@pgpm/metaschema-modules 0.21.2 → 0.22.0

package/deploy/schemas/metaschema_modules_public/tables/memberships_module/table.sql

@@ -20,6 +20,10 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     membership_defaults_table_id uuid NOT NULL DEFAULT uuid_nil(),
     membership_defaults_table_name text NOT NULL DEFAULT '',
 
+    -- Nullable: only created when entity_table_id IS NOT NULL (entity-scoped membership types)
+    membership_settings_table_id uuid NULL,
+    membership_settings_table_name text NOT NULL DEFAULT '',
+
     grants_table_id uuid NOT NULL DEFAULT uuid_nil(),
     grants_table_name text NOT NULL DEFAULT '',
 
@@ -54,6 +58,8 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     entity_ids_by_perm text NULL,
     entity_ids_function text NULL,
 
+    member_profiles_table_id uuid NULL,
+
     -- 
      
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
@@ -62,6 +68,7 @@ CREATE TABLE metaschema_modules_public.memberships_module (
 
     CONSTRAINT memberships_table_fkey FOREIGN KEY (memberships_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT membership_defaults_table_fkey FOREIGN KEY (membership_defaults_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT membership_settings_table_fkey FOREIGN KEY (membership_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT members_table_fkey FOREIGN KEY (members_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT grants_table_fkey FOREIGN KEY (grants_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT sprt_table_fkey FOREIGN KEY (sprt_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/notifications_module/table.sql

@@ -0,0 +1,66 @@
+-- Deploy schemas/metaschema_modules_public/tables/notifications_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.notifications_module (
+    id uuid PRIMARY KEY DEFAULT uuid_generate_v4 (),
+    database_id uuid NOT NULL,
+
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    notifications_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    read_state_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    -- Feature-gated tables: NULL when the corresponding has_* flag is off.
+    -- The generator returns NULL for tables it skipped; the insert trigger
+    -- forwards that through unchanged.
+    preferences_table_id uuid,
+    channels_table_id uuid,
+    delivery_log_table_id uuid,
+
+    owner_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional: table_template_module rows to extend with notifs_* columns.
+    -- Resolved at install time; NULL disables the corresponding extension.
+    user_settings_table_id uuid,
+    organization_settings_table_id uuid,
+
+    -- Sub-feature toggles. Resolved at module-generation time so the generated
+    -- schema has zero dead code. Validated by the BEFORE INSERT trigger; see
+    -- insert_notifications_module for dependency rules.
+    has_channels boolean NOT NULL DEFAULT true,
+    has_preferences boolean NOT NULL DEFAULT true,
+    has_settings_extension boolean NOT NULL DEFAULT false,
+    has_digest_metadata boolean NOT NULL DEFAULT false,
+    has_subscriptions boolean NOT NULL DEFAULT false,
+
+    --
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT notifications_table_fkey FOREIGN KEY (notifications_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT read_state_table_fkey FOREIGN KEY (read_state_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT preferences_table_fkey FOREIGN KEY (preferences_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT channels_table_fkey FOREIGN KEY (channels_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT delivery_log_table_fkey FOREIGN KEY (delivery_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT owner_table_fkey FOREIGN KEY (owner_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT user_settings_table_fkey FOREIGN KEY (user_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT organization_settings_table_fkey FOREIGN KEY (organization_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE
+);
+
+COMMENT ON CONSTRAINT schema_fkey ON metaschema_modules_public.notifications_module IS E'@omit manyToMany';
+COMMENT ON CONSTRAINT private_schema_fkey ON metaschema_modules_public.notifications_module IS E'@omit manyToMany';
+COMMENT ON CONSTRAINT notifications_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName notificationsTableByNotificationsTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT read_state_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName readStateTableByReadStateTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT preferences_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName preferencesTableByPreferencesTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT channels_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName channelsTableByChannelsTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT delivery_log_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName deliveryLogTableByDeliveryLogTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT owner_table_fkey ON metaschema_modules_public.notifications_module IS E'@omit manyToMany';
+COMMENT ON CONSTRAINT user_settings_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName userSettingsTableByUserSettingsTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT organization_settings_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName organizationSettingsTableByOrganizationSettingsTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT db_fkey ON metaschema_modules_public.notifications_module IS E'@omit manyToMany';
+CREATE INDEX notifications_module_database_id_idx ON metaschema_modules_public.notifications_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/permissions_module/table.sql

@@ -19,7 +19,29 @@ CREATE TABLE metaschema_modules_public.permissions_module (
     default_table_name text NOT NULL DEFAULT '',
     -- 
      
-    bitlen int NOT NULL DEFAULT 24,
+    -- Default bit-width of the permission mask for this module.
+    --
+    -- Chosen to maximize permission headroom without costing extra storage or
+    -- compute. PostgreSQL lays out heap tuples to MAXALIGN (8 bytes on x86_64),
+    -- so the row-size bucket that holds bit(24) already extends up to bit(64):
+    --
+    --   bitlen | row bytes | heap (1M rows) | btree idx (1M rows)
+    --   -------+-----------+----------------+--------------------
+    --   24     |  67       |  74 MB         |  47 MB
+    --   48     |  70       |  74 MB         |  47 MB
+    --   64     |  72       |  74 MB         |  47 MB   <-- same bucket
+    --   65     |  73       |  81 MB         |  47 MB   <-- next bucket
+    --
+    -- Bitwise AND/OR on bit(<=64) fits in a single 64-bit machine word, so
+    -- permission checks at 64 cost the same as at 24. Raising the default from
+    -- 24 to 64 gives new modules 6.4x more permission slots before anyone has
+    -- to think about running update_bitlen_permissions, at identical storage
+    -- and compute cost. Do not raise past 64 casually -- bit(65+) jumps to the
+    -- next 8-byte tuple bucket (+~10% heap) and pays on every write.
+    --
+    -- Existing databases are unaffected; this only changes the default for
+    -- newly inserted permissions_module rows.
+    bitlen int NOT NULL DEFAULT 64,
     membership_type int NOT NULL,
     -- if this is NOT NULL, then we add entity_id 
     -- e.g. limits to the app itself are considered global owned by app and no explicit owner

package/deploy/schemas/metaschema_modules_public/tables/plans_module/table.sql

@@ -0,0 +1,46 @@
+-- Deploy schemas/metaschema_modules_public/tables/plans_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.plans_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Plans table: defines plan tiers (Free, Pro, Enterprise)
+  plans_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  plans_table_name text NOT NULL DEFAULT '',
+
+  -- Plan limits table: maps plan → limit name → max value
+  plan_limits_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  plan_limits_table_name text NOT NULL DEFAULT '',
+
+  -- Plan pricing table: billing cycles, prices, discounts per plan
+  plan_pricing_table_id uuid NULL,
+
+  -- Plan overrides table: per-entity custom limit overrides
+  plan_overrides_table_id uuid NULL,
+
+  -- Generated apply_plan functions (one per limits scope)
+  apply_plan_function text NOT NULL DEFAULT '',
+  apply_plan_aggregate_function text NOT NULL DEFAULT '',
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT plans_table_fkey FOREIGN KEY (plans_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_limits_table_fkey FOREIGN KEY (plan_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_pricing_table_fkey FOREIGN KEY (plan_pricing_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_overrides_table_fkey FOREIGN KEY (plan_overrides_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plans_module_database_id_unique UNIQUE (database_id)
+);
+
+CREATE INDEX plans_module_database_id_idx ON metaschema_modules_public.plans_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/profiles_module/table.sql

@@ -26,6 +26,10 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     -- Profile definition grants audit table
     profile_definition_grants_table_id uuid NOT NULL DEFAULT uuid_nil(),
     profile_definition_grants_table_name text NOT NULL DEFAULT '',
+
+    -- Profile templates table (for seeding profiles into new entities)
+    profile_templates_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    profile_templates_table_name text NOT NULL DEFAULT '',
     
     membership_type int NOT NULL,
     
@@ -47,6 +51,7 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     CONSTRAINT profile_permissions_table_fkey FOREIGN KEY (profile_permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT profile_grants_table_fkey FOREIGN KEY (profile_grants_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT profile_definition_grants_table_fkey FOREIGN KEY (profile_definition_grants_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT profile_templates_table_fkey FOREIGN KEY (profile_templates_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT actor_table_fkey FOREIGN KEY (actor_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT permissions_table_fkey FOREIGN KEY (permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/realtime_module/table.sql

