feat(server): hard-break GraphQL runtime off services_public onto scoped routing plane

[pyramation]

Summary

Load-bearing part of the migration off the legacy services_public schema. The GraphQL server runtime, its config defaults, the express-context settings loaders, and the server integration tests no longer read services_public — host routing and settings resolve exclusively through the scoped planes (constructive_routing_public.resolve_route() + constructive_routing_public.*), with no fallback.

The one remaining services_public literal in scope is a negative assertion in routing.test.ts that proves the resolver never queries it.

API middleware restructure (graphql/server/src/middleware/api.ts)

Previously the api middleware short-circuited to a services_public domain lookup and enableServicesApi: false skipped route resolution entirely. Now:

determineMode(ctx):
  if !enableScopedRouting        -> 'static'          // single-tenant, expose configured schemas
  if isPublic === false          -> privateHeaderMode(X-Api-Name|X-Schemata|X-Meta-Schema) ?? 'scoped-route'
  else                           -> 'scoped-route'    // resolveScopedRoute is the SOLE host resolver

• Deleted DOMAIN_LOOKUP_SQL, API_LIST_SQL, resolveDomainLookup, and the dev fallback. resolveScopedRoute is the only host→api resolver; a no-match / missing resolver / non-api target returns null → hard 404 (no legacy fallback).
• Private X-Api-Name lookup repointed to the scoped plane (SCOPED_API_NAME_LOOKUP_SQL, was API_NAME_LOOKUP_SQL), using constructive_routing_public.apis with is_published as the analog of the old is_public.
• flush.ts schema-cache invalidation now reads constructive_routing_public.domains.

Config / env / CLI

• graphql/types: defaults flipped to enableScopedRouting: true; removed enableServicesApi and services_public defaults.
• graphql/env: env wiring swapped to scoped-routing vars; merge.test.ts snapshot regenerated (enableServicesApi gone).
• packages/cli: server command defaults to scoped routing.

express-context loaders

• Every settings query (rls, cors, pubkey, webauthn, database-settings, auth-settings, pg-settings) repointed from services_public.* to constructive_routing_public.* (same column shapes).
• Renamed LoaderContext.servicesPool → routingPool.

server-test scenarios (converted vs removed)

server.integration.test.ts rewritten around a scenario matrix:

• converted → static single-tenant (scoped routing off, simple-seed), scoped public via domain, scoped private via domain, scoped private via X-Api-Name, scoped private via X-Schemata, scoped private via X-Meta-Schema, plus error paths (unresolved host → 404, invalid X-Schemata → 404, absent metaSchemas → 404).
• removed → all simple-seed-services seeding and the __fixtures__/seed/services/ fixture.
• express-context / fn-routes / upload integration tests moved to scoped seed + config; cli-e2e / search / server-test / schema-snapshot set enableScopedRouting: false for static mode.
• Connection/list assertions ({ … { nodes … } }) kept it.skip with a TODO for the preexisting grafast ConnectionStep bug.

The X-Meta-Schema admin surface exposes a collision-free metadata plane (constructive_routing_public + metaschema_public + metaschema_modules_public) — exposing catalog and routing together collides in PostGraphile since both define a table apis.

Testing

cd graphql/server-test && pnpm test: 49 failed, 23 skipped, 68 passed. All 49 failures are preexisting on a clean main baseline (grafast ConnectionStep connection-query bug surfacing as HTTP 500s + MinIO presigned-PUT upload tests needing real S3) — 0 new failures vs baseline (81 failed there). express-context (4), graphql/server unit (120), and graphql/env (9) suites all pass.

Open question

pgpm.json still pins @pgpm/services. It cannot be removed: @pgpm/metaschema-modules@0.33.0 (needed for metaschema_modules_public.storage_module in the upload tests) hard-requires the services extension and itself ships the services_public schema. Fully deleting the services extension requires the DB team to publish a metaschema-modules that drops that dependency — out of the server scope. The load-bearing runtime break stands regardless: no server/loader/config/test code reads services_public.

Link to Devin session: https://app.devin.ai/sessions/7f3cb2f4bf1147d6a97b30fd9aa56236
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring