feat: upgrade to Constructive 5.x stack + RLS-stripped single-user export

[pyramation]

Summary

Upgrades agentic-db from the 4.x Constructive stack to the current 5.x stack and switches the exported pgpm packages to the RLS-stripped, single-user form.

Toolchain bumps (root + all packages)

• @constructive-io/graphql-codegen 4.30.2 → 5.4.1, graphql-query 4.2.2, graphql-types 3.19.0, graphile-test 5.2.2, pgsql-test 5.1.4
• @pgpmjs/core 7.5.1 / @pgpmjs/export 1.5.2; vendored extensions/@pgpm/* modules 0.20.x/0.21.x → 0.33.x (now pinned in pgpm.json dependencies)
• pnpm overrides moved off the 1.0.0-rc.* graphile/grafast line to GA versions (grafast 1.0.2, graphile-build 5.0.2, postgraphile 5.0.3, …) — the mixed rc/GA tree was instantiating multiple grafast copies and broke schema builds in tests

RLS-stripped export (single-user personal DB)

• packages/export/src/run-export.ts now passes excludeCategories to exportMigrations, defaulting to security,permissions (override with EXCLUDE_CATEGORIES; set it empty to keep everything):

const excludeCategories = (process.env.EXCLUDE_CATEGORIES ?? 'security,permissions')
  .split(',').map((c) => c.trim()).filter(Boolean);

• Regenerated packages/agentic-db / packages/agentic-db-services accordingly: no grants, no policies, no RLS (verified on a fresh deploy: 95 tables, 34 BM25 indexes, 0 policies, 0 RLS-enabled tables). Integration tests that issue raw SQL now use the root client (connections.pg) since app-role grants no longer exist in the exported package.

Provisioning updates for the new platform APIs (packages/provision)

• Blueprint creation moved to the modules API (modules.localhost) via @constructive-io/sdk (api/modules clients); old public_ namespace from @constructive-io/node no longer carries these ops
• Blueprint field types/defaults normalized to the new structured JSONB format ({ name, args, array_dimensions } / { value } / { function }) — raw strings like 'citext[]' are now rejected with BAD_FIELD_INPUT

SDK/CLI regeneration (codegen 5.4.1)

• sdk/schemas/agentic-db.graphql re-exported; sdk/sdk + sdk/cli regenerated (model naming changed, e.g. contactChunk → contactsChunk, FK inputs contactId → contactsId; tests updated)
• Generated ORM now imports @constructive-io/graphql-query/runtime → added as a dependency; removed the deleted nodeHttpAdapter codegen option; @agentic-kit/ollama ^2.4.2 in sdk/cli (generated embedder expects the v2 { embedding } result shape)
• Schema export script supports X-Api-Name header routing (API_NAME env), required to pick up per-database settings on the new scoped-routing server

Tests: orm 36/36, embeddings 5/5, embedding-pipeline 8/8, rag 10/10, documents-loader 74/74, cli-e2e 16/16 all pass locally against the exported (stripped) packages.

Note: LlmTextMutationPlugin is disabled in the graphile-test presets — the current constructive graphile-llm plugin unconditionally adds an embeddingText companion field that collides with agentic-db's physical embedding_text columns (platform bug, reported separately).

pnpm run lint fails identically on main (eslint 9 flat-config migration not done; packages have no eslint.config.js) — pre-existing, not addressed here.

Link to Devin session: https://app.devin.ai/sessions/bd82f3b68a6348b6b3527a6a9c399f15
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgpm/​metaschema-schema@​0.33.1
	@​pgpm/​app-scope@​0.33.1
	@​pgpm/​metaschema-modules@​0.33.1
	@​pgpm/​database-jobs@​0.33.1
	@​pgpm/​jwt-claims@​0.33.0
	@​pgpm/​stamps@​0.33.0
	@​pgpm/​totp@​0.33.0
	@​pgpm/​base32@​0.33.0
	@​pgpm/​inflection@​0.33.0
	@​pgpm/​types@​0.33.0
	@​pgpm/​utils@​0.33.0
	@​pgpm/​uuid@​0.33.0
	@​pgpm/​services@​0.33.0
	constructive-test@​0.4.7
	@​constructive-io/​node@​0.10.12
	node-type-registry@​1.1.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @launchql/protobufjs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@launchql/protobufjs@7.2.6 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@launchql/protobufjs@7.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @protobufjs/float is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/@protobufjs/float@1.0.2 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@protobufjs/float@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report