nerdsystem 0.0.6 → 0.0.7

package/dist/index.js

@@ -1,263 +1,3 @@
 #!/usr/bin/env node
-import { parseArgs } from "node:util";
-import { authConfig, authSecret } from "./commands/auth.js";
-import { check } from "./commands/check.js";
-import { dbMigrate, dbMigrations, dbQuery } from "./commands/db.js";
-import { deploy, deployments } from "./commands/deploy.js";
-import { dev } from "./commands/dev.js";
-import { doctor } from "./commands/doctor.js";
-import { cron, health, rollback, secretList, secretRemove, secretSet, transfer, waitlist } from "./commands/ops.js";
-import { agentsSync } from "./commands/agents.js";
-import { billingPortal, billingShow, billingUpgrade } from "./commands/billing.js";
-import { auditExport, clientsCreate, clientsList, clientsRelease, domainsAdd, domainsList, domainsRemove, logs, membersInvite, membersList, membersRemove } from "./commands/org.js";
-import { buildsList, buildsShow, buildsTrigger } from "./commands/builds.js";
-import { githubConnect, githubLink, githubStatus, githubUnlink } from "./commands/github.js";
-import { init, linkProject } from "./commands/init.js";
-import { login, whoami } from "./commands/login.js";
-import { findProjectRoot } from "./project.js";
-import { CliError, log } from "./util.js";
-const HELP = `nerd — deploy apps to nerdsystem
-
-  nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts)
-  nerd whoami                         Show the current user and orgs
-  nerd doctor                         Check Node, pnpm, git, login, and the project
-  nerd init <dir> [--org] [--name] [--describe "what it does"]   Create an app and a project for it
-  nerd link --slug <project> [--org]  Link this directory to an existing or new project
-  nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
-  nerd check [--no-build] [--rule id] [--json]   Run every gate a deploy runs; --json gives failures the agent can fix (alias: nerd verify)
-  nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
-  nerd rollback [deploymentId]        Re-publish the previous production bundle
-  nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
-  nerd transfer <org>                 Move this project to another org you administer
-  nerd health                         Platform component health (operators)
-  nerd waitlist [approve <id>]        Who is waiting for access while sign-up is invite-only (operators)
-  nerd deployments                    List recent deployments
-  nerd db query "<sql>"               Run SQL on the production database
-  nerd db migrate                     Apply pending migrations to production
-  nerd db migrations                  List applied migrations
-  nerd auth config [--roles a,b] [--default-role r] [--signup on|off]
-  nerd auth secret                    Mint a dev tenant secret into .dev.vars
-  nerd secret set NAME [value]        App secret for production (c.env.NAME); value from stdin when omitted
-  nerd secret list | rm NAME          Names only; values are never shown
-  nerd github connect                 Install the GitHub App for this org (prints a link)
-  nerd github link owner/repo [--branch main] [--root-dir dir] [--no-previews] [--require-pr] [--agent @claude]
-  nerd github status | unlink
-  nerd builds [--limit n]             List git-triggered builds
-  nerd builds show <id>               Build details and log
-  nerd builds trigger [--branch b] [--commit sha]
-  nerd agents sync                    Regenerate AGENTS.md, Cursor, Copilot, Gemini files from the skill
-  nerd billing [--org slug]           Plan, limits, and usage for the org
-  nerd billing upgrade --plan pro|studio [--annual]   Start checkout
-  nerd billing portal                 Manage cards, invoices, and plan
-  nerd members [invite <email> --role r | remove <userId>]   Org members and invitations
-  nerd clients [create <slug> --name n | release <slug>]     Studio: one org per client, billed through yours
-  nerd domains [add <hostname> | remove <id>]                Custom domains for this project
-  nerd logs [--since 30m] [--limit 100] [--q text] [--pr n]  Logs from the deployed app
-  nerd audit [--out file.csv]         Export deployments and builds (Studio)
-
-Every command accepts --json for machine-readable output.`;
-const BOOL = { type: "boolean", default: false };
-const STR = { type: "string" };
-async function main(argv) {
-    const [cmd, ...rest] = argv;
-    if (!cmd || cmd === "help" || cmd === "--help" || cmd === "-h") {
-        console.log(HELP);
-        return;
-    }
-    const parse = (options, allowPositionals = true) => parseArgs({ args: rest, options: { json: BOOL, ...options }, allowPositionals, strict: cmd !== "dev" });
-    switch (cmd) {
-        case "login": {
-            const { values } = parse({ token: STR, "api-url": STR, email: STR });
-            return login(values);
-        }
-        case "doctor": {
-            const { values } = parse({});
-            return doctor({ json: Boolean(values.json) });
-        }
-        case "whoami": {
-            const { values } = parse({});
-            return whoami({ json: Boolean(values.json) });
-        }
-        case "init": {
-            const { values, positionals } = parse({ org: STR, name: STR, slug: STR, describe: STR, "no-create": BOOL });
-            return init(positionals[0], values);
-        }
-        case "link": {
-            const { values } = parse({ org: STR, slug: STR, name: STR, "no-create": BOOL });
-            if (!values.slug)
-                throw new CliError("Usage: nerd link --slug <project> [--org <org>] [--name 'My App']");
-            const root = (() => {
-                try {
-                    return findProjectRoot();
-                }
-                catch {
-                    return process.cwd();
-                }
-            })();
-            await linkProject(root, { ...(values.org ? { org: values.org } : {}), slug: values.slug, name: values.name ?? values.slug, create: !values["no-create"] });
-            return;
-        }
-        case "dev":
-            return dev(rest);
-        case "check":
-        case "verify": {
-            const { values } = parse({ "no-build": BOOL, "no-remote": BOOL, "no-typecheck": BOOL, rule: STR });
-            return check({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), "no-remote": Boolean(values["no-remote"]), ...(values.rule ? { rule: values.rule } : {}) });
-        }
-        case "deploy": {
-            const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
-            return deploy(values);
-        }
-        case "rollback": {
-            const { values, positionals } = parse({ note: STR });
-            return rollback(positionals[0], { json: Boolean(values.json), ...(values.note ? { note: values.note } : {}) });
-        }
-        case "cron": {
-            const { values, positionals } = parse({});
-            return cron(positionals[0], { json: Boolean(values.json) });
-        }
-        case "transfer": {
-            const { values, positionals } = parse({});
-            return transfer(positionals[0], { json: Boolean(values.json) });
-        }
-        case "health": {
-            const { values } = parse({});
-            return health({ json: Boolean(values.json) });
-        }
-        case "waitlist": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: sub === "approve" ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
-            return waitlist({ json: Boolean(values.json), ...(sub === "approve" ? { approve: positionals[0] } : {}) });
-        }
-        case "deployments": {
-            const { values } = parse({ limit: { type: "string", default: "10" } });
-            return deployments(values);
-        }
-        case "db": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: true });
-            if (sub === "query")
-                return dbQuery(positionals[0], { json: Boolean(values.json) });
-            if (sub === "migrate")
-                return dbMigrate({ json: Boolean(values.json) });
-            if (sub === "migrations")
-                return dbMigrations({ json: Boolean(values.json) });
-            throw new CliError("Usage: nerd db query|migrate|migrations");
-        }
-        case "auth": {
-            const [sub, ...subRest] = rest;
-            const { values } = parseArgs({ args: subRest, options: { json: BOOL, roles: STR, "default-role": STR, signup: STR }, allowPositionals: false });
-            if (sub === "config")
-                return authConfig(values);
-            if (sub === "secret")
-                return authSecret();
-            throw new CliError("Usage: nerd auth config|secret");
-        }
-        case "billing": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "upgrade" || sub === "portal" || sub === "show";
-            const { values } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, plan: STR, annual: BOOL }, allowPositionals: false });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "upgrade")
-                return billingUpgrade({ ...o, ...(values.plan ? { plan: values.plan } : {}), annual: Boolean(values.annual) });
-            if (sub === "portal")
-                return billingPortal(o);
-            return billingShow(o);
-        }
-        case "members": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "invite" || sub === "remove" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, role: STR }, allowPositionals: true });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "invite")
-                return membersInvite(positionals[0], { ...o, ...(values.role ? { role: values.role } : {}) });
-            if (sub === "remove")
-                return membersRemove(positionals[0], o);
-            return membersList(o);
-        }
