easy-vps 0.1.0

package/dist/routes/system.js

@@ -0,0 +1,83 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const system = __importStar(require("../services/system"));
+const metrics_history_1 = require("../services/metrics-history");
+const async_route_1 = require("./async-route");
+const router = (0, express_1.Router)();
+router.get('/status', (0, async_route_1.asyncRoute)(async (req, res) => {
+    const [privileged, dependencies] = await Promise.all([
+        system.canAdminister(req.remote),
+        system.detectAll(req.remote),
+    ]);
+    res.json({
+        root: privileged,
+        host: req.remote.host,
+        user: req.remote.username,
+        dependencies,
+    });
+}));
+router.get('/metrics', (0, async_route_1.asyncRoute)(async (req, res) => {
+    const metrics = await system.getMetrics(req.remote);
+    (0, metrics_history_1.recordLoad)(req.remote.host, metrics.loadAverage);
+    res.json(metrics);
+}));
+router.get('/metrics/history', (0, async_route_1.asyncRoute)(async (req, res) => {
+    res.json((0, metrics_history_1.getLoadHistory)(req.remote.host));
+}));
+router.get('/:action(install|uninstall)/:name/stream', (req, res) => {
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        Connection: 'keep-alive',
+    });
+    const send = (event, data) => {
+        res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+    };
+    const cancel = system.packageStream(req.remote, req.params.name, req.params.action, {
+        onOutput: (line) => send('log', line),
+        onDone: () => {
+            send('done', 'ok');
+            res.end();
+        },
+        onError: (message) => {
+            send('failed', message);
+            res.end();
+        },
+    });
+    req.on('close', cancel);
+});
+exports.default = router;

package/dist/services/auth.d.ts

@@ -0,0 +1,25 @@
+import { type Credentials, type Remote } from './ssh';
+export declare class ValidationError extends Error {
+}
+export declare class AuthError extends Error {
+}
+export type LoginCredentials = Credentials;
+export interface Session {
+    /** Key into the in-memory connection registry in ./ssh. */
+    id: string;
+    username: string;
+    host: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export declare function secretPath(): string;
+export declare function verify(token: string): Session | null;
+/**
+ * Verifies credentials against the VPS's sshd and, on success, registers the
+ * live connection the rest of the panel runs its commands through.
+ */
+export declare function login(credentials: LoginCredentials): Promise<string>;
+/** Closes the SSH connection behind a session token, if one is still open. */
+export declare function logout(token: string): void;
+/** The live connection for a verified session, or null once the panel restarts. */
+export declare function remoteFor(session: Session): Remote | null;

