atlas-core 0.1.0

package/dist/application.js

@@ -0,0 +1,967 @@
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { PACKAGE_IMAGE, PACKAGE_NAME, PACKAGE_VERSION } from "./package-metadata.js";
+const PROJECT_NAME = "atlas_core_production";
+const POSTGRES_VOLUME = `${PROJECT_NAME}_postgres_data`;
+const MINIO_VOLUME = `${PROJECT_NAME}_minio_data`;
+const API_CONTAINER = `${PROJECT_NAME}_api`;
+const POSTGRES_CONTAINER = `${PROJECT_NAME}_postgres`;
+const MINIO_CONTAINER = `${PROJECT_NAME}_minio`;
+const MINIO_INIT_CONTAINER = `${PROJECT_NAME}_minio_init`;
+const INIT_LOCK_NETWORK = `${PROJECT_NAME}_init_lock`;
+const REQUIRED_SERVICES = new Set(["api", "minio", "postgres"]);
+const COMPOSE_VARIABLES = [
+    "API_AUTH_KEY",
+    "ATLAS_ADMIN_PASSWORD",
+    "ATLAS_CORE_IMAGE",
+    "CORS_ORIGINS",
+    "CORS_ORIGIN_PATTERNS",
+    "DATABASE_MAX_OVERFLOW",
+    "DATABASE_POOL_IDLE_TIMEOUT",
+    "DATABASE_POOL_PRE_PING",
+    "DATABASE_POOL_RECYCLE",
+    "DATABASE_POOL_SIZE",
+    "DATABASE_POOL_TIMEOUT",
+    "MAX_UPLOAD_SIZE_MB",
+    "MAX_VIEW_SIZE_MB",
+    "MINIO_BUCKET",
+    "MINIO_ROOT_PASSWORD",
+    "MINIO_ROOT_USER",
+    "POSTGRES_PASSWORD",
+    "TRUSTED_PROXY_CIDRS"
+];
+const SUPPORTED_PLATFORMS = new Set(["darwin", "linux"]);
+const SUPPORTED_ARCHITECTURES = new Set(["arm64", "x64"]);
+const CONFIG_SCHEMA = 1;
+const COMPOSE_WAIT_SECONDS = "120";
+const MINIMUM_COMPOSE_VERSION = [2, 17, 0];
+const UNRELEASED_IMAGE = "ghcr.io/the-drunken-coder/atlas-core:unreleased";
+const SUPPORTED_DOCKER_ARCHITECTURES = new Set(["amd64", "arm64", "aarch64", "x86_64"]);
+const usage = `Atlas Core ${PACKAGE_VERSION}
+
+Usage:
+  atlas-core init
+  atlas-core start
+  atlas-core stop
+  atlas-core restart
+  atlas-core status
+  atlas-core logs [core|postgres|minio] [--follow]
+  atlas-core doctor
+  atlas-core version
+  atlas-core help
+
+Atlas Core stores durable configuration in ~/.atlas/core by default.
+Set ATLAS_CORE_HOME to use a different directory.
+`;
+class UsageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UsageError";
+    }
+}
+class ProcessCommandRunner {
+    async run(command, args, options = {}) {
+        return await new Promise((resolve, reject) => {
+            const child = spawn(command, args, {
+                cwd: options.cwd,
+                env: options.env,
+                stdio: options.inherit ? "inherit" : ["ignore", "pipe", "pipe"]
+            });
+            let stdout = "";
+            let stderr = "";
+            child.stdout?.setEncoding("utf8");
+            child.stderr?.setEncoding("utf8");
+            child.stdout?.on("data", (chunk) => {
+                stdout += chunk;
+            });
+            child.stderr?.on("data", (chunk) => {
+                stderr += chunk;
+            });
+            child.once("error", reject);
+            child.once("close", (status) => {
+                resolve({ status: status ?? 1, stdout, stderr });
+            });
+        });
+    }
+}
+class AtlasCoreDeployment {
+    #configDir;
+    #envFile;
+    #stateFile;
+    #initLockFile;
+    #composeFile;
+    #initComposeFile;
+    #runner;
+    #stdout;
+    #stderr;
+    #env;
+    #platform;
+    #architecture;
+    #nodeVersion;
+    #now;
+    #createSecret;
+    #imageReference;
+    constructor(context) {
+        this.#configDir = resolveConfigDirectory(context.env.ATLAS_CORE_HOME, context.homeDir);
+        this.#envFile = join(this.#configDir, ".env");
+        this.#stateFile = join(this.#configDir, "state.json");
+        this.#initLockFile = join(this.#configDir, ".init.lock");
+        this.#composeFile = join(context.packageRoot, "assets", "docker-compose.yml");
+        this.#initComposeFile = join(context.packageRoot, "assets", "docker-compose.init.yml");
+        this.#runner = context.runner;
+        this.#stdout = context.stdout;
+        this.#stderr = context.stderr;
+        this.#env = context.env;
+        this.#platform = context.platform;
+        this.#architecture = context.architecture;
+        this.#nodeVersion = context.nodeVersion;
+        this.#now = context.now;
+        this.#createSecret = context.createSecret;
+        this.#imageReference = context.imageReference;
+    }
+    async init() {
+        const dockerEngineId = await this.#preflight();
+        this.#prepareConfigDirectory();
+        this.#acquireInitLock();
+        try {
+            await this.#acquireDockerInitLock(dockerEngineId);
+            try {
+                await this.#initialize(dockerEngineId);
+            }
+            finally {
+                await this.#releaseDockerInitLock();
+            }
+        }
+        finally {
+            this.#releaseInitLock();
+        }
+    }
+    async #initialize(dockerEngineId) {
+        const hasEnv = existsSync(this.#envFile);
+        const hasState = existsSync(this.#stateFile);
+        if (hasEnv)
+            this.#assertPrivateFile(this.#envFile);
+        if (hasState)
+            this.#assertPrivateFile(this.#stateFile);
+        const existingState = this.#readState();
+        if (hasState && !existingState) {
