@runeya/runeya 2.0.145 → 2.0.147

package/chunk-4D3GCBPO.js

@@ -0,0 +1,462 @@
+import {
+  StoreDiskCoordinator,
+  decryptValue,
+  ensureProjectsLoaded,
+  environmentStore,
+  getEncryptionKey,
+  isEncryptedValue,
+  isVaultClash,
+  isVaultConflicted,
+  markVaultConflict,
+  recordLocalRemoval,
+  rootOfProjectRef,
+  rootOfService,
+  stableEncryptValue
+} from "./chunk-DFPZ4MTI.js";
+import {
+  atomicWriteSecure,
+  fingerprintFiles
+} from "./chunk-4LJQIQMN.js";
+import {
+  allVaultRoots,
+  localVaultRoot,
+  projectVaultRoot,
+  vaultIdOfRoot
+} from "./chunk-VPSQJOSN.js";
+import {
+  ServiceConfigSchema
+} from "./chunk-MZSDTA4A.js";
+
+// ../server/src/services/service-store.ts
+import { randomUUID } from "crypto";
+import { readFile, rm } from "fs/promises";
+import { join } from "path";
+var FILENAME = "services.json";
+function encryptLogSources(logSources, previous, vault) {
+  return logSources.map((src, i) => {
+    const prev = previous?.[i];
+    if (src.type === "mongo") {
+      if (isEncryptedValue(src.connectionString)) return src;
+      const was = prev?.type === "mongo" ? prev.connectionString : void 0;
+      return { ...src, connectionString: stableEncryptValue(src.connectionString, was, vault) };
+    }
+    if (src.type === "mysql" && src.password) {
+      if (isEncryptedValue(src.password)) return src;
+      const was = prev?.type === "mysql" ? prev.password : void 0;
+      return { ...src, password: stableEncryptValue(src.password, was, vault) };
+    }
+    return src;
+  });
+}
+function decryptLogSources(logSources, vault) {
+  return logSources.map((src) => {
+    if (src.type === "mongo" && isEncryptedValue(src.connectionString)) {
+      try {
+        return { ...src, connectionString: decryptValue(src.connectionString, vault) };
+      } catch {
+        console.error("[service-store] Failed to decrypt mongo connectionString");
+        return src;
+      }
+    }
+    if (src.type === "mysql" && src.password && isEncryptedValue(src.password)) {
+      try {
+        return { ...src, password: decryptValue(src.password, vault) };
+      } catch {
+        console.error("[service-store] Failed to decrypt mysql password");
+        return src;
+      }
+    }
+    return src;
+  });
+}
+function prepareForDisk(service, previous, vault) {
+  return {
+    ...service,
+    env: {},
+    envSecrets: [],
+    resolvedLogParsers: void 0,
+    resolvedCwd: void 0,
+    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources, vault)
+  };
+}
+var ServiceStore = class {
+  services = /* @__PURE__ */ new Map();
+  loaded = false;
+  /**
+   * L'état du disque au dernier chargement — voir `ProjectStore.fingerprint` :
+   * plusieurs Runeya partagent la racine machine, et un store chargé une fois
+   * pour toutes ne verrait jamais les services créés par l'autre.
+   */
+  fingerprint = "";
+  disk = new StoreDiskCoordinator();
+  listeners = /* @__PURE__ */ new Set();
+  /**
+   * Last on-disk (encrypted) form per service id, so `prepareForDisk` can reuse
+   * existing ciphertext instead of re-encrypting unchanged credentials.
+   */
+  diskForm = /* @__PURE__ */ new Map();
+  onChange(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  notify() {
+    for (const fn of this.listeners) fn();
+  }
+  /** Which vault each service was read from, used until its project is known. */
+  roots = /* @__PURE__ */ new Map();
+  /**
+   * L'organisation d'où vient un service reçu du cloud.
+   *
+   * Le coffre ne peut pas encore répondre : les contenus arrivent avant leur
+   * projet, donc `rootFor` désignerait le répertoire de lancement et
+   * chiffrerait les secrets de l'organisation avec la clé de la machine. Cette
+   * provenance tient le temps que le projet devienne local — après quoi elle
+   * dit la même chose que le coffre.
+   */
+  remoteOrgs = /* @__PURE__ */ new Map();
+  /**
+   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
+   *
+   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
+   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
+   * qui n'existe plus. La laisser en place n'affichait pas seulement des
+   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
+   * par-dessus le nouveau, et défaisait l'adoption.
+   */
+  resetCache() {
+    this.services.clear();
+    this.diskForm.clear();
+    this.roots.clear();
+    this.remoteOrgs.clear();
+    this.loaded = false;
+    this.notify();
+  }
+  getFilePath(root) {
+    return join(root, FILENAME);
+  }
+  /**
+   * The vault a service must be written to: the one of the project owning it.
+   *
+   * A service carries no project id — ownership lives in `project.serviceIds` —
+   * so the registry answers, falling back to where the service was read and
+   * finally to the local vault.
+   */
+  /** La clé sous laquelle chiffrer ce service : son organisation, ou son coffre. */
+  vaultOf(serviceId) {
+    return this.remoteOrgs.get(serviceId) ?? vaultIdOfRoot(this.rootFor(serviceId));
+  }
+  rootFor(serviceId) {
+    return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();
+  }
+  /** Ce que le disque porte : un fichier de services par coffre. */
+  async diskFingerprint() {
+    return fingerprintFiles((await allVaultRoots()).map((root) => this.getFilePath(root)));
+  }
+  /**
+   * Read every vault: the launch directory and each materialized cloud project.
+   *
+   * Roots come from the disk, not from the project store, so services load
+   * without waiting on projects.
+   */
+  async load() {
+    if (!getEncryptionKey()) return;
+    await this.disk.load(async () => {
+      const fingerprint = await this.diskFingerprint();
+      if (this.loaded && fingerprint === this.fingerprint) return null;
+      await ensureProjectsLoaded();
+      const next = await this.readVaults();
+      return () => {
+        this.services = next.services;
+        this.diskForm = next.diskForm;
+        this.roots = next.roots;
+        this.fingerprint = fingerprint;
+        this.loaded = true;
+        if (this.services.size > 0) this.notify();
+      };
+    });
+  }
+  async readVaults() {
+    const services = /* @__PURE__ */ new Map();
+    const diskForm = /* @__PURE__ */ new Map();
+    const roots = /* @__PURE__ */ new Map();
+    for (const root of await allVaultRoots()) {
+      try {
+        const raw = await readFile(this.getFilePath(root), "utf-8");
+        const data = JSON.parse(raw);
+        const clash = data.find((s) => isVaultClash(root, roots.get(s.id)));
+        if (clash) {
+          markVaultConflict(root, `service ${clash.id}`);
+          continue;
+        }
+        for (const s of data) {
+          if (s.commands) {
+            for (const cmd of s.commands) {
+              if (cmd.shell === void 0) cmd.shell = true;
+            }
+          }
+          diskForm.set(s.id, s);
+          services.set(s.id, {
+            ...s,
+            logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root))
+          });
+          roots.set(s.id, root);
+        }
+      } catch {
+      }
+    }
+    return { services, diskForm, roots };
+  }
+  /**
+   * Write each vault that holds — or held — a service.
