@runeya/runeya 2.0.21 → 2.0.23

package/{chunk-PUNE7P6S.js → chunk-Y2R42AXQ.js}

@@ -1,24 +1,109 @@
-import {
-  decryptValue,
-  decryptVariableSlots,
-  deriveStableSecret,
-  encryptVariableSlots,
-  env,
-  extractEncryptedVariableSlots,
-  getEncryptionKey,
-  isEncryptedValue,
-  stableEncryptValue
-} from "./chunk-Q4N37KNN.js";
-
 // ../server/src/services/agent-manager.ts
 import { EventEmitter as EventEmitter2 } from "events";
 import WebSocket2 from "ws";
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
 import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
 import { join } from "path";
+
+// ../server/src/config/env.ts
+import { z } from "zod";
+var serverPort = z.coerce.number().int().min(1).max(65535).default(4e3).parse(process.env.RUNEYA_HTTP_PORT);
+var defaultAgentPort = process.env.RUNEYA_AGENT_PORT ? z.coerce.number().int().min(1).max(65535).parse(process.env.RUNEYA_AGENT_PORT) : serverPort + 1;
+var EnvSchema = z.object({
+  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).default(4e3),
+  RUNEYA_HOST: z.string().default("127.0.0.1"),
+  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),
+  RUNEYA_AGENT_HOST: z.string().default("127.0.0.1"),
+  RUNEYA_AGENT_BINARY_PATH: z.string().nullable().default(null),
+  RUNEYA_DATA_DIR: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().default(".runeya")),
+  RUNEYA_CLOUD_URL: z.string().url().nullable().default(null),
+  // Cloud front-end (landing) URL — used by the web app for the registration /
+  // onboarding flow. Configured on the server at launch; the web fetches it.
+  RUNEYA_CLOUD_APP_URL: z.string().url().nullable().default(null),
+  RUNEYA_MODE: z.enum(["local-simple", "cloud"]).default("local-simple"),
+  RUNEYA_CORS_ORIGIN: z.string().nullable().default(null),
+  RUNEYA_LAN_PROXY: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false)
+}).transform((data) => ({
+  ...data,
+  // Short aliases used throughout the server code
+  PORT: data.RUNEYA_HTTP_PORT,
+  HOST: data.RUNEYA_HOST,
+  MODE: data.RUNEYA_MODE,
+  DATA_DIR: data.RUNEYA_DATA_DIR,
+  CLOUD_URL: data.RUNEYA_CLOUD_URL,
+  CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,
+  CORS_ORIGIN: data.RUNEYA_CORS_ORIGIN,
+  AGENT_BINARY_PATH: data.RUNEYA_AGENT_BINARY_PATH
+}));
+var env = EnvSchema.parse(process.env);
+
+// ../server/src/utils/encryption-key.ts
+import { createHash } from "crypto";
+var KEY_SIZE_BYTES = 32;
+var cachedKey = null;
+var _ciMode = false;
+var _pendingLegacyKey = null;
+function isCiMode() {
+  return _ciMode;
+}
+async function loadFromEnv() {
+  const keyHex = process.env["RUNEYA_ENCRYPTION_KEY"];
+  if (!keyHex) return false;
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {
+    throw new Error("RUNEYA_ENCRYPTION_KEY invalide : attendu 64 caract\xE8res hex");
+  }
+  console.log("");
+  console.log("\u26A0 ATTENTION : RUNEYA_ENCRYPTION_KEY est d\xE9fini \u2014 l'authentification par master password est d\xE9sactiv\xE9e.");
+  console.log("  Cette variable d'environnement est r\xE9serv\xE9e aux environnements CI/CD.");
+  console.log("  Ne la d\xE9finissez jamais sur une machine de d\xE9veloppement.");
+  console.log("");
+  cachedKey = Buffer.from(keyHex, "hex");
+  _ciMode = true;
+  return true;
+}
+function setPendingLegacyKey(key) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  _pendingLegacyKey = key;
+}
+function getPendingLegacyKey() {
+  return _pendingLegacyKey;
+}
+function clearPendingLegacyKey() {
+  _pendingLegacyKey = null;
+}
+function hasPendingLegacyKey() {
+  return _pendingLegacyKey !== null;
+}
+function setEncryptionKeyInMemory(key) {
+  if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
+  cachedKey = key;
+}
+function clearEncryptionKey() {
+  cachedKey = null;
+}
+function hasEncryptionKey() {
+  return cachedKey !== null;
+}
+function getEncryptionKey() {
+  return cachedKey;
+}
+function deriveStableSecret(purpose) {
+  const key = getEncryptionKey();
+  if (!key) return null;
+  return createHash("sha256").update(key).update(purpose).digest("hex");
+}
+async function ensureEncryptionKey() {
+  return cachedKey;
+}
+async function setEncryptionKey(keyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) throw new Error("Invalid key format");
+  cachedKey = Buffer.from(keyHex, "hex");
+}
+
+// ../server/src/services/agent-store.ts
 var FILENAME = "agents.json";
 var ALGORITHM = "aes-256-gcm";
 function encrypt(plaintext) {
@@ -197,217 +282,304 @@ import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
 import { join as join2 } from "path";
 
+// ../server/src/services/crypto-helpers.ts
+import { randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
+var ALGORITHM2 = "aes-256-gcm";
+function encryptValue(plaintext) {
+  const maybeKey = getEncryptionKey();
+  if (!maybeKey) {
+    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
+  }
+  const key = maybeKey;
+  const iv = randomBytes2(16);
+  const cipher = createCipheriv2(ALGORITHM2, key, iv);
+  let enc = cipher.update(plaintext, "utf-8", "hex");
+  enc += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${authTag}:${enc}`;
+}
+function decryptValue(encrypted) {
+  const parts = encrypted.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
+  const [ivHex, authTagHex, ciphertext] = parts;
+  if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
+    throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
+  }
+  const maybeKey = getEncryptionKey();
+  if (!maybeKey) {
+    throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
+  }
+  const key = maybeKey;
+  const iv = Buffer.from(ivHex, "hex");
+  const decipher = createDecipheriv2(ALGORITHM2, key, iv, { authTagLength: 16 });
+  decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
+  let dec = decipher.update(ciphertext, "hex", "utf-8");
+  dec += decipher.final("utf-8");
+  return dec;
+}
+function stableEncryptValue(plaintext, existingEncrypted) {
+  if (existingEncrypted) {
+    try {
+      if (decryptValue(existingEncrypted) === plaintext) return existingEncrypted;
+    } catch {
+    }
+  }
+  return encryptValue(plaintext);
+}
+function encryptVariableSlots(variables, existingEncrypted) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) } };
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function decryptVariableSlots(variables, contextLabel) {
+  const result = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    const slot = variable.value;
+    if (slot.isSecret && slot.value) {
+      try {
+        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };
+      } catch (err) {
+        console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message}`);
+        result[key] = { ...variable, value: { ...slot, value: "" } };
+      }
+    } else {
+      result[key] = { ...variable, value: { ...slot } };
+    }
+  }
+  return result;
+}
+function extractEncryptedVariableSlots(variables) {
+  const slots = {};
+  for (const [key, variable] of Object.entries(variables)) {
+    if (variable.value?.isSecret && variable.value?.value) {
+      slots[key] = variable.value.value;
+    }
+  }
+  return slots;
+}
+function isEncryptedValue(s) {
+  const parts = s.split(":");
+  return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);
+}
+
 // ../../packages/shared/src/schemas/user.schema.ts
-import { z } from "zod";
-var UserSchema = z.object({
-  id: z.string().max(128),
-  email: z.string().email().max(320),
-  name: z.string().min(1).max(500),
-  avatar: z.string().url().max(2048).nullable().optional()
+import { z as z2 } from "zod";
+var UserSchema = z2.object({
+  id: z2.string().max(128),
+  email: z2.string().email().max(320),
+  name: z2.string().min(1).max(500),
+  avatar: z2.string().url().max(2048).nullable().optional()
 });
 
 // ../../packages/shared/src/schemas/org.schema.ts
-import { z as z2 } from "zod";
-var OrgSchema = z2.object({
-  id: z2.string().max(128),
-  name: z2.string().min(1).max(100),
-  slug: z2.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
-  ownerId: z2.string().max(128)
+import { z as z3 } from "zod";
+var OrgSchema = z3.object({
+  id: z3.string().max(128),
+  name: z3.string().min(1).max(100),
+  slug: z3.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+  ownerId: z3.string().max(128)
 });
-var OrgMemberSchema = z2.object({
-  id: z2.string().max(128),
-  orgId: z2.string().max(128),
-  userId: z2.string().max(128),
-  globalRole: z2.enum(["owner", "admin", "member"]),
-  invitedAt: z2.coerce.date(),
-  joinedAt: z2.coerce.date().nullable().optional()
+var OrgMemberSchema = z3.object({
+  id: z3.string().max(128),
+  orgId: z3.string().max(128),
+  userId: z3.string().max(128),
+  globalRole: z3.enum(["owner", "admin", "member"]),
+  invitedAt: z3.coerce.date(),
+  joinedAt: z3.coerce.date().nullable().optional()
 });
 
