@constructive-io/graphql-server 5.3.3 → 5.4.0

package/README.md

@@ -103,7 +103,7 @@ For the operational workflow, sampler output, and heap snapshot usage, see [docs
 
 This is a production-only server: every request is resolved through the scoped-routing plane. There is no static single-tenant mode and no flag to disable routing. For single-database local development without route resolution or a database id, use [`@constructive-io/graphql-dev-server`](../dev-server/README.md).
 
-- The server resolves the request host with a single `resolve_route()` call against the compiled route bindings in the scoped routing schema (`API_SCOPED_ROUTING_SCHEMA`, default `constructive_routing_public`), mapping host → tenant/api/database/role.
+- The server resolves the request host with a single `resolve_route()` call against the compiled route bindings in the scoped routing schema (`API_ROUTING_SCHEMA`, default `routing_public`), mapping host → tenant/api/database/role.
 - Only APIs where `api.is_public` matches `API_IS_PUBLIC` are served.
 - In private mode (`API_IS_PUBLIC=false`), you can override with headers:
   - `X-Api-Name` + `X-Database-Id`
@@ -126,10 +126,10 @@ Configuration is merged from defaults, config files, and env vars via `@construc
 | `FEATURES_SIMPLE_INFLECTION`   | Enable simple inflection              | `true`                                                        |
 | `FEATURES_OPPOSITE_BASE_NAMES` | Enable opposite base names            | `true`                                                        |
 | `FEATURES_POSTGIS`             | Enable PostGIS support                | `true`                                                        |
-| `API_SCOPED_ROUTING_SCHEMA`    | Schema containing `resolve_route()`   | `constructive_routing_public`                                 |
+| `API_ROUTING_SCHEMA`    | Schema containing `resolve_route()`   | `routing_public`                                 |
 | `API_IS_PUBLIC`                | Serve public APIs only                | `true`                                                        |
 | `API_EXPOSED_SCHEMAS`          | Additional schemas to expose          | empty                                                         |
-| `API_META_SCHEMAS`             | Meta schemas to query                 | `constructive_routing_public,metaschema_public,metaschema_modules_public` |
+| `API_META_SCHEMAS`             | Meta schemas to query                 | `routing_public,metaschema_public,metaschema_modules_public` |
 | `API_ANON_ROLE`                | Anonymous role name                   | `administrator`                                               |
 | `API_ROLE_NAME`                | Authenticated role name               | `administrator`                                               |
 | `GRAPHQL_OBSERVABILITY_ENABLED` | Master switch for debug routes and sampler | `false`                                                  |

package/esm/middleware/api.js

@@ -6,7 +6,7 @@ import { svcCache } from '@pgpmjs/server-utils';
 import { getPgPool } from 'pg-cache';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
-import { resolveRoute, routeToApiStructure } from './routing';
+import { getRoutingSchema, isValidSchemaName, resolveRoute, routeToApiStructure } from './routing';
 const log = new Logger('api');
 // =============================================================================
 // Module Loader Registry (replaces inline SQL queries for per-db config)
@@ -17,7 +17,7 @@ const defaultRegistry = createDefaultRegistry();
 // =============================================================================
 // Private-header X-Api-Name lookup against the scoped routing plane.
 // `is_published` is the routing-plane analog of the legacy `is_public` column.
-const SCOPED_API_NAME_LOOKUP_SQL = `
+const scopedApiNameLookupSql = (routingSchema) => `
   SELECT 
     a.id as api_id,
     a.database_id,
@@ -26,8 +26,8 @@ const SCOPED_API_NAME_LOOKUP_SQL = `
     a.anon_role,
     a.is_published as is_public,
     COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM constructive_routing_public.apis a
-  LEFT JOIN constructive_routing_public.api_schemas aps ON a.id = aps.api_id
+  FROM "${routingSchema}".apis a
+  LEFT JOIN "${routingSchema}".api_schemas aps ON a.id = aps.api_id
   LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
   WHERE a.database_id = $1 
     AND a.name = $2
@@ -41,6 +41,7 @@ const SCOPED_API_NAME_LOOKUP_SQL = `
  */
 const buildLoaderContext = (routingPool, opts, row) => ({
     routingPool,
+    routingSchema: getRoutingSchema(opts),
     tenantPool: getPgPool({ ...opts.pg, database: row.dbname }),
     databaseId: row.database_id,
     apiId: row.api_id,
@@ -136,7 +137,6 @@ const toApiStructure = (row, opts, settings = {}) => ({
     anonRole: row.anon_role || 'anon',
     roleName: row.role_name || 'authenticated',
     schema: row.schemas || [],
-    apiModules: [],
     rlsModule: settings.rlsModule,
     domains: [],
     databaseId: row.database_id,
@@ -152,7 +152,6 @@ const createAdminStructure = (opts, schemas, databaseId) => ({
     anonRole: 'administrator',
     roleName: 'administrator',
     schema: schemas,
-    apiModules: [],
     domains: [],
     databaseId,
     isPublic: false
@@ -164,8 +163,13 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, databaseId, name, isPublic) => {
-    const result = await pool.query(SCOPED_API_NAME_LOOKUP_SQL, [databaseId, name, isPublic]);
+const queryByApiName = async (pool, opts, databaseId, name, isPublic) => {
+    const routingSchema = getRoutingSchema(opts);
+    if (!isValidSchemaName(routingSchema)) {
+        log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
+        return null;
+    }
+    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name, isPublic]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -193,7 +197,7 @@ const resolveApiNameHeader = async (ctx) => {
     if (!headers.databaseId)
         return null;
     const isPublic = opts.api?.isPublic ?? false;
-    const row = await queryByApiName(pool, headers.databaseId, headers.apiName, isPublic);
+    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName, isPublic);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;
@@ -216,7 +220,7 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
+    const schema = getRoutingSchema(opts);
     const route = await resolveRoute(pool, schema, host);
     if (!route)
         return null;

