@constructive-io/graphql-server 4.41.1 → 4.42.1

package/esm/middleware/fn.js

@@ -0,0 +1,191 @@
+/**
+ * fn — REST function invocation routes
+ *
+ *   POST /fn/:alias           → invoke a function bound to this API (202 { invocationId })
+ *   GET  /fn/invocations/:id  → read invocation status/result
+ *
+ * Routing is per-API: bindings are looked up by (api_id, alias) across the
+ * bindings tables of every provisioned function-module scope, where api_id
+ * comes from the server-side domain resolution (req.constructive.api.apiId)
+ * — never from client input. RLS on the underlying tables governs access.
+ *
+ * Per-protocol enablement lives in the binding's `config` jsonb:
+ *   { "graphql": true, "rest": { "path": "/...", "methods": ["POST"] } }
+ * An absent `rest` key means REST is disabled for the binding.
+ *
+ * All queries run through req.constructive.withPgClient, which applies the
+ * request's pgSettings (role + jwt.claims.* incl. jwt.claims.api_id) in a
+ * transaction — RLS is fully enforced; no superuser or bypass path is used.
+ */
+import { Logger } from '@pgpmjs/logger';
+import { isUuid } from '@pgpmjs/server-utils';
+import { QueryBuilder } from '@constructive-io/query-builder';
+import express, { Router } from 'express';
+const log = new Logger('fn');
+const notFound = (res) => {
+    res.status(404).json({ error: 'Not found' });
+};
+async function handleInvoke(req, res) {
+    const ctx = req.constructive;
+    if (!ctx?.api?.apiId) {
+        notFound(res);
+        return;
+    }
+    const compute = await ctx.useModule('compute');
+    if (!compute?.modules.length) {
+        notFound(res);
+        return;
+    }
+    const alias = req.params.alias;
+    try {
+        // Resolve the alias across every function-module scope's bindings table.
+        const resolved = await ctx.withPgClient(async (client) => {
+            const matches = [];
+            for (const module of compute.modules) {
+                // Binding lookup carries everything the invocation insert needs:
+                // the binding id (api_binding_id), the definition it points at
+                // (function_definition_id), the resolved task_identifier, and config.
+                const { text, values } = new QueryBuilder()
+                    .schema(module.schemaName)
+                    .table(module.bindingsTableName, 'b')
+                    .select(['b.id', 'b.function_definition_id', 'b.config', 'd.task_identifier'])
+                    .innerJoin(module.definitionsTableName, 'b.function_definition_id', '=', 'd.id', {
+                    schema: module.schemaName,
+                    alias: 'd',
+                })
+                    .where('b.api_id', '=', ctx.api.apiId)
+                    .where('b.alias', '=', alias)
+                    .build();
+                const { rows } = await client.query(text, values);
+                for (const row of rows) {
+                    matches.push({ binding: row, module });
+                }
+            }
+            return matches;
+        });
+        if (resolved.length > 1) {
+            // Same alias bound to this API from more than one scope — ambiguous.
+            res.status(409).json({ error: `Alias "${alias}" is ambiguous for this API` });
+            return;
+        }
+        const binding = resolved[0]?.binding;
+        // 404 when the binding doesn't exist, REST is disabled for the binding
+        // (absent `rest` config), or the HTTP method isn't allowed.
+        const rest = binding?.config?.rest;
+        if (!binding || !rest) {
+            notFound(res);
+            return;
+        }
+        const methods = (rest.methods ?? ['POST']).map((m) => m.toUpperCase());
+        if (!methods.includes(req.method)) {
+            notFound(res);
+            return;
+        }
+        // TODO: JSON-Schema (ajv) payload validation hook — intentionally deferred.
+        // When enabled it should validate req.body against the binding/function
+        // input schema here, before the invocation row is inserted.
+        const payload = req.body ?? {};
+        const { invocationsSchemaName, invocationsTableName, invocationsEntityField } = resolved[0].module;
+        // API-channel provenance: set both the definition and the binding the
+        // invocation came through, at status 'pending'. The database's AFTER
+        // INSERT enqueue trigger schedules the job — the server never enqueues.
+        const insertData = {
+            task_identifier: binding.task_identifier,
+            function_definition_id: binding.function_definition_id,
+            api_binding_id: binding.id,
+            status: 'pending',
+            payload: JSON.stringify(payload),
+        };
+        // Scope-key column driven by the module's recorded entity_field: set for
+        // the database scope (database_id), absent for global scopes. Never a
+        // switch on scope name.
+        if (invocationsEntityField) {
+            insertData[invocationsEntityField] = ctx.api.databaseId ?? ctx.databaseId;
+        }
+        const { text, values } = new QueryBuilder()
+            .schema(invocationsSchemaName)
+            .table(invocationsTableName)
+            .insert(insertData)
+            .returning(['id'])
+            .build();
+        const invocationId = await ctx.withPgClient(async (client) => {
+            const { rows } = await client.query(text, values);
+            return rows[0].id;
+        });
+        res.status(202).json({ invocationId });
+    }
+    catch (err) {
+        if (err?.code === '42501') {
+            // insufficient_privilege — RLS rejected the insert for this caller
+            res.status(403).json({ error: 'Forbidden' });
+            return;
+        }
+        log.error({ event: 'fn_invoke_failed', alias, requestId: req.requestId, error: err?.message });
+        res.status(500).json({ error: 'Internal server error' });
+    }
+}
+async function handleGetInvocation(req, res) {
+    const ctx = req.constructive;
+    if (!ctx?.api?.apiId) {
+        notFound(res);
+        return;
+    }
+    const id = req.params.id;
+    if (!isUuid(id)) {
+        notFound(res);
+        return;
+    }
+    const compute = await ctx.useModule('compute');
+    if (!compute?.modules.length) {
+        notFound(res);
+        return;
+    }
+    try {
+        const invocation = await ctx.withPgClient(async (client) => {
+            // Invocation tables are per-scope; search each distinct one.
+            const seen = new Set();
+            for (const module of compute.modules) {
+                const key = `${module.invocationsSchemaName}.${module.invocationsTableName}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const { text, values } = new QueryBuilder()
+                    .schema(module.invocationsSchemaName)
+                    .table(module.invocationsTableName)
+                    .select(['id', 'status', 'result', 'error', 'created_at', 'started_at', 'completed_at', 'duration_ms'])
+                    .where('id', '=', id)
+                    .build();
+                const { rows } = await client.query(text, values);
+                if (rows[0])
+                    return rows[0];
+            }
+            return undefined;
+        });
+        // RLS-filtered read: rows not visible to the caller simply aren't returned
+        if (!invocation) {
+            notFound(res);
+            return;
+        }
+        res.status(200).json({
+            id: invocation.id,
+            status: invocation.status,
+            result: invocation.result,
+            error: invocation.error,
+            createdAt: invocation.created_at,
+            startedAt: invocation.started_at,
+            completedAt: invocation.completed_at,
+            durationMs: invocation.duration_ms
+        });
+    }
+    catch (err) {
+        log.error({ event: 'fn_get_invocation_failed', id, requestId: req.requestId, error: err?.message });
+        res.status(500).json({ error: 'Internal server error' });
+    }
+}
+export function createFnRouter() {
+    const router = Router();
+    router.use('/fn', express.json());
+    router.get('/fn/invocations/:id', handleGetInvocation);
+    router.all('/fn/:alias', handleInvoke);
+    return router;
+}

