@runeya/runeya 2.0.140 → 2.0.141

package/{src-NVQHFMTQ.js → src-ZSQISY6W.js}

@@ -62,10 +62,10 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-G4TOLDZB.js";
+} from "./chunk-36CC5CZK.js";
 import {
   settingsManager
-} from "./chunk-6HSZPK2W.js";
+} from "./chunk-UR3HL373.js";
 import {
   LocalProjectRefusedError,
   activeSessionRegistry,
@@ -87,7 +87,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-QWX6R6AW.js";
+} from "./chunk-H2MAALKN.js";
 import {
   agentManager,
   agentSpawner,
@@ -126,13 +126,13 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-SYCUQDA4.js";
+} from "./chunk-GXE5TLLJ.js";
 import {
   atomicWriteSecure,
   renameWithRetry,
   resolveConversationRunDir,
   sweepStaleTempFiles
-} from "./chunk-GOMF7NWS.js";
+} from "./chunk-7L6AQUBR.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
@@ -196,7 +196,7 @@ import {
   rememberOrgName,
   stampOrgCloud,
   vaultFor
-} from "./chunk-EV3TBM7E.js";
+} from "./chunk-IXO5KIO5.js";
 import {
   decryptValueWith,
   encryptValueWith,
@@ -215,24 +215,74 @@ import { applyWSSHandler } from "@trpc/server/adapters/ws";
 
 // ../server/src/trpc/routers/health.ts
 import os from "os";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+import { z } from "zod";
+
+// ../server/src/services/npm-cli.ts
 import { execFile } from "child_process";
 import { promisify } from "util";
-import { z } from "zod";
+import { existsSync, mkdtempSync, readFileSync, rmdirSync } from "fs";
+import { dirname, isAbsolute, join, relative } from "path";
 var execFileAsync = promisify(execFile);
-async function getDockerVersion() {
+var PACKAGE_NAME = "@runeya/runeya";
+var INSTALL_TIMEOUT_MS = 10 * 6e4;
+function resolveNpm() {
+  const nodeDir = dirname(process.execPath);
+  const candidates = [
+    // Windows (installateur officiel, nvm-windows, volta) : npm est un dossier
+    // frère de node.exe.
+    join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
+    // Unix : node est dans `bin/`, npm sous `lib/node_modules/`.
+    join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+  ];
+  for (const cli2 of candidates) {
+    if (existsSync(cli2)) return { command: process.execPath, args: [cli2], shell: false };
+  }
+  if (process.platform === "win32") {
+    for (const entry of (process.env["PATH"] ?? "").split(";").filter(Boolean)) {
+      const cliCandidates = [
+        join(entry, "node_modules", "npm", "bin", "npm-cli.js"),
+        join(entry, "..", "npm", "bin", "npm-cli.js")
+      ];
+      for (const cli2 of cliCandidates) {
+        if (existsSync(cli2)) return { command: process.execPath, args: [cli2], shell: false };
+      }
+    }
+    throw new Error("Impossible de trouver npm-cli.js dans les emplacements connus du PATH Windows.");
+  }
+  return { command: "npm", args: [], shell: false };
+}
+function npmLabel(npm) {
+  return [npm.command, ...npm.args].join(" ");
+}
+async function probeVersion(npm, args) {
   try {
-    const { stdout } = await execFileAsync("docker", ["--version"], {
-      timeout: 3e3,
-      windowsHide: true
+    const { stdout } = await execFileAsync(npm.command, [...npm.args, ...args], {
+      timeout: 1e4,
+      windowsHide: true,
+      shell: npm.shell
     });
-    const match = /Docker version\s+([^,\s]+)/i.exec(stdout);
-    return match?.[1] ?? (stdout.trim() || null);
+    return stdout.trim().split("\n")[0]?.trim() || null;
   } catch {
     return null;
   }
 }
-var startedAt = Date.now();
-var NPM_LATEST_URL = "https://registry.npmjs.org/@runeya%2Fruneya/latest";
+async function installRuneyaGlobally(npm, prefix) {
+  try {
+    const { stdout, stderr } = await execFileAsync(
+      npm.command,
+      [...npm.args, "install", "-g", "--prefix", prefix, `${PACKAGE_NAME}@latest`],
+      { timeout: INSTALL_TIMEOUT_MS, windowsHide: true, shell: npm.shell, maxBuffer: 10 * 1024 * 1024 }
+    );
+    const installedVersion = await probeVersion(npm, ["view", `${PACKAGE_NAME}`, "version"]);
+    return { ok: true, output: [stdout, stderr].filter(Boolean).join("\n").trim(), installedVersion };
+  } catch (err) {
+    const e = err;
+    const output = [e.stdout, e.stderr, e.message].filter(Boolean).join("\n").trim();
+    return { ok: false, output, installedVersion: null };
+  }
+}
 function compareSemver(a, b) {
   const pa = a.split(".").map((n) => Number.parseInt(n, 10) || 0);
   const pb = b.split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -244,6 +294,68 @@ function compareSemver(a, b) {
   }
   return 0;
 }
+function installedRuneya(prefix, platform = process.platform) {
+  const modules = platform === "win32" ? join(prefix, "node_modules") : join(prefix, "lib", "node_modules");
+  const pkgDir = join(modules, ...PACKAGE_NAME.split("/"));
+  try {
+    const pkg = JSON.parse(readFileSync(join(pkgDir, "package.json"), "utf8"));
+    const bin = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.["runeya"];
+    return bin ? { entry: join(pkgDir, bin), version: pkg.version ?? "0.0.0" } : null;
+  } catch {
+    return null;
+  }
+}
+function globalCliEntry(prefix, platform = process.platform) {
+  return installedRuneya(prefix, platform)?.entry ?? null;
+}
+function userPrefix() {
+  return join(machineRoot(), "npm");
+}
+function isWritable(dir) {
+  let current2 = dir;
+  while (!existsSync(current2)) {
+    const parent = dirname(current2);
+    if (parent === current2) return false;
+    current2 = parent;
+  }
+  try {
+    rmdirSync(mkdtempSync(join(current2, ".runeya-write-test-")));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function installPrefix(globalPrefix, platform = process.platform) {
+  const modules = platform === "win32" ? join(globalPrefix, "node_modules") : join(globalPrefix, "lib", "node_modules");
+  return isWritable(modules) ? globalPrefix : userPrefix();
+}
+function isInside(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function updatePrefix(globalPrefix, runningEntry) {
+  if (isInside(userPrefix(), runningEntry)) return userPrefix();
+  if (!globalPrefix) return null;
+  if (isInside(globalPrefix, runningEntry)) return globalPrefix;
+  return installPrefix(globalPrefix);
+}
+
+// ../server/src/trpc/routers/health.ts
+var execFileAsync2 = promisify2(execFile2);
+async function getDockerVersion() {
+  try {
+    const { stdout } = await execFileAsync2("docker", ["--version"], {
+      timeout: 3e3,
+      windowsHide: true
+    });
+    const match = /Docker version\s+([^,\s]+)/i.exec(stdout);
+    return match?.[1] ?? (stdout.trim() || null);
+  } catch {
+    return null;
+  }
+}
+var startedAt = Date.now();
+var NPM_LATEST_URL = "https://registry.npmjs.org/@runeya%2Fruneya/latest";
 var VERSION_CACHE_MS = 4 * 60 * 1e3;
 var versionCache = null;
 var FORCED_CHECK_FLOOR_MS = 2e3;
@@ -336,48 +448,37 @@ var healthRouter = router({
   })
 });
 
-// ../server/src/trpc/routers/app-update.ts
-import { spawn, execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-import { existsSync } from "fs";
-import { dirname, join } from "path";
+// ../server/src/trpc/routers/session.ts
 import { z as z2 } from "zod";
 import { TRPCError } from "@trpc/server";
-var execFileAsync2 = promisify2(execFile2);
-var PACKAGE_NAME = "@runeya/runeya";
-var INSTALL_TIMEOUT_MS = 10 * 6e4;
-function resolveNpm() {
-  const nodeDir = dirname(process.execPath);
-  const candidates = [
-    // Windows (installateur officiel, nvm-windows, volta) : npm est un dossier
-    // frère de node.exe.
-    join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
-    // Unix : node est dans `bin/`, npm sous `lib/node_modules/`.
-    join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
-  ];
-  for (const cli2 of candidates) {
-    if (existsSync(cli2)) return { command: process.execPath, args: [cli2], shell: false };
-  }
-  return process.platform === "win32" ? { command: "npm.cmd", args: [], shell: true } : { command: "npm", args: [], shell: false };
-}
-function npmLabel(npm) {
-  return [npm.command, ...npm.args].join(" ");
-}
-async function probeVersion(npm, args) {
-  try {
-    const { stdout } = await execFileAsync2(npm.command, [...npm.args, ...args], {
-      timeout: 1e4,
-      windowsHide: true,
-      shell: npm.shell
-    });
-    return stdout.trim().split("\n")[0]?.trim() || null;
-  } catch {
-    return null;
-  }
-}
+var sessionRouter = router({
+  /**
+   * Donne au WebSocket le jeton que l'onglet vient de renouveler.
+   *
+   * Le contexte d'un WebSocket est créé une fois, à la connexion : sans cet
+   * appel, chaque requête passée par la socket présenterait le jeton d'origine
+   * et serait refusée dès qu'il expire.
+   */
+  renewSocket: publicProcedure.input(z2.object({ token: z2.string().min(1).max(4096) })).mutation(async ({ ctx, input }) => {
+    if (!ctx.renewSocketToken) {
+      throw new TRPCError({ code: "BAD_REQUEST", message: "Only available over the WebSocket" });
+    }
+    try {
+      await ctx.renewSocketToken(input.token);
+    } catch {
+      throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
+    }
+    return { ok: true };
+  })
+});
+
+// ../server/src/trpc/routers/app-update.ts
+import { spawn } from "child_process";
+import { z as z3 } from "zod";
+import { TRPCError as TRPCError2 } from "@trpc/server";
 function requireDesktop() {
   if (!env.FROM_DESKTOP) {
-    throw new TRPCError({
+    throw new TRPCError2({
       code: "PRECONDITION_FAILED",
       message: "Update from the app is only available for desktop launches."
     });
@@ -386,19 +487,20 @@ function requireDesktop() {
 var appUpdateRouter = router({
   /** De quoi la mise à jour a besoin, et ce que la machine en offre. */
   prerequisites: publicProcedure.output(
-    z2.object({
-      fromDesktop: z2.boolean(),
-      nodeVersion: z2.string(),
-      npmVersion: z2.string().nullable(),
-      npmPath: z2.string(),
-      globalPrefix: z2.string().nullable(),
-      ready: z2.boolean()
+    z3.object({
+      fromDesktop: z3.boolean(),
+      nodeVersion: z3.string(),
+      npmVersion: z3.string().nullable(),
+      npmPath: z3.string(),
+      globalPrefix: z3.string().nullable(),
+      ready: z3.boolean()
     })
   ).query(async ({ ctx }) => {
     await requireLoopbackOrToken(ctx);
     const npm = resolveNpm();
     const npmVersion = await probeVersion(npm, ["--version"]);
-    const globalPrefix = npmVersion ? await probeVersion(npm, ["prefix", "-g"]) : null;
+    const npmPrefix = npmVersion ? await probeVersion(npm, ["prefix", "-g"]) : null;
+    const globalPrefix = updatePrefix(npmPrefix, process.argv[1] ?? "");
     return {
       fromDesktop: env.FROM_DESKTOP,
       nodeVersion: process.version,
@@ -416,28 +518,18 @@ var appUpdateRouter = router({
    * est la seule chose qui dit à l'utilisateur quoi faire.
    */
   install: publicProcedure.output(
-    z2.object({
-      ok: z2.boolean(),
-      output: z2.string(),
-      installedVersion: z2.string().nullable()
+    z3.object({
+      ok: z3.boolean(),
+      output: z3.string(),
+      installedVersion: z3.string().nullable()
     })
   ).mutation(async ({ ctx }) => {
     await requireLoopbackOrToken(ctx);
     requireDesktop();
     const npm = resolveNpm();
-    try {
-      const { stdout, stderr } = await execFileAsync2(
-        npm.command,
-        [...npm.args, "install", "-g", `${PACKAGE_NAME}@latest`],
-        { timeout: INSTALL_TIMEOUT_MS, windowsHide: true, shell: npm.shell, maxBuffer: 10 * 1024 * 1024 }
-      );
-      const installedVersion = await probeVersion(npm, ["view", `${PACKAGE_NAME}`, "version"]);
-      return { ok: true, output: [stdout, stderr].filter(Boolean).join("\n").trim(), installedVersion };
-    } catch (err) {
-      const e = err;
-      const output = [e.stdout, e.stderr, e.message].filter(Boolean).join("\n").trim();
-      return { ok: false, output, installedVersion: null };
-    }
+    const prefix = updatePrefix(await probeVersion(npm, ["prefix", "-g"]), process.argv[1] ?? "");
+    if (!prefix) return { ok: false, output: "npm ne r\xE9pond pas : impossible de trouver o\xF9 installer Runeya.", installedVersion: null };
+    return installRuneyaGlobally(npm, prefix);
   }),
   /**
    * Relance Runeya, puis rend la main au nouveau process.
@@ -447,7 +539,7 @@ var appUpdateRouter = router({
    * quelques instants — le démarrage réessaie déjà sur EADDRINUSE, c'est ce qui
    * rend ce relais possible sans temporisation ici.
    */
-  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(async ({ ctx }) => {
+  restart: publicProcedure.output(z3.object({ restarting: z3.literal(true), version: z3.string() })).mutation(async ({ ctx }) => {
     await requireLoopbackOrToken(ctx);
     requireDesktop();
     const child = spawn(process.execPath, process.argv.slice(1), {
@@ -472,7 +564,7 @@ var appUpdateRouter = router({
 });
 
 // ../server/src/trpc/routers/changelog.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var CACHE_MS = 5 * 60 * 1e3;
 var cache = /* @__PURE__ */ new Map();
 async function cloudChangelog(path, params) {
@@ -493,38 +585,38 @@ async function cloudChangelog(path, params) {
 function appCeiling() {
   return appVersion === "dev" ? null : appVersion;
 }
-var inputSchema = z3.object({
+var inputSchema = z4.object({
   surface: ChangelogSurfaceSchema,
   /** Dernière version déjà vue par ce navigateur, exclue du résultat. */
-  since: z3.string().max(32).nullish()
+  since: z4.string().max(32).nullish()
 });
 var changelogRouter = router({
   /** Ce qu'il y a à lire, sans les corps. */
-  index: publicProcedure.input(inputSchema).output(z3.object({ releases: z3.array(ChangelogIndexItemSchema), currentAppVersion: z3.string() })).query(async ({ input }) => {
+  index: publicProcedure.input(inputSchema).output(z4.object({ releases: z4.array(ChangelogIndexItemSchema), currentAppVersion: z4.string() })).query(async ({ input }) => {
     const data = await cloudChangelog("/api/changelog", {
       surface: input.surface,
       since: input.since ?? null,
       until: input.surface === "app" ? appCeiling() : null
     });
-    const parsed = z3.object({ releases: z3.array(ChangelogIndexItemSchema) }).parse(data);
+    const parsed = z4.object({ releases: z4.array(ChangelogIndexItemSchema) }).parse(data);
     return { releases: parsed.releases, currentAppVersion: appVersion };
   }),
   /** Les entrées complètes. */
-  releases: publicProcedure.input(inputSchema).output(z3.object({ releases: z3.array(ChangelogReleaseSchema), currentAppVersion: z3.string() })).query(async ({ input }) => {
+  releases: publicProcedure.input(inputSchema).output(z4.object({ releases: z4.array(ChangelogReleaseSchema), currentAppVersion: z4.string() })).query(async ({ input }) => {
     const data = await cloudChangelog("/api/changelog/releases", {
       surface: input.surface,
       since: input.since ?? null,
       until: input.surface === "app" ? appCeiling() : null
     });
-    const parsed = z3.object({ releases: z3.array(ChangelogReleaseSchema) }).parse(data);
+    const parsed = z4.object({ releases: z4.array(ChangelogReleaseSchema) }).parse(data);
     return { releases: parsed.releases, currentAppVersion: appVersion };
   })
 });
 
