@pgpm/metaschema-modules 0.28.3 → 0.28.4

package/Makefile

@@ -1,5 +1,5 @@
 EXTENSION = metaschema-modules
-DATA = sql/metaschema-modules--0.26.5.sql
+DATA = sql/metaschema-modules--0.15.5.sql
 
 PG_CONFIG = pg_config
 PGXS := $(shell $(PG_CONFIG) --pgxs)

package/README.md

@@ -223,7 +223,7 @@ pnpm test
 
 ## Related Tooling
 
-* [pgpm](https://github.com/constructive-io/constructive/tree/main/pgpm/pgpm): **🖥️ PostgreSQL Package Manager** for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.
+* [pgpm](https://github.com/constructive-io/constructive/tree/main/pgpm/cli): **🖥️ PostgreSQL Package Manager** for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.
 * [pgsql-test](https://github.com/constructive-io/constructive/tree/main/postgres/pgsql-test): **📊 Isolated testing environments** with per-test transaction rollbacks—ideal for integration tests, complex migrations, and RLS simulation.
 * [supabase-test](https://github.com/constructive-io/constructive/tree/main/postgres/supabase-test): **🧪 Supabase-native test harness** preconfigured for the local Supabase stack—per-test rollbacks, JWT/role context helpers, and CI/GitHub Actions ready.
 * [graphile-test](https://github.com/constructive-io/constructive/tree/main/graphile/graphile-test): **🔐 Authentication mocking** for Graphile-focused test helpers and emulating row-level security contexts.
@@ -231,21 +231,6 @@ pnpm test
 * [libpg-query-node](https://github.com/constructive-io/libpg-query-node): **🌉 Node.js bindings** for `libpg_query`, converting SQL into parse trees.
 * [pg-proto-parser](https://github.com/constructive-io/pg-proto-parser): **📦 Protobuf parser** for parsing PostgreSQL Protocol Buffers definitions to generate TypeScript interfaces, utility functions, and JSON mappings for enums.
 
-### 📚 Documentation & Skills
-
-* [constructive-skills](https://github.com/constructive-io/constructive-skills): **📖 Platform documentation and AI agent skills** — feature catalog, blueprint reference, SDK guides, and deployment guides.
-
-Install skills for AI coding agents:
-
-```bash
-# All platform skills (security, blueprints, codegen, billing, etc.)
-npx skills add constructive-io/constructive-skills
-
-# Individual repo skills (pgpm, testing, CLI, search, etc.)
-npx skills add https://github.com/constructive-io/constructive --skill pgpm
-npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
-```
-
 ## Disclaimer
 
 AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.

package/deploy/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -12,6 +12,10 @@ CREATE TABLE metaschema_modules_public.agent_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Generated table IDs (populated by the generator)
   thread_table_id uuid NOT NULL DEFAULT uuid_nil(),
   message_table_id uuid NOT NULL DEFAULT uuid_nil(),

package/deploy/schemas/metaschema_modules_public/tables/billing_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.billing_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Meters table: defines what you track (quota, boolean, credit_pool)
   meters_table_id uuid NOT NULL DEFAULT uuid_nil(),
   meters_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/compute_log_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.compute_log_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Compute log table (partitioned by completed_at)
   compute_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
   compute_log_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_module/table.sql

@@ -12,6 +12,10 @@ CREATE TABLE metaschema_modules_public.config_secrets_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
     -- Generated table IDs (populated by the generator)
     table_id uuid NOT NULL DEFAULT uuid_nil(),
     config_definitions_table_id uuid NULL DEFAULT NULL,

package/deploy/schemas/metaschema_modules_public/tables/db_usage_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.db_usage_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- DB table stats log (partitioned — per-table reads/writes/size from pg_stat_user_tables)
   table_stats_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
   table_stats_log_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/events_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.events_module (
   --
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
   --
   
   events_table_id uuid NOT NULL DEFAULT uuid_nil(),

package/deploy/schemas/metaschema_modules_public/tables/function_deployment_module/table.sql

