@pgpm/metaschema-modules 0.26.2 → 0.26.5

package/Makefile

@@ -1,5 +1,5 @@
 EXTENSION = metaschema-modules
-DATA = sql/metaschema-modules--0.26.1.sql
+DATA = sql/metaschema-modules--0.26.3.sql
 
 PG_CONFIG = pg_config
 PGXS := $(shell $(PG_CONFIG) --pgxs)

package/deploy/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -17,43 +17,49 @@ CREATE TABLE metaschema_modules_public.agent_module (
   message_table_id uuid NOT NULL DEFAULT uuid_nil(),
   task_table_id uuid NOT NULL DEFAULT uuid_nil(),
   prompts_table_id uuid NOT NULL DEFAULT uuid_nil(),
-  knowledge_table_id uuid DEFAULT NULL,
+  plan_table_id uuid DEFAULT NULL,
+  agent_table_id uuid DEFAULT NULL,
+  persona_table_id uuid DEFAULT NULL,
+  resource_table_id uuid DEFAULT NULL,
 
   -- Table names (input to the generator)
   thread_table_name text NOT NULL DEFAULT 'agent_thread',
   message_table_name text NOT NULL DEFAULT 'agent_message',
   task_table_name text NOT NULL DEFAULT 'agent_task',
   prompts_table_name text NOT NULL DEFAULT 'agent_prompt',
-  knowledge_table_name text NOT NULL DEFAULT 'agent_knowledge',
+  plan_table_name text NOT NULL DEFAULT 'agent_plan',
+  agent_table_name text NOT NULL DEFAULT 'agent',
+  persona_table_name text NOT NULL DEFAULT 'agent_persona',
+  resource_table_name text NOT NULL DEFAULT 'agent_resource',
 
   -- Feature flags
-  has_knowledge boolean NOT NULL DEFAULT false,
+  has_plans boolean NOT NULL DEFAULT false,
+  has_resources boolean NOT NULL DEFAULT false,
+  has_agents boolean NOT NULL DEFAULT false,
+  shared boolean NOT NULL DEFAULT false,
 
-  -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+  -- API routing (configurable per-module)
   api_name text DEFAULT 'agent',
+  private_api_name text DEFAULT NULL,
 
-  -- Multi-tenant scope
-  membership_type int DEFAULT NULL,
+  -- Scope: determines the security level for this module instance.
+  -- Resolved to a membership_type integer at trigger time via membership_types table.
+  scope text NOT NULL DEFAULT 'app',
 
-  -- Module key discriminator: allows multiple agent modules per scope.
-  -- 'default' is omitted from table names, any other value becomes
-  -- an infix: {prefix}_{key}_agent_thread.
-  -- Max 16 chars, lowercase snake_case.
-  key text NOT NULL DEFAULT 'default',
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  -- Override to create multiple module instances at the same scope.
+  prefix text NOT NULL DEFAULT '',
 
   -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
   entity_table_id uuid NULL,
 
-  -- Configurable security policies (NULL = use defaults based on membership_type)
+  -- Configurable security policies (NULL = use defaults based on scope)
   policies jsonb NULL,
 
-  -- Knowledge RAG config (dimensions, chunk_size, chunk_strategy, search_indexes, etc.)
-  -- NULL = use sensible defaults (768d, 1000 chars, paragraph, bm25)
-  knowledge_config jsonb NULL,
-
-  -- Custom RLS policies for knowledge table (provisions.knowledge.policies)
-  -- NULL = use defaults (AuthzEntityMembership or AuthzAppMembership)
-  knowledge_policies jsonb NULL,
+  -- Resource configuration array (dimensions, chunk_size, chunk_strategy, etc.)
+  -- NULL = use sensible defaults (768d, 1000 chunk_size, paragraph strategy)
+  -- Example: [{"dimensions": 1536, "chunk_size": 500, "chunk_strategy": "sentence"}]
+  resources jsonb NULL,
 
   -- Per-table provisions overrides from blueprint config.
   -- Keys are table keys (thread, message, task, prompt, knowledge).
@@ -61,6 +67,10 @@ CREATE TABLE metaschema_modules_public.agent_module (
   -- secure_table_provision applies the custom grants/policies instead.
   provisions jsonb NULL,
 
