nukebase 2.0.6 → 2.1.1

package/README.md

@@ -32,6 +32,10 @@ CLI sign-ins can deploy and manage projects but can't change billing, and stay
 signed in until you sign them out here or under **Signed-in devices** on the
 dashboard.
 
+A project's settings — which account owns it, which region it lives in,
+`exclude`, `backup` — are the `nukebase` section of its `package.json`.
+Push and pull carry it, so a fresh clone is already linked.
+
 ## Projects
 
 ```

package/bin/nukebase.js

@@ -24,7 +24,7 @@ if (!(args.has('version') && !args.command)) {
 const ACCOUNT_COMMANDS = ['login', 'logout', 'accounts', 'use', 'whoami', 'create', 'link'];
 const PROJECT_COMMANDS = [
   'push', 'pull', 'update', 'rollback', 'restorepoints', 'restore-points', 'backup', 'env',
-  'pause', 'restart', 'start', 'resume', 'delete', 'domain', 'logs', 'download',
+  'pause', 'restart', 'resume', 'delete', 'domain', 'logs', 'download',
   'regiontransfer', 'region-transfer'
 ];
 
@@ -49,8 +49,7 @@ Accounts
   whoami                     who owns this project, and are you signed in
 
 New projects
-  start [name] [size]        outside a project: sign in if needed, then create
-                             (inside a project, start = restart)
+  start [name] [size]        sign in if needed, then create and download
   create <name> [size] [email]
                              make a project and download it, e.g.
                              nukebase create demoapp123 256mb you@example.com
@@ -73,7 +72,7 @@ In a project folder (runs as the account that owns the project)
                              then; discards writes since
   rollback list              show restore points (also: restorepoints)
   pause                      stop the project (base fee + disk still accrue)
-  restart | start | resume   restart it; also resumes a paused project
+  restart | resume           restart it; also resumes a paused project
   delete                     delete it on the server; asks for the name
   domain                     connect a custom domain, step by step
   domain <name> [--email e]  connect in one go (DNS already set)
@@ -94,14 +93,27 @@ Options
 CI: set NUKEBASE_TOKEN and NUKEBASE_UID (create a build token on the
 dashboard under Signed-in devices).
 
-Sign-ins are kept in ~/.nukebase/credentials.json, never in a project.`);
+Sign-ins are kept in ~/.nukebase/credentials.json, never in a project.
+A project's settings (owner, region, exclude, backup) are the "nukebase"
+section of its package.json.`);
 }
 
 let command = args.command;
 
-// `start` means two things: inside a project it restarts the app (as it always
-// has); anywhere else it is the new-user setup (sign in, create, download).
-if (command === 'start' && !require('../lib/project').findProject(process.cwd())) command = 'setup';
+// `start` is the new-user setup (sign in, create, download). It used to double
+// as a restart alias inside a project; now it stops there instead of guessing,
+// so the same words do the same thing in every folder.
+if (command === 'start') {
+  const here = require('../lib/project').findProject(process.cwd());
+  if (here) {
+    const { project } = require('../lib/project').readConfig(here);
+    console.error(`This folder is already the NukeBase project "${project}".`);
+    console.error('  nukebase restart         restart it (resumes a paused project)');
+    console.error('  nukebase create <name>   make a new project (run it elsewhere)');
+    process.exit(1);
+  }
+  command = 'setup';
+}
 
 if (args.has('version') && !command) {
   console.log(version);

package/lib/account-commands.js

@@ -7,7 +7,7 @@ const { spawnSync } = require('child_process');
 const creds = require('./credentials');
 const login = require('./login');
 const unzip = require('./unzip');
-const { findProject, readConfig, writeConfig, newConfig } = require('./project');
+const { findProject, hasConfig, readConfig, writeConfig, newConfig } = require('./project');
 const { hostOf, apiFor, makeConfirm, makeAskLine, askHidden } = require('./ui');
 
 const PROJECT_NAME_RE = /^[a-z][a-z0-9_-]{2,30}$/;
@@ -224,7 +224,7 @@ async function ensurePlan(api, acct) {
 
   const started = await call('/start-free').catch(() => null);
   if (!started || !started.r.ok) return null;   // the create below says why
-  console.log(`\n✓ You're on the free plan: $${started.data.credit || 10} of credit each month, 1 app (any size), 1 GB storage.`);
+  console.log(`\n✓ You're on the free plan: $${started.data.credit || 10} of credit each month, any number of apps at any size, 1 GB storage.`);
   console.log(`  Upgrade any time at ${api}/`);
   return 'free';
 }
@@ -274,27 +274,78 @@ function sizeList(catalog) {
   return catalog.order.map(k => `${catalog.tiers[k].memoryHigh.replace(/M$/, 'mb').replace(/G$/, 'gb').toLowerCase()} (${k})`).join(', ');
 }
 
+// A project's package.json must not be named "nukebase": npm resolves
+// `npx nukebase` to the current project when the names match, and a project
+// has no executable, so every command inside it fails with "could not
+// determine executable to run". Older server templates shipped that name;
+// the project's own name (a valid npm name) replaces it. Returns true when
+// it changed something.
