@phtngyn/cms 0.2.0-beta.8 → 0.3.0

package/src/cli.js

@@ -1,199 +1,693 @@
-import { applyContent, diffContent, exportContent, planContent } from "./cli/content.js";
-import { o as renderConfigurationReport } from "./installation-DxqSSVbH.js";
-import { a as resetCmsDevelopment, i as loadCmsProjectEnvironment, n as checkCmsConfiguration, r as doctorCmsDevelopment, t as bootstrapCmsDevelopment } from "./dev-lifecycle-3I_pozUl.js";
-import { diagnosticFromCause, renderDiagnostic } from "./internal/diagnostics.js";
-import { Config, Console, Effect, Layer, Match, Option, Redacted, Runtime, Schema } from "effect";
-import { NodeChildProcessSpawner, NodeCrypto, NodeFileSystem, NodePath, NodeRuntime, NodeStdio, NodeTerminal } from "@effect/platform-node-shared";
-import { FetchHttpClient } from "effect/unstable/http";
-import { Argument, CliError, Command, Flag, Prompt } from "effect/unstable/cli";
-
-//#region package.json
-var version = "0.2.0-beta.8";
-
+#!/usr/bin/env -S node --
+import { o as mediaStorageOptions, t as Administrator } from "./Config-CMiwciub.js";
+import { t as load$1 } from "./Configuration-Dk2k3OIc.js";
+import { S as PublicationPlan, w as PublicationSelection } from "./StudioApi-CXLwwocX.js";
+import { a as ReadinessError, n as make$1, o as layer$2, r as errorDetails, s as make$2, t as ImportError } from "./DataTransfer-BmECvPHB.js";
+import { createRequire } from "node:module";
+import { Cause, Console, Context, Crypto, Effect, FileSystem, Layer, Option, Path, Result, Schema, Stdio, Stream } from "effect";
+import { mkdir, readFile, rename, rm, stat } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { createHash, randomBytes } from "node:crypto";
+import { BucketLocationConstraint, CreateBucketCommand, HeadBucketCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
+import { homedir } from "node:os";
+import { Argument, CliConfig, CliError, Command, Flag, GlobalFlag } from "effect/cli";
+import { format } from "node:util";
+import { createServer } from "node:net";
+import { DatabaseSync } from "node:sqlite";
+import { ChildProcess } from "effect/process";
+//#region ../cli/src/internal/files.ts
+/** Replace a file atomically and clean up the private temporary file on failure. */
+const writeAtomic = Effect.fn("Files.writeAtomic")(function* (target, contents, mode) {
+	const fs = yield* FileSystem.FileSystem;
+	const temporary = `${target}.${yield* (yield* Crypto.Crypto).randomUUIDv4}.tmp`;
+	yield* (Schema.is(Schema.String)(contents) ? fs.writeFileString(temporary, contents, {
+		flag: "wx",
+		mode
+	}) : fs.writeFile(temporary, contents, {
+		flag: "wx",
+		mode
+	})).pipe(Effect.flatMap(() => fs.rename(temporary, target)), Effect.onError(() => fs.remove(temporary, { force: true }).pipe(Effect.ignore)));
+});
 //#endregion
-//#region src/cli.ts
-const rootDirectory = Flag.String("root").pipe(Flag.withDefault("."));
-const envFile = Flag.String("env-file").pipe(Flag.withDefault(""));
-const verbose = Flag.Boolean("verbose").pipe(Flag.withDefault(false));
-const json = Flag.Boolean("json").pipe(Flag.withDefault(false));
-const root = Command.make("cms").pipe(Command.withSharedFlags({
-	url: Flag.String("url").pipe(Flag.withDefault("")),
-	email: Flag.String("email").pipe(Flag.withDefault("")),
-	rootDirectory,
-	envFile,
-	verbose,
-	json
+//#region ../cli/src/Sessions.ts
+const StoredSessions = Schema.fromJsonString(Schema.Record(Schema.String, Schema.String));
+var SessionError = class extends Schema.TaggedError()("Sessions.SessionError", {
+	message: Schema.String,
+	cause: Schema.optionalKey(Schema.Defect())
+}) {};
+function make(directory) {
+	const sessionFile = Effect.gen(function* () {
+		return (yield* Path.Path).join(directory, "sessions.json");
+	});
+	const storedSessions = Effect.fn("Sessions.storedSessions")(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		const file = yield* sessionFile;
+		if (!(yield* fs.exists(file))) return {};
+		return yield* Schema.decodeEffect(StoredSessions)(yield* fs.readFileString(file));
+	}, Effect.mapError((cause) => new SessionError({
+		message: "Could not read the CMS session.",
+		cause
+	})));
+	const writeSessions = Effect.fn("Sessions.writeSessions")(function* (sessions) {
+		const fs = yield* FileSystem.FileSystem;
+		const file = yield* sessionFile;
+		yield* fs.makeDirectory(directory, {
+			recursive: true,
+			mode: 448
+		});
+		yield* writeAtomic(file, `${JSON.stringify(sessions)}\n`, 384);
+	});
+	return {
+		read: Effect.fn("Sessions.read")(function* (site) {
+			const cookie = (yield* storedSessions())[site.origin];
+			if (!cookie) return yield* new SessionError({ message: `No CMS session for ${site.origin}. Run cms login.` });
+			return cookie;
+		}),
+		save: Effect.fn("Sessions.save")(function* (site, cookie) {
+			const sessions = yield* storedSessions();
+			yield* writeSessions({
+				...sessions,
+				[site.origin]: cookie
+			}).pipe(Effect.mapError((cause) => new SessionError({
+				message: "Could not save the CMS session.",
+				cause
+			})));
+		}),
+		remove: Effect.fn("Sessions.remove")(function* (site) {
+			const sessions = { ...yield* storedSessions() };
+			delete sessions[site.origin];
+			yield* writeSessions(sessions).pipe(Effect.mapError((cause) => new SessionError({
