@pgpm/metaschema-modules 0.28.5 → 0.29.0

package/verify/schemas/metaschema_modules_public/tables/resource_module/table.sql

@@ -0,0 +1,13 @@
+-- Verify schemas/metaschema_modules_public/tables/resource_module/table on pg
+
+BEGIN;
+
+SELECT id, database_id, schema_id, private_schema_id,
+       resources_table_id, resource_events_table_id,
+       resources_table_name, resource_events_table_name,
+       scope, prefix, entity_table_id, namespace_module_id,
+       policies, provisions, default_permissions
+FROM metaschema_modules_public.resource_module
+WHERE FALSE;
+
+ROLLBACK;

package/deploy/schemas/metaschema_modules_public/tables/certificate_module/table.sql

@@ -1,66 +0,0 @@
--- Deploy schemas/metaschema_modules_public/tables/certificate_module/table to pg
-
--- requires: schemas/metaschema_modules_public/schema
-
-BEGIN;
-
-CREATE TABLE metaschema_modules_public.certificate_module (
-    id uuid PRIMARY KEY DEFAULT uuidv7(),
-    database_id uuid NOT NULL,
-
-    -- Schema references (if uuid_nil, resolved from schema name or default)
-    schema_id uuid NOT NULL DEFAULT uuid_nil(),
-    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Optional schema name overrides (used when schema IDs are not provided)
-    public_schema_name text,
-    private_schema_name text,
-
-    -- Generated table IDs (populated by the generator)
-    certificates_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    certificate_domains_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    certificate_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Table names (input to the generator — bare names without scope prefix).
-    certificates_table_name text NOT NULL DEFAULT 'certificates',
-    certificate_domains_table_name text NOT NULL DEFAULT 'certificate_domains',
-    certificate_events_table_name text NOT NULL DEFAULT 'certificate_events',
-
-    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
-    api_name text,
-    private_api_name text,
-
-    -- Scope: determines the security level for this module instance.
-    scope text NOT NULL DEFAULT 'platform',
-
-    -- Table name prefix. Auto-derived from scope by the trigger when empty.
-    prefix text NOT NULL DEFAULT '',
-
-    -- Entity table for RLS
-    entity_table_id uuid NULL,
-
-    -- Configurable security policies (NULL = use defaults based on scope).
-    policies jsonb NULL,
-
-    -- Per-table provisions overrides from blueprint config.
-    provisions jsonb NULL,
-
-    -- Default permissions: permission names auto-granted to new members.
-    default_permissions text[] DEFAULT NULL,
-
-    -- Constraints
-    CONSTRAINT certificate_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_certs_table_fkey FOREIGN KEY (certificates_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_cert_domains_table_fkey FOREIGN KEY (certificate_domains_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_events_table_fkey FOREIGN KEY (certificate_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT certificate_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
-);
-
-CREATE INDEX certificate_module_database_id_idx ON metaschema_modules_public.certificate_module ( database_id );
-
--- Unique constraint: one certificate module per database per scope per prefix.
-CREATE UNIQUE INDEX certificate_module_unique_scope ON metaschema_modules_public.certificate_module ( database_id, scope, prefix );
-
-COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/config_secrets_org_module/table.sql

@@ -1,32 +0,0 @@
--- Deploy schemas/metaschema_modules_public/tables/config_secrets_org_module/table to pg
-
--- requires: schemas/metaschema_modules_public/schema
-
-BEGIN;
-
-CREATE TABLE metaschema_modules_public.config_secrets_org_module (
-    id uuid PRIMARY KEY DEFAULT uuidv7(),
-    database_id uuid NOT NULL,
-
-    --
-    schema_id uuid NOT NULL DEFAULT uuid_nil(),
-    table_id uuid NOT NULL DEFAULT uuid_nil(),
-    table_name text NOT NULL DEFAULT 'org_secrets',
-    --
-
-    -- API routing (configurable per-module)
-    api_name text DEFAULT 'config',
-    private_api_name text DEFAULT NULL,
-
-    CONSTRAINT db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
-    CONSTRAINT schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT table_fkey FOREIGN KEY (table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
-);
-
-CREATE INDEX config_secrets_org_module_database_id_idx ON metaschema_modules_public.config_secrets_org_module ( database_id );
-CREATE INDEX config_secrets_org_module_schema_id_idx ON metaschema_modules_public.config_secrets_org_module ( schema_id );
-CREATE INDEX config_secrets_org_module_table_id_idx ON metaschema_modules_public.config_secrets_org_module ( table_id );
-
-COMMENT ON TABLE metaschema_modules_public.config_secrets_org_module IS 'Config row for the config_secrets_org_module, which provisions an organization-scoped encrypted key-value secrets store with manage_secrets permission and entity-membership RLS.';
-
-COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/route_module/table.sql

