@calltelemetry/cli 0.12.11 → 0.12.12

package/dist/lib/ops-port.js

@@ -0,0 +1,906 @@
+/**
+ * Go clitree catalog ports implemented in TypeScript (TS all-the-way).
+ * Injectable runners for unit tests — no Go binary dependency.
+ *
+ * False-green rules (WS-A):
+ * - Mutates fail-closed (no soft mute on write/recreate/RPC that must succeed)
+ * - Appliance file paths via getPaths().installDir
+ * - .env key updates via Node fs (no bash sed with operator args)
+ * - crypto.randomBytes for generated passwords
+ */
+import { randomBytes } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { exec } from './exec.js';
+import { getPaths } from './paths.js';
+const defaultRun = async (cmd, args) => {
+    const r = await exec(cmd, args);
+    return { stdout: String(r.stdout ?? ''), stderr: String(r.stderr ?? '') };
+};
+/** Soft-fail runner for pure reads only. Mutates must use runOrThrow / try-catch. */
+async function soft(run, cmd, args) {
+    try {
+        const r = await run(cmd, args);
+        return String(r.stdout ?? '').trim();
+    }
+    catch {
+        return '';
+    }
+}
+async function runOrThrow(run, cmd, args) {
+    const r = await run(cmd, args);
+    return String(r.stdout ?? '').trim();
+}
+function resolveInstallDir(installDir) {
+    return installDir ?? getPaths().installDir;
+}
+function envFilePath(installDir) {
+    return join(resolveInstallDir(installDir), '.env');
+}
+function composeFilePath(installDir) {
+    return join(resolveInstallDir(installDir), 'docker-compose.yml');
+}
+/**
+ * Update or append a single KEY=value in installDir/.env using Node fs.
+ * Throws on I/O failure (callers fail-closed).
+ */
+export function updateEnvKeyFile(key, value, installDir) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+        throw new Error(`Invalid env key: ${key}`);
+    }
+    // Values must not contain newlines (env file line safety)
+    if (/[\r\n]/.test(value)) {
+        throw new Error(`Env value for ${key} must not contain newlines`);
+    }
+    const path = envFilePath(installDir);
+    const dir = resolveInstallDir(installDir);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    let raw = '';
+    if (existsSync(path)) {
+        raw = readFileSync(path, 'utf-8');
+    }
+    const lines = raw.length > 0 ? raw.split('\n') : [];
+    if (lines.length > 0 && lines[lines.length - 1] === '') {
+        lines.pop();
+    }
+    let found = false;
+    const result = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#')) {
+            result.push(line);
+            continue;
+        }
+        const stripped = trimmed.startsWith('export ') ? trimmed.slice(7) : trimmed;
+        const eqIdx = stripped.indexOf('=');
+        if (eqIdx === -1) {
+            result.push(line);
+            continue;
+        }
+        const lineKey = stripped.slice(0, eqIdx).trim();
+        if (lineKey === key && !found) {
+            result.push(`${key}=${value}`);
+            found = true;
+        }
+        else if (lineKey === key) {
+            // drop duplicates
+        }
+        else {
+            result.push(line);
+        }
+    }
+    if (!found) {
+        result.push(`${key}=${value}`);
+    }
+    const content = result.length > 0 ? result.join('\n') + '\n' : `${key}=${value}\n`;
+    writeFileSync(path, content, { mode: 0o600 });
+    return { path };
+}
+function readEnvKeysAt(installDir) {
+    const path = envFilePath(installDir);
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    for (const rawLine of readFileSync(path, 'utf-8').split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const stripped = line.startsWith('export ') ? line.slice(7) : line;
+        const eqIdx = stripped.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const k = stripped.slice(0, eqIdx).trim();
+        let v = stripped.slice(eqIdx + 1).trim();
+        if ((v.startsWith('"') && v.endsWith('"')) ||
+            (v.startsWith("'") && v.endsWith("'"))) {
+            v = v.slice(1, -1);
+        }
+        if (k)
+            out[k] = v;
+    }
+    return out;
+}
+function composeProjectArgs(installDir) {
+    const dir = resolveInstallDir(installDir);
+    return ['--project-directory', dir, '-f', composeFilePath(installDir)];
