@runeya/runeya 2.0.39 → 2.0.41

package/{chunk-PW6A3BLD.js → chunk-NJJMESIY.js}

@@ -5,8 +5,13 @@ import { z as z21 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
-import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
-import { join } from "path";
+import { readFile, writeFile, rename, mkdir as mkdir2, chmod } from "fs/promises";
+import { dirname } from "path";
+
+// ../server/src/services/vault-resolver.ts
+import { join, resolve } from "path";
+import { homedir } from "os";
+import { readdir, mkdir, access } from "fs/promises";
 
 // ../server/src/config/env.ts
 import { z } from "zod";
@@ -19,6 +24,10 @@ var EnvSchema = z.object({
   RUNEYA_AGENT_HOST: z.string().default("127.0.0.1"),
   RUNEYA_AGENT_BINARY_PATH: z.string().nullable().default(null),
   RUNEYA_DATA_DIR: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().default(".runeya")),
+  // Home holding the cloud vaults (`<home>/.runeya/orgs/...`). Defaults to the
+  // user's home directory; overridden by tests so they never write to the real
+  // one, and usable to relocate the vaults on a shared machine.
+  RUNEYA_HOME: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().nullable().default(null)),
   RUNEYA_CLOUD_URL: z.string().url().nullable().default(null),
   // Cloud front-end (landing) URL — used by the web app for the registration /
   // onboarding flow. Configured on the server at launch; the web fetches it.
@@ -40,6 +49,7 @@ var EnvSchema = z.object({
   HOST: data.RUNEYA_HOST,
   MODE: data.RUNEYA_MODE,
   DATA_DIR: data.RUNEYA_DATA_DIR,
+  HOME_DIR: data.RUNEYA_HOME,
   CLOUD_URL: data.RUNEYA_CLOUD_URL,
   CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,
   CORS_ORIGIN: data.RUNEYA_CORS_ORIGIN,
@@ -48,10 +58,93 @@ var EnvSchema = z.object({
 }));
 var env = EnvSchema.parse(process.env);
 
+// ../server/src/services/vault-resolver.ts
+var SAFE_ID = /^[A-Za-z0-9._-]{1,128}$/;
+function assertSafeId(kind, id) {
+  if (!SAFE_ID.test(id) || id === "." || id === "..") {
+    throw new Error(`Invalid ${kind} id for a vault path: ${JSON.stringify(id)}`);
+  }
+}
+function machineRoot() {
+  const override = process.env["RUNEYA_HOME"];
+  return join(override && override.length > 0 ? override : homedir(), ".runeya");
+}
+function localVaultRoot() {
+  return resolve(env.DATA_DIR);
+}
+function orgVaultRoot(orgId) {
+  assertSafeId("organization", orgId);
+  return join(machineRoot(), "orgs", orgId);
+}
+function projectVaultRoot(orgId, projectId) {
+  assertSafeId("project", projectId);
+  return join(orgVaultRoot(orgId), "projects", projectId);
+}
+function vaultFor(target) {
+  if (!target.orgId) return { root: localVaultRoot() };
+  return { root: projectVaultRoot(target.orgId, target.id) };
+}
+async function listCloudVaults() {
+  const orgsDir = join(machineRoot(), "orgs");
+  const found = [];
+  let orgIds;
+  try {
+    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return found;
+  }
+  for (const orgId of orgIds) {
+    const projectsDir = join(orgsDir, orgId, "projects");
+    try {
+      for (const entry of await readdir(projectsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !SAFE_ID.test(entry.name)) continue;
+        found.push({ orgId, projectId: entry.name, root: join(projectsDir, entry.name) });
+      }
+    } catch {
+    }
+  }
+  return found;
+}
+async function allVaultRoots() {
+  const cloud = await listCloudVaults();
+  return [localVaultRoot(), ...cloud.map((v) => v.root)];
+}
+function machineFilePath(filename) {
+  return join(machineRoot(), filename);
+}
+async function keyedFilePath(filename) {
+  return join(await keyRoot(), filename);
+}
+function legacyMachineFilePath(filename) {
+  return join(localVaultRoot(), filename);
+}
+async function ensureLocalVault() {
+  const root = localVaultRoot();
+  await mkdir(root, { recursive: true });
+  return root;
+}
+var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
+var keyRootPromise = null;
+function keyRoot() {
+  keyRootPromise ??= (async () => {
+    const local = localVaultRoot();
+    for (const filename of KEY_FILES) {
+      try {
+        await access(join(local, filename));
+        return local;
+      } catch {
+      }
+    }
+    return machineRoot();
+  })();
+  return keyRootPromise;
+}
+
 // ../server/src/utils/encryption-key.ts
 import { createHash } from "crypto";
 var KEY_SIZE_BYTES = 32;
-var cachedKey = null;
+var DEFAULT_VAULT = "\0default";
+var keyring = /* @__PURE__ */ new Map();
 var _ciMode = false;
 var _pendingLegacyKey = null;
 function isCiMode() {
@@ -68,7 +161,7 @@ async function loadFromEnv() {
   console.log("  Cette variable d'environnement est r\xE9serv\xE9e aux environnements CI/CD.");
   console.log("  Ne la d\xE9finissez jamais sur une machine de d\xE9veloppement.");
   console.log("");
-  cachedKey = Buffer.from(keyHex, "hex");
+  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
   _ciMode = true;
   return true;
 }
@@ -85,30 +178,31 @@ function clearPendingLegacyKey() {
 function hasPendingLegacyKey() {
   return _pendingLegacyKey !== null;
 }
-function setEncryptionKeyInMemory(key) {
+function setEncryptionKeyInMemory(key, vault = DEFAULT_VAULT) {
   if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
-  cachedKey = key;
+  keyring.set(vault, key);
 }
-function clearEncryptionKey() {
-  cachedKey = null;
+function clearEncryptionKey(vault) {
+  if (vault === void 0) keyring.clear();
+  else keyring.delete(vault);
 }
-function hasEncryptionKey() {
-  return cachedKey !== null;
+function hasEncryptionKey(vault = DEFAULT_VAULT) {
+  return keyring.has(vault);
 }
-function getEncryptionKey() {
-  return cachedKey;
+function getEncryptionKey(vault = DEFAULT_VAULT) {
+  return keyring.get(vault) ?? null;
 }
-function deriveStableSecret(purpose) {
-  const key = getEncryptionKey();
+function deriveStableSecret(purpose, vault = DEFAULT_VAULT) {
+  const key = getEncryptionKey(vault);
   if (!key) return null;
   return createHash("sha256").update(key).update(purpose).digest("hex");
 }
 async function ensureEncryptionKey() {
-  return cachedKey;
+  return getEncryptionKey();
 }
 async function setEncryptionKey(keyHex) {
   if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error("Invalid key format");
-  cachedKey = Buffer.from(keyHex, "hex");
+  setEncryptionKeyInMemory(Buffer.from(keyHex, "hex"));
 }
 
 // ../server/src/services/agent-store.ts
@@ -148,16 +242,37 @@ var AgentStore = class {
   passthroughEnv = {};
   traefikConfigs = {};
   loaded = false;
+  /**
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
+   */
   getFilePath() {
-    return join(env.DATA_DIR, FILENAME);
+    return keyedFilePath(FILENAME);
+  }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME);
+  }
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile(this.getLegacyFilePath(), "utf-8");
+    }
   }
   async ensureDir() {
-    await mkdir(env.DATA_DIR, { recursive: true });
+    await mkdir2(dirname(await this.getFilePath()), { recursive: true });
   }
   async load() {
     if (this.loaded) return;
     try {
-      const raw = await readFile(this.getFilePath(), "utf-8");
+      const raw = await this.readFromDisk();
       const data = JSON.parse(raw);
       if (Array.isArray(data)) {
         for (const a of data) this.agents.set(a.id, a);
@@ -174,7 +289,7 @@ var AgentStore = class {
   }
   async save() {
     await this.ensureDir();
-    const filePath = this.getFilePath();
+    const filePath = await this.getFilePath();
     const tmpPath = filePath + ".tmp";
     const fileData = {
       agents: Array.from(this.agents.values()),
@@ -282,12 +397,42 @@ var agentStore = new AgentStore();
 
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir4, chmod as chmod3 } from "fs/promises";
 import { join as join3 } from "path";
 
+// ../server/src/services/vault-registry.ts
+var loadProjects = null;
+var projectRoots = /* @__PURE__ */ new Map();
+var serviceOwners = /* @__PURE__ */ new Map();
+function registerProjectLoader(load) {
+  loadProjects = load;
+}
+function setProjectVault(projectId, root) {
+  projectRoots.set(projectId, root);
+}
+function forgetProject(projectId) {
+  projectRoots.delete(projectId);
+  for (const [serviceId, owner] of serviceOwners) {
+    if (owner === projectId) serviceOwners.delete(serviceId);
+  }
+}
+function setProjectServices(projectId, serviceIds) {
+  for (const [serviceId, owner] of serviceOwners) {
+    if (owner === projectId && !serviceIds.includes(serviceId)) serviceOwners.delete(serviceId);
+  }
+  for (const serviceId of serviceIds) serviceOwners.set(serviceId, projectId);
+}
+function rootOfProject(projectId) {
+  return projectRoots.get(projectId) ?? localVaultRoot();
+}
+function rootOfService(serviceId) {
+  const owner = serviceOwners.get(serviceId);
+  return owner ? rootOfProject(owner) : localVaultRoot();
+}
+
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { join as join2 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
@@ -1638,11 +1783,25 @@ var EnvironmentStore = class {
   notify() {
     for (const fn of this.listeners) fn();
   }
-  getFilePath() {
-    return join2(env.DATA_DIR, FILENAME2);
+  /**
+   * Which vault each environment was read from, so a save puts it back where it
+   * belongs even before its project has been loaded.
+   */
+  roots = /* @__PURE__ */ new Map();
+  getFilePath(root) {
+    return join2(root, FILENAME2);
   }
-  async ensureDir() {
-    await mkdir2(env.DATA_DIR, { recursive: true });
+  /**
+   * The vault an environment must be written to: its project's.
+   *
+   * Falls back to where it was last read, then to the local vault — an
+   * environment whose project is unknown belongs to the launch directory, which
+   * is where it lived before vaults existed.
+   */
+  rootFor(environment) {
+    const known = this.roots.get(environment.id);
+    const projectRoot = environment.projectId ? rootOfProject(environment.projectId) : null;
+    return projectRoot ?? known ?? localVaultRoot();
   }
   extractEncryptedCache(environment) {
     const envSlots = extractEncryptedVariableSlots(
@@ -1671,35 +1830,106 @@ var EnvironmentStore = class {
     }
     return { ...environment, variables: decryptedVars };
   }
+  /**
+   * Read every vault — the launch directory and each materialized cloud project.
+   *
+   * The roots come from the disk rather than from the project store, so loading
+   * environments never has to wait on projects being loaded first (the project
+   * store reads environments while absorbing a project, which would deadlock).
+   */
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await readFile2(this.getFilePath(), "utf-8");
-      const data = JSON.parse(raw);
-      if (!getEncryptionKey()) {
-        return;
-      }
-      for (const e of data) {
-        this.diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
-        const decrypted = this.decryptEnvironment(e);
-        this.environments.set(e.id, decrypted);
+    this.loaded = true;
+    if (!getEncryptionKey()) {
+      this.loaded = false;
+      return;
+    }
+    for (const root of await allVaultRoots()) {
+      try {
+        const raw = await readFile2(this.getFilePath(root), "utf-8");
+        const data = JSON.parse(raw);
+        for (const e of data) {
+          this.diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
+          const decrypted = this.decryptEnvironment(e);
+          this.environments.set(e.id, decrypted);
+          this.roots.set(e.id, root);
+        }
+      } catch {
       }
-    } catch {
     }
-    this.loaded = true;
   }
+  /**
+   * Write each vault that holds — or held — an environment.
+   *
+   * Vaults emptied by this save are still written, as an empty list: an
+   * environment that moved to another vault must not survive in the old one.
+   */
   async save() {
-    await this.ensureDir();
-    const filePath = this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const preparedEnvironments = Array.from(this.environments.values()).map((e) => this.encryptEnvironment(e));
-    for (const e of preparedEnvironments) {
-      this.diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
-    }
-    const data = JSON.stringify(preparedEnvironments, null, 2);
-    await writeFile2(tmpPath, data, "utf-8");
-    await rename2(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, []);
+    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
+    for (const environment of this.environments.values()) {
+      const root = this.rootFor(environment);
+      const prepared = this.encryptEnvironment(environment);
+      this.diskEncryptedSlots.set(prepared.id, this.extractEncryptedCache(prepared));
+      this.roots.set(environment.id, root);
+      const bucket = byRoot.get(root);
+      if (bucket) bucket.push(prepared);
+      else byRoot.set(root, [prepared]);
+    }
+    for (const [root, environments] of byRoot) {
+      await mkdir3(root, { recursive: true });
+      const filePath = this.getFilePath(root);
+      const tmpPath = filePath + ".tmp";
+      await writeFile2(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
+      await rename2(tmpPath, filePath);
+      await chmod2(filePath, 384);
+    }
+    this.notify();
+  }
+  /**
+   * Rewrite every vault, moving entities that now belong elsewhere.
+   *
+   * Called once the project store knows where projects live: entities read from
+   * the launch directory whose project turns out to be a cloud one are written
+   * into that project's vault, and disappear from the directory they came from.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
+  }
+  /**
+   * Which project a variable belongs to, by walking the environments that
+   * define it.
+   *
+   * Overrides are keyed by variable id alone — nothing in an override says
+   * which project it belongs to — so this is what lets them be stored with
+   * their project rather than in one machine-wide pile.
+   */
+  async projectIdOfVariable(variableId) {
+    await this.load();
+    for (const environment of this.environments.values()) {
+      if (environment.variables && variableId in environment.variables) {
+        return environment.projectId;
+      }
+    }
+    return null;
+  }
+  /**
+   * Drop a project's environments from memory, without touching the disk.
+   *
+   * Used when a project stops being followed: its vault is removed as a whole,
+   * and environments left in memory would be written back on the next save —
+   * into the local vault, since their project is no longer known.
+   */
+  async forgetByProject(projectId) {
+    await this.load();
+    for (const [id, environment] of this.environments) {
+      if (environment.projectId !== projectId) continue;
+      this.environments.delete(id);
+      this.diskEncryptedSlots.delete(id);
+      this.roots.delete(id);
+    }
     this.notify();
   }
   async list(projectId) {
@@ -1978,46 +2208,106 @@ var ServiceStore = class {
   notify() {
     for (const fn of this.listeners) fn();
   }
-  getFilePath() {
-    return join3(env.DATA_DIR, FILENAME3);
+  /** Which vault each service was read from, used until its project is known. */
+  roots = /* @__PURE__ */ new Map();
+  getFilePath(root) {
+    return join3(root, FILENAME3);
   }
-  async ensureDir() {
-    await mkdir3(env.DATA_DIR, { recursive: true });
+  /**
+   * The vault a service must be written to: the one of the project owning it.
+   *
+   * A service carries no project id — ownership lives in `project.serviceIds` —
+   * so the registry answers, falling back to where the service was read and
+   * finally to the local vault.
+   */
+  rootFor(serviceId) {
+    return rootOfService(serviceId) ?? this.roots.get(serviceId) ?? localVaultRoot();
   }
+  /**
+   * Read every vault: the launch directory and each materialized cloud project.
+   *
+   * Roots come from the disk, not from the project store, so services load
+   * without waiting on projects.
+   */
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await readFile3(this.getFilePath(), "utf-8");
-      const data = JSON.parse(raw);
-      if (!getEncryptionKey()) {
-        return;
-      }
-      for (const s of data) {
-        if (s.commands) {
-          for (const cmd of s.commands) {
-            if (cmd.shell === void 0) cmd.shell = true;
+    if (!getEncryptionKey()) return;
+    this.loaded = true;
+    for (const root of await allVaultRoots()) {
+      try {
+        const raw = await readFile3(this.getFilePath(root), "utf-8");
+        const data = JSON.parse(raw);
+        for (const s of data) {
+          if (s.commands) {
+            for (const cmd of s.commands) {
+              if (cmd.shell === void 0) cmd.shell = true;
+            }
           }
+          this.diskForm.set(s.id, s);
+          this.services.set(s.id, {
+            ...s,
+            logSources: decryptLogSources(s.logSources ?? [])
+          });
+          this.roots.set(s.id, root);
         }
-        this.diskForm.set(s.id, s);
-        this.services.set(s.id, {
-          ...s,
-          logSources: decryptLogSources(s.logSources ?? [])
-        });
+      } catch {
       }
-    } catch {
     }
-    this.loaded = true;
   }
+  /**
+   * Write each vault that holds — or held — a service.
+   *
+   * A vault emptied by this save is still written, as an empty list: a service
+   * that moved to another vault must not survive in the one it left.
+   */
   async save() {
-    await this.ensureDir();
-    const filePath = this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const preparedServices = Array.from(this.services.values()).map((s) => prepareForDisk(s, this.diskForm.get(s.id)));
-    for (const s of preparedServices) this.diskForm.set(s.id, s);
-    const data = JSON.stringify(preparedServices, null, 2);
-    await writeFile3(tmpPath, data, "utf-8");
-    await rename3(tmpPath, filePath);
-    await chmod3(filePath, 384);
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, []);
+    byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
+    for (const service of this.services.values()) {
+      const root = this.rootFor(service.id);
+      const prepared = prepareForDisk(service, this.diskForm.get(service.id));
+      this.diskForm.set(prepared.id, prepared);
+      this.roots.set(service.id, root);
+      const bucket = byRoot.get(root);
+      if (bucket) bucket.push(prepared);
+      else byRoot.set(root, [prepared]);
+    }
+    for (const [root, services] of byRoot) {
+      await mkdir4(root, { recursive: true });
+      const filePath = this.getFilePath(root);
+      const tmpPath = filePath + ".tmp";
+      await writeFile3(tmpPath, JSON.stringify(services, null, 2), "utf-8");
+      await rename3(tmpPath, filePath);
+      await chmod3(filePath, 384);
+    }
+  }
+  /**
+   * Drop services from memory, without touching the disk.
+   *
+   * Used when their project stops being followed: its vault goes away whole,
+   * and services left in memory would be written back on the next save — into
+   * the local vault, since their owner is no longer known.
+   */
+  async forgetLocally(serviceIds) {
+    await this.load();
+    for (const id of serviceIds) {
+      this.services.delete(id);
+      this.diskForm.delete(id);
+      this.roots.delete(id);
+    }
+    this.notify();
+  }
+  /**
+   * Rewrite every vault, moving entities that now belong elsewhere.
+   *
+   * Called once the project store knows where projects live: entities read from
+   * the launch directory whose project turns out to be a cloud one are written
+   * into that project's vault, and disappear from the directory they came from.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
   }
   async list() {
     await this.load();
@@ -2177,7 +2467,7 @@ var serviceStore = new ServiceStore();
 import { spawn } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname, join as join4 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath } from "url";
 function buildAgentEnv() {
   const safeKeys = [
@@ -2235,7 +2525,7 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join4(dirname(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentDistPath = env.AGENT_BINARY_PATH || join4(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
     this.agentProcess = spawn("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
@@ -2261,14 +2551,14 @@ var AgentSpawner = class {
     console.log(`[agent-spawner] Local agent registered as ${LOCAL_AGENT_ID}`);
   }
   waitForPassphrase() {
-    return new Promise((resolve) => {
+    return new Promise((resolve2) => {
       if (!this.agentProcess?.stdout) {
-        resolve(null);
+        resolve2(null);
         return;
       }
       const rl = createInterface({ input: this.agentProcess.stdout });
       const timeout = setTimeout(() => {
-        resolve(null);
+        resolve2(null);
       }, PASSPHRASE_TIMEOUT);
       let initialPassphraseFound = false;
       rl.on("line", (line) => {
@@ -2278,7 +2568,7 @@ var AgentSpawner = class {
           if (!initialPassphraseFound) {
             initialPassphraseFound = true;
             clearTimeout(timeout);
-            resolve(newPassphrase);
+            resolve2(newPassphrase);
           } else {
             console.log("[agent-spawner] \u{1F504} Agent reloaded, updating passphrase...");
             this.updateAgentPassphrase(newPassphrase).catch((err) => {
@@ -2298,14 +2588,14 @@ var AgentSpawner = class {
       this.agentProcess?.on("error", (err) => {
         console.error("[agent-spawner] Failed to spawn agent:", err);
         clearTimeout(timeout);
-        if (!initialPassphraseFound) resolve(null);
+        if (!initialPassphraseFound) resolve2(null);
       });
       this.agentProcess?.on("exit", (code) => {
         if (code !== null && code !== 0) {
           console.error(`[agent-spawner] Agent exited with code ${code}`);
         }
         clearTimeout(timeout);
-        if (!initialPassphraseFound) resolve(null);
+        if (!initialPassphraseFound) resolve2(null);
       });
     });
   }
@@ -2317,9 +2607,9 @@ var AgentSpawner = class {
     if (this.agentProcess) {
       console.log("[agent-spawner] Stopping local agent...");
       this.agentProcess.kill("SIGKILL");
-      await new Promise((resolve) => {
-        this.agentProcess?.on("exit", () => resolve());
-        setTimeout(resolve, 2e3);
+      await new Promise((resolve2) => {
+        this.agentProcess?.on("exit", () => resolve2());
+        setTimeout(resolve2, 2e3);
       });
       this.agentProcess = null;
     }
@@ -2775,7 +3065,7 @@ var AgentManager = class extends EventEmitter2 {
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering agent ${config.name} (${config.id})`);
       this.disconnectAgent(config.id);
-      await new Promise((resolve) => setTimeout(resolve, 200));
+      await new Promise((resolve2) => setTimeout(resolve2, 200));
     }
     this.connectAgent(config);
     console.log(`[agent-manager] Agent ${config.name} (${config.id}) connection established`);
@@ -2792,7 +3082,7 @@ var AgentManager = class extends EventEmitter2 {
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering local agent ${config.name} (${config.id})`);
       this.disconnectAgent(config.id);
-      await new Promise((resolve) => setTimeout(resolve, 200));
+      await new Promise((resolve2) => setTimeout(resolve2, 200));
     }
     const storedPassthrough = agentStore.getPassthroughEnv(config.id);
     const configWithPassthrough = { ...config, passthroughEnv: storedPassthrough };
@@ -3114,6 +3404,18 @@ export {
   getEncryptionKey,
   ensureEncryptionKey,
   setEncryptionKey,
+  machineRoot,
+  localVaultRoot,
+  orgVaultRoot,
+  projectVaultRoot,
+  vaultFor,
+  listCloudVaults,
+  allVaultRoots,
+  machineFilePath,
+  keyedFilePath,
+  legacyMachineFilePath,
+  ensureLocalVault,
+  keyRoot,
   ProjectSchema,
   ScenarioGroupSchema,
   ScenarioNodeSchema,
@@ -3154,6 +3456,11 @@ export {
   decryptVariableSlots,
   extractEncryptedVariableSlots,
   isEncryptedValue,
+  registerProjectLoader,
+  setProjectVault,
+  forgetProject,
+  setProjectServices,
+  rootOfProject,
   environmentStore,
   serviceStore,
   agentStore,
@@ -3161,4 +3468,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-PW6A3BLD.js.map
+//# sourceMappingURL=chunk-NJJMESIY.js.map