@pikku/cli 0.12.96 → 0.12.100

package/dist/src/functions/commands/scopes-prune.d.ts

@@ -9,6 +9,6 @@ export declare const scopesPrune: import("#pikku").PikkuFunctionConfig<{
     yes?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     yes?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     yes?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/scopes-shared.d.ts

@@ -33,6 +33,10 @@ export declare const openScopeService: ({ config, logger, }: {
         outDir: string;
         runtimeDir?: string;
         srcDirectories: string[];
+        db?: {
+            schema?: string;
+            defaultSchema?: string;
+        };
     };
     logger: Logger;
 }, declared: FlatScope[], command: string) => Promise<OpenedScopeService | null>;

package/dist/src/functions/commands/scopes-shared.js

@@ -52,7 +52,7 @@ export const openScopeService = async ({ config, logger, }, declared, command) =
     if (!userConfig) {
         return null;
     }
-    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
     if (!resolved) {
         logger.error(`${command}: no database configured — set sqliteDb or postgresUrl in your createConfig.`);
         throw new Error('no database configured');

package/dist/src/functions/commands/serve.d.ts

@@ -4,7 +4,7 @@ export declare const serve: import("#pikku").PikkuFunctionConfig<{
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     port?: string;
     console?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     port?: string;
     console?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/serve.js

@@ -3,7 +3,7 @@ import { pikkuSessionlessFunc } from '#pikku';
 import { ConsoleLogger, LocalEmailService, InMemoryQueueService, InMemoryWorkflowService, InMemoryTriggerService, InMemoryAIRunStateService, QueueWebhookService, } from '@pikku/core/services';
 import { KyselyAIStorageService, KyselyAIRunStateService, KyselyAgentRunService, } from '@pikku/kysely';
 import { stopSingletonServices } from '@pikku/core';
-import { pikkuState } from '@pikku/core/internal';
+import { pikkuState } from '@pikku/core/ecosystem';
 import { LocalMetaService } from '@pikku/core/services/local-meta';
 import { LocalContent, } from '@pikku/core/services/local-content';
 import { InMemorySchedulerService } from '@pikku/schedule';
@@ -38,7 +38,7 @@ export const serve = pikkuSessionlessFunc({
         const effectiveDbConfig = envDatabaseUrl
             ? parseDatabaseUrl(envDatabaseUrl)
             : userConfig;
-        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         const resolvedLocalDb = resolvedDb ?? undefined;
         const kysely = resolvedLocalDb
             ? await createKysely(resolvedLocalDb)

package/dist/src/functions/commands/skills.d.ts

@@ -2,7 +2,7 @@ export declare const pikkuSkillsList: import("#pikku").PikkuFunctionConfig<{
     target?: string;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     target?: string;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     target?: string;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
 export declare const pikkuSkillsInstall: import("#pikku").PikkuFunctionConfig<{
@@ -17,7 +17,7 @@ export declare const pikkuSkillsInstall: import("#pikku").PikkuFunctionConfig<{
     core?: boolean;
     fabric?: boolean;
     update?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     agent?: string;
     only?: string;
     core?: boolean;

package/dist/src/functions/commands/versions-check.d.ts

@@ -1 +1 @@
-export declare const pikkuVersionsCheck: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVersionsCheck: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/versions-check.js

@@ -30,7 +30,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     if (error.nextVersion !== undefined) {
                         logger.info(`  Set \`version: ${error.nextVersion}\` on the function, then run:`);
                     }
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else if (error.code === ErrorCode.FUNCTION_VERSION_MODIFIED &&
                     error.functionKey) {
@@ -54,7 +54,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     logger.info(``);
                     logger.info(`  This usually means a merge conflict in versions.pikku.json.`);
                     logger.info(`  Resolve the conflict, then run:`);
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else if (error.code === ErrorCode.VERSION_GAP_NOT_ALLOWED &&
                     error.functionKey) {
@@ -85,7 +85,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     }
                     logger.info(``);
                     logger.info(`  The manifest is corrupted. Run:`);
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else {
                     logger.info(`[${error.code}] ${error.message}`);

package/dist/src/functions/commands/versions-init.d.ts

@@ -2,6 +2,6 @@ export declare const pikkuVersionsInit: import("#pikku").PikkuFunctionConfig<{
     force?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     force?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     force?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/versions-update.d.ts