+}
+function rpcLooksFailed(out) {
+    return /error|Error|failed|Failed|FAULT|undefined function|UndefinedFunction|noproc/i.test(out);
+}
+// ── DB purge groups (Go parity) ──────────────────────────────────────────
+export const PURGE_GROUPS = {
+    'ct-events': {
+        description: 'CUBE/XCC/CURRI telemetry events',
+        tables: ['cube_events', 'xcc_events', 'curri_events', 'reputation_signals'],
+    },
+    cdr: {
+        description: 'Call detail records (partitioned)',
+        tables: ['cdrs', 'cmrs'],
+    },
+    logs: {
+        description: 'Application and audit logs',
+        tables: ['audit_logs', 'job_logs'],
+    },
+};
+export function listPurgeGroups() {
+    const lines = ['Optimized purge groups:', ''];
+    for (const [name, g] of Object.entries(PURGE_GROUPS)) {
+        lines.push(`  ${name.padEnd(14)} ${g.description}`);
+        lines.push(`                 tables: ${g.tables.join(', ')}`);
+    }
+    lines.push('');
+    lines.push('Usage: ct db purge-ct-events [days] [--yes]');
+    lines.push('       ct db purge <table|group> <days> [--yes]');
+    return lines.join('\n');
+}
+export async function purgeCtEvents(days, opts = {}) {
+    if (!Number.isFinite(days) || days < 1) {
+        return { ok: false, message: 'Error: days must be a positive number (default 7).' };
+    }
+    if (!opts.yes && !opts.dryRun) {
+        return {
+            ok: false,
+            message: `Refusing to purge ct-events older than ${days} days without --yes.`,
+        };
+    }
+    const run = opts.run ?? defaultRun;
+    if (opts.dryRun) {
+        return {
+            ok: true,
+            message: `Would purge ct-events group older than ${days} days (tables: ${PURGE_GROUPS['ct-events'].tables.join(', ')}).`,
+            deleted: 0,
+        };
+    }
+    const rpc = `Cdrcisco.Maintenance.purge_group("ct-events", ${days})`;
+    let out = '';
+    try {
+        out = await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'exec',
+            '-T',
+            'web',
+            'bin/onprem',
+            'rpc',
+            rpc,
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: purge-ct-events RPC failed: ${e?.message ?? e}`,
+        };
+    }
+    if (!out) {
+        return {
+            ok: false,
+            message: 'Error: purge-ct-events RPC returned empty output (RPC unavailable or symbol missing: Cdrcisco.Maintenance.purge_group).',
+        };
+    }
+    if (rpcLooksFailed(out)) {
+        return {
+            ok: false,
+            message: `Error: purge-ct-events RPC rejected: ${out.slice(0, 200)}`,
+        };
+    }
+    return {
+        ok: true,
+        message: `Purged ct-events group (older than ${days} days).`,
+        deleted: 0,
+    };
+}
+export async function factoryReset(opts = {}) {
+    const steps = [];
+    if (!opts.yes && !opts.dryRun) {
+        return {
+            ok: false,
+            message: 'Error: factory-reset requires --yes (destructive).',
+            steps,
+        };
+    }
+    if (!opts.experimental && !opts.dryRun) {
+        return {
+            ok: false,
+            message: 'Error: factory-reset is experimental/UAT-only. Pass --experimental --yes (hidden from default help).',
+            steps,
+        };
+    }
+    const installDir = resolveInstallDir(opts.installDir);
+    const postgresData = join(installDir, 'postgres-data');
+    const backupsDir = join(installDir, 'backups');
+    const run = opts.run ?? defaultRun;
+    const planDocker = [
+        ['docker', ['compose', ...composeProjectArgs(installDir), 'down', '-v']],
+        ['docker', ['system', 'prune', '-f']],
+        ['docker', ['compose', ...composeProjectArgs(installDir), 'up', '-d']],
+    ];
+    steps.push(`remove data: ${postgresData} and ${backupsDir}/*`);
+    for (const [cmd, args] of planDocker) {
+        steps.push(`${cmd} ${args.join(' ')}`);
+    }
+    if (opts.dryRun) {
+        return {
+            ok: true,
+            message: `Dry-run factory-reset (${steps.length} steps). Experimental/UAT only.`,
+            steps,
+        };
+    }
+    // Data removal — fail closed (no "; true" mute)
+    try {
+        if (existsSync(postgresData)) {
