Constructive Features
A feature-level index of what a Constructive app can do. Each row is a pointer — it names the feature, the module/toggle that gates it, and which skill owns the detail. No prose here that lives elsewhere — follow the links for specifics.
How to Read This
- Feature — what a user / developer gets.
- Gate — the module, Authz node type, or `app_settings_` toggle that controls it.
- Default in preset — presets from
@constructive-io/node-type-registry that include the gate out of the box (see `constructive-platform`). - Skill — where to go for the actual how-to.
When a feature is gated by a module, installing / omitting the module from a preset turns it on / off. When it's gated by a toggle, it's on all the time but can be flipped via a settings row.
Build an App End-to-End
Want to assemble these features into a working app rather than look one up? Use `constructive-builder` — the end-to-end builder that scaffolds, provisions the data model + RLS, wires Blocks + auth flows, and Chrome-verifies a working CRUD app in under 10 minutes (4 phases, 3 policy tiers). Come back to this catalog to decide which features (modules / presets / Authz\* nodes) the build should turn on.
1. Identity & Authentication
| Feature | Gate | In preset | Skill |
|---|
| Email + password sign-up/sign-in | user_auth_module + emails_module + app_settings_auth.allow_password_sign_up | auth:email, auth:email+magic, auth:sso, auth:passkey, auth:hardened, b2b, full | `constructive-platform` |
| Magic link sign-in | session_secrets_module + emails_module + app_settings_auth.allow_magic_link_sign_in | auth:email+magic, auth:hardened, b2b, full | `constructive-platform` |
| Email OTP | session_secrets_module + emails_module + toggle | auth:email+magic, auth:hardened, b2b, full | `constructive-platform` |
| Phone / SMS sign-in | phone_numbers_module + toggle | auth:hardened, b2b, full | `constructive-platform` |
| OAuth / SSO (federated identity) | identity_providers_module + connected_accounts_module | auth:sso, auth:hardened, b2b, full | `constructive-platform` |
| Passkeys (WebAuthn) | webauthn_credentials_module + webauthn_auth_module + session_secrets_module | auth:passkey, auth:hardened, b2b, full | `constructive-platform` |
| Rate limits / throttling | rate_limits_module (optional — see module-presets.md) | auth:hardened, b2b, full | `constructive-platform` |
| Device tracking (passive) | devices_module + app_settings_device.enable_device_tracking | full | `constructive-platform` |
| Trusted devices (MFA bypass) | devices_module + app_settings_device.enable_trusted_devices | full | `constructive-platform` |
| Device approval gate (email) | devices_module + app_settings_device.require_device_approval | full | `constructive-platform` |
| Force MFA on new devices | devices_module + app_settings_device.require_mfa_new_device | full | `constructive-platform` |
| User settings (extensible 1:1 preferences) | user_settings_module | b2b, full | `constructive-platform` |
| Sessions (server-side) | sessions_module | all presets except minimal-without-auth | `constructive-platform` |
| API keys | user_state_module | all presets | `constructive-platform` |
| Encrypted secrets (per-user) | config_secrets_user_module | auth:email+, b2b, full | `constructive-platform` |
| Encrypted secrets (org-scoped) | config_secrets_org_module | standalone (not in presets yet) | `constructive-platform` |
| Encrypted secrets (app-wide, admin-only) | app_secrets (part of config_secrets_user_module) | auth:email+, b2b, full | `constructive-platform` |
| Web3 wallet addresses | crypto_addresses_module | full | `constructive-platform` |
| Password reset / forgot password | emails_module + auth procs | auth:email+ | `constructive-platform` |
| Email verification | emails_module + auth procs | auth:email+ | `constructive-platform` |
| Local email testing (dev only) | — | — | `constructive-platform` |
2. Authorization (Safegres)
| Feature | Gate | In preset | Skill |
|---|
| Row-level security on every table | rls_module + secure_table_provision | all | `constructive-security` |
18 Authz* policy node types | Node Type Registry | — | `constructive-security` |
| Read-only API (API-level) | api.read_only = true | — (runtime toggle) | `constructive-platform` |
| Read-only members | AuthzNotReadOnly + membership field | — (policy-level) | `constructive-security` |
| Granular permissions | permissions_module | b2b, full | `constructive-access-control` |
| Named permissions (per-module) | permissions_module + module install | all (auto) | `constructive-access-control` |
| Permission defaults (module-level) | permission_default_permissions + module INSERT triggers | all (auto on module install) | `constructive-access-control` |
| Roles (admin/owner/member) | membership isAdmin / isOwner fields | all auth presets | `constructive-access-control` |
