@runeya/runeya 2.0.44 → 2.0.46

package/agent-manager-JJYZDLNB.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-5PRQBES2.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-JJYZDLNB.js.map

package/{chunk-NJJMESIY.js → chunk-5PRQBES2.js}

@@ -5,16 +5,17 @@ import { z as z21 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
-import { readFile, writeFile, rename, mkdir as mkdir2, chmod } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, rename, mkdir as mkdir2, chmod } from "fs/promises";
 import { dirname } from "path";
 
 // ../server/src/services/vault-resolver.ts
-import { join, resolve } from "path";
+import { join, sep } from "path";
 import { homedir } from "os";
-import { readdir, mkdir, access } from "fs/promises";
+import { readdir, mkdir, access, readFile, writeFile } from "fs/promises";
 
 // ../server/src/config/env.ts
 import { z } from "zod";
+import { resolve as resolvePath } from "path";
 var serverPort = z.coerce.number().int().min(1).max(65535).default(4e3).parse(process.env.RUNEYA_HTTP_PORT);
 var defaultAgentPort = process.env.RUNEYA_AGENT_PORT ? z.coerce.number().int().min(1).max(65535).parse(process.env.RUNEYA_AGENT_PORT) : serverPort + 1;
 var EnvSchema = z.object({
@@ -48,7 +49,15 @@ var EnvSchema = z.object({
   PORT: data.RUNEYA_HTTP_PORT,
   HOST: data.RUNEYA_HOST,
   MODE: data.RUNEYA_MODE,
-  DATA_DIR: data.RUNEYA_DATA_DIR,
+  /**
+   * Absolute from the start, resolved once against the launch directory.
+   *
+   * It defaults to a relative `.runeya`, and every caller used to re-resolve it
+   * against whatever the process's cwd happened to be. A vault that moves when
+   * the process changes directory is a vault that can be silently written to the
+   * wrong place — so the answer is fixed here, at boot, and never recomputed.
+   */
+  DATA_DIR: resolvePath(data.RUNEYA_DATA_DIR),
   HOME_DIR: data.RUNEYA_HOME,
   CLOUD_URL: data.RUNEYA_CLOUD_URL,
   CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,
@@ -70,7 +79,7 @@ function machineRoot() {
   return join(override && override.length > 0 ? override : homedir(), ".runeya");
 }
 function localVaultRoot() {
-  return resolve(env.DATA_DIR);
+  return env.DATA_DIR;
 }
 function orgVaultRoot(orgId) {
   assertSafeId("organization", orgId);
@@ -84,6 +93,34 @@ function vaultFor(target) {
   if (!target.orgId) return { root: localVaultRoot() };
   return { root: projectVaultRoot(target.orgId, target.id) };
 }
+var ORG_CLOUD_FILE = "cloud.json";
+async function stampOrgCloud(orgId, cloudUrl) {
+  const root = orgVaultRoot(orgId);
+  try {
+    await mkdir(root, { recursive: true });
+    await writeFile(join(root, ORG_CLOUD_FILE), JSON.stringify({ cloudUrl }, null, 2), "utf-8");
+  } catch {
+  }
+}
+async function readOrgClouds() {
+  const orgsDir = join(machineRoot(), "orgs");
+  const out = {};
+  let orgIds;
+  try {
+    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return out;
+  }
+  for (const orgId of orgIds) {
+    try {
+      const raw = await readFile(join(orgsDir, orgId, ORG_CLOUD_FILE), "utf-8");
+      const url = JSON.parse(raw).cloudUrl;
+      if (typeof url === "string" && url) out[orgId] = url;
+    } catch {
+    }
+  }
+  return out;
+}
 async function listCloudVaults() {
   const orgsDir = join(machineRoot(), "orgs");
   const found = [];
@@ -125,20 +162,28 @@ async function ensureLocalVault() {
 }
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var keyRootPromise = null;
+async function holdsKey(root) {
+  for (const filename of KEY_FILES) {
+    try {
+      await access(join(root, filename));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
 function keyRoot() {
   keyRootPromise ??= (async () => {
-    const local = localVaultRoot();
-    for (const filename of KEY_FILES) {
-      try {
-        await access(join(local, filename));
-        return local;
-      } catch {
-      }
-    }
-    return machineRoot();
+    if (await holdsKey(machineRoot())) return machineRoot();
+    return await holdsKey(localVaultRoot()) ? localVaultRoot() : machineRoot();
   })();
   return keyRootPromise;
 }
+async function legacyVaultRoot() {