+            rmSync(postgresData, { recursive: true, force: true });
+            if (existsSync(postgresData)) {
+                throw new Error(`path still exists after rm: ${postgresData}`);
+            }
+        }
+        if (existsSync(backupsDir)) {
+            for (const name of readdirSync(backupsDir)) {
+                rmSync(join(backupsDir, name), { recursive: true, force: true });
+            }
+        }
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `factory-reset failed removing data under ${installDir}: ${e?.message ?? e}`,
+            steps,
+        };
+    }
+    for (const [cmd, args] of planDocker) {
+        try {
+            await runOrThrow(run, cmd, args);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                message: `factory-reset failed at: ${cmd} ${args.join(' ')}: ${e?.message ?? e}`,
+                steps,
+            };
+        }
+    }
+    return {
+        ok: true,
+        message: 'Factory reset complete: data volumes removed, stack restarted.',
+        steps,
+    };
+}
+// ── Update service (single container tag) ────────────────────────────────
+export async function updateService(service, tag, opts = {}) {
+    const allowed = ['web', 'vue', 'ct-media', 'jtapi', 'traceroute', 'ct-pdf', 'syslog-ingest'];
+    if (!allowed.includes(service)) {
+        return {
+            ok: false,
+            message: `Error: unknown service '${service}'. Allowed: ${allowed.join(', ')}`,
+        };
+    }
+    if (!tag.trim()) {
+        return { ok: false, message: 'Error: tag is required.\nUsage: ct update service <svc> <tag>' };
+    }
+    if (!opts.yes && !opts.dryRun) {
+        return { ok: false, message: 'Error: update service requires --yes for non-interactive apply.' };
+    }
+    const run = opts.run ?? defaultRun;
+    const envKey = `${service.toUpperCase().replace(/-/g, '_')}_TAG`;
+    const envPath = envFilePath(opts.installDir);
+    if (opts.dryRun) {
+        return { ok: true, message: `Would set ${envKey}=${tag} in ${envPath} and recreate ${service}.` };
+    }
+    try {
+        updateEnvKeyFile(envKey, tag, opts.installDir);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error writing ${envKey} to ${envPath}: ${e?.message ?? e}`,
+        };
+    }
+    try {
+        await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'up',
+            '-d',
+            '--no-deps',
+            '--force-recreate',
+            service,
+        ]);
+    }
+    catch (e) {
+        return { ok: false, message: `Error updating ${service}: ${e?.message ?? e}` };
+    }
+    return { ok: true, message: `Updated service ${service} to tag ${tag} (${envPath}).` };
+}
+// ── JTAPI RTP advertise ──────────────────────────────────────────────────
+export async function setJtapiRtpAdvertise(ip, opts = {}) {
+    const value = ip.trim();
+    if (!value) {
+        return { ok: false, message: 'Error: IP required.\nUsage: ct jtapi set-rtp-advertise <ip>' };
+    }
+    const run = opts.run ?? defaultRun;
+    const envPath = envFilePath(opts.installDir);
+    try {
+        updateEnvKeyFile('JTAPI_RTP_ADVERTISE_IP', value, opts.installDir);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error writing JTAPI_RTP_ADVERTISE_IP to ${envPath}: ${e?.message ?? e}`,
+        };
+    }
+    try {
+        await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'up',
+            '-d',
+            '--no-deps',
+            '--force-recreate',
+            'jtapi',
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error recreating jtapi after RTP advertise update: ${e?.message ?? e}`,
+        };
+    }
+    return { ok: true, message: `JTAPI RTP advertise address set to ${value} (${envPath}).` };
+}
+// ── Seed monitor / cancel ────────────────────────────────────────────────
+export async function seedMonitor(opts = {}) {
+    const run = opts.run ?? defaultRun;
+    let out = '';
+    try {
+        out = await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'exec',
+            '-T',
+            'web',
+            'bin/onprem',
+            'rpc',
+            'Cdrcisco.Seed.status()',
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: seed monitor RPC failed: ${e?.message ?? e}`,
+        };
