@runeya/runeya 2.0.49 → 2.0.51

package/{src-WVK4WUI3.js → src-R6JOPDNL.js}

@@ -84,7 +84,7 @@ import {
   traefikManager,
   vaultFor,
   writeEntity
-} from "./chunk-4AGTVGSH.js";
+} from "./chunk-NVKGIBJN.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -6324,7 +6324,7 @@ var CloudSessionStore = class {
 };
 var cloudSessionStore = new CloudSessionStore();
 
-// ../server/src/trpc/routers/cloud-auth.ts
+// ../server/src/services/cloud-api.ts
 var DEFAULT_CLOUD_API_URL = "https://api.runeya.dev";
 var DEFAULT_CLOUD_APP_URL = "https://runeya.dev";
 function getCloudApiUrl() {
@@ -6333,6 +6333,31 @@ function getCloudApiUrl() {
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
+var CloudNotLinkedError = class extends Error {
+  code = "CLOUD_NOT_LINKED";
+  constructor() {
+    super("Not linked to the Runeya cloud.");
+    this.name = "CloudNotLinkedError";
+  }
+};
+async function cloudFetch(path, init = {}) {
+  const token = await cloudSessionStore.getToken();
+  if (!token) throw new CloudNotLinkedError();
+  return fetch(`${getCloudApiUrl()}${path}`, {
+    method: init.method ?? "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
+      [APP_VERSION_HEADER]: appVersion,
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
+    // 15s suits a JSON call; attachment downloads pass a longer budget.
+    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
+  });
+}
+
+// ../server/src/trpc/routers/cloud-auth.ts
 function getDeviceName() {
   if (env.DEVICE_NAME) return env.DEVICE_NAME.slice(0, 64);
   const host = hostname() || "runeya";
@@ -6348,23 +6373,13 @@ function isLocalOrigin(url) {
     return false;
   }
 }
-async function cloudFetch(path, init = {}) {
-  const token = await cloudSessionStore.getToken();
-  if (!token) {
-    throw new TRPCError10({ code: "PRECONDITION_FAILED", message: "Not linked to the Runeya cloud." });
+async function cloudFetch2(path, init = {}) {
+  try {
+    return await cloudFetch(path, init);
+  } catch (err) {
+    if (!(err instanceof CloudNotLinkedError)) throw err;
+    throw new TRPCError10({ code: "PRECONDITION_FAILED", message: err.message });
   }
-  return fetch(`${getCloudApiUrl()}${path}`, {
-    method: init.method ?? "GET",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
-      [APP_VERSION_HEADER]: appVersion,
-      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
-    },
-    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-    // 15s suits a JSON call; attachment downloads pass a longer budget.
-    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
-  });
 }
 var PROXY_PREFIXES = ["/organization/", "/project/", "/chat/", "/kanban/", "/user/prefs"];
 function isAllowedProxyPath(path) {
@@ -6391,7 +6406,7 @@ var cloudAuthRouter = router({
   /** The cloud session (user + org), fetched with the stored token. */
   session: protectedProcedure.query(async () => {
     if (!await cloudSessionStore.isLinked()) return null;
-    const res = await cloudFetch("/api/auth/get-session");
+    const res = await cloudFetch2("/api/auth/get-session");
     if (!res.ok) {
       if (res.status === 401) await cloudSessionStore.clear();
       return null;
@@ -6405,7 +6420,7 @@ var cloudAuthRouter = router({
    */
   devices: protectedProcedure.query(async () => {
     if (!await cloudSessionStore.isLinked()) return { devices: [] };
-    const res = await cloudFetch("/api/auth/device/list");
+    const res = await cloudFetch2("/api/auth/device/list");
     if (!res.ok) {
       if (res.status === 401) await cloudSessionStore.clear();
       return { devices: [] };
@@ -6420,7 +6435,7 @@ var cloudAuthRouter = router({
    * left holding a dead credential.
