sync: port the machine, repository and image module tables from constructive-db

packages/function-resolution/__tests__/capabilities.test.ts

@@ -175,8 +175,8 @@ describe('function-resolution capability resolution', () => {
           resource_installations_table_id, apps_table_id, buckets_table_id,
           sites_web_config_table_id, sites_error_pages_table_id,
           sites_app_links_table_id, sites_deep_links_table_id,
-          bindings_table_id, scope)
-       VALUES ($1, $2, $3, $3, $4, $3, $3, $3, $3, $3, $3, $5, $3, $3, $3, $3, $6, 'database')`,
+          redirects_table_id, bindings_table_id, scope)
+       VALUES ($1, $2, $3, $3, $4, $3, $3, $3, $3, $3, $3, $5, $3, $3, $3, $3, $3, $6, 'database')`,
       [
         TENANT_DB,
         catFunctions.schemaId,

packages/function-resolution/__tests__/catalog-fastpath.test.ts

@@ -200,8 +200,8 @@ describe('function-resolution catalog fast-path', () => {
           resource_installations_table_id, apps_table_id, buckets_table_id,
           sites_web_config_table_id, sites_error_pages_table_id,
           sites_app_links_table_id, sites_deep_links_table_id,
-          bindings_table_id, scope)
-       VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
+          redirects_table_id, bindings_table_id, scope)
+       VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
       [TENANT_DB, catSchema.id, catTable.id]
     );
 

packages/function-resolution/__tests__/published-capability-catalog.test.ts

@@ -242,8 +242,9 @@ describe('capability resolution against the published catalog planes', () => {
             resource_installations_table_id, apps_table_id, buckets_table_id,
             bindings_table_id, sites_web_config_table_id,
             sites_error_pages_table_id,
-            sites_app_links_table_id, sites_deep_links_table_id, scope)
-         VALUES ($1, $2, $3, $3, $4, $3, $3, $3, $3, $3, $3, $5, $6, $3, $3, $3, $3, 'database')`,
+            sites_app_links_table_id, sites_deep_links_table_id,
+            redirects_table_id, scope)
+         VALUES ($1, $2, $3, $3, $4, $3, $3, $3, $3, $3, $3, $5, $6, $3, $3, $3, $3, $3, 'database')`,
         [dbId, schemaId, bucketsTableId, apisTableId, bucketsTableId, bindingsTableId]
       );
       // Label kept for readability of the fixture rows above.

packages/function-resolution/__tests__/published-catalog.test.ts

@@ -147,8 +147,8 @@ describe('function-resolution against the published catalog plane', () => {
             resource_installations_table_id, apps_table_id, buckets_table_id,
             sites_web_config_table_id, sites_error_pages_table_id,
             sites_app_links_table_id, sites_deep_links_table_id,
-            bindings_table_id, scope)
-         VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
+            redirects_table_id, bindings_table_id, scope)
+         VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
         [dbId, schemaId, tableId]
       );
 

packages/function-resolution/__tests__/resolution.test.ts

@@ -160,8 +160,8 @@ describe('function-resolution end-to-end (format-based, no AST)', () => {
           resource_installations_table_id, apps_table_id, buckets_table_id,
           sites_web_config_table_id, sites_error_pages_table_id,
           sites_app_links_table_id, sites_deep_links_table_id,
-          bindings_table_id, scope)
-       VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
+          redirects_table_id, bindings_table_id, scope)
+       VALUES ($1, $2, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, $3, 'app')`,
       [TENANT_DB, catSchema.id, catTable.id]
     );
   });

packages/jwt-claims/deploy/schemas/jwt_private/procedures/current_database_id.sql

@@ -16,6 +16,11 @@ BEGIN;
 --
 -- pg_input_is_valid() validates without raising, so no EXCEPTION block is
 -- needed: an exception handler would open a subtransaction on every call
+--
+-- LEAKPROOF like its sibling claim readers: it takes no arguments, so it can
+-- leak nothing about the row a policy is testing, and the planner may push the
+-- claim comparison down instead of treating every policy that reads a claim as
+-- a barrier. Its one error path depends on the session, never on a value.
 CREATE FUNCTION jwt_private.current_database_id()
   RETURNS uuid
 AS $$
@@ -35,6 +40,6 @@ BEGIN
   RETURN database_id;
 END;
 $$
-LANGUAGE 'plpgsql' STABLE;
+LANGUAGE 'plpgsql' STABLE LEAKPROOF;
 
 COMMIT;

packages/jwt-claims/sql/pgpm-jwt-claims--0.41.0.sql

@@ -103,7 +103,7 @@ BEGIN
   END IF;
   RETURN database_id;
 END;
-$EOFCODE$ LANGUAGE plpgsql STABLE;
+$EOFCODE$ LANGUAGE plpgsql STABLE LEAKPROOF;
 
