nukebase 0.0.0-stage → 2.0.0

package/README.md

@@ -1,3 +1,48 @@
-# Temporary Holding Version
+# nukebase
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Create, deploy and manage [NukeBase](https://nukebase.com) projects.
+
+```
+npx nukebase login
+npx nukebase create myapp 256mb
+cd myapp
+npx nukebase push
+```
+
+For daily use, install it once: `npm i -g nukebase`, then run `nukebase …`.
+
+## Accounts
+
+Sign in by approving the CLI on the NukeBase website. Several accounts can be
+signed in at once; each project folder knows which account owns it, so you can
+deploy to different accounts from different terminals at the same time.
+
+```
+nukebase login                     approve in your browser
+nukebase login --email you@x.com   add another account
+nukebase login --device            from SSH or a machine without a browser
+nukebase accounts                  list signed-in accounts
+nukebase use you@x.com             default for commands outside a project
+nukebase logout you@x.com          sign out one account
+nukebase logout                    sign out every account
+```
+
+Sign-ins are kept in `~/.nukebase/credentials.json`, never inside a project.
+CLI sign-ins can deploy and manage projects but can't change billing, and stay
+signed in until you sign them out here or under **Signed-in devices** on the
+dashboard.
+
+## Projects
+
+```
+nukebase create <name> [size] [email]   sizes: 128mb, 256mb, 512mb, 1gb
+nukebase link <name> [email]            connect a folder to an existing project
+nukebase push | pull | logs | rollback | backup | env push | domain | ...
+```
+
+Run `nukebase help` for every command.
+
+## CI
+
+Create a build token on the dashboard (Signed-in devices → Create build token)
+and set `NUKEBASE_TOKEN` and `NUKEBASE_UID`.

package/bin/nukebase.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+// nukebase: create, deploy and manage NukeBase projects.
+//
+// Account commands (login, logout, accounts, use, whoami, create, link) work
+// anywhere. Project commands run in a project folder and act as the account
+// that owns it, so several terminals can deploy to different accounts at once.
+
+const args = require('../lib/args').parse(process.argv.slice(2));
+const { version } = require('../package.json');
+
+const ACCOUNT_COMMANDS = ['login', 'logout', 'accounts', 'use', 'whoami', 'create', 'link'];
+const PROJECT_COMMANDS = [
+  'push', 'pull', 'update', 'rollback', 'restorepoints', 'restore-points', 'backup', 'env',
+  'pause', 'restart', 'start', 'resume', 'delete', 'domain', 'logs', 'download',
+  'regiontransfer', 'region-transfer'
+];
+
+function usage() {
+  console.log(`nukebase ${version}
+
+Usage: nukebase <command>        (or: npx nukebase <command>)
+
+Accounts
+  login                      sign in by approving in your browser
+  login --email you@x.com    sign in as a specific account (adds it; others stay)
+  login --device             sign in from SSH or a machine without a browser
+  login --email-link         sign in with an emailed link instead
+  login --password           username + password (the master account)
+  logout <email>             sign out one account
+  logout                     sign out every account on this machine
+  accounts                   list signed-in accounts
+  use <email>                default account for commands outside a project
+  whoami                     who owns this project, and are you signed in
+
+New projects
+  create <name> [size] [email]
+                             make a project and download it, e.g.
+                             nukebase create demoapp123 256mb you@example.com
+                             sizes: 128mb, 256mb, 512mb, 1gb (or the tier name)
+  link <name> [email]        connect this folder to an existing project
+
+In a project folder (runs as the account that owns the project)
+  push                       upload code and restart (--tier <size> if it has
+                             to create the project in this region)
+  push --include backup      ALSO upload the backup set, replacing the
+                             server's live data with your copy
+  pull                       download code
+  update                     refresh the NukeBase engine files
+  backup [--out <dir>]       download the backup set from the server
+  env push                   make the hosted environment (process.env) equal
+                             to ./.env, then restart the project
+  env list [--show]          variable names set on the server
+  rollback [id]              undo a push. Live data is kept.