+function namePackage(dir, name) {
+  const pkgPath = path.join(dir, 'package.json');
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    if (pkg.name !== 'nukebase' && pkg.name !== 'nukebase-app') return false;
+    pkg.name = name;
+    fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+    return true;
+  } catch { return false; }
+}
+
 // Create `name` on the server and unpack it into `dest`. Returns
 // { exists: true } when the account already has a project by that name, so
 // `start` can try the next one; any other failure stops the command.
 async function createProject({ acct, api, name, tier, dest, install }) {
   console.log(`\n🚀 Creating ${name}...`);
-  let res;
+  const headers = (extra = {}) => ({ ...extra, 'X-Project': name, Cookie: cookieFor(acct) });
+
+  // The connection dropped while the server was setting up. That is not the
+  // same as "not created": setup ends with an nginx reload, and a reload
+  // sends GOAWAY on an open HTTP/2 connection, which Node's fetch reports as
+  // a failed request after the project already exists. (Older servers reload
+  // before streaming the ZIP; current ones reload after.) So check, and if it
+  // is there, fetch its files the other way rather than leaving a project
+  // behind and trying the next name.
+  async function recover(err) {
+    const why = err.cause?.message || err.message;
+    let probe = null;
+    try {
+      probe = await fetch(`${api}/sync`, {
+        method: 'POST',
+        headers: headers({ 'Content-Type': 'application/json' }),
+        body: JSON.stringify({ exclude: [], files: {}, direction: 'pull', symlinks: false })
+      });
+    } catch {}
+    if (!probe || probe.status === 404) {
+      fail(`Create failed: ${why}. Check the dashboard before retrying; it may have been created.`);
+    }
+    if (!probe.ok) fail(`Create failed: ${why} (and the server answered ${probe.status} when asked whether ${name} exists).`);
+    console.log(`  (the connection dropped while the server finished setting up ${name} — it exists, downloading it)`);
+    let dl;
+    try {
+      dl = await fetch(`${api}/download-project?project=${encodeURIComponent(name)}`, { headers: headers() });
+    } catch (e) {
+      fail(`${name} was created but could not be downloaded (${e.cause?.message || e.message}). Link to it: nukebase link ${name}`);
+    }
+    if (!dl.ok) fail(`${name} was created but could not be downloaded (${dl.status}). Link to it: nukebase link ${name}`);
+    return Buffer.from(await dl.arrayBuffer());
+  }
+
+  let res = null, zip = null;
   try {
     res = await fetch(`${api}/project`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', 'X-Project': name, Cookie: cookieFor(acct) },
+      headers: headers({ 'Content-Type': 'application/json' }),
       body: JSON.stringify({ tier })
     });
   } catch (e) {
-    fail(`Create failed: ${e.cause?.message || e.message}. Check the dashboard before retrying; it may have been created.`);
+    zip = await recover(e);
   }
-  if (!res.ok) {
+  if (res && !res.ok) {
     let msg = '';
     try { msg = (await res.json()).error; } catch {}
     if (res.status === 400 && /already exists/i.test(msg || '')) return { exists: true };
     if (res.status === 401) fail(`The sign-in for ${acct.label} is no longer valid. Run: nukebase login --email ${acct.label}`);
-    // No plan, no credit, or the free plan's one project: all fixed on the dashboard.
