@pikku/kysely 0.13.33 → 0.13.35

package/CHANGELOG.md

@@ -1,3 +1,51 @@
+## 0.13.35
+
+### Patch Changes
+
+- 15c4968: The default runtime path no longer needs `node:*`, `Buffer` or an unguarded `process`, so it loads on edge runtimes (Web APIs only).
+
+  **Breaking:** `FileScenarioRunStore`, `scenarioArtifactContentType` and `scenarioRunSummary` leave the `@pikku/core/services` barrel because they use `node:fs`. Import them from `@pikku/core/services/file-scenario-run-store`. Pre-0.13 breaking changes still ship as a patch.
+
+  **Breaking:** the HMAC helpers in `@pikku/core/hmac` run on Web Crypto, which is async. `hmacSha256Hex`, `hmacDigest`, `verifyHmacSignature` and `verifyPublicKeySignature` now return a Promise; `timingSafeStringEqual` stays synchronous. `WebhookService.sign` and `WebhookService.verify` return a Promise, and so does `verifySlackSignature` in `@pikku/gateway-slack`: `await` them. A function-style `verify` on a webhook source may return a Promise as well. `verifyPublicKeySignature` accepts RSA and EC (P-256, P-384, P-521) PEM keys; Ed25519 and RSA-PSS keys verify as false.
+
+  `isProduction()` (and the `PIKKU_MODEL_ALIASES` and `PIKKU_ENV` reads) now ask the registered singleton services' `variables` service first, then `process.env` when `process` exists. With neither, `isProduction()` is true, so an edge deployment never exposes error details by accident. `LocalVariablesService` resolves its `process.env` default when constructed and falls back to an empty store without `process`.
+
+  Workflow invocation ids use a built-in SHA-1 and stay byte-identical. `@pikku/kysely` and the Cloudflare hibernation server use `globalThis.crypto.randomUUID()` and no `Buffer`; `@pikku/kysely` is marked `sideEffects: false`. `@pikku/ai-deepinfra` reads `DEEPINFRA_API_KEY` only when `process` exists and decodes base64 audio without `Buffer`.
+
+  Runtime tiers. A package declares where it can run in `package.json`: `"pikku": { "runtime": "edge" | "serverless" | "server" }`, with optional per-subpath overrides (`"exports": { "./dev": "server" }`). `server` is the default. `@pikku/core` and the default services are `edge` (core's Node-only subpaths are `server`), `@pikku/better-auth`, `@pikku/addon-admin` and `@pikku/cloudflare` are `serverless` (better-auth statically imports `node:crypto` scrypt), and `@pikku/addon-console` is `server` and must never land in a deployed unit.
+
+  `pikku deploy` now verifies each deployed unit before bundling it. The unit is bundled with esbuild (neutral platform, `workerd`/`worker`/`browser` conditions) under its tier's profile, ahead of the adapter's aliases and stubs so they cannot hide anything, and the build fails when the bundle holds a package declared above the unit's tier or a Node built-in the runtime does not provide. The error names the unit, package, import chain and the fix. A built-in the provider stubs is a warning. On an edge unit, a bundled `InMemory*` class also fails the build. The unit's tier is its `runtime`, else the project's own `pikku.runtime`, else the provider default (`serverless` on Cloudflare). Packages that declare nothing are judged by their imports only.
+
+  `ProviderAdapter.getRuntimeProfile(tier?)` returns the compat date, compat flags, the built-ins the runtime provides (keyed by compat date), the stubbed ones and the externals. The Cloudflare adapter derives `wrangler.toml`, the upload metadata and the bundle externals from it; `node:os` and `node:fs` are not provided before compat date 2025-09-15. The default is `nodejs_compat_v2` with compat date 2024-12-18, which is what `wrangler.toml` and Fabric's live workers already use, so Fabric deploys see no runtime change. Only the direct-API upload in `@pikku/deploy-cloudflare` (`createWorker`, used by its own `deploy()`) moves: it sent `nodejs_compat` with 2024-01-01 before. A newer date or flag is opt-in through the adapter option `new CloudflareProviderAdapter({ compatDate })` or `getCloudflareRuntimeProfile(tier, compatDate)`. From 2025-08-15 `node:http` and `node:https` exist, and from 2025-09-15 `node:os`, `node:fs` (stubbed by the build regardless) and `node:perf_hooks`; the verifier's allowed built-ins follow the effective date. A newer date changes the runtime of every worker deployed with it.
+
+  `declareScopes(['pikku:console'])` (from `@pikku/core/scope`) declares scopes by id without wiring anything. `wireAddon({ scopes })` only requires a scope of an addon's functions; the tree arrives with the addon's metadata, so a role granting `pikku:console` used to fail PKU124 unless the addon was wired, and a wired `@pikku/addon-console` lands in every unit carrying the `/rpc` catch-all. An app that grants the scope without the console now calls `declareScopes` and no longer needs the scaffold or the addon. When the addon is wired its tree and descriptions win and the bare id adds nothing.
+
+  More packages declare a tier after bundling each with the edge profile. `edge`: `@pikku/addon-graph`, `@pikku/pino`, `@pikku/jose`, `@pikku/ai-vercel`, `@pikku/ai-voice`. `serverless`: `@pikku/kysely-postgres` (postgres.js needs `node:buffer`, `stream`, `events`), `@pikku/backblaze` (`copyFile` reads a local file, which the build stubs), `@pikku/gateway-slack` (`@slack/web-api` imports `node:os` and `zlib`). `server`: `@pikku/schedule` (`cron` imports `child_process`), `@pikku/aws-services` (the AWS SDK's Node handler needs `node:http2`), `@pikku/browser` (puppeteer), and `@pikku/modelcontextprotocol` except its `./fetch` subpath, which is `edge`.
+
+  `@pikku/addon-graph` no longer needs `node:crypto` or `Buffer`: the Crypto function hashes and HMACs on Web Crypto (MD5 is built in, since Web Crypto has none) and encodes with `TextEncoder`/`atob`/`btoa`, with output unchanged.
+
+- Updated dependencies [6f11bb5]
+- Updated dependencies [0c67e33]
+- Updated dependencies [15c4968]
+- Updated dependencies [d75a23d]
+- Updated dependencies [9b12c8a]
+  - @pikku/core@0.12.138
+
+## 0.13.34
+
+### Patch Changes
+
+- 80c94f9: MySQL is a third dialect for the `pikku db` commands, beside sqlite and postgres.
+
+  Set `mysqlUrl` in `createConfig` and `db migrate`, `generate`, `check`, `baseline`, `reset`, `codegen` and the dev seed behave as they do elsewhere, with migrations in `db/mysql/` and the seed in `db/mysql-dev-seed.sql`. MySQL has no embedded engine, so a command that needs a throwaway database creates and drops a `pikku_scratch_<hex>` one on your server — the account needs `CREATE` and `DROP`. DDL is not transactional there, so a migration that fails halfway is replayed from the top. `db.schema` is refused, because a MySQL schema is a database.
+
+  `@pikku/migrator-sql` gains `@pikku/migrator-sql/mysql`. The runtime schemas in `@pikku/kysely` now compile for MySQL without changing what sqlite and postgres get: keys are `varchar(255)`, free text is `longtext`, literal text defaults are expressions, and foreign keys are table-level constraints, because MySQL parses an inline `REFERENCES` and silently drops it. A foreign key onto a column another source owns takes that column's full type (`varchar(36)`), not the bare `varchar` the introspector reports.
+
+  An addon that ships `db/mysql` migrations needs `db.mysqlUrl` in its `pikku.config.json` for `pikku all` to publish them. The standalone bundle does not support MySQL yet and refuses a MySQL project by name.
+
+- Updated dependencies [149faae]
+  - @pikku/core@0.12.136
+
 ## 0.13.33
 