@@ -1,63 +0,0 @@
--- Deploy schemas/metaschema_modules_public/tables/route_module/table to pg
-
--- requires: schemas/metaschema_modules_public/schema
-
-BEGIN;
-
-CREATE TABLE metaschema_modules_public.route_module (
-    id uuid PRIMARY KEY DEFAULT uuidv7(),
-    database_id uuid NOT NULL,
-
-    -- Schema references (if uuid_nil, resolved from schema name or default)
-    schema_id uuid NOT NULL DEFAULT uuid_nil(),
-    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Optional schema name overrides (used when schema IDs are not provided)
-    public_schema_name text,
-    private_schema_name text,
-
-    -- Generated table IDs (populated by the generator)
-    routes_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    route_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Table names (input to the generator — bare names without scope prefix).
-    routes_table_name text NOT NULL DEFAULT 'routes',
-    route_events_table_name text NOT NULL DEFAULT 'route_events',
-
-    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
-    api_name text,
-    private_api_name text,
-
-    -- Scope: determines the security level for this module instance.
-    scope text NOT NULL DEFAULT 'platform',
-
-    -- Table name prefix. Auto-derived from scope by the trigger when empty.
-    prefix text NOT NULL DEFAULT '',
-
-    -- Entity table for RLS
-    entity_table_id uuid NULL,
-
-    -- Configurable security policies (NULL = use defaults based on scope).
-    policies jsonb NULL,
-
-    -- Per-table provisions overrides from blueprint config.
-    provisions jsonb NULL,
-
-    -- Default permissions: permission names auto-granted to new members.
-    default_permissions text[] DEFAULT NULL,
-
-    -- Constraints
-    CONSTRAINT route_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
-    CONSTRAINT route_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT route_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT route_module_routes_table_fkey FOREIGN KEY (routes_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT route_module_events_table_fkey FOREIGN KEY (route_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT route_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
-);
-
-CREATE INDEX route_module_database_id_idx ON metaschema_modules_public.route_module ( database_id );
-
--- Unique constraint: one route module per database per scope per prefix.
-CREATE UNIQUE INDEX route_module_unique_scope ON metaschema_modules_public.route_module ( database_id, scope, prefix );
-
-COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/server_definition_module/table.sql

@@ -1,70 +0,0 @@
--- Deploy schemas/metaschema_modules_public/tables/server_definition_module/table to pg
-
--- requires: schemas/metaschema_modules_public/schema
-
-BEGIN;
-
-CREATE TABLE metaschema_modules_public.server_definition_module (
-    id uuid PRIMARY KEY DEFAULT uuidv7(),
-    database_id uuid NOT NULL,
-
-    -- Schema references (if uuid_nil, resolved from schema name or default)
-    schema_id uuid NOT NULL DEFAULT uuid_nil(),
-    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Optional schema name overrides (used when schema IDs are not provided)
-    public_schema_name text,
-    private_schema_name text,
-
-    -- Generated table IDs (populated by the generator)
-    definitions_table_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Table names (input to the generator — bare names without scope prefix).
-    -- The trigger prepends the scope prefix automatically.
-    definitions_table_name text NOT NULL DEFAULT 'server_definitions',
-
-    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
-    api_name text,
-    private_api_name text,
-
-    -- Scope: determines the security level for this module instance.
-    -- Resolved to a membership_type integer at trigger time via membership_types table.
-    scope text NOT NULL DEFAULT 'platform',
-
-    -- Table name prefix. Auto-derived from scope by the trigger when empty.
-    -- Override to create multiple module instances at the same scope.
-    prefix text NOT NULL DEFAULT '',
-
-    -- Entity table for RLS (NULL for platform-level definitions, entity table for entity-scoped)
-    entity_table_id uuid NULL,
-
-    -- Configurable security policies (NULL = use defaults based on scope).
-    -- When provided, replaces the default policy set in apply_server_definition_security.
-    -- Accepts a JSON array of policy objects:
-    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
-    policies jsonb NULL,
-
-    -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (definitions).
-    -- When a key is present, the module trigger skips default security for that table;
-    -- secure_table_provision applies the custom grants/policies instead.
-    provisions jsonb NULL,
-
-    -- Default permissions: permission names auto-granted to new members.
-    -- NULL uses the module's built-in defaults; explicit array overrides them.
-    default_permissions text[] DEFAULT NULL,
-
-    -- Constraints
-    CONSTRAINT server_definition_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
-    CONSTRAINT server_definition_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT server_definition_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT server_definition_module_definitions_table_fkey FOREIGN KEY (definitions_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT server_definition_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
-);
-
-CREATE INDEX server_definition_module_database_id_idx ON metaschema_modules_public.server_definition_module ( database_id );
-
--- Unique constraint: one server definition module per database per scope per prefix.
-CREATE UNIQUE INDEX server_definition_module_unique_scope ON metaschema_modules_public.server_definition_module ( database_id, scope, prefix );
-
-COMMIT;

