@ingram-tech/nk-db 0.9.0 → 1.0.0

package/README.md

@@ -3,7 +3,7 @@
 The Ingram **Postgres data layer**: one TLS-aware `pg` pool, raw-SQL helpers,
 Drizzle wiring, and a **PGlite** (no-Docker) dev/test harness. It consolidates
 the `src/lib/db/` layer that several products each hand-rolled when they moved
-off Supabase. Design + rationale:
+to self-hosted Postgres. Design + rationale:
 [`docs/db-package.md`](https://github.com/ingram-technologies/nextkit/blob/main/docs/db-package.md).
 
 `pg` and `drizzle-orm` are **peer dependencies** (one copy in the app).
@@ -17,12 +17,10 @@ bun add @ingram-tech/nk-db pg drizzle-orm
 bun add -d @electric-sql/pglite @electric-sql/pglite-socket   # for PGlite dev/test
 ```
 
-Env contract (validated by `keys.ts`; resolves in precedence order):
+Env contract (validated by `keys.ts`):
 
 ```dotenv
-DATABASE_URL=…            # direct Postgres (session pooler / :5432), NOT PostgREST
-# fallbacks, for running on Supabase Postgres before the data moves:
-# POSTGRES_URL_NON_POOLING / POSTGRES_URL
+DATABASE_URL=…            # direct Postgres (session pooler / :5432), not a REST proxy
 DATABASE_CA_CERT=…        # optional PEM CA → verify-full
 DATABASE_SSL=true         # optional
 DATABASE_POOL_MAX=5       # optional; keep small on serverless
@@ -51,23 +49,21 @@ same pool: `betterAuth({ database: pool, … })`.
 - **Raw helpers** (`createQueries(pool)`) are the escape hatch — Postgres
   functions (`select fn($1,…)`), `pgmq` draining, `pg_trgm`. Signatures match the
   hand-rolled originals, so adopting is a find-and-replace of the import.
-- **`configureTimestampsAsStrings()`** — opt-in, for legacy row types that expect
-  `timestamptz` as ISO strings (on the golden path, prefer Drizzle's
-  `timestamp(..., { mode: "string" })` per column).
 - **`pgTimestampToIso(value)` / `pgNumericToNumber(value)`** — response-boundary
-  coercions for schemas written against supabase-js. `pg`/Drizzle return
-  `numeric` as a string and `timestamp(..., { mode: "string" })` as Postgres'
-  text form; these convert to the `z.number()` / strict `z.iso.datetime()` shapes
-  those schemas expect. Presentation only — keep money math on the decimal value.
+  coercions for strict schemas. `pg`/Drizzle return `numeric` as a string and
+  `timestamp(..., { mode: "string" })` as Postgres' text form; these convert to
+  the `z.number()` / strict `z.iso.datetime()` shapes such schemas expect.
+  Presentation only — keep money math on the decimal value. For string timestamps
+  prefer Drizzle's `timestamp(..., { mode: "string" })` per column.
 
 ## Keeping RLS on a direct connection (`withRls` / `withRlsTransaction`)
 
-A direct `pg`/Drizzle connection has no PostgREST, so the `SET ROLE authenticated`
-+ `request.jwt.claims` setup that made `auth.uid()` policies fire is gone — a
-plain query runs as the connection's role with no claims. These helpers reproduce
-that setup **per transaction**, so your **existing RLS policies keep working
-unchanged**, whether you're still on Supabase Postgres or already on DO. It's
-pure Postgres and behaves identically on both.
+A plain `pg`/Drizzle connection runs as the connection's role with **no request
+claims**, so `auth.uid()` policies can't fire — nothing populates the
+`request.jwt.claims` they read. These helpers set the claims GUC + `SET LOCAL
+ROLE` **per transaction**, so your **existing RLS policies keep working
+unchanged**, wherever the cluster lives. It's pure Postgres and behaves
+identically everywhere.
 
 ```ts
 import { withRlsTransaction } from "@ingram-tech/nk-db";
@@ -82,7 +78,7 @@ const notes = await withRlsTransaction(db, { sub: session.user.id }, (tx) =>
 ```
 
 The claims come **straight from the Better Auth session** (`sub` = `user.id`) — no
-JWT minting, no JWKS issuer, no `supabase.auth`. The raw helpers expose the same
+JWT minting, no JWKS issuer, no third-party auth bridge. The raw helpers expose the same
 thing as `withRls` (sibling of `withTx`):
 
 ```ts
@@ -96,18 +92,17 @@ Two requirements **you** own (they can't be enforced from the library):
 
 - **Connect as a role that doesn't bypass RLS** for user-facing rows — not the
   table owner, not a `BYPASSRLS` superuser. After `SET ROLE authenticated`, RLS
-  applies even if the underlying connection is `postgres` (exactly what PostgREST
-  relied on). Service-role/admin paths keep using plain `db` / `query` and bypass
-  RLS as before.
