@pgpm/metaschema-modules 0.26.0 → 0.26.1

package/Makefile

@@ -1,5 +1,5 @@
 EXTENSION = metaschema-modules
-DATA = sql/metaschema-modules--0.15.5.sql
+DATA = sql/metaschema-modules--0.26.0.sql
 
 PG_CONFIG = pg_config
 PGXS := $(shell $(PG_CONFIG) --pgxs)

package/deploy/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -0,0 +1,77 @@
+-- Deploy schemas/metaschema_modules_public/tables/agent_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.agent_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  -- Schema references (if uuid_nil, resolved from schema name or default)
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Generated table IDs (populated by the generator)
+  thread_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  message_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  task_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  prompts_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  knowledge_table_id uuid DEFAULT NULL,
+
+  -- Table names (input to the generator)
+  thread_table_name text NOT NULL DEFAULT 'agent_thread',
+  message_table_name text NOT NULL DEFAULT 'agent_message',
+  task_table_name text NOT NULL DEFAULT 'agent_task',
+  prompts_table_name text NOT NULL DEFAULT 'agent_prompt',
+  knowledge_table_name text NOT NULL DEFAULT 'agent_knowledge',
+
+  -- Feature flags
+  has_knowledge boolean NOT NULL DEFAULT false,
+
+  -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+  api_name text DEFAULT 'agent',
+
+  -- Multi-tenant scope
+  membership_type int DEFAULT NULL,
+
+  -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
+  entity_table_id uuid NULL,
+
+  -- Configurable security policies (NULL = use defaults based on membership_type)
+  policies jsonb NULL,
+
+  -- Knowledge RAG config (dimensions, chunk_size, chunk_strategy, search_indexes, etc.)
+  -- NULL = use sensible defaults (768d, 1000 chars, paragraph, bm25)
+  knowledge_config jsonb NULL,
+
+  -- Custom RLS policies for knowledge table (provisions.knowledge.policies)
+  -- NULL = use defaults (AuthzEntityMembership or AuthzAppMembership)
+  knowledge_policies jsonb NULL,
+
+  -- Per-table provisions overrides from blueprint config.
+  -- Keys are table keys (thread, message, task, prompt, knowledge).
+  -- When a key is present, the module trigger skips default security for that table;
+  -- secure_table_provision applies the custom grants/policies instead.
+  provisions jsonb NULL,
+
+  -- Constraints
+  CONSTRAINT agent_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_thread_table_fkey FOREIGN KEY (thread_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_message_table_fkey FOREIGN KEY (message_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_task_table_fkey FOREIGN KEY (task_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_prompts_table_fkey FOREIGN KEY (prompts_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_knowledge_table_fkey FOREIGN KEY (knowledge_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX agent_module_database_id_idx ON metaschema_modules_public.agent_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped.
+-- Only one agent module per scope.
+CREATE UNIQUE INDEX agent_module_unique_scope ON metaschema_modules_public.agent_module ( database_id, COALESCE(membership_type, -1) );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/billing_module/table.sql

@@ -31,6 +31,10 @@ CREATE TABLE metaschema_modules_public.billing_module (
   meter_credits_table_id uuid NOT NULL DEFAULT uuid_nil(),
   meter_credits_table_name text NOT NULL DEFAULT '',
 
+  -- Meter sources table: maps billing meters to typed daily summary table columns
+  meter_sources_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  meter_sources_table_name text NOT NULL DEFAULT '',
+
   -- Generated functions
   record_usage_function text NOT NULL DEFAULT '',
 
@@ -44,6 +48,7 @@ CREATE TABLE metaschema_modules_public.billing_module (
   CONSTRAINT ledger_table_fkey FOREIGN KEY (ledger_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT balances_table_fkey FOREIGN KEY (balances_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT meter_credits_table_fkey FOREIGN KEY (meter_credits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT meter_sources_table_fkey FOREIGN KEY (meter_sources_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT billing_module_database_id_unique UNIQUE (database_id)
 );
 

package/deploy/schemas/metaschema_modules_public/tables/compute_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/compute_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.compute_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Compute log table (partitioned by completed_at)
+  compute_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  compute_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT compute_log_table_fkey FOREIGN KEY (compute_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT compute_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX compute_log_module_database_id_idx ON metaschema_modules_public.compute_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/db_usage_module/table.sql

