS resolved_enable_connection_filter,
+    COALESCE(aps.enable_ltree, ds.enable_ltree) AS resolved_enable_ltree,
+    COALESCE(aps.enable_llm, ds.enable_llm) AS resolved_enable_llm,
+    COALESCE(aps.enable_realtime, ds.enable_realtime) AS resolved_enable_realtime,
+    COALESCE(aps.enable_bulk, ds.enable_bulk) AS resolved_enable_bulk
+  FROM services_public.database_settings ds
+  LEFT JOIN services_public.api_settings aps ON ds.database_id = aps.database_id AND aps.api_id = $2
+  WHERE ds.database_id = $1
+  LIMIT 1
+`;
+// ─── Loader ─────────────────────────────────────────────────────────────────
+exports.databaseSettingsLoader = (0, create_loader_1.createModuleLoader)({
+    name: 'databaseSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        const result = await servicesPool.query(DATABASE_SETTINGS_SQL, [databaseId, apiId ?? null]);
+        const row = result.rows[0];
+        if (!row)
+            return undefined;
+        return {
+            enableAggregates: row.resolved_enable_aggregates,
+            enablePostgis: row.resolved_enable_postgis,
+            enableSearch: row.resolved_enable_search,
+            enableDirectUploads: row.resolved_enable_direct_uploads,
+            enablePresignedUploads: row.resolved_enable_presigned_uploads,
+            enableManyToMany: row.resolved_enable_many_to_many,
+            enableConnectionFilter: row.resolved_enable_connection_filter,
+            enableLtree: row.resolved_enable_ltree,
+            enableLlm: row.resolved_enable_llm,
+            enableRealtime: row.resolved_enable_realtime,
+            enableBulk: row.resolved_enable_bulk,
+        };
+    },
+});

package/loaders/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Module Loaders — pluggable per-database cached lookups.
+ *
+ * Each loader encapsulates a SQL query + type transform + LRU cache
+ * for one piece of per-database configuration. Register loaders in
+ * a LoaderRegistry and pass it to createContextMiddleware().
+ *
+ * Built-in loaders cover the standard Constructive modules:
+ *   - rlsModule       (services_public.rls_settings)
+ *   - corsOrigins     (services_public.cors_settings)
+ *   - databaseSettings(services_public.database_settings)
+ *   - pubkeyChallengeSettings (services_public.pubkey_settings)
+ *   - webauthnSettings(services_public.webauthn_settings)
+ *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
+ *
+ * To add a new per-db lookup, implement a ModuleLoader and register it:
+ *
+ *   const myLoader = createModuleLoader({
+ *     name: 'myModule',
+ *     ttlMs: 60_000,
+ *     async resolve(ctx) {
+ *       const { rows } = await ctx.tenantPool.query(MY_SQL, [ctx.databaseId]);
+ *       return rows[0] ? transform(rows[0]) : undefined;
+ *     },
+ *   });
+ *   registry.register(myLoader);
+ */
+export type { LoaderContext, ModuleLoader } from './types';
+export type { CreateLoaderOptions } from './create-loader';
+export { createModuleLoader } from './create-loader';
+export type { LoaderRegistry } from './registry';
+export { createLoaderRegistry } from './registry';
+export { rlsLoader } from './rls';
+export { corsLoader } from './cors';
+export { databaseSettingsLoader } from './database-settings';
+export { pubkeyLoader } from './pubkey';
+export { webauthnLoader } from './webauthn';
+export { authSettingsLoader } from './auth-settings';
+export declare function createDefaultRegistry(): import("./registry").LoaderRegistry;

