@naviyra/cloud-panel 0.0.0-stage → 0.0.2

package/packages/runtime/index.cjs

@@ -0,0 +1,526 @@
+const { spawn } = require("node:child_process");
+const { createHash, randomUUID } = require("node:crypto");
+const {
+  createReadStream,
+  createWriteStream,
+  readFileSync,
+} = require("node:fs");
+const {
+  access,
+  mkdir,
+  readFile,
+  rename,
+  rm,
+  writeFile,
+} = require("node:fs/promises");
+const { pipeline } = require("node:stream/promises");
+const { Readable, Transform } = require("node:stream");
+const path = require("node:path");
+const { setTimeout: delay } = require("node:timers/promises");
+const artifacts = require("./artifacts.json");
+
+const runtimeError = (message) =>
+  Object.assign(Error(message), { status: 503 });
+// Next.js can bundle workspace packages and rewrite __dirname. Locate the project
+// from the service working directory so the panel and setup CLI share one runtime.
+function findProjectRoot() {
+  let directory = process.cwd();
+  while (true) {
+    try {
+      const pkg = JSON.parse(
+        readFileSync(
+          /* turbopackIgnore: true */ path.join(directory, "package.json"),
+          "utf8",
+        ),
+      );
+      if (
+        Array.isArray(pkg.workspaces) &&
+        pkg.workspaces.includes("apps/*") &&
+        pkg.workspaces.includes("packages/*")
+      )
+        return directory;
+    } catch {}
+    const parent = path.dirname(directory);
+    if (parent === directory)
+      throw runtimeError("Start Naviyra from its project directory");
+    directory = parent;
+  }
+}
+const projectRoot = findProjectRoot();
+function runtimeConfig({
+  platform = process.platform,
+  arch = process.arch,
+  root = process.env.NAVIYRA_RUNTIME_ROOT ||
+    path.join(projectRoot, ".runtime", "docker"),
+} = {}) {
+  if (
+    !["linux", "win32"].includes(platform) ||
+    !["x64", "arm64"].includes(arch)
+  )
+    throw runtimeError(
+      "Naviyra Docker supports Windows/WSL2 and Linux on x64 or ARM64",
+    );
+  root = path.resolve(/* turbopackIgnore: true */ root);
+  const id = createHash("sha256")
+    .update(platform === "win32" ? root.toLowerCase() : root)
+    .digest("hex")
+    .slice(0, 10);
+  return {
+    platform,
+    arch: arch === "x64" ? "x86_64" : "aarch64",
+    root,
+    id,
+    distro: `Naviyra-${id}`,
+    linuxRoot: platform === "win32" ? "/opt/naviyra" : root,
+  };
+}
+function cleanEnvironment(extra = {}) {
+  const env = { ...process.env };
+  for (const key of Object.keys(env))
+    if (key.startsWith("DOCKER_") || key === "WSLENV") delete env[key];
+  return { ...env, ...extra };
+}
+function execute(file, args, { env = {}, input, timeout = 30000 } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, {
+      shell: false,
+      windowsHide: true,
+      env: cleanEnvironment(env),
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    const chunks = [];
+    let length = 0;
+    const timer = setTimeout(() => {
+      child.kill();
+      reject(runtimeError("Naviyra runtime operation timed out"));
+    }, timeout);
+    child.stdout.on("data", (chunk) => {
+      length += chunk.length;
+      if (length <= 1024 * 1024) chunks.push(chunk);
+    });
+    child.stderr.resume(); // Commands can output credentials. Do not propagate their output in errors.
+    child.stdin.on("error", () => {});
+    child.on("error", () => {
+      clearTimeout(timer);
+      reject(
+        runtimeError("Naviyra runtime could not launch a required OS command"),
+      );
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      const bytes = Buffer.concat(chunks);
+      const result = bytes.includes(0)
+        ? bytes.toString("utf16le")
+        : bytes.toString("utf8");
+      if (code === 0) resolve(result.trim());
+      else
+        reject(
+          runtimeError(
+            "Naviyra runtime command failed. Run npm run runtime:setup on the server for prerequisite checks.",
+          ),
+        );
+    });
+    child.stdin.end(input);
+  });
+}
+const exists = async (file) => {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+};