+    }
+    if (!out) {
+        return {
+            ok: false,
+            message: 'Error: seed monitor RPC returned empty output (RPC unavailable or symbol missing: Cdrcisco.Seed.status).',
+        };
+    }
+    if (rpcLooksFailed(out)) {
+        return {
+            ok: false,
+            message: `Error: seed monitor RPC rejected: ${out.slice(0, 200)}`,
+        };
+    }
+    return {
+        ok: true,
+        message: out,
+        counts: {},
+    };
+}
+export async function seedCancel(opts = {}) {
+    const run = opts.run ?? defaultRun;
+    let out = '';
+    try {
+        out = await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'exec',
+            '-T',
+            'web',
+            'bin/onprem',
+            'rpc',
+            'Cdrcisco.Seed.cancel_all()',
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: seed cancel RPC failed: ${e?.message ?? e}`,
+        };
+    }
+    if (!out) {
+        return {
+            ok: false,
+            message: 'Error: seed cancel RPC returned empty output (RPC unavailable or symbol missing: Cdrcisco.Seed.cancel_all).',
+        };
+    }
+    if (rpcLooksFailed(out)) {
+        return {
+            ok: false,
+            message: `Error: seed cancel RPC rejected: ${out.slice(0, 200)}`,
+        };
+    }
+    return { ok: true, message: `Seed cancel requested: ${out}` };
+}
+// ── Bootstrap admin / users add-admin ─────────────────────────────────────
+export async function bootstrapAdmin(email, password, opts = {}) {
+    if (!email.includes('@') || password.length < 8) {
+        return { ok: false, message: 'Error: email and password (>=8 chars) required.' };
+    }
+    if (!opts.experimental) {
+        return {
+            ok: false,
+            message: 'Error: bootstrap-admin is experimental until RPC symbols are verified on the pinned release. Pass --experimental.',
+        };
+    }
+    const run = opts.run ?? defaultRun;
+    const org = opts.orgId ?? 'auto';
+    // Escape for Elixir string literal in RPC (Go parity: real password reaches RPC)
+    const esc = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+    const rpc = org === 'auto' || org === 'new'
+        ? `Cdrcisco.Identity.Users.bootstrap_admin("${esc(email)}", "${esc(password)}")`
+        : `Cdrcisco.Identity.Users.add_admin("${esc(org)}", "${esc(email)}", "${esc(password)}")`;
+    let out = '';
+    try {
+        out = await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'exec',
+            '-T',
+            '-e',
+            `CT_BOOTSTRAP_EMAIL=${email}`,
+            'web',
+            'bin/onprem',
+            'rpc',
+            rpc,
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: bootstrap-admin RPC failed: ${e?.message ?? e}`,
+        };
+    }
+    if (!out) {
+        return {
+            ok: false,
+            message: 'Error: bootstrap-admin RPC returned empty output (RPC unavailable or symbol missing: bootstrap_admin/add_admin).',
+        };
+    }
+    if (rpcLooksFailed(out)) {
+        return { ok: false, message: `Error: bootstrap-admin rejected: ${out.slice(0, 200)}` };
+    }
+    return {
+        ok: true,
+        message: org === 'new' || org === 'auto'
+            ? `Bootstrap admin ${email} completed (first-boot / auto-org).`
+            : `Add-admin ${email} for org ${org} completed.`,
+    };
+}
+export function telemetryStatePath(home = process.env.HOME ?? '/tmp') {
+    return `${home}/.ct/telemetry.json`;
+}
+export async function getTelemetryStatus(home) {
+    const path = telemetryStatePath(home);
+    try {
+        if (!existsSync(path))
+            return { enabled: false, path };
+        const j = JSON.parse(readFileSync(path, 'utf-8'));
+        return { enabled: !!j.enabled, path };
+    }
+    catch {
+        return { enabled: false, path };
+    }
+}
+export async function setTelemetry(enabled, home) {
+    const path = telemetryStatePath(home);
+    const { dirname } = await import('node:path');
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify({ enabled, updatedAt: new Date().toISOString() }, null, 2));
+    return {
+        ok: true,
+        message: enabled
+            ? 'CLI telemetry enabled (pseudonymous analytics).'
