@ingram-tech/nk-dev 0.10.0 → 0.11.1

package/README.md

@@ -3,7 +3,8 @@
 The nextkit **dev toolchain in one package**. Everything a site needs at
 development time — and nothing that ships to production — lives here:
 
-- the **`nk` CLI** (`nk dev` / `format` / `lint` / `knip` / `ast-grep` / `check` / `type-check` / `test` / `build`, plus `nk doctor`);
+- the **`nk` CLI** (`nk dev` / `format` / `lint` / `knip` / `ast-grep` / `migrations` / `check` / `type-check` / `test` / `build`, plus
+  `nk doctor`);
 - the shared **oxlint + oxfmt**, **TypeScript**, and **Vitest** config;
 - **knip** (unused dependency / export / file detection), bundled and run by `nk check`;
 - the **oxfmt format-on-commit** git hook (`nextkit-format-staged`);
@@ -80,7 +81,10 @@ tsc), so versions stay under each site's control — nk just orchestrates.
   skips files that already exist.
 - **`nk doctor [--fix]`** — report drift from the canonical nk-dev toolchain
   (superseded deps, config `extends`, package.json scripts, the agent-guide
-  import, a stale `.prettierignore`); `--fix` applies the auto-fixable findings.
+  import, a stale `.prettierignore`, an unsealed migration chain and the DDL in
+  it drizzle can't model, a page under `app/auth/` shadowing a Better Auth
+  endpoint — static segments beat the `[...all]` catch-all, so such a page
+  silently 405s the endpoint); `--fix` applies the auto-fixable findings.
 - **`nk dev`** — start the Next dev server on the golden-path local database
   (see [`db-package.md`](https://github.com/ingram-technologies/nextkit/blob/main/docs/db-package.md)):
   - **PGlite** — if `@ingram-tech/nk-db`'s `nk-pglite-dev` bin resolves, hand off
@@ -92,6 +96,14 @@ tsc), so versions stay under each site's control — nk just orchestrates.
   generated (drizzle migrations, `pg_dump` baselines, pglite fixtures).
 - **`nk lint`** — `oxlint`.
 - **`nk knip`** — `knip` (unused dependencies / exports / files).
+- **`nk migrations [--check|--reseal|--ddl]`** — guard the `drizzle/` migration
+  chain, with no database involved. Verifies each file against the hashes in
+  `drizzle/_seal.json` and seals newly generated ones; `--check` verifies
+  without writing (what `nk check` runs); `--reseal` rewrites every hash for a
+  deliberate squash; `--ddl` lists the migrations carrying DDL drizzle's
+  snapshot can't model. Details in
+  [`db-package.md`](https://github.com/ingram-technologies/nextkit/blob/main/docs/db-package.md#the-seal-applied-migrations-are-immutable).
+  A no-op on sites without a migration journal.
 - **`nk ast-grep [...]`** — structural search & rewrite of TS/TSX by AST pattern,
   via the vendored [ast-grep](https://ast-grep.github.io) (args passed through to
   it). For large mechanical refactors — import rewrites, API renames, call-shape
@@ -99,8 +111,8 @@ tsc), so versions stay under each site's control — nk just orchestrates.
   apply → `nk format` + `nk type-check`) and its syntactic-not-semantic limits
   live in the codemod skill, `skills/ts-codemod.md`.
 - **`nk check`** — `oxlint` + `oxfmt --check` + `knip` (only when the repo has a
-  knip config) + the agent-guide import gate. The CI gate; runs every checker and
-  reports them all before failing.
+  knip config) + the agent-guide import gate + the migration seal. The CI gate;
+  runs every checker and reports them all before failing.
 - **`nk type-check`** — `next typegen && tsc --noEmit`.
 - **`nk test [...]`** — `vitest run`, extra args passed through.
 - **`nk build [...]`** — `next build`, extra args passed through.

package/bin/nk.js

@@ -5,6 +5,7 @@ import { doctor } from "../lib/doctor.js";
 import { format } from "../lib/format.js";
 import { init } from "../lib/init.js";
 import { knip } from "../lib/knip.js";
+import { migrations } from "../lib/migrations.js";
 import { build, check, clean, lint, test, typeCheck } from "../lib/passthrough.js";
 
 const USAGE = `nk — the nextkit CLI
@@ -16,17 +17,23 @@ Commands:
                       oxfmt / TypeScript / Vitest config, the format-on-commit
                       hook, and the agent-guide import. Skips files that exist.
   doctor [--fix]      Report drift from the canonical nk-dev toolchain (scripts,
-                      superseded deps, config extends, guide import); --fix applies.
+                      superseded deps, config extends, guide import, auth pages
+                      shadowing Better Auth endpoints); --fix applies.
   dev                 Start the Next dev server (Turbopack). Boots local PGlite
                       first when @ingram-tech/nk-db is installed (no Docker).
   format [--check]    Format code with oxfmt. --check verifies without writing.
   lint [...]          Lint with oxlint (extra args passed through, e.g. --fix).
   knip                Find unused dependencies / exports / files with knip.
+  migrations [...]    Guard the drizzle migration chain: verify that no applied
+                      migration's bytes changed, and seal newly generated ones.
+                      --check verifies without writing (CI); --reseal rewrites
+                      every hash (a deliberate squash); --ddl lists the DDL
+                      drizzle's snapshot cannot model.
   ast-grep [...]      Structural search & rewrite of TS/TSX by AST pattern
                       (vendored ast-grep; args passed through). For large
                       mechanical refactors — see the codemod skill.
   check               The CI gate: lint + format verify + knip (when configured)
-                      + the agent-guide import gate.
+                      + the agent-guide import gate + the migration seal.
   type-check          next typegen && tsc --noEmit. Recovers automatically when
                       generated types are damaged (e.g. a killed dev server).
   clean               Remove regenerable build artifacts: Next's generated
@@ -58,6 +65,9 @@ switch (cmd) {
 	case "knip":
 		knip(rest);
 		break;
+	case "migrations":
+		migrations(rest);
+		break;
 	case "ast-grep":
 		astGrep(rest);
 		break;

