@pgpm/metaschema-modules 0.26.2 → 0.26.5

package/deploy/schemas/metaschema_modules_public/tables/inference_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.inference_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/invites_module/table.sql

@@ -21,13 +21,19 @@ CREATE TABLE metaschema_modules_public.invites_module (
     claimed_invites_table_name text NOT NULL DEFAULT '',
     submit_invite_code_function text NOT NULL DEFAULT '',
 
-    prefix text NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT invites_table_fkey FOREIGN KEY (invites_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
@@ -41,12 +47,8 @@ CREATE TABLE metaschema_modules_public.invites_module (
 
 CREATE INDEX invites_module_database_id_idx ON metaschema_modules_public.invites_module ( database_id );
 
--- Unique constraint on (database_id, membership_type) so the
--- entity_type_provision fan-out can use ON CONFLICT DO NOTHING for idempotent
--- re-provisioning. invites_module is always entity-scoped (membership_type
--- is NOT NULL on this table), so no COALESCE-NULL trick is needed here,
--- unlike storage_module which supports an app-level singleton row.
+-- Unique constraint: one invites module per database per scope per prefix.
 CREATE UNIQUE INDEX invites_module_unique_scope
-    ON metaschema_modules_public.invites_module (database_id, membership_type);
+    ON metaschema_modules_public.invites_module (database_id, scope, prefix);
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/limits_module/table.sql

@@ -61,16 +61,22 @@ CREATE TABLE metaschema_modules_public.limits_module (
     limit_check_soft_function text NOT NULL DEFAULT '',
     limit_aggregate_check_soft_function text NOT NULL DEFAULT '',
 
-    prefix text NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
     -- required tables    
     actor_table_id uuid NOT NULL DEFAULT uuid_nil(),
      
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'usage',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/memberships_module/table.sql

@@ -41,15 +41,16 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     owner_grants_table_id uuid NOT NULL DEFAULT uuid_nil(),
     owner_grants_table_name text NOT NULL DEFAULT '',
 
-    membership_type int NOT NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. memberships to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
     entity_table_owner_id uuid NULL,
 
-    prefix text NULL,
-
     -- Populated by memberships_module generator when get_organization_id is created
     get_org_fn text NULL,
 
@@ -65,6 +66,10 @@ CREATE TABLE metaschema_modules_public.memberships_module (
 
     -- 
      
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -83,7 +88,9 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     CONSTRAINT default_limits_table_fkey FOREIGN KEY (default_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
 
     CONSTRAINT permissions_table_fkey FOREIGN KEY (permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT default_permissions_table_fkey FOREIGN KEY (default_permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+    CONSTRAINT default_permissions_table_fkey FOREIGN KEY (default_permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    CONSTRAINT memberships_module_unique UNIQUE (database_id, scope, prefix)
 );
 
 CREATE INDEX memberships_module_database_id_idx ON metaschema_modules_public.memberships_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -30,8 +30,9 @@ CREATE TABLE metaschema_modules_public.merkle_store_module (
     api_name text,
     private_api_name text,
 
-    -- Scope field name (column used for multi-tenant isolation)
-    scope_field text NOT NULL DEFAULT 'scope_id',
+    -- Scope: 'app' for app-level, 'platform' for database-scoped with
+    -- RLS through metaschema_public.database ownership.
+    scope text NOT NULL DEFAULT 'app',
 
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -28,19 +28,18 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     api_name text,
     private_api_name text,
 
-    -- Multi-tenant namespace identity
-    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- Module key discriminator: allows multiple namespace modules per scope.
-    -- 'default' is omitted from table names, any other value becomes
-    -- an infix: {prefix}_{key}_namespaces.
-    -- Max 16 chars, lowercase snake_case.
-    key text NOT NULL DEFAULT 'default',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
 
     -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
     entity_table_id uuid NULL,
 
-    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_namespace_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
@@ -52,6 +51,10 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Constraints
     CONSTRAINT namespace_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT namespace_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -63,9 +66,7 @@ CREATE TABLE metaschema_modules_public.namespace_module (
 
 CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple namespace modules for the same scope (e.g. 'config' + 'content').
-CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one namespace module per database per scope per prefix.
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/notifications_module/table.sql

@@ -36,6 +36,14 @@ CREATE TABLE metaschema_modules_public.notifications_module (
     has_digest_metadata boolean NOT NULL DEFAULT false,
     has_subscriptions boolean NOT NULL DEFAULT false,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'notifications',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT notifications_table_fkey FOREIGN KEY (notifications_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/permissions_module/table.sql

@@ -42,16 +42,19 @@ CREATE TABLE metaschema_modules_public.permissions_module (
     -- Existing databases are unaffected; this only changes the default for
     -- newly inserted permissions_module rows.
     bitlen int NOT NULL DEFAULT 64,
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
     -- required tables    
     actor_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
-    prefix text NULL,
-
     --
 
     get_padded_mask text NOT NULL DEFAULT '',
@@ -61,6 +64,10 @@ CREATE TABLE metaschema_modules_public.permissions_module (
 
     --
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/phone_numbers_module/table.sql

