@runeya/runeya 2.0.119 → 2.0.121

package/{src-NRKK27F3.js → src-JIS3X4OU.js}

@@ -64,7 +64,7 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-22RJM654.js";
+} from "./chunk-HJUFIZ7H.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -87,7 +87,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-NYKFDU76.js";
+} from "./chunk-OVV52N5F.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -98,7 +98,6 @@ import {
   clearVaultLock,
   decryptValue,
   decryptValueWith,
-  describeInstance,
   encryptValue,
   encryptValueWith,
   ensureEncryptionKey,
@@ -126,10 +125,11 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-2WXQIUVC.js";
+} from "./chunk-CNTL6NVU.js";
 import {
   settingsManager
-} from "./chunk-GIHR3BGT.js";
+} from "./chunk-3N55WR7F.js";
+import "./chunk-YZU5FNXR.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -163,7 +163,7 @@ import {
   readEntity,
   serviceSlug,
   writeEntity
-} from "./chunk-H6VIS4OY.js";
+} from "./chunk-T2BV5WZE.js";
 import {
   env,
   forgetOrgLogo,
@@ -1167,6 +1167,63 @@ var projectRouter = router({
     await projectPathStore.set(project, input.path);
     await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id, metadata: { localPath: input.path } });
     return { path: input.path };
+  }),
+  /**
+   * Ce qui a changé dans les stores, à mesure que ça change.
+   *
+   * Un projet, un service ou un environnement n'arrive pas toujours de
+   * l'utilisateur assis devant : il descend du cloud quand un collègue le
+   * pousse, ou d'une autre Runeya de cette machine. Les stores étaient déjà
+   * prévenus — la synchronisation s'appuie sur les mêmes signaux — mais rien ne
+   * portait l'information jusqu'à l'écran, qui gardait donc ce qu'il avait
+   * chargé à l'ouverture de la vue.
+   *
+   * Ce flux annonce les collections touchées, pas leur contenu. Chacune a déjà
+   * sa route, avec ses règles — un service ne sort jamais d'ici sans être
+   * expurgé de ses secrets — et les redire ici en ferait une seconde version à
+   * tenir d'accord avec la première.
+   *
+   * Les réveils sont groupés : une synchronisation qui descend un projet touche
+   * ses trois collections coup sur coup, et trois annonces feraient trois
+   * rechargements là où un seul suffit.
+   */
+  onDataChanged: protectedProcedure.subscription(async function* ({ signal }) {
+    const touched = /* @__PURE__ */ new Set();
+    let wake = null;
+    const mark = (collection) => () => {
+      touched.add(collection);
+      if (wake) {
+        wake();
+        wake = null;
+      }
+    };
+    const onProjects = mark("projects");
+    projectStore.events.on("saved", onProjects);
+    const offs = [serviceStore.onChange(mark("services")), environmentStore.onChange(mark("environments"))];
+    const onAbort = () => {
+      if (wake) {
+        wake();
+        wake = null;
+      }
+    };
+    signal?.addEventListener("abort", onAbort);
+    try {
+      while (!signal?.aborted) {
+        if (touched.size > 0) {
+          const collections = Array.from(touched);
+          touched.clear();
+          yield { collections };
+        } else {
+          await new Promise((resolve4) => {
+            wake = resolve4;
+          });
+        }
+      }
+    } finally {
+      projectStore.events.off("saved", onProjects);
+      for (const off of offs) off();
+      signal?.removeEventListener("abort", onAbort);
+    }
   })
 });
 
@@ -6523,82 +6580,8 @@ async function reconcileOrgCanary(orgId) {
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID5 } from "crypto";
-import { mkdir as mkdir8, rm as rm3 } from "fs/promises";
+import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
 import * as Y from "yjs";
-
-// ../server/src/services/org-lock.ts
-import { open, readFile as readFile4, unlink, mkdir as mkdir7 } from "fs/promises";
-import { readFileSync, unlinkSync } from "fs";
-import { join as join10 } from "path";
-var held = /* @__PURE__ */ new Set();
-function lockPath(orgId) {
-  return join10(orgVaultRoot(orgId), "org.lock");
-}
-function isRunning(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-async function readLock(path) {
-  try {
-    const parsed = JSON.parse(await readFile4(path, "utf-8"));