    */
   revokeDevice: protectedProcedure.input(z14.object({ id: z14.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const res = await cloudFetch("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
+    const res = await cloudFetch2("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
     if (!res.ok) {
       if (res.status === 401) await cloudSessionStore.clear();
       throw new TRPCError10({ code: "BAD_REQUEST", message: "Could not revoke this session." });
@@ -6447,7 +6462,7 @@ var cloudAuthRouter = router({
       throw new TRPCError10({ code: "FORBIDDEN", message: `Path not allowed: ${input.path}` });
     }
     const qs = input.query ? `?${new URLSearchParams(input.query).toString()}` : "";
-    const res = await cloudFetch(`/api/auth${input.path}${qs}`, {
+    const res = await cloudFetch2(`/api/auth${input.path}${qs}`, {
       method: input.method,
       ...input.method === "POST" ? { body: input.body ?? {} } : {}
     });
@@ -6471,7 +6486,7 @@ var cloudAuthRouter = router({
   signOut: protectedProcedure.mutation(async () => {
     if (await cloudSessionStore.isLinked()) {
       try {
-        await cloudFetch("/api/auth/sign-out", { method: "POST", body: {} });
+        await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {} });
       } catch {
       }
     }
@@ -6483,7 +6498,7 @@ var cloudAuthRouter = router({
 // ../server/src/services/kanban-store.ts
 async function callCloud(path, init = {}) {
   try {
-    const res = await cloudFetch(`/api/auth${path}`, init);
+    const res = await cloudFetch2(`/api/auth${path}`, init);
     if (!res.ok) {
       console.error("[kanban-store] cloud call failed: %s %s", res.status, path);
       return { ok: false, data: null };
@@ -6987,7 +7002,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-JNA5ZALK.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-KX5MSTAK.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -7640,7 +7655,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-JNA5ZALK.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-KX5MSTAK.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -12061,7 +12076,7 @@ var kanbanRouter = router({
     if (!ATTACHMENT_ID_REGEX.test(id)) {
       throw new TRPCError17({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
-    const res = await cloudFetch(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
+    const res = await cloudFetch2(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
     if (res.status === 404) {
       throw new TRPCError17({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
@@ -12463,90 +12478,239 @@ var configRouter = router({
 import { z as z24 } from "zod";
 import { TRPCError as TRPCError20 } from "@trpc/server";
 
-// ../server/src/services/cloud-sync-store.ts
-import { readFile as readFile15, writeFile as writeFile15, rename as rename12, mkdir as mkdir17, chmod as chmod10 } from "fs/promises";
-var FILENAME6 = "cloud-sync.json";
-var CloudSyncStore = class {
-  links = /* @__PURE__ */ new Map();
-  loaded = false;
-  /** Machine-wide: this describes the machine, not any one project. */
-  getFilePath() {
-    return machineFilePath(FILENAME6);
+// ../server/src/services/org-sync-scope.ts
+import { access as access2 } from "fs/promises";
+import { join as join17 } from "path";
+async function isMaterialized(root) {
+  return access2(join17(root, "project.json")).then(() => true, () => false);
+}
+async function orgsToSync() {
+  const cloudUrl = getCloudApiUrl();
+  const stamps = await readOrgClouds();
+  const orgIds = /* @__PURE__ */ new Set();
+  for (const vault of await listCloudVaults()) {
+    if (orgIds.has(vault.orgId)) continue;
+    const stamped = stamps[vault.orgId];
+    if (stamped && stamped.replace(/\/+$/, "") !== cloudUrl) continue;
+    if (await isMaterialized(vault.root)) orgIds.add(vault.orgId);
   }
-  /** Where older versions kept it — read only, so an older Runeya keeps working. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME6);
+  return Array.from(orgIds, (orgId) => ({ orgId, cloudUrl }));
+}
+
+// ../server/src/services/master-password.ts
+import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
+import { readFile as readFile15, writeFile as writeFile15, chmod as chmod10, stat as stat6, rename as rename12 } from "fs/promises";
+import { join as join18 } from "path";
+import { Entry } from "@napi-rs/keyring";
+import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
+var KEYRING_SERVICE = "runeya";
+var KEYRING_ACCOUNT = "pepper";
+var VERIFY_FILENAME = ".runeya-verify";
+var ENCRYPTED_KEY_FILENAME = ".encryption.key.enc";
+var PEPPER_FILENAME = ".pepper.private";
+var CANARY_PLAINTEXT = "runeya:v1:key-verification";
+var MAX_KEY_FILE_SIZE = 1024;
+var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32 };
+async function readKeyFile(filePath) {
+  const s = await stat6(filePath);
+  if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
+  return readFile15(filePath);
+}
+function aesEncrypt(key, plaintext) {
+  const iv = randomBytes4(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([iv, authTag, encrypted]);
+}
+function aesDecrypt(key, data) {
+  const iv = data.subarray(0, 12);
+  const authTag = data.subarray(12, 28);
+  const ciphertext = data.subarray(28);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv, { authTagLength: 16 });
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+async function getPepperFromFile(dataDir) {
+  try {
+    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
+    const hex = raw.toString("utf-8").trim();
+    if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
+  } catch {
   }
-  /**
-   * Read the machine file, falling back to the launch directory of old.