package/guide.md

@@ -66,10 +66,10 @@ the UI/page tree, and never expose internal plumbing under `/api/`.
   (`uuid("id").primaryKey().default(sql\`uuidv7()\`)`) and Better Auth gets
   `advanced.database.generateId: false` so the DB mints ids; below 18 — and in
   the nk-auth README's canonical example — pass
-  `advanced.database.generateId: uuidGenerateId` (JS-minted UUIDv7 from
-  `@ingram-tech/nk-auth`) instead. Either way, never Better Auth's default JS
+  `advanced.database.generateId: uuidv7` (JS-minted UUIDv7 from `id758`;
+  `@ingram-tech/nk-auth` re-exports it as `uuidGenerateId`) instead. Either way, never Better Auth's default JS
   nanoid. Ids that cross a **public contract** are skinned to `prefix_base58`
-  via `@ingram-tech/nk-db/id` (`createIdRegistry`) — never expose a raw UUID.
+  via `id758` / `@ingram-tech/nk-db/id` (`createIdRegistry`) — never expose a raw UUID.
   External ids you don't mint (Stripe `cus_`, OAuth) stay `text`.
 - **Migrations don't auto-apply on deploy.** Code ships ahead of the prod schema
   unless someone runs the migration against the target DB — a page that reads a
@@ -83,6 +83,33 @@ the UI/page tree, and never expose internal plumbing under `/api/`.
   transaction, before commit. A blind move that touches nothing (an RLS mask, a
   wrong `where`) otherwise reports success, and the drop of the source columns
   in the same migration makes it unrecoverable.
+- **Never edit a migration that has been applied.** The runner records
+  `sha256(file)`, so the bytes are history: editing one drifts every database
+  that already ran it, and drizzle never looks at the file again to notice.
+  Express the change as a **new** migration. `drizzle/_seal.json` pins the
+  hashes and `nk check` fails on a mismatch — if it does, `git checkout` the
+  file rather than resealing. After generating a migration, run **`nk
+  migrations`** and commit `_seal.json` in the same commit as the `.sql`.
+  `nk migrations --reseal` exists only for a deliberate squash, which also
+  requires reconciling every database with `nk-pg-migrate --baseline`.
+- **A clean `db:generate` does not mean the chain matches the database.**
+  drizzle diffs `schema.ts` against `meta/*_snapshot.json`, never against the
+  `.sql` files, and the snapshot can't model functions, triggers, `DEFERRABLE`
+  constraints, grants or roles. Anything regenerated from `schema.ts` drops
+  those clauses silently. `nk migrations --ddl` lists which migrations carry
+  them; verify against a real database before trusting a regenerated chain.
+- **Never hand-append unmodelled DDL to a generated migration.** A generated
+  file must stay exactly what `drizzle-kit generate` produced, or the snapshot
+  becomes an active lie about a file drizzle believes it owns — and the next
+  regenerate re-emits those objects without your clauses. Put functions,
+  triggers, `DEFERRABLE`, grants and roles in `drizzle-kit generate --custom`
+  migrations instead.
+- **Merging two branches that both added migrations? Check the journal.**
+  drizzle applies files by `when > max(created_at)`, so a migration whose `when`
+  lands below one already applied is skipped silently and forever.
+  `nk-pg-migrate` refuses to run in that state (`MigrationOrderError`); fix it
+  by raising the stranded entry's `when` in `meta/_journal.json` — never by
+  editing the `.sql`, which would break the hash every database recorded.
 - **`drizzle-kit` is GENERATE-ONLY — it must never apply schema.** Use it for
   `drizzle-kit generate` (and `generate --custom` for a package-owned/raw SQL
   migration). Applying is always **`nk-pg-migrate`** (the bin from
@@ -112,12 +139,12 @@ tool instead). One-off single-file edits: just edit the file.
 
 - `@ingram-tech/nk-email` — Cloudflare email: `sendEmail`, `fromAddress`
 - `@ingram-tech/nk-auth` — Better Auth foundation: presets you spread into your own `betterAuth()` (mounts at `/auth` via `authBasePath`; org / JWT / passkey / pool / client helpers). Don't hand-roll session reads or auth middleware — bind `createAuthHelpers` (`getUser` / `requireUser` / `redirectIfAuthenticated`, from `@ingram-tech/nk-auth/server`) and gate routes with the loop-safe `createAuthMiddleware`
-- `@ingram-tech/nk-db` — Postgres data layer: `createPool` (one TLS-aware pool) + `createQueries` (raw SQL) + `createDb` (Drizzle), the PGlite dev/test harness at `@ingram-tech/nk-db/pglite`, the prefixed-id codec at `@ingram-tech/nk-db/id`, and the drift-aware migration runner at `@ingram-tech/nk-db/migrate`
+- `@ingram-tech/nk-db` — Postgres data layer: `createPool` (one TLS-aware pool) + `createQueries` (raw SQL) + `createDb` (Drizzle), the PGlite dev/test harness at `@ingram-tech/nk-db/pglite`, the prefixed-id codec (the standalone `id758` package) at `@ingram-tech/nk-db/id`, and the drift-aware migration runner at `@ingram-tech/nk-db/migrate`
 - `@ingram-tech/nk-api` — the standard HTTP API seam (Hono + `@hono/zod-openapi`): one `{ error, details? }` envelope, `createApiApp` / `createRouter`, auth + multi-tenant resource-scope middleware, pagination helpers, and an emitted OpenAPI/Swagger doc. Reach for it instead of hand-rolling route handlers
 - `@ingram-tech/nk-billing` — Stripe primitives: subscriptions, a Stripe-side wallet, and an optional Postgres credit ledger behind the `/credits` subpath. Prices resolve at runtime by Stripe `lookup_key` — **never hardcode a price id**, so test and live share one code path
 - `@ingram-tech/bot-protection` — invisible form protection (honeypot + timing + Vercel BotID); the primitive nk-forms builds on, used directly only for non-form endpoints
 - `@ingram-tech/nk-forms` — the public contact/signup submission pipeline over bot-protection + nk-email: `handleFormSubmission` (rate-limit → bot gate → validate → escaped-email deliver → uniform 200), `renderNotificationEmail`, `mintFormToken`, and `useFormSubmit` / `HoneypotInput` (`/react`). Reach for it instead of wiring bot-protection by hand
-- `@ingram-tech/nk-i18n` — type-safe, English-as-key i18n: the English source text *is* the key (no `en.json`), ICU MessageFormat, colocated JSON catalogs; routing is left to the site
+- `@ingram-tech/nk-i18n` — type-safe, English-as-key i18n: the English source text *is* the key (no `en.json`), ICU MessageFormat, colocated JSON catalogs, plus **locale URL routing** (`defineLocaleRouting` + a fixed URL→account→cookie→`Accept-Language`→country precedence, wired to Next at `/next`). A URL that names a locale must serve it with a 200 — never redirect `?hl=fr` away, or every hreflang annotation on the site points at a URL that doesn't serve the language it claims. See `docs/i18n-routing.md`
 - `@ingram-tech/nk-marketing` — Postgres-backed marketing & lifecycle email: contacts + consent, newsletter broadcast audiences, and idempotent triggered campaigns, with RFC 8058 one-click unsubscribe
 - `@ingram-tech/nk-seo` — SEO toolkit: metadata factory, JSON-LD builders, sitemap/robots routes, hreflang + canonical links, and an OG image template
 - `@ingram-tech/nk-blog` — file-indexed blog engine: frontmatter contract, limited-MDX rendering with a component vocabulary, RSS, blog SEO, GitHub publishing

package/lib/artifacts.js

@@ -17,7 +17,7 @@ const GENERATED_DIRECTORIES = [
 ];
 