package/dist/services/auth.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthError = exports.ValidationError = void 0;
+exports.secretPath = secretPath;
+exports.verify = verify;
+exports.login = login;
+exports.logout = logout;
+exports.remoteFor = remoteFor;
+// Verifies VPS credentials by attempting a real SSH connection, and issues session tokens.
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const node_path_1 = __importDefault(require("node:path"));
+const daemon_1 = require("./daemon");
+const ssh_1 = require("./ssh");
+class ValidationError extends Error {
+}
+exports.ValidationError = ValidationError;
+class AuthError extends Error {
+}
+exports.AuthError = AuthError;
+const SECRET_BYTES = 32;
+const SESSION_LIFETIME_SECONDS = 12 * 60 * 60;
+function secretPath() {
+    return node_path_1.default.join((0, daemon_1.stateDir)(), 'session-secret');
+}
+/**
+ * The HMAC key for session cookies. Kept on disk so a restart (a `tsc --watch`
+ * rebuild in dev, a `systemctl restart` in production) does not silently
+ * invalidate every issued cookie and drop the UI to 401.
+ */
+function loadSecret() {
+    const fromEnv = process.env.EASY_VPS_SECRET;
+    if (fromEnv)
+        return (0, node_crypto_1.createHash)('sha256').update(fromEnv).digest();
+    let file;
+    try {
+        file = secretPath();
+        const secret = Buffer.from((0, node_fs_1.readFileSync)(file, 'utf8').trim(), 'base64');
+        if (secret.length === SECRET_BYTES)
+            return secret;
+    }
+    catch {
+        // No secret yet, or the state directory is unreachable — mint a new one below.
+    }
+    const secret = (0, node_crypto_1.randomBytes)(SECRET_BYTES);
+    try {
+        file ??= secretPath();
+        (0, node_fs_1.writeFileSync)(file, secret.toString('base64'), { mode: 0o600 });
+        (0, node_fs_1.chmodSync)(file, 0o600);
+    }
+    catch (err) {
+        console.warn(`easy-vps: could not persist the session secret (${err.message}); ` +
+            'sessions will not survive a restart. Set EASY_VPS_SECRET to pin one.');
+    }
+    return secret;
+}
+const SECRET = loadSecret();
+function sign(session) {
+    const payload = Buffer.from(JSON.stringify(session)).toString('base64url');
+    const signature = (0, node_crypto_1.createHmac)('sha256', SECRET).update(payload).digest('base64url');
+    return `${payload}.${signature}`;
+}
+function verify(token) {
+    const parts = token.split('.');
+    if (parts.length !== 2)
+        return null;
+    const [payload, signature] = parts;
+    const expected = (0, node_crypto_1.createHmac)('sha256', SECRET).update(payload).digest('base64url');
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
+        return null;
+    try {
+        const session = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        if (Date.now() / 1000 > session.expiresAt)
+            return null;
+        return session;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verifies credentials against the VPS's sshd and, on success, registers the
+ * live connection the rest of the panel runs its commands through.
+ */
+async function login(credentials) {
+    if (!credentials.host || !credentials.username) {
+        throw new ValidationError('Host and username are required');
+    }
+    const hasPassword = Boolean(credentials.password);
+    const hasKey = Boolean(credentials.privateKey);
+    if (hasPassword === hasKey) {
+        throw new ValidationError('Provide either a password or a private key, not both');
+    }
+    const id = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    const remote = (0, ssh_1.createSession)(id, credentials);
+    try {
+        // Doubles as the credential check and as a warm-up of the uid cache.
+        await remote.uid();
+    }
+    catch (err) {
+        (0, ssh_1.destroySession)(id);
+        throw new AuthError(err instanceof ssh_1.RemoteError ? err.message : String(err));
+    }
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const session = {
+        id,
+        username: credentials.username,
+        host: credentials.host,
+        issuedAt,
+        expiresAt: issuedAt + SESSION_LIFETIME_SECONDS,
+    };
+    return sign(session);
+}
+/** Closes the SSH connection behind a session token, if one is still open. */
+function logout(token) {
+    const session = verify(token);
+    if (session)
+        (0, ssh_1.destroySession)(session.id);
+}
+/** The live connection for a verified session, or null once the panel restarts. */
+function remoteFor(session) {
+    return (0, ssh_1.getSession)(session.id);
+}

package/dist/services/backup-config.d.ts

@@ -0,0 +1,16 @@
+import type { Credentials } from './ssh';
+export interface S3Config {
+    bucket: string;
+    region: string;
+    accessKey: string;
+    secretKey: string;
+}
+export interface BackupConfig {
+    enabled: boolean;
+    retention: number;
+    s3: S3Config | null;
+    ssh: Credentials | null;
+}
+export declare function getBackupConfig(name: string): BackupConfig;
+export declare function setBackupConfig(name: string, config: Partial<BackupConfig>): BackupConfig;
+export declare function getAllEnabled(): Record<string, BackupConfig>;

package/dist/services/backup-config.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBackupConfig = getBackupConfig;
+exports.setBackupConfig = setBackupConfig;
+exports.getAllEnabled = getAllEnabled;
+// Persistent backup configuration stored in the panel's state directory.
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const daemon_1 = require("./daemon");
+function configPath() {
+    return node_path_1.default.join((0, daemon_1.stateDir)(), 'backup-config.json');
+}
+function loadStore() {
+    try {
+        if ((0, node_fs_1.existsSync)(configPath())) {
+            return JSON.parse((0, node_fs_1.readFileSync)(configPath(), 'utf8'));
+        }
+    }
+    catch {
+        // Corrupted file — start fresh
+    }
+    return { databases: {} };
+}
+function saveStore(store) {
+    (0, node_fs_1.writeFileSync)(configPath(), JSON.stringify(store, null, 2), 'utf8');
+}
+function getBackupConfig(name) {
+    const store = loadStore();
+    return store.databases[name] ?? { enabled: false, retention: 7, s3: null, ssh: null };
+}
+function setBackupConfig(name, config) {
+    const store = loadStore();
+    const existing = store.databases[name] ?? { enabled: false, retention: 7, s3: null, ssh: null };
+    const merged = { ...existing, ...config };
+    store.databases[name] = merged;
+    saveStore(store);
+    return merged;
+}
+function getAllEnabled() {
+    const store = loadStore();
+    const enabled = {};
+    for (const [name, config] of Object.entries(store.databases)) {
+        if (config.enabled && config.s3) {
+            enabled[name] = config;
+        }
+    }
+    return enabled;
+}

