@creezio/observability 0.22.0

package/dist-cjs/usage/usage-analytics.js

@@ -0,0 +1,353 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatDuration = void 0;
+exports.usageAnalyticsReady = usageAnalyticsReady;
+exports.ensureUsageAnalyticsSchema = ensureUsageAnalyticsSchema;
+exports.insertUsageEvents = insertUsageEvents;
+exports.recordUsageEvent = recordUsageEvent;
+exports.resolvePeriodFilters = resolvePeriodFilters;
+exports.getUsageOverview = getUsageOverview;
+exports.getUsageTimeline = getUsageTimeline;
+exports.getTopPages = getTopPages;
+exports.getTopClicks = getTopClicks;
+exports.getUserStats = getUserStats;
+exports.listUsageEvents = listUsageEvents;
+exports.purgeUsageEvents = purgeUsageEvents;
+/**
+ * Analytics d'usage — persistance SQLite + agrégations Admin.
+ * Événements UI (pages, clics, dwell) + actions serveur (agent IA…).
+ */
+const adapters_js_1 = require("./adapters.js");
+const usage_analytics_shared_js_1 = require("./usage-analytics-shared.js");
+Object.defineProperty(exports, "formatDuration", { enumerable: true, get: function () { return usage_analytics_shared_js_1.formatDuration; } });
+let schemaReady = false;
+function usageAnalyticsReady() {
+    return (0, adapters_js_1.uaTableExists)("usage_events");
+}
+/** Crée la table si absente (dev / avant migration Electron). */
+function ensureUsageAnalyticsSchema() {
+    if (schemaReady && usageAnalyticsReady())
+        return;
+    const db = (0, adapters_js_1.uaGetWriteDb)();
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS usage_events (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now')),
+      event_type TEXT NOT NULL,
+      category TEXT NOT NULL DEFAULT 'ui',
+      label TEXT,
+      path TEXT,
+      referrer_path TEXT,
+      user_id TEXT,
+      username TEXT,
+      user_kind TEXT NOT NULL DEFAULT 'human',
+      user_role TEXT,
+      session_id TEXT,
+      duration_ms INTEGER,
+      meta_json TEXT,
+      user_agent TEXT,
+      surface TEXT NOT NULL DEFAULT 'crm'
+    );
+    CREATE INDEX IF NOT EXISTS idx_usage_events_created
+      ON usage_events(created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_events_user_created
+      ON usage_events(user_id, created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_events_type_created
+      ON usage_events(event_type, created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_events_path_created
+      ON usage_events(path, created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_events_kind_created
+      ON usage_events(user_kind, created_at);
+    CREATE INDEX IF NOT EXISTS idx_usage_events_session
+      ON usage_events(session_id, created_at);
+  `);
+    schemaReady = true;
+}
+function normalizeKind(v) {
+    const s = String(v || "").toLowerCase();
+    if (s === "ai")
+        return "ai";
+    if (s === "system")
+        return "system";
+    if (s === "human")
+        return "human";
+    return "unknown";
+}
+function clampStr(v, max) {
+    if (v == null)
+        return null;
+    const s = String(v).trim();
+    if (!s)
+        return null;
+    return s.slice(0, max);
+}
+function periodBounds(period, now = new Date()) {
+    const to = now.toISOString();
+    const d = new Date(now);
+    if (period === "day")
+        d.setUTCDate(d.getUTCDate() - 1);
+    else if (period === "week")
+        d.setUTCDate(d.getUTCDate() - 7);
+    else if (period === "month")
+        d.setUTCDate(d.getUTCDate() - 30);
+    else
+        d.setUTCFullYear(d.getUTCFullYear() - 1);
+    return { from: d.toISOString(), to };
+}
+function buildWhere(filters) {
+    const parts = ["1=1"];
+    const params = [];
+    if (filters.from) {
+        parts.push("created_at >= ?");
+        params.push(filters.from);
+    }
+    if (filters.to) {
+        parts.push("created_at <= ?");
+        params.push(filters.to);
+    }
+    if (filters.userId) {
+        parts.push("user_id = ?");