+  applies even when the underlying connection is a superuser. Service-role/admin
+  paths keep using plain `db` / `query` and bypass RLS as before.
 - **The connecting role must be allowed to `SET ROLE`** to the target
-  (Supabase's `authenticator`/`postgres` already can; on DO, `GRANT app_user TO …`).
+  (on DO, `GRANT app_user TO the_connecting_role`).
 
 Override the role / claims GUC when your DB role name differs from the JWT claim:
 `withRlsTransaction(db, { sub }, fn, { role: "app_user" })`. Both helpers set the
 GUCs **transaction-locally** (`is_local = true`), so they reset at
 commit/rollback and never leak across pooled connections. See
 [`docs/db-package.md` §RLS](https://github.com/ingram-technologies/nextkit/blob/main/docs/db-package.md)
-and [`docs/better-auth-migration.md`](https://github.com/ingram-technologies/nextkit/blob/main/docs/better-auth-migration.md).
+and the [`@ingram-tech/nk-auth`](https://github.com/ingram-technologies/nextkit/blob/main/packages/nk-auth) README.
 
 ## PGlite dev & test (`@ingram-tech/nk-db/pglite`)
 

package/dist/coerce.d.ts

@@ -2,9 +2,9 @@
  * Normalize a Postgres timestamp string to a strict ISO-8601 UTC string
  * ("2026-06-21T18:22:08.331Z"), the form `z.iso.datetime()` (no offset) accepts.
  *
- * `Date` parses both Postgres' space-separated form and supabase-js's `+00:00`
- * offset form to the same instant, and `.toISOString()` emits the canonical
- * `T…Z`. `null` passes through.
+ * `Date` parses both Postgres' space-separated form and the `+00:00` offset
+ * form to the same instant, and `.toISOString()` emits the canonical `T…Z`.
+ * `null` passes through.
  */
 export declare function pgTimestampToIso(value: string): string;
 export declare function pgTimestampToIso(value: null): null;

package/dist/coerce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAcA;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AACpD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;AAKtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AACrD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC"}
+{"version":3,"file":"coerce.d.ts","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACxD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AACpD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;AAKtE;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AACrD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC"}

package/dist/coerce.js

@@ -1,12 +1,11 @@
 // Coerce Postgres value representations back to the JS types app code expects.
 //
-// Why these exist: response/validation schemas in nextkit sites are typically
-// written against supabase-js / PostgREST, which parsed `timestamptz` into ISO
-// strings and `numeric` into JS numbers. Direct `pg` (and Drizzle on top of it)
-// surfaces those columns differently — `numeric` as a string (to avoid losing
-// precision), and `timestamp(..., { mode: "string" })` as Postgres' own text
-// form ("2026-06-21 18:22:08.331494+00", space separator, short offset). Neither
-// satisfies a schema expecting `z.number()` / strict `z.iso.datetime()`.
+// Why these exist: `pg` (and Drizzle on top of it) surfaces some columns in a
+// form a strict response/validation schema rejects — `numeric` as a string (to
+// avoid losing precision), and `timestamp(..., { mode: "string" })` as Postgres'
+// own text form ("2026-06-21 18:22:08.331494+00", space separator, short
+// offset). Neither satisfies a schema expecting `z.number()` / strict
+// `z.iso.datetime()`.
 //
 // Use these at the read/response boundary when handing Drizzle/`pg` rows to such
 // a schema. They are presentation coercions, not domain math — keep money

package/dist/coerce.js.map

@@ -1 +1 @@
-{"version":3,"file":"coerce.js","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AACzE,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AAavE,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACpD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACrD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"coerce.js","sourceRoot":"","sources":["../src/coerce.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,yEAAyE;AACzE,sEAAsE;AACtE,sBAAsB;AACtB,EAAE;AACF,iFAAiF;AACjF,0EAA0E;AAC1E,uEAAuE;AAavE,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACpD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC9D,CAAC;AAaD,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACrD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC"}

package/dist/drizzle.d.ts

@@ -16,7 +16,7 @@ export declare const createDb: <TSchema extends Record<string, unknown>>(pool: P
 type DrizzleTx<TSchema extends Record<string, unknown>> = Parameters<Parameters<NodePgDatabase<TSchema>["transaction"]>[0]>[0];
 /**
  * Run `fn` inside a Drizzle transaction **scoped to a user**, so RLS policies
- * apply on a direct connection (no PostgREST). It sets `request.jwt.claims` +
+ * apply on a direct connection. It sets `request.jwt.claims` +
  * `SET LOCAL ROLE` (default `authenticated`) as the first statement, so existing
  * `auth.uid()` policies fire unchanged; the `tx` passed to `fn` is a normal