@@ -0,0 +1,52 @@
+-- Deploy schemas/metaschema_modules_public/tables/db_usage_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.db_usage_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- DB table stats log (partitioned — per-table reads/writes/size from pg_stat_user_tables)
+  table_stats_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  table_stats_log_table_name text NOT NULL DEFAULT '',
+
+  -- DB table stats daily rollup
+  table_stats_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  table_stats_daily_table_name text NOT NULL DEFAULT '',
+
+  -- DB query stats log (partitioned — query execution time from pg_stat_statements)
+  query_stats_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  query_stats_log_table_name text NOT NULL DEFAULT '',
+
+  -- DB query stats daily rollup
+  query_stats_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  query_stats_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage, 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT table_stats_log_table_fkey FOREIGN KEY (table_stats_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT table_stats_daily_table_fkey FOREIGN KEY (table_stats_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT query_stats_log_table_fkey FOREIGN KEY (query_stats_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT query_stats_daily_table_fkey FOREIGN KEY (query_stats_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT db_usage_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX db_usage_module_database_id_idx ON metaschema_modules_public.db_usage_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/entity_type_provision/table.sql

@@ -47,8 +47,6 @@ CREATE TABLE metaschema_modules_public.entity_type_provision (
 
     has_levels boolean NOT NULL DEFAULT false,
 
-    has_storage boolean NOT NULL DEFAULT false,
-
     has_invites boolean NOT NULL DEFAULT false,
 
     has_invite_achievements boolean NOT NULL DEFAULT false,
@@ -56,11 +54,27 @@ CREATE TABLE metaschema_modules_public.entity_type_provision (
     -- =========================================================================
     -- Storage configuration: JSON array of storage module definitions.
     -- Each element provisions a separate storage module with its own tables,
-    -- RLS policies, and feature flags. Only used when has_storage = true.
-    -- NULL = provision a single default storage module with default settings.
+    -- RLS policies, and feature flags. Presence triggers provisioning
+    -- (same inference model as namespaces, functions, agents).
+    -- NULL = do not provision. '[{}]' = provision one default storage module.
+    -- =========================================================================
+
+    storage jsonb DEFAULT NULL,
+
+    -- =========================================================================
+    -- Module configuration arrays: presence triggers provisioning.
+    -- Each is a JSON array of module definitions (like storage).
+    -- NULL = do not provision. '[{}]' = provision one default instance.
+    -- Each element may include "key" (discriminator) and "policies" (override).
     -- =========================================================================
 
-    storage_config jsonb DEFAULT NULL,
+    namespaces jsonb DEFAULT NULL,
+
+    functions jsonb DEFAULT NULL,
+
+    graphs jsonb DEFAULT NULL,
+
+    agents jsonb DEFAULT NULL,
 
     -- =========================================================================
     -- Escape hatch: skip default entity table RLS policies
@@ -107,6 +121,26 @@ CREATE TABLE metaschema_modules_public.entity_type_provision (
 
     out_invites_module_id uuid DEFAULT NULL,
 
+    out_namespace_module_id uuid DEFAULT NULL,
+
+    out_namespaces_table_id uuid DEFAULT NULL,
+
+    out_namespace_events_table_id uuid DEFAULT NULL,
+
+    out_function_module_id uuid DEFAULT NULL,
+
+    out_definitions_table_id uuid DEFAULT NULL,
+
+    out_invocations_table_id uuid DEFAULT NULL,
+
+    out_execution_logs_table_id uuid DEFAULT NULL,
+
+    out_graph_module_id uuid DEFAULT NULL,
+
+    out_graphs_table_id uuid DEFAULT NULL,
+
+    out_agent_module_id uuid DEFAULT NULL,
+
     -- =========================================================================
     -- Constraints
     -- =========================================================================
@@ -205,20 +239,14 @@ COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.has_levels IS
      Levels provide gamification/achievement tracking for members.
      When true, creates level steps, achievements, and level tables with security.';
 
-COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.has_storage IS
-    'Whether to provision storage_module for this type. Defaults to false.
-     When true, creates {prefix}_buckets and {prefix}_files tables
-     with entity-scoped RLS (AuthzEntityMembership) using the entity''s membership_type.
-     Storage tables get owner_id FK to the entity table, so files are owned by the entity.';
-
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.has_invites IS
     'Whether to provision invites_module for this type. Defaults to false.
      When true, the trigger inserts a row into invites_module which in turn
      (via insert_invites_module BEFORE INSERT) creates {prefix}_invites and
      {prefix}_claimed_invites tables plus the submit_{prefix}_invite_code() function.
-     Symmetric counterpart of has_storage. Re-provisioning is idempotent: the
-     UNIQUE (database_id, membership_type) constraint on invites_module combined with
-     ON CONFLICT DO NOTHING in the fan-out makes repeated INSERTs safe.';
+     Re-provisioning is idempotent: the UNIQUE (database_id, membership_type) constraint
+     on invites_module combined with ON CONFLICT DO NOTHING in the fan-out makes
+     repeated INSERTs safe.';
 
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.has_invite_achievements IS
     'Whether to auto-attach an EventTracker to the claimed_invites table for invite-based
@@ -296,11 +324,12 @@ COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_installed_
     'Output: array of installed module labels (e.g. ARRAY[''permissions_module:data_room'', ''memberships_module:data_room'', ''invites_module:data_room'']).
      Populated by the trigger. Useful for verifying which modules were provisioned.';
 
-COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.storage_config IS
-    'Optional JSON array of storage module definitions. Each element provisions a separate
-     storage module with its own tables ({prefix}_{storage_key}_buckets/files), RLS policies,
-     and feature flags. Only used when has_storage = true; ignored otherwise.
-     NULL = provision a single default storage module with all defaults.
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.storage IS
+    'Optional JSON array of storage module definitions. Presence triggers provisioning
+     (same inference model as namespaces, functions, agents).
+     Each element provisions a separate storage module with its own tables
+     ({prefix}_{storage_key}_buckets/files), RLS policies, and feature flags.
+     NULL = do not provision storage. ''[{}]'' = provision one default storage module.
      Each array element recognizes (all optional):
        - storage_key                   (text) module discriminator, max 16 chars, lowercase snake_case.
                                               Defaults to ''default'' (omitted from table names).
@@ -322,22 +351,68 @@ COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.storage_config
        - provisions                    (jsonb object) per-table customization keyed by "files" or "buckets".
                                               Each value: { nodes, fields, grants, use_rls, policies }.
      Example (single module, backward compat):
-       storage_config := ''[{"buckets": [{"name": "documents"}]}]''::jsonb
+       storage := ''[{"buckets": [{"name": "documents"}]}]''::jsonb
      Example (multi-module):
-       storage_config := ''[{"has_path_shares": true, "buckets": [{"name": "documents"}]}, {"storage_key": "fn", "has_custom_keys": true, "buckets": [{"name": "functions"}]}]''::jsonb';
+       storage := ''[{"has_path_shares": true, "buckets": [{"name": "documents"}]}, {"storage_key": "fn", "has_custom_keys": true, "buckets": [{"name": "functions"}]}]''::jsonb';
 
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_storage_module_id IS
-    'Output: the UUID of the storage_module row created for this entity type. Populated by the trigger when has_storage=true.';
+    'Output: the UUID of the storage_module row created for this entity type. Populated by the trigger when storage is non-NULL and non-empty.';
 
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_buckets_table_id IS
-    'Output: the UUID of the generated buckets table (e.g. data_room_buckets). Populated by the trigger when has_storage=true.';
+    'Output: the UUID of the generated buckets table (e.g. data_room_buckets). Populated by the trigger when storage is non-NULL and non-empty.';
 
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_files_table_id IS
-    'Output: the UUID of the generated files table (e.g. data_room_files). Populated by the trigger when has_storage=true.';
+    'Output: the UUID of the generated files table (e.g. data_room_files). Populated by the trigger when storage is non-NULL and non-empty.';
 
 COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_invites_module_id IS
     'Output: the UUID of the invites_module row created for this entity type. Populated by the trigger when has_invites=true.
      NULL when has_invites=false, or when re-provisioning hits ON CONFLICT DO NOTHING
      (i.e. the invites_module row was created in a previous run).';
 
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.namespaces IS
+    'Optional JSON array of namespace module definitions. Presence triggers provisioning.
+     NULL = do not provision namespaces. ''[{}]'' = provision one default namespace module.
+     Each element recognizes (all optional):
+       - key       (text) module discriminator. Defaults to ''default''.
+       - policies  (jsonb array) RLS policy overrides. NULL = apply defaults from apply_namespace_security().
+     Creates {prefix}_namespaces (or {prefix}_{key}_namespaces for non-default keys)
+     with entity-scoped RLS (AuthzEntityMembership) and a rename proxy trigger.
+     Registers manage_namespaces permission bit on first provision.
+     Example: namespaces := ''[{}]''::jsonb';
+
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.functions IS
+    'Optional JSON array of function module definitions. Presence triggers provisioning.
+     NULL = do not provision functions. ''[{}]'' = provision one default function module.
+     Each element recognizes (all optional):
+       - key       (text) module discriminator. Defaults to ''default''.
+       - policies  (jsonb array) RLS policy overrides. NULL = apply defaults from apply_function_security().
+     Creates {prefix}_function_definitions (or {prefix}_{key}_function_definitions for non-default keys)
+     with entity-scoped RLS and a job trigger dispatching function:provision tasks.
+     Registers manage_functions + invoke_functions permission bits on first provision.
+     Example: functions := ''[{}]''::jsonb';
+
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.graphs IS
+    'Optional JSON array of graph module definitions. Presence triggers provisioning.
+     NULL = do not provision graphs. ''[{}]'' = provision one default graph module.
+     Each element recognizes (all optional):
+       - key       (text) module discriminator. Defaults to ''default''.
+       - policies  (jsonb array) RLS policy overrides. NULL = apply defaults from apply_graph_security().
+     Registers manage_graphs + execute_graphs permission bits on first provision.
+     Graph module requires a merkle_store_module_id dependency, so entity_type_provision
+     only registers permissions here. The graph module itself must be provisioned
+     separately with the merkle store dependency resolved.
+     Example: graphs := ''[{}]''::jsonb';
+
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_namespace_module_id IS
+    'Output: the UUID of the namespace_module row created (or found) for this entity type.
+     Populated by the trigger when namespaces is non-NULL. NULL otherwise.';
+
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_namespaces_table_id IS
+    'Output: the UUID of the generated namespaces table (e.g. data_room_namespaces).
+     Populated by the trigger when namespaces is non-NULL. NULL otherwise.';
+
+COMMENT ON COLUMN metaschema_modules_public.entity_type_provision.out_namespace_events_table_id IS
+    'Output: the UUID of the generated namespace_events partitioned table (e.g. data_room_namespace_events).
+     Monthly partitioned, 12-month retention. Populated by the trigger when namespaces is non-NULL. NULL otherwise.';
+
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -0,0 +1,68 @@
+-- Deploy schemas/metaschema_modules_public/tables/function_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.function_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    invocations_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    execution_logs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator)
+    definitions_table_name text NOT NULL DEFAULT 'function_definitions',
+    invocations_table_name text NOT NULL DEFAULT 'function_invocations',
+    execution_logs_table_name text NOT NULL DEFAULT 'function_execution_logs',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Multi-tenant function identity
+    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+
+    -- Entity table for RLS (NULL for app-level functions, entity table for entity-scoped functions)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_function_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (definitions, invocations, execution_logs).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Constraints
+    CONSTRAINT function_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_definitions_table_fkey FOREIGN KEY (definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_invocations_table_fkey FOREIGN KEY (invocations_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_execution_logs_table_fkey FOREIGN KEY (execution_logs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX function_module_database_id_idx ON metaschema_modules_public.function_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped.
+-- Only one function module per scope.
+CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, COALESCE(membership_type, -1) );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -0,0 +1,73 @@
+-- Deploy schemas/metaschema_modules_public/tables/graph_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+-- requires: schemas/metaschema_modules_public/tables/merkle_store_module/table
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.graph_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    public_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Table/function prefix (e.g., 'pipeline' -> pipeline_function_graphs, ...)
+    -- Stored normalized (no trailing underscore); underscore added at generation time
+    prefix text NOT NULL DEFAULT '',
+
+    -- Reference to the Merkle store this graph module depends on
+    merkle_store_module_id uuid NOT NULL,
+
+    -- Generated table IDs (populated by BEFORE INSERT trigger)
+    graphs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    executions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    outputs_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Scope field name (column used for multi-tenant isolation)
+    scope_field text NOT NULL DEFAULT 'scope_id',
+
+    -- Multi-tenant scoping (entity-aware module pattern)
+    membership_type int DEFAULT NULL,              -- NULL = database-root, non-NULL = entity-scoped
+    entity_table_id uuid NULL,                     -- Entity table for entity-scoped RLS
+
+    -- Configurable security policies (NULL = use defaults).
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (graphs, executions, outputs).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Timestamps
+    created_at timestamptz NOT NULL DEFAULT now(),
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT public_schema_fkey FOREIGN KEY (public_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT merkle_store_fkey FOREIGN KEY (merkle_store_module_id) REFERENCES metaschema_modules_public.merkle_store_module (id) ON DELETE CASCADE,
+    CONSTRAINT graphs_table_fkey FOREIGN KEY (graphs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT executions_table_fkey FOREIGN KEY (executions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT outputs_table_fkey FOREIGN KEY (outputs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT graph_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    -- Only one graph module per database + merkle store combination
+    CONSTRAINT graph_module_database_merkle_unique UNIQUE (database_id, merkle_store_module_id)
+);
+
+CREATE INDEX graph_module_database_id_idx ON metaschema_modules_public.graph_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/inference_log_module/table.sql

