@git.zone/cli 2.23.0 → 2.25.0

package/dist_ts/mod_services/classes.servicedatamarker.js

@@ -0,0 +1,166 @@
+import * as plugins from './mod.plugins.js';
+export const serviceNames = ['mongodb', 'minio', 'elasticsearch'];
+/** Owner recorded in markers and container labels. */
+export const serviceDataOwner = '@git.zone/cli';
+/** Value of the `git.zone.tool` label on containers created by `gitzone services`. */
+export const serviceToolLabel = 'gitzone-services';
+/** Marker file name, stored in `<projectPath>/.nogit/`. */
+export const serviceDataMarkerFile = '.gitzone-services.json';
+/**
+ * Directory basename used below `.nogit/` for each service's bind-mounted data.
+ * This mapping is the only shape `gitzone services` ever creates, and prune
+ * refuses to touch anything that does not match it exactly.
+ */
+export const serviceDataDirectoryNames = {
+    mongodb: 'mongodata',
+    minio: 'miniodata',
+    elasticsearch: 'esdata',
+};
+/**
+ * Image used to run each service, and therefore the image available to perform
+ * a privileged cleanup of that service's data directory: if the data exists,
+ * the service ran, so its image is present locally.
+ */
+export const serviceImages = {
+    mongodb: 'mongo:7.0',
+    minio: 'minio/minio',
+    elasticsearch: 'elasticsearch:8.11.0',
+};
+const isPlainObject = (value) => {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+};
+/** Absolute path of the marker file for a project. */
+export const getServiceDataMarkerPath = (projectPathArg) => {
+    return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataMarkerFile);
+};
+/**
+ * Expected absolute data directory path for a service in a project.
+ * `mod_services` must always derive data paths through this helper so that
+ * creation and reclamation agree on a single shape.
+ */
+export const getServiceDataDirectory = (projectPathArg, serviceArg) => {
+    return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataDirectoryNames[serviceArg]);
+};
+/**
+ * True only when `candidatePathArg` is exactly one of the three data
+ * directories `gitzone services` creates for `projectPathArg`.
+ *
+ * This is an allowlist, not a denylist: any path that is not byte-for-byte one
+ * of the expected resolved paths is rejected. It is the last line of defence
+ * before a recursive delete.
+ */
+export const isSafeServiceDataPath = (projectPathArg, candidatePathArg) => {
+    const candidate = plugins.path.resolve(candidatePathArg);
+    for (const service of serviceNames) {
+        if (getServiceDataDirectory(projectPathArg, service) === candidate) {
+            return true;
+        }
+    }
+    return false;
+};
+/** Validate an unknown value as a usable marker. */
+export const isValidServiceDataMarker = (markerArg) => {
+    if (!isPlainObject(markerArg)) {
+        return false;
+    }
+    if (markerArg.owner !== serviceDataOwner) {
+        return false;
+    }
+    if (markerArg.kind !== 'service-data') {
+        return false;
+    }
+    if (markerArg.schemaVersion !== 1) {
+        return false;
+    }
+    if (markerArg.safeToPrune !== true) {
+        return false;
+    }
+    if (typeof markerArg.projectPath !== 'string' || !markerArg.projectPath) {
+        return false;
+    }
+    if (!Array.isArray(markerArg.dataDirectories)) {
+        return false;
+    }
+    for (const entry of markerArg.dataDirectories) {
+        if (!isPlainObject(entry)) {
+            return false;
+        }
+        if (!serviceNames.includes(entry.service)) {
+            return false;
+        }
+        if (typeof entry.path !== 'string' || !entry.path) {
+            return false;
+        }
+    }
+    return true;
+};
+/** Read and validate the marker for a project, or undefined when absent/invalid. */
+export const readServiceDataMarker = async (projectPathArg) => {
+    const markerPath = getServiceDataMarkerPath(projectPathArg);
+    try {
+        if (!(await plugins.smartfs.file(markerPath).exists())) {
+            return undefined;
+        }
+        const content = (await plugins.smartfs.file(markerPath).encoding('utf8').read());
+        const parsed = JSON.parse(content);
+        return isValidServiceDataMarker(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Record that `gitzone services` owns a data directory for this project.