| Admin/owner grants (role promotion audit trail) | {prefix}AdminGrant / {prefix}OwnerGrant tables | all auth presets | `constructive-access-control` |
| Grants lifecycle (append-only audit) | {prefix}_grants table | b2b, full | `constructive-access-control` |
| Permission levels | levels_module | b2b, full | `constructive-security` |
| GuardStepUp (step-up auth before DML) | GuardStepUp node + sessions_module + compound conditions | AUTH_EMAIL | `constructive-security` |
| Permissive + restrictive policy composition | AuthzComposite | — | `constructive-security` |
| "Users are organizations" identity | membership_types_module | all auth presets | `constructive-security` |
3. Multi-tenancy & Membership
| Feature | Gate | In preset | Skill |
|---|
| App-scope memberships (single tenant) | ["memberships_module", {"scope": "app"}] | all auth presets | `constructive-entities` |
| Org-scope memberships (multi-tenant) | ["memberships_module", {"scope": "org"}] | b2b, full | `constructive-entities` |
| Dynamic entity types (channels, teams, depts) | entity_type_provision + provision_membership_table() | — (runtime) | `constructive-entities` |
| Invites (email, blank, multiple) | invites_module | b2b, full | `constructive-entities` |
| Profile assignment on email invites | invites_module + profiles_module | b2b, full | `constructive-entities` |
| Email auto-verification on invite claim | invites_module + emails_module | b2b, full | `constructive-entities` |
| Limits (metered quotas per scope) | ["limits_module", {"scope": "app"}] / ["limits_module", {"scope": "org"}] | b2b, full | `constructive-entities` |
| Cap tables (static config values) | limits_module → limit_caps_defaults + limit_caps | b2b, full | `constructive-platform` |
| Feature flags (cap-based gating) | LimitFeatureFlag node + `limit_caps_defaults(max=0\ | 1)` | — |
| Credits (append-only ledger) | limits_module → limit_credits + credit_codes | b2b, full | `constructive-platform` |
| Profiles per scope (permission bundles) | ["profiles_module", {"scope": "app"}] / ["profiles_module", {"scope": "org"}] | b2b, full | `constructive-access-control` |
| Hierarchy (org chart, manager/subordinate) | ["hierarchy_module", {"scope": "org"}] + AuthzOrgHierarchy | b2b, full | `constructive-access-control` |
4. Data Modeling
| Feature | Gate | In preset | Skill |
|---|
| Blueprints (declarative schema) | blueprint + blueprint_template | — (runtime) | `constructive-platform` |
| Blueprint templates / marketplace | copy_template_to_blueprint() | — | `constructive-platform` |
| Merkle definition_hash | backend trigger | — | `constructive-platform` |
| Tables + fields | secure_table_provision | — | `constructive-security` |
| Relations (1:N, M:N junctions) | relation_provision | — | `constructive-platform` |
| Node type generators (12 categories: Data, Search, Authz, Guard, Check, Limit, Billing, Job, Process, Relation, View, Event) | Node Type Registry | — | `constructive-platform` |
| DataDirectOwner / DataEntityMembership / DataOwnershipInEntity | Node Type Registry | — | `constructive-platform` |
| DataPeoplestamps (created_by / updated_by) | Node Type Registry | — | `constructive-platform` |
| DataPublishable (is_published + published_at) | Node Type Registry | — | `constructive-platform` |
| DataCompositeField (derived text concatenation) | Node Type Registry | — | `constructive-platform` |
| Behavior triggers (DataSlug, DataInflection, DataForceCurrentUser) | Node Type Registry | — | `constructive-platform` |
| LimitCounter (metered usage tracking) | Node Type Registry + limits_module | — | `constructive-platform` |
| LimitFeatureFlag (cap-based feature gating) | Node Type Registry + limits_module | — | `constructive-platform` |
| Field protection (DataOwnedFields, DataImmutableFields) | Node Type Registry | — | `constructive-platform` |
| DataInheritFromParent (copy values from FK parent) | Node Type Registry | — | `constructive-platform` |
| DataI18n (translation tables + multilingual search) | DataI18n node + i18n_module | — | `constructive-i18n` |
| Smart tags (GraphQL schema hints) | field-level | — | `constructive-codegen` |
5. Events & Achievements
| Feature | Gate | In preset | Skill |
|---|
| EventTracker (record events on row changes) | EventTracker node + events_module | — | `constructive-events` |
| Blueprint achievements (levels + requirements) | achievements[] section + has_levels | — | `constructive-events` |
| Achievement reward credit grants | tg_achievement_reward + limits_module | — | `constructive-events` |
| Invite-based achievements (simple tier) | has_invite_achievements + has_invites + has_levels | — | `constructive-events` |
| Invitee achievement virality chain (meta tier) | tg_invitee_achievement + invites_module | — | `constructive-events` |
