@runeya/runeya 2.0.70 → 2.0.71

package/{src-6WVQ2FQV.js → src-Q3PSCMS7.js}

@@ -60,9 +60,11 @@ import {
   isVaultLocked,
   keyRoot,
   keyedFilePath,
+  killInstance,
   legacyMachineFilePath,
   legacyVaultRoot,
   listCloudVaults,
+  listInstances,
   listOrgVaults,
   loadFromEnv,
   localVaultRoot,
@@ -79,6 +81,7 @@ import {
   readOrgNames,
   refOfProjectAmong,
   refsOfProjectId,
+  registerInstance,
   registerProjectLoader,
   rememberFile,
   rememberOrgName,
@@ -93,11 +96,12 @@ import {
   stableEncryptValue,
   stampOrgCloud,
   traefikManager,
+  unregisterInstance,
   vaultFor,
   vaultIdOfRoot,
   wasRead,
   writeEntity
-} from "./chunk-YSJ6OJGN.js";
+} from "./chunk-Z3KAXI7V.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -4852,20 +4856,20 @@ var settingsRouter = router({
     });
     if (config?.wildcardDomain?.trim()) {
       const sanitisedDomain = config.wildcardDomain.replace(/^\*\./, "").replace(/[^a-z0-9.-]/gi, "");
-      const probe2 = `probe.${sanitisedDomain}`;
+      const probe = `probe.${sanitisedDomain}`;
       try {
-        const addresses = await dns.resolve4(probe2);
+        const addresses = await dns.resolve4(probe);
         const pointsToLocalhost = addresses.some((a) => a === "127.0.0.1");
         checks.push({
           id: "dns_resolution",
           ok: pointsToLocalhost,
-          message: pointsToLocalhost ? `${probe2} \u2192 127.0.0.1 \u2713` : `${probe2} r\xE9sout vers ${addresses.join(", ")} (attendu : 127.0.0.1)`
+          message: pointsToLocalhost ? `${probe} \u2192 127.0.0.1 \u2713` : `${probe} r\xE9sout vers ${addresses.join(", ")} (attendu : 127.0.0.1)`
         });
       } catch {
         checks.push({
           id: "dns_resolution",
           ok: false,
-          message: `${probe2} ne r\xE9sout pas \u2014 v\xE9rifiez le DNS wildcard`
+          message: `${probe} ne r\xE9sout pas \u2014 v\xE9rifiez le DNS wildcard`
         });
       }
     }
@@ -7959,7 +7963,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-74WZPMVQ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-UUSQK6S2.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -8700,7 +8704,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-74WZPMVQ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-UUSQK6S2.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -12697,7 +12701,8 @@ var debugRouter = router({
 });
 
 // ../server/src/trpc/routers/diagnostics.ts
-import { z as z21 } from "zod";
+import { z as z20 } from "zod";
+import { TRPCError as TRPCError18 } from "@trpc/server";
 
 // ../server/src/services/log-buffer.ts
 import { EventEmitter as EventEmitter4 } from "events";
@@ -12765,132 +12770,10 @@ function onEntry(listener) {
   return () => emitter.off("entry", listener);
 }
 
-// ../server/src/services/instance-registry.ts
-import { mkdir as mkdir16, readdir as readdir5, readFile as readFile15, writeFile as writeFile14, rm as rm3 } from "fs/promises";
-import { join as join19 } from "path";
-import { z as z20 } from "zod";
-var InstanceFileSchema = z20.object({
-  pid: z20.number().int().positive(),
-  port: z20.number().int().min(1).max(65535),
-  agentPort: z20.number().int().min(1).max(65535),
-  cwd: z20.string().max(4096),
-  dataDir: z20.string().max(4096),
-  version: z20.string().max(64),
-  fromDesktop: z20.boolean(),
-  startedAt: z20.number().int().nonnegative()
-});
-function registryDir() {
-  return join19(machineRoot(), "instances");
-}
-function fileFor(pid) {
-  return join19(registryDir(), `${pid}.json`);
-}
-function selfRecord() {
-  return {
-    pid: process.pid,
-    port: env.PORT,
-    agentPort: env.RUNEYA_AGENT_PORT,
-    cwd: process.cwd(),
-    dataDir: env.DATA_DIR,
-    version: process.env["RUNEYA_VERSION"] ?? "unknown",
-    fromDesktop: env.FROM_DESKTOP,
-    startedAt: Date.now()
-  };
-}
-async function registerInstance() {
-  try {
-    await mkdir16(registryDir(), { recursive: true });
-    await writeFile14(fileFor(process.pid), JSON.stringify(selfRecord(), null, 2));
-  } catch (err) {
-    console.log("[instances] Could not register this instance:", err.message);
-  }
-}
-async function unregisterInstance() {
-  await rm3(fileFor(process.pid), { force: true }).catch(() => {
-  });
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-async function probe(port) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/trpc/health.check`, {
-      signal: AbortSignal.timeout(1500)
-    });
-    if (!res.ok) return { ok: false, uptimeMs: null, version: null };
-    const body = await res.json();
-    const data = body.result?.data;
-    return { ok: true, uptimeMs: data?.uptime ?? null, version: data?.version ?? null };
-  } catch {
-    return { ok: false, uptimeMs: null, version: null };
-  }
-}
-async function listInstances() {
-  let files;
-  try {
-    files = await readdir5(registryDir());
-  } catch {
-    return [];
-  }
-  const found = await Promise.all(
-    files.filter((f) => f.endsWith(".json")).map(async (name) => {
-      const path = join19(registryDir(), name);
-      let record;
-      try {
-        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile15(path, "utf8")));
-        if (!parsed.success) {
-          await rm3(path, { force: true }).catch(() => {
-          });
-          return null;
-        }
-        record = parsed.data;
-      } catch {
-        return null;
-      }
-      if (!isProcessAlive(record.pid)) {
-        await rm3(path, { force: true }).catch(() => {
-        });
-        return null;
-      }
-      const { ok, uptimeMs, version } = await probe(record.port);
-      if (!ok) {
-        await rm3(path, { force: true }).catch(() => {
-        });
-        return null;
-      }
-      return {
-        ...record,
-        // Trust the live answer over the file: the file was written at boot
-        // and an upgraded instance would keep claiming its old version.
