nerdsystem 0.0.5 → 0.0.7

package/dist/gates/text.js

@@ -19,13 +19,34 @@ export const SECRET_PATTERNS = [
     { rule: "private-key", re: /-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY( BLOCK)?-----/g },
     { rule: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
     { rule: "nerdsystem-token", re: /\bn(sk|as|bt|rt|ss|pr|iv)_[a-z0-9]{40}\b/g },
-    { rule: "db-url-with-password", re: /\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis):\/\/[^:\s/]+:[^@\s/]{4,}@/g },
+    { rule: "db-url-with-password", re: /\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis):\/\/[^:\s/]+:[^@\s/]{4,}@[^/\s:?"'`]+/g },
     { rule: "generic-assignment", re: /\b(api[_-]?key|secret|password|passwd|token|client[_-]?secret)\b\s*[:=]\s*["'`]([A-Za-z0-9+/_=.-]{24,})["'`]/gi },
 ];
 const ALLOW = [/example/i, /placeholder/i, /your[-_ ]?key/i, /xxxx/i, /\$\{/, /process\.env/, /c\.env\./, /import\.meta\.env/, /nsk_\.\.\./];
 export function isAllowedLine(line) {
     return ALLOW.some((a) => a.test(line));
 }
+/** Files that exist to show the shape of a secret, not to hold one. Findings in them warn instead of block. */
+export const EXAMPLE_FILE = /(\.(example|sample|template)|(^|\/)\.env\.(example|sample))$/i;
+export function isExampleFile(file) {
+    return EXAMPLE_FILE.test(file);
+}
+/** Passwords nobody would use for real: the defaults every tutorial and docker-compose file carries. */
+const PLACEHOLDER_PASSWORDS = new Set(["root", "password", "pass", "secret", "changeme", "example", "test", "your-password", "your_password", "yourpassword", "postgres", "mysql", "admin"]);
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]", "0.0.0.0", "host.docker.internal"]);
+const PLACEHOLDER_VALUE = /xxx|your[_-]|example|changeme|placeholder|<|>|\.\.\./i;
+/** True when a matched credential is clearly a stand-in: a placeholder token, or a database URL with a default password or a local host. */
+export function isPlaceholderValue(rule, value) {
+    if (rule === "db-url-with-password") {
+        const m = /:\/\/([^:]+):([^@]+)@([^/\s:?"'`]+)/.exec(value);
+        if (!m)
+            return false;
+        const password = m[2].toLowerCase();
+        const host = m[3].toLowerCase();
+        return PLACEHOLDER_PASSWORDS.has(password) || LOCAL_HOSTS.has(host) || PLACEHOLDER_VALUE.test(password);
+    }
+    return PLACEHOLDER_VALUE.test(value);
+}
 /** Type and last four characters only: "sk_live_****4f2a". Never the value. */
 export function mask(match) {
     const compact = match.replace(/\s+/g, "");
@@ -55,7 +76,8 @@ export function findSecrets(text, file, limit = 50) {
                 continue;
             hitLines.add(line);
             const matched = p.rule === "generic-assignment" ? (m[2] ?? m[0]) : m[0];
-            hits.push({ rule: p.rule, file, line, masked: p.rule === "private-key" ? "private key" : mask(matched) });
+            const downgrade = isExampleFile(file) ? "example file" : p.rule !== "private-key" && isPlaceholderValue(p.rule, matched) ? "placeholder value" : undefined;
+            hits.push({ rule: p.rule, file, line, masked: p.rule === "private-key" ? "private key" : mask(matched), ...(downgrade ? { downgrade } : {}) });
             if (hits.length >= limit)
                 return hits;
