@pgpm/metaschema-modules 0.28.5 → 0.29.0

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_module/table.sql

@@ -18,7 +18,6 @@ CREATE TABLE metaschema_modules_public.config_secrets_module (
 
     -- Generated table IDs (populated by the generator)
     table_id uuid NOT NULL DEFAULT uuid_nil(),
-    config_definitions_table_id uuid NULL DEFAULT NULL,
 
     -- Table name (input — bare name without scope prefix).
     -- The trigger prepends the scope prefix automatically.
@@ -31,7 +30,7 @@ CREATE TABLE metaschema_modules_public.config_secrets_module (
     -- Scope: determines the security level for this module instance.
     -- Resolved to a membership_type integer at trigger time via membership_types table.
     -- 'app' = app-level (AuthzAppMembership, admin-only secrets + config)
-    -- 'org' = org-scoped (AuthzEntityMembership, per-org secrets with manage_secrets permission)
+    -- 'platform' / 'database' = platform-level infra (database scope carries a database_id)
     -- custom entity type names for entity-scoped secrets
     -- Note: user-scoped credentials are handled by user_credentials_module (separate module)
     scope text NOT NULL DEFAULT 'app',
@@ -50,15 +49,14 @@ CREATE TABLE metaschema_modules_public.config_secrets_module (
     policies jsonb NULL,
 
     -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (secrets, config_definitions).
+    -- Keys are table keys (secrets).
     -- When a key is present, the module trigger skips default security for that table;
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
 
     -- Feature flags
 
-    -- When true, also creates a plaintext config table ({prefix}_config) and
-    -- a config definitions registry table ({prefix}_config_definitions).
+    -- When true, also creates a plaintext config table ({prefix}_config).
     -- Only meaningful for app-level scope (scope = 'app').
     has_config boolean NOT NULL DEFAULT false,
 
@@ -67,7 +65,6 @@ CREATE TABLE metaschema_modules_public.config_secrets_module (
     CONSTRAINT config_secrets_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT config_secrets_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT config_secrets_module_table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT config_secrets_module_config_defs_table_fkey FOREIGN KEY (config_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT config_secrets_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
@@ -75,12 +72,12 @@ CREATE INDEX config_secrets_module_database_id_idx ON metaschema_modules_public.
 CREATE INDEX config_secrets_module_schema_id_idx ON metaschema_modules_public.config_secrets_module ( schema_id );
 CREATE INDEX config_secrets_module_table_id_idx ON metaschema_modules_public.config_secrets_module ( table_id );
 
--- Unique constraint: one config_secrets module per database per scope per prefix.
-CREATE UNIQUE INDEX config_secrets_module_unique_scope ON metaschema_modules_public.config_secrets_module ( database_id, scope, prefix );
+-- Unique constraint: one config_secrets module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX config_secrets_module_unique_scope ON metaschema_modules_public.config_secrets_module ( database_id, scope );
 
 COMMENT ON TABLE metaschema_modules_public.config_secrets_module IS
     'Entity-aware PGP-encrypted key-value config/secrets module. Supports app-level (admin-only)
-     and org-scoped (per-org secrets with manage_secrets permission) via the scope column.
+     and platform/database-scoped infra secrets via the scope column.
      User-scoped bcrypt credentials are handled by user_credentials_module.';
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_user_module/table.sql

@@ -13,18 +13,13 @@ CREATE TABLE metaschema_modules_public.config_secrets_user_module (
     table_id uuid NOT NULL DEFAULT uuid_nil(),
     table_name text NOT NULL DEFAULT 'user_secrets',
 
-    -- Config definitions table ID (populated by the generator)
-    config_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    -- 
-    
     -- API routing (configurable per-module)
     api_name text DEFAULT 'config',
     private_api_name text DEFAULT NULL,
 
     CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
     CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT config_defs_table_fkey FOREIGN KEY (config_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
+    CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX config_secrets_user_module_database_id_idx ON metaschema_modules_public.config_secrets_user_module ( database_id );

package/deploy/schemas/metaschema_modules_public/tables/entity_type_provision/table.sql

