@runeya/apps-cli 0.1.0 → 0.1.2

package/dist/agent-manager-3S4FUNJS-MYT5X6XQ.js

@@ -0,0 +1,8 @@
+import {
+  agentManager
+} from "./chunk-XZPCEGWS.js";
+import "./chunk-ERJIU7R4.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-3S4FUNJS-MYT5X6XQ.js.map

package/dist/agent-manager-3S4FUNJS-MYT5X6XQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-32HTB3XS.js

@@ -0,0 +1,350 @@
+import {
+  decryptValue,
+  encryptValue,
+  env
+} from "./chunk-ERJIU7R4.js";
+
+// ../server/dist/chunk-QJEZQQUG.js
+import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID } from "crypto";
+import { EventEmitter } from "events";
+import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
+import { join } from "path";
+var FILENAME = "kanban.private.json.enc";
+var KanbanStore = class {
+  boards = /* @__PURE__ */ new Map();
+  loaded = false;
+  events = new EventEmitter();
+  saveTimer = null;
+  getFilePath() {
+    return join(env.DATA_DIR, FILENAME);
+  }
+  async ensureDir() {
+    await mkdir(env.DATA_DIR, { recursive: true });
+  }
+  async load() {
+    if (this.loaded) return;
+    try {
+      const encrypted = await readFile(this.getFilePath(), "utf-8");
+      const raw = decryptValue(encrypted);
+      const data = JSON.parse(raw);
+      for (const b of data) {
+        this.boards.set(b.id, b);
+      }
+    } catch {
+    }
+    this.loaded = true;
+  }
+  async saveNow() {
+    await this.ensureDir();
+    const filePath = this.getFilePath();
+    const tmpPath = filePath + ".tmp";
+    const json = JSON.stringify(Array.from(this.boards.values()), null, 2);
+    const encrypted = encryptValue(json);
+    await writeFile(tmpPath, encrypted, "utf-8");
+    await rename(tmpPath, filePath);
+    await chmod(filePath, 384);
+  }
+  save() {
+    if (this.saveTimer) clearTimeout(this.saveTimer);
+    this.saveTimer = setTimeout(() => {
+      this.saveNow().catch((err) => {
+        console.error("[kanban-store] save failed:", err);
+      });
+    }, 200);
+  }
+  async list(includeArchived = false) {
+    await this.load();
+    const all = Array.from(this.boards.values());
+    return includeArchived ? all : all.filter((b) => !b.archived);
+  }
+  async get(id) {
+    await this.load();
+    return this.boards.get(id) ?? null;
+  }
+  async create(input) {
+    await this.load();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const board = {
+      id: randomUUID(),
+      name: input.name,
+      description: input.description ?? "",
+      columns: [],
+      archived: false,
+      createdAt: now,
+      updatedAt: now
+    };
+    this.boards.set(board.id, board);
+    this.save();
+    this.events.emit("changed", { type: "created", board });
+    return board;
+  }
+  async update(input) {
+    await this.load();
+    const existing = this.boards.get(input.id);
+    if (!existing) return null;
+    const updated = {
+      ...existing,
+      ...input.name !== void 0 && { name: input.name },
+      ...input.description !== void 0 && { description: input.description },
+      ...input.columns !== void 0 && { columns: input.columns },
+      ...input.archived !== void 0 && { archived: input.archived },
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.boards.set(input.id, updated);
+    this.save();
+    this.events.emit("changed", { type: "updated", board: updated });
+    return updated;
+  }
+  async delete(id) {
+    await this.load();
+    if (!this.boards.has(id)) return false;
+    this.boards.delete(id);
+    this.save();
+    this.events.emit("changed", { type: "deleted", id });
+    return true;
+  }
+  onChanged(handler) {
+    this.events.on("changed", handler);
+  }
+  offChanged(handler) {
+    this.events.off("changed", handler);
+  }
+};
+var kanbanStore = new KanbanStore();
+async function executeKanbanCommands(boardId, cardId, commands, conversationId) {
+  if (commands.length === 0) return;
+  let board = await kanbanStore.get(boardId);
+  if (!board) {
+    console.warn(`[kanban-commands] Board ${boardId} not found, skipping ${commands.length} command(s)`);
+    return;
+  }
+  const cardExistsInBoard = () => board.columns.some((col) => col.cards.some((c) => c.id === cardId));
+  if (!cardExistsInBoard()) {
+    for (let attempt = 1; attempt <= 5; attempt++) {
+      console.warn(`[kanban-commands] Card ${cardId} not found in board, retry ${attempt}/5...`);
+      await new Promise((r) => setTimeout(r, 500 * attempt));
+      board = await kanbanStore.get(boardId);
+      if (!board) return;
+      if (cardExistsInBoard()) break;
+    }
+    if (!cardExistsInBoard()) {
+      console.error(`[kanban-commands] Card ${cardId} still not found after retries, skipping ${commands.length} command(s)`);
+      return;
+    }
+  }
+  for (const cmd of commands) {
+    if (cmd.type === "move_card" && cmd.columnTitle) {
+      const moved = moveCard(board, cardId, cmd.columnTitle);
+      if (!moved) console.warn(`[kanban-commands] move_card failed: card=${cardId} target="${cmd.columnTitle}"`);
+    } else if (cmd.type === "add_comment" && cmd.comment) {
+      addComment(board, cardId, cmd.comment, conversationId);
+    } else if (cmd.type === "add_card" && cmd.columnTitle && cmd.cardTitle) {
+      addCardToColumn(board, cmd.columnTitle, cmd.cardTitle, cmd.cardContent);
+    }
+  }
+  await kanbanStore.update({ id: board.id, columns: board.columns });
+}
+async function executeKanbanBoardCommands(boardId, commands) {
+  if (commands.length === 0) return;
+  const board = await kanbanStore.get(boardId);
+  if (!board) return;
+  for (const cmd of commands) {
+    if (cmd.type === "add_card" && cmd.columnTitle && cmd.cardTitle) {
+      addCardToColumn(board, cmd.columnTitle, cmd.cardTitle, cmd.cardContent);
+    }
+  }
+  await kanbanStore.update({ id: board.id, columns: board.columns });
+}
+function moveCard(board, cardId, targetColTitle) {
+  let sourceCol = "";
+  let card = null;
+  let sourceColIdx = -1;
+  let cardIdx = -1;
+  for (let ci = 0; ci < board.columns.length; ci++) {
+    const col = board.columns[ci];
+    const idx = col.cards.findIndex((c) => c.id === cardId);
+    if (idx !== -1) {
+      sourceCol = col.title;
+      card = col.cards[idx];
+      sourceColIdx = ci;
+      cardIdx = idx;
+      break;
+    }
+  }
+  if (!card || sourceColIdx === -1) return false;
+  const targetCol = board.columns.find(
+    (c) => c.title.toLowerCase() === targetColTitle.toLowerCase()
+  );
+  if (!targetCol) {
+    console.warn(`[kanban-commands] Target column "${targetColTitle}" not found. Available: ${board.columns.map((c) => c.title).join(", ")}`);
+    return false;
+  }
+  if (targetCol.id === board.columns[sourceColIdx].id) return true;
+  board.columns[sourceColIdx].cards.splice(cardIdx, 1);
+  card.order = targetCol.cards.length;
+  card.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  card.history = [...card.history ?? [], {
+    type: "moved",
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: `"${sourceCol}" \u2192 "${targetCol.title}"`,
+    author: "ai"
+  }];
+  targetCol.cards.push(card);
+  return true;
+}
+function addCardToColumn(board, columnTitle, cardTitle, cardContent) {
+  const col = board.columns.find((c) => c.title.toLowerCase() === columnTitle.toLowerCase());
+  if (!col) return;
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const card = {
+    id: randomUUID2(),
+    title: cardTitle,
+    markdown: cardContent ?? "",
+    images: [],
+    order: col.cards.length,
+    history: [{ type: "created", timestamp: now, detail: `AI \u2014 In column "${col.title}"` }],
+    createdAt: now,
+    updatedAt: now
+  };
+  col.cards.push(card);
+}
+function addComment(board, cardId, comment, conversationId) {
+  for (const col of board.columns) {
+    const card = col.cards.find((c) => c.id === cardId);
+    if (card) {
+      card.history = [...card.history ?? [], {
+        type: "comment",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        detail: comment,
+        author: "ai",