-        version: version ?? record.version,
-        reachable: true,
-        current: record.pid === process.pid,
-        uptimeMs
-      };
-    })
-  );
-  return dedupeByPort(found.filter((i) => i !== null)).sort((a, b) => Number(b.current) - Number(a.current) || a.port - b.port);
-}
-function dedupeByPort(instances) {
-  const byPort = /* @__PURE__ */ new Map();
-  for (const instance of instances) {
-    const kept = byPort.get(instance.port);
-    if (!kept || instance.current || !kept.current && instance.startedAt > kept.startedAt) {
-      byPort.set(instance.port, instance);
-    }
-  }
-  return [...byPort.values()];
-}
-
 // ../server/src/trpc/routers/diagnostics.ts
 var diagnosticsRouter = router({
   /** Backlog for a client that just opened the panel. */
-  recentLogs: protectedProcedure.input(z21.object({ limit: z21.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
+  recentLogs: protectedProcedure.input(z20.object({ limit: z20.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
   /**
    * Live log stream.
    *
@@ -12899,7 +12782,7 @@ var diagnosticsRouter = router({
    * silently loses lines, which is precisely what someone watching a boot
    * failure cannot afford.
    */
-  streamLogs: protectedProcedure.input(z21.object({ afterSeq: z21.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
+  streamLogs: protectedProcedure.input(z20.object({ afterSeq: z20.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
     for (const entry of entriesSince(input?.afterSeq ?? 0)) yield entry;
     const queue = [];
     let wake = null;
@@ -12924,11 +12807,33 @@ var diagnosticsRouter = router({
     }
   }),
   /** Every Runeya answering on this machine, this one included. */
-  instances: protectedProcedure.query(() => listInstances())
+  instances: protectedProcedure.query(() => listInstances()),
+  /**
+   * Stop another Runeya on this machine — its agent first, then its server.
+   *
+   * The pid is a *selector*, not an instruction: it is looked up in the list
+   * `listInstances()` has just vouched for, and anything absent from it is
+   * refused. That is what keeps this from being a way to signal arbitrary
+   * processes with the server's privileges.
+   */
+  killInstance: protectedProcedure.input(z20.object({ pid: z20.number().int().positive() })).mutation(async ({ input }) => {
+    try {
+      return await killInstance(input.pid);
+    } catch (err) {
+      const reason = err.message;
+      if (reason === "instance-not-found") {
+        throw new TRPCError18({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
+      }
+      if (reason === "instance-is-current") {
+        throw new TRPCError18({ code: "BAD_REQUEST", message: "This instance cannot stop itself." });
+      }
+      throw new TRPCError18({ code: "INTERNAL_SERVER_ERROR", message: reason });
+    }
+  })
 });
 
 // ../server/src/trpc/routers/kanban-queue.ts
-import { z as z22 } from "zod";
+import { z as z21 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
 import { randomUUID as randomUUID10 } from "crypto";
@@ -13116,36 +13021,36 @@ var kanbanQueue = new KanbanQueueService();
 // ../server/src/trpc/routers/kanban-queue.ts
 var kanbanQueueRouter = router({
   getState: protectedProcedure.query(() => kanbanQueue.getState()),
-  add: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    cardId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
+  add: protectedProcedure.input(z21.object({
+    boardId: z21.string().max(128),
+    cardId: z21.string().max(128),
+    runner: z21.enum(["claude-code", "codex"]).optional(),
+    model: z21.string().max(128).optional(),
+    scenarioId: z21.string().max(128).optional(),
     // Le projet ouvert quand la carte a été mise en file : la conversation
     // qui en naîtra lui appartient, plutôt que de rester orpheline et de
     // s'afficher dans tous les projets.
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+    projectId: z21.string().max(128).optional(),
+    orgId: z21.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
-  addColumn: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    columnId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+  addColumn: protectedProcedure.input(z21.object({
+    boardId: z21.string().max(128),
+    columnId: z21.string().max(128),
+    runner: z21.enum(["claude-code", "codex"]).optional(),
+    model: z21.string().max(128).optional(),
+    scenarioId: z21.string().max(128).optional(),
+    projectId: z21.string().max(128).optional(),
+    orgId: z21.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
   }),
-  remove: protectedProcedure.input(z22.object({ itemId: z22.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
+  remove: protectedProcedure.input(z21.object({ itemId: z21.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
   stopAll: protectedProcedure.mutation(() => {
     kanbanQueue.stopAll();
     return { ok: true };
   }),
-  setMaxConcurrent: protectedProcedure.input(z22.object({ max: z22.number().int().min(1).max(20) })).mutation(({ input }) => {
+  setMaxConcurrent: protectedProcedure.input(z21.object({ max: z21.number().int().min(1).max(20) })).mutation(({ input }) => {
     kanbanQueue.setMaxConcurrent(input.max);
     return kanbanQueue.getState();
   }),
@@ -13179,12 +13084,12 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
-import { mkdir as mkdir17, readdir as readdir6, rm as rm4, stat as stat5, writeFile as writeFile15 } from "fs/promises";
+import { mkdir as mkdir16, readdir as readdir5, rm as rm3, stat as stat5, writeFile as writeFile14 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { join as join20 } from "path";
-import { z as z23 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
+import { join as join19 } from "path";
+import { z as z22 } from "zod";
+import { TRPCError as TRPCError19 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -13233,37 +13138,37 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join20(tmpdir(), "runeya-kanban-attachments");
+  return join19(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
-    for (const name of await readdir6(dir)) {
-      const path = join20(dir, name);
+    for (const name of await readdir5(dir)) {
+      const path = join19(dir, name);
       const info = await stat5(path).catch(() => null);
-      if (info && info.mtimeMs < cutoff) await rm4(path, { force: true });
+      if (info && info.mtimeMs < cutoff) await rm3(path, { force: true });
     }
   } catch {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join20(machineRoot(), "kanban-attachments")];
+  return [attachmentCacheDir(), join19(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
-      await mkdir17(dir, { recursive: true });
-      const path = join20(dir, safeLocalName(id, name));
-      await writeFile15(path, body);
+      await mkdir16(dir, { recursive: true });
+      const path = join19(dir, safeLocalName(id, name));
+      await writeFile14(path, body);
       void purgeStaleAttachments(dir);
       return path;
     } catch (err) {
       refusals.push(`${dir} (${err instanceof Error ? err.message : String(err)})`);
     }
   }
-  throw new TRPCError18({
+  throw new TRPCError19({
     code: "INTERNAL_SERVER_ERROR",
     message: `Impossible d'\xE9crire la pi\xE8ce jointe sur cette machine. Emplacements essay\xE9s : ${refusals.join(" ; ")}. V\xE9rifiez les droits d'\xE9criture, ou l'espace disque.`
   });
@@ -13279,9 +13184,9 @@ var kanbanRouter = router({
    * card graph, so listing them in full would be megabytes to answer "which
    * boards exist?". Use `getBoard` for the cards of one.
