@pikku/kysely 0.13.19 → 0.13.20

package/CHANGELOG.md

@@ -1,3 +1,57 @@
+## 0.13.20
+
+### Patch Changes
+
+- 274cab3: The singleton intersection moves to the leaves that name it, the runtime stops
+  creating schema, and `db generate` writes only the runtime tables a project's
+  services own
+
+  `WiredSingletonServices` was exported from the generated function leaf so the
+  auth leaf could import it. Nothing outside a generated leaf ever names it —
+  emit declarations for a project of any size and it appears in none of them —
+  so the auth and middleware leaves derive the intersection themselves and the
+  function leaf keeps it private. `WiredServices` stays exported: 147 `.d.ts`
+  files name it, and unexporting it asks every wired module to name each member
+  service through a specifier it does not have.
+
+  `ensurePikkuSchema` is gone. `requirePikkuSchema` replaces it: a service calls
+  it at boot, it looks, and it issues no DDL at all. `pikku db generate` writes
+  the declaration down as a migration and `pikku db migrate` applies it, and
+  those two are now the only way pikku's runtime tables come into existence. A
+  service that finds them missing says so and stops, naming both commands.
+  Half-present is no longer a distinct case — the remedy is the same migration
+  either way. `audit` and `virtual-user` join `pikkuSchemas` as a consequence:
+  boot was the only thing that had ever created them.
+
+  `pikku db generate` applied all of `pikkuSchemas`, so a project with no agents,
+  no channels and no workflows still had `agent_threads`, `channels` and
+  `workflow_runs` written into its migrations, and then carried them forever. A
+  schema now names the services that own it, and generation gates on
+  `requiredServices` — the set the inspector already builds for service
+  tree-shaking. The gate is one-sided: a schema that names no owner is always
+  written, because the session and secret stores and the deployment record are
+  reached by the runtime itself and nothing in a project's source implies them.
+  Declared scopes now imply `scopeService`, which nothing destructures because
+  the generated auth layer is what reaches it.
+
+  Drift keeps asking the unscoped question. A table already in a database has to
+  stay recognisable as a runtime table after the service that needed it is
+  dropped — scoping it there would report those tables as unexplained.
+
+  Every project in this repo that had been relying on boot-time creation now says
+  where its tables come from. `createConfig` moves into its own `config.ts` in the
+  templates — `pikku db` looks for it there — and the three postgres templates plus
+  the workflow verifier declare `postgresUrl` and run `pikku db generate && pikku
+db migrate` before the server starts, from the single connection string their
+  runtime opens. The e2e harness cannot: its databases are in-memory sqlite built
+  inside the services factory, so nothing outside the process can migrate them. It
+  applies the schemas it owns with `applyPikkuSchemas` instead — the same DDL, run
+  by the one process that has the database.
+
+- Updated dependencies [32616af]
+- Updated dependencies [6848cd9]
+  - @pikku/core@0.12.89
+
 ## 0.13.19
 
 ### Patch Changes

package/dist/src/index.d.ts

@@ -17,7 +17,7 @@ export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
 export { createCoercionPlugin, type ColumnKind, type CoercionMap, type CreateCoercionPluginOptions, } from './coercion-plugin.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, type EnsureOutcome, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
+export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/agent';

package/dist/src/index.js

@@ -17,4 +17,4 @@ export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { SerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
 export { createCoercionPlugin, } from './coercion-plugin.js';
-export { auditSchema, pikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, ensurePikkuSchema, resolveRequirements, } from './schema/index.js';
+export { agentSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, } from './schema/index.js';

package/dist/src/kysely-agent-run-state-service.js

@@ -1,5 +1,5 @@
 import { sql } from 'kysely';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { agentSchema } from './schema/agent.schema.js';
 import { getRunScores, saveRunScore } from './kysely-agent-run-scores.js';
 export class KyselyAgentRunStateService {
@@ -11,7 +11,7 @@ export class KyselyAgentRunStateService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, agentSchema);
+        await requirePikkuSchema(this.db, agentSchema);
         this.initialized = true;
     }
     async createRun(run) {

