@runeya/runeya 2.0.146 → 2.0.148

package/chunk-DFPZ4MTI.js

@@ -0,0 +1,1041 @@
+import {
+  decryptValueWith,
+  encryptValueWith
+} from "./chunk-OZBSOSAS.js";
+import {
+  atomicWriteSecure,
+  fingerprintFiles,
+  hasChangedSinceRead,
+  rememberFile,
+  wasRead
+} from "./chunk-4LJQIQMN.js";
+import {
+  allVaultRoots,
+  localVaultRoot,
+  vaultFor,
+  vaultIdOfRoot
+} from "./chunk-VPSQJOSN.js";
+import {
+  CreateEnvironmentSchema,
+  EnvironmentSchema
+} from "./chunk-MZSDTA4A.js";
+
+// ../server/src/services/store-disk-coordinator.ts
+import { AsyncLocalStorage } from "async_hooks";
+var insideReload = new AsyncLocalStorage();
+var StoreDiskCoordinator = class {
+  reloading = null;
+  saves = 0;
+  queue = Promise.resolve();
+  /**
+   * `read` rend de quoi substituer le nouvel état, ou `null` s'il n'y a rien à
+   * relire. La substitution doit être synchrone : c'est ce qui la rend atomique.
+   */
+  load(read) {
+    const inside = insideReload.getStore();
+    if (inside && (inside.has(this) || this.reloading)) return Promise.resolve();
+    this.reloading ??= this.reload(read).finally(() => {
+      this.reloading = null;
+    });
+    return this.reloading;
+  }
+  async reload(read) {
+    for (; ; ) {
+      await this.queue;
+      const savesBefore = this.saves;
+      const outer = insideReload.getStore() ?? /* @__PURE__ */ new Set();
+      const commit = await insideReload.run(/* @__PURE__ */ new Set([...outer, this]), read);
+      if (!commit) return;
+      if (this.saves !== savesBefore) continue;
+      commit();
+      return;
+    }
+  }
+  save(write) {
+    this.saves += 1;
+    const run = this.queue.then(write);
+    this.queue = run.catch(() => {
+    });
+    return run;
+  }
+};
+
+// ../server/src/services/project-key.ts
+function projectKey(ref) {
+  return `${ref.orgId ?? "local"}:${ref.id}`;
+}
+var AmbiguousProjectError = class extends Error {
+  constructor(projectId, orgIds) {
+    const where = orgIds.map((o) => o ?? "local").join(", ");
+    super(
+      `Project id ${projectId} exists in several organizations (${where}). Name the organization alongside the project id.`
+    );
+    this.projectId = projectId;
+    this.orgIds = orgIds;
+    this.name = "AmbiguousProjectError";
+  }
+  code = "AMBIGUOUS_PROJECT_ID";
+};
+
+// ../server/src/services/vault-registry.ts
+var loadProjects = null;
+var projectRoots = /* @__PURE__ */ new Map();
+var projectRefs = /* @__PURE__ */ new Map();
+var serviceOwners = /* @__PURE__ */ new Map();
+function registerProjectLoader(load) {
+  loadProjects = load;
+}
+async function ensureProjectsLoaded() {
+  await loadProjects?.();
+}
+function setProjectVault(ref, root) {
+  const key = projectKey(ref);
+  projectRoots.set(key, root);
+  projectRefs.set(key, { id: ref.id, orgId: ref.orgId ?? null });
+}
+function forgetProject(ref) {
+  const key = projectKey(ref);
+  projectRoots.delete(key);
+  projectRefs.delete(key);
+  for (const [serviceId, owners] of serviceOwners) {
+    owners.delete(key);
+    if (owners.size === 0) serviceOwners.delete(serviceId);
+  }
+}
+function setProjectServices(ref, serviceIds) {
+  const key = projectKey(ref);
+  for (const [serviceId, owners] of serviceOwners) {
+    if (!serviceIds.includes(serviceId)) {
+      owners.delete(key);
+      if (owners.size === 0) serviceOwners.delete(serviceId);
+    }
+  }
+  for (const serviceId of serviceIds) {
+    const owners = serviceOwners.get(serviceId) ?? /* @__PURE__ */ new Set();
+    owners.add(key);
+    serviceOwners.set(serviceId, owners);
+  }
+}
+function rootOfProjectRef(ref) {
+  return projectRoots.get(projectKey(ref)) ?? localVaultRoot();
+}
+function refsOfProjectId(projectId) {
+  const matches = [];
+  for (const ref of projectRefs.values()) {
+    if (ref.id === projectId) matches.push(ref);
+  }
+  return matches;
+}
+function rootOfProjectAmong(projectId, hint) {
+  const matches = refsOfProjectId(projectId);
+  if (matches.length > 1) {
+    const known = matches.map((ref2) => rootOfProjectRef(ref2));
+    if (hint && known.includes(hint)) return hint;
+    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
+  }
+  const [ref] = matches;
+  return ref ? rootOfProjectRef(ref) : hint ?? localVaultRoot();
+}
+function refOfProjectAmong(projectId, hint) {
+  const matches = refsOfProjectId(projectId);
+  if (matches.length > 1) {
+    const found = hint ? matches.find((ref) => rootOfProjectRef(ref) === hint) : void 0;
+    if (found) return found;
+    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
+  }
+  return matches[0] ?? { id: projectId, orgId: null };
+}
+function rootOfService(serviceId, hint = null) {
+  const owners = serviceOwners.get(serviceId);
+  if (!owners || owners.size === 0) return hint ?? localVaultRoot();
+  const roots = Array.from(owners, (key) => projectRoots.get(key)).filter((r) => !!r);
+  if (hint && roots.includes(hint)) return hint;
+  return roots[0] ?? hint ?? localVaultRoot();
+}
+
+// ../server/src/services/local-removals.ts
+var removed = /* @__PURE__ */ new Map();
+var detached = /* @__PURE__ */ new Map();
+var linkKey = (projectId, field) => `${projectId}:${field}`;
+function recordLocalRemoval(kind, id) {
+  const ids = removed.get(kind) ?? /* @__PURE__ */ new Set();
+  ids.add(id);
+  removed.set(kind, ids);
+}
+function isLocallyRemoved(kind, id) {
+  return removed.get(kind)?.has(id) ?? false;
+}
+function clearLocalRemoval(kind, id) {
+  removed.get(kind)?.delete(id);
+}
+function recordDetached(projectId, field, before, after) {
+  const kept = new Set(after);
+  const gone = before.filter((id) => !kept.has(id));
+  if (gone.length === 0) return;
+  const key = linkKey(projectId, field);
+  const ids = detached.get(key) ?? /* @__PURE__ */ new Set();
+  for (const id of gone) ids.add(id);
+  detached.set(key, ids);
+}
+function isDetached(projectId, field, id) {
+  return detached.get(linkKey(projectId, field))?.has(id) ?? false;
+}
+function clearDetached(projectId, field) {
+  detached.delete(linkKey(projectId, field));
+}
+
+// ../server/src/services/environment-store.ts
+import { randomUUID } from "crypto";
+import { readFile, rm } from "fs/promises";
+import { join } from "path";
+
+// ../server/src/utils/encryption-key.ts
+import { createHash } from "crypto";
+var KEY_SIZE_BYTES = 32;
+var DEFAULT_VAULT = "\0default";
+var keyring = /* @__PURE__ */ new Map();
+var lockedVaults = /* @__PURE__ */ new Set();
+var _ciMode = false;
+var _pendingLegacyKey = null;
+function isCiMode() {
+  return _ciMode;
+}
+async function loadFromEnv() {
+  const keyHex = process.env["RUNEYA_ENCRYPTION_KEY"];
+  if (!keyHex) return false;
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {
+    throw new Error("RUNEYA_ENCRYPTION_KEY invalide : attendu 64 caract\xE8res hex");
+  }
+  console.log("");
+  console.log("\u26A0 ATTENTION : RUNEYA_ENCRYPTION_KEY est d\xE9fini \u2014 l'authentification par master password est d\xE9sactiv\xE9e.");
+  console.log("  Cette variable d'environnement est r\xE9serv\xE9e aux environnements CI/CD.");
+  console.log("  Ne la d\xE9finissez jamais sur une machine de d\xE9veloppement.");
+  console.log("");
+  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
+  _ciMode = true;
+  return true;
+}
+function setPendingLegacyKey(key) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  _pendingLegacyKey = key;
+}
+function getPendingLegacyKey() {
+  return _pendingLegacyKey;
+}
+function clearPendingLegacyKey() {
+  _pendingLegacyKey = null;
+}
+function hasPendingLegacyKey() {
+  return _pendingLegacyKey !== null;
+}
+function setEncryptionKeyInMemory(key, vault = DEFAULT_VAULT) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  keyring.set(vault, key);
+  lockedVaults.delete(vault);
+  announceUnlock();
+}
+var unlockListeners = /* @__PURE__ */ new Set();
+function onVaultUnlocked(listener) {
+  unlockListeners.add(listener);
+  return () => unlockListeners.delete(listener);
+}
+function announceUnlock() {
+  for (const listener of unlockListeners) {
+    try {
+      listener();
+    } catch {
+    }
+  }
+}
+function clearEncryptionKey(vault) {
+  if (vault === void 0) {
+    keyring.clear();
+    lockedVaults.clear();
+  } else {
+    keyring.delete(vault);
+  }
+}
+function hasEncryptionKey(vault = DEFAULT_VAULT) {
+  return keyring.has(vault);
+}
+function getEncryptionKey(vault = DEFAULT_VAULT) {
+  const own = keyring.get(vault);
+  if (own) return own;
+  if (vault === DEFAULT_VAULT || lockedVaults.has(vault)) return null;
+  return keyring.get(DEFAULT_VAULT) ?? null;
+}
+function markVaultLocked(vault) {
+  lockedVaults.add(vault);
+  keyring.delete(vault);
+}
+function isVaultLocked(vault) {
+  return lockedVaults.has(vault);
+}
+function clearVaultLock(vault) {
+  lockedVaults.delete(vault);
+}
+function deriveStableSecret(purpose, vault = DEFAULT_VAULT) {
+  const key = getEncryptionKey(vault);
+  if (!key) return null;
+  return createHash("sha256").update(key).update(purpose).digest("hex");
+}
+async function ensureEncryptionKey() {
+  return getEncryptionKey();
