@calltelemetry/cli 0.6.12 → 0.6.13

package/dist/lib/migration-004-systemd-docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-004-systemd-docker.js","sourceRoot":"","sources":["../../src/lib/migration-004-systemd-docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,YAAY,GAAG,sCAAsC,CAAC;AAC5D,MAAM,aAAa,GAAG,GAAG,YAAY,gBAAgB,CAAC;AACtD,MAAM,gBAAgB,GAAG;;;CAGxB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,wDAAwD;IACxD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC,CAAC,kBAAkB;YAClC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACzC,CAAC;IAED,4BAA4B;IAC5B,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpE,+BAA+B;IAC/B,MAAM,GAAG,GAAG,4BAA4B,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;IAC1D,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,iBAAiB;IACjB,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAErE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-005-ssh-keys.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Migration 005: Regenerate SSH host keys.
+ *
+ * OVA clones share the same SSH host keys from the template build,
+ * enabling MITM attacks between appliances. This migration regenerates
+ * unique host keys for each appliance.
+ *
+ * Only runs if the key fingerprint matches a known OVA template
+ * fingerprint, or if a sentinel file indicates keys haven't been
+ * regenerated since OVA deployment.
+ */
+export declare function migrateSshKeys(): Promise<boolean>;
+//# sourceMappingURL=migration-005-ssh-keys.d.ts.map

package/dist/lib/migration-005-ssh-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-005-ssh-keys.d.ts","sourceRoot":"","sources":["../../src/lib/migration-005-ssh-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,wBAAsB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAmCvD"}

package/dist/lib/migration-005-ssh-keys.js

@@ -0,0 +1,49 @@
+/**
+ * Migration 005: Regenerate SSH host keys.
+ *
+ * OVA clones share the same SSH host keys from the template build,
+ * enabling MITM attacks between appliances. This migration regenerates
+ * unique host keys for each appliance.
+ *
+ * Only runs if the key fingerprint matches a known OVA template
+ * fingerprint, or if a sentinel file indicates keys haven't been
+ * regenerated since OVA deployment.
+ */
+import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const SSH_REGEN_SENTINEL = '/etc/ct-ssh-keys-regenerated';
+export async function migrateSshKeys() {
+    // If sentinel exists, keys were already regenerated
+    if (existsSync(SSH_REGEN_SENTINEL)) {
+        return false;
+    }
+    // Check if SSH host keys exist at all
+    const hasKeys = existsSync('/etc/ssh/ssh_host_ed25519_key') ||
+        existsSync('/etc/ssh/ssh_host_rsa_key');
+    if (!hasKeys) {
+        // No keys at all — generate fresh ones
+        spawnSync('sudo', ['ssh-keygen', '-A'], { stdio: 'pipe' });
+    }
+    else {
+        // Keys exist but may be from OVA template — regenerate
+        // Remove old keys
+        spawnSync('sudo', ['bash', '-c', 'rm -f /etc/ssh/ssh_host_*_key*'], { stdio: 'pipe' });
+        // Generate new keys
+        const keygen = spawnSync('sudo', ['ssh-keygen', '-A'], { stdio: 'pipe' });
+        if (keygen.status !== 0) {
+            throw new Error('ssh-keygen -A failed');
+        }
+    }
+    // Write sentinel so this never runs again
+    const tmp = `/tmp/ct-ssh-sentinel-${Date.now()}`;
+    require('node:fs').writeFileSync(tmp, new Date().toISOString());
+    spawnSync('sudo', ['cp', tmp, SSH_REGEN_SENTINEL], { stdio: 'pipe' });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    // Reload sshd to pick up new keys (don't restart — would kill current session)
+    spawnSync('sudo', ['systemctl', 'reload', 'sshd'], { stdio: 'pipe' });
+    return true;
+}
+//# sourceMappingURL=migration-005-ssh-keys.js.map