package/dist/src/kysely-agent-storage-service.js

@@ -1,6 +1,6 @@
 import { parseJson } from './kysely-json.js';
 import { getRunScores, saveRunScore } from './kysely-agent-run-scores.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { agentSchema } from './schema/agent.schema.js';
 export class KyselyAgentStorageService {
     db;
@@ -11,7 +11,7 @@ export class KyselyAgentStorageService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, agentSchema);
+        await requirePikkuSchema(this.db, agentSchema);
         this.initialized = true;
     }
     async createThread(resourceId, options) {

package/dist/src/kysely-audit-service.js

@@ -1,4 +1,4 @@
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { auditSchema } from './schema/audit.schema.js';
 const jsonOrNull = (v) => v != null ? JSON.stringify(v) : null;
 const parseJson = (v) => {
@@ -90,7 +90,7 @@ export class KyselyAuditService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, auditSchema);
+        await requirePikkuSchema(this.db, auditSchema);
         this.initialized = true;
     }
     async audit(event) {

package/dist/src/kysely-channel-store.js

@@ -1,6 +1,6 @@
 import { ChannelStore } from '@pikku/core/channel';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { channelSchema } from './schema/channel.schema.js';
 export class KyselyChannelStore extends ChannelStore {
     db;
@@ -12,7 +12,7 @@ export class KyselyChannelStore extends ChannelStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, channelSchema);
+        await requirePikkuSchema(this.db, channelSchema);
         this.initialized = true;
     }
     async addChannel({ channelId, channelName, openingData, }) {

package/dist/src/kysely-credential-service.js

@@ -1,5 +1,5 @@
 import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { credentialSchema } from './schema/credential.schema.js';
 export class KyselyCredentialService {
     db;
@@ -22,7 +22,7 @@ export class KyselyCredentialService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, credentialSchema);
+        await requirePikkuSchema(this.db, credentialSchema);
         this.initialized = true;
     }
     async logAudit(name, userId, action) {

package/dist/src/kysely-deployment-service.js

@@ -1,6 +1,6 @@
 import { buildRemoteHeaders } from '@pikku/core/remote';
 import { getAllFunctionNames } from '@pikku/core/function';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { deploymentSchema } from './schema/deployment.schema.js';
 export class KyselyDeploymentService {
     db;
@@ -21,7 +21,7 @@ export class KyselyDeploymentService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, deploymentSchema);
+        await requirePikkuSchema(this.db, deploymentSchema);
         this.initialized = true;
     }
     async start(config) {

package/dist/src/kysely-scope-service.js

@@ -1,5 +1,5 @@
 import { SystemRoleImmutableError, SystemRoleShadowedError, } from '@pikku/core/errors';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { scopeSchema } from './schema/scope.schema.js';
 /**
  * Resolves and administers user scopes against four self-created tables.
@@ -22,7 +22,7 @@ export class KyselyScopeService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, scopeSchema);
+        await requirePikkuSchema(this.db, scopeSchema);
         this.initialized = true;
     }
     /**

package/dist/src/kysely-secret-service.js

@@ -1,6 +1,6 @@
 import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
 import { createSecretValue, isSecretValue } from '@pikku/core/classification';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { secretSchema } from './schema/secret.schema.js';
 export class KyselySecretService {
     db;
@@ -23,7 +23,7 @@ export class KyselySecretService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, secretSchema);
+        await requirePikkuSchema(this.db, secretSchema);
         this.initialized = true;
     }
     async logAudit(secretKey, action) {

package/dist/src/kysely-session-store.js

@@ -1,5 +1,5 @@
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { sessionSchema } from './schema/session.schema.js';
 export class KyselySessionStore {
     db;
@@ -10,7 +10,7 @@ export class KyselySessionStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, sessionSchema);
+        await requirePikkuSchema(this.db, sessionSchema);
         this.initialized = true;
     }
     async get(pikkuUserId) {