@@ -0,0 +1,48 @@
+-- Deploy schemas/metaschema_modules_public/tables/realtime_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.realtime_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (populated by the insert trigger)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    subscriptions_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Generated table IDs (populated by the generator)
+    change_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    listener_node_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    source_registry_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Partition lifecycle configuration for change_log
+    retention_hours integer NOT NULL DEFAULT 168,
+    lookahead_hours integer NOT NULL DEFAULT 24,
+    partition_interval text NOT NULL DEFAULT 'hourly',
+
+    -- NOTIFY hybrid wake-up channel name (NULL = use default)
+    notify_channel text NULL,
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT subscriptions_schema_fkey FOREIGN KEY (subscriptions_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT change_log_table_fkey FOREIGN KEY (change_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT listener_node_table_fkey FOREIGN KEY (listener_node_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT source_registry_table_fkey FOREIGN KEY (source_registry_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX realtime_module_database_id_idx ON metaschema_modules_public.realtime_module ( database_id );
+CREATE UNIQUE INDEX realtime_module_unique_per_db ON metaschema_modules_public.realtime_module ( database_id );
+CREATE INDEX realtime_module_schema_id_idx ON metaschema_modules_public.realtime_module ( schema_id );
+CREATE INDEX realtime_module_private_schema_id_idx ON metaschema_modules_public.realtime_module ( private_schema_id );
+CREATE INDEX realtime_module_subscriptions_schema_id_idx ON metaschema_modules_public.realtime_module ( subscriptions_schema_id );
+CREATE INDEX realtime_module_change_log_table_id_idx ON metaschema_modules_public.realtime_module ( change_log_table_id );
+CREATE INDEX realtime_module_listener_node_table_id_idx ON metaschema_modules_public.realtime_module ( listener_node_table_id );
+CREATE INDEX realtime_module_source_registry_table_id_idx ON metaschema_modules_public.realtime_module ( source_registry_table_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/relation_provision/table.sql

@@ -72,28 +72,16 @@ CREATE TABLE metaschema_modules_public.relation_provision (
     nodes jsonb NOT NULL DEFAULT '[]',
 
     -- =========================================================================
-    -- ManyToMany: grants (forwarded to secure_table_provision)
+    -- ManyToMany: grants (forwarded to provision_table)
     -- =========================================================================
 
-    grant_roles text[] NOT NULL DEFAULT ARRAY['authenticated'],
-
-    grant_privileges jsonb[] NOT NULL DEFAULT '{}',
+    grants jsonb NOT NULL DEFAULT '[]',
 
     -- =========================================================================
     -- ManyToMany: RLS policies (forwarded to secure_table_provision)
     -- =========================================================================
 
-    policy_type text DEFAULT NULL,
-
-    policy_privileges text[] DEFAULT NULL,
-
-    policy_role text DEFAULT NULL,
-
-    policy_permissive boolean NOT NULL DEFAULT true,
-
-    policy_name text DEFAULT NULL,
-
-    policy_data jsonb NOT NULL DEFAULT '{}',
+    policies jsonb NOT NULL DEFAULT '[]',
 
     -- =========================================================================
     -- Output columns (populated by the trigger, not set by callers)
@@ -254,41 +242,18 @@ COMMENT ON COLUMN metaschema_modules_public.relation_provision.nodes IS
 -- ManyToMany: grants (forwarded to secure_table_provision)
 -- =============================================================================
 
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.grant_roles IS
-    'For RelationManyToMany: database roles to grant privileges to on the junction table. Forwarded to secure_table_provision as-is. Supports multiple roles, e.g. ARRAY[''authenticated'', ''admin'']. Each role receives all privileges defined in grant_privileges. Defaults to ARRAY[''authenticated'']. Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.grant_privileges IS
-    'For RelationManyToMany: privilege grants for the junction table. Forwarded to secure_table_provision as-is. Format: PostgreSQL array of jsonb [privilege, columns] tuples. Examples: ARRAY[''["select","*"]''::jsonb, ''["insert","*"]''::jsonb] for full access, or ARRAY[''["update",["name","bio"]]''::jsonb] for column-level grants. "*" means all columns. Defaults to ''{}'' (no grants — callers must explicitly specify privileges). Ignored for RelationBelongsTo/RelationHasOne.';
+COMMENT ON COLUMN metaschema_modules_public.relation_provision.grants IS
+    'For RelationManyToMany: array of grant objects for the junction table. Forwarded to provision_table as-is. Each element is a jsonb object with keys: "roles" (text[], required), "privileges" (jsonb[], required — array of [privilege, columns] tuples). Example: [{"roles":["authenticated"],"privileges":[["select","*"],["insert","*"],["delete","*"]]}]. Defaults to ''[]'' (no grants). Ignored for RelationBelongsTo/RelationHasOne.';
 
