@runeya/runeya 2.0.145 → 2.0.147

package/mcp-server/external.js

@@ -0,0 +1,2679 @@
+// src/external.ts
+import { homedir } from "os";
+import { join as join2 } from "path";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+
+// ../ai-capabilities/dist/index.js
+import { z as z23 } from "zod";
+
+// ../shared/dist/index.js
+import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+import { z as z7 } from "zod";
+import { z as z5 } from "zod";
+import { z as z4 } from "zod";
+import { z as z6 } from "zod";
+import { z as z8 } from "zod";
+import { z as z9 } from "zod";
+import { z as z10 } from "zod";
+import { z as z11 } from "zod";
+import { z as z12 } from "zod";
+import { z as z13 } from "zod";
+import { z as z14 } from "zod";
+import { z as z15 } from "zod";
+import { z as z16 } from "zod";
+import { z as z17 } from "zod";
+import { z as z18 } from "zod";
+import { z as z19 } from "zod";
+import { z as z20 } from "zod";
+import { z as z21 } from "zod";
+import { z as z22 } from "zod";
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypto";
+import vm from "vm";
+import * as Y from "yjs";
+var UserSchema = z.object({
+  id: z.string().max(128),
+  email: z.string().email().max(320),
+  name: z.string().min(1).max(500),
+  avatar: z.string().url().max(2048).nullable().optional()
+});
+var OrgSchema = z2.object({
+  id: z2.string().max(128),
+  name: z2.string().min(1).max(100),
+  slug: z2.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+  ownerId: z2.string().max(128)
+});
+var OrgMemberSchema = z2.object({
+  id: z2.string().max(128),
+  orgId: z2.string().max(128),
+  userId: z2.string().max(128),
+  globalRole: z2.enum(["owner", "admin", "member"]),
+  invitedAt: z2.coerce.date(),
+  joinedAt: z2.coerce.date().nullable().optional()
+});
+var ProjectSchema = z3.object({
+  id: z3.string().max(128),
+  orgId: z3.string().max(128).nullable().optional(),
+  name: z3.string().min(1).max(200),
+  description: z3.string().max(1e4).optional().default(""),
+  serviceIds: z3.array(z3.string().max(128)).max(1e4).default([]),
+  // Environment support
+  // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
+  // It's initialized to 'local' by default at load time
+  activeEnvironmentId: z3.string().max(128).optional(),
+  environmentIds: z3.array(z3.string().max(128)).max(100).default([]),
+  // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
+  // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
+  groupOrder: z3.array(z3.string().max(200)).max(100).default([])
+});
+var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
+var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
+var PositionSchema = z4.object({
+  x: z4.number(),
+  y: z4.number()
+});
+var ScenarioGroupSchema = z4.object({
+  id: z4.string().min(1).max(128),
+  name: z4.string().min(1).max(200),
+  description: z4.string().max(1e3).optional(),
+  color: z4.string().max(32).optional(),
+  position: PositionSchema.default({ x: 0, y: 0 }),
+  width: z4.number().default(300),
+  height: z4.number().default(200)
+});
+var ScenarioPresetRoleSchema = z4.object({
+  id: z4.string().min(1).max(64),
+  name: z4.string().min(1).max(200),
+  systemPrompt: z4.string().max(1e4).default(""),
+  prompt: z4.string().max(1e4).default("")
+});
+var ScenarioPresetInitialDataSchema = z4.object({
+  leaderId: z4.string().min(1).max(128),
+  groups: z4.array(z4.object({
+    id: z4.string().min(1).max(128),
+    name: z4.string().min(1).max(200),
+    description: z4.string().max(1e3).optional(),
+    color: z4.string().max(32).optional(),
+    position: z4.object({ x: z4.number(), y: z4.number() }).default({ x: 0, y: 0 }),
+    width: z4.number().default(300),
+    height: z4.number().default(200)
+  })).max(100).default([]),
+  nodes: z4.array(z4.object({
+    id: z4.string().min(1).max(128),
+    type: z4.enum(["ai", "ask"]).default("ai"),
+    parentIds: z4.array(z4.string().max(128)).default([]),
+    groupId: z4.string().max(128).nullable().default(null),
+    label: z4.string().max(240).default(""),
+    role: z4.string().max(64).default("other"),
+    prompt: z4.string().max(5e4).default(""),
+    question: z4.string().max(2e3).default(""),
+    autoGenerated: z4.boolean().default(true),
+    canAddNode: z4.boolean().default(false),
+    aiCli: z4.enum(["claude-code", "codex"]).default("claude-code"),
+    model: z4.string().max(128).default("sonnet"),
+    position: z4.object({ x: z4.number(), y: z4.number() }).default({ x: 0, y: 0 })
+  })).min(1).max(500)
+});
+var LocalizedStringSchema = z4.record(z4.string(), z4.string().max(100));
+var ScenarioPresetLabelsSchema = z4.object({
+  group: LocalizedStringSchema.optional(),
+  node: LocalizedStringSchema.optional(),
+  role: LocalizedStringSchema.optional(),
+  leader: LocalizedStringSchema.optional()
+});
+var ScenarioPresetSchema = z4.object({
+  id: z4.string().min(1).max(128),
+  name: z4.string().min(1).max(200),
+  icon: z4.string().max(64).optional(),
+  defaultTraversalMode: z4.enum(["hierarchical", "topological"]).optional(),
+  canChangeTraversalMode: z4.boolean().default(true),
+  roles: z4.array(ScenarioPresetRoleSchema).min(1).max(100),
+  initialData: ScenarioPresetInitialDataSchema.optional(),
+  labels: ScenarioPresetLabelsSchema.optional()
+});
+var ScenarioNodeSchema = z4.object({
+  id: z4.string().min(1).max(128),
+  type: z4.enum(["ai", "ask"]).default("ai"),
+  parentIds: z4.array(z4.string().max(128)).default([]),
+  groupId: z4.string().max(128).nullable().default(null),
+  label: z4.string().max(240).default(""),
+  role: z4.string().max(64).default("other"),
+  prompt: z4.string().max(5e4).default(""),
+  question: z4.string().max(2e3).default(""),
+  autoGenerated: z4.boolean().default(true),
+  canAddNode: z4.boolean().default(false),
+  aiCli: z4.enum(["claude-code", "codex"]).default("claude-code"),
+  model: z4.string().max(128).default("sonnet"),
+  position: PositionSchema.default({ x: 0, y: 0 }),
+  injectParentOutputs: z4.boolean().default(false),
+  injectedAncestorIds: z4.array(z4.string().max(128)).default([])
+});
+var ScenarioSchema = z4.object({
+  id: z4.string().min(1).max(128),
+  name: z4.string().min(1).max(200),
+  icon: z4.string().max(64).optional(),
+  description: z4.string().max(2e3).optional(),
+  leaderId: z4.string().min(1).max(128),
+  groups: z4.array(ScenarioGroupSchema).max(100).default([]),
+  nodes: z4.array(ScenarioNodeSchema).min(1).max(500),
+  traversalMode: z4.enum(["hierarchical", "topological"]).default("hierarchical"),
+  presetId: z4.string().max(128).optional(),
+  isPublished: z4.boolean().default(false),
+  createdAt: z4.number(),
+  updatedAt: z4.number()
+});
+var AI_PROVIDERS = ["anthropic", "openai", "mistral", "groq", "ollama"];
+var AIProviderSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  name: z5.string().min(1).max(200),
+  provider: z5.enum(AI_PROVIDERS),
+  encryptedApiKey: z5.string().max(2e3).default(""),
+  model: z5.string().max(200).optional(),
+  active: z5.boolean().default(false),
+  createdAt: z5.coerce.date(),
+  updatedAt: z5.coerce.date()
+});
+var JSLogParserSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  name: z5.string().min(1).max(200),
+  description: z5.string().max(2e3).optional(),
+  code: z5.string().min(1).max(5e4).refine(
+    (s) => !s.includes("require(") && !s.includes("import ") && !s.includes("eval("),
+    { message: "Code must not contain require, import, or eval patterns" }
+  ),
+  enabled: z5.boolean().default(true),
+  builtin: z5.boolean().optional(),
+  createdAt: z5.coerce.date(),
+  updatedAt: z5.coerce.date()
+});
+var NotificationPreferencesSchema = z5.object({
+  scenario_waiting_input: z5.boolean().default(true),
+  ai_conversation_complete: z5.boolean().default(true),
+  ai_conversation_error: z5.boolean().default(true),
+  service_error_log: z5.boolean().default(true),
+  service_status_changed: z5.boolean().default(true),
+  service_health_changed: z5.boolean().default(true),
+  /** Service IDs excluded from error-log notifications */
+  service_error_log_excluded: z5.array(z5.string().max(100)).max(500).default([]),
+  /** Service IDs excluded from status-change notifications */
+  service_status_changed_excluded: z5.array(z5.string().max(100)).max(500).default([]),
+  /** Service IDs excluded from health-change notifications */
+  service_health_changed_excluded: z5.array(z5.string().max(100)).max(500).default([])
+});
+var CompanionSettingsSchema = z5.object({
+  /** Activer le compagnon d'office sur les conversations créées ensuite. */
+  enabledByDefault: z5.boolean().default(false),
+  /**
+   * Spécificités ajoutées aux consignes Runeya.
+   *
+   * Vide — l'absence — signifie « aucune spécificité ». On ne recopie pas le
+   * texte par défaut dans le réglage : les consignes Runeya restent dans le
+   * code, pour profiter de leurs corrections.
+   *
+   * Rejeté au-delà de la borne plutôt que tronqué (§1) : un prompt coupé en
+   * plein milieu produirait des relectures incohérentes sans rien signaler.
+   */
+  prompt: z5.string().max(2e4).optional(),
+  /** Runner du compagnon des conversations créées ensuite. Absent = celui de la conversation. */
+  runner: z5.enum(["claude-code", "codex"]).optional(),
+  /** Modèle du compagnon des conversations créées ensuite. Absent = défaut du runner. */
+  model: z5.string().max(200).optional(),
+  /** Effort du compagnon des conversations créées ensuite. Absent = effort par défaut. */
+  effort: z5.enum(["low", "normal", "high"]).optional()
+});
+var SettingsSchema = z5.object({
+  mode: z5.enum(["local-simple", "cloud"]),
+  cloudUrl: z5.string().url().max(2048).nullable().optional(),
+  logParsers: z5.array(JSLogParserSchema).max(100).default([]),
+  scenarios: z5.array(ScenarioSchema).max(100).default([]),
+  /** Absolute path to the folder where the global wiki/docs markdown files live. Optional. */
+  globalDocsPath: z5.string().max(4096).optional(),
+  /**
+   * Optionnel plutôt que défauté : un réglage absent est un réglage jamais
+   * touché, et le rendre obligatoire dans le type forcerait chaque appelant qui
+   * construit un objet de réglages à inventer une valeur.
+   */
+  companion: CompanionSettingsSchema.optional()
+});
+var TraefikConfigSchema = z5.object({
+  enabled: z5.boolean().default(false),
+  acmeEmail: z5.string().email().max(256).optional(),
+  wildcardDomain: z5.string().max(253).optional(),
+  httpPort: z5.number().int().min(1).max(65535).default(80),
+  httpsPort: z5.number().int().min(1).max(65535).default(443),
+  dnsProvider: z5.string().max(64).optional(),
+  dnsCredentials: z5.record(z5.string().max(64), z5.string().max(2048)).default({}),
+  acmeStaging: z5.boolean().default(false),
+  encryptedCert: z5.string().max(65536).optional(),
+  encryptedCertKey: z5.string().max(65536).optional()
+});
+var SettingsPrivateSchema = z5.object({
+  aiProviders: z5.array(AIProviderSchema).max(50).default([]),
+  scenarios: z5.array(ScenarioSchema).max(100).default([]),
+  notifications: NotificationPreferencesSchema.default(() => ({
+    scenario_waiting_input: true,
+    ai_conversation_complete: true,
+    ai_conversation_error: true,
+    service_error_log: true,
+    service_status_changed: true,
+    service_health_changed: true,
+    service_error_log_excluded: [],
+    service_status_changed_excluded: [],
+    service_health_changed_excluded: []
+  })),
+  traefikConfig: TraefikConfigSchema.optional()
+});
+var SchemaVersionSchema = z5.object({
+  version: z5.number().int().positive(),
+  migratedAt: z5.coerce.date()
+});
+var safePath = z6.string().min(1).max(4096).refine(
+  (p) => !p.includes("\0"),
+  { message: "path must not contain null bytes" }
+).refine(
+  (p) => !/(^|[/\\])\.\.([/\\]|$)/.test(p),
+  { message: "path must not contain path-traversal sequences (..)" }
+);
+var ConsoleLogSourceSchema = z6.object({
+  type: z6.literal("console")
+});
+var FileLogSourceSchema = z6.object({
+  type: z6.literal("file"),
+  path: safePath,
+  encoding: z6.string().max(32).default("utf-8"),
+  startFromEnd: z6.boolean().default(true),
+  createIfNotExists: z6.boolean().default(false)
+});
+var MongoLogSourceSchema = z6.object({
+  type: z6.literal("mongo"),
+  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
+  connectionString: z6.string().min(1).max(2048),
+  database: z6.string().min(1).max(256),
+  collection: z6.string().min(1).max(256),
+  filter: z6.record(z6.string(), z6.unknown()).optional(),
+  timestampField: z6.string().max(128).default("timestamp"),
+  messageField: z6.string().max(128).default("message"),
+  levelField: z6.string().max(128).optional()
+});
+var MySQLLogSourceSchema = z6.object({
+  type: z6.literal("mysql"),
+  host: z6.string().min(1).max(253),
+  port: z6.number().int().min(1).max(65535).default(3306),
+  user: z6.string().min(1).max(256),
+  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
+  password: z6.string().max(2048),
+  database: z6.string().min(1).max(256),
+  table: z6.string().min(1).max(256),
+  query: z6.string().max(8192).optional(),
+  timestampColumn: z6.string().max(128).default("created_at"),
+  messageColumn: z6.string().max(128).default("message"),
+  levelColumn: z6.string().max(128).optional(),
+  pollIntervalMs: z6.number().int().min(500).max(6e4).default(2e3)
+});
+var LogSourceConfigSchema = z6.discriminatedUnion("type", [
+  ConsoleLogSourceSchema,
+  FileLogSourceSchema,
+  MongoLogSourceSchema,
+  MySQLLogSourceSchema
+]);
+var HealthCheckSchema = z7.object({
+  type: z7.enum(["http", "command"]).default("http"),
+  // HTTP-specific (required when type=http)
+  path: z7.string().min(1).max(500).startsWith("/").optional(),
+  method: z7.enum(["GET", "HEAD", "POST", "PUT"]).optional().default("GET"),
+  expectedStatus: z7.number().int().min(100).max(599).optional().default(200),
+  // Command-specific (required when type=command)
+  command: z7.string().min(1).max(4096).optional(),
+  // Shared
+  interval: z7.number().int().positive().default(1e3),
+  timeout: z7.number().int().positive().default(1e3),
+  retries: z7.number().int().nonnegative().default(3),
+  initialDelay: z7.number().int().nonnegative().optional().default(0)
+}).refine(
+  (data) => data.type === "http" ? !!data.path : !!data.command,
+  { message: "HTTP type requires path; command type requires command" }
+);
+var BootstrapCommandSchema = z7.object({
+  id: z7.string().min(1).max(64),
+  label: z7.string().max(200).default(""),
+  entrypoint: z7.string().max(4096).optional(),
+  command: z7.string().max(4096).default(""),
+  user: z7.string().max(256).optional()
+});
+var DockerConfigSchema = z7.object({
+  // Image mode (pull from registry) — mutually exclusive with build mode in UI
+  image: z7.string().min(1).max(1024).optional(),
+  // Build mode — Dockerfile stored inline in services.json
+  dockerfile: z7.string().max(65536).optional(),
+  buildContext: z7.string().max(4096).optional(),
+  buildArgs: z7.record(z7.string().max(256), z7.string().max(4096)).default({}).refine(
+    (obj) => Object.keys(obj).length <= 50,
+    { message: "Max 50 build args" }
+  ),
+  targetStage: z7.string().max(256).optional(),
+  // Runtime config
+  networkMode: z7.enum(["host", "bridge"]).default("host"),
+  ports: z7.array(z7.string().max(64)).max(100).default([]),
+  volumes: z7.array(z7.string().max(1024)).max(100).default([]),
+  mountRootpath: z7.boolean().default(false),
+  entrypoint: z7.string().max(4096).optional(),
+  command: z7.string().max(4096).optional(),
+  user: z7.string().max(256).optional(),
+  useNativeCommand: z7.boolean().default(false),
+  nativeCommandMode: z7.enum(["shared", "isolated"]).default("isolated"),
+  nativeShell: z7.string().max(256).default("sh"),
+  bootstrapCommands: z7.array(BootstrapCommandSchema).max(20).default([])
+});
+var RestartStrategySchema = z7.enum(["none", "on-failure", "always", "unless-stopped"]).default("none");
+var ServiceShortcutSchema = z7.object({
+  id: z7.string().min(1).max(64),
+  label: z7.string().max(200).default(""),
+  command: z7.string().max(4096).default(""),
+  cwd: z7.string().max(4096).optional()
+});
+var ServiceCommandSchema = z7.object({
+  id: z7.string().min(1).max(64),
+  label: z7.string().max(200).default(""),
+  command: z7.string().max(4096).default(""),
+  cwd: z7.string().max(4096).optional(),
+  shell: z7.boolean().optional().default(true)
+});
+var VariableSlotSchema = z7.object({
+  value: z7.string().max(8192).default(""),
+  pre: z7.string().max(8192).default(""),
+  post: z7.string().max(8192).default(""),
+  isSecret: z7.boolean().default(false),
+  // Deux décisions distinctes, et il ne faut pas les confondre :
+  //
+  // - `shareWithAi` est une permission de **lecture** : une IA (le chat de
+  //   Runeya, un agent par le serveur MCP) peut voir la valeur de ce secret.
