@xeplr/actions 1.1.19 → 1.1.20

package/README.md

@@ -300,9 +300,20 @@ Logical types and what each driver creates:
 | number | NUMERIC | DECIMAL(38,10) | DECIMAL(38,10) | DOUBLE |
 | boolean | BOOLEAN | TINYINT(1) | BIT | BOOLEAN |
 | date | DATE | DATE | DATE | DATE |
-| datetime | TIMESTAMPTZ | DATETIME(6) | DATETIME2 | TIMESTAMPTZ |
+| datetime (an instant) | TIMESTAMPTZ | DATETIME(6), in UTC | DATETIME2, in UTC | TIMESTAMPTZ |
+| localdatetime (no zone) | TIMESTAMP | DATETIME(6) | DATETIME2 | TIMESTAMP |
 | object / array | JSONB | JSON | NVARCHAR(MAX) | JSON |
 
+**Dates and times follow three rules, on every driver** (`lib/drivers/db/dateValues.js`, the one copy):
+
+1. **A `date` is copied as the same day.** MySQL/Postgres/SQL Server `DATE` → `date`.
+2. **A date-time with a zone is copied as the same instant**, stored in UTC. MySQL `TIMESTAMP`, Postgres `timestamptz`, SQL Server `datetimeoffset`, DuckDB `TIMESTAMPTZ` → `datetime`.
+3. **A date-time without a zone is copied as its digits**, `10:00` stays `10:00`, and stays zoneless. MySQL `DATETIME`, Postgres `timestamp`, SQL Server `datetime`/`datetime2`/`smalldatetime`, DuckDB `TIMESTAMP` → `localdatetime`. Which zone it was recorded in is declared where it is used (a cube's source zone), never guessed here.
+
+**Nothing reads the machine's time zone.** The MySQL session is pinned to UTC (`SET time_zone = '+00:00'` on every connection), SQL Server to `useUTC: true` (after the caller's options), Postgres returns `date` and `timestamp` as text, and DuckDB opens with `TimeZone = 'UTC'`. Every JS `Date` is read with `getUTC*`, and a string with no zone is read as UTC, never handed to `new Date()`. `test/dates-across-zones.test.js` moves a real table from each of the three databases into DuckDB with the process in India time and in New York time, and the two must store the same values.
+
+**An existing target column that is zoned but receives a zoneless source column is retyped once** to zoneless, keeping its digits (Postgres and DuckDB; `buildRetypeToLocalDateTimeSql`). Tables created before this rule held those values as instants.
+
 Inference (`inferColumns`): any array → `array`; any object → `object`; all `Date` or ISO-date strings → `datetime`; all booleans → `boolean`; all numbers → `number`; anything else, or all null → `string`.
 
 ### Staged loads
@@ -421,7 +432,7 @@ await driver.query(pool, userSql, params)          // reads only
 | Movement logs carry identifiers, counts, SQL and the error text — never parameter values or row contents; a failed batch shows one row's primary key, not its data. | Logs are copied into tickets and chats. |
 | DuckDB opens **read-only unless the call says `access: 'rw'`**; no environment variable can grant write. A file already open read-only in the process refuses a write. Opening waits on the lock (`openTimeoutMs`, default 60 s). | One read-write process locks every other process out, even readers. Write access belongs at the call site that writes. |
 | **Every DuckDB value comes out plain**, from `query` and `fetchStream` alike: a number, text, boolean, `Date`, array or object, never a BigInt or a DuckDB wrapper object. DECIMAL is a number; DATE and TIMESTAMP are `Date`s; a whole number too big to hold exactly (beyond ±9,007,199,254,740,991) is **text**, never rounded; lists, structs and maps are arrays and objects; TIME, INTERVAL, UUID and any other type are text. `fetchStream` has DuckDB do the conversion inside its engine by wrapping the query (about +3% on a million rows); a query with nothing to convert runs as given. | A streamed read used to hand DECIMAL and TIMESTAMP back as wrapper objects with a BigInt inside, and the first `JSON.stringify` downstream failed with "Do not know how to serialize a BigInt". Text for huge numbers is what the Postgres, MySQL and SQL Server drivers already return. |
-| **A DuckDB timestamp without a zone is read as UTC**; one with a zone keeps its exact instant. | Data is kept in UTC; the viewer's time zone is applied when rendering, never in the driver. |
+| **DuckDB works in UTC** (`TimeZone = 'UTC'` on every instance). A timestamp without a zone is read with its digits in the `Date`'s UTC fields; one with a zone keeps its exact instant. | Left to the machine's zone, `date_trunc('month', …)` of 1 Aug 00:00 UTC on a server in India was 31 Jul 18:30, so August was labelled July, and a filter "to 31 Aug" ended at 30 Aug 18:30. |
 | `meta-store-knex` requires `service` and `applicationId`, and scopes every statement by `applicationId`. | `import_meta` is shared by every app; unattributed rows, or a rollback decided from another app's row, are worse than refusing. |
 | Mail filenames are sanitised (`[^\w.-]` → `_`, all-dot names → `attachment`, max 180 chars) and prefixed with a random id. | Attachment names come from the sender and could escape the output directory; common names collide. |
 | The system mail sender refuses `text`, `bcc`, `from`, `replyTo` rather than dropping them. | A silently lost bcc is a compliance problem found a year later. |