package/dist/services/backup-scheduler.d.ts

@@ -0,0 +1,2 @@
+export declare function startBackupScheduler(): void;
+export declare function stopBackupScheduler(): void;

package/dist/services/backup-scheduler.js

@@ -0,0 +1,104 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startBackupScheduler = startBackupScheduler;
+exports.stopBackupScheduler = stopBackupScheduler;
+// Hourly backup scheduler — runs independently of user sessions.
+const cron = __importStar(require("node-cron"));
+const ssh_1 = require("./ssh");
+const backup_config_1 = require("./backup-config");
+const database_1 = require("./database");
+const s3_1 = require("./s3");
+let task = null;
+async function runBackupCycle() {
+    const enabled = (0, backup_config_1.getAllEnabled)();
+    const entries = Object.entries(enabled);
+    if (entries.length === 0)
+        return;
+    console.log(`[backup-scheduler] Running backup cycle for ${entries.length} database(s)…`);
+    for (const [name, config] of entries) {
+        if (!config.ssh || !config.s3)
+            continue;
+        const sessionId = `backup-${name}-${Date.now()}`;
+        let remote = null;
+        try {
+            remote = (0, ssh_1.createSession)(sessionId, config.ssh);
+            // Ensure the connection works
+            await remote.uid();
+            console.log(`[backup-scheduler] Backing up ${name}…`);
+            const { key } = await (0, database_1.backupToS3)(remote, name, 'postgres');
+            console.log(`[backup-scheduler] ${name} uploaded to s3://${config.s3.bucket}/${key}`);
+            // Enforce retention
+            await (0, s3_1.enforceRetention)(config.s3, 'postgres', name, config.retention);
+            console.log(`[backup-scheduler] ${name} retention enforced (keep ${config.retention})`);
+        }
+        catch (err) {
+            console.error(`[backup-scheduler] Failed to backup ${name}:`, err.message);
+        }
+        finally {
+            if (remote) {
+                try {
+                    (0, ssh_1.destroySession)(sessionId);
+                }
+                catch { /* ignore */ }
+            }
+        }
+    }
+    console.log('[backup-scheduler] Backup cycle complete');
+}
+function startBackupScheduler() {
+    if (task)
+        return;
+    console.log('[backup-scheduler] Starting hourly backup scheduler (cron: 0 * * * *)');
+    // Run first cycle after 1 minute (give server time to fully start)
+    setTimeout(() => {
+        runBackupCycle().catch((err) => {
+            console.error('[backup-scheduler] Initial cycle failed:', err.message);
+        });
+    }, 60_000);
+    // Schedule hourly cron job: at minute 0 of every hour
+    task = cron.schedule('0 * * * *', () => {
+        runBackupCycle().catch((err) => {
+            console.error('[backup-scheduler] Scheduled cycle failed:', err.message);
+        });
+    });
+}
+function stopBackupScheduler() {
+    if (task) {
+        task.stop();
+        task = null;
+        console.log('[backup-scheduler] Scheduler stopped');
+    }
+}

package/dist/services/daemon.d.ts

@@ -0,0 +1,28 @@
+export declare const SERVICE_NAME = "easy-vps";
+export type Mode = 'systemd' | 'process';
+export interface DaemonOptions {
+    port: number;
+    host: string;
+}
+export interface DaemonState {
+    mode: Mode | null;
+    running: boolean;
+    pid: number | null;
+    detail: string;
+}
+export declare function isRoot(): boolean;
+export declare function hasSystemd(): boolean;
+/** systemd is only usable for a system-wide unit when we are root. */
+export declare function mode(): Mode;
+/** Writable location for the pid file and log of the detached fallback. */
+export declare function stateDir(): string;
+export declare function logPath(): string;
+export declare function start(options: DaemonOptions): Promise<Mode>;
+export declare function stop(): Promise<void>;
+/** Remove the systemd unit; used when the package is uninstalled. */
+export declare function uninstall(): Promise<void>;
+export declare function status(): Promise<DaemonState>;
+/** Open the panel port in ufw, when ufw is installed and active. */
+export declare function openFirewall(port: number): Promise<boolean>;
+/** Non-internal IPv4 addresses, used to tell the user where to point a browser. */
+export declare function addresses(): string[];