+  rollback backup [id]       undo a push AND restore the backup set as it was
+                             then; discards writes since
+  rollback list              show restore points (also: restorepoints)
+  pause                      stop the project (base fee + disk still accrue)
+  restart | start | resume   restart it; also resumes a paused project
+  delete                     delete it on the server; asks for the name
+  domain                     connect a custom domain, step by step
+  domain <name> [--email e]  connect in one go (DNS already set)
+  domain remove              disconnect the custom domain
+  logs [--follow]            recent log output; --follow streams
+  download [--out f.zip]     the project ZIP, exactly as the server has it
+  regiontransfer [region]    move this project to another region, step by step
+  regiontransfer --to <email>  ... into a different account on the target
+
+Options
+  --region <name> / --api <url>
+                             run against the project in another region
+  --as <email>               with --region: as another signed-in account
+  --yes, -y                  non-interactive (no y/n prompts)
+  --no-check                 push even if server-side .js files don't parse
+  --streams <1-8>            parallel connections for big push/pull/backup
+
+CI: set NUKEBASE_TOKEN and NUKEBASE_UID (create a build token on the
+dashboard under Signed-in devices).
+
+Sign-ins are kept in ~/.nukebase/credentials.json, never in a project.`);
+}
+
+const command = args.command;
+
+if (args.has('version') && !command) {
+  console.log(version);
+} else if (!command || command === 'help' || (args.has('help') && !command)) {
+  usage();
+} else if (ACCOUNT_COMMANDS.includes(command)) {
+  Promise.resolve()
+    .then(() => require('../lib/account-commands')[command](args))
+    .then(() => process.exit(0), err => { console.error('❌', err.message); process.exit(1); });
+} else if (PROJECT_COMMANDS.includes(command)) {
+  require('../lib/project-commands');
+} else {
+  console.error(`Unknown command "${command}". Run nukebase help for the list.`);
+  process.exit(1);
+}

package/lib/account-commands.js

@@ -0,0 +1,369 @@
+// Commands that work with or without a project folder: signing accounts in
+// and out, choosing the default, and making or linking projects.
+
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const creds = require('./credentials');
+const login = require('./login');
+const unzip = require('./unzip');
+const { findProject, readConfig, writeConfig, newConfig } = require('./project');
+const { hostOf, apiFor, makeConfirm, makeAskLine, askHidden } = require('./ui');
+
+const PROJECT_NAME_RE = /^[a-z][a-z0-9_-]{2,30}$/;
+
+const cookieFor = (acct) => `uid=${acct.uid}; token=${acct.token}`;
+
+function fail(message) {
+  console.error(`❌ ${message}`);
+  process.exit(1);
+}
+
+function describe(acct) {
+  return `${acct.label || acct.uid} (${acct.uid})`;
+}
+
+// The project in the current folder, if any, without its secrets mattering.
+function currentProject() {
+  const root = findProject(process.cwd());
+  if (!root) return null;
+  try { return { root, config: readConfig(root) }; } catch { return null; }
+}
+
+// ---- login ----------------------------------------------------------------
+
+async function loginCommand(args) {
+  const askLine = makeAskLine(false);
+  const here = currentProject();
+  const api = apiFor(args, here?.config.API || creds.getDefault()?.api);
+
+  // `nukebase login` inside a project whose account isn't signed in asks for
+  // that account, so you don't have to remember which email it was.
+  let email = args.get('email') || args.positional.find(a => a.includes('@')) || null;
+  if (!email && here && here.config.uid && !creds.get(here.config.uid) && String(here.config.account || '').includes('@')) {
+    email = here.config.account;
+  }
+
+  let out, method;
+  if (args.has('password')) {
+    method = 'password';
+    const username = args.positional.find(a => !a.includes('@')) || (await askLine('Username: ')).trim();
+    const pass = await askHidden('Password: ');
+    if (!username || !pass) fail('Username and password are required.');
+    out = await login.password(api, username, pass);
+  } else if (args.has('device')) {
+    method = 'device';
+    out = await login.device(api);
+  } else if (args.has('email-link')) {
+    method = 'email-link';
+    if (!email) email = (await askLine('Email: ')).trim().toLowerCase();
+    if (!email.includes('@')) fail('An email address is required.');
+    out = await login.emailLink(api, email);
+  } else {
+    method = 'browser';
+    out = await login.browser(api, { email });
+  }
+
+  // Signing in again replaces this machine's token for that account; sign the
+  // old one out on the server rather than leave it valid and forgotten.
