nerdsystem 0.0.8 → 0.0.10

package/README.md

@@ -1,6 +1,6 @@
 # nerdsystem
 
-`nerd`: deploy apps built with coding agents to [nerdsystem](https://nerdsystem.com), with sign-in, roles, a database, file storage, previews per pull request, and security gates on every deploy.
+`nerd`: start a web app with your coding agent and deploy it to [nerdsystem](https://nerdsystem.com), with sign-in, roles, a database, file storage, previews per pull request, and security gates on every deploy.
 
 ```sh
 npx nerdsystem init my-app

package/dist/cli.js

@@ -17,7 +17,7 @@ import { login, whoami } from "./commands/login.js";
 import { deleteProject, trashList, trashRestore } from "./commands/trash.js";
 import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
-const HELP = `nerd — deploy apps to nerdsystem
+const HELP = `nerd: start, check, and deploy a web app on nerdsystem
 
   nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts)
   nerd whoami                         Show the current user and orgs
@@ -26,7 +26,7 @@ const HELP = `nerd — deploy apps to nerdsystem
   nerd link --slug <project> [--org]  Link this directory to an existing or new project
   nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
   nerd check [--no-build] [--rule id] [--json]   Run every gate a deploy runs; --json gives failures the agent can fix (alias: nerd verify)
-  nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
+  nerd deploy [--note "what changed"] [--skip-probe]   Check, build, migrate, upload, probe the live URL. Prints the URL
   nerd rollback [deploymentId]        Re-publish the previous production bundle
   nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
   nerd transfer <org>                 Move this project to another org you administer
@@ -111,7 +111,7 @@ export async function main(argv) {
             return check({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), "no-remote": Boolean(values["no-remote"]), ...(values.rule ? { rule: values.rule } : {}) });
         }
         case "deploy": {
-            const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
+            const { values } = parse({ "skip-build": BOOL, "skip-probe": BOOL, note: STR });
             return deploy(values);
         }
         case "rollback": {
@@ -301,6 +301,15 @@ export async function runCli(argv) {
             log.warn(err.message);
             code = err.exitCode > 0 ? err.exitCode : 1;
         }
+        else if (err instanceof Error && typeof err.code === "string" && err.code.startsWith("ERR_PARSE_ARGS")) {
+            // A typo in a flag gets one sentence, not a Node stack trace.
+            const message = `${err.message.replace(/\. To specify a positional argument.*$/s, "")}. Run \`nerd --help\` for the flags each command takes.`;
+            if (argv.includes("--json"))
+                console.log(JSON.stringify({ error: { code: "usage", message } }));
+            else
+                log.warn(message);
+            code = 2;
+        }
         else {
             console.error(err);
             code = 1;

package/dist/commands/check.js

@@ -121,7 +121,7 @@ export async function runChecks(root, opts) {
     }
     if (opts.typecheck && problems.every((p) => p.endsWith("(warning)") || p.startsWith("Agent instruction files"))) {
         log.step("Typechecking");
-        const code = await run("npx", ["tsc", "-b", "--pretty"], { cwd: root });
+        const code = await run("npx", ["tsc", "-b", "--pretty"], { cwd: root, stdoutToStderr: true });
         if (code !== 0)
             problems.push("Typecheck failed (see errors above).");
     }
@@ -144,7 +144,9 @@ export async function check(opts) {
         }
     }
     // Loaded here, not at the top: the gates import staticChecks from this file.
-    const { runVerify } = await import("./verify.js");
+    const { runVerify, assertRuleHasGate } = await import("./verify.js");
+    if (opts.rule)
+        assertRuleHasGate(opts.rule);
     const out = await runVerify(root, { withBuild: !opts["no-build"], stopOnFail: false, quiet: opts.json, onlyRules: opts.rule ? [opts.rule] : undefined });
     const failed = out.results.filter((r) => r.status === "fail").length;
     if (opts.json)

package/dist/commands/deploy.d.ts

@@ -16,8 +16,8 @@ export declare function applyRemoteMigrations(root: string, api: ApiClient): Pro
 }>;
 export declare function deploy(opts: {
     json: boolean;
-    "skip-check": boolean;
     "skip-build": boolean;
+    "skip-probe"?: boolean | undefined;
     note?: string | undefined;
 }): Promise<void>;
 export declare function deployments(opts: {

package/dist/commands/deploy.js

@@ -4,7 +4,7 @@ import { ApiClient } from "../api.js";
 import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
 import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
-import { BUILD_GATES, gateSummary, knownSecretsFrom, runGates, SOURCE_GATES } from "../gates/index.js";
+import { BUILD_GATES, gateSummary, knownSecretsFrom, probeDeployment, runGates, skippedProbe, SOURCE_GATES, waitForDeployment } from "../gates/index.js";
 import { readDevVars } from "../project.js";
 const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
 function walk(dir, base = dir) {
@@ -56,35 +56,58 @@ export async function applyRemoteMigrations(root, api) {
         return { applied: [], skipped: [] };
     return api.post(projectPath(readNerdJson(root), "/db/migrations"), { migrations });
 }
+/**
+ * Probes the live URL after an upload, the same checks the builder runs after a git build.
