@constructive-io/graphql-server 5.0.4 → 5.1.0

package/esm/server.js

@@ -1,35 +1,35 @@
 import { createCsrfMiddleware } from '@constructive-io/csrf';
+import { createContextMiddleware, createDefaultRegistry, requestIdMiddleware } from '@constructive-io/express-context';
 import { getEnvOptions } from '@constructive-io/graphql-env';
+import { middleware as parseDomains } from '@constructive-io/url-domains';
 import { Logger } from '@pgpmjs/logger';
 import { healthz, poweredBy, svcCache, trustProxy } from '@pgpmjs/server-utils';
-import { middleware as parseDomains } from '@constructive-io/url-domains';
+import { createAgenticRouter } from 'agentic-server';
 import cookieParser from 'cookie-parser';
 import express from 'express';
+import { closeAllCaches, graphileCache } from 'graphile-cache';
 import graphqlUpload from 'graphql-upload';
-import { graphileCache, closeAllCaches } from 'graphile-cache';
 import { getPgPool } from 'pg-cache';
 import requestIp from 'request-ip';
 import { closeDebugDatabasePools } from './diagnostics/debug-db-snapshot';
-import { isDevelopmentObservabilityMode, isGraphqlObservabilityEnabled, isGraphqlObservabilityRequested, isLoopbackHost, } from './diagnostics/observability';
+import { startDebugSampler } from './diagnostics/debug-sampler';
+import { isDevelopmentObservabilityMode, isGraphqlObservabilityEnabled, isGraphqlObservabilityRequested, isLoopbackHost } from './diagnostics/observability';
 import { createApiMiddleware } from './middleware/api';
 import { createAuthenticateMiddleware } from './middleware/auth';
+// Auth cookie handling is done via AuthCookiePlugin in grafserv
+import { createCaptchaMiddleware } from './middleware/captcha';
+import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
 import { cors } from './middleware/cors';
 import { errorHandler, notFoundHandler } from './middleware/error-handler';
 import { favicon } from './middleware/favicon';
-import { createFnRouter } from './middleware/fn';
 import { flush, flushService } from './middleware/flush';
+import { createFnRouter } from './middleware/fn';
 import { graphile } from './middleware/graphile';
 import { multipartBridge } from './middleware/multipart-bridge';
 import { createDebugDatabaseMiddleware } from './middleware/observability/debug-db';
 import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
 import { createRequestLogger } from './middleware/observability/request-logger';
-// Auth cookie handling is done via AuthCookiePlugin in grafserv
-import { createCaptchaMiddleware } from './middleware/captcha';
-import { parseCookieValue, SESSION_COOKIE_NAME } from './middleware/cookie';
-import { createAgenticRouter } from 'agentic-server';
-import { createContextMiddleware, createDefaultRegistry, requestIdMiddleware } from '@constructive-io/express-context';
-import { startDebugSampler } from './diagnostics/debug-sampler';
 const log = new Logger('server');
 /**
  * Creates and starts a GraphQL server instance
@@ -85,12 +85,13 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            enableServicesApi: apiOpts.enableServicesApi,
+            enableScopedRouting: apiOpts.enableScopedRouting,
+            scopedRoutingSchema: apiOpts.scopedRoutingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             exposedSchemas: apiOpts.exposedSchemas?.join(',') || 'none',
             anonRole: apiOpts.anonRole,
             roleName: apiOpts.roleName,
-            observabilityEnabled,
+            observabilityEnabled
         });
         if (observabilityRequested && !observabilityEnabled) {
             const reasons = [];
@@ -129,7 +130,7 @@ class Server {
         app.use(cors(fallbackOrigin));
         app.use('/graphql', graphqlUpload.graphqlUploadExpress({
             maxFileSize: 10 * 1024 * 1024, // 10 MB
-            maxFiles: 10,
+            maxFiles: 10
         }));
         // Rewrite Content-Type after graphql-upload so grafserv accepts the request
         app.use('/graphql', multipartBridge);
@@ -147,8 +148,8 @@ class Server {
             cookieOptions: {
                 httpOnly: false, // SPA clients need to read this via document.cookie
                 secure: process.env.NODE_ENV === 'production',
-                sameSite: 'lax',
-            },
+                sameSite: 'lax'
+            }
         });
         const csrfProtect = (req, res, next) => {
             // Skip CSRF for Bearer token auth