@@ -0,0 +1,81 @@
+-- Deploy schemas/metaschema_modules_public/tables/function_deployment_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.function_deployment_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    deployments_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    deployment_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator — bare names without scope prefix).
+    -- The trigger prepends the scope prefix automatically.
+    deployments_table_name text NOT NULL DEFAULT 'function_deployments',
+    deployment_events_table_name text NOT NULL DEFAULT 'function_deployment_events',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Scope: determines the security level for this module instance.
+    -- Resolved to a membership_type integer at trigger time via membership_types table.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    -- Override to create multiple module instances at the same scope.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level deployments, entity table for entity-scoped)
+    entity_table_id uuid NULL,
+
+    -- FK to function_module: which function definitions table deployments reference
+    function_module_id uuid NULL,
+
+    -- FK to namespace_module: which namespaces table deployments reference
+    namespace_module_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on scope).
+    -- When provided, replaces the default policy set in apply_function_deployment_security.
+    -- Accepts a JSON array of policy objects:
+    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (deployments, deployment_events).
+    -- When a key is present, the module trigger skips default security for that table;
+    -- secure_table_provision applies the custom grants/policies instead.
+    provisions jsonb NULL,
+
+    -- Default permissions: permission names auto-granted to new members.
+    -- NULL uses the module's built-in defaults; explicit array overrides them.
+    default_permissions text[] DEFAULT NULL,
+
+    -- Constraints
+    CONSTRAINT function_deployment_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_deployments_table_fkey FOREIGN KEY (deployments_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_events_table_fkey FOREIGN KEY (deployment_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT function_deployment_module_function_module_fkey FOREIGN KEY (function_module_id) REFERENCES metaschema_modules_public.function_module (id) ON DELETE SET NULL,
+    CONSTRAINT function_deployment_module_namespace_module_fkey FOREIGN KEY (namespace_module_id) REFERENCES metaschema_modules_public.namespace_module (id) ON DELETE SET NULL
+);
+
+CREATE INDEX function_deployment_module_database_id_idx ON metaschema_modules_public.function_deployment_module ( database_id );
+
+-- Unique constraint: one function deployment module per database per scope per prefix.
+CREATE UNIQUE INDEX function_deployment_module_unique_scope ON metaschema_modules_public.function_deployment_module ( database_id, scope, prefix );
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database.sql

@@ -0,0 +1,18 @@
+-- Deploy schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database to pg
+
+-- requires: schemas/metaschema_modules_public/tables/function_module/table
+
+BEGIN;
+
+-- No-op migration: platform database uniqueness is enforced at the application
+-- layer by resolveDatabaseId(), which queries:
+--   SELECT database_id FROM function_module WHERE scope = 'platform' LIMIT 1
+--
+-- A hard UNIQUE constraint on ((true)) WHERE scope='platform' would break
+-- test isolation (each test database independently provisions platform-scope
+-- modules in the same shared table). The existing unique index
+-- (database_id, scope, prefix) already prevents duplicates within a single
+-- database. Cross-database uniqueness (only one platform DB in production)
+-- is enforced operationally and validated at compute worker startup.
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/graph_module/table.sql

@@ -27,9 +27,8 @@ CREATE TABLE metaschema_modules_public.graph_module (
     merkle_store_module_id uuid NOT NULL,
 
     -- Generated table IDs (populated by BEFORE INSERT trigger)
+    -- Only the graphs (definition) table — execution tables live in graph_execution_module
     graphs_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    executions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    outputs_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
     api_name text,
@@ -44,7 +43,7 @@ CREATE TABLE metaschema_modules_public.graph_module (
     policies jsonb NULL,
 
     -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (graphs, executions, outputs).
+    -- Keys are table keys (graphs).
     -- When a key is present, the module trigger skips default security for that table;
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
@@ -62,8 +61,6 @@ CREATE TABLE metaschema_modules_public.graph_module (
     CONSTRAINT private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT merkle_store_fkey FOREIGN KEY (merkle_store_module_id) REFERENCES metaschema_modules_public.merkle_store_module (id) ON DELETE CASCADE,
     CONSTRAINT graphs_table_fkey FOREIGN KEY (graphs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT executions_table_fkey FOREIGN KEY (executions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT outputs_table_fkey FOREIGN KEY (outputs_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT graph_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
 
     -- Only one graph module per database + merkle store combination

package/deploy/schemas/metaschema_modules_public/tables/hierarchy_module/table.sql

@@ -33,7 +33,7 @@ CREATE TABLE metaschema_modules_public.hierarchy_module (
     prefix text NOT NULL DEFAULT '',
     
     -- Resolved names for RLS parser lookups
-    private_schema_name text NOT NULL DEFAULT '',
+  private_schema_name text NOT NULL DEFAULT '',
     sprt_table_name text NOT NULL DEFAULT '',
     
     -- Function names for helper functions

package/deploy/schemas/metaschema_modules_public/tables/identity_providers_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.identity_providers_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
     table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     table_name text NOT NULL DEFAULT 'identity_providers',

package/deploy/schemas/metaschema_modules_public/tables/inference_log_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.inference_log_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Inference log table (partitioned by created_at)
   inference_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
   inference_log_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/invites_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.invites_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
     emails_table_id uuid NOT NULL DEFAULT uuid_nil(),
     users_table_id uuid NOT NULL DEFAULT uuid_nil(),
 

package/deploy/schemas/metaschema_modules_public/tables/limits_module/table.sql

@@ -10,6 +10,10 @@ CREATE TABLE metaschema_modules_public.limits_module (
     --
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
     ---
     table_id uuid NOT NULL DEFAULT uuid_nil(),
     table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/memberships_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.memberships_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
     memberships_table_id uuid NOT NULL DEFAULT uuid_nil(),
     memberships_table_name text NOT NULL DEFAULT '',
 

package/deploy/schemas/metaschema_modules_public/tables/merkle_store_module/table.sql

@@ -39,6 +39,11 @@ CREATE TABLE metaschema_modules_public.merkle_store_module (
     -- any other value is used as-is. Tables always keep their prefix regardless of this setting.
     function_prefix text DEFAULT NULL,
 
+    -- Permission key for SELECT gating: when set, all 4 merkle tables require this
+    -- permission for SELECT at platform/app scope (e.g., 'manage_graphs').
+    -- NULL means the caller intentionally wants open membership SELECT.
+    permission_key text DEFAULT NULL,
+
     -- Timestamps
     created_at timestamptz NOT NULL DEFAULT now(),
 

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -39,6 +39,12 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
     entity_table_id uuid NULL,
 
+    -- Platform namespace table reference (for cross-scope mirror trigger).
+    -- When scope != 'platform', the insert trigger resolves this automatically
+    -- from the platform-scope namespace_module row.
+    -- NULL means no mirror trigger (platform scope, or no platform module exists).
+    platform_namespaces_table_id uuid NULL,
+
     -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_namespace_security.
     -- Accepts a JSON array of policy objects:

package/deploy/schemas/metaschema_modules_public/tables/notifications_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.notifications_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
     notifications_table_id uuid NOT NULL DEFAULT uuid_nil(),
     read_state_table_id uuid NOT NULL DEFAULT uuid_nil(),
     -- Feature-gated tables: NULL when the corresponding has_* flag is off.

package/deploy/schemas/metaschema_modules_public/tables/permissions_module/table.sql

@@ -10,6 +10,10 @@ CREATE TABLE metaschema_modules_public.permissions_module (
     --
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
     table_id uuid NOT NULL DEFAULT uuid_nil(),
     table_name text NOT NULL DEFAULT '',
     -- 

package/deploy/schemas/metaschema_modules_public/tables/plans_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.plans_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Plans table: defines plan tiers (Free, Pro, Enterprise)
   plans_table_id uuid NOT NULL DEFAULT uuid_nil(),
   plans_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/principal_auth_module/table.sql

@@ -0,0 +1,58 @@
+-- Deploy schemas/metaschema_modules_public/tables/principal_auth_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.principal_auth_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    principals_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    principal_entities_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    principal_scope_overrides_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    users_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    sessions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    session_credentials_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    audits_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    principals_table_name text NOT NULL DEFAULT 'principals',
+    create_principal_function text NOT NULL DEFAULT 'create_principal',
+    delete_principal_function text NOT NULL DEFAULT 'delete_principal',
+
+    -- Org principal function names (generated when org memberships exist)
+    create_org_principal_function text NOT NULL DEFAULT 'create_org_principal',
+    delete_org_principal_function text NOT NULL DEFAULT 'delete_org_principal',
+
+    -- Org API key function names (generated when org memberships exist)
+    create_org_api_key_function text NOT NULL DEFAULT 'create_org_api_key',
+    revoke_org_api_key_function text NOT NULL DEFAULT 'revoke_org_api_key',
+
+    api_name text DEFAULT 'auth',
+
+    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT principals_table_fkey FOREIGN KEY (principals_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT principal_entities_table_fkey FOREIGN KEY (principal_entities_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT users_table_fkey FOREIGN KEY (users_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT sessions_table_fkey FOREIGN KEY (sessions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT session_credentials_table_fkey FOREIGN KEY (session_credentials_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+);
+
+CREATE INDEX principal_auth_module_database_id_idx ON metaschema_modules_public.principal_auth_module ( database_id );
+
+COMMENT ON CONSTRAINT principals_table_fkey
+     ON metaschema_modules_public.principal_auth_module IS E'@omit';
+COMMENT ON CONSTRAINT users_table_fkey
+     ON metaschema_modules_public.principal_auth_module IS E'@omit';
+COMMENT ON CONSTRAINT sessions_table_fkey
+     ON metaschema_modules_public.principal_auth_module IS E'@omit';
+COMMENT ON CONSTRAINT session_credentials_table_fkey
+     ON metaschema_modules_public.principal_auth_module IS E'@omit';
+COMMENT ON CONSTRAINT principal_entities_table_fkey
+     ON metaschema_modules_public.principal_auth_module IS E'@omit';
+
+COMMENT ON TABLE metaschema_modules_public.principal_auth_module IS 'Provisions the principals subsystem: a principals table, a principal_entities junction table, create/delete mutations, and org API key management. Supports both human-owned principals (AuthzDirectOwner, AuthzHumanOnly) and org-owned principals (AuthzEntityMembership with is_admin). Org principal and org API key functions are only generated when an org-scoped memberships_module exists for the database.';
+
+COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/profiles_module/table.sql