@@ -16,6 +16,10 @@ CREATE TABLE metaschema_modules_public.phone_numbers_module (
 
     table_name text NOT NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/plans_module/table.sql

@@ -25,12 +25,26 @@ CREATE TABLE metaschema_modules_public.plans_module (
   -- Plan overrides table: per-entity custom limit overrides
   plan_overrides_table_id uuid NULL,
 
+  -- Plan meter limits table: maps plan → meter slug → billing quota
+  plan_meter_limits_table_id uuid NULL,
+
+  -- Plan caps table: maps plan → cap name → cap value (feature flags)
+  plan_caps_table_id uuid NULL,
+
   -- Generated apply_plan functions (one per limits scope)
   apply_plan_function text NOT NULL DEFAULT '',
   apply_plan_aggregate_function text NOT NULL DEFAULT '',
 
+  -- Generated apply functions for billing and caps (set when respective modules are installed)
+  apply_billing_plan_function text NULL,
+  apply_plan_caps_function text NULL,
+
   prefix text NULL,
 
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -38,6 +52,8 @@ CREATE TABLE metaschema_modules_public.plans_module (
   CONSTRAINT plan_limits_table_fkey FOREIGN KEY (plan_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plan_pricing_table_fkey FOREIGN KEY (plan_pricing_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plan_overrides_table_fkey FOREIGN KEY (plan_overrides_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_meter_limits_table_fkey FOREIGN KEY (plan_meter_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_caps_table_fkey FOREIGN KEY (plan_caps_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plans_module_database_id_unique UNIQUE (database_id)
 );
 

package/deploy/schemas/metaschema_modules_public/tables/profiles_module/table.sql

@@ -31,7 +31,11 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     profile_templates_table_id uuid NOT NULL DEFAULT uuid_nil(),
     profile_templates_table_name text NOT NULL DEFAULT '',
     
-    membership_type int NOT NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
     
     -- Entity table for org/group scoped profiles (NULL for app-level)
     entity_table_id uuid NULL,
@@ -41,8 +45,10 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     permissions_table_id uuid NOT NULL DEFAULT uuid_nil(),
     memberships_table_id uuid NOT NULL DEFAULT uuid_nil(),
     
-    prefix text NULL,
-    
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -57,7 +63,7 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     CONSTRAINT permissions_table_fkey FOREIGN KEY (permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT memberships_table_fkey FOREIGN KEY (memberships_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     
-    CONSTRAINT profiles_module_unique UNIQUE (database_id, membership_type)
+    CONSTRAINT profiles_module_unique UNIQUE (database_id, scope, prefix)
 );
 
 CREATE INDEX profiles_module_database_id_idx ON metaschema_modules_public.profiles_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/rate_limit_meters_module/table.sql

@@ -30,6 +30,14 @@ CREATE TABLE metaschema_modules_public.rate_limit_meters_module (
 
   prefix text NULL,
 
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/realtime_module/table.sql

@@ -27,6 +27,10 @@ CREATE TABLE metaschema_modules_public.realtime_module (
     notify_channel text NULL,
 
     -- Constraints
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'realtime',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/rls_module/table.sql

@@ -22,6 +22,10 @@ CREATE TABLE metaschema_modules_public.rls_module (
     "current_role" text NOT NULL DEFAULT 'current_user',
     current_role_id text NOT NULL DEFAULT 'current_user_id',
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT session_credentials_table_fkey FOREIGN KEY (session_credentials_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.storage_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -17,19 +17,18 @@ CREATE TABLE metaschema_modules_public.storage_module (
     files_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- Table names (input to the generator)
-    buckets_table_name text NOT NULL DEFAULT 'app_buckets',
-    files_table_name text NOT NULL DEFAULT 'app_files',
+    buckets_table_name text NOT NULL DEFAULT 'buckets',
+    files_table_name text NOT NULL DEFAULT 'files',
 
-    -- Multi-tenant storage identity
-    membership_type int DEFAULT NULL,              -- NULL = global gate (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- Module key discriminator: allows multiple storage modules per entity type.
-    -- 'default' is omitted from table names (backward compat), any other value becomes
-    -- an infix: {prefix}_{key}_{buckets|files}.
-    -- Max 16 chars, lowercase snake_case, cannot be 'buckets'/'files'/'bucket'/'file'.
-    key text NOT NULL DEFAULT 'default',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
 
-    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_storage_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
@@ -87,7 +86,15 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- Generated table ID for file_events (populated by the generator when has_audit_log=true)
     file_events_table_id uuid NULL DEFAULT NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Constraints
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -100,9 +107,7 @@ CREATE TABLE metaschema_modules_public.storage_module (
 
 CREATE INDEX storage_module_database_id_idx ON metaschema_modules_public.storage_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple storage modules for the same entity type (e.g. 'default' + 'fn').
-CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one storage module per database per scope per prefix.
+CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.transfer_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/user_auth_module/table.sql

@@ -44,6 +44,10 @@ CREATE TABLE metaschema_modules_public.user_auth_module (
 
     -- UNIQUE(api_id),
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT email_table_fkey FOREIGN KEY (emails_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/user_credentials_module/table.sql