    */
-  listBoards: protectedProcedure.input(z23.object({
-    includeArchived: z23.boolean().optional(),
-    organizationId: z23.string().max(128).optional()
+  listBoards: protectedProcedure.input(z22.object({
+    includeArchived: z22.boolean().optional(),
+    organizationId: z22.string().max(128).optional()
   }).optional()).query(async ({ input }) => {
     const { organizationId, boards } = await kanbanStore.list(
       input?.includeArchived ?? false,
@@ -13307,7 +13212,7 @@ var kanbanRouter = router({
     };
   }),
   /** One board: its columns, and the cards in each. */
-  getBoard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => {
+  getBoard: protectedProcedure.input(z22.object({ boardId: z22.string().max(128) })).query(async ({ input }) => {
     const board = await kanbanStore.get(input.boardId);
     if (!board) return { board: null };
     const { links } = await kanbanStore.cardLinks(input.boardId);
@@ -13346,11 +13251,11 @@ var kanbanRouter = router({
    * organization — or one board when `boardId` is given. Archived boards are
    * left out: they are what the team decided to stop looking at.
    */
-  searchCards: protectedProcedure.input(z23.object({
-    query: z23.string().min(1).max(256),
-    boardId: z23.string().max(128).optional(),
-    limit: z23.number().int().min(1).max(100).optional(),
-    organizationId: z23.string().max(128).optional()
+  searchCards: protectedProcedure.input(z22.object({
+    query: z22.string().min(1).max(256),
+    boardId: z22.string().max(128).optional(),
+    limit: z22.number().int().min(1).max(100).optional(),
+    organizationId: z22.string().max(128).optional()
   })).query(async ({ input }) => {
     const needle = normalize(input.query);
     const ids = input.boardId ? [input.boardId] : (await kanbanStore.list(false, input.organizationId)).boards.map((b) => b.id);
@@ -13369,10 +13274,10 @@ var kanbanRouter = router({
    * qu'un `commentCount`, et rien n'en donnait le texte. Cette route est la
    * relecture, pour une seule carte : c'est le journal qui pèse, pas le reste.
    */
-  getCardComments: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    limit: z23.number().int().min(1).max(200).optional()
+  getCardComments: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    limit: z22.number().int().min(1).max(200).optional()
   })).query(async ({ input }) => {
     const history = await kanbanStore.cardHistory(input.boardId, input.cardId);
     const comments = history.filter((e) => e.type === "comment");
@@ -13401,18 +13306,18 @@ var kanbanRouter = router({
    * `getBoard` en donne déjà l'essentiel carte par carte ; cette route sert
    * quand c'est l'arbre lui-même qu'on veut, dates et auteurs compris.
    */
-  getCardLinks: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
+  getCardLinks: protectedProcedure.input(z22.object({ boardId: z22.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
   /**
    * Rattacher une carte à une carte parente, ou l'en détacher.
    *
    * Sans `parentCardId`, le lien est retiré. Le parent peut vivre sur un autre
    * tableau : `parentBoardId` le désigne alors, sinon c'est celui de la carte.
    */
-  setCardParent: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    parentCardId: z23.string().max(128).optional(),
-    parentBoardId: z23.string().max(128).optional()
+  setCardParent: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    parentCardId: z22.string().max(128).optional(),
+    parentBoardId: z22.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardParent(
       input.boardId,
@@ -13420,35 +13325,35 @@ var kanbanRouter = router({
       input.parentCardId ? { boardId: input.parentBoardId ?? input.boardId, cardId: input.parentCardId } : null
     );
     if (!ok) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
     }
     return { ok: true };
   }),
-  moveCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    targetColumn: z23.string().max(256)
+  moveCard: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    targetColumn: z22.string().max(256)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "move_card", columnTitle: input.targetColumn }
     ]);
     return { ok: true };
   }),
-  addComment: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    comment: z23.string().max(2e4)
+  addComment: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    comment: z22.string().max(2e4)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "add_comment", comment: input.comment }
     ]);
     return { ok: true };
   }),
-  addCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    column: z23.string().max(256),
-    title: z23.string().max(512),
-    content: z23.string().max(2e4).optional()
+  addCard: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    column: z22.string().max(256),
+    title: z22.string().max(512),
+    content: z22.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     await executeKanbanBoardCommands(input.boardId, [
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
@@ -13460,28 +13365,28 @@ var kanbanRouter = router({
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z23.object({ attachmentId: z23.string().max(128) })).mutation(async ({ input }) => {
+  downloadAttachment: protectedProcedure.input(z22.object({ attachmentId: z22.string().max(128) })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
     const res = await cloudFetch2(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
     if (res.status === 404) {
-      throw new TRPCError18({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+      throw new TRPCError19({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
     if (!res.ok) {
-      throw new TRPCError18({
+      throw new TRPCError19({
         code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
         message: `Cloud refused the attachment (HTTP ${res.status})`
       });
     }
     const declared = Number(res.headers.get("content-length") ?? 0);
     if (declared > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const body = Buffer.from(await res.arrayBuffer());
     if (body.length > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const contentType = res.headers.get("content-type") ?? "application/octet-stream";
     const disposition = res.headers.get("content-disposition") ?? "";
@@ -13493,20 +13398,21 @@ var kanbanRouter = router({
 });
 
 // ../server/src/trpc/routers/terminal.ts
-import { z as z24 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
+import { z as z23 } from "zod";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
-  create: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    cwd: z24.string().max(512).optional(),
+  create: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    cwd: z23.string().max(512).optional(),
     /** Anchors the terminal when no explicit cwd is given. */
-    serviceId: z24.string().max(128).optional(),
-    projectId: z24.string().max(128).optional(),
+    serviceId: z23.string().max(128).optional(),
+    projectId: z23.string().max(128).optional(),
     /** L'organisation du projet : un id seul peut en nommer un par organisation. */
-    orgId: z24.string().max(128).nullable().optional(),
-    cols: z24.number().int().min(1).max(512).optional(),
-    rows: z24.number().int().min(1).max(256).optional()
