nerdsystem 0.0.0-stage → 0.0.2

package/dist/commands/deploy.js

@@ -0,0 +1,119 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { ApiClient } from "../api.js";
+import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
+import { CliError, log, printJson, runOrThrow, table } from "../util.js";
+import { runChecks } from "./check.js";
+import { BUILD_GATES, knownSecretsFrom, runGates, SOURCE_GATES } from "../gates/index.js";
+import { readDevVars } from "../project.js";
+const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
+function walk(dir, base = dir) {
+    const out = [];
+    for (const entry of readdirSync(dir)) {
+        const full = path.join(dir, entry);
+        if (statSync(full).isDirectory())
+            out.push(...walk(full, base));
+        else
+            out.push(path.relative(base, full));
+    }
+    return out;
+}
+/** Locates the Vite build output: dist/<worker>/wrangler.json names the entry and the assets dir. */
+export function readBuildOutput(root) {
+    const dist = path.join(root, "dist");
+    if (!existsSync(dist))
+        throw new CliError("No dist/ directory. Run `vite build` first.");
+    const workerDir = readdirSync(dist)
+        .map((d) => path.join(dist, d))
+        .find((d) => existsSync(path.join(d, "wrangler.json")));
+    if (!workerDir)
+        throw new CliError("No dist/*/wrangler.json found. Is @cloudflare/vite-plugin configured?");
+    const cfg = JSON.parse(readFileSync(path.join(workerDir, "wrangler.json"), "utf8"));
+    if (!cfg.main)
+        throw new CliError("Built wrangler.json has no main.");
+    const modules = walk(workerDir).filter((f) => MODULE_EXT.has(path.extname(f)) && !f.startsWith(".vite/"));
+    const assetsDir = cfg.assets?.directory ? path.resolve(workerDir, cfg.assets.directory) : undefined;
+    const assets = assetsDir && existsSync(assetsDir) ? walk(assetsDir).filter((f) => !f.startsWith(".") && !f.includes("/.") && path.basename(f) !== ".dev.vars") : [];
+    return {
+        workerDir,
+        main: cfg.main,
+        modules,
+        assetsDir,
+        assets,
+        compatibilityDate: cfg.compatibility_date,
+        compatibilityFlags: cfg.compatibility_flags ?? [],
+    };
+}
+export async function applyRemoteMigrations(root, api) {
+    const dir = path.join(root, "migrations");
+    if (!existsSync(dir))
+        return { applied: [], skipped: [] };
+    const migrations = readdirSync(dir)
+        .filter((f) => f.endsWith(".sql"))
+        .sort()
+        .map((name) => ({ name, sql: readFileSync(path.join(dir, name), "utf8") }));
+    if (migrations.length === 0)
+        return { applied: [], skipped: [] };
+    return api.post(projectPath(readNerdJson(root), "/db/migrations"), { migrations });
+}
+export async function deploy(opts) {
+    const root = findProjectRoot();
+    const nerd = readNerdJson(root);
+    const api = ApiClient.fromConfig();
+    const knownSecrets = knownSecretsFrom(readDevVars(root));
+    if (!opts["skip-check"]) {
+        const remote = await runChecks(root, { remote: true, typecheck: false });
+        if (!remote.ok) {
+            for (const p of remote.problems)
+                log.warn(p);
+            throw new CliError("Fix the problems above, then deploy again.", 2);
+        }
+        const { approvedSuppressions } = await import("./verify.js");
+        const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
+        if (!gates.ok)
+            throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
+        log.ok("Gates passed");
+    }
+    if (!opts["skip-build"]) {
+        log.step("Building with vite");
+        await runOrThrow("npx", ["vite", "build"], { cwd: root });
+    }
+    const build = readBuildOutput(root);
+    if (!opts["skip-check"]) {
+        const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
+        if (!built.ok)
+            throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
+    }
+    log.step("Applying migrations to the production database");
+    const mig = await applyRemoteMigrations(root, api);
+    if (mig.applied.length)
+        log.ok(`Applied ${mig.applied.join(", ")}`);
+    else
+        log.info("  No new migrations");
+    log.step(`Uploading ${build.modules.length} module(s) and ${build.assets.length} asset(s)`);
+    const form = new FormData();
+    form.append("metadata", JSON.stringify({
+        mainModule: build.main,
+        ...(build.compatibilityDate ? { compatibilityDate: build.compatibilityDate } : {}),
+        compatibilityFlags: build.compatibilityFlags,
+        ...(opts.note ? { note: opts.note } : {}),
+    }));
+    for (const m of build.modules) {
+        form.append(`module:${m}`, new Blob([readFileSync(path.join(build.workerDir, m))]), m);
+    }
+    for (const a of build.assets) {
+        form.append(`asset:/${a.split(path.sep).join("/")}`, new Blob([readFileSync(path.join(build.assetsDir, a))]), path.basename(a));
+    }
+    const { deployment } = await api.post(projectPath(nerd, "/deployments"), form);
+    const { project } = await api.get(projectPath(nerd));
+    if (opts.json)
+        return printJson({ deployment, url: project.url, migrations: mig });
+    log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
+}
+export async function deployments(opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().get(projectPath(nerd, `/deployments?limit=${Number(opts.limit) || 10}`));
+    if (opts.json)
+        return printJson(r);
+    table(r.deployments.map((d) => ({ id: d.id, status: d.status, modules: d.moduleCount, assets: d.assetCount, kb: Math.round(d.bundleBytes / 1024), created: d.createdAt, error: d.error ?? "" })), ["id", "status", "modules", "assets", "kb", "created", "error"]);
+}

