@naviyra/cloud-panel 0.0.0-stage → 0.0.1

package/scripts/postgres-local.mjs

@@ -0,0 +1,97 @@
+import { spawn } from "node:child_process";
+import { access, mkdir, writeFile, unlink } from "node:fs/promises";
+import path from "node:path";
+import pg from "pg";
+const root = path.resolve(".runtime/postgres");
+const bin =
+  process.env.POSTGRES_BIN ||
+  (process.platform === "win32" ? "C:/Program Files/PostgreSQL/18/bin" : "");
+const exe = (name) =>
+  path.join(bin, name + (process.platform === "win32" ? ".exe" : ""));
+const run = (name, args) =>
+  new Promise((resolve, reject) => {
+    const child = spawn(exe(name), args, {
+      windowsHide: true,
+      stdio: "inherit",
+      shell: false,
+    });
+    child.on("error", reject);
+    child.on("exit", (code) =>
+      code === 0 ? resolve() : reject(Error(`${name} exited ${code}`)),
+    );
+  });
+const url = new URL(process.env.DATABASE_URL || "");
+if (!["localhost", "127.0.0.1"].includes(url.hostname))
+  throw Error(
+    "db:local only manages a loopback database; keep remote PostgreSQL separately managed",
+  );
+const port = Number(url.port || 5432),
+  user = decodeURIComponent(url.username),
+  password = decodeURIComponent(url.password),
+  database = url.pathname.slice(1);
+if (
+  !password ||
+  !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(user) ||
+  !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(database)
+)
+  throw Error(
+    "Local database URL needs a password and simple database/user names",
+  );
+if (process.argv.includes("--stop")) {
+  await run("pg_ctl", ["-D", root, "stop", "-m", "fast"]);
+  process.exit(0);
+}
+await mkdir(".runtime", { recursive: true });
+let initialized = false;
+try {
+  await access(path.join(root, "PG_VERSION"));
+  initialized = true;
+} catch {}
+if (!initialized) {
+  const pwfile = path.resolve(".runtime/postgres-init-password");
+  await writeFile(pwfile, password, { mode: 0o600 });
+  try {
+    await run("initdb", [
+      "-D",
+      root,
+      "-U",
+      user,
+      "--auth=scram-sha-256",
+      "--pwfile",
+      pwfile,
+      "--encoding=UTF8",
+      "--locale=C",
+    ]);
+  } finally {
+    await unlink(pwfile);
+  }
+}
+await run("pg_ctl", [
+  "-D",
+  root,
+  "-l",
+  path.resolve(".runtime/postgres.log"),
+  "-o",
+  `-h 127.0.0.1 -p ${port}`,
+  "-w",
+  "start",
+]);
+const adminUrl = new URL(url);
+adminUrl.pathname = "/postgres";
+const client = new pg.Client({ connectionString: adminUrl.href });
+await client.connect();
+try {
+  if (
+    !(
+      await client.query("SELECT 1 FROM pg_database WHERE datname=$1", [
+        database,
+      ])
+    ).rowCount
+  )
+    await client.query(`CREATE DATABASE "${database}"`);
+} finally {
+  await client.end();
+}
+console.log(
+  "Native PostgreSQL is ready. Run npm run db:migrate and npm run db:seed.",
+);

package/scripts/runtime-download-manifest.mjs

@@ -0,0 +1,30 @@
+// Maintainer utility: resolve hashes from the official HTTPS distribution endpoints.
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+const artifacts = {};
+await mkdir(".runtime/runtime-downloads", { recursive: true });
+for (const arch of ["x86_64", "aarch64"]) {
+  for (const name of ["docker", "docker-rootless-extras"]) {
+    const file = `${name}-29.8.2-${arch}.tgz`;
+    const url = `https://download.docker.com/linux/static/stable/${arch}/${name}-29.8.2.tgz`;
+    const response = await fetch(url);
+    if (!response.ok) throw Error(`${response.status}: ${url}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    await writeFile(`.runtime/runtime-downloads/${file}`, bytes);
+    artifacts[`${name}-${arch}`] = { file, url, sha256 };
+    console.log(file, sha256);
+  }
+  const file = `alpine-minirootfs-3.23.6-${arch}.tar.gz`;
+  const url = `https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/${arch}/${file}`;
+  const response = await fetch(`${url}.sha256`);
+  if (!response.ok)
+    throw Error(`Cannot read Alpine checksum: ${response.status}`);
+  const sha256 = (await response.text()).split(/\s/)[0];
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw Error("Invalid Alpine checksum");
+  artifacts[`alpine-${arch}`] = { file, url, sha256 };
+}
+await writeFile(
+  "packages/runtime/artifacts.json",
+  JSON.stringify(artifacts, null, 2) + "\n",
+);