 // ../server/src/trpc/routers/project.ts
-import { z as z4 } from "zod";
-import { dirname as dirname2, isAbsolute } from "path";
-import { TRPCError as TRPCError2 } from "@trpc/server";
+import { z as z5 } from "zod";
+import { dirname as dirname2, isAbsolute as isAbsolute2 } from "path";
+import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/current-project.ts
 var current = null;
@@ -850,7 +942,7 @@ async function assertReadable(orgId) {
     await assertOrgVaultReadable(orgId);
   } catch (err) {
     if (err instanceof OrgVaultUnreadableError) {
-      throw new TRPCError2({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError3({ code: "FORBIDDEN", message: err.message });
     }
     throw err;
   }
@@ -863,10 +955,10 @@ var projectRouter = router({
    * `orgId` names which project — the same id can exist in several
    * organizations. Left out, the id must answer for exactly one project.
    */
-  get: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).query(async ({ input }) => {
+  get: protectedProcedure.input(z5.object({ id: z5.string().max(128), orgId: z5.string().max(128).nullable().optional() })).query(async ({ input }) => {
     const project = await projectStore.get(input);
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await assertReadable(project.orgId);
     return project;
@@ -877,23 +969,23 @@ var projectRouter = router({
    * Environments are intentionally excluded — they carry secret values that
    * stay local.
    */
-  export: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).query(async ({ input }) => {
+  export: protectedProcedure.input(z5.object({ id: z5.string().max(128), orgId: z5.string().max(128).nullable().optional() })).query(async ({ input }) => {
     const project = await projectStore.get(input);
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await assertReadable(project.orgId);
     const services = (await Promise.all(project.serviceIds.map((sid) => serviceStore.getSanitized(sid)))).filter((s) => s !== null);
     return { project, services };
   }),
   create: protectedProcedure.input(
-    z4.object({
-      name: z4.string().min(1).max(200),
-      description: z4.string().max(1e4).optional(),
-      orgId: z4.string().max(128).nullable().optional(),
-      serviceIds: z4.array(z4.string().max(128)).max(1e4).optional(),
+    z5.object({
+      name: z5.string().min(1).max(200),
+      description: z5.string().max(1e4).optional(),
+      orgId: z5.string().max(128).nullable().optional(),
+      serviceIds: z5.array(z5.string().max(128)).max(1e4).optional(),
       /** Le dossier d'un projet local. Omis : le dossier de lancement. */
-      localPath: z4.string().min(1).max(4096).refine(isAbsolute, "Chemin absolu attendu").optional()
+      localPath: z5.string().min(1).max(4096).refine(isAbsolute2, "Chemin absolu attendu").optional()
     })
   ).mutation(async ({ input }) => {
     const { localPath, ...fields } = input;
@@ -907,9 +999,9 @@ var projectRouter = router({
       }, fields.orgId ? void 0 : localPath);
     } catch (err) {
       if (err instanceof LocalProjectRefusedError) {
-        throw new TRPCError2({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError3({ code: "CONFLICT", message: err.code, cause: err });
       }
-      throw new TRPCError2({ code: "CONFLICT", message: err.message });
+      throw new TRPCError3({ code: "CONFLICT", message: err.message });
     }
     const localEnv = await environmentStore.create({
       projectId: project.id,
@@ -928,38 +1020,38 @@ var projectRouter = router({
     return result;
   }),
   update: protectedProcedure.input(
-    z4.object({
-      id: z4.string().max(128),
-      name: z4.string().min(1).max(200).optional(),
-      description: z4.string().max(1e4).optional(),
-      orgId: z4.string().max(128).nullable().optional(),
-      serviceIds: z4.array(z4.string().max(128)).max(1e4).optional(),
-      groupOrder: z4.array(z4.string().max(200)).max(100).optional()
+    z5.object({
+      id: z5.string().max(128),
+      name: z5.string().min(1).max(200).optional(),
+      description: z5.string().max(1e4).optional(),
+      orgId: z5.string().max(128).nullable().optional(),
+      serviceIds: z5.array(z5.string().max(128)).max(1e4).optional(),
+      groupOrder: z5.array(z5.string().max(200)).max(100).optional()
     })
   ).mutation(async ({ input }) => {
     const project = await projectStore.update(input);
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id });
     return project;
   }),
-  delete: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z5.object({ id: z5.string().max(128), orgId: z5.string().max(128).nullable().optional() })).mutation(async ({ input }) => {
     const deleted = await projectStore.delete(input);
     if (!deleted) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await auditService.log({ userId: "local", action: "delete", entityType: "project", entityId: input.id });
     return { success: true };
   }),
-  addService: protectedProcedure.input(z4.object({
-    projectId: z4.string().max(128),
-    orgId: z4.string().max(128).nullable().optional(),
-    serviceId: z4.string().max(128)
+  addService: protectedProcedure.input(z5.object({
+    projectId: z5.string().max(128),
+    orgId: z5.string().max(128).nullable().optional(),
+    serviceId: z5.string().max(128)
   })).mutation(async ({ input }) => {
     const project = await attachServiceToProject({ id: input.projectId, orgId: input.orgId }, input.serviceId);
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
     await auditService.log({
       userId: "local",
@@ -970,17 +1062,17 @@ var projectRouter = router({
     });
     return project;
   }),
-  removeService: protectedProcedure.input(z4.object({
-    projectId: z4.string().max(128),
-    orgId: z4.string().max(128).nullable().optional(),
-    serviceId: z4.string().max(128)
+  removeService: protectedProcedure.input(z5.object({
+    projectId: z5.string().max(128),
+    orgId: z5.string().max(128).nullable().optional(),
+    serviceId: z5.string().max(128)
   })).mutation(async ({ input }) => {
     const project = await projectStore.removeService(
       { id: input.projectId, orgId: input.orgId },
       input.serviceId
     );
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
     await auditService.log({
       userId: "local",
@@ -991,21 +1083,21 @@ var projectRouter = router({
     });
     return project;
   }),
-  setActiveEnvironment: protectedProcedure.input(z4.object({
-    projectId: z4.string().max(128),
-    orgId: z4.string().max(128).nullable().optional(),
-    environmentId: z4.string().max(128)
+  setActiveEnvironment: protectedProcedure.input(z5.object({
+    projectId: z5.string().max(128),
+    orgId: z5.string().max(128).nullable().optional(),
+    environmentId: z5.string().max(128)
   })).mutation(async ({ input }) => {
     const project = await projectStore.get({ id: input.projectId, orgId: input.orgId });
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
     const environment = await environmentStore.get(input.environmentId);
     if (!environment) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     }
     if (environment.projectId !== input.projectId) {
-      throw new TRPCError2({ code: "FORBIDDEN", message: "Environment does not belong to this project" });
+      throw new TRPCError3({ code: "FORBIDDEN", message: "Environment does not belong to this project" });
     }
     const runningServices = [];
     for (const serviceId of project.serviceIds) {
@@ -1030,7 +1122,7 @@ var projectRouter = router({
       input.environmentId
     );
     if (!updated) {
-      throw new TRPCError2({ code: "INTERNAL_SERVER_ERROR", message: "Failed to set active environment" });
+      throw new TRPCError3({ code: "INTERNAL_SERVER_ERROR", message: "Failed to set active environment" });
     }
     for (const serviceId of project.serviceIds) {
       const service = await serviceStore.get(serviceId);
@@ -1079,7 +1171,7 @@ var projectRouter = router({
    * système s'en sert, pour montrer les services du projet ouvert plutôt que
    * ceux de toute la machine.
    */
-  setCurrent: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().default(null) }).nullable()).mutation(({ input }) => {
+  setCurrent: protectedProcedure.input(z5.object({ id: z5.string().max(128), orgId: z5.string().max(128).nullable().default(null) }).nullable()).mutation(({ input }) => {
     setCurrentProject(input ? { id: input.id, orgId: input.orgId } : null);
     return { ok: true };
   }),
@@ -1095,13 +1187,13 @@ var projectRouter = router({
    * des secrets déchiffrés : elles servent à détecter la référence, et
    * s'arrêtent là.
    */
-  graph: protectedProcedure.input(z4.object({
-    id: z4.string().min(1).max(128),
-    orgId: z4.string().max(128).nullable().optional()
+  graph: protectedProcedure.input(z5.object({
+    id: z5.string().min(1).max(128),
+    orgId: z5.string().max(128).nullable().optional()
   })).query(async ({ ctx, input }) => {
     const project = await projectStore.get(input);
     if (!project) {
-      throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
+      throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await assertReadable(project.orgId);
     const allowed = getAllowedServiceIds(ctx);
@@ -1143,9 +1235,9 @@ var projectRouter = router({
     }
     return paths;
   }),
-  getLocalPath: protectedProcedure.input(z4.object({
-    id: z4.string().min(1).max(128),
-    orgId: z4.string().max(128).nullable().optional()
+  getLocalPath: protectedProcedure.input(z5.object({
+    id: z5.string().min(1).max(128),
+    orgId: z5.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return { path: await projectPathStore.get(input) };
   }),
@@ -1157,34 +1249,34 @@ var projectRouter = router({
    * makes services run against the wrong code.
    */
   /** Ajouter à la liste le projet local déjà présent dans un dossier. */
-  importLocal: protectedProcedure.input(z4.object({ path: z4.string().min(1).max(4096).refine(isAbsolute, "Chemin absolu attendu") })).mutation(async ({ input }) => {
+  importLocal: protectedProcedure.input(z5.object({ path: z5.string().min(1).max(4096).refine(isAbsolute2, "Chemin absolu attendu") })).mutation(async ({ input }) => {
     try {
       const project = await projectStore.importLocal(input.path);
       await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: project.id, metadata: { importedFrom: input.path } });
       return project;
     } catch (err) {
       if (err instanceof LocalProjectRefusedError) {
-        throw new TRPCError2({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError3({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
   }),
-  setLocalPath: protectedProcedure.input(z4.object({
-    id: z4.string().min(1).max(128),
-    orgId: z4.string().max(128).nullable().optional(),
-    path: z4.string().min(1).max(4096)
+  setLocalPath: protectedProcedure.input(z5.object({
+    id: z5.string().min(1).max(128),
+    orgId: z5.string().max(128).nullable().optional(),
+    path: z5.string().min(1).max(4096)
   })).mutation(async ({ input }) => {
     const project = await projectStore.get(input);
-    if (!project) throw new TRPCError2({ code: "NOT_FOUND", message: "Projet introuvable" });
+    if (!project) throw new TRPCError3({ code: "NOT_FOUND", message: "Projet introuvable" });
     if (await holdsRuneyaProject(input.path)) {
-      throw new TRPCError2({
+      throw new TRPCError3({
         code: "CONFLICT",
         message: "Ce r\xE9pertoire contient d\xE9j\xE0 un projet Runeya"
       });
     }
     const taken = await projectPathStore.projectAt(input.path, project);
     if (taken) {
-      throw new TRPCError2({
+      throw new TRPCError3({
         code: "CONFLICT",
         message: "Un autre projet est d\xE9j\xE0 rattach\xE9 \xE0 ce r\xE9pertoire"
       });
@@ -1253,8 +1345,8 @@ var projectRouter = router({
 });
 
 // ../server/src/trpc/routers/agent.ts
-import { z as z5 } from "zod";
-import { TRPCError as TRPCError3 } from "@trpc/server";
+import { z as z6 } from "zod";
+import { TRPCError as TRPCError4 } from "@trpc/server";
 var SUBSCRIPTION_QUEUE_MAX = LOG_BUFFER_SIZE;
 var agentRouter = router({
   /** List all registered agents with their connection status */
@@ -1262,10 +1354,10 @@ var agentRouter = router({
     return agentManager.listAgents();
   }),
   /** Get a single agent's config and status */
-  get: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(({ input }) => {
+  get: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).query(({ input }) => {
     const agent = agentManager.getAgent(input.id);
     if (!agent) {
-      throw new TRPCError3({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
     }
     return {
       config: { ...agent.config, passphrase: "***" },
@@ -1274,10 +1366,10 @@ var agentRouter = router({
   }),
   /** Test connectivity to an agent given url + passphrase */
   testConnection: protectedProcedure.input(
-    z5.object({
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      agentId: z5.string().max(128).optional()
+    z6.object({
+      url: z6.string().url().max(2048),
+      passphrase: z6.string().min(1).max(1024).optional(),
+      agentId: z6.string().max(128).optional()
     })
   ).mutation(async ({ input }) => {
     let passphrase = input.passphrase;
@@ -1285,13 +1377,13 @@ var agentRouter = router({
     if (!passphrase && input.agentId) {
       const agent = agentManager.getAgentConfig(input.agentId);
       if (!agent) {
-        throw new TRPCError3({ code: "NOT_FOUND", message: "Agent not found" });
+        throw new TRPCError4({ code: "NOT_FOUND", message: "Agent not found" });
       }
       passphrase = agent.passphrase;
       targetUrl = agent.url;
     }
     if (!passphrase) {
-      throw new TRPCError3({ code: "BAD_REQUEST", message: "Passphrase is required" });
+      throw new TRPCError4({ code: "BAD_REQUEST", message: "Passphrase is required" });
     }
     const url = new URL("/api/trpc/health.check", targetUrl);
     try {
@@ -1314,13 +1406,13 @@ var agentRouter = router({
   }),
   /** Register a new agent */
   register: protectedProcedure.input(
-    z5.object({
-      name: z5.string().min(1).max(100),
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024),
+    z6.object({
+      name: z6.string().min(1).max(100),
+      url: z6.string().url().max(2048),
+      passphrase: z6.string().min(1).max(1024),
       // À quelle organisation rattacher l'agent. Absent = la machine, ce que
       // font l'agent local et tout client antérieur à ce champ.
-      orgId: z5.string().min(1).max(128).nullable().optional()
+      orgId: z6.string().min(1).max(128).nullable().optional()
     })
   ).mutation(async ({ input }) => {
     const config = await agentManager.register(
@@ -1333,13 +1425,13 @@ var agentRouter = router({
   }),
   /** Update an existing agent */
   update: protectedProcedure.input(
-    z5.object({
-      id: z5.string().max(128),
-      name: z5.string().min(1).max(100).optional(),
-      url: z5.string().url().max(2048).optional(),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      passthroughEnv: z5.array(
-        z5.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
+    z6.object({
+      id: z6.string().max(128),
+      name: z6.string().min(1).max(100).optional(),
+      url: z6.string().url().max(2048).optional(),
+      passphrase: z6.string().min(1).max(1024).optional(),
+      passthroughEnv: z6.array(
+        z6.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
       ).max(100).optional()
     })
   ).mutation(async ({ input }) => {
@@ -1350,17 +1442,17 @@ var agentRouter = router({
     } catch (err) {
       if (err instanceof Error) {
         if (err.message.includes("not found")) {
-          throw new TRPCError3({ code: "NOT_FOUND", message: err.message });
+          throw new TRPCError4({ code: "NOT_FOUND", message: err.message });
         }
         if (err.message.includes("Cannot modify")) {
-          throw new TRPCError3({ code: "FORBIDDEN", message: err.message });
+          throw new TRPCError4({ code: "FORBIDDEN", message: err.message });
         }
       }
       throw err;
     }
   }),
   /** Get resolved passthrough env values from an agent */
-  getPassthroughEnv: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(async ({ input }) => {
+  getPassthroughEnv: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).query(async ({ input }) => {
     try {
       return await agentManager.agentQuery(input.id, "config.getPassthroughEnv");
     } catch {
@@ -1368,16 +1460,16 @@ var agentRouter = router({
     }
   }),
   /** Remove a registered agent */
-  remove: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).mutation(async ({ input }) => {
+  remove: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).mutation(async ({ input }) => {
     try {
       const removed = await agentManager.remove(input.id);
       if (!removed) {
-        throw new TRPCError3({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
+        throw new TRPCError4({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
       }
       return { success: true };
     } catch (err) {
       if (err instanceof Error && err.message === "Cannot remove the local agent") {
-        throw new TRPCError3({ code: "FORBIDDEN", message: err.message });
+        throw new TRPCError4({ code: "FORBIDDEN", message: err.message });
       }
       throw err;
     }
@@ -1415,16 +1507,16 @@ var agentRouter = router({
 });
 
 // ../server/src/trpc/routers/process.ts
-import { z as z6 } from "zod";
-import { TRPCError as TRPCError5 } from "@trpc/server";
+import { z as z7 } from "zod";
+import { TRPCError as TRPCError6 } from "@trpc/server";
 
 // ../server/src/services/process-control.ts
-import { TRPCError as TRPCError4 } from "@trpc/server";
+import { TRPCError as TRPCError5 } from "@trpc/server";
 async function resolveTarget(processId, fallbackAgentId) {
   const service = await serviceStore.get(processId) ?? null;
   const agentId = (service ? await resolveEffectiveAgentId(service) : null) ?? fallbackAgentId ?? null;
   if (!agentId) {
-    throw new TRPCError4({
+    throw new TRPCError5({
       code: "BAD_REQUEST",
       message: "No agent assigned to this service. Set an agent on the service or on the active environment."
     });
@@ -1440,7 +1532,7 @@ async function assertEnvironmentComplete(service) {
     activeEnvironmentId: project.activeEnvironmentId
   });
   if (missing.length === 0) return;
-  throw new TRPCError4({
+  throw new TRPCError5({
     code: "PRECONDITION_FAILED",
     message: `Missing environment variables: ${missing.map((m) => m.key).join(", ")}`,
     cause: { missingVariables: missing, environmentId: project.activeEnvironmentId }
@@ -1474,7 +1566,7 @@ async function startProcess(processId, fallbackAgentId) {
   } catch (err) {
     const err_ = err;
     const isFetchError = err_?.cause?.code === "ECONNREFUSED" || err_?.message === "fetch failed" || err_?.name === "TypeError";
-    throw new TRPCError4({
+    throw new TRPCError5({
       code: "INTERNAL_SERVER_ERROR",
       message: isFetchError ? `Cannot reach agent \u2014 make sure the agent is running` : err_?.message ?? "Failed to start process"
     });
@@ -1581,13 +1673,13 @@ async function* forwardLogBatches(agentId, processId) {
 }
 var processRouter = router({
   /** List all processes across all connected agents */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z6.any()).query(() => listAllProcesses()),
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z7.any()).query(() => listAllProcesses()),
   /** Get a single process from a specific agent */
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z6.object({ agentId: z6.string().max(128), id: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z7.object({ agentId: z7.string().max(128), id: z7.string().max(128) })).output(z7.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const status = agentManager.getStatus(input.agentId);
     if (!status) {
-      throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.agentId} not found` });
+      throw new TRPCError6({ code: "NOT_FOUND", message: `Agent ${input.agentId} not found` });
     }
     const proc = await agentManager.agentQuery(input.agentId, "process.get", { id: input.id });
     return { ...proc, agentId: input.agentId };
@@ -1597,37 +1689,37 @@ var processRouter = router({
    *  (or restarted). This avoids pushing configs for every service at agent boot,
    *  which would be wasteful when many services are never started.
    *  The deploy call is idempotent — creates the process if missing, updates config if it exists. */
-  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128).optional(), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:start");
     return startProcess(input.processId, input.agentId);
   }),
   /** Stop a process on an agent */
-  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:stop");
     return stopProcess(input.processId, input.agentId);
   }),
   /** Restart a process on an agent.
    *  Sends stop → deploy (latest resolved config) → start so that
    *  config/variable changes take effect. Same lazy deploy pattern as start. */
-  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128).optional(), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:restart");
     return restartProcess(input.processId, input.agentId);
   }),
   /** Get buffered logs for a process from an agent */
-  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).output(z7.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "logs:read");
     return agentManager.agentQuery(input.agentId, "process.logs", { id: input.processId });
   }),
   /** Clear buffered logs for a process on an agent */
-  clearLogBuffer: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).mutation(async ({ input }) => {
+  clearLogBuffer: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.clearLogBuffer", { id: input.processId });
     await auditService.log({ userId: "local", action: "clearLogBuffer", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
     return { success: true };
   }),
   /** Execute a shortcut command on an agent, streaming output into the process log */
-  executeShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
+  executeShortcut: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
     shortcut: ServiceShortcutSchema
   })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.processId);
@@ -1655,12 +1747,12 @@ var processRouter = router({
     return result;
   }),
   /** Execute an ad-hoc command on an agent, streaming output into the process log */
-  executeAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    command: z6.string().min(1).max(4096),
-    cwd: z6.string().max(4096).optional(),
-    commandId: z6.string().max(128).optional()
+  executeAdHocCommand: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    command: z7.string().min(1).max(4096),
+    cwd: z7.string().max(4096).optional(),
+    commandId: z7.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.processId);
     if (service) {
@@ -1694,25 +1786,25 @@ var processRouter = router({
     return result;
   }),
   /** Cancel a running shortcut command on an agent */
-  cancelShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    shortcutId: z6.string().max(128)
+  cancelShortcut: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    shortcutId: z7.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.cancelShortcut", { id: input.processId, shortcutId: input.shortcutId });
     return { success: true };
   }),
   /** Cancel a running ad-hoc command on an agent */
-  cancelAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    commandId: z6.string().max(128).optional()
+  cancelAdHocCommand: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    commandId: z7.string().max(128).optional()
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.cancelAdHocCommand", { id: input.processId, commandId: input.commandId });
     return { success: true };
   }),
   /** Get current metrics for a process from an agent */
-  metrics: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).query(async ({ input }) => {
+  metrics: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(input.agentId, "process.metrics", { id: input.processId });
   }),
   /**
@@ -1720,7 +1812,7 @@ var processRouter = router({
    * Forwards batched events from the AgentWSBridge in real-time.
    * Historical logs are fetched separately via process.logs query.
    */
-  onLog: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).subscription(async function* ({ input, ctx }) {
+  onLog: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).subscription(async function* ({ input, ctx }) {
     requireServiceAction(ctx, input.processId, "logs:read");
     yield* forwardLogBatches(input.agentId, input.processId);
   }),
@@ -1729,9 +1821,9 @@ var processRouter = router({
    * Input is optional — omit agentId/processId for global monitoring (dashboard).
    * Forwards events from the AgentWSBridge in real-time.
    */
-  onStatus: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onStatus: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
@@ -1759,9 +1851,9 @@ var processRouter = router({
     });
   }),
   /** Subscribe to real-time metrics for a process. */
-  onMetrics: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onMetrics: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
@@ -1773,9 +1865,9 @@ var processRouter = router({
     });
   }),
   /** Subscribe to real-time health status changes. */
-  onHealth: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onHealth: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:healthcheck");
@@ -1789,21 +1881,21 @@ var processRouter = router({
 });
 
 // ../server/src/trpc/routers/audit.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var auditRouter = router({
-  list: protectedProcedure.input(z7.object({
-    action: z7.string().max(50).optional(),
-    entityType: z7.string().max(50).optional(),
-    entityId: z7.string().max(100).optional(),
-    limit: z7.number().int().positive().max(100).default(50),
-    offset: z7.number().int().nonnegative().default(0)
+  list: protectedProcedure.input(z8.object({
+    action: z8.string().max(50).optional(),
+    entityType: z8.string().max(50).optional(),
+    entityId: z8.string().max(100).optional(),
+    limit: z8.number().int().positive().max(100).default(50),
+    offset: z8.number().int().nonnegative().default(0)
   }).optional()).query(async ({ input }) => {
     return auditService.list(input ?? {});
   })
 });
 
 // ../server/src/trpc/routers/setup.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var setupRouter = router({
   /**
    * Check if encryption key is required (project initialized but no key).
@@ -1907,9 +1999,9 @@ var setupRouter = router({
    * une validation de la clé à adopter rendait le parcours impossible : vert
    * quand le geste est inutile, rouge sinon.
    */
-  checkOrgKeyLocal: protectedProcedure.input(z8.object({
-    orgId: z8.string().min(1).max(128),
-    keyHex: z8.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
+  checkOrgKeyLocal: protectedProcedure.input(z9.object({
+    orgId: z9.string().min(1).max(128),
+    keyHex: z9.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
   })).query(async ({ input }) => {
     const canary = await readVerifyFile(orgVaultRoot(input.orgId));
     const locked = isVaultLocked(input.orgId);
@@ -1926,8 +2018,8 @@ var setupRouter = router({
    * Spawns the local agent if in local-simple mode.
    */
   submitEncryptionKey: publicProcedure.input(
-    z8.object({
-      keyHex: z8.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
+    z9.object({
+      keyHex: z9.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
     })
   ).mutation(async ({ input }) => {
     try {
@@ -1947,8 +2039,8 @@ var setupRouter = router({
 
 // ../server/src/trpc/routers/environment.ts
 import { randomUUID } from "crypto";
-import { z as z9 } from "zod";
-import { TRPCError as TRPCError6 } from "@trpc/server";
+import { z as z10 } from "zod";
+import { TRPCError as TRPCError7 } from "@trpc/server";
 
 // ../server/src/services/ai-variable-write.ts
 var AiVariableWriteError = class extends Error {
@@ -2027,29 +2119,29 @@ async function builtinsForEnvironment(environment) {
   return own ? values : Object.fromEntries(Object.entries(values).filter(([name]) => name.startsWith("services.")));
 }
 var environmentRouter = router({
-  list: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional()
+  list: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return await environmentStore.list(input.projectId, input.orgId);
   }),
-  get: protectedProcedure.input(z9.object({ id: z9.string().max(128) })).query(async ({ input }) => {
+  get: protectedProcedure.input(z10.object({ id: z10.string().max(128) })).query(async ({ input }) => {
     const env2 = await environmentStore.get(input.id);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     return env2;
   }),
-  listByScope: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional(),
-    scope: z9.enum(["global", "service"])
+  listByScope: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional(),
+    scope: z10.enum(["global", "service"])
   })).query(async ({ input }) => {
     return await environmentStore.listByScope(input.projectId, input.scope, input.orgId);
   }),
-  findServiceEnvironment: protectedProcedure.input(z9.object({ serviceId: z9.string().max(128), globalEnvId: z9.string().max(128) })).query(async ({ input }) => {
+  findServiceEnvironment: protectedProcedure.input(z10.object({ serviceId: z10.string().max(128), globalEnvId: z10.string().max(128) })).query(async ({ input }) => {
     return await environmentStore.findServiceEnvironment(input.serviceId, input.globalEnvId);
   }),
   create: protectedProcedure.input(CreateEnvironmentSchema.extend({
-    orgId: z9.string().max(128).nullable().optional()
+    orgId: z10.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { orgId, ...environment } = input;
     const target = { id: input.projectId, orgId };
@@ -2085,9 +2177,9 @@ var environmentRouter = router({
   }),
   update: protectedProcedure.input(UpdateEnvironmentSchema).mutation(async ({ input }) => {
     const existing = await environmentStore.get(input.id);
-    if (!existing) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
+    if (!existing) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     const env2 = await environmentStore.update(input);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     if (env2.scope === "global" && input.name && input.name !== existing.name) {
       const project = await projectStore.get(environmentStore.projectRefOf(env2) ?? env2.projectId);
       if (project) {
@@ -2101,24 +2193,24 @@ var environmentRouter = router({
     }
     return env2;
   }),
-  delete: protectedProcedure.input(z9.object({ id: z9.string().max(128) })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z10.object({ id: z10.string().max(128) })).mutation(async ({ input }) => {
     const env2 = await environmentStore.get(input.id);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     if (env2.immutable) {
-      throw new TRPCError6({ code: "FORBIDDEN", message: "Cannot delete immutable environment" });
+      throw new TRPCError7({ code: "FORBIDDEN", message: "Cannot delete immutable environment" });
     }
     if (env2.scope === "global") {
       await environmentStore.deleteByActivateOn(input.id);
     }
     const deleted = await environmentStore.delete(input.id);
-    if (!deleted) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to delete environment" });
+    if (!deleted) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to delete environment" });
     await projectStore.removeEnvironment(environmentStore.projectRefOf(env2) ?? env2.projectId, input.id);
     return { success: true };
   }),
-  resolve: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128) })).query(async ({ input, ctx }) => {
+  resolve: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128) })).query(async ({ input, ctx }) => {
     const { includeSecrets } = requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const resolved = await environmentResolver.resolveEnvironmentWithSources(input.environmentId);
     if (!includeSecrets) {
       const sanitized = { ...resolved };
@@ -2134,10 +2226,10 @@ var environmentRouter = router({
     }
     return resolved;
   }),
-  resolveFlat: protectedProcedure.meta({ openapi: { method: "GET", path: "/environments/{environmentId}/resolve-flat", tags: ["environments"], summary: "Resolve environment variables as a flat key-value map", protect: true } }).input(z9.object({ environmentId: z9.string().max(128) })).output(z9.record(z9.string(), z9.string())).query(async ({ input, ctx }) => {
+  resolveFlat: protectedProcedure.meta({ openapi: { method: "GET", path: "/environments/{environmentId}/resolve-flat", tags: ["environments"], summary: "Resolve environment variables as a flat key-value map", protect: true } }).input(z10.object({ environmentId: z10.string().max(128) })).output(z10.record(z10.string(), z10.string())).query(async ({ input, ctx }) => {
     const { includeSecrets } = requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const { env: resolved, envSecrets } = await environmentResolver.resolveEnvironment(input.environmentId);
     const result = {};
     for (const [key, value] of Object.entries(resolved)) {
@@ -2159,10 +2251,10 @@ var environmentRouter = router({
    * motif. C'est ce que l'assistant de complétion affiche, et il n'a pas
    * besoin de connaître ce qui est déjà rempli ailleurs.
    */
-  missingVariables: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128) })).query(async ({ input, ctx }) => {
+  missingVariables: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128) })).query(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const missing = await environmentResolver.findMissingForActiveEnvironment(input.environmentId);
     return missing.filter((item) => canEnvAction(ctx, item.environmentId, "env:read"));
   }),
@@ -2181,17 +2273,17 @@ var environmentRouter = router({
    *   poste, en recopiant depuis la définition la forme (`pre`, `post`) et le
    *   caractère secret que la surcharge ne porte pas d'elle-même.
    */
-  fillVariable: protectedProcedure.input(z9.object({
-    environmentId: z9.string().max(128),
-    variableId: z9.string().max(128),
-    value: z9.string().max(8192),
+  fillVariable: protectedProcedure.input(z10.object({
+    environmentId: z10.string().max(128),
+    variableId: z10.string().max(128),
+    value: z10.string().max(8192),
     reason: MissingVariableReasonSchema
   })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const variable = env2.variables[input.variableId];
-    if (!variable) throw new TRPCError6({ code: "NOT_FOUND", message: `Variable ${input.variableId} not found` });
+    if (!variable) throw new TRPCError7({ code: "NOT_FOUND", message: `Variable ${input.variableId} not found` });
     const slot = variable.value;
     if (input.reason === "overrideOnly") {
       await environmentOverridesStore.setOverride(input.variableId, {
@@ -2203,11 +2295,11 @@ var environmentRouter = router({
       ...variable,
       value: { ...slot, value: input.value }
     });
-    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to fill variable" });
+    if (!result) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to fill variable" });
     return { success: true };
   }),
-  setOverride: protectedProcedure.input(z9.object({
-    variableId: z9.string().max(128),
+  setOverride: protectedProcedure.input(z10.object({
+    variableId: z10.string().max(128),
     // Only the value slot: the env var name comes from the variable
     // definition (a `key` sent by an older client is stripped here).
     variable: VariableOverrideSchema
@@ -2215,8 +2307,8 @@ var environmentRouter = router({
     await environmentOverridesStore.setOverride(input.variableId, input.variable);
     return { success: true };
   }),
-  removeOverride: protectedProcedure.input(z9.object({
-    variableId: z9.string().max(128)
+  removeOverride: protectedProcedure.input(z10.object({
+    variableId: z10.string().max(128)
   })).mutation(async ({ input }) => {
     await environmentOverridesStore.removeOverride(input.variableId);
     return { success: true };
@@ -2224,16 +2316,16 @@ var environmentRouter = router({
   getOverrides: protectedProcedure.query(async () => {
     return await environmentOverridesStore.getAll();
   }),
-  upsertVariable: protectedProcedure.meta({ openapi: { method: "PUT", path: "/environments/{environmentId}/variables/{variableId}", tags: ["environments"], summary: "Upsert a variable in an environment", protect: true } }).output(z9.any()).input(z9.object({
-    environmentId: z9.string().max(128),
-    variableId: z9.string().max(128),
+  upsertVariable: protectedProcedure.meta({ openapi: { method: "PUT", path: "/environments/{environmentId}/variables/{variableId}", tags: ["environments"], summary: "Upsert a variable in an environment", protect: true } }).output(z10.any()).input(z10.object({
+    environmentId: z10.string().max(128),
+    variableId: z10.string().max(128),
     variable: VariableSchema
   })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const result = await environmentStore.upsertVariable(input.environmentId, input.variableId, input.variable);
-    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update variable" });
+    if (!result) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update variable" });
     return result;
   }),
   /**
@@ -2241,15 +2333,15 @@ var environmentRouter = router({
    * hérite de qui, lequel est actif — sans aucune valeur (`describeEnvironmentsForAi`).
    * Une clé d'API n'y voit que les environnements qu'elle peut lire.
    */
-  listForAi: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional()
+  listForAi: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional()
   })).query(async ({ input, ctx }) => {
     const project = await projectStore.get({
       id: input.projectId,
       ...input.orgId !== void 0 ? { orgId: input.orgId } : {}
     });
-    if (!project) throw new TRPCError6({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
+    if (!project) throw new TRPCError7({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     const environments = (await environmentStore.list(input.projectId, input.orgId)).filter((env2) => canEnvAction(ctx, env2.id, "env:read"));
     const serviceNames = {};
     for (const serviceId of project.serviceIds) {
@@ -2265,10 +2357,10 @@ var environmentRouter = router({
    * remplies — elles dépendent du service qui les reçoit — mais une référence
    * qui ne correspond à rien est nommée.
    */
-  resolveForAi: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128) })).query(async ({ input, ctx }) => {
+  resolveForAi: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128) })).query(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const [resolved, shared] = await Promise.all([
       environmentResolver.resolveEnvironment(input.environmentId),
       environmentResolver.resolveAiSharedKeys(input.environmentId)
@@ -2290,29 +2382,29 @@ var environmentRouter = router({
    * pas un secret public et ne le partage jamais avec les IA. La réponse ne
    * porte aucune valeur : ce qui vient d'être écrit peut être un secret.
    */
-  setVariableBlind: protectedProcedure.input(z9.object({
-    environmentId: z9.string().max(128),
-    key: z9.string().min(1).max(256),
-    value: z9.string().max(8192).optional(),
-    pre: z9.string().max(8192).optional(),
-    post: z9.string().max(8192).optional(),
-    isSecret: z9.boolean().optional(),
-    description: z9.string().max(2e3).optional()
+  setVariableBlind: protectedProcedure.input(z10.object({
+    environmentId: z10.string().max(128),
+    key: z10.string().min(1).max(256),
+    value: z10.string().max(8192).optional(),
+    pre: z10.string().max(8192).optional(),
+    post: z10.string().max(8192).optional(),
+    isSecret: z10.boolean().optional(),
+    description: z10.string().max(2e3).optional()
   })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const found = Object.entries(env2.variables).find(([, v]) => v.key === input.key);
     const variableId = found?.[0] ?? randomUUID();
     let variable;
     try {
       variable = planAiVariableWrite(found?.[1], input);
     } catch (err) {
-      if (err instanceof AiVariableWriteError) throw new TRPCError6({ code: "FORBIDDEN", message: err.message });
+      if (err instanceof AiVariableWriteError) throw new TRPCError7({ code: "FORBIDDEN", message: err.message });
       throw err;
     }
     const result = await environmentStore.upsertVariable(input.environmentId, variableId, variable);
-    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to write variable" });
+    if (!result) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to write variable" });
     const written = `${variable.value.pre}${variable.value.value}${variable.value.post}`;
     let suggestions = [];
     if (!variable.value.isSecret) {
@@ -2338,26 +2430,26 @@ var environmentRouter = router({
    * une route dédiée parce que `update` rend l'environnement entier, valeurs
    * comprises.
    */
-  setInheritanceBlind: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128), inherit: z9.boolean() })).mutation(async ({ input, ctx }) => {
+  setInheritanceBlind: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128), inherit: z10.boolean() })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     if (env2.scope !== "service" || !env2.activateOn) {
-      throw new TRPCError6({ code: "BAD_REQUEST", message: `Environment ${input.environmentId} is not a service environment: only those inherit from, or are isolated from, the global environment that activates them` });
+      throw new TRPCError7({ code: "BAD_REQUEST", message: `Environment ${input.environmentId} is not a service environment: only those inherit from, or are isolated from, the global environment that activates them` });
     }
     const updated = await environmentStore.update({ id: env2.id, parentIds: input.inherit ? [env2.activateOn] : [] });
-    if (!updated) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update inheritance" });
+    if (!updated) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to update inheritance" });
     return { environmentId: env2.id, isolated: !input.inherit };
   }),
   /** Retirer une variable par son nom, pour le compte d'une IA : la réponse ne porte aucune valeur. */
-  removeVariableBlind: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128), key: z9.string().min(1).max(256) })).mutation(async ({ input, ctx }) => {
+  removeVariableBlind: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128), key: z10.string().min(1).max(256) })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const found = Object.entries(env2.variables).find(([, v]) => v.key === input.key);
-    if (!found) throw new TRPCError6({ code: "NOT_FOUND", message: `Variable ${input.key} not found in environment ${input.environmentId}` });
+    if (!found) throw new TRPCError7({ code: "NOT_FOUND", message: `Variable ${input.key} not found in environment ${input.environmentId}` });
     const result = await environmentStore.removeVariable(input.environmentId, found[0]);
-    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to remove variable" });
+    if (!result) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to remove variable" });
     return { environmentId: input.environmentId, key: input.key, removed: true };
   }),
   /**
@@ -2365,12 +2457,12 @@ var environmentRouter = router({
    * define it, and variables that reference it through {{environment.KEY}}.
    * Used by the UI to warn before editing a shared variable from a resolved view.
    */
-  keyUsages: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional(),
-    key: z9.string().min(1).max(256),
+  keyUsages: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional(),
+    key: z10.string().min(1).max(256),
     /** Environment holding the variable about to be edited — enables inherited-impact detection */
-    environmentId: z9.string().max(128).optional()
+    environmentId: z10.string().max(128).optional()
   })).query(async ({ input }) => {
     const environments = await environmentStore.list(input.projectId, input.orgId);
     const services = await serviceStore.list();
@@ -2427,22 +2519,22 @@ var environmentRouter = router({
     }
     return { definedIn, referencedBy, inheritedBy };
   }),
-  removeVariable: protectedProcedure.input(z9.object({
-    environmentId: z9.string().max(128),
-    variableId: z9.string().max(128)
+  removeVariable: protectedProcedure.input(z10.object({
+    environmentId: z10.string().max(128),
+    variableId: z10.string().max(128)
   })).mutation(async ({ input }) => {
     const env2 = await environmentStore.get(input.environmentId);
-    if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
+    if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
     const result = await environmentStore.removeVariable(input.environmentId, input.variableId);
-    if (!result) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to remove variable" });
+    if (!result) throw new TRPCError7({ code: "INTERNAL_SERVER_ERROR", message: "Failed to remove variable" });
     return result;
   })
 });
 