 ### Patch Changes

package/dist/bin/pikku-kysely-pure.js

@@ -39,4 +39,7 @@ if (process.argv.length !== 4) {
     process.exit(1);
 }
 const [, , output, input] = process.argv;
-main(output, input);
+main(output, input).catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/src/classification-crypto.js

@@ -12,8 +12,22 @@ import { DEFAULT_KEY_ID } from '@pikku/core/classification';
  */
 export { DEFAULT_KEY_ID };
 const ENVELOPE_PREFIX = 'pikku1';
-const encodePart = (value) => Buffer.from(value, 'utf8').toString('base64url');
-const decodePart = (value) => Buffer.from(value, 'base64url').toString('utf8');
+/** base64url of the UTF-8 bytes, unpadded: `Buffer`-free, so it runs on edge runtimes. */
+const encodePart = (value) => {
+    let binary = '';
+    for (const byte of new TextEncoder().encode(value)) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const decodePart = (value) => {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return new TextDecoder().decode(bytes);
+};
 const serializeEnvelope = (envelope) => [
     ENVELOPE_PREFIX,
     encodePart(envelope.keyId),

package/dist/src/kysely-deployment-service.js

@@ -54,7 +54,10 @@ export class KyselyDeploymentService {
                     .execute();
             }
         });
-        this.heartbeatTimer = setInterval(() => this.sendHeartbeat(), this.heartbeatInterval);
+        this.heartbeatTimer = setInterval(() => {
+            // sendHeartbeat catches its own errors; it retries on the next tick
+            void this.sendHeartbeat();
+        }, this.heartbeatInterval);
     }
     async stop() {
         if (this.heartbeatTimer) {

package/dist/src/kysely-virtual-user-run-store.js

@@ -1,4 +1,3 @@
-import { randomUUID } from 'node:crypto';
 import { parseJson } from './kysely-json.js';
 import { requirePikkuSchema } from './schema/index.js';
 import { virtualUserSchema } from './schema/virtual-user.schema.js';
@@ -49,7 +48,7 @@ export class KyselyVirtualUserRunStore {
     }
     async start(run) {
         await this.init();
-        const runId = randomUUID();
+        const runId = globalThis.crypto.randomUUID();
         await this.db
             .insertInto('virtualUserRun')
             .values({

package/dist/src/kysely-workflow-service.d.ts

@@ -23,6 +23,11 @@ export declare class KyselyWorkflowService extends PikkuWorkflowService {
     protected listStepStates(runId: string): Promise<Array<StepState & {
         stepName: string;
     }>>;
+    getRunSteps(runId: string): Promise<Array<StepState & {
+        stepName: string;
+        rpcName?: string;
+        data?: any;
+    }>>;
     getRunHistory(runId: string): Promise<Array<StepState & {
         stepName: string;
     }>>;

package/dist/src/kysely-workflow-service.js

@@ -147,6 +147,9 @@ export class KyselyWorkflowService extends PikkuWorkflowService {
             .execute();
         return rows.map((row) => ({ ...toStepState(row), stepName: row.stepName }));
     }
+    async getRunSteps(runId) {
+        return this.runService.getRunSteps(runId);
+    }
     async getRunHistory(runId) {
         return this.runService.getRunHistory(runId);
     }