 /** Prefixes (posix-normalised) that `tsc` error locations may fall inside. */
-export const TYPE_CHECK_INPUT_PREFIXES = GENERATED_DIRECTORIES.filter(
+const TYPE_CHECK_INPUT_PREFIXES = GENERATED_DIRECTORIES.filter(
 	(entry) => entry.typeCheckInput,
 ).map((entry) => entry.path);
 

package/lib/auth-shadow.js

@@ -0,0 +1,150 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+
+// In the App Router a static segment always beats a catch-all, so a page (or
+// route.ts) under `app/auth/` whose path matches a Better Auth endpoint
+// silently shadows it: GETs render the page, POSTs to the endpoint return 405,
+// and nothing at build time says so. The endpoint list is derived textually
+// from better-auth's dist (grep for `createAuthEndpoint("...")`) — we never
+// load or execute site or dependency code just to read a set of strings.
+
+const PAGE_FILES = /^page\.(tsx|jsx|ts|js)$/;
+const ROUTE_FILES = /^route\.(ts|js)$/;
+const ENDPOINT_RE = /createAuthEndpoint\(\s*"([^"]+)"/g;
+
+/** The `app/auth/[...all]` mount dir, or null when the site has no auth mount. */
+function findMount(cwd) {
+	for (const appDir of ["src/app", "app"]) {
+		const catchAll = resolve(cwd, appDir, "auth", "[...all]");
+		for (const ext of ["ts", "js", "tsx", "jsx"]) {
+			if (existsSync(join(catchAll, `route.${ext}`))) {
+				return { appDir, authDir: resolve(cwd, appDir, "auth") };
+			}
+		}
+	}
+	return null;
+}
+
+/** better-auth's dist dir resolved from the site, or null when not installed. */
+function betterAuthDist(cwd) {
+	try {
+		const require = createRequire(resolve(cwd, "package.json"));
+		const pkg = require.resolve("better-auth/package.json");
+		return join(dirname(pkg), "dist");
+	} catch {
+		return null;
+	}
+}
+
+/** All `createAuthEndpoint("...")` paths in the `.mjs` files under `dir`. */
+function grepEndpoints(dir, recurse) {
+	if (!existsSync(dir)) return [];
+	const paths = new Set();
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (recurse) for (const p of grepEndpoints(full, true)) paths.add(p);
+			continue;
+		}
+		if (!entry.name.endsWith(".mjs")) continue;
+		const src = readFileSync(full, "utf8");
+		for (const m of src.matchAll(ENDPOINT_RE)) paths.add(m[1]);
+	}
+	return [...paths];
+}
+
+/**
+ * Walk `app/auth/**` collecting the page/route files that claim a static URL,
+ * as `{ file, segments }` with `file` relative to `cwd`. Skips the `[...all]`
+ * catch-all itself, `_private` folders, and `@slot` parallel-route trees (a
+ * slot renders alongside the layout rather than owning the URL segment, so we
+ * conservatively leave those trees to the human); `(group)` segments don't
+ * appear in the URL and are dropped.
+ */
+function collectRoutes(cwd, dir, segments, out) {
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) {
+			if (entry.name === "[...all]") continue;
+			if (entry.name.startsWith("_") || entry.name.startsWith("@")) continue;
+			const next = /^\(.*\)$/.test(entry.name)
+				? segments
+				: [...segments, entry.name];
+			collectRoutes(cwd, full, next, out);
+			continue;
+		}
+		if (!PAGE_FILES.test(entry.name) && !ROUTE_FILES.test(entry.name)) continue;
+		if (segments.length === 0) continue; // `/auth` itself can't match an endpoint
+		out.push({ file: full.slice(cwd.length + 1), segments });
+	}
+}
+
+/**
+ * Whether a page's segments match an endpoint path: same segment count, where
+ * an endpoint `:param` matches any page segment and a page `[param]` (or
+ * catch-all) matches any endpoint segment.
+ */
+function shadows(segments, endpoint) {
+	const eps = endpoint.split("/").filter(Boolean);
+	if (eps.length !== segments.length) return false;
+	return eps.every((ep, i) => {
+		const seg = segments[i];
+		if (ep.startsWith(":")) return true;
+		if (/^\[.*\]$/.test(seg)) return true;
+		return seg === ep;
+	});
+}
+
+/**
+ * Findings for Better Auth endpoint shadowing. Silent on sites without an
+ * `app/auth/[...all]` mount or without better-auth installed. Core endpoints
+ * (dist/api/routes) shadow as errors; plugin endpoints (dist/plugins) as
+ * warnings, since only enabled plugins are live and we can't tell which those
+ * are without executing the site's auth config.
+ */
+export function authShadowFindings(cwd) {
+	const mount = findMount(cwd);
+	if (!mount) return [];
+	const dist = betterAuthDist(cwd);
+	if (!dist) return [];
+
+	const core = grepEndpoints(join(dist, "api", "routes"), false);
+	if (core.length === 0) {
+		return [
+			{
+				id: "auth:shadow-check-skipped",
+				level: "warn",
+				message:
+					"could not derive Better Auth's endpoint list from better-auth/dist/api/routes (layout changed?) — the endpoint-shadowing check was skipped",
+			},
+		];
+	}
+	const plugin = grepEndpoints(join(dist, "plugins"), true);
+
+	const routes = [];
+	collectRoutes(cwd, mount.authDir, [], routes);
+
+	const out = [];
+	for (const { file, segments } of routes) {
+		const routePath = `/${segments.join("/")}`;
+		const hit = core.find((ep) => shadows(segments, ep));
+		if (hit) {
+			out.push({
+				id: `auth:endpoint-shadow:${routePath}`,
+				level: "error",
+				message: `\`${file}\` shadows Better Auth's \`/auth${hit}\` endpoint — a static segment beats the \`[...all]\` catch-all, so POSTs to it return 405 and the auth flow silently breaks. Rename the page (the precedent: the reset page is \`/auth/set-password\` because \`/auth/reset-password\` is taken).`,
+			});
+			continue;
+		}
+		const pluginHit = plugin.find((ep) => shadows(segments, ep));
+		if (pluginHit) {
+			out.push({
+				id: `auth:endpoint-shadow-plugin:${routePath}`,
+				level: "warn",
+				message: `\`${file}\` would shadow the Better Auth plugin endpoint \`/auth${pluginHit}\` — only a problem if the site enables that plugin, but a rename now avoids the 405 later.`,
+			});
+		}
+	}
+	return out;
+}

