@pikku/cli 0.12.124 → 0.12.126

package/dist/src/functions/commands/db-reset.js

@@ -43,13 +43,17 @@ export const dbReset = pikkuSessionlessFunc({
         logger.info(zod.written
             ? `db reset: regenerated ${zod.outFile} (${zod.tables.length} tables)`
             : `db reset: ${zod.outFile} unchanged`);
+        // Both lines report on the SEED STEP, never on the database. A migration
+        // is free to carry rows — data a deployed stage needs is migration data —
+        // so "database is empty" was a verdict this step has no standing to reach,
+        // and it read as a failed reset every time it was wrong.
         if (noSeed) {
-            logger.info('db reset: --no-seed, leaving the database empty');
+            logger.info('db reset: --no-seed, skipping the dev seed');
             return;
         }
         const devSeedResult = await devSeed(resolved);
         logger.info(devSeedResult.applied
             ? `db reset: seeded ${resolved.devSeedFile} (${devSeedResult.bytes} bytes)`
-            : `db reset: no ${resolved.devSeedFile} found, database is empty`);
+            : `db reset: no dev seed applied (${resolved.devSeedFile} not found)`);
     },
 });

package/dist/src/functions/commands/deploy-apply.d.ts

@@ -8,23 +8,33 @@ export declare function resolveProvider(config?: {
     };
 }, providerName?: string, options?: {
     runtime?: string;
+    desktop?: boolean;
+    projectDir?: string;
+    desktopIdentifier?: string;
+    desktopUrl?: string;
 }): Promise<ProviderAdapter>;
 export declare const deployApply: import("#pikku/function").PikkuFunctionConfig<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
     fromPlan?: boolean;
     provider?: string;
     runtime?: string;
+    desktop?: boolean;
+    desktopUrl?: string;
     resultFile?: string;
     debugArtifacts?: boolean;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/deploy-apply.js

@@ -178,8 +178,15 @@ async function runDeploy(provider, providerDir, logger, resultFile) {
 export const deployApply = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState, bundler }, data) => {
         const projectDir = config.rootDir;
+        // A url on its own is a request for a shell — asking for both flags would
+        // only leave `--desktop-url` alone as a silent no-op.
+        const desktopUrl = data?.desktopUrl ?? config.deploy?.desktop?.url;
         const provider = await resolveProvider(config, data?.provider, {
             runtime: data?.runtime,
+            desktop: data?.desktop || Boolean(desktopUrl),
+            projectDir,
+            desktopIdentifier: config.deploy?.desktop?.identifier,
+            desktopUrl,
         });
         const fromPlan = data?.fromPlan ?? false;
         const resultFile = data?.resultFile;
@@ -212,6 +219,7 @@ export const deployApply = pikkuSessionlessFunc({
             defaultTarget: config.deploy?.defaultTarget,
             globalHTTPPrefix: config.globalHTTPPrefix,
             getEntryContext,
+            frontend: config.frontend,
             outDir: config.outDir,
             debugArtifacts: data?.debugArtifacts ?? false,
             logger,

package/dist/src/functions/commands/deploy-plan.js

@@ -59,6 +59,7 @@ export const deployPlan = pikkuSessionlessFunc({
             defaultTarget: config.deploy?.defaultTarget,
             globalHTTPPrefix: config.globalHTTPPrefix,
             getEntryContext,
+            frontend: config.frontend,
             outDir: config.outDir,
             debugArtifacts: data?.debugArtifacts ?? false,
             logger,

