@constructive-sdk/cli 0.13.3 → 0.13.4

package/esm/public/cli/commands/{submit-invite-code.js → submit-app-invite-code.js}

@@ -3,7 +3,7 @@ import { unflattenDotNotation, buildSelectFromPaths } from '../utils';
 export default async (argv, prompter, _options) => {
     try {
         if (argv.help || argv.h) {
-            console.log('submit-invite-code - submitInviteCode\n\nUsage: submit-invite-code [OPTIONS]\n');
+            console.log('submit-app-invite-code - submitAppInviteCode\n\nUsage: submit-app-invite-code [OPTIONS]\n');
             process.exit(0);
         }
         const answers = await prompter.prompt(argv, [
@@ -18,14 +18,14 @@ export default async (argv, prompter, _options) => {
         const parsedAnswers = unflattenDotNotation(answers);
         const selectFields = buildSelectFromPaths(argv.select ?? 'clientMutationId');
         const result = await client.mutation
-            .submitInviteCode(parsedAnswers, {
+            .submitAppInviteCode(parsedAnswers, {
             select: selectFields,
         })
             .execute();
         console.log(JSON.stringify(result, null, 2));
     }
     catch (error) {
-        console.error('Failed: submitInviteCode');
+        console.error('Failed: submitAppInviteCode');
         if (error instanceof Error) {
             console.error(error.message);
         }

package/esm/public/cli/commands.js

@@ -92,8 +92,8 @@ import emailCmd from './commands/email';
 import phoneNumberCmd from './commands/phone-number';
 import cryptoAddressCmd from './commands/crypto-address';
 import connectedAccountCmd from './commands/connected-account';
-import inviteCmd from './commands/invite';
-import claimedInviteCmd from './commands/claimed-invite';
+import appInviteCmd from './commands/app-invite';
+import appClaimedInviteCmd from './commands/app-claimed-invite';
 import orgInviteCmd from './commands/org-invite';
 import orgClaimedInviteCmd from './commands/org-claimed-invite';
 import auditLogCmd from './commands/audit-log';
@@ -107,6 +107,7 @@ import orgLimitDefaultCmd from './commands/org-limit-default';
 import membershipTypeCmd from './commands/membership-type';
 import appMembershipDefaultCmd from './commands/app-membership-default';
 import commitCmd from './commands/commit';
+import rateLimitsModuleCmd from './commands/rate-limits-module';
 import orgMembershipDefaultCmd from './commands/org-membership-default';
 import rlsModuleCmd from './commands/rls-module';
 import sqlActionCmd from './commands/sql-action';
@@ -139,7 +140,9 @@ import signOutCmd from './commands/sign-out';
 import acceptDatabaseTransferCmd from './commands/accept-database-transfer';
 import cancelDatabaseTransferCmd from './commands/cancel-database-transfer';
 import rejectDatabaseTransferCmd from './commands/reject-database-transfer';
-import submitInviteCodeCmd from './commands/submit-invite-code';
+import verifyPasswordCmd from './commands/verify-password';
+import verifyTotpCmd from './commands/verify-totp';
+import submitAppInviteCodeCmd from './commands/submit-app-invite-code';
 import submitOrgInviteCodeCmd from './commands/submit-org-invite-code';
 import checkPasswordCmd from './commands/check-password';
 import confirmDeleteAccountCmd from './commands/confirm-delete-account';
@@ -173,8 +176,6 @@ import oneTimeTokenCmd from './commands/one-time-token';
 import provisionTableCmd from './commands/provision-table';
 import sendVerificationEmailCmd from './commands/send-verification-email';
 import forgotPasswordCmd from './commands/forgot-password';
-import verifyPasswordCmd from './commands/verify-password';
-import verifyTotpCmd from './commands/verify-totp';
 import requestUploadUrlCmd from './commands/request-upload-url';
 import confirmUploadCmd from './commands/confirm-upload';
 import provisionBucketCmd from './commands/provision-bucket';
@@ -267,8 +268,8 @@ const createCommandMap = () => ({
     'phone-number': phoneNumberCmd,
     'crypto-address': cryptoAddressCmd,
     'connected-account': connectedAccountCmd,
-    invite: inviteCmd,
-    'claimed-invite': claimedInviteCmd,
+    'app-invite': appInviteCmd,
+    'app-claimed-invite': appClaimedInviteCmd,
     'org-invite': orgInviteCmd,
     'org-claimed-invite': orgClaimedInviteCmd,
     'audit-log': auditLogCmd,
@@ -282,6 +283,7 @@ const createCommandMap = () => ({
     'membership-type': membershipTypeCmd,
     'app-membership-default': appMembershipDefaultCmd,
     commit: commitCmd,
+    'rate-limits-module': rateLimitsModuleCmd,
     'org-membership-default': orgMembershipDefaultCmd,
     'rls-module': rlsModuleCmd,
     'sql-action': sqlActionCmd,
@@ -314,7 +316,9 @@ const createCommandMap = () => ({
     'accept-database-transfer': acceptDatabaseTransferCmd,
     'cancel-database-transfer': cancelDatabaseTransferCmd,
     'reject-database-transfer': rejectDatabaseTransferCmd,
-    'submit-invite-code': submitInviteCodeCmd,
+    'verify-password': verifyPasswordCmd,
+    'verify-totp': verifyTotpCmd,
+    'submit-app-invite-code': submitAppInviteCodeCmd,
     'submit-org-invite-code': submitOrgInviteCodeCmd,
     'check-password': checkPasswordCmd,
     'confirm-delete-account': confirmDeleteAccountCmd,
@@ -348,13 +352,11 @@ const createCommandMap = () => ({
     'provision-table': provisionTableCmd,
     'send-verification-email': sendVerificationEmailCmd,
     'forgot-password': forgotPasswordCmd,
-    'verify-password': verifyPasswordCmd,
-    'verify-totp': verifyTotpCmd,
     'request-upload-url': requestUploadUrlCmd,
     'confirm-upload': confirmUploadCmd,
     'provision-bucket': provisionBucketCmd,
 });