+  //   Une variable publique est lisible de toute façon, le drapeau ne la
+  //   concerne pas.
+  // - `injectIntoAi` est une **exécution** : la variable est posée dans
+  //   l'environnement du process des agents (Claude Code, Codex, …) lancés
+  //   depuis Runeya pendant que cet environnement est actif.
+  //
+  // Les deux sont opt-in : sans rien cocher, aucun secret ne part vers une IA.
+  // Injecter implique lire (ce que le process reçoit, l'agent le voit), donc
+  // la lecture accepte l'un OU l'autre : voir `isSharedWithAi`, qui est le seul
+  // endroit où cette règle s'écrit.
+  shareWithAi: z7.boolean().default(false),
+  injectIntoAi: z7.boolean().default(false),
+  // Une variable obligatoire doit avoir une valeur finale non vide avant qu'un
+  // service de cet environnement puisse démarrer. Le démarrage est refusé
+  // sinon, avec la liste des manquantes — l'assistant est le moyen de remplir.
+  required: z7.boolean().default(false),
+  // Une variable « seulement surchargeable » n'a jamais de valeur partagée :
+  // `value` reste vide dans le document synchronisé, et chaque poste DOIT
+  // fournir sa propre surcharge machine-locale (chemin local, jeton personnel).
+  // `pre` et `post` restent partagés — ils décrivent la forme, pas le secret.
+  overrideOnly: z7.boolean().default(false),
+  // À quoi sert cette variable, pour quelqu'un qui doit la remplir. Affichée
+  // par l'assistant de complétion et dans l'éditeur.
+  //
+  // Du **markdown**, pas du texte brut : une description gagne à pouvoir
+  // pointer vers la console qui délivre le jeton. Écrite et relue par le même
+  // éditeur Tiptap (`packages/editor-ui`), jamais injectée en HTML — Tiptap
+  // analyse le markdown dans son propre schéma, si bien qu'une description
+  // arrivée d'un autre poste par la synchronisation ne peut rien exécuter.
+  description: z7.string().max(2e3).default("")
+}).refine(
+  (slot) => !slot.overrideOnly || slot.value === "",
+  { message: "An override-only variable cannot carry a shared value", path: ["value"] }
+);
+var MissingVariableReasonSchema = z7.enum(["required", "overrideOnly"]);
+var MissingVariableSchema = z7.object({
+  variableId: z7.string().max(128),
+  key: z7.string().max(256),
+  description: z7.string().max(2e3),
+  reason: MissingVariableReasonSchema,
+  isSecret: z7.boolean(),
+  environmentId: z7.string().max(128),
+  environmentName: z7.string().max(200)
+});
+var VariableSchema = z7.object({
+  key: z7.string().min(1).max(256),
+  value: VariableSlotSchema
+});
+var VariablesRecordSchema = z7.record(
+  z7.string().max(128),
+  VariableSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variables" }
+);
+var VariableSlotsRecordSchema = z7.record(
+  z7.string().max(256),
+  VariableSlotSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variable slots" }
+);
+var ServiceConfigSchema = z7.object({
+  id: z7.string().max(128),
+  orgId: z7.string().max(128).nullable().optional(),
+  agentId: z7.string().max(128).optional(),
+  // Optional: if absent, inherited from active environment's agentId
+  name: z7.string().min(1).max(200),
+  commands: z7.array(ServiceCommandSchema).max(50).optional().default([]),
+  cwd: z7.string().max(4096).optional(),
+  ports: z7.array(z7.number().int().positive().max(65535)).max(20).optional().default([]),
+  // Metadata fields (migration from old Runeya)
+  groups: z7.array(z7.string().max(200)).max(20).optional().default([]),
+  description: z7.string().max(2e3).optional(),
+  /** Path (relative to service.cwd or absolute) where the service's docs/wiki markdown files live. Optional — defaults to service.cwd. */
+  docsPath: z7.string().max(4096).optional(),
+  url: z7.string().max(2048).optional(),
+  localUrls: z7.array(z7.object({
+    url: z7.string().max(253).regex(/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/),
+    port: z7.number().int().min(1).max(65535)
+  })).max(20).optional().default([]),
+  openapiUrl: z7.string().max(2048).optional(),
+  git: z7.object({
+    remote: z7.string().max(2048).optional(),
+    home: z7.string().max(2048).optional()
+  }).optional(),
+  meta: z7.record(z7.string().max(256), z7.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  // Transient env dict (resolved by server before deployment, used directly by agent runner — NOT persisted)
+  env: z7.record(z7.string().max(256), z7.string().max(8192)).default({}).refine(
+    (obj) => Object.keys(obj).length <= 200,
+    { message: "Too many env vars (max 200)" }
+  ),
+  envSecrets: z7.array(z7.string().max(256)).max(200).default([]),
+  // Transient: resolved JS log parsers (from parserIds, resolved by server before deployment — NOT persisted)
+  resolvedLogParsers: z7.array(JSLogParserSchema).default([]).optional(),
+  // Transient: resolved working directory (cwd with env vars expanded — NOT persisted)
+  resolvedCwd: z7.string().optional(),
+  runner: z7.enum(["native", "docker"]).optional().default("native"),
+  dockerConfig: DockerConfigSchema.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  parserIds: z7.array(z7.string().max(128)).max(50).default([]),
+  shortcuts: z7.array(ServiceShortcutSchema).max(50).optional().default([]),
+  autoRestart: z7.boolean().optional().default(false),
+  clearLogsOnStart: z7.boolean().optional().default(false),
+  restartStrategy: RestartStrategySchema.optional(),
+  maxRestarts: z7.number().int().nonnegative().optional(),
+  restartBackoffMs: z7.number().int().positive().optional().default(1e3),
+  // Log sources additionnelles (au-delà du stdout/stderr console par défaut)
+  logSources: z7.array(LogSourceConfigSchema).max(20).optional().default([])
+});
+var CreateServiceSchema = ServiceConfigSchema.omit({ id: true }).partial().required({ name: true });
+var UpdateServiceSchema = ServiceConfigSchema.partial().required({ id: true }).extend({
+  agentId: z7.string().max(128).nullable().optional(),
+  // null = clear (inherit from env), undefined = no change
+  cwd: z7.string().max(4096).nullable().optional(),
+  git: z7.object({ remote: z7.string().max(2048).optional(), home: z7.string().max(2048).optional() }).nullable().optional(),
+  meta: z7.record(z7.string().max(256), z7.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  healthCheck: HealthCheckSchema.nullable().optional()
+});
+var ProcessStateSchema = z8.enum(["starting", "running", "stopped", "errored"]);
+var HealthStatusSchema = z8.enum(["healthy", "unhealthy", "unknown"]);
+var ProcessStatusSchema = z8.object({
+  id: z8.string().max(128),
+  serviceId: z8.string().max(128),
+  agentId: z8.string().max(128),
+  state: ProcessStateSchema,
+  pid: z8.number().int().nullable().optional(),
+  pids: z8.array(z8.number().int()).optional().default([]),
+  exitCode: z8.number().int().nullable().optional(),
+  startedAt: z8.coerce.date().nullable().optional(),
+  restartCount: z8.number().int().nonnegative().default(0),
+  uptime: z8.number().nonnegative().default(0),
+  healthStatus: HealthStatusSchema.default("unknown"),
+  /**
+   * Le répertoire où le processus s'exécute VRAIMENT, absolutisé par l'agent.
+   *
+   * Rapporté par l'agent plutôt que déduit de la config : entre le `cwd` de la
+   * commande, celui du service, l'ancrage sur le projet et les variables que
+   * l'agent étend lui-même, la valeur affichée n'aurait rien prouvé. Ce qui
+   * intéresse quand un service tourne contre le mauvais dépôt, c'est le chemin
+   * final — y compris quand il retombe sur le répertoire de l'agent.
+   */
+  cwd: z8.string().max(4096).nullable().optional()
+});
+var LogLevelSchema = z9.enum(["debug", "info", "warn", "error", "fatal"]);
+var LogLineSchema = z9.object({
+  /** Raw log line as received from the process (immutable context) */
+  raw: z9.string(),
+  /** Source stream (immutable context) */
+  stream: z9.enum(["stdout", "stderr"]),
+  /** Severity level */
+  level: LogLevelSchema,
+  /** Parsed/enriched message to display */
+  message: z9.string(),
+  /** When true, the line is hidden from the log view */
+  hidden: z9.boolean(),
+  /** Arbitrary key/value pairs shown in the detail panel */
+  metadata: z9.record(z9.string().max(256), z9.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  /** Full parsed JSON object when the line is JSON */
+  json: z9.record(z9.string(), z9.unknown()).optional(),
+  /** Custom header for the JSON log card (supports HTML, sanitized before display) */
+  jsonHeader: z9.string().max(256).optional()
+});
+var LogCardDirectiveSchema = z9.object({
+  id: z9.string().max(128),
+  type: z9.string().max(64),
+  header: z9.string().max(256),
+  collapsable: z9.boolean().optional(),
+  collapsed: z9.boolean().optional(),
+  state: z9.enum(["open", "append", "close", "self"])
+});
+var ParsedLogSchema = z9.object({
+  id: z9.string().max(128),
+  processId: z9.string().max(128),
+  pid: z9.number().int().nullable().optional(),
+  timestamp: z9.coerce.date(),
+  level: LogLevelSchema.default("info"),
+  message: z9.string().max(16384),
+  raw: z9.string().max(16384),
+  stream: z9.enum(["stdout", "stderr"]).default("stdout"),
+  hidden: z9.boolean().optional().default(false),
+  metadata: z9.record(z9.string().max(256), z9.unknown()).optional().refine(
+    (obj) => !obj || Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  json: z9.record(z9.string(), z9.unknown()).optional(),
+  logCard: LogCardDirectiveSchema.optional(),
+  sourceType: z9.enum(["console", "file", "mongo", "mysql"]).optional(),
+  sourcePath: z9.string().max(4096).optional()
+});
+var ENV_VAR_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var AgentConfigSchema = z10.object({
+  id: z10.string().max(128),
+  name: z10.string().min(1).max(100),
+  url: z10.string().url().max(2048),
+  passphrase: z10.string().min(1).max(1024),
+  passthroughEnv: z10.array(
+    z10.string().regex(ENV_VAR_NAME_REGEX).max(256)
+  ).max(100).default([])
+});
+var AgentStatusSchema = z10.object({
+  connected: z10.boolean(),
+  lastSeen: z10.string().nullable().optional(),
+  uptime: z10.number().nonnegative().default(0),
+  runnersAvailable: z10.array(z10.enum(["native", "docker"])).default(["native"]),
+  lanIp: z10.string().optional(),
+  /**
+   * Ce que la machine de l'agent vaut pour les builtins de portée `agent`.
+   * Sert à PRÉVISUALISER — la valeur injectée reste calculée au lancement, par
+   * l'agent lui-même : une IP change, un agent se déconnecte, et un statut
+   * n'est qu'un cliché.
