@runeya/runeya 2.0.26 → 2.0.28

package/{src-RMLLDYCE.js → src-ZYEDS2TT.js}

@@ -3440,7 +3440,7 @@ var RUNEYA_CAPABILITIES = [
   },
   {
     name: "kanban_get_board",
-    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count). Use the exact column names it returns when moving or adding a card.",
+    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
     route: "kanban.getBoard",
     method: "GET",
     params: [
@@ -3464,6 +3464,16 @@ var RUNEYA_CAPABILITIES = [
       ...p.limit ? { limit: Number(p.limit) } : {}
     })
   },
+  {
+    name: "kanban_download_attachment",
+    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context or from kanban_get_board.",
+    route: "kanban.downloadAttachment",
+    method: "POST",
+    params: [
+      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true }
+    ],
+    buildInput: (p) => ({ attachmentId: p.attachmentId })
+  },
   {
     name: "kanban_move_card",
     description: "Move a kanban card to another column. Use the exact column name.",
@@ -5571,7 +5581,8 @@ async function cloudFetch(path, init = {}) {
       ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-    signal: AbortSignal.timeout(15e3)
+    // 15s suits a JSON call; attachment downloads pass a longer budget.
+    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
   });
 }
 var PROXY_PREFIXES = ["/organization/", "/project/", "/chat/", "/kanban/", "/user/prefs"];
@@ -5820,6 +5831,11 @@ function addComment(board, cardId, comment, conversationId) {
     }
   }
 }
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} o`;
+  if (bytes < 1024 * 1024) return `${Math.round(bytes / 1024)} Ko`;
+  return `${(bytes / (1024 * 1024)).toFixed(1).replace(".", ",")} Mo`;
+}
 function generateKanbanSystemPrompt(board, cardId) {
   let currentColTitle = "";
   let card = null;
@@ -5857,11 +5873,27 @@ function generateKanbanSystemPrompt(board, cardId) {
       for (const c of comments.slice(-20)) {
         const who = c.author === "ai" ? "AI" : "Utilisateur";
         const date = new Date(c.timestamp).toLocaleString("fr-FR", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" });
-        lines.push(`- **${who}** (${date}) : ${c.detail}`);
+        const files = (c.attachments ?? []).map((f) => `\`${f.id}\` ${f.name}`).join(", ");
+        lines.push(`- **${who}** (${date}) : ${c.detail}${files ? ` \u2014 pi\xE8ces jointes : ${files}` : ""}`);
       }
       lines.push("");
     }
   }
+  if (card) {
+    const files = card.attachments ?? [];
+    const commentFiles = (card.history ?? []).flatMap((e) => e.attachments ?? []);
+    const all = [...files, ...commentFiles];
+    if (all.length > 0) {
+      lines.push(`### Pi\xE8ces jointes disponibles (${all.length})`);
+      lines.push("");
+      for (const f of all) {
+        lines.push(`- \`${f.id}\` \u2014 ${f.name} (${f.contentType}, ${formatSize(f.size)})`);
+      }
+      lines.push("");
+      lines.push("> Ces fichiers ne sont **pas** dans ce prompt. Appelle `kanban_download_attachment(attachmentId)` pour en r\xE9cup\xE9rer un sur le disque, puis ouvre le chemin renvoy\xE9 avec tes outils de lecture de fichiers.");
+      lines.push("");
+    }
+  }
   lines.push("### Outils Kanban disponibles");
   lines.push("");
   lines.push(`- **boardId** (\xE0 passer dans tous les outils) : \`${board.id}\``);
@@ -5870,6 +5902,7 @@ function generateKanbanSystemPrompt(board, cardId) {
   lines.push("Tu disposes des outils suivants pour interagir avec le board :");
   lines.push("- `kanban_move_card(boardId, cardId, targetColumn)` \u2014 D\xE9placer la carte vers une autre colonne");
   lines.push("- `kanban_add_comment(boardId, cardId, comment)` \u2014 Ajouter un commentaire sur la carte");
+  lines.push("- `kanban_download_attachment(attachmentId)` \u2014 T\xE9l\xE9charger une pi\xE8ce jointe et obtenir son chemin local");
   lines.push("");
   lines.push("### OBLIGATOIRE \u2014 D\xE9cision Kanban");
   lines.push("");
@@ -10855,7 +10888,10 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
+import { mkdir as mkdir14, writeFile as writeFile11 } from "fs/promises";
+import { join as join16 } from "path";
 import { z as z20 } from "zod";
+import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -10866,6 +10902,13 @@ function summarizeCard(card, boardId, columnTitle) {
     assignees: (card.assignees ?? []).map((a) => a.name),
     commentCount: (card.history ?? []).filter((e) => e.type === "comment").length,
     attachmentCount: (card.attachments ?? []).length,
+    // Metadata only — the bytes are fetched on demand by `downloadAttachment`.