-const usage = "\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  org-get-managers-record orgGetManagersRecord CRUD operations\n  org-get-subordinates-record orgGetSubordinatesRecord CRUD operations\n  get-all-record       getAllRecord CRUD operations\n  object               object CRUD operations\n  app-permission       appPermission CRUD operations\n  org-permission       orgPermission CRUD operations\n  app-level-requirement appLevelRequirement CRUD operations\n  database             database CRUD operations\n  schema               schema CRUD operations\n  table                table CRUD operations\n  check-constraint     checkConstraint CRUD operations\n  field                field CRUD operations\n  foreign-key-constraint foreignKeyConstraint CRUD operations\n  full-text-search     fullTextSearch CRUD operations\n  index                index CRUD operations\n  policy               policy CRUD operations\n  primary-key-constraint primaryKeyConstraint CRUD operations\n  table-grant          tableGrant CRUD operations\n  trigger              trigger CRUD operations\n  unique-constraint    uniqueConstraint CRUD operations\n  view                 view CRUD operations\n  view-table           viewTable CRUD operations\n  view-grant           viewGrant CRUD operations\n  view-rule            viewRule CRUD operations\n  embedding-chunk      embeddingChunk CRUD operations\n  table-template-module tableTemplateModule CRUD operations\n  secure-table-provision secureTableProvision CRUD operations\n  relation-provision   relationProvision CRUD operations\n  schema-grant         schemaGrant CRUD operations\n  default-privilege    defaultPrivilege CRUD operations\n  enum                 enum CRUD operations\n  api-schema           apiSchema CRUD operations\n  api-module           apiModule CRUD operations\n  domain               domain CRUD operations\n  site-metadatum       siteMetadatum CRUD operations\n  site-module          siteModule CRUD operations\n  site-theme           siteTheme CRUD operations\n  trigger-function     triggerFunction CRUD operations\n  database-transfer    databaseTransfer CRUD operations\n  api                  api CRUD operations\n  site                 site CRUD operations\n  app                  app CRUD operations\n  connected-accounts-module connectedAccountsModule CRUD operations\n  crypto-addresses-module cryptoAddressesModule CRUD operations\n  crypto-auth-module   cryptoAuthModule CRUD operations\n  default-ids-module   defaultIdsModule CRUD operations\n  denormalized-table-field denormalizedTableField CRUD operations\n  emails-module        emailsModule CRUD operations\n  encrypted-secrets-module encryptedSecretsModule CRUD operations\n  invites-module       invitesModule CRUD operations\n  levels-module        levelsModule CRUD operations\n  limits-module        limitsModule CRUD operations\n  membership-types-module membershipTypesModule CRUD operations\n  memberships-module   membershipsModule CRUD operations\n  permissions-module   permissionsModule CRUD operations\n  phone-numbers-module phoneNumbersModule CRUD operations\n  profiles-module      profilesModule CRUD operations\n  secrets-module       secretsModule CRUD operations\n  sessions-module      sessionsModule CRUD operations\n  user-auth-module     userAuthModule CRUD operations\n  users-module         usersModule CRUD operations\n  blueprint            blueprint CRUD operations\n  blueprint-template   blueprintTemplate CRUD operations\n  blueprint-construction blueprintConstruction CRUD operations\n  storage-module       storageModule CRUD operations\n  database-provision-module databaseProvisionModule CRUD operations\n  app-admin-grant      appAdminGrant CRUD operations\n  app-owner-grant      appOwnerGrant CRUD operations\n  app-grant            appGrant CRUD operations\n  org-membership       orgMembership CRUD operations\n  org-member           orgMember CRUD operations\n  org-admin-grant      orgAdminGrant CRUD operations\n  org-owner-grant      orgOwnerGrant CRUD operations\n  org-grant            orgGrant CRUD operations\n  org-chart-edge       orgChartEdge CRUD operations\n  org-chart-edge-grant orgChartEdgeGrant CRUD operations\n  org-permission-default orgPermissionDefault CRUD operations\n  app-limit            appLimit CRUD operations\n  org-limit            orgLimit CRUD operations\n  app-step             appStep CRUD operations\n  app-achievement      appAchievement CRUD operations\n  app-level            appLevel CRUD operations\n  email                email CRUD operations\n  phone-number         phoneNumber CRUD operations\n  crypto-address       cryptoAddress CRUD operations\n  connected-account    connectedAccount CRUD operations\n  invite               invite CRUD operations\n  claimed-invite       claimedInvite CRUD operations\n  org-invite           orgInvite CRUD operations\n  org-claimed-invite   orgClaimedInvite CRUD operations\n  audit-log            auditLog CRUD operations\n  app-permission-default appPermissionDefault CRUD operations\n  ref                  ref CRUD operations\n  store                store CRUD operations\n  role-type            roleType CRUD operations\n  migrate-file         migrateFile CRUD operations\n  app-limit-default    appLimitDefault CRUD operations\n  org-limit-default    orgLimitDefault CRUD operations\n  membership-type      membershipType CRUD operations\n  app-membership-default appMembershipDefault CRUD operations\n  commit               commit CRUD operations\n  org-membership-default orgMembershipDefault CRUD operations\n  rls-module           rlsModule CRUD operations\n  sql-action           sqlAction CRUD operations\n  user                 user CRUD operations\n  ast-migration        