n8n-nodes-whm 1.0.0

package/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anthony Tuberville
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,161 @@
+# n8n-nodes-whm
+
+A community node package that brings [cPanel & WHM](https://cpanel.net/) (WebHost
+Manager) into [n8n](https://n8n.io/) as native nodes.
+
+It ships two nodes:
+
+- **WHM** — an action node covering the server-level WHM API (accounts, packages,
+  domains, DNS zones, resellers, server, services, SSL, backups, API tokens) **and**
+  the account-level cPanel API (email accounts, MySQL databases, addon/parked/sub
+  domains, FTP accounts) executed *as* any cPanel user through WHM — no per-account
+  passwords needed. Two escape hatches (*Custom WHM Call* and *cPanel Function*) can
+  invoke any documented WHM API 1, UAPI or API 2 function.
+- **WHM Trigger** — a webhook node that starts workflows from WHM hook events
+  (account created, suspended, email account added, …) via a small, signed hook
+  bridge script that you register on the server.
+
+> Design, endpoint, authentication and workflow details live in
+> [`WHM-n8n-Node-Technical-Documentation.md`](./WHM-n8n-Node-Technical-Documentation.md).
+
+## Installation
+
+### Via the n8n UI (recommended)
+1. In n8n go to **Settings → Community Nodes → Install**.
+2. Enter `n8n-nodes-whm` and confirm.
+
+### Manual / self-hosted
+```bash
+cd ~/.n8n/nodes        # or your N8N_CUSTOM_EXTENSIONS path
+npm install n8n-nodes-whm
+```
+
+### Build from source
+```bash
+git clone https://github.com/Falcyn/n8n-nodes-whm.git
+cd n8n-nodes-whm
+npm install
+npm run build      # tsc + copies icons into dist/
+npm run lint       # eslint with eslint-plugin-n8n-nodes-base
+```
+The compiled output in `dist/` is what n8n loads (see the `n8n` block in `package.json`).
+
+## Credentials
+
+Create an API token in WHM first:
+
+1. **WHM » Development » Manage API Tokens » Generate Token.**
+2. Give it a name and restrict its privileges (ACLs) to what your workflows need. A
+   reseller can generate a token limited to its own accounts.
+3. Copy the token — WHM shows it only once.
+
+Then in n8n add a **WHM API** credential:
+
+| Field | Example | Notes |
+|-------|---------|-------|
+| Host | `server.example.com` | Hostname or IP, no scheme or port |
+| Port | `2087` | 2087 = HTTPS (default), 2086 = plain HTTP |
+| Use SSL | on | Keep on; the port must match |
+| Username | `root` | root or a reseller username |
+| Authentication | API Token | Password (HTTP Basic) is also supported |
+| API Token | `U7HMR63FGY…` | From WHM |
+| Ignore SSL Issues | off | Turn on only if WHM still uses its self-signed certificate |
+
+The credential **Test** button calls the harmless `version` function.
+
+## What the WHM node can do
+
+| Resource | Operations |
+|----------|------------|
+| **Account** | Create, Get, Get Many, Get Suspended, Modify, Suspend, Unsuspend, Terminate, Change Package, Change Password, Change Primary IP, Set Bandwidth Limit, Set Disk Quota, Get Bandwidth Usage, Get Disk Usage, Create Login Session (SSO URL), Force Password Change |
+| **Package** | Create, Update, Delete, Get, Get Many, Get Feature Lists, Get Feature List |
+| **Domain** | Get Many (every domain on the server), Get Owner, Get User Data (vhost), Park, Unpark, Resolve |
+| **DNS Zone** | Get Many, Create Zone, Delete Zone, Get Zone (all records), Reset Zone, Add / Edit / Get / Delete Record, Get MX Records, Save MX Record, Lookup Nameserver IP |
+| **Reseller** | Get Many, Grant / Revoke Privileges, Get Stats, Get Account Counts, Get / Set IP Addresses, Set Main IP, Set Nameservers, Set Limits, Set Package Limit, Set ACLs, Get ACL Lists, Suspend, Unsuspend, Terminate |
+| **Server** | Get Version, Get Hostname, Set Hostname, Get Load Average, Get Disk Usage, Get / Add / Delete IP Addresses, Get / Set Tweak Setting, Get Languages, Get Applications, Reboot |
+| **Service** | Get Status, Restart, Configure (enable / monitor) |
