@calltelemetry/cli 0.6.12 → 0.7.1

package/dist/lib/migration-011-docker-memory-limit.js

@@ -0,0 +1,45 @@
+/**
+ * Migration 011: Cap Docker daemon memory at 90% of system RAM.
+ *
+ * On a single-purpose Docker Compose appliance, containers can consume
+ * all available RAM, starving the OS (kernel, systemd, sshd, NM) and
+ * triggering the OOM killer. This migration creates a systemd drop-in
+ * that limits the Docker daemon + all containers to 90% of total RAM,
+ * guaranteeing 10% for the OS.
+ *
+ * Also updates existing 80% limit to 90% (previous default was too conservative).
+ */
+import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const DROPIN_DIR = '/etc/systemd/system/docker.service.d';
+const DROPIN_FILE = `${DROPIN_DIR}/memory-limit.conf`;
+export async function migrateDockerMemoryLimit() {
+    // Skip if already at 90%
+    if (existsSync(DROPIN_FILE)) {
+        const content = readFileSync(DROPIN_FILE, 'utf-8');
+        if (content.includes('MemoryMax=90%')) {
+            return false;
+        }
+        // Exists but wrong value (80%) — update to 90%
+    }
+    const content = `[Service]\nMemoryMax=90%\n`;
+    const tmp = `/tmp/ct-docker-memory-${Date.now()}`;
+    writeFileSync(tmp, content);
+    spawnSync('sudo', ['mkdir', '-p', DROPIN_DIR], { stdio: 'pipe' });
+    spawnSync('sudo', ['cp', tmp, DROPIN_FILE], { stdio: 'pipe' });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    const reload = spawnSync('sudo', ['systemctl', 'daemon-reload'], { stdio: 'pipe' });
+    if (reload.status !== 0) {
+        throw new Error('systemctl daemon-reload failed');
+    }
+    // Restart Docker to apply the memory limit
+    const restart = spawnSync('sudo', ['systemctl', 'restart', 'docker'], { stdio: 'pipe' });
+    if (restart.status !== 0) {
+        throw new Error('systemctl restart docker failed');
+    }
+    return true;
+}
+//# sourceMappingURL=migration-011-docker-memory-limit.js.map

package/dist/lib/migration-011-docker-memory-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-011-docker-memory-limit.js","sourceRoot":"","sources":["../../src/lib/migration-011-docker-memory-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAa,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,MAAM,WAAW,GAAG,GAAG,UAAU,oBAAoB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,yBAAyB;IACzB,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,+CAA+C;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,MAAM,GAAG,GAAG,yBAAyB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAClD,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE5B,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-012-db-pool-sizes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Migration 012: Set default DB pool sizes if no profile is configured.
+ *
+ * Existing appliances run with 95 total DB connections (45+18+18+14)
+ * which is excessive for 8GB appliances and wastes memory. If no
+ * PG_PROFILE is set in .env, apply the 'small' profile defaults:
+ * 44 total connections (20+8+8+8).
+ *
+ * Does NOT override if a profile is already set — respects user choice.
+ */
+export declare function migrateDbPoolSizes(): Promise<boolean>;
+//# sourceMappingURL=migration-012-db-pool-sizes.d.ts.map

package/dist/lib/migration-012-db-pool-sizes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-012-db-pool-sizes.d.ts","sourceRoot":"","sources":["../../src/lib/migration-012-db-pool-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAgBH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CA2C3D"}

package/dist/lib/migration-012-db-pool-sizes.js

@@ -0,0 +1,64 @@
+/**
+ * Migration 012: Set default DB pool sizes if no profile is configured.
+ *
+ * Existing appliances run with 95 total DB connections (45+18+18+14)
+ * which is excessive for 8GB appliances and wastes memory. If no
+ * PG_PROFILE is set in .env, apply the 'small' profile defaults:
+ * 44 total connections (20+8+8+8).
+ *
+ * Does NOT override if a profile is already set — respects user choice.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+// Detect install dir (same logic as ct-cli paths.ts)
+function getInstallDir() {
+    const known = ['/home/calltelemetry', '/opt/calltelemetry'];
+    for (const p of known) {
+        if (existsSync(join(p, 'docker-compose.yml')))
+            return p;
+    }
+    return homedir();
+}
+export async function migrateDbPoolSizes() {
+    const installDir = getInstallDir();
+    const envFile = join(installDir, '.env');
+    // If PG_PROFILE is already set, user has chosen a profile — don't override
+    if (existsSync(envFile)) {
+        const content = readFileSync(envFile, 'utf-8');
+        if (content.includes('PG_PROFILE=')) {
+            return false; // Already configured
+        }
+    }
+    // No profile set — apply small defaults
+    const settings = [
+        'PG_PROFILE=small',
+        'PG_SHM_SIZE=1gb',
+        'PG_SHARED_BUFFERS=512MB',
+        'PG_EFFECTIVE_CACHE_SIZE=1536MB',
+        'PG_WORK_MEM=8MB',
+        'PG_MAINTENANCE_WORK_MEM=128MB',
+        'PG_MAX_CONNECTIONS=60',
+        'DB_POOL_SIZE=20',
+        'DB_BACKGROUND_POOL_SIZE=8',
+        'DB_DISCOVERY_POOL_SIZE=8',
+        'DB_OBAN_POOL_SIZE=8',
+    ];
+    // Append to .env (or create it)
+    const block = '\n# PostgreSQL profile: small (auto-applied by migration 012)\n' +
+        settings.join('\n') + '\n';
+    const tmp = `/tmp/ct-env-append-${Date.now()}`;
+    require('node:fs').writeFileSync(tmp, block);
+    // Append via sudo
+    const result = spawnSync('sudo', ['bash', '-c', `cat ${tmp} >> ${envFile}`], { stdio: 'pipe' });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch { /* ignore */ }
+    if (result.status !== 0) {
+        throw new Error(`Failed to write pool sizes to ${envFile}`);
+    }
+    return true;
+}
+//# sourceMappingURL=migration-012-db-pool-sizes.js.map

package/dist/lib/migration-012-db-pool-sizes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-012-db-pool-sizes.js","sourceRoot":"","sources":["../../src/lib/migration-012-db-pool-sizes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAY,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,qDAAqD;AACrD,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,CAAC,qBAAqB;QACrC,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,QAAQ,GAAG;QACf,kBAAkB;QAClB,iBAAiB;QACjB,yBAAyB;QACzB,gCAAgC;QAChC,iBAAiB;QACjB,+BAA+B;QAC/B,uBAAuB;QACvB,iBAAiB;QACjB,2BAA2B;QAC3B,0BAA0B;QAC1B,qBAAqB;KACtB,CAAC;IAEF,gCAAgC;IAChC,MAAM,KAAK,GAAG,iEAAiE;QAC7E,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE7B,MAAM,GAAG,GAAG,sBAAsB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,OAAO,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC;QAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAElE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-013-grafana-password.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Migration 013: Generate GRAFANA_PASSWORD for deterministic Grafana auth.
+ *
+ * The BootProvisioner (Elixir) uses GRAFANA_PASSWORD for basic auth to push
+ * dashboards to Grafana. Both the web container and grafana container read
+ * this from .env. If it's missing, dashboard provisioning fails.
+ *
+ * This migration:
+ * 1. Generates a random 32-char hex password
+ * 2. Writes GRAFANA_PASSWORD=<password> to .env
+ * 3. Removes stale GRAFANA_TOKEN if present
+ * 4. Resets Grafana admin password via grafana-cli (for existing volumes)
+ */
+export declare function migrateGrafanaPassword(): Promise<boolean>;
+//# sourceMappingURL=migration-013-grafana-password.d.ts.map

package/dist/lib/migration-013-grafana-password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-013-grafana-password.d.ts","sourceRoot":"","sources":["../../src/lib/migration-013-grafana-password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgBH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAoE/D"}

package/dist/lib/migration-013-grafana-password.js

@@ -0,0 +1,80 @@
+/**
+ * Migration 013: Generate GRAFANA_PASSWORD for deterministic Grafana auth.
+ *
+ * The BootProvisioner (Elixir) uses GRAFANA_PASSWORD for basic auth to push
+ * dashboards to Grafana. Both the web container and grafana container read
+ * this from .env. If it's missing, dashboard provisioning fails.
+ *
+ * This migration:
+ * 1. Generates a random 32-char hex password
+ * 2. Writes GRAFANA_PASSWORD=<password> to .env
+ * 3. Removes stale GRAFANA_TOKEN if present
+ * 4. Resets Grafana admin password via grafana-cli (for existing volumes)
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+function getInstallDir() {
+    const known = ['/home/calltelemetry', '/opt/calltelemetry'];
+    for (const p of known) {
+        if (existsSync(join(p, 'docker-compose.yml')))
+            return p;
+    }
+    return homedir();
+}
+export async function migrateGrafanaPassword() {
+    const installDir = getInstallDir();
+    const envFile = join(installDir, '.env');
+    // If GRAFANA_PASSWORD is already set, nothing to do
+    if (existsSync(envFile)) {
+        const content = readFileSync(envFile, 'utf-8');
+        if (content.includes('GRAFANA_PASSWORD=')) {
+            return false; // Already configured
+        }
+    }
+    // Generate random password
+    const password = randomBytes(16).toString('hex');
+    // Build .env block
+    const block = '\n# Grafana auth password (auto-generated by migration 013)\n' +
+        `GRAFANA_PASSWORD=${password}\n`;
+    const tmp = `/tmp/ct-grafana-pw-${Date.now()}`;
+    require('node:fs').writeFileSync(tmp, block);
+    // Append to .env
+    const appendResult = spawnSync('sudo', ['bash', '-c', `cat ${tmp} >> ${envFile}`], {
+        stdio: 'pipe',
+    });
+    try {
+        require('node:fs').unlinkSync(tmp);
+    }
+    catch {
+        /* ignore */
+    }
+    if (appendResult.status !== 0) {
+        throw new Error(`Failed to write GRAFANA_PASSWORD to ${envFile}`);
+    }
+    // Remove stale GRAFANA_TOKEN lines from .env (replaced by GRAFANA_PASSWORD)
+    if (existsSync(envFile)) {
+        const content = readFileSync(envFile, 'utf-8');
+        if (content.includes('GRAFANA_TOKEN=')) {
+            spawnSync('sudo', ['sed', '-i', '/^GRAFANA_TOKEN=/d', envFile], { stdio: 'pipe' });
+            spawnSync('sudo', ['sed', '-i', '/^# .*GRAFANA_TOKEN/d', envFile], { stdio: 'pipe' });
+        }
+    }
+    // Reset Grafana admin password for existing volumes.
+    // grafana-cli stores the new password in the SQLite DB, overriding whatever
+    // was set previously (even if changed via the UI).
+    const resetResult = spawnSync('docker', ['compose', 'exec', '-T', 'grafana', 'grafana-cli', 'admin', 'reset-admin-password', password], { cwd: installDir, stdio: 'pipe', timeout: 30_000 });
+    if (resetResult.status !== 0) {
+        // Grafana container might not be running — that's OK.
+        // On next start, GF_SECURITY_ADMIN_PASSWORD from .env will be used
+        // (only applies on first start of a fresh volume, but that covers new installs).
+        const stderr = resetResult.stderr?.toString() ?? '';
+        if (!stderr.includes('No such container') && !stderr.includes('not running')) {
+            console.warn(`[migration-013] grafana-cli reset failed (non-fatal): ${stderr.slice(0, 200)}`);
+        }
+    }
+    return true;
+}
+//# sourceMappingURL=migration-013-grafana-password.js.map

package/dist/lib/migration-013-grafana-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-013-grafana-password.js","sourceRoot":"","sources":["../../src/lib/migration-013-grafana-password.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEzC,oDAAoD;IACpD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,CAAC,qBAAqB;QACrC,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEjD,mBAAmB;IACnB,MAAM,KAAK,GACT,+DAA+D;QAC/D,oBAAoB,QAAQ,IAAI,CAAC;IAEnC,MAAM,GAAG,GAAG,sBAAsB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC/C,OAAO,CAAC,SAAS,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,iBAAiB;IACjB,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,OAAO,EAAE,CAAC,EAAE;QACjF,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,4EAA4E;IAC5E,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,WAAW,GAAG,SAAS,CAC3B,QAAQ,EACR,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,CAAC,EAC9F,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACpD,CAAC;IAEF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,sDAAsD;QACtD,mEAAmE;QACnE,iFAAiF;QACjF,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7E,OAAO,CAAC,IAAI,CACV,yDAAyD,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migration-014-docker-firewall-backend.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Migration 014: Remove firewall-backend from daemon.json on Docker < 29.
+ *
+ * The `firewall-backend` option was added in Docker 29.0.0. Appliances that
+ * were provisioned with a daemon.json written for Docker 29 but then received
+ * Docker 28.x (e.g. dnf resolving to an older version) will fail to start
+ * dockerd with:
+ *
+ *   unable to configure the Docker daemon with file /etc/docker/daemon.json:
+ *   the following directives don't match any configuration option: firewall-backend
+ *
+ * This migration detects that condition and removes the unsupported key so
+ * Docker can start. The option is left in place on Docker 29+ where it is valid.
+ */
+export declare function migrateDockerFirewallBackend(): Promise<boolean>;
+//# sourceMappingURL=migration-014-docker-firewall-backend.d.ts.map

package/dist/lib/migration-014-docker-firewall-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-014-docker-firewall-backend.d.ts","sourceRoot":"","sources":["../../src/lib/migration-014-docker-firewall-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAkBH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,OAAO,CAAC,CAgDrE"}

package/dist/lib/migration-014-docker-firewall-backend.js

@@ -0,0 +1,72 @@
+/**
+ * Migration 014: Remove firewall-backend from daemon.json on Docker < 29.
+ *
+ * The `firewall-backend` option was added in Docker 29.0.0. Appliances that
+ * were provisioned with a daemon.json written for Docker 29 but then received
+ * Docker 28.x (e.g. dnf resolving to an older version) will fail to start
+ * dockerd with:
+ *
+ *   unable to configure the Docker daemon with file /etc/docker/daemon.json:
+ *   the following directives don't match any configuration option: firewall-backend
+ *
+ * This migration detects that condition and removes the unsupported key so
+ * Docker can start. The option is left in place on Docker 29+ where it is valid.
+ */
+import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+const DAEMON_JSON = '/etc/docker/daemon.json';
+function getDockerMajorVersion() {
+    const result = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
+        stdio: 'pipe',
+        timeout: 10_000,
+    });
+    if (result.status !== 0)
+        return 0;
+    const version = result.stdout?.toString().trim() ?? '';
+    const major = parseInt(version.split('.')[0] ?? '0', 10);
+    return isNaN(major) ? 0 : major;
+}
+export async function migrateDockerFirewallBackend() {
+    // Only relevant if daemon.json exists and contains firewall-backend
+    if (!existsSync(DAEMON_JSON))
+        return false;
+    const raw = readFileSync(DAEMON_JSON, 'utf-8');
+    if (!raw.includes('"firewall-backend"'))
+        return false;
+    // firewall-backend is valid on Docker 29+ — leave it alone
+    const major = getDockerMajorVersion();
+    if (major >= 29)
+        return false;
+    // Docker < 29 (or version undetectable): remove the key
+    let config;
+    try {
+        config = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Cannot parse ${DAEMON_JSON}: invalid JSON`);
+    }
+    delete config['firewall-backend'];
+    const updated = JSON.stringify(config, null, 2) + '\n';
+    const tmp = `/tmp/ct-daemon-json-${Date.now()}`;
+    writeFileSync(tmp, updated, 'utf-8');
+    const result = spawnSync('sudo', ['cp', tmp, DAEMON_JSON], { stdio: 'pipe' });
+    try {
+        unlinkSync(tmp);
+    }
+    catch {
+        /* ignore */
+    }
+    if (result.status !== 0) {
+        throw new Error(`Failed to write ${DAEMON_JSON}: ${result.stderr?.toString().trim()}`);
+    }
+    // Restart Docker so the corrected config takes effect
+    const restart = spawnSync('sudo', ['systemctl', 'restart', 'docker'], {
+        stdio: 'pipe',
+        timeout: 30_000,
+    });
+    if (restart.status !== 0) {
+        throw new Error(`daemon.json fixed but Docker restart failed: ${restart.stderr?.toString().trim()}`);
+    }
+    return true;
+}
+//# sourceMappingURL=migration-014-docker-firewall-backend.js.map

package/dist/lib/migration-014-docker-firewall-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-014-docker-firewall-backend.js","sourceRoot":"","sources":["../../src/lib/migration-014-docker-firewall-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAE9C,SAAS,qBAAqB;IAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;QACjF,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,oEAAoE;IACpE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtD,2DAA2D;IAC3D,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAE9B,wDAAwD;IACxD,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gBAAgB,WAAW,gBAAgB,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,uBAAuB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAChD,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9E,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;QACpE,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,gDAAgD,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/migrations.d.ts

@@ -0,0 +1,42 @@
+export interface Migration {
+    id: string;
+    description: string;
+    run: () => Promise<boolean>;
+}
+interface MigrationRecord {
+    at: string;
+    result: 'applied' | 'skipped';
+}
+interface ErrorRecord {
+    at: string;
+    error: string;
+}
+interface MigrationState {
+    completed: Record<string, MigrationRecord>;
+    errors: Record<string, ErrorRecord>;
+}
+export declare const MIGRATIONS: Migration[];
+export declare function loadMigrationState(): MigrationState;
+export declare function saveMigrationState(state: MigrationState): void;
+export declare function isMigrationCompleted(id: string): boolean;
+export declare function runPendingMigrations(log?: (msg: string) => void): Promise<{
+    ran: string[];
+    skipped: string[];
+}>;
+/**
+ * Run a single migration by ID, regardless of whether it has already completed.
+ * Useful for re-running a migration that errored or needs to be re-applied.
+ */
+export declare function runSingleMigration(id: string, log?: (msg: string) => void): Promise<{
+    result: 'applied' | 'skipped' | 'not_found';
+    error?: string;
+}>;
+export declare function getMigrationStatus(): Array<{
+    id: string;
+    description: string;
+    status: 'applied' | 'skipped' | 'pending' | 'error';
+    at?: string;
+    error?: string;
+}>;
+export {};
+//# sourceMappingURL=migrations.d.ts.map

package/dist/lib/migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/lib/migrations.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7B;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;CAC/B;AAED,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,cAAc;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACrC;AAqBD,eAAO,MAAM,UAAU,EAAE,SAAS,EAuEjC,CAAC;AAEF,wBAAgB,kBAAkB,IAAI,cAAc,CAcnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED,wBAAsB,oBAAoB,CACxC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA4C/C;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,MAAM,EACV,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAwC1E;AAED,wBAAgB,kBAAkB,IAAI,KAAK,CAAC;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IACpD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAgCD"}

package/dist/lib/migrations.js

@@ -0,0 +1,231 @@
+/**
+ * Appliance migration framework.
+ *
+ * Tracks which system-level migrations have been applied on this appliance
+ * and runs any pending ones. State is persisted in ~/.ct/migrations.json.
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+const CT_DIR = join(homedir(), '.ct');
+const MIGRATIONS_FILE = join(CT_DIR, 'migrations.json');
+// Import migrations
+import { migrateCgnatSubnets } from './migration-001-cgnat.js';
+import { migrateSwapFile } from './migration-002-swap.js';
+import { migrateNmHeal } from './migration-003-nm-heal.js';
+import { migrateSystemdDocker } from './migration-004-systemd-docker.js';
+import { migrateSshKeys } from './migration-005-ssh-keys.js';
+import { migrateConsoleLoglevel } from './migration-006-console-loglevel.js';
+import { migrateNmKeyfile } from './migration-007-nm-keyfile.js';
+import { migrateSystemdRestart } from './migration-008-systemd-restart.js';
+import { migrateBindMountFiles } from './migration-009-bind-mount-files.js';
+import { migrateDockerMemoryLimit } from './migration-011-docker-memory-limit.js';
+import { migrateJtapiState } from './migration-010-jtapi-state.js';
+import { migrateDbPoolSizes } from './migration-012-db-pool-sizes.js';
+import { migrateGrafanaPassword } from './migration-013-grafana-password.js';
+import { migrateDockerFirewallBackend } from './migration-014-docker-firewall-backend.js';
+export const MIGRATIONS = [
+    {
+        id: '001_cgnat_docker_subnets',
+        description: 'Move Docker subnets to CGNAT space (100.64.x)',
+        run: migrateCgnatSubnets,
+    },
+    {
+        id: '002_swap_file',
+        description: 'Configure swap file (50% of RAM)',
+        run: migrateSwapFile,
+    },
+    {
+        id: '003_nm_connection_heal',
+        description: 'Fix NetworkManager connection profiles (autoconnect, Docker bridges)',
+        run: migrateNmHeal,
+    },
+    {
+        id: '004_systemd_docker_boot',
+        description: 'Docker boot ordering (After=firewalld)',
+        run: migrateSystemdDocker,
+    },
+    {
+        id: '005_ssh_host_keys',
+        description: 'Regenerate SSH host keys (OVA clone safety)',
+        run: migrateSshKeys,
+    },
+    {
+        id: '006_console_loglevel',
+        description: 'Suppress nft_compat/ip_set kernel console warnings',
+        run: migrateConsoleLoglevel,
+    },
+    {
+        id: '007_nm_keyfile_migration',
+        description: 'Migrate legacy ifcfg network configs to NM keyfile format',
+        run: migrateNmKeyfile,
+    },
+    {
+        id: '008_systemd_restart_policy',
+        description: 'Add restart-on-failure and network-online.target to systemd service',
+        run: migrateSystemdRestart,
+    },
+    {
+        id: '009_bind_mount_files',
+        description: 'Fix alertmanager.yml and tempo.yaml created as directories by Docker',
+        run: migrateBindMountFiles,
+    },
+    {
+        id: '010_jtapi_state_to_env',
+        description: 'Migrate .jtapi-enabled sentinel to .env COMPOSE_PROFILES=jtapi',
+        run: migrateJtapiState,
+    },
+    {
+        id: '011_docker_memory_limit',
+        description: 'Cap Docker daemon at 90% RAM (reserve 10% for OS)',
+        run: migrateDockerMemoryLimit,
+    },
+    {
+        id: '012_db_pool_sizes',
+        description: 'Set small DB pool profile (44 connections instead of 95)',
+        run: migrateDbPoolSizes,
+    },
+    {
+        id: '013_grafana_password',
+        description: 'Generate GRAFANA_PASSWORD for deterministic Grafana auth',
+        run: migrateGrafanaPassword,
+    },
+    {
+        id: '014_docker_firewall_backend',
+        description: 'Remove firewall-backend from daemon.json on Docker < 29 (prevents dockerd startup failure)',
+        run: migrateDockerFirewallBackend,
+    },
+];
+export function loadMigrationState() {
+    try {
+        if (!existsSync(MIGRATIONS_FILE)) {
+            return { completed: {}, errors: {} };
+        }
+        const raw = readFileSync(MIGRATIONS_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return {
+            completed: parsed.completed ?? {},
+            errors: parsed.errors ?? {},
+        };
+    }
+    catch {
+        return { completed: {}, errors: {} };
+    }
+}
+export function saveMigrationState(state) {
+    mkdirSync(CT_DIR, { recursive: true });
+    writeFileSync(MIGRATIONS_FILE, JSON.stringify(state, null, 2) + '\n', 'utf-8');
+}
+export function isMigrationCompleted(id) {
+    const state = loadMigrationState();
+    return id in state.completed;
+}
+export async function runPendingMigrations(log) {
+    const state = loadMigrationState();
+    const ran = [];
+    const skipped = [];
+    for (const migration of MIGRATIONS) {
+        if (migration.id in state.completed) {
+            skipped.push(migration.id);
+            continue;
+        }
+        log?.(`Running migration: ${migration.description}`);
+        try {
+            const changed = await migration.run();
+            state.completed[migration.id] = {
+                at: new Date().toISOString(),
+                result: changed ? 'applied' : 'skipped',
+            };
+            // Clear any previous error for this migration
+            delete state.errors[migration.id];
+            if (changed) {
+                ran.push(migration.id);
+                log?.(`  Applied: ${migration.id}`);
+            }
+            else {
+                skipped.push(migration.id);
+                log?.(`  Skipped (already correct): ${migration.id}`);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            state.errors[migration.id] = {
+                at: new Date().toISOString(),
+                error: message,
+            };
+            log?.(`  Error: ${migration.id} — ${message}`);
+        }
+        saveMigrationState(state);
+    }
+    return { ran, skipped };
+}
+/**
+ * Run a single migration by ID, regardless of whether it has already completed.
+ * Useful for re-running a migration that errored or needs to be re-applied.
+ */
+export async function runSingleMigration(id, log) {
+    const migration = MIGRATIONS.find((m) => m.id === id);
+    if (!migration) {
+        return { result: 'not_found' };
+    }
+    const state = loadMigrationState();
+    log?.(`Running migration: ${migration.description}`);
+    try {
+        const changed = await migration.run();
+        state.completed[migration.id] = {
+            at: new Date().toISOString(),
+            result: changed ? 'applied' : 'skipped',
+        };
+        // Clear any previous error for this migration
+        delete state.errors[migration.id];
+        saveMigrationState(state);
+        if (changed) {
+            log?.(`  Applied: ${migration.id}`);
+            return { result: 'applied' };
+        }
+        else {
+            log?.(`  Skipped (already correct): ${migration.id}`);
+            return { result: 'skipped' };
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        state.errors[migration.id] = {
+            at: new Date().toISOString(),
+            error: message,
+        };
+        saveMigrationState(state);
+        log?.(`  Error: ${migration.id} — ${message}`);
+        return { result: 'applied', error: message };
+    }
+}
+export function getMigrationStatus() {
+    const state = loadMigrationState();
+    return MIGRATIONS.map((m) => {
+        const completed = state.completed[m.id];
+        const errRecord = state.errors[m.id];
+        if (completed) {
+            return {
+                id: m.id,
+                description: m.description,
+                status: completed.result,
+                at: completed.at,
+            };
+        }
+        if (errRecord) {
+            return {
+                id: m.id,
+                description: m.description,
+                status: 'error',
+                at: errRecord.at,
+                error: errRecord.error,
+            };
+        }
+        return {
+            id: m.id,
+            description: m.description,
+            status: 'pending',
+        };
+    });
+}
+//# sourceMappingURL=migrations.js.map

package/dist/lib/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/lib/migrations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAuB7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAExD,oBAAoB;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAE1F,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,+CAA+C;QAC5D,GAAG,EAAE,mBAAmB;KACzB;IACD;QACE,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,kCAAkC;QAC/C,GAAG,EAAE,eAAe;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,sEAAsE;QACnF,GAAG,EAAE,aAAa;KACnB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,wCAAwC;QACrD,GAAG,EAAE,oBAAoB;KAC1B;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,6CAA6C;QAC1D,GAAG,EAAE,cAAc;KACpB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,oDAAoD;QACjE,GAAG,EAAE,sBAAsB;KAC5B;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,WAAW,EAAE,2DAA2D;QACxE,GAAG,EAAE,gBAAgB;KACtB;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,WAAW,EAAE,qEAAqE;QAClF,GAAG,EAAE,qBAAqB;KAC3B;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,sEAAsE;QACnF,GAAG,EAAE,qBAAqB;KAC3B;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,WAAW,EAAE,gEAAgE;QAC7E,GAAG,EAAE,iBAAiB;KACvB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,WAAW,EAAE,mDAAmD;QAChE,GAAG,EAAE,wBAAwB;KAC9B;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,0DAA0D;QACvE,GAAG,EAAE,kBAAkB;KACxB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,WAAW,EAAE,0DAA0D;QACvE,GAAG,EAAE,sBAAsB;KAC5B;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,WAAW,EAAE,4FAA4F;QACzG,GAAG,EAAE,4BAA4B;KAClC;CACF,CAAC;AAEF,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACtD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,OAAO,EAAE,IAAI,KAAK,CAAC,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAA2B;IAE3B,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QAED,GAAG,EAAE,CAAC,sBAAsB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;YAEtC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;gBAC9B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aACxC,CAAC;YAEF,8CAA8C;YAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAElC,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACvB,GAAG,EAAE,CAAC,cAAc,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,CAAC,gCAAgC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;gBAC3B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK,EAAE,OAAO;aACf,CAAC;YACF,GAAG,EAAE,CAAC,YAAY,SAAS,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,GAA2B;IAE3B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IAEnC,GAAG,EAAE,CAAC,sBAAsB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC;QAEtC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;YAC9B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACxC,CAAC;QAEF,8CAA8C;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAElC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAE1B,IAAI,OAAO,EAAE,CAAC;YACZ,GAAG,EAAE,CAAC,cAAc,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC,gCAAgC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;YAC3B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,OAAO;SACf,CAAC;QACF,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,GAAG,EAAE,CAAC,YAAY,SAAS,CAAC,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAOhC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IAEnC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAErC,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,EAAE,EAAE,SAAS,CAAC,EAAE;aACjB,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM,EAAE,OAAgB;gBACxB,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,KAAK,EAAE,SAAS,CAAC,KAAK;aACvB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,SAAkB;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}