@agentic-kit/pi 0.2.1 → 0.5.0

package/esm/host.d.ts

@@ -38,6 +38,16 @@ export type PreviewToken = {
     accessTokenExpiresAt?: string;
     userId?: string;
 };
+/**
+ * Overlay layered over the pinned base preset when provisioning a database.
+ * Structurally the `ProvisionOverlay` from `provision-database/resolve`; typed
+ * loosely here to keep `host.ts` free of provision-internal imports.
+ */
+export interface HostProvisionOverlay {
+    preset?: string;
+    add?: (string | [string, Record<string, unknown>])[];
+    remove?: string[];
+}
 export interface PiToolsHost {
     /** Signed-in platform account, or null/undefined when signed out. */
     account(): HostAccount | null | undefined;
@@ -49,6 +59,13 @@ export interface PiToolsHost {
     previewToken?(): Promise<PreviewToken | null>;
     /** Treat tokens expiring within this window as already expired. Default 30s. */
     dataTokenSkewMs?: number;
+    /**
+     * Optional provision overlay: pick a base preset and/or layer module
+     * add/remove on top of it. The base module list always comes from the pinned
+     * `node-type-registry` preset — this only customizes it. Distributed as data
+     * (e.g. materialized from appstash / a pinned git ref), never as code.
+     */
+    provisionOverlay?(): HostProvisionOverlay | null | undefined | Promise<HostProvisionOverlay | null | undefined>;
 }
 export declare const DEFAULT_DATA_TOKEN_SKEW_MS = 30000;
 export declare function configureHost(host: PiToolsHost): void;

package/esm/index.d.ts

@@ -5,7 +5,10 @@ export declare const dbTools: ExtensionFactory;
 export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
 export { type ConfirmGate, type ConfirmGateDeps, createConfirmGate } from './confirm-gate';
 export { type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
-export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type PiToolsHost, type PreviewToken, } from './host';
+export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type HostProvisionOverlay, type PiToolsHost, type PreviewToken, } from './host';
+export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, type ProvisionManifest, } from './provision-database/manifest';
+export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, type ModulePreset, type ProvisionModule, } from './provision-database/presets';
+export { moduleKey, type ProvisionOverlay, resolveProvisionModules, } from './provision-database/resolve';
 export { toolSchema } from './tool-schema';
 export { createTemplatePreviewTables } from './tools/templates';
 export default dbTools;

package/esm/index.js

@@ -43,6 +43,9 @@ export function createDbTools(host) {
 export { createConfirmGate } from './confirm-gate';
 export { resolveDataToken, resolveProjectContext, } from './context';
 export { configureHost, getHost, } from './host';
+export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, } from './provision-database/manifest';
+export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, } from './provision-database/presets';
+export { moduleKey, resolveProvisionModules, } from './provision-database/resolve';
 export { toolSchema } from './tool-schema';
 export { createTemplatePreviewTables } from './tools/templates';
 export default dbTools;

package/esm/provision-database/create-database-provision.d.ts

@@ -1,4 +1,4 @@
-import type { ProvisionModule } from './modules';
+import type { ProvisionModule } from './presets';
 export declare function createDatabaseProvision(args: {
     endpoint: string;
     bearer: string;

package/esm/provision-database/manifest.d.ts

@@ -0,0 +1,10 @@
+import type { ProvisionOverlay } from './resolve';
+export declare const PROVISION_MANIFEST_FILE = "provision.json";
+export type ProvisionManifest = ProvisionOverlay;
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+export declare function parseProvisionManifest(value: unknown): ProvisionManifest;
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+export declare function loadProvisionManifest(dir: string): Promise<ProvisionManifest | null>;

