@pikku/kysely 0.13.34 → 0.13.37

package/CHANGELOG.md

@@ -1,3 +1,85 @@
+## 0.13.37
+
+### Patch Changes
+
+- fdcc821: Fabric is gone from the open toolchain. The previous names are removed with no aliases.
+
+  The CLI group is `pikku cloud …` and the export is `@pikku/cli/cloud`. The project link is the `cloud` key of `pikku.config.json` (`cloud.projectId`), the CLI keeps its local state in `~/.pikkustudio` (run `pikku cloud login` again), and the project config file is `pikkustudio.config.json`.
+
+  Every environment variable drops the `FABRIC_` prefix for `PIKKUSTUDIO_` with the same suffix: `PIKKUSTUDIO_API_URL`, `PIKKUSTUDIO_PROJECT_ID`, `PIKKUSTUDIO_TOKEN`, `PIKKUSTUDIO_OPERATOR_TOKEN`, `PIKKUSTUDIO_AUTH_PUBLIC_KEY`, `PIKKUSTUDIO_STAGE_ID` and the rest. Rename them wherever you set them.
+
+  Wire ids: the operator sign-in route is `/sign-in/cloud`, the plugin and mode literal is `'cloud'`, the Better Auth plugin is `pikkuCloud`, its session field is `pikkustudioadmin`, and the signature header is `x-cloud-sig`. The cloud API calls are `getCloudLogs`, `getCloudLogsByStageKind`, `cloudCliProjects`, `cloudCliDeployments`, `providedByCloud` and `recordCloudAnalyticsEvents`. Addon packages are `@pikkustudio/*`, scaffolded files live under `scaffold/cloud` and `__cloud_*__`, and the API hosts are the `pikkustudio.app` and `pikkustudio.dev` domains.
+
+  `pikku skills install --fabric` is `--cloud`, the install group is `cloud`, and the skills are `pikku-cloud`, `pikku-cloud-debug`, `pikku-admin-to-cloud` and `pikku-blueprint-to-cloud`.
+
+  The stale analytics forwarder copies are removed from the online-shop example and the starter template.
+
+  The sealed-box salt stays `pikkufabric/sealed-box/v1`: it is a cryptographic constant that already-sealed secrets depend on.
+
+- 33b102d: Virtual users now have one name everywhere. The id column of `virtual_user_run` and `virtual_user_schedule` is `virtual_user_id` (a migration renames it in place), the CLI group is `pikku virtual-user …`, and the declarations and imports live under `@pikku/core/virtual-user`. The previous names are removed with no aliases.
+
+  The default virtual user email domain is now `virtualuser.invalid`: apps that rely on the default domain get new accounts at the next provisioning (`pikku virtual-user sync`, deploy, or `pikku dev` start), and the old rows stay unused.
+
+  The sign-in surface carries the same name. The route is `/sign-in/virtual-user`, the environment variables are `PIKKU_ALLOW_VIRTUAL_USER_SIGN_IN` and the `PIKKU_DEV_VIRTUAL_USER_SIGN_IN` / `VITE_*` equivalents, the Better Auth plugin is `pikkuVirtualUser`, the scenario step option and wire member are `virtualUser` and `virtualUsers`, and the Better Auth user flag column is `virtual_user`. Rename the environment variables wherever you set them, and add a migration that renames the flag column on the `user` table. Nothing is aliased.
+
+  The conversation runner is now `@pikku/core/virtual-user/conversation`, replacing the old `-flow` subpath. Update the import; the old subpath is gone.
+
+- Updated dependencies [fdcc821]
+- Updated dependencies [33b102d]
+- Updated dependencies [6a25c70]
+- Updated dependencies [a084c3b]
+  - @pikku/core@0.12.142
+
+## 0.13.36
+
+### Patch Changes
+
+- e0846b5: Saving an agent's tool messages skips a tool call whose result is undefined instead of writing it. When the browser driver for a scenario cannot be loaded, the error now includes the underlying cause and tells you to `bun add -D` it.
+- 884a1b5: MySQL: the `@pikku/kysely` stores no longer emit postgres/sqlite-only SQL. Upserts use `on duplicate key update`, insert-or-ignore uses `insert ignore`, `returning` deletes read the rows first, the lease clock casts to `signed`, workflow JSON state uses `CAST(... AS JSON)`, the agent thread owner `LIKE` escapes with `!`, and timestamp columns are written as `Date`s instead of `Z`-suffixed ISO strings. `pikku db generate` now emits the `scope` schema when Better Auth's user model is a mapped table (for example a Rails `users` table), typing the key column from the real `users.id`.