package/dist/commands/dev.d.ts

@@ -0,0 +1,3 @@
+/** Makes sure .dev.vars carries the platform bindings for local dev, minting a dev tenant secret once. */
+export declare function ensureDevVars(root: string): Promise<void>;
+export declare function dev(extra: string[]): Promise<void>;

package/dist/commands/dev.js

@@ -0,0 +1,38 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { ApiClient } from "../api.js";
+import { findProjectRoot, projectPath, readDevVars, readNerdJson, writeDevVars } from "../project.js";
+import { log, run, runOrThrow } from "../util.js";
+/** Makes sure .dev.vars carries the platform bindings for local dev, minting a dev tenant secret once. */
+export async function ensureDevVars(root) {
+    const nerd = readNerdJson(root);
+    const vars = readDevVars(root);
+    const api = ApiClient.fromConfig();
+    const project = (await api.get(projectPath(nerd))).project;
+    const authUrl = `${api.apiUrl}/auth/v1`;
+    const next = {};
+    if (vars.NERD_PROJECT_ID !== project.id)
+        next.NERD_PROJECT_ID = project.id;
+    if (vars.NERD_AUTH_URL !== authUrl)
+        next.NERD_AUTH_URL = authUrl;
+    if (!vars.NERD_AUTH_SECRET || vars.NERD_PROJECT_ID !== project.id) {
+        log.step("Minting a development tenant secret");
+        const r = await api.post(projectPath(nerd, "/auth/secrets"), { label: `dev-${process.env.USER ?? "local"}` });
+        next.NERD_AUTH_SECRET = r.secret.secret;
+    }
+    if (Object.keys(next).length) {
+        writeDevVars(root, next);
+        log.ok("Updated .dev.vars");
+    }
+}
+export async function dev(extra) {
+    const root = findProjectRoot();
+    await ensureDevVars(root);
+    if (existsSync(path.join(root, "migrations"))) {
+        log.step("Applying migrations to the local database");
+        await runOrThrow("npx", ["wrangler", "d1", "migrations", "apply", "DB", "--local"], { cwd: root });
+    }
+    log.step("Starting vite dev");
+    const code = await run("npx", ["vite", ...extra], { cwd: root });
+    process.exitCode = code;
+}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,4 @@
+/** Checks the machine, not the app: the things that stop a newcomer before the first deploy. */
+export declare function doctor(opts: {
+    json: boolean;
+}): Promise<void>;