-   *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
-   */
-  async readFromDisk() {
-    try {
-      return await readFile15(this.getFilePath(), "utf-8");
-    } catch {
-      return readFile15(this.getLegacyFilePath(), "utf-8");
-    }
+  return null;
+}
+async function writePepperToFile(dataDir, pepper) {
+  const filePath = join18(dataDir, PEPPER_FILENAME);
+  const tmpPath = filePath + ".tmp";
+  await writeFile15(tmpPath, pepper.toString("hex"), "utf-8");
+  await chmod10(tmpPath, 384);
+  await rename12(tmpPath, filePath);
+}
+function tryKeyringGet() {
+  try {
+    return new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).getPassword();
+  } catch {
+    return null;
   }
-  async load() {
-    if (this.loaded) return;
-    try {
-      const raw = await this.readFromDisk();
-      const data = JSON.parse(raw);
-      for (const l of data) {
-        this.links.set(l.orgId, { orgId: l.orgId, cloudUrl: l.cloudUrl });
-        void stampOrgCloud(l.orgId, l.cloudUrl);
-      }
-    } catch {
-    }
-    this.loaded = true;
+}
+function tryKeyringSet(value) {
+  try {
+    new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).setPassword(value);
+    return true;
+  } catch {
+    return false;
   }
-  async save() {
-    await mkdir17(machineRoot(), { recursive: true });
-    const filePath = this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const data = JSON.stringify(Array.from(this.links.values()), null, 2);
-    await writeFile15(tmpPath, data, "utf-8");
-    await rename12(tmpPath, filePath);
-    await chmod10(filePath, 384);
+}
+async function getOrCreatePepper(dataDir) {
+  const pepperHex = tryKeyringGet();
+  if (pepperHex && /^[0-9a-f]{64}$/i.test(pepperHex)) {
+    return Buffer.from(pepperHex, "hex");
   }
-  /** Store (or replace) the sync link for an organization. */
-  async upsert(orgId, cloudUrl) {
-    await this.load();
-    this.links.set(orgId, { orgId, cloudUrl });
-    await stampOrgCloud(orgId, cloudUrl);
-    await this.save();
+  const filePepper = await getPepperFromFile(dataDir);
+  if (filePepper) return filePepper;
+  const pepper = randomBytes4(32);
+  const saved = tryKeyringSet(pepper.toString("hex"));
+  if (!saved) {
+    console.warn("[master-password] Keyring unavailable, storing pepper in dataDir (fallback)");
+    await writePepperToFile(dataDir, pepper);
   }
-  async remove(orgId) {
-    await this.load();
-    if (this.links.delete(orgId)) await this.save();
+  return pepper;
+}
+async function deriveKey(masterPassword, pepper, salt) {
+  const combined = masterPassword + pepper.toString("hex");
+  const derived = await argon2HashRaw(combined, {
+    ...ARGON2_OPTIONS,
+    salt
+  });
+  return Buffer.from(derived);
+}
+async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
+  const pepper = await getOrCreatePepper(dataDir);
+  const salt = randomBytes4(16);
+  const derivedKey = await deriveKey(masterPassword, pepper, salt);
+  const payload = aesEncrypt(derivedKey, encryptionKey);
+  const fileContent = Buffer.concat([salt, payload]);
+  const encoded = fileContent.toString("base64");
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const tmpPath = filePath + ".tmp";
+  await writeFile15(tmpPath, encoded, "utf-8");
+  await chmod10(tmpPath, 384);
+  await rename12(tmpPath, filePath);
+}
+async function readEncryptedKey(dataDir, masterPassword) {
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const raw = await readKeyFile(filePath);
+  const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
+  const salt = fileContent.subarray(0, 16);
+  const payload = fileContent.subarray(16);
+  const pepper = await getPepperFromKeychain(dataDir);
+  const derivedKey = await deriveKey(masterPassword, pepper, salt);
+  return aesDecrypt(derivedKey, payload);
+}
+async function getPepperFromKeychain(dataDir) {
+  const pepperHex = tryKeyringGet();
+  if (pepperHex && /^[0-9a-f]{64}$/i.test(pepperHex)) {
+    return Buffer.from(pepperHex, "hex");
   }
-  /** All sync links (for the bridge on startup). */
-  async list() {
-    await this.load();
-    return Array.from(this.links.values());
+  const filePepper = await getPepperFromFile(dataDir);
+  if (filePepper) return filePepper;
+  throw new Error("Pepper introuvable (keyring et fichier). Re-setup requis.");
+}
+async function writeVerifyFile(dataDir, encryptionKey) {
+  const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
+  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const tmpPath = filePath + ".tmp";
+  await writeFile15(tmpPath, payload.toString("base64"), "utf-8");
+  await rename12(tmpPath, filePath);
+}
+async function verifyEncryptionKey(dataDir, encryptionKey) {
+  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const raw = await readKeyFile(filePath);
+  if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
+    throw new Error("Cl\xE9 d'encryption incorrecte");
   }
-  async get(orgId) {
-    await this.load();
-    return this.links.get(orgId) ?? null;
+}
+function matchesCanary(canaryBase64, encryptionKey) {
+  try {
+    const payload = Buffer.from(canaryBase64.trim(), "base64");
+    return aesDecrypt(encryptionKey, payload).toString("utf-8") === CANARY_PLAINTEXT;
+  } catch {
+    return false;
+  }
+}
+async function readVerifyFile(dataDir) {
+  try {
+    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+  } catch {
+    return null;
+  }
+}
+async function hasVerifyFile(dataDir) {
+  try {
+    await stat6(join18(dataDir, VERIFY_FILENAME));
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function hasEncryptedKeyFile(dataDir) {
+  try {
+    await stat6(join18(dataDir, ENCRYPTED_KEY_FILENAME));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ../server/src/services/org-canary.ts
+var CanaryUnavailableError = class extends Error {
+  code = "CANARY_UNAVAILABLE";
+  constructor(message) {
+    super(message);
+    this.name = "CanaryUnavailableError";
   }
 };
-var cloudSyncStore = new CloudSyncStore();
+var OrgKeyMismatchError = class extends Error {
+  code = "ORG_KEY_MISMATCH";
+  constructor() {
+    super(
+      "This organization uses a different encryption key. Ask a member for the key already in use, then set it up on this machine before syncing."