@@ -1 +1 @@
-export declare const pikkuVersionsUpdate: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const pikkuVersionsUpdate: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/watch.d.ts

@@ -2,6 +2,6 @@ export declare const watch: import("#pikku").PikkuFunctionConfig<{
     hmr?: boolean;
 }, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
     hmr?: boolean;
-}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+}, void, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<{
     hmr?: boolean;
 }, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/workspace-validate.d.ts

@@ -19,7 +19,7 @@ export declare const workspaceValidate: import("#pikku").PikkuFunctionConfig<Rec
         path: string;
         fixHint: string;
     }[];
-}, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<Record<string, never>, {
+}, "rpc" | "session", import("#pikku").WiredServices, unknown> | import("#pikku").PikkuFunction<Record<string, never>, {
     ok: boolean;
     root: string;
     findings: {

package/dist/src/functions/db/annotation-parser.d.ts

@@ -2,6 +2,8 @@ import type { ColumnKind } from './coercion-plugin.js';
 import { type ZodFormat } from './zod-codegen.js';
 type Classification = 'public' | 'private' | 'pii' | 'secret';
 type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
+type ColumnForm = 'plain' | 'hashed' | 'wrapped' | 'sealed';
+export declare const COLUMN_FORMS: readonly ["plain", "hashed", "wrapped", "sealed"];
 export interface ColAnnotation {
     /** Column kind override: `date`, `bool`, `json`, or `uuid`. */
     kind?: ColumnKind;
@@ -15,6 +17,11 @@ export interface ColAnnotation {
     format?: ZodFormat;
     classification?: Classification;
     anonymize?: AnonymizeStrategy;
+    /**
+     * At-rest representation, independent of `classification`. Drives the
+     * insert/update brand on the generated column type. Absent means `plain`.
+     */
+    form?: ColumnForm;
 }
 /** Per-table, per-column annotation map sourced from `db/annotations.ts`. */
 export type AnnotationMap = Record<string, Record<string, ColAnnotation>>;
@@ -37,6 +44,13 @@ export declare function nameSuggestsKind(colName: string): ColumnKind | null;
  * where `security` is the privacy level and `classification` is the anonymize
  * strategy. Returns `{}` if the sidecar doesn't exist yet (first migrate run,
  * before it has been generated).
+ *
+ * `DbClassificationMap` nests under the schema name whenever the project has
+ * one (`{ app: { user: { email: … } } }`), so the sidecar is flattened back to
+ * bare table names here — the codegen looks columns up by `bareTableName`.
+ * Reading a schema-qualified map as though it were flat silently yields an
+ * annotation for every column of every table, which is how a project could
+ * classify a column `secret` and still generate it as `private`.
  */
 export declare function loadAnnotations(rootDir: string): AnnotationMap;
 export {};

