@calltelemetry/cli 0.5.18 → 0.6.0

package/dist/shell/network-onboarding.js

@@ -1,22 +1,32 @@
 /**
- * network-onboarding.ts — First-boot network setup wizard for ct shell.
+ * network-onboarding.ts — First-boot setup wizard for ct shell.
  *
- * Guides the operator through IP / gateway / DNS configuration with:
- *   - Field-by-field prompts (IP, prefix, gateway, DNS)
- *   - Default values shown in brackets (press Enter to accept)
- *   - Input validation before applying
- *   - Summary + confirm before writing to NetworkManager
- *   - Gateway ping after apply to verify reachability
+ * Six-step wizard that collects all configuration atomically before applying:
+ *   1. Network (IP/DHCP, DNS, search domain)
+ *   2. System Identity (hostname, location)
+ *   3. Admin Credentials (root password)
+ *   4. Timezone
+ *   5. NTP Time Servers
+ *   6. Preferences (auto-update, IPv6, JTAPI)
+ *
+ * After collection, shows a unified summary and offers Apply/Edit/Cancel.
+ * Apply phase runs all changes sequentially with progress output.
+ * Verify phase checks connectivity and reports warnings (not blockers).
  */
 import * as readline from 'node:readline';
 import { execSync, spawnSync } from 'node:child_process';
 import { writeFileSync } from 'node:fs';
 import chalk from 'chalk';
-import { loadPrefs, savePrefs } from '../lib/prefs.js';
+import { savePrefs } from '../lib/prefs.js';
+import { getHostname, isValidHostname, buildFqdn, applyHostname, applyAdminPassword, isStrongPassword, } from '../lib/identity.js';
+import { getSystemTimezone, TIMEZONE_REGIONS, searchTimezones, isValidTimezone, applyTimezone, applyNtpServers, checkNtpSync, DEFAULT_NTP, } from '../lib/time.js';
+import { generateSelfSignedCerts, getCertInfo } from '../lib/certs.js';
+export { buildFqdn } from '../lib/identity.js';
 export const NETWORK_SENTINEL = '/etc/ct-network-configured';
 const DEFAULT_DNS1 = '8.8.8.8';
 const DEFAULT_DNS2 = '8.8.4.4';
-// ── Validation helpers (exported for testing) ──────────────────────────────
+const DEFAULT_SEARCH_DOMAIN = 'local';
+// ── Validation helpers (exported for testing) ────────────────────────────────
 const IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
 export function isValidIp(ip) {
     const m = IPV4_RE.exec(ip.trim());
@@ -48,7 +58,14 @@ export function parsePingMs(stdout) {
     // macOS: round-trip min/avg/max/stddev = 1.234/2.345/3.456/0.123 ms
     return null;
 }
-// ── System helpers ─────────────────────────────────────────────────────────
+/** Validate a DNS search domain (e.g. 'local', 'corp.example.com'). */
+export function isValidSearchDomain(domain) {
+    if (domain.length === 0)
+        return true; // empty means no search domain
+    // RFC 1123-ish: labels separated by dots, alphanumeric + hyphens
+    return /^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/.test(domain) && domain.length <= 253;
+}
+// ── System helpers ───────────────────────────────────────────────────────────
 /** Return current global IPv4 address if DHCP already provided one. */
 export function detectCurrentIp() {
     try {
@@ -128,25 +145,26 @@ export function applyDhcp(iface) {
     const up = spawnSync('sudo', ['nmcli', 'connection', 'up', 'ct-network'], { stdio: 'pipe' });
     return up.status === 0;
 }
-// ── Readline helper ────────────────────────────────────────────────────────
+// ── Readline helper ──────────────────────────────────────────────────────────
 function makeAsker(rl) {
     return (question) => new Promise((resolve) => rl.question(question, resolve));
 }
-// ── Wizard ─────────────────────────────────────────────────────────────────
-/**
- * Interactive first-boot network setup wizard.
- * Runs once (when NETWORK_SENTINEL does not exist) before the shell starts.
- */
-export async function runNetworkOnboarding() {
-    console.log('');
-    console.log(chalk.bold.cyan('  Call Telemetry — First-Boot Setup'));
-    console.log(chalk.dim('  ────────────────────────────────────────'));
-    // Always run network wizard — even if DHCP already provided an IP,
-    // the operator should confirm or switch to static.