package/dist/src/functions/commands/dev.js

@@ -18,17 +18,23 @@ import { resolveDb, createKysely, parseDatabaseUrl, } from '../db/local-db.js';
 import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
 import { startCoverageService } from './start-coverage.js';
+import { resolveDevEnvironmentName } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
 import { enableDevActorSignIn } from '../../server/actor-sign-in.js';
+import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { applyModelAliasOverride } from '../../utils/model-alias-override.js';
 export const dev = pikkuSessionlessFunc({
     remote: true,
     func: async ({ logger, config, getInspectorState, invalidateInspectorState, variables, devServerRunner, }, { port, watch, hmr, coverage, test, model }, { rpc }) => {
         process.env.PIKKU_DEV_QUICK_LOGIN ??= 'true';
-        enableDevActorSignIn(logger);
+        process.env.PIKKU_ENV ??= resolveDevEnvironmentName(config.environments ?? {});
+        await enableDevActorSignIn(logger, async () => {
+            const state = await getInspectorState(true, false, false, true);
+            return Object.values(resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain));
+        });
         applyModelAliasOverride(logger, model, config.models);
         if (test) {
             process.env.PIKKU_TEST_RUN = 'true';
@@ -296,10 +302,19 @@ export const dev = pikkuSessionlessFunc({
         await lifecycle?.beforeStart?.(resolvedServices);
         await pikkuServer.start();
         await lifecycle?.afterStart?.(resolvedServices);
+        // Not `resolvedPort`: `--port 0` asks the OS for a free port, and every URL
+        // announced from here has to name the one it actually handed out.
+        const boundPort = pikkuServer.port;
         if (consoleMount) {
-            logger.info(`Pikku Console available at http://${hostname}:${resolvedPort}${consoleMount.urlPrefix}`);
+            logger.info(`Pikku Console available at http://${hostname}:${boundPort}${consoleMount.urlPrefix}`);
+        }
+        // Serving the built frontend here would hand you whatever the last build
+        // produced, with no HMR and no warning that it is stale. The frontend's own
+        // dev server owns dev; it proxies its API calls back to this port.
+        if (config.frontend) {
+            logger.info(`Frontend not served in dev — run your frontend dev server and proxy its API calls to http://${hostname}:${boundPort}`);
         }
-        logger.info(serverReadyLine(hostname, resolvedPort));
+        logger.info(serverReadyLine(hostname, boundPort));
         let watcher;
         process.once('SIGINT', async () => {
             logger.info('Stopping dev server...');

package/dist/src/functions/commands/environment.d.ts

@@ -60,3 +60,13 @@ export declare const parseAppUrls: (value: string) => {
     base?: string;
     byApp: Record<string, string>;
 };
+/**
+ * The environment name `pikku dev` is running as, for anything that gates on
+ * `PIKKU_ENV` — persona provisioning above all, which fails closed and so
+ * provisions nothing at all when nobody says where the process is.
+ *
+ * Local means a configured, non-production environment whose `apiUrl` is a
+ * loopback host; `local` wins when several qualify. A project that configures
+ * none gets `undefined` rather than a guess.
+ */
+export declare const resolveDevEnvironmentName: (environments: Record<string, PikkuEnvironment>) => string | undefined;

package/dist/src/functions/commands/environment.js

@@ -94,3 +94,27 @@ export const parseAppUrls = (value) => {
     }
     return { base, byApp };
 };
+/**
+ * The environment name `pikku dev` is running as, for anything that gates on
+ * `PIKKU_ENV` — persona provisioning above all, which fails closed and so
+ * provisions nothing at all when nobody says where the process is.
+ *
+ * Local means a configured, non-production environment whose `apiUrl` is a
+ * loopback host; `local` wins when several qualify. A project that configures
+ * none gets `undefined` rather than a guess.
+ */
+export const resolveDevEnvironmentName = (environments) => {
+    const candidates = Object.entries(environments).filter(([, environment]) => {
+        if (environment.production) {
+            return false;
+        }
+        try {
+            return LOCAL_HOSTNAMES.has(new URL(environment.apiUrl).hostname);
+        }
+        catch {
+            return false;
+        }
+    });
+    const preferred = candidates.find(([name]) => name === 'local');
+    return (preferred ?? candidates[0])?.[0];
+};

package/dist/src/functions/commands/persona.d.ts

@@ -55,4 +55,22 @@ export declare const personaRun: import("#pikku/function").PikkuFunctionConfig<{
     out?: string;
 }, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 /** Who this app is for, and what each of them wants, without running anything. */
+/**
+ * Mint the actor credential for one persona, or for every declared persona.
+ *
+ * The root secret is entitled to all of them, so nothing that only needs to be
+ * one person should ever hold it. What comes out is bound to that persona's
+ * address by the target — presenting it for anyone else is refused — so a CI
+ * job, a container or a virtual user can be handed exactly the people it is
+ * meant to be and no more.
+ *
+ * Printed as `id=secret` lines, which is the shape PIKKU_PERSONA_SECRETS reads.
+ */
+export declare const personaSecret: import("#pikku/function").PikkuFunctionConfig<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<{
+    personas?: string[];
+}, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;
 export declare const personaList: import("#pikku/function").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku/function").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku/function").WiredServices, unknown> | import("#pikku/function").PikkuFunction<void, void, "rpc" | "session", import("#pikku/function").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/persona.js

