@runeya/runeya 2.0.94 → 2.0.95

package/chunk-3MJLS5UY.js

@@ -0,0 +1,1944 @@
+// ../server/src/config/env.ts
+import { z } from "zod";
+import { resolve as resolvePath } from "path";
+var serverPort = z.coerce.number().int().min(1).max(65535).default(4e3).parse(process.env.RUNEYA_HTTP_PORT);
+var defaultAgentPort = process.env.RUNEYA_AGENT_PORT ? z.coerce.number().int().min(1).max(65535).parse(process.env.RUNEYA_AGENT_PORT) : serverPort + 1;
+var EnvSchema = z.object({
+  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).default(4e3),
+  RUNEYA_HOST: z.string().default("127.0.0.1"),
+  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),
+  RUNEYA_AGENT_HOST: z.string().default("127.0.0.1"),
+  RUNEYA_AGENT_BINARY_PATH: z.string().nullable().default(null),
+  RUNEYA_DATA_DIR: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().default(".runeya")),
+  // Home holding the cloud vaults (`<home>/.runeya/orgs/...`). Defaults to the
+  // user's home directory; overridden by tests so they never write to the real
+  // one, and usable to relocate the vaults on a shared machine.
+  RUNEYA_HOME: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().nullable().default(null)),
+  RUNEYA_CLOUD_URL: z.string().url().nullable().default(null),
+  // Cloud front-end (landing) URL — used by the web app for the registration /
+  // onboarding flow. Configured on the server at launch; the web fetches it.
+  RUNEYA_CLOUD_APP_URL: z.string().url().nullable().default(null),
+  RUNEYA_MODE: z.enum(["local-simple", "cloud"]).default("local-simple"),
+  RUNEYA_CORS_ORIGIN: z.string().nullable().default(null),
+  RUNEYA_LAN_PROXY: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false),
+  // Set by the CLI when it was started from a desktop launcher rather than a
+  // terminal. The web app surfaces it so the user knows which Runeya they are
+  // looking at when several are running.
+  RUNEYA_FROM_DESKTOP: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false),
+  // Label shown for this machine in the cloud's "linked machines" screen.
+  // Defaults to the hostname (see `getDeviceName`); set it explicitly when a
+  // single host runs several instances and you want to tell them apart.
+  RUNEYA_DEVICE_NAME: z.preprocess(
+    (v) => typeof v === "string" && v.trim().length > 0 ? v.trim() : void 0,
+    z.string().max(64).nullable().default(null)
+  )
+}).transform((data) => ({
+  ...data,
+  // Short aliases used throughout the server code
+  PORT: data.RUNEYA_HTTP_PORT,
+  HOST: data.RUNEYA_HOST,
+  MODE: data.RUNEYA_MODE,
+  /**
+   * Absolute from the start, resolved once against the launch directory.
+   *
+   * It defaults to a relative `.runeya`, and every caller used to re-resolve it
+   * against whatever the process's cwd happened to be. A vault that moves when
+   * the process changes directory is a vault that can be silently written to the
+   * wrong place — so the answer is fixed here, at boot, and never recomputed.
+   */
+  DATA_DIR: resolvePath(data.RUNEYA_DATA_DIR),
+  HOME_DIR: data.RUNEYA_HOME,
+  CLOUD_URL: data.RUNEYA_CLOUD_URL,
+  CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,
+  CORS_ORIGIN: data.RUNEYA_CORS_ORIGIN,
+  AGENT_BINARY_PATH: data.RUNEYA_AGENT_BINARY_PATH,
+  DEVICE_NAME: data.RUNEYA_DEVICE_NAME,
+  FROM_DESKTOP: data.RUNEYA_FROM_DESKTOP
+}));
+var env = EnvSchema.parse(process.env);
+
+// ../server/src/services/vault-resolver.ts
+import { join, sep } from "path";
+import { homedir } from "os";
+import { readdir, mkdir, access, readFile, writeFile, unlink } from "fs/promises";
+import { existsSync } from "fs";
+var SAFE_ID = /^[A-Za-z0-9._-]{1,128}$/;
+function assertSafeId(kind, id) {
+  if (!SAFE_ID.test(id) || id === "." || id === "..") {
+    throw new Error(`Invalid ${kind} id for a vault path: ${JSON.stringify(id)}`);
+  }
+}
+function machineRoot() {
+  const override = process.env["RUNEYA_HOME"];
+  return join(override && override.length > 0 ? override : homedir(), ".runeya");
+}
+function localVaultRoot() {
+  return env.DATA_DIR;
+}
+function orgVaultRoot(orgId) {
+  assertSafeId("organization", orgId);
+  return join(machineRoot(), "orgs", orgId);
+}
+function projectVaultRoot(orgId, projectId) {
+  assertSafeId("project", projectId);
+  return join(orgVaultRoot(orgId), "projects", projectId);
+}
+function orgIdOfRoot(root) {
+  const marker = join(machineRoot(), "orgs") + sep;
+  if (!root.startsWith(marker)) return null;
+  const [orgId] = root.slice(marker.length).split(sep);
+  return orgId && SAFE_ID.test(orgId) ? orgId : null;
+}
+function vaultIdOfRoot(root) {
+  return orgIdOfRoot(root) ?? void 0;
+}
+function vaultFor(target) {
+  if (!target.orgId) return { root: localVaultRoot() };
+  return { root: projectVaultRoot(target.orgId, target.id) };
+}
+var ORG_CLOUD_FILE = "cloud.json";
+async function stampOrgCloud(orgId, cloudUrl, name) {
+  const root = orgVaultRoot(orgId);
+  await mkdir(root, { recursive: true });
+  const known = name ?? (await readOrgNames())[orgId];
+  const stamp = known ? { cloudUrl, name: known } : { cloudUrl };
+  await writeFile(join(root, ORG_CLOUD_FILE), JSON.stringify(stamp, null, 2), "utf-8");
+}
+async function rememberOrgName(orgId, name) {
+  const root = orgVaultRoot(orgId);
+  if (!existsSync(root)) return;
+  const file = join(root, ORG_CLOUD_FILE);
+  let stamp = {};
+  try {
+    stamp = JSON.parse(await readFile(file, "utf-8"));
+  } catch {
+  }
+  if (stamp["name"] === name) return;
+  await writeFile(file, JSON.stringify({ ...stamp, name }, null, 2), "utf-8");
+}
+async function readOrgNames() {
+  const out = {};
+  for (const orgId of await listOrgVaults()) {
+    try {
+      const raw = await readFile(join(orgVaultRoot(orgId), ORG_CLOUD_FILE), "utf-8");
+      const name = JSON.parse(raw).name;
+      if (typeof name === "string" && name) out[orgId] = name;
+    } catch {
+    }
+  }
+  return out;
+}
+var ORG_LOGO_FILE = "logo.json";
+var LOGO_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp", "image/gif"]);
+async function rememberOrgLogo(orgId, contentType, base64) {
+  if (!LOGO_TYPES.has(contentType)) return;
+  const root = orgVaultRoot(orgId);
+  const stored = { contentType, base64, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await mkdir(root, { recursive: true });
+  await writeFile(join(root, ORG_LOGO_FILE), JSON.stringify(stored), "utf-8");
+}
+async function forgetOrgLogo(orgId) {
+  try {
+    await unlink(join(orgVaultRoot(orgId), ORG_LOGO_FILE));
+  } catch {
+  }
+}
+async function readOrgLogos() {
+  const out = {};
+  for (const orgId of await listOrgVaults()) {
+    try {
+      const raw = await readFile(join(orgVaultRoot(orgId), ORG_LOGO_FILE), "utf-8");
+      const { contentType, base64 } = JSON.parse(raw);
+      if (typeof contentType !== "string" || !LOGO_TYPES.has(contentType)) continue;
+      if (typeof base64 !== "string" || !base64) continue;
+      out[orgId] = `data:${contentType};base64,${base64}`;
+    } catch {
+    }
+  }
+  return out;
+}
+async function readOrgClouds() {
+  const orgsDir = join(machineRoot(), "orgs");
+  const out = {};
+  let orgIds;
+  try {
+    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return out;
+  }
+  for (const orgId of orgIds) {
+    try {
+      const raw = await readFile(join(orgsDir, orgId, ORG_CLOUD_FILE), "utf-8");
+      const url = JSON.parse(raw).cloudUrl;
+      if (typeof url === "string" && url) out[orgId] = url;
+    } catch {
+    }
+  }
+  return out;
+}
+async function listOrgVaults() {
+  const orgsDir = join(machineRoot(), "orgs");
+  try {
+    return (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+async function listCloudVaults() {
+  const orgsDir = join(machineRoot(), "orgs");
+  const found = [];
+  let orgIds;
+  try {
+    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return found;
+  }
+  for (const orgId of orgIds) {
+    const projectsDir = join(orgsDir, orgId, "projects");
+    try {
+      for (const entry of await readdir(projectsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || !SAFE_ID.test(entry.name)) continue;
+        const root = join(projectsDir, entry.name);
+        if (!await access(join(root, "project.json")).then(() => true, () => false)) continue;
+        found.push({ orgId, projectId: entry.name, root });
+      }
+    } catch {
+    }
+  }
+  return found;
+}
+async function allVaultRoots() {
+  const cloud = await listCloudVaults();
