nerdsystem 0.0.0-stage → 0.0.1

package/template/GEMINI.md

@@ -0,0 +1,120 @@
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (2834c4c81f7f); edit the skill, then run: nerd agents sync -->
+
+# Building on nerdsystem
+
+This app is deployed by nerdsystem, which also provides authentication, authorization, a D1 database, and an R2 bucket. You never touch Cloudflare directly. Everything goes through the `nerd` CLI, which wraps the platform API. Every `nerd` command accepts `--json`; prefer it when you need to parse output.
+
+## First session with a new project
+
+If this project still has the template's todo app (the `todos` table and `src/server/routes/todos.ts`), treat the person as new and offer a short walkthrough before building anything:
+
+1. Ask one question: what should the app do, in a sentence or two. Do not ask about stacks, databases, or hosting; those are decided.
+2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
+3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. Keep signup and login as they are; they already work.
+4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
+5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
+
+Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
+
+## The loop
+
+1. Make the change.
+2. `nerd check` (static rules, then typecheck). Fix anything it reports.
+3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
+
+Run `nerd check --json` when you want a machine-readable list of problems.
+
+## Deploying from GitHub
+
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+
+## Where things go
+
+| Concern | Location |
+| --- | --- |
+| API routes | `src/server/index.ts` mounts routers under `/api/...`. Put each resource in `src/server/routes/<name>.ts`. |
+| Database schema | `src/server/db/schema.ts` (Drizzle). Then `pnpm db:generate` to produce a migration in `migrations/`. |
+| Queries | `db(c.env.DB)` from `src/server/db/index.ts`. Drizzle query builder, D1 dialect (SQLite). |
+| Files | `c.env.STORAGE` is an R2 bucket. `put`, `get`, `delete`, `list`. Key files by user id. |
+| Frontend | `src/client/` React, built by Vite. `src/client/api.ts` has a fetch wrapper that sends the session cookie. |
+| Roles and signup policy | `nerd auth config`. Not in code. |
+
+## Auth and authorization
+
+The SDK handles sessions. There is no login code to write.
+
+- `c.var.user` is `{ id, email, name, roles }` or `null` on every request.
+- `requireAuth()` middleware returns 401 when signed out.
+- `requireRole("admin")` returns 403 unless the user has one of the given roles. Multiple roles are OR.
+- The frontend calls `/api/auth/signup`, `/api/auth/login`, `/api/auth/logout`, `/api/auth/me`, `/api/auth/forgot`, and `/api/auth/reset`. The template's `auth` helper in `src/client/api.ts` wraps them. Password reset emails link to `/reset-password?token=...`, which the template client renders; keep that route if you restructure the client.
+- Roles are a list the platform owns. See the current list with `nerd auth config`. Add one with `nerd auth config --roles admin,member,editor`. The default role for new signups is set with `--default-role`. Turn public signup off with `--signup off`.
+- To promote a user from code, use the admin client: `new AuthServiceClient(c.env).users.setRoles(userId, ["admin"])`. Guard that route with `requireRole("admin")`.
+
+Example of a protected resource router:
+
+```ts
+import { Hono } from "hono";
+import { eq } from "drizzle-orm";
+import { requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
+import { db, schema } from "../db";
+
+const notes = new Hono<NerdHonoEnv>();
+notes.use("*", requireAuth());
+notes.get("/", async (c) => {
+  const rows = await db(c.env.DB).select().from(schema.notes).where(eq(schema.notes.userId, c.var.user!.id)).all();
+  return c.json({ notes: rows });
+});
+export default notes;
+```
+
+Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
+
+## Data rules
+
+- Every table holding user data has a `user_id` text column, and every read and write filters on `c.var.user.id`. This is how users are kept apart.
+- Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
+- Migrations are forward-only. To undo, write another migration.
+- Prefer small, additive migrations. SQLite cannot alter columns in place.
+
+## Errors
+
+API errors are `{ error: { code, message } }` with a matching HTTP status. Use the same shape in your routes so the frontend's `ApiError` keeps working. Codes in use: `bad_request`, `unauthorized`, `forbidden`, `not_found`, `conflict`, `internal`.
+
+## Security gates
+
+The `nerdsystem` MCP server (configured in `.mcp.json`) gives you two tools; prefer them over shelling out:
+
+- `run_gates` runs every gate a deploy runs (secrets in source and in the built bundle, vulnerable dependencies, platform rules, static analysis, acceptable-use policy, personal-data heuristics, typecheck, and scanner suppressions) and returns `failures`. Each has `rule_id`, `file`, `line`, `risk` (what could happen), `fix` (what to change), `verify` (the command that confirms it), `attempt`, and `audience`.
+- `explain_failure` takes a `rule_id` and returns the risk, the fix, and a wrong/right example.
+
+The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_gates` again (it re-runs every gate, not just the one that failed), repeat. Rules you cannot clear:
+
+- `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
+- When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
+
+Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+
+## What `nerd check` rejects
+
+- A root app that is not `createNerdApp()` from `@nerdsystem/sdk`.
+- Any route outside `/api/`. Other paths serve the static client and never reach the Worker.
+- New bindings in `wrangler.jsonc`. Only `DB`, `STORAGE`, and `ASSETS` exist. Durable Objects are not available.
+- Scripts that call `wrangler deploy`, `wrangler secret`, or remote `wrangler d1` commands.
+- Typecheck failures in either `src/server` or `src/client`.
+
+## Scheduled jobs and email
+
+- **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+
+## Debugging production
+
+When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
+
+## Not available yet
+
+Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/drizzle.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "sqlite",
+  schema: "./src/server/db/schema.ts",
+  out: "./migrations",
+});

package/template/gitignore

@@ -0,0 +1,7 @@
+node_modules/
+dist/
+.wrangler/
+.dev.vars
+.dev.vars.*
+*.tsbuildinfo
+.nerd/

package/template/index.html

@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>nerd-app</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/client/main.tsx"></script>
+  </body>
+</html>

package/template/migrations/0000_init.sql

@@ -0,0 +1,7 @@
+CREATE TABLE `todos` (
+	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
+	`user_id` text NOT NULL,
+	`title` text NOT NULL,
+	`done` integer DEFAULT false NOT NULL,
+	`created_at` text NOT NULL
+);

package/template/nerd.json

@@ -0,0 +1,5 @@
+{
+  "$schema": "https://nerdsystem.com/schemas/nerd.json",
+  "org": "",
+  "project": ""
+}

package/template/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "nerd-app",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "nerd dev",
+    "build": "vite build",
+    "check": "nerd check",
+    "deploy": "nerd deploy",
+    "typecheck": "tsc -p tsconfig.worker.json --noEmit && tsc -p tsconfig.client.json --noEmit",
+    "db:generate": "drizzle-kit generate",
+    "agents:sync": "node scripts/sync-agents.mjs"
+  },
+  "dependencies": {
+    "@nerdsystem/sdk": "workspace:*",
+    "drizzle-orm": "^0.45.4",
+    "hono": "^4.13.16",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1"
+  },
+  "devDependencies": {
+    "@cloudflare/vite-plugin": "^1.67.0",
+    "@cloudflare/workers-types": "^5.20261102.1",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.2.1",
+    "drizzle-kit": "^0.31.11",
+    "typescript": "^5.9.3",
+    "vite": "^8.3.5",
+    "wrangler": "^4.156.2"
+  }
+}

package/template/scripts/sync-agents.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// Generates per-agent instruction files from the single source of truth, the nerdsystem skill.
+// Run after editing .claude/skills/nerdsystem/SKILL.md (or let `nerd agents sync` do it).
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const skillPath = path.join(root, ".claude/skills/nerdsystem/SKILL.md");
+const skill = readFileSync(skillPath, "utf8");
+const body = skill.replace(/^---[\s\S]*?---\s*/, ""); // drop the skill front matter
+const hash = createHash("sha256").update(body).digest("hex").slice(0, 12);
+const stamp = `<!-- generated from .claude/skills/nerdsystem/SKILL.md (${hash}); edit the skill, then run: nerd agents sync -->`;
+
+const targets = {
+  "AGENTS.md": `${stamp}\n\n${body}`,
+  "GEMINI.md": `${stamp}\n\n${body}`,
+  ".github/copilot-instructions.md": `${stamp}\n\n${body}`,
+  ".cursor/rules/nerdsystem.mdc": `---\ndescription: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.\nalwaysApply: true\n---\n${stamp}\n\n${body}`,
+};
+
+for (const [file, content] of Object.entries(targets)) {
+  const p = path.join(root, file);
+  mkdirSync(path.dirname(p), { recursive: true });
+  writeFileSync(p, content);
+}
+console.log(`synced ${Object.keys(targets).length} agent files from the skill (${hash})`);