+  const local = localVaultRoot();
+  if (await keyRoot() === local) return null;
+  return await holdsKey(local) ? local : null;
+}
 
 // ../server/src/utils/encryption-key.ts
 import { createHash } from "crypto";
@@ -261,9 +306,9 @@ var AgentStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile(await this.getFilePath(), "utf-8");
+      return await readFile2(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile(this.getLegacyFilePath(), "utf-8");
+      return readFile2(this.getLegacyFilePath(), "utf-8");
     }
   }
   async ensureDir() {
@@ -296,7 +341,7 @@ var AgentStore = class {
       passthroughEnv: this.passthroughEnv,
       traefikConfigs: this.traefikConfigs
     };
-    await writeFile(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
+    await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
     await rename(tmpPath, filePath);
     await chmod(filePath, 384);
   }
@@ -397,47 +442,146 @@ var agentStore = new AgentStore();
 
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir4, chmod as chmod3 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3 } from "fs/promises";
 import { join as join3 } from "path";
 
+// ../server/src/services/project-key.ts
+function projectKey(ref) {
+  return `${ref.orgId ?? "local"}:${ref.id}`;
+}
+var AmbiguousProjectError = class extends Error {
+  constructor(projectId, orgIds) {
+    const where = orgIds.map((o) => o ?? "local").join(", ");
+    super(
+      `Project id ${projectId} exists in several organizations (${where}). Name the organization alongside the project id.`
+    );
+    this.projectId = projectId;
+    this.orgIds = orgIds;
+    this.name = "AmbiguousProjectError";
+  }
+  code = "AMBIGUOUS_PROJECT_ID";
+};
+
 // ../server/src/services/vault-registry.ts
 var loadProjects = null;
 var projectRoots = /* @__PURE__ */ new Map();
+var projectRefs = /* @__PURE__ */ new Map();
 var serviceOwners = /* @__PURE__ */ new Map();
 function registerProjectLoader(load) {
   loadProjects = load;
 }
-function setProjectVault(projectId, root) {
-  projectRoots.set(projectId, root);
+async function ensureProjectsLoaded() {
+  await loadProjects?.();
 }
-function forgetProject(projectId) {
-  projectRoots.delete(projectId);
-  for (const [serviceId, owner] of serviceOwners) {
-    if (owner === projectId) serviceOwners.delete(serviceId);
+function setProjectVault(ref, root) {
+  const key = projectKey(ref);
+  projectRoots.set(key, root);
+  projectRefs.set(key, { id: ref.id, orgId: ref.orgId ?? null });
+}
+function forgetProject(ref) {
+  const key = projectKey(ref);
+  projectRoots.delete(key);
+  projectRefs.delete(key);
+  for (const [serviceId, owners] of serviceOwners) {
+    owners.delete(key);
+    if (owners.size === 0) serviceOwners.delete(serviceId);
   }
 }
-function setProjectServices(projectId, serviceIds) {
-  for (const [serviceId, owner] of serviceOwners) {
-    if (owner === projectId && !serviceIds.includes(serviceId)) serviceOwners.delete(serviceId);
+function setProjectServices(ref, serviceIds) {
+  const key = projectKey(ref);
+  for (const [serviceId, owners] of serviceOwners) {
+    if (!serviceIds.includes(serviceId)) {
+      owners.delete(key);
+      if (owners.size === 0) serviceOwners.delete(serviceId);
+    }
+  }
+  for (const serviceId of serviceIds) {
+    const owners = serviceOwners.get(serviceId) ?? /* @__PURE__ */ new Set();
+    owners.add(key);
+    serviceOwners.set(serviceId, owners);
   }
-  for (const serviceId of serviceIds) serviceOwners.set(serviceId, projectId);
 }
-function rootOfProject(projectId) {
-  return projectRoots.get(projectId) ?? localVaultRoot();
+function rootOfProjectRef(ref) {
+  return projectRoots.get(projectKey(ref)) ?? localVaultRoot();
 }
-function rootOfService(serviceId) {
-  const owner = serviceOwners.get(serviceId);
-  return owner ? rootOfProject(owner) : localVaultRoot();
+function refsOfProjectId(projectId) {
+  const matches = [];
+  for (const ref of projectRefs.values()) {
+    if (ref.id === projectId) matches.push(ref);
+  }
+  return matches;
+}
+function rootOfProjectAmong(projectId, hint) {
+  const matches = refsOfProjectId(projectId);
