@ingram-tech/nk-dev 0.6.1 → 0.7.0

package/guide.md

@@ -77,6 +77,18 @@ the UI/page tree, and never expose internal plumbing under `/api/`.
   `@ingram-tech/nk-db`'s drift-aware runner (`@ingram-tech/nk-db/migrate`), which
   surfaces the real Postgres error and pre-flights journal drift. Generate **and
   apply** in the same step; don't leave "run the migration" as a handoff.
+- **`drizzle-kit` is GENERATE-ONLY — it must never apply schema.** Use it for
+  `drizzle-kit generate` (and `generate --custom` for a package-owned/raw SQL
+  migration). Applying is always **`nk-pg-migrate`** (the bin from
+  `@ingram-tech/nk-db`): `bun run db:migrate`, and check first with
+  `db:migrate:status`. Two commands are banned, and `nk doctor` fails on either:
+  - **`drizzle-kit push`** applies a diff straight to the live DB with no
+    migration file and no journal entry. It is the schema-drift source — it has
+    already drifted a production database in this fleet, and where the dev DB is
+    shared it rewrites everyone's. To iterate locally, rebuild from migrations
+    (the PGlite harness / your `dev:*fresh` script), don't push.
+  - **`drizzle-kit migrate`** is opaque: it exits non-zero with no message (even
+    on a clean no-op) and hides journal drift.
 
 ## Large-scale / structural edits
 

package/lib/doctor.js

@@ -36,7 +36,7 @@ function writeJson(file, value) {
  * returns a short past-tense note. `level` is "error" (breaks the model) or
  * "warn" (cosmetic / cleanup).
  */
-function findings(cwd) {
+export function findings(cwd) {
 	const out = [];
 	const pkgPath = resolve(cwd, "package.json");
 	const pkg = readJson(pkgPath);
@@ -202,7 +202,47 @@ function findings(cwd) {
 		}
 	}
 
-	// 7. .prettierignore is now dead weight (nk no longer formats SQL).
+	// 7. drizzle-kit is GENERATE-ONLY — it must never apply schema.
+	//    `drizzle-kit push` diffs the live DB and applies straight to it with no
+	//    migration file and no journal entry: the schema-drift source (it has
+	//    already drifted one production database in this fleet, and on sites
+	//    whose dev DB is shared it rewrites everyone's).
+	//    `drizzle-kit migrate` is opaque — it exits non-zero with no message
+	//    (even on a clean no-op) and hides journal drift.
+	//    `nk-pg-migrate` (@ingram-tech/nk-db) is the one runner that applies:
+	//    it surfaces the real Postgres error and pre-flights drift.
+	for (const [name, cmd] of Object.entries(scripts)) {
+		if (typeof cmd !== "string") continue;
+		if (/\bdrizzle-kit\s+push\b/.test(cmd)) {
+			out.push({
+				id: `script:drizzle-push:${name}`,
+				level: "error",
+				message: `\`${name}\` runs \`drizzle-kit push\` — it applies schema to the live DB with no migration (drift). Generate a migration and apply it with \`nk-pg-migrate\`.`,
+				fix: (dir) => {
+					const p = resolve(dir, "package.json");
+					const j = readJson(p);
+					delete j.scripts?.[name];
+					writeJson(p, j);
+					return `removed \`${name}\` (drizzle-kit push)`;
+				},
+			});
+		} else if (/\bdrizzle-kit\s+migrate\b/.test(cmd)) {
+			out.push({
+				id: `script:drizzle-migrate:${name}`,
+				level: "error",
+				message: `\`${name}\` runs \`drizzle-kit migrate\` — apply with \`nk-pg-migrate\` instead (it surfaces the real error and pre-flights journal drift).`,
+				fix: (dir) => {
+					const p = resolve(dir, "package.json");
+					const j = readJson(p);
+					j.scripts[name] = "nk-pg-migrate";
+					writeJson(p, j);
+					return `set \`${name}\` → "nk-pg-migrate"`;
+				},
+			});
+		}
+	}
+
+	// 8. .prettierignore is now dead weight (nk no longer formats SQL).
 	const prettierIgnore = resolve(cwd, ".prettierignore");
 	if (existsSync(prettierIgnore)) {
 		out.push({
@@ -223,8 +263,9 @@ function findings(cwd) {
 /**
  * `nk doctor [--fix]` — report drift from the canonical nk-dev model (scripts,
  * dependencies, oxlint/tsconfig extends, the CLAUDE.md guide import, stale knip
- * ignores, a dead .prettierignore). With `--fix`, apply every auto-fixable
- * finding, then remind to reinstall.
+ * ignores, forbidden schema-applying drizzle-kit scripts, a dead
+ * .prettierignore). With `--fix`, apply every auto-fixable finding, then remind
+ * to reinstall.
  */
 export function doctor(args = []) {
 	const fix = args.includes("--fix");

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-dev",
-	"version": "0.6.1",
+	"version": "0.7.0",
 	"description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.",
 	"license": "MIT",
 	"type": "module",