astMigration CRUD operations\n  app-membership       appMembership CRUD operations\n  hierarchy-module     hierarchyModule CRUD operations\n  current-user-id      currentUserId\n  current-ip-address   currentIpAddress\n  current-user-agent   currentUserAgent\n  app-permissions-get-padded-mask appPermissionsGetPaddedMask\n  org-permissions-get-padded-mask orgPermissionsGetPaddedMask\n  steps-achieved       stepsAchieved\n  rev-parse            revParse\n  org-is-manager-of    orgIsManagerOf\n  app-permissions-get-mask appPermissionsGetMask\n  org-permissions-get-mask orgPermissionsGetMask\n  resolve-blueprint-table Resolves a table_name (with optional schema_name) to a table_id. Resolution order: (1) if schema_name provided, exact lookup via metaschema_public.schema.name + metaschema_public.table; (2) check local table_map (tables created in current blueprint); (3) search metaschema_public.table by name across all schemas; (4) if multiple matches, throw ambiguous error asking for schema_name; (5) if no match, throw not-found error.\n  app-permissions-get-mask-by-names appPermissionsGetMaskByNames\n  org-permissions-get-mask-by-names orgPermissionsGetMaskByNames\n  get-all-objects-from-root Reads and enables pagination through a set of `Object`.\n  get-path-objects-from-root Reads and enables pagination through a set of `Object`.\n  get-object-at-path   getObjectAtPath\n  app-permissions-get-by-mask Reads and enables pagination through a set of `AppPermission`.\n  org-permissions-get-by-mask Reads and enables pagination through a set of `OrgPermission`.\n  steps-required       Reads and enables pagination through a set of `AppLevelRequirement`.\n  current-user         currentUser\n  send-account-deletion-email sendAccountDeletionEmail\n  sign-out             signOut\n  accept-database-transfer acceptDatabaseTransfer\n  cancel-database-transfer cancelDatabaseTransfer\n  reject-database-transfer rejectDatabaseTransfer\n  submit-invite-code   submitInviteCode\n  submit-org-invite-code submitOrgInviteCode\n  check-password       checkPassword\n  confirm-delete-account confirmDeleteAccount\n  set-password         setPassword\n  verify-email         verifyEmail\n  freeze-objects       freezeObjects\n  init-empty-repo      initEmptyRepo\n  construct-blueprint  Executes a blueprint definition by delegating to provision_* procedures. Creates a blueprint_construction record to track the attempt. Five phases: (1) provision_table() for each table with nodes[], fields[], policies[], and grants (table-level indexes/fts/unique_constraints are deferred), (2) provision_relation() for each relation, (3) provision_index() for top-level + deferred indexes, (4) provision_full_text_search() for top-level + deferred FTS, (5) provision_unique_constraint() for top-level + deferred unique constraints. Table-level indexes/fts/unique_constraints are deferred to phases 3-5 so they can reference columns created by relations in phase 2. Tables are identified by table_name with optional per-table schema_name. Relations use $type for relation_type with source_table/target_table. Returns the construction record ID on success, NULL on failure.\n  reset-password       resetPassword\n  remove-node-at-path  removeNodeAtPath\n  copy-template-to-blueprint Creates a new blueprint by copying a template definition. Checks visibility: owners can always copy their own templates, others require public visibility. Increments the template copy_count. Returns the new blueprint ID.\n  bootstrap-user       bootstrapUser\n  set-field-order      setFieldOrder\n  provision-unique-constraint Creates a unique constraint on a table. Accepts a jsonb definition with columns (array of field names). Graceful: skips if the exact same unique constraint already exists.\n  provision-full-text-search Creates a full-text search configuration on a table. Accepts a jsonb definition with field (tsvector column name) and sources (array of {field, weight, lang}). Graceful: skips if FTS config already exists for the same (table_id, field_id). Returns the fts_id.\n  provision-index      Creates an index on a table. Accepts a jsonb definition with columns (array of names or single column string), access_method (default BTREE), is_unique, op_classes, options, and name (auto-generated if omitted). Graceful: skips if an index with the same (table_id, field_ids, access_method) already exists. Returns the index_id.\n  set-data-at-path     setDataAtPath\n  set-props-and-commit setPropsAndCommit\n  provision-database-with-user provisionDatabaseWithUser\n  insert-node-at-path  insertNodeAtPath\n  update-node-at-path  updateNodeAtPath\n  set-and-commit       setAndCommit\n  provision-relation   Composable relation provisioning: creates FK fields, indexes, unique constraints, and junction tables depending on the relation_type. Supports RelationBelongsTo, RelationHasOne, RelationHasMany, and RelationManyToMany. ManyToMany uses provision_table() internally for junction table creation with full node/grant/policy support. All operations are graceful (skip existing). Returns (out_field_id, out_junction_table_id, out_source_field_id, out_target_field_id).\n  apply-rls            applyRls\n  sign-in-one-time-token signInOneTimeToken\n  create-user-database Creates a new user database with all required modules, permissions, and RLS policies.\n\nParameters:\n  - database_name: Name for the new database (required)\n  - owner_id: UUID of the owner user (required)\n  - include_invites: Include invite system (default: true)\n  - include_groups: Include group-level memberships (default: false)\n  - include_levels: Include levels/achievements (default: false)\n  - bitlen: Bit length for permission masks (default: 64)\n  - tokens_expiration: Token expiration interval (default: 30 days)\n\nReturns the database_id UUID of the newly created database.