@pikku/kysely 0.13.18 → 0.13.20

package/CHANGELOG.md

@@ -1,3 +1,80 @@
+## 0.13.20
+
+### Patch Changes
+
+- 274cab3: The singleton intersection moves to the leaves that name it, the runtime stops
+  creating schema, and `db generate` writes only the runtime tables a project's
+  services own
+
+  `WiredSingletonServices` was exported from the generated function leaf so the
+  auth leaf could import it. Nothing outside a generated leaf ever names it —
+  emit declarations for a project of any size and it appears in none of them —
+  so the auth and middleware leaves derive the intersection themselves and the
+  function leaf keeps it private. `WiredServices` stays exported: 147 `.d.ts`
+  files name it, and unexporting it asks every wired module to name each member
+  service through a specifier it does not have.
+
+  `ensurePikkuSchema` is gone. `requirePikkuSchema` replaces it: a service calls
+  it at boot, it looks, and it issues no DDL at all. `pikku db generate` writes
+  the declaration down as a migration and `pikku db migrate` applies it, and
+  those two are now the only way pikku's runtime tables come into existence. A
+  service that finds them missing says so and stops, naming both commands.
+  Half-present is no longer a distinct case — the remedy is the same migration
+  either way. `audit` and `virtual-user` join `pikkuSchemas` as a consequence:
+  boot was the only thing that had ever created them.
+
+  `pikku db generate` applied all of `pikkuSchemas`, so a project with no agents,
+  no channels and no workflows still had `agent_threads`, `channels` and
+  `workflow_runs` written into its migrations, and then carried them forever. A
+  schema now names the services that own it, and generation gates on
+  `requiredServices` — the set the inspector already builds for service
+  tree-shaking. The gate is one-sided: a schema that names no owner is always
+  written, because the session and secret stores and the deployment record are
+  reached by the runtime itself and nothing in a project's source implies them.
+  Declared scopes now imply `scopeService`, which nothing destructures because
+  the generated auth layer is what reaches it.
+
+  Drift keeps asking the unscoped question. A table already in a database has to
+  stay recognisable as a runtime table after the service that needed it is
+  dropped — scoping it there would report those tables as unexplained.
+
+  Every project in this repo that had been relying on boot-time creation now says
+  where its tables come from. `createConfig` moves into its own `config.ts` in the
+  templates — `pikku db` looks for it there — and the three postgres templates plus
+  the workflow verifier declare `postgresUrl` and run `pikku db generate && pikku
+db migrate` before the server starts, from the single connection string their
+  runtime opens. The e2e harness cannot: its databases are in-memory sqlite built
+  inside the services factory, so nothing outside the process can migrate them. It
+  applies the schemas it owns with `applyPikkuSchemas` instead — the same DDL, run
+  by the one process that has the database.
+
+- Updated dependencies [32616af]
+- Updated dependencies [6848cd9]
+  - @pikku/core@0.12.89
+
+## 0.13.19
+
+### Patch Changes
+
+- 2d21628: fix(kysely): claim a workflow step atomically in every SQL dialect
+
+  The workflow engine's "atomic claim" was a read-then-write guarded by
+  `withStepLock`, and `@pikku/kysely` inherited a silent pass-through for that
+  lock — so on every dialect but Postgres and MySQL a redelivered queue job could
+  claim a step another dispatch was already running, executing a side-effecting
+  step twice.
+
+  `@pikku/kysely` now claims the step with a status-guarded `UPDATE` and reads the
+  affected-row count, which is atomic in every SQL dialect without an
+  advisory-lock primitive. Relay redispatch is enabled for all Kysely dialects as
+  a result, not just Postgres and MySQL.
+
+- Updated dependencies [9687ad1]
+- Updated dependencies [2d21628]
+- Updated dependencies [985b87b]
+- Updated dependencies [3a83f85]
+  - @pikku/core@0.12.87
+
 ## 0.13.18
 
