@ericminassian/plat 0.0.0-stage → 0.2.0

package/src/api.ts

@@ -0,0 +1,341 @@
+/**
+ * Typed client for the control plane API (`/v1`). Route shapes follow the
+ * design in docs/DESIGN.md; list endpoints return `{ <plural>: [...] }`.
+ *
+ * Auth, in order: an explicit token, GitHub Actions OIDC (CI), the token
+ * stored by `plat login`.
+ */
+import {
+  type AppRecord,
+  type AppSummary,
+  type CliLoginRequest,
+  type CliLoginResponse,
+  type CreateAppRequest,
+  type CreateDeploymentRequest,
+  type CreateDeploymentResponse,
+  type DataPage,
+  type DeploymentRecord,
+  type ErrorGroup,
+  type JobStats,
+  type LogLine,
+  type LogsResponse,
+  type MeResponse,
+  type MetricsResponse,
+  PLATFORM_DEFAULTS,
+  type QueueStats,
+  type Resolution,
+  type RouteStats,
+  type SecretInfo,
+  type StageRecord,
+  type StoredObjectInfo,
+  type TraceResponse,
+} from './api-types.ts';
+import { isExpired, loadCredentials } from './credentials.ts';
+import { canUseOidc, fetchOidcToken } from './github.ts';
+import { CliError, EXIT } from './util/output.ts';
+
+export function apiBaseUrl(env = process.env): string {
+  return (env.PLATFORM_API_URL || PLATFORM_DEFAULTS.apiUrl).replace(/\/$/, '');
+}
+
+export class ApiError extends CliError {
+  readonly status: number;
+  readonly code: string;
+  constructor(status: number, code: string, message: string) {
+    super(message, {
+      hint: hintFor(status),
+      exitCode: status === 401 || status === 403 ? EXIT.auth : status === 404 ? EXIT.notFound : EXIT.error,
+    });
+    this.status = status;
+    this.code = code;
+  }
+}
+
+function hintFor(status: number): string | undefined {
+  if (status === 401) return 'run `plat login` (or check the CI workflow has `id-token: write`)';
+  if (status === 403) return 'you are not allowed to do this; ask a platform admin';
+  if (status === 404) return 'check the app/stage name with `plat apps list` / `plat stages`';
+  return undefined;
+}
+
+export type AuthMode = 'auto' | 'token' | 'oidc' | 'none';
+
+export interface ApiClientOptions {
+  baseUrl?: string;
+  token?: string;
+  auth?: AuthMode;
+  fetch?: typeof fetch;
+}
+
+type Query = Record<string, string | number | boolean | undefined>;
+
+export class ApiClient {
+  readonly baseUrl: string;
+  private readonly fetchImpl: typeof fetch;
+  private readonly authMode: AuthMode;
+  private token?: string;
+
+  constructor(opts: ApiClientOptions = {}) {
+    this.baseUrl = (opts.baseUrl ?? apiBaseUrl()).replace(/\/$/, '');
+    this.fetchImpl = opts.fetch ?? fetch;
+    this.authMode = opts.auth ?? 'auto';
+    this.token = opts.token;
+  }
+
+  /** The bearer token this client will send (resolved lazily). */
+  async authorization(): Promise<string | undefined> {
+    if (this.token) return this.token;
+    if (this.authMode === 'none') return undefined;
+    if (this.authMode !== 'token' && canUseOidc()) {
+      this.token = await fetchOidcToken(PLATFORM_DEFAULTS.oidcAudience);
+      return this.token;
+    }
+    if (this.authMode === 'oidc') {
+      throw new CliError('GitHub Actions OIDC is not available here', { exitCode: EXIT.auth });
+    }
+    const creds = loadCredentials();
+    if (!creds) throw new CliError('not logged in', { hint: 'run `plat login`', exitCode: EXIT.auth });
+    if (isExpired(creds))
+      throw new CliError('your platform login has expired', {
+        hint: 'run `plat login`',
+        exitCode: EXIT.auth,
+      });
+    if (creds.apiUrl.replace(/\/$/, '') !== this.baseUrl) {
+      throw new CliError(`stored login is for ${creds.apiUrl}, not ${this.baseUrl}`, {
+        hint: 'run `plat login` again',
+        exitCode: EXIT.auth,
+      });
+    }
+    this.token = creds.token;
+    return this.token;
+  }
+
+  url(path: string, query?: Query): string {