 // ../server/src/trpc/routers/settings.ts
 import { promises as dns } from "dns";
-import { z as z10 } from "zod";
-import { TRPCError as TRPCError7 } from "@trpc/server";
+import { z as z11 } from "zod";
+import { TRPCError as TRPCError8 } from "@trpc/server";
 var NotificationPreferencesPatchSchema = NotificationPreferencesSchema.partial().strict();
 function listWithOrigin(parsers, vault) {
   return [
@@ -2455,8 +2547,8 @@ function maskApiKey2(plaintext) {
   return plaintext.slice(0, 4) + "****" + plaintext.slice(-4);
 }
 var ScopeShape = {
-  orgId: z10.string().max(128).nullable().optional(),
-  projectId: z10.string().max(128).optional()
+  orgId: z11.string().max(128).nullable().optional(),
+  projectId: z11.string().max(128).optional()
 };
 async function scopeOf(input) {
   return input?.orgId ?? await vaultOfProject(input?.projectId);
@@ -2499,11 +2591,11 @@ var settingsRouter = router({
    * celle de l'onglet qui bascule, ne sont pas coupées. Le choix est mémorisé
    * dans les réglages, donc conservé au prochain démarrage.
    */
-  setLanMode: protectedProcedure.input(z10.object({ enabled: z10.boolean() })).mutation(async ({ input }) => {
+  setLanMode: protectedProcedure.input(z11.object({ enabled: z11.boolean() })).mutation(async ({ input }) => {
     try {
       return await setLanMode(input.enabled);
     } catch (err) {
-      throw new TRPCError7({
+      throw new TRPCError8({
         code: "INTERNAL_SERVER_ERROR",
         message: `Impossible de changer l'adresse d'\xE9coute : ${err.message}`
       });
@@ -2524,7 +2616,7 @@ var settingsRouter = router({
   /**
    * Get notification preferences
    */
-  getNotificationPreferences: protectedProcedure.input(z10.object(ScopeShape).optional()).query(async ({ input }) => {
+  getNotificationPreferences: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
     const priv = await settingsManager.getPrivateSettings(await scopeOf(input));
     return NotificationPreferencesSchema.parse(priv.notifications ?? {});
   }),
@@ -2552,7 +2644,7 @@ var settingsRouter = router({
    * parseur d'organisation se modifie pour toute l'équipe, et l'interface doit
    * pouvoir le dire avant que quelqu'un le change sans le savoir.
    */
-  listParsers: protectedProcedure.input(z10.object(ScopeShape).optional()).query(async ({ input }) => {
+  listParsers: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
     const vault = await scopeOf(input);
     return listWithOrigin(await logParserStore.list(vault), vault);
   }),
@@ -2564,7 +2656,7 @@ var settingsRouter = router({
    * retard — affichant une liste dans laquelle le parseur qu'un service vient
    * de référencer n'existe pas encore.
    */
-  onParsersChanged: protectedProcedure.input(z10.object(ScopeShape).optional()).subscription(async function* ({ input, signal }) {
+  onParsersChanged: protectedProcedure.input(z11.object(ScopeShape).optional()).subscription(async function* ({ input, signal }) {
     const vault = await scopeOf(input);
     let pending = true;
     let wake = null;
@@ -2602,10 +2694,10 @@ var settingsRouter = router({
   /**
    * Get single parser by ID
    */
-  getParser: protectedProcedure.input(z10.object({ id: z10.string().max(128), ...ScopeShape })).query(async ({ input }) => {
+  getParser: protectedProcedure.input(z11.object({ id: z11.string().max(128), ...ScopeShape })).query(async ({ input }) => {
     const parser = await logParserStore.get(input.id, await scopeOf(input));
     if (!parser) {
-      throw new TRPCError7({ code: "NOT_FOUND", message: `Parser not found: ${input.id}` });
+      throw new TRPCError8({ code: "NOT_FOUND", message: `Parser not found: ${input.id}` });
     }
     return parser;
   }),
@@ -2621,7 +2713,7 @@ var settingsRouter = router({
   ).mutation(async ({ input }) => {
     const { orgId, projectId, ...fields } = input;
     if (!fields.code.trim()) {
-      throw new TRPCError7({ code: "BAD_REQUEST", message: "Parser code cannot be empty" });
+      throw new TRPCError8({ code: "BAD_REQUEST", message: "Parser code cannot be empty" });
     }
     return logParserStore.create(fields, await scopeOf({ orgId, projectId }));
   }),
@@ -2636,27 +2728,27 @@ var settingsRouter = router({
   ).mutation(async ({ input }) => {
     const { id, orgId, projectId, ...patch } = input;
     if (id.startsWith("native:")) {
-      throw new TRPCError7({ code: "FORBIDDEN", message: "Cannot modify built-in parsers" });
+      throw new TRPCError8({ code: "FORBIDDEN", message: "Cannot modify built-in parsers" });
     }
     if (patch.code !== void 0 && !patch.code.trim()) {
-      throw new TRPCError7({ code: "BAD_REQUEST", message: "Parser code cannot be empty" });
+      throw new TRPCError8({ code: "BAD_REQUEST", message: "Parser code cannot be empty" });
     }
     const updated = await logParserStore.update(id, patch, await scopeOf({ orgId, projectId }));
     if (!updated) {
-      throw new TRPCError7({ code: "NOT_FOUND", message: `Parser not found: ${id}` });
+      throw new TRPCError8({ code: "NOT_FOUND", message: `Parser not found: ${id}` });
     }
     return updated;
   }),
   /**
    * Delete parser by ID
    */
-  deleteParser: protectedProcedure.input(z10.object({ id: z10.string().max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  deleteParser: protectedProcedure.input(z11.object({ id: z11.string().max(128), ...ScopeShape })).mutation(async ({ input }) => {
     if (input.id.startsWith("native:")) {
-      throw new TRPCError7({ code: "FORBIDDEN", message: "Cannot delete built-in parsers" });
+      throw new TRPCError8({ code: "FORBIDDEN", message: "Cannot delete built-in parsers" });
     }
     const deleted = await logParserStore.delete(input.id, await scopeOf(input));
     if (!deleted) {
-      throw new TRPCError7({ code: "NOT_FOUND", message: `Parser not found: ${input.id}` });
+      throw new TRPCError8({ code: "NOT_FOUND", message: `Parser not found: ${input.id}` });
     }
     return { deleted: true };
   }),
@@ -2688,11 +2780,11 @@ var settingsRouter = router({
       defaultPrompt: companionDefaultPrompt()
     };
   }),
-  setCompanionSettings: protectedProcedure.input(z10.object({
-    enabledByDefault: z10.boolean().optional(),
+  setCompanionSettings: protectedProcedure.input(z11.object({
+    enabledByDefault: z11.boolean().optional(),
     // Rejeté au-delà, jamais tronqué : un prompt coupé produirait des
     // relectures incohérentes sans rien signaler.
-    prompt: z10.string().max(2e4).optional()
+    prompt: z11.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     const settings = await settingsManager.getSettings();
     const current2 = settings.companion ?? { enabledByDefault: false };
@@ -2711,7 +2803,7 @@ var settingsRouter = router({
   /**
    * List AI providers (API keys are masked)
    */
-  listAIProviders: protectedProcedure.input(z10.object(ScopeShape).optional()).query(async ({ input }) => {
+  listAIProviders: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     return (priv.aiProviders ?? []).map((p) => {
@@ -2729,16 +2821,16 @@ var settingsRouter = router({
   /**
    * Create AI provider
    */
-  createAIProvider: protectedProcedure.input(z10.object({
-    name: z10.string().min(1).max(200),
+  createAIProvider: protectedProcedure.input(z11.object({
+    name: z11.string().min(1).max(200),
     provider: AIProviderSchema.shape.provider,
-    apiKey: z10.string().max(500).optional(),
+    apiKey: z11.string().max(500).optional(),
     // optional for providers like Ollama
-    model: z10.string().max(200).optional(),
+    model: z11.string().max(200).optional(),
     ...ScopeShape
   })).mutation(async ({ input }) => {
     if (input.provider !== "ollama" && !input.apiKey?.trim()) {
-      throw new TRPCError7({ code: "BAD_REQUEST", message: "Une cl\xE9 API est requise pour ce provider." });
+      throw new TRPCError8({ code: "BAD_REQUEST", message: "Une cl\xE9 API est requise pour ce provider." });
     }
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
@@ -2767,19 +2859,19 @@ var settingsRouter = router({
   /**
    * Update AI provider (apiKey optional — omit to keep existing)
    */
-  updateAIProvider: protectedProcedure.input(z10.object({
-    id: z10.string().min(1).max(128),
-    name: z10.string().min(1).max(200).optional(),
+  updateAIProvider: protectedProcedure.input(z11.object({
+    id: z11.string().min(1).max(128),
+    name: z11.string().min(1).max(200).optional(),
     provider: AIProviderSchema.shape.provider.optional(),
-    apiKey: z10.string().min(1).max(500).optional(),
-    model: z10.string().max(200).optional(),
+    apiKey: z11.string().min(1).max(500).optional(),
+    model: z11.string().max(200).optional(),
     ...ScopeShape
   })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const idx = providers.findIndex((p) => p.id === input.id);
-    if (idx === -1) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
+    if (idx === -1) throw new TRPCError8({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const existing = providers[idx];
     const encryptedApiKey = input.apiKey ? stableEncryptValue(input.apiKey, existing.encryptedApiKey, vault) : existing.encryptedApiKey;
     const updated = {
@@ -2805,12 +2897,12 @@ var settingsRouter = router({
   /**
    * Delete AI provider
    */
-  deleteAIProvider: protectedProcedure.input(z10.object({ id: z10.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  deleteAIProvider: protectedProcedure.input(z11.object({ id: z11.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const filtered = providers.filter((p) => p.id !== input.id);
-    if (filtered.length === providers.length) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
+    if (filtered.length === providers.length) throw new TRPCError8({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const deletedWasActive = providers.find((p) => p.id === input.id)?.active ?? false;
     if (deletedWasActive && filtered.length > 0) filtered[0].active = true;
     await settingsManager.savePrivateSettings({ ...priv, aiProviders: filtered }, vault);
@@ -2819,12 +2911,12 @@ var settingsRouter = router({
   /**
    * Set one provider as active (clears active flag on all others)
    */
-  setActiveAIProvider: protectedProcedure.input(z10.object({ id: z10.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  setActiveAIProvider: protectedProcedure.input(z11.object({ id: z11.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const idx = providers.findIndex((p) => p.id === input.id);
-    if (idx === -1) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
+    if (idx === -1) throw new TRPCError8({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const updated = providers.map((p) => ({ ...p, active: p.id === input.id }));
     await settingsManager.savePrivateSettings({ ...priv, aiProviders: updated }, vault);
     return { id: input.id, active: true };
@@ -2835,7 +2927,7 @@ var settingsRouter = router({
   /**
    * Get Traefik config for a specific agent (never returns credentials or cert key in plain text)
    */
-  getAgentTraefikConfig: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikConfig: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -2855,16 +2947,16 @@ var settingsRouter = router({
   /**
    * Update Traefik config for a specific agent (credentials are encrypted before saving)
    */
-  updateAgentTraefikConfig: protectedProcedure.input(z10.object({
-    agentId: z10.string().max(128),
-    enabled: z10.boolean().optional(),
-    acmeEmail: z10.string().email().max(256).optional(),
-    wildcardDomain: z10.string().max(253).optional(),
-    httpPort: z10.number().int().min(1).max(65535).optional(),
-    httpsPort: z10.number().int().min(1).max(65535).optional(),
-    dnsProvider: z10.string().max(64).optional(),
-    dnsCredentials: z10.record(z10.string().max(64), z10.string().max(2048)).optional(),
-    acmeStaging: z10.boolean().optional()
+  updateAgentTraefikConfig: protectedProcedure.input(z11.object({
+    agentId: z11.string().max(128),
+    enabled: z11.boolean().optional(),
+    acmeEmail: z11.string().email().max(256).optional(),
+    wildcardDomain: z11.string().max(253).optional(),
+    httpPort: z11.number().int().min(1).max(65535).optional(),
+    httpsPort: z11.number().int().min(1).max(65535).optional(),
+    dnsProvider: z11.string().max(64).optional(),
+    dnsCredentials: z11.record(z11.string().max(64), z11.string().max(2048)).optional(),
+    acmeStaging: z11.boolean().optional()
   })).mutation(async ({ input }) => {
     const { agentId, ...fields } = input;
     const raw = agentStore.getTraefikConfig(agentId);
@@ -2893,13 +2985,13 @@ var settingsRouter = router({
   /**
    * Get Traefik config files content for a specific agent
    */
-  getAgentTraefikConfigFiles: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikConfigFiles: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "config.getTraefikConfigFiles"
     );
   }),
-  getAgentTraefikFileTree: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikFileTree: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "config.getTraefikFileTree"
@@ -2908,7 +3000,7 @@ var settingsRouter = router({
   /**
    * Get Traefik container logs for a specific agent (snapshot)
    */
-  getAgentTraefikLogs: protectedProcedure.input(z10.object({ agentId: z10.string().max(128), lines: z10.number().int().min(1).max(500).default(100) })).query(async ({ input }) => {
+  getAgentTraefikLogs: protectedProcedure.input(z11.object({ agentId: z11.string().max(128), lines: z11.number().int().min(1).max(500).default(100) })).query(async ({ input }) => {
     const result = await agentManager.agentQuery(
       input.agentId,
       "config.getTraefikLogs",
@@ -2919,7 +3011,7 @@ var settingsRouter = router({
   /**
    * Stream Traefik logs in real-time (subscription, yields new lines every 500ms)
    */
-  streamAgentTraefikLogs: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).subscription(async function* ({ input, signal }) {
+  streamAgentTraefikLogs: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).subscription(async function* ({ input, signal }) {
     let seen = 0;
     while (!signal?.aborted) {
       try {
@@ -2942,11 +3034,11 @@ var settingsRouter = router({
   /**
    * Restart Traefik container on a specific agent (re-pushes config first to handle agent restarts)
    */
-  restartAgentTraefik: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).mutation(async ({ input }) => {
+  restartAgentTraefik: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).mutation(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
-    if (!config?.enabled) throw new TRPCError7({ code: "BAD_REQUEST", message: "Traefik non activ\xE9 sur cet agent" });
+    if (!config?.enabled) throw new TRPCError8({ code: "BAD_REQUEST", message: "Traefik non activ\xE9 sur cet agent" });
     const decrypted = { ...config, dnsCredentials: traefikManager.decryptDnsCredentials(config.dnsCredentials ?? {}) };
     await agentManager.agentMutation(input.agentId, "config.initTraefikConfig", decrypted, 5e3);
     await agentManager.agentMutation(input.agentId, "config.restartTraefik", void 0, 3e4);
@@ -2955,11 +3047,11 @@ var settingsRouter = router({
   /**
    * Force certificate renewal for a specific agent (wipes acme.json + restarts container)
    */
-  renewAgentTraefikCert: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).mutation(async ({ input }) => {
+  renewAgentTraefikCert: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).mutation(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
-    if (!config?.enabled) throw new TRPCError7({ code: "BAD_REQUEST", message: "Traefik non activ\xE9 sur cet agent" });
+    if (!config?.enabled) throw new TRPCError8({ code: "BAD_REQUEST", message: "Traefik non activ\xE9 sur cet agent" });
     const decrypted = { ...config, dnsCredentials: traefikManager.decryptDnsCredentials(config.dnsCredentials ?? {}) };
     await agentManager.agentMutation(input.agentId, "config.initTraefikConfig", decrypted, 5e3);
     await agentManager.agentMutation(input.agentId, "config.renewTraefikCert", void 0, 3e4);
@@ -2968,7 +3060,7 @@ var settingsRouter = router({
   /**
    * Validate Traefik configuration for a specific agent
    */
-  validateAgentTraefikConfig: protectedProcedure.input(z10.object({ agentId: z10.string().max(128) })).query(async ({ input }) => {
+  validateAgentTraefikConfig: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -3070,12 +3162,12 @@ var settingsRouter = router({
    * Test parser code: compile and run it against sample logs, return per-line results
    */
   testParser: protectedProcedure.input(
-    z10.object({
-      code: z10.string().max(5e4),
-      sampleLogs: z10.array(
-        z10.object({
-          raw: z10.string().max(16384),
-          stream: z10.enum(["stdout", "stderr"])
+    z11.object({
+      code: z11.string().max(5e4),
+      sampleLogs: z11.array(
+        z11.object({
+          raw: z11.string().max(16384),
+          stream: z11.enum(["stdout", "stderr"])
         })
       ).max(100).default([])
     })
@@ -3091,7 +3183,7 @@ var settingsRouter = router({
         updatedAt: /* @__PURE__ */ new Date()
       }]);
     } catch (err) {
-      throw new TRPCError7({
+      throw new TRPCError8({
         code: "BAD_REQUEST",
         message: err instanceof Error ? err.message : String(err)
       });
@@ -3119,8 +3211,8 @@ var settingsRouter = router({
 });
 
 // ../server/src/trpc/routers/editor.ts
-import { z as z12 } from "zod";
-import { TRPCError as TRPCError8 } from "@trpc/server";
+import { z as z13 } from "zod";
+import { TRPCError as TRPCError9 } from "@trpc/server";
 import { execFile as execFile3, spawn as spawn2 } from "child_process";
 import { stat as stat2 } from "fs/promises";
 import { resolve, join as join4 } from "path";
@@ -3130,19 +3222,19 @@ import { homedir as homedir2 } from "os";
 import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { join as join3 } from "path";
 import { homedir } from "os";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var CONFIG_DIR = join3(homedir(), ".runeya");
 var CONFIG_FILE = "runeya.conf";
-var EditorPreferencesSchema = z11.object({
-  default: z11.string().max(64).optional()
-}).catchall(z11.string().max(64)).refine((obj) => Object.keys(obj).length <= 500, "Too many editor preferences");
-var ProjectSettingsSchema = z11.object({
-  settings: z11.object({
+var EditorPreferencesSchema = z12.object({
+  default: z12.string().max(64).optional()
+}).catchall(z12.string().max(64)).refine((obj) => Object.keys(obj).length <= 500, "Too many editor preferences");
+var ProjectSettingsSchema = z12.object({
+  settings: z12.object({
     editors: EditorPreferencesSchema.optional()
   }).optional()
 });
-var UserConfigSchema = z11.record(
-  z11.string().max(128),
+var UserConfigSchema = z12.record(
+  z12.string().max(128),
   ProjectSettingsSchema
 ).refine((obj) => Object.keys(obj).length <= 100, "Too many projects in config");
 function configKey(ref) {
@@ -3213,7 +3305,7 @@ async function getServiceCwd(serviceId) {
   const services = await serviceStore.list();
   const service = services.find((s) => s.id === serviceId);
   if (!service) {
-    throw new TRPCError8({ code: "NOT_FOUND", message: "Service not found" });
+    throw new TRPCError9({ code: "NOT_FOUND", message: "Service not found" });
   }
   return resolveCwd(await resolveWorkspaceCwd({ serviceId }));
 }
@@ -3234,19 +3326,19 @@ var editorRouter = router({
     );
     return results;
   }),
-  getPreferences: protectedProcedure.input(z12.object({
-    projectId: z12.string().max(128),
-    orgId: z12.string().max(128).nullable().optional()
+  getPreferences: protectedProcedure.input(z13.object({
+    projectId: z13.string().max(128),
+    orgId: z13.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return userConfigManager.getEditorPreferences({ id: input.projectId, orgId: input.orgId });
   }),
-  setDefault: protectedProcedure.input(z12.object({
-    projectId: z12.string().max(128),
-    orgId: z12.string().max(128).nullable().optional(),
-    editorKey: z12.string().max(64)
+  setDefault: protectedProcedure.input(z13.object({
+    projectId: z13.string().max(128),
+    orgId: z13.string().max(128).nullable().optional(),
+    editorKey: z13.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     await userConfigManager.setEditorPreference(
       { id: input.projectId, orgId: input.orgId },
@@ -3255,14 +3347,14 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  setServiceEditor: protectedProcedure.input(z12.object({
-    projectId: z12.string().max(128),
-    orgId: z12.string().max(128).nullable().optional(),
-    serviceId: z12.string().max(128),
-    editorKey: z12.string().max(64)
+  setServiceEditor: protectedProcedure.input(z13.object({
+    projectId: z13.string().max(128),
+    orgId: z13.string().max(128).nullable().optional(),
+    serviceId: z13.string().max(128),
+    editorKey: z13.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     await userConfigManager.setEditorPreference(
       { id: input.projectId, orgId: input.orgId },
@@ -3271,10 +3363,10 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  removeServiceEditor: protectedProcedure.input(z12.object({
-    projectId: z12.string().max(128),
-    orgId: z12.string().max(128).nullable().optional(),
-    serviceId: z12.string().max(128)
+  removeServiceEditor: protectedProcedure.input(z13.object({
+    projectId: z13.string().max(128),
+    orgId: z13.string().max(128).nullable().optional(),
+    serviceId: z13.string().max(128)
   })).mutation(async ({ input }) => {
     await userConfigManager.removeEditorPreference(
       { id: input.projectId, orgId: input.orgId },
@@ -3282,21 +3374,21 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  open: protectedProcedure.input(z12.object({
-    editorKey: z12.string().max(64),
-    path: z12.string().max(4096)
+  open: protectedProcedure.input(z13.object({
+    editorKey: z13.string().max(64),
+    path: z13.string().max(4096)
   })).mutation(async ({ input }) => {
     const editor = EDITOR_BY_KEY.get(input.editorKey);
     if (!editor) {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const expanded = input.path.replace(/^~(\/|$)/, `${process.env["HOME"] ?? "/tmp"}$1`).replace(/\$\{(\w+)\}|\$(\w+)/g, (_, a, b) => process.env[a || b] ?? "");
     const resolvedPath = resolve(expanded || ".");
     try {
       await stat2(resolvedPath);
     } catch (err) {
-      if (err instanceof TRPCError8) throw err;
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `Path does not exist: ${resolvedPath}` });
+      if (err instanceof TRPCError9) throw err;
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `Path does not exist: ${resolvedPath}` });
     }
     const invocation = resolveCliInvocation(editor.command, [resolvedPath]);
     const child = spawn2(invocation.command, invocation.args, {
@@ -3308,24 +3400,24 @@ var editorRouter = router({
     child.unref();
     return { success: true };
   }),
-  openFile: protectedProcedure.input(z12.object({
-    editorKey: z12.string().max(64),
-    serviceId: z12.string().max(128),
-    relativePath: z12.string().max(4096)
+  openFile: protectedProcedure.input(z13.object({
+    editorKey: z13.string().max(64),
+    serviceId: z13.string().max(128),
+    relativePath: z13.string().max(4096)
   })).mutation(async ({ input }) => {
     const editor = EDITOR_BY_KEY.get(input.editorKey);
     if (!editor) {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const cwd = await getServiceCwd(input.serviceId);
     const filePath = join4(cwd, input.relativePath);
     if (!filePath.startsWith(cwd)) {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: "Path traversal not allowed" });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: "Path traversal not allowed" });
     }
     try {
       await stat2(filePath);
     } catch {
-      throw new TRPCError8({ code: "BAD_REQUEST", message: `File does not exist: ${filePath}` });
+      throw new TRPCError9({ code: "BAD_REQUEST", message: `File does not exist: ${filePath}` });
     }
     const invocation = resolveCliInvocation(editor.command, [filePath]);
     const child = spawn2(invocation.command, invocation.args, {
@@ -3340,8 +3432,8 @@ var editorRouter = router({
 });
 
 // ../server/src/trpc/routers/api-keys.ts
-import { z as z13 } from "zod";
-import { TRPCError as TRPCError9 } from "@trpc/server";
+import { z as z14 } from "zod";
+import { TRPCError as TRPCError10 } from "@trpc/server";
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
 import { join as join5, dirname as dirname3 } from "path";
 var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
@@ -3349,46 +3441,46 @@ var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
   ".cursor/rules/runeya.mdc",
   ".windsurf/rules/runeya.md"
 ]);
-var KeyInputSchema = z13.object({
-  name: z13.string().min(1).max(200),
+var KeyInputSchema = z14.object({
+  name: z14.string().min(1).max(200),
   scopes: ApiKeyScopeSchema,
-  isPublic: z13.boolean().default(false)
+  isPublic: z14.boolean().default(false)
 });
 var apiKeysRouter = router({
   list: protectedProcedure.query(() => apiKeyStore.list()),
-  create: protectedProcedure.input(KeyInputSchema.extend({ orgId: z13.string().min(1).max(128).nullable().optional() })).mutation(
+  create: protectedProcedure.input(KeyInputSchema.extend({ orgId: z14.string().min(1).max(128).nullable().optional() })).mutation(
     ({ input }) => apiKeyStore.create(input.name, input.scopes, input.isPublic, input.orgId ?? null)
   ),
   /**
    * Renvoie le secret d'une seule clé, sur demande explicite. `list` ne le
    * contient pas : une clé ne doit jamais être re-servie en masse.
    */
-  reveal: protectedProcedure.input(z13.object({ id: z13.string().max(128) })).query(async ({ input }) => {
+  reveal: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).query(async ({ input }) => {
     const key = await apiKeyStore.reveal(input.id);
-    if (!key) throw new TRPCError9({ code: "NOT_FOUND", message: "API key not found" });
+    if (!key) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return { key };
   }),
-  update: protectedProcedure.input(KeyInputSchema.extend({ id: z13.string().max(128) })).mutation(async ({ input }) => {
+  update: protectedProcedure.input(KeyInputSchema.extend({ id: z14.string().max(128) })).mutation(async ({ input }) => {
     const updated = await apiKeyStore.update(input.id, input.name, input.scopes, input.isPublic);
-    if (!updated) throw new TRPCError9({ code: "NOT_FOUND", message: "API key not found" });
+    if (!updated) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return maskApiKey(updated);
   }),
-  remove: protectedProcedure.input(z13.object({ id: z13.string().max(128) })).mutation(async ({ input }) => {
+  remove: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).mutation(async ({ input }) => {
     const removed = await apiKeyStore.remove(input.id);
-    if (!removed) throw new TRPCError9({ code: "NOT_FOUND", message: "API key not found" });
+    if (!removed) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return { success: true };
   }),
-  renewKey: protectedProcedure.input(z13.object({ id: z13.string().max(128) })).mutation(async ({ input }) => {
+  renewKey: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).mutation(async ({ input }) => {
     const renewed = await apiKeyStore.renewKey(input.id);
-    if (!renewed) throw new TRPCError9({ code: "NOT_FOUND", message: "API key not found" });
+    if (!renewed) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return renewed;
   }),
-  writeSkillFile: protectedProcedure.input(z13.object({
-    relativePath: z13.string().max(256),
-    content: z13.string().max(32768)
+  writeSkillFile: protectedProcedure.input(z14.object({
+    relativePath: z14.string().max(256),
+    content: z14.string().max(32768)
   })).mutation(async ({ input }) => {
     if (!ALLOWED_SKILL_PATHS.has(input.relativePath)) {
-      throw new TRPCError9({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
+      throw new TRPCError10({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
     }
     const abs = join5(await resolveWorkspaceCwd({}), input.relativePath);
     await mkdir3(dirname3(abs), { recursive: true });
@@ -3398,133 +3490,133 @@ var apiKeysRouter = router({
 });
 
 // ../server/src/trpc/routers/git.ts
-import { z as z14 } from "zod";
-import { TRPCError as TRPCError10 } from "@trpc/server";
+import { z as z15 } from "zod";
+import { TRPCError as TRPCError11 } from "@trpc/server";
 import Anthropic from "@anthropic-ai/sdk";
 import OpenAI from "openai";
-var SERVICE_ID_SCHEMA = z14.string().max(128);
-var SAFE_PATH_SCHEMA = z14.string().min(1).max(4096).refine((p) => !p.startsWith("/") && !p.includes("../"), {
+var SERVICE_ID_SCHEMA = z15.string().max(128);
+var SAFE_PATH_SCHEMA = z15.string().min(1).max(4096).refine((p) => !p.startsWith("/") && !p.includes("../"), {
   message: "Path must be relative and not traverse up"
 });
-var REMOTE_SCHEMA = z14.string().min(1).max(128).regex(/^[a-zA-Z0-9_\-.]+$/);
-var BRANCH_SCHEMA = z14.string().min(1).max(256).regex(/^[a-zA-Z0-9._\-/]+$/);
+var REMOTE_SCHEMA = z15.string().min(1).max(128).regex(/^[a-zA-Z0-9_\-.]+$/);
+var BRANCH_SCHEMA = z15.string().min(1).max(256).regex(/^[a-zA-Z0-9._\-/]+$/);
 async function resolveServiceContext(serviceId) {
   const service = await serviceStore.get(serviceId);
   if (!service) {
-    throw new TRPCError10({ code: "NOT_FOUND", message: "Service not found" });
+    throw new TRPCError11({ code: "NOT_FOUND", message: "Service not found" });
   }
   const agentId = await resolveEffectiveAgentId(service);
   if (!agentId) {
-    throw new TRPCError10({ code: "BAD_REQUEST", message: "No agent configured for this service" });
+    throw new TRPCError11({ code: "BAD_REQUEST", message: "No agent configured for this service" });
   }
   return { agentId, cwd: await resolveWorkspaceCwd({ serviceId }) };
 }
 var gitTargetShape = {
   serviceId: SERVICE_ID_SCHEMA.optional(),
-  agentId: z14.string().max(128).optional(),
+  agentId: z15.string().max(128).optional(),
   /** Anchors on a project when no service is targeted (e.g. from the AI chat). */
-  projectId: z14.string().max(128).optional(),
+  projectId: z15.string().max(128).optional(),
   /** Son organisation : un id de projet seul peut en nommer un par organisation. */
-  orgId: z14.string().max(128).nullable().optional()
+  orgId: z15.string().max(128).nullable().optional()
 };
 async function resolveGitContext(input) {
   if (input.serviceId) return resolveServiceContext(input.serviceId);
   const agentId = input.agentId ?? agentManager.getDefaultAgentId();
   if (!agentId) {
-    throw new TRPCError10({ code: "BAD_REQUEST", message: "No agent available" });
+    throw new TRPCError11({ code: "BAD_REQUEST", message: "No agent available" });
   }
   const cwd = await resolveAgentCwd({ projectId: input.projectId, orgId: input.orgId }) ?? ".";
   return { agentId, cwd };
 }
 var gitRouter = router({
   /** Get full git status */
-  status: protectedProcedure.input(z14.object({ ...gitTargetShape })).query(async ({ input }) => {
+  status: protectedProcedure.input(z15.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.status", { cwd });
   }),
   /** Get commit log */
-  log: protectedProcedure.input(z14.object({ ...gitTargetShape, limit: z14.number().int().min(1).max(200).default(50) })).query(async ({ input }) => {
+  log: protectedProcedure.input(z15.object({ ...gitTargetShape, limit: z15.number().int().min(1).max(200).default(50) })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.log", { cwd, limit: input.limit });
   }),
   /** List local and remote branches */
-  branches: protectedProcedure.input(z14.object({ ...gitTargetShape })).query(async ({ input }) => {
+  branches: protectedProcedure.input(z15.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.branches", { cwd });
   }),
   /** Checkout a branch */
-  checkout: protectedProcedure.input(z14.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, create: z14.boolean().default(false) })).mutation(async ({ input }) => {
+  checkout: protectedProcedure.input(z15.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, create: z15.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.checkout", { cwd, branch: input.branch, create: input.create });
   }),
   /** Stage files */
-  stage: protectedProcedure.input(z14.object({ ...gitTargetShape, paths: z14.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  stage: protectedProcedure.input(z15.object({ ...gitTargetShape, paths: z15.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stage", { cwd, paths: input.paths });
   }),
   /** Stage all files */
-  stageAll: protectedProcedure.input(z14.object({ ...gitTargetShape })).mutation(async ({ input }) => {
+  stageAll: protectedProcedure.input(z15.object({ ...gitTargetShape })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stageAll", { cwd });
   }),
   /** Unstage files */
-  unstage: protectedProcedure.input(z14.object({ ...gitTargetShape, paths: z14.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  unstage: protectedProcedure.input(z15.object({ ...gitTargetShape, paths: z15.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.unstage", { cwd, paths: input.paths });
   }),
   /** Unstage all files */
-  unstageAll: protectedProcedure.input(z14.object({ ...gitTargetShape })).mutation(async ({ input }) => {
+  unstageAll: protectedProcedure.input(z15.object({ ...gitTargetShape })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.unstageAll", { cwd });
   }),
   /** Commit staged changes */
-  commit: protectedProcedure.input(z14.object({ ...gitTargetShape, message: z14.string().min(1).max(4096) })).mutation(async ({ input }) => {
+  commit: protectedProcedure.input(z15.object({ ...gitTargetShape, message: z15.string().min(1).max(4096) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.commit", { cwd, message: input.message });
   }),
   /** Push to remote */
-  push: protectedProcedure.input(z14.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin"), setUpstream: z14.boolean().default(false) })).mutation(async ({ input }) => {
+  push: protectedProcedure.input(z15.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin"), setUpstream: z15.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.push", { cwd, remote: input.remote, setUpstream: input.setUpstream });
   }),
   /** Pull from remote */
-  pull: protectedProcedure.input(z14.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
+  pull: protectedProcedure.input(z15.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.pull", { cwd, remote: input.remote });
   }),
   /** Fetch from remote */
-  fetch: protectedProcedure.input(z14.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
+  fetch: protectedProcedure.input(z15.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.fetch", { cwd, remote: input.remote });
   }),
   /** Get diff for a file or the whole index */
-  diff: protectedProcedure.input(z14.object({
+  diff: protectedProcedure.input(z15.object({
     ...gitTargetShape,
-    path: z14.string().max(4096).optional(),
-    staged: z14.boolean().default(false),
-    untracked: z14.boolean().default(false)
+    path: z15.string().max(4096).optional(),
+    staged: z15.boolean().default(false),
+    untracked: z15.boolean().default(false)
   })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.diff", { cwd, path: input.path, staged: input.staged, untracked: input.untracked });
   }),
   /** Discard changes to working tree files */
-  discard: protectedProcedure.input(z14.object({ ...gitTargetShape, paths: z14.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  discard: protectedProcedure.input(z15.object({ ...gitTargetShape, paths: z15.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.discard", { cwd, paths: input.paths });
   }),
   /** Generate a commit message from staged diffs using AI (diff fetched from agent, AI runs on server) */
-  generateCommitMessage: protectedProcedure.input(z14.object({ ...gitTargetShape, providerId: OptionalProviderIdSchema, model: z14.string().max(200).optional() })).mutation(async ({ input }) => {
+  generateCommitMessage: protectedProcedure.input(z15.object({ ...gitTargetShape, providerId: OptionalProviderIdSchema, model: z15.string().max(200).optional() })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     const { diff } = await agentManager.agentQuery(agentId, "git.stagedDiff", { cwd });
     if (!diff.trim()) {
-      throw new TRPCError10({ code: "BAD_REQUEST", message: "No staged changes to generate a commit message from" });
+      throw new TRPCError11({ code: "BAD_REQUEST", message: "No staged changes to generate a commit message from" });
     }
     const active = await getActiveProvider(
       input.providerId,
       input.orgId ?? await vaultOfProject(input.projectId)
     );
     if (!active) {
-      throw new TRPCError10({ code: "BAD_REQUEST", message: "No AI provider configured" });
+      throw new TRPCError11({ code: "BAD_REQUEST", message: "No AI provider configured" });
     }
     const systemPrompt = `You are a git commit message generator. Given a git diff, write a concise and meaningful conventional commit message (e.g. feat:, fix:, refactor:, chore:, docs:, style:, test:).
 Rules:
@@ -3557,45 +3649,45 @@ Rules:
       });
       return { message: res.choices[0]?.message?.content?.trim() ?? "" };
     }
-    throw new TRPCError10({ code: "BAD_REQUEST", message: "Unsupported AI provider" });
+    throw new TRPCError11({ code: "BAD_REQUEST", message: "Unsupported AI provider" });
   }),
   /** Merge a branch into the current branch */
-  merge: protectedProcedure.input(z14.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, noFf: z14.boolean().default(false) })).mutation(async ({ input }) => {
+  merge: protectedProcedure.input(z15.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, noFf: z15.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.merge", { cwd, branch: input.branch, noFf: input.noFf });
   }),
   /** Rebase current branch onto another branch */
-  rebase: protectedProcedure.input(z14.object({ ...gitTargetShape, branch: BRANCH_SCHEMA })).mutation(async ({ input }) => {
+  rebase: protectedProcedure.input(z15.object({ ...gitTargetShape, branch: BRANCH_SCHEMA })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.rebase", { cwd, branch: input.branch });
   }),
   /** List stash entries */
-  stashList: protectedProcedure.input(z14.object({ ...gitTargetShape })).query(async ({ input }) => {
+  stashList: protectedProcedure.input(z15.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.stashList", { cwd });
   }),
   /** Stash current changes */
-  stashPush: protectedProcedure.input(z14.object({ ...gitTargetShape, message: z14.string().max(4096).optional(), includeUntracked: z14.boolean().default(true) })).mutation(async ({ input }) => {
+  stashPush: protectedProcedure.input(z15.object({ ...gitTargetShape, message: z15.string().max(4096).optional(), includeUntracked: z15.boolean().default(true) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashPush", { cwd, message: input.message, includeUntracked: input.includeUntracked });
   }),
   /** Pop a stash entry */
-  stashPop: protectedProcedure.input(z14.object({ ...gitTargetShape, index: z14.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashPop: protectedProcedure.input(z15.object({ ...gitTargetShape, index: z15.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashPop", { cwd, index: input.index });
   }),
   /** Apply a stash entry without dropping it */
-  stashApply: protectedProcedure.input(z14.object({ ...gitTargetShape, index: z14.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashApply: protectedProcedure.input(z15.object({ ...gitTargetShape, index: z15.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashApply", { cwd, index: input.index });
   }),
   /** Drop a stash entry */
-  stashDrop: protectedProcedure.input(z14.object({ ...gitTargetShape, index: z14.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashDrop: protectedProcedure.input(z15.object({ ...gitTargetShape, index: z15.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashDrop", { cwd, index: input.index });
   }),
   /** Watch .git/ for changes and stream updated status */
-  onStatusChange: protectedProcedure.input(z14.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
+  onStatusChange: protectedProcedure.input(z15.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
     const { agentId, cwd } = await resolveGitContext(input);
     const queue = [];
     let resolve4 = null;
@@ -3622,7 +3714,7 @@ Rules:
         }
       );
     } catch (err) {
-      throw new TRPCError10({
+      throw new TRPCError11({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to git status: ${err.message}`
       });
@@ -3642,7 +3734,7 @@ Rules:
     }
   }),
   /** List remotes */
-  remotes: protectedProcedure.input(z14.object({ ...gitTargetShape })).query(async ({ input }) => {
+  remotes: protectedProcedure.input(z15.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.remotes", { cwd });
   })
@@ -3650,41 +3742,41 @@ Rules:
 
 // ../server/src/trpc/routers/scenario.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { TRPCError as TRPCError13 } from "@trpc/server";
-import { z as z15 } from "zod";
+import { TRPCError as TRPCError14 } from "@trpc/server";
+import { z as z16 } from "zod";
 
 // ../server/src/trpc/crud-procedure-utils.ts
-import { TRPCError as TRPCError11 } from "@trpc/server";
+import { TRPCError as TRPCError12 } from "@trpc/server";
 async function getOrNotFound(getter, notFoundMessage) {
   const entity = await getter();
-  if (!entity) throw new TRPCError11({ code: "NOT_FOUND", message: notFoundMessage });
+  if (!entity) throw new TRPCError12({ code: "NOT_FOUND", message: notFoundMessage });
   return entity;
 }
 async function createOrBadRequest(creator) {
   try {
     return await creator();
   } catch (err) {
-    throw new TRPCError11({ code: "BAD_REQUEST", message: err.message });
+    throw new TRPCError12({ code: "BAD_REQUEST", message: err.message });
   }
 }
 async function updateOrThrow(updater, notFoundMessage) {
   try {
     const entity = await updater();
-    if (!entity) throw new TRPCError11({ code: "NOT_FOUND", message: notFoundMessage });
+    if (!entity) throw new TRPCError12({ code: "NOT_FOUND", message: notFoundMessage });
     return entity;
   } catch (err) {
-    if (err instanceof TRPCError11) throw err;
-    throw new TRPCError11({ code: "BAD_REQUEST", message: err.message });
+    if (err instanceof TRPCError12) throw err;
+    throw new TRPCError12({ code: "BAD_REQUEST", message: err.message });
   }
 }
 async function deleteOrNotFound(deleter, notFoundMessage) {
   const deleted = await deleter();
-  if (!deleted) throw new TRPCError11({ code: "NOT_FOUND", message: notFoundMessage });
+  if (!deleted) throw new TRPCError12({ code: "NOT_FOUND", message: notFoundMessage });
   return { ok: true };
 }
 
 // ../server/src/trpc/ai-generation-procedure-utils.ts
-import { TRPCError as TRPCError12 } from "@trpc/server";
+import { TRPCError as TRPCError13 } from "@trpc/server";
 
