packages/cli/skills/pikku-kysely/SKILL.md
Use when setting up SQL database services with Kysely in a Pikku app. Covers @pikku/kysely (base), @pikku/kysely-postgres, @pikku/kysely-mysql, @pikku/kysely-sqlite — channel stores, workflow services, secret services, AI storage, agent runs, and deployment services. TRIGGER when: code uses Kysely, PikkuKysely, KyselyChannelStore, KyselyWorkflowService, KyselySecretService, or user asks about SQL database setup, Postgres/MySQL/SQLite with Pikku. DO NOT TRIGGER when: user asks about MongoDB (use pikku-mongodb) or Redis (use pikku-redis).
npx skillsauth add pikkujs/pikku pikku-kyselyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this skill as an execution checklist, not reference material.
pikku-meta when available; otherwise run the relevant pikku meta ... --json command and inspect only the focused output you need..pikku, node_modules, vendored packages, or broad build artifacts.pikku-verify or pikku all when functions, wirings, schemas, or generated clients may have changed.Pikku provides SQL database services through four packages:
@pikku/kysely — Base service implementations (database-agnostic)@pikku/kysely-postgres — PostgreSQL-specific implementations + PikkuKysely connection wrapper@pikku/kysely-mysql — MySQL-specific implementations@pikku/kysely-sqlite — SQLite-specific implementations + createSQLiteKysely factoryAll implement standard Pikku interfaces from @pikku/core.
# Pick your database
yarn add @pikku/kysely @pikku/kysely-postgres # PostgreSQL
yarn add @pikku/kysely @pikku/kysely-mysql # MySQL
yarn add @pikku/kysely @pikku/kysely-sqlite # SQLite
PikkuKyselyimport { PikkuKysely } from '@pikku/kysely-postgres'
const db = new PikkuKysely<DB>(
logger: Logger,
connectionOrConfig: postgres.Sql | postgres.Options | string,
defaultSchemaName?: string
)
await db.init()
db.kysely // Kysely<DB> instance for queries
await db.close()
createSQLiteKyselyimport { createSQLiteKysely } from '@pikku/kysely-sqlite'
const kysely = createSQLiteKysely(database: SqliteDatabase | (() => Promise<SqliteDatabase>))
Each database variant exports these services with a prefix (Pg, MySQL, SQLite, or base Kysely):
| Service | Interface | Purpose |
| --------------------- | ------------------------------------- | ---------------------------------------------- |
| *ChannelStore | ChannelStore | WebSocket channel state persistence |
| *EventHubStore | EventHubStore | Event hub state persistence |
| *WorkflowService | PikkuWorkflowService | Workflow definition storage |
| *WorkflowRunService | WorkflowRunService | Workflow execution tracking |
| *DeploymentService | DeploymentService | Deployment state management |
| *AIStorageService | AIStorageService, AIRunStateService | AI conversation/run storage |
| *AgentRunService | AgentRunService | Agent execution tracking |
| *SecretService | SecretService | Encrypted secret storage (envelope encryption) |
All services take a Kysely<KyselyPikkuDB> instance in their constructor and have an init() method that creates tables if needed.
import { PgKyselySecretService } from '@pikku/kysely-postgres'
const secrets = new PgKyselySecretService(db.kysely, {
kekSecret: 'your-key-encryption-key',
salt: 'your-salt',
})
await secrets.init()
await secrets.setSecretJSON('api-key', { key: 'sk-...' })
const value = await secrets.getSecretJSON<{ key: string }>('api-key')
await secrets.rotateKEK() // Re-encrypt all secrets with new KEK
import {
PikkuKysely,
PgKyselyChannelStore,
PgKyselyWorkflowService,
} from '@pikku/kysely-postgres'
const createSingletonServices = pikkuServices(async (config) => {
const logger = new PinoLogger()
const db = new PikkuKysely(logger, config.databaseUrl)
await db.init()
const channelStore = new PgKyselyChannelStore(db.kysely)
await channelStore.init()
const workflowService = new PgKyselyWorkflowService(db.kysely)
await workflowService.init()
return { config, logger, database: db, channelStore, workflowService }
})
import {
createSQLiteKysely,
SQLiteKyselyChannelStore,
} from '@pikku/kysely-sqlite'
import Database from 'better-sqlite3'
const kysely = createSQLiteKysely(new Database('app.db'))
const channelStore = new SQLiteKyselyChannelStore(kysely)
await channelStore.init()
import { MySQLKyselyWorkflowService } from '@pikku/kysely-mysql'
const workflowService = new MySQLKyselyWorkflowService(kyselyInstance)
await workflowService.init()
documentation
Deprecated — use pikku-middleware instead. Tag middleware (addTagMiddleware) is now documented as a section within the pikku-middleware skill, alongside global HTTP middleware, execution order, and the service-to-service bearer auth pattern.
testing
Use when adding authorization checks to Pikku functions or routes — pikkuPermission, pikkuAuth, per-function permissions, pattern-based permissions, or understanding OR/AND permission logic. TRIGGER when: user wants to restrict who can call a function, check resource ownership, add role-based access, or understand where permission checks belong. DO NOT TRIGGER when: user asks about middleware or request interception (use pikku-middleware), authentication strategies (use pikku-security), or session management.
testing
Use when adding any middleware to a Pikku app — global HTTP middleware, tag-scoped middleware (including service-to-service bearer auth), per-route middleware, session-setting middleware, or understanding middleware execution order and priority. TRIGGER when: user wants middleware on some or all routes, machine-to-machine auth, tag-scoped cross-cutting concerns, global interceptors, or middleware priority/order questions. DO NOT TRIGGER when: user asks about permissions/authorization checks (use pikku-permissions), auth strategies like authBearer/authCookie (use pikku-security), or deployment.
documentation
Standard cleanup to run right after a Pikku template is cloned or scaffolded into a new project. TRIGGER when: a Pikku template was just cloned/scaffolded (via `pikku create`, `git clone <template>`, or the user says "I cloned the kanban template / starter / template"), or the working tree still looks like an untouched template (template README, placeholder `@project/*` name in package.json). DO NOT TRIGGER when: working in an established project mid-feature, or editing the template repo itself.