package/lib/drivers/db/dateValues.js

@@ -0,0 +1,106 @@
+// Dates and times as they move between databases — the ONE copy every driver
+// uses, so no driver can quietly read a value in this machine's zone.
+//
+// Three logical types, and three rules:
+//
+//   date           a calendar day. Copied as the same day, always.
+//   datetime       an INSTANT (MySQL TIMESTAMP, Postgres timestamptz, SQL Server
+//                  datetimeoffset, DuckDB TIMESTAMPTZ). Copied as the same
+//                  instant, in UTC.
+//   localdatetime  a wall-clock reading with NO zone (MySQL DATETIME, Postgres
+//                  timestamp, SQL Server datetime/datetime2, DuckDB TIMESTAMP).
+//                  Copied digit for digit — 10:00 stays 10:00. What zone it was
+//                  recorded in is declared later, where it is used (a cube's
+//                  source timezone), never guessed here.
+//
+// NOTHING HERE READS THE MACHINE'S ZONE. Every Date is read with getUTC*, and a
+// string without a zone is read as UTC rather than handed to `new Date()`,
+// which would read it in local time. The drivers deliver values on the same
+// terms: the MySQL session is pinned to UTC, the SQL Server driver to useUTC,
+// Postgres returns its zoneless types as text, and DuckDB works in UTC. So a
+// value here means the same thing on a server in India and one in New York —
+// the tests run under both zones to keep it that way.
+
+function pad(n, width) { return String(n).padStart(width || 2, '0'); }
+
+function utcDate(d) {
+  return d.getUTCFullYear() + '-' + pad(d.getUTCMonth() + 1) + '-' + pad(d.getUTCDate());
+}
+
+function utcClock(d) {
+  return pad(d.getUTCHours()) + ':' + pad(d.getUTCMinutes()) + ':' + pad(d.getUTCSeconds()) + '.' + pad(d.getUTCMilliseconds(), 3);
+}
+
+// '2025-08-01', '2025-08-01 10:00', '2025-08-01T10:00:00.123456', optionally with
+// 'Z' or an offset. Captures the parts as written.
+var STAMP = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?)?\s*(Z|[+-]\d{2}(?::?\d{2})?)?$/i;
+
+/**
+ * A calendar day as YYYY-MM-DD. A Date is read in UTC — every driver delivers a
+ * date as midnight UTC of that day, or as text.
+ */
+function toDateOnly(v) {
+  if (v === null || v === undefined) return v;
+  if (v instanceof Date) return isNaN(v.getTime()) ? null : utcDate(v);
+  var m = /^(\d{4}-\d{2}-\d{2})/.exec(String(v).trim());
+  return m ? m[1] : v;
+}
+
+/**
+ * A zoneless wall-clock time as 'YYYY-MM-DD HH:MM:SS.mmm', the digits it had.
+ * A Date carries those digits in its UTC fields (that is how the drivers hand
+ * one over); a string keeps its own digits, and any zone on it is dropped —
+ * the column has none to keep.
+ */
+function toLocalDateTime(v) {
+  if (v === null || v === undefined) return v;
+  if (v instanceof Date) return isNaN(v.getTime()) ? null : utcDate(v) + ' ' + utcClock(v);
+  var m = STAMP.exec(String(v).trim());
+  if (!m) return v;
+  var ms = m[5] ? (m[5] + '00').slice(0, 3) : '000';
+  return m[1] + ' ' + (m[2] || '00') + ':' + (m[3] || '00') + ':' + (m[4] || '00') + '.' + ms;
+}
+
+/**
+ * An instant as a Date. A string that names its zone is read in it; one that
+ * does not is read as UTC (a MySQL TIMESTAMP from a UTC session), never in this
+ * machine's zone. Unreadable → null.
+ */
+function toInstant(v) {
+  if (v === null || v === undefined) return null;
+  if (v instanceof Date) return isNaN(v.getTime()) ? null : v;
+  var m = STAMP.exec(String(v).trim());
+  if (!m) return null;
+  var iso = m[1] + 'T' + (m[2] || '00') + ':' + (m[3] || '00') + ':' + (m[4] || '00') +
+    (m[5] ? '.' + (m[5] + '00').slice(0, 3) : '') + (m[6] ? normalizeZone(m[6]) : 'Z');
+  var d = new Date(iso);
+  return isNaN(d.getTime()) ? null : d;
+}
+
+function normalizeZone(z) {
+  if (/^z$/i.test(z)) return 'Z';
+  var m = /^([+-])(\d{2}):?(\d{2})?$/.exec(z);
+  return m ? m[1] + m[2] + ':' + (m[3] || '00') : 'Z';
+}
+
+/** An instant as ISO 8601 in UTC ('…Z'), or the value unchanged when unreadable. */
+function toInstantIso(v) {
+  if (v === null || v === undefined) return v;
+  var d = toInstant(v);
+  return d ? d.toISOString() : v;
+}
+
+/** An instant as 'YYYY-MM-DD HH:MM:SS.mmm' in UTC — for a column with no zone of its own (MySQL, SQL Server). */
+function toInstantUtcClock(v) {
+  if (v === null || v === undefined) return v;
+  var d = toInstant(v);
+  return d ? utcDate(d) + ' ' + utcClock(d) : v;
+}
+
+module.exports = {
+  toDateOnly: toDateOnly,
+  toLocalDateTime: toLocalDateTime,
+  toInstant: toInstant,
+  toInstantIso: toInstantIso,
+  toInstantUtcClock: toInstantUtcClock
+};

