ocean-brain 0.13.0 → 0.13.2

package/server/dist/modules/rate-limit.js

@@ -1,31 +1,31 @@
-import { rateLimit } from "express-rate-limit";
+import { isAuthenticatedRequest } from "./auth-guard.js";
+import { createAppError } from "./error-handler.js";
 const AUTH_RATE_LIMIT_MESSAGE = "Too many authentication attempts. Please try again later.";
 const SESSION_ACCESS_RATE_LIMIT_MESSAGE = "Too many authenticated requests. Please try again later.";
-const createAuthAttemptRateLimit = () => rateLimit({
-  windowMs: 15 * 60 * 1e3,
-  limit: 10,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "AUTH_RATE_LIMITED",
-      message: AUTH_RATE_LIMIT_MESSAGE
-    });
-  }
+const IMAGE_ASSET_RATE_LIMIT_MESSAGE = "Too many image asset requests. Please try again later.";
+const createOptions = (max, timeWindow, code, message, options = {}) => ({
+  max,
+  timeWindow,
+  hook: "preHandler",
+  enableDraftSpec: true,
+  errorResponseBuilder: (_request, context) => createAppError(context.statusCode, code, message),
+  ...options
 });
-const createSessionAccessRateLimit = () => rateLimit({
-  windowMs: 60 * 1e3,
-  limit: 300,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "SESSION_RATE_LIMITED",
-      message: SESSION_ACCESS_RATE_LIMIT_MESSAGE
-    });
-  }
+const createAuthAttemptRateLimit = () => createOptions(10, 15 * 60 * 1e3, "AUTH_RATE_LIMITED", AUTH_RATE_LIMIT_MESSAGE, {
+  groupId: "auth-attempt"
+});
+const createSessionAccessRateLimit = () => createOptions(300, 60 * 1e3, "SESSION_RATE_LIMITED", SESSION_ACCESS_RATE_LIMIT_MESSAGE, {
+  groupId: "session-access"
+});
+const createImageAssetRateLimit = (authConfig) => ({
+  ...createOptions(10, 15 * 60 * 1e3, "IMAGE_ASSET_RATE_LIMITED", IMAGE_ASSET_RATE_LIMIT_MESSAGE, {
+    groupId: "image-asset",
+    allowList: (request) => authConfig.mode !== "password" || isAuthenticatedRequest(request)
+  }),
+  hook: "onRequest"
 });
 export {
   createAuthAttemptRateLimit,
+  createImageAssetRateLimit,
   createSessionAccessRateLimit
 };

package/server/dist/modules/server-events-handler.js

@@ -12,23 +12,25 @@ const getEventStreamLifetimeMs = (expires) => {
   return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));
 };
 const createServerEventsHandler = () => {
-  return async (req, res) => {
-    res.status(200);
-    res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
-    res.setHeader("Cache-Control", "no-cache, no-transform");
-    res.setHeader("Connection", "keep-alive");
-    res.setHeader("X-Accel-Buffering", "no");
-    res.flushHeaders?.();
-    res.write(": connected\n\n");
+  return async (req, reply) => {
+    reply.hijack();
+    const response = reply.raw;
+    response.statusCode = 200;
+    response.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+    response.setHeader("Cache-Control", "no-cache, no-transform");
+    response.setHeader("Connection", "keep-alive");
+    response.setHeader("X-Accel-Buffering", "no");
+    response.flushHeaders();
+    response.write(": connected\n\n");
     const unsubscribe = subscribeServerEvents((event) => {
-      res.write(serializeServerEvent(event));
+      response.write(serializeServerEvent(event));
     });
     const keepAliveTimer = setInterval(() => {
-      res.write(": keepalive\n\n");
+      response.write(": keepalive\n\n");
     }, KEEP_ALIVE_INTERVAL_MS);
     keepAliveTimer.unref?.();
     const sessionExpiryTimer = setTimeout(() => {
-      res.end();
+      response.end();
     }, getEventStreamLifetimeMs(req.session?.cookie.expires));
     sessionExpiryTimer.unref?.();
     let cleanedUp = false;
@@ -41,8 +43,8 @@ const createServerEventsHandler = () => {
       clearTimeout(sessionExpiryTimer);
       unsubscribe();
     };
-    req.on("close", cleanup);
-    res.on("close", cleanup);
+    req.raw.on("close", cleanup);
+    response.on("close", cleanup);
   };
 };
 export {

