nerdsystem 0.0.9 → 0.0.10

package/dist/commands/check.js

@@ -121,7 +121,7 @@ export async function runChecks(root, opts) {
     }
     if (opts.typecheck && problems.every((p) => p.endsWith("(warning)") || p.startsWith("Agent instruction files"))) {
         log.step("Typechecking");
-        const code = await run("npx", ["tsc", "-b", "--pretty"], { cwd: root });
+        const code = await run("npx", ["tsc", "-b", "--pretty"], { cwd: root, stdoutToStderr: true });
         if (code !== 0)
             problems.push("Typecheck failed (see errors above).");
     }
@@ -144,7 +144,9 @@ export async function check(opts) {
         }
     }
     // Loaded here, not at the top: the gates import staticChecks from this file.
-    const { runVerify } = await import("./verify.js");
+    const { runVerify, assertRuleHasGate } = await import("./verify.js");
+    if (opts.rule)
+        assertRuleHasGate(opts.rule);
     const out = await runVerify(root, { withBuild: !opts["no-build"], stopOnFail: false, quiet: opts.json, onlyRules: opts.rule ? [opts.rule] : undefined });
     const failed = out.results.filter((r) => r.status === "fail").length;
     if (opts.json)

package/dist/commands/deploy.js

@@ -65,7 +65,10 @@ async function probeAfterDeploy(deployment, url, skip) {
         return skippedProbe("--skip-probe was given");
     if (deployment.status !== "live")
         return skippedProbe(`the deployment status is ${deployment.status}, not live`);
-    await waitForDeployment(url);
+    // Until the dispatcher knows the new script it answers its own 404 page, which has none of the app's
+    // headers or routes; probing that would report false auth failures. Wait, and say so when it never came.
+    if (!(await waitForDeployment(url)))
+        return skippedProbe("the app had not started answering within 30 seconds; open the URL to check, or run nerd deploy again to probe it");
     return probeDeployment(url);
 }
 function printProbe(url, probes) {
@@ -99,7 +102,7 @@ export async function deploy(opts) {
     if (!opts["skip-build"]) {
         log.step("Building with vite");
         ensureDeps(root);
-        await runOrThrow("npx", ["vite", "build"], { cwd: root });
+        await runOrThrow("npx", ["vite", "build"], { cwd: root, stdoutToStderr: true });
     }
     const build = readBuildOutput(root);
     const built = await runGates(BUILD_GATES, { root, build, knownSecrets, log: (l) => log.info(l) }, { stopOnFail: true });
@@ -127,10 +130,12 @@ export async function deploy(opts) {
     }
     const { deployment } = await api.post(projectPath(nerd, "/deployments"), form);
     const { project } = await api.get(projectPath(nerd));
+    log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
+    if (!opts["skip-probe"] && deployment.status === "live")
+        log.step(`Probing ${project.url}`);
     const probes = await probeAfterDeploy(deployment, project.url, Boolean(opts["skip-probe"]));
     if (opts.json)
         return printJson({ deployment, url: project.url, migrations: mig, probes });
-    log.ok(`Deployed ${deployment.id} (${deployment.status}) → ${project.url}`);
     printProbe(project.url, probes);
     log.info(`First time? Sign up on your app at ${project.url}, then make yourself admin in the dashboard's Auth tab: ${dashboardUrl(api.apiUrl)}/app/${nerd.org}/projects/${nerd.project}/auth`);
 }

package/dist/commands/init.js

@@ -174,4 +174,4 @@ export async function init(dir, args) {
     log.ok(`Ready. Next:\n  cd ${dir}\n  pnpm install\n  nerd dev\n\nThen open the folder in your coding agent and ask it to build the first feature; the nerdsystem skill walks it through.\nDeploys go to ${project.url}`);
 }
 // Kept in sync with packages/sdk/package.json by the release script.
-const SDK_VERSION = "0.0.9";
+const SDK_VERSION = "0.0.10";

package/dist/commands/login.js

@@ -28,7 +28,7 @@ export async function login(args) {
         else {
             log.info(`Open this link in your browser and approve code ${start.userCode}:\n\n  ${start.verificationUrl}\n`);
             if (args.email)
-                log.info(`An email went to ${args.email}: one click signs you in (creating your account if you are new) and approves.`);
+                log.info(`An email went to ${args.email}: the link signs you in (creating your account if you are new) and opens a page where you press Approve.`);
             log.info("Waiting for approval…");
         }
     }

package/dist/commands/verify.d.ts

@@ -17,6 +17,8 @@ export declare function runVerify(root: string, opts: {
     onlyRules?: string[] | undefined;
     trackAttempts?: boolean;
 }): Promise<VerifyOutput>;
+/** `--rule smoke/x` would select no gate and report "All 0 gates passed"; say which prefixes a gate owns instead. */
+export declare function assertRuleHasGate(rule: string): void;
 export declare function verify(opts: {
     json: boolean;
     "no-build": boolean;

