@pgpm/metaschema-modules 0.23.0 → 0.26.1

package/deploy/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -0,0 +1,68 @@
+-- Deploy schemas/metaschema_modules_public/tables/function_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.function_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    invocations_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    execution_logs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator)
+    definitions_table_name text NOT NULL DEFAULT 'function_definitions',
+    invocations_table_name text NOT NULL DEFAULT 'function_invocations',
+    execution_logs_table_name text NOT NULL DEFAULT 'function_execution_logs',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Multi-tenant function identity
+    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+
+    -- Entity table for RLS (NULL for app-level functions, entity table for entity-scoped functions)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_function_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (definitions, invocations, execution_logs).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Constraints
+    CONSTRAINT function_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_definitions_table_fkey FOREIGN KEY (definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_invocations_table_fkey FOREIGN KEY (invocations_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_execution_logs_table_fkey FOREIGN KEY (execution_logs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX function_module_database_id_idx ON metaschema_modules_public.function_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped.
+-- Only one function module per scope.
+CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, COALESCE(membership_type, -1) );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -0,0 +1,73 @@
+-- Deploy schemas/metaschema_modules_public/tables/graph_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+-- requires: schemas/metaschema_modules_public/tables/merkle_store_module/table
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.graph_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    public_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Table/function prefix (e.g., 'pipeline' -> pipeline_function_graphs, ...)
+    -- Stored normalized (no trailing underscore); underscore added at generation time
+    prefix text NOT NULL DEFAULT '',
+
+    -- Reference to the Merkle store this graph module depends on
+    merkle_store_module_id uuid NOT NULL,
+
+    -- Generated table IDs (populated by BEFORE INSERT trigger)
+    graphs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    executions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    outputs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Scope field name (column used for multi-tenant isolation)
+    scope_field text NOT NULL DEFAULT 'scope_id',
+
+    -- Multi-tenant scoping (entity-aware module pattern)
+    membership_type int DEFAULT NULL,              -- NULL = database-root, non-NULL = entity-scoped
+    entity_table_id uuid NULL,                     -- Entity table for entity-scoped RLS
+
+    -- Configurable security policies (NULL = use defaults).
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (graphs, executions, outputs).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Timestamps
+    created_at timestamptz NOT NULL DEFAULT now(),
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT public_schema_fkey FOREIGN KEY (public_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT merkle_store_fkey FOREIGN KEY (merkle_store_module_id) REFERENCES metaschema_modules_public.merkle_store_module (id) ON DELETE CASCADE,
+    CONSTRAINT graphs_table_fkey FOREIGN KEY (graphs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT executions_table_fkey FOREIGN KEY (executions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT outputs_table_fkey FOREIGN KEY (outputs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT graph_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    -- Only one graph module per database + merkle store combination
+    CONSTRAINT graph_module_database_merkle_unique UNIQUE (database_id, merkle_store_module_id)
+);
+
+CREATE INDEX graph_module_database_id_idx ON metaschema_modules_public.graph_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/inference_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/inference_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.inference_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Inference log table (partitioned by created_at)
+  inference_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  inference_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT inference_log_table_fkey FOREIGN KEY (inference_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT inference_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX inference_log_module_database_id_idx ON metaschema_modules_public.inference_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/limits_module/table.sql

@@ -53,6 +53,14 @@ CREATE TABLE metaschema_modules_public.limits_module (
     -- Resolve cap function (COALESCE lookup: per-entity → default → 0)
     resolve_cap_function text NOT NULL DEFAULT '',
 
+    -- Warning tables for soft-limit notifications
+    limit_warnings_table_id uuid NULL,
+    limit_warning_state_table_id uuid NULL,
+
+    -- Soft limit check functions
+    limit_check_soft_function text NOT NULL DEFAULT '',
+    limit_aggregate_check_soft_function text NOT NULL DEFAULT '',
+
     prefix text NULL,
 
     membership_type int NOT NULL,
@@ -77,7 +85,9 @@ CREATE TABLE metaschema_modules_public.limits_module (
     CONSTRAINT credit_code_items_table_fkey FOREIGN KEY (credit_code_items_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT credit_redemptions_table_fkey FOREIGN KEY (credit_redemptions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT limit_caps_table_fkey FOREIGN KEY (limit_caps_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT limit_caps_defaults_table_fkey FOREIGN KEY (limit_caps_defaults_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+    CONSTRAINT limit_caps_defaults_table_fkey FOREIGN KEY (limit_caps_defaults_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT limit_warnings_table_fkey FOREIGN KEY (limit_warnings_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT limit_warning_state_table_fkey FOREIGN KEY (limit_warning_state_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 
 );
 