package/server/dist/modules/session-store.js

@@ -1,4 +1,3 @@
-import session from "express-session";
 const AUTH_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1e3;
 const ANONYMOUS_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
 const AUTH_SESSION_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
@@ -25,9 +24,8 @@ const getSessionExpiry = (data, now = Date.now()) => {
   }
   return fallbackExpiresAt;
 };
-class TtlMemorySessionStore extends session.Store {
+class TtlMemorySessionStore {
   constructor(options = {}) {
-    super();
     this.options = options;
     this.pruneTimer = setInterval(() => {
       this.pruneExpiredSessions();
@@ -54,7 +52,7 @@ class TtlMemorySessionStore extends session.Store {
       callback(error);
     }
   }
-  set(sid, data, callback) {
+  set(sid, data, callback = () => void 0) {
     try {
       const now = Date.now();
       this.sessions.set(sid, {
@@ -65,14 +63,14 @@ class TtlMemorySessionStore extends session.Store {
       });
       this.pruneExpiredSessions();
       this.evictOldestSessions();
-      callback?.();
+      callback();
     } catch (error) {
-      callback?.(error);
+      callback(error);
     }
   }
-  destroy(sid, callback) {
+  destroy(sid, callback = () => void 0) {
     this.sessions.delete(sid);
-    callback?.();
+    callback();
   }
   touch(sid, data, callback) {
     const entry = this.sessions.get(sid);

package/server/dist/paths.js

@@ -6,9 +6,10 @@ const DATA_DIR = process.env.OCEAN_BRAIN_DATA_DIR || ".";
 const IMAGE_DIR = process.env.OCEAN_BRAIN_IMAGE_DIR || path.resolve(DATA_DIR, "assets/images");
 const SEARCH_INDEX_PATH = process.env.OCEAN_BRAIN_SEARCH_INDEX_PATH || path.resolve(DATA_DIR, "search.sqlite3");
 const EMBEDDING_API_KEY_PATH = path.resolve(DATA_DIR, "embedding-api-key");
+const CLIENT_DIST = process.env.OCEAN_BRAIN_CLIENT_DIST || path.resolve(PACKAGE_ROOT, "client/dist");
 const paths = {
   packageRoot: path.resolve(PACKAGE_ROOT),
-  clientDist: path.resolve(PACKAGE_ROOT, "client/dist"),
+  clientDist: path.resolve(CLIENT_DIST),
   imageDir: path.resolve(IMAGE_DIR),
   searchIndex: path.resolve(SEARCH_INDEX_PATH),
   embeddingApiKey: path.resolve(EMBEDDING_API_KEY_PATH)