+    );
+    this.name = "OrgKeyMismatchError";
+  }
+};
+async function reconcileOrgCanary(orgId) {
+  const key = getEncryptionKey();
+  if (!key) throw new CanaryUnavailableError("Encryption key not loaded.");
+  const local = await readVerifyFile(await keyRoot());
+  if (!local) throw new CanaryUnavailableError("This machine has no key canary yet.");
+  const res = await cloudFetch("/api/auth/organization/canary", {
+    method: "POST",
+    body: { organizationId: orgId, canary: local }
+  });
+  if (!res.ok) {
+    throw new CanaryUnavailableError("Could not reach the organization on the cloud.");
+  }
+  const { canary } = await res.json();
+  if (typeof canary !== "string") {
+    throw new CanaryUnavailableError("The cloud returned no key canary.");
+  }
+  if (!matchesCanary(canary, key)) throw new OrgKeyMismatchError();
+}
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID11 } from "crypto";
-import { mkdir as mkdir19, rm as rm5 } from "fs/promises";
+import { mkdir as mkdir18, rm as rm5 } from "fs/promises";
 import * as Y from "yjs";
 
 // ../server/src/services/org-lock.ts
-import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir18 } from "fs/promises";
+import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir17 } from "fs/promises";
 import { readFileSync, unlinkSync } from "fs";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 var held = /* @__PURE__ */ new Set();
 function lockPath(orgId) {
-  return join17(orgVaultRoot(orgId), "org.lock");
+  return join19(orgVaultRoot(orgId), "org.lock");
 }
 function isRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -12567,7 +12731,7 @@ async function readLock(path) {
 }
 async function acquireOrgLock(orgId) {
   const path = lockPath(orgId);
-  await mkdir18(orgVaultRoot(orgId), { recursive: true });
+  await mkdir17(orgVaultRoot(orgId), { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await open2(path, "wx");
@@ -12978,7 +13142,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir19(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir18(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -13187,15 +13351,21 @@ var CloudSyncBridge = class {
   /** Orgs another instance holds the lock on — reported, not retried blindly. */
   locked = /* @__PURE__ */ new Set();
   started = false;
-  /** Start syncing every organization already linked on disk. */
+  /**
+   * Start syncing every organization this machine holds a project of.
+   *
+   * The scope is read from the disk (see `org-sync-scope.ts`) rather than from
+   * a list of links: opening a project is what makes its org worth syncing, and
+   * dropping the last one is what ends it.