+async function hashFile(file) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(file)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function downloadArtifact(artifact, directory) {
+  await mkdir(directory, { recursive: true });
+  const destination = path.join(directory, artifact.file);
+  if (
+    (await exists(destination)) &&
+    (await hashFile(destination)) === artifact.sha256
+  )
+    return destination;
+  const temporary = `${destination}.${randomUUID()}.part`;
+  try {
+    const response = await fetch(artifact.url, {
+      signal: AbortSignal.timeout(600000),
+      redirect: "error",
+    });
+    if (!response.ok || !response.body) throw Error();
+    let length = 0;
+    const limit = new Transform({
+      transform(chunk, encoding, callback) {
+        length += chunk.length;
+        callback(
+          length > 250 * 1024 * 1024 ? Error("Download too large") : null,
+          chunk,
+        );
+      },
+    });
+    await pipeline(
+      Readable.fromWeb(response.body),
+      limit,
+      createWriteStream(temporary, { flags: "wx", mode: 0o600 }),
+    );
+    if ((await hashFile(temporary)) !== artifact.sha256) throw Error();
+    await rename(temporary, destination);
+    return destination;
+  } catch {
+    throw runtimeError(
+      `Could not download or verify ${artifact.file}. Check network access and retry.`,
+    );
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+
+function dockerCommand(config, args, env = {}) {
+  const binary = `${config.linuxRoot}/bin/docker`;
+  const command = [
+    binary,
+    "--config",
+    `${config.linuxRoot}/client`,
+    "--host",
+    `unix://${config.linuxRoot}/run/docker.sock`,
+    ...args,
+  ];
+  if (config.platform === "linux")
+    return { file: binary, args: command.slice(1), env };
+  const keys = Object.keys(env);
+  if (keys.some((key) => !/^[A-Z][A-Z0-9_]*$/.test(key)))
+    throw runtimeError("Invalid runtime environment key");
+  return {
+    file: "wsl.exe",
+    args: [
+      "--distribution",
+      config.distro,
+      "--user",
+      "root",
+      "--exec",
+      ...command,
+    ],
+    env: { ...env, WSLENV: keys.map((key) => `${key}/u`).join(":") },
+  };
+}
+
+// Cross-process lock shared by Next.js workers and the setup CLI. Never steal a live lock.
+async function locked(config, task) {
+  const lock = path.join(config.root, "setup.lock");
+  await mkdir(config.root, { recursive: true });
+  for (let attempt = 0; attempt < 900; attempt++) {
+    try {
+      await mkdir(lock);
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        const pid = Number(await readFile(path.join(lock, "pid"), "utf8"));
+        if (Number.isInteger(pid) && pid > 0) {
+          try {
+            process.kill(pid, 0);
+          } catch (probe) {
+            if (probe.code === "ESRCH")
+              await rm(lock, { recursive: true, force: true });
+          }
+        }
+      } catch {}
+      await delay(1000);
+      continue;
+    }
+    try {
+      await writeFile(path.join(lock, "pid"), String(process.pid));
+      return await task();
+    } finally {
+      await rm(lock, { recursive: true, force: true });
+    }
+  }
+  throw runtimeError(
+    "Another Naviyra runtime setup is still running. Retry when it finishes.",
+  );
+}
+
+function createManagedRuntime({
+  config = runtimeConfig(),
+  run = execute,
+  download = downloadArtifact,
+  sleep = delay,
+} = {}) {
+  let starting;
+  const command = (args, options = {}) => {
+    const spec = dockerCommand(config, args, options.env);
+    return run(spec.file, spec.args, { ...options, env: spec.env });
+  };
+  const wsl = (args, options) =>
+    run(
+      "wsl.exe",
+      ["-d", config.distro, "-u", "root", "--exec", ...args],
+      options,
+    );
+  async function info() {
+    const result = JSON.parse(
+      await command(["info", "--format", "{{json .}}"], { timeout: 10000 }),
+    );
+    if (
+      result.OSType !== "linux" ||
+      !result.Labels?.includes(`naviyra.runtime=${config.id}`)
+    )
+      throw Object.assign(
+        runtimeError(
+          "The private Docker endpoint does not belong to this Naviyra installation",
+        ),
+        { code: "RUNTIME_OWNERSHIP" },
