@runeya/runeya 2.0.44 → 2.0.45

package/agent-manager-RQEJLSSF.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-B6C5AXMK.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-RQEJLSSF.js.map

package/{chunk-NJJMESIY.js → chunk-B6C5AXMK.js}

@@ -125,20 +125,28 @@ async function ensureLocalVault() {
 }
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var keyRootPromise = null;
+async function holdsKey(root) {
+  for (const filename of KEY_FILES) {
+    try {
+      await access(join(root, filename));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
 function keyRoot() {
   keyRootPromise ??= (async () => {
-    const local = localVaultRoot();
-    for (const filename of KEY_FILES) {
-      try {
-        await access(join(local, filename));
-        return local;
-      } catch {
-      }
-    }
-    return machineRoot();
+    if (await holdsKey(machineRoot())) return machineRoot();
+    return await holdsKey(localVaultRoot()) ? localVaultRoot() : machineRoot();
   })();
   return keyRootPromise;
 }
+async function legacyVaultRoot() {
+  const local = localVaultRoot();
+  if (await keyRoot() === local) return null;
+  return await holdsKey(local) ? local : null;
+}
 
 // ../server/src/utils/encryption-key.ts
 import { createHash } from "crypto";
@@ -438,6 +446,27 @@ import { join as join2 } from "path";
 // ../server/src/services/crypto-helpers.ts
 import { randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 var ALGORITHM2 = "aes-256-gcm";
+function encryptValueWith(key, plaintext) {
+  const iv = randomBytes2(16);
+  const cipher = createCipheriv2(ALGORITHM2, key, iv);
+  let enc = cipher.update(plaintext, "utf-8", "hex");
+  enc += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${enc}`;
+}
+function decryptValueWith(key, encrypted) {
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
+  const [ivHex, authTagHex, ciphertext] = parts;
+  if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
+    throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
+  }
+  const decipher = createDecipheriv2(ALGORITHM2, key, Buffer.from(ivHex, "hex"), { authTagLength: 16 });
+  decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
+  let dec = decipher.update(ciphertext, "hex", "utf-8");
+  dec += decipher.final("utf-8");
+  return dec;
+}
 function encryptValue(plaintext) {
   const maybeKey = getEncryptionKey();
   if (!maybeKey) {
@@ -3416,6 +3445,7 @@ export {
   legacyMachineFilePath,
   ensureLocalVault,
   keyRoot,
+  legacyVaultRoot,
   ProjectSchema,
   ScenarioGroupSchema,
   ScenarioNodeSchema,
@@ -3449,6 +3479,8 @@ export {
   getCollection,
   readEntity,
   writeEntity,
+  encryptValueWith,
+  decryptValueWith,
   encryptValue,
   decryptValue,
   stableEncryptValue,
@@ -3468,4 +3500,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-NJJMESIY.js.map
+//# sourceMappingURL=chunk-B6C5AXMK.js.map