+   *
+   * A vault emptied by this save loses its file: a service that moved to
+   * another vault must not survive in the one it left, and a `[]` left behind
+   * would keep (or recreate) a `.runeya` in a directory that holds nothing.
+   */
+  save() {
+    return this.disk.save(() => this.writeVaults());
+  }
+  async writeVaults() {
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) {
+      if (!isVaultConflicted(root)) byRoot.set(root, []);
+    }
+    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
+    for (const service of this.services.values()) {
+      const root = this.rootFor(service.id);
+      const prepared = prepareForDisk(service, this.diskForm.get(service.id), this.vaultOf(service.id));
+      this.diskForm.set(prepared.id, prepared);
+      this.roots.set(service.id, root);
+      if (isVaultConflicted(root)) continue;
+      const bucket = byRoot.get(root);
+      if (bucket) bucket.push(prepared);
+      else byRoot.set(root, [prepared]);
+    }
+    for (const [root, services] of byRoot) {
+      const filePath = this.getFilePath(root);
+      if (services.length === 0) {
+        await rm(filePath, { force: true }).catch(() => {
+        });
+        continue;
+      }
+      await atomicWriteSecure(filePath, JSON.stringify(services, null, 2));
+    }
+    this.fingerprint = await this.diskFingerprint();
+  }
+  /**
+   * Drop services from memory, without touching the disk.
+   *
+   * Used when their project stops being followed: its vault goes away whole,
+   * and services left in memory would be written back on the next save — into
+   * the local vault, since their owner is no longer known.
+   */
+  async forgetLocally(serviceIds) {
+    await this.load();
+    for (const id of serviceIds) {
+      this.services.delete(id);
+      this.diskForm.delete(id);
+      this.roots.delete(id);
+      this.remoteOrgs.delete(id);
+    }
+    this.notify();
+  }
+  /**
+   * Rewrite every vault, moving entities that now belong elsewhere.
+   *
+   * Called once the project store knows where projects live: entities read from
+   * the launch directory whose project turns out to be a cloud one are written
+   * into that project's vault, and disappear from the directory they came from.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
+  }
+  /**
+   * Réattribuer l'organisation de services dont le projet vient de changer de
+   * coffre.
+   *
+   * Un service porte son `orgId` en propre : laissé à `null` après le passage
+   * du projet dans une organisation, il partirait dans le doc en se disant
+   * local. La sauvegarde qui suit les écrit dans leur nouveau coffre et les
+   * retire de l'ancien, le registre ayant déjà été mis à jour par le projet.
+   */
+  async reassignOrg(serviceIds, orgId) {
+    await this.load();
+    for (const id of serviceIds) {
+      const service = this.services.get(id);
+      if (service) this.services.set(id, { ...service, orgId });
+    }
+    await this.save();
+    this.notify();
+  }
+  async list() {
+    await this.load();
+    return Array.from(this.services.values());
+  }
+  async get(id) {
+    await this.load();
+    return this.services.get(id) ?? null;
+  }
+  /**
+   * Service in its on-disk (sanitized) form: transient runtime env and plaintext
+   * secrets stripped. Used when exporting a project to the cloud so that no
+   * secret ever leaves the machine.
+   */
+  async getSanitized(id) {
+    await this.load();
+    const service = this.services.get(id);
+    return service ? prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)) : null;
+  }
+  /**
+   * `project` : le projet qui va l'adopter, quand on le connaît. Le service est
+   * alors écrit d'emblée dans son coffre — sans lui, il naissait dans le coffre
+   * de lancement et y laissait une copie une fois rattaché.
+   */
+  async create(input, project) {
+    await this.load();
+    const service = {
+      id: randomUUID(),
+      orgId: input.orgId ?? null,
+      agentId: input.agentId,
+      name: input.name,
+      commands: input.commands ?? [],
+      cwd: input.cwd,
+      ports: input.ports ?? [],
+      groups: input.groups ?? [],
+      description: input.description,
+      docsPath: input.docsPath,
+      url: input.url,
+      localUrls: input.localUrls ?? [],
+      openapiUrl: input.openapiUrl,
+      git: input.git,
+      meta: input.meta,
+      env: {},
+      envSecrets: [],
+      runner: input.runner ?? "native",
+      dockerConfig: input.dockerConfig,
+      healthCheck: input.healthCheck,
+      parserIds: input.parserIds ?? [],
+      shortcuts: input.shortcuts ?? [],
+      logSources: input.logSources ?? [],
+      autoRestart: input.autoRestart ?? false,
+      restartBackoffMs: input.restartBackoffMs ?? 1e3,
+      ...input.restartStrategy !== void 0 && { restartStrategy: input.restartStrategy },
+      ...input.maxRestarts !== void 0 && { maxRestarts: input.maxRestarts },
+      clearLogsOnStart: input.clearLogsOnStart ?? false
+    };
+    this.services.set(service.id, service);
+    if (project) this.roots.set(service.id, rootOfProjectRef(project));
+    await this.save();
+    this.notify();
+    return service;
+  }
+  async update(input) {
+    await this.load();
+    const existing = this.services.get(input.id);
+    if (!existing) return null;
+    const updated = {
+      ...existing,
+      ...input.agentId !== void 0 && { agentId: input.agentId ?? void 0 },
+      ...input.name !== void 0 && { name: input.name },
+      ...input.commands !== void 0 && { commands: input.commands },
+      ...input.cwd !== void 0 && { cwd: input.cwd ?? void 0 },
+      ...input.ports !== void 0 && { ports: input.ports },
+      ...input.groups !== void 0 && { groups: input.groups },
+      ...input.description !== void 0 && { description: input.description },
+      ...input.docsPath !== void 0 && { docsPath: input.docsPath },
+      ...input.url !== void 0 && { url: input.url },
+      ...input.localUrls !== void 0 && { localUrls: input.localUrls },
+      ...input.openapiUrl !== void 0 && { openapiUrl: input.openapiUrl },
+      ...input.git !== void 0 && { git: input.git ?? void 0 },
+      ...input.meta !== void 0 && { meta: input.meta ?? void 0 },
+      ...input.runner !== void 0 && { runner: input.runner },
+      ...input.dockerConfig !== void 0 && { dockerConfig: input.dockerConfig },
+      ...input.healthCheck !== void 0 && { healthCheck: input.healthCheck ?? void 0 },
+      ...input.autoRestart !== void 0 && { autoRestart: input.autoRestart },
+      ...input.clearLogsOnStart !== void 0 && { clearLogsOnStart: input.clearLogsOnStart },
+      ...input.restartBackoffMs !== void 0 && { restartBackoffMs: input.restartBackoffMs },
+      ...input.restartStrategy !== void 0 && { restartStrategy: input.restartStrategy },
+      ...input.maxRestarts !== void 0 && { maxRestarts: input.maxRestarts },
+      ...input.orgId !== void 0 && { orgId: input.orgId },
+      ...input.shortcuts !== void 0 && { shortcuts: input.shortcuts },
+      ...input.parserIds !== void 0 && { parserIds: input.parserIds },
+      ...input.logSources !== void 0 && { logSources: input.logSources }
+    };
+    this.services.set(input.id, updated);
+    await this.save();
+    this.notify();
+    return updated;
+  }
+  async delete(id) {
+    await this.load();
+    if (!this.services.has(id)) return false;
+    this.services.delete(id);
+    recordLocalRemoval("services", id);
+    await this.save();
+    this.notify();
+    await environmentStore.deleteByReference(id);
+    return true;
+  }
+  // ---- Cloud sync ------------------------------------------------------
+  /** The services of a project, in their on-disk form (what the cloud mirrors). */
+  async listSanitizedByIds(ids) {
+    await this.load();
+    const out = [];
+    for (const id of ids) {
+      const service = this.services.get(id);
+      if (service) out.push(prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)));
+    }
+    return out;
+  }
+  /**
+   * Apply a service received from the cloud, in its on-disk form.