+      );
+    return result;
+  }
+  async function bootstrap() {
+    const cache = path.join(projectRoot, ".runtime", "runtime-downloads");
+    if (config.platform === "win32") {
+      let distributions;
+      try {
+        distributions = await run("wsl.exe", ["--list", "--quiet"]);
+      } catch {
+        throw runtimeError(
+          "Enable WSL2 first: run wsl --install --no-distribution as Administrator, restart Windows if requested, then retry Naviyra setup.",
+        );
+      }
+      if (
+        !distributions
+          .split(/\r?\n/)
+          .map((line) => line.trim())
+          .includes(config.distro)
+      ) {
+        const archive = await download(
+          artifacts[`alpine-${config.arch}`],
+          cache,
+        );
+        try {
+          await run(
+            "wsl.exe",
+            [
+              "--import",
+              config.distro,
+              path.join(config.root, "wsl"),
+              archive,
+              "--version",
+              "2",
+            ],
+            { timeout: 180000 },
+          );
+        } catch {
+          throw runtimeError(
+            "Could not create Naviyra's WSL2 environment. Enable virtualization and WSL2, then run npm run runtime:setup again.",
+          );
+        }
+      }
+      // Only Naviyra's dedicated distribution is modified; user distributions and Docker Desktop are never used.
+      try {
+        await wsl(
+          [
+            "sh",
+            "-c",
+            "apk add --no-cache ca-certificates iptables ip6tables procps util-linux",
+          ],
+          { timeout: 180000 },
+        );
+      } catch {
+        throw runtimeError(
+          "Could not install OS dependencies in Naviyra's WSL environment. Check Alpine repository access and retry.",
+        );
+      }
+      await wsl([
+        "mkdir",
+        "-p",
+        `${config.linuxRoot}/bin`,
+        `${config.linuxRoot}/run`,
+        `${config.linuxRoot}/client`,
+      ]);
+    } else {
+      await mkdir(path.join(config.root, "bin"), { recursive: true });
+      await mkdir(path.join(config.root, "run"), {
+        recursive: true,
+        mode: 0o700,
+      });
+      await mkdir(path.join(config.root, "client"), { recursive: true });
+    }
+    const rootless = config.platform === "linux" && process.getuid?.() !== 0;
+    for (const name of rootless
+      ? ["docker", "docker-rootless-extras"]
+      : ["docker"]) {
+      const archive = await download(
+        artifacts[`${name}-${config.arch}`],
+        cache,
+      );
+      if (config.platform === "win32") {
+        const mounted = await wsl(["wslpath", "-a", "-u", archive]);
+        await wsl([
+          "tar",
+          "-xzf",
+          mounted,
+          "--strip-components=1",
+          "-C",
+          `${config.linuxRoot}/bin`,
+        ]);
+      } else
+        await run("tar", [
+          "-xzf",
+          archive,
+          "--strip-components=1",
+          "-C",
+          path.join(config.root, "bin"),
+        ]);
+    }
+    const daemonConfig = JSON.stringify({
+      "data-root": `${config.linuxRoot}/data`,
+      "exec-root": `${config.linuxRoot}/run/exec`,
+      pidfile: `${config.linuxRoot}/run/docker.pid`,
+      hosts: [`unix://${config.linuxRoot}/run/docker.sock`],
+      labels: [`naviyra.runtime=${config.id}`],
+      bridge: "none",
+      "containerd-namespace": `naviyra-${config.id}`,
+      "containerd-plugins-namespace": `naviyra-plugins-${config.id}`,
+      features: { "containerd-snapshotter": false },
+      ...(!rootless ? { group: "root" } : {}),
+    });
+    await writeFile(path.join(config.root, "daemon.json"), daemonConfig, {
+      mode: 0o600,
+    });
+    if (config.platform === "win32") {
+      const mounted = await wsl([
+        "wslpath",
+        "-a",
+        "-u",
+        path.join(config.root, "daemon.json"),
+      ]);
+      await wsl(["cp", mounted, `${config.linuxRoot}/daemon.json`]);
+    }
+    await writeFile(
+      path.join(config.root, "installed.json"),
+      JSON.stringify({ version: "29.8.2", arch: config.arch }),
+    );
+  }
+  async function launch() {