  * Drizzle transaction (full query builder + `tx.execute`). Use for user-facing

package/dist/drizzle.js

@@ -14,7 +14,7 @@ import { resolveRlsConfig } from "./rls.js";
 export const createDb = (pool, schema) => drizzle(pool, { schema });
 /**
  * Run `fn` inside a Drizzle transaction **scoped to a user**, so RLS policies
- * apply on a direct connection (no PostgREST). It sets `request.jwt.claims` +
+ * apply on a direct connection. It sets `request.jwt.claims` +
  * `SET LOCAL ROLE` (default `authenticated`) as the first statement, so existing
  * `auth.uid()` policies fire unchanged; the `tx` passed to `fn` is a normal
  * Drizzle transaction (full query builder + `tx.execute`). Use for user-facing

package/dist/index.d.ts

@@ -5,5 +5,4 @@ export { type DbEnv, dbEnv, getDatabaseUrl, isConfigured } from "./keys.js";
 export { type CreatePoolConfig, createPool } from "./pool.js";
 export { createQueries, parseMaybeRow, parseOneRow, parseRows, type PoolQueries, type Queries, type RowsResult, } from "./queries.js";
 export { RLS_CLAIMS_SETTING, RLS_DEFAULT_ROLE, type ResolvedRlsConfig, type RlsClaims, type RlsOptions, resolveRlsConfig, rlsPreamble, } from "./rls.js";
-export { configureTimestampsAsStrings } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EACN,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,UAAU,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EACN,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,EACT,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,UAAU,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -8,5 +8,4 @@ export { dbEnv, getDatabaseUrl, isConfigured } from "./keys.js";
 export { createPool } from "./pool.js";
 export { createQueries, parseMaybeRow, parseOneRow, parseRows, } from "./queries.js";
 export { RLS_CLAIMS_SETTING, RLS_DEFAULT_ROLE, resolveRlsConfig, rlsPreamble, } from "./rls.js";
-export { configureTimestampsAsStrings } from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,qBAAqB;AAErB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAc,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAyB,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EACN,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,GAIT,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAIhB,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E;AAC9E,qBAAqB;AAErB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAc,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAyB,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EACN,aAAa,EACb,aAAa,EACb,WAAW,EACX,SAAS,GAIT,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,kBAAkB,EAClB,gBAAgB,EAIhB,gBAAgB,EAChB,WAAW,GACX,MAAM,UAAU,CAAC"}

package/dist/keys.d.ts

@@ -5,13 +5,8 @@
  * @ingram-tech/nk-auth). Env vars are external input, so we parse them with Zod
  * (per docs/code-style.md) rather than reading `process.env` ad hoc.
  *
- * The connection string resolves in a fixed precedence so an app can deploy the
- * direct-`pg` code **while still pointed at Supabase Postgres**, before any data
- * has moved (see docs/db-package.md and the Supabase->Postgres playbook):
- *
- *   1. DATABASE_URL                 — our DO cluster (or the local PGlite socket)
- *   2. POSTGRES_URL_NON_POOLING     — Supabase integration's direct URL
- *   3. POSTGRES_URL                 — Supabase integration's pooled URL
+ * The connection string comes from `DATABASE_URL` — our DO cluster, or the local
+ * PGlite socket in dev (see docs/db-package.md).
  *
  * Optional TLS / pool controls:
  *   DATABASE_SSL        — booleanish flag; only "true" sets DbEnv.ssl, but other
@@ -30,9 +25,9 @@ export interface DbEnv {
     poolMax?: number;
 }
 /**
- * Resolve the connection string from the environment by precedence, without
- * validating the rest of the contract. Returns `undefined` if none is set —
- * useful for "is a database configured?" checks (e.g. degrade in local dev).
+ * Resolve the connection string from the environment, without validating the
+ * rest of the contract. Returns `undefined` if unset — useful for "is a database
+ * configured?" checks (e.g. degrade in local dev).
  */
 export declare const getDatabaseUrl: (env?: NodeJS.ProcessEnv) => string | undefined;
 /**

package/dist/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgBH,MAAM,WAAW,KAAK;IACrB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,GAAG,EAAE,OAAO,CAAC;IACb,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAK,MAAM,CAAC,UAAwB,KAClC,MAAM,GAAG,SACyD,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,KAAK,QAAO,KAqBxB,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,QAAO,OAAyC,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAcH,MAAM,WAAW,KAAK;IACrB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,GAAG,EAAE,OAAO,CAAC;IACb,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAK,MAAM,CAAC,UAAwB,KAClC,MAAM,GAAG,SAA6B,CAAC;AAE1C;;;;GAIG;AACH,eAAO,MAAM,KAAK,QAAO,KAoBxB,CAAC;AAEF,mFAAmF;AACnF,eAAO,MAAM,YAAY,QAAO,OAAyC,CAAC"}

package/dist/keys.js

@@ -5,13 +5,8 @@
  * @ingram-tech/nk-auth). Env vars are external input, so we parse them with Zod
  * (per docs/code-style.md) rather than reading `process.env` ad hoc.