package/middleware/api.d.ts

@@ -1,6 +1,6 @@
+import './types';
 import { NextFunction, Request, Response } from 'express';
 import { ApiConfigResult, ApiOptions } from '../types';
-import './types';
 export declare const getSubdomain: (subdomains: string[]) => string | null;
 export declare const getSvcKey: (opts: ApiOptions, req: Request) => string;
 export declare const getApiConfig: (opts: ApiOptions, req: Request) => Promise<ApiConfigResult>;

package/middleware/api.js

@@ -4,16 +4,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApiMiddleware = exports.getApiConfig = exports.getSvcKey = exports.getSubdomain = void 0;
-const env_1 = require("@pgpmjs/env");
+require("./types");
+const express_context_1 = require("@constructive-io/express-context");
+const url_domains_1 = require("@constructive-io/url-domains");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
-const url_domains_1 = require("@constructive-io/url-domains");
-const express_context_1 = require("@constructive-io/express-context");
 const pg_cache_1 = require("pg-cache");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
 const routing_1 = require("./routing");
-require("./types");
 const log = new logger_1.Logger('api');
 // =============================================================================
 // Module Loader Registry (replaces inline SQL queries for per-db config)
@@ -22,87 +21,49 @@ const defaultRegistry = (0, express_context_1.createDefaultRegistry)();
 // =============================================================================
 // SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
-const DOMAIN_LOOKUP_SQL = `
+// Private-header X-Api-Name lookup against the scoped routing plane.
+// `is_published` is the routing-plane analog of the legacy `is_public` column.
+const SCOPED_API_NAME_LOOKUP_SQL = `
   SELECT 
     a.id as api_id,
     a.database_id,
     a.dbname,
     a.role_name,
     a.anon_role,
-    a.is_public,
+    a.is_published as is_public,
     COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM services_public.domains d
-  JOIN services_public.apis a ON d.api_id = a.id
-  LEFT JOIN services_public.api_schemas aps ON a.id = aps.api_id
-  LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
-  WHERE d.domain = $1 
-    AND (($2::text IS NULL AND d.subdomain IS NULL) OR d.subdomain = $2)
-    AND a.is_public = $3
-  GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_public
-  LIMIT 1
-`;
-const API_NAME_LOOKUP_SQL = `
-  SELECT 
-    a.id as api_id,
-    a.database_id,
-    a.dbname,
-    a.role_name,
-    a.anon_role,
-    a.is_public,
-    COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM services_public.apis a
-  LEFT JOIN services_public.api_schemas aps ON a.id = aps.api_id
+  FROM constructive_routing_public.apis a
+  LEFT JOIN constructive_routing_public.api_schemas aps ON a.id = aps.api_id
   LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
   WHERE a.database_id = $1 
     AND a.name = $2
-    AND a.is_public = $3
-  GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_public
+    AND a.is_published = $3
+  GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_published
   LIMIT 1
 `;
-const API_LIST_SQL = `
-  SELECT 
-    a.id,
-    a.database_id,
-    a.name,
-    a.dbname,
-    a.role_name,
-    a.anon_role,
-    a.is_public,
-    COALESCE(
-      json_agg(
-        json_build_object('domain', d.domain, 'subdomain', d.subdomain)
-      ) FILTER (WHERE d.domain IS NOT NULL),
-      '[]'
-    ) as domains
-  FROM services_public.apis a
-  LEFT JOIN services_public.domains d ON a.id = d.api_id
-  WHERE a.is_public = $1
-  GROUP BY a.id, a.database_id, a.name, a.dbname, a.role_name, a.anon_role, a.is_public
-  LIMIT 100
-`;
 /**
  * Build a LoaderContext from the API row and options.
  * This is used to resolve per-database module settings via the loader registry.
  */
-const buildLoaderContext = (servicesPool, opts, row) => ({
-    servicesPool,
+const buildLoaderContext = (routingPool, opts, row) => ({
+    routingPool,
     tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: row.dbname }),