package/lib/drivers/db/duckdb.js

@@ -81,7 +81,8 @@ var TYPE_MAP = {
   number:   'DOUBLE',
   boolean:  'BOOLEAN',
   date:     'DATE',
-  datetime: 'TIMESTAMPTZ',
+  datetime: 'TIMESTAMPTZ',     // an instant
+  localdatetime: 'TIMESTAMP',  // no zone; its digits as they were (dateValues.js)
   object:   'JSON',
   array:    'JSON'
 };
@@ -94,8 +95,10 @@ var DUCK_TO_LOGICAL = {
   'HUGEINT': 'number',  'UTINYINT': 'number', 'USMALLINT': 'number', 'UINTEGER': 'number',
   'UBIGINT': 'number',  'FLOAT': 'number',    'DOUBLE': 'number',  'DECIMAL': 'number',
   'DATE': 'date',
-  'TIMESTAMP': 'datetime', 'TIMESTAMP WITH TIME ZONE': 'datetime',
-  'TIMESTAMP_S': 'datetime', 'TIMESTAMP_MS': 'datetime', 'TIMESTAMP_NS': 'datetime',
+  // A TIMESTAMP has no zone — a wall-clock reading, copied as its digits. Only
+  // the one WITH a zone is an instant.
+  'TIMESTAMP': 'localdatetime', 'TIMESTAMP WITH TIME ZONE': 'datetime',
+  'TIMESTAMP_S': 'localdatetime', 'TIMESTAMP_MS': 'localdatetime', 'TIMESTAMP_NS': 'localdatetime',
   'TIME': 'datetime',   'TIME WITH TIME ZONE': 'datetime', 'INTERVAL': 'string',
   'JSON': 'object',     'STRUCT': 'object',   'MAP': 'object',
   'LIST': 'array'
@@ -234,7 +237,15 @@ async function connect(config) {
     return existing.pool;
   }
 