\n\nExample usage:\n  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid);\n  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid, true, true);  -- with invites and groups\n\n  extend-token-expires extendTokenExpires\n  sign-in              signIn\n  sign-up              signUp\n  one-time-token       oneTimeToken\n  provision-table      Composable table provisioning: creates or finds a table, then creates fields (so Data* modules can reference them), applies N nodes (Data* modules), enables RLS, creates grants, creates N policies, and optionally creates table-level indexes/full_text_searches/unique_constraints. All operations are graceful (skip existing). Accepts multiple nodes and multiple policies per call, unlike secure_table_provision which is limited to one of each. Returns (out_table_id, out_fields).\n  send-verification-email sendVerificationEmail\n  forgot-password      forgotPassword\n  verify-password      verifyPassword\n  verify-totp          verifyTotp\n  request-upload-url   Request a presigned URL for uploading a file directly to S3.\nClient computes SHA-256 of the file content and provides it here.\nIf a file with the same hash already exists (dedup), returns the\nexisting file ID and deduplicated=true with no uploadUrl.\n  confirm-upload       Confirm that a file has been uploaded to S3.\nVerifies the object exists in S3, checks content-type,\nand transitions the file status from 'pending' to 'ready'.\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n";
+const usage = "\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  org-get-managers-record orgGetManagersRecord CRUD operations\n  org-get-subordinates-record orgGetSubordinatesRecord CRUD operations\n  get-all-record       getAllRecord CRUD operations\n  object               object CRUD operations\n  app-permission       appPermission CRUD operations\n  org-permission       orgPermission CRUD operations\n  app-level-requirement appLevelRequirement CRUD operations\n  database             database CRUD operations\n  schema               schema CRUD operations\n  table                table CRUD operations\n  check-constraint     checkConstraint CRUD operations\n  field                field CRUD operations\n  foreign-key-constraint foreignKeyConstraint CRUD operations\n  full-text-search     fullTextSearch CRUD operations\n  index                index CRUD operations\n  policy               policy CRUD operations\n  primary-key-constraint primaryKeyConstraint CRUD operations\n  table-grant          tableGrant CRUD operations\n  trigger              trigger CRUD operations\n  unique-constraint    uniqueConstraint CRUD operations\n  view                 view CRUD operations\n  view-table           viewTable CRUD operations\n  view-grant           viewGrant CRUD operations\n  view-rule            viewRule CRUD operations\n  embedding-chunk      embeddingChunk CRUD operations\n  table-template-module tableTemplateModule CRUD operations\n  secure-table-provision secureTableProvision CRUD operations\n  relation-provision   relationProvision CRUD operations\n  schema-grant         schemaGrant CRUD operations\n  default-privilege    defaultPrivilege CRUD operations\n  enum                 enum CRUD operations\n  api-schema           apiSchema CRUD operations\n  api-module           apiModule CRUD operations\n  domain               domain CRUD operations\n  site-metadatum       siteMetadatum CRUD operations\n  site-module          siteModule CRUD operations\n  site-theme           siteTheme CRUD operations\n  trigger-function     triggerFunction CRUD operations\n  database-transfer    databaseTransfer CRUD operations\n  api                  api CRUD operations\n  site                 site CRUD operations\n  app                  app CRUD operations\n  connected-accounts-module connectedAccountsModule CRUD operations\n  crypto-addresses-module cryptoAddressesModule CRUD operations\n  crypto-auth-module   cryptoAuthModule CRUD operations\n  default-ids-module   defaultIdsModule CRUD operations\n  denormalized-table-field denormalizedTableField CRUD operations\n  emails-module        emailsModule CRUD operations\n  encrypted-secrets-module encryptedSecretsModule CRUD operations\n  invites-module       invitesModule CRUD operations\n  levels-module        levelsModule CRUD operations\n  limits-module        limitsModule CRUD operations\n  membership-types-module membershipTypesModule CRUD operations\n  memberships-module   membershipsModule CRUD operations\n  permissions-module   permissionsModule CRUD operations\n  phone-numbers-module phoneNumbersModule CRUD operations\n  profiles-module      profilesModule CRUD operations\n  secrets-module       secretsModule CRUD operations\n  sessions-module      sessionsModule CRUD operations\n  user-auth-module     userAuthModule CRUD operations\n  users-module         usersModule CRUD operations\n  blueprint            blueprint CRUD operations\n  blueprint-template   blueprintTemplate CRUD operations\n  blueprint-construction blueprintConstruction CRUD operations\n  storage-module       storageModule CRUD operations\n  database-provision-module databaseProvisionModule CRUD operations\n  app-admin-grant      appAdminGrant CRUD operations\n  app-owner-grant      appOwnerGrant CRUD operations\n  app-grant            appGrant CRUD operations\n  org-membership       orgMembership CRUD operations\n  org-member           orgMember CRUD operations\n  org-admin-grant      orgAdminGrant CRUD operations\n  org-owner-grant      