+        params.push(filters.userId);
+    }
+    if (filters.kind && filters.kind !== "all") {
+        parts.push("user_kind = ?");
+        params.push(filters.kind);
+    }
+    if (filters.eventType) {
+        parts.push("event_type = ?");
+        params.push(filters.eventType);
+    }
+    if (filters.path) {
+        parts.push("path LIKE ?");
+        params.push(`${filters.path}%`);
+    }
+    if (filters.q) {
+        parts.push("(label LIKE ? OR path LIKE ? OR username LIKE ? OR event_type LIKE ?)");
+        const like = `%${filters.q}%`;
+        params.push(like, like, like, like);
+    }
+    return { sql: parts.join(" AND "), params };
+}
+function insertUsageEvents(events) {
+    if (!events.length)
+        return 0;
+    ensureUsageAnalyticsSchema();
+    const db = (0, adapters_js_1.uaGetWriteDb)();
+    const stmt = db.prepare(`
+    INSERT INTO usage_events (
+      created_at, event_type, category, label, path, referrer_path,
+      user_id, username, user_kind, user_role, session_id,
+      duration_ms, meta_json, user_agent, surface
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+    const now = new Date().toISOString();
+    let inserted = 0;
+    const insertRows = (rows) => {
+        for (const e of rows) {
+            const eventType = clampStr(e.eventType, 80);
+            if (!eventType)
+                continue;
+            const duration = typeof e.durationMs === "number" && Number.isFinite(e.durationMs) && e.durationMs >= 0
+                ? Math.min(Math.round(e.durationMs), 86_400_000)
+                : null;
+            stmt.run(clampStr(e.createdAt, 40) || now, eventType, clampStr(e.category, 40) || "ui", clampStr(e.label, 240), clampStr(e.path, 500), clampStr(e.referrerPath, 500), clampStr(e.userId, 80), clampStr(e.username, 120), normalizeKind(e.userKind), clampStr(e.userRole, 40), clampStr(e.sessionId, 80), duration, e.meta ? JSON.stringify(e.meta).slice(0, 4000) : null, clampStr(e.userAgent, 300), clampStr(e.surface, 40) || "crm");
+            inserted += 1;
+        }
+    };
+    if (db.transaction)
+        db.transaction(insertRows)(events);
+    else
+        insertRows(events);
+    return inserted;
+}
+function recordUsageEvent(event) {
+    try {
+        insertUsageEvents([event]);
+    }
+    catch {
+        /* ne jamais casser le flux métier */
+    }
+}
+function resolvePeriodFilters(period, from, to) {
+    const p = ["day", "week", "month", "year"].includes(period)
+        ? period
+        : "week";
+    if (from || to) {
+        return { from: from || undefined, to: to || undefined };
+    }
+    return periodBounds(p);
+}
+function getUsageOverview(filters) {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    const totals = (0, adapters_js_1.uaQueryOne)(`SELECT
+       COUNT(*) AS events,
+       SUM(CASE WHEN event_type = 'page.view' THEN 1 ELSE 0 END) AS page_views,
+       SUM(CASE WHEN event_type = 'ui.click' THEN 1 ELSE 0 END) AS clicks,
+       COUNT(DISTINCT session_id) AS sessions,
+       COUNT(DISTINCT user_id) AS active_users,
+       COUNT(DISTINCT CASE WHEN user_kind = 'human' THEN user_id END) AS active_humans,
+       COUNT(DISTINCT CASE WHEN user_kind = 'ai' THEN user_id END) AS active_ai,
+       COALESCE(SUM(CASE WHEN duration_ms IS NOT NULL THEN duration_ms ELSE 0 END), 0) AS total_time_ms
+     FROM usage_events
+     WHERE ${sql}`, params);
+    const byKind = (0, adapters_js_1.uaQueryAll)(`SELECT
+       user_kind AS kind,
+       COUNT(*) AS events,
+       COUNT(DISTINCT user_id) AS users,
+       COALESCE(SUM(CASE WHEN duration_ms IS NOT NULL THEN duration_ms ELSE 0 END), 0) AS time_ms
+     FROM usage_events
+     WHERE ${sql}
+     GROUP BY user_kind
+     ORDER BY events DESC`, params);
+    const sessions = totals?.sessions ?? 0;
+    const totalTimeMs = totals?.total_time_ms ?? 0;
+    return {
+        period: { from: filters.from || "", to: filters.to || "" },
