@pikku/kysely 0.13.31 → 0.13.34

package/dist/src/schema/audit.schema.js

@@ -17,33 +17,33 @@ export const auditSchema = {
     name: 'audit',
     ownedBy: ['audit', 'auditLog'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('audit')
-            .addColumn('auditId', 'text', (col) => col.primaryKey())
-            .addColumn('occurredAt', 'text', (col) => col.notNull())
-            .addColumn('type', 'text', (col) => col.notNull())
-            .addColumn('source', 'text', (col) => col.defaultTo('auto').notNull())
-            .addColumn('outcome', 'text')
-            .addColumn('functionId', 'text')
-            .addColumn('wireType', 'text')
-            .addColumn('traceId', 'text')
-            .addColumn('transactionId', 'text')
-            .addColumn('queryId', 'text')
-            .addColumn('userId', 'text')
-            .addColumn('orgId', 'text')
-            .addColumn('pikkuUserId', 'text')
-            .addColumn('tables', 'text')
-            .addColumn('changedCols', 'text')
-            .addColumn('event', 'text')
-            .addColumn('old', 'text')
-            .addColumn('data', 'text'),
+            .addColumn('auditId', ctx.key, (col) => col.primaryKey())
+            .addColumn('occurredAt', ctx.key, (col) => col.notNull())
+            .addColumn('type', ctx.key, (col) => col.notNull())
+            .addColumn('source', ctx.text, (col) => col.defaultTo(ctx.defaultText('auto')).notNull())
+            .addColumn('outcome', ctx.text)
+            .addColumn('functionId', ctx.text)
+            .addColumn('wireType', ctx.text)
+            .addColumn('traceId', ctx.text)
+            .addColumn('transactionId', ctx.text)
+            .addColumn('queryId', ctx.text)
+            .addColumn('userId', ctx.key)
+            .addColumn('orgId', ctx.text)
+            .addColumn('pikkuUserId', ctx.text)
+            .addColumn('tables', ctx.text)
+            .addColumn('changedCols', ctx.text)
+            .addColumn('event', ctx.text)
+            .addColumn('old', ctx.text)
+            .addColumn('data', ctx.text),
         // The trail is only ever read newest-first, and the two filters the console
         // offers are user and type.
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_audit_occurred_at')
             .on('audit')
             .column('occurredAt'),
-        (db) => db.schema.createIndex('idx_audit_user_id').on('audit').column('userId'),
-        (db) => db.schema.createIndex('idx_audit_type').on('audit').column('type'),
+        (db, _types, ctx) => db.schema.createIndex('idx_audit_user_id').on('audit').column('userId'),
+        (db, _types, ctx) => db.schema.createIndex('idx_audit_type').on('audit').column('type'),
     ],
 };

package/dist/src/schema/channel.schema.js

@@ -4,22 +4,25 @@ export const channelSchema = {
     name: 'channel',
     ownedBy: ['channelStore', 'eventHub'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('channels')
-            .addColumn('channelId', 'text', (col) => col.primaryKey())
-            .addColumn('channelName', 'text', (col) => col.notNull())
+            .addColumn('channelId', ctx.key, (col) => col.primaryKey())
+            .addColumn('channelName', ctx.text, (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
-            .addColumn('openingData', 'text', (col) => col.notNull().defaultTo('{}'))
-            .addColumn('pikkuUserId', 'text')
-            .addColumn('state', 'text')
+            .addColumn('openingData', ctx.text, (col) => col.notNull().defaultTo(ctx.defaultText('{}')))
+            .addColumn('pikkuUserId', ctx.text)
+            .addColumn('state', ctx.text)
             .addColumn('lastWire', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('channelSubscriptions')
-            .addColumn('channelId', 'text', (col) => col.notNull().references('channels.channelId').onDelete('cascade'))
-            .addColumn('topic', 'text', (col) => col.notNull())
+            .addColumn('channelId', ctx.key, (col) => ctx.references(col.notNull(), 'channels.channelId'))
+            .addColumn('topic', ctx.key, (col) => col.notNull())
             .addPrimaryKeyConstraint('channel_subscriptions_pk', [
             'channelId',
             'topic',
-        ]),
+        ])
+            .$call(ctx.foreignKeys('channelSubscriptions', {
+            channelId: 'channels.channelId',
+        })),
     ],
 };

