@constructive-io/graphql-server 5.30.0 → 5.31.0

package/README.md

@@ -56,6 +56,13 @@ This starts the server with env defaults from `@constructive-io/graphql-env`.
 
 ## What it does
 
+Platform deployments connect through one pgpm-provisioned `NOSUPERUSER INHERIT
+BYPASSRLS` login with direct metadata privileges, configured only with
+`PGUSER`/`PGPASSWORD`. Startup and routing queries use that pool login directly.
+Requests continue to switch to `authenticated` or `anonymous`, so PostgreSQL
+enforces their RLS policies; the login's BYPASSRLS attribute is not inherited
+after `SET ROLE`.
+
 Runs an Express server that wires CORS, uploads, domain parsing, auth, and PostGraphile into a single GraphQL endpoint. It serves `/graphql` and `/graphiql`, injects per-request `pgSettings`, and flushes cached schemas on demand or via database notifications. When meta API is enabled, it resolves API config (schemas, roles, modules) from the meta schema using the request host and enforces `api.isPublic`, with optional header overrides in private mode; when meta API is disabled, it serves the fixed schemas and roles from `api.exposedSchemas`, `api.anonRole`, and `api.roleName`.
 
 ## Key Features
@@ -146,7 +153,6 @@ Configuration is merged from defaults, config files, and env vars via `@construc
 | `API_ROLE_NAME`                | Authenticated role name               | `administrator`                                               |
 | `API_FLUSH_TOKEN`              | Bearer token required by `POST /flush`; route is not mounted when unset | empty                        |
 | `API_INTROSPECTION_ROLE`       | Role PostGraphile introspects as; unset means the pool's connecting role. Naming a role with fewer grants removes fields from the schema | empty |
-| `API_CONTROL_ROLE`             | Role control-plane queries (routing, API lookups, module loaders, flush, refusal log) run as via `SET LOCAL ROLE`. The login role holds no privileges, so the server refuses to start without it | required |
 | `GRAPHQL_OBSERVABILITY_ENABLED` | Master switch for debug routes and sampler | `false`                                                  |
 | `GRAPHQL_DEBUG_SAMPLER_ENABLED` | Enables periodic NDJSON sampling when observability is on | `true`                                   |
 | `GRAPHQL_DEBUG_SAMPLER_INTERVAL_MS` | Sampler interval in milliseconds | `10000`                                                       |

package/diagnostics/debug-db-snapshot.js

@@ -4,7 +4,6 @@ exports.getDebugDatabaseSnapshot = exports.closeDebugDatabasePools = void 0;
 const pg_1 = require("pg");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
-const control_role_1 = require("../control-role");
 const ACTIVE_ACTIVITY_SQL = `
   select
     pid,
@@ -142,7 +141,6 @@ const withDiagnosticsClient = async (opts, fn) => {
     const client = await diagnosticsPool.connect();
     try {
         await client.query('BEGIN');
-        await client.query('SELECT set_config($1, $2, true)', ['role', (0, control_role_1.getControlRole)(opts)]);
         await client.query(`SET LOCAL statement_timeout = '${DIAGNOSTICS_STATEMENT_TIMEOUT_MS}ms'`);
         await client.query(`SET LOCAL lock_timeout = '${DIAGNOSTICS_LOCK_TIMEOUT_MS}ms'`);
         const result = await fn(client);

package/esm/diagnostics/debug-db-snapshot.js

@@ -1,7 +1,6 @@
 import { Pool } from 'pg';
 import { buildConnectionString, getPgPool } from 'pg-cache';
 import { getPgEnvOptions } from 'pg-env';
-import { getControlRole } from '../control-role';
 const ACTIVE_ACTIVITY_SQL = `
   select
     pid,
@@ -139,7 +138,6 @@ const withDiagnosticsClient = async (opts, fn) => {
     const client = await diagnosticsPool.connect();
     try {
         await client.query('BEGIN');
-        await client.query('SELECT set_config($1, $2, true)', ['role', getControlRole(opts)]);
         await client.query(`SET LOCAL statement_timeout = '${DIAGNOSTICS_STATEMENT_TIMEOUT_MS}ms'`);
         await client.query(`SET LOCAL lock_timeout = '${DIAGNOSTICS_LOCK_TIMEOUT_MS}ms'`);
         const result = await fn(client);