 CREATE FUNCTION jwt_private.current_token_id() RETURNS uuid AS $EOFCODE$
   SELECT nullif(current_setting('jwt.claims.token_id', true), '')::uuid;

packages/metaschema-modules/__tests__/__snapshots__/modules.test.ts.snap

@@ -34,13 +34,17 @@ exports[`db_meta_modules should have all expected module tables 1`] = `
     "http_route_module",
     "i18n_module",
     "identity_providers_module",
+    "image_module",
     "inference_log_module",
     "infra_config_module",
     "infra_secrets_module",
     "integration_providers_module",
+    "internal_config_module",
     "internal_secrets_module",
     "invites_module",
+    "k8s_admission_module",
     "limits_module",
+    "machine_module",
     "membership_types_module",
     "memberships_module",
     "merkle_store_module",
@@ -55,6 +59,7 @@ exports[`db_meta_modules should have all expected module tables 1`] = `
     "rate_limit_meters_module",
     "rate_limits_module",
     "realtime_module",
+    "repository_module",
     "resource_module",
     "rls_module",
     "route_module",
@@ -80,8 +85,8 @@ exports[`db_meta_modules should have all expected module tables 1`] = `
 
 exports[`db_meta_modules should verify all module tables exist in metaschema_modules_public schema 1`] = `
 {
-  "moduleTablesCount": 71,
-  "totalTables": 80,
+  "moduleTablesCount": 76,
+  "totalTables": 85,
 }
 `;
 
@@ -148,13 +153,13 @@ exports[`db_meta_modules should verify emails_module table structure 1`] = `
 
 exports[`db_meta_modules should verify module table structures have database_id foreign keys 1`] = `
 {
-  "constraintCount": 71,
+  "constraintCount": 76,
 }
 `;
 
 exports[`db_meta_modules should verify module tables have proper foreign key relationships 1`] = `
 {
-  "constraintCount": 505,
+  "constraintCount": 551,
   "foreignTables": [
     "catalog_module",
     "database",

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/agent_module/table.sql

@@ -30,6 +30,9 @@ CREATE TABLE metaschema_modules_public.agent_module (
   agent_table_id uuid DEFAULT NULL,
   persona_table_id uuid DEFAULT NULL,
   resource_table_id uuid DEFAULT NULL,
+  run_table_id uuid DEFAULT NULL,
+  event_table_id uuid DEFAULT NULL,
+  workspace_table_id uuid DEFAULT NULL,
 
   -- Table names (input to the generator)
   thread_table_name text NOT NULL DEFAULT 'agent_thread',
@@ -40,12 +43,28 @@ CREATE TABLE metaschema_modules_public.agent_module (
   agent_table_name text NOT NULL DEFAULT 'agent',
   persona_table_name text NOT NULL DEFAULT 'agent_persona',
   resource_table_name text NOT NULL DEFAULT 'agent_resource',
+  run_table_name text NOT NULL DEFAULT 'agent_run',
+  event_table_name text NOT NULL DEFAULT 'agent_event',
+  workspace_table_name text NOT NULL DEFAULT 'agent_run_workspace',
 
   -- Feature flags
   has_plans boolean NOT NULL DEFAULT false,
   has_resources boolean NOT NULL DEFAULT false,
   has_agents boolean NOT NULL DEFAULT false,
-  shared boolean NOT NULL DEFAULT false,
+  -- The coding-agent execution surface: runs and their append-only transcripts.
+  -- Off by default, so a conversation-only install provisions exactly what it did
+  -- before this flag existed.
+  has_runs boolean NOT NULL DEFAULT false,
+  -- Files carried by a message: an upload[] column on the message table, managed
+  -- by the storage module installed at this same scope. Off by default because
+  -- turning it on *requires* that storage module — an attachment with nowhere to
+  -- live fails provisioning rather than accepting a file it cannot store.
+  has_attachments boolean NOT NULL DEFAULT false,
+  -- The DDL default of the thread table's visibility column, and nothing more:
+  -- who may read a thread is decided per row by that column, never by how the
+  -- module was installed. 'private' (owner only) or 'entity' (scope members).
+  default_visibility text NOT NULL DEFAULT 'private'
+    CONSTRAINT default_visibility_chk CHECK (default_visibility IN ('private', 'entity')),
 
   -- API routing (configurable per-module)
   api_name text DEFAULT 'agent',
@@ -92,6 +111,9 @@ CREATE TABLE metaschema_modules_public.agent_module (
   CONSTRAINT agent_module_agent_table_fkey FOREIGN KEY (agent_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_persona_table_fkey FOREIGN KEY (persona_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_resource_table_fkey FOREIGN KEY (resource_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_run_table_fkey FOREIGN KEY (run_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_event_table_fkey FOREIGN KEY (event_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
+  CONSTRAINT agent_module_workspace_table_fkey FOREIGN KEY (workspace_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE,
   CONSTRAINT agent_module_entity_table_fkey FOREIGN KEY (entity_table_id) REFERENCES metaschema_public.table (id) ON DELETE CASCADE
 );
 