+    orgId: z23.string().max(128).nullable().optional(),
+    cols: z23.number().int().min(1).max(512).optional(),
+    rows: z23.number().int().min(1).max(256).optional(),
+    title: z23.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
@@ -13520,16 +13426,37 @@ var terminalRouter = router({
           orgId: input.orgId
         }),
         cols: input.cols,
-        rows: input.rows
+        rows: input.rows,
+        title: input.title
       }
     );
     return result;
   }),
+  /** Les sessions PTY encore vivantes sur l'agent (onglets à retrouver) */
+  list: protectedProcedure.input(z23.object({ agentId: z23.string().max(128) })).query(async ({ input }) => {
+    return agentManager.agentQuery(
+      input.agentId,
+      "terminal.list"
+    );
+  }),
+  /** Renommer un onglet */
+  rename: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    title: z23.string().max(128)
+  })).mutation(async ({ input }) => {
+    await agentManager.agentMutation(
+      input.agentId,
+      "terminal.rename",
+      { sessionId: input.sessionId, title: input.title }
+    );
+    return { ok: true };
+  }),
   /** Send keystrokes / data to a PTY session */
-  write: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    data: z24.string().max(65536)
+  write: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    data: z23.string().max(65536)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13539,11 +13466,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Resize the PTY */
-  resize: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    cols: z24.number().int().min(1).max(512),
-    rows: z24.number().int().min(1).max(256)
+  resize: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    cols: z23.number().int().min(1).max(512),
+    rows: z23.number().int().min(1).max(256)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13553,9 +13480,9 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Destroy a PTY session */
-  destroy: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128)
+  destroy: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13565,9 +13492,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Stream PTY output — proxied via AgentWSBridge dynamic subscription */
-  onData: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128)
+  onData: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    /** Rejouer l'historique de la session avant le flux temps réel. */
+    replay: z23.boolean().optional()
   })).subscription(async function* ({ input }) {
     const queue = [];
     let resolve7 = null;
@@ -13577,7 +13506,7 @@ var terminalRouter = router({
       unsubscribe = agentManager.agentSubscribe(
         input.agentId,
         "terminal.onData",
-        { sessionId: input.sessionId },
+        { sessionId: input.sessionId, replay: input.replay },
         (data) => {
           if (typeof data === "string") queue.push(data);
           if (resolve7) {
@@ -13594,7 +13523,7 @@ var terminalRouter = router({
         }
       );
     } catch (err) {
-      throw new TRPCError19({
+      throw new TRPCError20({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -13616,11 +13545,11 @@ var terminalRouter = router({
 });
 
 // ../server/src/trpc/routers/utility.ts
-import { z as z25 } from "zod";
+import { z as z24 } from "zod";
 var MAX_WAIT_MS = 5 * 60 * 1e3;
 var utilityRouter = router({
-  wait: protectedProcedure.input(z25.object({
-    ms: z25.number().int().min(0).max(MAX_WAIT_MS)
+  wait: protectedProcedure.input(z24.object({
+    ms: z24.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
     await new Promise((resolve7) => setTimeout(resolve7, input.ms));
     return { waited: input.ms };
@@ -13628,15 +13557,15 @@ var utilityRouter = router({
 });
 
 // ../server/src/trpc/routers/wiki.ts
-import { z as z26 } from "zod";
-import { TRPCError as TRPCError20 } from "@trpc/server";
-import { readFile as readFile16, readdir as readdir7, stat as stat6, realpath, writeFile as writeFile16, mkdir as mkdir18, rename as rename12, rm as rm5 } from "fs/promises";
-import { resolve as resolvePath, join as join21, relative, sep as sep3, dirname as dirname9 } from "path";
-var SCOPE_SCHEMA = z26.union([
-  z26.literal("global"),
-  z26.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+import { z as z25 } from "zod";
+import { TRPCError as TRPCError21 } from "@trpc/server";
+import { readFile as readFile15, readdir as readdir6, stat as stat6, realpath, writeFile as writeFile15, mkdir as mkdir17, rename as rename12, rm as rm4 } from "fs/promises";
+import { resolve as resolvePath, join as join20, relative, sep as sep3, dirname as dirname9 } from "path";
+var SCOPE_SCHEMA = z25.union([
+  z25.literal("global"),
+  z25.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
 ]);
-var REL_PATH_SCHEMA = z26.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+var REL_PATH_SCHEMA = z25.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
   message: "Path must be a relative path without traversal"
 });
 var MAX_FILES = 500;
@@ -13656,36 +13585,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "target",
   "out"
 ]);
-var DocsEntrySchema = z26.lazy(() => z26.union([
-  z26.object({ type: z26.literal("file"), name: z26.string(), path: z26.string() }),
-  z26.object({ type: z26.literal("dir"), name: z26.string(), path: z26.string(), children: z26.array(DocsEntrySchema) })
+var DocsEntrySchema = z25.lazy(() => z25.union([
+  z25.object({ type: z25.literal("file"), name: z25.string(), path: z25.string() }),
+  z25.object({ type: z25.literal("dir"), name: z25.string(), path: z25.string(), children: z25.array(DocsEntrySchema) })
 ]));
 async function resolveScope(scope) {
   if (scope === "global") {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir18(dataDirAbs, { recursive: true });
+    await mkdir17(dataDirAbs, { recursive: true });
     const base = dirname9(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir18(target, { recursive: true });
+    await mkdir17(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep3).startsWith(base + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError20({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError20({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
   return { mode: "agent", agentId, cwd };
 }
@@ -13693,7 +13622,7 @@ async function walkLocal(root, dir, depth, counter) {
   if (depth > MAX_DEPTH || counter.n >= MAX_FILES) return [];
   let entries2;
   try {
-    entries2 = await readdir7(dir, { withFileTypes: true });
+    entries2 = await readdir6(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -13701,7 +13630,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries2) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join21(dir, e.name);
+    const abs = join20(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -13720,7 +13649,7 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError20({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError21({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
@@ -13728,10 +13657,10 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     try {
       real = await realpath(target);
     } catch {
-      throw new TRPCError20({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError21({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep3).startsWith(root + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