package/dist/src/functions/db/annotation-parser.js

@@ -1,6 +1,12 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { ZOD_FORMATS } from './zod-codegen.js';
+export const COLUMN_FORMS = [
+    'plain',
+    'hashed',
+    'wrapped',
+    'sealed',
+];
 /**
  * Warn-only naming heuristic. We no longer *infer* a column's kind from its
  * name (it produced wrong types — e.g. SQLite stores `*_at` as ISO TEXT, not a
@@ -23,6 +29,17 @@ function parseStrategy(s) {
         ? s
         : null;
 }
+/**
+ * A column entry's own values are all primitives; a table's are objects. That
+ * is the only structural difference between the two levels, and it is what
+ * tells a schema-qualified map (`{ app: { user: { … } } }`) from a bare one
+ * (`{ user: { … } }`) without having to be told which shape was authored.
+ */
+function isColumnEntry(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    return Object.values(value).every((v) => typeof v !== 'object' || v === null);
+}
 /**
  * Load annotations from the `db/annotations.gen.json` sidecar, which is
  * compiled from the developer-authored `db/annotations.ts` (`DbClassificationMap`)
@@ -34,6 +51,13 @@ function parseStrategy(s) {
  * where `security` is the privacy level and `classification` is the anonymize
  * strategy. Returns `{}` if the sidecar doesn't exist yet (first migrate run,
  * before it has been generated).
+ *
+ * `DbClassificationMap` nests under the schema name whenever the project has
+ * one (`{ app: { user: { email: … } } }`), so the sidecar is flattened back to
+ * bare table names here — the codegen looks columns up by `bareTableName`.
+ * Reading a schema-qualified map as though it were flat silently yields an
+ * annotation for every column of every table, which is how a project could
+ * classify a column `secret` and still generate it as `private`.
  */
 export function loadAnnotations(rootDir) {
     const jsonPath = join(rootDir, 'db', 'annotations.gen.json');
@@ -41,8 +65,24 @@ export function loadAnnotations(rootDir) {
         return {};
     try {
         const raw = JSON.parse(readFileSync(jsonPath, 'utf8'));
+        const tables = [];
+        for (const [key, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const isTable = Object.values(value).every((v) => v === null || isColumnEntry(v));
+            if (isTable) {
+                tables.push([key, value]);
+                continue;
+            }
+            // `key` is a schema; its values are the tables.
+            for (const [table, cols] of Object.entries(value)) {
+                if (cols && typeof cols === 'object') {
+                    tables.push([table, cols]);
+                }
+            }
+        }
         const result = {};
-        for (const [table, cols] of Object.entries(raw)) {
+        for (const [table, cols] of tables) {
             result[table] = {};
             for (const [col, ann] of Object.entries(cols)) {
                 if (!ann)
@@ -57,7 +97,9 @@ export function loadAnnotations(rootDir) {
                     entry.tsType = ann.tsType;
                 if (ann.format && ann.format in ZOD_FORMATS)
                     entry.format = ann.format;
-                // `security` is the privacy level. `encrypted` brands as `secret`.
+                // `security` is the privacy level. The legacy `encrypted` value
+                // predates `form` and conflated the two axes; it still parses, as the
+                // pair it always meant.
                 switch (ann.security) {
                     case 'public':
                     case 'private':
@@ -67,8 +109,14 @@ export function loadAnnotations(rootDir) {
                         break;
                     case 'encrypted':
                         entry.classification = 'secret';
+                        entry.form = 'wrapped';
                         break;
                 }
+                // An explicit `form` wins over the one implied by legacy `encrypted`.
+                if (ann.form &&
+                    COLUMN_FORMS.includes(ann.form)) {
+                    entry.form = ann.form;
+                }
                 const strategy = parseStrategy(ann.classification);
                 if (strategy !== null)
                     entry.anonymize = strategy;

package/dist/src/functions/db/better-auth-schema.js

@@ -3,6 +3,7 @@ import { pathToFileURL } from 'node:url';
 import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
 import { join, extname, dirname } from 'node:path';
 import { PIKKU_BETTER_AUTH } from '@pikku/better-auth';
+import { createSecretValue } from '@pikku/core';
 import { LocalVariablesService } from '@pikku/core/services';
 import { loadUserModule } from '../commands/load-user-project.js';
 let cachedGetMigrations = null;
@@ -95,7 +96,7 @@ async function loadAuthFactory(sourceFile) {
 function fakeSecretService() {
     const placeholder = 'schema-introspection-only';
     return {
-        getSecret: async () => placeholder,
+        getSecret: async () => createSecretValue(placeholder),
         hasSecret: async () => true,
         setSecret: async () => { },
     };

package/dist/src/functions/db/db-codegen.d.ts

@@ -16,6 +16,18 @@ export interface CodegenOptions {
      */
     enumsFile?: string;
     camelCase?: boolean;
+    /**
+     * Schema whose qualifier is dropped from the `DB` keys and the interface
+     * names, so `app.user` reads as `user`/`User` rather than `app.user`/
+     * `AppUser`. Tables in any other schema stay fully qualified. Omitting it
+     * qualifies everything, which is the safe default for a project spanning
+     * schemas.
+     *
+     * The key IS what Kysely puts in the SQL, so only set this for a schema the
+     * connection's `search_path` resolves — otherwise every query compiles and
+     * then fails to find the table at runtime.
+     */
+    defaultSchema?: string;
     rootDir?: string;
     /** DB dialect — drives real-type-aware date typing. Defaults to 'sqlite'. */
     dialect?: Dialect;

