nerdsystem 0.0.8 → 0.0.9

package/README.md

@@ -1,6 +1,6 @@
 # nerdsystem
 
-`nerd`: deploy apps built with coding agents to [nerdsystem](https://nerdsystem.com), with sign-in, roles, a database, file storage, previews per pull request, and security gates on every deploy.
+`nerd`: start a web app with your coding agent and deploy it to [nerdsystem](https://nerdsystem.com), with sign-in, roles, a database, file storage, previews per pull request, and security gates on every deploy.
 
 ```sh
 npx nerdsystem init my-app

package/dist/cli.js

@@ -17,7 +17,7 @@ import { login, whoami } from "./commands/login.js";
 import { deleteProject, trashList, trashRestore } from "./commands/trash.js";
 import { findProjectRoot } from "./project.js";
 import { CliError, log } from "./util.js";
-const HELP = `nerd — deploy apps to nerdsystem
+const HELP = `nerd: start, check, and deploy a web app on nerdsystem
 
   nerd login [--email you@x.com]      Sign in or sign up: prints a link to approve in the browser (--email sends it; --token nsk_... for scripts)
   nerd whoami                         Show the current user and orgs
@@ -26,7 +26,7 @@ const HELP = `nerd — deploy apps to nerdsystem
   nerd link --slug <project> [--org]  Link this directory to an existing or new project
   nerd dev [vite args]                Run locally (writes .dev.vars, applies local migrations)
   nerd check [--no-build] [--rule id] [--json]   Run every gate a deploy runs; --json gives failures the agent can fix (alias: nerd verify)
-  nerd deploy [--note "what changed"] Check, build, migrate, upload. Prints the URL
+  nerd deploy [--note "what changed"] [--skip-probe]   Check, build, migrate, upload, probe the live URL. Prints the URL
   nerd rollback [deploymentId]        Re-publish the previous production bundle
   nerd cron [off|hourly|daily]        Scheduled job: the platform calls POST /api/cron
   nerd transfer <org>                 Move this project to another org you administer
@@ -111,7 +111,7 @@ export async function main(argv) {
             return check({ json: Boolean(values.json), "no-build": Boolean(values["no-build"]), "no-remote": Boolean(values["no-remote"]), ...(values.rule ? { rule: values.rule } : {}) });
         }
         case "deploy": {
-            const { values } = parse({ "skip-check": BOOL, "skip-build": BOOL, note: STR });
+            const { values } = parse({ "skip-build": BOOL, "skip-probe": BOOL, note: STR });
             return deploy(values);
         }
         case "rollback": {
@@ -301,6 +301,15 @@ export async function runCli(argv) {
             log.warn(err.message);
             code = err.exitCode > 0 ? err.exitCode : 1;
         }
+        else if (err instanceof Error && typeof err.code === "string" && err.code.startsWith("ERR_PARSE_ARGS")) {
+            // A typo in a flag gets one sentence, not a Node stack trace.
+            const message = `${err.message.replace(/\. To specify a positional argument.*$/s, "")}. Run \`nerd --help\` for the flags each command takes.`;
+            if (argv.includes("--json"))
+                console.log(JSON.stringify({ error: { code: "usage", message } }));
+            else
+                log.warn(message);
+            code = 2;
+        }
         else {
             console.error(err);
             code = 1;

package/dist/commands/deploy.d.ts

@@ -16,8 +16,8 @@ export declare function applyRemoteMigrations(root: string, api: ApiClient): Pro
 }>;
 export declare function deploy(opts: {
     json: boolean;
-    "skip-check": boolean;
     "skip-build": boolean;
+    "skip-probe"?: boolean | undefined;
     note?: string | undefined;
 }): Promise<void>;
 export declare function deployments(opts: {

package/dist/commands/deploy.js

@@ -4,7 +4,7 @@ import { ApiClient } from "../api.js";
 import { findProjectRoot, projectPath, readNerdJson } from "../project.js";
 import { CliError, log, printJson, runOrThrow, table, dashboardUrl, ensureDeps } from "../util.js";
 import { runChecks } from "./check.js";
-import { BUILD_GATES, gateSummary, knownSecretsFrom, runGates, SOURCE_GATES } from "../gates/index.js";
+import { BUILD_GATES, gateSummary, knownSecretsFrom, probeDeployment, runGates, skippedProbe, SOURCE_GATES, waitForDeployment } from "../gates/index.js";
 import { readDevVars } from "../project.js";
 const MODULE_EXT = new Set([".js", ".mjs", ".wasm"]);
 function walk(dir, base = dir) {
@@ -56,35 +56,55 @@ export async function applyRemoteMigrations(root, api) {
         return { applied: [], skipped: [] };
     return api.post(projectPath(readNerdJson(root), "/db/migrations"), { migrations });
 }
+/**
+ * Probes the live URL after an upload, the same checks the builder runs after a git build.