+				message: "Could not remove the CMS session.",
+				cause
+			})));
+		})
+	};
+}
+var SessionStore = class extends Context.Service()("cli/SessionStore") {};
+const layer$1 = (directory) => Layer.effect(SessionStore, Effect.gen(function* () {
+	const context = yield* Effect.context();
+	const store = make(directory);
+	return {
+		read: (site) => store.read(site).pipe(Effect.provide(context)),
+		save: (site, cookie) => store.save(site, cookie).pipe(Effect.provide(context)),
+		remove: (site) => store.remove(site).pipe(Effect.provide(context))
+	};
 }));
-const directory = Argument.String("directory");
-const overwrite = Flag.Boolean("overwrite").pipe(Flag.withDefault(false));
-const publish = Flag.Boolean("publish").pipe(Flag.withDefault(false));
-const exportCommand = Command.make("export", { directory }, ({ directory }) => Effect.gen(function* () {
-	const { url, email } = yield* root;
-	return yield* exportContent({
-		url,
-		email
-	}, directory);
-})).pipe(Command.withDescription("Export authored Markdown from a CMS installation"));
-const diffCommand = Command.make("diff", { directory }, ({ directory }) => Effect.gen(function* () {
-	const { url, email } = yield* root;
-	return yield* diffContent({
-		url,
-		email
-	}, directory);
-})).pipe(Command.withDescription("Compare local Markdown with the current CMS content"));
-const planCommand = Command.make("plan", {
-	directory,
-	overwrite,
-	publish
-}, ({ directory, overwrite, publish }) => Effect.gen(function* () {
-	const { url, email } = yield* root;
-	return yield* planContent({
-		url,
-		email
-	}, directory, {
-		overwrite,
-		publish
-	});
-})).pipe(Command.withDescription("Preview content changes without writing to the CMS"));
-const applyCommand = Command.make("apply", {
-	directory,
-	overwrite,
-	publish
-}, ({ directory, overwrite, publish }) => Effect.gen(function* () {
-	const { url, email } = yield* root;
-	return yield* applyContent({
-		url,
-		email
-	}, directory, {
-		overwrite,
-		publish
-	});
-})).pipe(Command.withDescription("Apply a validated content plan to the CMS"));
-const content = Command.make("content").pipe(Command.withSubcommands([
-	exportCommand,
-	diffCommand,
-	planCommand,
-	applyCommand
-]));
-const configurationCheckCommand = Command.make("check", {}, () => Effect.gen(function* () {
-	const options = yield* root;
-	const report = yield* attempt("configuration.check", options, () => checkCmsConfiguration(options.rootDirectory, options.envFile || void 0, options.verbose));
-	if (options.json) yield* Console.log(JSON.stringify(report));
-	else yield* Console.log(renderConfigurationReport(report));
-	if (!report.compatible) return yield* options.json ? new JsonCommandFailed({}) : cliError("The candidate CMS configuration is incompatible with stored content.");
-})).pipe(Command.withDescription("Compare the candidate configuration with the accepted catalog and stored content"));
-const configuration = Command.make("configuration").pipe(Command.withSubcommands([configurationCheckCommand]));
-const full = Flag.Boolean("full").pipe(Flag.withDefault(false));
-const contentDirectory = Flag.String("content").pipe(Flag.withDefault(""));
-const administratorName = Flag.String("name").pipe(Flag.withDefault(""));
-const database = Flag.Boolean("database").pipe(Flag.withDefault(false));
-const media = Flag.Boolean("media").pipe(Flag.withDefault(false));
-const bootstrap = Flag.Boolean("bootstrap").pipe(Flag.withDefault(false));
-const yes = Flag.Boolean("yes").pipe(Flag.withDefault(false));
-const doctorCommand = Command.make("doctor", { full }, ({ full }) => Effect.gen(function* () {
-	const options = yield* root;
-	const report = yield* attempt("doctor.configuration", options, () => doctorCmsDevelopment(options.rootDirectory, full, options.envFile || void 0));
-	if (options.json) yield* Console.log(JSON.stringify(report));
-	else for (const check of report.checks) {
-		const icon = Match.value(check.status).pipe(Match.when("pass", () => "✓"), Match.when("fail", () => "✗"), Match.when("not-verified", () => "−"), Match.exhaustive);
-		yield* Console.log(`${icon} ${check.label}${check.detail ? `\n\n  ${check.detail}` : ""}`);
+//#endregion
+//#region ../cli/src/internal/commandOutput.ts
+const write = (value) => console.log(JSON.stringify(value));
+/** Keep framework help out of failed commands' stdout and render each failure once. */
+const run$4 = Effect.fn("Cli.output")((operation) => Effect.gen(function* () {
+	const output = [];
+	const current = yield* Console.Console;
+	const buffered = Object.assign(Object.create(current), { log: (...values) => {
+		output.push(format(...values));
+	} });
+	const result = yield* operation.pipe(Effect.provideService(Console.Console, buffered));
+	yield* Effect.sync(() => {
+		for (const line of output) current.log(line);
+	});
+	return result;
+}).pipe(Effect.onError((cause) => Effect.sync(() => {
+	if (Cause.hasInterruptsOnly(cause)) return;
+	const error = Cause.squash(cause);
+	if (error instanceof ImportError) {
+		console.error(JSON.stringify({ error: {
+			code: error._tag,
+			message: error.message,
+			phase: error.phase,
+			outcome: error.outcome,
+			uploadedMedia: error.uploadedMedia,
+			uncertainMediaId: error.uncertainMediaId,
