@xeno-js/core 0.1.12 → 1.0.0

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <img src="logo/logo.png" alt="Xeno Logo" width="140" />
+  <img src="logo/logo.png" alt="Xeno.JS Logo" width="140" />
 
   <h1>Xeno.JS</h1>
   <p><strong>The application architecture framework for TypeScript.</strong></p>
@@ -19,7 +19,7 @@
 
 ## What is Xeno?
 
-Xeno is a TypeScript application architecture framework for Node.js.
+Xeno.JS is a TypeScript application architecture framework for Node.js.
 
 It provides explicit building blocks for applications organized around:
 
@@ -34,7 +34,7 @@ It provides explicit building blocks for applications organized around:
 
 The goal is simple: **make application architecture explicit in code.**
 
-Xeno is not tied to a specific HTTP server. Your application layer can remain
+Xeno.JS is not tied to a specific HTTP server. Your application layer can remain
 independent from the transport that delivers a request.
 
 ---
@@ -45,7 +45,7 @@ independent from the transport that delivers a request.
 
 **Your dependency graph is code.**
 
-Xeno does not require decorators, runtime scanning, or implicit dependency
+Xeno.JS does not require decorators, runtime scanning, or implicit dependency
 discovery. Services are registered explicitly, and their lifetimes are visible
 at the composition root.
 
@@ -65,7 +65,7 @@ reason about.
 
 Business logic should not belong to your HTTP framework.
 
-Xeno keeps application concerns separate from delivery mechanisms, allowing the
+Xeno.JS keeps application concerns separate from delivery mechanisms, allowing the
 same application architecture to be hosted behind transports such as Fastify,
 Hono, Express, or other adapters.
 
@@ -104,7 +104,7 @@ This keeps cross-cutting concerns out of individual handlers.
 
 ### 04 — Explicit Lifetimes and Request Boundaries
 
-Xeno distinguishes service lifetimes such as singleton, scoped, and transient
+Xeno.JS distinguishes service lifetimes such as singleton, scoped, and transient
 services.
 
 Request-scoped dependencies are resolved inside an explicit application scope,
@@ -127,7 +127,7 @@ infrastructure.
 
 ## Architecture
 
-A typical Xeno application can be organized like this:
+A typical Xeno.JS application can be organized like this:
 
 ```text
 +------------------------------------------+
@@ -181,7 +181,7 @@ Infrastructure capabilities can be enabled only when they are needed.
 npm install @xeno-js/core
 ```
 
-Install only the integrations your application uses. Xeno exposes optional
+Install only the integrations your application uses. Xeno.JS exposes optional
 infrastructure dependencies for capabilities such as databases, Redis, logging,
 resilience, and authentication.
 
@@ -198,9 +198,11 @@ npm install zod pino cockatiel drizzle-orm
 The composition root is explicit:
 
 ```typescript
+// src/bootstrap.ts
 import { AppBuilder } from '@xeno-js/core'
 
-const app = new AppBuilder().addServices((services) => {
+const app = new AppBuilder()
+.addServices((services) => {
   services.addScoped('USER_REPOSITORY', (container) => {
     return new UserRepository(container.resolve('USER_DATA_SOURCE'))
   })
@@ -210,12 +212,14 @@ const app = new AppBuilder().addServices((services) => {
   })
 
   services.addTransient('FIND_USER_CONTROLLER', (c) => {
-    return new FindUserHandler(
+    return new FindUserController(
       c.resolve(TOKENS.REQUEST_CONTEXT),
       c.resolve(TOKENS.MEDIATOR),
     )
   })
 })
+
+await app.build()
 ```
 
