@fork-hu/cli2 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,115 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+# Fork szerver telepítése – @fork-hu/cli2 1.x
+
+Helyszíni (Windows) telepítés és frissítés a privát `fork-hu/fork-releases` repó GitHub Release-eiből. A régi, 0.2.x-es CLI-vel készült telepítéseket a [Régi telepítés átvétele](#régi-telepítés-átvétele) rész veszi át.
+
+## Előfeltételek
+
+- Windows 10 vagy 11, **rendszergazdaként** megnyitott PowerShell.
+- [Node.js 24 LTS](https://nodejs.org/). A szolgáltatás azzal a Node-dal fut, amellyel a CLI-t futtatod.
+- MySQL 8.4 a `fork` adatbázissal és a `fork`/`fork` felhasználóval.
+  - Az adatkönyvtár létrehozásakor be kell állítani: `lower_case_table_names=1`, `sql_mode=""`.
+  - Új helyszínen az adatbázist továbbra is az alap-dumpból kell létrehozni: üres adatbázison a szerver nem indul el.
+- A Forktól kapott **`.forkdeploy`** fájl. Ebben van a domain, a tanúsítvány és a helyszíni release-token (`releaseToken`).
+- Szabad 80-as és 443-as port, internet-hozzáférés a `github.com`-hoz.
+
+## 1. A CLI telepítése
+
+```powershell
+npm i -g @fork-hu/cli2
+```
+
+Frissíteni ugyanezzel a paranccsal lehet. A parancs neve `fork2`. A régi, 0.2.x-es CLI (`@fork-hu/cli`, `fork` parancs) egymás mellett megmaradhat vele, és a beállításaik is külön helyen vannak.
+
+## 2. Első telepítés
+
+1. Hozd létre a telepítési mappát (például `C:\fork-deploy`), és másold bele a `.forkdeploy` fájlt.
+2. Futtasd az initet. Ellenőrzi és kiírja a tanúsítványokat, a CA-t felveszi a Root tárolóba, beírja a hosts-bejegyzést, és elmenti a release-tokent. Egy összesítő után megerősítést kér.
+
+   ```powershell
+   fork2 init C:\fork-deploy
+   ```
+
+3. Ha az adatbázis nem a `127.0.0.1:3306`-on, `fork`/`fork` felhasználóval érhető el, hozd létre a `C:\fork-deploy\data\config.local.json` fájlt, például:
+
+   ```json
+   { "database": { "port": 3307, "password": "..." } }
+   ```
+
+4. Telepítés: letöltés, aláírás- és hash-ellenőrzés, `npm ci`, Windows-szolgáltatás, indítás, egészség-ellenőrzés.
+
+   ```powershell
+   fork2 install
+   ```
+
+   Béta verzióhoz `fork2 install beta`, egy adott verzióhoz `fork2 install v1.6.0`.
+
+5. Ellenőrzés: futtasd a `fork2 status` parancsot, majd nyisd meg böngészőben a `https://<domain>/admin` oldalt. A szerver első induláskor saját titkokat generál, ezért a rendelő terminálokat párosítani kell.
+
+## Frissítés és visszaállítás
+
+```powershell
+fork2 update
+```
+
+- Az alapértelmezett csatorna a `latest`; `fork2 update beta` a bétát, `fork2 update v1.6.0` egy adott verziót telepít.
+- Az új verzió a régi mellé kerül. Ha 90 másodpercen belül nem válaszol, a CLI magától visszaáll az előzőre.
+- Kézi visszaállás az előző verzióra:
+
+  ```powershell
+  fork2 rollback
+  ```
+
+## Régi telepítés átvétele
+
+0.2.x-es CLI-vel készült telepítésnél (például `C:\fork-deploy\server`):
+
+1. Telepítsd a Node.js 24-et és az új CLI-t (1. lépés).
+2. Ha a `.forkdeploy` fájlban még nincs `releaseToken`, add meg a tokent:
+
+   ```powershell
+   fork2 token <token>
+   ```
+
+3. Futtasd az átvételt. Eltávolítja a régi szolgáltatást, a régi `server` mappát `server-legacy-<dátum>` néven félreteszi, és telepíti az új verziót.
+
+   ```powershell
+   fork2 migrate
+   ```
+
+4. **Minden terminált újra kell párosítani**, mert az új szerver saját JWT-titkot használ.