+- 51ec3ac: MySQL fixes found moving a Rails database onto pikku.
+
+  - The generated local services (`pikku db baseline`, `pikku dev`, `pikku all`, a local CLI) open MySQL: a `mysql://` `DATABASE_URL` or `mysqlUrl` in the config opens through a Kysely `MysqlDialect` on a `mysql2` pool (declare `mysql2` in the project), with `CamelCasePlugin` and the coercion map like the other dialects. A `mysql://` URL was read as a sqlite file path. `db/mysql` now counts as a project database, and `@pikku/kysely` re-exports `MysqlDialect`.
+  - MySQL migrations run with `FOREIGN_KEY_CHECKS` off, so a mysqldump whose tables reference ones created later applies as it is.
+  - `TINYINT(1)` is typed `boolean` and coerced at runtime (mysql2 returns 0/1); an explicit `tsType` in `db/annotations.ts` keeps it a number. `DECIMAL` is read as a number (`decimalNumbers`), as the generated types say. `BIGINT` stays `number`, exact to 2^53, which is mysql2's default.
+  - `pikku all` no longer throws "db/mysql exists but no mysqlUrl is configured": the server comes from createConfig's `mysqlUrl`, `db.mysqlUrl` or a `mysql://` `DATABASE_URL`, and with none the stub `DB` is written.
+  - Better Auth schema derivation follows the resolved database rather than the factory's `database.type`, so a factory declaring `type: 'sqlite'` no longer sends SQLite introspection (`pragma index_list`) to a MySQL server. Set `type: 'mysql'` in the factory too, so the runtime matches.
+
+- Updated dependencies [f396538]
+  - @pikku/core@0.12.140
+
+## 0.13.35
+
+### Patch Changes
+
+- 15c4968: The default runtime path no longer needs `node:*`, `Buffer` or an unguarded `process`, so it loads on edge runtimes (Web APIs only).
+
+  **Breaking:** `FileScenarioRunStore`, `scenarioArtifactContentType` and `scenarioRunSummary` leave the `@pikku/core/services` barrel because they use `node:fs`. Import them from `@pikku/core/services/file-scenario-run-store`. Pre-0.13 breaking changes still ship as a patch.
+
+  **Breaking:** the HMAC helpers in `@pikku/core/hmac` run on Web Crypto, which is async. `hmacSha256Hex`, `hmacDigest`, `verifyHmacSignature` and `verifyPublicKeySignature` now return a Promise; `timingSafeStringEqual` stays synchronous. `WebhookService.sign` and `WebhookService.verify` return a Promise, and so does `verifySlackSignature` in `@pikku/gateway-slack`: `await` them. A function-style `verify` on a webhook source may return a Promise as well. `verifyPublicKeySignature` accepts RSA and EC (P-256, P-384, P-521) PEM keys; Ed25519 and RSA-PSS keys verify as false.
+
+  `isProduction()` (and the `PIKKU_MODEL_ALIASES` and `PIKKU_ENV` reads) now ask the registered singleton services' `variables` service first, then `process.env` when `process` exists. With neither, `isProduction()` is true, so an edge deployment never exposes error details by accident. `LocalVariablesService` resolves its `process.env` default when constructed and falls back to an empty store without `process`.
+
+  Workflow invocation ids use a built-in SHA-1 and stay byte-identical. `@pikku/kysely` and the Cloudflare hibernation server use `globalThis.crypto.randomUUID()` and no `Buffer`; `@pikku/kysely` is marked `sideEffects: false`. `@pikku/ai-deepinfra` reads `DEEPINFRA_API_KEY` only when `process` exists and decodes base64 audio without `Buffer`.
+
