@runeya/runeya 2.0.27 → 2.0.29

package/{src-RMLLDYCE.js → src-W64XJTN5.js}

@@ -58,7 +58,7 @@ import {
   stableEncryptValue,
   traefikManager,
   writeEntity
-} from "./chunk-Y2R42AXQ.js";
+} from "./chunk-PZHVJHTC.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -3440,7 +3440,7 @@ var RUNEYA_CAPABILITIES = [
   },
   {
     name: "kanban_get_board",
-    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count). Use the exact column names it returns when moving or adding a card.",
+    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
     route: "kanban.getBoard",
     method: "GET",
     params: [
@@ -3464,6 +3464,16 @@ var RUNEYA_CAPABILITIES = [
       ...p.limit ? { limit: Number(p.limit) } : {}
     })
   },
+  {
+    name: "kanban_download_attachment",
+    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context or from kanban_get_board.",
+    route: "kanban.downloadAttachment",
+    method: "POST",
+    params: [
+      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true }
+    ],
+    buildInput: (p) => ({ attachmentId: p.attachmentId })
+  },
   {
     name: "kanban_move_card",
     description: "Move a kanban card to another column. Use the exact column name.",
@@ -5571,7 +5581,8 @@ async function cloudFetch(path, init = {}) {
       ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-    signal: AbortSignal.timeout(15e3)
+    // 15s suits a JSON call; attachment downloads pass a longer budget.
+    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
   });
 }
 var PROXY_PREFIXES = ["/organization/", "/project/", "/chat/", "/kanban/", "/user/prefs"];
@@ -5676,10 +5687,54 @@ var KanbanStore = class {
     const res = await callCloud(`/kanban/board/list${query}`);
     return res.data?.boards ?? [];
   }
-  async get(id) {
-    const res = await callCloud(`/kanban/board/get?id=${encodeURIComponent(id)}`);
+  /**
+   * Un tableau. Sans les journaux de ses cartes par défaut : c'est la moitié
+   * lourde du document, et presque aucun appelant n'en a besoin — un agent qui
+   * liste des cartes ne lit pas les commentaires. `withHistory` les redemande
+   * pour les rares cas qui les veulent tous d'un coup.
+   */
+  async get(id, opts = {}) {
+    const query = `?id=${encodeURIComponent(id)}${opts.withHistory ? "&withHistory=true" : ""}`;
+    const res = await callCloud(`/kanban/board/get${query}`);
     return res.data?.board ?? null;
   }
+  /** Le journal d'une seule carte — ce que le contexte d'un agent demande. */
+  async cardHistory(boardId, cardId) {
+    const res = await callCloud(
+      `/kanban/card/history?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`
+    );
+    return res.data?.history ?? [];
+  }
+  /**
+   * Commenter une carte, sans réécrire le tableau.
+   *
+   * C'est le geste que l'IA répète le plus, et souvent avec de longs textes :
+   * le faire passer par une sauvegarde de tableau faisait transiter tout le
+   * graphe de cartes à chaque phrase.
+   */
+  async addComment(boardId, cardId, detail, conversationId) {
+    const res = await callCloud("/kanban/card/comment/add", {
+      method: "POST",
+      body: { boardId, cardId, detail, author: "ai", ...conversationId ? { conversationId } : {} }
+    });
+    return res.ok;
+  }
+  /** Poser une entrée de journal non-commentaire (une conversation qui s'ouvre). */
+  async addCardEvent(boardId, cardId, type, detail) {
+    const res = await callCloud("/kanban/card/event/add", {
+      method: "POST",
+      body: { boardId, cardId, type, detail }
+    });
+    return res.ok;
+  }
+  /** Déplacer une carte, sans réécrire le tableau. */
+  async moveCard(boardId, cardId, toColumnId) {
+    const res = await callCloud("/kanban/card/move", {
+      method: "POST",
+      body: { boardId, cardId, toColumnId }
+    });
+    return res.ok;
+  }
   async create(input) {
     const organizationId = await resolveOrganizationId();
     if (!organizationId) return null;
@@ -5728,17 +5783,27 @@ async function executeKanbanCommands(boardId, cardId, commands, conversationId)
       return;
     }
   }
+  let pendingBoardWrite = false;
   for (const cmd of commands) {
     if (cmd.type === "move_card" && cmd.columnTitle) {
-      const moved = moveCard(board, cardId, cmd.columnTitle);