package/esm/provision-database/manifest.js

@@ -0,0 +1,48 @@
+// `provision.json` overlay manifest.
+//
+// A pure-data overlay, distributed the same way skills are: written into a
+// config/app directory (locally, or materialized there from appstash / a pinned
+// git ref) and read at provision time. It NEVER installs or executes a package
+// — the base preset is a pinned build-time dependency; this file only selects a
+// preset and layers add/remove on top.
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { z } from 'zod';
+export const PROVISION_MANIFEST_FILE = 'provision.json';
+const ModuleSchema = z.union([
+    z.string(),
+    z.tuple([z.string(), z.record(z.string(), z.unknown())]),
+]);
+const ProvisionManifestSchema = z
+    .object({
+    preset: z.string().optional(),
+    add: z.array(ModuleSchema).optional(),
+    remove: z.array(z.string()).optional(),
+})
+    .strict();
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+export function parseProvisionManifest(value) {
+    return ProvisionManifestSchema.parse(value);
+}
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+export async function loadProvisionManifest(dir) {
+    const file = path.join(dir, PROVISION_MANIFEST_FILE);
+    let raw;
+    try {
+        raw = await readFile(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Invalid ${PROVISION_MANIFEST_FILE} at ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parseProvisionManifest(parsed);
+}

package/esm/provision-database/presets.d.ts

@@ -0,0 +1,4 @@
+import { allModulePresets, getModulePreset, type ModulePreset } from 'node-type-registry';
+export type ProvisionModule = string | [string, Record<string, unknown>];
+export declare const DEFAULT_PROVISION_PRESET: string;
+export { allModulePresets, getModulePreset, type ModulePreset };

package/esm/provision-database/presets.js

@@ -0,0 +1,13 @@
+// Provision module presets — the canonical source of truth.
+//
+// The module list is NEVER hand-copied here. It is imported from the pinned
+// `node-type-registry` package (the same presets the backend and dashboard use),
+// so bumping that dependency is how the base module set moves. Hosts customize
+// on top with an ordered overlay (see `resolve.ts`) rather than editing a list.
+import { allModulePresets, getModulePreset, PresetB2bStorage, } from 'node-type-registry';
+// Default base preset. `b2b:storage` = the full multi-tenant B2B shape plus file
+// storage, matching Constructive's app shape. Crucially it already includes
+// `config_secrets_module` — the dependency the old hand-copied list dropped,
+// which made the backend reject provisioning with `REQUIRES (config_secrets_module:app)`.
+export const DEFAULT_PROVISION_PRESET = PresetB2bStorage.name;
+export { allModulePresets, getModulePreset };

package/esm/provision-database/resolve.d.ts

@@ -0,0 +1,27 @@
+import { type ProvisionModule } from './presets';
+export interface ProvisionOverlay {
+    /**
+     * Base preset name to resolve from (e.g. 'b2b:storage', 'full'). The last
+     * layer that sets `preset` wins; if none set it, `DEFAULT_PROVISION_PRESET`
+     * is used.
+     */
+    preset?: string;
+    /**
+     * Modules to add. An entry whose key matches an existing module OVERRIDES it
+     * (e.g. re-declaring `storage_module` with app-specific options); a new key
+     * is appended.
+     */
+    add?: ProvisionModule[];
+    /**
+     * Module names or `name:scope` keys to drop from the base. A bare name
+     * removes every scope of that module; `name:scope` removes just that one.
+     */
+    remove?: string[];
+}
+/** Stable identity for a module entry: `name` or `name:scope` when scoped. */
+export declare function moduleKey(m: ProvisionModule): string;
+/**
+ * Resolve the effective module list from a pinned preset plus ordered overlays.
+ * Pure: no I/O, no host access. Later overlays win (last-write-wins by key).
+ */
+export declare function resolveProvisionModules(layers?: ProvisionOverlay[]): ProvisionModule[];