package/dist/src/schema/credential.schema.js

@@ -14,22 +14,22 @@ export const credentialSchema = {
     name: 'credential',
     ownedBy: ['credentialService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('credentials')
             .addColumn('name', 'varchar(255)', (col) => col.notNull())
             .addColumn('userId', 'varchar(255)')
-            .addColumn('ciphertext', 'text', (col) => col.notNull())
-            .addColumn('wrappedDek', 'text', (col) => col.notNull())
+            .addColumn('ciphertext', ctx.text, (col) => col.notNull())
+            .addColumn('wrappedDek', ctx.text, (col) => col.notNull())
             .addColumn('keyVersion', 'integer', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        rawStatement(({ table }) => sql `CREATE UNIQUE INDEX credentials_name_user_id_unique ON ${table('credentials')} (name, COALESCE(user_id, ''))`),
-        (db) => db.schema
+        rawStatement(({ table, mysql }) => sql `CREATE UNIQUE INDEX credentials_name_user_id_unique ON ${table('credentials')} (name, ${mysql ? sql `(COALESCE(user_id, ''))` : sql `COALESCE(user_id, '')`})`),
+        (db, _types, ctx) => db.schema
             .createTable('credentialKekSalts')
             .addColumn('keyVersion', 'integer', (col) => col.primaryKey())
             .addColumn('salt', 'varchar(64)', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('credentialsAudit')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
             .addColumn('credentialName', 'varchar(255)', (col) => col.notNull())

package/dist/src/schema/deployment.schema.js

@@ -3,28 +3,28 @@ import { sql } from 'kysely';
 export const deploymentSchema = {
     name: 'deployment',
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuDeployments')
-            .addColumn('deploymentId', 'text', (col) => col.primaryKey())
-            .addColumn('endpoint', 'text', (col) => col.notNull())
+            .addColumn('deploymentId', ctx.key, (col) => col.primaryKey())
+            .addColumn('endpoint', ctx.text, (col) => col.notNull())
             .addColumn('lastHeartbeat', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuDeploymentFunctions')
-            .addColumn('deploymentId', 'text', (col) => col
-            .notNull()
-            .references('pikkuDeployments.deploymentId')
-            .onDelete('cascade'))
-            .addColumn('functionName', 'text', (col) => col.notNull())
+            .addColumn('deploymentId', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuDeployments.deploymentId'))
+            .addColumn('functionName', ctx.key, (col) => col.notNull())
             .addPrimaryKeyConstraint('pikku_deployment_functions_pk', [
             'deploymentId',
             'functionName',
-        ]),
-        (db) => db.schema
+        ])
+            .$call(ctx.foreignKeys('pikkuDeploymentFunctions', {
+            deploymentId: 'pikkuDeployments.deploymentId',
+        })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_deployments_heartbeat')
             .on('pikkuDeployments')
             .column('lastHeartbeat'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_deployment_functions_name')
             .on('pikkuDeploymentFunctions')
             .column('functionName'),