     databaseId: row.database_id,
     apiId: row.api_id,
-    dbname: row.dbname,
+    dbname: row.dbname
 });
 /**
  * Resolve all per-database module settings in parallel via the loader registry.
  * Each loader independently caches by databaseId — repeated calls are cheap.
  */
 const resolveModuleSettings = async (registry, ctx) => {
-    const [rlsModule, authSettings, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings,] = await Promise.all([
+    const [rlsModule, authSettings, corsOrigins, databaseSettings, pubkeyChallengeSettings, webauthnSettings] = await Promise.all([
         registry.resolve('rlsModule', ctx),
         registry.resolve('authSettings', ctx),
         registry.resolve('corsOrigins', ctx),
         registry.resolve('databaseSettings', ctx),
         registry.resolve('pubkeyChallengeSettings', ctx),
-        registry.resolve('webauthnSettings', ctx),
+        registry.resolve('webauthnSettings', ctx)
     ]);
     return {
         rlsModule,
@@ -110,7 +71,7 @@ const resolveModuleSettings = async (registry, ctx) => {
         corsOrigins,
         databaseSettings,
         pubkeyChallengeSettings,
-        webauthnSettings,
+        webauthnSettings
     };
 };
 // =============================================================================
@@ -131,14 +92,14 @@ const getRoutingHeaders = (req) => ({
     schemata: req.get('X-Schemata'),
     apiName: req.get('X-Api-Name'),
     metaSchema: req.get('X-Meta-Schema'),
-    databaseId: req.get('X-Database-Id'),
+    databaseId: req.get('X-Database-Id')
 });
 const getUrlDomains = (req) => {
     const fullUrl = `${req.protocol}://${req.get('host')}${req.originalUrl}`;
     const parsed = (0, url_domains_1.parseUrl)(fullUrl);
     return {
         domain: parsed.domain ?? '',
-        subdomains: parsed.subdomains ?? [],
+        subdomains: parsed.subdomains ?? []
     };
 };
 const getSubdomain = (subdomains) => {
@@ -180,7 +141,7 @@ const toApiStructure = (row, opts, settings = {}) => ({
     corsOrigins: settings.corsOrigins,
     databaseSettings: settings.databaseSettings,
     pubkeyChallengeSettings: settings.pubkeyChallengeSettings,
-    webauthnSettings: settings.webauthnSettings,
+    webauthnSettings: settings.webauthnSettings
 });
 const createAdminStructure = (opts, schemas, databaseId) => ({
     dbname: opts.pg?.database ?? '',
@@ -190,7 +151,7 @@ const createAdminStructure = (opts, schemas, databaseId) => ({
     apiModules: [],
     domains: [],
     databaseId,
-    isPublic: false,
+    isPublic: false
 });
 // =============================================================================
 // Database Queries (API resolution only)
@@ -199,31 +160,25 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByDomain = async (pool, domain, subdomain, isPublic) => {
-    const result = await pool.query(DOMAIN_LOOKUP_SQL, [domain, subdomain, isPublic]);
-    return result.rows[0] ?? null;
-};
 const queryByApiName = async (pool, databaseId, name, isPublic) => {
-    const result = await pool.query(API_NAME_LOOKUP_SQL, [databaseId, name, isPublic]);
+    const result = await pool.query(SCOPED_API_NAME_LOOKUP_SQL, [databaseId, name, isPublic]);
     return result.rows[0] ?? null;
 };
-const queryApiList = async (pool, isPublic) => {
-    const result = await pool.query(API_LIST_SQL, [isPublic]);
-    return result.rows;
-};
 // =============================================================================
 // Resolution Logic
 // =============================================================================
 const determineMode = (ctx) => {
     const { opts, headers } = ctx;
-    if (opts.api?.enableServicesApi === false)
-        return 'services-disabled';
+    // Static single-tenant mode: scoped routing off — expose configured schemas
+    // directly with no route resolution.
+    if (!opts.api?.enableScopedRouting)
+        return 'static';
     if (opts.api?.isPublic === false) {
-        return getPrivateHeaderMode(headers) ?? 'domain-lookup';
+        return getPrivateHeaderMode(headers) ?? 'scoped-route';