@@ -13743,12 +13672,12 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep3).startsWith(root + sep3)) {
-    throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
 var wikiRouter = router({
-  list: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).output(z26.object({ root: z26.string(), entries: z26.array(DocsEntrySchema), truncated: z26.boolean() })).query(async ({ input }) => {
+  list: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA })).output(z25.object({ root: z25.string(), entries: z25.array(DocsEntrySchema), truncated: z25.boolean() })).query(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
@@ -13757,9 +13686,9 @@ var wikiRouter = router({
     const entries2 = await walkLocal(target.root, target.root, 0, counter);
     return { root: target.root, entries: entries2, truncated: counter.n >= MAX_FILES };
   }),
-  read: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z26.object({ path: z26.string(), content: z26.string() })).query(async ({ input }) => {
+  read: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z25.object({ path: z25.string(), content: z25.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -13767,27 +13696,27 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
     const s = await stat6(file);
-    if (!s.isFile()) throw new TRPCError20({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError20({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
-    const content = await readFile16(file, "utf-8");
+    if (!s.isFile()) throw new TRPCError21({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError21({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    const content = await readFile15(file, "utf-8");
     return { path: input.path, content };
   }),
-  write: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z26.string().max(5e6) })).mutation(async ({ input }) => {
+  write: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z25.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir18(dirname9(file), { recursive: true });
-    await writeFile16(file, input.content, "utf-8");
+    await mkdir17(dirname9(file), { recursive: true });
+    await writeFile15(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
-  createFile: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createFile: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -13796,24 +13725,24 @@ var wikiRouter = router({
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
       await stat6(file);
-      throw new TRPCError20({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      throw new TRPCError21({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError20) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir18(dirname9(file), { recursive: true });
-    await writeFile16(file, "", "utf-8");
+    await mkdir17(dirname9(file), { recursive: true });
+    await writeFile15(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
-  createDir: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createDir: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir18(dir, { recursive: true });
+    await mkdir17(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
-  rename: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  rename: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
@@ -13822,35 +13751,35 @@ var wikiRouter = router({
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
       await stat6(to);
-      throw new TRPCError20({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      throw new TRPCError21({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError20) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir18(dirname9(to), { recursive: true });
+    await mkdir17(dirname9(to), { recursive: true });
     await rename12(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
-  ensureRoot: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+  ensureRoot: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
     if (input.scope === "global") {
       await resolveScope("global");
       return { ok: true };
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError20({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError20({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
-  delete: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError20({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
-    await rm5(fp, { recursive: true, force: true });
+    if (fp === target.root) throw new TRPCError21({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    await rm4(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
 });
@@ -13869,14 +13798,14 @@ var configRouter = router({
 });
 
 // ../server/src/trpc/routers/cloud-sync.ts
-import { z as z27 } from "zod";
-import { TRPCError as TRPCError21 } from "@trpc/server";
+import { z as z26 } from "zod";
+import { TRPCError as TRPCError22 } from "@trpc/server";
 
 // ../server/src/services/org-sync-scope.ts
 import { access as access2 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 async function isMaterialized(root) {
-  return access2(join22(root, "project.json")).then(() => true, () => false);
+  return access2(join21(root, "project.json")).then(() => true, () => false);
 }
 async function orgsToSync() {
   const cloudUrl = getCloudApiUrl();
@@ -13938,16 +13867,16 @@ async function reconcileOrgCanary(orgId) {
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID11 } from "crypto";
-import { mkdir as mkdir20, rm as rm6 } from "fs/promises";
+import { mkdir as mkdir19, rm as rm5 } from "fs/promises";
 import * as Y from "yjs";
 
 // ../server/src/services/org-lock.ts
-import { open as open2, readFile as readFile17, unlink as unlink4, mkdir as mkdir19 } from "fs/promises";
+import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir18 } from "fs/promises";
 import { readFileSync, unlinkSync } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 var held = /* @__PURE__ */ new Set();
 function lockPath(orgId) {
-  return join23(orgVaultRoot(orgId), "org.lock");
+  return join22(orgVaultRoot(orgId), "org.lock");
 }
 function isRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -13960,7 +13889,7 @@ function isRunning(pid) {
 }
 async function readLock(path) {
   try {
-    const parsed = JSON.parse(await readFile17(path, "utf-8"));
+    const parsed = JSON.parse(await readFile16(path, "utf-8"));
     return typeof parsed?.pid === "number" ? parsed : null;
   } catch {
     return null;
@@ -13968,7 +13897,7 @@ async function readLock(path) {
 }
 async function acquireOrgLock(orgId) {
   const path = lockPath(orgId);
-  await mkdir19(orgVaultRoot(orgId), { recursive: true });
+  await mkdir18(orgVaultRoot(orgId), { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await open2(path, "wx");
@@ -14379,7 +14308,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir20(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir19(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -14395,7 +14324,7 @@ var OrgSyncConnection = class {
   async unfollowProject(projectId) {
     this.tracked.delete(projectId);
     await projectStore.forgetLocally({ id: projectId, orgId: this.link.orgId });
-    await rm6(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
+    await rm5(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
     });
   }