+ * Informational: the app is already live, so findings are printed, never thrown.
+ */
+async function probeAfterDeploy(deployment, url, skip) {
+    if (skip)
+        return skippedProbe("--skip-probe was given");
+    if (deployment.status !== "live")
+        return skippedProbe(`the deployment status is ${deployment.status}, not live`);
+    await waitForDeployment(url);
+    return probeDeployment(url);
+}
+function printProbe(url, probes) {
+    if (probes.status === "skip")
+        return log.info(`Live URL not probed: ${probes.summary}`);
+    const line = `Probed ${url}: ${probes.status === "pass" ? "all probes passed" : probes.summary}`;
+    if (probes.status === "pass")
+        log.ok(line);
+    else
+        log.warn(line);
+    for (const f of probes.findings)
+        log.info(`    ${f.severity === "block" ? "✗" : "!"} ${f.rule_id}: ${f.risk}`);
+}
 export async function deploy(opts) {
     const root = findProjectRoot();
     const nerd = readNerdJson(root);
     const api = ApiClient.fromConfig();
     const knownSecrets = knownSecretsFrom(readDevVars(root));
-    if (!opts["skip-check"]) {
-        const remote = await runChecks(root, { remote: true, typecheck: false });
-        if (!remote.ok) {
-            for (const p of remote.problems)
-                log.warn(p);
-            throw new CliError("Fix the problems above, then deploy again.", 2);
-        }
-        const { approvedSuppressions } = await import("./verify.js");
-        const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
-        if (!gates.ok)
-            throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
-        log.ok(gateSummary(gates.results));
+    // Every deploy runs every gate. There is no flag to skip them: suppressions need a person's approval in the dashboard.
+    const remote = await runChecks(root, { remote: true, typecheck: false });
+    if (!remote.ok) {
+        for (const p of remote.problems)
+            log.warn(p);
+        throw new CliError("Fix the problems above, then deploy again.", 2);
     }
+    const { approvedSuppressions } = await import("./verify.js");
+    const gates = await runGates(SOURCE_GATES, { root, knownSecrets, approvedSuppressions: await approvedSuppressions(root), log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!gates.ok)
+        throw new CliError(`Blocked by: ${gates.failed.map((g) => g.title).join(", ")}. Fix the findings above, then deploy again.`, 2);
+    log.ok(gateSummary(gates.results));
     if (!opts["skip-build"]) {
         log.step("Building with vite");
         ensureDeps(root);
         await runOrThrow("npx", ["vite", "build"], { cwd: root });
     }
     const build = readBuildOutput(root);
-    if (!opts["skip-check"]) {
-        const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
-        if (!built.ok)
-            throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
-    }
+    const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
+    if (!built.ok)
+        throw new CliError(`Blocked by: ${built.failed.map((g) => g.title).join(", ")}.`, 2);
     log.step("Applying migrations to the production database");
     const mig = await applyRemoteMigrations(root, api);
     if (mig.applied.length)
@@ -107,9 +127,11 @@ export async function deploy(opts) {
     }
     const { deployment } = await api.post(projectPath(nerd, "/deployments"), form);
     const { project } = await api.get(projectPath(nerd));
+    const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
     if (opts.json)
-        return printJson({ deployment, url: project.url, migrations: mig });
+        return printJson({ deployment, url: project.url, migrations: mig, probes });
     log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
+    printProbe(project.url, probes);
     log.info(`First time? Sign up on your app at ${project.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
 }
 export async function deployments(opts) {

package/dist/commands/doctor.js

@@ -12,6 +12,10 @@ export async function doctor(opts) {
         const r = await exec(tool, ["--version"], process.cwd());
         checks.push({ name: tool, ok: r.code === 0, detail: r.code === 0 ? r.stdout.trim().split("\n")[0] ?? "" : "not found", fix });
     }
+    if (process.platform === "win32" && !process.env.MSYSTEM && !process.env.WSL_DISTRO_NAME) {
+        // npm installs nerd and pnpm as .ps1 scripts too, and PowerShell's default policy refuses those; Git Bash (MSYSTEM) and WSL are not affected.