+			cause: error.error
+		} }));
+		return;
 	}
-	if (!report.ok) return yield* options.json ? new JsonCommandFailed({}) : cliError("One or more CMS development checks failed.");
-})).pipe(Command.withDescription("Check local CMS configuration and infrastructure"));
-const bootstrapCommand = Command.make("bootstrap", {
-	contentDirectory,
-	administratorName,
-	publish
-}, ({ contentDirectory, administratorName, publish }) => Effect.gen(function* () {
-	const options = yield* root;
-	yield* attempt("bootstrap.environment", options, () => loadCmsProjectEnvironment(options.rootDirectory, options.envFile || void 0));
-	const administrator = yield* administratorOptions(administratorName, contentDirectory, publish, options, "bootstrap.credentials");
-	const result = yield* attempt("bootstrap.installation", options, () => bootstrapCmsDevelopment({
-		rootDir: options.rootDirectory,
-		envFile: options.envFile || void 0,
-		verbose: options.verbose,
-		...administrator
-	}));
-	if (options.json) yield* Console.log(JSON.stringify(result));
-	else yield* Console.log(`Bootstrap complete: administrator ${result.administrator}${result.contentApplied ? ", content applied" : ""}.`);
-})).pipe(Command.withDescription("Provision and initialize a local CMS installation"));
-const resetCommand = Command.make("reset", {
-	bootstrap,
-	contentDirectory,
-	database,
-	media,
-	publish,
-	yes
-}, ({ bootstrap, contentDirectory, database, media, publish, yes }) => Effect.gen(function* () {
-	const options = yield* root;
-	if (!database && !media) return yield* commandFailure("reset.arguments", options, /* @__PURE__ */ new Error("Choose --database, --media, or both."));
-	if (bootstrap && yes) yield* attempt("reset.environment", options, () => loadCmsProjectEnvironment(options.rootDirectory, options.envFile || void 0));
-	const administrator = bootstrap && yes ? yield* administratorOptions("", contentDirectory, publish, options, "reset.credentials") : void 0;
-	const result = yield* attempt("reset.installation", options, () => resetCmsDevelopment({
-		rootDir: options.rootDirectory,
-		envFile: options.envFile || void 0,
+	if (error instanceof CliError.ShowHelp) {
+		const details = error.errors.map((item) => ({
+			code: `Cli.${item._tag}`,
+			message: item.message
+		}));
+		console.error(JSON.stringify({ error: {
+			code: "Cli.InvalidArguments",
+			message: details.map((item) => item.message).join(" ") || "Choose a command. Run cms --help.",
+			details
+		} }));
+		return;
+	}
+	console.error(JSON.stringify({ error: CliError.isCliError(error) ? {
+		code: `Cli.${error._tag}`,
+		message: error.message
+	} : errorDetails(error) }));
+}))));
+//#endregion
+//#region ../cli/src/Lifecycle.ts
+var LifecycleError = class extends Schema.TaggedError()("Lifecycle.Error", { message: Schema.String }) {};
+/** The framework owns its launcher; the CLI owns the server's scope and installation workflow. */
+var DevelopmentServer = class extends Context.Service()("cli/DevelopmentServer") {};
+//#endregion
+//#region ../cli/src/internal/project.ts
+const attempt = (message, operation) => Effect.tryPromise({
+	try: operation,
+	catch: (error) => error instanceof LifecycleError ? error : new LifecycleError({ message })
+});
+const Phase = Schema.Literals([
+	"initialize",
+	"import",
+	"accounts",
+	"seo",
+	"ready"
+]);
+const exists = async (file) => {
+	try {
+		await stat(file);
+		return true;
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return false;
+		throw error;
+	}
+};
+const load = Effect.fn("Project.load")(function* (directory, envName = "development", envFile, progressScope = "origin") {
+	const configured = yield* load$1(directory, envName, envFile);
+	const data = join(configured.project, ".data");
+	const database = resolve(configured.project, configured.configuration.runtime.databaseFile);
+	const target = progressScope === "database" ? database : `${configured.site.origin}\0${database}`;
+	const identity = createHash("sha256").update(target).digest("hex").slice(0, 16);
+	return {
+		...configured,
+		data,
 		database,
-		media,
-		yes,
-		verbose: options.verbose,
-		bootstrap: administrator
+		phaseFile: join(data, `cms-bootstrap-${identity}.json`)
+	};
+});
+/** Only an explicit preparation command generates a secret; config loading and server startup never do. */
+const prepare$1 = Effect.fn("Project.prepare")(function* (project) {
+	if (project.configuration.runtime.installationSecret) return project;
+	if (process.env.NUXT_CMS_INSTALLATION_SECRET !== void 0) return yield* new LifecycleError({ message: "NUXT_CMS_INSTALLATION_SECRET is explicitly empty. Unset it to generate a persistent secret, or provide a real secret." });
+	const secret = randomBytes(32).toString("hex");
+	const contents = yield* attempt(`Could not read ${project.environmentFile}.`, async () => {
+		return (await exists(project.environmentFile) ? await readFile(project.environmentFile, "utf8") : "").replace(/^(?:export\s+)?NUXT_CMS_INSTALLATION_SECRET\s*=.*$/gmu, "");
+	});
+	yield* writeAtomic(project.environmentFile, `${contents}\nNUXT_CMS_INSTALLATION_SECRET=${secret}\n`, 384).pipe(Effect.mapError(() => new LifecycleError({ message: `Could not save the installation secret to ${project.environmentFile}.` })));