package/loaders/index.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Module Loaders — pluggable per-database cached lookups.
+ *
+ * Each loader encapsulates a SQL query + type transform + LRU cache
+ * for one piece of per-database configuration. Register loaders in
+ * a LoaderRegistry and pass it to createContextMiddleware().
+ *
+ * Built-in loaders cover the standard Constructive modules:
+ *   - rlsModule       (services_public.rls_settings)
+ *   - corsOrigins     (services_public.cors_settings)
+ *   - databaseSettings(services_public.database_settings)
+ *   - pubkeyChallengeSettings (services_public.pubkey_settings)
+ *   - webauthnSettings(services_public.webauthn_settings)
+ *   - authSettings    (metaschema_modules_public.sessions_module → tenant DB)
+ *
+ * To add a new per-db lookup, implement a ModuleLoader and register it:
+ *
+ *   const myLoader = createModuleLoader({
+ *     name: 'myModule',
+ *     ttlMs: 60_000,
+ *     async resolve(ctx) {
+ *       const { rows } = await ctx.tenantPool.query(MY_SQL, [ctx.databaseId]);
+ *       return rows[0] ? transform(rows[0]) : undefined;
+ *     },
+ *   });
+ *   registry.register(myLoader);
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authSettingsLoader = exports.webauthnLoader = exports.pubkeyLoader = exports.databaseSettingsLoader = exports.corsLoader = exports.rlsLoader = exports.createLoaderRegistry = exports.createModuleLoader = void 0;
+exports.createDefaultRegistry = createDefaultRegistry;
+var create_loader_1 = require("./create-loader");
+Object.defineProperty(exports, "createModuleLoader", { enumerable: true, get: function () { return create_loader_1.createModuleLoader; } });
+var registry_1 = require("./registry");
+Object.defineProperty(exports, "createLoaderRegistry", { enumerable: true, get: function () { return registry_1.createLoaderRegistry; } });
+// Built-in loaders
+var rls_1 = require("./rls");
+Object.defineProperty(exports, "rlsLoader", { enumerable: true, get: function () { return rls_1.rlsLoader; } });
+var cors_1 = require("./cors");
+Object.defineProperty(exports, "corsLoader", { enumerable: true, get: function () { return cors_1.corsLoader; } });
+var database_settings_1 = require("./database-settings");
+Object.defineProperty(exports, "databaseSettingsLoader", { enumerable: true, get: function () { return database_settings_1.databaseSettingsLoader; } });
+var pubkey_1 = require("./pubkey");
+Object.defineProperty(exports, "pubkeyLoader", { enumerable: true, get: function () { return pubkey_1.pubkeyLoader; } });
+var webauthn_1 = require("./webauthn");
+Object.defineProperty(exports, "webauthnLoader", { enumerable: true, get: function () { return webauthn_1.webauthnLoader; } });
+var auth_settings_1 = require("./auth-settings");
+Object.defineProperty(exports, "authSettingsLoader", { enumerable: true, get: function () { return auth_settings_1.authSettingsLoader; } });
+/**
+ * Convenience: create a registry pre-loaded with all built-in loaders.
+ */
+const registry_2 = require("./registry");
+const rls_2 = require("./rls");
+const cors_2 = require("./cors");
+const database_settings_2 = require("./database-settings");
+const pubkey_2 = require("./pubkey");
+const webauthn_2 = require("./webauthn");
+const auth_settings_2 = require("./auth-settings");
+function createDefaultRegistry() {
+    const registry = (0, registry_2.createLoaderRegistry)();
+    registry.register(rls_2.rlsLoader);
+    registry.register(cors_2.corsLoader);
+    registry.register(database_settings_2.databaseSettingsLoader);
+    registry.register(pubkey_2.pubkeyLoader);
+    registry.register(webauthn_2.webauthnLoader);
+    registry.register(auth_settings_2.authSettingsLoader);
+    return registry;
+}

package/loaders/pubkey.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pubkey Challenge Settings Loader
+ *
+ * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
+ * function names). Tries the new pubkey_settings table first, falls back
+ * to the legacy api_modules approach.
+ */
+import type { PubkeyChallengeSettings } from '../types';
+import type { ModuleLoader } from './types';
+export declare const pubkeyLoader: ModuleLoader<PubkeyChallengeSettings>;