+            : 'CLI telemetry disabled.',
+    };
+}
+export function leasePath(home = process.env.HOME ?? '/tmp') {
+    return `${home}/.ct/operation-lease.json`;
+}
+export async function operationLeaseStatus(home) {
+    const path = leasePath(home);
+    if (!existsSync(path)) {
+        return { ok: true, message: 'No operation lease held.', lease: null };
+    }
+    try {
+        const lease = JSON.parse(readFileSync(path, 'utf-8'));
+        const expired = Date.parse(lease.expiresAt) < Date.now();
+        return {
+            ok: true,
+            message: expired
+                ? `Stale lease by ${lease.holder} (expired ${lease.expiresAt}).`
+                : `Lease held by ${lease.holder} until ${lease.expiresAt}.`,
+            lease,
+        };
+    }
+    catch {
+        return { ok: false, message: 'Error: corrupt lease file.' };
+    }
+}
+export async function operationLeaseAcquire(holder, ttlMinutes = 60, home) {
+    const { dirname } = await import('node:path');
+    const path = leasePath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    if (existsSync(path)) {
+        try {
+            const cur = JSON.parse(readFileSync(path, 'utf-8'));
+            if (Date.parse(cur.expiresAt) > Date.now() && cur.holder !== holder) {
+                return { ok: false, message: `Error: lease held by ${cur.holder} until ${cur.expiresAt}.` };
+            }
+        }
+        catch {
+            /* overwrite corrupt */
+        }
+    }
+    const now = new Date();
+    const exp = new Date(now.getTime() + ttlMinutes * 60_000);
+    const lease = {
+        holder,
+        acquiredAt: now.toISOString(),
+        expiresAt: exp.toISOString(),
+    };
+    writeFileSync(path, JSON.stringify(lease, null, 2));
+    return { ok: true, message: `Lease acquired by ${holder} until ${lease.expiresAt}.` };
+}
+export async function operationLeaseRelease(holder, home) {
+    const path = leasePath(home);
+    if (!existsSync(path))
+        return { ok: true, message: 'No lease to release.' };
+    try {
+        const cur = JSON.parse(readFileSync(path, 'utf-8'));
+        if (cur.holder !== holder) {
+            return { ok: false, message: `Error: lease owned by ${cur.holder}, not ${holder}.` };
+        }
+    }
+    catch {
+        /* remove anyway */
+    }
+    rmSync(path, { force: true });
+    return { ok: true, message: `Lease released by ${holder}.` };
+}
+export async function operationLeaseRecover(home) {
+    const path = leasePath(home);
+    if (existsSync(path))
+        rmSync(path, { force: true });
+    return { ok: true, message: 'Stale operation lease recovered (file removed).' };
+}
+// ── Prep cluster / build appliance ───────────────────────────────────────
+export async function prepClusterNode(opts = {}) {
+    const steps = [
+        'command -v kubectl',
+        'command -v helm',
+        'command -v git',
+        'echo no-k3s-guidance',
+    ];
+    if (opts.dryRun) {
+        return {
+            ok: true,
+            message: `prep-cluster-node dry-run (lab/non-production): ${steps.join('; ')}`,
+            steps,
+        };
+    }
+    const run = opts.run ?? defaultRun;
+    const executed = [];
+    for (const step of ['kubectl', 'helm', 'git']) {
+        try {
+            await runOrThrow(run, 'bash', ['-c', `command -v ${step}`]);
+            executed.push(step);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                message: `Error: prep-cluster-node missing required tool '${step}': ${e?.message ?? e}`,
+                steps: executed,
+            };
+        }
+    }
+    try {
+        await runOrThrow(run, 'bash', [
+            '-c',
+            'echo "Use kubeadm/k3s separately; prep-cluster-node installs helpers only (lab profile)."',
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: prep-cluster-node guidance failed: ${e?.message ?? e}`,
+            steps: executed,
+        };
+    }
+    return {
+        ok: true,
+        message: `prep-cluster-node (lab/non-production): verified tools (${executed.join(', ')}).`,
+        steps: executed,
+    };
+}
+export async function buildAppliance(opts = {}) {
+    if (opts.dryRun) {
+        return {
+            ok: true,
+            message: 'Would download appliance prep installer (lab/non-production path check only).',
+        };
+    }
+    const run = opts.run ?? defaultRun;
+    try {
+        const body = await runOrThrow(run, 'curl', [
+            '-fsSL',
+            '--connect-timeout',
+            '10',
+            '--max-time',
+            '60',
+            'https://get.calltelemetry.com/install-ct.sh',
+        ]);
+        if (!body.includes('install') && !body.includes('ct') && body.length < 20) {
+            return { ok: false, message: 'Error: build-appliance installer response too short or empty.' };
+        }
+        return {
+            ok: true,
+            message: `build-appliance (lab/non-production): fetched installer (${body.length} bytes). Does not build production OVA.`,
+        };
+    }
+    catch (e) {
+        return { ok: false, message: `Error: build-appliance fetch failed: ${e?.message ?? e}` };
+    }
+}
+// ── Postgres convert-bitnami ──────────────────────────────────────────────
+/**
+ * Detect-and-report only. Never writes a comment-only postgresql.conf as "repaired".