+  return [localVaultRoot(), ...cloud.map((v) => v.root)];
+}
+function machineFilePath(filename) {
+  return join(machineRoot(), filename);
+}
+async function keyedFilePath(filename) {
+  return join(await keyRoot(), filename);
+}
+function legacyMachineFilePath(filename) {
+  return join(localVaultRoot(), filename);
+}
+async function ensureLocalVault() {
+  const root = localVaultRoot();
+  await mkdir(root, { recursive: true });
+  return root;
+}
+var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
+var keyRootPromise = null;
+async function holdsKey(root) {
+  for (const filename of KEY_FILES) {
+    try {
+      await access(join(root, filename));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function keyRoot() {
+  keyRootPromise ??= (async () => {
+    if (await holdsKey(machineRoot())) return machineRoot();
+    return await holdsKey(localVaultRoot()) ? localVaultRoot() : machineRoot();
+  })();
+  return keyRootPromise;
+}
+async function legacyVaultRoot() {
+  const local = localVaultRoot();
+  if (await keyRoot() === local) return null;
+  return await holdsKey(local) ? local : null;
+}
+
+// ../../packages/shared/src/schemas/settings.schema.ts
+import { z as z3 } from "zod";
+
+// ../../packages/shared/src/schemas/scenario.schema.ts
+import { z as z2 } from "zod";
+var PositionSchema = z2.object({
+  x: z2.number(),
+  y: z2.number()
+});
+var ScenarioGroupSchema = z2.object({
+  id: z2.string().min(1).max(128),
+  name: z2.string().min(1).max(200),
+  description: z2.string().max(1e3).optional(),
+  color: z2.string().max(32).optional(),
+  position: PositionSchema.default({ x: 0, y: 0 }),
+  width: z2.number().default(300),
+  height: z2.number().default(200)
+});
+var ScenarioPresetRoleSchema = z2.object({
+  id: z2.string().min(1).max(64),
+  name: z2.string().min(1).max(200),
+  systemPrompt: z2.string().max(1e4).default(""),
+  prompt: z2.string().max(1e4).default("")
+});
+var ScenarioPresetInitialDataSchema = z2.object({
+  leaderId: z2.string().min(1).max(128),
+  groups: z2.array(z2.object({
+    id: z2.string().min(1).max(128),
+    name: z2.string().min(1).max(200),
+    description: z2.string().max(1e3).optional(),
+    color: z2.string().max(32).optional(),
+    position: z2.object({ x: z2.number(), y: z2.number() }).default({ x: 0, y: 0 }),
+    width: z2.number().default(300),
+    height: z2.number().default(200)
+  })).max(100).default([]),
+  nodes: z2.array(z2.object({
+    id: z2.string().min(1).max(128),
+    type: z2.enum(["ai", "ask"]).default("ai"),
+    parentIds: z2.array(z2.string().max(128)).default([]),
+    groupId: z2.string().max(128).nullable().default(null),
+    label: z2.string().max(240).default(""),
+    role: z2.string().max(64).default("other"),
+    prompt: z2.string().max(5e4).default(""),
+    question: z2.string().max(2e3).default(""),
+    autoGenerated: z2.boolean().default(true),
+    canAddNode: z2.boolean().default(false),
+    aiCli: z2.enum(["claude-code", "codex"]).default("claude-code"),
+    model: z2.string().max(128).default("sonnet"),
+    position: z2.object({ x: z2.number(), y: z2.number() }).default({ x: 0, y: 0 })
+  })).min(1).max(500)
+});
+var LocalizedStringSchema = z2.record(z2.string(), z2.string().max(100));
+var ScenarioPresetLabelsSchema = z2.object({
+  group: LocalizedStringSchema.optional(),
+  node: LocalizedStringSchema.optional(),
+  role: LocalizedStringSchema.optional(),
+  leader: LocalizedStringSchema.optional()
+});
+var ScenarioPresetSchema = z2.object({
+  id: z2.string().min(1).max(128),
+  name: z2.string().min(1).max(200),
+  icon: z2.string().max(64).optional(),
+  defaultTraversalMode: z2.enum(["hierarchical", "topological"]).optional(),
+  canChangeTraversalMode: z2.boolean().default(true),
+  roles: z2.array(ScenarioPresetRoleSchema).min(1).max(100),
+  initialData: ScenarioPresetInitialDataSchema.optional(),
+  labels: ScenarioPresetLabelsSchema.optional()
+});
+var ScenarioNodeSchema = z2.object({
+  id: z2.string().min(1).max(128),
+  type: z2.enum(["ai", "ask"]).default("ai"),
+  parentIds: z2.array(z2.string().max(128)).default([]),
+  groupId: z2.string().max(128).nullable().default(null),
+  label: z2.string().max(240).default(""),
+  role: z2.string().max(64).default("other"),
+  prompt: z2.string().max(5e4).default(""),
+  question: z2.string().max(2e3).default(""),
+  autoGenerated: z2.boolean().default(true),
+  canAddNode: z2.boolean().default(false),
+  aiCli: z2.enum(["claude-code", "codex"]).default("claude-code"),
+  model: z2.string().max(128).default("sonnet"),
+  position: PositionSchema.default({ x: 0, y: 0 }),
+  injectParentOutputs: z2.boolean().default(false),
+  injectedAncestorIds: z2.array(z2.string().max(128)).default([])
+});
+var ScenarioSchema = z2.object({
+  id: z2.string().min(1).max(128),
+  name: z2.string().min(1).max(200),
+  icon: z2.string().max(64).optional(),
+  description: z2.string().max(2e3).optional(),
+  leaderId: z2.string().min(1).max(128),
+  groups: z2.array(ScenarioGroupSchema).max(100).default([]),
+  nodes: z2.array(ScenarioNodeSchema).min(1).max(500),
+  traversalMode: z2.enum(["hierarchical", "topological"]).default("hierarchical"),
+  presetId: z2.string().max(128).optional(),
+  isPublished: z2.boolean().default(false),
+  createdAt: z2.number(),
+  updatedAt: z2.number()
+});
+
+// ../../packages/shared/src/schemas/settings.schema.ts
+var AI_PROVIDERS = ["anthropic", "openai", "mistral", "groq", "ollama"];
+var AIProviderSchema = z3.object({
+  id: z3.string().min(1).max(128),
+  name: z3.string().min(1).max(200),
+  provider: z3.enum(AI_PROVIDERS),
+  encryptedApiKey: z3.string().max(2e3).default(""),
+  model: z3.string().max(200).optional(),
+  active: z3.boolean().default(false),
+  createdAt: z3.coerce.date(),
+  updatedAt: z3.coerce.date()
+});
+var JSLogParserSchema = z3.object({
+  id: z3.string().min(1).max(128),
+  name: z3.string().min(1).max(200),
+  description: z3.string().max(2e3).optional(),
+  code: z3.string().min(1).max(5e4).refine(
+    (s) => !s.includes("require(") && !s.includes("import ") && !s.includes("eval("),
+    { message: "Code must not contain require, import, or eval patterns" }
+  ),
+  enabled: z3.boolean().default(true),
+  builtin: z3.boolean().optional(),
+  createdAt: z3.coerce.date(),
+  updatedAt: z3.coerce.date()
+});
+var NotificationPreferencesSchema = z3.object({
+  scenario_waiting_input: z3.boolean().default(true),
+  ai_conversation_complete: z3.boolean().default(true),
+  ai_conversation_error: z3.boolean().default(true),
+  service_error_log: z3.boolean().default(true),
+  service_status_changed: z3.boolean().default(true),
+  service_health_changed: z3.boolean().default(true),
+  /** Service IDs excluded from error-log notifications */
+  service_error_log_excluded: z3.array(z3.string().max(100)).max(500).default([]),
+  /** Service IDs excluded from status-change notifications */
+  service_status_changed_excluded: z3.array(z3.string().max(100)).max(500).default([]),
+  /** Service IDs excluded from health-change notifications */
+  service_health_changed_excluded: z3.array(z3.string().max(100)).max(500).default([])
+});
+var CompanionSettingsSchema = z3.object({
+  /** Activer le compagnon d'office sur les conversations créées ensuite. */
+  enabledByDefault: z3.boolean().default(false),
+  /**
+   * Consignes envoyées au compagnon, à la place des nôtres.
+   *
+   * Vide — l'absence — signifie « celles de Runeya ». On ne recopie pas le
+   * texte par défaut dans le réglage : figé le jour où il est enregistré, il ne
+   * profiterait plus jamais des corrections apportées au nôtre.
+   *
+   * Rejeté au-delà de la borne plutôt que tronqué (§1) : un prompt coupé en
+   * plein milieu produirait des relectures incohérentes sans rien signaler.
+   */
+  prompt: z3.string().max(2e4).optional()
+});
+var SettingsSchema = z3.object({
+  mode: z3.enum(["local-simple", "cloud"]),
+  cloudUrl: z3.string().url().max(2048).nullable().optional(),
+  logParsers: z3.array(JSLogParserSchema).max(100).default([]),
+  scenarios: z3.array(ScenarioSchema).max(100).default([]),
+  /** Absolute path to the folder where the global wiki/docs markdown files live. Optional. */
+  globalDocsPath: z3.string().max(4096).optional(),
+  /**
+   * Optionnel plutôt que défauté : un réglage absent est un réglage jamais
+   * touché, et le rendre obligatoire dans le type forcerait chaque appelant qui
+   * construit un objet de réglages à inventer une valeur.