+   */
+  os: z10.string().max(64).optional(),
+  home: z10.string().max(4096).optional(),
+  cwd: z10.string().max(4096).optional()
+});
+var GlobalRoleSchema = z11.enum(["owner", "admin", "member"]);
+var ProjectRoleSchema = z11.enum(["admin", "editor", "viewer"]);
+var ProjectMemberRoleSchema = z11.object({
+  id: z11.string().max(128),
+  projectId: z11.string().max(128),
+  userId: z11.string().max(128),
+  role: ProjectRoleSchema
+});
+var ConfigVersionSchema = z12.object({
+  id: z12.string().max(128),
+  entityType: z12.enum(["project", "service"]),
+  entityId: z12.string().max(128),
+  version: z12.string().max(128),
+  parentVersion: z12.string().max(128),
+  data: z12.record(z12.string(), z12.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 1e3,
+    "Too many data keys (max 1000)"
+  ),
+  patch: z12.array(z12.record(z12.string(), z12.unknown())).max(1e3),
+  userId: z12.string().max(128),
+  timestamp: z12.coerce.date(),
+  resolved: z12.boolean().default(false)
+});
+var ConfigChangeSchema = z12.object({
+  entityType: z12.enum(["project", "service"]),
+  entityId: z12.string().max(128),
+  version: z12.string().max(128),
+  parentVersion: z12.string().max(128),
+  data: z12.record(z12.string(), z12.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 1e3,
+    "Too many data keys (max 1000)"
+  ),
+  patch: z12.array(z12.record(z12.string(), z12.unknown())).max(1e3)
+});
+var SyncStatusSchema = z12.object({
+  connected: z12.boolean(),
+  lastSync: z12.coerce.date().nullable().optional(),
+  pendingChanges: z12.number().int().nonnegative().default(0),
+  conflicts: z12.number().int().nonnegative().default(0)
+});
+var AuditActionSchema = z13.enum([
+  "create",
+  "update",
+  "delete",
+  "invite",
+  "remove",
+  "deploy",
+  "start",
+  "stop",
+  "roleChange"
+]);
+var AuditEntityTypeSchema = z13.enum([
+  "org",
+  "project",
+  "service",
+  "member",
+  "permission"
+]);
+var AuditLogSchema = z13.object({
+  id: z13.string().max(128),
+  orgId: z13.string().max(128),
+  userId: z13.string().max(128),
+  action: AuditActionSchema,
+  entityType: AuditEntityTypeSchema,
+  entityId: z13.string().max(128),
+  metadata: z13.record(z13.string().max(256), z13.unknown()).default({}).refine(
+    (obj) => Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  timestamp: z13.coerce.date()
+});
+var ProcessMetricsSchema = z14.object({
+  processId: z14.string().max(128),
+  cpu: z14.number().nonnegative(),
+  memory: z14.number().int().nonnegative(),
+  timestamp: z14.string()
+});
+var EnvironmentVariablesSchema = z15.record(
+  z15.string().max(256),
+  VariableSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variables" }
+);
+var EnvironmentSchema = z15.object({
+  id: z15.string().max(128),
+  projectId: z15.string().max(128),
+  name: z15.string().min(1).max(200),
+  description: z15.string().max(2e3).optional().default(""),
+  parentIds: z15.array(z15.string().max(128)).max(10).default([]),
+  variables: EnvironmentVariablesSchema.default({}),
+  // Scope: 'global' = project-level env, 'service' = per-service env
+  scope: z15.enum(["global", "service"]).default("global"),
+  // When scope='service': the serviceId this env belongs to
+  reference: z15.string().max(128).optional(),
+  // When scope='service': the globalEnvId this env activates on
+  activateOn: z15.string().max(128).optional(),
+  immutable: z15.boolean().default(false),
+  default: z15.boolean().optional().default(false),
+  color: z15.string().max(20).optional(),
+  bgColor: z15.string().max(20).optional(),
+  // When scope='global': the default agent used by services that don't have an explicit agentId
+  agentId: z15.string().max(128).optional()
+});
+var ResolvedEnvironmentSchema = z15.object({
+  variables: z15.record(z15.string().max(256), VariableSchema).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved variables" }),
+  env: z15.record(z15.string().max(256), z15.string().max(8192)).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved env vars" }),
+  envSecrets: z15.array(z15.string().max(256)).max(500),
+  sources: z15.record(z15.string().max(256), z15.object({
+    environmentId: z15.string().max(128),
+    environmentName: z15.string().max(200),
+    overridden: z15.boolean(),
+    resolvedFrom: z15.object({
+      environmentId: z15.string().max(128),
+      environmentName: z15.string().max(200)
+    }).optional(),
+    // Set when a machine-local override was applied to this variable, pointing
+    // at the environment that carries the winning override. Distinct from
+    // `overridden`, which also covers "shadows an inherited variable".
+    overriddenBy: z15.object({
+      environmentId: z15.string().max(128),
+      environmentName: z15.string().max(200)
+    }).optional()
+  })).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 source entries" })
+});
+var CreateEnvironmentSchema = EnvironmentSchema.omit({ id: true }).extend({
+  description: z15.string().max(2e3).optional().default(""),
+  parentIds: z15.array(z15.string().max(128)).max(10).optional().default([]),
+  variables: EnvironmentVariablesSchema.optional().default({}),
+  scope: z15.enum(["global", "service"]).optional().default("global"),
+  reference: z15.string().max(128).optional(),
+  activateOn: z15.string().max(128).optional(),
+  immutable: z15.boolean().optional().default(false)
+});
+var UpdateEnvironmentSchema = EnvironmentSchema.partial().required({ id: true }).extend({
+  description: z15.string().max(2e3).optional(),
+  parentIds: z15.array(z15.string().max(128)).max(10).optional(),
+  variables: EnvironmentVariablesSchema.optional(),
+  scope: z15.enum(["global", "service"]).optional(),
+  immutable: z15.boolean().optional(),
+  default: z15.boolean().optional(),
+  agentId: z15.string().max(128).nullable().optional()
+  // null = clear (no default agent)
+});
+var VariableOverrideSchema = z16.object({
+  value: VariableSlotSchema
+});
+var EnvironmentOverridesSchema = z16.record(
+  z16.string().max(128),
+  VariableOverrideSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 5e3,
+  { message: "Max 5000 overrides" }
+);
+var ApiServiceActionSchema = z17.enum([
+  "service:read",
+  "service:start",
+  "service:stop",
+  "service:restart",
+  "service:healthcheck",
+  "service:status",
+  "logs:read"
+]);
+var ApiEnvActionSchema = z17.enum(["env:read", "env:write"]);
+var ApiEnvPermSchema = z17.object({
+  environmentId: z17.string().max(128),
+  actions: z17.array(ApiEnvActionSchema).max(10).default(["env:read"]),
+  includeSecrets: z17.boolean().default(false)
+});
+var ApiServicePermSchema = z17.object({
+  serviceId: z17.string().max(128),
+  actions: z17.array(ApiServiceActionSchema).max(10).default(["service:read"]),
+  environments: z17.array(ApiEnvPermSchema).max(100).default([])
+});
+var ApiKeyScopeSchema = z17.object({
+  services: z17.array(ApiServicePermSchema).max(500).default([])
+});
+var ApiKeySchema = z17.object({
+  id: z17.string().max(128),
+  name: z17.string().min(1).max(200),
+  key: z17.string().regex(/^[0-9a-f]{64}$/i),
+  scopes: ApiKeyScopeSchema,
+  createdAt: z17.string().max(64),
+  isPublic: z17.boolean().default(false)
+});
+var PersistedApiKeySchema = ApiKeySchema.extend({
+  key: z17.string().min(1).max(4096)
+});
+var ApiKeysFileSchema = z17.object({
+  keys: z17.array(PersistedApiKeySchema).max(100)
+});
+var MaskedApiKeySchema = ApiKeySchema.omit({ key: true }).extend({
+  /** Last 4 characters of the secret, for recognising a key in a list. */
+  keyPreview: z17.string().max(8)
+});
+var ALLOWED_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+var ImagePartSchema = z18.object({
+  type: z18.literal("image"),
+  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z18.string().min(1),
+  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
+  altText: z18.string().max(500).optional()
+});
+var ImageUploadResponseSchema = z18.object({
+  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z18.string().min(1),
+  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z18.string()
+});
+var ImageMetaSchema = z18.object({
+  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  filePath: z18.string().min(1),
+  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z18.string().min(1),
+  createdAt: z18.number().positive(),
+  size: z18.number().positive().optional()
+});
+var KanbanAttachmentSchema = z19.object({
+  /** Server-issued id, also the storage key. */
+  id: z19.string().max(128),
+  name: z19.string().max(255),
+  size: z19.number().int().nonnegative(),
+  contentType: z19.string().max(128)
+});
+var KanbanCardEventSchema = z19.object({
+  type: z19.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment", "archived", "unarchived"]),
+  timestamp: z19.string(),
+  /** Extra context: old/new column name, old/new title, comment text, etc. */
+  /**
+   * Le texte de l'entrée : le corps d'un commentaire, ou le contexte du geste.
+   *
+   * Borné comme le corps d'une carte (100 000), et non plus à 5 000 : un
+   * commentaire est de la prose comme une description, et rien de technique ne
+   * justifiait un écart de vingt fois. La borne étroite s'est vue à l'import
+   * d'un Kanbanize, où des commentaires de 12 000 caractères passaient par
+   * l'API publique — bornée, elle, à 20 000 — pour écrire en base une donnée que
+   * ce schéma déclarait invalide, et qu'aucune reprise depuis l'interface
+   * n'aurait ensuite pu enregistrer.
+   */
+  detail: z19.string().max(1e5).optional(),
+  /**
+   * Stable identity of the event, used to tell an edit from an insertion when a
+   * whole history is written back. Absent on events recorded before the field
+   * existed; those fall back to (type, timestamp).
+   */
+  id: z19.string().max(128).optional(),
+  /**
+   * La colonne où l'événement fait entrer la carte (`created`, `moved`,
+   * `unarchived`). Le `detail` n'en porte que le titre, qu'un renommage rend
+   * introuvable : l'identifiant, lui, tient. Absent des événements antérieurs
+   * que la migration n'a pas pu rapprocher.
+   */
+  columnId: z19.string().max(128).optional(),
+  /** Who authored this event — 'ai' or 'user'. Only set for comment events. */
+  author: z19.enum(["ai", "user"]).optional(),
+  /**
+   * Qui est derrière l'événement, estampillé par le serveur — jamais pris du
+   * client, sans quoi n'importe qui pourrait signer au nom d'un autre.
+   *
+   * Posé sur les commentaires (c'est ce qui rend « mon propre commentaire »
+   * répondable ; `author` ne sépare que l'IA de l'humain) et sur les
+   * déplacements. Absent des événements écrits avant qu'on l'estampille : un
+   * lecteur doit donc afficher « on ne sait pas », pas un nom vide.
+   *
+   * Pour une clé d'API, c'est le nom de la clé et non son porteur : la clé
+   * emprunte les droits de son créateur, pas son identité — personne ne doit
+   * croire qu'un humain a déplacé ce qu'un robot de CI a déplacé.
+   */
+  authorUser: z19.object({ id: z19.string().max(128), name: z19.string().max(200) }).optional(),
+  /** Set when the author amended their comment, so the UI can say so. */
+  editedAt: z19.string().optional(),
+  /** Files attached to a comment — same storage as a card's own attachments. */
+  attachments: z19.array(KanbanAttachmentSchema).max(20).optional(),
+  /** Conversation that produced this event (comments only). Used to navigate back to the conversation. */
+  conversationId: z19.string().optional()
+});
+var KanbanBoardEventTypeSchema = z19.enum([
+  "board_renamed",
+  "column_added",
+  "column_renamed",
+  "column_deleted",
+  "card_deleted"
+]);
+var KanbanBoardHistoryEntrySchema = z19.object({
+  id: z19.string().max(128),
+  source: z19.enum(["card", "board"]),
+  type: z19.union([KanbanCardEventSchema.shape.type, KanbanBoardEventTypeSchema]),
+  timestamp: z19.string(),
+  detail: z19.string().max(1e5).optional(),
+  author: KanbanCardEventSchema.shape.author,
+  authorUser: KanbanCardEventSchema.shape.authorUser,
+  columnId: z19.string().max(128).optional(),
+  /** La carte concernée : celle qui porte l'événement, ou celle supprimée. */
+  card: z19.object({ id: z19.string().max(128), title: z19.string().max(500) }).optional(),
+  /** Pour un renommage : l'ancien nom, puis le nouveau. Sinon, le nom concerné dans `to`. */
+  from: z19.string().max(500).optional(),
+  to: z19.string().max(500).optional()
+});
+var KanbanCardSchema = z19.object({
+  id: z19.string(),
+  title: z19.string().min(1).max(500),
+  markdown: z19.string().max(1e5).default(""),
+  /**
+   * Legacy inline images, kept so boards written before object storage still
+   * render. New uploads go to `attachments` instead.
+   */
+  images: z19.array(z19.string()).default([]),
+  /** Files attached to the card — stored out of band, referenced here. */
+  attachments: z19.array(KanbanAttachmentSchema).max(50).default([]),
+  order: z19.number().int(),
+  /**
+   * La priorité de la carte, de 1 à 10 — 10 étant le plus urgent.
+   *
+   * Facultative, et absente veut dire « pas de priorité », pas « la plus
+   * basse » : une carte qu'on n'a pas encore arbitrée ne doit pas se ranger
+   * d'office au fond de la pile.
+   */
+  priority: z19.number().int().min(1).max(10).optional(),
+  /**
+   * Les groupes de la carte — des étiquettes libres, posées par l'équipe.
+   *
+   * Rien ne les déclare ailleurs : un groupe existe parce qu'une carte le
+   * porte, et disparaît avec la dernière qui le portait. C'est ce qui permet
+   * d'en créer un en le tapant, sans passer par un écran d'administration.
+   */
+  groups: z19.array(z19.string().min(1).max(60)).max(30).optional(),
+  /**
+   * L'échéance de la carte : le jour où elle est attendue, `AAAA-MM-JJ`.
+   *
+   * Un jour, pas un instant, et c'est une décision : une équipe se dit « pour
+   * vendredi », jamais « pour vendredi 23:59:59 UTC ». Stocker un instant
+   * ferait afficher une échéance au 4 mars comme le 3 mars à qui travaille à
+   * l'ouest de Greenwich — la carte serait en retard d'un jour pour la moitié
+   * de l'équipe, et personne ne saurait pourquoi.
+   *
+   * Facultative, et absente veut dire « pas d'échéance », pas « en retard » :
+   * une carte qu'on n'a pas datée ne doit pas s'annoncer comme urgente.
+   */
+  deadline: z19.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
+  /**
+   * La couleur de la carte, en hexadécimal (`#RRGGBB`) — un liseré en haut de
+   * la carte, et rien d'autre : ce qu'elle veut dire appartient à l'équipe.
+   *
+   * Bornée à une notation stricte plutôt qu'à une chaîne libre : cette valeur
+   * finit dans un attribut `style`, et une couleur ne doit pouvoir contenir
+   * qu'une couleur. Absente sur les cartes sans couleur.
+   */
+  color: z19.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  /**
+   * Le journal de la carte — commentaires compris.
+   *
+   * Optionnel, et c'est tout l'intérêt : c'est la partie qui grossit sans fin
+   * (une IA bavarde y écrit des pages), alors les lectures de tableau ne le
+   * transportent plus. `undefined` veut dire « pas chargé », et une écriture
+   * qui l'omet laisse au serveur celui qu'il a en base — à ne pas confondre
+   * avec `[]`, qui demanderait bel et bien de le vider.
+   */
+  history: z19.array(KanbanCardEventSchema).optional(),
+  /**
+   * Ce que le journal absent laisse quand même dire : combien de commentaires,
+   * et quand fut le dernier. Posés par le serveur en lecture, ignorés en
+   * écriture — la carte ne les stocke pas, ils se déduisent de `history`.
+   */
+  commentCount: z19.number().int().nonnegative().optional(),
+  lastCommentAt: z19.string().optional(),
+  /**
+   * L'auteur du dernier commentaire, pour son avatar sur la tuile. Même règle :
+   * posé en lecture, ignoré en écriture. `id`/`name` absents quand le
+   * commentaire précède l'estampille d'auteur — on sait alors seulement si
+   * c'était une IA.
+   */
+  lastCommentBy: z19.object({ id: z19.string().max(128).optional(), name: z19.string().max(200).optional(), author: z19.enum(["ai", "user"]).optional() }).optional(),
+  /**
+   * Les entrées de journal qui ouvrent une conversation IA. Elles restent dans
+   * la lecture allégée — il y en a une poignée par carte, et l'hôte s'en sert
+   * pour dire, sans ouvrir la carte, qu'une IA y travaille.
