@runeya/runeya 2.0.121 → 2.0.122

package/{chunk-CNTL6NVU.js → chunk-XTLQOYLT.js}

@@ -1,9 +1,10 @@
 import {
+  atomicWriteSecure,
   fingerprintFiles,
   hasChangedSinceRead,
   rememberFile,
   wasRead
-} from "./chunk-YZU5FNXR.js";
+} from "./chunk-GL7WA5K3.js";
 import {
   AGENT_FETCH_TIMEOUT,
   AGENT_HEALTH_POLL_INTERVAL,
@@ -390,7 +391,7 @@ var agentStore = new AgentStore();
 
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir3, chmod as chmod3, rm as rm2 } from "fs/promises";
+import { readFile as readFile3, rm as rm2 } from "fs/promises";
 import { join as join3 } from "path";
 
 // ../server/src/services/project-key.ts
@@ -501,9 +502,49 @@ function isVaultConflicted(root) {
   return conflicted.has(root);
 }
 
+// ../server/src/services/store-disk-coordinator.ts
+import { AsyncLocalStorage } from "async_hooks";
+var insideReload = new AsyncLocalStorage();
+var StoreDiskCoordinator = class {
+  reloading = null;
+  saves = 0;
+  queue = Promise.resolve();
+  /**
+   * `read` rend de quoi substituer le nouvel état, ou `null` s'il n'y a rien à
+   * relire. La substitution doit être synchrone : c'est ce qui la rend atomique.
+   */
+  load(read) {
+    const inside = insideReload.getStore();
+    if (inside && (inside.has(this) || this.reloading)) return Promise.resolve();
+    this.reloading ??= this.reload(read).finally(() => {
+      this.reloading = null;
+    });
+    return this.reloading;
+  }
+  async reload(read) {
+    for (; ; ) {
+      await this.queue;
+      const savesBefore = this.saves;
+      const outer = insideReload.getStore() ?? /* @__PURE__ */ new Set();
+      const commit = await insideReload.run(/* @__PURE__ */ new Set([...outer, this]), read);
+      if (!commit) return;
+      if (this.saves !== savesBefore) continue;
+      commit();
+      return;
+    }
+  }
+  save(write) {
+    this.saves += 1;
+    const run = this.queue.then(write);
+    this.queue = run.catch(() => {
+    });
+    return run;
+  }
+};
+
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2, rm } from "fs/promises";
+import { readFile as readFile2, rm } from "fs/promises";
 import { join as join2 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
@@ -647,6 +688,7 @@ var EnvironmentStore = class {
    * refusée l'est pour toujours et la modification de l'utilisateur se perd.
    */
   fingerprint = "";
+  disk = new StoreDiskCoordinator();
   listeners = /* @__PURE__ */ new Set();
   /** Notified after every persisted mutation, for the cloud sync bridge. */
   onChange(fn) {
@@ -810,7 +852,7 @@ var EnvironmentStore = class {
     }
     return result;
   }
-  decryptEnvironment(environment, vault) {
+  decryptEnvironment(environment, vault, unreadable = this.unreadableSecrets) {
     let decryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
       const failed = /* @__PURE__ */ new Set();
@@ -820,8 +862,8 @@ var EnvironmentStore = class {
         (variableId) => failed.add(variableId),
         vault ?? this.vaultOf(environment)
       );
-      if (failed.size > 0) this.unreadableSecrets.set(environment.id, failed);
-      else this.unreadableSecrets.delete(environment.id);
+      if (failed.size > 0) unreadable.set(environment.id, failed);
+      else unreadable.delete(environment.id);
     }
     return { ...environment, variables: decryptedVars };
   }
@@ -837,39 +879,47 @@ var EnvironmentStore = class {
    * store reads environments while absorbing a project, which would deadlock).
    */
   async load() {
-    const fingerprint = await this.diskFingerprint();
-    if (this.loaded && fingerprint === this.fingerprint) return;
-    this.loaded = true;
-    this.fingerprint = fingerprint;
-    await ensureProjectsLoaded();
-    if (!getEncryptionKey()) {
-      this.loaded = false;
-      return;
-    }
-    const roots = await allVaultRoots();
-    this.environments.clear();
-    this.diskEncryptedSlots.clear();
-    this.roots.clear();
-    this.unreadableSecrets.clear();
-    for (const root of roots) {
+    await this.disk.load(async () => {
+      const fingerprint = await this.diskFingerprint();