+   */
+  companion: CompanionSettingsSchema.optional()
+});
+var TraefikConfigSchema = z3.object({
+  enabled: z3.boolean().default(false),
+  acmeEmail: z3.string().email().max(256).optional(),
+  wildcardDomain: z3.string().max(253).optional(),
+  httpPort: z3.number().int().min(1).max(65535).default(80),
+  httpsPort: z3.number().int().min(1).max(65535).default(443),
+  dnsProvider: z3.string().max(64).optional(),
+  dnsCredentials: z3.record(z3.string().max(64), z3.string().max(2048)).default({}),
+  acmeStaging: z3.boolean().default(false),
+  encryptedCert: z3.string().max(65536).optional(),
+  encryptedCertKey: z3.string().max(65536).optional()
+});
+var SettingsPrivateSchema = z3.object({
+  aiProviders: z3.array(AIProviderSchema).max(50).default([]),
+  scenarios: z3.array(ScenarioSchema).max(100).default([]),
+  notifications: NotificationPreferencesSchema.default(() => ({
+    scenario_waiting_input: true,
+    ai_conversation_complete: true,
+    ai_conversation_error: true,
+    service_error_log: true,
+    service_status_changed: true,
+    service_health_changed: true,
+    service_error_log_excluded: [],
+    service_status_changed_excluded: [],
+    service_health_changed_excluded: []
+  })),
+  traefikConfig: TraefikConfigSchema.optional()
+});
+var SchemaVersionSchema = z3.object({
+  version: z3.number().int().positive(),
+  migratedAt: z3.coerce.date()
+});
+
+// ../../packages/shared/src/utils/companion-markers.ts
+var COMPANION_RELAY_OPEN = "[RUNEYA_COMPAGNON_RESPONSE]";
+var COMPANION_RELAY_CLOSE = "[/RUNEYA_COMPAGNON_RESPONSE]";
+function extractCompanionRelay(raw) {
+  const text = (raw ?? "").trim();
+  const open = text.lastIndexOf(COMPANION_RELAY_OPEN);
+  if (open === -1) return null;
+  const after = text.slice(open + COMPANION_RELAY_OPEN.length);
+  const close = after.indexOf(COMPANION_RELAY_CLOSE);
+  const inner = (close === -1 ? after : after.slice(0, close)).trim();
+  return inner || null;
+}
+
+// ../../packages/shared/src/constants/intervals.ts
+var AGENT_HEALTH_POLL_INTERVAL = 15e3;
+
+// ../../packages/shared/src/constants/timeouts.ts
+var GRACE_PERIOD = 1e4;
+var AGENT_FETCH_TIMEOUT = 1e4;
+var AGENT_LONG_FETCH_TIMEOUT = 6e5;
+var AGENT_STOP_FETCH_TIMEOUT = GRACE_PERIOD + 15e3;
+var PASSPHRASE_TIMEOUT = 3e4;
+var WS_RECONNECT_MIN = 1e3;
+var WS_RECONNECT_MAX = 15e3;
+
+// ../../packages/shared/src/schemas/user.schema.ts
+import { z as z4 } from "zod";
+var UserSchema = z4.object({
+  id: z4.string().max(128),
+  email: z4.string().email().max(320),
+  name: z4.string().min(1).max(500),
+  avatar: z4.string().url().max(2048).nullable().optional()
+});
+
+// ../../packages/shared/src/schemas/org.schema.ts
+import { z as z5 } from "zod";
+var OrgSchema = z5.object({
+  id: z5.string().max(128),
+  name: z5.string().min(1).max(100),
+  slug: z5.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+  ownerId: z5.string().max(128)
+});
+var OrgMemberSchema = z5.object({
+  id: z5.string().max(128),
+  orgId: z5.string().max(128),
+  userId: z5.string().max(128),
+  globalRole: z5.enum(["owner", "admin", "member"]),
+  invitedAt: z5.coerce.date(),
+  joinedAt: z5.coerce.date().nullable().optional()
+});
+
+// ../../packages/shared/src/schemas/project.schema.ts
+import { z as z6 } from "zod";
+var ProjectSchema = z6.object({
+  id: z6.string().max(128),
+  orgId: z6.string().max(128).nullable().optional(),
+  name: z6.string().min(1).max(200),
+  description: z6.string().max(1e4).optional().default(""),
+  serviceIds: z6.array(z6.string().max(128)).max(1e4).default([]),
+  // Environment support
+  // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
+  // It's initialized to 'local' by default at load time
+  activeEnvironmentId: z6.string().max(128).optional(),
+  environmentIds: z6.array(z6.string().max(128)).max(100).default([]),
+  // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
+  // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
+  groupOrder: z6.array(z6.string().max(200)).max(100).default([])
+});
+var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
+var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
+
+// ../../packages/shared/src/schemas/service.schema.ts
+import { z as z8 } from "zod";
+
+// ../../packages/shared/src/schemas/log-source.schema.ts
+import { z as z7 } from "zod";
+var safePath = z7.string().min(1).max(4096).refine(
+  (p) => !p.includes("\0"),
+  { message: "path must not contain null bytes" }
+).refine(
+  (p) => !/(^|[/\\])\.\.([/\\]|$)/.test(p),
+  { message: "path must not contain path-traversal sequences (..)" }
+);
+var ConsoleLogSourceSchema = z7.object({
+  type: z7.literal("console")
+});
+var FileLogSourceSchema = z7.object({
+  type: z7.literal("file"),
+  path: safePath,
+  encoding: z7.string().max(32).default("utf-8"),
+  startFromEnd: z7.boolean().default(true),
+  createIfNotExists: z7.boolean().default(false)
+});
+var MongoLogSourceSchema = z7.object({
+  type: z7.literal("mongo"),
+  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
+  connectionString: z7.string().min(1).max(2048),
+  database: z7.string().min(1).max(256),
+  collection: z7.string().min(1).max(256),
+  filter: z7.record(z7.string(), z7.unknown()).optional(),
+  timestampField: z7.string().max(128).default("timestamp"),
+  messageField: z7.string().max(128).default("message"),
+  levelField: z7.string().max(128).optional()
+});
+var MySQLLogSourceSchema = z7.object({
+  type: z7.literal("mysql"),
+  host: z7.string().min(1).max(253),
+  port: z7.number().int().min(1).max(65535).default(3306),
+  user: z7.string().min(1).max(256),
+  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
+  password: z7.string().max(2048),
+  database: z7.string().min(1).max(256),
+  table: z7.string().min(1).max(256),
+  query: z7.string().max(8192).optional(),
+  timestampColumn: z7.string().max(128).default("created_at"),
+  messageColumn: z7.string().max(128).default("message"),
+  levelColumn: z7.string().max(128).optional(),
+  pollIntervalMs: z7.number().int().min(500).max(6e4).default(2e3)
+});
+var LogSourceConfigSchema = z7.discriminatedUnion("type", [
+  ConsoleLogSourceSchema,
+  FileLogSourceSchema,
+  MongoLogSourceSchema,
+  MySQLLogSourceSchema
+]);
+
+// ../../packages/shared/src/schemas/service.schema.ts
+var HealthCheckSchema = z8.object({
+  type: z8.enum(["http", "command"]).default("http"),
+  // HTTP-specific (required when type=http)
+  path: z8.string().min(1).max(500).startsWith("/").optional(),
+  method: z8.enum(["GET", "HEAD", "POST", "PUT"]).optional().default("GET"),
+  expectedStatus: z8.number().int().min(100).max(599).optional().default(200),
+  // Command-specific (required when type=command)
+  command: z8.string().min(1).max(4096).optional(),
+  // Shared
+  interval: z8.number().int().positive().default(1e3),
+  timeout: z8.number().int().positive().default(1e3),
+  retries: z8.number().int().nonnegative().default(3),
+  initialDelay: z8.number().int().nonnegative().optional().default(0)
+}).refine(
+  (data) => data.type === "http" ? !!data.path : !!data.command,
+  { message: "HTTP type requires path; command type requires command" }
+);
+var BootstrapCommandSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  entrypoint: z8.string().max(4096).optional(),
+  command: z8.string().max(4096).default(""),
+  user: z8.string().max(256).optional()
+});
+var DockerConfigSchema = z8.object({
+  // Image mode (pull from registry) — mutually exclusive with build mode in UI
+  image: z8.string().min(1).max(1024).optional(),
+  // Build mode — Dockerfile stored inline in services.json
+  dockerfile: z8.string().max(65536).optional(),
+  buildContext: z8.string().max(4096).optional(),
+  buildArgs: z8.record(z8.string().max(256), z8.string().max(4096)).default({}).refine(
+    (obj) => Object.keys(obj).length <= 50,
+    { message: "Max 50 build args" }
+  ),
+  targetStage: z8.string().max(256).optional(),
+  // Runtime config
+  networkMode: z8.enum(["host", "bridge"]).default("host"),
+  ports: z8.array(z8.string().max(64)).max(100).default([]),
+  volumes: z8.array(z8.string().max(1024)).max(100).default([]),
+  mountRootpath: z8.boolean().default(false),
+  entrypoint: z8.string().max(4096).optional(),
+  command: z8.string().max(4096).optional(),
+  user: z8.string().max(256).optional(),
+  useNativeCommand: z8.boolean().default(false),
+  nativeCommandMode: z8.enum(["shared", "isolated"]).default("isolated"),
+  nativeShell: z8.string().max(256).default("sh"),
+  bootstrapCommands: z8.array(BootstrapCommandSchema).max(20).default([])
+});
+var RestartStrategySchema = z8.enum(["none", "on-failure", "always", "unless-stopped"]).default("none");
+var ServiceShortcutSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  command: z8.string().max(4096).default(""),
+  cwd: z8.string().max(4096).optional()
+});
+var ServiceCommandSchema = z8.object({
+  id: z8.string().min(1).max(64),
+  label: z8.string().max(200).default(""),
+  command: z8.string().max(4096).default(""),
+  cwd: z8.string().max(4096).optional(),
+  shell: z8.boolean().optional().default(true)
+});
+var VariableSlotSchema = z8.object({
+  value: z8.string().max(8192).default(""),
+  pre: z8.string().max(8192).default(""),
+  post: z8.string().max(8192).default(""),
+  isSecret: z8.boolean().default(false),
+  // When true, this variable is injected into the process environment of AI
+  // agents (Claude Code, Codex, …) spawned while this environment is active.
+  // Opt-in: defaults to false so secrets are never leaked to AI agents by default.
