@noormdev/sdk 1.0.0-alpha.16 → 1.0.0-alpha.17

package/dist/index.js

@@ -1,5 +1,5 @@
 import { processFile, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES, GZIP_THRESHOLD, GZIP_RATIO_THRESHOLD } from './chunk-BTXUEWYQ.js';
-import { NOORM_TABLES, initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, encryptVaultKey } from './chunk-ZRZ7AECF.js';
+import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-LJDHQEWW.js';
 import { observer } from './chunk-4HW4CS2C.js';
 import { constants, existsSync, readFileSync, mkdirSync, writeFileSync, createWriteStream } from 'fs';
 import path, { join, dirname } from 'path';
@@ -1889,7 +1889,7 @@ async function createConnection(config, configName = "__default__") {
     destroy: wrappedDestroy
   };
   observer.emit("connection:open", { configName, dialect: config.dialect });
-  await waitForIdentityToLoad(trackedConn.db);
+  await waitForIdentityToLoad(trackedConn.db, config.dialect);
   return trackedConn;
 }
 var SYSTEM_DATABASES = {
@@ -1920,7 +1920,7 @@ async function testConnection(config, options = {}) {
 // src/core/version/types.ts
 var CURRENT_VERSIONS = Object.freeze({
   /** Database tracking tables schema version */
-  schema: 1,
+  schema: 2,
   /** State file (state.enc) schema version */
   state: 1,
   /** Settings file (settings.yml) schema version */
@@ -2022,6 +2022,171 @@ var v1 = {
     await db.schema.dropTable("__noorm_version__").execute();
   }
 };
+var TABLE_MAP = [
+  { old: "__noorm_version__", new: "version" },
+  { old: "__noorm_change__", new: "change" },
+  { old: "__noorm_executions__", new: "executions" },
+  { old: "__noorm_lock__", new: "lock" },
+  { old: "__noorm_identities__", new: "identities" },
+  { old: "__noorm_vault__", new: "vault" }
+];
+var INDEXES = [
+  { name: "idx_executions_change_id", table: "executions", columns: ["change_id"] },
+  { name: "idx_change_name_config", table: "change", columns: ["name", "config_name"] },
+  { name: "idx_vault_secret_key", table: "vault", columns: ["secret_key"] }
+];
+var v2 = {
+  version: 2,
+  description: "Move tracking tables to noorm schema",
+  async up(db, dialect) {
+    if (dialect === "sqlite" || dialect === "mysql") return;
+    await db.transaction().execute(async (trx) => {
+      if (dialect === "postgres") {
+        await sql`CREATE SCHEMA IF NOT EXISTS noorm`.execute(trx);
+      } else {
+        await sql`IF NOT EXISTS (SELECT 1 FROM sys.schemas WHERE name = 'noorm') EXEC('CREATE SCHEMA noorm')`.execute(trx);
+      }
+      if (dialect === "postgres") {
+        const { rows } = await sql`
+                    SELECT constraint_name
+                    FROM information_schema.table_constraints
+                    WHERE table_name = '__noorm_executions__'
+                    AND constraint_type = 'FOREIGN KEY'
+                `.execute(trx);
+        for (const row of rows) {
+          await sql`ALTER TABLE __noorm_executions__ DROP CONSTRAINT ${sql.ref(row.constraint_name)}`.execute(trx);
+        }
+      } else {
+        const { rows } = await sql`
+                    SELECT fk.name AS fk_name
+                    FROM sys.foreign_keys fk
+                    JOIN sys.tables t ON fk.parent_object_id = t.object_id
+                    WHERE t.name = '__noorm_executions__'
+                `.execute(trx);
+        for (const row of rows) {
+          await sql`ALTER TABLE __noorm_executions__ DROP CONSTRAINT ${sql.ref(row.fk_name)}`.execute(trx);
+        }
+      }
+      if (dialect === "postgres") {
+        for (const idx of INDEXES) {
+          await sql`DROP INDEX IF EXISTS ${sql.ref(idx.name)}`.execute(trx);
+        }
+      } else {
+        const prefixedTables = {
+          executions: "__noorm_executions__",
+          change: "__noorm_change__",
+          vault: "__noorm_vault__"
+        };
+        for (const idx of INDEXES) {
+          const tableName = prefixedTables[idx.table];
+          await sql`
+                        IF EXISTS (SELECT 1 FROM sys.indexes WHERE name = ${idx.name})
+                        DROP INDEX ${sql.ref(idx.name)} ON ${sql.table(tableName)}
+                    `.execute(trx);
+        }
+      }
+      for (const t of TABLE_MAP) {
+        if (dialect === "postgres") {
+          await sql`ALTER TABLE ${sql.table(t.old)} SET SCHEMA noorm`.execute(trx);
+        } else {
+          await sql`ALTER SCHEMA noorm TRANSFER ${sql.ref(`dbo.${t.old}`)}`.execute(trx);
+        }
+      }
+      for (const t of TABLE_MAP) {
+        if (dialect === "postgres") {
+          await sql`ALTER TABLE ${sql.table(`noorm.${t.old}`)} RENAME TO ${sql.ref(t.new)}`.execute(trx);
+        } else {
+          await sql`EXEC sp_rename ${sql.raw(`'noorm.${t.old}'`)}, ${sql.raw(`'${t.new}'`)}`.execute(trx);
+        }
+      }
+      await sql`
+                ALTER TABLE ${sql.table("noorm.executions")}
+                ADD CONSTRAINT fk_executions_change_id
+                FOREIGN KEY (change_id) REFERENCES ${sql.table("noorm.change")}(id)
+                ON DELETE CASCADE
+            `.execute(trx);
+      for (const idx of INDEXES) {
+        const cols = idx.columns.join(", ");
+        await sql`CREATE INDEX ${sql.ref(idx.name)} ON ${sql.table(`noorm.${idx.table}`)} (${sql.raw(cols)})`.execute(trx);
+      }
+    });
+  },
+  async down(db, dialect) {
+    if (dialect === "sqlite" || dialect === "mysql") return;
+    await db.transaction().execute(async (trx) => {
+      if (dialect === "postgres") {
+        const { rows } = await sql`
+                    SELECT constraint_name
+                    FROM information_schema.table_constraints
+                    WHERE table_schema = 'noorm'
+                    AND table_name = 'executions'
+                    AND constraint_type = 'FOREIGN KEY'
+                `.execute(trx);
+        for (const row of rows) {
+          await sql`ALTER TABLE ${sql.table("noorm.executions")} DROP CONSTRAINT ${sql.ref(row.constraint_name)}`.execute(trx);
+        }
+      } else {
+        const { rows } = await sql`
+                    SELECT fk.name AS fk_name
+                    FROM sys.foreign_keys fk
+                    JOIN sys.tables t ON fk.parent_object_id = t.object_id
+                    JOIN sys.schemas s ON t.schema_id = s.schema_id
+                    WHERE t.name = 'executions' AND s.name = 'noorm'
+                `.execute(trx);
+        for (const row of rows) {
+          await sql`ALTER TABLE ${sql.table("noorm.executions")} DROP CONSTRAINT ${sql.ref(row.fk_name)}`.execute(trx);
+        }
+      }
+      if (dialect === "postgres") {
+        for (const idx of INDEXES) {
+          await sql`DROP INDEX IF EXISTS ${sql.ref(`noorm.${idx.name}`)}`.execute(trx);
+        }
+      } else {
+        for (const idx of INDEXES) {
+          await sql`
+                        IF EXISTS (SELECT 1 FROM sys.indexes WHERE name = ${idx.name})
+                        DROP INDEX ${sql.ref(idx.name)} ON ${sql.table(`noorm.${idx.table}`)}
+                    `.execute(trx);
+        }
+      }
+      for (const t of TABLE_MAP) {
+        if (dialect === "postgres") {
+          await sql`ALTER TABLE ${sql.table(`noorm.${t.new}`)} RENAME TO ${sql.ref(t.old)}`.execute(trx);
+        } else {
+          await sql`EXEC sp_rename ${sql.raw(`'noorm.${t.new}'`)}, ${sql.raw(`'${t.old}'`)}`.execute(trx);
+        }
+      }
+      for (const t of TABLE_MAP) {
+        if (dialect === "postgres") {
+          await sql`ALTER TABLE ${sql.table(`noorm.${t.old}`)} SET SCHEMA public`.execute(trx);
+        } else {
+          await sql`ALTER SCHEMA dbo TRANSFER ${sql.ref(`noorm.${t.old}`)}`.execute(trx);
+        }
+      }
+      await sql`
+                ALTER TABLE __noorm_executions__
+                ADD CONSTRAINT fk_executions_change_id
+                FOREIGN KEY (change_id) REFERENCES __noorm_change__(id)
+                ON DELETE CASCADE
+            `.execute(trx);
+      for (const idx of INDEXES) {
+        const prefixedTables = {
+          executions: "__noorm_executions__",
+          change: "__noorm_change__",
+          vault: "__noorm_vault__"
+        };
+        const tableName = prefixedTables[idx.table];
+        const cols = idx.columns.join(", ");
+        await sql`CREATE INDEX ${sql.ref(idx.name)} ON ${sql.table(tableName)} (${sql.raw(cols)})`.execute(trx);
+      }
+      if (dialect === "postgres") {
+        await sql`DROP SCHEMA IF EXISTS noorm`.execute(trx);
+      } else {
+        await sql`IF EXISTS (SELECT 1 FROM sys.schemas WHERE name = 'noorm') DROP SCHEMA noorm`.execute(trx);
+      }
+    });
+  }
+};
 
 // src/core/update/checker.ts
 function getCurrentVersion() {
@@ -2029,26 +2194,43 @@ function getCurrentVersion() {
 }
 
 // src/core/version/schema/index.ts
-var MIGRATIONS = [v1];
-async function tablesExist(db) {
-  const [result, err] = await attempt(async () => {
-    await sql`SELECT 1 FROM __noorm_version__ LIMIT 1`.execute(db);
+var MIGRATIONS = [v1, v2];
+async function tablesExist(db, dialect) {
+  const [legacyResult] = await attempt(async () => {
+    await db.selectFrom("__noorm_version__").select("id").limit(1).executeTakeFirst();
     return true;
   });
-  if (err) return false;
-  return result;
+  if (legacyResult) return true;
+  if (dialect === "postgres" || dialect === "mssql") {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const [schemaResult] = await attempt(async () => {
+      await ndb.selectFrom(tables.version).select("id").limit(1).executeTakeFirst();
+      return true;
+    });
+    if (schemaResult) return true;
+  }
+  return false;
 }
-async function getSchemaVersion(db) {
-  const exists = await tablesExist(db);
+async function getSchemaVersion(db, dialect) {
+  const exists = await tablesExist(db, dialect);
   if (!exists) return 0;
-  const [result, err] = await attempt(async () => {
+  const [legacyResult] = await attempt(async () => {
     return db.selectFrom("__noorm_version__").select("noorm_version").orderBy("id", "desc").limit(1).executeTakeFirst();
   });
-  if (err) return 0;
-  return result?.noorm_version ?? 0;
+  if (legacyResult) return legacyResult.noorm_version ?? 0;
+  if (dialect === "postgres" || dialect === "mssql") {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const [schemaResult] = await attempt(async () => {
+      return ndb.selectFrom(tables.version).select("noorm_version").orderBy("id", "desc").limit(1).executeTakeFirst();
+    });
+    if (schemaResult) return schemaResult.noorm_version ?? 0;
+  }
+  return 0;
 }
-async function checkSchemaVersion(db) {
-  const current = await getSchemaVersion(db);
+async function checkSchemaVersion(db, dialect) {
+  const current = await getSchemaVersion(db, dialect);
   const expected = CURRENT_VERSIONS.schema;
   observer.emit("version:schema:checking", { current });
   return {
@@ -2070,7 +2252,9 @@ async function bootstrapSchema(db, dialect, options) {
       throw new MigrationError("schema", migration.version, err);
     }
   }
-  await db.insertInto("__noorm_version__").values({
+  const ndb = noormDb(db, dialect);
+  const tables = getNoormTables(dialect);
+  await ndb.insertInto(tables.version).values({
     cli_version: getCurrentVersion(),
     noorm_version: CURRENT_VERSIONS.schema,
     state_version: CURRENT_VERSIONS.state,
@@ -2082,22 +2266,37 @@ async function bootstrapSchema(db, dialect, options) {
     to: CURRENT_VERSIONS.schema,
     durationMs
   });
-  await waitForIdentityToLoad(db);
+  await waitForIdentityToLoad(db, dialect);
 }
-async function getLatestVersionRecord(db) {
-  const exists = await tablesExist(db);
+async function getLatestVersionRecord(db, dialect) {
+  const exists = await tablesExist(db, dialect);
   if (!exists) return null;
-  const [result, err] = await attempt(async () => {
+  const [legacyResult] = await attempt(async () => {
     return db.selectFrom("__noorm_version__").select(["state_version", "settings_version"]).orderBy("id", "desc").limit(1).executeTakeFirst();
   });
-  if (err || !result) return null;
-  return {
-    stateVersion: result.state_version,
-    settingsVersion: result.settings_version
-  };
+  if (legacyResult) {
+    return {
+      stateVersion: legacyResult.state_version,
+      settingsVersion: legacyResult.settings_version
+    };
+  }
+  if (dialect === "postgres" || dialect === "mssql") {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const [schemaResult] = await attempt(async () => {