+| **SSL** | Get Many (installed), Install, Delete Installed, Get Certificate Info, Get Vhost Components, List Certificates, Generate Self-Signed, Run AutoSSL (user / all), Get / Set AutoSSL Provider |
+| **Backup** | Get / Set Configuration, Get Backup Dates, Get Backup Users, Get User Backup Sets, Restore Account, Restore From Archive, Toggle User Backups, Skip All Users, Get Skip-All Status |
+| **API Token** | Get Many, Create, Update, Revoke |
+| **cPanel Email** | Get Many, Create, Delete, Change Password, Get / Set Quota, Suspend / Unsuspend Login, Get / Add / Delete Forwarders, Get Mail Domains |
+| **cPanel Database** | Get Many, Create, Delete, Rename, Get Users, Create / Delete User, Set User Password, Get / Set Privileges, Add / Delete Remote Host |
+| **cPanel Domain** | Get Many, Get Domain Data, Add / Delete Addon Domain, Add / Delete Subdomain, Add / Delete Alias (parked) |
+| **cPanel FTP** | Get Many, Create, Delete, Change Password, Set Quota, Set Home Directory |
+| **cPanel Function** | Execute any UAPI or API 2 function as a cPanel user |
+| **Custom WHM Call** | Execute any WHM API 1 function |
+
+Every operation also has a **Custom Parameters** list for parameters that are not
+exposed as fields, and an **Options → Raw Response** switch that returns the
+complete API envelope. *Get Many* operations support **Return All / Limit** and, for
+WHM API 1 functions, server-side **Filters** and **Sort** (`api.filter.*`, `api.sort.*`).
+
+## Trigger setup (optional)
+
+cPanel & WHM has no outbound webhooks; it has *Standardized Hooks* that run a script
+when something happens. The package ships that script.
+
+1. Add a **WHM Trigger** node, pick the events, set a **Shared Secret**, and copy the
+   **Production URL**.
+2. Copy the `bridge/` folder to the WHM server and run, as root:
+   ```bash
+   ./n8n-whm-hooks.sh install --url https://n8n.example.com/webhook/<id>/whm --secret '<same secret>'
+   ```
+   This installs `/opt/n8n-whm-hook-bridge/n8n-whm-hook-bridge.pl`, writes
+   `/etc/n8n-whm-hook-bridge.conf` (root-only) and registers a default set of events
+   with `manage_hooks`.
+3. Register extra events with `./n8n-whm-hooks.sh add <Category> <Event> [pre|post]`,
+   e.g. `./n8n-whm-hooks.sh add Cpanel UAPI::Email::passwd_pop post`. Add the same
+   name to the node's **Custom Events** if it is not in the list.
+
+The bridge reads the hook's JSON from STDIN, redacts password fields, signs the body
+with HMAC-SHA256 (`X-WHM-Signature`) and POSTs it to n8n with a short timeout. It
+**always** reports success to cPanel, so an unreachable n8n never blocks account
+creation or any other WHM action. Delivery failures are logged to
+`/usr/local/cpanel/logs/n8n-whm-hook-bridge.log`.
+
+## Quick examples
+
+*Create a hosting account when an order comes in:*
+
+- Resource **Account** → Operation **Create**
+- Username `{{ $json.username }}`, Domain `{{ $json.domain }}`
+- Additional Fields → Package `starter`, Contact Email `{{ $json.email }}`
+
+*List every suspended account owned by reseller `acme`:*
+
+- Resource **Account** → **Get Many**
+- Filters → Search Type `Owner`, Search `^acme$`
+- List Options → Filters → Field `suspended`, Type `Equals`, Value `1`
+
+*Add a mailbox on a customer's account:*
+
+- Resource **cPanel Email** → **Create**
+- cPanel Username `examplecom`, Email Address `support@example.com`, Password …
+
+## Security
+
+- **Use API tokens, not passwords**, and restrict their ACLs. A root token can do
+  anything on the server; a reseller token can only touch that reseller's accounts.
+- **Always set a Shared Secret on the WHM Trigger.** Without it the webhook is
+  unauthenticated and anyone who discovers the URL can inject fake events. The node
+  verifies an HMAC-SHA256 signature over the raw body in constant time.
+- **Hook payloads can contain passwords** (account creation, password changes). The
+  bridge redacts common password keys before the event leaves the server; extend the
+  `redact` list in the config if you register other events.
+- **Use HTTPS end to end.** Point the bridge at an `https://` n8n URL and keep
+  *Ignore SSL Issues* off once WHM has a valid certificate.
+- **Credentials** are stored in n8n's encrypted credential store, injected per request
+  as an `Authorization` header, and redacted from error output by the node.
+
+## Disclaimer
+
+This is an unofficial, community-maintained project. It is **not affiliated with,
+endorsed by, or sponsored by cPanel, L.L.C. or WebPros**. "cPanel" and "WHM" are
+trademarks of cPanel, L.L.C. and are used here only to describe API compatibility. This
+package contains **no cPanel source code** — it communicates with WHM solely through
+its public, documented APIs and hook system. The software is provided "as is", without
+warranty of any kind (see [LICENSE](LICENSE.md)).
+
+## License
+
+[MIT](LICENSE.md) © Anthony Tuberville

package/bridge/n8n-whm-hook-bridge.conf.example

@@ -0,0 +1,22 @@
+# n8n hook bridge configuration
+# Copy to /etc/n8n-whm-hook-bridge.conf on the WHM server and chmod 600.
+
+# Production URL of the WHM Trigger node (required)
+webhook_url = https://n8n.example.com/webhook/REPLACE-ME/whm
+
+# Shared secret — must match the WHM Trigger node's "Shared Secret" field.
+# Every request is signed with HMAC-SHA256 over the JSON body (X-WHM-Signature).
+secret      = change-me-to-a-long-random-string
+
+# HTTP timeout in seconds. Keep it short: hooks run inline with the WHM action.
+timeout     = 5
+
+# Set to 1 to skip TLS certificate verification (only for trusted internal n8n hosts)
+insecure    = 0
+
+# Keys whose values are replaced with ***redacted*** before the event leaves the
+# server. Account-creation and password-change hooks carry plaintext passwords.
+redact      = pass,password,passwd,pass1,pass2,key,db_pass,rawpass,newpass,oldpass
+
+# Delivery failures are appended here (set empty to disable)
+log         = /usr/local/cpanel/logs/n8n-whm-hook-bridge.log

package/bridge/n8n-whm-hook-bridge.pl

@@ -0,0 +1,188 @@
+#!/usr/local/cpanel/3rdparty/bin/perl
+# ---------------------------------------------------------------------------
+# n8n hook bridge for cPanel & WHM
+# ---------------------------------------------------------------------------
+# A cPanel *Standardized Hooks* script that forwards hook events to an n8n
+# "WHM Trigger" webhook.
+#
+# cPanel runs this script at each registered hook point and passes the event
+# as a single JSON document on STDIN:
+#
+#   { "context": {...}, "data": {...}, "hook": { "category", "event", "stage", ... } }
+#
+# The script POSTs the event to n8n as JSON, signed with HMAC-SHA256 using the
+# shared secret, and ALWAYS reports success back to cPanel so that a slow or
+# unreachable n8n can never block account creation or any other action.
+#
+# Configuration lives in /etc/n8n-whm-hook-bridge.conf (key = value):
+#
+#   webhook_url = https://n8n.example.com/webhook/<id>/whm   (required)
+#   secret      = long-random-string                          (recommended)
+#   timeout     = 5                                           (seconds)
+#   insecure    = 0                                           (1 = skip TLS verify)
+#   redact      = pass,password,passwd,pass1,pass2,key,db_pass,rawpass
+#   log         = /usr/local/cpanel/logs/n8n-whm-hook-bridge.log
+#
+# Register it with the bundled n8n-whm-hooks.sh, or by hand:
+#   /usr/local/cpanel/bin/manage_hooks add script /opt/n8n-whm-hook-bridge/n8n-whm-hook-bridge.pl \
+#       --manual --category Whostmgr --event Accounts::Create --stage post
+# ---------------------------------------------------------------------------
+use strict;
+use warnings;
+
+use JSON::PP    ();
+use HTTP::Tiny  ();
+use Digest::SHA qw(hmac_sha256_hex);
+use Sys::Hostname qw(hostname);
+use POSIX qw(strftime);
+
+my $CONFIG_FILE = $ENV{N8N_WHM_BRIDGE_CONF} || '/etc/n8n-whm-hook-bridge.conf';
+
+# ---- configuration --------------------------------------------------------
+my %cfg = (
+    webhook_url => '',
+    secret      => '',
+    timeout     => 5,
+    insecure    => 0,
+    redact      => 'pass,password,passwd,pass1,pass2,key,db_pass,rawpass,newpass,oldpass',
+    log         => '/usr/local/cpanel/logs/n8n-whm-hook-bridge.log',
+);
+
+if ( open my $fh, '<', $CONFIG_FILE ) {
+    while ( my $line = <$fh> ) {
+        chomp $line;
+        next if $line =~ /^\s*(#|$)/;
+        my ( $k, $v ) = $line =~ /^\s*([A-Za-z_]+)\s*=\s*(.*?)\s*$/ or next;
+        $v =~ s/^(['"])(.*)\1$/$2/;
+        $cfg{ lc $k } = $v;
+    }
+    close $fh;
+}
+
+sub logmsg {
+    my ($msg) = @_;
+    return unless $cfg{log};
+    if ( open my $lf, '>>', $cfg{log} ) {
+        print {$lf} strftime( '%Y-%m-%d %H:%M:%S', localtime ), " [$$] $msg\n";
+        close $lf;
+    }
+    return;
+}
+
+# Never block cPanel: every exit path prints a success line to STDOUT.
+sub finish {
+    my ($msg) = @_;
+    print "1 n8n bridge: $msg\n";
+    exit 0;
+}
+
+# ---- read the hook payload --------------------------------------------------
+my $raw = do { local $/; <STDIN> };
+$raw = '' unless defined $raw;
+$raw =~ s/^\s+|\s+$//g;
+
+my $input;
+if ( length $raw ) {
+    $input = eval { JSON::PP->new->utf8->decode($raw) };
+    if ( !$input || ref $input ne 'HASH' ) {
+        logmsg("could not decode hook input: " . ( $@ || 'not a JSON object' ));
+        finish('invalid input ignored');
+    }
+}
+else {
+    $input = { context => {}, data => {}, hook => {} };
+}
+
+unless ( $cfg{webhook_url} && $cfg{webhook_url} =~ m{^https?://}i ) {
+    logmsg("webhook_url is not configured in $CONFIG_FILE");
+    finish('not configured');
+}
+
+# ---- build the event ----------------------------------------------------------
+my $hook     = ref $input->{hook} eq 'HASH' ? $input->{hook} : {};
+my $category = $hook->{category} // $ENV{HOOK_CATEGORY} // '';
+my $event    = $hook->{event}    // $ENV{HOOK_EVENT}    // '';
+my $stage    = $hook->{stage}    // $ENV{HOOK_STAGE}    // '';
+
+my %redact = map { lc($_) => 1 } grep { length } split /\s*,\s*/, $cfg{redact};
+
+sub scrub {
+    my ($node) = @_;
+    if ( ref $node eq 'HASH' ) {
+        for my $k ( keys %$node ) {
+            if ( $redact{ lc $k } ) { $node->{$k} = '***redacted***'; }
+            else                    { scrub( $node->{$k} ); }
+        }
+    }
+    elsif ( ref $node eq 'ARRAY' ) {
+        scrub($_) for @$node;
+    }
+    return;
+}
+scrub( $input->{data} );
+scrub( $input->{context} );
+
+my $payload = {
+    event      => join( '::', grep { length } $category, $event ),
+    category   => $category,
+    name       => $event,
+    stage      => $stage,
+    hook       => $hook,
+    context    => $input->{context} // {},
+    data       => $input->{data}    // {},
+    hostname   => hostname(),
+    timestamp  => strftime( '%Y-%m-%dT%H:%M:%S%z', localtime ),
+};
+
+my $body = JSON::PP->new->utf8->canonical->encode($payload);
+
+my %headers = (
+    'Content-Type' => 'application/json',
+    'User-Agent'   => 'n8n-whm-hook-bridge/1.0',
+    'X-WHM-Event'  => $payload->{event},
+);
+if ( length $cfg{secret} ) {
+    $headers{'X-WHM-Signature'} = 'sha256=' . hmac_sha256_hex( $body, $cfg{secret} );
+}
+
+# ---- deliver ----------------------------------------------------------------------
+my $timeout = ( $cfg{timeout} || 5 ) + 0;
+my $ok      = 0;
+my $detail  = '';
+
+if ( HTTP::Tiny->can_ssl || $cfg{webhook_url} =~ m{^http://}i ) {
+    my $http = HTTP::Tiny->new(
+        timeout    => $timeout,
+        verify_SSL => $cfg{insecure} ? 0 : 1,
+        agent      => 'n8n-whm-hook-bridge/1.0',
+    );
+    my $res = $http->post( $cfg{webhook_url}, { headers => \%headers, content => $body } );
+    $ok     = $res->{success} ? 1 : 0;
+    $detail = "$res->{status} $res->{reason}";
+    $detail .= ": $res->{content}" if $res->{status} == 599 && defined $res->{content};
+}
+else {
+    # Fallback for a Perl without SSL support: shell out to curl.
+    my @cmd = ( 'curl', '-sS', '-o', '/dev/null', '-w', '%{http_code}', '--max-time', $timeout, '-X', 'POST' );
+    push @cmd, '-k' if $cfg{insecure};
+    push @cmd, '-H', "$_: $headers{$_}" for keys %headers;
+    push @cmd, '--data-binary', '@-', $cfg{webhook_url};
+    if ( open my $curl, '|-', @cmd ) {    # STDIN of curl
+        print {$curl} $body;
+        close $curl;
+        $ok     = ( $? == 0 ) ? 1 : 0;
+        $detail = "curl exit " . ( $? >> 8 );
+    }
+    else {
+        $detail = "could not run curl: $!";
+    }
+}
+
+if ($ok) {
+    logmsg("forwarded $payload->{event} ($stage) -> $cfg{webhook_url}") if $ENV{N8N_WHM_BRIDGE_DEBUG};
+    finish("forwarded $payload->{event}");
+}
+else {
+    logmsg("FAILED to forward $payload->{event} ($stage): $detail");
+    finish("delivery failed ($detail), ignored");
+}

package/bridge/n8n-whm-hooks.sh

@@ -0,0 +1,152 @@
+#!/bin/bash
+# ---------------------------------------------------------------------------
+# n8n-whm-hooks.sh — install / register / remove the n8n hook bridge on a
+# cPanel & WHM server. Run as root ON THE WHM SERVER.
+#
+#   ./n8n-whm-hooks.sh install [--url URL] [--secret SECRET]
+#         Copies the bridge to /opt/n8n-whm-hook-bridge, writes the config
+#         (if missing) and registers the DEFAULT_EVENTS below.
+#   ./n8n-whm-hooks.sh add    <Category> <Event> [pre|post]
+#   ./n8n-whm-hooks.sh remove <Category> <Event> [pre|post]
+#   ./n8n-whm-hooks.sh list            Show every hook registered on the server
+#   ./n8n-whm-hooks.sh uninstall       Deregister all bridge hooks, keep files
+#
+# Category::Event names are the ones from the cPanel "Guide to Standardized
+# Hooks". For the Cpanel category the bridge is registered with
+# --escalateprivs 1 so it runs as root and can read the config file.
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+INSTALL_DIR="/opt/n8n-whm-hook-bridge"
+SCRIPT_NAME="n8n-whm-hook-bridge.pl"
+SCRIPT_PATH="$INSTALL_DIR/$SCRIPT_NAME"
+CONF_PATH="/etc/n8n-whm-hook-bridge.conf"
+MANAGE_HOOKS="/usr/local/cpanel/bin/manage_hooks"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Events registered by "install". Format: Category|Event|stage
+DEFAULT_EVENTS=(
+  "Whostmgr|Accounts::Create|post"
+  "Whostmgr|Accounts::Remove|post"
+  "Whostmgr|Accounts::Modify|post"
+  "Whostmgr|Accounts::change_package|post"
+  "Whostmgr|Accounts::suspendacct|post"
+  "Whostmgr|Accounts::unsuspendacct|post"
+  "Whostmgr|Domain::park|post"
+  "Whostmgr|Domain::unpark|post"
+  "Passwd|ChangePasswd|post"
+  "Cpanel|UAPI::Email::add_pop|post"
+  "Cpanel|UAPI::Email::delete_pop|post"
+  "Cpanel|Api2::AddonDomain::addaddondomain|post"
+  "Cpanel|Api2::AddonDomain::deladdondomain|post"
+  "Cpanel|Api2::SubDomain::addsubdomain|post"
+  "Cpanel|Api2::SubDomain::delsubdomain|post"
+  "Cpanel|UAPI::Mysql::create_database|post"
+  "Cpanel|UAPI::Ftp::add_ftp|post"
+)
+
+die() { echo "error: $*" >&2; exit 1; }
+
+need_root() { [[ $EUID -eq 0 ]] || die "run this script as root on the WHM server"; }
+need_manage_hooks() { [[ -x "$MANAGE_HOOKS" ]] || die "$MANAGE_HOOKS not found — is this a cPanel & WHM server?"; }
+
+hook_args() {
+  # $1 category, $2 event, $3 stage