         }
@@ -70,3 +92,61 @@ export const ENV_FILES = /(^|\/)(\.env(\.[A-Za-z0-9_-]+)?|\.dev\.vars(\.[A-Za-z0
 /** Source files worth scanning for text patterns; everything else is skipped as binary or generated. */
 export const TEXT_FILE = /(\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|toml|yaml|yml|env|vars|md|html|css|sql|py|rb|go|rs|java|kt|swift|php|sh|txt|cfg|ini|conf|xml)|(^|\/)(README|LICENSE|Dockerfile|Makefile|Procfile|\.gitignore|\.npmrc))$/i;
 export const SKIP_DIR = /(^|\/)(node_modules|dist|build|\.git|\.wrangler|\.next|\.nuxt|coverage|vendor|target)(\/|$)/;
+export function normalizeSeverity(raw) {
+    const s = (raw ?? "").trim().toLowerCase();
+    if (s === "critical")
+        return "critical";
+    if (s === "high")
+        return "high";
+    if (s === "moderate" || s === "medium")
+        return "moderate";
+    if (s === "low" || s === "info" || s === "informational")
+        return "low";
+    return "unknown";
+}
+/**
+ * Severity of one OSV record: `database_specific.severity` (what GHSA publishes: CRITICAL, HIGH,
+ * MODERATE, LOW), else any `affected[].ecosystem_specific.severity`, else the CVSS 3.x base score
+ * computed from the vector in `severity[]`. The OSV batch query (`/v1/querybatch`) returns only ids;
+ * fetch `/v1/vulns/{id}` to get these fields.
+ */
+export function osvSeverity(v) {
+    const direct = normalizeSeverity(v.database_specific?.severity);
+    if (direct !== "unknown")
+        return direct;
+    for (const a of v.affected ?? []) {
+        const s = normalizeSeverity(a.ecosystem_specific?.severity);
+        if (s !== "unknown")
+            return s;
+    }
+    for (const s of v.severity ?? []) {
+        if (/^CVSS_V3/i.test(s.type ?? "") && s.score) {
+            const score = cvss3BaseScore(s.score);
+            if (score !== null)
+                return score >= 9 ? "critical" : score >= 7 ? "high" : score >= 4 ? "moderate" : score > 0 ? "low" : "unknown";
+        }
+    }
+    return "unknown";
+}
+/** CVSS v3.0/3.1 base score from a vector string, or null when the vector is malformed. */
+export function cvss3BaseScore(vector) {
+    const parts = Object.fromEntries(vector.split("/").slice(1).map((kv) => kv.split(":")));
+    const AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 }[parts.AV ?? ""];
+    const AC = { L: 0.77, H: 0.44 }[parts.AC ?? ""];
+    const UI = { N: 0.85, R: 0.62 }[parts.UI ?? ""];
+    const CIA = { H: 0.56, L: 0.22, N: 0 };
+    const C = CIA[(parts.C ?? "")];
+    const I = CIA[(parts.I ?? "")];
+    const A = CIA[(parts.A ?? "")];
+    const scopeChanged = parts.S === "C";
+    const PR = scopeChanged ? { N: 0.85, L: 0.68, H: 0.5 }[parts.PR ?? ""] : { N: 0.85, L: 0.62, H: 0.27 }[parts.PR ?? ""];
+    if ([AV, AC, UI, C, I, A, PR].some((x) => x === undefined) || (parts.S !== "C" && parts.S !== "U"))
+        return null;
+    const iss = 1 - (1 - C) * (1 - I) * (1 - A);
+    const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
+    const exploitability = 8.22 * AV * AC * PR * UI;
+    if (impact <= 0)
+        return 0;
+    const roundUp = (x) => Math.ceil(x * 10 - 1e-9) / 10;
+    return scopeChanged ? roundUp(Math.min(1.08 * (impact + exploitability), 10)) : roundUp(Math.min(impact + exploitability, 10));
+}