package/server/dist/routes/api.js

@@ -1,4 +1,3 @@
-import { Router } from "express";
 import { createLoginHandler, createLogoutHandler, createSessionStatusHandler } from "../features/auth/http/api.js";
 import { createUploadImageHandler } from "../features/image/http/upload.js";
 import {
@@ -17,78 +16,113 @@ import {
 import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
 import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 import { createServerEventsHandler } from "../modules/server-events-handler.js";
-import useAsync from "../modules/use-async.js";
 import { createMcpRouter } from "./mcp.js";
 const createApiRouter = (authConfig, mcpAdminService) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  const requireSession = requireSessionForWrite(authConfig);
-  const sessionAccessRateLimit = createSessionAccessRateLimit();
-  return Router().use("/mcp", createMcpRouter(authConfig, mcpAdminService)).get("/auth/session", csrfProtection, useAsync(createSessionStatusHandler(authConfig))).post("/auth/login", csrfProtection, createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig))).post(
-    "/auth/logout",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createLogoutHandler(authConfig))
-  ).get(
-    "/mcp-admin/status",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminStatusHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/enabled",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminSetEnabledHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/token/rotate",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminRotateTokenHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/token/revoke",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService))
-  ).get(
-    "/search-admin/status",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminStatusHandler())
-  ).post(
-    "/search-admin/config",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminSaveConfigHandler())
-  ).post(
-    "/search-admin/models",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminListModelsHandler())
-  ).post(
-    "/search-admin/test",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminTestConnectionHandler())
-  ).post(
-    "/search-admin/reindex",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminReindexHandler())
-  ).post("/image", sessionAccessRateLimit, requireSession, csrfProtection, useAsync(createUploadImageHandler())).get("/events", sessionAccessRateLimit, requireSession, csrfProtection, createServerEventsHandler()).use((_req, res) => {
-    res.status(404).json({
-      code: "API_ROUTE_NOT_FOUND",
-      message: "The requested API route was not found."
-    }).end();
-  });
+  return async (app) => {
+    const csrfProtection = createCsrfProtection(authConfig);
+    const requireSession = requireSessionForWrite(authConfig);
+    const sessionAccessRateLimit = app.rateLimit(createSessionAccessRateLimit());
+    app.register(createMcpRouter(authConfig, mcpAdminService), { prefix: "/mcp" });
+    app.get("/auth/session", createSessionStatusHandler(authConfig));
+    app.post(
+      "/auth/login",
+      {
+        preHandler: csrfProtection,
+        config: { rateLimit: createAuthAttemptRateLimit() }
+      },
+      createLoginHandler(authConfig)
+    );
+    app.post(
+      "/auth/logout",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createLogoutHandler(authConfig)
+    );
+    app.get(
+      "/mcp-admin/status",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createMcpAdminStatusHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/enabled",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminSetEnabledHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/token/rotate",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminRotateTokenHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/token/revoke",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminRevokeTokenHandler(mcpAdminService)
+    );
+    app.get(
+      "/search-admin/status",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createSearchAdminStatusHandler()
+    );
+    app.post(
+      "/search-admin/config",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminSaveConfigHandler()
+    );
+    app.post(
+      "/search-admin/models",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminListModelsHandler()
+    );
+    app.post(
+      "/search-admin/test",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminTestConnectionHandler()
+    );
+    app.post(
+      "/search-admin/reindex",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminReindexHandler()
+    );
+    app.post(
+      "/image",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createUploadImageHandler()
+    );
+    app.get(
+      "/events",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createServerEventsHandler()
+    );
+    app.all("/*", (_request, reply) => {
+      return reply.status(404).send({
+        code: "API_ROUTE_NOT_FOUND",
+        message: "The requested API route was not found."
+      });
+    });
+  };
 };
 export {
   createApiRouter

package/server/dist/routes/auth-pages.js

@@ -1,21 +1,31 @@
-import { Router } from "express";
 import {
   createLoginPageHandler,
   createLoginPageSubmitHandler,
   createLogoutPageHandler
 } from "../features/auth/http/pages.js";
-import { createCsrfProtection, createLoginCsrfFailureHandler, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
 import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 const createAuthPagesRouter = (authConfig) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  const sessionAccessRateLimit = createSessionAccessRateLimit();
-  return Router().get("/login", csrfProtection, createLoginPageHandler(authConfig)).post("/login", csrfProtection, createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig)).post(
-    "/logout",
-    sessionAccessRateLimit,
-    requireSessionForWrite(authConfig),
-    csrfProtection,
-    createLogoutPageHandler(authConfig)
-  ).use(createLoginCsrfFailureHandler(authConfig));
+  return async (app) => {
+    const csrfProtection = createCsrfProtection(authConfig);
+    app.get("/login", createLoginPageHandler(authConfig));
+    app.post(
+      "/login",
+      {
+        preHandler: csrfProtection,
+        config: { rateLimit: createAuthAttemptRateLimit() }
+      },
+      createLoginPageSubmitHandler(authConfig)
+    );
+    app.post(
+      "/logout",
+      {
+        preHandler: [requireSessionForWrite(authConfig), csrfProtection],
+        config: { rateLimit: createSessionAccessRateLimit() }
+      },
+      createLogoutPageHandler(authConfig)
+    );
+  };
 };
 export {
   createAuthPagesRouter