package/esm/middleware/cors.js

@@ -7,7 +7,6 @@ import './types'; // for Request type
  * Feature parity + compatibility:
  *  - Respects a global fallback origin (e.g. from env/CLI) for quick overrides.
  *  - Reads per-API CORS origins from typed cors_settings table (via req.api.corsOrigins).
- *  - Falls back to legacy api_modules CORS data for backwards compatibility.
  *  - Always allows localhost to ease development.
  *
  * Usage:
@@ -32,13 +31,10 @@ export const cors = (fallbackOrigin) => {
         //    createApiMiddleware runs before this in server.ts, so req.api should be set
         const api = req.api;
         if (api) {
-            // Typed cors_settings origins (preferred)
+            // Typed cors_settings origins
             const typedOrigins = api.corsOrigins || [];
-            // Legacy api_modules CORS data (fallback)
-            const corsModules = (api.apiModules || []).filter((m) => m.name === 'cors');
-            const legacyOrigins = corsModules.reduce((m, mod) => [...mod.data.urls, ...m], []);
             const siteUrls = api.domains || [];
-            const listOfDomains = [...typedOrigins, ...legacyOrigins, ...siteUrls];
+            const listOfDomains = [...typedOrigins, ...siteUrls];
             if (origin && listOfDomains.includes(origin)) {
                 return callback(null, true);
             }

package/esm/middleware/flush.js

@@ -3,6 +3,7 @@ import { Logger } from '@pgpmjs/logger';
 import { svcCache } from '@pgpmjs/server-utils';
 import { graphileCache } from 'graphile-cache';
 import { getPgPool } from 'pg-cache';
+import { getRoutingSchema, isValidSchemaName } from './routing';
 const log = new Logger('flush');
 export const flush = async (req, res, next) => {
     if (req.url === '/flush') {
@@ -28,8 +29,13 @@ export const flushService = async (opts, databaseId) => {
             }
         });
     }
+    const routingSchema = getRoutingSchema(opts);
+    if (!isValidSchemaName(routingSchema)) {
+        log.warn(`[flush] invalid routing schema name: ${routingSchema}`);
+        return;
+    }
     const svc = await pgPool.query(`SELECT hostname
-     FROM constructive_routing_public.domains
+     FROM "${routingSchema}".domains
      WHERE database_id = $1`, [databaseId]);
     if (svc.rowCount === 0)
         return;

package/esm/middleware/routing.js

@@ -1,7 +1,11 @@
 import { Logger } from '@pgpmjs/logger';
 const log = new Logger('routing');
 const RESOLVER_FUNCTION = 'resolve_route';
-const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
+/** Published logical name of the database-scope routing plane. */
+export const DEFAULT_ROUTING_SCHEMA = 'routing_public';
+/** The routing-plane schema in effect: configured override or the published default. */
+export const getRoutingSchema = (opts) => opts.api?.routingSchema || DEFAULT_ROUTING_SCHEMA;
+export const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
 /**
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
  * path/method routing belongs to Traefik/Ingress, not the server).
@@ -54,7 +58,6 @@ export const routeToApiStructure = (route, opts) => {
         anonRole: config.anon_role || 'anon',
         roleName: config.role_name || 'authenticated',
         schema: config.schemas,
-        apiModules: [],
         domains: [],
         databaseId: config.database_id,
         isPublic: config.is_public ?? (opts.api?.isPublic ?? false)

