@pgpm/metaschema-modules 0.26.0 → 0.26.2

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -0,0 +1,55 @@
+-- Deploy schemas/metaschema_modules_public/tables/merkle_store_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.merkle_store_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by BEFORE INSERT trigger)
+    object_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    store_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    commit_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    ref_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table/function prefix (e.g., 'graph' -> graph_object, graph_store, ...)
+    -- Stored normalized (no trailing underscore); underscore added at generation time
+    prefix text NOT NULL DEFAULT '',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Scope field name (column used for multi-tenant isolation)
+    scope_field text NOT NULL DEFAULT 'scope_id',
+
+    -- Timestamps
+    created_at timestamptz NOT NULL DEFAULT now(),
+
+    -- Constraints
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT object_table_fkey FOREIGN KEY (object_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT store_table_fkey FOREIGN KEY (store_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT commit_table_fkey FOREIGN KEY (commit_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT ref_table_fkey FOREIGN KEY (ref_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    -- Only one merkle store module per database + prefix combination
+    CONSTRAINT merkle_store_module_database_prefix_unique UNIQUE (database_id, prefix)
+);
+
+CREATE INDEX merkle_store_module_database_id_idx ON metaschema_modules_public.merkle_store_module ( database_id );
+CREATE INDEX merkle_store_module_private_schema_id_idx ON metaschema_modules_public.merkle_store_module ( private_schema_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -0,0 +1,71 @@
+-- Deploy schemas/metaschema_modules_public/tables/namespace_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.namespace_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    namespaces_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    namespace_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator)
+    namespaces_table_name text NOT NULL DEFAULT 'namespaces',
+    namespace_events_table_name text NOT NULL DEFAULT 'namespace_events',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Multi-tenant namespace identity
+    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+
+    -- Module key discriminator: allows multiple namespace modules per scope.
+    -- 'default' is omitted from table names, any other value becomes
+    -- an infix: {prefix}_{key}_namespaces.
+    -- Max 16 chars, lowercase snake_case.
+    key text NOT NULL DEFAULT 'default',
+
+    -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- When provided, replaces the default policy set in apply_namespace_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (namespaces, namespace_events).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Constraints
+    CONSTRAINT namespace_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_namespaces_table_fkey FOREIGN KEY (namespaces_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_events_table_fkey FOREIGN KEY (namespace_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT namespace_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
+
+-- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
+-- multiple namespace modules for the same scope (e.g. 'config' + 'content').
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, COALESCE(membership_type, -1), key );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/storage_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.storage_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Storage log table (partitioned by snapshot_at)
+  storage_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  storage_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_table_fkey FOREIGN KEY (storage_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT storage_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX storage_log_module_database_id_idx ON metaschema_modules_public.storage_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -23,11 +23,11 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- Multi-tenant storage identity
     membership_type int DEFAULT NULL,              -- NULL = global gate (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
 
-    -- Storage module discriminator: allows multiple storage modules per entity type.
+    -- Module key discriminator: allows multiple storage modules per entity type.
     -- 'default' is omitted from table names (backward compat), any other value becomes
-    -- an infix: {prefix}_{storage_key}_{buckets|files}.
+    -- an infix: {prefix}_{key}_{buckets|files}.
     -- Max 16 chars, lowercase snake_case, cannot be 'buckets'/'files'/'bucket'/'file'.
-    storage_key text NOT NULL DEFAULT 'default',
+    key text NOT NULL DEFAULT 'default',
 
     -- Configurable security policies (NULL = use defaults based on membership_type).
     -- When provided, replaces the default policy set in apply_storage_security.
@@ -35,12 +35,11 @@ CREATE TABLE metaschema_modules_public.storage_module (
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
     policies jsonb NULL,
 
-    -- Per-table skip list for apply_storage_security default policies.
-    -- When a table role name ("files", "buckets") is listed here,
-    -- apply_storage_security skips its default policies for that table.
-    -- Used by entity_type_provision to mark tables whose policies are
-    -- supplied via provisions (secure_table_provision).
-    skip_default_policy_tables text[] NOT NULL DEFAULT '{}',
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (files, buckets).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
 
     -- Entity table for RLS (NULL for app-level storage, entity table for entity-scoped storage)
     entity_table_id uuid NULL,
@@ -101,9 +100,9 @@ CREATE TABLE metaschema_modules_public.storage_module (
 
