Builded new structure.

Now with remote setup and management Server
more than one Node can be connected
added user auth

management/src/agentClient.js

@@ -0,0 +1,34 @@
+export async function agentRequest(node, path, options = {}) {
+  const response = await fetch(`${node.baseUrl}/api${path}`, {
+    method: options.method || 'GET',
+    headers: {
+      Authorization: `Bearer ${node.token}`,
+      'Content-Type': 'application/json',
+      ...(options.headers || {}),
+    },
+    body: options.body ? JSON.stringify(options.body) : undefined,
+    signal: AbortSignal.timeout(options.timeout || 20000),
+  });
+
+  const text = await response.text();
+  const data = text ? JSON.parse(text) : null;
+  if (!response.ok) {
+    const error = new Error(data?.error || `Agent request failed with ${response.status}`);
+    error.status = response.status;
+    throw error;
+  }
+  return data;
+}
+
+export function publicNode(node) {
+  return {
+    id: node.id,
+    name: node.name,
+    baseUrl: node.baseUrl,
+    enabled: node.enabled,
+    lastHealthStatus: node.lastHealthStatus,
+    lastHealthAt: node.lastHealthAt,
+    createdAt: node.createdAt,
+    updatedAt: node.updatedAt,
+  };
+}

management/src/auth.js

@@ -0,0 +1,52 @@
+import { createSession, deleteSession, getUserBySession, getUserByUsername } from './store.js';
+import { verifyPassword } from './crypto.js';
+
+const cookieName = 'incus_backup_session';
+
+export function requireAuth(req, res, next) {
+  const sessionId = readCookie(req, cookieName);
+  const user = sessionId ? getUserBySession(sessionId) : null;
+  if (!user) {
+    res.status(401).json({ error: 'Authentication required.' });
+    return;
+  }
+  req.user = user;
+  req.sessionId = sessionId;
+  next();
+}
+
+export function currentSession(req) {
+  const sessionId = readCookie(req, cookieName);
+  const user = sessionId ? getUserBySession(sessionId) : null;
+  return user ? { sessionId, user } : null;
+}
+
+export function login(username, password) {
+  const user = getUserByUsername(username);
+  if (!user || !verifyPassword(password, user.password_hash)) return null;
+  const session = createSession(user.id);
+  return { session, user: { id: user.id, username: user.username } };
+}
+
+export function logout(sessionId) {
+  if (sessionId) deleteSession(sessionId);
+}
+
+export function setSessionCookie(res, session) {
+  res.setHeader('Set-Cookie', [
+    `${cookieName}=${session.id}; Path=/; HttpOnly; SameSite=Lax; Expires=${session.expiresAt.toUTCString()}`,
+  ]);
+}
+
+export function clearSessionCookie(res) {
+  res.setHeader('Set-Cookie', [`${cookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`]);
+}
+
+function readCookie(req, name) {
+  const header = req.headers.cookie || '';
+  for (const part of header.split(';')) {
+    const [key, ...value] = part.trim().split('=');
+    if (key === name) return decodeURIComponent(value.join('='));
+  }
+  return '';
+}

management/src/config.js

@@ -0,0 +1,12 @@
+import dotenv from 'dotenv';
+import path from 'node:path';
+
+dotenv.config();
+
+export const config = {
+  port: Number(process.env.PORT || 3100),
+  sessionSecret: process.env.SESSION_SECRET || 'change-me',
+  authUsername: process.env.AUTH_USERNAME || 'admin',
+  authPassword: process.env.AUTH_PASSWORD || '',
+  databasePath: path.resolve(process.cwd(), process.env.DATABASE_PATH || './management.sqlite'),
+};

