@naviyra/cloud-panel 0.0.0-stage → 0.0.2

package/scripts/panel-control.mjs

@@ -0,0 +1,195 @@
+import { spawn } from "node:child_process";
+import { access, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import {
+  TASK_NAME,
+  panelOrigin,
+  removeBootTask,
+  runPowerShell,
+  startBootTask,
+  stopBootTask,
+} from "./windows-boot.mjs";
+
+export const COMMANDS = ["status", "open", "stop", "start", "update", "uninstall"];
+
+export function isProtectedDir(dir) {
+  const resolved = path.resolve(dir);
+  const roots = [
+    process.env.WINDIR,
+    process.env.ProgramFiles,
+    process.env["ProgramFiles(x86)"],
+  ].filter(Boolean);
+  return roots.some((root) => {
+    const base = path.resolve(root);
+    const prefix = base.toLowerCase() + path.sep;
+    return resolved.toLowerCase().startsWith(prefix) || resolved.toLowerCase() === base.toLowerCase();
+  });
+}
+
+export function canRemoveInstall(dir) {
+  const resolved = path.resolve(dir);
+  const base = path.basename(resolved).toLowerCase();
+  if (base === "system32" || base === "windows" || base === "syswow64") return false;
+  const windir = path.resolve(process.env.WINDIR || "C:\\Windows");
+  return resolved.toLowerCase() !== windir.toLowerCase();
+}
+
+export function problemFromLog(text) {
+  const lines = String(text)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  if (lines.some((line) => /permission denied/i.test(line)))
+    return "PostgreSQL could not create its data directory because this folder is protected. Install into an empty folder you own, such as D:\\naviyra-install.";
+  return lines.findLast((line) => /could not start|exited 1|error:/i.test(line)) || "";
+}
+
+export function formatStatus({ dir, taskState, origin, ready, problem }) {
+  if (!dir && (!taskState || taskState === "missing"))
+    return "Naviyra is not installed. From an empty folder you own, run: npx @naviyra/cloud-panel";
+  const lines = [
+    ready ? "Naviyra is running." : "Naviyra is not ready.",
+    `Panel: ${origin || "http://127.0.0.1:3000"}`,
+  ];
+  if (dir) lines.push(`Install folder: ${dir}`);
+  lines.push(`Startup task: ${taskState || "not registered"}`);
+  if (!ready && problem) lines.push(problem);
+  lines.push(
+    ready
+      ? "Open the panel with: npx @naviyra/cloud-panel open"
+      : "After it is ready, open it with: npx @naviyra/cloud-panel open",
+  );
+  return lines.join("\n");
+}
+
+async function isPanel(dir) {
+  try {
+    const pkg = JSON.parse(await readFile(path.join(dir, "package.json"), "utf8"));
+    await access(path.join(dir, "apps", "panel", "package.json"));
+    return pkg.name === "@naviyra/cloud-panel";
+  } catch {
+    return false;
+  }
+}
+
+export async function queryTask(run = runPowerShell) {
+  const result = await run(`$task = Get-ScheduledTask -TaskName ${"'" + TASK_NAME.replaceAll("'", "''") + "'"} -ErrorAction SilentlyContinue
+if (-not $task) { Write-Output 'STATE=missing'; exit 0 }
+Write-Output ('STATE=' + $task.State)
+Write-Output ('DIR=' + $task.Actions[0].WorkingDirectory)
+`);
+  const state = result.output.match(/STATE=(.*)/)?.[1]?.trim() || "missing";
+  const dir = result.output.match(/DIR=(.*)/)?.[1]?.trim() || "";
+  return { state, dir };
+}
+
+export async function panelHealthy(origin) {
+  try {
+    const response = await fetch(`${origin}/api/me`, {
+      redirect: "manual",
+      signal: AbortSignal.timeout(2000),
+    });
+    const body = await response.json();
+    return response.status === 401 && body.error === "Please sign in";
+  } catch {
+    return false;
+  }
+}
+
+function openBrowser(origin) {