package/dist/lib/migration-005-ssh-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-005-ssh-keys.js","sourceRoot":"","sources":["../../src/lib/migration-005-ssh-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,SAAS,EAAY,MAAM,oBAAoB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,oDAAoD;IACpD,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sCAAsC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,+BAA+B,CAAC;QAC3C,UAAU,CAAC,2BAA2B,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,uCAAuC;QACvC,SAAS,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,uDAAuD;QACvD,kBAAkB;QAClB,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,gCAAgC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEvF,oBAAoB;QACpB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,wBAAwB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjD,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,+EAA+E;IAC/E,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-006-console-loglevel.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Migration 006: Suppress noisy kernel console warnings.
+ *
+ * Docker/firewalld loads nft_compat and ip_set kernel modules which emit
+ * KERN_WARNING (level 4) messages to the console. These clutter the TTY
+ * and alarm users. The kernel cmdline loglevel=3 set during OVA build
+ * gets reset by systemd on boot; a sysctl.d drop-in persists it.
+ */
+export declare function migrateConsoleLoglevel(): Promise<boolean>;
+//# sourceMappingURL=migration-006-console-loglevel.d.ts.map

package/dist/lib/migration-006-console-loglevel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-006-console-loglevel.d.ts","sourceRoot":"","sources":["../../src/lib/migration-006-console-loglevel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAc/D"}

package/dist/lib/migration-006-console-loglevel.js

@@ -0,0 +1,27 @@
+/**
+ * Migration 006: Suppress noisy kernel console warnings.
+ *
+ * Docker/firewalld loads nft_compat and ip_set kernel modules which emit
+ * KERN_WARNING (level 4) messages to the console. These clutter the TTY
+ * and alarm users. The kernel cmdline loglevel=3 set during OVA build
+ * gets reset by systemd on boot; a sysctl.d drop-in persists it.
+ */
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const SYSCTL_FILE = '/etc/sysctl.d/99-console-loglevel.conf';
+export async function migrateConsoleLoglevel() {
+    if (existsSync(SYSCTL_FILE)) {
+        return false;
+    }
+    const content = 'kernel.printk = 3 4 1 3\n';
+    const tmp = `/tmp/ct-loglevel-${Date.now()}`;
+    writeFileSync(tmp, content);
+    spawnSync('sudo', ['cp', tmp, SYSCTL_FILE], { stdio: 'pipe' });
+    try {
+        unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    spawnSync('sudo', ['sysctl', '-p', SYSCTL_FILE], { stdio: 'pipe' });
+    return true;
+}
+//# sourceMappingURL=migration-006-console-loglevel.js.map

package/dist/lib/migration-006-console-loglevel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-006-console-loglevel.js","sourceRoot":"","sources":["../../src/lib/migration-006-console-loglevel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAE7D,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,2BAA2B,CAAC;IAC5C,MAAM,GAAG,GAAG,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC7C,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC5B,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAE/C,SAAS,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAEpE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-007-nm-keyfile.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Migration 007: Migrate legacy ifcfg network configs to NM keyfile format.
+ *
+ * RHEL 9 / AlmaLinux 9 deprecated the ifcfg backend for NetworkManager.
+ * Connections still using ifcfg-rh files emit deprecation warnings in logs
+ * and will stop working in future RHEL releases. `nmcli connection migrate`
+ * converts them to the native keyfile format in /etc/NetworkManager/system-connections/.
+ */
+export declare function migrateNmKeyfile(): Promise<boolean>;
+//# sourceMappingURL=migration-007-nm-keyfile.d.ts.map

package/dist/lib/migration-007-nm-keyfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-007-nm-keyfile.d.ts","sourceRoot":"","sources":["../../src/lib/migration-007-nm-keyfile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAuBzD"}

package/dist/lib/migration-007-nm-keyfile.js

@@ -0,0 +1,30 @@
+/**
+ * Migration 007: Migrate legacy ifcfg network configs to NM keyfile format.
+ *
+ * RHEL 9 / AlmaLinux 9 deprecated the ifcfg backend for NetworkManager.
+ * Connections still using ifcfg-rh files emit deprecation warnings in logs
+ * and will stop working in future RHEL releases. `nmcli connection migrate`
+ * converts them to the native keyfile format in /etc/NetworkManager/system-connections/.
+ */
+import { spawnSync } from 'node:child_process';
+export async function migrateNmKeyfile() {
+    // Check if nmcli is available
+    const check = spawnSync('command', ['-v', 'nmcli'], { shell: true, stdio: 'pipe' });
+    if (check.status !== 0) {
+        return false;
+    }
+    // Count connections still using ifcfg backend
+    const list = spawnSync('nmcli', ['-t', '-f', 'FILENAME', 'connection', 'show'], { stdio: 'pipe' });
+    const output = list.stdout?.toString() ?? '';
+    const ifcfgCount = output.split('\n').filter((line) => line.includes('ifcfg')).length;
+    if (ifcfgCount === 0) {
+        return false;
+    }
+    // Migrate all ifcfg connections to keyfile format
+    const migrate = spawnSync('sudo', ['nmcli', 'connection', 'migrate'], { stdio: 'pipe' });
+    if (migrate.status !== 0) {
+        throw new Error(`nmcli connection migrate failed: ${migrate.stderr?.toString()}`);
+    }
+    return true;
+}
+//# sourceMappingURL=migration-007-nm-keyfile.js.map

package/dist/lib/migration-007-nm-keyfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-007-nm-keyfile.js","sourceRoot":"","sources":["../../src/lib/migration-007-nm-keyfile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,8BAA8B;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAEtF,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kDAAkD;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-008-systemd-restart.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Migration 008: Add restart-on-failure policy to docker-compose-app.service.
+ *
+ * Without Restart=on-failure, a container crash or OOM kill leaves the
+ * appliance down until someone manually restarts. This migration adds:
+ *   Restart=on-failure
+ *   RestartSec=60
+ *
+ * Also ensures network-online.target dependency exists for boot on
+ * isolated LANs where DNS/DHCP may be slow.
+ */
+export declare function migrateSystemdRestart(): Promise<boolean>;
+//# sourceMappingURL=migration-008-systemd-restart.d.ts.map

package/dist/lib/migration-008-systemd-restart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-008-systemd-restart.d.ts","sourceRoot":"","sources":["../../src/lib/migration-008-systemd-restart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CA6B9D"}

package/dist/lib/migration-008-systemd-restart.js

@@ -0,0 +1,41 @@
+/**
+ * Migration 008: Add restart-on-failure policy to docker-compose-app.service.
+ *
+ * Without Restart=on-failure, a container crash or OOM kill leaves the
+ * appliance down until someone manually restarts. This migration adds:
+ *   Restart=on-failure
+ *   RestartSec=60
+ *
+ * Also ensures network-online.target dependency exists for boot on
+ * isolated LANs where DNS/DHCP may be slow.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const SERVICE_FILE = '/etc/systemd/system/docker-compose-app.service';
+export async function migrateSystemdRestart() {
+    if (!existsSync(SERVICE_FILE)) {
+        return false;
+    }
+    const content = readFileSync(SERVICE_FILE, 'utf-8');
+    let changed = false;
+    // Add Restart=on-failure if missing
+    if (!content.includes('Restart=')) {
+        if (content.includes('TimeoutStartSec=')) {
+            spawnSync('sudo', ['sed', '-i', '/^TimeoutStartSec=/a Restart=on-failure\\nRestartSec=60', SERVICE_FILE], { stdio: 'pipe' });
+        }
+        else {
+            spawnSync('sudo', ['sed', '-i', '/^\\[Install\\]/i Restart=on-failure\\nRestartSec=60', SERVICE_FILE], { stdio: 'pipe' });
+        }
+        changed = true;
+    }
+    // Add network-online.target dependency if missing
+    if (!content.includes('network-online.target')) {
+        spawnSync('sudo', ['sed', '-i', '/^After=docker.service/a Wants=network-online.target\\nAfter=network-online.target', SERVICE_FILE], { stdio: 'pipe' });
+        changed = true;
+    }
+    if (changed) {
+        spawnSync('sudo', ['systemctl', 'daemon-reload'], { stdio: 'pipe' });
+    }
+    return changed;
+}
+//# sourceMappingURL=migration-008-systemd-restart.js.map

package/dist/lib/migration-008-systemd-restart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-008-systemd-restart.js","sourceRoot":"","sources":["../../src/lib/migration-008-systemd-restart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACpD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,oCAAoC;IACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,yDAAyD,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,sDAAsD,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC/C,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,oFAAoF,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxJ,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/migration-009-bind-mount-files.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Migration 009: Fix Docker bind-mount directory-vs-file confusion.
+ *
+ * Docker auto-creates missing bind-mount targets as DIRECTORIES.
+ * If alertmanager.yml or tempo.yaml were created as directories
+ * (from a `docker compose up` before the files existed), the services
+ * fail to start. This migration removes the bogus directories and
+ * creates the correct config files.
+ */
+export declare function migrateBindMountFiles(): Promise<boolean>;
+//# sourceMappingURL=migration-009-bind-mount-files.d.ts.map

package/dist/lib/migration-009-bind-mount-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-009-bind-mount-files.d.ts","sourceRoot":"","sources":["../../src/lib/migration-009-bind-mount-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkFH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAI9D"}

package/dist/lib/migration-009-bind-mount-files.js

@@ -0,0 +1,86 @@
+/**
+ * Migration 009: Fix Docker bind-mount directory-vs-file confusion.
+ *
+ * Docker auto-creates missing bind-mount targets as DIRECTORIES.
+ * If alertmanager.yml or tempo.yaml were created as directories
+ * (from a `docker compose up` before the files existed), the services
+ * fail to start. This migration removes the bogus directories and
+ * creates the correct config files.
+ */
+import { existsSync, statSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const INSTALL_DIR = join(homedir(), '');
+const ALERTMANAGER_DIR = join(INSTALL_DIR, 'alertmanager');
+const ALERTMANAGER_FILE = join(ALERTMANAGER_DIR, 'alertmanager.yml');
+const ALERTMANAGER_CONTENT = `global:
+  resolve_timeout: 5m
+route:
+  receiver: 'default'
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+receivers:
+  - name: 'default'
+`;
+const TEMPO_DIR = join(INSTALL_DIR, 'tempo');
+const TEMPO_FILE = join(TEMPO_DIR, 'tempo.yaml');
+const TEMPO_CONTENT = `server:
+  http_listen_port: 3200
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+ingester:
+  max_block_duration: 5m
+
+compactor:
+  compaction:
+    block_retention: 72h    # Keep traces for 3 days
+
+storage:
+  trace:
+    backend: local
+    local:
+      path: /var/tempo/blocks
+    wal:
+      path: /var/tempo/wal
+
+metrics_generator:
+  registry:
+    external_labels:
+      source: tempo
+  storage:
+    path: /var/tempo/generator/wal
+    remote_write:
+      - url: http://prometheus:9090/api/v1/write
+        send_exemplars: true
+`;
+function fixBindMount(dir, filePath, content) {
+    let changed = false;
+    // If the file path is a directory (Docker bind-mount bug), remove it
+    if (existsSync(filePath) && statSync(filePath).isDirectory()) {
+        rmSync(filePath, { recursive: true, force: true });
+        changed = true;
+    }
+    // Ensure parent directory exists
+    mkdirSync(dir, { recursive: true });
+    // Create the file if it doesn't exist
+    if (!existsSync(filePath)) {
+        writeFileSync(filePath, content);
+        changed = true;
+    }
+    return changed;
+}
+export async function migrateBindMountFiles() {
+    const a = fixBindMount(ALERTMANAGER_DIR, ALERTMANAGER_FILE, ALERTMANAGER_CONTENT);
+    const b = fixBindMount(TEMPO_DIR, TEMPO_FILE, TEMPO_CONTENT);
+    return a || b;
+}
+//# sourceMappingURL=migration-009-bind-mount-files.js.map

package/dist/lib/migration-009-bind-mount-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-009-bind-mount-files.js","sourceRoot":"","sources":["../../src/lib/migration-009-bind-mount-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAExC,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AAC3D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AACrE,MAAM,oBAAoB,GAAG;;;;;;;;;CAS5B,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACjD,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCrB,CAAC;AAEF,SAAS,YAAY,CAAC,GAAW,EAAE,QAAgB,EAAE,OAAe;IAClE,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,qEAAqE;IACrE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,iCAAiC;IACjC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,sCAAsC;IACtC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,CAAC,GAAG,YAAY,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/lib/migration-010-jtapi-state.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Migration 010: Migrate legacy .jtapi-enabled file to .env COMPOSE_PROFILES.
+ *
+ * Older appliances used a `.jtapi-enabled` sentinel file to track whether
+ * JTAPI was enabled. The compose stack now uses COMPOSE_PROFILES=jtapi
+ * in .env to conditionally include the jtapi-sidecar and ct-media services.
+ * This migration reads the old flag, sets the appropriate .env vars, and
+ * removes the sentinel file.
+ */
+export declare function migrateJtapiState(): Promise<boolean>;
+//# sourceMappingURL=migration-010-jtapi-state.d.ts.map

package/dist/lib/migration-010-jtapi-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-010-jtapi-state.d.ts","sourceRoot":"","sources":["../../src/lib/migration-010-jtapi-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+BH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAsB1D"}

package/dist/lib/migration-010-jtapi-state.js

@@ -0,0 +1,61 @@
+/**
+ * Migration 010: Migrate legacy .jtapi-enabled file to .env COMPOSE_PROFILES.
+ *
+ * Older appliances used a `.jtapi-enabled` sentinel file to track whether
+ * JTAPI was enabled. The compose stack now uses COMPOSE_PROFILES=jtapi
+ * in .env to conditionally include the jtapi-sidecar and ct-media services.
+ * This migration reads the old flag, sets the appropriate .env vars, and
+ * removes the sentinel file.
+ */
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const INSTALL_DIR = homedir();
+const ENV_FILE = join(INSTALL_DIR, '.env');
+const JTAPI_STATE_FILE = join(INSTALL_DIR, '.jtapi-enabled');
+function envGet(key) {
+    if (!existsSync(ENV_FILE))
+        return '';
+    const content = readFileSync(ENV_FILE, 'utf-8');
+    const match = content.match(new RegExp(`^${key}=(.*)$`, 'm'));
+    return match?.[1] ?? '';
+}
+function envSet(key, value) {
+    if (!existsSync(ENV_FILE)) {
+        writeFileSync(ENV_FILE, `${key}=${value}\n`);
+        return;
+    }
+    const content = readFileSync(ENV_FILE, 'utf-8');
+    const regex = new RegExp(`^${key}=.*$`, 'm');
+    if (regex.test(content)) {
+        writeFileSync(ENV_FILE, content.replace(regex, `${key}=${value}`));
+    }
+    else {
+        writeFileSync(ENV_FILE, content.trimEnd() + `\n${key}=${value}\n`);
+    }
+}
+export async function migrateJtapiState() {
+    if (!existsSync(JTAPI_STATE_FILE)) {
+        return false;
+    }
+    // Add jtapi to COMPOSE_PROFILES if not already there
+    const profiles = envGet('COMPOSE_PROFILES');
+    if (!profiles.includes('jtapi')) {
+        envSet('COMPOSE_PROFILES', profiles ? `${profiles},jtapi` : 'jtapi');
+    }
+    // Set JTAPI env vars if not already present
+    if (!envGet('JTAPI_MODE'))
+        envSet('JTAPI_MODE', 'direct');
+    if (!envGet('JTAPI_SIDECAR_ENDPOINT'))
+        envSet('JTAPI_SIDECAR_ENDPOINT', 'jtapi-sidecar:50051');
+    if (!envGet('JTAPI_SIDECAR_URL'))
+        envSet('JTAPI_SIDECAR_URL', 'http://jtapi-sidecar:8080');
+    if (!envGet('S3_ENABLED'))
+        envSet('S3_ENABLED', 'true');
+    if (!envGet('CT_MEDIA_ENDPOINT'))
+        envSet('CT_MEDIA_ENDPOINT', 'ct-media:50053');
+    // Remove the legacy sentinel file
+    unlinkSync(JTAPI_STATE_FILE);
+    return true;
+}
+//# sourceMappingURL=migration-010-jtapi-state.js.map

package/dist/lib/migration-010-jtapi-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-010-jtapi-state.js","sourceRoot":"","sources":["../../src/lib/migration-010-jtapi-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;AAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC3C,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAE7D,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,KAAa;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IAED,4CAA4C;IAC5C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAAE,MAAM,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,CAAC;IAC/F,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAAE,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAAE,MAAM,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAEhF,kCAAkC;IAClC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAE7B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-011-docker-memory-limit.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Migration 011: Cap Docker daemon memory at 90% of system RAM.
+ *
+ * On a single-purpose Docker Compose appliance, containers can consume
+ * all available RAM, starving the OS (kernel, systemd, sshd, NM) and
+ * triggering the OOM killer. This migration creates a systemd drop-in
+ * that limits the Docker daemon + all containers to 90% of total RAM,
+ * guaranteeing 10% for the OS.
+ *
+ * Also updates existing 80% limit to 90% (previous default was too conservative).
+ */
+export declare function migrateDockerMemoryLimit(): Promise<boolean>;
+//# sourceMappingURL=migration-011-docker-memory-limit.d.ts.map

package/dist/lib/migration-011-docker-memory-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-011-docker-memory-limit.d.ts","sourceRoot":"","sources":["../../src/lib/migration-011-docker-memory-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,OAAO,CAAC,CA8BjE"}

package/dist/lib/migration-011-docker-memory-limit.js

@@ -0,0 +1,45 @@
+/**
+ * Migration 011: Cap Docker daemon memory at 90% of system RAM.
+ *
+ * On a single-purpose Docker Compose appliance, containers can consume
+ * all available RAM, starving the OS (kernel, systemd, sshd, NM) and
+ * triggering the OOM killer. This migration creates a systemd drop-in
+ * that limits the Docker daemon + all containers to 90% of total RAM,
+ * guaranteeing 10% for the OS.
+ *
+ * Also updates existing 80% limit to 90% (previous default was too conservative).
+ */
+import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const DROPIN_DIR = '/etc/systemd/system/docker.service.d';
+const DROPIN_FILE = `${DROPIN_DIR}/memory-limit.conf`;
+export async function migrateDockerMemoryLimit() {
+    // Skip if already at 90%
+    if (existsSync(DROPIN_FILE)) {
+        const content = readFileSync(DROPIN_FILE, 'utf-8');
+        if (content.includes('MemoryMax=90%')) {
+            return false;
+        }
+        // Exists but wrong value (80%) — update to 90%
+    }
+    const content = `[Service]\nMemoryMax=90%\n`;
+    const tmp = `/tmp/ct-docker-memory-${Date.now()}`;
+    writeFileSync(tmp, content);
+    spawnSync('sudo', ['mkdir', '-p', DROPIN_DIR], { stdio: 'pipe' });
+    spawnSync('sudo', ['cp', tmp, DROPIN_FILE], { stdio: 'pipe' });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    const reload = spawnSync('sudo', ['systemctl', 'daemon-reload'], { stdio: 'pipe' });
+    if (reload.status !== 0) {
+        throw new Error('systemctl daemon-reload failed');
+    }
+    // Restart Docker to apply the memory limit
+    const restart = spawnSync('sudo', ['systemctl', 'restart', 'docker'], { stdio: 'pipe' });
+    if (restart.status !== 0) {
+        throw new Error('systemctl restart docker failed');
+    }
+    return true;
+}
+//# sourceMappingURL=migration-011-docker-memory-limit.js.map

package/dist/lib/migration-011-docker-memory-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-011-docker-memory-limit.js","sourceRoot":"","sources":["../../src/lib/migration-011-docker-memory-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,MAAM,WAAW,GAAG,GAAG,UAAU,oBAAoB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,yBAAyB;IACzB,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,+CAA+C;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,MAAM,GAAG,GAAG,yBAAyB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAClD,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5B,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-012-db-pool-sizes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Migration 012: Set default DB pool sizes if no profile is configured.
+ *
+ * Existing appliances run with 95 total DB connections (45+18+18+14)
+ * which is excessive for 8GB appliances and wastes memory. If no
+ * PG_PROFILE is set in .env, apply the 'small' profile defaults:
+ * 44 total connections (20+8+8+8).
+ *
+ * Does NOT override if a profile is already set — respects user choice.
+ */
+export declare function migrateDbPoolSizes(): Promise<boolean>;
+//# sourceMappingURL=migration-012-db-pool-sizes.d.ts.map

package/dist/lib/migration-012-db-pool-sizes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-012-db-pool-sizes.d.ts","sourceRoot":"","sources":["../../src/lib/migration-012-db-pool-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CA2C3D"}