management/src/crypto.js

@@ -0,0 +1,19 @@
+import crypto from 'node:crypto';
+
+const keyLength = 64;
+
+export function hashPassword(password, salt = crypto.randomBytes(16).toString('hex')) {
+  const hash = crypto.scryptSync(String(password), salt, keyLength).toString('hex');
+  return `scrypt$${salt}$${hash}`;
+}
+
+export function verifyPassword(password, storedHash) {
+  const [algorithm, salt, hash] = String(storedHash || '').split('$');
+  if (algorithm !== 'scrypt' || !salt || !hash) return false;
+  const candidate = hashPassword(password, salt).split('$')[2];
+  return crypto.timingSafeEqual(Buffer.from(hash, 'hex'), Buffer.from(candidate, 'hex'));
+}
+
+export function randomToken(bytes = 32) {
+  return crypto.randomBytes(bytes).toString('hex');
+}

management/src/db.js

@@ -0,0 +1,62 @@
+import { DatabaseSync } from 'node:sqlite';
+import { config } from './config.js';
+import { hashPassword } from './crypto.js';
+
+export const db = new DatabaseSync(config.databasePath);
+
+export function migrate() {
+  db.exec(`
+    PRAGMA journal_mode = WAL;
+    CREATE TABLE IF NOT EXISTS users (
+      id TEXT PRIMARY KEY,
+      username TEXT NOT NULL UNIQUE,
+      password_hash TEXT NOT NULL,
+      created_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS sessions (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      expires_at TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+    );
+    CREATE TABLE IF NOT EXISTS nodes (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      base_url TEXT NOT NULL,
+      token TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      last_health_status TEXT,
+      last_health_at TEXT,
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL
+    );
+    CREATE TABLE IF NOT EXISTS schedules (
+      id TEXT PRIMARY KEY,
+      node_id TEXT NOT NULL,
+      vm_name TEXT NOT NULL,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      interval_hours INTEGER NOT NULL DEFAULT 24,
+      time_of_day TEXT NOT NULL DEFAULT '02:00',
+      next_run_at TEXT,
+      last_run_at TEXT,
+      last_error TEXT NOT NULL DEFAULT '',
+      created_at TEXT NOT NULL,
+      updated_at TEXT NOT NULL,
+      UNIQUE (node_id, vm_name),
+      FOREIGN KEY (node_id) REFERENCES nodes(id) ON DELETE CASCADE
+    );
+  `);
+
+  const existing = db.prepare('SELECT id FROM users LIMIT 1').get();
+  if (!existing) {
+    const now = new Date().toISOString();
+    const password = config.authPassword || 'admin';
+    db.prepare('INSERT INTO users (id, username, password_hash, created_at) VALUES (?, ?, ?, ?)')
+      .run(`user_${cryptoId()}`, config.authUsername, hashPassword(password), now);
+  }
+}
+
+function cryptoId() {
+  return Math.random().toString(16).slice(2) + Date.now().toString(16);
+}

management/src/index.js

@@ -0,0 +1,33 @@
+import cors from 'cors';
+import express from 'express';
+import { config } from './config.js';
+import { migrate } from './db.js';
+import { requireAuth } from './auth.js';
+import { authRouter } from './routes/auth.js';
+import { nodesRouter } from './routes/nodes.js';
+import { proxyRouter } from './routes/proxy.js';
+import { schedulesRouter } from './routes/schedules.js';
+import { startScheduler } from './scheduler.js';
+
+migrate();
+
+const app = express();
+
+app.use(cors({ origin: true, credentials: true }));
+app.use(express.json());
+
+app.use('/api/auth', authRouter);
+app.use('/api', requireAuth, proxyRouter);
+app.use('/api/nodes', requireAuth, nodesRouter);
+app.use('/api/schedules', requireAuth, schedulesRouter);
+
+app.use((error, _req, res, _next) => {
+  const status = error.status || 500;
+  res.status(status).json({ error: error.message || 'Internal server error.' });
+});
+
+app.listen(config.port, () => {
+  console.log(`Incus backup management API listening on http://localhost:${config.port}`);
+});
+
+startScheduler();

management/src/routes/auth.js

@@ -0,0 +1,26 @@
+import { Router } from 'express';
+import { clearSessionCookie, currentSession, login, logout, setSessionCookie } from '../auth.js';
+
+export const authRouter = Router();
+
+authRouter.get('/session', (req, res) => {
+  const session = currentSession(req);
+  res.json({ authenticated: Boolean(session), user: session?.user || null });
+});
+
+authRouter.post('/login', (req, res) => {
+  const result = login(req.body?.username, req.body?.password);
+  if (!result) {
+    res.status(401).json({ error: 'Invalid username or password.' });
+    return;
+  }
+  setSessionCookie(res, result.session);
+  res.json({ user: result.user });
+});
+
+authRouter.post('/logout', (req, res) => {
+  const session = currentSession(req);
+  logout(session?.sessionId);
+  clearSessionCookie(res);
+  res.json({ ok: true });
+});

management/src/routes/nodes.js

@@ -0,0 +1,96 @@
+import { Router } from 'express';
+import { agentRequest, publicNode } from '../agentClient.js';
+import { createNode, deleteNode, getNode, listNodes, recordNodeHealth, updateNode } from '../store.js';
+
+export const nodesRouter = Router();
+
+nodesRouter.get('/', (_req, res) => {
+  res.json(listNodes().map(publicNode));
+});
+
+nodesRouter.post('/', async (req, res, next) => {
+  try {
+    const node = createNode(validateNodeInput(req.body));
+    res.status(201).json(publicNode(node));
+  } catch (error) {
+    next(error);
+  }
+});
+
+nodesRouter.put('/:nodeId', async (req, res, next) => {
+  try {
+    const node = updateNode(req.params.nodeId, validateNodeInput(req.body, { partial: true }));
+    if (!node) {
+      res.status(404).json({ error: 'Node not found.' });
+      return;
+    }
+    res.json(publicNode(node));
+  } catch (error) {
+    next(error);
+  }
+});
+
+nodesRouter.delete('/:nodeId', (req, res) => {
+  deleteNode(req.params.nodeId);
+  res.json({ ok: true });
+});
+
+nodesRouter.get('/:nodeId/health', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    const health = await agentRequest(node, '/health', { timeout: 10000 });
+    recordNodeHealth(node.id, health?.ok ? 'ok' : 'degraded');
+    res.json(health);
+  } catch (error) {
+    if (error.status === 404) {
+      next(error);
+      return;
+    }
+    recordNodeHealth(req.params.nodeId, 'error');
+    next(error);
+  }
+});
+
+nodesRouter.post('/:nodeId/test', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    const health = await agentRequest(node, '/health', { timeout: 10000 });
+    recordNodeHealth(node.id, health?.ok ? 'ok' : 'degraded');
+    res.json({ ok: true, health });
+  } catch (error) {
+    recordNodeHealth(req.params.nodeId, 'error');
+    next(error);
+  }
+});
+
+function requireNode(id) {
+  const node = getNode(id);
+  if (!node) {
+    const error = new Error('Node not found.');
+    error.status = 404;
+    throw error;
+  }
+  return node;
+}
+
+function validateNodeInput(body, options = {}) {
+  const values = body || {};
+  const required = !options.partial;
+  const name = values.name === undefined ? undefined : String(values.name).trim();
+  const baseUrl = values.baseUrl === undefined ? undefined : String(values.baseUrl).trim();
+  const token = values.token === undefined ? undefined : String(values.token).trim();
+
+  if (required && (!name || !baseUrl || !token)) {
+    const error = new Error('Node name, URL and token are required.');
+    error.status = 400;
+    throw error;
+  }
+  if (baseUrl) new URL(baseUrl);
+
+  return {
+    ...(name !== undefined ? { name } : {}),
+    ...(baseUrl !== undefined ? { baseUrl } : {}),
+    ...(token !== undefined ? { token } : {}),
+    ...(values.enabled !== undefined ? { enabled: Boolean(values.enabled) } : {}),
+  };
+}