package/template/src/client/App.tsx

@@ -0,0 +1,182 @@
+import { useEffect, useRef, useState, type FormEvent } from "react";
+
+// Optional bot protection on signup: set VITE_TURNSTILE_SITE_KEY (client) and NERD_TURNSTILE_SECRET
+// (server, via `nerd secrets`) from a Cloudflare Turnstile widget. Without them, signup is open.
+const TURNSTILE_SITE_KEY = import.meta.env.VITE_TURNSTILE_SITE_KEY as string | undefined;
+
+function Turnstile({ onToken }: { onToken: (t: string) => void }) {
+  const ref = useRef<HTMLDivElement>(null);
+  useEffect(() => {
+    if (!TURNSTILE_SITE_KEY || !ref.current) return;
+    const w = window as unknown as { turnstile?: { render: (el: HTMLElement, opts: { sitekey: string; callback: (t: string) => void }) => void } };
+    const render = () => w.turnstile?.render(ref.current!, { sitekey: TURNSTILE_SITE_KEY, callback: onToken });
+    if (w.turnstile) render();
+    else {
+      const s = document.createElement("script");
+      s.src = "https://challenges.cloudflare.com/turnstile/v0/api.js";
+      s.async = true;
+      s.onload = render;
+      document.head.appendChild(s);
+    }
+  }, [onToken]);
+  return TURNSTILE_SITE_KEY ? <div ref={ref} /> : null;
+}
+import { api, auth, ApiError, type User } from "./api";
+
+interface Todo {
+  id: number;
+  title: string;
+  done: boolean;
+}
+
+export default function App() {
+  const [user, setUser] = useState<User | null | undefined>(undefined);
+
+  useEffect(() => {
+    auth.me().then((r) => setUser(r.user)).catch(() => setUser(null));
+  }, []);
+
+  if (user === undefined) return <main className="shell">Loading…</main>;
+  if (window.location.pathname === "/reset-password") return <ResetPassword onSignedIn={(u) => { window.history.replaceState(null, "", "/"); setUser(u); }} />;
+  if (!user) return <AuthScreen onSignedIn={setUser} />;
+  return <Todos user={user} onSignedOut={() => setUser(null)} />;
+}
+
+function AuthScreen({ onSignedIn }: { onSignedIn: (u: User) => void }) {
+  const [mode, setMode] = useState<"login" | "signup" | "forgot">("login");
+  const [error, setError] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [turnstileToken, setTurnstileToken] = useState<string | undefined>(undefined);
+
+  async function submit(e: FormEvent<HTMLFormElement>) {
+    e.preventDefault();
+    const form = new FormData(e.currentTarget);
+    const email = String(form.get("email"));
+    const password = String(form.get("password"));
+    setBusy(true);
+    setError(null);
+    try {
+      if (mode === "forgot") {
+        await auth.forgot(email);
+        setNotice("If that email has an account, a reset link is on its way.");
+        return;
+      }
+      const r = mode === "login" ? await auth.login(email, password) : await auth.signup(email, password, String(form.get("name")), turnstileToken);
+      onSignedIn(r.user);
+    } catch (err) {
+      setError(err instanceof ApiError ? err.message : "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  return (
+    <main className="shell">
+      <h1>nerd-app</h1>
+      <form onSubmit={submit} className="card">
+        {mode === "signup" && <input name="name" placeholder="Your name" required />}
+        <input name="email" type="email" placeholder="Email" required />
+        {mode !== "forgot" && <input name="password" type="password" placeholder="Password (8+ characters)" minLength={8} required />}
+        {mode === "signup" && <Turnstile onToken={setTurnstileToken} />}
+        {error && <p className="error">{error}</p>}