 // ../../packages/shared/src/schemas/project.schema.ts
-import { z as z3 } from "zod";
-var ProjectSchema = z3.object({
-  id: z3.string().max(128),
-  orgId: z3.string().max(128).nullable().optional(),
-  name: z3.string().min(1).max(200),
-  description: z3.string().max(1e4).optional().default(""),
-  serviceIds: z3.array(z3.string().max(128)).max(1e4).default([]),
+import { z as z4 } from "zod";
+var ProjectSchema = z4.object({
+  id: z4.string().max(128),
+  orgId: z4.string().max(128).nullable().optional(),
+  name: z4.string().min(1).max(200),
+  description: z4.string().max(1e4).optional().default(""),
+  serviceIds: z4.array(z4.string().max(128)).max(1e4).default([]),
   // Environment support
   // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
   // It's initialized to 'local' by default at load time
-  activeEnvironmentId: z3.string().max(128).optional(),
-  environmentIds: z3.array(z3.string().max(128)).max(100).default([]),
+  activeEnvironmentId: z4.string().max(128).optional(),
+  environmentIds: z4.array(z4.string().max(128)).max(100).default([]),
   // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
   // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
-  groupOrder: z3.array(z3.string().max(200)).max(100).default([])
+  groupOrder: z4.array(z4.string().max(200)).max(100).default([])
 });
 var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
 var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
 
 // ../../packages/shared/src/schemas/service.schema.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // ../../packages/shared/src/schemas/settings.schema.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // ../../packages/shared/src/schemas/scenario.schema.ts
-import { z as z4 } from "zod";
-var PositionSchema = z4.object({
-  x: z4.number(),
-  y: z4.number()
+import { z as z5 } from "zod";
+var PositionSchema = z5.object({
+  x: z5.number(),
+  y: z5.number()
 });
-var ScenarioGroupSchema = z4.object({
-  id: z4.string().min(1).max(128),
-  name: z4.string().min(1).max(200),
-  description: z4.string().max(1e3).optional(),
-  color: z4.string().max(32).optional(),
+var ScenarioGroupSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  name: z5.string().min(1).max(200),
+  description: z5.string().max(1e3).optional(),
+  color: z5.string().max(32).optional(),
   position: PositionSchema.default({ x: 0, y: 0 }),
-  width: z4.number().default(300),
-  height: z4.number().default(200)
+  width: z5.number().default(300),
+  height: z5.number().default(200)
 });
-var ScenarioPresetRoleSchema = z4.object({
-  id: z4.string().min(1).max(64),
-  name: z4.string().min(1).max(200),
-  systemPrompt: z4.string().max(1e4).default(""),
-  prompt: z4.string().max(1e4).default("")
-});
-var ScenarioPresetInitialDataSchema = z4.object({
-  leaderId: z4.string().min(1).max(128),
-  groups: z4.array(z4.object({
-    id: z4.string().min(1).max(128),
-    name: z4.string().min(1).max(200),
-    description: z4.string().max(1e3).optional(),
-    color: z4.string().max(32).optional(),
-    position: z4.object({ x: z4.number(), y: z4.number() }).default({ x: 0, y: 0 }),
-    width: z4.number().default(300),
-    height: z4.number().default(200)
+var ScenarioPresetRoleSchema = z5.object({
+  id: z5.string().min(1).max(64),
+  name: z5.string().min(1).max(200),
+  systemPrompt: z5.string().max(1e4).default(""),
+  prompt: z5.string().max(1e4).default("")
+});
+var ScenarioPresetInitialDataSchema = z5.object({
+  leaderId: z5.string().min(1).max(128),
+  groups: z5.array(z5.object({
+    id: z5.string().min(1).max(128),
+    name: z5.string().min(1).max(200),
+    description: z5.string().max(1e3).optional(),
+    color: z5.string().max(32).optional(),
+    position: z5.object({ x: z5.number(), y: z5.number() }).default({ x: 0, y: 0 }),
+    width: z5.number().default(300),
+    height: z5.number().default(200)
   })).max(100).default([]),
-  nodes: z4.array(z4.object({
-    id: z4.string().min(1).max(128),
-    type: z4.enum(["ai", "ask"]).default("ai"),
-    parentIds: z4.array(z4.string().max(128)).default([]),
-    groupId: z4.string().max(128).nullable().default(null),
-    label: z4.string().max(240).default(""),
-    role: z4.string().max(64).default("other"),
-    prompt: z4.string().max(5e4).default(""),
-    question: z4.string().max(2e3).default(""),
-    autoGenerated: z4.boolean().default(true),
-    canAddNode: z4.boolean().default(false),
-    aiCli: z4.enum(["claude-code", "codex"]).default("claude-code"),
-    model: z4.string().max(128).default("sonnet"),
-    position: z4.object({ x: z4.number(), y: z4.number() }).default({ x: 0, y: 0 })
+  nodes: z5.array(z5.object({
+    id: z5.string().min(1).max(128),
+    type: z5.enum(["ai", "ask"]).default("ai"),
+    parentIds: z5.array(z5.string().max(128)).default([]),
+    groupId: z5.string().max(128).nullable().default(null),
+    label: z5.string().max(240).default(""),
+    role: z5.string().max(64).default("other"),
+    prompt: z5.string().max(5e4).default(""),
+    question: z5.string().max(2e3).default(""),
+    autoGenerated: z5.boolean().default(true),
+    canAddNode: z5.boolean().default(false),
+    aiCli: z5.enum(["claude-code", "codex"]).default("claude-code"),
+    model: z5.string().max(128).default("sonnet"),
+    position: z5.object({ x: z5.number(), y: z5.number() }).default({ x: 0, y: 0 })
   })).min(1).max(500)
 });
-var LocalizedStringSchema = z4.record(z4.string(), z4.string().max(100));
-var ScenarioPresetLabelsSchema = z4.object({
+var LocalizedStringSchema = z5.record(z5.string(), z5.string().max(100));
+var ScenarioPresetLabelsSchema = z5.object({
   group: LocalizedStringSchema.optional(),
   node: LocalizedStringSchema.optional(),
   role: LocalizedStringSchema.optional(),
   leader: LocalizedStringSchema.optional()
 });
-var ScenarioPresetSchema = z4.object({
-  id: z4.string().min(1).max(128),
-  name: z4.string().min(1).max(200),
-  icon: z4.string().max(64).optional(),
-  defaultTraversalMode: z4.enum(["hierarchical", "topological"]).optional(),
-  canChangeTraversalMode: z4.boolean().default(true),
-  roles: z4.array(ScenarioPresetRoleSchema).min(1).max(100),
+var ScenarioPresetSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  name: z5.string().min(1).max(200),
+  icon: z5.string().max(64).optional(),
+  defaultTraversalMode: z5.enum(["hierarchical", "topological"]).optional(),
+  canChangeTraversalMode: z5.boolean().default(true),
+  roles: z5.array(ScenarioPresetRoleSchema).min(1).max(100),
   initialData: ScenarioPresetInitialDataSchema.optional(),
   labels: ScenarioPresetLabelsSchema.optional()
 });
-var ScenarioNodeSchema = z4.object({
-  id: z4.string().min(1).max(128),
-  type: z4.enum(["ai", "ask"]).default("ai"),
-  parentIds: z4.array(z4.string().max(128)).default([]),
-  groupId: z4.string().max(128).nullable().default(null),
-  label: z4.string().max(240).default(""),
-  role: z4.string().max(64).default("other"),
-  prompt: z4.string().max(5e4).default(""),
-  question: z4.string().max(2e3).default(""),
-  autoGenerated: z4.boolean().default(true),
-  canAddNode: z4.boolean().default(false),
-  aiCli: z4.enum(["claude-code", "codex"]).default("claude-code"),
-  model: z4.string().max(128).default("sonnet"),
+var ScenarioNodeSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  type: z5.enum(["ai", "ask"]).default("ai"),
+  parentIds: z5.array(z5.string().max(128)).default([]),
+  groupId: z5.string().max(128).nullable().default(null),
+  label: z5.string().max(240).default(""),
+  role: z5.string().max(64).default("other"),
+  prompt: z5.string().max(5e4).default(""),
+  question: z5.string().max(2e3).default(""),
+  autoGenerated: z5.boolean().default(true),
+  canAddNode: z5.boolean().default(false),
+  aiCli: z5.enum(["claude-code", "codex"]).default("claude-code"),
+  model: z5.string().max(128).default("sonnet"),
   position: PositionSchema.default({ x: 0, y: 0 }),
-  injectParentOutputs: z4.boolean().default(false),
-  injectedAncestorIds: z4.array(z4.string().max(128)).default([])
+  injectParentOutputs: z5.boolean().default(false),
+  injectedAncestorIds: z5.array(z5.string().max(128)).default([])
 });
-var ScenarioSchema = z4.object({
-  id: z4.string().min(1).max(128),
-  name: z4.string().min(1).max(200),
-  icon: z4.string().max(64).optional(),
-  description: z4.string().max(2e3).optional(),
-  leaderId: z4.string().min(1).max(128),
-  groups: z4.array(ScenarioGroupSchema).max(100).default([]),
-  nodes: z4.array(ScenarioNodeSchema).min(1).max(500),
-  traversalMode: z4.enum(["hierarchical", "topological"]).default("hierarchical"),
-  presetId: z4.string().max(128).optional(),
-  isPublished: z4.boolean().default(false),
-  createdAt: z4.number(),
-  updatedAt: z4.number()
+var ScenarioSchema = z5.object({
+  id: z5.string().min(1).max(128),
+  name: z5.string().min(1).max(200),
+  icon: z5.string().max(64).optional(),
+  description: z5.string().max(2e3).optional(),
+  leaderId: z5.string().min(1).max(128),
+  groups: z5.array(ScenarioGroupSchema).max(100).default([]),
+  nodes: z5.array(ScenarioNodeSchema).min(1).max(500),
+  traversalMode: z5.enum(["hierarchical", "topological"]).default("hierarchical"),
+  presetId: z5.string().max(128).optional(),
+  isPublished: z5.boolean().default(false),
+  createdAt: z5.number(),
+  updatedAt: z5.number()
 });
 