management/src/routes/proxy.js

@@ -0,0 +1,119 @@
+import { Router } from 'express';
+import { agentRequest } from '../agentClient.js';
+import { getNode, listNodes, recordNodeHealth } from '../store.js';
+
+export const proxyRouter = Router();
+
+proxyRouter.get('/health', async (_req, res) => {
+  const nodes = listNodes().filter((node) => node.enabled);
+  const checks = { database: 'ok' };
+  let ok = true;
+  await Promise.all(nodes.map(async (node) => {
+    try {
+      const health = await agentRequest(node, '/health', { timeout: 8000 });
+      checks[node.name] = health?.ok ? 'ok' : 'degraded';
+      recordNodeHealth(node.id, checks[node.name]);
+      ok = ok && Boolean(health?.ok);
+    } catch {
+      checks[node.name] = 'error';
+      recordNodeHealth(node.id, 'error');
+      ok = false;
+    }
+  }));
+  res.json({ ok, checks });
+});
+
+proxyRouter.get('/vms', async (_req, res) => {
+  const nodes = listNodes().filter((node) => node.enabled);
+  const rows = [];
+  await Promise.all(nodes.map(async (node) => {
+    try {
+      const vms = await agentRequest(node, '/vms');
+      for (const vm of vms) {
+        rows.push({ ...vm, id: `${node.id}:${vm.name}`, nodeId: node.id, nodeName: node.name });
+      }
+      recordNodeHealth(node.id, 'ok');
+    } catch {
+      recordNodeHealth(node.id, 'error');
+    }
+  }));
+  res.json(rows.sort((a, b) => `${a.nodeName}/${a.name}`.localeCompare(`${b.nodeName}/${b.name}`)));
+});
+
+proxyRouter.get('/jobs', async (_req, res) => {
+  const nodes = listNodes().filter((node) => node.enabled);
+  const rows = [];
+  await Promise.all(nodes.map(async (node) => {
+    try {
+      const jobs = await agentRequest(node, '/jobs');
+      for (const job of jobs) rows.push({ ...job, nodeId: node.id, nodeName: node.name });
+    } catch {
+      recordNodeHealth(node.id, 'error');
+    }
+  }));
+  res.json(rows.sort((a, b) => String(b.startedAt || '').localeCompare(String(a.startedAt || ''))));
+});
+
+proxyRouter.get('/snapshots/:nodeId/:vmName', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.json(await agentRequest(node, `/snapshots/${encodeURIComponent(req.params.vmName)}`));
+  } catch (error) {
+    next(error);
+  }
+});
+
+proxyRouter.get('/snapshots/:nodeId/:vmName/:snapshotId/files', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.json(await agentRequest(node, `/snapshots/${encodeURIComponent(req.params.vmName)}/${encodeURIComponent(req.params.snapshotId)}/files`));
+  } catch (error) {
+    next(error);
+  }
+});
+
+proxyRouter.post('/backup/:nodeId/:vmName', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.status(202).json(await agentRequest(node, `/backup/${encodeURIComponent(req.params.vmName)}`, { method: 'POST', body: req.body || {} }));
+  } catch (error) {
+    next(error);
+  }
+});
+
+proxyRouter.post('/restore/:nodeId/:vmName', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.status(202).json(await agentRequest(node, `/restore/${encodeURIComponent(req.params.vmName)}`, { method: 'POST', body: req.body || {} }));
+  } catch (error) {
+    next(error);
+  }
+});
+
+proxyRouter.get('/settings/:nodeId', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.json(await agentRequest(node, '/settings'));
+  } catch (error) {
+    next(error);
+  }
+});
+
+proxyRouter.put('/settings/:nodeId', async (req, res, next) => {
+  try {
+    const node = requireNode(req.params.nodeId);
+    res.json(await agentRequest(node, '/settings', { method: 'PUT', body: req.body || {} }));
+  } catch (error) {
+    next(error);
+  }
+});
+
+function requireNode(id) {
+  const node = getNode(id);
+  if (!node) {
+    const error = new Error('Node not found.');
+    error.status = 404;
+    throw error;
+  }
+  return node;
+}

management/src/routes/schedules.js

@@ -0,0 +1,16 @@
+import { Router } from 'express';
+import { listSchedules, replaceSchedules } from '../store.js';
+
+export const schedulesRouter = Router();
+
+schedulesRouter.get('/', (_req, res) => {
+  res.json(listSchedules());
+});
+
+schedulesRouter.put('/', (req, res, next) => {
+  try {
+    res.json(replaceSchedules(req.body?.schedules || []));
+  } catch (error) {
+    next(error);
+  }
+});