-        case "clients": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "create" || sub === "release" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, org: STR, name: STR }, allowPositionals: true });
-            const o = { json: Boolean(values.json), ...(values.org ? { org: values.org } : {}) };
-            if (sub === "create")
-                return clientsCreate(positionals[0], { ...o, ...(values.name ? { name: values.name } : {}) });
-            if (sub === "release")
-                return clientsRelease(positionals[0], o);
-            return clientsList(o);
-        }
-        case "secret": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, previews: BOOL }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "set")
-                return secretSet(positionals[0], positionals[1], { json, previews: Boolean(values.previews) });
-            if (sub === "rm" || sub === "remove" || sub === "delete")
-                return secretRemove(positionals[0], { json });
-            if (sub === "list" || sub === "ls" || sub === undefined)
-                return secretList({ json });
-            throw new CliError("Usage: nerd secret set NAME [value] [--previews] | list | rm NAME");
-        }
-        case "domains": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "add" || sub === "remove" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL }, allowPositionals: true });
-            const o = { json: Boolean(values.json) };
-            if (sub === "add")
-                return domainsAdd(positionals[0], o);
-            if (sub === "remove")
-                return domainsRemove(positionals[0], o);
-            return domainsList(o);
-        }
-        case "logs": {
-            const { values } = parse({ since: STR, limit: STR, q: STR, pr: STR });
-            return logs({ json: Boolean(values.json), ...(values.since ? { since: values.since } : {}), ...(values.limit ? { limit: values.limit } : {}), ...(values.q ? { q: values.q } : {}), ...(values.pr ? { pr: values.pr } : {}) });
-        }
-        case "audit": {
-            const { values } = parse({ org: STR, out: STR });
-            return auditExport({ json: Boolean(values.json), ...(values.org ? { org: values.org } : {}), ...(values.out ? { out: values.out } : {}) });
-        }
-        case "agents": {
-            const [sub, ...subRest] = rest;
-            const { values } = parseArgs({ args: subRest, options: { json: BOOL }, allowPositionals: false });
-            if (sub === "sync")
-                return agentsSync({ json: Boolean(values.json) });
-            throw new CliError("Usage: nerd agents sync");
-        }
-        case "github": {
-            const [sub, ...subRest] = rest;
-            const { values, positionals } = parseArgs({ args: subRest, options: { json: BOOL, branch: STR, "root-dir": STR, "no-previews": BOOL, "require-pr": BOOL, installation: STR, agent: STR }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "connect")
-                return githubConnect({ json });
-            if (sub === "link")
-                return githubLink(positionals[0], { json, "no-previews": Boolean(values["no-previews"]), "require-pr": Boolean(values["require-pr"]), ...(values.agent ? { agent: String(values.agent) } : {}), ...(values.branch ? { branch: values.branch } : {}), ...(values["root-dir"] ? { "root-dir": values["root-dir"] } : {}), ...(values.installation ? { installation: values.installation } : {}) });
-            if (sub === "unlink")
-                return githubUnlink({ json });
-            if (sub === "status" || sub === undefined)
-                return githubStatus({ json });
-            throw new CliError("Usage: nerd github connect|link|unlink|status");
-        }
-        case "builds": {
-            const [sub, ...subRest] = rest;
-            const isSub = sub === "show" || sub === "trigger" || sub === "list";
-            const { values, positionals } = parseArgs({ args: isSub ? subRest : rest, options: { json: BOOL, limit: { type: "string", default: "10" }, branch: STR, commit: STR }, allowPositionals: true });
-            const json = Boolean(values.json);
-            if (sub === "show")
-                return buildsShow(positionals[0], { json });
-            if (sub === "trigger")
-                return buildsTrigger({ json, ...(values.branch ? { branch: values.branch } : {}), ...(values.commit ? { commit: values.commit } : {}) });
-            return buildsList({ json, limit: values.limit });
-        }
-        default:
-            throw new CliError(`Unknown command "${cmd}". Run \`nerd help\`.`);
-    }
-}
-main(process.argv.slice(2)).catch((err) => {
-    if (err instanceof CliError) {
-        log.warn(err.message);
-        process.exit(err.exitCode);
-    }
-    console.error(err);
-    process.exit(1);
-});
+import { runCli } from "./cli.js";
+await runCli(process.argv.slice(2));