+        checks.push({ name: "Windows shell (optional)", ok: true, detail: "if PowerShell says running scripts is disabled, run `Set-ExecutionPolicy -Scope CurrentUser RemoteSigned` once, or use Git Bash or WSL" });
+    }
     const gh = await exec("gh", ["auth", "status"], process.cwd());
     checks.push({ name: "GitHub CLI signed in (optional)", ok: gh.code === 0, detail: gh.code === 0 ? "ok" : "not signed in", fix: "Only needed to create repos from the terminal: https://cli.github.com then `gh auth login`." });
     const cfg = loadConfig();

package/dist/commands/init.js

@@ -174,4 +174,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.8";
+const SDK_VERSION = "0.0.9";

package/dist/gates/code.d.ts

@@ -11,7 +11,6 @@ export declare const rulesGate: Gate;
 export declare const typecheckGate: Gate;
 /** The catalog rule for an advisory severity. Critical and high block, as the homepage promises; moderate warns; low and unrated inform. */
 export declare function depsRuleFor(severity: AdvisorySeverity): string;
-/** Known vulnerabilities in dependencies. Critical and high block; moderate warns. Package names come from the registry, not the repo. */
 export declare const depsGate: Gate;
 export declare const policyGate: Gate;
 /** Heuristics for careless handling of personal data. Advisory: warns, never blocks. */

package/dist/gates/code.js

@@ -72,6 +72,22 @@ export function depsRuleFor(severity) {
     return severity === "critical" ? "deps/critical-vulnerability" : severity === "high" ? "deps/high-vulnerability" : severity === "moderate" ? "deps/moderate-vulnerability" : severity === "low" ? "deps/low-vulnerability" : "deps/advisory";
 }
 /** Known vulnerabilities in dependencies. Critical and high block; moderate warns. Package names come from the registry, not the repo. */
+/**
+ * The lockfile for the project: in its root, or in an ancestor up to the repository root (the directory holding .git),
+ * since a workspace member such as the template inside this monorepo shares the lockfile committed at the top.
+ */
+function findLockfile(start) {
+    let dir = start;
+    for (;;) {
+        const hit = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"].find((f) => existsSync(path.join(dir, f)));
+        if (hit)
+            return path.join(dir, hit);
+        const parent = path.dirname(dir);
+        if (parent === dir || existsSync(path.join(dir, ".git")))
+            return undefined;
+        dir = parent;
+    }
+}
 export const depsGate = {
     name: "dependencies",
     title: "Dependency vulnerabilities",
@@ -80,11 +96,12 @@ export const depsGate = {
     async run(ctx) {
         const t = Date.now();
         const findings = [];
-        const lock = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"].find((f) => existsSync(path.join(ctx.root, f)));
+        const lockPath = findLockfile(ctx.root);
+        const lock = lockPath ? path.basename(lockPath) : undefined;
         if (!lock)
             findings.push(finding("deps/lockfile-required", {}));
         if (await hasTool("osv-scanner")) {
-            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lock ?? "pnpm-lock.yaml"], ctx.root);
+            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lockPath ?? path.join(ctx.root, "pnpm-lock.yaml")], ctx.root);
             try {
                 const json = JSON.parse(r.stdout);
                 for (const res of json.results ?? [])

package/dist/gates/index.d.ts

@@ -4,6 +4,7 @@ export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor, type RuleDef } from "./rules.js";
 export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
+export { probeDeployment, skippedProbe, waitForDeployment, type FetchLike } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
 export declare const SOURCE_GATES: Gate[];
 /** Gates that need the built output. */

package/dist/gates/index.js

@@ -7,6 +7,7 @@ export { gateSummary, skippedGates } from "./types.js";
