From 1e203b7fa5691f2362d934b8463d4739d54252ca Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 6 Sep 2026 11:43:54 +0000
Subject: [PATCH] Version Packages

---
 .changeset/doctor-oxlintrc-hoisted.md        | 11 ---
 .changeset/nk-base-ui-native-button.md       | 12 ----
 .changeset/nk-check-tailwind-sources.md      | 24 -------
 .changeset/nk-dev-stale-next-types-guide.md  | 10 ---
 .changeset/nk-no-server-env-in-client.md     | 13 ----
 .changeset/nk-no-sql-array-cast.md           | 12 ----
 .changeset/nk-no-unvalidated-request-body.md | 13 ----
 packages/nk-dev/CHANGELOG.md                 | 75 ++++++++++++++++++++
 packages/nk-dev/package.json                 |  2 +-
 9 files changed, 76 insertions(+), 96 deletions(-)
 delete mode 100644 .changeset/doctor-oxlintrc-hoisted.md
 delete mode 100644 .changeset/nk-base-ui-native-button.md
 delete mode 100644 .changeset/nk-check-tailwind-sources.md
 delete mode 100644 .changeset/nk-dev-stale-next-types-guide.md
 delete mode 100644 .changeset/nk-no-server-env-in-client.md
 delete mode 100644 .changeset/nk-no-sql-array-cast.md
 delete mode 100644 .changeset/nk-no-unvalidated-request-body.md

diff --git a/.changeset/doctor-oxlintrc-hoisted.md b/.changeset/doctor-oxlintrc-hoisted.md
deleted file mode 100644
index 2753d5f..0000000
--- a/.changeset/doctor-oxlintrc-hoisted.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"@ingram-tech/nk-dev": patch
----
-
-`nk doctor` no longer flags a hoisted-workspace member whose `.oxlintrc.json`
-extends `../node_modules/@ingram-tech/nk-dev/oxlintrc.json`. oxlint resolves
-`extends` relative to the config file, so that is the only path that works when
-`node_modules` lives at the workspace root; the check matched the literal
-`./node_modules/…` string and `--fix` rewrote the config to a path that does
-not exist, breaking `nk lint`. Both now accept any prefix that reaches the
-file, and `--fix` writes the one that resolves from the site folder.
diff --git a/.changeset/nk-base-ui-native-button.md b/.changeset/nk-base-ui-native-button.md
deleted file mode 100644
index 9570472..0000000
--- a/.changeset/nk-base-ui-native-button.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@ingram-tech/nk-dev": minor
----
-
-New oxlint rule `nextkit/base-ui-native-button` (error): a Base UI button-like
-component rendered as something other than a `<button>` needs
-`nativeButton={false}`. `useButton` defaults the prop to true, so
-`render={<Link />}` on a `Button` or a `*Trigger` makes Base UI skip the
-keyboard, role and form-participation shims the non-native element needs, and
-log an error at runtime. The types cannot see it. The rule only inspects a JSX
-element literal in `render`, so a variable or call falls out for free, and it
-is inert on projects that do not depend on `@base-ui/react`.
diff --git a/.changeset/nk-check-tailwind-sources.md b/.changeset/nk-check-tailwind-sources.md
deleted file mode 100644
index 1365362..0000000
--- a/.changeset/nk-check-tailwind-sources.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-"@ingram-tech/nk-dev": minor
----
-
-`nk check` resolves the tailwind `@source` paths in the site's stylesheets and
-fails on one that matches nothing. Tailwind v4 resolves `@source` against the
-CSS file that carries it and treats a path matching no files as an empty scan,
-so a path one directory short silently drops every utility class only those
-files use: in a monorepo that means the shared component package's buttons,
-badges, tabs and sheets render unstyled in production. Nothing else catches it,
-because nothing else in the toolchain reads CSS: oxlint and tsc do not parse
-it, knip walks the import graph, and `next build` exits 0 with a smaller
-stylesheet. Globbed sources are checked at their literal prefix
-(`../packages/*/src` is checked as `../packages`), `@source inline(...)` is
-ignored, and a site with no `@source` is a no-op.
-
-The gate also checks the other half of the same failure: a workspace
-dependency whose components write class names and that no `@source` scans at
-all. Automatic source detection starts at the site and never reaches a sibling
-package, so a stylesheet that simply never names the shared component library
-drops its classes exactly as a misspelled path does, with even less to notice.