 CREATE INDEX storage_module_database_id_idx ON metaschema_modules_public.storage_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, storage_key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. storage_key discriminates
+-- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
+-- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
 -- multiple storage modules for the same entity type (e.g. 'default' + 'fn').
-CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1), storage_key );
+CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1), key );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -0,0 +1,44 @@
+-- Deploy schemas/metaschema_modules_public/tables/transfer_log_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.transfer_log_module (
+  id uuid PRIMARY KEY DEFAULT uuidv7(),
+  database_id uuid NOT NULL,
+
+  schema_id uuid NOT NULL DEFAULT uuid_nil(),
+  private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Transfer log table (partitioned by created_at)
+  transfer_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  transfer_log_table_name text NOT NULL DEFAULT '',
+
+  -- Pre-aggregated daily rollup table
+  usage_daily_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  usage_daily_table_name text NOT NULL DEFAULT '',
+
+  -- Partition lifecycle configuration
+  "interval" text NOT NULL DEFAULT '1 month',
+  retention text NOT NULL DEFAULT '12 months',
+  premake int NOT NULL DEFAULT 2,
+
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  scope text NOT NULL DEFAULT 'app',
+  actor_fk_table_id uuid NULL,
+  entity_fk_table_id uuid NULL,
+
+  prefix text NULL,
+
+  CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+  CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_table_fkey FOREIGN KEY (transfer_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT usage_daily_table_fkey FOREIGN KEY (usage_daily_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT transfer_log_module_database_id_prefix_unique UNIQUE NULLS NOT DISTINCT (database_id, prefix)
+);
+
+CREATE INDEX transfer_log_module_database_id_idx ON metaschema_modules_public.transfer_log_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/user_auth_module/table.sql

@@ -19,7 +19,7 @@ CREATE TABLE metaschema_modules_public.user_auth_module (
     session_credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     audits_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    audits_table_name text NOT NULL DEFAULT 'audit_logs',
+    audits_table_name text NOT NULL DEFAULT 'audit_log_auth',
 
     -- api_id uuid NOT NULL REFERENCES services_public.apis (id),
 

package/metaschema-modules.control

@@ -1,6 +1,6 @@
 # metaschema-modules extension
 comment = 'metaschema-modules extension'
-default_version = '0.15.5'
+default_version = '0.26.1'
 module_pathname = '$libdir/metaschema-modules'
 requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'
 relocatable = false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,7 +21,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.26.0",
+    "@pgpm/metaschema-schema": "0.26.2",
     "@pgpm/verify": "0.26.0"
   },
   "devDependencies": {
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "3badf1e5e2fc71deae9e194b779599d17ab28a0d"
+  "gitHead": "d938867e5d7c0e7b2e130a2bdc5d58cd0d5874e1"
 }

package/pgpm.plan

@@ -51,3 +51,13 @@ schemas/metaschema_modules_public/tables/realtime_module/table [schemas/metasche
 schemas/metaschema_modules_public/tables/rate_limit_meters_module/table [schemas/metaschema_modules_public/schema] 2026-05-16T00:00:00Z devin <devin@cognition.ai> # add rate_limit_meters_module for rolling window abuse protection (standalone rate limiting)
 schemas/metaschema_modules_public/tables/config_secrets_org_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T00:00:00Z devin <devin@cognition.ai> # add config_secrets_org_module config table for org-scoped encrypted secrets
 schemas/metaschema_modules_public/tables/inference_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:00:00Z devin <devin@cognition.ai> # add inference_log_module config table for partitioned LLM inference logging
+schemas/metaschema_modules_public/tables/compute_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T20:00:00Z devin <devin@cognition.ai> # add compute_log_module config table for partitioned compute usage logging
+schemas/metaschema_modules_public/tables/transfer_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:00Z devin <devin@cognition.ai> # add transfer_log_module config table for partitioned transfer/bandwidth logging
+schemas/metaschema_modules_public/tables/storage_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:01Z devin <devin@cognition.ai> # add storage_log_module config table for partitioned object storage usage logging
+schemas/metaschema_modules_public/tables/db_usage_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:02Z devin <devin@cognition.ai> # add db_usage_module config table for partitioned database-level usage metrics
+schemas/metaschema_modules_public/tables/agent_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:01:00Z devin <devin@cognition.ai> # add agent_module config table for AI agent conversation threads, messages, and tasks
+schemas/metaschema_modules_public/tables/merkle_store_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T00:00:00Z devin <devin@cognition.ai> # add merkle_store_module config table for content-addressed Merkle object stores
+schemas/metaschema_modules_public/tables/graph_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/merkle_store_module/table] 2026-05-21T01:00:00Z devin <devin@cognition.ai> # add graph_module config table for FBP graph utilities on top of merkle store
+schemas/metaschema_modules_public/tables/namespace_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T02:00:00Z devin <devin@cognition.ai> # add namespace_module config table for entity-aware namespace provisioning
+schemas/metaschema_modules_public/tables/function_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T03:00:00Z devin <devin@cognition.ai> # add function_module config table for entity-aware function definitions
+

package/revert/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/agent_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.agent_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/compute_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/compute_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.compute_log_module;

package/revert/schemas/metaschema_modules_public/tables/db_usage_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/db_usage_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.db_usage_module;

package/revert/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/function_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.function_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/graph_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.graph_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/merkle_store_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.merkle_store_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/namespace_module/table from pg
+
+BEGIN;
+
+DROP TABLE IF EXISTS metaschema_modules_public.namespace_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/storage_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.storage_log_module;

package/revert/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -0,0 +1,3 @@
+-- Revert schemas/metaschema_modules_public/tables/transfer_log_module/table from pg
+
+DROP TABLE IF EXISTS metaschema_modules_public.transfer_log_module;