 -- =============================================================================
 -- ManyToMany: RLS policies (forwarded to secure_table_provision)
 -- =============================================================================
 
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_type IS
-    'For RelationManyToMany: RLS policy type for the junction table. Forwarded to secure_table_provision as-is. The trigger does not interpret or validate this value.
-     Examples: AuthzEntityMembership, AuthzMembership, AuthzAllowAll, AuthzDirectOwner, AuthzOrgHierarchy.
-     NULL means no policy is created — the junction table will have RLS enabled but no policies (unless added separately via secure_table_provision).
-     Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_privileges IS
-    'For RelationManyToMany: privileges the policy applies to, e.g. ARRAY[''select'',''insert'',''delete'']. Forwarded to secure_table_provision as-is. NULL means privileges are derived from the grant_privileges verbs by secure_table_provision. Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_role IS
-    'For RelationManyToMany: database role the policy targets, e.g. ''authenticated''. Forwarded to secure_table_provision as-is. NULL means secure_table_provision falls back to the first role in grant_roles. Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_permissive IS
-    'For RelationManyToMany: whether the policy is PERMISSIVE (true) or RESTRICTIVE (false). Forwarded to secure_table_provision as-is. Defaults to true. Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_name IS
-    'For RelationManyToMany: custom suffix for the generated policy name. Forwarded to secure_table_provision as-is. When NULL and policy_type is set, secure_table_provision auto-derives a suffix from policy_type (e.g. AuthzDirectOwner becomes direct_owner, producing policy names like auth_sel_direct_owner). When explicitly set, used as-is. This ensures multiple policies on the same junction table do not collide. Ignored for RelationBelongsTo/RelationHasOne.';
-
-COMMENT ON COLUMN metaschema_modules_public.relation_provision.policy_data IS
-    'For RelationManyToMany: opaque policy configuration forwarded to secure_table_provision as-is. The trigger does not interpret or validate this value. Structure varies by policy_type. Examples:
-     - AuthzEntityMembership: {"entity_field": "entity_id", "membership_type": 2}
-     - AuthzDirectOwner: {"owner_field": "owner_id"}
-     - AuthzMembership: {"membership_type": 2}
-     Defaults to ''{}'' (empty object).
-     Ignored for RelationBelongsTo/RelationHasOne.';
+COMMENT ON COLUMN metaschema_modules_public.relation_provision.policies IS
+    'For RelationManyToMany: array of policy objects for the junction table. Forwarded to provision_table as-is. Each element is a jsonb object with keys: "$type" (text, required — the Authz* policy generator type), "data" (jsonb, optional — opaque config), "privileges" (text[], optional — e.g. ["select","insert"]; if omitted, derived from grants[] privilege verbs), "policy_role" (text, optional — falls back to first role in first grants[] entry, or ''authenticated''), "permissive" (boolean, optional, defaults to true), "policy_name" (text, optional). Supports multiple policies per row.
+     Example: [{"$type": "AuthzEntityMembership", "data": {"entity_field": "entity_id", "membership_type": 2}, "privileges": ["select", "insert", "delete"]}].
+     Defaults to ''[]'' (no policies — the junction table will have RLS enabled but no policies unless added separately).
+     Ignored for RelationBelongsTo/RelationHasOne/RelationHasMany.';
 
 -- =============================================================================
 -- Output columns

package/deploy/schemas/metaschema_modules_public/tables/secure_table_provision/table.sql

@@ -21,21 +21,9 @@ CREATE TABLE metaschema_modules_public.secure_table_provision (
 
     fields jsonb[] NOT NULL DEFAULT '{}',
 
-    grant_roles text[] NOT NULL DEFAULT ARRAY['authenticated'],
+    grants jsonb NOT NULL DEFAULT '[]',
 