-  var options = access === 'ro' ? { access_mode: 'READ_ONLY' } : {};
+  // THE SESSION ZONE IS UTC, ALWAYS. DuckDB otherwise takes the machine's
+  // zone, and every date operation on a TIMESTAMPTZ — date_trunc, comparing
+  // with a plain date, a cast to DATE — happens in it. On a server in India
+  // the month of 1 Aug 00:00 UTC came back as 31 Jul 18:30, a board asked for
+  // August labelled its total "Jul-2025", and a filter "to 31 Aug" ended at
+  // 30 Aug 18:30. Data here is kept in UTC (and a cube stores its days already
+  // cut in its own reporting zone), so UTC is the zone that changes nothing.
+  // Set on the instance, so every connection to the file inherits it.
+  var options = Object.assign({ TimeZone: 'UTC' }, access === 'ro' ? { access_mode: 'READ_ONLY' } : {});
   // Waits rather than failing — see openWithWait. This is what makes the
   // file's own lock the mutex and removes any need to designate a writer.
   var instance = await openWithWait(api, key, options, access,
@@ -516,19 +527,8 @@ function buildInsertSql(tableName, rows, columns, movementId, primaryKeys) {
   return { sql: sql, params: params };
 }
 
-// A calendar date as YYYY-MM-DD with no timezone conversion — see the note in
-// postgres.js; the bug it avoids is identical here.
-function toDateOnly(v) {
-  if (v === null || v === undefined) return v;
-  if (v instanceof Date) {
-    if (isNaN(v.getTime())) return null;
-    return v.getFullYear() + '-' +
-      String(v.getMonth() + 1).padStart(2, '0') + '-' +
-      String(v.getDate()).padStart(2, '0');
-  }
-  var m = /^(\d{4}-\d{2}-\d{2})/.exec(String(v));
-  return m ? m[1] : v;
-}
+// Dates and times: one shared rule for every driver (dateValues.js).
+var dateValues = require('./dateValues');
 
 // Coerce a JS value to the effective column type. Same contract as the other
 // drivers: a value that cannot fit passes through unchanged so DuckDB rejects
@@ -567,11 +567,13 @@ function coerceValue(v, type) {
       return v;
 
     case 'date':
-      return toDateOnly(v);
+      return dateValues.toDateOnly(v);
 
     case 'datetime':
-      if (v instanceof Date) return v.toISOString();
-      return v;
+      return dateValues.toInstantIso(v);
+
+    case 'localdatetime':
+      return dateValues.toLocalDateTime(v);
 
     case 'object':
     case 'array':
@@ -955,7 +957,17 @@ async function committedMovement(pool, movementId) {
   return r.rows[0] || null;
 }
 
+/**
+ * A zoned date-time column that holds zoneless values, retyped to zoneless with
+ * the same digits (read in UTC — how they were written). See the uploader's
+ * bootstrap for when this runs.
+ */
+function buildRetypeToLocalDateTimeSql(tableName, column) {
+  return 'ALTER TABLE ' + quoteIdent(tableName) + ' ALTER COLUMN ' + quoteIdent(column) + ' SET DATA TYPE TIMESTAMP';
+}
+
 module.exports = {
+  buildRetypeToLocalDateTimeSql: buildRetypeToLocalDateTimeSql,
   requires: ['@duckdb/node-api'],
 
   connect: connect,

package/lib/drivers/db/mssql.js

@@ -22,8 +22,9 @@
 //   number  → DECIMAL(38,10)   (38 is SQL Server's max precision; > 10
 //                               fractional digits are rounded)
 //   boolean → BIT
-//   date    → DATETIME2        (user rule: always datetime, stored UTC)
-//   datetime→ DATETIME2
+//   date          → DATE       (the same day — dateValues.js)
+//   datetime      → DATETIME2  (an instant, written in UTC)
+//   localdatetime → DATETIME2  (no zone; its digits as they were)
 //   object  → NVARCHAR(MAX)    (SQL Server has no native JSON type)
 //   array   → NVARCHAR(MAX)
 