+        {notice && <p className="muted">{notice}</p>}
+        <button disabled={busy}>{mode === "login" ? "Sign in" : mode === "signup" ? "Create account" : "Email me a reset link"}</button>
+        <button type="button" className="link" onClick={() => { setNotice(null); setMode(mode === "login" ? "signup" : "login"); }}>
+          {mode === "login" ? "Need an account? Sign up" : "Have an account? Sign in"}
+        </button>
+        {mode === "login" && (
+          <button type="button" className="link" onClick={() => { setNotice(null); setMode("forgot"); }}>Forgot your password?</button>
+        )}
+      </form>
+    </main>
+  );
+}
+
+function ResetPassword({ onSignedIn }: { onSignedIn: (u: User) => void }) {
+  const token = new URLSearchParams(window.location.search).get("token") ?? "";
+  const [error, setError] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  async function submit(e: FormEvent<HTMLFormElement>) {
+    e.preventDefault();
+    setBusy(true);
+    setError(null);
+    try {
+      const r = await auth.reset(token, String(new FormData(e.currentTarget).get("password")));
+      onSignedIn(r.user);
+    } catch (err) {
+      setError(err instanceof ApiError ? err.message : "Something went wrong");
+    } finally {
+      setBusy(false);
+    }
+  }
+  return (
+    <main className="shell">
+      <h1>Choose a new password</h1>
+      <form onSubmit={submit} className="card">
+        <input name="password" type="password" placeholder="New password (8+ characters)" minLength={8} required autoFocus />
+        {error && <p className="error">{error}</p>}
+        <button disabled={busy || !token}>Set password and sign in</button>
+      </form>
+    </main>
+  );
+}
+
+function Todos({ user, onSignedOut }: { user: User; onSignedOut: () => void }) {
+  const [todos, setTodos] = useState<Todo[]>([]);
+  const [title, setTitle] = useState("");
+
+  const load = () => api<{ todos: Todo[] }>("/api/todos").then((r) => setTodos(r.todos));
+  useEffect(() => {
+    load();
+  }, []);
+
+  async function add(e: FormEvent) {
+    e.preventDefault();
+    if (!title.trim()) return;
+    await api("/api/todos", { method: "POST", body: JSON.stringify({ title }) });
+    setTitle("");
+    load();
+  }
+
+  async function toggle(t: Todo) {
+    await api(`/api/todos/${t.id}`, { method: "PATCH", body: JSON.stringify({ done: !t.done }) });
+    load();
+  }
+
+  async function remove(t: Todo) {
+    await api(`/api/todos/${t.id}`, { method: "DELETE" });
+    load();
+  }
+
+  return (
+    <main className="shell">
+      <header>
+        <h1>Todos</h1>
+        <span>
+          {user.name} · {user.roles.join(", ")}{" "}
+          <button className="link" onClick={() => auth.logout().then(onSignedOut)}>
+            Sign out
+          </button>
+        </span>
+      </header>
+      <form onSubmit={add} className="row">
+        <input value={title} onChange={(e) => setTitle(e.target.value)} placeholder="What needs doing?" />
+        <button>Add</button>
+      </form>
+      <ul className="list">
+        {todos.map((t) => (
+          <li key={t.id} className={t.done ? "done" : ""}>
+            <label>
+              <input type="checkbox" checked={t.done} onChange={() => toggle(t)} /> {t.title}
+            </label>
+            <button className="link" onClick={() => remove(t)}>
+              ×
+            </button>
+          </li>
+        ))}
+        {todos.length === 0 && <li className="muted">Nothing yet.</li>}
+      </ul>
+    </main>
+  );
+}