+// ── Step progress helper ─────────────────────────────────────────────────────
+function stepProgress(label, ok) {
+    if (ok) {
+        console.log(chalk.green(`  ✓ ${label}`));
+    }
+    else {
+        console.log(chalk.red(`  ✗ ${label}`));
+    }
+}
+// ── Step 1: Network ──────────────────────────────────────────────────────────
+async function stepNetwork(ask, state) {
     console.log('');
-    console.log(chalk.bold.cyan('  Step 1 — Network Configuration'));
+    console.log(chalk.bold.cyan('  Step 1 of 6 — Network'));
     console.log(chalk.dim('  ────────────────────────────────────────'));
     const iface = detectIface();
+    state.iface = iface;
     const existingIp = detectCurrentIp();
     console.log(chalk.dim(`  Interface : ${iface}`));
     if (existingIp) {
@@ -156,98 +174,640 @@ export async function runNetworkOnboarding() {
         console.log(chalk.yellow('  No IP address detected.'));
     }
     console.log('');
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-    const ask = makeAsker(rl);
+    // Mode selection — order depends on whether DHCP already has an IP
+    if (existingIp) {
+        console.log(chalk.cyan('  Network mode:'));
+        console.log(chalk.dim('    1  Keep current DHCP configuration'));
+        console.log(chalk.dim('    2  Configure static IP'));
+        console.log('');
+        const mode = (await ask(chalk.bold('  Choice [1]: '))).trim() || '1';
+        if (mode === '2') {
+            state.mode = 'static';
+        }
+        else {
+            state.mode = 'dhcp';
+            state.ip = existingIp;
+        }
+    }
+    else {
+        console.log(chalk.cyan('  Network mode:'));
+        console.log(chalk.dim('    1  Static IP'));
+        console.log(chalk.dim('    2  DHCP (auto)'));
+        console.log('');
+        const mode = (await ask(chalk.bold('  Choice [1]: '))).trim() || '1';
+        if (mode === '2') {
+            state.mode = 'dhcp';
+        }
+        else {
+            state.mode = 'static';
+        }
+    }
+    // Collect static IP fields
+    if (state.mode === 'static') {
+        console.log('');
+        console.log(chalk.cyan('  Static IP Configuration'));
+        console.log(chalk.dim('  ────────────────────────────────────────'));
+        let ip = '';
+        while (!isValidIp(ip)) {
+            ip = (await ask(chalk.bold('  IP Address   (e.g. 192.168.1.100)   : '))).trim();
+            if (!isValidIp(ip))
+                console.log(chalk.red('    ✗ Invalid IP address — enter four octets, e.g. 192.168.1.100'));
+        }
+        state.ip = ip;
+        let prefix = '';
+        while (!isValidPrefix(prefix)) {
+            prefix = (await ask(chalk.bold('  Prefix       (e.g. 24 for /24)      : '))).trim();
+            if (!isValidPrefix(prefix))
+                console.log(chalk.red('    ✗ Invalid prefix — enter a number between 1 and 30'));
+        }
+        state.prefix = prefix;
+        let gateway = '';
+        while (!isValidGateway(gateway)) {
+            gateway = (await ask(chalk.bold('  Gateway      (e.g. 192.168.1.1)     : '))).trim();
+            if (!isValidGateway(gateway))
+                console.log(chalk.red('    ✗ Invalid gateway — enter a valid IPv4 address'));
+        }
+        state.gateway = gateway;
+    }
+    // DNS (applies to both modes)
+    const dns1Raw = await ask(chalk.bold(`  Primary DNS  [${DEFAULT_DNS1}]             : `));
+    state.dns1 = parseDnsField(dns1Raw, DEFAULT_DNS1);
+    const dns2Raw = await ask(chalk.bold(`  Secondary DNS [${DEFAULT_DNS2}]           : `));
+    state.dns2 = parseDnsField(dns2Raw, DEFAULT_DNS2);
+    // Search domain
+    const domainRaw = await ask(chalk.bold(`  Search domain [${DEFAULT_SEARCH_DOMAIN}]            : `));
+    state.searchDomain = parseDnsField(domainRaw, DEFAULT_SEARCH_DOMAIN);
+    // Quick connectivity check
+    console.log('');
+    console.log(chalk.dim('  Quick connectivity check...'));
+    if (state.mode === 'static' && state.gateway) {
+        const ms = pingGateway(state.gateway);
+        if (ms !== null) {
+            console.log(chalk.green(`  ✓ Gateway ${state.gateway} reachable (${ms}ms)`));
+        }
+        else {
+            console.log(chalk.yellow(`  ⚠ Gateway ${state.gateway} not reachable — may work after apply`));
+        }
+    }
+    // DNS resolve test
     try {
-        if (existingIp) {
-            console.log(chalk.cyan('  Network mode:'));
-            console.log(chalk.dim('    1  Keep current DHCP configuration'));
-            console.log(chalk.dim('    2  Configure static IP'));
+        const result = spawnSync('nslookup', ['google.com', state.dns1], {
+            encoding: 'utf-8',
+            timeout: 5000,
+        });
+        if (result.status === 0) {
+            console.log(chalk.green(`  ✓ DNS resolution via ${state.dns1} working`));
+        }
+        else {
+            console.log(chalk.yellow(`  ⚠ DNS resolution via ${state.dns1} failed — may work after apply`));
+        }
+    }
+    catch {
+        console.log(chalk.yellow(`  ⚠ DNS check skipped — nslookup not available`));
+    }
+}
+// ── Step 2: System Identity ──────────────────────────────────────────────────
+async function stepIdentity(ask, state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Step 2 of 6 — System Identity'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    const currentHostname = getHostname();