+  const previous = creds.get(out.uid);
+  creds.put(out.uid, { label: out.label, api, token: out.token, method, created: Date.now(), lastUsed: Date.now() });
+  if (previous && previous.token && previous.token !== out.token) await revoke(previous);
+
+  console.log(`\n✓ Signed in as ${describe(out)} on ${hostOf(api)}`);
+  if (email && String(out.label).toLowerCase() !== email.toLowerCase()) {
+    console.log(`  Note: you asked for ${email} but approved as ${out.label}.`);
+  }
+  const n = creds.list().length;
+  if (n > 1) console.log(`  ${n} accounts signed in on this machine. List them with: nukebase accounts`);
+}
+
+// ---- logout ---------------------------------------------------------------
+
+async function revoke(acct) {
+  try {
+    const r = await fetch(`${acct.api}/cli/revoke`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Cookie: cookieFor(acct) },
+      body: '{}'
+    });
+    return r.ok || r.status === 401;   // 401: already signed out
+  } catch {
+    return false;
+  }
+}
+
+// `nukebase logout <email|uid>` signs out that account; plain `nukebase
+// logout` signs out every account on this machine.
+async function logoutCommand(args) {
+  const target = args.positional[0];
+  let accounts;
+  if (target) {
+    const acct = creds.find(target);
+    if (!acct) fail(`${target} isn't signed in on this machine. See: nukebase accounts`);
+    accounts = [acct];
+  } else {
+    accounts = creds.list();
+    if (!accounts.length) { console.log('No accounts are signed in.'); return; }
+  }
+  for (const acct of accounts) {
+    const ok = await revoke(acct);
+    creds.remove(acct.uid);
+    console.log(`✓ Signed out ${describe(acct)}${ok ? '' : ` (couldn't reach ${hostOf(acct.api)}; sign it out from the dashboard's Signed-in devices too)`}`);
+  }
+}
+
+// ---- accounts / use / whoami ----------------------------------------------
+
+function relative(ms) {
+  if (!ms) return 'never';
+  const days = Math.floor((Date.now() - ms) / 86400000);
+  return days <= 0 ? 'today' : days === 1 ? 'yesterday' : `${days} days ago`;
+}
+
+function accountsCommand() {
+  const list = creds.list();
+  if (!list.length) { console.log('No accounts are signed in. Run: nukebase login'); return; }
+  const w = Math.max(...list.map(a => String(a.label || '').length), 7);
+  console.log('');
+  for (const a of list) {
+    console.log(`  ${a.isDefault ? '*' : ' '} ${String(a.label || '').padEnd(w)}  ${a.uid}  ${hostOf(a.api)}  last used ${relative(a.lastUsed)}`);
+  }
+  console.log(`\n  * default, for commands run outside a project (nukebase use <email> to change)`);
+  console.log(`  Inside a project, the account that owns it is used automatically.\n`);
+}
+
+function useCommand(args) {
+  const q = args.positional[0];
+  if (!q) fail('Usage: nukebase use <email|uid>');
+  const acct = creds.find(q);
+  if (!acct) fail(`${q} isn't signed in on this machine. Run: nukebase login --email ${q}`);
+  creds.setDefault(acct.uid);
+  console.log(`✓ Default account: ${describe(acct)}`);
+}
+
+async function whoamiCommand() {
+  const here = currentProject();
+  if (here && here.config.uid) {
+    const acct = creds.get(here.config.uid);
+    const name = here.config.project || path.basename(here.root);
+    if (!acct) {
+      console.log(`${name} belongs to ${here.config.account || 'uid'} (${here.config.uid}), which isn't signed in on this machine.`);
+      console.log(`Run: nukebase login${String(here.config.account || '').includes('@') ? ` --email ${here.config.account}` : ''}`);
+      return;
+    }
+    console.log(`${name} belongs to ${describe(acct)} on ${hostOf(here.config.API)}`);
