@constructive-sdk/cli 0.25.9 → 0.25.11

package/modules/cli/commands/transfer-log-module.js

@@ -13,6 +13,8 @@ const fieldSchema = {
     databaseId: 'uuid',
     schemaId: 'uuid',
     privateSchemaId: 'uuid',
+    publicSchemaName: 'string',
+    privateSchemaName: 'string',
     transferLogTableId: 'uuid',
     transferLogTableName: 'string',
     usageDailyTableId: 'uuid',
@@ -73,6 +75,8 @@ async function handleList(argv, _prompter) {
             databaseId: true,
             schemaId: true,
             privateSchemaId: true,
+            publicSchemaName: true,
+            privateSchemaName: true,
             transferLogTableId: true,
             transferLogTableName: true,
             usageDailyTableId: true,
@@ -107,6 +111,8 @@ async function handleFindFirst(argv, _prompter) {
             databaseId: true,
             schemaId: true,
             privateSchemaId: true,
+            publicSchemaName: true,
+            privateSchemaName: true,
             transferLogTableId: true,
             transferLogTableName: true,
             usageDailyTableId: true,
@@ -153,6 +159,8 @@ async function handleGet(argv, prompter) {
                 databaseId: true,
                 schemaId: true,
                 privateSchemaId: true,
+                publicSchemaName: true,
+                privateSchemaName: true,
                 transferLogTableId: true,
                 transferLogTableName: true,
                 usageDailyTableId: true,
@@ -202,6 +210,20 @@ async function handleCreate(argv, prompter) {
                 required: false,
                 skipPrompt: true,
             },
+            {
+                type: 'text',
+                name: 'publicSchemaName',
+                message: 'publicSchemaName',
+                required: false,
+                skipPrompt: true,
+            },
+            {
+                type: 'text',
+                name: 'privateSchemaName',
+                message: 'privateSchemaName',
+                required: false,
+                skipPrompt: true,
+            },
             {
                 type: 'text',
                 name: 'transferLogTableId',
@@ -303,6 +325,8 @@ async function handleCreate(argv, prompter) {
                 databaseId: cleanedData.databaseId,
                 schemaId: cleanedData.schemaId,
                 privateSchemaId: cleanedData.privateSchemaId,
+                publicSchemaName: cleanedData.publicSchemaName,
+                privateSchemaName: cleanedData.privateSchemaName,
                 transferLogTableId: cleanedData.transferLogTableId,
                 transferLogTableName: cleanedData.transferLogTableName,
                 usageDailyTableId: cleanedData.usageDailyTableId,
@@ -322,6 +346,8 @@ async function handleCreate(argv, prompter) {
                 databaseId: true,
                 schemaId: true,
                 privateSchemaId: true,
+                publicSchemaName: true,
+                privateSchemaName: true,
                 transferLogTableId: true,
                 transferLogTableName: true,
                 usageDailyTableId: true,
@@ -377,6 +403,20 @@ async function handleUpdate(argv, prompter) {
                 required: false,
                 skipPrompt: true,
             },
+            {
+                type: 'text',
+                name: 'publicSchemaName',
+                message: 'publicSchemaName',
+                required: false,
+                skipPrompt: true,
+            },
+            {
+                type: 'text',
+                name: 'privateSchemaName',
+                message: 'privateSchemaName',
+                required: false,
+                skipPrompt: true,
+            },
             {
                 type: 'text',
                 name: 'transferLogTableId',
@@ -481,6 +521,8 @@ async function handleUpdate(argv, prompter) {
                 databaseId: cleanedData.databaseId,
                 schemaId: cleanedData.schemaId,
                 privateSchemaId: cleanedData.privateSchemaId,
+                publicSchemaName: cleanedData.publicSchemaName,
+                privateSchemaName: cleanedData.privateSchemaName,
                 transferLogTableId: cleanedData.transferLogTableId,
                 transferLogTableName: cleanedData.transferLogTableName,
                 usageDailyTableId: cleanedData.usageDailyTableId,
@@ -500,6 +542,8 @@ async function handleUpdate(argv, prompter) {
                 databaseId: true,
                 schemaId: true,
                 privateSchemaId: true,
+                publicSchemaName: true,
+                privateSchemaName: true,
                 transferLogTableId: true,
                 transferLogTableName: true,
                 usageDailyTableId: true,

package/modules/cli/commands.js

@@ -29,45 +29,46 @@ const rate_limits_module_1 = __importDefault(require("./commands/rate-limits-mod
 const users_module_1 = __importDefault(require("./commands/users-module"));
 const webauthn_credentials_module_1 = __importDefault(require("./commands/webauthn-credentials-module"));
 const crypto_addresses_module_1 = __importDefault(require("./commands/crypto-addresses-module"));
-const identity_providers_module_1 = __importDefault(require("./commands/identity-providers-module"));
 const denormalized_table_field_1 = __importDefault(require("./commands/denormalized-table-field"));
+const identity_providers_module_1 = __importDefault(require("./commands/identity-providers-module"));
 const rls_module_1 = __importDefault(require("./commands/rls-module"));
 const blueprint_1 = __importDefault(require("./commands/blueprint"));
 const blueprint_template_1 = __importDefault(require("./commands/blueprint-template"));
 const blueprint_construction_1 = __importDefault(require("./commands/blueprint-construction"));
 const crypto_auth_module_1 = __importDefault(require("./commands/crypto-auth-module"));
-const rate_limit_meters_module_1 = __importDefault(require("./commands/rate-limit-meters-module"));
 const sessions_module_1 = __importDefault(require("./commands/sessions-module"));
-const config_secrets_module_1 = __importDefault(require("./commands/config-secrets-module"));
+const secure_table_provision_1 = __importDefault(require("./commands/secure-table-provision"));
 const merkle_store_module_1 = __importDefault(require("./commands/merkle-store-module"));
 const graph_module_1 = __importDefault(require("./commands/graph-module"));
-const secure_table_provision_1 = __importDefault(require("./commands/secure-table-provision"));
-const invites_module_1 = __importDefault(require("./commands/invites-module"));