package/dist/src/functions/db/db-codegen.js

@@ -33,6 +33,16 @@ function snakeToPascal(name) {
         .map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase())
         .join('');
 }
+/**
+ * Drop `defaultSchema`'s qualifier from a table name, leaving every other
+ * schema qualified. `app.user` → `user` when the default schema is `app`.
+ */
+function stripDefaultSchema(name, defaultSchema) {
+    if (!defaultSchema)
+        return name;
+    const prefix = `${defaultSchema}.`;
+    return name.startsWith(prefix) ? name.slice(prefix.length) : name;
+}
 function tableToInterfaceName(name) {
     return name
         .split('.')
@@ -105,10 +115,54 @@ function insertBase(annotation, col) {
         return 'unknown';
     return mapType(col.type);
 }
-function columnTypeExpression(col, annotation, classification) {
+/**
+ * The brand a `form` puts on a column's INSERT and UPDATE types.
+ *
+ * `plain` maps to null rather than to an identity wrapper: an unbranded column
+ * is the default every existing project already has, and emitting a wrapper for
+ * it would churn every generated file to say nothing.
+ */
+/** The erasable sensitivity brand on a column's SELECT type. */
+function classificationBrand(classification) {
+    return classification === 'secret'
+        ? 'Secret'
+        : classification === 'pii'
+            ? 'Pii'
+            : 'Private';
+}
+function formBrand(form) {
+    switch (form) {
+        case 'wrapped':
+            return 'WrappedValue';
+        case 'sealed':
+            return 'SealedValue';
+        case 'hashed':
+            return 'HashedValue';
+        default:
+            return null;
+    }
+}
+function columnTypeExpression(col, annotation, classification, form) {
     const nullable = !col.notNull && !col.pk;
     const isAutoInt = col.pk && mapType(col.type) === 'number';
     const isOptionalInsert = col.defaultValue !== null || isAutoInt || Boolean(col.generated);
+    // A declared `form` supersedes both branches below, because it constrains the
+    // side neither of them touches: what may be WRITTEN. The caller only reaches
+    // here with a form once it has confirmed the column resolves to `string`.
+    const brand = formBrand(form);
+    if (brand) {
+        // The two brands compose — `Secret<WrappedValue>` is still structurally
+        // `{ __classification__?: 'secret' }`, so the inspector's PKU910 output
+        // check keeps working, while a row read back is already a `WrappedValue`
+        // and flows into rewrap/re-seal calls without a cast.
+        const selectT = classification === 'public'
+            ? brand
+            : `${classificationBrand(classification)}<${brand}>`;
+        const insertT = `${brand}${isOptionalInsert ? ' | undefined' : ''}`;
+        return nullable
+            ? `ColumnType<${selectT} | null, ${insertT} | null, ${brand} | null>`
+            : `ColumnType<${selectT}, ${insertT}, ${brand}>`;
+    }
     if (classification === 'public') {
         const wrap = (inner) => isOptionalInsert ? `Generated<${inner}>` : inner;
         if (annotation?.kind === 'bool') {
@@ -139,11 +193,7 @@ function columnTypeExpression(col, annotation, classification) {
             return `Generated<${base}${nullable ? ' | null' : ''}>`;
         return nullable ? `${base} | null` : base;
     }
-    const B = classification === 'secret'
-        ? 'Secret'
-        : classification === 'pii'
-            ? 'Pii'
-            : 'Private';
+    const B = classificationBrand(classification);
     const sBase = selectBase(annotation, col);
     const iBase = insertBase(annotation, col);
     const selectT = nullable ? `${B}<${sBase}> | null` : `${B}<${sBase}>`;
@@ -159,7 +209,7 @@ function bareTableName(name) {
     return dot >= 0 ? name.slice(dot + 1) : name;
 }
 function emitInterface(table, camelCase, explicitAnnotations, dialect, enumByName, formatHints, warnings) {
-    const ifaceName = tableToInterfaceName(table.name);
+    const ifaceName = tableToInterfaceName(table.displayName ?? table.name);
     const bare = bareTableName(table.name);
     const tableCols = explicitAnnotations[bare] ?? {};
     const fields = table.columns
@@ -243,7 +293,44 @@ function emitInterface(table, camelCase, explicitAnnotations, dialect, enumByNam
             }
         }
         const classification = ann?.classification ?? 'private';