+  local args=(--manual --category "$1" --event "$2" --stage "$3")
+  [[ "$1" == "Cpanel" ]] && args+=(--escalateprivs 1)
+  printf '%s\n' "${args[@]}"
+}
+
+add_hook() {
+  local category="$1" event="$2" stage="${3:-post}"
+  mapfile -t args < <(hook_args "$category" "$event" "$stage")
+  echo "+ registering $category::$event ($stage)"
+  "$MANAGE_HOOKS" add script "$SCRIPT_PATH" "${args[@]}"
+}
+
+remove_hook() {
+  local category="$1" event="$2" stage="${3:-post}"
+  mapfile -t args < <(hook_args "$category" "$event" "$stage")
+  echo "- removing $category::$event ($stage)"
+  "$MANAGE_HOOKS" delete script "$SCRIPT_PATH" "${args[@]}" || true
+}
+
+write_config() {
+  local url="$1" secret="$2"
+  if [[ -f "$CONF_PATH" ]]; then
+    echo "config $CONF_PATH already exists — leaving it untouched"
+    return
+  fi
+  if [[ -z "$secret" ]]; then
+    secret="$(head -c 48 /dev/urandom | base64 | tr -d '/+=' | head -c 48)"
+    echo "generated a shared secret — copy it into the WHM Trigger node's Shared Secret field:"
+    echo "    $secret"
+  fi
+  umask 077
+  cat > "$CONF_PATH" <<EOF
+# n8n hook bridge configuration — root only (mode 600)
+webhook_url = ${url:-https://YOUR-N8N-HOST/webhook/REPLACE-ME/whm}
+secret      = $secret
+timeout     = 5
+insecure    = 0
+redact      = pass,password,passwd,pass1,pass2,key,db_pass,rawpass,newpass,oldpass
+log         = /usr/local/cpanel/logs/n8n-whm-hook-bridge.log
+EOF
+  chmod 600 "$CONF_PATH"
+  echo "wrote $CONF_PATH"
+  [[ -n "$url" ]] || echo "NOTE: edit $CONF_PATH and set webhook_url to the WHM Trigger node's Production URL"
+}
+
+cmd="${1:-}"; shift || true
+case "$cmd" in
+  install)
+    need_root; need_manage_hooks
+    url=""; secret=""
+    while [[ $# -gt 0 ]]; do
+      case "$1" in
+        --url)    url="$2"; shift 2 ;;
+        --secret) secret="$2"; shift 2 ;;
+        *) die "unknown option $1" ;;
+      esac
+    done
+    [[ -f "$HERE/$SCRIPT_NAME" ]] || die "$SCRIPT_NAME not found next to this script"
+    mkdir -p "$INSTALL_DIR"
+    install -o root -g root -m 0700 "$HERE/$SCRIPT_NAME" "$SCRIPT_PATH"
+    echo "installed $SCRIPT_PATH"
+    write_config "$url" "$secret"
+    for spec in "${DEFAULT_EVENTS[@]}"; do
+      IFS='|' read -r category event stage <<< "$spec"
+      add_hook "$category" "$event" "$stage"
+    done
+    echo
+    echo "done. Test with:"
+    echo "  echo '{\"context\":{},\"data\":{\"user\":\"test\"},\"hook\":{\"category\":\"Whostmgr\",\"event\":\"Accounts::Create\",\"stage\":\"post\"}}' | $SCRIPT_PATH"
+    ;;
+  add)
+    need_root; need_manage_hooks
+    [[ $# -ge 2 ]] || die "usage: $0 add <Category> <Event> [pre|post]"
+    add_hook "$1" "$2" "${3:-post}"
+    ;;
+  remove)
+    need_root; need_manage_hooks
+    [[ $# -ge 2 ]] || die "usage: $0 remove <Category> <Event> [pre|post]"
+    remove_hook "$1" "$2" "${3:-post}"
+    ;;
+  list)
+    need_manage_hooks
+    "$MANAGE_HOOKS" list
+    ;;
+  uninstall)
+    need_root; need_manage_hooks
+    for spec in "${DEFAULT_EVENTS[@]}"; do
+      IFS='|' read -r category event stage <<< "$spec"
+      remove_hook "$category" "$event" "$stage"
+    done
+    echo "bridge hooks removed. Files in $INSTALL_DIR and $CONF_PATH were kept; delete them by hand if no longer needed."