| EventReferral (attribute events to inviters) | EventReferral node + invites_module | — | `constructive-events` |
| Multi-level referral chains (MLM) | EventReferral node + max_depth (2–10) | — | `constructive-events` |
| Compound conditions (shared with JobTrigger) | build_condition_ast() + conditions param | — | `constructive-events` + `constructive-jobs` |
| Partitioned event log (time-based retention) | events_module + pg_partman | — | `constructive-events` |
| Event aggregates (running counts per user) | events_module | — | `constructive-events` |
6. Storage & Uploads
| Feature | Gate | In preset | Skill |
|---|
| S3 / MinIO buckets per entity type | storage_module + storage on entity_type_provision | full, any app using uploads | `constructive-uploads` + `constructive-entities` |
| Org-scoped storage (per-org/user buckets) | Top-level storage: [{ scope: "org", ... }] | — | `constructive-platform` |
| Public vs private buckets | is_public on bucket entries | — | `constructive-uploads` |
| Presigned upload URLs | requestUploadUrl mutation | — | `constructive-uploads` |
| Per-bucket RLS policies | storage_config.policies[] (Authz* nodes) | — | `constructive-uploads` + `constructive-security` |
| Multi-scope bucket resolution | bucketKey + ownerId | — | `constructive-uploads` |
| Entity-scoped storage (buckets per entity) | has_storage + storage_config | — | `constructive-entities` |
| Bucket provisioning | provisionBucket mutation + auto-provision | — | `constructive-uploads` |
| Content-hash deduplication | requestUploadUrl (deduplicated field) | — | `constructive-uploads` |
| Download URLs (presigned GET / CDN) | downloadUrl computed field | — | `constructive-uploads` |
| MIME type restrictions + file size limits | allowed_mime_types + max_file_size on bucket | — | `constructive-uploads` |
7. Search
| Feature | Gate | In preset | Skill |
|---|
| SearchUnified (orchestrated multi-algorithm) | SearchUnified blueprint node | — | `constructive-agents` + `constructive-search` |
| SearchFullText (tsvector + GIN) | SearchFullText blueprint node | — | `constructive-platform` |
| SearchBm25 (pg_textsearch) | SearchBm25 blueprint node | — | `constructive-platform` |
| SearchTrgm (trigram fuzzy) | SearchTrgm blueprint node | — | `constructive-platform` |
| SearchVector (pgvector embeddings) | SearchVector blueprint node | — | `constructive-agents` |
| SearchSpatial (PostGIS geometry) | SearchSpatial blueprint node | — | `constructive-platform` |
| SearchSpatialAggregate (materialized aggregates) | SearchSpatialAggregate blueprint node | — | `constructive-platform` |
| Unified composite search (GraphQL) | unifiedSearch field | — | `constructive-search` |
8. AI
| Feature | Gate | In preset | Skill |
|---|
| SearchVector (pgvector columns + HNSW/IVFFlat) | SearchVector blueprint node | — | `constructive-agents` |
| Embedding stale tracking + job enqueue | SearchVector include_updated_at + enqueue_job | — | `constructive-agents` |
| Chunk tables (long text splitting) | SearchVector chunks_config | — | `constructive-agents` |
| Embedding worker pipeline | Graphile Worker + generate_embedding task | — | `constructive-agents` |
| agentic-kit LLM client (multi-provider) | @agentic-kit/ollama, @agentic-kit/anthropic, @agentic-kit/openai | — | `constructive-agents` |
| RAG pipelines (blueprint → embed → retrieve → generate) | app code + ORM | — | `constructive-agents` |
| Agent threads + messages | agent_module | full | `constructive-entities` |
| Agent multiplayer mode (shared threads) | ["agent_module", {"shared": true}] | — | `constructive-agents` |
| Multi-agent attribution (agent_id on messages) | ["agent_module", {"has_agents": true}] | full | `constructive-agents` |
| Agent plans + approval workflow | ["agent_module", {"has_plans": true}] | — | `constructive-entities` |
| Agent resources (unified skills + knowledge) | ["agent_module", {"has_resources": true}] | full | `constructive-entities` |
| Agent registry + personas | ["agent_module", {"has_agents": true}] | full | `constructive-entities` |
| Agent prompt templates | agent_module | full | `constructive-entities` |
9. GraphQL & Codegen
| Feature | Gate | In preset | Skill |
|---|
| PostGraphile v5 server | cnc server | — | `constructive-platform` |
| GraphiQL explorer | cnc explorer | — | `constructive-platform` |
| React Query hooks codegen | --react-query | — | `constructive-codegen` |
| Prisma-like ORM codegen | --orm | — | `constructive-codegen` |
CLI codegen (csdk / constructive) | --cli | — | `constructive-codegen` |
| Multi-target codegen | config | — | `constructive-codegen` |
| Relay-spec pagination | Node Type Registry + PostGraphile | — | `constructive-codegen` |
_meta introspection endpoint | built-in | — | `constructive-frontend` |