+      return ndb.selectFrom(tables.version).select(["state_version", "settings_version"]).orderBy("id", "desc").limit(1).executeTakeFirst();
+    });
+    if (schemaResult) {
+      return {
+        stateVersion: schemaResult.state_version,
+        settingsVersion: schemaResult.settings_version
+      };
+    }
+  }
+  return null;
 }
 async function migrateSchema(db, dialect, options) {
-  const status = await checkSchemaVersion(db);
+  const status = await checkSchemaVersion(db, dialect);
   if (status.isNewer) {
     observer.emit("version:mismatch", {
       layer: "schema",
@@ -2116,7 +2315,7 @@ async function migrateSchema(db, dialect, options) {
     from: status.current,
     to: CURRENT_VERSIONS.schema
   });
-  const existing = await getLatestVersionRecord(db);
+  const existing = await getLatestVersionRecord(db, dialect);
   const pendingMigrations = MIGRATIONS.filter((m) => m.version > status.current);
   for (const migration of pendingMigrations) {
     const [, err] = await attempt(() => migration.up(db, dialect));
@@ -2124,7 +2323,9 @@ async function migrateSchema(db, dialect, options) {
       throw new MigrationError("schema", migration.version, err);
     }
   }
-  await db.insertInto("__noorm_version__").values({
+  const ndb = noormDb(db, dialect);
+  const tables = getNoormTables(dialect);
+  await ndb.insertInto(tables.version).values({
     cli_version: getCurrentVersion(),
     noorm_version: CURRENT_VERSIONS.schema,
     state_version: existing?.stateVersion ?? CURRENT_VERSIONS.state,
@@ -2136,7 +2337,7 @@ async function migrateSchema(db, dialect, options) {
     to: CURRENT_VERSIONS.schema,
     durationMs
   });
-  await waitForIdentityToLoad(db);
+  await waitForIdentityToLoad(db, dialect);
 }
 async function ensureSchemaVersion(db, dialect, options) {
   await migrateSchema(db, dialect);
@@ -2284,9 +2485,11 @@ addMaskedFields([
 ]);
 
 // src/core/identity/sync.ts
-async function registerIdentity(db, identity) {
+async function registerIdentity(db, identity, dialect) {
+  const ndb = noormDb(db, dialect);
+  const tables = getNoormTables(dialect);
   const [existing, selectErr] = await attempt(
-    () => db.selectFrom("__noorm_identities__").select(["id"]).where("identity_hash", "=", identity.identityHash).executeTakeFirst()
+    () => ndb.selectFrom(tables.identities).select(["id"]).where("identity_hash", "=", identity.identityHash).executeTakeFirst()
   );
   if (selectErr) {
     observer.emit("error", {
@@ -2302,7 +2505,7 @@ async function registerIdentity(db, identity) {
   }
   if (existing) {
     const [, updateErr] = await attempt(
-      () => db.updateTable("__noorm_identities__").set({ last_seen_at: /* @__PURE__ */ new Date() }).where("identity_hash", "=", identity.identityHash).execute()
+      () => ndb.updateTable(tables.identities).set({ last_seen_at: /* @__PURE__ */ new Date() }).where("identity_hash", "=", identity.identityHash).execute()
     );
     if (updateErr) {
       observer.emit("error", {
@@ -2319,7 +2522,7 @@ async function registerIdentity(db, identity) {
     return { ok: true, registered: false };
   }
   const [, insertErr] = await attempt(
-    () => db.insertInto("__noorm_identities__").values({
+    () => ndb.insertInto(tables.identities).values({
       identity_hash: identity.identityHash,
       email: identity.email,
       name: identity.name,
@@ -2362,11 +2565,11 @@ function resolveIdentity2(options = {}) {
 function getIdentityForConfig(config) {
   return resolveIdentity2({ configIdentity: config.identity });
 }
-async function waitForIdentityToLoad(db) {
+async function waitForIdentityToLoad(db, dialect) {
   const identity = await loadExistingIdentity();
   if (!identity) observer.emit("identity:not-found");
   if (!identity) return;
-  const [, err] = await attempt(() => registerIdentity(db, identity));
+  const [, err] = await attempt(() => registerIdentity(db, identity, dialect));
   if (err) observer.emit("error", {
     error: err,
     source: "identity:ensure",
@@ -2946,9 +3149,13 @@ function getExtension(filename) {
 }
 var ChangeHistory = class {
   #db;
+  #ndb;
+  #tables;
   #configName;
-  constructor(db, configName) {
+  constructor(db, configName, dialect = "sqlite") {
     this.#db = db;
+    this.#ndb = noormDb(db, dialect);
+    this.#tables = getNoormTables(dialect);
     this.#configName = configName;
   }
   // ─────────────────────────────────────────────────────────
@@ -2965,7 +3172,7 @@ var ChangeHistory = class {
    */
   async getStatus(name) {
     const [record, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select([
+      () => this.#ndb.selectFrom(this.#tables.change).select([
         "name",
         "status",
         "executed_at",
@@ -2986,7 +3193,7 @@ var ChangeHistory = class {
       return null;
     }
     const [revertRecord] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["executed_at"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "revert").where("status", "=", "success").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["executed_at"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "revert").where("status", "=", "success").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     return {
       name: record.name,
@@ -3007,7 +3214,7 @@ var ChangeHistory = class {
   async getAllStatuses() {
     const statuses = /* @__PURE__ */ new Map();
     const [records, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["id", "name", "status", "executed_at", "executed_by", "error_message"]).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").execute()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["id", "name", "status", "executed_at", "executed_by", "error_message"]).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").execute()
     );
     if (err) {
       observer.emit("error", {
@@ -3031,7 +3238,7 @@ var ChangeHistory = class {
       }
     }
     const [reverts] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["name", "executed_at"]).where("change_type", "=", "change").where("direction", "=", "revert").where("status", "=", "success").where("config_name", "=", this.#configName).orderBy("id", "desc").execute()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["name", "executed_at"]).where("change_type", "=", "change").where("direction", "=", "revert").where("status", "=", "success").where("config_name", "=", this.#configName).orderBy("id", "desc").execute()