 const database_provision_module_1 = __importDefault(require("./commands/database-provision-module"));
-const namespace_module_1 = __importDefault(require("./commands/namespace-module"));
+const config_secrets_module_1 = __importDefault(require("./commands/config-secrets-module"));
+const rate_limit_meters_module_1 = __importDefault(require("./commands/rate-limit-meters-module"));
 const realtime_module_1 = __importDefault(require("./commands/realtime-module"));
 const webauthn_auth_module_1 = __importDefault(require("./commands/webauthn-auth-module"));
+const function_invocation_module_1 = __importDefault(require("./commands/function-invocation-module"));
+const function_module_1 = __importDefault(require("./commands/function-module"));
+const invites_module_1 = __importDefault(require("./commands/invites-module"));
+const namespace_module_1 = __importDefault(require("./commands/namespace-module"));
 const compute_log_module_1 = __importDefault(require("./commands/compute-log-module"));
 const inference_log_module_1 = __importDefault(require("./commands/inference-log-module"));
 const storage_log_module_1 = __importDefault(require("./commands/storage-log-module"));
 const transfer_log_module_1 = __importDefault(require("./commands/transfer-log-module"));
-const db_usage_module_1 = __importDefault(require("./commands/db-usage-module"));
-const notifications_module_1 = __importDefault(require("./commands/notifications-module"));
 const plans_module_1 = __importDefault(require("./commands/plans-module"));
-const hierarchy_module_1 = __importDefault(require("./commands/hierarchy-module"));
-const billing_module_1 = __importDefault(require("./commands/billing-module"));
 const billing_provider_module_1 = __importDefault(require("./commands/billing-provider-module"));
-const profiles_module_1 = __importDefault(require("./commands/profiles-module"));
+const db_usage_module_1 = __importDefault(require("./commands/db-usage-module"));
+const hierarchy_module_1 = __importDefault(require("./commands/hierarchy-module"));
 const permissions_module_1 = __importDefault(require("./commands/permissions-module"));
+const notifications_module_1 = __importDefault(require("./commands/notifications-module"));
+const profiles_module_1 = __importDefault(require("./commands/profiles-module"));
+const billing_module_1 = __importDefault(require("./commands/billing-module"));
 const relation_provision_1 = __importDefault(require("./commands/relation-provision"));
-const function_module_1 = __importDefault(require("./commands/function-module"));
 const user_auth_module_1 = __importDefault(require("./commands/user-auth-module"));
 const agent_module_1 = __importDefault(require("./commands/agent-module"));
 const limits_module_1 = __importDefault(require("./commands/limits-module"));
 const memberships_module_1 = __importDefault(require("./commands/memberships-module"));
+const entity_type_provision_1 = __importDefault(require("./commands/entity-type-provision"));
 const storage_module_1 = __importDefault(require("./commands/storage-module"));
 const events_module_1 = __importDefault(require("./commands/events-module"));
-const entity_type_provision_1 = __importDefault(require("./commands/entity-type-provision"));
 const resolve_blueprint_field_1 = __importDefault(require("./commands/resolve-blueprint-field"));
 const resolve_blueprint_table_1 = __importDefault(require("./commands/resolve-blueprint-table"));
 const construct_blueprint_1 = __importDefault(require("./commands/construct-blueprint"));
@@ -100,45 +101,46 @@ const createCommandMap = () => ({
     'users-module': users_module_1.default,
     'webauthn-credentials-module': webauthn_credentials_module_1.default,
     'crypto-addresses-module': crypto_addresses_module_1.default,
-    'identity-providers-module': identity_providers_module_1.default,
     'denormalized-table-field': denormalized_table_field_1.default,
+    'identity-providers-module': identity_providers_module_1.default,
     'rls-module': rls_module_1.default,
     blueprint: blueprint_1.default,
     'blueprint-template': blueprint_template_1.default,
     'blueprint-construction': blueprint_construction_1.default,
     'crypto-auth-module': crypto_auth_module_1.default,
-    'rate-limit-meters-module': rate_limit_meters_module_1.default,
     'sessions-module': sessions_module_1.default,
-    'config-secrets-module': config_secrets_module_1.default,
+    'secure-table-provision': secure_table_provision_1.default,
     'merkle-store-module': merkle_store_module_1.default,
     'graph-module': graph_module_1.default,
-    'secure-table-provision': secure_table_provision_1.default,
-    'invites-module': invites_module_1.default,
     'database-provision-module': database_provision_module_1.default,
-    'namespace-module': namespace_module_1.default,
+    'config-secrets-module': config_secrets_module_1.default,
+    'rate-limit-meters-module': rate_limit_meters_module_1.default,
     'realtime-module': realtime_module_1.default,
     'webauthn-auth-module': webauthn_auth_module_1.default,
+    'function-invocation-module': function_invocation_module_1.default,
+    'function-module': function_module_1.default,
+    'invites-module': invites_module_1.default,
+    'namespace-module': namespace_module_1.default,
     'compute-log-module': compute_log_module_1.default,
     'inference-log-module': inference_log_module_1.default,
     'storage-log-module': storage_log_module_1.default,
     'transfer-log-module': transfer_log_module_1.default,
-    'db-usage-module': db_usage_module_1.default,
-    'notifications-module': notifications_module_1.default,
     'plans-module': plans_module_1.default,
-    'hierarchy-module': hierarchy_module_1.default,
-    'billing-module': billing_module_1.default,
     'billing-provider-module': billing_provider_module_1.default,
-    'profiles-module': profiles_module_1.default,
+    'db-usage-module': db_usage_module_1.default,
+    'hierarchy-module': hierarchy_module_1.default,
     'permissions-module': permissions_module_1.default,
+    'notifications-module': notifications_module_1.default,
+    'profiles-module': profiles_module_1.default,
+    'billing-module': billing_module_1.default,
     'relation-provision': relation_provision_1.default,
-    'function-module': function_module_1.default,
     'user-auth-module': user_auth_module_1.default,
     'agent-module': agent_module_1.default,
     'limits-module': limits_module_1.default,
     'memberships-module': memberships_module_1.default,
+    'entity-type-provision': entity_type_provision_1.default,