package/dist/src/schema/flag.schema.js

@@ -17,14 +17,14 @@ export const flagSchema = {
     name: 'flag',
     ownedBy: ['featureFlags'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuFeatureFlags')
-            .addColumn('name', 'text', (col) => col.primaryKey())
-            .addColumn('description', 'text')
+            .addColumn('name', ctx.key, (col) => col.primaryKey())
+            .addColumn('description', ctx.text)
             // The declared `anyOf` scope list, as JSON. Read by the console to say
             // who would see the feature; never read on the request path, where the
             // capability half comes from the session's own scopes.
-            .addColumn('anyOf', 'text')
+            .addColumn('anyOf', ctx.text)
             // Off until somebody turns it on. A flag exists so a feature can ship
             // dark, so the row a deploy creates has to start closed — the opposite
             // default would make merging the declaration the moment of launch.
@@ -37,26 +37,29 @@ export const flagSchema = {
             // longer offered, awaiting `pikku flags prune`. The same additive
             // contract as `pikkuScopes.declared`.
             .addColumn('declared', 'boolean', (col) => col.defaultTo(true).notNull())
-            .addColumn('updatedBy', 'text')
+            .addColumn('updatedBy', ctx.text)
             // Why it was flipped. A kill switch is pulled during an incident, and
             // the one question afterwards is always who turned it off and why.
-            .addColumn('note', 'text')
+            .addColumn('note', ctx.text)
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuFeatureFlagOverrides')
-            .addColumn('flag', 'text', (col) => col.notNull().references('pikkuFeatureFlags.name').onDelete('cascade'))
-            .addColumn('subjectId', 'text', (col) => col.notNull())
+            .addColumn('flag', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuFeatureFlags.name'))
+            .addColumn('subjectId', ctx.key, (col) => col.notNull())
             // Which id this is, for the console to render. Resolution keys on the
             // id alone, because that is all the resolver has: it prefers the
             // organization and falls back to the user, and by then the two are one
             // string.
-            .addColumn('subjectKind', 'text', (col) => col.notNull())
+            .addColumn('subjectKind', ctx.text, (col) => col.notNull())
             .addColumn('enabled', 'boolean', (col) => col.notNull())
-            .addColumn('grantedBy', 'text')
+            .addColumn('grantedBy', ctx.text)
             .addColumn('grantedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addPrimaryKeyConstraint('pikku_feature_flag_overrides_pk', [
             'flag',
             'subjectId',
-        ]),
+        ])
+            .$call(ctx.foreignKeys('pikkuFeatureFlagOverrides', {
+            flag: 'pikkuFeatureFlags.name',
+        })),
     ],
 };

package/dist/src/schema/incoming-webhook.schema.js

@@ -4,15 +4,15 @@ export const incomingWebhookSchema = {
     name: 'incoming-webhook',
     ownedBy: ['incomingWebhookService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('webhookReceipt')
-            .addColumn('receiptId', 'text', (col) => col.primaryKey())
-            .addColumn('source', 'text', (col) => col.notNull())
-            .addColumn('event', 'text', (col) => col.notNull())
-            .addColumn('providerEventId', 'text')
-            .addColumn('status', 'text', (col) => col.defaultTo('pending').notNull())
+            .addColumn('receiptId', ctx.key, (col) => col.primaryKey())
+            .addColumn('source', ctx.key, (col) => col.notNull())
+            .addColumn('event', ctx.key, (col) => col.notNull())
+            .addColumn('providerEventId', ctx.key)
+            .addColumn('status', ctx.text, (col) => col.defaultTo(ctx.defaultText('pending')).notNull())
             .addColumn('attempts', 'integer', (col) => col.defaultTo(0).notNull())
-            .addColumn('lastError', 'text')
+            .addColumn('lastError', ctx.text)
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('deliveredAt', 'timestamp'),
         (db) => db.schema

package/dist/src/schema/index.d.ts

@@ -24,6 +24,7 @@ export { channelSchema } from './channel.schema.js';
 export { credentialSchema } from './credential.schema.js';
 export { deploymentSchema } from './deployment.schema.js';
 export { flagSchema } from './flag.schema.js';
+export { leaseSchema } from './lease.schema.js';
 export { triggerSourceSchema } from './trigger-source.schema.js';
 export { incomingWebhookSchema } from './incoming-webhook.schema.js';
 export { scopeSchema } from './scope.schema.js';