package/lib/doctor.js

@@ -1,6 +1,16 @@
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { authShadowFindings } from "./auth-shadow.js";
 import { SUPERSEDED_DEPS } from "./drift.js";
+import {
+	SEAL_FILE,
+	migrationsFolder,
+	readChain,
+	readSeal,
+	summarizeKinds,
+	unmodelledDdl,
+	writeSeal,
+} from "./migrations.js";
 
 // The canonical script → command mapping for a site on the nk-dev toolchain.
 // The key is matched loosely (`type-check` and `typecheck` are both accepted);
@@ -257,6 +267,65 @@ export function findings(cwd) {
 		});
 	}
 
+	// 9. The migration chain is sealed, and its unmodelled DDL is declared.
+	out.push(...migrationFindings(cwd));
+
+	// 10. No page/route under app/auth/ shadows a Better Auth endpoint.
+	out.push(...authShadowFindings(cwd));
+
+	return out;
+}
+
+/**
+ * Findings over a `drizzle/` chain. Silent on repos without one.
+ *
+ * The seal finding is the cheap half of migration safety: applied migrations
+ * are immutable, and nothing in drizzle notices when one is edited.
+ *
+ * The unmodelled-DDL finding is the honest half. `drizzle-kit generate` diffs
+ * `schema.ts` against `meta/*_snapshot.json`, so any DDL the snapshot can't
+ * model — functions, triggers, `DEFERRABLE` constraints, grants, roles — is
+ * outside the diff basis entirely. A chain carrying it can drift arbitrarily
+ * far from the database while `db:generate` still reports no changes, and
+ * anything regenerated from `schema.ts` drops it. That is a real property of
+ * the repo, so `nk doctor` states it rather than leaving it to be rediscovered.
+ */
+function migrationFindings(cwd) {
+	const out = [];
+	const folder = migrationsFolder(cwd);
+	let chain;
+	try {
+		chain = readChain(cwd, folder);
+	} catch (err) {
+		return [
+			{ id: "migrations:broken-chain", level: "error", message: err.message },
+		];
+	}
+	if (chain === null || chain.length === 0) return out;
+
+	if (readSeal(cwd, folder) === null) {
+		out.push({
+			id: "migrations:unsealed",
+			level: "warn",
+			message: `${chain.length} migration(s) with no ${folder}/${SEAL_FILE} — an edit to an already-applied migration would go unnoticed`,
+			fix: (dir) => {
+				const f = migrationsFolder(dir);
+				writeSeal(dir, f, readChain(dir, f));
+				return `sealed ${chain.length} migration(s) in ${f}/${SEAL_FILE}`;
+			},
+		});
+	}
+
+	const inventory = unmodelledDdl(cwd, folder);
+	if (inventory.length > 0) {
+		const kinds = summarizeKinds(inventory);
+		out.push({
+			id: "migrations:unmodelled-ddl",
+			level: "warn",
+			message: `${inventory.length} of ${chain.length} migration(s) carry DDL drizzle's snapshot cannot model (${kinds.join(", ")}) — \`db:generate\` reporting "no changes" does not mean the chain reproduces the database, and regenerating from schema.ts drops it. Run \`nk migrations --ddl\` for the per-file list.`,
+		});
+	}
+
 	return out;
 }
 
@@ -264,7 +333,9 @@ export function findings(cwd) {
  * `nk doctor [--fix]` — report drift from the canonical nk-dev model (scripts,
  * dependencies, oxlint/tsconfig extends, the CLAUDE.md guide import, stale knip
  * ignores, forbidden schema-applying drizzle-kit scripts, a dead
- * .prettierignore). With `--fix`, apply every auto-fixable finding, then remind
+ * .prettierignore, an unsealed or unmodelled-DDL-carrying migration chain, a
+ * page under app/auth/ shadowing a Better Auth endpoint).
+ * With `--fix`, apply every auto-fixable finding, then remind
  * to reinstall.
  */
 export function doctor(args = []) {

package/lib/migrations.js

@@ -0,0 +1,354 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+// Two guards over a `drizzle/` migration chain, both of which exist because
+// `drizzle-kit generate` diffs `schema.ts` against `meta/*_snapshot.json` and
+// NEVER against the `.sql` files:
+//
+//   1. THE SEAL. Once a migration has been applied anywhere, its bytes are
+//      history — the runner records `sha256(file)` in the journal table, so
+//      editing the file (a formatter sweep, a "quick fix" to a generated
+//      migration) permanently drifts every database that already ran it. There
+//      is nothing in drizzle that notices. {@link verifySeal} pins each file's
+//      hash in a committed `_seal.json`, so the edit shows up as a failed check
+//      in the PR that made it instead of as a confusing `already exists` on the
+//      next deploy.
+//
+//   2. THE UNMODELLED-DDL INVENTORY. Functions, triggers, `DEFERRABLE`
+//      constraints, grants and roles are not in drizzle's snapshot model. Once
+//      a migration carries them, the snapshot is a permanently partial view of
+//      the schema: `db:generate` reports "nothing to migrate" no matter how far
+//      the chain has drifted from the database, and anything regenerated from
+//      `schema.ts` (notably a squash) silently drops them.
+//      {@link unmodelledDdl} turns that from tribal knowledge into a list.
+//
+// Both are deliberately database-free: they run in CI, in a pre-commit hook and
+// on a laptop with no `DATABASE_URL`. Proving the chain actually reproduces the
+// live schema needs a catalog diff against a real database, which is a
+// different (and much larger) tool.
+
+/** Name of the seal file, written inside the migrations folder. */
+export const SEAL_FILE = "_seal.json";
+
+const SEAL_COMMENT =
+	"sha256 of each migration file at the time it was sealed. Applied migrations are immutable: if a hash here stops matching, the file was edited after it ran and every database that already applied it has drifted. Regenerate with `nk migrations --reseal` ONLY as part of a deliberate squash.";
+
+/**
+ * The migrations folder for a repo. Honours `out:` in a drizzle config when one
+ * is present (matched textually — we are not loading the site's TS config just
+ * to read one string), else drizzle's `drizzle` default.
+ */
+export function migrationsFolder(cwd = process.cwd()) {
+	for (const name of [
+		"drizzle.config.ts",
+		"drizzle.config.js",
+		"drizzle.config.mjs",
+	]) {
+		const path = resolve(cwd, name);
+		if (!existsSync(path)) continue;
+		const match = /\bout\s*:\s*["'`]([^"'`]+)["'`]/.exec(
+			readFileSync(path, "utf8"),
+		);
+		if (match?.[1]) return match[1];
+	}
+	return "drizzle";
+}
+
+const journalPathFor = (cwd, folder) => resolve(cwd, folder, "meta", "_journal.json");
+
+/**
+ * The migration chain as `{ tag, hash }`, in journal order. `hash` is
+ * `sha256(rawFile)` — the exact value drizzle records in `__drizzle_migrations`,
+ * so a mismatch here is a mismatch there.
+ *
+ * Returns null when the repo has no journal (not a drizzle site — nothing to
+ * guard). Throws when the journal names a file that doesn't exist, which is
+ * itself a broken chain.
+ */
+export function readChain(cwd = process.cwd(), folder = migrationsFolder(cwd)) {
+	const journalPath = journalPathFor(cwd, folder);
+	if (!existsSync(journalPath)) return null;
+	const journal = JSON.parse(readFileSync(journalPath, "utf8"));
+	const entries = Array.isArray(journal?.entries) ? journal.entries : [];
+	return entries.map((entry) => {
+		const sqlPath = resolve(cwd, folder, `${entry.tag}.sql`);
+		if (!existsSync(sqlPath)) {
+			throw new Error(
+				`nk migrations: journal entry "${entry.tag}" has no ${folder}/${entry.tag}.sql`,
+			);
+		}
+		const sql = readFileSync(sqlPath, "utf8");
+		return {
+			tag: entry.tag,
+			hash: createHash("sha256").update(sql).digest("hex"),
+			sql,
+		};
+	});
+}
+
+/** The committed seal, or an empty one when the repo hasn't sealed yet. */
+export function readSeal(cwd = process.cwd(), folder = migrationsFolder(cwd)) {
+	const path = resolve(cwd, folder, SEAL_FILE);
+	if (!existsSync(path)) return null;
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	return parsed?.migrations && typeof parsed.migrations === "object"
+		? parsed.migrations
+		: {};
+}
+
+/** Write the seal for `chain`, in journal order (stable diffs). */
+export function writeSeal(cwd, folder, chain) {
+	const migrations = {};
+	for (const m of chain) migrations[m.tag] = m.hash;
+	writeFileSync(
+		resolve(cwd, folder, SEAL_FILE),
+		`${JSON.stringify({ $comment: SEAL_COMMENT, migrations }, null, "\t")}\n`,
+	);
+}
+
+/**
+ * Compare the chain on disk to the committed seal.
+ *
+ * - `changed` — sealed migrations whose bytes moved. Always a defect: those
+ *   files have already run somewhere.
+ * - `dropped` — sealed migrations no longer in the journal. Normal during a
+ *   squash, a defect at any other time.
+ * - `unsealed` — migrations with no seal entry yet (newly generated).
+ */
+export function verifySeal(cwd = process.cwd(), folder = migrationsFolder(cwd)) {
+	const chain = readChain(cwd, folder);
+	if (chain === null) return null;
+	const sealed = readSeal(cwd, folder);
+	if (sealed === null) {
+		return { chain, sealedYet: false, changed: [], dropped: [], unsealed: chain };
+	}
+	const changed = [];
+	const unsealed = [];
+	for (const m of chain) {
+		const expected = sealed[m.tag];
+		if (expected === undefined) unsealed.push(m);
+		else if (expected !== m.hash) changed.push({ ...m, sealed: expected });
+	}
+	const tags = new Set(chain.map((m) => m.tag));
+	const dropped = Object.keys(sealed).filter((tag) => !tags.has(tag));
+	return { chain, sealedYet: true, changed, dropped, unsealed };
+}
+
+// DDL that drizzle's snapshot model does not represent. Each entry is
+// `[kind, pattern]`, matched against SQL with comments, string literals and
+// dollar-quoted bodies stripped, so a mention inside a function body or a
+// `-- create trigger` comment doesn't count.
+const UNMODELLED = [
+	["function", /\bcreate\s+(?:or\s+replace\s+)?(?:function|procedure)\b/i],
+	["trigger", /\bcreate\s+(?:constraint\s+|event\s+)?trigger\b/i],
+	["deferrable", /\bdeferrable\b/i],
+	["grant", /\b(?:grant|revoke)\b/i],
+	["role", /\b(?:create|alter|drop)\s+role\b/i],
+	["extension", /\bcreate\s+extension\b/i],
+	["materialized-view", /\bcreate\s+materialized\s+view\b/i],
+	["rule", /\bcreate\s+(?:or\s+replace\s+)?rule\b/i],
+	["do-block", /(?:^|;|\n)\s*do\s+\$/i],
+];
+
+/**
+ * Blank out anything that isn't executable DDL text: dollar-quoted bodies (a
+ * function body full of SQL keywords), block and line comments, single-quoted
+ * literals and double-quoted identifiers. Replaced with spaces rather than
