@runeya/runeya 2.0.146 → 2.0.148

package/chunk-WDHLEO5S.js

@@ -0,0 +1,809 @@
+import {
+  StoreDiskCoordinator,
+  decryptVariableSlots,
+  encryptVariableSlots,
+  ensureProjectsLoaded,
+  environmentStore,
+  extractEncryptedVariableSlots,
+  getEncryptionKey
+} from "./chunk-DFPZ4MTI.js";
+import {
+  fingerprintFiles,
+  renameWithRetry
+} from "./chunk-4LJQIQMN.js";
+import {
+  allVaultRoots,
+  keyedFilePath,
+  legacyMachineFilePath,
+  vaultIdOfRoot
+} from "./chunk-VPSQJOSN.js";
+import {
+  MASKED_VALUE,
+  isSharedWithAi
+} from "./chunk-MZSDTA4A.js";
+
+// ../server/src/services/environment-overrides-store.ts
+import { readFile, writeFile, mkdir, chmod } from "fs/promises";
+import { dirname, join } from "path";
+var FILENAME = "environment-overrides.json";
+var EnvironmentOverridesStore = class {
+  data = {};
+  loaded = false;
+  /**
+   * Le coordinateur partagé par les stores : un seul rechargement à la fois,
+   * jamais pendant une écriture, et une substitution atomique à la fin.
+   *
+   * Ce store faisait sa propre cuisine et se marquait « chargé » avant ses
+   * `await` : toute lecture concurrente repartait avec une table vide — une
+   * surcharge déjà écrite paraissait absente, et l'assistant réclamait au
+   * déverrouillage des variables que ce poste avait déjà renseignées.
+   */
+  disk = new StoreDiskCoordinator();
+  /** Ce que le disque portait au dernier chargement (cf. `load`). */
+  fingerprint = "";
+  diskEncryptedSlots = {};
+  /**
+   * Les surcharges dont le secret ne s'est pas ouvert.
+   *
+   * Vides en mémoire, elles doivent repartir chiffrées : sans cela, la
+   * sauvegarde suivante remplacerait par du blanc une valeur dont il ne
+   * manquait que la clé.
+   */
+  unreadableSecrets = /* @__PURE__ */ new Set();
+  /** Which vault each override was read from, until its project is known. */
+  roots = /* @__PURE__ */ new Map();
+  /**
+   * An override belongs to the project whose variable it answers.
+   *
+   * Nothing in an override says so — they are keyed by variable id alone — so
+   * the owning project is resolved through the environment that defines the
+   * variable. Overrides are never synced: they stay in the project's vault on
+   * this machine, and no other machine sees them.
+   *
+   * An override whose variable no longer exists (a deleted environment, a row
+   * left behind) has no project to belong to. It stays wherever it was read,
+   * falling back to the key's own directory — never dropped, since the variable
+   * may simply not be loaded yet.
+   */
+  async rootFor(variableId) {
+    const root = await environmentStore.rootOfVariable(variableId);
+    if (root) return root;
+    return this.roots.get(variableId) ?? dirname(await keyedFilePath(FILENAME));
+  }
+  /** Where earlier versions kept them: read once, rewritten to their vaults. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME);
+  }
+  /** Les fichiers qui portent des surcharges : les coffres, et l'emplacement d'avant. */
+  async sourcePaths() {
+    const roots = await allVaultRoots();
+    return [
+      this.getLegacyFilePath(),
+      await keyedFilePath(FILENAME),
+      ...roots.map((root) => join(root, FILENAME))
+    ];
+  }
+  /**
+   * Charger, et recharger quand les fichiers ont bougé sous nos pieds.
+   *
+   * L'empreinte se prend **après** `ensureProjectsLoaded` : la liste des coffres
+   * en dépend, et une empreinte prise sur une liste incomplète ne ressemblerait
+   * à aucune des suivantes — le store se rechargerait à chaque lecture.