@@ -135,8 +135,6 @@ CREATE TABLE metaschema_modules_public.entity_type_provision (
 
     out_execution_logs_table_id uuid DEFAULT NULL,
 
-    out_secret_definitions_table_id uuid DEFAULT NULL,
-
     out_graph_module_id uuid DEFAULT NULL,
 
     out_graphs_table_id uuid DEFAULT NULL,

package/deploy/schemas/metaschema_modules_public/tables/function_deployment_module/table.sql

@@ -75,7 +75,7 @@ CREATE TABLE metaschema_modules_public.function_deployment_module (
 
 CREATE INDEX function_deployment_module_database_id_idx ON metaschema_modules_public.function_deployment_module ( database_id );
 
--- Unique constraint: one function deployment module per database per scope per prefix.
-CREATE UNIQUE INDEX function_deployment_module_unique_scope ON metaschema_modules_public.function_deployment_module ( database_id, scope, prefix );
+-- Unique constraint: one function deployment module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX function_deployment_module_unique_scope ON metaschema_modules_public.function_deployment_module ( database_id, scope );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/function_invocation_module/table.sql

@@ -61,7 +61,7 @@ CREATE TABLE metaschema_modules_public.function_invocation_module (
 
 CREATE INDEX function_invocation_module_database_id_idx ON metaschema_modules_public.function_invocation_module ( database_id );
 
--- Unique constraint: one function invocation module per database per scope per prefix.
-CREATE UNIQUE INDEX function_invocation_module_unique_scope ON metaschema_modules_public.function_invocation_module ( database_id, scope, prefix );
+-- Unique constraint: one function invocation module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX function_invocation_module_unique_scope ON metaschema_modules_public.function_invocation_module ( database_id, scope );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/function_module/table.sql

@@ -18,12 +18,10 @@ CREATE TABLE metaschema_modules_public.function_module (
 
     -- Generated table IDs (populated by the generator)
     definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    secret_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
 
     -- Table names (input to the generator — bare names without scope prefix).
     -- The trigger prepends the scope prefix automatically.
     definitions_table_name text NOT NULL DEFAULT 'function_definitions',
-    secret_definitions_table_name text NOT NULL DEFAULT 'secret_definitions',
 
     -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
     api_name text,
@@ -47,7 +45,7 @@ CREATE TABLE metaschema_modules_public.function_module (
     policies jsonb NULL,
 
     -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (definitions, secret_definitions).
+    -- Keys are table keys (definitions).
     -- When a key is present, the module trigger skips default security for that table;
     -- secure_table_provision applies the custom grants/policies instead.
     provisions jsonb NULL,
@@ -61,13 +59,12 @@ CREATE TABLE metaschema_modules_public.function_module (
     CONSTRAINT function_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT function_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
     CONSTRAINT function_module_definitions_table_fkey FOREIGN KEY (definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT function_module_secret_defs_table_fkey FOREIGN KEY (secret_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
     CONSTRAINT function_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
 CREATE INDEX function_module_database_id_idx ON metaschema_modules_public.function_module ( database_id );
 
--- Unique constraint: one function module per database per scope per prefix.
-CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, scope, prefix );
+-- Unique constraint: one function module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX function_module_unique_scope ON metaschema_modules_public.function_module ( database_id, scope );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/graph_execution_module/table.sql

@@ -77,7 +77,7 @@ CREATE TABLE metaschema_modules_public.graph_execution_module (
 
 CREATE INDEX graph_execution_module_database_id_idx ON metaschema_modules_public.graph_execution_module ( database_id );
 
--- One execution module per (database, scope, prefix).
-CREATE UNIQUE INDEX graph_execution_module_unique_scope ON metaschema_modules_public.graph_execution_module ( database_id, scope, prefix );
+-- One execution module per (database, scope) (K8s infra: scopes never share).
+CREATE UNIQUE INDEX graph_execution_module_unique_scope ON metaschema_modules_public.graph_execution_module ( database_id, scope );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/identity_providers_module/table.sql