  *
- * The connection string resolves in a fixed precedence so an app can deploy the
- * direct-`pg` code **while still pointed at Supabase Postgres**, before any data
- * has moved (see docs/db-package.md and the Supabase->Postgres playbook):
- *
- *   1. DATABASE_URL                 — our DO cluster (or the local PGlite socket)
- *   2. POSTGRES_URL_NON_POOLING     — Supabase integration's direct URL
- *   3. POSTGRES_URL                 — Supabase integration's pooled URL
+ * The connection string comes from `DATABASE_URL` — our DO cluster, or the local
+ * PGlite socket in dev (see docs/db-package.md).
  *
  * Optional TLS / pool controls:
  *   DATABASE_SSL        — booleanish flag; only "true" sets DbEnv.ssl, but other
@@ -22,8 +17,6 @@
 import { z } from "zod";
 const schema = z.object({
     DATABASE_URL: z.string().min(1).optional(),
-    POSTGRES_URL_NON_POOLING: z.string().min(1).optional(),
-    POSTGRES_URL: z.string().min(1).optional(),
     // Booleanish, but tolerant: only "true" flips DbEnv.ssl, yet libpq-style
     // values (disable/require/prefer/…) are accepted rather than throwing —
     // createPool decides TLS from the CA cert + host, never from this flag.
@@ -32,11 +25,11 @@ const schema = z.object({
     DATABASE_POOL_MAX: z.coerce.number().int().positive().optional(),
 });
 /**
- * Resolve the connection string from the environment by precedence, without
- * validating the rest of the contract. Returns `undefined` if none is set —
- * useful for "is a database configured?" checks (e.g. degrade in local dev).
+ * Resolve the connection string from the environment, without validating the
+ * rest of the contract. Returns `undefined` if unset — useful for "is a database
+ * configured?" checks (e.g. degrade in local dev).
  */
-export const getDatabaseUrl = (env = process.env) => env.DATABASE_URL ?? env.POSTGRES_URL_NON_POOLING ?? env.POSTGRES_URL;
+export const getDatabaseUrl = (env = process.env) => env.DATABASE_URL;
 /**
  * Read and validate the nk-db env vars at once. Throws a single error listing
  * everything missing/invalid so a misconfigured site fails fast at startup
@@ -52,8 +45,7 @@ export const dbEnv = () => {
     }
     const connectionString = getDatabaseUrl();
     if (!connectionString) {
-        throw new Error("@ingram-tech/nk-db: no database connection string — set DATABASE_URL " +
-            "(or POSTGRES_URL_NON_POOLING / POSTGRES_URL).");
+        throw new Error("@ingram-tech/nk-db: no database connection string — set DATABASE_URL.");
     }
     return {
         connectionString,

package/dist/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAaH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,MAAyB,OAAO,CAAC,GAAG,EACf,EAAE,CACvB,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,wBAAwB,IAAI,GAAG,CAAC,YAAY,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,GAAU,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,gBAAgB,GAAG,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACd,uEAAuE;YACtE,+CAA+C,CAChD,CAAC;IACH,CAAC;IACD,OAAO;QACN,gBAAgB;QAChB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QACpC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM;QACxC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB;KACtC,CAAC;AACH,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,cAAc,EAAE,KAAK,SAAS,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAaH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,MAAyB,OAAO,CAAC,GAAG,EACf,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,GAAU,EAAE;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;aAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,gBAAgB,GAAG,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACd,uEAAuE,CACvE,CAAC;IACH,CAAC;IACD,OAAO;QACN,gBAAgB;QAChB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QACpC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM;QACxC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB;KACtC,CAAC;AACH,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,GAAY,EAAE,CAAC,cAAc,EAAE,KAAK,SAAS,CAAC"}

package/dist/pglite/index.js

@@ -70,7 +70,7 @@ export const startPgliteDev = async (options = {}) => {
         dataDir: options.dataDir ?? ".pglite",
         ...options,
     });
-    console.log(`nk(pglite): Postgres 18 (WASM) ready on ${databaseUrl} — no Docker, no Supabase CLI`);
+    console.log(`nk(pglite): Postgres 18 (WASM) ready on ${databaseUrl} — no Docker, no external service`);
     const child = spawn("bunx", ["next", "dev", "--turbopack", ...(options.nextArgs ?? [])], { stdio: "inherit", env: { ...process.env, DATABASE_URL: databaseUrl } });
     let closing = false;
     const close = async (code) => {

package/dist/pglite/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pglite/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,uEAAuE;AACvE,iFAAiF;AACjF,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAmB,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgC/C;2EAC2E;AAC3E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAmB,EAAE,CAClD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC/B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEJ,MAAM,cAAc,GACnB,CAAC,gBAAwB,EAAE,EAAE,CAC7B,KAAK,EAAE,EAAU,EAAiB,EAAE;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAChE,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACtC,UAA+B,EAAE,EACT,EAAE;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;IAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,OAAO;QACjB,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAClE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,WAAW,GAAG,kCAAkC,IAAI,IAAI,IAAI,WAAW,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAClC,UAAyD,EAAE,EAC3C,EAAE;IAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC;QACtD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;QACrC,GAAG,OAAO;KACV,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CACV,2CAA2C,WAAW,+BAA+B,CACrF,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAClB,MAAM,EACN,