Fix server type errors after dual-driver; swap postgres.js → node-postgres (#32)

Background: the dual-driver commit (#29) typed the exported `db` as
`NeonHttpDatabase | PostgresJsDatabase`, which degraded every
`.returning()` / `.execute().rows` call site via builder-chain
signature intersection — 60+ ghost type errors across the modules.

Fixes:
- db.ts: narrow `db` to `NeonHttpDatabase<typeof schema>` (the production
  driver and the shape the codebase was written against). Type-level also
  enforces the no-transactions rule documented in apps/server/CLAUDE.md.
- db.ts: swap the local-Postgres branch from `postgres.js` to `pg` via
  `drizzle-orm/node-postgres`. `pg`'s `{ rows, fields, rowCount }` result
  matches `NeonHttpQueryResult` natively, dropping the `.rows` shim,
  timestamp OID serializers, and `prepare: false` workarounds. Pin UTC
  at connection startup via libpq `options: "-c TimeZone=UTC"`.
- env-bindings.d.ts: augment `Cloudflare.Env` with the 8 secrets wrangler
  can't infer (DATABASE_URL, BETTER_AUTH_*, UPSTASH_*, TINYBIRD_*).
- env.ts + require-client-credential.ts: add `ClientCredentialContext`
  and set `c.var.clientCredential` in the middleware, previously referenced
  but not wired.
- middleware/session.ts: normalize `activeOrganizationId: undefined → null`
  to match `InferredSession` (Better Auth types it as optional).
- task/client-routes.ts: pass `credential.publishableKey` to
  `verifyRequest` — previously passed the whole object, which didn't
  match the `(publishableKey: string, ...)` signature.
- item/validators.ts: `UseItemResponseSchema.costItems`/`rewardItems`
  take the polymorphic `RewardEntry` shape, matching what `PullResult`
  actually returns since the currency refactor (#30).
- middleware/request-log.ts: guard `c.executionCtx` — it's workerd-only
  and throws under vitest/Node, which was silently breaking every
  route-layer test since the Tinybird commit (#31).

ESLint cleanup:
- Disable `no-unused-vars` (both variants) in the shared base + re-apply
  in react-internal.js (tseslint preset re-enables it after base).
- Disable `react/prop-types` — TypeScript handles prop validation.
- Give `*.config.{js,mjs,cjs,ts}` the Node globals so `process` isn't
  `no-undef` in tinybird.config.mjs.
- Declare TINYBIRD_* in turbo.json globalEnv.
- `eslint --fix` picked up 4 prefer-const and 3 stale eslint-disable
  directives across services and tests.

Verified: `pnpm --filter=server check-types` / `lint` / `test` all
green (618/618 tests, up from 591 before the request-log guard).

Author: dengzhaofun

apps/server/eslint.config.mjs

@@ -3,6 +3,15 @@ import { config } from "@repo/eslint-config/base";
 /** @type {import("eslint").Linter.Config[]} */
 export default [
   ...config,
+  {
+    // Tool config files run in Node at build time (tinybird, drizzle-kit,
+    // vitest, etc.), not inside the Worker bundle — give them the Node
+    // globals so `process.env` etc don't trip `no-undef`.
+    files: ["*.config.{js,mjs,cjs,ts}"],
+    languageOptions: {
+      globals: { process: "readonly" },
+    },
+  },
   {
     ignores: [
       "worker-configuration.d.ts",

apps/server/package.json

@@ -32,14 +32,15 @@
     "drizzle-orm": "^0.45.2",
     "filtrex": "^3.1.0",
     "hono": "^4.12.12",
-    "postgres": "^3.4.9",
+    "pg": "^8.20.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@better-auth/cli": "^1.4.21",
     "@repo/eslint-config": "workspace:^",
     "@repo/typescript-config": "workspace:^",
     "@types/node": "^22.15.3",
+    "@types/pg": "^8.20.0",
     "dotenv": "^17.4.1",
     "dotenv-cli": "^11.0.0",
     "drizzle-kit": "^0.31.10",

apps/server/src/db.ts

@@ -1,7 +1,7 @@
 import { env } from "cloudflare:workers";
 import { neon } from "@neondatabase/serverless";
 import { upstashCache } from "drizzle-orm/cache/upstash";
-import { drizzle as drizzleNeon } from "drizzle-orm/neon-http";
+import { drizzle as drizzleNeon, type NeonHttpDatabase } from "drizzle-orm/neon-http";
 
 import * as schema from "./schema";
 
@@ -17,53 +17,44 @@ const cache =
       })
     : undefined;
 