     );
     if (reverts) {
       const seenReverts = /* @__PURE__ */ new Set();
@@ -3061,7 +3268,7 @@ var ChangeHistory = class {
       return { needsRun: true, reason: "force" };
     }
     const [record, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["status", "checksum"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["status", "checksum"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     if (err) {
       observer.emit("error", {
@@ -3126,7 +3333,7 @@ var ChangeHistory = class {
    */
   async createOperation(data2) {
     const [result, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.change).values({
+      () => this.#ndb.insertInto(this.#tables.change).values({
         name: data2.name,
         change_type: "change",
         direction: data2.direction,
@@ -3170,7 +3377,7 @@ var ChangeHistory = class {
       status: "pending"
     }));
     const [, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.executions).values(values).execute()
+      () => this.#ndb.insertInto(this.#tables.executions).values(values).execute()
     );
     if (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
@@ -3193,7 +3400,7 @@ var ChangeHistory = class {
    */
   async updateFileExecution(operationId, filepath, status, durationMs, errorMessage, skipReason) {
     const [result, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.executions).set({
+      () => this.#ndb.updateTable(this.#tables.executions).set({
         status,
         duration_ms: Math.round(durationMs),
         error_message: errorMessage ?? "",
@@ -3228,7 +3435,7 @@ var ChangeHistory = class {
    */
   async skipRemainingFiles(operationId, reason) {
     const [, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.executions).set({
+      () => this.#ndb.updateTable(this.#tables.executions).set({
         status: "skipped",
         skip_reason: reason
       }).where("change_id", "=", operationId).where("status", "=", "pending").execute()
@@ -3251,7 +3458,7 @@ var ChangeHistory = class {
   async finalizeOperation(operationId, status, checksum, durationMs, errorMessage) {
     const truncatedError = errorMessage ? errorMessage.slice(0, 2e3) : "";
     const [result, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.change).set({
+      () => this.#ndb.updateTable(this.#tables.change).set({
         status,
         checksum,
         duration_ms: Math.round(durationMs),
@@ -3292,7 +3499,7 @@ var ChangeHistory = class {
    */
   async recordReset(executedBy, reason) {
     const [result, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.change).values({
+      () => this.#ndb.insertInto(this.#tables.change).values({
         name: "__reset__",
         change_type: "change",
         direction: "change",
@@ -3322,14 +3529,14 @@ var ChangeHistory = class {
    */
   async deleteRecords(name) {
     const [operations, queryErr] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("config_name", "=", this.#configName).execute()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("config_name", "=", this.#configName).execute()
     );
     if (queryErr || !operations || operations.length === 0) {
       return;
     }
     const operationIds = operations.map((o) => o.id);
     const [, execErr] = await attempt(
-      () => this.#db.deleteFrom(NOORM_TABLES.executions).where("change_id", "in", operationIds).execute()
+      () => this.#ndb.deleteFrom(this.#tables.executions).where("change_id", "in", operationIds).execute()
     );
     if (execErr) {
       observer.emit("error", {
@@ -3339,7 +3546,7 @@ var ChangeHistory = class {
       });
     }
     const [, changeErr] = await attempt(
-      () => this.#db.deleteFrom(NOORM_TABLES.change).where("id", "in", operationIds).execute()
+      () => this.#ndb.deleteFrom(this.#tables.change).where("id", "in", operationIds).execute()
     );
     if (changeErr) {
       observer.emit("error", {
@@ -3359,7 +3566,7 @@ var ChangeHistory = class {
    * @param limit - Max records to return
    */
   async getHistory(name, limit) {
-    let query = this.#db.selectFrom(NOORM_TABLES.change).select([
+    let query = this.#ndb.selectFrom(this.#tables.change).select([
       "id",
       "name",
       "direction",
@@ -3407,7 +3614,7 @@ var ChangeHistory = class {
    * @param limit - Max records to return
    */
   async getUnifiedHistory(changeTypes, limit) {
-    let query = this.#db.selectFrom(NOORM_TABLES.change).select([
+    let query = this.#ndb.selectFrom(this.#tables.change).select([
       "id",
       "name",
       "change_type",
@@ -3463,7 +3670,7 @@ var ChangeHistory = class {
    */
   async getFileHistory(operationId) {
     const [records, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.executions).select([
+      () => this.#ndb.selectFrom(this.#tables.executions).select([
         "id",
         "change_id",
         "filepath",
@@ -3513,9 +3720,13 @@ var ChangeHistory = class {
 };
 var Tracker = class {
   #db;
+  #ndb;
+  #tables;
   #configName;
-  constructor(db, configName) {
+  constructor(db, configName, dialect = "sqlite") {
     this.#db = db;
+    this.#ndb = noormDb(db, dialect);
+    this.#tables = getNoormTables(dialect);
     this.#configName = configName;
   }
   /**
@@ -3538,15 +3749,16 @@ var Tracker = class {
       return { needsRun: true, reason: "force" };
     }
     const [record, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.executions).innerJoin(
-        NOORM_TABLES.change,
-        `${NOORM_TABLES.change}.id`,
-        `${NOORM_TABLES.executions}.change_id`
+      () => this.#ndb.selectFrom(this.#tables.executions).innerJoin(
+        this.#tables.change,
+        `${this.#tables.change}.id`,
+        `${this.#tables.executions}.change_id`
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
       ).select((eb) => [
-        eb.ref(`${NOORM_TABLES.executions}.checksum`).as("checksum"),
-        eb.ref(`${NOORM_TABLES.executions}.status`).as("exec_status"),