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -0,0 +1,50 @@
+-- Deploy schemas/metaschema_modules_public/tables/merkle_store_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.merkle_store_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema reference (if uuid_nil, resolved from public_schema_name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name override (used when schema_id is not provided)
+    public_schema_name text,
+
+    -- Generated table IDs (populated by BEFORE INSERT trigger)
+    object_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    store_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    commit_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    ref_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table/function prefix (e.g., 'graph' -> graph_object, graph_store, ...)
+    -- Stored normalized (no trailing underscore); underscore added at generation time
+    prefix text NOT NULL DEFAULT '',
+
+    -- API name (if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+
+    -- Scope field name (column used for multi-tenant isolation)
+    scope_field text NOT NULL DEFAULT 'scope_id',
+
+    -- Timestamps
+    created_at timestamptz NOT NULL DEFAULT now(),
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT object_table_fkey FOREIGN KEY (object_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT store_table_fkey FOREIGN KEY (store_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT commit_table_fkey FOREIGN KEY (commit_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT ref_table_fkey FOREIGN KEY (ref_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    -- Only one merkle store module per database + prefix combination
+    CONSTRAINT merkle_store_module_database_prefix_unique UNIQUE (database_id, prefix)
+);
+
+CREATE INDEX merkle_store_module_database_id_idx ON metaschema_modules_public.merkle_store_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -0,0 +1,65 @@
+-- Deploy schemas/metaschema_modules_public/tables/namespace_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.namespace_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    namespaces_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    namespace_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator)
+    namespaces_table_name text NOT NULL DEFAULT 'namespaces',
+    namespace_events_table_name text NOT NULL DEFAULT 'namespace_events',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Multi-tenant namespace identity
+    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+
+    -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_namespace_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (namespaces, namespace_events).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Constraints
+    CONSTRAINT namespace_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_namespaces_table_fkey FOREIGN KEY (namespaces_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_events_table_fkey FOREIGN KEY (namespace_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped.
+-- Only one namespace module per scope (unlike storage_module which has storage_key).
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, COALESCE(membership_type, -1) );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/rate_limit_meters_module/table.sql

@@ -0,0 +1,51 @@
+-- Deploy schemas/metaschema_modules_public/tables/rate_limit_meters_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.rate_limit_meters_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  -- Public schema: rate_limit_overrides table (admin-manageable via GraphQL API)
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  -- Private schema: rate_limit_state table, check_rate_limit function (internal)
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- State table: sliding window tracking per entity/actor/meter/window (private)
+  rate_limit_state_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  rate_limit_state_table_name text NOT NULL DEFAULT '',
+
+  -- Overrides table: per-entity and per-actor rate limit overrides (public)
+  rate_limit_overrides_table_id uuid NULL,
+  rate_limit_overrides_table_name text NOT NULL DEFAULT '',
+
+  -- Rate window limits table: per-plan rate limit configuration (public)
+  rate_window_limits_table_id uuid NULL,
+  rate_window_limits_table_name text NOT NULL DEFAULT '',
+
+  -- Generated check function (private)
+  check_rate_limit_function text NOT NULL DEFAULT '',
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT rate_limit_state_table_fkey FOREIGN KEY (rate_limit_state_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT rate_limit_overrides_table_fkey FOREIGN KEY (rate_limit_overrides_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT rate_window_limits_table_fkey FOREIGN KEY (rate_window_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT rate_limit_meters_module_database_id_unique UNIQUE (database_id)
+);
+
+CREATE INDEX rate_limit_meters_module_database_id_idx ON metaschema_modules_public.rate_limit_meters_module ( database_id );
+
+COMMENT ON CONSTRAINT rate_limit_state_table_fkey
+     ON metaschema_modules_public.rate_limit_meters_module IS E'@fieldName rateLimitStateTableByRateLimitStateTableId';
+COMMENT ON CONSTRAINT rate_limit_overrides_table_fkey
+     ON metaschema_modules_public.rate_limit_meters_module IS E'@fieldName rateLimitOverridesTableByRateLimitOverridesTableId';
+COMMENT ON CONSTRAINT rate_window_limits_table_fkey
+     ON metaschema_modules_public.rate_limit_meters_module IS E'@fieldName rateWindowLimitsTableByRateWindowLimitsTableId';
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/realtime_module/table.sql

@@ -20,8 +20,8 @@ CREATE TABLE metaschema_modules_public.realtime_module (
 
     -- Partition lifecycle configuration for change_log
     retention_hours integer NOT NULL DEFAULT 168,
-    lookahead_hours integer NOT NULL DEFAULT 24,
-    partition_interval text NOT NULL DEFAULT 'hourly',
+    premake int NOT NULL DEFAULT 7,
+    "interval" text NOT NULL DEFAULT '1 day',
 
     -- NOTIFY hybrid wake-up channel name (NULL = use default)
     notify_channel text NULL,

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/storage_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.storage_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Storage log table (partitioned by snapshot_at)
+  storage_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  storage_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_table_fkey FOREIGN KEY (storage_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX storage_log_module_database_id_idx ON metaschema_modules_public.storage_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -23,18 +23,23 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- Multi-tenant storage identity
     membership_type int DEFAULT NULL,              -- NULL = global gate (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
 
