@pgpm/metaschema-modules 0.26.3 → 0.26.6

package/deploy/schemas/metaschema_modules_public/tables/hierarchy_module/table.sql

@@ -23,11 +23,14 @@ CREATE TABLE metaschema_modules_public.hierarchy_module (
     chart_edge_grants_table_name text NOT NULL DEFAULT '',
     
     -- Required external table references
-    entity_table_id uuid NOT NULL,  -- Organizations table (membership_type=2 entity)
+    entity_table_id uuid NOT NULL,  -- Organizations table (entity-scoped)
     users_table_id uuid NOT NULL,   -- Users table
+
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'org',
     
-    -- Prefix for naming (e.g., 'org' -> 'org_chart_edges')
-    prefix text NOT NULL DEFAULT 'org',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
     
     -- Resolved names for RLS parser lookups
     private_schema_name text NOT NULL DEFAULT '',
@@ -39,6 +42,10 @@ CREATE TABLE metaschema_modules_public.hierarchy_module (
     get_managers_function text NOT NULL DEFAULT '',
     is_manager_of_function text NOT NULL DEFAULT '',
     
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),
     

package/deploy/schemas/metaschema_modules_public/tables/i18n_module/table.sql

@@ -0,0 +1,31 @@
+-- Deploy schemas/metaschema_modules_public/tables/i18n_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.i18n_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (populated by the insert trigger)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Settings table (populated by the generator)
+    settings_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT NULL,
+    private_api_name text DEFAULT NULL,
+
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT settings_table_fkey FOREIGN KEY (settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX i18n_module_database_id_idx ON metaschema_modules_public.i18n_module ( database_id );
+CREATE UNIQUE INDEX i18n_module_unique_per_db ON metaschema_modules_public.i18n_module ( database_id );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/identity_providers_module/table.sql

@@ -15,11 +15,30 @@ CREATE TABLE metaschema_modules_public.identity_providers_module (
 
     table_name text NOT NULL DEFAULT 'identity_providers',
 
-    --
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
+    -- Entity-aware scope: determines which config_secrets_module table
+    -- the rotate_identity_provider_{prefix}_secret proc targets.
+    --   'app'  = app_secrets (AuthzAppMembership, admin-only)
+    --   'org'  = org_secrets (AuthzEntityMembership, per-org)
+    -- Future entity types are also supported via the membership_types table.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix for the generated rotate proc.
+    -- Auto-derived from scope by the trigger when empty.
+    -- e.g. scope='app' → prefix='app' → rotate_identity_provider_app_secret
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
+    entity_table_id uuid NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE
+    CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX identity_providers_module_database_id_idx ON metaschema_modules_public.identity_providers_module ( database_id );
@@ -27,7 +46,20 @@ CREATE INDEX identity_providers_module_schema_id_idx ON metaschema_modules_publi
 CREATE INDEX identity_providers_module_private_schema_id_idx ON metaschema_modules_public.identity_providers_module ( private_schema_id );
 CREATE INDEX identity_providers_module_table_id_idx ON metaschema_modules_public.identity_providers_module ( table_id );
 
-COMMENT ON TABLE metaschema_modules_public.identity_providers_module IS 'Config row for the identity_providers_module, which provisions a per-database identity_providers config table holding OAuth2 / OIDC (and future SAML) provider definitions: protocol kind, endpoint URLs, encrypted client secret, scopes, audience validation, PKCE, and email-handling flags. Built-in providers (google, github, apple, ...) are seeded as is_built_in=true rows; custom providers use slugs of the form custom:<slug>.';
+-- One install per database per scope
+CREATE UNIQUE INDEX identity_providers_module_unique_scope ON metaschema_modules_public.identity_providers_module ( database_id, scope );
+
+COMMENT ON TABLE metaschema_modules_public.identity_providers_module IS
+    'Entity-aware config row for the identity_providers_module, which provisions a per-database
+     identity_providers table holding OAuth2 / OIDC (and future SAML) provider definitions.
+     The scope column determines which config_secrets_module table the rotate proc targets
+     (app_secrets for app scope, org_secrets for org scope). When scope = platform,
+     the secrets table gets a database_id column and platform-level RLS via
+     AuthzRelatedEntityMembership through database.owner_id.
+     Scoping matrix:
+       scope=app       → per-database flat, in-app admin manages
+       scope=platform  → per-database, platform admin manages (generate:constructive)
+       scope=org       → per-org tenant, org admin manages';
 COMMENT ON COLUMN metaschema_modules_public.identity_providers_module.private_schema_id IS 'Private schema that hosts SECURITY DEFINER admin helpers which write to identity_providers (create / update / enable / disable / rotate-secret / delete) and the per-app quota check.';
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/inference_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.inference_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/invites_module/table.sql