+  Runtime tiers. A package declares where it can run in `package.json`: `"pikku": { "runtime": "edge" | "serverless" | "server" }`, with optional per-subpath overrides (`"exports": { "./dev": "server" }`). `server` is the default. `@pikku/core` and the default services are `edge` (core's Node-only subpaths are `server`), `@pikku/better-auth`, `@pikku/addon-admin` and `@pikku/cloudflare` are `serverless` (better-auth statically imports `node:crypto` scrypt), and `@pikku/addon-console` is `server` and must never land in a deployed unit.
+
+  `pikku deploy` now verifies each deployed unit before bundling it. The unit is bundled with esbuild (neutral platform, `workerd`/`worker`/`browser` conditions) under its tier's profile, ahead of the adapter's aliases and stubs so they cannot hide anything, and the build fails when the bundle holds a package declared above the unit's tier or a Node built-in the runtime does not provide. The error names the unit, package, import chain and the fix. A built-in the provider stubs is a warning. On an edge unit, a bundled `InMemory*` class also fails the build. The unit's tier is its `runtime`, else the project's own `pikku.runtime`, else the provider default (`serverless` on Cloudflare). Packages that declare nothing are judged by their imports only.
+
+  `ProviderAdapter.getRuntimeProfile(tier?)` returns the compat date, compat flags, the built-ins the runtime provides (keyed by compat date), the stubbed ones and the externals. The Cloudflare adapter derives `wrangler.toml`, the upload metadata and the bundle externals from it; `node:os` and `node:fs` are not provided before compat date 2025-09-15. The default is `nodejs_compat_v2` with compat date 2024-12-18, which is what `wrangler.toml` and Fabric's live workers already use, so Fabric deploys see no runtime change. Only the direct-API upload in `@pikku/deploy-cloudflare` (`createWorker`, used by its own `deploy()`) moves: it sent `nodejs_compat` with 2024-01-01 before. A newer date or flag is opt-in through the adapter option `new CloudflareProviderAdapter({ compatDate })` or `getCloudflareRuntimeProfile(tier, compatDate)`. From 2025-08-15 `node:http` and `node:https` exist, and from 2025-09-15 `node:os`, `node:fs` (stubbed by the build regardless) and `node:perf_hooks`; the verifier's allowed built-ins follow the effective date. A newer date changes the runtime of every worker deployed with it.
+
+  `declareScopes(['pikku:console'])` (from `@pikku/core/scope`) declares scopes by id without wiring anything. `wireAddon({ scopes })` only requires a scope of an addon's functions; the tree arrives with the addon's metadata, so a role granting `pikku:console` used to fail PKU124 unless the addon was wired, and a wired `@pikku/addon-console` lands in every unit carrying the `/rpc` catch-all. An app that grants the scope without the console now calls `declareScopes` and no longer needs the scaffold or the addon. When the addon is wired its tree and descriptions win and the bare id adds nothing.
+
+  More packages declare a tier after bundling each with the edge profile. `edge`: `@pikku/addon-graph`, `@pikku/pino`, `@pikku/jose`, `@pikku/ai-vercel`, `@pikku/ai-voice`. `serverless`: `@pikku/kysely-postgres` (postgres.js needs `node:buffer`, `stream`, `events`), `@pikku/backblaze` (`copyFile` reads a local file, which the build stubs), `@pikku/gateway-slack` (`@slack/web-api` imports `node:os` and `zlib`). `server`: `@pikku/schedule` (`cron` imports `child_process`), `@pikku/aws-services` (the AWS SDK's Node handler needs `node:http2`), `@pikku/browser` (puppeteer), and `@pikku/modelcontextprotocol` except its `./fetch` subpath, which is `edge`.
+
+  `@pikku/addon-graph` no longer needs `node:crypto` or `Buffer`: the Crypto function hashes and HMACs on Web Crypto (MD5 is built in, since Web Crypto has none) and encodes with `TextEncoder`/`atob`/`btoa`, with output unchanged.
+
+- Updated dependencies [6f11bb5]
+- Updated dependencies [0c67e33]
+- Updated dependencies [15c4968]
+- Updated dependencies [d75a23d]
+- Updated dependencies [9b12c8a]
+  - @pikku/core@0.12.138
+
 ## 0.13.34
 