 The transport remains outside the application composition:
@@ -228,17 +232,17 @@ The transport remains outside the application composition:
 
 ```typescript
 import Fastify from 'fastify'
-import { builder } from './bootstrap'
+import { app } from './bootstrap'
 
-const app = Fastify({ logger: true })
+const fastify = Fastify({ logger: true })
 
-app.get('/users/:id', async (req, reply) => {
+fastify.get('/users/:id', async (req, reply) => {
   const endpoint = req.url
-  const container = await builder.build()
+
   const action = async () => {
     const controller = ContainerUtils.resolveServiceScoped(
       'FIND_USER_CONTROLLER',
-      container,
+      app,
     )
     return await controller.handle()
   }
@@ -248,7 +252,7 @@ app.get('/users/:id', async (req, reply) => {
     req.method,
     req.headers,
     { reply, req },
-    container,
+    app,
     action,
   )
 
@@ -298,7 +302,7 @@ application.
 
 ## Infrastructure & Integrations
 
-Xeno Core can be composed with infrastructure such as:
+Xeno.JS Core can be composed with infrastructure such as:
 
 - **Database:** Drizzle ORM, PostgreSQL, LibSQL
 - **Cache / distributed coordination:** Redis
@@ -315,7 +319,7 @@ architecture.
 
 ## CLI
 
-Use the official CLI to scaffold a Xeno application:
+Use the official CLI to scaffold a Xeno.JS application:
 
 ```bash
 npm install @xeno-js/cli
@@ -347,7 +351,7 @@ Recommended starting points:
 
 ## Ecosystem
 
-Xeno is designed as an ecosystem rather than a single monolithic package:
+Xeno.JS is designed as an ecosystem rather than a single monolithic package:
 
 | Package           | Role                                      |
 | ----------------- | ----------------------------------------- |
@@ -358,15 +362,15 @@ Xeno is designed as an ecosystem rather than a single monolithic package:
 
 ---
 
-## What Xeno Is Not
+## What Xeno.JS Is Not
 
-Xeno is not primarily an HTTP framework.
+Xeno.JS is not primarily an HTTP framework.
 
 If you are looking for a framework centered on routing, controllers, middleware,
 and server lifecycle, there are excellent options already available in the
 Node.js ecosystem.
 
-Xeno focuses on the layer above transport:
+Xeno.JS focuses on the layer above transport:
 
 > **How should a TypeScript application be structured so that its business
 > logic, dependencies, and infrastructure boundaries remain explicit as the
@@ -376,7 +380,7 @@ Xeno focuses on the layer above transport:
 
 ## Production Considerations
 
-Xeno provides architectural primitives, but application correctness still
+Xeno.JS provides architectural primitives, but application correctness still
 depends on how those primitives are composed.
 
 Before deploying an application, test the behaviors that matter to your
@@ -439,10 +443,10 @@ npm run check
 
 ## Support
 
-If Xeno is useful to you, you can support the project through the community and
+If Xeno.JS is useful to you, you can support the project through the community and
 sponsorship channels documented on the website:
 
-**[Support Xeno](https://www.xeno-js.it/support-us)**
+**[Support Xeno](https://www.xeno-js.it/docs/support-us)**
 