     }
-    return 'domain-lookup';
+    return 'scoped-route';
 };
-const resolveServicesDisabled = (ctx) => {
+const resolveStatic = (ctx) => {
     const { opts } = ctx;
     return {
         dbname: opts.pg?.database ?? '',
@@ -233,7 +188,7 @@ const resolveServicesDisabled = (ctx) => {
         apiModules: [],
         domains: [],
         databaseId: opts.api?.defaultDatabaseId,
-        isPublic: false,
+        isPublic: false
     };
 };
 const resolveSchemataHeader = async (ctx, validatedSchemas) => {
@@ -265,12 +220,12 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
     return createAdminStructure(ctx.opts, validatedSchemas, ctx.headers.databaseId);
 };
 /**
- * Scoped routing plane resolution (additive, host-only): one indexed
- * resolve_route() call against the compiled hostname/route bindings.
- * Path/method routing belongs to Traefik/Ingress — the server only maps
- * host → tenant/api/db/role. Returns null (fall back to the legacy
- * services_public lookup) when disabled, unmatched, resolver not installed,
- * or the target is not an api surface.
+ * Scoped routing plane resolution (host-only): one indexed resolve_route()
+ * call against the compiled hostname/route bindings. Path/method routing
+ * belongs to Traefik/Ingress — the server only maps host → tenant/api/db/role.
+ * This is the sole host resolver. Returns null (→ 404) when disabled,
+ * unmatched, the resolver is not installed, or the target is not an api
+ * surface. There is no legacy fallback.
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
@@ -293,7 +248,7 @@ const resolveScopedRoute = async (ctx) => {
         role_name: structure.roleName,
         anon_role: structure.anonRole,
         is_public: structure.isPublic ?? false,
-        schemas: structure.schema,
+        schemas: structure.schema
     });
     const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
     return {
@@ -303,63 +258,7 @@ const resolveScopedRoute = async (ctx) => {
         corsOrigins: settings.corsOrigins,
         databaseSettings: settings.databaseSettings,
         pubkeyChallengeSettings: settings.pubkeyChallengeSettings,
-        webauthnSettings: settings.webauthnSettings,
-    };
-};
-const resolveDomainLookup = async (ctx) => {
-    const { opts, pool, domain, subdomain } = ctx;
-    const isPublic = opts.api?.isPublic ?? false;
-    log.debug(`[domain-lookup] domain=${domain} subdomain=${subdomain} isPublic=${isPublic}`);
-    const row = await queryByDomain(pool, domain, subdomain, isPublic);
-    if (!row) {
-        log.debug(`[domain-lookup] No API found for domain=${domain} subdomain=${subdomain}`);
-        return null;
-    }
-    const loaderCtx = buildLoaderContext(pool, opts, row);
-    const settings = await resolveModuleSettings(defaultRegistry, loaderCtx);
-    log.debug(`[domain-lookup] resolved schemas: [${row.schemas?.join(', ')}], rlsModule: ${settings.rlsModule ? 'found' : 'none'}, authSettings: ${settings.authSettings ? 'found' : 'none'}`);
-    return toApiStructure(row, opts, settings);
-};
-const buildDevFallbackError = async (ctx, req) => {
-    if ((0, env_1.getNodeEnv)() !== 'development')
-        return null;
-    const isPublic = ctx.opts.api?.isPublic ?? false;
-    const apis = await queryApiList(ctx.pool, isPublic);
-    if (!apis.length)
-        return null;
-    const host = req.get('host') || '';
-    const portMatch = host.match(/:(\d+)$/);
-    const port = portMatch ? portMatch[1] : '';
-    const apiCards = apis.map((api) => {
-        const domains = api.domains.length
-            ? api.domains.map((d) => {
-                const hostname = d.subdomain ? `${d.subdomain}.${d.domain}` : d.domain;
-                const url = port ? `http://${hostname}:${port}/graphiql` : `http://${hostname}/graphiql`;
-                return `<a href="${url}" style="color:#01A1FF;text-decoration:none;font-weight:500" onmouseover="this.style.textDecoration='underline'" onmouseout="this.style.textDecoration='none'">${hostname}</a>`;
-            }).join('<span style="color:#D4DCEA;margin:0 4px">·</span>')