+   */
+  async load() {
+    await this.disk.load(async () => {
+      if (!getEncryptionKey()) return null;
+      await ensureProjectsLoaded();
+      const fingerprint = await fingerprintFiles(await this.sourcePaths());
+      if (this.loaded && fingerprint === this.fingerprint) return null;
+      const next = await this.readVaults();
+      return () => {
+        this.data = next.data;
+        this.diskEncryptedSlots = next.diskEncryptedSlots;
+        this.roots = next.roots;
+        this.unreadableSecrets = next.unreadableSecrets;
+        this.fingerprint = fingerprint;
+        this.loaded = true;
+      };
+    });
+  }
+  /**
+   * Read every vault, then the places older versions used, into fresh tables
+   * that `load` swaps in at once.
+   *
+   * Variable ids are unique, so merging the files cannot collide; a vault read
+   * later simply wins over a legacy copy of the same override.
+   */
+  async readVaults() {
+    const data = {};
+    const diskEncryptedSlots = {};
+    const roots = /* @__PURE__ */ new Map();
+    const unreadableSecrets = /* @__PURE__ */ new Set();
+    for (const path of await this.sourcePaths()) {
+      let parsed;
+      try {
+        parsed = JSON.parse(await readFile(path, "utf-8"));
+      } catch {
+        continue;
+      }
+      Object.assign(
+        diskEncryptedSlots,
+        extractEncryptedVariableSlots(parsed)
+      );
+      const decrypted = decryptVariableSlots(
+        parsed,
+        "environment-overrides",
+        (variableId) => unreadableSecrets.add(variableId),
+        vaultIdOfRoot(dirname(path))
+      );
+      for (const [id, override] of Object.entries(decrypted)) {
+        data[id] = { value: override.value };
+        roots.set(id, dirname(path));
+      }
+    }
+    return { data, diskEncryptedSlots, roots, unreadableSecrets };
+  }
+  save() {
+    return this.disk.save(() => this.doSave());
+  }
+  /**
+   * Write each vault that holds — or held — an override.
+   *
+   * A vault emptied by this save is still written, as an empty object: an
+   * override that moved to its project's vault must not survive in the one it
+   * came from.
+   */
+  async doSave() {
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, {});
+    for (const [variableId, override] of Object.entries(this.data)) {
+      const root = await this.rootFor(variableId);
+      this.roots.set(variableId, root);
+      const bucket = byRoot.get(root) ?? {};
+      bucket[variableId] = override;
+      byRoot.set(root, bucket);
+    }
+    for (const [root, overrides] of byRoot) {
+      const encrypted = this.keepUnreadableSecrets(encryptVariableSlots(
+        overrides,
+        this.diskEncryptedSlots,
+        vaultIdOfRoot(root)
+      ));
+      Object.assign(
+        this.diskEncryptedSlots,
+        extractEncryptedVariableSlots(encrypted)
+      );
+      await mkdir(root, { recursive: true });
+      const path = join(root, FILENAME);
+      const tmpPath = path + ".tmp";
+      await writeFile(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
+      await renameWithRetry(tmpPath, path);
+      await chmod(path, 384);
+    }
+  }
+  /**
+   * Rendre au disque le chiffré d'une surcharge illisible, plutôt qu'un blanc.
+   *
+   * Pendant du garde-fou du store des environnements : tant que la valeur en
+   * mémoire est vide, c'est que personne n'a retouché la variable et que son
+   * chiffré fait toujours foi.
+   */
+  keepUnreadableSecrets(overrides) {
+    if (this.unreadableSecrets.size === 0) return overrides;
+    const result = { ...overrides };
+    for (const variableId of this.unreadableSecrets) {
+      const ciphertext = this.diskEncryptedSlots[variableId];
+      const override = result[variableId];
+      if (!ciphertext || !override || override.value.value) continue;
+      result[variableId] = { ...override, value: { ...override.value, value: ciphertext } };
+    }
+    return result;
+  }
+  async getOverride(variableId) {
+    await this.load();
+    return this.data[variableId] ?? null;
+  }
+  async setOverride(variableId, override) {
+    await this.load();
+    this.data[variableId] = { value: override.value };
+    await this.save();
+  }
+  async removeOverride(variableId) {
+    await this.load();
+    if (!this.data[variableId]) return;
+    delete this.data[variableId];
+    this.unreadableSecrets.delete(variableId);
+    await this.save();
+  }
+  async getAll() {
+    await this.load();
+    return { ...this.data };
+  }
+  async removeOverridesForVariables(variableIds) {
+    await this.load();
+    let changed = false;
+    for (const id of variableIds) {
+      if (this.data[id]) {
+        delete this.data[id];
+        this.unreadableSecrets.delete(id);
+        changed = true;
+      }
+    }
+    if (changed) await this.save();
+  }
+};
+var environmentOverridesStore = new EnvironmentOverridesStore();
+
+// ../server/src/services/environment-resolver.ts
+function interpolateValue(raw, envContext) {
+  return raw.replace(/\{\{environment\.([^}]+)\}\}/g, (match, key) => {
+    return envContext[key] !== void 0 ? envContext[key] : match;
+  });
+}
+function resolveVariable(variable, envContext) {
+  const slot = variable.value;
+  const finalValue = interpolateValue(slot.pre, envContext) + interpolateValue(slot.value, envContext) + interpolateValue(slot.post, envContext);
+  return { value: finalValue, isSecret: slot.isSecret };
+}
+function slotReferenceText(variable) {
+  const slot = variable.value;
+  return `${slot.pre}
+${slot.value}
+${slot.post}`;
+}
+var HIDDEN_VALUES_NOTICE = `Values shown as ${MASKED_VALUE} are secrets their author did not share with AI. The service does receive them: never treat such a key as missing, and never pass ${MASKED_VALUE} as its value.`;
+function filterEnvForAi(resolved, sharedKeys) {
+  const secret = new Set(resolved.envSecrets);
+  const shared = new Set(sharedKeys);
+  const env = {};
+  const envSecrets = [];
+  const hiddenKeys = [];
+  for (const [key, value] of Object.entries(resolved.env)) {
+    const hidden = secret.has(key) && !shared.has(key);
+    env[key] = hidden ? MASKED_VALUE : value;
+    if (secret.has(key)) envSecrets.push(key);
+    if (hidden) hiddenKeys.push(key);
+  }
+  return {
+    env,
+    envSecrets,
+    hiddenKeys,
+    ...hiddenKeys.length > 0 ? { hiddenNotice: HIDDEN_VALUES_NOTICE } : {}
+  };
+}
+function describeVariables(environments, ctx) {
+  const details = [];
+  for (const environment of environments) {
+    for (const [variableId, variable] of Object.entries(environment.variables ?? {})) {
+      const slot = variable.value;
+      const isOverridden = ctx.overriddenVariableIds.has(variableId);
+      const isSecret = slot.isSecret || ctx.resolvedSecretKeys.has(variable.key);
+      const readableByAi = ctx.maskedKeys.has(variable.key) ? false : !isSecret || isSharedWithAi(slot);
+      details.push({
+        key: variable.key,
+        inService: ctx.serviceKeys.has(variable.key),
+        environmentId: environment.id,
+        environmentName: environment.name,
+        scope: environment.scope,
+        ...environment.scope === "service" && environment.reference ? { environmentServiceId: environment.reference } : {},
+        ...slot.description ? { description: slot.description } : {},
+        secret: isSecret,
+        readableByAi,
+        injectedIntoAi: slot.injectIntoAi,
+        required: slot.required,
+        overrideOnly: slot.overrideOnly,
+        overridden: isOverridden,
+        ...isOverridden && ctx.sharedValues[variable.key] !== void 0 ? { sharedValue: ctx.sharedValues[variable.key] } : {}
+      });
+    }
+  }
+  return details.sort((a, b) => a.key.localeCompare(b.key) || a.environmentName.localeCompare(b.environmentName));
+}
+function withOverriddenValue(variable, override) {
+  return {
+    ...variable,
+    value: {
+      ...variable.value,
+      value: override.value,
+      pre: override.pre,
+      post: override.post
+    }
+  };
+}
+var EnvironmentResolver = class {
+  async resolveForService(ctx, opts) {
+    if (!ctx.activeEnvironmentId) {
+      return { env: {}, envSecrets: [] };
+    }
+    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
+    if (!serviceEnv) {
+      return this.resolveEnvironment(ctx.activeEnvironmentId, opts);
+    }
+    return this.resolveEnvironment(serviceEnv.id, opts);
+  }
+  /**
+   * `applyOverrides: false` rend ce que l'équipe partage, sans ce que ce poste
+   * a mis par-dessus : c'est la réponse à « qu'est-ce que ma surcharge
+   * remplace ». Le défaut reste `true` — tout le reste du produit veut la
+   * valeur avec laquelle le service tourne réellement.
+   */
+  async resolveEnvironment(environmentId, opts) {
+    const visited = /* @__PURE__ */ new Set();
+    const result = await this.resolveDag(environmentId, visited);
+    const overridesByKey = opts?.applyOverrides === false ? {} : await this.resolveOverridesByKey(environmentId);
+    for (const [varId, variable] of Object.entries(result.variables)) {
+      const override = overridesByKey[variable.key];
+      if (override) {
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
+      }
+    }
+    const rawEnv = {};
+    for (const [_varId, variable] of Object.entries(result.variables)) {
+      const slot = variable.value;
+      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
+    }
+    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
+    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
+    const env = {};
+    const envSecrets = [];
+    for (const [_varId, variable] of Object.entries(result.variables)) {
+      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
+      env[variable.key] = value;
+      if (isSecret || secretKeys.has(variable.key)) {
+        envSecrets.push(variable.key);
+      }
+    }
+    return { env, envSecrets };
+  }
+  /**
+   * Resolve an environment (with inheritance) and return only the variables
+   * flagged `injectIntoAi`, as a flat KEY→value dict ready to be injected into
+   * the process environment of an AI agent spawn.
+   */
+  async resolveAiInjectedEnv(environmentId) {
+    if (!environmentId) return {};
+    const visited = /* @__PURE__ */ new Set();
+    const result = await this.resolveDag(environmentId, visited);
+    const overridesByKey = await this.resolveOverridesByKey(environmentId);
+    for (const [varId, variable] of Object.entries(result.variables)) {
+      const override = overridesByKey[variable.key];
+      if (override) {
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
+      }
+    }
+    const rawEnv = {};
+    for (const variable of Object.values(result.variables)) {
+      const slot = variable.value;
+      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
+    }
+    const { ctx: interpolationCtx } = await this.buildInterpolationContext(
+      environmentId,
+      rawEnv,
+      result.parentEnv,
+      result.parentSecretKeys,
+      result.parentKeySources
+    );
+    const injected = {};
+    for (const variable of Object.values(result.variables)) {
+      if (!variable.value.injectIntoAi) continue;
+      const { value } = resolveVariable(variable, interpolationCtx);
+      injected[variable.key] = value;
+    }
+    return injected;
+  }
+  /**
+   * Les variables qu'il faut remplir avant qu'un service de cet environnement
+   * puisse démarrer.
+   *
+   * Deux motifs, et ils ne se mesurent pas au même endroit :
+   *
+   * - `required` porte sur la valeur **finale**, interpolation et surcharge
+   *   comprises : une variable obligatoire dont la valeur ne tient qu'à une
+   *   référence morte est aussi vide qu'une case blanche.
+   * - `overrideOnly` porte sur l'**existence d'une surcharge machine**. Elle
+   *   n'a par construction pas de valeur partagée ; ce qui manque n'est pas un
+   *   contenu, c'est la réponse de ce poste-ci.
+   *
+   * Les drapeaux se lisent sur la définition, jamais sur le slot résolu : une
+   * surcharge remplace le slot entier et ne porte aucun drapeau — les y lire
+   * rendrait toute variable surchargée silencieusement facultative.
+   */
+  async findMissingVariables(environmentId) {
+    if (!environmentId) return [];
+    const [{ env }, definitions, overridesByKey] = await Promise.all([
+      this.resolveEnvironment(environmentId),
+      this.resolveDag(environmentId, /* @__PURE__ */ new Set()),
+      this.resolveOverridesByKey(environmentId)
+    ]);
+    const missing = [];
+    for (const [variableId, variable] of Object.entries(definitions.variables)) {
+      const slot = variable.value;
+      const source = definitions.sources[variableId];
+      const base = {
+        variableId,
+        key: variable.key,
+        description: slot.description,
+        isSecret: slot.isSecret,
+        environmentId: source?.environmentId ?? environmentId,
+        environmentName: source?.environmentName ?? ""
+      };
+      if (slot.overrideOnly && !overridesByKey[variable.key]) {
+        missing.push({ ...base, reason: "overrideOnly" });
+        continue;
+      }
+      if (slot.required && (env[variable.key] ?? "") === "") {
+        missing.push({ ...base, reason: "required" });
+      }
+    }
+    return missing;
+  }
+  /**
+   * Tout ce qu'il reste à remplir sous l'environnement courant.
+   *
+   * Deux périmètres, et il faut les deux :
+   *
+   * 1. **L'environnement courant lui-même**, héritage compris —
+   *    `findMissingVariables` remonte ses `parentIds`. C'est là que vivent les
+   *    variables globales du projet, et c'est la première branche balayée.
+   * 2. **Les environnements de service qui s'activent avec lui**
+   *    (`activateOn`). Ceux-là ne sont pas des ancêtres du global : ils en
+   *    héritent, dans l'autre sens. Ne pas y descendre revenait à ne rien
+   *    réclamer d'un service jusqu'à ce qu'on essaie de le démarrer.
+   *
+   * Dédoublonné par identifiant de variable : une variable du global remonte
+   * dans chaque branche de service qui en hérite, et l'assistant ne doit pas
+   * demander deux fois la même chose.
+   */
+  async findMissingForActiveEnvironment(globalEnvId) {
+    if (!globalEnvId) return [];
+    const serviceEnvs = await environmentStore.listByActivateOn(globalEnvId);
+    const branches = await Promise.all([
+      this.findMissingVariables(globalEnvId),
+      ...serviceEnvs.map((env) => this.findMissingVariables(env.id))
+    ]);
+    const seen = /* @__PURE__ */ new Set();
+    const missing = [];
+    for (const branch of branches) {
+      for (const item of branch) {
+        if (seen.has(item.variableId)) continue;
+        seen.add(item.variableId);
+        missing.push(item);
+      }
+    }
+    return missing;
+  }
+  /**
+   * Les clés que leur auteur a partagées avec les IA, héritage compris.
+   *
+   * Le partage se lit sur la **définition**, et seulement là : une surcharge
+   * machine ne dit que la valeur de ce poste (`withOverriddenValue`). Il n'y a
+   * donc qu'un endroit où ce drapeau existe, et rien à réconcilier.
+   *
+   * Des clés, pas des valeurs : la valeur rendue reste celle que le service
+   * reçoit, surcharges et interpolation comprises.
+   */
+  async resolveAiSharedKeys(environmentId) {
+    if (!environmentId) return /* @__PURE__ */ new Set();
+    const result = await this.resolveDag(environmentId, /* @__PURE__ */ new Set());
+    const keys = /* @__PURE__ */ new Set();
+    for (const variable of Object.values(result.variables)) {
+      if (isSharedWithAi(variable.value)) keys.add(variable.key);
+    }
+    return keys;
+  }
+  /**
+   * Idem, pour ce qu'un service verra réellement : son environnement dédié
+   * quand il en a un, l'environnement global sinon — la règle de sélection de
+   * `resolveForService`.
+   */
+  async resolveAiSharedKeysForService(ctx) {
+    if (!ctx.activeEnvironmentId) return /* @__PURE__ */ new Set();
+    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
+    return this.resolveAiSharedKeys(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
+  }
+  /**
+   * Idem, pour ce qu'un service verra réellement : son environnement dédié
+   * quand il en a un, l'environnement global sinon. Miroir de
+   * `resolveForService`, dont il partage la règle de sélection.
+   */
+  async findMissingForService(ctx) {
+    if (!ctx.activeEnvironmentId) return [];
+    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
+    return this.findMissingVariables(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
+  }
+  async resolveEnvironmentWithSources(environmentId) {
+    const visited = /* @__PURE__ */ new Set();
+    const result = await this.resolveDag(environmentId, visited);
+    const overridesByKey = await this.resolveOverridesByKey(environmentId);
+    for (const [varId, variable] of Object.entries(result.variables)) {
+      const override = overridesByKey[variable.key];
+      if (override) {
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
+        result.sources[varId] = {
+          ...result.sources[varId],
+          overridden: true,
+          ...override.source ? { overriddenBy: override.source } : {}
+        };
+      }
+    }
+    const rawEnv = {};
+    for (const [_varId, variable] of Object.entries(result.variables)) {
+      const slot = variable.value;
+      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
+    }
+    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys, keySources } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
+    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
+    const env = {};
+    const envSecrets = [];
+    for (const [_varId, variable] of Object.entries(result.variables)) {
+      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
+      env[variable.key] = value;
+      if (isSecret || secretKeys.has(variable.key)) {
+        envSecrets.push(variable.key);
+      }
+    }
+    const refPattern = /^\{\{environment\.([^}]+)\}\}$/;
+    for (const [varId, variable] of Object.entries(result.variables)) {
+      const match = variable.value.value.match(refPattern);
+      if (match) {
+        const refSource = keySources[match[1]];
+        if (refSource && result.sources[varId]?.environmentId !== refSource.environmentId) {
+          result.sources[varId] = {
+            ...result.sources[varId],
+            resolvedFrom: refSource
+          };
+        }
+      }
+    }
+    return {
+      variables: result.variables,
+      env,
+      envSecrets,
+      sources: result.sources
+    };
+  }
+  /** Check if a raw value string interpolates any key that is secret in the context */
+  /**
+   * Toutes les clés dont la valeur est, directement ou par interpolation, un
+   * secret.
+   *
+   * Le contexte d'interpolation ne connaît que les secrets *hérités* : les
+   * secrets définis dans le même environnement n'y figurent pas, si bien qu'un
+   * `AUTH='Bearer {{environment.TOKEN}}'` voisin de son propre `TOKEN` secret
+   * ressortait non marqué — et donc non masqué par toute la chaîne en aval.
+   *
+   * On part des secrets hérités plus ceux déclarés ici, puis on propage
+   * jusqu'au point fixe : une valeur qui référence une clé secrète devient
+   * secrète à son tour, y compris en chaîne (A secret → B cite A → C cite B).
+   */
+  collectSecretKeys(variables, parentSecretKeys) {
+    const secretKeys = new Set(parentSecretKeys);
+    for (const variable of Object.values(variables)) {
+      if (variable.value.isSecret) secretKeys.add(variable.key);
+    }
+    let changed = true;
+    while (changed) {
+      changed = false;
+      for (const variable of Object.values(variables)) {
+        if (secretKeys.has(variable.key)) continue;
+        if (this.interpolatesSecretKey(slotReferenceText(variable), secretKeys)) {
+          secretKeys.add(variable.key);
+          changed = true;
+        }
+      }
+    }
+    return secretKeys;
+  }
+  interpolatesSecretKey(rawValue, ctxSecretKeys) {
+    const refs = [...rawValue.matchAll(/\{\{environment\.([^}]+)\}\}/g)].map((m) => m[1]);
+    return refs.some((ref) => ctxSecretKeys.has(ref));
+  }
+  /**
+   * Build the interpolation context for an environment.
+   *
+   * For inheriting envs (has parents): start from parent concrete values,
+   * then overlay with current concrete values. This ensures that
+   * {{environment.KEY}} resolves against the parent's value when the child
+   * redefines KEY as an interpolation reference.
+   *
+   * For isolated service envs (scope=service, activateOn set, no parents):
+   * the global env is resolved and used as fallback.
+   */
+  async buildInterpolationContext(environmentId, rawEnv, parentEnv, parentSecretKeys, parentKeySources) {
+    const environment = await environmentStore.get(environmentId);
+    if (environment && environment.scope === "service" && environment.activateOn && (!environment.parentIds || environment.parentIds.length === 0)) {
+      const globalResolved = await this.resolveEnvironmentWithSources(environment.activateOn);
+      const secretKeys = new Set(globalResolved.envSecrets);
+      const keySources = {};
+      for (const [varId, variable] of Object.entries(globalResolved.variables)) {
+        const source = globalResolved.sources[varId];
+        if (source) {
+          keySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
+        }
+      }
+      const ctx2 = { ...globalResolved.env };
+      for (const [key, value] of Object.entries(rawEnv)) {
+        if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
+          ctx2[key] = value;
+        }
+      }
+      return { ctx: ctx2, secretKeys, keySources };
+    }
+    const ctx = { ...parentEnv };
+    for (const [key, value] of Object.entries(rawEnv)) {
+      if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
+        ctx[key] = value;
+      }
+    }
+    return { ctx, secretKeys: parentSecretKeys, keySources: parentKeySources };
+  }
+  /**
+   * For service-scoped envs, compute effective parentIds by also including
+   * the service-scoped envs of ancestor global environments.
+   *
+   * Example: "Server (test)" has parentIds=[test-global]. test-global has
+   * parentIds=[Local-global]. This method adds "Server (Local)" to the
+   * effective parents so service-specific variables from ancestor envs
+   * are inherited correctly.
+   */
+  async getEffectiveParentIds(environment) {
+    if (environment.scope !== "service" || !environment.reference || !environment.activateOn) {
+      return environment.parentIds;
+    }
+    const additionalIds = [];
+    for (const parentId of environment.parentIds) {
+      const parentEnv = await environmentStore.get(parentId);
+      if (!parentEnv || parentEnv.scope !== "global") continue;
+      for (const grandparentGlobalId of parentEnv.parentIds) {
+        const ancestorServiceEnv = await environmentStore.findServiceEnvironment(environment.reference, grandparentGlobalId);
+        if (ancestorServiceEnv && !environment.parentIds.includes(ancestorServiceEnv.id)) {
+          additionalIds.push(ancestorServiceEnv.id);
+        }
+      }
+    }
+    if (additionalIds.length === 0) return environment.parentIds;
+    return [...environment.parentIds, ...additionalIds];
+  }
+  /**
+   * Project an environment's variables onto their overrides: keep only the
+   * variables that have one, and swap in the override's value slot. The key
+   * always comes from the definition.
+   *
+   * Feeding this projection back through `resolveDag` resolves the override
+   * chain with the exact same inheritance and dedup-by-key rules as the value
+   * chain — so an override set on a parent env is no longer swallowed when a
+   * child (or a service env) redeclares the same key.
+   */
+  projectOverrides(variables, overrides) {
+    const projected = {};
+    for (const [varId, variable] of Object.entries(variables)) {
+      const override = overrides[varId];
+      if (override) {
+        projected[varId] = { key: variable.key, value: override.value };
+      }
+    }
+    return projected;
+  }
+  /**
+   * Resolve the override chain independently of the value chain and return the
+   * winning override per variable key (empty when nothing is overridden).