     'storage-module': storage_module_1.default,
     'events-module': events_module_1.default,
-    'entity-type-provision': entity_type_provision_1.default,
     'resolve-blueprint-field': resolve_blueprint_field_1.default,
     'resolve-blueprint-table': resolve_blueprint_table_1.default,
     'construct-blueprint': construct_blueprint_1.default,
@@ -152,7 +154,7 @@ const createCommandMap = () => ({
     'provision-relation': provision_relation_1.default,
     'provision-bucket': provision_bucket_1.default,
 });
-const usage = "\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  default-ids-module   defaultIdsModule CRUD operations\n  membership-types-module membershipTypesModule CRUD operations\n  user-state-module    userStateModule CRUD operations\n  session-secrets-module sessionSecretsModule CRUD operations\n  config-secrets-org-module configSecretsOrgModule CRUD operations\n  devices-module       devicesModule CRUD operations\n  i-18-n-module        i18NModule CRUD operations\n  user-credentials-module userCredentialsModule CRUD operations\n  user-settings-module userSettingsModule CRUD operations\n  config-secrets-user-module configSecretsUserModule CRUD operations\n  connected-accounts-module connectedAccountsModule CRUD operations\n  emails-module        emailsModule CRUD operations\n  phone-numbers-module phoneNumbersModule CRUD operations\n  rate-limits-module   rateLimitsModule CRUD operations\n  users-module         usersModule CRUD operations\n  webauthn-credentials-module webauthnCredentialsModule CRUD operations\n  crypto-addresses-module cryptoAddressesModule CRUD operations\n  identity-providers-module identityProvidersModule CRUD operations\n  denormalized-table-field denormalizedTableField CRUD operations\n  rls-module           rlsModule CRUD operations\n  blueprint            blueprint CRUD operations\n  blueprint-template   blueprintTemplate CRUD operations\n  blueprint-construction blueprintConstruction CRUD operations\n  crypto-auth-module   cryptoAuthModule CRUD operations\n  rate-limit-meters-module rateLimitMetersModule CRUD operations\n  sessions-module      sessionsModule CRUD operations\n  config-secrets-module configSecretsModule CRUD operations\n  merkle-store-module  merkleStoreModule CRUD operations\n  graph-module         graphModule CRUD operations\n  secure-table-provision secureTableProvision CRUD operations\n  invites-module       invitesModule CRUD operations\n  database-provision-module databaseProvisionModule CRUD operations\n  namespace-module     namespaceModule CRUD operations\n  realtime-module      realtimeModule CRUD operations\n  webauthn-auth-module webauthnAuthModule CRUD operations\n  compute-log-module   computeLogModule CRUD operations\n  inference-log-module inferenceLogModule CRUD operations\n  storage-log-module   storageLogModule CRUD operations\n  transfer-log-module  transferLogModule CRUD operations\n  db-usage-module      dbUsageModule CRUD operations\n  notifications-module notificationsModule CRUD operations\n  plans-module         plansModule CRUD operations\n  hierarchy-module     hierarchyModule CRUD operations\n  billing-module       billingModule CRUD operations\n  billing-provider-module billingProviderModule CRUD operations\n  profiles-module      profilesModule CRUD operations\n  permissions-module   permissionsModule CRUD operations\n  relation-provision   relationProvision CRUD operations\n  function-module      functionModule CRUD operations\n  user-auth-module     userAuthModule CRUD operations\n  agent-module         agentModule CRUD operations\n  limits-module        limitsModule CRUD operations\n  memberships-module   membershipsModule CRUD operations\n  storage-module       storageModule CRUD operations\n  events-module        eventsModule CRUD operations\n  entity-type-provision entityTypeProvision CRUD operations\n  resolve-blueprint-field Resolves a field_name within a given table_id to a field_id. Throws if no match is found. Used by construct_blueprint to translate user-authored field names (e.g. \"location\") into field UUIDs for downstream provisioning procedures. table_id must already be resolved (via resolve_blueprint_table) before calling this.\n  resolve-blueprint-table Resolves a table_name (with optional schema_name) to a table_id. Resolution order: (1) if schema_name provided, exact lookup via metaschema_public.schema.name + metaschema_public.table; (2) check local table_map (tables created in current blueprint); (3) search metaschema_public.table by name across all schemas; (4) if multiple matches, throw ambiguous error asking for schema_name; (5) if no match, throw not-found error.\n  construct-blueprint  Executes a blueprint definition by delegating to provision_* procedures. Creates a blueprint_construction record to track the attempt. Eight phases: (0) entity_type_provision for each membership_type entry \u2014 provisions entity tables, membership modules, and security. When a prefix already exists (e.g., 'org'), the entry extends the existing entity type instead of creating a new one; if a storage[] key is present, it provisions entity-scoped storage for that type. (0.5) scope-based storage: each storage[] entry has an optional scope ('app' or 'org' only). App-scoped storage seeds buckets at migration time. Org-scoped storage resolves the org membership type, creates org_buckets/org_files with owner_id, and seeds buckets per-entity via an AFTER INSERT trigger on the users table. When function_module is installed, a private functions bucket is auto-injected into org-scoped or entity-scoped storage entries. (1) provision_table() for each table with nodes[], fields[], policies[], and grants (table-level indexes/fts/unique_constraints/check_constraints are deferred). After provisioning, optional smart_tags (jsonb object) on the table entry are applied via metaschema.append_table_smart_tags(), and optional smart_tags on individual field entries are applied via metaschema.append_field_smart_tags(). (2) provision_relation() for each relation, (3) provision_index() for top-level + deferred indexes, (4) provision_full_text_search() for top-level + deferred FTS, (5) provision_unique_constraint() for top-level + deferred unique constraints, (6) provision_check_constraint() for top-level + deferred check constraints, (7) seed achievements from definition.achievements[] \u2014 resolves events_module by entity_prefix and creates INSERT actions for levels, level_requirements, and achievement_rewards tables. Phase 0 entity tables are added to the table_map so subsequent phases can reference them by name. Table-level entries are deferred to phases 3-6 so they can reference columns created by relations in phase 2. Returns the construction record ID on success, NULL on failure.