@pgpm/metaschema-modules 0.26.0 → 0.26.1

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -0,0 +1,65 @@
+-- Deploy schemas/metaschema_modules_public/tables/namespace_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.namespace_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    namespaces_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    namespace_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator)
+    namespaces_table_name text NOT NULL DEFAULT 'namespaces',
+    namespace_events_table_name text NOT NULL DEFAULT 'namespace_events',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Multi-tenant namespace identity
+    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+
+    -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_namespace_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (namespaces, namespace_events).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Constraints
+    CONSTRAINT namespace_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_namespaces_table_fkey FOREIGN KEY (namespaces_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_events_table_fkey FOREIGN KEY (namespace_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped.
+-- Only one namespace module per scope (unlike storage_module which has storage_key).
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, COALESCE(membership_type, -1) );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/storage_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.storage_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Storage log table (partitioned by snapshot_at)
+  storage_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  storage_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_table_fkey FOREIGN KEY (storage_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX storage_log_module_database_id_idx ON metaschema_modules_public.storage_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -35,12 +35,11 @@ CREATE TABLE metaschema_modules_public.storage_module (
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
     policies jsonb NULL,
 
-    -- Per-table skip list for apply_storage_security default policies.
-    -- When a table role name ("files", "buckets") is listed here,
-    -- apply_storage_security skips its default policies for that table.
-    -- Used by entity_type_provision to mark tables whose policies are
-    -- supplied via provisions (secure_table_provision).
-    skip_default_policy_tables text[] NOT NULL DEFAULT '{}',
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (files, buckets).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
 
     -- Entity table for RLS (NULL for app-level storage, entity table for entity-scoped storage)
     entity_table_id uuid NULL,

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/transfer_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.transfer_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Transfer log table (partitioned by created_at)
+  transfer_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  transfer_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_table_fkey FOREIGN KEY (transfer_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX transfer_log_module_database_id_idx ON metaschema_modules_public.transfer_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/user_auth_module/table.sql

@@ -19,7 +19,7 @@ CREATE TABLE metaschema_modules_public.user_auth_module (
     session_credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     audits_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    audits_table_name text NOT NULL DEFAULT 'audit_logs',
+    audits_table_name text NOT NULL DEFAULT 'audit_log_auth',
 
     -- api_id uuid NOT NULL REFERENCES services_public.apis (id),
 

package/metaschema-modules.control

@@ -1,6 +1,6 @@
 # metaschema-modules extension
 comment = 'metaschema-modules extension'
-default_version = '0.15.5'
+default_version = '0.26.0'
 module_pathname = '$libdir/metaschema-modules'
 requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'
 relocatable = false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,7 +21,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.26.0",
+    "@pgpm/metaschema-schema": "0.26.1",
     "@pgpm/verify": "0.26.0"
   },
   "devDependencies": {
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "3badf1e5e2fc71deae9e194b779599d17ab28a0d"
+  "gitHead": "e1f2e9bec1c91d0751ebe49e9193459191d3c464"
 }

package/pgpm.plan

@@ -51,3 +51,12 @@ schemas/metaschema_modules_public/tables/realtime_module/table [schemas/metasche
 schemas/metaschema_modules_public/tables/rate_limit_meters_module/table [schemas/metaschema_modules_public/schema] 2026-05-16T00:00:00Z devin <devin@cognition.ai> # add rate_limit_meters_module for rolling window abuse protection (standalone rate limiting)
 schemas/metaschema_modules_public/tables/config_secrets_org_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T00:00:00Z devin <devin@cognition.ai> # add config_secrets_org_module config table for org-scoped encrypted secrets
 schemas/metaschema_modules_public/tables/inference_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:00:00Z devin <devin@cognition.ai> # add inference_log_module config table for partitioned LLM inference logging
+schemas/metaschema_modules_public/tables/compute_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T20:00:00Z devin <devin@cognition.ai> # add compute_log_module config table for partitioned compute usage logging
+schemas/metaschema_modules_public/tables/transfer_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:00Z devin <devin@cognition.ai> # add transfer_log_module config table for partitioned transfer/bandwidth logging
+schemas/metaschema_modules_public/tables/storage_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:01Z devin <devin@cognition.ai> # add storage_log_module config table for partitioned object storage usage logging
+schemas/metaschema_modules_public/tables/db_usage_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:02Z devin <devin@cognition.ai> # add db_usage_module config table for partitioned database-level usage metrics
+schemas/metaschema_modules_public/tables/agent_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:01:00Z devin <devin@cognition.ai> # add agent_module config table for AI agent conversation threads, messages, and tasks
+schemas/metaschema_modules_public/tables/merkle_store_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T00:00:00Z devin <devin@cognition.ai> # add merkle_store_module config table for content-addressed Merkle object stores
+schemas/metaschema_modules_public/tables/graph_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/merkle_store_module/table] 2026-05-21T01:00:00Z devin <devin@cognition.ai> # add graph_module config table for FBP graph utilities on top of merkle store
+schemas/metaschema_modules_public/tables/namespace_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T02:00:00Z devin <devin@cognition.ai> # add namespace_module config table for entity-aware namespace provisioning
+schemas/metaschema_modules_public/tables/function_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T03:00:00Z devin <devin@cognition.ai> # add function_module config table for entity-aware function definitions

package/revert/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/agent_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.agent_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/compute_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/compute_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.compute_log_module;

package/revert/schemas/metaschema_modules_public/tables/db_usage_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/db_usage_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.db_usage_module;

package/revert/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/function_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.function_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/graph_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.graph_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/merkle_store_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.merkle_store_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/namespace_module/table from pg
+
+BEGIN;
+
+DROP TABLE IF EXISTS metaschema_modules_public.namespace_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/storage_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.storage_log_module;

package/revert/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/transfer_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.transfer_log_module;