+}
+async function setEncryptionKey(keyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error("Invalid key format");
+  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
+}
+
+// ../server/src/services/vault-conflicts.ts
+var conflicted = /* @__PURE__ */ new Map();
+function isVaultClash(root, heldIn) {
+  return heldIn !== void 0 && heldIn !== root && heldIn !== localVaultRoot();
+}
+function markVaultConflict(root, detail) {
+  if (conflicted.has(root)) return;
+  conflicted.set(root, detail);
+  console.error(
+    "[vaults] %s partage des identifiants avec un autre coffre (%s) \u2014 son contenu est ignor\xE9 et laiss\xE9 intact. Cessez de suivre l'un des deux projets.",
+    root,
+    detail
+  );
+}
+function isVaultConflicted(root) {
+  return conflicted.has(root);
+}
+
+// ../server/src/services/crypto-helpers.ts
+function encryptValue(plaintext, vault) {
+  return encryptValueWith(requireKey(vault), plaintext);
+}
+function decryptValue(encrypted, vault) {
+  return decryptValueWith(requireKey(vault), encrypted);
+}
+function requireKey(vault) {
+  const key = getEncryptionKey(vault);
+  if (!key) {
+    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
+  }
+  return key;
+}
+function stableEncryptValue(plaintext, existingEncrypted, vault) {
+  if (existingEncrypted) {
+    try {
+      if (decryptValue(existingEncrypted, vault) === plaintext) return existingEncrypted;
+    } catch {
+    }
+  }
+  return encryptValue(plaintext, vault);
+}
+function encryptVariableSlots(variables, existingEncrypted, vault) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key], vault) } };
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function decryptVariableSlots(variables, contextLabel, onFailure, vault) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      try {
+        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value, vault) } };
+      } catch (err) {
+        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message} \u2014 la valeur chiffr\xE9e est conserv\xE9e telle quelle sur le disque`);
+        onFailure?.(key);
+        result[key] = { ...variable, value: { ...slot, value: "" } };
+      }
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function extractEncryptedVariableSlots(variables) {
+  const slots = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    if (variable.value?.isSecret && variable.value?.value) {
+      slots[key] = variable.value.value;
+    }
+  }
+  return slots;
+}
+function isEncryptedValue(s) {
+  const parts = s.split(":");
+  return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);
+}
+
+// ../server/src/services/environment-store.ts
+var FILENAME = "environments.json";
+var EnvironmentStore = class {
+  environments = /* @__PURE__ */ new Map();
+  loaded = false;
+  /** Cache of encrypted secret values as last written to disk */
+  diskEncryptedSlots = /* @__PURE__ */ new Map();
+  /**
+   * Les secrets qu'aucune clé chargée n'a ouverts, par environnement.
+   *
+   * Vides en mémoire, ils doivent repartir sur le disque sous leur forme
+   * chiffrée : c'est ce que retient cette liste. Voir `keepUnreadableSecrets`.
+   */
+  unreadableSecrets = /* @__PURE__ */ new Map();
+  /**
+   * Coffres dont le fichier a bougé depuis la lecture.
+   *
+   * On ne les réécrit pas. Ni avec notre copie — elle décrirait l'état d'avant
+   * la réparation — ni sans elle, ce qui effacerait les secrets qu'elle
+   * protège. Entre les deux, la seule issue sûre est de ne pas toucher au
+   * fichier et de laisser le prochain chargement faire foi.
+   */
+  staleRoots = /* @__PURE__ */ new Set();
+  /**
+   * L'état du disque au dernier chargement — voir `ProjectStore.fingerprint`.
+   *
+   * `staleRoots` dit « ne réécris pas ce fichier, il a bougé » ; celui-ci dit
+   * « relis-le ». Les deux vont ensemble : refuser d'écrire protège le travail
+   * de l'autre instance, mais tant que la mémoire n'est pas reprise, l'écriture
+   * refusée l'est pour toujours et la modification de l'utilisateur se perd.
+   */
+  fingerprint = "";
+  disk = new StoreDiskCoordinator();
+  listeners = /* @__PURE__ */ new Set();
+  /** Notified after every persisted mutation, for the cloud sync bridge. */
+  onChange(fn) {
+    this.listeners.add(fn);
+    return () => this.listeners.delete(fn);
+  }
+  notify() {
+    for (const fn of this.listeners) fn();
+  }
+  /**
+   * Which vault each environment was read from, so a save puts it back where it
+   * belongs even before its project has been loaded.
+   */
+  roots = /* @__PURE__ */ new Map();
+  /** L'organisation d'où vient un environnement reçu du cloud — voir `vaultOf`. */
+  remoteOrgs = /* @__PURE__ */ new Map();
+  /**
+   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
+   *
+   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
+   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
+   * qui n'existe plus. La laisser en place n'affichait pas seulement des
+   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
+   * par-dessus le nouveau, et défaisait l'adoption.
+   */
+  resetCache() {
+    this.environments.clear();
+    this.diskEncryptedSlots.clear();
+    this.unreadableSecrets.clear();
+    this.roots.clear();
+    this.remoteOrgs.clear();
+    this.loaded = false;
+    this.notify();
+  }
+  /**
+   * Combien de secrets ce coffre garde chiffrés sans savoir les ouvrir, par
+   * organisation (`null` pour la machine).
+   *
+   * Ils sont déjà préservés à l'écriture (`keepUnreadableSecrets`) ; ce qui
+   * manquait, c'est de le dire. Un secret qui s'affiche vide et se sauvegarde
+   * intact est rassurant sur le disque et déroutant à l'écran.
+   */
+  async unreadableByVault() {
+    await this.load();
+    const out = /* @__PURE__ */ new Map();
+    for (const [environmentId, failed] of this.unreadableSecrets) {
+      if (!failed.size) continue;
+      const environment = this.environments.get(environmentId);
+      const vault = (environment ? this.vaultOf(environment) : void 0) ?? null;
+      out.set(vault, (out.get(vault) ?? 0) + failed.size);
+    }
+    return out;
+  }
+  getFilePath(root) {
+    return join(root, FILENAME);
+  }
+  /**
+   * The vault an environment must be written to: its project's.
+   *
+   * An environment names its project by id alone, and that id can answer for a
+   * project in each organization. The vault it was read from names the couple —
+   * so it is handed over as the tie-breaker rather than left as a mere fallback.
+   *
+   * Falls back to where it was last read, then to the local vault — an
+   * environment whose project is unknown belongs to the launch directory, which
+   * is where it lived before vaults existed.
+   */
+  /**
+   * La clé sous laquelle chiffrer cet environnement.
+   *
+   * La provenance l'emporte sur le coffre tant que le projet n'est pas local :
+   * un environnement reçu du cloud arrive avant lui, et `rootFor` désignerait
+   * alors le répertoire de lancement — donc la clé de la machine plutôt que
+   * celle de l'organisation qui a chiffré ces secrets.
+   */
+  vaultOf(environment) {
+    return this.remoteOrgs.get(environment.id) ?? vaultIdOfRoot(this.rootFor(environment));
+  }
+  rootFor(environment) {
+    const known = this.roots.get(environment.id) ?? null;
+    const projectRoot = environment.projectId ? rootOfProjectAmong(environment.projectId, known) : null;
+    return projectRoot ?? known ?? localVaultRoot();
+  }
+  /**
+   * Le projet d'un environnement, organisation comprise.
+   *
+   * L'environnement ne nomme que l'id ; le coffre d'où il vient fournit
+   * l'organisation, et c'est ce couple qu'il faut pour agir sur son projet.
+   */
+  projectRefOf(environment) {
+    if (!environment.projectId) return null;
+    return refOfProjectAmong(environment.projectId, this.roots.get(environment.id) ?? null);
+  }
+  /**
+   * The vault holding the environment that defines a variable.
+   *
+   * Overrides answer a variable, not a project: this is what lets them find the
+   * same vault without re-resolving an id that may be ambiguous.
+   */
+  async rootOfVariable(variableId) {
+    await this.load();
+    for (const environment of this.environments.values()) {
+      if (environment.variables && variableId in environment.variables) {
+        return this.rootFor(environment);
+      }
+    }
+    return null;
+  }
+  extractEncryptedCache(environment) {
+    const envSlots = extractEncryptedVariableSlots(
+      environment.variables
+    );
+    return { envSlots };
+  }
+  /**
+   * `vault` est fourni quand l'appelant sait à qui appartient l'environnement
+   * mieux que le disque : à l'arrivée d'une entité distante, son projet n'est
+   * pas encore local, et le coffre déduit serait celui du répertoire de
+   * lancement — donc la mauvaise clé.
+   */
+  encryptEnvironment(environment, vault) {
+    const cache = this.diskEncryptedSlots.get(environment.id);
+    let encryptedVars = environment.variables;
+    if (environment.variables && Object.keys(environment.variables).length > 0) {
+      encryptedVars = encryptVariableSlots(
+        environment.variables,
+        cache?.envSlots,
+        // La clé est celle du coffre où l'environnement sera écrit : les
+        // secrets d'une organisation sont chiffrés par la sienne.
+        vault ?? this.vaultOf(environment)
+      );
+    }
+    return { ...environment, variables: this.keepUnreadableSecrets(environment.id, encryptedVars) };
+  }
+  /**
+   * Réécrire un secret illisible tel qu'il est sur le disque, jamais à blanc.
+   *
+   * Un secret qui ne s'ouvre pas est vide en mémoire (voir
+   * `decryptVariableSlots`) : le chiffrer donnerait un chiffré de la chaîne
+   * vide, et la sauvegarde effacerait pour de bon une valeur dont il ne
+   * manquait que la clé. Son chiffré d'origine est encore là — c'est celui que
+   * `diskEncryptedSlots` a mis de côté avant le déchiffrement — et c'est lui
+   * qui repart sur le disque.
+   *
+   * La condition tient à la valeur en mémoire : tant qu'elle est vide, la
+   * variable n'a pas été retouchée et son chiffré fait foi. Dès que
+   * l'utilisateur en saisit une nouvelle, elle l'emporte — et vider un secret
+   * volontairement reste possible, puisque cela ne concerne que les variables
+   * dont le déchiffrement a échoué.
+   */
+  keepUnreadableSecrets(environmentId, variables) {
+    const failed = this.unreadableSecrets.get(environmentId);
+    if (!failed?.size || !variables) return variables;
+    const onDisk = this.diskEncryptedSlots.get(environmentId)?.envSlots ?? {};
+    const result = { ...variables };
+    for (const variableId of failed) {
+      const ciphertext = onDisk[variableId];
+      const variable = result[variableId];
+      if (!ciphertext || !variable || variable.value.value) continue;
+      result[variableId] = { ...variable, value: { ...variable.value, value: ciphertext } };
+    }
+    return result;
+  }
+  decryptEnvironment(environment, vault, unreadable = this.unreadableSecrets) {
+    let decryptedVars = environment.variables;
+    if (environment.variables && Object.keys(environment.variables).length > 0) {
+      const failed = /* @__PURE__ */ new Set();
+      decryptedVars = decryptVariableSlots(
+        environment.variables,
+        `environment ${environment.id}`,
+        (variableId) => failed.add(variableId),
+        vault ?? this.vaultOf(environment)
+      );
+      if (failed.size > 0) unreadable.set(environment.id, failed);
+      else unreadable.delete(environment.id);
+    }
+    return { ...environment, variables: decryptedVars };
+  }
+  /** Ce que le disque porte : un fichier d'environnements par coffre. */
+  async diskFingerprint() {
+    return fingerprintFiles((await allVaultRoots()).map((root) => this.getFilePath(root)));
+  }
+  /**
+   * Read every vault — the launch directory and each materialized cloud project.
+   *
+   * The roots come from the disk rather than from the project store, so loading
+   * environments never has to wait on projects being loaded first (the project
+   * store reads environments while absorbing a project, which would deadlock).
+   */
+  async load() {
+    await this.disk.load(async () => {
+      const fingerprint = await this.diskFingerprint();
+      if (this.loaded && fingerprint === this.fingerprint) return null;
+      await ensureProjectsLoaded();
+      if (!getEncryptionKey()) return null;
+      const next = await this.readVaults();
+      return () => {
+        this.environments = next.environments;
+        this.diskEncryptedSlots = next.diskEncryptedSlots;
+        this.roots = next.roots;
+        this.unreadableSecrets = next.unreadableSecrets;
+        this.fingerprint = fingerprint;
+        this.loaded = true;
+      };
+    });
+  }
+  /** Lire tous les coffres dans des tables neuves, que `load` substitue d'un coup. */
+  async readVaults() {
+    const environments = /* @__PURE__ */ new Map();
+    const diskEncryptedSlots = /* @__PURE__ */ new Map();
+    const roots = /* @__PURE__ */ new Map();
+    const unreadableSecrets = /* @__PURE__ */ new Map();
+    for (const root of await allVaultRoots()) {
+      try {
+        const raw = await readFile(this.getFilePath(root), "utf-8");
+        await rememberFile(this.getFilePath(root));
+        const data = JSON.parse(raw);
+        const clash = data.find((e) => isVaultClash(root, roots.get(e.id)));
+        if (clash) {
+          markVaultConflict(root, `environnement ${clash.id}`);
+          continue;
+        }
+        for (const e of data) {
+          diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
+          roots.set(e.id, root);
+          environments.set(e.id, this.decryptEnvironment(e, vaultIdOfRoot(root), unreadableSecrets));
+        }
+      } catch {
+      }
+    }
+    return { environments, diskEncryptedSlots, roots, unreadableSecrets };
+  }
+  /**
+   * Write each vault that holds — or held — an environment.
+   *
+   * A vault emptied by this save loses its file: an environment that moved to
+   * another vault must not survive in the old one, and a `[]` left behind would
+   * keep (or recreate) a `.runeya` in a directory that holds nothing.
+   */
+  /**
+   * Repérer les coffres réparés sous nos pieds, avant d'écrire.
+   *
+   * Le test est fait ici, une fois par sauvegarde, plutôt que par
+   * environnement : c'est le fichier du coffre qui change, pas la variable.
+   */
+  async markStaleRoots() {
+    this.staleRoots.clear();
+    for (const root of new Set(this.roots.values())) {
+      const path = this.getFilePath(root);
+      if (wasRead(path) && await hasChangedSinceRead(path)) this.staleRoots.add(root);
+    }
+  }
+  save() {
+    return this.disk.save(() => this.writeVaults());
+  }
+  async writeVaults() {
+    await this.markStaleRoots();
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) {
+      if (!isVaultConflicted(root)) byRoot.set(root, []);
+    }
+    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
+    for (const environment of this.environments.values()) {
+      const root = this.rootFor(environment);
+      const prepared = this.encryptEnvironment(environment);
+      this.diskEncryptedSlots.set(prepared.id, this.extractEncryptedCache(prepared));
+      this.roots.set(environment.id, root);
+      if (isVaultConflicted(root)) continue;
+      const bucket = byRoot.get(root);
+      if (bucket) bucket.push(prepared);
+      else byRoot.set(root, [prepared]);
+    }
+    for (const [root, environments] of byRoot) {
+      if (this.staleRoots.has(root)) {
+        console.warn(
+          `[environment-store] ${this.getFilePath(root)} a chang\xE9 depuis sa lecture \u2014 \xE9criture ignor\xE9e pour ne pas \xE9craser une r\xE9paration faite en dehors du serveur.`
+        );
+        continue;
+      }
+      const filePath = this.getFilePath(root);
+      if (environments.length === 0) {
+        await rm(filePath, { force: true }).catch(() => {
+        });
+        continue;
+      }
+      try {
+        await atomicWriteSecure(filePath, JSON.stringify(environments, null, 2));
+      } catch (err) {
+        if (err.code !== "ENOENT") throw err;
+        console.warn(`[environment-store] ${filePath} a disparu pendant l'\xE9criture (projet supprim\xE9 ?) \u2014 coffre ignor\xE9.`);
+        continue;
+      }
+      await rememberFile(filePath);
+    }
+    this.fingerprint = await this.diskFingerprint();
+    this.notify();
+  }
+  /**
+   * Rewrite every vault, moving entities that now belong elsewhere.
+   *
+   * Called once the project store knows where projects live: entities read from
+   * the launch directory whose project turns out to be a cloud one are written
+   * into that project's vault, and disappear from the directory they came from.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
+  }
+  /**
+   * Which project a variable belongs to, by walking the environments that
+   * define it.
+   *
+   * Overrides are keyed by variable id alone — nothing in an override says
+   * which project it belongs to — so this is what lets them be stored with
+   * their project rather than in one machine-wide pile.
+   */
+  /**
+   * Drop a project's environments from memory, without touching the disk.
+   *
+   * Used when a project stops being followed: its vault is removed as a whole,
+   * and environments left in memory would be written back on the next save —
+   * into the local vault, since their project is no longer known.
+   */
+  async forgetByProject(projectId) {
+    await this.load();
+    for (const [id, environment] of this.environments) {
+      if (environment.projectId !== projectId) continue;
+      this.environments.delete(id);
+      this.diskEncryptedSlots.delete(id);
+      this.unreadableSecrets.delete(id);
+      this.roots.delete(id);
+      this.remoteOrgs.delete(id);
+    }
+    this.notify();
+  }
+  /**
+   * Les environnements d'un projet.
+   *
+   * `orgId` restreint au projet de cette organisation : deux projets homonymes
+   * ont chacun les siens, et filtrer sur le seul `projectId` mélangeait les deux
+   * listes à l'écran. Omis, le filtre reste sur l'id — ce que fait un appelant
+   * qui n'a pas d'organisation à donner.
+   */
+  async list(projectId, orgId) {
+    await this.load();
+    return this.ofProject(projectId, orgId);
+  }
+  /** Le filtre commun : l'id, puis le coffre quand l'organisation est connue. */
+  ofProject(projectId, orgId) {
+    const byId = Array.from(this.environments.values()).filter((e) => e.projectId === projectId);
+    if (orgId === void 0) return byId;
+    const root = vaultFor({ id: projectId, orgId }).root;
+    return byId.filter((e) => this.rootFor(e) === root);
+  }
+  async get(id) {
+    await this.load();
+    return this.environments.get(id) ?? null;
+  }
+  /**
+   * `orgId` ne fait pas partie de l'environnement : il dit dans quel coffre le
+   * poser. Un environnement neuf n'a pas encore de provenance, et son
+   * `projectId` seul peut répondre pour un projet de chaque organisation — sans
+   * cette précision, la création échouerait sur l'ambiguïté au lieu de viser le
+   * bon coffre.
+   */
+  async create(input, orgId) {
+    await this.load();
+    const parsed = CreateEnvironmentSchema.parse(input);
+    const environment = {
+      id: randomUUID(),
+      projectId: parsed.projectId,
+      name: parsed.name,
+      description: parsed.description,
+      parentIds: parsed.parentIds,
+      variables: parsed.variables,
+      scope: parsed.scope,
+      reference: parsed.reference,
+      activateOn: parsed.activateOn,
+      immutable: parsed.immutable,
+      default: parsed.default,
+      color: parsed.color,
+      bgColor: parsed.bgColor,
+      agentId: parsed.agentId
+    };
+    if (environment.default) {
+      for (const [id, e] of this.environments) {
+        if (e.projectId === environment.projectId && e.default) {
+          this.environments.set(id, { ...e, default: false });
+        }
+      }
+    }
+    this.environments.set(environment.id, environment);
+    if (environment.projectId && orgId !== void 0) {
+      this.roots.set(environment.id, vaultFor({ id: environment.projectId, orgId }).root);
+    }
+    await this.save();
+    return environment;
+  }
+  async update(input) {
+    await this.load();
+    const existing = this.environments.get(input.id);
+    if (!existing) return null;
+    const updated = {
+      ...existing,
+      // Immutable environments: allow changing variables, color, description — but not name
+      ...!existing.immutable && input.name !== void 0 && { name: input.name },
+      ...input.description !== void 0 && { description: input.description },
+      ...input.parentIds !== void 0 && { parentIds: input.parentIds },
+      ...input.variables !== void 0 && { variables: input.variables },
+      ...input.scope !== void 0 && { scope: input.scope },
+      ...input.reference !== void 0 && { reference: input.reference },
+      ...input.activateOn !== void 0 && { activateOn: input.activateOn },
+      ...input.color !== void 0 && { color: input.color },
+      ...input.bgColor !== void 0 && { bgColor: input.bgColor },
+      ...input.default !== void 0 && { default: input.default },
+      ...input.agentId !== void 0 && { agentId: input.agentId ?? void 0 }
+    };
+    if (updated.default) {
+      for (const [id, e] of this.environments) {
+        if (id !== input.id && e.projectId === updated.projectId && e.default) {
+          this.environments.set(id, { ...e, default: false });
+        }
+      }
+    }
+    this.environments.set(input.id, updated);
+    await this.save();
+    return updated;
+  }
+  async upsertVariable(environmentId, variableId, variable) {
+    const existing = this.environments.get(environmentId);
+    if (!existing) return null;
+    const variables = { ...existing.variables, [variableId]: variable };
+    return this.update({ id: environmentId, variables });
+  }
+  async removeVariable(environmentId, variableId) {
+    const existing = this.environments.get(environmentId);
+    if (!existing) return null;
+    const variables = { ...existing.variables };
+    delete variables[variableId];
+    return this.update({ id: environmentId, variables });
+  }
+  async delete(id) {
+    await this.load();
+    const env = this.environments.get(id);
+    if (!env) return false;
+    if (env.immutable) return false;
+    this.environments.delete(id);
+    recordLocalRemoval("environments", id);
+    await this.save();
+    return true;
+  }
+  async getByProjectId(projectId, orgId) {
+    await this.load();
+    return this.ofProject(projectId, orgId);
+  }
+  async listAllGlobal() {
+    await this.load();
+    return Array.from(this.environments.values()).filter((e) => e.scope === "global");
+  }
+  // --- Scope-based Query Methods ---
+  async listByScope(projectId, scope, orgId) {
+    await this.load();
+    return this.ofProject(projectId, orgId).filter((e) => e.scope === scope);
+  }
+  /** Les environnements de service qui s'activent avec un environnement global. */
+  async listByActivateOn(globalEnvId) {
+    await this.load();
+    return Array.from(this.environments.values()).filter((e) => e.scope === "service" && e.activateOn === globalEnvId);
+  }
+  async findServiceEnvironment(serviceId, globalEnvId) {
+    await this.load();
+    for (const e of this.environments.values()) {
+      if (e.scope === "service" && e.reference === serviceId && e.activateOn === globalEnvId) return e;
+    }
+    return null;
+  }
+  async findServiceEnvironments(serviceId) {
+    await this.load();
+    return Array.from(this.environments.values()).filter((e) => e.scope === "service" && e.reference === serviceId);
+  }
+  async deleteByReference(serviceId) {
+    await this.load();
+    let changed = false;
+    for (const [id, e] of this.environments) {
+      if (e.scope === "service" && e.reference === serviceId) {
+        this.environments.delete(id);
+        recordLocalRemoval("environments", id);
+        changed = true;
+      }
+    }
+    if (changed) await this.save();
+  }
+  async deleteByActivateOn(globalEnvId) {
+    await this.load();
+    let changed = false;
+    for (const [id, e] of this.environments) {
+      if (e.scope === "service" && e.activateOn === globalEnvId) {
+        this.environments.delete(id);
+        recordLocalRemoval("environments", id);
+        changed = true;
+      }
+    }
+    if (changed) await this.save();
+  }
+  /**
+   * When a service is renamed, update the name of all its service-scoped environments
+   * to keep the `${serviceName} (${globalEnvName})` pattern in sync.
+   */
+  async renameByReference(serviceId, newServiceName) {
+    await this.load();
+    let changed = false;
+    for (const [id, e] of this.environments) {
+      if (e.scope === "service" && e.reference === serviceId && e.activateOn) {
+        const globalEnv = this.environments.get(e.activateOn);
+        if (!globalEnv) continue;
+        this.environments.set(id, { ...e, name: `${newServiceName} (${globalEnv.name})` });
+        changed = true;
+      }
+    }
+    if (changed) await this.save();
+  }
+  /**
+   * When a global environment is renamed, update the name of all service-scoped
+   * environments that activateOn it to keep the naming pattern in sync.
+   * Caller provides a serviceId→name map since environmentStore can't access serviceStore.
+   */
+  async renameByActivateOn(globalEnvId, newGlobalName, serviceNames) {
+    await this.load();
+    let changed = false;
+    for (const [id, e] of this.environments) {
+      if (e.scope === "service" && e.activateOn === globalEnvId && e.reference) {
+        const serviceName = serviceNames.get(e.reference);
+        if (!serviceName) continue;
+        this.environments.set(id, { ...e, name: `${serviceName} (${newGlobalName})` });
+        changed = true;
+      }
+    }
+    if (changed) await this.save();
+  }
+  // ---- Cloud sync ------------------------------------------------------
+  /** Environments of the given projects, in their on-disk (encrypted) form. */
+  async listEncryptedByProjectIds(projectIds) {
+    await this.load();
+    const wanted = new Set(projectIds);
+    return Array.from(this.environments.values()).filter((e) => wanted.has(e.projectId)).map((e) => this.encryptEnvironment(e));
+  }
+  /**
+   * Apply an environment received from the cloud, in its on-disk form.
+   *
+   * Validated rather than trusted, and diff-guarded against the on-disk form so
+   * re-applying an identical environment neither saves nor notifies (loop-safe).
+   */
+  async applyRemoteUpsert(id, fields, vault) {
+    await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
+    const parsed = EnvironmentSchema.safeParse({ ...fields, id });
+    if (!parsed.success) {
+      console.error("[environment-store] Rejected remote environment %s:", id, parsed.error.message);
+      return { created: false };
+    }
+    const incoming = parsed.data;
+    const existing = this.environments.get(id);
+    if (existing && JSON.stringify(this.encryptEnvironment(existing, vault)) === JSON.stringify(incoming)) {
+      return { created: false };
+    }
+    this.diskEncryptedSlots.set(id, this.extractEncryptedCache(incoming));
+    this.environments.set(id, this.decryptEnvironment(incoming, vault));
+    await this.save();
+    return { created: !existing };
+  }
+  /** Delete an environment that was removed on another peer. */
+  async applyRemoteDelete(id) {
+    await this.load();
+    if (!this.environments.has(id)) return false;
+    this.environments.delete(id);
+    this.diskEncryptedSlots.delete(id);
+    this.unreadableSecrets.delete(id);
+    this.remoteOrgs.delete(id);
+    await this.save();
+    return true;
+  }
+};
+var environmentStore = new EnvironmentStore();
+
+export {
+  isCiMode,
+  loadFromEnv,
+  setPendingLegacyKey,
+  getPendingLegacyKey,
+  clearPendingLegacyKey,
+  hasPendingLegacyKey,
+  setEncryptionKeyInMemory,
+  onVaultUnlocked,
+  clearEncryptionKey,
+  hasEncryptionKey,
+  getEncryptionKey,
+  markVaultLocked,
+  isVaultLocked,
+  clearVaultLock,
+  deriveStableSecret,
+  ensureEncryptionKey,
+  setEncryptionKey,
+  encryptValue,
+  decryptValue,
+  stableEncryptValue,
+  encryptVariableSlots,
+  decryptVariableSlots,
+  extractEncryptedVariableSlots,
+  isEncryptedValue,
+  StoreDiskCoordinator,
+  projectKey,
+  AmbiguousProjectError,
+  registerProjectLoader,
+  ensureProjectsLoaded,
+  setProjectVault,
+  forgetProject,
+  setProjectServices,
+  rootOfProjectRef,
+  refsOfProjectId,
+  rootOfProjectAmong,
+  refOfProjectAmong,
+  rootOfService,
+  isVaultClash,
+  markVaultConflict,
+  isVaultConflicted,
+  recordLocalRemoval,
+  isLocallyRemoved,
+  clearLocalRemoval,
+  recordDetached,
+  isDetached,
+  clearDetached,
+  environmentStore
+};
+//# sourceMappingURL=chunk-DFPZ4MTI.js.map