+  const file = process.platform === "win32" ? "explorer.exe" : "xdg-open";
+  const browser = spawn(file, [origin], { windowsHide: true, stdio: "ignore" });
+  browser.once("error", () => console.log(`Open ${origin} in your browser.`));
+  browser.unref();
+}
+
+async function locate(options) {
+  const task = options.queryTask ? await options.queryTask() : await queryTask(options.runPowerShell);
+  if (task.dir && (await isPanel(task.dir))) return { ...task, dir: task.dir };
+  if (options.cwd && (await isPanel(options.cwd)))
+    return { state: task.state, dir: options.cwd };
+  return { state: task.state || "missing", dir: "" };
+}
+
+async function readStatus(dir, taskState) {
+  let envText = "";
+  let logText = "";
+  if (dir) {
+    try {
+      envText = await readFile(path.join(dir, ".env"), "utf8");
+    } catch {
+      envText = "";
+    }
+    try {
+      logText = await readFile(path.join(dir, ".runtime", "service.log"), "utf8");
+    } catch {
+      logText = "";
+    }
+  }
+  const origin = panelOrigin(envText);
+  const ready = await panelHealthy(origin);
+  return {
+    dir,
+    taskState,
+    origin,
+    ready,
+    problem: ready ? "" : problemFromLog(logText),
+  };
+}
+
+export async function execute(command, options = {}) {
+  const located = await locate(options);
+  if (command === "status") {
+    console.log(formatStatus(await readStatus(located.dir, located.state)));
+    return;
+  }
+  if (!located.dir)
+    throw Error("Naviyra is not installed. From an empty folder you own, run: npx @naviyra/cloud-panel");
+  const root = located.dir;
+  const run = options.runPowerShell;
+  if (command === "stop") {
+    const stopped = await stopBootTask({ root, runPowerShell: run });
+    if (!stopped.ok) throw Error(stopped.message || "Could not stop Naviyra.");
+    console.log("Naviyra is stopped.");
+    return;
+  }
+  if (command === "start") {
+    const started = await startBootTask(run);
+    if (!started.ok) throw Error(started.message || "Could not start Naviyra.");
+    console.log("Naviyra is starting. Check it with: npx @naviyra/cloud-panel status");
+    return;
+  }
+  if (command === "open") {
+    const status = await readStatus(root, located.state);
+    if (!status.ready) {
+      console.log(formatStatus(status));
+      throw Error("The panel is not ready to open yet.");
+    }
+    openBrowser(status.origin);
+    console.log(`Opened ${status.origin}`);
+    return;
+  }
+  if (command === "uninstall") {
+    const removed = await removeBootTask({ root, runPowerShell: run });
+    if (!removed.ok) throw Error(removed.message || "Could not remove the startup task.");
+    if (canRemoveInstall(root) && (await isPanel(root))) {
+      await rm(root, { recursive: true, force: true });
+      console.log(`Uninstalled Naviyra and removed ${root}`);
+      return;
+    }
+    console.log(`${removed.message} The install folder was left at ${root}`);
+    return;
+  }
+  if (command === "update") {
+    if (!options.source) throw Error("Cannot find the new Naviyra package to copy.");
+    if (path.resolve(options.source) === path.resolve(root))
+      throw Error("Run npx @naviyra/cloud-panel update so the newest package can replace this install.");
+    await options.copy(options.source, root);
+    await options.install(root);
+    const started = await startBootTask(run);
+    if (!started.ok) throw Error(started.message || "Update copied, but Naviyra did not start.");
+    console.log(`Updated Naviyra in ${root}. Check it with: npx @naviyra/cloud-panel status`);
+    return;
+  }
+  throw Error(`Unknown command: ${command}`);
+}