+   */
+  conversationEvents: z19.array(KanbanCardEventSchema).optional(),
+  createdAt: z19.string(),
+  updatedAt: z19.string(),
+  /**
+   * Quand la carte a été archivée — absente tant qu'elle est au tableau.
+   *
+   * Une carte archivée reste dans sa colonne en base : c'est la lecture qui la
+   * retire du tableau, jamais une écriture qui la déplace. Rien à recoller donc
+   * au désarchivage, et aucun cimetière où une carte pourrait se perdre.
+   */
+  archivedAt: z19.string().optional(),
+  /**
+   * La colonne d'où la carte a été archivée, telle qu'elle s'appelait alors.
+   *
+   * L'identifiant sert à l'y remettre, le titre à le dire dans l'archive même
+   * quand la colonne a disparu depuis — auquel cas le désarchivage repose la
+   * carte dans la première colonne, sans se taire sur son origine.
+   */
+  archivedFrom: z19.object({ columnId: z19.string().max(128), columnTitle: z19.string().max(200) }).optional(),
+  /**
+   * Le tableau d'origine d'une carte vue depuis un tableau où elle est posée
+   * en référence. Jamais stocké : le serveur le pose à la lecture. Absent chez elle.
+   */
+  origin: z19.object({ boardId: z19.string().max(64), boardName: z19.string().max(200) }).optional(),
+  /**
+   * Quand la carte a été supprimée. Rien n'est effacé : la carte reste en base,
+   * et toutes les lectures l'écartent.
+   *
+   * Une suppression est le seul geste que rien ne rattrape — sauf à ne pas
+   * l'exécuter vraiment. La colonne et le tableau portent le même champ, pour
+   * que supprimer l'un n'emporte jamais les cartes de l'autre.
+   */
+  deletedAt: z19.string().optional(),
+  /**
+   * People assigned to the card. Names are denormalized for display; the server
+   * keeps only members of the owning organization, and notifies newcomers.
+   */
+  assignees: z19.array(z19.object({ id: z19.string().max(128), name: z19.string().max(200) })).max(20).default([]),
+  /**
+   * Who first created the card. Stamped by the server the first time a card id
+   * appears in a board write, never taken from the client — a member could
+   * otherwise claim any authorship. Absent on cards created before this field
+   * existed, so readers must treat it as unknown rather than assume.
+   */
+  createdBy: z19.object({ id: z19.string().max(128), name: z19.string().max(200) }).optional()
+});
+var KanbanColumnSchema = z19.object({
+  id: z19.string(),
+  title: z19.string().min(1).max(200),
+  order: z19.number().int(),
+  cards: z19.array(KanbanCardSchema).default([]),
+  /**
+   * Le regroupement auquel la colonne appartient, s'il y en a un.
+   *
+   * Un pointeur vers le parent, et rien dans l'autre sens : le groupe ne tient
+   * pas la liste de ses membres. Deux listes qui prétendent dire qui contient
+   * quoi finissent par se contredire, et un déplacement devient alors deux
+   * écritures au lieu d'une.
+   */
+  groupId: z19.string().optional(),
+  /**
+   * Colonne de cartes finalisées : y entrer compte comme « finalisée » dans les
+   * statistiques de la liste, au même titre qu'un archivage.
+   */
+  done: z19.boolean().optional(),
+  /** Supprimée, mais conservée — voir `deletedAt` sur la carte. */
+  deletedAt: z19.string().optional()
+});
+var KanbanColumnGroupSchema = z19.object({
+  id: z19.string(),
+  title: z19.string().min(1).max(200),
+  /** La couleur du bandeau, en hexadécimal — l'interface décide du défaut. */
+  color: z19.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  /** Le groupe parent, pour les regroupements imbriqués. */
+  parentId: z19.string().optional(),
+  /** Supprimé, mais conservé — comme une colonne. */
+  deletedAt: z19.string().optional()
+});
+var KanbanBoardSchema = z19.object({
+  id: z19.string(),
+  name: z19.string().min(1).max(200),
+  description: z19.string().max(1e4).default(""),
+  /**
+   * Le mode d'emploi du tableau, en texte libre : ce que veulent dire ses
+   * colonnes, quand une carte a le droit d'avancer, les conventions de
+   * l'équipe. Écrit par les humains, lu surtout par l'IA — il est injecté dans
+   * le prompt des agents pour qu'ils travaillent selon les règles du tableau
+   * plutôt que selon les leurs.
+   */
+  instructions: z19.string().max(2e4).default(""),
+  columns: z19.array(KanbanColumnSchema).default([]),
+  /** Les regroupements de colonnes — vide sur un tableau qui n'en a jamais eu. */
+  columnGroups: z19.array(KanbanColumnGroupSchema).default([]),
+  /**
+   * Les projets auxquels le tableau est rattaché, par leur identifiant.
+   *
+   * Un rattachement, pas une possession : il ne sert qu'à filtrer la liste des
+   * tableaux, et un tableau sans projet (`[]`, le cas par défaut) reste visible
+   * partout. Plusieurs projets sont permis parce qu'une équipe partage souvent
+   * un même tableau entre deux projets — obliger à choisir l'un des deux
+   * ferait disparaître le tableau de la liste de l'autre.
+   *
+   * Les identifiants sont ceux des projets de l'organisation ; le serveur
+   * refuse ceux qu'il ne connaît pas plutôt que de garder un lien mort.
+   */
+  projectIds: z19.array(z19.string().min(1).max(128)).max(20).default([]),
+  archived: z19.boolean().default(false),
+  /** Supprimé, mais conservé avec ses cartes — voir `deletedAt` sur la carte. */
+  deletedAt: z19.string().optional(),
+  createdAt: z19.string(),
+  updatedAt: z19.string()
+});
+var CreateKanbanBoardInput = z19.object({
+  name: z19.string().min(1).max(200),
+  description: z19.string().max(1e4).optional(),
+  instructions: z19.string().max(2e4).optional(),
+  projectIds: z19.array(z19.string().min(1).max(128)).max(20).optional()
+});
+var UpdateKanbanBoardInput = z19.object({
+  id: z19.string(),
+  name: z19.string().min(1).max(200).optional(),
+  description: z19.string().max(1e4).optional(),
+  instructions: z19.string().max(2e4).optional(),
+  columns: z19.array(KanbanColumnSchema).optional(),
+  archived: z19.boolean().optional(),
+  projectIds: z19.array(z19.string().min(1).max(128)).max(20).optional()
+});
+var KanbanCardLinkSchema = z19.object({
+  id: z19.string().max(128),
+  /** Le tableau et la carte qui *dépendent* de l'autre. */
+  childBoardId: z19.string().max(64),
+  childCardId: z19.string().max(128),
+  /** Le tableau et la carte *dont* on dépend. */
+  parentBoardId: z19.string().max(64),
+  parentCardId: z19.string().max(128),
+  createdAt: z19.string(),
+  createdBy: z19.object({ id: z19.string().max(128), name: z19.string().max(200) }).optional()
+});
+var KanbanCardRefSchema = z19.object({
+  cardId: z19.string().max(128),
+  boardId: z19.string().max(64),
+  boardName: z19.string().max(200),
+  columnId: z19.string().max(128),
+  columnTitle: z19.string().max(200),
+  title: z19.string().max(500),
+  /** Les mêmes informations qu'une ligne de tableau montre d'une carte d'ici. */
+  assignees: z19.array(z19.object({ id: z19.string().max(128), name: z19.string().max(200) })).default([]),
+  commentCount: z19.number().int().nonnegative().default(0)
+});
+var KanbanCardLocationSchema = z19.object({
+  boardId: z19.string().max(64),
+  boardName: z19.string().max(200),
+  columnId: z19.string().max(128),
+  columnTitle: z19.string().max(200),
+  home: z19.boolean()
+});
+var CloudApiScopeSchema = z20.enum([
+  "kanban:read",
+  "kanban:write",
+  "kanban:comment",
+  "kanban:delete"
+]);
+var CloudApiKeySecretSchema = z20.string().regex(/^rk_[0-9a-f]{64}$/);
+var CloudApiKeySchema = z20.object({
+  id: z20.string().max(128),
+  organizationId: z20.string().max(128),
+  name: z20.string().min(1).max(200),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
+  /**
+   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
+   * l'organisation ».
+   *
+   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
+   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
+   * nommait plus que lui.
+   */
+  boards: z20.array(z20.string().max(64)).max(200).nullable(),
+  createdAt: z20.string().max(64),
+  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
+  lastUsedAt: z20.string().max(64).nullable(),
+  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
+  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }),
+  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
+  keyPreview: z20.string().max(8)
+});
+var CreatedCloudApiKeySchema = z20.object({
+  key: CloudApiKeySchema,
+  secret: CloudApiKeySecretSchema
+});
+var CreateCloudApiKeyInput = z20.object({
+  organizationId: z20.string().min(1).max(128),
+  name: z20.string().min(1).max(200),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
+  boards: z20.array(z20.string().max(64)).max(200).nullable().default(null)
+});
+var UpdateCloudApiKeyInput = z20.object({
+  id: z20.string().min(1).max(128),
+  name: z20.string().min(1).max(200).optional(),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10).optional(),
+  boards: z20.array(z20.string().max(64)).max(200).nullable().optional()
+});
+var IntegrationProviderSchema = z21.enum(["intercom", "hubspot"]);
+var IntegrationConnectionSchema = z21.object({
+  id: z21.string().max(128),
+  organizationId: z21.string().max(128),
+  provider: IntegrationProviderSchema,
+  name: z21.string().min(1).max(200),
+  /** Le tableau et la colonne de création — seulement avec la création automatique. */
+  boardId: z21.string().max(64).nullable(),
+  columnId: z21.string().max(128).nullable(),
+  enabled: z21.boolean(),
+  /**
+   * L'URL complète du webhook à coller chez le fournisseur, construite par le
+   * cloud (domaine public des webhooks). Elle contient un jeton imprévisible.
+   */
+  webhookUrl: z21.string().max(2048),
+  /** Les quatre derniers caractères du secret de signature, pour le reconnaître. */
+  secretPreview: z21.string().max(8),
+  region: z21.string().max(16),
+  /** Créer une carte pour toute conversation qui n'est encore liée nulle part. */
+  autoCreate: z21.boolean(),
+  createdBy: z21.object({ id: z21.string().max(128), name: z21.string().max(200) }),
+  createdAt: z21.string().max(64),
+  lastEventAt: z21.string().max(64).nullable()
+});
+var IntegrationConversationStateSchema = z21.enum(["open", "resolved"]);
+var IntegrationMessageSchema = z21.object({
+  id: z21.string().max(256),
+  author: z21.object({ name: z21.string().max(500), role: z21.enum(["customer", "agent"]) }),
+  body: z21.string().max(1e5),
+  internal: z21.boolean(),
+  sentAt: z21.string().max(64),
+  /** Fichiers joints et images, copiés dans Runeya : ils se lisent comme ceux d'une carte. */
+  attachments: z21.array(KanbanAttachmentSchema).max(50),
+  /** Noms des fichiers qui n'ont pas pu être copiés. */
+  missingAttachments: z21.array(z21.string().max(500)).max(50)
+});
+var IntegrationConversationSchema = z21.object({
+  id: z21.string().max(256),
+  connectionId: z21.string().max(128),
+  provider: IntegrationProviderSchema,
+  externalId: z21.string().max(128),
+  title: z21.string().max(500),
+  url: z21.string().max(2e3).nullable(),
+  state: IntegrationConversationStateSchema,
+  updatedAt: z21.string().max(64)
+});
+var CardConversationSchema = IntegrationConversationSchema.extend({
+  origin: z21.enum(["auto", "manual"]),
+  /** Les fichiers de la conversation sont en train d'être copiés : ils vont apparaître. */
+  filesPending: z21.boolean(),
+  linkedAt: z21.string().max(64),
+  opening: z21.object({
+    author: IntegrationMessageSchema.shape.author,
+    body: z21.string().max(1e5),
+    attachments: z21.array(KanbanAttachmentSchema).max(50),
+    missingAttachments: z21.array(z21.string().max(500)).max(50)
+  }).nullable(),
+  messages: z21.array(IntegrationMessageSchema),
+  otherCards: z21.array(z21.object({ boardId: z21.string().max(64), cardId: z21.string().max(64), title: z21.string().max(500) }))
+});
+var ConversationSearchHitSchema = IntegrationConversationSchema.extend({
+  preview: z21.string().max(500),
+  linkedCards: z21.array(z21.object({ boardId: z21.string().max(64), cardId: z21.string().max(64), title: z21.string().max(500) }))
+});
+var ChangelogSurfaceSchema = z22.enum(["app", "cloud"]);
+var ChangelogChangeKindSchema = z22.enum(["feature", "improvement", "fix", "breaking"]);
+var ChangelogTextSchema = z22.object({
+  fr: z22.string().min(1).max(500),
+  en: z22.string().min(1).max(500)
+});
+var ChangelogChangeSchema = z22.object({
+  kind: ChangelogChangeKindSchema,
+  text: ChangelogTextSchema
+});
+var ChangelogDraftSchema = ChangelogChangeSchema.extend({
+  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  title: ChangelogTextSchema.optional()
+});
+var ChangelogReleaseSchema = z22.object({
+  surface: ChangelogSurfaceSchema,
+  /** `1.4.2` pour l'app (version npm publiée), `2026-09-03` — ou `2026-09-03.2` — pour le cloud. */
+  version: z22.string().min(1).max(32).regex(/^[0-9][0-9.-]*$/),
+  /** Date de publication, `YYYY-MM-DD`. */
+  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  /** Facultatif : une version peut s'annoncer par son seul numéro. */
+  title: ChangelogTextSchema.optional(),
+  /** Une version sans changement n'a rien à annoncer : elle n'a pas sa place ici. */
+  changes: z22.array(ChangelogChangeSchema).min(1).max(50)
+});
+var ChangelogIndexItemSchema = ChangelogReleaseSchema.omit({ changes: true }).extend({
+  changeCount: z22.number().int().nonnegative()
+});
+var MASKED_VALUE = "***";
+function maskLogSourceSecrets(sources) {
+  return sources.map((src) => {
+    if (src.type === "mongo") return { ...src, connectionString: MASKED_VALUE };
+    if (src.type === "mysql" && src.password) return { ...src, password: MASKED_VALUE };
+    return src;
+  });
+}
+var BUILTIN_VARIABLES = [
+  // ── Le service ───────────────────────────────────────────────────────────
+  { name: "service.NAME", scope: "server", descriptionKey: "serviceName" },
+  { name: "service.ID", scope: "server", descriptionKey: "serviceId" },
+  { name: "service.PORT", scope: "server", descriptionKey: "servicePort" },
+  { name: "service.URL", scope: "server", descriptionKey: "serviceUrl" },
+  { name: "service.BASE_URL", scope: "server", descriptionKey: "serviceBaseUrl" },
+  { name: "service.CWD", scope: "agent", descriptionKey: "serviceCwd" },
+  // ── Le projet et l'environnement actif ───────────────────────────────────
+  { name: "project.NAME", scope: "server", descriptionKey: "projectName" },
+  { name: "runeya.ENV_NAME", scope: "server", descriptionKey: "envName" },
+  // ── Le serveur Runeya ────────────────────────────────────────────────────
+  // `service.HOST` a toujours désigné l'adresse d'écoute du SERVEUR, pas une
+  // propriété du service : le nom trompait, il devient un alias.
