nerdsystem 0.0.10 → 0.0.12

package/README.md

@@ -7,18 +7,29 @@ npx nerdsystem init my-app
 cd my-app && pnpm install
 nerd dev       # run locally with real sign-in
 nerd check     # every gate a deploy runs: secrets, dependencies, policy, PII, types (alias: nerd verify)
-nerd deploy    # checks, builds, migrates, ships
+nerd deploy    # checks, builds, saves the code, migrates, ships
 ```
 
 Every command takes `--json` for agents. `nerd help` lists them all.
 
+Your code is kept with every deploy and every `nerd save` (and `nerd dev` saves on start), so a lost laptop does not lose the app. Work after the last save is only on your computer. GitHub stays optional.
+
+```sh
+nerd save                      # keep a copy of the code on nerdsystem without deploying
+nerd pull <org>/<project>      # get the newest saved copy back on any computer, then: pnpm install && nerd dev
+nerd pull --deployment <id>    # the code of one deployment (what a rollback went back to)
+nerd pull --trashed <org>/<project>   # the code of a deleted project while it is in the trash
+```
+
+`nerd pull` verifies the download against its recorded hash, refuses to write into a non-empty folder without `--force`, and starts a git repository in the restored folder. `nerd deploy` stops when the live app was deployed from a copy of the code this folder never saw; `nerd pull` gets that copy, or `nerd deploy --force` replaces it.
+
 More you will reach for:
 
 ```sh
 nerd db export                 # SQL dump of the production database to <slug>-<date>.sql (--out file.sql)
 nerd delete --yes              # take the app offline; data kept a week in the trash
 nerd trash                     # deleted projects you can still restore
-nerd trash restore <slug>      # bring one back, then nerd deploy or roll back
+nerd trash restore <slug>      # bring one back online from its last deployed version
 ```
 
 `nerd check` prints how many gates ran and which were skipped (semgrep and gitleaks are optional locally; git builds run them in the builder). Platform operators also have `nerd admin --help`.

package/dist/api.d.ts

@@ -12,7 +12,21 @@ export declare class ApiClient {
     static fromConfig(opts?: {
         requireAuth?: boolean;
     }): ApiClient;
+    private authHeaders;
+    private send;
+    /** Turns a non-2xx response into a CliError carrying the API's code and status. */
+    private fail;
     request<T>(method: string, path: string, body?: unknown | FormData): Promise<T>;
+    /**
+     * Posts raw bytes (a snapshot) with an explicit content type and length plus any extra headers.
+     * The response is JSON like every other route.
+     */
+    postRaw<T>(path: string, body: Uint8Array, headers: Record<string, string>): Promise<T>;
+    /** GETs a binary body (a snapshot download) with the bearer token; errors are parsed like every other route. */
+    download(path: string): Promise<{
+        bytes: Buffer;
+        headers: Headers;
+    }>;
     get<T>(path: string): Promise<T>;
     post<T>(path: string, body?: unknown): Promise<T>;
     put<T>(path: string, body: unknown): Promise<T>;
@@ -43,12 +57,37 @@ export interface Project {
 export interface Deployment {
     id: string;
     status: "uploading" | "live" | "failed";
+    environment?: "production" | "preview";
+    note?: string | null;
+    commitSha?: string | null;
+    rolledBackFrom?: string | null;
+    artifactStored?: boolean;
     moduleCount: number;
     assetCount: number;
     bundleBytes: number;
     error: string | null;
     createdAt: string;
     finishedAt: string | null;
+    /** The snapshot of the code this deployment was made from; null when none was stored (older nerd, or a user-caused skip). */
+    sourceId?: string | null;