+   */
+  async resolveOverridesByKey(environmentId) {
+    const allOverrides = await environmentOverridesStore.getAll();
+    if (Object.keys(allOverrides).length === 0) return {};
+    const result = await this.resolveDag(
+      environmentId,
+      /* @__PURE__ */ new Set(),
+      (variables) => this.projectOverrides(variables, allOverrides)
+    );
+    const byKey = {};
+    for (const [varId, variable] of Object.entries(result.variables)) {
+      const source = result.sources[varId];
+      byKey[variable.key] = {
+        variable,
+        ...source ? { source: { environmentId: source.environmentId, environmentName: source.environmentName } } : {}
+      };
+    }
+    return byKey;
+  }
+  async resolveDag(environmentId, visited, project) {
+    if (visited.has(environmentId)) {
+      throw new Error(`Circular dependency detected in environment inheritance for ${environmentId}`);
+    }
+    const environment = await environmentStore.get(environmentId);
+    if (!environment) {
+      throw new Error(`Environment "${environmentId}" not found`);
+    }
+    visited.add(environmentId);
+    const effectiveParentIds = await this.getEffectiveParentIds(environment);
+    const parentResults = [];
+    for (const parentId of effectiveParentIds) {
+      const parentVisited = new Set(visited);
+      const parentResult = await this.resolveDag(parentId, parentVisited, project);
+      parentResults.push(parentResult);
+    }
+    const mergedVariables = {};
+    const sources = {};
+    for (const result of parentResults) {
+      for (const [varId, variable] of Object.entries(result.variables)) {
+        for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
+          if (existingVar.key === variable.key && existingId !== varId) {
+            delete mergedVariables[existingId];
+            delete sources[existingId];
+          }
+        }
+        mergedVariables[varId] = variable;
+        sources[varId] = result.sources[varId] ?? sources[varId];
+      }
+    }
+    const parentEnv = {};
+    const parentSecretKeys = /* @__PURE__ */ new Set();
+    const parentKeySources = {};
+    for (const [varId, variable] of Object.entries(mergedVariables)) {
+      const slot = variable.value;
+      parentEnv[variable.key] = slot.pre + slot.value + slot.post;
+      if (slot.isSecret) {
+        parentSecretKeys.add(variable.key);
+      }
+      const source = sources[varId];
+      if (source) {
+        parentKeySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
+      }
+    }
+    const isInterpRef = (v) => /\{\{environment\.[^}]+\}\}/.test(v);
+    for (const result of parentResults) {
+      for (const [key, value] of Object.entries(result.parentEnv)) {
+        const existingIsRef = key in parentEnv && isInterpRef(parentEnv[key]);
+        const newIsConcrete = !isInterpRef(value);
+        if (!(key in parentEnv) || existingIsRef && newIsConcrete) {
+          parentEnv[key] = value;
+        }
+      }
+      for (const key of result.parentSecretKeys) {
+        parentSecretKeys.add(key);
+      }
+      for (const [key, source] of Object.entries(result.parentKeySources)) {
+        if (!(key in parentKeySources)) {
+          parentKeySources[key] = source;
+        }
+      }
+    }
+    for (const key of this.collectSecretKeys(mergedVariables, parentSecretKeys)) {
+      parentSecretKeys.add(key);
+    }
+    const ownVariables = project ? project(environment.variables) : environment.variables;
+    for (const [varId, variable] of Object.entries(ownVariables)) {
+      let wasInherited = varId in mergedVariables;
+      for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
+        if (existingVar.key === variable.key && existingId !== varId) {
+          delete mergedVariables[existingId];
+          delete sources[existingId];
+          wasInherited = true;
+        }
+      }
+      mergedVariables[varId] = variable;
+      sources[varId] = {
+        environmentId: environment.id,
+        environmentName: environment.name,
+        overridden: wasInherited
+      };
+    }
+    return {
+      variables: mergedVariables,
+      sources,
+      parentEnv,
+      parentSecretKeys,
+      parentKeySources
+    };
+  }
+};
+var environmentResolver = new EnvironmentResolver();
+
+export {
+  environmentOverridesStore,
+  HIDDEN_VALUES_NOTICE,
+  filterEnvForAi,
+  describeVariables,
+  environmentResolver
+};
+//# sourceMappingURL=chunk-WDHLEO5S.js.map