-export const db = isNeon
+// `db` is typed as `NeonHttpDatabase` — the production driver, and the
+// shape the entire codebase was written against (`.execute(...).rows`,
+// `.returning(...)`, no multi-statement transactions). Typing this as the
+// true `NeonHttp | NodePg` union would degrade every `.returning()` and
+// `.execute().rows` callsite via builder-chain signature intersection, so
+// we cast the local-Postgres branch to the neon-http type.
+//
+// The local branch uses `drizzle-orm/node-postgres` (not `postgres.js`)
+// because `pg`'s wire result is already `{ rows, fields, rowCount }` —
+// the same shape as `NeonHttpQueryResult`. `postgres.js` would need a
+// `.rows` shim over `RowList`, prepared-statement Bind tweaks, and
+// per-OID timestamp serializers to match.
+//
+// Narrowing to `NeonHttpDatabase` also enforces the codebase's
+// no-transaction rule at compile time — neon-http rejects
+// `db.transaction(cb)` at runtime, and all writes go through single
+// atomic `INSERT ... ON CONFLICT DO UPDATE WHERE ... RETURNING`
+// statements (see apps/server/CLAUDE.md → "`neon-http` has no
+// transactions", and modules/check-in/service.ts for the canonical
+// pattern).
+export const db: NeonHttpDatabase<typeof schema> = isNeon
   ? drizzleNeon({ client: neon(url), schema, cache })
   : await (async () => {
-      const { drizzle } = await import("drizzle-orm/postgres-js");
-      const { default: postgres } = await import("postgres");
-      const client = postgres(url, {
-        // prepare: false → avoid the prepared-statement Bind codec that
-        // chokes on Date → timestamptz. With prepare:false Drizzle sends
-        // ISO strings that Postgres parses natively.
-        prepare: false,
-        // Pin the session to UTC so `timestamp`-without-tz columns behave
-        // the same on local PG as on Neon (Neon's server runs UTC by
-        // default, but a local Postgres.app on +08 would otherwise store
-        // NOW() as local time and break any `col >= ${jsDate}` filter —
-        // the ::timestamp cast of an ISO-with-Z string *strips* the Z
-        // instead of converting.
-        connection: { TimeZone: "UTC" },
+      const { drizzle } = await import("drizzle-orm/node-postgres");
+      const { default: pg } = await import("pg");
+      // Pin every new physical connection to UTC so `timestamp`-without-tz
+      // columns behave the same as on Neon (which defaults to UTC server-side).
+      // Without this, a local Postgres on +08 stores NOW() as local time and
+      // `col >= ${jsDate}` filters drift by the TZ offset.
+      //
+      // `options: "-c TimeZone=UTC"` passes the setting as a libpq startup
+      // parameter — set before any query runs, avoiding the pg deprecation
+      // warning we'd hit by firing a `SET TIME ZONE` on the `connect` event
+      // (that path calls `client.query()` while the client is still mid-startup).
+      const pool = new pg.Pool({
+        connectionString: url,
+        options: "-c TimeZone=UTC",
       });
-      const drz = drizzle({ client, schema, cache });
-      // Drizzle's postgres-js driver installs a `val => val` serializer
-      // for all timestamp OIDs (see drizzle-orm/postgres-js/driver.js)
-      // so it can format Dates itself. That works for `gte(col, date)`
-      // where Drizzle pre-stringifies, but breaks `sql\`${col} <= ${date}\``
-      // raw templates — the Date slips through to postgres-js's `b.str()`
-      // and throws `ERR_INVALID_ARG_TYPE`. Reinstall a Date→ISO fallback.
-      const toIso = (v: unknown) =>
-        v instanceof Date ? v.toISOString() : v;
-      for (const oid of ["1184", "1114", "1082", "1083", "1182", "1185", "1115", "1231"]) {
-        (client as unknown as { options: { serializers: Record<string, (v: unknown) => unknown> } })
-          .options.serializers[oid] = toIso;
-      }
-      // Shape compat: `db.execute(sql\`...\`)` returns `{ rows }` on neon-http
-      // and a bare array on postgres-js. The codebase reads `.rows.length`
-      // (e.g. friend-gift, check-in's ON CONFLICT ... RETURNING). Attach a
-      // non-enumerable `rows` pointing back to the result array so both
-      // drivers quack the same.
-      const origExecute = drz.execute.bind(drz);
-      drz.execute = (async (query: Parameters<typeof origExecute>[0]) => {
-        const result = await origExecute(query);
-        if (Array.isArray(result) && !("rows" in result)) {
-          Object.defineProperty(result, "rows", {
-            value: result,
-            enumerable: false,
-            configurable: true,
-          });
-        }
-        return result;
-      }) as typeof drz.execute;
-      return drz;
+      const drz = drizzle({ client: pool, schema, cache });
+      return drz as unknown as NeonHttpDatabase<typeof schema>;
     })();

apps/server/src/env-bindings.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Augments `Cloudflare.Env` with worker secrets that `wrangler types`
+ * can't infer from `wrangler.jsonc`. Keep in sync with the secret list
+ * documented in `wrangler.jsonc` and with `testing/cloudflare-workers-shim.ts`.
+ */
+declare namespace Cloudflare {
+  interface Env {
+    DATABASE_URL: string;
+    BETTER_AUTH_SECRET: string;
+    BETTER_AUTH_URL: string;
+    UPSTASH_REDIS_REST_URL: string;
+    UPSTASH_REDIS_REST_TOKEN: string;
+    TINYBIRD_TOKEN: string;
+    TINYBIRD_URL: string;
+    TINYBIRD_WORKSPACE_ID: string;
+  }
+}

apps/server/src/env.ts

@@ -30,10 +30,27 @@ type InferredUser = typeof auth.$Infer.Session.user;
 
 export type AuthMethod = "session" | "admin-api-key" | "client-credential";
 