+    const rootless = config.platform === "linux" && process.getuid?.() !== 0;
+    const bin = `${config.linuxRoot}/bin`;
+    const script =
+      'set -eu\nroot="$1"\nmode="$2"\nexport PATH="$root/bin:$PATH"\nexport XDG_RUNTIME_DIR="$root/run"\nexport DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR="$root/run/rootlesskit"\nif [ "$mode" = rootless ]; then\n command -v newuidmap >/dev/null && command -v newgidmap >/dev/null || exit 42\n daemon="$root/bin/dockerd-rootless.sh"\nelse\n daemon="$root/bin/dockerd"\nfi\nnohup "$daemon" --config-file "$root/daemon.json" >>"$root/daemon.log" 2>&1 </dev/null &\nsleep 2\n';
+    if (config.platform === "win32") {
+      await wsl([
+        "sh",
+        "-c",
+        script,
+        "naviyra-start",
+        config.linuxRoot,
+        "rootful",
+      ]);
+    } else {
+      try {
+        await run(
+          "sh",
+          [
+            "-c",
+            script,
+            "naviyra-start",
+            config.linuxRoot,
+            rootless ? "rootless" : "rootful",
+          ],
+          { env: { PATH: `${bin}:${process.env.PATH}` } },
+        );
+      } catch {
+        throw runtimeError(
+          "Rootless Docker requires newuidmap/newgidmap (uidmap), subordinate UID/GID ranges and enabled user namespaces. Configure these OS prerequisites and retry runtime:setup.",
+        );
+      }
+    }
+    for (let attempt = 0; attempt < 60; attempt++) {
+      try {
+        await info();
+        return;
+      } catch {}
+      await sleep(1000);
+    }
+    throw runtimeError(
+      `Naviyra's Docker engine did not start. Check ${config.platform === "win32" ? `${config.distro}:/opt/naviyra/daemon.log` : path.join(config.root, "daemon.log")} and OS prerequisites.`,
+    );
+  }
+  async function ensure() {
+    try {
+      await info();
+      return;
+    } catch (error) {
+      if (error.code === "RUNTIME_OWNERSHIP") throw error;
+    }
+    if (!starting)
+      starting = locked(config, async () => {
+        try {
+          await info();
+          return;
+        } catch (error) {
+          if (error.code === "RUNTIME_OWNERSHIP") throw error;
+        }
+        if (!(await exists(path.join(config.root, "installed.json"))))
+          await bootstrap();
+        await launch();
+      }).finally(() => {
+        starting = undefined;
+      });
+    await starting;
+  }
+  return {
+    config,
+    ensure,
+    async run(args, options) {
+      await ensure();
+      return command(args, options);
+    },
+    async status() {
+      try {
+        const current = await info();
+        return {
+          ready: true,
+          version: current.ServerVersion,
+          platform: config.platform,
+          root: config.root,
+        };
+      } catch {
+        return { ready: false, platform: config.platform, root: config.root };
+      }
+    },
+    async stop() {
+      await locked(config, async () => {
+        await info(); // Never signal an engine without validating ownership.
+        const script =
+          'set -eu\nroot="$1"\npid=$(cat "$root/run/docker.pid")\ncase "$pid" in ""|*[!0-9]*) exit 1;; esac\nkill -TERM "$pid"\n';
+        if (config.platform === "win32")
+          await wsl(["sh", "-s", "--", config.linuxRoot], { input: script });
+        else await run("sh", ["-s", "--", config.linuxRoot], { input: script });
+        for (let attempt = 0; attempt < 30; attempt++) {
+          try {
+            await info();
+          } catch {
+            return;
+          }
+          await sleep(1000);
+        }
+        throw runtimeError(
+          "The private engine is still shutting down. Check runtime:status before restarting.",
+        );
+      });
+    },
+  };
+}
+let managed;
+function managedRuntime() {
+  return (managed ||= createManagedRuntime());
+}
+
+exports.runtimeError = runtimeError;
+exports.runtimeConfig = runtimeConfig;
+exports.cleanEnvironment = cleanEnvironment;
+exports.execute = execute;
+exports.downloadArtifact = downloadArtifact;
+exports.dockerCommand = dockerCommand;
+exports.createManagedRuntime = createManagedRuntime;
+exports.managedRuntime = managedRuntime;