package/esm/middleware/graphile.js

@@ -2,6 +2,7 @@ import crypto from 'node:crypto';
 import { getNodeEnv } from '@pgpmjs/env';
 import { Logger } from '@pgpmjs/logger';
 import { createGraphileInstance, graphileCache } from 'graphile-cache';
+import { createFunctionBindingsPlugin } from 'graphile-function-bindings';
 import { createConstructivePreset, makePgService } from 'graphile-settings';
 import { getPgPool } from 'pg-cache';
 import { getPgEnvOptions } from 'pg-env';
@@ -184,10 +185,31 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
+const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId, compute) => {
     return {
         extends: [createConstructivePreset(databaseSettings)],
-        plugins: [AuthCookiePlugin],
+        plugins: [
+            AuthCookiePlugin,
+            // Only registered when the compute module is provisioned for this
+            // database — all schema/table names come from the constructive
+            // metaschema (express-context compute module loader); the plugin has
+            // no fallbacks or discovery of its own.
+            ...(apiId && compute?.modules.length
+                ? [
+                    createFunctionBindingsPlugin({
+                        apiId,
+                        modules: compute.modules.map((m) => ({
+                            computeSchema: m.schemaName,
+                            bindingsTable: m.bindingsTableName,
+                            definitionsTable: m.definitionsTableName,
+                            invocationsSchema: m.invocationsSchemaName,
+                            invocationsTable: m.invocationsTableName,
+                            invocationsEntityField: m.invocationsEntityField,
+                        })),
+                    }),
+                ]
+                : []),
+        ],
         pgServices: [
             makePgService({
                 pool,
@@ -211,6 +233,12 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                     if (req.databaseId) {
                         context['jwt.claims.database_id'] = req.databaseId;
                     }
+                    // API provenance — which API surface this request arrived through.
+                    // Derived server-side from hostname -> services_public.domains -> api_id;
+                    // never taken from client-supplied headers, body, or token payload.
+                    if (req.api?.apiId) {
+                        context['jwt.claims.api_id'] = req.api.apiId;
+                    }
                     if (req.clientIp) {
                         context['jwt.claims.ip_address'] = req.clientIp;
                     }
@@ -333,7 +361,8 @@ export const graphile = (opts) => {
             // properly, preventing leaked connections during database teardown.
             const pool = getPgPool(pgConfig);
             // Create promise and store in in-flight map BEFORE try block
-            const preset = buildPreset(pool, schema || [], anonRole, roleName, api.databaseSettings);
+            const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
+            const preset = buildPreset(pool, schema || [], anonRole, roleName, api.databaseSettings, api.apiId, compute);
             const creationPromise = observeGraphileBuild({
                 cacheKey: key,
                 serviceKey: key,