 ### Patch Changes

package/dist/bin/pikku-kysely-pure.js

@@ -39,4 +39,7 @@ if (process.argv.length !== 4) {
     process.exit(1);
 }
 const [, , output, input] = process.argv;
-main(output, input);
+main(output, input).catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/src/classification-crypto.js

@@ -12,8 +12,22 @@ import { DEFAULT_KEY_ID } from '@pikku/core/classification';
  */
 export { DEFAULT_KEY_ID };
 const ENVELOPE_PREFIX = 'pikku1';
-const encodePart = (value) => Buffer.from(value, 'utf8').toString('base64url');
-const decodePart = (value) => Buffer.from(value, 'base64url').toString('utf8');
+/** base64url of the UTF-8 bytes, unpadded: `Buffer`-free, so it runs on edge runtimes. */
+const encodePart = (value) => {
+    let binary = '';
+    for (const byte of new TextEncoder().encode(value)) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const decodePart = (value) => {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return new TextDecoder().decode(bytes);
+};
 const serializeEnvelope = (envelope) => [
     ENVELOPE_PREFIX,
     encodePart(envelope.keyId),

package/dist/src/index.d.ts

@@ -22,12 +22,12 @@ export { KyselyAuditService } from './kysely-audit-service.js';
 export { KyselyAnalyticsService } from './kysely-analytics-service.js';
 export { KyselyVirtualUserRunStore } from './kysely-virtual-user-run-store.js';
 export { KyselyVirtualUserScheduleStore } from './kysely-virtual-user-schedule-store.js';
-export { CamelCasePlugin, Kysely, PostgresDialect } from 'kysely';
+export { CamelCasePlugin, Kysely, MysqlDialect, PostgresDialect } from 'kysely';
 export { SerializePlugin, BaseSerializePlugin, type Serializer, type Deserializer, } from './serialize-plugin.js';
 export { createCoercionPlugin, type ColumnKind, type CoercionMap, type CreateCoercionPluginOptions, } from './coercion-plugin.js';
 export { createClassificationPlugin, type CreateClassificationPluginOptions, } from './classification-plugin.js';
 export { ClassificationCrypto, DEFAULT_KEY_ID, isColumnEnvelope, parseColumnEnvelope, type ClassificationCryptoOptions, type ColumnEnvelope, type KEKResolver, type ResolvedKEK, } from './classification-crypto.js';
-export { agentSchema, analyticsSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, flagSchema, incomingWebhookSchema, leaseSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
+export { agentSchema, analyticsSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, flagSchema, incomingWebhookSchema, leaseSchema, scopeSchema, secretSchema, sessionSchema, triggerSourceSchema, virtualUserScheduleSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, withUserTable, type PikkuSchema, type RequiredTypes, type UnmetRequirement, type SchemaStatementFactory, } from './schema/index.js';
 export type { KyselyPikkuDB } from './kysely-tables.js';
 export type { WorkflowRunService } from '@pikku/core/workflow';
 export type { AgentRunService, AgentRunRow } from '@pikku/core/agent';

package/dist/src/index.js

@@ -24,9 +24,9 @@ export { KyselyVirtualUserScheduleStore } from './kysely-virtual-user-schedule-s
 // Re-exported so a generated file that constructs the services above opens and
 // types its database with the same copy of kysely those services were built
 // against, rather than a second copy the project may resolve on its own.
-export { CamelCasePlugin, Kysely, PostgresDialect } from 'kysely';
+export { CamelCasePlugin, Kysely, MysqlDialect, PostgresDialect } from 'kysely';
 export { SerializePlugin, BaseSerializePlugin, } from './serialize-plugin.js';
 export { createCoercionPlugin, } from './coercion-plugin.js';
 export { createClassificationPlugin, } from './classification-plugin.js';
 export { ClassificationCrypto, DEFAULT_KEY_ID, isColumnEnvelope, parseColumnEnvelope, } from './classification-crypto.js';
-export { agentSchema, analyticsSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, flagSchema, incomingWebhookSchema, leaseSchema, scopeSchema, secretSchema, sessionSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, } from './schema/index.js';
+export { agentSchema, analyticsSchema, auditSchema, channelSchema, credentialSchema, deploymentSchema, flagSchema, incomingWebhookSchema, leaseSchema, scopeSchema, secretSchema, sessionSchema, triggerSourceSchema, virtualUserScheduleSchema, virtualUserSchema, webhookSchema, workflowSchema, pikkuSchemas, requiredPikkuSchemas, applyPikkuSchemas, compilePikkuSchemas, requirePikkuSchema, resolveRequirements, withUserTable, } from './schema/index.js';

package/dist/src/kysely-agent-run-service.js

@@ -2,7 +2,7 @@ import { sql } from 'kysely';
 import { parseJson } from './kysely-json.js';
 // Owner ids routinely contain `_` (e.g. `user_123`), which LIKE treats as a
 // single-character wildcard — so a raw prefix would match a foreign owner.
-const escapeLikePattern = (value) => value.replace(/[\\%_]/g, (char) => `\\${char}`);
+const escapeLikePattern = (value) => value.replace(/[!%_]/g, (char) => `!${char}`);
 export class KyselyAgentRunService {
     db;
     constructor(db) {
@@ -37,7 +37,7 @@ export class KyselyAgentRunService {
         if (owners) {
             query = query.where((eb) => eb.or(owners.flatMap((owner) => [
                 eb('t.resourceId', '=', owner),
-                eb('t.resourceId', 'like', sql `${`${escapeLikePattern(owner)}:%`} escape '\\'`),
+                eb('t.resourceId', 'like', sql `${`${escapeLikePattern(owner)}:%`} escape '!'`),
             ])));
         }
         const result = await query

