nukebase 0.0.0-stage → 2.0.0

package/lib/project.js

@@ -0,0 +1,125 @@
+// A project folder: finding it, its sys/config.json, and moving sign-ins left
+// there by the old per-project CLI into ~/.nukebase.
+//
+// sys/config.json now holds only non-secret settings: API, uid (which account
+// owns the project), project, account (that account's email or username, for
+// messages), and the exclude/backup/updateExclude/streams settings.
+
+const fs = require('fs');
+const path = require('path');
+const creds = require('./credentials');
+const login = require('./login');
+
+const DEFAULT_EXCLUDE = ['sys', '.env', 'server/data', 'server/backup', 'server/files'];
+const DEFAULT_BACKUP = ['server/data', 'server/files'];
+const SECRET_FIELDS = ['token', 'password', 'username', 'email', 'privateKey'];
+
+function findProject(dir) {
+  while (dir !== path.dirname(dir)) {
+    if (fs.existsSync(path.join(dir, 'sys', 'config.json'))) return dir;
+    dir = path.dirname(dir);
+  }
+  return null;
+}
+
+function configPathOf(root) {
+  return path.join(root, 'sys', 'config.json');
+}
+
+function readConfig(root) {
+  return JSON.parse(fs.readFileSync(configPathOf(root), 'utf8'));
+}
+
+function writeConfig(root, config) {
+  fs.mkdirSync(path.join(root, 'sys'), { recursive: true });
+  fs.writeFileSync(configPathOf(root), JSON.stringify(config, null, 2) + '\n');
+}
+
+// The settings a freshly linked or created project gets.
+function newConfig({ api, uid, project, account }, base = {}) {
+  const out = {
+    API: api, uid, project, account,
+    exclude: base.exclude || DEFAULT_EXCLUDE,
+    backup: base.backup || DEFAULT_BACKUP,
+    updateExclude: base.updateExclude || [],
+    streams: base.streams || 4
+  };
+  for (const [k, v] of Object.entries(base)) if (!(k in out) && !SECRET_FIELDS.includes(k)) out[k] = v;
+  return out;
+}
+
+function sessionFiles(root) {
+  const dir = path.join(root, 'sys');
+  try {
+    return fs.readdirSync(dir).filter(f => f.startsWith('.session-') && f.endsWith('.json')).map(f => path.join(dir, f));
+  } catch { return []; }
+}
+
+// Errors that mean "try again later" rather than "this sign-in is dead": a
+// server without CLI sign-in yet, or no connection. The old sign-in is kept
+// and used as before until the move can happen.
+const isOldServer = (e) => /doesn't support CLI sign-in|Could not reach/.test(e.message);
+
+// Move a project's old sign-in into ~/.nukebase, then strip it from
+// sys/config.json. Returns the config to use.
+// On a server without CLI sign-in yet, nothing changes and `legacy` is true:
+// the caller then uses the token from sys/config.json as before.
+async function migrateLegacy(root, config) {
+  const hasSecrets = SECRET_FIELDS.some(f => config[f]);
+  const sessions = sessionFiles(root);
+  if (!hasSecrets && !sessions.length) return { config, legacy: false };
+
+  const api = config.API;
+  const label = config.email || config.username || null;
+  let legacy = false;
+
+  if (config.uid && !creds.get(config.uid) && (config.token || (config.username && config.password))) {
+    let out = null;
+    if (config.token) {
+      try { out = await login.exchange(api, config.uid, config.token); }
+      catch (e) { if (isOldServer(e)) legacy = true; }
+    }
+    if (!out && !legacy && config.username && config.password) {
+      try { out = await login.password(api, config.username, config.password); }
+      catch (e) { if (isOldServer(e)) legacy = true; }
+    }
+    if (out) {
+      creds.put(out.uid, { label: out.label || label, api, token: out.token, method: 'migrated', created: Date.now() });
+      console.log(`🔑 Moved this project's sign-in (${out.label || label}) to ${creds.FILE}`);
+    }
+  }
+  if (legacy) return { config, legacy: true };
+
+  for (const file of sessions) {
+    try {
+      const s = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (s.uid && s.token && !creds.get(s.uid)) {
+        const host = path.basename(file).replace(/^\.session-/, '').split('-')[0];
+        const sApi = host ? `https://${host}` : api;
+        const out = await login.exchange(sApi, s.uid, s.token);
+        creds.put(out.uid, { label: out.label || s.email, api: sApi, token: out.token, method: 'migrated', created: Date.now() });
+        console.log(`🔑 Moved the saved sign-in for ${out.label || s.email} to ${creds.FILE}`);
+      }
+      fs.unlinkSync(file);
+    } catch (e) {
+      // Keep the file to try again later; a dead session is worth nothing.
+      if (isOldServer(e)) continue;
+      try { fs.unlinkSync(file); } catch {}
+    }
+  }
+
+  if (hasSecrets) {
+    // Only the sign-in fields go; every other setting is kept as it was.
+    const clean = { ...config, account: config.account || label || undefined };
+    for (const f of SECRET_FIELDS) delete clean[f];
+    writeConfig(root, clean);
+    console.log('🔒 Removed the sign-in (token, password) from sys/config.json. Projects now hold only which account owns them.');
+    if (config.uid && !creds.get(config.uid)) {
+      console.log(`   This project's account isn't signed in on this machine. Run: nukebase login${label && label.includes('@') ? ` --email ${label}` : ''}`);
+    }
+    return { config: clean, legacy: false };
+  }
+  return { config, legacy: false };
+}
+
+module.exports = { findProject, configPathOf, readConfig, writeConfig, newConfig, migrateLegacy, DEFAULT_EXCLUDE, DEFAULT_BACKUP };

package/lib/sdk.js

@@ -0,0 +1,94 @@
+// WebSocket client for the CLI: the log tail and the few reads the commands
+// make (custom domain, project node). Signs in with the account's token from
+// the credentials file; it never reads or writes any file itself.
+
+const WebSocket = require('ws');
+const crypto = require('crypto');
+
+const REQUEST_TIMEOUT_MS = 30 * 1000;
+
+function createClient(url, { uid, token } = {}) {
+  return new Promise((resolve, reject) => {
+    const pending = new Map();
+    const subscriptions = new Map();   // key -> { msg, handler }
+    let socket;
+    let first = true;
+    let closed = false;
+
+    const cookie = uid && token ? `uid=${uid}; token=${token}` : '';
+
+    // Same keying as the browser SDK: path segments stringified, so [users, 1]
+    // and [users, '1'] are one subscription, matching the server's tree.
+    const encodePath = (p) => JSON.stringify(Array.isArray(p) ? p.map(String) : (p ?? null));
+    const routeKey = (action, event, path) => JSON.stringify([action ?? null, event ?? null, encodePath(path)]);
+
+    function sendRequest(msg) {
+      return new Promise((res, rej) => {
+        if (closed) return rej(new Error('connection closed'));
+        const requestId = crypto.randomBytes(8).toString('hex');
+        msg.requestId = requestId;
+        const timer = setTimeout(() => {
+          pending.delete(requestId);
+          rej(new Error('request timed out'));
+        }, REQUEST_TIMEOUT_MS);
+        pending.set(requestId, { res, rej, timer });
+        try { socket.send(JSON.stringify(msg)); } catch (e) { clearTimeout(timer); pending.delete(requestId); rej(e); }
+      });
+    }
+
+    function failPending(err) {
+      for (const [id, p] of pending) { clearTimeout(p.timer); p.rej(err); pending.delete(id); }
+    }
+
+    function connect() {
+      socket = new WebSocket(url, cookie ? { headers: { Cookie: cookie } } : {});
+
+      socket.on('message', (data) => {
+        let msg;
+        try { msg = JSON.parse(data); } catch { return; }
+        const p = msg.requestId && pending.get(msg.requestId);
+        if (p) { clearTimeout(p.timer); pending.delete(msg.requestId); p.res(msg); return; }
+        const sub = subscriptions.get(routeKey(msg.action, msg.event, msg.path));
+        if (sub) sub.handler(msg);
+      });
+
+      socket.on('open', () => {
+        if (first) { first = false; resolve(client); return; }
+        for (const { msg } of subscriptions.values()) socket.send(JSON.stringify(msg));
+      });
+
+      socket.on('close', () => {
+        failPending(new Error('disconnected'));
+        if (closed) return;
+        if (!first) setTimeout(() => { if (!closed) connect(); }, 5000);
+      });
+
+      socket.on('error', (e) => { if (first) { closed = true; reject(e); } });
+    }
+
+    const client = {
+      get: (path) => sendRequest({ action: 'get', path }),
+
+      getSub({ event = 'value@', path }, handler) {
+        const msg = { action: 'getSub', event, path };
+        const key = routeKey(msg.action, event, path);
+        subscriptions.set(key, { msg, handler });
+        socket.send(JSON.stringify(msg));
+        return () => {
+          subscriptions.delete(key);
+          try { socket.send(JSON.stringify({ action: 'getSubStop', event, path })); } catch {}
+        };
+      },
+
+      close() {
+        closed = true;
+        failPending(new Error('connection closed'));
+        try { socket.close(); } catch {}
+      }
+    };
+
+    connect();
+  });
+}
+
+module.exports = createClient;