+        ...conversationId ? { conversationId } : {}
+      }];
+      card.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+      return;
+    }
+  }
+}
+function generateKanbanSystemPrompt(board, cardId) {
+  let currentColTitle = "";
+  let card = null;
+  for (const col of board.columns) {
+    const found = col.cards.find((c) => c.id === cardId);
+    if (found) {
+      currentColTitle = col.title;
+      card = found;
+      break;
+    }
+  }
+  const sortedColumns = [...board.columns].sort((a, b) => a.order - b.order);
+  const lines = [];
+  lines.push("## Kanban Board Context");
+  lines.push("");
+  lines.push(`Tu travailles dans le contexte d'une carte Kanban.`);
+  lines.push(`- **Board** : ${board.name}`);
+  if (card) {
+    lines.push(`- **Carte** : ${card.title}`);
+    lines.push(`- **Colonne actuelle** : \`${currentColTitle}\``);
+  }
+  lines.push("");
+  lines.push("### Colonnes disponibles (noms exacts \xE0 utiliser) :");
+  for (const col of sortedColumns) {
+    const cardCount = col.cards.length;
+    const isCurrent = card && col.cards.some((c) => c.id === cardId);
+    lines.push(`- \`${col.title}\` (${cardCount} carte${cardCount !== 1 ? "s" : ""})${isCurrent ? " \u2190 **colonne actuelle**" : ""}`);
+  }
+  lines.push("");
+  if (card) {
+    const comments = (card.history ?? []).filter((e) => e.type === "comment");
+    if (comments.length > 0) {
+      lines.push("### Commentaires existants sur cette carte :");
+      lines.push("");
+      for (const c of comments.slice(-20)) {
+        const who = c.author === "ai" ? "AI" : "Utilisateur";
+        const date = new Date(c.timestamp).toLocaleString("fr-FR", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" });
+        lines.push(`- **${who}** (${date}) : ${c.detail}`);
+      }
+      lines.push("");
+    }
+  }
+  lines.push("### Outils Kanban disponibles");
+  lines.push("");
+  lines.push(`- **boardId** (\xE0 passer dans tous les outils) : \`${board.id}\``);
+  if (card) lines.push(`- **cardId** (carte actuelle) : \`${card.id}\``);
+  lines.push("");
+  lines.push("Tu disposes des outils suivants pour interagir avec le board :");
+  lines.push("- `kanban_move_card(boardId, cardId, targetColumn)` \u2014 D\xE9placer la carte vers une autre colonne");
+  lines.push("- `kanban_add_comment(boardId, cardId, comment)` \u2014 Ajouter un commentaire sur la carte");
+  lines.push("");
+  lines.push("### OBLIGATOIRE \u2014 D\xE9cision Kanban");
+  lines.push("");
+  lines.push("\xC0 chaque r\xE9ponse, tu DOIS obligatoirement faire les deux actions suivantes :");
+  lines.push("");
+  lines.push("**1. \xC9valuer et d\xE9placer la carte si n\xE9cessaire** via `kanban_move_card` :");
+  lines.push("   - **Au d\xE9but** si tu sais d\xE9j\xE0 que tu vas travailler activement (ex. tu passes en `In progress`).");
+  lines.push("   - **\xC0 la fin** pour une d\xE9cision forte apr\xE8s analyse compl\xE8te (ex. tu conclus que c'est `Done`).");
+  lines.push("   - Si tu ne fais qu'analyser ou poser des questions \u2192 **ne pas d\xE9placer**.");
+  lines.push("");
+  lines.push("   > \u26A0\uFE0F **CRITIQUE** : En fin de r\xE9ponse, tu DOIS TOUJOURS \xE9valuer si la colonne actuelle est encore correcte.");
+  lines.push("");
+  lines.push("**2. Appeler `kanban_add_comment`** r\xE9sumant ce que tu as fait ou constat\xE9 (**\xE0 la fin** de ta r\xE9ponse).");
+  lines.push("");
+  lines.push("> \u{1F6AB} **INTERDIT** : Terminer une r\xE9ponse sans appeler `kanban_add_comment`. C'est non n\xE9gociable.");
+  lines.push("");
+  return lines.join("\n");
+}
+function generateKanbanPopulatePrompt(board) {
+  const lines = [];
+  lines.push("## Kanban Board \u2014 Mode Populate");
+  lines.push("");
+  lines.push(`Tu es en mode **populate** sur le tableau Kanban **"${board.name}"**.`);
+  lines.push(`Tu es un outil de gestion de projet. Quand l'utilisateur dit "cr\xE9er une card", "ajouter une t\xE2che", "cr\xE9er une carte", ou toute demande similaire, il parle EXCLUSIVEMENT d'une carte Kanban \xE0 ajouter au tableau \u2014 PAS d'un composant UI, PAS de code HTML ou CSS, PAS d'un composant React/Vue/Angular.`);
+  lines.push("");
+  lines.push("Ton UNIQUE r\xF4le est de cr\xE9er des cartes Kanban pertinentes en r\xE9ponse \xE0 la demande de l'utilisateur.");
+  lines.push("Tu ne dois PAS r\xE9pondre \xE0 la question, ni donner d'explication, ni \xE9crire du code, ni montrer de composant.");
+  lines.push("Tu dois UNIQUEMENT produire des tags XML `<kanban_add_card>` pour cr\xE9er des cartes dans le tableau.");
+  if (board.description) {
+    lines.push("");
+    lines.push(`Description du board : ${board.description}`);
+  }
+  lines.push("");
+  const sortedCols = [...board.columns].sort((a, b) => a.order - b.order);
+  lines.push("### Colonnes existantes (noms exacts \xE0 utiliser) :");
+  for (const col of sortedCols) {
+    const cardCount = col.cards.length;
+    lines.push(`- \`${col.title}\` (${cardCount} carte${cardCount !== 1 ? "s" : ""})`);
+    for (const card of col.cards) {
+      lines.push(`  - ${card.title}`);
+    }
+  }
+  lines.push("");
+  lines.push("### Outil disponible");
+  lines.push("");
+  lines.push(`- **boardId** (\xE0 passer dans tous les outils) : \`${board.id}\``);
+  lines.push("");
+  lines.push("Pour chaque carte \xE0 cr\xE9er, appelle l'outil `kanban_add_card(boardId, column, title, content)` :");
+  lines.push("- `column` : nom exact de la colonne cible");
+  lines.push("- `title` : titre concis de la carte");
+  lines.push("- `content` : contenu markdown d\xE9taill\xE9 et actionnable");
+  lines.push("");
+  lines.push("### R\xE8gles STRICTES");
+  lines.push("");
+  lines.push("1. **NE R\xC9PONDS PAS** \xE0 la question de l'utilisateur. Ne donne aucune explication, aucun texte libre.");
+  lines.push("2. **Appelle uniquement** `kanban_add_card`, rien d'autre.");
+  lines.push("3. Tu ne peux PAS cr\xE9er de nouvelles colonnes. Dispatch les cartes dans les colonnes existantes list\xE9es ci-dessus.");
+  lines.push("4. Utilise les noms **exacts** des colonnes.");
+  lines.push("5. Chaque carte doit avoir un titre concis et un contenu markdown d\xE9taill\xE9 et actionnable.");
+  lines.push("6. D\xE9compose la demande de l'utilisateur en t\xE2ches concr\xE8tes, chacune \xE9tant une carte.");
+  lines.push("7. Dispatch chaque carte dans la colonne la plus appropri\xE9e selon sa nature.");
+  lines.push("");
+  return lines.join("\n");
+}
+
+export {
+  kanbanStore,
+  executeKanbanCommands,
+  executeKanbanBoardCommands,
+  generateKanbanSystemPrompt,
+  generateKanbanPopulatePrompt
+};
+//# sourceMappingURL=chunk-32HTB3XS.js.map

package/dist/chunk-32HTB3XS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../server/src/services/kanban-commands.ts","../../server/src/services/kanban-store.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { kanbanStore } from './kanban-store.js';\nimport type { KanbanBoard, KanbanCard } from '@runeya/packages-shared';\n\n// ─── Command parsing ────────────────────────────────────────────────────────\n\nexport interface KanbanCommand {\n  type: 'move_card' | 'add_comment' | 'add_card';\n  /** Target column title (for move_card, add_card) */\n  columnTitle?: string;\n  /** Comment text (for add_comment) */\n  comment?: string;\n  /** Card title (for add_card) */\n  cardTitle?: string;\n  /** Card content / markdown (for add_card) */\n  cardContent?: string;\n}\n\n/**\n * Parse kanban commands from AI output.\n * Commands use XML tags for robustness (support multiline content, no delimiter conflicts).\n *\n * Supported tags:\n *   <kanban_move column=\"Column Title\" />\n *   <kanban_comment>Comment text (multiline ok)</kanban_comment>\n *   <kanban_add_card column=\"Col\" title=\"Card Title\">Markdown content</kanban_add_card>\n */\nfunction parseKanbanCommands(output: string): KanbanCommand[] {\n  const commands: KanbanCommand[] = [];\n\n  // <kanban_move column=\"...\" />\n  const moveMatches = output.matchAll(/<kanban_move\\s+column=\"([^\"]*?)