package/scripts/postgres-local.mjs

@@ -0,0 +1,97 @@
+import { spawn } from "node:child_process";
+import { access, mkdir, writeFile, unlink } from "node:fs/promises";
+import path from "node:path";
+import pg from "pg";
+const root = path.resolve(".runtime/postgres");
+const bin =
+  process.env.POSTGRES_BIN ||
+  (process.platform === "win32" ? "C:/Program Files/PostgreSQL/18/bin" : "");
+const exe = (name) =>
+  path.join(bin, name + (process.platform === "win32" ? ".exe" : ""));
+const run = (name, args) =>
+  new Promise((resolve, reject) => {
+    const child = spawn(exe(name), args, {
+      windowsHide: true,
+      stdio: "inherit",
+      shell: false,
+    });
+    child.on("error", reject);
+    child.on("exit", (code) =>
+      code === 0 ? resolve() : reject(Error(`${name} exited ${code}`)),
+    );
+  });
+const url = new URL(process.env.DATABASE_URL || "");
+if (!["localhost", "127.0.0.1"].includes(url.hostname))
+  throw Error(
+    "db:local only manages a loopback database; keep remote PostgreSQL separately managed",
+  );
+const port = Number(url.port || 5432),
+  user = decodeURIComponent(url.username),
+  password = decodeURIComponent(url.password),
+  database = url.pathname.slice(1);
+if (
+  !password ||
+  !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(user) ||
+  !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(database)
+)
+  throw Error(
+    "Local database URL needs a password and simple database/user names",
+  );
+if (process.argv.includes("--stop")) {
+  await run("pg_ctl", ["-D", root, "stop", "-m", "fast"]);
+  process.exit(0);
+}
+await mkdir(".runtime", { recursive: true });
+let initialized = false;
+try {
+  await access(path.join(root, "PG_VERSION"));
+  initialized = true;
+} catch {}
+if (!initialized) {
+  const pwfile = path.resolve(".runtime/postgres-init-password");
+  await writeFile(pwfile, password, { mode: 0o600 });
+  try {
+    await run("initdb", [
+      "-D",
+      root,
+      "-U",
+      user,
+      "--auth=scram-sha-256",
+      "--pwfile",
+      pwfile,
+      "--encoding=UTF8",
+      "--locale=C",
+    ]);
+  } finally {
+    await unlink(pwfile);
+  }
+}
+await run("pg_ctl", [
+  "-D",
+  root,
+  "-l",
+  path.resolve(".runtime/postgres.log"),
+  "-o",
+  `-h 127.0.0.1 -p ${port}`,
+  "-w",
+  "start",
+]);
+const adminUrl = new URL(url);
+adminUrl.pathname = "/postgres";
+const client = new pg.Client({ connectionString: adminUrl.href });
+await client.connect();
+try {
+  if (
+    !(
+      await client.query("SELECT 1 FROM pg_database WHERE datname=$1", [
+        database,
+      ])
+    ).rowCount
+  )
+    await client.query(`CREATE DATABASE "${database}"`);
+} finally {
+  await client.end();
+}
+console.log(
+  "Native PostgreSQL is ready. Run npm run db:migrate and npm run db:seed.",
+);

package/scripts/runtime-download-manifest.mjs

@@ -0,0 +1,30 @@
+// Maintainer utility: resolve hashes from the official HTTPS distribution endpoints.
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+const artifacts = {};
+await mkdir(".runtime/runtime-downloads", { recursive: true });
+for (const arch of ["x86_64", "aarch64"]) {
+  for (const name of ["docker", "docker-rootless-extras"]) {
+    const file = `${name}-29.8.2-${arch}.tgz`;
+    const url = `https://download.docker.com/linux/static/stable/${arch}/${name}-29.8.2.tgz`;
+    const response = await fetch(url);
+    if (!response.ok) throw Error(`${response.status}: ${url}`);
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    await writeFile(`.runtime/runtime-downloads/${file}`, bytes);
+    artifacts[`${name}-${arch}`] = { file, url, sha256 };
+    console.log(file, sha256);
+  }
+  const file = `alpine-minirootfs-3.23.6-${arch}.tar.gz`;
+  const url = `https://dl-cdn.alpinelinux.org/alpine/v3.23/releases/${arch}/${file}`;
+  const response = await fetch(`${url}.sha256`);
+  if (!response.ok)
+    throw Error(`Cannot read Alpine checksum: ${response.status}`);
+  const sha256 = (await response.text()).split(/\s/)[0];
+  if (!/^[0-9a-f]{64}$/.test(sha256)) throw Error("Invalid Alpine checksum");
+  artifacts[`alpine-${arch}`] = { file, url, sha256 };
+}
+await writeFile(
+  "packages/runtime/artifacts.json",
+  JSON.stringify(artifacts, null, 2) + "\n",
+);