+    // Hostname
+    let hostname = '';
+    while (true) {
+        const raw = await ask(chalk.bold(`  Hostname [${currentHostname}]: `));
+        hostname = raw.trim() || currentHostname;
+        if (isValidHostname(hostname))
+            break;
+        console.log(chalk.red('    ✗ Invalid hostname — alphanumeric + hyphens, 1-63 chars, no leading/trailing hyphen'));
+    }
+    state.hostname = hostname;
+    // Show FQDN
+    const fqdn = buildFqdn(hostname, state.searchDomain);
+    console.log(chalk.dim(`  FQDN: ${fqdn}`));
+    // Location
+    const locationRaw = await ask(chalk.bold('  Location (optional): '));
+    state.location = locationRaw.trim();
+    // Cert info
+    console.log('');
+    console.log(chalk.dim(`  A self-signed SSL certificate will be generated for ${chalk.bold(fqdn)}`));
+    console.log(chalk.dim('  To import a CA-signed cert later:'));
+    console.log(chalk.dim('    config certs import <cert.pem> <key.pem>'));
+}
+// ── Step 3: Admin Credentials ────────────────────────────────────────────────
+async function stepAdmin(ask, state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Step 3 of 6 — Admin Credentials'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    console.log(chalk.yellow('  Default passwords must be changed before production use.'));
+    console.log(chalk.dim('  Minimum 12 characters, uppercase, lowercase, and digit required.'));
+    console.log('');
+    while (true) {
+        const pw = (await ask(chalk.bold('  New admin password: '))).trim();
+        const check = isStrongPassword(pw);
+        if (!check.valid) {
+            console.log(chalk.red(`    ✗ ${check.reason}`));
+            continue;
+        }
+        const confirm = (await ask(chalk.bold('  Confirm password:   '))).trim();
+        if (confirm !== pw) {
+            console.log(chalk.red('    ✗ Passwords do not match'));
+            continue;
+        }
+        state.adminPassword = pw;
+        console.log(chalk.green('    ✓ Password accepted'));
+        break;
+    }
+}
+// ── Step 4: Timezone ─────────────────────────────────────────────────────────
+async function stepTimezone(ask, state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Step 4 of 6 — Timezone'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    const currentTz = getSystemTimezone();
+    console.log(chalk.dim(`  Current timezone: ${currentTz}`));
+    console.log('');
+    // Region menu
+    while (true) {
+        console.log(chalk.cyan('  Select region:'));
+        for (let i = 0; i < TIMEZONE_REGIONS.length; i++) {
+            console.log(chalk.dim(`    ${i + 1}  ${TIMEZONE_REGIONS[i].name}`));
+        }
+        console.log(chalk.dim('    4  Other / Custom IANA zone'));
+        console.log(chalk.dim('    s  Search'));
+        console.log('');
+        const choice = (await ask(chalk.bold('  Choice: '))).trim().toLowerCase();
+        if (choice === 's') {
+            // Search mode
+            const query = (await ask(chalk.bold('  Search timezone: '))).trim();
+            if (!query)
+                continue;
+            const results = searchTimezones(query);
+            if (results.length === 0) {
+                console.log(chalk.yellow('    No matches found.'));
+                console.log('');
+                continue;
+            }
             console.log('');
-            const mode = (await ask(chalk.bold('  Choice [1]: '))).trim() || '1';
-            if (mode === '2') {
-                await runStaticIp(rl, ask, iface);
+            for (let i = 0; i < results.length; i++) {
+                const tz = results[i];
+                const note = tz.note ? chalk.dim(` (${tz.note})`) : '';
+                console.log(chalk.dim(`    ${i + 1}  ${tz.label.padEnd(14)} ${tz.offset.padEnd(10)} ${tz.value}${note}`));
             }
-            else {
-                writeSentinel();
-                console.log(chalk.green(`  ✓ Keeping DHCP: ${existingIp}`));
+            console.log(chalk.dim('    b  Back'));
+            console.log('');
+            const pick = (await ask(chalk.bold('  Choice: '))).trim().toLowerCase();
+            if (pick === 'b')
+                continue;
+            const idx = parseInt(pick, 10) - 1;
+            if (idx >= 0 && idx < results.length) {
+                state.timezone = results[idx].value;
+                console.log(chalk.green(`    ✓ Timezone: ${state.timezone}`));
+                return;
+            }
+            console.log(chalk.red('    ✗ Invalid selection'));
+            continue;
+        }
+        if (choice === '4') {
+            // Custom IANA zone
+            while (true) {
+                const tz = (await ask(chalk.bold('  IANA timezone (e.g. America/Chicago): '))).trim();
+                if (!tz)
+                    break;
+                if (isValidTimezone(tz)) {
+                    state.timezone = tz;
+                    console.log(chalk.green(`    ✓ Timezone: ${state.timezone}`));
+                    return;
+                }
+                console.log(chalk.red('    ✗ Invalid timezone — must be a valid IANA zone'));
             }
+            continue;
+        }
+        const regionIdx = parseInt(choice, 10) - 1;
+        if (regionIdx < 0 || regionIdx >= TIMEZONE_REGIONS.length) {
+            console.log(chalk.red('    ✗ Invalid selection'));