+            throw new Error(`${this.#stateFile} is invalid. Initialization stopped so existing storage is not adopted.`);
+        }
+        if (existingState && existingState.schema !== CONFIG_SCHEMA) {
+            throw new Error(`Atlas Core state schema ${existingState.schema} is not supported by this CLI.`);
+        }
+        if (existingState?.phase === "ready") {
+            if (!hasEnv)
+                throw new Error(`Atlas Core state exists without ${this.#envFile}. Restore the matching credentials.`);
+            this.#assertStateMatchesRuntime(existingState, dockerEngineId);
+            this.#stdout.write(`Atlas Core is already initialized at ${this.#configDir}.\n`);
+            return;
+        }
+        if (existingState)
+            this.#assertStateMatchesRuntime(existingState, dockerEngineId);
+        if (hasEnv && !existingState) {
+            throw new Error(`Atlas Core found ${this.#envFile} without matching initialization state. ` +
+                "Initialization stopped so arbitrary credentials cannot adopt existing storage.");
+        }
+        const [hasPostgres, hasMinio, hasApiContainer, hasPostgresContainer, hasMinioContainer, hasMinioInitContainer] = await Promise.all([
+            this.#volumeExists(POSTGRES_VOLUME),
+            this.#volumeExists(MINIO_VOLUME),
+            this.#containerExists(API_CONTAINER),
+            this.#containerExists(POSTGRES_CONTAINER),
+            this.#containerExists(MINIO_CONTAINER),
+            this.#containerExists(MINIO_INIT_CONTAINER)
+        ]);
+        if (!hasEnv &&
+            (hasPostgres || hasMinio || hasApiContainer || hasPostgresContainer || hasMinioContainer || hasMinioInitContainer)) {
+            throw new Error("Atlas Core found containers or durable volumes without matching CLI configuration. " +
+                "Initialization stopped so existing data cannot be adopted with new credentials.");
+        }
+        if (hasEnv && (hasPostgres || hasApiContainer || hasPostgresContainer || hasMinioInitContainer)) {
+            throw new Error("Atlas Core found an incomplete initialization with a PostgreSQL volume. " +
+                "Initialization stopped because the deployment is no longer provably new.");
+        }
+        const initializingState = this.#writeInitializingState(dockerEngineId, existingState);
+        if (!hasEnv)
+            this.#writeConfiguration();
+        if (!hasMinio)
+            await this.#createVolume(MINIO_VOLUME, "minio_data");
+        let startedMinio = false;
+        try {
+            this.#stdout.write("Provisioning the new durable MinIO store...\n");
+            startedMinio = true;
+            await this.#runInitComposeChecked(["up", "-d", "--wait", "--wait-timeout", COMPOSE_WAIT_SECONDS, "minio"]);
+            await this.#runInitComposeChecked([
+                "exec",
+                "-T",
+                "minio",
+                "sh",
+                "-c",
+                'mc alias set local http://127.0.0.1:9000 "$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD" >/dev/null'
+            ]);
+            const bucket = this.#readConfigValue("MINIO_BUCKET") ?? "atlas-media";
+            await this.#runInitComposeChecked(["exec", "-T", "minio", "mc", "mb", "--ignore-existing", `local/${bucket}`]);
+            await this.#runInitComposeChecked(["exec", "-T", "minio", "mc", "anonymous", "set", "none", `local/${bucket}`]);
+            await this.#runInitComposeChecked(["down"]);
+            startedMinio = false;
+            this.#writeReadyState(initializingState);
+        }
+        catch (error) {
+            if (startedMinio) {
+                const cleanup = await this.#runInitCompose(["down"]);
+                if (cleanup.status !== 0) {
+                    throw new Error(`${errorMessage(error)} Cleanup also failed: ${errorMessage(commandFailure("docker compose down", cleanup))}`);
+                }
+            }
+            throw error;
+        }
+        this.#stdout.write(`Atlas Core initialized at ${this.#configDir}.\n`);
+        this.#stdout.write(`Credentials are stored in ${this.#envFile} with owner-only permissions.\n`);
+        this.#stdout.write("Run atlas-core start to start the deployment.\n");
+    }
+    async start() {
+        const state = this.#requireInitialized();
+        const dockerEngineId = await this.#preflight();
+        this.#assertStateMatchesRuntime(state, dockerEngineId);
+        this.#requirePublishedImage();
+        const needsPostgresVolume = await this.#assertStartIsSafe(state);
+        if (needsPostgresVolume)
+            await this.#createVolume(POSTGRES_VOLUME, "postgres_data");
+        const attemptedState = this.#recordStartAttempt(state);
+        this.#stdout.write(`Starting Atlas Core ${PACKAGE_VERSION}...\n`);
+        await this.#runComposeChecked(["up", "-d", "--pull", "always", "--wait", "--wait-timeout", COMPOSE_WAIT_SECONDS]);
+        this.#recordStarted(attemptedState);
+        this.#stdout.write("Atlas Core is ready.\n");
+        this.#stdout.write("API:       http://127.0.0.1:8000\n");