+    -- Storage module discriminator: allows multiple storage modules per entity type.
+    -- 'default' is omitted from table names (backward compat), any other value becomes
+    -- an infix: {prefix}_{storage_key}_{buckets|files}.
+    -- Max 16 chars, lowercase snake_case, cannot be 'buckets'/'files'/'bucket'/'file'.
+    storage_key text NOT NULL DEFAULT 'default',
+
     -- Configurable security policies (NULL = use defaults based on membership_type).
     -- When provided, replaces the default policy set in apply_storage_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
     policies jsonb NULL,
 
-    -- Per-table skip list for apply_storage_security default policies.
-    -- When a table role name ("files", "buckets") is listed here,
-    -- apply_storage_security skips its default policies for that table.
-    -- Used by entity_type_provision to mark tables whose policies are
-    -- supplied via provisions (secure_table_provision).
-    skip_default_policy_tables text[] NOT NULL DEFAULT '{}',
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (files, buckets).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
 
     -- Entity table for RLS (NULL for app-level storage, entity table for entity-scoped storage)
     entity_table_id uuid NULL,
@@ -76,6 +81,8 @@ CREATE TABLE metaschema_modules_public.storage_module (
     has_content_hash boolean NOT NULL DEFAULT false,  -- Content hash column for dedup + integrity verification
     has_custom_keys boolean NOT NULL DEFAULT false,   -- allow_custom_keys on buckets (implies has_versioning + has_content_hash)
     has_audit_log boolean NOT NULL DEFAULT false,     -- File events audit table: upload, delete, move, rename, download, share events
+    has_confirm_upload boolean NOT NULL DEFAULT false,  -- Deferred HeadObject confirmation: enqueues storage:confirm_upload job on INSERT, creates status transition functions
+    confirm_upload_delay interval NOT NULL DEFAULT '30 seconds',  -- Delay before first confirmation attempt (only used when has_confirm_upload = true)
 
     -- Generated table ID for file_events (populated by the generator when has_audit_log=true)
     file_events_table_id uuid NULL DEFAULT NULL,
@@ -93,8 +100,9 @@ CREATE TABLE metaschema_modules_public.storage_module (
 
 CREATE INDEX storage_module_database_id_idx ON metaschema_modules_public.storage_module ( database_id );
 
--- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
--- NULL membership_type = app-level (only one per database), non-NULL = entity-scoped (one per membership_type per database).
-CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1) );
+-- Unique constraint on (database_id, membership_type, storage_key) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped. storage_key discriminates
+-- multiple storage modules for the same entity type (e.g. 'default' + 'fn').
+CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1), storage_key );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/transfer_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.transfer_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Transfer log table (partitioned by created_at)
+  transfer_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  transfer_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_table_fkey FOREIGN KEY (transfer_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX transfer_log_module_database_id_idx ON metaschema_modules_public.transfer_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/user_auth_module/table.sql

@@ -19,7 +19,7 @@ CREATE TABLE metaschema_modules_public.user_auth_module (
     session_credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     audits_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    audits_table_name text NOT NULL DEFAULT 'audit_logs',
+    audits_table_name text NOT NULL DEFAULT 'audit_log_auth',
 
     -- api_id uuid NOT NULL REFERENCES services_public.apis (id),
 

package/deploy/schemas/metaschema_modules_public/tables/{secrets_module → user_state_module}/table.sql

@@ -1,16 +1,16 @@
--- Deploy schemas/metaschema_modules_public/tables/secrets_module/table to pg
+-- Deploy schemas/metaschema_modules_public/tables/user_state_module/table to pg
 
 -- requires: schemas/metaschema_modules_public/schema
 
 BEGIN;
 
-CREATE TABLE metaschema_modules_public.secrets_module (
+CREATE TABLE metaschema_modules_public.user_state_module (
     id uuid PRIMARY KEY DEFAULT uuidv7(),
     database_id uuid NOT NULL,
     --
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     table_id uuid NOT NULL DEFAULT uuid_nil(),
-    table_name text NOT NULL DEFAULT 'secrets',
+    table_name text NOT NULL DEFAULT 'user_state',
     -- 
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -18,6 +18,6 @@ CREATE TABLE metaschema_modules_public.secrets_module (
 
 );
 
-CREATE INDEX secrets_module_database_id_idx ON metaschema_modules_public.secrets_module ( database_id );
+CREATE INDEX user_state_module_database_id_idx ON metaschema_modules_public.user_state_module ( database_id );
 
 COMMIT;

package/metaschema-modules.control

@@ -1,6 +1,6 @@
 # metaschema-modules extension
 comment = 'metaschema-modules extension'
-default_version = '0.15.5'
+default_version = '0.26.0'
 module_pathname = '$libdir/metaschema-modules'
 requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'
 relocatable = false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.23.0",
+  "version": "0.26.1",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,8 +21,8 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.23.0",
-    "@pgpm/verify": "0.23.0"
+    "@pgpm/metaschema-schema": "0.26.1",
+    "@pgpm/verify": "0.26.0"
   },
   "devDependencies": {
     "pgpm": "^4.23.2"
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "c051ba5f98dd780c1f69e3ac07c2cc870d1c859d"
+  "gitHead": "e1f2e9bec1c91d0751ebe49e9193459191d3c464"
 }