nerdsystem 0.0.0-stage → 0.0.2

package/dist/index.js

@@ -0,0 +1,268 @@
+#!/usr/bin/env node
+import { parseArgs } from "node:util";
+import { authConfig, authSecret } from "./commands/auth.js";
+import { check } from "./commands/check.js";
+import { dbMigrate, dbMigrations, dbQuery } from "./commands/db.js";
+import { deploy, deployments } from "./commands/deploy.js";
+import { dev } from "./commands/dev.js";
+import { doctor } from "./commands/doctor.js";
+import { cron, health, rollback, secretList, secretRemove, secretSet, transfer, waitlist } from "./commands/ops.js";
+import { verify } from "./commands/verify.js";
+import { agentsSync } from "./commands/agents.js";
+import { billingPortal, billingShow, billingUpgrade } from "./commands/billing.js";
+import { auditExport, clientsCreate, clientsList, clientsRelease, domainsAdd, domainsList, domainsRemove, logs, membersInvite, membersList, membersRemove } from "./commands/org.js";
+import { buildsList, buildsShow, buildsTrigger } from "./commands/builds.js";
+import { githubConnect, githubLink, githubStatus, githubUnlink } from "./commands/github.js";
+import { init, linkProject } from "./commands/init.js";
+import { login, whoami } from "./commands/login.js";
+import { findProjectRoot } from "./project.js";
+import { CliError, log } from "./util.js";
+const HELP = `nerd — deploy apps to nerdsystem
+
+  nerd login --token nsk_...          Save an API token (also: NERD_TOKEN, NERD_API_URL)
+  nerd whoami                         Show the current user and orgs
+  nerd doctor                         Check Node, pnpm, git, login, and the project
+  nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
+  nerd link --slug <project> [--org]  Link this directory to an existing or new project
+  nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
+  nerd check                          Verify platform rules and typecheck
+  nerd verify [--no-build] [--rule id] [--json]   Run the security gates; --json gives failures the agent can fix
+  nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
+  nerd rollback [deploymentId]        Re-publish the previous production bundle
+  nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
+  nerd transfer <org>                 Move this project to another org you administer
+  nerd health                         Platform component health (operators)
+  nerd waitlist [approve <id>]        Who is waiting for access while sign-up is invite-only (operators)
+  nerd deployments                    List recent deployments
+  nerd db query "<sql>"               Run SQL on the production database
+  nerd db migrate                     Apply pending migrations to production
+  nerd db migrations                  List applied migrations
+  nerd auth config [--roles a,b] [--default-role r] [--signup on|off]
+  nerd auth secret                    Mint a dev tenant secret into .dev.vars
+  nerd secret set NAME [value]        App secret for production (c.env.NAME); value from stdin when omitted
+  nerd secret list | rm NAME          Names only; values are never shown
+  nerd github connect                 Install the GitHub App for this org (prints a link)
+  nerd github link owner/repo [--branch main] [--root-dir dir] [--no-previews] [--require-pr]
+  nerd github status | unlink
+  nerd builds [--limit n]             List git-triggered builds
+  nerd builds show <id>               Build details and log
+  nerd builds trigger [--branch b] [--commit sha]
+  nerd agents sync                    Regenerate AGENTS.md, Cursor, Copilot, Gemini files from the skill
+  nerd billing [--org slug]           Plan, limits, and usage for the org
+  nerd billing upgrade --plan pro|studio [--annual]   Start checkout
+  nerd billing portal                 Manage cards, invoices, and plan
+  nerd members [invite <email> --role r | remove <userId>]   Org members and invitations
+  nerd clients [create <slug> --name n | release <slug>]     Studio: one org per client, billed through yours
+  nerd domains [add <hostname> | remove <id>]                Custom domains for this project
+  nerd logs [--since 30m] [--limit 100] [--q text] [--pr n]  Logs from the deployed app
+  nerd audit [--out file.csv]         Export deployments and builds (Studio)
+
+Every command accepts --json for machine-readable output.`;
+const BOOL = { type: "boolean", default: false };
+const STR = { type: "string" };
+async function main(argv) {
+    const [cmd, ...rest] = argv;
+    if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
+        console.log(HELP);
+        return;
+    }
+    const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
+    switch (cmd) {
+        case "login": {
+            const { values } = parse({ token: STR, "api-url": STR });
+            return login(values);
+        }
+        case "doctor": {
+            const { values } = parse({});
+            return doctor({ json: Boolean(values.json) });
+        }