+    echo "Hooks added with '$0 add' for events outside the default list must be removed with '$0 remove'."
+    ;;
+  *)
+    sed -n '2,20p' "$0" | sed 's/^# \{0,1\}//'
+    exit 1
+    ;;
+esac

package/dist/credentials/WhmApi.credentials.d.ts

@@ -0,0 +1,9 @@
+import type { ICredentialDataDecryptedObject, ICredentialTestRequest, ICredentialType, IHttpRequestOptions, INodeProperties } from 'n8n-workflow';
+export declare class WhmApi implements ICredentialType {
+    name: string;
+    displayName: string;
+    documentationUrl: string;
+    properties: INodeProperties[];
+    authenticate(credentials: ICredentialDataDecryptedObject, requestOptions: IHttpRequestOptions): Promise<IHttpRequestOptions>;
+    test: ICredentialTestRequest;
+}

package/dist/credentials/WhmApi.credentials.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WhmApi = void 0;
+class WhmApi {
+    constructor() {
+        this.name = 'whmApi';
+        this.displayName = 'WHM API';
+        this.documentationUrl = 'https://api.docs.cpanel.net/whm/introduction/';
+        this.properties = [
+            {
+                displayName: 'Host',
+                name: 'host',
+                type: 'string',
+                default: '',
+                placeholder: 'server.example.com',
+                required: true,
+                description: 'Hostname or IP address of the WHM server, without a scheme or port. The node builds the URL from Host, Port and Use SSL.',
+            },
+            {
+                displayName: 'Port',
+                name: 'port',
+                type: 'number',
+                default: 2087,
+                required: true,
+                description: 'WHM listens on 2087 for HTTPS and 2086 for plain HTTP',
+            },
+            {
+                displayName: 'Use SSL',
+                name: 'useSsl',
+                type: 'boolean',
+                default: true,
+                description: 'Whether to connect over HTTPS. Turn this off only for port 2086 on a trusted private network — credentials are sent with every request.',
+            },
+            {
+                displayName: 'Username',
+                name: 'username',
+                type: 'string',
+                default: 'root',
+                required: true,
+                description: 'The WHM user the token or password belongs to — root or a reseller username',
+            },
+            {
+                displayName: 'Authentication',
+                name: 'authMethod',
+                type: 'options',
+                default: 'apiToken',
+                options: [
+                    { name: 'API Token', value: 'apiToken', description: 'Recommended. Created in WHM under Development » Manage API Tokens.' },
+                    { name: 'Password', value: 'password', description: 'HTTP Basic authentication with the WHM account password' },
+                ],
+            },
+            {
+                displayName: 'API Token',
+                name: 'apiToken',
+                type: 'string',
+                typeOptions: { password: true },
+                default: '',
+                displayOptions: { show: { authMethod: ['apiToken'] } },
+                description: 'The token generated in WHM. Restrict its privileges to the ACLs your workflows need.',
+            },
+            {
+                displayName: 'Password',
+                name: 'password',
+                type: 'string',
+                typeOptions: { password: true },
+                default: '',
+                displayOptions: { show: { authMethod: ['password'] } },
+            },
+            {
+                displayName: 'Ignore SSL Issues',
+                name: 'allowUnauthorizedCerts',
+                type: 'boolean',
+                default: false,