package/dist/src/schema/index.js

@@ -1,4 +1,4 @@
-import { CamelCasePlugin } from 'kysely';
+import { CamelCasePlugin, sql } from 'kysely';
 import { schemaContext, } from './pikku-schema.types.js';
 import { agentSchema } from './agent.schema.js';
 import { analyticsSchema } from './analytics.schema.js';
@@ -10,6 +10,7 @@ import { scopeSchema } from './scope.schema.js';
 import { flagSchema } from './flag.schema.js';
 import { triggerSourceSchema } from './trigger-source.schema.js';
 import { incomingWebhookSchema } from './incoming-webhook.schema.js';
+import { leaseSchema } from './lease.schema.js';
 import { secretSchema } from './secret.schema.js';
 import { sessionSchema } from './session.schema.js';
 import { webhookSchema } from './webhook.schema.js';
@@ -44,6 +45,7 @@ export const pikkuSchemas = [
     scopeSchema,
     flagSchema,
     triggerSourceSchema,
+    leaseSchema,
     auditSchema,
     analyticsSchema,
     virtualUserSchema,
@@ -56,6 +58,7 @@ export { channelSchema } from './channel.schema.js';
 export { credentialSchema } from './credential.schema.js';
 export { deploymentSchema } from './deployment.schema.js';
 export { flagSchema } from './flag.schema.js';
+export { leaseSchema } from './lease.schema.js';
 export { triggerSourceSchema } from './trigger-source.schema.js';
 export { incomingWebhookSchema } from './incoming-webhook.schema.js';
 export { scopeSchema } from './scope.schema.js';
@@ -99,10 +102,30 @@ const bind = (db) => db.withPlugin(new CamelCasePlugin());
  * connection they are handed. A caller that had to remember to say the schema
  * twice would eventually say it once.
  */
-const boundSchema = (db) => CREATE_TABLE.exec(db.schema.createTable('pikkuSchemaProbe').addColumn('id', 'text').compile()
-    .sql)?.[1];
-/** The context for statements compiled against `db`, matching its binding. */
-const contextFor = (db) => schemaContext(boundSchema(db));
+const probe = (db) => db.schema.createTable('pikkuSchemaProbe').addColumn('id', 'text').compile()
+    .sql;
+/**
+ * The context for statements compiled against `db`, matching its binding and
+ * its dialect — MySQL is recognised by the backtick it quotes with.
+ */
+const contextFor = (db) => {
+    const sql = probe(db);
+    return schemaContext(CREATE_TABLE.exec(sql)?.[1], {
+        mysql: sql.includes('`'),
+    });
+};
+/**
+ * A MySQL column's full declared type — `varchar(36)`, not the `varchar` the
+ * introspector reports. The length is part of the type a foreign key has to
+ * match, and a bare `varchar` is not a type MySQL accepts.
+ */
+const mysqlColumnType = async (db, table, column) => {
+    const { rows } = await sql `
+    select column_type as type from information_schema.columns
+    where table_schema = database() and table_name = ${table} and column_name = ${column}
+  `.execute(db);
+    return rows[0].type;
+};
 /**
  * Look up every prerequisite in `db`, reporting the gaps and the types found.
  *
@@ -119,6 +142,7 @@ export const resolveRequirements = async (db, schemas = pikkuSchemas) => {
         table.name,
         table,
     ]));
+    const mysql = contextFor(bind(db)).mysql;
     const types = {};
     const unmet = [];
     for (const schema of schemas) {
@@ -130,7 +154,9 @@ export const resolveRequirements = async (db, schemas = pikkuSchemas) => {
                 unmet.push({ schema, requirement });
             }
             else {
-                types[`${requirement.table}.${requirement.column}`] = column.dataType;
+                types[`${requirement.table}.${requirement.column}`] = mysql
+                    ? await mysqlColumnType(db, requirement.table, requirement.column)
+                    : column.dataType;
             }
         }
     }
@@ -231,7 +257,7 @@ const displayName = (table) => table.schema ? `${table.schema}.${table.name}` :
  * identifier — matching the first one instead reads a `withSchema('app')`
  * connection's DDL as a table called `app`, which is no table at all.
  */
-const CREATE_TABLE = /^\s*create table (?:if not exists\s+)?(?:"([^"]+)"\.)?"([^"]+)"/i;
+const CREATE_TABLE = /^\s*create table (?:if not exists\s+)?(?:["`]([^"`]+)["`]\.)?["`]([^"`]+)["`]/i;
 /**
  * The tables a schema creates, read back out of its own compiled SQL.
  *