 // ../../packages/shared/src/schemas/settings.schema.ts
 var AI_PROVIDERS = ["anthropic", "openai", "mistral", "groq", "ollama"];
-var AIProviderSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  name: z5.string().min(1).max(200),
-  provider: z5.enum(AI_PROVIDERS),
-  encryptedApiKey: z5.string().max(2e3).default(""),
-  model: z5.string().max(200).optional(),
-  active: z5.boolean().default(false),
-  createdAt: z5.coerce.date(),
-  updatedAt: z5.coerce.date()
-});
-var JSLogParserSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  name: z5.string().min(1).max(200),
-  description: z5.string().max(2e3).optional(),
-  code: z5.string().min(1).max(5e4).refine(
+var AIProviderSchema = z6.object({
+  id: z6.string().min(1).max(128),
+  name: z6.string().min(1).max(200),
+  provider: z6.enum(AI_PROVIDERS),
+  encryptedApiKey: z6.string().max(2e3).default(""),
+  model: z6.string().max(200).optional(),
+  active: z6.boolean().default(false),
+  createdAt: z6.coerce.date(),
+  updatedAt: z6.coerce.date()
+});
+var JSLogParserSchema = z6.object({
+  id: z6.string().min(1).max(128),
+  name: z6.string().min(1).max(200),
+  description: z6.string().max(2e3).optional(),
+  code: z6.string().min(1).max(5e4).refine(
     (s) => !s.includes("require(") && !s.includes("import ") && !s.includes("eval("),
     { message: "Code must not contain require, import, or eval patterns" }
   ),
-  enabled: z5.boolean().default(true),
-  builtin: z5.boolean().optional(),
-  createdAt: z5.coerce.date(),
-  updatedAt: z5.coerce.date()
-});
-var NotificationPreferencesSchema = z5.object({
-  scenario_waiting_input: z5.boolean().default(true),
-  ai_conversation_complete: z5.boolean().default(true),
-  ai_conversation_error: z5.boolean().default(true),
-  service_error_log: z5.boolean().default(true),
-  service_status_changed: z5.boolean().default(true),
-  service_health_changed: z5.boolean().default(true),
+  enabled: z6.boolean().default(true),
+  builtin: z6.boolean().optional(),
+  createdAt: z6.coerce.date(),
+  updatedAt: z6.coerce.date()
+});
+var NotificationPreferencesSchema = z6.object({
+  scenario_waiting_input: z6.boolean().default(true),
+  ai_conversation_complete: z6.boolean().default(true),
+  ai_conversation_error: z6.boolean().default(true),
+  service_error_log: z6.boolean().default(true),
+  service_status_changed: z6.boolean().default(true),
+  service_health_changed: z6.boolean().default(true),
   /** Service IDs excluded from error-log notifications */
-  service_error_log_excluded: z5.array(z5.string().max(100)).max(500).default([]),
+  service_error_log_excluded: z6.array(z6.string().max(100)).max(500).default([]),
   /** Service IDs excluded from status-change notifications */
-  service_status_changed_excluded: z5.array(z5.string().max(100)).max(500).default([]),
+  service_status_changed_excluded: z6.array(z6.string().max(100)).max(500).default([]),
   /** Service IDs excluded from health-change notifications */
-  service_health_changed_excluded: z5.array(z5.string().max(100)).max(500).default([])
+  service_health_changed_excluded: z6.array(z6.string().max(100)).max(500).default([])
 });
-var SettingsSchema = z5.object({
-  mode: z5.enum(["local-simple", "cloud"]),
-  cloudUrl: z5.string().url().max(2048).nullable().optional(),
-  logParsers: z5.array(JSLogParserSchema).max(100).default([]),
-  scenarios: z5.array(ScenarioSchema).max(100).default([]),
+var SettingsSchema = z6.object({
+  mode: z6.enum(["local-simple", "cloud"]),
+  cloudUrl: z6.string().url().max(2048).nullable().optional(),
+  logParsers: z6.array(JSLogParserSchema).max(100).default([]),
+  scenarios: z6.array(ScenarioSchema).max(100).default([]),
   /** Absolute path to the folder where the global wiki/docs markdown files live. Optional. */
-  globalDocsPath: z5.string().max(4096).optional()
-});
-var TraefikConfigSchema = z5.object({
-  enabled: z5.boolean().default(false),
-  acmeEmail: z5.string().email().max(256).optional(),
-  wildcardDomain: z5.string().max(253).optional(),
-  httpPort: z5.number().int().min(1).max(65535).default(80),
-  httpsPort: z5.number().int().min(1).max(65535).default(443),
-  dnsProvider: z5.string().max(64).optional(),
-  dnsCredentials: z5.record(z5.string().max(64), z5.string().max(2048)).default({}),
-  acmeStaging: z5.boolean().default(false),
-  encryptedCert: z5.string().max(65536).optional(),
-  encryptedCertKey: z5.string().max(65536).optional()
-});
-var SettingsPrivateSchema = z5.object({
-  aiProviders: z5.array(AIProviderSchema).max(50).default([]),
-  scenarios: z5.array(ScenarioSchema).max(100).default([]),
+  globalDocsPath: z6.string().max(4096).optional()
+});
+var TraefikConfigSchema = z6.object({
+  enabled: z6.boolean().default(false),
+  acmeEmail: z6.string().email().max(256).optional(),
+  wildcardDomain: z6.string().max(253).optional(),
+  httpPort: z6.number().int().min(1).max(65535).default(80),
+  httpsPort: z6.number().int().min(1).max(65535).default(443),
+  dnsProvider: z6.string().max(64).optional(),
+  dnsCredentials: z6.record(z6.string().max(64), z6.string().max(2048)).default({}),
+  acmeStaging: z6.boolean().default(false),
+  encryptedCert: z6.string().max(65536).optional(),
+  encryptedCertKey: z6.string().max(65536).optional()
+});
+var SettingsPrivateSchema = z6.object({
+  aiProviders: z6.array(AIProviderSchema).max(50).default([]),
+  scenarios: z6.array(ScenarioSchema).max(100).default([]),
   notifications: NotificationPreferencesSchema.default(() => ({
     scenario_waiting_input: true,
     ai_conversation_complete: true,
@@ -421,57 +593,57 @@ var SettingsPrivateSchema = z5.object({
   })),
   traefikConfig: TraefikConfigSchema.optional()
 });
-var SchemaVersionSchema = z5.object({
-  version: z5.number().int().positive(),
-  migratedAt: z5.coerce.date()
+var SchemaVersionSchema = z6.object({
+  version: z6.number().int().positive(),
+  migratedAt: z6.coerce.date()
 });
 
 // ../../packages/shared/src/schemas/log-source.schema.ts
-import { z as z6 } from "zod";
-var safePath = z6.string().min(1).max(4096).refine(
+import { z as z7 } from "zod";
+var safePath = z7.string().min(1).max(4096).refine(
   (p) => !p.includes("\0"),
   { message: "path must not contain null bytes" }
 ).refine(
   (p) => !/(^|[/\\])\.\.([/\\]|$)/.test(p),
   { message: "path must not contain path-traversal sequences (..)" }
 );
-var ConsoleLogSourceSchema = z6.object({
-  type: z6.literal("console")
+var ConsoleLogSourceSchema = z7.object({
+  type: z7.literal("console")
 });
-var FileLogSourceSchema = z6.object({
-  type: z6.literal("file"),
+var FileLogSourceSchema = z7.object({
+  type: z7.literal("file"),
   path: safePath,
-  encoding: z6.string().max(32).default("utf-8"),
-  startFromEnd: z6.boolean().default(true),
-  createIfNotExists: z6.boolean().default(false)
+  encoding: z7.string().max(32).default("utf-8"),
+  startFromEnd: z7.boolean().default(true),
+  createIfNotExists: z7.boolean().default(false)
 });
-var MongoLogSourceSchema = z6.object({
-  type: z6.literal("mongo"),
+var MongoLogSourceSchema = z7.object({
+  type: z7.literal("mongo"),
   /** @sensitive — stored encrypted (AES-256-GCM) on disk */
-  connectionString: z6.string().min(1).max(2048),
-  database: z6.string().min(1).max(256),
-  collection: z6.string().min(1).max(256),
-  filter: z6.record(z6.string(), z6.unknown()).optional(),
-  timestampField: z6.string().max(128).default("timestamp"),
-  messageField: z6.string().max(128).default("message"),
-  levelField: z6.string().max(128).optional()
-});
-var MySQLLogSourceSchema = z6.object({
-  type: z6.literal("mysql"),
-  host: z6.string().min(1).max(253),
-  port: z6.number().int().min(1).max(65535).default(3306),
-  user: z6.string().min(1).max(256),
+  connectionString: z7.string().min(1).max(2048),
+  database: z7.string().min(1).max(256),
+  collection: z7.string().min(1).max(256),
+  filter: z7.record(z7.string(), z7.unknown()).optional(),
+  timestampField: z7.string().max(128).default("timestamp"),
+  messageField: z7.string().max(128).default("message"),
+  levelField: z7.string().max(128).optional()
+});
+var MySQLLogSourceSchema = z7.object({
+  type: z7.literal("mysql"),
+  host: z7.string().min(1).max(253),
+  port: z7.number().int().min(1).max(65535).default(3306),
+  user: z7.string().min(1).max(256),
   /** @sensitive — stored encrypted (AES-256-GCM) on disk */
-  password: z6.string().max(2048),
-  database: z6.string().min(1).max(256),
-  table: z6.string().min(1).max(256),
-  query: z6.string().max(8192).optional(),
-  timestampColumn: z6.string().max(128).default("created_at"),
-  messageColumn: z6.string().max(128).default("message"),
-  levelColumn: z6.string().max(128).optional(),
-  pollIntervalMs: z6.number().int().min(500).max(6e4).default(2e3)
-});
-var LogSourceConfigSchema = z6.discriminatedUnion("type", [
+  password: z7.string().max(2048),
+  database: z7.string().min(1).max(256),
+  table: z7.string().min(1).max(256),
+  query: z7.string().max(8192).optional(),
+  timestampColumn: z7.string().max(128).default("created_at"),
+  messageColumn: z7.string().max(128).default("message"),
+  levelColumn: z7.string().max(128).optional(),
+  pollIntervalMs: z7.number().int().min(500).max(6e4).default(2e3)
+});
+var LogSourceConfigSchema = z7.discriminatedUnion("type", [
   ConsoleLogSourceSchema,
   FileLogSourceSchema,
   MongoLogSourceSchema,
@@ -479,293 +651,293 @@ var LogSourceConfigSchema = z6.discriminatedUnion("type", [
 ]);
 
 // ../../packages/shared/src/schemas/service.schema.ts
-var HealthCheckSchema = z7.object({
-  type: z7.enum(["http", "command"]).default("http"),
+var HealthCheckSchema = z8.object({
+  type: z8.enum(["http", "command"]).default("http"),
   // HTTP-specific (required when type=http)
-  path: z7.string().min(1).max(500).startsWith("/").optional(),
-  method: z7.enum(["GET", "HEAD", "POST", "PUT"]).optional().default("GET"),
-  expectedStatus: z7.number().int().min(100).max(599).optional().default(200),
+  path: z8.string().min(1).max(500).startsWith("/").optional(),
+  method: z8.enum(["GET", "HEAD", "POST", "PUT"]).optional().default("GET"),
+  expectedStatus: z8.number().int().min(100).max(599).optional().default(200),
   // Command-specific (required when type=command)
-  command: z7.string().min(1).max(4096).optional(),
+  command: z8.string().min(1).max(4096).optional(),
   // Shared
-  interval: z7.number().int().positive().default(1e3),
-  timeout: z7.number().int().positive().default(1e3),
-  retries: z7.number().int().nonnegative().default(3),
-  initialDelay: z7.number().int().nonnegative().optional().default(0)
+  interval: z8.number().int().positive().default(1e3),
+  timeout: z8.number().int().positive().default(1e3),
+  retries: z8.number().int().nonnegative().default(3),
+  initialDelay: z8.number().int().nonnegative().optional().default(0)
 }).refine(
   (data) => data.type === "http" ? !!data.path : !!data.command,
   { message: "HTTP type requires path; command type requires command" }
 );
-var BootstrapCommandSchema = z7.object({
-  id: z7.string().min(1).max(64),
-  label: z7.string().max(200).default(""),
-  entrypoint: z7.string().max(4096).optional(),
-  command: z7.string().max(4096).default(""),
-  user: z7.string().max(256).optional()
-});
-var DockerConfigSchema = z7.object({
+var BootstrapCommandSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  entrypoint: z8.string().max(4096).optional(),
+  command: z8.string().max(4096).default(""),
+  user: z8.string().max(256).optional()
+});
+var DockerConfigSchema = z8.object({
   // Image mode (pull from registry) — mutually exclusive with build mode in UI
-  image: z7.string().min(1).max(1024).optional(),
+  image: z8.string().min(1).max(1024).optional(),
   // Build mode — Dockerfile stored inline in services.json
-  dockerfile: z7.string().max(65536).optional(),
-  buildContext: z7.string().max(4096).optional(),
-  buildArgs: z7.record(z7.string().max(256), z7.string().max(4096)).default({}).refine(
+  dockerfile: z8.string().max(65536).optional(),
+  buildContext: z8.string().max(4096).optional(),
+  buildArgs: z8.record(z8.string().max(256), z8.string().max(4096)).default({}).refine(
     (obj) => Object.keys(obj).length <= 50,
     { message: "Max 50 build args" }
   ),
-  targetStage: z7.string().max(256).optional(),
+  targetStage: z8.string().max(256).optional(),
   // Runtime config
-  networkMode: z7.enum(["host", "bridge"]).default("host"),
-  ports: z7.array(z7.string().max(64)).max(100).default([]),
-  volumes: z7.array(z7.string().max(1024)).max(100).default([]),
-  mountRootpath: z7.boolean().default(false),
-  entrypoint: z7.string().max(4096).optional(),
-  command: z7.string().max(4096).optional(),
-  user: z7.string().max(256).optional(),
-  useNativeCommand: z7.boolean().default(false),
-  nativeCommandMode: z7.enum(["shared", "isolated"]).default("isolated"),
-  nativeShell: z7.string().max(256).default("sh"),
-  bootstrapCommands: z7.array(BootstrapCommandSchema).max(20).default([])
-});
-var RestartStrategySchema = z7.enum(["none", "on-failure", "always", "unless-stopped"]).default("none");
-var ServiceShortcutSchema = z7.object({
-  id: z7.string().min(1).max(64),
-  label: z7.string().max(200).default(""),
-  command: z7.string().max(4096).default(""),
-  cwd: z7.string().max(4096).optional()
-});
-var ServiceCommandSchema = z7.object({
-  id: z7.string().min(1).max(64),
-  label: z7.string().max(200).default(""),
-  command: z7.string().max(4096).default(""),
-  cwd: z7.string().max(4096).optional(),
-  shell: z7.boolean().optional().default(true)
-});
-var VariableSlotSchema = z7.object({
-  value: z7.string().max(8192).default(""),
-  pre: z7.string().max(8192).default(""),
-  post: z7.string().max(8192).default(""),
-  isSecret: z7.boolean().default(false),
+  networkMode: z8.enum(["host", "bridge"]).default("host"),
+  ports: z8.array(z8.string().max(64)).max(100).default([]),
+  volumes: z8.array(z8.string().max(1024)).max(100).default([]),
+  mountRootpath: z8.boolean().default(false),
+  entrypoint: z8.string().max(4096).optional(),
+  command: z8.string().max(4096).optional(),
+  user: z8.string().max(256).optional(),
+  useNativeCommand: z8.boolean().default(false),
+  nativeCommandMode: z8.enum(["shared", "isolated"]).default("isolated"),
+  nativeShell: z8.string().max(256).default("sh"),
+  bootstrapCommands: z8.array(BootstrapCommandSchema).max(20).default([])
+});
+var RestartStrategySchema = z8.enum(["none", "on-failure", "always", "unless-stopped"]).default("none");
+var ServiceShortcutSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  command: z8.string().max(4096).default(""),
+  cwd: z8.string().max(4096).optional()
+});
+var ServiceCommandSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  command: z8.string().max(4096).default(""),
+  cwd: z8.string().max(4096).optional(),
+  shell: z8.boolean().optional().default(true)
+});
+var VariableSlotSchema = z8.object({
+  value: z8.string().max(8192).default(""),
+  pre: z8.string().max(8192).default(""),
+  post: z8.string().max(8192).default(""),
+  isSecret: z8.boolean().default(false),
   // When true, this variable is injected into the process environment of AI
   // agents (Claude Code, Codex, …) spawned while this environment is active.
   // Opt-in: defaults to false so secrets are never leaked to AI agents by default.
-  injectIntoAi: z7.boolean().default(false)
+  injectIntoAi: z8.boolean().default(false)
 });
-var VariableSchema = z7.object({
-  key: z7.string().min(1).max(256),
+var VariableSchema = z8.object({
+  key: z8.string().min(1).max(256),
   value: VariableSlotSchema
 });
-var VariablesRecordSchema = z7.record(
-  z7.string().max(128),
+var VariablesRecordSchema = z8.record(
+  z8.string().max(128),
   VariableSchema
 ).refine(
   (obj) => Object.keys(obj).length <= 200,
   { message: "Max 200 variables" }
 );
-var VariableSlotsRecordSchema = z7.record(
-  z7.string().max(256),
+var VariableSlotsRecordSchema = z8.record(
+  z8.string().max(256),
   VariableSlotSchema
 ).refine(
   (obj) => Object.keys(obj).length <= 200,
   { message: "Max 200 variable slots" }
 );
-var ServiceConfigSchema = z7.object({
-  id: z7.string().max(128),
-  orgId: z7.string().max(128).nullable().optional(),
-  agentId: z7.string().max(128).optional(),
+var ServiceConfigSchema = z8.object({
+  id: z8.string().max(128),
+  orgId: z8.string().max(128).nullable().optional(),
+  agentId: z8.string().max(128).optional(),
   // Optional: if absent, inherited from active environment's agentId
-  name: z7.string().min(1).max(200),
-  commands: z7.array(ServiceCommandSchema).max(50).optional().default([]),
-  cwd: z7.string().max(4096).optional(),
-  ports: z7.array(z7.number().int().positive().max(65535)).max(20).optional().default([]),
+  name: z8.string().min(1).max(200),
+  commands: z8.array(ServiceCommandSchema).max(50).optional().default([]),
+  cwd: z8.string().max(4096).optional(),
+  ports: z8.array(z8.number().int().positive().max(65535)).max(20).optional().default([]),
   // Metadata fields (migration from old Runeya)
-  groups: z7.array(z7.string().max(200)).max(20).optional().default([]),
-  description: z7.string().max(2e3).optional(),
+  groups: z8.array(z8.string().max(200)).max(20).optional().default([]),
+  description: z8.string().max(2e3).optional(),
   /** Path (relative to service.cwd or absolute) where the service's docs/wiki markdown files live. Optional — defaults to service.cwd. */
-  docsPath: z7.string().max(4096).optional(),
-  url: z7.string().max(2048).optional(),
-  localUrls: z7.array(z7.object({
-    url: z7.string().max(253).regex(/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/),
-    port: z7.number().int().min(1).max(65535)
+  docsPath: z8.string().max(4096).optional(),
+  url: z8.string().max(2048).optional(),
+  localUrls: z8.array(z8.object({
+    url: z8.string().max(253).regex(/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/),
+    port: z8.number().int().min(1).max(65535)
   })).max(20).optional().default([]),
-  openapiUrl: z7.string().max(2048).optional(),
-  git: z7.object({
-    remote: z7.string().max(2048).optional(),
-    home: z7.string().max(2048).optional()
+  openapiUrl: z8.string().max(2048).optional(),
+  git: z8.object({
+    remote: z8.string().max(2048).optional(),
+    home: z8.string().max(2048).optional()
   }).optional(),
-  meta: z7.record(z7.string().max(256), z7.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
   // Transient env dict (resolved by server before deployment, used directly by agent runner — NOT persisted)
-  env: z7.record(z7.string().max(256), z7.string().max(8192)).default({}).refine(
+  env: z8.record(z8.string().max(256), z8.string().max(8192)).default({}).refine(
     (obj) => Object.keys(obj).length <= 200,
     { message: "Too many env vars (max 200)" }
   ),
-  envSecrets: z7.array(z7.string().max(256)).max(200).default([]),
+  envSecrets: z8.array(z8.string().max(256)).max(200).default([]),
   // Transient: resolved JS log parsers (from parserIds, resolved by server before deployment — NOT persisted)
-  resolvedLogParsers: z7.array(JSLogParserSchema).default([]).optional(),
+  resolvedLogParsers: z8.array(JSLogParserSchema).default([]).optional(),
   // Transient: resolved working directory (cwd with env vars expanded — NOT persisted)
-  resolvedCwd: z7.string().optional(),
-  runner: z7.enum(["native", "docker"]).optional().default("native"),
+  resolvedCwd: z8.string().optional(),
+  runner: z8.enum(["native", "docker"]).optional().default("native"),
   dockerConfig: DockerConfigSchema.optional(),
   healthCheck: HealthCheckSchema.optional(),
-  parserIds: z7.array(z7.string().max(128)).max(50).default([]),
-  shortcuts: z7.array(ServiceShortcutSchema).max(50).optional().default([]),
-  autoRestart: z7.boolean().optional().default(false),
-  clearLogsOnStart: z7.boolean().optional().default(false),
+  parserIds: z8.array(z8.string().max(128)).max(50).default([]),
+  shortcuts: z8.array(ServiceShortcutSchema).max(50).optional().default([]),
+  autoRestart: z8.boolean().optional().default(false),
+  clearLogsOnStart: z8.boolean().optional().default(false),
   restartStrategy: RestartStrategySchema.optional(),
-  maxRestarts: z7.number().int().nonnegative().optional(),
-  restartBackoffMs: z7.number().int().positive().optional().default(1e3),
+  maxRestarts: z8.number().int().nonnegative().optional(),
+  restartBackoffMs: z8.number().int().positive().optional().default(1e3),
   // Log sources additionnelles (au-delà du stdout/stderr console par défaut)
-  logSources: z7.array(LogSourceConfigSchema).max(20).optional().default([])
+  logSources: z8.array(LogSourceConfigSchema).max(20).optional().default([])
 });
 var CreateServiceSchema = ServiceConfigSchema.omit({ id: true }).partial().required({ name: true });
 var UpdateServiceSchema = ServiceConfigSchema.partial().required({ id: true }).extend({
-  agentId: z7.string().max(128).nullable().optional(),
+  agentId: z8.string().max(128).nullable().optional(),
   // null = clear (inherit from env), undefined = no change
-  cwd: z7.string().max(4096).nullable().optional(),
-  git: z7.object({ remote: z7.string().max(2048).optional(), home: z7.string().max(2048).optional() }).nullable().optional(),
-  meta: z7.record(z7.string().max(256), z7.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  cwd: z8.string().max(4096).nullable().optional(),
+  git: z8.object({ remote: z8.string().max(2048).optional(), home: z8.string().max(2048).optional() }).nullable().optional(),
+  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
   healthCheck: HealthCheckSchema.nullable().optional()
 });
 