+  injectIntoAi: z8.boolean().default(false)
+});
+var VariableSchema = z8.object({
+  key: z8.string().min(1).max(256),
+  value: VariableSlotSchema
+});
+var VariablesRecordSchema = z8.record(
+  z8.string().max(128),
+  VariableSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variables" }
+);
+var VariableSlotsRecordSchema = z8.record(
+  z8.string().max(256),
+  VariableSlotSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variable slots" }
+);
+var ServiceConfigSchema = z8.object({
+  id: z8.string().max(128),
+  orgId: z8.string().max(128).nullable().optional(),
+  agentId: z8.string().max(128).optional(),
+  // Optional: if absent, inherited from active environment's agentId
+  name: z8.string().min(1).max(200),
+  commands: z8.array(ServiceCommandSchema).max(50).optional().default([]),
+  cwd: z8.string().max(4096).optional(),
+  ports: z8.array(z8.number().int().positive().max(65535)).max(20).optional().default([]),
+  // Metadata fields (migration from old Runeya)
+  groups: z8.array(z8.string().max(200)).max(20).optional().default([]),
+  description: z8.string().max(2e3).optional(),
+  /** Path (relative to service.cwd or absolute) where the service's docs/wiki markdown files live. Optional — defaults to service.cwd. */
+  docsPath: z8.string().max(4096).optional(),
+  url: z8.string().max(2048).optional(),
+  localUrls: z8.array(z8.object({
+    url: z8.string().max(253).regex(/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/),
+    port: z8.number().int().min(1).max(65535)
+  })).max(20).optional().default([]),
+  openapiUrl: z8.string().max(2048).optional(),
+  git: z8.object({
+    remote: z8.string().max(2048).optional(),
+    home: z8.string().max(2048).optional()
+  }).optional(),
+  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  // Transient env dict (resolved by server before deployment, used directly by agent runner — NOT persisted)
+  env: z8.record(z8.string().max(256), z8.string().max(8192)).default({}).refine(
+    (obj) => Object.keys(obj).length <= 200,
+    { message: "Too many env vars (max 200)" }
+  ),
+  envSecrets: z8.array(z8.string().max(256)).max(200).default([]),
+  // Transient: resolved JS log parsers (from parserIds, resolved by server before deployment — NOT persisted)
+  resolvedLogParsers: z8.array(JSLogParserSchema).default([]).optional(),
+  // Transient: resolved working directory (cwd with env vars expanded — NOT persisted)
+  resolvedCwd: z8.string().optional(),
+  runner: z8.enum(["native", "docker"]).optional().default("native"),
+  dockerConfig: DockerConfigSchema.optional(),
+  healthCheck: HealthCheckSchema.optional(),
+  parserIds: z8.array(z8.string().max(128)).max(50).default([]),
+  shortcuts: z8.array(ServiceShortcutSchema).max(50).optional().default([]),
+  autoRestart: z8.boolean().optional().default(false),
+  clearLogsOnStart: z8.boolean().optional().default(false),
+  restartStrategy: RestartStrategySchema.optional(),
+  maxRestarts: z8.number().int().nonnegative().optional(),
+  restartBackoffMs: z8.number().int().positive().optional().default(1e3),
+  // Log sources additionnelles (au-delà du stdout/stderr console par défaut)
+  logSources: z8.array(LogSourceConfigSchema).max(20).optional().default([])
+});
+var CreateServiceSchema = ServiceConfigSchema.omit({ id: true }).partial().required({ name: true });
+var UpdateServiceSchema = ServiceConfigSchema.partial().required({ id: true }).extend({
+  agentId: z8.string().max(128).nullable().optional(),
+  // null = clear (inherit from env), undefined = no change
+  cwd: z8.string().max(4096).nullable().optional(),
+  git: z8.object({ remote: z8.string().max(2048).optional(), home: z8.string().max(2048).optional() }).nullable().optional(),
+  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+  healthCheck: HealthCheckSchema.nullable().optional()
+});
+
+// ../../packages/shared/src/schemas/process.schema.ts
+import { z as z9 } from "zod";
+var ProcessStateSchema = z9.enum(["starting", "running", "stopped", "errored"]);
+var HealthStatusSchema = z9.enum(["healthy", "unhealthy", "unknown"]);
+var ProcessStatusSchema = z9.object({
+  id: z9.string().max(128),
+  serviceId: z9.string().max(128),
+  agentId: z9.string().max(128),
+  state: ProcessStateSchema,
+  pid: z9.number().int().nullable().optional(),
+  pids: z9.array(z9.number().int()).optional().default([]),
+  exitCode: z9.number().int().nullable().optional(),
+  startedAt: z9.coerce.date().nullable().optional(),
+  restartCount: z9.number().int().nonnegative().default(0),
+  uptime: z9.number().nonnegative().default(0),
+  healthStatus: HealthStatusSchema.default("unknown"),
+  /**
+   * Le répertoire où le processus s'exécute VRAIMENT, absolutisé par l'agent.
+   *
+   * Rapporté par l'agent plutôt que déduit de la config : entre le `cwd` de la
+   * commande, celui du service, l'ancrage sur le projet et les variables que
+   * l'agent étend lui-même, la valeur affichée n'aurait rien prouvé. Ce qui
+   * intéresse quand un service tourne contre le mauvais dépôt, c'est le chemin
+   * final — y compris quand il retombe sur le répertoire de l'agent.
+   */
+  cwd: z9.string().max(4096).nullable().optional()
+});
+
+// ../../packages/shared/src/schemas/log.schema.ts
+import { z as z10 } from "zod";
+var LogLevelSchema = z10.enum(["debug", "info", "warn", "error", "fatal"]);
+var LogLineSchema = z10.object({
+  /** Raw log line as received from the process (immutable context) */
+  raw: z10.string(),
+  /** Source stream (immutable context) */
+  stream: z10.enum(["stdout", "stderr"]),
+  /** Severity level */
+  level: LogLevelSchema,
+  /** Parsed/enriched message to display */
+  message: z10.string(),
+  /** When true, the line is hidden from the log view */
+  hidden: z10.boolean(),
+  /** Arbitrary key/value pairs shown in the detail panel */
+  metadata: z10.record(z10.string().max(256), z10.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  /** Full parsed JSON object when the line is JSON */
+  json: z10.record(z10.string(), z10.unknown()).optional(),
+  /** Custom header for the JSON log card (supports HTML, sanitized before display) */
+  jsonHeader: z10.string().max(256).optional()
+});
+var LogCardDirectiveSchema = z10.object({
+  id: z10.string().max(128),
+  type: z10.string().max(64),
+  header: z10.string().max(256),
+  collapsable: z10.boolean().optional(),
+  collapsed: z10.boolean().optional(),
+  state: z10.enum(["open", "append", "close", "self"])
+});
+var ParsedLogSchema = z10.object({
+  id: z10.string().max(128),
+  processId: z10.string().max(128),
+  pid: z10.number().int().nullable().optional(),
+  timestamp: z10.coerce.date(),
+  level: LogLevelSchema.default("info"),
+  message: z10.string().max(16384),
+  raw: z10.string().max(16384),
+  stream: z10.enum(["stdout", "stderr"]).default("stdout"),
+  hidden: z10.boolean().optional().default(false),
+  metadata: z10.record(z10.string().max(256), z10.unknown()).optional().refine(
+    (obj) => !obj || Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  json: z10.record(z10.string(), z10.unknown()).optional(),
+  logCard: LogCardDirectiveSchema.optional(),
+  sourceType: z10.enum(["console", "file", "mongo", "mysql"]).optional(),
+  sourcePath: z10.string().max(4096).optional()
+});
+
+// ../../packages/shared/src/schemas/agent.schema.ts
+import { z as z11 } from "zod";
+var ENV_VAR_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var AgentConfigSchema = z11.object({
+  id: z11.string().max(128),
+  name: z11.string().min(1).max(100),
+  url: z11.string().url().max(2048),
+  passphrase: z11.string().min(1).max(1024),
+  passthroughEnv: z11.array(
+    z11.string().regex(ENV_VAR_NAME_REGEX).max(256)
+  ).max(100).default([])
+});
+var AgentStatusSchema = z11.object({
+  connected: z11.boolean(),
+  lastSeen: z11.string().nullable().optional(),
+  uptime: z11.number().nonnegative().default(0),
+  runnersAvailable: z11.array(z11.enum(["native", "docker"])).default(["native"]),
+  lanIp: z11.string().optional(),
+  /**
+   * Ce que la machine de l'agent vaut pour les builtins de portée `agent`.
+   * Sert à PRÉVISUALISER — la valeur injectée reste calculée au lancement, par
+   * l'agent lui-même : une IP change, un agent se déconnecte, et un statut
+   * n'est qu'un cliché.
+   */
+  os: z11.string().max(64).optional(),
+  home: z11.string().max(4096).optional(),
+  cwd: z11.string().max(4096).optional()
+});
+
+// ../../packages/shared/src/schemas/permission.schema.ts
+import { z as z12 } from "zod";
+var GlobalRoleSchema = z12.enum(["owner", "admin", "member"]);
+var ProjectRoleSchema = z12.enum(["admin", "editor", "viewer"]);
+var ProjectMemberRoleSchema = z12.object({
+  id: z12.string().max(128),
+  projectId: z12.string().max(128),
+  userId: z12.string().max(128),
+  role: ProjectRoleSchema
+});
+
+// ../../packages/shared/src/schemas/sync.schema.ts
+import { z as z13 } from "zod";
+var ConfigVersionSchema = z13.object({
+  id: z13.string().max(128),
+  entityType: z13.enum(["project", "service"]),
+  entityId: z13.string().max(128),
+  version: z13.string().max(128),
+  parentVersion: z13.string().max(128),
+  data: z13.record(z13.string(), z13.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 1e3,
+    "Too many data keys (max 1000)"
+  ),
+  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3),
+  userId: z13.string().max(128),
+  timestamp: z13.coerce.date(),
+  resolved: z13.boolean().default(false)
+});
+var ConfigChangeSchema = z13.object({
+  entityType: z13.enum(["project", "service"]),
+  entityId: z13.string().max(128),
+  version: z13.string().max(128),
+  parentVersion: z13.string().max(128),
+  data: z13.record(z13.string(), z13.unknown()).refine(
+    (obj) => Object.keys(obj).length <= 1e3,
+    "Too many data keys (max 1000)"
+  ),
+  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3)
+});
+var SyncStatusSchema = z13.object({
+  connected: z13.boolean(),
+  lastSync: z13.coerce.date().nullable().optional(),
+  pendingChanges: z13.number().int().nonnegative().default(0),
+  conflicts: z13.number().int().nonnegative().default(0)
+});
+
+// ../../packages/shared/src/schemas/audit.schema.ts
+import { z as z14 } from "zod";
+var AuditActionSchema = z14.enum([
+  "create",
+  "update",
+  "delete",
+  "invite",
+  "remove",
+  "deploy",
+  "start",
+  "stop",
+  "roleChange"
+]);
+var AuditEntityTypeSchema = z14.enum([
+  "org",
+  "project",
+  "service",
+  "member",
+  "permission"
+]);
+var AuditLogSchema = z14.object({
+  id: z14.string().max(128),
+  orgId: z14.string().max(128),
+  userId: z14.string().max(128),
+  action: AuditActionSchema,
+  entityType: AuditEntityTypeSchema,
+  entityId: z14.string().max(128),
+  metadata: z14.record(z14.string().max(256), z14.unknown()).default({}).refine(
+    (obj) => Object.keys(obj).length <= 100,
+    { message: "Too many metadata keys (max 100)" }
+  ),
+  timestamp: z14.coerce.date()
+});
+
+// ../../packages/shared/src/schemas/metrics.schema.ts
+import { z as z15 } from "zod";
+var ProcessMetricsSchema = z15.object({
+  processId: z15.string().max(128),
+  cpu: z15.number().nonnegative(),
+  memory: z15.number().int().nonnegative(),
+  timestamp: z15.string()
+});
+
+// ../../packages/shared/src/schemas/environment.schema.ts
+import { z as z16 } from "zod";
+var EnvironmentVariablesSchema = z16.record(
+  z16.string().max(256),
+  VariableSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 200,
+  { message: "Max 200 variables" }
+);
+var EnvironmentSchema = z16.object({
+  id: z16.string().max(128),
+  projectId: z16.string().max(128),
+  name: z16.string().min(1).max(200),
+  description: z16.string().max(2e3).optional().default(""),
+  parentIds: z16.array(z16.string().max(128)).max(10).default([]),
+  variables: EnvironmentVariablesSchema.default({}),
+  // Scope: 'global' = project-level env, 'service' = per-service env
+  scope: z16.enum(["global", "service"]).default("global"),
+  // When scope='service': the serviceId this env belongs to
+  reference: z16.string().max(128).optional(),
+  // When scope='service': the globalEnvId this env activates on
+  activateOn: z16.string().max(128).optional(),
+  immutable: z16.boolean().default(false),
+  default: z16.boolean().optional().default(false),
+  color: z16.string().max(20).optional(),
+  bgColor: z16.string().max(20).optional(),
+  // When scope='global': the default agent used by services that don't have an explicit agentId
+  agentId: z16.string().max(128).optional()
+});
+var ResolvedEnvironmentSchema = z16.object({
+  variables: z16.record(z16.string().max(256), VariableSchema).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved variables" }),
+  env: z16.record(z16.string().max(256), z16.string().max(8192)).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved env vars" }),
+  envSecrets: z16.array(z16.string().max(256)).max(500),
+  sources: z16.record(z16.string().max(256), z16.object({
+    environmentId: z16.string().max(128),
+    environmentName: z16.string().max(200),
+    overridden: z16.boolean(),
+    resolvedFrom: z16.object({
+      environmentId: z16.string().max(128),
+      environmentName: z16.string().max(200)
+    }).optional(),
+    // Set when a machine-local override was applied to this variable, pointing
+    // at the environment that carries the winning override. Distinct from
+    // `overridden`, which also covers "shadows an inherited variable".