\n  provision-full-text-search Creates a full-text search configuration on a table. Accepts a jsonb definition with field (tsvector column name) and sources (array of {field, weight, lang}). Graceful: skips if FTS config already exists for the same (table_id, field_id). Returns the fts_id.\n  provision-index      Creates an index on a table. Accepts a jsonb definition with columns (array of names or single column string), access_method (default BTREE), is_unique, op_classes, options, and name (auto-generated if omitted). Graceful: skips if an index with the same (table_id, field_ids, access_method) already exists. Returns the index_id.\n  provision-check-constraint Creates a check constraint on a table from a $type + data blueprint definition. Supports: CheckOneOf (enum validation via = ANY(ARRAY[...])), CheckGreaterThan (single-column > value or cross-column), CheckLessThan (single-column < value or cross-column), CheckNotEqual (cross-column inequality). Builds AST expressions via ast_helpers and inserts into metaschema_public.check_constraint. Graceful: skips if a constraint with the same name already exists.\n  provision-unique-constraint Creates a unique constraint on a table. Accepts a jsonb definition with columns (array of field names). Graceful: skips if the exact same unique constraint already exists.\n  copy-template-to-blueprint Creates a new blueprint by copying a template definition. Checks visibility: owners can always copy their own templates, others require public visibility. Increments the template copy_count. Returns the new blueprint ID.\n  provision-spatial-relation Idempotent provisioner for metaschema_public.spatial_relation. Inserts a row declaring a spatial predicate between two geometry/geography columns (owner and target). Called from construct_blueprint when a relation entry has $type=RelationSpatial. Graceful: re-running with the same (source_table_id, name) returns the existing id without modifying the row. Operator whitelist and st_dwithin \u2194 param_name pairing are enforced by the spatial_relation table CHECKs. Both fields must already exist \u2014 this is a metadata-only insert.\n  provision-table      Composable table provisioning: creates or finds a table, then creates fields (so Data* modules can reference them), applies N nodes (Data* modules), enables RLS, creates grants, creates N policies, and optionally creates table-level indexes/full_text_searches/unique_constraints. All operations are graceful (skip existing). Accepts multiple nodes and multiple policies per call, unlike secure_table_provision which is limited to one of each. Returns (out_table_id, out_fields).\n  provision-relation   Composable relation provisioning: creates FK fields, indexes, unique constraints, and junction tables depending on the relation_type. Supports RelationBelongsTo, RelationHasOne, RelationHasMany, and RelationManyToMany. ManyToMany uses provision_table() internally for junction table creation with full node/grant/policy support. All operations are graceful (skip existing). Returns (out_field_id, out_junction_table_id, out_source_field_id, out_target_field_id).\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n";
+const usage = "\ncsdk <command>\n\nCommands:\n  context               Manage API contexts\n  auth                  Manage authentication\n  default-ids-module   defaultIdsModule CRUD operations\n  membership-types-module membershipTypesModule CRUD operations\n  user-state-module    userStateModule CRUD operations\n  session-secrets-module sessionSecretsModule CRUD operations\n  config-secrets-org-module configSecretsOrgModule CRUD operations\n  devices-module       devicesModule CRUD operations\n  i-18-n-module        i18NModule CRUD operations\n  user-credentials-module userCredentialsModule CRUD operations\n  user-settings-module userSettingsModule CRUD operations\n  config-secrets-user-module configSecretsUserModule CRUD operations\n  connected-accounts-module connectedAccountsModule CRUD operations\n  emails-module        emailsModule CRUD operations\n  phone-numbers-module phoneNumbersModule CRUD operations\n  rate-limits-module   rateLimitsModule CRUD operations\n  users-module         usersModule CRUD operations\n  webauthn-credentials-module webauthnCredentialsModule CRUD operations\n  crypto-addresses-module cryptoAddressesModule CRUD operations\n  denormalized-table-field denormalizedTableField CRUD operations\n  identity-providers-module identityProvidersModule CRUD operations\n  rls-module           rlsModule CRUD operations\n  blueprint            blueprint CRUD operations\n  blueprint-template   blueprintTemplate CRUD operations\n  blueprint-construction blueprintConstruction CRUD operations\n  crypto-auth-module   cryptoAuthModule CRUD operations\n  sessions-module      sessionsModule CRUD operations\n  secure-table-provision secureTableProvision CRUD operations\n  merkle-store-module  merkleStoreModule CRUD operations\n  graph-module         graphModule CRUD operations\n  database-provision-module databaseProvisionModule CRUD operations\n  config-secrets-module configSecretsModule CRUD operations\n  rate-limit-meters-module rateLimitMetersModule CRUD operations\n  realtime-module      realtimeModule CRUD operations\n  webauthn-auth-module webauthnAuthModule CRUD operations\n  function-invocation-module functionInvocationModule CRUD operations\n  function-module      functionModule CRUD operations\n  invites-module       invitesModule CRUD operations\n  namespace-module     namespaceModule CRUD operations\n  compute-log-module   computeLogModule CRUD operations\n  inference-log-module inferenceLogModule CRUD operations\n  storage-log-module   storageLogModule CRUD operations\n  transfer-log-module  transferLogModule CRUD operations\n  plans-module         plansModule CRUD operations\n  billing-provider-module billingProviderModule CRUD operations\n  db-usage-module      dbUsageModule CRUD operations\n  hierarchy-module     hierarchyModule CRUD operations\n  permissions-module   permissionsModule CRUD operations\n  notifications-module notificationsModule CRUD operations\n  profiles-module      profilesModule CRUD operations\n  billing-module       billingModule CRUD operations\n  relation-provision   relationProvision CRUD operations\n  user-auth-module     userAuthModule CRUD operations\n  agent-module         agentModule CRUD operations\n  limits-module        limitsModule CRUD operations\n  memberships-module   membershipsModule CRUD operations\n  entity-type-provision entityTypeProvision CRUD operations\n  storage-module       storageModule CRUD operations\n  events-module        eventsModule CRUD operations\n  resolve-blueprint-field Resolves a field_name within a given table_id to a field_id. Throws if no match is found. Used by construct_blueprint to translate user-authored field names (e.g. \"location\") into field UUIDs for downstream provisioning procedures. table_id must already be resolved (via resolve_blueprint_table) before calling this.