nerdsystem 0.0.28 → 0.0.30

package/dist/cli.js

@@ -25,7 +25,7 @@ import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
 const HELP = `nerd: start, check, and deploy a web app on nerdsystem
 
-  nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts)
+  nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts; --ref <code> records the partner who sent you)
   nerd whoami                         Show the current user and orgs
   nerd doctor                         Check Node, pnpm, git, login, and the project
   nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
@@ -100,7 +100,7 @@ export async function main(argv) {
     const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
     switch (cmd) {
         case "login": {
-            const { values } = parse({ token: STR, "api-url": STR, email: STR });
+            const { values } = parse({ token: STR, "api-url": STR, email: STR, ref: STR });
             return login(values);
         }
         case "doctor": {

package/dist/commands/deploy.d.ts

@@ -18,10 +18,22 @@ export interface BuildOutput {
  */
 export declare function dropLocalSecretCopies(build: BuildOutput): number;
 /**
- * The build's own output lists that copy ("Using secrets defined in .dev.vars", then the file among what
- * it wrote), which reads as if local secrets were about to be uploaded. Said once, right after the build.
+ * The build's own output names that copy twice ("Using secrets defined in .dev.vars", then the file among
+ * what it wrote), which reads as if local secrets were about to be uploaded. This sentence is printed in
+ * place of those lines, so the explanation is where the alarm would have been. True before and after the copy is deleted.
  */
-export declare const SECRET_COPY_NOTE = "The build tool listed a copy of your local secrets file (.dev.vars) in its output folder; it makes one for local previews. nerd has deleted that copy. It is never uploaded: the live app gets its secrets from `nerd secret set`.";
+export declare const SECRET_COPY_NOTE = "The build tool makes a copy of your local secrets file (.dev.vars) in its output folder, for local previews. nerd deletes that copy when the build ends and never uploads it: the live app gets its secrets from `nerd secret set`.";
+/**
+ * Every check of a deploy as one list, so its closing count is the one `nerd check` gives for the same
+ * code: the scan of the built output is in it, and a check that ran on the code and again on the built
+ * output (the policy's size limits) is one check, with the later answer.
+ */
+export declare function wholeRun(source: GateResult[], built: GateResult[]): GateResult[];
+/** For the build's output: the lines that name the local secrets file become the one sentence above, said once. */
+export declare function secretCopyLines(): {
+    line: (text: string) => string | null;
+    said: () => boolean;
+};
 export declare function readBuildOutput(root: string): BuildOutput;
 export declare function applyRemoteMigrations(root: string, api: ApiClient): Promise<{
     applied: string[];

package/dist/commands/deploy.js

@@ -43,10 +43,34 @@ export function dropLocalSecretCopies(build) {
     return dropped;
 }
 /**
- * The build's own output lists that copy ("Using secrets defined in .dev.vars", then the file among what
- * it wrote), which reads as if local secrets were about to be uploaded. Said once, right after the build.
+ * The build's own output names that copy twice ("Using secrets defined in .dev.vars", then the file among
+ * what it wrote), which reads as if local secrets were about to be uploaded. This sentence is printed in
+ * place of those lines, so the explanation is where the alarm would have been. True before and after the copy is deleted.
  */
-export const SECRET_COPY_NOTE = "The build tool listed a copy of your local secrets file (.dev.vars) in its output folder; it makes one for local previews. nerd has deleted that copy. It is never uploaded: the live app gets its secrets from `nerd secret set`.";
+export const SECRET_COPY_NOTE = "The build tool makes a copy of your local secrets file (.dev.vars) in its output folder, for local previews. nerd deletes that copy when the build ends and never uploads it: the live app gets its secrets from `nerd secret set`.";
+/**
+ * Every check of a deploy as one list, so its closing count is the one `nerd check` gives for the same
+ * code: the scan of the built output is in it, and a check that ran on the code and again on the built
+ * output (the policy's size limits) is one check, with the later answer.
+ */
+export function wholeRun(source, built) {
+    return [...source.filter((r) => !built.some((b) => b.name === r.name)), ...built];
+}
+/** For the build's output: the lines that name the local secrets file become the one sentence above, said once. */
+export function secretCopyLines() {
+    let said = false;
+    return {
+        line: (text) => {
+            if (!/\.dev\.vars\b/.test(text))
+                return text;
+            if (said)
+                return null;
+            said = true;
+            return SECRET_COPY_NOTE;
+        },
+        said: () => said,
+    };
+}
 export function readBuildOutput(root) {
     const dist = path.join(root, "dist");
     if (!existsSync(dist))
@@ -241,18 +265,20 @@ export async function deploy(opts) {
     const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
     if (!gates.ok)
         throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
-    log.ok(gateSummary(gates.results));
+    const secretCopy = secretCopyLines();
     if (!opts["skip-build"]) {
         log.step("Building with vite");
         ensureDeps(root);
-        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
+        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true, stdoutLine: secretCopy.line });
     }
     const build = readBuildOutput(root);
-    if (dropLocalSecretCopies(build))
+    // Said here only when the build's output did not carry it (a build made earlier, or a tool that words it differently).
+    if (dropLocalSecretCopies(build) && !secretCopy.said())
         log.info(SECRET_COPY_NOTE);
     const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
     if (!built.ok)
         throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
+    log.ok(gateSummary(wholeRun(gates.results, built.results)));
     const r = await shipBuild({ root, nerd, api, build, results: [...gates.results, ...built.results], opts });
     // The app is live at this point. The platform says what the review on file holds, and now and then reads the code itself.
     const reviewPage = `${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/review`;