package/dist/commands/doctor.js

@@ -0,0 +1,42 @@
+import { existsSync } from "node:fs";
+import { exec, hasTool } from "../gates/code.js";
+import { loadConfig } from "../config.js";
+import { findProjectRoot } from "../project.js";
+import { log, printJson } from "../util.js";
+/** Checks the machine, not the app: the things that stop a newcomer before the first deploy. */
+export async function doctor(opts) {
+    const checks = [];
+    const nodeMajor = Number(process.versions.node.split(".")[0]);
+    checks.push({ name: "Node.js 22+", ok: nodeMajor >= 22, detail: `v${process.versions.node}`, fix: "Install Node 22 from https://nodejs.org or with your version manager." });
+    for (const [tool, fix] of [["pnpm", "npm install -g pnpm"], ["git", "Install git from https://git-scm.com"]]) {
+        const r = await exec(tool, ["--version"], process.cwd());
+        checks.push({ name: tool, ok: r.code === 0, detail: r.code === 0 ? r.stdout.trim().split("\n")[0] ?? "" : "not found", fix });
+    }
+    const gh = await exec("gh", ["auth", "status"], process.cwd());
+    checks.push({ name: "GitHub CLI signed in (optional)", ok: gh.code === 0, detail: gh.code === 0 ? "ok" : "not signed in", fix: "Only needed to create repos from the terminal: https://cli.github.com then `gh auth login`." });
+    const cfg = loadConfig();
+    checks.push({ name: "nerd login", ok: Boolean(cfg.token), detail: cfg.token ? cfg.apiUrl : "no token saved", fix: "Create a token in the dashboard (API tokens), then `nerd login --token nsk_...`." });
+    let root = null;
+    try {
+        root = findProjectRoot();
+    }
+    catch {
+        // not inside a project; fine
+    }
+    checks.push({ name: "Inside a nerdsystem project", ok: Boolean(root), detail: root ?? "no nerd.json found upward from here", fix: "Run `npx nerdsystem init my-app` or cd into an app." });
+    if (root) {
+        checks.push({ name: "Dependencies installed", ok: existsSync(`${root}/node_modules`), detail: existsSync(`${root}/node_modules`) ? "node_modules present" : "missing", fix: "Run `pnpm install` in the project." });
+        checks.push({ name: "Local secrets (.dev.vars)", ok: existsSync(`${root}/.dev.vars`), detail: existsSync(`${root}/.dev.vars`) ? "present" : "missing", fix: "`nerd dev` writes it on first run." });
+    }
+    for (const tool of ["gitleaks", "semgrep", "osv-scanner"]) {
+        const ok = await hasTool(tool);
+        checks.push({ name: `${tool} (optional)`, ok, detail: ok ? "installed" : "not installed; the builder runs it for you", fix: `Optional for \`nerd verify\` locally.` });
+    }
+    if (opts.json)
+        return printJson({ ok: checks.filter((c) => !c.name.includes("optional")).every((c) => c.ok), checks });
+    for (const c of checks) {
+        log.info(`${c.ok ? "✓" : c.name.includes("optional") ? "–" : "✗"} ${c.name}: ${c.detail}`);
+        if (!c.ok && c.fix && !c.name.includes("optional"))
+            log.info(`    ${c.fix}`);
+    }
+}

package/dist/commands/github.d.ts

@@ -0,0 +1,17 @@
+export declare function githubConnect(opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function githubLink(fullName: string | undefined, opts: {
+    json: boolean;
+    branch?: string;
+    "root-dir"?: string;
+    "no-previews": boolean;
+    "require-pr": boolean;
+    installation?: string;
+}): Promise<void>;
+export declare function githubUnlink(opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function githubStatus(opts: {
+    json: boolean;
+}): Promise<void>;