+  { name: "runeya.HOST", scope: "server", descriptionKey: "runeyaHost", deprecatedAlias: "service.HOST" },
+  // ── La machine qui exécute ───────────────────────────────────────────────
+  { name: "agent.HOST_LAN", scope: "agent", descriptionKey: "agentHostLan", deprecatedAlias: "service.HOST_LAN" },
+  // Le NOM de l'agent est une étiquette de la configuration du serveur, pas
+  // une propriété de la machine : c'est le serveur qui le connaît et le résout.
+  { name: "agent.NAME", scope: "server", descriptionKey: "agentName" },
+  { name: "agent.OS", scope: "agent", descriptionKey: "agentOs" },
+  { name: "agent.HOME", scope: "agent", descriptionKey: "agentHome" }
+];
+var GRACE_PERIOD = 1e4;
+var AGENT_STOP_FETCH_TIMEOUT = GRACE_PERIOD + 15e3;
+var SUPPORTED_EDITORS = [
+  { key: "vscode", name: "Visual Studio Code", command: "code" },
+  { key: "cursor", name: "Cursor", command: "cursor" },
+  { key: "windsurf", name: "Windsurf", command: "windsurf" },
+  { key: "sublime", name: "Sublime Text", command: "subl" },
+  { key: "atom", name: "Atom", command: "atom" },
+  { key: "antigravity", name: "Antigravity", command: "antigravity" },
+  { key: "intellij", name: "IntelliJ IDEA", command: "idea" },
+  { key: "android-studio", name: "Android Studio", command: "studio" },
+  { key: "webstorm", name: "WebStorm", command: "webstorm" },
+  { key: "zed", name: "Zed", command: "zed" },
+  { key: "neovim", name: "Neovim", command: "nvim" },
+  { key: "vim", name: "Vim", command: "vim" },
+  { key: "emacs", name: "Emacs", command: "emacs" },
+  { key: "fleet", name: "Fleet", command: "fleet" }
+];
+var EDITOR_BY_KEY = new Map(
+  SUPPORTED_EDITORS.map((e) => [e.key, e])
+);
+
+// ../ai-capabilities/dist/index.js
+import { z as z24 } from "zod";
+import { z as z32 } from "zod";
+function toList(raw) {
+  if (!raw) return [];
+  const text2 = raw.trim();
+  if (text2.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(text2);
+      if (Array.isArray(parsed)) return parsed.map((v) => String(v).trim()).filter(Boolean);
+    } catch {
+    }
+  }
+  return text2.split(",").map((v) => v.trim().replace(/^["'[]+|["'\]]+$/g, "")).filter(Boolean);
+}
+function clearable(raw, parse, key) {
+  if (raw === void 0) return {};
+  const text2 = String(raw).trim();
+  if (!text2 || text2 === "null") return { [key]: null };
+  return { [key]: parse(text2) };
+}
+function gitTarget(p) {
+  return {
+    ...p.serviceId ? { serviceId: p.serviceId } : {},
+    ...p.projectId ? { projectId: p.projectId } : {},
+    ...p.agentId ? { agentId: p.agentId } : {},
+    ...p.orgId ? { orgId: p.orgId } : {}
+  };
+}
+var toBool = (raw) => raw.trim().toLowerCase() === "true";
+var newId = () => globalThis.crypto.randomUUID();
+function listItem(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return raw;
+  }
+}
+function parseTyped(name, schema, raw) {
+  if (raw === void 0) return void 0;
+  let result = raw.trim() === "null" ? schema.safeParse(null) : schema.safeParse(raw);
+  if (!result.success && raw.trim() === "null") result = schema.safeParse(raw);
+  if (!result.success) {
+    const text2 = raw.trim();
+    const json = listItem(text2);
+    if (json !== text2) result = schema.safeParse(json);
+    if (!result.success && !/^[[{]/.test(text2)) {
+      const list = schema.safeParse(toList(text2).map(listItem));
+      if (list.success) result = list;
+    }
+  }
+  if (!result.success) throw new Error(`${name}: ${z23.prettifyError(result.error)}`);
+  return result.data;
+}
+function withIds(items) {
+  return items.map((item) => ({ ...item, id: item.id || newId() }));
+}
+var optionalId = (schema) => schema.extend({ id: z23.string().min(1).max(64).optional() });
+var DockerConfigInput = DockerConfigSchema.extend({
+  bootstrapCommands: z23.array(optionalId(BootstrapCommandSchema)).max(20).default([])
+}).refine((c) => !!c.image !== !!c.dockerfile, {
+  message: 'dockerConfig needs exactly one of "image" (an image to pull) or "dockerfile" (a Dockerfile to build)'
+});
+var SERVICE_FIELDS = [
+  { name: "description", description: "What the service is, in a sentence" },
+  { name: "agentId", description: "The agent that runs it, from list_agents. Omit to inherit from the environment.", clearable: true },
+  { name: "cwd", description: `Working directory, RELATIVE to the project root (e.g. "apps/web", or omit for the root). The project is synced between machines and lives in a different folder on each: Runeya resolves a relative cwd against each machine's own project folder, while an absolute path (/home/you/\u2026) breaks on every other machine. Use an absolute path only for something outside the project, written with ~ or an environment variable ($NAME) rather than a literal home directory.`, clearable: true },
+  { name: "command", description: 'Shortcut for a single command line (e.g. "npm run dev"). Replaces every existing command. Use commands for several.' },
+  { name: "commands", description: 'The processes of the service. They all start AT THE SAME TIME, in parallel, and the service runs while they run \u2014 not one after another. Use several for processes that live side by side (a web server and a worker). Steps that must follow each other (build, then install, then launch) go in ONE command chained with &&. A one-off action the user triggers by hand (build, deploy, read logs) is a shortcut, not a command. Each command runs in the service cwd, or its own "cwd", relative to the project root. No absolute paths of this machine: the service is synced to other machines. Replaces every existing command. "id" is generated when omitted; "shell" runs the line through a shell (default true).', schema: z23.array(optionalId(ServiceCommandSchema)).max(50) },
+  { name: "ports", description: "Ports the service listens on. Declare them: they become {{service.PORT}}, {{service.URL}} and {{services.<slug>.URL}} for the other services, which environment variables should reference instead of repeating the numbers.", schema: ServiceConfigSchema.shape.ports.unwrap().unwrap() },
+  { name: "groups", description: "Groups the service belongs to. Replaces the current ones.", schema: ServiceConfigSchema.shape.groups.unwrap().unwrap() },
+  { name: "url", description: "URL where the service is reached" },
+  { name: "localUrls", description: 'Local domain names routed to a port of the service (e.g. {"url":"api.localhost.dev","port":3000})', schema: ServiceConfigSchema.shape.localUrls.unwrap().unwrap() },
+  { name: "openapiUrl", description: "URL of its OpenAPI document" },
+  { name: "docsPath", description: "Where its markdown docs live, relative to cwd or absolute. Defaults to cwd." },
+  { name: "git", description: 'Its git repository: "remote" URL and "home" page', schema: ServiceConfigSchema.shape.git.unwrap(), clearable: true },
+  { name: "meta", description: "Free key/value metadata (strings)", schema: ServiceConfigSchema.shape.meta.unwrap(), clearable: true },
+  { name: "runner", description: '"native" runs the commands on the machine; "docker" runs the service in a container and then needs dockerConfig', schema: ServiceConfigSchema.shape.runner.unwrap().unwrap() },
+  { name: "dockerConfig", description: 'With runner "docker": the container. Exactly one of "image" (pull) or "dockerfile" (inline Dockerfile, built with "buildContext", "buildArgs", "targetStage"). Ports and volumes use Docker syntax ("8080:80", "./data:/data"); host paths in volumes relative to the service directory, never an absolute path of this machine. "useNativeCommand" runs the service commands inside the container instead of its CMD ("nativeCommandMode": one shared container or one per command). "bootstrapCommands" run once when the container starts. Replaces the whole Docker configuration: read it first with get_service to keep what you do not change.', schema: DockerConfigInput },
+  { name: "healthCheck", description: 'How to tell the service is ready: an HTTP "path" to call, or a "command" that must succeed', schema: HealthCheckSchema, clearable: true },
+  { name: "autoRestart", description: "Restart the service when it crashes", schema: z23.boolean() },
+  { name: "restartStrategy", description: "When to restart it", schema: RestartStrategySchema.unwrap() },
+  { name: "maxRestarts", description: "Give up after this many restarts", schema: ServiceConfigSchema.shape.maxRestarts.unwrap() },
+  { name: "restartBackoffMs", description: "Delay before a restart, in milliseconds", schema: ServiceConfigSchema.shape.restartBackoffMs.unwrap().unwrap() },
+  { name: "clearLogsOnStart", description: "Clear the logs each time the service starts", schema: z23.boolean() },
+  { name: "shortcuts", description: 'One-click actions shown on the service, run on demand and independently of the running commands (build, deploy, migrate, read logs). Same path rules as commands: relative to the project root, never an absolute path of this machine. Replaces the current ones. "id" is generated when omitted.', schema: z23.array(optionalId(ServiceShortcutSchema)).max(50) },
+  { name: "parserIds", description: "Log parsers applied to its output, by id", schema: ServiceConfigSchema.shape.parserIds.unwrap() },
+  { name: "logSources", description: 'Extra log sources beyond the console output (files, databases\u2026). Replaces the current ones. Credentials (mongo connectionString, mysql password) read as "***": send "***" back to keep the stored value, or the real value to change it.', schema: ServiceConfigSchema.shape.logSources.unwrap().unwrap() }
+];
+function serviceParams(clearable2) {
+  return SERVICE_FIELDS.map((f) => {
+    const nullable = clearable2 && f.clearable;
+    const base = f.schema ?? (nullable ? z23.string() : void 0);
+    return {
+      name: f.name,
+      description: nullable ? `${f.description} null clears it.` : f.description,
+      required: false,
+      ...base ? { schema: nullable ? base.nullable() : base } : {}
+    };
+  });
+}
+function serviceFields(p, params) {
+  const out = {};
+  for (const param of params) {
+    if (p[param.name] === void 0 || param.name === "command") continue;
+    out[param.name] = param.schema ? parseTyped(param.name, param.schema, p[param.name]) : p[param.name];
+  }
+  if (p.command !== void 0 && p.commands === void 0) out["commands"] = [{ label: "", command: p.command, shell: true }];
+  if (Array.isArray(out["commands"])) out["commands"] = withIds(out["commands"]);
+  if (Array.isArray(out["shortcuts"])) out["shortcuts"] = withIds(out["shortcuts"]);
+  const docker = out["dockerConfig"];
+  if (docker?.bootstrapCommands) out["dockerConfig"] = { ...docker, bootstrapCommands: withIds(docker.bootstrapCommands) };
+  return out;
+}
+function maskServices(result) {
+  if (Array.isArray(result)) return result.map(maskServices);
+  if (result && typeof result === "object" && Array.isArray(result.logSources)) {
+    const service = result;
+    return { ...service, logSources: maskLogSourceSecrets(service.logSources) };
+  }
+  return result;
+}
+var refs = (scope) => BUILTIN_VARIABLES.filter((b) => b.scope === scope).map((b) => `{{${b.name}}}`).join(", ");
+var BUILTINS_HELP = `Built-in references Runeya fills itself \u2014 filled when the service is deployed, from the service that receives the variable: ${refs("server")}, the numbered {{service.PORT_2}} / {{service.URL_2}}\u2026 for its other ports, and {{services.<slug>.PORT}}, .URL, .BASE_URL, .NAME, .ID for a sibling service of the project (slug = its name in lowercase-dashes). Filled on the machine when the service starts: ${refs("agent")}.`;
+var CREATE_SERVICE_PARAMS = serviceParams(false);
+var UPDATE_SERVICE_PARAMS = serviceParams(true);
+var RUNEYA_CAPABILITIES = [
+  {
+    name: "list_services",
+    transformOutput: maskServices,
+    description: "List services, with the serviceId and agentId to use in other calls. Pass the projectId your context names to stay on the project the user is looking at, or another one from list_projects to look elsewhere. Called with no project, this can answer for every project of every organization on the machine \u2014 far more than the interface shows.",
+    route: "service.list",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "Restrict to this project, from list_projects. Omit to list every service on the machine.", required: false },
+      { name: "orgId", description: "With projectId: its organization, needed only when the same project id exists in several. Alone: list the services of this whole organization.", required: false }
+    ],
+    // `orgId` seul est une portée à part entière, que `service.list` sait filtrer :
+    // l'omettre rendait toute la machine.
+    buildInput: (p) => {
+      if (p.projectId) return { projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} };
+      return p.orgId ? { orgId: p.orgId } : void 0;
+    }
+  },
+  {
+    name: "get_service_status",
+    description: "Get the current status (running, stopped, etc.) of a service. A service that has never been started on this agent has no process yet, and this answers 404 Process not found \u2014 that means STOPPED, not forbidden and not missing. Start it, or read its configuration with get_service.",
+    route: "process.get",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, id: p.serviceId })
+  },
+  {
+    name: "get_logs",
+    description: "Get the recent buffered logs for a service.",
+    route: "process.logs",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
+  },
+  {
+    name: "start_service",
+    description: "Start a service on an agent.",
+    route: "process.start",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to start", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  {
+    name: "stop_service",
+    description: "Stop a running service on an agent.",
+    route: "process.stop",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to stop", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  {
+    name: "restart_service",
+    description: "Restart a service on an agent (stop \u2192 redeploy \u2192 start).",
+    route: "process.restart",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to restart", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  // ─── Utility ─────────────────────────────────────────────────────────────
+  {
+    name: "wait",
+    description: "Wait for a given number of milliseconds before continuing.",
+    route: "utility.wait",
+    method: "POST",
+    params: [
+      { name: "ms", description: "Number of MILLISECONDS to wait. Convert from seconds: 1s=1000, 10s=10000, 1min=60000. Max 300000.", required: true }
+    ],
+    buildInput: (p) => ({ ms: Number(p.ms) }),
+    usageHint: '"wait 5s" \u2192 wait(ms=5000), "pause 10 seconds" \u2192 wait(ms=10000), "attends 3 secondes" \u2192 wait(ms=3000). Always convert to milliseconds.'
+  },
+  // ─── Kanban ───────────────────────────────────────────────────────────────
+  {
+    name: "kanban_list_boards",
+    description: "List the kanban boards of the organization. Returns the organizationId actually queried, the boardId to use in the other kanban tools, plus column and card counts. Cards themselves are not included \u2014 use kanban_get_board for those. An empty list means that organization really has no board: a failure to reach the cloud is reported as an error instead, never as an empty list.",
+    route: "kanban.listBoards",
+    method: "GET",
+    params: [
+      { name: "includeArchived", description: 'Set to "true" to include archived boards. Default: false.', required: false },
+      { name: "organizationId", description: "Which organization to read. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => ({
+      includeArchived: p.includeArchived === "true",
+      ...p.organizationId ? { organizationId: p.organizationId } : {}
+    })
+  },
+  {
+    name: "kanban_get_board",
+    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
+    route: "kanban.getBoard",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID, from kanban_list_boards", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId })
+  },
+  {
+    name: "kanban_get_card_comments",
+    description: "Read the comment thread of one kanban card, newest last: who wrote each comment (ai or user, with the person's name), when, its text, and its attachments. The comments in your task context are a snapshot taken when the task started \u2014 call this to see anything written since, whenever someone tells you a comment was added or kanban_get_board reports a higher commentCount than you have.",
+    route: "kanban.getCardComments",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID whose comments to read", required: true },
+      { name: "limit", description: "How many of the most recent comments to return (1-200). Default: 50.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.limit ? { limit: Number(p.limit) } : {}
+    }),
+    usageHint: '"le support a ajout\xE9 un commentaire" / "regarde les nouveaux commentaires" \u2192 kanban_get_card_comments(boardId, cardId). Never answer from the snapshot in your context when fresh comments are mentioned.'