   /**
@@ -14755,8 +14684,8 @@ var CloudSyncBridge = class {
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir8, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir21, copyFile, rename as rename13, stat as stat7 } from "fs/promises";
-import { join as join24 } from "path";
+import { readdir as readdir7, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir20, copyFile, rename as rename13, stat as stat7 } from "fs/promises";
+import { join as join23 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes5 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 function isAgentTriplet(value) {
@@ -14813,7 +14742,7 @@ async function rootsOfOrg(orgId) {
 }
 async function jsonFilesIn(root) {
   try {
-    const entries2 = await readdir8(root, { withFileTypes: true });
+    const entries2 = await readdir7(root, { withFileTypes: true });
     return entries2.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
   } catch {
     return [];
@@ -14836,10 +14765,10 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const touchedRoots = /* @__PURE__ */ new Set();
   for (const vaultRoot of await rootsOfOrg(orgId)) {
     for (const name of await jsonFilesIn(vaultRoot)) {
-      const path = join24(vaultRoot, name);
+      const path = join23(vaultRoot, name);
       let parsed;
       try {
-        parsed = JSON.parse(await readFile18(path, "utf-8"));
+        parsed = JSON.parse(await readFile17(path, "utf-8"));
       } catch {
         continue;
       }
@@ -14853,21 +14782,21 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backups = [];
   for (const vaultRoot of touchedRoots) {
-    const backupDir = join24(vaultRoot, `backup-key-${stamp}`);
-    await mkdir21(backupDir, { recursive: true });
+    const backupDir = join23(vaultRoot, `backup-key-${stamp}`);
+    await mkdir20(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
-      await copyFile(join24(vaultRoot, name), join24(backupDir, name));
+      await copyFile(join23(vaultRoot, name), join23(backupDir, name));
     }
     for (const name of [".encryption.key.enc", ".runeya-verify"]) {
-      if (await exists(join24(vaultRoot, name))) {
-        await copyFile(join24(vaultRoot, name), join24(backupDir, name));
+      if (await exists(join23(vaultRoot, name))) {
+        await copyFile(join23(vaultRoot, name), join23(backupDir, name));
       }
     }
     backups.push(backupDir);
   }
   for (const item of pending) {
     const tmp = item.path + ".tmp";
-    await writeFile17(tmp, item.content, "utf-8");
+    await writeFile16(tmp, item.content, "utf-8");
     await rename13(tmp, item.path);
   }
   await installOrgKey(orgId, newKey, masterPassword);
@@ -14899,7 +14828,7 @@ async function assertOrgReadable(orgId) {
     await assertOrgVaultReadable(orgId);
   } catch (err) {
     if (err instanceof OrgVaultUnreadableError) {
-      throw new TRPCError21({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     throw err;
   }
@@ -14909,10 +14838,10 @@ async function assertOrgKey(orgId) {
     await reconcileOrgCanary(orgId);
   } catch (err) {
     if (err instanceof OrgKeyMismatchError) {
-      throw new TRPCError21({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     if (err instanceof CanaryUnavailableError) {
-      throw new TRPCError21({ code: "PRECONDITION_FAILED", message: err.message });
+      throw new TRPCError22({ code: "PRECONDITION_FAILED", message: err.message });
     }
     throw err;
   }
@@ -14929,10 +14858,10 @@ var cloudSyncRouter = router({
    * "open this project" is the whole gesture.
    */
   trackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      cloudUrl: z26.string().url().max(2048),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
@@ -14947,7 +14876,7 @@ var cloudSyncRouter = router({
       return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError21({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -14966,18 +14895,18 @@ var cloudSyncRouter = router({
    * fusionné.
    */
   publishProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      cloudUrl: z26.string().url().max(2048),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
     if (!local) {
-      throw new TRPCError21({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
     }
     if (await projectStore.get({ id: input.projectId, orgId: input.orgId })) {
-      throw new TRPCError21({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
+      throw new TRPCError22({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
     }
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
@@ -14996,7 +14925,7 @@ var cloudSyncRouter = router({
       await cloudSyncBridge.followProject(input.orgId, input.projectId);
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError21({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -15010,16 +14939,16 @@ var cloudSyncRouter = router({
    * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
    * les yeux — donc le canari est rapatrié et jugé ici.
    */
-  checkOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i)
+  checkOrgKey: protectedProcedure.input(z26.object({
+    orgId: z26.string().min(1).max(128),
+    keyHex: z26.string().length(64).regex(/^[0-9a-f]+$/i)
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
       { method: "GET" }
     );
     if (!res.ok) {
-      throw new TRPCError21({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
+      throw new TRPCError22({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
     }
     const { canary } = await res.json();
     if (typeof canary !== "string") return { matches: false, published: false };
@@ -15035,10 +14964,10 @@ var cloudSyncRouter = router({
    * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
    * organisations et la machine gardent leur clé.
    */
-  adoptOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i),
-    masterPassword: z27.string().min(1).max(1024)
+  adoptOrgKey: protectedProcedure.input(z26.object({
+    orgId: z26.string().min(1).max(128),
+    keyHex: z26.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z26.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const report = await adoptOrgKey(
       input.orgId,
@@ -15062,10 +14991,10 @@ var cloudSyncRouter = router({
    * Elle ne re-chiffre rien : ce qui a déjà été synchronisé sous l'ancienne clé
    * reste illisible. L'interface le dit avant de la déclencher.
    */
-  resetOrgKey: protectedProcedure.input(z27.object({ orgId: z27.string().min(1).max(128) })).mutation(async ({ input }) => {
+  resetOrgKey: protectedProcedure.input(z26.object({ orgId: z26.string().min(1).max(128) })).mutation(async ({ input }) => {
     const canary = await readVerifyFile(await keyRoot());
     if (!canary) {
-      throw new TRPCError21({
+      throw new TRPCError22({
         code: "PRECONDITION_FAILED",
         message: "Cette machine n'a pas encore de cl\xE9 de chiffrement."
       });
@@ -15076,7 +15005,7 @@ var cloudSyncRouter = router({
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
-      throw new TRPCError21({
+      throw new TRPCError22({
         code: res.status === 403 ? "FORBIDDEN" : "BAD_GATEWAY",
         message: detail || `ORG_KEY_RESET_FAILED (${res.status})`
       });
@@ -15092,9 +15021,9 @@ var cloudSyncRouter = router({
    * every other member and for this one on another machine.