+    /** Why no snapshot was stored, when the person's own setup caused it (over the size cap, a preview build). */
+    sourceSkippedReason?: string | null;
+}
+/** A stored copy of the app's code (docs/source-snapshots.md). */
+export interface Source {
+    id: string;
+    projectId: string;
+    deploymentId: string | null;
+    buildId: string | null;
+    kind: "deploy" | "save";
+    sha256: string;
+    treeHash: string;
+    bytes: number;
+    fileCount: number;
+    gitSha: string | null;
+    cliVersion: string | null;
+    createdBy: string | null;
+    createdAt: string;
 }
 export interface TenantConfig {
     projectId: string;

package/dist/api.js

@@ -14,33 +14,75 @@ export class ApiClient {
         }
         return new ApiClient(cfg.apiUrl, cfg.token);
     }
+    authHeaders() {
+        return this.token ? { authorization: `Bearer ${this.token}` } : {};
+    }
+    async send(path, init) {
+        return fetch(`${this.apiUrl}${path}`, init).catch((err) => {
+            throw new CliError(`Could not reach ${this.apiUrl}: ${err.message}`);
+        });
+    }
+    /** Turns a non-2xx response into a CliError carrying the API's code and status. */
+    async fail(res, text) {
+        let json = null;
+        try {
+            json = text ? JSON.parse(text) : null;
+        }
+        catch {
+            throw new CliError(`API returned non-JSON (${res.status}): ${text.slice(0, 200)}`, 1, { status: res.status });
+        }
+        const err = json?.error;
+        const details = err?.details ? `\n${JSON.stringify(err.details, null, 2)}` : "";
+        // The message leads; the code and status follow for people who need them.
+        throw new CliError(`${err?.message ?? "request failed"} [${err?.code ?? "error"} ${res.status}]${details}`, 1, { code: err?.code ?? "error", status: res.status });
+    }
     async request(method, path, body) {
         const isForm = body instanceof FormData;
-        const res = await fetch(`${this.apiUrl}${path}`, {
+        const res = await this.send(path, {
             method,
             headers: {
-                ...(this.token ? { authorization: `Bearer ${this.token}` } : {}),
+                ...this.authHeaders(),
                 ...(body !== undefined && !isForm ? { "content-type": "application/json" } : {}),
             },
             body: body === undefined ? null : isForm ? body : JSON.stringify(body),
-        }).catch((err) => {
-            throw new CliError(`Could not reach ${this.apiUrl}: ${err.message}`);
         });
         const text = await res.text();
-        let json = null;
+        if (!res.ok)
+            await this.fail(res, text);
         try {
-            json = text ? JSON.parse(text) : null;
+            return (text ? JSON.parse(text) : null);
         }
         catch {
             throw new CliError(`API returned non-JSON (${res.status}): ${text.slice(0, 200)}`);
         }
-        if (!res.ok) {
-            const err = json?.error;
-            const details = err?.details ? `\n${JSON.stringify(err.details, null, 2)}` : "";
-            // The message leads; the code and status follow for people who need them.
-            throw new CliError(`${err?.message ?? "request failed"} [${err?.code ?? "error"} ${res.status}]${details}`, 1, { code: err?.code ?? "error", status: res.status });
+    }
+    /**
+     * Posts raw bytes (a snapshot) with an explicit content type and length plus any extra headers.
+     * The response is JSON like every other route.
+     */
+    async postRaw(path, body, headers) {
+        const res = await this.send(path, {
+            method: "POST",
+            // fetch sets content-length from the byte length, which the API requires before it reads.