-            : '<span style="color:#8E9398;font-style:italic;font-size:11px">no domains</span>';
-        const badge = api.is_public
-            ? '<span style="color:#01A1FF;font-size:10px;font-weight:500">public</span>'
-            : '<span style="color:#8E9398;font-size:10px">private</span>';
-        return `
-      <div style="background:#fff;border-radius:8px;padding:10px 14px;margin-bottom:6px;box-shadow:0 1px 3px rgba(0,0,0,0.04);border:1px solid #E8ECF0;display:flex;align-items:center;gap:12px;transition:background 0.15s" onmouseover="this.style.background='#FAFBFC'" onmouseout="this.style.background='#fff'">
-        <div style="flex:1;min-width:0;display:flex;align-items:center;gap:8px;font-size:13px">
-          <span style="font-weight:600;color:#232323;white-space:nowrap">${api.name}</span>
-          <span style="color:#D4DCEA">→</span>
-          ${domains}
-        </div>
-        <div style="display:flex;align-items:center;gap:8px;flex-shrink:0">
-          <span style="color:#8E9398;font-size:11px;font-family:'SF Mono',Monaco,monospace">${api.dbname}</span>
-          ${badge}
-        </div>
-      </div>`;
-    }).join('');
-    return {
-        errorHtml: `
-      <div style="text-align:left;max-width:600px;margin:0 auto">
-        <p style="color:#8E9398;font-size:11px;margin-bottom:10px;font-weight:500;text-transform:uppercase;letter-spacing:0.5px">Available APIs</p>
-        ${apiCards}
-      </div>`,
+        webauthnSettings: settings.webauthnSettings
     };
 };
 // =============================================================================
@@ -384,7 +283,7 @@ const getApiConfig = async (opts, req) => {
         subdomain,
         cacheKey,
         headers: getRoutingHeaders(req),
-        host: req.get('host') || '',
+        host: req.get('host') || ''
     };
     // Validate schemas upfront for modes that need them
     const apiOpts = opts.api || {};
@@ -404,8 +303,8 @@ const getApiConfig = async (opts, req) => {
     const mode = determineMode(ctx);
     let result;
     switch (mode) {
-        case 'services-disabled':
-            result = resolveServicesDisabled(ctx);
+        case 'static':
+            result = resolveStatic(ctx);
             break;
         case 'schemata-header':
             result = await resolveSchemataHeader(ctx, validatedSchemas);
@@ -416,16 +315,8 @@ const getApiConfig = async (opts, req) => {
         case 'meta-schema-header':
             result = resolveMetaSchemaHeader(ctx, validatedSchemas);
             break;
-        case 'domain-lookup':
+        case 'scoped-route':
             result = await resolveScopedRoute(ctx);
-            if (!result) {
-                result = await resolveDomainLookup(ctx);
-            }
-            if (!result && apiOpts.isPublic) {
-                const fallback = await buildDevFallbackError(ctx, req);
-                if (fallback)
-                    return fallback;
-            }
             break;
     }
     // Cache successful results
@@ -441,19 +332,20 @@ exports.getApiConfig = getApiConfig;
 const createApiMiddleware = (opts) => {
     return async (req, res, next) => {
         log.debug(`[api-middleware] ${req.method} ${req.path}`);
-        // Fast path: services disabled
-        if (opts.api?.enableServicesApi === false) {
-            req.api = resolveServicesDisabled({
+        // Fast path: static single-tenant mode (scoped routing disabled) — no
+        // route resolution, expose the configured schemas directly.
+        if (!opts.api?.enableScopedRouting) {
+            req.api = resolveStatic({
                 opts,
                 pool: null,
                 domain: '',
                 subdomain: null,
-                cacheKey: 'meta-api-off',
+                cacheKey: 'static',
                 headers: {},
-                host: '',
+                host: ''
             });
             req.databaseId = req.api.databaseId;
-            req.svc_key = 'meta-api-off';
+            req.svc_key = 'static';
             return next();
         }
         try {