package/esm/middleware/api.js

@@ -4,8 +4,6 @@ import { parseUrl } from '@constructive-io/url-domains';
 import { Logger } from '@pgpmjs/logger';
 import { svcCache } from '@pgpmjs/server-utils';
 import { getPgPool } from 'pg-cache';
-import { controlPlanePool } from 'pg-query-context';
-import { getControlRole } from '../control-role';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
 import { getRoutingSchema, isValidSchemaName, requireApiRole, resolveRoute, routeToApiStructure } from './routing';
@@ -50,7 +48,7 @@ const buildLoaderContext = (routingPool, opts, row) => {
     return {
         routingPool,
         routingSchema: getRoutingSchema(opts),
-        tenantPool: controlPlanePool(getPgPool({ ...opts.pg, database: dbname }), routingPool.role),
+        tenantPool: getPgPool({ ...opts.pg, database: dbname }),
         databaseId: row.database_id,
         apiId: row.api_id,
         dbname
@@ -262,7 +260,7 @@ const resolveScopedRoute = async (ctx) => {
 // Main Resolution Function
 // =============================================================================
 export const getApiConfig = async (opts, req) => {
-    const pool = controlPlanePool(getPgPool(opts.pg), getControlRole(opts));
+    const pool = getPgPool(opts.pg);
     const { domain, subdomains } = getUrlDomains(req);
     const subdomain = getSubdomain(subdomains);
     const cacheKey = getSvcKey(opts, req);

package/esm/middleware/auth.js

@@ -62,7 +62,6 @@ export const createAuthenticateMiddleware = (opts) => {
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {
-                    role: api.anonRole,
                     'jwt.claims.ip_address': req.clientIp,
                 };
                 if (req.get('origin')) {

package/esm/middleware/flush.js

@@ -4,8 +4,6 @@ import { svcCache } from '@pgpmjs/server-utils';
 import { createHash, timingSafeEqual } from 'crypto';
 import { graphileCache } from 'graphile-cache';
 import { getPgPool } from 'pg-cache';
-import { controlPlanePool } from 'pg-query-context';
-import { getControlRole } from '../control-role';
 import { getRoutingSchema, isValidSchemaName } from './routing';
 const log = new Logger('flush');
 const bearerToken = (req) => {
@@ -49,7 +47,7 @@ export const createFlushMiddleware = (opts) => {
     };
 };
 export const flushService = async (opts, databaseId) => {
-    const pgPool = controlPlanePool(getPgPool(opts.pg), getControlRole(opts));
+    const pgPool = getPgPool(opts.pg);
     log.info('flushing db ' + databaseId);
     const api = new RegExp(`^api:${databaseId}:.*`);
     const schemata = new RegExp(`^schemata:${databaseId}:.*`);

package/esm/middleware/graphile.js

@@ -7,8 +7,6 @@ import { createFunctionBindingsPlugin } from 'graphile-function-bindings';
 import { createConstructivePreset, createGrafastCacheLimitsPreset } from 'graphile-settings';
 import { getPgPool } from 'pg-cache';
 import { getPgEnvOptions } from 'pg-env';
-import { controlPlanePool } from 'pg-query-context';
-import { getControlRole } from '../control-role';
 import { isGraphqlObservabilityEnabled } from '../diagnostics/observability';
 import { HandlerCreationError } from '../errors/api-errors';
 import { respondWithGraphQLError } from '../errors/graphql-response';
@@ -58,7 +56,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, controlRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await makeIntrospectionWiring(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = createGrafastCacheLimitsPreset(graphileOptions?.grafastCache);
@@ -89,7 +87,6 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
                 ? [
                     createFunctionBindingsPlugin({
                         apiId,
-                        role: controlRole,
                         modules: compute.modules.map((m) => ({
                             computeSchema: m.schemaName,
                             bindingsTable: m.bindingsTableName,
@@ -314,7 +311,7 @@ export const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, getControlRole(opts), opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return observeGraphileBuild({
                     cacheKey: key,
                     serviceKey: key,
@@ -322,8 +319,7 @@ export const graphile = (opts) => {
                 }, () => createGraphileInstance({
                     preset,
                     cacheKey: key,
-                    enableRealtime: api.databaseSettings?.enableRealtime,
-                    realtimePool: controlPlanePool(pool, getControlRole(opts))
+                    enableRealtime: api.databaseSettings?.enableRealtime
                 }), { enabled: observabilityEnabled });
             })();
             creating.set(key, creationPromise);