orgOwnerGrant CRUD operations\n  org-grant            orgGrant CRUD operations\n  org-chart-edge       orgChartEdge CRUD operations\n  org-chart-edge-grant orgChartEdgeGrant CRUD operations\n  org-permission-default orgPermissionDefault CRUD operations\n  app-limit            appLimit CRUD operations\n  org-limit            orgLimit CRUD operations\n  app-step             appStep CRUD operations\n  app-achievement      appAchievement CRUD operations\n  app-level            appLevel CRUD operations\n  email                email CRUD operations\n  phone-number         phoneNumber CRUD operations\n  crypto-address       cryptoAddress CRUD operations\n  connected-account    connectedAccount CRUD operations\n  app-invite           appInvite CRUD operations\n  app-claimed-invite   appClaimedInvite CRUD operations\n  org-invite           orgInvite CRUD operations\n  org-claimed-invite   orgClaimedInvite CRUD operations\n  audit-log            auditLog CRUD operations\n  app-permission-default appPermissionDefault CRUD operations\n  ref                  ref CRUD operations\n  store                store CRUD operations\n  role-type            roleType CRUD operations\n  migrate-file         migrateFile CRUD operations\n  app-limit-default    appLimitDefault CRUD operations\n  org-limit-default    orgLimitDefault CRUD operations\n  membership-type      membershipType CRUD operations\n  app-membership-default appMembershipDefault CRUD operations\n  commit               commit CRUD operations\n  rate-limits-module   rateLimitsModule CRUD operations\n  org-membership-default orgMembershipDefault CRUD operations\n  rls-module           rlsModule CRUD operations\n  sql-action           sqlAction CRUD operations\n  user                 user CRUD operations\n  ast-migration        astMigration CRUD operations\n  app-membership       appMembership CRUD operations\n  hierarchy-module     hierarchyModule CRUD operations\n  current-user-id      currentUserId\n  current-ip-address   currentIpAddress\n  current-user-agent   currentUserAgent\n  app-permissions-get-padded-mask appPermissionsGetPaddedMask\n  org-permissions-get-padded-mask orgPermissionsGetPaddedMask\n  steps-achieved       stepsAchieved\n  rev-parse            revParse\n  org-is-manager-of    orgIsManagerOf\n  app-permissions-get-mask appPermissionsGetMask\n  org-permissions-get-mask orgPermissionsGetMask\n  resolve-blueprint-table Resolves a table_name (with optional schema_name) to a table_id. Resolution order: (1) if schema_name provided, exact lookup via metaschema_public.schema.name + metaschema_public.table; (2) check local table_map (tables created in current blueprint); (3) search metaschema_public.table by name across all schemas; (4) if multiple matches, throw ambiguous error asking for schema_name; (5) if no match, throw not-found error.\n  app-permissions-get-mask-by-names appPermissionsGetMaskByNames\n  org-permissions-get-mask-by-names orgPermissionsGetMaskByNames\n  get-all-objects-from-root Reads and enables pagination through a set of `Object`.\n  get-path-objects-from-root Reads and enables pagination through a set of `Object`.\n  get-object-at-path   getObjectAtPath\n  app-permissions-get-by-mask Reads and enables pagination through a set of `AppPermission`.\n  org-permissions-get-by-mask Reads and enables pagination through a set of `OrgPermission`.\n  steps-required       Reads and enables pagination through a set of `AppLevelRequirement`.\n  current-user         currentUser\n  send-account-deletion-email sendAccountDeletionEmail\n  sign-out             signOut\n  accept-database-transfer acceptDatabaseTransfer\n  cancel-database-transfer cancelDatabaseTransfer\n  reject-database-transfer rejectDatabaseTransfer\n  verify-password      verifyPassword\n  verify-totp          verifyTotp\n  submit-app-invite-code submitAppInviteCode\n  submit-org-invite-code submitOrgInviteCode\n  check-password       checkPassword\n  confirm-delete-account confirmDeleteAccount\n  set-password         setPassword\n  verify-email         verifyEmail\n  freeze-objects       freezeObjects\n  init-empty-repo      initEmptyRepo\n  construct-blueprint  Executes a blueprint definition by delegating to provision_* procedures. Creates a blueprint_construction record to track the attempt. Five phases: (1) provision_table() for each table with nodes[], fields[], policies[], and grants (table-level indexes/fts/unique_constraints are deferred), (2) provision_relation() for each relation, (3) provision_index() for top-level + deferred indexes, (4) provision_full_text_search() for top-level + deferred FTS, (5) provision_unique_constraint() for top-level + deferred unique constraints. Table-level indexes/fts/unique_constraints are deferred to phases 3-5 so they can reference columns created by relations in phase 2. Tables are identified by table_name with optional per-table schema_name. Relations use $type for relation_type with source_table/target_table. Returns the construction record ID on success, NULL on failure.\n  reset-password       resetPassword\n  remove-node-at-path  removeNodeAtPath\n  copy-template-to-blueprint Creates a new blueprint by copying a template definition. Checks visibility: owners can always copy their own templates, others require public visibility. Increments the template copy_count. Returns the new blueprint ID.\n  bootstrap-user       bootstrapUser\n  set-field-order      setFieldOrder\n  provision-unique-constraint Creates a unique constraint on a table. Accepts a jsonb definition with columns (array of field names). Graceful: skips if the exact same unique constraint already exists.