\n  resolve-blueprint-table Resolves a table_name (with optional schema_name) to a table_id. Resolution order: (1) if schema_name provided, exact lookup via metaschema_public.schema.name + metaschema_public.table; (2) check local table_map (tables created in current blueprint); (3) search metaschema_public.table by name across all schemas; (4) if multiple matches, throw ambiguous error asking for schema_name; (5) if no match, throw not-found error.\n  construct-blueprint  Executes a blueprint definition by delegating to provision_* procedures. Creates a blueprint_construction record to track the attempt. Eight phases: (0) entity_type_provision for each membership_type entry \u2014 provisions entity tables, membership modules, and security. When a prefix already exists (e.g., 'org'), the entry extends the existing entity type instead of creating a new one; if a storage[] key is present, it provisions entity-scoped storage for that type. (0.5) scope-based storage: each storage[] entry has an optional scope ('app' or 'org' only). App-scoped storage seeds buckets at migration time. Org-scoped storage resolves the org membership type, creates org_buckets/org_files with owner_id, and seeds buckets per-entity via an AFTER INSERT trigger on the users table. When function_module is installed, a private functions bucket is auto-injected into org-scoped or entity-scoped storage entries. (1) provision_table() for each table with nodes[], fields[], policies[], and grants (table-level indexes/fts/unique_constraints/check_constraints are deferred). After provisioning, optional smart_tags (jsonb object) on the table entry are applied via metaschema.append_table_smart_tags(), and optional smart_tags on individual field entries are applied via metaschema.append_field_smart_tags(). (2) provision_relation() for each relation, (3) provision_index() for top-level + deferred indexes, (4) provision_full_text_search() for top-level + deferred FTS, (5) provision_unique_constraint() for top-level + deferred unique constraints, (6) provision_check_constraint() for top-level + deferred check constraints, (7) seed achievements from definition.achievements[] \u2014 resolves events_module by entity_prefix and creates INSERT actions for levels, level_requirements, and achievement_rewards tables. Phase 0 entity tables are added to the table_map so subsequent phases can reference them by name. Table-level entries are deferred to phases 3-6 so they can reference columns created by relations in phase 2. Returns the construction record ID on success, NULL on failure.\n  provision-full-text-search Creates a full-text search configuration on a table. Accepts a jsonb definition with field (tsvector column name) and sources (array of {field, weight, lang}). Graceful: skips if FTS config already exists for the same (table_id, field_id). Returns the fts_id.\n  provision-index      Creates an index on a table. Accepts a jsonb definition with columns (array of names or single column string), access_method (default BTREE), is_unique, op_classes, options, and name (auto-generated if omitted). Graceful: skips if an index with the same (table_id, field_ids, access_method) already exists. Returns the index_id.\n  provision-check-constraint Creates a check constraint on a table from a $type + data blueprint definition. Supports: CheckOneOf (enum validation via = ANY(ARRAY[...])), CheckGreaterThan (single-column > value or cross-column), CheckLessThan (single-column < value or cross-column), CheckNotEqual (cross-column inequality). Builds AST expressions via ast_helpers and inserts into metaschema_public.check_constraint. Graceful: skips if a constraint with the same name already exists.\n  provision-unique-constraint Creates a unique constraint on a table. Accepts a jsonb definition with columns (array of field names). Graceful: skips if the exact same unique constraint already exists.\n  copy-template-to-blueprint Creates a new blueprint by copying a template definition. Checks visibility: owners can always copy their own templates, others require public visibility. Increments the template copy_count. Returns the new blueprint ID.\n  provision-spatial-relation Idempotent provisioner for metaschema_public.spatial_relation. Inserts a row declaring a spatial predicate between two geometry/geography columns (owner and target). Called from construct_blueprint when a relation entry has $type=RelationSpatial. Graceful: re-running with the same (source_table_id, name) returns the existing id without modifying the row. Operator whitelist and st_dwithin \u2194 param_name pairing are enforced by the spatial_relation table CHECKs. Both fields must already exist \u2014 this is a metadata-only insert.\n  provision-table      Composable table provisioning: creates or finds a table, then creates fields (so Data* modules can reference them), applies N nodes (Data* modules), enables RLS, creates grants, creates N policies, and optionally creates table-level indexes/full_text_searches/unique_constraints. All operations are graceful (skip existing). Accepts multiple nodes and multiple policies per call, unlike secure_table_provision which is limited to one of each. Returns (out_table_id, out_fields).\n  provision-relation   Composable relation provisioning: creates FK fields, indexes, unique constraints, and junction tables depending on the relation_type. Supports RelationBelongsTo, RelationHasOne, RelationHasMany, and RelationManyToMany. ManyToMany uses provision_table() internally for junction table creation with full node/grant/policy support. All operations are graceful (skip existing). Returns (out_field_id, out_junction_table_id, out_source_field_id, out_target_field_id).\n  provision-bucket     Provision an S3 bucket for a logical bucket in the database.\nReads the bucket config via RLS, then creates and configures\nthe S3 bucket with the appropriate privacy policies, CORS rules,\nand lifecycle settings.\n\n  --help, -h            Show this help message\n  --version, -v         Show version\n";
