@runeya/runeya 2.0.44 → 2.0.45

package/index.js

@@ -201,7 +201,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
   });
 }
 async function main() {
-  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-7CJJBMY3.js");
+  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-ZKQETCHR.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.44",
+  "version": "2.0.45",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-7CJJBMY3.js → src-ZKQETCHR.js}

@@ -35,8 +35,10 @@ import {
   clearEncryptionKey,
   clearPendingLegacyKey,
   decryptValue,
+  decryptValueWith,
   decryptVariableSlots,
   encryptValue,
+  encryptValueWith,
   encryptVariableSlots,
   ensureEncryptionKey,
   ensureLocalVault,
@@ -54,6 +56,7 @@ import {
   keyRoot,
   keyedFilePath,
   legacyMachineFilePath,
+  legacyVaultRoot,
   listCloudVaults,
   loadFromEnv,
   localVaultRoot,
@@ -75,7 +78,7 @@ import {
   traefikManager,
   vaultFor,
   writeEntity
-} from "./chunk-NJJMESIY.js";
+} from "./chunk-B6C5AXMK.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -1976,13 +1979,13 @@ var serviceRouter = router({
       remote: service.git?.remote,
       checkReachability: input.checkReachability
     });
-    const { exists, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
+    const { exists: exists2, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
     if (unresolvedVars.length > 0) {
       return { exists: false, canClone: false, unresolvedVars, resolvedCwd, gitMismatch: null };
     }
-    const canClone = !!service.git?.remote && (!exists || actualRemote === null);
+    const canClone = !!service.git?.remote && (!exists2 || actualRemote === null);
     let gitMismatch = null;
-    if (exists && service.git?.remote && !canClone) {
+    if (exists2 && service.git?.remote && !canClone) {
       if (actualRemote === null) {
         gitMismatch = { actual: null, configured: service.git.remote };
       } else if (actualRemote !== service.git.remote) {
@@ -1991,7 +1994,7 @@ var serviceRouter = router({
         gitMismatch = { actual: actualRemote, configured: service.git.remote, unreachable: true };
       }
     }
-    return { exists, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
+    return { exists: exists2, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
   cloneRepository: protectedProcedure.input(z3.object({ id: z3.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
@@ -6590,7 +6593,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-RQEJLSSF.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -7243,7 +7246,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-RQEJLSSF.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -13147,19 +13150,129 @@ async function ensureFilePermissions() {
   }
 }
 
+// ../server/src/services/vault-migration.ts
+import { readdir as readdir7, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir19, copyFile, unlink as unlink5, rename as rename13, stat as stat7 } from "fs/promises";
+import { join as join17 } from "path";
+var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
+var MACHINE_FILES = [
+  "agents.json",
+  "cloud-session.json",
+  "conversations.private.json",
+  "api-keys.json",
+  "api-keys.private.json",
+  "settings.private.json"
+];
+function rekeyValue(value, from, to, counter) {
+  if (typeof value === "string") {
+    if (!isEncryptedValue(value)) return value;
+    let plaintext;
+    try {
+      plaintext = decryptValueWith(from, value);
+    } catch {
+      return value;
+    }
+    counter.n += 1;
+    return encryptValueWith(to, plaintext);
+  }
+  if (Array.isArray(value)) return value.map((v) => rekeyValue(v, from, to, counter));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = rekeyValue(v, from, to, counter);
+    }
+    return out;
+  }
+  return value;
+}
+async function vaultJsonFiles(root) {
+  const entries = await readdir7(root, { withFileTypes: true });
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
+}
+async function exists(path) {
+  try {
+    await stat7(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function openLegacyVault(legacyRoot, masterPassword) {
+  const key = await readEncryptedKey(legacyRoot, masterPassword);
+  await verifyEncryptionKey(legacyRoot, key);
+  return key;
+}
+async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
+  const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
+  const backupDir = join17(legacyRoot, `backup-${stamp}`);
+  await mkdir19(backupDir, { recursive: true });
+  const jsonFiles = await vaultJsonFiles(legacyRoot);
+  for (const name of [...jsonFiles, ...KEY_FILES]) {
+    if (await exists(join17(legacyRoot, name))) {
+      await copyFile(join17(legacyRoot, name), join17(backupDir, name));
+    }
+  }
+  const rekeyed = [];
+  for (const name of jsonFiles) {
+    const raw = await readFile17(join17(legacyRoot, name), "utf-8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const counter = { n: 0 };
+    const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
+    if (counter.n === 0) continue;
+    const tmp = join17(legacyRoot, `${name}.tmp`);
+    await writeFile16(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename13(tmp, join17(legacyRoot, name));
+    rekeyed.push({ file: name, values: counter.n });
+  }
+  for (const { file, values } of rekeyed) {
+    const parsed = JSON.parse(await readFile17(join17(legacyRoot, file), "utf-8"));
+    const check = { n: 0 };
+    rekeyValue(parsed, machineKey, machineKey, check);
+    if (check.n !== values) {
+      throw new Error(
+        `V\xE9rification \xE9chou\xE9e pour ${file} : ${check.n} valeur(s) relisible(s) avec la cl\xE9 machine, ${values} attendue(s)`
+      );
+    }
+  }
+  await mkdir19(machineRootDir, { recursive: true });
+  const moved = [];
+  const skipped = [];
+  for (const name of MACHINE_FILES) {
+    const from = join17(legacyRoot, name);
+    if (!await exists(from)) continue;
+    const to = join17(machineRootDir, name);
+    if (await exists(to)) {
+      skipped.push(name);
+      continue;
+    }
+    await copyFile(from, to);
+    await unlink5(from);
+    moved.push(name);
+  }
+  for (const name of KEY_FILES) {
+    const path = join17(legacyRoot, name);
+    if (await exists(path)) await unlink5(path);
+  }
+  return { backupDir, rekeyed, moved, skipped };
+}
+
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile17,
-  writeFile as writeFile16,
-  rename as rename13,
-  mkdir as mkdir19,
+  readFile as readFile18,
+  writeFile as writeFile17,
+  rename as rename14,
+  mkdir as mkdir20,
   access as access2,
-  readdir as readdir7
+  readdir as readdir8
 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -13268,7 +13381,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile17(filePath, "utf-8")).trim();
+  const raw = (await readFile18(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -13288,14 +13401,14 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile16(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename13(tmp, path);
+  await writeFile17(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await rename14(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const { resolve: resolve6 } = await import("path");
   const abCwd = resolve6(process.cwd());
-  const legacyRoot = join17(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join17(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = join18(abCwd, env.DATA_DIR);
+  const legacyKeyPath = join18(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -13303,20 +13416,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join17(abCwd, ".runeya-tmp");
-  await rename13(legacyRoot, legacyTmp);
-  await mkdir19(dataDir, { recursive: true });
-  const legacyOld = join17(dataDir, `backup-${timestamp}`);
-  await rename13(legacyTmp, legacyOld);
+  const legacyTmp = join18(abCwd, ".runeya-tmp");
+  await rename14(legacyRoot, legacyTmp);
+  await mkdir20(dataDir, { recursive: true });
+  const legacyOld = join18(dataDir, `backup-${timestamp}`);
+  await rename14(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile17(join17(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile18(join18(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join17(legacyOld, "dbs");
+  const dbsDir = join18(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -13325,29 +13438,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join17(dbsDir, "envs");
-  const envFiles = (await readdir7(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join18(dbsDir, "envs");
+  const envFiles = (await readdir8(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join17(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join18(envsDir, file));
   }
-  const servicesDir = join17(dbsDir, "services");
-  const serviceFiles = (await readdir7(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join18(dbsDir, "services");
+  const serviceFiles = (await readdir8(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join17(servicesDir, file));
+    const data = await readEncrypted(join18(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join17(dbsDir, "overrides");
-  const overrideFiles = (await readdir7(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join18(dbsDir, "overrides");
+  const overrideFiles = (await readdir8(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join17(overridesDir, file));
+    const data = await readEncrypted(join18(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -13355,11 +13468,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join17(dbsDir, "parsers");
-  const parserFiles = (await readdir7(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join18(dbsDir, "parsers");
+  const parserFiles = (await readdir8(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join17(parsersDir, file));
+    const data = await readEncrypted(join18(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -13700,7 +13813,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile17(join17(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile18(join18(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -13721,11 +13834,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join17(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join17(dataDir, "services.json"), runeServices);
-  await atomicWrite(join17(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join17(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join17(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join18(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join18(dataDir, "services.json"), runeServices);
+  await atomicWrite(join18(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join18(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join18(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -13736,12 +13849,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries = await readdir7(dataDir);
+    const entries = await readdir8(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join17(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join18(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile17(keyJsonPath, "utf-8");
+        const raw = await readFile18(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -13763,14 +13876,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const abDataDir = resolve6(dataDir);
   const abCwd = resolve6(process.cwd());
   const candidateDirs = [
-    join17(abCwd, ".runeya", "dbs", "overrides"),
-    join17(abDataDir, "dbs", "overrides")
+    join18(abCwd, ".runeya", "dbs", "overrides"),
+    join18(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir7(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir8(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -13780,7 +13893,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join17(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join18(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -13798,7 +13911,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile17(join17(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile18(join18(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -13817,7 +13930,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile17(join17(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile18(join18(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -13834,7 +13947,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join18(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13861,7 +13974,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join17(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join18(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -13871,7 +13984,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join18(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13930,12 +14043,12 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join17(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join18(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename13(overridesDir, migratedDir);
+    await rename14(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -13945,8 +14058,8 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join18 } from "path";
-import { stat as stat7 } from "fs/promises";
+import { join as join19 } from "path";
+import { stat as stat8 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
 async function getServerState() {
@@ -13955,36 +14068,43 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat7(join18(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat8(join19(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, VERIFY_FILENAME2));
+    await stat8(join19(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, "projects.json"));
+    await stat8(join19(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, "project.json"));
+    await stat8(join19(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
   if (hasEncryptionKey()) {
-    return { state: "unlocked", hasVerifyFile: false, isLegacyMigration: false, hasExistingData: hasData };
+    return {
+      state: "unlocked",
+      hasVerifyFile: false,
+      isLegacyMigration: false,
+      hasExistingData: hasData,
+      legacyVault: await legacyVaultRoot()
+    };
   }
   if (hasEncFile) {
-    return { state: "locked", hasVerifyFile: hasVerify, isLegacyMigration: false, hasExistingData: hasData };
+    return { state: "locked", hasVerifyFile: hasVerify, isLegacyMigration: false, hasExistingData: hasData, legacyVault: null };
   }
   return {
     state: "setup",
     hasVerifyFile: hasVerify,
     isLegacyMigration: hasPendingLegacyKey(),
-    hasExistingData: hasData
+    hasExistingData: hasData,
+    legacyVault: null
   };
 }
 
@@ -14730,6 +14850,48 @@ async function createLocalServer() {
       }
     }
   });
+  app.post("/api/migrate-vault", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
+    try {
+      const jwt = typeof req.headers.authorization === "string" && req.headers.authorization.startsWith("Bearer ") ? req.headers.authorization.slice(7) : "";
+      if (!isCiMode()) {
+        try {
+          await verifyJwt(jwt);
+        } catch {
+          res.status(401).json({ error: "Session invalide" });
+          return;
+        }
+      }
+      const machineKey = getEncryptionKey();
+      if (!machineKey) {
+        res.status(409).json({ error: "Serveur verrouill\xE9" });
+        return;
+      }
+      const legacyRoot = await legacyVaultRoot();
+      if (!legacyRoot) {
+        res.status(409).json({ error: "Aucun coffre \xE0 migrer dans ce r\xE9pertoire" });
+        return;
+      }
+      const body = req.body;
+      const masterPassword = body.masterPassword;
+      if (typeof masterPassword !== "string" || masterPassword.length < 1 || masterPassword.length > 1024) {
+        res.status(400).json({ error: "masterPassword invalide" });
+        return;
+      }
+      let legacyKey;
+      try {
+        legacyKey = await openLegacyVault(legacyRoot, masterPassword);
+      } catch {
+        res.status(401).json({ error: "Ancien master password incorrect" });
+        return;
+      }
+      const report = await migrateLegacyVault(legacyRoot, machineRoot(), legacyKey, machineKey, /* @__PURE__ */ new Date());
+      console.log(`[vault-migration] ${legacyRoot} migr\xE9 \u2014 sauvegarde : ${report.backupDir}`);
+      res.json(report);
+    } catch (err) {
+      console.error("[server] Vault migration error:", err);
+      res.status(500).json({ error: err instanceof Error ? err.message : "Erreur interne" });
+    }
+  });
   app.get("/:apikey/llms.txt", llmsLimiter, async (req, res) => {
     const apikey = Array.isArray(req.params["apikey"]) ? req.params["apikey"][0] : req.params["apikey"];
     if (!apikey || !/^[0-9a-f]{64}$/i.test(apikey)) {
@@ -15134,4 +15296,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-7CJJBMY3.js.map
+//# sourceMappingURL=src-ZKQETCHR.js.map