Dynamic _meta forms (zero-config CRUD) | @constructive-io/ui | — | `constructive-frontend` |
| CRUD Stack cards (iOS-style panels) | @constructive-io/ui | — | `constructive-frontend` |
| 50+ UI components | @constructive-io/ui | — | `constructive-frontend` |
10. Services & Routing
| Feature | Gate | In preset | Skill |
|---|
| Multiple APIs per database | api + api_schema entities | — | `constructive-platform` |
| Domain / subdomain routing | domain + site entities | — | `constructive-platform` |
| Public vs admin API routing | api.routing_mode | — | `constructive-platform` |
| Schema grants per API | schema_grant | — | `constructive-platform` |
11. Realtime Subscriptions
| Feature | Gate | In preset | Skill |
|---|
| Per-table subscriber tables | DataRealtime node + realtime_module | — | `constructive-platform` |
| RLS-derived subscription security | secure_table_provision.policies SELECT policies | — | `constructive-platform` |
| Change log (partitioned event stream) | realtime_module | — | `constructive-platform` |
| Statement-level emit triggers | DataRealtime → emit_change() | — | `constructive-platform` |
GraphQL subscription fields (onXxxChanged) | @realtime smart tag + enable_realtime | — | `constructive-platform` |
Sparse-set row filtering (ids: [UUID!]) | onXxxChanged(ids: [...]) argument | — | `constructive-platform` |
| Overflow detection (INVALIDATE) | >50 rows/statement or >50 events/sec/table | — | `constructive-platform` |
Codegen subscription hooks (useXxxSubscription) | cnc codegen + DataRealtime | — | `constructive-platform` |
Connection state hook (useConnectionState) | cnc codegen + realtime config | — | `constructive-platform` |
ORM realtime (client.subscribe()) | realtime config on createClient | — | `constructive-platform` |
Runtime toggle (enable_realtime) | database_settings / api_settings | — | `constructive-platform` |
| Policy-driven field generation | column-ref in parameter_schema | — | `constructive-platform` |
| Partition table support | Declarative partitioned flag + automatic lifecycle | — | `constructive-platform` |
12. Background Work & Operations
| Feature | Gate | In preset | Skill |
|---|
| Background jobs (Knative) | jobs package | — | `constructive-jobs` |
| Job triggers (JobTrigger) | JobTrigger node | — | `constructive-jobs` |
| Cloud functions (Knative HTTP) | functions/* | — | `constructive-platform` |
| Deterministic DB migrations | pgpm deploy / verify / revert | — | `pgpm` |
| Module provisioning | metaschema_generators.provision_database_modules | — | `constructive-platform` |
| DB introspection → SDK | cnc codegen | — | `constructive-codegen` |
| Notifications (email/push/webhook) | notifications_module | b2b, full | `constructive-notifications` |
| Internationalization (multilingual search + translations) | i18n_module + DataI18n + lang_column | full | `constructive-i18n` |
14. Module Presets (starting points, not features)
| Preset | Shape |
|---|
minimal | users + sessions + rls + secrets — no server-side auth |
auth:email | email/password, single tenant |
auth:email+magic | auth:email + magic link / email OTP |
auth:sso | auth:email + OAuth + connected accounts |
auth:passkey | auth:email + WebAuthn |
auth:hardened | rate limits + SSO + passkeys + SMS + magic links |
b2b | auth:hardened + orgs + invites + permissions + levels + profiles + hierarchy + user_settings |
b2b:storage | b2b + file upload infrastructure (buckets, files, RLS) + user_settings |
full | everything — includes i18n_module, user_settings_module, storage, billing, notifications |
See `constructive/references/module-presets.md` for the full catalog, shapes, and ORM usage.
User Settings Extension Pattern
user_settings_module creates a skeleton 1:1 table (per-user, AuthzDirectOwner RLS) in users_public. Other modules extend it by adding columns via metaschema.create_field():
| Module | Columns added to user_settings |
|---|
notifications_module | notifs_enabled, notifs_default_digest_frequency, notifs_quiet_hours_start, notifs_quiet_hours_end, notifs_quiet_hours_timezone, notifs_default_channels |
i18n_module | preferred_language |
Flow-Based Programming
Graph module + merkle store for SDK-authorable computation graphs. See `constructive-flow-graphs` for types, spec, evaluator, and graph editor.
TddFollow test-driven development with a strict red-green-refactor loop when creating reliable features or fixing bugs.544k196k
Test Driven DevelopmentEnforce writing failing tests before any production implementation code.181k264k
Webapp TestingVerify frontend behavior, debug UI issues, capture screenshots, and inspect logs of a running local web application using Playwright.123k165k
Playwright CliRun browser automation, generate element snapshots, inspect DOM attributes, and execute Playwright tests from the terminal.102k12.3k