 ---
 

package/dist/index.cjs

@@ -68,15 +68,11 @@ var init_container_utils = __esm({
        * @throws Error If the service is not found in the container.
        * @throws Error If the service is not a scoped service.
        */
-      async runExecute(endpoint, method, headers, transport, container, action) {
+      async runExecute(res, req, container, action) {
         const middleware = container.resolve(import_shared.TOKENS.MIDDLEWARE);
-        return await middleware.execute(
-          { path: endpoint, method: method ?? "GET", transport },
-          { ...headers },
-          async () => {
-            return await action();
-          }
-        );
+        return await middleware.execute(req, res, async () => {
+          return await action();
+        });
       }
     });
   }
@@ -1024,7 +1020,6 @@ var init_gate_keeper = __esm({
           }
         }
         return import_shared27.Result.ok(guest);
-        return import_shared27.Result.ok(guest);
       }
     };
   }
@@ -1955,17 +1950,19 @@ var init_extract_bearer_extractor = __esm({
     "use strict";
     import_shared45 = require("@xeno-js/shared");
     BearerTokenExtractor = class {
+      constructor(_cookiePrefix) {
+        this._cookiePrefix = _cookiePrefix;
+      }
+      _cookiePrefix;
       extract(headers) {
-        const authHeader = import_shared45.StringHelper.getSingleValue(headers["authorization"]);
-        if (!import_shared45.Guards.isDefined(authHeader)) {
-          return void 0;
-        }
-        if (authHeader.toLowerCase().startsWith("bearer ")) {
+        const authHeader = headers.get("Authorization");
+        if (import_shared45.Guards.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
-        const cookieHeader = import_shared45.StringHelper.getSingleValue(headers["cookie"]);
+        const cookieHeader = headers.get("cookie");
         if (import_shared45.Guards.isDefined(cookieHeader)) {
-          const match = /sb-access-token=([^;]+)/.exec(cookieHeader);
+          const regex = new RegExp(`${this._cookiePrefix}=([^;]+)`);
+          const match = regex.exec(cookieHeader);
           if (!import_shared45.Guards.isNullOrEmpty(match) && import_shared45.Guards.isDefined(match[1])) {
             return match[1].trim();
           }
@@ -1984,11 +1981,11 @@ var init_extract_ssr_bearer_extractor = __esm({
     import_shared46 = require("@xeno-js/shared");
     SupabaseSsrTokenExtractor = class {
       extract(headers) {
-        const authHeader = import_shared46.StringHelper.getSingleValue(headers["authorization"]);
+        const authHeader = headers.get("authorization");
         if (import_shared46.Guards.isDefined(authHeader) && authHeader.toLowerCase().startsWith("bearer ")) {
           return authHeader.substring(7);
         }
-        const cookieHeader = import_shared46.StringHelper.getSingleValue(headers["cookie"]);
+        const cookieHeader = headers.get("cookie");
         if (import_shared46.Guards.isNullOrEmpty(cookieHeader)) return void 0;
         const cookies = cookieHeader.split(";").map((c) => c.trim());
         const tokenChunks = {};
@@ -2078,29 +2075,29 @@ var init_http_header_extractor = __esm({
       _trustedIp;
       _cookieName;
       extract(headers) {
-        const correlationId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-correlation-id"]));
-        const requestId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-request-id"]));
+        const correlationId = import_shared48.GuidHelper.parse(headers.get("x-correlation-id") ?? void 0);
+        const requestId = import_shared48.GuidHelper.parse(headers.get("x-request-id") ?? void 0);
         const token = this._bearerExtractor.extract(headers);
-        const clientIp = import_shared48.StringHelper.getSingleValue(headers[this._trustedIp?.toLowerCase() ?? "x-forwarded-for"]) ?? import_shared48.StringHelper.getSingleValue(headers["x-real-ip"]);
-        const spanId = import_shared48.GuidHelper.parse(import_shared48.StringHelper.getSingleValue(headers["x-span-id"]));
-        const parentSpanId = import_shared48.StringHelper.getSingleValue(headers["x-parent-span-id"]);
-        const acceptHeader = import_shared48.StringHelper.getSingleValue(headers["accept"]);
-        const contentTypeHeader = import_shared48.StringHelper.getSingleValue(headers["content-type"]);
-        const userAgent = import_shared48.StringHelper.getSingleValue(headers["user-agent"]);
-        const returnAddress = import_shared48.StringHelper.getSingleValue(headers["x-return-address"]);
-        const sequenceId = import_shared48.StringHelper.getSingleValue(headers["x-sequence-id"]);
-        const position = import_shared48.StringHelper.getSingleValue(headers["x-sequence-position"]);