package/dist/commands/github.js

@@ -0,0 +1,49 @@
+import { ApiClient } from "../api.js";
+import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
+import { CliError, log, printJson, table } from "../util.js";
+export async function githubConnect(opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().post(`/v1/orgs/${nerd.org}/github/install-url`, {});
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Open this link to install the nerdsystem GitHub App for org ${nerd.org} (valid 30 minutes):\n\n  ${r.url}\n\nThen run: nerd github link owner/repo`);
+}
+export async function githubLink(fullName, opts) {
+    if (!fullName)
+        throw new CliError("Usage: nerd github link owner/repo [--branch main] [--root-dir apps/web] [--no-previews] [--require-pr]");
+    const nerd = readNerdJson(findProjectRoot());
+    const body = { fullName, previews: !opts["no-previews"], rootDir: opts["root-dir"] ?? "", requirePr: opts["require-pr"] };
+    if (opts.branch)
+        body.productionBranch = opts.branch;
+    if (opts.installation)
+        body.installationId = Number(opts.installation);
+    const r = await ApiClient.fromConfig().request("PUT", projectPath(nerd, "/repo"), body);
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Linked ${r.repo.fullName}. Pushes to ${r.repo.productionBranch} deploy to production${r.repo.previews ? "; pull requests get previews" : ""}.`);
+}
+export async function githubUnlink(opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().delete(projectPath(nerd, "/repo"));
+    if (opts.json)
+        return printJson(r);
+    log.ok(r.unlinked ? "Repository unlinked. Git deploys are off; `nerd deploy` still works." : "No repository was linked.");
+}
+export async function githubStatus(opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const api = ApiClient.fromConfig();
+    const [installs, repo] = await Promise.all([
+        api.get(`/v1/orgs/${nerd.org}/github/installations`),
+        api.get(projectPath(nerd, "/repo")),
+    ]);
+    if (opts.json)
+        return printJson({ ...installs, ...repo });
+    if (installs.installations.length === 0)
+        log.warn("No GitHub installation for this org. Run `nerd github connect`.");
+    else
+        table(installs.installations.map((i) => ({ installation: i.installationId, account: i.accountLogin, suspended: i.suspendedAt ?? "" })), ["installation", "account", "suspended"]);
+    if (repo.repo)
+        log.info(`\nrepo: ${repo.repo.fullName}  branch: ${repo.repo.productionBranch}  root: ${repo.repo.rootDir || "."}  previews: ${repo.repo.previews ? "on" : "off"}`);
+    else
+        log.info("\nNo repository linked to this project. Run `nerd github link owner/repo`.");
+}

package/dist/commands/init.d.ts

@@ -0,0 +1,15 @@
+import { type Project } from "../api.js";
+/** Creates the remote project and writes nerd.json. Shared by init and link. */
+export declare function linkProject(root: string, args: {
+    org?: string;
+    slug: string;
+    name: string;
+    create: boolean;
+}): Promise<Project>;
+export declare function init(dir: string | undefined, args: {
+    org?: string;
+    name?: string;
+    slug?: string;
+    describe?: string;
+    "no-create": boolean;
+}): Promise<void>;