package/dist/src/schema/agent.schema.js

@@ -13,89 +13,96 @@ export const agentSchema = {
     name: 'agent',
     ownedBy: ['agentStorage', 'agentRunState', 'agentRunService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentThreads')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
             .addColumn('resourceId', 'varchar(255)', (col) => col.notNull())
-            .addColumn('title', 'text')
-            .addColumn('metadata', 'text')
+            .addColumn('title', ctx.text)
+            .addColumn('metadata', ctx.text)
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_threads_resource')
             .on('agentThreads')
             .column('resourceId'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentMessage')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
-            .addColumn('threadId', 'varchar(36)', (col) => col.notNull().references('agentThreads.id').onDelete('cascade'))
+            .addColumn('threadId', 'varchar(36)', (col) => ctx.references(col.notNull(), 'agentThreads.id'))
             .addColumn('role', 'varchar(50)', (col) => col.notNull())
-            .addColumn('content', 'text')
-            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+            .addColumn('content', ctx.text)
+            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .$call(ctx.foreignKeys('agentMessage', { threadId: 'agentThreads.id' })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_message_thread')
             .on('agentMessage')
             .columns(['threadId', 'createdAt']),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentToolCall')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
-            .addColumn('threadId', 'varchar(36)', (col) => col.notNull().references('agentThreads.id').onDelete('cascade'))
-            .addColumn('messageId', 'varchar(36)', (col) => col.notNull().references('agentMessage.id').onDelete('cascade'))
+            .addColumn('threadId', 'varchar(36)', (col) => ctx.references(col.notNull(), 'agentThreads.id'))
+            .addColumn('messageId', 'varchar(36)', (col) => ctx.references(col.notNull(), 'agentMessage.id'))
             .addColumn('runId', 'varchar(36)')
             .addColumn('toolName', 'varchar(255)', (col) => col.notNull())
-            .addColumn('args', 'text', (col) => col.notNull())
-            .addColumn('result', 'text')
+            .addColumn('args', ctx.text, (col) => col.notNull())
+            .addColumn('result', ctx.text)
             .addColumn('approvalStatus', 'varchar(50)')
             .addColumn('approvalType', 'varchar(50)')
             .addColumn('agentRunId', 'varchar(36)')
             .addColumn('displayToolName', 'varchar(255)')
-            .addColumn('displayArgs', 'text')
-            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+            .addColumn('displayArgs', ctx.text)
+            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .$call(ctx.foreignKeys('agentToolCall', {
+            threadId: 'agentThreads.id',
+            messageId: 'agentMessage.id',
+        })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_tool_call_thread')
             .on('agentToolCall')
             .column('threadId'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_tool_call_message')
             .on('agentToolCall')
             .column('messageId'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentWorkingMemory')
             .addColumn('id', 'varchar(255)', (col) => col.notNull())
             .addColumn('scope', 'varchar(50)', (col) => col.notNull())
-            .addColumn('data', 'text', (col) => col.notNull())
+            .addColumn('data', ctx.text, (col) => col.notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addPrimaryKeyConstraint('agent_working_memory_pk', ['id', 'scope']),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentRun')
             .addColumn('runId', 'varchar(36)', (col) => col.primaryKey())
             .addColumn('agentName', 'varchar(255)', (col) => col.notNull())
-            .addColumn('threadId', 'varchar(36)', (col) => col.notNull().references('agentThreads.id').onDelete('cascade'))
+            .addColumn('threadId', 'varchar(36)', (col) => ctx.references(col.notNull(), 'agentThreads.id'))
             .addColumn('resourceId', 'varchar(255)', (col) => col.notNull())
-            .addColumn('status', 'varchar(50)', (col) => col.notNull().defaultTo('running'))
-            .addColumn('errorMessage', 'text')
-            .addColumn('suspendReason', 'text')
-            .addColumn('missingRpcs', 'text')
-            .addColumn('pendingApprovals', 'text')
+            .addColumn('status', 'varchar(50)', (col) => col.notNull().defaultTo(ctx.defaultText('running')))
+            .addColumn('errorMessage', ctx.text)
+            .addColumn('suspendReason', ctx.text)
+            .addColumn('missingRpcs', ctx.text)
+            .addColumn('pendingApprovals', ctx.text)
             .addColumn('usageInputTokens', 'integer', (col) => col.notNull().defaultTo(0))
             .addColumn('usageOutputTokens', 'integer', (col) => col.notNull().defaultTo(0))
-            .addColumn('usageModel', 'varchar(255)', (col) => col.notNull().defaultTo(''))
+            .addColumn('usageModel', 'varchar(255)', (col) => col.notNull().defaultTo(ctx.defaultText('')))
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
-            .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+            .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .$call(ctx.foreignKeys('agentRun', { threadId: 'agentThreads.id' })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_run_thread')
             .on('agentRun')
             .columns(['threadId', 'createdAt']),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('agentRunScore')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
-            .addColumn('runId', 'varchar(36)', (col) => col.notNull().references('agentRun.runId').onDelete('cascade'))
+            .addColumn('runId', 'varchar(36)', (col) => ctx.references(col.notNull(), 'agentRun.runId'))
             .addColumn('scorerName', 'varchar(255)', (col) => col.notNull())
             .addColumn('score', 'real', (col) => col.notNull())
-            .addColumn('reason', 'text')
-            .addColumn('metadata', 'text')
-            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+            .addColumn('reason', ctx.text)
+            .addColumn('metadata', ctx.text)
+            .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
+            .$call(ctx.foreignKeys('agentRunScore', { runId: 'agentRun.runId' })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_agent_run_score_run')
             .on('agentRunScore')
             .columns(['runId', 'createdAt']),