+   */
   async start() {
     if (this.started) return;
     this.started = true;
     let links = [];
     try {
-      links = await cloudSyncStore.list();
+      links = await orgsToSync();
     } catch (err) {
-      console.error("[cloud-sync] could not load links:", err.message);
+      console.error("[cloud-sync] could not read which organizations to sync:", err.message);
       return;
     }
     for (const link of links) await this.connect(link);
@@ -13246,6 +13416,19 @@ var CloudSyncBridge = class {
    */
   async connect(link) {
     this.disconnect(link.orgId);
+    try {
+      await reconcileOrgCanary(link.orgId);
+    } catch (err) {
+      if (err instanceof OrgKeyMismatchError) {
+        console.error("[cloud-sync] org %s: %s", link.orgId, err.message);
+        return;
+      }
+      console.warn(
+        "[cloud-sync] org %s: could not check the organization key (%s) \u2014 syncing anyway.",
+        link.orgId,
+        err.message
+      );
+    }
     const lock = await acquireOrgLock(link.orgId).catch((err) => {
       console.error("[cloud-sync] could not take the lock for org %s:", link.orgId, err.message);
       return { acquired: false, heldBy: 0 };
@@ -13285,172 +13468,6 @@ var CloudSyncBridge = class {
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
-// ../server/src/services/master-password.ts
-import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile17, writeFile as writeFile16, chmod as chmod11, stat as stat6, rename as rename13 } from "fs/promises";
-import { join as join18 } from "path";
-import { Entry } from "@napi-rs/keyring";
-import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
-var KEYRING_SERVICE = "runeya";
-var KEYRING_ACCOUNT = "pepper";
-var VERIFY_FILENAME = ".runeya-verify";
-var ENCRYPTED_KEY_FILENAME = ".encryption.key.enc";
-var PEPPER_FILENAME = ".pepper.private";
-var CANARY_PLAINTEXT = "runeya:v1:key-verification";
-var MAX_KEY_FILE_SIZE = 1024;
-var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32 };
-async function readKeyFile(filePath) {
-  const s = await stat6(filePath);
-  if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
-  return readFile17(filePath);
-}
-function aesEncrypt(key, plaintext) {
-  const iv = randomBytes4(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return Buffer.concat([iv, authTag, encrypted]);
-}
-function aesDecrypt(key, data) {
-  const iv = data.subarray(0, 12);
-  const authTag = data.subarray(12, 28);
-  const ciphertext = data.subarray(28);
-  const decipher = createDecipheriv("aes-256-gcm", key, iv, { authTagLength: 16 });
-  decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-}
-async function getPepperFromFile(dataDir) {
-  try {
-    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
-    const hex = raw.toString("utf-8").trim();
-    if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
-  } catch {
-  }
-  return null;
-}
-async function writePepperToFile(dataDir, pepper) {
-  const filePath = join18(dataDir, PEPPER_FILENAME);
-  const tmpPath = filePath + ".tmp";
-  await writeFile16(tmpPath, pepper.toString("hex"), "utf-8");
-  await chmod11(tmpPath, 384);
-  await rename13(tmpPath, filePath);
-}
-function tryKeyringGet() {
-  try {
-    return new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).getPassword();
-  } catch {
-    return null;
-  }
-}
-function tryKeyringSet(value) {
-  try {
-    new Entry(KEYRING_SERVICE, KEYRING_ACCOUNT).setPassword(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function getOrCreatePepper(dataDir) {
-  const pepperHex = tryKeyringGet();
-  if (pepperHex && /^[0-9a-f]{64}$/i.test(pepperHex)) {
-    return Buffer.from(pepperHex, "hex");
-  }
-  const filePepper = await getPepperFromFile(dataDir);
-  if (filePepper) return filePepper;
-  const pepper = randomBytes4(32);
-  const saved = tryKeyringSet(pepper.toString("hex"));
-  if (!saved) {
-    console.warn("[master-password] Keyring unavailable, storing pepper in dataDir (fallback)");
-    await writePepperToFile(dataDir, pepper);
-  }
-  return pepper;
-}
-async function deriveKey(masterPassword, pepper, salt) {
-  const combined = masterPassword + pepper.toString("hex");
-  const derived = await argon2HashRaw(combined, {
-    ...ARGON2_OPTIONS,
-    salt
-  });
-  return Buffer.from(derived);
-}
-async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
-  const pepper = await getOrCreatePepper(dataDir);
-  const salt = randomBytes4(16);
-  const derivedKey = await deriveKey(masterPassword, pepper, salt);
-  const payload = aesEncrypt(derivedKey, encryptionKey);
-  const fileContent = Buffer.concat([salt, payload]);
-  const encoded = fileContent.toString("base64");
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
-  const tmpPath = filePath + ".tmp";
-  await writeFile16(tmpPath, encoded, "utf-8");
-  await chmod11(tmpPath, 384);
-  await rename13(tmpPath, filePath);
-}
-async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
-  const raw = await readKeyFile(filePath);
-  const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
-  const salt = fileContent.subarray(0, 16);
-  const payload = fileContent.subarray(16);
-  const pepper = await getPepperFromKeychain(dataDir);
-  const derivedKey = await deriveKey(masterPassword, pepper, salt);
-  return aesDecrypt(derivedKey, payload);
-}
-async function getPepperFromKeychain(dataDir) {
-  const pepperHex = tryKeyringGet();
-  if (pepperHex && /^[0-9a-f]{64}$/i.test(pepperHex)) {
-    return Buffer.from(pepperHex, "hex");
-  }
-  const filePepper = await getPepperFromFile(dataDir);
-  if (filePepper) return filePepper;
-  throw new Error("Pepper introuvable (keyring et fichier). Re-setup requis.");
-}
-async function writeVerifyFile(dataDir, encryptionKey) {
-  const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join18(dataDir, VERIFY_FILENAME);
-  const tmpPath = filePath + ".tmp";
-  await writeFile16(tmpPath, payload.toString("base64"), "utf-8");
-  await rename13(tmpPath, filePath);
-}
-async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join18(dataDir, VERIFY_FILENAME);
-  const raw = await readKeyFile(filePath);
-  if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
-    throw new Error("Cl\xE9 d'encryption incorrecte");
-  }
-}
-function matchesCanary(canaryBase64, encryptionKey) {
-  try {
-    const payload = Buffer.from(canaryBase64.trim(), "base64");
-    return aesDecrypt(encryptionKey, payload).toString("utf-8") === CANARY_PLAINTEXT;
-  } catch {
-    return false;
-  }
-}
-async function readVerifyFile(dataDir) {
-  try {
-    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
-  } catch {
-    return null;
-  }
-}
-async function hasVerifyFile(dataDir) {
-  try {
-    await stat6(join18(dataDir, VERIFY_FILENAME));
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function hasEncryptedKeyFile(dataDir) {
-  try {
-    await stat6(join18(dataDir, ENCRYPTED_KEY_FILENAME));
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 // ../server/src/trpc/routers/cloud-sync.ts
 async function cloudMessage(res) {
   try {
@@ -13466,59 +13483,23 @@ async function cloudMessage(res) {
     return "";
   }
 }
-async function reconcileOrgCanary(orgId) {
-  const key = getEncryptionKey();
-  if (!key) {
-    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
-  }
-  const local = await readVerifyFile(await keyRoot());
-  if (!local) {
-    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
-  }
-  const res = await cloudFetch("/api/auth/organization/canary", {
-    method: "POST",
-    body: { organizationId: orgId, canary: local }
-  });
-  if (!res.ok) {
-    throw new TRPCError20({ code: "BAD_GATEWAY", message: "Could not reach the organization on the cloud." });
-  }
-  const { canary } = await res.json();
-  if (typeof canary !== "string") {
-    throw new TRPCError20({ code: "BAD_GATEWAY", message: "The cloud returned no key canary." });
-  }
-  if (!matchesCanary(canary, key)) {
-    throw new TRPCError20({
-      code: "FORBIDDEN",
-      message: "This organization uses a different encryption key. Ask a member for the key already in use, then set it up on this machine before syncing."
-    });
+async function assertOrgKey(orgId) {
+  try {
+    await reconcileOrgCanary(orgId);
+  } catch (err) {
+    if (err instanceof OrgKeyMismatchError) {
+      throw new TRPCError20({ code: "FORBIDDEN", message: err.message });
+    }
+    if (err instanceof CanaryUnavailableError) {
+      throw new TRPCError20({ code: "PRECONDITION_FAILED", message: err.message });
+    }
+    throw err;
   }
 }
 function syncState(orgId) {
   return cloudSyncBridge.states().find((s) => s.orgId === orgId)?.state ?? "stopped";
 }
 var cloudSyncRouter = router({
-  /**
-   * Register/replace a sync link for an org and start syncing immediately.
-   *
-   * Refuses when this machine's key is not the org's — better to stop here than
-   * to sync a project whose secrets will not open.
-   */
-  link: protectedProcedure.input(
-    z24.object({
-      orgId: z24.string().min(1).max(128),
-      cloudUrl: z24.string().url().max(2048),
-      // No project selection: which projects this machine materializes is
-      // read from the vaults on disk, so linking an org never re-downloads
-      // projects the user had dropped.
-      projectIds: z24.array(z24.string().min(1).max(128)).max(500).optional()
-    })
-  ).mutation(async ({ input }) => {
-    await reconcileOrgCanary(input.orgId);
-    await cloudSyncStore.upsert(input.orgId, input.cloudUrl);
-    const link = await cloudSyncStore.get(input.orgId);
-    await cloudSyncBridge.connect(link ?? { orgId: input.orgId, cloudUrl: input.cloudUrl });
-    return { success: true };
-  }),
   /**
    * Follow one more project of an org, and pull it now.
    *
@@ -13533,12 +13514,11 @@ var cloudSyncRouter = router({
       projectId: z24.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
-    const existing = await cloudSyncStore.get(input.orgId);
-    if (!existing) {
-      await reconcileOrgCanary(input.orgId);
-      await cloudSyncStore.upsert(input.orgId, input.cloudUrl);
-      const link = await cloudSyncStore.get(input.orgId);
-      if (link) await cloudSyncBridge.connect(link);
+    const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
+    if (!connected) {
+      await assertOrgKey(input.orgId);
+      await stampOrgCloud(input.orgId, input.cloudUrl);
+      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
@@ -13582,7 +13562,7 @@ var cloudSyncRouter = router({
   ).mutation(async ({ input }) => {
     let res;
     try {
-      res = await cloudFetch("/api/auth/project/delete", {
+      res = await cloudFetch2("/api/auth/project/delete", {
         method: "POST",
         body: { organizationId: input.orgId, projectId: input.projectId }
       });
@@ -13606,18 +13586,15 @@ var cloudSyncRouter = router({
       message: detail || `PROJECT_DELETE_FAILED (${res.status})`
     });
   }),
-  /** Stop syncing an org and forget its token. */
-  unlink: protectedProcedure.input(z24.object({ orgId: z24.string().min(1).max(128) })).mutation(async ({ input }) => {
-    cloudSyncBridge.disconnect(input.orgId);
-    await cloudSyncStore.remove(input.orgId);
-    return { success: true };
-  }),
   /**
-   * List orgs this server is linked to, with their live sync state so the UI can
-   * surface an org whose sync is paused awaiting a fresh cloud sign-in.