+/**
+ * Client-credential context placed by `require-client-credential` middleware.
+ * Keep this field-for-field compatible with the row selection the middleware
+ * does — adding a column here requires adding it to the `.select()` shape
+ * too, otherwise downstream routes reading `c.var.clientCredential.<field>`
+ * will type-check but be `undefined` at runtime.
+ */
+export type ClientCredentialContext = {
+  id: string;
+  organizationId: string;
+  publishableKey: string;
+  enabled: boolean;
+  expiresAt: Date | null;
+  devMode: boolean;
+};
+
 export type HonoEnv = {
   Variables: RequestIdVariables & {
     user: InferredUser | null;
     session: InferredSession | null;
     authMethod: AuthMethod | null;
+    clientCredential: ClientCredentialContext | null;
   };
 };

apps/server/src/lib/storage/s3-compatible.ts

@@ -65,7 +65,7 @@ async function bodyToBuffer(
   const reader = body.getReader();
   const chunks: Uint8Array[] = [];
   let total = 0;
-  // eslint-disable-next-line no-constant-condition
+   
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;

apps/server/src/middleware/request-log.ts

@@ -38,7 +38,18 @@ export const requestLog = createMiddleware<HonoEnv>(async (c, next) => {
 
   const path = new URL(c.req.url).pathname;
 
-  c.executionCtx.waitUntil(
+  // `c.executionCtx` is a workerd-only API — it THROWS under vitest/Node
+  // (where `app.request(...)` doesn't inject an ExecutionContext). Skip
+  // analytics ingest in that case; tests don't need Tinybird and we don't
+  // want to spam the real dataset from test runs anyway.
+  let ec: ExecutionContext;
+  try {
+    ec = c.executionCtx;
+  } catch {
+    return;
+  }
+
+  ec.waitUntil(
     deps.analytics.writer.logHttp({
       ts: new Date(start),
       orgId,

apps/server/src/middleware/require-client-credential.ts

@@ -37,6 +37,7 @@ export const requireClientCredential = createMiddleware<HonoEnv>(
       .select({
         id: clientCredentials.id,
         organizationId: clientCredentials.organizationId,
+        publishableKey: clientCredentials.publishableKey,
         enabled: clientCredentials.enabled,
         expiresAt: clientCredentials.expiresAt,
         devMode: clientCredentials.devMode,
@@ -69,6 +70,7 @@ export const requireClientCredential = createMiddleware<HonoEnv>(
     } as NonNullable<typeof c.var.session>);
     c.set("user", null);
     c.set("authMethod", "client-credential");
+    c.set("clientCredential", cred);
 
     return next();
   },

apps/server/src/middleware/session.ts

@@ -6,7 +6,21 @@ import type { HonoEnv } from "../env";
 export const session = createMiddleware<HonoEnv>(async (c, next) => {
   const data = await auth.api.getSession({ headers: c.req.raw.headers });
   c.set("user", data?.user ?? null);
-  c.set("session", data?.session ?? null);
+  // Better Auth types `activeOrganizationId` as optional (`string | null |
+  // undefined`) because the organization plugin doesn't teach the session
+  // inferrer about the column it adds. At runtime the `session.create.before`
+  // hook in `src/auth.ts` always populates it, so normalize `undefined → null`
+  // here to match the `InferredSession` shape declared in `env.ts`.
+  const rawSession = data?.session ?? null;
+  c.set(
+    "session",
+    rawSession
+      ? {
+          ...rawSession,
+          activeOrganizationId: rawSession.activeOrganizationId ?? null,
+        }
+      : null,
+  );
   c.set("authMethod", data?.user ? "session" : null);
   await next();
 });

apps/server/src/modules/collection/service.test.ts

@@ -25,7 +25,7 @@ import { collectionMilestones } from "../../schema/collection";
 import { createTestOrg, deleteTestOrg } from "../../testing/fixtures";
 import { createItemService } from "../item/service";
 import type { MailService } from "../mail/service";
-import type { ItemEntry } from "../item/types";
+import type { RewardEntry } from "../../lib/rewards";
 import { createCollectionService } from "./service";
 
 type CapturedMail = {
@@ -34,7 +34,7 @@ type CapturedMail = {
   input: {
     title: string;
     content: string;
-    rewards: ItemEntry[];
+    rewards: RewardEntry[];
     originSource: string;
     originSourceId: string;
     requireRead?: boolean;