+   *
+   * Validated rather than trusted: a peer running a different version — or a
+   * tampered doc — must not be able to write arbitrary shapes into
+   * `services.json`. Diff-guarded against the on-disk form so re-applying an
+   * identical service neither saves nor notifies (loop-safe).
+   */
+  async applyRemoteUpsert(id, fields, vault, projectId) {
+    await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
+    if (vault && projectId && !this.roots.has(id)) this.roots.set(id, projectVaultRoot(vault, projectId));
+    const parsed = ServiceConfigSchema.safeParse({ ...fields, id });
+    if (!parsed.success) {
+      console.error("[service-store] Rejected remote service %s:", id, parsed.error.message);
+      return { created: false };
+    }
+    const incoming = parsed.data;
+    const existing = this.services.get(id);
+    if (existing) {
+      const currentDisk = prepareForDisk(existing, this.diskForm.get(id), vault ?? this.vaultOf(id));
+      if (JSON.stringify(currentDisk) === JSON.stringify(incoming)) return { created: false };
+    }
+    this.diskForm.set(id, incoming);
+    this.services.set(id, {
+      ...incoming,
+      // The doc carries the on-disk form, where credentials are ciphertext;
+      // in memory they are expected in the clear, as `load()` keeps them.
+      logSources: decryptLogSources(incoming.logSources ?? [], vault ?? this.vaultOf(id))
+    });
+    await this.save();
+    this.notify();
+    return { created: !existing };
+  }
+  /** Delete a service that was removed on another peer. */
+  async applyRemoteDelete(id) {
+    await this.load();
+    if (!this.services.has(id)) return false;
+    this.services.delete(id);
+    this.diskForm.delete(id);
+    await this.save();
+    this.notify();
+    await environmentStore.deleteByReference(id);
+    return true;
+  }
+};
+var serviceStore = new ServiceStore();
+
+export {
+  serviceStore
+};
+//# sourceMappingURL=chunk-4D3GCBPO.js.map

package/chunk-4D3GCBPO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../server/src/services/service-store.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { readFile, rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { getEncryptionKey } from '../utils/encryption-key.js';\nimport { allVaultRoots, localVaultRoot , vaultIdOfRoot, projectVaultRoot } from './vault-resolver.js';\nimport { rootOfService, rootOfProjectRef, ensureProjectsLoaded } from './vault-registry.js';\nimport type { ProjectRef } from './project-key.js';\nimport { recordLocalRemoval } from './local-removals.js';\nimport { markVaultConflict, isVaultConflicted, isVaultClash } from './vault-conflicts.js';\nimport { fingerprintFiles } from './disk-freshness.js';\nimport { atomicWriteSecure } from './run-store-utils.js';\nimport { StoreDiskCoordinator } from './store-disk-coordinator.js';\nimport { environmentStore } from './environment-store.js';\nimport { stableEncryptValue, decryptValue, isEncryptedValue } from './crypto-helpers.js';\nimport { ServiceConfigSchema } from '@runeya/packages-shared';\nimport type { ServiceConfig, CreateService, UpdateService, LogSourceConfig } from '@runeya/packages-shared';\n\nconst FILENAME = 'services.json';\n\n/**\n * Encrypt sensitive log source credentials before writing to disk.\n *\n * `previous` is the last ciphertext written for the same sources: reusing it\n * when the plaintext is unchanged keeps the output byte-stable. Without it,\n * every save re-encrypts with a fresh IV, so an untouched service still looks\n * modified — which shows up as phantom git diffs, and as an endless sync loop\n * once the file is mirrored into a CRDT (each side keeps \"changing\" it).\n */\nfunction encryptLogSources(\n  logSources: LogSourceConfig[],\n  previous?: LogSourceConfig[],\n  vault?: string,\n): LogSourceConfig[] {\n  return logSources.map((src, i) => {\n    const prev = previous?.[i];\n    // Une valeur encore chiffrée est une valeur que le déchiffrement n'a pas su\n    // ouvrir — clé absente, ou coffre lu sous une autre. La re-chiffrer\n    // produirait un chiffré de chiffré, et la seule copie lisible serait\n    // perdue : on la laisse telle quelle sur le disque.\n    if (src.type === 'mongo') {\n      if (isEncryptedValue(src.connectionString)) return src;\n      const was = prev?.type === 'mongo' ? prev.connectionString : undefined;\n      return { ...src, connectionString: stableEncryptValue(src.connectionString, was, vault) };\n    }\n    if (src.type === 'mysql' && src.password) {\n      if (isEncryptedValue(src.password)) return src;\n      const was = prev?.type === 'mysql' ? prev.password : undefined;\n      return { ...src, password: stableEncryptValue(src.password, was, vault) };\n    }\n    return src;\n  });\n}\n\n/** Decrypt sensitive log source credentials after reading from disk. */\nfunction decryptLogSources(logSources: LogSourceConfig[], vault?: string): LogSourceConfig[] {\n  return logSources.map((src) => {\n    if (src.type === 'mongo' && isEncryptedValue(src.connectionString)) {\n      try {\n        return { ...src, connectionString: decryptValue(src.connectionString, vault) };\n      } catch {\n        console.error('[service-store] Failed to decrypt mongo connectionString');\n        return src;\n      }\n    }\n    if (src.type === 'mysql' && src.password && isEncryptedValue(src.password)) {\n      try {\n        return { ...src, password: decryptValue(src.password, vault) };\n      } catch {\n        console.error('[service-store] Failed to decrypt mysql password');\n        return src;\n      }\n    }\n    return src;\n  });\n}\n\n/**\n * Prepare service for disk: strip transient env/envSecrets/resolvedLogParsers\n * fields and encrypt log source credentials. `previous` is the service's last\n * on-disk form, so unchanged credentials keep their existing ciphertext.