@runeya/runeya 2.0.48 → 2.0.50

package/agent-manager-ABEKUAWR.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-JBR3MGS7.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-ABEKUAWR.js.map

package/{chunk-JUOZ4L4Y.js → chunk-JBR3MGS7.js}

@@ -442,7 +442,7 @@ var agentStore = new AgentStore();
 
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3, rm as rm2 } from "fs/promises";
 import { join as join3 } from "path";
 
 // ../server/src/services/project-key.ts
@@ -555,7 +555,7 @@ function isVaultConflicted(root) {
 
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2, rm } from "fs/promises";
 import { join as join2 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
@@ -635,7 +635,7 @@ function encryptVariableSlots(variables, existingEncrypted) {
   }
   return result;
 }
-function decryptVariableSlots(variables, contextLabel) {
+function decryptVariableSlots(variables, contextLabel, onFailure) {
   const result = {};
   for (const [key, variable] of Object.entries(variables)) {
     const slot = variable.value;
@@ -643,7 +643,8 @@ function decryptVariableSlots(variables, contextLabel) {
       try {
         result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };
       } catch (err) {
-        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message}`);
+        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message} \u2014 la valeur chiffr\xE9e est conserv\xE9e telle quelle sur le disque`);
+        onFailure?.(key);
         result[key] = { ...variable, value: { ...slot, value: "" } };
       }
     } else {
@@ -1928,6 +1929,13 @@ var EnvironmentStore = class {
   loaded = false;
   /** Cache of encrypted secret values as last written to disk */
   diskEncryptedSlots = /* @__PURE__ */ new Map();
+  /**
+   * Les secrets qu'aucune clé chargée n'a ouverts, par environnement.
+   *
+   * Vides en mémoire, ils doivent repartir sur le disque sous leur forme
+   * chiffrée : c'est ce que retient cette liste. Voir `keepUnreadableSecrets`.
+   */
+  unreadableSecrets = /* @__PURE__ */ new Map();
   listeners = /* @__PURE__ */ new Set();
   /** Notified after every persisted mutation, for the cloud sync bridge. */
   onChange(fn) {
@@ -2001,15 +2009,48 @@ var EnvironmentStore = class {
         cache?.envSlots
       );
     }
-    return { ...environment, variables: encryptedVars };
+    return { ...environment, variables: this.keepUnreadableSecrets(environment.id, encryptedVars) };
+  }
+  /**
+   * Réécrire un secret illisible tel qu'il est sur le disque, jamais à blanc.
+   *
+   * Un secret qui ne s'ouvre pas est vide en mémoire (voir
+   * `decryptVariableSlots`) : le chiffrer donnerait un chiffré de la chaîne
+   * vide, et la sauvegarde effacerait pour de bon une valeur dont il ne
+   * manquait que la clé. Son chiffré d'origine est encore là — c'est celui que
+   * `diskEncryptedSlots` a mis de côté avant le déchiffrement — et c'est lui
+   * qui repart sur le disque.
+   *
+   * La condition tient à la valeur en mémoire : tant qu'elle est vide, la
+   * variable n'a pas été retouchée et son chiffré fait foi. Dès que
+   * l'utilisateur en saisit une nouvelle, elle l'emporte — et vider un secret
+   * volontairement reste possible, puisque cela ne concerne que les variables
+   * dont le déchiffrement a échoué.
+   */
+  keepUnreadableSecrets(environmentId, variables) {
+    const failed = this.unreadableSecrets.get(environmentId);
+    if (!failed?.size || !variables) return variables;
+    const onDisk = this.diskEncryptedSlots.get(environmentId)?.envSlots ?? {};
+    const result = { ...variables };
+    for (const variableId of failed) {
+      const ciphertext = onDisk[variableId];
+      const variable = result[variableId];
+      if (!ciphertext || !variable || variable.value.value) continue;
+      result[variableId] = { ...variable, value: { ...variable.value, value: ciphertext } };
+    }
+    return result;
   }
   decryptEnvironment(environment) {
     let decryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
+      const failed = /* @__PURE__ */ new Set();
       decryptedVars = decryptVariableSlots(
         environment.variables,
-        `environment ${environment.id}`
+        `environment ${environment.id}`,
+        (variableId) => failed.add(variableId)
       );
+      if (failed.size > 0) this.unreadableSecrets.set(environment.id, failed);
+      else this.unreadableSecrets.delete(environment.id);
     }
     return { ...environment, variables: decryptedVars };
   }
@@ -2050,8 +2091,9 @@ var EnvironmentStore = class {
   /**
    * Write each vault that holds — or held — an environment.
    *
-   * Vaults emptied by this save are still written, as an empty list: an
-   * environment that moved to another vault must not survive in the old one.
+   * A vault emptied by this save loses its file: an environment that moved to
+   * another vault must not survive in the old one, and a `[]` left behind would
+   * keep (or recreate) a `.runeya` in a directory that holds nothing.
    */
   async save() {
     const byRoot = /* @__PURE__ */ new Map();
@@ -2070,8 +2112,13 @@ var EnvironmentStore = class {
       else byRoot.set(root, [prepared]);
     }
     for (const [root, environments] of byRoot) {
-      await mkdir3(root, { recursive: true });
       const filePath = this.getFilePath(root);
+      if (environments.length === 0) {
+        await rm(filePath, { force: true }).catch(() => {
+        });
+        continue;
+      }
+      await mkdir3(root, { recursive: true });
       const tmpPath = filePath + ".tmp";
       await writeFile3(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
       await rename2(tmpPath, filePath);
@@ -2111,6 +2158,7 @@ var EnvironmentStore = class {
       if (environment.projectId !== projectId) continue;
       this.environments.delete(id);
       this.diskEncryptedSlots.delete(id);
+      this.unreadableSecrets.delete(id);
       this.roots.delete(id);
     }
     this.notify();
@@ -2347,6 +2395,7 @@ var EnvironmentStore = class {
     if (!this.environments.has(id)) return false;
     this.environments.delete(id);
     this.diskEncryptedSlots.delete(id);
+    this.unreadableSecrets.delete(id);
     await this.save();
     return true;
   }
@@ -2471,8 +2520,9 @@ var ServiceStore = class {
   /**
    * Write each vault that holds — or held — a service.
    *
-   * A vault emptied by this save is still written, as an empty list: a service
-   * that moved to another vault must not survive in the one it left.
+   * A vault emptied by this save loses its file: a service that moved to
+   * another vault must not survive in the one it left, and a `[]` left behind
+   * would keep (or recreate) a `.runeya` in a directory that holds nothing.
    */
   async save() {
     const byRoot = /* @__PURE__ */ new Map();
@@ -2491,8 +2541,13 @@ var ServiceStore = class {
       else byRoot.set(root, [prepared]);
     }
     for (const [root, services] of byRoot) {
-      await mkdir4(root, { recursive: true });
       const filePath = this.getFilePath(root);
+      if (services.length === 0) {
+        await rm2(filePath, { force: true }).catch(() => {
+        });
+        continue;
+      }
+      await mkdir4(root, { recursive: true });
       const tmpPath = filePath + ".tmp";
       await writeFile4(tmpPath, JSON.stringify(services, null, 2), "utf-8");
       await rename3(tmpPath, filePath);
@@ -3694,4 +3749,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-JUOZ4L4Y.js.map
+//# sourceMappingURL=chunk-JBR3MGS7.js.map