+ * Informational: the app is already live, so findings are printed, never thrown.
+ */
+async function probeAfterDeploy(deployment, url, skip) {
+    if (skip)
+        return skippedProbe("--skip-probe was given");
+    if (deployment.status !== "live")
+        return skippedProbe(`the deployment status is ${deployment.status}, not live`);
+    // Until the dispatcher knows the new script it answers its own 404 page, which has none of the app's
+    // headers or routes; probing that would report false auth failures. Wait, and say so when it never came.
+    if (!(await waitForDeployment(url)))
+        return skippedProbe("the app had not started answering within 30 seconds; open the URL to check, or run nerd deploy again to probe it");
+    return probeDeployment(url);
+}
+function printProbe(url, probes) {
+    if (probes.status === "skip")
+        return log.info(`Live URL not probed: ${probes.summary}`);
+    const line = `Probed ${url}: ${probes.status === "pass" ? "all probes passed" : probes.summary}`;
+    if (probes.status === "pass")
+        log.ok(line);
+    else
+        log.warn(line);
+    for (const f of probes.findings)
+        log.info(`    ${f.severity === "block" ? "✗" : "!"} ${f.rule_id}: ${f.risk}`);
+}
 export async function deploy(opts) {
     const root = findProjectRoot();
     const nerd = readNerdJson(root);
     const api = ApiClient.fromConfig();
     const knownSecrets = knownSecretsFrom(readDevVars(root));
-    if (!opts["skip-check"]) {
-        const remote = await runChecks(root, { remote: true, typecheck: false });
-        if (!remote.ok) {
-            for (const p of remote.problems)
-                log.warn(p);
-            throw new CliError("Fix the problems above, then deploy again.", 2);
-        }
-        const { approvedSuppressions } = await import("./verify.js");
-        const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
-        if (!gates.ok)
-            throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
-        log.ok(gateSummary(gates.results));
+    // Every deploy runs every gate. There is no flag to skip them: suppressions need a person's approval in the dashboard.
+    const remote = await runChecks(root, { remote: true, typecheck: false });
+    if (!remote.ok) {
+        for (const p of remote.problems)
+            log.warn(p);
+        throw new CliError("Fix the problems above, then deploy again.", 2);
     }
+    const { approvedSuppressions } = await import("./verify.js");
+    const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!gates.ok)
+        throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
+    log.ok(gateSummary(gates.results));
     if (!opts["skip-build"]) {
         log.step("Building with vite");
         ensureDeps(root);
-        await runOrThrow("npx", ["vite", "build"], { cwd: root });
+        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
     }
     const build = readBuildOutput(root);
-    if (!opts["skip-check"]) {
-        const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
-        if (!built.ok)
-            throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
-    }
+    const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!built.ok)
+        throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
     log.step("Applying migrations to the production database");
     const mig = await applyRemoteMigrations(root, api);
     if (mig.applied.length)
@@ -107,9 +130,13 @@ export async function deploy(opts) {
     }
     const { deployment } = await api.post(projectPath(nerd, "/deployments"), form);
     const { project } = await api.get(projectPath(nerd));
-    if (opts.json)
-        return printJson({ deployment, url: project.url, migrations: mig });
     log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
+    if (!opts["skip-probe"] && deployment.status === "live")
+        log.step(`Probing ${project.url}`);
+    const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
+    if (opts.json)
+        return printJson({ deployment, url: project.url, migrations: mig, probes });
+    printProbe(project.url, probes);
     log.info(`First time? Sign up on your app at ${project.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
 }
 export async function deployments(opts) {

package/dist/commands/doctor.js

@@ -12,6 +12,10 @@ export async function doctor(opts) {
         const r = await exec(tool, ["--version"], process.cwd());
         checks.push({ name: tool, ok: r.code === 0, detail: r.code === 0 ? r.stdout.trim().split("\n")[0] ?? "" : "not found", fix });
     }
+    if (process.platform === "win32" && !process.env.MSYSTEM && !process.env.WSL_DISTRO_NAME) {
+        // npm installs nerd and pnpm as .ps1 scripts too, and PowerShell's default policy refuses those; Git Bash (MSYSTEM) and WSL are not affected.