 // ../server/src/services/ai-generation.ts
 import Anthropic2 from "@anthropic-ai/sdk";
@@ -3740,7 +3832,7 @@ async function* streamProviderText(input) {
 // ../server/src/trpc/ai-generation-procedure-utils.ts
 async function* streamWithActiveProvider(opts) {
   const active = await getActiveProvider(opts.providerId, opts.vault);
-  if (!active) throw new TRPCError12({ code: "BAD_REQUEST", message: "Aucun fournisseur IA configur\xE9" });
+  if (!active) throw new TRPCError13({ code: "BAD_REQUEST", message: "Aucun fournisseur IA configur\xE9" });
   const { provider, plaintextKey } = active;
   const model = opts.model || provider.model || DEFAULT_MODELS[provider.provider] || "";
   try {
@@ -3758,7 +3850,7 @@ async function* streamWithActiveProvider(opts) {
     yield { type: "done", text: "" };
   } catch (err) {
     if (String(err?.message ?? "").startsWith("Unsupported provider:")) {
-      throw new TRPCError12({ code: "BAD_REQUEST", message: `Fournisseur non support\xE9: ${provider.provider}` });
+      throw new TRPCError13({ code: "BAD_REQUEST", message: `Fournisseur non support\xE9: ${provider.provider}` });
     }
     throw err;
   }
@@ -5250,28 +5342,28 @@ Modify the scenario. Keep existing ids when possible.`;
   return `Generate an scenario org-chart based on: ${userPrompt}`;
 }
 var ScopeShape2 = {
-  orgId: z15.string().max(128).nullable().optional(),
+  orgId: z16.string().max(128).nullable().optional(),
   projectId: Id128Schema.optional()
 };
 async function scopeOf2(input) {
   return input?.orgId ?? await vaultOfProject(input?.projectId);
 }
 var scenarioRouter = router({
-  list: protectedProcedure.input(z15.object(ScopeShape2).optional()).query(async ({ input }) => scenarioStore.list(await scopeOf2(input))),
-  get: protectedProcedure.input(z15.object({ id: Id128Schema, ...ScopeShape2 })).query(async ({ input }) => getOrNotFound(
+  list: protectedProcedure.input(z16.object(ScopeShape2).optional()).query(async ({ input }) => scenarioStore.list(await scopeOf2(input))),
+  get: protectedProcedure.input(z16.object({ id: Id128Schema, ...ScopeShape2 })).query(async ({ input }) => getOrNotFound(
     async () => scenarioStore.get(input.id, await scopeOf2(input)),
     "Scenario not found"
   )),
-  create: protectedProcedure.input(z15.object({
+  create: protectedProcedure.input(z16.object({
     name: NameSchema,
-    icon: z15.string().max(64).optional(),
+    icon: z16.string().max(64).optional(),
     description: DescriptionSchema.optional(),
     leaderId: Id128Schema,
-    groups: z15.array(ScenarioGroupSchema).max(100).optional(),
-    nodes: z15.array(ScenarioNodeSchema).min(1).max(500),
-    traversalMode: z15.enum(["hierarchical", "topological"]).optional(),
-    presetId: z15.string().max(128).optional(),
-    isPublished: z15.boolean().optional(),
+    groups: z16.array(ScenarioGroupSchema).max(100).optional(),
+    nodes: z16.array(ScenarioNodeSchema).min(1).max(500),
+    traversalMode: z16.enum(["hierarchical", "topological"]).optional(),
+    presetId: z16.string().max(128).optional(),
+    isPublished: z16.boolean().optional(),
     ...ScopeShape2
   })).mutation(({ input }) => {
     const now = Date.now();
@@ -5290,17 +5382,17 @@ var scenarioRouter = router({
       updatedAt: now
     }));
   }),
-  update: protectedProcedure.input(z15.object({
+  update: protectedProcedure.input(z16.object({
     id: Id128Schema,
     name: NameSchema.optional(),
-    icon: z15.string().max(64).optional(),
+    icon: z16.string().max(64).optional(),
     description: DescriptionSchema.optional(),
     leaderId: Id128Schema.optional(),
-    groups: z15.array(ScenarioGroupSchema).max(100).optional(),
-    nodes: z15.array(ScenarioNodeSchema).min(1).max(500).optional(),
-    traversalMode: z15.enum(["hierarchical", "topological"]).optional(),
-    presetId: z15.string().max(128).optional(),
-    isPublished: z15.boolean().optional(),
+    groups: z16.array(ScenarioGroupSchema).max(100).optional(),
+    nodes: z16.array(ScenarioNodeSchema).min(1).max(500).optional(),
+    traversalMode: z16.enum(["hierarchical", "topological"]).optional(),
+    presetId: z16.string().max(128).optional(),
+    isPublished: z16.boolean().optional(),
     ...ScopeShape2
   })).mutation(({ input }) => updateOrThrow(
     async () => scenarioStore.update(input.id, {
@@ -5317,25 +5409,25 @@ var scenarioRouter = router({
     }, await scopeOf2(input)),
     "Scenario not found"
   )),
-  delete: protectedProcedure.input(z15.object({ id: Id128Schema, ...ScopeShape2 })).mutation(({ input }) => deleteOrNotFound(
+  delete: protectedProcedure.input(z16.object({ id: Id128Schema, ...ScopeShape2 })).mutation(({ input }) => deleteOrNotFound(
     async () => scenarioStore.delete(input.id, await scopeOf2(input)),
     "Scenario not found"
   )),
-  run: protectedProcedure.input(z15.object({
+  run: protectedProcedure.input(z16.object({
     conversationId: ConversationIdSchema,
     scenarioId: Id128Schema,
-    userRequest: z15.string().max(1e5),
-    runnerOverride: z15.enum(["claude-code", "codex"]).optional(),
+    userRequest: z16.string().max(1e5),
+    runnerOverride: z16.enum(["claude-code", "codex"]).optional(),
     modelOverride: Id128Schema.optional(),
     agentId: Id128Schema.optional(),
     /** Anchors the run's working directory on the project it belongs to. */
     projectId: Id128Schema.optional(),
     /** Son organisation : sans elle, un id partagé désignerait un projet au hasard. */
-    orgId: z15.string().max(128).nullable().optional(),
-    resume: z15.boolean().optional()
+    orgId: z16.string().max(128).nullable().optional(),
+    resume: z16.boolean().optional()
   })).subscription(async function* ({ input, signal }) {
     const scenario = await scenarioStore.get(input.scenarioId, await scopeOf2(input));
-    if (!scenario) throw new TRPCError13({ code: "NOT_FOUND", message: "Scenario not found" });
+    if (!scenario) throw new TRPCError14({ code: "NOT_FOUND", message: "Scenario not found" });
     const canStart = input.userRequest.trim().length > 0 || !!input.resume;
     if (!isScenarioRunning(input.conversationId) && canStart) {
       let userRequest = input.userRequest;
@@ -5352,41 +5444,41 @@ var scenarioRouter = router({
     }
     yield* tapBus(input.conversationId, signal ?? new AbortController().signal);
   }),
-  stop: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
+  stop: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
     abortScenario(input.conversationId);
     return { ok: true };
   }),
-  sendNodeInput: protectedProcedure.input(z15.object({
+  sendNodeInput: protectedProcedure.input(z16.object({
     conversationId: ConversationIdSchema,
     nodeId: Id128Schema,
-    text: z15.string().min(1).max(1e5)
+    text: z16.string().min(1).max(1e5)
   })).mutation(({ input }) => {
     const resolved = resolveNodeInput(input.conversationId, input.nodeId, input.text);
-    if (!resolved) throw new TRPCError13({ code: "NOT_FOUND", message: "No pending input request for this node" });
+    if (!resolved) throw new TRPCError14({ code: "NOT_FOUND", message: "No pending input request for this node" });
     return { ok: true };
   }),
-  isRunning: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).query(({ input }) => ({ running: isScenarioRunning(input.conversationId) })),
-  runState: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).query(({ input }) => {
+  isRunning: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).query(({ input }) => ({ running: isScenarioRunning(input.conversationId) })),
+  runState: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).query(({ input }) => {
     const runState = scenarioRunStore.getRunState(input.conversationId);
     return runState ?? { nodeStates: {}, nodeOutputs: {}, activeNodeId: void 0 };
   }),
-  getPersistedRunState: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getPersistedRunState: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.loadPersistedRunState(input.conversationId);
   }),
-  getReadme: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getReadme: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.readReadme(input.conversationId);
   }),
-  getSnapshot: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getSnapshot: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.loadScenarioSnapshot(input.conversationId);
   }),
-  streamGenerateWithAI: protectedProcedure.input(z15.object({
-    prompt: z15.string().min(1).max(1e4),
+  streamGenerateWithAI: protectedProcedure.input(z16.object({
+    prompt: z16.string().min(1).max(1e4),
     providerId: OptionalProviderIdSchema,
-    model: z15.string().max(200).optional(),
-    current: z15.object({
+    model: z16.string().max(200).optional(),
+    current: z16.object({
       leaderId: Id128Schema,
-      groups: z15.array(ScenarioGroupSchema).max(100),
-      nodes: z15.array(ScenarioNodeSchema).max(500)
+      groups: z16.array(ScenarioGroupSchema).max(100),
+      nodes: z16.array(ScenarioNodeSchema).max(500)
     }).optional()
   })).subscription(async function* ({ input, signal }) {
     const userMessage = buildScenarioUserMessage(input.prompt, input.current);
@@ -5399,7 +5491,7 @@ var scenarioRouter = router({
       signal: signal ?? void 0
     });
   }),
-  streamRunEvents: protectedProcedure.input(z15.object({ conversationId: ConversationIdSchema })).subscription(async function* ({ input }) {
+  streamRunEvents: protectedProcedure.input(z16.object({ conversationId: ConversationIdSchema })).subscription(async function* ({ input }) {
     const convId = input.conversationId;
     const runState = scenarioRunStore.getRunState(convId);
     if (runState) {
@@ -5413,24 +5505,24 @@ var scenarioRouter = router({
    * open a debug PTY with `claude --resume <sessionId>` on the right agent.
    * Falls back to the persisted run-state for past nodes.
    */
-  getNodeSession: protectedProcedure.input(z15.object({
+  getNodeSession: protectedProcedure.input(z16.object({
     conversationId: ConversationIdSchema,
     nodeId: Id128Schema
   })).query(async ({ input }) => {
     return await scenarioRunStore.getNodeSessionPersistent(input.conversationId, input.nodeId);
   }),
   listPresets: protectedProcedure.query(() => listPresets()),
-  getPreset: protectedProcedure.input(z15.object({ id: Id128Schema })).query(({ input }) => {
+  getPreset: protectedProcedure.input(z16.object({ id: Id128Schema })).query(({ input }) => {
     const preset = getPreset(input.id);
-    if (!preset) throw new TRPCError13({ code: "NOT_FOUND", message: "Preset not found" });
+    if (!preset) throw new TRPCError14({ code: "NOT_FOUND", message: "Preset not found" });
     return preset;
   })
 });
 
 // ../server/src/trpc/routers/debug.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { TRPCError as TRPCError14 } from "@trpc/server";
-import { z as z16 } from "zod";
+import { TRPCError as TRPCError15 } from "@trpc/server";
+import { z as z17 } from "zod";
 var MAX_BUFFER2 = 300;
 var jobs = /* @__PURE__ */ new Map();
 function publish(job, event) {
@@ -5487,9 +5579,9 @@ async function* tapJob(job, signal) {
   }
 }
 var debugRouter = router({
-  startRandomJob: protectedProcedure.input(z16.object({
-    intervalMs: z16.number().int().min(100).max(5e3).optional(),
-    maxTicks: z16.number().int().min(1).max(1e4).optional()
+  startRandomJob: protectedProcedure.input(z17.object({
+    intervalMs: z17.number().int().min(100).max(5e3).optional(),
+    maxTicks: z17.number().int().min(1).max(1e4).optional()
   }).optional()).mutation(({ input }) => {
     const jobId = randomUUID4();
     const intervalMs = input?.intervalMs ?? 400;
@@ -5523,15 +5615,15 @@ var debugRouter = router({
     jobs.set(jobId, job);
     return { jobId, intervalMs, maxTicks, startedAt: job.startedAt };
   }),
-  streamRandomJob: protectedProcedure.input(z16.object({ jobId: z16.string().max(128) })).subscription(async function* ({ input, signal }) {
+  streamRandomJob: protectedProcedure.input(z17.object({ jobId: z17.string().max(128) })).subscription(async function* ({ input, signal }) {
     const job = jobs.get(input.jobId);
     if (!job) {
-      throw new TRPCError14({ code: "NOT_FOUND", message: "Random job not found" });
+      throw new TRPCError15({ code: "NOT_FOUND", message: "Random job not found" });
     }
     yield* tapJob(job, signal ?? new AbortController().signal);
   }),
-  stopRandomJob: protectedProcedure.input(z16.object({ jobId: z16.string().max(128) })).mutation(({ input }) => ({ ok: stopJob(input.jobId, "stopped") })),
-  randomJobStatus: protectedProcedure.input(z16.object({ jobId: z16.string().max(128) })).query(({ input }) => {
+  stopRandomJob: protectedProcedure.input(z17.object({ jobId: z17.string().max(128) })).mutation(({ input }) => ({ ok: stopJob(input.jobId, "stopped") })),
+  randomJobStatus: protectedProcedure.input(z17.object({ jobId: z17.string().max(128) })).query(({ input }) => {
     const job = jobs.get(input.jobId);
     return {
       running: !!job && !job.done,
@@ -5541,8 +5633,8 @@ var debugRouter = router({
 });
 
 // ../server/src/trpc/routers/diagnostics.ts
-import { z as z17 } from "zod";
-import { TRPCError as TRPCError15 } from "@trpc/server";
+import { z as z18 } from "zod";
+import { TRPCError as TRPCError16 } from "@trpc/server";
 
 // ../server/src/services/log-buffer.ts
 import { EventEmitter } from "events";
@@ -5613,7 +5705,7 @@ function onEntry(listener) {
 // ../server/src/trpc/routers/diagnostics.ts
 var diagnosticsRouter = router({
   /** Backlog for a client that just opened the panel. */
-  recentLogs: protectedProcedure.input(z17.object({ limit: z17.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
+  recentLogs: protectedProcedure.input(z18.object({ limit: z18.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
   /**
    * Live log stream.
    *
@@ -5622,7 +5714,7 @@ var diagnosticsRouter = router({
    * silently loses lines, which is precisely what someone watching a boot
    * failure cannot afford.
    */
-  streamLogs: protectedProcedure.input(z17.object({ afterSeq: z17.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
+  streamLogs: protectedProcedure.input(z18.object({ afterSeq: z18.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
     for (const entry of entriesSince(input?.afterSeq ?? 0)) yield entry;
     const queue = [];
     let wake = null;
@@ -5656,18 +5748,18 @@ var diagnosticsRouter = router({
    * refused. That is what keeps this from being a way to signal arbitrary
    * processes with the server's privileges.
    */
-  killInstance: protectedProcedure.input(z17.object({ pid: z17.number().int().positive() })).mutation(async ({ input }) => {
+  killInstance: protectedProcedure.input(z18.object({ pid: z18.number().int().positive() })).mutation(async ({ input }) => {
     try {
       return await killInstance(input.pid);
     } catch (err) {
       const reason = err.message;
       if (reason === "instance-not-found") {
-        throw new TRPCError15({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
+        throw new TRPCError16({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
       }
       if (reason === "instance-is-current") {
-        throw new TRPCError15({ code: "BAD_REQUEST", message: "This instance cannot stop itself." });
+        throw new TRPCError16({ code: "BAD_REQUEST", message: "This instance cannot stop itself." });
       }
-      throw new TRPCError15({ code: "INTERNAL_SERVER_ERROR", message: reason });
+      throw new TRPCError16({ code: "INTERNAL_SERVER_ERROR", message: reason });
     }
   }),
   /**
@@ -5684,7 +5776,7 @@ var diagnosticsRouter = router({
    * reproductible : instance trop ancienne pour avoir publié sa ligne de
    * commande, ou lancée avec un secret que le registre ne conserve pas.
    */
-  restartInstance: protectedProcedure.input(z17.object({ pid: z17.number().int().positive() })).mutation(async ({ input }) => {
+  restartInstance: protectedProcedure.input(z18.object({ pid: z18.number().int().positive() })).mutation(async ({ input }) => {
     try {
       if (input.pid === process.pid) {
         const { relauncherPid, port } = await scheduleSelfRestart();
@@ -5694,21 +5786,21 @@ var diagnosticsRouter = router({
     } catch (err) {
       const reason = err.message;
       if (reason === "instance-not-found") {
-        throw new TRPCError15({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
+        throw new TRPCError16({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
       }
       if (reason.startsWith("instance-not-restartable:")) {
-        throw new TRPCError15({
+        throw new TRPCError16({
           code: "BAD_REQUEST",
           message: `This instance cannot be restarted (${reason.split(":")[1]}).`
         });
       }
-      throw new TRPCError15({ code: "INTERNAL_SERVER_ERROR", message: reason });
+      throw new TRPCError16({ code: "INTERNAL_SERVER_ERROR", message: reason });
     }
   })
 });
 
 // ../server/src/trpc/routers/kanban-queue.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
 import { randomUUID as randomUUID5 } from "crypto";
@@ -5900,38 +5992,38 @@ var kanbanQueue = new KanbanQueueService();
 // ../server/src/trpc/routers/kanban-queue.ts
 var kanbanQueueRouter = router({
   getState: protectedProcedure.query(() => kanbanQueue.getState()),
-  add: protectedProcedure.input(z18.object({
-    boardId: z18.string().max(128),
-    cardId: z18.string().max(128),
-    runner: z18.enum(["claude-code", "codex"]).optional(),
-    model: z18.string().max(128).optional(),
-    scenarioId: z18.string().max(128).optional(),
+  add: protectedProcedure.input(z19.object({
+    boardId: z19.string().max(128),
+    cardId: z19.string().max(128),
+    runner: z19.enum(["claude-code", "codex"]).optional(),
+    model: z19.string().max(128).optional(),
+    scenarioId: z19.string().max(128).optional(),
     // Le projet ouvert quand la carte a été mise en file : la conversation
     // qui en naîtra lui appartient, plutôt que de rester orpheline et de
     // s'afficher dans tous les projets.
-    projectId: z18.string().max(128).optional(),
-    orgId: z18.string().max(128).nullable().optional()
+    projectId: z19.string().max(128).optional(),
+    orgId: z19.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
-  addColumn: protectedProcedure.input(z18.object({
-    boardId: z18.string().max(128),
-    columnId: z18.string().max(128),
+  addColumn: protectedProcedure.input(z19.object({
+    boardId: z19.string().max(128),
+    columnId: z19.string().max(128),
     // Les cartes visibles côté écran : une colonne filtrée n'envoie qu'elles.
-    cardIds: z18.array(z18.string().max(128)).max(5e3).optional(),
-    runner: z18.enum(["claude-code", "codex"]).optional(),
-    model: z18.string().max(128).optional(),
-    scenarioId: z18.string().max(128).optional(),
-    projectId: z18.string().max(128).optional(),
-    orgId: z18.string().max(128).nullable().optional()
+    cardIds: z19.array(z19.string().max(128)).max(5e3).optional(),
+    runner: z19.enum(["claude-code", "codex"]).optional(),
+    model: z19.string().max(128).optional(),
+    scenarioId: z19.string().max(128).optional(),
+    projectId: z19.string().max(128).optional(),
+    orgId: z19.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
   }),
-  remove: protectedProcedure.input(z18.object({ itemId: z18.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
+  remove: protectedProcedure.input(z19.object({ itemId: z19.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
   stopAll: protectedProcedure.mutation(() => {
     kanbanQueue.stopAll();
     return { ok: true };
   }),
-  setMaxConcurrent: protectedProcedure.input(z18.object({ max: z18.number().int().min(1).max(20) })).mutation(({ input }) => {
+  setMaxConcurrent: protectedProcedure.input(z19.object({ max: z19.number().int().min(1).max(20) })).mutation(({ input }) => {
     kanbanQueue.setMaxConcurrent(input.max);
     return kanbanQueue.getState();
   }),
@@ -5969,8 +6061,8 @@ import { mkdir as mkdir5, readdir, rm, stat as stat3, writeFile as writeFile4 }
 import { createHash } from "crypto";
 import { tmpdir } from "os";
 import { join as join7 } from "path";
-import { z as z19 } from "zod";
-import { TRPCError as TRPCError16 } from "@trpc/server";
+import { z as z20 } from "zod";
+import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -6041,7 +6133,7 @@ async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
       refusals.push(`${dir} (${err instanceof Error ? err.message : String(err)})`);
     }
   }
-  throw new TRPCError16({
+  throw new TRPCError17({
     code: "INTERNAL_SERVER_ERROR",
     message: `Impossible d'\xE9crire la pi\xE8ce jointe sur cette machine. Emplacements essay\xE9s : ${refusals.join(" ; ")}. V\xE9rifiez les droits d'\xE9criture, ou l'espace disque.`
   });
@@ -6062,9 +6154,9 @@ var kanbanRouter = router({
    * card graph, so listing them in full would be megabytes to answer "which
    * boards exist?". Use `getBoard` for the cards of one.
    */
-  listBoards: protectedProcedure.input(z19.object({
-    includeArchived: z19.boolean().optional(),
-    organizationId: z19.string().max(128).optional()
+  listBoards: protectedProcedure.input(z20.object({
+    includeArchived: z20.boolean().optional(),
+    organizationId: z20.string().max(128).optional()
   }).optional()).query(async ({ input }) => {
     const { organizationId, boards } = await kanbanStore.list(
       input?.includeArchived ?? false,
@@ -6090,7 +6182,7 @@ var kanbanRouter = router({
     };
   }),
   /** One board: its columns, and the cards in each. */
-  getBoard: protectedProcedure.input(z19.object({ boardId: z19.string().max(128) })).query(async ({ input }) => {
+  getBoard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128) })).query(async ({ input }) => {
     const board = await kanbanStore.get(input.boardId);
     if (!board) return { board: null };
     const { links } = await kanbanStore.cardLinks(input.boardId);
@@ -6129,12 +6221,12 @@ var kanbanRouter = router({
    * organization — or one board when `boardId` is given. Archived boards are
    * left out: they are what the team decided to stop looking at.
    */
-  searchCards: protectedProcedure.input(z19.object({
-    query: z19.string().max(256).optional(),
-    createdBy: z19.string().min(1).max(200).optional(),
-    boardId: z19.string().max(128).optional(),
-    limit: z19.number().int().min(1).max(100).optional(),
-    organizationId: z19.string().max(128).optional()
+  searchCards: protectedProcedure.input(z20.object({
+    query: z20.string().max(256).optional(),
+    createdBy: z20.string().min(1).max(200).optional(),
+    boardId: z20.string().max(128).optional(),
+    limit: z20.number().int().min(1).max(100).optional(),
+    organizationId: z20.string().max(128).optional()
   }).refine((i) => !!i.query?.trim() || !!i.createdBy?.trim(), { message: "query or createdBy is required." })).query(async ({ input }) => {
     return kanbanStore.searchCards(input);
   }),
@@ -6142,10 +6234,10 @@ var kanbanRouter = router({
    * Les conversations de support liées à une carte, avec leur fil — ce que
    * le client a écrit à l'équipe, séparé des commentaires de la carte.
    */
-  getCardConversations: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    limit: z19.number().int().min(1).max(500).optional()
+  getCardConversations: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    limit: z20.number().int().min(1).max(500).optional()
   })).query(async ({ input }) => {
     const conversations = await kanbanStore.cardConversations(input.boardId, input.cardId);
     const limit = input.limit ?? 100;
@@ -6158,13 +6250,13 @@ var kanbanRouter = router({
     };
   }),
   /** Chercher une conversation chez les fournisseurs de l'organisation (lecture seule côté fournisseur). */
-  searchConversations: protectedProcedure.input(z19.object({ boardId: z19.string().max(128), query: z19.string().trim().min(1).max(500) })).query(async ({ input }) => ({ results: await kanbanStore.searchConversations(input.boardId, input.query) })),
+  searchConversations: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), query: z20.string().trim().min(1).max(500) })).query(async ({ input }) => ({ results: await kanbanStore.searchConversations(input.boardId, input.query) })),
   /** Lier une conversation trouvée à une carte. N'écrit rien chez le fournisseur. */
-  linkConversation: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    connectionId: z19.string().max(128),
-    externalId: z19.string().max(128)
+  linkConversation: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    connectionId: z20.string().max(128),
+    externalId: z20.string().max(128)
   })).mutation(async ({ input }) => ({ conversations: await kanbanStore.linkConversation(input) })),
   /**
    * Le fil de commentaires d'une carte, relu à la demande.
@@ -6175,10 +6267,10 @@ var kanbanRouter = router({
    * qu'un `commentCount`, et rien n'en donnait le texte. Cette route est la
    * relecture, pour une seule carte : c'est le journal qui pèse, pas le reste.
    */
-  getCardComments: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    limit: z19.number().int().min(1).max(200).optional()
+  getCardComments: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    limit: z20.number().int().min(1).max(200).optional()
   })).query(async ({ input }) => {
     const history = await kanbanStore.cardHistory(input.boardId, input.cardId);
     const comments = history.filter((e) => e.type === "comment");
@@ -6207,18 +6299,18 @@ var kanbanRouter = router({
    * `getBoard` en donne déjà l'essentiel carte par carte ; cette route sert
    * quand c'est l'arbre lui-même qu'on veut, dates et auteurs compris.
    */
-  getCardLinks: protectedProcedure.input(z19.object({ boardId: z19.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
+  getCardLinks: protectedProcedure.input(z20.object({ boardId: z20.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
   /**
    * Rattacher une carte à une carte parente, ou l'en détacher.
    *
    * Sans `parentCardId`, le lien est retiré. Le parent peut vivre sur un autre
    * tableau : `parentBoardId` le désigne alors, sinon c'est celui de la carte.
    */
-  setCardParent: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    parentCardId: z19.string().max(128).optional(),
-    parentBoardId: z19.string().max(128).optional()
+  setCardParent: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    parentCardId: z20.string().max(128).optional(),
+    parentBoardId: z20.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardParent(
       input.boardId,
@@ -6226,7 +6318,7 @@ var kanbanRouter = router({
       input.parentCardId ? { boardId: input.parentBoardId ?? input.boardId, cardId: input.parentCardId } : null
     );
     if (!ok) {
-      throw new TRPCError16({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
+      throw new TRPCError17({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
     }
     return { ok: true };
   }),
@@ -6235,48 +6327,48 @@ var kanbanRouter = router({
    * `boardId` est le tableau où on la pose (ou d'où on la retire) ; la carte
    * reste sur son tableau d'origine.
    */
-  getCardPlacements: protectedProcedure.input(z19.object({ boardId: z19.string().max(128), cardId: z19.string().max(128) })).query(async ({ input }) => ({ placements: await kanbanStore.cardPlacements(input.boardId, input.cardId) })),
-  placeCard: protectedProcedure.input(z19.object({ boardId: z19.string().max(128), cardId: z19.string().max(128), column: z19.string().min(1).max(200) })).mutation(async ({ input }) => {
+  getCardPlacements: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).query(async ({ input }) => ({ placements: await kanbanStore.cardPlacements(input.boardId, input.cardId) })),
+  placeCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128), column: z20.string().min(1).max(200) })).mutation(async ({ input }) => {
     const res = await kanbanStore.placeCard(input.boardId, input.cardId, input.column);
     if (!res.ok) {
-      throw new TRPCError16({
+      throw new TRPCError17({
         code: "BAD_REQUEST",
         message: res.reason ?? "The cloud refused the placement (unknown card or column, archived card, or already on this board)."
       });
     }
     return { ok: true };
   }),
-  unplaceCard: protectedProcedure.input(z19.object({ boardId: z19.string().max(128), cardId: z19.string().max(128) })).mutation(async ({ input }) => {
+  unplaceCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).mutation(async ({ input }) => {
     if (!await kanbanStore.unplaceCard(input.boardId, input.cardId)) {
-      throw new TRPCError16({ code: "NOT_FOUND", message: "This card is not placed on this board." });
+      throw new TRPCError17({ code: "NOT_FOUND", message: "This card is not placed on this board." });
     }
     return { ok: true };
   }),
-  moveCard: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    targetColumn: z19.string().max(256)
+  moveCard: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    targetColumn: z20.string().max(256)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "move_card", columnTitle: input.targetColumn }
     ]);
     return { ok: true };
   }),
-  addComment: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    comment: z19.string().max(1e5)
+  addComment: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    comment: z20.string().max(1e5)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "add_comment", comment: input.comment }
     ]);
     return { ok: true };
   }),
-  addCard: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    column: z19.string().max(256),
-    title: z19.string().max(512),
-    content: z19.string().max(2e4).optional()
+  addCard: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    column: z20.string().max(256),
+    title: z20.string().max(512),
+    content: z20.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     await executeKanbanBoardCommands(input.boardId, [
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
@@ -6289,7 +6381,7 @@ var kanbanRouter = router({
    * `getBoard` rapatrie le tableau entier pour n'en regarder qu'une ; et il ne
    * porte pas les cartes rangées. Une carte s'adresse par son identifiant.
    */
-  getCard: protectedProcedure.input(z19.object({ boardId: z19.string().max(128), cardId: z19.string().max(128) })).query(async ({ input }) => {
+  getCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).query(async ({ input }) => {
     const found = await kanbanStore.card(input.boardId, input.cardId);
     if (!found) throw new Error(`Carte ${input.cardId} introuvable sur le tableau ${input.boardId}.`);
     return { ...summarizeCard(found.card, input.boardId, ""), columnId: found.columnId };
@@ -6303,16 +6395,16 @@ var kanbanRouter = router({
    * Un champ absent n'est pas touché ; `null` l'efface. La distinction compte —
    * changer un titre ne doit pas vider une couleur.
    */
-  updateCard: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    title: z19.string().min(1).max(512).optional(),
-    content: z19.string().max(1e5).optional(),
-    priority: z19.number().int().min(1).max(10).nullable().optional(),
-    color: z19.string().max(32).nullable().optional(),
-    groups: z19.array(z19.string().min(1).max(60)).max(30).optional(),
-    deadline: z19.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
-    assignees: z19.array(z19.string().max(128)).max(50).optional()
+  updateCard: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    title: z20.string().min(1).max(512).optional(),
+    content: z20.string().max(1e5).optional(),
+    priority: z20.number().int().min(1).max(10).nullable().optional(),
+    color: z20.string().max(32).nullable().optional(),
+    groups: z20.array(z20.string().min(1).max(60)).max(30).optional(),
+    deadline: z20.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
+    assignees: z20.array(z20.string().max(128)).max(50).optional()
   })).mutation(async ({ input }) => {
     const { boardId, cardId, content, ...rest } = input;
     const patch = { ...rest };
@@ -6323,10 +6415,10 @@ var kanbanRouter = router({
     return summarizeCard(card, boardId, "");
   }),
   /** Ranger une carte, ou la reprendre. */
-  setCardArchived: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    archived: z19.boolean()
+  setCardArchived: protectedProcedure.input(z20.object({
+    boardId: z20.string().max(128),
+    cardId: z20.string().max(128),
+    archived: z20.boolean()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardArchived(input.boardId, input.cardId, input.archived);
     if (!ok) throw new Error(`La carte ${input.cardId} n'a pas pu \xEAtre ${input.archived ? "archiv\xE9e" : "reprise"}.`);
@@ -6338,48 +6430,48 @@ var kanbanRouter = router({
    * Sans cette liste, assigner revient à deviner un identifiant — et l'agent
    * n'a aucun moyen de le trouver.
    */
-  listMembers: protectedProcedure.input(z19.object({ organizationId: z19.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
+  listMembers: protectedProcedure.input(z20.object({ organizationId: z20.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
   /**
    * Fetch one card attachment from the cloud and drop it on this machine, so an
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z19.object({
-    attachmentId: z19.string().max(128),
+  downloadAttachment: protectedProcedure.input(z20.object({
+    attachmentId: z20.string().max(128),
     // La pièce jointe appartient à une organisation : la nommer dit sous quel
     // compte la demander.
-    orgId: z19.string().max(128).optional(),
+    orgId: z20.string().max(128).optional(),
     // À défaut, le tableau d'où vient la carte suffit : il désigne un compte
     // comme le fait n'importe quel autre appel du kanban. Sans lui, la route
     // retombait sur le compte unique du poste et refusait de servir dès qu'il
     // y en avait plusieurs — alors que l'agent, qui n'a qu'un identifiant de
     // fichier, n'avait aucun moyen de nommer l'organisation.
-    boardId: z19.string().max(128).optional()
+    boardId: z20.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
-      throw new TRPCError16({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+      throw new TRPCError17({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
     const res = await cloudFetch2(`/api/kanban/file/${id}`, {
       timeoutMs: 12e4,
       accountId: await attachmentScope(input)
     });
     if (res.status === 404) {
-      throw new TRPCError16({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+      throw new TRPCError17({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
     if (!res.ok) {
-      throw new TRPCError16({
+      throw new TRPCError17({
         code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
         message: `Cloud refused the attachment (HTTP ${res.status})`
       });
     }
     const declared = Number(res.headers.get("content-length") ?? 0);
     if (declared > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError16({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const body = Buffer.from(await res.arrayBuffer());
     if (body.length > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError16({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const contentType = res.headers.get("content-type") ?? "application/octet-stream";
     const disposition = res.headers.get("content-disposition") ?? "";
@@ -6391,21 +6483,21 @@ var kanbanRouter = router({
 });
 
 // ../server/src/trpc/routers/terminal.ts
-import { z as z20 } from "zod";
-import { TRPCError as TRPCError17 } from "@trpc/server";
+import { z as z21 } from "zod";
+import { TRPCError as TRPCError18 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
-  create: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    cwd: z20.string().max(512).optional(),
+  create: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    cwd: z21.string().max(512).optional(),
     /** Anchors the terminal when no explicit cwd is given. */
-    serviceId: z20.string().max(128).optional(),
-    projectId: z20.string().max(128).optional(),
+    serviceId: z21.string().max(128).optional(),
+    projectId: z21.string().max(128).optional(),
     /** L'organisation du projet : un id seul peut en nommer un par organisation. */
-    orgId: z20.string().max(128).nullable().optional(),
-    cols: z20.number().int().min(1).max(512).optional(),
-    rows: z20.number().int().min(1).max(256).optional(),
-    title: z20.string().max(128).optional()
+    orgId: z21.string().max(128).nullable().optional(),
+    cols: z21.number().int().min(1).max(512).optional(),
+    rows: z21.number().int().min(1).max(256).optional(),
+    title: z21.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
@@ -6426,17 +6518,17 @@ var terminalRouter = router({
     return result;
   }),
   /** Les sessions PTY encore vivantes sur l'agent (onglets à retrouver) */
-  list: protectedProcedure.input(z20.object({ agentId: z20.string().max(128) })).query(async ({ input }) => {
+  list: protectedProcedure.input(z21.object({ agentId: z21.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "terminal.list"
     );
   }),
   /** Renommer un onglet */
-  rename: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    sessionId: z20.string().max(128),
-    title: z20.string().max(128)
+  rename: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    sessionId: z21.string().max(128),
+    title: z21.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6446,10 +6538,10 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Send keystrokes / data to a PTY session */
-  write: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    sessionId: z20.string().max(128),
-    data: z20.string().max(65536)
+  write: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    sessionId: z21.string().max(128),
+    data: z21.string().max(65536)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6459,11 +6551,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Resize the PTY */
-  resize: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    sessionId: z20.string().max(128),
-    cols: z20.number().int().min(1).max(512),
-    rows: z20.number().int().min(1).max(256)
+  resize: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    sessionId: z21.string().max(128),
+    cols: z21.number().int().min(1).max(512),
+    rows: z21.number().int().min(1).max(256)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6473,9 +6565,9 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Destroy a PTY session */
-  destroy: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    sessionId: z20.string().max(128)
+  destroy: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    sessionId: z21.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6485,11 +6577,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Stream PTY output — proxied via AgentWSBridge dynamic subscription */
-  onData: protectedProcedure.input(z20.object({
-    agentId: z20.string().max(128),
-    sessionId: z20.string().max(128),
+  onData: protectedProcedure.input(z21.object({
+    agentId: z21.string().max(128),
+    sessionId: z21.string().max(128),
     /** Rejouer l'historique de la session avant le flux temps réel. */
-    replay: z20.boolean().optional()
+    replay: z21.boolean().optional()
   })).subscription(async function* ({ input }) {
     const queue = [];
     let resolve4 = null;
@@ -6516,7 +6608,7 @@ var terminalRouter = router({
         }
       );
     } catch (err) {
-      throw new TRPCError17({
+      throw new TRPCError18({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -6538,11 +6630,11 @@ var terminalRouter = router({
 });
 
 // ../server/src/trpc/routers/utility.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var MAX_WAIT_MS = 5 * 60 * 1e3;
 var utilityRouter = router({
-  wait: protectedProcedure.input(z21.object({
-    ms: z21.number().int().min(0).max(MAX_WAIT_MS)
+  wait: protectedProcedure.input(z22.object({
+    ms: z22.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
     await new Promise((resolve4) => setTimeout(resolve4, input.ms));
     return { waited: input.ms };
@@ -6550,15 +6642,15 @@ var utilityRouter = router({
 });
 
 // ../server/src/trpc/routers/wiki.ts
-import { z as z22 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
+import { z as z23 } from "zod";
+import { TRPCError as TRPCError19 } from "@trpc/server";
 import { readFile as readFile3, readdir as readdir2, stat as stat4, realpath, writeFile as writeFile5, mkdir as mkdir6, rename, rm as rm2 } from "fs/promises";
-import { resolve as resolvePath, join as join8, relative, sep, dirname as dirname4 } from "path";
-var SCOPE_SCHEMA = z22.union([
-  z22.literal("global"),
-  z22.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+import { resolve as resolvePath, join as join8, relative as relative2, sep, dirname as dirname4 } from "path";
+var SCOPE_SCHEMA = z23.union([
+  z23.literal("global"),
+  z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
 ]);
-var REL_PATH_SCHEMA = z22.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+var REL_PATH_SCHEMA = z23.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
   message: "Path must be a relative path without traversal"
 });
 var MAX_FILES = 500;
@@ -6578,36 +6670,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "target",
   "out"
 ]);
-var DocsEntrySchema = z22.lazy(() => z22.union([
-  z22.object({ type: z22.literal("file"), name: z22.string(), path: z22.string() }),
-  z22.object({ type: z22.literal("dir"), name: z22.string(), path: z22.string(), children: z22.array(DocsEntrySchema) })
+var DocsEntrySchema = z23.lazy(() => z23.union([
+  z23.object({ type: z23.literal("file"), name: z23.string(), path: z23.string() }),
+  z23.object({ type: z23.literal("dir"), name: z23.string(), path: z23.string(), children: z23.array(DocsEntrySchema) })
 ]));
 async function resolveScope(scope) {
   if (scope === "global") {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
     await mkdir6(dataDirAbs, { recursive: true });
     const base = dirname4(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep).startsWith(base + sep)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
     await mkdir6(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep).startsWith(base + sep)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
   return { mode: "agent", agentId, cwd };
 }
@@ -6624,7 +6716,7 @@ async function walkLocal(root, dir, depth, counter) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
     const abs = join8(dir, e.name);
-    const rel = relative(root, abs).split(sep).join("/");
+    const rel = relative2(root, abs).split(sep).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
       const children = await walkLocal(root, abs, depth + 1, counter);
@@ -6642,7 +6734,7 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError18({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError19({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
@@ -6650,10 +6742,10 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     try {
       real = await realpath(target);
     } catch {
-      throw new TRPCError18({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError19({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep).startsWith(root + sep)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
@@ -6665,12 +6757,12 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep).startsWith(root + sep)) {
-    throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
 var wikiRouter = router({
-  list: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA })).output(z22.object({ root: z22.string(), entries: z22.array(DocsEntrySchema), truncated: z22.boolean() })).query(async ({ input }) => {
+  list: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA })).output(z23.object({ root: z23.string(), entries: z23.array(DocsEntrySchema), truncated: z23.boolean() })).query(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
@@ -6679,9 +6771,9 @@ var wikiRouter = router({
     const entries2 = await walkLocal(target.root, target.root, 0, counter);
     return { root: target.root, entries: entries2, truncated: counter.n >= MAX_FILES };
   }),
-  read: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z22.object({ path: z22.string(), content: z22.string() })).query(async ({ input }) => {
+  read: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z23.object({ path: z23.string(), content: z23.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -6689,14 +6781,14 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
     const s = await stat4(file);
-    if (!s.isFile()) throw new TRPCError18({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    if (!s.isFile()) throw new TRPCError19({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
     const content = await readFile3(file, "utf-8");
     return { path: input.path, content };
   }),
-  write: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z22.string().max(5e6) })).mutation(async ({ input }) => {
+  write: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z23.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -6707,9 +6799,9 @@ var wikiRouter = router({
     await writeFile5(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
-  createFile: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -6718,15 +6810,15 @@ var wikiRouter = router({
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
       await stat4(file);
-      throw new TRPCError18({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      throw new TRPCError19({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
     await mkdir6(dirname4(file), { recursive: true });
     await writeFile5(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
-  createDir: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
@@ -6735,7 +6827,7 @@ var wikiRouter = router({
     await mkdir6(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
-  rename: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  rename: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
@@ -6744,34 +6836,34 @@ var wikiRouter = router({
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
       await stat4(to);
-      throw new TRPCError18({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      throw new TRPCError19({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
     await mkdir6(dirname4(to), { recursive: true });
     await rename(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
-  ensureRoot: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+  ensureRoot: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
     if (input.scope === "global") {
       await resolveScope("global");
       return { ok: true };
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
-  delete: protectedProcedure.input(z22.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError18({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    if (fp === target.root) throw new TRPCError19({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
     await rm2(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
@@ -6791,8 +6883,8 @@ var configRouter = router({
 });
 