+
+## Üzemeltetés
+
+| Parancs | Mit csinál |
+|---|---|
+| `fork2 status` | telepített és elérhető verziók |
+| `fork2 start` / `stop` / `restart` | a „Fork Server” Windows-szolgáltatás kezelése |
+| `fork2 logs` | a szolgáltatás naplói |
+| `fork2 token <token>` | lejárt vagy visszavont release-token cseréje |
+| `fork2 uninstall` | a szolgáltatás eltávolítása (a `releases\` és a `data\` megmarad) |
+| `fork2 config` | a CLI beállításfájljának helye (`%APPDATA%\fork\cli.json`) |
+
+A telepítési mappa szerkezete:
+
+```
+C:\fork-deploy\
+  ssl\              tanúsítványok a .forkdeploy-ból
+  releases\<tag>\   az aktív és az előző verzió
+  server            junction az aktív verzióra
+  data\             .fork-secrets.json, access.log, config.local.json, sslcert -> ..\ssl
+  launcher\         ezt futtatja a szolgáltatás; naplók: launcher\daemon\
+  state.json        aktív és előző verzió
+```
+
+**Mentés:** az adatbázis és a `data\.fork-secrets.json`. Ha ez a fájl elvész, minden terminált újra kell párosítani.
+
+## Hibaelhárítás
+
+| Hiba | Teendő |
+|---|---|
+| `GitHub 401` / `404 … check the release token` | A token lejárt, visszavonták, vagy nincs olvasási joga a `fork-releases`-re: `fork2 token <új token>`. |
+| `signature is invalid` / `is corrupted` | A letöltött csomag nem a Forktól jött, vagy megsérült; a CLI nem telepíti. Próbáld újra, és ha ismétlődik, jelezd. |
+| `Update … failed, … is running again` | Az új verzió nem indult el, a régi fut. Az okot a `fork2 logs` mutatja (gyakran DB-kapcsolat vagy foglalt port). |
+| `needs administrator rights` | Rendszergazdaként megnyitott PowerShellből futtasd. |
+| `Node.js 24+ is required` | Telepítsd a Node.js 24 LTS-t, utána futtasd újra a parancsot. |
+| `A legacy installation is in the way` | 0.2.x-es telepítés van a mappában: `fork2 migrate`. |

package/dist/fork.mjs

@@ -0,0 +1,603 @@
+#!/usr/bin/env node
+
+// src/main.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync4, renameSync as renameSync2, statSync } from "fs";
+import { createRequire as createRequire2 } from "module";
+import { join as join5, resolve as resolve2 } from "path";
+import { createInterface } from "readline/promises";
+
+// src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+
+// src/release-key.ts
+var RELEASE_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAbZ7I1PbVBqlG5QZGJCDr51GARB4oAAWKseckv3UIgek=
+-----END PUBLIC KEY-----
+`;
+var DEFAULT_RELEASE_REPO = "fork-hu/fork-releases";
+
+// src/config.ts
+var defaults = {
+  releaseRepo: DEFAULT_RELEASE_REPO,
+  healthUrl: "https://127.0.0.1/api/status"
+};
+var configPath = () => process.env.FORK_CLI_CONFIG ?? join(process.env.APPDATA ?? join(homedir(), ".config"), "fork", "cli.json");
+var loadConfig = () => {
+  const file = configPath();
+  if (!existsSync(file)) return { ...defaults };
+  return { ...defaults, ...JSON.parse(readFileSync(file, "utf8")) };
+};
+var saveConfig = (config) => {
+  const file = configPath();
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(config, null, "	") + "\n", { mode: 384 });
+};
+var legacyInstallLocation = () => {
+  const file = join(process.env.APPDATA ?? join(homedir(), ".config"), "fork-cli-nodejs", "Config", "config.json");