\n  provision-full-text-search Creates a full-text search configuration on a table. Accepts a jsonb definition with field (tsvector column name) and sources (array of {field, weight, lang}). Graceful: skips if FTS config already exists for the same (table_id, field_id). Returns the fts_id.\n  provision-index      Creates an index on a table. Accepts a jsonb definition with columns (array of names or single column string), access_method (default BTREE), is_unique, op_classes, options, and name (auto-generated if omitted). Graceful: skips if an index with the same (table_id, field_ids, access_method) already exists. Returns the index_id.\n  set-data-at-path     setDataAtPath\n  set-props-and-commit setPropsAndCommit\n  provision-database-with-user provisionDatabaseWithUser\n  insert-node-at-path  insertNodeAtPath\n  update-node-at-path  updateNodeAtPath\n  set-and-commit       setAndCommit\n  provision-relation   Composable relation provisioning: creates FK fields, indexes, unique constraints, and junction tables depending on the relation_type. Supports RelationBelongsTo, RelationHasOne, RelationHasMany, and RelationManyToMany. ManyToMany uses provision_table() internally for junction table creation with full node/grant/policy support. All operations are graceful (skip existing). Returns (out_field_id, out_junction_table_id, out_source_field_id, out_target_field_id).\n  apply-rls            applyRls\n  sign-in-one-time-token signInOneTimeToken\n  create-user-database Creates a new user database with all required modules, permissions, and RLS policies.\n\nParameters:\n  - database_name: Name for the new database (required)\n  - owner_id: UUID of the owner user (required)\n  - include_invites: Include invite system (default: true)\n  - include_groups: Include group-level memberships (default: false)\n  - include_levels: Include levels/achievements (default: false)\n  - bitlen: Bit length for permission masks (default: 64)\n  - tokens_expiration: Token expiration interval (default: 30 days)\n\nReturns the database_id UUID of the newly created database.\n\nExample usage:\n  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid);\n  SELECT metaschema_public.create_user_database('my_app', 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'::uuid, true, true);  -- with invites and groups\n\n  extend-token-expires extendTokenExpires\n  sign-in              signIn\n  sign-up              signUp\n  one-time-token       oneTimeToken\n  provision-table      Composable table provisioning: creates or finds a table, then creates fields (so Data* modules can reference them), applies N nodes (Data* modules), enables RLS, creates grants, creates N policies, and optionally creates table-level indexes/full_text_searches/unique_constraints. All operations are graceful (skip existing). Accepts multiple nodes and multiple policies per call, unlike secure_table_provision which is limited to one of each. Returns (out_table_id, out_fields).\n  send-verification-email sendVerificationEmail\n  forgot-password      forgotPassword\n  request-upload-url   Request a presigned URL for uploading a file directly to S3.\nClient computes SHA-256 of the file content and provides it here.\nIf a file with the same hash already exists (dedup), returns the\nexisting file ID and deduplicated=true with no uploadUrl.\n  confirm-upload       Confirm that a file has been uploaded to S3.\nVerifies the object exists in S3, checks content-type,\nand transitions the file status from 'pending' to 'ready'.\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n";
 export const commands = async (argv, prompter, options) => {
     if (argv.help || argv.h) {
         console.log(usage);

package/esm/public/cli/executor.d.ts

@@ -86,8 +86,8 @@ export declare function getClient(contextName?: string): {
     phoneNumber: import("..").PhoneNumberModel;
     cryptoAddress: import("..").CryptoAddressModel;
     connectedAccount: import("..").ConnectedAccountModel;
-    invite: import("..").InviteModel;
-    claimedInvite: import("..").ClaimedInviteModel;
+    appInvite: import("..").AppInviteModel;
+    appClaimedInvite: import("..").AppClaimedInviteModel;
     orgInvite: import("..").OrgInviteModel;
     orgClaimedInvite: import("..").OrgClaimedInviteModel;
     auditLog: import("..").AuditLogModel;
@@ -101,6 +101,7 @@ export declare function getClient(contextName?: string): {
     membershipType: import("..").MembershipTypeModel;
     appMembershipDefault: import("..").AppMembershipDefaultModel;
     commit: import("..").CommitModel;
+    rateLimitsModule: import("..").RateLimitsModuleModel;
     orgMembershipDefault: import("..").OrgMembershipDefaultModel;
     rlsModule: import("..").RlsModuleModel;
     sqlAction: import("..").SqlActionModel;
@@ -236,10 +237,20 @@ export declare function getClient(contextName?: string): {
         } & import("..").StrictSelect<S, import("../orm/input-types").RejectDatabaseTransferPayloadSelect>) => import("..").QueryBuilder<{
             rejectDatabaseTransfer: import("..").InferSelectResult<import("../orm/input-types").RejectDatabaseTransferPayload, S> | null;
         }>;
-        submitInviteCode: <S extends import("../orm/input-types").SubmitInviteCodePayloadSelect>(args: import("../orm/mutation").SubmitInviteCodeVariables, options: {
+        verifyPassword: <S extends import("../orm/input-types").VerifyPasswordPayloadSelect>(args: import("../orm/mutation").VerifyPasswordVariables, options: {
+            select: S;
+        } & import("..").StrictSelect<S, import("../orm/input-types").VerifyPasswordPayloadSelect>) => import("..").QueryBuilder<{
+            verifyPassword: import("..").InferSelectResult<import("../orm/input-types").VerifyPasswordPayload, S> | null;