+        case "whoami": {
+            const { values } = parse({});
+            return whoami({ json: Boolean(values.json) });
+        }
+        case "init": {
+            const { values, positionals } = parse({ org: STR, name: STR, slug: STR, describe: STR, "no-create": BOOL });
+            return init(positionals[0], values);
+        }
+        case "link": {
+            const { values } = parse({ org: STR, slug: STR, name: STR, "no-create": BOOL });
+            if (!values.slug)
+                throw new CliError("Usage: nerd link --slug <project> [--org <org>] [--name 'My App']");
+            const root = (() => {
+                try {
+                    return findProjectRoot();
+                }
+                catch {
+                    return process.cwd();
+                }
+            })();
+            await linkProject(root, { ...(values.org ? { org: values.org } : {}), slug: values.slug, name: values.name ?? values.slug, create: !values["no-create"] });
+            return;
+        }
+        case "dev":
+            return dev(rest);
+        case "check": {
+            const { values } = parse({ "no-typecheck": BOOL, "no-remote": BOOL });
+            return check(values);
+        }
+        case "verify": {
+            const { values } = parse({ "no-build": BOOL, rule: STR });
+            return verify({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), ...(values.rule ? { rule: values.rule } : {}) });
+        }
+        case "deploy": {
+            const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
+            return deploy(values);
+        }
+        case "rollback": {
+            const { values, positionals } = parse({ note: STR });
+            return rollback(positionals[0], { json: Boolean(values.json), ...(values.note ? { note: values.note } : {}) });
+        }
+        case "cron": {
+            const { values, positionals } = parse({});
+            return cron(positionals[0], { json: Boolean(values.json) });
+        }
+        case "transfer": {
+            const { values, positionals } = parse({});
+            return transfer(positionals[0], { json: Boolean(values.json) });
+        }
+        case "health": {
+            const { values } = parse({});
+            return health({ json: Boolean(values.json) });
+        }
+        case "waitlist": {
+            const [sub, ...subRest] = rest;
+            const { values, positionals } = parseArgs({ args: sub === "approve" ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
+            return waitlist({ json: Boolean(values.json), ...(sub === "approve" ? { approve: positionals[0] } : {}) });
+        }
+        case "deployments": {
+            const { values } = parse({ limit: { type: "string", default: "10" } });
+            return deployments(values);
+        }
+        case "db": {
+            const [sub, ...subRest] = rest;
+            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
+            if (sub === "query")
+                return dbQuery(positionals[0], { json: Boolean(values.json) });
+            if (sub === "migrate")
+                return dbMigrate({ json: Boolean(values.json) });
+            if (sub === "migrations")
+                return dbMigrations({ json: Boolean(values.json) });
+            throw new CliError("Usage: nerd db query|migrate|migrations");
+        }
+        case "auth": {
+            const [sub, ...subRest] = rest;
+            const { values } = parseArgs({ args: subRest, options: { json: BOOL, roles: STR, "default-role": STR, signup: STR }, allowPositionals: false });
+            if (sub === "config")
+                return authConfig(values);
+            if (sub === "secret")
+                return authSecret();
+            throw new CliError("Usage: nerd auth config|secret");
+        }
+        case "billing": {
+            const [sub, ...subRest] = rest;
+            const isSub = sub === "upgrade" || sub === "portal" || sub === "show";
+            const { values } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, plan: STR, annual: BOOL }, allowPositionals: false });
+            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
+            if (sub === "upgrade")
+                return billingUpgrade({ ...o, ...(values.plan ? { plan: values.plan } : {}), annual: Boolean(values.annual) });
+            if (sub === "portal")
+                return billingPortal(o);
+            return billingShow(o);
+        }
+        case "members": {
+            const [sub, ...subRest] = rest;
+            const isSub = sub === "invite" || sub === "remove" || sub === "list";
+            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, role: STR }, allowPositionals: true });
+            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
+            if (sub === "invite")
+                return membersInvite(positionals[0], { ...o, ...(values.role ? { role: values.role } : {}) });