+  if (matches.length > 1) {
+    const known = matches.map((ref2) => rootOfProjectRef(ref2));
+    if (hint && known.includes(hint)) return hint;
+    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
+  }
+  const [ref] = matches;
+  return ref ? rootOfProjectRef(ref) : hint ?? localVaultRoot();
+}
+function refOfProjectAmong(projectId, hint) {
+  const matches = refsOfProjectId(projectId);
+  if (matches.length > 1) {
+    const found = hint ? matches.find((ref) => rootOfProjectRef(ref) === hint) : void 0;
+    if (found) return found;
+    throw new AmbiguousProjectError(projectId, matches.map((r) => r.orgId ?? null));
+  }
+  return matches[0] ?? { id: projectId, orgId: null };
+}
+function rootOfService(serviceId, hint = null) {
+  const owners = serviceOwners.get(serviceId);
+  if (!owners || owners.size === 0) return hint ?? localVaultRoot();
+  const roots = Array.from(owners, (key) => projectRoots.get(key)).filter((r) => !!r);
+  if (hint && roots.includes(hint)) return hint;
+  return roots[0] ?? hint ?? localVaultRoot();
+}
+
+// ../server/src/services/vault-conflicts.ts
+var conflicted = /* @__PURE__ */ new Map();
+function markVaultConflict(root, detail) {
+  if (conflicted.has(root)) return;
+  conflicted.set(root, detail);
+  console.error(
+    "[vaults] %s partage des identifiants avec un autre coffre (%s) \u2014 son contenu est ignor\xE9 et laiss\xE9 intact. Cessez de suivre l'un des deux projets.",
+    root,
+    detail
+  );
+}
+function isVaultConflicted(root) {
+  return conflicted.has(root);
 }
 
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { join as join2 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
 import { randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 var ALGORITHM2 = "aes-256-gcm";
+function encryptValueWith(key, plaintext) {
+  const iv = randomBytes2(16);
+  const cipher = createCipheriv2(ALGORITHM2, key, iv);
+  let enc = cipher.update(plaintext, "utf-8", "hex");
+  enc += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${enc}`;
+}
+function decryptValueWith(key, encrypted) {
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
+  const [ivHex, authTagHex, ciphertext] = parts;
+  if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
+    throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
+  }
+  const decipher = createDecipheriv2(ALGORITHM2, key, Buffer.from(ivHex, "hex"), { authTagLength: 16 });
+  decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
+  let dec = decipher.update(ciphertext, "hex", "utf-8");
+  dec += decipher.final("utf-8");
+  return dec;
+}
 function encryptValue(plaintext) {
   const maybeKey = getEncryptionKey();
   if (!maybeKey) {
@@ -1794,15 +1938,44 @@ var EnvironmentStore = class {
   /**
    * The vault an environment must be written to: its project's.
    *
+   * An environment names its project by id alone, and that id can answer for a
+   * project in each organization. The vault it was read from names the couple —
+   * so it is handed over as the tie-breaker rather than left as a mere fallback.
+   *
    * Falls back to where it was last read, then to the local vault — an
    * environment whose project is unknown belongs to the launch directory, which
    * is where it lived before vaults existed.
    */
   rootFor(environment) {
-    const known = this.roots.get(environment.id);
-    const projectRoot = environment.projectId ? rootOfProject(environment.projectId) : null;
+    const known = this.roots.get(environment.id) ?? null;
+    const projectRoot = environment.projectId ? rootOfProjectAmong(environment.projectId, known) : null;
     return projectRoot ?? known ?? localVaultRoot();
   }
+  /**
+   * Le projet d'un environnement, organisation comprise.
+   *
+   * L'environnement ne nomme que l'id ; le coffre d'où il vient fournit
+   * l'organisation, et c'est ce couple qu'il faut pour agir sur son projet.
+   */
+  projectRefOf(environment) {
+    if (!environment.projectId) return null;
+    return refOfProjectAmong(environment.projectId, this.roots.get(environment.id) ?? null);
+  }
+  /**
+   * The vault holding the environment that defines a variable.