+            headers: { ...this.authHeaders(), ...headers },
+            body,
+        });
+        const text = await res.text();
+        if (!res.ok)
+            await this.fail(res, text);
+        try {
+            return (text ? JSON.parse(text) : null);
         }
-        return json;
+        catch {
+            throw new CliError(`API returned non-JSON (${res.status}): ${text.slice(0, 200)}`);
+        }
+    }
+    /** GETs a binary body (a snapshot download) with the bearer token; errors are parsed like every other route. */
+    async download(path) {
+        const res = await this.send(path, { method: "GET", headers: this.authHeaders() });
+        if (!res.ok)
+            await this.fail(res, await res.text());
+        return { bytes: Buffer.from(await res.arrayBuffer()), headers: res.headers };
     }
     get(path) {
         return this.request("GET", path);

package/dist/cli.d.ts

@@ -1,3 +1,5 @@
+import { cliVersion } from "./commands/source.js";
+export { cliVersion };
 export declare function main(argv: string[]): Promise<void>;
 /**
  * Runs one command and turns any failure into a non-zero exit code. `process.exitCode` is set

package/dist/cli.js

@@ -14,6 +14,9 @@ import { buildsList, buildsShow, buildsTrigger } from "./commands/builds.js";
 import { githubConnect, githubLink, githubStatus, githubUnlink } from "./commands/github.js";
 import { init, linkProject } from "./commands/init.js";
 import { login, whoami } from "./commands/login.js";
+import { pull } from "./commands/pull.js";
+import { save } from "./commands/save.js";
+import { cliVersion } from "./commands/source.js";
 import { deleteProject, trashList, trashRestore } from "./commands/trash.js";
 import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
@@ -26,13 +29,16 @@ const HELP = `nerd: start, check, and deploy a web app on nerdsystem
   nerd link --slug <project> [--org]  Link this directory to an existing or new project
   nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
   nerd check [--no-build] [--rule id] [--json]   Run every gate a deploy runs; --json gives failures the agent can fix (alias: nerd verify)
-  nerd deploy [--note "what changed"] [--skip-probe]   Check, build, migrate, upload, probe the live URL. Prints the URL
-  nerd rollback [deploymentId]        Re-publish the previous production bundle
+  nerd deploy [--note "what changed"] [--skip-probe] [--force]   Check, build, save the code, migrate, upload, probe the live URL. Prints the URL
+  nerd save                           Keep a copy of the code on nerdsystem without deploying (nerd dev does this on start)
+  nerd pull [<org>/<project>] [--latest | --source <id> | --deployment <id>] [--trashed] [--dir <name>] [--force]
+                                      Get a saved copy of the code back onto this computer
+  nerd rollback [deploymentId]        Re-publish the previous production bundle (its saved code comes with it)
   nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
   nerd transfer <org>                 Move this project to another org you administer
   nerd delete [--slug p] [--org o] --yes   Take the app offline; data kept a week in the trash
   nerd trash [--org o]                Deleted projects you can still restore
-  nerd trash restore <slug> [--org o] Bring a deleted project back (then deploy or roll back)
+  nerd trash restore <slug> [--org o] Bring a deleted project back online from its last version
   nerd health                         Platform component health (operators)
   nerd waitlist [approve <id>]        Who is waiting for access while sign-up is invite-only (operators)
   nerd deployments                    List recent deployments
@@ -60,8 +66,9 @@ const HELP = `nerd: start, check, and deploy a web app on nerdsystem
   nerd logs [--since 30m] [--limit 100] [--q text] [--pr n]  Logs from the deployed app
   nerd audit [--out file.csv]         Export deployments and builds (Studio)
 
-Every command accepts --json for machine-readable output.
+Every command accepts --json for machine-readable output. nerd --version prints the version.
 Operator: nerd admin --help`;
+export { cliVersion };
 const BOOL = { type: "boolean", default: false };
 const STR = { type: "string" };
 export async function main(argv) {
@@ -70,6 +77,18 @@ export async function main(argv) {
         console.log(HELP);
         return;
     }
+    if (cmd === "version" || cmd === "--version" || cmd === "-v") {
+        if (rest.includes("--json"))
+            console.log(JSON.stringify({ version: cliVersion() }));
+        else
+            console.log(cliVersion());
+        return;
+    }
+    // `nerd <command> --help` prints the help instead of "Unknown option"; admin keeps its own help text.