@@ -1,11 +1,11 @@
 import { resolve, dirname } from 'node:path';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { pikkuSessionlessFunc } from '#pikku/function';
-import { createHttpPersonas, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
+import { createHttpPersonas, deriveActorSecret, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
 import { personaVirtualUserTarget, runVirtualUser, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, } from '@pikku/core/virtual-user';
 import { getSingletonServices, setSingletonServices } from '@pikku/core/state';
 import { resolvePersonas } from '../../utils/resolve-personas.js';
-import { resolvePersonaCredentials } from '../../utils/persona-credentials.js';
+import { ACTOR_SECRET_VARIABLE, PERSONA_SECRETS_VARIABLE, resolvePersonaCredentials, } from '../../utils/persona-credentials.js';
 import { resolveEnvironment } from './environment.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { formatVirtualUserReport } from './virtual-user-formatter.js';
@@ -191,6 +191,45 @@ export const personaRun = pikkuSessionlessFunc({
     },
 });
 /** Who this app is for, and what each of them wants, without running anything. */
+/**
+ * Mint the actor credential for one persona, or for every declared persona.
+ *
+ * The root secret is entitled to all of them, so nothing that only needs to be
+ * one person should ever hold it. What comes out is bound to that persona's
+ * address by the target — presenting it for anyone else is refused — so a CI
+ * job, a container or a virtual user can be handed exactly the people it is
+ * meant to be and no more.
+ *
+ * Printed as `id=secret` lines, which is the shape PIKKU_PERSONA_SECRETS reads.
+ */
+export const personaSecret = pikkuSessionlessFunc({
+    func: async ({ logger, config, variables, getInspectorState }, input) => {
+        const root = await variables.get(ACTOR_SECRET_VARIABLE);
+        if (!root) {
+            throw new Error(`${ACTOR_SECRET_VARIABLE} is not set — there is no root to derive from. ` +
+                `It lives in the environment of whoever mints credentials, and never in pikku.config.json.`);
+        }
+        const state = await getInspectorState(true, false, false, true);
+        const declared = resolvePersonas(state.personas?.definitions ?? [], config.scenarios?.emailDomain);
+        const wanted = input.personas?.length
+            ? input.personas
+            : Object.keys(declared);
+        const unknown = wanted.filter((id) => !declared[id]);
+        if (unknown.length > 0) {
+            throw new Error(`No persona ${unknown.map((id) => `'${id}'`).join(', ')} is declared. ` +
+                `Declared: ${Object.keys(declared).sort().join(', ') || 'none'}.`);
+        }
+        const minted = [];
+        for (const id of wanted) {
+            minted.push(`${id}=${await deriveActorSecret(String(root), declared[id].email)}`);
+        }
+        for (const line of minted) {
+            logger.info(line);
+        }
+        logger.info('');
+        logger.info(`Hand these to a run as ${PERSONA_SECRETS_VARIABLE}='${minted.join(',')}'`);
+    },
+});
 export const personaList = pikkuSessionlessFunc({
     func: async ({ logger, config, getInspectorState }) => {
         const state = await getInspectorState(true, false, false, true);

package/dist/src/functions/commands/scenario-browser.d.ts

@@ -9,12 +9,16 @@
  */
 import type { ScenarioArtifact, ScenarioBrowserFailure, ScenarioBrowserProvider } from '@pikku/core/scenario';
 import type { ResolvedPersona } from '@pikku/core/services';
-import type { OperatorSignInOptions } from '@pikku/core/persona';
+import type { ActorSecretResolver, OperatorSignInOptions } from '@pikku/core/persona';
 /** The default driver, used when a project names no other. */
 export declare const DEFAULT_BROWSER_DRIVER = "@pikku/playwright";
 export interface ScenarioBrowserDriverOptions {
-    /** The actor secret, for a local `pikku dev` target. */
-    secret?: string;
+    /**
+     * The root actor secret, for a local `pikku dev` target — each persona's
+     * credential is derived from it. A resolver instead when this run was handed
+     * credentials for only some personas.
+     */
+    secret?: string | ActorSecretResolver;
     /** Fabric operator credentials, for a deployed target. */
     operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;
@@ -72,8 +76,12 @@ export interface ResolveScenarioBrowserProviderOptions {
     appUrl?: string;
     /** Base url per app, for a product whose personas sign into more than one. */
     appUrls?: Record<string, string>;
-    /** The actor secret, for a local `pikku dev` target. */
-    secret?: string;
+    /**
+     * The root actor secret, for a local `pikku dev` target — each persona's
+     * credential is derived from it. A resolver instead when this run was handed
+     * credentials for only some personas.
+     */
+    secret?: string | ActorSecretResolver;
     /** Fabric operator credentials, for a deployed target. */
     operator?: OperatorSignInOptions;
     actors: Record<string, ResolvedPersona>;