+        totals: {
+            events: totals?.events ?? 0,
+            pageViews: totals?.page_views ?? 0,
+            clicks: totals?.clicks ?? 0,
+            sessions,
+            activeUsers: totals?.active_users ?? 0,
+            activeHumans: totals?.active_humans ?? 0,
+            activeAi: totals?.active_ai ?? 0,
+            totalTimeMs,
+            avgSessionTimeMs: sessions > 0 ? Math.round(totalTimeMs / sessions) : 0,
+        },
+        byKind: byKind.map((r) => ({
+            kind: r.kind,
+            events: r.events,
+            users: r.users,
+            timeMs: r.time_ms,
+        })),
+    };
+}
+function bucketExpr(period) {
+    if (period === "day")
+        return `strftime('%Y-%m-%d %H:00', created_at)`;
+    if (period === "year")
+        return `strftime('%Y-%m', created_at)`;
+    return `strftime('%Y-%m-%d', created_at)`;
+}
+function getUsageTimeline(filters, period = "week") {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    const bucket = bucketExpr(period);
+    return (0, adapters_js_1.uaQueryAll)(`SELECT
+       ${bucket} AS bucket,
+       COUNT(*) AS events,
+       SUM(CASE WHEN event_type = 'page.view' THEN 1 ELSE 0 END) AS page_views,
+       SUM(CASE WHEN event_type = 'ui.click' THEN 1 ELSE 0 END) AS clicks,
+       SUM(CASE WHEN user_kind = 'human' THEN 1 ELSE 0 END) AS humans,
+       SUM(CASE WHEN user_kind = 'ai' THEN 1 ELSE 0 END) AS ai,
+       COALESCE(SUM(CASE WHEN duration_ms IS NOT NULL THEN duration_ms ELSE 0 END), 0) AS time_ms
+     FROM usage_events
+     WHERE ${sql}
+     GROUP BY bucket
+     ORDER BY bucket ASC`, params).map((r) => ({
+        bucket: r.bucket,
+        events: r.events,
+        pageViews: r.page_views,
+        clicks: r.clicks,
+        humans: r.humans,
+        ai: r.ai,
+        timeMs: r.time_ms,
+    }));
+}
+function getTopPages(filters, limit = 25) {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    return (0, adapters_js_1.uaQueryAll)(`SELECT
+       COALESCE(path, '(inconnu)') AS path,
+       SUM(CASE WHEN event_type = 'page.view' THEN 1 ELSE 0 END) AS views,
+       COUNT(DISTINCT user_id) AS unique_users,
+       COALESCE(AVG(CASE WHEN event_type IN ('page.hide','page.dwell') AND duration_ms IS NOT NULL THEN duration_ms END), 0) AS avg_time_ms,
+       COALESCE(SUM(CASE WHEN duration_ms IS NOT NULL THEN duration_ms ELSE 0 END), 0) AS total_time_ms
+     FROM usage_events
+     WHERE ${sql} AND path IS NOT NULL AND path != ''
+     GROUP BY path
+     HAVING views > 0
+     ORDER BY views DESC
+     LIMIT ?`, [...params, Math.min(Math.max(limit, 1), 200)]).map((r) => ({
+        path: r.path,
+        views: r.views,
+        uniqueUsers: r.unique_users,
+        avgTimeMs: Math.round(r.avg_time_ms || 0),
+        totalTimeMs: r.total_time_ms,
+    }));
+}
+function getTopClicks(filters, limit = 25) {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    return (0, adapters_js_1.uaQueryAll)(`SELECT
+       COALESCE(NULLIF(TRIM(label), ''), '(sans label)') AS label,
+       COUNT(*) AS clicks,
+       COUNT(DISTINCT user_id) AS unique_users,
+       COUNT(DISTINCT path) AS paths
+     FROM usage_events
+     WHERE ${sql} AND event_type = 'ui.click'
+     GROUP BY label
+     ORDER BY clicks DESC
+     LIMIT ?`, [...params, Math.min(Math.max(limit, 1), 200)]).map((r) => ({
+        label: r.label,
+        clicks: r.clicks,
+        uniqueUsers: r.unique_users,
+        paths: r.paths,
+    }));
+}
+function getUserStats(filters, limit = 50) {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    return (0, adapters_js_1.uaQueryAll)(`SELECT
+       COALESCE(user_id, 'anonymous') AS user_id,
+       COALESCE(MAX(username), user_id, 'anonymous') AS username,
+       MAX(user_kind) AS kind,
+       MAX(user_role) AS role,
+       COUNT(*) AS events,
+       SUM(CASE WHEN event_type = 'page.view' THEN 1 ELSE 0 END) AS page_views,