package/dist/util.d.ts

@@ -1,7 +1,16 @@
 export declare class CliError extends Error {
     readonly exitCode: number;
-    constructor(message: string, exitCode?: number);
+    /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
+    readonly code: string | undefined;
+    /** The HTTP status when the error came from a response. */
+    readonly status: number | undefined;
+    constructor(message: string, exitCode?: number, extra?: {
+        code?: string | undefined;
+        status?: number | undefined;
+    });
 }
+/** The one sentence every unauthenticated command prints, with both ways in. */
+export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
 export declare const log: {
     info: (msg: string) => void;
     step: (msg: string) => void;

package/dist/util.js

@@ -3,11 +3,19 @@ import { existsSync } from "node:fs";
 import path from "node:path";
 export class CliError extends Error {
     exitCode;
-    constructor(message, exitCode = 1) {
+    /** The API's error code (e.g. "not_found") when the error came from a response; callers branch on this, never on the message. */
+    code;
+    /** The HTTP status when the error came from a response. */
+    status;
+    constructor(message, exitCode = 1, extra = {}) {
         super(message);
         this.exitCode = exitCode;
+        this.code = extra.code;
+        this.status = extra.status;
     }
 }
+/** The one sentence every unauthenticated command prints, with both ways in. */
+export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
 export const log = {
     info: (msg) => console.error(`${msg}`),
     step: (msg) => console.error(`\x1b[36m›\x1b[0m ${msg}`),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -28,11 +28,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -82,6 +82,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -121,6 +122,10 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -29,11 +29,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -83,6 +83,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -122,6 +123,10 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -25,11 +25,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -79,6 +79,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -118,6 +119,10 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -25,11 +25,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -79,6 +79,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -118,6 +119,10 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (b1d847104ce0); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -25,11 +25,11 @@ Throughout, show commands rather than describing them, and never ask the person
 4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
-Run `nerd check --json` when you want a machine-readable list of problems.
+Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -79,6 +79,7 @@ Then in `src/server/index.ts`: `app.route("/api/notes", notes);`
 - Schema changes are migrations. Edit `schema.ts`, run `pnpm db:generate`, commit the new file in `migrations/`. Never hand-write SQL into production; `nerd deploy` applies migrations in name order and records which ran.
 - Migrations are forward-only. To undo, write another migration.
 - Prefer small, additive migrations. SQLite cannot alter columns in place.
+- `nerd db export` downloads a SQL dump of the production database (`<slug>-<date>.sql`, or `--out file.sql`); use it before a risky migration or when the person wants their data.
 
 ## Errors
 
@@ -118,6 +119,10 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 When something is wrong on the deployed app: `nerd logs --since 1h` (add `--q "text"` to search, `--pr 12` for a preview) shows errors with the request that caused them. Reproduce locally with `nerd dev` using the same input, fix it, run `nerd verify`, and deploy or open a pull request. If a deploy made things worse, `nerd rollback` puts the previous production bundle back without touching the database. Write a one-line note on every deploy (`nerd deploy --note "fix: todos query filtered by user"`); the dashboard shows these as a changelog people can read.
 
+## Deleting a project
+
+`nerd delete --yes` takes the app offline at once and moves the project to the trash; its database and files are kept for seven days (the command prints the date), then destroyed. `nerd trash` lists what can still be restored and `nerd trash restore <slug>` brings one back (the app stays offline until the next `nerd deploy` or a rollback). Never run `nerd delete` unless the person asked for it in so many words.
+
 ## Not available yet
 
 Queues, Durable Objects, and log streaming. If the task needs one, say so instead of working around it with an unsupported binding.

package/template/package.json

@@ -19,6 +19,12 @@
     "react": "^19.3.1",
     "react-dom": "^19.3.1"
   },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild",
+      "workerd"
+    ]
+  },
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.67.0",
     "@cloudflare/workers-types": "^5.20261102.1",