Усилен firewall rollback lifecycle и безопасная запись конфигов/секретов

orchestrator/src/lib/fs.ts

@@ -19,6 +19,46 @@ export async function writeText(path: string, data: string, mode?: number): Prom
   }
 }
 
+export async function writeTextAtomic(
+  path: string,
+  data: string,
+  options: {
+    mode: number;
+    owner: string;
+    group: string;
+  }
+): Promise<void> {
+  const dir = path.replace(/\/[^/]+$/, "") || ".";
+  const base = path.split("/").pop() || "tmp";
+  const tmp = `${dir}/.${base}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+  await Bun.write(tmp, data);
+
+  const chmodResult = Bun.spawnSync(["chmod", options.mode.toString(8), tmp], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!chmodResult.success) {
+    throw new Error(`chmod failed for ${tmp}: ${chmodResult.stderr.toString()}`);
+  }
+
+  const chownResult = Bun.spawnSync(["chown", `${options.owner}:${options.group}`, tmp], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!chownResult.success) {
+    throw new Error(`chown failed for ${tmp}: ${chownResult.stderr.toString()}`);
+  }
+
+  const mvResult = Bun.spawnSync(["mv", "-f", tmp, path], {
+    stdout: "pipe",
+    stderr: "pipe"
+  });
+  if (!mvResult.success) {
+    throw new Error(`atomic rename failed for ${path}: ${mvResult.stderr.toString()}`);
+  }
+}
+
 export function renderTemplate(template: string, values: Record<string, string | number>): string {
   let rendered = template;
   for (const [key, value] of Object.entries(values)) {