+    // No plan or no credit: fixed on the dashboard.
     if (res.status === 403 && /plan|funds|credit|wallet|balance|upgrade/i.test(msg)) {
       fail(`${msg}\n   Manage your plan at ${api}/`);
     }
@@ -302,18 +353,25 @@ async function createProject({ acct, api, name, tier, dest, install }) {
   }
 
   // The server finishes setup as the ZIP finishes streaming, so read it all.
-  const zip = Buffer.from(await res.arrayBuffer());
+  // A drop here is the same case as above.
+  if (!zip) {
+    try { zip = Buffer.from(await res.arrayBuffer()); }
+    catch (e) { zip = await recover(e); }
+  }
   fs.mkdirSync(dest, { recursive: true });
   const count = unzip.extract(zip, dest);
 
   let base = {};
   try { base = readConfig(dest); } catch {}
   writeConfig(dest, newConfig({ api, uid: acct.uid, project: name, account: acct.label }, base));
+  namePackage(dest, name);
   console.log(`✓ Downloaded ${count} files into ${path.relative(process.cwd(), dest) || 'this folder'}`);
 
   if (install && fs.existsSync(path.join(dest, 'package.json'))) {
     console.log('\n📦 npm install\n');
-    const r = spawnSync('npm', ['install'], { cwd: dest, stdio: 'inherit', shell: process.platform === 'win32' });
+    // One command string under a shell: npm is npm.cmd on Windows, which
+    // needs a shell, and Node 26 deprecates passing separate args with one.
+    const r = spawnSync('npm install', [], { cwd: dest, stdio: 'inherit', shell: true });
     if (r.status !== 0) console.log(`\n⚠️  npm install failed. Run it yourself in ${dest}.`);
   }
   return { ok: true, url: `https://${acct.uid}-${name}.${hostOf(api)}` };
@@ -402,7 +460,16 @@ async function startCommand(args) {
   const emailArg = args.positional.find(a => a.includes('@')) || args.get('as');
   console.log('\n  Welcome to NukeBase.');
 
-  let acct = emailArg ? creds.find(emailArg) : (creds.getDefault() || creds.list()[0]);
+  // With several accounts signed in, ask — creating a project bills the
+  // account, so never guess between them. Only interactively: an agent (no
+  // terminal) or --yes gets the default, as before.
+  let acct = emailArg ? creds.find(emailArg) : null;
+  if (!acct && !emailArg) {
+    const list = creds.list();
+    acct = (list.length > 1 && process.stdin.isTTY && !args.has('yes'))
+      ? await chooseAccount(args, null, false)
+      : (creds.getDefault() || list[0]);
+  }
   if (!acct) {
     console.log('\n  Confirm your Claude session: click Confirm in the browser window that opens.');
     await loginCommand(parse(['login', ...(emailArg ? ['--email', emailArg] : []), ...passFlags]));
@@ -469,7 +536,7 @@ async function linkCommand(args) {
 
   const root = process.cwd();
   let base = {};
-  const existing = fs.existsSync(path.join(root, 'sys', 'config.json'));
+  const existing = hasConfig(root);
   if (existing) {
     try { base = readConfig(root); } catch {}
     if (base.uid && base.uid !== acct.uid && !(await makeConfirm(autoYes)(`This folder belongs to ${base.account || base.uid}. Link it to ${acct.label} instead? (y/n) `))) {
@@ -483,6 +550,7 @@ async function linkCommand(args) {
 }
 
 module.exports = {
+  namePackage,
   login: loginCommand,
   logout: logoutCommand,
   accounts: accountsCommand,

package/lib/project-commands.js

@@ -1,5 +1,5 @@
 // Commands that act on the project in the current folder: push, pull, update,
-// rollback, backup, env, pause/restart/delete, domain, logs, download and
+// rollback, backup, env, pause/restart/resume/delete, domain, logs, download and
 // regiontransfer. Loaded by bin/nukebase.js, which runs the command named in
 // process.argv when this module is required.