+        this.#stdout.write("MinIO UI:  http://127.0.0.1:9001\n");
+    }
+    async stop() {
+        const state = this.#requireInitialized();
+        const dockerEngineId = await this.#preflight();
+        this.#assertStateMatchesRuntime(state, dockerEngineId);
+        await this.#runComposeChecked(["down"]);
+        this.#stdout.write("Atlas Core stopped. Durable volumes were preserved.\n");
+    }
+    async restart() {
+        const state = this.#requireInitialized();
+        const dockerEngineId = await this.#preflight();
+        this.#assertStateMatchesRuntime(state, dockerEngineId);
+        this.#requirePublishedImage();
+        const needsPostgresVolume = await this.#assertStartIsSafe(state);
+        if (needsPostgresVolume)
+            await this.#createVolume(POSTGRES_VOLUME, "postgres_data");
+        const attemptedState = this.#recordStartAttempt(state);
+        await this.#runComposeChecked(["pull"]);
+        await this.#runComposeChecked(["down"]);
+        await this.#runComposeChecked(["up", "-d", "--pull", "never", "--wait", "--wait-timeout", COMPOSE_WAIT_SECONDS]);
+        this.#recordStarted(attemptedState);
+        this.#stdout.write(`Atlas Core ${PACKAGE_VERSION} restarted and is ready.\n`);
+    }
+    async status() {
+        const state = this.#requireInitialized();
+        const dockerEngineId = await this.#preflight();
+        this.#assertStateMatchesRuntime(state, dockerEngineId);
+        const result = await this.#runCompose(["ps", "--all", "--format", "json"]);
+        if (result.status !== 0)
+            throw commandFailure("docker compose ps", result);
+        const services = parseComposeServiceStates(result.stdout);
+        const failures = [...REQUIRED_SERVICES].flatMap((service) => {
+            const current = services.find((candidate) => candidate.Service === service);
+            if (!current)
+                return [`${service} is missing`];
+            if (current.State !== "running")
+                return [`${service} is ${current.State || "in an unknown state"}`];
+            if (current.Health !== "healthy")
+                return [`${service} is ${current.Health || "not reporting health"}`];
+            return [];
+        });
+        if (failures.length > 0) {
+            this.#stderr.write(`Atlas Core is not ready: ${failures.join(", ")}.\n`);
+            return false;
+        }
+        this.#stdout.write("Atlas Core is running.\n");
+        return true;
+    }
+    async logs(service, follow) {
+        const state = this.#requireInitialized();
+        const dockerEngineId = await this.#preflight();
+        this.#assertStateMatchesRuntime(state, dockerEngineId);
+        const args = ["logs", "--tail", "200"];
+        if (follow)
+            args.push("--follow");
+        if (service)
+            args.push(service);
+        const result = await this.#runCompose(args, true);
+        if (result.status !== 0)
+            throw commandFailure("docker compose logs", result);
+    }
+    async doctor() {
+        const checks = [
+            {
+                label: "platform",
+                check: async () => {
+                    if (!SUPPORTED_PLATFORMS.has(this.#platform))
+                        throw new Error(`${this.#platform} is not supported yet`);
+                    if (!SUPPORTED_ARCHITECTURES.has(this.#architecture)) {
+                        throw new Error(`${this.#architecture} is not supported yet`);
+                    }
+                    return `${this.#platform}/${this.#architecture}`;
+                }
+            },
+            {
+                label: "Node.js",
+                check: async () => {
+                    assertNodeVersion(this.#nodeVersion);
+                    return this.#nodeVersion;
+                }
+            },
+            {
+                label: "Docker",
+                check: async () => oneLine(await this.#checkCommand("docker", ["--version"]))
+            },
+            {
+                label: "Docker Compose",
+                check: async () => {
+                    const version = oneLine(await this.#checkCommand("docker", ["compose", "version", "--short"]));
+                    assertComposeVersion(version);
+                    return version;
+                }
+            },
+            {
+                label: "Docker daemon",
+                check: async () => {
+                    const runtime = await this.#dockerRuntime();
+                    return `${runtime.engineId} (${runtime.operatingSystem}/${runtime.architecture})`;
+                }
+            },
+            {
+                label: "configuration",
+                check: async () => {
+                    const state = this.#requireInitialized();
+                    const runtime = await this.#dockerRuntime();
+                    this.#assertStateMatchesRuntime(state, runtime.engineId);
+                    await this.#runComposeChecked(["config", "--quiet"]);
+                    return this.#configDir;
+                }
+            }
+        ];
+        let healthy = true;