+ * removed so nothing accidentally joins into a new keyword.
+ */
+function stripNonDdl(sql) {
+	const blank = (m) => " ".repeat(m.length);
+	return (
+		sql
+			// A dollar-quoted body collapses to a bare `$$` rather than to spaces:
+			// the body's contents are not statements, but the opener still has to be
+			// visible so `do $$ ... $$` is recognisable as an anonymous block.
+			.replace(/\$([A-Za-z_]\w*)?\$[\s\S]*?\$\1?\$/g, " $$$$ ")
+			.replace(/\/\*[\s\S]*?\*\//g, blank)
+			.replace(/--[^\n]*/g, blank)
+			.replace(/'(?:[^']|'')*'/g, blank)
+			.replace(/"(?:[^"]|"")*"/g, blank)
+	);
+}
+
+/** The unmodelled-DDL kinds present in one migration's SQL. */
+export function unmodelledKinds(sql) {
+	const stripped = stripNonDdl(sql);
+	return UNMODELLED.filter(([, pattern]) => pattern.test(stripped)).map(
+		([kind]) => kind,
+	);
+}
+
+/**
+ * Per-file inventory of DDL drizzle can't model: `[{ tag, kinds }]`, only for
+ * files that carry some. Empty when the chain is purely generated output (the
+ * only case in which `db:generate` reporting "no changes" actually means the
+ * chain reproduces `schema.ts`).
+ */
+export function unmodelledDdl(cwd = process.cwd(), folder = migrationsFolder(cwd)) {
+	const chain = readChain(cwd, folder);
+	if (chain === null) return [];
+	return chain
+		.map((m) => ({ tag: m.tag, kinds: unmodelledKinds(m.sql) }))
+		.filter((m) => m.kinds.length > 0);
+}
+
+/** Distinct kinds across a whole inventory, for a one-line summary. */
+export function summarizeKinds(inventory) {
+	return [...new Set(inventory.flatMap((m) => m.kinds))].sort();
+}
+
+const short = (hash) => hash.slice(0, 12);
+
+/**
+ * The `nk check` gate: `{ ok, reason }`, non-exiting. `ok` on a repo with no
+ * journal (not every site has a database) and on a chain that matches its seal.
+ */
+export function checkSeal(cwd = process.cwd()) {
+	const folder = migrationsFolder(cwd);
+	let state;
+	try {
+		state = verifySeal(cwd, folder);
+	} catch (err) {
+		return { ok: false, reason: err.message };
+	}
+	if (state === null) return { ok: true };
+	const problems = [
+		...state.changed.map(
+			(m) =>
+				`${m.tag} changed after it was sealed (${short(m.sealed)} → ${short(m.hash)})`,
+		),
+		...state.dropped.map(
+			(tag) => `${tag} was sealed but is no longer in the journal`,
+		),
+		...state.unsealed.map((m) => `${m.tag} is unsealed`),
+	];
+	if (problems.length === 0) return { ok: true };
+	return {
+		ok: false,
+		reason: `migration chain does not match ${folder}/${SEAL_FILE} — ${problems.join("; ")}`,
+	};
+}
+
+/**
+ * `nk migrations [--check|--reseal|--ddl]` — guard the migration chain.
+ *
+ * Default: verify the seal, then seal anything newly generated and write the
+ * file. `--check` verifies without writing (the CI shape: an unsealed migration
+ * is a failure, because the seal must land in the same commit as the
+ * migration). `--reseal` rewrites every hash — the deliberate squash escape
+ * hatch, whose effect is visible in the diff. `--ddl` prints the
+ * unmodelled-DDL inventory.
+ */
+export function migrations(args = []) {
+	const cwd = process.cwd();
+	const folder = migrationsFolder(cwd);
+	const checkOnly = args.includes("--check");
+
+	let state;
+	try {
+		state = verifySeal(cwd, folder);
+	} catch (err) {
+		console.error(`nk migrations: ${err.message}`);
+		process.exit(1);
+	}
+	if (state === null) {
+		if (!checkOnly) console.log(`nk migrations: no ${folder}/meta/_journal.json.`);
+		process.exit(0);
+	}
+
+	if (args.includes("--ddl")) {
+		printDdl(cwd, folder);
+		process.exit(0);
+	}
+
+	if (args.includes("--reseal")) {
+		writeSeal(cwd, folder, state.chain);
+		console.log(
+			`nk migrations: resealed ${state.chain.length} migration(s) in ${folder}/${SEAL_FILE}.`,
+		);
+		for (const m of state.changed) {
+			console.log(`  ! ${m.tag}: ${short(m.sealed)} → ${short(m.hash)}`);
+		}
+		for (const tag of state.dropped) console.log(`  – ${tag} (dropped)`);
+		console.log(
+			"\n  Every database that already ran a changed or dropped migration must be reconciled (`nk-pg-migrate --baseline`) and verified against the new chain before this ships.",
+		);
+		process.exit(0);
+	}
+
+	const broken = state.changed.length > 0 || state.dropped.length > 0;
+	for (const m of state.changed) {
+		console.error(
+			`nk migrations: ✗ ${m.tag} changed after it was sealed (${short(m.sealed)} → ${short(m.hash)})`,
+		);
+	}
+	for (const tag of state.dropped) {
+		console.error(
+			`nk migrations: ✗ ${tag} was sealed but is no longer in the journal`,
+		);
+	}
+	if (broken) {
+		console.error(
+			"\n  An applied migration's bytes are history: every database that ran it recorded that hash. Restore the file (`git checkout`) and express the change as a NEW migration.",
+		);
+		console.error(
+			"  If this is a deliberate squash, run `nk migrations --reseal` and reconcile each database with `nk-pg-migrate --baseline`.",
+		);
+		process.exit(1);
+	}
+
+	if (checkOnly) {
+		if (state.unsealed.length > 0) {
+			console.error(
+				`nk migrations: ✗ ${state.unsealed.length} unsealed migration(s): ${state.unsealed.map((m) => m.tag).join(", ")}`,
+			);
+			console.error(
+				`  → run \`nk migrations\` and commit ${folder}/${SEAL_FILE} alongside the migration.`,
+			);
+			process.exit(1);
+		}
+		console.log(
+			`nk migrations: ✓ ${state.chain.length} migration(s) match the seal.`,
+		);
+		process.exit(0);
+	}
+
+	if (state.unsealed.length === 0 && state.sealedYet) {
+		console.log(
+			`nk migrations: ✓ ${state.chain.length} migration(s) match the seal.`,
+		);
+		process.exit(0);
+	}
+	writeSeal(cwd, folder, state.chain);
+	console.log(
+		`nk migrations: sealed ${state.unsealed.length} new migration(s) — commit ${folder}/${SEAL_FILE}.`,
+	);
+	for (const m of state.unsealed) console.log(`  + ${m.tag}`);
+	process.exit(0);
+}
+
+function printDdl(cwd, folder) {
+	const inventory = unmodelledDdl(cwd, folder);
+	if (inventory.length === 0) {
+		console.log(
+			"nk migrations: no DDL outside drizzle's snapshot model — `db:generate` sees the whole schema.",
+		);
+		return;
+	}
+	console.log(
+		`nk migrations: ${inventory.length} migration(s) carry DDL drizzle's snapshot cannot model:\n`,
+	);
+	for (const m of inventory) console.log(`  ${m.tag}  ${m.kinds.join(", ")}`);
+	console.log(
+		"\n  drizzle diffs schema.ts against meta/*_snapshot.json, so none of this is in the diff basis:",
+	);
+	console.log(
+		"  `db:generate` reporting no changes does NOT mean the chain reproduces the database, and anything",
+	);
+	console.log(
+		"  regenerated from schema.ts (a squash above all) drops these clauses silently. Verify against a real",
+	);
+	console.log("  database before trusting a regenerated chain.");
+}