+    console.log(await check(acct, here.config.API));
+    return;
+  }
+  const acct = creds.getDefault();
+  if (!acct) { console.log(creds.list().length ? 'No default account. Set one with: nukebase use <email>' : 'Not signed in. Run: nukebase login'); return; }
+  console.log(`Default account: ${describe(acct)} on ${hostOf(acct.api)}`);
+  console.log(await check(acct, acct.api));
+}
+
+async function check(acct, api) {
+  try {
+    const r = await fetch(`${api}/cli/whoami`, { method: 'POST', headers: { 'Content-Type': 'application/json', Cookie: cookieFor(acct) }, body: '{}' });
+    if (r.ok) return '✓ Signed in';
+    if (r.status === 401) return `✗ This sign-in was revoked. Run: nukebase login${String(acct.label).includes('@') ? ` --email ${acct.label}` : ''}`;
+    return `? ${hostOf(api)} answered ${r.status}`;
+  } catch {
+    return `? Couldn't reach ${hostOf(api)}`;
+  }
+}
+
+// ---- choosing an account for create / link ----------------------------------
+
+async function chooseAccount(args, hint, autoYes) {
+  const q = args.get('as') || hint;
+  if (q) {
+    const acct = creds.find(q);
+    if (!acct) fail(`${q} isn't signed in on this machine. Run: nukebase login --email ${q}`);
+    return acct;
+  }
+  const list = creds.list();
+  if (!list.length) fail('Not signed in. Run: nukebase login');
+  if (list.length === 1) return list[0];
+  // Creating a project is billed to the account, so never guess between several.
+  if (autoYes || !process.stdin.isTTY) {
+    fail(`Several accounts are signed in. Say which one, e.g.: nukebase ${args.command} ${args.positional[0] || '<name>'} ${list[0].label}`);
+  }
+  console.log('\n  Which account?');
+  list.forEach((a, i) => console.log(`    ${i + 1}) ${a.label}  (${a.uid})${a.isDefault ? '  default' : ''}`));
+  const answer = (await makeAskLine(false)('\n  Account (number or email): ')).trim();
+  const picked = /^\d+$/.test(answer) ? list[Number(answer) - 1] : creds.find(answer);
+  if (!picked) fail('No account chosen.');
+  return picked;
+}
+
+// ---- create ---------------------------------------------------------------
+
+// "256mb", "256", "1gb", "1g", "512 MB" -> megabytes; null when not a size.
+function sizeToMb(text) {
+  const m = /^(\d+(?:\.\d+)?)\s*(m|mb|g|gb)?$/i.exec(String(text).trim());
+  if (!m) return null;
+  const n = Number(m[1]);
+  return /^g/i.test(m[2] || '') ? n * 1024 : n;
+}
+
+// A size the user typed -> tier key. Matches the RAM each tier buys
+// (memoryHigh) or the tier's name.
+function resolveTier(input, catalog) {
+  const tiers = catalog.tiers || {};
+  const key = String(input).toLowerCase();
+  if (tiers[key]) return key;
+  const want = sizeToMb(input);
+  if (want === null) return null;
+  return (catalog.order || Object.keys(tiers)).find(k => sizeToMb(tiers[k].memoryHigh) === want) || null;
+}
+
+function tierLabel(catalog, key) {
+  const t = catalog.tiers[key];
+  const mb = sizeToMb(t.memoryHigh);
+  const ram = mb >= 1024 ? `${mb / 1024} GB` : `${mb} MB`;
+  return `${t.name}, ${ram} RAM, $${(t.monthlyCents / 100).toFixed(0)}/mo`;
+}
+
+async function createCommand(args) {
+  const autoYes = args.has('yes');
+  const confirm = makeConfirm(autoYes);
+  const askLine = makeAskLine(autoYes);
+
+  const name = args.positional[0];
+  if (!name) fail('Usage: nukebase create <name> [size] [email]   e.g. nukebase create demoapp123 256mb you@example.com');
+  if (!PROJECT_NAME_RE.test(name)) fail('Project names are 3-31 characters: lowercase letters, numbers, - and _, starting with a letter.');
+
+  // After the name, in any order: something with an @ is the account; the
+  // rest is the size.