+       SUM(CASE WHEN event_type = 'ui.click' THEN 1 ELSE 0 END) AS clicks,
+       COUNT(DISTINCT session_id) AS sessions,
+       COALESCE(SUM(CASE WHEN duration_ms IS NOT NULL THEN duration_ms ELSE 0 END), 0) AS time_ms,
+       MAX(created_at) AS last_seen
+     FROM usage_events
+     WHERE ${sql}
+     GROUP BY COALESCE(user_id, 'anonymous')
+     ORDER BY events DESC
+     LIMIT ?`, [...params, Math.min(Math.max(limit, 1), 200)]).map((r) => ({
+        userId: r.user_id,
+        username: r.username,
+        kind: r.kind,
+        role: r.role,
+        events: r.events,
+        pageViews: r.page_views,
+        clicks: r.clicks,
+        sessions: r.sessions,
+        timeMs: r.time_ms,
+        lastSeen: r.last_seen,
+    }));
+}
+function listUsageEvents(filters) {
+    ensureUsageAnalyticsSchema();
+    const { sql, params } = buildWhere(filters);
+    const limit = Math.min(Math.max(filters.limit ?? 100, 1), 500);
+    const offset = Math.max(filters.offset ?? 0, 0);
+    const total = (0, adapters_js_1.uaQueryOne)(`SELECT COUNT(*) AS c FROM usage_events WHERE ${sql}`, params)?.c ??
+        0;
+    const events = (0, adapters_js_1.uaQueryAll)(`SELECT * FROM usage_events WHERE ${sql} ORDER BY created_at DESC, id DESC LIMIT ? OFFSET ?`, [...params, limit, offset]);
+    return { events, total };
+}
+function purgeUsageEvents(opts = {}) {
+    ensureUsageAnalyticsSchema();
+    const db = (0, adapters_js_1.uaGetWriteDb)();
+    if (opts.all) {
+        const info = db.prepare(`DELETE FROM usage_events`).run();
+        return info.changes;
+    }
+    if (opts.before) {
+        const info = db.prepare(`DELETE FROM usage_events WHERE created_at < ?`).run(opts.before);
+        return info.changes;
+    }
+    return 0;
+}
+//# sourceMappingURL=usage-analytics.js.map

package/dist-cjs/usage/usage-analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-analytics.js","sourceRoot":"","sources":["../../src/usage/usage-analytics.ts"],"names":[],"mappings":";;;AAoEA,kDAEC;AAGD,gEAoCC;AA8DD,8CA4CC;AAED,4CAMC;AAED,oDAYC;AAkBD,4CA4DC;AAkBD,4CAsCC;AAUD,kCA8BC;AASD,oCA0BC;AAeD,oCA4CC;AAED,0CAeC;AAED,4CAYC;AAxhBD;;;GAGG;AACH,+CAKuB;AACvB,2EAIqC;AAG5B,+FANP,0CAAc,OAMO;AAiDvB,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAgB,mBAAmB;IACjC,OAAO,IAAA,2BAAW,EAAC,cAAc,CAAC,CAAC;AACrC,CAAC;AAED,iEAAiE;AACjE,SAAgB,0BAA0B;IACxC,IAAI,WAAW,IAAI,mBAAmB,EAAE;QAAE,OAAO;IACjD,MAAM,EAAE,GAAG,IAAA,0BAAU,GAAE,CAAC;IACxB,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BP,CAAC,CAAC;IACH,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,GAAW;IACvC,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,MAAmB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IACzD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,KAAK;QAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,IAAI,MAAM,KAAK,MAAM;QAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;SACxD,IAAI,MAAM,KAAK,OAAO;QAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;;QAC1D,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,UAAU,CAAC,OAAqB;IACvC,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC7B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,0BAAU,GAAE,CAAC;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;GAMvB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAE,EAAE;QAC7C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC;gBACpF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;gBAChD,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,GAAG,CACN,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,GAAG,EAChC,SAAS,EACT,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,EAChC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EACtB,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EACrB,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,CAAC,EAC7B,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EACtB,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EACzB,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EACzB,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EACxB,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EACzB,QAAQ,EACR,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EACrD,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAC1B,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,CACjC,CAAC;YACF,QAAQ,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC;IACF,IAAI,EAAE,CAAC,WAAW;QAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;;QAClD,UAAU,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAsB;IACrD,IAAI,CAAC;QACH,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;AACH,CAAC;AAED,SAAgB,oBAAoB,CAClC,MAAwC,EACxC,IAAa,EACb,EAAW;IAEX,MAAM,CAAC,GAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAW,CAAC,QAAQ,CAAC,MAAqB,CAAC;QACnF,CAAC,CAAE,MAAsB;QACzB,CAAC,CAAC,MAAM,CAAC;IACX,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,SAAS,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAkBD,SAAgB,gBAAgB,CAAC,OAAqB;IACpD,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAUrB;;;;;;;;;;aAUS,GAAG,EAAE,EACd,MAAM,CACP,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB;;;;;;aAMS,GAAG;;0BAEU,EACtB,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;YAC3B,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,CAAC;YAClC,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;YAC3B,QAAQ;YACR,WAAW,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC;YACtC,YAAY,EAAE,MAAM,EAAE,aAAa,IAAI,CAAC;YACxC,QAAQ,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC;YAChC,WAAW;YACX,gBAAgB,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;SACxE;QACD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,OAAO;SAClB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAYD,SAAS,UAAU,CAAC,MAAmB;IACrC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,wCAAwC,CAAC;IACtE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,+BAA+B,CAAC;IAC9D,OAAO,kCAAkC,CAAC;AAC5C,CAAC;AAED,SAAgB,gBAAgB,CAC9B,OAAqB,EACrB,SAAsB,MAAM;IAE5B,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,IAAA,wBAAQ,EASb;SACK,MAAM;;;;;;;;aAQF,GAAG;;yBAES,EACrB,MAAM,CACP,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,OAAO;KAClB,CAAC,CAAC,CAAC;AACN,CAAC;AAUD,SAAgB,WAAW,CAAC,OAAqB,EAAE,KAAK,GAAG,EAAE;IAC3D,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAA,wBAAQ,EAOb;;;;;;;aAOS,GAAG;;;;aAIH,EACT,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC;QACzC,WAAW,EAAE,CAAC,CAAC,aAAa;KAC7B,CAAC,CAAC,CAAC;AACN,CAAC;AASD,SAAgB,YAAY,CAAC,OAAqB,EAAE,KAAK,GAAG,EAAE;IAC5D,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAA,wBAAQ,EAMb;;;;;;aAMS,GAAG;;;aAGH,EACT,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,YAAY;QAC3B,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC,CAAC;AACN,CAAC;AAeD,SAAgB,YAAY,CAAC,OAAqB,EAAE,KAAK,GAAG,EAAE;IAC5D,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAA,wBAAQ,EAYb;;;;;;;;;;;;aAYS,GAAG;;;aAGH,EACT,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAC/C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACZ,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,UAAU;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,OAAO;QACjB,QAAQ,EAAE,CAAC,CAAC,SAAS;KACtB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAgB,eAAe,CAC7B,OAA2D;IAE3D,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GACT,IAAA,wBAAQ,EAAgB,gDAAgD,GAAG,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC;QACzF,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAA,wBAAQ,EACrB,oCAAoC,GAAG,qDAAqD,EAC5F,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAC3B,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAA2C,EAAE;IAC5E,0BAA0B,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,0BAAU,GAAE,CAAC;IACxB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/fleet-collector/AGENTS.md

@@ -0,0 +1,7 @@
+# AGENTS — observability/fleet-collector
+
+Service collector flotte (bin `creezio-fleet-collector`).
