@pikku/cli 0.12.96 → 0.12.99

package/dist/src/functions/commands/db-reset.d.ts

@@ -1 +1,15 @@
-export declare const dbReset: import("#pikku").PikkuFunctionConfig<{}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+/**
+ * Wipe the dev database, replay every migration, then apply the dev seed.
+ *
+ * Seeding lives here rather than in a command of its own so it only ever meets
+ * a freshly migrated, empty database. That is what lets a seed file be plain
+ * `INSERT`s: there is no path that applies it twice, so it never has to defend
+ * itself with `INSERT OR IGNORE` or `ON CONFLICT DO NOTHING`.
+ */
+export declare const dbReset: import("#pikku").PikkuFunctionConfig<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<{
+    noSeed?: boolean;
+}, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/db-reset.js

@@ -1,9 +1,17 @@
 import { pikkuSessionlessFunc } from '#pikku';
-import { resolveDb, reset, migrateAndCodegen, seed } from '../db/local-db.js';
+import { resolveDb, reset, migrateAndCodegen, devSeed } from '../db/local-db.js';
 import { loadUserConfigForDb } from './db-shared.js';
+/**
+ * Wipe the dev database, replay every migration, then apply the dev seed.
+ *
+ * Seeding lives here rather than in a command of its own so it only ever meets
+ * a freshly migrated, empty database. That is what lets a seed file be plain
+ * `INSERT`s: there is no path that applies it twice, so it never has to defend
+ * itself with `INSERT OR IGNORE` or `ON CONFLICT DO NOTHING`.
+ */
 export const dbReset = pikkuSessionlessFunc({
     remote: true,
-    func: async ({ logger, config }) => {
+    func: async ({ logger, config }, { noSeed }) => {
         if (process.env.NODE_ENV === 'production') {
             logger.error('pikku db reset refused: NODE_ENV=production. This command only runs in dev.');
             throw new Error('pikku db reset refused: NODE_ENV=production');
@@ -11,7 +19,7 @@ export const dbReset = pikkuSessionlessFunc({
         const userConfig = await loadUserConfigForDb({ config, logger });
         if (!userConfig)
             return;
-        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         if (!resolved) {
             logger.error('pikku db reset: no database configured — set sqliteDb or postgresUrl in your createConfig.');
             throw new Error('no database configured');
@@ -35,9 +43,13 @@ export const dbReset = pikkuSessionlessFunc({
         logger.info(zod.written
             ? `db reset: regenerated ${zod.outFile} (${zod.tables.length} tables)`
             : `db reset: ${zod.outFile} unchanged`);
-        const seedResult = await seed(resolved);
-        if (seedResult.applied) {
-            logger.info(`db reset: seeded ${resolved.seedFile} (${seedResult.bytes} bytes)`);
+        if (noSeed) {
+            logger.info('db reset: --no-seed, leaving the database empty');
+            return;
         }
+        const devSeedResult = await devSeed(resolved);
+        logger.info(devSeedResult.applied
+            ? `db reset: seeded ${resolved.devSeedFile} (${devSeedResult.bytes} bytes)`
+            : `db reset: no ${resolved.devSeedFile} found, database is empty`);
     },
 });

package/dist/src/functions/commands/db-shared.d.ts

@@ -1,6 +1,20 @@
 export interface UserConfigShape {
     sqliteDb?: string;
     postgresUrl?: string;
+    /**
+     * Postgres extensions the CLI's embedded PGlite databases must load — the
+     * local dev database, and the shadow one every `db` command migrates to type
+     * and diff a schema.
+     *
+     * A bare name is one of PGlite's bundled contrib extensions (`hstore`,
+     * `citext`, `uuid_ossp`, …) and needs nothing installed. Anything else is a
+     * package the project depends on, such as `@electric-sql/pglite-pgvector`.
+     *
+     * Needed even when `postgresUrl` points at a server that already has the
+     * extension: the shadow database is PGlite regardless, so a `CREATE EXTENSION`
+     * in a migration fails there unless it is declared here.
+     */
+    pgliteExtensions?: string[];
     [key: string]: unknown;
 }
 interface LoadOptions {

package/dist/src/functions/commands/deploy-info.d.ts

@@ -1 +1 @@
-export declare const deployInfo: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const deployInfo: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/dev.js