package/dist/src/kysely-tables.d.ts

@@ -289,6 +289,33 @@ export interface VirtualUserRunTable {
     createdAt: Generated<Date | string>;
     finishedAt: Date | string | null;
 }
+/**
+ * One audit event. Every column is text on every engine so a locally-run
+ * project and a deployed stage write rows the same reader can read; the JSON
+ * columns (`tables`, `changedCols`, `event`, `old`, `data`) are serialised by
+ * {@link KyselyAuditService} rather than by a plugin.
+ */
+export interface AuditTable {
+    auditId: string;
+    /** ISO 8601, because string ordering is chronological ordering. */
+    occurredAt: string;
+    type: string;
+    source: Generated<string>;
+    outcome: string | null;
+    functionId: string | null;
+    wireType: string | null;
+    traceId: string | null;
+    transactionId: string | null;
+    queryId: string | null;
+    userId: string | null;
+    orgId: string | null;
+    pikkuUserId: string | null;
+    tables: string | null;
+    changedCols: string | null;
+    event: string | null;
+    old: string | null;
+    data: string | null;
+}
 export interface KyselyPikkuDB {
     pikkuScopes: PikkuScopesTable;
     pikkuRoles: PikkuRolesTable;
@@ -319,4 +346,5 @@ export interface KyselyPikkuDB {
     webhookDelivery: WebhookDeliveryTable;
     webhookDeliveryAttempt: WebhookDeliveryAttemptTable;
     virtualUserRun: VirtualUserRunTable;
+    audit: AuditTable;
 }

package/dist/src/kysely-virtual-user-run-store.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { virtualUserSchema } from './schema/virtual-user.schema.js';
 /**
  * Records virtual-user runs in a `virtualUserRun` table.
@@ -35,7 +35,7 @@ export class KyselyVirtualUserRunStore {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, virtualUserSchema);
+        await requirePikkuSchema(this.db, virtualUserSchema);
         this.initialized = true;
     }
     async start(run) {

package/dist/src/kysely-webhook-service.js

@@ -1,6 +1,6 @@
 import { QueueWebhookService } from '@pikku/core/services';
 import { PIKKU_OUTGOING_WEBHOOK_QUEUE_NAME, } from '@pikku/core/services';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { webhookSchema } from './schema/webhook.schema.js';
 /**
  * Durable {@link QueueWebhookService}: still delivers through the
@@ -19,7 +19,7 @@ export class KyselyWebhookService extends QueueWebhookService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, webhookSchema);
+        await requirePikkuSchema(this.db, webhookSchema);
         this.initialized = true;
     }
     async send(input) {

package/dist/src/kysely-workflow-mirror.d.ts

@@ -22,7 +22,7 @@ export declare class KyselyWorkflowMirror implements WorkflowRunMirror {
      * Create the underlying tables if none of them exist yet.
      *
      * Safe to call from either the mirror or `KyselyWorkflowService.init()` —
-     * both apply the same `workflowSchema`, and `ensurePikkuSchema` is a no-op
+     * both apply the same `workflowSchema`, and `requirePikkuSchema` is a no-op
      * once the tables are there. A database holding only *part* of the schema
      * throws rather than filling in the rest: something else owns those tables,
      * and boot is not where that gets reconciled.

package/dist/src/kysely-workflow-mirror.js

@@ -1,4 +1,4 @@
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { workflowSchema } from './schema/workflow.schema.js';
 /**
  * Kysely-backed `WorkflowRunMirror`.
@@ -22,7 +22,7 @@ export class KyselyWorkflowMirror {
      * Create the underlying tables if none of them exist yet.
      *
      * Safe to call from either the mirror or `KyselyWorkflowService.init()` —
-     * both apply the same `workflowSchema`, and `ensurePikkuSchema` is a no-op
+     * both apply the same `workflowSchema`, and `requirePikkuSchema` is a no-op
      * once the tables are there. A database holding only *part* of the schema
      * throws rather than filling in the rest: something else owns those tables,
      * and boot is not where that gets reconciled.
@@ -30,7 +30,7 @@ export class KyselyWorkflowMirror {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, workflowSchema);
+        await requirePikkuSchema(this.db, workflowSchema);
         this.initialized = true;
     }
     async createRun(runId, workflowName, input, inline, graphHash, wire, options) {

package/dist/src/kysely-workflow-service.js

@@ -2,7 +2,7 @@ import { PikkuWorkflowService, WorkflowStepFunctionMismatchError, } from '@pikku
 import { sql } from 'kysely';
 import { KyselyWorkflowRunService } from './kysely-workflow-run-service.js';
 import { parseJson } from './kysely-json.js';
-import { ensurePikkuSchema } from './schema/index.js';
+import { requirePikkuSchema } from './schema/index.js';
 import { workflowSchema } from './schema/workflow.schema.js';
 export class KyselyWorkflowService extends PikkuWorkflowService {
     db;
@@ -16,7 +16,7 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
     async init() {
         if (this.initialized)
             return;
-        await ensurePikkuSchema(this.db, workflowSchema);
+        await requirePikkuSchema(this.db, workflowSchema);
         this.initialized = true;
     }
     async createRunImpl(workflowName, input, inline, graphHash, wire, options) {

