Publish buildable Free Core source

.github/workflows/repo-checks.yml

@@ -9,11 +9,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Shell syntax
         run: bash -n install.sh
 
+      - name: Node setup
+        uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: core/api/package-lock.json
+
+      - name: Core API setup
+        working-directory: core/api
+        run: npm ci
+
+      - name: Core API checks
+        working-directory: core/api
+        run: |
+          npm run lint
+          npm test
+          npm run build
+
       - name: Markdown relative links
         run: |
           python3 - <<'PY'
@@ -25,7 +43,7 @@ jobs:
           missing = []
 
           for path in root.rglob("*.md"):
-              if ".git" in path.parts:
+              if any(part in {".git", "node_modules", "dist"} for part in path.parts):
                   continue
               text = path.read_text(encoding="utf-8", errors="replace")
               for match in link_re.finditer(text):

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Notable public repository updates are tracked here. Production release bundles remain controlled by FreeWebPanel.com.
 
+## 2026-07-10
+
+- Published the first buildable Free Core control-plane source under `core/api`.
+- Added production-clean state initialization with no demo customers or fake billing records.
+- Added scrypt owner authentication, hashed sessions, atomic mode-`0600` state, login throttling, account creation, strict domain validation, and constrained site-root provisioning.
+- Added Core API lint, tests, and build checks to GitHub Actions.
+- Documented the exact public/private boundary instead of implying that private Pro or production assets are open source.
+
 ## 2026-07-04
 
 - Added Softaculous bridge documentation for provider-owned Remote and custom-panel integrations.

README.md

@@ -12,7 +12,9 @@
 
 **FreeWebPanel Free Core** is the public entry point for a real Linux hosting business: install on a clean Ubuntu server, create hosting accounts, publish websites, manage mail, SQL, files, domains, SSL, security, backups, updates, and customer workspaces, then grow into official Pro or support when the server starts earning.
 
-This GitHub repository is the public front door for installs, documentation, videos, and safe project discovery. The official release bundle, update channel, Pro licensing, paid support, commercial response, and protected runtime assets are served from [freewebpanel.com](https://freewebpanel.com/).
+This GitHub repository now includes the first buildable [Free Core control-plane source](core/README.md), alongside installs, documentation, videos, and safe project discovery. The official release bundle, update channel, Pro licensing, paid support, commercial response, and protected runtime assets are served from [freewebpanel.com](https://freewebpanel.com/).
+
+The source boundary is deliberate: public Core code is testable here, while Pro automation, payment settlement, signing keys, customer data, private themes, and production inventory remain outside the repository.
 
 ## Why FreeWebPanel Exists
 
@@ -60,6 +62,7 @@ FreeWebPanel is designed to be found by people searching for a free hosting cont
 
 ## Public Docs
 
+- [Buildable Free Core source](core/README.md)
 - [Install guide](docs/INSTALL.md)
 - [Downloads, releases, and updates](docs/DOWNLOADS_AND_RELEASES.md)
 - [Feature map](docs/FEATURE_MAP.md)
@@ -89,6 +92,17 @@ FreeWebPanel is designed to be found by people searching for a free hosting cont
 
 Feature map: [docs/FEATURE_MAP.md](docs/FEATURE_MAP.md)
 
+## Build The Public Core
+
+```bash
+cd core/api
+npm install
+npm test
+npm run build
+```
+
+The current source slice implements the unprivileged control-plane foundation: clean owner initialization, secure sessions, customer accounts, domain validation, constrained site-root creation, and auditable state. The hosted installer remains the supported route for the broader compiled panel while privileged web, mail, DNS, SQL, and certificate workers are prepared for separate public review.
+
 ## Featured Videos
 
 ### TalkToAI: Sovereignty Through ZeroThink and OpenZero Infrastructure

core/README.md

@@ -0,0 +1,43 @@
+# FreeWebPanel Core Source
+
+This directory is the public, buildable Free Core control-plane source. It is intentionally smaller than the hosted FreeWebPanel release and intentionally excludes Pro automation, payment settlement, vendor signing keys, customer data, private themes, and production deployment inventory.
+
+The first public source slice provides:
+
+- production-clean initialization with one owner and no demo customers;
+- scrypt password hashing and rate-limited owner login;
+- SHA-256 hashed bearer sessions stored in an atomic mode-`0600` state file;
+- owner-managed customer accounts;
+- strict international-domain normalization and validation;
+- site roots derived beneath one configured directory, never accepted from request input;
+- a real initial `public_html/index.html` write with restrictive permissions;
+- audit records and tests for the security boundaries above.
+
+It does not claim to publish Nginx, DNS, mail, SQL, certificate, or privileged system changes yet. Those need a separately reviewed privileged worker and will be opened in auditable slices rather than hidden behind marketing claims.
+
+## Run
+
+```bash
+cd core/api
+cp .env.example .env
+npm install
+npm test
+npm run build
+FREEWEBPANEL_OWNER_PASSWORD='use-a-long-unique-secret' npm start
+```
+
+The API binds to `127.0.0.1:4080` by default. Put it behind an authenticated HTTPS reverse proxy; do not expose the development process directly to the Internet.
+
+## Endpoints
+
+| Method | Path | Purpose |
+| --- | --- | --- |
+| `GET` | `/health` | Process health |
+| `GET` | `/v1/profile` | Public Core boundary |
+| `POST` | `/v1/auth/login` | Owner login |
+| `POST` | `/v1/auth/logout` | Revoke current session |
+| `GET/POST` | `/v1/accounts` | List or create customer accounts |
+| `GET/POST` | `/v1/sites` | List or create constrained site roots |
+| `GET` | `/v1/domains` | List the domain inventory |
+
+Bearer-authenticated routes require the owner session returned by `/v1/auth/login`.

core/api/.env.example

@@ -0,0 +1,7 @@
+FREEWEBPANEL_HOST=127.0.0.1
+FREEWEBPANEL_PORT=4080
+FREEWEBPANEL_STATE_FILE=/var/lib/freewebpanel/core-state.json
+FREEWEBPANEL_SITE_ROOT=/srv/freewebpanel/sites
+FREEWEBPANEL_OWNER_USERNAME=panel-admin
+FREEWEBPANEL_OWNER_PASSWORD=replace-with-a-long-unique-password
+FREEWEBPANEL_SESSION_HOURS=12