i didnt realize the postgres pass-through function included some regular expression functions. this seems to works ok. the purpose of the ucase() = lcase() in the WHERE clause is a proxy for whether the substring has characters or not. i'd still be curious to know if there's a better way to do that.

var sql = "
SELECT max(regexp_replace(SUBSTRING(Id, "+(prefix.length+1)+", 6), '[a-z]+', '')) as maxNumber
FROM study.Demographics
WHERE Id LIKE '" + prefix + "%' AND lcase(SUBSTRING(Id, "+(prefix.length+1)+", 6)) = ucase(SUBSTRING(Id, "+(prefix.length+1)+", 6))";