+      if (this.loaded && fingerprint === this.fingerprint) return null;
+      await ensureProjectsLoaded();
+      if (!getEncryptionKey()) return null;
+      const next = await this.readVaults();
+      return () => {
+        this.environments = next.environments;
+        this.diskEncryptedSlots = next.diskEncryptedSlots;
+        this.roots = next.roots;
+        this.unreadableSecrets = next.unreadableSecrets;
+        this.fingerprint = fingerprint;
+        this.loaded = true;
+      };
+    });
+  }
+  /** Lire tous les coffres dans des tables neuves, que `load` substitue d'un coup. */
+  async readVaults() {
+    const environments = /* @__PURE__ */ new Map();
+    const diskEncryptedSlots = /* @__PURE__ */ new Map();
+    const roots = /* @__PURE__ */ new Map();
+    const unreadableSecrets = /* @__PURE__ */ new Map();
+    for (const root of await allVaultRoots()) {
       try {
         const raw = await readFile2(this.getFilePath(root), "utf-8");
         await rememberFile(this.getFilePath(root));
         const data = JSON.parse(raw);
-        const clash = data.find((e) => this.environments.has(e.id) && this.roots.get(e.id) !== root);
+        const clash = data.find((e) => environments.has(e.id) && roots.get(e.id) !== root);
         if (clash) {
           markVaultConflict(root, `environnement ${clash.id}`);
           continue;
         }
         for (const e of data) {
-          this.diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
-          this.roots.set(e.id, root);
-          const decrypted = this.decryptEnvironment(e, vaultIdOfRoot(root));
-          this.environments.set(e.id, decrypted);
+          diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
+          roots.set(e.id, root);
+          environments.set(e.id, this.decryptEnvironment(e, vaultIdOfRoot(root), unreadableSecrets));
         }
       } catch {
       }
     }
+    return { environments, diskEncryptedSlots, roots, unreadableSecrets };
   }
   /**
    * Write each vault that holds — or held — an environment.
@@ -891,7 +941,10 @@ var EnvironmentStore = class {
       if (wasRead(path) && await hasChangedSinceRead(path)) this.staleRoots.add(root);
     }
   }
-  async save() {
+  save() {
+    return this.disk.save(() => this.writeVaults());
+  }
+  async writeVaults() {
     await this.markStaleRoots();
     const byRoot = /* @__PURE__ */ new Map();
     for (const root of this.roots.values()) {
@@ -921,11 +974,7 @@ var EnvironmentStore = class {
         });
         continue;
       }
-      await mkdir2(root, { recursive: true });
-      const tmpPath = filePath + ".tmp";
-      await writeFile2(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
-      await rename2(tmpPath, filePath);
-      await chmod2(filePath, 384);
+      await atomicWriteSecure(filePath, JSON.stringify(environments, null, 2));
       await rememberFile(filePath);
     }
     this.fingerprint = await this.diskFingerprint();
@@ -1273,6 +1322,7 @@ var ServiceStore = class {
    * pour toutes ne verrait jamais les services créés par l'autre.
    */
   fingerprint = "";
+  disk = new StoreDiskCoordinator();
   listeners = /* @__PURE__ */ new Set();
   /**
    * Last on-disk (encrypted) form per service id, so `prepareForDisk` can reuse
@@ -1344,20 +1394,30 @@ var ServiceStore = class {
    */
   async load() {
     if (!getEncryptionKey()) return;
-    const fingerprint = await this.diskFingerprint();
-    if (this.loaded && fingerprint === this.fingerprint) return;
-    this.loaded = true;
-    this.fingerprint = fingerprint;
-    await ensureProjectsLoaded();
-    const roots = await allVaultRoots();
-    this.services.clear();
-    this.diskForm.clear();
-    this.roots.clear();
-    for (const root of roots) {
+    await this.disk.load(async () => {
+      const fingerprint = await this.diskFingerprint();
+      if (this.loaded && fingerprint === this.fingerprint) return null;
+      await ensureProjectsLoaded();
+      const next = await this.readVaults();
+      return () => {
+        this.services = next.services;
+        this.diskForm = next.diskForm;