+
+- Config / env : voir [README.md](./README.md)
+- Package parent : [../README.md](../README.md) · [../AGENTS.md](../AGENTS.md)
+- Ne pas coupler au métier d’une marque ; payloads anonymisés / agrégats

package/fleet-collector/README.md

@@ -0,0 +1,83 @@
+# Fleet Collector — `@creezio/observability`
+
+Service ops autonome en Node pur (loopback HTTP + store JSON), **SoT kit**
+— 0 domaine marque hardcodé. Le dossier porte le collector télémétrie :
+
+| Fichier | Service | Câblé en prod |
+|---|---|---|
+| `server.mjs` (+ `ops-api.mjs`, `env.mjs`) | Collector télémétrie (ingest heartbeat/crash/bundle + cockpit ops) — **SoT ici** | Service dédié (ex. legacy `:8665`) |
+
+**Backend flotte / agent hôte** : la SoT vit dans
+[`packages/fleet`](../../fleet/README.md) (`@creezio/fleet`, TS strict —
+P2.b 0.15.0). Les 7 wrappers `.mjs` de compat de ce dossier et le bin npm
+`creezio-server-admin` ont été **retirés en 0.19.0**. Les images embarquent
+`packages/fleet/dist` (CMD `node_modules/@creezio/fleet/dist/bin/*-main.js`,
+contexte stagé fail-closed).
+
+**Piège prod** : le code flotte est **copié dans les images** au build —
+après toute modif de `packages/fleet/src`, `npm run build:packages` puis
+re-runner `creezio server-docker admin up …` / `agent up …` (sinon nouvelles
+routes → 404 silencieux).
+
+## Lancement
+
+```bash
+# Depuis le kit
+CREEZIO_FLEET_INGEST_TOKEN=… \
+CREEZIO_FLEET_OPS_USER=ops \
+CREEZIO_FLEET_OPS_PASS=… \
+CREEZIO_FLEET_UI_TITLE="TempoFlow Fleet" \
+CREEZIO_FLEET_TUNNEL_SUFFIX=tempoflow.fr \
+FLEET_PUBLIC_DOMAIN=fleet.tempoflow.fr \
+npm run fleet-collector -w @creezio/observability
+
+# Ou binaire
+npx creezio-fleet-collector
+```
+
+Marques (package npm installé) :
+
+```bash
+node node_modules/@creezio/observability/fleet-collector/server.mjs
+```
+
+## Env (neutre + dual-read legacy)
+
+| Variable | Alias legacy | Rôle |
+|----------|--------------|------|
+| `CREEZIO_FLEET_PORT` / `FLEET_PORT` | `TF2_FLEET_PORT`, `CERTIVAN_FLEET_PORT` | Listen (défaut 8665) |
+| `CREEZIO_FLEET_INGEST_TOKEN` / `FLEET_INGEST_TOKEN` | `TF2_*`, `CERTIVAN_*` | Path ingest `/i-<token>/…` |
+| `CREEZIO_FLEET_OPS_USER` / `_PASS` / `_TOKEN` | idem | Auth ops Basic / Bearer |
+| `CREEZIO_FLEET_DIR` / `FLEET_DIR` | idem | State JSON |
+| `FLEET_PUBLIC_DOMAIN` / `CREEZIO_FLEET_DOMAIN` | — | Domaine public (docs / NPM) |
+| `CREEZIO_FLEET_TUNNEL_SUFFIX` | — | Fallback hostname `${slug}.${suffix}` |
+| `CREEZIO_FLEET_UI_TITLE` / `_MARK` / `_HOME_TITLE` / `_REALM` | — | Branding UI |
+| `CREEZIO_FLEET_UI_EXTRAS_TITLE` | — | Carte extras (ex. « Dossiers VASP ») |
+| `CREEZIO_FLEET_UI_ETAT_LABELS` | — | JSON labels états extras |
+
+## Endpoints
+
+- Ingest : `POST /i-<token>/heartbeat|crash|bundle`, `GET/POST …/commands`
+- Ops : `/` UI + `/ops/api/*` (Basic / Bearer)
+
+## Extras métier (marques)
+
+Le collector accepte `dossierStats` opaque dans le heartbeat (agrégation + UI
+si présent). L’émission métier reste marque — ex. Certivan
+`electron/fleet-dossier-samples.ts` via `getHeartbeatExtras`.