package/template/src/client/api.ts

@@ -0,0 +1,42 @@
+// Small fetch wrapper. Cookies carry the session, so there is nothing to attach by hand.
+export interface User {
+  id: string;
+  email: string;
+  name: string;
+  roles: string[];
+}
+
+export class ApiError extends Error {
+  constructor(
+    public readonly status: number,
+    public readonly code: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+export async function api<T>(path: string, init: RequestInit = {}): Promise<T> {
+  const res = await fetch(path, {
+    ...init,
+    headers: { ...(init.body ? { "content-type": "application/json" } : {}), ...init.headers },
+    credentials: "same-origin",
+  });
+  const text = await res.text();
+  const json = text ? JSON.parse(text) : null;
+  if (!res.ok) {
+    throw new ApiError(res.status, json?.error?.code ?? "error", json?.error?.message ?? `Request failed (${res.status})`);
+  }
+  return json as T;
+}
+
+export const auth = {
+  me: () => api<{ user: User | null }>("/api/auth/me"),
+  login: (email: string, password: string) =>
+    api<{ user: User }>("/api/auth/login", { method: "POST", body: JSON.stringify({ email, password }) }),
+  signup: (email: string, password: string, name: string, turnstileToken?: string) =>
+    api<{ user: User }>("/api/auth/signup", { method: "POST", body: JSON.stringify({ email, password, name, ...(turnstileToken ? { turnstileToken } : {}) }) }),
+  logout: () => api<{ ok: true }>("/api/auth/logout", { method: "POST" }),
+  forgot: (email: string) => api<{ ok: true }>("/api/auth/forgot", { method: "POST", body: JSON.stringify({ email }) }),
+  reset: (token: string, password: string) => api<{ user: User }>("/api/auth/reset", { method: "POST", body: JSON.stringify({ token, password }) }),
+};

package/template/src/client/main.tsx

@@ -0,0 +1,10 @@
+import { StrictMode } from "react";
+import { createRoot } from "react-dom/client";
+import App from "./App";
+import "./styles.css";
+
+createRoot(document.getElementById("root")!).render(
+  <StrictMode>
+    <App />
+  </StrictMode>,
+);

package/template/src/client/styles.css

@@ -0,0 +1,16 @@
+:root { color-scheme: light dark; font-family: system-ui, sans-serif; }
+body { margin: 0; }
+.shell { max-width: 32rem; margin: 4rem auto; padding: 0 1rem; }
+header { display: flex; justify-content: space-between; align-items: baseline; gap: 1rem; }
+h1 { margin: 0 0 1rem; }
+.card, .row { display: flex; flex-direction: column; gap: 0.5rem; }
+.row { flex-direction: row; }
+.row input { flex: 1; }
+input { padding: 0.5rem; font: inherit; }
+button { padding: 0.5rem 0.75rem; font: inherit; cursor: pointer; }
+button.link { background: none; border: none; color: inherit; text-decoration: underline; padding: 0; }
+.list { list-style: none; padding: 0; }
+.list li { display: flex; justify-content: space-between; padding: 0.4rem 0; border-bottom: 1px solid #8884; }
+.list li.done label { text-decoration: line-through; opacity: 0.6; }
+.error { color: #c33; margin: 0; }
+.muted { opacity: 0.6; }

package/template/src/client/vite-env.d.ts

@@ -0,0 +1 @@
+/// <reference types="vite/client" />

package/template/src/server/db/index.ts

@@ -0,0 +1,7 @@
+import { drizzle } from "drizzle-orm/d1";
+import * as schema from "./schema";
+
+export function db(d1: D1Database) {
+  return drizzle(d1, { schema });
+}
+export { schema };

package/template/src/server/db/schema.ts

@@ -0,0 +1,14 @@
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+// Add your tables here, then run `pnpm db:generate` to create a migration.
+// Rows that belong to a user should carry their id from c.var.user.
+
+export const todos = sqliteTable("todos", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id").notNull(),
+  title: text("title").notNull(),
+  done: integer("done", { mode: "boolean" }).notNull().default(false),
+  createdAt: text("created_at")
+    .notNull()
+    .$defaultFn(() => new Date().toISOString()),
+});