+  if (!existsSync(file)) return void 0;
+  return JSON.parse(readFileSync(file, "utf8"))["install-location"];
+};
+
+// src/deploy.ts
+import { X509Certificate, createPrivateKey } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, readdirSync, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+var findForkDeploy = (dir) => {
+  const name2 = existsSync2(dir) ? readdirSync(dir).find((f) => f.endsWith(".forkdeploy")) : void 0;
+  return name2 ? join2(dir, name2) : void 0;
+};
+var readForkDeploy = (file) => {
+  const data = JSON.parse(readFileSync2(file, "utf8"));
+  for (const field of ["domain", "cert", "key", "ca"]) {
+    if (!data[field]) throw new Error(`${file} has no "${field}"`);
+  }
+  return data;
+};
+var describeForkDeploy = (deploy) => {
+  const cert = new X509Certificate(deploy.cert);
+  const ca = new X509Certificate(deploy.ca);
+  return {
+    domain: deploy.domain,
+    subject: cert.subject.replace(/\n/g, ", "),
+    san: cert.subjectAltName ?? "none",
+    validTo: new Date(cert.validTo),
+    keyMatches: cert.checkPrivateKey(createPrivateKey(deploy.key)),
+    signedByCa: cert.verify(ca.publicKey),
+    hasReleaseToken: Boolean(deploy.releaseToken)
+  };
+};
+var writeSslFiles = (sslDir, deploy) => {
+  mkdirSync2(sslDir, { recursive: true });
+  writeFileSync2(join2(sslDir, "cert.pem"), deploy.cert);
+  writeFileSync2(join2(sslDir, "key.pem"), deploy.key, { mode: 384 });
+  writeFileSync2(join2(sslDir, "privkey.pem"), deploy.key, { mode: 384 });
+  writeFileSync2(join2(sslDir, "ca.pem"), deploy.ca);
+};
+
+// src/layout.ts
+import { existsSync as existsSync3, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync3, readlinkSync, rmdirSync, symlinkSync, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3, resolve } from "path";
+var paths = (root) => ({
+  root,
+  ssl: join3(root, "ssl"),
+  releases: join3(root, "releases"),
+  release: (tag) => join3(root, "releases", tag),
+  server: join3(root, "server"),
+  data: join3(root, "data"),
+  downloads: join3(root, "downloads"),
+  launcher: join3(root, "launcher"),
+  launcherScript: join3(root, "launcher", "run.cjs"),
+  state: join3(root, "state.json")
+});
+var readState = (p) => existsSync3(p.state) ? JSON.parse(readFileSync3(p.state, "utf8")) : {};
+var writeState = (p, state) => writeFileSync3(p.state, JSON.stringify(state, null, "	") + "\n");
+var isLink = (path) => {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+};
+var removeLink = (path) => {
+  if (!isLink(path)) return;
+  try {
+    unlinkSync(path);
+  } catch {
+    rmdirSync(path);
+  }
+};
+var pointLink = (link, target) => {
+  removeLink(link);
+  if (existsSync3(link)) throw new Error(`${link} exists and is not a link; run "fork2 migrate" for a legacy installation`);
+  symlinkSync(resolve(target), link, "junction");
+};
+var linkTarget = (link) => isLink(link) ? resolve(readlinkSync(link)) : void 0;
+var isLegacyLayout = (p) => existsSync3(p.server) && !isLink(p.server);
+var LAUNCHER = `// Generated by @fork-hu/cli2. The Windows service runs this file, so it lives outside the release
+// folders: it switches to the data directory and loads the active release through the "server" junction.