-    grant_privileges jsonb[] NOT NULL DEFAULT '{}',
-
-    policy_type text DEFAULT NULL,
-
-    policy_privileges text[] DEFAULT NULL,
-
-    policy_role text DEFAULT NULL,
-
-    policy_permissive boolean NOT NULL DEFAULT true,
-
-    policy_name text DEFAULT NULL,
-
-    policy_data jsonb NOT NULL DEFAULT '{}',
+    policies jsonb NOT NULL DEFAULT '[]',
 
     out_fields uuid[] DEFAULT NULL,
 
@@ -45,7 +33,7 @@ CREATE TABLE metaschema_modules_public.secure_table_provision (
 );
 
 COMMENT ON TABLE metaschema_modules_public.secure_table_provision IS
-    'Provisions security, fields, grants, and policies onto a table. Each row can independently: (1) create fields via nodes[] array (supporting multiple Data* modules per row), (2) grant privileges via grant_privileges, (3) create RLS policies via policy_type. Multiple rows can target the same table to compose different concerns. All three concerns are optional and independent.';
+    'Provisions security, fields, grants, and policies onto a table. Each row can independently: (1) create fields via nodes[] array (supporting multiple Data* modules per row), (2) grant privileges via grants[] array (supporting per-role privilege targeting), (3) create RLS policies via policies[] array (supporting multiple Authz* policies per row). Multiple rows can target the same table to compose different concerns. All three concerns are optional and independent.';
 
 COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.id IS
     'Unique identifier for this provision row.';
@@ -66,35 +54,16 @@ COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.nodes IS
     'Array of node objects to apply to the table. Each element is a jsonb object with a required "$type" key (one of: DataId, DataDirectOwner, DataEntityMembership, DataOwnershipInEntity, DataTimestamps, DataPeoplestamps, DataPublishable, DataSoftDelete, DataEmbedding, DataFullTextSearch, DataSlug, etc.) and an optional "data" key containing generator-specific configuration. Supports multiple nodes per row, matching the blueprint definition format. Example: [{"$type": "DataId"}, {"$type": "DataTimestamps"}, {"$type": "DataDirectOwner", "data": {"owner_field_name": "author_id"}}]. Defaults to ''[]'' (no node processing).';
 
 COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.use_rls IS
-    'If true and Row Level Security is not yet enabled on the target table, enable it. Automatically set to true by the trigger when policy_type is provided. Defaults to true.';
-
+    'If true and Row Level Security is not yet enabled on the target table, enable it. Automatically set to true by the trigger when policies[] is non-empty. Defaults to true.';
 
 COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.fields IS
     'PostgreSQL array of jsonb field definition objects to create on the target table. Each object has keys: "name" (text, required), "type" (text, required), "default" (text, optional), "is_required" (boolean, optional, defaults to false), "min" (float, optional), "max" (float, optional), "regexp" (text, optional), "index" (boolean, optional, defaults to false — creates a btree index on the field). min/max generate CHECK constraints: for text/citext they constrain character_length, for integer/float types they constrain the value. regexp generates a CHECK (col ~ pattern) constraint for text/citext. Fields are created via metaschema.create_field() after any node_type generator runs, and their IDs are appended to out_fields. Example: ARRAY[''{"name":"username","type":"citext","max":256,"regexp":"^[a-z0-9_]+$"}''::jsonb, ''{"name":"score","type":"integer","min":0,"max":100}''::jsonb]. Defaults to ''{}'' (no additional fields).';
 