+	return {
+		...project,
+		environment: {
+			...project.environment,
+			NUXT_CMS_INSTALLATION_SECRET: secret
+		},
+		configuration: {
+			...project.configuration,
+			runtime: {
+				...project.configuration.runtime,
+				installationSecret: secret
+			}
+		}
+	};
+});
+const checkLocal = (project) => {
+	const { site } = project;
+	if (site.protocol !== "http:" || site.hostname !== "127.0.0.1" || !site.port) return Effect.fail(new LifecycleError({ message: "Running Nuxt locally requires an HTTP origin on 127.0.0.1 with an explicit port. Set runtime.origin or NUXT_CMS_ORIGIN." }));
+	if (dirname(project.database) !== project.data) return Effect.fail(new LifecycleError({ message: "Local development and reset require a database file inside the project .data directory." }));
+	return Effect.void;
+};
+const lock = Effect.fn("Project.lock")(function* (directory) {
+	const data = resolve(directory, ".data");
+	const file = join(data, "cms.lock");
+	return yield* Effect.acquireRelease(attempt(`Could not acquire local development ownership in ${data}. Check directory access and the lock database.`, async () => {
+		await mkdir(data, { recursive: true });
+		const owner = new DatabaseSync(file, { timeout: 0 });
+		try {
+			owner.exec("BEGIN EXCLUSIVE");
+			return owner;
+		} catch (error) {
+			owner.close();
+			if (error instanceof Error && "errcode" in error && error.errcode === 5) throw new LifecycleError({ message: `Another CMS lifecycle command owns ${resolve(directory)}. Stop it before preparing, setting up, starting, or resetting.` });
+			throw error;
+		}
+	}), (owned) => Effect.sync(() => owned.close()));
+});
+const checkPort = (site) => attempt(`${site.origin} is already in use. Stop the running server or change runtime.origin or NUXT_CMS_ORIGIN.`, () => new Promise((fulfill, reject) => {
+	const probe = createServer();
+	probe.once("error", reject);
+	probe.listen(Number(site.port), site.hostname, () => probe.close((error) => error ? reject(error) : fulfill()));
+}));
+const readPhase = (project) => attempt("Could not read local initialization progress. Inspect .data/cms-bootstrap-*.json.", async () => await exists(project.phaseFile) ? Schema.decodeSync(Schema.fromJsonString(Phase))(await readFile(project.phaseFile, "utf8")) : void 0);
+const writePhase = (project, phase) => writeAtomic(project.phaseFile, JSON.stringify(phase), 384).pipe(Effect.mapError(() => new LifecycleError({ message: "Could not save initialization progress." })));
+const reset = (project) => attempt("Could not retain the previous local database before reset.", async () => {
+	const backup = join(project.data, `before-reset-${Date.now()}`);
+	await mkdir(backup);
+	for (const suffix of [
+		"",
+		"-wal",
+		"-shm"
+	]) if (await exists(`${project.database}${suffix}`)) await rename(`${project.database}${suffix}`, join(backup, `cms.sqlite${suffix}`));
+	await rm(project.phaseFile, { force: true });
+	return backup;
+});
+//#endregion
+//#region ../cli/src/internal/provision.ts
+const run$3 = Effect.fn("Provision.run")(function* (project) {
+	const provision = project.configuration.provision;
+	const runtime = project.configuration.runtime.s3;
+	if (provision?.compose) {
+		console.log("Starting configured infrastructure…");
+		if ((yield* (yield* ChildProcess.make("docker", [
+			"compose",
+			"-f",
+			resolve(project.project, provision.compose.file),
+			"up",
+			"-d",
+			"--wait",
+			provision.compose.service
+		], {
+			cwd: project.project,
+			env: project.environment,
+			extendEnv: true,
+			stdin: "ignore",
+			stdout: "inherit",
+			stderr: "inherit"
+		}).pipe(Effect.mapError(() => new LifecycleError({ message: "Could not start configured infrastructure. Start Docker and check the Compose file." })))).exitCode) !== 0) return yield* new LifecycleError({ message: "Infrastructure failed to start. Check Docker Compose output and rerun." });
+	}
+	if (!provision?.createBucket) return;
+	const client = yield* Effect.acquireRelease(Effect.try({
+		try: () => new S3Client(mediaStorageOptions(runtime)),
+		catch: () => new LifecycleError({ message: "Bucket creation requires an S3 bucket, region, and a complete credential pair or cloud identity." })
+	}), (owned) => Effect.sync(() => owned.destroy()));
+	yield* attempt("Could not prepare the media bucket. Check runtime.s3 and its NUXT_CMS_S3_* overrides.", async (signal) => {
+		const Bucket = runtime.bucket;
+		try {
+			await client.send(new HeadBucketCommand({ Bucket }), { abortSignal: signal });
+		} catch (error) {
+			if (!(error instanceof S3ServiceException && error.$metadata.httpStatusCode === 404)) throw error;
+			const location = Object.values(BucketLocationConstraint).find((region) => region === runtime.region);
+			if (runtime.region !== "us-east-1" && !location) throw new LifecycleError({ message: "Bucket creation requires a region supported by the S3 client." });
+			await client.send(new CreateBucketCommand({
+				Bucket,
+				...runtime.region === "us-east-1" ? void 0 : { CreateBucketConfiguration: { LocationConstraint: location } }
+			}), { abortSignal: signal });
+		}
+	}).pipe(Effect.timeoutOrElse({
+		duration: "15 seconds",
+		orElse: () => Effect.fail(new LifecycleError({ message: "Media bucket preparation timed out. Check the S3 endpoint." }))