package/esm/server.js

@@ -16,6 +16,7 @@ import { createAuthenticateMiddleware } from './middleware/auth';
 import { cors } from './middleware/cors';
 import { errorHandler, notFoundHandler } from './middleware/error-handler';
 import { favicon } from './middleware/favicon';
+import { createFnRouter } from './middleware/fn';
 import { flush, flushService } from './middleware/flush';
 import { graphile } from './middleware/graphile';
 import { multipartBridge } from './middleware/multipart-bridge';
@@ -27,7 +28,7 @@ import { createRequestLogger } from './middleware/observability/request-logger';
 import { createCaptchaMiddleware } from './middleware/captcha';
 import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { createAgenticRouter } from 'agentic-server';
-import { createContextMiddleware, requestIdMiddleware } from '@constructive-io/express-context';
+import { createContextMiddleware, createDefaultRegistry, requestIdMiddleware } from '@constructive-io/express-context';
 import { startDebugSampler } from './diagnostics/debug-sampler';
 const log = new Logger('server');
 /**
@@ -138,7 +139,7 @@ class Server {
         app.use(requestLogger);
         app.use(api);
         app.use(authenticate);
-        app.use(createContextMiddleware({ pg: effectiveOpts.pg }));
+        app.use(createContextMiddleware({ pg: effectiveOpts.pg, loaders: createDefaultRegistry() }));
         app.use(createCaptchaMiddleware());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests
@@ -171,6 +172,8 @@ class Server {
         // LLM Agent REST API — mounted before graphile so SSE streaming
         // routes are handled without going through PostGraphile
         app.use(createAgenticRouter());
+        // REST function invocation routes (POST /fn/:alias, GET /fn/invocations/:id)
+        app.use(createFnRouter());
         app.use(graphile(effectiveOpts));
         app.use(flush);
         // Error handling - MUST be LAST

package/middleware/fn.d.ts

@@ -0,0 +1,21 @@
+/**
+ * fn — REST function invocation routes
+ *
+ *   POST /fn/:alias           → invoke a function bound to this API (202 { invocationId })
+ *   GET  /fn/invocations/:id  → read invocation status/result
+ *
+ * Routing is per-API: bindings are looked up by (api_id, alias) across the
+ * bindings tables of every provisioned function-module scope, where api_id
+ * comes from the server-side domain resolution (req.constructive.api.apiId)
+ * — never from client input. RLS on the underlying tables governs access.
+ *
+ * Per-protocol enablement lives in the binding's `config` jsonb:
+ *   { "graphql": true, "rest": { "path": "/...", "methods": ["POST"] } }
+ * An absent `rest` key means REST is disabled for the binding.
+ *
+ * All queries run through req.constructive.withPgClient, which applies the
+ * request's pgSettings (role + jwt.claims.* incl. jwt.claims.api_id) in a
+ * transaction — RLS is fully enforced; no superuser or bypass path is used.
+ */
+import { Router } from 'express';
+export declare function createFnRouter(): Router;