package/dist/commands/init.js

@@ -0,0 +1,107 @@
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ApiClient } from "../api.js";
+import { projectPath, writeNerdJson } from "../project.js";
+import { CliError, log } from "../util.js";
+const SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,28}[a-z0-9])?$/;
+function templateDir() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        process.env.NERD_TEMPLATE_DIR,
+        path.resolve(here, "../template"), // published package: dist/../template
+        path.resolve(here, "../../template"), // monorepo: packages/cli/dist/../../template
+    ].filter((p) => Boolean(p));
+    const found = candidates.find((p) => existsSync(path.join(p, "nerd.json")));
+    if (!found)
+        throw new CliError(`Template not found. Looked in: ${candidates.join(", ")}`);
+    return found;
+}
+async function pickOrg(api, wanted) {
+    const me = await api.get("/v1/me");
+    if (wanted) {
+        if (!me.orgs.some((o) => o.slug === wanted))
+            throw new CliError(`You are not a member of org "${wanted}". Yours: ${me.orgs.map((o) => o.slug).join(", ")}`);
+        return wanted;
+    }
+    if (me.orgs.length === 1)
+        return me.orgs[0].slug;
+    if (me.orgs.length === 0)
+        throw new CliError("You have no orgs. Create one in the dashboard first.");
+    throw new CliError(`Pick an org with --org. Yours: ${me.orgs.map((o) => o.slug).join(", ")}`);
+}
+/** Creates the remote project and writes nerd.json. Shared by init and link. */
+export async function linkProject(root, args) {
+    const api = ApiClient.fromConfig();
+    const org = await pickOrg(api, args.org);
+    const nerd = { org, project: args.slug };
+    let project;
+    try {
+        project = (await api.get(projectPath(nerd))).project;
+        log.ok(`Linked to existing project ${org}/${args.slug}`);
+    }
+    catch (err) {
+        if (!args.create || !(err instanceof CliError) || !err.message.startsWith("not_found"))
+            throw err;
+        log.step(`Creating project ${org}/${args.slug} (provisions a database and a bucket)`);
+        project = (await api.post(`/v1/orgs/${org}/projects`, { slug: args.slug, name: args.name })).project;
+        log.ok(`Created ${project.url}`);
+    }
+    writeNerdJson(root, nerd);
+    return project;
+}
+async function askDescription() {
+    if (!process.stdin.isTTY || process.env.CI)
+        return undefined;
+    const { createInterface } = await import("node:readline/promises");
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await rl.question("What should this app do? (one or two sentences; Enter to skip)\n> ");
+        return answer.trim() || undefined;
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Records the idea where the agent reads first, so the first session starts from the person's goal. */
+function seedDescription(root, name, description) {
+    const p = path.join(root, "CLAUDE.md");
+    const heading = `# ${name}\n\n${description ? `${description}\n\n` : "(Describe what this app does here; the agent starts from it.)\n\n"}`;
+    writeFileSync(p, heading + readFileSync(p, "utf8").replace(/^# This app runs on nerdsystem\n/, "## This app runs on nerdsystem\n"));
+}
+export async function init(dir, args) {
+    if (!dir)
+        throw new CliError("Usage: nerd init <directory> [--org slug] [--name 'My App'] [--slug my-app]");
+    const root = path.resolve(dir);
+    const slug = args.slug ?? path.basename(root).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);
+    if (!SLUG_RE.test(slug))
+        throw new CliError(`"${slug}" is not a valid project slug (lowercase letters, digits, hyphens). Pass --slug.`);
+    const name = args.name ?? slug;
+    if (existsSync(root) && readdirSync(root).length > 0)
+        throw new CliError(`${root} is not empty.`);
+    const src = templateDir();
+    log.step(`Copying template into ${root}`);
+    mkdirSync(root, { recursive: true });
+    // Filter on the path inside the template: the installed template itself lives under node_modules/.
+    cpSync(src, root, { recursive: true, filter: (p) => !/(^|\/)(node_modules|dist|\.wrangler|\.dev\.vars.*|.*\.tsbuildinfo)(\/|$)/.test(path.relative(src, p)) });
+    // The published template carries ".gitignore" as "gitignore" (npm strips the dotted name from packages).
+    if (existsSync(path.join(root, "gitignore")) && !existsSync(path.join(root, ".gitignore")))
+        renameSync(path.join(root, "gitignore"), path.join(root, ".gitignore"));
+    // Rename the app and point the SDK dependency somewhere installable.
+    const pkgPath = path.join(root, "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    pkg.name = slug;
+    const sdkPath = process.env.NERD_SDK_PATH;
+    pkg.dependencies["@nerdsystem/sdk"] = sdkPath ? `file:${path.resolve(sdkPath)}` : `^${SDK_VERSION}`;
+    writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    for (const f of ["wrangler.jsonc", "index.html"]) {
+        const p = path.join(root, f);
+        writeFileSync(p, readFileSync(p, "utf8").replaceAll("nerd-app", slug));
+    }
+    const description = args.describe ?? (await askDescription());
+    seedDescription(root, name, description);
+    const project = await linkProject(root, { ...(args.org !== undefined ? { org: args.org } : {}), slug, name, create: !args["no-create"] });
+    log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
+}
+// Kept in sync with packages/sdk/package.json by the release script.
+const SDK_VERSION = "0.0.2";

package/dist/commands/login.d.ts

@@ -0,0 +1,7 @@
+export declare function login(args: {
+    token?: string;
+    "api-url"?: string;
+}): Promise<void>;
+export declare function whoami(opts: {
+    json: boolean;
+}): Promise<void>;

package/dist/commands/login.js

@@ -0,0 +1,21 @@
+import { ApiClient } from "../api.js";
+import { DEFAULT_API_URL, loadConfig, saveConfig } from "../config.js";
+import { CliError, log, printJson } from "../util.js";
+export async function login(args) {
+    const token = args.token ?? process.env.NERD_TOKEN;
+    if (!token)
+        throw new CliError("Pass --token nsk_... (get one from the dashboard or `POST /v1/tokens`).");
+    const apiUrl = (args["api-url"] ?? loadConfig().apiUrl ?? DEFAULT_API_URL).replace(/\/$/, "");
+    const me = await new ApiClient(apiUrl, token).get("/v1/me");
+    const file = saveConfig({ apiUrl, token });
+    log.ok(`Logged in as ${me.user.email} (${apiUrl}). Saved to ${file}`);
+}
+export async function whoami(opts) {
+    const api = ApiClient.fromConfig();
+    const me = await api.get("/v1/me");
+    if (opts.json)
+        return printJson({ apiUrl: api.apiUrl, ...me });
+    log.info(`${me.user.name} <${me.user.email}> via ${api.apiUrl}`);
+    for (const o of me.orgs)
+        log.info(`  org ${o.slug} (${o.role})`);
+}