+        }>;
+        verifyTotp: <S extends import("../orm/input-types").VerifyTotpPayloadSelect>(args: import("../orm/mutation").VerifyTotpVariables, options: {
+            select: S;
+        } & import("..").StrictSelect<S, import("../orm/input-types").VerifyTotpPayloadSelect>) => import("..").QueryBuilder<{
+            verifyTotp: import("..").InferSelectResult<import("../orm/input-types").VerifyTotpPayload, S> | null;
+        }>;
+        submitAppInviteCode: <S extends import("../orm/input-types").SubmitAppInviteCodePayloadSelect>(args: import("../orm/mutation").SubmitAppInviteCodeVariables, options: {
             select: S;
-        } & import("..").StrictSelect<S, import("../orm/input-types").SubmitInviteCodePayloadSelect>) => import("..").QueryBuilder<{
-            submitInviteCode: import("..").InferSelectResult<import("../orm/input-types").SubmitInviteCodePayload, S> | null;
+        } & import("..").StrictSelect<S, import("../orm/input-types").SubmitAppInviteCodePayloadSelect>) => import("..").QueryBuilder<{
+            submitAppInviteCode: import("..").InferSelectResult<import("../orm/input-types").SubmitAppInviteCodePayload, S> | null;
         }>;
         submitOrgInviteCode: <S extends import("../orm/input-types").SubmitOrgInviteCodePayloadSelect>(args: import("../orm/mutation").SubmitOrgInviteCodeVariables, options: {
             select: S;
@@ -406,16 +417,6 @@ export declare function getClient(contextName?: string): {
         } & import("..").StrictSelect<S, import("../orm/input-types").ForgotPasswordPayloadSelect>) => import("..").QueryBuilder<{
             forgotPassword: import("..").InferSelectResult<import("../orm/input-types").ForgotPasswordPayload, S> | null;
         }>;
-        verifyPassword: <S extends import("../orm/input-types").VerifyPasswordPayloadSelect>(args: import("../orm/mutation").VerifyPasswordVariables, options: {
-            select: S;
-        } & import("..").StrictSelect<S, import("../orm/input-types").VerifyPasswordPayloadSelect>) => import("..").QueryBuilder<{
-            verifyPassword: import("..").InferSelectResult<import("../orm/input-types").VerifyPasswordPayload, S> | null;
-        }>;
-        verifyTotp: <S extends import("../orm/input-types").VerifyTotpPayloadSelect>(args: import("../orm/mutation").VerifyTotpVariables, options: {
-            select: S;
-        } & import("..").StrictSelect<S, import("../orm/input-types").VerifyTotpPayloadSelect>) => import("..").QueryBuilder<{
-            verifyTotp: import("..").InferSelectResult<import("../orm/input-types").VerifyTotpPayload, S> | null;
-        }>;
         requestUploadUrl: <S extends import("../orm/input-types").RequestUploadUrlPayloadSelect>(args: import("../orm/mutation").RequestUploadUrlVariables, options: {
             select: S;
         } & import("..").StrictSelect<S, import("../orm/input-types").RequestUploadUrlPayloadSelect>) => import("..").QueryBuilder<{

package/esm/public/orm/index.d.ts

@@ -85,8 +85,8 @@ import { EmailModel } from './models/email';
 import { PhoneNumberModel } from './models/phoneNumber';
 import { CryptoAddressModel } from './models/cryptoAddress';
 import { ConnectedAccountModel } from './models/connectedAccount';
-import { InviteModel } from './models/invite';
-import { ClaimedInviteModel } from './models/claimedInvite';
+import { AppInviteModel } from './models/appInvite';
+import { AppClaimedInviteModel } from './models/appClaimedInvite';
 import { OrgInviteModel } from './models/orgInvite';
 import { OrgClaimedInviteModel } from './models/orgClaimedInvite';
 import { AuditLogModel } from './models/auditLog';
@@ -100,6 +100,7 @@ import { OrgLimitDefaultModel } from './models/orgLimitDefault';
 import { MembershipTypeModel } from './models/membershipType';
 import { AppMembershipDefaultModel } from './models/appMembershipDefault';
 import { CommitModel } from './models/commit';
+import { RateLimitsModuleModel } from './models/rateLimitsModule';
 import { OrgMembershipDefaultModel } from './models/orgMembershipDefault';
 import { RlsModuleModel } from './models/rlsModule';
 import { SqlActionModel } from './models/sqlAction';
@@ -225,8 +226,8 @@ export declare function createClient(config: OrmClientConfig): {
     phoneNumber: PhoneNumberModel;
     cryptoAddress: CryptoAddressModel;
     connectedAccount: ConnectedAccountModel;
-    invite: InviteModel;
-    claimedInvite: ClaimedInviteModel;
+    appInvite: AppInviteModel;
+    appClaimedInvite: AppClaimedInviteModel;
     orgInvite: OrgInviteModel;
     orgClaimedInvite: OrgClaimedInviteModel;
     auditLog: AuditLogModel;
@@ -240,6 +241,7 @@ export declare function createClient(config: OrmClientConfig): {
     membershipType: MembershipTypeModel;
     appMembershipDefault: AppMembershipDefaultModel;
     commit: CommitModel;
+    rateLimitsModule: RateLimitsModuleModel;
     orgMembershipDefault: OrgMembershipDefaultModel;
     rlsModule: RlsModuleModel;
     sqlAction: SqlActionModel;
@@ -375,10 +377,20 @@ export declare function createClient(config: OrmClientConfig): {
         } & import("./select-types").StrictSelect<S, import("./input-types").RejectDatabaseTransferPayloadSelect>) => import("./query-builder").QueryBuilder<{
             rejectDatabaseTransfer: import("./select-types").InferSelectResult<import("./input-types").RejectDatabaseTransferPayload, S> | null;
         }>;
-        submitInviteCode: <S extends import("./input-types").SubmitInviteCodePayloadSelect>(args: import("./mutation").SubmitInviteCodeVariables, options: {
+        verifyPassword: <S extends import("./input-types").VerifyPasswordPayloadSelect>(args: import("./mutation").VerifyPasswordVariables, options: {
+            select: S;
+        } & import("./select-types").StrictSelect<S, import("./input-types").VerifyPasswordPayloadSelect>) => import("./query-builder").QueryBuilder<{
+            verifyPassword: import("./select-types").InferSelectResult<import("./input-types").VerifyPasswordPayload, S> | null;
+        }>;
+        verifyTotp: <S extends import("./input-types").VerifyTotpPayloadSelect>(args: import("./mutation").VerifyTotpVariables, options: {
+            select: S;
+        } & import("./select-types").StrictSelect<S, import("./input-types").VerifyTotpPayloadSelect>) => import("./query-builder").QueryBuilder<{
+            verifyTotp: import("./select-types").InferSelectResult<import("./input-types").VerifyTotpPayload, S> | null;
+        }>;
+        submitAppInviteCode: <S extends import("./input-types").SubmitAppInviteCodePayloadSelect>(args: import("./mutation").SubmitAppInviteCodeVariables, options: {
             select: S;
-        } & import("./select-types").StrictSelect<S, import("./input-types").SubmitInviteCodePayloadSelect>) => import("./query-builder").QueryBuilder<{
-            submitInviteCode: import("./select-types").InferSelectResult<import("./input-types").SubmitInviteCodePayload, S> | null;
+        } & import("./select-types").StrictSelect<S, import("./input-types").SubmitAppInviteCodePayloadSelect>) => import("./query-builder").QueryBuilder<{
+            submitAppInviteCode: import("./select-types").InferSelectResult<import("./input-types").SubmitAppInviteCodePayload, S> | null;
         }>;
         submitOrgInviteCode: <S extends import("./input-types").SubmitOrgInviteCodePayloadSelect>(args: import("./mutation").SubmitOrgInviteCodeVariables, options: {
             select: S;
@@ -545,16 +557,6 @@ export declare function createClient(config: OrmClientConfig): {
         } & import("./select-types").StrictSelect<S, import("./input-types").ForgotPasswordPayloadSelect>) => import("./query-builder").QueryBuilder<{
             forgotPassword: import("./select-types").InferSelectResult<import("./input-types").ForgotPasswordPayload, S> | null;
         }>;
-        verifyPassword: <S extends import("./input-types").VerifyPasswordPayloadSelect>(args: import("./mutation").VerifyPasswordVariables, options: {
-            select: S;
-        } & import("./select-types").StrictSelect<S, import("./input-types").VerifyPasswordPayloadSelect>) => import("./query-builder").QueryBuilder<{
-            verifyPassword: import("./select-types").InferSelectResult<import("./input-types").VerifyPasswordPayload, S> | null;
-        }>;
-        verifyTotp: <S extends import("./input-types").VerifyTotpPayloadSelect>(args: import("./mutation").VerifyTotpVariables, options: {
-            select: S;
-        } & import("./select-types").StrictSelect<S, import("./input-types").VerifyTotpPayloadSelect>) => import("./query-builder").QueryBuilder<{
-            verifyTotp: import("./select-types").InferSelectResult<import("./input-types").VerifyTotpPayload, S> | null;
-        }>;
         requestUploadUrl: <S extends import("./input-types").RequestUploadUrlPayloadSelect>(args: import("./mutation").RequestUploadUrlVariables, options: {
             select: S;
         } & import("./select-types").StrictSelect<S, import("./input-types").RequestUploadUrlPayloadSelect>) => import("./query-builder").QueryBuilder<{

package/esm/public/orm/index.js

@@ -90,8 +90,8 @@ import { EmailModel } from './models/email';
 import { PhoneNumberModel } from './models/phoneNumber';
 import { CryptoAddressModel } from './models/cryptoAddress';
 import { ConnectedAccountModel } from './models/connectedAccount';
-import { InviteModel } from './models/invite';
-import { ClaimedInviteModel } from './models/claimedInvite';
+import { AppInviteModel } from './models/appInvite';
+import { AppClaimedInviteModel } from './models/appClaimedInvite';
 import { OrgInviteModel } from './models/orgInvite';
 import { OrgClaimedInviteModel } from './models/orgClaimedInvite';
 import { AuditLogModel } from './models/auditLog';
@@ -105,6 +105,7 @@ import { OrgLimitDefaultModel } from './models/orgLimitDefault';
 import { MembershipTypeModel } from './models/membershipType';
 import { AppMembershipDefaultModel } from './models/appMembershipDefault';
 import { CommitModel } from './models/commit';
+import { RateLimitsModuleModel } from './models/rateLimitsModule';
 import { OrgMembershipDefaultModel } from './models/orgMembershipDefault';
 import { RlsModuleModel } from './models/rlsModule';
 import { SqlActionModel } from './models/sqlAction';
@@ -233,8 +234,8 @@ export function createClient(config) {
         phoneNumber: new PhoneNumberModel(client),
         cryptoAddress: new CryptoAddressModel(client),
         connectedAccount: new ConnectedAccountModel(client),
-        invite: new InviteModel(client),
-        claimedInvite: new ClaimedInviteModel(client),
+        appInvite: new AppInviteModel(client),
+        appClaimedInvite: new AppClaimedInviteModel(client),
         orgInvite: new OrgInviteModel(client),
         orgClaimedInvite: new OrgClaimedInviteModel(client),
         auditLog: new AuditLogModel(client),
@@ -248,6 +249,7 @@ export function createClient(config) {
         membershipType: new MembershipTypeModel(client),
         appMembershipDefault: new AppMembershipDefaultModel(client),
         commit: new CommitModel(client),
+        rateLimitsModule: new RateLimitsModuleModel(client),
         orgMembershipDefault: new OrgMembershipDefaultModel(client),
         rlsModule: new RlsModuleModel(client),
         sqlAction: new SqlActionModel(client),