+        checks.push({ name: "Windows shell (optional)", ok: true, detail: "if PowerShell says running scripts is disabled, run `Set-ExecutionPolicy -Scope CurrentUser RemoteSigned` once, or use Git Bash or WSL" });
+    }
     const gh = await exec("gh", ["auth", "status"], process.cwd());
     checks.push({ name: "GitHub CLI signed in (optional)", ok: gh.code === 0, detail: gh.code === 0 ? "ok" : "not signed in", fix: "Only needed to create repos from the terminal: https://cli.github.com then `gh auth login`." });
     const cfg = loadConfig();

package/dist/commands/init.js

@@ -174,4 +174,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.8";
+const SDK_VERSION = "0.0.10";

package/dist/commands/login.js

@@ -28,7 +28,7 @@ export async function login(args) {
         else {
             log.info(`Open this link in your browser and approve code ${start.userCode}:\n\n  ${start.verificationUrl}\n`);
             if (args.email)
-                log.info(`An email went to ${args.email}: one click signs you in (creating your account if you are new) and approves.`);
+                log.info(`An email went to ${args.email}: the link signs you in (creating your account if you are new) and opens a page where you press Approve.`);
             log.info("Waiting for approval…");
         }
     }

package/dist/commands/verify.d.ts

@@ -17,6 +17,8 @@ export declare function runVerify(root: string, opts: {
     onlyRules?: string[] | undefined;
     trackAttempts?: boolean;
 }): Promise<VerifyOutput>;
+/** `--rule smoke/x` would select no gate and report "All 0 gates passed"; say which prefixes a gate owns instead. */
+export declare function assertRuleHasGate(rule: string): void;
 export declare function verify(opts: {
     json: boolean;
     "no-build": boolean;

package/dist/commands/verify.js

@@ -35,8 +35,19 @@ export async function runVerify(root, opts) {
     }
     return { ok: results.every((r) => r.status !== "fail"), failures, stop, results };
 }
+/** `--rule smoke/x` would select no gate and report "All 0 gates passed"; say which prefixes a gate owns instead. */
+export function assertRuleHasGate(rule) {
+    const prefixes = [...new Set([...SOURCE_GATES, ...BUILD_GATES].flatMap((g) => g.rulePrefixes))];
+    if (prefixes.some((p) => rule.startsWith(p)))
+        return;
+    if (rule.startsWith("smoke/"))
+        throw new CliError(`No gate runs ${rule} on the source: the live URL is probed by nerd deploy. Deploy again to re-check it.`, 2);
+    throw new CliError(`No gate runs ${rule}. Rule ids start with one of: ${prefixes.join(", ")}`, 2);
+}
 export async function verify(opts) {
     const root = findProjectRoot();
+    if (opts.rule)
+        assertRuleHasGate(opts.rule);
     const out = await runVerify(root, { withBuild: !opts["no-build"], stopOnFail: false, quiet: opts.json, onlyRules: opts.rule ? [opts.rule] : undefined });
     if (opts.json)
         process.stdout.write(`${JSON.stringify({ ok: out.ok, failures: out.failures, stop: out.stop, skipped: skippedGates(out.results) }, null, 2)}\n`);

package/dist/gates/code.d.ts

@@ -11,7 +11,6 @@ export declare const rulesGate: Gate;
 export declare const typecheckGate: Gate;
 /** The catalog rule for an advisory severity. Critical and high block, as the homepage promises; moderate warns; low and unrated inform. */
 export declare function depsRuleFor(severity: AdvisorySeverity): string;
-/** Known vulnerabilities in dependencies. Critical and high block; moderate warns. Package names come from the registry, not the repo. */
 export declare const depsGate: Gate;
 export declare const policyGate: Gate;
 /** Heuristics for careless handling of personal data. Advisory: warns, never blocks. */

package/dist/gates/code.js

@@ -72,6 +72,24 @@ export function depsRuleFor(severity) {
     return severity === "critical" ? "deps/critical-vulnerability" : severity === "high" ? "deps/high-vulnerability" : severity === "moderate" ? "deps/moderate-vulnerability" : severity === "low" ? "deps/low-vulnerability" : "deps/advisory";
 }
 /** Known vulnerabilities in dependencies. Critical and high block; moderate warns. Package names come from the registry, not the repo. */
+/**
+ * The lockfile for the project: in its root, or in an ancestor that is itself a package or workspace root
+ * (it holds a package.json or pnpm-workspace.yaml), searched up to the repository root (the directory holding
+ * .git). A workspace member such as the template inside this monorepo shares the lockfile committed at the top;
+ * a stray lockfile in an unrelated ancestor such as the home folder is never adopted.