package/lib/oxlint-plugins/index.js

@@ -7,6 +7,7 @@ import deferredCurrentTarget from "./deferred-current-target.js";
 import lucideIconSuffix from "./lucide-icon-suffix.js";
 import noCryptoRandomUuid from "./no-crypto-random-uuid.js";
 import noRedirectOnlyPage from "./no-redirect-only-page.js";
+import noRedundantNodeCrypto from "./no-redundant-node-crypto.js";
 import redundantUseStateType from "./redundant-usestate-type.js";
 import satoriCss from "./satori-css.js";
 import tNoPositionalArgs from "./t-no-positional-args.js";
@@ -20,6 +21,7 @@ export default {
 		...lucideIconSuffix.rules,
 		...noCryptoRandomUuid.rules,
 		...noRedirectOnlyPage.rules,
+		...noRedundantNodeCrypto.rules,
 		...redundantUseStateType.rules,
 		...satoriCss.rules,
 		...tNoPositionalArgs.rules,

package/lib/oxlint-plugins/no-crypto-random-uuid.js

@@ -8,7 +8,7 @@
 // invisible until the table is large, which is exactly when it is expensive to
 // undo.
 //
-// The mint is `uuidGenerateId()` from `@ingram-tech/nk-db/id`, already typed
+// The mint is `uuidv7()` from `id758` (re-exported by `@ingram-tech/nk-db/id`), already typed
 // `Uuid`. Most rows need no mint at all: `uuid("id").primaryKey().default(sql`
 // `uuidv7()`)` lets the database do it, and the app only mints when it needs the
 // id *before* the insert (a client-chosen document PK it must also use as the
@@ -17,7 +17,7 @@
 // Deliberately not autofixable. The right replacement depends on what the value
 // is, and one of the answers is "leave it alone":
 //
-//   - a stored id            -> uuidGenerateId(), or drop it for the column default
+//   - a stored id            -> uuidv7(), or drop it for the column default
 //   - a bearer token / nonce -> keep crypto.randomUUID()
 //
 // v7 is the *wrong* choice for a secret. It spends 48 bits on a millisecond
@@ -77,7 +77,7 @@ const noCryptoRandomUuid = {
 		},
 		messages: {
 			cryptoRandomUuid:
-				"`crypto.randomUUID()` is UUIDv4; stored ids are UUIDv7. Mint with `uuidGenerateId()` from `@ingram-tech/nk-db/id`, or omit the id and let the `uuidv7()` column default apply. If this is a bearer token or nonce, keep v4 and add `// oxlint-disable-next-line nextkit/no-crypto-random-uuid -- <reason>`.",
+				"`crypto.randomUUID()` is UUIDv4; stored ids are UUIDv7. Mint with `uuidv7()` from `id758` (re-exported by `@ingram-tech/nk-db/id`), or omit the id and let the `uuidv7()` column default apply. If this is a bearer token or nonce, keep v4 and add `// oxlint-disable-next-line nextkit/no-crypto-random-uuid -- <reason>`.",
 		},
 	},
 	create(context) {