package/esm/provision-database/resolve.js

@@ -0,0 +1,49 @@
+// Ordered-overlay resolution for provision modules.
+//
+// Mirrors the skills overlay model (`@agentic-kit/harness` skills manifest): a
+// pinned base (a named preset from `node-type-registry`) is layered under zero
+// or more overlays, later layers winning by module key. An empty overlay list
+// resolves to the base preset unchanged.
+import { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, } from './presets';
+function moduleName(m) {
+    return Array.isArray(m) ? m[0] : m;
+}
+function moduleScope(m) {
+    if (!Array.isArray(m))
+        return undefined;
+    const scope = m[1]?.scope;
+    return typeof scope === 'string' ? scope : undefined;
+}
+/** Stable identity for a module entry: `name` or `name:scope` when scoped. */
+export function moduleKey(m) {
+    const scope = moduleScope(m);
+    return scope ? `${moduleName(m)}:${scope}` : moduleName(m);
+}
+/**
+ * Resolve the effective module list from a pinned preset plus ordered overlays.
+ * Pure: no I/O, no host access. Later overlays win (last-write-wins by key).
+ */
+export function resolveProvisionModules(layers = []) {
+    const presetName = [...layers].reverse().find((l) => l.preset)?.preset ?? DEFAULT_PROVISION_PRESET;
+    const preset = getModulePreset(presetName);
+    if (!preset) {
+        const known = allModulePresets.map((p) => p.name).join(', ');
+        throw new Error(`Unknown provision preset "${presetName}". Known presets: ${known}.`);
+    }
+    // Ordered map keyed by module identity preserves position while allowing
+    // overrides (same key) and appends (new key).
+    const resolved = new Map();
+    for (const m of preset.modules)
+        resolved.set(moduleKey(m), m);
+    for (const layer of layers) {
+        for (const target of layer.remove ?? []) {
+            for (const key of [...resolved.keys()]) {
+                if (key === target || key.split(':')[0] === target)
+                    resolved.delete(key);
+            }
+        }
+        for (const m of layer.add ?? [])
+            resolved.set(moduleKey(m), m);
+    }
+    return [...resolved.values()];
+}

package/esm/tools/provision-database.js

@@ -9,8 +9,9 @@ import { probeDatabase } from '../db-probe';
 import { createDatabaseProvision } from '../provision-database/create-database-provision';
 import { selectProvisionCredential } from '../provision-database/credential';
 import { archiveBindingKeys, ARCHIVED_BINDING_KEYS, mergeEnv, provisionEnvVars, } from '../provision-database/env-file';
-import { DEFAULT_PROVISION_MODULES } from '../provision-database/modules';
+import { loadProvisionManifest } from '../provision-database/manifest';
 import { applySqlFixups } from '../provision-database/pg-fixups';
+import { resolveProvisionModules } from '../provision-database/resolve';
 const DEFAULT_API_ENDPOINT = 'http://api.localhost:3000/graphql';
 const DEFAULT_MODULES_ENDPOINT = 'http://modules.localhost:3000/graphql';
 // The per-DB endpoints are subdomain.<domain>; the provisioning domain is the api
@@ -186,6 +187,24 @@ export const provisionDatabaseTool = {
             ok: false,
             out: err instanceof Error ? err.message : String(err),
         }));
+        // Resolve the module set: pinned base preset from node-type-registry, then
+        // ordered overlays (host default < project-local provision.json). No list is
+        // hand-copied here; overlays are pure data. A bad preset/manifest fails the
+        // run rather than provisioning a wrong module set.
+        let modules;
+        try {
+            const layers = [];
+            const hostOverlay = await host.provisionOverlay?.();
+            if (hostOverlay)
+                layers.push(hostOverlay);
+            const projectOverlay = await loadProvisionManifest(ctx.cwd);
+            if (projectOverlay)
+                layers.push(projectOverlay);
+            modules = resolveProvisionModules(layers);
+        }
+        catch (err) {
+            return fail(`Cannot resolve provision modules: ${err instanceof Error ? err.message : String(err)}`);
+        }
         const physicalDb = process.env.CONSTRUCTIVE_DB || 'constructive';
         // Provision on the MODULES endpoint: createDatabaseProvisionModule creates
         // the database owned by ownerId, provisions the module set, and bootstraps
@@ -200,7 +219,7 @@ export const provisionDatabaseTool = {
                 databaseName,
                 domain: provisionDomain(apiEndpoint),
                 ownerId,
-                modules: DEFAULT_PROVISION_MODULES,
+                modules,
             })));
         }
         catch (err) {