+const path = require('node:path')
+process.chdir(path.join(__dirname, '..', 'data'))
+require(path.join(__dirname, '..', 'server', 'main.js'))
+`;
+var ensureBaseLayout = (p) => {
+  for (const dir of [p.releases, p.data, p.downloads, p.launcher]) mkdirSync3(dir, { recursive: true });
+  writeFileSync3(p.launcherScript, LAUNCHER);
+  const sslLink = join3(p.data, "sslcert");
+  if (existsSync3(p.ssl) && !isLink(sslLink)) symlinkSync(p.ssl, sslLink, "junction");
+};
+
+// src/log.ts
+import { styleText } from "util";
+var log = {
+  info: (...parts) => console.log(...parts),
+  step: (text) => console.log(styleText("cyan", "\u203A ") + text),
+  success: (text) => console.log(styleText("green", "\u2714 ") + text),
+  warn: (text) => console.warn(styleText("yellow", "! ") + text),
+  error: (text) => console.error(styleText("red", "\u2716 ") + text)
+};
+
+// src/server.ts
+import { spawn } from "child_process";
+import { copyFileSync, existsSync as existsSync4, readdirSync as readdirSync2, renameSync, rmSync } from "fs";
+import { request as request2 } from "https";
+import { join as join4 } from "path";
+import AdmZip from "adm-zip";
+
+// src/github.ts
+import { createWriteStream } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+var GitHubError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+};
+var API = "https://api.github.com";
+var request = async (fetchImpl, token, path, accept = "application/vnd.github+json") => {
+  const response = await fetchImpl(API + path, {
+    headers: {
+      Accept: accept,
+      Authorization: `Bearer ${token}`,
+      "X-GitHub-Api-Version": "2022-11-28",
+      "User-Agent": "fork-cli"
+    },
+    redirect: "follow"
+  });
+  if (!response.ok) {
+    const hint = response.status === 401 || response.status === 404 ? " (check the release token: it needs read access to the release repository)" : "";
+    throw new GitHubError(`GitHub ${response.status} for ${path}${hint}`, response.status);
+  }
+  return response;
+};
+var toRelease = (r) => ({ tag: r.tag_name, prerelease: r.prerelease, assets: r.assets });
+var resolveRelease = async (repo, token, selector, fetchImpl = fetch) => {
+  if (selector === "latest") {
+    const response2 = await request(fetchImpl, token, `/repos/${repo}/releases/latest`);
+    return toRelease(await response2.json());
+  }
+  if (selector === "beta") {
+    const response2 = await request(fetchImpl, token, `/repos/${repo}/releases?per_page=30`);
+    const releases = (await response2.json()).filter((r) => !r.draft);
+    if (!releases.length) throw new GitHubError(`No releases in ${repo}`, 404);
+    return toRelease(releases[0]);
+  }
+  if (!/^v\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/.test(selector)) {
+    throw new Error(`Unknown release "${selector}": use latest, beta or a version tag such as v1.6.0`);
+  }
+  const response = await request(fetchImpl, token, `/repos/${repo}/releases/tags/${selector}`);
+  return toRelease(await response.json());
+};
+var findAsset = (release, name2) => {
+  const asset = release.assets.find((a) => a.name === name2);
+  if (!asset) throw new Error(`Release ${release.tag} has no ${name2}`);
+  return asset;
+};
+var downloadAsset = async (repo, token, asset, destination, fetchImpl = fetch) => {
+  const response = await request(fetchImpl, token, `/repos/${repo}/releases/assets/${asset.id}`, "application/octet-stream");
+  if (!response.body) throw new Error(`Empty download for ${asset.name}`);
+  await pipeline(Readable.fromWeb(response.body), createWriteStream(destination));
+};
+var downloadText = async (repo, token, asset, fetchImpl = fetch) => {
+  const response = await request(fetchImpl, token, `/repos/${repo}/releases/assets/${asset.id}`, "application/octet-stream");
+  return response.text();
+};
+
+// src/verify.ts
+import { createHash, createPublicKey, verify } from "crypto";
+import { createReadStream } from "fs";
+var verifySignature = (content, signatureBase64, publicKeyPem) => verify(null, Buffer.from(content, "utf8"), createPublicKey(publicKeyPem), Buffer.from(signatureBase64.trim(), "base64"));
+var parseChecksums = (content) => {
+  const sums = /* @__PURE__ */ new Map();
+  for (const line of content.split(/\r?\n/)) {
+    const match = /^([0-9a-f]{64}) [ *](.+)$/.exec(line.trim());
+    if (match) sums.set(match[2], match[1]);
+  }
+  return sums;