package/esm/refusals/recorder.js

@@ -2,8 +2,6 @@ import '../middleware/types'; // for Request type
 import { clientIpFrom, createRecordRefusalsSink, RefusalRecorder, trustedProxyHops } from '@constructive-io/express-context';
 import { Logger } from '@pgpmjs/logger';
 import { getPgPool } from 'pg-cache';
-import { controlPlanePool } from 'pg-query-context';
-import { getControlRole } from '../control-role';
 const log = new Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -121,17 +119,16 @@ export const platformFlushClaims = (identity) => ({
  */
 export const createPlatformRefusalRecorder = (opts, recorderOpts = {}) => {
     const pool = getPgPool(opts.pg);
-    const role = getControlRole(opts);
     let cached = null;
     const claims = async () => {
         if (cached)
             return cached;
-        cached = platformFlushClaims(await resolvePlatformFlushIdentity(controlPlanePool(pool, role), recorderOpts.principalName));
+        cached = platformFlushClaims(await resolvePlatformFlushIdentity(pool, recorderOpts.principalName));
         log.info(`[refusals] flushing as '${recorderOpts.principalName ?? PLATFORM_BOOTSTRAP_PRINCIPAL}'`);
         return cached;
     };
     return new RefusalRecorder({
-        sink: createRecordRefusalsSink({ pool, role, claims }),
+        sink: createRecordRefusalsSink({ pool, claims }),
         intervalMs: recorderOpts.intervalMs,
         jitterMs: recorderOpts.jitterMs,
         maxKeys: recorderOpts.maxKeys

package/esm/server.js

@@ -11,7 +11,6 @@ import graphqlUpload from 'graphql-upload';
 import { getPgPool } from 'pg-cache';
 import requestIp from 'request-ip';
 import { createAgenticRouter } from './agentic';
-import { getControlRole } from './control-role';
 import { closeDebugDatabasePools } from './diagnostics/debug-db-snapshot';
 import { startDebugSampler } from './diagnostics/debug-sampler';
 import { isDevelopmentObservabilityMode, isGraphqlObservabilityEnabled, isGraphqlObservabilityRequested, isLoopbackHost } from './diagnostics/observability';
@@ -77,7 +76,6 @@ class Server {
     constructor(opts) {
         this.opts = getEnvOptions(opts);
         const effectiveOpts = this.opts;
-        const controlRole = getControlRole(effectiveOpts);
         const observabilityRequested = isGraphqlObservabilityRequested();
         const observabilityEnabled = isGraphqlObservabilityEnabled(effectiveOpts.server?.host);
         const app = express();
@@ -147,8 +145,7 @@ class Server {
         app.use(createContextMiddleware({
             pg: effectiveOpts.pg,
             loaders: createDefaultRegistry(),
-            routingSchema: getRoutingSchema(effectiveOpts),
-            controlRole
+            routingSchema: getRoutingSchema(effectiveOpts)
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.

package/middleware/api.js

@@ -10,8 +10,6 @@ const url_domains_1 = require("@constructive-io/url-domains");
 const logger_1 = require("@pgpmjs/logger");
 const server_utils_1 = require("@pgpmjs/server-utils");
 const pg_cache_1 = require("pg-cache");
-const pg_query_context_1 = require("pg-query-context");
-const control_role_1 = require("../control-role");
 const _50x_1 = __importDefault(require("../errors/50x"));
 const _404_message_1 = __importDefault(require("../errors/404-message"));
 const routing_1 = require("./routing");
@@ -56,7 +54,7 @@ const buildLoaderContext = (routingPool, opts, row) => {
     return {
         routingPool,
         routingSchema: (0, routing_1.getRoutingSchema)(opts),
-        tenantPool: (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname }), routingPool.role),
+        tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname }),
         databaseId: row.database_id,
         apiId: row.api_id,
         dbname
@@ -270,7 +268,7 @@ const resolveScopedRoute = async (ctx) => {
 // Main Resolution Function
 // =============================================================================
 const getApiConfig = async (opts, req) => {
-    const pool = (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)(opts.pg), (0, control_role_1.getControlRole)(opts));
+    const pool = (0, pg_cache_1.getPgPool)(opts.pg);
     const { domain, subdomains } = getUrlDomains(req);
     const subdomain = (0, exports.getSubdomain)(subdomains);
     const cacheKey = (0, exports.getSvcKey)(opts, req);