+    overriddenBy: z16.object({
+      environmentId: z16.string().max(128),
+      environmentName: z16.string().max(200)
+    }).optional()
+  })).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 source entries" })
+});
+var CreateEnvironmentSchema = EnvironmentSchema.omit({ id: true }).extend({
+  description: z16.string().max(2e3).optional().default(""),
+  parentIds: z16.array(z16.string().max(128)).max(10).optional().default([]),
+  variables: EnvironmentVariablesSchema.optional().default({}),
+  scope: z16.enum(["global", "service"]).optional().default("global"),
+  reference: z16.string().max(128).optional(),
+  activateOn: z16.string().max(128).optional(),
+  immutable: z16.boolean().optional().default(false)
+});
+var UpdateEnvironmentSchema = EnvironmentSchema.partial().required({ id: true }).extend({
+  description: z16.string().max(2e3).optional(),
+  parentIds: z16.array(z16.string().max(128)).max(10).optional(),
+  variables: EnvironmentVariablesSchema.optional(),
+  scope: z16.enum(["global", "service"]).optional(),
+  immutable: z16.boolean().optional(),
+  default: z16.boolean().optional(),
+  agentId: z16.string().max(128).nullable().optional()
+  // null = clear (no default agent)
+});
+
+// ../../packages/shared/src/schemas/environment-overrides.schema.ts
+import { z as z17 } from "zod";
+var VariableOverrideSchema = z17.object({
+  value: VariableSlotSchema
+});
+var EnvironmentOverridesSchema = z17.record(
+  z17.string().max(128),
+  VariableOverrideSchema
+).refine(
+  (obj) => Object.keys(obj).length <= 5e3,
+  { message: "Max 5000 overrides" }
+);
+
+// ../../packages/shared/src/schemas/api-key.schema.ts
+import { z as z18 } from "zod";
+var ApiServiceActionSchema = z18.enum([
+  "service:read",
+  "service:start",
+  "service:stop",
+  "service:restart",
+  "service:healthcheck",
+  "service:status",
+  "logs:read"
+]);
+var ApiEnvActionSchema = z18.enum(["env:read", "env:write"]);
+var ApiEnvPermSchema = z18.object({
+  environmentId: z18.string().max(128),
+  actions: z18.array(ApiEnvActionSchema).max(10).default(["env:read"]),
+  includeSecrets: z18.boolean().default(false)
+});
+var ApiServicePermSchema = z18.object({
+  serviceId: z18.string().max(128),
+  actions: z18.array(ApiServiceActionSchema).max(10).default(["service:read"]),
+  environments: z18.array(ApiEnvPermSchema).max(100).default([])
+});
+var ApiKeyScopeSchema = z18.object({
+  services: z18.array(ApiServicePermSchema).max(500).default([])
+});
+var ApiKeySchema = z18.object({
+  id: z18.string().max(128),
+  name: z18.string().min(1).max(200),
+  key: z18.string().regex(/^[0-9a-f]{64}$/i),
+  scopes: ApiKeyScopeSchema,
+  createdAt: z18.string().max(64),
+  isPublic: z18.boolean().default(false)
+});
+var PersistedApiKeySchema = ApiKeySchema.extend({
+  key: z18.string().min(1).max(4096)
+});
+var ApiKeysFileSchema = z18.object({
+  keys: z18.array(PersistedApiKeySchema).max(100)
+});
+var MaskedApiKeySchema = ApiKeySchema.omit({ key: true }).extend({
+  /** Last 4 characters of the secret, for recognising a key in a list. */
+  keyPreview: z18.string().max(8)
+});
+
+// ../../packages/shared/src/schemas/image.schema.ts
+import { z as z19 } from "zod";
+var ALLOWED_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
+var ImagePartSchema = z19.object({
+  type: z19.literal("image"),
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  altText: z19.string().max(500).optional()
+});
+var ImageUploadResponseSchema = z19.object({
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  url: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z19.string()
+});
+var ImageMetaSchema = z19.object({
+  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
+  filePath: z19.string().min(1),
+  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
+  originalName: z19.string().min(1),
+  createdAt: z19.number().positive(),
+  size: z19.number().positive().optional()
+});
+
+// ../../packages/shared/src/schemas/kanban.schema.ts
+import { z as z20 } from "zod";
+var KanbanAttachmentSchema = z20.object({
+  /** Server-issued id, also the storage key. */
+  id: z20.string().max(128),
+  name: z20.string().max(255),
+  size: z20.number().int().nonnegative(),
+  contentType: z20.string().max(128)
+});
+var KanbanCardEventSchema = z20.object({
+  type: z20.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment", "archived", "unarchived"]),
+  timestamp: z20.string(),
+  /** Extra context: old/new column name, old/new title, comment text, etc. */
+  /**
+   * Le texte de l'entrée : le corps d'un commentaire, ou le contexte du geste.
+   *
+   * Borné comme le corps d'une carte (100 000), et non plus à 5 000 : un
+   * commentaire est de la prose comme une description, et rien de technique ne
+   * justifiait un écart de vingt fois. La borne étroite s'est vue à l'import
+   * d'un Kanbanize, où des commentaires de 12 000 caractères passaient par
+   * l'API publique — bornée, elle, à 20 000 — pour écrire en base une donnée que
+   * ce schéma déclarait invalide, et qu'aucune reprise depuis l'interface
+   * n'aurait ensuite pu enregistrer.
+   */
+  detail: z20.string().max(1e5).optional(),
+  /**
+   * Stable identity of the event, used to tell an edit from an insertion when a
+   * whole history is written back. Absent on events recorded before the field
+   * existed; those fall back to (type, timestamp).
+   */
+  id: z20.string().max(128).optional(),
+  /** Who authored this event — 'ai' or 'user'. Only set for comment events. */
+  author: z20.enum(["ai", "user"]).optional(),
+  /**
+   * Qui est derrière l'événement, estampillé par le serveur — jamais pris du
+   * client, sans quoi n'importe qui pourrait signer au nom d'un autre.
+   *
+   * Posé sur les commentaires (c'est ce qui rend « mon propre commentaire »
+   * répondable ; `author` ne sépare que l'IA de l'humain) et sur les
+   * déplacements. Absent des événements écrits avant qu'on l'estampille : un
+   * lecteur doit donc afficher « on ne sait pas », pas un nom vide.
+   *
+   * Pour une clé d'API, c'est le nom de la clé et non son porteur : la clé
+   * emprunte les droits de son créateur, pas son identité — personne ne doit
+   * croire qu'un humain a déplacé ce qu'un robot de CI a déplacé.
+   */
+  authorUser: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional(),
+  /** Set when the author amended their comment, so the UI can say so. */
+  editedAt: z20.string().optional(),
+  /** Files attached to a comment — same storage as a card's own attachments. */
+  attachments: z20.array(KanbanAttachmentSchema).max(20).optional(),
+  /** Conversation that produced this event (comments only). Used to navigate back to the conversation. */
+  conversationId: z20.string().optional()
+});
+var KanbanCardSchema = z20.object({
+  id: z20.string(),
+  title: z20.string().min(1).max(500),
+  markdown: z20.string().max(1e5).default(""),
+  /**
+   * Legacy inline images, kept so boards written before object storage still
+   * render. New uploads go to `attachments` instead.
+   */
+  images: z20.array(z20.string()).default([]),
+  /** Files attached to the card — stored out of band, referenced here. */
+  attachments: z20.array(KanbanAttachmentSchema).max(50).default([]),
+  order: z20.number().int(),
+  /**
+   * La priorité de la carte, de 1 à 10 — 10 étant le plus urgent.
+   *
+   * Facultative, et absente veut dire « pas de priorité », pas « la plus
+   * basse » : une carte qu'on n'a pas encore arbitrée ne doit pas se ranger
+   * d'office au fond de la pile.
+   */
+  priority: z20.number().int().min(1).max(10).optional(),
+  /**
+   * Les groupes de la carte — des étiquettes libres, posées par l'équipe.
+   *
+   * Rien ne les déclare ailleurs : un groupe existe parce qu'une carte le
+   * porte, et disparaît avec la dernière qui le portait. C'est ce qui permet
+   * d'en créer un en le tapant, sans passer par un écran d'administration.
+   */
+  groups: z20.array(z20.string().min(1).max(60)).max(30).optional(),
+  /**
+   * L'échéance de la carte : le jour où elle est attendue, `AAAA-MM-JJ`.
+   *
+   * Un jour, pas un instant, et c'est une décision : une équipe se dit « pour
+   * vendredi », jamais « pour vendredi 23:59:59 UTC ». Stocker un instant
+   * ferait afficher une échéance au 4 mars comme le 3 mars à qui travaille à
+   * l'ouest de Greenwich — la carte serait en retard d'un jour pour la moitié
+   * de l'équipe, et personne ne saurait pourquoi.