 ### Patch Changes

package/dist/src/index.d.ts

@@ -17,7 +17,7 @@ export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
 export { createCoercionPlugin, type ColumnKind, type CoercionMap, type CreateCoercionPluginOptions, } from './coercion-plugin.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, type EnsureOutcome, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
+export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/agent';

package/dist/src/index.js

@@ -17,4 +17,4 @@ export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
 export { createCoercionPlugin, } from './coercion-plugin.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, resolveRequirements, } from './schema/index.js';
+export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, } from './schema/index.js';

package/dist/src/kysely-agent-run-state-service.js

@@ -1,5 +1,5 @@
 import { sql } from 'kysely';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { agentSchema } from './schema/agent.schema.js';
 import { getRunScores, saveRunScore } from './kysely-agent-run-scores.js';
 export class KyselyAgentRunStateService {
@@ -11,7 +11,7 @@ export class KyselyAgentRunStateService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, agentSchema);
+        await requirePikkuSchema(this.db, agentSchema);
         this.initialized = true;
     }
     async createRun(run) {

package/dist/src/kysely-agent-storage-service.js

@@ -1,6 +1,6 @@
 import { parseJson } from './kysely-json.js';
 import { getRunScores, saveRunScore } from './kysely-agent-run-scores.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { agentSchema } from './schema/agent.schema.js';
 export class KyselyAgentStorageService {
     db;
@@ -11,7 +11,7 @@ export class KyselyAgentStorageService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, agentSchema);
+        await requirePikkuSchema(this.db, agentSchema);
         this.initialized = true;
     }
     async createThread(resourceId, options) {

package/dist/src/kysely-audit-service.js

@@ -1,4 +1,4 @@
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { auditSchema } from './schema/audit.schema.js';
 const jsonOrNull = (v) => v != null ? JSON.stringify(v) : null;
 const parseJson = (v) => {
@@ -90,7 +90,7 @@ export class KyselyAuditService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, auditSchema);
+        await requirePikkuSchema(this.db, auditSchema);
         this.initialized = true;
     }
     async audit(event) {

package/dist/src/kysely-channel-store.js

@@ -1,6 +1,6 @@
 import { ChannelStore } from '@pikku/core/channel';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { channelSchema } from './schema/channel.schema.js';
 export class KyselyChannelStore extends ChannelStore {
     db;
@@ -12,7 +12,7 @@ export class KyselyChannelStore extends ChannelStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, channelSchema);
+        await requirePikkuSchema(this.db, channelSchema);
         this.initialized = true;
     }
     async addChannel({ channelId, channelName, openingData, }) {

package/dist/src/kysely-credential-service.js

@@ -1,5 +1,5 @@
 import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { credentialSchema } from './schema/credential.schema.js';
 export class KyselyCredentialService {
     db;
@@ -22,7 +22,7 @@ export class KyselyCredentialService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, credentialSchema);
+        await requirePikkuSchema(this.db, credentialSchema);
         this.initialized = true;
     }
     async logAudit(name, userId, action) {

package/dist/src/kysely-deployment-service.js

@@ -1,6 +1,6 @@
 import { buildRemoteHeaders } from '@pikku/core/remote';
 import { getAllFunctionNames } from '@pikku/core/function';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { deploymentSchema } from './schema/deployment.schema.js';
 export class KyselyDeploymentService {
     db;
@@ -21,7 +21,7 @@ export class KyselyDeploymentService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, deploymentSchema);
+        await requirePikkuSchema(this.db, deploymentSchema);
         this.initialized = true;
     }
     async start(config) {

package/dist/src/kysely-scope-service.js

@@ -1,5 +1,5 @@
 import { SystemRoleImmutableError, SystemRoleShadowedError, } from '@pikku/core/errors';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { scopeSchema } from './schema/scope.schema.js';
 /**
  * Resolves and administers user scopes against four self-created tables.
@@ -22,7 +22,7 @@ export class KyselyScopeService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, scopeSchema);
+        await requirePikkuSchema(this.db, scopeSchema);
         this.initialized = true;
     }
     /**

package/dist/src/kysely-secret-service.js

@@ -1,6 +1,6 @@
 import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
 import { createSecretValue, isSecretValue } from '@pikku/core/classification';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { secretSchema } from './schema/secret.schema.js';
 export class KyselySecretService {
     db;
@@ -23,7 +23,7 @@ export class KyselySecretService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, secretSchema);
+        await requirePikkuSchema(this.db, secretSchema);
         this.initialized = true;
     }
     async logAudit(secretKey, action) {