+        for (const item of checks) {
+            try {
+                this.#stdout.write(`[ok] ${item.label}: ${await item.check()}\n`);
+            }
+            catch (error) {
+                healthy = false;
+                this.#stderr.write(`[fail] ${item.label}: ${errorMessage(error)}\n`);
+            }
+        }
+        return healthy;
+    }
+    async #preflight() {
+        if (!SUPPORTED_PLATFORMS.has(this.#platform)) {
+            throw new Error(`Atlas Core supports macOS and Linux. Detected ${this.#platform}.`);
+        }
+        if (!SUPPORTED_ARCHITECTURES.has(this.#architecture)) {
+            throw new Error(`Atlas Core supports arm64 and x64 hosts. Detected ${this.#architecture}.`);
+        }
+        assertNodeVersion(this.#nodeVersion);
+        await this.#checkCommand("docker", ["--version"]);
+        const composeVersion = oneLine(await this.#checkCommand("docker", ["compose", "version", "--short"]));
+        assertComposeVersion(composeVersion);
+        return (await this.#dockerRuntime()).engineId;
+    }
+    async #dockerRuntime() {
+        const context = oneLine(await this.#checkCommand("docker", ["context", "show"]));
+        if (!context)
+            throw new Error("Docker did not report an active context.");
+        const contextHost = oneLine(await this.#checkCommand("docker", [
+            "context",
+            "inspect",
+            context,
+            "--format",
+            '{{(index .Endpoints "docker").Host}}'
+        ]));
+        const configuredContext = this.#env.DOCKER_CONTEXT?.trim();
+        const dockerHost = configuredContext ? contextHost : this.#env.DOCKER_HOST?.trim() || contextHost;
+        if (!dockerHost.startsWith("unix://")) {
+            throw new Error(`Atlas Core requires a local Docker daemon over a Unix socket. Context ${context} uses ${dockerHost || "no endpoint"}.`);
+        }
+        const raw = await this.#checkCommand("docker", ["info", "--format", "{{json .}}"]);
+        let info;
+        try {
+            info = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Docker returned invalid daemon information.");
+        }
+        if (!isDockerInfo(info)) {
+            throw new Error("Docker daemon information is missing its ID, operating system, or architecture.");
+        }
+        if (info.OSType !== "linux") {
+            throw new Error(`Atlas Core requires a Linux Docker daemon. Detected ${info.OSType}.`);
+        }
+        if (!SUPPORTED_DOCKER_ARCHITECTURES.has(info.Architecture)) {
+            throw new Error(`Atlas Core supports amd64 and arm64 Docker daemons. Detected ${info.Architecture}.`);
+        }
+        return { architecture: info.Architecture, engineId: info.ID, operatingSystem: info.OSType };
+    }
+    async #checkCommand(command, args) {
+        const result = await this.#runner.run(command, args, { env: this.#env });
+        if (result.status !== 0)
+            throw commandFailure([command, ...args].join(" "), result);
+        return result.stdout || result.stderr;
+    }
+    #acquireInitLock() {
+        try {
+            writePrivateFile(this.#initLockFile, `${JSON.stringify({ pid: process.pid }, null, 2)}\n`, this.#platform, true);
+            return;
+        }
+        catch (error) {
+            if (!isNodeError(error) || error.code !== "EEXIST")
+                throw error;
+        }
+        this.#assertPrivateFile(this.#initLockFile);
+        let owner;
+        try {
+            owner = JSON.parse(readFileSync(this.#initLockFile, "utf8"));
+        }
+        catch {
+            owner = undefined;
+        }
+        const ownerDescription = isInitLock(owner) ? ` by PID ${owner.pid}` : "";
+        throw new Error(`Atlas Core initialization is locked${ownerDescription} at ${this.#initLockFile}. ` +
+            "If no atlas-core init process is running, remove that file and run init again.");
+    }
+    #releaseInitLock() {
+        try {
+            unlinkSync(this.#initLockFile);
+        }
+        catch (error) {
+            if (!isNodeError(error) || error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    async #acquireDockerInitLock(dockerEngineId) {
+        const labels = {
+            "io.atlas.core.engine": dockerEngineId,
+            "io.atlas.core.lock": "initialization",
+            "io.atlas.core.project": PROJECT_NAME
+        };
+        const args = ["network", "create"];
+        for (const [name, value] of Object.entries(labels))
+            args.push("--label", `${name}=${value}`);
+        args.push(INIT_LOCK_NETWORK);
+        const result = await this.#runner.run("docker", args, { env: this.#env });
+        if (result.status === 0)
+            return;
+        const inspection = await this.#runner.run("docker", ["network", "inspect", "--format", "{{json .Labels}}", INIT_LOCK_NETWORK], { env: this.#env });
+        if (inspection.status !== 0)
+            throw commandFailure(`docker ${args.join(" ")}`, result);
+        this.#assertResourceLabels("initialization lock", INIT_LOCK_NETWORK, inspection.stdout, labels);