package/scripts/runtime.mjs

@@ -0,0 +1,20 @@
+import { managedRuntime } from "../packages/runtime/index.mjs";
+try {
+  const runtime = managedRuntime();
+  const action = process.argv[2] || "setup";
+  if (action === "status")
+    console.log(JSON.stringify(await runtime.status(), null, 2));
+  else if (action === "stop") {
+    await runtime.stop();
+    console.log("Naviyra Docker stopped. Database data is preserved.");
+  } else if (["setup", "start"].includes(action)) {
+    console.log(
+      "Preparing Naviyra's private Docker runtime. First setup downloads verified runtime files.",
+    );
+    await runtime.ensure();
+    console.log(JSON.stringify(await runtime.status(), null, 2));
+  } else throw Error("Use setup, start, status, or stop");
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/scripts/seed.mjs

@@ -0,0 +1,35 @@
+import pg from "pg";
+import bcrypt from "bcryptjs";
+import { randomUUID, createHash } from "node:crypto";
+if (
+  !process.env.ADMIN_EMAIL ||
+  (process.env.ADMIN_PASSWORD?.length || 0) < 12 ||
+  (process.env.AGENT_TOKEN?.length || 0) < 32
+)
+  throw Error(
+    "Set ADMIN_EMAIL, ADMIN_PASSWORD (12+ characters), and AGENT_TOKEN (32+ characters).",
+  );
+const client = new pg.Client({ connectionString: process.env.DATABASE_URL });
+await client.connect();
+try {
+  await client.query(
+    "INSERT INTO users(id,email,password_hash,role) VALUES($1,$2,$3,$4) ON CONFLICT(email) DO UPDATE SET password_hash=$3",
+    [
+      randomUUID(),
+      process.env.ADMIN_EMAIL.toLowerCase(),
+      await bcrypt.hash(process.env.ADMIN_PASSWORD, 12),
+      "admin",
+    ],
+  );
+  await client.query(
+    "INSERT INTO agents(id,name,token_hash) VALUES($1,$2,$3) ON CONFLICT(name) DO UPDATE SET token_hash=$3",
+    [
+      randomUUID(),
+      "primary",
+      createHash("sha256").update(process.env.AGENT_TOKEN).digest("hex"),
+    ],
+  );
+  console.log("Administrator and primary agent ready.");
+} finally {
+  await client.end();
+}