 const { existsSync, readdirSync, statSync, lstatSync, readlinkSync, symlinkSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, rmdirSync } = require('fs');
@@ -15,7 +15,7 @@ const tar = require('tar');
 const createClient = require('./sdk');
 const creds = require('./credentials');
 const loginFlows = require('./login');
-const { findProject, readConfig, writeConfig, migrateLegacy } = require('./project');
+const { findProject, readConfig, writeConfig, restoreSettings, migrateLegacy } = require('./project');
 const { regionApi, hostOf } = require('./ui');
 
 const args = require('./args').parse(process.argv.slice(2));
@@ -28,18 +28,17 @@ const BIN = require.resolve('../bin/nukebase.js');
 
 const root = findProject(process.cwd());
 if (!root) {
-  console.error('Not inside a NukeBase project (no sys/config.json here or above).');
+  console.error('Not inside a NukeBase project (no package.json with a "nukebase" section here or above).');
   console.error('  nukebase create <name>   make a new one');
   console.error('  nukebase link <name>     connect this folder to an existing one');
   process.exit(1);
 }
-const configPath = join(root, 'sys', 'config.json');
 let config = readConfig(root);
 let { project, exclude, API } = config;
 let uid = null, token = null, accountLabel = null;
 
 // `--region <name>` / `--api <url>` point THIS invocation at another region
-// without touching sys/config.json. The account is the same everywhere (auth
+// without touching package.json. The account is the same everywhere (auth
 // replicates), the project is not — so this is how a command reaches a copy
 // of the project elsewhere: `nukebase delete --region usw3` after a transfer,
 // or the transfer itself driving the target. A region's API is its name as
@@ -58,7 +57,7 @@ const AS = args.get('as');
 // ---------------------------------------------------------------------------
 // The backup set
 // ---------------------------------------------------------------------------
-// sys/config.json carries two path lists. They are INDEPENDENT — each does
+// package.json carries two path lists. They are INDEPENDENT — each does
 // exactly one job, and neither implies the other:
 //
 //   exclude  what push and pull skip. Nothing else reads it.
@@ -101,7 +100,7 @@ const backupPaths = Array.isArray(config.backup) && config.backup.length
 // `nukebase rollback backup` — the word "backup" always names the same set.
 const INCLUDE_BACKUP = args.get('include') === 'backup';
 
-// `.env` is never part of a code push or pull, whatever sys/config.json says.
+// `.env` is never part of a code push or pull, whatever package.json says.
 // It is the input to `nukebase env push`, which carries it to a root-owned file
 // OUTSIDE the project on the server. An ordinary push copying it into the
 // project tree would put secrets where the ZIP download and every restore
@@ -132,7 +131,7 @@ const localExclude = INCLUDE_BACKUP
 // idle, 520 Mbps with four at once. So a large transfer is split into STREAMS
 // groups of roughly equal size that move concurrently.
 //
-//   sys/config.json  "streams": 4 (default, 1-8)
+//   package.json  "streams": 4 (default, 1-8)
 //   --streams <n>    override for one command; --streams 1 is the old behaviour
 //
 // Small transfers (under PARALLEL_MIN_BYTES and PARALLEL_MIN_FILES) stay one
@@ -325,7 +324,7 @@ async function connectAndLogin() {
     ({ uid, token } = acct);
     accountLabel = acct.label || acct.uid;
   } else {
-    if (!config.uid) die('sys/config.json has no "uid", so this folder has no owner.', 'Run: nukebase link <project>');
+    if (!config.uid) die('The "nukebase" section of package.json has no "uid", so this folder has no owner.', 'Run: nukebase link <project>');
     const acct = creds.get(config.uid);
     if (!acct) {
       die(`This project belongs to ${config.account || 'uid'} (${config.uid}), which isn't signed in on this machine.`,
@@ -659,9 +658,9 @@ function cleanHeaders(headers) {
 //
 // Creates it through the same /project the dashboard uses — template files,
 // nginx block, unit started, project node with a tier — then returns so the
-// push proceeds and replaces the template with the local files. `sys` is in
-// the default exclude, so the server keeps the sys/config.json /project
-// wrote for it (the new region's own mail key); the local one is untouched.
+// push proceeds and replaces the template with the local files, package.json
+// and its settings included. The mail key the new region's easy-login needs
+// is in no file: the platform hands it to the process at every start.
 //
 // Size comes from --tier <name>, else a prompt, else the server's default.
 // The server enforces plan and wallet for that region and its error is
@@ -778,7 +777,7 @@ function askLine(question) {
 // ---------------------------------------------------------------------------
 // Every one of these calls the same endpoint the dashboard does, with the same
 // body, so behaviour cannot drift between the two. They all address the project
-// in sys/config.json.
+// in package.json.
