nexus-deploy

name	nexus-deploy
description	Safe deployment pipeline skill for NEXUS. Runs pre-flight checks (TypeScript, build, tests, slop audit, security), executes Firebase deploy, and validates with post-deploy health checks. Always load nexus-core first. Prevents broken deploys during the critical launch phase.

NEXUS Deploy — Safe Deployment Pipeline (Layer 1)

Prerequisite: Load nexus-core kernel before running this skill.

---

Pipeline Stages

Stage 1: Pre-Flight Checks

Run ALL checks before deploying. If ANY fails, STOP.

# 1.1 TypeScript — MUST pass with 0 errors
npx tsc --noEmit
# Expected: 0 errors
# If fails: Fix types FIRST. Do not proceed.

# 1.2 Build — MUST produce clean output
npx vite build
# Expected: clean build, no warnings about missing modules
# Check: bundle sizes within budget (module chunks <200KB, jsPDF <600KB)

# 1.3 Critical Path Tests — MUST pass 100%
npx vitest run src/tests/services/ProtocolOrchestrator.test.ts
npx vitest run src/tests/integration/ProtocolDispatchFlow.test.ts
npx vitest run src/tests/hooks/useProtocolGeneration.test.ts
npx vitest run src/tests/agents/ValidatorAgent.test.ts
# These protect revenue-generating flows. Failure = DO NOT DEPLOY.

# 1.4 Full Test Suite — compare count
npx vitest run
# Expected: 1680+ tests passing. If count dropped, investigate before deploying.

# 1.5 Environment Check
# Verify .env.production has all required VITE_* vars
# Verify functions/.env has all required secrets
# Verify NO secrets in committed code

Stage 2: Slop Audit (optional but recommended)

# Quick slop audit before deploy
# Run nexus-slop-killer in audit mode
# Focus on: console.logs that might leak PII, dead imports inflating bundle

If console.logs with patient data found → STOP and clean first (LGPD risk).

Stage 3: Security Gate

Check before deploy:
- [ ] No new .env files in git staging
- [ ] No hardcoded API keys in committed files
- [ ] Firestore rules haven't been weakened
- [ ] No PII in console.log statements
- [ ] Cloud Functions have input validation (Zod)
- [ ] Rate limiting active on public endpoints

Stage 4: Deploy Execution

Deploy Everything (hosting + functions)

cd nexus-app && npx firebase-tools deploy --only functions,hosting --project nexus-72034052-d80bc

Deploy Hosting Only (frontend changes only)

cd nexus-app && npx firebase-tools deploy --only hosting --project nexus-72034052-d80bc

Deploy Functions Only (backend changes only)

cd nexus-app && npx firebase-tools deploy --only functions --project nexus-72034052-d80bc

Decision matrix — what to deploy:

Changed	Deploy
Only src/ files (UI/stores/services)	Hosting only
Only functions/src/ files	Functions only
Both src/ and functions/	Everything
firestore.rules	--only firestore:rules
firestore.indexes.json	--only firestore:indexes

Stage 5: Post-Deploy Validation

After deploy completes, verify:

# 5.1 Hosting is live
curl -s -o /dev/null -w "%{http_code}" https://nexushealthtech.com.br
# Expected: 200

# 5.2 Check deploy status
npx firebase-tools hosting:channel:list --project nexus-72034052-d80bc

# 5.3 Functions deployed (check list)
npx firebase-tools functions:list --project nexus-72034052-d80bc

Manual Smoke Test Checklist

- [ ] Landing page loads at nexushealthtech.com.br
- [ ] Login page accessible at /login
- [ ] Dashboard loads after login
- [ ] At least one module page loads (e.g., /protocols)
- [ ] Stripe checkout flow initiates
- [ ] Public booking page loads (/agendar/:clinicId)

---

Deployment Modes

deploy:safe (default)

Full pipeline: pre-flight → slop audit → security gate → deploy → validate. Use for: Sprint releases, significant changes.

deploy:quick

Minimal pipeline: tsc + build → deploy hosting only → curl health check. Use for: Hotfixes, copy changes, small UI tweaks.

deploy:functions

Functions-specific: tsc (functions/) + deploy functions → list functions. Use for: Backend-only changes (new Cloud Function, webhook fix).

---

Rollback Plan

If post-deploy validation fails:

# Option 1: Rollback to previous hosting version
npx firebase-tools hosting:clone nexus-72034052-d80bc:live nexus-72034052-d80bc:live --version PREVIOUS_VERSION_ID

# Option 2: Revert and redeploy
git log --oneline -5  # Find last good commit
git revert HEAD        # Revert the broken commit
npx vite build && npx firebase-tools deploy --only hosting --project nexus-72034052-d80bc

# Option 3: For functions — redeploy specific function
npx firebase-tools deploy --only functions:FUNCTION_NAME --project nexus-72034052-d80bc

---

Bundle Size Budget

Track these on every deploy:

Chunk	Budget	Alert if
Module chunks (each)	<200KB raw	>200KB
jsPDF	<600KB (lazy)	>600KB
Vendor chunk	<300KB	>300KB
Total initial load	<500KB gz	>500KB gz

# After vite build, check output:
# Look for lines like: dist/assets/EndoInjectModule-XXXX.js  149.23 kB │ gzip: 39.12 kB
# Any chunk exceeding budget = investigate before deploying

---

Integration with Quality Gates

This skill orchestrates Layer 2 gates automatically:

Gate	When	What
regression-shield	Stage 1.3-1.4	Critical path + full suite tests
protocol-integrity	If protocol files changed	Safety gates, SHA-256, shapes
firestore-rules-audit	If rules file changed	Permissions, LGPD compliance
nexus-slop-killer	Stage 2	Console.log audit, PII check

---

Deploy Log

After successful deploy, report:

## Deploy Report — [DATE] [TIME]
**Mode:** safe | quick | functions
**Branch:** [branch name]
**Commit:** [short hash + message]

### Pre-Flight
- tsc: PASS (0 errors)
- build: PASS (bundle: XXkB gz)
- tests: PASS (XXXX/XXXX)
- slop audit: PASS (X console.logs found, 0 PII)
- security: PASS

### Deploy
- Target: hosting | functions | both
- Duration: Xs
- Status: SUCCESS

### Post-Deploy
- Health check: 200 OK
- Functions: XX deployed
- Smoke test: [checklist status]