@@ -0,0 +1,42 @@
+-- Deploy schemas/metaschema_modules_public/tables/user_credentials_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.user_credentials_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (resolved by BEFORE INSERT trigger when uuid_nil)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Generated table ID (populated by the generator)
+    table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table name (input — defaults to 'user_secrets')
+    table_name text NOT NULL DEFAULT 'user_secrets',
+
+    -- API routing (get-or-create: if set, schema is added to this API)
+    api_name text DEFAULT 'config',
+    private_api_name text DEFAULT NULL,
+
+    -- Constraints
+    CONSTRAINT user_credentials_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT user_credentials_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT user_credentials_module_table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX user_credentials_module_database_id_idx ON metaschema_modules_public.user_credentials_module ( database_id );
+CREATE INDEX user_credentials_module_schema_id_idx ON metaschema_modules_public.user_credentials_module ( schema_id );
+CREATE INDEX user_credentials_module_table_id_idx ON metaschema_modules_public.user_credentials_module ( table_id );
+
+-- One user_credentials_module per database.
+CREATE UNIQUE INDEX user_credentials_module_unique ON metaschema_modules_public.user_credentials_module ( database_id );
+
+COMMENT ON TABLE metaschema_modules_public.user_credentials_module IS
+    'Per-user bcrypt credential store (password hashes, API key hashes).
+     Always user-scoped with AuthzDirectOwner RLS. Consumed by user_auth_module,
+     identity_providers_module, and bootstrap procedures.';
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/user_settings_module/table.sql

@@ -0,0 +1,34 @@
+-- Deploy schemas/metaschema_modules_public/tables/user_settings_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.user_settings_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema reference (populated by the insert trigger)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table reference (populated by the generator)
+    table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Owner table reference (resolved to users table by trigger)
+    owner_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    table_name text NOT NULL DEFAULT 'user_settings',
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT NULL,
+
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT owner_table_fkey FOREIGN KEY (owner_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX user_settings_module_database_id_idx ON metaschema_modules_public.user_settings_module ( database_id );
+CREATE UNIQUE INDEX user_settings_module_unique_per_db ON metaschema_modules_public.user_settings_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/users_module/table.sql

@@ -18,6 +18,10 @@ CREATE TABLE metaschema_modules_public.users_module (
     type_table_name text NOT NULL DEFAULT 'role_types',
     -- 
      
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/webauthn_credentials_module/table.sql

@@ -16,6 +16,10 @@ CREATE TABLE metaschema_modules_public.webauthn_credentials_module (
 
     table_name text NOT NULL DEFAULT 'webauthn_credentials',
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/metaschema-modules.control

@@ -1,6 +1,6 @@
 # metaschema-modules extension
 comment = 'metaschema-modules extension'
-default_version = '0.26.1'
+default_version = '0.26.3'
 module_pathname = '$libdir/metaschema-modules'
 requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'
 relocatable = false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.26.2",
+  "version": "0.26.5",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,7 +21,7 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.26.2",
+    "@pgpm/metaschema-schema": "0.26.5",
     "@pgpm/verify": "0.26.0"
   },
   "devDependencies": {
@@ -35,5 +35,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "d938867e5d7c0e7b2e130a2bdc5d58cd0d5874e1"
+  "gitHead": "a496a00d89c37d874f4a7207265b9972b6f05c7d"
 }

package/pgpm.plan

@@ -60,4 +60,8 @@ schemas/metaschema_modules_public/tables/merkle_store_module/table [schemas/meta
 schemas/metaschema_modules_public/tables/graph_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/merkle_store_module/table] 2026-05-21T01:00:00Z devin <devin@cognition.ai> # add graph_module config table for FBP graph utilities on top of merkle store
 schemas/metaschema_modules_public/tables/namespace_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T02:00:00Z devin <devin@cognition.ai> # add namespace_module config table for entity-aware namespace provisioning
 schemas/metaschema_modules_public/tables/function_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T03:00:00Z devin <devin@cognition.ai> # add function_module config table for entity-aware function definitions
+schemas/metaschema_modules_public/tables/config_secrets_module/table [schemas/metaschema_modules_public/schema] 2026-05-29T00:00:00Z devin <devin@cognition.ai> # add entity-aware config_secrets_module (replaces config_secrets_user_module + config_secrets_org_module)
+schemas/metaschema_modules_public/tables/user_credentials_module/table [schemas/metaschema_modules_public/schema] 2026-05-30T00:00:00Z devin <devin@cognition.ai> # add user_credentials_module for per-user bcrypt credential store (split from config_secrets_module)
+schemas/metaschema_modules_public/tables/user_settings_module/table [schemas/metaschema_modules_public/schema] 2026-05-28T00:00:00Z devin <devin@cognition.ai> # add user_settings_module for extensible per-user preferences (1:1 with users)
 
+schemas/metaschema_modules_public/tables/i18n_module/table [schemas/metaschema_modules_public/schema] 2026-05-28T00:00:00Z devin <devin@cognition.ai> # add i18n_module config table for internationalization settings