+   *
+   * Facultative, et absente veut dire « pas d'échéance », pas « en retard » :
+   * une carte qu'on n'a pas datée ne doit pas s'annoncer comme urgente.
+   */
+  deadline: z20.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
+  /**
+   * La couleur de la carte, en hexadécimal (`#RRGGBB`) — un liseré en haut de
+   * la carte, et rien d'autre : ce qu'elle veut dire appartient à l'équipe.
+   *
+   * Bornée à une notation stricte plutôt qu'à une chaîne libre : cette valeur
+   * finit dans un attribut `style`, et une couleur ne doit pouvoir contenir
+   * qu'une couleur. Absente sur les cartes sans couleur.
+   */
+  color: z20.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  /**
+   * Le journal de la carte — commentaires compris.
+   *
+   * Optionnel, et c'est tout l'intérêt : c'est la partie qui grossit sans fin
+   * (une IA bavarde y écrit des pages), alors les lectures de tableau ne le
+   * transportent plus. `undefined` veut dire « pas chargé », et une écriture
+   * qui l'omet laisse au serveur celui qu'il a en base — à ne pas confondre
+   * avec `[]`, qui demanderait bel et bien de le vider.
+   */
+  history: z20.array(KanbanCardEventSchema).optional(),
+  /**
+   * Ce que le journal absent laisse quand même dire : combien de commentaires,
+   * et quand fut le dernier. Posés par le serveur en lecture, ignorés en
+   * écriture — la carte ne les stocke pas, ils se déduisent de `history`.
+   */
+  commentCount: z20.number().int().nonnegative().optional(),
+  lastCommentAt: z20.string().optional(),
+  /**
+   * Les entrées de journal qui ouvrent une conversation IA. Elles restent dans
+   * la lecture allégée — il y en a une poignée par carte, et l'hôte s'en sert
+   * pour dire, sans ouvrir la carte, qu'une IA y travaille.
+   */
+  conversationEvents: z20.array(KanbanCardEventSchema).optional(),
+  createdAt: z20.string(),
+  updatedAt: z20.string(),
+  /**
+   * Quand la carte a été archivée — absente tant qu'elle est au tableau.
+   *
+   * Une carte archivée reste dans sa colonne en base : c'est la lecture qui la
+   * retire du tableau, jamais une écriture qui la déplace. Rien à recoller donc
+   * au désarchivage, et aucun cimetière où une carte pourrait se perdre.
+   */
+  archivedAt: z20.string().optional(),
+  /**
+   * La colonne d'où la carte a été archivée, telle qu'elle s'appelait alors.
+   *
+   * L'identifiant sert à l'y remettre, le titre à le dire dans l'archive même
+   * quand la colonne a disparu depuis — auquel cas le désarchivage repose la
+   * carte dans la première colonne, sans se taire sur son origine.
+   */
+  archivedFrom: z20.object({ columnId: z20.string().max(128), columnTitle: z20.string().max(200) }).optional(),
+  /**
+   * Quand la carte a été supprimée. Rien n'est effacé : la carte reste en base,
+   * et toutes les lectures l'écartent.
+   *
+   * Une suppression est le seul geste que rien ne rattrape — sauf à ne pas
+   * l'exécuter vraiment. La colonne et le tableau portent le même champ, pour
+   * que supprimer l'un n'emporte jamais les cartes de l'autre.
+   */
+  deletedAt: z20.string().optional(),
+  /**
+   * People assigned to the card. Names are denormalized for display; the server
+   * keeps only members of the owning organization, and notifies newcomers.
+   */
+  assignees: z20.array(z20.object({ id: z20.string().max(128), name: z20.string().max(200) })).max(20).default([]),
+  /**
+   * Who first created the card. Stamped by the server the first time a card id
+   * appears in a board write, never taken from the client — a member could
+   * otherwise claim any authorship. Absent on cards created before this field
+   * existed, so readers must treat it as unknown rather than assume.
+   */
+  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional()
+});
+var KanbanColumnSchema = z20.object({
+  id: z20.string(),
+  title: z20.string().min(1).max(200),
+  order: z20.number().int(),
+  cards: z20.array(KanbanCardSchema).default([]),
+  /**
+   * Le regroupement auquel la colonne appartient, s'il y en a un.
+   *
+   * Un pointeur vers le parent, et rien dans l'autre sens : le groupe ne tient
+   * pas la liste de ses membres. Deux listes qui prétendent dire qui contient
+   * quoi finissent par se contredire, et un déplacement devient alors deux
+   * écritures au lieu d'une.
+   */
+  groupId: z20.string().optional(),
+  /** Supprimée, mais conservée — voir `deletedAt` sur la carte. */
+  deletedAt: z20.string().optional()
+});
+var KanbanColumnGroupSchema = z20.object({
+  id: z20.string(),
+  title: z20.string().min(1).max(200),
+  /** La couleur du bandeau, en hexadécimal — l'interface décide du défaut. */
+  color: z20.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
+  /** Le groupe parent, pour les regroupements imbriqués. */
+  parentId: z20.string().optional(),
+  /** Supprimé, mais conservé — comme une colonne. */
+  deletedAt: z20.string().optional()
+});
+var KanbanBoardSchema = z20.object({
+  id: z20.string(),
+  name: z20.string().min(1).max(200),
+  description: z20.string().max(1e4).default(""),
+  /**
+   * Le mode d'emploi du tableau, en texte libre : ce que veulent dire ses
+   * colonnes, quand une carte a le droit d'avancer, les conventions de
+   * l'équipe. Écrit par les humains, lu surtout par l'IA — il est injecté dans
+   * le prompt des agents pour qu'ils travaillent selon les règles du tableau
+   * plutôt que selon les leurs.
+   */
+  instructions: z20.string().max(2e4).default(""),
+  columns: z20.array(KanbanColumnSchema).default([]),
+  /** Les regroupements de colonnes — vide sur un tableau qui n'en a jamais eu. */
+  columnGroups: z20.array(KanbanColumnGroupSchema).default([]),
+  archived: z20.boolean().default(false),
+  /** Supprimé, mais conservé avec ses cartes — voir `deletedAt` sur la carte. */
+  deletedAt: z20.string().optional(),
+  createdAt: z20.string(),
+  updatedAt: z20.string()
+});
+var CreateKanbanBoardInput = z20.object({
+  name: z20.string().min(1).max(200),
+  description: z20.string().max(1e4).optional(),
+  instructions: z20.string().max(2e4).optional()
+});
+var UpdateKanbanBoardInput = z20.object({
+  id: z20.string(),
+  name: z20.string().min(1).max(200).optional(),
+  description: z20.string().max(1e4).optional(),
+  instructions: z20.string().max(2e4).optional(),
+  columns: z20.array(KanbanColumnSchema).optional(),
+  archived: z20.boolean().optional()
+});
+var KanbanCardLinkSchema = z20.object({
+  id: z20.string().max(128),
+  /** Le tableau et la carte qui *dépendent* de l'autre. */
+  childBoardId: z20.string().max(64),
+  childCardId: z20.string().max(128),
+  /** Le tableau et la carte *dont* on dépend. */
+  parentBoardId: z20.string().max(64),
+  parentCardId: z20.string().max(128),
+  createdAt: z20.string(),
+  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional()
+});
+var KanbanCardRefSchema = z20.object({
+  cardId: z20.string().max(128),
+  boardId: z20.string().max(64),
+  boardName: z20.string().max(200),
+  columnId: z20.string().max(128),
+  columnTitle: z20.string().max(200),
+  title: z20.string().max(500),
+  /** Les mêmes informations qu'une ligne de tableau montre d'une carte d'ici. */
+  assignees: z20.array(z20.object({ id: z20.string().max(128), name: z20.string().max(200) })).default([]),
+  commentCount: z20.number().int().nonnegative().default(0)
+});
+
+// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
+import { z as z21 } from "zod";
+var CloudApiScopeSchema = z21.enum([
+  "kanban:read",
+  "kanban:write",
+  "kanban:comment",
+  "kanban:delete"
+]);
+var CloudApiKeySecretSchema = z21.string().regex(/^rk_[0-9a-f]{64}$/);
+var CloudApiKeySchema = z21.object({
+  id: z21.string().max(128),
+  organizationId: z21.string().max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  /**
+   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
+   * l'organisation ».
+   *
+   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
+   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
+   * nommait plus que lui.