+    attachments: (card.attachments ?? []).map((f) => ({
+      id: f.id,
+      name: f.name,
+      contentType: f.contentType,
+      size: f.size
+    })),
     createdAt: card.createdAt,
     updatedAt: card.updatedAt
   };
@@ -10887,6 +10930,15 @@ function boardCounts(board) {
 function normalize(value) {
   return value.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
 }
+var ATTACHMENT_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
+var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
+function attachmentCacheDir() {
+  return join16(env.DATA_DIR, "kanban-attachments");
+}
+function safeLocalName(id, name) {
+  const ext = /\.([A-Za-z0-9]{1,12})$/.exec(name)?.[1];
+  return ext ? `${id}.${ext.toLowerCase()}` : id;
+}
 var kanbanRouter = router({
   /**
    * The organization's boards, without their cards — a board carries its whole
@@ -10976,12 +11028,49 @@ var kanbanRouter = router({
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
     ]);
     return { ok: true };
+  }),
+  /**
+   * Fetch one card attachment from the cloud and drop it on this machine, so an
+   * agent can open it with its own file tools. The bytes never go through the
+   * prompt: the card context lists the attachments, this returns a path.
+   */
+  downloadAttachment: protectedProcedure.input(z20.object({ attachmentId: z20.string().max(128) })).mutation(async ({ input }) => {
+    const id = input.attachmentId;
+    if (!ATTACHMENT_ID_REGEX.test(id)) {
+      throw new TRPCError17({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+    }
+    const res = await cloudFetch(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
+    if (res.status === 404) {
+      throw new TRPCError17({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+    }
+    if (!res.ok) {
+      throw new TRPCError17({
+        code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
+        message: `Cloud refused the attachment (HTTP ${res.status})`
+      });
+    }
+    const declared = Number(res.headers.get("content-length") ?? 0);
+    if (declared > MAX_ATTACHMENT_BYTES) {
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+    }
+    const body = Buffer.from(await res.arrayBuffer());
+    if (body.length > MAX_ATTACHMENT_BYTES) {
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+    }
+    const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+    const disposition = res.headers.get("content-disposition") ?? "";
+    const name = /filename="([^"]*)"/.exec(disposition)?.[1] || id;
+    const dir = attachmentCacheDir();
+    await mkdir14(dir, { recursive: true });
+    const path = join16(dir, safeLocalName(id, name));
+    await writeFile11(path, body);
+    return { path, name, contentType, size: body.length };
   })
 });
 
 // ../server/src/trpc/routers/terminal.ts
 import { z as z21 } from "zod";
-import { TRPCError as TRPCError17 } from "@trpc/server";
+import { TRPCError as TRPCError18 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
   create: protectedProcedure.input(z21.object({
@@ -11066,7 +11155,7 @@ var terminalRouter = router({
         }
       );
     } catch (err) {
-      throw new TRPCError17({
+      throw new TRPCError18({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -11101,9 +11190,9 @@ var utilityRouter = router({
 
 // ../server/src/trpc/routers/wiki.ts
 import { z as z23 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
-import { readFile as readFile13, readdir as readdir5, stat as stat3, realpath, writeFile as writeFile11, mkdir as mkdir14, rename as rename10, rm as rm2 } from "fs/promises";
-import { resolve as resolvePath, join as join16, relative, sep as sep3, dirname as dirname3 } from "path";
+import { TRPCError as TRPCError19 } from "@trpc/server";
+import { readFile as readFile13, readdir as readdir5, stat as stat3, realpath, writeFile as writeFile12, mkdir as mkdir15, rename as rename10, rm as rm2 } from "fs/promises";
+import { resolve as resolvePath, join as join17, relative, sep as sep3, dirname as dirname3 } from "path";
 var SCOPE_SCHEMA = z23.union([
   z23.literal("global"),
   z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
@@ -11137,27 +11226,27 @@ async function resolveScope(scope) {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir14(dataDirAbs, { recursive: true });
+    await mkdir15(dataDirAbs, { recursive: true });
     const base = dirname3(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir14(target, { recursive: true });
+    await mkdir15(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep3).startsWith(base + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
   return { mode: "agent", agentId, cwd };
 }
@@ -11173,7 +11262,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join16(dir, e.name);
+    const abs = join17(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -11192,7 +11281,7 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError18({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError19({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
@@ -11200,10 +11289,10 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     try {
       real = await realpath(target);
     } catch {
-      throw new TRPCError18({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError19({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep3).startsWith(root + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
@@ -11215,7 +11304,7 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep3).startsWith(root + sep3)) {
-    throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
@@ -11231,7 +11320,7 @@ var wikiRouter = router({
   }),
   read: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z23.object({ path: z23.string(), content: z23.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -11239,27 +11328,27 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
     const s = await stat3(file);
-    if (!s.isFile()) throw new TRPCError18({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    if (!s.isFile()) throw new TRPCError19({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
     const content = await readFile13(file, "utf-8");
     return { path: input.path, content };
   }),
   write: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z23.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir14(dirname3(file), { recursive: true });
-    await writeFile11(file, input.content, "utf-8");
+    await mkdir15(dirname3(file), { recursive: true });
+    await writeFile12(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
   createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -11268,12 +11357,12 @@ var wikiRouter = router({
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
       await stat3(file);
-      throw new TRPCError18({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      throw new TRPCError19({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
-    await mkdir14(dirname3(file), { recursive: true });
-    await writeFile11(file, "", "utf-8");
+    await mkdir15(dirname3(file), { recursive: true });
+    await writeFile12(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
   createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11282,7 +11371,7 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir14(dir, { recursive: true });
+    await mkdir15(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
   rename: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11294,11 +11383,11 @@ var wikiRouter = router({
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
       await stat3(to);
-      throw new TRPCError18({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      throw new TRPCError19({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
-    await mkdir14(dirname3(to), { recursive: true });
+    await mkdir15(dirname3(to), { recursive: true });
     await rename10(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
@@ -11309,9 +11398,9 @@ var wikiRouter = router({
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
@@ -11321,7 +11410,7 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError18({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    if (fp === target.root) throw new TRPCError19({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
     await rm2(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
@@ -11337,17 +11426,17 @@ var configRouter = router({
 
 // ../server/src/trpc/routers/cloud-sync.ts
 import { z as z24 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 
 // ../server/src/services/cloud-sync-store.ts
-import { readFile as readFile14, writeFile as writeFile12, rename as rename11, mkdir as mkdir15, chmod as chmod9 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile14, writeFile as writeFile13, rename as rename11, mkdir as mkdir16, chmod as chmod9 } from "fs/promises";
+import { join as join18 } from "path";
 var FILENAME5 = "cloud-sync.json";
 var CloudSyncStore = class {
   links = /* @__PURE__ */ new Map();
   loaded = false;
   getFilePath() {
-    return join17(env.DATA_DIR, FILENAME5);
+    return join18(env.DATA_DIR, FILENAME5);
   }
   async load() {
     if (this.loaded) return;
@@ -11360,11 +11449,11 @@ var CloudSyncStore = class {
     this.loaded = true;
   }
   async save() {
-    await mkdir15(env.DATA_DIR, { recursive: true });
+    await mkdir16(env.DATA_DIR, { recursive: true });
     const filePath = this.getFilePath();
     const tmpPath = filePath + ".tmp";
     const data = JSON.stringify(Array.from(this.links.values()), null, 2);
-    await writeFile12(tmpPath, data, "utf-8");
+    await writeFile13(tmpPath, data, "utf-8");
     await rename11(tmpPath, filePath);
     await chmod9(filePath, 384);
   }
@@ -11760,8 +11849,8 @@ var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/master-password.ts
 import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile15, writeFile as writeFile13, chmod as chmod10, stat as stat4, rename as rename12 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile15, writeFile as writeFile14, chmod as chmod10, stat as stat4, rename as rename12 } from "fs/promises";
+import { join as join19 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
 var KEYRING_SERVICE = "runeya";
@@ -11794,7 +11883,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join19(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -11802,9 +11891,9 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join18(dataDir, PEPPER_FILENAME);
+  const filePath = join19(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, pepper.toString("hex"), "utf-8");
+  await writeFile14(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
@@ -11853,14 +11942,14 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, encoded, "utf-8");
+  await writeFile14(tmpPath, encoded, "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
@@ -11880,13 +11969,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, payload.toString("base64"), "utf-8");
+  await writeFile14(tmpPath, payload.toString("base64"), "utf-8");
   await rename12(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
     throw new Error("Cl\xE9 d'encryption incorrecte");
@@ -11902,14 +11991,14 @@ function matchesCanary(canaryBase64, encryptionKey) {
 }
 async function readVerifyFile(dataDir) {
   try {
-    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+    return (await readKeyFile(join19(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
   } catch {
     return null;
   }
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat4(join18(dataDir, VERIFY_FILENAME));
+    await stat4(join19(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11917,7 +12006,7 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat4(join18(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat4(join19(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11928,25 +12017,25 @@ async function hasEncryptedKeyFile(dataDir) {
 async function reconcileOrgCanary(orgId) {
   const key = getEncryptionKey();
   if (!key) {
-    throw new TRPCError19({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
+    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
   }
   const local = await readVerifyFile(env.DATA_DIR);
   if (!local) {
-    throw new TRPCError19({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
+    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
   }
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
     body: { organizationId: orgId, canary: local }
   });
   if (!res.ok) {
-    throw new TRPCError19({ code: "BAD_GATEWAY", message: "Could not reach the organization on the cloud." });
+    throw new TRPCError20({ code: "BAD_GATEWAY", message: "Could not reach the organization on the cloud." });
   }
   const { canary } = await res.json();
   if (typeof canary !== "string") {
-    throw new TRPCError19({ code: "BAD_GATEWAY", message: "The cloud returned no key canary." });
+    throw new TRPCError20({ code: "BAD_GATEWAY", message: "The cloud returned no key canary." });
   }
   if (!matchesCanary(canary, key)) {
-    throw new TRPCError19({
+    throw new TRPCError20({
       code: "FORBIDDEN",
       message: "This organization uses a different encryption key. Ask a member for the key already in use, then set it up on this machine before syncing."
     });
@@ -12051,7 +12140,7 @@ var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
 import { chmod as chmod11, stat as stat5 } from "fs/promises";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -12063,7 +12152,7 @@ var SENSITIVE_FILES = [
 var SECURE_MODE = 384;
 async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
-    const filepath = join19(env.DATA_DIR, filename);
+    const filepath = join20(env.DATA_DIR, filename);
     try {
       const stats = await stat5(filepath);
       const mode = stats.mode & 511;
@@ -12080,8 +12169,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/utils/ensure-data-gitignore.ts
-import { writeFile as writeFile14 } from "fs/promises";
-import { join as join20 } from "path";
+import { writeFile as writeFile15 } from "fs/promises";
+import { join as join21 } from "path";
 var GITIGNORE_CONTENT = `
 #################
 # Do not edit this file #
@@ -12118,8 +12207,8 @@ conversations.private.json
 *.log.*
 `;
 async function ensureDataGitignore(dataDir) {
-  const gitignorePath = join20(dataDir, ".gitignore");
-  await writeFile14(gitignorePath, GITIGNORE_CONTENT, "utf-8");
+  const gitignorePath = join21(dataDir, ".gitignore");
+  await writeFile15(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 
 // ../server/src/migrations/migrate-from-legacy.ts
@@ -12128,13 +12217,13 @@ import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createD
 import { randomUUID as randomUUID12 } from "crypto";
 import {
   readFile as readFile16,
-  writeFile as writeFile15,
+  writeFile as writeFile16,
   rename as rename13,
-  mkdir as mkdir16,
+  mkdir as mkdir17,
   access as access2,
   readdir as readdir6
 } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -12263,14 +12352,14 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile15(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await writeFile16(tmp, JSON.stringify(data, null, 2), "utf-8");
   await rename13(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const { resolve: resolve6 } = await import("path");
   const abCwd = resolve6(process.cwd());
-  const legacyRoot = join21(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join21(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = join22(abCwd, env.DATA_DIR);
+  const legacyKeyPath = join22(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -12278,20 +12367,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join21(abCwd, ".runeya-tmp");
+  const legacyTmp = join22(abCwd, ".runeya-tmp");
   await rename13(legacyRoot, legacyTmp);
-  await mkdir16(dataDir, { recursive: true });
-  const legacyOld = join21(dataDir, `backup-${timestamp}`);
+  await mkdir17(dataDir, { recursive: true });
+  const legacyOld = join22(dataDir, `backup-${timestamp}`);
   await rename13(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile16(join21(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile16(join22(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join21(legacyOld, "dbs");
+  const dbsDir = join22(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -12300,29 +12389,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join21(dbsDir, "envs");