package/template/src/server/index.ts

@@ -0,0 +1,23 @@
+import { createNerdApp, cronEvent, requireRole, verifyCron } from "@nerdsystem/sdk";
+import todos from "./routes/todos";
+
+// createNerdApp gives you a Hono app with sessions at /api/auth and c.var.user on every request.
+// Static assets (the React client) are served by the platform for every path outside /api.
+const app = createNerdApp();
+
+app.get("/api/health", (c) => c.json({ ok: true, user: c.var.user?.email ?? null }));
+
+app.route("/api/todos", todos);
+
+// Scheduled job. Turn it on with `nerd cron hourly` (or daily); the platform then POSTs here on
+// schedule with a signed header. Put periodic work in this handler: digests, cleanup, syncing.
+app.post("/api/cron", verifyCron(), async (c) => {
+  const event = await cronEvent(c);
+  console.log(`cron ${event.schedule} at ${event.at}`);
+  return c.json({ ok: true });
+});
+
+// Example of a role-gated route. Roles are managed in the nerdsystem dashboard or `nerd auth`.
+app.get("/api/admin/ping", requireRole("admin"), (c) => c.json({ pong: true, admin: c.var.user!.email }));
+
+export default app;

package/template/src/server/routes/todos.ts

@@ -0,0 +1,57 @@
+import { Hono } from "hono";
+import { and, desc, eq } from "drizzle-orm";
+import { requireAuth, type NerdHonoEnv } from "@nerdsystem/sdk";
+import { db, schema } from "../db";
+
+// Every route here needs a signed-in user. c.var.user is set by the SDK.
+const todos = new Hono<NerdHonoEnv>();
+todos.use("*", requireAuth());
+
+todos.get("/", async (c) => {
+  const rows = await db(c.env.DB)
+    .select()
+    .from(schema.todos)
+    .where(eq(schema.todos.userId, c.var.user!.id))
+    .orderBy(desc(schema.todos.createdAt))
+    .all();
+  return c.json({ todos: rows });
+});
+
+todos.post("/", async (c) => {
+  const body = (await c.req.json().catch(() => ({}))) as { title?: unknown };
+  if (typeof body.title !== "string" || !body.title.trim()) {
+    return c.json({ error: { code: "bad_request", message: "title is required" } }, 400);
+  }
+  const row = await db(c.env.DB)
+    .insert(schema.todos)
+    .values({ userId: c.var.user!.id, title: body.title.trim() })
+    .returning()
+    .get();
+  return c.json({ todo: row }, 201);
+});
+
+todos.patch("/:id", async (c) => {
+  const id = Number(c.req.param("id"));
+  const body = (await c.req.json().catch(() => ({}))) as { done?: unknown };
+  const row = await db(c.env.DB)
+    .update(schema.todos)
+    .set({ done: Boolean(body.done) })
+    .where(and(eq(schema.todos.id, id), eq(schema.todos.userId, c.var.user!.id)))
+    .returning()
+    .get();
+  if (!row) return c.json({ error: { code: "not_found", message: "Todo not found" } }, 404);
+  return c.json({ todo: row });
+});
+
+todos.delete("/:id", async (c) => {
+  const id = Number(c.req.param("id"));
+  const row = await db(c.env.DB)
+    .delete(schema.todos)
+    .where(and(eq(schema.todos.id, id), eq(schema.todos.userId, c.var.user!.id)))
+    .returning({ id: schema.todos.id })
+    .get();
+  if (!row) return c.json({ error: { code: "not_found", message: "Todo not found" } }, 404);
+  return c.json({ deleted: true });
+});
+
+export default todos;

package/template/tsconfig.client.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "jsx": "react-jsx",
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "composite": true,
+    "rootDir": "."
+  },
+  "include": ["src/client"]
+}

package/template/tsconfig.json

@@ -0,0 +1,4 @@
+{
+  "files": [],
+  "references": [{ "path": "./tsconfig.worker.json" }, { "path": "./tsconfig.client.json" }]
+}

package/template/tsconfig.worker.json

@@ -0,0 +1,18 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "lib": ["ES2022"],
+    "types": ["@cloudflare/workers-types"],
+    "strict": true,
+    "noUncheckedIndexedAccess": true,
+    "verbatimModuleSyntax": true,
+    "isolatedModules": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "composite": true,
+    "rootDir": "."
+  },
+  "include": ["src/server", "vite.config.ts", "drizzle.config.ts"]
+}

package/template/vite.config.ts

@@ -0,0 +1,7 @@
+import { cloudflare } from "@cloudflare/vite-plugin";
+import react from "@vitejs/plugin-react";
+import { defineConfig } from "vite";
+
+export default defineConfig({
+  plugins: [react(), cloudflare()],
+});