+  const rest = args.positional.slice(1);
+  const emailArg = rest.find(a => a.includes('@')) || null;
+  const sizeArg = args.get('tier') || rest.find(a => !a.includes('@')) || null;
+
+  const dest = path.resolve(process.cwd(), name);
+  if (fs.existsSync(dest) && fs.readdirSync(dest).length) fail(`The folder ${name} already exists and isn't empty.`);
+
+  const acct = await chooseAccount(args, emailArg, autoYes);
+  const api = apiFor(args, acct.api);
+  const host = hostOf(api);
+
+  let catalog;
+  try {
+    const r = await fetch(`${api}/tiers`);
+    if (!r.ok) throw new Error(`HTTP ${r.status}`);
+    catalog = await r.json();
+  } catch (e) {
+    fail(`Could not reach ${host} (${e.cause?.message || e.message}).`);
+  }
+  const order = catalog.order || Object.keys(catalog.tiers);
+  const def = catalog.default || order[0];
+
+  let tier = sizeArg ? resolveTier(sizeArg, catalog) : null;
+  if (sizeArg && !tier) {
+    fail(`Unknown size "${sizeArg}". One of: ${order.map(k => `${catalog.tiers[k].memoryHigh.replace(/M$/, 'mb').replace(/G$/, 'gb').toLowerCase()} (${k})`).join(', ')}`);
+  }
+  if (!tier) {
+    if (autoYes || !process.stdin.isTTY) {
+      tier = def;
+    } else {
+      console.log('\n  Sizes:');
+      order.forEach((k, i) => console.log(`    ${i + 1}) ${tierLabel(catalog, k)}${k === def ? '  (default)' : ''}`));
+      const answer = (await askLine(`\n  Size [${def}]: `)).trim();
+      tier = !answer ? def : /^\d+$/.test(answer) ? order[Number(answer) - 1] : resolveTier(answer, catalog);
+      if (!tier) fail(`Unknown size "${answer}".`);
+    }
+  }
+
+  console.log(`\n  Project   ${name}`);
+  console.log(`  Size      ${tierLabel(catalog, tier)}`);
+  console.log(`  Account   ${describe(acct)}`);
+  console.log(`  Region    ${host}`);
+  if (!(await confirm('\nCreate it? It is billed to this account. (y/n) '))) { console.log('Aborted. Nothing was created.'); return; }
+
+  console.log(`\n🚀 Creating ${name}...`);
+  let res;
+  try {
+    res = await fetch(`${api}/project`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Project': name, Cookie: cookieFor(acct) },
+      body: JSON.stringify({ tier })
+    });
+  } catch (e) {
+    fail(`Create failed: ${e.cause?.message || e.message}. Check the dashboard before retrying; it may have been created.`);
+  }
+  if (!res.ok) {
+    let msg = '';
+    try { msg = (await res.json()).error; } catch {}
+    if (res.status === 401) fail(`The sign-in for ${acct.label} is no longer valid. Run: nukebase login --email ${acct.label}`);
+    fail(`Create failed (${res.status}): ${msg || res.statusText}`);
+  }
+
+  // The server finishes setup as the ZIP finishes streaming, so read it all.