@@ -10,6 +10,10 @@ CREATE TABLE metaschema_modules_public.profiles_module (
     --
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
     
     -- Main profiles table
     table_id uuid NOT NULL DEFAULT uuid_nil(),

package/deploy/schemas/metaschema_modules_public/tables/rate_limit_meters_module/table.sql

@@ -13,6 +13,10 @@ CREATE TABLE metaschema_modules_public.rate_limit_meters_module (
   -- Private schema: rate_limit_state table, check_rate_limit function (internal)
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- State table: sliding window tracking per entity/actor/meter/window (private)
   rate_limit_state_table_id uuid NOT NULL DEFAULT uuid_nil(),
   rate_limit_state_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/storage_log_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.storage_log_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Storage log table (partitioned by snapshot_at)
   storage_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
   storage_log_table_name text NOT NULL DEFAULT '',

package/deploy/schemas/metaschema_modules_public/tables/storage_module/table.sql

@@ -12,6 +12,11 @@ CREATE TABLE metaschema_modules_public.storage_module (
     schema_id uuid NOT NULL DEFAULT uuid_nil(),
     private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+    -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+    -- Enables putting storage tables into a dedicated schema (e.g. per-entity isolation).
+    public_schema_name text,
+    private_schema_name text,
+
     -- Generated table IDs (populated by the generator)
     buckets_table_id uuid NOT NULL DEFAULT uuid_nil(),
     files_table_id uuid NOT NULL DEFAULT uuid_nil(),
@@ -92,7 +97,8 @@ CREATE TABLE metaschema_modules_public.storage_module (
 
     -- Constraints
     -- API routing (configurable per-module)
-    api_name text DEFAULT 'admin',
+    -- NULL = no automatic API routing (caller must route explicitly or use entity_type_provision).
+    api_name text DEFAULT NULL,
     private_api_name text DEFAULT NULL,
 
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,

package/deploy/schemas/metaschema_modules_public/tables/transfer_log_module/table.sql

@@ -11,6 +11,10 @@ CREATE TABLE metaschema_modules_public.transfer_log_module (
   schema_id uuid NOT NULL DEFAULT uuid_nil(),
   private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
 
+  -- Schema name overrides: when set, the trigger uses these instead of hardcoded defaults.
+  public_schema_name text,
+  private_schema_name text,
+
   -- Transfer log table (partitioned by created_at)
   transfer_log_table_id uuid NOT NULL DEFAULT uuid_nil(),
   transfer_log_table_name text NOT NULL DEFAULT '',

package/metaschema-modules.control

@@ -1,6 +1,6 @@
 # metaschema-modules extension
 comment = 'metaschema-modules extension'
-default_version = '0.26.5'
+default_version = '0.15.5'
 module_pathname = '$libdir/metaschema-modules'
 requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'
 relocatable = false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.28.3",
+  "version": "0.28.4",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,11 +21,12 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.28.3",
-    "@pgpm/verify": "0.28.3"
+    "@pgpm/metaschema-schema": "0.28.4",
+    "@pgpm/verify": "0.28.4"
   },
   "devDependencies": {
-    "pgpm": "^4.23.2"
+    "constructive-test": "^0.4.1",
+    "pgpm": "^4.28.7"
   },
   "repository": {
     "type": "git",
@@ -35,5 +36,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "ebab5300b911578a615bf8d267fe7c5c244caea3"
+  "gitHead": "08979b82f1f68af396b540c6ce0cda4b438d34f0"
 }