\"\\s*\\/>/gs);\n  for (const m of moveMatches) {\n    commands.push({ type: 'move_card', columnTitle: m[1].trim() });\n  }\n\n  // <kanban_comment>...</kanban_comment>\n  const commentMatches = output.matchAll(/<kanban_comment>([\\s\\S]*?)<\\/kanban_comment>/g);\n  for (const m of commentMatches) {\n    commands.push({ type: 'add_comment', comment: m[1].trim() });\n  }\n\n  // <kanban_add_card column=\"...\" title=\"...\">...</kanban_add_card>\n  // Accept attributes in any order (some LLMs swap column= and title=)\n  // Use (?:[^>\"]|\"[^\"]*\")* to correctly handle `>` inside quoted attribute values\n  // (e.g. title=\"CÔTÉ CLIENT > PANEL\" would break [^>]* which stops at the first >)\n  const addCardMatches = output.matchAll(/<kanban_add_card\\s+((?:[^>\"]|\"[^\"]*\")*?)>([\\s\\S]*?)<\\/kanban_add_card>/g);\n  for (const m of addCardMatches) {\n    const attrs = m[1];\n    const colMatch = attrs.match(/column=\"([^\"]*?)\"/);\n    const titleMatch = attrs.match(/title=\"([^\"]*?)\"/);\n    if (colMatch && titleMatch) {\n      commands.push({\n        type: 'add_card',\n        columnTitle: colMatch[1].trim(),\n        cardTitle: titleMatch[1].trim(),\n        cardContent: m[2].trim(),\n      });\n    }\n  }\n\n  return commands;\n}\n\n// ─── Command execution ──────────────────────────────────────────────────────\n\nexport async function executeKanbanCommands(\n  boardId: string,\n  cardId: string,\n  commands: KanbanCommand[],\n  conversationId?: string,\n): Promise<void> {\n  if (commands.length === 0) return;\n\n  // Retry loading the board a few times — the card may not have been persisted yet\n  // when the conversation was launched before the card was fully saved.\n  let board = await kanbanStore.get(boardId);\n  if (!board) {\n    console.warn(`[kanban-commands] Board ${boardId} not found, skipping ${commands.length} command(s)`);\n    return;\n  }\n\n  // Check if card exists in the board; if not, retry a few times with a short delay\n  const cardExistsInBoard = () => board!.columns.some(col => col.cards.some(c => c.id === cardId));\n  if (!cardExistsInBoard()) {\n    for (let attempt = 1; attempt <= 5; attempt++) {\n      console.warn(`[kanban-commands] Card ${cardId} not found in board, retry ${attempt}/5...`);\n      await new Promise(r => setTimeout(r, 500 * attempt));\n      board = await kanbanStore.get(boardId);\n      if (!board) return;\n      if (cardExistsInBoard()) break;\n    }\n    if (!cardExistsInBoard()) {\n      console.error(`[kanban-commands] Card ${cardId} still not found after retries, skipping ${commands.length} command(s)`);\n      return;\n    }\n  }\n\n  for (const cmd of commands) {\n    if (cmd.type === 'move_card' && cmd.columnTitle) {\n      const moved = moveCard(board, cardId, cmd.columnTitle);\n      if (!moved) console.warn(`[kanban-commands] move_card failed: card=${cardId} target=\"${cmd.columnTitle}\"`);\n    } else if (cmd.type === 'add_comment' && cmd.comment) {\n      addComment(board, cardId, cmd.comment, conversationId);\n    } else if (cmd.type === 'add_card' && cmd.columnTitle && cmd.cardTitle) {\n      addCardToColumn(board, cmd.columnTitle, cmd.cardTitle, cmd.cardContent);\n    }\n  }\n\n  await kanbanStore.update({ id: board.id, columns: board.columns });\n}\n\n/**\n * Execute board-level commands (no card context needed).\n * Used by the AI populate feature.\n */\nexport async function executeKanbanBoardCommands(\n  boardId: string,\n  commands: KanbanCommand[],\n): Promise<void> {\n  if (commands.length === 0) return;\n\n  const board = await kanbanStore.get(boardId);\n  if (!board) return;\n\n  for (const cmd of commands) {\n    if (cmd.type === 'add_card' && cmd.columnTitle && cmd.cardTitle) {\n      addCardToColumn(board, cmd.columnTitle, cmd.cardTitle, cmd.cardContent);\n    }\n  }\n\n  await kanbanStore.update({ id: board.id, columns: board.columns });\n}\n\nfunction moveCard(board: KanbanBoard, cardId: string, targetColTitle: string): boolean {\n  let sourceCol = '';\n  let card = null;\n  let sourceColIdx = -1;\n  let cardIdx = -1;\n\n  for (let ci = 0; ci < board.columns.length; ci++) {\n    const col = board.columns[ci];\n    const idx = col.cards.findIndex(c => c.id === cardId);\n    if (idx !== -1) {\n      sourceCol = col.title;\n      card = col.cards[idx];\n      sourceColIdx = ci;\n      cardIdx = idx;\n      break;\n    }\n  }\n  if (!card || sourceColIdx === -1) return false;\n\n  const targetCol = board.columns.find(\n    c => c.title.toLowerCase() === targetColTitle.toLowerCase(),\n  );\n  if (!targetCol) {\n    console.warn(`[kanban-commands] Target column \"${targetColTitle}\" not found. Available: ${board.columns.map(c => c.title).join(', ')}`);\n    return false;\n  }\n  if (targetCol.id === board.columns[sourceColIdx].id) return true; // already there\n\n  board.columns[sourceColIdx].cards.splice(cardIdx, 1);\n\n  card.order = targetCol.cards.length;\n  card.updatedAt = new Date().toISOString();\n  card.history = [...(card.history ?? []), {\n    type: 'moved',\n    timestamp: new Date().toISOString(),\n    detail: `\"${sourceCol}\" → \"${targetCol.title}\"`,\n    author: 'ai',\n  }];\n\n  targetCol.cards.push(card);\n  return true;\n}\n\nfunction addCardToColumn(board: KanbanBoard, columnTitle: string, cardTitle: string, cardContent?: string): void {\n  const col = board.columns.find(c => c.title.toLowerCase() === columnTitle.toLowerCase());\n  // Ignore if column doesn't exist — AI must use existing columns\n  if (!col) return;\n  const now = new Date().toISOString();\n  const card: KanbanCard = {\n    id: randomUUID(),\n    title: cardTitle,\n    markdown: cardContent ?? '',\n    images: [],\n    order: col.cards.length,\n    history: [{ type: 'created', timestamp: now, detail: `AI — In column \"${col.title}\"` }],\n    createdAt: now,\n    updatedAt: now,\n  };\n  col.cards.push(card);\n}\n\nfunction addComment(board: KanbanBoard, cardId: string, comment: string, conversationId?: string): void {\n  for (const col of board.columns) {\n    const card = col.cards.find(c => c.id === cardId);\n    if (card) {\n      card.history = [...(card.history ?? []), {\n        type: 'comment',\n        timestamp: new Date().toISOString(),\n        detail: comment,\n        author: 'ai',\n        ...(conversationId ? { conversationId } : {}),\n      }];\n      card.updatedAt = new Date().toISOString();\n      return;\n    }\n  }\n}\n\n// ─── System prompt for kanban context ───────────────────────────────────────\n\nexport function generateKanbanSystemPrompt(board: KanbanBoard, cardId: string): string {\n  let currentColTitle = '';\n  let card = null;\n  for (const col of board.columns) {\n    const found = col.cards.find(c => c.id === cardId);\n    if (found) {\n      currentColTitle = col.title;\n      card = found;\n      break;\n    }\n  }\n\n  const sortedColumns = [...board.columns].sort((a, b) => a.order - b.order);\n\n  const lines: string[] = [];\n  lines.push('## Kanban Board Context');\n  lines.push('');\n  lines.push(`Tu travailles dans le contexte d'une carte Kanban.`);\n  lines.push(`- **Board** : ${board.name}`);\n  if (card) {\n    lines.push(`- **Carte** : ${card.title}`);\n    lines.push(`- **Colonne actuelle** : \\`${currentColTitle}\\``);\n  }\n  lines.push('');\n\n  // List columns explicitly so the AI knows the exact names to use\n  lines.push('### Colonnes disponibles (noms exacts à utiliser) :');\n  for (const col of sortedColumns) {\n    const cardCount = col.cards.length;\n    const isCurrent = card && col.cards.some(c => c.id === cardId);\n    lines.push(`- \\`${col.title}\\` (${cardCount} carte${cardCount !== 1 ? 's' : ''})${isCurrent ? ' ← **colonne actuelle**' : ''}`);\n  }\n  lines.push('');\n\n  // Inject existing comments\n  if (card) {\n    const comments = (card.history ?? []).filter(e => e.type === 'comment');\n    if (comments.length > 0) {\n      lines.push('### Commentaires existants sur cette carte :');\n      lines.push('');\n      for (const c of comments.slice(-20)) { // Last 20 comments max\n        const who = c.author === 'ai' ? 