package/dist/gates/types.d.ts

@@ -70,3 +70,15 @@ export declare function result(gate: Gate, status: GateStatus, summary: string,
 /** Status from findings: any block = fail, any warn = warn, else pass. */
 export declare function verdict(findings: Finding[]): GateStatus;
 export declare function counts(findings: Finding[]): string;
+export interface SkippedGate {
+    name: string;
+    title: string;
+    reason: string;
+}
+/** Gates that did not run this time (a scanner is not installed, no build output), so "passed" is never claimed for them. */
+export declare function skippedGates(results: GateResult[]): SkippedGate[];
+/**
+ * One honest line: "7 gates passed, 2 skipped (semgrep, gitleaks not installed; install them or deploy from git so the builder runs them)".
+ * Never "All gates passed" when something did not run.
+ */
+export declare function gateSummary(results: GateResult[]): string;

package/dist/gates/types.js

@@ -16,3 +16,21 @@ export function counts(findings) {
         return "No findings";
     return [b ? `${b} blocking` : "", w ? `${w} advisory` : "", findings.length - b - w ? `${findings.length - b - w} informational` : ""].filter(Boolean).join(", ");
 }
+/** Gates that did not run this time (a scanner is not installed, no build output), so "passed" is never claimed for them. */
+export function skippedGates(results) {
+    return results.filter((r) => r.status === "skip").map((r) => ({ name: r.name, title: r.title, reason: r.summary }));
+}
+/**
+ * One honest line: "7 gates passed, 2 skipped (semgrep, gitleaks not installed; install them or deploy from git so the builder runs them)".
+ * Never "All gates passed" when something did not run.
+ */
+export function gateSummary(results) {
+    const skipped = skippedGates(results);
+    const passed = results.filter((r) => r.status === "pass" || r.status === "warn").length;
+    if (!skipped.length)
+        return `All ${passed} gates passed`;
+    const tools = skipped.filter((s) => /not installed/.test(s.reason)).map((s) => s.name);
+    const other = skipped.filter((s) => !/not installed/.test(s.reason)).map((s) => `${s.name}: ${s.reason}`);
+    const why = [tools.length ? `${tools.join(", ")} not installed; install them or deploy from git so the builder runs them` : "", ...other].filter(Boolean).join("; ");
+    return `${passed} gate${passed === 1 ? "" : "s"} passed, ${skipped.length} skipped (${why})`;
+}