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
   -- Constraints
   CONSTRAINT agent_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -69,15 +79,16 @@ CREATE TABLE metaschema_modules_public.agent_module (
   CONSTRAINT agent_module_message_table_fkey FOREIGN KEY (message_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_task_table_fkey FOREIGN KEY (task_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_prompts_table_fkey FOREIGN KEY (prompts_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-  CONSTRAINT agent_module_knowledge_table_fkey FOREIGN KEY (knowledge_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_plan_table_fkey FOREIGN KEY (plan_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_agent_table_fkey FOREIGN KEY (agent_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_persona_table_fkey FOREIGN KEY (persona_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_resource_table_fkey FOREIGN KEY (resource_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX agent_module_database_id_idx ON metaschema_modules_public.agent_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple agent modules for the same scope (e.g. 'support' + 'internal').
-CREATE UNIQUE INDEX agent_module_unique_scope ON metaschema_modules_public.agent_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one agent module per database per scope per prefix.
+CREATE UNIQUE INDEX agent_module_unique_scope ON metaschema_modules_public.agent_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/billing_module/table.sql

@@ -35,11 +35,23 @@ CREATE TABLE metaschema_modules_public.billing_module (
   meter_sources_table_id uuid NOT NULL DEFAULT uuid_nil(),
   meter_sources_table_name text NOT NULL DEFAULT '',
 
+  -- Meter defaults table: app-scope default meter catalog seeded at provision time
+  meter_defaults_table_id uuid NOT NULL DEFAULT uuid_nil(),
+  meter_defaults_table_name text NOT NULL DEFAULT '',
+
   -- Generated functions
   record_usage_function text NOT NULL DEFAULT '',
 
   prefix text NULL,
 
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -49,6 +61,7 @@ CREATE TABLE metaschema_modules_public.billing_module (
   CONSTRAINT balances_table_fkey FOREIGN KEY (balances_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT meter_credits_table_fkey FOREIGN KEY (meter_credits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT meter_sources_table_fkey FOREIGN KEY (meter_sources_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT meter_defaults_table_fkey FOREIGN KEY (meter_defaults_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT billing_module_database_id_unique UNIQUE (database_id)
 );
 

package/deploy/schemas/metaschema_modules_public/tables/billing_provider_module/table.sql

@@ -42,6 +42,10 @@ CREATE TABLE metaschema_modules_public.billing_provider_module (
 
   prefix text NULL,
 
+  -- API routing (configurable per-module)
+  api_name text DEFAULT NULL,
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/compute_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.compute_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_module/table.sql

@@ -0,0 +1,82 @@
+-- Deploy schemas/metaschema_modules_public/tables/config_secrets_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.config_secrets_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (resolved by BEFORE INSERT trigger when uuid_nil)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Generated table IDs (populated by the generator)
+    table_id uuid NOT NULL DEFAULT uuid_nil(),
+    config_definitions_table_id uuid NULL DEFAULT NULL,
+
+    -- Table name (input — bare name without scope prefix).
+    -- The trigger prepends the scope prefix automatically.
+    table_name text NOT NULL DEFAULT 'secrets',
+
+    -- API routing (get-or-create: if set, schema is added to this API)
+    api_name text DEFAULT 'config',
+    private_api_name text DEFAULT NULL,
+
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    -- 'app' = app-level (AuthzAppMembership, admin-only secrets + config)
+    -- 'org' = org-scoped (AuthzEntityMembership, per-org secrets with manage_secrets permission)
+    -- custom entity type names for entity-scoped secrets
+    -- Note: user-scoped credentials are handled by user_credentials_module (separate module)
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
+    entity_table_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on scope).
+    -- When provided, replaces the default policy set in the security function.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (secrets, config_definitions).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Feature flags
+
+    -- When true, also creates a plaintext config table ({prefix}_config) and
+    -- a config definitions registry table ({prefix}_config_definitions).
+    -- Only meaningful for app-level scope (scope = 'app').
+    has_config boolean NOT NULL DEFAULT false,
+
+    -- Constraints
+    CONSTRAINT config_secrets_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT config_secrets_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT config_secrets_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT config_secrets_module_table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT config_secrets_module_config_defs_table_fkey FOREIGN KEY (config_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT config_secrets_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX config_secrets_module_database_id_idx ON metaschema_modules_public.config_secrets_module ( database_id );
+CREATE INDEX config_secrets_module_schema_id_idx ON metaschema_modules_public.config_secrets_module ( schema_id );
+CREATE INDEX config_secrets_module_table_id_idx ON metaschema_modules_public.config_secrets_module ( table_id );
+
+-- Unique constraint: one config_secrets module per database per scope per prefix.
+CREATE UNIQUE INDEX config_secrets_module_unique_scope ON metaschema_modules_public.config_secrets_module ( database_id, scope, prefix );
+
+COMMENT ON TABLE metaschema_modules_public.config_secrets_module IS
+    'Entity-aware PGP-encrypted key-value config/secrets module. Supports app-level (admin-only)
+     and org-scoped (per-org secrets with manage_secrets permission) via the scope column.
+     User-scoped bcrypt credentials are handled by user_credentials_module.';
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_org_module/table.sql