-        const type = columnTypeExpression(col, typeAnn, classification);
+        // A form brands the column with a nominal string subtype, so it only
+        // means anything where the resolved type IS a string. On a bytea/blob or
+        // a coerced column the brand would not compile, so skip it and say why —
+        // a secret that needs wrapping in a non-text column needs the column
+        // migrated to text first, which is a schema decision, not a codegen one.
+        let form = ann?.form;
+        if (form && form !== 'plain') {
+            const base = selectBase(typeAnn, col);
+            if (base !== 'string') {
+                warnings.push({
+                    severity: 'warn',
+                    code: ErrorCode.DB_FORM_ON_NON_STRING,
+                    message: `Column "${bare}.${col.name}": form '${form}' ignored — its resolved ` +
+                        `type is ${base}, not string. Ciphertext and digests are text; ` +
+                        `migrate the column or drop the form.`,
+                });
+                form = undefined;
+            }
+        }
+        // The point of the axis: a credential the application can replay is one
+        // that a database read alone hands to whoever has it. Warn rather than
+        // fail, because every project predating `form` has such columns and a
+        // hard error would break them all on the next migrate — `pikku db
+        // --fail-on-warn` is how a project opts into the ratchet.
+        // Checks what was DECLARED, not what survived the string test above, so a
+        // form rejected for a non-text column reports that one reason rather than
+        // two, and an explicit `form: 'plain'` is the acknowledgement that ends it.
+        if (classification === 'secret' && ann?.form === undefined) {
+            warnings.push({
+                severity: 'warn',
+                code: ErrorCode.DB_SECRET_COLUMN_STORED_PLAIN,
+                message: `Column "${bare}.${col.name}" is classified secret but stored in the clear. ` +
+                    `Declare how it is held in db/annotations.ts — form: 'hashed' | 'wrapped' | ` +
+                    `'sealed' — or form: 'plain' to state that reading the row is meant to ` +
+                    `yield a usable credential.`,
+            });
+        }
+        const type = columnTypeExpression(col, typeAnn, classification, form);
         const safeName = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(fieldName)
             ? fieldName
             : JSON.stringify(fieldName);
@@ -263,8 +350,12 @@ function emitManifest(tables, explicitAnnotations) {
             const classification = ann?.classification ?? 'private';
             const strategy = ann?.anonymize ?? null;
             const strategyLiteral = strategy === null ? 'null' : `'${strategy}'`;
+            // Emitted only when declared. An audit reading this manifest needs to
+            // tell "held in the clear, stated" from "nobody has said yet", and a
+            // defaulted 'plain' would erase exactly that difference.
+            const formLiteral = ann?.form ? `, form: '${ann.form}'` : '';
             return (`      ${JSON.stringify(col.name)}: ` +
-                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral} }`);
+                `{ classification: '${classification}', anonymize_strategy: ${strategyLiteral}${formLiteral} }`);
         })
             .join(',\n');
         return `    ${JSON.stringify(table.name)}: {\n${colEntries}\n    }`;
@@ -292,8 +383,14 @@ function emitManifest(tables, explicitAnnotations) {
  */
 function emitClassificationMap(tables) {
     const colEntry = [
-        `  /** Privacy level. Defaults to 'private' when omitted. */`,
+        `  /** Privacy level — can the value leave the process? Defaults to 'private'.`,
+        `   *  'encrypted' is the legacy spelling of \`security: 'secret', form: 'wrapped'\`. */`,
         `  security?: 'public' | 'private' | 'pii' | 'secret' | 'encrypted'`,
+        `  /** How the value is held at rest, independent of \`security\`. A form other`,
+        `   *  than 'plain' makes the column's INSERT/UPDATE type nominal, so only a`,
+        `   *  real encrypt/seal/hash result can be written to it. Defaults to 'plain',`,
+        `   *  which on a \`secret\` column is warned about (PKU483) until stated here. */`,