 export { RULES, ruleFor } from "./rules.js";
 export { mask } from "./secrets.js";
 export { MAX_ATTEMPTS, readAttempts } from "./attempts.js";
+export { probeDeployment, skippedProbe, waitForDeployment } from "./smoke.js";
 /** Gates that run on source, before the build. Suppressions first so a human sees them before anything else. */
 export const SOURCE_GATES = [suppressionsGate, secretsGate, gitleaksGate, depsGate, rulesGate, semgrepGate, policyGate, piiGate, typecheckGate];
 /** Gates that need the built output. */

package/dist/gates/rules.js

@@ -34,6 +34,7 @@ export const RULES = {
     "deps/audit-unavailable": { title: "Dependency audit could not run", severity: "warn", audience: "human", risk: "Vulnerable packages would not be detected this run.", fix: "Check network access and the package manager, then run `nerd verify` again." },
     "rules/platform": { title: "Platform rule", severity: "block", audience: "agent", risk: "The app would not run correctly on the platform.", fix: "Follow the instruction in the finding; the rules are listed in the nerdsystem skill." },
     "rules/advisory": { title: "Platform advisory", severity: "warn", audience: "agent", risk: "Not blocking, but the project is missing something the platform expects.", fix: "Follow the instruction in the finding." },
+    "rules/shape": { title: "Not in the nerdsystem shape", severity: "warn", audience: "human", risk: "Every app on nerdsystem is one shape: a Vite client, a Hono server on @nerdsystem/sdk, SQLite on D1, and a bucket. This repository is not in that shape. A clean scan says nothing about whether it would deploy here.", fix: "Start a project with `nerd init` and have the agent port the screens into it. The server and the login are rebuilt on the platform's sign-in and database. The compare pages on nerdsystem.com say what carries over." },
     "typecheck/error": { title: "TypeScript error", severity: "block", audience: "agent", risk: "The code would not compile reliably; the build may fail or behave unexpectedly.", fix: "Fix the type error at the file and line shown. Run `npx tsc -b` for the full message." },
     "typecheck/failed": { title: "Typecheck failed", severity: "block", audience: "agent", risk: "The project does not compile.", fix: "Run `npx tsc -b` and fix the errors it prints." },
     "policy/blocked-package": { title: "Package not allowed", severity: "block", audience: "agent", risk: "The package is a miner, proxy, or headless browser, which the acceptable use policy forbids and the platform cannot run.", fix: "Remove the package and the code that uses it. If the app genuinely needs a browser or scraping, say so to the person; it is not supported here." },

package/dist/gates/smoke.d.ts

@@ -0,0 +1,18 @@
+import { type GateResult } from "./types.js";
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+ * Waits until GET / on the deployed app answers (a response below 500 that is not the dispatcher's
+ * 404 for a script it does not know yet). Returns true as soon as it does; false after the last attempt.
+ */
+export declare function waitForDeployment(url: string, opts?: {
+    attempts?: number;
+    delayMs?: number;
+    fetchImpl?: FetchLike;
+}): Promise<boolean>;
+/**
+ * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
+ * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ */
+export declare function probeDeployment(url: string, fetchImpl?: FetchLike): Promise<GateResult>;
+/** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
+export declare function skippedProbe(reason: string): GateResult;

package/dist/gates/smoke.js

@@ -0,0 +1,99 @@
+/**
+ * Post-deploy probes against the live URL. The same checks the builder runs after a git build
+ * (apps/builder/image/build.mjs smokeGate), so `nerd deploy` reports the same findings.
+ * Deterministic and non-disruptive: three GETs and one login with made-up credentials.
+ * Findings are informational for the deploy command; the app is already live when they run.