 	}));
-	if (options.json) return yield* Console.log(JSON.stringify(result));
-	for (const target of result.targets) yield* Console.log(`${result.executed ? "✓ Reset" : "Would reset"} ${target}`);
-	if (!result.executed) yield* Console.log("Dry run only. Add --yes to execute these exact targets.");
-})).pipe(Command.withDescription("Reset CMS-owned local data with a dry-run default"));
-const dev = Command.make("dev").pipe(Command.withSubcommands([
-	doctorCommand,
-	bootstrapCommand,
-	resetCommand
-]));
-const administratorOptions = Effect.fn("CmsCli.dev.administratorOptions")(function* (name, content, publishContent, options, phase) {
-	const email = yield* Config.String("CMS_EMAIL").pipe(Config.withDefault(""));
-	const configuredPassword = yield* Config.Redacted("CMS_PASSWORD").pipe(Config.option);
-	if (!email) return yield* commandFailure(phase, options, /* @__PURE__ */ new Error("CMS_EMAIL is required."));
-	if (Option.isNone(configuredPassword) && options.json) return yield* commandFailure(phase, options, /* @__PURE__ */ new Error("CMS_PASSWORD is required."));
-	const password = Option.isSome(configuredPassword) ? Redacted.value(configuredPassword.value) : Redacted.value(yield* Prompt.Password({ message: `Password for ${email}` }));
-	if (!password) return yield* commandFailure(phase, options, /* @__PURE__ */ new Error("CMS_PASSWORD is required."));
+});
+//#endregion
+//#region ../cli/src/internal/bootstrap.ts
+const ready = Effect.fn("Bootstrap.ready")(function* (connection) {
+	while (true) {
+		const result = yield* connection.readiness().pipe(Effect.result);
+		if (Result.isSuccess(result)) {
+			if (result.success.status === "ready") return;
+			const failures = Object.values(result.success.checks).filter((check) => check.status === "failed");
+			if (result.success.checks.installation.action !== "retry" && failures.some((check) => check.action !== "retry")) return yield* new LifecycleError({ message: failures.map((check) => check.message).join(" ") });
+		}
+		yield* Effect.sleep("500 millis");
+	}
+}, (operation) => operation.pipe(Effect.timeoutOrElse({
+	duration: "60 seconds",
+	orElse: () => Effect.fail(new LifecycleError({ message: "CMS startup timed out. Inspect the server output and run cms doctor." }))
+})));
+const run$2 = Effect.fn("Bootstrap.run")(function* (project, connection) {
+	const bootstrap = project.configuration.bootstrap;
+	if (!bootstrap) return;
+	let phase = yield* readPhase(project);
+	const { initialized } = yield* connection.api.session.installation();
+	if (!initialized) {
+		phase = "initialize";
+		yield* writePhase(project, phase);
+	} else if (!phase || phase === "ready") return;
+	const administrator = yield* Schema.decodeEffect(Administrator)(bootstrap.administrator).pipe(Effect.mapError(() => new LifecycleError({ message: "Bootstrap requires a valid administrator email, password of at least eight characters, and name. Configure bootstrap.administrator or its NUXT_CMS_BOOTSTRAP_ADMINISTRATOR_* overrides." })));
+	if (phase === "initialize") {
+		if (initialized) yield* connection.signIn(administrator.email, administrator.password);
+		else yield* connection.initialize({
+			...administrator,
+			installationSecret: project.configuration.runtime.installationSecret
+		});
+		phase = "import";
+		yield* writePhase(project, phase);
+	} else yield* connection.signIn(administrator.email, administrator.password);
+	if (phase === "import") {
+		const snapshot = bootstrap.snapshot;
+		if (snapshot) {
+			console.log("Importing the configured snapshot…");
+			yield* make$1(connection).import(resolve(project.project, snapshot));
+		}
+		phase = "accounts";
+		yield* writePhase(project, phase);
+	}
+	if (phase === "accounts") {
+		for (const account of bootstrap.accounts) {
+			const { people } = yield* connection.api.people.list({ query: { search: account.email } });
+			const person = people.find((person) => person.email === account.email);
+			if (!person) return yield* new LifecycleError({ message: `The configured bootstrap account ${account.email} is missing from the snapshot.` });
+			const invitation = yield* connection.api.people.invite({ params: { id: person.id } });
+			yield* connection.resetPassword(invitation.token, account.password);
+		}
+		phase = "seo";
+		yield* writePhase(project, phase);
+	}
+	if (phase === "seo") {
+		const seo = yield* connection.api.seo.state();
+		const updated = seo.working.settings.canonicalOrigin !== project.site.origin ? yield* connection.api.seo.save({ payload: {
+			expectedVersion: seo.working.version,
+			settings: {
+				...seo.working.settings,
+				canonicalOrigin: project.site.origin
+			}
+		} }) : seo;
+		if (updated.published.settings.canonicalOrigin !== project.site.origin) yield* connection.api.seo.publish({ payload: {
+			expectedVersion: updated.working.version,
+			confirmedSiteWideChange: true
+		} });
+		yield* (yield* SessionStore).save(project.site, connection.session);
+		yield* writePhase(project, "ready");
+	}
+});
+//#endregion
+//#region ../cli/src/internal/development.ts
+const run$1 = Effect.fn("Development.run")(function* (mode, directory, envName = "development", envFile) {
+	yield* lock(directory);
+	const loaded = yield* load(directory, envName, envFile, "database");