+    if (cmd !== "admin" && (rest.includes("--help") || rest.includes("-h"))) {
+        console.log(HELP);
+        return;
+    }
     const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
     switch (cmd) {
         case "login": {
@@ -111,9 +130,19 @@ export async function main(argv) {
             return check({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), "no-remote": Boolean(values["no-remote"]), ...(values.rule ? { rule: values.rule } : {}) });
         }
         case "deploy": {
-            const { values } = parse({ "skip-build": BOOL, "skip-probe": BOOL, note: STR });
+            const { values } = parse({ "skip-build": BOOL, "skip-probe": BOOL, force: BOOL, note: STR });
             return deploy(values);
         }
+        case "save": {
+            const { values } = parse({}, false);
+            return save({ json: Boolean(values.json) });
+        }
+        case "pull": {
+            const { values, positionals } = parse({ latest: BOOL, source: STR, deployment: STR, trashed: BOOL, dir: STR, force: BOOL });
+            if (positionals.length > 1)
+                throw new CliError("Usage: nerd pull [<org>/<project>] [--latest | --source <id> | --deployment <id>] [--trashed] [--dir <name>] [--force]");
+            return pull(positionals[0], { json: Boolean(values.json), latest: Boolean(values.latest), trashed: Boolean(values.trashed), force: Boolean(values.force), ...(values.source ? { source: values.source } : {}), ...(values.deployment ? { deployment: values.deployment } : {}), ...(values.dir ? { dir: values.dir } : {}) });
+        }
         case "rollback": {
             const { values, positionals } = parse({ note: STR });
             return rollback(positionals[0], { json: Boolean(values.json), ...(values.note ? { note: values.note } : {}) });

package/dist/commands/admin.js

@@ -32,5 +32,5 @@ export async function adminUnsuspend(opts) {
     const r = await operatorPost("/v1/admin/unsuspend", { orgSlug: opts.org });
     if (opts.json)
         return printJson(r);
-    log.ok(`Unsuspended ${r.org}: ${r.usersRestored} user(s) restored. Trashed projects stay in the trash until restored with \`nerd trash restore\`.`);
+    log.ok(`Unsuspended ${r.org}: ${r.usersRestored} user(s) restored. ${r.projectsKept} project(s) stay in the trash with a fresh grace period (destroyed after ${r.purgeAfter.slice(0, 10)}) until restored with \`nerd trash restore\`.`);
 }

package/dist/commands/deploy.d.ts

@@ -1,5 +1,7 @@
-import { ApiClient } from "../api.js";
-interface BuildOutput {
+import { ApiClient, type Deployment, type Source } from "../api.js";
+import { type NerdJson } from "../project.js";
+import { type GateResult } from "../gates/index.js";
+export interface BuildOutput {
     workerDir: string;
     main: string;
     modules: string[];
@@ -14,14 +16,65 @@ export declare function applyRemoteMigrations(root: string, api: ApiClient): Pro
     applied: string[];
     skipped: string[];
 }>;
-export declare function deploy(opts: {
+export interface DeployOptions {
     json: boolean;
     "skip-build": boolean;
     "skip-probe"?: boolean | undefined;
+    /** Skip the lineage guard: replace a live app deployed from another copy of the code. */
+    force?: boolean | undefined;
     note?: string | undefined;
-}): Promise<void>;
+}
+/** What the lineage guard found, for --json output and tests. */
+export interface LineageCheck {
+    /** The newest live production deployment, when there is one. */
+    live: Deployment | null;
+    /** Why this copy may deploy over it. */
+    passed: "no-live-deployment" | "no-source" | "known-id" | "same-commit" | "forced";
+}
+/**
+ * The lineage guard: the live app must come from this copy of the code, or the person must say so.
+ * A live production deployment with a snapshot this folder never deployed, saved, or pulled (and whose
+ * commit this folder's git history does not hold) stops the deploy and points at `nerd pull`.