package/deploy/schemas/metaschema_modules_public/tables/server_deployment_module/table.sql

@@ -1,83 +0,0 @@
--- Deploy schemas/metaschema_modules_public/tables/server_deployment_module/table to pg
-
--- requires: schemas/metaschema_modules_public/schema
--- requires: schemas/metaschema_modules_public/tables/server_definition_module/table
--- requires: schemas/metaschema_modules_public/tables/namespace_module/table
-
-BEGIN;
-
-CREATE TABLE metaschema_modules_public.server_deployment_module (
-    id uuid PRIMARY KEY DEFAULT uuidv7(),
-    database_id uuid NOT NULL,
-
-    -- Schema references (if uuid_nil, resolved from schema name or default)
-    schema_id uuid NOT NULL DEFAULT uuid_nil(),
-    private_schema_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Optional schema name overrides (used when schema IDs are not provided)
-    public_schema_name text,
-    private_schema_name text,
-
-    -- Generated table IDs (populated by the generator)
-    deployments_table_id uuid NOT NULL DEFAULT uuid_nil(),
-    deployment_events_table_id uuid NOT NULL DEFAULT uuid_nil(),
-
-    -- Table names (input to the generator — bare names without scope prefix).
-    -- The trigger prepends the scope prefix automatically.
-    deployments_table_name text NOT NULL DEFAULT 'server_deployments',
-    deployment_events_table_name text NOT NULL DEFAULT 'server_deployment_events',
-
-    -- API routing (get-or-create: if set, schema is added to this API; if NULL, no API is added)
-    api_name text,
-    private_api_name text,
-
-    -- Scope: determines the security level for this module instance.
-    -- Resolved to a membership_type integer at trigger time via membership_types table.
-    scope text NOT NULL DEFAULT 'app',
-
-    -- Table name prefix. Auto-derived from scope by the trigger when empty.
-    -- Override to create multiple module instances at the same scope.
-    prefix text NOT NULL DEFAULT '',
-
-    -- Entity table for RLS (NULL for app-level deployments, entity table for entity-scoped)
-    entity_table_id uuid NULL,
-
-    -- FK to server_definition_module: which server definitions table deployments reference
-    server_definition_module_id uuid NULL,
-
-    -- FK to namespace_module: which namespaces table deployments reference
-    namespace_module_id uuid NULL,
-
-    -- Configurable security policies (NULL = use defaults based on scope).
-    -- When provided, replaces the default policy set in apply_server_deployment_security.
-    -- Accepts a JSON array of policy objects:
-    --   {"$type": "AuthzEntityMembership", "privileges": ["select", "update"], "data": {...}}
-    policies jsonb NULL,
-
-    -- Per-table provisions overrides from blueprint config.
-    -- Keys are table keys (deployments, deployment_events).
-    -- When a key is present, the module trigger skips default security for that table;
-    -- secure_table_provision applies the custom grants/policies instead.
-    provisions jsonb NULL,
-
-    -- Default permissions: permission names auto-granted to new members.
-    -- NULL uses the module's built-in defaults; explicit array overrides them.
-    default_permissions text[] DEFAULT NULL,
-
-    -- Constraints
-    CONSTRAINT server_deployment_module_db_fkey FOREIGN KEY (database_id) REFERENCES metaschema_public.database (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_schema_fkey FOREIGN KEY (schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_private_schema_fkey FOREIGN KEY (private_schema_id) REFERENCES metaschema_public.schema (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_deployments_table_fkey FOREIGN KEY (deployments_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_events_table_fkey FOREIGN KEY (deployment_events_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
-    CONSTRAINT server_deployment_module_server_def_module_fkey FOREIGN KEY (server_definition_module_id) REFERENCES metaschema_modules_public.server_definition_module (id) ON DELETE SET NULL,
-    CONSTRAINT server_deployment_module_namespace_module_fkey FOREIGN KEY (namespace_module_id) REFERENCES metaschema_modules_public.namespace_module (id) ON DELETE SET NULL
-);
-
-CREATE INDEX server_deployment_module_database_id_idx ON metaschema_modules_public.server_deployment_module ( database_id );
-
--- Unique constraint: one server deployment module per database per scope per prefix.
-CREATE UNIQUE INDEX server_deployment_module_unique_scope ON metaschema_modules_public.server_deployment_module ( database_id, scope, prefix );
-
-COMMIT;