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.grant_roles IS
-    'Database roles to grant privileges to. Supports multiple roles, e.g. ARRAY[''authenticated'', ''admin'']. Each role receives all privileges defined in grant_privileges. Defaults to ARRAY[''authenticated''].';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.grant_privileges IS
-    'PostgreSQL array of jsonb [privilege, columns] tuples defining table grants. Examples: ARRAY[''["select","*"]''::jsonb, ''["insert","*"]''::jsonb] for full access, or ARRAY[''["update",["name","bio"]]''::jsonb] for column-level grants. "*" means all columns; an array means column-level grant. Defaults to ''{}'' (no grants — callers must explicitly specify privileges). Type safety is enforced by PostgreSQL at INSERT time.';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_type IS
-    'Policy generator type, e.g. ''AuthzEntityMembership'', ''AuthzMembership'', ''AuthzAllowAll''. NULL means no policy is created. When set, the trigger automatically enables RLS on the target table.';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_privileges IS
-    'Privileges the policy applies to, e.g. ARRAY[''select'',''update'']. NULL means privileges are derived from the grant_privileges verbs.';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_role IS
-    'Role the policy targets. NULL means it falls back to the first role in grant_roles.';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_permissive IS
-    'Whether the policy is PERMISSIVE (true) or RESTRICTIVE (false). Defaults to true.';
-
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_name IS
-    'Custom suffix for the generated policy name. When NULL and policy_type is set, the trigger auto-derives a suffix from policy_type by stripping the Authz prefix and underscoring the remainder (e.g. AuthzDirectOwner becomes direct_owner, producing policy names like auth_sel_direct_owner). When explicitly set, the value is passed through as-is to metaschema.create_policy name parameter. This ensures multiple policies on the same table do not collide (e.g. AuthzDirectOwner + AuthzPublishable each get unique names).';
+COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.grants IS
+    'Array of grant objects defining table privileges. Each element is a jsonb object with keys: "roles" (text[], required — database roles to grant to, e.g. ["authenticated","admin"]), "privileges" (jsonb[], required — array of [privilege, columns] tuples, e.g. [["select","*"],["insert","*"]]). "*" means all columns; an array means column-level grant. Supports per-role privilege targeting: different grant entries can target different roles with different privileges. Example: [{"roles":["authenticated"],"privileges":[["select","*"]]},{"roles":["admin"],"privileges":[["insert","*"],["update","*"],["delete","*"]]}]. Defaults to ''[]'' (no grants). When policies[] omit explicit privileges/policy_role, they fall back to the verbs and first role from grants[].';
 
-COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policy_data IS
-    'Opaque configuration passed through to metaschema.create_policy(). Structure varies by policy_type and is not interpreted by this trigger. Defaults to ''{}''.';
+COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.policies IS
+    'Array of policy objects to create on the target table. Each element is a jsonb object with keys: "$type" (text, required — the Authz* policy generator type, e.g. AuthzEntityMembership, AuthzMembership, AuthzDirectOwner, AuthzPublishable, AuthzAllowAll), "data" (jsonb, optional — opaque configuration passed to metaschema.create_policy(), structure varies by type), "privileges" (text[], optional — privileges the policy applies to, e.g. ["select","insert"]; if omitted, derived from grants[] privilege verbs), "policy_role" (text, optional — role the policy targets; if omitted, falls back to first role in first grants[] entry, or ''authenticated'' if no grants), "permissive" (boolean, optional — PERMISSIVE or RESTRICTIVE; defaults to true), "policy_name" (text, optional — custom suffix for the generated policy name; if omitted, auto-derived from $type by stripping Authz prefix). Supports multiple policies per row. Example: [{"$type": "AuthzEntityMembership", "data": {"entity_field": "owner_id", "membership_type": 3}, "privileges": ["select", "insert"]}, {"$type": "AuthzDirectOwner", "data": {"entity_field": "actor_id"}, "privileges": ["update", "delete"]}]. Defaults to ''[]'' (no policies created). When non-empty, the trigger automatically enables RLS.';
 
 COMMENT ON COLUMN metaschema_modules_public.secure_table_provision.out_fields IS
     'Output column populated by the trigger after field creation. Contains the UUIDs of the metaschema fields created on the target table by this provision row''s nodes. NULL when nodes is empty or before the trigger runs. Callers should not set this directly.';

package/deploy/schemas/metaschema_modules_public/tables/session_secrets_module/table.sql