+ */
+export declare function checkLineage(root: string, nerd: NerdJson, api: ApiClient, force: boolean): Promise<LineageCheck>;
+/** The gate results the deploy reports with the row, the shape builds use, capped the way the API caps them. */
+export declare function checksMetadata(results: GateResult[]): {
+    reportedBy: "cli";
+    cli: string;
+    results: GateResult[];
+};
+export interface ShipResult {
+    deployment: Deployment;
+    url: string;
+    migrations: {
+        applied: string[];
+        skipped: string[];
+    };
+    probes: GateResult;
+    /** The snapshot stored for this deploy, when one was. */
+    source: Source | null;
+    /** Why no snapshot was stored, when the folder itself was the reason. */
+    sourceSkipped: string | null;
+    lineage: LineageCheck;
+    warnings: string[];
+}
+/**
+ * Everything after the gates, in the order the contract fixes: lineage guard, snapshot (pack and
+ * upload), migrations, the deploy itself with the snapshot id and the gate results, then the probe.
+ * An upload that fails for any reason but the folder's own size stops here with nothing deployed.
+ */
+export declare function shipBuild(args: {
+    root: string;
+    nerd: NerdJson;
+    api: ApiClient;
+    build: BuildOutput;
+    results: GateResult[];
+    opts: DeployOptions;
+}): Promise<ShipResult>;
+/** The one line about the code after a live deploy, keyed on what the API recorded, not on what we sent. */
+export declare function sourceLine(r: Pick<ShipResult, "deployment" | "source" | "sourceSkipped">): string;
+export declare function deploy(opts: DeployOptions): Promise<void>;
 export declare function deployments(opts: {
     json: boolean;
     limit: string;
 }): Promise<void>;
-export {};

package/dist/commands/deploy.js

@@ -1,11 +1,13 @@
+import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
 import { ApiClient } from "../api.js";
-import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
+import { findProjectRoot, projectPath, readDevVars, readNerdJson } from "../project.js";
+import { formatMb } from "../snapshot.js";
 import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
+import { appendLineage, cliVersion, LOCAL_ONLY_NOTE, packProject, readLineage, uploadSnapshot, uploadStopMessage } from "./source.js";
 import { BUILD_GATES, gateSummary, knownSecretsFrom, probeDeployment, runGates, skippedProbe, SOURCE_GATES, waitForDeployment } from "../gates/index.js";
-import { readDevVars } from "../project.js";
 const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
 function walk(dir, base = dir) {
     const out = [];
@@ -82,32 +84,77 @@ function printProbe(url, probes) {
     for (const f of probes.findings)
         log.info(`    ${f.severity === "block" ? "✗" : "!"} ${f.rule_id}: ${f.risk}`);
 }
-export async function deploy(opts) {
-    const root = findProjectRoot();
-    const nerd = readNerdJson(root);
-    const api = ApiClient.fromConfig();
-    const knownSecrets = knownSecretsFrom(readDevVars(root));
-    // Every deploy runs every gate. There is no flag to skip them: suppressions need a person's approval in the dashboard.
-    const remote = await runChecks(root, { remote: true, typecheck: false });
-    if (!remote.ok) {
-        for (const p of remote.problems)
-            log.warn(p);
-        throw new CliError("Fix the problems above, then deploy again.", 2);
+/** True when `sha` is a commit in the repository at `root`, so this copy descends from it. */
+function hasCommit(root, sha) {
+    if (!/^[0-9a-f]{7,64}$/.test(sha) || !existsSync(path.join(root, ".git")))
+        return false;
+    try {
+        execFileSync("git", ["cat-file", "-e", `${sha}^{commit}`], { cwd: root, stdio: "ignore", windowsHide: true });
+        return true;
     }
-    const { approvedSuppressions } = await import("./verify.js");
-    const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
-    if (!gates.ok)
-        throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
-    log.ok(gateSummary(gates.results));
-    if (!opts["skip-build"]) {
-        log.step("Building with vite");
-        ensureDeps(root);
-        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
+    catch {
+        return false;
+    }
+}
+/**
+ * The lineage guard: the live app must come from this copy of the code, or the person must say so.