+  const envsDir = join22(dbsDir, "envs");
   const envFiles = (await readdir6(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join21(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join22(envsDir, file));
   }
-  const servicesDir = join21(dbsDir, "services");
+  const servicesDir = join22(dbsDir, "services");
   const serviceFiles = (await readdir6(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join21(servicesDir, file));
+    const data = await readEncrypted(join22(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join21(dbsDir, "overrides");
+  const overridesDir = join22(dbsDir, "overrides");
   const overrideFiles = (await readdir6(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join21(overridesDir, file));
+    const data = await readEncrypted(join22(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -12330,11 +12419,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join21(dbsDir, "parsers");
+  const parsersDir = join22(dbsDir, "parsers");
   const parserFiles = (await readdir6(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join21(parsersDir, file));
+    const data = await readEncrypted(join22(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -12675,7 +12764,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile16(join21(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile16(join22(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -12696,11 +12785,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join21(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join21(dataDir, "services.json"), runeServices);
-  await atomicWrite(join21(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join21(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join21(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join22(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join22(dataDir, "services.json"), runeServices);
+  await atomicWrite(join22(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join22(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join22(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -12714,7 +12803,7 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries = await readdir6(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join21(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join22(dataDir, dir, "dbs", "encryption-key.json");
       try {
         const raw = await readFile16(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
@@ -12738,8 +12827,8 @@ async function runOverrideOnlyMigration(dataDir) {
   const abDataDir = resolve6(dataDir);
   const abCwd = resolve6(process.cwd());
   const candidateDirs = [
-    join21(abCwd, ".runeya", "dbs", "overrides"),
-    join21(abDataDir, "dbs", "overrides")
+    join22(abCwd, ".runeya", "dbs", "overrides"),
+    join22(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -12755,7 +12844,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join21(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join22(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -12773,7 +12862,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile16(join21(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile16(join22(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -12792,7 +12881,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile16(join21(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile16(join22(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -12809,7 +12898,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -12836,7 +12925,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join21(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join22(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -12846,7 +12935,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -12905,7 +12994,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join21(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join22(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -12920,7 +13009,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 import { stat as stat6 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -12930,17 +13019,17 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat6(join22(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat6(join23(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat6(join22(dataDir, VERIFY_FILENAME2));
+    await stat6(join23(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat6(join22(dataDir, "projects.json"));
+    await stat6(join23(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
@@ -13232,7 +13321,7 @@ function getOpenApiDocument() {
 // ../server/src/create-server.ts
 import rateLimit from "express-rate-limit";
 import { existsSync as existsSync2, createReadStream } from "fs";
-import { mkdir as mkdir17 } from "fs/promises";
+import { mkdir as mkdir18 } from "fs/promises";
 import multer from "multer";
 
 // ../server/src/services/image-cleanup.service.ts
@@ -13338,7 +13427,7 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  if (!existsSync2(env.DATA_DIR)) await mkdir17(env.DATA_DIR);
+  if (!existsSync2(env.DATA_DIR)) await mkdir18(env.DATA_DIR);
   const absoluteDataDir = resolve5(env.DATA_DIR);
   console.log(`[server] Data directory: ${absoluteDataDir}`);
   await ensureDataGitignore(env.DATA_DIR);
@@ -14090,4 +14179,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-RMLLDYCE.js.map
+//# sourceMappingURL=src-ZYEDS2TT.js.map