+            continue;
+        }
+        // Show zones in selected region
+        const region = TIMEZONE_REGIONS[regionIdx];
+        console.log('');
+        console.log(chalk.cyan(`  ${region.name}:`));
+        for (let i = 0; i < region.zones.length; i++) {
+            const tz = region.zones[i];
+            const note = tz.note ? chalk.dim(` (${tz.note})`) : '';
+            console.log(chalk.dim(`    ${i + 1}  ${tz.label.padEnd(14)} ${tz.offset.padEnd(10)} ${tz.value}${note}`));
+        }
+        console.log(chalk.dim('    b  Back'));
+        console.log('');
+        const zonePick = (await ask(chalk.bold('  Choice: '))).trim().toLowerCase();
+        if (zonePick === 'b')
+            continue;
+        const zoneIdx = parseInt(zonePick, 10) - 1;
+        if (zoneIdx >= 0 && zoneIdx < region.zones.length) {
+            state.timezone = region.zones[zoneIdx].value;
+            console.log(chalk.green(`    ✓ Timezone: ${state.timezone}`));
+            return;
+        }
+        console.log(chalk.red('    ✗ Invalid selection'));
+    }
+}
+// ── Step 5: NTP ──────────────────────────────────────────────────────────────
+async function stepNtp(ask, state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Step 5 of 6 — NTP Time Servers'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    const ntp1Raw = await ask(chalk.bold(`  NTP Server 1 [${DEFAULT_NTP[0]}]: `));
+    state.ntp1 = parseDnsField(ntp1Raw, DEFAULT_NTP[0]);
+    const ntp2Raw = await ask(chalk.bold(`  NTP Server 2 [${DEFAULT_NTP[1]}]: `));
+    state.ntp2 = parseDnsField(ntp2Raw, DEFAULT_NTP[1]);
+    console.log(chalk.green(`    ✓ NTP: ${state.ntp1}, ${state.ntp2}`));
+}
+// ── Step 6: Preferences ──────────────────────────────────────────────────────
+async function stepPreferences(ask, state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Step 6 of 6 — Preferences'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    // Auto-updates
+    const autoUpdate = (await ask(chalk.bold('  Enable automatic CLI updates?    [Y/n]: '))).trim().toLowerCase();
+    state.autoUpdate = autoUpdate !== 'n' && autoUpdate !== 'no';
+    console.log(state.autoUpdate ? chalk.green('    ✓ Auto-updates enabled') : chalk.dim('    ○ Auto-updates disabled'));
+    // IPv6
+    const ipv6 = (await ask(chalk.bold('  Enable IPv6 support?             [y/N]: '))).trim().toLowerCase();
+    state.ipv6 = ipv6 === 'y' || ipv6 === 'yes';
+    console.log(state.ipv6 ? chalk.green('    ✓ IPv6 enabled') : chalk.dim('    ○ IPv6 disabled'));
+    // JTAPI
+    console.log('');
+    console.log(chalk.dim('  JTAPI enables greeting injection — play custom audio greetings'));
+    console.log(chalk.dim('  to callers via Cisco JTAPI phone control. Requires a CUCM user'));
+    console.log(chalk.dim('  with CTI permissions and a JTAPI license.'));
+    const jtapi = (await ask(chalk.bold('  Enable JTAPI greeting injection?  [y/N]: '))).trim().toLowerCase();
+    state.jtapi = jtapi === 'y' || jtapi === 'yes';
+    console.log(state.jtapi ? chalk.green('    ✓ JTAPI greeting injection enabled') : chalk.dim('    ○ JTAPI greeting injection disabled'));
+}
+// ── Summary ──────────────────────────────────────────────────────────────────
+/** Render a full summary of the wizard state. Exported for testing. */
+export function renderSummary(state) {
+    const lines = [];
+    const add = (s) => lines.push(s);
+    add('');
+    add(chalk.bold.cyan('  Configuration Summary'));
+    add(chalk.dim('  ════════════════════════════════════════'));
+    // NETWORK
+    add('');
+    add(chalk.cyan('  NETWORK'));
+    add(chalk.dim('  ────────────────────────────────────────'));
+    add(`  Mode           : ${chalk.bold(state.mode.toUpperCase())}`);
+    if (state.mode === 'static') {
+        add(`  IP Address     : ${chalk.bold(`${state.ip}/${state.prefix}`)}`);
+        add(`  Gateway        : ${chalk.bold(state.gateway)}`);
+    }
+    else if (state.ip) {
+        add(`  IP Address     : ${chalk.bold(state.ip)} ${chalk.dim('(DHCP)')}`);
+    }
+    add(`  Primary DNS    : ${chalk.bold(state.dns1)}`);
+    add(`  Secondary DNS  : ${chalk.bold(state.dns2)}`);
+    add(`  Search Domain  : ${chalk.bold(state.searchDomain)}`);
+    add(`  Interface      : ${chalk.dim(state.iface)}`);
+    // SYSTEM
+    add('');
+    add(chalk.cyan('  SYSTEM'));
+    add(chalk.dim('  ────────────────────────────────────────'));
+    add(`  Hostname       : ${chalk.bold(state.hostname)}`);
+    add(`  FQDN           : ${chalk.bold(buildFqdn(state.hostname, state.searchDomain))}`);
+    add(`  Location       : ${state.location ? chalk.bold(state.location) : chalk.dim('(not set)')}`);
+    add(`  Admin Password : ${chalk.bold('(changed)')}`);
+    // TIME
+    add('');
+    add(chalk.cyan('  TIME'));
+    add(chalk.dim('  ────────────────────────────────────────'));
+    add(`  Timezone       : ${chalk.bold(state.timezone)}`);
+    add(`  NTP Server 1   : ${chalk.bold(state.ntp1)}`);
+    add(`  NTP Server 2   : ${chalk.bold(state.ntp2)}`);
+    // PREFERENCES
+    add('');
+    add(chalk.cyan('  PREFERENCES'));
+    add(chalk.dim('  ────────────────────────────────────────'));
+    add(`  Auto-updates   : ${state.autoUpdate ? chalk.green('Yes') : chalk.dim('No')}`);
+    add(`  IPv6           : ${state.ipv6 ? chalk.green('Yes') : chalk.dim('No')}`);
+    add(`  JTAPI Greetings: ${state.jtapi ? chalk.green('Yes') : chalk.dim('No')}`);
+    add('');
+    return lines.join('\n');
+}
+// ── Apply phase ──────────────────────────────────────────────────────────────
+async function applyWizardState(state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Applying configuration...'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    let allOk = true;
+    // 1. Hostname
+    const hostnameOk = applyHostname(state.hostname);
+    stepProgress('Set hostname', hostnameOk);
+    if (!hostnameOk)
+        allOk = false;
+    // 2. Network
+    if (state.mode === 'static') {
+        const ipPrefix = `${state.ip}/${state.prefix}`;
+        const netOk = applyStaticIp(state.iface, ipPrefix, state.gateway, state.dns1, state.dns2);
+        stepProgress('Apply static IP', netOk);
+        if (!netOk)
+            allOk = false;
+    }
+    else {
+        const netOk = applyDhcp(state.iface);
+        stepProgress('Apply DHCP', netOk);
+        if (!netOk)
+            allOk = false;
+    }
+    // 3. Search domain
+    const dnsSearchResult = spawnSync('sudo', [
+        'nmcli', 'con', 'mod', 'ct-network', 'ipv4.dns-search', state.searchDomain,
+    ], { stdio: 'pipe' });
+    const searchOk = dnsSearchResult.status === 0;
+    stepProgress('Set DNS search domain', searchOk);
+    if (!searchOk)
+        allOk = false;
+    // 4. Admin password
+    const pwOk = applyAdminPassword(state.adminPassword);
+    stepProgress('Set admin password', pwOk);
+    if (!pwOk)
+        allOk = false;
+    // 5. Timezone
+    const tzOk = applyTimezone(state.timezone);
+    stepProgress('Set timezone', tzOk);
+    if (!tzOk)
+        allOk = false;
+    // 6. NTP servers
+    const ntpOk = applyNtpServers(state.ntp1, state.ntp2);
+    stepProgress('Configure NTP servers', ntpOk);
+    if (!ntpOk)
+        allOk = false;
+    // 7. Self-signed certs
+    try {
+        const fqdn = buildFqdn(state.hostname, state.searchDomain);
+        await generateSelfSignedCerts(fqdn, state.ip);
+        stepProgress('Generate SSL certificate', true);
+    }
+    catch {
+        stepProgress('Generate SSL certificate', false);
+        allOk = false;
+    }
+    // 8. Save preferences
+    const prefs = {
+        autoUpdate: state.autoUpdate,
+        ipv6: state.ipv6,
+        otel: true,
+        jtapi: state.jtapi,
+        deploymentMode: 'docker-compose',
+        k8sNamespace: 'ct',
+        k8sEnvironment: 'ct-dev',
+        timezone: state.timezone,
+        ntpServers: [state.ntp1, state.ntp2],
+        hostname: state.hostname,
+        location: state.location || undefined,
+    };
+    savePrefs(prefs);
+    stepProgress('Save preferences', true);
+    // 9. Write sentinel
+    writeSentinel();
+    stepProgress('Mark setup complete', true);
+    return allOk;
+}
+// ── Verify phase ─────────────────────────────────────────────────────────────
+function runVerification(state) {
+    console.log('');
+    console.log(chalk.bold.cyan('  Verification'));
+    console.log(chalk.dim('  ────────────────────────────────────────'));
+    // 1. Ping gateway (static only)
+    if (state.mode === 'static' && state.gateway) {
+        const ms = pingGateway(state.gateway);
+        if (ms !== null) {
+            console.log(chalk.green(`  ✓ Gateway ${state.gateway} reachable (${ms}ms)`));
         }
         else {
-            console.log(chalk.cyan('  Network mode:'));
-            console.log(chalk.dim('    1  Static IP'));
-            console.log(chalk.dim('    2  DHCP (auto)'));
+            console.log(chalk.yellow(`  ⚠ Gateway ${state.gateway} not reachable`));
+            console.log(chalk.dim('    Remediation: network address <ip/prefix> <gateway>'));
+        }
+    }
+    // 2. DNS resolution — search domain
+    try {
+        const result = spawnSync('nslookup', [state.searchDomain, state.dns1], {
+            encoding: 'utf-8',
+            timeout: 5000,
+        });
+        if (result.status === 0) {
+            console.log(chalk.green(`  ✓ DNS resolves ${state.searchDomain} via ${state.dns1}`));
+        }
+        else {
+            console.log(chalk.yellow(`  ⚠ DNS cannot resolve ${state.searchDomain}`));
+            console.log(chalk.dim('    Remediation: network dns-servers <dns1> <dns2>'));
+        }
+    }
+    catch {
+        console.log(chalk.yellow('  ⚠ DNS search domain check skipped'));
+    }
+    // 3. External DNS
+    try {
+        const result = spawnSync('nslookup', ['google.com', state.dns1], {
+            encoding: 'utf-8',
+            timeout: 5000,
+        });
+        if (result.status === 0) {
+            console.log(chalk.green(`  ✓ External DNS resolution working`));
+        }
+        else {
+            console.log(chalk.yellow('  ⚠ External DNS resolution failed'));
+            console.log(chalk.dim('    Remediation: network dns-servers <dns1> <dns2>'));
+        }
+    }
+    catch {
+        console.log(chalk.yellow('  ⚠ External DNS check skipped'));
+    }
+    // 4. NTP sync
+    const ntpSynced = checkNtpSync();
+    if (ntpSynced) {
+        console.log(chalk.green('  ✓ NTP synchronized'));
+    }
+    else {
+        console.log(chalk.yellow('  ⚠ NTP not yet synchronized — may take a few minutes'));
+        console.log(chalk.dim('    Remediation: config ntp <server1> <server2>'));
+    }
+    // 5. Certificate check
+    const certInfo = getCertInfo();
+    if (certInfo) {
+        const fqdn = buildFqdn(state.hostname, state.searchDomain);
+        if (certInfo.cn === fqdn) {
+            console.log(chalk.green(`  ✓ SSL certificate CN matches ${fqdn}`));
+        }
+        else {
+            console.log(chalk.yellow(`  ⚠ SSL certificate CN (${certInfo.cn}) does not match FQDN (${fqdn})`));
+            console.log(chalk.dim('    Remediation: config certs regenerate'));
+        }
+    }
+    else {
+        console.log(chalk.yellow('  ⚠ No SSL certificate found'));
+        console.log(chalk.dim('    Remediation: config certs regenerate'));
+    }
+}
+// ── Step runner mapping ──────────────────────────────────────────────────────
+const STEP_FUNCTIONS = [
+    stepNetwork,
+    stepIdentity,
+    stepAdmin,
+    stepTimezone,
+    stepNtp,
+    stepPreferences,
+];
+const STEP_NAMES = [
+    'Network',
+    'System Identity',
+    'Admin Credentials',
+    'Timezone',
+    'NTP Time Servers',
+    'Preferences',
+];
+// ── Main entry point ─────────────────────────────────────────────────────────
+/**
+ * Interactive first-boot setup wizard.
+ * Runs once (when NETWORK_SENTINEL does not exist) before the shell starts.
+ * Collects all configuration, then applies atomically.
+ */
+export async function runNetworkOnboarding() {
+    console.log('');
+    console.log(chalk.bold.cyan('  Call Telemetry — First-Boot Setup'));
+    console.log(chalk.dim('  ═══════════════════════════════════════'));
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    const ask = makeAsker(rl);
+    try {
+        // Initialize state with defaults
+        const state = {
+            mode: 'dhcp',
+            dns1: DEFAULT_DNS1,
+            dns2: DEFAULT_DNS2,
+            searchDomain: DEFAULT_SEARCH_DOMAIN,
+            iface: 'eth0',
+            hostname: getHostname(),
+            location: '',
+            adminPassword: '',
+            timezone: getSystemTimezone(),
+            ntp1: DEFAULT_NTP[0],
+            ntp2: DEFAULT_NTP[1],
+            autoUpdate: true,
+            ipv6: false,
+            jtapi: false,
+        };
+        // Run steps 1-6 sequentially
+        for (const stepFn of STEP_FUNCTIONS) {
+            await stepFn(ask, state);
+        }
+        // Show/edit/apply loop
+        while (true) {
+            // Show unified summary
+            console.log(renderSummary(state));
+            console.log(chalk.bold('  [A]pply  [E]dit  [C]ancel'));
             console.log('');
-            const mode = (await ask(chalk.bold('  Choice [1]: '))).trim() || '1';
-            if (mode === '2') {
-                await runDhcp(rl, ask, iface);
+            const action = (await ask(chalk.bold('  Choice: '))).trim().toLowerCase();
+            if (action === 'c') {
+                console.log(chalk.yellow('\n  Cancelled — no changes applied.\n'));
+                return;
+            }
+            if (action === 'e') {
+                console.log('');
+                for (let i = 0; i < STEP_NAMES.length; i++) {
+                    console.log(chalk.dim(`    ${i + 1}  ${STEP_NAMES[i]}`));
+                }
+                console.log('');
+                const stepChoice = (await ask(chalk.bold('  Which step? [1-6]: '))).trim();
+                const stepIdx = parseInt(stepChoice, 10) - 1;
+                if (stepIdx >= 0 && stepIdx < STEP_FUNCTIONS.length) {
+                    await STEP_FUNCTIONS[stepIdx](ask, state);
+                }
+                else {
+                    console.log(chalk.red('    ✗ Invalid step number'));
+                }
+                continue; // re-show summary
             }
-            else {
-                await runStaticIp(rl, ask, iface);
+            if (action === 'a' || action === '') {
+                // Apply all
+                const ok = await applyWizardState(state);
+                if (ok) {
+                    console.log('');
+                    console.log(chalk.green('  ✓ All configuration applied successfully'));
+                }
+                else {
+                    console.log('');
+                    console.log(chalk.yellow('  ⚠ Some steps had errors — check messages above'));
+                }
+                // Verify
+                runVerification(state);
+                // Show Web UI + SSH info
+                const displayIp = state.ip ?? detectCurrentIp() ?? state.hostname;
+                console.log('');
+                console.log(chalk.dim('  ────────────────────────────────────────'));
+                console.log(chalk.bold(`  Web UI : https://${displayIp}`));
+                console.log(chalk.bold(`  SSH    : ssh root@${displayIp}`));
+                console.log('');
+                break;
             }
+            console.log(chalk.red('    ✗ Invalid choice — enter A, E, or C'));
         }
     }
     finally {
         rl.close();
     }
-    // Run preferences wizard if prefs haven't been configured yet
-    if (!loadPrefs()) {
-        await runPreferencesOnboarding();
-    }
     console.log(chalk.dim('  Continuing to management shell...\n'));
 }
-// ── Preferences Onboarding ──────────────────────────────────────────────────
+// ── Preferences-only onboarding ──────────────────────────────────────────────
 /**
- * Interactive preferences wizard for first-boot configuration.
- * Asks about optional features and saves to ~/.ct/preferences.json.
+ * Interactive preferences wizard for when network is already configured
+ * but preferences haven't been set yet. Runs only Step 6.
  */
 export async function runPreferencesOnboarding() {
     console.log('');
-    console.log(chalk.bold.cyan('  Step 2 — Appliance Preferences'));
-    console.log(chalk.dim('  ────────────────────────────────────────'));
+    console.log(chalk.bold.cyan('  Call Telemetry — Preferences Setup'));
+    console.log(chalk.dim('  ═══════════════════════════════════════'));
     console.log(chalk.dim('  Configure optional features. Press Enter to accept defaults.'));
-    console.log('');
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
     const ask = makeAsker(rl);
     try {
-        const prefs = {
-            autoUpdate: false,
+        const state = {
+            mode: 'dhcp',
+            dns1: DEFAULT_DNS1,
+            dns2: DEFAULT_DNS2,
+            searchDomain: DEFAULT_SEARCH_DOMAIN,
+            iface: 'eth0',
+            hostname: getHostname(),
+            location: '',
+            adminPassword: '',
+            timezone: getSystemTimezone(),
+            ntp1: DEFAULT_NTP[0],
+            ntp2: DEFAULT_NTP[1],
+            autoUpdate: true,
             ipv6: false,
-            otel: true, // Always enabled — not a user preference
             jtapi: false,
-            deploymentMode: 'docker-compose',
-            k8sNamespace: 'ct',
-            k8sEnvironment: 'ct-dev',
         };
-        // Auto-updates
-        const autoUpdate = (await ask(chalk.bold('  Enable automatic CLI updates?  [Y/n]: '))).trim().toLowerCase();
-        prefs.autoUpdate = autoUpdate !== 'n' && autoUpdate !== 'no';
-        console.log(prefs.autoUpdate ? chalk.green('    ✓ Auto-updates enabled') : chalk.dim('    ○ Auto-updates disabled'));
-        // IPv6
-        const ipv6 = (await ask(chalk.bold('  Enable IPv6 support?           [y/N]: '))).trim().toLowerCase();
-        prefs.ipv6 = ipv6 === 'y' || ipv6 === 'yes';
-        console.log(prefs.ipv6 ? chalk.green('    ✓ IPv6 enabled') : chalk.dim('    ○ IPv6 disabled'));
-        // JTAPI Greeting Injection
-        console.log('');
-        console.log(chalk.dim('  JTAPI enables greeting injection — play custom audio greetings'));
-        console.log(chalk.dim('  to callers via Cisco JTAPI phone control. Requires a CUCM user'));
-        console.log(chalk.dim('  with CTI permissions and a JTAPI license.'));
-        const jtapi = (await ask(chalk.bold('  Enable JTAPI greeting injection? [y/N]: '))).trim().toLowerCase();
-        prefs.jtapi = jtapi === 'y' || jtapi === 'yes';
-        console.log(prefs.jtapi ? chalk.green('    ✓ JTAPI greeting injection enabled') : chalk.dim('    ○ JTAPI greeting injection disabled'));
+        await stepPreferences(ask, state);
         // Summary
         console.log('');
         console.log(chalk.cyan('  Preferences Summary'));
         console.log(chalk.dim('  ────────────────────────────────────────'));
-        console.log(`  Auto-updates         : ${prefs.autoUpdate ? chalk.green('Yes') : chalk.dim('No')}`);
-        console.log(`  IPv6                 : ${prefs.ipv6 ? chalk.green('Yes') : chalk.dim('No')}`);
-        console.log(`  JTAPI Greetings      : ${prefs.jtapi ? chalk.green('Yes') : chalk.dim('No')}`);
+        console.log(`  Auto-updates     : ${state.autoUpdate ? chalk.green('Yes') : chalk.dim('No')}`);
+        console.log(`  IPv6             : ${state.ipv6 ? chalk.green('Yes') : chalk.dim('No')}`);
+        console.log(`  JTAPI Greetings  : ${state.jtapi ? chalk.green('Yes') : chalk.dim('No')}`);
         console.log('');
         const confirm = (await ask(chalk.bold('  Save preferences? [Y/n]: '))).trim().toLowerCase();
         if (confirm === 'n' || confirm === 'no') {
             console.log(chalk.yellow('  Skipped — defaults will be used. Edit later with: config preferences'));
             return;
         }
+        const prefs = {
+            autoUpdate: state.autoUpdate,
+            ipv6: state.ipv6,
+            otel: true,
+            jtapi: state.jtapi,
+            deploymentMode: 'docker-compose',
+            k8sNamespace: 'ct',
+            k8sEnvironment: 'ct-dev',
+        };
         savePrefs(prefs);
         console.log(chalk.green('  ✓ Preferences saved'));
     }
@@ -255,103 +815,4 @@ export async function runPreferencesOnboarding() {
         rl.close();
     }
 }
-async function runDhcp(_rl, _ask, iface) {