-    return typeof parsed?.pid === "number" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-async function acquireOrgLock(orgId) {
-  const path = lockPath(orgId);
-  await mkdir7(orgVaultRoot(orgId), { recursive: true });
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      const handle = await open(path, "wx");
-      try {
-        const contents = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        await handle.writeFile(JSON.stringify(contents), "utf-8");
-      } finally {
-        await handle.close();
-      }
-      held.add(orgId);
-      return { acquired: true };
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-    }
-    const holder2 = await readLock(path);
-    if (holder2 && holder2.pid !== process.pid && isRunning(holder2.pid)) {
-      return { acquired: false, heldBy: holder2.pid };
-    }
-    await unlink(path).catch(() => {
-    });
-  }
-  const holder = await readLock(path);
-  return holder ? { acquired: false, heldBy: holder.pid } : { acquired: true };
-}
-async function releaseOrgLock(orgId) {
-  held.delete(orgId);
-  const path = lockPath(orgId);
-  const holder = await readLock(path);
-  if (holder && holder.pid !== process.pid) return;
-  await unlink(path).catch(() => {
-  });
-}
-function releaseAllOrgLocksSync() {
-  for (const orgId of held) {
-    const path = lockPath(orgId);
-    try {
-      const holder = JSON.parse(readFileSync(path, "utf-8"));
-      if (holder.pid === process.pid) unlinkSync(path);
-    } catch {
-    }
-  }
-  held.clear();
-}
-
-// ../server/src/services/cloud-sync-bridge.ts
 var LOCAL_ORIGIN = "local-bridge";
 var REMOTE_ORIGIN = "remote";
 var RECONNECT_DELAY_MS = 3e3;
@@ -6971,7 +6954,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir8(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir7(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -7012,6 +6995,7 @@ var OrgSyncConnection = class {
     } finally {
       this.pulling = false;
     }
+    await serviceStore.relocateAll();
     await this.reconcileLocalToDoc();
   }
   // ---- Local ↔ Doc reconciliation --------------------------------------
@@ -7243,21 +7227,12 @@ var OrgSyncConnection = class {
 };
 var CloudSyncBridge = class {
   connections = /* @__PURE__ */ new Map();
-  /**
-   * Orgs another instance holds the lock on — reported, not retried blindly.
-   *
-   * Le pid du détenteur, et non un simple drapeau : « un autre Runeya de cette
-   * machine » ne dit pas lequel fermer, et l'utilisateur en a souvent trois.
-   * Le port se déduit du pid par le registre d'instances, au moment de rendre
-   * l'état — jamais mémorisé ici, où il vieillirait.
-   */
-  locked = /* @__PURE__ */ new Map();
   /**
    * Orgs whose key this machine does not have.
    *
-   * Held here for the same reason as `locked`: the connection is never opened,
-   * so there is nothing to ask for its state — and an org that cannot sync
-   * until a human supplies a key must not read as merely "stopped".
+   * Tenues à part : la connexion n'est jamais ouverte, donc il n'y a rien à qui
+   * demander son état — et une organisation qui ne peut pas synchroniser tant
+   * qu'un humain n'a pas fourni de clé ne doit pas se lire « arrêtée ».
    */
   keyMismatch = /* @__PURE__ */ new Set();
   started = false;
@@ -7341,22 +7316,14 @@ var CloudSyncBridge = class {
     const live = Array.from(this.connections.entries()).map(([orgId, conn]) => ({
       orgId,
       state: conn.getState(),
-      lastIncompatibleVersion: conn.getLastIncompatibleVersion(),
-      heldByPid: null
-    }));
-    const locked = Array.from(this.locked).filter(([orgId]) => !this.connections.has(orgId)).map(([orgId, pid]) => ({
-      orgId,
-      state: "locked",
-      lastIncompatibleVersion: null,
-      heldByPid: pid
+      lastIncompatibleVersion: conn.getLastIncompatibleVersion()
     }));
     const mismatched = Array.from(this.keyMismatch).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({
       orgId,
       state: "key-mismatch",
-      lastIncompatibleVersion: null,
-      heldByPid: null
+      lastIncompatibleVersion: null
     }));
-    return [...live, ...locked, ...mismatched];
+    return [...live, ...mismatched];
   }
   /**
    * Follow one project of an org on this machine, pulling it now.