package/dist/commands/init.js

@@ -192,4 +192,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.28";
+const SDK_VERSION = "0.0.30";

package/dist/commands/login.d.ts

@@ -3,14 +3,19 @@
  * dashboard (or from the email when --email is given), and the token arrives here. `--token` still
  * works for scripts. A pending login is remembered, so running `nerd login` again after approving
  * picks it up instead of starting over. `--email` with a different address than the pending login's
- * starts a fresh one, so a typo does not lock the person out until the code expires.
+ * starts a fresh one, so a typo does not lock the person out until the code expires. `--ref` is the code
+ * of the partner who sent the person: it is recorded on the account this sign-in creates, and a code that
+ * is not one is left out with a line saying so, because nobody should fail to sign in over it.
  */
 export declare function login(args: {
     token?: string;
     "api-url"?: string;
     email?: string;
+    ref?: string;
     json?: boolean;
 }): Promise<void>;
+/** The same shape the platform accepts (`lib/partners.ts` in the API); anything else is no code. */
+export declare function partnerRef(value: string | undefined): string | null;
 export declare function whoami(opts: {
     json: boolean;
 }): Promise<void>;

package/dist/commands/login.js

@@ -9,7 +9,9 @@ const WAIT_S = 90;
  * dashboard (or from the email when --email is given), and the token arrives here. `--token` still
  * works for scripts. A pending login is remembered, so running `nerd login` again after approving
  * picks it up instead of starting over. `--email` with a different address than the pending login's
- * starts a fresh one, so a typo does not lock the person out until the code expires.
+ * starts a fresh one, so a typo does not lock the person out until the code expires. `--ref` is the code
+ * of the partner who sent the person: it is recorded on the account this sign-in creates, and a code that
+ * is not one is left out with a line saying so, because nobody should fail to sign in over it.
  */
 export async function login(args) {
     const cfg = loadConfig();
@@ -25,7 +27,10 @@ export async function login(args) {
     let pending = resumable ? saved : undefined;
     if (!pending) {
         const client = `nerd CLI on ${os.hostname()} (${os.platform()})`;
-        const start = await anon.post("/session/device", { client, ...(email ? { email } : {}) });
+        const ref = partnerRef(args.ref);
+        if (args.ref && !ref && !args.json)
+            log.warn("Leaving out --ref: a partner's code is 2 to 32 lowercase letters, digits, or hyphens. Signing in works the same without it.");
+        const start = await anon.post("/session/device", { client, ...(email ? { email } : {}), ...(ref ? { ref } : {}) });
         pending = { apiUrl, deviceCode: start.deviceCode, userCode: start.userCode, verificationUrl: start.verificationUrl, interval: start.interval, expiresAt: Date.now() + start.expiresIn * 1000, ...(email ? { email } : {}) };
         saveConfig({ ...cfg, pendingLogin: pending });
         if (args.json)
@@ -70,6 +75,11 @@ export async function login(args) {
     else
         log.warn(msg);
 }
+/** The same shape the platform accepts (`lib/partners.ts` in the API); anything else is no code. */
+export function partnerRef(value) {
+    const v = value?.trim().toLowerCase() ?? "";
+    return /^[a-z0-9][a-z0-9-]{1,31}$/.test(v) ? v : null;
+}
 function clearPending() {
     const { pendingLogin: _drop, ...rest } = loadConfig();
     saveConfig(rest);