package/dist/src/kysely-agent-storage-service.js

@@ -1,6 +1,7 @@
 import { parseJson } from './kysely-json.js';
 import { getRunScores, saveRunScore } from './kysely-agent-run-scores.js';
 import { requirePikkuSchema } from './schema/index.js';
+import { upsert } from './kysely-upsert.js';
 import { agentSchema } from './schema/agent.schema.js';
 export class KyselyAgentStorageService {
     db;
@@ -216,6 +217,8 @@ export class KyselyAgentStorageService {
             if (!toolMsg.toolResults)
                 continue;
             for (const tr of toolMsg.toolResults) {
+                if (tr.result === undefined)
+                    continue;
                 await this.db
                     .updateTable('agentToolCall')
                     .set({ result: tr.result })
@@ -241,19 +244,12 @@ export class KyselyAgentStorageService {
         return parseJson(row.data);
     }
     async saveWorkingMemory(id, scope, data) {
-        await this.db
-            .insertInto('agentWorkingMemory')
-            .values({
+        await upsert(this.db, this.db.insertInto('agentWorkingMemory').values({
             id,
             scope,
             data: JSON.stringify(data),
             updatedAt: new Date(),
-        })
-            .onConflict((oc) => oc.columns(['id', 'scope']).doUpdateSet({
-            data: JSON.stringify(data),
-            updatedAt: new Date(),
-        }))
-            .execute();
+        }), ['id', 'scope'], { data: JSON.stringify(data), updatedAt: new Date() }).execute();
     }
     async createRun(run) {
         const runId = crypto.randomUUID();

package/dist/src/kysely-analytics-service.js

@@ -1,4 +1,5 @@
 import { requirePikkuSchema } from './schema/index.js';
+import { insertOrIgnore } from './kysely-upsert.js';
 import { analyticsSchema } from './schema/analytics.schema.js';
 const jsonOrNull = (value) => value != null ? JSON.stringify(value) : null;
 /**
@@ -71,10 +72,6 @@ export class KyselyAnalyticsService {
             consent: jsonOrNull(record.userIdentity?.consent),
             props: jsonOrNull(record.props),
         }));
-        await this.db
-            .insertInto('pikkuAnalyticsEvents')
-            .values(rows)
-            .onConflict((oc) => oc.doNothing())
-            .execute();
+        await insertOrIgnore(this.db, this.db.insertInto('pikkuAnalyticsEvents').values(rows)).execute();
     }
 }

package/dist/src/kysely-audit-service.js

@@ -1,4 +1,5 @@
 import { requirePikkuSchema } from './schema/index.js';
+import { insertOrIgnore } from './kysely-upsert.js';
 import { auditSchema } from './schema/audit.schema.js';
 const jsonOrNull = (v) => v != null ? JSON.stringify(v) : null;
 const parseJson = (v) => {
@@ -122,11 +123,7 @@ export class KyselyAuditService {
                 data: jsonOrNull(e.metadata),
             };
         });
-        await this.db
-            .insertInto('audit')
-            .values(rows)
-            .onConflict((oc) => oc.doNothing())
-            .execute();
+        await insertOrIgnore(this.db, this.db.insertInto('audit').values(rows)).execute();
     }
     /**
      * A page of the trail, newest first.

package/dist/src/kysely-credential-service.js

@@ -1,5 +1,6 @@
 import { deriveKEK, envelopeDecrypt, envelopeEncrypt, envelopeRewrap, generateKEKSalt, } from '@pikku/core/crypto-utils';
 import { requirePikkuSchema } from './schema/index.js';
+import { insertOrIgnore, timestampParam } from './kysely-upsert.js';
 import { credentialSchema } from './schema/credential.schema.js';
 export class KyselyCredentialService {
     db;
@@ -37,7 +38,7 @@ export class KyselyCredentialService {
             credentialName: name,
             userId: userId ?? null,
             action,
-            performedAt: new Date().toISOString(),
+            performedAt: timestampParam(this.db),
         })
             .execute();
     }
@@ -52,15 +53,11 @@ export class KyselyCredentialService {
             .executeTakeFirst();
         let salt = existing?.salt;
         if (!salt) {
-            await this.db
-                .insertInto('credentialKekSalts')
-                .values({
+            await insertOrIgnore(this.db, this.db.insertInto('credentialKekSalts').values({
                 keyVersion: version,
                 salt: generateKEKSalt(),
-                createdAt: new Date().toISOString(),
-            })
-                .onConflict((oc) => oc.column('keyVersion').doNothing())
-                .execute();
+                createdAt: timestampParam(this.db),
+            }), ['keyVersion']).execute();
             const row = await this.db
                 .selectFrom('credentialKekSalts')
                 .select('salt')
@@ -110,7 +107,7 @@ export class KyselyCredentialService {
     async set(name, value, userId) {
         const plaintext = JSON.stringify(value);
         const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), plaintext);
-        const now = new Date().toISOString();
+        const now = timestampParam(this.db);
         const exists = await this.has(name, userId);
         if (exists) {
             let qb = this.db
@@ -212,7 +209,7 @@ export class KyselyCredentialService {
                 .set({
                 wrappedDek: newWrappedDEK,
                 keyVersion: this.keyVersion,
-                updatedAt: new Date().toISOString(),
+                updatedAt: timestampParam(this.db),
             })
                 .where('name', '=', row.name);
             qb = this.whereUserId(qb, row.userId ?? undefined);

package/dist/src/kysely-deployment-service.js

@@ -1,6 +1,7 @@
 import { buildRemoteHeaders } from '@pikku/core/remote';
 import { getAllFunctionNames } from '@pikku/core/function';
 import { requirePikkuSchema } from './schema/index.js';
+import { upsert } from './kysely-upsert.js';
 import { deploymentSchema } from './schema/deployment.schema.js';
 export class KyselyDeploymentService {
     db;
@@ -28,18 +29,11 @@ export class KyselyDeploymentService {
         const functions = config.functions ?? getAllFunctionNames();
         this.deploymentConfig = { ...config, functions };
         await this.db.transaction().execute(async (trx) => {
-            await trx
-                .insertInto('pikkuDeployments')
-                .values({
+            await upsert(trx, trx.insertInto('pikkuDeployments').values({
                 deploymentId: config.deploymentId,
                 endpoint: config.endpoint,
                 lastHeartbeat: new Date(),
-            })
-                .onConflict((oc) => oc.column('deploymentId').doUpdateSet({
-                endpoint: config.endpoint,
-                lastHeartbeat: new Date(),
-            }))
-                .execute();
+            }), ['deploymentId'], { endpoint: config.endpoint, lastHeartbeat: new Date() }).execute();
             await trx
                 .deleteFrom('pikkuDeploymentFunctions')
                 .where('deploymentId', '=', config.deploymentId)
@@ -54,7 +48,10 @@ export class KyselyDeploymentService {
                     .execute();
             }
         });
-        this.heartbeatTimer = setInterval(() => this.sendHeartbeat(), this.heartbeatInterval);
+        this.heartbeatTimer = setInterval(() => {
+            // sendHeartbeat catches its own errors; it retries on the next tick
+            void this.sendHeartbeat();
+        }, this.heartbeatInterval);
     }
     async stop() {
         if (this.heartbeatTimer) {

package/dist/src/kysely-eventhub-store.js

@@ -1,4 +1,5 @@
 import { EventHubStore } from '@pikku/core/channel';
+import { insertOrIgnore } from './kysely-upsert.js';
 export class KyselyEventHubStore extends EventHubStore {
     db;
     initialized = false;
@@ -22,11 +23,9 @@ export class KyselyEventHubStore extends EventHubStore {
     }
     async subscribe(topic, channelId) {
         try {
-            await this.db
+            await insertOrIgnore(this.db, this.db
                 .insertInto('channelSubscriptions')
-                .values({ channelId: channelId, topic: topic })
-                .onConflict((oc) => oc.columns(['channelId', 'topic']).doNothing())
-                .execute();
+                .values({ channelId: channelId, topic: topic }), ['channelId', 'topic']).execute();
             return true;
         }
         catch {

package/dist/src/kysely-feature-flag-store.d.ts

@@ -20,9 +20,9 @@ export declare class KyselyFeatureFlagStore extends CachedFlagSource implements
     syncFlags(flags: DeclaredFlag[]): Promise<void>;
     listFlags(): Promise<FlagRow[]>;
     listOverrides(key: string): Promise<FlagOverrideRow[]>;
-    setEnabled(key: string, enabled: boolean, actor?: string, note?: string): Promise<void>;
-    setRollout(key: string, percent: number | null, actor?: string): Promise<void>;
-    setOverride(key: string, subject: FlagSubject, enabled: boolean, actor?: string): Promise<void>;
+    setEnabled(key: string, enabled: boolean, virtualUser?: string, note?: string): Promise<void>;
+    setRollout(key: string, percent: number | null, virtualUser?: string): Promise<void>;
+    setOverride(key: string, subject: FlagSubject, enabled: boolean, virtualUser?: string): Promise<void>;
     clearOverride(key: string, subject: FlagSubject): Promise<void>;
     findStaleFlags(): Promise<string[]>;
     /**