-Linked workspace members are found through the `node_modules` symlink, so it
-works under bun, npm and pnpm workspaces; published dependencies, packages that
-write no class names, and sites with no tailwind entry stylesheet are skipped.
diff --git a/.changeset/nk-dev-stale-next-types-guide.md b/.changeset/nk-dev-stale-next-types-guide.md
deleted file mode 100644
index 297fdf4..0000000
--- a/.changeset/nk-dev-stale-next-types-guide.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-"@ingram-tech/nk-dev": patch
----
-
-Docs: the agent guide now says to type-check with `nk type-check` rather than
-bare `tsc`, and explains that a `tsc` error inside `.next/` (a deleted route or
-a killed `next dev` leaving `.next/dev/types/validator.ts` stale) is generated
-output that `nk type-check` recovers from on its own. The README describes
-that recovery and `nk clean` instead of summarising the command as
-`next typegen && tsc --noEmit`.
diff --git a/.changeset/nk-no-server-env-in-client.md b/.changeset/nk-no-server-env-in-client.md
deleted file mode 100644
index 5b7ea6b..0000000
--- a/.changeset/nk-no-server-env-in-client.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@ingram-tech/nk-dev": minor
----
-
-New oxlint rule `nextkit/no-server-env-in-client` (error): a `"use client"`
-file may read only `NEXT_PUBLIC_*` and `NODE_ENV`. Next inlines nothing else
-into client bundles, so any other `process.env.X` read from a client component
-is `undefined` in the browser while working in dev, in tests, and in every
-server render of the same module — the feature silently never happens. An
-allowlist rather than a list of secret names, because such a list goes stale
-the moment someone adds an integration and the miss is invisible. The fix is
-to read the value on the server and pass it down, not to rename it
-`NEXT_PUBLIC_`, which publishes it to every visitor.
diff --git a/.changeset/nk-no-sql-array-cast.md b/.changeset/nk-no-sql-array-cast.md
deleted file mode 100644
index 26a8c67..0000000
--- a/.changeset/nk-no-sql-array-cast.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@ingram-tech/nk-dev": minor
----
-
-New oxlint rule `nextkit/no-sql-array-cast` (error): no `${value}::type[]` in a
-drizzle `sql` template. A template interpolation is one bound parameter and
-drizzle expands a JS array into several, so the cast lands on a record and
-Postgres fails at run time with "cannot cast type record to uuid[]". Types,
-lint and build are all happy until the query reaches the server. Build the
-array with `array[...]` and `sql.join` instead. Casting a column to an array
-type is legitimate and syntactically identical, so that case takes a justified
-disable comment.
diff --git a/.changeset/nk-no-unvalidated-request-body.md b/.changeset/nk-no-unvalidated-request-body.md
deleted file mode 100644
index b6404bc..0000000
--- a/.changeset/nk-no-unvalidated-request-body.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@ingram-tech/nk-dev": minor
----
-
-New oxlint rule `nextkit/no-unvalidated-request-body` (error), enforcing the
-guide's hard rule in the place it binds hardest: a route handler
-(`app/**/route.ts`) may not assert a type on the body it just parsed.
-`Request.json()` is typed `Promise<any>`, so both `(await req.json()) as Body`
-and `const body: Body = await req.json()` type-check while claiming something
-about a payload the caller controls, and the first symptom is a 500 or a row
-written from a body nobody checked. Parse it with a schema instead;
-`as unknown` on the way into the parser is still fine. Casting a response you
-fetched is a different claim and the rule says nothing about it.
diff --git a/packages/nk-dev/CHANGELOG.md b/packages/nk-dev/CHANGELOG.md
index ee9f0a0..fb36ccd 100644
--- a/packages/nk-dev/CHANGELOG.md
+++ b/packages/nk-dev/CHANGELOG.md
@@ -1,5 +1,80 @@
 # @ingram-tech/nk-dev
 
+## 0.16.0
+
+### Minor Changes
+
+- 314d5c5: New oxlint rule `nextkit/base-ui-native-button` (error): a Base UI button-like
+  component rendered as something other than a `<button>` needs
+  `nativeButton={false}`. `useButton` defaults the prop to true, so
+  `render={<Link />}` on a `Button` or a `*Trigger` makes Base UI skip the
+  keyboard, role and form-participation shims the non-native element needs, and
+  log an error at runtime. The types cannot see it. The rule only inspects a JSX
+  element literal in `render`, so a variable or call falls out for free, and it
+  is inert on projects that do not depend on `@base-ui/react`.