@@ -135,7 +135,7 @@ export const dev = pikkuSessionlessFunc({
         const effectiveDbConfig = envDatabaseUrl
             ? parseDatabaseUrl(envDatabaseUrl)
             : userConfig;
-        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         const resolvedLocalDb = resolvedDb ?? undefined;
         const kysely = resolvedLocalDb
             ? await createKysely(resolvedLocalDb)

package/dist/src/functions/commands/enable.d.ts

@@ -1,8 +1,8 @@
-export declare const enableRpc: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableConsole: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableScenarios: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableAgent: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableWorkflow: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableEvents: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableRemoteRpc: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
-export declare const enableWebhook: import("#pikku").PikkuFunctionConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices> | import("#pikku").PikkuFunction<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableRpc: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableConsole: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableScenarios: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableAgent: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableWorkflow: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableEvents: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableRemoteRpc: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;
+export declare const enableWebhook: import("#pikku").PikkuFunctionSessionlessConfig<void, void, "rpc" | "session", import("#pikku").PikkuFunctionSessionless<void, void, "rpc" | "session", import("#pikku").WiredServices>, undefined, undefined>;

package/dist/src/functions/commands/new-addon.js

@@ -308,10 +308,10 @@ import { pikkuAddonServices } from '#pikku'
 
 export const createSingletonServices = pikkuAddonServices(async (
   config,
-  { secrets, variables }
+  { secrets }
 ) => {
   const creds = await secrets.getSecret<${pascalName}Secrets>('${screamingName}_CREDENTIALS')
-  const ${camelName} = new ${pascalName}Service(creds, variables)
+  const ${camelName} = new ${pascalName}Service(creds.reveal())
 
   return { ${camelName} }
 })

package/dist/src/functions/commands/persona-sync.d.ts

@@ -2,7 +2,7 @@
  * Provision the declared personas into an environment: their accounts, and the
  * roles they declare.
  *
- * This is deployment, not seeding. `pikku db seed` applies a project's test
+ * This is deployment, not seeding. `pikku db reset` applies a project's test
  * fixtures and does not run in production; an accountable persona doing a real
  * job in production still needs an account and its grants, and this is where
  * they come from.

package/dist/src/functions/commands/persona-sync.js

@@ -26,7 +26,7 @@ const userIdByEmail = async (db, email) => {
  * Provision the declared personas into an environment: their accounts, and the
  * roles they declare.
  *
- * This is deployment, not seeding. `pikku db seed` applies a project's test
+ * This is deployment, not seeding. `pikku db reset` applies a project's test
  * fixtures and does not run in production; an accountable persona doing a real
  * job in production still needs an account and its grants, and this is where
  * they come from.

package/dist/src/functions/commands/persona.js

@@ -2,9 +2,8 @@ import { resolve, dirname } from 'node:path';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { pikkuSessionlessFunc } from '#pikku';
 import { createHttpPersonas, personaEnvironmentRefusal, roleMismatchMessage, verifyPersonaRoles, } from '@pikku/core/persona';
-import { flattenSystemRoleDefinitions } from '@pikku/core/role';
-import { personaVirtualUserTarget, catalogueClassification, deriveCatalogue, deriveIntents, DISPOSITIONS, reachableAgents, runVirtualUser, } from '@pikku/core/virtual-user';
-import { personaScopes, resolvePersonas } from '../../utils/resolve-personas.js';
+import { personaVirtualUserTarget, catalogueClassification, DISPOSITIONS, prepareVirtualUserRun, runVirtualUser, } from '@pikku/core/virtual-user';
+import { resolvePersonas } from '../../utils/resolve-personas.js';
 import { resolveEnvironment } from './environment.js';
 import { createDevAIAgentRunner } from './dev-ai-runner.js';
 import { formatVirtualUserReport } from './virtual-user-formatter.js';
@@ -93,23 +92,21 @@ export const personaRun = pikkuSessionlessFunc({
         if (!aiAgentRunner) {
             throw new Error('No AI provider is configured. Set OPENAI_BASE_URL + OPENAI_API_KEY (or LITELLM_PROXY_URL + LITELLM_API_KEY).');
         }
-        const functionsMeta = state.functions?.meta ?? {};
-        const catalogue = deriveCatalogue(functionsMeta, (state.schemas ?? {}));
+        // Shared with the scaffolded `runVirtualUser` RPC, which does the same
+        // derivation from `metaService` at runtime — the two have to agree, or the
+        // same persona and seed explore a different API depending on how it was
+        // started.
+        const { catalogue, intents, scopes, agents } = prepareVirtualUserRun({
+            persona,
+            functionsMeta: state.functions?.meta ?? {},
+            schemas: (state.schemas ?? {}),
+            workflowsMeta: state.workflows?.meta ?? {},
+            systemRoles: state.systemRoles?.definitions ?? [],
+            agentsMeta: state.agents?.agentsMeta ?? {},
+        });
         if (catalogue.length === 0) {
             throw new Error('This project exposes no RPCs, so there is nothing for a virtual user to do.');
         }
-        const intents = deriveIntents(state.workflows?.meta ?? {}, functionsMeta);
-        // Roles are what a persona declares; scopes are what a function checks.
-        // Expanded once, here, from the same definitions the seed grants from.
-        const roleScopes = {};
-        for (const role of flattenSystemRoleDefinitions(state.systemRoles?.definitions ?? [])) {
-            roleScopes[role.name] = role.scopes;
-        }
-        const scopes = personaScopes(persona, roleScopes);
-        // Gated by the same scopes as the RPCs, because an agent is reached rather
-        // than declared: `CoreAIAgent.scopes` is checked against the session, so a
-        // persona finds the specialists its roles unlock and no others.
-        const agents = reachableAgents(state.agents?.agentsMeta ?? {}, scopes);
         const signedIn = createHttpPersonas({
             apiUrl: env.apiUrl,
             secret,
@@ -173,7 +170,8 @@ export const personaRun = pikkuSessionlessFunc({
             apiUrl: env.apiUrl,
             catalogue: catalogueClassification(catalogue),
         })) {
-            logger[level](text);
+            const write = logger[level].bind(logger);
+            write(text);
         }
         if (out) {
             const path = resolve(config.rootDir, out);