+	yield* checkLocal(loaded);
+	yield* checkPort(loaded.site);
+	const project = yield* prepare$1(loaded);
+	if (mode === "reset" && !project.configuration.bootstrap?.snapshot) return yield* new LifecycleError({ message: "cms reset requires bootstrap.snapshot in cms.config.ts." });
+	const snapshot = project.configuration.bootstrap?.snapshot;
+	if (snapshot) yield* attempt(`Could not access the demo snapshot ${snapshot}.`, async () => {
+		if (!await exists(resolve(project.project, snapshot))) throw new Error("Missing snapshot");
+	});
+	yield* run$3(project);
+	if (mode === "reset") console.log(`Previous database retained in ${yield* reset(project)}`);
+	const server = yield* (yield* DevelopmentServer).start({
+		project: project.project,
+		site: project.site,
+		environment: project.environment,
+		envName: project.envName,
+		environmentFile: project.environmentFile,
+		watch: mode === "dev"
+	});
+	const connection = yield* make$2(project.site);
+	yield* Effect.raceFirst(Effect.gen(function* () {
+		yield* ready(connection);
+		yield* run$2(project, connection);
+		yield* ready(connection);
+	}), server.exited);
+	console.log(`CMS ready\nWebsite: ${project.site.origin}\nStudio: ${project.site.origin}/_cms/app`);
+	if (mode === "reset") console.log("Demo restored. Run cms dev.");
+	else return yield* server.exited;
+}, Effect.scoped);
+//#endregion
+//#region ../cli/src/Command.ts
+var UsageError = class extends Schema.TaggedError()("Cli.UsageError", { message: Schema.String }) {};
+const root = Command.make("cms").pipe(Command.withDescription("Develop and operate a CMS installation. Commands never prompt."), Command.withSharedFlags({
+	project: Flag.String("project").pipe(Flag.withDefault(".")),
+	envFile: Flag.String("env-file").pipe(Flag.optional),
+	envName: Flag.String("envName").pipe(Flag.withDefault("development"))
+}));
+const context = Effect.gen(function* () {
+	const { project, envName, envFile } = yield* root;
+	return yield* load$1(project, envName, Option.getOrUndefined(envFile));
+});
+const authenticated = Effect.gen(function* () {
+	const current = yield* context;
+	const session = yield* (yield* SessionStore).read(current.site);
+	const connection = yield* make$2(current.site, session);
 	return {
-		content: content || void 0,
+		...current,
+		connection
+	};
+});
+const credentials = {
+	username: Flag.String("username").pipe(Flag.optional),
+	passwordStdin: Flag.Boolean("password-stdin").pipe(Flag.withDefault(false))
+};
+const readCredentials = Effect.fn("Cli.credentials")(function* (username, passwordStdin) {
+	const current = yield* context;
+	let password;
+	if (passwordStdin) {
+		const stdio = yield* Stdio.Stdio;
+		if (yield* stdio.stdinIsTerminal) return yield* new UsageError({ message: "Pipe a password into --password-stdin." });
+		password = (yield* stdio.stdin.pipe(Stream.decodeText, Stream.mkString)).replace(/\r?\n$/u, "");
+	}
+	const email = Option.getOrUndefined(username);
+	if (!email || !password) return yield* new UsageError({ message: "Supply --username and pipe a password into --password-stdin." });
+	return {
+		...current,
 		email,
-		name: name || (yield* Config.String("CMS_NAME").pipe(Config.withDefault("Administrator"))),
-		password,
-		publish: publishContent
+		password
 	};
 });
-function cliError(message) {
-	return new CliError.UserError({
-		cause: new Error(message),
-		userMessage: message
+const snapshot = Argument.String("snapshot.zip");
+const force = Flag.Boolean("force").pipe(Flag.withDefault(false));
+const login = Command.make("login", credentials).pipe(Command.withHandler(Effect.fn("Cli.login")(function* ({ username, passwordStdin }) {
+	const { site, email, password } = yield* readCredentials(username, passwordStdin);
+	const connection = yield* make$2(site);
+	const actor = yield* connection.signIn(email, password);
+	yield* (yield* SessionStore).save(site, connection.session);
+	write({
+		site: site.origin,
+		actor
 	});
-}
-var CliOperationFailed = class extends Schema.TaggedError()("CliOperationFailed", { cause: Schema.Defect() }) {};
-var JsonCommandFailed = class extends Schema.TaggedError()("JsonCommandFailed", {}) {
-	[Runtime.errorExitCode] = 1;
-	[Runtime.errorReported] = false;
-};
-function attempt(phase, options, operation) {
-	return Effect.tryPromise({
-		try: () => Promise.resolve(operation()),
-		catch: (cause) => new CliOperationFailed({ cause })
-	}).pipe(Effect.catch((failure) => commandFailure(phase, options, failure.cause)));
-}
-function commandFailure(phase, options, cause) {
-	return Effect.gen(function* () {
-		const diagnostic = diagnosticFromCause(phase, cause);
-		if (!options.json) return yield* cliError(renderDiagnostic(diagnostic, options.verbose));
-		const { details: _details, ...output } = diagnostic;
-		yield* Console.log(JSON.stringify(output));
-		return yield* new JsonCommandFailed({});
+})));
+const prepare = Command.make("prepare").pipe(Command.withDescription("Prepare the configured infrastructure and persist a missing installation secret."), Command.withHandler(() => Effect.gen(function* () {
+	const { project, envName, envFile } = yield* root;
+	yield* lock(project);
+	const configured = yield* prepare$1(yield* load(project, envName, Option.getOrUndefined(envFile)));