package/middleware/auth.js

@@ -68,7 +68,6 @@ const createAuthenticateMiddleware = (opts) => {
             if (effectiveToken) {
                 log.info(`[auth] Processing ${tokenSource} authentication`);
                 const context = {
-                    role: api.anonRole,
                     'jwt.claims.ip_address': req.clientIp,
                 };
                 if (req.get('origin')) {

package/middleware/flush.js

@@ -7,8 +7,6 @@ const server_utils_1 = require("@pgpmjs/server-utils");
 const crypto_1 = require("crypto");
 const graphile_cache_1 = require("graphile-cache");
 const pg_cache_1 = require("pg-cache");
-const pg_query_context_1 = require("pg-query-context");
-const control_role_1 = require("../control-role");
 const routing_1 = require("./routing");
 const log = new logger_1.Logger('flush');
 const bearerToken = (req) => {
@@ -53,7 +51,7 @@ const createFlushMiddleware = (opts) => {
 };
 exports.createFlushMiddleware = createFlushMiddleware;
 const flushService = async (opts, databaseId) => {
-    const pgPool = (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)(opts.pg), (0, control_role_1.getControlRole)(opts));
+    const pgPool = (0, pg_cache_1.getPgPool)(opts.pg);
     log.info('flushing db ' + databaseId);
     const api = new RegExp(`^api:${databaseId}:.*`);
     const schemata = new RegExp(`^schemata:${databaseId}:.*`);

package/middleware/graphile.js

@@ -13,8 +13,6 @@ const graphile_function_bindings_1 = require("graphile-function-bindings");
 const graphile_settings_1 = require("graphile-settings");
 const pg_cache_1 = require("pg-cache");
 const pg_env_1 = require("pg-env");
-const pg_query_context_1 = require("pg-query-context");
-const control_role_1 = require("../control-role");
 const observability_1 = require("../diagnostics/observability");
 const api_errors_1 = require("../errors/api-errors");
 const graphql_response_1 = require("../errors/graphql-response");
@@ -64,7 +62,7 @@ const reqLabel = (req) => (req.requestId ? `[${req.requestId}]` : '[req]');
  * plugin preset.  Without settings the default preset is used
  * (everything on except aggregates).
  */
-const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, controlRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
+const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole, graphileOptions, databaseSettings, apiId, compute, webauthn) => {
     const introspection = await (0, graphile_introspection_1.makeIntrospectionWiring)(pool, schemas, graphileOptions, undefined, introspectionRole);
     const configuredPreset = graphileOptions?.preset ?? {};
     const grafastCachePreset = (0, graphile_settings_1.createGrafastCacheLimitsPreset)(graphileOptions?.grafastCache);
@@ -95,7 +93,6 @@ const buildPreset = async (pool, schemas, anonRole, roleName, introspectionRole,
                 ? [
                     (0, graphile_function_bindings_1.createFunctionBindingsPlugin)({
                         apiId,
-                        role: controlRole,
                         modules: compute.modules.map((m) => ({
                             computeSchema: m.schemaName,
                             bindingsTable: m.bindingsTableName,
@@ -320,7 +317,7 @@ const graphile = (opts) => {
             // concurrent requests coalesce while optional plugin modules load.
             const creationPromise = (async () => {
                 const compute = api.apiId ? await req.constructive?.useModule('compute') : undefined;
-                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, (0, control_role_1.getControlRole)(opts), opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
+                const preset = await buildPreset(pool, schema || [], anonRole, roleName, opts.api?.introspectionRole, opts.graphile, api.databaseSettings, api.apiId, compute, Boolean(api.webauthnSettings));
                 return (0, graphile_build_stats_1.observeGraphileBuild)({
                     cacheKey: key,
                     serviceKey: key,
@@ -328,8 +325,7 @@ const graphile = (opts) => {
                 }, () => (0, graphile_cache_1.createGraphileInstance)({
                     preset,
                     cacheKey: key,
-                    enableRealtime: api.databaseSettings?.enableRealtime,
-                    realtimePool: (0, pg_query_context_1.controlPlanePool)(pool, (0, control_role_1.getControlRole)(opts))
+                    enableRealtime: api.databaseSettings?.enableRealtime
                 }), { enabled: observabilityEnabled });
             })();
             creating.set(key, creationPromise);