@@ -25,8 +25,9 @@ CREATE TABLE metaschema_modules_public.identity_providers_module (
 
     -- Entity-aware scope: determines which config_secrets_module table
     -- the rotate_identity_provider_{prefix}_secret proc targets.
-    --   'app'  = app_secrets (AuthzAppMembership, admin-only)
-    --   'org'  = org_secrets (AuthzEntityMembership, per-org)
+    --   'app'      = app_secrets (AuthzAppMembership, admin-only)
+    --   'platform' = platform_secrets (platform-wide infra)
+    --   'database' = secrets (per-database infra, carries database_id)
     -- Future entity types are also supported via the membership_types table.
     scope text NOT NULL DEFAULT 'app',
 
@@ -57,13 +58,12 @@ COMMENT ON TABLE metaschema_modules_public.identity_providers_module IS
     'Entity-aware config row for the identity_providers_module, which provisions a per-database
      identity_providers table holding OAuth2 / OIDC (and future SAML) provider definitions.
      The scope column determines which config_secrets_module table the rotate proc targets
-     (app_secrets for app scope, org_secrets for org scope). When scope = platform,
-     the secrets table gets a database_id column and platform-level RLS via
-     AuthzRelatedEntityMembership through database.owner_id.
+     (app_secrets for app scope, platform_secrets for platform scope). When scope = database,
+     the secrets table gets a database_id column.
      Scoping matrix:
        scope=app       → per-database flat, in-app admin manages
-       scope=platform  → per-database, platform admin manages (generate:constructive)
-       scope=org       → per-org tenant, org admin manages';
+       scope=platform  → platform-wide, platform admin manages (generate:constructive)
+       scope=database  → per-database infra, carries database_id';
 COMMENT ON COLUMN metaschema_modules_public.identity_providers_module.private_schema_id IS 'Private schema that hosts SECURITY DEFINER admin helpers which write to identity_providers (create / update / enable / disable / rotate-secret / delete) and the per-app quota check.';
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/namespace_module/table.sql

@@ -39,12 +39,6 @@ CREATE TABLE metaschema_modules_public.namespace_module (
     -- Entity table for RLS (NULL for app-level namespaces, entity table for entity-scoped namespaces)
     entity_table_id uuid NULL,
 
-    -- Platform namespace table reference (for cross-scope mirror trigger).
-    -- When scope != 'platform', the insert trigger resolves this automatically
-    -- from the platform-scope namespace_module row.
-    -- NULL means no mirror trigger (platform scope, or no platform module exists).
-    platform_namespaces_table_id uuid NULL,
-
     -- Configurable security policies (NULL = use defaults based on scope).
     -- When provided, replaces the default policy set in apply_namespace_security.
     -- Accepts a JSON array of policy objects:
@@ -72,7 +66,7 @@ CREATE TABLE metaschema_modules_public.namespace_module (
 
 CREATE INDEX namespace_module_database_id_idx ON metaschema_modules_public.namespace_module ( database_id );
 
--- Unique constraint: one namespace module per database per scope per prefix.
-CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, scope, prefix );
+-- Unique constraint: one namespace module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX namespace_module_unique_scope ON metaschema_modules_public.namespace_module ( database_id, scope );
 
 COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/resource_module/table.sql