'AI' : 'Utilisateur';\n        const date = new Date(c.timestamp).toLocaleString('fr-FR', { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit' });\n        lines.push(`- **${who}** (${date}) : ${c.detail}`);\n      }\n      lines.push('');\n    }\n  }\n\n  lines.push('### Outils Kanban disponibles');\n  lines.push('');\n  lines.push(`- **boardId** (à passer dans tous les outils) : \\`${board.id}\\``);\n  if (card) lines.push(`- **cardId** (carte actuelle) : \\`${card.id}\\``);\n  lines.push('');\n  lines.push('Tu disposes des outils suivants pour interagir avec le board :');\n  lines.push('- `kanban_move_card(boardId, cardId, targetColumn)` — Déplacer la carte vers une autre colonne');\n  lines.push('- `kanban_add_comment(boardId, cardId, comment)` — Ajouter un commentaire sur la carte');\n  lines.push('');\n  lines.push('### OBLIGATOIRE — Décision Kanban');\n  lines.push('');\n  lines.push('À chaque réponse, tu DOIS obligatoirement faire les deux actions suivantes :');\n  lines.push('');\n  lines.push('**1. Évaluer et déplacer la carte si nécessaire** via `kanban_move_card` :');\n  lines.push('   - **Au début** si tu sais déjà que tu vas travailler activement (ex. tu passes en `In progress`).');\n  lines.push('   - **À la fin** pour une décision forte après analyse complète (ex. tu conclus que c\\'est `Done`).');\n  lines.push('   - Si tu ne fais qu\\'analyser ou poser des questions → **ne pas déplacer**.');\n  lines.push('');\n  lines.push('   > ⚠️ **CRITIQUE** : En fin de réponse, tu DOIS TOUJOURS évaluer si la colonne actuelle est encore correcte.');\n  lines.push('');\n  lines.push('**2. Appeler `kanban_add_comment`** résumant ce que tu as fait ou constaté (**à la fin** de ta réponse).');\n  lines.push('');\n  lines.push('> 🚫 **INTERDIT** : Terminer une réponse sans appeler `kanban_add_comment`. C\\'est non négociable.');\n  lines.push('');\n\n  return lines.join('\\n');\n}\n\n// ─── Board-level populate prompt ─────────────────────────────────────────────\n\nexport function generateKanbanPopulatePrompt(board: KanbanBoard): string {\n  const lines: string[] = [];\n  lines.push('## Kanban Board — Mode Populate');\n  lines.push('');\n  lines.push(`Tu es en mode **populate** sur le tableau Kanban **\"${board.name}\"**.`);\n  lines.push('Tu es un outil de gestion de projet. Quand l\\'utilisateur dit \"créer une card\", \"ajouter une tâche\", \"créer une carte\", ou toute demande similaire, il parle EXCLUSIVEMENT d\\'une carte Kanban à ajouter au tableau — PAS d\\'un composant UI, PAS de code HTML ou CSS, PAS d\\'un composant React/Vue/Angular.');\n  lines.push('');\n  lines.push('Ton UNIQUE rôle est de créer des cartes Kanban pertinentes en réponse à la demande de l\\'utilisateur.');\n  lines.push('Tu ne dois PAS répondre à la question, ni donner d\\'explication, ni écrire du code, ni montrer de composant.');\n  lines.push('Tu dois UNIQUEMENT produire des tags XML `<kanban_add_card>` pour créer des cartes dans le tableau.');\n  if (board.description) {\n    lines.push('');\n    lines.push(`Description du board : ${board.description}`);\n  }\n  lines.push('');\n\n  const sortedCols = [...board.columns].sort((a, b) => a.order - b.order);\n\n  lines.push('### Colonnes existantes (noms exacts à utiliser) :');\n  for (const col of sortedCols) {\n    const cardCount = col.cards.length;\n    lines.push(`- \\`${col.title}\\` (${cardCount} carte${cardCount !== 1 ? 's' : ''})`);\n    for (const card of col.cards) {\n      lines.push(`  - ${card.title}`);\n    }\n  }\n  lines.push('');\n\n  lines.push('### Outil disponible');\n  lines.push('');\n  lines.push(`- **boardId** (à passer dans tous les outils) : \\`${board.id}\\``);\n  lines.push('');\n  lines.push('Pour chaque carte à créer, appelle l\\'outil `kanban_add_card(boardId, column, title, content)` :');\n  lines.push('- `column` : nom exact de la colonne cible');\n  lines.push('- `title` : titre concis de la carte');\n  lines.push('- `content` : contenu markdown détaillé et actionnable');\n  lines.push('');\n  lines.push('### Règles STRICTES');\n  lines.push('');\n  lines.push('1. **NE RÉPONDS PAS** à la question de l\\'utilisateur. Ne donne aucune explication, aucun texte libre.');\n  lines.push('2. **Appelle uniquement** `kanban_add_card`, rien d\\'autre.');\n  lines.push('3. Tu ne peux PAS créer de nouvelles colonnes. Dispatch les cartes dans les colonnes existantes listées ci-dessus.');\n  lines.push('4. Utilise les noms **exacts** des colonnes.');\n  lines.push('5. Chaque carte doit avoir un titre concis et un contenu markdown détaillé et actionnable.');\n  lines.push('6. Décompose la demande de l\\'utilisateur en tâches concrètes, chacune étant une carte.');\n  lines.push('7. Dispatch chaque carte dans la colonne la plus appropriée selon sa nature.');\n  lines.push('');\n\n  return lines.join('\\n');\n}\n","import { randomUUID } from 'node:crypto';\nimport { EventEmitter } from 'node:events';\nimport { readFile, writeFile, rename, mkdir, chmod } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { env } from '../config/env.js';\nimport { encryptValue, decryptValue } from './crypto-helpers.js';\nimport type { KanbanBoard, CreateKanbanBoardInput, UpdateKanbanBoardInput } from '@runeya/packages-shared';\n\nexport type KanbanChangeEvent =\n  | { type: 'created'; board: KanbanBoard }\n  | { type: 'updated'; board: KanbanBoard }\n  | { type: 'deleted'; id: string };\n\nconst FILENAME = 'kanban.private.json.enc';\n\nclass KanbanStore {\n  private boards: Map<string, KanbanBoard> = new Map();\n  private loaded = false;\n  private readonly events = new EventEmitter();\n  private saveTimer: ReturnType<typeof setTimeout> | null = null;\n\n  private getFilePath(): string {\n    return join(env.DATA_DIR, FILENAME);\n  }\n\n  private async ensureDir(): Promise<void> {\n    await mkdir(env.DATA_DIR, { recursive: true });\n  }\n\n  private async load(): Promise<void> {\n    if (this.loaded) return;\n    try {\n      const encrypted = await readFile(this.getFilePath(), 'utf-8');\n      const raw = decryptValue(encrypted);\n      const data: KanbanBoard[] = JSON.parse(raw);\n      for (const b of data) {\n        this.boards.set(b.id, b);\n      }\n    } catch {\n      // File doesn't exist yet or decryption failed, start empty\n    }\n    this.loaded = true;\n  }\n\n  private async saveNow(): Promise<void> {\n    await this.ensureDir();\n    const filePath = this.getFilePath();\n    const tmpPath = filePath + '.tmp';\n    const json = JSON.stringify(Array.from(this.boards.values()), null, 2);\n    const encrypted = encryptValue(json);\n    await writeFile(tmpPath, encrypted, 'utf-8');\n    await rename(tmpPath, filePath);\n    await chmod(filePath, 0o600);\n  }\n\n  private save(): void {\n    if (this.saveTimer) clearTimeout(this.saveTimer);\n    this.saveTimer = setTimeout(() => {\n      this.saveNow().catch((err) => {\n        console.error('[kanban-store] save failed:', err);\n      });\n    }, 200);\n  }\n\n  async list(includeArchived = false): Promise<KanbanBoard[]> {\n    await this.load();\n    const all = Array.from(this.boards.values());\n    return includeArchived ? all : all.filter(b => !b.archived);\n  }\n\n  async get(id: string): Promise<KanbanBoard | null> {\n    await this.load();\n    return this.boards.get(id) ?? null;\n  }\n\n  async create(input: CreateKanbanBoardInput): Promise<KanbanBoard> {\n    await this.load();\n    const now = new Date().toISOString();\n    const board: KanbanBoard = {\n      id: randomUUID(),\n      name: input.name,\n      description: input.description ?? '',\n      columns: [],\n      archived: false,\n      createdAt: now,\n      updatedAt: now,\n    };\n    this.boards.set(board.id, board);\n    this.save();\n    this.events.emit('changed', { type: 'created', board } as KanbanChangeEvent);\n    return board;\n  }\n\n  async update(input: UpdateKanbanBoardInput): Promise<KanbanBoard | null> {\n    await this.load();\n    const existing = this.boards.get(input.id);\n    if (!existing) return null;\n    const updated: KanbanBoard = {\n      ...existing,\n      ...