package/middleware/flush.d.ts

@@ -1,5 +1,5 @@
+import './types';
 import { ConstructiveOptions } from '@constructive-io/graphql-types';
 import { NextFunction, Request, Response } from 'express';
-import './types';
 export declare const flush: (req: Request, res: Response, next: NextFunction) => Promise<void>;
 export declare const flushService: (opts: ConstructiveOptions, databaseId: string) => Promise<void>;

package/middleware/flush.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flushService = exports.flush = void 0;
+require("./types"); // for Request type
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const graphile_cache_1 = require("graphile-cache");
 const pg_cache_1 = require("pg-cache");
-require("./types"); // for Request type
 const log = new logger_1.Logger('flush');
 const flush = async (req, res, next) => {
     if (req.url === '/flush') {
@@ -32,19 +32,13 @@ const flushService = async (opts, databaseId) => {
             }
         });
     }
-    const svc = await pgPool.query(`SELECT *
-     FROM services_public.domains
+    const svc = await pgPool.query(`SELECT hostname
+     FROM constructive_routing_public.domains
      WHERE database_id = $1`, [databaseId]);
     if (svc.rowCount === 0)
         return;
     for (const row of svc.rows) {
-        let key;
-        if (row.domain && !row.subdomain) {
-            key = row.domain;
-        }
-        else if (row.domain && row.subdomain) {
-            key = `${row.subdomain}.${row.domain}`;
-        }
+        const key = row.hostname || undefined;
         if (key) {
             graphile_cache_1.graphileCache.delete(key);
             server_utils_1.svcCache.delete(key);

package/middleware/graphile.d.ts

@@ -1,6 +1,6 @@
+import './types';
 import type { ConstructiveOptions } from '@constructive-io/graphql-types';
 import type { RequestHandler } from 'express';
-import './types';
 /**
  * Returns the number of currently in-flight handler creation operations.
  * Useful for monitoring and debugging.