-      if (!moved) console.warn(`[kanban-commands] move_card failed: card=${cardId} target="${cmd.columnTitle}"`);
+      const target = board.columns.find(
+        (c) => c.title.toLowerCase() === cmd.columnTitle.toLowerCase()
+      );
+      if (!target) {
+        console.warn(`[kanban-commands] Target column "${cmd.columnTitle}" not found. Available: ${board.columns.map((c) => c.title).join(", ")}`);
+        continue;
+      }
+      const ok = await kanbanStore.moveCard(board.id, cardId, target.id);
+      if (!ok) console.warn(`[kanban-commands] move_card failed: card=${cardId} target="${cmd.columnTitle}"`);
     } else if (cmd.type === "add_comment" && cmd.comment) {
-      addComment(board, cardId, cmd.comment, conversationId);
+      const ok = await kanbanStore.addComment(board.id, cardId, cmd.comment, conversationId);
+      if (!ok) console.warn(`[kanban-commands] add_comment failed: card=${cardId}`);
     } else if (cmd.type === "add_card" && cmd.columnTitle && cmd.cardTitle) {
       addCardToColumn(board, cmd.columnTitle, cmd.cardTitle, cmd.cardContent);
+      pendingBoardWrite = true;
     }
   }
-  await kanbanStore.update({ id: board.id, columns: board.columns });
+  if (pendingBoardWrite) await kanbanStore.update({ id: board.id, columns: board.columns });
 }
 async function executeKanbanBoardCommands(boardId, commands) {
   if (commands.length === 0) return;
@@ -5751,43 +5816,6 @@ async function executeKanbanBoardCommands(boardId, commands) {
   }
   await kanbanStore.update({ id: board.id, columns: board.columns });
 }
-function moveCard(board, cardId, targetColTitle) {
-  let sourceCol = "";
-  let card = null;
-  let sourceColIdx = -1;
-  let cardIdx = -1;
-  for (let ci = 0; ci < board.columns.length; ci++) {
-    const col = board.columns[ci];
-    const idx = col.cards.findIndex((c) => c.id === cardId);
-    if (idx !== -1) {
-      sourceCol = col.title;
-      card = col.cards[idx];
-      sourceColIdx = ci;
-      cardIdx = idx;
-      break;
-    }
-  }
-  if (!card || sourceColIdx === -1) return false;
-  const targetCol = board.columns.find(
-    (c) => c.title.toLowerCase() === targetColTitle.toLowerCase()
-  );
-  if (!targetCol) {
-    console.warn(`[kanban-commands] Target column "${targetColTitle}" not found. Available: ${board.columns.map((c) => c.title).join(", ")}`);
-    return false;
-  }
-  if (targetCol.id === board.columns[sourceColIdx].id) return true;
-  board.columns[sourceColIdx].cards.splice(cardIdx, 1);
-  card.order = targetCol.cards.length;
-  card.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  card.history = [...card.history ?? [], {
-    type: "moved",
-    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    detail: `"${sourceCol}" \u2192 "${targetCol.title}"`,
-    author: "ai"
-  }];
-  targetCol.cards.push(card);
-  return true;
-}
 function addCardToColumn(board, columnTitle, cardTitle, cardContent) {
   const col = board.columns.find((c) => c.title.toLowerCase() === columnTitle.toLowerCase());
   if (!col) return;
@@ -5804,23 +5832,12 @@ function addCardToColumn(board, columnTitle, cardTitle, cardContent) {
   };
   col.cards.push(card);
 }
-function addComment(board, cardId, comment, conversationId) {
-  for (const col of board.columns) {
-    const card = col.cards.find((c) => c.id === cardId);
-    if (card) {
-      card.history = [...card.history ?? [], {
-        type: "comment",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        detail: comment,
-        author: "ai",
-        ...conversationId ? { conversationId } : {}
-      }];
-      card.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-      return;
-    }
-  }
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} o`;
+  if (bytes < 1024 * 1024) return `${Math.round(bytes / 1024)} Ko`;
+  return `${(bytes / (1024 * 1024)).toFixed(1).replace(".", ",")} Mo`;
 }
-function generateKanbanSystemPrompt(board, cardId) {
+function generateKanbanSystemPrompt(board, cardId, history) {
   let currentColTitle = "";
   let card = null;
   for (const col of board.columns) {
@@ -5850,16 +5867,33 @@ function generateKanbanSystemPrompt(board, cardId) {
   }
   lines.push("");
   if (card) {
-    const comments = (card.history ?? []).filter((e) => e.type === "comment");
+    const events = history ?? card.history ?? [];
+    const comments = events.filter((e) => e.type === "comment");