@@ -0,0 +1,31 @@
+-- Deploy schemas/metaschema_modules_public/tables/session_secrets_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.session_secrets_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+    --
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    table_id uuid NOT NULL DEFAULT uuid_nil(),
+    table_name text NOT NULL DEFAULT 'session_secrets',
+    --
+    sessions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    --
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT sessions_table_fkey FOREIGN KEY (sessions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX session_secrets_module_database_id_idx ON metaschema_modules_public.session_secrets_module ( database_id );
+CREATE INDEX session_secrets_module_schema_id_idx ON metaschema_modules_public.session_secrets_module ( schema_id );
+CREATE INDEX session_secrets_module_table_id_idx ON metaschema_modules_public.session_secrets_module ( table_id );
+CREATE INDEX session_secrets_module_sessions_table_id_idx ON metaschema_modules_public.session_secrets_module ( sessions_table_id );
+
+COMMENT ON TABLE metaschema_modules_public.session_secrets_module IS 'Config row for the session_secrets_module, which provisions a DB-private, session-scoped ephemeral key-value store for challenges, nonces, and one-time tokens that must never be readable by end users.';
+COMMENT ON COLUMN metaschema_modules_public.session_secrets_module.sessions_table_id IS 'Resolved reference to sessions_module.sessions_table, used to FK session_secrets.session_id with ON DELETE CASCADE.';
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -15,16 +15,27 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- Generated table IDs (populated by the generator)
     buckets_table_id uuid NOT NULL DEFAULT uuid_nil(),
     files_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    upload_requests_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- Table names (input to the generator)
     buckets_table_name text NOT NULL DEFAULT 'app_buckets',
     files_table_name text NOT NULL DEFAULT 'app_files',
-    upload_requests_table_name text NOT NULL DEFAULT 'app_upload_requests',
 
     -- Multi-tenant storage identity
     membership_type int DEFAULT NULL,              -- NULL = global gate (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
 
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_storage_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table skip list for apply_storage_security default policies.
+    -- When a table role name ("files", "buckets") is listed here,
+    -- apply_storage_security skips its default policies for that table.
+    -- Used by entity_type_provision to mark tables whose policies are
+    -- supplied via provisions (secure_table_provision).
+    skip_default_policy_tables text[] NOT NULL DEFAULT '{}',
+
     -- Entity table for RLS (NULL for app-level storage, entity table for entity-scoped storage)
     entity_table_id uuid NULL,
 
@@ -36,6 +47,19 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- CORS configuration (NULL = use plugin defaults)
     allowed_origins text[] NULL,                 -- Default CORS origins for all buckets in this database (e.g., ARRAY['https://app.example.com']). ['*'] = open/CDN mode.
 
+    -- Storage permissions: when true, SELECT on files requires read_files permission
+    -- (opt-in restrictive mode for sensitive entity types like data rooms with confidential docs).
+    -- When false (default), any entity member can read all files (baseline = membership).
+    restrict_reads boolean NOT NULL DEFAULT false,
+
+    -- Virtual filesystem + path shares: when true, generates the ltree path column
+    -- on files, the file_path_shares table, and path share RLS policies.
+    -- Enables folder hierarchy, per-folder/file sharing, and version chains.
+    has_path_shares boolean NOT NULL DEFAULT false,
+
+    -- Generated table ID for file_path_shares (populated by the generator when has_path_shares=true)
+    path_shares_table_id uuid NULL DEFAULT NULL,
+
     -- Per-database configurable settings (NULL = use plugin defaults)
     upload_url_expiry_seconds integer NULL,      -- Presigned PUT URL expiry (default: 900 = 15 min)
     download_url_expiry_seconds integer NULL,    -- Presigned GET URL expiry (default: 3600 = 1 hour)
@@ -43,14 +67,28 @@ CREATE TABLE metaschema_modules_public.storage_module (
     max_filename_length integer NULL,            -- Max filename length in chars (default: 1024)
     cache_ttl_seconds integer NULL,              -- LRU cache TTL for this config (default: 300 dev / 3600 prod)
 