 const commands = async (argv, prompter, options) => {
     if (argv.help || argv.h) {
         console.log(usage);

package/modules/cli/executor.d.ts

@@ -17,45 +17,46 @@ export declare function getClient(contextName?: string): {
     usersModule: import("../orm").UsersModuleModel;
     webauthnCredentialsModule: import("../orm").WebauthnCredentialsModuleModel;
     cryptoAddressesModule: import("../orm").CryptoAddressesModuleModel;
-    identityProvidersModule: import("../orm").IdentityProvidersModuleModel;
     denormalizedTableField: import("../orm").DenormalizedTableFieldModel;
+    identityProvidersModule: import("../orm").IdentityProvidersModuleModel;
     rlsModule: import("../orm").RlsModuleModel;
     blueprint: import("../orm").BlueprintModel;
     blueprintTemplate: import("../orm").BlueprintTemplateModel;
     blueprintConstruction: import("../orm").BlueprintConstructionModel;
     cryptoAuthModule: import("../orm").CryptoAuthModuleModel;
-    rateLimitMetersModule: import("../orm").RateLimitMetersModuleModel;
     sessionsModule: import("../orm").SessionsModuleModel;
-    configSecretsModule: import("../orm").ConfigSecretsModuleModel;
+    secureTableProvision: import("../orm").SecureTableProvisionModel;
     merkleStoreModule: import("../orm").MerkleStoreModuleModel;
     graphModule: import("../orm").GraphModuleModel;
-    secureTableProvision: import("../orm").SecureTableProvisionModel;
-    invitesModule: import("../orm").InvitesModuleModel;
     databaseProvisionModule: import("../orm").DatabaseProvisionModuleModel;
-    namespaceModule: import("../orm").NamespaceModuleModel;
+    configSecretsModule: import("../orm").ConfigSecretsModuleModel;
+    rateLimitMetersModule: import("../orm").RateLimitMetersModuleModel;
     realtimeModule: import("../orm").RealtimeModuleModel;
     webauthnAuthModule: import("../orm").WebauthnAuthModuleModel;
+    functionInvocationModule: import("../orm").FunctionInvocationModuleModel;
+    functionModule: import("../orm").FunctionModuleModel;
+    invitesModule: import("../orm").InvitesModuleModel;
+    namespaceModule: import("../orm").NamespaceModuleModel;
     computeLogModule: import("../orm").ComputeLogModuleModel;
     inferenceLogModule: import("../orm").InferenceLogModuleModel;
     storageLogModule: import("../orm").StorageLogModuleModel;
     transferLogModule: import("../orm").TransferLogModuleModel;
-    dbUsageModule: import("../orm").DbUsageModuleModel;
-    notificationsModule: import("../orm").NotificationsModuleModel;
     plansModule: import("../orm").PlansModuleModel;
-    hierarchyModule: import("../orm").HierarchyModuleModel;
-    billingModule: import("../orm").BillingModuleModel;
     billingProviderModule: import("../orm").BillingProviderModuleModel;
-    profilesModule: import("../orm").ProfilesModuleModel;
+    dbUsageModule: import("../orm").DbUsageModuleModel;
+    hierarchyModule: import("../orm").HierarchyModuleModel;
     permissionsModule: import("../orm").PermissionsModuleModel;
+    notificationsModule: import("../orm").NotificationsModuleModel;
+    profilesModule: import("../orm").ProfilesModuleModel;
+    billingModule: import("../orm").BillingModuleModel;
     relationProvision: import("../orm").RelationProvisionModel;
-    functionModule: import("../orm").FunctionModuleModel;
     userAuthModule: import("../orm").UserAuthModuleModel;
     agentModule: import("../orm").AgentModuleModel;
     limitsModule: import("../orm").LimitsModuleModel;
     membershipsModule: import("../orm").MembershipsModuleModel;
+    entityTypeProvision: import("../orm").EntityTypeProvisionModel;
     storageModule: import("../orm").StorageModuleModel;
     eventsModule: import("../orm").EventsModuleModel;
-    entityTypeProvision: import("../orm").EntityTypeProvisionModel;
     query: {
         resolveBlueprintField: (args: import("../orm/query").ResolveBlueprintFieldVariables, options?: {
             select?: Record<string, unknown>;

package/modules/orm/index.d.ts

@@ -16,45 +16,46 @@ import { RateLimitsModuleModel } from './models/rateLimitsModule';
 import { UsersModuleModel } from './models/usersModule';
 import { WebauthnCredentialsModuleModel } from './models/webauthnCredentialsModule';
 import { CryptoAddressesModuleModel } from './models/cryptoAddressesModule';
-import { IdentityProvidersModuleModel } from './models/identityProvidersModule';
 import { DenormalizedTableFieldModel } from './models/denormalizedTableField';
+import { IdentityProvidersModuleModel } from './models/identityProvidersModule';
 import { RlsModuleModel } from './models/rlsModule';
 import { BlueprintModel } from './models/blueprint';
 import { BlueprintTemplateModel } from './models/blueprintTemplate';
 import { BlueprintConstructionModel } from './models/blueprintConstruction';
 import { CryptoAuthModuleModel } from './models/cryptoAuthModule';
-import { RateLimitMetersModuleModel } from './models/rateLimitMetersModule';
 import { SessionsModuleModel } from './models/sessionsModule';
-import { ConfigSecretsModuleModel } from './models/configSecretsModule';
+import { SecureTableProvisionModel } from './models/secureTableProvision';
 import { MerkleStoreModuleModel } from './models/merkleStoreModule';
 import { GraphModuleModel } from './models/graphModule';
-import { SecureTableProvisionModel } from './models/secureTableProvision';
-import { InvitesModuleModel } from './models/invitesModule';
 import { DatabaseProvisionModuleModel } from './models/databaseProvisionModule';
-import { NamespaceModuleModel } from './models/namespaceModule';
+import { ConfigSecretsModuleModel } from './models/configSecretsModule';
+import { RateLimitMetersModuleModel } from './models/rateLimitMetersModule';
 import { RealtimeModuleModel } from './models/realtimeModule';
 import { WebauthnAuthModuleModel } from './models/webauthnAuthModule';
+import { FunctionInvocationModuleModel } from './models/functionInvocationModule';
+import { FunctionModuleModel } from './models/functionModule';
+import { InvitesModuleModel } from './models/invitesModule';
+import { NamespaceModuleModel } from './models/namespaceModule';
 import { ComputeLogModuleModel } from './models/computeLogModule';
 import { InferenceLogModuleModel } from './models/inferenceLogModule';
 import { StorageLogModuleModel } from './models/storageLogModule';
 import { TransferLogModuleModel } from './models/transferLogModule';
-import { DbUsageModuleModel } from './models/dbUsageModule';
-import { NotificationsModuleModel } from './models/notificationsModule';