\n */\nfunction prepareForDisk(service: ServiceConfig, previous?: ServiceConfig, vault?: string): ServiceConfig {\n  return {\n    ...service,\n    env: {},\n    envSecrets: [],\n    resolvedLogParsers: undefined,\n    resolvedCwd: undefined,\n    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources, vault),\n  };\n}\n\ntype ChangeListener = () => void;\n\nclass ServiceStore {\n  private services: Map<string, ServiceConfig> = new Map();\n  private loaded = false;\n  /**\n   * L'état du disque au dernier chargement — voir `ProjectStore.fingerprint` :\n   * plusieurs Runeya partagent la racine machine, et un store chargé une fois\n   * pour toutes ne verrait jamais les services créés par l'autre.\n   */\n  private fingerprint = '';\n  private readonly disk = new StoreDiskCoordinator();\n  private listeners: Set<ChangeListener> = new Set();\n  /**\n   * Last on-disk (encrypted) form per service id, so `prepareForDisk` can reuse\n   * existing ciphertext instead of re-encrypting unchanged credentials.\n   */\n  private diskForm: Map<string, ServiceConfig> = new Map();\n\n  onChange(fn: ChangeListener): () => void {\n    this.listeners.add(fn);\n    return () => this.listeners.delete(fn);\n  }\n\n  private notify(): void {\n    for (const fn of this.listeners) fn();\n  }\n\n  /** Which vault each service was read from, used until its project is known. */\n  private roots: Map<string, string> = new Map();\n  /**\n   * L'organisation d'où vient un service reçu du cloud.\n   *\n   * Le coffre ne peut pas encore répondre : les contenus arrivent avant leur\n   * projet, donc `rootFor` désignerait le répertoire de lancement et\n   * chiffrerait les secrets de l'organisation avec la clé de la machine. Cette\n   * provenance tient le temps que le projet devienne local — après quoi elle\n   * dit la même chose que le coffre.\n   */\n  private remoteOrgs: Map<string, string> = new Map();\n\n  /**\n   * Oublier ce qui a été lu, pour tout relire sous la clé courante.\n   *\n   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être\n   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état\n   * qui n'existe plus. La laisser en place n'affichait pas seulement des\n   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré\n   * par-dessus le nouveau, et défaisait l'adoption.\n   */\n  resetCache(): void {\n    this.services.clear();\n    this.diskForm.clear();\n    this.roots.clear();\n    this.remoteOrgs.clear();\n    this.loaded = false;\n    // Les clients abonnés tiennent l'ancienne liste : sans ce signal, l'écran\n    // ne se corrigerait qu'au prochain appel qu'il ferait de lui-même.\n    this.notify();\n  }\n\n  private getFilePath(root: string): string {\n    return join(root, FILENAME);\n  }\n\n  /**\n   * The vault a service must be written to: the one of the project owning it.\n   *\n   * A service carries no project id — ownership lives in `project.serviceIds` —\n   * so the registry answers, falling back to where the service was read and\n   * finally to the local vault.\n   */\n  /** La clé sous laquelle chiffrer ce service : son organisation, ou son coffre. */\n  private vaultOf(serviceId: string): string | undefined {\n    return this.remoteOrgs.get(serviceId) ?? vaultIdOfRoot(this.rootFor(serviceId));\n  }\n\n  private rootFor(serviceId: string): string {\n    // La provenance sert d'arbitre quand deux projets revendiquent le service.\n    return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();\n  }\n\n  /** Ce que le disque porte : un fichier de services par coffre. */\n  private async diskFingerprint(): Promise<string> {\n    return fingerprintFiles((await allVaultRoots()).map((root) => this.getFilePath(root)));\n  }\n\n  /**\n   * Read every vault: the launch directory and each materialized cloud project.\n   *\n   * Roots come from the disk, not from the project store, so services load\n   * without waiting on projects.\n   */\n  private async load(): Promise<void> {\n    if (!getEncryptionKey()) return;\n    await this.disk.load(async () => {\n      const fingerprint = await this.diskFingerprint();\n      if (this.loaded && fingerprint === this.fingerprint) return null;\n      // Les projets d'abord : tant qu'ils sont inconnus, tout se résoudrait vers\n      // le coffre de lancement et y serait réécrit à la première sauvegarde —\n      // hors de l'organisation propriétaire.\n      await ensureProjectsLoaded();\n      const next = await this.readVaults();\n      return () => {\n        this.services = next.services;\n        this.diskForm = next.diskForm;\n        this.roots = next.roots;\n        this.fingerprint = fingerprint;\n        this.loaded = true;\n        if (this.services.size > 0) this.notify();\n      };\n    });\n  }\n\n  private async readVaults(): Promise<{\n    services: Map<string, ServiceConfig>;\n    diskForm: Map<string, ServiceConfig>;\n    roots: Map<string, string>;\n  }> {\n    const services = new Map<string, ServiceConfig>();\n    const diskForm = new Map<string, ServiceConfig>();\n    const roots = new Map<string, string>();\n    for (const root of await allVaultRoots()) {\n      try {\n        const raw = await readFile(this.getFilePath(root), 'utf-8');\n        const data: ServiceConfig[] = JSON.parse(raw);\n        // Un coffre qui rapporte un service déjà tenu par un autre est une\n        // copie du même projet dans une seconde organisation : on garde le\n        // premier et on laisse le second intact plutôt que de l'écraser.