package/loaders/pubkey.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Pubkey Challenge Settings Loader
+ *
+ * Resolves public-key challenge auth config (crypto network, sign-in/sign-up
+ * function names). Tries the new pubkey_settings table first, falls back
+ * to the legacy api_modules approach.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pubkeyLoader = void 0;
+const create_loader_1 = require("./create-loader");
+// ─── SQL ────────────────────────────────────────────────────────────────────
+const PUBKEY_SETTINGS_SQL = `
+  SELECT
+    s.schema_name AS schema,
+    ps.crypto_network,
+    sign_up_fn.name AS sign_up_with_key,
+    sign_in_req_fn.name AS sign_in_request_challenge,
+    sign_in_fail_fn.name AS sign_in_record_failure,
+    sign_in_fn.name AS sign_in_with_challenge
+  FROM services_public.pubkey_settings ps
+  LEFT JOIN metaschema_public.schema s ON ps.schema_id = s.id
+  LEFT JOIN metaschema_public.function sign_up_fn ON ps.sign_up_with_key_function_id = sign_up_fn.id
+  LEFT JOIN metaschema_public.function sign_in_req_fn ON ps.sign_in_request_challenge_function_id = sign_in_req_fn.id
+  LEFT JOIN metaschema_public.function sign_in_fail_fn ON ps.sign_in_record_failure_function_id = sign_in_fail_fn.id
+  LEFT JOIN metaschema_public.function sign_in_fn ON ps.sign_in_with_challenge_function_id = sign_in_fn.id
+  WHERE ps.database_id = $1
+  LIMIT 1
+`;
+const PUBKEY_MODULE_SQL = `
+  SELECT data
+  FROM services_public.api_modules
+  WHERE api_id = $1 AND name = 'pubkey_challenge'
+  LIMIT 1
+`;
+// ─── Transforms ─────────────────────────────────────────────────────────────
+function fromRow(row) {
+    if (!row?.schema || !row?.sign_up_with_key)
+        return undefined;
+    return {
+        schema: row.schema,
+        cryptoNetwork: row.crypto_network,
+        signUpWithKey: row.sign_up_with_key,
+        signInRequestChallenge: row.sign_in_request_challenge,
+        signInRecordFailure: row.sign_in_record_failure,
+        signInWithChallenge: row.sign_in_with_challenge,
+    };
+}
+// ─── Loader ─────────────────────────────────────────────────────────────────
+exports.pubkeyLoader = (0, create_loader_1.createModuleLoader)({
+    name: 'pubkeyChallengeSettings',
+    ttlMs: 5 * 60_000,
+    async resolve(ctx) {
+        const { servicesPool, databaseId, apiId } = ctx;
+        // Try new pubkey_settings table first
+        try {
+            const result = await servicesPool.query(PUBKEY_SETTINGS_SQL, [databaseId]);
+            const resolved = fromRow(result.rows[0] ?? null);
+            if (resolved)
+                return resolved;
+        }
+        catch {
+            // Table may not exist yet
+        }
+        // Fall back to legacy api_modules
+        if (apiId) {
+            const result = await servicesPool.query(PUBKEY_MODULE_SQL, [apiId]);
+            return fromRow(result.rows[0]?.data ?? null);
+        }
+        return undefined;
+    },
+});