@@ -21,13 +21,19 @@ CREATE TABLE metaschema_modules_public.invites_module (
     claimed_invites_table_name text NOT NULL DEFAULT '',
     submit_invite_code_function text NOT NULL DEFAULT '',
 
-    prefix text NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT invites_table_fkey FOREIGN KEY (invites_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
@@ -41,12 +47,8 @@ CREATE TABLE metaschema_modules_public.invites_module (
 
 CREATE INDEX invites_module_database_id_idx ON metaschema_modules_public.invites_module ( database_id );
 
--- Unique constraint on (database_id, membership_type) so the
--- entity_type_provision fan-out can use ON CONFLICT DO NOTHING for idempotent
--- re-provisioning. invites_module is always entity-scoped (membership_type
--- is NOT NULL on this table), so no COALESCE-NULL trick is needed here,
--- unlike storage_module which supports an app-level singleton row.
+-- Unique constraint: one invites module per database per scope per prefix.
 CREATE UNIQUE INDEX invites_module_unique_scope
-    ON metaschema_modules_public.invites_module (database_id, membership_type);
+    ON metaschema_modules_public.invites_module (database_id, scope, prefix);
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/limits_module/table.sql

@@ -61,16 +61,22 @@ CREATE TABLE metaschema_modules_public.limits_module (
     limit_check_soft_function text NOT NULL DEFAULT '',
     limit_aggregate_check_soft_function text NOT NULL DEFAULT '',
 
-    prefix text NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
     -- required tables    
     actor_table_id uuid NOT NULL DEFAULT uuid_nil(),
      
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'usage',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/memberships_module/table.sql

@@ -41,15 +41,16 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     owner_grants_table_id uuid NOT NULL DEFAULT uuid_nil(),
     owner_grants_table_name text NOT NULL DEFAULT '',
 
-    membership_type int NOT NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. memberships to the app itself are considered global owned by app and no explicit owner
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
     entity_table_owner_id uuid NULL,
 
-    prefix text NULL,
-
     -- Populated by memberships_module generator when get_organization_id is created
     get_org_fn text NULL,
 
@@ -63,8 +64,14 @@ CREATE TABLE metaschema_modules_public.memberships_module (
 
     member_profiles_table_id uuid NULL,
 
-    -- 
-     
+    -- Audit tables for permission defaults (created by memberships_module when has_permissions=true)
+    permission_default_permissions_table_id uuid NULL,
+    permission_default_grants_table_id uuid NULL,
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -83,7 +90,9 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     CONSTRAINT default_limits_table_fkey FOREIGN KEY (default_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
 
     CONSTRAINT permissions_table_fkey FOREIGN KEY (permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT default_permissions_table_fkey FOREIGN KEY (default_permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+    CONSTRAINT default_permissions_table_fkey FOREIGN KEY (default_permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+
+    CONSTRAINT memberships_module_unique UNIQUE (database_id, scope, prefix)
 );
 
 CREATE INDEX memberships_module_database_id_idx ON metaschema_modules_public.memberships_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -30,8 +30,14 @@ CREATE TABLE metaschema_modules_public.merkle_store_module (
     api_name text,
     private_api_name text,
 