     if (comments.length > 0) {
       lines.push("### Commentaires existants sur cette carte :");
       lines.push("");
       for (const c of comments.slice(-20)) {
         const who = c.author === "ai" ? "AI" : "Utilisateur";
         const date = new Date(c.timestamp).toLocaleString("fr-FR", { day: "numeric", month: "short", hour: "2-digit", minute: "2-digit" });
-        lines.push(`- **${who}** (${date}) : ${c.detail}`);
+        const files = (c.attachments ?? []).map((f) => `\`${f.id}\` ${f.name}`).join(", ");
+        lines.push(`- **${who}** (${date}) : ${c.detail}${files ? ` \u2014 pi\xE8ces jointes : ${files}` : ""}`);
+      }
+      lines.push("");
+    }
+  }
+  if (card) {
+    const files = card.attachments ?? [];
+    const commentFiles = (history ?? card.history ?? []).flatMap((e) => e.attachments ?? []);
+    const all = [...files, ...commentFiles];
+    if (all.length > 0) {
+      lines.push(`### Pi\xE8ces jointes disponibles (${all.length})`);
+      lines.push("");
+      for (const f of all) {
+        lines.push(`- \`${f.id}\` \u2014 ${f.name} (${f.contentType}, ${formatSize(f.size)})`);
       }
       lines.push("");
+      lines.push("> Ces fichiers ne sont **pas** dans ce prompt. Appelle `kanban_download_attachment(attachmentId)` pour en r\xE9cup\xE9rer un sur le disque, puis ouvre le chemin renvoy\xE9 avec tes outils de lecture de fichiers.");
+      lines.push("");
     }
   }
   lines.push("### Outils Kanban disponibles");
@@ -5870,6 +5904,7 @@ function generateKanbanSystemPrompt(board, cardId) {
   lines.push("Tu disposes des outils suivants pour interagir avec le board :");
   lines.push("- `kanban_move_card(boardId, cardId, targetColumn)` \u2014 D\xE9placer la carte vers une autre colonne");
   lines.push("- `kanban_add_comment(boardId, cardId, comment)` \u2014 Ajouter un commentaire sur la carte");
+  lines.push("- `kanban_download_attachment(attachmentId)` \u2014 T\xE9l\xE9charger une pi\xE8ce jointe et obtenir son chemin local");
   lines.push("");
   lines.push("### OBLIGATOIRE \u2014 D\xE9cision Kanban");
   lines.push("");
@@ -6096,7 +6131,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2P4THUVA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -6749,7 +6784,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2P4THUVA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7433,7 +7468,13 @@ async function buildCliSystemContext(conv, jwt) {
   if (conv?.kanbanBoardId) {
     const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
     if (kanbanBoard) {
-      systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
+      systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(
+        kanbanBoard,
+        conv.kanbanCardId,
+        // Le journal ne vient plus avec le tableau : le contexte de l'agent
+        // le demande pour la seule carte qui le concerne.
+        await kanbanStore.cardHistory(kanbanBoard.id, conv.kanbanCardId)
+      ) : generateKanbanPopulatePrompt(kanbanBoard));
     }
   }
   return systemContext;
@@ -7834,7 +7875,13 @@ ${input.prompt}` : input.prompt;
     if (conv.kanbanBoardId) {
       const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
       if (kanbanBoard) {
-        systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
+        systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(
+          kanbanBoard,
+          conv.kanbanCardId,
+          // Le journal ne vient plus avec le tableau : le contexte de l'agent
+          // le demande pour la seule carte qui le concerne.
+          await kanbanStore.cardHistory(kanbanBoard.id, conv.kanbanCardId)
+        ) : generateKanbanPopulatePrompt(kanbanBoard));
       }
     }
     const mcpServerPath = fileURLToPath(new URL("../mcp-server/index.js", import.meta.url));
@@ -7949,7 +7996,13 @@ ${input.prompt}` : input.prompt;
     if (conv.kanbanBoardId) {
       const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
       if (kanbanBoard) {
-        systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
+        systemContext += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(
+          kanbanBoard,
+          conv.kanbanCardId,
+          // Le journal ne vient plus avec le tableau : le contexte de l'agent
+          // le demande pour la seule carte qui le concerne.