package/scripts/runtime.mjs

@@ -0,0 +1,20 @@
+import { managedRuntime } from "../packages/runtime/index.mjs";
+try {
+  const runtime = managedRuntime();
+  const action = process.argv[2] || "setup";
+  if (action === "status")
+    console.log(JSON.stringify(await runtime.status(), null, 2));
+  else if (action === "stop") {
+    await runtime.stop();
+    console.log("Naviyra Docker stopped. Database data is preserved.");
+  } else if (["setup", "start"].includes(action)) {
+    console.log(
+      "Preparing Naviyra's private Docker runtime. First setup downloads verified runtime files.",
+    );
+    await runtime.ensure();
+    console.log(JSON.stringify(await runtime.status(), null, 2));
+  } else throw Error("Use setup, start, status, or stop");
+} catch (error) {
+  console.error(error.message);
+  process.exitCode = 1;
+}

package/scripts/seed.mjs

@@ -0,0 +1,35 @@
+import pg from "pg";
+import bcrypt from "bcryptjs";
+import { randomUUID, createHash } from "node:crypto";
+if (
+  !process.env.ADMIN_EMAIL ||
+  (process.env.ADMIN_PASSWORD?.length || 0) < 12 ||
+  (process.env.AGENT_TOKEN?.length || 0) < 32
+)
+  throw Error(
+    "Set ADMIN_EMAIL, ADMIN_PASSWORD (12+ characters), and AGENT_TOKEN (32+ characters).",
+  );
+const client = new pg.Client({ connectionString: process.env.DATABASE_URL });
+await client.connect();
+try {
+  await client.query(
+    "INSERT INTO users(id,email,password_hash,role) VALUES($1,$2,$3,$4) ON CONFLICT(email) DO UPDATE SET password_hash=$3",
+    [
+      randomUUID(),
+      process.env.ADMIN_EMAIL.toLowerCase(),
+      await bcrypt.hash(process.env.ADMIN_PASSWORD, 12),
+      "admin",
+    ],
+  );
+  await client.query(
+    "INSERT INTO agents(id,name,token_hash) VALUES($1,$2,$3) ON CONFLICT(name) DO UPDATE SET token_hash=$3",
+    [
+      randomUUID(),
+      "primary",
+      createHash("sha256").update(process.env.AGENT_TOKEN).digest("hex"),
+    ],
+  );
+  console.log("Administrator and primary agent ready.");
+} finally {
+  await client.end();
+}