+        throw new Error(`Atlas Core initialization is already locked on Docker engine ${dockerEngineId}. ` +
+            `If no atlas-core init process is running, remove ${INIT_LOCK_NETWORK} with docker network rm and run init again.`);
+    }
+    async #releaseDockerInitLock() {
+        const result = await this.#runner.run("docker", ["network", "rm", INIT_LOCK_NETWORK], { env: this.#env });
+        if (result.status !== 0)
+            throw commandFailure(`docker network rm ${INIT_LOCK_NETWORK}`, result);
+    }
+    async #volumeExists(name) {
+        const volume = name === POSTGRES_VOLUME ? "postgres_data" : "minio_data";
+        return await this.#ownedResourceExists("volume", name, {
+            "com.docker.compose.project": PROJECT_NAME,
+            "com.docker.compose.volume": volume
+        });
+    }
+    async #createVolume(name, volume) {
+        await this.#checkCommand("docker", [
+            "volume",
+            "create",
+            "--label",
+            `com.docker.compose.project=${PROJECT_NAME}`,
+            "--label",
+            `com.docker.compose.volume=${volume}`,
+            name
+        ]);
+        if (!(await this.#volumeExists(name))) {
+            throw new Error(`Docker created ${name}, but Atlas Core could not verify the volume.`);
+        }
+    }
+    async #containerExists(name) {
+        const service = name === API_CONTAINER
+            ? "api"
+            : name === POSTGRES_CONTAINER
+                ? "postgres"
+                : name === MINIO_INIT_CONTAINER
+                    ? "minio-init"
+                    : "minio";
+        return await this.#ownedResourceExists("container", name, {
+            "com.docker.compose.project": PROJECT_NAME,
+            "com.docker.compose.service": service
+        });
+    }
+    async #ownedResourceExists(kind, name, expectedLabels) {
+        const result = await this.#runner.run("docker", [kind, "inspect", "--format", "{{json .Labels}}", name], {
+            env: this.#env
+        });
+        if (result.status !== 0) {
+            if (new RegExp(`no such ${kind}`, "i").test(result.stderr || result.stdout))
+                return false;
+            throw commandFailure(`docker ${kind} inspect ${name}`, result);
+        }
+        this.#assertResourceLabels(kind, name, result.stdout, expectedLabels);
+        return true;
+    }
+    #assertResourceLabels(kind, name, stdout, expectedLabels) {
+        let labels;
+        try {
+            labels = JSON.parse(stdout);
+        }
+        catch {
+            throw new Error(`Docker returned invalid ownership labels for ${kind} ${name}.`);
+        }
+        if (typeof labels !== "object" || labels === null) {
+            throw new Error(`Atlas Core found ${kind} ${name} without ownership labels.`);
+        }
+        const record = labels;
+        const mismatch = Object.entries(expectedLabels).find(([key, value]) => record[key] !== value);
+        if (mismatch) {
+            throw new Error(`Atlas Core found ${kind} ${name} without the expected ${mismatch[0]}=${mismatch[1]} ownership label.`);
+        }
+    }
+    async #assertStartIsSafe(state) {
+        const [hasPostgres, hasMinio] = await Promise.all([
+            this.#volumeExists(POSTGRES_VOLUME),
+            this.#volumeExists(MINIO_VOLUME)
+        ]);
+        if (!hasMinio || ((state.startAttemptedAt !== undefined || state.startedAt !== undefined) && !hasPostgres)) {
+            throw new Error("Atlas Core durable storage is missing. Start stopped so Docker Compose cannot replace it with an empty volume.");
+        }
+        return !hasPostgres;
+    }
+    #writeConfiguration() {
+        const contents = [
+            "# Generated by atlas-core init. Keep this file private and back it up securely.",
+            `POSTGRES_PASSWORD=${this.#createSecret()}`,
+            "MINIO_ROOT_USER=atlas",
+            `MINIO_ROOT_PASSWORD=${this.#createSecret()}`,
+            "MINIO_BUCKET=atlas-media",
+            `API_AUTH_KEY=${this.#createSecret()}`,
+            `ATLAS_ADMIN_PASSWORD=${this.#createSecret()}`,
+            "CORS_ORIGINS=https://atlasinterface.com",
+            "CORS_ORIGIN_PATTERNS=https://*.atlas-je0.pages.dev",
+            "TRUSTED_PROXY_CIDRS=",
+            "",
+            "# Optional tuning",
+            "DATABASE_POOL_SIZE=5",
+            "DATABASE_MAX_OVERFLOW=10",
+            "DATABASE_POOL_RECYCLE=3600",
+            "DATABASE_POOL_TIMEOUT=30",
+            "DATABASE_POOL_IDLE_TIMEOUT=600",
+            "DATABASE_POOL_PRE_PING=true",
+            "MAX_UPLOAD_SIZE_MB=100",
+            "MAX_VIEW_SIZE_MB=10",
+            ""
+        ].join("\n");
+        try {
+            writePrivateFile(this.#envFile, contents, this.#platform, true);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "EEXIST") {
+                throw new Error(`Another atlas-core init process created ${this.#envFile}. Run init again after it exits.`);
+            }
+            throw error;
+        }
+    }
+    #writeInitializingState(dockerEngineId, previous) {
+        const state = {