package/dist/src/schema/analytics.schema.js

@@ -17,30 +17,30 @@ export const analyticsSchema = {
     name: 'analytics',
     ownedBy: ['analyticsService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuAnalyticsEvents')
-            .addColumn('eventId', 'text', (col) => col.primaryKey())
-            .addColumn('name', 'text', (col) => col.notNull())
-            .addColumn('occurredAt', 'text', (col) => col.notNull())
-            .addColumn('source', 'text', (col) => col.notNull())
-            .addColumn('functionId', 'text')
-            .addColumn('wireType', 'text')
-            .addColumn('traceId', 'text')
-            .addColumn('userId', 'text')
-            .addColumn('orgId', 'text')
-            .addColumn('pikkuUserId', 'text')
+            .addColumn('eventId', ctx.key, (col) => col.primaryKey())
+            .addColumn('name', ctx.key, (col) => col.notNull())
+            .addColumn('occurredAt', ctx.key, (col) => col.notNull())
+            .addColumn('source', ctx.text, (col) => col.notNull())
+            .addColumn('functionId', ctx.text)
+            .addColumn('wireType', ctx.text)
+            .addColumn('traceId', ctx.text)
+            .addColumn('userId', ctx.text)
+            .addColumn('orgId', ctx.text)
+            .addColumn('pikkuUserId', ctx.text)
             // The device id for a visitor with no session. Its own column beside
             // `userId` and not folded into it: the whole point of the anonymous id
             // is the traffic that has no user to be attributed to yet.
-            .addColumn('anonymousId', 'text')
-            .addColumn('vendorIds', 'text')
-            .addColumn('consent', 'text')
-            .addColumn('props', 'text'),
-        (db) => db.schema
+            .addColumn('anonymousId', ctx.text)
+            .addColumn('vendorIds', ctx.text)
+            .addColumn('consent', ctx.text)
+            .addColumn('props', ctx.text),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_analytics_events_occurred_at')
             .on('pikkuAnalyticsEvents')
             .column('occurredAt'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_analytics_events_name')
             .on('pikkuAnalyticsEvents')
             .column('name'),

package/dist/src/schema/audit.schema.js

@@ -17,33 +17,33 @@ export const auditSchema = {
     name: 'audit',
     ownedBy: ['audit', 'auditLog'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('audit')
-            .addColumn('auditId', 'text', (col) => col.primaryKey())
-            .addColumn('occurredAt', 'text', (col) => col.notNull())
-            .addColumn('type', 'text', (col) => col.notNull())
-            .addColumn('source', 'text', (col) => col.defaultTo('auto').notNull())
-            .addColumn('outcome', 'text')
-            .addColumn('functionId', 'text')
-            .addColumn('wireType', 'text')
-            .addColumn('traceId', 'text')
-            .addColumn('transactionId', 'text')
-            .addColumn('queryId', 'text')
-            .addColumn('userId', 'text')
-            .addColumn('orgId', 'text')
-            .addColumn('pikkuUserId', 'text')
-            .addColumn('tables', 'text')
-            .addColumn('changedCols', 'text')
-            .addColumn('event', 'text')
-            .addColumn('old', 'text')
-            .addColumn('data', 'text'),
+            .addColumn('auditId', ctx.key, (col) => col.primaryKey())
+            .addColumn('occurredAt', ctx.key, (col) => col.notNull())
+            .addColumn('type', ctx.key, (col) => col.notNull())
+            .addColumn('source', ctx.text, (col) => col.defaultTo(ctx.defaultText('auto')).notNull())
+            .addColumn('outcome', ctx.text)
+            .addColumn('functionId', ctx.text)
+            .addColumn('wireType', ctx.text)
+            .addColumn('traceId', ctx.text)
+            .addColumn('transactionId', ctx.text)
+            .addColumn('queryId', ctx.text)
+            .addColumn('userId', ctx.key)
+            .addColumn('orgId', ctx.text)
+            .addColumn('pikkuUserId', ctx.text)
+            .addColumn('tables', ctx.text)
+            .addColumn('changedCols', ctx.text)
+            .addColumn('event', ctx.text)
+            .addColumn('old', ctx.text)
+            .addColumn('data', ctx.text),
         // The trail is only ever read newest-first, and the two filters the console
         // offers are user and type.
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_audit_occurred_at')
             .on('audit')
             .column('occurredAt'),
-        (db) => db.schema.createIndex('idx_audit_user_id').on('audit').column('userId'),
-        (db) => db.schema.createIndex('idx_audit_type').on('audit').column('type'),
+        (db, _types, ctx) => db.schema.createIndex('idx_audit_user_id').on('audit').column('userId'),
+        (db, _types, ctx) => db.schema.createIndex('idx_audit_type').on('audit').column('type'),
     ],
 };