package/dist/src/schema/lease.schema.d.ts

@@ -0,0 +1,2 @@
+import type { PikkuSchema } from './pikku-schema.types.js';
+export declare const leaseSchema: PikkuSchema;

package/dist/src/schema/lease.schema.js

@@ -0,0 +1,12 @@
+export const leaseSchema = {
+    name: 'lease',
+    ownedBy: ['leaseService', 'workflowService'],
+    statements: [
+        (db, _types, ctx) => db.schema
+            .createTable('pikkuLease')
+            .addColumn('key', ctx.key, (col) => col.primaryKey())
+            .addColumn('holder', ctx.text, (col) => col.notNull())
+            .addColumn('token', 'integer', (col) => col.notNull())
+            .addColumn('expiresAt', 'bigint', (col) => col.notNull()),
+    ],
+};

package/dist/src/schema/pikku-schema.types.d.ts

@@ -1,4 +1,5 @@
-import { type CompiledQuery, type Kysely, type RawBuilder } from 'kysely';
+import { type ColumnDefinitionBuilder, type CompiledQuery, type CreateTableBuilder, type Kysely, type RawBuilder } from 'kysely';
+type DataTypeExpression = Parameters<CreateTableBuilder<any, any>['addColumn']>[1];
 /**
  * One DDL statement, bound to a database.
  *
@@ -21,6 +22,12 @@ export type SchemaStatementFactory = (db: Kysely<any>, types: RequiredTypes, ctx
  * statement that spells its own SQL has to spell the qualifier too.
  */
 export interface SchemaContext {
+    /**
+     * Whether the connection is MySQL, which is the one engine the declarations
+     * cannot spell the same way: it refuses a `TEXT` column in a key or with a
+     * literal default, and quotes with backticks.
+     */
+    mysql: boolean;
     /**
      * A table as the surrounding DDL addresses it: `"app"."credentials"` on a
      * schema-bound connection, `"credentials"` otherwise.
@@ -30,6 +37,36 @@ export interface SchemaContext {
      * physical names throughout and this is no exception.
      */
     table: (name: string) => RawBuilder<unknown>;
+    /**
+     * The type of a text column that is part of a key — primary, foreign, unique
+     * or indexed. `text` everywhere but MySQL, where a key needs a bounded type.
+     */
+    key: DataTypeExpression;
+    /**
+     * The type of free text of any length. `text` everywhere but MySQL, where
+     * `TEXT` stops at 64KB and these columns hold serialized state and payloads.
+     */
+    text: DataTypeExpression;
+    /**
+     * A literal default for a text column. MySQL refuses one on `TEXT`, so it
+     * takes the parenthesised expression form (8.0.13+); everywhere else the
+     * literal itself.
+     */
+    defaultText: (value: string) => string | RawBuilder<unknown>;
+    /**
+     * An inline `references ... on delete cascade` on a column.
+     *
+     * A no-op on MySQL, which parses an inline `REFERENCES` and discards it — the
+     * constraint never exists. There the same relationship is declared once, at
+     * table level, through `foreignKeys`.
+     */
+    references: (column: ColumnDefinitionBuilder, target: string) => ColumnDefinitionBuilder;
+    /**
+     * The table-level foreign keys MySQL needs in place of inline `references`,
+     * keyed by local column to `table.column` target. Identity everywhere else,
+     * where `references` has already done the work.
+     */
+    foreignKeys: (table: string, keys: Record<string, string>) => <T extends CreateTableBuilder<any, any>>(builder: T) => T;
 }
 /**
  * The `SchemaContext` for DDL that names no schema.
@@ -44,7 +81,9 @@ export declare const unqualifiedContext: SchemaContext;
  * Identifiers are quoted rather than interpolated bare so a schema named after
  * a reserved word still compiles.
  */
-export declare const schemaContext: (schema: string | undefined) => SchemaContext;
+export declare const schemaContext: (schema: string | undefined, options?: {
+    mysql?: boolean;
+}) => SchemaContext;
 /**
  * The physical types of the columns named in `requires`, keyed `table.column`.
  *
@@ -129,3 +168,4 @@ export interface SchemaRequirement {
  */
 export declare function rawStatement(fragment: RawBuilder<unknown>): SchemaStatementFactory;
 export declare function rawStatement(build: (ctx: SchemaContext) => RawBuilder<unknown>): SchemaStatementFactory;
+export {};