 
 // POST to a project endpoint; resolves the parsed JSON, exits with the server's
 // message on failure. A 401 says how to sign back in.
@@ -829,7 +828,7 @@ async function pauseProject() {
 async function restartProject() {
   await connectAndLogin();
   await projectPost('/restart', {}, { label: command });
-  console.log(command === 'restart' ? `🔄 Restarting ${project}...` : `▶️  Starting ${project}...`);
+  console.log(command === 'restart' ? `🔄 Restarting ${project}...` : `▶️  Resuming ${project}...`);
   if (AUTO_YES) { await tailLogsUntilSettled(); process.exit(0); }
   watchLogs();
 }
@@ -863,7 +862,7 @@ async function deleteProject() {
 // Ctrl+C to give up and come back later), then asks the server to verify and
 // issue the certificate — the slow part, up to a minute at Let's Encrypt.
 // --email is the cert contact; it defaults to the account email in
-// sys/config.json.
+// package.json.
 async function domainCommand() {
   await connectAndLogin();
   const sub = args.positional[0] || null;
@@ -1096,7 +1095,7 @@ async function downloadCommand() {
 //   4  push the backup set up to the target                   (downtime ends)
 //   5  copy the hosted environment variables
 //   6  custom domain, if there is one — DNS has to move to the target's IP
-//   7  point sys/config.json at the target
+//   7  point package.json at the target
 //
 // The source is left PAUSED, never deleted: verify the target, then
 // `nukebase delete --region <source>` when satisfied. Base fee and disk keep
@@ -1155,7 +1154,7 @@ async function regionTransfer() {
   // this uid and token; otherwise — or when `--to <email>` says so — another
   // account, signed in on this machine like any other (~/.nukebase). Every
   // target step then runs `--as <email>`, so the source steps keep this
-  // identity and sys/config.json is only rewritten at the very end, when the
+  // identity and package.json is only rewritten at the very end, when the
   // folder changes hands.
   let toEmail = args.get('to') && args.get('to').includes('@') ? args.get('to').trim().toLowerCase() : null;
   let targetUid = uid, targetToken = token;
@@ -1253,7 +1252,7 @@ async function regionTransfer() {
       for (const rest of steps.slice(i)) if (rest.args) console.error(`     nukebase ${rest.args.join(' ')}`);
       console.error(`     nukebase env push --region ${target}${asArgs.length ? ' ' + asArgs.join(' ') : ''}   (after writing the variables to .env)`);
       if (customDomain) console.error(`     nukebase domain ${customDomain} --region ${target} --wait${asArgs.length ? ' ' + asArgs.join(' ') : ''}`);
-      console.error(`   then set "API" in sys/config.json to ${targetApi}`);
+      console.error(`   then set "api" in the "nukebase" section of package.json to ${targetApi}`);
       process.exit(1);
     }
   }
@@ -1308,7 +1307,7 @@ async function regionTransfer() {
     fresh.account = creds.get(targetUid)?.label || toEmail;
   }
   writeConfig(root, fresh);
-  console.log(`  ✓ sys/config.json API → ${targetApi}${toEmail ? `, account → ${fresh.account}` : ''}`);
+  console.log(`  ✓ package.json "nukebase" api → ${targetApi}${toEmail ? `, account → ${fresh.account}` : ''}`);
 
   const oldAs = toEmail ? ` --as ${accountLabel}` : '';
   console.log(`\n✅ "${project}" is running in ${target}: https://${targetUid}-${project}.${targetHost}`);
@@ -1367,7 +1366,7 @@ async function push() {
   if (res.status === 401) authExpired();
 
   // The project is not on this server. That is the normal state when the API
-  // in sys/config.json was just pointed at a different region — the account
+  // in package.json was just pointed at a different region — the account
   // is the same everywhere, the project is not — so offer to create it here
   // and carry on, rather than failing with a bare 404.
   if (res.status === 404) {
@@ -1618,6 +1617,12 @@ async function pull() {
     const pullSizes = {};
     const result = await downloadStreams(root, download, (f) => pullSizes[f] || 0, totalSize);
 
+    // The server's package.json carries whichever settings were last pushed
+    // to it — from another machine, or with --region another region's copy.
+    // This folder's own settings are what the developer meant; put them back
+    // (also after a stop, since the file may already have landed).