@@ -33,6 +34,7 @@ var TYPE_MAP = {
   boolean:  'BIT',
   date:     'DATE',
   datetime: 'DATETIME2',
+  localdatetime: 'DATETIME2',
   object:   'NVARCHAR(MAX)',
   array:    'NVARCHAR(MAX)'
 };
@@ -45,30 +47,16 @@ var NATIVE_TO_LOGICAL = {
   decimal: 'number', numeric: 'number', float: 'number', real: 'number',
   money: 'number', smallmoney: 'number',
   bit: 'boolean',
-  datetime: 'datetime', datetime2: 'datetime', smalldatetime: 'datetime',
+  // No zone: copied as their digits (dateValues.js). datetimeoffset is an
+  // instant.
+  datetime: 'localdatetime', datetime2: 'localdatetime', smalldatetime: 'localdatetime',
   // 'date' maps to its OWN logical type — see reconcile.js.
   date: 'date', time: 'datetime', datetimeoffset: 'datetime'
 };
 
 
-// A calendar date, as YYYY-MM-DD, with NO timezone conversion.
-//
-// toISOString() would convert to UTC first, which is exactly the bug: a Date
-// holding 2026-01-05 local becomes 2026-01-04 in UTC anywhere east of
-// Greenwich. The local getters are the right ones here precisely because a
-// business date has no instant to convert.
-function toDateOnly(v) {
-  if (v === null || v === undefined) return v;
-  if (v instanceof Date) {
-    if (isNaN(v.getTime())) return null;
-    return v.getFullYear() + '-' +
-      String(v.getMonth() + 1).padStart(2, '0') + '-' +
-      String(v.getDate()).padStart(2, '0');
-  }
-  // Already a date string — take the date part and leave the rest alone.
-  var m = /^(\d{4}-\d{2}-\d{2})/.exec(String(v));
-  return m ? m[1] : v;
-}
+// Dates and times: one shared rule for every driver (dateValues.js).
+var dateValues = require('./dateValues');
 
 var INTERNAL_ID_COL       = '__xeplr_id__';
 var INTERNAL_MOVEMENT_COL = '__xeplr_movement_id__';
@@ -92,7 +80,12 @@ async function connect(config) {
       // batch and has no session-level read-only mode, so SQL the caller did
       // not write needs a login that can only read (db_datareader). See README.
       config.readOnly ? { readOnlyIntent: true } : {},
-      config.options || {}
+      config.options || {},
+      // PINNED, after the caller's options: a zoneless datetime/date comes
+      // back with its digits in the Date's UTC fields, whatever zone this
+      // process is in. It was the library's default, which a default change
+      // or a caller's `useUTC: false` would have silently undone.
+      { useUTC: true }
     )
   });
   await pool.connect();
@@ -265,7 +258,7 @@ function coerceValue(v, type) {
 
   switch (type) {
     case 'string':
-      if (v instanceof Date)     return toMssqlDatetime(v);
+      if (v instanceof Date)     return dateValues.toInstantUtcClock(v);
       if (Array.isArray(v))      return JSON.stringify(v);
       if (typeof v === 'object') return JSON.stringify(v);
       return String(v);
@@ -289,10 +282,13 @@ function coerceValue(v, type) {
       return v;                    // let SQL Server reject
 
     case 'date':
-      return toDateOnly(v);
+      return dateValues.toDateOnly(v);
 
     case 'datetime':
-      return toMssqlDatetime(v);
+      return dateValues.toInstantUtcClock(v);
+
+    case 'localdatetime':
+      return dateValues.toLocalDateTime(v);
 
     case 'object':
     case 'array':
@@ -304,13 +300,6 @@ function coerceValue(v, type) {
   }
 }
 
-// 'YYYY-MM-DD HH:MM:SS.mmm' in UTC — DATETIME2 parses this unambiguously.
-// Unparseable input passes through so SQL Server rejects it (→ error table).
-function toMssqlDatetime(v) {
-  var d = (v instanceof Date) ? v : new Date(v);
-  if (isNaN(d.getTime())) return v;
-  return d.toISOString().slice(0, 23).replace('T', ' ');
-}
 
 async function getTableSchema(pool, tableName, schema) {
   var r = await query(pool,

package/lib/drivers/db/mysql.js

@@ -19,8 +19,9 @@
 //   number  → DECIMAL(38,10)   (exact; > 10 fractional digits are rounded —
 //                               pre-create a wider column if you need more)
 //   boolean → TINYINT(1)
-//   date    → DATETIME(6)      (user rule: always datetime, stored UTC)
-//   datetime→ DATETIME(6)
+//   date          → DATE         (the same day — dateValues.js)
+//   datetime      → DATETIME(6)  (an instant, written in UTC)
+//   localdatetime → DATETIME(6)  (no zone; its digits as they were)
 //   object  → JSON
 //   array   → JSON
 