package/dist/src/schema/pikku-schema.types.js

@@ -1,22 +1,38 @@
-import { sql } from 'kysely';
+import { sql, } from 'kysely';
 /**
  * The `SchemaContext` for DDL that names no schema.
  *
  * The default everywhere a schema has not been asked for, which is every engine
  * but postgres and most postgres projects too.
  */
-export const unqualifiedContext = {
-    table: (name) => sql.raw(`"${name}"`),
-};
+export const unqualifiedContext = buildContext(undefined, false);
+function buildContext(schema, mysql) {
+    const quote = mysql ? '`' : '"';
+    const name = (table) => schema
+        ? `${quote}${schema}${quote}.${quote}${table}${quote}`
+        : `${quote}${table}${quote}`;
+    return {
+        mysql,
+        table: (table) => sql.raw(name(table)),
+        key: mysql ? sql.raw('varchar(255)') : 'text',
+        text: mysql ? sql.raw('longtext') : 'text',
+        defaultText: (value) => (mysql ? sql `(${sql.lit(value)})` : value),
+        references: (column, target) => mysql ? column : column.references(target).onDelete('cascade'),
+        foreignKeys: (table, keys) => (builder) => mysql
+            ? Object.entries(keys).reduce((acc, [column, target]) => {
+                const [targetTable, targetColumn] = target.split('.');
+                return acc.addForeignKeyConstraint(`${table}_${column}_fk`, [column], targetTable, [targetColumn], (fk) => fk.onDelete('cascade'));
+            }, builder)
+            : builder,
+    };
+}
 /**
  * A `SchemaContext` qualifying every table into `schema`.
  *
  * Identifiers are quoted rather than interpolated bare so a schema named after
  * a reserved word still compiles.
  */
-export const schemaContext = (schema) => schema
-    ? { table: (name) => sql.raw(`"${schema}"."${name}"`) }
-    : unqualifiedContext;
+export const schemaContext = (schema, options = {}) => buildContext(schema, options.mysql ?? false);
 /**
  * The declared type for a foreign key onto a column another source owns.
  *