package/esm/server.js

@@ -30,6 +30,7 @@ import { createDebugDatabaseMiddleware } from './middleware/observability/debug-
 import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
 import { createRequestLogger } from './middleware/observability/request-logger';
+import { getRoutingSchema } from './middleware/routing';
 const log = new Logger('server');
 /**
  * Creates and starts a GraphQL server instance
@@ -85,7 +86,7 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            scopedRoutingSchema: apiOpts.scopedRoutingSchema,
+            routingSchema: apiOpts.routingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             observabilityEnabled
         });
@@ -136,7 +137,11 @@ class Server {
         app.use(requestLogger);
         app.use(api);
         app.use(authenticate);
-        app.use(createContextMiddleware({ pg: effectiveOpts.pg, loaders: createDefaultRegistry() }));
+        app.use(createContextMiddleware({
+            pg: effectiveOpts.pg,
+            loaders: createDefaultRegistry(),
+            routingSchema: getRoutingSchema(effectiveOpts)
+        }));
         app.use(createCaptchaMiddleware());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests

package/middleware/api.js

@@ -23,7 +23,7 @@ const defaultRegistry = (0, express_context_1.createDefaultRegistry)();
 // =============================================================================
 // Private-header X-Api-Name lookup against the scoped routing plane.
 // `is_published` is the routing-plane analog of the legacy `is_public` column.
-const SCOPED_API_NAME_LOOKUP_SQL = `
+const scopedApiNameLookupSql = (routingSchema) => `
   SELECT 
     a.id as api_id,
     a.database_id,
@@ -32,8 +32,8 @@ const SCOPED_API_NAME_LOOKUP_SQL = `
     a.anon_role,
     a.is_published as is_public,
     COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM constructive_routing_public.apis a
-  LEFT JOIN constructive_routing_public.api_schemas aps ON a.id = aps.api_id
+  FROM "${routingSchema}".apis a
+  LEFT JOIN "${routingSchema}".api_schemas aps ON a.id = aps.api_id
   LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
   WHERE a.database_id = $1 
     AND a.name = $2
@@ -47,6 +47,7 @@ const SCOPED_API_NAME_LOOKUP_SQL = `
  */
 const buildLoaderContext = (routingPool, opts, row) => ({
     routingPool,
+    routingSchema: (0, routing_1.getRoutingSchema)(opts),
     tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: row.dbname }),
     databaseId: row.database_id,
     apiId: row.api_id,
@@ -144,7 +145,6 @@ const toApiStructure = (row, opts, settings = {}) => ({
     anonRole: row.anon_role || 'anon',
     roleName: row.role_name || 'authenticated',
     schema: row.schemas || [],
-    apiModules: [],
     rlsModule: settings.rlsModule,
     domains: [],
     databaseId: row.database_id,
@@ -160,7 +160,6 @@ const createAdminStructure = (opts, schemas, databaseId) => ({
     anonRole: 'administrator',
     roleName: 'administrator',
     schema: schemas,
-    apiModules: [],
     domains: [],
     databaseId,
     isPublic: false
@@ -172,8 +171,13 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, databaseId, name, isPublic) => {
-    const result = await pool.query(SCOPED_API_NAME_LOOKUP_SQL, [databaseId, name, isPublic]);
+const queryByApiName = async (pool, opts, databaseId, name, isPublic) => {
+    const routingSchema = (0, routing_1.getRoutingSchema)(opts);
+    if (!(0, routing_1.isValidSchemaName)(routingSchema)) {
+        log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
+        return null;
+    }
+    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name, isPublic]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -201,7 +205,7 @@ const resolveApiNameHeader = async (ctx) => {
     if (!headers.databaseId)
         return null;
     const isPublic = opts.api?.isPublic ?? false;
-    const row = await queryByApiName(pool, headers.databaseId, headers.apiName, isPublic);
+    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName, isPublic);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;
@@ -224,7 +228,7 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    const schema = opts.api?.scopedRoutingSchema || 'constructive_routing_public';
+    const schema = (0, routing_1.getRoutingSchema)(opts);
     const route = await (0, routing_1.resolveRoute)(pool, schema, host);
     if (!route)
         return null;