+  const zip = Buffer.from(await res.arrayBuffer());
+  fs.mkdirSync(dest, { recursive: true });
+  const count = unzip.extract(zip, dest);
+
+  let base = {};
+  try { base = readConfig(dest); } catch {}
+  writeConfig(dest, newConfig({ api, uid: acct.uid, project: name, account: acct.label }, base));
+  console.log(`✓ Downloaded ${count} files into ./${name}`);
+
+  if (!args.has('no-install') && fs.existsSync(path.join(dest, 'package.json'))) {
+    console.log('\n📦 npm install\n');
+    const r = spawnSync('npm', ['install'], { cwd: dest, stdio: 'inherit', shell: process.platform === 'win32' });
+    if (r.status !== 0) console.log(`\n⚠️  npm install failed. Run it yourself in ./${name}.`);
+  }
+
+  console.log(`\n✅ ${name} is live at https://${acct.uid}-${name}.${host}`);
+  console.log(`\n   cd ${name}`);
+  console.log('   nukebase push      deploy your changes');
+}
+
+// ---- link -----------------------------------------------------------------
+
+async function linkCommand(args) {
+  const autoYes = args.has('yes');
+  const name = args.positional[0];
+  if (!name) fail('Usage: nukebase link <project> [email]   connects this folder to an existing project');
+  const acct = await chooseAccount(args, args.positional.slice(1).find(a => a.includes('@')), autoYes);
+  const api = apiFor(args, acct.api);
+
+  let r;
+  try {
+    r = await fetch(`${api}/sync`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Project': name, Cookie: cookieFor(acct) },
+      body: JSON.stringify({ exclude: ['sys', '.env', 'node_modules', 'server'], files: {}, direction: 'pull', symlinks: false })
+    });
+  } catch (e) {
+    fail(`Could not reach ${hostOf(api)} (${e.cause?.message || e.message}).`);
+  }
+  if (r.status === 404) fail(`${acct.label} has no project named ${name} on ${hostOf(api)}.`);
+  if (r.status === 401) fail(`The sign-in for ${acct.label} is no longer valid. Run: nukebase login --email ${acct.label}`);
+  if (!r.ok) fail(`Could not check the project (${r.status}).`);
+
+  const root = process.cwd();
+  let base = {};
+  const existing = fs.existsSync(path.join(root, 'sys', 'config.json'));
+  if (existing) {
+    try { base = readConfig(root); } catch {}
+    if (base.uid && base.uid !== acct.uid && !(await makeConfirm(autoYes)(`This folder belongs to ${base.account || base.uid}. Link it to ${acct.label} instead? (y/n) `))) {
+      console.log('Aborted.');
+      return;
+    }
+  }
+  writeConfig(root, newConfig({ api, uid: acct.uid, project: name, account: acct.label }, base));
+  console.log(`✓ Linked this folder to ${name} (${describe(acct)}) on ${hostOf(api)}`);
+  console.log('  nukebase pull   download its files');
+}
+
+module.exports = {
+  login: loginCommand,
+  logout: logoutCommand,
+  accounts: accountsCommand,
+  use: useCommand,
+  whoami: whoamiCommand,
+  create: createCommand,
+  link: linkCommand,
+  resolveTier, sizeToMb
+};

package/lib/args.js

@@ -0,0 +1,47 @@
+// Command-line parsing shared by every command.
+//
+// Options that take a value consume the next word, so it is never mistaken
+// for a positional argument: `nukebase rollback --region usw3` has no
+// restore-point id, and `nukebase update --as a@b.com` has no file filter.
+// `--name=value` works too.
+
+const VALUE_FLAGS = new Set([
+  'region', 'api', 'as', 'tier', 'streams', 'out', 'email', 'to', 'include', 'name'
+]);
+
+const SHORT = { y: 'yes', f: 'follow', h: 'help', v: 'version' };
+
+function parse(argv) {
+  const flags = {};
+  const words = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--') { words.push(...argv.slice(i + 1)); break; }
+    if (a.startsWith('--')) {
+      const eq = a.indexOf('=');
+      if (eq > 2) { flags[a.slice(2, eq)] = a.slice(eq + 1); continue; }
+      const name = a.slice(2);
+      if (VALUE_FLAGS.has(name)) {
+        const next = argv[i + 1];
+        flags[name] = next !== undefined && !next.startsWith('-') ? (i++, next) : '';
+      } else {
+        flags[name] = true;
+      }
+      continue;
+    }
+    if (a.length > 1 && a.startsWith('-') && !/^-\d/.test(a)) {
+      for (const ch of a.slice(1)) flags[SHORT[ch] || ch] = true;
+      continue;
+    }
+    words.push(a);
+  }
+  return {
+    command: words[0],
+    positional: words.slice(1),
+    flags,
+    has: (name) => flags[name] !== undefined && flags[name] !== false,
+    get: (name) => (typeof flags[name] === 'string' && flags[name] !== '' ? flags[name] : null)
+  };
+}
+
+module.exports = { parse };

package/lib/credentials.js

@@ -0,0 +1,118 @@
+// ~/.nukebase/credentials.json — every account signed in on this machine,
+// keyed by uid. A project's sys/config.json says which uid owns it; the token
+// for that uid lives here and never inside a project folder.