@@ -0,0 +1,76 @@
+-- Deploy schemas/metaschema_modules_public/tables/resource_module/table to pg
+
+-- requires: schemas/metaschema_modules_public/schema
+-- requires: schemas/metaschema_modules_public/tables/namespace_module/table
+
+BEGIN;
+
+CREATE TABLE metaschema_modules_public.resource_module (
+    id uuid PRIMARY KEY DEFAULT uuidv7(),
+    database_id uuid NOT NULL,
+
+    -- Schema references (if uuid_nil, resolved from schema name or default)
+    schema_id uuid NOT NULL DEFAULT uuid_nil(),
+    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Optional schema name overrides (used when schema IDs are not provided)
+    public_schema_name text,
+    private_schema_name text,
+
+    -- Generated table IDs (populated by the generator)
+    resources_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    resource_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    resource_status_checks_table_id uuid NOT NULL DEFAULT uuid_nil(),
+    resource_definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
+
+    -- Table names (input to the generator — bare names without scope prefix).
+    -- The trigger prepends the scope prefix automatically.
+    resources_table_name text NOT NULL DEFAULT 'resources',
+    resource_events_table_name text NOT NULL DEFAULT 'resource_events',
+    resource_status_checks_table_name text NOT NULL DEFAULT 'resource_status_checks',
+    resource_definitions_table_name text NOT NULL DEFAULT 'resource_definitions',
+
+    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
+    api_name text,
+    private_api_name text,
+
+    -- Scope: determines the security level for this module instance.
+    scope text NOT NULL DEFAULT 'app',
+
+    -- Table name prefix. Auto-derived from scope by the trigger when empty.
+    prefix text NOT NULL DEFAULT '',
+
+    -- Entity table for RLS (NULL for app-level resources, entity table for entity-scoped)
+    entity_table_id uuid NULL,
+
+    -- FK to namespace_module: which namespaces table resources are scoped to
+    namespace_module_id uuid NULL,
+
+    -- Configurable security policies (NULL = use defaults based on scope).
+    policies jsonb NULL,
+
+    -- Per-table provisions overrides from blueprint config.
+    -- Keys are table keys (resources, resource_events).
+    provisions jsonb NULL,
+
+    -- Default permissions: permission names auto-granted to new members.
+    default_permissions text[] DEFAULT NULL,
+
+    -- Constraints
+    CONSTRAINT resource_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_resources_table_fkey FOREIGN KEY (resources_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_events_table_fkey FOREIGN KEY (resource_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_status_checks_table_fkey FOREIGN KEY (resource_status_checks_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_definitions_table_fkey FOREIGN KEY (resource_definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+    CONSTRAINT resource_module_namespace_module_fkey FOREIGN KEY (namespace_module_id) REFERENCES metaschema_modules_public.namespace_module (id) ON DELETE SET NULL
+);
+
+CREATE INDEX resource_module_database_id_idx ON metaschema_modules_public.resource_module ( database_id );
+
+-- Unique constraint: one resource module per database per scope (K8s infra: scopes never share).
+CREATE UNIQUE INDEX resource_module_unique_scope ON metaschema_modules_public.resource_module ( database_id, scope );
+
+COMMIT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpm/metaschema-modules",
-  "version": "0.28.5",
+  "version": "0.29.0",
   "description": "Module metadata handling and dependency tracking",
   "author": "Dan Lynch <pyramation@gmail.com>",
   "contributors": [
@@ -21,8 +21,8 @@
     "test:watch": "jest --watch"
   },
   "dependencies": {
-    "@pgpm/metaschema-schema": "0.28.4",
-    "@pgpm/verify": "0.28.4"
+    "@pgpm/metaschema-schema": "0.29.0",
+    "@pgpm/verify": "0.29.0"
   },
   "devDependencies": {
     "constructive-test": "^0.4.1",
@@ -36,5 +36,5 @@
   "bugs": {
     "url": "https://github.com/constructive-io/pgpm-modules/issues"
   },
-  "gitHead": "1ea2567e22a81f4d0b2bea83c3e1289406015e58"
+  "gitHead": "a896e2ee50a376c53d94b92c0bcb59bef0071717"
 }