package/lib/ui.js

@@ -0,0 +1,91 @@
+// Terminal prompts and small helpers shared by the commands.
+
+const readline = require('readline');
+const { spawn } = require('child_process');
+
+// Projects are served from the master's region host; this is where `login`
+// and `create` go when no project or option says otherwise.
+const DEFAULT_API = (process.env.NUKEBASE_API || 'https://usw4.nukebase.com').replace(/\/$/, '');
+
+function hostOf(api) {
+  try { return new URL(api).host; } catch { return api; }
+}
+
+// `--region usw3` swaps the first host label: usw4.nukebase.com -> usw3.nukebase.com.
+function regionApi(base, region) {
+  const u = new URL(base);
+  const labels = u.hostname.split('.');
+  labels[0] = region;
+  u.hostname = labels.join('.');
+  return u.origin;
+}
+
+function apiFor(args, base) {
+  if (args.get('api')) return args.get('api').replace(/\/$/, '');
+  if (args.get('region')) return regionApi(base || DEFAULT_API, args.get('region'));
+  return (base || DEFAULT_API).replace(/\/$/, '');
+}
+
+function makeConfirm(autoYes) {
+  return function confirm(question) {
+    if (autoYes) {
+      console.log(question + 'y  ▶ auto-confirmed (--yes)');
+      return Promise.resolve(true);
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise(resolve => {
+      let answered = false;
+      rl.question(question, answer => { answered = true; rl.close(); resolve(answer.trim().toLowerCase() === 'y'); });
+      // EOF with no answer (piped, no terminal): abort rather than hang.
+      rl.on('close', () => { if (!answered) resolve(false); });
+    });
+  };
+}
+
+// One line of free text. Empty under --yes or without a terminal, so callers
+// fall back to their default.
+function makeAskLine(autoYes) {
+  return function askLine(question) {
+    if (autoYes || !process.stdin.isTTY) return Promise.resolve('');
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise(resolve => {
+      let answered = false;
+      rl.question(question, answer => { answered = true; rl.close(); resolve(answer); });
+      rl.on('close', () => { if (!answered) resolve(''); });
+    });
+  };
+}
+
+// A password prompt that doesn't echo what is typed.
+function askHidden(question) {
+  if (!process.stdin.isTTY) return Promise.resolve('');
+  return new Promise(resolve => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    let muted = false;
+    rl._writeToOutput = (s) => { if (!muted) rl.output.write(s); };
+    rl.question(question, answer => { rl.output.write('\n'); rl.close(); resolve(answer); });
+    muted = true;
+  });
+}
+
+// Open a URL in the default browser. Best effort: the URL is always printed
+// too, for SSH sessions and machines without one.
+function openBrowser(url) {
+  if (process.env.NUKEBASE_NO_BROWSER) return;
+  try {
+    let child;
+    if (process.platform === 'win32') {
+      // rundll32 takes the URL as one argument, so & in the query survives
+      // (cmd /c start would split on it).
+      child = spawn('rundll32', ['url.dll,FileProtocolHandler', url], { stdio: 'ignore', detached: true });
+    } else if (process.platform === 'darwin') {
+      child = spawn('open', [url], { stdio: 'ignore', detached: true });
+    } else {
+      child = spawn('xdg-open', [url], { stdio: 'ignore', detached: true });
+    }
+    child.on('error', () => {});
+    child.unref();
+  } catch {}
+}
+
+module.exports = { DEFAULT_API, hostOf, regionApi, apiFor, makeConfirm, makeAskLine, askHidden, openBrowser };