+          await kanbanStore.cardHistory(kanbanBoard.id, conv.kanbanCardId)
+        ) : generateKanbanPopulatePrompt(kanbanBoard));
       }
     }
     const resolvedImages = input.imageIds && input.imageIds.length > 0 ? await resolveImagesToBase64(input.imageIds.map((id) => ({ imageId: id, mimeType: "" })), input.conversationId) : [];
@@ -8042,7 +8095,13 @@ ${input.prompt}` : input.prompt;
     if (conv && conv.kanbanBoardId) {
       const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
       if (kanbanBoard) {
-        system += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
+        system += "\n\n" + (conv.kanbanCardId ? generateKanbanSystemPrompt(
+          kanbanBoard,
+          conv.kanbanCardId,
+          // Le journal ne vient plus avec le tableau : le contexte de l'agent
+          // le demande pour la seule carte qui le concerne.
+          await kanbanStore.cardHistory(kanbanBoard.id, conv.kanbanCardId)
+        ) : generateKanbanPopulatePrompt(kanbanBoard));
       }
     }
     const resolvedImages = input.imageIds && input.imageIds.length > 0 ? await resolveImagesToBase64(input.imageIds.map((id) => ({ imageId: id, mimeType: "" })), input.conversationId) : [];
@@ -10736,19 +10795,8 @@ var KanbanQueueService = class extends EventEmitter4 {
     this.running.push(runItem);
     this.emit("changed");
     const eventType = item.scenarioId ? "scenario_started" : "conversation_started";
-    for (const col of board.columns) {
-      const target = col.cards.find((c) => c.id === item.cardId);
-      if (target) {
-        target.history = [...target.history ?? [], {
-          type: eventType,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          detail: conv.id
-        }];
-        kanbanStore.update({ id: board.id, columns: board.columns }).catch(() => {
-        });
-        break;
-      }
-    }
+    kanbanStore.addCardEvent(board.id, item.cardId, eventType, conv.id).catch(() => {
+    });
     if (item.scenarioId) {
       void runScenario(conv.id, item.scenarioId, cardContent, {
         runnerOverride: item.runner,
@@ -10855,7 +10903,12 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
+import { mkdir as mkdir14, readdir as readdir5, rm as rm2, stat as stat3, writeFile as writeFile11 } from "fs/promises";
+import { createHash } from "crypto";
+import { tmpdir } from "os";
+import { join as join16 } from "path";
 import { z as z20 } from "zod";
+import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -10864,8 +10917,15 @@ function summarizeCard(card, boardId, columnTitle) {
     title: card.title,
     markdown: card.markdown ?? "",
     assignees: (card.assignees ?? []).map((a) => a.name),
-    commentCount: (card.history ?? []).filter((e) => e.type === "comment").length,
+    commentCount: card.commentCount ?? (card.history ?? []).filter((e) => e.type === "comment").length,
     attachmentCount: (card.attachments ?? []).length,
+    // Metadata only — the bytes are fetched on demand by `downloadAttachment`.
+    attachments: (card.attachments ?? []).map((f) => ({
+      id: f.id,
+      name: f.name,
+      contentType: f.contentType,
+      size: f.size
+    })),
     createdAt: card.createdAt,
     updatedAt: card.updatedAt
   };
@@ -10887,6 +10947,49 @@ function boardCounts(board) {
 function normalize(value) {
   return value.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
 }
+var ATTACHMENT_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
+var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
+function attachmentCacheDir() {
+  return join16(tmpdir(), "runeya-kanban-attachments");
+}
+var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
+  try {
+    const cutoff = Date.now() - ttlMs;
+    for (const name of await readdir5(dir)) {
+      const path = join16(dir, name);
+      const info = await stat3(path).catch(() => null);
+      if (info && info.mtimeMs < cutoff) await rm2(path, { force: true });
+    }
+  } catch {
+  }
+}
+function attachmentCacheDirs() {
+  return [attachmentCacheDir(), join16(env.DATA_DIR, "kanban-attachments")];
+}
+async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
+  const refusals = [];
+  for (const dir of dirs) {
+    try {
+      await mkdir14(dir, { recursive: true });
+      const path = join16(dir, safeLocalName(id, name));
+      await writeFile11(path, body);
+      void purgeStaleAttachments(dir);
+      return path;
+    } catch (err) {
+      refusals.push(`${dir} (${err instanceof Error ? err.message : String(err)})`);
+    }
+  }
+  throw new TRPCError17({
+    code: "INTERNAL_SERVER_ERROR",
+    message: `Impossible d'\xE9crire la pi\xE8ce jointe sur cette machine. Emplacements essay\xE9s : ${refusals.join(" ; ")}. V\xE9rifiez les droits d'\xE9criture, ou l'espace disque.`
+  });
+}
+function safeLocalName(id, name) {
+  const base = createHash("sha256").update(id).digest("hex").slice(0, 32);
+  const ext = /\.([A-Za-z0-9]{1,12})$/.exec(name)?.[1];
+  return ext ? `${base}.${ext.toLowerCase()}` : base;
+}
 var kanbanRouter = router({
   /**
    * The organization's boards, without their cards — a board carries its whole
@@ -10976,12 +11079,46 @@ var kanbanRouter = router({
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
     ]);
     return { ok: true };
+  }),
+  /**
+   * Fetch one card attachment from the cloud and drop it on this machine, so an
+   * agent can open it with its own file tools. The bytes never go through the
+   * prompt: the card context lists the attachments, this returns a path.