+            if (sub === "remove")
+                return membersRemove(positionals[0], o);
+            return membersList(o);
+        }
+        case "clients": {
+            const [sub, ...subRest] = rest;
+            const isSub = sub === "create" || sub === "release" || sub === "list";
+            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, name: STR }, allowPositionals: true });
+            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
+            if (sub === "create")
+                return clientsCreate(positionals[0], { ...o, ...(values.name ? { name: values.name } : {}) });
+            if (sub === "release")
+                return clientsRelease(positionals[0], o);
+            return clientsList(o);
+        }
+        case "secret": {
+            const [sub, ...subRest] = rest;
+            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
+            const json = Boolean(values.json);
+            if (sub === "set")
+                return secretSet(positionals[0], positionals[1], { json });
+            if (sub === "rm" || sub === "remove" || sub === "delete")
+                return secretRemove(positionals[0], { json });
+            if (sub === "list" || sub === "ls" || sub === undefined)
+                return secretList({ json });
+            throw new CliError("Usage: nerd secret set NAME [value] | list | rm NAME");
+        }
+        case "domains": {
+            const [sub, ...subRest] = rest;
+            const isSub = sub === "add" || sub === "remove" || sub === "list";
+            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
+            const o = { json: Boolean(values.json) };
+            if (sub === "add")
+                return domainsAdd(positionals[0], o);
+            if (sub === "remove")
+                return domainsRemove(positionals[0], o);
+            return domainsList(o);
+        }
+        case "logs": {
+            const { values } = parse({ since: STR, limit: STR, q: STR, pr: STR });
+            return logs({ json: Boolean(values.json), ...(values.since ? { since: values.since } : {}), ...(values.limit ? { limit: values.limit } : {}), ...(values.q ? { q: values.q } : {}), ...(values.pr ? { pr: values.pr } : {}) });
+        }
+        case "audit": {
+            const { values } = parse({ org: STR, out: STR });
+            return auditExport({ json: Boolean(values.json), ...(values.org ? { org: values.org } : {}), ...(values.out ? { out: values.out } : {}) });
+        }
+        case "agents": {
+            const [sub, ...subRest] = rest;
+            const { values } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: false });
+            if (sub === "sync")
+                return agentsSync({ json: Boolean(values.json) });
+            throw new CliError("Usage: nerd agents sync");
+        }
+        case "github": {
+            const [sub, ...subRest] = rest;
+            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, branch: STR, "root-dir": STR, "no-previews": BOOL, "require-pr": BOOL, installation: STR }, allowPositionals: true });
+            const json = Boolean(values.json);
+            if (sub === "connect")
+                return githubConnect({ json });
+            if (sub === "link")
+                return githubLink(positionals[0], { json, "no-previews": Boolean(values["no-previews"]), "require-pr": Boolean(values["require-pr"]), ...(values.branch ? { branch: values.branch } : {}), ...(values["root-dir"] ? { "root-dir": values["root-dir"] } : {}), ...(values.installation ? { installation: values.installation } : {}) });
+            if (sub === "unlink")
+                return githubUnlink({ json });
+            if (sub === "status" || sub === undefined)
+                return githubStatus({ json });
+            throw new CliError("Usage: nerd github connect|link|unlink|status");
+        }
+        case "builds": {
+            const [sub, ...subRest] = rest;
+            const isSub = sub === "show" || sub === "trigger" || sub === "list";
+            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, limit: { type: "string", default: "10" }, branch: STR, commit: STR }, allowPositionals: true });
+            const json = Boolean(values.json);
+            if (sub === "show")
+                return buildsShow(positionals[0], { json });
+            if (sub === "trigger")
+                return buildsTrigger({ json, ...(values.branch ? { branch: values.branch } : {}), ...(values.commit ? { commit: values.commit } : {}) });
+            return buildsList({ json, limit: values.limit });
+        }
+        default:
+            throw new CliError(`Unknown command "${cmd}". Run \`nerd help\`.`);
+    }
+}
+main(process.argv.slice(2)).catch((err) => {
+    if (err instanceof CliError) {
+        log.warn(err.message);
+        process.exit(err.exitCode);
+    }
+    console.error(err);
+    process.exit(1);
+});