package/lib/oxlint-plugins/no-redundant-node-crypto.js

@@ -0,0 +1,137 @@
+// nextkit oxlint JS plugin rule: don't import from `node:crypto` what is
+// already a global.
+//
+// Web Crypto is on `globalThis` in every runtime we ship to — Node (since 19,
+// and nk-dev's floor is 22), the browser, and every edge/worker runtime. So
+// `randomUUID`, `getRandomValues`, `subtle` and `webcrypto` are reachable as
+// `crypto.randomUUID()`, `crypto.getRandomValues()`, `crypto.subtle` and
+// `crypto` with no import at all.
+//
+// Importing them anyway costs something real: it pins the module to a Node-only
+// runtime for a function it would have had regardless. A component, a shared
+// helper or a route that could have run anywhere now can't, and the reason is
+// invisible at the call site — the code reads identically either way. Two of
+// these are not even different objects: `node:crypto`'s `subtle` and `webcrypto`
+// are the very same references as `globalThis.crypto.subtle` and
+// `globalThis.crypto`.
+//
+// nk-db already pays for this the hard way: its id codec is imported by Drizzle
+// schemas, client components and edge runtimes, so `id.ts` is held to an empty
+// import list by a test (`id.test.ts`, "isomorphic invariant") whose comment
+// names `node:crypto` for randomness as the tempting one. That invariant was
+// prose in one package; this rule is the mechanical version of it, fleet-wide.
+//
+// This is about the module boundary, not the algorithm. The rest of `node:crypto`
+// — `createHash`, `createHmac`, `createPrivateKey`, `randomBytes`,
+// `timingSafeEqual` — has no drop-in global (the Web Crypto equivalents live
+// under `crypto.subtle` and are async), so those imports are correct and this
+// rule leaves them alone. Trimming a redundant name off an import list is the
+// common fix; the import disappears entirely only when nothing else was on it.
+//
+// Deliberately not autofixable. Deleting the specifier is the easy half — the
+// call sites still have to become member expressions on the global, and a
+// default or namespace import named `crypto` (which shadows the global it is
+// standing in for) needs the whole file reread, not a mechanical edit.
+//
+// One case keeps the import: `node:crypto`'s `randomUUID` takes an options bag
+// (`randomUUID({ disableEntropyCache: true })`) that Web Crypto's does not. If
+// you need it, keep the import and say so:
+//
+//   // oxlint-disable-next-line nextkit/no-redundant-node-crypto -- needs disableEntropyCache
+//
+// Only static `import` is checked, matching every other rule in this plugin.
+// `require("node:crypto")` in a CommonJS script is out of scope.
+//
+// Note this overlaps by design with `nextkit/no-crypto-random-uuid`, which asks
+// a different question about the same call: that rule is about v4-versus-v7 for
+// a *stored id*, this one is about the module. A call site that justifiably
+// keeps v4 — a bearer token, a nonce — silences that rule and should still be
+// reaching for the global.
+
+const NODE_CRYPTO_MODULES = new Set(["crypto", "node:crypto"]);
+
+/** node:crypto exports that are already global, and what to reach for instead. */
+const REDUNDANT_EXPORTS = new Map([
+	["randomUUID", "crypto.randomUUID()"],
+	["getRandomValues", "crypto.getRandomValues()"],
+	["subtle", "crypto.subtle"],
+	["webcrypto", "crypto"],
+]);
+
+const noRedundantNodeCrypto = {
+	meta: {
+		type: "suggestion",
+		docs: {
+			description:
+				"Disallow importing node:crypto members that are already on the Web Crypto global",
+		},
+		messages: {
+			redundantImport:
+				"`{{name}}` from `{{module}}` is already global — use `{{replacement}}` and drop the import. Web Crypto is on globalThis in Node (>=19), the browser and every edge runtime, so importing it pins this module to Node for nothing. Keep the import only if you need a Node-specific signature, with `// oxlint-disable-next-line nextkit/no-redundant-node-crypto -- <reason>`.",
+			redundantMember:
+				"`{{local}}.{{name}}` is already global — use `{{replacement}}`. Web Crypto is on globalThis in Node (>=19), the browser and every edge runtime; reaching for it through the `{{module}}` namespace pins this module to Node for nothing.",
+		},
+	},
+	create(context) {
+		// Local names bound to the whole module (`import * as c` / `import c`),
+		// whose members we then check.
+		const namespaceNames = new Set();
+
+		return {
+			ImportDeclaration(node) {
+				const module = node.source.value;
+				if (!NODE_CRYPTO_MODULES.has(module)) return;
+
+				for (const specifier of node.specifiers) {
+					if (
+						specifier.type === "ImportNamespaceSpecifier" ||
+						specifier.type === "ImportDefaultSpecifier"
+					) {
+						namespaceNames.add(specifier.local.name);
+						continue;
+					}
+					if (specifier.type !== "ImportSpecifier") continue;
+					if (specifier.imported.type !== "Identifier") continue;
+
+					const name = specifier.imported.name;
+					const replacement = REDUNDANT_EXPORTS.get(name);
+					if (!replacement) continue;
+
+					context.report({
+						node: specifier,
+						messageId: "redundantImport",
+						data: { name, module, replacement },
+					});
+				}
+			},
+			// `nodeCrypto.subtle` where `nodeCrypto` is the imported module. The
+			// import itself can be legitimate (it may also carry `createHash`), so
+			// the redundant part is this access, not the declaration.
+			MemberExpression(node) {
+				if (node.computed) return;
+				if (node.object.type !== "Identifier") return;
+				if (!namespaceNames.has(node.object.name)) return;
+				if (node.property.type !== "Identifier") return;
+
+				const replacement = REDUNDANT_EXPORTS.get(node.property.name);
+				if (!replacement) return;
+
+				context.report({
+					node,
+					messageId: "redundantMember",
+					data: {
+						local: node.object.name,
+						name: node.property.name,
+						replacement,
+						module: "node:crypto",
+					},
+				});
+			},
+		};
+	},
+};
+
+export default {
+	meta: { name: "nextkit" },
+	rules: { "no-redundant-node-crypto": noRedundantNodeCrypto },
+};

package/lib/passthrough.js

@@ -3,6 +3,7 @@ import { cleanGeneratedArtifacts, onlyGeneratedTypeErrors } from "./artifacts.js
 import { toolDrift } from "./drift.js";
 import { FORMATTER } from "./formatter.js";
 import { hasKnipConfig, runKnip } from "./knip.js";
+import { checkSeal } from "./migrations.js";
 import { run, runCapture, writeThrough } from "./run.js";
 
 /** `nk lint [...]` — oxlint, with extra args passed through (e.g. `--fix`). */
@@ -33,8 +34,19 @@ export function check() {
 			"  → add `@./node_modules/@ingram-tech/nk-dev/guide.md` to your CLAUDE.md (or run `nk init`).",
 		);
 	}
+	// Applied migrations are immutable. A no-op on sites without a `drizzle/`
+	// journal, so it costs non-database sites nothing.
+	const seal = checkSeal();
+	if (!seal.ok) {
+		console.error(`nk check: ${seal.reason}`);
+		console.error(
+			"  → restore the file and add a new migration, or run `nk migrations` to seal a newly generated one.",
+		);
+	}
 	warnToolDrift();
-	process.exit(lintFailed || fmtFailed || knipFailed || !guide.ok ? 1 : 0);
+	process.exit(
+		lintFailed || fmtFailed || knipFailed || !guide.ok || !seal.ok ? 1 : 0,
+	);
 }
 
 /** Non-fatal: surface superseded deps so drift doesn't silently re-accumulate. */

package/oxlintrc.json

@@ -13,6 +13,7 @@
 		"nextkit/t-requires-values": "error",
 		"nextkit/t-no-positional-args": "error",
 		"nextkit/no-crypto-random-uuid": "warn",
+		"nextkit/no-redundant-node-crypto": "warn",
 		"nextkit/satori-css": "warn",
 		"no-unused-vars": "warn",
 		"typescript/no-non-null-assertion": "error",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-dev",
-	"version": "0.10.0",
+	"version": "0.11.1",
 	"description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.",
 	"license": "MIT",
 	"type": "module",
@@ -45,14 +45,14 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@ast-grep/cli": "^0.45.0",
+		"@ast-grep/cli": "^0.45.1",
 		"@testing-library/dom": "^10.4.1",
-		"@testing-library/jest-dom": "^7.0.0",
+		"@testing-library/jest-dom": "^7.0.1",
 		"@typescript/native": "npm:typescript@^7.0.2",
 		"jsdom": "^30.0.1",
-		"knip": "^6.31.0",
-		"oxfmt": "^0.61.0",
-		"oxlint": "^1.76.0",
+		"knip": "^6.32.2",
+		"oxfmt": "^0.63.0",
+		"oxlint": "^1.78.0",
 		"typescript": "npm:@typescript/typescript6@^6.0.2",
 		"vitest": "^4.1.10"
 	},