package/dist/gates/review.d.ts

@@ -1,3 +1,4 @@
+import { type ReviewDue } from "../commands/session-review.js";
 import { type Gate } from "./types.js";
 /**
  * Brings the review of this app into the same list as every other check, so an agent meets it in the
@@ -8,3 +9,9 @@ import { type Gate } from "./types.js";
  * Skipped without comment when there is no sign-in, no linked project, or no network.
  */
 export declare const reviewGate: Gate;
+/**
+ * The check's one line about the review. It says whether one is due and, when none is, why not: an agent
+ * that has just changed a build or config file cannot otherwise tell a review that was not needed from one
+ * that was forgotten.
+ */
+export declare function reviewSaid(open: number, when: string | undefined, due: ReviewDue | null): string;

package/dist/gates/review.js

@@ -35,18 +35,31 @@ export const reviewGate = {
             return { rule_id: i.rule_id, severity: i.severity, audience: i.audience, file, line: Number(line) || undefined, risk: i.risk, fix: i.fix, verify: "nerd review report (say what you fixed), then nerd deploy", attempt: 1, fingerprint: `${i.rule_id}:${i.where}` };
         });
         const open = findings.length;
-        let due = false;
-        let first = false;
+        let due = null;
         try {
-            ({ due, first } = reviewDue(ctx.root));
+            due = reviewDue(ctx.root);
         }
         catch {
             // a folder that cannot be listed has nothing to say here
         }
-        if (due)
+        if (due?.due)
             findings.push(finding("session/review-due", { verify: "nerd review report" }));
-        const when = got.reviewedAt ? localDay(got.reviewedAt) : undefined;
-        const said = [open ? `${open} open from the review of ${when}; a second opinion that can be wrong, so read the code first` : when ? `Nothing open from the review of ${when}` : "No review yet", ...(due ? [first ? "no review has been reported from this folder: run nerd review checklist" : "code has changed since the last review: run nerd review checklist"] : [])];
-        return result(this, verdict(findings), findings.length ? `${counts(findings)}: ${said.join("; ")}` : said.join("; "), findings, t);
+        const said = reviewSaid(open, got.reviewedAt ? localDay(got.reviewedAt) : undefined, due);
+        return result(this, verdict(findings), findings.length ? `${counts(findings)}: ${said}` : said, findings, t);
     },
 };
+/**
+ * The check's one line about the review. It says whether one is due and, when none is, why not: an agent
+ * that has just changed a build or config file cannot otherwise tell a review that was not needed from one
+ * that was forgotten.
+ */
+export function reviewSaid(open, when, due) {
+    const findings = open ? `${open} open from the review of ${when}; a second opinion that can be wrong, so read the code first` : when ? `Nothing open from the review of ${when}` : "No review yet";
+    if (!due)
+        return findings;
+    if (due.due)
+        return `${findings}; ${due.first ? "no review has been reported from this folder: run nerd review checklist" : "code has changed since the last review: run nerd review checklist"}`;
+    if (due.first)
+        return findings;
+    return `${findings}; no review is due: the app's code under src/ is as it was last reviewed here (build and config files, tests, styles, the README and package.json do not ask for one)`;
+}

package/dist/util.d.ts

@@ -22,6 +22,11 @@ export interface RunOptions {
     env?: NodeJS.ProcessEnv;
     /** Send the child's stdout to our stderr, so stdout stays reserved for `--json` output. */
     stdoutToStderr?: boolean;
+    /**
+     * With `stdoutToStderr`: each line the child prints is passed through this first. Return the line to
+     * print it, another line to print that instead, or null to print nothing.
+     */
+    stdoutLine?: (line: string) => string | null;
 }
 /**
  * How a command is started. On Windows the tools an app uses (npx, pnpm) are `.cmd` files, which only

package/dist/util.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import path from "node:path";
+import { createInterface } from "node:readline";
 export class CliError extends Error {
     exitCode;
     /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
@@ -40,9 +41,19 @@ export function run(cmd, args, opts = {}) {
     return new Promise((resolve, reject) => {
         const how = shellCommand(cmd, args);
         const child = spawn(how.file, how.args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: ["inherit", opts.stdoutToStderr ? "pipe" : "inherit", "inherit"], shell: how.shell });
-        child.stdout?.pipe(process.stderr);
+        const perLine = child.stdout && opts.stdoutLine ? opts.stdoutLine : null;
+        if (perLine) {
+            createInterface({ input: child.stdout }).on("line", (line) => {
+                const out = perLine(line);
+                if (out !== null)
+                    process.stderr.write(`${out}\n`);
+            });
+        }
+        else
+            child.stdout?.pipe(process.stderr);
         child.on("error", reject);
-        child.on("exit", (code) => resolve(code ?? 1));
+        // "close" comes after the child's output has ended, so every line has been through `stdoutLine` by then.
+        child.on(perLine ? "close" : "exit", (code) => resolve(code ?? 1));
     });
 }
 export async function runOrThrow(cmd, args, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.28",
+  "version": "0.0.30",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {