@runeya/runeya 2.0.146 → 2.0.147

package/{chunk-KV4GJKXU.js → chunk-5XG3X2TM.js}

@@ -1,35 +1,28 @@
 import {
-  decryptValueWith,
-  encryptValueWith
-} from "./chunk-OZBSOSAS.js";
+  serviceStore
+} from "./chunk-4D3GCBPO.js";
 import {
-  atomicWriteSecure,
-  fingerprintFiles,
-  hasChangedSinceRead,
-  rememberFile,
-  renameWithRetry,
-  wasRead
+  decryptValue,
+  deriveStableSecret,
+  getEncryptionKey,
+  isEncryptedValue,
+  stableEncryptValue
+} from "./chunk-DFPZ4MTI.js";
+import {
+  renameWithRetry
 } from "./chunk-4LJQIQMN.js";
 import {
-  allVaultRoots,
   env,
   keyedFilePath,
   legacyMachineFilePath,
   listOrgVaults,
-  localVaultRoot,
   machineRoot,
-  orgVaultRoot,
-  projectVaultRoot,
-  vaultFor,
-  vaultIdOfRoot
+  orgVaultRoot
 } from "./chunk-VPSQJOSN.js";
 import {
   AGENT_FETCH_TIMEOUT,
   AGENT_HEALTH_POLL_INTERVAL,
-  CreateEnvironmentSchema,
-  EnvironmentSchema,
   PASSPHRASE_TIMEOUT,
-  ServiceConfigSchema,
   TraefikConfigSchema,
   WS_RECONNECT_MAX,
   WS_RECONNECT_MIN
@@ -44,106 +37,6 @@ import { z as z2 } from "zod";
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
 import { readFile, writeFile, mkdir, chmod } from "fs/promises";
 import { dirname, join } from "path";
-
-// ../server/src/utils/encryption-key.ts
-import { createHash } from "crypto";
-var KEY_SIZE_BYTES = 32;
-var DEFAULT_VAULT = "\0default";
-var keyring = /* @__PURE__ */ new Map();
-var lockedVaults = /* @__PURE__ */ new Set();
-var _ciMode = false;
-var _pendingLegacyKey = null;
-function isCiMode() {
-  return _ciMode;
-}
-async function loadFromEnv() {
-  const keyHex = process.env["RUNEYA_ENCRYPTION_KEY"];
-  if (!keyHex) return false;
-  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {
-    throw new Error("RUNEYA_ENCRYPTION_KEY invalide : attendu 64 caract\xE8res hex");
-  }
-  console.log("");
-  console.log("\u26A0 ATTENTION : RUNEYA_ENCRYPTION_KEY est d\xE9fini \u2014 l'authentification par master password est d\xE9sactiv\xE9e.");
-  console.log("  Cette variable d'environnement est r\xE9serv\xE9e aux environnements CI/CD.");
-  console.log("  Ne la d\xE9finissez jamais sur une machine de d\xE9veloppement.");
-  console.log("");
-  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
-  _ciMode = true;
-  return true;
-}
-function setPendingLegacyKey(key) {
-  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
-  _pendingLegacyKey = key;
-}
-function getPendingLegacyKey() {
-  return _pendingLegacyKey;
-}
-function clearPendingLegacyKey() {
-  _pendingLegacyKey = null;
-}
-function hasPendingLegacyKey() {
-  return _pendingLegacyKey !== null;
-}
-function setEncryptionKeyInMemory(key, vault = DEFAULT_VAULT) {
-  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
-  keyring.set(vault, key);
-  lockedVaults.delete(vault);
-  announceUnlock();
-}
-var unlockListeners = /* @__PURE__ */ new Set();
-function onVaultUnlocked(listener) {
-  unlockListeners.add(listener);
-  return () => unlockListeners.delete(listener);
-}
-function announceUnlock() {
-  for (const listener of unlockListeners) {
-    try {
-      listener();
-    } catch {
-    }
-  }
-}
-function clearEncryptionKey(vault) {
-  if (vault === void 0) {
-    keyring.clear();
-    lockedVaults.clear();
-  } else {
-    keyring.delete(vault);
-  }
-}
-function hasEncryptionKey(vault = DEFAULT_VAULT) {
-  return keyring.has(vault);
-}
-function getEncryptionKey(vault = DEFAULT_VAULT) {
-  const own = keyring.get(vault);
-  if (own) return own;
-  if (vault === DEFAULT_VAULT || lockedVaults.has(vault)) return null;
-  return keyring.get(DEFAULT_VAULT) ?? null;
-}
-function markVaultLocked(vault) {
-  lockedVaults.add(vault);
-  keyring.delete(vault);
-}
-function isVaultLocked(vault) {
-  return lockedVaults.has(vault);
-}
-function clearVaultLock(vault) {
-  lockedVaults.delete(vault);
-}
-function deriveStableSecret(purpose, vault = DEFAULT_VAULT) {
-  const key = getEncryptionKey(vault);
-  if (!key) return null;
-  return createHash("sha256").update(key).update(purpose).digest("hex");
-}
-async function ensureEncryptionKey() {
-  return getEncryptionKey();
-}
-async function setEncryptionKey(keyHex) {
-  if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error("Invalid key format");
-  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
-}
-
-// ../server/src/services/agent-store.ts
 var FILENAME = "agents.json";
 var ALGORITHM = "aes-256-gcm";
 function encrypt(plaintext, vault) {
@@ -395,1321 +288,19 @@ var AgentStore = class {
 };
 var agentStore = new AgentStore();
 
-// ../server/src/services/service-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join3 } from "path";
-
-// ../server/src/services/project-key.ts
-function projectKey(ref) {
-  return `${ref.orgId ?? "local"}:${ref.id}`;
-}
-var AmbiguousProjectError = class extends Error {
-  constructor(projectId, orgIds) {
-    const where = orgIds.map((o) => o ?? "local").join(", ");
-    super(
-      `Project id ${projectId} exists in several organizations (${where}). Name the organization alongside the project id.`
-    );
-    this.projectId = projectId;
-    this.orgIds = orgIds;
-    this.name = "AmbiguousProjectError";
-  }
-  code = "AMBIGUOUS_PROJECT_ID";
-};
-
-// ../server/src/services/vault-registry.ts
-var loadProjects = null;
-var projectRoots = /* @__PURE__ */ new Map();
-var projectRefs = /* @__PURE__ */ new Map();
-var serviceOwners = /* @__PURE__ */ new Map();
-function registerProjectLoader(load) {
-  loadProjects = load;
-}
-async function ensureProjectsLoaded() {
-  await loadProjects?.();
-}
-function setProjectVault(ref, root) {
-  const key = projectKey(ref);
-  projectRoots.set(key, root);
-  projectRefs.set(key, { id: ref.id, orgId: ref.orgId ?? null });
-}
-function forgetProject(ref) {
-  const key = projectKey(ref);
-  projectRoots.delete(key);
-  projectRefs.delete(key);
-  for (const [serviceId, owners] of serviceOwners) {
-    owners.delete(key);
-    if (owners.size === 0) serviceOwners.delete(serviceId);
-  }
-}
-function setProjectServices(ref, serviceIds) {
-  const key = projectKey(ref);
-  for (const [serviceId, owners] of serviceOwners) {
-    if (!serviceIds.includes(serviceId)) {
-      owners.delete(key);
-      if (owners.size === 0) serviceOwners.delete(serviceId);
-    }
-  }
-  for (const serviceId of serviceIds) {
-    const owners = serviceOwners.get(serviceId) ?? /* @__PURE__ */ new Set();
-    owners.add(key);
-    serviceOwners.set(serviceId, owners);
-  }
-}
-function rootOfProjectRef(ref) {
-  return projectRoots.get(projectKey(ref)) ?? localVaultRoot();
-}
-function refsOfProjectId(projectId) {
-  const matches = [];
-  for (const ref of projectRefs.values()) {
-    if (ref.id === projectId) matches.push(ref);
-  }
-  return matches;
-}
-function rootOfProjectAmong(projectId, hint) {
-  const matches = refsOfProjectId(projectId);
-  if (matches.length > 1) {
-    const known = matches.map((ref2) => rootOfProjectRef(ref2));
-    if (hint && known.includes(hint)) return hint;
-    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
-  }
-  const [ref] = matches;
-  return ref ? rootOfProjectRef(ref) : hint ?? localVaultRoot();
-}
-function refOfProjectAmong(projectId, hint) {
-  const matches = refsOfProjectId(projectId);
-  if (matches.length > 1) {
-    const found = hint ? matches.find((ref) => rootOfProjectRef(ref) === hint) : void 0;
-    if (found) return found;
-    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
-  }
-  return matches[0] ?? { id: projectId, orgId: null };
-}
-function rootOfService(serviceId, hint = null) {
-  const owners = serviceOwners.get(serviceId);
-  if (!owners || owners.size === 0) return hint ?? localVaultRoot();
-  const roots = Array.from(owners, (key) => projectRoots.get(key)).filter((r) => !!r);
-  if (hint && roots.includes(hint)) return hint;
-  return roots[0] ?? hint ?? localVaultRoot();
-}
-
-// ../server/src/services/local-removals.ts
-var removed = /* @__PURE__ */ new Map();
-var detached = /* @__PURE__ */ new Map();
-var linkKey = (projectId, field) => `${projectId}:${field}`;
-function recordLocalRemoval(kind, id) {
-  const ids = removed.get(kind) ?? /* @__PURE__ */ new Set();
-  ids.add(id);
-  removed.set(kind, ids);
-}
-function isLocallyRemoved(kind, id) {
-  return removed.get(kind)?.has(id) ?? false;
-}
-function clearLocalRemoval(kind, id) {
-  removed.get(kind)?.delete(id);
-}
-function recordDetached(projectId, field, before, after) {
-  const kept = new Set(after);
-  const gone = before.filter((id) => !kept.has(id));
-  if (gone.length === 0) return;
-  const key = linkKey(projectId, field);
-  const ids = detached.get(key) ?? /* @__PURE__ */ new Set();
-  for (const id of gone) ids.add(id);
-  detached.set(key, ids);
-}
-function isDetached(projectId, field, id) {
-  return detached.get(linkKey(projectId, field))?.has(id) ?? false;
-}
-function clearDetached(projectId, field) {
-  detached.delete(linkKey(projectId, field));
-}
-
-// ../server/src/services/vault-conflicts.ts
-var conflicted = /* @__PURE__ */ new Map();
-function isVaultClash(root, heldIn) {
-  return heldIn !== void 0 && heldIn !== root && heldIn !== localVaultRoot();
-}
-function markVaultConflict(root, detail) {
-  if (conflicted.has(root)) return;
-  conflicted.set(root, detail);
-  console.error(
-    "[vaults] %s partage des identifiants avec un autre coffre (%s) \u2014 son contenu est ignor\xE9 et laiss\xE9 intact. Cessez de suivre l'un des deux projets.",
-    root,
-    detail
-  );
-}
-function isVaultConflicted(root) {
-  return conflicted.has(root);
-}
-
-// ../server/src/services/store-disk-coordinator.ts
-import { AsyncLocalStorage } from "async_hooks";
-var insideReload = new AsyncLocalStorage();
-var StoreDiskCoordinator = class {
-  reloading = null;
-  saves = 0;
-  queue = Promise.resolve();
-  /**
-   * `read` rend de quoi substituer le nouvel état, ou `null` s'il n'y a rien à
-   * relire. La substitution doit être synchrone : c'est ce qui la rend atomique.
-   */
-  load(read) {
-    const inside = insideReload.getStore();
-    if (inside && (inside.has(this) || this.reloading)) return Promise.resolve();
-    this.reloading ??= this.reload(read).finally(() => {
-      this.reloading = null;
-    });
-    return this.reloading;
-  }
-  async reload(read) {
-    for (; ; ) {
-      await this.queue;
-      const savesBefore = this.saves;
-      const outer = insideReload.getStore() ?? /* @__PURE__ */ new Set();
-      const commit = await insideReload.run(/* @__PURE__ */ new Set([...outer, this]), read);
-      if (!commit) return;
-      if (this.saves !== savesBefore) continue;
-      commit();
-      return;
-    }
-  }
-  save(write) {
-    this.saves += 1;
-    const run = this.queue.then(write);
-    this.queue = run.catch(() => {
-    });
-    return run;
-  }
-};
-
-// ../server/src/services/environment-store.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile2, rm } from "fs/promises";
-import { join as join2 } from "path";
-
-// ../server/src/services/crypto-helpers.ts
-function encryptValue(plaintext, vault) {
-  return encryptValueWith(requireKey(vault), plaintext);
-}
-function decryptValue(encrypted, vault) {
-  return decryptValueWith(requireKey(vault), encrypted);
-}
-function requireKey(vault) {
-  const key = getEncryptionKey(vault);
-  if (!key) {
-    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
-  }
-  return key;
-}
-function stableEncryptValue(plaintext, existingEncrypted, vault) {
-  if (existingEncrypted) {
-    try {
-      if (decryptValue(existingEncrypted, vault) === plaintext) return existingEncrypted;
-    } catch {
-    }
-  }
-  return encryptValue(plaintext, vault);
-}
-function encryptVariableSlots(variables, existingEncrypted, vault) {
-  const result = {};
-  for (const [key, variable] of Object.entries(variables)) {
-    const slot = variable.value;
-    if (slot.isSecret && slot.value) {
-      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key], vault) } };
-    } else {
-      result[key] = { ...variable, value: { ...slot } };
-    }
-  }
-  return result;
-}
-function decryptVariableSlots(variables, contextLabel, onFailure, vault) {
-  const result = {};
-  for (const [key, variable] of Object.entries(variables)) {
-    const slot = variable.value;
-    if (slot.isSecret && slot.value) {
-      try {
-        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value, vault) } };
-      } catch (err) {
-        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message} \u2014 la valeur chiffr\xE9e est conserv\xE9e telle quelle sur le disque`);
-        onFailure?.(key);
-        result[key] = { ...variable, value: { ...slot, value: "" } };
-      }
-    } else {
-      result[key] = { ...variable, value: { ...slot } };
-    }
-  }
-  return result;
-}
-function extractEncryptedVariableSlots(variables) {
-  const slots = {};
-  for (const [key, variable] of Object.entries(variables)) {
-    if (variable.value?.isSecret && variable.value?.value) {
-      slots[key] = variable.value.value;
-    }
-  }
-  return slots;
-}
-function isEncryptedValue(s) {
-  const parts = s.split(":");
-  return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);
-}
-
-// ../server/src/services/environment-store.ts
-var FILENAME2 = "environments.json";
-var EnvironmentStore = class {
-  environments = /* @__PURE__ */ new Map();
-  loaded = false;
-  /** Cache of encrypted secret values as last written to disk */
-  diskEncryptedSlots = /* @__PURE__ */ new Map();
-  /**
-   * Les secrets qu'aucune clé chargée n'a ouverts, par environnement.
-   *
-   * Vides en mémoire, ils doivent repartir sur le disque sous leur forme
-   * chiffrée : c'est ce que retient cette liste. Voir `keepUnreadableSecrets`.
-   */
-  unreadableSecrets = /* @__PURE__ */ new Map();
-  /**
-   * Coffres dont le fichier a bougé depuis la lecture.
-   *
-   * On ne les réécrit pas. Ni avec notre copie — elle décrirait l'état d'avant
-   * la réparation — ni sans elle, ce qui effacerait les secrets qu'elle
-   * protège. Entre les deux, la seule issue sûre est de ne pas toucher au
-   * fichier et de laisser le prochain chargement faire foi.
-   */
-  staleRoots = /* @__PURE__ */ new Set();
-  /**
-   * L'état du disque au dernier chargement — voir `ProjectStore.fingerprint`.
-   *
-   * `staleRoots` dit « ne réécris pas ce fichier, il a bougé » ; celui-ci dit
-   * « relis-le ». Les deux vont ensemble : refuser d'écrire protège le travail
-   * de l'autre instance, mais tant que la mémoire n'est pas reprise, l'écriture
-   * refusée l'est pour toujours et la modification de l'utilisateur se perd.
-   */
-  fingerprint = "";
-  disk = new StoreDiskCoordinator();
-  listeners = /* @__PURE__ */ new Set();
-  /** Notified after every persisted mutation, for the cloud sync bridge. */
-  onChange(fn) {
-    this.listeners.add(fn);
-    return () => this.listeners.delete(fn);
-  }
-  notify() {
-    for (const fn of this.listeners) fn();
-  }
-  /**
-   * Which vault each environment was read from, so a save puts it back where it
-   * belongs even before its project has been loaded.
-   */
-  roots = /* @__PURE__ */ new Map();
-  /** L'organisation d'où vient un environnement reçu du cloud — voir `vaultOf`. */
-  remoteOrgs = /* @__PURE__ */ new Map();
-  /**
-   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
-   *
-   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
-   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
-   * qui n'existe plus. La laisser en place n'affichait pas seulement des
-   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
-   * par-dessus le nouveau, et défaisait l'adoption.
-   */
-  resetCache() {
-    this.environments.clear();
-    this.diskEncryptedSlots.clear();
-    this.unreadableSecrets.clear();
-    this.roots.clear();
-    this.remoteOrgs.clear();
-    this.loaded = false;
-    this.notify();
-  }
-  /**
-   * Combien de secrets ce coffre garde chiffrés sans savoir les ouvrir, par
-   * organisation (`null` pour la machine).
-   *
-   * Ils sont déjà préservés à l'écriture (`keepUnreadableSecrets`) ; ce qui
-   * manquait, c'est de le dire. Un secret qui s'affiche vide et se sauvegarde
-   * intact est rassurant sur le disque et déroutant à l'écran.
-   */
-  async unreadableByVault() {
-    await this.load();
-    const out = /* @__PURE__ */ new Map();
-    for (const [environmentId, failed] of this.unreadableSecrets) {
-      if (!failed.size) continue;
-      const environment = this.environments.get(environmentId);
-      const vault = (environment ? this.vaultOf(environment) : void 0) ?? null;
-      out.set(vault, (out.get(vault) ?? 0) + failed.size);
-    }
-    return out;
-  }
-  getFilePath(root) {
-    return join2(root, FILENAME2);
-  }
-  /**
-   * The vault an environment must be written to: its project's.
-   *
-   * An environment names its project by id alone, and that id can answer for a
-   * project in each organization. The vault it was read from names the couple —
-   * so it is handed over as the tie-breaker rather than left as a mere fallback.
-   *
-   * Falls back to where it was last read, then to the local vault — an
-   * environment whose project is unknown belongs to the launch directory, which
-   * is where it lived before vaults existed.
-   */
-  /**
-   * La clé sous laquelle chiffrer cet environnement.
-   *
-   * La provenance l'emporte sur le coffre tant que le projet n'est pas local :
-   * un environnement reçu du cloud arrive avant lui, et `rootFor` désignerait
-   * alors le répertoire de lancement — donc la clé de la machine plutôt que
-   * celle de l'organisation qui a chiffré ces secrets.
-   */
-  vaultOf(environment) {
-    return this.remoteOrgs.get(environment.id) ?? vaultIdOfRoot(this.rootFor(environment));
-  }
-  rootFor(environment) {
-    const known = this.roots.get(environment.id) ?? null;
-    const projectRoot = environment.projectId ? rootOfProjectAmong(environment.projectId, known) : null;
-    return projectRoot ?? known ?? localVaultRoot();
-  }
-  /**
-   * Le projet d'un environnement, organisation comprise.
-   *
-   * L'environnement ne nomme que l'id ; le coffre d'où il vient fournit
-   * l'organisation, et c'est ce couple qu'il faut pour agir sur son projet.
-   */
-  projectRefOf(environment) {
-    if (!environment.projectId) return null;
-    return refOfProjectAmong(environment.projectId, this.roots.get(environment.id) ?? null);
-  }
-  /**
-   * The vault holding the environment that defines a variable.
-   *
-   * Overrides answer a variable, not a project: this is what lets them find the
-   * same vault without re-resolving an id that may be ambiguous.
-   */
-  async rootOfVariable(variableId) {
-    await this.load();
-    for (const environment of this.environments.values()) {
-      if (environment.variables && variableId in environment.variables) {
-        return this.rootFor(environment);
-      }
-    }
-    return null;
-  }
-  extractEncryptedCache(environment) {
-    const envSlots = extractEncryptedVariableSlots(
-      environment.variables
-    );
-    return { envSlots };
-  }
-  /**
-   * `vault` est fourni quand l'appelant sait à qui appartient l'environnement
-   * mieux que le disque : à l'arrivée d'une entité distante, son projet n'est
-   * pas encore local, et le coffre déduit serait celui du répertoire de
-   * lancement — donc la mauvaise clé.
-   */
-  encryptEnvironment(environment, vault) {
-    const cache = this.diskEncryptedSlots.get(environment.id);
-    let encryptedVars = environment.variables;
-    if (environment.variables && Object.keys(environment.variables).length > 0) {
-      encryptedVars = encryptVariableSlots(
-        environment.variables,
-        cache?.envSlots,
-        // La clé est celle du coffre où l'environnement sera écrit : les
-        // secrets d'une organisation sont chiffrés par la sienne.
-        vault ?? this.vaultOf(environment)
-      );
-    }
-    return { ...environment, variables: this.keepUnreadableSecrets(environment.id, encryptedVars) };
-  }
-  /**
-   * Réécrire un secret illisible tel qu'il est sur le disque, jamais à blanc.
-   *
-   * Un secret qui ne s'ouvre pas est vide en mémoire (voir
-   * `decryptVariableSlots`) : le chiffrer donnerait un chiffré de la chaîne
-   * vide, et la sauvegarde effacerait pour de bon une valeur dont il ne
-   * manquait que la clé. Son chiffré d'origine est encore là — c'est celui que
-   * `diskEncryptedSlots` a mis de côté avant le déchiffrement — et c'est lui
-   * qui repart sur le disque.
-   *
-   * La condition tient à la valeur en mémoire : tant qu'elle est vide, la
-   * variable n'a pas été retouchée et son chiffré fait foi. Dès que
-   * l'utilisateur en saisit une nouvelle, elle l'emporte — et vider un secret
-   * volontairement reste possible, puisque cela ne concerne que les variables
-   * dont le déchiffrement a échoué.
-   */
-  keepUnreadableSecrets(environmentId, variables) {
-    const failed = this.unreadableSecrets.get(environmentId);
-    if (!failed?.size || !variables) return variables;
-    const onDisk = this.diskEncryptedSlots.get(environmentId)?.envSlots ?? {};
-    const result = { ...variables };
-    for (const variableId of failed) {
-      const ciphertext = onDisk[variableId];
-      const variable = result[variableId];
-      if (!ciphertext || !variable || variable.value.value) continue;
-      result[variableId] = { ...variable, value: { ...variable.value, value: ciphertext } };
-    }
-    return result;
-  }
-  decryptEnvironment(environment, vault, unreadable = this.unreadableSecrets) {
-    let decryptedVars = environment.variables;
-    if (environment.variables && Object.keys(environment.variables).length > 0) {
-      const failed = /* @__PURE__ */ new Set();
-      decryptedVars = decryptVariableSlots(
-        environment.variables,
-        `environment ${environment.id}`,
-        (variableId) => failed.add(variableId),
-        vault ?? this.vaultOf(environment)
-      );
-      if (failed.size > 0) unreadable.set(environment.id, failed);
-      else unreadable.delete(environment.id);
-    }
-    return { ...environment, variables: decryptedVars };
-  }
-  /** Ce que le disque porte : un fichier d'environnements par coffre. */
-  async diskFingerprint() {
-    return fingerprintFiles((await allVaultRoots()).map((root) => this.getFilePath(root)));
-  }
-  /**
-   * Read every vault — the launch directory and each materialized cloud project.
-   *
-   * The roots come from the disk rather than from the project store, so loading
-   * environments never has to wait on projects being loaded first (the project
-   * store reads environments while absorbing a project, which would deadlock).
-   */
-  async load() {
-    await this.disk.load(async () => {
-      const fingerprint = await this.diskFingerprint();
-      if (this.loaded && fingerprint === this.fingerprint) return null;
-      await ensureProjectsLoaded();
-      if (!getEncryptionKey()) return null;
-      const next = await this.readVaults();
-      return () => {
-        this.environments = next.environments;
-        this.diskEncryptedSlots = next.diskEncryptedSlots;
-        this.roots = next.roots;
-        this.unreadableSecrets = next.unreadableSecrets;
-        this.fingerprint = fingerprint;
-        this.loaded = true;
-      };
-    });
-  }
-  /** Lire tous les coffres dans des tables neuves, que `load` substitue d'un coup. */
-  async readVaults() {
-    const environments = /* @__PURE__ */ new Map();
-    const diskEncryptedSlots = /* @__PURE__ */ new Map();
-    const roots = /* @__PURE__ */ new Map();
-    const unreadableSecrets = /* @__PURE__ */ new Map();
-    for (const root of await allVaultRoots()) {
-      try {
-        const raw = await readFile2(this.getFilePath(root), "utf-8");
-        await rememberFile(this.getFilePath(root));
-        const data = JSON.parse(raw);
-        const clash = data.find((e) => isVaultClash(root, roots.get(e.id)));
-        if (clash) {
-          markVaultConflict(root, `environnement ${clash.id}`);
-          continue;
-        }
-        for (const e of data) {
-          diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
-          roots.set(e.id, root);
-          environments.set(e.id, this.decryptEnvironment(e, vaultIdOfRoot(root), unreadableSecrets));
-        }
-      } catch {
-      }
-    }
-    return { environments, diskEncryptedSlots, roots, unreadableSecrets };
-  }
-  /**
-   * Write each vault that holds — or held — an environment.
-   *
-   * A vault emptied by this save loses its file: an environment that moved to
-   * another vault must not survive in the old one, and a `[]` left behind would
-   * keep (or recreate) a `.runeya` in a directory that holds nothing.
-   */
-  /**
-   * Repérer les coffres réparés sous nos pieds, avant d'écrire.
-   *
-   * Le test est fait ici, une fois par sauvegarde, plutôt que par
-   * environnement : c'est le fichier du coffre qui change, pas la variable.
-   */
-  async markStaleRoots() {
-    this.staleRoots.clear();
-    for (const root of new Set(this.roots.values())) {
-      const path = this.getFilePath(root);
-      if (wasRead(path) && await hasChangedSinceRead(path)) this.staleRoots.add(root);
-    }
-  }
-  save() {
-    return this.disk.save(() => this.writeVaults());
-  }
-  async writeVaults() {
-    await this.markStaleRoots();
-    const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) {
-      if (!isVaultConflicted(root)) byRoot.set(root, []);
-    }
-    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
-    for (const environment of this.environments.values()) {
-      const root = this.rootFor(environment);
-      const prepared = this.encryptEnvironment(environment);
-      this.diskEncryptedSlots.set(prepared.id, this.extractEncryptedCache(prepared));
-      this.roots.set(environment.id, root);
-      if (isVaultConflicted(root)) continue;
-      const bucket = byRoot.get(root);
-      if (bucket) bucket.push(prepared);
-      else byRoot.set(root, [prepared]);
-    }
-    for (const [root, environments] of byRoot) {
-      if (this.staleRoots.has(root)) {
-        console.warn(
-          `[environment-store] ${this.getFilePath(root)} a chang\xE9 depuis sa lecture \u2014 \xE9criture ignor\xE9e pour ne pas \xE9craser une r\xE9paration faite en dehors du serveur.`
-        );
-        continue;
-      }
-      const filePath = this.getFilePath(root);
-      if (environments.length === 0) {
-        await rm(filePath, { force: true }).catch(() => {
-        });
-        continue;
-      }
-      try {
-        await atomicWriteSecure(filePath, JSON.stringify(environments, null, 2));
-      } catch (err) {
-        if (err.code !== "ENOENT") throw err;
-        console.warn(`[environment-store] ${filePath} a disparu pendant l'\xE9criture (projet supprim\xE9 ?) \u2014 coffre ignor\xE9.`);
-        continue;
-      }
-      await rememberFile(filePath);
-    }
-    this.fingerprint = await this.diskFingerprint();
-    this.notify();
-  }
-  /**
-   * Rewrite every vault, moving entities that now belong elsewhere.
-   *
-   * Called once the project store knows where projects live: entities read from
-   * the launch directory whose project turns out to be a cloud one are written
-   * into that project's vault, and disappear from the directory they came from.
-   */
-  async relocateAll() {
-    await this.load();
-    await this.save();
-  }
-  /**
-   * Which project a variable belongs to, by walking the environments that
-   * define it.
-   *
-   * Overrides are keyed by variable id alone — nothing in an override says
-   * which project it belongs to — so this is what lets them be stored with
-   * their project rather than in one machine-wide pile.
-   */
-  /**
-   * Drop a project's environments from memory, without touching the disk.
-   *
-   * Used when a project stops being followed: its vault is removed as a whole,
-   * and environments left in memory would be written back on the next save —
-   * into the local vault, since their project is no longer known.
-   */
-  async forgetByProject(projectId) {
-    await this.load();
-    for (const [id, environment] of this.environments) {
-      if (environment.projectId !== projectId) continue;
-      this.environments.delete(id);
-      this.diskEncryptedSlots.delete(id);
-      this.unreadableSecrets.delete(id);
-      this.roots.delete(id);
-      this.remoteOrgs.delete(id);
-    }
-    this.notify();
-  }
-  /**
-   * Les environnements d'un projet.
-   *
-   * `orgId` restreint au projet de cette organisation : deux projets homonymes
-   * ont chacun les siens, et filtrer sur le seul `projectId` mélangeait les deux
-   * listes à l'écran. Omis, le filtre reste sur l'id — ce que fait un appelant
-   * qui n'a pas d'organisation à donner.
-   */
-  async list(projectId, orgId) {
-    await this.load();
-    return this.ofProject(projectId, orgId);
-  }
-  /** Le filtre commun : l'id, puis le coffre quand l'organisation est connue. */
-  ofProject(projectId, orgId) {
-    const byId = Array.from(this.environments.values()).filter((e) => e.projectId === projectId);
-    if (orgId === void 0) return byId;
-    const root = vaultFor({ id: projectId, orgId }).root;
-    return byId.filter((e) => this.rootFor(e) === root);
-  }
-  async get(id) {
-    await this.load();
-    return this.environments.get(id) ?? null;
-  }
-  /**
-   * `orgId` ne fait pas partie de l'environnement : il dit dans quel coffre le
-   * poser. Un environnement neuf n'a pas encore de provenance, et son
-   * `projectId` seul peut répondre pour un projet de chaque organisation — sans
-   * cette précision, la création échouerait sur l'ambiguïté au lieu de viser le
-   * bon coffre.
-   */
-  async create(input, orgId) {
-    await this.load();
-    const parsed = CreateEnvironmentSchema.parse(input);
-    const environment = {
-      id: randomUUID2(),
-      projectId: parsed.projectId,
-      name: parsed.name,
-      description: parsed.description,
-      parentIds: parsed.parentIds,
-      variables: parsed.variables,
-      scope: parsed.scope,
-      reference: parsed.reference,
-      activateOn: parsed.activateOn,
-      immutable: parsed.immutable,
-      default: parsed.default,
-      color: parsed.color,
-      bgColor: parsed.bgColor,
-      agentId: parsed.agentId
-    };
-    if (environment.default) {
-      for (const [id, e] of this.environments) {
-        if (e.projectId === environment.projectId && e.default) {
-          this.environments.set(id, { ...e, default: false });
-        }
-      }
-    }
-    this.environments.set(environment.id, environment);
-    if (environment.projectId && orgId !== void 0) {
-      this.roots.set(environment.id, vaultFor({ id: environment.projectId, orgId }).root);
-    }
-    await this.save();
-    return environment;
-  }
-  async update(input) {
-    await this.load();
-    const existing = this.environments.get(input.id);
-    if (!existing) return null;
-    const updated = {
-      ...existing,
-      // Immutable environments: allow changing variables, color, description — but not name
-      ...!existing.immutable && input.name !== void 0 && { name: input.name },
-      ...input.description !== void 0 && { description: input.description },
-      ...input.parentIds !== void 0 && { parentIds: input.parentIds },
-      ...input.variables !== void 0 && { variables: input.variables },
-      ...input.scope !== void 0 && { scope: input.scope },
-      ...input.reference !== void 0 && { reference: input.reference },
-      ...input.activateOn !== void 0 && { activateOn: input.activateOn },
-      ...input.color !== void 0 && { color: input.color },
-      ...input.bgColor !== void 0 && { bgColor: input.bgColor },
-      ...input.default !== void 0 && { default: input.default },
-      ...input.agentId !== void 0 && { agentId: input.agentId ?? void 0 }
-    };
-    if (updated.default) {
-      for (const [id, e] of this.environments) {
-        if (id !== input.id && e.projectId === updated.projectId && e.default) {
-          this.environments.set(id, { ...e, default: false });
-        }
-      }
-    }
-    this.environments.set(input.id, updated);
-    await this.save();
-    return updated;
-  }
-  async upsertVariable(environmentId, variableId, variable) {
-    const existing = this.environments.get(environmentId);
-    if (!existing) return null;
-    const variables = { ...existing.variables, [variableId]: variable };
-    return this.update({ id: environmentId, variables });
-  }
-  async removeVariable(environmentId, variableId) {
-    const existing = this.environments.get(environmentId);
-    if (!existing) return null;
-    const variables = { ...existing.variables };
-    delete variables[variableId];
-    return this.update({ id: environmentId, variables });
-  }
-  async delete(id) {
-    await this.load();
-    const env2 = this.environments.get(id);
-    if (!env2) return false;
-    if (env2.immutable) return false;
-    this.environments.delete(id);
-    recordLocalRemoval("environments", id);
-    await this.save();
-    return true;
-  }
-  async getByProjectId(projectId, orgId) {
-    await this.load();
-    return this.ofProject(projectId, orgId);
-  }
-  async listAllGlobal() {
-    await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.scope === "global");
-  }
-  // --- Scope-based Query Methods ---
-  async listByScope(projectId, scope, orgId) {
-    await this.load();
-    return this.ofProject(projectId, orgId).filter((e) => e.scope === scope);
-  }
-  /** Les environnements de service qui s'activent avec un environnement global. */
-  async listByActivateOn(globalEnvId) {
-    await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.scope === "service" && e.activateOn === globalEnvId);
-  }
-  async findServiceEnvironment(serviceId, globalEnvId) {
-    await this.load();
-    for (const e of this.environments.values()) {
-      if (e.scope === "service" && e.reference === serviceId && e.activateOn === globalEnvId) return e;
-    }
-    return null;
-  }
-  async findServiceEnvironments(serviceId) {
-    await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.scope === "service" && e.reference === serviceId);
-  }
-  async deleteByReference(serviceId) {
-    await this.load();
-    let changed = false;
-    for (const [id, e] of this.environments) {
-      if (e.scope === "service" && e.reference === serviceId) {
-        this.environments.delete(id);
-        recordLocalRemoval("environments", id);
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-  async deleteByActivateOn(globalEnvId) {
-    await this.load();
-    let changed = false;
-    for (const [id, e] of this.environments) {
-      if (e.scope === "service" && e.activateOn === globalEnvId) {
-        this.environments.delete(id);
-        recordLocalRemoval("environments", id);
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-  /**
-   * When a service is renamed, update the name of all its service-scoped environments
-   * to keep the `${serviceName} (${globalEnvName})` pattern in sync.
-   */
-  async renameByReference(serviceId, newServiceName) {
-    await this.load();
-    let changed = false;
-    for (const [id, e] of this.environments) {
-      if (e.scope === "service" && e.reference === serviceId && e.activateOn) {
-        const globalEnv = this.environments.get(e.activateOn);
-        if (!globalEnv) continue;
-        this.environments.set(id, { ...e, name: `${newServiceName} (${globalEnv.name})` });
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-  /**
-   * When a global environment is renamed, update the name of all service-scoped
-   * environments that activateOn it to keep the naming pattern in sync.
-   * Caller provides a serviceId→name map since environmentStore can't access serviceStore.
-   */
-  async renameByActivateOn(globalEnvId, newGlobalName, serviceNames) {
-    await this.load();
-    let changed = false;
-    for (const [id, e] of this.environments) {
-      if (e.scope === "service" && e.activateOn === globalEnvId && e.reference) {
-        const serviceName = serviceNames.get(e.reference);
-        if (!serviceName) continue;
-        this.environments.set(id, { ...e, name: `${serviceName} (${newGlobalName})` });
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-  // ---- Cloud sync ------------------------------------------------------
-  /** Environments of the given projects, in their on-disk (encrypted) form. */
-  async listEncryptedByProjectIds(projectIds) {
-    await this.load();
-    const wanted = new Set(projectIds);
-    return Array.from(this.environments.values()).filter((e) => wanted.has(e.projectId)).map((e) => this.encryptEnvironment(e));
-  }
-  /**
-   * Apply an environment received from the cloud, in its on-disk form.
-   *
-   * Validated rather than trusted, and diff-guarded against the on-disk form so
-   * re-applying an identical environment neither saves nor notifies (loop-safe).
-   */
-  async applyRemoteUpsert(id, fields, vault) {
-    await this.load();
-    if (vault) this.remoteOrgs.set(id, vault);
-    const parsed = EnvironmentSchema.safeParse({ ...fields, id });
-    if (!parsed.success) {
-      console.error("[environment-store] Rejected remote environment %s:", id, parsed.error.message);
-      return { created: false };
-    }
-    const incoming = parsed.data;
-    const existing = this.environments.get(id);
-    if (existing && JSON.stringify(this.encryptEnvironment(existing, vault)) === JSON.stringify(incoming)) {
-      return { created: false };
-    }
-    this.diskEncryptedSlots.set(id, this.extractEncryptedCache(incoming));
-    this.environments.set(id, this.decryptEnvironment(incoming, vault));
-    await this.save();
-    return { created: !existing };
-  }
-  /** Delete an environment that was removed on another peer. */
-  async applyRemoteDelete(id) {
-    await this.load();
-    if (!this.environments.has(id)) return false;
-    this.environments.delete(id);
-    this.diskEncryptedSlots.delete(id);
-    this.unreadableSecrets.delete(id);
-    this.remoteOrgs.delete(id);
-    await this.save();
-    return true;
-  }
-};
-var environmentStore = new EnvironmentStore();
-
-// ../server/src/services/service-store.ts
-var FILENAME3 = "services.json";
-function encryptLogSources(logSources, previous, vault) {
-  return logSources.map((src, i) => {
-    const prev = previous?.[i];
-    if (src.type === "mongo") {
-      if (isEncryptedValue(src.connectionString)) return src;
-      const was = prev?.type === "mongo" ? prev.connectionString : void 0;
-      return { ...src, connectionString: stableEncryptValue(src.connectionString, was, vault) };
-    }
-    if (src.type === "mysql" && src.password) {
-      if (isEncryptedValue(src.password)) return src;
-      const was = prev?.type === "mysql" ? prev.password : void 0;
-      return { ...src, password: stableEncryptValue(src.password, was, vault) };
-    }
-    return src;
-  });
-}
-function decryptLogSources(logSources, vault) {
-  return logSources.map((src) => {
-    if (src.type === "mongo" && isEncryptedValue(src.connectionString)) {
-      try {
-        return { ...src, connectionString: decryptValue(src.connectionString, vault) };
-      } catch {
-        console.error("[service-store] Failed to decrypt mongo connectionString");
-        return src;
-      }
-    }
-    if (src.type === "mysql" && src.password && isEncryptedValue(src.password)) {
-      try {
-        return { ...src, password: decryptValue(src.password, vault) };
-      } catch {
-        console.error("[service-store] Failed to decrypt mysql password");
-        return src;
-      }
-    }
-    return src;
-  });
-}
-function prepareForDisk(service, previous, vault) {
-  return {
-    ...service,
-    env: {},
-    envSecrets: [],
-    resolvedLogParsers: void 0,
-    resolvedCwd: void 0,
-    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources, vault)
-  };
-}
-var ServiceStore = class {
-  services = /* @__PURE__ */ new Map();
-  loaded = false;
-  /**
-   * L'état du disque au dernier chargement — voir `ProjectStore.fingerprint` :
-   * plusieurs Runeya partagent la racine machine, et un store chargé une fois
-   * pour toutes ne verrait jamais les services créés par l'autre.
-   */
-  fingerprint = "";
-  disk = new StoreDiskCoordinator();
-  listeners = /* @__PURE__ */ new Set();
-  /**
-   * Last on-disk (encrypted) form per service id, so `prepareForDisk` can reuse
-   * existing ciphertext instead of re-encrypting unchanged credentials.
-   */
-  diskForm = /* @__PURE__ */ new Map();
-  onChange(fn) {
-    this.listeners.add(fn);
-    return () => this.listeners.delete(fn);
-  }
-  notify() {
-    for (const fn of this.listeners) fn();
-  }
-  /** Which vault each service was read from, used until its project is known. */
-  roots = /* @__PURE__ */ new Map();
-  /**
-   * L'organisation d'où vient un service reçu du cloud.
-   *
-   * Le coffre ne peut pas encore répondre : les contenus arrivent avant leur
-   * projet, donc `rootFor` désignerait le répertoire de lancement et
-   * chiffrerait les secrets de l'organisation avec la clé de la machine. Cette
-   * provenance tient le temps que le projet devienne local — après quoi elle
-   * dit la même chose que le coffre.
-   */
-  remoteOrgs = /* @__PURE__ */ new Map();
-  /**
-   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
-   *
-   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
-   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
-   * qui n'existe plus. La laisser en place n'affichait pas seulement des
-   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
-   * par-dessus le nouveau, et défaisait l'adoption.
-   */
-  resetCache() {
-    this.services.clear();
-    this.diskForm.clear();
-    this.roots.clear();
-    this.remoteOrgs.clear();
-    this.loaded = false;
-    this.notify();
-  }
-  getFilePath(root) {
-    return join3(root, FILENAME3);
-  }
-  /**
-   * The vault a service must be written to: the one of the project owning it.
-   *
-   * A service carries no project id — ownership lives in `project.serviceIds` —
-   * so the registry answers, falling back to where the service was read and
-   * finally to the local vault.
-   */
-  /** La clé sous laquelle chiffrer ce service : son organisation, ou son coffre. */
-  vaultOf(serviceId) {
-    return this.remoteOrgs.get(serviceId) ?? vaultIdOfRoot(this.rootFor(serviceId));
-  }
-  rootFor(serviceId) {
-    return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();
-  }
-  /** Ce que le disque porte : un fichier de services par coffre. */
-  async diskFingerprint() {
-    return fingerprintFiles((await allVaultRoots()).map((root) => this.getFilePath(root)));
-  }
-  /**
-   * Read every vault: the launch directory and each materialized cloud project.
-   *
-   * Roots come from the disk, not from the project store, so services load
-   * without waiting on projects.
-   */
-  async load() {
-    if (!getEncryptionKey()) return;
-    await this.disk.load(async () => {
-      const fingerprint = await this.diskFingerprint();
-      if (this.loaded && fingerprint === this.fingerprint) return null;
-      await ensureProjectsLoaded();
-      const next = await this.readVaults();
-      return () => {
-        this.services = next.services;
-        this.diskForm = next.diskForm;
-        this.roots = next.roots;
-        this.fingerprint = fingerprint;
-        this.loaded = true;
-        if (this.services.size > 0) this.notify();
-      };
-    });
-  }
-  async readVaults() {
-    const services = /* @__PURE__ */ new Map();
-    const diskForm = /* @__PURE__ */ new Map();
-    const roots = /* @__PURE__ */ new Map();
-    for (const root of await allVaultRoots()) {
-      try {
-        const raw = await readFile3(this.getFilePath(root), "utf-8");
-        const data = JSON.parse(raw);
-        const clash = data.find((s) => isVaultClash(root, roots.get(s.id)));
-        if (clash) {
-          markVaultConflict(root, `service ${clash.id}`);
-          continue;
-        }
-        for (const s of data) {
-          if (s.commands) {
-            for (const cmd of s.commands) {
-              if (cmd.shell === void 0) cmd.shell = true;
-            }
-          }
-          diskForm.set(s.id, s);
-          services.set(s.id, {
-            ...s,
-            logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root))
-          });
-          roots.set(s.id, root);
-        }
-      } catch {
-      }
-    }
-    return { services, diskForm, roots };
-  }
-  /**
-   * Write each vault that holds — or held — a service.
-   *
-   * A vault emptied by this save loses its file: a service that moved to
-   * another vault must not survive in the one it left, and a `[]` left behind
-   * would keep (or recreate) a `.runeya` in a directory that holds nothing.
-   */
-  save() {
-    return this.disk.save(() => this.writeVaults());
-  }
-  async writeVaults() {
-    const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) {
-      if (!isVaultConflicted(root)) byRoot.set(root, []);
-    }
-    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
-    for (const service of this.services.values()) {
-      const root = this.rootFor(service.id);
-      const prepared = prepareForDisk(service, this.diskForm.get(service.id), this.vaultOf(service.id));
-      this.diskForm.set(prepared.id, prepared);
-      this.roots.set(service.id, root);
-      if (isVaultConflicted(root)) continue;
-      const bucket = byRoot.get(root);
-      if (bucket) bucket.push(prepared);
-      else byRoot.set(root, [prepared]);
-    }
-    for (const [root, services] of byRoot) {
-      const filePath = this.getFilePath(root);
-      if (services.length === 0) {
-        await rm2(filePath, { force: true }).catch(() => {
-        });
-        continue;
-      }
-      await atomicWriteSecure(filePath, JSON.stringify(services, null, 2));
-    }
-    this.fingerprint = await this.diskFingerprint();
-  }
-  /**
-   * Drop services from memory, without touching the disk.
-   *
-   * Used when their project stops being followed: its vault goes away whole,
-   * and services left in memory would be written back on the next save — into
-   * the local vault, since their owner is no longer known.
-   */
-  async forgetLocally(serviceIds) {
-    await this.load();
-    for (const id of serviceIds) {
-      this.services.delete(id);
-      this.diskForm.delete(id);
-      this.roots.delete(id);
-      this.remoteOrgs.delete(id);
-    }
-    this.notify();
-  }
-  /**
-   * Rewrite every vault, moving entities that now belong elsewhere.
-   *
-   * Called once the project store knows where projects live: entities read from
-   * the launch directory whose project turns out to be a cloud one are written
-   * into that project's vault, and disappear from the directory they came from.
-   */
-  async relocateAll() {
-    await this.load();
-    await this.save();
-  }
-  /**
-   * Réattribuer l'organisation de services dont le projet vient de changer de
-   * coffre.
-   *
-   * Un service porte son `orgId` en propre : laissé à `null` après le passage
-   * du projet dans une organisation, il partirait dans le doc en se disant
-   * local. La sauvegarde qui suit les écrit dans leur nouveau coffre et les
-   * retire de l'ancien, le registre ayant déjà été mis à jour par le projet.
-   */
-  async reassignOrg(serviceIds, orgId) {
-    await this.load();
-    for (const id of serviceIds) {
-      const service = this.services.get(id);
-      if (service) this.services.set(id, { ...service, orgId });
-    }
-    await this.save();
-    this.notify();
-  }
-  async list() {
-    await this.load();
-    return Array.from(this.services.values());
-  }
-  async get(id) {
-    await this.load();
-    return this.services.get(id) ?? null;
-  }
-  /**
-   * Service in its on-disk (sanitized) form: transient runtime env and plaintext
-   * secrets stripped. Used when exporting a project to the cloud so that no
-   * secret ever leaves the machine.
-   */
-  async getSanitized(id) {
-    await this.load();
-    const service = this.services.get(id);
-    return service ? prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)) : null;
-  }
-  /**
-   * `project` : le projet qui va l'adopter, quand on le connaît. Le service est
-   * alors écrit d'emblée dans son coffre — sans lui, il naissait dans le coffre
-   * de lancement et y laissait une copie une fois rattaché.
-   */
-  async create(input, project) {
-    await this.load();
-    const service = {
-      id: randomUUID3(),
-      orgId: input.orgId ?? null,
-      agentId: input.agentId,
-      name: input.name,
-      commands: input.commands ?? [],
-      cwd: input.cwd,
-      ports: input.ports ?? [],
-      groups: input.groups ?? [],
-      description: input.description,
-      docsPath: input.docsPath,
-      url: input.url,
-      localUrls: input.localUrls ?? [],
-      openapiUrl: input.openapiUrl,
-      git: input.git,
-      meta: input.meta,
-      env: {},
-      envSecrets: [],
-      runner: input.runner ?? "native",
-      dockerConfig: input.dockerConfig,
-      healthCheck: input.healthCheck,
-      parserIds: input.parserIds ?? [],
-      shortcuts: input.shortcuts ?? [],
-      logSources: input.logSources ?? [],
-      autoRestart: input.autoRestart ?? false,
-      restartBackoffMs: input.restartBackoffMs ?? 1e3,
-      ...input.restartStrategy !== void 0 && { restartStrategy: input.restartStrategy },
-      ...input.maxRestarts !== void 0 && { maxRestarts: input.maxRestarts },
-      clearLogsOnStart: input.clearLogsOnStart ?? false
-    };
-    this.services.set(service.id, service);
-    if (project) this.roots.set(service.id, rootOfProjectRef(project));
-    await this.save();
-    this.notify();
-    return service;
-  }
-  async update(input) {
-    await this.load();
-    const existing = this.services.get(input.id);
-    if (!existing) return null;
-    const updated = {
-      ...existing,
-      ...input.agentId !== void 0 && { agentId: input.agentId ?? void 0 },
-      ...input.name !== void 0 && { name: input.name },
-      ...input.commands !== void 0 && { commands: input.commands },
-      ...input.cwd !== void 0 && { cwd: input.cwd ?? void 0 },
-      ...input.ports !== void 0 && { ports: input.ports },
-      ...input.groups !== void 0 && { groups: input.groups },
-      ...input.description !== void 0 && { description: input.description },
-      ...input.docsPath !== void 0 && { docsPath: input.docsPath },
-      ...input.url !== void 0 && { url: input.url },
-      ...input.localUrls !== void 0 && { localUrls: input.localUrls },
-      ...input.openapiUrl !== void 0 && { openapiUrl: input.openapiUrl },
-      ...input.git !== void 0 && { git: input.git ?? void 0 },
-      ...input.meta !== void 0 && { meta: input.meta ?? void 0 },
-      ...input.runner !== void 0 && { runner: input.runner },
-      ...input.dockerConfig !== void 0 && { dockerConfig: input.dockerConfig },
-      ...input.healthCheck !== void 0 && { healthCheck: input.healthCheck ?? void 0 },
-      ...input.autoRestart !== void 0 && { autoRestart: input.autoRestart },
-      ...input.clearLogsOnStart !== void 0 && { clearLogsOnStart: input.clearLogsOnStart },
-      ...input.restartBackoffMs !== void 0 && { restartBackoffMs: input.restartBackoffMs },
-      ...input.restartStrategy !== void 0 && { restartStrategy: input.restartStrategy },
-      ...input.maxRestarts !== void 0 && { maxRestarts: input.maxRestarts },
-      ...input.orgId !== void 0 && { orgId: input.orgId },
-      ...input.shortcuts !== void 0 && { shortcuts: input.shortcuts },
-      ...input.parserIds !== void 0 && { parserIds: input.parserIds },
-      ...input.logSources !== void 0 && { logSources: input.logSources }
-    };
-    this.services.set(input.id, updated);
-    await this.save();
-    this.notify();
-    return updated;
-  }
-  async delete(id) {
-    await this.load();
-    if (!this.services.has(id)) return false;
-    this.services.delete(id);
-    recordLocalRemoval("services", id);
-    await this.save();
-    this.notify();
-    await environmentStore.deleteByReference(id);
-    return true;
-  }
-  // ---- Cloud sync ------------------------------------------------------
-  /** The services of a project, in their on-disk form (what the cloud mirrors). */
-  async listSanitizedByIds(ids) {
-    await this.load();
-    const out = [];
-    for (const id of ids) {
-      const service = this.services.get(id);
-      if (service) out.push(prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)));
-    }
-    return out;
-  }
-  /**
-   * Apply a service received from the cloud, in its on-disk form.
-   *
-   * Validated rather than trusted: a peer running a different version — or a
-   * tampered doc — must not be able to write arbitrary shapes into
-   * `services.json`. Diff-guarded against the on-disk form so re-applying an
-   * identical service neither saves nor notifies (loop-safe).
-   */
-  async applyRemoteUpsert(id, fields, vault, projectId) {
-    await this.load();
-    if (vault) this.remoteOrgs.set(id, vault);
-    if (vault && projectId && !this.roots.has(id)) this.roots.set(id, projectVaultRoot(vault, projectId));
-    const parsed = ServiceConfigSchema.safeParse({ ...fields, id });
-    if (!parsed.success) {
-      console.error("[service-store] Rejected remote service %s:", id, parsed.error.message);
-      return { created: false };
-    }
-    const incoming = parsed.data;
-    const existing = this.services.get(id);
-    if (existing) {
-      const currentDisk = prepareForDisk(existing, this.diskForm.get(id), vault ?? this.vaultOf(id));
-      if (JSON.stringify(currentDisk) === JSON.stringify(incoming)) return { created: false };
-    }
-    this.diskForm.set(id, incoming);
-    this.services.set(id, {
-      ...incoming,
-      // The doc carries the on-disk form, where credentials are ciphertext;
-      // in memory they are expected in the clear, as `load()` keeps them.
-      logSources: decryptLogSources(incoming.logSources ?? [], vault ?? this.vaultOf(id))
-    });
-    await this.save();
-    this.notify();
-    return { created: !existing };
-  }
-  /** Delete a service that was removed on another peer. */
-  async applyRemoteDelete(id) {
-    await this.load();
-    if (!this.services.has(id)) return false;
-    this.services.delete(id);
-    this.diskForm.delete(id);
-    await this.save();
-    this.notify();
-    await environmentStore.deleteByReference(id);
-    return true;
-  }
-};
-var serviceStore = new ServiceStore();
-
 // ../server/src/services/agent-spawner.ts
 import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { fileURLToPath } from "url";
 
 // ../server/src/services/instance-registry.ts
-import { mkdir as mkdir2, readdir, readFile as readFile4, writeFile as writeFile2, rm as rm3 } from "fs/promises";
+import { mkdir as mkdir2, readdir, readFile as readFile2, writeFile as writeFile2, rm } from "fs/promises";
 import { readFileSync } from "fs";
 import dotenv from "dotenv";
 import { spawn } from "child_process";
-import { join as join4 } from "path";
+import { join as join2 } from "path";
 import { z } from "zod";
 var InstanceFileSchema = z.object({
   pid: z.number().int().positive(),
@@ -1753,10 +344,10 @@ var InstanceFileSchema = z.object({
   needsSecretEnv: z.boolean().optional()
 });
 function registryDir() {
-  return join4(machineRoot(), "instances");
+  return join2(machineRoot(), "instances");
 }
 function fileFor(pid) {
-  return join4(registryDir(), `${pid}.json`);
+  return join2(registryDir(), `${pid}.json`);
 }
 var published = null;
 var SECRET_ENV_KEYS = ["RUNEYA_ENCRYPTION_KEY", "RUNEYA_MASTER_PASSWORD"];
@@ -1776,7 +367,7 @@ function secretsAreReproducible() {
   if (present.length === 0) return true;
   let fromFile;
   try {
-    fromFile = dotenv.parse(readFileSync(join4(process.cwd(), ".env")));
+    fromFile = dotenv.parse(readFileSync(join2(process.cwd(), ".env")));
   } catch {
     return false;
   }
@@ -1810,7 +401,7 @@ async function registerInstance() {
   }
 }
 async function unregisterInstance() {
-  await rm3(fileFor(process.pid), { force: true }).catch(() => {
+  await rm(fileFor(process.pid), { force: true }).catch(() => {
   });
 }
 async function setInstanceAgentPid(agentPid) {
@@ -1851,12 +442,12 @@ async function listInstances() {
   }
   const found = await Promise.all(
     files.filter((f) => f.endsWith(".json")).map(async (name) => {
-      const path = join4(registryDir(), name);
+      const path = join2(registryDir(), name);
       let record;
       try {
-        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile4(path, "utf8")));
+        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile2(path, "utf8")));
         if (!parsed.success) {
-          await rm3(path, { force: true }).catch(() => {
+          await rm(path, { force: true }).catch(() => {
           });
           return null;
         }
@@ -1865,13 +456,13 @@ async function listInstances() {
         return null;
       }
       if (!isProcessAlive(record.pid)) {
-        await rm3(path, { force: true }).catch(() => {
+        await rm(path, { force: true }).catch(() => {
         });
         return null;
       }
       const { ok, uptimeMs, version } = await probe(record.port);
       if (!ok) {
-        await rm3(path, { force: true }).catch(() => {
+        await rm(path, { force: true }).catch(() => {
         });
         return null;
       }
@@ -1939,7 +530,7 @@ async function killInstance(pid) {
   const agent = target.agentPid ? await terminate(target.agentPid) : "absent";
   const server = await terminate(pid);
   if (server === "terminated" || server === "killed") {
-    await rm3(fileFor(pid), { force: true }).catch(() => {
+    await rm(fileFor(pid), { force: true }).catch(() => {
     });
   }
   return { agent, server };
@@ -2169,7 +760,7 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join5(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentDistPath = env.AGENT_BINARY_PATH || join3(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
     this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"],
@@ -2279,7 +870,7 @@ var AgentSpawner = class {
       this.fileWatcher.close();
     }
     console.log("[agent-spawner] \u{1F50D} Watching agent dist for changes (hot reload enabled)");
-    const distDir = join5(this.agentDistPath, "..");
+    const distDir = join3(this.agentDistPath, "..");
     this.fileWatcher = watch(distDir, { persistent: false }, (eventType, filename) => {
       if ((eventType === "change" || eventType === "rename") && filename === "index.js" && !this.isRestarting) {
         this.isRestarting = true;
@@ -3064,49 +1655,6 @@ var AgentManager = class extends EventEmitter2 {
 var agentManager = new AgentManager();
 
 export {
-  isCiMode,
-  loadFromEnv,
-  setPendingLegacyKey,
-  getPendingLegacyKey,
-  clearPendingLegacyKey,
-  hasPendingLegacyKey,
-  setEncryptionKeyInMemory,
-  onVaultUnlocked,
-  clearEncryptionKey,
-  hasEncryptionKey,
-  getEncryptionKey,
-  markVaultLocked,
-  isVaultLocked,
-  clearVaultLock,
-  ensureEncryptionKey,
-  setEncryptionKey,
-  encryptValue,
-  decryptValue,
-  stableEncryptValue,
-  encryptVariableSlots,
-  decryptVariableSlots,
-  extractEncryptedVariableSlots,
-  isEncryptedValue,
-  StoreDiskCoordinator,
-  projectKey,
-  AmbiguousProjectError,
-  registerProjectLoader,
-  ensureProjectsLoaded,
-  setProjectVault,
-  forgetProject,
-  setProjectServices,
-  rootOfProjectRef,
-  refsOfProjectId,
-  rootOfProjectAmong,
-  refOfProjectAmong,
-  recordLocalRemoval,
-  isLocallyRemoved,
-  clearLocalRemoval,
-  recordDetached,
-  isDetached,
-  clearDetached,
-  environmentStore,
-  serviceStore,
   agentStore,
   registerInstance,
   unregisterInstance,
@@ -3118,4 +1666,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-KV4GJKXU.js.map
+//# sourceMappingURL=chunk-5XG3X2TM.js.map