package/scripts/service-supervisor.mjs

@@ -0,0 +1,164 @@
+import { spawn } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { mkdir, stat, rename, writeFile, unlink } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import net from "node:net";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function portOpen(port) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection({ host: "127.0.0.1", port });
+    const finish = (open) => {
+      socket.destroy();
+      resolve(open);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(1500, () => finish(false));
+  });
+}
+
+async function stackUp() {
+  try {
+    process.loadEnvFile(path.join(root, ".env"));
+  } catch {
+    // The launcher creates .env when it is missing.
+  }
+  const panelPort = Number(process.env.PANEL_PORT || 3000);
+  const agentPort = Number(process.env.AGENT_PORT || 4001);
+  if (
+    !Number.isInteger(panelPort) ||
+    !Number.isInteger(agentPort) ||
+    panelPort < 1 ||
+    agentPort < 1
+  )
+    return false;
+  return (await portOpen(panelPort)) && (await portOpen(agentPort));
+}
+
+function killTree(pid) {
+  if (!pid) return;
+  if (process.platform === "win32") {
+    const killer = spawn("taskkill.exe", ["/PID", String(pid), "/T", "/F"], {
+      windowsHide: true,
+      stdio: "ignore",
+    });
+    killer.once("error", () => {});
+    killer.unref();
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    // The child has already exited.
+  }
+}
+
+export async function supervise(options = {}) {
+  const log = options.log ?? (() => {});
+  const spawnChild = options.spawnChild;
+  const healthy = options.stackUp ?? stackUp;
+  const sleep =
+    options.sleep ??
+    (async (ms, shouldStop) => {
+      const step = 200;
+      for (let waited = 0; waited < ms && !shouldStop(); waited += step)
+        await delay(Math.min(step, ms - waited));
+    });
+  let stopping = false;
+  const shouldStop = options.shouldStop ?? (() => stopping);
+  let current = null;
+  if (options.hookSignals !== false && !options.shouldStop) {
+    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
+      process.on(signal, () => {
+        stopping = true;
+        current?.kill();
+      });
+  }
+  let backoff = 3000;
+  log("Naviyra service supervisor started.");
+  while (!shouldStop()) {
+    const started = Date.now();
+    current = spawnChild();
+    const code = await current.exited;
+    current = null;
+    if (shouldStop()) break;
+    const ran = Date.now() - started;
+    if (code === 0 && (await healthy())) {
+      log("Launcher exited cleanly. Watching until the panel or agent stops.");
+      while (!shouldStop() && (await healthy())) await sleep(5000, shouldStop);
+      if (shouldStop()) break;
+      backoff = 3000;
+      log("Panel or agent is not listening. Starting again in 3s.");
+      await sleep(3000, shouldStop);
+      continue;
+    }
+    if (ran > 60000) backoff = 3000;
+    const wait = code === 0 ? Math.max(backoff, 3000) : backoff;
+    log(
+      `Launcher exited with code ${code}. Restarting in ${Math.round(wait / 1000)}s.`,
+    );
+    await sleep(wait, shouldStop);
+    backoff = Math.min(Math.max(wait, 3000) * 2, 60000);
+  }
+  log("Naviyra service supervisor stopped.");
+  return 0;
+}
+
+function spawnLauncher(logStream) {
+  const child = spawn(
+    process.execPath,
+    ["scripts/start-naviyra.mjs", "--no-browser"],
+    {
+      cwd: root,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  );
+  child.stdout?.on("data", (chunk) => logStream.write(chunk));
+  child.stderr?.on("data", (chunk) => logStream.write(chunk));
+  return {
+    exited: new Promise((resolve) => {
+      child.once("error", () => resolve(1));
+      child.once("exit", (code) => resolve(code ?? 1));
+    }),
+    kill() {
+      killTree(child.pid);
+    },
+  };
+}
+
+async function main() {
+  const runtime = path.join(root, ".runtime");
+  await mkdir(runtime, { recursive: true });
+  const logPath = path.join(runtime, "service.log");
+  try {
+    if ((await stat(logPath)).size > 2_000_000)
+      await rename(logPath, `${logPath}.1`);
+  } catch {
+    // A missing log is created by the write stream.
+  }
+  const logStream = createWriteStream(logPath, { flags: "a" });
+  const log = (line) => {
+    logStream.write(`[${new Date().toISOString()}] ${line}\n`);
+  };
+  const pidFile = path.join(runtime, "service.pid");
+  await writeFile(pidFile, String(process.pid));
+  try {
+    await supervise({ log, spawnChild: () => spawnLauncher(logStream), stackUp });
+  } finally {
+    await unlink(pidFile).catch(() => {});
+    logStream.end();
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.chdir(root);
+  main().catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}