+  },
+  {
+    name: "kanban_search_cards",
+    description: 'Search kanban cards by free text, matched against their title, body, comments and the support conversations they follow (title, messages, internal notes, and the names of message authors) \u2014 accent- and case-insensitive. Archived cards are included. Searches every board of the organization unless boardId narrows it down. createdBy narrows to the cards someone created ("les cartes cr\xE9\xE9es par Isabelle"), alone or with a query.',
+    route: "kanban.searchCards",
+    method: "GET",
+    params: [
+      { name: "query", description: "Text to look for in card titles, bodies, comments and followed conversations. Optional when createdBy is given.", required: false },
+      { name: "createdBy", description: "Only cards created by this author: a user id, or a name (accent- and case-insensitive, partial match).", required: false },
+      { name: "boardId", description: "Restrict the search to this board. Omit to search all boards.", required: false },
+      { name: "limit", description: "Maximum number of cards to return (1-100). Default: 25.", required: false },
+      { name: "organizationId", description: "Which organization to search. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => ({
+      ...p.query ? { query: p.query } : {},
+      ...p.createdBy ? { createdBy: p.createdBy } : {},
+      ...p.boardId ? { boardId: p.boardId } : {},
+      ...p.limit ? { limit: Number(p.limit) } : {},
+      ...p.organizationId ? { organizationId: p.organizationId } : {}
+    })
+  },
+  {
+    name: "kanban_download_attachment",
+    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context, from kanban_get_board, or from kanban_get_card_comments \u2014 a file attached to a comment downloads exactly like one attached to the card.",
+    route: "kanban.downloadAttachment",
+    method: "POST",
+    params: [
+      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true },
+      { name: "boardId", description: "The board the attachment comes from. Pass it whenever you know it: on a machine linked to several cloud accounts, it is what says which one holds the file.", required: false },
+      { name: "organizationId", description: "Which organization the attachment belongs to. Optional: needed only when neither the board id is known nor the machine has a single account.", required: false }
+    ],
+    buildInput: (p) => ({
+      attachmentId: p.attachmentId,
+      ...p.boardId ? { boardId: p.boardId } : {},
+      ...p.organizationId ? { orgId: p.organizationId } : {}
+    })
+  },
+  {
+    name: "kanban_move_card",
+    description: "Move a kanban card to another column. Use the exact column name.",
+    route: "kanban.moveCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID to move", required: true },
+      { name: "targetColumn", description: "Exact name of the target column", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, targetColumn: p.targetColumn })
+  },
+  {
+    name: "kanban_add_comment",
+    description: "Add a comment to a kanban card.",
+    route: "kanban.addComment",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "comment", description: "The comment text (markdown supported)", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, comment: p.comment })
+  },
+  {
+    name: "kanban_get_card_conversations",
+    description: "Read the customer support conversations (Intercom\u2026) linked to one kanban card: for each, its title, provider, state (open/resolved), link, the opening message and the thread of messages (author name, customer or team, internal note or not, date, text, attached files \u2014 fetch their bytes with kanban_download_attachment), plus the other cards following the same conversation. These messages are NOT comments of the card \u2014 read them here.",
+    route: "kanban.getCardConversations",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID whose conversations to read", required: true },
+      { name: "limit", description: "How many of the most recent messages to return per conversation (1-500). Default: 100.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.limit ? { limit: Number(p.limit) } : {}
+    }),
+    usageHint: `"regarde la conversation Intercom de la carte" / "qu'a dit le client" \u2192 kanban_get_card_conversations(boardId, cardId).`
+  },
+  {
+    name: "kanban_search_conversations",
+    description: "Search customer support conversations (Intercom\u2026) at the providers connected to the board's organization, by words of the conversation title, or by conversation number or URL. Read-only at the provider. Each result gives connectionId and externalId (needed to link it), title, state, a preview and the cards already following it.",
+    route: "kanban.searchConversations",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "Any kanban board ID of the organization to search in", required: true },
+      { name: "query", description: "Words of the conversation title, a conversation number, or a conversation URL", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, query: p.query })
+  },
+  {
+    name: "kanban_link_conversation",
+    description: "Link a customer support conversation found with kanban_search_conversations to a kanban card. Its whole thread is imported and new messages keep arriving on the card. A conversation can be linked to several cards. Nothing is written at the provider.",
+    route: "kanban.linkConversation",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID of the card", required: true },
+      { name: "cardId", description: "The card to link the conversation to", required: true },
+      { name: "connectionId", description: "The connectionId of the search result", required: true },
+      { name: "externalId", description: "The externalId of the search result", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, connectionId: p.connectionId, externalId: p.externalId })
+  },
+  {
+    name: "kanban_get_card_links",
+    description: "Read the filiation of a board: which card depends on which. Returns one entry per link (child card \u2194 parent card), plus the title, board, column, assignees and comment count of any linked card living on another board. Use it when a card context says it has a parent or sub-cards and you need their ids to read them.",
+    route: "kanban.getCardLinks",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID whose links to read", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId })
+  },
+  {
+    name: "kanban_set_card_parent",
+    description: "Link a kanban card to a parent card, or detach it. The parent is the card the other one depends on \u2014 an epic and its tasks, a bug and its follow-ups. A card has at most one parent, and setting a new one replaces it. Omit parentCardId to detach. kanban_get_board reports the current filiation as parentCardId / childCardIds on each card.",
+    route: "kanban.setCardParent",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID of the card being linked", required: true },
+      { name: "cardId", description: "The card that depends on the parent (the child)", required: true },
+      { name: "parentCardId", description: "The parent card ID. Omit to detach the card from its parent.", required: false },
+      { name: "parentBoardId", description: "The parent's board, when it lives on another board of the same organization. Defaults to boardId.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.parentCardId ? { parentCardId: p.parentCardId } : {},
+      ...p.parentBoardId ? { parentBoardId: p.parentBoardId } : {}
+    })
+  },
+  {
+    name: "kanban_place_card",
+    description: "Place an existing kanban card on another board of the same organization, without copying it \u2014 a reference. The card stays on its origin board; the target board gives it a column of its own. Editing, commenting, archiving or deleting the card from either board acts on the same card; moving it on the target board only moves the reference. Use it to show an issue from an issue list on a team kanban, for instance.",
+    route: "kanban.placeCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The board to place the card on (not its own board)", required: true },
+      { name: "cardId", description: "The card to place", required: true },
+      { name: "column", description: "The column on that board: its ID or its title", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, column: p.column })
+  },
+  {
+    name: "kanban_remove_card_placement",
+    description: "Remove a card from a board where it was placed as a reference. The card itself is untouched and stays on its origin board.",
+    route: "kanban.unplaceCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The board the reference is on", required: true },
+      { name: "cardId", description: "The card to remove from that board", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
+  },
+  {
+    name: "kanban_get_card_placements",
+    description: "List where a kanban card is: its origin board (home: true), then every board it is placed on as a reference, with the column on each. kanban_get_board flags a referenced card with an `origin` field naming its origin board.",
+    route: "kanban.getCardPlacements",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "Any board the card is on", required: true },
+      { name: "cardId", description: "The card", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
+  },
+  {
+    name: "kanban_add_card",
+    description: "Add a new card to a kanban column.",
+    route: "kanban.addCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "column", description: "Exact name of the target column", required: true },
+      { name: "title", description: "Card title", required: true },
+      { name: "content", description: "Card content in markdown", required: false }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, column: p.column, title: p.title, content: p.content })
+  },
+  {
+    name: "kanban_get_card",
+    description: "Read one kanban card by id, including archived ones. Cheaper than fetching the whole board, and the only way to read a card that has been archived.",
+    route: "kanban.getCard",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
+  },
+  {
+    name: "kanban_get_card_context",
+    description: "Load the working context of a kanban card: the card, the board's columns, the team's guidelines for the board and the expected ending (move the card if needed, then comment). Call it first when the user asks you to work on a card, then follow it. It is the context a session started from the card in Runeya receives.",
+    route: "kanban.cardContext",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "projectId", description: "The project the work happens in, named in the context. Optional.", required: false },
+      { name: "orgId", description: "Its organization. Optional.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.projectId ? { projectId: p.projectId } : {},
+      ...p.orgId ? { orgId: p.orgId } : {}
+    })
+  },
+  {
+    name: "kanban_update_card",
+    description: "Update an existing kanban card. Only the fields you pass are changed; passing null to priority, color or deadline clears it. Prefer this over creating a second card when something needs correcting.",
+    route: "kanban.updateCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "title", description: "New title", required: false },
+      { name: "content", description: "New card content, in markdown", required: false },
+      { name: "priority", description: "Priority from 1 to 10, or null to clear it", required: false },
+      { name: "color", description: "Card colour, or null to clear it", required: false },
+      { name: "groups", description: "Labels, as a list of strings. Replaces the current ones.", required: false },
+      { name: "deadline", description: "Due date as YYYY-MM-DD, or null to clear it", required: false },
+      { name: "assignees", description: "User ids to assign, as a list. Replaces the current ones; use kanban_list_members to find the ids.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.title !== void 0 ? { title: p.title } : {},
+      ...p.content !== void 0 ? { content: p.content } : {},
+      // Tout arrive en chaîne : un modèle n'écrit pas des nombres, des listes
+      // ni des `null` typés. `clearable` distingue « efface » de « ne touche
+      // pas » — sans quoi vider une couleur serait impossible à exprimer, et
+      // changer un titre risquerait de vider le reste.
+      ...clearable(p.priority, (v) => Number(v), "priority"),
+      ...clearable(p.color, (v) => v, "color"),
+      ...clearable(p.deadline, (v) => v, "deadline"),
+      ...p.groups !== void 0 ? { groups: toList(p.groups) } : {},
+      ...p.assignees !== void 0 ? { assignees: toList(p.assignees) } : {}
+    })
+  },
+  {
+    name: "kanban_set_card_archived",
+    description: "Archive a kanban card (it leaves the board but is not deleted) or bring it back. An unarchived card returns to the column it left.",
+    route: "kanban.setCardArchived",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "archived", description: "true to archive, false to bring the card back", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, archived: p.archived === "true" })
+  },
+  {
+    name: "kanban_list_members",
+    description: "List the people of the organization who can be assigned to a card, with their ids. Needed before assigning anyone with kanban_update_card.",
+    route: "kanban.listMembers",
+    method: "GET",
+    params: [
+      { name: "organizationId", description: "Which organization. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => p.organizationId ? { organizationId: p.organizationId } : {}
+  },
+  // ─── Lecture seule ───────────────────────────────────────────────────────
+  //
+  // Tout ce qui se consulte sans rien changer. Les écritures s'ajoutent au cas
+  // par cas : aujourd'hui les services et leurs variables, plus bas.
+  //
+  // Volontairement absentes, et à ne pas ajouter sans y regarder à deux fois,
+  // parce qu'elles rendent un secret : `environment.list` / `get` / `resolve` /
+  // `resolveFlat` (un `Environment` porte ses variables, valeurs comprises),
+  // `apiKeys.list` / `reveal`, `setup.getEncryptionKeyHex` et `getOrgKeys`
+  // (clés de chiffrement), `settings.get` et `settings.listAIProviders` (clés
+  // de fournisseurs d'IA — `settings.getPaths` et `getNetwork`, eux, ne
+  // rendent que des chemins et une adresse, d'où leur présence ci-dessous),
+  // `cloudAuth.session`, `agent.getPassthroughEnv`. Un agent n'a pas besoin de
+  // ces valeurs pour travailler, et ce qu'il lit finit dans une transcription.
+  //
+  // La seule exception est `service.getEnv` (`get_service_env` ci-dessous),
+  // et elle n'en est une que parce qu'elle filtre : les variables publiques, et
+  // les seuls secrets que leur auteur a partagés avec les IA (`isSharedWithAi`
+  // — « Lisible par l'IA », ou l'injection, qui vaut la lecture). Un secret non
+  // partagé n'y apparaît pas, pas même par son nom.
+  {
+    name: "list_processes",
+    description: "List every process across all agents with its current state (running, stopped, exit code, uptime). Use this to see the whole machine at once, rather than calling get_service_status service by service. An agent only learns about a service when it is first started, so this lists what is deployed, not what is configured: an empty list means nothing has been started, not that you cannot see them \u2014 list_services shows what exists.",
+    route: "process.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_service",
+    transformOutput: maskServices,
+    description: "Read the full configuration of one service: its commands, ports, groups, runner, log sources and restart policy. list_services gives the ids.",
+    route: "service.get",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true }
+    ],
+    buildInput: (p) => ({ id: p.serviceId })
+  },
+  {
+    name: "get_service_env",
+    description: 'Read the environment variables a service runs with, and the project\'s variable inventory. `env` lists every key the service receives; a value reads "***" when it is a secret whose author did not share it with AI (sharing = ticking "AI read", or injecting it into the agents\' environment, which grants reading too). `envSecrets` says which keys are secret, `hiddenKeys` which ones are masked. A masked key is set on the service: never treat it as missing, never suggest adding it, and never pass "***" as a value \u2014 ask the user for it. `variables` describes every variable of the project \u2014 which environment defines it and its scope, its description, its flags, whether this machine overrides it, and `inService: false` for the ones this service does not receive. Use it to say where a variable must be changed instead of guessing. On an overridden variable, `sharedValue` is what the machine-local override replaces (the team\'s value, masked as "***" when unreadable); no other value appears there. This is the resolver: the values are what the service would receive \u2014 inheritance, {{environment.KEY}} references, this machine\'s overrides and server built-ins applied; agent built-ins stay as written until the service starts. Use it to check a variable you just composed. `unresolvedReferences` lists references nothing will fill (a typo, a variable that does not exist): fix them.',
+    route: "service.getEnv",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "environmentId", description: "A global environment of the project to resolve in instead of the active one, without activating it (from list_environments). Omit for the active one.", required: false }
+    ],
+    buildInput: (p) => ({ id: p.serviceId, ...p.environmentId ? { environmentId: p.environmentId } : {} })
+  },
+  // ─── Écrire un service et ses variables ────────────────────────────────────
+  //
+  // Les variables s'écrivent à l'aveugle (`environment.setVariableBlind`) : une
+  // IA remplace la valeur d'un secret sans la lire, et ne peut ni le rendre
+  // public, ni le partager avec les IA. La règle tient côté serveur, dans la
+  // route ; ces outils ne passent jamais par une route qui renvoie des valeurs
+  // (`upsertVariable`, `removeVariable`, `update` rendent l'environnement entier).