 import { PlansModuleModel } from './models/plansModule';
-import { HierarchyModuleModel } from './models/hierarchyModule';
-import { BillingModuleModel } from './models/billingModule';
 import { BillingProviderModuleModel } from './models/billingProviderModule';
-import { ProfilesModuleModel } from './models/profilesModule';
+import { DbUsageModuleModel } from './models/dbUsageModule';
+import { HierarchyModuleModel } from './models/hierarchyModule';
 import { PermissionsModuleModel } from './models/permissionsModule';
+import { NotificationsModuleModel } from './models/notificationsModule';
+import { ProfilesModuleModel } from './models/profilesModule';
+import { BillingModuleModel } from './models/billingModule';
 import { RelationProvisionModel } from './models/relationProvision';
-import { FunctionModuleModel } from './models/functionModule';
 import { UserAuthModuleModel } from './models/userAuthModule';
 import { AgentModuleModel } from './models/agentModule';
 import { LimitsModuleModel } from './models/limitsModule';
 import { MembershipsModuleModel } from './models/membershipsModule';
+import { EntityTypeProvisionModel } from './models/entityTypeProvision';
 import { StorageModuleModel } from './models/storageModule';
 import { EventsModuleModel } from './models/eventsModule';
-import { EntityTypeProvisionModel } from './models/entityTypeProvision';
 export type { OrmClientConfig, QueryResult, GraphQLError, GraphQLAdapter } from './client';
 export { GraphQLRequestError, FetchAdapter } from './client';
 export { QueryBuilder } from './query-builder';
@@ -103,45 +104,46 @@ export declare function createClient(config: OrmClientConfig): {
     usersModule: UsersModuleModel;
     webauthnCredentialsModule: WebauthnCredentialsModuleModel;
     cryptoAddressesModule: CryptoAddressesModuleModel;
-    identityProvidersModule: IdentityProvidersModuleModel;
     denormalizedTableField: DenormalizedTableFieldModel;
+    identityProvidersModule: IdentityProvidersModuleModel;
     rlsModule: RlsModuleModel;
     blueprint: BlueprintModel;
     blueprintTemplate: BlueprintTemplateModel;
     blueprintConstruction: BlueprintConstructionModel;
     cryptoAuthModule: CryptoAuthModuleModel;
-    rateLimitMetersModule: RateLimitMetersModuleModel;
     sessionsModule: SessionsModuleModel;
-    configSecretsModule: ConfigSecretsModuleModel;
+    secureTableProvision: SecureTableProvisionModel;
     merkleStoreModule: MerkleStoreModuleModel;
     graphModule: GraphModuleModel;
-    secureTableProvision: SecureTableProvisionModel;
-    invitesModule: InvitesModuleModel;
     databaseProvisionModule: DatabaseProvisionModuleModel;
-    namespaceModule: NamespaceModuleModel;
+    configSecretsModule: ConfigSecretsModuleModel;
+    rateLimitMetersModule: RateLimitMetersModuleModel;
     realtimeModule: RealtimeModuleModel;
     webauthnAuthModule: WebauthnAuthModuleModel;
+    functionInvocationModule: FunctionInvocationModuleModel;
+    functionModule: FunctionModuleModel;
+    invitesModule: InvitesModuleModel;
+    namespaceModule: NamespaceModuleModel;
     computeLogModule: ComputeLogModuleModel;
     inferenceLogModule: InferenceLogModuleModel;
     storageLogModule: StorageLogModuleModel;
     transferLogModule: TransferLogModuleModel;
-    dbUsageModule: DbUsageModuleModel;
-    notificationsModule: NotificationsModuleModel;
     plansModule: PlansModuleModel;
-    hierarchyModule: HierarchyModuleModel;
-    billingModule: BillingModuleModel;
     billingProviderModule: BillingProviderModuleModel;
-    profilesModule: ProfilesModuleModel;
+    dbUsageModule: DbUsageModuleModel;
+    hierarchyModule: HierarchyModuleModel;
     permissionsModule: PermissionsModuleModel;
+    notificationsModule: NotificationsModuleModel;
+    profilesModule: ProfilesModuleModel;
+    billingModule: BillingModuleModel;
     relationProvision: RelationProvisionModel;
-    functionModule: FunctionModuleModel;
     userAuthModule: UserAuthModuleModel;
     agentModule: AgentModuleModel;
     limitsModule: LimitsModuleModel;
     membershipsModule: MembershipsModuleModel;
+    entityTypeProvision: EntityTypeProvisionModel;
     storageModule: StorageModuleModel;
     eventsModule: EventsModuleModel;
-    entityTypeProvision: EntityTypeProvisionModel;
     query: {
         resolveBlueprintField: (args: import("./query").ResolveBlueprintFieldVariables, options?: {
             select?: Record<string, unknown>;

package/modules/orm/index.js

@@ -39,45 +39,46 @@ const rateLimitsModule_1 = require("./models/rateLimitsModule");
 const usersModule_1 = require("./models/usersModule");
 const webauthnCredentialsModule_1 = require("./models/webauthnCredentialsModule");
 const cryptoAddressesModule_1 = require("./models/cryptoAddressesModule");
-const identityProvidersModule_1 = require("./models/identityProvidersModule");
 const denormalizedTableField_1 = require("./models/denormalizedTableField");
+const identityProvidersModule_1 = require("./models/identityProvidersModule");
 const rlsModule_1 = require("./models/rlsModule");
 const blueprint_1 = require("./models/blueprint");
 const blueprintTemplate_1 = require("./models/blueprintTemplate");
 const blueprintConstruction_1 = require("./models/blueprintConstruction");
 const cryptoAuthModule_1 = require("./models/cryptoAuthModule");
-const rateLimitMetersModule_1 = require("./models/rateLimitMetersModule");
 const sessionsModule_1 = require("./models/sessionsModule");
-const configSecretsModule_1 = require("./models/configSecretsModule");
+const secureTableProvision_1 = require("./models/secureTableProvision");
 const merkleStoreModule_1 = require("./models/merkleStoreModule");
 const graphModule_1 = require("./models/graphModule");
-const secureTableProvision_1 = require("./models/secureTableProvision");
-const invitesModule_1 = require("./models/invitesModule");
 const databaseProvisionModule_1 = require("./models/databaseProvisionModule");
-const namespaceModule_1 = require("./models/namespaceModule");
+const configSecretsModule_1 = require("./models/configSecretsModule");
+const rateLimitMetersModule_1 = require("./models/rateLimitMetersModule");
 const realtimeModule_1 = require("./models/realtimeModule");
 const webauthnAuthModule_1 = require("./models/webauthnAuthModule");
+const functionInvocationModule_1 = require("./models/functionInvocationModule");
+const functionModule_1 = require("./models/functionModule");
+const invitesModule_1 = require("./models/invitesModule");
+const namespaceModule_1 = require("./models/namespaceModule");
 const computeLogModule_1 = require("./models/computeLogModule");