package/middleware/fn.js

@@ -0,0 +1,227 @@
+"use strict";
+/**
+ * fn — REST function invocation routes
+ *
+ *   POST /fn/:alias           → invoke a function bound to this API (202 { invocationId })
+ *   GET  /fn/invocations/:id  → read invocation status/result
+ *
+ * Routing is per-API: bindings are looked up by (api_id, alias) across the
+ * bindings tables of every provisioned function-module scope, where api_id
+ * comes from the server-side domain resolution (req.constructive.api.apiId)
+ * — never from client input. RLS on the underlying tables governs access.
+ *
+ * Per-protocol enablement lives in the binding's `config` jsonb:
+ *   { "graphql": true, "rest": { "path": "/...", "methods": ["POST"] } }
+ * An absent `rest` key means REST is disabled for the binding.
+ *
+ * All queries run through req.constructive.withPgClient, which applies the
+ * request's pgSettings (role + jwt.claims.* incl. jwt.claims.api_id) in a
+ * transaction — RLS is fully enforced; no superuser or bypass path is used.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFnRouter = createFnRouter;
+const logger_1 = require("@pgpmjs/logger");
+const server_utils_1 = require("@pgpmjs/server-utils");
+const query_builder_1 = require("@constructive-io/query-builder");
+const express_1 = __importStar(require("express"));
+const log = new logger_1.Logger('fn');
+const notFound = (res) => {
+    res.status(404).json({ error: 'Not found' });
+};
+async function handleInvoke(req, res) {
+    const ctx = req.constructive;
+    if (!ctx?.api?.apiId) {
+        notFound(res);
+        return;
+    }
+    const compute = await ctx.useModule('compute');
+    if (!compute?.modules.length) {
+        notFound(res);
+        return;
+    }
+    const alias = req.params.alias;
+    try {
+        // Resolve the alias across every function-module scope's bindings table.
+        const resolved = await ctx.withPgClient(async (client) => {
+            const matches = [];
+            for (const module of compute.modules) {
+                // Binding lookup carries everything the invocation insert needs:
+                // the binding id (api_binding_id), the definition it points at
+                // (function_definition_id), the resolved task_identifier, and config.
+                const { text, values } = new query_builder_1.QueryBuilder()
+                    .schema(module.schemaName)
+                    .table(module.bindingsTableName, 'b')
+                    .select(['b.id', 'b.function_definition_id', 'b.config', 'd.task_identifier'])
+                    .innerJoin(module.definitionsTableName, 'b.function_definition_id', '=', 'd.id', {
+                    schema: module.schemaName,
+                    alias: 'd',
+                })
+                    .where('b.api_id', '=', ctx.api.apiId)
+                    .where('b.alias', '=', alias)
+                    .build();
+                const { rows } = await client.query(text, values);
+                for (const row of rows) {
+                    matches.push({ binding: row, module });
+                }
+            }
+            return matches;
+        });
+        if (resolved.length > 1) {
+            // Same alias bound to this API from more than one scope — ambiguous.
+            res.status(409).json({ error: `Alias "${alias}" is ambiguous for this API` });
+            return;
+        }
+        const binding = resolved[0]?.binding;
+        // 404 when the binding doesn't exist, REST is disabled for the binding
+        // (absent `rest` config), or the HTTP method isn't allowed.
+        const rest = binding?.config?.rest;
+        if (!binding || !rest) {
+            notFound(res);
+            return;
+        }
+        const methods = (rest.methods ?? ['POST']).map((m) => m.toUpperCase());
+        if (!methods.includes(req.method)) {
+            notFound(res);
+            return;
+        }
+        // TODO: JSON-Schema (ajv) payload validation hook — intentionally deferred.
+        // When enabled it should validate req.body against the binding/function
+        // input schema here, before the invocation row is inserted.
+        const payload = req.body ?? {};