+    const u = new URL(this.baseUrl + path);
+    for (const [k, v] of Object.entries(query ?? {}))
+      if (v !== undefined && v !== '') u.searchParams.set(k, String(v));
+    return u.toString();
+  }
+
+  async request<T>(method: string, path: string, opts: { query?: Query; body?: unknown } = {}): Promise<T> {
+    const headers: Record<string, string> = { accept: 'application/json' };
+    const auth = await this.authorization();
+    if (auth) headers.authorization = `Bearer ${auth}`;
+    if (opts.body !== undefined) headers['content-type'] = 'application/json';
+    let res: Response;
+    try {
+      res = await this.fetchImpl(this.url(path, opts.query), {
+        method,
+        headers,
+        body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
+      });
+    } catch (err) {
+      throw new CliError(`can't reach the platform API at ${this.baseUrl}: ${(err as Error).message}`, {
+        hint: 'set PLATFORM_API_URL if the API lives elsewhere',
+      });
+    }
+    const text = await res.text();
+    const body = text ? safeJson(text) : undefined;
+    if (!res.ok) {
+      const e = (body as { error?: { code?: string; message?: string } } | undefined)?.error;
+      throw new ApiError(
+        res.status,
+        e?.code ?? `http_${res.status}`,
+        e?.message ?? `${method} ${path} failed (HTTP ${res.status})`,
+      );
+    }
+    return body as T;
+  }
+
+  /** Server-sent events stream; yields parsed `data:` payloads. */
+  async *stream<T>(path: string, query?: Query, signal?: AbortSignal): AsyncGenerator<T> {
+    const headers: Record<string, string> = { accept: 'text/event-stream' };
+    const auth = await this.authorization();
+    if (auth) headers.authorization = `Bearer ${auth}`;
+    const res = await this.fetchImpl(this.url(path, query), { headers, signal });
+    if (!res.ok || !res.body)
+      throw new ApiError(res.status, `http_${res.status}`, `stream ${path} failed (HTTP ${res.status})`);
+    const decoder = new TextDecoder();
+    let buf = '';
+    for await (const chunk of res.body as unknown as AsyncIterable<Uint8Array>) {
+      buf += decoder.decode(chunk, { stream: true });
+      let idx = buf.indexOf('\n\n');
+      while (idx !== -1) {
+        const frame = buf.slice(0, idx);
+        buf = buf.slice(idx + 2);
+        const data = frame
+          .split('\n')
+          .filter((l) => l.startsWith('data:'))
+          .map((l) => l.slice(5).trimStart())
+          .join('\n');
+        if (data) yield safeJson(data) as T;
+        idx = buf.indexOf('\n\n');
+      }
+    }
+  }
+
+  // ------------------------------------------------------------- auth
+  login(req: CliLoginRequest) {
+    return this.request<CliLoginResponse>('POST', '/v1/auth/cli', { body: req });
+  }
+  me() {
+    return this.request<MeResponse>('GET', '/v1/me');
+  }
+
+  // ------------------------------------------------------------- apps
+  async listApps(): Promise<AppSummary[]> {
+    return list(await this.request('GET', '/v1/apps'), 'apps');
+  }
+  getApp(app: string) {
+    return this.request<AppSummary>('GET', `/v1/apps/${enc(app)}`);
+  }
+  createApp(req: CreateAppRequest) {
+    return this.request<AppRecord>('POST', '/v1/apps', { body: req });
+  }
+  /** Unregister an app. The API refuses while any stage is still live. */
+  deleteApp(app: string) {
+    return this.request<unknown>('DELETE', `/v1/apps/${enc(app)}`);
+  }
+
+  // ------------------------------------------------------------- stages & deployments
+  async listStages(app: string): Promise<StageRecord[]> {
+    return list(await this.request('GET', `/v1/apps/${enc(app)}/stages`), 'stages');
+  }
+  destroyStage(app: string, stage: string) {
+    // The API requires an explicit confirmation to destroy prod.