+	yield* run$3(configured);
+	write({
+		site: configured.site.origin,
+		prepared: true
 	});
-}
-root.pipe(Command.withSubcommands([
-	configuration,
-	content,
-	dev
-]), Command.run({ version }), Effect.provide(Layer.mergeAll(NodeFileSystem.layer, NodePath.layer, NodeCrypto.layer, NodeTerminal.layer, NodeStdio.layer, NodeChildProcessSpawner.layer.pipe(Layer.provide(Layer.merge(NodeFileSystem.layer, NodePath.layer))), FetchHttpClient.layer)), NodeRuntime.runMain);
-
+})));
+const setup = Command.make("setup").pipe(Command.withDescription("Bootstrap a running installation from cms.config.ts, then save the administrator session. Existing authored installations are preserved."), Command.withHandler(() => Effect.gen(function* () {
+	const { project, envName, envFile } = yield* root;
+	yield* lock(project);
+	const configured = yield* load(project, envName, Option.getOrUndefined(envFile));
+	if (!configured.configuration.bootstrap) return yield* new UsageError({ message: "Setup requires bootstrap.administrator in cms.config.ts." });
+	const connection = yield* make$2(configured.site);
+	yield* ready(connection);
+	yield* run$2(configured, connection);
+	write({
+		site: configured.site.origin,
+		initialized: true
+	});
+})));
+const whoami = Command.make("whoami").pipe(Command.withHandler(() => Effect.gen(function* () {
+	const { site, connection } = yield* authenticated;
+	write({
+		site: site.origin,
+		actor: yield* connection.api.connection.user()
+	});
+})));
+const doctor = Command.make("doctor").pipe(Command.withDescription("Read-only installation diagnostics; no login required. Prints one JSON object with site, status, and checks (connection, configuration, database, media, installation). Each check has status, code, message, and action. Exit 0 means ready; exit 1 means unavailable. Requests time out after five seconds."), Command.withHandler(() => Effect.gen(function* () {
+	let site = null;
+	const result = yield* Effect.gen(function* () {
+		const current = yield* context;
+		site = current.site.origin;
+		const report = yield* (yield* make$2(current.site)).readiness();
+		return {
+			status: report.status,
+			checks: {
+				connection: {
+					status: "passed",
+					code: "connection_ready",
+					action: "none",
+					message: "The CMS readiness endpoint returned a valid report."
+				},
+				...report.checks
+			}
+		};
+	}).pipe(Effect.catch((error) => {
+		const connection = error instanceof ReadinessError ? {
+			status: "failed",
+			code: error.code,
+			message: error.message,
+			action: error.action
+		} : {
+			status: "failed",
+			code: "client_configuration_invalid",
+			action: "check_configuration",
+			message: "Check --project, --env-file, and runtime.origin or NUXT_CMS_ORIGIN. Use HTTPS, or HTTP on localhost, without credentials in the URL."
+		};
+		const skipped = {
+			status: "skipped",
+			code: "report_unavailable",
+			action: connection.action,
+			message: "The CMS readiness report could not be obtained."
+		};
+		return Effect.succeed({
+			status: "unavailable",
+			checks: {
+				connection,
+				configuration: skipped,
+				database: skipped,
+				media: skipped,
+				installation: skipped
+			}
+		});
+	}));
+	write({
+		site,
+		...result
+	});
+	if (result.status === "unavailable") process.exitCode = 1;
+})));
+const logout = Command.make("logout").pipe(Command.withHandler(() => Effect.gen(function* () {
+	const { site } = yield* context;
+	const sessions = yield* SessionStore;
+	yield* (yield* make$2(site, yield* sessions.read(site))).signOut();
+	yield* sessions.remove(site);
+	write({
+		site: site.origin,
+		signedOut: true
+	});
+})));
+const exportCommand = Command.make("export", {
+	snapshot,
+	force
+}).pipe(Command.withDescription("Export full CMS history and media into one ZIP snapshot. --force replaces an existing file."), Command.withHandler(Effect.fn("Cli.export")(function* ({ snapshot, force }) {
+	const { site, connection } = yield* authenticated;
+	write({
+		site: site.origin,
+		...yield* make$1(connection).export(snapshot, force)
+	});
+})));
+const importCommand = Command.make("import", {
+	snapshot,
+	dryRun: Flag.Boolean("dry-run").pipe(Flag.withDefault(false)),
+	replace: Flag.Boolean("replace").pipe(Flag.withDefault(false))
+}).pipe(Command.withDescription("Import a CMS ZIP snapshot with full history and website selection, keeping local passwords. --dry-run previews it; --replace replaces authored data."), Command.withHandler(Effect.fn("Cli.import")(function* ({ snapshot, dryRun, replace }) {
+	const { site, connection } = yield* authenticated;
+	write({
+		site: site.origin,
+		...yield* make$1(connection).import(snapshot, {
+			dryRun,
+			replace
+		})
+	});
+})));
+const documents = Command.make("documents").pipe(Command.withSubcommands([Command.make("list").pipe(Command.withHandler(() => Effect.gen(function* () {
+	const { connection } = yield* authenticated;
+	write(yield* connection.api.documents.catalog());
+})))]));
+const publication = Command.make("publication").pipe(Command.withSubcommands([Command.make("plan", { file: Argument.String("selection-file") }).pipe(Command.withHandler(Effect.fn("Cli.publicationPlan")(function* ({ file }) {
+	const { connection } = yield* authenticated;