-        eb.ref(`${NOORM_TABLES.change}.status`).as("change_status")
-      ]).where(`${NOORM_TABLES.executions}.filepath`, "=", filepath).where(`${NOORM_TABLES.change}.config_name`, "=", this.#configName).orderBy(`${NOORM_TABLES.executions}.id`, "desc").limit(1).executeTakeFirst()
+        eb.ref(`${this.#tables.executions}.checksum`).as("checksum"),
+        eb.ref(`${this.#tables.executions}.status`).as("exec_status"),
+        eb.ref(`${this.#tables.change}.status`).as("change_status")
+      ]).where(`${this.#tables.executions}.filepath`, "=", filepath).where(`${this.#tables.change}.config_name`, "=", this.#configName).orderBy(`${this.#tables.executions}.id`, "desc").limit(1).executeTakeFirst()
     );
     if (err) {
       observer.emit("error", {
@@ -3602,7 +3814,7 @@ var Tracker = class {
     const direction = data2.direction ?? "commit";
     const dbDirection = direction === "commit" ? "change" : "revert";
     const [result, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.change).values({
+      () => this.#ndb.insertInto(this.#tables.change).values({
         name: data2.name,
         change_type: data2.changeType,
         direction: dbDirection,
@@ -3639,7 +3851,7 @@ var Tracker = class {
    */
   async recordExecution(data2) {
     const [, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.executions).values({
+      () => this.#ndb.insertInto(this.#tables.executions).values({
         change_id: data2.changeId,
         filepath: data2.filepath,
         file_type: "sql",
@@ -3673,7 +3885,7 @@ var Tracker = class {
   async finalizeOperation(operationId, status, durationMs, checksum, errorMessage) {
     const truncatedError = errorMessage ? errorMessage.slice(0, 2e3) : "";
     const [result, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.change).set({
+      () => this.#ndb.updateTable(this.#tables.change).set({
         status,
         duration_ms: Math.round(durationMs),
         checksum: checksum ?? "",
@@ -3724,7 +3936,7 @@ var Tracker = class {
       status: "pending"
     }));
     const [, err] = await attempt(
-      () => this.#db.insertInto(NOORM_TABLES.executions).values(values).execute()
+      () => this.#ndb.insertInto(this.#tables.executions).values(values).execute()
     );
     if (err) {
       const errMsg = err instanceof Error ? err.message : String(err);
@@ -3752,7 +3964,7 @@ var Tracker = class {
    */
   async updateFileExecution(operationId, filepath, status, durationMs, errorMessage, skipReason) {
     const [result, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.executions).set({
+      () => this.#ndb.updateTable(this.#tables.executions).set({
         status,
         duration_ms: Math.round(durationMs),
         error_message: errorMessage ?? "",
@@ -3792,7 +4004,7 @@ var Tracker = class {
    */
   async skipRemainingFiles(operationId, reason) {
     const [, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.executions).set({
+      () => this.#ndb.updateTable(this.#tables.executions).set({
         status: "skipped",
         skip_reason: reason
       }).where("change_id", "=", operationId).where("status", "=", "pending").execute()
@@ -3823,7 +4035,7 @@ var Tracker = class {
       return { needsRun: true, reason: "force" };
     }
     const [record, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["status", "checksum"]).where("name", "=", name).where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["status", "checksum"]).where("name", "=", name).where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     if (err) {
       observer.emit("error", {
@@ -3877,11 +4089,13 @@ var Tracker = class {
 var ChangeTracker = class extends Tracker {
   // Store db and configName for change-specific queries
   // (Tracker uses private fields, so we need our own references)
-  #db;
+  #ndb;
+  #tables;
   #configName;
-  constructor(db, configName) {
-    super(db, configName);
-    this.#db = db;
+  constructor(db, configName, dialect = "sqlite") {
+    super(db, configName, dialect);
+    this.#ndb = noormDb(db, dialect);
+    this.#tables = getNoormTables(dialect);
     this.#configName = configName;
   }
   /**
@@ -3893,7 +4107,7 @@ var ChangeTracker = class extends Tracker {
    */
   async canRevert(name, force) {
     const [record, err] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["status"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["status"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     if (err) {
       observer.emit("error", {
@@ -3933,11 +4147,11 @@ var ChangeTracker = class extends Tracker {
    */
   async markAsReverted(name) {
     const [record] = await attempt(
-      () => this.#db.selectFrom(NOORM_TABLES.change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(this.#tables.change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", "change").where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     if (record) {
       await attempt(
-        () => this.#db.updateTable(NOORM_TABLES.change).set({ status: "reverted" }).where("id", "=", record.id).execute()
+        () => this.#ndb.updateTable(this.#tables.change).set({ status: "reverted" }).where("id", "=", record.id).execute()
       );
     }
   }
@@ -3953,7 +4167,7 @@ var ChangeTracker = class extends Tracker {
    */
   async markAllAsStale() {
     const [result, err] = await attempt(
-      () => this.#db.updateTable(NOORM_TABLES.change).set({ status: "stale" }).where("direction", "=", "change").where("status", "in", ["success", "failed", "pending"]).where("config_name", "=", this.#configName).execute()
+      () => this.#ndb.updateTable(this.#tables.change).set({ status: "stale" }).where("direction", "=", "change").where("status", "in", ["success", "failed", "pending"]).where("config_name", "=", this.#configName).execute()
     );
     if (err) {
       observer.emit("error", {
@@ -4065,7 +4279,7 @@ var LockManager = class {
     observer.emit("lock:acquiring", { configName, identity });
     while (true) {
       await this.cleanupExpired(db, configName, opts.dialect);
-      const existing = await this.getLock(db, configName);
+      const existing = await this.getLock(db, configName, opts.dialect);
       if (!existing) {