-    -- Scope field name (column used for multi-tenant isolation)
-    scope_field text NOT NULL DEFAULT 'scope_id',
+    -- Scope: 'app' for app-level, 'platform' for database-scoped with
+    -- RLS through metaschema_public.database ownership.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Function name prefix override: NULL (default) inherits from `prefix`;
+    -- '' (empty string) generates unprefixed function names (e.g., get_all instead of function_graph_get_all);
+    -- any other value is used as-is. Tables always keep their prefix regardless of this setting.
+    function_prefix text DEFAULT NULL,
 
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -28,19 +28,18 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     api_name text,
     private_api_name text,
 
-    -- Multi-tenant namespace identity
-    membership_type int DEFAULT NULL,              -- NULL = database-root (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- Module key discriminator: allows multiple namespace modules per scope.
-    -- 'default' is omitted from table names, any other value becomes
-    -- an infix: {prefix}_{key}_namespaces.
-    -- Max 16 chars, lowercase snake_case.
-    key text NOT NULL DEFAULT 'default',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
 
     -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
     entity_table_id uuid NULL,
 
-    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_namespace_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
@@ -52,6 +51,10 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Constraints
     CONSTRAINT namespace_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT namespace_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -63,9 +66,7 @@ CREATE TABLE metaschema_modules_public.namespace_module (
 
 CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple namespace modules for the same scope (e.g. 'config' + 'content').
-CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one namespace module per database per scope per prefix.
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/notifications_module/table.sql

@@ -19,6 +19,7 @@ CREATE TABLE metaschema_modules_public.notifications_module (
     preferences_table_id uuid,
     channels_table_id uuid,
     delivery_log_table_id uuid,
+    suppressions_table_id uuid,
 
     owner_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
@@ -36,6 +37,14 @@ CREATE TABLE metaschema_modules_public.notifications_module (
     has_digest_metadata boolean NOT NULL DEFAULT false,
     has_subscriptions boolean NOT NULL DEFAULT false,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'notifications',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT notifications_table_fkey FOREIGN KEY (notifications_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
@@ -43,6 +52,7 @@ CREATE TABLE metaschema_modules_public.notifications_module (
     CONSTRAINT preferences_table_fkey FOREIGN KEY (preferences_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
     CONSTRAINT channels_table_fkey FOREIGN KEY (channels_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
     CONSTRAINT delivery_log_table_fkey FOREIGN KEY (delivery_log_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
+    CONSTRAINT suppressions_table_fkey FOREIGN KEY (suppressions_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
     CONSTRAINT owner_table_fkey FOREIGN KEY (owner_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT user_settings_table_fkey FOREIGN KEY (user_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
     CONSTRAINT organization_settings_table_fkey FOREIGN KEY (organization_settings_table_id) REFERENCES metaschema_public.table (id) ON DELETE SET NULL,
@@ -57,6 +67,7 @@ COMMENT ON CONSTRAINT read_state_table_fkey ON metaschema_modules_public.notific
 COMMENT ON CONSTRAINT preferences_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName preferencesTableByPreferencesTableId\n@omit manyToMany';
 COMMENT ON CONSTRAINT channels_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName channelsTableByChannelsTableId\n@omit manyToMany';
 COMMENT ON CONSTRAINT delivery_log_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName deliveryLogTableByDeliveryLogTableId\n@omit manyToMany';
+COMMENT ON CONSTRAINT suppressions_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName suppressionsTableBySuppressionsTableId';
 COMMENT ON CONSTRAINT owner_table_fkey ON metaschema_modules_public.notifications_module IS E'@omit manyToMany';
 COMMENT ON CONSTRAINT user_settings_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName userSettingsTableByUserSettingsTableId\n@omit manyToMany';
 COMMENT ON CONSTRAINT organization_settings_table_fkey ON metaschema_modules_public.notifications_module IS E'@fieldName organizationSettingsTableByOrganizationSettingsTableId\n@omit manyToMany';

package/deploy/schemas/metaschema_modules_public/tables/permissions_module/table.sql