+    return this.request<unknown>('DELETE', `/v1/apps/${enc(app)}/stages/${enc(stage)}`, {
+      query: stage === 'prod' ? { confirm: app } : {},
+    });
+  }
+  rollback(app: string, stage: string, toDeployment?: string) {
+    return this.request<DeploymentRecord | StageRecord>(
+      'POST',
+      `/v1/apps/${enc(app)}/stages/${enc(stage)}/rollback`,
+      {
+        body: toDeployment ? { deploymentId: toDeployment } : {},
+      },
+    );
+  }
+  createDeployment(app: string, req: CreateDeploymentRequest) {
+    return this.request<CreateDeploymentResponse>('POST', `/v1/apps/${enc(app)}/deployments`, { body: req });
+  }
+  startDeployment(id: string) {
+    return this.request<DeploymentRecord>('POST', `/v1/deployments/${enc(id)}/start`, { body: {} });
+  }
+  getDeployment(id: string) {
+    return this.request<DeploymentRecord>('GET', `/v1/deployments/${enc(id)}`);
+  }
+  async listDeployments(app: string, stage?: string): Promise<DeploymentRecord[]> {
+    return list(
+      await this.request('GET', `/v1/apps/${enc(app)}/deployments`, { query: { stage } }),
+      'deployments',
+    );
+  }
+
+  // ------------------------------------------------------------- observability
+  metrics(app: string, q: { stage: string; from: number; to: number; res: Resolution }) {
+    return this.request<MetricsResponse>('GET', `/v1/apps/${enc(app)}/metrics`, { query: q });
+  }
+  async routes(app: string, q: { stage: string; from: number; to: number }): Promise<RouteStats[]> {
+    return list(await this.request('GET', `/v1/apps/${enc(app)}/routes`, { query: q }), 'routes');
+  }
+  async jobs(
+    app: string,
+    q: { stage: string; from: number; to: number },
+  ): Promise<{ jobs: JobStats[]; queues: QueueStats[] }> {
+    const [body, queues] = await Promise.all([
+      this.request<{ jobs?: JobStats[] }>('GET', `/v1/apps/${enc(app)}/jobs`, { query: q }),
+      this.request<QueueStats[]>('GET', `/v1/apps/${enc(app)}/queues`, { query: { stage: q.stage } }),
+    ]);
+    return { jobs: body?.jobs ?? [], queues: Array.isArray(queues) ? queues : [] };
+  }
+  async errors(app: string, q: { stage: string }): Promise<ErrorGroup[]> {
+    return list(await this.request('GET', `/v1/apps/${enc(app)}/errors`, { query: q }), 'errors');
+  }
+  logs(
+    app: string,
+    q: { stage: string; from: number; to?: number; filter?: string; nextToken?: string; limit?: number },
+  ) {
+    const { filter, nextToken, ...rest } = q;
+    return this.request<LogsResponse>('GET', `/v1/apps/${enc(app)}/logs`, {
+      query: { ...rest, ...(filter ? { q: filter } : {}), ...(nextToken ? { next: nextToken } : {}) },
+    });
+  }
+  tailLogs(app: string, q: { stage: string; filter?: string }, signal?: AbortSignal) {
+    return this.stream<LogLine>(
+      `/v1/apps/${enc(app)}/logs/tail`,
+      { stage: q.stage, ...(q.filter ? { q: q.filter } : {}) },
+      signal,
+    );
+  }
+  trace(app: string, trace: string, q: { stage: string }) {
+    return this.request<TraceResponse>('GET', `/v1/apps/${enc(app)}/traces/${enc(trace)}`, { query: q });
+  }
+
+  // ------------------------------------------------------------- data
+  async collections(app: string, q: { stage: string }): Promise<string[]> {
+    const rows = list<string | { name: string }>(
+      await this.request('GET', `/v1/apps/${enc(app)}/data/collections`, { query: q }),
+      'collections',
+    );
+    return rows.map((r) => (typeof r === 'string' ? r : r.name));
+  }
+  items(