+};
+var sha256File = async (file) => {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return hash.digest("hex");
+};
+var verifyRelease = async (options) => {
+  if (!verifySignature(options.sums, options.signature, options.publicKey)) {
+    throw new Error("SHA256SUMS signature is invalid: the release was not signed by Fork, refusing to install");
+  }
+  const expected = parseChecksums(options.sums).get(options.fileName);
+  if (!expected) throw new Error(`SHA256SUMS does not list ${options.fileName}`);
+  const actual = await sha256File(options.file);
+  if (actual !== expected) throw new Error(`${options.fileName} is corrupted (sha256 ${actual}, expected ${expected})`);
+};
+
+// src/server.ts
+var archiveName = (tag) => `fork-server-${tag}.zip`;
+var npmInstall = (dir) => new Promise((resolve3, reject) => {
+  const lock = existsSync4(join4(dir, "package-lock.json"));
+  const command2 = `npm ${lock ? "ci" : "install"} --omit=dev --no-audit --no-fund`;
+  const child = spawn(command2, { cwd: dir, shell: true, stdio: "inherit" });
+  child.on("error", reject);
+  child.on("close", (code) => code === 0 ? resolve3() : reject(new Error(`${command2} failed (exit code ${code})`)));
+});
+var httpHealthCheck = (url, timeoutMs = 9e4) => async () => {
+  const deadline = Date.now() + timeoutMs;
+  let last = "no answer";
+  while (Date.now() < deadline) {
+    const status = await new Promise((resolve3) => {
+      const req = request2(url, { rejectUnauthorized: false, timeout: 5e3 }, (res) => {
+        res.resume();
+        resolve3(res.statusCode ?? 0);
+      });
+      req.on("error", (err) => resolve3(err.message));
+      req.on("timeout", () => req.destroy(new Error("timeout")));
+      req.end();
+    });
+    if (status === 200) return;
+    last = String(status);
+    await new Promise((r) => setTimeout(r, 2e3));
+  }
+  throw new Error(`Health check of ${url} failed: ${last}`);
+};
+var ServerManager = class {
+  p;
+  deps;
+  constructor(deps) {
+    this.deps = deps;
+    this.p = paths(deps.root);
+  }
+  current() {
+    return readState(this.p).current;
+  }
+  resolve(selector) {
+    return resolveRelease(this.deps.repo, this.deps.token, selector, this.deps.fetchImpl);
+  }
+  /** Downloads, verifies and unpacks a release into releases/<tag> (no service changes). */
+  async prepare(release) {
+    const target = this.p.release(release.tag);
+    if (existsSync4(join4(target, "main.js")) && existsSync4(join4(target, "node_modules"))) {
+      log.step(`${release.tag} is already unpacked`);
+      return target;
+    }
+    const name2 = archiveName(release.tag);
+    const archive = join4(this.p.downloads, name2);
+    const { repo, token, fetchImpl } = this.deps;
+    log.step(`Downloading ${name2}`);
+    await downloadAsset(repo, token, findAsset(release, name2), archive, fetchImpl);
+    const sums = await downloadText(repo, token, findAsset(release, "SHA256SUMS"), fetchImpl);
+    const signature = await downloadText(repo, token, findAsset(release, "SHA256SUMS.sig"), fetchImpl);
+    log.step("Verifying signature and checksum");
+    await verifyRelease({ sums, signature, publicKey: this.deps.publicKey ?? RELEASE_PUBLIC_KEY, file: archive, fileName: name2 });
+    log.step(`Unpacking to ${target}`);
+    const staging = target + ".partial";
+    rmSync(staging, { recursive: true, force: true });
+    new AdmZip(archive).extractAllTo(staging, true);
+    log.step("Installing dependencies");
+    await this.deps.installDependencies(staging);
+    rmSync(target, { recursive: true, force: true });
+    renameSync(staging, target);
+    rmSync(archive, { force: true });
+    return target;
+  }
+  /** Site specific runtime overrides live in data/ and are copied next to main.js of every release. */
+  applySiteConfig(releaseDir) {
+    const local = join4(this.p.data, "config.local.json");
+    if (existsSync4(local)) copyFileSync(local, join4(releaseDir, "config.local.json"));
+  }
+  /** First installation: layout, service, start. */
+  async install(selector) {
+    if (this.current()) throw new Error(`Fork server ${this.current()} is already installed; use "fork2 update"`);
+    const release = await this.resolve(selector);
+    ensureBaseLayout(this.p);
+    const dir = await this.prepare(release);
+    this.applySiteConfig(dir);
+    pointLink(this.p.server, dir);