management/src/scheduler.js

@@ -0,0 +1,37 @@
+import { agentRequest } from './agentClient.js';
+import { listDueSchedules, markScheduleRun, nextRunFrom } from './store.js';
+
+let timer = null;
+
+export function startScheduler() {
+  if (timer) return;
+  timer = setInterval(runDueSchedules, 30 * 1000);
+  timer.unref?.();
+  runDueSchedules();
+}
+
+async function runDueSchedules() {
+  const now = new Date();
+  const schedules = listDueSchedules(now);
+  for (const schedule of schedules) {
+    try {
+      await agentRequest({
+        id: schedule.node_id,
+        baseUrl: schedule.base_url,
+        token: schedule.token,
+      }, `/backup/${encodeURIComponent(schedule.vm_name)}`, { method: 'POST' });
+
+      markScheduleRun(schedule.id, {
+        lastRunAt: now.toISOString(),
+        lastError: '',
+        nextRunAt: nextRunFrom(now, schedule.interval_hours, schedule.time_of_day),
+      });
+    } catch (error) {
+      markScheduleRun(schedule.id, {
+        lastRunAt: schedule.last_run_at,
+        lastError: String(error.message || error),
+        nextRunAt: new Date(now.getTime() + 5 * 60 * 1000).toISOString(),
+      });
+    }
+  }
+}