+
+## Tests
+
+```bash
+npm run test:fleet-collector -w @creezio/observability
+# ou
+node packages/observability/fleet-collector/test-fleet-collector.mjs
+```
+
+## DNS / NPM (VPS)
+
+```bash
+FLEET_PUBLIC_DOMAIN=fleet.example.com FLEET_PORT=8665 \
+CF_ENV=/path/to/.cloudflare.env \
+bash packages/observability/fleet-collector/configure-fleet-npm.sh
+```

package/fleet-collector/configure-fleet-npm.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# DNS Cloudflare + NPM proxy host pour le cockpit fleet (domaine injecté).
+#
+# Requis :
+#   FLEET_PUBLIC_DOMAIN  (ex. fleet.example.com)
+#   FLEET_PORT           (ex. 8665)
+#   CF_ENV               chemin .env Cloudflare (token + zone)
+# Optionnel :
+#   NPM_CONTAINER, NPM_API, WP_ENV, PROV_SCRIPTS, VPS_IP, FORWARD_HOST
+set -euo pipefail
+
+: "${FLEET_PUBLIC_DOMAIN:?set FLEET_PUBLIC_DOMAIN}"
+: "${FLEET_PORT:?set FLEET_PORT}"
+: "${CF_ENV:?set CF_ENV (cloudflare env file)}"
+
+NPM_CONTAINER="${NPM_CONTAINER:-nginx-proxy-manager}"
+NPM_API="${NPM_API:-http://127.0.0.1:81/api}"
+WP_ENV="${WP_ENV:-/opt/docker/wp-provisioner/.env}"
+PROV_SCRIPTS="${PROV_SCRIPTS:-/opt/docker/wp-provisioner/scripts}"
+CF_API="https://api.cloudflare.com/client/v4"
+
+DOMAIN="$FLEET_PUBLIC_DOMAIN"
+PORT="$FLEET_PORT"
+FORWARD_HOST="${FORWARD_HOST:-127.0.0.1}"
+VPS_IP="${VPS_IP:-104.168.10.36}"
+
+set -a; . "$WP_ENV"; . "$CF_ENV"; set +a
+: "${NPM_EMAIL:?}"; : "${NPM_PASSWORD:?}"; : "${CF_API_TOKEN:?}"; : "${CF_ZONE_ID:?}"
+
+echo "==> DNS A $DOMAIN → $VPS_IP (proxied)"
+EXIST_DNS=$(curl -sS -H "Authorization: Bearer $CF_API_TOKEN" \
+  "$CF_API/zones/$CF_ZONE_ID/dns_records?name=$DOMAIN&type=A" | jq -r '.result[0].id // empty')
+DNS_BODY=$(jq -nc --arg n "$DOMAIN" --arg ip "$VPS_IP" \
+  '{type:"A",name:$n,content:$ip,ttl:1,proxied:true,comment:"Creezio fleet cockpit"}')
+if [ -n "$EXIST_DNS" ]; then
+  curl -sS -X PUT -H "Authorization: Bearer $CF_API_TOKEN" -H "Content-Type: application/json" \
+    -d "$DNS_BODY" "$CF_API/zones/$CF_ZONE_ID/dns_records/$EXIST_DNS" | jq -e '.success==true' >/dev/null
+  echo "   DNS mis à jour ($EXIST_DNS)"
+else
+  curl -sS -X POST -H "Authorization: Bearer $CF_API_TOKEN" -H "Content-Type: application/json" \
+    -d "$DNS_BODY" "$CF_API/zones/$CF_ZONE_ID/dns_records" | jq -e '.success==true' >/dev/null
+  echo "   DNS créé"
+fi
+
+echo "==> Authentification NPM"
+TOKEN=$(docker exec "$NPM_CONTAINER" curl -sS -X POST "$NPM_API/tokens" \
+  -H "Content-Type: application/json" \
+  -d "$(jq -nc --arg i "$NPM_EMAIL" --arg s "$NPM_PASSWORD" '{identity:$i,secret:$s}')" \
+  | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+[ -n "$TOKEN" ] || { echo "ERREUR: token NPM vide"; exit 1; }
+
+echo "==> Proxy host $DOMAIN -> $FORWARD_HOST:$PORT"