\n        const clash = data.find((s) => isVaultClash(root, roots.get(s.id)));\n        if (clash) {\n          markVaultConflict(root, `service ${clash.id}`);\n          continue;\n        }\n        for (const s of data) {\n          // Ensure shell defaults to true for legacy commands stored without it\n          if (s.commands) {\n            for (const cmd of s.commands) {\n              if (cmd.shell === undefined) cmd.shell = true;\n            }\n          }\n          diskForm.set(s.id, s);\n          services.set(s.id, {\n            ...s,\n            logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root)),\n          });\n          roots.set(s.id, root);\n        }\n      } catch {\n        // No services in this vault yet.\n      }\n    }\n    return { services, diskForm, roots };\n  }\n\n  /**\n   * Write each vault that holds — or held — a service.\n   *\n   * A vault emptied by this save loses its file: a service that moved to\n   * another vault must not survive in the one it left, and a `[]` left behind\n   * would keep (or recreate) a `.runeya` in a directory that holds nothing.\n   */\n  private save(): Promise<void> {\n    return this.disk.save(() => this.writeVaults());\n  }\n\n  private async writeVaults(): Promise<void> {\n    const byRoot = new Map<string, ServiceConfig[]>();\n    for (const root of this.roots.values()) {\n      if (!isVaultConflicted(root)) byRoot.set(root, []);\n    }\n    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);\n\n    for (const service of this.services.values()) {\n      const root = this.rootFor(service.id);\n      // Le coffre décide de la clé : un service d'organisation est chiffré par\n      // la sienne, pas par celle de la machine.\n      const prepared = prepareForDisk(service, this.diskForm.get(service.id), this.vaultOf(service.id));\n      this.diskForm.set(prepared.id, prepared);\n      this.roots.set(service.id, root);\n      if (isVaultConflicted(root)) continue;\n      const bucket = byRoot.get(root);\n      if (bucket) bucket.push(prepared);\n      else byRoot.set(root, [prepared]);\n    }\n\n    for (const [root, services] of byRoot) {\n      const filePath = this.getFilePath(root);\n      if (services.length === 0) {\n        // Un coffre vidé perd son fichier plutôt que d'en garder une liste\n        // vide. Écrire `[]` recréait un `.runeya` dans le dépôt de lancement\n        // alors que tous les projets vivent désormais dans le cloud — un\n        // fichier fantôme qui apparaissait dans le git status de l'utilisateur.\n        await rm(filePath, { force: true }).catch(() => {});\n        continue;\n      }\n      await atomicWriteSecure(filePath, JSON.stringify(services, null, 2));\n    }\n\n    // Nos propres écritures deviennent la référence : sans ça, le chargement\n    // suivant les prendrait pour celles d'une autre instance et relirait tout.\n    this.fingerprint = await this.diskFingerprint();\n  }\n\n  /**\n   * Drop services from memory, without touching the disk.\n   *\n   * Used when their project stops being followed: its vault goes away whole,\n   * and services left in memory would be written back on the next save — into\n   * the local vault, since their owner is no longer known.\n   */\n  async forgetLocally(serviceIds: string[]): Promise<void> {\n    await this.load();\n    for (const id of serviceIds) {\n      this.services.delete(id);\n      this.diskForm.delete(id);\n      this.roots.delete(id);\n      this.remoteOrgs.delete(id);\n    }\n    this.notify();\n  }\n\n  /**\n   * Rewrite every vault, moving entities that now belong elsewhere.\n   *\n   * Called once the project store knows where projects live: entities read from\n   * the launch directory whose project turns out to be a cloud one are written\n   * into that project's vault, and disappear from the directory they came from.\n   */\n  async relocateAll(): Promise<void> {\n    await this.load();\n    await this.save();\n  }\n\n  /**\n   * Réattribuer l'organisation de services dont le projet vient de changer de\n   * coffre.\n   *\n   * Un service porte son `orgId` en propre : laissé à `null` après le passage\n   * du projet dans une organisation, il partirait dans le doc en se disant\n   * local. La sauvegarde qui suit les écrit dans leur nouveau coffre et les\n   * retire de l'ancien, le registre ayant déjà été mis à jour par le projet.\n   */\n  async reassignOrg(serviceIds: string[], orgId: string | null): Promise<void> {\n    await this.load();\n    for (const id of serviceIds) {\n      const service = this.services.get(id);\n      if (service) this.services.set(id, { ...service, orgId });\n    }\n    await this.save();\n    this.notify();\n  }\n\n  async list(): Promise<ServiceConfig[]> {\n    await this.load();\n    return Array.from(this.services.values());\n  }\n\n  async get(id: string): Promise<ServiceConfig | null> {\n    await this.load();\n    return this.services.get(id) ?? null;\n  }\n\n  /**\n   * Service in its on-disk (sanitized) form: transient runtime env and plaintext\n   * secrets stripped. Used when exporting a project to the cloud so that no\n   * secret ever leaves the machine.\n   */\n  async getSanitized(id: string): Promise<ServiceConfig | null> {\n    await this.load();\n    const service = this.services.get(id);\n    return service ? prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)) : null;\n  }\n\n  /**\n   * `project` : le projet qui va l'adopter, quand on le connaît. Le service est\n   * alors écrit d'emblée dans son coffre — sans lui, il naissait dans le coffre\n   * de lancement et y laissait une copie une fois rattaché.\n   */\n  async create(input: CreateService, project?: ProjectRef): Promise<ServiceConfig> {\n    await this.load();\n    const service: ServiceConfig = {\n      id: randomUUID(),\n      orgId: input.orgId ?? null,\n      agentId: input.agentId,\n      name: input.name,\n      commands: input.commands ?? [],\n      cwd: input.cwd,\n      ports: input.ports ?? [],\n      groups: input.groups ?? [],\n      description: input.description,\n      docsPath: input.docsPath,\n      url: input.url,\n      localUrls: input.localUrls ?? [],\n      openapiUrl: input.openapiUrl,\n      git: input.git,\n      meta: input.meta,\n      env: {},\n      envSecrets: [],\n      runner: input.runner ?? 