package/dist/index.js

@@ -1,268 +1,3 @@
 #!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { authConfig, authSecret } from "./commands/auth.js";
-import { check } from "./commands/check.js";
-import { dbMigrate, dbMigrations, dbQuery } from "./commands/db.js";
-import { deploy, deployments } from "./commands/deploy.js";
-import { dev } from "./commands/dev.js";
-import { doctor } from "./commands/doctor.js";
-import { cron, health, rollback, secretList, secretRemove, secretSet, transfer, waitlist } from "./commands/ops.js";
-import { verify } from "./commands/verify.js";
-import { agentsSync } from "./commands/agents.js";
-import { billingPortal, billingShow, billingUpgrade } from "./commands/billing.js";
-import { auditExport, clientsCreate, clientsList, clientsRelease, domainsAdd, domainsList, domainsRemove, logs, membersInvite, membersList, membersRemove } from "./commands/org.js";
-import { buildsList, buildsShow, buildsTrigger } from "./commands/builds.js";
-import { githubConnect, githubLink, githubStatus, githubUnlink } from "./commands/github.js";
-import { init, linkProject } from "./commands/init.js";
-import { login, whoami } from "./commands/login.js";
-import { findProjectRoot } from "./project.js";
-import { CliError, log } from "./util.js";
-const HELP = `nerd — deploy apps to nerdsystem
-
-  nerd login [--email you@x.com]      Sign in: prints a link to approve in the browser (or --token nsk_...)
-  nerd whoami                         Show the current user and orgs
-  nerd doctor                         Check Node, pnpm, git, login, and the project
-  nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
-  nerd link --slug <project> [--org]  Link this directory to an existing or new project
-  nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
-  nerd check                          Verify platform rules and typecheck
-  nerd verify [--no-build] [--rule id] [--json]   Run the security gates; --json gives failures the agent can fix
-  nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
-  nerd rollback [deploymentId]        Re-publish the previous production bundle
-  nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
-  nerd transfer <org>                 Move this project to another org you administer
-  nerd health                         Platform component health (operators)
-  nerd waitlist [approve <id>]        Who is waiting for access while sign-up is invite-only (operators)
-  nerd deployments                    List recent deployments
-  nerd db query "<sql>"               Run SQL on the production database
-  nerd db migrate                     Apply pending migrations to production
-  nerd db migrations                  List applied migrations
-  nerd auth config [--roles a,b] [--default-role r] [--signup on|off]
-  nerd auth secret                    Mint a dev tenant secret into .dev.vars
-  nerd secret set NAME [value]        App secret for production (c.env.NAME); value from stdin when omitted
-  nerd secret list | rm NAME          Names only; values are never shown
-  nerd github connect                 Install the GitHub App for this org (prints a link)
-  nerd github link owner/repo [--branch main] [--root-dir dir] [--no-previews] [--require-pr]
-  nerd github status | unlink
-  nerd builds [--limit n]             List git-triggered builds
-  nerd builds show <id>               Build details and log
-  nerd builds trigger [--branch b] [--commit sha]
-  nerd agents sync                    Regenerate AGENTS.md, Cursor, Copilot, Gemini files from the skill
-  nerd billing [--org slug]           Plan, limits, and usage for the org
-  nerd billing upgrade --plan pro|studio [--annual]   Start checkout
-  nerd billing portal                 Manage cards, invoices, and plan
-  nerd members [invite <email> --role r | remove <userId>]   Org members and invitations
-  nerd clients [create <slug> --name n | release <slug>]     Studio: one org per client, billed through yours
-  nerd domains [add <hostname> | remove <id>]                Custom domains for this project
-  nerd logs [--since 30m] [--limit 100] [--q text] [--pr n]  Logs from the deployed app
-  nerd audit [--out file.csv]         Export deployments and builds (Studio)
-
-Every command accepts --json for machine-readable output.`;
-const BOOL = { type: "boolean", default: false };
-const STR = { type: "string" };
-async function main(argv) {
-    const [cmd, ...rest] = argv;
-    if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
-        console.log(HELP);
-        return;
-    }
-    const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
-    switch (cmd) {
-        case "login": {