 // ../../packages/shared/src/schemas/process.schema.ts
-import { z as z8 } from "zod";
-var ProcessStateSchema = z8.enum(["starting", "running", "stopped", "errored"]);
-var HealthStatusSchema = z8.enum(["healthy", "unhealthy", "unknown"]);
-var ProcessStatusSchema = z8.object({
-  id: z8.string().max(128),
-  serviceId: z8.string().max(128),
-  agentId: z8.string().max(128),
+import { z as z9 } from "zod";
+var ProcessStateSchema = z9.enum(["starting", "running", "stopped", "errored"]);
+var HealthStatusSchema = z9.enum(["healthy", "unhealthy", "unknown"]);
+var ProcessStatusSchema = z9.object({
+  id: z9.string().max(128),
+  serviceId: z9.string().max(128),
+  agentId: z9.string().max(128),
   state: ProcessStateSchema,
-  pid: z8.number().int().nullable().optional(),
-  pids: z8.array(z8.number().int()).optional().default([]),
-  exitCode: z8.number().int().nullable().optional(),
-  startedAt: z8.coerce.date().nullable().optional(),
-  restartCount: z8.number().int().nonnegative().default(0),
-  uptime: z8.number().nonnegative().default(0),
+  pid: z9.number().int().nullable().optional(),
+  pids: z9.array(z9.number().int()).optional().default([]),
+  exitCode: z9.number().int().nullable().optional(),
+  startedAt: z9.coerce.date().nullable().optional(),
+  restartCount: z9.number().int().nonnegative().default(0),
+  uptime: z9.number().nonnegative().default(0),
   healthStatus: HealthStatusSchema.default("unknown")
 });
 
 // ../../packages/shared/src/schemas/log.schema.ts
-import { z as z9 } from "zod";
-var LogLevelSchema = z9.enum(["debug", "info", "warn", "error", "fatal"]);
-var LogLineSchema = z9.object({
+import { z as z10 } from "zod";
+var LogLevelSchema = z10.enum(["debug", "info", "warn", "error", "fatal"]);
+var LogLineSchema = z10.object({
   /** Raw log line as received from the process (immutable context) */
-  raw: z9.string(),
+  raw: z10.string(),
   /** Source stream (immutable context) */
-  stream: z9.enum(["stdout", "stderr"]),
+  stream: z10.enum(["stdout", "stderr"]),
   /** Severity level */
   level: LogLevelSchema,
   /** Parsed/enriched message to display */
-  message: z9.string(),
+  message: z10.string(),
   /** When true, the line is hidden from the log view */
-  hidden: z9.boolean(),
+  hidden: z10.boolean(),
   /** Arbitrary key/value pairs shown in the detail panel */
-  metadata: z9.record(z9.string().max(256), z9.unknown()).refine(
+  metadata: z10.record(z10.string().max(256), z10.unknown()).refine(
     (obj) => Object.keys(obj).length <= 100,
     { message: "Too many metadata keys (max 100)" }
   ),
   /** Full parsed JSON object when the line is JSON */
-  json: z9.record(z9.string(), z9.unknown()).optional(),
+  json: z10.record(z10.string(), z10.unknown()).optional(),
   /** Custom header for the JSON log card (supports HTML, sanitized before display) */
-  jsonHeader: z9.string().max(256).optional()
+  jsonHeader: z10.string().max(256).optional()
 });
-var LogCardDirectiveSchema = z9.object({
-  id: z9.string().max(128),
-  type: z9.string().max(64),
-  header: z9.string().max(256),
-  collapsable: z9.boolean().optional(),
-  collapsed: z9.boolean().optional(),
-  state: z9.enum(["open", "append", "close", "self"])
+var LogCardDirectiveSchema = z10.object({
+  id: z10.string().max(128),
+  type: z10.string().max(64),
+  header: z10.string().max(256),
+  collapsable: z10.boolean().optional(),
+  collapsed: z10.boolean().optional(),
+  state: z10.enum(["open", "append", "close", "self"])
 });
-var ParsedLogSchema = z9.object({
-  id: z9.string().max(128),
-  processId: z9.string().max(128),
-  pid: z9.number().int().nullable().optional(),
-  timestamp: z9.coerce.date(),
+var ParsedLogSchema = z10.object({
+  id: z10.string().max(128),
+  processId: z10.string().max(128),
+  pid: z10.number().int().nullable().optional(),
+  timestamp: z10.coerce.date(),
   level: LogLevelSchema.default("info"),
-  message: z9.string().max(16384),
-  raw: z9.string().max(16384),
-  stream: z9.enum(["stdout", "stderr"]).default("stdout"),
-  hidden: z9.boolean().optional().default(false),
-  metadata: z9.record(z9.string().max(256), z9.unknown()).optional().refine(
+  message: z10.string().max(16384),
+  raw: z10.string().max(16384),
+  stream: z10.enum(["stdout", "stderr"]).default("stdout"),
+  hidden: z10.boolean().optional().default(false),
+  metadata: z10.record(z10.string().max(256), z10.unknown()).optional().refine(
     (obj) => !obj || Object.keys(obj).length <= 100,
     { message: "Too many metadata keys (max 100)" }
   ),
-  json: z9.record(z9.string(), z9.unknown()).optional(),
+  json: z10.record(z10.string(), z10.unknown()).optional(),
   logCard: LogCardDirectiveSchema.optional(),
-  sourceType: z9.enum(["console", "file", "mongo", "mysql"]).optional(),
-  sourcePath: z9.string().max(4096).optional()
+  sourceType: z10.enum(["console", "file", "mongo", "mysql"]).optional(),
+  sourcePath: z10.string().max(4096).optional()
 });
 