'native',\n      dockerConfig: input.dockerConfig,\n      healthCheck: input.healthCheck,\n      parserIds: input.parserIds ?? [],\n      shortcuts: input.shortcuts ?? [],\n      logSources: input.logSources ?? [],\n      autoRestart: input.autoRestart ?? false,\n      restartBackoffMs: input.restartBackoffMs ?? 1000,\n      ...(input.restartStrategy !== undefined && { restartStrategy: input.restartStrategy }),\n      ...(input.maxRestarts !== undefined && { maxRestarts: input.maxRestarts }),\n      clearLogsOnStart: input.clearLogsOnStart ?? false,\n    };\n    this.services.set(service.id, service);\n    // Provenance donnée d'avance : `rootFor` s'y range tant qu'aucun projet ne\n    // revendique encore le service.\n    if (project) this.roots.set(service.id, rootOfProjectRef(project));\n    await this.save();\n    this.notify();\n    return service;\n  }\n\n  async update(input: UpdateService): Promise<ServiceConfig | null> {\n    await this.load();\n    const existing = this.services.get(input.id);\n    if (!existing) return null;\n    const updated: ServiceConfig = {\n      ...existing,\n      ...(input.agentId !== undefined && { agentId: input.agentId ?? undefined }),\n      ...(input.name !== undefined && { name: input.name }),\n      ...(input.commands !== undefined && { commands: input.commands }),\n      ...(input.cwd !== undefined && { cwd: input.cwd ?? undefined }),\n      ...(input.ports !== undefined && { ports: input.ports }),\n      ...(input.groups !== undefined && { groups: input.groups }),\n      ...(input.description !== undefined && { description: input.description }),\n      ...(input.docsPath !== undefined && { docsPath: input.docsPath }),\n      ...(input.url !== undefined && { url: input.url }),\n      ...(input.localUrls !== undefined && { localUrls: input.localUrls }),\n      ...(input.openapiUrl !== undefined && { openapiUrl: input.openapiUrl }),\n      ...(input.git !== undefined && { git: input.git ?? undefined }),\n      ...(input.meta !== undefined && { meta: input.meta ?? undefined }),\n      ...(input.runner !== undefined && { runner: input.runner }),\n      ...(input.dockerConfig !== undefined && { dockerConfig: input.dockerConfig }),\n      ...(input.healthCheck !== undefined && { healthCheck: input.healthCheck ?? undefined }),\n      ...(input.autoRestart !== undefined && { autoRestart: input.autoRestart }),\n      ...(input.clearLogsOnStart !== undefined && { clearLogsOnStart: input.clearLogsOnStart }),\n      ...(input.restartBackoffMs !== undefined && { restartBackoffMs: input.restartBackoffMs }),\n      ...(input.restartStrategy !== undefined && { restartStrategy: input.restartStrategy }),\n      ...(input.maxRestarts !== undefined && { maxRestarts: input.maxRestarts }),\n      ...(input.orgId !== undefined && { orgId: input.orgId }),\n      ...(input.shortcuts !== undefined && { shortcuts: input.shortcuts }),\n      ...(input.parserIds !== undefined && { parserIds: input.parserIds }),\n      ...(input.logSources !== undefined && { logSources: input.logSources }),\n    };\n    this.services.set(input.id, updated);\n    await this.save();\n    this.notify();\n    return updated;\n  }\n\n  async delete(id: string): Promise<boolean> {\n    await this.load();\n    if (!this.services.has(id)) return false;\n    this.services.delete(id);\n    recordLocalRemoval('services', id);\n    await this.save();\n    this.notify();\n    // Clean up service-scoped environments\n    await environmentStore.deleteByReference(id);\n    return true;\n  }\n\n  // ---- Cloud sync ------------------------------------------------------\n\n  /** The services of a project, in their on-disk form (what the cloud mirrors). */\n  async listSanitizedByIds(ids: string[]): Promise<ServiceConfig[]> {\n    await this.load();\n    const out: ServiceConfig[] = [];\n    for (const id of ids) {\n      const service = this.services.get(id);\n      if (service) out.push(prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)));\n    }\n    return out;\n  }\n\n  /**\n   * Apply a service received from the cloud, in its on-disk form.\n   *\n   * Validated rather than trusted: a peer running a different version — or a\n   * tampered doc — must not be able to write arbitrary shapes into\n   * `services.json`. Diff-guarded against the on-disk form so re-applying an\n   * identical service neither saves nor notifies (loop-safe).\n   */\n  async applyRemoteUpsert(\n    id: string, fields: unknown, vault?: string, projectId?: string,\n  ): Promise<{ created: boolean }> {\n    await this.load();\n    // Retenue avant tout : la sauvegarde qui suit doit chiffrer sous la même\n    // clé que celle qui vient d'ouvrir, pas sous celle du coffre de repli.\n    if (vault) this.remoteOrgs.set(id, vault);\n    // Le projet que le doc lui donne, quand il arrive avant ce projet : sans\n    // cette provenance, le service atterrissait dans le coffre de lancement et\n    // y restait en double une fois le projet arrivé.\n    if (vault && projectId && !this.roots.has(id)) this.roots.set(id, projectVaultRoot(vault, projectId));\n    const parsed = ServiceConfigSchema.safeParse({ ...(fields as object), id });\n    if (!parsed.success) {\n      console.error('[service-store] Rejected remote service %s:', id, parsed.error.message);\n      return { created: false };\n    }\n    const incoming = parsed.data;\n    const existing = this.services.get(id);\n    if (existing) {\n      const currentDisk = prepareForDisk(existing, this.diskForm.get(id), vault ?? this.vaultOf(id));\n      if (JSON.stringify(currentDisk) === JSON.stringify(incoming)) return { created: false };\n    }\n    this.diskForm.set(id, incoming);\n    this.services.set(id, {\n      ...incoming,\n      // The doc carries the on-disk form, where credentials are ciphertext;\n      // in memory they are expected in the clear, as `load()` keeps them.