+- b8b2dae: `nk check` resolves the tailwind `@source` paths in the site's stylesheets and
+  fails on one that matches nothing. Tailwind v4 resolves `@source` against the
+  CSS file that carries it and treats a path matching no files as an empty scan,
+  so a path one directory short silently drops every utility class only those
+  files use: in a monorepo that means the shared component package's buttons,
+  badges, tabs and sheets render unstyled in production. Nothing else catches it,
+  because nothing else in the toolchain reads CSS: oxlint and tsc do not parse
+  it, knip walks the import graph, and `next build` exits 0 with a smaller
+  stylesheet. Globbed sources are checked at their literal prefix
+  (`../packages/*/src` is checked as `../packages`), `@source inline(...)` is
+  ignored, and a site with no `@source` is a no-op.
+  
+  The gate also checks the other half of the same failure: a workspace
+  dependency whose components write class names and that no `@source` scans at
+  all. Automatic source detection starts at the site and never reaches a sibling
+  package, so a stylesheet that simply never names the shared component library
+  drops its classes exactly as a misspelled path does, with even less to notice.
+  Linked workspace members are found through the `node_modules` symlink, so it
+  works under bun, npm and pnpm workspaces; published dependencies, packages that
+  write no class names, and sites with no tailwind entry stylesheet are skipped.
+- c291cfe: New oxlint rule `nextkit/no-server-env-in-client` (error): a `"use client"`
+  file may read only `NEXT_PUBLIC_*` and `NODE_ENV`. Next inlines nothing else
+  into client bundles, so any other `process.env.X` read from a client component
+  is `undefined` in the browser while working in dev, in tests, and in every
+  server render of the same module — the feature silently never happens. An
+  allowlist rather than a list of secret names, because such a list goes stale
+  the moment someone adds an integration and the miss is invisible. The fix is
+  to read the value on the server and pass it down, not to rename it
+  `NEXT_PUBLIC_`, which publishes it to every visitor.
+- c8b0901: New oxlint rule `nextkit/no-sql-array-cast` (error): no `${value}::type[]` in a
+  drizzle `sql` template. A template interpolation is one bound parameter and
+  drizzle expands a JS array into several, so the cast lands on a record and
+  Postgres fails at run time with "cannot cast type record to uuid[]". Types,
+  lint and build are all happy until the query reaches the server. Build the
+  array with `array[...]` and `sql.join` instead. Casting a column to an array
+  type is legitimate and syntactically identical, so that case takes a justified
+  disable comment.
+- da249da: New oxlint rule `nextkit/no-unvalidated-request-body` (error), enforcing the
+  guide's hard rule in the place it binds hardest: a route handler
+  (`app/**/route.ts`) may not assert a type on the body it just parsed.
+  `Request.json()` is typed `Promise<any>`, so both `(await req.json()) as Body`
+  and `const body: Body = await req.json()` type-check while claiming something
+  about a payload the caller controls, and the first symptom is a 500 or a row
+  written from a body nobody checked. Parse it with a schema instead;
+  `as unknown` on the way into the parser is still fine. Casting a response you
+  fetched is a different claim and the rule says nothing about it.
+
+### Patch Changes
+
+- 9ee76f6: `nk doctor` no longer flags a hoisted-workspace member whose `.oxlintrc.json`
+  extends `../node_modules/@ingram-tech/nk-dev/oxlintrc.json`. oxlint resolves
+  `extends` relative to the config file, so that is the only path that works when
+  `node_modules` lives at the workspace root; the check matched the literal
+  `./node_modules/…` string and `--fix` rewrote the config to a path that does
+  not exist, breaking `nk lint`. Both now accept any prefix that reaches the
+  file, and `--fix` writes the one that resolves from the site folder.
+- 1dbead5: Docs: the agent guide now says to type-check with `nk type-check` rather than
+  bare `tsc`, and explains that a `tsc` error inside `.next/` (a deleted route or
+  a killed `next dev` leaving `.next/dev/types/validator.ts` stale) is generated
+  output that `nk type-check` recovers from on its own. The README describes
+  that recovery and `nk clean` instead of summarising the command as
+  `next typegen && tsc --noEmit`.
+
 ## 0.15.0
 
 ### Minor Changes
diff --git a/packages/nk-dev/package.json b/packages/nk-dev/package.json
index 2342daf..7b4da91 100644
--- a/packages/nk-dev/package.json
+++ b/packages/nk-dev/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-tech/nk-dev",
-	"version": "0.15.0",
+	"version": "0.16.0",
 	"description": "The nextkit dev toolchain in one package: the `nk` CLI plus shared oxlint/oxfmt, TypeScript, and Vitest config, the format-on-commit hook, and the AI agent guide. `nk init` scaffolds a site to use it.",
 	"license": "MIT",
 	"type": "module",