@@ -104,9 +126,28 @@ CREATE INDEX agent_module_persona_table_id_idx ON metaschema_modules_public.agen
 CREATE INDEX agent_module_plan_table_id_idx ON metaschema_modules_public.agent_module ( plan_table_id );
 CREATE INDEX agent_module_prompts_table_id_idx ON metaschema_modules_public.agent_module ( prompts_table_id );
 CREATE INDEX agent_module_resource_table_id_idx ON metaschema_modules_public.agent_module ( resource_table_id );
+CREATE INDEX agent_module_run_table_id_idx ON metaschema_modules_public.agent_module ( run_table_id );
+CREATE INDEX agent_module_event_table_id_idx ON metaschema_modules_public.agent_module ( event_table_id );
+CREATE INDEX agent_module_workspace_table_id_idx ON metaschema_modules_public.agent_module ( workspace_table_id );
 CREATE INDEX agent_module_task_table_id_idx ON metaschema_modules_public.agent_module ( task_table_id );
 CREATE INDEX agent_module_thread_table_id_idx ON metaschema_modules_public.agent_module ( thread_table_id );
 CREATE INDEX agent_module_private_schema_id_idx ON metaschema_modules_public.agent_module ( private_schema_id );
 CREATE INDEX agent_module_schema_id_idx ON metaschema_modules_public.agent_module ( schema_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.agent_module.agent_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.message_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.persona_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.plan_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.prompts_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.resource_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.task_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.thread_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.run_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.event_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.agent_module.workspace_table_id IS '@module_table';
+
 COMMIT;

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/api_surface_module/table.sql

@@ -102,4 +102,13 @@ CREATE INDEX api_surface_module_entity_table_id_idx ON metaschema_modules_public
 CREATE INDEX api_surface_module_schema_id_idx ON metaschema_modules_public.api_surface_module ( schema_id );
 CREATE INDEX api_surface_module_catalog_module_id_idx ON metaschema_modules_public.api_surface_module ( catalog_module_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.api_surface_module.api_schemas_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.api_surface_module.api_settings_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.api_surface_module.apis_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.api_surface_module.cors_settings_table_id IS '@module_table';
+
 COMMIT;

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/app_module/table.sql

@@ -95,4 +95,11 @@ CREATE INDEX app_module_private_schema_id_idx ON metaschema_modules_public.app_m
 CREATE INDEX app_module_schema_id_idx ON metaschema_modules_public.app_module ( schema_id );
 CREATE INDEX app_module_catalog_module_id_idx ON metaschema_modules_public.app_module ( catalog_module_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.app_module.app_components_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.app_module.apps_table_id IS '@module_table';
+
 COMMIT;

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/billing_module/table.sql

@@ -87,4 +87,16 @@ CREATE INDEX billing_module_plan_subscriptions_table_id_idx ON metaschema_module
 CREATE INDEX billing_module_private_schema_id_idx ON metaschema_modules_public.billing_module ( private_schema_id );
 CREATE INDEX billing_module_schema_id_idx ON metaschema_modules_public.billing_module ( schema_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.billing_module.balances_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.ledger_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.meter_credits_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.meter_defaults_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.meter_sources_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.meters_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_module.plan_subscriptions_table_id IS '@module_table';
+
 COMMIT;

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/billing_provider_module/table.sql

@@ -87,4 +87,16 @@ CREATE INDEX billing_provider_module_subscriptions_table_id_idx ON metaschema_mo
 CREATE INDEX billing_provider_module_private_schema_id_idx ON metaschema_modules_public.billing_provider_module ( private_schema_id );
 CREATE INDEX billing_provider_module_schema_id_idx ON metaschema_modules_public.billing_provider_module ( schema_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_customers_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_invoices_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_prices_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_products_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_refunds_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_subscriptions_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.billing_provider_module.billing_webhook_events_table_id IS '@module_table';
+
 COMMIT;

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/capabilities_module/table.sql

@@ -94,4 +94,11 @@ CREATE INDEX capabilities_module_table_id_idx ON metaschema_modules_public.capab
 CREATE INDEX capabilities_module_private_schema_id_idx ON metaschema_modules_public.capabilities_module ( private_schema_id );
 CREATE INDEX capabilities_module_schema_id_idx ON metaschema_modules_public.capabilities_module ( schema_id );
 
+-- Tables this module generates, as opposed to tables it is handed (an
+-- entity or users table it points at): the @module_table marker is what
+-- metaschema_modules_private.tg_module_install_provenance attributes to this
+-- install, keyed by the role name in the column.
+COMMENT ON COLUMN metaschema_modules_public.capabilities_module.default_table_id IS '@module_table';
+COMMENT ON COLUMN metaschema_modules_public.capabilities_module.table_id IS '@module_table';
+
 COMMIT;