\n      logSources: decryptLogSources(incoming.logSources ?? [], vault ?? this.vaultOf(id)),\n    });\n    await this.save();\n    this.notify();\n    return { created: !existing };\n  }\n\n  /** Delete a service that was removed on another peer. */\n  async applyRemoteDelete(id: string): Promise<boolean> {\n    await this.load();\n    if (!this.services.has(id)) return false;\n    this.services.delete(id);\n    this.diskForm.delete(id);\n    await this.save();\n    this.notify();\n    await environmentStore.deleteByReference(id);\n    return true;\n  }\n}\n\nexport const serviceStore = new ServiceStore();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,UAAU,UAAU;AAC7B,SAAS,YAAY;AAerB,IAAM,WAAW;AAWjB,SAAS,kBACP,YACA,UACA,OACmB;AACnB,SAAO,WAAW,IAAI,CAAC,KAAK,MAAM;AAChC,UAAM,OAAO,WAAW,CAAC;AAKzB,QAAI,IAAI,SAAS,SAAS;AACxB,UAAI,iBAAiB,IAAI,gBAAgB,EAAG,QAAO;AACnD,YAAM,MAAM,MAAM,SAAS,UAAU,KAAK,mBAAmB;AAC7D,aAAO,EAAE,GAAG,KAAK,kBAAkB,mBAAmB,IAAI,kBAAkB,KAAK,KAAK,EAAE;AAAA,IAC1F;AACA,QAAI,IAAI,SAAS,WAAW,IAAI,UAAU;AACxC,UAAI,iBAAiB,IAAI,QAAQ,EAAG,QAAO;AAC3C,YAAM,MAAM,MAAM,SAAS,UAAU,KAAK,WAAW;AACrD,aAAO,EAAE,GAAG,KAAK,UAAU,mBAAmB,IAAI,UAAU,KAAK,KAAK,EAAE;AAAA,IAC1E;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGA,SAAS,kBAAkB,YAA+B,OAAmC;AAC3F,SAAO,WAAW,IAAI,CAAC,QAAQ;AAC7B,QAAI,IAAI,SAAS,WAAW,iBAAiB,IAAI,gBAAgB,GAAG;AAClE,UAAI;AACF,eAAO,EAAE,GAAG,KAAK,kBAAkB,aAAa,IAAI,kBAAkB,KAAK,EAAE;AAAA,MAC/E,QAAQ;AACN,gBAAQ,MAAM,0DAA0D;AACxE,eAAO;AAAA,MACT;AAAA,IACF;AACA,QAAI,IAAI,SAAS,WAAW,IAAI,YAAY,iBAAiB,IAAI,QAAQ,GAAG;AAC1E,UAAI;AACF,eAAO,EAAE,GAAG,KAAK,UAAU,aAAa,IAAI,UAAU,KAAK,EAAE;AAAA,MAC/D,QAAQ;AACN,gBAAQ,MAAM,kDAAkD;AAChE,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAOA,SAAS,eAAe,SAAwB,UAA0B,OAA+B;AACvG,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,CAAC;AAAA,IACN,YAAY,CAAC;AAAA,IACb,oBAAoB;AAAA,IACpB,aAAa;AAAA,IACb,YAAY,kBAAkB,QAAQ,cAAc,CAAC,GAAG,UAAU,YAAY,KAAK;AAAA,EACrF;AACF;AAIA,IAAM,eAAN,MAAmB;AAAA,EACT,WAAuC,oBAAI,IAAI;AAAA,EAC/C,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMT,cAAc;AAAA,EACL,OAAO,IAAI,qBAAqB;AAAA,EACzC,YAAiC,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKzC,WAAuC,oBAAI,IAAI;AAAA,EAEvD,SAAS,IAAgC;AACvC,SAAK,UAAU,IAAI,EAAE;AACrB,WAAO,MAAM,KAAK,UAAU,OAAO,EAAE;AAAA,EACvC;AAAA,EAEQ,SAAe;AACrB,eAAW,MAAM,KAAK,UAAW,IAAG;AAAA,EACtC;AAAA;AAAA,EAGQ,QAA6B,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUrC,aAAkC,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlD,aAAmB;AACjB,SAAK,SAAS,MAAM;AACpB,SAAK,SAAS,MAAM;AACpB,SAAK,MAAM,MAAM;AACjB,SAAK,WAAW,MAAM;AACtB,SAAK,SAAS;AAGd,SAAK,OAAO;AAAA,EACd;AAAA,EAEQ,YAAY,MAAsB;AACxC,WAAO,KAAK,MAAM,QAAQ;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,QAAQ,WAAuC;AACrD,WAAO,KAAK,WAAW,IAAI,SAAS,KAAK,cAAc,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChF;AAAA,EAEQ,QAAQ,WAA2B;AAEzC,WAAO,cAAc,WAAW,KAAK,MAAM,IAAI,SAAS,KAAK,IAAI,KAAK,eAAe;AAAA,EACvF;AAAA;AAAA,EAGA,MAAc,kBAAmC;AAC/C,WAAO,kBAAkB,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,IAAI,CAAC,CAAC;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,OAAsB;AAClC,QAAI,CAAC,iBAAiB,EAAG;AACzB,UAAM,KAAK,KAAK,KAAK,YAAY;AAC/B,YAAM,cAAc,MAAM,KAAK,gBAAgB;AAC/C,UAAI,KAAK,UAAU,gBAAgB,KAAK,YAAa,QAAO;AAI5D,YAAM,qBAAqB;AAC3B,YAAM,OAAO,MAAM,KAAK,WAAW;AACnC,aAAO,MAAM;AACX,aAAK,WAAW,KAAK;AACrB,aAAK,WAAW,KAAK;AACrB,aAAK,QAAQ,KAAK;AAClB,aAAK,cAAc;AACnB,aAAK,SAAS;AACd,YAAI,KAAK,SAAS,OAAO,EAAG,MAAK,OAAO;AAAA,MAC1C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAc,aAIX;AACD,UAAM,WAAW,oBAAI,IAA2B;AAChD,UAAM,WAAW,oBAAI,IAA2B;AAChD,UAAM,QAAQ,oBAAI,IAAoB;AACtC,eAAW,QAAQ,MAAM,cAAc,GAAG;AACxC,UAAI;AACF,cAAM,MAAM,MAAM,SAAS,KAAK,YAAY,IAAI,GAAG,OAAO;AAC1D,cAAM,OAAwB,KAAK,MAAM,GAAG;AAI5C,cAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,aAAa,MAAM,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;AAClE,YAAI,OAAO;AACT,4BAAkB,MAAM,WAAW,MAAM,EAAE,EAAE;AAC7C;AAAA,QACF;AACA,mBAAW,KAAK,MAAM;AAEpB,cAAI,EAAE,UAAU;AACd,uBAAW,OAAO,EAAE,UAAU;AAC5B,kBAAI,IAAI,UAAU,OAAW,KAAI,QAAQ;AAAA,YAC3C;AAAA,UACF;AACA,mBAAS,IAAI,EAAE,IAAI,CAAC;AACpB,mBAAS,IAAI,EAAE,IAAI;AAAA,YACjB,GAAG;AAAA,YACH,YAAY,kBAAkB,EAAE,cAAc,CAAC,GAAG,cAAc,IAAI,CAAC;AAAA,UACvE,CAAC;AACD,gBAAM,IAAI,EAAE,IAAI,IAAI;AAAA,QACtB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,UAAU,UAAU,MAAM;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,OAAsB;AAC5B,WAAO,KAAK,KAAK,KAAK,MAAM,KAAK,YAAY,CAAC;AAAA,EAChD;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,SAAS,oBAAI,IAA6B;AAChD,eAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;AACtC,UAAI,CAAC,kBAAkB,IAAI,EAAG,QAAO,IAAI,MAAM,CAAC,CAAC;AAAA,IACnD;AACA,WAAO,IAAI,eAAe,GAAG,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;AAE/D,eAAW,WAAW,KAAK,SAAS,OAAO,GAAG;AAC5C,YAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;AAGpC,YAAM,WAAW,eAAe,SAAS,KAAK,SAAS,IAAI,QAAQ,EAAE,GAAG,KAAK,QAAQ,QAAQ,EAAE,CAAC;AAChG,WAAK,SAAS,IAAI,SAAS,IAAI,QAAQ;AACvC,WAAK,MAAM,IAAI,QAAQ,IAAI,IAAI;AAC/B,UAAI,kBAAkB,IAAI,EAAG;AAC7B,YAAM,SAAS,OAAO,IAAI,IAAI;AAC9B,UAAI,OAAQ,QAAO,KAAK,QAAQ;AAAA,UAC3B,QAAO,IAAI,MAAM,CAAC,QAAQ,CAAC;AAAA,IAClC;AAEA,eAAW,CAAC,MAAM,QAAQ,KAAK,QAAQ;AACrC,YAAM,WAAW,KAAK,YAAY,IAAI;AACtC,UAAI,SAAS,WAAW,GAAG;AAKzB,cAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAClD;AAAA,MACF;AACA,YAAM,kBAAkB,UAAU,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,IACrE;AAIA,SAAK,cAAc,MAAM,KAAK,gBAAgB;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAAc,YAAqC;AACvD,UAAM,KAAK,KAAK;AAChB,eAAW,MAAM,YAAY;AAC3B,WAAK,SAAS,OAAO,EAAE;AACvB,WAAK,SAAS,OAAO,EAAE;AACvB,WAAK,MAAM,OAAO,EAAE;AACpB,WAAK,WAAW,OAAO,EAAE