package/dist/src/functions/commands/scenario-ladder.js

@@ -49,7 +49,7 @@ export const collectScenarioStepProse = (workflowMeta, functionsMeta) => {
     for (const step of walkScenarioSteps(workflowMeta?.steps)) {
         const stepMeta = functionsMeta[step.stepFunc];
         const parts = {
-            phase: step.phase ?? 'step',
+            phase: step.phase,
             description: step.options?.description ?? stepMeta?.description ?? step.stepName,
             // A call-site description is an explicit override, so it wins over the
             // step's template the same way it wins over its description.

package/dist/src/functions/commands/scenario.js

@@ -484,7 +484,8 @@ export const scenarioRun = pikkuSessionlessFunc({
             trace,
             projectRoot: config.rootDir,
         })) {
-            logger[level](text);
+            const write = logger[level].bind(logger);
+            write(text);
         }
         // How much of the run actually happened on the surface it targeted. Every
         // step counts, so a step that fell back to the server lowers the ratio
@@ -505,7 +506,8 @@ export const scenarioRun = pikkuSessionlessFunc({
                 logger.info(line);
             }
             else {
-                logger[strict ? 'error' : 'warn'](`${line} — asserted server-side only: ${[...unwitnessed].join(', ')}`);
+                const write = logger[strict ? 'error' : 'warn'].bind(logger);
+                write(`${line} — asserted server-side only: ${[...unwitnessed].join(', ')}`);
             }
         }
         const failed = results.filter((r) => r.status === 'failed');

package/dist/src/functions/commands/scopes-shared.d.ts

@@ -33,6 +33,10 @@ export declare const openScopeService: ({ config, logger, }: {
         outDir: string;
         runtimeDir?: string;
         srcDirectories: string[];
+        db?: {
+            schema?: string;
+            defaultSchema?: string;
+        };
     };
     logger: Logger;
 }, declared: FlatScope[], command: string) => Promise<OpenedScopeService | null>;

package/dist/src/functions/commands/scopes-shared.js

@@ -52,7 +52,7 @@ export const openScopeService = async ({ config, logger, }, declared, command) =
     if (!userConfig) {
         return null;
     }
-    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir);
+    const resolved = resolveDb(userConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
     if (!resolved) {
         logger.error(`${command}: no database configured — set sqliteDb or postgresUrl in your createConfig.`);
         throw new Error('no database configured');

package/dist/src/functions/commands/serve.js

@@ -38,7 +38,7 @@ export const serve = pikkuSessionlessFunc({
         const effectiveDbConfig = envDatabaseUrl
             ? parseDatabaseUrl(envDatabaseUrl)
             : userConfig;
-        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir);
+        const resolvedDb = resolveDb(effectiveDbConfig, config.rootDir, config.outDir, config.runtimeDir, config.db);
         const resolvedLocalDb = resolvedDb ?? undefined;
         const kysely = resolvedLocalDb
             ? await createKysely(resolvedLocalDb)