package/middleware/routing.d.ts

@@ -1,4 +1,4 @@
-import type { ControlPlaneQueryable } from 'pg-query-context';
+import { Pool } from 'pg';
 import { ApiOptions, ApiStructure } from '../types';
 /**
  * The role an API row names is the role the server will SET ROLE to; a row
@@ -41,7 +41,7 @@ export declare const isValidSchemaName: (name: string) => boolean;
  * resolver is not installed in the target database — in both cases the caller
  * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
-export declare const resolveRoute: (pool: ControlPlaneQueryable, schema: string, host: string) => Promise<ResolvedRoute | null>;
+export declare const resolveRoute: (pool: Pool, schema: string, host: string) => Promise<ResolvedRoute | null>;
 /**
  * Map a resolved api-target route onto the ApiStructure shape consumed by the
  * rest of the middleware chain. Returns null when the route target is not an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.30.0",
+  "version": "5.31.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,18 +43,18 @@
     "@agentic-kit/ollama": "2.15.0",
     "@constructive-io/csrf": "^0.30.1",
     "@constructive-io/errors": "^0.24.0",
-    "@constructive-io/express-context": "^0.34.0",
-    "@constructive-io/graphql-env": "^3.36.0",
-    "@constructive-io/graphql-types": "^3.35.0",
+    "@constructive-io/express-context": "^0.34.1",
+    "@constructive-io/graphql-env": "^3.36.1",
+    "@constructive-io/graphql-types": "^3.35.1",
     "@constructive-io/llm-env": "^0.15.0",
-    "@constructive-io/query-builder": "^3.16.9",
+    "@constructive-io/query-builder": "^3.16.10",
     "@constructive-io/s3-utils": "^2.34.0",
     "@constructive-io/url-domains": "^2.31.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
-    "@pgpmjs/env": "^2.47.0",
+    "@pgpmjs/env": "^2.47.1",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.7",
-    "@pgpmjs/types": "^2.57.0",
+    "@pgpmjs/server-utils": "^3.29.8",
+    "@pgpmjs/types": "^2.57.1",
     "@pgsql/quotes": "^18.2.4",
     "@simplewebauthn/server": "13.3.2",
     "cors": "^2.8.6",
@@ -65,20 +65,20 @@
     "grafserv": "1.0.1",
     "graphile-build": "5.1.1",
     "graphile-build-pg": "5.1.3",
-    "graphile-cache": "^4.15.0",
+    "graphile-cache": "^4.15.1",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.17.10",
+    "graphile-function-bindings": "^1.17.11",
     "graphile-plugin-utils": "^1.13.0",
-    "graphile-scoped-introspection": "^0.4.10",
-    "graphile-settings": "^6.25.2",
+    "graphile-scoped-introspection": "^0.4.11",
+    "graphile-settings": "^6.25.3",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.7",
-    "pg-env": "^1.32.0",
-    "pg-query-context": "^2.32.0",
+    "pg-cache": "^3.29.8",
+    "pg-env": "^1.32.1",
+    "pg-query-context": "^2.32.1",
     "pg-sql2": "5.0.1",
     "postgraphile": "5.1.4",
     "request-ip": "^3.3.0"
@@ -93,11 +93,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.17.10",
+    "graphile-test": "5.17.11",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "2f506a4a4062b4bd92979c02249e0fee14af4043"
+  "gitHead": "bf845a1b0701f57f6900d9e2a3c66ea48e125cc3"
 }

package/refusals/recorder.d.ts

@@ -3,7 +3,7 @@ import type { RefusalReason, RefusalRecorderStats } from '@constructive-io/expre
 import { RefusalRecorder } from '@constructive-io/express-context';
 import type { ConstructiveOptions } from '@constructive-io/graphql-types';
 import type { Request } from 'express';
-import { type ControlPlaneQueryable } from 'pg-query-context';
+import type { Pool } from 'pg';
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
  *
@@ -61,7 +61,7 @@ interface PlatformFlushIdentity {
  * `platform-bootstrap` service principal's user row. Throws — with the row
  * that was missing named — rather than returning a partial identity.
  */
-export declare const resolvePlatformFlushIdentity: (pool: ControlPlaneQueryable, principalName?: string) => Promise<PlatformFlushIdentity>;
+export declare const resolvePlatformFlushIdentity: (pool: Pool, principalName?: string) => Promise<PlatformFlushIdentity>;
 export declare const platformFlushClaims: (identity: PlatformFlushIdentity) => Record<string, string>;
 export interface PlatformRefusalRecorderOptions {
     intervalMs?: number;