@@ -21,9 +21,14 @@ CREATE TABLE metaschema_modules_public.inference_log_module (
 
   -- Partition lifecycle configuration
   "interval" text NOT NULL DEFAULT '1 month',
-  retention text NULL,
+  retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
   prefix text NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
@@ -31,7 +36,7 @@ CREATE TABLE metaschema_modules_public.inference_log_module (
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT inference_log_table_fkey FOREIGN KEY (inference_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-  CONSTRAINT inference_log_module_database_id_unique UNIQUE (database_id)
+  CONSTRAINT inference_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
 );
 
 CREATE INDEX inference_log_module_database_id_idx ON metaschema_modules_public.inference_log_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -0,0 +1,50 @@
+-- Deploy schemas/metaschema_modules_public/tables/merkle_store_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.merkle_store_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema reference (if uuid_nil, resolved from public_schema_name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name override (used when schema_id is not provided)
+    public_schema_name text,
+
+    -- Generated table IDs (populated by BEFORE INSERT trigger)
+    object_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    store_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    commit_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    ref_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table/function prefix (e.g., 'graph' -> graph_object, graph_store, ...)
+    -- Stored normalized (no trailing underscore); underscore added at generation time
+    prefix text NOT NULL DEFAULT '',
+
+    -- API name (if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+
+    -- Scope field name (column used for multi-tenant isolation)
+    scope_field text NOT NULL DEFAULT 'scope_id',
+
+    -- Timestamps
+    created_at timestamptz NOT NULL DEFAULT now(),
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT object_table_fkey FOREIGN KEY (object_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT store_table_fkey FOREIGN KEY (store_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT commit_table_fkey FOREIGN KEY (commit_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT ref_table_fkey FOREIGN KEY (ref_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    -- Only one merkle store module per database + prefix combination
+    CONSTRAINT merkle_store_module_database_prefix_unique UNIQUE (database_id, prefix)
+);
+
+CREATE INDEX merkle_store_module_database_id_idx ON metaschema_modules_public.merkle_store_module ( database_id );
+
+COMMIT;