+   */
+  boards: z21.array(z21.string().max(64)).max(200).nullable(),
+  createdAt: z21.string().max(64),
+  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
+  lastUsedAt: z21.string().max(64).nullable(),
+  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
+  createdBy: z21.object({ id: z21.string().max(128), name: z21.string().max(200) }),
+  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
+  keyPreview: z21.string().max(8)
+});
+var CreatedCloudApiKeySchema = z21.object({
+  key: CloudApiKeySchema,
+  secret: CloudApiKeySecretSchema
+});
+var CreateCloudApiKeyInput = z21.object({
+  organizationId: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().default(null)
+});
+var UpdateCloudApiKeyInput = z21.object({
+  id: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200).optional(),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10).optional(),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().optional()
+});
+
+// ../../packages/shared/src/schemas/changelog.schema.ts
+import { z as z22 } from "zod";
+var ChangelogSurfaceSchema = z22.enum(["app", "cloud"]);
+var ChangelogChangeKindSchema = z22.enum(["feature", "improvement", "fix", "breaking"]);
+var ChangelogTextSchema = z22.object({
+  fr: z22.string().min(1).max(500),
+  en: z22.string().min(1).max(500)
+});
+var ChangelogChangeSchema = z22.object({
+  kind: ChangelogChangeKindSchema,
+  text: ChangelogTextSchema
+});
+var ChangelogDraftSchema = ChangelogChangeSchema.extend({
+  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  title: ChangelogTextSchema.optional()
+});
+var ChangelogReleaseSchema = z22.object({
+  surface: ChangelogSurfaceSchema,
+  /** `1.4.2` pour l'app (version npm publiée), `2026-09-03` — ou `2026-09-03.2` — pour le cloud. */
+  version: z22.string().min(1).max(32).regex(/^[0-9][0-9.-]*$/),
+  /** Date de publication, `YYYY-MM-DD`. */
+  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  /** Facultatif : une version peut s'annoncer par son seul numéro. */
+  title: ChangelogTextSchema.optional(),
+  /** Une version sans changement n'a rien à annoncer : elle n'a pas sa place ici. */
+  changes: z22.array(ChangelogChangeSchema).min(1).max(50)
+});
+var ChangelogIndexItemSchema = ChangelogReleaseSchema.omit({ changes: true }).extend({
+  changeCount: z22.number().int().nonnegative()
+});
+
+// ../../packages/shared/src/utils/crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypto";
+
+// ../../packages/shared/src/native-parsers.ts
+var epoch = /* @__PURE__ */ new Date("2025-01-01T00:00:00Z");
+var nativeParsers = [
+  {
+    id: "native:json",
+    name: "JSON Log Parser",
+    description: "Parses JSON log lines and extracts level, message, timestamp, metadata, and the full parsed object.",
+    code: `(line) => {
+  var trimmed = line.message.trim();
+  if (!trimmed.startsWith('{')) return line;
+  try {
+    var obj = JSON.parse(trimmed);
+    var level = (obj.level || obj.severity || obj.loglevel || '').toString().toLowerCase();
+    var levelMap = { trace: 'debug', debug: 'debug', info: 'info', warn: 'warn', warning: 'warn', error: 'error', fatal: 'fatal', err: 'error' };
+    var mappedLevel = levelMap[level] || line.level;
+    var message = obj.message || obj.msg || obj.text || trimmed;
+    var metadata = {};
+    for (var k in obj) {
+      if (['level','severity','loglevel','message','msg','text','timestamp','time','ts'].indexOf(k) !== -1) continue;
+      metadata[k] = typeof obj[k] === 'string' ? obj[k] : JSON.stringify(obj[k]);
+    }
+    var merged = {};
+    for (var mk in line.metadata) merged[mk] = line.metadata[mk];
+    for (var nk in metadata) merged[nk] = metadata[nk];
+    return { raw: line.raw, stream: line.stream, level: mappedLevel, message: String(message).slice(0, 16384), hidden: line.hidden, metadata: merged, json: obj, jsonHeader: line.jsonHeader };
+  } catch (e) { return line; }
+}`,
+    enabled: true,
+    builtin: true,
+    createdAt: epoch,
+    updatedAt: epoch
+  },
+  {
+    id: "native:debug",
+    name: "Runeya Debug Parser",
+    description: 'Detects Runeya internal debug logs emitted as JSON arrays: ["runeya", payload]. Marks them as debug level.',
+    code: `(line) => {
+  var trimmed = line.message.trim();
+  if (!trimmed.startsWith('[')) return line;
+  try {
+    var parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed) || parsed[0] !== 'runeya') return line;
+    var debug = parsed.length === 2 ? parsed[1] : parsed.slice(1);
+    var message = typeof debug === 'string' ? debug : JSON.stringify(debug);
+    var merged = {};
+    for (var k in line.metadata) merged[k] = line.metadata[k];
+    merged.runeya_debug = JSON.stringify(debug);
+    return { raw: line.raw, stream: line.stream, level: 'debug', message: message, hidden: line.hidden, metadata: merged, jsonHeader: line.jsonHeader };
+  } catch (e) { return line; }
+}`,
+    enabled: true,
+    builtin: true,
+    createdAt: epoch,
+    updatedAt: epoch
+  },
+  {
+    id: "native:links",
+    name: "Link Detector",
+    description: "Detects URLs in plain-text log lines and exposes them in metadata.links for frontend rendering.",
+    code: `(line) => {
+  var urlRegex = /(https?|ftp):\\/\\/[\\w_-]+(?:\\.[\\w_-]+)+([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?/gi;
+  var urls = line.message.match(urlRegex);
+  if (!urls || urls.length === 0) return line;
+  var merged = {};
+  for (var k in line.metadata) merged[k] = line.metadata[k];
+  merged.links = urls.join(' ');
+  return { raw: line.raw, stream: line.stream, level: line.level, message: line.message, hidden: line.hidden, metadata: merged, jsonHeader: line.jsonHeader };
+}`,
+    enabled: true,
+    builtin: true,
+    createdAt: epoch,
+    updatedAt: epoch
+  }
+];
+
+// ../../packages/shared/src/js-log-parser.ts
+import vm from "vm";
+var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
+var PARSE_TIMEOUT_MS = 50;
+var MAX_CONSECUTIVE_TIMEOUTS = 10;
+var JSLogParser = class {
+  parsers = [];
+  constructor(definitions = []) {
+    this.setParsers(definitions);
+  }
+  setParsers(definitions) {
+    this.parsers = [];
+    for (const def of definitions) {
+      if (!def.enabled) continue;
+      try {
+        const compiled = this.compileParser(def);
+        this.parsers.push({
+          id: def.id,
+          name: def.name,
+          enabled: true,
+          fn: compiled
+        });
+      } catch (err) {
+        console.warn(
+          `[js-log-parser] Failed to compile parser "${def.name}" (${def.id}): ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
+  parse(line) {
+    let current = line;
+    for (const parser of this.parsers) {
+      try {
+        current = parser.fn(current);
+      } catch (err) {
+        console.warn(
+          `[js-log-parser] Parser "${parser.name}" threw error: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    return this.sanitize(current);
+  }
+  /**
+   * Compile le code utilisateur en une fonction bornée en temps.
+   *
+   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
+   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
+   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
+   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
+   * métriques de *tous* les services. Chaque invocation repasse maintenant par
+   * la vm, avec son propre budget.
+   */
+  compileParser(def) {
+    const forbidden = ["require(", "import ", "eval("];
+    for (const pat of forbidden) {
+      if (def.code.includes(pat)) {
+        throw new Error("Code contains forbidden patterns (require, import, eval)");
+      }
+    }
+    const sandbox = {
+      RegExp,
+      String,
+      Object,
+      Array,
+      JSON,
+      Math,
+      Date,
+      undefined: void 0,
+      null: null
+    };
+    let script;
+    try {
+      script = new vm.Script(`(${def.code})`, { filename: `parser-${def.id}.js` });
+    } catch (err) {
+      throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
+    let parserFn;
+    try {
+      parserFn = script.runInContext(context, { timeout: 100 });
+    } catch (err) {
+      throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof parserFn !== "function") {
+      throw new Error("Parser code must export a function");
+    }
+    context["__parserFn"] = parserFn;
+    const callScript = new vm.Script("__result = __parserFn(__line);", {
+      filename: `parser-${def.id}-call.js`
+    });
+    let consecutiveTimeouts = 0;
+    let disabled = false;
+    return (line) => {
+      if (disabled) return line;
+      const ctx = context;
+      ctx["__line"] = line;
+      ctx["__result"] = null;
+      try {
+        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
+        consecutiveTimeouts = 0;
+      } catch (err) {
+        const e = err;
+        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
+        if (!timedOut) throw err;
+        consecutiveTimeouts += 1;
+        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
+          disabled = true;
+          console.warn(
+            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
+          );
+        }
+        return line;
+      }
+      const result = ctx["__result"];
+      if (result === null || result === void 0 || typeof result !== "object") {
+        return line;
+      }
+      return result;
+    };
+  }
+  /** Sanitize the final LogLine: truncate message, limit metadata, validate level */
+  sanitize(line) {
+    let { message, metadata, level } = line;
+    if (message.length > 16384) {
+      message = message.substring(0, 16384) + "...[truncated]";
+    }
+    metadata = metadata ?? {};
+    const metaKeys = Object.keys(metadata);
+    if (metaKeys.length > 100) {
+      const limited = {};
+      for (let i = 0; i < 100; i++) {
+        limited[metaKeys[i]] = metadata[metaKeys[i]];
+      }
+      metadata = limited;
+    }
+    if (!VALID_LEVELS.has(level)) {
+      level = "info";
+    }
+    if (message !== line.message || metadata !== line.metadata || level !== line.level) {
+      return { ...line, message, metadata, level };
+    }
+    return line;
+  }
+};
+
+// ../../packages/shared/src/builtins.ts
+var BUILTIN_VARIABLES = [
+  // ── Le service ───────────────────────────────────────────────────────────
+  { name: "service.NAME", scope: "server", descriptionKey: "serviceName" },
+  { name: "service.ID", scope: "server", descriptionKey: "serviceId" },
+  { name: "service.PORT", scope: "server", descriptionKey: "servicePort" },
+  { name: "service.URL", scope: "server", descriptionKey: "serviceUrl" },
+  { name: "service.BASE_URL", scope: "server", descriptionKey: "serviceBaseUrl" },
+  { name: "service.CWD", scope: "agent", descriptionKey: "serviceCwd" },
+  // ── Le projet et l'environnement actif ───────────────────────────────────
+  { name: "project.NAME", scope: "server", descriptionKey: "projectName" },
+  { name: "runeya.ENV_NAME", scope: "server", descriptionKey: "envName" },
+  // ── Le serveur Runeya ────────────────────────────────────────────────────
+  // `service.HOST` a toujours désigné l'adresse d'écoute du SERVEUR, pas une
+  // propriété du service : le nom trompait, il devient un alias.
+  { name: "runeya.HOST", scope: "server", descriptionKey: "runeyaHost", deprecatedAlias: "service.HOST" },
+  // ── La machine qui exécute ───────────────────────────────────────────────
+  { name: "agent.HOST_LAN", scope: "agent", descriptionKey: "agentHostLan", deprecatedAlias: "service.HOST_LAN" },
+  // Le NOM de l'agent est une étiquette de la configuration du serveur, pas
+  // une propriété de la machine : c'est le serveur qui le connaît et le résout.