 // ../../packages/shared/src/schemas/agent.schema.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var ENV_VAR_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var AgentConfigSchema = z10.object({
-  id: z10.string().max(128),
-  name: z10.string().min(1).max(100),
-  url: z10.string().url().max(2048),
-  passphrase: z10.string().min(1).max(1024),
-  passthroughEnv: z10.array(
-    z10.string().regex(ENV_VAR_NAME_REGEX).max(256)
+var AgentConfigSchema = z11.object({
+  id: z11.string().max(128),
+  name: z11.string().min(1).max(100),
+  url: z11.string().url().max(2048),
+  passphrase: z11.string().min(1).max(1024),
+  passthroughEnv: z11.array(
+    z11.string().regex(ENV_VAR_NAME_REGEX).max(256)
   ).max(100).default([])
 });
-var AgentStatusSchema = z10.object({
-  connected: z10.boolean(),
-  lastSeen: z10.string().nullable().optional(),
-  uptime: z10.number().nonnegative().default(0),
-  runnersAvailable: z10.array(z10.enum(["native", "docker"])).default(["native"]),
-  lanIp: z10.string().optional()
+var AgentStatusSchema = z11.object({
+  connected: z11.boolean(),
+  lastSeen: z11.string().nullable().optional(),
+  uptime: z11.number().nonnegative().default(0),
+  runnersAvailable: z11.array(z11.enum(["native", "docker"])).default(["native"]),
+  lanIp: z11.string().optional()
 });
 
 // ../../packages/shared/src/schemas/permission.schema.ts
-import { z as z11 } from "zod";
-var GlobalRoleSchema = z11.enum(["owner", "admin", "member"]);
-var ProjectRoleSchema = z11.enum(["admin", "editor", "viewer"]);
-var ProjectMemberRoleSchema = z11.object({
-  id: z11.string().max(128),
-  projectId: z11.string().max(128),
-  userId: z11.string().max(128),
+import { z as z12 } from "zod";
+var GlobalRoleSchema = z12.enum(["owner", "admin", "member"]);
+var ProjectRoleSchema = z12.enum(["admin", "editor", "viewer"]);
+var ProjectMemberRoleSchema = z12.object({
+  id: z12.string().max(128),
+  projectId: z12.string().max(128),
+  userId: z12.string().max(128),
   role: ProjectRoleSchema
 });
 
 // ../../packages/shared/src/schemas/sync.schema.ts
-import { z as z12 } from "zod";
-var ConfigVersionSchema = z12.object({
-  id: z12.string().max(128),
-  entityType: z12.enum(["project", "service"]),
-  entityId: z12.string().max(128),
-  version: z12.string().max(128),
-  parentVersion: z12.string().max(128),
-  data: z12.record(z12.string(), z12.unknown()).refine(
+import { z as z13 } from "zod";
+var ConfigVersionSchema = z13.object({
+  id: z13.string().max(128),
+  entityType: z13.enum(["project", "service"]),
+  entityId: z13.string().max(128),
+  version: z13.string().max(128),
+  parentVersion: z13.string().max(128),
+  data: z13.record(z13.string(), z13.unknown()).refine(
     (obj) => Object.keys(obj).length <= 1e3,
     "Too many data keys (max 1000)"
   ),
-  patch: z12.array(z12.record(z12.string(), z12.unknown())).max(1e3),
-  userId: z12.string().max(128),
-  timestamp: z12.coerce.date(),
-  resolved: z12.boolean().default(false)
-});
-var ConfigChangeSchema = z12.object({
-  entityType: z12.enum(["project", "service"]),
-  entityId: z12.string().max(128),
-  version: z12.string().max(128),
-  parentVersion: z12.string().max(128),
-  data: z12.record(z12.string(), z12.unknown()).refine(
+  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3),
+  userId: z13.string().max(128),
+  timestamp: z13.coerce.date(),
+  resolved: z13.boolean().default(false)
+});
+var ConfigChangeSchema = z13.object({
+  entityType: z13.enum(["project", "service"]),
+  entityId: z13.string().max(128),
+  version: z13.string().max(128),
+  parentVersion: z13.string().max(128),
+  data: z13.record(z13.string(), z13.unknown()).refine(
     (obj) => Object.keys(obj).length <= 1e3,
     "Too many data keys (max 1000)"
   ),
-  patch: z12.array(z12.record(z12.string(), z12.unknown())).max(1e3)
+  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3)
 });
-var SyncStatusSchema = z12.object({
-  connected: z12.boolean(),
-  lastSync: z12.coerce.date().nullable().optional(),
-  pendingChanges: z12.number().int().nonnegative().default(0),
-  conflicts: z12.number().int().nonnegative().default(0)
+var SyncStatusSchema = z13.object({
+  connected: z13.boolean(),
+  lastSync: z13.coerce.date().nullable().optional(),
+  pendingChanges: z13.number().int().nonnegative().default(0),
+  conflicts: z13.number().int().nonnegative().default(0)
 });
 
 // ../../packages/shared/src/schemas/audit.schema.ts
-import { z as z13 } from "zod";
-var AuditActionSchema = z13.enum([
+import { z as z14 } from "zod";
+var AuditActionSchema = z14.enum([
   "create",
   "update",
   "delete",
@@ -776,112 +948,122 @@ var AuditActionSchema = z13.enum([
   "stop",
   "roleChange"
 ]);
-var AuditEntityTypeSchema = z13.enum([
+var AuditEntityTypeSchema = z14.enum([
   "org",
   "project",
   "service",
   "member",
   "permission"
 ]);
-var AuditLogSchema = z13.object({
-  id: z13.string().max(128),
-  orgId: z13.string().max(128),
-  userId: z13.string().max(128),
+var AuditLogSchema = z14.object({
+  id: z14.string().max(128),
+  orgId: z14.string().max(128),
+  userId: z14.string().max(128),
   action: AuditActionSchema,
   entityType: AuditEntityTypeSchema,
-  entityId: z13.string().max(128),
-  metadata: z13.record(z13.string().max(256), z13.unknown()).default({}).refine(
+  entityId: z14.string().max(128),
+  metadata: z14.record(z14.string().max(256), z14.unknown()).default({}).refine(
     (obj) => Object.keys(obj).length <= 100,
     { message: "Too many metadata keys (max 100)" }
   ),
-  timestamp: z13.coerce.date()
+  timestamp: z14.coerce.date()
 });
 
 // ../../packages/shared/src/schemas/metrics.schema.ts
-import { z as z14 } from "zod";
-var ProcessMetricsSchema = z14.object({
-  processId: z14.string().max(128),
-  cpu: z14.number().nonnegative(),
-  memory: z14.number().int().nonnegative(),
-  timestamp: z14.string()
+import { z as z15 } from "zod";
+var ProcessMetricsSchema = z15.object({
+  processId: z15.string().max(128),
+  cpu: z15.number().nonnegative(),
+  memory: z15.number().int().nonnegative(),
+  timestamp: z15.string()
 });
 