+ */
+function findLockfile(start) {
+    let dir = start;
+    for (;;) {
+        const hit = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"].find((f) => existsSync(path.join(dir, f)));
+        if (hit && (dir === start || existsSync(path.join(dir, "package.json")) || existsSync(path.join(dir, "pnpm-workspace.yaml"))))
+            return path.join(dir, hit);
+        const parent = path.dirname(dir);
+        if (parent === dir || existsSync(path.join(dir, ".git")))
+            return undefined;
+        dir = parent;
+    }
+}
 export const depsGate = {
     name: "dependencies",
     title: "Dependency vulnerabilities",
@@ -80,11 +98,13 @@ export const depsGate = {
     async run(ctx) {
         const t = Date.now();
         const findings = [];
-        const lock = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"].find((f) => existsSync(path.join(ctx.root, f)));
+        const lockPath = findLockfile(ctx.root);
+        const lock = lockPath ? path.basename(lockPath) : undefined;
         if (!lock)
             findings.push(finding("deps/lockfile-required", {}));
         if (await hasTool("osv-scanner")) {
-            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lock ?? "pnpm-lock.yaml"], ctx.root);
+            // Run from the lockfile's own folder with a bare name: on Windows the shell would split an absolute path with a space.
+            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lock ?? "pnpm-lock.yaml"], lockPath ? path.dirname(lockPath) : ctx.root);
             try {
                 const json = JSON.parse(r.stdout);
                 for (const res of json.results ?? [])

package/dist/gates/index.d.ts

@@ -4,6 +4,7 @@ export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor, type RuleDef } from "./rules.js";
 export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
+export { probeDeployment, skippedProbe, waitForDeployment, type FetchLike } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
 export declare const SOURCE_GATES: Gate[];
 /** Gates that need the built output. */

package/dist/gates/index.js

@@ -7,6 +7,7 @@ export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor } from "./rules.js";
 export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
+export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
 export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate];
 /** Gates that need the built output. */

package/dist/gates/rules.js

@@ -34,6 +34,7 @@ export const RULES = {
     "deps/audit-unavailable": { title: "Dependency audit could not run", severity: "warn", audience: "human", risk: "Vulnerable packages would not be detected this run.", fix: "Check network access and the package manager, then run `nerd verify` again." },
     "rules/platform": { title: "Platform rule", severity: "block", audience: "agent", risk: "The app would not run correctly on the platform.", fix: "Follow the instruction in the finding; the rules are listed in the nerdsystem skill." },
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
+    "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
     "typecheck/failed": { title: "Typecheck failed", severity: "block", audience: "agent", risk: "The project does not compile.", fix: "Run `npx tsc -b` and fix the errors it prints." },
     "policy/blocked-package": { title: "Package not allowed", severity: "block", audience: "agent", risk: "The package is a miner, proxy, or headless browser, which the acceptable use policy forbids and the platform cannot run.", fix: "Remove the package and the code that uses it. If the app genuinely needs a browser or scraping, say so to the person; it is not supported here." },

package/dist/gates/smoke.d.ts

@@ -0,0 +1,18 @@
+import { type GateResult } from "./types.js";
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * Waits until GET / on the deployed app answers (a response below 500 that is not the dispatcher's
+ * 404 for a script it does not know yet). Returns true as soon as it does; false after the last attempt.
+ */
+export declare function waitForDeployment(url: string, opts?: {
+    attempts?: number;
+    delayMs?: number;
+    fetchImpl?: FetchLike;
+}): Promise<boolean>;
+/**
+ * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
+ * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ */
+export declare function probeDeployment(url: string, fetchImpl?: FetchLike): Promise<GateResult>;
+/** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
+export declare function skippedProbe(reason: string): GateResult;

package/dist/gates/smoke.js

@@ -0,0 +1,101 @@
+/**
+ * Post-deploy probes against the live URL. The same checks the builder runs after a git build
+ * (apps/builder/image/build.mjs smokeGate), so `nerd deploy` reports the same findings.
+ * Deterministic and non-disruptive: three GETs and one login with made-up credentials.
+ * Findings are informational for the deploy command; the app is already live when they run.
+ */
+import { finding, fingerprint } from "./secrets.js";
+import { verdict } from "./types.js";
+const PROBE_TIMEOUT_MS = 10_000;
+const REQUIRED_HEADERS = ["x-content-type-options", "content-security-policy", "x-frame-options"];
+/** Default fetch wrapped so it is never called with a foreign `this` (workerd throws "Illegal invocation"). */
+const defaultFetch = (input, init) => fetch(input, init);
+function withTimeout(init) {
+    const signal = typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(PROBE_TIMEOUT_MS) : undefined;
+    return { redirect: "manual", ...(signal ? { signal } : {}), ...init };
+}
+/** No gate owns the smoke/ prefix, so `nerd verify --rule smoke/...` would run nothing; the way to re-check is another deploy. */
+const VERIFY = "nerd deploy (the live URL is probed after every deploy)";
+function smokeFinding(ruleId, risk, key) {
+    return { ...finding(ruleId, { risk, fingerprint: fingerprint(ruleId, key) }), verify: VERIFY };
+}
+function probeResult(findings, startedAt) {
+    const status = verdict(findings);
+    const blocks = findings.filter((f) => f.severity === "block").length;
+    const summary = blocks ? `${blocks} probe${blocks === 1 ? "" : "s"} failed` : findings.length ? `${findings.length} warning${findings.length === 1 ? "" : "s"}` : "All probes passed";
+    return { name: "smoke", title: "Deployed app probes", status, summary, findings, durationMs: Date.now() - startedAt, tool: "builtin" };
+}
+/**
+ * Waits until GET / on the deployed app answers (a response below 500 that is not the dispatcher's
+ * 404 for a script it does not know yet). Returns true as soon as it does; false after the last attempt.
+ */
+export async function waitForDeployment(url, opts = {}) {
+    const attempts = opts.attempts ?? 8;
+    const delayMs = opts.delayMs ?? 2000;
+    const fetchImpl = opts.fetchImpl ?? defaultFetch;
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const r = await fetchImpl(`${url}/`, withTimeout(undefined));
+            await r.body?.cancel().catch(() => { });
+            if (r.status < 500 && r.status !== 404)
+                return true;
+        }
+        catch {
+            // not reachable yet
+        }
+        if (i < attempts - 1)
+            await new Promise((r) => setTimeout(r, delayMs));
+    }
+    return false;
+}
+/**
+ * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
+ * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ */
+export async function probeDeployment(url, fetchImpl = defaultFetch) {
+    const startedAt = Date.now();
+    const base = url.replace(/\/$/, "");
+    const findings = [];
+    const get = async (p, init) => {
+        try {
+            return await fetchImpl(`${base}${p}`, withTimeout(init));
+        }
+        catch (err) {
+            findings.push(smokeFinding("smoke/unreachable", `${p} could not be fetched: ${err instanceof Error ? err.message : String(err)}`, p));
+            return null;
+        }
+    };
+    const home = await get("/");
+    if (home) {
+        await home.body?.cancel().catch(() => { });
+        if (home.status >= 500)
+            findings.push(smokeFinding("smoke/unreachable", `GET / returned ${home.status}.`, "/:status"));
+        for (const h of REQUIRED_HEADERS) {
+            if (!home.headers.get(h))
+                findings.push(smokeFinding("smoke/header-missing", `The ${h} header is missing, so browsers lose a protection against clickjacking, content sniffing, or script injection.`, h));
+        }
+        if (base.startsWith("https://") && !home.headers.get("strict-transport-security"))
+            findings.push(smokeFinding("smoke/header-missing", "The strict-transport-security header is missing.", "strict-transport-security"));
+    }
+    const me = await get("/api/auth/me");
+    if (me) {
+        const body = await me.text().catch(() => "");
+        if (me.status !== 200 || !body.includes('"user":null'))
+            findings.push(smokeFinding("smoke/auth-me", `GET /api/auth/me without a session returned ${me.status} instead of 200 with {"user":null}.`, "/api/auth/me"));
+    }
+    const login = await get("/api/auth/login", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "probe@nerdsystem.invalid", password: "definitely-wrong-password" }),
+    });
+    if (login) {
+        await login.body?.cancel().catch(() => { });
+        if (login.status !== 401)
+            findings.push(smokeFinding("smoke/auth-login", `Wrong credentials returned ${login.status} instead of 401.`, "/api/auth/login"));
+    }
+    return probeResult(findings, startedAt);
+}
+/** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
+export function skippedProbe(reason) {
+    return { name: "smoke", title: "Deployed app probes", status: "skip", summary: reason, findings: [], durationMs: 0, tool: "builtin" };
+}

package/dist/project.js

@@ -8,7 +8,7 @@ export function findProjectRoot(start = process.cwd()) {
             return dir;
         const parent = path.dirname(dir);
         if (parent === dir)
-            throw new CliError("No nerd.json found. Run this inside a nerdsystem app, or create one with `nerd init <dir>`.");
+            throw new CliError("No nerd.json found. Run this inside an app created by `nerd init`, link a folder already in the nerdsystem shape with `nerd link --slug <project>`, or create one with `nerd init <dir>`.");
         dir = parent;
     }
 }

package/dist/util.d.ts

@@ -10,22 +10,22 @@ export declare class CliError extends Error {
     });
 }
 /** The one sentence every unauthenticated command prints, with both ways in. */
-export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
+export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (the link in the email signs you in, creating your account the first time, and opens a page where you press Approve), or set NERD_TOKEN to an API token for scripts.";
 export declare const log: {
     info: (msg: string) => void;
     step: (msg: string) => void;
     ok: (msg: string) => void;
     warn: (msg: string) => void;
 };
-/** Runs a command, streaming output. Resolves with the exit code. */
-export declare function run(cmd: string, args: string[], opts?: {
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-}): Promise<number>;
-export declare function runOrThrow(cmd: string, args: string[], opts?: {
+export interface RunOptions {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
-}): Promise<void>;
+    /** Send the child's stdout to our stderr, so stdout stays reserved for `--json` output. */
+    stdoutToStderr?: boolean;
+}
+/** Runs a command, streaming output. Resolves with the exit code. */
+export declare function run(cmd: string, args: string[], opts?: RunOptions): Promise<number>;
+export declare function runOrThrow(cmd: string, args: string[], opts?: RunOptions): Promise<void>;
 export declare function printJson(value: unknown): void;
 export declare function table(rows: Record<string, unknown>[], columns: string[]): void;
 /** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */

package/dist/util.js

@@ -15,7 +15,7 @@ export class CliError extends Error {
     }
 }
 /** The one sentence every unauthenticated command prints, with both ways in. */
-export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
+export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (the link in the email signs you in, creating your account the first time, and opens a page where you press Approve), or set NERD_TOKEN to an API token for scripts.";
 export const log = {
     info: (msg) => console.error(`${msg}`),
     step: (msg) => console.error(`\x1b[36m›\x1b[0m ${msg}`),
@@ -25,7 +25,8 @@ export const log = {
 /** Runs a command, streaming output. Resolves with the exit code. */
 export function run(cmd, args, opts = {}) {
     return new Promise((resolve, reject) => {
-        const child = spawn(cmd, args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: "inherit", shell: process.platform === "win32" });
+        const child = spawn(cmd, args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: ["inherit", opts.stdoutToStderr ? "pipe" : "inherit", "inherit"], shell: process.platform === "win32" });
+        child.stdout?.pipe(process.stderr);
         child.on("error", reject);
         child.on("exit", (code) => resolve(code ?? 1));
     });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.8",
-  "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
+  "version": "0.0.10",
+  "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {
     "nerd": "./dist/index.js"
@@ -44,6 +44,8 @@
     "deploy",
     "cli",
     "claude-code",
+    "cursor",
+    "codex",
     "vibe-coding"
   ],
   "publishConfig": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -20,19 +20,30 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -116,7 +127,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -21,19 +21,30 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -117,7 +128,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,19 +17,30 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,19 +17,30 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,19 +17,30 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production