+    app: string,
+    q: { stage: string; collection: string; partition?: string; cursor?: string; limit?: number },
+  ) {
+    return this.request<DataPage>('GET', `/v1/apps/${enc(app)}/data/items`, { query: q });
+  }
+  async files(app: string, q: { stage: string; store: string; prefix?: string; cursor?: string }) {
+    return this.request<{ objects: StoredObjectInfo[]; cursor?: string }>(
+      'GET',
+      `/v1/apps/${enc(app)}/storage`,
+      { query: q },
+    );
+  }
+
+  // ------------------------------------------------------------- secrets & jobs
+  async listSecrets(app: string, q: { stage: string }): Promise<SecretInfo[]> {
+    return list(await this.request('GET', `/v1/apps/${enc(app)}/secrets`, { query: q }), 'secrets');
+  }
+  setSecret(app: string, name: string, body: { value: string; stage?: string; shared?: boolean }) {
+    return this.request<SecretInfo>('PUT', `/v1/apps/${enc(app)}/secrets/${enc(name)}`, {
+      body: { value: body.value },
+      query: secretScope(body),
+    });
+  }
+  deleteSecret(app: string, name: string, q: { stage?: string; shared?: boolean }) {
+    return this.request<unknown>('DELETE', `/v1/apps/${enc(app)}/secrets/${enc(name)}`, {
+      query: secretScope(q),
+    });
+  }
+  runCron(app: string, name: string, stage: string) {
+    return this.request<unknown>('POST', `/v1/apps/${enc(app)}/crons/${enc(name)}/run`, {
+      body: {},
+      query: { stage },
+    });
+  }
+}
+
+const enc = encodeURIComponent;
+
+/** The API scopes secrets with `?scope=shared` (app-wide) or `?stage=`. */
+function secretScope(o: { stage?: string; shared?: boolean }): Record<string, string> {
+  return o.shared ? { scope: 'shared' } : o.stage ? { stage: o.stage } : {};
+}
+
+function safeJson(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+/** Accept `[...]` or `{ key: [...] }` / `{ items: [...] }`. */
+function list<T>(body: unknown, key: string): T[] {
+  if (Array.isArray(body)) return body as T[];
+  const obj = (body ?? {}) as Record<string, unknown>;
+  const v = obj[key] ?? obj.items;
+  return Array.isArray(v) ? (v as T[]) : [];
+}

package/src/bin.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from './main.ts';
+
+await main(process.argv);

package/src/build.ts

@@ -0,0 +1,252 @@
+import { spawn } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { delimiter, join, resolve } from 'node:path';
+import type { ArtifactFile, ResolvedManifest } from '@ericminassian/platform-core';
+import { build as esbuild, type Plugin } from 'esbuild';
+import { cliVersion, loadProject, type Project } from './project.ts';
+import { buildFailureList } from './util/esbuild.ts';
+import { CliError, EXIT, step } from './util/output.ts';
+import { dirExists, zipDirectory } from './util/zip.ts';
+
+export const SDK_SERVER = '@ericminassian/platform/server';
+export const SDK_WORKER = '@ericminassian/platform/worker';
+
+export interface BuildOptions {
+  cwd: string;
+  /** Already-loaded project (skips evaluating plat.config.ts again). */
+  project?: Project;
+  /** Default `<app>/.plat/build`. */
+  outDir?: string;
+  /** Skip `web.build` (e.g. `plat dev`, which runs the dev server instead). */
+  skipWebBuild?: boolean;
+  /** Only build these parts. Default: everything the manifest declares. */
+  only?: Array<'server' | 'worker' | 'static'>;
+  /**
+   * Replace module specifiers during bundling (absolute paths). Tests use it to
+   * stand in for the SDK; nothing else should need it.