+ */
+import { finding, fingerprint } from "./secrets.js";
+import { verdict } from "./types.js";
+const PROBE_TIMEOUT_MS = 10_000;
+const REQUIRED_HEADERS = ["x-content-type-options", "content-security-policy", "x-frame-options"];
+/** Default fetch wrapped so it is never called with a foreign `this` (workerd throws "Illegal invocation"). */
+const defaultFetch = (input, init) => fetch(input, init);
+function withTimeout(init) {
+    const signal = typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(PROBE_TIMEOUT_MS) : undefined;
+    return { redirect: "manual", ...(signal ? { signal } : {}), ...init };
+}
+function smokeFinding(ruleId, risk, key) {
+    return finding(ruleId, { risk, fingerprint: fingerprint(ruleId, key) });
+}
+function probeResult(findings, startedAt) {
+    const status = verdict(findings);
+    const blocks = findings.filter((f) => f.severity === "block").length;
+    const summary = blocks ? `${blocks} probe${blocks === 1 ? "" : "s"} failed` : findings.length ? `${findings.length} warning${findings.length === 1 ? "" : "s"}` : "All probes passed";
+    return { name: "smoke", title: "Deployed app probes", status, summary, findings, durationMs: Date.now() - startedAt, tool: "builtin" };
+}
+/**
+ * Waits until GET / on the deployed app answers (a response below 500 that is not the dispatcher's
+ * 404 for a script it does not know yet). Returns true as soon as it does; false after the last attempt.
+ */
+export async function waitForDeployment(url, opts = {}) {
+    const attempts = opts.attempts ?? 3;
+    const delayMs = opts.delayMs ?? 2000;
+    const fetchImpl = opts.fetchImpl ?? defaultFetch;
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const r = await fetchImpl(`${url}/`, withTimeout(undefined));
+            await r.body?.cancel().catch(() => { });
+            if (r.status < 500 && r.status !== 404)
+                return true;
+        }
+        catch {
+            // not reachable yet
+        }
+        if (i < attempts - 1)
+            await new Promise((r) => setTimeout(r, delayMs));
+    }
+    return false;
+}
+/**
+ * Runs the live-URL probes: security headers on GET /, GET /api/auth/me answers 200 with
+ * {"user":null} when signed out, and POST /api/auth/login with wrong credentials answers 401.
+ */
+export async function probeDeployment(url, fetchImpl = defaultFetch) {
+    const startedAt = Date.now();
+    const base = url.replace(/\/$/, "");
+    const findings = [];
+    const get = async (p, init) => {
+        try {
+            return await fetchImpl(`${base}${p}`, withTimeout(init));
+        }
+        catch (err) {
+            findings.push(smokeFinding("smoke/unreachable", `${p} could not be fetched: ${err instanceof Error ? err.message : String(err)}`, p));
+            return null;
+        }
+    };
+    const home = await get("/");
+    if (home) {
+        await home.body?.cancel().catch(() => { });
+        if (home.status >= 500)
+            findings.push(smokeFinding("smoke/unreachable", `GET / returned ${home.status}.`, "/:status"));
+        for (const h of REQUIRED_HEADERS) {
+            if (!home.headers.get(h))
+                findings.push(smokeFinding("smoke/header-missing", `The ${h} header is missing, so browsers lose a protection against clickjacking, content sniffing, or script injection.`, h));
+        }
+        if (base.startsWith("https://") && !home.headers.get("strict-transport-security"))
+            findings.push(smokeFinding("smoke/header-missing", "The strict-transport-security header is missing.", "strict-transport-security"));
+    }
+    const me = await get("/api/auth/me");
+    if (me) {
+        const body = await me.text().catch(() => "");
+        if (me.status !== 200 || !body.includes('"user":null'))
+            findings.push(smokeFinding("smoke/auth-me", `GET /api/auth/me without a session returned ${me.status} instead of 200 with {"user":null}.`, "/api/auth/me"));
+    }
+    const login = await get("/api/auth/login", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ email: "probe@nerdsystem.invalid", password: "definitely-wrong-password" }),
+    });
+    if (login) {
+        await login.body?.cancel().catch(() => { });
+        if (login.status !== 401)
+            findings.push(smokeFinding("smoke/auth-login", `Wrong credentials returned ${login.status} instead of 401.`, "/api/auth/login"));
+    }
+    return probeResult(findings, startedAt);
+}
+/** The result recorded when the probe did not run, so --json consumers see why rather than a missing key. */
+export function skippedProbe(reason) {
+    return { name: "smoke", title: "Deployed app probes", status: "skip", summary: reason, findings: [], durationMs: 0, tool: "builtin" };
+}

package/dist/project.js