-        const size = import_shared48.StringHelper.getSingleValue(headers["x-sequence-size"]);
-        const expiration = import_shared48.StringHelper.getSingleValue(headers["x-expiration"]);
-        const csrf = import_shared48.StringHelper.getSingleValue(headers["x-csrf-token"]);
-        const cookieHeader = import_shared48.StringHelper.getSingleValue(headers["cookie"]);
+        const clientIp = headers.get(this._trustedIp?.toLowerCase() ?? "x-forwarded-for") ?? headers.get("x-real-ip") ?? void 0;
+        const spanId = import_shared48.GuidHelper.parse(headers.get("x-span-id") ?? void 0);
+        const parentSpanId = headers.get("x-parent-span-id") ?? void 0;
+        const acceptHeader = headers.get("accept");
+        const contentTypeHeader = headers.get("content-type");
+        const userAgent = headers.get("user-agent") ?? void 0;
+        const returnAddress = headers.get("x-return-address") ?? void 0;
+        const sequenceId = headers.get("x-sequence-id") ?? void 0;
+        const position = headers.get("x-sequence-position");
+        const size = headers.get("x-sequence-size");
+        const expiration = headers.get("x-expiration");
+        const csrf = headers.get("x-csrf-token") ?? void 0;
+        const cookieHeader = headers.get("cookie") ?? void 0;
         const csrfCookie = this._cookieExtractor.extract({
           header: cookieHeader,
           name: this._cookieName
         });
-        const origin = import_shared48.StringHelper.getSingleValue(headers["origin"]);
+        const origin = headers.get("origin") ?? void 0;
         const cleanOrigin = import_shared48.HttpHelper.sanitizeOriginUrl(origin);
-        const referer = import_shared48.StringHelper.getSingleValue(headers["referer"]);
+        const referer = headers.get("referer") ?? void 0;
         const cleanReferer = import_shared48.HttpHelper.sanitizeOriginUrl(referer);
         const accept = acceptHeader === "*/*" ? void 0 : acceptHeader;
         const formatIndicator = accept ?? contentTypeHeader ?? "application/json";
@@ -2289,7 +2286,7 @@ var init_axios_factory = __esm({
     import_node_https = __toESM(require("https"), 1);
     import_shared52 = require("@xeno-js/shared");
     import_axios = __toESM(require("axios"), 1);
-    NodeAxiosFactory = class extends import_shared52.AxiosFactory {
+    NodeAxiosFactory = class {
       create(config) {
         const isKeepAlive = config.keepAlive ?? true;
         const maxSockets = config.maxSockets ?? 100;
@@ -2821,17 +2818,26 @@ var init_auth_utils = __esm({
        * @link https://github.com/xeno-js/xeno-js 
        */
       async addAuthN(container, opts) {
-        const { TOKENS: TOKENS4 } = await import("@xeno-js/shared");
-        const _t = opts;
-        const { SupabaseServerAuthFactory: SupabaseServerAuthFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
-        const factory = new SupabaseServerAuthFactory2();
-        const supabase = factory.create({ config: opts, container });
-        container.addScoped(TOKENS4.AUTH_SERVICE, () => {
-          return supabase;
-        });
-        container.addSingleton(TOKENS4.BASE_AUTH_SERVICE, () => {
-          return supabase;
-        });
+        const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
+        if (Guards46.isDefined(opts.customAuth)) {
+          const authService = opts.customAuth.authExtendedService();
+          container.addScoped(TOKENS4.AUTH_SERVICE, () => {
+            return authService;
+          });
+          container.addSingleton(TOKENS4.BASE_AUTH_SERVICE, () => {
+            return authService;
+          });
+        } else {
+          const { SupabaseServerAuthFactory: SupabaseServerAuthFactory2 } = await Promise.resolve().then(() => (init_factories(), factories_exports));
+          const factory = new SupabaseServerAuthFactory2();
+          const supabase = factory.create({ config: opts, container });
+          container.addScoped(TOKENS4.AUTH_SERVICE, () => {
+            return supabase;
+          });
+          container.addSingleton(TOKENS4.BASE_AUTH_SERVICE, () => {
+            return supabase;
+          });
+        }
       }
     });
   }
@@ -3426,6 +3432,7 @@ var init_base_controller = __esm({
       /**
        * Helper to send a query through the mediator and return the result.
        * @param request - The IQuery instance to be sent.
+       * @param signal - The AbortSignal
        * @returns A promise resolving to the result of the query.
        *
        * @author Xeno
@@ -3433,13 +3440,13 @@ var init_base_controller = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js
        */
-      _query(request) {
-        const signal = new AbortController().signal;
+      _query(request, signal) {