+  { name: "agent.NAME", scope: "server", descriptionKey: "agentName" },
+  { name: "agent.OS", scope: "agent", descriptionKey: "agentOs" },
+  { name: "agent.HOME", scope: "agent", descriptionKey: "agentHome" }
+];
+var BUILTIN_REFERENCE_RE = /\{\{([A-Za-z][A-Za-z0-9_.-]*)\}\}/g;
+var ENVIRONMENT_NAMESPACE = "environment.";
+function interpolateBuiltins(text, values) {
+  return text.replace(BUILTIN_REFERENCE_RE, (match, name) => {
+    if (name.startsWith(ENVIRONMENT_NAMESPACE)) return match;
+    return values[name] ?? match;
+  });
+}
+function interpolateBuiltinsInEnv(env2, values) {
+  const out = {};
+  for (const [key, value] of Object.entries(env2)) {
+    out[key] = interpolateBuiltins(value, values);
+  }
+  return out;
+}
+function withDeprecatedAliases(values) {
+  const out = { ...values };
+  for (const builtin of BUILTIN_VARIABLES) {
+    if (builtin.deprecatedAlias && out[builtin.name] !== void 0) {
+      out[builtin.deprecatedAlias] = out[builtin.name];
+    }
+  }
+  return out;
+}
+function serviceSlug(name) {
+  return name.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function servicePortValues(ports, prefix = "service") {
+  const values = {};
+  (ports ?? []).forEach((port, i) => {
+    values[i === 0 ? `${prefix}.PORT` : `${prefix}.PORT_${i + 1}`] = String(port);
+  });
+  return values;
+}
+function isWildcardHost(host) {
+  const h = host.trim();
+  return h === "" || h === "0.0.0.0" || h === "::" || h === "[::]";
+}
+function isLoopbackHost(host) {
+  const h = host.trim();
+  return h === "127.0.0.1" || h === "::1" || h === "[::1]";
+}
+function urlHostFor(host) {
+  if (isWildcardHost(host)) return null;
+  return isLoopbackHost(host) ? "localhost" : host.trim();
+}
+function serviceUrlValues(service, host, prefix = "service") {
+  const domainByPort = new Map((service.localUrls ?? []).map((lu) => [lu.port, lu.url]));
+  const ports = [...service.ports ?? []];
+  for (const local of service.localUrls ?? []) {
+    if (!ports.includes(local.port)) ports.push(local.port);
+  }
+  const values = {};
+  ports.forEach((port, i) => {
+    const domain = domainByPort.get(port);
+    values[i === 0 ? `${prefix}.URL` : `${prefix}.URL_${i + 1}`] = domain ? `http://${domain}` : `http://${host}:${port}`;
+  });
+  return values;
+}
+function crossServiceValues(service, host) {
+  const slug = serviceSlug(service.name);
+  if (!slug) return {};
+  return {
+    [`services.${slug}.NAME`]: service.name,
+    [`services.${slug}.ID`]: service.id,
+    ...servicePortValues(service.ports, `services.${slug}`),
+    ...serviceUrlValues(service, host, `services.${slug}`),
+    ...service.url ? { [`services.${slug}.BASE_URL`]: service.url } : {}
+  };
+}
+
+// ../../packages/shared/src/constants/buffers.ts
+var LOG_BUFFER_SIZE = 5e3;
+
+// ../../packages/shared/src/constants/editors.ts
+var SUPPORTED_EDITORS = [
+  { key: "vscode", name: "Visual Studio Code", command: "code" },
+  { key: "cursor", name: "Cursor", command: "cursor" },
+  { key: "windsurf", name: "Windsurf", command: "windsurf" },
+  { key: "sublime", name: "Sublime Text", command: "subl" },
+  { key: "atom", name: "Atom", command: "atom" },
+  { key: "antigravity", name: "Antigravity", command: "antigravity" },
+  { key: "intellij", name: "IntelliJ IDEA", command: "idea" },
+  { key: "android-studio", name: "Android Studio", command: "studio" },
+  { key: "webstorm", name: "WebStorm", command: "webstorm" },
+  { key: "zed", name: "Zed", command: "zed" },
+  { key: "neovim", name: "Neovim", command: "nvim" },
+  { key: "vim", name: "Vim", command: "vim" },
+  { key: "emacs", name: "Emacs", command: "emacs" },
+  { key: "fleet", name: "Fleet", command: "fleet" }
+];
+var EDITOR_BY_KEY = new Map(
+  SUPPORTED_EDITORS.map((e) => [e.key, e])
+);
+
+// ../../packages/shared/src/sync/json-crdt.ts
+import * as Y from "yjs";
+function normalize(value) {
+  return JSON.parse(JSON.stringify(value ?? null));
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function toPlain(value) {
+  if (value instanceof Y.Map) {
+    const out = {};
+    for (const [k, v] of value.entries()) out[k] = toPlain(v);
+    return out;
+  }
+  if (value instanceof Y.Array) return value.toArray().map(toPlain);
+  return value ?? null;
+}
+function identityOf(value) {
+  if (isPlainObject(value) && typeof value["id"] === "string") return `id:${value["id"]}`;
+  return `v:${JSON.stringify(value)}`;
+}
+function identityOfY(value) {
+  if (value instanceof Y.Map) {
+    const id = value.get("id");
+    if (typeof id === "string") return `id:${id}`;
+  }
+  return `v:${JSON.stringify(toPlain(value))}`;
+}
+function toY(value) {
+  if (Array.isArray(value)) {
+    const arr = new Y.Array();
+    if (value.length > 0) arr.insert(0, value.map(toY));
+    return arr;
+  }
+  if (isPlainObject(value)) {
+    const map = new Y.Map();
+    for (const [k, v] of Object.entries(value)) map.set(k, toY(v));
+    return map;
+  }
+  return value;
+}
+function applyToMap(map, next) {
+  for (const key of Array.from(map.keys())) {
+    if (!(key in next)) map.delete(key);
+  }
+  for (const [key, value] of Object.entries(next)) {
+    const current = map.get(key);
+    if (Array.isArray(value)) {
+      if (!(current instanceof Y.Array)) map.set(key, toY(value));
+      else applyToArray(current, value);
+    } else if (isPlainObject(value)) {
+      if (!(current instanceof Y.Map)) map.set(key, toY(value));
+      else applyToMap(current, value);
+    } else if (current instanceof Y.Map || current instanceof Y.Array || current !== value) {
+      map.set(key, value);
+    }
+  }
+}
+function applyToArray(arr, next) {
+  const wanted = next.map(identityOf);
+  const wantedCount = /* @__PURE__ */ new Map();
+  for (const k of wanted) wantedCount.set(k, (wantedCount.get(k) ?? 0) + 1);
+  const seen = /* @__PURE__ */ new Map();
+  for (let i = arr.length - 1; i >= 0; i--) {
+    const key = identityOfY(arr.get(i));
+    const used = seen.get(key) ?? 0;
+    if (used >= (wantedCount.get(key) ?? 0)) arr.delete(i, 1);
+    else seen.set(key, used + 1);
+  }
+  for (let j = 0; j < next.length; j++) {
+    const key = wanted[j];
+    if (j < arr.length && identityOfY(arr.get(j)) === key) {
+      const current = arr.get(j);
+      const value = next[j];
+      if (current instanceof Y.Map && isPlainObject(value)) applyToMap(current, value);
+      else if (current instanceof Y.Array && Array.isArray(value)) applyToArray(current, value);
+      continue;
+    }
+    let found = -1;
+    for (let k = j + 1; k < arr.length; k++) {
+      if (identityOfY(arr.get(k)) === key) {
+        found = k;
+        break;
+      }
+    }
+    if (found !== -1) {
+      const moved = toPlain(arr.get(found));
+      arr.delete(found, 1);
+      arr.insert(j, [toY(moved)]);
+    } else {
+      arr.insert(j, [toY(next[j])]);
+    }
+  }
+}
+function getCollection(doc, name) {
+  return doc.getMap(name);
+}
+function readEntity(collection, id) {
+  const entity = collection.get(id);
+  if (!(entity instanceof Y.Map)) return null;
+  const plain = toPlain(entity);
+  return isPlainObject(plain) ? plain : null;
+}
+function writeEntity(collection, id, entity) {
+  const next = normalize(entity);
+  if (!isPlainObject(next)) return;
+  const current = collection.get(id);
+  if (!(current instanceof Y.Map)) {
+    collection.set(id, toY(next));
+    return;
+  }
+  applyToMap(current, next);
+}
+
+export {
+  env,
+  machineRoot,
+  localVaultRoot,
+  orgVaultRoot,
+  projectVaultRoot,
+  orgIdOfRoot,
+  vaultIdOfRoot,
+  vaultFor,
+  stampOrgCloud,
+  rememberOrgName,
+  readOrgNames,
+  rememberOrgLogo,
+  forgetOrgLogo,
+  readOrgLogos,
+  readOrgClouds,
+  listOrgVaults,
+  listCloudVaults,
+  allVaultRoots,
+  machineFilePath,
+  keyedFilePath,
+  legacyMachineFilePath,
+  ensureLocalVault,
+  keyRoot,
+  legacyVaultRoot,
+  ProjectSchema,
+  ScenarioGroupSchema,
+  ScenarioNodeSchema,
+  ScenarioSchema,
+  AIProviderSchema,
+  JSLogParserSchema,
+  NotificationPreferencesSchema,
+  SettingsSchema,
+  TraefikConfigSchema,
+  SettingsPrivateSchema,
+  SchemaVersionSchema,
+  LogSourceConfigSchema,
+  HealthCheckSchema,
+  DockerConfigSchema,
+  RestartStrategySchema,
+  ServiceShortcutSchema,
+  ServiceCommandSchema,
+  VariableSchema,
+  ServiceConfigSchema,
+  EnvironmentSchema,
+  CreateEnvironmentSchema,
+  UpdateEnvironmentSchema,
+  VariableOverrideSchema,
+  ApiKeyScopeSchema,
+  ApiKeysFileSchema,
+  ChangelogSurfaceSchema,
+  ChangelogReleaseSchema,
+  ChangelogIndexItemSchema,
+  COMPANION_RELAY_OPEN,
+  COMPANION_RELAY_CLOSE,
+  extractCompanionRelay,
+  nativeParsers,
+  JSLogParser,
+  interpolateBuiltinsInEnv,
+  withDeprecatedAliases,
+  serviceSlug,
+  servicePortValues,
+  urlHostFor,
+  serviceUrlValues,
+  crossServiceValues,
+  AGENT_HEALTH_POLL_INTERVAL,
+  LOG_BUFFER_SIZE,
+  AGENT_FETCH_TIMEOUT,
+  AGENT_LONG_FETCH_TIMEOUT,
+  AGENT_STOP_FETCH_TIMEOUT,
+  PASSPHRASE_TIMEOUT,
+  WS_RECONNECT_MIN,
+  WS_RECONNECT_MAX,
+  SUPPORTED_EDITORS,
+  EDITOR_BY_KEY,
+  getCollection,
+  readEntity,
+  writeEntity
+};
+//# sourceMappingURL=chunk-3MJLS5UY.js.map