package/dist/src/functions/commands/serve-frontend.d.ts

@@ -0,0 +1,11 @@
+import type { StaticMount } from '@pikku/node-http-server';
+import type { PikkuCLIConfig } from '../../../types/config.js';
+/**
+ * Turn a resolved `frontend` config into the mount that serves it.
+ *
+ * The directory is checked rather than trusted because pikku only ever reads a
+ * frontend's output: an unbuilt `dir` means the project's own build has not run,
+ * and saying so here is far cheaper than a server that boots fine and answers
+ * every page with a 404.
+ */
+export declare function resolveFrontendMount(frontend: NonNullable<PikkuCLIConfig['frontend']>): Promise<StaticMount>;

package/dist/src/functions/commands/serve-frontend.js

@@ -0,0 +1,17 @@
+import { assertFrontendBuilt } from '../../utils/frontend.js';
+/**
+ * Turn a resolved `frontend` config into the mount that serves it.
+ *
+ * The directory is checked rather than trusted because pikku only ever reads a
+ * frontend's output: an unbuilt `dir` means the project's own build has not run,
+ * and saying so here is far cheaper than a server that boots fine and answers
+ * every page with a 404.
+ */
+export async function resolveFrontendMount(frontend) {
+    await assertFrontendBuilt(frontend.dir);
+    return {
+        urlPrefix: frontend.urlPrefix,
+        directory: frontend.dir,
+        spaFallback: frontend.spaFallback,
+    };
+}

package/dist/src/functions/commands/serve.js

@@ -16,6 +16,7 @@ import { loadUserBootstrap, loadUserModule } from './load-user-project.js';
 import { registerScenarioInstrumentation } from '../wirings/scenarios/register-scenario-instrumentation.js';
 import { createDevAgentRunner } from './dev-agent-runner.js';
 import { resolveConsoleMount } from './serve-console.js';
+import { resolveFrontendMount } from './serve-frontend.js';
 import { serverReadyLine } from '../../server/server-ready.js';
 import { createEphemeralContentSigningJWT } from '../../server/content-signing-jwt.js';
 import { disableDevActorSignIn } from '../../server/actor-sign-in.js';
@@ -144,22 +145,34 @@ export const serve = pikkuSessionlessFunc({
         if (serveConsole && !consoleMount) {
             logger.warn('Console app not found. Please rebuild @pikku/cli with the console app bundled.');
         }
+        const frontendMount = config.frontend
+            ? await resolveFrontendMount(config.frontend)
+            : undefined;
+        // The console goes first so a frontend mounted at `/` cannot claim
+        // `/console` before the console's own mount is offered the request.
+        const staticMounts = [consoleMount, frontendMount].filter((mount) => Boolean(mount));
         const pikkuServer = devServerRunner.createServer({
             ...userConfig,
             hostname: bindHostname,
             port: resolvedPort,
             content: localContentConfig,
-            ...(consoleMount ? { staticMounts: [consoleMount] } : {}),
+            ...(staticMounts.length ? { staticMounts } : {}),
         }, logger, { contentSigningJWT });
         const lifecycle = await loadLifecycle();
         await pikkuServer.init();
         await lifecycle?.beforeStart?.(resolvedServices);
         await pikkuServer.start();
         await lifecycle?.afterStart?.(resolvedServices);
+        // Not `resolvedPort`: `--port 0` asks the OS for a free port, and every URL
+        // announced from here has to name the one it actually handed out.
+        const boundPort = pikkuServer.port;
         if (consoleMount) {
-            logger.info(`Pikku Console available at http://${hostname}:${resolvedPort}${consoleMount.urlPrefix}`);
+            logger.info(`Pikku Console available at http://${hostname}:${boundPort}${consoleMount.urlPrefix}`);
+        }
+        if (frontendMount) {
+            logger.info(`Frontend available at http://${hostname}:${boundPort}${frontendMount.urlPrefix}`);
         }
-        logger.info(serverReadyLine(hostname, resolvedPort));
+        logger.info(serverReadyLine(hostname, boundPort));
         process.once('SIGINT', async () => {
             logger.info('Stopping server...');
             try {

package/dist/src/functions/db/annotation-parser.d.ts

@@ -30,6 +30,14 @@ export interface ColAnnotation {
      * insert/update brand on the generated column type. Absent means `plain`.
      */
     form?: ColumnForm;
+    /**
+     * Which key protects this column, for an encrypted `form`. Absent means the
+     * deployment's default key.
+     *
+     * Reported as authored rather than defaulted here, so the manifest emitter
+     * stays the single place the default is applied.
+     */
+    keyId?: string;
 }
 /** Per-table, per-column annotation map sourced from `db/annotations.ts`. */
 export type AnnotationMap = Record<string, Record<string, ColAnnotation>>;

package/dist/src/functions/db/annotation-parser.js

@@ -117,6 +117,8 @@ export function loadAnnotations(rootDir) {
                     COLUMN_FORMS.includes(ann.form)) {
                     entry.form = ann.form;
                 }
+                if (ann.keyId)
+                    entry.keyId = ann.keyId;
                 const strategy = parseStrategy(ann.classification);
                 if (strategy !== null)
                     entry.anonymize = strategy;

package/dist/src/functions/db/check-enums.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A `CHECK (col IN ('a','b',…))` constraint is an enum by another name, and
+ * both introspectors read one back as SQL text: SQLite stores the `CREATE
+ * TABLE` verbatim, Postgres hands back a normalised `pg_get_constraintdef`.
+ * The parsing they need differs, but the quoting rules do not, so both go
+ * through here.
+ */
+/**
+ * Blank out `--` line comments and `/* … *\/` block comments, leaving a string
+ * of the same shape so offsets and line breaks still line up.
+ *
+ * Quoted text is skipped rather than scanned: `'a--b'` is a value, not a
+ * comment. The reverse — reading a comment as SQL — is what makes this
+ * necessary at all: an apostrophe in `-- the clinician's copy` opens a string
+ * that runs to the next quote in the real list, and a bracket in `-- (see
+ * below)` closes the list early. Either way the CHECK survives as a union that
+ * is wrong, which is worse than no union.
+ */
+export declare function stripSqlComments(sql: string): string;
+/** The single-quoted literals in `text`, with doubled quotes unescaped. */
+export declare function quotedValues(text: string): string[];
+/**
+ * Map each column constrained by a `CHECK (col IN (…))` in a `CREATE TABLE`
+ * statement to its allowed values. Only the positive `col IN (…)` form is
+ * recognised (the convention); `NOT IN`, ranges and boolean expressions are
+ * left for the column to stay a plain string.
+ */
+export declare function parseCheckEnumsFromDdl(ddl: string): Map<string, string[]>;
+/**
+ * The allowed values in a Postgres check constraint, or `undefined` when the
+ * constraint is not an enumeration.
+ *
+ * Postgres does not store the `IN (…)` you wrote — `pg_get_constraintdef`
+ * rewrites it as `= ANY (ARRAY[…])`, with each element cast to the column's
+ * type. Matching that shape is deliberate: `NOT IN` normalises to `<> ALL
+ * (ARRAY[…])` and a range to `>`/`<`, and neither is an enum.
+ */
+export declare function parseCheckEnumValues(constraintDef: string): string[] | undefined;

package/dist/src/functions/db/check-enums.js

@@ -0,0 +1,103 @@
+/**
+ * A `CHECK (col IN ('a','b',…))` constraint is an enum by another name, and
+ * both introspectors read one back as SQL text: SQLite stores the `CREATE
+ * TABLE` verbatim, Postgres hands back a normalised `pg_get_constraintdef`.
+ * The parsing they need differs, but the quoting rules do not, so both go
+ * through here.
+ */
+/**
+ * Blank out `--` line comments and `/* … *\/` block comments, leaving a string
+ * of the same shape so offsets and line breaks still line up.
+ *
+ * Quoted text is skipped rather than scanned: `'a--b'` is a value, not a
+ * comment. The reverse — reading a comment as SQL — is what makes this
+ * necessary at all: an apostrophe in `-- the clinician's copy` opens a string
+ * that runs to the next quote in the real list, and a bracket in `-- (see
+ * below)` closes the list early. Either way the CHECK survives as a union that
+ * is wrong, which is worse than no union.
+ */
+export function stripSqlComments(sql) {
+    let out = '';
+    let i = 0;
+    while (i < sql.length) {
+        const c = sql[i];
+        if (c === "'" || c === '"') {
+            const end = closingQuote(sql, i);
+            out += sql.slice(i, end);
+            i = end;
+            continue;
+        }
+        if (c === '-' && sql[i + 1] === '-') {
+            while (i < sql.length && sql[i] !== '\n') {
+                out += ' ';
+                i++;
+            }
+            continue;
+        }
+        if (c === '/' && sql[i + 1] === '*') {
+            const close = sql.indexOf('*/', i + 2);
+            const end = close === -1 ? sql.length : close + 2;
+            for (let k = i; k < end; k++)
+                out += sql[k] === '\n' ? '\n' : ' ';
+            i = end;
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    return out;
+}
+/** Index just past the quoted run starting at `start`, doubled quotes included. */
+function closingQuote(sql, start) {
+    const quote = sql[start];
+    let i = start + 1;
+    while (i < sql.length) {
+        if (sql[i] === quote) {
+            if (sql[i + 1] === quote) {
+                i += 2;
+                continue;
+            }
+            return i + 1;
+        }
+        i++;
+    }
+    return sql.length;
+}
+/** The single-quoted literals in `text`, with doubled quotes unescaped. */
+export function quotedValues(text) {
+    return [...text.matchAll(/'((?:[^']|'')*)'/g)].map((m) => m[1].replace(/''/g, "'"));
+}
+/**
+ * Map each column constrained by a `CHECK (col IN (…))` in a `CREATE TABLE`
+ * statement to its allowed values. Only the positive `col IN (…)` form is
+ * recognised (the convention); `NOT IN`, ranges and boolean expressions are
+ * left for the column to stay a plain string.
+ */
+export function parseCheckEnumsFromDdl(ddl) {
+    const out = new Map();
+    const sql = stripSqlComments(ddl);
+    const checkIn = /CHECK\s*\(\s*"?(\w+)"?\s+IN\s*\(([^)]*)\)/gi;
+    let m;
+    while ((m = checkIn.exec(sql))) {
+        const values = quotedValues(m[2]);
+        if (values.length > 0)
+            out.set(m[1], values);
+    }
+    return out;
+}
+/**
+ * The allowed values in a Postgres check constraint, or `undefined` when the
+ * constraint is not an enumeration.
+ *
+ * Postgres does not store the `IN (…)` you wrote — `pg_get_constraintdef`
+ * rewrites it as `= ANY (ARRAY[…])`, with each element cast to the column's
+ * type. Matching that shape is deliberate: `NOT IN` normalises to `<> ALL
+ * (ARRAY[…])` and a range to `>`/`<`, and neither is an enum.
+ */
+export function parseCheckEnumValues(constraintDef) {
+    const any = /=\s*ANY\s*\(\s*\(?\s*ARRAY\s*\[([^\]]*)\]/i.exec(constraintDef);
+    if (!any)
+        return undefined;
+    const values = quotedValues(any[1]);
+    return values.length > 0 ? values : undefined;
+}