package/dist/services/daemon.js

@@ -0,0 +1,180 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE_NAME = void 0;
+exports.isRoot = isRoot;
+exports.hasSystemd = hasSystemd;
+exports.mode = mode;
+exports.stateDir = stateDir;
+exports.logPath = logPath;
+exports.start = start;
+exports.stop = stop;
+exports.uninstall = uninstall;
+exports.status = status;
+exports.openFirewall = openFirewall;
+exports.addresses = addresses;
+// Background service control: systemd unit when available, detached process otherwise.
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const run = (0, node_util_1.promisify)(node_child_process_1.execFile);
+exports.SERVICE_NAME = 'easy-vps';
+const UNIT_PATH = `/etc/systemd/system/${exports.SERVICE_NAME}.service`;
+function isRoot() {
+    return typeof process.getuid === 'function' && process.getuid() === 0;
+}
+function hasSystemd() {
+    return (0, node_fs_1.existsSync)('/run/systemd/system') && (0, node_fs_1.existsSync)('/usr/bin/systemctl');
+}
+/** systemd is only usable for a system-wide unit when we are root. */
+function mode() {
+    return hasSystemd() && isRoot() ? 'systemd' : 'process';
+}
+/** Writable location for the pid file and log of the detached fallback. */
+function stateDir() {
+    const dir = isRoot() ? '/var/lib/easy-vps' : node_path_1.default.join(node_os_1.default.homedir(), '.easy-vps');
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    return dir;
+}
+function logPath() {
+    return node_path_1.default.join(stateDir(), 'easy-vps.log');
+}
+function pidPath() {
+    return node_path_1.default.join(stateDir(), 'easy-vps.pid');
+}
+function cliPath() {
+    return node_path_1.default.resolve(__dirname, '..', '..', 'bin', 'cli.js');
+}
+function readPid() {
+    try {
+        const pid = Number((0, node_fs_1.readFileSync)(pidPath(), 'utf8').trim());
+        return Number.isInteger(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function unitFile(options) {
+    return `[Unit]
+Description=easy-vps control panel
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${process.execPath} ${cliPath()} --port ${options.port} --host ${options.host}
+Restart=on-failure
+RestartSec=5
+Environment=NODE_ENV=production
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+/** Install and start the systemd unit so the panel survives a closed terminal and reboots. */
+async function startSystemd(options) {
+    (0, node_fs_1.writeFileSync)(UNIT_PATH, unitFile(options), 'utf8');
+    await run('systemctl', ['daemon-reload']);
+    await run('systemctl', ['enable', exports.SERVICE_NAME]);
+    await run('systemctl', ['restart', exports.SERVICE_NAME]);
+}
+/** Fallback: fully detached child that outlives the parent shell. */
+function startProcess(options) {
+    const out = (0, node_fs_1.openSync)(logPath(), 'a');
+    const child = (0, node_child_process_1.spawn)(process.execPath, [cliPath(), '--port', String(options.port), '--host', options.host], { detached: true, stdio: ['ignore', out, out] });
+    child.unref();
+    (0, node_fs_1.writeFileSync)(pidPath(), String(child.pid), 'utf8');
+    return child.pid;
+}
+async function start(options) {
+    const target = mode();
+    if (target === 'systemd') {
+        await startSystemd(options);
+    }
+    else {
+        await stop();
+        startProcess(options);
+    }
+    return target;
+}
+async function stop() {
+    if (mode() === 'systemd' && (0, node_fs_1.existsSync)(UNIT_PATH)) {
+        await run('systemctl', ['stop', exports.SERVICE_NAME]).catch(() => undefined);
+        return;
+    }
+    const pid = readPid();
+    if (pid && alive(pid)) {
+        try {
+            process.kill(pid, 'SIGTERM');
+        }
+        catch {
+            // already gone
+        }
+    }
+    (0, node_fs_1.rmSync)(pidPath(), { force: true });
+}
+/** Remove the systemd unit; used when the package is uninstalled. */
+async function uninstall() {
+    await stop();
+    if ((0, node_fs_1.existsSync)(UNIT_PATH)) {
+        await run('systemctl', ['disable', exports.SERVICE_NAME]).catch(() => undefined);
+        (0, node_fs_1.rmSync)(UNIT_PATH, { force: true });
+        await run('systemctl', ['daemon-reload']).catch(() => undefined);
+    }
+}
+async function status() {
+    if (hasSystemd() && (0, node_fs_1.existsSync)(UNIT_PATH)) {
+        const active = await run('systemctl', ['is-active', exports.SERVICE_NAME])
+            .then(({ stdout }) => stdout.trim())
+            .catch((error) => (error.stdout || 'inactive').trim());
+        return {
+            mode: 'systemd',
+            running: active === 'active',
+            pid: null,
+            detail: `systemd unit ${exports.SERVICE_NAME} is ${active}`,
+        };
+    }
+    const pid = readPid();
+    if (pid && alive(pid)) {
+        return { mode: 'process', running: true, pid, detail: `running as pid ${pid}` };
+    }
+    return { mode: pid ? 'process' : null, running: false, pid: null, detail: 'not running' };
+}
+/** Open the panel port in ufw, when ufw is installed and active. */
+async function openFirewall(port) {
+    if (!isRoot())
+        return false;
+    try {
+        const { stdout } = await run('ufw', ['status']);
+        if (!stdout.toLowerCase().includes('status: active'))
+            return false;
+        await run('ufw', ['allow', `${port}/tcp`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Non-internal IPv4 addresses, used to tell the user where to point a browser. */
+function addresses() {
+    const found = [];
+    for (const list of Object.values(node_os_1.default.networkInterfaces())) {
+        for (const net of list || []) {
+            if (net.family === 'IPv4' && !net.internal)
+                found.push(net.address);
+        }
+    }
+    return found;
+}