package/dist/src/schema/channel.schema.js

@@ -4,22 +4,25 @@ export const channelSchema = {
     name: 'channel',
     ownedBy: ['channelStore', 'eventHub'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('channels')
-            .addColumn('channelId', 'text', (col) => col.primaryKey())
-            .addColumn('channelName', 'text', (col) => col.notNull())
+            .addColumn('channelId', ctx.key, (col) => col.primaryKey())
+            .addColumn('channelName', ctx.text, (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
-            .addColumn('openingData', 'text', (col) => col.notNull().defaultTo('{}'))
-            .addColumn('pikkuUserId', 'text')
-            .addColumn('state', 'text')
+            .addColumn('openingData', ctx.text, (col) => col.notNull().defaultTo(ctx.defaultText('{}')))
+            .addColumn('pikkuUserId', ctx.text)
+            .addColumn('state', ctx.text)
             .addColumn('lastWire', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('channelSubscriptions')
-            .addColumn('channelId', 'text', (col) => col.notNull().references('channels.channelId').onDelete('cascade'))
-            .addColumn('topic', 'text', (col) => col.notNull())
+            .addColumn('channelId', ctx.key, (col) => ctx.references(col.notNull(), 'channels.channelId'))
+            .addColumn('topic', ctx.key, (col) => col.notNull())
             .addPrimaryKeyConstraint('channel_subscriptions_pk', [
             'channelId',
             'topic',
-        ]),
+        ])
+            .$call(ctx.foreignKeys('channelSubscriptions', {
+            channelId: 'channels.channelId',
+        })),
     ],
 };

package/dist/src/schema/credential.schema.js

@@ -14,22 +14,22 @@ export const credentialSchema = {
     name: 'credential',
     ownedBy: ['credentialService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('credentials')
             .addColumn('name', 'varchar(255)', (col) => col.notNull())
             .addColumn('userId', 'varchar(255)')
-            .addColumn('ciphertext', 'text', (col) => col.notNull())
-            .addColumn('wrappedDek', 'text', (col) => col.notNull())
+            .addColumn('ciphertext', ctx.text, (col) => col.notNull())
+            .addColumn('wrappedDek', ctx.text, (col) => col.notNull())
             .addColumn('keyVersion', 'integer', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        rawStatement(({ table }) => sql `CREATE UNIQUE INDEX credentials_name_user_id_unique ON ${table('credentials')} (name, COALESCE(user_id, ''))`),
-        (db) => db.schema
+        rawStatement(({ table, mysql }) => sql `CREATE UNIQUE INDEX credentials_name_user_id_unique ON ${table('credentials')} (name, ${mysql ? sql `(COALESCE(user_id, ''))` : sql `COALESCE(user_id, '')`})`),
+        (db, _types, ctx) => db.schema
             .createTable('credentialKekSalts')
             .addColumn('keyVersion', 'integer', (col) => col.primaryKey())
             .addColumn('salt', 'varchar(64)', (col) => col.notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('credentialsAudit')
             .addColumn('id', 'varchar(36)', (col) => col.primaryKey())
             .addColumn('credentialName', 'varchar(255)', (col) => col.notNull())

package/dist/src/schema/deployment.schema.js

@@ -3,28 +3,28 @@ import { sql } from 'kysely';
 export const deploymentSchema = {
     name: 'deployment',
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuDeployments')
-            .addColumn('deploymentId', 'text', (col) => col.primaryKey())
-            .addColumn('endpoint', 'text', (col) => col.notNull())
+            .addColumn('deploymentId', ctx.key, (col) => col.primaryKey())
+            .addColumn('endpoint', ctx.text, (col) => col.notNull())
             .addColumn('lastHeartbeat', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuDeploymentFunctions')
-            .addColumn('deploymentId', 'text', (col) => col
-            .notNull()
-            .references('pikkuDeployments.deploymentId')
-            .onDelete('cascade'))
-            .addColumn('functionName', 'text', (col) => col.notNull())
+            .addColumn('deploymentId', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuDeployments.deploymentId'))
+            .addColumn('functionName', ctx.key, (col) => col.notNull())
             .addPrimaryKeyConstraint('pikku_deployment_functions_pk', [
             'deploymentId',
             'functionName',
-        ]),
-        (db) => db.schema
+        ])
+            .$call(ctx.foreignKeys('pikkuDeploymentFunctions', {
+            deploymentId: 'pikkuDeployments.deploymentId',
+        })),
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_deployments_heartbeat')
             .on('pikkuDeployments')
             .column('lastHeartbeat'),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createIndex('idx_pikku_deployment_functions_name')
             .on('pikkuDeploymentFunctions')
             .column('functionName'),