+    if (download.includes('package.json')) restoreSettings(root, config);
+
     if (result.stopped) {
       console.log('\n🛑 Pull stopped cleanly. Local file deletes were skipped. Re-run `nukebase pull` to resume.');
       return;
@@ -1810,6 +1815,9 @@ async function update() {
   }
 
   if (!toWrite.length && !hasPackageWork(pkgPlan)) {
+    if (!updateExclude.includes('package.json') && require('./account-commands').namePackage(root, project)) {
+      console.log(`\n✓ package.json name -> "${project}" (was "nukebase"; that name broke npx nukebase in this folder)`);
+    }
     console.log('\n✓ Engine is already up to date');
     process.exit(0);
   }
@@ -1819,7 +1827,7 @@ async function update() {
   const pkgCount = pkgPlan.changes.length + (pkgPlan.versionChanged ? 1 : 0);
   console.log(`\n📊 Total: ${outdated} to update, ${added} new, ${pkgCount} package.json change(s)`);
   console.log('   Local edits to these files will be overwritten — add a path to');
-  console.log('   "updateExclude" in sys/config.json to protect it permanently');
+  console.log('   "updateExclude" in the "nukebase" section of package.json to protect it permanently');
   console.log('   ("package.json" there opts out of dependency pinning).');
 
   const ok = await confirm(`Continue? (y/n) `);
@@ -1839,6 +1847,12 @@ async function update() {
     applyPackageChanges(pkgPlan);
     console.log(`   ✓ package.json (${pkgCount} change(s))`);
   }
+  // Projects from older templates are named "nukebase", which breaks
+  // `npx nukebase` inside them (see namePackage). Repaired here as well, so
+  // one `nukebase update` fixes an existing project.
+  if (!updateExclude.includes('package.json') && require('./account-commands').namePackage(root, project)) {
+    console.log(`   ✓ package.json name -> "${project}" (was "nukebase"; that name broke npx nukebase in this folder)`);
+  }
 
   console.log(`\n✅ Updated ${toWrite.length} file(s) to ${manifest.version}`);
   if (pkgPlan.changes.length) console.log('   → run: npm install');
@@ -2329,9 +2343,9 @@ if (command === 'push' && args.positional[0] === 'env') {
   run(backup);
 } else if (command === 'pause') {
   run(pauseProject);
-} else if (command === 'restart' || command === 'start' || command === 'resume') {
+} else if (command === 'restart' || command === 'resume') {
   // One endpoint: /restart launches a stopped unit and bounces a running one,
-  // so start/resume are the same call under the name the user reaches for.
+  // so resume is the same call under the name the user reaches for.
   run(restartProject);
 } else if (command === 'delete') {
   run(deleteProject);

package/lib/project.js

@@ -1,38 +1,133 @@
-// A project folder: finding it, its sys/config.json, and moving sign-ins left
-// there by the old per-project CLI into ~/.nukebase.
+// A project folder: finding it and its settings.
 //
-// sys/config.json now holds only non-secret settings: API, uid (which account
-// owns the project), project, account (that account's email or username, for
-// messages), and the exclude/backup/updateExclude/streams settings.
+// Settings live under the "nukebase" key of package.json. Every project has
+// one, `nukebase update` already rewrites it, and npm leaves keys it does not
+// know alone. They hold no account sign-in — only api (the region), uid (which
+// account owns the project), project, account (that account's email, for
+// messages), mailKey (the project's key for hosted sign-in emails, read by the
+// easy-login extension) and the exclude/backup/updateExclude/streams settings.
+// Tokens live in
+// ~/.nukebase/credentials.json (see credentials.js). Push and pull carry
+// package.json, so a fresh clone of a project is already linked.
+//
+// Projects made before 2.1 keep the same settings in sys/config.json. That
+// file is still read, and the first command moves it into package.json. The
+// master project is the exception: its fallback CLI (sys/deploy.js) reads
+// sys/config.json, so there the file is kept and merely stripped of sign-ins.
 
 const fs = require('fs');
 const path = require('path');
 const creds = require('./credentials');
 const login = require('./login');
 
-const DEFAULT_EXCLUDE = ['sys', '.env', 'server/data', 'server/backup', 'server/files'];
+const KEY = 'nukebase';
+const DEFAULT_EXCLUDE = ['.env', 'server/data', 'server/backup', 'server/files'];
 const DEFAULT_BACKUP = ['server/data', 'server/files'];
 const SECRET_FIELDS = ['token', 'password', 'username', 'email', 'privateKey'];
+// Written first, in this order, so the section reads the same in every project.