-            const { values } = parse({ token: STR, "api-url": STR, email: STR });
-            return login(values);
-        }
-        case "doctor": {
-            const { values } = parse({});
-            return doctor({ json: Boolean(values.json) });
-        }
-        case "whoami": {
-            const { values } = parse({});
-            return whoami({ json: Boolean(values.json) });
-        }
-        case "init": {
-            const { values, positionals } = parse({ org: STR, name: STR, slug: STR, describe: STR, "no-create": BOOL });
-            return init(positionals[0], values);
-        }
-        case "link": {
-            const { values } = parse({ org: STR, slug: STR, name: STR, "no-create": BOOL });
-            if (!values.slug)
-                throw new CliError("Usage: nerd link --slug <project> [--org <org>] [--name 'My App']");
-            const root = (() => {
-                try {
-                    return findProjectRoot();
-                }
-                catch {
-                    return process.cwd();
-                }
-            })();
-            await linkProject(root, { ...(values.org ? { org: values.org } : {}), slug: values.slug, name: values.name ?? values.slug, create: !values["no-create"] });
-            return;
-        }
-        case "dev":
-            return dev(rest);
-        case "check": {
-            const { values } = parse({ "no-typecheck": BOOL, "no-remote": BOOL });
-            return check(values);
-        }
-        case "verify": {
-            const { values } = parse({ "no-build": BOOL, rule: STR });
-            return verify({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), ...(values.rule ? { rule: values.rule } : {}) });
-        }
-        case "deploy": {
-            const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
-            return deploy(values);
-        }
-        case "rollback": {
-            const { values, positionals } = parse({ note: STR });
-            return rollback(positionals[0], { json: Boolean(values.json), ...(values.note ? { note: values.note } : {}) });
-        }
-        case "cron": {
-            const { values, positionals } = parse({});
-            return cron(positionals[0], { json: Boolean(values.json) });
-        }
-        case "transfer": {
-            const { values, positionals } = parse({});
-            return transfer(positionals[0], { json: Boolean(values.json) });
-        }
-        case "health": {
-            const { values } = parse({});
-            return health({ json: Boolean(values.json) });
-        }
-        case "waitlist": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: sub === "approve" ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
-            return waitlist({ json: Boolean(values.json), ...(sub === "approve" ? { approve: positionals[0] } : {}) });
-        }
-        case "deployments": {
-            const { values } = parse({ limit: { type: "string", default: "10" } });
-            return deployments(values);
-        }
-        case "db": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
-            if (sub === "query")
-                return dbQuery(positionals[0], { json: Boolean(values.json) });
-            if (sub === "migrate")
-                return dbMigrate({ json: Boolean(values.json) });
-            if (sub === "migrations")
-                return dbMigrations({ json: Boolean(values.json) });
-            throw new CliError("Usage: nerd db query|migrate|migrations");
-        }
-        case "auth": {
-            const [sub, ...subRest] = rest;
-            const { values } = parseArgs({ args: subRest, options: { json: BOOL, roles: STR, "default-role": STR, signup: STR }, allowPositionals: false });
-            if (sub === "config")
-                return authConfig(values);
-            if (sub === "secret")
-                return authSecret();
-            throw new CliError("Usage: nerd auth config|secret");
-        }
-        case "billing": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "upgrade" || sub === "portal" || sub === "show";
-            const { values } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, plan: STR, annual: BOOL }, allowPositionals: false });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "upgrade")
-                return billingUpgrade({ ...o, ...(values.plan ? { plan: values.plan } : {}), annual: Boolean(values.annual) });
-            if (sub === "portal")
-                return billingPortal(o);
-            return billingShow(o);
-        }
-        case "members": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "invite" || sub === "remove" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, role: STR }, allowPositionals: true });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "invite")