 const inferenceLogModule_1 = require("./models/inferenceLogModule");
 const storageLogModule_1 = require("./models/storageLogModule");
 const transferLogModule_1 = require("./models/transferLogModule");
-const dbUsageModule_1 = require("./models/dbUsageModule");
-const notificationsModule_1 = require("./models/notificationsModule");
 const plansModule_1 = require("./models/plansModule");
-const hierarchyModule_1 = require("./models/hierarchyModule");
-const billingModule_1 = require("./models/billingModule");
 const billingProviderModule_1 = require("./models/billingProviderModule");
-const profilesModule_1 = require("./models/profilesModule");
+const dbUsageModule_1 = require("./models/dbUsageModule");
+const hierarchyModule_1 = require("./models/hierarchyModule");
 const permissionsModule_1 = require("./models/permissionsModule");
+const notificationsModule_1 = require("./models/notificationsModule");
+const profilesModule_1 = require("./models/profilesModule");
+const billingModule_1 = require("./models/billingModule");
 const relationProvision_1 = require("./models/relationProvision");
-const functionModule_1 = require("./models/functionModule");
 const userAuthModule_1 = require("./models/userAuthModule");
 const agentModule_1 = require("./models/agentModule");
 const limitsModule_1 = require("./models/limitsModule");
 const membershipsModule_1 = require("./models/membershipsModule");
+const entityTypeProvision_1 = require("./models/entityTypeProvision");
 const storageModule_1 = require("./models/storageModule");
 const eventsModule_1 = require("./models/eventsModule");
-const entityTypeProvision_1 = require("./models/entityTypeProvision");
 const query_1 = require("./query");
 const mutation_1 = require("./mutation");
 var client_2 = require("./client");
@@ -134,45 +135,46 @@ function createClient(config) {
         usersModule: new usersModule_1.UsersModuleModel(client),
         webauthnCredentialsModule: new webauthnCredentialsModule_1.WebauthnCredentialsModuleModel(client),
         cryptoAddressesModule: new cryptoAddressesModule_1.CryptoAddressesModuleModel(client),
-        identityProvidersModule: new identityProvidersModule_1.IdentityProvidersModuleModel(client),
         denormalizedTableField: new denormalizedTableField_1.DenormalizedTableFieldModel(client),
+        identityProvidersModule: new identityProvidersModule_1.IdentityProvidersModuleModel(client),
         rlsModule: new rlsModule_1.RlsModuleModel(client),
         blueprint: new blueprint_1.BlueprintModel(client),
         blueprintTemplate: new blueprintTemplate_1.BlueprintTemplateModel(client),
         blueprintConstruction: new blueprintConstruction_1.BlueprintConstructionModel(client),
         cryptoAuthModule: new cryptoAuthModule_1.CryptoAuthModuleModel(client),
-        rateLimitMetersModule: new rateLimitMetersModule_1.RateLimitMetersModuleModel(client),
         sessionsModule: new sessionsModule_1.SessionsModuleModel(client),
-        configSecretsModule: new configSecretsModule_1.ConfigSecretsModuleModel(client),
+        secureTableProvision: new secureTableProvision_1.SecureTableProvisionModel(client),
         merkleStoreModule: new merkleStoreModule_1.MerkleStoreModuleModel(client),
         graphModule: new graphModule_1.GraphModuleModel(client),
-        secureTableProvision: new secureTableProvision_1.SecureTableProvisionModel(client),
-        invitesModule: new invitesModule_1.InvitesModuleModel(client),
         databaseProvisionModule: new databaseProvisionModule_1.DatabaseProvisionModuleModel(client),
-        namespaceModule: new namespaceModule_1.NamespaceModuleModel(client),
+        configSecretsModule: new configSecretsModule_1.ConfigSecretsModuleModel(client),
+        rateLimitMetersModule: new rateLimitMetersModule_1.RateLimitMetersModuleModel(client),
         realtimeModule: new realtimeModule_1.RealtimeModuleModel(client),
         webauthnAuthModule: new webauthnAuthModule_1.WebauthnAuthModuleModel(client),
+        functionInvocationModule: new functionInvocationModule_1.FunctionInvocationModuleModel(client),
+        functionModule: new functionModule_1.FunctionModuleModel(client),
+        invitesModule: new invitesModule_1.InvitesModuleModel(client),
+        namespaceModule: new namespaceModule_1.NamespaceModuleModel(client),
         computeLogModule: new computeLogModule_1.ComputeLogModuleModel(client),
         inferenceLogModule: new inferenceLogModule_1.InferenceLogModuleModel(client),
         storageLogModule: new storageLogModule_1.StorageLogModuleModel(client),
         transferLogModule: new transferLogModule_1.TransferLogModuleModel(client),
-        dbUsageModule: new dbUsageModule_1.DbUsageModuleModel(client),
-        notificationsModule: new notificationsModule_1.NotificationsModuleModel(client),
         plansModule: new plansModule_1.PlansModuleModel(client),
-        hierarchyModule: new hierarchyModule_1.HierarchyModuleModel(client),
-        billingModule: new billingModule_1.BillingModuleModel(client),
         billingProviderModule: new billingProviderModule_1.BillingProviderModuleModel(client),
-        profilesModule: new profilesModule_1.ProfilesModuleModel(client),
+        dbUsageModule: new dbUsageModule_1.DbUsageModuleModel(client),
+        hierarchyModule: new hierarchyModule_1.HierarchyModuleModel(client),
         permissionsModule: new permissionsModule_1.PermissionsModuleModel(client),
+        notificationsModule: new notificationsModule_1.NotificationsModuleModel(client),
+        profilesModule: new profilesModule_1.ProfilesModuleModel(client),
+        billingModule: new billingModule_1.BillingModuleModel(client),
         relationProvision: new relationProvision_1.RelationProvisionModel(client),
-        functionModule: new functionModule_1.FunctionModuleModel(client),
         userAuthModule: new userAuthModule_1.UserAuthModuleModel(client),
         agentModule: new agentModule_1.AgentModuleModel(client),
         limitsModule: new limitsModule_1.LimitsModuleModel(client),
         membershipsModule: new membershipsModule_1.MembershipsModuleModel(client),
+        entityTypeProvision: new entityTypeProvision_1.EntityTypeProvisionModel(client),
         storageModule: new storageModule_1.StorageModuleModel(client),
         eventsModule: new eventsModule_1.EventsModuleModel(client),
-        entityTypeProvision: new entityTypeProvision_1.EntityTypeProvisionModel(client),
         query: (0, query_1.createQueryOperations)(client),
         mutation: (0, mutation_1.createMutationOperations)(client),
     };