package/refusals/recorder.js

@@ -5,8 +5,6 @@ require("../middleware/types"); // for Request type
 const express_context_1 = require("@constructive-io/express-context");
 const logger_1 = require("@pgpmjs/logger");
 const pg_cache_1 = require("pg-cache");
-const pg_query_context_1 = require("pg-query-context");
-const control_role_1 = require("../control-role");
 const log = new logger_1.Logger('refusals');
 /**
  * refusals/recorder — the GraphQL lane's `RefusalRecorder`.
@@ -131,17 +129,16 @@ exports.platformFlushClaims = platformFlushClaims;
  */
 const createPlatformRefusalRecorder = (opts, recorderOpts = {}) => {
     const pool = (0, pg_cache_1.getPgPool)(opts.pg);
-    const role = (0, control_role_1.getControlRole)(opts);
     let cached = null;
     const claims = async () => {
         if (cached)
             return cached;
-        cached = (0, exports.platformFlushClaims)(await (0, exports.resolvePlatformFlushIdentity)((0, pg_query_context_1.controlPlanePool)(pool, role), recorderOpts.principalName));
+        cached = (0, exports.platformFlushClaims)(await (0, exports.resolvePlatformFlushIdentity)(pool, recorderOpts.principalName));
         log.info(`[refusals] flushing as '${recorderOpts.principalName ?? exports.PLATFORM_BOOTSTRAP_PRINCIPAL}'`);
         return cached;
     };
     return new express_context_1.RefusalRecorder({
-        sink: (0, express_context_1.createRecordRefusalsSink)({ pool, role, claims }),
+        sink: (0, express_context_1.createRecordRefusalsSink)({ pool, claims }),
         intervalMs: recorderOpts.intervalMs,
         jitterMs: recorderOpts.jitterMs,
         maxKeys: recorderOpts.maxKeys

package/server.js

@@ -17,7 +17,6 @@ const graphql_upload_1 = __importDefault(require("graphql-upload"));
 const pg_cache_1 = require("pg-cache");
 const request_ip_1 = __importDefault(require("request-ip"));
 const agentic_1 = require("./agentic");
-const control_role_1 = require("./control-role");
 const debug_db_snapshot_1 = require("./diagnostics/debug-db-snapshot");
 const debug_sampler_1 = require("./diagnostics/debug-sampler");
 const observability_1 = require("./diagnostics/observability");
@@ -84,7 +83,6 @@ class Server {
     constructor(opts) {
         this.opts = (0, graphql_env_1.getEnvOptions)(opts);
         const effectiveOpts = this.opts;
-        const controlRole = (0, control_role_1.getControlRole)(effectiveOpts);
         const observabilityRequested = (0, observability_1.isGraphqlObservabilityRequested)();
         const observabilityEnabled = (0, observability_1.isGraphqlObservabilityEnabled)(effectiveOpts.server?.host);
         const app = (0, express_1.default)();
@@ -154,8 +152,7 @@ class Server {
         app.use((0, express_context_1.createContextMiddleware)({
             pg: effectiveOpts.pg,
             loaders: (0, express_context_1.createDefaultRegistry)(),
-            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts),
-            controlRole
+            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts)
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.

package/control-role.d.ts

@@ -1,8 +0,0 @@
-import type { ApiOptions } from '@constructive-io/graphql-types';
-/**
- * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
- * The login role is NOINHERIT and holds no privileges, so there is no default.
- */
-export declare const getControlRole: (opts: {
-    api?: ApiOptions;
-}) => string;

package/control-role.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getControlRole = void 0;
-/**
- * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
- * The login role is NOINHERIT and holds no privileges, so there is no default.
- */
-const getControlRole = (opts) => {
-    const role = opts.api?.controlRole;
-    if (!role) {
-        throw new Error('GraphQL server: api.controlRole (API_CONTROL_ROLE) is required — control-plane queries run as that role');
-    }
-    return role;
-};
-exports.getControlRole = getControlRole;

package/esm/control-role.js

@@ -1,11 +0,0 @@
-/**
- * The role control-plane queries run as (`api.controlRole` / `API_CONTROL_ROLE`).
- * The login role is NOINHERIT and holds no privileges, so there is no default.
- */
-export const getControlRole = (opts) => {
-    const role = opts.api?.controlRole;
-    if (!role) {
-        throw new Error('GraphQL server: api.controlRole (API_CONTROL_ROLE) is required — control-plane queries run as that role');
-    }
-    return role;
-};