+                description: 'Whether to connect even if SSL certificate validation fails. WHM ships with a self-signed certificate by default, so this is often needed for servers that have not installed a trusted certificate on the hostname.',
+            },
+        ];
+        this.test = {
+            request: {
+                baseURL: '={{ ($credentials.useSsl ? "https" : "http") + "://" + $credentials.host.replace(/^https?:\\/\\//, "").replace(/\\/.*$/, "") + ":" + $credentials.port }}',
+                url: '/json-api/version',
+                method: 'GET',
+                qs: { 'api.version': 1 },
+                skipSslCertificateValidation: '={{ $credentials.allowUnauthorizedCerts }}',
+            },
+        };
+    }
+    async authenticate(credentials, requestOptions) {
+        var _a, _b, _c;
+        const username = String((_a = credentials.username) !== null && _a !== void 0 ? _a : 'root').trim();
+        let authorization;
+        if (credentials.authMethod === 'password') {
+            const basic = Buffer.from(`${username}:${(_b = credentials.password) !== null && _b !== void 0 ? _b : ''}`, 'utf8').toString('base64');
+            authorization = `Basic ${basic}`;
+        }
+        else {
+            authorization = `whm ${username}:${String((_c = credentials.apiToken) !== null && _c !== void 0 ? _c : '').trim()}`;
+        }
+        requestOptions.headers = {
+            ...requestOptions.headers,
+            Authorization: authorization,
+        };
+        return requestOptions;
+    }
+}
+exports.WhmApi = WhmApi;
+//# sourceMappingURL=WhmApi.credentials.js.map

package/dist/credentials/WhmApi.credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WhmApi.credentials.js","sourceRoot":"","sources":["../../credentials/WhmApi.credentials.ts"],"names":[],"mappings":";;;AAsBA,MAAa,MAAM;IAAnB;QACC,SAAI,GAAG,QAAQ,CAAC;QAEhB,gBAAW,GAAG,SAAS,CAAC;QAExB,qBAAgB,GAAG,+CAA+C,CAAC;QAEnE,eAAU,GAAsB;YAC/B;gBACC,WAAW,EAAE,MAAM;gBACnB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,EAAE;gBACX,WAAW,EAAE,oBAAoB;gBACjC,QAAQ,EAAE,IAAI;gBACd,WAAW,EACV,0HAA0H;aAC3H;YACD;gBACC,WAAW,EAAE,MAAM;gBACnB,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,uDAAuD;aACpE;YACD;gBACC,WAAW,EAAE,SAAS;gBACtB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI;gBACb,WAAW,EACV,yIAAyI;aAC1I;YACD;gBACC,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE,6EAA6E;aAC1F;YACD;gBACC,WAAW,EAAE,gBAAgB;gBAC7B,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,UAAU;gBACnB,OAAO,EAAE;oBACR,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,oEAAoE,EAAE;oBAC3H,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yDAAyD,EAAE;iBAC/G;aACD;YACD;gBACC,WAAW,EAAE,WAAW;gBACxB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC/B,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE;gBACtD,WAAW,EAAE,sFAAsF;aACnG;YACD;gBACC,WAAW,EAAE,UAAU;gBACvB,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC/B,OAAO,EAAE,EAAE;gBACX,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE;aACtD;YACD;gBACC,WAAW,EAAE,mBAAmB;gBAChC,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,KAAK;gBACd,WAAW,EACV,sNAAsN;aACvN;SACD,CAAC;QA6BF,SAAI,GAA2B;YAC9B,OAAO,EAAE;gBACR,OAAO,EAAE,2JAA2J;gBACpK,GAAG,EAAE,mBAAmB;gBACxB,MAAM,EAAE,KAAK;gBACb,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;gBACxB,4BAA4B,EAAE,4CAA4C;aAC1E;SACD,CAAC;IACH,CAAC;IAnCA,KAAK,CAAC,YAAY,CACjB,WAA2C,EAC3C,cAAmC;;QAEnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAA,WAAW,CAAC,QAAQ,mCAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,aAAqB,CAAC;QAE1B,IAAI,WAAW,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,MAAA,WAAW,CAAC,QAAQ,mCAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClG,aAAa,GAAG,SAAS,KAAK,EAAE,CAAC;QAClC,CAAC;aAAM,CAAC;YACP,aAAa,GAAG,OAAO,QAAQ,IAAI,MAAM,CAAC,MAAA,WAAW,CAAC,QAAQ,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChF,CAAC;QAED,cAAc,CAAC,OAAO,GAAG;YACxB,GAAG,cAAc,CAAC,OAAO;YACzB,aAAa,EAAE,aAAa;SAC5B,CAAC;QACF,OAAO,cAAc,CAAC;IACvB,CAAC;CAgBD;AAnHD,wBAmHC"}