package/revert/schemas/metaschema_modules_public/tables/certificate_module/table.sql

@@ -1,7 +0,0 @@
--- Revert schemas/metaschema_modules_public/tables/certificate_module/table from pg
-
-BEGIN;
-
-DROP TABLE IF EXISTS metaschema_modules_public.certificate_module;
-
-COMMIT;

package/revert/schemas/metaschema_modules_public/tables/config_secrets_org_module/table.sql

@@ -1,7 +0,0 @@
--- Revert schemas/metaschema_modules_public/tables/config_secrets_org_module/table from pg
-
-BEGIN;
-
-DROP TABLE metaschema_modules_public.config_secrets_org_module;
-
-COMMIT;

package/revert/schemas/metaschema_modules_public/tables/route_module/table.sql

@@ -1,7 +0,0 @@
--- Revert schemas/metaschema_modules_public/tables/route_module/table from pg
-
-BEGIN;
-
-DROP TABLE IF EXISTS metaschema_modules_public.route_module;
-
-COMMIT;

package/revert/schemas/metaschema_modules_public/tables/server_definition_module/table.sql

@@ -1,7 +0,0 @@
--- Revert schemas/metaschema_modules_public/tables/server_definition_module/table from pg
-
-BEGIN;
-
-DROP TABLE IF EXISTS metaschema_modules_public.server_definition_module;
-
-COMMIT;

package/revert/schemas/metaschema_modules_public/tables/server_deployment_module/table.sql

@@ -1,7 +0,0 @@
--- Revert schemas/metaschema_modules_public/tables/server_deployment_module/table from pg
-
-BEGIN;
-
-DROP TABLE IF EXISTS metaschema_modules_public.server_deployment_module;
-
-COMMIT;

package/verify/schemas/metaschema_modules_public/tables/certificate_module/table.sql

@@ -1,7 +0,0 @@
--- Verify schemas/metaschema_modules_public/tables/certificate_module/table on pg
-
-BEGIN;
-
-SELECT verify_table ('metaschema_modules_public.certificate_module');
-
-ROLLBACK;

package/verify/schemas/metaschema_modules_public/tables/config_secrets_org_module/table.sql

@@ -1,5 +0,0 @@
--- Verify schemas/metaschema_modules_public/tables/config_secrets_org_module/table on pg
-
-SELECT id, database_id
-FROM metaschema_modules_public.config_secrets_org_module
-WHERE FALSE;

package/verify/schemas/metaschema_modules_public/tables/route_module/table.sql

@@ -1,7 +0,0 @@
--- Verify schemas/metaschema_modules_public/tables/route_module/table on pg
-
-BEGIN;
-
-SELECT verify_table ('metaschema_modules_public.route_module');
-
-ROLLBACK;

package/verify/schemas/metaschema_modules_public/tables/server_definition_module/table.sql

@@ -1,7 +0,0 @@
--- Verify schemas/metaschema_modules_public/tables/server_definition_module/table on pg
-
-BEGIN;
-
-SELECT verify_table ('metaschema_modules_public.server_definition_module');
-
-ROLLBACK;

package/verify/schemas/metaschema_modules_public/tables/server_deployment_module/table.sql

@@ -1,7 +0,0 @@
--- Verify schemas/metaschema_modules_public/tables/server_deployment_module/table on pg
-
-BEGIN;
-
-SELECT verify_table ('metaschema_modules_public.server_deployment_module');
-
-ROLLBACK;