Version Packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@ingram-tech/biome-config@0.2.0

Minor Changes

• c763c17: Enforce noNonNullAssertion and noExplicitAny as errors (previously
  warn), so the house rules "no non-null !" and "no any" actually fail
  biome check instead of only being documented. Sites that currently rely on !
  or explicit any will see new errors — replace ! with guard clauses / optional
  chaining, and give any a real type (or unknown + narrowing).

@ingram-tech/newsletter@0.3.0

Minor Changes

• 16abb6f: Validate Supabase rows with Zod at the boundary instead of as-casting them, per
  the house "validate external input with Zod" rule. Row types are now inferred
  from the schemas (single source of truth), the subscribe path now checks the
  previously-dropped lookup error, and zod is a new runtime dependency. Malformed
  rows now throw a clear validation error rather than flowing through as a bad type.

Patch Changes

• Updated dependencies [568ea58]
  • @ingram-tech/email@0.1.2

@ingram-tech/agent-guide@0.1.2

Patch Changes

• 56b48c3: Note that nk is optional convenience that only orchestrates the standard tools
  — a nextkit site must stay buildable with plain next build / next dev. Keeps
  the agent guide consistent with the prime directive.

@ingram-tech/bot-protection@0.3.1

Patch Changes

• 3904231: Clarify in the timing-token docs that it is a timing-window gate, not a
  per-submission nonce: a token can be replayed within its [minMs, maxMs] window,
  so it composes with the honeypot and BotID layers rather than providing single-use
  semantics on its own.

@ingram-tech/email@0.1.2

Patch Changes

• 568ea58: keys() now narrows the validated env vars with a combined guard instead of
  as string casts — no behavior change, but it follows the house "no as on
  external input" rule that the package documents.

@ingram-tech/nk-auth@0.2.2

Patch Changes

• 564413c: createAuthPool now connects to managed Postgres (e.g. Supabase) over TLS
  without chain verification when no caCert is given and the host is remote —
  Supabase's cert chain isn't in Node's trust store, so plain pg verification
  fails with "self-signed certificate in certificate chain" (this 500'd peppost's
  login in production). Local connections stay non-TLS; caCert still does full
  verification. sslmode is stripped from the URL so pg honors the ssl object.