package/dist/commands/verify.js

@@ -35,8 +35,19 @@ export async function runVerify(root, opts) {
     }
     return { ok: results.every((r) => r.status !== "fail"), failures, stop, results };
 }
+/** `--rule smoke/x` would select no gate and report "All 0 gates passed"; say which prefixes a gate owns instead. */
+export function assertRuleHasGate(rule) {
+    const prefixes = [...new Set([...SOURCE_GATES, ...BUILD_GATES].flatMap((g) => g.rulePrefixes))];
+    if (prefixes.some((p) => rule.startsWith(p)))
+        return;
+    if (rule.startsWith("smoke/"))
+        throw new CliError(`No gate runs ${rule} on the source: the live URL is probed by nerd deploy. Deploy again to re-check it.`, 2);
+    throw new CliError(`No gate runs ${rule}. Rule ids start with one of: ${prefixes.join(", ")}`, 2);
+}
 export async function verify(opts) {
     const root = findProjectRoot();
+    if (opts.rule)
+        assertRuleHasGate(opts.rule);
     const out = await runVerify(root, { withBuild: !opts["no-build"], stopOnFail: false, quiet: opts.json, onlyRules: opts.rule ? [opts.rule] : undefined });
     if (opts.json)
         process.stdout.write(`${JSON.stringify({ ok: out.ok, failures: out.failures, stop: out.stop, skipped: skippedGates(out.results) }, null, 2)}\n`);

package/dist/gates/code.js

@@ -73,14 +73,16 @@ export function depsRuleFor(severity) {
 }
 /** Known vulnerabilities in dependencies. Critical and high block; moderate warns. Package names come from the registry, not the repo. */
 /**
- * The lockfile for the project: in its root, or in an ancestor up to the repository root (the directory holding .git),
- * since a workspace member such as the template inside this monorepo shares the lockfile committed at the top.
+ * The lockfile for the project: in its root, or in an ancestor that is itself a package or workspace root
+ * (it holds a package.json or pnpm-workspace.yaml), searched up to the repository root (the directory holding
+ * .git). A workspace member such as the template inside this monorepo shares the lockfile committed at the top;
+ * a stray lockfile in an unrelated ancestor such as the home folder is never adopted.
  */
 function findLockfile(start) {
     let dir = start;
     for (;;) {
         const hit = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock"].find((f) => existsSync(path.join(dir, f)));
-        if (hit)
+        if (hit && (dir === start || existsSync(path.join(dir, "package.json")) || existsSync(path.join(dir, "pnpm-workspace.yaml"))))
             return path.join(dir, hit);
         const parent = path.dirname(dir);
         if (parent === dir || existsSync(path.join(dir, ".git")))
@@ -101,7 +103,8 @@ export const depsGate = {
         if (!lock)
             findings.push(finding("deps/lockfile-required", {}));
         if (await hasTool("osv-scanner")) {
-            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lockPath ?? path.join(ctx.root, "pnpm-lock.yaml")], ctx.root);
+            // Run from the lockfile's own folder with a bare name: on Windows the shell would split an absolute path with a space.
+            const r = await exec("osv-scanner", ["scan", "source", "--format", "json", "--lockfile", lock ?? "pnpm-lock.yaml"], lockPath ? path.dirname(lockPath) : ctx.root);
             try {
                 const json = JSON.parse(r.stdout);
                 for (const res of json.results ?? [])

package/dist/gates/smoke.js

@@ -14,8 +14,10 @@ function withTimeout(init) {
     const signal = typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(PROBE_TIMEOUT_MS) : undefined;
     return { redirect: "manual", ...(signal ? { signal } : {}), ...init };
 }
+/** No gate owns the smoke/ prefix, so `nerd verify --rule smoke/...` would run nothing; the way to re-check is another deploy. */
+const VERIFY = "nerd deploy (the live URL is probed after every deploy)";
 function smokeFinding(ruleId, risk, key) {
-    return finding(ruleId, { risk, fingerprint: fingerprint(ruleId, key) });
+    return { ...finding(ruleId, { risk, fingerprint: fingerprint(ruleId, key) }), verify: VERIFY };
 }
 function probeResult(findings, startedAt) {
     const status = verdict(findings);
@@ -28,7 +30,7 @@ function probeResult(findings, startedAt) {
  * 404 for a script it does not know yet). Returns true as soon as it does; false after the last attempt.
  */
 export async function waitForDeployment(url, opts = {}) {
-    const attempts = opts.attempts ?? 3;
+    const attempts = opts.attempts ?? 8;
     const delayMs = opts.delayMs ?? 2000;
     const fetchImpl = opts.fetchImpl ?? defaultFetch;
     for (let i = 0; i < attempts; i++) {