package/dist/src/kysely-session-store.js

@@ -1,5 +1,5 @@
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { sessionSchema } from './schema/session.schema.js';
 export class KyselySessionStore {
     db;
@@ -10,7 +10,7 @@ export class KyselySessionStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, sessionSchema);
+        await requirePikkuSchema(this.db, sessionSchema);
         this.initialized = true;
     }
     async get(pikkuUserId) {

package/dist/src/kysely-tables.d.ts

@@ -289,6 +289,33 @@ export interface VirtualUserRunTable {
     createdAt: Generated<Date | string>;
     finishedAt: Date | string | null;
 }
+/**
+ * One audit event. Every column is text on every engine so a locally-run
+ * project and a deployed stage write rows the same reader can read; the JSON
+ * columns (`tables`, `changedCols`, `event`, `old`, `data`) are serialised by
+ * {@link KyselyAuditService} rather than by a plugin.
+ */
+export interface AuditTable {
+    auditId: string;
+    /** ISO 8601, because string ordering is chronological ordering. */
+    occurredAt: string;
+    type: string;
+    source: Generated<string>;
+    outcome: string | null;
+    functionId: string | null;
+    wireType: string | null;
+    traceId: string | null;
+    transactionId: string | null;
+    queryId: string | null;
+    userId: string | null;
+    orgId: string | null;
+    pikkuUserId: string | null;
+    tables: string | null;
+    changedCols: string | null;
+    event: string | null;
+    old: string | null;
+    data: string | null;
+}
 export interface KyselyPikkuDB {
     pikkuScopes: PikkuScopesTable;
     pikkuRoles: PikkuRolesTable;
@@ -319,4 +346,5 @@ export interface KyselyPikkuDB {
     webhookDelivery: WebhookDeliveryTable;
     webhookDeliveryAttempt: WebhookDeliveryAttemptTable;
     virtualUserRun: VirtualUserRunTable;
+    audit: AuditTable;
 }

package/dist/src/kysely-virtual-user-run-store.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { virtualUserSchema } from './schema/virtual-user.schema.js';
 /**
  * Records virtual-user runs in a `virtualUserRun` table.
@@ -35,7 +35,7 @@ export class KyselyVirtualUserRunStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, virtualUserSchema);
+        await requirePikkuSchema(this.db, virtualUserSchema);
         this.initialized = true;
     }
     async start(run) {

package/dist/src/kysely-webhook-service.js

@@ -1,6 +1,6 @@
 import { QueueWebhookService } from '@pikku/core/services';
 import { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, } from '@pikku/core/services';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { webhookSchema } from './schema/webhook.schema.js';
 /**
  * Durable {@link QueueWebhookService}: still delivers through the
@@ -19,7 +19,7 @@ export class KyselyWebhookService extends QueueWebhookService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, webhookSchema);
+        await requirePikkuSchema(this.db, webhookSchema);
         this.initialized = true;
     }
     async send(input) {

package/dist/src/kysely-workflow-mirror.d.ts

@@ -22,7 +22,7 @@ export declare class KyselyWorkflowMirror implements WorkflowRunMirror {
      * Create the underlying tables if none of them exist yet.
      *
      * Safe to call from either the mirror or `KyselyWorkflowService.init()` —
-     * both apply the same `workflowSchema`, and `ensurePikkuSchema` is a no-op
+     * both apply the same `workflowSchema`, and `requirePikkuSchema` is a no-op
      * once the tables are there. A database holding only *part* of the schema
      * throws rather than filling in the rest: something else owns those tables,
      * and boot is not where that gets reconciled.