management/src/store.js

@@ -0,0 +1,178 @@
+import { db } from './db.js';
+import { randomToken } from './crypto.js';
+
+export function getUserByUsername(username) {
+  return db.prepare('SELECT * FROM users WHERE username = ?').get(username);
+}
+
+export function getUserBySession(sessionId) {
+  return db.prepare(`
+    SELECT users.id, users.username
+    FROM sessions
+    JOIN users ON users.id = sessions.user_id
+    WHERE sessions.id = ? AND sessions.expires_at > ?
+  `).get(sessionId, new Date().toISOString());
+}
+
+export function createSession(userId) {
+  const now = new Date();
+  const expires = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000);
+  const id = `sess_${randomToken()}`;
+  db.prepare('INSERT INTO sessions (id, user_id, expires_at, created_at) VALUES (?, ?, ?, ?)')
+    .run(id, userId, expires.toISOString(), now.toISOString());
+  return { id, expiresAt: expires };
+}
+
+export function deleteSession(sessionId) {
+  db.prepare('DELETE FROM sessions WHERE id = ?').run(sessionId);
+}
+
+export function listNodes() {
+  return db.prepare('SELECT * FROM nodes ORDER BY name ASC').all().map(formatNode);
+}
+
+export function getNode(id) {
+  const row = db.prepare('SELECT * FROM nodes WHERE id = ?').get(id);
+  return row ? formatNode(row) : null;
+}
+
+export function createNode(values) {
+  const now = new Date().toISOString();
+  const id = `node_${randomToken(8)}`;
+  db.prepare(`
+    INSERT INTO nodes (id, name, base_url, token, enabled, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+  `).run(id, values.name, normalizeBaseUrl(values.baseUrl), values.token, values.enabled ? 1 : 0, now, now);
+  return getNode(id);
+}
+
+export function updateNode(id, values) {
+  const current = getNode(id);
+  if (!current) return null;
+  const next = {
+    name: values.name ?? current.name,
+    baseUrl: values.baseUrl ? normalizeBaseUrl(values.baseUrl) : current.baseUrl,
+    token: values.token ?? current.token,
+    enabled: values.enabled ?? current.enabled,
+  };
+  db.prepare('UPDATE nodes SET name = ?, base_url = ?, token = ?, enabled = ?, updated_at = ? WHERE id = ?')
+    .run(next.name, next.baseUrl, next.token, next.enabled ? 1 : 0, new Date().toISOString(), id);
+  return getNode(id);
+}
+
+export function deleteNode(id) {
+  db.prepare('DELETE FROM nodes WHERE id = ?').run(id);
+}
+
+export function recordNodeHealth(id, status) {
+  db.prepare('UPDATE nodes SET last_health_status = ?, last_health_at = ? WHERE id = ?')
+    .run(status, new Date().toISOString(), id);
+}
+
+export function listSchedules() {
+  return db.prepare(`
+    SELECT schedules.*, nodes.name AS node_name
+    FROM schedules
+    JOIN nodes ON nodes.id = schedules.node_id
+    ORDER BY node_name ASC, vm_name ASC
+  `).all().map(formatSchedule);
+}
+
+export function replaceSchedules(schedules) {
+  const now = new Date().toISOString();
+  try {
+    db.exec('BEGIN');
+    db.prepare('DELETE FROM schedules').run();
+    const insert = db.prepare(`
+      INSERT INTO schedules
+        (id, node_id, vm_name, enabled, interval_hours, time_of_day, next_run_at, last_run_at, last_error, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+    for (const row of schedules) {
+      insert.run(
+        row.id || `sched_${randomToken(8)}`,
+        row.nodeId,
+        row.vmName,
+        row.enabled ? 1 : 0,
+        Math.max(1, Number(row.intervalHours) || 24),
+        normalizeTimeOfDay(row.timeOfDay),
+        row.nextRunAt || nextRunFrom(new Date(), Math.max(1, Number(row.intervalHours) || 24), normalizeTimeOfDay(row.timeOfDay)),
+        row.lastRunAt || null,
+        row.lastError || '',
+        now,
+        now,
+      );
+    }
+    db.exec('COMMIT');
+  } catch (error) {
+    db.exec('ROLLBACK');
+    throw error;
+  }
+  return listSchedules();
+}
+
+export function listDueSchedules(date = new Date()) {
+  return db.prepare(`
+    SELECT schedules.*, nodes.name AS node_name, nodes.base_url, nodes.token, nodes.enabled AS node_enabled
+    FROM schedules
+    JOIN nodes ON nodes.id = schedules.node_id
+    WHERE schedules.enabled = 1 AND nodes.enabled = 1 AND schedules.next_run_at <= ?
+  `).all(date.toISOString());
+}
+
+export function markScheduleRun(id, values) {
+  db.prepare('UPDATE schedules SET next_run_at = ?, last_run_at = ?, last_error = ?, updated_at = ? WHERE id = ?')
+    .run(values.nextRunAt, values.lastRunAt || null, values.lastError || '', new Date().toISOString(), id);
+}
+
+export function nextRunFrom(date, intervalHours, timeOfDay) {
+  const next = withTimeOfDay(date, timeOfDay);
+  const intervalMs = intervalHours * 60 * 60 * 1000;
+  while (next <= date) next.setTime(next.getTime() + intervalMs);
+  return next.toISOString();
+}
+
+function formatNode(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    baseUrl: row.base_url,
+    token: row.token,
+    enabled: Boolean(row.enabled),
+    lastHealthStatus: row.last_health_status,
+    lastHealthAt: row.last_health_at,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+  };
+}
+
+function formatSchedule(row) {
+  return {
+    id: row.id,
+    nodeId: row.node_id,
+    nodeName: row.node_name,
+    vmName: row.vm_name,
+    enabled: Boolean(row.enabled),
+    intervalHours: row.interval_hours,
+    timeOfDay: row.time_of_day,
+    nextRunAt: row.next_run_at,
+    lastRunAt: row.last_run_at,
+    lastError: row.last_error || '',
+  };
+}
+
+function normalizeBaseUrl(value) {
+  return String(value || '').replace(/\/+$/, '');
+}
+
+function normalizeTimeOfDay(value) {
+  const text = String(value || '02:00');
+  return /^\d{2}:\d{2}$/.test(text) ? text : '02:00';
+}
+
+function withTimeOfDay(date, timeOfDay) {
+  const [hours, minutes] = normalizeTimeOfDay(timeOfDay).split(':').map(Number);
+  const next = new Date(date);
+  next.setHours(hours, minutes, 0, 0);
+  return next;
+}