(input.name !== undefined && { name: input.name }),\n      ...(input.description !== undefined && { description: input.description }),\n      ...(input.columns !== undefined && { columns: input.columns }),\n      ...(input.archived !== undefined && { archived: input.archived }),\n      updatedAt: new Date().toISOString(),\n    };\n    this.boards.set(input.id, updated);\n    this.save();\n    this.events.emit('changed', { type: 'updated', board: updated } as KanbanChangeEvent);\n    return updated;\n  }\n\n  async delete(id: string): Promise<boolean> {\n    await this.load();\n    if (!this.boards.has(id)) return false;\n    this.boards.delete(id);\n    this.save();\n    this.events.emit('changed', { type: 'deleted', id } as KanbanChangeEvent);\n    return true;\n  }\n\n  onChanged(handler: (event: KanbanChangeEvent) => void): void {\n    this.events.on('changed', handler);\n  }\n\n  offChanged(handler: (event: KanbanChangeEvent) => void): void {\n    this.events.off('changed', handler);\n  }\n}\n\nexport const kanbanStore = new KanbanStore();\n"],"mappings":";;;;;;;AAAA,SAAS,cAAAA,mBAAkB;ACA3B,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,UAAU,WAAW,QAAQ,OAAO,aAAa;AAC1D,SAAS,YAAY;AAUrB,IAAM,WAAW;AAEjB,IAAM,cAAN,MAAkB;EACR,SAAmC,oBAAI,IAAI;EAC3C,SAAS;EACA,SAAS,IAAI,aAAa;EACnC,YAAkD;EAElD,cAAsB;AAC5B,WAAO,KAAK,IAAI,UAAU,QAAQ;EACpC;EAEA,MAAc,YAA2B;AACvC,UAAM,MAAM,IAAI,UAAU,EAAE,WAAW,KAAK,CAAC;EAC/C;EAEA,MAAc,OAAsB;AAClC,QAAI,KAAK,OAAQ;AACjB,QAAI;AACF,YAAM,YAAY,MAAM,SAAS,KAAK,YAAY,GAAG,OAAO;AAC5D,YAAM,MAAM,aAAa,SAAS;AAClC,YAAM,OAAsB,KAAK,MAAM,GAAG;AAC1C,iBAAW,KAAK,MAAM;AACpB,aAAK,OAAO,IAAI,EAAE,IAAI,CAAC;MACzB;IACF,QAAQ;IAER;AACA,SAAK,SAAS;EAChB;EAEA,MAAc,UAAyB;AACrC,UAAM,KAAK,UAAU;AACrB,UAAM,WAAW,KAAK,YAAY;AAClC,UAAM,UAAU,WAAW;AAC3B,UAAM,OAAO,KAAK,UAAU,MAAM,KAAK,KAAK,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;AACrE,UAAM,YAAY,aAAa,IAAI;AACnC,UAAM,UAAU,SAAS,WAAW,OAAO;AAC3C,UAAM,OAAO,SAAS,QAAQ;AAC9B,UAAM,MAAM,UAAU,GAAK;EAC7B;EAEQ,OAAa;AACnB,QAAI,KAAK,UAAW,cAAa,KAAK,SAAS;AAC/C,SAAK,YAAY,WAAW,MAAM;AAChC,WAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC5B,gBAAQ,MAAM,+BAA+B,GAAG;MAClD,CAAC;IACH,GAAG,GAAG;EACR;EAEA,MAAM,KAAK,kBAAkB,OAA+B;AAC1D,UAAM,KAAK,KAAK;AAChB,UAAM,MAAM,MAAM,KAAK,KAAK,OAAO,OAAO,CAAC;AAC3C,WAAO,kBAAkB,MAAM,IAAI,OAAO,CAAA,MAAK,CAAC,EAAE,QAAQ;EAC5D;EAEA,MAAM,IAAI,IAAyC;AACjD,UAAM,KAAK,KAAK;AAChB,WAAO,KAAK,OAAO,IAAI,EAAE,KAAK;EAChC;EAEA,MAAM,OAAO,OAAqD;AAChE,UAAM,KAAK,KAAK;AAChB,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,QAAqB;MACzB,IAAI,WAAW;MACf,MAAM,MAAM;MACZ,aAAa,MAAM,eAAe;MAClC,SAAS,CAAC;MACV,UAAU;MACV,WAAW;MACX,WAAW;IACb;AACA,SAAK,OAAO,IAAI,MAAM,IAAI,KAAK;AAC/B,SAAK,KAAK;AACV,SAAK,OAAO,KAAK,WAAW,EAAE,MAAM,WAAW,MAAM,CAAsB;AAC3E,WAAO;EACT;EAEA,MAAM,OAAO,OAA4D;AACvE,UAAM,KAAK,KAAK;AAChB,UAAM,WAAW,KAAK,OAAO,IAAI,MAAM,EAAE;AACzC,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,UAAuB;MAC3B,GAAG;MACH,GAAI,MAAM,SAAS,UAAa,EAAE,MAAM,MAAM,KAAK;MACnD,GAAI,MAAM,gBAAgB,UAAa,EAAE,aAAa,MAAM,YAAY;MACxE,GAAI,MAAM,YAAY,UAAa,EAAE,SAAS,MAAM,QAAQ;MAC5D,GAAI,MAAM,aAAa,UAAa,EAAE,UAAU,MAAM,SAAS;MAC/D,YAAW,oBAAI,KAAK,GAAE,YAAY;IACpC;AACA,SAAK,OAAO,IAAI,MAAM,IAAI,OAAO;AACjC,SAAK,KAAK;AACV,SAAK,OAAO,KAAK,WAAW,EAAE,MAAM,WAAW,OAAO,QAAQ,CAAsB;AACpF,WAAO;EACT;EAEA,MAAM,OAAO,IAA8B;AACzC,UAAM,KAAK,KAAK;AAChB,QAAI,CAAC,KAAK,OAAO,IAAI,EAAE,EAAG,QAAO;AACjC,SAAK,OAAO,OAAO,EAAE;AACrB,SAAK,KAAK;AACV,SAAK,OAAO,KAAK,WAAW,EAAE,MAAM,WAAW,GAAG,CAAsB;AACxE,WAAO;EACT;EAEA,UAAU,SAAmD;AAC3D,SAAK,OAAO,GAAG,WAAW,OAAO;EACnC;EAEA,WAAW,SAAmD;AAC5D,SAAK,OAAO,IAAI,WAAW,OAAO;EACpC;AACF;AAEO,IAAM,cAAc,IAAI,YAAY;AD/D3C,eAAsB,sBACpB,SACA,QACA,UACA,gBACe;AACf,MAAI,SAAS,WAAW,EAAG;AAI3B,MAAI,QAAQ,MAAM,YAAY,IAAI,OAAO;AACzC,MAAI,CAAC,OAAO;AACV,YAAQ,KAAK,2BAA2B,OAAO,wBAAwB,SAAS,MAAM,aAAa;AACnG;EACF;AAGA,QAAM,oBAAoB,MAAM,MAAO,QAAQ,KAAK,CAAA,QAAO,IAAI,MAAM,KAAK,CAAA,MAAK,EAAE,OAAO,MAAM,CAAC;AAC/F,MAAI,CAAC,kBAAkB,GAAG;AACxB,aAAS,UAAU,GAAG,WAAW,GAAG,WAAW;AAC7C,cAAQ,KAAK,0BAA0B,MAAM,8BAA8B,OAAO,OAAO;AACzF,YAAM,IAAI,QAAQ,CAAA,MAAK,WAAW,GAAG,MAAM,OAAO,CAAC;AACnD,cAAQ,MAAM,YAAY,IAAI,OAAO;AACrC,UAAI,CAAC,MAAO;AACZ,UAAI,kBAAkB,EAAG;IAC3B;AACA,QAAI,CAAC,kBAAkB,GAAG;AACxB,cAAQ,MAAM,0BAA0B,MAAM,4CAA4C,SAAS,MAAM,aAAa;AACtH;IACF;EACF;AAEA,aAAW,OAAO,UAAU;AAC1B,QAAI,IAAI,SAAS,eAAe,IAAI,aAAa;AAC/C,YAAM,QAAQ,SAAS,OAAO,QAAQ,IAAI,WAAW;AACrD,UAAI,CAAC,MAAO,SAAQ,KAAK,4CAA4C,MAAM,YAAY,IAAI,WAAW,GAAG;IAC3G,WAAW,IAAI,SAAS,iBAAiB,IAAI,SAAS;AACpD,iBAAW,OAAO,QAAQ,IAAI,SAAS,cAAc;IACvD,WAAW,IAAI,SAAS,cAAc,IAAI,eAAe,IAAI,WAAW;AACtE,sBAAgB,OAAO,IAAI,aAAa,IAAI,WAAW,IAAI,WAAW;IACxE;EACF;AAEA,QAAM,YAAY,OAAO,EAAE,IAAI,MAAM,IAAI,SAAS,MAAM,QAAQ,CAAC;AACnE;AAMA,eAAsB,2BACpB,SACA,UACe;AACf,MAAI,SAAS,WAAW,EAAG;AAE3B,QAAM,QAAQ,MAAM,YAAY,IAAI,OAAO;AAC3C,MAAI,CAAC,MAAO;AAEZ,aAAW,OAAO,UAAU;AAC1B,QAAI,IAAI,SAAS,cAAc,IAAI,eAAe,IAAI,WAAW;AAC/D,sBAAgB,OAAO,IAAI,aAAa,IAAI,WAAW,IAAI,WAAW;IACxE;EACF;AAEA,QAAM,YAAY,OAAO,EAAE,IAAI,MAAM,IAAI,SAAS,MAAM,QAAQ,CAAC;AACnE;AAEA,SAAS,SAAS,OAAoB,QAAgB,gBAAiC;AACrF,MAAI,YAAY;AAChB,MAAI,OAAO;AACX,MAAI,eAAe;AACnB,MAAI,UAAU;AAEd,WAAS,KAAK,GAAG,KAAK,MAAM,QAAQ,QAAQ,MAAM;AAChD,UAAM,MAAM,MAAM,QAAQ,EAAE;AAC5B,UAAM,MAAM,IAAI,MAAM,UAAU,CAAA,MAAK,EAAE,OAAO,MAAM;AACpD,QAAI,QAAQ,IAAI;AACd,kBAAY,IAAI;AAChB,aAAO,IAAI,MAAM,GAAG;AACpB,qBAAe;AACf,gBAAU;AACV;IACF;EACF;AACA,MAAI,CAAC,QAAQ,iBAAiB,GAAI,QAAO;AAEzC,QAAM,YAAY,MAAM,QAAQ;IAC9B,CAAA,MAAK,EAAE,MAAM,YAAY,MAAM,eAAe,YAAY;EAC5D;AACA,MAAI,CAAC,WAAW;AACd,YAAQ,KAAK,oCAAoC,cAAc,2BAA2B,MAAM,QAAQ,IAAI,CAAA,MAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,EAAE;AACtI,WAAO;EACT;AACA,MAAI,UAAU,OAAO,MAAM,QAAQ,YAAY,EAAE,GAAI,QAAO;AAE5D,QAAM,QAAQ,YAAY,EAAE,MAAM,OAAO,SAAS,CAAC;AAEnD,OAAK,QAAQ,UAAU,MAAM;AAC7B,OAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC,OAAK,UAAU,CAAC,GAAI,KAAK,WAAW,CAAC,GAAI;IACvC,MAAM;IACN,YAAW,oBAAI,KAAK,GAAE,YAAY;IAClC,QAAQ,IAAI,SAAS,aAAQ,UAAU,KAAK;IAC5C,QAAQ;EACV,CAAC;AAED,YAAU,MAAM,KAAK,IAAI;AACzB,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAoB,aAAqB,WAAmB,aAA4B;AAC/G,QAAM,MAAM,MAAM,QAAQ,KAAK,CAAA,MAAK,EAAE,MAAM,YAAY,MAAM,YAAY,YAAY,CAAC;AAEvF,MAAI,CAAC,IAAK;AACV,QAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,QAAM,OAAmB;IACvB,IAAIA,YAAW;IACf,OAAO;IACP,UAAU,eAAe;IACzB,QAAQ,CAAC;IACT,OAAO,IAAI,MAAM;IACjB,SAAS,CAAC,EAAE,MAAM,WAAW,WAAW,KAAK,QAAQ,wBAAmB,IAAI,KAAK,IAAI,CAAC;IACtF,WAAW;IACX,WAAW;EACb;AACA,MAAI,MAAM,KAAK,IAAI;AACrB;AAEA,SAAS,WAAW,OAAoB,QAAgB,SAAiB,gBAA+B;AACtG,aAAW,OAAO,MAAM,SAAS;AAC/B,UAAM,OAAO,IAAI,MAAM,KAAK,CAAA,MAAK,EAAE,OAAO,MAAM;AAChD,QAAI,MAAM;AACR,WAAK,UAAU,CAAC,GAAI,KAAK,WAAW,CAAC,GAAI;QACvC,MAAM;QACN,YAAW,oBAAI,KAAK,GAAE,YAAY;QAClC,QAAQ;QACR,QAAQ;QACR,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;MAC7C,CAAC;AACD,WAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC;IACF;EACF;AACF;AAIO,SAAS,2BAA2B,OAAoB,QAAwB;AACrF,MAAI,kBAAkB;AACtB,MAAI,OAAO;AACX,aAAW,OAAO,MAAM,SAAS;AAC/B,UAAM,QAAQ,IAAI,MAAM,KAAK,CAAA,MAAK,EAAE,OAAO,MAAM;AACjD,QAAI,OAAO;AACT,wBAAkB,IAAI;AACtB,aAAO;AACP;IACF;EACF;AAEA,QAAM,gBAAgB,CAAC,GAAG,MAAM,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAEzE,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,yBAAyB;AACpC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,oDAAoD;AAC/D,QAAM,KAAK,iBAAiB,MAAM,IAAI,EAAE;AACxC,MAAI,MAAM;AACR,UAAM,KAAK,iBAAiB,KAAK,KAAK,EAAE;AACxC,UAAM,KAAK,8BAA8B,eAAe,IAAI;EAC9D;AACA,QAAM,KAAK,EAAE;AAGb,QAAM,KAAK,wDAAqD;AAChE,aAAW,OAAO,eAAe;AAC/B,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,YAAY,QAAQ,IAAI,MAAM,KAAK,CAAA,MAAK,EAAE,OAAO,MAAM;AAC7D,UAAM,KAAK,OAAO,IAAI,KAAK,OAAO,SAAS,SAAS,cAAc,IAAI,MAAM,EAAE,IAAI,YAAY,iCAA4B,EAAE,EAAE;EAChI;AACA,QAAM,KAAK,EAAE;AAGb,MAAI,MAAM;AACR,UAAM,YAAY,KAAK,WAAW,CAAC,GAAG,OAAO,CAAA,MAAK,EAAE,SAAS,SAAS;AACtE,QAAI,SAAS,SAAS,GAAG;AACvB,YAAM,KAAK,8CAA8C;AACzD,YAAM,KAAK,EAAE;AACb,iBAAW,KAAK,SAAS,MAAM,GAAG,GAAG;AACnC,cAAM,MAAM,EAAE,WAAW,OAAO,OAAO;AACvC,cAAM,OAAO,IAAI,KAAK,EAAE,SAAS,EAAE,eAAe,SAAS,EAAE,KAAK,WAAW,OAAO,SAAS,MAAM,WAAW,QAAQ,UAAU,CAAC;AACjI,cAAM,KAAK,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