    */
   untrackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
@@ -15110,9 +15039,9 @@ var cloudSyncRouter = router({
    * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
    */
   deleteProjectFromOrg: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     let res;
@@ -15122,8 +15051,8 @@ var cloudSyncRouter = router({
         body: { organizationId: input.orgId, projectId: input.projectId }
       });
     } catch (err) {
-      if (err instanceof TRPCError21 && err.code === "PRECONDITION_FAILED") {
-        throw new TRPCError21({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
+      if (err instanceof TRPCError22 && err.code === "PRECONDITION_FAILED") {
+        throw new TRPCError22({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
       }
       throw err;
     }
@@ -15131,12 +15060,12 @@ var cloudSyncRouter = router({
     const detail = await cloudMessage(res);
     if (res.status === 403) {
       const code = /not a member/i.test(detail) ? "PROJECT_NOT_MEMBER" : "PROJECT_DELETE_FORBIDDEN";
-      throw new TRPCError21({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
+      throw new TRPCError22({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
     }
     if (res.status === 404) {
-      throw new TRPCError21({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
     }
-    throw new TRPCError21({
+    throw new TRPCError22({
       code: "BAD_GATEWAY",
       message: detail || `PROJECT_DELETE_FAILED (${res.status})`
     });
@@ -15156,10 +15085,10 @@ var cloudSyncRouter = router({
    * afficher. Le nom est donc recopié dans le tampon du coffre au passage, là
    * où il est déjà lu au démarrage suivant.
    */
-  rememberOrgNames: protectedProcedure.input(z27.object({
-    orgs: z27.array(z27.object({
-      orgId: z27.string().min(1).max(128),
-      name: z27.string().min(1).max(100)
+  rememberOrgNames: protectedProcedure.input(z26.object({
+    orgs: z26.array(z26.object({
+      orgId: z26.string().min(1).max(128),
+      name: z26.string().min(1).max(100)
     })).max(200)
   })).mutation(async ({ input }) => {
     for (const { orgId, name } of input.orgs) await rememberOrgName(orgId, name);
@@ -15193,15 +15122,15 @@ var cloudSyncRouter = router({
 });
 
 // ../server/src/trpc/routers/filesystem.ts
-import { readdir as readdir9, stat as stat8 } from "fs/promises";
+import { readdir as readdir8, stat as stat8 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute4, join as join25, resolve as resolve5, dirname as dirname10, basename as basename2 } from "path";
-import { z as z28 } from "zod";
+import { isAbsolute as isAbsolute4, join as join24, resolve as resolve5, dirname as dirname10, basename as basename2 } from "path";
+import { z as z27 } from "zod";
 var MAX_ENTRIES2 = 500;
-var PATH_SCHEMA = z28.string().min(1).max(4096);
+var PATH_SCHEMA = z27.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join25(homedir5(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join24(homedir5(), input.slice(1)) : input;
   if (!isAbsolute4(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve5(expanded);
 }
@@ -15222,7 +15151,7 @@ var filesystemRouter = router({
    * Hidden entries are skipped: they are noise for choosing a workspace, and
    * `.runeya` itself would invite placing a project inside another's data.
    */
-  listDirectories: protectedProcedure.input(z28.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  listDirectories: protectedProcedure.input(z27.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
     if (!info?.isDirectory()) {
@@ -15230,14 +15159,14 @@ var filesystemRouter = router({
     }
     let names;
     try {
-      names = (await readdir9(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+      names = (await readdir8(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
     } catch {
       throw new Error(`R\xE9pertoire illisible : ${dir}`);
     }
     const truncated = names.length > MAX_ENTRIES2;
     const entries2 = [];
     for (const name of names.slice(0, MAX_ENTRIES2)) {
-      const path = join25(dir, name);
+      const path = join24(dir, name);
       entries2.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
@@ -15256,10 +15185,10 @@ var filesystemRouter = router({
    * Two projects in one directory is what makes services run against the wrong
    * code, so a directory that already holds one is refused outright.
    */
-  checkProjectTarget: protectedProcedure.input(z28.object({
+  checkProjectTarget: protectedProcedure.input(z27.object({
     path: PATH_SCHEMA,
-    projectId: z28.string().min(1).max(128),
-    orgId: z28.string().max(128).nullable().optional()
+    projectId: z27.string().min(1).max(128),
+    orgId: z27.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
@@ -15369,8 +15298,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir10, readFile as readFile19, writeFile as writeFile18, mkdir as mkdir22, copyFile as copyFile2, unlink as unlink5, rename as rename14, stat as stat10 } from "fs/promises";
-import { join as join26 } from "path";
+import { readdir as readdir9, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir21, copyFile as copyFile2, unlink as unlink5, rename as rename14, stat as stat10 } from "fs/promises";
+import { join as join25 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -15382,7 +15311,7 @@ var MACHINE_FILES = [
 ];
 var rekeyValue = rekeyJsonValue;
 async function vaultJsonFiles(root) {
-  const entries2 = await readdir10(root, { withFileTypes: true });
+  const entries2 = await readdir9(root, { withFileTypes: true });
   return entries2.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
 }
 async function exists2(path) {
@@ -15400,17 +15329,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join26(legacyRoot, `backup-${stamp}`);
-  await mkdir22(backupDir, { recursive: true });
+  const backupDir = join25(legacyRoot, `backup-${stamp}`);
+  await mkdir21(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists2(join26(legacyRoot, name))) {
-      await copyFile2(join26(legacyRoot, name), join26(backupDir, name));
+    if (await exists2(join25(legacyRoot, name))) {
+      await copyFile2(join25(legacyRoot, name), join25(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile19(join26(legacyRoot, name), "utf-8");
+    const raw = await readFile18(join25(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -15420,13 +15349,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join26(legacyRoot, `${name}.tmp`);
-    await writeFile18(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename14(tmp, join26(legacyRoot, name));
+    const tmp = join25(legacyRoot, `${name}.tmp`);
+    await writeFile17(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename14(tmp, join25(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile19(join26(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile18(join25(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -15435,13 +15364,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir22(machineRootDir, { recursive: true });
+  await mkdir21(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join26(legacyRoot, name);
+    const from = join25(legacyRoot, name);
     if (!await exists2(from)) continue;
-    const to = join26(machineRootDir, name);
+    const to = join25(machineRootDir, name);
     if (await exists2(to)) {
       skipped.push(name);
       continue;
@@ -15451,15 +15380,15 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join26(legacyRoot, name);
+    const path = join25(legacyRoot, name);
     if (await exists2(path)) await unlink5(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile20, writeFile as writeFile19, rename as rename15, unlink as unlink6, mkdir as mkdir23, chmod as chmod12, stat as stat11 } from "fs/promises";
-import { join as join27 } from "path";
+import { readFile as readFile19, writeFile as writeFile18, rename as rename15, unlink as unlink6, mkdir as mkdir22, chmod as chmod12, stat as stat11 } from "fs/promises";
+import { join as join26 } from "path";
 var SETTINGS_FILE2 = "settings.json";
 var SETTINGS_PRIVATE_FILE2 = "settings.private.json";
 async function exists3(path) {
@@ -15472,11 +15401,11 @@ async function legacySource(filename) {
   return null;
 }
 async function moveInto(root, filename, from) {
-  await mkdir23(root, { recursive: true });
-  const to = join27(root, filename);