@@ -7402,20 +7369,6 @@ var CloudSyncBridge = class {
       );
     }
     this.keyMismatch.delete(link.orgId);
-    const lock = await acquireOrgLock(link.orgId).catch((err) => {
-      console.error("[cloud-sync] could not take the lock for org %s:", link.orgId, err.message);
-      return { acquired: false, heldBy: 0 };
-    });
-    if (!lock.acquired) {
-      console.error(
-        "[cloud-sync] org %s is already being synced by another Runeya (pid %d) \u2014 not syncing it here",
-        link.orgId,
-        lock.heldBy
-      );
-      this.locked.set(link.orgId, lock.heldBy);
-      return;
-    }
-    this.locked.delete(link.orgId);
     const conn = new OrgSyncConnection(link);
     this.connections.set(link.orgId, conn);
     try {
@@ -7429,22 +7382,19 @@ var CloudSyncBridge = class {
     if (existing) {
       existing.stop();
       this.connections.delete(orgId);
-      void releaseOrgLock(orgId);
     }
   }
   stopAll() {
     for (const conn of this.connections.values()) conn.stop();
     this.connections.clear();
-    this.locked.clear();
     this.keyMismatch.clear();
-    releaseAllOrgLocksSync();
   }
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir9, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
-import { join as join11 } from "path";
+import { readdir as readdir3, readFile as readFile4, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
+import { join as join10 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 function isAgentTriplet(value) {
@@ -7524,10 +7474,10 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const touchedRoots = /* @__PURE__ */ new Set();
   for (const vaultRoot of await rootsOfOrg(orgId)) {
     for (const name of await jsonFilesIn(vaultRoot)) {
-      const path = join11(vaultRoot, name);
+      const path = join10(vaultRoot, name);
       let parsed;
       try {
-        parsed = JSON.parse(await readFile5(path, "utf-8"));
+        parsed = JSON.parse(await readFile4(path, "utf-8"));
       } catch {
         continue;
       }
@@ -7541,14 +7491,14 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backups = [];
   for (const vaultRoot of touchedRoots) {
-    const backupDir = join11(vaultRoot, `backup-key-${stamp}`);
-    await mkdir9(backupDir, { recursive: true });
+    const backupDir = join10(vaultRoot, `backup-key-${stamp}`);
+    await mkdir8(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
-      await copyFile(join11(vaultRoot, name), join11(backupDir, name));
+      await copyFile(join10(vaultRoot, name), join10(backupDir, name));
     }
     for (const name of [".encryption.key.enc", ".runeya-verify"]) {
-      if (await exists(join11(vaultRoot, name))) {
-        await copyFile(join11(vaultRoot, name), join11(backupDir, name));
+      if (await exists(join10(vaultRoot, name))) {
+        await copyFile(join10(vaultRoot, name), join10(backupDir, name));
       }
     }
     backups.push(backupDir);
@@ -7612,10 +7562,6 @@ async function assertOrgKey(orgId) {
 function syncState(orgId) {
   return cloudSyncBridge.states().find((s) => s.orgId === orgId)?.state ?? "stopped";
 }
-async function syncLockHolder(orgId) {
-  const pid = cloudSyncBridge.states().find((s) => s.orgId === orgId)?.heldByPid;
-  return pid ? describeInstance(pid) : null;
-}
 var cloudSyncRouter = router({
   /**
    * Follow one more project of an org, and pull it now.
@@ -7650,7 +7596,7 @@ var cloudSyncRouter = router({
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
-      return { pulled, state: syncState(input.orgId), heldBy: await syncLockHolder(input.orgId) };
+      return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
         throw new TRPCError19({ code: "CONFLICT", message: err.code, cause: err });
@@ -7987,9 +7933,8 @@ var cloudSyncRouter = router({
   list: protectedProcedure.query(async () => {
     const links = await orgsToSync();
     const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s]));
-    return Promise.all(links.map(async (l) => {
+    return links.map((l) => {
       const found = states.get(l.orgId);
-      const heldBy = found?.heldByPid ? await describeInstance(found.heldByPid) : null;
       return {
         orgId: l.orgId,
         cloudUrl: l.cloudUrl,
@@ -7997,10 +7942,9 @@ var cloudSyncRouter = router({
         // Renseigné seulement quand le cloud a refusé cette app comme trop
         // ancienne : c'est lui qui publie le plancher, on ne le devine pas. La
         // borne est exclusive — il faut strictement plus récent que ce numéro.
-        lastIncompatibleVersion: found?.lastIncompatibleVersion ?? null,
-        heldBy
+        lastIncompatibleVersion: found?.lastIncompatibleVersion ?? null
       };
-    }));
+    });
   }),
   /**
    * The cloud instance behind every org vault on this machine.