+const FIELD_ORDER = ['api', 'uid', 'project', 'account', 'exclude', 'backup', 'updateExclude', 'streams'];
+
+const pkgPathOf = (root) => path.join(root, 'package.json');
+const legacyPathOf = (root) => path.join(root, 'sys', 'config.json');
+const isMaster = (root) => fs.existsSync(path.join(root, 'server', 'region.config.json'));
+
+function readPkg(root) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPathOf(root), 'utf8'));
+    return pkg && typeof pkg === 'object' && !Array.isArray(pkg) ? pkg : null;
+  } catch { return null; }
+}
+
+function pkgSection(root) {
+  const pkg = readPkg(root);
+  const s = pkg && pkg[KEY];
+  return s && typeof s === 'object' && !Array.isArray(s) ? s : null;
+}
+
+// Does this folder carry project settings, in either place?
+function hasConfig(dir) {
+  return !!pkgSection(dir) || fs.existsSync(legacyPathOf(dir));
+}
+
+// Settings only in sys/config.json: they have not moved into package.json yet.
+function isLegacy(root) {
+  return !pkgSection(root) && fs.existsSync(legacyPathOf(root));
+}
 
 function findProject(dir) {
   while (dir !== path.dirname(dir)) {
-    if (fs.existsSync(path.join(dir, 'sys', 'config.json'))) return dir;
+    if (hasConfig(dir)) return dir;
     dir = path.dirname(dir);
   }
   return null;
 }
 
-function configPathOf(root) {
-  return path.join(root, 'sys', 'config.json');
+// The settings as the commands use them: `API` is the one name every command
+// reads (package.json stores it as `api`); everything else as stored.
+function readConfig(root) {
+  const section = pkgSection(root);
+  const raw = section || JSON.parse(fs.readFileSync(legacyPathOf(root), 'utf8'));
+  const { api, ...rest } = raw;
+  return { API: rest.API || api, ...rest };
 }
 
-function readConfig(root) {
-  return JSON.parse(fs.readFileSync(configPathOf(root), 'utf8'));
+// The stored form: `api` first, then the known fields in a fixed order, then
+// anything else the project added.
+function toSection(config) {
+  const { API, api, ...rest } = config;
+  const all = { api: API || api, ...rest };
+  const section = {};
+  for (const k of FIELD_ORDER) if (all[k] !== undefined) section[k] = all[k];
+  for (const [k, v] of Object.entries(all)) if (!(k in section) && v !== undefined) section[k] = v;
+  return section;
 }
 
+// Write the settings into package.json. A folder without one (`nukebase link`
+// into an empty directory) gets a minimal package.json; a package.json without
+// the section gets it right after "version", where a reader looks first.
+// sys/config.json, if present, goes — except in the master project, where it
+// is rewritten without sign-ins for the fallback CLI that still reads it.
 function writeConfig(root, config) {
-  fs.mkdirSync(path.join(root, 'sys'), { recursive: true });
-  fs.writeFileSync(configPathOf(root), JSON.stringify(config, null, 2) + '\n');
+  const section = toSection(config);
+  const existing = readPkg(root);
+  let pkg;
+  if (!existing) {
+    pkg = { name: String(section.project || path.basename(root)).toLowerCase(), version: '0.0.0', private: true, [KEY]: section };
+  } else if (KEY in existing) {
+    pkg = { ...existing, [KEY]: section };
+  } else {
+    pkg = {};
+    const after = 'version' in existing ? 'version' : ('name' in existing ? 'name' : null);
+    for (const [k, v] of Object.entries(existing)) {
+      pkg[k] = v;
+      if (k === after) pkg[KEY] = section;
+    }
+    if (!after) pkg[KEY] = section;
+  }
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(pkgPathOf(root), JSON.stringify(pkg, null, 2) + '\n');
+
+  const legacy = legacyPathOf(root);
+  if (!fs.existsSync(legacy)) return;
+  if (isMaster(root)) {
+    const clean = { API: section.api, ...section };
+    delete clean.api;
+    for (const f of SECRET_FIELDS) delete clean[f];
+    fs.writeFileSync(legacy, JSON.stringify(clean, null, 2) + '\n');
+    return;
+  }
+  try { fs.unlinkSync(legacy); } catch {}
+  try { if (!fs.readdirSync(path.dirname(legacy)).length) fs.rmdirSync(path.dirname(legacy)); } catch {}
+}
+
+// After a pull: the server's package.json carries whichever settings were
+// last pushed to it — from another machine, or with --region another region's
+// copy. The settings this folder had before the pull are what the developer
+// meant, so they go back in.