+   */
+  resolveOverrides?: Record<string, string>;
+  minify?: boolean;
+  quiet?: boolean;
+}
+
+export interface BuildResult {
+  manifest: ResolvedManifest;
+  /** Absolute paths of the produced artifacts. */
+  files: Partial<Record<ArtifactFile, string>>;
+}
+
+/**
+ * Builds an app into deployable artifacts:
+ *  - `server.zip`  → `index.mjs` (+ map): the app's fetch handler wrapped by the SDK server
+ *  - `worker.zip`  → `index.mjs` (+ map): `export const handler` for the worker Lambda
+ *  - `static.zip`  → the built frontend
+ *  - `manifest.json` → `{ manifest, resolved, build }` (`manifest` is plat.config.ts evaluated to JSON)
+ */
+export async function buildApp(opts: BuildOptions): Promise<BuildResult> {
+  const project = opts.project ?? (await loadProject(opts.cwd));
+  const { root, manifest, raw } = project;
+  const outDir = resolve(opts.outDir ?? join(root, '.plat', 'build'));
+  const want = (part: 'server' | 'worker' | 'static') => !opts.only || opts.only.includes(part);
+  const log = opts.quiet ? () => {} : step;
+
+  validateForBuild(root, manifest);
+  rmSync(outDir, { recursive: true, force: true });
+  mkdirSync(outDir, { recursive: true });
+
+  const files: BuildResult['files'] = {};
+  const plugins = opts.resolveOverrides ? [overridePlugin(opts.resolveOverrides)] : [];
+  const minify = opts.minify ?? true;
+
+  if (manifest.web?.server && want('server')) {
+    log('bundling server');
+    const entry = resolve(root, manifest.web.server);
+    const dir = await bundle({
+      root,
+      outDir: join(outDir, 'server'),
+      contents: `import handler from ${JSON.stringify(entry)};\nimport { startServer } from ${JSON.stringify(SDK_SERVER)};\nawait startServer(handler);\n`,
+      plugins,
+      minify,
+    });
+    files['server.zip'] = writeZip(outDir, 'server.zip', zipDirectory(dir));
+  }
+
+  if (manifest.worker && want('worker')) {
+    log('bundling worker');
+    const dir = await bundleWorker(root, manifest, join(outDir, 'worker'), { plugins, minify });
+    files['worker.zip'] = writeZip(outDir, 'worker.zip', zipDirectory(dir));
+  }
+
+  if (manifest.web?.static && want('static')) {
+    if (manifest.web.build && !opts.skipWebBuild) {
+      log(`building frontend: ${manifest.web.build}`);
+      await runCommand(manifest.web.build, root);
+    }
+    const staticDir = resolve(root, manifest.web.static);
+    if (!dirExists(staticDir)) {
+      throw new CliError(`web.static directory ${manifest.web.static} does not exist`, {
+        hint: manifest.web.build
+          ? 'check that web.build writes to web.static'
+          : 'add a web.build command or build the frontend first',
+        exitCode: EXIT.usage,
+      });
+    }
+    if (!existsSync(join(staticDir, 'index.html')) && manifest.web.spa) {
+      throw new CliError(`${manifest.web.static}/index.html is missing but web.spa is true`, {
+        exitCode: EXIT.usage,
+      });
+    }
+    files['static.zip'] = writeZip(outDir, 'static.zip', zipDirectory(staticDir));
+  }
+
+  const manifestPath = join(outDir, 'manifest.json');
+  writeFileSync(
+    manifestPath,