@@ -29,7 +30,8 @@ var TYPE_MAP = {
   number:   'DECIMAL(38,10)',
   boolean:  'TINYINT(1)',
   date:     'DATE',
-  datetime: 'DATETIME(6)',
+  datetime: 'DATETIME(6)',      // an instant, written in UTC
+  localdatetime: 'DATETIME(6)', // a wall-clock reading, written as its digits
   object:   'JSON',
   array:    'JSON'
 };
@@ -43,30 +45,16 @@ var NATIVE_TO_LOGICAL = {
   float: 'number', double: 'number', bit: 'boolean',
   // 'date' maps to its OWN logical type — see reconcile.js. A DATE column
   // created as DATETIME acquires a midnight that shifts under a timezone.
-  date: 'date', datetime: 'datetime', timestamp: 'datetime',
+  // DATETIME has no zone — its digits are copied as they are (dateValues.js).
+  // TIMESTAMP is an instant, read in UTC (the session is pinned to it below).
+  date: 'date', datetime: 'localdatetime', timestamp: 'datetime',
   time: 'datetime', year: 'datetime',
   json: 'object'
 };
 
 
-// A calendar date, as YYYY-MM-DD, with NO timezone conversion.
-//
-// toISOString() would convert to UTC first, which is exactly the bug: a Date
-// holding 2026-01-05 local becomes 2026-01-04 in UTC anywhere east of
-// Greenwich. The local getters are the right ones here precisely because a
-// business date has no instant to convert.
-function toDateOnly(v) {
-  if (v === null || v === undefined) return v;
-  if (v instanceof Date) {
-    if (isNaN(v.getTime())) return null;
-    return v.getFullYear() + '-' +
-      String(v.getMonth() + 1).padStart(2, '0') + '-' +
-      String(v.getDate()).padStart(2, '0');
-  }
-  // Already a date string — take the date part and leave the rest alone.
-  var m = /^(\d{4}-\d{2}-\d{2})/.exec(String(v));
-  return m ? m[1] : v;
-}
+// Dates and times: one shared rule for every driver (dateValues.js).
+var dateValues = require('./dateValues');
 
 var INTERNAL_ID_COL       = '__xeplr_id__';
 var INTERNAL_MOVEMENT_COL = '__xeplr_movement_id__';
@@ -96,6 +84,13 @@ async function connect(config) {
     stringifyObjects:  true
     // multipleStatements stays at its default (off): one statement per query.
   });
+  // THE SESSION IS IN UTC. MySQL hands a TIMESTAMP back in the session's zone
+  // (the server's own unless told), so without this the same instant read
+  // from a server set to India time came back 5½ hours off. Run first on
+  // every connection the pool opens; mysql2 queues it ahead of any query.
+  pool.pool.on('connection', function(conn) {
+    conn.query("SET time_zone = '+00:00'");
+  });
   // READ-ONLY CONNECTIONS — `connect({ ..., readOnly: true })` for SQL the
   // caller did not write itself. Every connection the pool opens is put into
   // read-only transaction mode before it is used, so a write fails.
@@ -262,7 +257,7 @@ function coerceValue(v, type) {
 
   switch (type) {
     case 'string':
-      if (v instanceof Date)     return toMysqlDatetime(v);
+      if (v instanceof Date)     return dateValues.toInstantUtcClock(v);
       if (Array.isArray(v))      return JSON.stringify(v);
       if (typeof v === 'object') return JSON.stringify(v);
       return String(v);
@@ -286,10 +281,13 @@ function coerceValue(v, type) {
       return v;                    // let MySQL reject
 
     case 'date':
-      return toDateOnly(v);
+      return dateValues.toDateOnly(v);
 
     case 'datetime':
-      return toMysqlDatetime(v);
+      return dateValues.toInstantUtcClock(v);
+
+    case 'localdatetime':
+      return dateValues.toLocalDateTime(v);
 
     case 'object':
     case 'array':
@@ -301,13 +299,6 @@ function coerceValue(v, type) {
   }
 }
 