+            schema: CONFIG_SCHEMA,
+            phase: "initializing",
+            initializedAt: previous?.initializedAt ?? this.#now().toISOString(),
+            packageVersion: PACKAGE_VERSION,
+            dockerEngineId
+        };
+        try {
+            writePrivateFile(this.#stateFile, `${JSON.stringify(state, null, 2)}\n`, this.#platform, previous === undefined);
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "EEXIST") {
+                throw new Error(`Another atlas-core init process created ${this.#stateFile}. Run init again after it exits.`);
+            }
+            throw error;
+        }
+        return state;
+    }
+    #writeReadyState(state) {
+        const readyState = {
+            ...state,
+            phase: "ready"
+        };
+        writePrivateFile(this.#stateFile, `${JSON.stringify(readyState, null, 2)}\n`, this.#platform);
+    }
+    #recordStartAttempt(state) {
+        const attemptedState = {
+            ...state,
+            startAttemptedAt: state.startAttemptedAt ?? this.#now().toISOString()
+        };
+        writePrivateFile(this.#stateFile, `${JSON.stringify(attemptedState, null, 2)}\n`, this.#platform);
+        return attemptedState;
+    }
+    #recordStarted(state) {
+        const startedState = {
+            ...state,
+            startAttemptedAt: state.startAttemptedAt ?? this.#now().toISOString(),
+            startedAt: state.startedAt ?? this.#now().toISOString()
+        };
+        writePrivateFile(this.#stateFile, `${JSON.stringify(startedState, null, 2)}\n`, this.#platform);
+    }
+    #readState() {
+        if (!existsSync(this.#stateFile))
+            return undefined;
+        try {
+            const value = JSON.parse(readFileSync(this.#stateFile, "utf8"));
+            if (!isDeploymentState(value))
+                return undefined;
+            return value;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    #requireInitialized() {
+        if (!existsSync(this.#configDir) || !existsSync(this.#envFile) || !existsSync(this.#stateFile)) {
+            throw new Error("Atlas Core is not initialized. Run atlas-core init first.");
+        }
+        this.#assertPrivateConfiguration();
+        const state = this.#readState();
+        if (state?.schema !== CONFIG_SCHEMA || state.phase !== "ready") {
+            throw new Error("Atlas Core is not initialized. Run atlas-core init first.");
+        }
+        return state;
+    }
+    #prepareConfigDirectory() {
+        if (!existsSync(this.#configDir)) {
+            mkdirSync(this.#configDir, { recursive: true, mode: 0o700 });
+            if (this.#platform !== "win32")
+                chmodSync(this.#configDir, 0o700);
+            return;
+        }
+        this.#assertPrivateDirectory();
+    }
+    #assertPrivateConfiguration() {
+        this.#assertPrivateDirectory();
+        if (existsSync(this.#envFile))
+            this.#assertPrivateFile(this.#envFile);
+        if (existsSync(this.#stateFile))
+            this.#assertPrivateFile(this.#stateFile);
+    }
+    #assertPrivateDirectory() {
+        const info = lstatSync(this.#configDir);
+        if (info.isSymbolicLink() || !info.isDirectory()) {
+            throw new Error(`${this.#configDir} must be a regular directory, not a symlink or another file type.`);
+        }
+        this.#assertPrivateOwnershipAndMode(this.#configDir, info, 0o700);
+    }
+    #assertPrivateFile(path) {
+        const info = lstatSync(path);
+        if (info.isSymbolicLink() || !info.isFile()) {
+            throw new Error(`${path} must be a regular file, not a symlink or another file type.`);
+        }
+        this.#assertPrivateOwnershipAndMode(path, info, 0o600);
+    }
+    #assertPrivateOwnershipAndMode(path, info, expectedMode) {
+        if (this.#platform === "win32")
+            return;
+        const currentUserId = process.getuid?.();
+        if (currentUserId !== undefined && info.uid !== currentUserId) {
+            throw new Error(`${path} is owned by UID ${info.uid}, not the current user.`);
+        }
+        const actualMode = info.mode & 0o777;
+        if (actualMode !== expectedMode) {
+            throw new Error(`${path} must have mode ${expectedMode.toString(8)}, not ${actualMode.toString(8)}.`);
+        }
+    }
+    #assertStateMatchesRuntime(state, dockerEngineId) {
+        if (state.packageVersion !== PACKAGE_VERSION) {
+            throw new Error(`Atlas Core ${state.packageVersion} initialized this deployment, but the installed CLI is ${PACKAGE_VERSION}. ` +
+                `Reinstall atlas-core@${state.packageVersion}; automatic upgrades are not supported yet.`);
+        }
+        if (state.dockerEngineId !== dockerEngineId) {
+            throw new Error(`Atlas Core was initialized on Docker engine ${state.dockerEngineId}, but the current engine is ${dockerEngineId}. ` +
+                "Restore the original Docker context before operating this deployment.");
+        }
+    }
+    #requirePublishedImage() {
+        if (!this.#imageReference) {