+function restoreSettings(root, config) {
+  const pulled = pkgSection(root);
+  if (pulled && pulled.mailKey && !config.mailKey) config = { ...config, mailKey: pulled.mailKey };
+  writeConfig(root, config);
 }
 
 // The settings a freshly linked or created project gets.
@@ -44,7 +139,7 @@ function newConfig({ api, uid, project, account }, base = {}) {
     updateExclude: base.updateExclude || [],
     streams: base.streams || 4
   };
-  for (const [k, v] of Object.entries(base)) if (!(k in out) && !SECRET_FIELDS.includes(k)) out[k] = v;
+  for (const [k, v] of Object.entries(base)) if (!(k in out) && k !== 'api' && !SECRET_FIELDS.includes(k)) out[k] = v;
   return out;
 }
 
@@ -55,19 +150,29 @@ function sessionFiles(root) {
   } catch { return []; }
 }
 
+// Settings still in sys/config.json move into package.json. Returns the
+// config unchanged; the move is on disk.
+function moveSettings(root, config) {
+  if (!isLegacy(root)) return config;
+  writeConfig(root, config);
+  console.log(`📦 Moved this project's settings from sys/config.json into package.json (its "${KEY}" section).`);
+  return config;
+}
+
 // Errors that mean "try again later" rather than "this sign-in is dead": a
 // server without CLI sign-in yet, or no connection. The old sign-in is kept
 // and used as before until the move can happen.
 const isOldServer = (e) => /doesn't support CLI sign-in|Could not reach/.test(e.message);
 
-// Move a project's old sign-in into ~/.nukebase, then strip it from
-// sys/config.json. Returns the config to use.
+// Move a project's old sign-in into ~/.nukebase, then strip it from the
+// settings; move the settings themselves into package.json. Returns the
+// config to use.
 // On a server without CLI sign-in yet, nothing changes and `legacy` is true:
 // the caller then uses the token from sys/config.json as before.
 async function migrateLegacy(root, config) {
   const hasSecrets = SECRET_FIELDS.some(f => config[f]);
   const sessions = sessionFiles(root);
-  if (!hasSecrets && !sessions.length) return { config, legacy: false };
+  if (!hasSecrets && !sessions.length) return { config: moveSettings(root, config), legacy: false };
 
   const api = config.API;
   const label = config.email || config.username || null;
@@ -113,13 +218,13 @@ async function migrateLegacy(root, config) {
     const clean = { ...config, account: config.account || label || undefined };
     for (const f of SECRET_FIELDS) delete clean[f];
     writeConfig(root, clean);
-    console.log('🔒 Removed the sign-in (token, password) from sys/config.json. Projects now hold only which account owns them.');
+    console.log(`🔒 Removed the sign-in (token, password) from this project's settings. Projects now hold only which account owns them, under "${KEY}" in package.json.`);
     if (config.uid && !creds.get(config.uid)) {
       console.log(`   This project's account isn't signed in on this machine. Run: nukebase login${label && label.includes('@') ? ` --email ${label}` : ''}`);
     }
     return { config: clean, legacy: false };
   }
-  return { config, legacy: false };
+  return { config: moveSettings(root, config), legacy: false };
 }
 
-module.exports = { findProject, configPathOf, readConfig, writeConfig, newConfig, migrateLegacy, DEFAULT_EXCLUDE, DEFAULT_BACKUP };
+module.exports = { KEY, findProject, hasConfig, readConfig, writeConfig, restoreSettings, newConfig, migrateLegacy, DEFAULT_EXCLUDE, DEFAULT_BACKUP };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nukebase",
-  "version": "2.0.6",
+  "version": "2.1.1",
   "description": "NukeBase CLI: create, deploy and manage NukeBase projects",
   "bin": {
     "nukebase": "bin/nukebase.js"