+    log.step("Installing the Windows service");
+    await this.deps.service.install();
+    await this.deps.service.start();
+    await this.deps.healthCheck();
+    writeState(this.p, { current: release.tag });
+    log.success(`Fork server ${release.tag} is running`);
+    return release.tag;
+  }
+  /** Switches to another release; goes back to the previous one if the new one does not come up. */
+  async update(selector, { force = false } = {}) {
+    const state = readState(this.p);
+    if (!state.current) throw new Error('No Fork server installed; use "fork2 install"');
+    const release = await this.resolve(selector);
+    if (release.tag === state.current && !force) {
+      log.success(`Already on ${release.tag}`);
+      return release.tag;
+    }
+    ensureBaseLayout(this.p);
+    const dir = await this.prepare(release);
+    this.applySiteConfig(dir);
+    await this.switchTo(release.tag, state.current);
+    this.prune();
+    return release.tag;
+  }
+  async rollback() {
+    const state = readState(this.p);
+    if (!state.previous || !existsSync4(this.p.release(state.previous))) throw new Error("No previous release to roll back to");
+    await this.switchTo(state.previous, state.current);
+    return state.previous;
+  }
+  async switchTo(tag, from) {
+    const { service } = this.deps;
+    log.step(`Switching ${from} -> ${tag}`);
+    await service.stop();
+    pointLink(this.p.server, this.p.release(tag));
+    try {
+      await service.start();
+      await this.deps.healthCheck();
+    } catch (err) {
+      log.error(`${tag} did not start (${err.message}); going back to ${from}`);
+      await service.stop().catch(() => void 0);
+      pointLink(this.p.server, this.p.release(from));
+      await service.start();
+      throw new Error(`Update to ${tag} failed, ${from} is running again`);
+    }
+    writeState(this.p, { current: tag, previous: from });
+    log.success(`Fork server ${tag} is running (previous: ${from})`);
+  }
+  /** Deletes old releases, keeping the active and the previous one (plus `keep` more). */
+  prune() {
+    const state = readState(this.p);
+    const keepTags = new Set([state.current, state.previous].filter(Boolean));
+    const active = linkTarget(this.p.server);
+    const others = readdirSync2(this.p.releases).filter((t) => !keepTags.has(t) && !t.endsWith(".partial"));
+    const extra = this.deps.keep ?? 0;
+    for (const tag of others.sort().reverse().slice(extra)) {
+      const dir = this.p.release(tag);
+      if (dir === active) continue;
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+  async uninstall() {
+    await this.deps.service.stop().catch(() => void 0);
+    await this.deps.service.uninstall();
+    rmSync(this.p.state, { force: true });
+    log.success("Windows service removed; releases/ and data/ were kept");
+  }
+};
+
+// src/service.ts
+import { createRequire } from "module";
+var SERVICE_NAME = "Fork Server";
+var waitFor = (svc, action, done) => new Promise((resolve3, reject) => {
+  for (const event of done) svc.on(event, () => resolve3());
+  svc.on("error", (err) => reject(err instanceof Error ? err : new Error(String(err))));
+  action();
+});
+var windowsService = (script, cwd) => {
+  const require2 = createRequire(import.meta.url);
+  const { Service } = require2("node-windows");
+  const create = () => new Service({ name: SERVICE_NAME, description: "Fork \xC9ttermi Program szerver", script, workingDirectory: cwd });
+  return {
+    install: () => {
+      const s = create();
+      return waitFor(s, () => s.install(), ["install", "alreadyinstalled"]);
+    },
+    uninstall: () => {
+      const s = create();
+      return waitFor(s, () => s.uninstall(), ["uninstall", "alreadyuninstalled"]);
+    },
+    start: () => {
+      const s = create();
+      return waitFor(s, () => s.start(), ["start"]);
+    },
+    stop: () => {
+      const s = create();
+      return waitFor(s, () => s.stop(), ["stop", "alreadystopped"]);
+    }
+  };
+};
+
+// src/main.ts
+var MIN_NODE_MAJOR = 24;
+var usage = `Usage: fork2 <command>
+
+  init [folder]          set up a site from its .forkdeploy file (certificates, hosts entry, release token)
+  install [release]      install the server (release: latest | beta | v1.6.0; default latest)
+  update [release]       update to another release; rolls back by itself if it does not start