+ *
+ * The marker lives in `.nogit/` rather than inside the bind-mounted data
+ * directory itself, so it can never confuse mongod, MinIO or Elasticsearch at
+ * runtime. Entries are merged so enabling a service later does not drop the
+ * claim on previously created directories.
+ */
+export const recordServiceDataDirectory = async (projectPathArg, serviceArg) => {
+    const projectPath = plugins.path.resolve(projectPathArg);
+    const dataPath = getServiceDataDirectory(projectPath, serviceArg);
+    const existingMarker = await readServiceDataMarker(projectPath);
+    const entries = existingMarker
+        ? existingMarker.dataDirectories.filter((entry) => entry.service !== serviceArg)
+        : [];
+    entries.push({ service: serviceArg, path: dataPath });
+    entries.sort((entryA, entryB) => entryA.service.localeCompare(entryB.service));
+    const marker = {
+        owner: serviceDataOwner,
+        kind: 'service-data',
+        schemaVersion: 1,
+        projectPath,
+        safeToPrune: true,
+        createdAt: existingMarker?.createdAt || new Date().toISOString(),
+        dataDirectories: entries,
+    };
+    const markerPath = getServiceDataMarkerPath(projectPath);
+    await plugins.smartfs.directory(plugins.path.dirname(markerPath)).recursive().create();
+    await plugins.smartfs
+        .file(markerPath)
+        .encoding('utf8')
+        .write(`${JSON.stringify(marker, null, 2)}\n`);
+};
+/**
+ * Labels applied to every container `gitzone services` creates.
+ *
+ * Mirrors the `git.zone.*` namespace already established by
+ * `@git.zone/tsdocker` so prune logic can identify tool-owned resources
+ * without ever matching on image or bare name.
+ */
+export const getServiceContainerLabels = (optionsArg) => {
+    return {
+        'git.zone.tool': serviceToolLabel,
+        'git.zone.service': optionsArg.service,
+        'git.zone.project-path': plugins.path.resolve(optionsArg.projectPath),
+        'git.zone.data-path': plugins.path.resolve(optionsArg.dataPath),
+        'git.zone.safe-to-prune': 'true',
+    };
+};
+/** True when a container's labels prove `gitzone services` created it. */
+export const isServiceOwnedByLabels = (labelsArg) => {
+    return (labelsArg['git.zone.tool'] === serviceToolLabel &&
+        labelsArg['git.zone.safe-to-prune'] === 'true');
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zZXJ2aWNlZGF0YW1hcmtlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL21vZF9zZXJ2aWNlcy9jbGFzc2VzLnNlcnZpY2VkYXRhbWFya2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFZNUMsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFtQixDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFFbEYsc0RBQXNEO0FBQ3RELE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLGVBQWUsQ0FBQztBQUVoRCxzRkFBc0Y7QUFDdEYsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsa0JBQWtCLENBQUM7QUFFbkQsMkRBQTJEO0FBQzNELE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLHdCQUF3QixDQUFDO0FBRTlEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBc0M7SUFDMUUsT0FBTyxFQUFFLFdBQVc7SUFDcEIsS0FBSyxFQUFFLFdBQVc7SUFDbEIsYUFBYSxFQUFFLFFBQVE7Q0FDeEIsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxhQUFhLEdBQXNDO0lBQzlELE9BQU8sRUFBRSxXQUFXO0lBQ3BCLEtBQUssRUFBRSxhQUFhO0lBQ3BCLGFBQWEsRUFBRSxzQkFBc0I7Q0FDdEMsQ0FBQztBQWlCRixNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBZ0MsRUFBRTtJQUNyRSxPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM5RSxDQUFDLENBQUM7QUFFRixzREFBc0Q7QUFDdEQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUFzQixFQUFVLEVBQUU7SUFDekUsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsRUFBRSxRQUFRLEVBQUUscUJBQXFCLENBQUMsQ0FBQztBQUNsRyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FDckMsY0FBc0IsRUFDdEIsVUFBd0IsRUFDaEIsRUFBRTtJQUNWLE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQ3RCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxFQUNwQyxRQUFRLEVBQ1IseUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQ3RDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FDbkMsY0FBc0IsRUFDdEIsZ0JBQXdCLEVBQ2YsRUFBRTtJQUNYLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDekQsS0FBSyxNQUFNLE9BQU8sSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNuQyxJQUFJLHVCQUF1QixDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuRSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixvREFBb0Q7QUFDcEQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxTQUFrQixFQUFtQyxFQUFFO0lBQzlGLElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5QixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxLQUFLLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN6QyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDdEMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsYUFBYSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLFdBQVcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNuQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDeEUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDOUMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxTQUFTLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDOUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFDLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELElBQUksT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRixvRkFBb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsS0FBSyxFQUN4QyxjQUFzQixFQUNtQixFQUFFO0lBQzNDLE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzVELElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFXLENBQUM7UUFDM0YsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuQyxPQUFPLHdCQUF3QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUMvRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzdDLGNBQXNCLEVBQ3RCLFVBQXdCLEVBQ1QsRUFBRTtJQUNqQixNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN6RCxNQUFNLFFBQVEsR0FBRyx1QkFBdUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbEUsTUFBTSxjQUFjLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUVoRSxNQUFNLE9BQU8sR0FBOEIsY0FBYztRQUN2RCxDQUFDLENBQUMsY0FBYyxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDO1FBQ2hGLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUN0RCxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFFL0UsTUFBTSxNQUFNLEdBQXVCO1FBQ2pDLEtBQUssRUFBRSxnQkFBZ0I7UUFDdkIsSUFBSSxFQUFFLGNBQWM7UUFDcEIsYUFBYSxFQUFFLENBQUM7UUFDaEIsV0FBVztRQUNYLFdBQVcsRUFBRSxJQUFJO1FBQ2pCLFNBQVMsRUFBRSxjQUFjLEVBQUUsU0FBUyxJQUFJLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1FBQ2hFLGVBQWUsRUFBRSxPQUFPO0tBQ3pCLENBQUM7SUFFRixNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN6RCxNQUFNLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDdkYsTUFBTSxPQUFPLENBQUMsT0FBTztTQUNsQixJQUFJLENBQUMsVUFBVSxDQUFDO1NBQ2hCLFFBQVEsQ0FBQyxNQUFNLENBQUM7U0FDaEIsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUNuRCxDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFVBSXpDLEVBQTZCLEVBQUU7SUFDOUIsT0FBTztRQUNMLGVBQWUsRUFBRSxnQkFBZ0I7UUFDakMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLE9BQU87UUFDdEMsdUJBQXVCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQztRQUNyRSxvQkFBb0IsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQy9ELHdCQUF3QixFQUFFLE1BQU07S0FDakMsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFNBQW9DLEVBQVcsRUFBRTtJQUN0RixPQUFPLENBQ0wsU0FBUyxDQUFDLGVBQWUsQ0FBQyxLQUFLLGdCQUFnQjtRQUMvQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsS0FBSyxNQUFNLENBQy9DLENBQUM7QUFDSixDQUFDLENBQUMifQ==

package/dist_ts/mod_services/classes.servicemanager.d.ts

@@ -1,3 +1,36 @@
+import { ServiceConfiguration } from './classes.serviceconfiguration.js';
+import { type TServiceName } from './classes.servicedatamarker.js';
+import type { ContainerStatus } from './classes.dockercontainer.js';
+import type { TServiceOptionSource } from './classes.serviceoptions.js';
+export interface IServiceStatus {
+    service: TServiceName;
+    enabled: boolean;
+    container: string;
+    status: ContainerStatus;
+    port: string;
+    connectionString: string;
+    dataDirectory: string;
+    dataSizeBytes: number;
+    /** Only meaningful when the container does not exist yet. */
+    portAvailable: boolean | null;
+    /** MongoDB only: whether the instance enforces authentication. */
+    authEnabled?: boolean;
+    /** MongoDB only: whether the auth mode is declared in committed config. */
+    authSource?: TServiceOptionSource;
+}
+export interface IServicesStatus {
+    project: {
+        name: string;
+        path: string;
+        enabledServices: string[];
+    };
+    services: {
+        mongodb: IServiceStatus;
+        minio: IServiceStatus;
+        elasticsearch: IServiceStatus;
+    };
+    totalDataBytes: number;
+}
 export declare class ServiceManager {
     private config;
     private docker;
@@ -8,6 +41,16 @@ export declare class ServiceManager {
      * Initialize the service manager
      */
     init(): Promise<void>;
+    /**
+     * Human phrasing for where the auth mode came from. A declared auth-off is
+     * committed to the repository and therefore affects everyone who clones it,
+     * so it must never read the same as a local-only choice.