package/dist/commands/ops.d.ts

@@ -0,0 +1,29 @@
+/** Re-publish the previous production deployment, or a specific one. */
+export declare function rollback(target: string | undefined, opts: {
+    json: boolean;
+    note?: string;
+}): Promise<void>;
+export declare function cron(schedule: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function transfer(toOrg: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function health(opts: {
+    json: boolean;
+}): Promise<void>;
+/** Operator only: who is waiting while sign-up is invite-only. */
+export declare function waitlist(opts: {
+    json: boolean;
+    approve?: string;
+}): Promise<void>;
+export declare function secretList(opts: {
+    json: boolean;
+}): Promise<void>;
+/** Value from the argument, or from stdin when omitted, so keys stay out of shell history. */
+export declare function secretSet(name: string | undefined, value: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function secretRemove(name: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;

package/dist/commands/ops.js

@@ -0,0 +1,113 @@
+import { ApiClient } from "../api.js";
+import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
+import { CliError, log, printJson, table } from "../util.js";
+/** Re-publish the previous production deployment, or a specific one. */
+export async function rollback(target, opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const api = ApiClient.fromConfig();
+    let id = target;
+    if (!id) {
+        const list = await api.get(projectPath(nerd, "/deployments?limit=20"));
+        const prod = list.deployments.filter((d) => d.environment === "production" && d.status === "live");
+        const previous = prod.find((d, i) => i > 0 && d.artifactStored);
+        if (!previous)
+            throw new CliError("No earlier production deployment with a stored bundle to roll back to.");
+        id = previous.id;
+        log.step(`Rolling back to ${id} (${previous.note ?? previous.commitSha?.slice(0, 7) ?? previous.createdAt})`);
+    }
+    const r = await api.post(projectPath(nerd, `/deployments/${id}/rollback`), opts.note ? { note: opts.note } : {});
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Live again as ${r.deployment.id}. The database was not changed.`);
+}
+export async function cron(schedule, opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const api = ApiClient.fromConfig();
+    if (!schedule) {
+        const p = await api.get(projectPath(nerd));
+        if (opts.json)
+            return printJson(p.project);
+        return log.info(`schedule: ${p.project.cronSchedule}${p.project.lastCronAt ? `  last run: ${p.project.lastCronAt} (${p.project.lastCronStatus})` : ""}\nSet with: nerd cron hourly|daily|off`);
+    }
+    if (!["off", "hourly", "daily"].includes(schedule))
+        throw new CliError("Usage: nerd cron off|hourly|daily");
+    const r = await api.patch(projectPath(nerd, "/cron"), { schedule });
+    if (opts.json)
+        return printJson(r);
+    log.ok(schedule === "off" ? "Scheduled job turned off." : `The platform will POST /api/cron ${schedule}. Handle it with verifyCron() in src/server/index.ts.`);
+}
+export async function transfer(toOrg, opts) {
+    if (!toOrg)
+        throw new CliError("Usage: nerd transfer <org-slug>");
+    const root = findProjectRoot();
+    const nerd = readNerdJson(root);
+    const r = await ApiClient.fromConfig().post(projectPath(nerd, "/transfer"), { toOrg });
+    const { writeNerdJson } = await import("../project.js");
+    writeNerdJson(root, { org: r.org, project: r.project.slug });
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Moved to ${r.org}. nerd.json updated; the URL ${r.project.url} is unchanged.`);
+}
+export async function health(opts) {
+    const r = await ApiClient.fromConfig().get("/health/deep");
+    if (opts.json)
+        return printJson(r);
+    for (const c of r.components)
+        log.info(`${c.ok ? "✓" : "✗"} ${c.name}: ${c.detail}`);
+    if (!r.ok)
+        throw new CliError("Platform health check has failures", 2);