package/dist/src/schema/scope.schema.js

@@ -21,15 +21,15 @@ export const scopeSchema = {
     ownedBy: ['scopeService'],
     requires: [{ table: 'user', column: 'id', owner: 'Better Auth' }],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuScopes')
-            .addColumn('name', 'text', (col) => col.primaryKey())
-            .addColumn('description', 'text')
+            .addColumn('name', ctx.key, (col) => col.primaryKey())
+            .addColumn('description', ctx.text)
             .addColumn('declared', 'boolean', (col) => col.defaultTo(true).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuRoles')
-            .addColumn('name', 'text', (col) => col.primaryKey())
-            .addColumn('description', 'text')
+            .addColumn('name', ctx.key, (col) => col.primaryKey())
+            .addColumn('description', ctx.text)
             // Declared in code with `defineSystemRole` rather than composed by an
             // admin. What it buys is the refusals: a system role cannot be renamed,
             // re-scoped or deleted from the console, and a console role cannot be
@@ -43,30 +43,42 @@ export const scopeSchema = {
             // be able to cause.
             .addColumn('declared', 'boolean', (col) => col.defaultTo(true).notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuRoleScopes')
-            .addColumn('role', 'text', (col) => col.notNull().references('pikkuRoles.name').onDelete('cascade'))
-            .addColumn('scope', 'text', (col) => col.notNull().references('pikkuScopes.name').onDelete('cascade'))
-            .addPrimaryKeyConstraint('pikku_role_scopes_pk', ['role', 'scope']),
-        (db, types) => db.schema
+            .addColumn('role', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuRoles.name'))
+            .addColumn('scope', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuScopes.name'))
+            .addPrimaryKeyConstraint('pikku_role_scopes_pk', ['role', 'scope'])
+            .$call(ctx.foreignKeys('pikkuRoleScopes', {
+            role: 'pikkuRoles.name',
+            scope: 'pikkuScopes.name',
+        })),
+        (db, types, ctx) => db.schema
             .createTable('pikkuUserRole')
-            .addColumn('userId', requiredType(types, 'user', 'id'), (col) => col.notNull().references('user.id').onDelete('cascade'))
-            .addColumn('role', 'text', (col) => col.notNull().references('pikkuRoles.name').onDelete('cascade'))
-            .addColumn('grantedBy', 'text')
+            .addColumn('userId', requiredType(types, 'user', 'id'), (col) => ctx.references(col.notNull(), 'user.id'))
+            .addColumn('role', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuRoles.name'))
+            .addColumn('grantedBy', ctx.text)
             .addColumn('grantedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
-            .addPrimaryKeyConstraint('pikku_user_role_pk', ['userId', 'role']),
-        (db, types) => db.schema
+            .addPrimaryKeyConstraint('pikku_user_role_pk', ['userId', 'role'])
+            .$call(ctx.foreignKeys('pikkuUserRole', {
+            userId: 'user.id',
+            role: 'pikkuRoles.name',
+        })),
+        (db, types, ctx) => db.schema
             .createTable('pikkuUserScope')
-            .addColumn('userId', requiredType(types, 'user', 'id'), (col) => col.notNull().references('user.id').onDelete('cascade'))
-            .addColumn('scope', 'text', (col) => col.notNull().references('pikkuScopes.name').onDelete('cascade'))
-            .addColumn('grantedBy', 'text')
+            .addColumn('userId', requiredType(types, 'user', 'id'), (col) => ctx.references(col.notNull(), 'user.id'))
+            .addColumn('scope', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuScopes.name'))
+            .addColumn('grantedBy', ctx.text)
             .addColumn('grantedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
-            .addPrimaryKeyConstraint('pikku_user_scope_pk', ['userId', 'scope']),
-        (db) => db.schema
+            .addPrimaryKeyConstraint('pikku_user_scope_pk', ['userId', 'scope'])
+            .$call(ctx.foreignKeys('pikkuUserScope', {
+            userId: 'user.id',
+            scope: 'pikkuScopes.name',
+        })),
+        (db, _types, ctx) => db.schema
             .createIndex('pikku_role_scopes_scope_idx')
             .on('pikkuRoleScopes')
             .column('scope'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('pikku_user_role_role_idx')
             .on('pikkuUserRole')
             .column('role'),

package/dist/src/schema/secret.schema.js

@@ -11,20 +11,20 @@ import { sql } from 'kysely';
 export const secretSchema = {
     name: 'secret',
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('secrets')
             .addColumn('key', 'varchar(255)', (col) => col.primaryKey())
-            .addColumn('ciphertext', 'text', (col) => col.notNull())
-            .addColumn('wrappedDek', 'text', (col) => col.notNull())
+            .addColumn('ciphertext', ctx.text, (col) => col.notNull())
+            .addColumn('wrappedDek', ctx.text, (col) => col.notNull())
             .addColumn('keyVersion', 'integer', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('secretKekSalts')
             .addColumn('keyVersion', 'integer', (col) => col.primaryKey())
             .addColumn('salt', 'varchar(64)', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('secretsAudit')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
             .addColumn('secretKey', 'varchar(255)', (col) => col.notNull())

package/dist/src/schema/session.schema.js

@@ -3,10 +3,10 @@ import { sql } from 'kysely';
 export const sessionSchema = {
     name: 'session',
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuUserSessions')
-            .addColumn('pikkuUserId', 'text', (col) => col.primaryKey())
-            .addColumn('session', 'text', (col) => col.notNull())
+            .addColumn('pikkuUserId', ctx.key, (col) => col.primaryKey())
+            .addColumn('session', ctx.text, (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
     ],