package/dist/src/schema/flag.schema.js

@@ -17,14 +17,14 @@ export const flagSchema = {
     name: 'flag',
     ownedBy: ['featureFlags'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuFeatureFlags')
-            .addColumn('name', 'text', (col) => col.primaryKey())
-            .addColumn('description', 'text')
+            .addColumn('name', ctx.key, (col) => col.primaryKey())
+            .addColumn('description', ctx.text)
             // The declared `anyOf` scope list, as JSON. Read by the console to say
             // who would see the feature; never read on the request path, where the
             // capability half comes from the session's own scopes.
-            .addColumn('anyOf', 'text')
+            .addColumn('anyOf', ctx.text)
             // Off until somebody turns it on. A flag exists so a feature can ship
             // dark, so the row a deploy creates has to start closed — the opposite
             // default would make merging the declaration the moment of launch.
@@ -37,26 +37,29 @@ export const flagSchema = {
             // longer offered, awaiting `pikku flags prune`. The same additive
             // contract as `pikkuScopes.declared`.
             .addColumn('declared', 'boolean', (col) => col.defaultTo(true).notNull())
-            .addColumn('updatedBy', 'text')
+            .addColumn('updatedBy', ctx.text)
             // Why it was flipped. A kill switch is pulled during an incident, and
             // the one question afterwards is always who turned it off and why.
-            .addColumn('note', 'text')
+            .addColumn('note', ctx.text)
             .addColumn('updatedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull()),
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('pikkuFeatureFlagOverrides')
-            .addColumn('flag', 'text', (col) => col.notNull().references('pikkuFeatureFlags.name').onDelete('cascade'))
-            .addColumn('subjectId', 'text', (col) => col.notNull())
+            .addColumn('flag', ctx.key, (col) => ctx.references(col.notNull(), 'pikkuFeatureFlags.name'))
+            .addColumn('subjectId', ctx.key, (col) => col.notNull())
             // Which id this is, for the console to render. Resolution keys on the
             // id alone, because that is all the resolver has: it prefers the
             // organization and falls back to the user, and by then the two are one
             // string.
-            .addColumn('subjectKind', 'text', (col) => col.notNull())
+            .addColumn('subjectKind', ctx.text, (col) => col.notNull())
             .addColumn('enabled', 'boolean', (col) => col.notNull())
-            .addColumn('grantedBy', 'text')
+            .addColumn('grantedBy', ctx.text)
             .addColumn('grantedAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addPrimaryKeyConstraint('pikku_feature_flag_overrides_pk', [
             'flag',
             'subjectId',
-        ]),
+        ])
+            .$call(ctx.foreignKeys('pikkuFeatureFlagOverrides', {
+            flag: 'pikkuFeatureFlags.name',
+        })),
     ],
 };

package/dist/src/schema/incoming-webhook.schema.js

@@ -4,15 +4,15 @@ export const incomingWebhookSchema = {
     name: 'incoming-webhook',
     ownedBy: ['incomingWebhookService'],
     statements: [
-        (db) => db.schema
+        (db, _types, ctx) => db.schema
             .createTable('webhookReceipt')
-            .addColumn('receiptId', 'text', (col) => col.primaryKey())
-            .addColumn('source', 'text', (col) => col.notNull())
-            .addColumn('event', 'text', (col) => col.notNull())
-            .addColumn('providerEventId', 'text')
-            .addColumn('status', 'text', (col) => col.defaultTo('pending').notNull())
+            .addColumn('receiptId', ctx.key, (col) => col.primaryKey())
+            .addColumn('source', ctx.key, (col) => col.notNull())
+            .addColumn('event', ctx.key, (col) => col.notNull())
+            .addColumn('providerEventId', ctx.key)
+            .addColumn('status', ctx.text, (col) => col.defaultTo(ctx.defaultText('pending')).notNull())
             .addColumn('attempts', 'integer', (col) => col.defaultTo(0).notNull())
-            .addColumn('lastError', 'text')
+            .addColumn('lastError', ctx.text)
             .addColumn('createdAt', 'timestamp', (col) => col.defaultTo(sql `CURRENT_TIMESTAMP`).notNull())
             .addColumn('deliveredAt', 'timestamp'),
         (db) => db.schema