,MAAM,EAAE;MACnD;AACA,YAAM,KAAK,EAAE;IACf;EACF;AAEA,QAAM,KAAK,+BAA+B;AAC1C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,wDAAqD,MAAM,EAAE,IAAI;AAC5E,MAAI,KAAM,OAAM,KAAK,qCAAqC,KAAK,EAAE,IAAI;AACrE,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,gEAAgE;AAC3E,QAAM,KAAK,wGAAgG;AAC3G,QAAM,KAAK,6FAAwF;AACnG,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,2CAAmC;AAC9C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,oFAA8E;AACzF,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qFAA4E;AACvF,QAAM,KAAK,+GAAsG;AACjH,QAAM,KAAK,iHAAsG;AACjH,QAAM,KAAK,sFAA+E;AAC1F,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,gIAAgH;AAC3H,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,sHAA0G;AACrH,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,gHAAoG;AAC/G,QAAM,KAAK,EAAE;AAEb,SAAO,MAAM,KAAK,IAAI;AACxB;AAIO,SAAS,6BAA6B,OAA4B;AACvE,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,sCAAiC;AAC5C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,uDAAuD,MAAM,IAAI,MAAM;AAClF,QAAM,KAAK,4TAA+S;AAC1T,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,kHAAuG;AAClH,QAAM,KAAK,sHAA8G;AACzH,QAAM,KAAK,wGAAqG;AAChH,MAAI,MAAM,aAAa;AACrB,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,0BAA0B,MAAM,WAAW,EAAE;EAC1D;AACA,QAAM,KAAK,EAAE;AAEb,QAAM,aAAa,CAAC,GAAG,MAAM,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAEtE,QAAM,KAAK,uDAAoD;AAC/D,aAAW,OAAO,YAAY;AAC5B,UAAM,YAAY,IAAI,MAAM;AAC5B,UAAM,KAAK,OAAO,IAAI,KAAK,OAAO,SAAS,SAAS,cAAc,IAAI,MAAM,EAAE,GAAG;AACjF,eAAW,QAAQ,IAAI,OAAO;AAC5B,YAAM,KAAK,OAAO,KAAK,KAAK,EAAE;IAChC;EACF;AACA,QAAM,KAAK,EAAE;AAEb,QAAM,KAAK,sBAAsB;AACjC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,wDAAqD,MAAM,EAAE,IAAI;AAC5E,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,uGAAkG;AAC7G,QAAM,KAAK,4CAA4C;AACvD,QAAM,KAAK,sCAAsC;AACjD,QAAM,KAAK,8DAAwD;AACnE,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,wBAAqB;AAChC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,6GAAwG;AACnH,QAAM,KAAK,4DAA6D;AACxE,QAAM,KAAK,0HAAoH;AAC/H,QAAM,KAAK,8CAA8C;AACzD,QAAM,KAAK,kGAA4F;AACvG,QAAM,KAAK,oGAAyF;AACpG,QAAM,KAAK,iFAA8E;AACzF,QAAM,KAAK,EAAE;AAEb,SAAO,MAAM,KAAK,IAAI;AACxB;","names":["randomUUID"]}

package/dist/chunk-ERJIU7R4.js

@@ -0,0 +1,195 @@
+// ../server/dist/chunk-ECCOVHDM.js
+import { z } from "zod";
+import { createHash } from "crypto";
+import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
+var effectivePortStr = process.env.RUNEYA_HTTP_PORT ?? process.env.PORT;
+var serverPort = z.coerce.number().int().min(1).max(65535).default(4e3).parse(effectivePortStr);
+var effectiveAgentPortStr = process.env.RUNEYA_AGENT_PORT ?? process.env.AGENT_PORT;
+var defaultAgentPort = effectiveAgentPortStr ? z.coerce.number().int().min(1).max(65535).parse(effectiveAgentPortStr) : serverPort + 1;
+var EnvSchema = z.object({
+  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).optional(),
+  PORT: z.coerce.number().int().min(1).max(65535).default(4e3),
+  HOST: z.string().default("127.0.0.1"),
+  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),
+  RUNEYA_AGENT_HOST: z.string().default("127.0.0.1"),
+  AGENT_BINARY_PATH: z.string().nullable().default(null),
+  DATA_DIR: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().default(".runeya")),
+  CLOUD_URL: z.string().url().nullable().default(null),
+  MODE: z.enum(["local-simple", "cloud"]).default("local-simple"),
+  CORS_ORIGIN: z.string().nullable().default(null),
+  RUNEYA_LAN_PROXY: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false)
+}).transform((data) => ({
+  ...data,
+  // RUNEYA_HTTP_PORT takes priority over PORT
+  PORT: data.RUNEYA_HTTP_PORT ?? data.PORT
+}));
+var env = EnvSchema.parse(process.env);
+var KEY_SIZE_BYTES = 32;
+var cachedKey = null;
+var _ciMode = false;
+var _pendingLegacyKey = null;
+function isCiMode() {
+  return _ciMode;
+}
+async function loadFromEnv() {
+  const keyHex = process.env["RUNEYA_ENCRYPTION_KEY"];
+  if (!keyHex) return false;
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {
+    throw new Error("RUNEYA_ENCRYPTION_KEY invalide : attendu 64 caract\xE8res hex");
+  }
+  console.log("");
+  console.log("\u26A0 ATTENTION : RUNEYA_ENCRYPTION_KEY est d\xE9fini \u2014 l'authentification par master password est d\xE9sactiv\xE9e.");
+  console.log("  Cette variable d'environnement est r\xE9serv\xE9e aux environnements CI/CD.");
+  console.log("  Ne la d\xE9finissez jamais sur une machine de d\xE9veloppement.");
+  console.log("");
+  cachedKey = Buffer.from(keyHex, "hex");
+  _ciMode = true;
+  return true;
+}
+function setPendingLegacyKey(key) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  _pendingLegacyKey = key;
+}
+function getPendingLegacyKey() {
+  return _pendingLegacyKey;
+}
+function clearPendingLegacyKey() {
+  _pendingLegacyKey = null;
+}
+function hasPendingLegacyKey() {
+  return _pendingLegacyKey !== null;
+}
+function setEncryptionKeyInMemory(key) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  cachedKey = key;
+}
+function clearEncryptionKey() {
+  cachedKey = null;
+}
+function hasEncryptionKey() {
+  return cachedKey !== null;
+}
+function getEncryptionKey() {
+  return cachedKey;
+}
+function deriveStableSecret(purpose) {
+  const key = getEncryptionKey();
+  if (!key) return null;
+  return createHash("sha256").update(key).update(purpose).digest("hex");
+}
+async function ensureEncryptionKey() {
+  return cachedKey;
+}
+async function setEncryptionKey(keyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error("Invalid key format");
+  cachedKey = Buffer.from(keyHex, "hex");
+}
+var ALGORITHM = "aes-256-gcm";
+function encryptValue(plaintext) {
+  const maybeKey = getEncryptionKey();
+  if (!maybeKey) {
+    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
+  }
+  const key = maybeKey;
+  const iv = randomBytes(16);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  let enc = cipher.update(plaintext, "utf-8", "hex");
+  enc += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${enc}`;
+}
+function decryptValue(encrypted) {
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
+  const [ivHex, authTagHex, ciphertext] = parts;
+  if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
+    throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
+  }
+  const maybeKey = getEncryptionKey();
+  if (!maybeKey) {
+    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
+  }
+  const key = maybeKey;
+  const iv = Buffer.from(ivHex, "hex");
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: 16 });
+  decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
+  let dec = decipher.update(ciphertext, "hex", "utf-8");
+  dec += decipher.final("utf-8");
+  return dec;
+}
+function stableEncryptValue(plaintext, existingEncrypted) {
+  if (existingEncrypted) {
+    try {
+      if (decryptValue(existingEncrypted) === plaintext) return existingEncrypted;
+    } catch {
+    }
+  }
+  return encryptValue(plaintext);
+}
+function encryptVariableSlots(variables, existingEncrypted) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) } };
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function decryptVariableSlots(variables, contextLabel) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      try {
+        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };
+      } catch (err) {
+        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message}`);
+        result[key] = { ...variable, value: { ...slot, value: "" } };
+      }
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function extractEncryptedVariableSlots(variables) {
+  const slots = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    if (variable.value?.isSecret && variable.value?.value) {
+      slots[key] = variable.value.value;
+    }
+  }
+  return slots;
+}
+function isEncryptedValue(s) {
+  const parts = s.split(":");
+  return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);
+}
+
+export {
+  env,
+  isCiMode,
+  loadFromEnv,
+  setPendingLegacyKey,
+  getPendingLegacyKey,
+  clearPendingLegacyKey,