+ * A live production deployment with a snapshot this folder never deployed, saved, or pulled (and whose
+ * commit this folder's git history does not hold) stops the deploy and points at `nerd pull`.
+ */
+export async function checkLineage(root, nerd, api, force) {
+    const list = await api.get(projectPath(nerd, "/deployments?limit=100"));
+    const live = list.deployments.find((d) => d.environment === "production" && d.status === "live") ?? null;
+    if (!live)
+        return { live, passed: "no-live-deployment" };
+    if (!live.sourceId)
+        return { live, passed: "no-source" };
+    if (readLineage(root).includes(live.sourceId))
+        return { live, passed: "known-id" };
+    if (live.commitSha && hasCommit(root, live.commitSha))
+        return { live, passed: "same-commit" };
+    if (force)
+        return { live, passed: "forced" };
+    const date = live.createdAt.slice(0, 10);
+    throw new CliError(`The live app was deployed from another copy of the code on ${date}. Run \`nerd pull\` to work from that copy, or \`nerd deploy --force\` to replace it with this one.`, 2, { code: "lineage" });
+}
+const CHECKS_MAX = 30;
+/** The gate results the deploy reports with the row, the shape builds use, capped the way the API caps them. */
+export function checksMetadata(results) {
+    return {
+        reportedBy: "cli",
+        cli: cliVersion(),
+        results: results.slice(0, CHECKS_MAX).map((r) => ({ ...r, findings: r.findings.slice(0, CHECKS_MAX) })),
+    };
+}
+/**
+ * Everything after the gates, in the order the contract fixes: lineage guard, snapshot (pack and
+ * upload), migrations, the deploy itself with the snapshot id and the gate results, then the probe.
+ * An upload that fails for any reason but the folder's own size stops here with nothing deployed.
+ */
+export async function shipBuild(args) {
+    const { root, nerd, api, build, opts } = args;
+    const lineage = await checkLineage(root, nerd, api, Boolean(opts.force));
+    log.step("Saving a copy of the code with this deploy");
+    const pack = await packProject(root);
+    for (const w of pack.warnings)
+        log.warn(w);
+    let source = null;
+    let sourceSkipped = null;
+    if (pack.tooLarge) {
+        sourceSkipped = pack.tooLarge.message.replace(/^Code not saved: /, "").slice(0, 300);
+        log.warn(pack.tooLarge.message);
+    }
+    else {
+        try {
+            source = await uploadSnapshot(api, projectPath(nerd), pack, "deploy");
+        }
+        catch (err) {
+            throw new CliError(uploadStopMessage(err), 1, { code: err instanceof CliError ? err.code : "upload_failed", status: err instanceof CliError ? err.status : undefined });
+        }
+        appendLineage(root, source.id);
+        // "Stored", not "saved": the one line that says "saved" is the final one, which also says the work after it is only on this computer (invariant 7).
+        log.ok(`Stored ${pack.fileCount} files (${formatMb(pack.bytes)}) as ${source.id}`);
     }
-    const build = readBuildOutput(root);
-    const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
-    if (!built.ok)
-        throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
     log.step("Applying migrations to the production database");
     const mig = await applyRemoteMigrations(root, api);
     if (mig.applied.length)
@@ -121,6 +168,9 @@ export async function deploy(opts) {
         ...(build.compatibilityDate ? { compatibilityDate: build.compatibilityDate } : {}),
         compatibilityFlags: build.compatibilityFlags,
         ...(opts.note ? { note: opts.note } : {}),
+        ...(source ? { sourceId: source.id } : {}),
+        ...(sourceSkipped ? { sourceSkipped } : {}),
+        checks: checksMetadata(args.results),
     }));
     for (const m of build.modules) {
         form.append(`module:${m}`, new Blob([readFileSync(path.join(build.workerDir, m))]), m);
@@ -134,15 +184,57 @@ export async function deploy(opts) {
     if (!opts["skip-probe"] && deployment.status === "live")
         log.step(`Probing ${project.url}`);
     const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
+    return { deployment, url: project.url, migrations: mig, probes, source, sourceSkipped, lineage, warnings: pack.warnings };
+}
+/** The one line about the code after a live deploy, keyed on what the API recorded, not on what we sent. */
+export function sourceLine(r) {
+    if (r.deployment.sourceId)
+        return `Code saved with this deploy: ${r.source?.fileCount ?? "the folder's"} files. ${LOCAL_ONLY_NOTE}`;
+    const reason = r.deployment.sourceSkippedReason ?? r.sourceSkipped ?? "the platform did not record a copy; update nerd with npm install -g nerdsystem@latest and deploy again";
+    return `Code NOT saved: ${reason.replace(/\.$/, "")}.`;
+}
+export async function deploy(opts) {
+    const root = findProjectRoot();
+    const nerd = readNerdJson(root);
+    const api = ApiClient.fromConfig();
+    const knownSecrets = knownSecretsFrom(readDevVars(root));
+    // Every deploy runs every gate. There is no flag to skip them: suppressions need a person's approval in the dashboard.