package/pgpm.plan

@@ -58,6 +58,7 @@ schemas/metaschema_modules_public/tables/db_usage_module/table [schemas/metasche
 schemas/metaschema_modules_public/tables/agent_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:01:00Z devin <devin@cognition.ai> # add agent_module config table for AI agent conversation threads, messages, and tasks
 schemas/metaschema_modules_public/tables/merkle_store_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T00:00:00Z devin <devin@cognition.ai> # add merkle_store_module config table for content-addressed Merkle object stores
 schemas/metaschema_modules_public/tables/graph_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/merkle_store_module/table] 2026-05-21T01:00:00Z devin <devin@cognition.ai> # add graph_module config table for FBP graph utilities on top of merkle store
+schemas/metaschema_modules_public/tables/graph_execution_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/graph_module/table] 2026-06-12T00:00:00Z devin <devin@cognition.ai> # add graph_execution_module config table for partitioned execution state + merkle tree time-travel debugging
 schemas/metaschema_modules_public/tables/namespace_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T02:00:00Z devin <devin@cognition.ai> # add namespace_module config table for entity-aware namespace provisioning
 schemas/metaschema_modules_public/tables/function_module/table [schemas/metaschema_modules_public/schema] 2026-05-21T03:00:00Z devin <devin@cognition.ai> # add function_module config table for entity-aware function definitions
 schemas/metaschema_modules_public/tables/function_invocation_module/table [schemas/metaschema_modules_public/schema] 2026-06-08T00:00:00Z devin <devin@cognition.ai> # add function_invocation_module config table for entity-scoped invocations and execution logs
@@ -66,4 +67,6 @@ schemas/metaschema_modules_public/tables/user_credentials_module/table [schemas/
 schemas/metaschema_modules_public/tables/user_settings_module/table [schemas/metaschema_modules_public/schema] 2026-05-28T00:00:00Z devin <devin@cognition.ai> # add user_settings_module for extensible per-user preferences (1:1 with users)
 
 schemas/metaschema_modules_public/tables/i18n_module/table [schemas/metaschema_modules_public/schema] 2026-05-28T00:00:00Z devin <devin@cognition.ai> # add i18n_module config table for internationalization settings
-schemas/metaschema_modules_public/tables/graph_execution_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/graph_module/table] 2026-06-12T00:00:00Z devin <devin@cognition.ai> # add graph_execution_module config table for partitioned execution state + merkle tree time-travel debugging
+schemas/metaschema_modules_public/tables/function_deployment_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/function_module/table schemas/metaschema_modules_public/tables/namespace_module/table] 2026-06-11T06:00:00Z devin <devin@cognition.ai> # add function_deployment_module config table for function-to-namespace deployment binding
+schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database [schemas/metaschema_modules_public/tables/function_module/table] 2026-06-11T08:00:00Z devin <devin@cognition.ai> # enforce at most one platform-scope function_module (unambiguous resolveDatabaseId)
+schemas/metaschema_modules_public/tables/principal_auth_module/table [schemas/metaschema_modules_public/schema] 2026-06-24T11:15:00Z devin <devin@cognition.ai> # add principal_auth_module config table for scoped API keys and agent principals

package/revert/schemas/metaschema_modules_public/tables/config_secrets_module/table.sql

@@ -2,6 +2,6 @@
 
 BEGIN;
 
-DROP TABLE IF EXISTS metaschema_modules_public.config_secrets_module;
+DROP TABLE metaschema_modules_public.config_secrets_module;
 
 COMMIT;

package/revert/schemas/metaschema_modules_public/tables/function_deployment_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/function_deployment_module/table from pg
+
+BEGIN;
+
+DROP TABLE IF EXISTS metaschema_modules_public.function_deployment_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database from pg
+
+BEGIN;
+
+-- No-op: nothing to revert (deploy was a no-op documentation migration)
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/principal_auth_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/principal_auth_module/table from pg
+
+BEGIN;
+
+DROP TABLE metaschema_modules_public.principal_auth_module;
+
+COMMIT;

package/revert/schemas/metaschema_modules_public/tables/user_credentials_module/table.sql

@@ -2,6 +2,6 @@
 
 BEGIN;
 
-DROP TABLE IF EXISTS metaschema_modules_public.user_credentials_module;
+DROP TABLE metaschema_modules_public.user_credentials_module;
 
 COMMIT;

package/revert/schemas/metaschema_modules_public/tables/user_settings_module/table.sql

@@ -2,6 +2,6 @@
 
 BEGIN;
 
-DROP TABLE IF EXISTS metaschema_modules_public.user_settings_module;
+DROP TABLE metaschema_modules_public.user_settings_module;
 
 COMMIT;