         return this._mediator.query(request, signal);
       }
       /**
        * Helper to send a command through the mediator and return the result.
        * @param request - The ICommand instance to be sent.
+       * @param signal - The AbortSignal
        * @returns A promise resolving to the result of the command.
        *
        * @author Xeno
@@ -3447,8 +3454,7 @@ var init_base_controller = __esm({
        * @since 2025-09-30
        * @link https://github.com/xeno-js/xeno-js
        */
-      _send(request) {
-        const signal = new AbortController().signal;
+      _send(request, signal) {
         return this._mediator.send(request, signal);
       }
       getContext() {
@@ -3479,7 +3485,7 @@ var init_allow_method_middleware = __esm({
       }
       _requestContext;
       _allowMethod;
-      async execute(req, _headers, next) {
+      async execute(req, _res, next) {
         const isAllowed = this._allowMethod.check(req.path, req.method);
         if (!isAllowed) {
           const { network, tracing } = this._requestContext.getContext() ?? {};
@@ -3524,7 +3530,7 @@ var init_allow_origin_middleware = __esm({
       _allowOrigin;
       _requestContext;
       _logger;
-      async execute(req, _headers, next) {
+      async execute(req, _res, next) {
         const { network, tracing } = this._requestContext.getContext() ?? {};
         const origin = network?.origin;
         if (!this._allowOrigin.isAllowed(origin)) {
@@ -3569,8 +3575,8 @@ var init_auth_middleware = __esm({
       _tokenExtractor;
       _gateKeeper;
       _logger;
-      async execute(req, headers, next) {
-        const token = this._tokenExtractor.extract(headers);
+      async execute(req, _res, next) {
+        const token = this._tokenExtractor.extract(req.headers);
         const authResult = await this._gateKeeper.authenticate(token);
         if (!authResult.isOk()) {
           const error = authResult.getErrorOrThrow();
@@ -3613,12 +3619,12 @@ var init_composite_middleware = __esm({
         this._middlewares = _middlewares;
       }
       _middlewares;
-      async execute(req, headers, next) {
+      async execute(req, res, next) {
         let currentNext = next;
         for (let i = this._middlewares.length - 1; i >= 0; i--) {
           const currentBehavior = this._middlewares[i];
           const previousNext = currentNext;
-          currentNext = () => currentBehavior.execute(req, headers, previousNext);
+          currentNext = () => currentBehavior.execute(req, res, previousNext);
         }
         return currentNext();
       }
@@ -3639,7 +3645,7 @@ var init_cors_middleware = __esm({
       }
       _requestContext;
       _withCredentials;
-      async execute(_req, _headers, next) {
+      async execute(_req, _res, next) {
         const { network } = this._requestContext.getContext() ?? {};
         const origin = network?.origin;
         const response = await next();
@@ -3669,7 +3675,7 @@ var init_csrf_middleware = __esm({
       }
       _requestContext;
       _csrfTokenService;
-      async execute(req, _headers, next) {
+      async execute(req, _res, next) {
         const method = req.method.toUpperCase();
         const isStateChanging = ["POST", "PUT", "DELETE", "PATCH"].includes(method);
         if (isStateChanging) {
@@ -3761,7 +3767,7 @@ var init_csrf_cookie_middleware = __esm({
       _requestContext;
       _csrfTokenService;
       _csrf;
-      async execute(_req, _headers, next) {
+      async execute(_req, _res, next) {
         const response = await next();
         const context = this._requestContext.getContext();
         const identity = context?.identity;
@@ -3801,7 +3807,7 @@ var init_options_middleware = __esm({
       _alloewMethod;
       _allowHeaders;
       _withCredentials;
-      async execute(req, _headers, next) {
+      async execute(req, _res, next) {
         if (req.method.toUpperCase() === "OPTIONS") {
           const network = this._requestContext.getNetworkContext();
           const origin = network?.origin;
@@ -3840,7 +3846,7 @@ var init_rate_limiter_middleware = __esm({
       _keyBuilder;
       _logger;
       _opts;
-      async execute(req, _headers, next) {
+      async execute(req, _res, next) {
         const cacheKey = this._keyBuilder.buildRateLimitKey(req.path);
         const { network, tracing } = this._ctxAccessor.getContext() ?? {};
         if (!import_shared69.Guards.isDefined(cacheKey))
@@ -3873,7 +3879,7 @@ var init_rate_limiter_middleware = __esm({
               error: {
                 code: import_shared69.ERROR_CODES.TOO_MANY_REQUESTS,
                 message: import_shared69.ERROR_CODE_MESSAGES[import_shared69.ERROR_CODES.TOO_MANY_REQUESTS],
-                details: `Rate limit exceeded. Key ${cacheKey} throttled.`,