package/dist/src/functions/commands/versions-check.js

@@ -30,7 +30,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     if (error.nextVersion !== undefined) {
                         logger.info(`  Set \`version: ${error.nextVersion}\` on the function, then run:`);
                     }
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else if (error.code === ErrorCode.FUNCTION_VERSION_MODIFIED &&
                     error.functionKey) {
@@ -54,7 +54,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     logger.info(``);
                     logger.info(`  This usually means a merge conflict in versions.pikku.json.`);
                     logger.info(`  Resolve the conflict, then run:`);
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else if (error.code === ErrorCode.VERSION_GAP_NOT_ALLOWED &&
                     error.functionKey) {
@@ -85,7 +85,7 @@ export const pikkuVersionsCheck = pikkuSessionlessFunc({
                     }
                     logger.info(``);
                     logger.info(`  The manifest is corrupted. Run:`);
-                    logger.info(`  npx pikku versions-update`);
+                    logger.info(`  npx pikku versions update`);
                 }
                 else {
                     logger.info(`[${error.code}] ${error.message}`);

package/dist/src/functions/db/annotation-parser.d.ts

@@ -2,6 +2,8 @@ import type { ColumnKind } from './coercion-plugin.js';
 import { type ZodFormat } from './zod-codegen.js';
 type Classification = 'public' | 'private' | 'pii' | 'secret';
 type AnonymizeStrategy = 'fake:email' | 'fake:name' | 'hash' | 'keep' | null;
+type ColumnForm = 'plain' | 'hashed' | 'wrapped' | 'sealed';
+export declare const COLUMN_FORMS: readonly ["plain", "hashed", "wrapped", "sealed"];
 export interface ColAnnotation {
     /** Column kind override: `date`, `bool`, `json`, or `uuid`. */
     kind?: ColumnKind;
@@ -15,6 +17,11 @@ export interface ColAnnotation {
     format?: ZodFormat;
     classification?: Classification;
     anonymize?: AnonymizeStrategy;
+    /**
+     * At-rest representation, independent of `classification`. Drives the
+     * insert/update brand on the generated column type. Absent means `plain`.
+     */
+    form?: ColumnForm;
 }
 /** Per-table, per-column annotation map sourced from `db/annotations.ts`. */
 export type AnnotationMap = Record<string, Record<string, ColAnnotation>>;
@@ -37,6 +44,13 @@ export declare function nameSuggestsKind(colName: string): ColumnKind | null;
  * where `security` is the privacy level and `classification` is the anonymize
  * strategy. Returns `{}` if the sidecar doesn't exist yet (first migrate run,
  * before it has been generated).
+ *
+ * `DbClassificationMap` nests under the schema name whenever the project has
+ * one (`{ app: { user: { email: … } } }`), so the sidecar is flattened back to
+ * bare table names here — the codegen looks columns up by `bareTableName`.
+ * Reading a schema-qualified map as though it were flat silently yields an
+ * annotation for every column of every table, which is how a project could
+ * classify a column `secret` and still generate it as `private`.
  */
 export declare function loadAnnotations(rootDir: string): AnnotationMap;
 export {};