+  {
+    name: "create_service",
+    transformOutput: maskServices,
+    description: "Create a service, native or Docker, in a project: it joins the project and gets its environments in the same call. Pass the projectId your context names. Projects are synced between machines, so write paths relative to the project root and put machine-specific values (a device serial, a local token) in environment variables, referenced as $NAME in commands \u2014 see the cwd, commands and shortcuts parameters. Then set its variables with set_environment_variable.",
+    route: "service.create",
+    method: "POST",
+    params: [
+      { name: "name", description: "The service name", required: true },
+      { name: "projectId", description: "The project it joins: the one your context names, or another from list_projects. Without it, the service belongs to no project.", required: false },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false },
+      ...CREATE_SERVICE_PARAMS
+    ],
+    buildInput: (p) => {
+      const fields = serviceFields(p, CREATE_SERVICE_PARAMS);
+      if (fields["runner"] === "docker" && !fields["dockerConfig"]) {
+        throw new Error('dockerConfig: required with runner "docker" \u2014 give an "image" or a "dockerfile"');
+      }
+      return {
+        name: p.name,
+        ...fields,
+        ...p.projectId ? { projectId: p.projectId } : {},
+        ...p.orgId ? { orgId: p.orgId } : {}
+      };
+    }
+  },
+  {
+    name: "add_service_to_project",
+    description: "Add an existing service to a project, and create its environments \u2014 one for each of the project's environments, where its own variables go. Not needed after create_service, which already does it; calling it again changes nothing.",
+    route: "project.addService",
+    method: "POST",
+    params: [
+      { name: "projectId", description: "The project ID, from list_projects", required: true },
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ projectId: p.projectId, serviceId: p.serviceId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "update_service",
+    transformOutput: maskServices,
+    description: "Change any part of a service configuration \u2014 commands, ports, health check, restart policy, shortcuts, log sources, whether it runs natively or in Docker (runner, dockerConfig)\u2026 Only the fields you pass change; a list or an object you pass replaces the current one whole. Read the service first with get_service.",
+    route: "service.update",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "name", description: "New name", required: false },
+      { name: "orgId", description: "Move the service to this organization vault. Leave unset unless asked.", required: false, schema: z23.string().max(128).nullable() },
+      ...UPDATE_SERVICE_PARAMS
+    ],
+    buildInput: (p) => ({
+      id: p.serviceId,
+      ...p.name ? { name: p.name } : {},
+      ...p.orgId !== void 0 ? { orgId: parseTyped("orgId", z23.string().max(128).nullable(), p.orgId) } : {},
+      ...serviceFields(p, UPDATE_SERVICE_PARAMS)
+    })
+  },
+  {
+    name: "list_environments",
+    description: "List the environments of a project, with no value: each one's id, name and scope (global = shared by the whole project, service = one service's own variables), which global environment is active, which service a service environment belongs to and which global environment activates it, its parents (it inherits their variables), `isolated` when a service environment does not inherit from its global one, and the variables it defines with their flags. Empty environments are listed too \u2014 a service you just created has one per global environment, where its own variables go. Use it to find the environmentId before set_environment_variable.",
+    route: "environment.listForAi",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "The project ID: the one your context names, or another from list_projects", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "resolve_environment",
+    description: "Resolve one environment alone \u2014 its variables with those inherited from its parents and this machine's overrides \u2014 as an AI may read it: secrets not shared with AI read \"***\". Built-in references ({{service.*}}, {{services.*}}, {{agent.*}}\u2026) are NOT filled, since they depend on the service that receives the variable; use get_service_env for a service's final values. `unresolvedReferences` lists references nothing will fill: a misspelled {{environment.KEY}}, or a name that is no built-in.",
+    route: "environment.resolveForAi",
+    method: "GET",
+    params: [
+      { name: "environmentId", description: "The environment, from list_environments", required: true }
+    ],
+    buildInput: (p) => ({ environmentId: p.environmentId })
+  },
+  {
+    name: "set_environment_variable",
+    description: `Create or change an environment variable, by name, in one environment \u2014 global or service, same rules for both. Find the environmentId with list_environments. Where it belongs: a value shared by several services (a database host, an API base URL) goes ONCE in the active global environment; services inherit it. A value only one service needs goes in that service's environment (scope service, activated by the active global one), where it also overrides a global variable of the same name. Never hardcode what Runeya already knows: a service's own port is {{service.PORT}}, its own URL {{service.URL}}, another service's address {{services.<slug>.URL}} \u2014 a copied "3210" or "http://localhost:3211" breaks as soon as a port changes or the project runs on another machine. If the port a variable needs is not declared on its service, declare it there (update_service, ports) instead of writing the number. When a written value contains a port or URL of a project service, the response lists \`suggestions\`: rewrite the value with those references. Compose instead of copying: a value can reference another variable of the resolved environment as {{environment.KEY}} (e.g. "postgres://{{environment.DB_USER}}@{{environment.DB_HOST}}:5432"). ${BUILTINS_HELP} After writing, check the result with get_service_env (a service, optionally in another global environment) or resolve_environment (an environment alone). References are substituted in one pass: a reference to a variable whose own value is only a reference may stay unexpanded, so point at the variable that holds the actual value. $NAME is not a reference here: it only expands inside a shell command. pre and post are concatenated around the value, each resolved separately. You can replace a secret's value without reading it, and create a variable as secret. You cannot make a secret public nor make it readable by AI: that stays the user's decision. Never pass "***" as a value. The response never contains the value.`,
+    route: "environment.setVariableBlind",
+    method: "POST",
+    params: [
+      { name: "environmentId", description: "The environment that holds the variable, from list_environments", required: true },
+      { name: "key", description: "The variable name, e.g. DATABASE_URL", required: true },
+      { name: "value", description: "The new value, possibly with {{environment.KEY}} references. Omit to leave it unchanged.", required: false },
+      { name: "pre", description: 'Text put before the value (e.g. "https://"). Omit to leave it unchanged.', required: false },
+      { name: "post", description: 'Text put after the value (e.g. "/api"). Omit to leave it unchanged.', required: false },
+      { name: "isSecret", description: '"true" to store it as a secret. On an existing public variable, makes it secret.', required: false },
+      { name: "description", description: "What the variable is for, in markdown", required: false }
+    ],
+    buildInput: (p) => ({
+      environmentId: p.environmentId,
+      key: p.key,
+      ...p.value !== void 0 ? { value: p.value } : {},
+      ...p.pre !== void 0 ? { pre: p.pre } : {},
+      ...p.post !== void 0 ? { post: p.post } : {},
+      ...p.isSecret !== void 0 ? { isSecret: toBool(p.isSecret) } : {},
+      ...p.description !== void 0 ? { description: p.description } : {}
+    })
+  },
+  {
+    name: "set_environment_inheritance",
+    description: "Switch whether a service environment inherits the variables of the global environment that activates it (the default), or is isolated from it and receives only its own variables. list_environments shows this as `isolated`. Isolating a service is unusual: it loses every shared variable of the project. Do it only when the user asks, and never to work around a variable \u2014 override it in the service environment instead.",
+    route: "environment.setInheritanceBlind",
+    method: "POST",
+    params: [
+      { name: "environmentId", description: "A service environment (scope service), from list_environments", required: true },
+      { name: "inherit", description: '"true" to inherit from the global environment, "false" to isolate', required: true, schema: z23.boolean() }
+    ],
+    buildInput: (p) => ({ environmentId: p.environmentId, inherit: toBool(p.inherit ?? "true") })
+  },
+  {
+    name: "remove_environment_variable",
+    description: "Delete an environment variable, by name, from one environment. Its value is lost.",
+    route: "environment.removeVariableBlind",
+    method: "POST",
+    params: [
+      { name: "environmentId", description: "The environment that holds the variable", required: true },
+      { name: "key", description: "The variable name", required: true }
+    ],
+    buildInput: (p) => ({ environmentId: p.environmentId, key: p.key }),
+    destructive: true
+  },
+  {
+    name: "get_service_metrics",
+    description: "Read the CPU and memory currently used by a running service.",
+    route: "process.metrics",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
+  },
+  {
+    name: "list_agents",
+    description: "List the agents connected to this Runeya, with their status and whether they run on this machine. Passphrases are never returned.",
+    route: "agent.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "list_projects",
+    description: "List the projects known to this Runeya, with their ids and the services they hold.",
+    route: "project.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_project",
+    description: "Read one project: its services, its active environment, its organization.",
+    route: "project.get",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "The project ID, from list_projects", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "list_project_paths",
+    description: "Where each project lives on this machine. Use it to find the directory to work in before reading or editing files.",
+    route: "project.localPaths",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "git_status",
+    description: "Read the git working tree of a service or a project: staged, modified and untracked files, current branch, ahead/behind counts.",
+    route: "git.status",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_log",
+    description: "Read the recent commits of a service or project repository: hash, author, date, message.",
+    route: "git.log",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
+      { name: "limit", description: "How many commits to return (1-200). Default: 50.", required: false }
+    ],
+    buildInput: (p) => ({ ...gitTarget(p), ...p.limit ? { limit: Number(p.limit) } : {} })
+  },
+  {
+    name: "git_branches",
+    description: "List the local and remote branches of a service or project repository.",
+    route: "git.branches",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_diff",
+    description: "Read the diff of a service or project repository \u2014 everything, or one file. Use it to see what changed before describing or reviewing it.",
+    route: "git.diff",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
+      { name: "path", description: "Restrict the diff to this file path", required: false },
+      { name: "staged", description: 'Set to "true" to read the staged diff instead of the working tree', required: false },
+      { name: "untracked", description: 'Set to "true" to include untracked files', required: false }
+    ],
+    buildInput: (p) => ({
+      ...gitTarget(p),
+      ...p.path ? { path: p.path } : {},
+      ...p.staged !== void 0 ? { staged: p.staged === "true" } : {},
+      ...p.untracked !== void 0 ? { untracked: p.untracked === "true" } : {}
+    })
+  },
+  {
+    name: "list_docs",
+    description: "List the markdown documentation files of a scope, as a tree. Pair it with read_doc to answer from the project's own docs rather than from guesswork.",
+    route: "wiki.list",
+    method: "GET",
+    params: [
+      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true }
+    ],
+    buildInput: (p) => ({ scope: p.scope })
+  },
+  {
+    name: "read_doc",
+    description: "Read one markdown documentation file. Paths come from list_docs; only .md and .markdown can be read.",
+    route: "wiki.read",
+    method: "GET",
+    params: [
+      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true },
+      { name: "path", description: "Relative path of the file, as returned by list_docs", required: true }
+    ],
+    buildInput: (p) => ({ scope: p.scope, path: p.path })
+  },
+  {
+    name: "get_server_logs",
+    description: "Read Runeya's own recent log entries. Use it to explain why Runeya itself misbehaved \u2014 not to read a service's output, which is get_logs.",
+    route: "diagnostics.recentLogs",
+    method: "GET",
+    params: [
+      { name: "limit", description: "How many entries to return (1-2000). Default: 500.", required: false }
+    ],
+    buildInput: (p) => p.limit ? { limit: Number(p.limit) } : void 0
+  },
+  {
+    name: "get_kanban_queue_state",
+    description: "Read the state of the kanban task queue: what is running, what is waiting. Use it before queuing work, or to explain why a card has not started.",
+    route: "kanbanQueue.getState",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "export_project",
+    description: "Read a project and every service it holds in one call, with secrets stripped out. Cheaper and safer than calling get_service for each service \u2014 prefer it whenever you need the whole picture of a project.",
+    route: "project.export",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "The project ID, from list_projects", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "git_remotes",
+    description: "List the git remotes of a service or project repository, with their URLs.",
+    route: "git.remotes",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_stash_list",
+    description: "List the stashes of a service or project repository. Useful before assuming work was lost: it may simply be stashed.",
+    route: "git.stashList",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "get_runeya_version",
+    description: "Read the version of Runeya running here, the latest published one, and whether this install is up to date. Use it before blaming a bug on the code: the machine may simply be behind.",
+    route: "health.versionInfo",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_runeya_paths",
+    description: "Read where Runeya keeps its things on this machine: its launch directory, its data directory, and the machine-wide directory holding cloud projects.",
+    route: "settings.getPaths",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_network_info",
+    description: "Read where this Runeya listens (host and port) and whether it is reachable from the local network, with the URLs to use. Use it to give someone a working link instead of guessing one.",
+    route: "settings.getNetwork",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "list_runeya_instances",
+    description: "List every Runeya answering on this machine, this one included, with its port and directory. Use it when a port is taken or when two instances seem to disagree.",
+    route: "diagnostics.instances",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_cloud_status",
+    description: "Say whether this Runeya is linked to a cloud account, and to which cloud. A kanban tool failing for lack of a cloud link is explained here.",
+    route: "cloudAuth.status",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  }
+];
+function buildMcpShape(cap) {
+  const shape = {};
+  for (const param of cap.params) {
+    const base = (param.schema ?? z32.string()).describe(param.description);
+    shape[param.name] = param.required ? base : base.optional();
+  }
+  shape["authToken"] = z32.string().describe("Bearer token for authentication").optional();