+    const remote = await runChecks(root, { remote: true, typecheck: false });
+    if (!remote.ok) {
+        for (const p of remote.problems)
+            log.warn(p);
+        throw new CliError("Fix the problems above, then deploy again.", 2);
+    }
+    const { approvedSuppressions } = await import("./verify.js");
+    const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!gates.ok)
+        throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
+    log.ok(gateSummary(gates.results));
+    if (!opts["skip-build"]) {
+        log.step("Building with vite");
+        ensureDeps(root);
+        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
+    }
+    const build = readBuildOutput(root);
+    const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!built.ok)
+        throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
+    const r = await shipBuild({ root, nerd, api, build, results: [...gates.results, ...built.results], opts });
     if (opts.json)
-        return printJson({ deployment, url: project.url, migrations: mig, probes });
-    printProbe(project.url, probes);
-    log.info(`First time? Sign up on your app at ${project.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
+        return printJson({ deployment: r.deployment, url: r.url, migrations: r.migrations, probes: r.probes, source: r.source, sourceSkipped: r.sourceSkipped, lineage: r.lineage.passed, warnings: r.warnings });
+    printProbe(r.url, r.probes);
+    if (r.deployment.status === "live") {
+        if (r.deployment.sourceId)
+            log.ok(sourceLine(r));
+        else
+            log.warn(sourceLine(r));
+    }
+    log.info(`First time? Sign up on your app at ${r.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
 }
 export async function deployments(opts) {
     const nerd = readNerdJson(findProjectRoot());
     const r = await ApiClient.fromConfig().get(projectPath(nerd, `/deployments?limit=${Number(opts.limit) || 10}`));
     if (opts.json)
         return printJson(r);
-    table(r.deployments.map((d) => ({ id: d.id, status: d.status, modules: d.moduleCount, assets: d.assetCount, kb: Math.round(d.bundleBytes / 1024), created: d.createdAt, error: d.error ?? "" })), ["id", "status", "modules", "assets", "kb", "created", "error"]);
+    table(r.deployments.map((d) => ({ id: d.id, status: d.status, code: d.sourceId ? "saved" : d.sourceSkippedReason ? "not saved" : "older nerd", modules: d.moduleCount, assets: d.assetCount, kb: Math.round(d.bundleBytes / 1024), created: d.createdAt, error: d.error ?? "" })), ["id", "status", "code", "modules", "assets", "kb", "created", "error"]);
 }

package/dist/commands/dev.js

@@ -3,6 +3,7 @@ import path from "node:path";
 import { ApiClient } from "../api.js";
 import { findProjectRoot, projectPath, readDevVars, readNerdJson, writeDevVars } from "../project.js";
 import { log, run, runOrThrow, ensureDeps } from "../util.js";
+import { silentSave } from "./save.js";
 /** Makes sure .dev.vars carries the platform bindings for local dev, minting a dev tenant secret once. */
 export async function ensureDevVars(root) {
     const nerd = readNerdJson(root);
@@ -28,6 +29,9 @@ export async function ensureDevVars(root) {
 export async function dev(extra) {
     const root = findProjectRoot();
     await ensureDevVars(root);
+    // A copy of the code goes to nerdsystem on every start, so a lost laptop never loses the app.