@@ -8019,13 +7963,13 @@ var cloudSyncRouter = router({
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute, join as join12, resolve as resolve2, dirname as dirname4, basename } from "path";
+import { isAbsolute, join as join11, resolve as resolve2, dirname as dirname4, basename } from "path";
 import { z as z24 } from "zod";
 var MAX_ENTRIES2 = 500;
 var PATH_SCHEMA = z24.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join12(homedir3(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join11(homedir3(), input.slice(1)) : input;
   if (!isAbsolute(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve2(expanded);
 }
@@ -8061,7 +8005,7 @@ var filesystemRouter = router({
     const truncated = names.length > MAX_ENTRIES2;
     const entries2 = [];
     for (const name of names.slice(0, MAX_ENTRIES2)) {
-      const path = join12(dir, name);
+      const path = join11(dir, name);
       entries2.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
@@ -8322,8 +8266,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir10, copyFile as copyFile2, unlink as unlink2, rename as rename5, stat as stat8 } from "fs/promises";
-import { join as join13 } from "path";
+import { readdir as readdir5, readFile as readFile5, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename5, stat as stat8 } from "fs/promises";
+import { join as join12 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -8353,17 +8297,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join13(legacyRoot, `backup-${stamp}`);
-  await mkdir10(backupDir, { recursive: true });
+  const backupDir = join12(legacyRoot, `backup-${stamp}`);
+  await mkdir9(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists2(join13(legacyRoot, name))) {
-      await copyFile2(join13(legacyRoot, name), join13(backupDir, name));
+    if (await exists2(join12(legacyRoot, name))) {
+      await copyFile2(join12(legacyRoot, name), join12(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile6(join13(legacyRoot, name), "utf-8");
+    const raw = await readFile5(join12(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -8373,13 +8317,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join13(legacyRoot, `${name}.tmp`);
+    const tmp = join12(legacyRoot, `${name}.tmp`);
     await writeFile7(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename5(tmp, join13(legacyRoot, name));
+    await rename5(tmp, join12(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile6(join13(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile5(join12(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -8388,31 +8332,31 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir10(machineRootDir, { recursive: true });
+  await mkdir9(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join13(legacyRoot, name);
+    const from = join12(legacyRoot, name);
     if (!await exists2(from)) continue;
-    const to = join13(machineRootDir, name);
+    const to = join12(machineRootDir, name);
     if (await exists2(to)) {
       skipped.push(name);
       continue;
     }
     await copyFile2(from, to);
-    await unlink2(from);
+    await unlink(from);
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join13(legacyRoot, name);
-    if (await exists2(path)) await unlink2(path);
+    const path = join12(legacyRoot, name);
+    if (await exists2(path)) await unlink(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile7, writeFile as writeFile8, rename as rename6, unlink as unlink3, mkdir as mkdir11, chmod as chmod4, stat as stat9 } from "fs/promises";
-import { join as join14 } from "path";
+import { readFile as readFile6, writeFile as writeFile8, rename as rename6, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
+import { join as join13 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 async function exists3(path) {
@@ -8425,14 +8369,14 @@ async function legacySource(filename) {
   return null;
 }
 async function moveInto(root, filename, from) {
-  await mkdir11(root, { recursive: true });
-  const to = join14(root, filename);
-  const contents = await readFile7(from, "utf-8");
+  await mkdir10(root, { recursive: true });
+  const to = join13(root, filename);
+  const contents = await readFile6(from, "utf-8");
   const tmp = to + ".tmp";
   await writeFile8(tmp, contents, "utf-8");
   await rename6(tmp, to);
   await chmod4(to, 384);
-  await unlink3(from);
+  await unlink2(from);
 }
 async function migrateSettingsIntoVaults() {
   const report = { movedTo: null, files: [], ambiguous: [] };
@@ -8451,7 +8395,7 @@ async function migrateSettingsIntoVaults() {
   const orgId = orgs[0];
   const root = orgVaultRoot(orgId);
   for (const { filename, from } of sources) {
-    if (await exists3(join14(root, filename))) continue;
+    if (await exists3(join13(root, filename))) continue;
     await moveInto(root, filename, from);
     report.files.push(filename);
   }
@@ -8467,14 +8411,14 @@ import { createRequire } from "module";
 import { randomBytes as randomBytes3, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
 import { randomUUID as randomUUID6 } from "crypto";
 import {
-  readFile as readFile8,
+  readFile as readFile7,
   writeFile as writeFile9,
   rename as rename7,
-  mkdir as mkdir12,
+  mkdir as mkdir11,
   access as access2,
   readdir as readdir6
 } from "fs/promises";
-import { join as join15, dirname as dirname5 } from "path";
+import { join as join14, dirname as dirname5 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -8591,7 +8535,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile8(filePath, "utf-8")).trim();
+  const raw = (await readFile7(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -8616,7 +8560,7 @@ async function atomicWrite(path, data) {
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join15(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join14(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -8626,18 +8570,18 @@ async function runLegacyMigration(dataDir) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const legacyTmp = `${legacyRoot}-tmp`;
   await rename7(legacyRoot, legacyTmp);
-  await mkdir12(dataDir, { recursive: true });
-  const legacyOld = join15(dataDir, `backup-${timestamp}`);
+  await mkdir11(dataDir, { recursive: true });
+  const legacyOld = join14(dataDir, `backup-${timestamp}`);
   await rename7(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile8(join15(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile7(join14(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join15(legacyOld, "dbs");