package/dist/src/schema/agent.schema.js

@@ -11,6 +11,7 @@ import { sql } from 'kysely';
  */
 export const agentSchema = {
     name: 'agent',
+    ownedBy: ['agentStorage', 'agentRunState', 'agentRunService'],
     statements: [
         (db) => db.schema
             .createTable('agentThreads')

package/dist/src/schema/audit.schema.d.ts

@@ -2,10 +2,11 @@ import type { PikkuSchema } from './pikku-schema.types.js';
 /**
  * The `audit` table {@link KyselyAuditService} writes to and reads back.
  *
- * Deliberately not in `pikkuSchemas`: the runtime never needs this table, only
- * a project that has wired a durable audit sink does, and creating it for
- * everyone would put an empty table in every database. `KyselyAuditService.init()`
- * applies it, so it arrives exactly when the sink that fills it does.
+ * Gated by `ownedBy` rather than written for everyone: only a project that has
+ * wired a durable audit sink needs this table, and generating it for the rest
+ * would put an empty table in every database. `KyselyAuditService.init()`
+ * requires it and never creates it, so it arrives with the migration `pikku db
+ * generate` writes for the sink that fills it.
  *
  * Every column is text on every engine, matching the platform audit-queue
  * consumer's row shape — a locally-run project and a deployed stage write rows

package/dist/src/schema/audit.schema.js

@@ -1,10 +1,11 @@
 /**
  * The `audit` table {@link KyselyAuditService} writes to and reads back.
  *
- * Deliberately not in `pikkuSchemas`: the runtime never needs this table, only
- * a project that has wired a durable audit sink does, and creating it for
- * everyone would put an empty table in every database. `KyselyAuditService.init()`
- * applies it, so it arrives exactly when the sink that fills it does.
+ * Gated by `ownedBy` rather than written for everyone: only a project that has
+ * wired a durable audit sink needs this table, and generating it for the rest
+ * would put an empty table in every database. `KyselyAuditService.init()`
+ * requires it and never creates it, so it arrives with the migration `pikku db
+ * generate` writes for the sink that fills it.
  *
  * Every column is text on every engine, matching the platform audit-queue
  * consumer's row shape — a locally-run project and a deployed stage write rows
@@ -14,6 +15,7 @@
  */
 export const auditSchema = {
     name: 'audit',
+    ownedBy: ['audit', 'auditLog'],
     statements: [
         (db) => db.schema
             .createTable('audit')

package/dist/src/schema/channel.schema.js

@@ -2,6 +2,7 @@ import { sql } from 'kysely';
 /** Channels and their topic subscriptions, also read by the event-hub store. */
 export const channelSchema = {
     name: 'channel',
+    ownedBy: ['channelStore', 'eventHub'],
     statements: [
         (db) => db.schema
             .createTable('channels')

package/dist/src/schema/credential.schema.js

@@ -12,6 +12,7 @@ import { rawStatement } from './pikku-schema.types.js';
  */
 export const credentialSchema = {
     name: 'credential',
+    ownedBy: ['credentialService'],
     statements: [
         (db) => db.schema
             .createTable('credentials')