package/server/dist/routes/client.js

@@ -1,11 +1,12 @@
-import express, { Router } from "express";
-import { rateLimit } from "express-rate-limit";
-import path from "path";
-import { createCsrfProtection, isAuthenticatedRequest } from "../modules/auth-guard.js";
+import path from "node:path";
+import fastifyStatic from "@fastify/static";
+import { isAuthenticatedRequest, issueCsrfToken } from "../modules/auth-guard.js";
+import { createImageAssetRateLimit } from "../modules/rate-limit.js";
 import { paths } from "../paths.js";
-const IMAGE_ASSET_RATE_LIMIT_MESSAGE = "Too many image asset requests. Please try again later.";
-const isClientDocumentRequest = (req) => {
-  return req.method === "GET" && Boolean(req.headers.accept?.includes("text/html")) && path.extname(req.path) === "";
+const getRequestPath = (request) => request.url.split("?")[0] || "/";
+const isClientDocumentRequest = (request) => {
+  const accept = request.headers.accept;
+  return request.method === "GET" && Boolean(accept?.includes("text/html")) && path.extname(getRequestPath(request)) === "";
 };
 const shouldBlockClientRoute = (authConfig, requestPath, authenticated) => {
   if (authConfig.mode !== "password" || authenticated) {
@@ -16,82 +17,69 @@ const shouldBlockClientRoute = (authConfig, requestPath, authenticated) => {
   }
   return path.extname(requestPath) === "";
 };
-const createImageAssetAuthRateLimit = (authConfig) => rateLimit({
-  windowMs: 15 * 60 * 1e3,
-  limit: 10,
-  standardHeaders: true,
-  legacyHeaders: false,
-  skip: (req) => authConfig.mode !== "password" || isAuthenticatedRequest(req),
-  handler: (_req, res) => {
-    res.setHeader("Cache-Control", "no-store");
-    res.status(429).json({
-      code: "IMAGE_ASSET_RATE_LIMITED",
-      message: IMAGE_ASSET_RATE_LIMIT_MESSAGE
-    });
-  }
-});
 const createProtectedImageAssetsMiddleware = (authConfig) => {
-  return (req, res, next) => {
-    if (authConfig.mode !== "password" || isAuthenticatedRequest(req)) {
-      next();
+  return (request, reply, done) => {
+    if (authConfig.mode !== "password" || isAuthenticatedRequest(request)) {
+      done();
       return;
     }
-    res.setHeader("Cache-Control", "no-store");
-    if (req.headers.accept?.includes("text/html")) {
-      const redirectPath = encodeURIComponent(req.originalUrl || req.url || "/");
-      res.redirect(303, `/login?next=${redirectPath}`);
+    if (request.headers.accept?.includes("text/html")) {
+      const redirectPath = encodeURIComponent(request.url || "/");
+      void reply.redirect(`/login?next=${redirectPath}`, 303);
       return;
     }
-    res.status(401).end();
+    void reply.status(401).send();
   };
 };
-const createClientRouteCsrfTokenMiddleware = (authConfig) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  return (req, res, next) => {
-    if (path.extname(req.path) !== "") {
-      next();
-      return;
+const setImageHeaders = (authConfig, reply) => {
+  reply.header("X-Content-Type-Options", "nosniff");
+  if (authConfig.mode === "password") {
+    reply.header("Cache-Control", "no-store");
+  }
+};
+const createProductionClientContentHandler = () => {
+  return (request, reply) => {
+    if (isClientDocumentRequest(request)) {
+      return reply.sendFile("index.html", paths.clientDist);
     }
-    csrfProtection(req, res, next);
+    const filePath = getRequestPath(request).replace(/^\/+/, "");
+    return reply.sendFile(filePath, paths.clientDist, { extensions: ["html"] });
   };
 };
-const createProductionClientContentRouter = () => Router().use(express.static(paths.clientDist, { extensions: ["html"] })).get(/.*/, (req, res, next) => {
-  if (!isClientDocumentRequest(req)) {
-    next();
-    return;
-  }
-  res.sendFile("index.html", { root: paths.clientDist });
-}).use((_req, res) => {
-  res.setHeader("X-Content-Type-Options", "nosniff");
-  res.status(404).end();
-});
-const createClientRouter = (authConfig, clientContentMiddleware = createProductionClientContentRouter()) => Router().use(
-  "/assets/images",
-  createImageAssetAuthRateLimit(authConfig),
-  createProtectedImageAssetsMiddleware(authConfig),
-  express.static(paths.imageDir, {
-    setHeaders: (res) => {
-      res.setHeader("X-Content-Type-Options", "nosniff");
-      if (authConfig.mode === "password") {
-        res.setHeader("Cache-Control", "no-store");
+const createClientRouter = (authConfig, clientContentHandler = createProductionClientContentHandler()) => {
+  return async (app) => {
+    app.register(fastifyStatic, { serve: false });
+    app.get(
+      "/assets/images/*",
+      {
+        onRequest: (_request, reply, done) => {
+          setImageHeaders(authConfig, reply);
+          done();
+        },
+        preHandler: createProtectedImageAssetsMiddleware(authConfig),
+        config: { rateLimit: createImageAssetRateLimit(authConfig) }
+      },
+      (request, reply) => {
+        return reply.sendFile(request.params["*"], paths.imageDir, { cacheControl: false });
       }
-    }
-  }),
-  (_req, res) => {
-    res.setHeader("X-Content-Type-Options", "nosniff");
-    if (authConfig.mode === "password") {
-      res.setHeader("Cache-Control", "no-store");
-    }
-    res.status(404).end();
-  }
-).use((req, res, next) => {
-  if (shouldBlockClientRoute(authConfig, req.path, isAuthenticatedRequest(req))) {
-    const redirectPath = encodeURIComponent(req.originalUrl || "/");
-    res.redirect(303, `/login?next=${redirectPath}`);
-    return;
-  }
-  next();
-}).use(createClientRouteCsrfTokenMiddleware(authConfig)).use(clientContentMiddleware);
+    );
+    const handleClientRequest = async (request, reply) => {
+      const requestPath = getRequestPath(request);
+      if (shouldBlockClientRoute(authConfig, requestPath, isAuthenticatedRequest(request))) {
+        return reply.redirect(`/login?next=${encodeURIComponent(request.url || "/")}`, 303);
+      }
+      if (path.extname(requestPath) === "") {
+        issueCsrfToken(authConfig, reply);
+      }
+      return clientContentHandler(request, reply);
+    };
+    app.get("/", handleClientRequest);
+    app.get("/*", handleClientRequest);
+    app.setNotFoundHandler((_request, reply) => {
+      return reply.header("X-Content-Type-Options", "nosniff").status(404).send();
+    });
+  };
+};
 export {
   createClientRouter
 };