@@ -14,6 +14,10 @@ CREATE TABLE metaschema_modules_public.config_secrets_org_module (
     table_name text NOT NULL DEFAULT 'org_secrets',
     --
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'config',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_user_module/table.sql

@@ -17,6 +17,10 @@ CREATE TABLE metaschema_modules_public.config_secrets_user_module (
     config_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
     -- 
     
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'config',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/connected_accounts_module/table.sql

@@ -16,6 +16,10 @@ CREATE TABLE metaschema_modules_public.connected_accounts_module (
 
     table_name text NOT NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/crypto_addresses_module/table.sql

@@ -17,6 +17,10 @@ CREATE TABLE metaschema_modules_public.crypto_addresses_module (
     table_name text NOT NULL,
     crypto_network text NOT NULL DEFAULT 'BTC',
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/db_usage_module/table.sql

@@ -32,10 +32,19 @@ CREATE TABLE metaschema_modules_public.db_usage_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage, 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage
   scope text NOT NULL DEFAULT 'app',
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/emails_module/table.sql

@@ -16,6 +16,10 @@ CREATE TABLE metaschema_modules_public.emails_module (
 
     table_name text NOT NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/entity_type_provision/table.sql

@@ -137,10 +137,6 @@ CREATE TABLE metaschema_modules_public.entity_type_provision (
 
     out_secret_definitions_table_id uuid DEFAULT NULL,
 
-    out_requirements_table_id uuid DEFAULT NULL,
-
-    out_config_requirements_table_id uuid DEFAULT NULL,
-
     out_graph_module_id uuid DEFAULT NULL,
 
     out_graphs_table_id uuid DEFAULT NULL,

package/deploy/schemas/metaschema_modules_public/tables/events_module/table.sql

@@ -54,17 +54,27 @@ CREATE TABLE metaschema_modules_public.events_module (
   retention text DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  prefix text NULL,
+  -- Scope: determines the security level for this module instance.
+  scope text NOT NULL DEFAULT 'app',
 
-  membership_type int NOT NULL,
-  -- if this is NOT NULL, then we add entity_id 
-  -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
   entity_table_id uuid NULL,
 
   -- required tables    
   actor_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
 
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -21,9 +21,6 @@ CREATE TABLE metaschema_modules_public.function_module (
     invocations_table_id uuid NOT NULL DEFAULT uuid_nil(),
     execution_logs_table_id uuid NOT NULL DEFAULT uuid_nil(),
     secret_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    requirements_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    config_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    config_requirements_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- Table names (input to the generator — bare names without scope prefix).
     -- The trigger prepends the scope prefix automatically.
@@ -31,43 +28,38 @@ CREATE TABLE metaschema_modules_public.function_module (
     invocations_table_name text NOT NULL DEFAULT 'function_invocations',
     execution_logs_table_name text NOT NULL DEFAULT 'function_execution_logs',
     secret_definitions_table_name text NOT NULL DEFAULT 'secret_definitions',
-    requirements_table_name text NOT NULL DEFAULT 'function_secret_requirements',
-    config_requirements_table_name text NOT NULL DEFAULT 'function_config_requirements',
 