package/dist/project.d.ts

@@ -0,0 +1,11 @@
+export interface NerdJson {
+    org: string;
+    project: string;
+}
+export declare function findProjectRoot(start?: string): string;
+export declare function readNerdJson(root: string): NerdJson;
+export declare function writeNerdJson(root: string, value: NerdJson): void;
+export declare function projectPath(p: NerdJson, suffix?: string): string;
+/** Reads .dev.vars as a simple key=value map. Values may be single- or double-quoted. */
+export declare function readDevVars(root: string): Record<string, string>;
+export declare function writeDevVars(root: string, vars: Record<string, string>): void;

package/dist/project.js

@@ -0,0 +1,51 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { CliError } from "./util.js";
+export function findProjectRoot(start = process.cwd()) {
+    let dir = start;
+    for (;;) {
+        if (existsSync(path.join(dir, "nerd.json")))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            throw new CliError("No nerd.json found. Run this inside a nerdsystem app, or create one with `nerd init <dir>`.");
+        dir = parent;
+    }
+}
+export function readNerdJson(root) {
+    const raw = JSON.parse(readFileSync(path.join(root, "nerd.json"), "utf8"));
+    if (!raw.org || !raw.project)
+        throw new CliError("nerd.json is missing org or project. Run `nerd link`.");
+    return { org: raw.org, project: raw.project };
+}
+export function writeNerdJson(root, value) {
+    const existing = existsSync(path.join(root, "nerd.json")) ? JSON.parse(readFileSync(path.join(root, "nerd.json"), "utf8")) : {};
+    writeFileSync(path.join(root, "nerd.json"), `${JSON.stringify({ ...existing, ...value }, null, 2)}\n`);
+}
+export function projectPath(p, suffix = "") {
+    return `/v1/orgs/${p.org}/projects/${p.project}${suffix}`;
+}
+/** Reads .dev.vars as a simple key=value map. Values may be single- or double-quoted. */
+export function readDevVars(root) {
+    const file = path.join(root, ".dev.vars");
+    if (!existsSync(file))
+        return {};
+    const out = {};
+    for (const line of readFileSync(file, "utf8").split("\n")) {
+        const m = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/.exec(line);
+        if (!m)
+            continue;
+        let v = m[2];
+        if ((v.startsWith("'") && v.endsWith("'")) || (v.startsWith('"') && v.endsWith('"')))
+            v = v.slice(1, -1);
+        out[m[1]] = v;
+    }
+    return out;
+}
+export function writeDevVars(root, vars) {
+    const merged = { ...readDevVars(root), ...vars };
+    const body = Object.entries(merged)
+        .map(([k, v]) => `${k}='${v.replace(/'/g, "'\\''")}'`)
+        .join("\n");
+    writeFileSync(path.join(root, ".dev.vars"), `${body}\n`, { mode: 0o600 });
+}

package/dist/util.d.ts

@@ -0,0 +1,21 @@
+export declare class CliError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export declare const log: {
+    info: (msg: string) => void;
+    step: (msg: string) => void;
+    ok: (msg: string) => void;
+    warn: (msg: string) => void;
+};
+/** Runs a command, streaming output. Resolves with the exit code. */
+export declare function run(cmd: string, args: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<number>;
+export declare function runOrThrow(cmd: string, args: string[], opts?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+}): Promise<void>;
+export declare function printJson(value: unknown): void;
+export declare function table(rows: Record<string, unknown>[], columns: string[]): void;

package/dist/util.js

@@ -0,0 +1,39 @@
+import { spawn } from "node:child_process";
+export class CliError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+    }
+}
+export const log = {
+    info: (msg) => console.error(`${msg}`),
+    step: (msg) => console.error(`\x1b[36m›\x1b[0m ${msg}`),
+    ok: (msg) => console.error(`\x1b[32m✓\x1b[0m ${msg}`),
+    warn: (msg) => console.error(`\x1b[33m!\x1b[0m ${msg}`),
+};
+/** Runs a command, streaming output. Resolves with the exit code. */
+export function run(cmd, args, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: "inherit", shell: process.platform === "win32" });
+        child.on("error", reject);
+        child.on("exit", (code) => resolve(code ?? 1));
+    });
+}
+export async function runOrThrow(cmd, args, opts = {}) {
+    const code = await run(cmd, args, opts);
+    if (code !== 0)
+        throw new CliError(`${cmd} ${args.join(" ")} exited with ${code}`, code);
+}
+export function printJson(value) {
+    process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+}
+export function table(rows, columns) {
+    if (rows.length === 0)
+        return;
+    const widths = columns.map((c) => Math.max(c.length, ...rows.map((r) => String(r[c] ?? "").length)));
+    const line = (cells) => cells.map((v, i) => v.padEnd(widths[i])).join("  ");
+    process.stdout.write(`${line(columns)}\n`);
+    for (const r of rows)
+        process.stdout.write(`${line(columns.map((c) => String(r[c] ?? "")))}\n`);
+}