package/scripts/service-supervisor.mjs

@@ -0,0 +1,164 @@
+import { spawn } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { mkdir, stat, rename, writeFile, unlink } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import net from "node:net";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+function portOpen(port) {
+  return new Promise((resolve) => {
+    const socket = net.createConnection({ host: "127.0.0.1", port });
+    const finish = (open) => {
+      socket.destroy();
+      resolve(open);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(1500, () => finish(false));
+  });
+}
+
+async function stackUp() {
+  try {
+    process.loadEnvFile(path.join(root, ".env"));
+  } catch {
+    // The launcher creates .env when it is missing.
+  }
+  const panelPort = Number(process.env.PANEL_PORT || 3000);
+  const agentPort = Number(process.env.AGENT_PORT || 4001);
+  if (
+    !Number.isInteger(panelPort) ||
+    !Number.isInteger(agentPort) ||
+    panelPort < 1 ||
+    agentPort < 1
+  )
+    return false;
+  return (await portOpen(panelPort)) && (await portOpen(agentPort));
+}
+
+function killTree(pid) {
+  if (!pid) return;
+  if (process.platform === "win32") {
+    const killer = spawn("taskkill.exe", ["/PID", String(pid), "/T", "/F"], {
+      windowsHide: true,
+      stdio: "ignore",
+    });
+    killer.once("error", () => {});
+    killer.unref();
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    // The child has already exited.
+  }
+}
+
+export async function supervise(options = {}) {
+  const log = options.log ?? (() => {});
+  const spawnChild = options.spawnChild;
+  const healthy = options.stackUp ?? stackUp;
+  const sleep =
+    options.sleep ??
+    (async (ms, shouldStop) => {
+      const step = 200;
+      for (let waited = 0; waited < ms && !shouldStop(); waited += step)
+        await delay(Math.min(step, ms - waited));
+    });
+  let stopping = false;
+  const shouldStop = options.shouldStop ?? (() => stopping);
+  let current = null;
+  if (options.hookSignals !== false && !options.shouldStop) {
+    for (const signal of ["SIGINT", "SIGTERM", "SIGHUP"])
+      process.on(signal, () => {
+        stopping = true;
+        current?.kill();
+      });
+  }
+  let backoff = 3000;
+  log("Naviyra service supervisor started.");
+  while (!shouldStop()) {
+    const started = Date.now();
+    current = spawnChild();
+    const code = await current.exited;
+    current = null;
+    if (shouldStop()) break;
+    const ran = Date.now() - started;
+    if (code === 0 && (await healthy())) {
+      log("Launcher exited cleanly. Watching until the panel or agent stops.");
+      while (!shouldStop() && (await healthy())) await sleep(5000, shouldStop);
+      if (shouldStop()) break;
+      backoff = 3000;
+      log("Panel or agent is not listening. Starting again in 3s.");
+      await sleep(3000, shouldStop);
+      continue;
+    }
+    if (ran > 60000) backoff = 3000;
+    const wait = code === 0 ? Math.max(backoff, 3000) : backoff;
+    log(
+      `Launcher exited with code ${code}. Restarting in ${Math.round(wait / 1000)}s.`,
+    );
+    await sleep(wait, shouldStop);
+    backoff = Math.min(Math.max(wait, 3000) * 2, 60000);
+  }
+  log("Naviyra service supervisor stopped.");
+  return 0;
+}
+
+function spawnLauncher(logStream) {
+  const child = spawn(
+    process.execPath,
+    ["scripts/start-naviyra.mjs", "--no-browser"],
+    {
+      cwd: root,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"],
+    },
+  );
+  child.stdout?.on("data", (chunk) => logStream.write(chunk));
+  child.stderr?.on("data", (chunk) => logStream.write(chunk));
+  return {
+    exited: new Promise((resolve) => {
+      child.once("error", () => resolve(1));
+      child.once("exit", (code) => resolve(code ?? 1));
+    }),
+    kill() {
+      killTree(child.pid);
+    },
+  };
+}
+
+async function main() {
+  const runtime = path.join(root, ".runtime");
+  await mkdir(runtime, { recursive: true });
+  const logPath = path.join(runtime, "service.log");
+  try {
+    if ((await stat(logPath)).size > 2_000_000)
+      await rename(logPath, `${logPath}.1`);
+  } catch {
+    // A missing log is created by the write stream.
+  }
+  const logStream = createWriteStream(logPath, { flags: "a" });
+  const log = (line) => {
+    logStream.write(`[${new Date().toISOString()}] ${line}\n`);
+  };
+  const pidFile = path.join(runtime, "service.pid");
+  await writeFile(pidFile, String(process.pid));
+  try {
+    await supervise({ log, spawnChild: () => spawnLauncher(logStream), stackUp });
+  } finally {
+    await unlink(pidFile).catch(() => {});
+    logStream.end();
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  process.chdir(root);
+  main().catch((error) => {
+    console.error(error.message);
+    process.exitCode = 1;
+  });
+}