 // ../server/src/trpc/routers/cloud-sync.ts
-import { z as z23 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
+import { z as z24 } from "zod";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 
 // ../server/src/services/org-sync-scope.ts
 import { access } from "fs/promises";
@@ -6878,7 +6970,7 @@ import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
 import * as Y2 from "yjs";
 
 // ../server/src/services/sync-doc-cache.ts
-import { readFileSync, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
+import { readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
 import { readFile as readFile4 } from "fs/promises";
 import { dirname as dirname5, join as join10 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
@@ -6909,7 +7001,7 @@ function writeSyncDocSync(orgId, state) {
   const path = cachePath(orgId);
   let existing = null;
   try {
-    existing = new Uint8Array(readFileSync(path));
+    existing = new Uint8Array(readFileSync2(path));
   } catch {
   }
   mkdirSync(dirname5(path), { recursive: true });
@@ -7098,7 +7190,7 @@ var OrgSyncConnection = class {
   }
   track(work) {
     this.applying.add(work);
-    void work.finally(() => this.applying.delete(work));
+    void work.catch((err) => console.error("[cloud-sync] \xE9chec en appliquant un changement distant :", err)).finally(() => this.applying.delete(work));
   }
   async settleApplying() {
     while (this.applying.size > 0) await Promise.allSettled(this.applying);
@@ -8073,7 +8165,7 @@ async function assertOrgReadable(orgId) {
     await assertOrgVaultReadable(orgId);
   } catch (err) {
     if (err instanceof OrgVaultUnreadableError) {
-      throw new TRPCError19({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError20({ code: "FORBIDDEN", message: err.message });
     }
     throw err;
   }
@@ -8083,10 +8175,10 @@ async function assertOrgKey(orgId) {
     await reconcileOrgCanary(orgId);
   } catch (err) {
     if (err instanceof OrgKeyMismatchError) {
-      throw new TRPCError19({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError20({ code: "FORBIDDEN", message: err.message });
     }
     if (err instanceof CanaryUnavailableError) {
-      throw new TRPCError19({ code: "PRECONDITION_FAILED", message: err.message });
+      throw new TRPCError20({ code: "PRECONDITION_FAILED", message: err.message });
     }
     throw err;
   }
@@ -8103,14 +8195,14 @@ var cloudSyncRouter = router({
    * "open this project" is the whole gesture.
    */
   trackProject: protectedProcedure.input(
-    z23.object({
-      orgId: z23.string().min(1).max(128),
-      cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128),
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      cloudUrl: z24.string().url().max(2048),
+      projectId: z24.string().min(1).max(128),
       // Le compte sous lequel cette organisation a été listée. Tamponné avec
       // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
       // bon token sans qu'on ait à le lui redire.
-      accountId: z23.string().max(64).optional()
+      accountId: z24.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
@@ -8132,7 +8224,7 @@ var cloudSyncRouter = router({
       return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError19({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -8151,22 +8243,22 @@ var cloudSyncRouter = router({
    * fusionné.
    */
   publishProject: protectedProcedure.input(
-    z23.object({
-      orgId: z23.string().min(1).max(128),
-      cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128),
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      cloudUrl: z24.string().url().max(2048),
+      projectId: z24.string().min(1).max(128),
       // Le compte sous lequel cette organisation a été listée. Tamponné avec
       // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
       // bon token sans qu'on ait à le lui redire.
-      accountId: z23.string().max(64).optional()
+      accountId: z24.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
     if (!local) {
-      throw new TRPCError19({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
+      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
     }
     if (await projectStore.get({ id: input.projectId, orgId: input.orgId })) {
-      throw new TRPCError19({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
+      throw new TRPCError20({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
     }
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
@@ -8191,7 +8283,7 @@ var cloudSyncRouter = router({
       await cloudSyncBridge.followProject(input.orgId, input.projectId);
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError19({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -8205,16 +8297,16 @@ var cloudSyncRouter = router({
    * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
    * les yeux — donc le canari est rapatrié et jugé ici.
    */
-  checkOrgKey: protectedProcedure.input(z23.object({
-    orgId: z23.string().min(1).max(128),
-    keyHex: z23.string().length(64).regex(/^[0-9a-f]+$/i)
+  checkOrgKey: protectedProcedure.input(z24.object({
+    orgId: z24.string().min(1).max(128),
+    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i)
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
       { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) {
-      throw new TRPCError19({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
+      throw new TRPCError20({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
     }
     const { canary } = await res.json();
     if (typeof canary !== "string") return { matches: false, published: false };
@@ -8229,7 +8321,7 @@ var cloudSyncRouter = router({
    * que l'interface puisse proposer ni l'adoption ni la remise à zéro — le seul
    * chemin qui la répare. Rien n'est écrit ici, ni sur le disque ni sur le cloud.
    */
-  orgKeyStatus: protectedProcedure.input(z23.object({ orgId: z23.string().min(1).max(128) })).query(async ({ input }) => {
+  orgKeyStatus: protectedProcedure.input(z24.object({ orgId: z24.string().min(1).max(128) })).query(async ({ input }) => {
     const key = getEncryptionKey(input.orgId);
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
@@ -8252,10 +8344,10 @@ var cloudSyncRouter = router({
    * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
    * organisations et la machine gardent leur clé.
    */
-  adoptOrgKey: protectedProcedure.input(z23.object({
-    orgId: z23.string().min(1).max(128),
-    keyHex: z23.string().length(64).regex(/^[0-9a-f]+$/i),
-    masterPassword: z23.string().min(1).max(1024)
+  adoptOrgKey: protectedProcedure.input(z24.object({
+    orgId: z24.string().min(1).max(128),
+    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z24.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const report = await adoptOrgKey(
       input.orgId,
@@ -8285,14 +8377,14 @@ var cloudSyncRouter = router({
    * Ce qui a déjà été synchronisé sous l'ancienne clé de référence reste
    * illisible : aucune clé d'ici ne l'ouvre. L'interface le dit avant.
    */
-  resetOrgKey: protectedProcedure.input(z23.object({
-    orgId: z23.string().min(1).max(128),
-    masterPassword: z23.string().min(1).max(1024)
+  resetOrgKey: protectedProcedure.input(z24.object({
+    orgId: z24.string().min(1).max(128),
+    masterPassword: z24.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const { keyHex } = await resetOrgKeyToFresh(input.orgId, input.masterPassword, /* @__PURE__ */ new Date());
     const canary = await readVerifyFile(orgVaultRoot(input.orgId));
     if (!canary) {
-      throw new TRPCError19({
+      throw new TRPCError20({
         code: "PRECONDITION_FAILED",
         message: "Le coffre de cette organisation n'a pas re\xE7u sa cl\xE9."
       });
@@ -8304,7 +8396,7 @@ var cloudSyncRouter = router({
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
-      throw new TRPCError19({
+      throw new TRPCError20({
         code: res.status === 403 ? "FORBIDDEN" : "BAD_GATEWAY",
         message: detail || `ORG_KEY_RESET_FAILED (${res.status})`
       });
@@ -8320,9 +8412,9 @@ var cloudSyncRouter = router({
    * every other member and for this one on another machine.
    */
   untrackProject: protectedProcedure.input(
-    z23.object({
-      orgId: z23.string().min(1).max(128),
-      projectId: z23.string().min(1).max(128)
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      projectId: z24.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
@@ -8338,9 +8430,9 @@ var cloudSyncRouter = router({
    * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
    */
   deleteProjectFromOrg: protectedProcedure.input(
-    z23.object({
-      orgId: z23.string().min(1).max(128),
-      projectId: z23.string().min(1).max(128)
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      projectId: z24.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     let res;
@@ -8353,8 +8445,8 @@ var cloudSyncRouter = router({
         accountId: await accountForOrgScope(input.orgId)
       });
     } catch (err) {
-      if (err instanceof TRPCError19 && err.code === "PRECONDITION_FAILED") {
-        throw new TRPCError19({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
+      if (err instanceof TRPCError20 && err.code === "PRECONDITION_FAILED") {
+        throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
       }
       throw err;
     }
@@ -8362,12 +8454,12 @@ var cloudSyncRouter = router({
     const detail = await cloudMessage(res);
     if (res.status === 403) {
       const code = /not a member/i.test(detail) ? "PROJECT_NOT_MEMBER" : "PROJECT_DELETE_FORBIDDEN";
-      throw new TRPCError19({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
+      throw new TRPCError20({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
     }
     if (res.status === 404) {
-      throw new TRPCError19({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
+      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
     }
-    throw new TRPCError19({
+    throw new TRPCError20({
       code: "BAD_GATEWAY",
       message: detail || `PROJECT_DELETE_FAILED (${res.status})`
     });
@@ -8396,10 +8488,10 @@ var cloudSyncRouter = router({
    * d'un autre. Même forme que `rememberOrgNames`, et pour la même raison :
    * ce que seul le cloud sait, on le recopie quand il le dit.
    */
-  rememberOrgAccounts: protectedProcedure.input(z23.object({
-    orgs: z23.array(z23.object({
-      orgId: z23.string().min(1).max(128),
-      accountId: z23.string().min(1).max(64)
+  rememberOrgAccounts: protectedProcedure.input(z24.object({
+    orgs: z24.array(z24.object({
+      orgId: z24.string().min(1).max(128),
+      accountId: z24.string().min(1).max(64)
     })).max(200)
   })).mutation(async ({ input }) => {
     const candidates = /* @__PURE__ */ new Map();
@@ -8426,10 +8518,10 @@ var cloudSyncRouter = router({
     }
     return { remembered };
   }),
-  rememberOrgNames: protectedProcedure.input(z23.object({
-    orgs: z23.array(z23.object({
-      orgId: z23.string().min(1).max(128),
-      name: z23.string().min(1).max(100)
+  rememberOrgNames: protectedProcedure.input(z24.object({
+    orgs: z24.array(z24.object({
+      orgId: z24.string().min(1).max(128),
+      name: z24.string().min(1).max(100)
     })).max(200)
   })).mutation(async ({ input }) => {
     for (const { orgId, name } of input.orgs) await rememberOrgName(orgId, name);
@@ -8459,7 +8551,7 @@ var cloudSyncRouter = router({
    * Un 404 efface le logo retenu — l'organisation en a retiré un — tandis qu'un
    * réseau muet laisse en place ce qui est déjà là : hors ligne, on garde.
    */
-  cacheOrgLogos: protectedProcedure.input(z23.object({ orgIds: z23.array(z23.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
+  cacheOrgLogos: protectedProcedure.input(z24.object({ orgIds: z24.array(z24.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
     let cached = 0;
     for (const orgId of input.orgIds) {
       const base = await orgCloudUrl(orgId);
@@ -8517,14 +8609,14 @@ var cloudSyncRouter = router({
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute2, join as join12, resolve as resolve2, dirname as dirname6, basename } from "path";
-import { z as z24 } from "zod";
+import { isAbsolute as isAbsolute3, join as join12, resolve as resolve2, dirname as dirname6, basename } from "path";
+import { z as z25 } from "zod";
 var MAX_ENTRIES2 = 500;
-var PATH_SCHEMA = z24.string().min(1).max(4096);
+var PATH_SCHEMA = z25.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
   const expanded = input.startsWith("~") ? join12(homedir3(), input.slice(1)) : input;
-  if (!isAbsolute2(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
+  if (!isAbsolute3(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve2(expanded);
 }
 var filesystemRouter = router({
@@ -8544,7 +8636,7 @@ var filesystemRouter = router({
    * Hidden entries are skipped: they are noise for choosing a workspace, and
    * `.runeya` itself would invite placing a project inside another's data.
    */
-  listDirectories: protectedProcedure.input(z24.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  listDirectories: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
     if (!info?.isDirectory()) {
@@ -8577,7 +8669,7 @@ var filesystemRouter = router({
    * qui s'y trouve, ou rien (déjà dans la liste, lié à un projet d'organisation,
    * racine machine).
    */
-  checkLocalProjectTarget: protectedProcedure.input(z24.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  checkLocalProjectTarget: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
     if (!info?.isDirectory()) return { path: dir, status: "missing", projectName: null };
@@ -8589,10 +8681,10 @@ var filesystemRouter = router({
    * Two projects in one directory is what makes services run against the wrong
    * code, so a directory that already holds one is refused outright.
    */
-  checkProjectTarget: protectedProcedure.input(z24.object({
+  checkProjectTarget: protectedProcedure.input(z25.object({
     path: PATH_SCHEMA,
-    projectId: z24.string().min(1).max(128),
-    orgId: z24.string().max(128).nullable().optional()
+    projectId: z25.string().min(1).max(128),
+    orgId: z25.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
@@ -8611,13 +8703,13 @@ var filesystemRouter = router({
 });
 
 // ../server/src/trpc/routers/desktop.ts
-import { z as z25 } from "zod";
-import { isAbsolute as isAbsolute4 } from "path";
-import { TRPCError as TRPCError20 } from "@trpc/server";
+import { z as z26 } from "zod";
+import { isAbsolute as isAbsolute5 } from "path";
+import { TRPCError as TRPCError21 } from "@trpc/server";
 
 // ../server/src/services/desktop-launcher.ts
 import { execFile as execFile4 } from "child_process";
-import { isAbsolute as isAbsolute3 } from "path";
+import { isAbsolute as isAbsolute4 } from "path";
 import { promisify as promisify3 } from "util";
 var exec = promisify3(execFile4);
 var INSTALL_TIMEOUT_MS2 = 3e4;
@@ -8638,7 +8730,7 @@ function suggestLauncher() {
 }
 async function installLauncher(input) {
   if (!cli) throw new Error("launcher-unavailable");
-  if (input.workingDir !== null && !isAbsolute3(input.workingDir)) {
+  if (input.workingDir !== null && !isAbsolute4(input.workingDir)) {
     throw new Error("launcher-working-dir-not-absolute");
   }
   const args = [
@@ -8696,43 +8788,43 @@ var desktopRouter = router({
    * dessinée par le serveur. Sans cette annonce elle garderait la teinte figée
    * du fichier livré avec le CLI. Rien n'est persisté — voir `tray-accent.ts`.
    */
-  setTrayAccent: protectedProcedure.input(z25.object({
+  setTrayAccent: protectedProcedure.input(z26.object({
     // `#rgb` ou `#rrggbb` : la forme est vérifiée ici, pas rabotée plus loin.
-    color: z25.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/).nullable()
+    color: z26.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/).nullable()
   })).mutation(({ input }) => {
     setTrayAccent(input.color);
     return { ok: true };
   }),
-  installLauncher: protectedProcedure.input(z25.object({
-    name: z25.string().trim().min(1).max(120),
+  installLauncher: protectedProcedure.input(z26.object({
+    name: z26.string().trim().min(1).max(120),
     /**
      * `null` : raccourci global, sans dossier épinglé. Sinon un chemin
      * absolu, refusé autrement : le dossier devient un argument positionnel
      * du CLI, où une valeur commençant par un tiret passerait pour un drapeau.
      */
-    workingDir: z25.string().max(4096).refine(isAbsolute4, {
+    workingDir: z26.string().max(4096).refine(isAbsolute5, {
       message: "Le dossier de travail doit \xEAtre un chemin absolu."
     }).nullable(),
-    port: z25.number().int().min(1).max(65535),
-    agentPort: z25.number().int().min(1).max(65535)
+    port: z26.number().int().min(1).max(65535),
+    agentPort: z26.number().int().min(1).max(65535)
   })).mutation(async ({ input }) => {
     try {
       return await installLauncher(input);
     } catch (err) {
       const message = err.message;
       if (message === "launcher-working-dir-not-absolute") {
-        throw new TRPCError20({
+        throw new TRPCError21({
           code: "BAD_REQUEST",
           message: "Le dossier de travail doit \xEAtre un chemin absolu."
         });
       }
       if (message === "launcher-unavailable") {
-        throw new TRPCError20({
+        throw new TRPCError21({
           code: "PRECONDITION_FAILED",
           message: "Cette Runeya ne sait pas o\xF9 trouver son CLI : cr\xE9ez le raccourci avec `runeya install-desktop`."
         });
       }
-      throw new TRPCError20({ code: "INTERNAL_SERVER_ERROR", message });
+      throw new TRPCError21({ code: "INTERNAL_SERVER_ERROR", message });
     }
   })
 });
@@ -8740,6 +8832,7 @@ var desktopRouter = router({
 // ../server/src/trpc/router.ts
 var appRouter = router({
   health: healthRouter,
+  session: sessionRouter,
   appUpdate: appUpdateRouter,
   changelog: changelogRouter,
   diagnostics: diagnosticsRouter,
@@ -10184,6 +10277,13 @@ var authLimiter = rateLimit({
   legacyHeaders: false,
   message: { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." }
 });
+var refreshLimiter = rateLimit({
+  windowMs: 60 * 1e3,
+  max: 120,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: "Trop de renouvellements de session." }
+});
 var llmsLimiter = rateLimit({
   windowMs: 60 * 1e3,
   // 1 minute
@@ -10553,6 +10653,17 @@ async function createLocalServer() {
   });
   proxyCloudStream("/api/cloud/chat/stream", "/api/chat/stream");
   proxyCloudStream("/api/cloud/kanban/stream", "/api/kanban/stream");
+  app.post("/api/auth/refresh", refreshLimiter, async (req, res) => {
+    const auth = req.headers.authorization;
+    const jwt = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    try {
+      await verifyJwt(jwt);
+    } catch {
+      res.status(401).json({ error: "Session invalide" });
+      return;
+    }
+    res.json({ token: await signJwt() });
+  });
   app.post("/api/unlock", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
     try {
       const body = req.body;
@@ -10848,12 +10959,22 @@ async function createLocalServer() {
   applyWSSHandler({
     wss,
     router: appRouter,
-    createContext: ({ req }) => {
+    createContext: ({ req, res: ws }) => {
       const headerAuth = req.headers.authorization ?? null;
       const urlObj = new URL(req.url ?? "/", `http://localhost:${env.PORT}`);
       const queryToken = urlObj.searchParams.get("token");
       const queryAuth = queryToken ? `Bearer ${queryToken}` : null;
-      return { authorization: headerAuth ?? queryAuth };
+      let authorization = headerAuth ?? queryAuth;
+      return {
+        get authorization() {
+          return authorization;
+        },
+        renewSocketToken: async (token) => {
+          const { exp, iat } = await verifyJwt(token);
+          authorization = `Bearer ${token}`;
+          if (ws.readyState === ws.OPEN) wsConnRegistry.set(ws, { exp, iat });
+        }
+      };
     }
   });
   const wsConnRegistry = /* @__PURE__ */ new Map();
@@ -10931,7 +11052,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-LQVLEHU7.js");
+  const { initCompanion } = await import("./companion-EVCS2HNC.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -11361,21 +11482,29 @@ if (import.meta.url === `file://${process.argv[1]}`) {
 }
 export {
   PullEnvError,
+  compareSemver,
   createLocalServer,
+  globalCliEntry,
+  installPrefix,
+  installRuneyaGlobally,
+  installedRuneya,
   killInstance,
   listInstances,
   listTrayServices,
   networkInfo,
   onTrayServicesChanged,
+  probeVersion,
   pullEnv,
   registerCli as registerCliLocation,
   registerInstance,
+  resolveNpm,
   resolveTrayIcon,
   restartInstance,
   restartProcess,
   scheduleSelfRestart,
   setLanMode,
   startProcess,
-  stopProcess
+  stopProcess,
+  userPrefix
 };
-//# sourceMappingURL=src-NVQHFMTQ.js.map
+//# sourceMappingURL=src-ZSQISY6W.js.map