+     */
+    private describeMongoAuthSource;
+    /**
+     * Expose the resolved service configuration to the command layer.
+     */
+    getConfiguration(): ServiceConfiguration;
     /**
      * Load service configuration from .smartconfig.json
      */
@@ -21,15 +64,31 @@ export declare class ServiceManager {
      */
     private isServiceEnabled;
     /**
-     * Register this project with the global registry
+     * Prepare a service's data directory: create it and record tool ownership.
+     *
+     * The marker written here is what later allows `gitzone services prune` to
+     * prove the directory is reclaimable instead of guessing from its path.
+     */
+    private prepareDataDirectory;
+    /**
+     * Register this project with the global registry.
+     *
+     * Public and called from the command layer after any start path: previously
+     * only `startAll` registered, so `gitzone services start mongo` created a
+     * container the registry never knew about and prune could never account for.
      */
-    private registerWithGlobalRegistry;
+    registerWithGlobalRegistry(): Promise<void>;
     /**
      * Start all enabled services
      */
     startAll(): Promise<void>;
     /**
-     * Stop all enabled services
+     * Stop every service container belonging to this project.
+     *
+     * Deliberately not filtered by the enabled-service list: disabling a service
+     * previously left its container running with no command able to stop it,
+     * which is how projects accumulated forgotten containers. Stopping a service
+     * that is not running is a no-op, so covering all three is always safe.
      */
     stopAll(): Promise<void>;
     /**
@@ -52,9 +111,21 @@ export declare class ServiceManager {
      */
     private ensureMongoKeyfile;
     /**
-     * Check whether the container was created with --replSet
+     * The mongod argv the container was created with
      */
-    private mongoContainerHasReplSet;
+    private getMongoContainerCmd;
+    /**
+     * Make sure the configured root user exists when auth is enabled.
+     *
+     * `MONGO_INITDB_ROOT_USERNAME` only takes effect on an empty dbpath, so data
+     * that was first created with auth disabled has no user at all. Enabling auth
+     * over it would leave an unusable database. MongoDB's localhost exception is
+     * the designed bootstrap path for exactly this: while zero users exist, a
+     * connection from localhost — which, inside the container, is what this is —
+     * may create the first one. If users already exist the exception does not
+     * apply and creation fails, so this can never overwrite or escalate anything.
+     */
+    private ensureMongoRootUser;
     /**
      * Initiate the single-node replica set once mongod is reachable
      */
@@ -79,10 +150,25 @@ export declare class ServiceManager {
      * Stop Elasticsearch service
      */
     stopElasticsearch(): Promise<void>;
+    /**
+     * Collect service status as structured data.
+     *
+     * This is the machine-readable surface behind `gitzone services status
+     * --json`; consumers such as test suites can read a connection string from it
+     * without scraping human output or re-deriving it from `.nogit/env.json`.
+     */
+    collectStatus(): Promise<IServicesStatus>;
     /**
      * Show service status
      */
     showStatus(): Promise<void>;
+    /**
+     * Report on-disk size of this project's service data.
+     *
+     * Reporting comes before any deletion: knowing what a project holds is what
+     * makes reclaiming it a decision rather than a guess.
+     */
+    showDiskUsage(): Promise<void>;
     /**
      * Show configuration
      */