+   * List the orgs this machine syncs, with their live sync state so the UI can
+   * surface one whose sync is paused awaiting a fresh cloud sign-in.
+   *
+   * Derived from the vaults on disk, so it says what is actually synced rather
+   * than what someone once asked for.
    */
   list: protectedProcedure.query(async () => {
-    const links = await cloudSyncStore.list();
+    const links = await orgsToSync();
     const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s]));
     return links.map((l) => ({
       orgId: l.orgId,
@@ -13632,14 +13609,13 @@ var cloudSyncRouter = router({
   /**
    * The cloud instance behind every org vault on this machine.
    *
-   * Wider than `list`, which only sees the links of the directory this server
-   * was launched in: org vaults are shared machine-wide, so a project can very
-   * well belong to an org linked from another directory — or from another cloud
-   * entirely.
+   * Wider than `list`, which only reports the orgs actually synced here: a vault
+   * may come from another cloud entirely, and saying so is how the UI explains
+   * an org it can see but not reach.
    */
   orgClouds: protectedProcedure.query(async () => {
     const clouds = await readOrgClouds();
-    for (const l of await cloudSyncStore.list()) clouds[l.orgId] = l.cloudUrl;
+    for (const { orgId } of await orgsToSync()) clouds[orgId] ??= getCloudApiUrl();
     return clouds;
   })
 });
@@ -13647,13 +13623,13 @@ var cloudSyncRouter = router({
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir7, stat as stat7 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute4, join as join19, resolve as resolve5, dirname as dirname9, basename as basename2 } from "path";
+import { isAbsolute as isAbsolute4, join as join20, resolve as resolve5, dirname as dirname9, basename as basename2 } from "path";
 import { z as z25 } from "zod";
 var MAX_ENTRIES = 500;
 var PATH_SCHEMA = z25.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join19(homedir5(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join20(homedir5(), input.slice(1)) : input;
   if (!isAbsolute4(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve5(expanded);
 }
@@ -13689,7 +13665,7 @@ var filesystemRouter = router({
     const truncated = names.length > MAX_ENTRIES;
     const entries = [];
     for (const name of names.slice(0, MAX_ENTRIES)) {
-      const path = join19(dir, name);
+      const path = join20(dir, name);
       entries.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
@@ -13789,7 +13765,7 @@ var MigrationEngine = class {
 var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
-import { chmod as chmod12, stat as stat8 } from "fs/promises";
+import { chmod as chmod11, stat as stat8 } from "fs/promises";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -13807,7 +13783,7 @@ async function ensureFilePermissions() {
         const mode = stats.mode & 511;
         if (mode !== SECURE_MODE) {
           console.warn("[security] File", filepath, "has mode", mode.toString(8) + ", fixing to 600");
-          await chmod12(filepath, SECURE_MODE);
+          await chmod11(filepath, SECURE_MODE);
         }
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -13819,8 +13795,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir8, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir20, copyFile, unlink as unlink5, rename as rename14, stat as stat9 } from "fs/promises";
-import { join as join20 } from "path";
+import { readdir as readdir8, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir19, copyFile, unlink as unlink5, rename as rename13, stat as stat9 } from "fs/promises";
+import { join as join21 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -13871,17 +13847,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join20(legacyRoot, `backup-${stamp}`);
-  await mkdir20(backupDir, { recursive: true });
+  const backupDir = join21(legacyRoot, `backup-${stamp}`);
+  await mkdir19(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists(join20(legacyRoot, name))) {
-      await copyFile(join20(legacyRoot, name), join20(backupDir, name));
+    if (await exists(join21(legacyRoot, name))) {
+      await copyFile(join21(legacyRoot, name), join21(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile18(join20(legacyRoot, name), "utf-8");
+    const raw = await readFile17(join21(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -13891,13 +13867,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join20(legacyRoot, `${name}.tmp`);
-    await writeFile17(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename14(tmp, join20(legacyRoot, name));
+    const tmp = join21(legacyRoot, `${name}.tmp`);
+    await writeFile16(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename13(tmp, join21(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile18(join20(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile17(join21(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -13906,13 +13882,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir20(machineRootDir, { recursive: true });
+  await mkdir19(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join20(legacyRoot, name);
+    const from = join21(legacyRoot, name);
     if (!await exists(from)) continue;
-    const to = join20(machineRootDir, name);
+    const to = join21(machineRootDir, name);
     if (await exists(to)) {
       skipped.push(name);
       continue;
@@ -13922,7 +13898,7 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join20(legacyRoot, name);
+    const path = join21(legacyRoot, name);
     if (await exists(path)) await unlink5(path);
   }
   return { backupDir, rekeyed, moved, skipped };
@@ -13933,14 +13909,14 @@ import { createRequire } from "module";
 import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile19,
-  writeFile as writeFile18,
-  rename as rename15,
-  mkdir as mkdir21,
-  access as access2,
+  readFile as readFile18,
+  writeFile as writeFile17,
+  rename as rename14,
+  mkdir as mkdir20,
+  access as access3,
   readdir as readdir9
 } from "fs/promises";
-import { join as join21, dirname as dirname10 } from "path";
+import { join as join22, dirname as dirname10 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -14049,7 +14025,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile19(filePath, "utf-8")).trim();
