Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@ingram-tech/nk-db@1.5.0

Minor Changes

• 3e6e51d: nk-pg-migrate refuses to under-apply, and reports what the migrator can't reach.

  drizzle's migrator picks what to run with when > max(created_at) — a
  high-water mark. A migration whose journal timestamp lands below an
  already-applied one is skipped, never recorded, and reported as success,
  and the gap is permanent. It doesn't register as drift either: the recorded
  rows still match the files positionally. Two branches generating migrations and
  merging in the other order produce exactly this, as does a hand-edited when.

  inspectMigrations now computes pending as a set difference on hash rather
  than by timestamp, and adds unreachable (pending files the migrator will
  never reach) and journalIssues (non-increasing when, gaps or repeats in
  idx). runMigrations throws the new MigrationOrderError instead of running
  a partial chain, naming the stranded migrations and the timestamp to clear;
  nk-pg-migrate --status reports both before a deploy.

  The fix it points at is raising the stranded entry's when in
  meta/_journal.json, which leaves the .sql — and so the hash every database
  recorded — untouched.

  MigrationFileMeta gains idx.

@ingram-tech/nk-dev@0.11.0

Minor Changes

• f2c9d94: New oxlint rule nextkit/no-redundant-node-crypto (warn): flags the
  node:crypto imports that are already on the Web Crypto global — randomUUID,
  getRandomValues, subtle and webcrypto. Each pins a module to a Node-only
  runtime for something it would have had regardless, and subtle/webcrypto
  aren't even different objects from globalThis.crypto.subtle/globalThis.crypto.
  Catches named imports, and member access through a namespace or default import
  of the module. The rest of node:crypto (createHash, createHmac,
  randomBytes, timingSafeEqual, …) has no drop-in global and is left alone, so
  the usual fix is trimming one name off an import list.

  This makes fleet-wide the invariant nk-db's id codec already holds by hand — its
  id.ts is pinned to an empty import list by a test whose comment names
  node:crypto for randomness as the tempting one, because a single Node-only
  import there would make every module that touches an id Node-only.

  Not autofixable: the call sites have to become member expressions on the global,
  and an import named crypto shadows the global it stands in for. Keep an import
  with a justified disable — node:crypto's randomUUID takes a
  disableEntropyCache option that Web Crypto's does not.

• 6c34702: Guard the drizzle migration chain: nk migrations and two new nk doctor findings.

  Applied migrations are immutable — the runner records sha256(file), so editing
  one after it has run drifts every database that applied it, and drizzle never
  looks at the file again to notice. nk migrations pins each file's hash in a
  committed drizzle/_seal.json and nk check fails on a mismatch, so the edit
  surfaces in the PR that made it instead of on the next deploy. --reseal is the
  deliberate-squash escape hatch, and its effect is visible in the diff.

  nk migrations --ddl (and a nk doctor finding) lists the migrations carrying
  DDL drizzle's snapshot cannot model — functions, triggers, DEFERRABLE
  constraints, grants, roles, extensions, materialized views. Those are outside
  db:generate's diff basis entirely, so a clean generate does not mean the chain
  reproduces the database, and anything regenerated from schema.ts drops them.

  Both run without a database. nk doctor also seals an unsealed chain on --fix.