package/dist/src/kysely-workflow-mirror.js

@@ -1,4 +1,4 @@
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { workflowSchema } from './schema/workflow.schema.js';
 /**
  * Kysely-backed `WorkflowRunMirror`.
@@ -22,7 +22,7 @@ export class KyselyWorkflowMirror {
      * Create the underlying tables if none of them exist yet.
      *
      * Safe to call from either the mirror or `KyselyWorkflowService.init()` —
-     * both apply the same `workflowSchema`, and `ensurePikkuSchema` is a no-op
+     * both apply the same `workflowSchema`, and `requirePikkuSchema` is a no-op
      * once the tables are there. A database holding only *part* of the schema
      * throws rather than filling in the rest: something else owns those tables,
      * and boot is not where that gets reconciled.
@@ -30,7 +30,7 @@ export class KyselyWorkflowMirror {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, workflowSchema);
+        await requirePikkuSchema(this.db, workflowSchema);
         this.initialized = true;
     }
     async createRun(runId, workflowName, input, inline, graphHash, wire, options) {

package/dist/src/kysely-workflow-service.d.ts

@@ -47,7 +47,36 @@ export declare class KyselyWorkflowService extends PikkuWorkflowService {
     protected setStepErrorImpl(stepId: string, error: Error): Promise<void>;
     protected createRetryAttemptImpl(stepId: string, status: 'pending' | 'running'): Promise<StepState>;
     withRunLock<T>(_id: string, fn: () => Promise<T>): Promise<T>;
+    /**
+     * A pass-through, and deliberately so: the one decision that must exclude —
+     * claiming a step to execute it — is made by `claimStepForExecution` below as
+     * a single conditional write, which needs no lock to be exclusive.
+     *
+     * What is left are the suspend and approval sections in the engine, where the
+     * lock is genuine mutual exclusion rather than a claim. A dialect with a real
+     * primitive overrides this to cover them — `kysely-postgres` with
+     * `pg_advisory_xact_lock`, `kysely-mysql` with `GET_LOCK`.
+     */
     withStepLock<T>(_runId: string, _stepName: string, fn: () => Promise<T>): Promise<T>;
+    /**
+     * Claim the step with a status-guarded `UPDATE` and read the affected-row
+     * count: the database decides the winner in one statement, so two dispatches
+     * racing for the same step cannot both proceed.
+     *
+     * This replaces the read-then-write the base engine does under `withStepLock`,
+     * which is only as exclusive as that lock — and every dialect but Postgres and
+     * MySQL inherits a pass-through. A conditional update needs no advisory-lock
+     * primitive, so every SQL dialect gets the same guarantee.
+     *
+     * The winner then goes through the ordinary transition methods, so history
+     * rows and the mirror see exactly what they saw before.
+     */
+    protected claimStepForExecution(runId: string, stepName: string, rpcName: string): Promise<StepState | null>;
+    /**
+     * Move a step to `running` only if it is still in one of `from`, reporting
+     * whether this caller is the one that moved it.
+     */
+    private claimStepStatus;
     getCompletedGraphState(runId: string): Promise<{
         completedNodeIds: string[];
         failedNodeIds: string[];
@@ -81,16 +110,18 @@ export declare class KyselyWorkflowService extends PikkuWorkflowService {
     private jsonPathFor;
     protected updateRunStateImpl(runId: string, name: string, value: unknown): Promise<void>;
     /**
-     * The undispatched-step query, shared by the dialects that can safely relay.
+     * The undispatched-step query, shared by every dialect.
      *
-     * Deliberately NOT an override of `findUndispatchedSteps`: this class's
-     * `withStepLock` is a pass-through, so a subclass inheriting it (kysely-sqlite)
-     * has no atomic claim, and the relay's redundant dispatches would become
-     * double executions. A dialect opts in by overriding `findUndispatchedSteps`
-     * to call this — which `kysely-postgres` and `kysely-mysql` do, having real
-     * locks.
+     * It used to be deliberately NOT an override, because this class's
+     * `withStepLock` is a pass-through: a subclass inheriting it (kysely-sqlite)
+     * had no atomic claim, so the relay's redundant dispatches would have become
+     * double executions, and only `kysely-postgres` and `kysely-mysql` opted in
+     * on the strength of their real locks. `claimStepForExecution` no longer
+     * needs that lock — the claim is a status-guarded `UPDATE`, atomic in every
+     * dialect — so the relay is safe here for all of them and the override lives
+     * in the base.
      */
-    protected queryUndispatchedSteps(before: Date, limit: number): Promise<Array<{
+    protected findUndispatchedSteps(before: Date, limit: number): Promise<Array<{
         runId: string;
         stepId: string;
     }>>;

package/dist/src/kysely-workflow-service.js

@@ -1,8 +1,8 @@
-import { PikkuWorkflowService } from '@pikku/core/workflow';
+import { PikkuWorkflowService, WorkflowStepFunctionMismatchError, } from '@pikku/core/workflow';
 import { sql } from 'kysely';
 import { KyselyWorkflowRunService } from './kysely-workflow-run-service.js';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { workflowSchema } from './schema/workflow.schema.js';
 export class KyselyWorkflowService extends PikkuWorkflowService {
     db;
@@ -16,7 +16,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, workflowSchema);
+        await requirePikkuSchema(this.db, workflowSchema);
         this.initialized = true;
     }
     async createRunImpl(workflowName, input, inline, graphHash, wire, options) {
@@ -363,9 +363,73 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     async withRunLock(_id, fn) {
         return fn();
     }
+    /**
+     * A pass-through, and deliberately so: the one decision that must exclude —
+     * claiming a step to execute it — is made by `claimStepForExecution` below as
+     * a single conditional write, which needs no lock to be exclusive.
+     *
+     * What is left are the suspend and approval sections in the engine, where the
+     * lock is genuine mutual exclusion rather than a claim. A dialect with a real
+     * primitive overrides this to cover them — `kysely-postgres` with
+     * `pg_advisory_xact_lock`, `kysely-mysql` with `GET_LOCK`.
+     */
     async withStepLock(_runId, _stepName, fn) {
         return fn();
     }
+    /**
+     * Claim the step with a status-guarded `UPDATE` and read the affected-row
+     * count: the database decides the winner in one statement, so two dispatches
+     * racing for the same step cannot both proceed.
+     *
+     * This replaces the read-then-write the base engine does under `withStepLock`,
+     * which is only as exclusive as that lock — and every dialect but Postgres and
+     * MySQL inherits a pass-through. A conditional update needs no advisory-lock
+     * primitive, so every SQL dialect gets the same guarantee.
+     *
+     * The winner then goes through the ordinary transition methods, so history
+     * rows and the mirror see exactly what they saw before.
+     */
+    async claimStepForExecution(runId, stepName, rpcName) {
+        const stepState = await this.getStepState(runId, stepName);
+        // knowledge: decisions/security/a-step-runs-the-function-the-workflow-dispatched-it-with.md
+        if (stepState.rpcName !== undefined &&
+            stepState.rpcName !== (rpcName ?? null)) {
+            throw new WorkflowStepFunctionMismatchError(runId, stepName);
+        }
+        if (stepState.status === 'succeeded' || stepState.status === 'running') {
+            return null;
+        }
+        if (stepState.status === 'failed') {
+            if (!(await this.claimStepStatus(stepState.stepId, ['failed']))) {
+                return null;
+            }
+            return this.createRetryAttempt(stepState.stepId, 'running');
+        }
+        if (stepState.status === 'pending' || stepState.status === 'scheduled') {
+            if (!(await this.claimStepStatus(stepState.stepId, [
+                'pending',
+                'scheduled',
+            ]))) {
+                return null;
+            }
+            await this.setStepRunning(stepState.stepId);
+            return { ...stepState, status: 'running' };
+        }
+        return stepState;
+    }
+    /**
+     * Move a step to `running` only if it is still in one of `from`, reporting
+     * whether this caller is the one that moved it.
+     */
+    async claimStepStatus(stepId, from) {
+        const claimed = await this.db
+            .updateTable('workflowStep')
+            .set({ status: 'running', updatedAt: new Date() })
+            .where('workflowStepId', '=', stepId)
+            .where('status', 'in', from)
+            .executeTakeFirst();
+        return Number(claimed?.numUpdatedRows ?? 0n) > 0;
+    }
     async getCompletedGraphState(runId) {
         const results = await this.db
             .selectFrom('workflowStep as ws')
@@ -470,16 +534,18 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
             .execute();
     }
     /**
-     * The undispatched-step query, shared by the dialects that can safely relay.
+     * The undispatched-step query, shared by every dialect.
      *
-     * Deliberately NOT an override of `findUndispatchedSteps`: this class's
-     * `withStepLock` is a pass-through, so a subclass inheriting it (kysely-sqlite)
-     * has no atomic claim, and the relay's redundant dispatches would become
-     * double executions. A dialect opts in by overriding `findUndispatchedSteps`
-     * to call this — which `kysely-postgres` and `kysely-mysql` do, having real
-     * locks.
+     * It used to be deliberately NOT an override, because this class's
+     * `withStepLock` is a pass-through: a subclass inheriting it (kysely-sqlite)
+     * had no atomic claim, so the relay's redundant dispatches would have become
+     * double executions, and only `kysely-postgres` and `kysely-mysql` opted in
+     * on the strength of their real locks. `claimStepForExecution` no longer
+     * needs that lock — the claim is a status-guarded `UPDATE`, atomic in every
+     * dialect — so the relay is safe here for all of them and the override lives
+     * in the base.
      */
-    async queryUndispatchedSteps(before, limit) {
+    async findUndispatchedSteps(before, limit) {
         const rows = await this.db
             .selectFrom('workflowStep as s')
             .innerJoin('workflowRuns as r', 'r.workflowRunId', 's.workflowRunId')