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAC3D,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,CACxE,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACnD,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAYF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAChC,UAA+B,EAAE,EACf,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GACT,OAAO,CAAC,IAAI;QACZ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW;YACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,GAAkB,EAAE,CACjC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAwB,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACvC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/pglite/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iFAAiF;AACjF,uEAAuE;AACvE,iFAAiF;AACjF,sBAAsB;AACtB,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAmB,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgC/C;2EAC2E;AAC3E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAmB,EAAE,CAClD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC/B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEJ,MAAM,cAAc,GACnB,CAAC,gBAAwB,EAAE,EAAE,CAC7B,KAAK,EAAE,EAAU,EAAiB,EAAE;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAChE,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACtC,UAA+B,EAAE,EACT,EAAE;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;IAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,OAAO;QACjB,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAClE,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3D,IAAI,eAAe,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,MAAM,WAAW,GAAG,kCAAkC,IAAI,IAAI,IAAI,WAAW,CAAC;IAC9E,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACtC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAClC,UAAyD,EAAE,EAC3C,EAAE;IAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC;QACtD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS;QACrC,GAAG,OAAO;KACV,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CACV,2CAA2C,WAAW,mCAAmC,CACzF,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,CAClB,MAAM,EACN,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,EAC3D,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,CACxE,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACnD,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,IAAI,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC;AAYF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAChC,UAA+B,EAAE,EACf,EAAE;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GACT,OAAO,CAAC,IAAI;QACZ,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW;YACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YACjC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,GAAkB,EAAE,CACjC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAwB,GAAG,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACvC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC,CAAC"}

package/dist/pool.d.ts

@@ -7,6 +7,21 @@ export interface CreatePoolConfig {
     /** Pool size cap. Defaults to env DATABASE_POOL_MAX, or 1 for a local socket. */
     max?: number;
 }
+/**
+ * Un-escape a PEM CA cert that arrived with literal `\n` instead of real
+ * newlines. A multiline secret survives intact in the app's runtime env (e.g.
+ * Vercel hands `process.env.DATABASE_CA_CERT` back with real newlines), but
+ * `vercel env pull` — and most `.env` serializers — collapse it to a single
+ * quoted line with `\n` escapes. A caller that then sources that file (the
+ * `nk-pg-migrate` runner, a CI job) gets the literal-`\n` form, which OpenSSL
+ * rejects with "self-signed certificate in certificate chain" even though the
+ * deployed app verifies the very same cert fine. Normalise here, the one place
+ * the cert reaches `pg`, so every caller gets verify-full regardless of how the
+ * env was loaded. A correctly-newlined PEM contains no literal `\n`, so this is
+ * a no-op there — idempotent and safe (base64 + the BEGIN/END lines never
+ * contain a backslash).
+ */
+export declare const normalizeCaCert: (caCert: string | undefined) => string | undefined;
 /**
  * The one shared `pg.Pool`. Reuse this for everything — app queries (via
  * `createQueries` / Drizzle) AND Better Auth's adapter — so there's exactly one
@@ -18,8 +33,8 @@ export interface CreatePoolConfig {
  *   - `caCert` set  -> verify the server cert + hostname (`sslmode=verify-full`).
  *   - local host    -> no TLS, and cap at `max: 1` (the PGlite socket server is
  *                      single-connection/multiplexed; a larger pool breaks dev).
- *   - otherwise     -> TLS **without** chain verification. Managed certs (DO,
- *                      Supabase) aren't in Node's trust store, so full
+ *   - otherwise     -> TLS **without** chain verification. Managed certs (e.g.
+ *                      DigitalOcean) aren't in Node's trust store, so full
  *                      verification fails with "self-signed certificate in
  *                      certificate chain"; the link is still encrypted. `sslmode`
  *                      is stripped from the URL because `pg` ignores the `ssl`

package/dist/pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAG3C,MAAM,WAAW,gBAAgB;IAChC,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAKD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAQ,gBAAqB,KAAG,IA6B1D,CAAC"}
+{"version":3,"file":"pool.d.ts","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAG3C,MAAM,WAAW,gBAAgB;IAChC,8EAA8E;IAC9E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAKD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SACN,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAQ,gBAAqB,KAAG,IA6B1D,CAAC"}

package/dist/pool.js

@@ -1,6 +1,21 @@
 import { Pool } from "pg";
 import { dbEnv } from "./keys.js";
 const isLocal = (connectionString) => connectionString.includes("127.0.0.1") || connectionString.includes("localhost");
+/**
+ * Un-escape a PEM CA cert that arrived with literal `\n` instead of real
+ * newlines. A multiline secret survives intact in the app's runtime env (e.g.