package/dist/src/schema/index.d.ts

@@ -3,19 +3,42 @@ import { type PikkuSchema, type RequiredTypes, type SchemaRequirement } from './
 export type { PikkuSchema, RequiredTypes, SchemaContext, SchemaRequirement, SchemaStatement, SchemaStatementFactory, } from './pikku-schema.types.js';
 export { rawStatement, requiredType, schemaContext, unqualifiedContext, } from './pikku-schema.types.js';
 /**
- * Opt-in, so it is named here rather than folded into `pikkuSchemas` — the
- * runtime works without an audit table, and `KyselyAuditService.init()` applies
- * this for the projects that wire the sink.
- */
-export { auditSchema } from './audit.schema.js';
-/**
- * Every table the pikku runtime needs, in dependency order.
+ * Every table any part of the pikku runtime can need, in dependency order.
  *
  * Order is load-bearing, not cosmetic: `scope` has foreign keys onto Better
  * Auth's `user`, and the tables within each schema reference each other. Sort
  * this list alphabetically and it stops applying.
+ *
+ * `audit` and `virtualUser` are in the list now. They used to be left out and
+ * created by their own services at boot, which was the only way they ever came
+ * into existence — so with the runtime no longer creating anything, leaving
+ * them out would mean a wired audit sink starting up against a table that
+ * nothing writes a migration for. Both are gated by `ownedBy`, so a project
+ * that wires neither still carries neither.
  */
 export declare const pikkuSchemas: PikkuSchema[];
+export { agentSchema } from './agent.schema.js';
+export { auditSchema } from './audit.schema.js';
+export { channelSchema } from './channel.schema.js';
+export { credentialSchema } from './credential.schema.js';
+export { deploymentSchema } from './deployment.schema.js';
+export { scopeSchema } from './scope.schema.js';
+export { secretSchema } from './secret.schema.js';
+export { sessionSchema } from './session.schema.js';
+export { virtualUserSchema } from './virtual-user.schema.js';
+export { webhookSchema } from './webhook.schema.js';
+export { workflowSchema } from './workflow.schema.js';
+/**
+ * The schemas a project needs, given the services its code actually reaches.
+ *
+ * `services` is the inspector's `requiredServices` — the same set that drives
+ * service tree-shaking, so a schema is written for exactly the projects whose
+ * functions, middleware or wirings reach the service that owns its tables.
+ *
+ * The gate is one-sided: a schema declaring no `ownedBy` is always in, because
+ * nothing a project writes implies it and leaving it out would be a guess.
+ */
+export declare const requiredPikkuSchemas: (services: ReadonlySet<string>) => PikkuSchema[];
 export interface UnmetRequirement {
     schema: PikkuSchema;
     requirement: SchemaRequirement;
@@ -74,27 +97,25 @@ export interface DeclaredTable {
  * schema the DDL will actually target — the same binding the lookup has to use.
  */
 export declare const declaredTables: (schema: PikkuSchema, db: Kysely<any>) => DeclaredTable[];
-/** What `ensurePikkuSchema` found when it looked. */
-export type EnsureOutcome = 'present' | 'created';
 /**
- * Make sure one schema's tables are there, creating them only if none are.
- *
- * What a service calls at boot. It looks before it creates, which is the whole
- * difference from the `.ifNotExists()` DDL this replaces: that spelling turned
- * every failure into a silent no-op, and hid a foreign key onto `user.id` that
- * postgres had been rejecting since the day it was written.
- *
- * A partially-present schema is refused rather than completed. Half a schema
- * means something else already applied part of it — a migration, an older
- * version, a hand-run script — and creating the remainder at boot would leave
- * two authorities over one set of tables, which is the condition all of this
- * exists to end.
- *
- * Creating at boot is the fallback, not the intent. `pikku db generate` writes
- * the declaration down as a migration; a project that has done so takes the
- * `present` path and this never issues DDL at all.
+ * Refuse to start unless one schema's tables are already there.
+ *
+ * What a service calls at boot, and it never issues DDL. The runtime is not an
+ * author of the schema: `pikku db generate` writes the declaration down as a
+ * migration and `pikku db migrate` applies it, and those two are the only way
+ * these tables come into existence. A service that finds them missing says so
+ * and stops.
+ *
+ * This is the whole point of gating what `db generate` writes. While boot could
+ * still create, a schema that generation left out was created silently at
+ * startup instead — two authorities over one set of tables, which is the
+ * condition all of this exists to end. With creation gone, a schema generation
+ * missed is a sentence at startup naming the command that fixes it.
+ *
+ * Half-present is not a distinct case any more. Every missing table is reported
+ * the same way, because the remedy is the same one either way.
  */
-export declare const ensurePikkuSchema: (db: Kysely<any>, schema: PikkuSchema) => Promise<EnsureOutcome>;
+export declare const requirePikkuSchema: (db: Kysely<any>, schema: PikkuSchema) => Promise<void>;
 /**
  * Render the declaration as SQL for the dialect `db` was built with.
  *