+  rollback               go back to the previous release
+  status                 installed and available releases
+  start | stop | restart control the Windows service
+  logs                   print the service logs
+  migrate                take over an installation made by the legacy 0.2.x CLI
+  uninstall              remove the Windows service (keeps releases/ and data/)
+  token <token>          replace the release repository token
+  config                 print the configuration file location`;
+var ask = async (question, fallback = "") => {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = (await rl.question(fallback ? `${question} [${fallback}] ` : `${question} `)).trim();
+  rl.close();
+  return answer || fallback;
+};
+var confirm = async (question) => /^(i|igen|y|yes)$/i.test(await ask(`${question} (i/n)`, "i"));
+var isElevated = () => process.platform !== "win32" || spawnSync("net", ["session"], { stdio: "ignore" }).status === 0;
+var requireElevated = () => {
+  if (!isElevated()) throw new Error('This command needs administrator rights: run it from a terminal opened "as administrator"');
+};
+var requireNode = () => {
+  const major = Number(process.versions.node.split(".")[0]);
+  if (major < MIN_NODE_MAJOR) {
+    throw new Error(`Node.js ${MIN_NODE_MAJOR}+ is required (this is ${process.version}); the service runs on the same Node.js as this command`);
+  }
+};
+var requireSetup = (config) => {
+  if (!config.installLocation) throw new Error('Not initialised: run "fork2 init" first');
+  if (!config.releaseToken) throw new Error('No release token: run "fork2 token <token>" or "fork2 init" with a .forkdeploy that contains one');
+  return { root: config.installLocation, token: config.releaseToken };
+};
+var manager = (config) => {
+  const { root, token } = requireSetup(config);
+  const p = paths(root);
+  return new ServerManager({
+    root,
+    repo: config.releaseRepo,
+    token,
+    service: windowsService(p.launcherScript, p.data),
+    healthCheck: httpHealthCheck(config.healthUrl),
+    installDependencies: npmInstall
+  });
+};
+var serviceOf = (config) => {
+  const p = paths(requireSetup(config).root);
+  return windowsService(p.launcherScript, p.data);
+};
+var commands = {
+  async init([folder]) {
+    requireElevated();
+    const config = loadConfig();
+    const root = resolve2(folder ?? await ask("Install location:", config.installLocation ?? "C:\\fork-deploy"));
+    const file = findForkDeploy(root);
+    if (!file) throw new Error(`No .forkdeploy file in ${root}`);
+    const deploy = readForkDeploy(file);
+    const info = describeForkDeploy(deploy);
+    log.info(`Domain:        ${info.domain}`);
+    log.info(`Certificate:   ${info.subject}`);
+    log.info(`SAN:           ${info.san}`);
+    log.info(`Valid until:   ${info.validTo.toLocaleDateString("hu-HU")}`);
+    log.info(`Private key:   ${info.keyMatches ? "OK" : "DOES NOT MATCH"}`);
+    log.info(`CA signature:  ${info.signedByCa ? "OK" : "INVALID"}`);
+    log.info(`Release token: ${info.hasReleaseToken ? "present" : 'missing (add it later with "fork2 token")'}`);
+    if (!info.keyMatches || !info.signedByCa) throw new Error("The .forkdeploy file is not valid");
+    if (!await confirm("Proceed?")) return;
+    const p = paths(root);
+    writeSslFiles(p.ssl, deploy);
+    log.success("SSL files written");
+    const certutil = spawnSync("certutil", ["-addstore", "Root", join5(p.ssl, "ca.pem")], { stdio: "inherit" });
+    if (certutil.status === 0) log.success("CA added to the Root store");
+    else log.warn("Could not add the CA to the Root store");
+    createRequire2(import.meta.url)("hostile").set("127.0.0.1", deploy.domain);
+    log.success(`hosts: ${deploy.domain} -> 127.0.0.1`);
+    saveConfig({
+      ...config,
+      installLocation: root,
+      domain: deploy.domain,
+      releaseToken: deploy.releaseToken ?? config.releaseToken,
+      releaseRepo: deploy.releaseRepo ?? config.releaseRepo
+    });
+    log.success(`Initialised; next: "fork2 install"`);
+  },
+  async install([selector = "latest"]) {
+    requireElevated();
+    requireNode();
+    const config = loadConfig();
+    if (isLegacyLayout(paths(requireSetup(config).root))) throw new Error('A legacy installation is in the way: run "fork2 migrate"');