+  hasPendingLegacyKey,
+  setEncryptionKeyInMemory,
+  clearEncryptionKey,
+  hasEncryptionKey,
+  getEncryptionKey,
+  deriveStableSecret,
+  ensureEncryptionKey,
+  setEncryptionKey,
+  encryptValue,
+  decryptValue,
+  stableEncryptValue,
+  encryptVariableSlots,
+  decryptVariableSlots,
+  extractEncryptedVariableSlots,
+  isEncryptedValue
+};
+//# sourceMappingURL=chunk-ERJIU7R4.js.map

package/dist/chunk-ERJIU7R4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../server/src/config/env.ts","../../server/src/utils/encryption-key.ts","../../server/src/services/crypto-helpers.ts"],"sourcesContent":["import { z } from 'zod';\n\n// RUNEYA_HTTP_PORT takes priority over PORT for RUNEYA_AGENT_PORT default derivation\nconst effectivePortStr = process.env.RUNEYA_HTTP_PORT ?? process.env.PORT;\nconst serverPort = z.coerce.number().int().min(1).max(65535).default(4000).parse(effectivePortStr);\n\n// RUNEYA_AGENT_PORT takes priority over AGENT_PORT (legacy alias used by e2e test-server)\nconst effectiveAgentPortStr = process.env.RUNEYA_AGENT_PORT ?? process.env.AGENT_PORT;\nconst defaultAgentPort = effectiveAgentPortStr\n  ? z.coerce.number().int().min(1).max(65535).parse(effectiveAgentPortStr)\n  : serverPort + 1;\n\nconst EnvSchema = z.object({\n  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).optional(),\n  PORT: z.coerce.number().int().min(1).max(65535).default(4000),\n  HOST: z.string().default('127.0.0.1'),\n  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),\n  RUNEYA_AGENT_HOST: z.string().default('127.0.0.1'),\n  AGENT_BINARY_PATH: z.string().nullable().default(null),\n  DATA_DIR: z.preprocess((v) => (typeof v === 'string' && v.length > 0 ? v : undefined), z.string().default('.runeya')),\n  CLOUD_URL: z.string().url().nullable().default(null),\n  MODE: z.enum(['local-simple', 'cloud']).default('local-simple'),\n  CORS_ORIGIN: z.string().nullable().default(null),\n  RUNEYA_LAN_PROXY: z.preprocess((v) => v === 'true' || v === '1', z.boolean()).default(false),\n}).transform((data) => ({\n  ...data,\n  // RUNEYA_HTTP_PORT takes priority over PORT\n  PORT: data.RUNEYA_HTTP_PORT ?? data.PORT,\n}));\n\nexport type Env = z.infer<typeof EnvSchema>;\n\nexport const env = EnvSchema.parse(process.env);\n","import { createHash } from 'node:crypto';\n\nconst KEY_SIZE_BYTES = 32;\n\nlet cachedKey: Buffer | null = null;\nlet _ciMode = false;\n\n// Pending legacy key holder — kept in memory between migration and setup\nlet _pendingLegacyKey: Buffer | null = null;\n\n/** True only when the key was loaded from RUNEYA_ENCRYPTION_KEY (CI/CD — no JWT required). */\nexport function isCiMode(): boolean {\n  return _ciMode;\n}\n\n/** Load encryption key from env var (CI mode) */\nexport async function loadFromEnv(): Promise<boolean> {\n  const keyHex = process.env['RUNEYA_ENCRYPTION_KEY'];\n  if (!keyHex) return false;\n  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {\n    throw new Error('RUNEYA_ENCRYPTION_KEY invalide : attendu 64 caractères hex');\n  }\n  console.log('');\n  console.log('⚠ ATTENTION : RUNEYA_ENCRYPTION_KEY est défini — l\\'authentification par master password est désactivée.');\n  console.log('  Cette variable d\\'environnement est réservée aux environnements CI/CD.');\n  console.log('  Ne la définissez jamais sur une machine de développement.');\n  console.log('');\n  cachedKey = Buffer.from(keyHex, 'hex');\n  _ciMode = true;\n  return true;\n}\n\n// ── Pending legacy key holder ──────────────────────────────────────────────\n// After legacy migration, the libsodium key is stored here (NOT in the main\n// singleton) so that hasEncryptionKey() returns false → server state = setup.\n// The key is consumed by /api/setup to write .encryption.key.enc.\n\nexport function setPendingLegacyKey(key: Buffer): void {\n  if (key.length !== KEY_SIZE_BYTES) throw new Error('Taille de clé invalide');\n  _pendingLegacyKey = key;\n}\n\nexport function getPendingLegacyKey(): Buffer | null {\n  return _pendingLegacyKey;\n}\n\nexport function clearPendingLegacyKey(): void {\n  _pendingLegacyKey = null;\n}\n\nexport function hasPendingLegacyKey(): boolean {\n  return _pendingLegacyKey !== null;\n}\n\n/** Set the encryption key in memory (called after successful unlock/setup) */\nexport function setEncryptionKeyInMemory(key: Buffer): void {\n  if (key.length !== KEY_SIZE_BYTES) throw new Error('Taille de clé invalide');\n  cachedKey = key;\n}\n\n/** Clear the cached key (lock) */\nexport function clearEncryptionKey(): void {\n  cachedKey = null;\n}\n\nexport function hasEncryptionKey(): boolean {\n  return cachedKey !== null;\n}\n\nexport function getEncryptionKey(): Buffer | null {\n  return cachedKey;\n}\n\nexport function deriveStableSecret(purpose: string): string | null {\n  const key = getEncryptionKey();\n  if (!key) return null;\n  return createHash('sha256').update(key).update(purpose).digest('hex');\n}\n\n// Legacy compat: ensureEncryptionKey for code that still calls it\n// Returns null if key not loaded yet (LOCKED/SETUP state)\nexport async function ensureEncryptionKey(): Promise<Buffer | null> {\n  return cachedKey;\n}\n\n// Legacy compat: setEncryptionKey (used by old setup router)\nexport async function setEncryptionKey(keyHex: string): Promise<void> {\n  if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error('Invalid key format');\n  cachedKey = Buffer.from(keyHex, 'hex');\n}\n","import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';\nimport { getEncryptionKey } from '../utils/encryption-key.js';\nimport type { VariableSlot } from '@runeya/packages-shared';\n\nconst ALGORITHM = 'aes-256-gcm';\n\nexport function encryptValue(plaintext: string): string {\n  const maybeKey = getEncryptionKey();\n  if (!maybeKey) {\n    throw new Error('Encryption key not loaded — please provide the key via setup UI');\n  }\n  const key: Buffer = maybeKey;\n  const iv = randomBytes(16);\n  const cipher = createCipheriv(ALGORITHM, key, iv);\n  let enc = cipher.update(plaintext, 'utf-8', 'hex');\n  enc += cipher.final('hex');\n  const authTag = cipher.getAuthTag().toString('hex');\n  return `${iv.toString('hex')}:${authTag}:${enc}`;\n}\n\nexport function decryptValue(encrypted: string): string {\n  const parts = encrypted.split(':');\n  if (parts.length !== 3) throw new Error('Invalid encrypted value format — expected iv:authTag:ciphertext');\n  const [ivHex, authTagHex, ciphertext] = parts;\n  if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || (ciphertext !== '' && !/^[0-9a-f]+$/i.test(ciphertext))) {\n    throw new Error('Invalid hex in encrypted value — possible data corruption');\n  }\n  const maybeKey = getEncryptionKey();\n  if (!maybeKey) {\n    throw new Error('Encryption key not loaded — please provide the key via setup UI');\n  }\n  const key: Buffer = maybeKey;\n  const iv = Buffer.from(ivHex, 'hex');\n  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: 16 });\n  decipher.setAuthTag(Buffer.from(authTagHex, 'hex'));\n  let dec = decipher.update(ciphertext, 'hex', 'utf-8');\n  dec += decipher.final('utf-8');\n  return dec;\n}\n\n/** Reuse existing ciphertext if plaintext is unchanged — keeps diffs stable */\nexport function stableEncryptValue(plaintext: string, existingEncrypted?: string): string {\n  if (existingEncrypted) {\n    try {\n      if (decryptValue(existingEncrypted) === plaintext) return existingEncrypted;\n    } catch {\n      // Existing value is corrupt — fall through to re-encrypt\n    }\n  }\n  return encryptValue(plaintext);\n}\n\n/** Encrypt secret VariableSlot values in a flat slots record (overrides) */\nfunction encryptSlots(\n  slots: Record<string, VariableSlot>,\n  existingEncrypted?: Record<string, string>,\n): Record<string, VariableSlot> {\n  const result: Record<string, VariableSlot> = {};\n  for (const [key, slot] of Object.entries(slots)) {\n    if (slot.isSecret && slot.value) {\n      result[key] = { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) };\n    } else {\n      result[key] = { ...slot };\n    }\n  }\n  return