package/dist/src/functions/db/annotation-parser.js

@@ -1,6 +1,12 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { ZOD_FORMATS } from './zod-codegen.js';
+export const COLUMN_FORMS = [
+    'plain',
+    'hashed',
+    'wrapped',
+    'sealed',
+];
 /**
  * Warn-only naming heuristic. We no longer *infer* a column's kind from its
  * name (it produced wrong types — e.g. SQLite stores `*_at` as ISO TEXT, not a
@@ -23,6 +29,17 @@ function parseStrategy(s) {
         ? s
         : null;
 }
+/**
+ * A column entry's own values are all primitives; a table's are objects. That
+ * is the only structural difference between the two levels, and it is what
+ * tells a schema-qualified map (`{ app: { user: { … } } }`) from a bare one
+ * (`{ user: { … } }`) without having to be told which shape was authored.
+ */
+function isColumnEntry(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    return Object.values(value).every((v) => typeof v !== 'object' || v === null);
+}
 /**
  * Load annotations from the `db/annotations.gen.json` sidecar, which is
  * compiled from the developer-authored `db/annotations.ts` (`DbClassificationMap`)
@@ -34,6 +51,13 @@ function parseStrategy(s) {
  * where `security` is the privacy level and `classification` is the anonymize
  * strategy. Returns `{}` if the sidecar doesn't exist yet (first migrate run,
  * before it has been generated).
+ *
+ * `DbClassificationMap` nests under the schema name whenever the project has
+ * one (`{ app: { user: { email: … } } }`), so the sidecar is flattened back to
+ * bare table names here — the codegen looks columns up by `bareTableName`.
+ * Reading a schema-qualified map as though it were flat silently yields an
+ * annotation for every column of every table, which is how a project could
+ * classify a column `secret` and still generate it as `private`.
  */
 export function loadAnnotations(rootDir) {
     const jsonPath = join(rootDir, 'db', 'annotations.gen.json');
@@ -41,8 +65,24 @@ export function loadAnnotations(rootDir) {
         return {};
     try {
         const raw = JSON.parse(readFileSync(jsonPath, 'utf8'));
+        const tables = [];
+        for (const [key, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const isTable = Object.values(value).every((v) => v === null || isColumnEntry(v));
+            if (isTable) {
+                tables.push([key, value]);
+                continue;
+            }
+            // `key` is a schema; its values are the tables.
+            for (const [table, cols] of Object.entries(value)) {
+                if (cols && typeof cols === 'object') {
+                    tables.push([table, cols]);
+                }
+            }
+        }
         const result = {};
-        for (const [table, cols] of Object.entries(raw)) {
+        for (const [table, cols] of tables) {
             result[table] = {};
             for (const [col, ann] of Object.entries(cols)) {
                 if (!ann)
@@ -57,7 +97,9 @@ export function loadAnnotations(rootDir) {
                     entry.tsType = ann.tsType;
                 if (ann.format && ann.format in ZOD_FORMATS)
                     entry.format = ann.format;
-                // `security` is the privacy level. `encrypted` brands as `secret`.
+                // `security` is the privacy level. The legacy `encrypted` value
+                // predates `form` and conflated the two axes; it still parses, as the
+                // pair it always meant.
                 switch (ann.security) {
                     case 'public':
                     case 'private':
@@ -67,8 +109,14 @@ export function loadAnnotations(rootDir) {
                         break;
                     case 'encrypted':
                         entry.classification = 'secret';
+                        entry.form = 'wrapped';
                         break;
                 }
+                // An explicit `form` wins over the one implied by legacy `encrypted`.
+                if (ann.form &&
+                    COLUMN_FORMS.includes(ann.form)) {
+                    entry.form = ann.form;
+                }
                 const strategy = parseStrategy(ann.classification);
                 if (strategy !== null)
                     entry.anonymize = strategy;

package/dist/src/functions/db/better-auth-schema.js

@@ -3,6 +3,7 @@ import { pathToFileURL } from 'node:url';
 import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
 import { join, extname, dirname } from 'node:path';
 import { PIKKU_BETTER_AUTH } from '@pikku/better-auth';
+import { createSecretValue } from '@pikku/core';
 import { LocalVariablesService } from '@pikku/core/services';
 import { loadUserModule } from '../commands/load-user-project.js';
 let cachedGetMigrations = null;
@@ -95,7 +96,7 @@ async function loadAuthFactory(sourceFile) {
 function fakeSecretService() {
     const placeholder = 'schema-introspection-only';
     return {
-        getSecret: async () => placeholder,
+        getSecret: async () => createSecretValue(placeholder),
         hasSecret: async () => true,
         setSecret: async () => { },
     };

package/dist/src/functions/db/db-codegen.d.ts

@@ -16,6 +16,18 @@ export interface CodegenOptions {
      */
     enumsFile?: string;
     camelCase?: boolean;
+    /**
+     * Schema whose qualifier is dropped from the `DB` keys and the interface
+     * names, so `app.user` reads as `user`/`User` rather than `app.user`/
+     * `AppUser`. Tables in any other schema stay fully qualified. Omitting it
+     * qualifies everything, which is the safe default for a project spanning
+     * schemas.
+     *
+     * The key IS what Kysely puts in the SQL, so only set this for a schema the
+     * connection's `search_path` resolves — otherwise every query compiles and
+     * then fails to find the table at runtime.
+     */
+    defaultSchema?: string;
     rootDir?: string;
     /** DB dialect — drives real-type-aware date typing. Defaults to 'sqlite'. */
     dialect?: Dialect;