package/scripts/setup-local.mjs

@@ -0,0 +1,215 @@
+import { randomBytes } from "node:crypto";
+import { createInterface } from "node:readline/promises";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+
+const emailPattern = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export function envAssignment(name, value) {
+  const plain = /^[A-Za-z0-9@._:/+-]+$/.test(value);
+  const encoded = plain
+    ? value
+    : `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+  return `${name}=${encoded}`;
+}
+
+export function applySettings(template, settings) {
+  const replacements = [
+    [
+      "JWT_SECRET=replace-with-at-least-32-random-characters",
+      envAssignment("JWT_SECRET", settings.jwt),
+    ],
+    [
+      "AGENT_TOKEN=replace-with-at-least-32-random-characters",
+      envAssignment("AGENT_TOKEN", settings.token),
+    ],
+    [
+      "ADMIN_PASSWORD=replace-with-a-strong-password",
+      envAssignment("ADMIN_PASSWORD", settings.password),
+    ],
+    [
+      "ADMIN_EMAIL=admin@example.com",
+      envAssignment("ADMIN_EMAIL", settings.email),
+    ],
+    ["POSTGRES_PORT=55432", `POSTGRES_PORT=${settings.postgresPort}`],
+    [
+      "postgresql://naviyra:naviyra@127.0.0.1:55432/naviyra",
+      `postgresql://naviyra:naviyra@127.0.0.1:${settings.postgresPort}/naviyra`,
+    ],
+    [
+      "AGENT_URL=http://127.0.0.1:4001",
+      `AGENT_URL=http://127.0.0.1:${settings.agentPort}`,
+    ],
+    ["AGENT_PORT=4001", `AGENT_PORT=${settings.agentPort}`],
+    ["PANEL_PORT=3000", `PANEL_PORT=${settings.panelPort}`],
+  ];
+  let env = template;
+  for (const [from, to] of replacements) {
+    if (!env.includes(from))
+      throw Error(`Environment template is missing ${from.split("=")[0]}.`);
+    env = env.replace(from, to);
+  }
+  return env;
+}
+
+async function askPort(ask, label, fallback, used, log) {
+  for (;;) {
+    const raw = (await ask(label)).trim();
+    const port = raw === "" ? fallback : Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      log("Enter a port from 1 to 65535.");
+      continue;
+    }
+    if (used.includes(port)) {
+      log("That port is already used by another Naviyra service.");
+      continue;
+    }
+    return port;
+  }
+}
+
+export async function promptSettings(ask, askSecret, log = console.log) {
+  log("Enter the panel settings. Press Enter to accept a default.");
+  let email = "";
+  for (;;) {
+    const typed = (await ask("Administrator email [admin@example.com]: ")).trim();
+    email = (typed || "admin@example.com").toLowerCase();
+    if (emailPattern.test(email)) break;
+    log("Enter an email address.");
+  }
+  let password = "";
+  for (;;) {
+    password = await askSecret("Administrator password (12+ characters): ");
+    if (password.length < 12) {
+      log("Use at least 12 characters.");
+      continue;
+    }
+    if (password !== (await askSecret("Confirm password: "))) {
+      log("Passwords do not match.");
+      continue;
+    }
+    break;
+  }
+  const agentPort = await askPort(
+    ask,
+    "Agent port [4001]: ",
+    4001,
+    [3000, 55432],
+    log,
+  );
+  return {
+    email,
+    password,
+    panelPort: 3000,
+    agentPort,
+    postgresPort: 55432,
+  };
+}
+
+function defaultAsk(question) {
+  return new Promise((resolve, reject) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+    rl.question(question)
+      .then((answer) => {
+        rl.close();
+        resolve(answer);
+      })
+      .catch((error) => {
+        rl.close();
+        reject(error);
+      });
+  });
+}
+
+function defaultAskSecret(question) {
+  return new Promise((resolve) => {
+    const input = process.stdin;
+    const output = process.stdout;
+    output.write(question);
+    input.setRawMode(true);
+    input.resume();
+    let value = "";
+    const finish = (result) => {
+      input.setRawMode(false);
+      input.pause();
+      input.off("data", onData);
+      output.write("\n");
+      resolve(result);
+    };
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === "\u0003") {
+          input.setRawMode(false);
+          process.exit(130);
+        }
+        if (char === "\r" || char === "\n") {
+          finish(value);
+          return;
+        }
+        if (char === "\u007f" || char === "\b") {
+          if (value) output.write("\b \b");
+          value = value.slice(0, -1);
+          continue;
+        }
+        if (char < " ") continue;
+        value += char;
+        output.write("*");
+      }
+    };
+    input.on("data", onData);
+  });
+}
+
+export async function createLocalEnv(options = {}) {
+  const readExisting = options.readExisting ?? (() => readFile(".env"));
+  try {
+    await readExisting();
+    console.log(".env already exists; left unchanged.");
+    return { created: false };
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  const secret = () => randomBytes(32).toString("hex");
+  const tty = options.tty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  const settings = tty
+    ? await promptSettings(
+        options.ask ?? defaultAsk,
+        options.askSecret ?? defaultAskSecret,
+        options.log ?? console.log,
+      )
+    : {
+        email: "admin@example.com",
+        password: secret().slice(0, 24),
+        panelPort: 3000,
+        agentPort: 4001,
+        postgresPort: 55432,
+      };
+  const template = await (options.readTemplate ?? (() => readFile(".env.example", "utf8")))();
+  const env = applySettings(template, {
+    ...settings,
+    jwt: secret(),
+    token: secret(),
+  });
+  await (options.writeEnv ??
+    ((text) => writeFile(".env", text, { flag: "wx", mode: 0o600 })))(env);
+  await mkdir(".runtime", { recursive: true });
+  const login = `Local installation\nURL: http://127.0.0.1:${settings.panelPort}\nEmail: ${settings.email}\nPassword: ${settings.password}\n`;
+  await (options.writeLogin ??
+    ((text) => writeFile(".runtime/local-login.txt", text, { mode: 0o600 })))(login);
+  console.log("Created .env. Sign-in details saved to .runtime/local-login.txt.");
+  return { created: true, settings };
+}
+
+const isMain =
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url);
+if (isMain) {
+  createLocalEnv().catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}