package/host.d.ts

@@ -38,6 +38,16 @@ export type PreviewToken = {
     accessTokenExpiresAt?: string;
     userId?: string;
 };
+/**
+ * Overlay layered over the pinned base preset when provisioning a database.
+ * Structurally the `ProvisionOverlay` from `provision-database/resolve`; typed
+ * loosely here to keep `host.ts` free of provision-internal imports.
+ */
+export interface HostProvisionOverlay {
+    preset?: string;
+    add?: (string | [string, Record<string, unknown>])[];
+    remove?: string[];
+}
 export interface PiToolsHost {
     /** Signed-in platform account, or null/undefined when signed out. */
     account(): HostAccount | null | undefined;
@@ -49,6 +59,13 @@ export interface PiToolsHost {
     previewToken?(): Promise<PreviewToken | null>;
     /** Treat tokens expiring within this window as already expired. Default 30s. */
     dataTokenSkewMs?: number;
+    /**
+     * Optional provision overlay: pick a base preset and/or layer module
+     * add/remove on top of it. The base module list always comes from the pinned
+     * `node-type-registry` preset — this only customizes it. Distributed as data
+     * (e.g. materialized from appstash / a pinned git ref), never as code.
+     */
+    provisionOverlay?(): HostProvisionOverlay | null | undefined | Promise<HostProvisionOverlay | null | undefined>;
 }
 export declare const DEFAULT_DATA_TOKEN_SKEW_MS = 30000;
 export declare function configureHost(host: PiToolsHost): void;

package/index.d.ts

@@ -5,7 +5,10 @@ export declare const dbTools: ExtensionFactory;
 export declare function createDbTools(host: PiToolsHost): ExtensionFactory;
 export { type ConfirmGate, type ConfirmGateDeps, createConfirmGate } from './confirm-gate';
 export { type ModulesClient, type ProjectContext, resolveDataToken, resolveProjectContext, } from './context';
-export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type PiToolsHost, type PreviewToken, } from './host';
+export { type ActiveDataToken, configureHost, type DataAuthBroker, getHost, type HostAccount, type HostBackendConfig, type HostProvisionOverlay, type PiToolsHost, type PreviewToken, } from './host';
+export { loadProvisionManifest, parseProvisionManifest, PROVISION_MANIFEST_FILE, type ProvisionManifest, } from './provision-database/manifest';
+export { allModulePresets, DEFAULT_PROVISION_PRESET, getModulePreset, type ModulePreset, type ProvisionModule, } from './provision-database/presets';
+export { moduleKey, type ProvisionOverlay, resolveProvisionModules, } from './provision-database/resolve';
 export { toolSchema } from './tool-schema';
 export { createTemplatePreviewTables } from './tools/templates';
 export default dbTools;