+   */
+  downloadAttachment: protectedProcedure.input(z20.object({ attachmentId: z20.string().max(128) })).mutation(async ({ input }) => {
+    const id = input.attachmentId;
+    if (!ATTACHMENT_ID_REGEX.test(id)) {
+      throw new TRPCError17({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+    }
+    const res = await cloudFetch(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
+    if (res.status === 404) {
+      throw new TRPCError17({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+    }
+    if (!res.ok) {
+      throw new TRPCError17({
+        code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
+        message: `Cloud refused the attachment (HTTP ${res.status})`
+      });
+    }
+    const declared = Number(res.headers.get("content-length") ?? 0);
+    if (declared > MAX_ATTACHMENT_BYTES) {
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+    }
+    const body = Buffer.from(await res.arrayBuffer());
+    if (body.length > MAX_ATTACHMENT_BYTES) {
+      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+    }
+    const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+    const disposition = res.headers.get("content-disposition") ?? "";
+    const name = /filename="([^"]*)"/.exec(disposition)?.[1] || id;
+    const path = await storeAttachment(id, name, body);
+    return { path, name, contentType, size: body.length };
   })
 });
 
 // ../server/src/trpc/routers/terminal.ts
 import { z as z21 } from "zod";
-import { TRPCError as TRPCError17 } from "@trpc/server";
+import { TRPCError as TRPCError18 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
   create: protectedProcedure.input(z21.object({
@@ -11066,7 +11203,7 @@ var terminalRouter = router({
         }
       );
     } catch (err) {
-      throw new TRPCError17({
+      throw new TRPCError18({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -11101,9 +11238,9 @@ var utilityRouter = router({
 
 // ../server/src/trpc/routers/wiki.ts
 import { z as z23 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
-import { readFile as readFile13, readdir as readdir5, stat as stat3, realpath, writeFile as writeFile11, mkdir as mkdir14, rename as rename10, rm as rm2 } from "fs/promises";
-import { resolve as resolvePath, join as join16, relative, sep as sep3, dirname as dirname3 } from "path";
+import { TRPCError as TRPCError19 } from "@trpc/server";
+import { readFile as readFile13, readdir as readdir6, stat as stat4, realpath, writeFile as writeFile12, mkdir as mkdir15, rename as rename10, rm as rm3 } from "fs/promises";
+import { resolve as resolvePath, join as join17, relative, sep as sep3, dirname as dirname3 } from "path";
 var SCOPE_SCHEMA = z23.union([
   z23.literal("global"),
   z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
@@ -11137,27 +11274,27 @@ async function resolveScope(scope) {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir14(dataDirAbs, { recursive: true });
+    await mkdir15(dataDirAbs, { recursive: true });
     const base = dirname3(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir14(target, { recursive: true });
+    await mkdir15(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep3).startsWith(base + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
   return { mode: "agent", agentId, cwd };
 }
@@ -11165,7 +11302,7 @@ async function walkLocal(root, dir, depth, counter) {
   if (depth > MAX_DEPTH || counter.n >= MAX_FILES) return [];
   let entries;
   try {
-    entries = await readdir5(dir, { withFileTypes: true });
+    entries = await readdir6(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -11173,7 +11310,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join16(dir, e.name);
+    const abs = join17(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -11192,7 +11329,7 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError18({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError19({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
@@ -11200,10 +11337,10 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     try {
       real = await realpath(target);
     } catch {
-      throw new TRPCError18({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError19({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep3).startsWith(root + sep3)) {
-      throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
@@ -11215,7 +11352,7 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep3).startsWith(root + sep3)) {
-    throw new TRPCError18({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
@@ -11231,35 +11368,35 @@ var wikiRouter = router({
   }),
   read: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z23.object({ path: z23.string(), content: z23.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.readRepoMarkdown", { cwd: target.cwd, path: input.path });
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
-    const s = await stat3(file);
-    if (!s.isFile()) throw new TRPCError18({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    const s = await stat4(file);
+    if (!s.isFile()) throw new TRPCError19({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
     const content = await readFile13(file, "utf-8");
     return { path: input.path, content };
   }),
   write: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z23.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir14(dirname3(file), { recursive: true });
-    await writeFile11(file, input.content, "utf-8");
+    await mkdir15(dirname3(file), { recursive: true });
+    await writeFile12(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
   createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -11267,13 +11404,13 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
-      await stat3(file);
-      throw new TRPCError18({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      await stat4(file);
+      throw new TRPCError19({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
-    await mkdir14(dirname3(file), { recursive: true });
-    await writeFile11(file, "", "utf-8");
+    await mkdir15(dirname3(file), { recursive: true });
+    await writeFile12(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
   createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11282,7 +11419,7 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir14(dir, { recursive: true });
+    await mkdir15(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
   rename: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11293,12 +11430,12 @@ var wikiRouter = router({
     const from = await resolveSafeLocal(target.root, input.fromPath, true);
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
-      await stat3(to);
-      throw new TRPCError18({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      await stat4(to);
+      throw new TRPCError19({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError18) throw err;
+      if (err instanceof TRPCError19) throw err;
     }
-    await mkdir14(dirname3(to), { recursive: true });
+    await mkdir15(dirname3(to), { recursive: true });
     await rename10(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
@@ -11309,9 +11446,9 @@ var wikiRouter = router({
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError18({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError18({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
@@ -11321,8 +11458,8 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError18({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
-    await rm2(fp, { recursive: true, force: true });
+    if (fp === target.root) throw new TRPCError19({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    await rm3(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
 });
@@ -11337,17 +11474,17 @@ var configRouter = router({
 
 // ../server/src/trpc/routers/cloud-sync.ts
 import { z as z24 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 
 // ../server/src/services/cloud-sync-store.ts
-import { readFile as readFile14, writeFile as writeFile12, rename as rename11, mkdir as mkdir15, chmod as chmod9 } from "fs/promises";
-import { join as join17 } from "path";
+import { readFile as readFile14, writeFile as writeFile13, rename as rename11, mkdir as mkdir16, chmod as chmod9 } from "fs/promises";
+import { join as join18 } from "path";
 var FILENAME5 = "cloud-sync.json";
 var CloudSyncStore = class {
   links = /* @__PURE__ */ new Map();
   loaded = false;
   getFilePath() {
-    return join17(env.DATA_DIR, FILENAME5);
+    return join18(env.DATA_DIR, FILENAME5);
   }
   async load() {
     if (this.loaded) return;
@@ -11360,11 +11497,11 @@ var CloudSyncStore = class {
     this.loaded = true;
   }
   async save() {
-    await mkdir15(env.DATA_DIR, { recursive: true });
+    await mkdir16(env.DATA_DIR, { recursive: true });
     const filePath = this.getFilePath();
     const tmpPath = filePath + ".tmp";
     const data = JSON.stringify(Array.from(this.links.values()), null, 2);
-    await writeFile12(tmpPath, data, "utf-8");
+    await writeFile13(tmpPath, data, "utf-8");
     await rename11(tmpPath, filePath);
     await chmod9(filePath, 384);
   }
@@ -11760,8 +11897,8 @@ var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/master-password.ts
 import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile15, writeFile as writeFile13, chmod as chmod10, stat as stat4, rename as rename12 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile15, writeFile as writeFile14, chmod as chmod10, stat as stat5, rename as rename12 } from "fs/promises";
+import { join as join19 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
 var KEYRING_SERVICE = "runeya";
@@ -11773,7 +11910,7 @@ var CANARY_PLAINTEXT = "runeya:v1:key-verification";
 var MAX_KEY_FILE_SIZE = 1024;
 var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32 };
 async function readKeyFile(filePath) {
-  const s = await stat4(filePath);
+  const s = await stat5(filePath);
   if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
   return readFile15(filePath);
 }
@@ -11794,7 +11931,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join19(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -11802,9 +11939,9 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join18(dataDir, PEPPER_FILENAME);
+  const filePath = join19(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, pepper.toString("hex"), "utf-8");
+  await writeFile14(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
@@ -11853,14 +11990,14 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, encoded, "utf-8");
+  await writeFile14(tmpPath, encoded, "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
@@ -11880,13 +12017,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile13(tmpPath, payload.toString("base64"), "utf-8");
+  await writeFile14(tmpPath, payload.toString("base64"), "utf-8");
   await rename12(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
     throw new Error("Cl\xE9 d'encryption incorrecte");
@@ -11902,14 +12039,14 @@ function matchesCanary(canaryBase64, encryptionKey) {
 }
 async function readVerifyFile(dataDir) {
   try {
-    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+    return (await readKeyFile(join19(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
   } catch {
     return null;
   }