-  const contents = await readFile20(from, "utf-8");
+  await mkdir22(root, { recursive: true });
+  const to = join26(root, filename);
+  const contents = await readFile19(from, "utf-8");
   const tmp = to + ".tmp";
-  await writeFile19(tmp, contents, "utf-8");
+  await writeFile18(tmp, contents, "utf-8");
   await rename15(tmp, to);
   await chmod12(to, 384);
   await unlink6(from);
@@ -15498,7 +15427,7 @@ async function migrateSettingsIntoVaults() {
   const orgId = orgs[0];
   const root = orgVaultRoot(orgId);
   for (const { filename, from } of sources) {
-    if (await exists3(join27(root, filename))) continue;
+    if (await exists3(join26(root, filename))) continue;
     await moveInto(root, filename, from);
     report.files.push(filename);
   }
@@ -15514,14 +15443,14 @@ import { createRequire as createRequire2 } from "module";
 import { randomBytes as randomBytes6, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile21,
-  writeFile as writeFile20,
+  readFile as readFile20,
+  writeFile as writeFile19,
   rename as rename16,
-  mkdir as mkdir24,
+  mkdir as mkdir23,
   access as access3,
-  readdir as readdir11
+  readdir as readdir10
 } from "fs/promises";
-import { join as join28, dirname as dirname11 } from "path";
+import { join as join27, dirname as dirname11 } from "path";
 var _require = createRequire2(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -15630,7 +15559,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile21(filePath, "utf-8")).trim();
+  const raw = (await readFile20(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -15650,12 +15579,12 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile20(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await writeFile19(tmp, JSON.stringify(data, null, 2), "utf-8");
   await rename16(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join28(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join27(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
   } catch {
@@ -15663,20 +15592,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join28(abCwd, ".runeya-tmp");
+  const legacyTmp = join27(abCwd, ".runeya-tmp");
   await rename16(legacyRoot, legacyTmp);
-  await mkdir24(dataDir, { recursive: true });
-  const legacyOld = join28(dataDir, `backup-${timestamp}`);
+  await mkdir23(dataDir, { recursive: true });
+  const legacyOld = join27(dataDir, `backup-${timestamp}`);
   await rename16(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile21(join28(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile20(join27(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join28(legacyOld, "dbs");
+  const dbsDir = join27(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -15685,29 +15614,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join28(dbsDir, "envs");
-  const envFiles = (await readdir11(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join27(dbsDir, "envs");
+  const envFiles = (await readdir10(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join28(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join27(envsDir, file));
   }
-  const servicesDir = join28(dbsDir, "services");
-  const serviceFiles = (await readdir11(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join27(dbsDir, "services");
+  const serviceFiles = (await readdir10(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join28(servicesDir, file));
+    const data = await readEncrypted(join27(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join28(dbsDir, "overrides");
-  const overrideFiles = (await readdir11(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join27(dbsDir, "overrides");
+  const overrideFiles = (await readdir10(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join28(overridesDir, file));
+    const data = await readEncrypted(join27(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -15715,11 +15644,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join28(dbsDir, "parsers");
-  const parserFiles = (await readdir11(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join27(dbsDir, "parsers");
+  const parserFiles = (await readdir10(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join28(parsersDir, file));
+    const data = await readEncrypted(join27(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -16060,7 +15989,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile21(join28(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile20(join27(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -16081,11 +16010,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join28(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join28(dataDir, "services.json"), runeServices);
-  await atomicWrite(join28(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join28(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join28(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join27(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join27(dataDir, "services.json"), runeServices);
+  await atomicWrite(join27(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join27(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join27(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -16096,12 +16025,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries2 = await readdir11(dataDir);
+    const entries2 = await readdir10(dataDir);
     const backupDirs = entries2.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join28(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join27(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile21(keyJsonPath, "utf-8");
+        const raw = await readFile20(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -16122,14 +16051,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve7 } = await import("path");
   const abDataDir = resolve7(dataDir);
   const candidateDirs = [
-    join28(dirname11(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join28(abDataDir, "dbs", "overrides")
+    join27(dirname11(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join27(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir11(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir10(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -16139,7 +16068,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join28(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join27(overridesDir, "..", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
     return false;
@@ -16157,7 +16086,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile21(join28(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile20(join27(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -16176,7 +16105,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile21(join28(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile20(join27(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -16193,7 +16122,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join28(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join27(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -16220,7 +16149,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join28(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join27(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -16230,7 +16159,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join28(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join27(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -16289,7 +16218,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join28(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join27(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -16304,7 +16233,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join29 } from "path";
+import { join as join28 } from "path";
 import { stat as stat12 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -16314,22 +16243,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat12(join29(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat12(join28(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, VERIFY_FILENAME2));
+    await stat12(join28(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, "projects.json"));
+    await stat12(join28(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, "project.json"));
+    await stat12(join28(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -17589,4 +17518,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-6WVQ2FQV.js.map
+//# sourceMappingURL=src-Q3PSCMS7.js.map