+  return shape;
+}
+function toRawParams(input, cap) {
+  const typed = new Set(cap?.params.filter((p) => p.schema).map((p) => p.name));
+  return Object.fromEntries(Object.entries(input).map(([k, v]) => [
+    k,
+    v === null && typed.has(k) ? "null" : v == null ? void 0 : typeof v === "object" ? JSON.stringify(v) : String(v)
+  ]));
+}
+async function callTrpc(baseUrl, route, method, input, authToken, fetchImpl = fetch) {
+  const headers = {
+    "Content-Type": "application/json",
+    "Authorization": `Bearer ${authToken}`
+  };
+  const url = method === "GET" && input ? `${baseUrl}/api/trpc/${route}?input=${encodeURIComponent(JSON.stringify(input))}` : `${baseUrl}/api/trpc/${route}`;
+  const res = await fetchImpl(url, {
+    method,
+    headers,
+    ...method === "POST" ? { body: JSON.stringify(input ?? {}) } : {},
+    signal: AbortSignal.timeout(15e3)
+  });
+  const json = await res.json();
+  if (json["error"]) throw new Error(JSON.stringify(json["error"]));
+  const result = json["result"];
+  return result?.["data"] ?? result ?? json;
+}
+async function runCapability(cap, baseUrl, params, authToken, fetchImpl = fetch) {
+  const result = await callTrpc(baseUrl, cap.route, cap.method, cap.buildInput(params), authToken, fetchImpl);
+  return cap.transformOutput ? cap.transformOutput(result) : result;
+}
+function applyProjectAnchor(cap, params, anchor) {
+  const accepts = (name) => cap.params.some((p) => p.name === name);
+  const anchored = { ...params };
+  const mayAnchorOrg = !params["projectId"] || params["projectId"] === anchor.projectId;
+  if (anchor.projectId && accepts("projectId") && !anchored["projectId"]) {
+    anchored["projectId"] = anchor.projectId;
+  }
+  if (mayAnchorOrg && anchor.orgId && !anchored["orgId"] && accepts("orgId")) {
+    anchored["orgId"] = anchor.orgId;
+  }
+  if (mayAnchorOrg && anchor.orgId && !anchored["organizationId"] && accepts("organizationId")) {
+    anchored["organizationId"] = anchor.orgId;
+  }
+  return anchored;
+}
+
+// src/external.ts
+import { z as z26 } from "zod";
+
+// src/project-anchors.ts
+function createProjectAnchors(env, cwd, containing) {
+  const anchors = /* @__PURE__ */ new Map();
+  return (key, baseUrl, authToken) => {
+    if (env.projectId) return Promise.resolve(env);
+    let anchor = anchors.get(key);
+    if (!anchor) {
+      anchor = containing(baseUrl, authToken, cwd).then((found) => {
+        const p = found;
+        return p ? { projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} } : {};
+      }).catch((err) => {
+        anchors.delete(key);
+        throw new Error(`Impossible de savoir \xE0 quel projet Runeya appartient le dossier ${cwd} (${err.message}). Nomme le projet : appelle list_projects, puis passe son projectId.`);
+      });
+      anchors.set(key, anchor);
+    }
+    return anchor;
+  };
+}
+
+// src/session-token.ts
+var RETRY_DELAY_MS = 1e3;
+function jwtExpiresAt(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8"));
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+function startSessionToken(initial, baseUrl, fetchImpl = fetch) {
+  let token = initial;
+  let timer = null;
+  let stopped = false;
+  const arm = (delayMs) => {
+    if (stopped) return;
+    timer = setTimeout(() => {
+      void refresh();
+    }, delayMs);
+    timer.unref?.();
+  };
+  const schedule = () => {
+    const exp = jwtExpiresAt(token);
+    if (exp === null) return;
+    const remainingMs = exp * 1e3 - Date.now();
+    if (remainingMs > 0) arm(remainingMs / 2);
+  };
+  const retry = () => {
+    const exp = jwtExpiresAt(token);
+    if (exp !== null && exp * 1e3 - Date.now() > RETRY_DELAY_MS) arm(RETRY_DELAY_MS);
+  };
+  async function refresh() {
+    timer = null;
+    let res;
+    try {
+      res = await fetchImpl(`${baseUrl}/api/auth/refresh`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(5e3)
+      });
+    } catch {
+      retry();
+      return;
+    }
+    if (res.status === 401) return;
+    if (!res.ok) {
+      retry();
+      return;
+    }
+    const body = await res.json().catch(() => null);
+    if (typeof body?.token !== "string") {
+      retry();
+      return;
+    }
+    token = body.token;
+    schedule();
+  }
+  if (initial) schedule();
+  return {
+    current: () => token,
+    isInitial: (candidate) => candidate === initial,
+    stop: () => {
+      stopped = true;
+      if (timer) clearTimeout(timer);
+      timer = null;
+    }
+  };
+}
+
+// src/instance-selector.ts
+function instanceUrl(i) {
+  return `http://localhost:${i.port}`;
+}
+function describe(i) {
+  return `pid ${i.pid} \u2014 port ${i.port} \u2014 ${i.cwd}${i.version ? ` (v${i.version})` : ""}`;
+}
+function createInstanceSelector(listInstances) {
+  return {
+    async instance(pid) {
+      const instances = await listInstances();
+      if (pid !== void 0) {
+        const named = instances.find((i) => i.pid === pid);
+        if (named) return named;
+        throw new Error(`Aucune instance Runeya lanc\xE9e avec le pid ${pid}. Instances en cours :
+${instances.map((i) => `- ${describe(i)}`).join("\n") || "(aucune)"}`);
+      }
+      if (instances.length === 0) {
+        throw new Error("Runeya n'est pas lanc\xE9 sur cette machine : aucune instance \xE0 contacter.");
+      }
+      if (instances.length === 1) return instances[0];
+      throw new Error(
+        `Plusieurs instances Runeya sont lanc\xE9es. Demande \xE0 l'utilisateur laquelle utiliser, puis passe son pid dans le param\xE8tre runeyaInstance, \xE0 chaque appel de cette conversation :
+${instances.map((i) => `- ${describe(i)}`).join("\n")}`
+      );
+    },
+    list: listInstances
+  };
+}
+
+// src/pairing-client.ts
+import { createHash } from "crypto";
+import { mkdir, readFile, rm, writeFile, chmod } from "fs/promises";
+import { join } from "path";
+function clientDisplayName(info) {
+  const title = info.title?.trim();
+  if (title) return title.slice(0, 100);
+  const words = info.name.split(/[-_\s]+/).filter(Boolean);
+  const pretty = words.map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+  return pretty.slice(0, 100) || "Client MCP";
+}
+var EXPIRY_MARGIN_S = 30;
+var PairingClient = class {
+  constructor(dir, clientInfo, cwd, fetchImpl = fetch) {
+    this.dir = dir;
+    this.clientInfo = clientInfo;
+    this.cwd = cwd;
+    this.fetchImpl = fetchImpl;
+  }
+  tokens = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  /** Le nom technique du client : il distingue les secrets, il ne s'affiche pas. */
+  name() {
+    return this.clientInfo().name.slice(0, 100) || "Client MCP";
+  }
+  /**
+   * Un secret par instance ET par client : accepter Claude Code ne donne pas
+   * accès à Cursor, et chaque outil se révoque à part.
+   */
+  secretFile(key) {
+    const id = createHash("sha256").update(`${key}\0${this.name()}`).digest("hex").slice(0, 32);
+    return join(this.dir, `${id}.json`);
+  }
+  async readSecret(key) {
+    try {
+      const { secret } = JSON.parse(await readFile(this.secretFile(key), "utf8"));
+      return typeof secret === "string" ? secret : null;
+    } catch {
+      return null;
+    }
+  }
+  async writeSecret(key, secret) {
+    await mkdir(this.dir, { recursive: true, mode: 448 });
+    const file = this.secretFile(key);
+    await writeFile(file, JSON.stringify({ secret }), { mode: 384 });
+    await chmod(file, 384);
+  }
+  async call(target, route, method, input) {
+    try {
+      return await callTrpc(target.baseUrl, route, method, input, "", this.fetchImpl);
+    } catch (err) {
+      if (/NOT_FOUND/.test(err.message)) {
+        throw new Error(`L'instance Runeya de ${target.baseUrl} est trop ancienne pour accepter ce client : mettez Runeya \xE0 jour, ou passez une cl\xE9 d'API dans RUNEYA_API_TOKEN.`);
+      }
+      throw err;
+    }
+  }
+  /**
+   * Oublie le jeton en mémoire. Le serveur l'a refusé, typiquement après un
+   * redémarrage (la clé de signature change) : le prochain `token()` le
+   * réobtient avec le secret, sans nouvelle demande d'accès.
+   */
+  forget(target) {
+    this.tokens.delete(target.key);
+  }
+  /** Un jeton pour cette instance, ou une erreur qui dit à l'utilisateur quoi faire. */
+  async token(target) {
+    const cached = this.tokens.get(target.key);
+    const exp = cached ? jwtExpiresAt(cached) : null;
+    if (cached && exp !== null && exp - EXPIRY_MARGIN_S > Date.now() / 1e3) return cached;
+    this.tokens.delete(target.key);
+    const secret = await this.readSecret(target.key);
+    if (secret) {
+      try {
+        const { token } = await this.call(target, "mcpPairing.exchange", "POST", { secret });
+        this.tokens.set(target.key, token);
+        return token;
+      } catch (err) {
+        if (!/UNAUTHORIZED/.test(err.message)) throw err;
+        await rm(this.secretFile(target.key), { force: true });
+      }
+    }
+    return this.pair(target);
+  }
+  async pair(target) {
+    const pending = this.pending.get(target.key);
+    if (pending) {
+      const { status, secret } = await this.call(target, "mcpPairing.status", "GET", { requestId: pending.requestId });
+      if (status === "approved" && secret) {
+        this.pending.delete(target.key);
+        await this.writeSecret(target.key, secret);
+        return this.token(target);
+      }
+      if (status === "pending") {
+        throw new Error(`Acc\xE8s en attente : l'utilisateur doit accepter la demande dans Runeya (code ${pending.code}), puis relancer l'action.`);
+      }
+      this.pending.delete(target.key);
+      if (status === "denied") throw new Error("L'utilisateur a refus\xE9 l'acc\xE8s dans Runeya.");
+    }
+    const { id, code } = await this.call(target, "mcpPairing.request", "POST", { name: clientDisplayName(this.clientInfo()), cwd: this.cwd });
+    this.pending.set(target.key, { requestId: id, code });
+    throw new Error(`Runeya doit autoriser ce client. Une demande d'acc\xE8s vient de s'afficher dans Runeya avec le code ${code} : demande \xE0 l'utilisateur de v\xE9rifier le code et d'accepter, puis relance l'action.`);
+  }
+};
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z as z25 } from "zod";
+function needsAnchor(cap, params) {
+  const accepts = (name) => cap.params.some((p) => p.name === name);
+  if (params["orgId"] || params["organizationId"]) return false;
+  if (accepts("projectId")) return !params["projectId"];
+  return ["orgId", "organizationId"].some((name) => accepts(name) && !params[name]);
+}
+var RETRY = /* @__PURE__ */ Symbol("retry");
+function text(value) {
+  return { content: [{ type: "text", text: typeof value === "string" ? value : JSON.stringify(value, null, 2) }] };
+}
+function error(err) {
+  return { content: [{ type: "text", text: `Error: ${err.message}` }], isError: true };
+}
+function createRuneyaMcpServer(opts) {
+  const server = new McpServer({ name: "runeya", version: "1.0.0" });
+  async function callCapability(cap, input) {
+    const rawParams = toRawParams(input, cap);
+    const raw = rawParams["authToken"];
+    const explicit = raw && !raw.startsWith("$") && !opts.sessionToken.isInitial(raw) ? raw : null;
+    const call = async () => {
+      const target = await opts.target(input);
+      const authToken = explicit ?? (target.authToken || opts.sessionToken.current() || opts.internalToken || void 0);
+      if (!authToken) throw new Error("No auth token available");
+      const anchor = target.projectAnchor && needsAnchor(cap, rawParams) ? await target.projectAnchor() : opts.projectAnchor;
+      const params = applyProjectAnchor(cap, rawParams, anchor);
+      try {
+        return await runCapability(cap, target.baseUrl, params, authToken);
+      } catch (err) {
+        if (!explicit && target.forgetToken && /UNAUTHORIZED/.test(err.message)) {
+          target.forgetToken();
+          return RETRY;
+        }
+        throw err;
+      }
+    };
+    let result = await call();
+    if (result === RETRY) result = await call();
+    if (result === RETRY) throw new Error("Runeya refuse le jeton de ce client, m\xEAme renouvel\xE9.");
+    return result;
+  }
+  for (const cap of RUNEYA_CAPABILITIES) {
+    server.tool(cap.name, cap.description, { ...buildMcpShape(cap), ...opts.extraShape }, async (input) => {
+      try {
+        return text(await callCapability(cap, input));
+      } catch (err) {
+        return error(err);
+      }
+    });
+  }
+  registerWorkOnCardPrompt(server, (input) => callCapability(CARD_CONTEXT, input), opts.extraShape !== void 0);
+  return server;
+}
+var CARD_CONTEXT = RUNEYA_CAPABILITIES.find((c) => c.name === "kanban_get_card_context");
+function registerWorkOnCardPrompt(server, cardContext, withInstance) {
+  const args = {
+    boardId: z25.string().max(128).describe("The kanban board ID"),
+    cardId: z25.string().max(128).describe("The card ID"),
+    ...withInstance ? { runeyaInstance: z25.string().max(16).optional().describe("pid of the Runeya instance, when several are running") } : {}
+  };
+  server.prompt(
+    "work_on_card",
+    "Work on a Runeya kanban card: loads the card, the board guidelines and the expected ending.",
+    args,
+    async (input) => {
+      const { boardId, cardId, runeyaInstance } = input;
+      const pid = runeyaInstance ? Number(runeyaInstance) : void 0;
+      const { context } = await cardContext({ boardId, cardId, ...pid ? { runeyaInstance: pid } : {} });
+      return {
+        description: `Carte ${cardId}`,
+        messages: [{
+          role: "user",
+          content: {
+            type: "text",
+            text: `Je veux travailler sur cette carte du kanban Runeya. Voici son contexte, tel que Runeya le donne \xE0 une session lanc\xE9e depuis la carte : suis ces consignes, en particulier la fin attendue (d\xE9placer la carte si besoin, puis la commenter).
+
+${context}`
+          }
+        }]
+      };
+    }
+  );
+}
+function registerInstanceTools(server, selector) {
+  server.tool(
+    "list_local_runeya_instances",
+    "List the Runeya instances running on this machine, with their pid. When several are running, ask the user which one to use, then pass its pid as runeyaInstance on every call of this conversation.",
+    {},
+    async () => {
+      try {
+        return text(await selector.list());
+      } catch (err) {
+        return error(err);
+      }
+    }
+  );
+}
+
+// src/external.ts
+async function runExternalMcp(opts) {
+  const fixedUrl = process.env["RUNEYA_BASE_URL"];
+  const selector = createInstanceSelector(async () => (await opts.listInstances()).map(({ pid, port, cwd, dataDir, version }) => ({ pid, port, cwd, dataDir, version })));
+  const sessionToken = startSessionToken(process.env["RUNEYA_API_TOKEN"] ?? "", fixedUrl ?? "");
+  const pairing = new PairingClient(
+    // Même règle que `machineRoot()` du serveur : `RUNEYA_HOME` déplace la racine machine.
+    join2(opts.machineRoot ?? join2(process.env["RUNEYA_HOME"] || homedir(), ".runeya"), "mcp"),
+    () => server.server.getClientVersion() ?? { name: "" },
+    process.cwd()
+  );
+  const envAnchor = {
+    projectId: process.env["RUNEYA_PROJECT_ID"] || void 0,
+    orgId: process.env["RUNEYA_ORG_ID"] || void 0
+  };
+  const anchorFor = createProjectAnchors(envAnchor, process.cwd(), (baseUrl, authToken, path) => callTrpc(baseUrl, "project.containing", "GET", { path }, authToken));
+  const server = createRuneyaMcpServer({
+    target: async (input) => {
+      const pid = typeof input["runeyaInstance"] === "number" ? input["runeyaInstance"] : void 0;
+      const { baseUrl, key } = fixedUrl ? { baseUrl: fixedUrl, key: fixedUrl } : await selector.instance(pid).then((i) => ({ baseUrl: instanceUrl(i), key: i.dataDir }));
+      if (sessionToken.current()) {
+        const authToken2 = sessionToken.current();
+        return { baseUrl, authToken: authToken2, projectAnchor: () => anchorFor(key, baseUrl, authToken2) };
+      }
+      const authToken = await pairing.token({ baseUrl, key });
+      return {
+        baseUrl,
+        authToken,
+        projectAnchor: () => anchorFor(key, baseUrl, authToken),
+        forgetToken: () => pairing.forget({ baseUrl, key })
+      };
+    },
+    sessionToken,
+    projectAnchor: envAnchor,
+    extraShape: fixedUrl ? void 0 : {
+      runeyaInstance: z26.number().int().positive().optional().describe(
+        "The pid of the Runeya instance to call, from list_local_runeya_instances. Needed only when several instances are running: then pass it on every call of this conversation."
+      )
+    }
+  });
+  if (!fixedUrl) registerInstanceTools(server, selector);
+  await server.connect(new StdioServerTransport());
+}
+export {
+  runExternalMcp
+};
+//# sourceMappingURL=external.js.map