+//
+//   {
+//     "version": 1,
+//     "default": "<uid>",            used only outside a project
+//     "accounts": {
+//       "<uid>": { "label": "you@example.com", "api": "https://usw4.nukebase.com",
+//                  "token": "...", "method": "browser", "created": 0, "lastUsed": 0 }
+//     }
+//   }
+//
+// Several terminals may run at once (pushes to different accounts in
+// parallel), so every write re-reads the file, changes one entry, writes a
+// temporary file and renames it over the original. Reads never lock.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DIR = process.env.NUKEBASE_HOME || path.join(os.homedir(), '.nukebase');
+const FILE = path.join(DIR, 'credentials.json');
+const LAST_USED_EVERY_MS = 60 * 60 * 1000;
+
+function empty() {
+  return { version: 1, default: null, accounts: {} };
+}
+
+function load() {
+  try {
+    const data = JSON.parse(fs.readFileSync(FILE, 'utf8'));
+    if (!data || typeof data !== 'object' || typeof data.accounts !== 'object') return empty();
+    return data;
+  } catch (e) {
+    return empty();
+  }
+}
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+// Apply `change` to a fresh read and write the result atomically.
+function edit(change) {
+  fs.mkdirSync(DIR, { recursive: true, mode: 0o700 });
+  const data = load();
+  change(data);
+  const tmp = `${FILE}.${process.pid}.${Date.now()}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+  // Windows refuses a rename onto a file another process has open for a
+  // moment; a few short retries ride that out.
+  for (let attempt = 0; ; attempt++) {
+    try { fs.renameSync(tmp, FILE); break; } catch (e) {
+      if (attempt >= 20 || !['EPERM', 'EACCES', 'EBUSY'].includes(e.code)) {
+        try { fs.unlinkSync(tmp); } catch {}
+        throw e;
+      }
+      sleepSync(25);
+    }
+  }
+  return data;
+}
+
+function list() {
+  const data = load();
+  return Object.entries(data.accounts).map(([uid, a]) => ({ uid, ...a, isDefault: data.default === uid }));
+}
+
+function get(uid) {
+  const a = uid ? load().accounts[uid] : null;
+  return a ? { uid, ...a } : null;
+}
+
+// By uid, or by label (email or username), case-insensitive.
+function find(query) {
+  if (!query) return null;
+  const data = load();
+  if (data.accounts[query]) return { uid: query, ...data.accounts[query] };
+  const q = String(query).toLowerCase();
+  const hit = Object.entries(data.accounts).find(([, a]) => String(a.label || '').toLowerCase() === q);
+  return hit ? { uid: hit[0], ...hit[1] } : null;
+}
+
+function getDefault() {
+  const data = load();
+  if (data.default && data.accounts[data.default]) return { uid: data.default, ...data.accounts[data.default] };
+  const uids = Object.keys(data.accounts);
+  return uids.length === 1 ? { uid: uids[0], ...data.accounts[uids[0]] } : null;
+}
+
+function put(uid, entry) {
+  return edit((data) => {
+    data.accounts[uid] = { ...(data.accounts[uid] || {}), ...entry };
+    if (!data.default || !data.accounts[data.default]) data.default = uid;
+  });
+}
+
+function remove(uid) {
+  return edit((data) => {
+    delete data.accounts[uid];
+    if (data.default === uid) data.default = Object.keys(data.accounts)[0] || null;
+  });
+}
+
+function setDefault(uid) {
+  return edit((data) => { if (data.accounts[uid]) data.default = uid; });
+}
+
+// Pushes only read this file; "last used" is written at most once an hour so
+// ten parallel pushes don't queue up on it.
+function touch(uid) {
+  const a = get(uid);
+  if (!a || Date.now() - (a.lastUsed || 0) < LAST_USED_EVERY_MS) return;
+  try { edit((data) => { if (data.accounts[uid]) data.accounts[uid].lastUsed = Date.now(); }); } catch {}
+}
+
+module.exports = { FILE, list, get, find, getDefault, put, remove, setDefault, touch };