@ingram-tech/nk-dev 0.6.0 → 0.7.0

package/bin/nk.js

@@ -20,7 +20,7 @@ Commands:
   dev                 Start the Next dev server (Turbopack). Boots local PGlite
                       first when @ingram-tech/nk-db is installed (no Docker).
   format [--check]    Format code with oxfmt. --check verifies without writing.
-  lint                Lint with oxlint.
+  lint [...]          Lint with oxlint (extra args passed through, e.g. --fix).
   knip                Find unused dependencies / exports / files with knip.
   ast-grep [...]      Structural search & rewrite of TS/TSX by AST pattern
                       (vendored ast-grep; args passed through). For large
@@ -50,7 +50,7 @@ switch (cmd) {
 		format({ check: rest.includes("--check") });
 		break;
 	case "lint":
-		lint();
+		lint(rest);
 		break;
 	case "knip":
 		knip(rest);

package/guide.md

@@ -77,6 +77,18 @@ the UI/page tree, and never expose internal plumbing under `/api/`.
   `@ingram-tech/nk-db`'s drift-aware runner (`@ingram-tech/nk-db/migrate`), which
   surfaces the real Postgres error and pre-flights journal drift. Generate **and
   apply** in the same step; don't leave "run the migration" as a handoff.
+- **`drizzle-kit` is GENERATE-ONLY — it must never apply schema.** Use it for
+  `drizzle-kit generate` (and `generate --custom` for a package-owned/raw SQL
+  migration). Applying is always **`nk-pg-migrate`** (the bin from
+  `@ingram-tech/nk-db`): `bun run db:migrate`, and check first with
+  `db:migrate:status`. Two commands are banned, and `nk doctor` fails on either:
+  - **`drizzle-kit push`** applies a diff straight to the live DB with no
+    migration file and no journal entry. It is the schema-drift source — it has
+    already drifted a production database in this fleet, and where the dev DB is
+    shared it rewrites everyone's. To iterate locally, rebuild from migrations
+    (the PGlite harness / your `dev:*fresh` script), don't push.
+  - **`drizzle-kit migrate`** is opaque: it exits non-zero with no message (even
+    on a clean no-op) and hides journal drift.
 
 ## Large-scale / structural edits
 

package/lib/dev.js

@@ -1,6 +1,6 @@
 import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 
 /**
  * Whether `@ingram-tech/nk-db` is resolvable from the site — the signal that
@@ -19,6 +19,32 @@ function hasPgliteDev() {
 	}
 }
 
+/**
+ * If `@ingram-tech/nk-auth` is installed, the `nk-pglite-dev` flag that makes
+ * the local database apply its shipped auth-table migration chain (see
+ * docs/db-package.md § "The nk-auth migration chain"). Returned as
+ * `--dep-migrations <folder>#<table>` args, or `[]` when nk-auth is absent.
+ *
+ * This resolution lives here, not in nk-db: `nk` is the orchestrator that
+ * already knows both packages, so nk-db's harness stays generic and the
+ * dependency graph stays acyclic (nk-auth → nk-db, never the reverse).
+ */
+function authMigrationArgs() {
+	try {
+		const require = createRequire(resolve(process.cwd(), "package.json"));
+		// Resolve the shipped journal via nk-auth's `./migrations/*` export (its
+		// `exports` deliberately does not expose `./package.json`). A successful
+		// resolve both locates the folder AND confirms the chain is shipped; the
+		// folder is the journal's grandparent (…/migrations/meta/_journal.json).
+		const journal =
+			require.resolve("@ingram-tech/nk-auth/migrations/meta/_journal.json");
+		const folder = dirname(dirname(journal));
+		return ["--dep-migrations", `${folder}#__nkauth_migrations`];
+	} catch {
+		return [];
+	}
+}
+
 /**
  * `nk dev` — start the Next dev server on the golden-path local database.
  *
@@ -33,7 +59,7 @@ function hasPgliteDev() {
  */
 export function dev(extraArgs = []) {
 	const command = hasPgliteDev()
-		? ["nk-pglite-dev", ...extraArgs]
+		? ["nk-pglite-dev", ...authMigrationArgs(), ...extraArgs]
 		: ["next", "dev", "--turbopack", ...extraArgs];
 	if (command[0] === "nk-pglite-dev") {
 		console.log("nk: @ingram-tech/nk-db found — booting local PGlite (no Docker)…");

package/lib/doctor.js

@@ -36,7 +36,7 @@ function writeJson(file, value) {
  * returns a short past-tense note. `level` is "error" (breaks the model) or
  * "warn" (cosmetic / cleanup).
  */
-function findings(cwd) {
+export function findings(cwd) {
 	const out = [];
 	const pkgPath = resolve(cwd, "package.json");
 	const pkg = readJson(pkgPath);
@@ -202,7 +202,47 @@ function findings(cwd) {
 		}
 	}
 