package/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTemplatePreviewTables = exports.toolSchema = exports.getHost = exports.configureHost = exports.resolveProjectContext = exports.resolveDataToken = exports.createConfirmGate = exports.dbTools = void 0;
+exports.createTemplatePreviewTables = exports.toolSchema = exports.resolveProvisionModules = exports.moduleKey = exports.getModulePreset = exports.DEFAULT_PROVISION_PRESET = exports.allModulePresets = exports.PROVISION_MANIFEST_FILE = exports.parseProvisionManifest = exports.loadProvisionManifest = exports.getHost = exports.configureHost = exports.resolveProjectContext = exports.resolveDataToken = exports.createConfirmGate = exports.dbTools = void 0;
 exports.createDbTools = createDbTools;
 const confirm_gate_1 = require("./confirm-gate");
 const context_1 = require("./context");
@@ -53,6 +53,17 @@ Object.defineProperty(exports, "resolveProjectContext", { enumerable: true, get:
 var host_2 = require("./host");
 Object.defineProperty(exports, "configureHost", { enumerable: true, get: function () { return host_2.configureHost; } });
 Object.defineProperty(exports, "getHost", { enumerable: true, get: function () { return host_2.getHost; } });
+var manifest_1 = require("./provision-database/manifest");
+Object.defineProperty(exports, "loadProvisionManifest", { enumerable: true, get: function () { return manifest_1.loadProvisionManifest; } });
+Object.defineProperty(exports, "parseProvisionManifest", { enumerable: true, get: function () { return manifest_1.parseProvisionManifest; } });
+Object.defineProperty(exports, "PROVISION_MANIFEST_FILE", { enumerable: true, get: function () { return manifest_1.PROVISION_MANIFEST_FILE; } });
+var presets_1 = require("./provision-database/presets");
+Object.defineProperty(exports, "allModulePresets", { enumerable: true, get: function () { return presets_1.allModulePresets; } });
+Object.defineProperty(exports, "DEFAULT_PROVISION_PRESET", { enumerable: true, get: function () { return presets_1.DEFAULT_PROVISION_PRESET; } });
+Object.defineProperty(exports, "getModulePreset", { enumerable: true, get: function () { return presets_1.getModulePreset; } });
+var resolve_1 = require("./provision-database/resolve");
+Object.defineProperty(exports, "moduleKey", { enumerable: true, get: function () { return resolve_1.moduleKey; } });
+Object.defineProperty(exports, "resolveProvisionModules", { enumerable: true, get: function () { return resolve_1.resolveProvisionModules; } });
 var tool_schema_1 = require("./tool-schema");
 Object.defineProperty(exports, "toolSchema", { enumerable: true, get: function () { return tool_schema_1.toolSchema; } });
 var templates_2 = require("./tools/templates");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentic-kit/pi",
-  "version": "0.2.1",
+  "version": "0.5.0",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "description": "Pi adapter for agentic-kit — the Constructive typed db tools (provision, blueprint, codegen, records, policies, templates) and confirm gate as a pi coding-agent extension",
   "main": "index.js",
@@ -29,9 +29,10 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@agentic-kit/harness": "^0.3.1",
-    "@constructive-io/graphql-query": "^4.5.5",
-    "@constructive-io/sdk": "^1.5.5",
+    "@agentic-kit/harness": "^0.5.0",
+    "@constructive-io/graphql-query": "^4.8.0",
+    "@constructive-io/sdk": "^1.7.0",
+    "node-type-registry": "^1.7.0",
     "zod": "^4.4.3"
   },
   "peerDependencies": {
@@ -47,5 +48,5 @@
     "coding-agent",
     "constructive"
   ],
-  "gitHead": "6f85eefed51d88b3a857ff36d20da44b7ebb47c9"
+  "gitHead": "3ba26a9dfa342feff5a2216aafea962132d51621"
 }

package/provision-database/create-database-provision.d.ts

@@ -1,4 +1,4 @@
-import type { ProvisionModule } from './modules';
+import type { ProvisionModule } from './presets';
 export declare function createDatabaseProvision(args: {
     endpoint: string;
     bearer: string;

package/provision-database/manifest.d.ts

@@ -0,0 +1,10 @@
+import type { ProvisionOverlay } from './resolve';
+export declare const PROVISION_MANIFEST_FILE = "provision.json";
+export type ProvisionManifest = ProvisionOverlay;
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+export declare function parseProvisionManifest(value: unknown): ProvisionManifest;
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+export declare function loadProvisionManifest(dir: string): Promise<ProvisionManifest | null>;

package/provision-database/manifest.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVISION_MANIFEST_FILE = void 0;
+exports.parseProvisionManifest = parseProvisionManifest;
+exports.loadProvisionManifest = loadProvisionManifest;
+// `provision.json` overlay manifest.
+//
+// A pure-data overlay, distributed the same way skills are: written into a
+// config/app directory (locally, or materialized there from appstash / a pinned
+// git ref) and read at provision time. It NEVER installs or executes a package
+// — the base preset is a pinned build-time dependency; this file only selects a
+// preset and layers add/remove on top.
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const zod_1 = require("zod");
+exports.PROVISION_MANIFEST_FILE = 'provision.json';
+const ModuleSchema = zod_1.z.union([
+    zod_1.z.string(),
+    zod_1.z.tuple([zod_1.z.string(), zod_1.z.record(zod_1.z.string(), zod_1.z.unknown())]),
+]);
+const ProvisionManifestSchema = zod_1.z
+    .object({
+    preset: zod_1.z.string().optional(),
+    add: zod_1.z.array(ModuleSchema).optional(),
+    remove: zod_1.z.array(zod_1.z.string()).optional(),
+})
+    .strict();
+/** Validate an untrusted value as a provision manifest, throwing on bad shape. */
+function parseProvisionManifest(value) {
+    return ProvisionManifestSchema.parse(value);
+}
+/**
+ * Load `<dir>/provision.json` as an overlay, or `null` when absent. A malformed
+ * file throws so a broken overlay is surfaced rather than silently ignored.
+ */
+async function loadProvisionManifest(dir) {
+    const file = node_path_1.default.join(dir, exports.PROVISION_MANIFEST_FILE);
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Invalid ${exports.PROVISION_MANIFEST_FILE} at ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return parseProvisionManifest(parsed);
+}