package/middleware/cors.d.ts

@@ -6,7 +6,6 @@ import './types';
  * Feature parity + compatibility:
  *  - Respects a global fallback origin (e.g. from env/CLI) for quick overrides.
  *  - Reads per-API CORS origins from typed cors_settings table (via req.api.corsOrigins).
- *  - Falls back to legacy api_modules CORS data for backwards compatibility.
  *  - Always allows localhost to ease development.
  *
  * Usage:

package/middleware/cors.js

@@ -13,7 +13,6 @@ require("./types"); // for Request type
  * Feature parity + compatibility:
  *  - Respects a global fallback origin (e.g. from env/CLI) for quick overrides.
  *  - Reads per-API CORS origins from typed cors_settings table (via req.api.corsOrigins).
- *  - Falls back to legacy api_modules CORS data for backwards compatibility.
  *  - Always allows localhost to ease development.
  *
  * Usage:
@@ -38,13 +37,10 @@ const cors = (fallbackOrigin) => {
         //    createApiMiddleware runs before this in server.ts, so req.api should be set
         const api = req.api;
         if (api) {
-            // Typed cors_settings origins (preferred)
+            // Typed cors_settings origins
             const typedOrigins = api.corsOrigins || [];
-            // Legacy api_modules CORS data (fallback)
-            const corsModules = (api.apiModules || []).filter((m) => m.name === 'cors');
-            const legacyOrigins = corsModules.reduce((m, mod) => [...mod.data.urls, ...m], []);
             const siteUrls = api.domains || [];
-            const listOfDomains = [...typedOrigins, ...legacyOrigins, ...siteUrls];
+            const listOfDomains = [...typedOrigins, ...siteUrls];
             if (origin && listOfDomains.includes(origin)) {
                 return callback(null, true);
             }

package/middleware/flush.js

@@ -6,6 +6,7 @@ const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const graphile_cache_1 = require("graphile-cache");
 const pg_cache_1 = require("pg-cache");
+const routing_1 = require("./routing");
 const log = new logger_1.Logger('flush');
 const flush = async (req, res, next) => {
     if (req.url === '/flush') {
@@ -32,8 +33,13 @@ const flushService = async (opts, databaseId) => {
             }
         });
     }
+    const routingSchema = (0, routing_1.getRoutingSchema)(opts);
+    if (!(0, routing_1.isValidSchemaName)(routingSchema)) {
+        log.warn(`[flush] invalid routing schema name: ${routingSchema}`);
+        return;
+    }
     const svc = await pgPool.query(`SELECT hostname
-     FROM constructive_routing_public.domains
+     FROM "${routingSchema}".domains
      WHERE database_id = $1`, [databaseId]);
     if (svc.rowCount === 0)
         return;

package/middleware/routing.d.ts

@@ -19,6 +19,15 @@ export interface ResolvedRoute {
     tls_status: string | null;
     tls_secret_name: string | null;
 }
+/** Published logical name of the database-scope routing plane. */
+export declare const DEFAULT_ROUTING_SCHEMA = "routing_public";
+/** The routing-plane schema in effect: configured override or the published default. */
+export declare const getRoutingSchema: (opts: {
+    api?: {
+        routingSchema?: string;
+    };
+}) => string;
+export declare const isValidSchemaName: (name: string) => boolean;
 /**
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
  * path/method routing belongs to Traefik/Ingress, not the server).