package/lib/unzip.js

@@ -0,0 +1,97 @@
+// Extract the project ZIP that /project streams back, without a dependency.
+//
+// Reads the central directory (always at the end, with real sizes even when
+// the archive was written as a stream) and supports the two methods Info-ZIP
+// writes: stored (0) and deflate (8). Zip64 sizes are read from the extra
+// field. Every entry must land inside `dest`; links are not created.
+
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+
+function findEndOfCentralDir(buf) {
+  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 65557); i--) {
+    if (buf.readUInt32LE(i) === 0x06054b50) return i;
+  }
+  throw new Error('Not a ZIP file (no end-of-central-directory record)');
+}
+
+function zip64Values(extra, wanted) {
+  // wanted: which of [uncompressed, compressed, localOffset] were 0xFFFFFFFF
+  let p = 0;
+  while (p + 4 <= extra.length) {
+    const id = extra.readUInt16LE(p);
+    const size = extra.readUInt16LE(p + 2);
+    if (id === 0x0001) {
+      const out = {};
+      let q = p + 4;
+      for (const name of wanted) { out[name] = Number(extra.readBigUInt64LE(q)); q += 8; }
+      return out;
+    }
+    p += 4 + size;
+  }
+  return {};
+}
+
+function extract(buf, dest) {
+  const root = path.resolve(dest);
+  const eocd = findEndOfCentralDir(buf);
+  let count = buf.readUInt16LE(eocd + 10);
+  let cdOffset = buf.readUInt32LE(eocd + 16);
+  if (cdOffset === 0xFFFFFFFF || count === 0xFFFF) {
+    // Zip64 end-of-central-directory locator sits just before the EOCD.
+    const loc = eocd - 20;
+    if (loc >= 0 && buf.readUInt32LE(loc) === 0x07064b50) {
+      const z64 = Number(buf.readBigUInt64LE(loc + 8));
+      count = Number(buf.readBigUInt64LE(z64 + 32));
+      cdOffset = Number(buf.readBigUInt64LE(z64 + 48));
+    }
+  }
+
+  let p = cdOffset;
+  let files = 0;
+  for (let n = 0; n < count; n++) {
+    if (buf.readUInt32LE(p) !== 0x02014b50) throw new Error('Corrupt ZIP (central directory)');
+    const method = buf.readUInt16LE(p + 10);
+    let compSize = buf.readUInt32LE(p + 20);
+    let size = buf.readUInt32LE(p + 24);
+    const nameLen = buf.readUInt16LE(p + 28);
+    const extraLen = buf.readUInt16LE(p + 30);
+    const commentLen = buf.readUInt16LE(p + 32);
+    const externalAttr = buf.readUInt32LE(p + 38);
+    let localOffset = buf.readUInt32LE(p + 42);
+    const name = buf.toString('utf8', p + 46, p + 46 + nameLen);
+    const extra = buf.subarray(p + 46 + nameLen, p + 46 + nameLen + extraLen);
+    const wanted = [];
+    if (size === 0xFFFFFFFF) wanted.push('size');
+    if (compSize === 0xFFFFFFFF) wanted.push('compSize');
+    if (localOffset === 0xFFFFFFFF) wanted.push('localOffset');
+    if (wanted.length) ({ size = size, compSize = compSize, localOffset = localOffset } = zip64Values(extra, wanted));
+    p += 46 + nameLen + extraLen + commentLen;
+
+    const target = path.resolve(root, name);
+    if (target !== root && !target.startsWith(root + path.sep)) throw new Error(`ZIP entry outside the project: ${name}`);
+    const unixMode = externalAttr >>> 16;
+    if ((unixMode & 0o170000) === 0o120000) continue;   // symlink: skipped
+    if (name.endsWith('/')) { fs.mkdirSync(target, { recursive: true }); continue; }
+
+    if (buf.readUInt32LE(localOffset) !== 0x04034b50) throw new Error(`Corrupt ZIP (local header for ${name})`);
+    const dataStart = localOffset + 30 + buf.readUInt16LE(localOffset + 26) + buf.readUInt16LE(localOffset + 28);
+    const raw = buf.subarray(dataStart, dataStart + compSize);
+    let data;
+    if (method === 0) data = raw;
+    else if (method === 8) data = zlib.inflateRawSync(raw);
+    else throw new Error(`Unsupported ZIP compression (method ${method}) for ${name}`);
+    if (data.length !== size) throw new Error(`Corrupt ZIP (size mismatch for ${name})`);
+
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.writeFileSync(target, data);
+    if (process.platform !== 'win32' && (unixMode & 0o111)) {
+      try { fs.chmodSync(target, unixMode & 0o777); } catch {}
+    }
+    files++;
+  }
+  return files;
+}
+
+module.exports = { extract };

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "nukebase",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0",
+  "description": "NukeBase CLI: create, deploy and manage NukeBase projects",
+  "bin": {
+    "nukebase": "bin/nukebase.js"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "tar": "^7.5.15",
+    "ws": "^8.20.0"
+  },
+  "homepage": "https://nukebase.com",
+  "keywords": ["nukebase", "database", "realtime", "hosting", "cli", "deploy"],
+  "license": "MIT"
+}