+EXIST=$(docker exec "$NPM_CONTAINER" curl -sS -H "Authorization: Bearer $TOKEN" "$NPM_API/nginx/proxy-hosts" \
+  | jq -r --arg d "$DOMAIN" '(if type=="array" then . else [] end)[]|select((.domain_names//[])|index($d)!=null)|.id' | head -1)
+if [ -z "$EXIST" ] || [ "$EXIST" = "null" ]; then
+  PAYLOAD=$(jq -nc --arg d "$DOMAIN" --arg fh "$FORWARD_HOST" --argjson p "$PORT" \
+    '{domain_names:[$d],forward_scheme:"http",forward_host:$fh,forward_port:$p,
+      certificate_id:0,ssl_forced:false,hsts_enabled:false,
+      hsts_subdomains:false,http2_support:true,block_exploits:true,caching_enabled:false,
+      allow_websocket_upgrade:true,advanced_config:"",enabled:true,
+      meta:{letsencrypt_agree:false,dns_challenge:false},locations:[]}')
+  HOST_ID=$(docker exec "$NPM_CONTAINER" curl -sS -X POST "$NPM_API/nginx/proxy-hosts" \
+    -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d "$PAYLOAD" | jq -r '.id // empty')
+  [ -n "$HOST_ID" ] || { echo "ERREUR: création proxy host échouée"; exit 1; }
+  echo "   proxy host créé (id=$HOST_ID)"
+else
+  HOST_ID="$EXIST"
+  echo "   proxy host déjà présent (id=$HOST_ID)"
+fi
+
+echo "==> Certificat Cloudflare Origin pour $DOMAIN"
+TMP=$(mktemp -d); trap 'rm -rf "$TMP"' EXIT
+cat > "$TMP/openssl.cnf" <<EOF
+[ req ]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+req_extensions = v3_req
+[ dn ]
+CN = $DOMAIN
+[ v3_req ]
+subjectAltName = @alt_names
+[ alt_names ]
+DNS.1 = $DOMAIN
+EOF
+openssl req -new -newkey rsa:2048 -nodes -keyout "$TMP/origin.key" -out "$TMP/origin.csr" -config "$TMP/openssl.cnf" >/dev/null 2>&1
+CF_BODY=$(jq -n --rawfile csr "$TMP/origin.csr" --arg d "$DOMAIN" \
+  '{hostnames:[$d],requested_validity:5475,request_type:"origin-rsa",csr:$csr,requested_bundle:"false"}')
+CF_RESP=$(curl -sS -X POST "$CF_API/certificates" -H "Authorization: Bearer $CF_API_TOKEN" -H "Content-Type: application/json" -d "$CF_BODY")
+echo "$CF_RESP" | jq -e '.success==true' >/dev/null 2>&1 || { echo "ERREUR Cloudflare Origin CA: $(echo "$CF_RESP" | jq -c '.errors // .' | head -c 600)"; exit 1; }
+CERT_PEM=$(echo "$CF_RESP" | jq -r '.result.certificate')
+
+echo "==> Upload TLS NPM"
+export DOM="$DOMAIN"
+export FRONT_DOM=""
+export FRONT_DEV_DOM=""
+export EMAIL="$NPM_EMAIL"
+export PASS="$NPM_PASSWORD"
+export CERT_B64="$(printf '%s' "$CERT_PEM" | base64 | tr -d '\n')"
+export KEY_B64="$(base64 < "$TMP/origin.key" | tr -d '\n')"
+RESULT=$(bash "$PROV_SCRIPTS/n8n-npm-tls-install.sh" 2>&1 | grep -E '^\{.*\}' | tail -1)
+echo "   $RESULT"
+echo "$RESULT" | jq -e '.ok==true' >/dev/null 2>&1 || { echo "ERREUR install TLS NPM"; exit 1; }
+
+echo "=================================================="
+echo " OK -> https://$DOMAIN/"
+echo "=================================================="