+ * Full Bitnami conversion remains out of the default customer path.
+ */
+export async function postgresConvertBitnami(opts = {}) {
+    const dataDir = opts.dataDir ??
+        join(opts.installDir ? join(opts.installDir, 'postgres-data') : getPaths().postgresDataDir, 'data');
+    const hasDataDir = existsSync(dataDir);
+    const confPath = join(dataDir, 'postgresql.conf');
+    const hasConf = existsSync(confPath);
+    const report = [
+        'postgres convert-bitnami: detect-and-report only (no auto-repair).',
+        `  dataDir: ${dataDir}`,
+        `  dataDir exists: ${hasDataDir}`,
+        `  postgresql.conf: ${hasConf ? 'present' : 'MISSING'}`,
+        hasConf
+            ? '  layout: config present — no action required from this command.'
+            : '  layout: config missing — do not treat a comment-only stub as repair; use documented migration.',
+        opts.experimental
+            ? '  mode: --experimental (still detect-only; mutate path removed).'
+            : '  note: experimental mutate path removed; this command never writes conf.',
+    ].join('\n');
+    if (opts.dryRun) {
+        return { ok: true, message: `Would detect PostgreSQL layout under ${dataDir} (no writes).` };
+    }
+    // Always report; ok:true when detection ran. Missing conf is informational, not a green repair.
+    return { ok: true, message: report };
+}
+// ── RIS phone-export ─────────────────────────────────────────────────────
+export async function risPhoneExport(opts = {}) {
+    if (!opts.experimental) {
+        return {
+            ok: false,
+            message: 'Error: ris phone-export is experimental/non-production. Pass --experimental.',
+        };
+    }
+    const run = opts.run ?? defaultRun;
+    const dest = opts.output ?? `ris-phone-export-${Date.now()}.log`;
+    try {
+        await runOrThrow(run, 'bash', [
+            '-c',
+            [
+                `DEST=${JSON.stringify(dest)}`,
+                'TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)',
+                '{',
+                '  echo "=== RIS phone-export $TS ==="',
+                '  echo "phase=before"',
+                '  echo "note=experimental non-production snapshot"',
+                '  docker compose ps 2>/dev/null | head -20 || true',
+                '  echo "phase=export"',
+                '  echo "soap=pending-or-offline"',
+                '  echo "phase=after"',
+                '} > "$DEST"',
+                'test -s "$DEST"',
+            ].join('\n'),
+        ]);
+    }
+    catch (e) {
+        return { ok: false, message: `Error: ris phone-export failed to write ${dest}: ${e?.message ?? e}` };
+    }
+    return {
+        ok: true,
+        message: `RIS phone-export experimental snapshot written to ${dest}.`,
+    };
+}
+// ── SQL monitor password ─────────────────────────────────────────────────
+export async function sqlMonitorPassword(opts = {}) {
+    const envPath = envFilePath(opts.installDir);
+    try {
+        const keys = readEnvKeysAt(opts.installDir);
+        const lines = [];
+        for (const [k, v] of Object.entries(keys)) {
+            if (/^(PGHERO_|SQL_MONITOR_)/.test(k)) {
+                const redacted = /PASSWORD/i.test(k) ? '***' : v;
+                lines.push(`${k}=${redacted}`);
+            }
+        }
+        if (lines.length === 0) {
+            return {
+                ok: true,
+                message: `sql-monitor: no credentials in ${envPath} (enable sql-monitor first).`,
+            };
+        }
+        return { ok: true, message: lines.join('\n') };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error reading sql-monitor credentials from ${envPath}: ${e?.message ?? e}`,
+        };
+    }
+}
+export async function sqlMonitorRotatePassword(opts = {}) {
+    const run = opts.run ?? defaultRun;
+    const pass = `pgh_${randomBytes(18).toString('base64url')}`;
+    const envPath = envFilePath(opts.installDir);
+    try {
+        updateEnvKeyFile('PGHERO_PASSWORD', pass, opts.installDir);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error writing PGHERO_PASSWORD to ${envPath}: ${e?.message ?? e}`,
+        };
+    }
+    try {
+        await runOrThrow(run, 'docker', [
+            'compose',
+            ...composeProjectArgs(opts.installDir),