package/provision-database/presets.d.ts

@@ -0,0 +1,4 @@
+import { allModulePresets, getModulePreset, type ModulePreset } from 'node-type-registry';
+export type ProvisionModule = string | [string, Record<string, unknown>];
+export declare const DEFAULT_PROVISION_PRESET: string;
+export { allModulePresets, getModulePreset, type ModulePreset };

package/provision-database/presets.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getModulePreset = exports.allModulePresets = exports.DEFAULT_PROVISION_PRESET = void 0;
+// Provision module presets — the canonical source of truth.
+//
+// The module list is NEVER hand-copied here. It is imported from the pinned
+// `node-type-registry` package (the same presets the backend and dashboard use),
+// so bumping that dependency is how the base module set moves. Hosts customize
+// on top with an ordered overlay (see `resolve.ts`) rather than editing a list.
+const node_type_registry_1 = require("node-type-registry");
+Object.defineProperty(exports, "allModulePresets", { enumerable: true, get: function () { return node_type_registry_1.allModulePresets; } });
+Object.defineProperty(exports, "getModulePreset", { enumerable: true, get: function () { return node_type_registry_1.getModulePreset; } });
+// Default base preset. `b2b:storage` = the full multi-tenant B2B shape plus file
+// storage, matching Constructive's app shape. Crucially it already includes
+// `config_secrets_module` — the dependency the old hand-copied list dropped,
+// which made the backend reject provisioning with `REQUIRES (config_secrets_module:app)`.
+exports.DEFAULT_PROVISION_PRESET = node_type_registry_1.PresetB2bStorage.name;

package/provision-database/resolve.d.ts

@@ -0,0 +1,27 @@
+import { type ProvisionModule } from './presets';
+export interface ProvisionOverlay {
+    /**
+     * Base preset name to resolve from (e.g. 'b2b:storage', 'full'). The last
+     * layer that sets `preset` wins; if none set it, `DEFAULT_PROVISION_PRESET`
+     * is used.
+     */
+    preset?: string;
+    /**
+     * Modules to add. An entry whose key matches an existing module OVERRIDES it
+     * (e.g. re-declaring `storage_module` with app-specific options); a new key
+     * is appended.
+     */
+    add?: ProvisionModule[];
+    /**
+     * Module names or `name:scope` keys to drop from the base. A bare name
+     * removes every scope of that module; `name:scope` removes just that one.
+     */
+    remove?: string[];
+}
+/** Stable identity for a module entry: `name` or `name:scope` when scoped. */
+export declare function moduleKey(m: ProvisionModule): string;
+/**
+ * Resolve the effective module list from a pinned preset plus ordered overlays.
+ * Pure: no I/O, no host access. Later overlays win (last-write-wins by key).
+ */
+export declare function resolveProvisionModules(layers?: ProvisionOverlay[]): ProvisionModule[];