package/dist/services/database.d.ts

@@ -0,0 +1,60 @@
+import { type Remote, type StreamHandlers } from './ssh';
+export type DatabaseEngine = 'postgres' | 'mysql' | 'mongodb';
+export interface DatabaseConfig {
+    name: string;
+    engine: DatabaseEngine;
+    user: string;
+    password: string;
+    port: number;
+    poolSize: number;
+}
+export interface DatabaseInstance {
+    name: string;
+    engine: DatabaseEngine;
+    user: string;
+    password: string;
+    port: number;
+    host: string;
+    pooledPort: number;
+    poolSize: number;
+    status: 'running' | 'stopped' | 'unknown';
+}
+/** Start the pooler sidecar for an engine that has one. Returns the host port, or 0. */
+export declare function startPooler(remote: Remote, config: DatabaseConfig): Promise<number>;
+/** List all databases managed by easy-vps. */
+export declare function list(remote: Remote): Promise<DatabaseInstance[]>;
+/** Create a new database container. */
+export declare function createDatabase(remote: Remote, config: DatabaseConfig): Promise<{
+    port: number;
+    host: string;
+    pooledPort: number;
+}>;
+/** Remove a database container. */
+export declare function removeDatabase(remote: Remote, name: string): Promise<void>;
+/** Backup a database using pg_dump. */
+export declare function backup(remote: Remote, name: string): Promise<{
+    path: string;
+}>;
+/** Restore a database from a dump file. */
+export declare function restore(remote: Remote, name: string, dumpPath: string): Promise<void>;
+/** Download a file from the VPS to the panel server using base64 encoding. */
+export declare function downloadDump(remote: Remote, remotePath: string, localPath: string): Promise<void>;
+/** Upload a database backup to S3. */
+export declare function backupToS3(remote: Remote, name: string, engine: string): Promise<{
+    key: string;
+}>;
+/** Stream a backup with progress logging via SSH execStream. */
+export declare function backupStream(remote: Remote, name: string, engine: string, handlers: StreamHandlers): () => void;
+/** Read a backup file from S3 and return its buffer. */
+export declare function readBackupFromS3(name: string, engine: string, s3Key: string): Promise<{
+    buffer: Buffer;
+    fileName: string;
+}>;
+/** List backups for a database from S3. */
+export declare function listBackupsFromS3(name: string, engine: string): Promise<{
+    key: string;
+    size: number;
+    lastModified: Date;
+}[]>;
+/** Restore a database from an S3 backup. */
+export declare function restoreFromS3(remote: Remote, name: string, engine: string, s3Key: string): Promise<void>;