package/middleware/graphile.js

@@ -7,6 +7,7 @@ exports.graphile = void 0;
 exports.getInFlightCount = getInFlightCount;
 exports.getInFlightKeys = getInFlightKeys;
 exports.clearInFlightMap = clearInFlightMap;
+require("./types"); // for Request type
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const env_1 = require("@pgpmjs/env");
 const logger_1 = require("@pgpmjs/logger");
@@ -15,11 +16,10 @@ const graphile_function_bindings_1 = require("graphile-function-bindings");
 const graphile_settings_1 = require("graphile-settings");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
-require("./types"); // for Request type
 const observability_1 = require("../diagnostics/observability");
 const api_errors_1 = require("../errors/api-errors");
-const graphile_build_stats_1 = require("./observability/graphile-build-stats");
 const auth_cookie_plugin_1 = require("../plugins/auth-cookie-plugin");
+const graphile_build_stats_1 = require("./observability/graphile-build-stats");
 const maskErrorLog = new logger_1.Logger('graphile:maskError');
 const SAFE_ERROR_CODES = new Set([
     // GraphQL standard
@@ -124,7 +124,7 @@ const SAFE_ERROR_CODES = new Set([
     '23503', // foreign_key_violation
     '23502', // not_null_violation
     '23514', // check_violation
-    '23P01', // exclusion_violation
+    '23P01' // exclusion_violation
 ]);
 /**
  * Production-aware error masking function.
@@ -151,8 +151,8 @@ const maskError = (error) => {
         message: `An unexpected error occurred. Reference: ${errorId}`,
         extensions: {
             code: 'INTERNAL_SERVER_ERROR',
-            errorId,
-        },
+            errorId
+        }
     };
 };
 // =============================================================================
@@ -213,24 +213,24 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                             definitionsTable: m.definitionsTableName,
                             invocationsSchema: m.invocationsSchemaName,
                             invocationsTable: m.invocationsTableName,
-                            invocationsEntityField: m.invocationsEntityField,
-                        })),
-                    }),
+                            invocationsEntityField: m.invocationsEntityField
+                        }))
+                    })
                 ]
-                : []),
+                : [])
         ],
         pgServices: [
             (0, graphile_settings_1.makePgService)({
                 pool,
-                schemas,
-            }),
+                schemas
+            })
         ],
         grafserv: {
             graphqlPath: '/graphql',
             graphiqlPath: '/graphiql',
             graphiql: true,
             graphiqlOnGraphQLGET: false,
-            maskError,
+            maskError
         },
         grafast: {
             explain: process.env.NODE_ENV === 'development',
@@ -243,8 +243,9 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                         context['jwt.claims.database_id'] = req.databaseId;
                     }
                     // API provenance — which API surface this request arrived through.
-                    // Derived server-side from hostname -> services_public.domains -> api_id;
-                    // never taken from client-supplied headers, body, or token payload.
+                    // Derived server-side by resolving the hostname through the scoped
+                    // routing plane (resolve_route -> api_id); never taken from
+                    // client-supplied headers, body, or token payload.
                     if (req.api?.apiId) {
                         context['jwt.claims.api_id'] = req.api.apiId;
                     }
@@ -265,7 +266,7 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                             role: roleName,
                             'jwt.claims.token_id': req.token.id,
                             'jwt.claims.user_id': req.token.user_id,
-                            ...context,
+                            ...context
                         };
                         if (req.token.session_id) {
                             pgSettings['jwt.claims.session_id'] = req.token.session_id;
@@ -292,16 +293,16 @@ const buildPreset = (pool, schemas, anonRole, roleName, databaseSettings, apiId,
                 }
                 const anonSettings = {
                     role: anonRole,
-                    ...context,
+                    ...context
                 };
                 if (req?.requestId) {
                     anonSettings['request.id'] = req.requestId;
                 }
                 return {
-                    pgSettings: anonSettings,
+                    pgSettings: anonSettings
                 };
-            },
-        },
+            }
+        }
     };
 };
 const graphile = (opts) => {
@@ -364,7 +365,7 @@ const graphile = (opts) => {
             log.info(`${label} Building PostGraphile v5 handler key=${key} db=${dbname} schemas=${schemaLabel} role=${roleName} anon=${anonRole}`);
             const pgConfig = (0, pg_env_1.getPgEnvOptions)({
                 ...opts.pg,
-                database: dbname,
+                database: dbname
             });
             // Route through pg-cache so the pool is tracked and can be cleaned up
             // properly, preventing leaked connections during database teardown.
@@ -375,11 +376,11 @@ const graphile = (opts) => {
             const creationPromise = (0, graphile_build_stats_1.observeGraphileBuild)({
                 cacheKey: key,
                 serviceKey: key,
-                databaseId: api.databaseId ?? null,
+                databaseId: api.databaseId ?? null
             }, () => (0, graphile_cache_1.createGraphileInstance)({
                 preset,
                 cacheKey: key,
-                enableRealtime: api.databaseSettings?.enableRealtime,
+                enableRealtime: api.databaseSettings?.enableRealtime
             }), { enabled: observabilityEnabled });
             creating.set(key, creationPromise);
             try {
@@ -392,7 +393,7 @@ const graphile = (opts) => {
                 log.error(`${label} Failed to create PostGraphile[${key}]:`, error);
                 throw new api_errors_1.HandlerCreationError(`Failed to create handler for ${key}: ${error instanceof Error ? error.message : String(error)}`, {
                     cacheKey: key,
-                    cause: error instanceof Error ? error.message : String(error),
+                    cause: error instanceof Error ? error.message : String(error)
                 });
             }
             finally {