result;\n}\n\n/** Decrypt secret VariableSlot values in a flat slots record (overrides) */\nfunction decryptSlots(slots: Record<string, VariableSlot>, contextLabel: string): Record<string, VariableSlot> {\n  const result: Record<string, VariableSlot> = {};\n  for (const [key, slot] of Object.entries(slots)) {\n    if (slot.isSecret && slot.value) {\n      try {\n        result[key] = { ...slot, value: decryptValue(slot.value) };\n      } catch (err) {\n        console.error(`[crypto-helpers] Failed to decrypt \"${key}\" for ${contextLabel}: ${(err as Error).message}`);\n        result[key] = { ...slot, value: '' };\n      }\n    } else {\n      result[key] = { ...slot };\n    }\n  }\n  return result;\n}\n\ntype HasValueSlot = { value: VariableSlot; [k: string]: unknown };\n\n/** Encrypt secret Variable.value slots (environment variables — {value: VariableSlot}) */\nexport function encryptVariableSlots(\n  variables: Record<string, HasValueSlot>,\n  existingEncrypted?: Record<string, string>,\n): Record<string, HasValueSlot> {\n  const result: Record<string, HasValueSlot> = {};\n  for (const [key, variable] of Object.entries(variables)) {\n    const slot = variable.value;\n    if (slot.isSecret && slot.value) {\n      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) } };\n    } else {\n      result[key] = { ...variable, value: { ...slot } };\n    }\n  }\n  return result;\n}\n\n/** Decrypt secret Variable.value slots (environment variables) */\nexport function decryptVariableSlots(\n  variables: Record<string, HasValueSlot>,\n  contextLabel: string,\n): Record<string, HasValueSlot> {\n  const result: Record<string, HasValueSlot> = {};\n  for (const [key, variable] of Object.entries(variables)) {\n    const slot = variable.value;\n    if (slot.isSecret && slot.value) {\n      try {\n        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };\n      } catch (err) {\n        console.error(`[crypto-helpers] Failed to decrypt variable \"${key}\" for ${contextLabel}: ${(err as Error).message}`);\n        result[key] = { ...variable, value: { ...slot, value: '' } };\n      }\n    } else {\n      result[key] = { ...variable, value: { ...slot } };\n    }\n  }\n  return result;\n}\n\n/** Extract encrypted slot values from Variable records (for stable-encrypt cache) */\nexport function extractEncryptedVariableSlots(\n  variables: Record<string, HasValueSlot>,\n): Record<string, string> {\n  const slots: Record<string, string> = {};\n  for (const [key, variable] of Object.entries(variables)) {\n    if (variable.value?.isSecret && variable.value?.value) {\n      slots[key] = variable.value.value;\n    }\n  }\n  return slots;\n}\n\n/**\n * Returns true if `s` looks like a value encrypted by `encryptValue()`.\n * Format: `<32hex>:<32hex>:<Nhex>` (iv:authTag:ciphertext).\n */\nexport function isEncryptedValue(s: string): boolean {\n  const parts = s.split(':');\n  return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);\n}\n\n/** Extract encrypted slot values from VariableSlot records (for stable-encrypt cache) */\nfunction extractEncryptedSlots(\n  slots: Record<string, VariableSlot>,\n): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const [key, slot] of Object.entries(slots)) {\n    if (slot.isSecret && slot.value) result[key] = slot.value;\n  }\n  return result;\n}\n"],"mappings":";AAAA,SAAS,SAAS;ACAlB,SAAS,kBAAkB;ACA3B,SAAS,aAAa,gBAAgB,wBAAwB;AFG9D,IAAM,mBAAmB,QAAQ,IAAI,oBAAoB,QAAQ,IAAI;AACrE,IAAM,aAAa,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI,EAAE,MAAM,gBAAgB;AAGjG,IAAM,wBAAwB,QAAQ,IAAI,qBAAqB,QAAQ,IAAI;AAC3E,IAAM,mBAAmB,wBACrB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,MAAM,qBAAqB,IACrE,aAAa;AAEjB,IAAM,YAAY,EAAE,OAAO;EACzB,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS;EACrE,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;EAC5D,MAAM,EAAE,OAAO,EAAE,QAAQ,WAAW;EACpC,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,gBAAgB;EACrF,mBAAmB,EAAE,OAAO,EAAE,QAAQ,WAAW;EACjD,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;EACrD,UAAU,EAAE,WAAW,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI,IAAI,QAAY,EAAE,OAAO,EAAE,QAAQ,SAAS,CAAC;EACpH,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;EACnD,MAAM,EAAE,KAAK,CAAC,gBAAgB,OAAO,CAAC,EAAE,QAAQ,cAAc;EAC9D,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;EAC/C,kBAAkB,EAAE,WAAW,CAAC,MAAM,MAAM,UAAU,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,KAAK;AAC7F,CAAC,EAAE,UAAU,CAAC,UAAU;EACtB,GAAG;;EAEH,MAAM,KAAK,oBAAoB,KAAK;AACtC,EAAE;AAIK,IAAM,MAAM,UAAU,MAAM,QAAQ,GAAG;AC9B9C,IAAM,iBAAiB;AAEvB,IAAI,YAA2B;AAC/B,IAAI,UAAU;AAGd,IAAI,oBAAmC;AAGhC,SAAS,WAAoB;AAClC,SAAO;AACT;AAGA,eAAsB,cAAgC;AACpD,QAAM,SAAS,QAAQ,IAAI,uBAAuB;AAClD,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,kBAAkB,KAAK,MAAM,GAAG;AACnC,UAAM,IAAI,MAAM,+DAA4D;EAC9E;AACA,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,4HAA0G;AACtH,UAAQ,IAAI,+EAA0E;AACtF,UAAQ,IAAI,mEAA6D;AACzE,UAAQ,IAAI,EAAE;AACd,cAAY,OAAO,KAAK,QAAQ,KAAK;AACrC,YAAU;AACV,SAAO;AACT;AAOO,SAAS,oBAAoB,KAAmB;AACrD,MAAI,IAAI,WAAW,eAAgB,OAAM,IAAI,MAAM,2BAAwB;AAC3E,sBAAoB;AACtB;AAEO,SAAS,sBAAqC;AACnD,SAAO;AACT;AAEO,SAAS,wBAA8B;AAC5C,sBAAoB;AACtB;AAEO,SAAS,sBAA+B;AAC7C,SAAO,sBAAsB;AAC/B;AAGO,SAAS,yBAAyB,KAAmB;AAC1D,MAAI,IAAI,WAAW,eAAgB,OAAM,IAAI,MAAM,2BAAwB;AAC3E,cAAY;AACd;AAGO,SAAS,qBAA2B;AACzC,cAAY;AACd;AAEO,SAAS,mBAA4B;AAC1C,SAAO,cAAc;AACvB;AAEO,SAAS,mBAAkC;AAChD,SAAO;AACT;AAEO,SAAS,mBAAmB,SAAgC;AACjE,QAAM,MAAM,iBAAiB;AAC7B,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACtE;AAIA,eAAsB,sBAA8C;AAClE,SAAO;AACT;AAGA,eAAsB,iBAAiB,QAA+B;AACpE,MAAI,CAAC,kBAAkB,KAAK,MAAM,EAAG,OAAM,IAAI,MAAM,oBAAoB;AACzE,cAAY,OAAO,KAAK,QAAQ,KAAK;AACvC;ACrFA,IAAM,YAAY;AAEX,SAAS,aAAa,WAA2B;AACtD,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,sEAAiE;EACnF;AACA,QAAM,MAAc;AACpB,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAChD,MAAI,MAAM,OAAO,OAAO,WAAW,SAAS,KAAK;AACjD,SAAO,OAAO,MAAM,KAAK;AACzB,QAAM,UAAU,OAAO,WAAW,EAAE,SAAS,KAAK;AAClD,SAAO,GAAG,GAAG,SAAS,KAAK,CAAC,IAAI,OAAO,IAAI,GAAG;AAChD;AAEO,SAAS,aAAa,WAA2B;AACtD,QAAM,QAAQ,UAAU,MAAM,GAAG;AACjC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,sEAAiE;AACzG,QAAM,CAAC,OAAO,YAAY,UAAU,IAAI;AACxC,MAAI,CAAC,eAAe,KAAK,KAAK,KAAK,CAAC,eAAe,KAAK,UAAU,KAAM,eAAe,MAAM,CAAC,eAAe,KAAK,UAAU,GAAI;AAC9H,UAAM,IAAI,MAAM,gEAA2D;EAC7E;AACA,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,sEAAiE;EACnF;AACA,QAAM,MAAc;AACpB,QAAM,KAAK,OAAO,KAAK,OAAO,KAAK;AACnC,QAAM,WAAW,iBAAiB,WAAW,KAAK,IAAI,EAAE,eAAe,GAAG,CAAC;AAC3E,WAAS,WAAW,OAAO,KAAK,YAAY,KAAK,CAAC;AAClD,MAAI,MAAM,SAAS,OAAO,YAAY,OAAO,OAAO;AACpD,SAAO,SAAS,MAAM,OAAO;AAC7B,SAAO;AACT;AAGO,SAAS,mBAAmB,WAAmB,mBAAoC;AACxF,MAAI,mBAAmB;AACrB,QAAI;AACF,UAAI,aAAa,iBAAiB,MAAM,UAAW,QAAO;IAC5D,QAAQ;IAER;EACF;AACA,SAAO,aAAa,SAAS;AAC/B;AAuCO,SAAS,qBACd,WACA,mBAC8B;AAC9B,QAAM,SAAuC,CAAC;AAC9C,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AACvD,UAAM,OAAO,SAAS;AACtB,QAAI,KAAK,YAAY,KAAK,OAAO;AAC/B,aAAO,GAAG,IAAI,EAAE,GAAG,UAAU,OAAO,EAAE,GAAG,MAAM,OAAO,mBAAmB,KAAK,OAAO,oBAAoB,GAAG,CAAC,EAAE,EAAE;IACnH,OAAO;AACL,aAAO,GAAG,IAAI,EAAE,GAAG,UAAU,OAAO,EAAE,GAAG,KAAK,EAAE;IAClD;EACF;AACA,SAAO;AACT;AAGO,SAAS,qBACd,WACA,cAC8B;AAC9B,QAAM,SAAuC,CAAC;AAC9C,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AACvD,UAAM,OAAO,SAAS;AACtB,QAAI,KAAK,YAAY,KAAK,OAAO;AAC/B,UAAI;AACF,eAAO,GAAG,IAAI,EAAE,GAAG,UAAU,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,KAAK,KAAK,EAAE,EAAE;MACnF,SAAS,KAAK;AACZ,gBAAQ,MAAM,gDAAgD,GAAG,SAAS,YAAY,KAAM,IAAc,OAAO,EAAE;AACnH,eAAO,GAAG,IAAI,EAAE,GAAG,UAAU,OAAO,EAAE,GAAG,MAAM,OAAO,GAAG,EAAE;MAC7D;IACF,OAAO;AACL,aAAO,GAAG,IAAI,EAAE,GAAG,UAAU,OAAO,EAAE,GAAG,KAAK,EAAE;IAClD;EACF;AACA,SAAO;AACT;AAGO,SAAS,8BACd,WACwB;AACxB,QAAM,QAAgC,CAAC;AACvC,aAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,SAAS,GAAG;AACvD,QAAI,SAAS,OAAO,YAAY,SAAS,OAAO,OAAO;AACrD,YAAM,GAAG,IAAI,SAAS,MAAM;IAC9B;EACF;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,GAAoB;AACnD,QAAM,QAAQ,EAAE,MAAM,GAAG;AACzB,SAAO,MAAM,WAAW,KAAK,kBAAkB,KAAK,MAAM,CAAC,CAAC,KAAK,kBAAkB,KAAK,MAAM,CAAC,CAAC;AAClG;","names":[]}