feat: sync modules from constructive-db (services removed, catalog/routing module tables added)

[pyramation]

Summary

Upstreams constructive-db/pgpm-modules/* into packages/* with constructive-db as source of truth. Only source content (deploy/, verify/, revert/, pgpm.plan, __tests__/) was synced — versions, Makefile/.control default_version, and generated sql/ bundles were intentionally left untouched (see follow-up).

services removed. The services → scoped-routing cutover deleted the module in constructive-db, so packages/services/ is gone, along with the orphaned services_public / services_private verify/+revert/ trees still sitting in metaschema-schema and metaschema-modules. Knock-on edits:

-requires = 'plpgsql,uuid-ossp,metaschema-schema,services,pgpm-verify'   # metaschema-modules.control
+requires = 'plpgsql,uuid-ossp,metaschema-schema,pgpm-verify'
-schemas/metaschema_modules_public/tables/rls_module/table [... services_public/tables/apis/table] # pgpm.plan dep dropped

plus the services entry in the CI matrix, README.md/MODULES.md, and its lockfile importer.

metaschema-modules gains the typed catalog/routing config tables (deploy+verify+revert+plan): catalog_module, domain_module, api_surface_module, site_surface_module, route_module, app_module, database_settings_module; ~30 existing *_module/table.sql files picked up their constructive-db edits. Snapshots regenerated (58 → 65 module tables).

metaschema-schema gains exclusion_constraint (EXCLUDE constraints) and syncs check_constraint, field, foreign_key_constraint, primary_key_constraint, unique_constraint, view.

app-scope frames() now resolves the platform database lazily instead of via app_scope.platform_database_id() inside the walk: with no metaschema_public.database WHERE platform row (generation bootstrap / isolated metaschemas) the chain simply ends after the local frames, and only execution_scope = 'platform' raises PLATFORM_DATABASE_NOT_REGISTERED. platform_database_id() itself is unchanged and still the canonical resolver.

Also synced: object-store.freeze_objects recursion (unnests kids and joins on the (id, scope_id) PK, and the final UPDATE now matches on scope_id too), and the database-jobs test now passes db_id := explicitly rather than setting jwt.claims.database_id.

Two constructive-db test artifacts were not taken, because they are stale there and contradict the SQL both repos share: the encrypted-secrets-table snapshot (uuid_generate_v4() vs. the uuidv7() the table actually defaults to) and the deleted inflection.dns_1123 cases (the function still exists in deploy/).

Validation

Against constructiveio/postgres-plus:18:

• pnpm -r bundle — all 27 packages bundled
• pgpm test-packages --full-cycle — 27/27 modules deploy → verify → revert clean
• jest for every package in the CI matrix plus object-tree/object-store/inflection-db — all green

Follow-up (needs approval)

Nothing was published to npm, and no versions were bumped. Publishing (lerna version + lerna publish from-package, which also regenerates the sql/*--<version>.sql bundles and default_version in the .control/Makefile files) is a separate step requiring explicit approval.

Link to Devin session: https://app.devin.ai/sessions/8f10f72151e94c479e36f63ca4915f8e
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring