@fonoster/common 0.27.0 → 0.30.0

package/dist/config/cli/check.js

@@ -0,0 +1,202 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCheck = runCheck;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const _2020_1 = __importDefault(require("ajv/dist/2020"));
+const yaml_1 = require("yaml");
+const configHints_1 = require("../configHints");
+const interpolateEnv_1 = require("../interpolateEnv");
+const resolveSecretRefs_1 = require("../resolveSecretRefs");
+const envFile_1 = require("./envFile");
+const exposure_1 = require("./exposure");
+const render_1 = require("./render");
+/**
+ * Container paths under which the services mount config/ (compose.yaml): a `secret://file/...`
+ * reference to one of them is read from config/ on this machine.
+ */
+const MOUNTS = ["/config/", "/opt/fonoster/", "/etc/fonoster/"];
+/** Schema names that validate a config file of another name. */
+const ALIASES = {
+    apiserver: "fonoster",
+    "autopilot-session": "autopilot"
+};
+const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-[^}]*)?\}/g;
+function keyPath(segments) {
+    return segments
+        .map((s, i) => typeof s === "number" ? `[${s}]` : i === 0 ? String(s) : `.${s}`)
+        .join("");
+}
+function pointerSegments(pointer) {
+    if (!pointer)
+        return [];
+    return pointer
+        .slice(1)
+        .split("/")
+        .map((s) => s.replace(/~1/g, "/").replace(/~0/g, "~"))
+        .map((s) => (/^\d+$/.test(s) ? Number(s) : s));
+}
+/** Resolves every secret:// reference in place; problems name the key path, never a value. */
+function resolveRefs(input, env, configDir, path, problems) {
+    if (typeof input === "string") {
+        const raw = input;
+        // ${NAME} placeholders resolve from .env, as Compose passes it to the containers.
+        if (/\$\{[^}]*\}/.test(raw)) {
+            try {
+                input = (0, interpolateEnv_1.interpolateEnv)(raw, env);
+            }
+            catch (_a) {
+                const unset = [...raw.matchAll(PLACEHOLDER)]
+                    .filter((m) => (env[m[1]] === undefined || env[m[1]] === "") && !m[2])
+                    .map((m) => m[1]);
+                problems.push(`${keyPath(path)}: ${unset.map((n) => `\${${n}}`).join(", ")} not set in .env`);
+                return input;
+            }
+        }
+        if (typeof input !== "string" || !(0, resolveSecretRefs_1.isSecretRef)(input))
+            return input;
+        try {
+            return (0, resolveSecretRefs_1.resolveSecretRef)(input, {
+                env,
+                readFile: (p) => {
+                    const mount = MOUNTS.find((m) => p.startsWith(m));
+                    const local = mount ? (0, path_1.join)(configDir, p.slice(mount.length)) : p;
+                    return (0, fs_1.readFileSync)((0, fs_1.existsSync)(local) ? local : p, "utf8");
+                }
+            });
+        }
+        catch (e) {
+            problems.push(`${keyPath(path)}: ${e.message}`);
+            return input;
+        }
+    }
+    if (Array.isArray(input))
+        return input.map((v, i) => resolveRefs(v, env, configDir, [...path, i], problems));
+    if (input !== null && typeof input === "object")
+        return Object.fromEntries(Object.entries(input).map(([k, v]) => [
+            k,
+            resolveRefs(v, env, configDir, [...path, k], problems)
+        ]));
+    return input;
+}
+function describe(error) {
+    var _a, _b;
+    const at = pointerSegments(error.instancePath);
+    if (error.keyword === "additionalProperties") {
+        const key = error.params
+            .additionalProperty;
+        const known = Object.keys((_b = (_a = error.parentSchema) === null || _a === void 0 ? void 0 : _a.properties) !== null && _b !== void 0 ? _b : {});
+        const hint = (0, configHints_1.suggestKey)(key, known);
+        return `${keyPath([...at, key])}: unknown key${hint ? ` (did you mean ${hint}?)` : ""}`;
+    }
+    if (error.keyword === "required") {
+        const missing = error.params
+            .missingProperty;
+        return `${keyPath([...at, missing])}: missing required value`;
+    }
+    return `${keyPath(at) || "(root)"}: ${error.message}`;
+}
+function loadSchemas(dir) {
+    var _a;
+    const schemas = new Map();
+    if (!(0, fs_1.existsSync)(dir))
+        return schemas;
+    for (const file of (0, fs_1.readdirSync)(dir).filter((f) => f.endsWith(".json"))) {
+        const name = file.replace(/\.json$/, "");
+        schemas.set((_a = ALIASES[name]) !== null && _a !== void 0 ? _a : name, JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(dir, file), "utf8")));
+    }
+    return schemas;
+}
+/** Validates config/*.yaml, placeholders resolved from .env, against config/schemas/*.json (D5). */
+function runCheck(options, io) {
+    var _a, _b;
+    const dir = (0, path_1.resolve)(options.dir);
+    const envFile = (0, path_1.join)(dir, ".env");
+    const configDir = (0, path_1.join)(dir, "config");
+    if (!(0, fs_1.existsSync)(envFile) || !(0, fs_1.existsSync)(configDir)) {
+        io.err("no .env here: run `npx -p @fonoster/common fonoster-config init` first");
+        return 1;
+    }
+    const env = (0, envFile_1.expandEnv)((0, envFile_1.readEnvFile)(envFile));
+    const schemas = loadSchemas((0, path_1.join)(configDir, "schemas"));
+    if (!schemas.size)
+        io.out("config/schemas/ has no schemas: checking values and secret:// references only");
+    let failed = 0;
+    const files = (0, render_1.listExamples)(configDir)
+        .map((e) => (0, render_1.renderedName)(e))
+        .filter((f) => /\.ya?ml$/.test(f));
+    for (const file of files) {
+        const label = `config/${file}`;
+        const path = (0, path_1.join)(configDir, file);
+        const problems = [];
+        if (!(0, fs_1.existsSync)(path)) {
+            io.err(`${label}: missing (run init)`);
+            failed++;
+            continue;
+        }
+        let data;
+        try {
+            data = (_a = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, "utf8"))) !== null && _a !== void 0 ? _a : {};
+        }
+        catch (e) {
+            io.err(`${label}: not valid YAML: ${e.message}`);
+            failed++;
+            continue;
+        }
+        const resolved = resolveRefs(data, env, configDir, [], problems);
+        const schema = schemas.get(file.replace(/\.ya?ml$/, ""));
+        if (schema) {
+            // The exported schemas are draft 2020-12 (toJsonSchema).
+            // coerceTypes: a placeholder is a string after YAML parsing; services accept "5060" for a
+            // port the same way. validateFormats: false: formats (uri, email) only document a value
+            // here (the services check them), and Ajv without ajv-formats warned for each one.
+            const ajv = new _2020_1.default({
+                allErrors: true,
+                coerceTypes: true,
+                strict: false,
+                validateFormats: false,
+                verbose: true
+            });
+            const validate = ajv.compile(schema);
+            if (!validate(resolved))
+                for (const error of (_b = validate.errors) !== null && _b !== void 0 ? _b : []) {
+                    const p = describe(error);
+                    if (!problems.includes(p))
+                        problems.push(p);
+                }
+        }
+        if (problems.length) {
+            failed++;
+            problems.forEach((p) => io.err(`${label}: ${p}`));
+        }
+        else
+            io.out(`${label}: valid${schema ? "" : " (no schema; values only)"}`);
+    }
+    (0, exposure_1.exposureWarnings)(env, dir).forEach((w) => io.err(`warning: ${w}`));
+    if (failed) {
+        io.err(`${failed} file${failed > 1 ? "s" : ""} with problems`);
+        return 1;
+    }
+    return 0;
+}

package/dist/config/cli/envFile.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Compose-style `.env` files (KEY=VALUE lines, `#` comments). Values may reference earlier names
+ * as `${NAME}` or `${NAME:-default}`, which Docker Compose expands too; `expandEnv` does the same
+ * for rendering. Quotes around a whole value are removed.
+ */
+export type EnvLine = {
+    kind: "entry";
+    name: string;
+    value: string;
+    raw: string;
+} | {
+    kind: "other";
+    raw: string;
+};
+export declare function parseEnvLines(text: string): EnvLine[];
+/** The entries of an env file, by name (the last one wins, as in Compose). */
+export declare function envEntries(lines: EnvLine[]): Map<string, string>;
+export declare function readEnvFile(file: string): Map<string, string>;
+/** Expands `${NAME}` references between values, in order (later values see earlier ones). */
+export declare function expandEnv(entries: Map<string, string>, base?: Record<string, string | undefined>): Record<string, string>;
+/** Writes a file and sets its mode (also when it already existed with another one). */
+export declare function writeWithMode(file: string, content: string, mode: number): void;
+export declare function serializeEnvLines(lines: EnvLine[]): string;

package/dist/config/cli/envFile.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEnvLines = parseEnvLines;
+exports.envEntries = envEntries;
+exports.readEnvFile = readEnvFile;
+exports.expandEnv = expandEnv;
+exports.writeWithMode = writeWithMode;
+exports.serializeEnvLines = serializeEnvLines;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const ENTRY = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/;
+function unquote(value) {
+    const v = value.trim();
+    if (v.length >= 2 &&
+        ((v.startsWith('"') && v.endsWith('"')) ||
+            (v.startsWith("'") && v.endsWith("'"))))
+        return v.slice(1, -1);
+    return v;
+}
+function parseEnvLines(text) {
+    const lines = text.split(/\r?\n/);
+    if (lines.length && lines[lines.length - 1] === "")
+        lines.pop();
+    return lines.map((raw) => {
+        const m = raw.trimStart().startsWith("#") ? null : ENTRY.exec(raw);
+        return m
+            ? { kind: "entry", name: m[1], value: unquote(m[2]), raw }
+            : { kind: "other", raw };
+    });
+}
+/** The entries of an env file, by name (the last one wins, as in Compose). */
+function envEntries(lines) {
+    const out = new Map();
+    for (const line of lines)
+        if (line.kind === "entry")
+            out.set(line.name, line.value);
+    return out;
+}
+function readEnvFile(file) {
+    return envEntries(parseEnvLines((0, fs_1.readFileSync)(file, "utf8")));
+}
+const REF = /\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}/g;
+/** Expands `${NAME}` references between values, in order (later values see earlier ones). */
+function expandEnv(entries, base = {}) {
+    const out = {};
+    for (const [name, value] of entries) {
+        out[name] = value.replace(REF, (_m, ref, dflt, fallback) => {
+            var _a;
+            const v = (_a = out[ref]) !== null && _a !== void 0 ? _a : base[ref];
+            if (v !== undefined && v !== "")
+                return v;
+            return dflt !== undefined ? fallback : "";
+        });
+    }
+    return out;
+}
+/** Writes a file and sets its mode (also when it already existed with another one). */
+function writeWithMode(file, content, mode) {
+    (0, fs_1.writeFileSync)(file, content, { mode });
+    (0, fs_1.chmodSync)(file, mode);
+}
+function serializeEnvLines(lines) {
+    return lines.map((l) => l.raw).join("\n") + "\n";
+}

package/dist/config/cli/exposure.d.ts

@@ -0,0 +1,10 @@
+/** The Compose file that turns on HTTPS in Envoy (ops/bundle/compose.tls.yaml). */
+export declare const TLS_COMPOSE_FILE = "compose.tls.yaml";
+export declare function isLocalHost(host: string): boolean;
+/** Whether .env turns on compose.tls.yaml (COMPOSE_FILE, `:`- or `,`-separated). */
+export declare function tlsEnabled(env: Record<string, string | undefined>): boolean;
+/**
+ * Warnings about how the dashboard and API are exposed (M10): plain HTTP on an address the
+ * internet may reach, or an HTTPS setup that is incomplete. They never stop init or check.
+ */
+export declare function exposureWarnings(env: Record<string, string | undefined>, dir: string): string[];

package/dist/config/cli/exposure.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TLS_COMPOSE_FILE = void 0;
+exports.isLocalHost = isLocalHost;
+exports.tlsEnabled = tlsEnabled;
+exports.exposureWarnings = exposureWarnings;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const net_1 = require("net");
+const path_1 = require("path");
+const url_1 = require("url");
+/** The Compose file that turns on HTTPS in Envoy (ops/bundle/compose.tls.yaml). */
+exports.TLS_COMPOSE_FILE = "compose.tls.yaml";
+/** Loopback, private and link-local ranges: a URL on them is not reachable from the internet. */
+const LOCAL = new net_1.BlockList();
+LOCAL.addSubnet("127.0.0.0", 8);
+LOCAL.addSubnet("10.0.0.0", 8);
+LOCAL.addSubnet("172.16.0.0", 12);
+LOCAL.addSubnet("192.168.0.0", 16);
+LOCAL.addSubnet("169.254.0.0", 16);
+LOCAL.addSubnet("100.64.0.0", 10);
+LOCAL.addAddress("::1", "ipv6");
+LOCAL.addSubnet("fc00::", 7, "ipv6");
+LOCAL.addSubnet("fe80::", 10, "ipv6");
+function isLocalHost(host) {
+    const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+    if (h === "localhost" || h.endsWith(".localhost") || h.endsWith(".local"))
+        return true;
+    const family = (0, net_1.isIP)(h);
+    if (family === 0)
+        return false;
+    return LOCAL.check(h, family === 6 ? "ipv6" : "ipv4");
+}
+/** Whether .env turns on compose.tls.yaml (COMPOSE_FILE, `:`- or `,`-separated). */
+function tlsEnabled(env) {
+    var _a;
+    return ((_a = env.COMPOSE_FILE) !== null && _a !== void 0 ? _a : "")
+        .split(/[:,;]/)
+        .some((f) => f.trim().replace(/^\.\//, "") === exports.TLS_COMPOSE_FILE);
+}
+const HOW = "set COMPOSE_FILE=compose.yaml:compose.tls.yaml with TLS_CERT and TLS_KEY in .env (see .env.example), or put a TLS proxy in front with HTTP_BIND=127.0.0.1";
+/**
+ * Warnings about how the dashboard and API are exposed (M10): plain HTTP on an address the
+ * internet may reach, or an HTTPS setup that is incomplete. They never stop init or check.
+ */
+function exposureWarnings(env, dir) {
+    var _a;
+    const warnings = [];
+    const publicUrl = (_a = env.PUBLIC_URL) !== null && _a !== void 0 ? _a : "";
+    let url;
+    try {
+        url = new url_1.URL(publicUrl);
+    }
+    catch (_b) {
+        if (publicUrl)
+            warnings.push(`PUBLIC_URL "${publicUrl}" is not a URL (http(s)://host)`);
+    }
+    const tls = tlsEnabled(env);
+    if (tls) {
+        ["TLS_CERT", "TLS_KEY"].forEach((name) => {
+            const file = env[name];
+            if (!file)
+                warnings.push(`COMPOSE_FILE names ${exports.TLS_COMPOSE_FILE} but ${name} is not set: Compose will refuse to start`);
+            else if (!(0, fs_1.existsSync)((0, path_1.isAbsolute)(file) ? file : (0, path_1.resolve)(dir, file)))
+                warnings.push(`${name}: ${file} not found on this machine`);
+        });
+        if (url && url.protocol !== "https:")
+            warnings.push(`HTTPS is on (${exports.TLS_COMPOSE_FILE}) but PUBLIC_URL is ${url.protocol}//: set PUBLIC_URL=https://<the certificate's domain> and run init again`);
+        return warnings;
+    }
+    if (env.TLS_CERT || env.TLS_KEY)
+        warnings.push(`TLS_CERT/TLS_KEY are set but COMPOSE_FILE does not name ${exports.TLS_COMPOSE_FILE}: Envoy still serves plain HTTP`);
+    if ((url === null || url === void 0 ? void 0 : url.protocol) === "http:" && !isLocalHost(url.hostname))
+        warnings.push(`PUBLIC_URL is ${url.origin}: the dashboard and API (passwords, API keys, tokens) go over plain HTTP to an address others may reach. For HTTPS, ${HOW}`);
+    return warnings;
+}

package/dist/config/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/{identity/tokenHasAccessKeyId.js → config/cli/index.js}

@@ -1,6 +1,6 @@
+#!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.tokenHasAccessKeyId = tokenHasAccessKeyId;
 /**
  * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/fonoster
@@ -19,10 +19,9 @@ exports.tokenHasAccessKeyId = tokenHasAccessKeyId;
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-const _1 = require(".");
-function tokenHasAccessKeyId(token, accessKeyId) {
-    var _a;
-    const decodedToken = (0, _1.decodeToken)(token);
-    const accessKeyIds = (_a = decodedToken.access) === null || _a === void 0 ? void 0 : _a.map((a) => a.accessKeyId);
-    return accessKeyIds.includes(accessKeyId);
-}
+const main_1 = require("./main");
+// fonoster-config (bin): see ./main for the commands.
+(0, main_1.main)(process.argv.slice(2)).then((code) => process.exit(code), (e) => {
+    process.stderr.write(`fonoster-config: ${e.message}\n`);
+    process.exit(1);
+});

package/dist/config/cli/info.d.ts

@@ -0,0 +1,6 @@
+import { Io } from "./types";
+export type InfoOptions = {
+    dir: string;
+};
+/** How to reach the install, from its local files only (.env). */
+export declare function runInfo(options: InfoOptions, io: Io): number;