+ * Vercel hands `process.env.DATABASE_CA_CERT` back with real newlines), but
+ * `vercel env pull` — and most `.env` serializers — collapse it to a single
+ * quoted line with `\n` escapes. A caller that then sources that file (the
+ * `nk-pg-migrate` runner, a CI job) gets the literal-`\n` form, which OpenSSL
+ * rejects with "self-signed certificate in certificate chain" even though the
+ * deployed app verifies the very same cert fine. Normalise here, the one place
+ * the cert reaches `pg`, so every caller gets verify-full regardless of how the
+ * env was loaded. A correctly-newlined PEM contains no literal `\n`, so this is
+ * a no-op there — idempotent and safe (base64 + the BEGIN/END lines never
+ * contain a backslash).
+ */
+export const normalizeCaCert = (caCert) => caCert?.includes("\\n") ? caCert.replace(/\\n/g, "\n") : caCert;
 /**
  * The one shared `pg.Pool`. Reuse this for everything — app queries (via
  * `createQueries` / Drizzle) AND Better Auth's adapter — so there's exactly one
@@ -12,8 +27,8 @@ const isLocal = (connectionString) => connectionString.includes("127.0.0.1") ||
  *   - `caCert` set  -> verify the server cert + hostname (`sslmode=verify-full`).
  *   - local host    -> no TLS, and cap at `max: 1` (the PGlite socket server is
  *                      single-connection/multiplexed; a larger pool breaks dev).
- *   - otherwise     -> TLS **without** chain verification. Managed certs (DO,
- *                      Supabase) aren't in Node's trust store, so full
+ *   - otherwise     -> TLS **without** chain verification. Managed certs (e.g.
+ *                      DigitalOcean) aren't in Node's trust store, so full
  *                      verification fails with "self-signed certificate in
  *                      certificate chain"; the link is still encrypted. `sslmode`
  *                      is stripped from the URL because `pg` ignores the `ssl`
@@ -29,7 +44,7 @@ export const createPool = (config = {}) => {
     if (!connectionString) {
         throw new Error("@ingram-tech/nk-db: createPool needs a connection string.");
     }
-    const caCert = config.caCert ?? env?.caCert;
+    const caCert = normalizeCaCert(config.caCert ?? env?.caCert);
     const local = isLocal(connectionString);
     const max = config.max ?? env?.poolMax ?? (local ? 1 : undefined);
     const base = max === undefined ? {} : { max };

package/dist/pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"pool.js","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAWlC,MAAM,OAAO,GAAG,CAAC,gBAAwB,EAAW,EAAE,CACrD,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAA2B,EAAE,EAAQ,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,EAAE,gBAAgB,CAAC;IAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElE,MAAM,IAAI,GAAe,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAE1D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,IAAI,CAAC;YACf,GAAG,IAAI;YACP,gBAAgB;YAChB,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC;QACf,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;QAChC,GAAG,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE;KAClC,CAAC,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,IAAI,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAWlC,MAAM,OAAO,GAAG,CAAC,gBAAwB,EAAW,EAAE,CACrD,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAA0B,EAAsB,EAAE,CACjF,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAA2B,EAAE,EAAQ,EAAE;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,EAAE,gBAAgB,CAAC;IAC1E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElE,MAAM,IAAI,GAAe,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAE1D,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,IAAI,CAAC;YACf,GAAG,IAAI;YACP,gBAAgB;YAChB,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7C,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO,IAAI,IAAI,CAAC;QACf,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG,CAAC,QAAQ,EAAE;QAChC,GAAG,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE;KAClC,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/queries.d.ts

@@ -59,8 +59,8 @@ export interface PoolQueries extends Queries {
     /**
      * Like `withTx`, but first **scopes the transaction to a user** so RLS
      * policies apply: it sets `request.jwt.claims` + `SET LOCAL ROLE` (default
-     * `authenticated`) before `fn`, reproducing what PostgREST did. Use this for
-     * user-facing reads/writes on a direct connection; keep `withTx` / `query`
+     * `authenticated`) before `fn`, so `auth.uid()`-style policies fire. Use this
+     * for user-facing reads/writes on a direct connection; keep `withTx` / `query`
      * for service-role paths that should bypass RLS. The connection role must not
      * bypass RLS for the rows touched — see `rls.ts`.
      */

package/dist/rls.d.ts

@@ -1,26 +1,20 @@
 /**
- * Row-Level Security for a **direct Postgres connection** (no PostgREST).
+ * Row-Level Security for a **direct Postgres connection** (`pg` / Drizzle).
  *
- * On Supabase, PostgREST is what made RLS work: per request it did
- * `SET ROLE authenticated` and set `request.jwt.claims` from the user's JWT, so
- * policies written against `auth.uid()` fired. The moment a site queries Postgres
- * directly (`pg` / Drizzle) — whether it's still on Supabase Postgres or has
- * moved to our DigitalOcean cluster — that setup is gone, and a plain connection
- * runs as the connection's role with **no claims**, so RLS is either bypassed
- * (privileged role) or denies everything.