package/provision-database/resolve.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.moduleKey = moduleKey;
+exports.resolveProvisionModules = resolveProvisionModules;
+// Ordered-overlay resolution for provision modules.
+//
+// Mirrors the skills overlay model (`@agentic-kit/harness` skills manifest): a
+// pinned base (a named preset from `node-type-registry`) is layered under zero
+// or more overlays, later layers winning by module key. An empty overlay list
+// resolves to the base preset unchanged.
+const presets_1 = require("./presets");
+function moduleName(m) {
+    return Array.isArray(m) ? m[0] : m;
+}
+function moduleScope(m) {
+    if (!Array.isArray(m))
+        return undefined;
+    const scope = m[1]?.scope;
+    return typeof scope === 'string' ? scope : undefined;
+}
+/** Stable identity for a module entry: `name` or `name:scope` when scoped. */
+function moduleKey(m) {
+    const scope = moduleScope(m);
+    return scope ? `${moduleName(m)}:${scope}` : moduleName(m);
+}
+/**
+ * Resolve the effective module list from a pinned preset plus ordered overlays.
+ * Pure: no I/O, no host access. Later overlays win (last-write-wins by key).
+ */
+function resolveProvisionModules(layers = []) {
+    const presetName = [...layers].reverse().find((l) => l.preset)?.preset ?? presets_1.DEFAULT_PROVISION_PRESET;
+    const preset = (0, presets_1.getModulePreset)(presetName);
+    if (!preset) {
+        const known = presets_1.allModulePresets.map((p) => p.name).join(', ');
+        throw new Error(`Unknown provision preset "${presetName}". Known presets: ${known}.`);
+    }
+    // Ordered map keyed by module identity preserves position while allowing
+    // overrides (same key) and appends (new key).
+    const resolved = new Map();
+    for (const m of preset.modules)
+        resolved.set(moduleKey(m), m);
+    for (const layer of layers) {
+        for (const target of layer.remove ?? []) {
+            for (const key of [...resolved.keys()]) {
+                if (key === target || key.split(':')[0] === target)
+                    resolved.delete(key);
+            }
+        }
+        for (const m of layer.add ?? [])
+            resolved.set(moduleKey(m), m);
+    }
+    return [...resolved.values()];
+}

package/tools/provision-database.js

@@ -15,8 +15,9 @@ const db_probe_1 = require("../db-probe");
 const create_database_provision_1 = require("../provision-database/create-database-provision");
 const credential_1 = require("../provision-database/credential");
 const env_file_1 = require("../provision-database/env-file");
-const modules_1 = require("../provision-database/modules");
+const manifest_1 = require("../provision-database/manifest");
 const pg_fixups_1 = require("../provision-database/pg-fixups");
+const resolve_1 = require("../provision-database/resolve");
 const DEFAULT_API_ENDPOINT = 'http://api.localhost:3000/graphql';
 const DEFAULT_MODULES_ENDPOINT = 'http://modules.localhost:3000/graphql';
 // The per-DB endpoints are subdomain.<domain>; the provisioning domain is the api
@@ -192,6 +193,24 @@ exports.provisionDatabaseTool = {
             ok: false,
             out: err instanceof Error ? err.message : String(err),
         }));
+        // Resolve the module set: pinned base preset from node-type-registry, then
+        // ordered overlays (host default < project-local provision.json). No list is
+        // hand-copied here; overlays are pure data. A bad preset/manifest fails the
+        // run rather than provisioning a wrong module set.
+        let modules;
+        try {
+            const layers = [];
+            const hostOverlay = await host.provisionOverlay?.();
+            if (hostOverlay)
+                layers.push(hostOverlay);
+            const projectOverlay = await (0, manifest_1.loadProvisionManifest)(ctx.cwd);
+            if (projectOverlay)
+                layers.push(projectOverlay);
+            modules = (0, resolve_1.resolveProvisionModules)(layers);
+        }
+        catch (err) {
+            return fail(`Cannot resolve provision modules: ${err instanceof Error ? err.message : String(err)}`);
+        }
         const physicalDb = process.env.CONSTRUCTIVE_DB || 'constructive';
         // Provision on the MODULES endpoint: createDatabaseProvisionModule creates
         // the database owned by ownerId, provisions the module set, and bootstraps
@@ -206,7 +225,7 @@ exports.provisionDatabaseTool = {
                 databaseName,
                 domain: provisionDomain(apiEndpoint),
                 ownerId,
-                modules: modules_1.DEFAULT_PROVISION_MODULES,
+                modules,
             })));
         }
         catch (err) {