+    await manager(config).install(selector);
+  },
+  async update([selector = "latest", flag]) {
+    requireElevated();
+    requireNode();
+    await manager(loadConfig()).update(selector, { force: flag === "--force" });
+  },
+  async rollback() {
+    requireElevated();
+    await manager(loadConfig()).rollback();
+  },
+  async status() {
+    const config = loadConfig();
+    const m = manager(config);
+    log.info(`Install location: ${m.p.root}`);
+    log.info(`Installed:        ${m.current() ?? "none"}`);
+    for (const channel of ["latest", "beta"]) {
+      const release = await m.resolve(channel).catch((err) => ({ tag: `unavailable (${err.message})` }));
+      log.info(`Available ${channel.padEnd(7)} ${release.tag}`);
+    }
+  },
+  async start() {
+    requireElevated();
+    await serviceOf(loadConfig()).start();
+  },
+  async stop() {
+    requireElevated();
+    await serviceOf(loadConfig()).stop();
+  },
+  async restart(args2) {
+    await commands.stop(args2);
+    await commands.start(args2);
+  },
+  async logs() {
+    const p = paths(requireSetup(loadConfig()).root);
+    for (const file of ["forkserver.out.log", "forkserver.err.log"]) {
+      const path = join5(p.launcher, "daemon", file);
+      log.info(`===== ${path}`);
+      log.info(existsSync5(path) ? readFileSync4(path, "utf8") : "(missing)");
+    }
+  },
+  async migrate() {
+    requireElevated();
+    requireNode();
+    const config = loadConfig();
+    const root = config.installLocation ?? legacyInstallLocation();
+    if (!root) throw new Error('No installation found; use "fork2 init"');
+    const p = paths(root);
+    if (!isLegacyLayout(p)) {
+      log.success("Nothing to migrate");
+      return;
+    }
+    log.warn("The new server generates its own JWT secret: every terminal has to be paired again after this");
+    if (!await confirm(`Migrate the installation in ${root}?`)) return;
+    log.step("Removing the legacy service");
+    await windowsService(join5(p.server, "main.js"), p.server).stop().catch(() => void 0);
+    await windowsService(join5(p.server, "main.js"), p.server).uninstall();
+    const backup = `${p.server}-legacy-${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`;
+    renameSync2(p.server, backup);
+    log.success(`Legacy server moved to ${backup}`);
+    saveConfig({ ...config, installLocation: root });
+    if (!loadConfig().releaseToken) {
+      log.warn('Set the release token with "fork2 token <token>", then run "fork2 install"');
+      return;
+    }
+    await manager(loadConfig()).install("latest");
+  },
+  async uninstall() {
+    requireElevated();
+    await manager(loadConfig()).uninstall();
+  },
+  async token([token]) {
+    if (!token) throw new Error("Usage: fork2 token <token>");
+    saveConfig({ ...loadConfig(), releaseToken: token });
+    log.success("Release token saved");
+  },
+  async config() {
+    const file = configPath();
+    log.info(file, existsSync5(file) ? `(${statSync(file).size} bytes)` : "(not created yet)");
+  }
+};
+var [name, ...args] = process.argv.slice(2);
+var command = name ? commands[name] : void 0;
+if (!command) {
+  log.info(usage);
+  process.exitCode = name ? 1 : 0;
+} else {
+  command(args).catch((err) => {
+    log.error(err.message);
+    process.exitCode = 1;
+  });
+}

package/package.json

@@ -1,6 +1,49 @@
-{
-  "name": "@fork-hu/cli2",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@fork-hu/cli2",
+  "version": "1.0.0",
+  "description": "Installs and updates the Fork server on-premise from GitHub Releases",
+  "license": "UNLICENSED",
+  "author": "Fork <admin@fork.hu> (https://fork.hu)",
+  "keywords": [
+    "fork",
+    "Fork"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fork-hu/fork-2026-refactor.git",
+    "directory": "packages/cli"
+  },
+  "type": "module",
+  "bin": {
+    "fork2": "dist/fork.mjs"
+  },
+  "files": [
+    "dist"
+  ],
+  "os": [
+    "win32"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "node --experimental-strip-types src/main.ts",
+    "typecheck": "tsc -p tsconfig.json",
+    "prepublishOnly": "tsup"
+  },
+  "dependencies": {
+    "adm-zip": "0.6.1",
+    "hostile": "1.4.0",
+    "node-windows": "1.0.0-beta.8"
+  },
+  "devDependencies": {
+    "@types/adm-zip": "0.6.0",
+    "@types/node": "24.9.1",
+    "tsup": "8.5.1",
+    "typescript": "5.9.3"
+  }
+}