@@ -42,16 +42,19 @@ CREATE TABLE metaschema_modules_public.permissions_module (
     -- Existing databases are unaffected; this only changes the default for
     -- newly inserted permissions_module rows.
     bitlen int NOT NULL DEFAULT 64,
-    membership_type int NOT NULL,
-    -- if this is NOT NULL, then we add entity_id 
-    -- e.g. limits to the app itself are considered global owned by app and no explicit owner
+
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level, entity table for entity-scoped)
     entity_table_id uuid NULL,
 
     -- required tables    
     actor_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
-    prefix text NULL,
-
     --
 
     get_padded_mask text NOT NULL DEFAULT '',
@@ -61,6 +64,10 @@ CREATE TABLE metaschema_modules_public.permissions_module (
 
     --
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/phone_numbers_module/table.sql

@@ -16,6 +16,10 @@ CREATE TABLE metaschema_modules_public.phone_numbers_module (
 
     table_name text NOT NULL,
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/plans_module/table.sql

@@ -25,12 +25,26 @@ CREATE TABLE metaschema_modules_public.plans_module (
   -- Plan overrides table: per-entity custom limit overrides
   plan_overrides_table_id uuid NULL,
 
+  -- Plan meter limits table: maps plan → meter slug → billing quota
+  plan_meter_limits_table_id uuid NULL,
+
+  -- Plan caps table: maps plan → cap name → cap value (feature flags)
+  plan_caps_table_id uuid NULL,
+
   -- Generated apply_plan functions (one per limits scope)
   apply_plan_function text NOT NULL DEFAULT '',
   apply_plan_aggregate_function text NOT NULL DEFAULT '',
 
+  -- Generated apply functions for billing and caps (set when respective modules are installed)
+  apply_billing_plan_function text NULL,
+  apply_plan_caps_function text NULL,
+
   prefix text NULL,
 
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -38,6 +52,8 @@ CREATE TABLE metaschema_modules_public.plans_module (
   CONSTRAINT plan_limits_table_fkey FOREIGN KEY (plan_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plan_pricing_table_fkey FOREIGN KEY (plan_pricing_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plan_overrides_table_fkey FOREIGN KEY (plan_overrides_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_meter_limits_table_fkey FOREIGN KEY (plan_meter_limits_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT plan_caps_table_fkey FOREIGN KEY (plan_caps_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT plans_module_database_id_unique UNIQUE (database_id)
 );
 

package/deploy/schemas/metaschema_modules_public/tables/profiles_module/table.sql

@@ -31,7 +31,11 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     profile_templates_table_id uuid NOT NULL DEFAULT uuid_nil(),
     profile_templates_table_name text NOT NULL DEFAULT '',
     
-    membership_type int NOT NULL,
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
     
     -- Entity table for org/group scoped profiles (NULL for app-level)
     entity_table_id uuid NULL,
@@ -41,8 +45,10 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     permissions_table_id uuid NOT NULL DEFAULT uuid_nil(),
     memberships_table_id uuid NOT NULL DEFAULT uuid_nil(),
     
-    prefix text NULL,
-    
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -57,7 +63,7 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     CONSTRAINT permissions_table_fkey FOREIGN KEY (permissions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT memberships_table_fkey FOREIGN KEY (memberships_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     
-    CONSTRAINT profiles_module_unique UNIQUE (database_id, membership_type)
+    CONSTRAINT profiles_module_unique UNIQUE (database_id, scope, prefix)
 );
 
 CREATE INDEX profiles_module_database_id_idx ON metaschema_modules_public.profiles_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/rate_limit_meters_module/table.sql

@@ -30,6 +30,14 @@ CREATE TABLE metaschema_modules_public.rate_limit_meters_module (
 
   prefix text NULL,
 
+  -- Default permissions: permission names auto-granted to new members.
+  -- NULL uses the module's built-in defaults; explicit array overrides them.
+  default_permissions text[] DEFAULT NULL,
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
+
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
   CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/realtime_module/table.sql