package/pgpm.plan

@@ -49,7 +49,6 @@ schemas/metaschema_modules_public/tables/billing_module/table [schemas/metaschem
 schemas/metaschema_modules_public/tables/billing_provider_module/table [schemas/metaschema_modules_public/schema] 2026-05-03T01:00:00Z devin <devin@cognition.ai> # add billing_provider_module config table for external billing provider integration
 schemas/metaschema_modules_public/tables/realtime_module/table [schemas/metaschema_modules_public/schema] 2026-05-09T10:00:00Z devin <devin@cognition.ai> # add realtime_module config table for real-time subscription infrastructure
 schemas/metaschema_modules_public/tables/rate_limit_meters_module/table [schemas/metaschema_modules_public/schema] 2026-05-16T00:00:00Z devin <devin@cognition.ai> # add rate_limit_meters_module for rolling window abuse protection (standalone rate limiting)
-schemas/metaschema_modules_public/tables/config_secrets_org_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T00:00:00Z devin <devin@cognition.ai> # add config_secrets_org_module config table for org-scoped encrypted secrets
 schemas/metaschema_modules_public/tables/inference_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-12T23:00:00Z devin <devin@cognition.ai> # add inference_log_module config table for partitioned LLM inference logging
 schemas/metaschema_modules_public/tables/compute_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T20:00:00Z devin <devin@cognition.ai> # add compute_log_module config table for partitioned compute usage logging
 schemas/metaschema_modules_public/tables/transfer_log_module/table [schemas/metaschema_modules_public/schema] 2026-05-18T21:00:00Z devin <devin@cognition.ai> # add transfer_log_module config table for partitioned transfer/bandwidth logging
@@ -70,7 +69,4 @@ schemas/metaschema_modules_public/tables/i18n_module/table [schemas/metaschema_m
 schemas/metaschema_modules_public/tables/function_deployment_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/function_module/table schemas/metaschema_modules_public/tables/namespace_module/table] 2026-06-11T06:00:00Z devin <devin@cognition.ai> # add function_deployment_module config table for function-to-namespace deployment binding
 schemas/metaschema_modules_public/tables/function_module/constraints/one_platform_database [schemas/metaschema_modules_public/tables/function_module/table] 2026-06-11T08:00:00Z devin <devin@cognition.ai> # enforce at most one platform-scope function_module (unambiguous resolveDatabaseId)
 schemas/metaschema_modules_public/tables/principal_auth_module/table [schemas/metaschema_modules_public/schema] 2026-06-24T11:15:00Z devin <devin@cognition.ai> # add principal_auth_module config table for scoped API keys and agent principals
-schemas/metaschema_modules_public/tables/server_definition_module/table [schemas/metaschema_modules_public/schema] 2026-06-30T00:00:00Z devin <devin@cognition.ai> # add server_definition_module config table for persistent server definitions (GraphQL, agentic, WebSocket, etc.)
-schemas/metaschema_modules_public/tables/server_deployment_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/server_definition_module/table schemas/metaschema_modules_public/tables/namespace_module/table] 2026-06-30T00:00:01Z devin <devin@cognition.ai> # add server_deployment_module config table for server-to-namespace deployment binding
-schemas/metaschema_modules_public/tables/route_module/table [schemas/metaschema_modules_public/schema] 2026-06-30T00:00:02Z devin <devin@cognition.ai> # add route_module config table for gateway route rules (domain+path to backend target)
-schemas/metaschema_modules_public/tables/certificate_module/table [schemas/metaschema_modules_public/schema] 2026-06-30T00:00:03Z devin <devin@cognition.ai> # add certificate_module config table for TLS certificate lifecycle management
+schemas/metaschema_modules_public/tables/resource_module/table [schemas/metaschema_modules_public/schema schemas/metaschema_modules_public/tables/namespace_module/table] 2026-07-02T00:00:00Z devin <devin@cognition.ai> # add resource_module config table for unified K8s resource management (kind-based dispatch)

package/revert/schemas/metaschema_modules_public/tables/resource_module/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/metaschema_modules_public/tables/resource_module/table from pg
+
+BEGIN;
+
+DROP TABLE IF EXISTS metaschema_modules_public.resource_module;
+
+COMMIT;