         const lock = await this.createLock(db, configName, identity, opts);
         observer.emit("lock:acquired", {
@@ -4117,18 +4331,21 @@ var LockManager = class {
    * @param db - Kysely database instance
    * @param configName - Config/database scope
    * @param identity - Identity of the lock holder
+   * @param dialect - Database dialect for schema-aware table resolution
    * @throws LockNotFoundError if no lock exists
    * @throws LockOwnershipError if lock is held by someone else
    */
-  async release(db, configName, identity) {
-    const existing = await this.getLock(db, configName);
+  async release(db, configName, identity, dialect) {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const existing = await this.getLock(db, configName, dialect);
     if (!existing) {
       throw new LockNotFoundError(configName, identity);
     }
     if (existing.lockedBy !== identity) {
       throw new LockOwnershipError(configName, identity, existing.lockedBy);
     }
-    await db.deleteFrom(NOORM_TABLES.lock).where("config_name", "=", configName).where("locked_by", "=", identity).execute();
+    await ndb.deleteFrom(tables.lock).where("config_name", "=", configName).where("locked_by", "=", identity).execute();
     observer.emit("lock:released", { configName, identity });
   }
   /**
@@ -4139,14 +4356,17 @@ var LockManager = class {
    *
    * @param db - Kysely database instance
    * @param configName - Config/database scope
+   * @param dialect - Database dialect for schema-aware table resolution
    * @returns true if a lock was released, false if none existed
    */
-  async forceRelease(db, configName) {
-    const existing = await this.getLock(db, configName);
+  async forceRelease(db, configName, dialect) {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const existing = await this.getLock(db, configName, dialect);
     if (!existing) {
       return false;
     }
-    await db.deleteFrom(NOORM_TABLES.lock).where("config_name", "=", configName).execute();
+    await ndb.deleteFrom(tables.lock).where("config_name", "=", configName).execute();
     observer.emit("lock:released", {
       configName,
       identity: existing.lockedBy
@@ -4167,11 +4387,12 @@ var LockManager = class {
    * @returns Result of the operation
    */
   async withLock(db, configName, identity, operation, options = {}) {
+    const opts = { ...DEFAULT_LOCK_OPTIONS, ...options };
     await this.acquire(db, configName, identity, options);
     try {
       return await operation();
     } finally {
-      const [, err] = await attempt(() => this.release(db, configName, identity));
+      const [, err] = await attempt(() => this.release(db, configName, identity, opts.dialect));
       if (err) {
         observer.emit("error", {
           source: "lock",
@@ -4189,12 +4410,13 @@ var LockManager = class {
    * @param db - Kysely database instance
    * @param configName - Config/database scope
    * @param identity - Expected lock holder
+   * @param dialect - Database dialect for schema-aware table resolution
    * @throws LockExpiredError if lock has expired
    * @throws LockOwnershipError if lock is held by someone else
    * @throws LockNotFoundError if no lock exists
    */
   async validate(db, configName, identity, dialect = "postgres") {
-    const existing = await this.getLock(db, configName);
+    const existing = await this.getLock(db, configName, dialect);
     if (!existing) {
       throw new LockNotFoundError(configName, identity);
     }
@@ -4216,7 +4438,8 @@ var LockManager = class {
    * @returns Updated lock state
    */
   async extend(db, configName, identity, options = {}) {
-    await this.validate(db, configName, identity);
+    const opts = { ...DEFAULT_LOCK_OPTIONS, ...options };
+    await this.validate(db, configName, identity, opts.dialect);
     return this.extendLock(db, configName, identity, options);
   }
   /**
@@ -4229,7 +4452,7 @@ var LockManager = class {
    */
   async status(db, configName, dialect = "postgres") {
     await this.cleanupExpired(db, configName, dialect);
-    const lock = await this.getLock(db, configName);
+    const lock = await this.getLock(db, configName, dialect);
     return {
       isLocked: lock !== null,
       lock
@@ -4241,8 +4464,10 @@ var LockManager = class {
   /**
    * Get lock from database, or null if none exists.
    */
-  async getLock(db, configName) {
-    const row = await db.selectFrom(NOORM_TABLES.lock).selectAll().where("config_name", "=", configName).executeTakeFirst();
+  async getLock(db, configName, dialect) {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
+    const row = await ndb.selectFrom(tables.lock).selectAll().where("config_name", "=", configName).executeTakeFirst();
     if (!row) {
       return null;
     }
@@ -4257,9 +4482,11 @@ var LockManager = class {
    * Create a new lock in the database.
    */
   async createLock(db, configName, identity, opts) {
+    const ndb = noormDb(db, opts.dialect);
+    const tables = getNoormTables(opts.dialect);
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + opts.timeout);
-    await db.insertInto(NOORM_TABLES.lock).values({
+    await ndb.insertInto(tables.lock).values({
       config_name: configName,
       locked_by: identity,
       locked_at: formatDateForDialect(now, opts.dialect),
@@ -4279,6 +4506,8 @@ var LockManager = class {
   async extendLock(db, configName, identity, opts) {
     const dialect = opts.dialect ?? DEFAULT_LOCK_OPTIONS.dialect;
     const timeout = opts.timeout ?? DEFAULT_LOCK_OPTIONS.timeout;
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + timeout);
     const updateValues = {
@@ -4287,19 +4516,21 @@ var LockManager = class {
     if (opts.reason !== void 0) {
       updateValues["reason"] = opts.reason;
     }
-    await db.updateTable(NOORM_TABLES.lock).set(updateValues).where("config_name", "=", configName).where("locked_by", "=", identity).execute();
-    const lock = await this.getLock(db, configName);
+    await ndb.updateTable(tables.lock).set(updateValues).where("config_name", "=", configName).where("locked_by", "=", identity).execute();
+    const lock = await this.getLock(db, configName, dialect);
     return lock;
   }
   /**
    * Clean up expired locks.