package/dist/src/kysely-feature-flag-store.js

@@ -1,5 +1,6 @@
 import { CachedFlagSource, subjectIdOf } from '@pikku/core/flag';
 import { requirePikkuSchema } from './schema/index.js';
+import { INSERTED, isMysql, upsert } from './kysely-upsert.js';
 import { flagSchema } from './schema/flag.schema.js';
 /**
  * Reads the stored `anyOf`, which arrives as either shape.
@@ -77,25 +78,16 @@ export class KyselyFeatureFlagStore extends CachedFlagSource {
         this.setDeclared(flags);
         await this.db.transaction().execute(async (trx) => {
             for (const flag of flags) {
-                await trx
-                    .insertInto('pikkuFeatureFlags')
-                    .values({
-                    name: flag.name,
-                    description: flag.description ?? null,
-                    anyOf: flag.anyOf ? JSON.stringify(flag.anyOf) : null,
-                    declared: true,
-                })
-                    .onConflict((oc) => 
                 // `enabled`, `rolloutPercent` and every override are the operator's
                 // and are never touched here. A deploy that re-enabled a flag
                 // somebody killed an hour earlier would make the kill switch
                 // useless exactly when it is being relied on.
-                oc.column('name').doUpdateSet((eb) => ({
-                    description: eb.ref('excluded.description'),
-                    anyOf: eb.ref('excluded.anyOf'),
+                await upsert(trx, trx.insertInto('pikkuFeatureFlags').values({
+                    name: flag.name,
+                    description: flag.description ?? null,
+                    anyOf: flag.anyOf ? JSON.stringify(flag.anyOf) : null,
                     declared: true,
-                })))
-                    .execute();
+                }), ['name'], { description: INSERTED, anyOf: INSERTED, declared: true }).execute();
             }
             const markStale = trx
                 .updateTable('pikkuFeatureFlags')
@@ -140,12 +132,12 @@ export class KyselyFeatureFlagStore extends CachedFlagSource {
                 : undefined,
         }));
     }
-    async setEnabled(key, enabled, actor, note) {
+    async setEnabled(key, enabled, virtualUser, note) {
         await this.db
             .updateTable('pikkuFeatureFlags')
             .set({
             enabled,
-            updatedBy: actor ?? null,
+            updatedBy: virtualUser ?? null,
             note: note ?? null,
             updatedAt: new Date(),
         })
@@ -153,7 +145,7 @@ export class KyselyFeatureFlagStore extends CachedFlagSource {
             .execute();
         this.invalidate();
     }
-    async setRollout(key, percent, actor) {
+    async setRollout(key, percent, virtualUser) {
         if (percent !== null && (percent < 0 || percent > 100)) {
             throw new Error(`Feature flag '${key}': rollout must be between 0 and 100, got ${percent}.`);
         }
@@ -161,38 +153,34 @@ export class KyselyFeatureFlagStore extends CachedFlagSource {
             .updateTable('pikkuFeatureFlags')
             .set({
             rolloutPercent: percent === null ? null : Math.round(percent),
-            updatedBy: actor ?? null,
+            updatedBy: virtualUser ?? null,
             updatedAt: new Date(),
         })
             .where('name', '=', key)
             .execute();
         this.invalidate();
     }
-    async setOverride(key, subject, enabled, actor) {
+    async setOverride(key, subject, enabled, virtualUser) {
         const subjectId = subjectIdOf(subject);
         if (!subjectId) {
             throw new Error(`Feature flag '${key}': an override needs an organization or a user to be about.`);
         }
-        await this.db
-            .insertInto('pikkuFeatureFlagOverrides')
-            .values({
+        // `grantedAt` is rewritten too: the column defaults on insert only, and the
+        // panel reads it as when the pin was last granted — not when the subject
+        // was first pinned to something else.
+        await upsert(this.db, this.db.insertInto('pikkuFeatureFlagOverrides').values({
             flag: key,
             subjectId,
             subjectKind: subject.organizationId ? 'organization' : 'user',
             enabled,
-            grantedBy: actor ?? null,
+            grantedBy: virtualUser ?? null,
             grantedAt: new Date(),
-        })
-            .onConflict((oc) => oc.columns(['flag', 'subjectId']).doUpdateSet((eb) => ({
-            enabled: eb.ref('excluded.enabled'),
-            subjectKind: eb.ref('excluded.subjectKind'),
-            grantedBy: eb.ref('excluded.grantedBy'),
-            // The column defaults on insert only, and the panel reads this as
-            // when the pin was last granted — not when the subject was first
-            // pinned to something else.
-            grantedAt: eb.ref('excluded.grantedAt'),
-        })))
-            .execute();
+        }), ['flag', 'subjectId'], {
+            enabled: INSERTED,
+            subjectKind: INSERTED,
+            grantedBy: INSERTED,
+            grantedAt: INSERTED,
+        }).execute();
         this.invalidate();
     }
     async clearOverride(key, subject) {
@@ -225,15 +213,33 @@ export class KyselyFeatureFlagStore extends CachedFlagSource {
      * live flag and cascade away every override an operator had set on it.
      */
     async pruneFlags() {
-        const deleted = await this.db
-            .deleteFrom('pikkuFeatureFlags')
-            .where('declared', '=', false)
-            .returning('name')
-            .execute();
-        if (deleted.length === 0) {
+        // MySQL has no `returning`: the matching names are read under a lock in the
+        // same transaction as the delete, so what is reported is what was deleted.
+        const names = await this.db.transaction().execute(async (trx) => {
+            if (isMysql(trx)) {
+                const rows = await trx
+                    .selectFrom('pikkuFeatureFlags')
+                    .select('name')
+                    .where('declared', '=', false)
+                    .forUpdate()
+                    .execute();
+                await trx
+                    .deleteFrom('pikkuFeatureFlags')
+                    .where('declared', '=', false)
+                    .execute();
+                return rows.map((row) => row.name);
+            }
+            const deleted = await trx
+                .deleteFrom('pikkuFeatureFlags')
+                .where('declared', '=', false)
+                .returning('name')
+                .execute();
+            return deleted.map((row) => row.name);
+        });
+        if (names.length === 0) {
             return [];
         }
         this.invalidate();
-        return deleted.map((row) => row.name).sort();
+        return names.sort();
     }
 }