package/middleware/routing.js

@@ -1,10 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.routeToApiStructure = exports.resolveRoute = void 0;
+exports.routeToApiStructure = exports.resolveRoute = exports.isValidSchemaName = exports.getRoutingSchema = exports.DEFAULT_ROUTING_SCHEMA = void 0;
 const logger_1 = require("@pgpmjs/logger");
 const log = new logger_1.Logger('routing');
 const RESOLVER_FUNCTION = 'resolve_route';
+/** Published logical name of the database-scope routing plane. */
+exports.DEFAULT_ROUTING_SCHEMA = 'routing_public';
+/** The routing-plane schema in effect: configured override or the published default. */
+const getRoutingSchema = (opts) => opts.api?.routingSchema || exports.DEFAULT_ROUTING_SCHEMA;
+exports.getRoutingSchema = getRoutingSchema;
 const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
+exports.isValidSchemaName = isValidSchemaName;
 /**
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
  * path/method routing belongs to Traefik/Ingress, not the server).
@@ -13,7 +19,7 @@ const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
  * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
 const resolveRoute = async (pool, schema, host) => {
-    if (!isValidSchemaName(schema)) {
+    if (!(0, exports.isValidSchemaName)(schema)) {
         log.warn(`[resolve-route] invalid routing schema name: ${schema}`);
         return null;
     }
@@ -58,7 +64,6 @@ const routeToApiStructure = (route, opts) => {
         anonRole: config.anon_role || 'anon',
         roleName: config.role_name || 'authenticated',
         schema: config.schemas,
-        apiModules: [],
         domains: [],
         databaseId: config.database_id,
         isPublic: config.is_public ?? (opts.api?.isPublic ?? false)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.3.3",
+  "version": "5.4.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -42,9 +42,9 @@
   ],
   "dependencies": {
     "@constructive-io/csrf": "^0.18.2",
-    "@constructive-io/express-context": "^0.14.2",
-    "@constructive-io/graphql-env": "^3.19.2",
-    "@constructive-io/graphql-types": "^3.18.2",
+    "@constructive-io/express-context": "^0.15.0",
+    "@constructive-io/graphql-env": "^3.20.0",
+    "@constructive-io/graphql-types": "^3.19.0",
     "@constructive-io/query-builder": "^3.1.2",
     "@constructive-io/s3-utils": "^2.21.2",
     "@constructive-io/url-domains": "^2.20.2",
@@ -53,7 +53,7 @@
     "@pgpmjs/logger": "^2.15.2",
     "@pgpmjs/server-utils": "^3.16.2",
     "@pgpmjs/types": "^2.37.2",
-    "agentic-server": "0.12.2",
+    "agentic-server": "0.13.0",
     "cors": "^2.8.6",
     "deepmerge": "^4.3.1",
     "express": "^5.2.1",
@@ -64,8 +64,8 @@
     "graphile-build-pg": "5.0.2",
     "graphile-cache": "^4.1.2",
     "graphile-config": "1.0.1",
-    "graphile-function-bindings": "^1.1.2",
-    "graphile-settings": "^6.1.3",
+    "graphile-function-bindings": "^1.2.0",
+    "graphile-settings": "^6.2.0",
     "graphile-utils": "5.0.1",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -87,10 +87,10 @@
     "@types/pg": "^8.20.0",
     "@types/request-ip": "^0.0.41",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.1.2",
+    "graphile-test": "5.2.0",
     "makage": "^0.3.0",
     "nodemon": "^3.1.14",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "0e3ee42c44c9b35ffac4bf1faa6775eb69311ec4"
+  "gitHead": "518e7ab2270661c64875258436d90fdf76b4b336"
 }

package/server.js

@@ -36,6 +36,7 @@ const debug_db_1 = require("./middleware/observability/debug-db");
 const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
 const request_logger_1 = require("./middleware/observability/request-logger");
+const routing_1 = require("./middleware/routing");
 const log = new logger_1.Logger('server');
 /**
  * Creates and starts a GraphQL server instance
@@ -92,7 +93,7 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            scopedRoutingSchema: apiOpts.scopedRoutingSchema,
+            routingSchema: apiOpts.routingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             observabilityEnabled
         });
@@ -143,7 +144,11 @@ class Server {
         app.use(requestLogger);
         app.use(api);
         app.use(authenticate);
-        app.use((0, express_context_1.createContextMiddleware)({ pg: effectiveOpts.pg, loaders: (0, express_context_1.createDefaultRegistry)() }));
+        app.use((0, express_context_1.createContextMiddleware)({
+            pg: effectiveOpts.pg,
+            loaders: (0, express_context_1.createDefaultRegistry)(),
+            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts)
+        }));
         app.use((0, captcha_1.createCaptchaMiddleware)());
         // CSRF protection for cookie-authenticated requests
         // Skip CSRF for Bearer token auth (not vulnerable to CSRF) and anonymous requests

package/types.d.ts

@@ -1,6 +1,6 @@
 import type { PgpmOptions } from '@pgpmjs/types';
 import type { ApiOptions as ApiConfig } from '@constructive-io/graphql-types';
-export type { ApiConfigResult, ApiError, ApiModule, ApiStructure, AuthSettings, CorsModuleData, DatabaseSettings, GenericModuleData, PubkeyChallengeSettings, PublicKeyChallengeData, RlsModule, WebauthnSettings, } from '@constructive-io/express-context';
+export type { ApiConfigResult, ApiError, ApiStructure, AuthSettings, DatabaseSettings, PubkeyChallengeSettings, RlsModule, WebauthnSettings, } from '@constructive-io/express-context';
 export type ApiOptions = PgpmOptions & {
     api?: ApiConfig;
 };