package/dist/src/schema/agent.schema.js

@@ -11,6 +11,7 @@ import { sql } from 'kysely';
  */
 export const agentSchema = {
     name: 'agent',
+    ownedBy: ['agentStorage', 'agentRunState', 'agentRunService'],
     statements: [
         (db) => db.schema
             .createTable('agentThreads')

package/dist/src/schema/audit.schema.d.ts

@@ -2,10 +2,11 @@ import type { PikkuSchema } from './pikku-schema.types.js';
 /**
  * The `audit` table {@link KyselyAuditService} writes to and reads back.
  *
- * Deliberately not in `pikkuSchemas`: the runtime never needs this table, only
- * a project that has wired a durable audit sink does, and creating it for
- * everyone would put an empty table in every database. `KyselyAuditService.init()`
- * applies it, so it arrives exactly when the sink that fills it does.
+ * Gated by `ownedBy` rather than written for everyone: only a project that has
+ * wired a durable audit sink needs this table, and generating it for the rest
+ * would put an empty table in every database. `KyselyAuditService.init()`
+ * requires it and never creates it, so it arrives with the migration `pikku db
+ * generate` writes for the sink that fills it.
  *
  * Every column is text on every engine, matching the platform audit-queue
  * consumer's row shape — a locally-run project and a deployed stage write rows

package/dist/src/schema/audit.schema.js

@@ -1,10 +1,11 @@
 /**
  * The `audit` table {@link KyselyAuditService} writes to and reads back.
  *
- * Deliberately not in `pikkuSchemas`: the runtime never needs this table, only
- * a project that has wired a durable audit sink does, and creating it for
- * everyone would put an empty table in every database. `KyselyAuditService.init()`
- * applies it, so it arrives exactly when the sink that fills it does.
+ * Gated by `ownedBy` rather than written for everyone: only a project that has
+ * wired a durable audit sink needs this table, and generating it for the rest
+ * would put an empty table in every database. `KyselyAuditService.init()`
+ * requires it and never creates it, so it arrives with the migration `pikku db
+ * generate` writes for the sink that fills it.
  *
  * Every column is text on every engine, matching the platform audit-queue
  * consumer's row shape — a locally-run project and a deployed stage write rows
@@ -14,6 +15,7 @@
  */
 export const auditSchema = {
     name: 'audit',
+    ownedBy: ['audit', 'auditLog'],
     statements: [
         (db) => db.schema
             .createTable('audit')

package/dist/src/schema/channel.schema.js

@@ -2,6 +2,7 @@ import { sql } from 'kysely';
 /** Channels and their topic subscriptions, also read by the event-hub store. */
 export const channelSchema = {
     name: 'channel',
+    ownedBy: ['channelStore', 'eventHub'],
     statements: [
         (db) => db.schema
             .createTable('channels')

package/dist/src/schema/credential.schema.js

@@ -12,6 +12,7 @@ import { rawStatement } from './pikku-schema.types.js';
  */
 export const credentialSchema = {
     name: 'credential',
+    ownedBy: ['credentialService'],
     statements: [
         (db) => db.schema
             .createTable('credentials')