package/dist/src/functions/db/db-codegen.js

@@ -340,6 +340,14 @@ function emitInterface(table, camelCase, explicitAnnotations, dialect, enumByNam
     return `export interface ${ifaceName} {\n${fields}\n}`;
 }
 // ─── Manifest emitter ────────────────────────────────────────────────────────
+/**
+ * The key an encrypted column is protected by when it names none.
+ *
+ * Spelled out in every entry rather than left implicit, so the set of keys a
+ * deployment has to resolve can be read off the manifest without knowing the
+ * rule that produced it.
+ */
+const DEFAULT_COLUMN_KEY_ID = 'default';
 function emitManifest(tables, explicitAnnotations) {
     const tableEntries = tables
         .map((table) => {
@@ -354,8 +362,15 @@ function emitManifest(tables, explicitAnnotations) {
             // tell "held in the clear, stated" from "nobody has said yet", and a
             // defaulted 'plain' would erase exactly that difference.
             const formLiteral = ann?.form ? `, form: '${ann.form}'` : '';
+            // Only a column that is actually encrypted names a key. Emitting one
+            // on a plain or hashed column would claim a protection it has not
+            // got — and a hash has no key to be opened with in the first place.
+            const encrypted = ann?.form === 'wrapped' || ann?.form === 'sealed';
+            const keyIdLiteral = encrypted
+                ? `, keyId: '${ann?.keyId ?? DEFAULT_COLUMN_KEY_ID}'`
+                : '';
             return (`      ${JSON.stringify(col.name)}: ` +
-                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral}${formLiteral} }`);
+                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral}${formLiteral}${keyIdLiteral} }`);
         })
             .join(',\n');
         return `    ${JSON.stringify(table.name)}: {\n${colEntries}\n    }`;
@@ -391,6 +406,10 @@ function emitClassificationMap(tables) {
         `   *  real encrypt/seal/hash result can be written to it. Defaults to 'plain',`,
         `   *  which on a \`secret\` column is warned about (PKU483) until stated here. */`,
         `  form?: 'plain' | 'hashed' | 'wrapped' | 'sealed'`,
+        `  /** Which key protects this column, for a 'wrapped' or 'sealed' form. It is a`,
+        `   *  purpose, not a tenant: naming one here says these columns open together and`,
+        `   *  separately from the rest. Defaults to 'default'. */`,
+        `  keyId?: string`,
         `  /** Anonymize strategy used by \`pikku db anonymize\`. */`,
         `  classification?: 'fake:email' | 'fake:name' | 'hash' | 'keep'`,
         `  /** Column kind override for codegen coercion + typing. */`,
@@ -622,6 +641,21 @@ export async function generateSchemaTypes(introspector, options) {
     const coercionBody = [
         `// Generated by @pikku/cli — do not edit by hand.`,
         `// Run \`pikku db migrate\` to refresh.`,
+        `//`,
+        `// Nothing applies this for you. Attach it where the kysely singleton is`,
+        `// created, in createSingletonServices:`,
+        `//`,
+        `//   import { createCoercionPlugin } from '@pikku/kysely'`,
+        `//   import { coercionMap } from '#pikku/db/coercion.gen.js'`,
+        `//`,
+        `//   kysely: existingServices.kysely.withPlugin(`,
+        `//     createCoercionPlugin({ map: coercionMap }),`,
+        `//   )`,
+        `//`,
+        `// Unwired, this file is invisible locally and fatal deployed: the dev`,
+        `// driver hydrates a TEXT date into a Date by itself, a deployed one`,
+        `// returns the raw string, and the generated schema types the column`,
+        `// \`Date\` either way — so tsc flags nothing and no local test can fail.`,
         ``,
         `export const coercionMap = {`,
         coercionEntries,

package/dist/src/functions/db/postgres/postgres-introspector.d.ts

@@ -12,6 +12,20 @@ export declare class PostgresIntrospector implements DbIntrospector {
     connect(): Promise<void>;
     listTables(): Promise<string[]>;
     getColumns(table: string): Promise<ColumnInfo[]>;
+    /**
+     * Columns constrained to a value list by a `CHECK (col IN (…))`, keyed like
+     * {@link getAllColumns} then by column name. Postgres has native enums, but
+     * a CHECK is the other half of how a schema says "one of these" — and the
+     * one an app written against SQLite as well ends up using, since SQLite has
+     * no enums at all. Left as plain `string`, every caller narrows it by hand.
+     *
+     * Only single-column constraints are read: `conkey` naming two columns means
+     * neither is restricted to the list on its own.
+     *
+     * `table` limits the sweep to one table; omitted, it covers the schema. Both
+     * are one round-trip — see {@link getAllColumns}.
+     */
+    private getCheckEnums;
     getForeignKeys(table: string): Promise<ForeignKeyInfo[]>;
     getAllColumns(): Promise<Map<string, ColumnInfo[]>>;
     getAllForeignKeys(): Promise<Map<string, ForeignKeyInfo[]>>;