 // ../../packages/shared/src/schemas/environment.schema.ts
-import { z as z15 } from "zod";
-var EnvironmentVariablesSchema = z15.record(
-  z15.string().max(256),
+import { z as z16 } from "zod";
+var EnvironmentVariablesSchema = z16.record(
+  z16.string().max(256),
   VariableSchema
 ).refine(
   (obj) => Object.keys(obj).length <= 200,
   { message: "Max 200 variables" }
 );
-var EnvironmentSchema = z15.object({
-  id: z15.string().max(128),
-  projectId: z15.string().max(128),
-  name: z15.string().min(1).max(200),
-  description: z15.string().max(2e3).optional().default(""),
-  parentIds: z15.array(z15.string().max(128)).max(10).default([]),
+var EnvironmentSchema = z16.object({
+  id: z16.string().max(128),
+  projectId: z16.string().max(128),
+  name: z16.string().min(1).max(200),
+  description: z16.string().max(2e3).optional().default(""),
+  parentIds: z16.array(z16.string().max(128)).max(10).default([]),
   variables: EnvironmentVariablesSchema.default({}),
   // Scope: 'global' = project-level env, 'service' = per-service env
-  scope: z15.enum(["global", "service"]).default("global"),
+  scope: z16.enum(["global", "service"]).default("global"),
   // When scope='service': the serviceId this env belongs to
-  reference: z15.string().max(128).optional(),
+  reference: z16.string().max(128).optional(),
   // When scope='service': the globalEnvId this env activates on
-  activateOn: z15.string().max(128).optional(),
-  immutable: z15.boolean().default(false),
-  default: z15.boolean().optional().default(false),
-  color: z15.string().max(20).optional(),
-  bgColor: z15.string().max(20).optional(),
+  activateOn: z16.string().max(128).optional(),
+  immutable: z16.boolean().default(false),
+  default: z16.boolean().optional().default(false),
+  color: z16.string().max(20).optional(),
+  bgColor: z16.string().max(20).optional(),
   // When scope='global': the default agent used by services that don't have an explicit agentId
-  agentId: z15.string().max(128).optional()
-});
-var ResolvedEnvironmentSchema = z15.object({
-  variables: z15.record(z15.string().max(256), VariableSchema).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved variables" }),
-  env: z15.record(z15.string().max(256), z15.string().max(8192)).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved env vars" }),
-  envSecrets: z15.array(z15.string().max(256)).max(500),
-  sources: z15.record(z15.string().max(256), z15.object({
-    environmentId: z15.string().max(128),
-    environmentName: z15.string().max(200),
-    overridden: z15.boolean(),
-    resolvedFrom: z15.object({
-      environmentId: z15.string().max(128),
-      environmentName: z15.string().max(200)
+  agentId: z16.string().max(128).optional()
+});
+var ResolvedEnvironmentSchema = z16.object({
+  variables: z16.record(z16.string().max(256), VariableSchema).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved variables" }),
+  env: z16.record(z16.string().max(256), z16.string().max(8192)).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved env vars" }),
+  envSecrets: z16.array(z16.string().max(256)).max(500),
+  sources: z16.record(z16.string().max(256), z16.object({
+    environmentId: z16.string().max(128),
+    environmentName: z16.string().max(200),
+    overridden: z16.boolean(),
+    resolvedFrom: z16.object({
+      environmentId: z16.string().max(128),
+      environmentName: z16.string().max(200)
+    }).optional(),
+    // Set when a machine-local override was applied to this variable, pointing
+    // at the environment that carries the winning override. Distinct from
+    // `overridden`, which also covers "shadows an inherited variable".
+    overriddenBy: z16.object({
+      environmentId: z16.string().max(128),
+      environmentName: z16.string().max(200)
     }).optional()
   })).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 source entries" })
 });
 var CreateEnvironmentSchema = EnvironmentSchema.omit({ id: true }).extend({
-  description: z15.string().max(2e3).optional().default(""),
-  parentIds: z15.array(z15.string().max(128)).max(10).optional().default([]),
+  description: z16.string().max(2e3).optional().default(""),
+  parentIds: z16.array(z16.string().max(128)).max(10).optional().default([]),
   variables: EnvironmentVariablesSchema.optional().default({}),
-  scope: z15.enum(["global", "service"]).optional().default("global"),
-  reference: z15.string().max(128).optional(),
-  activateOn: z15.string().max(128).optional(),
-  immutable: z15.boolean().optional().default(false)
+  scope: z16.enum(["global", "service"]).optional().default("global"),
+  reference: z16.string().max(128).optional(),
+  activateOn: z16.string().max(128).optional(),
+  immutable: z16.boolean().optional().default(false)
 });
 var UpdateEnvironmentSchema = EnvironmentSchema.partial().required({ id: true }).extend({
-  description: z15.string().max(2e3).optional(),
-  parentIds: z15.array(z15.string().max(128)).max(10).optional(),
+  description: z16.string().max(2e3).optional(),
+  parentIds: z16.array(z16.string().max(128)).max(10).optional(),
   variables: EnvironmentVariablesSchema.optional(),
-  scope: z15.enum(["global", "service"]).optional(),
-  immutable: z15.boolean().optional(),
-  default: z15.boolean().optional(),
-  agentId: z15.string().max(128).nullable().optional()
+  scope: z16.enum(["global", "service"]).optional(),
+  immutable: z16.boolean().optional(),
+  default: z16.boolean().optional(),
+  agentId: z16.string().max(128).nullable().optional()
   // null = clear (no default agent)
 });
 
 // ../../packages/shared/src/schemas/environment-overrides.schema.ts
-import { z as z16 } from "zod";
-var EnvironmentOverridesSchema = z16.record(
-  z16.string().max(128),
-  VariableSchema
+import { z as z17 } from "zod";
+var VariableOverrideSchema = z17.object({
+  value: VariableSlotSchema
+});
+var EnvironmentOverridesSchema = z17.record(
+  z17.string().max(128),
+  VariableOverrideSchema
 ).refine(
   (obj) => Object.keys(obj).length <= 5e3,
   { message: "Max 5000 overrides" }
 );
 
 // ../../packages/shared/src/schemas/api-key.schema.ts
-import { z as z17 } from "zod";
-var ApiServiceActionSchema = z17.enum([
+import { z as z18 } from "zod";
+var ApiServiceActionSchema = z18.enum([
   "service:read",
   "service:start",
   "service:stop",
@@ -890,109 +1072,155 @@ var ApiServiceActionSchema = z17.enum([
   "service:status",
   "logs:read"
 ]);
-var ApiEnvActionSchema = z17.enum(["env:read", "env:write"]);
-var ApiEnvPermSchema = z17.object({
-  environmentId: z17.string().max(128),
-  actions: z17.array(ApiEnvActionSchema).max(10).default(["env:read"]),
-  includeSecrets: z17.boolean().default(false)
-});
-var ApiServicePermSchema = z17.object({
-  serviceId: z17.string().max(128),
-  actions: z17.array(ApiServiceActionSchema).max(10).default(["service:read"]),
-  environments: z17.array(ApiEnvPermSchema).max(100).default([])
-});
-var ApiKeyScopeSchema = z17.object({
-  services: z17.array(ApiServicePermSchema).max(500).default([])
-});
-var ApiKeySchema = z17.object({
-  id: z17.string().max(128),
-  name: z17.string().min(1).max(200),
-  key: z17.string().regex(/^[0-9a-f]{64}$/i),
+var ApiEnvActionSchema = z18.enum(["env:read", "env:write"]);
+var ApiEnvPermSchema = z18.object({
+  environmentId: z18.string().max(128),
+  actions: z18.array(ApiEnvActionSchema).max(10).default(["env:read"]),
+  includeSecrets: z18.boolean().default(false)
+});
+var ApiServicePermSchema = z18.object({
+  serviceId: z18.string().max(128),
+  actions: z18.array(ApiServiceActionSchema).max(10).default(["service:read"]),
+  environments: z18.array(ApiEnvPermSchema).max(100).default([])
+});
+var ApiKeyScopeSchema = z18.object({
+  services: z18.array(ApiServicePermSchema).max(500).default([])
+});
+var ApiKeySchema = z18.object({
+  id: z18.string().max(128),
+  name: z18.string().min(1).max(200),
+  key: z18.string().regex(/^[0-9a-f]{64}$/i),
   scopes: ApiKeyScopeSchema,
-  createdAt: z17.string().max(64),
-  isPublic: z17.boolean().default(false)
+  createdAt: z18.string().max(64),
+  isPublic: z18.boolean().default(false)
+});
+var PersistedApiKeySchema = ApiKeySchema.extend({
+  key: z18.string().min(1).max(4096)
 });
-var ApiKeysFileSchema = z17.object({
-  keys: z17.array(ApiKeySchema).max(100)
+var ApiKeysFileSchema = z18.object({
+  keys: z18.array(PersistedApiKeySchema).max(100)
+});
+var MaskedApiKeySchema = ApiKeySchema.omit({ key: true }).extend({
+  /** Last 4 characters of the secret, for recognising a key in a list. */
+  keyPreview: z18.string().max(8)
 });
 
 // ../../packages/shared/src/schemas/image.schema.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 var ALLOWED_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
-var ImagePartSchema = z18.object({
-  type: z18.literal("image"),
-  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  url: z18.string().min(1),
-  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
-  altText: z18.string().max(500).optional()
-});
-var ImageUploadResponseSchema = z18.object({
-  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  url: z18.string().min(1),
-  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
-  originalName: z18.string()
-});
-var ImageMetaSchema = z18.object({
-  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  filePath: z18.string().min(1),
-  mimeType: z18.enum(ALLOWED_IMAGE_MIME_TYPES),
-  originalName: z18.string().min(1),
-  createdAt: z18.number().positive(),
-  size: z18.number().positive().optional()
+var ImagePartSchema = z19.object({
+  type: z19.literal("image"),
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  altText: z19.string().max(500).optional()
+});
+var ImageUploadResponseSchema = z19.object({
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z19.string()
+});
+var ImageMetaSchema = z19.object({
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  filePath: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z19.string().min(1),
+  createdAt: z19.number().positive(),
+  size: z19.number().positive().optional()
 });
 