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat4(join18(dataDir, VERIFY_FILENAME));
+    await stat5(join19(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11917,7 +12054,7 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat4(join18(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat5(join19(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
@@ -11928,25 +12065,25 @@ async function hasEncryptedKeyFile(dataDir) {
 async function reconcileOrgCanary(orgId) {
   const key = getEncryptionKey();
   if (!key) {
-    throw new TRPCError19({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
+    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
   }
   const local = await readVerifyFile(env.DATA_DIR);
   if (!local) {
-    throw new TRPCError19({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
+    throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
   }
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
     body: { organizationId: orgId, canary: local }
   });
   if (!res.ok) {
-    throw new TRPCError19({ code: "BAD_GATEWAY", message: "Could not reach the organization on the cloud." });
+    throw new TRPCError20({ code: "BAD_GATEWAY", message: "Could not reach the organization on the cloud." });
   }
   const { canary } = await res.json();
   if (typeof canary !== "string") {
-    throw new TRPCError19({ code: "BAD_GATEWAY", message: "The cloud returned no key canary." });
+    throw new TRPCError20({ code: "BAD_GATEWAY", message: "The cloud returned no key canary." });
   }
   if (!matchesCanary(canary, key)) {
-    throw new TRPCError19({
+    throw new TRPCError20({
       code: "FORBIDDEN",
       message: "This organization uses a different encryption key. Ask a member for the key already in use, then set it up on this machine before syncing."
     });
@@ -12050,8 +12187,8 @@ var MigrationEngine = class {
 var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
-import { chmod as chmod11, stat as stat5 } from "fs/promises";
-import { join as join19 } from "path";
+import { chmod as chmod11, stat as stat6 } from "fs/promises";
+import { join as join20 } from "path";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -12063,9 +12200,9 @@ var SENSITIVE_FILES = [
 var SECURE_MODE = 384;
 async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
-    const filepath = join19(env.DATA_DIR, filename);
+    const filepath = join20(env.DATA_DIR, filename);
     try {
-      const stats = await stat5(filepath);
+      const stats = await stat6(filepath);
       const mode = stats.mode & 511;
       if (mode !== SECURE_MODE) {
         console.warn("[security] File", filename, "has mode", mode.toString(8) + ", fixing to 600");
@@ -12080,8 +12217,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/utils/ensure-data-gitignore.ts
-import { writeFile as writeFile14 } from "fs/promises";
-import { join as join20 } from "path";
+import { writeFile as writeFile15 } from "fs/promises";
+import { join as join21 } from "path";
 var GITIGNORE_CONTENT = `
 #################
 # Do not edit this file #
@@ -12118,8 +12255,8 @@ conversations.private.json
 *.log.*
 `;
 async function ensureDataGitignore(dataDir) {
-  const gitignorePath = join20(dataDir, ".gitignore");
-  await writeFile14(gitignorePath, GITIGNORE_CONTENT, "utf-8");
+  const gitignorePath = join21(dataDir, ".gitignore");
+  await writeFile15(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 
 // ../server/src/migrations/migrate-from-legacy.ts
@@ -12128,13 +12265,13 @@ import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createD
 import { randomUUID as randomUUID12 } from "crypto";
 import {
   readFile as readFile16,
-  writeFile as writeFile15,
+  writeFile as writeFile16,
   rename as rename13,
-  mkdir as mkdir16,
+  mkdir as mkdir17,
   access as access2,
-  readdir as readdir6
+  readdir as readdir7
 } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -12263,14 +12400,14 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile15(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await writeFile16(tmp, JSON.stringify(data, null, 2), "utf-8");
   await rename13(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const { resolve: resolve6 } = await import("path");
   const abCwd = resolve6(process.cwd());
-  const legacyRoot = join21(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join21(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = join22(abCwd, env.DATA_DIR);
+  const legacyKeyPath = join22(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -12278,20 +12415,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join21(abCwd, ".runeya-tmp");
+  const legacyTmp = join22(abCwd, ".runeya-tmp");
   await rename13(legacyRoot, legacyTmp);
-  await mkdir16(dataDir, { recursive: true });
-  const legacyOld = join21(dataDir, `backup-${timestamp}`);
+  await mkdir17(dataDir, { recursive: true });
+  const legacyOld = join22(dataDir, `backup-${timestamp}`);
   await rename13(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile16(join21(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile16(join22(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join21(legacyOld, "dbs");
+  const dbsDir = join22(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -12300,29 +12437,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join21(dbsDir, "envs");
-  const envFiles = (await readdir6(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join22(dbsDir, "envs");
+  const envFiles = (await readdir7(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join21(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join22(envsDir, file));
   }
-  const servicesDir = join21(dbsDir, "services");