+   *
+   * Overrides answer a variable, not a project: this is what lets them find the
+   * same vault without re-resolving an id that may be ambiguous.
+   */
+  async rootOfVariable(variableId) {
+    await this.load();
+    for (const environment of this.environments.values()) {
+      if (environment.variables && variableId in environment.variables) {
+        return this.rootFor(environment);
+      }
+    }
+    return null;
+  }
   extractEncryptedCache(environment) {
     const envSlots = extractEncryptedVariableSlots(
       environment.variables
@@ -1840,14 +2013,20 @@ var EnvironmentStore = class {
   async load() {
     if (this.loaded) return;
     this.loaded = true;
+    await ensureProjectsLoaded();
     if (!getEncryptionKey()) {
       this.loaded = false;
       return;
     }
     for (const root of await allVaultRoots()) {
       try {
-        const raw = await readFile2(this.getFilePath(root), "utf-8");
+        const raw = await readFile3(this.getFilePath(root), "utf-8");
         const data = JSON.parse(raw);
+        const clash = data.find((e) => this.environments.has(e.id) && this.roots.get(e.id) !== root);
+        if (clash) {
+          markVaultConflict(root, `environnement ${clash.id}`);
+          continue;
+        }
         for (const e of data) {
           this.diskEncryptedSlots.set(e.id, this.extractEncryptedCache(e));
           const decrypted = this.decryptEnvironment(e);
@@ -1866,13 +2045,16 @@ var EnvironmentStore = class {
    */
   async save() {
     const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) byRoot.set(root, []);
+    for (const root of this.roots.values()) {
+      if (!isVaultConflicted(root)) byRoot.set(root, []);
+    }
     byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
     for (const environment of this.environments.values()) {
       const root = this.rootFor(environment);
       const prepared = this.encryptEnvironment(environment);
       this.diskEncryptedSlots.set(prepared.id, this.extractEncryptedCache(prepared));
       this.roots.set(environment.id, root);
+      if (isVaultConflicted(root)) continue;
       const bucket = byRoot.get(root);
       if (bucket) bucket.push(prepared);
       else byRoot.set(root, [prepared]);
@@ -1881,7 +2063,7 @@ var EnvironmentStore = class {
       await mkdir3(root, { recursive: true });
       const filePath = this.getFilePath(root);
       const tmpPath = filePath + ".tmp";
-      await writeFile2(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
+      await writeFile3(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
       await rename2(tmpPath, filePath);
       await chmod2(filePath, 384);
     }
@@ -1906,15 +2088,6 @@ var EnvironmentStore = class {
    * which project it belongs to — so this is what lets them be stored with
    * their project rather than in one machine-wide pile.
    */
-  async projectIdOfVariable(variableId) {
-    await this.load();
-    for (const environment of this.environments.values()) {
-      if (environment.variables && variableId in environment.variables) {
-        return environment.projectId;
-      }
-    }
-    return null;
-  }
   /**
    * Drop a project's environments from memory, without touching the disk.
    *
@@ -1932,15 +2105,37 @@ var EnvironmentStore = class {
     }
     this.notify();
   }
-  async list(projectId) {
+  /**
+   * Les environnements d'un projet.
+   *
+   * `orgId` restreint au projet de cette organisation : deux projets homonymes
+   * ont chacun les siens, et filtrer sur le seul `projectId` mélangeait les deux
+   * listes à l'écran. Omis, le filtre reste sur l'id — ce que fait un appelant
+   * qui n'a pas d'organisation à donner.
+   */
+  async list(projectId, orgId) {
     await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.projectId === projectId);
+    return this.ofProject(projectId, orgId);
+  }
+  /** Le filtre commun : l'id, puis le coffre quand l'organisation est connue. */
+  ofProject(projectId, orgId) {
+    const byId = Array.from(this.environments.values()).filter((e) => e.projectId === projectId);
+    if (orgId === void 0) return byId;
+    const root = vaultFor({ id: projectId, orgId }).root;
+    return byId.filter((e) => this.rootFor(e) === root);
   }
   async get(id) {
     await this.load();
     return this.environments.get(id) ?? null;
   }
-  async create(input) {
+  /**
+   * `orgId` ne fait pas partie de l'environnement : il dit dans quel coffre le
+   * poser. Un environnement neuf n'a pas encore de provenance, et son
+   * `projectId` seul peut répondre pour un projet de chaque organisation — sans
+   * cette précision, la création échouerait sur l'ambiguïté au lieu de viser le
+   * bon coffre.