 // ../../packages/shared/src/schemas/kanban.schema.ts
-import { z as z19 } from "zod";
-var KanbanCardEventSchema = z19.object({
-  type: z19.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment"]),
-  timestamp: z19.string(),
+import { z as z20 } from "zod";
+var KanbanAttachmentSchema = z20.object({
+  /** Server-issued id, also the storage key. */
+  id: z20.string().max(128),
+  name: z20.string().max(255),
+  size: z20.number().int().nonnegative(),
+  contentType: z20.string().max(128)
+});
+var KanbanCardEventSchema = z20.object({
+  type: z20.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment"]),
+  timestamp: z20.string(),
   /** Extra context: old/new column name, old/new title, comment text, etc. */
-  detail: z19.string().max(5e3).optional(),
+  detail: z20.string().max(5e3).optional(),
+  /**
+   * Stable identity of the event, used to tell an edit from an insertion when a
+   * whole history is written back. Absent on events recorded before the field
+   * existed; those fall back to (type, timestamp).
+   */
+  id: z20.string().max(128).optional(),
   /** Who authored this event — 'ai' or 'user'. Only set for comment events. */
-  author: z19.enum(["ai", "user"]).optional(),
+  author: z20.enum(["ai", "user"]).optional(),
+  /**
+   * The human behind a comment, stamped by the server. This is what makes
+   * "my own comment" answerable; `author` only separates AI from human.
+   */
+  authorUser: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional(),
+  /** Set when the author amended their comment, so the UI can say so. */
+  editedAt: z20.string().optional(),
+  /** Files attached to a comment — same storage as a card's own attachments. */
+  attachments: z20.array(KanbanAttachmentSchema).max(20).optional(),
   /** Conversation that produced this event (comments only). Used to navigate back to the conversation. */
-  conversationId: z19.string().optional()
-});
-var KanbanCardSchema = z19.object({
-  id: z19.string(),
-  title: z19.string().min(1).max(500),
-  markdown: z19.string().max(1e5).default(""),
-  /** Base64-encoded image data URIs attached to the card */
-  images: z19.array(z19.string()).default([]),
-  order: z19.number().int(),
-  history: z19.array(KanbanCardEventSchema).default([]),
-  createdAt: z19.string(),
-  updatedAt: z19.string()
-});
-var KanbanColumnSchema = z19.object({
-  id: z19.string(),
-  title: z19.string().min(1).max(200),
-  order: z19.number().int(),
-  cards: z19.array(KanbanCardSchema).default([])
-});
-var KanbanBoardSchema = z19.object({
-  id: z19.string(),
-  name: z19.string().min(1).max(200),
-  description: z19.string().max(1e4).default(""),
-  columns: z19.array(KanbanColumnSchema).default([]),
-  archived: z19.boolean().default(false),
-  createdAt: z19.string(),
-  updatedAt: z19.string()
-});
-var CreateKanbanBoardInput = z19.object({
-  name: z19.string().min(1).max(200),
-  description: z19.string().max(1e4).optional()
-});
-var UpdateKanbanBoardInput = z19.object({
-  id: z19.string(),
-  name: z19.string().min(1).max(200).optional(),
-  description: z19.string().max(1e4).optional(),
-  columns: z19.array(KanbanColumnSchema).optional(),
-  archived: z19.boolean().optional()
+  conversationId: z20.string().optional()
+});
+var KanbanCardSchema = z20.object({
+  id: z20.string(),
+  title: z20.string().min(1).max(500),
+  markdown: z20.string().max(1e5).default(""),
+  /**
+   * Legacy inline images, kept so boards written before object storage still
+   * render. New uploads go to `attachments` instead.
+   */
+  images: z20.array(z20.string()).default([]),
+  /** Files attached to the card — stored out of band, referenced here. */
+  attachments: z20.array(KanbanAttachmentSchema).max(50).default([]),
+  order: z20.number().int(),
+  history: z20.array(KanbanCardEventSchema).default([]),
+  createdAt: z20.string(),
+  updatedAt: z20.string(),
+  /**
+   * People assigned to the card. Names are denormalized for display; the server
+   * keeps only members of the owning organization, and notifies newcomers.
+   */
+  assignees: z20.array(z20.object({ id: z20.string().max(128), name: z20.string().max(200) })).max(20).default([]),
+  /**
+   * Who first created the card. Stamped by the server the first time a card id
+   * appears in a board write, never taken from the client — a member could
+   * otherwise claim any authorship. Absent on cards created before this field
+   * existed, so readers must treat it as unknown rather than assume.
+   */
+  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional()
+});
+var KanbanColumnSchema = z20.object({
+  id: z20.string(),
+  title: z20.string().min(1).max(200),
+  order: z20.number().int(),
+  cards: z20.array(KanbanCardSchema).default([])
+});
+var KanbanBoardSchema = z20.object({
+  id: z20.string(),
+  name: z20.string().min(1).max(200),
+  description: z20.string().max(1e4).default(""),
+  columns: z20.array(KanbanColumnSchema).default([]),
+  archived: z20.boolean().default(false),
+  createdAt: z20.string(),
+  updatedAt: z20.string()
+});
+var CreateKanbanBoardInput = z20.object({
+  name: z20.string().min(1).max(200),
+  description: z20.string().max(1e4).optional()
+});
+var UpdateKanbanBoardInput = z20.object({
+  id: z20.string(),
+  name: z20.string().min(1).max(200).optional(),
+  description: z20.string().max(1e4).optional(),
+  columns: z20.array(KanbanColumnSchema).optional(),
+  archived: z20.boolean().optional()
 });
 
 // ../../packages/shared/src/utils/crypto.ts
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2, pbkdf2Sync } from "crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3, pbkdf2Sync } from "crypto";
 
 // ../../packages/shared/src/native-parsers.ts
 var epoch = /* @__PURE__ */ new Date("2025-01-01T00:00:00Z");
@@ -1072,6 +1300,8 @@ var nativeParsers = [
 // ../../packages/shared/src/js-log-parser.ts
 import vm from "vm";
 var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
+var PARSE_TIMEOUT_MS = 50;
+var MAX_CONSECUTIVE_TIMEOUTS = 10;
 var JSLogParser = class {
   parsers = [];
   constructor(definitions = []) {
@@ -1109,6 +1339,16 @@ var JSLogParser = class {
     }
     return this.sanitize(current);
   }
+  /**
+   * Compile le code utilisateur en une fonction bornée en temps.
+   *
+   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
+   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
+   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
+   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
+   * métriques de *tous* les services. Chaque invocation repasse maintenant par
+   * la vm, avec son propre budget.
+   */
   compileParser(def) {
     const forbidden = ["require(", "import ", "eval("];
     for (const pat of forbidden) {
@@ -1133,17 +1373,44 @@ var JSLogParser = class {
     } catch (err) {
       throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
     let parserFn;
     try {
-      parserFn = script.runInNewContext(sandbox, { timeout: 100 });
+      parserFn = script.runInContext(context, { timeout: 100 });
     } catch (err) {
       throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
     }
     if (typeof parserFn !== "function") {
       throw new Error("Parser code must export a function");
     }
+    context["__parserFn"] = parserFn;
+    const callScript = new vm.Script("__result = __parserFn(__line);", {
+      filename: `parser-${def.id}-call.js`
+    });
+    let consecutiveTimeouts = 0;
+    let disabled = false;
     return (line) => {
-      const result = parserFn(line);
+      if (disabled) return line;
+      const ctx = context;
+      ctx["__line"] = line;
+      ctx["__result"] = null;
+      try {
+        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
+        consecutiveTimeouts = 0;
+      } catch (err) {
+        const e = err;
+        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
+        if (!timedOut) throw err;
+        consecutiveTimeouts += 1;
+        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
+          disabled = true;
+          console.warn(
+            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
+          );
+        }
+        return line;
+      }
+      const result = ctx["__result"];
       if (result === null || result === void 0 || typeof result !== "object") {
         return line;
       }
@@ -1593,7 +1860,7 @@ var EnvironmentStore = class {
     await this.load();
     const parsed = EnvironmentSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
-      console.error(`[environment-store] Rejected remote environment ${id}:`, parsed.error.message);
+      console.error("[environment-store] Rejected remote environment %s:", id, parsed.error.message);
       return { created: false };
     }
     const incoming = parsed.data;
@@ -1842,7 +2109,7 @@ var ServiceStore = class {
     await this.load();
     const parsed = ServiceConfigSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
-      console.error(`[service-store] Rejected remote service ${id}:`, parsed.error.message);
+      console.error("[service-store] Rejected remote service %s:", id, parsed.error.message);
       return { created: false };
     }
     const incoming = parsed.data;
@@ -2343,13 +2610,13 @@ var AgentWSBridge = class extends EventEmitter {
 };
 
 // ../server/src/services/agent-manager.ts
-var HealthMessageSchema = z20.object({
-  status: z20.string(),
-  uptime: z20.number(),
-  runnersAvailable: z20.array(z20.enum(["native", "docker"])),
-  processCount: z20.number(),
-  runningCount: z20.number(),
-  lanIp: z20.string().optional()
+var HealthMessageSchema = z21.object({
+  status: z21.string(),
+  uptime: z21.number(),
+  runnersAvailable: z21.array(z21.enum(["native", "docker"])),
+  processCount: z21.number(),
+  runningCount: z21.number(),
+  lanIp: z21.string().optional()
 });
 var MIN_RECONNECT_DELAY = WS_RECONNECT_MIN;
 var MAX_RECONNECT_DELAY = WS_RECONNECT_MAX;
@@ -2773,6 +3040,19 @@ var AgentManager = class extends EventEmitter2 {
 var agentManager = new AgentManager();
 
 export {
+  env,
+  isCiMode,
+  loadFromEnv,
+  setPendingLegacyKey,
+  getPendingLegacyKey,
+  clearPendingLegacyKey,
+  hasPendingLegacyKey,
+  setEncryptionKeyInMemory,
+  clearEncryptionKey,
+  hasEncryptionKey,
+  getEncryptionKey,
+  ensureEncryptionKey,
+  setEncryptionKey,
   ProjectSchema,
   ScenarioGroupSchema,
   ScenarioNodeSchema,
@@ -2793,9 +3073,9 @@ export {
   VariableSchema,
   CreateEnvironmentSchema,
   UpdateEnvironmentSchema,
+  VariableOverrideSchema,
   ApiKeyScopeSchema,
   ApiKeysFileSchema,
-  KanbanColumnSchema,
   nativeParsers,
   JSLogParser,
   LOG_BUFFER_SIZE,
@@ -2806,6 +3086,13 @@ export {
   getCollection,
   readEntity,
   writeEntity,
+  encryptValue,
+  decryptValue,
+  stableEncryptValue,
+  encryptVariableSlots,
+  decryptVariableSlots,
+  extractEncryptedVariableSlots,
+  isEncryptedValue,
   environmentStore,
   serviceStore,
   agentStore,
@@ -2813,4 +3100,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-PUNE7P6S.js.map
+//# sourceMappingURL=chunk-Y2R42AXQ.js.map