package/dist/util.d.ts

@@ -10,22 +10,22 @@ export declare class CliError extends Error {
     });
 }
 /** The one sentence every unauthenticated command prints, with both ways in. */
-export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
+export declare const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (the link in the email signs you in, creating your account the first time, and opens a page where you press Approve), or set NERD_TOKEN to an API token for scripts.";
 export declare const log: {
     info: (msg: string) => void;
     step: (msg: string) => void;
     ok: (msg: string) => void;
     warn: (msg: string) => void;
 };
-/** Runs a command, streaming output. Resolves with the exit code. */
-export declare function run(cmd: string, args: string[], opts?: {
-    cwd?: string;
-    env?: NodeJS.ProcessEnv;
-}): Promise<number>;
-export declare function runOrThrow(cmd: string, args: string[], opts?: {
+export interface RunOptions {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
-}): Promise<void>;
+    /** Send the child's stdout to our stderr, so stdout stays reserved for `--json` output. */
+    stdoutToStderr?: boolean;
+}
+/** Runs a command, streaming output. Resolves with the exit code. */
+export declare function run(cmd: string, args: string[], opts?: RunOptions): Promise<number>;
+export declare function runOrThrow(cmd: string, args: string[], opts?: RunOptions): Promise<void>;
 export declare function printJson(value: unknown): void;
 export declare function table(rows: Record<string, unknown>[], columns: string[]): void;
 /** The dashboard that goes with an API origin (https://api.nerdsystem.com -> https://nerdsystem.com). */

package/dist/util.js

@@ -15,7 +15,7 @@ export class CliError extends Error {
     }
 }
 /** The one sentence every unauthenticated command prints, with both ways in. */
-export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (one click in the email signs you in and creates your account the first time), or set NERD_TOKEN to an API token for scripts.";
+export const NOT_LOGGED_IN = "Not logged in. Run `nerd login --email you@example.com` (the link in the email signs you in, creating your account the first time, and opens a page where you press Approve), or set NERD_TOKEN to an API token for scripts.";
 export const log = {
     info: (msg) => console.error(`${msg}`),
     step: (msg) => console.error(`\x1b[36m›\x1b[0m ${msg}`),
@@ -25,7 +25,8 @@ export const log = {
 /** Runs a command, streaming output. Resolves with the exit code. */
 export function run(cmd, args, opts = {}) {
     return new Promise((resolve, reject) => {
-        const child = spawn(cmd, args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: "inherit", shell: process.platform === "win32" });
+        const child = spawn(cmd, args, { cwd: opts.cwd, env: { ...process.env, ...opts.env }, stdio: ["inherit", opts.stdoutToStderr ? "pipe" : "inherit", "inherit"], shell: process.platform === "win32" });
+        child.stdout?.pipe(process.stderr);
         child.on("error", reject);
         child.on("exit", (code) => resolve(code ?? 1));
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nerdsystem",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "description": "nerd: start, check, and deploy a web app on nerdsystem from the terminal or a coding agent.",
   "type": "module",
   "bin": {

package/template/.claude/skills/nerdsystem/SKILL.md

@@ -36,14 +36,14 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 

package/template/.cursor/rules/nerdsystem.mdc

@@ -2,7 +2,7 @@
 description: How to build, run, and deploy this app on nerdsystem. Applies to server, database, auth, and deploy work.
 alwaysApply: true
 ---
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -37,14 +37,14 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 

package/template/.github/copilot-instructions.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,14 +33,14 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 

package/template/AGENTS.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,14 +33,14 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go
 

package/template/GEMINI.md

@@ -1,4 +1,4 @@
-<!-- generated from .claude/skills/nerdsystem/SKILL.md (f8685cd08ad1); edit the skill, then run: nerd agents sync -->
+<!-- generated from .claude/skills/nerdsystem/SKILL.md (10dcd79a44bd); edit the skill, then run: nerd agents sync -->
 
 # Building on nerdsystem
 
@@ -33,14 +33,14 @@ Tell the person plainly what does not carry. Their users sign up again on the ne
 1. Make the change.
 2. `nerd check` (static rules, then typecheck). Fix anything it reports.
 3. `nerd dev` to run locally when you need to try it. The local app talks to the real auth service, so signup and login work exactly as in production.
-4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, and prints the URL.
+4. `nerd deploy` when it is ready. It runs the checks, builds, applies pending migrations, uploads, prints the URL, and probes the live URL (headers and the sign-in routes). With `--json` the output carries `probes`, the same shape as a check result, with `status: "skip"` and the reason when it did not run; probe findings never fail the deploy.
 5. If something is wrong after deploying: `nerd logs` shows recent output from the deployed app (`--q` to search, `--pr 12` for a preview), `nerd deployments` shows status and errors, `nerd db query "..."` inspects production data.
 
 Run `nerd check --json` when you want a machine-readable list of problems. Its summary says how many gates ran and which were skipped (`skipped` in the JSON): semgrep and gitleaks only run locally when installed; git builds always run them in the builder.
 
 ## Deploying from GitHub
 
-Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically (for accounts younger than seven days, counted from the nerdsystem account's creation, git builds are deferred: deploy with `nerd deploy` from the machine until then), and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
+Once the repo is linked (`nerd github connect`, then `nerd github link owner/repo`), every push to the production branch builds and deploys automatically, and every pull request gets a preview at its own URL, posted as a PR comment. `nerd builds` lists builds; `nerd builds show <id>` prints the log when one fails. A failing build reports the same `nerd check` problems you would see locally, so fix and push again. Every preview gets its own database and bucket, and pending migrations are applied to it on each preview build, so a PR that changes the schema can be tried end to end before it merges.
 
 ## Where things go