- *
- * These helpers reproduce exactly what PostgREST did, per transaction: set the
- * claims GUC and `SET LOCAL ROLE`, so **existing `auth.uid()` policies keep
- * working unchanged**. It is pure Postgres, so it behaves identically on Supabase
- * and on DO. See `docs/db-package.md` (§RLS) and `docs/better-auth-migration.md`.
+ * A plain connection runs as the connection's role with **no request claims**, so
+ * RLS is either bypassed (privileged role) or denies everything. These helpers
+ * scope a transaction the way a JWT-claims RLS setup needs: per transaction they
+ * set the `request.jwt.claims` GUC and `SET LOCAL ROLE`, so policies written
+ * against `auth.uid()` (i.e. `current_setting('request.jwt.claims') ->> 'sub'`)
+ * fire correctly. It is pure Postgres. See `docs/db-package.md` (§RLS).
  *
  * Two requirements the caller owns (documented, not enforceable here):
  *   1. The pool must connect as a role that **does not bypass RLS** for the rows
  *      it touches — i.e. not the table owner and not a `BYPASSRLS` superuser for
  *      user-facing reads. (After `SET ROLE authenticated`, RLS applies even if the
- *      underlying connection is `postgres`, exactly as PostgREST relied on.)
+ *      underlying connection is a superuser.)
  *   2. The connecting role must be allowed to `SET ROLE` to the target role
- *      (Supabase's `authenticator`/`postgres` can; on DO, `GRANT app_user TO …`).
+ *      (e.g. `GRANT app_user TO the_connecting_role`).
  */
 /**
  * The JWT-style claims to scope a transaction by. `sub` becomes `auth.uid()`;
@@ -30,8 +24,8 @@
  */
 export interface RlsClaims {
     /**
-     * The user id. Becomes the `sub` claim → `auth.uid()`. For Supabase-style
-     * policies that cast `sub` to `uuid`, this MUST be a valid UUID.
+     * The user id. Becomes the `sub` claim → `auth.uid()`. For policies that cast
+     * `sub` to `uuid`, this MUST be a valid UUID.
      */
     sub: string;
     /** The Postgres role to assume (the JWT `role` claim). Defaults to `"authenticated"`. */
@@ -52,7 +46,7 @@ export interface RlsOptions {
 }
 /** The role assumed when neither `options.role` nor `claims.role` is set. */
 export declare const RLS_DEFAULT_ROLE = "authenticated";
-/** The GUC `auth.uid()` / `auth.role()` read; what PostgREST populated. */
+/** The GUC `auth.uid()` / `auth.role()` policies read claims from. */
 export declare const RLS_CLAIMS_SETTING = "request.jwt.claims";
 /** The concrete values a transaction is scoped with. */
 export interface ResolvedRlsConfig {

package/dist/rls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../src/rls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IACjC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,SAAS,EACjB,UAAS,UAAe,KACtB,iBAID,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GACvB,QAAQ,iBAAiB,KACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAGjC,CAAC"}
+{"version":3,"file":"rls.d.ts","sourceRoot":"","sources":["../src/rls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IAC1B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,wDAAwD;AACxD,MAAM,WAAW,iBAAiB;IACjC,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,SAAS,EACjB,UAAS,UAAe,KACtB,iBAID,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,GACvB,QAAQ,iBAAiB,KACvB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAGjC,CAAC"}

package/dist/rls.js

@@ -1,30 +1,24 @@
 /**
- * Row-Level Security for a **direct Postgres connection** (no PostgREST).
+ * Row-Level Security for a **direct Postgres connection** (`pg` / Drizzle).
  *
- * On Supabase, PostgREST is what made RLS work: per request it did
- * `SET ROLE authenticated` and set `request.jwt.claims` from the user's JWT, so
- * policies written against `auth.uid()` fired. The moment a site queries Postgres
- * directly (`pg` / Drizzle) — whether it's still on Supabase Postgres or has
- * moved to our DigitalOcean cluster — that setup is gone, and a plain connection
- * runs as the connection's role with **no claims**, so RLS is either bypassed
- * (privileged role) or denies everything.
- *
- * These helpers reproduce exactly what PostgREST did, per transaction: set the
- * claims GUC and `SET LOCAL ROLE`, so **existing `auth.uid()` policies keep
- * working unchanged**. It is pure Postgres, so it behaves identically on Supabase
- * and on DO. See `docs/db-package.md` (§RLS) and `docs/better-auth-migration.md`.
+ * A plain connection runs as the connection's role with **no request claims**, so
+ * RLS is either bypassed (privileged role) or denies everything. These helpers
+ * scope a transaction the way a JWT-claims RLS setup needs: per transaction they
+ * set the `request.jwt.claims` GUC and `SET LOCAL ROLE`, so policies written
+ * against `auth.uid()` (i.e. `current_setting('request.jwt.claims') ->> 'sub'`)
+ * fire correctly. It is pure Postgres. See `docs/db-package.md` (§RLS).