-	// 7. .prettierignore is now dead weight (nk no longer formats SQL).
+	// 7. drizzle-kit is GENERATE-ONLY — it must never apply schema.
+	//    `drizzle-kit push` diffs the live DB and applies straight to it with no
+	//    migration file and no journal entry: the schema-drift source (it has
+	//    already drifted one production database in this fleet, and on sites
+	//    whose dev DB is shared it rewrites everyone's).
+	//    `drizzle-kit migrate` is opaque — it exits non-zero with no message
+	//    (even on a clean no-op) and hides journal drift.
+	//    `nk-pg-migrate` (@ingram-tech/nk-db) is the one runner that applies:
+	//    it surfaces the real Postgres error and pre-flights drift.
+	for (const [name, cmd] of Object.entries(scripts)) {
+		if (typeof cmd !== "string") continue;
+		if (/\bdrizzle-kit\s+push\b/.test(cmd)) {
+			out.push({
+				id: `script:drizzle-push:${name}`,
+				level: "error",
+				message: `\`${name}\` runs \`drizzle-kit push\` — it applies schema to the live DB with no migration (drift). Generate a migration and apply it with \`nk-pg-migrate\`.`,
+				fix: (dir) => {
+					const p = resolve(dir, "package.json");
+					const j = readJson(p);
+					delete j.scripts?.[name];
+					writeJson(p, j);
+					return `removed \`${name}\` (drizzle-kit push)`;
+				},
+			});
+		} else if (/\bdrizzle-kit\s+migrate\b/.test(cmd)) {
+			out.push({
+				id: `script:drizzle-migrate:${name}`,
+				level: "error",
+				message: `\`${name}\` runs \`drizzle-kit migrate\` — apply with \`nk-pg-migrate\` instead (it surfaces the real error and pre-flights journal drift).`,
+				fix: (dir) => {
+					const p = resolve(dir, "package.json");
+					const j = readJson(p);
+					j.scripts[name] = "nk-pg-migrate";
+					writeJson(p, j);
+					return `set \`${name}\` → "nk-pg-migrate"`;
+				},
+			});
+		}
+	}
+
+	// 8. .prettierignore is now dead weight (nk no longer formats SQL).
 	const prettierIgnore = resolve(cwd, ".prettierignore");
 	if (existsSync(prettierIgnore)) {
 		out.push({
@@ -223,8 +263,9 @@ function findings(cwd) {
 /**
  * `nk doctor [--fix]` — report drift from the canonical nk-dev model (scripts,
  * dependencies, oxlint/tsconfig extends, the CLAUDE.md guide import, stale knip
- * ignores, a dead .prettierignore). With `--fix`, apply every auto-fixable
- * finding, then remind to reinstall.
+ * ignores, forbidden schema-applying drizzle-kit scripts, a dead
+ * .prettierignore). With `--fix`, apply every auto-fixable finding, then remind
+ * to reinstall.
  */
 export function doctor(args = []) {
 	const fix = args.includes("--fix");

package/lib/passthrough.js

@@ -4,9 +4,9 @@ import { FORMATTER } from "./formatter.js";
 import { hasKnipConfig, runKnip } from "./knip.js";
 import { run } from "./run.js";
 
-/** `nk lint` — oxlint. */
-export function lint() {
-	process.exit(run(FORMATTER.lint[0], FORMATTER.lint[1]));
+/** `nk lint [...]` — oxlint, with extra args passed through (e.g. `--fix`). */
+export function lint(extraArgs = []) {
+	process.exit(run(FORMATTER.lint[0], [...FORMATTER.lint[1], ...extraArgs]));
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-dev",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.",
 	"license": "MIT",
 	"type": "module",
@@ -49,9 +49,9 @@
 		"@testing-library/jest-dom": "^6.9.1",
 		"@typescript/native": "npm:typescript@^7.0.2",
 		"jsdom": "^29.1.1",
-		"knip": "^6.25.0",
-		"oxfmt": "^0.58.0",
-		"oxlint": "^1.73.0",
+		"knip": "^6.27.0",
+		"oxfmt": "^0.59.0",
+		"oxlint": "^1.74.0",
 		"typescript": "npm:@typescript/typescript6@^6.0.2",
 		"vitest": "^4.1.10"
 	},