     -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
     api_name text,
     private_api_name text,
 
-    -- Multi-tenant function identity
-    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- Scope prefix for table naming.  Auto-derived from membership_type when
-    -- NULL:  NULL/1 → 'app',  2 → 'org'.  Can be overridden explicitly.
-    -- The trigger prepends this to all bare table names
-    -- (e.g. prefix='app' + 'function_definitions' → 'app_function_definitions').
-    prefix text NULL,
-
-    -- Module key discriminator: allows multiple function modules per scope.
-    -- 'default' is omitted from table names, any other value becomes
-    -- an infix: {prefix}_{key}_function_definitions.
-    -- Max 16 chars, lowercase snake_case.
-    key text NOT NULL DEFAULT 'default',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
 
     -- Entity table for RLS (NULL for app-level functions, entity table for entity-scoped functions)
     entity_table_id uuid NULL,
 
-    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_function_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
     policies jsonb NULL,
 
     -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (definitions, invocations, execution_logs, secret_definitions, requirements).
+    -- Keys are table keys (definitions, invocations, execution_logs, secret_definitions).
     -- When a key is present, the module trigger skips default security for that table;
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Constraints
     CONSTRAINT function_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT function_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -76,17 +68,12 @@ CREATE TABLE metaschema_modules_public.function_module (
     CONSTRAINT function_module_invocations_table_fkey FOREIGN KEY (invocations_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT function_module_execution_logs_table_fkey FOREIGN KEY (execution_logs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT function_module_secret_defs_table_fkey FOREIGN KEY (secret_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT function_module_requirements_table_fkey FOREIGN KEY (requirements_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT function_module_config_defs_table_fkey FOREIGN KEY (config_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT function_module_config_reqs_table_fkey FOREIGN KEY (config_requirements_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT function_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX function_module_database_id_idx ON metaschema_modules_public.function_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple function modules for the same scope (e.g. 'webhooks' + 'automations').
-CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one function module per database per scope per prefix.
+CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -17,8 +17,10 @@ CREATE TABLE metaschema_modules_public.graph_module (
     public_schema_name text,
     private_schema_name text,
 
-    -- Table/function prefix (e.g., 'pipeline' -> pipeline_function_graphs, ...)
-    -- Stored normalized (no trailing underscore); underscore added at generation time
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
     prefix text NOT NULL DEFAULT '',
 
     -- Reference to the Merkle store this graph module depends on
@@ -33,12 +35,8 @@ CREATE TABLE metaschema_modules_public.graph_module (
     api_name text,
     private_api_name text,
 
-    -- Scope field name (column used for multi-tenant isolation)
-    scope_field text NOT NULL DEFAULT 'scope_id',
-
-    -- Multi-tenant scoping (entity-aware module pattern)
-    membership_type int DEFAULT NULL,              -- NULL = database-root, non-NULL = entity-scoped
-    entity_table_id uuid NULL,                     -- Entity table for entity-scoped RLS
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
+    entity_table_id uuid NULL,
 
     -- Configurable security policies (NULL = use defaults).
     -- Accepts a JSON array of policy objects:
@@ -51,6 +49,10 @@ CREATE TABLE metaschema_modules_public.graph_module (
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),
 

package/deploy/schemas/metaschema_modules_public/tables/hierarchy_module/table.sql

@@ -23,11 +23,14 @@ CREATE TABLE metaschema_modules_public.hierarchy_module (
     chart_edge_grants_table_name text NOT NULL DEFAULT '',
     
     -- Required external table references
-    entity_table_id uuid NOT NULL,  -- Organizations table (membership_type=2 entity)
+    entity_table_id uuid NOT NULL,  -- Organizations table (entity-scoped)
     users_table_id uuid NOT NULL,   -- Users table
+
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'org',
     