-// 'YYYY-MM-DD HH:MM:SS.mmm' in UTC — the format MySQL DATETIME accepts.
-// Unparseable input passes through so MySQL rejects it (→ error table).
-function toMysqlDatetime(v) {
-  var d = (v instanceof Date) ? v : new Date(v);
-  if (isNaN(d.getTime())) return v;
-  return d.toISOString().slice(0, 23).replace('T', ' ');
-}
 
 async function getTableSchema(pool, tableName, schema) {
   var r = await query(pool,

package/lib/drivers/db/postgres.js

@@ -22,8 +22,9 @@
 //   string  → TEXT
 //   number  → NUMERIC          (integer + float both handled)
 //   boolean → BOOLEAN
-//   date    → TIMESTAMPTZ      (user rule: "always datetime, never date-only")
-//   datetime→ TIMESTAMPTZ
+//   date          → DATE         (the same day — dateValues.js)
+//   datetime      → TIMESTAMPTZ  (an instant)
+//   localdatetime → TIMESTAMP    (no zone; its digits as they were)
 //   object  → JSONB
 //   array   → JSONB
 
@@ -33,6 +34,7 @@ var TYPE_MAP = {
   boolean:  'BOOLEAN',
   date:     'DATE',
   datetime: 'TIMESTAMPTZ',
+  localdatetime: 'TIMESTAMP',
   object:   'JSONB',
   array:    'JSONB'
 };
@@ -60,7 +62,17 @@ async function connect(config) {
     user:     config.user,
     password: config.password,
     database: config.database,
-    max:      config.maxConnections || 10
+    max:      config.maxConnections || 10,
+    // THE ZONELESS TYPES COME BACK AS TEXT. node-pg turns a `date` and a
+    // `timestamp` into a JS Date read in THIS PROCESS's zone, so the same row
+    // read on a server in India and one in New York came back as two
+    // different instants — and a date a day apart. As text they are exactly
+    // the digits stored. `timestamptz` (1184) is a real instant and stays a
+    // Date.
+    types: { getTypeParser: function(oid, format) {
+      if (oid === 1082 || oid === 1114) return function(text) { return text; };
+      return pg.types.getTypeParser(oid, format);
+    } }
   });
   if (config.readOnly) pool.__xeplrReadOnly = true;
   return pool;
@@ -98,24 +110,9 @@ async function query(pool, sql, params) {
 
 function toPgType(type) { return TYPE_MAP[type] || 'TEXT'; }
 
-// A calendar date, as YYYY-MM-DD, with NO timezone conversion.
-//
-// toISOString() would convert to UTC first, which is exactly the bug: a Date
-// holding 2026-01-05 local becomes 2026-01-04 in UTC anywhere east of
-// Greenwich. The local getters are the right ones here precisely because a
-// business date has no instant to convert.
-function toDateOnly(v) {
-  if (v === null || v === undefined) return v;
-  if (v instanceof Date) {
-    if (isNaN(v.getTime())) return null;
-    return v.getFullYear() + '-' +
-      String(v.getMonth() + 1).padStart(2, '0') + '-' +
-      String(v.getDate()).padStart(2, '0');
-  }
-  // Already a date string — take the date part and leave the rest alone.
-  var m = /^(\d{4}-\d{2}-\d{2})/.exec(String(v));
-  return m ? m[1] : v;
-}
+// Dates and times: one shared rule for every driver (dateValues.js).
+var dateValues = require('./dateValues');
+var toDateOnly = dateValues.toDateOnly;
 
 
 // Double-quote a Postgres identifier, escaping embedded quotes.
@@ -251,8 +248,10 @@ function coerceValue(v, type) {
       return toDateOnly(v);
 
     case 'datetime':
-      if (v instanceof Date)         return v.toISOString();
-      return v;                       // strings pass through; PG parses
+      return dateValues.toInstantIso(v);
+
+    case 'localdatetime':
+      return dateValues.toLocalDateTime(v);
 
     case 'object':
     case 'array':
@@ -395,7 +394,17 @@ async function rollbackMovement(pool, tableName, movementId) {
   return result;
 }
 