+	const fs = yield* FileSystem.FileSystem;
+	const payload = yield* Schema.decodeEffect(Schema.fromJsonString(PublicationSelection))(yield* fs.readFileString(file));
+	write(yield* connection.api.publication.plan({ payload }));
+}))), Command.make("apply", { file: Argument.String("plan-file") }).pipe(Command.withHandler(Effect.fn("Cli.publicationApply")(function* ({ file }) {
+	const { connection } = yield* authenticated;
+	const fs = yield* FileSystem.FileSystem;
+	const plan = yield* Schema.decodeEffect(Schema.fromJsonString(PublicationPlan))(yield* fs.readFileString(file));
+	write(yield* connection.api.publication.apply({ payload: {
+		changes: plan.changes,
+		stamp: plan.stamp
+	} }));
+})))]));
+const localCommands = ["dev", "reset"].map((mode) => Command.make(mode).pipe(Command.withDescription(mode === "dev" ? "Prepare and run local Nuxt development, initializing a fresh installation from cms.config.ts." : "Stop development first. Retain the local database and restore the configured demo snapshot."), Command.withHandler(() => Effect.gen(function* () {
+	const { project, envName, envFile } = yield* root;
+	yield* run$1(mode, project, envName, Option.getOrUndefined(envFile));
+}))));
+const run = Command.run(root.pipe(Command.withSubcommands([
+	...localCommands,
+	prepare,
+	setup,
+	login,
+	whoami,
+	doctor,
+	logout,
+	exportCommand,
+	importCommand,
+	documents,
+	publication
+])), {
+	version: "0.0.0",
+	renderErrors: false
+}).pipe(Effect.scoped, Effect.provide(Layer.mergeAll(layer$2, NodeServices.layer, CliConfig.layer({ builtIns: [
+	GlobalFlag.Help,
+	GlobalFlag.Version,
+	GlobalFlag.Completions
+] }), layer$1(join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "phtngyn-cms")).pipe(Layer.provide(NodeServices.layer)))), run$4);
+//#endregion
+//#region src/internal/developmentServer.ts
+const prepareStudio = Effect.fn("Development.prepareStudio")(function* (packageRoot, watch) {
+	if (existsSync(resolve(packageRoot, "studio/host.js"))) return;
+	const studio = resolve(packageRoot, "../studio");
+	if (!existsSync(resolve(studio, "package.json"))) return yield* new LifecycleError({ message: "CMS Studio assets are missing. Reinstall @phtngyn/cms." });
+	const vite = yield* Effect.tryPromise({
+		try: () => import(pathToFileURL(createRequire(resolve(studio, "../../package.json")).resolve("vite")).href),
+		catch: () => new LifecycleError({ message: "Could not load the workspace Studio builder." })
+	});
+	console.log(watch ? "Building and watching Studio…" : "Building Studio…");
+	if (!watch) {
+		yield* Effect.tryPromise({
+			try: () => vite.build({
+				root: studio,
+				logLevel: "warn"
+			}),
+			catch: () => new LifecycleError({ message: "Studio build failed. Inspect the build output." })
+		});
+		return;
+	}
+	const watcher = yield* Effect.acquireRelease(Effect.tryPromise({
+		try: () => vite.build({
+			root: studio,
+			logLevel: "warn",
+			build: { watch: {} }
+		}),
+		catch: () => new LifecycleError({ message: "Could not start the Studio watcher." })
+	}), (owned) => Effect.promise(async () => {
+		if ("close" in owned) await owned.close();
+	}));
+	if (!("on" in watcher)) return yield* new LifecycleError({ message: "Studio watcher did not start." });
+	yield* Effect.callback((resume) => {
+		watcher.on("event", (event) => {
+			if (event.code === "BUNDLE_END") {
+				event.result.close();
+				resume(Effect.void);
+			} else if (event.code === "ERROR") {
+				console.error(event.error);
+				resume(Effect.fail(new LifecycleError({ message: "Studio build failed. Inspect the build output." })));
+			}
+		});
+	});
+});
+const layer = (packageRoot) => Layer.succeed(DevelopmentServer, { start: Effect.fn("Development.startNuxt")(function* (options) {
+	const entry = yield* Effect.try({
+		try: () => {
+			const manifest = createRequire(resolve(options.project, "package.json")).resolve("nuxt/package.json");
+			return resolve(dirname(manifest), "bin/nuxt.mjs");
+		},
+		catch: () => new LifecycleError({ message: "Nuxt is missing from the app. Install its dependencies and rerun cms dev." })
+	});
+	yield* prepareStudio(packageRoot, options.watch);
+	return { exited: (yield* ChildProcess.make(process.execPath, [
+		entry,
+		"dev",
+		"--host",
+		options.site.hostname,
+		"--port",
+		options.site.port,
+		"--envName",
+		options.envName,
+		"--dotenv",
+		options.environmentFile
+	], {
+		cwd: options.project,
+		env: options.environment,
+		extendEnv: true,
+		stdin: "ignore",
+		stdout: "inherit",
+		stderr: "inherit",
+		forceKillAfter: "5 seconds"
+	}).pipe(Effect.mapError(() => new LifecycleError({ message: "Could not start Nuxt. Install the app dependencies and rerun cms dev." })))).exitCode.pipe(Effect.flatMap((code) => Effect.fail(new LifecycleError({ message: `Nuxt exited with code ${code}. Inspect the server output.` }))), Effect.mapError((error) => error instanceof LifecycleError ? error : new LifecycleError({ message: "Could not observe the Nuxt process." }))) };
+}) });
+//#endregion
+//#region src/cli.ts
+NodeRuntime.runMain(run.pipe(Effect.provide(layer(resolve(dirname(fileURLToPath(import.meta.url)), "..")))), { disableErrorReporting: true });
 //#endregion
-export {  };
-//# sourceMappingURL=cli.js.map
+export {};