-                return membersInvite(positionals[0], { ...o, ...(values.role ? { role: values.role } : {}) });
-            if (sub === "remove")
-                return membersRemove(positionals[0], o);
-            return membersList(o);
-        }
-        case "clients": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "create" || sub === "release" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, name: STR }, allowPositionals: true });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "create")
-                return clientsCreate(positionals[0], { ...o, ...(values.name ? { name: values.name } : {}) });
-            if (sub === "release")
-                return clientsRelease(positionals[0], o);
-            return clientsList(o);
-        }
-        case "secret": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "set")
-                return secretSet(positionals[0], positionals[1], { json });
-            if (sub === "rm" || sub === "remove" || sub === "delete")
-                return secretRemove(positionals[0], { json });
-            if (sub === "list" || sub === "ls" || sub === undefined)
-                return secretList({ json });
-            throw new CliError("Usage: nerd secret set NAME [value] | list | rm NAME");
-        }
-        case "domains": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "add" || sub === "remove" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
-            const o = { json: Boolean(values.json) };
-            if (sub === "add")
-                return domainsAdd(positionals[0], o);
-            if (sub === "remove")
-                return domainsRemove(positionals[0], o);
-            return domainsList(o);
-        }
-        case "logs": {
-            const { values } = parse({ since: STR, limit: STR, q: STR, pr: STR });
-            return logs({ json: Boolean(values.json), ...(values.since ? { since: values.since } : {}), ...(values.limit ? { limit: values.limit } : {}), ...(values.q ? { q: values.q } : {}), ...(values.pr ? { pr: values.pr } : {}) });
-        }
-        case "audit": {
-            const { values } = parse({ org: STR, out: STR });
-            return auditExport({ json: Boolean(values.json), ...(values.org ? { org: values.org } : {}), ...(values.out ? { out: values.out } : {}) });
-        }
-        case "agents": {
-            const [sub, ...subRest] = rest;
-            const { values } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: false });
-            if (sub === "sync")
-                return agentsSync({ json: Boolean(values.json) });
-            throw new CliError("Usage: nerd agents sync");
-        }
-        case "github": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, branch: STR, "root-dir": STR, "no-previews": BOOL, "require-pr": BOOL, installation: STR }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "connect")
-                return githubConnect({ json });
-            if (sub === "link")
-                return githubLink(positionals[0], { json, "no-previews": Boolean(values["no-previews"]), "require-pr": Boolean(values["require-pr"]), ...(values.branch ? { branch: values.branch } : {}), ...(values["root-dir"] ? { "root-dir": values["root-dir"] } : {}), ...(values.installation ? { installation: values.installation } : {}) });
-            if (sub === "unlink")
-                return githubUnlink({ json });
-            if (sub === "status" || sub === undefined)
-                return githubStatus({ json });
-            throw new CliError("Usage: nerd github connect|link|unlink|status");
-        }
-        case "builds": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "show" || sub === "trigger" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, limit: { type: "string", default: "10" }, branch: STR, commit: STR }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "show")
-                return buildsShow(positionals[0], { json });
-            if (sub === "trigger")
-                return buildsTrigger({ json, ...(values.branch ? { branch: values.branch } : {}), ...(values.commit ? { commit: values.commit } : {}) });
-            return buildsList({ json, limit: values.limit });
-        }
-        default:
-            throw new CliError(`Unknown command "${cmd}". Run \`nerd help\`.`);
-    }
-}
-main(process.argv.slice(2)).catch((err) => {
-    if (err instanceof CliError) {
-        log.warn(err.message);
-        process.exit(err.exitCode);
-    }
-    console.error(err);
-    process.exit(1);
-});
+import { runCli } from "./cli.js";
+await runCli(process.argv.slice(2));