@@ -8,7 +8,7 @@ export function findProjectRoot(start = process.cwd()) {
             return dir;
         const parent = path.dirname(dir);
         if (parent === dir)
-            throw new CliError("No nerd.json found. Run this inside a nerdsystem app, or create one with `nerd init <dir>`.");
+            throw new CliError("No nerd.json found. Run this inside an app created by `nerd init`, link a folder already in the nerdsystem shape with `nerd link --slug <project>`, or create one with `nerd init <dir>`.");
         dir = parent;
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.8",
-  "description": "nerd: deploy apps to nerdsystem from the terminal or a coding agent.",
+  "version": "0.0.9",
+  "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {
     "nerd": "./dist/index.js"
@@ -44,6 +44,8 @@
     "deploy",
     "cli",
     "claude-code",
+    "cursor",
+    "codex",
     "vibe-coding"
   ],
   "publishConfig": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -20,6 +20,17 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
@@ -116,7 +127,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -21,6 +21,17 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
@@ -117,7 +128,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,6 +17,17 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,6 +17,17 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (088a9335c558); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -17,6 +17,17 @@ If this project still has the template's todo app (the `todos` table and `src/se
 
 Throughout, show commands rather than describing them, and never ask the person to edit config files; the platform owns `wrangler.jsonc` and `nerd.json`.
 
+## Porting an app built somewhere else into this project
+
+When the person built the app on Lovable, Bolt, Replit, Vercel, or another host and wants it here, the screens carry over and the server is rebuilt on the platform's sign-in and database. Say that in one line before starting, then work in this order and run `nerd check` after each step:
+
+1. Keep `src/client/`. Port the screens into the template's client and route them with `src/client/router.tsx` or a router of your choice. Replace the old sign-in, sign-up, and password UI with the forms from `src/client/auth.tsx`; the old auth client code (Supabase, Firebase, Clerk, hand-rolled tokens) is deleted, not adapted.
+2. Rebuild the server as routers under `/api/...` on `createNerdApp()`. Each old endpoint, serverless function, or edge function becomes a Hono route in `src/server/routes/<name>.ts`. The login is a service the agent does not write.
+3. Define the schema in `src/server/db/schema.ts` (Drizzle, SQLite dialect) and run `pnpm db:generate`. Every table that holds user data carries `user_id`, and every query filters by `c.var.user.id`.
+4. Any key the old app held goes into `.dev.vars` locally and `nerd secret set NAME` for production, never into the code.
+
+Tell the person plainly what does not carry. Their users sign up again on the new login; there is no account import. Postgres-only features (row-level security policies, extensions), Next.js server features (server components, API routes, middleware), Lovable Cloud functions, Supabase edge functions, and any long-running process are rewritten or dropped. Say which ones you hit as you go rather than at the end.
+
 ## The loop
 
 1. Make the change.
@@ -113,7 +124,7 @@ Without MCP, `nerd check --json` returns the same shape, and `nerd check --rule
 
 - **Scheduled jobs**: put the work in the `POST /api/cron` handler (already in `src/server/index.ts`, guarded by `verifyCron()`), then turn the schedule on with `nerd cron hourly` or `nerd cron daily`. The platform calls it; the app never needs its own timer.
 - **Secrets** (Stripe keys, API tokens): never in code or in the client. Locally they live in `.dev.vars` (gitignored). For production, ask the person to run `nerd secret set NAME` and paste the value; it reaches the app as `c.env.NAME` on the next deploy. Pull request previews do not get it unless it was set with `--previews` (use that only for keys that are safe in a preview, such as a test-mode key). `nerd secret list` shows names only. Do not put a real secret value in any command you run yourself.
-- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 2,000 on Pro at $39 a month, 10,000 on Studio), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
+- **Email**: `sendEmail(c.env, { to, subject, text, html? })` from `@nerdsystem/sdk` sends through the platform. It is limited per day by plan (50 on Free, 1,000 on Pro at $39 a month, 2,000 on Studio at $99 a month), so use it for transactional mail such as receipts and notifications, not bulk. Plans can be paid monthly or yearly at ten times the monthly price.
 
 ## Debugging production