-    console.log('');
-    console.log(chalk.dim('  Requesting IP via DHCP...'));
-    const ok = applyDhcp(iface);
-    if (!ok) {
-        console.log(chalk.red('  ✗ DHCP configuration failed.'));
-        console.log(chalk.dim('  Retry from the shell:  network dhcp'));
-        return;
-    }
-    // Wait briefly for DHCP lease
-    await new Promise((r) => setTimeout(r, 2000));
-    const ip = detectCurrentIp();
-    if (ip) {
-        writeSentinel();
-        console.log(chalk.green(`  ✓ Network ready (DHCP): ${ip}`));
-    }
-    else {
-        console.log(chalk.yellow('  ⚠  No IP obtained via DHCP yet — lease may still be pending.'));
-        console.log(chalk.dim('  Check status:  show interfaces'));
-    }
-    console.log('');
-}
-async function runStaticIp(_rl, ask, iface) {
-    console.log('');
-    console.log(chalk.cyan('  Static IP Configuration'));
-    console.log(chalk.dim('  ────────────────────────────────────────'));
-    // ── Collect fields ──────────────────────────────────────────────────
-    let ip = '';
-    while (!isValidIp(ip)) {
-        ip = (await ask(chalk.bold('  IP Address   (e.g. 192.168.1.100)   : '))).trim();
-        if (!isValidIp(ip))
-            console.log(chalk.red('    ✗ Invalid IP address — enter four octets, e.g. 192.168.1.100'));
-    }
-    let prefix = '';
-    while (!isValidPrefix(prefix)) {
-        prefix = (await ask(chalk.bold('  Prefix       (e.g. 24 for /24)      : '))).trim();
-        if (!isValidPrefix(prefix))
-            console.log(chalk.red('    ✗ Invalid prefix — enter a number between 1 and 30'));
-    }
-    let gateway = '';
-    while (!isValidGateway(gateway)) {
-        gateway = (await ask(chalk.bold('  Gateway      (e.g. 192.168.1.1)     : '))).trim();
-        if (!isValidGateway(gateway))
-            console.log(chalk.red('    ✗ Invalid gateway — enter a valid IPv4 address'));
-    }
-    const dns1Raw = await ask(chalk.bold(`  Primary DNS  [${DEFAULT_DNS1}]             : `));
-    const dns1 = parseDnsField(dns1Raw, DEFAULT_DNS1);
-    const dns2Raw = await ask(chalk.bold(`  Secondary DNS [${DEFAULT_DNS2}]           : `));
-    const dns2 = parseDnsField(dns2Raw, DEFAULT_DNS2);
-    const ipPrefix = `${ip}/${prefix}`;
-    // ── Summary ─────────────────────────────────────────────────────────
-    console.log('');
-    console.log(chalk.cyan('  Summary'));
-    console.log(chalk.dim('  ────────────────────────────────────────'));
-    console.log(`  IP Address  : ${chalk.bold(ipPrefix)}`);
-    console.log(`  Gateway     : ${chalk.bold(gateway)}`);
-    console.log(`  Primary DNS : ${chalk.bold(dns1)}`);
-    console.log(`  Secondary   : ${chalk.bold(dns2)}`);
-    console.log(`  Interface   : ${chalk.dim(iface)}`);
-    console.log('');
-    const confirm = (await ask(chalk.bold('  Apply? [Y/n]: '))).trim().toLowerCase();
-    if (confirm === 'n' || confirm === 'no') {
-        console.log(chalk.yellow('\n  Cancelled. Run  network address <ip/prefix> <gateway>  to configure manually.\n'));
-        return;
-    }
-    // ── Apply ────────────────────────────────────────────────────────────
-    console.log('');
-    console.log(chalk.dim('  Applying static IP...'));
-    const ok = applyStaticIp(iface, ipPrefix, gateway, dns1, dns2);
-    if (!ok) {
-        console.log(chalk.red('  ✗ Failed to apply network configuration.'));
-        console.log(chalk.dim('  Retry from the shell:'));
-        console.log(chalk.dim(`    network address ${iface} ${ipPrefix} ${gateway}`));
-        console.log(chalk.dim(`    network dns-servers ${dns1} ${dns2}`));
-        console.log('');
-        return;
-    }
-    // ── Verify IP ────────────────────────────────────────────────────────
-    const newIp = detectCurrentIp();
-    if (newIp) {
-        writeSentinel();
-        console.log(chalk.green(`  ✓ Network configured: ${newIp}`));
-    }
-    else {
-        console.log(chalk.yellow('  ⚠  Configuration applied but no IP detected yet.'));
-    }
-    // ── Ping gateway ─────────────────────────────────────────────────────
-    process.stdout.write(chalk.dim(`  Checking gateway ${gateway}...`));
-    const ms = pingGateway(gateway);
-    if (ms !== null) {
-        console.log(chalk.green(` ✓ reachable (${ms}ms)`));
-    }
-    else {
-        console.log(chalk.yellow(' ⚠  no response — check gateway address'));
-    }
-    console.log('');
-    console.log(chalk.dim(`  Web UI: https://${newIp ?? ip}`));
-    console.log('');
-}
 //# sourceMappingURL=network-onboarding.js.map