-  const serviceFiles = (await readdir6(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join22(dbsDir, "services");
+  const serviceFiles = (await readdir7(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join21(servicesDir, file));
+    const data = await readEncrypted(join22(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join21(dbsDir, "overrides");
-  const overrideFiles = (await readdir6(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join22(dbsDir, "overrides");
+  const overrideFiles = (await readdir7(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join21(overridesDir, file));
+    const data = await readEncrypted(join22(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -12330,11 +12467,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join21(dbsDir, "parsers");
-  const parserFiles = (await readdir6(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join22(dbsDir, "parsers");
+  const parserFiles = (await readdir7(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join21(parsersDir, file));
+    const data = await readEncrypted(join22(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -12675,7 +12812,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile16(join21(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile16(join22(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -12696,11 +12833,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join21(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join21(dataDir, "services.json"), runeServices);
-  await atomicWrite(join21(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join21(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join21(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join22(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join22(dataDir, "services.json"), runeServices);
+  await atomicWrite(join22(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join22(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join22(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -12711,10 +12848,10 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries = await readdir6(dataDir);
+    const entries = await readdir7(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join21(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join22(dataDir, dir, "dbs", "encryption-key.json");
       try {
         const raw = await readFile16(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
@@ -12738,14 +12875,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const abDataDir = resolve6(dataDir);
   const abCwd = resolve6(process.cwd());
   const candidateDirs = [
-    join21(abCwd, ".runeya", "dbs", "overrides"),
-    join21(abDataDir, "dbs", "overrides")
+    join22(abCwd, ".runeya", "dbs", "overrides"),
+    join22(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir6(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir7(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -12755,7 +12892,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join21(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join22(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -12773,7 +12910,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile16(join21(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile16(join22(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -12792,7 +12929,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile16(join21(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile16(join22(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -12809,7 +12946,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -12836,7 +12973,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join21(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join22(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -12846,7 +12983,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -12905,7 +13042,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join21(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join22(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -12920,8 +13057,8 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join22 } from "path";
-import { stat as stat6 } from "fs/promises";
+import { join as join23 } from "path";
+import { stat as stat7 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
 async function getServerState() {
@@ -12930,17 +13067,17 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat6(join22(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat7(join23(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat6(join22(dataDir, VERIFY_FILENAME2));
+    await stat7(join23(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat6(join22(dataDir, "projects.json"));
+    await stat7(join23(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
@@ -13232,7 +13369,7 @@ function getOpenApiDocument() {
 // ../server/src/create-server.ts
 import rateLimit from "express-rate-limit";
 import { existsSync as existsSync2, createReadStream } from "fs";
-import { mkdir as mkdir17 } from "fs/promises";
+import { mkdir as mkdir18 } from "fs/promises";
 import multer from "multer";
 
 // ../server/src/services/image-cleanup.service.ts
@@ -13338,7 +13475,7 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  if (!existsSync2(env.DATA_DIR)) await mkdir17(env.DATA_DIR);
+  if (!existsSync2(env.DATA_DIR)) await mkdir18(env.DATA_DIR);
   const absoluteDataDir = resolve5(env.DATA_DIR);
   console.log(`[server] Data directory: ${absoluteDataDir}`);
   await ensureDataGitignore(env.DATA_DIR);
@@ -14090,4 +14227,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-RMLLDYCE.js.map
+//# sourceMappingURL=src-W64XJTN5.js.map