+        `  form?: 'plain' | 'hashed' | 'wrapped' | 'sealed'`,
         `  /** Anonymize strategy used by \`pikku db anonymize\`. */`,
         `  classification?: 'fake:email' | 'fake:name' | 'hash' | 'keep'`,
         `  /** Column kind override for codegen coercion + typing. */`,
@@ -419,24 +516,57 @@ export async function generateSchemaTypes(introspector, options) {
     }
     // ── schema.gen.ts ────────────────────────────────────────────────────────────
     const warnings = [];
+    // The name each table is known by in the generated types. With a
+    // `defaultSchema` that is the unqualified name — unless dropping the
+    // qualifier would make two tables share one name, in which case the table
+    // keeps its qualifier rather than silently shadowing the other.
+    const displayNames = new Map();
+    const claimedBy = new Map();
+    for (const t of tables) {
+        const stripped = stripDefaultSchema(t.name, options.defaultSchema);
+        const owner = claimedBy.get(stripped);
+        if (owner !== undefined && owner !== t.name) {
+            warnings.push({
+                severity: 'warn',
+                code: ErrorCode.DB_DEFAULT_SCHEMA_NAME_COLLISION,
+                message: `Dropping the "${options.defaultSchema}" qualifier would make "${t.name}" and ` +
+                    `"${owner}" both "${stripped}". "${t.name}" keeps its qualifier.`,
+            });
+            displayNames.set(t.name, t.name);
+            continue;
+        }
+        claimedBy.set(stripped, t.name);
+        displayNames.set(t.name, stripped);
+    }
+    const displayName = (name) => displayNames.get(name) ?? name;
     const zodFormats = {};
     const interfaces = tables
-        .map((t) => emitInterface(t, camelCase, explicitAnnotations, dialect, enumByName, zodFormats, warnings))
+        .map((t) => emitInterface({ ...t, displayName: displayName(t.name) }, camelCase, explicitAnnotations, dialect, enumByName, zodFormats, warnings))
         .join('\n\n');
     const dbEntries = tables
         .map((t) => {
-        const tableKey = camelCase ? snakeToCamel(t.name) : t.name;
+        const name = displayName(t.name);
+        const tableKey = camelCase ? snakeToCamel(name) : name;
         const safe = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(tableKey)
             ? tableKey
             : JSON.stringify(tableKey);
-        return `  ${safe}: ${tableToInterfaceName(t.name)}`;
+        return `  ${safe}: ${tableToInterfaceName(name)}`;
     })
         .join('\n');
+    // The form brands are nominal (`unique symbol`), so unlike the structural
+    // `Private`/`Secret` aliases they CANNOT be re-declared here: a local
+    // declaration would be a distinct type, and the ciphertext `@pikku/core`
+    // hands back would not be assignable to the column it belongs in. Import the
+    // one true declaration, and only when a column actually uses it.
+    const usedFormBrands = ['WrappedValue', 'SealedValue', 'HashedValue'].filter((brand) => new RegExp(`\\b${brand}\\b`).test(interfaces));
     const schemaBody = [
         `// Generated by @pikku/cli — do not edit by hand.`,
         `// Run \`pikku db migrate\` to refresh.`,
         ``,
         `import type { ColumnType } from 'kysely'`,
+        ...(usedFormBrands.length > 0
+            ? [`import type { ${usedFormBrands.join(', ')} } from '@pikku/core'`]
+            : []),
         ``,
         `export type Generated<T> = T extends ColumnType<infer S, infer I, infer U>`,
         `  ? ColumnType<S, I | undefined, U>`,
@@ -470,9 +600,12 @@ export async function generateSchemaTypes(introspector, options) {
             // is a string in both dialects, so it needs no runtime coercion.
             const kind = tableCols[col.name]?.kind;
             if (kind && kind !== 'uuid') {
-                if (!coercionMap[table.name])
-                    coercionMap[table.name] = {};
-                coercionMap[table.name][col.name] = kind;
+                // Keyed by the name the query is written against, since that is what
+                // the runtime plugin sees on the Kysely node.
+                const key = displayName(table.name);
+                if (!coercionMap[key])
+                    coercionMap[key] = {};
+                coercionMap[key][col.name] = kind;
             }
         }
     }