  *
  * Two requirements the caller owns (documented, not enforceable here):
  *   1. The pool must connect as a role that **does not bypass RLS** for the rows
  *      it touches — i.e. not the table owner and not a `BYPASSRLS` superuser for
  *      user-facing reads. (After `SET ROLE authenticated`, RLS applies even if the
- *      underlying connection is `postgres`, exactly as PostgREST relied on.)
+ *      underlying connection is a superuser.)
  *   2. The connecting role must be allowed to `SET ROLE` to the target role
- *      (Supabase's `authenticator`/`postgres` can; on DO, `GRANT app_user TO …`).
+ *      (e.g. `GRANT app_user TO the_connecting_role`).
  */
 /** The role assumed when neither `options.role` nor `claims.role` is set. */
 export const RLS_DEFAULT_ROLE = "authenticated";
-/** The GUC `auth.uid()` / `auth.role()` read; what PostgREST populated. */
+/** The GUC `auth.uid()` / `auth.role()` policies read claims from. */
 export const RLS_CLAIMS_SETTING = "request.jwt.claims";
 /** Resolve claims + options into the role, GUC name, and serialized claims. */
 export const resolveRlsConfig = (claims, options = {}) => ({

package/dist/rls.js.map

@@ -1 +1 @@
-{"version":3,"file":"rls.js","sourceRoot":"","sources":["../src/rls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAgCH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAYvD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,MAAiB,EACjB,UAAsB,EAAE,EACJ,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB;IACrD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,kBAAkB;IAC1D,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAC1B,MAAyB,EACY,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,+DAA+D;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;CAC9D,CAAC,CAAC"}
+{"version":3,"file":"rls.js","sourceRoot":"","sources":["../src/rls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAgCH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAYvD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,MAAiB,EACjB,UAAsB,EAAE,EACJ,EAAE,CAAC,CAAC;IACxB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB;IACrD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,kBAAkB;IAC1D,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;CAClC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAC1B,MAAyB,EACY,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,+DAA+D;IACrE,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;CAC9D,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-db",
-	"version": "0.9.0",
+	"version": "1.0.0",
 	"description": "The Ingram Postgres data layer: one TLS-aware pg pool, raw-SQL helpers, Drizzle wiring, and a PGlite (no-Docker) dev/test harness for Next.js sites.",
 	"license": "MIT",
 	"type": "module",
@@ -66,7 +66,7 @@
 	"devDependencies": {
 		"@electric-sql/pglite": "^0.5.0",
 		"@electric-sql/pglite-socket": "^0.2.4",
-		"@ingram-tech/nk-dev": "workspace:*",
+		"@ingram-tech/nk-dev": "0.2.4",
 		"@types/node": "^25.0.0",
 		"@types/pg": "^8.11.0",
 		"drizzle-orm": "^0.45.0",

package/dist/types.d.ts

@@ -1,16 +0,0 @@
-/**
- * Opt-in: keep `timestamptz` / `timestamp` columns as the raw ISO **strings**
- * Postgres sends, instead of letting `pg` parse them into JS `Date`s.
- *
- * Why this exists: supabase-js / PostgREST returned timestamps as strings, and
- * Supabase-generated row types declare them `string`. After moving to direct
- * `pg`, the same columns come back as `Date`, which silently breaks any code
- * doing string ops on them (and mismatches the generated types). Call this once
- * at startup if your row types expect strings.
- *
- * Note: with Drizzle you usually express this per-column instead
- * (`timestamp(..., { mode: "string" })`), so reach for that first on the golden
- * path; this global switch is for the raw-helper / legacy-types case.
- */
-export declare const configureTimestampsAsStrings: () => void;
-//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,QAAO,IAI/C,CAAC"}

package/dist/types.js

@@ -1,24 +0,0 @@
-import pg from "pg";
-/** Postgres type OIDs we care about. */
-const TIMESTAMPTZ_OID = 1184;
-const TIMESTAMP_OID = 1114;
-/**
- * Opt-in: keep `timestamptz` / `timestamp` columns as the raw ISO **strings**
- * Postgres sends, instead of letting `pg` parse them into JS `Date`s.
- *
- * Why this exists: supabase-js / PostgREST returned timestamps as strings, and
- * Supabase-generated row types declare them `string`. After moving to direct
- * `pg`, the same columns come back as `Date`, which silently breaks any code
- * doing string ops on them (and mismatches the generated types). Call this once
- * at startup if your row types expect strings.
- *
- * Note: with Drizzle you usually express this per-column instead
- * (`timestamp(..., { mode: "string" })`), so reach for that first on the golden
- * path; this global switch is for the raw-helper / legacy-types case.
- */
-export const configureTimestampsAsStrings = () => {
-    const keep = (value) => value;
-    pg.types.setTypeParser(TIMESTAMPTZ_OID, keep);
-    pg.types.setTypeParser(TIMESTAMP_OID, keep);
-};
-//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,wCAAwC;AACxC,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAS,EAAE;IACtD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC;IAC9C,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC9C,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC"}