+    -- Bulk upload limits (NULL = use plugin defaults)
+    max_bulk_files integer NULL,                 -- Max files per requestBulkUploadUrls batch (default: 100)
+    max_bulk_total_size bigint NULL,             -- Max total size per batch in bytes (default: 1GB = 1073741824)
+
+    -- Feature flags: toggleable storage capabilities (all default false for minimal footprint)
+    has_versioning boolean NOT NULL DEFAULT false,   -- Version chains: previous_version_id, is_latest, version_history()
+    has_content_hash boolean NOT NULL DEFAULT false,  -- Content hash column for dedup + integrity verification
+    has_custom_keys boolean NOT NULL DEFAULT false,   -- allow_custom_keys on buckets (implies has_versioning + has_content_hash)
+    has_audit_log boolean NOT NULL DEFAULT false,     -- File events audit table: upload, delete, move, rename, download, share events
+
+    -- Generated table ID for file_events (populated by the generator when has_audit_log=true)
+    file_events_table_id uuid NULL DEFAULT NULL,
+
     -- Constraints
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT buckets_table_fkey FOREIGN KEY (buckets_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT files_table_fkey FOREIGN KEY (files_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT upload_requests_table_fkey FOREIGN KEY (upload_requests_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+    CONSTRAINT entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT path_shares_table_fkey FOREIGN KEY (path_shares_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT file_events_table_fkey FOREIGN KEY (file_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX storage_module_database_id_idx ON metaschema_modules_public.storage_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/user_auth_module/table.sql

@@ -38,8 +38,8 @@ CREATE TABLE metaschema_modules_public.user_auth_module (
     send_account_deletion_email_function text NOT NULL DEFAULT 'send_account_deletion_email',
     delete_account_function text NOT NULL DEFAULT 'confirm_delete_account',
 
-    sign_in_one_time_token_function text NOT NULL DEFAULT 'sign_in_one_time_token',
-    one_time_token_function text NOT NULL DEFAULT 'one_time_token',
+    sign_in_cross_origin_function text NOT NULL DEFAULT 'sign_in_cross_origin',
+    request_cross_origin_token_function text NOT NULL DEFAULT 'request_cross_origin_token',
     extend_token_expires text NOT NULL DEFAULT 'extend_token_expires',
 
     -- UNIQUE(api_id),

package/deploy/schemas/metaschema_modules_public/tables/webauthn_auth_module/table.sql

@@ -0,0 +1,63 @@
+-- Deploy schemas/metaschema_modules_public/tables/webauthn_auth_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+-- WebAuthn / Passkey auth module config.
+-- Sibling of crypto_auth_module. Registers a `webauthn_challenge` entry in
+-- services_public.api_modules for every authenticated API in the database,
+-- so the Node relying-party (using @simplewebauthn/server) knows where to
+-- read and write passkey challenges + where the credentials table lives.
+--
+-- RP config (rp_id, rp_name, origin_allowlist, attestation_type,
+-- require_user_verification, resident_key) lives on this row (not on
+-- app_auth_settings) because RP identity varies per deployment, not per
+-- user choice.
+--
+-- All fields default to safe passwordless-passkey values per SimpleWebAuthn's
+-- consumer guidance: attestation_type='none', require_user_verification=false,
+-- resident_key='required'.
+CREATE TABLE metaschema_modules_public.webauthn_auth_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    users_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    sessions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    session_credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    session_secrets_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    auth_settings_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Relying Party config. Empty defaults require the caller to populate
+    -- via UPDATE / ALTER on the row before the first registration.
+    rp_id text NOT NULL DEFAULT '',
+    rp_name text NOT NULL DEFAULT '',
+    origin_allowlist text[] NOT NULL DEFAULT '{}',
+
+    -- Consumer defaults per SimpleWebAuthn passkey guidance.
+    attestation_type text NOT NULL DEFAULT 'none'
+        CHECK (attestation_type IN ('none', 'indirect', 'direct', 'enterprise')),
+    require_user_verification boolean NOT NULL DEFAULT false,
+    resident_key text NOT NULL DEFAULT 'required'
+        CHECK (resident_key IN ('discouraged', 'preferred', 'required')),
+
+    -- Challenge TTL (mirrors mfa_challenge_expiry on app_auth_settings).
+    -- 5 minutes matches SimpleWebAuthn's recommended cookie-based TTL.
+    challenge_expiry interval NOT NULL DEFAULT '5 minutes',
+
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT users_table_fkey FOREIGN KEY (users_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT credentials_table_fkey FOREIGN KEY (credentials_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT sessions_table_fkey FOREIGN KEY (sessions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT session_credentials_table_fkey FOREIGN KEY (session_credentials_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT session_secrets_table_fkey FOREIGN KEY (session_secrets_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT auth_settings_table_fkey FOREIGN KEY (auth_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX webauthn_auth_module_database_id_idx ON metaschema_modules_public.webauthn_auth_module ( database_id );
+
+COMMIT;