+    `${JSON.stringify(
+      {
+        manifest: raw,
+        resolved: manifest,
+        build: {
+          cli: cliVersion(),
+          builtAt: new Date().toISOString(),
+          files: Object.keys(files),
+        },
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  files['manifest.json'] = manifestPath;
+  return { manifest, files };
+}
+
+/** Bundle just the worker into `outDir/index.mjs` (used by build and `plat dev`). */
+export async function bundleWorker(
+  root: string,
+  manifest: ResolvedManifest,
+  outDir: string,
+  opts: { plugins?: Plugin[]; minify?: boolean } = {},
+): Promise<string> {
+  if (!manifest.worker) throw new Error('manifest has no worker');
+  const entry = resolve(root, manifest.worker.entry);
+  return bundle({
+    root,
+    outDir,
+    contents: `import def from ${JSON.stringify(entry)};\nimport { createWorkerHandler } from ${JSON.stringify(SDK_WORKER)};\nexport const handler = createWorkerHandler(def);\n`,
+    plugins: opts.plugins ?? [],
+    minify: opts.minify ?? true,
+  });
+}
+
+/** Zip of a bundled directory, for UpdateFunctionCode. */
+export function zipBundle(dir: string): Uint8Array {
+  return zipDirectory(dir);
+}
+
+export function validateForBuild(root: string, manifest: ResolvedManifest): void {
+  const problems: string[] = [];
+  if (manifest.auth.enabled && !manifest.web?.server)
+    problems.push('auth needs web.server (sign-in routes run in the server)');
+  if (manifest.web?.server && !existsSync(resolve(root, manifest.web.server))) {
+    problems.push(`web.server entry ${manifest.web.server} does not exist`);
+  }
+  if (manifest.worker && !existsSync(resolve(root, manifest.worker.entry))) {
+    problems.push(
+      `worker entry ${manifest.worker.entry} does not exist (needed for ${describeWorkerNeeds(manifest)})`,
+    );
+  }
+  if (problems.length)
+    throw new CliError(`can't build ${manifest.name}:\n  - ${problems.join('\n  - ')}`, {
+      exitCode: EXIT.usage,
+    });
+}
+
+function describeWorkerNeeds(m: ResolvedManifest): string {
+  const parts = [
+    ...Object.keys(m.queues).map((q) => `queue ${q}`),
+    ...m.events.map((e) => `event ${e}`),
+    ...Object.keys(m.crons).map((c) => `cron ${c}`),
+  ];
+  return parts.join(', ') || 'worker';
+}
+
+async function bundle(o: {
+  root: string;
+  outDir: string;
+  contents: string;
+  plugins: Plugin[];
+  minify: boolean;
+}): Promise<string> {
+  mkdirSync(o.outDir, { recursive: true });
+  try {
+    await esbuild({
+      stdin: { contents: o.contents, resolveDir: o.root, sourcefile: 'platform-entry.ts', loader: 'ts' },
+      outfile: join(o.outDir, 'index.mjs'),
+      bundle: true,
+      platform: 'node',
+      format: 'esm',
+      target: 'node24',
+      minify: o.minify,
+      sourcemap: 'external',
+      sourcesContent: false,
+      legalComments: 'none',
+      logLevel: 'silent',
+      // ESM bundles of CJS dependencies still call require(). process.getBuiltinModule
+      // (not a static `import 'node:module'`) keeps the bundle loadable in runtimes
+      // without node:module, such as the AWS Emulator's Lambda sandbox.