package/dist/src/kysely-lease-clock.d.ts

@@ -9,6 +9,6 @@ import { type RawBuilder } from 'kysely';
  * worker shares. This default binds the process clock, for SQLite, where the
  * database lives in the process anyway.
  */
-export declare const appNowMs: () => RawBuilder<number>;
+export declare const appNowMs: (mysql?: boolean) => RawBuilder<number>;
 /** `now + ms`, for a lease that runs `ms` from the clock's now. */
 export declare const leaseUntil: (now: RawBuilder<number>, ms: number) => RawBuilder<number>;

package/dist/src/kysely-lease-clock.js

@@ -9,6 +9,10 @@ import { sql } from 'kysely';
  * worker shares. This default binds the process clock, for SQLite, where the
  * database lives in the process anyway.
  */
-export const appNowMs = () => sql `cast(${Date.now()} as bigint)`;
+export const appNowMs = (mysql = false) => 
+// MySQL has no `bigint` to cast to; `signed` is its 64-bit integer.
+mysql
+    ? sql `cast(${Date.now()} as signed)`
+    : sql `cast(${Date.now()} as bigint)`;
 /** `now + ms`, for a lease that runs `ms` from the clock's now. */
 export const leaseUntil = (now, ms) => sql `${now} + ${ms}`;

package/dist/src/kysely-lease-service.js

@@ -1,5 +1,6 @@
 import { appNowMs, leaseUntil } from './kysely-lease-clock.js';
 import { requirePikkuSchema } from './schema/index.js';
+import { insertOrIgnore, isMysql } from './kysely-upsert.js';
 import { leaseSchema } from './schema/lease.schema.js';
 const toLease = (row) => ({
     key: row.key,
@@ -31,15 +32,13 @@ export class KyselyLeaseService {
     }
     /** Now, in epoch milliseconds, on the clock leases are judged by. */
     nowMs() {
-        return appNowMs();
+        return appNowMs(isMysql(this.db));
     }
     /** Create the key's row, lapsed, unless it already has one. */
     async insertIfAbsent(key, holder) {
-        await this.db
+        await insertOrIgnore(this.db, this.db
             .insertInto('pikkuLease')
-            .values({ key, holder, token: 0, expiresAt: 0 })
-            .onConflict((oc) => oc.column('key').doNothing())
-            .execute();
+            .values({ key, holder, token: 0, expiresAt: 0 }), ['key']).execute();
     }
     /**
      * The row is created lapsed and then taken by the same guarded `UPDATE` as