+    // Silent when nothing changed; a warning, never a stop, when it does not go through.
+    await silentSave(root);
     if (existsSync(path.join(root, "migrations"))) {
         log.step("Applying migrations to the local database");
         await runOrThrow("npx", ["wrangler", "d1", "migrations", "apply", "DB", "--local"], { cwd: root });

package/dist/commands/doctor.d.ts

@@ -1,3 +1,7 @@
+/** The template's Vite needs Node 22.12 or newer (its engines field: ^20.19.0 || >=22.12.0); the CLI asks for 22, so 22.12 is the floor. */
+export declare const NODE_FLOOR = "22.12";
+/** Whether a Node version string ("22.11.0") meets the floor; a 22.0-22.11 machine only failed at `nerd deploy` before. */
+export declare function nodeMeetsFloor(version: string, floor?: string): boolean;
 /** Checks the machine, not the app: the things that stop a newcomer before the first deploy. */
 export declare function doctor(opts: {
     json: boolean;

package/dist/commands/doctor.js

@@ -3,11 +3,18 @@ import { exec, hasTool } from "../gates/code.js";
 import { loadConfig } from "../config.js";
 import { findProjectRoot } from "../project.js";
 import { log, printJson } from "../util.js";
+/** The template's Vite needs Node 22.12 or newer (its engines field: ^20.19.0 || >=22.12.0); the CLI asks for 22, so 22.12 is the floor. */
+export const NODE_FLOOR = "22.12";
+/** Whether a Node version string ("22.11.0") meets the floor; a 22.0-22.11 machine only failed at `nerd deploy` before. */
+export function nodeMeetsFloor(version, floor = NODE_FLOOR) {
+    const [major = 0, minor = 0] = version.split(".").map(Number);
+    const [fMajor = 0, fMinor = 0] = floor.split(".").map(Number);
+    return major > fMajor || (major === fMajor && minor >= fMinor);
+}
 /** Checks the machine, not the app: the things that stop a newcomer before the first deploy. */
 export async function doctor(opts) {
     const checks = [];
-    const nodeMajor = Number(process.versions.node.split(".")[0]);
-    checks.push({ name: "Node.js 22+", ok: nodeMajor >= 22, detail: `v${process.versions.node}`, fix: "Install Node 22 from https://nodejs.org or with your version manager." });
+    checks.push({ name: `Node.js ${NODE_FLOOR}+`, ok: nodeMeetsFloor(process.versions.node), detail: `v${process.versions.node}`, fix: `Install Node ${NODE_FLOOR} or newer from https://nodejs.org` });
     for (const [tool, fix] of [["pnpm", "npm install -g pnpm"], ["git", "Install git from https://git-scm.com"]]) {
         const r = await exec(tool, ["--version"], process.cwd());
         checks.push({ name: tool, ok: r.code === 0, detail: r.code === 0 ? r.stdout.trim().split("\n")[0] ?? "" : "not found", fix });

package/dist/commands/init.d.ts

@@ -6,10 +6,17 @@ export declare function linkProject(root: string, args: {
     name: string;
     create: boolean;
 }): Promise<Project>;
+/**
+ * A repository from the first minute: deploy-on-push and the agent's commits both expect one. Skipped
+ * silently when git is missing, and when the folder already sits inside a repository. `nerd pull`
+ * uses it too, with its own commit message.
+ */
+export declare function initGitRepo(root: string, message?: string): void;
 export declare function init(dir: string | undefined, args: {
     org?: string;
     name?: string;
     slug?: string;
     describe?: string;
     "no-create": boolean;
+    json?: boolean;
 }): Promise<void>;