+            throw new Error("This atlas-core package was not produced by the release workflow and has no pinned Core image.");
+        }
+    }
+    #readConfigValue(name) {
+        const line = readFileSync(this.#envFile, "utf8")
+            .split(/\r?\n/)
+            .find((candidate) => candidate.startsWith(`${name}=`));
+        const value = line?.slice(name.length + 1).trim();
+        if (value === undefined)
+            return undefined;
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            return value.slice(1, -1);
+        }
+        return value;
+    }
+    async #runCompose(args, inherit = false) {
+        return await this.#runComposeFile(this.#composeFile, args, inherit);
+    }
+    async #runInitCompose(args) {
+        return await this.#runComposeFile(this.#initComposeFile, args);
+    }
+    async #runComposeFile(composeFile, args, inherit = false) {
+        const env = { ...this.#env };
+        for (const variable of COMPOSE_VARIABLES)
+            delete env[variable];
+        for (const variable of Object.keys(env)) {
+            if (variable.startsWith("COMPOSE_"))
+                delete env[variable];
+        }
+        env.COMPOSE_IGNORE_ORPHANS = "0";
+        env.COMPOSE_REMOVE_ORPHANS = "0";
+        env.ATLAS_CORE_IMAGE = this.#imageReference ?? UNRELEASED_IMAGE;
+        return await this.#runner.run("docker", this.#composeArgs(composeFile, args), {
+            cwd: this.#configDir,
+            env,
+            inherit
+        });
+    }
+    async #runComposeChecked(args) {
+        const result = await this.#runCompose(args);
+        if (result.status !== 0)
+            throw commandFailure(`docker ${this.#composeArgs(this.#composeFile, args).join(" ")}`, result);
+    }
+    async #runInitComposeChecked(args) {
+        const result = await this.#runInitCompose(args);
+        if (result.status !== 0) {
+            throw commandFailure(`docker ${this.#composeArgs(this.#initComposeFile, args).join(" ")}`, result);
+        }
+    }
+    #composeArgs(composeFile, args) {
+        return ["compose", "--project-name", PROJECT_NAME, "--env-file", this.#envFile, "--file", composeFile, ...args];
+    }
+}
+export async function runCLI(argv, context = {}) {
+    const runtime = defaultContext(context);
+    try {
+        const command = parseCommand(argv);
+        if (command.kind === "help") {
+            runtime.stdout.write(usage);
+            return 0;
+        }
+        if (command.kind === "version") {
+            runtime.stdout.write(`${PACKAGE_NAME} ${PACKAGE_VERSION}\n`);
+            return 0;
+        }
+        const deployment = new AtlasCoreDeployment(runtime);
+        switch (command.kind) {
+            case "doctor":
+                return (await deployment.doctor()) ? 0 : 1;
+            case "init":
+                await deployment.init();
+                return 0;
+            case "logs":
+                await deployment.logs(command.service, command.follow);
+                return 0;
+            case "restart":
+                await deployment.restart();
+                return 0;
+            case "start":
+                await deployment.start();
+                return 0;
+            case "status":
+                return (await deployment.status()) ? 0 : 1;
+            case "stop":
+                await deployment.stop();
+                return 0;
+            default:
+                return assertNever(command);
+        }
+    }
+    catch (error) {
+        runtime.stderr.write(`${errorMessage(error)}\n`);
+        if (error instanceof UsageError)
+            runtime.stderr.write(usage);
+        return error instanceof UsageError ? 2 : 1;
+    }
+}
+function parseCommand(argv) {
+    if (argv.length === 0 || (argv.length === 1 && ["help", "--help", "-h"].includes(argv[0] ?? ""))) {
+        return { kind: "help" };
+    }
+    const [name, ...args] = argv;
+    switch (name) {
+        case "doctor":
+        case "init":
+        case "restart":
+        case "start":
+        case "status":
+        case "stop":
+        case "version":
+            if (args.length > 0)
+                throw new UsageError(`${name} does not accept arguments`);
+            return { kind: name };
+        case "logs":
+            return parseLogs(args);
+        default:
+            throw new UsageError(`Unknown command: ${name ?? ""}`);
+    }
+}
+function parseLogs(args) {
+    let service;
+    let follow = false;
+    for (const arg of args) {
+        if (arg === "--follow" || arg === "-f") {
+            follow = true;
+            continue;
+        }
+        if (service)
+            throw new UsageError("logs accepts at most one service");
+        if (arg === "core" || arg === "api")
+            service = "api";
+        else if (arg === "postgres" || arg === "minio")
+            service = arg;
+        else
+            throw new UsageError(`Unknown logs service: ${arg}`);
+    }
+    return service === undefined ? { kind: "logs", follow } : { kind: "logs", service, follow };
+}
+function defaultContext(context) {
+    const currentDirectory = dirname(fileURLToPath(import.meta.url));