+   */
+  async create(input, orgId) {
     await this.load();
     const parsed = CreateEnvironmentSchema.parse(input);
     const environment = {
@@ -1967,6 +2162,9 @@ var EnvironmentStore = class {
       }
     }
     this.environments.set(environment.id, environment);
+    if (environment.projectId && orgId !== void 0) {
+      this.roots.set(environment.id, vaultFor({ id: environment.projectId, orgId }).root);
+    }
     await this.save();
     return environment;
   }
@@ -2022,18 +2220,18 @@ var EnvironmentStore = class {
     await this.save();
     return true;
   }
-  async getByProjectId(projectId) {
+  async getByProjectId(projectId, orgId) {
     await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.projectId === projectId);
+    return this.ofProject(projectId, orgId);
   }
   async listAllGlobal() {
     await this.load();
     return Array.from(this.environments.values()).filter((e) => e.scope === "global");
   }
   // --- Scope-based Query Methods ---
-  async listByScope(projectId, scope) {
+  async listByScope(projectId, scope, orgId) {
     await this.load();
-    return Array.from(this.environments.values()).filter((e) => e.projectId === projectId && e.scope === scope);
+    return this.ofProject(projectId, orgId).filter((e) => e.scope === scope);
   }
   async findServiceEnvironment(serviceId, globalEnvId) {
     await this.load();
@@ -2221,7 +2419,7 @@ var ServiceStore = class {
    * finally to the local vault.
    */
   rootFor(serviceId) {
-    return rootOfService(serviceId) ?? this.roots.get(serviceId) ?? localVaultRoot();
+    return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();
   }
   /**
    * Read every vault: the launch directory and each materialized cloud project.
@@ -2233,10 +2431,16 @@ var ServiceStore = class {
     if (this.loaded) return;
     if (!getEncryptionKey()) return;
     this.loaded = true;
+    await ensureProjectsLoaded();
     for (const root of await allVaultRoots()) {
       try {
-        const raw = await readFile3(this.getFilePath(root), "utf-8");
+        const raw = await readFile4(this.getFilePath(root), "utf-8");
         const data = JSON.parse(raw);
+        const clash = data.find((s) => this.services.has(s.id) && this.roots.get(s.id) !== root);
+        if (clash) {
+          markVaultConflict(root, `service ${clash.id}`);
+          continue;
+        }
         for (const s of data) {
           if (s.commands) {
             for (const cmd of s.commands) {
@@ -2262,13 +2466,16 @@ var ServiceStore = class {
    */
   async save() {
     const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) byRoot.set(root, []);
+    for (const root of this.roots.values()) {
+      if (!isVaultConflicted(root)) byRoot.set(root, []);
+    }
     byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
     for (const service of this.services.values()) {
       const root = this.rootFor(service.id);
       const prepared = prepareForDisk(service, this.diskForm.get(service.id));
       this.diskForm.set(prepared.id, prepared);
       this.roots.set(service.id, root);
+      if (isVaultConflicted(root)) continue;
       const bucket = byRoot.get(root);
       if (bucket) bucket.push(prepared);
       else byRoot.set(root, [prepared]);
@@ -2277,7 +2484,7 @@ var ServiceStore = class {
       await mkdir4(root, { recursive: true });
       const filePath = this.getFilePath(root);
       const tmpPath = filePath + ".tmp";
-      await writeFile3(tmpPath, JSON.stringify(services, null, 2), "utf-8");
+      await writeFile4(tmpPath, JSON.stringify(services, null, 2), "utf-8");
       await rename3(tmpPath, filePath);
       await chmod3(filePath, 384);
     }
@@ -2551,14 +2758,14 @@ var AgentSpawner = class {
     console.log(`[agent-spawner] Local agent registered as ${LOCAL_AGENT_ID}`);
   }
   waitForPassphrase() {
-    return new Promise((resolve2) => {
+    return new Promise((resolve) => {
       if (!this.agentProcess?.stdout) {