package/server/dist/routes/graphql.js

@@ -1,35 +1,40 @@
-import { Router } from "express";
-import { createHandler } from "graphql-http/lib/use/express";
+import mercurius from "mercurius";
 import { createCsrfProtection, isAuthenticatedRequest, requireSessionForGraphql } from "../modules/auth-guard.js";
 import { createMcpAuthMiddleware, createReadOnlyMcpValidationRule } from "../modules/mcp-auth.js";
 import schema from "../schema/index.js";
-const createGraphqlContext = (authConfig) => (req) => ({
+const createGraphqlContext = (authConfig) => (request, reply) => ({
   authMode: authConfig.mode,
-  isAuthenticated: isAuthenticatedRequest(req.raw),
-  req: req.raw,
-  res: req.context.res
+  isAuthenticated: isAuthenticatedRequest(request),
+  req: request,
+  res: reply
 });
 const createGraphqlRouter = (authConfig, mcpAdminService) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  return Router().use(
-    "/mcp",
-    createMcpAuthMiddleware(authConfig, mcpAdminService),
-    createHandler({
-      schema,
-      context: createGraphqlContext(authConfig),
-      validationRules: (_req, _args, specifiedRules) => {
-        return [...specifiedRules, createReadOnlyMcpValidationRule()];
-      }
-    })
-  ).use(
-    "/",
-    requireSessionForGraphql(authConfig),
-    csrfProtection,
-    createHandler({
-      schema,
-      context: createGraphqlContext(authConfig)
-    })
-  );
+  return async (app) => {
+    app.register(async (mcpEndpoint) => {
+      mcpEndpoint.addHook("preHandler", createMcpAuthMiddleware(authConfig, mcpAdminService));
+      mcpEndpoint.register(mercurius, {
+        schema,
+        path: "/graphql/mcp",
+        graphiql: false,
+        errorFormatter: (execution, context) => ({
+          ...mercurius.defaultErrorFormatter(execution, context),
+          statusCode: 200
+        }),
+        context: createGraphqlContext(authConfig),
+        validationRules: [createReadOnlyMcpValidationRule()]
+      });
+    });
+    app.register(async (sessionEndpoint) => {
+      sessionEndpoint.addHook("preHandler", requireSessionForGraphql(authConfig));
+      sessionEndpoint.addHook("preHandler", createCsrfProtection(authConfig));
+      sessionEndpoint.register(mercurius, {
+        schema,
+        path: "/graphql",
+        graphiql: false,
+        context: createGraphqlContext(authConfig)
+      });
+    });
+  };
 };
 export {
   createGraphqlRouter