;AAAA,IAC3B;AACA,SAAK,OAAO;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,cAA6B;AACjC,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,KAAK;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,YAAY,YAAsB,OAAqC;AAC3E,UAAM,KAAK,KAAK;AAChB,eAAW,MAAM,YAAY;AAC3B,YAAM,UAAU,KAAK,SAAS,IAAI,EAAE;AACpC,UAAI,QAAS,MAAK,SAAS,IAAI,IAAI,EAAE,GAAG,SAAS,MAAM,CAAC;AAAA,IAC1D;AACA,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AAAA,EACd;AAAA,EAEA,MAAM,OAAiC;AACrC,UAAM,KAAK,KAAK;AAChB,WAAO,MAAM,KAAK,KAAK,SAAS,OAAO,CAAC;AAAA,EAC1C;AAAA,EAEA,MAAM,IAAI,IAA2C;AACnD,UAAM,KAAK,KAAK;AAChB,WAAO,KAAK,SAAS,IAAI,EAAE,KAAK;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,IAA2C;AAC5D,UAAM,KAAK,KAAK;AAChB,UAAM,UAAU,KAAK,SAAS,IAAI,EAAE;AACpC,WAAO,UAAU,eAAe,SAAS,KAAK,SAAS,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,IAAI;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,OAAsB,SAA8C;AAC/E,UAAM,KAAK,KAAK;AAChB,UAAM,UAAyB;AAAA,MAC7B,IAAI,WAAW;AAAA,MACf,OAAO,MAAM,SAAS;AAAA,MACtB,SAAS,MAAM;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM,YAAY,CAAC;AAAA,MAC7B,KAAK,MAAM;AAAA,MACX,OAAO,MAAM,SAAS,CAAC;AAAA,MACvB,QAAQ,MAAM,UAAU,CAAC;AAAA,MACzB,aAAa,MAAM;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,KAAK,MAAM;AAAA,MACX,WAAW,MAAM,aAAa,CAAC;AAAA,MAC/B,YAAY,MAAM;AAAA,MAClB,KAAK,MAAM;AAAA,MACX,MAAM,MAAM;AAAA,MACZ,KAAK,CAAC;AAAA,MACN,YAAY,CAAC;AAAA,MACb,QAAQ,MAAM,UAAU;AAAA,MACxB,cAAc,MAAM;AAAA,MACpB,aAAa,MAAM;AAAA,MACnB,WAAW,MAAM,aAAa,CAAC;AAAA,MAC/B,WAAW,MAAM,aAAa,CAAC;AAAA,MAC/B,YAAY,MAAM,cAAc,CAAC;AAAA,MACjC,aAAa,MAAM,eAAe;AAAA,MAClC,kBAAkB,MAAM,oBAAoB;AAAA,MAC5C,GAAI,MAAM,oBAAoB,UAAa,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,MACpF,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,YAAY;AAAA,MACxE,kBAAkB,MAAM,oBAAoB;AAAA,IAC9C;AACA,SAAK,SAAS,IAAI,QAAQ,IAAI,OAAO;AAGrC,QAAI,QAAS,MAAK,MAAM,IAAI,QAAQ,IAAI,iBAAiB,OAAO,CAAC;AACjE,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AACZ,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,OAAqD;AAChE,UAAM,KAAK,KAAK;AAChB,UAAM,WAAW,KAAK,SAAS,IAAI,MAAM,EAAE;AAC3C,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,UAAyB;AAAA,MAC7B,GAAG;AAAA,MACH,GAAI,MAAM,YAAY,UAAa,EAAE,SAAS,MAAM,WAAW,OAAU;AAAA,MACzE,GAAI,MAAM,SAAS,UAAa,EAAE,MAAM,MAAM,KAAK;AAAA,MACnD,GAAI,MAAM,aAAa,UAAa,EAAE,UAAU,MAAM,SAAS;AAAA,MAC/D,GAAI,MAAM,QAAQ,UAAa,EAAE,KAAK,MAAM,OAAO,OAAU;AAAA,MAC7D,GAAI,MAAM,UAAU,UAAa,EAAE,OAAO,MAAM,MAAM;AAAA,MACtD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,YAAY;AAAA,MACxE,GAAI,MAAM,aAAa,UAAa,EAAE,UAAU,MAAM,SAAS;AAAA,MAC/D,GAAI,MAAM,QAAQ,UAAa,EAAE,KAAK,MAAM,IAAI;AAAA,MAChD,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,MAClE,GAAI,MAAM,eAAe,UAAa,EAAE,YAAY,MAAM,WAAW;AAAA,MACrE,GAAI,MAAM,QAAQ,UAAa,EAAE,KAAK,MAAM,OAAO,OAAU;AAAA,MAC7D,GAAI,MAAM,SAAS,UAAa,EAAE,MAAM,MAAM,QAAQ,OAAU;AAAA,MAChE,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,iBAAiB,UAAa,EAAE,cAAc,MAAM,aAAa;AAAA,MAC3E,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,eAAe,OAAU;AAAA,MACrF,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,YAAY;AAAA,MACxE,GAAI,MAAM,qBAAqB,UAAa,EAAE,kBAAkB,MAAM,iBAAiB;AAAA,MACvF,GAAI,MAAM,qBAAqB,UAAa,EAAE,kBAAkB,MAAM,iBAAiB;AAAA,MACvF,GAAI,MAAM,oBAAoB,UAAa,EAAE,iBAAiB,MAAM,gBAAgB;AAAA,MACpF,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,YAAY;AAAA,MACxE,GAAI,MAAM,UAAU,UAAa,EAAE,OAAO,MAAM,MAAM;AAAA,MACtD,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,MAClE,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;AAAA,MAClE,GAAI,MAAM,eAAe,UAAa,EAAE,YAAY,MAAM,WAAW;AAAA,IACvE;AACA,SAAK,SAAS,IAAI,MAAM,IAAI,OAAO;AACnC,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AACZ,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,IAA8B;AACzC,UAAM,KAAK,KAAK;AAChB,QAAI,CAAC,KAAK,SAAS,IAAI,EAAE,EAAG,QAAO;AACnC,SAAK,SAAS,OAAO,EAAE;AACvB,uBAAmB,YAAY,EAAE;AACjC,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AAEZ,UAAM,iBAAiB,kBAAkB,EAAE;AAC3C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAKA,MAAM,mBAAmB,KAAyC;AAChE,UAAM,KAAK,KAAK;AAChB,UAAM,MAAuB,CAAC;AAC9B,eAAW,MAAM,KAAK;AACpB,YAAM,UAAU,KAAK,SAAS,IAAI,EAAE;AACpC,UAAI,QAAS,KAAI,KAAK,eAAe,SAAS,KAAK,SAAS,IAAI,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,CAAC;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,kBACJ,IAAY,QAAiB,OAAgB,WACd;AAC/B,UAAM,KAAK,KAAK;AAGhB,QAAI,MAAO,MAAK,WAAW,IAAI,IAAI,KAAK;AAIxC,QAAI,SAAS,aAAa,CAAC,KAAK,MAAM,IAAI,EAAE,EAAG,MAAK,MAAM,IAAI,IAAI,iBAAiB,OAAO,SAAS,CAAC;AACpG,UAAM,SAAS,oBAAoB,UAAU,EAAE,GAAI,QAAmB,GAAG,CAAC;AAC1E,QAAI,CAAC,OAAO,SAAS;AACnB,cAAQ,MAAM,+CAA+C,IAAI,OAAO,MAAM,OAAO;AACrF,aAAO,EAAE,SAAS,MAAM;AAAA,IAC1B;AACA,UAAM,WAAW,OAAO;AACxB,UAAM,WAAW,KAAK,SAAS,IAAI,EAAE;AACrC,QAAI,UAAU;AACZ,YAAM,cAAc,eAAe,UAAU,KAAK,SAAS,IAAI,EAAE,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;AAC7F,UAAI,KAAK,UAAU,WAAW,MAAM,KAAK,UAAU,QAAQ,EAAG,QAAO,EAAE,SAAS,MAAM;AAAA,IACxF;AACA,SAAK,SAAS,IAAI,IAAI,QAAQ;AAC9B,SAAK,SAAS,IAAI,IAAI;AAAA,MACpB,GAAG;AAAA;AAAA;AAAA,MAGH,YAAY,kBAAkB,SAAS,cAAc,CAAC,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC;AAAA,IACpF,CAAC;AACD,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AACZ,WAAO,EAAE,SAAS,CAAC,SAAS;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAM,kBAAkB,IAA8B;AACpD,UAAM,KAAK,KAAK;AAChB,QAAI,CAAC,KAAK,SAAS,IAAI,EAAE,EAAG,QAAO;AACnC,SAAK,SAAS,OAAO,EAAE;AACvB,SAAK,SAAS,OAAO,EAAE;AACvB,UAAM,KAAK,KAAK;AAChB,SAAK,OAAO;AACZ,UAAM,iBAAiB,kBAAkB,EAAE;AAC3C,WAAO;AAAA,EACT;AACF;AAEO,IAAM,eAAe,IAAI,aAAa;","names":[]}

package/{chunk-NCO4OOYT.js → chunk-4LJQIQMN.js}

@@ -1,6 +1,6 @@
 import {
   machineRoot
-} from "./chunk-KS7A5CTW.js";
+} from "./chunk-VPSQJOSN.js";
 
 // ../server/src/services/disk-freshness.ts
 import { stat } from "fs/promises";
@@ -134,4 +134,4 @@ export {
   atomicWriteJsonSecure,
   readJsonFileSafe
 };
-//# sourceMappingURL=chunk-NCO4OOYT.js.map
+//# sourceMappingURL=chunk-4LJQIQMN.js.map