-        resolve2(null);
+        resolve(null);
         return;
       }
       const rl = createInterface({ input: this.agentProcess.stdout });
       const timeout = setTimeout(() => {
-        resolve2(null);
+        resolve(null);
       }, PASSPHRASE_TIMEOUT);
       let initialPassphraseFound = false;
       rl.on("line", (line) => {
@@ -2568,7 +2775,7 @@ var AgentSpawner = class {
           if (!initialPassphraseFound) {
             initialPassphraseFound = true;
             clearTimeout(timeout);
-            resolve2(newPassphrase);
+            resolve(newPassphrase);
           } else {
             console.log("[agent-spawner] \u{1F504} Agent reloaded, updating passphrase...");
             this.updateAgentPassphrase(newPassphrase).catch((err) => {
@@ -2588,14 +2795,14 @@ var AgentSpawner = class {
       this.agentProcess?.on("error", (err) => {
         console.error("[agent-spawner] Failed to spawn agent:", err);
         clearTimeout(timeout);
-        if (!initialPassphraseFound) resolve2(null);
+        if (!initialPassphraseFound) resolve(null);
       });
       this.agentProcess?.on("exit", (code) => {
         if (code !== null && code !== 0) {
           console.error(`[agent-spawner] Agent exited with code ${code}`);
         }
         clearTimeout(timeout);
-        if (!initialPassphraseFound) resolve2(null);
+        if (!initialPassphraseFound) resolve(null);
       });
     });
   }
@@ -2607,9 +2814,9 @@ var AgentSpawner = class {
     if (this.agentProcess) {
       console.log("[agent-spawner] Stopping local agent...");
       this.agentProcess.kill("SIGKILL");
-      await new Promise((resolve2) => {
-        this.agentProcess?.on("exit", () => resolve2());
-        setTimeout(resolve2, 2e3);
+      await new Promise((resolve) => {
+        this.agentProcess?.on("exit", () => resolve());
+        setTimeout(resolve, 2e3);
       });
       this.agentProcess = null;
     }
@@ -3065,7 +3272,7 @@ var AgentManager = class extends EventEmitter2 {
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering agent ${config.name} (${config.id})`);
       this.disconnectAgent(config.id);
-      await new Promise((resolve2) => setTimeout(resolve2, 200));
+      await new Promise((resolve) => setTimeout(resolve, 200));
     }
     this.connectAgent(config);
     console.log(`[agent-manager] Agent ${config.name} (${config.id}) connection established`);
@@ -3082,7 +3289,7 @@ var AgentManager = class extends EventEmitter2 {
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering local agent ${config.name} (${config.id})`);
       this.disconnectAgent(config.id);
-      await new Promise((resolve2) => setTimeout(resolve2, 200));
+      await new Promise((resolve) => setTimeout(resolve, 200));
     }
     const storedPassthrough = agentStore.getPassthroughEnv(config.id);
     const configWithPassthrough = { ...config, passthroughEnv: storedPassthrough };
@@ -3409,6 +3616,8 @@ export {
   orgVaultRoot,
   projectVaultRoot,
   vaultFor,
+  stampOrgCloud,
+  readOrgClouds,
   listCloudVaults,
   allVaultRoots,
   machineFilePath,
@@ -3416,6 +3625,7 @@ export {
   legacyMachineFilePath,
   ensureLocalVault,
   keyRoot,
+  legacyVaultRoot,
   ProjectSchema,
   ScenarioGroupSchema,
   ScenarioNodeSchema,
@@ -3449,6 +3659,8 @@ export {
   getCollection,
   readEntity,
   writeEntity,
+  encryptValueWith,
+  decryptValueWith,
   encryptValue,
   decryptValue,
   stableEncryptValue,
@@ -3456,11 +3668,15 @@ export {
   decryptVariableSlots,
   extractEncryptedVariableSlots,
   isEncryptedValue,
+  projectKey,
+  AmbiguousProjectError,
   registerProjectLoader,
+  ensureProjectsLoaded,
   setProjectVault,
   forgetProject,
   setProjectServices,
-  rootOfProject,
+  rootOfProjectAmong,
+  refOfProjectAmong,
   environmentStore,
   serviceStore,
   agentStore,
@@ -3468,4 +3684,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-NJJMESIY.js.map
+//# sourceMappingURL=chunk-5PRQBES2.js.map