package/loaders/registry.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Loader Registry — manages a set of ModuleLoader instances.
+ *
+ * Supports two resolution modes:
+ *   - Lazy (preferred): `resolve(name, ctx)` resolves a single loader
+ *     on-demand. Only fires the SQL query if the cache misses. Middleware
+ *     requests only the loaders it actually needs.
+ *   - Eager: `resolveAll(ctx)` resolves every registered loader in
+ *     parallel. Useful for pre-warming or migration from the monolithic
+ *     svcCache pattern.
+ *
+ * Each loader's result is independently cached per databaseId — resolving
+ * one module never invalidates another.
+ */
+import type { LoaderContext, ModuleLoader } from './types';
+export interface LoaderRegistry {
+    /** Register a loader. Throws if a loader with the same name already exists. */
+    register(loader: ModuleLoader): void;
+    /**
+     * Resolve a single loader by name (lazy, on-demand).
+     * Returns undefined if the loader isn't registered or the module
+     * isn't provisioned for this database. Results are cached per databaseId
+     * inside the loader's own LRU — repeated calls are cheap.
+     */
+    resolve<T = unknown>(name: string, ctx: LoaderContext): Promise<T | undefined>;
+    /** Resolve all registered loaders in parallel (eager, for migration/pre-warm). */
+    resolveAll(ctx: LoaderContext): Promise<Record<string, unknown>>;
+    /** Get a specific loader by name (for direct access / advanced usage). */
+    get<T = unknown>(name: string): ModuleLoader<T> | undefined;
+    /** Check whether a loader is registered. */
+    has(name: string): boolean;
+    /** Invalidate caches for one database (or all databases if omitted). */
+    invalidate(databaseId?: string): void;
+    /** List all registered loader names. */
+    readonly names: string[];
+}
+export declare function createLoaderRegistry(): LoaderRegistry;

package/loaders/registry.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Loader Registry — manages a set of ModuleLoader instances.
+ *
+ * Supports two resolution modes:
+ *   - Lazy (preferred): `resolve(name, ctx)` resolves a single loader
+ *     on-demand. Only fires the SQL query if the cache misses. Middleware
+ *     requests only the loaders it actually needs.
+ *   - Eager: `resolveAll(ctx)` resolves every registered loader in
+ *     parallel. Useful for pre-warming or migration from the monolithic
+ *     svcCache pattern.
+ *
+ * Each loader's result is independently cached per databaseId — resolving
+ * one module never invalidates another.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLoaderRegistry = createLoaderRegistry;
+const logger_1 = require("@pgpmjs/logger");
+const log = new logger_1.Logger('loader-registry');
+function createLoaderRegistry() {
+    const loaders = new Map();
+    return {
+        register(loader) {
+            if (loaders.has(loader.name)) {
+                throw new Error(`Loader "${loader.name}" is already registered`);
+            }
+            loaders.set(loader.name, loader);
+            log.debug(`Registered loader: ${loader.name}`);
+        },
+        async resolve(name, ctx) {
+            const loader = loaders.get(name);
+            if (!loader) {
+                log.debug(`Loader "${name}" not registered, returning undefined`);
+                return undefined;
+            }
+            return loader.resolve(ctx);
+        },
+        async resolveAll(ctx) {
+            if (loaders.size === 0)
+                return {};
+            const entries = Array.from(loaders.entries());
+            const results = await Promise.all(entries.map(async ([name, loader]) => {
+                const value = await loader.resolve(ctx);
+                return [name, value];
+            }));
+            const modules = {};
+            for (const [name, value] of results) {
+                if (value !== undefined) {
+                    modules[name] = value;
+                }
+            }
+            return modules;
+        },
+        get(name) {
+            return loaders.get(name);
+        },
+        has(name) {
+            return loaders.has(name);
+        },
+        invalidate(databaseId) {
+            for (const loader of loaders.values()) {
+                loader.invalidate(databaseId);
+            }
+            log.debug(databaseId
+                ? `Invalidated all loaders for databaseId=${databaseId}`
+                : 'Invalidated all loaders');
+        },
+        get names() {
+            return Array.from(loaders.keys());
+        },
+    };
+}

package/loaders/rls.d.ts

@@ -0,0 +1,10 @@
+/**
+ * RLS Module Loader
+ *
+ * Resolves RLS authentication function names and schema references for
+ * a given database. Tries the new rls_settings table first, falls back
+ * to the legacy api_modules approach.
+ */
+import type { RlsModule } from '../types';
+import type { ModuleLoader } from './types';
+export declare const rlsLoader: ModuleLoader<RlsModule>;