package/dist/lib/migration-012-db-pool-sizes.js

@@ -0,0 +1,64 @@
+/**
+ * Migration 012: Set default DB pool sizes if no profile is configured.
+ *
+ * Existing appliances run with 95 total DB connections (45+18+18+14)
+ * which is excessive for 8GB appliances and wastes memory. If no
+ * PG_PROFILE is set in .env, apply the 'small' profile defaults:
+ * 44 total connections (20+8+8+8).
+ *
+ * Does NOT override if a profile is already set — respects user choice.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Detect install dir (same logic as ct-cli paths.ts)
+function getInstallDir() {
+    const known = ['/home/calltelemetry', '/opt/calltelemetry'];
+    for (const p of known) {
+        if (existsSync(join(p, 'docker-compose.yml')))
+            return p;
+    }
+    return homedir();
+}
+export async function migrateDbPoolSizes() {
+    const installDir = getInstallDir();
+    const envFile = join(installDir, '.env');
+    // If PG_PROFILE is already set, user has chosen a profile — don't override
+    if (existsSync(envFile)) {
+        const content = readFileSync(envFile, 'utf-8');
+        if (content.includes('PG_PROFILE=')) {
+            return false; // Already configured
+        }
+    }
+    // No profile set — apply small defaults
+    const settings = [
+        'PG_PROFILE=small',
+        'PG_SHM_SIZE=1gb',
+        'PG_SHARED_BUFFERS=512MB',
+        'PG_EFFECTIVE_CACHE_SIZE=1536MB',
+        'PG_WORK_MEM=8MB',
+        'PG_MAINTENANCE_WORK_MEM=128MB',
+        'PG_MAX_CONNECTIONS=60',
+        'DB_POOL_SIZE=20',
+        'DB_BACKGROUND_POOL_SIZE=8',
+        'DB_DISCOVERY_POOL_SIZE=8',
+        'DB_OBAN_POOL_SIZE=8',
+    ];
+    // Append to .env (or create it)
+    const block = '\n# PostgreSQL profile: small (auto-applied by migration 012)\n' +
+        settings.join('\n') + '\n';
+    const tmp = `/tmp/ct-env-append-${Date.now()}`;
+    require('node:fs').writeFileSync(tmp, block);
+    // Append via sudo
+    const result = spawnSync('sudo', ['bash', '-c', `cat ${tmp} >> ${envFile}`], { stdio: 'pipe' });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    if (result.status !== 0) {
+        throw new Error(`Failed to write pool sizes to ${envFile}`);
+    }
+    return true;
+}
+//# sourceMappingURL=migration-012-db-pool-sizes.js.map

package/dist/lib/migration-012-db-pool-sizes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-012-db-pool-sizes.js","sourceRoot":"","sources":["../../src/lib/migration-012-db-pool-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAY,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,qDAAqD;AACrD,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,CAAC,qBAAqB;QACrC,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,QAAQ,GAAG;QACf,kBAAkB;QAClB,iBAAiB;QACjB,yBAAyB;QACzB,gCAAgC;QAChC,iBAAiB;QACjB,+BAA+B;QAC/B,uBAAuB;QACvB,iBAAiB;QACjB,2BAA2B;QAC3B,0BAA0B;QAC1B,qBAAqB;KACtB,CAAC;IAEF,gCAAgC;IAChC,MAAM,KAAK,GAAG,iEAAiE;QAC7E,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE7B,MAAM,GAAG,GAAG,sBAAsB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migrations.d.ts

@@ -0,0 +1,34 @@
+export interface Migration {
+    id: string;
+    description: string;
+    run: () => Promise<boolean>;
+}
+interface MigrationRecord {
+    at: string;
+    result: 'applied' | 'skipped';
+}
+interface ErrorRecord {
+    at: string;
+    error: string;
+}
+interface MigrationState {
+    completed: Record<string, MigrationRecord>;
+    errors: Record<string, ErrorRecord>;
+}
+export declare const MIGRATIONS: Migration[];
+export declare function loadMigrationState(): MigrationState;
+export declare function saveMigrationState(state: MigrationState): void;
+export declare function isMigrationCompleted(id: string): boolean;
+export declare function runPendingMigrations(log?: (msg: string) => void): Promise<{
+    ran: string[];
+    skipped: string[];
+}>;
+export declare function getMigrationStatus(): Array<{
+    id: string;
+    description: string;
+    status: 'applied' | 'skipped' | 'pending' | 'error';
+    at?: string;
+    error?: string;
+}>;
+export {};
+//# sourceMappingURL=migrations.d.ts.map

package/dist/lib/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/lib/migrations.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACrC;AAmBD,eAAO,MAAM,UAAU,EAAE,SAAS,EA6DjC,CAAC;AAEF,wBAAgB,kBAAkB,IAAI,cAAc,CAcnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED,wBAAsB,oBAAoB,CACxC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA4C/C;AAED,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACpD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAgCD"}