+}
+/** Operator only: who is waiting while sign-up is invite-only. */
+export async function waitlist(opts) {
+    const api = ApiClient.fromConfig();
+    if (opts.approve) {
+        const r = await api.post(`/v1/waitlist/${opts.approve}/approve`, {});
+        if (opts.json)
+            return printJson(r);
+        return log.ok(`Approved ${r.entry.email}. They can sign in with GitHub now.`);
+    }
+    const r = await api.get("/v1/waitlist");
+    if (opts.json)
+        return printJson(r);
+    log.info(`sign-up mode: ${r.signupMode}`);
+    if (!r.entries.length)
+        return log.info("Nobody waiting.");
+    table(r.entries.map((e) => ({ id: e.id, email: e.email, github: e.githubLogin ?? "", note: e.note ?? "", status: e.approvedAt ? "approved" : "waiting", asked: e.createdAt })), ["id", "email", "github", "note", "status", "asked"]);
+}
+export async function secretList(opts) {
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().get(projectPath(nerd, "/secrets"));
+    if (opts.json)
+        return printJson(r);
+    if (!r.secrets.length)
+        return log.info("No app secrets yet. Set one with: nerd secret set STRIPE_SECRET_KEY");
+    table(r.secrets.map((s) => ({ name: s.name, updated: s.updatedAt })), ["name", "updated"]);
+    log.info(`\n${r.note}`);
+}
+/** Value from the argument, or from stdin when omitted, so keys stay out of shell history. */
+export async function secretSet(name, value, opts) {
+    if (!name)
+        throw new CliError("Usage: nerd secret set NAME [value]   (omit the value to read it from stdin)");
+    let v = value;
+    if (v === undefined) {
+        if (process.stdin.isTTY)
+            log.info(`Paste the value for ${name}, then Enter and Ctrl-D:`);
+        v = (await new Promise((resolve) => { let s = ""; process.stdin.setEncoding("utf8"); process.stdin.on("data", (d) => (s += d)); process.stdin.on("end", () => resolve(s)); })).replace(/\r?\n$/, "");
+    }
+    if (!v)
+        throw new CliError("Empty value.");
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().put(projectPath(nerd, `/secrets/${name}`), { value: v });
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Set ${r.secret.name}. ${r.note} For local dev, add ${name}=... to .dev.vars (never commit it).`);
+}
+export async function secretRemove(name, opts) {
+    if (!name)
+        throw new CliError("Usage: nerd secret rm NAME");
+    const nerd = readNerdJson(findProjectRoot());
+    const r = await ApiClient.fromConfig().delete(projectPath(nerd, `/secrets/${name}`));
+    if (opts.json)
+        return printJson(r);
+    log.ok(`Removed ${name}. It disappears from the app on the next deploy.`);
+}

package/dist/commands/org.d.ts

@@ -0,0 +1,47 @@
+export declare function membersList(opts: {
+    json: boolean;
+    org?: string;
+}): Promise<void>;
+export declare function membersInvite(email: string | undefined, opts: {
+    json: boolean;
+    org?: string;
+    role?: string;
+}): Promise<void>;
+export declare function membersRemove(userId: string | undefined, opts: {
+    json: boolean;
+    org?: string;
+}): Promise<void>;
+export declare function domainsList(opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function domainsAdd(hostname: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function domainsRemove(id: string | undefined, opts: {
+    json: boolean;
+}): Promise<void>;
+export declare function logs(opts: {
+    json: boolean;
+    since?: string;
+    limit?: string;
+    q?: string;
+    pr?: string;
+}): Promise<void>;
+export declare function auditExport(opts: {
+    json: boolean;
+    org?: string;
+    out?: string;
+}): Promise<void>;
+export declare function clientsList(opts: {
+    json: boolean;
+    org?: string;
+}): Promise<void>;
+export declare function clientsCreate(slug: string | undefined, opts: {
+    json: boolean;
+    org?: string;
+    name?: string;
+}): Promise<void>;
+export declare function clientsRelease(slug: string | undefined, opts: {
+    json: boolean;
+    org?: string;
+}): Promise<void>;