+    return {
+        stdout: context.stdout ?? process.stdout,
+        stderr: context.stderr ?? process.stderr,
+        env: context.env ?? process.env,
+        runner: context.runner ?? new ProcessCommandRunner(),
+        homeDir: context.homeDir ?? homedir(),
+        packageRoot: context.packageRoot ?? dirname(currentDirectory),
+        platform: context.platform ?? process.platform,
+        architecture: context.architecture ?? process.arch,
+        nodeVersion: context.nodeVersion ?? process.versions.node,
+        now: context.now ?? (() => new Date()),
+        createSecret: context.createSecret ?? (() => randomBytes(32).toString("base64url")),
+        imageReference: context.imageReference ?? PACKAGE_IMAGE
+    };
+}
+function writePrivateFile(path, contents, platform, exclusive = false) {
+    if (exclusive) {
+        writeFileSync(path, contents, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        if (platform !== "win32")
+            chmodSync(path, 0o600);
+        return;
+    }
+    const temporaryPath = `${path}.${process.pid}.tmp`;
+    writeFileSync(temporaryPath, contents, { encoding: "utf8", mode: 0o600, flag: "wx" });
+    renameSync(temporaryPath, path);
+    if (platform !== "win32")
+        chmodSync(path, 0o600);
+}
+function isDeploymentState(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return (typeof record.schema === "number" &&
+        (record.phase === "initializing" || record.phase === "ready") &&
+        typeof record.initializedAt === "string" &&
+        typeof record.packageVersion === "string" &&
+        typeof record.dockerEngineId === "string" &&
+        (record.startAttemptedAt === undefined || typeof record.startAttemptedAt === "string") &&
+        (record.startedAt === undefined || typeof record.startedAt === "string"));
+}
+function isDockerInfo(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const info = value;
+    return (typeof info.ID === "string" &&
+        info.ID.length > 0 &&
+        typeof info.OSType === "string" &&
+        typeof info.Architecture === "string");
+}
+function isInitLock(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const record = value;
+    return typeof record.pid === "number" && Number.isInteger(record.pid) && record.pid > 0;
+}
+function resolveConfigDirectory(configured, homeDir) {
+    if (!configured)
+        return join(homeDir, ".atlas", "core");
+    if (configured === "~")
+        return homeDir;
+    if (configured.startsWith("~/"))
+        return resolve(homeDir, configured.slice(2));
+    return resolve(configured);
+}
+function parseComposeServiceStates(stdout) {
+    const output = stdout.trim();
+    if (!output)
+        return [];
+    let candidates;
+    try {
+        const value = JSON.parse(output);
+        candidates = Array.isArray(value) ? value : [value];
+    }
+    catch {
+        try {
+            candidates = output.split(/\r?\n/).map((line) => JSON.parse(line));
+        }
+        catch {
+            throw new Error("Docker Compose returned invalid JSON from ps.");
+        }
+    }
+    return candidates.map((candidate) => {
+        if (typeof candidate !== "object" || candidate === null) {
+            throw new Error("Docker Compose returned an invalid service from ps.");
+        }
+        const record = candidate;
+        if (typeof record.Service !== "string" || typeof record.State !== "string" || typeof record.Health !== "string") {
+            throw new Error("Docker Compose returned an incomplete service from ps.");
+        }
+        return { Service: record.Service, State: record.State, Health: record.Health };
+    });
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+function assertNodeVersion(version) {
+    const major = Number.parseInt(version.split(".")[0] ?? "", 10);
+    if (!Number.isInteger(major) || major < 24) {
+        throw new Error(`Atlas Core requires Node.js 24 or newer. Detected ${version}.`);
+    }
+}
+function assertComposeVersion(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(version);
+    if (!match)
+        throw new Error(`Docker Compose returned an unsupported version: ${version}`);
+    const actual = match.slice(1, 4).map(Number);
+    for (let index = 0; index < MINIMUM_COMPOSE_VERSION.length; index += 1) {
+        const difference = (actual[index] ?? 0) - (MINIMUM_COMPOSE_VERSION[index] ?? 0);
+        if (difference > 0)
+            return;
+        if (difference < 0) {
+            throw new Error(`Atlas Core requires Docker Compose ${MINIMUM_COMPOSE_VERSION.join(".")} or newer. Detected ${version}.`);
+        }
+    }
+}
+function commandFailure(command, result) {
+    const detail = oneLine(result.stderr || result.stdout);
+    return new Error(`${command} failed with exit code ${result.status}${detail ? `: ${detail}` : ""}`);
+}
+function oneLine(value) {
+    return value.trim().split(/\r?\n/, 1)[0] ?? "";
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function assertNever(value) {
+    throw new Error(`Unhandled command: ${JSON.stringify(value)}`);
+}
+//# sourceMappingURL=application.js.map