+  const raw = (await readFile18(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -14069,33 +14045,33 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile18(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename15(tmp, path);
+  await writeFile17(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await rename14(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join21(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join22(legacyRoot, "dbs", "encryption-key.json");
   try {
-    await access2(legacyKeyPath);
+    await access3(legacyKeyPath);
   } catch {
     return false;
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join21(abCwd, ".runeya-tmp");
-  await rename15(legacyRoot, legacyTmp);
-  await mkdir21(dataDir, { recursive: true });
-  const legacyOld = join21(dataDir, `backup-${timestamp}`);
-  await rename15(legacyTmp, legacyOld);
+  const legacyTmp = join22(abCwd, ".runeya-tmp");
+  await rename14(legacyRoot, legacyTmp);
+  await mkdir20(dataDir, { recursive: true });
+  const legacyOld = join22(dataDir, `backup-${timestamp}`);
+  await rename14(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile19(join21(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile18(join22(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join21(legacyOld, "dbs");
+  const dbsDir = join22(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -14104,29 +14080,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join21(dbsDir, "envs");
+  const envsDir = join22(dbsDir, "envs");
   const envFiles = (await readdir9(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join21(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join22(envsDir, file));
   }
-  const servicesDir = join21(dbsDir, "services");
+  const servicesDir = join22(dbsDir, "services");
   const serviceFiles = (await readdir9(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join21(servicesDir, file));
+    const data = await readEncrypted(join22(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join21(dbsDir, "overrides");
+  const overridesDir = join22(dbsDir, "overrides");
   const overrideFiles = (await readdir9(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join21(overridesDir, file));
+    const data = await readEncrypted(join22(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -14134,11 +14110,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join21(dbsDir, "parsers");
+  const parsersDir = join22(dbsDir, "parsers");
   const parserFiles = (await readdir9(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join21(parsersDir, file));
+    const data = await readEncrypted(join22(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -14479,7 +14455,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile19(join21(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile18(join22(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -14500,11 +14476,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join21(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join21(dataDir, "services.json"), runeServices);
-  await atomicWrite(join21(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join21(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join21(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join22(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join22(dataDir, "services.json"), runeServices);
+  await atomicWrite(join22(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join22(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join22(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -14518,9 +14494,9 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries = await readdir9(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join21(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join22(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile19(keyJsonPath, "utf-8");
+        const raw = await readFile18(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -14541,8 +14517,8 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve7 } = await import("path");
   const abDataDir = resolve7(dataDir);
   const candidateDirs = [
-    join21(dirname10(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join21(abDataDir, "dbs", "overrides")
+    join22(dirname10(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join22(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -14558,9 +14534,9 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join21(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join22(overridesDir, "..", "encryption-key.json");
   try {
-    await access2(legacyKeyPath);
+    await access3(legacyKeyPath);
     return false;
   } catch {
   }
@@ -14576,7 +14552,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile19(join21(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile18(join22(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -14595,7 +14571,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile19(join21(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile18(join22(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -14612,7 +14588,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -14639,7 +14615,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join21(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join22(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -14649,7 +14625,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -14708,12 +14684,12 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join21(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join22(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename15(overridesDir, migratedDir);
+    await rename14(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -14723,7 +14699,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import { stat as stat10 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -14733,22 +14709,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat10(join22(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat10(join23(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat10(join22(dataDir, VERIFY_FILENAME2));
+    await stat10(join23(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat10(join22(dataDir, "projects.json"));
+    await stat10(join23(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat10(join22(dataDir, "project.json"));
+    await stat10(join23(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -15962,4 +15938,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-WVK4WUI3.js.map
+//# sourceMappingURL=src-R6JOPDNL.js.map