    */
   async cleanupExpired(db, configName, dialect = "postgres") {
+    const ndb = noormDb(db, dialect);
+    const tables = getNoormTables(dialect);
     const now = /* @__PURE__ */ new Date();
     const nowForDb = formatDateForDialect(now, dialect);
-    const expired = await db.selectFrom(NOORM_TABLES.lock).select(["locked_by"]).where("config_name", "=", configName).where("expires_at", "<", nowForDb).executeTakeFirst();
+    const expired = await ndb.selectFrom(tables.lock).select(["locked_by"]).where("config_name", "=", configName).where("expires_at", "<", nowForDb).executeTakeFirst();
     if (expired) {
-      await db.deleteFrom(NOORM_TABLES.lock).where("config_name", "=", configName).where("expires_at", "<", nowForDb).execute();
+      await ndb.deleteFrom(tables.lock).where("config_name", "=", configName).where("expires_at", "<", nowForDb).execute();
       observer.emit("lock:expired", {
         configName,
         previousHolder: expired.locked_by
@@ -4358,7 +4589,7 @@ async function executeChange(context, change, options = {}) {
     return createFailedResult(change.name, "change", checksumErr.message, start);
   }
   const changeChecksum = computeCombinedChecksum(checksums);
-  const history = new ChangeHistory(context.db, context.configName);
+  const history = new ChangeHistory(context.db, context.configName, context.dialect ?? "postgres");
   if (!opts.dryRun && !opts.preview) {
     const needsRunResult = await history.needsRun(
       change.name,
@@ -4407,7 +4638,7 @@ async function executeChange(context, change, options = {}) {
       start
     )
   );
-  await attempt(() => lockManager.release(context.db, context.configName, identity));
+  await attempt(() => lockManager.release(context.db, context.configName, identity, context.dialect ?? "postgres"));
   if (execErr) {
     throw execErr;
   }
@@ -4430,8 +4661,8 @@ async function revertChange(context, change, options = {}) {
     return createFailedResult(change.name, "revert", checksumErr.message, start);
   }
   const revertChecksum = computeCombinedChecksum(checksums);
-  const history = new ChangeHistory(context.db, context.configName);
-  const tracker = new ChangeTracker(context.db, context.configName);
+  const history = new ChangeHistory(context.db, context.configName, context.dialect ?? "postgres");
+  const tracker = new ChangeTracker(context.db, context.configName, context.dialect ?? "postgres");
   if (!opts.dryRun && !opts.preview) {
     const canRevertResult = await tracker.canRevert(change.name, opts.force);
     if (!canRevertResult.canRevert) {
@@ -4479,7 +4710,7 @@ async function revertChange(context, change, options = {}) {
       start
     )
   );
-  await attempt(() => lockManager.release(context.db, context.configName, identity));
+  await attempt(() => lockManager.release(context.db, context.configName, identity, context.dialect ?? "postgres"));
   if (execErr) {
     throw execErr;
   }
@@ -4893,7 +5124,7 @@ var ChangeManager = class {
   #history;
   constructor(context) {
     this.#context = context;
-    this.#history = new ChangeHistory(context.db, context.configName);
+    this.#history = new ChangeHistory(context.db, context.configName, context.dialect ?? "postgres");
   }
   // ─────────────────────────────────────────────────────────
   // List
@@ -5513,7 +5744,7 @@ async function runFile(context, filepath, options = {}) {
     filepath,
     configName: context.configName
   });
-  const tracker = new Tracker(context.db, context.configName);
+  const tracker = new Tracker(context.db, context.configName, context.dialect ?? "postgres");
   const operationName = `run:${(/* @__PURE__ */ new Date()).toISOString()}`;
   const [operationId, createErr] = await attempt(
     () => tracker.createOperation({
@@ -5645,7 +5876,7 @@ async function executeFiles2(context, files, runOptions, execOptions) {
       durationMs: durationMs2
     };
   }
-  const tracker = execOptions.tracker ?? new Tracker(context.db, context.configName);
+  const tracker = execOptions.tracker ?? new Tracker(context.db, context.configName, context.dialect ?? "postgres");
   const [operationId, createErr] = await attempt(
     () => tracker.createOperation({
       name: execOptions.operationName,
@@ -6231,13 +6462,14 @@ var RunNamespace = class {
       configName: this.#state.config.name,
       identity: this.#state.identity,
       projectRoot: this.#state.projectRoot,
+      dialect: this.#state.config.connection.dialect,
       config: this.#state.config,
       secrets: state.getAllSecrets(this.#state.config.name),
       globalSecrets: state.getAllGlobalSecrets()
     };
   }
 };
-var EXCLUDED_SCHEMAS = ["pg_catalog", "information_schema", "pg_toast"];
+var EXCLUDED_SCHEMAS = ["pg_catalog", "information_schema", "pg_toast", "noorm"];
 var postgresExploreOperations = {
   async getOverview(db) {
     const [tables, views, procedures, functions, types, indexes, foreignKeys] = await Promise.all([
@@ -7435,7 +7667,7 @@ var mysqlExploreOperations = {
     };
   }
 };
-var EXCLUDED_SCHEMAS2 = ["sys", "INFORMATION_SCHEMA", "guest"];
+var EXCLUDED_SCHEMAS2 = ["sys", "INFORMATION_SCHEMA", "guest", "noorm"];
 var mssqlExploreOperations = {
   async getOverview(db) {
     const [tables, views, procedures, functions, types, indexes, foreignKeys] = await Promise.all([
@@ -8649,10 +8881,10 @@ function getTeardownOperations(dialect) {
 }
 
 // src/core/teardown/operations.ts
-var NOORM_TABLE_NAMES = new Set(Object.values(NOORM_TABLES));
 function isNoormTable2(name) {
   if (!name) return false;
-  return name.startsWith("__noorm_") || NOORM_TABLE_NAMES.has(name);
+  if (name.startsWith("__noorm_")) return true;
+  return false;
 }
 async function truncateData(db, dialect, options = {}) {
   const startTime = performance.now();
@@ -8825,11 +9057,13 @@ async function teardownSchema(db, dialect, options = {}) {
   if (options.configName && options.executedBy && !options.dryRun) {
     const tracker = new ChangeTracker(
       db,
-      options.configName
+      options.configName,
+      dialect
     );
     const history = new ChangeHistory(
       db,
-      options.configName
+      options.configName,
+      dialect
     );
     result.staleCount = await tracker.markAllAsStale();
     const parts = [
@@ -9058,7 +9292,8 @@ var LockNamespace = class {
     await lockManager.release(
       this.#kysely,
       this.#state.config.name,
-      identityStr
+      identityStr,
+      this.#state.config.connection.dialect
     );
   }
   /**
@@ -9110,7 +9345,8 @@ var LockNamespace = class {
     const lockManager = getLockManager();
     return lockManager.forceRelease(
       this.#kysely,
-      this.#state.config.name
+      this.#state.config.name,
+      this.#state.config.connection.dialect
     );
   }
   // ─────────────────────────────────────────────────────
@@ -9123,9 +9359,11 @@ var LockNamespace = class {
     return this.#state.connection.db;
   }
 };
-async function getUsersWithoutVaultAccess(db) {
+async function getUsersWithoutVaultAccess(db, dialect) {
+  const ndb = noormDb(db, dialect);