+  const dbsDir = join14(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -8646,29 +8590,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join15(dbsDir, "envs");
+  const envsDir = join14(dbsDir, "envs");
   const envFiles = (await readdir6(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join15(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join14(envsDir, file));
   }
-  const servicesDir = join15(dbsDir, "services");
+  const servicesDir = join14(dbsDir, "services");
   const serviceFiles = (await readdir6(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join15(servicesDir, file));
+    const data = await readEncrypted(join14(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join15(dbsDir, "overrides");
+  const overridesDir = join14(dbsDir, "overrides");
   const overrideFiles = (await readdir6(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join15(overridesDir, file));
+    const data = await readEncrypted(join14(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -8676,11 +8620,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join15(dbsDir, "parsers");
+  const parsersDir = join14(dbsDir, "parsers");
   const parserFiles = (await readdir6(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join15(parsersDir, file));
+    const data = await readEncrypted(join14(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID6();
@@ -9021,7 +8965,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile8(join15(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile7(join14(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -9042,11 +8986,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join15(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join15(dataDir, "services.json"), runeServices);
-  await atomicWrite(join15(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join15(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join15(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join14(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join14(dataDir, "services.json"), runeServices);
+  await atomicWrite(join14(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join14(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join14(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -9060,9 +9004,9 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries2 = await readdir6(dataDir);
     const backupDirs = entries2.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join15(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join14(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile8(keyJsonPath, "utf-8");
+        const raw = await readFile7(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -9083,8 +9027,8 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve4 } = await import("path");
   const abDataDir = resolve4(dataDir);
   const candidateDirs = [
-    join15(dirname5(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join15(abDataDir, "dbs", "overrides")
+    join14(dirname5(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join14(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -9100,7 +9044,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join15(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join14(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -9118,7 +9062,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile8(join15(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile7(join14(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -9137,7 +9081,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile8(join15(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile7(join14(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -9154,7 +9098,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join14(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9181,7 +9125,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join15(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join14(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -9191,7 +9135,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join14(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9250,7 +9194,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join15(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join14(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -9265,7 +9209,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 import { stat as stat10 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -9275,22 +9219,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat10(join16(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat10(join15(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, VERIFY_FILENAME2));
+    await stat10(join15(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, "projects.json"));
+    await stat10(join15(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, "project.json"));
+    await stat10(join15(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -10442,7 +10386,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-4RQ3AMOL.js");
+  const { initCompanion } = await import("./companion-AUMA6RGX.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10572,8 +10516,8 @@ function onTrayServicesChanged(listener) {
 }
 
 // ../server/src/services/tray-icon.ts
-import { mkdir as mkdir13, writeFile as writeFile10, rename as rename8 } from "fs/promises";
-import { join as join17 } from "path";
+import { mkdir as mkdir12, writeFile as writeFile10, rename as rename8 } from "fs/promises";
+import { join as join16 } from "path";
 
 // ../server/src/services/png-to-ico.ts
 function isPng(bytes) {
@@ -10733,7 +10677,7 @@ var FETCH_TIMEOUT_MS = 3e3;
 var CACHE_TTL_MS = 10 * 6e4;
 var cache2 = /* @__PURE__ */ new Map();
 function trayIconDir() {
-  return join17(machineRoot(), "tray-icons");
+  return join16(machineRoot(), "tray-icons");
 }
 async function resolveTrayIcon(platform = process.platform) {
   const orgId = getCurrentProject()?.orgId;
@@ -10761,8 +10705,8 @@ async function renderThemedIcon(platform) {
 }
 async function writeTrayIcon(stem, png, platform) {
   const dir = trayIconDir();
-  await mkdir13(dir, { recursive: true });
-  const path = join17(dir, stem);
+  await mkdir12(dir, { recursive: true });
+  const path = join16(dir, stem);
   if (platform === "win32") {
     const ico = pngToIco(png);
     return ico ? writeAtomic(`${path}.ico`, ico) : null;
@@ -10889,4 +10833,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-NRKK27F3.js.map
+//# sourceMappingURL=src-JIS3X4OU.js.map