+        const { invocationsSchemaName, invocationsTableName, invocationsEntityField } = resolved[0].module;
+        // API-channel provenance: set both the definition and the binding the
+        // invocation came through, at status 'pending'. The database's AFTER
+        // INSERT enqueue trigger schedules the job — the server never enqueues.
+        const insertData = {
+            task_identifier: binding.task_identifier,
+            function_definition_id: binding.function_definition_id,
+            api_binding_id: binding.id,
+            status: 'pending',
+            payload: JSON.stringify(payload),
+        };
+        // Scope-key column driven by the module's recorded entity_field: set for
+        // the database scope (database_id), absent for global scopes. Never a
+        // switch on scope name.
+        if (invocationsEntityField) {
+            insertData[invocationsEntityField] = ctx.api.databaseId ?? ctx.databaseId;
+        }
+        const { text, values } = new query_builder_1.QueryBuilder()
+            .schema(invocationsSchemaName)
+            .table(invocationsTableName)
+            .insert(insertData)
+            .returning(['id'])
+            .build();
+        const invocationId = await ctx.withPgClient(async (client) => {
+            const { rows } = await client.query(text, values);
+            return rows[0].id;
+        });
+        res.status(202).json({ invocationId });
+    }
+    catch (err) {
+        if (err?.code === '42501') {
+            // insufficient_privilege — RLS rejected the insert for this caller
+            res.status(403).json({ error: 'Forbidden' });
+            return;
+        }
+        log.error({ event: 'fn_invoke_failed', alias, requestId: req.requestId, error: err?.message });
+        res.status(500).json({ error: 'Internal server error' });
+    }
+}
+async function handleGetInvocation(req, res) {
+    const ctx = req.constructive;
+    if (!ctx?.api?.apiId) {
+        notFound(res);
+        return;
+    }
+    const id = req.params.id;
+    if (!(0, server_utils_1.isUuid)(id)) {
+        notFound(res);
+        return;
+    }
+    const compute = await ctx.useModule('compute');
+    if (!compute?.modules.length) {
+        notFound(res);
+        return;
+    }
+    try {
+        const invocation = await ctx.withPgClient(async (client) => {
+            // Invocation tables are per-scope; search each distinct one.
+            const seen = new Set();
+            for (const module of compute.modules) {
+                const key = `${module.invocationsSchemaName}.${module.invocationsTableName}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const { text, values } = new query_builder_1.QueryBuilder()
+                    .schema(module.invocationsSchemaName)
+                    .table(module.invocationsTableName)
+                    .select(['id', 'status', 'result', 'error', 'created_at', 'started_at', 'completed_at', 'duration_ms'])
+                    .where('id', '=', id)
+                    .build();
+                const { rows } = await client.query(text, values);
+                if (rows[0])
+                    return rows[0];
+            }
+            return undefined;
+        });
+        // RLS-filtered read: rows not visible to the caller simply aren't returned
+        if (!invocation) {
+            notFound(res);
+            return;
+        }
+        res.status(200).json({
+            id: invocation.id,
+            status: invocation.status,
+            result: invocation.result,
+            error: invocation.error,
+            createdAt: invocation.created_at,
+            startedAt: invocation.started_at,
+            completedAt: invocation.completed_at,
+            durationMs: invocation.duration_ms
+        });
+    }
+    catch (err) {
+        log.error({ event: 'fn_get_invocation_failed', id, requestId: req.requestId, error: err?.message });
+        res.status(500).json({ error: 'Internal server error' });
+    }
+}
+function createFnRouter() {
+    const router = (0, express_1.Router)();
+    router.use('/fn', express_1.default.json());
+    router.get('/fn/invocations/:id', handleGetInvocation);
+    router.all('/fn/:alias', handleInvoke);
+    return router;
+}

package/middleware/graphile.js

@@ -11,6 +11,7 @@ const node_crypto_1 = __importDefault(require("node:crypto"));
 const env_1 = require("@pgpmjs/env");
 const logger_1 = require("@pgpmjs/logger");
 const graphile_cache_1 = require("graphile-cache");
+const graphile_function_bindings_1 = require("graphile-function-bindings");
 const graphile_settings_1 = require("graphile-settings");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
@@ -193,10 +194,31 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
+const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId, compute) => {
     return {
         extends: [(0, graphile_settings_1.createConstructivePreset)(databaseSettings)],
-        plugins: [auth_cookie_plugin_1.AuthCookiePlugin],
+        plugins: [
+            auth_cookie_plugin_1.AuthCookiePlugin,
+            // Only registered when the compute module is provisioned for this
+            // database — all schema/table names come from the constructive
+            // metaschema (express-context compute module loader); the plugin has
+            // no fallbacks or discovery of its own.
+            ...(apiId && compute?.modules.length
+                ? [
+                    (0, graphile_function_bindings_1.createFunctionBindingsPlugin)({
+                        apiId,
+                        modules: compute.modules.map((m) => ({
+                            computeSchema: m.schemaName,
+                            bindingsTable: m.bindingsTableName,
+                            definitionsTable: m.definitionsTableName,
+                            invocationsSchema: m.invocationsSchemaName,
+                            invocationsTable: m.invocationsTableName,
+                            invocationsEntityField: m.invocationsEntityField,
+                        })),
+                    }),
+                ]
+                : []),
+        ],
         pgServices: [
             (0, graphile_settings_1.makePgService)({
                 pool,
@@ -220,6 +242,12 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings) => {
                     if (req.databaseId) {
                         context['jwt.claims.database_id'] = req.databaseId;
                     }
+                    // API provenance — which API surface this request arrived through.
+                    // Derived server-side from hostname -> services_public.domains -> api_id;
+                    // never taken from client-supplied headers, body, or token payload.
+                    if (req.api?.apiId) {
+                        context['jwt.claims.api_id'] = req.api.apiId;
+                    }
                     if (req.clientIp) {
                         context['jwt.claims.ip_address'] = req.clientIp;
                     }
@@ -342,7 +370,8 @@ const graphile = (opts) => {
             // properly, preventing leaked connections during database teardown.
             const pool = (0, pg_cache_1.getPgPool)(pgConfig);
             // Create promise and store in in-flight map BEFORE try block
-            const preset = buildPreset(pool, schema || [], anonRole, roleName, api.databaseSettings);
+            const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
+            const preset = buildPreset(pool, schema || [], anonRole, roleName, api.databaseSettings, api.apiId, compute);
             const creationPromise = (0, graphile_build_stats_1.observeGraphileBuild)({
                 cacheKey: key,
                 serviceKey: key,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "4.41.1",
+  "version": "4.42.1",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -42,17 +42,18 @@
   ],
   "dependencies": {
     "@constructive-io/csrf": "^0.17.0",
-    "@constructive-io/express-context": "^0.9.0",
+    "@constructive-io/express-context": "^0.10.0",
     "@constructive-io/graphql-env": "^3.15.0",
     "@constructive-io/graphql-types": "^3.14.0",
+    "@constructive-io/query-builder": "^2.22.0",
     "@constructive-io/s3-utils": "^2.20.0",
     "@constructive-io/url-domains": "^2.19.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
     "@pgpmjs/env": "^2.27.0",
     "@pgpmjs/logger": "^2.14.0",
-    "@pgpmjs/server-utils": "^3.15.0",
+    "@pgpmjs/server-utils": "^3.15.1",
     "@pgpmjs/types": "^2.34.0",
-    "agentic-server": "0.9.0",
+    "agentic-server": "0.9.1",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -63,7 +64,8 @@
     "graphile-build-pg": "5.0.2",
     "graphile-cache": "^3.15.0",
     "graphile-config": "1.0.1",
-    "graphile-settings": "^5.13.1",
+    "graphile-function-bindings": "^0.2.1",
+    "graphile-settings": "^5.13.3",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -85,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "4.20.1",
+    "graphile-test": "4.20.2",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "6235bf0645f56d423fa464404ec1e3283c49e532"
+  "gitHead": "fe49621d08cbf93d3b75ee7bb9b0849580980369"
 }

package/server.js

@@ -22,6 +22,7 @@ const auth_1 = require("./middleware/auth");
 const cors_1 = require("./middleware/cors");
 const error_handler_1 = require("./middleware/error-handler");
 const favicon_1 = require("./middleware/favicon");
+const fn_1 = require("./middleware/fn");
 const flush_1 = require("./middleware/flush");
 const graphile_1 = require("./middleware/graphile");
 const multipart_bridge_1 = require("./middleware/multipart-bridge");
@@ -145,7 +146,7 @@ class Server {
         app.use(requestLogger);
         app.use(api);
         app.use(authenticate);
-        app.use((0, express_context_1.createContextMiddleware)({ pg: effectiveOpts.pg }));
+        app.use((0, express_context_1.createContextMiddleware)({ pg: effectiveOpts.pg, loaders: (0, express_context_1.createDefaultRegistry)() }));
         app.use((0, captcha_1.createCaptchaMiddleware)());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests
@@ -178,6 +179,8 @@ class Server {
         // LLM Agent REST API — mounted before graphile so SSE streaming
         // routes are handled without going through PostGraphile
         app.use((0, agentic_server_1.createAgenticRouter)());
+        // REST function invocation routes (POST /fn/:alias, GET /fn/invocations/:id)
+        app.use((0, fn_1.createFnRouter)());
         app.use((0, graphile_1.graphile)(effectiveOpts));
         app.use(flush_1.flush);
         // Error handling - MUST be LAST