package/dist/config/cli/info.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInfo = runInfo;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const url_1 = require("url");
+const envFile_1 = require("./envFile");
+const exposure_1 = require("./exposure");
+/** How to reach the install, from its local files only (.env). */
+function runInfo(options, io) {
+    const envFile = (0, path_1.join)(options.dir, ".env");
+    if (!(0, fs_1.existsSync)(envFile) || !(0, fs_1.existsSync)((0, path_1.join)(options.dir, "config"))) {
+        io.err("no .env here: run `npx -p @fonoster/common fonoster-config init` first");
+        return 1;
+    }
+    const env = (0, envFile_1.expandEnv)((0, envFile_1.readEnvFile)(envFile));
+    const host = env.HOST_IP || "localhost";
+    const httpPort = env.HTTP_PORT || "8449";
+    const sipPort = env.SIP_PORT || "5060";
+    const publicUrl = env.PUBLIC_URL || `http://${host}:${httpPort}`;
+    // compose.tls.yaml: Envoy serves HTTPS on 443 for PUBLIC_URL's host.
+    let tlsHost = host;
+    try {
+        tlsHost = new url_1.URL(publicUrl).hostname;
+    }
+    catch (_a) {
+        // Not a URL: check and init say so.
+    }
+    const api = (0, exposure_1.tlsEnabled)(env)
+        ? `${tlsHost}:443 (gRPC and gRPC-Web, TLS)`
+        : `${host}:${httpPort} (gRPC and gRPC-Web, plain HTTP)`;
+    const lines = [
+        `Dashboard   ${publicUrl}`,
+        `Owner       ${env.OWNER_EMAIL || "(OWNER_EMAIL not set)"} / ${env.OWNER_PASSWORD || "(OWNER_PASSWORD not set)"}`,
+        `API         ${api}`,
+        `SIP         ${host}:${sipPort} (UDP and TCP)`,
+        "",
+        `Files       ${envFile}   Compose settings and the generated secrets (back it up)`,
+        `            ${(0, path_1.join)(options.dir, "config")}/   service settings (from config/*.example.*)`,
+        `            ${(0, path_1.join)(options.dir, "config", "keys")}/   signing keys`
+    ];
+    lines.forEach((l) => io.out(l));
+    return 0;
+}

package/dist/config/cli/init.d.ts

@@ -0,0 +1,9 @@
+import { Io } from "./types";
+export type InitOptions = {
+    /** The bundle folder (compose.yaml, .env.example, config/). */
+    dir: string;
+    hostIp?: string;
+    /** Finds the host address (tests). */
+    detectHostIp?: () => Promise<string | undefined>;
+};
+export declare function runInit(options: InitOptions, io: Io): Promise<number>;

package/dist/config/cli/init.js

@@ -0,0 +1,152 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInit = runInit;
+/**
+ * Copyright (C) 2025 by Fonoster Inc (https://fonoster.com)
+ * http://github.com/fonoster/fonoster
+ *
+ * This file is part of Fonoster
+ *
+ * Licensed under the MIT License (the "License");
+ * you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ *    https://opensource.org/licenses/MIT
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const envFile_1 = require("./envFile");
+const exposure_1 = require("./exposure");
+const render_1 = require("./render");
+const secrets_1 = require("./secrets");
+const HOST = /^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$|^[0-9a-fA-F:]+$/;
+/** The .env lines after a run: new values only for missing names or empty secrets. */
+function mergeEnv(example, existing, hostIp) {
+    const added = [];
+    const generated = [];
+    const valueFor = (name, exampleValue) => {
+        if (name === "HOST_IP")
+            return hostIp;
+        if (exampleValue !== "")
+            return exampleValue;
+        const secret = (0, secrets_1.generateSecret)(name);
+        if (secret !== undefined)
+            generated.push(name);
+        return secret !== null && secret !== void 0 ? secret : "";
+    };
+    const entry = (name, value) => ({
+        kind: "entry",
+        name,
+        value,
+        raw: `${name}=${value}`
+    });
+    if (!existing) {
+        const lines = example.map((l) => l.kind === "entry" && (l.value === "" || l.name === "HOST_IP")
+            ? entry(l.name, valueFor(l.name, l.value))
+            : l);
+        return { lines, added: [], generated };
+    }
+    // Existing lines stay as they are, except an empty secret (filled) and HOST_IP when
+    // --host-ip names another address.
+    const lines = existing.map((l) => {
+        if (l.kind !== "entry")
+            return l;
+        if (l.name === "HOST_IP")
+            return l.value === hostIp ? l : entry(l.name, hostIp);
+        if (l.value === "" && (0, secrets_1.generateSecret)(l.name) !== undefined)
+            return entry(l.name, valueFor(l.name, ""));
+        return l;
+    });
+    const have = (0, envFile_1.envEntries)(existing);
+    const missing = example.filter((l) => l.kind === "entry" && !have.has(l.name));
+    if (missing.length) {
+        lines.push({
+            kind: "other",
+            raw: `# Added by fonoster-config init (${new Date().toISOString().slice(0, 10)})`
+        });
+        for (const l of missing) {
+            lines.push(entry(l.name, valueFor(l.name, l.value)));
+            added.push(l.name);
+        }
+    }
+    return { lines, added, generated };
+}
+function runInit(options, io) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const dir = options.dir;
+        const exampleFile = (0, path_1.join)(dir, ".env.example");
+        const envFile = (0, path_1.join)(dir, ".env");
+        const configDir = (0, path_1.join)(dir, "config");
+        if (!(0, fs_1.existsSync)(exampleFile) || !(0, fs_1.existsSync)(configDir)) {
+            io.err(`${dir} has no .env.example or config/: run init in the unpacked fonoster folder, or pass --dir <folder>`);
+            return 1;
+        }
+        if (options.hostIp !== undefined && !HOST.test(options.hostIp)) {
+            io.err(`--host-ip: "${options.hostIp}" is not an address`);
+            return 1;
+        }
+        const example = (0, envFile_1.parseEnvLines)((0, fs_1.readFileSync)(exampleFile, "utf8"));
+        const existing = (0, fs_1.existsSync)(envFile)
+            ? (0, envFile_1.parseEnvLines)((0, fs_1.readFileSync)(envFile, "utf8"))
+            : undefined;
+        const kept = existing ? (0, envFile_1.envEntries)(existing).get("HOST_IP") : undefined;
+        const hostIp = options.hostIp ||
+            kept ||
+            (yield ((_a = options.detectHostIp) !== null && _a !== void 0 ? _a : (() => (0, secrets_1.detectHostIp)()))());
+        if (!hostIp) {
+            io.err("could not detect this machine's address: pass --host-ip <address> (the address softphones and browsers reach it at)");
+            return 1;
+        }
+        const { lines, added, generated } = mergeEnv(example, existing, hostIp);
+        (0, envFile_1.writeWithMode)(envFile, (0, envFile_1.serializeEnvLines)(lines), 0o600);
+        // config/ holds secrets: only the owner may list it. Files inside are readable by the
+        // containers, which run as another user and reach them through their bind mounts.
+        (0, fs_1.chmodSync)(configDir, 0o700);
+        const keys = (0, secrets_1.ensureKeys)(configDir);
+        const env = (0, envFile_1.expandEnv)((0, envFile_1.envEntries)(lines));
+        let rendered;
+        try {
+            rendered = (0, render_1.renderConfigDir)({ configDir, env });
+        }
+        catch (e) {
+            if (!(e instanceof render_1.RenderError))
+                throw e;
+            e.problems.forEach((p) => io.err(p));
+            io.err("fix .env (or the example) and run init again");
+            return 1;
+        }
+        const rel = (p) => (0, path_1.relative)(dir, p) || ".";
+        io.out(existing
+            ? `.env kept${added.length ? `; added ${added.join(", ")}` : ""}`
+            : `.env written (${generated.length} secrets generated)`);
+        const filled = generated.filter((n) => !added.includes(n));
+        if (existing && filled.length)
+            io.out(`generated ${filled.join(", ")}`);
+        io.out(keys.length
+            ? `keys: ${keys.length} files created in ${rel((0, path_1.join)(configDir, "keys"))}`
+            : "keys: kept");
+        io.out(`config: ${rendered.map((f) => `config/${f}`).join(", ")}`);
+        io.out(`host address: ${hostIp}`);
+        (0, exposure_1.exposureWarnings)(env, dir).forEach((w) => io.err(`warning: ${w}`));
+        io.out("");
+        io.out("Next: docker compose up -d");
+        io.out("Then: npx -p @fonoster/common fonoster-config info (dashboard URL and owner login)");
+        return 0;
+    });
+}