+      banner: {
+        js: "const require = globalThis.process?.getBuiltinModule?.('module')?.createRequire(import.meta.url);",
+      },
+      plugins: o.plugins,
+      absWorkingDir: o.root,
+    });
+  } catch (err) {
+    throw new CliError(`bundling failed:${buildFailureList(err)}`);
+  }
+  return o.outDir;
+}
+
+function overridePlugin(map: Record<string, string>): Plugin {
+  const keys = Object.keys(map);
+  const filter = new RegExp(`^(${keys.map((k) => k.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&')).join('|')})$`);
+  return {
+    name: 'plat-resolve-overrides',
+    setup(b) {
+      b.onResolve({ filter }, (args) => ({ path: map[args.path]! }));
+    },
+  };
+}
+
+function writeZip(outDir: string, name: string, data: Uint8Array): string {
+  const p = join(outDir, name);
+  writeFileSync(p, data);
+  return p;
+}
+
+/** Run a manifest shell command with the app's `node_modules/.bin` on PATH. */
+export function runCommand(
+  command: string,
+  cwd: string,
+  env: NodeJS.ProcessEnv = process.env,
+): Promise<void> {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(command, {
+      cwd,
+      shell: true,
+      stdio: ['ignore', 'inherit', 'inherit'],
+      env: withLocalBin(cwd, env),
+    });
+    child.once('exit', (code) =>
+      code === 0 ? resolvePromise() : reject(new CliError(`\`${command}\` exited with code ${code}`)),
+    );
+    child.once('error', reject);
+  });
+}
+
+export function withLocalBin(cwd: string, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+  return { ...env, PATH: [join(cwd, 'node_modules', '.bin'), env.PATH ?? ''].join(delimiter) };
+}
+
+export function readBuildManifest(outDir: string): unknown {
+  return JSON.parse(readFileSync(join(outDir, 'manifest.json'), 'utf8'));
+}

package/src/commands/account.ts

@@ -0,0 +1,62 @@
+import { spawnSync } from 'node:child_process';
+import { type Command, Option } from 'commander';
+import pc from 'picocolors';
+import { ApiClient, apiBaseUrl } from '../api.ts';
+import { clearCredentials, credentialsPath, loadCredentials, saveCredentials } from '../credentials.ts';
+import { CliError, EXIT, result, success } from '../util/output.ts';
+import { action, apiFor, type CommonOpts, withCommon } from './common.ts';
+
+export function registerAccount(program: Command): void {
+  withCommon(
+    program
+      .command('login')
+      .description('sign in to the platform with your GitHub identity (uses `gh auth token`)')
+      .addOption(
+        new Option('--github-token <token>', 'GitHub token to use instead of `gh auth token`').env(
+          'PLAT_GITHUB_TOKEN',
+        ),
+      ),
+  ).action(
+    action(async (opts: CommonOpts & { githubToken?: string }) => {
+      const baseUrl = opts.apiUrl ?? apiBaseUrl();
+      const githubToken = opts.githubToken ?? ghToken();
+      const api = new ApiClient({ baseUrl, auth: 'none' });
+      const res = await api.login({ githubToken });
+      saveCredentials({ apiUrl: baseUrl, token: res.token, github: res.github, expiresAt: res.expiresAt });
+      result({ github: res.github, role: res.role, expiresAt: res.expiresAt, apiUrl: baseUrl }, (r) => {
+        success(`signed in as ${pc.bold(r.github)} (${r.role}) until ${r.expiresAt}`);
+        return undefined;
+      });
+    }),
+  );
+
+  withCommon(program.command('logout').description('forget the stored platform login')).action(
+    action(async () => {
+      const removed = clearCredentials();
+      result({ loggedOut: removed, path: credentialsPath() }, (r) =>
+        r.loggedOut ? 'logged out' : 'not logged in',
+      );
+    }),
+  );
+
+  withCommon(program.command('whoami').description('show the signed-in platform member')).action(
+    action(async (opts: CommonOpts) => {
+      const me = await apiFor(opts).me();
+      const stored = loadCredentials();
+      result({ ...me, expiresAt: stored?.expiresAt }, (r) => `${pc.bold(r.github)} (${r.role})`);
+    }),
+  );
+}
+
+function ghToken(): string {
+  const env = process.env.GH_TOKEN || process.env.GITHUB_TOKEN;
+  const r = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8' });
+  const token = r.status === 0 ? r.stdout.trim() : env;
+  if (!token) {
+    throw new CliError('could not get a GitHub token', {
+      hint: 'install the GitHub CLI and run `gh auth login`, or pass --github-token',
+      exitCode: EXIT.auth,
+    });
+  }
+  return token;
+}