-    -- Prefix for naming (e.g., 'org' -> 'org_chart_edges')
-    prefix text NOT NULL DEFAULT 'org',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
     
     -- Resolved names for RLS parser lookups
     private_schema_name text NOT NULL DEFAULT '',
@@ -39,6 +42,10 @@ CREATE TABLE metaschema_modules_public.hierarchy_module (
     get_managers_function text NOT NULL DEFAULT '',
     is_manager_of_function text NOT NULL DEFAULT '',
     
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),
     

package/deploy/schemas/metaschema_modules_public/tables/i18n_module/table.sql

@@ -0,0 +1,31 @@
+-- Deploy schemas/metaschema_modules_public/tables/i18n_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.i18n_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (populated by the insert trigger)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Settings table (populated by the generator)
+    settings_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT NULL,
+    private_api_name text DEFAULT NULL,
+
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT settings_table_fkey FOREIGN KEY (settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX i18n_module_database_id_idx ON metaschema_modules_public.i18n_module ( database_id );
+CREATE UNIQUE INDEX i18n_module_unique_per_db ON metaschema_modules_public.i18n_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/identity_providers_module/table.sql

@@ -15,11 +15,30 @@ CREATE TABLE metaschema_modules_public.identity_providers_module (
 
     table_name text NOT NULL DEFAULT 'identity_providers',
 
-    --
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
+    -- Entity-aware scope: determines which config_secrets_module table
+    -- the rotate_identity_provider_{prefix}_secret proc targets.
+    --   'app'  = app_secrets (AuthzAppMembership, admin-only)
+    --   'org'  = org_secrets (AuthzEntityMembership, per-org)
+    -- Future entity types are also supported via the membership_types table.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix for the generated rotate proc.
+    -- Auto-derived from scope by the trigger when empty.
+    -- e.g. scope='app' → prefix='app' → rotate_identity_provider_app_secret
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
+    entity_table_id uuid NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX identity_providers_module_database_id_idx ON metaschema_modules_public.identity_providers_module ( database_id );
@@ -27,7 +46,20 @@ CREATE INDEX identity_providers_module_schema_id_idx ON metaschema_modules_publi
 CREATE INDEX identity_providers_module_private_schema_id_idx ON metaschema_modules_public.identity_providers_module ( private_schema_id );
 CREATE INDEX identity_providers_module_table_id_idx ON metaschema_modules_public.identity_providers_module ( table_id );
 
-COMMENT ON TABLE metaschema_modules_public.identity_providers_module IS 'Config row for the identity_providers_module, which provisions a per-database identity_providers config table holding OAuth2 / OIDC (and future SAML) provider definitions: protocol kind, endpoint URLs, encrypted client secret, scopes, audience validation, PKCE, and email-handling flags. Built-in providers (google, github, apple, ...) are seeded as is_built_in=true rows; custom providers use slugs of the form custom:<slug>.';
+-- One install per database per scope
+CREATE UNIQUE INDEX identity_providers_module_unique_scope ON metaschema_modules_public.identity_providers_module ( database_id, scope );
+
+COMMENT ON TABLE metaschema_modules_public.identity_providers_module IS
+    'Entity-aware config row for the identity_providers_module, which provisions a per-database
+     identity_providers table holding OAuth2 / OIDC (and future SAML) provider definitions.
+     The scope column determines which config_secrets_module table the rotate proc targets
+     (app_secrets for app scope, org_secrets for org scope). When scope = platform,
+     the secrets table gets a database_id column and platform-level RLS via
+     AuthzRelatedEntityMembership through database.owner_id.
+     Scoping matrix:
+       scope=app       → per-database flat, in-app admin manages
+       scope=platform  → per-database, platform admin manages (generate:constructive)
+       scope=org       → per-org tenant, org admin manages';
 COMMENT ON COLUMN metaschema_modules_public.identity_providers_module.private_schema_id IS 'Private schema that hosts SECURITY DEFINER admin helpers which write to identity_providers (create / update / enable / disable / rotate-secret / delete) and the per-app quota check.';
 
 COMMIT;