package/packages/runtime/index.mjs

@@ -0,0 +1,10 @@
+export {
+  runtimeError,
+  runtimeConfig,
+  cleanEnvironment,
+  execute,
+  downloadArtifact,
+  dockerCommand,
+  createManagedRuntime,
+  managedRuntime,
+} from "./index.cjs";

package/packages/runtime/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@naviyra/runtime",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": "./index.cjs"
+}

package/packages/shared/index.mjs

@@ -0,0 +1,85 @@
+import { z } from "zod";
+export const runtimeLabels = {
+  nodejs: "Node.js",
+  python: "Python",
+  php: "PHP",
+  go: "Go",
+  static: "Static / frontend",
+  custom: "Other (native executable)",
+};
+const relativePath = z
+  .string()
+  .max(200)
+  .regex(
+    /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[a-zA-Z0-9_./-]+$/,
+    "Use a relative project path without ..",
+  );
+export const runtimeConfig = z
+  .object({
+    python_server: z.enum(["asgi", "wsgi"]).default("asgi"),
+    entrypoint: z
+      .string()
+      .regex(/^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*:[A-Za-z_]\w*$/)
+      .default("app:app"),
+    public_dir: relativePath.default("."),
+    executable: z
+      .string()
+      .max(64)
+      .regex(/^[a-zA-Z0-9_.-]*$/)
+      .default(""),
+    args: z.array(z.string().max(1000)).max(32).default([]),
+  })
+  .default({
+    python_server: "asgi",
+    entrypoint: "app:app",
+    public_dir: ".",
+    executable: "",
+    args: [],
+  });
+export const projectInput = z
+  .object({
+    type: z
+      .enum(["nodejs", "python", "php", "go", "static", "custom"])
+      .default("nodejs"),
+    runtime_config: runtimeConfig,
+    name: z
+      .string()
+      .min(2)
+      .max(48)
+      .regex(/^[a-z][a-z0-9-]+$/, "Use lowercase letters, numbers and hyphens"),
+    subdomain: z
+      .string()
+      .max(253)
+      .regex(
+        /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/,
+        "Enter a full hostname, e.g. app.example.com",
+      ),
+    source_type: z.enum(["git", "zip"]),
+    git_url: z.string().max(500).optional().default(""),
+  })
+  .superRefine((data, ctx) => {
+    if (data.source_type === "git") {
+      try {
+        const u = new URL(data.git_url);
+        if (
+          u.protocol !== "https:" ||
+          u.username ||
+          u.password ||
+          u.port ||
+          !["github.com", "gitlab.com", "bitbucket.org"].includes(u.hostname)
+        )
+          throw Error();
+      } catch {
+        ctx.addIssue({
+          code: "custom",
+          path: ["git_url"],
+          message:
+            "Use a public HTTPS GitHub, GitLab or Bitbucket repository URL",
+        });
+      }
+    }
+  });
+export const idSchema = z.uuid();
+export const deploymentInput = z.object({ deployment_id: z.uuid() });
+export const MAX_ZIP_BYTES = 25 * 1024 * 1024;
+export const statuses = ["created", "queued", "deploying", "running", "failed"];

package/packages/shared/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@naviyra/shared",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": "./index.mjs",
+  "dependencies": {
+    "zod": "^4.1.12"
+  }
+}

package/scripts/migrate.mjs

@@ -0,0 +1,18 @@
+import pg from "pg";
+import { readFile, readdir } from "node:fs/promises";
+const client = new pg.Client({ connectionString: process.env.DATABASE_URL });
+await client.connect();
+try {
+  await client.query("BEGIN");
+  for (const file of (await readdir(new URL("../db/", import.meta.url)))
+    .filter((f) => f.endsWith(".sql"))
+    .sort()) {
+    await client.query(
+      await readFile(new URL(`../db/${file}`, import.meta.url), "utf8"),
+    );
+  }
+  await client.query("COMMIT");
+  console.log("Database schema ready.");
+} finally {
+  await client.end();
+}