
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@pgpmjs/naming-spec
Advanced tools
PGPM naming spec — canonical, derived change paths rendered from object identity; paths are projections, never authored and never identity
The PGPM naming spec — canonical, derived change paths.
A change path is never authored and never identity: it is a pure projection of an object's identity through this spec. Objects (content-addressed ASTs + dependency edges) are the source of truth; paths are re-derivable at any time, so regrouping, renaming schemes, or repartitioning packages can never break identity-keyed consumers (diff, dependency resolution).
import { pathFor } from '@pgpmjs/naming-spec';
import { classifyStatements, identityOf } from '@pgsql/transform';
const facts = classifyStatements('CREATE TABLE app.users (id int);')[0];
pathFor(identityOf(facts)!); // 'schemas/app/tables/users/table'
Canonical templates (naming spec v1, the conventions used across constructive-db):
| kind | path |
|---|---|
| schema | schemas/{schema}/schema |
| table | schemas/{schema}/tables/{table}/table |
| trigger / policy / index / constraint / seed | schemas/{schema}/tables/{table}/{triggers|policies|indexes|constraints|fixtures}/{name} |
| function / view / type / sequence | schemas/{schema}/{procedures|views|types|sequences}/{name} |
| extension | extensions/{name} |
| role | roles/{name} |
Pure leaf with zero dependencies. Identity derivation (identityOf) lives upstream
in @pgsql/transform; this package only renders identities to paths.
🚀 Quickstart: Getting Up and Running Get started with modular databases in minutes. Install prerequisites and deploy your first module.
📦 Modular PostgreSQL Development with Database Packages Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.
✏️ Authoring Database Changes Master the workflow for adding, organizing, and managing database changes with pgpm.
🧪 End-to-End PostgreSQL Testing with TypeScript Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.
⚡ Supabase Testing Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.
💧 Drizzle ORM Testing Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.
🔧 Troubleshooting Common issues and solutions for pgpm, PostgreSQL, and testing.
SET LOCAL) into queries—ideal for setting role, jwt.claims, and other session settings.libpg_query, converting SQL into parse trees.Install skills for AI coding agents:
# All platform skills (security, blueprints, codegen, billing, etc.)
npx skills add constructive-io/constructive-skills
# Individual repo skills (pgpm, testing, CLI, search, etc.)
npx skills add https://github.com/constructive-io/constructive --skill pgpm
npx skills add https://github.com/constructive-io/constructive --skill constructive-testing
🛠 Built by the Constructive team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on GitHub.
AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.
No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.
FAQs
PGPM naming spec — canonical, derived change paths rendered from object identity; paths are projections, never authored and never identity
We found that @pgpmjs/naming-spec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.