package/esm/provision-database/modules.d.ts

@@ -1,2 +0,0 @@
-export type ProvisionModule = string | [string, Record<string, unknown>];
-export declare const DEFAULT_PROVISION_MODULES: ProvisionModule[];

package/esm/provision-database/modules.js

@@ -1,40 +0,0 @@
-export const DEFAULT_PROVISION_MODULES = [
-    'users_module',
-    'membership_types_module',
-    ['permissions_module', { scope: 'app' }],
-    ['permissions_module', { scope: 'org' }],
-    ['limits_module', { scope: 'app' }],
-    ['limits_module', { scope: 'org' }],
-    ['levels_module', { scope: 'app' }],
-    ['levels_module', { scope: 'org' }],
-    ['memberships_module', { scope: 'app' }],
-    ['memberships_module', { scope: 'org' }],
-    'sessions_module',
-    'user_state_module',
-    'user_credentials_module',
-    ['internal_secrets_module', { scope: 'app' }],
-    'emails_module',
-    'rls_module',
-    'user_auth_module',
-    'session_secrets_module',
-    'rate_limits_module',
-    'connected_accounts_module',
-    ['identity_providers_module', { scope: 'app' }],
-    'webauthn_credentials_module',
-    'webauthn_auth_module',
-    'phone_numbers_module',
-    ['profiles_module', { scope: 'app' }],
-    ['profiles_module', { scope: 'org' }],
-    ['hierarchy_module', { scope: 'org' }],
-    ['invites_module', { scope: 'app' }],
-    ['invites_module', { scope: 'org' }],
-    // Mirrors constructive-client: api_name links storage to the same api-<slug>
-    // endpoint the generated SDK targets (without it uploads fail with "not
-    // enabled for this endpoint"), prefix keeps app_buckets/app_files names off
-    // user tables, and buckets seeds the public bucket row uploads need.
-    [
-        'storage_module',
-        { scope: 'app', api_name: 'api', prefix: 'app', buckets: [{ key: 'public', is_public: true }] },
-    ],
-    'devices_module',
-];

package/provision-database/modules.d.ts

@@ -1,2 +0,0 @@
-export type ProvisionModule = string | [string, Record<string, unknown>];
-export declare const DEFAULT_PROVISION_MODULES: ProvisionModule[];

package/provision-database/modules.js

@@ -1,43 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_PROVISION_MODULES = void 0;
-exports.DEFAULT_PROVISION_MODULES = [
-    'users_module',
-    'membership_types_module',
-    ['permissions_module', { scope: 'app' }],
-    ['permissions_module', { scope: 'org' }],
-    ['limits_module', { scope: 'app' }],
-    ['limits_module', { scope: 'org' }],
-    ['levels_module', { scope: 'app' }],
-    ['levels_module', { scope: 'org' }],
-    ['memberships_module', { scope: 'app' }],
-    ['memberships_module', { scope: 'org' }],
-    'sessions_module',
-    'user_state_module',
-    'user_credentials_module',
-    ['internal_secrets_module', { scope: 'app' }],
-    'emails_module',
-    'rls_module',
-    'user_auth_module',
-    'session_secrets_module',
-    'rate_limits_module',
-    'connected_accounts_module',
-    ['identity_providers_module', { scope: 'app' }],
-    'webauthn_credentials_module',
-    'webauthn_auth_module',
-    'phone_numbers_module',
-    ['profiles_module', { scope: 'app' }],
-    ['profiles_module', { scope: 'org' }],
-    ['hierarchy_module', { scope: 'org' }],
-    ['invites_module', { scope: 'app' }],
-    ['invites_module', { scope: 'org' }],
-    // Mirrors constructive-client: api_name links storage to the same api-<slug>
-    // endpoint the generated SDK targets (without it uploads fail with "not
-    // enabled for this endpoint"), prefix keeps app_buckets/app_files names off
-    // user tables, and buckets seeds the public bucket row uploads need.
-    [
-        'storage_module',
-        { scope: 'app', api_name: 'api', prefix: 'app', buckets: [{ key: 'public', is_public: true }] },
-    ],
-    'devices_module',
-];