+                details: `Rate limit exceeded.`,
                 path: req.path
               },
               correlationId: tracing?.correlationId ?? import_shared69.GuidHelper.generate(),
@@ -3981,14 +3987,14 @@ var init_request_middleware = __esm({
       _extractor;
       _resolver;
       _logger;
-      async execute(req, headers, next) {
+      async execute(req, res, next) {
         const correlationId = import_shared71.GuidHelper.generate();
         const requestId = import_shared71.GuidHelper.generate();
         const spanId = correlationId;
         const formatIndicator = "application/json";
         try {
-          const meta = this._extractor.extract(headers);
-          const clientIp = this._resolver.resolve(req.transport.req, meta.clientIp);
+          const meta = this._extractor.extract(req.headers);
+          const clientIp = this._resolver.resolve(req, meta.clientIp);
           const metadata = {
             ...meta,
             clientIp,
@@ -4001,7 +4007,7 @@ var init_request_middleware = __esm({
             metadata,
             identity: import_shared71.GUEST,
             path: req.path,
-            transport: req.transport
+            transport: { req, res }
           });
           const result = await this._requestContext.runAsync(tmpContext, async () => {
             return next();
@@ -4132,7 +4138,11 @@ var init_middleware_module = __esm({
         const { Guards: Guards46, TOKENS: TOKENS4 } = await import("@xeno-js/shared");
         const { HttpCookieExtractor: HttpCookieExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
         const { HttpHeaderExtractor: HttpHeaderExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
-        const tokenExtractor = await this._getTokenExtractor(opts.isSSR);
+        const tokenExtractor = await this._getTokenExtractor(
+          opts.isSSR,
+          opts.authCookieName,
+          opts.customTokenExtractor
+        );
         container.addSingleton(
           TOKENS4.SERVICE_EXTRACTOR,
           () => new HttpHeaderExtractor2(
@@ -4251,13 +4261,15 @@ var init_middleware_module = __esm({
           return new CompositeMiddleware2(middlewares);
         });
       }
-      async _getTokenExtractor(isSSR) {
+      async _getTokenExtractor(isSSR, cookieName, customTokenExtractor) {
+        const { Guards: Guards46 } = await import("@xeno-js/shared");
+        if (Guards46.isDefined(customTokenExtractor)) return customTokenExtractor();
         if (isSSR) {
           const { SupabaseSsrTokenExtractor: SupabaseSsrTokenExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
           return new SupabaseSsrTokenExtractor2();
         } else {
           const { BearerTokenExtractor: BearerTokenExtractor2 } = await Promise.resolve().then(() => (init_services(), services_exports));
-          return new BearerTokenExtractor2();
+          return new BearerTokenExtractor2(cookieName ?? "sb-access-token");
         }
       }
       async _getAllowMethod(configure, opts) {
@@ -4642,7 +4654,17 @@ var AppBuilder = class {
     allowOrigins: [],
     allowHeaders: [],
     cors: true,
-    withCredentials: true
+    withCredentials: true,
+    authCookieName: "sb-access-token"
+  };
+  _authConfig = {
+    url: "",
+    key: "",
+    opts: void 0,
+    redirectTo: "",
+    storageOpts: { type: "memory", cookieOpts: void 0, storage: void 0 },
+    ssrOpts: void 0,
+    customAuth: void 0
   };
   _httpConfig = {
     dataSourceToken: void 0,
@@ -4773,21 +4795,13 @@ var AppBuilder = class {
   addAuth(setupAction) {
     if (this._isAuthModuleQueued) return this;
     this._isAuthModuleQueued = true;
-    const config = {
-      url: "",
-      key: "",
-      opts: void 0,
-      redirectTo: "",
-      storageOpts: { type: "memory", cookieOpts: void 0, storage: void 0 },
-      ssrOpts: void 0
-    };
-    setupAction(config, this._configuration);
+    setupAction(this._authConfig, this._configuration);
     this._modules.push({
       priority: 3,
       name: "AuthModule",
       action: async () => {
         const { AuthUtils: AuthUtils2 } = await Promise.resolve().then(() => (init_auth_utils(), auth_utils_exports));
-        await AuthUtils2.addAuthN(this._container, config);
+        await AuthUtils2.addAuthN(this._container, this._authConfig);
       }
     });
     return this;
@@ -5039,7 +5053,8 @@ var AppBuilder = class {
         const middlewareModule = new MiddlewareModule2();
         await middlewareModule.configure(this._container, {
           ...this._middlewareConfig,
-          isAuth: this._isAuthModuleQueued
+          isAuth: this._isAuthModuleQueued,
+          customTokenExtractor: this._authConfig.customAuth?.authHeaderExtractor
         });
       }
     });