@@ -27,6 +27,10 @@ CREATE TABLE metaschema_modules_public.realtime_module (
     notify_channel text NULL,
 
     -- Constraints
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'realtime',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/rls_module/table.sql

@@ -22,6 +22,10 @@ CREATE TABLE metaschema_modules_public.rls_module (
     "current_role" text NOT NULL DEFAULT 'current_user',
     current_role_id text NOT NULL DEFAULT 'current_user_id',
 
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'auth',
+    private_api_name text DEFAULT NULL,
+
     --
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT session_credentials_table_fkey FOREIGN KEY (session_credentials_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.storage_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -17,19 +17,18 @@ CREATE TABLE metaschema_modules_public.storage_module (
     files_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- Table names (input to the generator)
-    buckets_table_name text NOT NULL DEFAULT 'app_buckets',
-    files_table_name text NOT NULL DEFAULT 'app_files',
+    buckets_table_name text NOT NULL DEFAULT 'buckets',
+    files_table_name text NOT NULL DEFAULT 'files',
 
-    -- Multi-tenant storage identity
-    membership_type int DEFAULT NULL,              -- NULL = global gate (AuthzMembership via app_sprt), non-NULL = entity-scoped (AuthzEntityMembership)
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
 
-    -- Module key discriminator: allows multiple storage modules per entity type.
-    -- 'default' is omitted from table names (backward compat), any other value becomes
-    -- an infix: {prefix}_{key}_{buckets|files}.
-    -- Max 16 chars, lowercase snake_case, cannot be 'buckets'/'files'/'bucket'/'file'.
-    key text NOT NULL DEFAULT 'default',
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
 
-    -- Configurable security policies (NULL = use defaults based on membership_type).
+    -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_storage_security.
     -- Accepts a JSON array of policy objects:
     --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
@@ -87,7 +86,15 @@ CREATE TABLE metaschema_modules_public.storage_module (
     -- Generated table ID for file_events (populated by the generator when has_audit_log=true)
     file_events_table_id uuid NULL DEFAULT NULL,
 
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
     -- Constraints
+    -- API routing (configurable per-module)
+    api_name text DEFAULT 'admin',
+    private_api_name text DEFAULT NULL,
+
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
@@ -100,9 +107,7 @@ CREATE TABLE metaschema_modules_public.storage_module (
 
 CREATE INDEX storage_module_database_id_idx ON metaschema_modules_public.storage_module ( database_id );
 
--- Unique constraint on (database_id, membership_type, key) using COALESCE to handle NULLs.
--- NULL membership_type = app-level, non-NULL = entity-scoped. key discriminates
--- multiple storage modules for the same entity type (e.g. 'default' + 'fn').
-CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, COALESCE(membership_type, -1), key );
+-- Unique constraint: one storage module per database per scope per prefix.
+CREATE UNIQUE INDEX storage_module_unique_scope ON metaschema_modules_public.storage_module ( database_id, scope, prefix );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -24,12 +24,17 @@ CREATE TABLE metaschema_modules_public.transfer_log_module (
   retention text NOT NULL DEFAULT '12 months',
   premake int NOT NULL DEFAULT 2,
 
-  -- Scope configuration: 'app' = per-app usage (actor_id RLS), 'platform' = tenant metering (database_id RLS)
+  -- Scope configuration: 'app' = per-app usage (actor_id RLS)
   scope text NOT NULL DEFAULT 'app',
   actor_fk_table_id uuid NULL,
   entity_fk_table_id uuid NULL,
 
-  prefix text NULL,
+  -- Table name prefix. Auto-derived from scope by the trigger when empty.
+  prefix text NOT NULL DEFAULT '',
+
+  -- API routing (configurable per-module)
+  api_name text DEFAULT 'usage',
+  private_api_name text DEFAULT NULL,
 
   CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
   CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,