+        this.roots = next.roots;
+        this.fingerprint = fingerprint;
+        this.loaded = true;
+        if (this.services.size > 0) this.notify();
+      };
+    });
+  }
+  async readVaults() {
+    const services = /* @__PURE__ */ new Map();
+    const diskForm = /* @__PURE__ */ new Map();
+    const roots = /* @__PURE__ */ new Map();
+    for (const root of await allVaultRoots()) {
       try {
         const raw = await readFile3(this.getFilePath(root), "utf-8");
         const data = JSON.parse(raw);
-        const clash = data.find((s) => this.services.has(s.id) && this.roots.get(s.id) !== root);
+        const clash = data.find((s) => services.has(s.id) && roots.get(s.id) !== root);
         if (clash) {
           markVaultConflict(root, `service ${clash.id}`);
           continue;
@@ -1368,17 +1428,17 @@ var ServiceStore = class {
               if (cmd.shell === void 0) cmd.shell = true;
             }
           }
-          this.diskForm.set(s.id, s);
-          this.services.set(s.id, {
+          diskForm.set(s.id, s);
+          services.set(s.id, {
             ...s,
             logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root))
           });
-          this.roots.set(s.id, root);
+          roots.set(s.id, root);
         }
       } catch {
       }
     }
-    if (this.services.size > 0) this.notify();
+    return { services, diskForm, roots };
   }
   /**
    * Write each vault that holds — or held — a service.
@@ -1387,7 +1447,10 @@ var ServiceStore = class {
    * another vault must not survive in the one it left, and a `[]` left behind
    * would keep (or recreate) a `.runeya` in a directory that holds nothing.
    */
-  async save() {
+  save() {
+    return this.disk.save(() => this.writeVaults());
+  }
+  async writeVaults() {
     const byRoot = /* @__PURE__ */ new Map();
     for (const root of this.roots.values()) {
       if (!isVaultConflicted(root)) byRoot.set(root, []);
@@ -1410,11 +1473,7 @@ var ServiceStore = class {
         });
         continue;
       }
-      await mkdir3(root, { recursive: true });
-      const tmpPath = filePath + ".tmp";
-      await writeFile3(tmpPath, JSON.stringify(services, null, 2), "utf-8");
-      await rename3(tmpPath, filePath);
-      await chmod3(filePath, 384);
+      await atomicWriteSecure(filePath, JSON.stringify(services, null, 2));
     }
     this.fingerprint = await this.diskFingerprint();
   }
@@ -1627,7 +1686,7 @@ import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // ../server/src/services/instance-registry.ts
-import { mkdir as mkdir4, readdir, readFile as readFile4, writeFile as writeFile4, rm as rm3 } from "fs/promises";
+import { mkdir as mkdir2, readdir, readFile as readFile4, writeFile as writeFile2, rm as rm3 } from "fs/promises";
 import { readFileSync } from "fs";
 import dotenv from "dotenv";
 import { spawn } from "child_process";
@@ -1724,9 +1783,9 @@ function selfRecord() {
 }
 async function registerInstance() {
   try {
-    await mkdir4(registryDir(), { recursive: true });
+    await mkdir2(registryDir(), { recursive: true });
     published = selfRecord();
-    await writeFile4(fileFor(process.pid), JSON.stringify(published, null, 2));
+    await writeFile2(fileFor(process.pid), JSON.stringify(published, null, 2));
   } catch (err) {
     console.log("[instances] Could not register this instance:", err.message);
   }
@@ -1739,7 +1798,7 @@ async function setInstanceAgentPid(agentPid) {
   if (!published) return;
   published = { ...published, agentPid: agentPid ?? void 0 };
   try {
-    await writeFile4(fileFor(process.pid), JSON.stringify(published, null, 2));
+    await writeFile2(fileFor(process.pid), JSON.stringify(published, null, 2));
   } catch {
   }
 }
@@ -3011,6 +3070,7 @@ export {
   decryptVariableSlots,
   extractEncryptedVariableSlots,
   isEncryptedValue,
+  StoreDiskCoordinator,
   projectKey,
   AmbiguousProjectError,
   registerProjectLoader,
@@ -3035,4 +3095,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-CNTL6NVU.js.map
+//# sourceMappingURL=chunk-XTLQOYLT.js.map