+  const tables = getNoormTables(dialect);
   const [rows, err] = await attempt(async () => {
-    return db.selectFrom(NOORM_TABLES.identities).select([
+    return ndb.selectFrom(tables.identities).select([
       "identity_hash",
       "public_key",
       "name",
@@ -9140,11 +9378,13 @@ async function getUsersWithoutVaultAccess(db) {
     email: r.email
   }));
 }
-async function propagateVaultKey(db, vaultKey) {
-  const users = await getUsersWithoutVaultAccess(db);
+async function propagateVaultKey(db, vaultKey, dialect) {
+  const ndb = noormDb(db, dialect);
+  const tables = getNoormTables(dialect);
+  const users = await getUsersWithoutVaultAccess(db, dialect);
   if (users.length === 0) {
     const [countResult2] = await attempt(async () => {
-      return db.selectFrom(NOORM_TABLES.identities).select(db.fn.count("id").as("count")).where("encrypted_vault_key", "is not", null).executeTakeFirst();
+      return ndb.selectFrom(tables.identities).select(ndb.fn.count("id").as("count")).where("encrypted_vault_key", "is not", null).executeTakeFirst();
     });
     return {
       propagatedTo: [],
@@ -9156,7 +9396,7 @@ async function propagateVaultKey(db, vaultKey) {
     const encrypted = encryptVaultKey(vaultKey, user.publicKey);
     const encryptedJson = JSON.stringify(encrypted);
     const [, err] = await attempt(async () => {
-      return db.updateTable(NOORM_TABLES.identities).set({ encrypted_vault_key: encryptedJson }).where("identity_hash", "=", user.identityHash).execute();
+      return ndb.updateTable(tables.identities).set({ encrypted_vault_key: encryptedJson }).where("identity_hash", "=", user.identityHash).execute();
     });
     if (!err) {
       propagatedTo.push(user.identityHash);
@@ -9167,7 +9407,7 @@ async function propagateVaultKey(db, vaultKey) {
     }
   }
   const [countResult] = await attempt(async () => {
-    return db.selectFrom(NOORM_TABLES.identities).select(db.fn.count("id").as("count")).where("encrypted_vault_key", "is not", null).executeTakeFirst();
+    return ndb.selectFrom(tables.identities).select(ndb.fn.count("id").as("count")).where("encrypted_vault_key", "is not", null).executeTakeFirst();
   });
   const totalWithAccess = countResult ? Number(countResult.count) : 0;
   const alreadyHadAccess = totalWithAccess - propagatedTo.length;
@@ -9247,18 +9487,20 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
       const sourceVaultKey = await getVaultKey(
         ctx.source.db,
         identityHash,
-        privateKey
+        privateKey,
+        ctx.source.dialect
       );
       if (!sourceVaultKey) {
         throw new Error(`No vault access on source config "${sourceConfig.name}"`);
       }
-      const destStatus = await getVaultStatus(ctx.destination.db, identityHash);
+      const destStatus = await getVaultStatus(ctx.destination.db, identityHash, ctx.destination.dialect);
       let destVaultKey = null;
       if (!destStatus.isInitialized) {
         const [newKey, initErr] = await initializeVault(
           ctx.destination.db,
           identityHash,
-          publicKey
+          publicKey,
+          ctx.destination.dialect
         );
         if (initErr) {
           throw new Error(`Failed to initialize vault on destination: ${initErr.message}`);
@@ -9270,13 +9512,14 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
         destVaultKey = await getVaultKey(
           ctx.destination.db,
           identityHash,
-          privateKey
+          privateKey,
+          ctx.destination.dialect
         );
       }
       if (!destVaultKey) {
         throw new Error("Failed to get vault key for destination");
       }
-      const allSourceSecrets = await getAllVaultSecrets(ctx.source.db, sourceVaultKey);
+      const allSourceSecrets = await getAllVaultSecrets(ctx.source.db, sourceVaultKey, ctx.source.dialect);
       const secretsToCopy = keys === "all" ? Object.entries(allSourceSecrets) : Object.entries(allSourceSecrets).filter(([key]) => keys.includes(key));
       const result = {
         copied: [],
@@ -9294,7 +9537,7 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
         }
       }
       for (const [key, secret] of secretsToCopy) {
-        const exists = await vaultSecretExists(ctx.destination.db, key);
+        const exists = await vaultSecretExists(ctx.destination.db, key, ctx.destination.dialect);
         if (exists && !force) {
           result.skipped.push(key);
           continue;
@@ -9305,7 +9548,8 @@ async function copyVaultSecrets(sourceConfig, destConfig, keys, identityHash, pr
           destVaultKey,
           key,
           secret.value,
-          setBy
+          setBy,
+          ctx.destination.dialect
         );
         if (setErr) {
           result.errors.push({ key, error: setErr.message });
@@ -9346,7 +9590,8 @@ var VaultNamespace = class {
     return initializeVault(
       this.#kysely,
       this.#identityHash,
-      this.#publicKey
+      this.#publicKey,
+      this.#dialect
     );
   }
   /**
@@ -9360,7 +9605,8 @@ var VaultNamespace = class {
   async status() {
     return getVaultStatus(
       this.#kysely,
-      this.#identityHash
+      this.#identityHash,
+      this.#dialect
     );
   }
   // ─────────────────────────────────────────────────────
@@ -9382,7 +9628,8 @@ var VaultNamespace = class {
       vaultKey,
       key,
       value,
-      formatIdentity(this.#state.identity)
+      formatIdentity(this.#state.identity),
+      this.#dialect
     );
   }
   /**
@@ -9399,7 +9646,8 @@ var VaultNamespace = class {
     return getVaultSecret(
       this.#kysely,
       vaultKey,
-      key
+      key,
+      this.#dialect
     );
   }
   /**
@@ -9415,7 +9663,8 @@ var VaultNamespace = class {
     if (!vaultKey) return {};
     return getAllVaultSecrets(
       this.#kysely,
-      vaultKey
+      vaultKey,
+      this.#dialect
     );
   }
   /**
@@ -9428,7 +9677,8 @@ var VaultNamespace = class {
    */
   async list() {
     return listVaultSecretKeys(
-      this.#kysely
+      this.#kysely,
+      this.#dialect
     );
   }
   /**
@@ -9442,7 +9692,8 @@ var VaultNamespace = class {
   async delete(key) {
     return deleteVaultSecret(
       this.#kysely,
-      key
+      key,
+      this.#dialect
     );
   }
   /**
@@ -9456,7 +9707,8 @@ var VaultNamespace = class {
   async exists(key) {
     return vaultSecretExists(
       this.#kysely,
-      key
+      key,
+      this.#dialect
     );
   }
   // ─────────────────────────────────────────────────────
@@ -9477,7 +9729,8 @@ var VaultNamespace = class {
     }
     return propagateVaultKey(
       this.#kysely,
-      vaultKey
+      vaultKey,
+      this.#dialect
     );
   }
   /**
@@ -9516,11 +9769,15 @@ var VaultNamespace = class {
     const identity = this.#state.identity;
     return identity["publicKey"] ?? "";
   }
+  get #dialect() {
+    return this.#state.config.connection.dialect;
+  }
   async #getVaultKey(privateKey) {
     return getVaultKey(
       this.#kysely,
       this.#identityHash,
-      privateKey
+      privateKey,
+      this.#dialect
     );
   }
 };