+/**
+ * A zoned date-time column that holds zoneless values, retyped to zoneless with
+ * the same digits (read in UTC — how they were written). See the uploader's
+ * bootstrap for when this runs.
+ */
+function buildRetypeToLocalDateTimeSql(tableName, column) {
+  return 'ALTER TABLE ' + quoteIdent(tableName) + ' ALTER COLUMN ' + quoteIdent(column) + ' TYPE timestamp USING ' + quoteIdent(column) + " AT TIME ZONE 'UTC'";
+}
+
 module.exports = {
+  buildRetypeToLocalDateTimeSql: buildRetypeToLocalDateTimeSql,
   requires: ['pg'],
 
   // Connection lifecycle

package/lib/formats/writers/xlsx.js

@@ -17,6 +17,7 @@
 // same memory as a hundred. Only the first SAMPLE_ROWS are held, to size the
 // columns, because <cols> must come before the rows in the sheet.
 
+var dateValues = require('../../drivers/db/dateValues');
 var fs = require('fs');
 
 var MAX_ROWS = 1048576;          // Excel's own limit, header and title rows included
@@ -38,9 +39,14 @@ function colName(i) {
   return s;
 }
 
-/** A Date, or an ISO date string, as an Excel serial — or null. */
+/**
+ * A Date, or an ISO date string, as an Excel serial — or null. A string with
+ * no zone is read as UTC (dateValues.toInstant), never in this machine's zone:
+ * `new Date('2025-08-01 10:00')` would put a different time in the cell on a
+ * server in India than on one in New York.
+ */
 function dateSerial(value) {
-  var d = value instanceof Date ? value : (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}/.test(value) ? new Date(value) : null);
+  var d = value instanceof Date ? value : (typeof value === 'string' ? dateValues.toInstant(value) : null);
   if (!d || isNaN(d.getTime())) return null;
   return d.getTime() / 86400000 + 25569;
 }

package/lib/uploader/index.js

@@ -410,6 +410,20 @@ async function runBootstrap(driver, pool, targetTable, columns, primaryKeys, sta
   var { reconcileColumns } = require('./reconcile');
   var reconciled = reconcileColumns(columns, targetSchema, driver.dataTypeToLogical);
 
+  // A ZONELESS SOURCE COLUMN IN A ZONED TARGET COLUMN. Tables created before
+  // zoneless date-times had their own type hold them as instants (the digits
+  // read as UTC). The target's type would win and keep it so forever — so it
+  // is retyped to zoneless, once, keeping those same digits. Only where the
+  // dialect has the two kinds (Postgres, DuckDB); MySQL DATETIME and SQL
+  // Server DATETIME2 are zoneless already.
+  var retype = reconciled.filter(function(c) { return c.sourceType === 'localdatetime' && c.targetType === 'datetime'; });
+  if (retype.length && typeof driver.buildRetypeToLocalDateTimeSql === 'function') {
+    for (var r = 0; r < retype.length; r++) {
+      await driver.query(pool, driver.buildRetypeToLocalDateTimeSql(targetTable, retype[r].name));
+    }
+    reconciled = reconcileColumns(columns, await driver.getTableSchema(pool, targetTable), driver.dataTypeToLogical);
+  }
+
   var missing = reconciled.filter(function(c) { return c.missing; });
   if (missing.length > 0) {
     throw new Error(

package/lib/uploader/reconcile.js

@@ -29,7 +29,8 @@ var PG_TO_LOGICAL = {
   'double precision':            'number',
   'boolean':                     'boolean',
   'timestamp with time zone':    'datetime',
-  'timestamp without time zone': 'datetime',
+  // No zone: copied as its digits, never as an instant (drivers/db/dateValues.js).
+  'timestamp without time zone': 'localdatetime',
   // A DATE IS NOT A TIMESTAMP, and mapping it to one moves it.
   //
   // This said 'datetime', so a source `date` was created as TIMESTAMPTZ in the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xeplr/actions",
-  "version": "1.1.19",
+  "version": "1.1.20",
   "description": "Named-action registry with typed inputs and safe invocation — plus built-in actions for HTTP, DB, files, email, spawn",
   "main": "index.js",
   "files": [