package/dist/util.d.ts

@@ -1,7 +1,16 @@
 export declare class CliError extends Error {
     readonly exitCode: number;
-    constructor(message: string, exitCode?: number);
+    /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
+    readonly code: string | undefined;
+    /** The HTTP status when the error came from a response. */
+    readonly status: number | undefined;
+    constructor(message: string, exitCode?: number, extra?: {
+        code?: string | undefined;
+        status?: number | undefined;
+    });
 }
+/** The one sentence every unauthenticated command prints, with both ways in. */
+export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
 export declare const log: {
     info: (msg: string) => void;
     step: (msg: string) => void;
@@ -19,3 +28,7 @@ export declare function runOrThrow(cmd: string, args: string[], opts?: {
 }): Promise<void>;
 export declare function printJson(value: unknown): void;
 export declare function table(rows: Record<string, unknown>[], columns: string[]): void;
+/** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */
+export declare function dashboardUrl(apiUrl: string): string;
+/** Stops with one sentence instead of npx noise when `pnpm install` has not been run. */
+export declare function ensureDeps(root: string): void;

package/dist/util.js

@@ -1,11 +1,21 @@
 import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
 export class CliError extends Error {
     exitCode;
-    constructor(message, exitCode = 1) {
+    /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
+    code;
+    /** The HTTP status when the error came from a response. */
+    status;
+    constructor(message, exitCode = 1, extra = {}) {
         super(message);
         this.exitCode = exitCode;
+        this.code = extra.code;
+        this.status = extra.status;
     }
 }
+/** The one sentence every unauthenticated command prints, with both ways in. */
+export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
 export const log = {
     info: (msg) => console.error(`${msg}`),
     step: (msg) => console.error(`\x1b[36m›\x1b[0m ${msg}`),
@@ -37,3 +47,12 @@ export function table(rows, columns) {
     for (const r of rows)
         process.stdout.write(`${line(columns.map((c) => String(r[c] ?? "")))}\n`);
 }
+/** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */
+export function dashboardUrl(apiUrl) {
+    return apiUrl.replace(/\/$/, "").replace(/^https?:\/\/api\./, "https://");
+}
+/** Stops with one sentence instead of npx noise when `pnpm install` has not been run. */
+export function ensureDeps(root) {
+    if (!existsSync(path.join(root, "node_modules")))
+        throw new CliError(`Dependencies are not installed. Run \`pnpm install\` in ${root} first (install pnpm with \`npm install -g pnpm\` if it is missing).`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -15,7 +15,7 @@ If this project still has the template's todo app (the `todos` table and `src/se
 2. Say what you will build first, in plain words: the one table and the one screen that make the idea real. Keep the first feature small enough to deploy within the session.
 3. Replace the todo example with that feature: schema, migration (`pnpm db:generate`), a router under `/api/...`, and the client screen. The template is a normal website: a public homepage at `/`, auth pages at `/login`, `/signup`, `/forgot-password`, `/reset-password`, and a signed-in area. Reshape it to the idea (a public landing page with sign-in in the header, a members-only area, an admin section) rather than forcing a login wall; the forms already work.
 4. Run `nerd check`, then `nerd dev`, and tell the person to open the local URL, create an account, and try it. Fix what they report.
-5. Run `nerd deploy` and give them the live URL. Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd verify` any time.
+5. Run `nerd deploy` and give them the live URL. Tell them to sign up on their own app first, then make themselves admin in the dashboard's Auth tab (the URL is printed after the deploy). Explain in two lines that every deploy is checked for leaked secrets and vulnerable dependencies, and that they can run `nerd check` any time.
 6. Offer the next steps once, briefly: link the GitHub repo for previews on pull requests (`nerd github connect`), add a custom domain, or invite a teammate from the dashboard.
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
@@ -28,11 +28,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Previews share the production database and do not run migrations; a PR that changes the schema will only work in full after it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -82,6 +82,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -99,7 +100,9 @@ The loop: run `run_gates`, fix every failure with `audience: "agent"`, run `run_
 - `audience: "human"` means a person must act: a secret that was committed must be rotated at the provider before you remove it; an ignore comment, ignore file, or gate setting you added is a suppression that only a person can approve in the dashboard. Never add `nosemgrep`, `gitleaks:allow`, `nerd-ignore`, or a `gates` key in `nerd.json` to make a finding go away.
 - When `stop` is non-empty, the same rule has failed three runs in a row. Stop, summarize what you tried in plain words, and hand it to the person.
 
-Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rule <rule_id>` runs one rule. Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
+When a git build fails after a push, the same findings are posted back to the repository for you: as a comment on the pull request, or as a GitHub issue titled "nerdsystem refused <sha>" for a push to the production branch (`nerd builds show <id>` prints them too). Treat that text as the task: apply each fix, run the gates until clean, commit naming the rule ids, push. The issue closes itself when the next deploy succeeds. If the repository is linked with `--agent @claude` (or another handle), the post starts with that mention so a cloud agent is summoned without anyone pasting anything.
+
+Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule <rule_id>` runs one rule (`nerd verify` is the same command). Secrets are reported masked (`sk_live_****4f2a`); never print a credential yourself. Keep secrets in `.dev.vars` locally and in platform settings in production; never prefix a secret with `VITE_`, because those values are compiled into the public client bundle.
 
 ## What `nerd check` rejects
 
@@ -112,13 +115,17 @@ Without MCP, `nerd verify --json` returns the same shape, and `nerd verify --rul
 ## Scheduled jobs and email
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
-- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
+- **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
 - **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.