+            'up',
+            '-d',
+            '--no-deps',
+            '--force-recreate',
+            'pghero',
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error recreating pghero after password rotate (password may already be in ${envPath}): ${e?.message ?? e}`,
+        };
+    }
+    return {
+        ok: true,
+        message: `sql-monitor password rotated. New password: ${pass} (written to ${envPath}).`,
+    };
+}
+// ── Offline depth helpers ────────────────────────────────────────────────
+export async function offlineListImages(opts = {}) {
+    const composePath = composeFilePath(opts.installDir);
+    try {
+        if (!existsSync(composePath)) {
+            return { ok: true, message: `No docker-compose.yml at ${composePath}.` };
+        }
+        const lines = readFileSync(composePath, 'utf-8')
+            .split('\n')
+            .filter((l) => /image\s*:/.test(l))
+            .slice(0, 40);
+        return {
+            ok: true,
+            message: lines.length ? lines.join('\n') : `No image: lines in ${composePath}.`,
+        };
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error reading compose images from ${composePath}: ${e?.message ?? e}`,
+        };
+    }
+}
+export async function offlineFetchVersion(version, opts = {}) {
+    if (!version.trim())
+        return { ok: false, message: 'Error: version required.' };
+    if (opts.dryRun)
+        return { ok: true, message: `Would fetch offline bundle for ${version}.` };
+    const run = opts.run ?? defaultRun;
+    try {
+        await runOrThrow(run, 'curl', [
+            '-fsSIL',
+            `https://get.calltelemetry.com/releases/${version}/manifest.json`,
+        ]);
+    }
+    catch (e) {
+        return {
+            ok: false,
+            message: `Error: offline fetch manifest check failed for ${version}: ${e?.message ?? e}`,
+        };
+    }
+    return { ok: true, message: `offline fetch: checked manifest path for ${version}.` };
+}
+// ── Migrate legacy polish ────────────────────────────────────────────────
+export async function migrateLegacyStatus(opts = {}) {
+    const run = opts.run ?? defaultRun;
+    // Read-only: soft is acceptable; prefer honest empty messaging
+    const out = await soft(run, 'docker', [
+        'compose',
+        ...composeProjectArgs(opts.installDir),
+        'exec',
+        '-T',
+        'web',
+        'bin/onprem',
+        'rpc',
+        'Cdrcisco.Release.legacy_partition_status()',
+    ]);
+    if (opts.json) {
+        return { ok: true, message: JSON.stringify({ status: out || 'unknown' }) };
+    }
+    return {
+        ok: true,
+        message: out || 'migrate legacy: status unavailable (stack offline); use when web is up.',
+    };
+}
+// ── Rollback list polish ─────────────────────────────────────────────────
+export async function listRollbackSnapshots(opts = {}) {
+    const dir = opts.dir ??
+        join(opts.installDir ?? getPaths().installDir, 'snapshots');
+    try {
+        if (!existsSync(dir)) {
+            return { ok: true, message: 'No rollback snapshots found.', snapshots: [] };
+        }
+        const snapshots = readdirSync(dir).filter(Boolean).slice(-20);
+        return {
+            ok: true,
+            message: snapshots.length
+                ? `Snapshots:\n${snapshots.map((s) => `  ${s}`).join('\n')}`
+                : 'No rollback snapshots found.',
+            snapshots,
+        };
+    }
+    catch (e) {
+        // Optional soft read via run for remote listing if dir unreadable
+        if (opts.run) {
+            const out = await soft(opts.run, 'bash', ['-c', `ls -1 ${JSON.stringify(dir)} 2>/dev/null | tail -20`]);
+            const snapshots = out ? out.split('\n').filter(Boolean) : [];
+            return {
+                ok: true,
+                message: snapshots.length
+                    ? `Snapshots:\n${snapshots.map((s) => `  ${s}`).join('\n')}`
+                    : 'No rollback snapshots found.',
+                snapshots,
+            };
+        }
+        return {
+            ok: false,
+            message: `Error listing snapshots under ${dir}: ${e?.message ?? e}`,
+            snapshots: [],
+        };
+    }
+}
+//# sourceMappingURL=ops-port.js.map