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.2",
+  "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
+  "type": "module",
+  "bin": {
+    "nerd": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "rules",
+    "template",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./gates": "./dist/gates/index.js",
+    "./gates/text": "./dist/gates/text.js",
+    "./gates/rules": "./dist/gates/rules.js",
+    "./project": "./dist/project.js",
+    "./api": "./dist/api.js",
+    "./commands/check": "./dist/commands/check.js",
+    "./commands/deploy": "./dist/commands/deploy.js",
+    "./commands/verify": "./dist/commands/verify.js"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/doobe01/nerdsystem-cloudflare",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://nerdsystem.com",
+  "keywords": [
+    "cloudflare",
+    "deploy",
+    "cli",
+    "claude-code",
+    "vibe-coding"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "sync-template": "node scripts/sync-template.mjs",
+    "test": "vitest run"
+  }
 }

package/rules/semgrep.yml

@@ -0,0 +1,77 @@
+# nerdsystem Semgrep rules. Run by the builder (and by `nerd verify` when semgrep is installed).
+# Severity ERROR blocks a deploy; WARNING is advisory.
+rules:
+  - id: nerd-raw-sql-interpolation
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: SQL built with string interpolation. Use Drizzle's query builder or sql`` with parameters.
+    patterns:
+      - pattern-either:
+          - pattern: $DB.prepare(`...${$X}...`)
+          - pattern: $DB.exec(`...${$X}...`)
+          - pattern: sql.raw(`...${$X}...`)
+  - id: nerd-eval
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: eval and new Function execute arbitrary code; not allowed in hosted apps.
+    pattern-either:
+      - pattern: eval(...)
+      - pattern: new Function(...)
+  - id: nerd-dangerously-set-inner-html
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: dangerouslySetInnerHTML with a non-literal value can inject scripts. Sanitize or avoid.
+    patterns:
+      - pattern: dangerouslySetInnerHTML={{ __html: $X }}
+      - pattern-not: dangerouslySetInnerHTML={{ __html: "..." }}
+  - id: nerd-innerhtml-assignment
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: Assigning to innerHTML from a variable can inject scripts.
+    patterns:
+      - pattern: $EL.innerHTML = $X
+      - pattern-not: $EL.innerHTML = "..."
+  - id: nerd-hand-rolled-password-check
+    languages: [typescript, javascript]
+    severity: ERROR
+    message: Comparing passwords in app code. Authentication is provided by the platform; do not store or compare passwords.
+    pattern-either:
+      - pattern: $A.password === $B
+      - pattern: $A.password == $B
+      - pattern: bcrypt.compare(...)
+      - pattern: bcrypt.hash(...)
+  - id: nerd-jwt-in-app
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: Signing or verifying tokens in app code. Sessions are handled by the SDK; use c.var.user.
+    pattern-either:
+      - pattern: jwt.sign(...)
+      - pattern: jwt.verify(...)
+      - pattern: sign($PAYLOAD, $SECRET, ...)
+  - id: nerd-open-redirect
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: Redirecting to a value from the request can send users to attacker sites. Allow-list destinations.
+    patterns:
+      - pattern-either:
+          - pattern: c.redirect(c.req.query(...))
+          - pattern: c.redirect($REQ.query.$X)
+  - id: nerd-fetch-to-user-url
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: Fetching a URL taken from the request can reach internal services (SSRF). Validate the host.
+    patterns:
+      - pattern-either:
+          - pattern: fetch(c.req.query(...), ...)
+          - pattern: fetch((await c.req.json()).$X, ...)
+  - id: nerd-math-random-for-secrets
+    languages: [typescript, javascript]
+    severity: WARNING
+    message: Math.random is not a secure source for tokens or ids used in security decisions. Use crypto.randomUUID or getRandomValues.
+    patterns:
+      - pattern-inside: |
+          $TOKEN = ...
+      - pattern: Math.random()
+      - metavariable-regex:
+          metavariable: $TOKEN
+          regex: (?i).*(token|secret|nonce|otp|code|key).*

package/template/.claude/settings.json

@@ -0,0 +1,12 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(nerd check:*)",
+      "Bash(nerd deployments:*)",
+      "Bash(nerd db migrations:*)",
+      "Bash(nerd auth config)",
+      "Bash(pnpm db:generate)",
+      "Bash(pnpm typecheck)"
+    ]
+  }
+}