nerdsystem 0.0.28 → 0.0.29

package/dist/commands/deploy.d.ts

@@ -18,10 +18,22 @@ export interface BuildOutput {
  */
 export declare function dropLocalSecretCopies(build: BuildOutput): number;
 /**
- * The build's own output lists that copy ("Using secrets defined in .dev.vars", then the file among what
- * it wrote), which reads as if local secrets were about to be uploaded. Said once, right after the build.
+ * The build's own output names that copy twice ("Using secrets defined in .dev.vars", then the file among
+ * what it wrote), which reads as if local secrets were about to be uploaded. This sentence is printed in
+ * place of those lines, so the explanation is where the alarm would have been. True before and after the copy is deleted.
  */
-export declare const SECRET_COPY_NOTE = "The build tool listed a copy of your local secrets file (.dev.vars) in its output folder; it makes one for local previews. nerd has deleted that copy. It is never uploaded: the live app gets its secrets from `nerd secret set`.";
+export declare const SECRET_COPY_NOTE = "The build tool makes a copy of your local secrets file (.dev.vars) in its output folder, for local previews. nerd deletes that copy when the build ends and never uploads it: the live app gets its secrets from `nerd secret set`.";
+/**
+ * Every check of a deploy as one list, so its closing count is the one `nerd check` gives for the same
+ * code: the scan of the built output is in it, and a check that ran on the code and again on the built
+ * output (the policy's size limits) is one check, with the later answer.
+ */
+export declare function wholeRun(source: GateResult[], built: GateResult[]): GateResult[];
+/** For the build's output: the lines that name the local secrets file become the one sentence above, said once. */
+export declare function secretCopyLines(): {
+    line: (text: string) => string | null;
+    said: () => boolean;
+};
 export declare function readBuildOutput(root: string): BuildOutput;
 export declare function applyRemoteMigrations(root: string, api: ApiClient): Promise<{
     applied: string[];

package/dist/commands/deploy.js

@@ -43,10 +43,34 @@ export function dropLocalSecretCopies(build) {
     return dropped;
 }
 /**
- * The build's own output lists that copy ("Using secrets defined in .dev.vars", then the file among what
- * it wrote), which reads as if local secrets were about to be uploaded. Said once, right after the build.
+ * The build's own output names that copy twice ("Using secrets defined in .dev.vars", then the file among
+ * what it wrote), which reads as if local secrets were about to be uploaded. This sentence is printed in
+ * place of those lines, so the explanation is where the alarm would have been. True before and after the copy is deleted.
  */
-export const SECRET_COPY_NOTE = "The build tool listed a copy of your local secrets file (.dev.vars) in its output folder; it makes one for local previews. nerd has deleted that copy. It is never uploaded: the live app gets its secrets from `nerd secret set`.";
+export const SECRET_COPY_NOTE = "The build tool makes a copy of your local secrets file (.dev.vars) in its output folder, for local previews. nerd deletes that copy when the build ends and never uploads it: the live app gets its secrets from `nerd secret set`.";
+/**
+ * Every check of a deploy as one list, so its closing count is the one `nerd check` gives for the same
+ * code: the scan of the built output is in it, and a check that ran on the code and again on the built
+ * output (the policy's size limits) is one check, with the later answer.
+ */
+export function wholeRun(source, built) {
+    return [...source.filter((r) => !built.some((b) => b.name === r.name)), ...built];
+}
+/** For the build's output: the lines that name the local secrets file become the one sentence above, said once. */
+export function secretCopyLines() {
+    let said = false;
+    return {
+        line: (text) => {
+            if (!/\.dev\.vars\b/.test(text))
+                return text;
+            if (said)
+                return null;
+            said = true;
+            return SECRET_COPY_NOTE;
+        },
+        said: () => said,
+    };
+}
 export function readBuildOutput(root) {
     const dist = path.join(root, "dist");
     if (!existsSync(dist))
@@ -241,18 +265,20 @@ export async function deploy(opts) {
     const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
     if (!gates.ok)
         throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
-    log.ok(gateSummary(gates.results));
+    const secretCopy = secretCopyLines();
     if (!opts["skip-build"]) {
         log.step("Building with vite");
         ensureDeps(root);
-        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
+        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true, stdoutLine: secretCopy.line });
     }
     const build = readBuildOutput(root);
-    if (dropLocalSecretCopies(build))
+    // Said here only when the build's output did not carry it (a build made earlier, or a tool that words it differently).
+    if (dropLocalSecretCopies(build) && !secretCopy.said())
         log.info(SECRET_COPY_NOTE);
     const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
     if (!built.ok)
         throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
+    log.ok(gateSummary(wholeRun(gates.results, built.results)));
     const r = await shipBuild({ root, nerd, api, build, results: [...gates.results, ...built.results], opts });
     // The app is live at this point. The platform says what the review on file holds, and now and then reads the code itself.
     const reviewPage = `${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/review`;

package/dist/commands/init.js

@@ -192,4 +192,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.28";
+const SDK_VERSION = "0.0.29";

package/dist/util.d.ts

@@ -22,6 +22,11 @@ export interface RunOptions {
     env?: NodeJS.ProcessEnv;
     /** Send the child's stdout to our stderr, so stdout stays reserved for `--json` output. */
     stdoutToStderr?: boolean;
+    /**
+     * With `stdoutToStderr`: each line the child prints is passed through this first. Return the line to
+     * print it, another line to print that instead, or null to print nothing.
+     */
+    stdoutLine?: (line: string) => string | null;
 }
 /**
  * How a command is started. On Windows the tools an app uses (npx, pnpm) are `.cmd` files, which only

package/dist/util.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { createInterface } from "node:readline";
 export class CliError extends Error {
     exitCode;
     /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
@@ -40,9 +41,19 @@ export function run(cmd, args, opts = {}) {
     return new Promise((resolve, reject) => {
         const how = shellCommand(cmd, args);
         const child = spawn(how.file, how.args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: ["inherit", opts.stdoutToStderr ? "pipe" : "inherit", "inherit"], shell: how.shell });
-        child.stdout?.pipe(process.stderr);
+        const perLine = child.stdout && opts.stdoutLine ? opts.stdoutLine : null;
+        if (perLine) {
+            createInterface({ input: child.stdout }).on("line", (line) => {
+                const out = perLine(line);
+                if (out !== null)
+                    process.stderr.write(`${out}\n`);
+            });
+        }
+        else
+            child.stdout?.pipe(process.stderr);
         child.on("error", reject);
-        child.on("exit", (code) => resolve(code ?? 1));
+        // "close" comes after the child's output has ended, so every line has been through `stdoutLine` by then.
+        child.on(perLine ? "close" : "exit", (code) => resolve(code ?? 1));
     });
 }
 export async function runOrThrow(cmd, args, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.28",
+  "version": "0.0.29",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {