@runeya/runeya 2.0.94 → 2.0.95

package/{chunk-4PQXBTV6.js → chunk-HX3ZIWHM.js}

@@ -1,266 +1,34 @@
+import {
+  AGENT_FETCH_TIMEOUT,
+  AGENT_HEALTH_POLL_INTERVAL,
+  CreateEnvironmentSchema,
+  EnvironmentSchema,
+  PASSPHRASE_TIMEOUT,
+  ServiceConfigSchema,
+  TraefikConfigSchema,
+  WS_RECONNECT_MAX,
+  WS_RECONNECT_MIN,
+  allVaultRoots,
+  env,
+  keyedFilePath,
+  legacyMachineFilePath,
+  listOrgVaults,
+  localVaultRoot,
+  machineRoot,
+  orgVaultRoot,
+  vaultFor,
+  vaultIdOfRoot
+} from "./chunk-3MJLS5UY.js";
+
 // ../server/src/services/agent-manager.ts
 import { EventEmitter as EventEmitter2 } from "events";
 import WebSocket2 from "ws";
-import { z as z24 } from "zod";
+import { z as z2 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile2, writeFile as writeFile2, rename, mkdir as mkdir2, chmod } from "fs/promises";
-import { dirname, join as join2 } from "path";
-
-// ../server/src/services/vault-resolver.ts
-import { join, sep } from "path";
-import { homedir } from "os";
-import { readdir, mkdir, access, readFile, writeFile, unlink } from "fs/promises";
-import { existsSync } from "fs";
-
-// ../server/src/config/env.ts
-import { z } from "zod";
-import { resolve as resolvePath } from "path";
-var serverPort = z.coerce.number().int().min(1).max(65535).default(4e3).parse(process.env.RUNEYA_HTTP_PORT);
-var defaultAgentPort = process.env.RUNEYA_AGENT_PORT ? z.coerce.number().int().min(1).max(65535).parse(process.env.RUNEYA_AGENT_PORT) : serverPort + 1;
-var EnvSchema = z.object({
-  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).default(4e3),
-  RUNEYA_HOST: z.string().default("127.0.0.1"),
-  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),
-  RUNEYA_AGENT_HOST: z.string().default("127.0.0.1"),
-  RUNEYA_AGENT_BINARY_PATH: z.string().nullable().default(null),
-  RUNEYA_DATA_DIR: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().default(".runeya")),
-  // Home holding the cloud vaults (`<home>/.runeya/orgs/...`). Defaults to the
-  // user's home directory; overridden by tests so they never write to the real
-  // one, and usable to relocate the vaults on a shared machine.
-  RUNEYA_HOME: z.preprocess((v) => typeof v === "string" && v.length > 0 ? v : void 0, z.string().nullable().default(null)),
-  RUNEYA_CLOUD_URL: z.string().url().nullable().default(null),
-  // Cloud front-end (landing) URL — used by the web app for the registration /
-  // onboarding flow. Configured on the server at launch; the web fetches it.
-  RUNEYA_CLOUD_APP_URL: z.string().url().nullable().default(null),
-  RUNEYA_MODE: z.enum(["local-simple", "cloud"]).default("local-simple"),
-  RUNEYA_CORS_ORIGIN: z.string().nullable().default(null),
-  RUNEYA_LAN_PROXY: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false),
-  // Set by the CLI when it was started from a desktop launcher rather than a
-  // terminal. The web app surfaces it so the user knows which Runeya they are
-  // looking at when several are running.
-  RUNEYA_FROM_DESKTOP: z.preprocess((v) => v === "true" || v === "1", z.boolean()).default(false),
-  // Label shown for this machine in the cloud's "linked machines" screen.
-  // Defaults to the hostname (see `getDeviceName`); set it explicitly when a
-  // single host runs several instances and you want to tell them apart.
-  RUNEYA_DEVICE_NAME: z.preprocess(
-    (v) => typeof v === "string" && v.trim().length > 0 ? v.trim() : void 0,
-    z.string().max(64).nullable().default(null)
-  )
-}).transform((data) => ({
-  ...data,
-  // Short aliases used throughout the server code
-  PORT: data.RUNEYA_HTTP_PORT,
-  HOST: data.RUNEYA_HOST,
-  MODE: data.RUNEYA_MODE,
-  /**
-   * Absolute from the start, resolved once against the launch directory.
-   *
-   * It defaults to a relative `.runeya`, and every caller used to re-resolve it
-   * against whatever the process's cwd happened to be. A vault that moves when
-   * the process changes directory is a vault that can be silently written to the
-   * wrong place — so the answer is fixed here, at boot, and never recomputed.
-   */
-  DATA_DIR: resolvePath(data.RUNEYA_DATA_DIR),
-  HOME_DIR: data.RUNEYA_HOME,
-  CLOUD_URL: data.RUNEYA_CLOUD_URL,
-  CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,
-  CORS_ORIGIN: data.RUNEYA_CORS_ORIGIN,
-  AGENT_BINARY_PATH: data.RUNEYA_AGENT_BINARY_PATH,
-  DEVICE_NAME: data.RUNEYA_DEVICE_NAME,
-  FROM_DESKTOP: data.RUNEYA_FROM_DESKTOP
-}));
-var env = EnvSchema.parse(process.env);
-
-// ../server/src/services/vault-resolver.ts
-var SAFE_ID = /^[A-Za-z0-9._-]{1,128}$/;
-function assertSafeId(kind, id) {
-  if (!SAFE_ID.test(id) || id === "." || id === "..") {
-    throw new Error(`Invalid ${kind} id for a vault path: ${JSON.stringify(id)}`);
-  }
-}
-function machineRoot() {
-  const override = process.env["RUNEYA_HOME"];
-  return join(override && override.length > 0 ? override : homedir(), ".runeya");
-}
-function localVaultRoot() {
-  return env.DATA_DIR;
-}
-function orgVaultRoot(orgId) {
-  assertSafeId("organization", orgId);
-  return join(machineRoot(), "orgs", orgId);
-}
-function projectVaultRoot(orgId, projectId) {
-  assertSafeId("project", projectId);
-  return join(orgVaultRoot(orgId), "projects", projectId);
-}
-function orgIdOfRoot(root) {
-  const marker = join(machineRoot(), "orgs") + sep;
-  if (!root.startsWith(marker)) return null;
-  const [orgId] = root.slice(marker.length).split(sep);
-  return orgId && SAFE_ID.test(orgId) ? orgId : null;
-}
-function vaultIdOfRoot(root) {
-  return orgIdOfRoot(root) ?? void 0;
-}
-function vaultFor(target) {
-  if (!target.orgId) return { root: localVaultRoot() };
-  return { root: projectVaultRoot(target.orgId, target.id) };
-}
-var ORG_CLOUD_FILE = "cloud.json";
-async function stampOrgCloud(orgId, cloudUrl, name) {
-  const root = orgVaultRoot(orgId);
-  await mkdir(root, { recursive: true });
-  const known = name ?? (await readOrgNames())[orgId];
-  const stamp = known ? { cloudUrl, name: known } : { cloudUrl };
-  await writeFile(join(root, ORG_CLOUD_FILE), JSON.stringify(stamp, null, 2), "utf-8");
-}
-async function rememberOrgName(orgId, name) {
-  const root = orgVaultRoot(orgId);
-  if (!existsSync(root)) return;
-  const file = join(root, ORG_CLOUD_FILE);
-  let stamp = {};
-  try {
-    stamp = JSON.parse(await readFile(file, "utf-8"));
-  } catch {
-  }
-  if (stamp["name"] === name) return;
-  await writeFile(file, JSON.stringify({ ...stamp, name }, null, 2), "utf-8");
-}
-async function readOrgNames() {
-  const out = {};
-  for (const orgId of await listOrgVaults()) {
-    try {
-      const raw = await readFile(join(orgVaultRoot(orgId), ORG_CLOUD_FILE), "utf-8");
-      const name = JSON.parse(raw).name;
-      if (typeof name === "string" && name) out[orgId] = name;
-    } catch {
-    }
-  }
-  return out;
-}
-var ORG_LOGO_FILE = "logo.json";
-var LOGO_TYPES = /* @__PURE__ */ new Set(["image/png", "image/jpeg", "image/webp", "image/gif"]);
-async function rememberOrgLogo(orgId, contentType, base64) {
-  if (!LOGO_TYPES.has(contentType)) return;
-  const root = orgVaultRoot(orgId);
-  const stored = { contentType, base64, fetchedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await mkdir(root, { recursive: true });
-  await writeFile(join(root, ORG_LOGO_FILE), JSON.stringify(stored), "utf-8");
-}
-async function forgetOrgLogo(orgId) {
-  try {
-    await unlink(join(orgVaultRoot(orgId), ORG_LOGO_FILE));
-  } catch {
-  }
-}
-async function readOrgLogos() {
-  const out = {};
-  for (const orgId of await listOrgVaults()) {
-    try {
-      const raw = await readFile(join(orgVaultRoot(orgId), ORG_LOGO_FILE), "utf-8");
-      const { contentType, base64 } = JSON.parse(raw);
-      if (typeof contentType !== "string" || !LOGO_TYPES.has(contentType)) continue;
-      if (typeof base64 !== "string" || !base64) continue;
-      out[orgId] = `data:${contentType};base64,${base64}`;
-    } catch {
-    }
-  }
-  return out;
-}
-async function readOrgClouds() {
-  const orgsDir = join(machineRoot(), "orgs");
-  const out = {};
-  let orgIds;
-  try {
-    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
-  } catch {
-    return out;
-  }
-  for (const orgId of orgIds) {
-    try {
-      const raw = await readFile(join(orgsDir, orgId, ORG_CLOUD_FILE), "utf-8");
-      const url = JSON.parse(raw).cloudUrl;
-      if (typeof url === "string" && url) out[orgId] = url;
-    } catch {
-    }
-  }
-  return out;
-}
-async function listOrgVaults() {
-  const orgsDir = join(machineRoot(), "orgs");
-  try {
-    return (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
-  } catch {
-    return [];
-  }
-}
-async function listCloudVaults() {
-  const orgsDir = join(machineRoot(), "orgs");
-  const found = [];
-  let orgIds;
-  try {
-    orgIds = (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
-  } catch {
-    return found;
-  }
-  for (const orgId of orgIds) {
-    const projectsDir = join(orgsDir, orgId, "projects");
-    try {
-      for (const entry of await readdir(projectsDir, { withFileTypes: true })) {
-        if (!entry.isDirectory() || !SAFE_ID.test(entry.name)) continue;
-        const root = join(projectsDir, entry.name);
-        if (!await access(join(root, "project.json")).then(() => true, () => false)) continue;
-        found.push({ orgId, projectId: entry.name, root });
-      }
-    } catch {
-    }
-  }
-  return found;
-}
-async function allVaultRoots() {
-  const cloud = await listCloudVaults();
-  return [localVaultRoot(), ...cloud.map((v) => v.root)];
-}
-function machineFilePath(filename) {
-  return join(machineRoot(), filename);
-}
-async function keyedFilePath(filename) {
-  return join(await keyRoot(), filename);
-}
-function legacyMachineFilePath(filename) {
-  return join(localVaultRoot(), filename);
-}
-async function ensureLocalVault() {
-  const root = localVaultRoot();
-  await mkdir(root, { recursive: true });
-  return root;
-}
-var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
-var keyRootPromise = null;
-async function holdsKey(root) {
-  for (const filename of KEY_FILES) {
-    try {
-      await access(join(root, filename));
-      return true;
-    } catch {
-    }
-  }
-  return false;
-}
-function keyRoot() {
-  keyRootPromise ??= (async () => {
-    if (await holdsKey(machineRoot())) return machineRoot();
-    return await holdsKey(localVaultRoot()) ? localVaultRoot() : machineRoot();
-  })();
-  return keyRootPromise;
-}
-async function legacyVaultRoot() {
-  const local = localVaultRoot();
-  if (await keyRoot() === local) return null;
-  return await holdsKey(local) ? local : null;
-}
+import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
+import { dirname, join } from "path";
 
 // ../server/src/utils/encryption-key.ts
 import { createHash } from "crypto";
@@ -407,7 +175,7 @@ var AgentStore = class {
   }
   filePathFor(owner) {
     if (owner === null) return keyedFilePath(FILENAME);
-    return Promise.resolve(join2(orgVaultRoot(owner), FILENAME));
+    return Promise.resolve(join(orgVaultRoot(owner), FILENAME));
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
@@ -419,7 +187,7 @@ var AgentStore = class {
     for (const path of paths) {
       let raw;
       try {
-        raw = await readFile2(path, "utf-8");
+        raw = await readFile(path, "utf-8");
       } catch {
         continue;
       }
@@ -490,9 +258,9 @@ var AgentStore = class {
         )
       };
       const filePath = await this.filePathFor(owner);
-      await mkdir2(dirname(filePath), { recursive: true });
+      await mkdir(dirname(filePath), { recursive: true });
       const tmpPath = filePath + ".tmp";
-      await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
+      await writeFile(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
       await rename(tmpPath, filePath);
       await chmod(filePath, 384);
     }
@@ -600,8 +368,8 @@ var agentStore = new AgentStore();
 
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3, rm as rm2 } from "fs/promises";
-import { join as join4 } from "path";
+import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir3, chmod as chmod3, rm as rm2 } from "fs/promises";
+import { join as join3 } from "path";
 
 // ../server/src/services/project-key.ts
 function projectKey(ref) {
@@ -713,8 +481,8 @@ function isVaultConflicted(root) {
 
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2, rm } from "fs/promises";
+import { join as join2 } from "path";
 
 // ../server/src/services/disk-freshness.ts
 import { stat } from "fs/promises";
@@ -850,1584 +618,6 @@ function isEncryptedValue(s) {
   return parts.length === 3 && /^[0-9a-f]{32}$/i.test(parts[0]) && /^[0-9a-f]{32}$/i.test(parts[1]);
 }
 
-// ../../packages/shared/src/schemas/user.schema.ts
-import { z as z2 } from "zod";
-var UserSchema = z2.object({
-  id: z2.string().max(128),
-  email: z2.string().email().max(320),
-  name: z2.string().min(1).max(500),
-  avatar: z2.string().url().max(2048).nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/org.schema.ts
-import { z as z3 } from "zod";
-var OrgSchema = z3.object({
-  id: z3.string().max(128),
-  name: z3.string().min(1).max(100),
-  slug: z3.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
-  ownerId: z3.string().max(128)
-});
-var OrgMemberSchema = z3.object({
-  id: z3.string().max(128),
-  orgId: z3.string().max(128),
-  userId: z3.string().max(128),
-  globalRole: z3.enum(["owner", "admin", "member"]),
-  invitedAt: z3.coerce.date(),
-  joinedAt: z3.coerce.date().nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/project.schema.ts
-import { z as z4 } from "zod";
-var ProjectSchema = z4.object({
-  id: z4.string().max(128),
-  orgId: z4.string().max(128).nullable().optional(),
-  name: z4.string().min(1).max(200),
-  description: z4.string().max(1e4).optional().default(""),
-  serviceIds: z4.array(z4.string().max(128)).max(1e4).default([]),
-  // Environment support
-  // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
-  // It's initialized to 'local' by default at load time
-  activeEnvironmentId: z4.string().max(128).optional(),
-  environmentIds: z4.array(z4.string().max(128)).max(100).default([]),
-  // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
-  // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
-  groupOrder: z4.array(z4.string().max(200)).max(100).default([])
-});
-var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
-var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
-
-// ../../packages/shared/src/schemas/service.schema.ts
-import { z as z8 } from "zod";
-
-// ../../packages/shared/src/schemas/settings.schema.ts
-import { z as z6 } from "zod";
-
-// ../../packages/shared/src/schemas/scenario.schema.ts
-import { z as z5 } from "zod";
-var PositionSchema = z5.object({
-  x: z5.number(),
-  y: z5.number()
-});
-var ScenarioGroupSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  name: z5.string().min(1).max(200),
-  description: z5.string().max(1e3).optional(),
-  color: z5.string().max(32).optional(),
-  position: PositionSchema.default({ x: 0, y: 0 }),
-  width: z5.number().default(300),
-  height: z5.number().default(200)
-});
-var ScenarioPresetRoleSchema = z5.object({
-  id: z5.string().min(1).max(64),
-  name: z5.string().min(1).max(200),
-  systemPrompt: z5.string().max(1e4).default(""),
-  prompt: z5.string().max(1e4).default("")
-});
-var ScenarioPresetInitialDataSchema = z5.object({
-  leaderId: z5.string().min(1).max(128),
-  groups: z5.array(z5.object({
-    id: z5.string().min(1).max(128),
-    name: z5.string().min(1).max(200),
-    description: z5.string().max(1e3).optional(),
-    color: z5.string().max(32).optional(),
-    position: z5.object({ x: z5.number(), y: z5.number() }).default({ x: 0, y: 0 }),
-    width: z5.number().default(300),
-    height: z5.number().default(200)
-  })).max(100).default([]),
-  nodes: z5.array(z5.object({
-    id: z5.string().min(1).max(128),
-    type: z5.enum(["ai", "ask"]).default("ai"),
-    parentIds: z5.array(z5.string().max(128)).default([]),
-    groupId: z5.string().max(128).nullable().default(null),
-    label: z5.string().max(240).default(""),
-    role: z5.string().max(64).default("other"),
-    prompt: z5.string().max(5e4).default(""),
-    question: z5.string().max(2e3).default(""),
-    autoGenerated: z5.boolean().default(true),
-    canAddNode: z5.boolean().default(false),
-    aiCli: z5.enum(["claude-code", "codex"]).default("claude-code"),
-    model: z5.string().max(128).default("sonnet"),
-    position: z5.object({ x: z5.number(), y: z5.number() }).default({ x: 0, y: 0 })
-  })).min(1).max(500)
-});
-var LocalizedStringSchema = z5.record(z5.string(), z5.string().max(100));
-var ScenarioPresetLabelsSchema = z5.object({
-  group: LocalizedStringSchema.optional(),
-  node: LocalizedStringSchema.optional(),
-  role: LocalizedStringSchema.optional(),
-  leader: LocalizedStringSchema.optional()
-});
-var ScenarioPresetSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  name: z5.string().min(1).max(200),
-  icon: z5.string().max(64).optional(),
-  defaultTraversalMode: z5.enum(["hierarchical", "topological"]).optional(),
-  canChangeTraversalMode: z5.boolean().default(true),
-  roles: z5.array(ScenarioPresetRoleSchema).min(1).max(100),
-  initialData: ScenarioPresetInitialDataSchema.optional(),
-  labels: ScenarioPresetLabelsSchema.optional()
-});
-var ScenarioNodeSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  type: z5.enum(["ai", "ask"]).default("ai"),
-  parentIds: z5.array(z5.string().max(128)).default([]),
-  groupId: z5.string().max(128).nullable().default(null),
-  label: z5.string().max(240).default(""),
-  role: z5.string().max(64).default("other"),
-  prompt: z5.string().max(5e4).default(""),
-  question: z5.string().max(2e3).default(""),
-  autoGenerated: z5.boolean().default(true),
-  canAddNode: z5.boolean().default(false),
-  aiCli: z5.enum(["claude-code", "codex"]).default("claude-code"),
-  model: z5.string().max(128).default("sonnet"),
-  position: PositionSchema.default({ x: 0, y: 0 }),
-  injectParentOutputs: z5.boolean().default(false),
-  injectedAncestorIds: z5.array(z5.string().max(128)).default([])
-});
-var ScenarioSchema = z5.object({
-  id: z5.string().min(1).max(128),
-  name: z5.string().min(1).max(200),
-  icon: z5.string().max(64).optional(),
-  description: z5.string().max(2e3).optional(),
-  leaderId: z5.string().min(1).max(128),
-  groups: z5.array(ScenarioGroupSchema).max(100).default([]),
-  nodes: z5.array(ScenarioNodeSchema).min(1).max(500),
-  traversalMode: z5.enum(["hierarchical", "topological"]).default("hierarchical"),
-  presetId: z5.string().max(128).optional(),
-  isPublished: z5.boolean().default(false),
-  createdAt: z5.number(),
-  updatedAt: z5.number()
-});
-
-// ../../packages/shared/src/schemas/settings.schema.ts
-var AI_PROVIDERS = ["anthropic", "openai", "mistral", "groq", "ollama"];
-var AIProviderSchema = z6.object({
-  id: z6.string().min(1).max(128),
-  name: z6.string().min(1).max(200),
-  provider: z6.enum(AI_PROVIDERS),
-  encryptedApiKey: z6.string().max(2e3).default(""),
-  model: z6.string().max(200).optional(),
-  active: z6.boolean().default(false),
-  createdAt: z6.coerce.date(),
-  updatedAt: z6.coerce.date()
-});
-var JSLogParserSchema = z6.object({
-  id: z6.string().min(1).max(128),
-  name: z6.string().min(1).max(200),
-  description: z6.string().max(2e3).optional(),
-  code: z6.string().min(1).max(5e4).refine(
-    (s) => !s.includes("require(") && !s.includes("import ") && !s.includes("eval("),
-    { message: "Code must not contain require, import, or eval patterns" }
-  ),
-  enabled: z6.boolean().default(true),
-  builtin: z6.boolean().optional(),
-  createdAt: z6.coerce.date(),
-  updatedAt: z6.coerce.date()
-});
-var NotificationPreferencesSchema = z6.object({
-  scenario_waiting_input: z6.boolean().default(true),
-  ai_conversation_complete: z6.boolean().default(true),
-  ai_conversation_error: z6.boolean().default(true),
-  service_error_log: z6.boolean().default(true),
-  service_status_changed: z6.boolean().default(true),
-  service_health_changed: z6.boolean().default(true),
-  /** Service IDs excluded from error-log notifications */
-  service_error_log_excluded: z6.array(z6.string().max(100)).max(500).default([]),
-  /** Service IDs excluded from status-change notifications */
-  service_status_changed_excluded: z6.array(z6.string().max(100)).max(500).default([]),
-  /** Service IDs excluded from health-change notifications */
-  service_health_changed_excluded: z6.array(z6.string().max(100)).max(500).default([])
-});
-var SettingsSchema = z6.object({
-  mode: z6.enum(["local-simple", "cloud"]),
-  cloudUrl: z6.string().url().max(2048).nullable().optional(),
-  logParsers: z6.array(JSLogParserSchema).max(100).default([]),
-  scenarios: z6.array(ScenarioSchema).max(100).default([]),
-  /** Absolute path to the folder where the global wiki/docs markdown files live. Optional. */
-  globalDocsPath: z6.string().max(4096).optional()
-});
-var TraefikConfigSchema = z6.object({
-  enabled: z6.boolean().default(false),
-  acmeEmail: z6.string().email().max(256).optional(),
-  wildcardDomain: z6.string().max(253).optional(),
-  httpPort: z6.number().int().min(1).max(65535).default(80),
-  httpsPort: z6.number().int().min(1).max(65535).default(443),
-  dnsProvider: z6.string().max(64).optional(),
-  dnsCredentials: z6.record(z6.string().max(64), z6.string().max(2048)).default({}),
-  acmeStaging: z6.boolean().default(false),
-  encryptedCert: z6.string().max(65536).optional(),
-  encryptedCertKey: z6.string().max(65536).optional()
-});
-var SettingsPrivateSchema = z6.object({
-  aiProviders: z6.array(AIProviderSchema).max(50).default([]),
-  scenarios: z6.array(ScenarioSchema).max(100).default([]),
-  notifications: NotificationPreferencesSchema.default(() => ({
-    scenario_waiting_input: true,
-    ai_conversation_complete: true,
-    ai_conversation_error: true,
-    service_error_log: true,
-    service_status_changed: true,
-    service_health_changed: true,
-    service_error_log_excluded: [],
-    service_status_changed_excluded: [],
-    service_health_changed_excluded: []
-  })),
-  traefikConfig: TraefikConfigSchema.optional()
-});
-var SchemaVersionSchema = z6.object({
-  version: z6.number().int().positive(),
-  migratedAt: z6.coerce.date()
-});
-
-// ../../packages/shared/src/schemas/log-source.schema.ts
-import { z as z7 } from "zod";
-var safePath = z7.string().min(1).max(4096).refine(
-  (p) => !p.includes("\0"),
-  { message: "path must not contain null bytes" }
-).refine(
-  (p) => !/(^|[/\\])\.\.([/\\]|$)/.test(p),
-  { message: "path must not contain path-traversal sequences (..)" }
-);
-var ConsoleLogSourceSchema = z7.object({
-  type: z7.literal("console")
-});
-var FileLogSourceSchema = z7.object({
-  type: z7.literal("file"),
-  path: safePath,
-  encoding: z7.string().max(32).default("utf-8"),
-  startFromEnd: z7.boolean().default(true),
-  createIfNotExists: z7.boolean().default(false)
-});
-var MongoLogSourceSchema = z7.object({
-  type: z7.literal("mongo"),
-  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
-  connectionString: z7.string().min(1).max(2048),
-  database: z7.string().min(1).max(256),
-  collection: z7.string().min(1).max(256),
-  filter: z7.record(z7.string(), z7.unknown()).optional(),
-  timestampField: z7.string().max(128).default("timestamp"),
-  messageField: z7.string().max(128).default("message"),
-  levelField: z7.string().max(128).optional()
-});
-var MySQLLogSourceSchema = z7.object({
-  type: z7.literal("mysql"),
-  host: z7.string().min(1).max(253),
-  port: z7.number().int().min(1).max(65535).default(3306),
-  user: z7.string().min(1).max(256),
-  /** @sensitive — stored encrypted (AES-256-GCM) on disk */
-  password: z7.string().max(2048),
-  database: z7.string().min(1).max(256),
-  table: z7.string().min(1).max(256),
-  query: z7.string().max(8192).optional(),
-  timestampColumn: z7.string().max(128).default("created_at"),
-  messageColumn: z7.string().max(128).default("message"),
-  levelColumn: z7.string().max(128).optional(),
-  pollIntervalMs: z7.number().int().min(500).max(6e4).default(2e3)
-});
-var LogSourceConfigSchema = z7.discriminatedUnion("type", [
-  ConsoleLogSourceSchema,
-  FileLogSourceSchema,
-  MongoLogSourceSchema,
-  MySQLLogSourceSchema
-]);
-
-// ../../packages/shared/src/schemas/service.schema.ts
-var HealthCheckSchema = z8.object({
-  type: z8.enum(["http", "command"]).default("http"),
-  // HTTP-specific (required when type=http)
-  path: z8.string().min(1).max(500).startsWith("/").optional(),
-  method: z8.enum(["GET", "HEAD", "POST", "PUT"]).optional().default("GET"),
-  expectedStatus: z8.number().int().min(100).max(599).optional().default(200),
-  // Command-specific (required when type=command)
-  command: z8.string().min(1).max(4096).optional(),
-  // Shared
-  interval: z8.number().int().positive().default(1e3),
-  timeout: z8.number().int().positive().default(1e3),
-  retries: z8.number().int().nonnegative().default(3),
-  initialDelay: z8.number().int().nonnegative().optional().default(0)
-}).refine(
-  (data) => data.type === "http" ? !!data.path : !!data.command,
-  { message: "HTTP type requires path; command type requires command" }
-);
-var BootstrapCommandSchema = z8.object({
-  id: z8.string().min(1).max(64),
-  label: z8.string().max(200).default(""),
-  entrypoint: z8.string().max(4096).optional(),
-  command: z8.string().max(4096).default(""),
-  user: z8.string().max(256).optional()
-});
-var DockerConfigSchema = z8.object({
-  // Image mode (pull from registry) — mutually exclusive with build mode in UI
-  image: z8.string().min(1).max(1024).optional(),
-  // Build mode — Dockerfile stored inline in services.json
-  dockerfile: z8.string().max(65536).optional(),
-  buildContext: z8.string().max(4096).optional(),
-  buildArgs: z8.record(z8.string().max(256), z8.string().max(4096)).default({}).refine(
-    (obj) => Object.keys(obj).length <= 50,
-    { message: "Max 50 build args" }
-  ),
-  targetStage: z8.string().max(256).optional(),
-  // Runtime config
-  networkMode: z8.enum(["host", "bridge"]).default("host"),
-  ports: z8.array(z8.string().max(64)).max(100).default([]),
-  volumes: z8.array(z8.string().max(1024)).max(100).default([]),
-  mountRootpath: z8.boolean().default(false),
-  entrypoint: z8.string().max(4096).optional(),
-  command: z8.string().max(4096).optional(),
-  user: z8.string().max(256).optional(),
-  useNativeCommand: z8.boolean().default(false),
-  nativeCommandMode: z8.enum(["shared", "isolated"]).default("isolated"),
-  nativeShell: z8.string().max(256).default("sh"),
-  bootstrapCommands: z8.array(BootstrapCommandSchema).max(20).default([])
-});
-var RestartStrategySchema = z8.enum(["none", "on-failure", "always", "unless-stopped"]).default("none");
-var ServiceShortcutSchema = z8.object({
-  id: z8.string().min(1).max(64),
-  label: z8.string().max(200).default(""),
-  command: z8.string().max(4096).default(""),
-  cwd: z8.string().max(4096).optional()
-});
-var ServiceCommandSchema = z8.object({
-  id: z8.string().min(1).max(64),
-  label: z8.string().max(200).default(""),
-  command: z8.string().max(4096).default(""),
-  cwd: z8.string().max(4096).optional(),
-  shell: z8.boolean().optional().default(true)
-});
-var VariableSlotSchema = z8.object({
-  value: z8.string().max(8192).default(""),
-  pre: z8.string().max(8192).default(""),
-  post: z8.string().max(8192).default(""),
-  isSecret: z8.boolean().default(false),
-  // When true, this variable is injected into the process environment of AI
-  // agents (Claude Code, Codex, …) spawned while this environment is active.
-  // Opt-in: defaults to false so secrets are never leaked to AI agents by default.
-  injectIntoAi: z8.boolean().default(false)
-});
-var VariableSchema = z8.object({
-  key: z8.string().min(1).max(256),
-  value: VariableSlotSchema
-});
-var VariablesRecordSchema = z8.record(
-  z8.string().max(128),
-  VariableSchema
-).refine(
-  (obj) => Object.keys(obj).length <= 200,
-  { message: "Max 200 variables" }
-);
-var VariableSlotsRecordSchema = z8.record(
-  z8.string().max(256),
-  VariableSlotSchema
-).refine(
-  (obj) => Object.keys(obj).length <= 200,
-  { message: "Max 200 variable slots" }
-);
-var ServiceConfigSchema = z8.object({
-  id: z8.string().max(128),
-  orgId: z8.string().max(128).nullable().optional(),
-  agentId: z8.string().max(128).optional(),
-  // Optional: if absent, inherited from active environment's agentId
-  name: z8.string().min(1).max(200),
-  commands: z8.array(ServiceCommandSchema).max(50).optional().default([]),
-  cwd: z8.string().max(4096).optional(),
-  ports: z8.array(z8.number().int().positive().max(65535)).max(20).optional().default([]),
-  // Metadata fields (migration from old Runeya)
-  groups: z8.array(z8.string().max(200)).max(20).optional().default([]),
-  description: z8.string().max(2e3).optional(),
-  /** Path (relative to service.cwd or absolute) where the service's docs/wiki markdown files live. Optional — defaults to service.cwd. */
-  docsPath: z8.string().max(4096).optional(),
-  url: z8.string().max(2048).optional(),
-  localUrls: z8.array(z8.object({
-    url: z8.string().max(253).regex(/^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/),
-    port: z8.number().int().min(1).max(65535)
-  })).max(20).optional().default([]),
-  openapiUrl: z8.string().max(2048).optional(),
-  git: z8.object({
-    remote: z8.string().max(2048).optional(),
-    home: z8.string().max(2048).optional()
-  }).optional(),
-  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-  // Transient env dict (resolved by server before deployment, used directly by agent runner — NOT persisted)
-  env: z8.record(z8.string().max(256), z8.string().max(8192)).default({}).refine(
-    (obj) => Object.keys(obj).length <= 200,
-    { message: "Too many env vars (max 200)" }
-  ),
-  envSecrets: z8.array(z8.string().max(256)).max(200).default([]),
-  // Transient: resolved JS log parsers (from parserIds, resolved by server before deployment — NOT persisted)
-  resolvedLogParsers: z8.array(JSLogParserSchema).default([]).optional(),
-  // Transient: resolved working directory (cwd with env vars expanded — NOT persisted)
-  resolvedCwd: z8.string().optional(),
-  runner: z8.enum(["native", "docker"]).optional().default("native"),
-  dockerConfig: DockerConfigSchema.optional(),
-  healthCheck: HealthCheckSchema.optional(),
-  parserIds: z8.array(z8.string().max(128)).max(50).default([]),
-  shortcuts: z8.array(ServiceShortcutSchema).max(50).optional().default([]),
-  autoRestart: z8.boolean().optional().default(false),
-  clearLogsOnStart: z8.boolean().optional().default(false),
-  restartStrategy: RestartStrategySchema.optional(),
-  maxRestarts: z8.number().int().nonnegative().optional(),
-  restartBackoffMs: z8.number().int().positive().optional().default(1e3),
-  // Log sources additionnelles (au-delà du stdout/stderr console par défaut)
-  logSources: z8.array(LogSourceConfigSchema).max(20).optional().default([])
-});
-var CreateServiceSchema = ServiceConfigSchema.omit({ id: true }).partial().required({ name: true });
-var UpdateServiceSchema = ServiceConfigSchema.partial().required({ id: true }).extend({
-  agentId: z8.string().max(128).nullable().optional(),
-  // null = clear (inherit from env), undefined = no change
-  cwd: z8.string().max(4096).nullable().optional(),
-  git: z8.object({ remote: z8.string().max(2048).optional(), home: z8.string().max(2048).optional() }).nullable().optional(),
-  meta: z8.record(z8.string().max(256), z8.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-  healthCheck: HealthCheckSchema.nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/process.schema.ts
-import { z as z9 } from "zod";
-var ProcessStateSchema = z9.enum(["starting", "running", "stopped", "errored"]);
-var HealthStatusSchema = z9.enum(["healthy", "unhealthy", "unknown"]);
-var ProcessStatusSchema = z9.object({
-  id: z9.string().max(128),
-  serviceId: z9.string().max(128),
-  agentId: z9.string().max(128),
-  state: ProcessStateSchema,
-  pid: z9.number().int().nullable().optional(),
-  pids: z9.array(z9.number().int()).optional().default([]),
-  exitCode: z9.number().int().nullable().optional(),
-  startedAt: z9.coerce.date().nullable().optional(),
-  restartCount: z9.number().int().nonnegative().default(0),
-  uptime: z9.number().nonnegative().default(0),
-  healthStatus: HealthStatusSchema.default("unknown"),
-  /**
-   * Le répertoire où le processus s'exécute VRAIMENT, absolutisé par l'agent.
-   *
-   * Rapporté par l'agent plutôt que déduit de la config : entre le `cwd` de la
-   * commande, celui du service, l'ancrage sur le projet et les variables que
-   * l'agent étend lui-même, la valeur affichée n'aurait rien prouvé. Ce qui
-   * intéresse quand un service tourne contre le mauvais dépôt, c'est le chemin
-   * final — y compris quand il retombe sur le répertoire de l'agent.
-   */
-  cwd: z9.string().max(4096).nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/log.schema.ts
-import { z as z10 } from "zod";
-var LogLevelSchema = z10.enum(["debug", "info", "warn", "error", "fatal"]);
-var LogLineSchema = z10.object({
-  /** Raw log line as received from the process (immutable context) */
-  raw: z10.string(),
-  /** Source stream (immutable context) */
-  stream: z10.enum(["stdout", "stderr"]),
-  /** Severity level */
-  level: LogLevelSchema,
-  /** Parsed/enriched message to display */
-  message: z10.string(),
-  /** When true, the line is hidden from the log view */
-  hidden: z10.boolean(),
-  /** Arbitrary key/value pairs shown in the detail panel */
-  metadata: z10.record(z10.string().max(256), z10.unknown()).refine(
-    (obj) => Object.keys(obj).length <= 100,
-    { message: "Too many metadata keys (max 100)" }
-  ),
-  /** Full parsed JSON object when the line is JSON */
-  json: z10.record(z10.string(), z10.unknown()).optional(),
-  /** Custom header for the JSON log card (supports HTML, sanitized before display) */
-  jsonHeader: z10.string().max(256).optional()
-});
-var LogCardDirectiveSchema = z10.object({
-  id: z10.string().max(128),
-  type: z10.string().max(64),
-  header: z10.string().max(256),
-  collapsable: z10.boolean().optional(),
-  collapsed: z10.boolean().optional(),
-  state: z10.enum(["open", "append", "close", "self"])
-});
-var ParsedLogSchema = z10.object({
-  id: z10.string().max(128),
-  processId: z10.string().max(128),
-  pid: z10.number().int().nullable().optional(),
-  timestamp: z10.coerce.date(),
-  level: LogLevelSchema.default("info"),
-  message: z10.string().max(16384),
-  raw: z10.string().max(16384),
-  stream: z10.enum(["stdout", "stderr"]).default("stdout"),
-  hidden: z10.boolean().optional().default(false),
-  metadata: z10.record(z10.string().max(256), z10.unknown()).optional().refine(
-    (obj) => !obj || Object.keys(obj).length <= 100,
-    { message: "Too many metadata keys (max 100)" }
-  ),
-  json: z10.record(z10.string(), z10.unknown()).optional(),
-  logCard: LogCardDirectiveSchema.optional(),
-  sourceType: z10.enum(["console", "file", "mongo", "mysql"]).optional(),
-  sourcePath: z10.string().max(4096).optional()
-});
-
-// ../../packages/shared/src/schemas/agent.schema.ts
-import { z as z11 } from "zod";
-var ENV_VAR_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var AgentConfigSchema = z11.object({
-  id: z11.string().max(128),
-  name: z11.string().min(1).max(100),
-  url: z11.string().url().max(2048),
-  passphrase: z11.string().min(1).max(1024),
-  passthroughEnv: z11.array(
-    z11.string().regex(ENV_VAR_NAME_REGEX).max(256)
-  ).max(100).default([])
-});
-var AgentStatusSchema = z11.object({
-  connected: z11.boolean(),
-  lastSeen: z11.string().nullable().optional(),
-  uptime: z11.number().nonnegative().default(0),
-  runnersAvailable: z11.array(z11.enum(["native", "docker"])).default(["native"]),
-  lanIp: z11.string().optional(),
-  /**
-   * Ce que la machine de l'agent vaut pour les builtins de portée `agent`.
-   * Sert à PRÉVISUALISER — la valeur injectée reste calculée au lancement, par
-   * l'agent lui-même : une IP change, un agent se déconnecte, et un statut
-   * n'est qu'un cliché.
-   */
-  os: z11.string().max(64).optional(),
-  home: z11.string().max(4096).optional(),
-  cwd: z11.string().max(4096).optional()
-});
-
-// ../../packages/shared/src/schemas/permission.schema.ts
-import { z as z12 } from "zod";
-var GlobalRoleSchema = z12.enum(["owner", "admin", "member"]);
-var ProjectRoleSchema = z12.enum(["admin", "editor", "viewer"]);
-var ProjectMemberRoleSchema = z12.object({
-  id: z12.string().max(128),
-  projectId: z12.string().max(128),
-  userId: z12.string().max(128),
-  role: ProjectRoleSchema
-});
-
-// ../../packages/shared/src/schemas/sync.schema.ts
-import { z as z13 } from "zod";
-var ConfigVersionSchema = z13.object({
-  id: z13.string().max(128),
-  entityType: z13.enum(["project", "service"]),
-  entityId: z13.string().max(128),
-  version: z13.string().max(128),
-  parentVersion: z13.string().max(128),
-  data: z13.record(z13.string(), z13.unknown()).refine(
-    (obj) => Object.keys(obj).length <= 1e3,
-    "Too many data keys (max 1000)"
-  ),
-  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3),
-  userId: z13.string().max(128),
-  timestamp: z13.coerce.date(),
-  resolved: z13.boolean().default(false)
-});
-var ConfigChangeSchema = z13.object({
-  entityType: z13.enum(["project", "service"]),
-  entityId: z13.string().max(128),
-  version: z13.string().max(128),
-  parentVersion: z13.string().max(128),
-  data: z13.record(z13.string(), z13.unknown()).refine(
-    (obj) => Object.keys(obj).length <= 1e3,
-    "Too many data keys (max 1000)"
-  ),
-  patch: z13.array(z13.record(z13.string(), z13.unknown())).max(1e3)
-});
-var SyncStatusSchema = z13.object({
-  connected: z13.boolean(),
-  lastSync: z13.coerce.date().nullable().optional(),
-  pendingChanges: z13.number().int().nonnegative().default(0),
-  conflicts: z13.number().int().nonnegative().default(0)
-});
-
-// ../../packages/shared/src/schemas/audit.schema.ts
-import { z as z14 } from "zod";
-var AuditActionSchema = z14.enum([
-  "create",
-  "update",
-  "delete",
-  "invite",
-  "remove",
-  "deploy",
-  "start",
-  "stop",
-  "roleChange"
-]);
-var AuditEntityTypeSchema = z14.enum([
-  "org",
-  "project",
-  "service",
-  "member",
-  "permission"
-]);
-var AuditLogSchema = z14.object({
-  id: z14.string().max(128),
-  orgId: z14.string().max(128),
-  userId: z14.string().max(128),
-  action: AuditActionSchema,
-  entityType: AuditEntityTypeSchema,
-  entityId: z14.string().max(128),
-  metadata: z14.record(z14.string().max(256), z14.unknown()).default({}).refine(
-    (obj) => Object.keys(obj).length <= 100,
-    { message: "Too many metadata keys (max 100)" }
-  ),
-  timestamp: z14.coerce.date()
-});
-
-// ../../packages/shared/src/schemas/metrics.schema.ts
-import { z as z15 } from "zod";
-var ProcessMetricsSchema = z15.object({
-  processId: z15.string().max(128),
-  cpu: z15.number().nonnegative(),
-  memory: z15.number().int().nonnegative(),
-  timestamp: z15.string()
-});
-
-// ../../packages/shared/src/schemas/environment.schema.ts
-import { z as z16 } from "zod";
-var EnvironmentVariablesSchema = z16.record(
-  z16.string().max(256),
-  VariableSchema
-).refine(
-  (obj) => Object.keys(obj).length <= 200,
-  { message: "Max 200 variables" }
-);
-var EnvironmentSchema = z16.object({
-  id: z16.string().max(128),
-  projectId: z16.string().max(128),
-  name: z16.string().min(1).max(200),
-  description: z16.string().max(2e3).optional().default(""),
-  parentIds: z16.array(z16.string().max(128)).max(10).default([]),
-  variables: EnvironmentVariablesSchema.default({}),
-  // Scope: 'global' = project-level env, 'service' = per-service env
-  scope: z16.enum(["global", "service"]).default("global"),
-  // When scope='service': the serviceId this env belongs to
-  reference: z16.string().max(128).optional(),
-  // When scope='service': the globalEnvId this env activates on
-  activateOn: z16.string().max(128).optional(),
-  immutable: z16.boolean().default(false),
-  default: z16.boolean().optional().default(false),
-  color: z16.string().max(20).optional(),
-  bgColor: z16.string().max(20).optional(),
-  // When scope='global': the default agent used by services that don't have an explicit agentId
-  agentId: z16.string().max(128).optional()
-});
-var ResolvedEnvironmentSchema = z16.object({
-  variables: z16.record(z16.string().max(256), VariableSchema).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved variables" }),
-  env: z16.record(z16.string().max(256), z16.string().max(8192)).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 resolved env vars" }),
-  envSecrets: z16.array(z16.string().max(256)).max(500),
-  sources: z16.record(z16.string().max(256), z16.object({
-    environmentId: z16.string().max(128),
-    environmentName: z16.string().max(200),
-    overridden: z16.boolean(),
-    resolvedFrom: z16.object({
-      environmentId: z16.string().max(128),
-      environmentName: z16.string().max(200)
-    }).optional(),
-    // Set when a machine-local override was applied to this variable, pointing
-    // at the environment that carries the winning override. Distinct from
-    // `overridden`, which also covers "shadows an inherited variable".
-    overriddenBy: z16.object({
-      environmentId: z16.string().max(128),
-      environmentName: z16.string().max(200)
-    }).optional()
-  })).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 source entries" })
-});
-var CreateEnvironmentSchema = EnvironmentSchema.omit({ id: true }).extend({
-  description: z16.string().max(2e3).optional().default(""),
-  parentIds: z16.array(z16.string().max(128)).max(10).optional().default([]),
-  variables: EnvironmentVariablesSchema.optional().default({}),
-  scope: z16.enum(["global", "service"]).optional().default("global"),
-  reference: z16.string().max(128).optional(),
-  activateOn: z16.string().max(128).optional(),
-  immutable: z16.boolean().optional().default(false)
-});
-var UpdateEnvironmentSchema = EnvironmentSchema.partial().required({ id: true }).extend({
-  description: z16.string().max(2e3).optional(),
-  parentIds: z16.array(z16.string().max(128)).max(10).optional(),
-  variables: EnvironmentVariablesSchema.optional(),
-  scope: z16.enum(["global", "service"]).optional(),
-  immutable: z16.boolean().optional(),
-  default: z16.boolean().optional(),
-  agentId: z16.string().max(128).nullable().optional()
-  // null = clear (no default agent)
-});
-
-// ../../packages/shared/src/schemas/environment-overrides.schema.ts
-import { z as z17 } from "zod";
-var VariableOverrideSchema = z17.object({
-  value: VariableSlotSchema
-});
-var EnvironmentOverridesSchema = z17.record(
-  z17.string().max(128),
-  VariableOverrideSchema
-).refine(
-  (obj) => Object.keys(obj).length <= 5e3,
-  { message: "Max 5000 overrides" }
-);
-
-// ../../packages/shared/src/schemas/api-key.schema.ts
-import { z as z18 } from "zod";
-var ApiServiceActionSchema = z18.enum([
-  "service:read",
-  "service:start",
-  "service:stop",
-  "service:restart",
-  "service:healthcheck",
-  "service:status",
-  "logs:read"
-]);
-var ApiEnvActionSchema = z18.enum(["env:read", "env:write"]);
-var ApiEnvPermSchema = z18.object({
-  environmentId: z18.string().max(128),
-  actions: z18.array(ApiEnvActionSchema).max(10).default(["env:read"]),
-  includeSecrets: z18.boolean().default(false)
-});
-var ApiServicePermSchema = z18.object({
-  serviceId: z18.string().max(128),
-  actions: z18.array(ApiServiceActionSchema).max(10).default(["service:read"]),
-  environments: z18.array(ApiEnvPermSchema).max(100).default([])
-});
-var ApiKeyScopeSchema = z18.object({
-  services: z18.array(ApiServicePermSchema).max(500).default([])
-});
-var ApiKeySchema = z18.object({
-  id: z18.string().max(128),
-  name: z18.string().min(1).max(200),
-  key: z18.string().regex(/^[0-9a-f]{64}$/i),
-  scopes: ApiKeyScopeSchema,
-  createdAt: z18.string().max(64),
-  isPublic: z18.boolean().default(false)
-});
-var PersistedApiKeySchema = ApiKeySchema.extend({
-  key: z18.string().min(1).max(4096)
-});
-var ApiKeysFileSchema = z18.object({
-  keys: z18.array(PersistedApiKeySchema).max(100)
-});
-var MaskedApiKeySchema = ApiKeySchema.omit({ key: true }).extend({
-  /** Last 4 characters of the secret, for recognising a key in a list. */
-  keyPreview: z18.string().max(8)
-});
-
-// ../../packages/shared/src/schemas/image.schema.ts
-import { z as z19 } from "zod";
-var ALLOWED_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/webp", "image/gif"];
-var ImagePartSchema = z19.object({
-  type: z19.literal("image"),
-  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  url: z19.string().min(1),
-  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
-  altText: z19.string().max(500).optional()
-});
-var ImageUploadResponseSchema = z19.object({
-  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  url: z19.string().min(1),
-  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
-  originalName: z19.string()
-});
-var ImageMetaSchema = z19.object({
-  imageId: z19.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID"),
-  filePath: z19.string().min(1),
-  mimeType: z19.enum(ALLOWED_IMAGE_MIME_TYPES),
-  originalName: z19.string().min(1),
-  createdAt: z19.number().positive(),
-  size: z19.number().positive().optional()
-});
-
-// ../../packages/shared/src/schemas/kanban.schema.ts
-import { z as z20 } from "zod";
-var KanbanAttachmentSchema = z20.object({
-  /** Server-issued id, also the storage key. */
-  id: z20.string().max(128),
-  name: z20.string().max(255),
-  size: z20.number().int().nonnegative(),
-  contentType: z20.string().max(128)
-});
-var KanbanCardEventSchema = z20.object({
-  type: z20.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment", "archived", "unarchived"]),
-  timestamp: z20.string(),
-  /** Extra context: old/new column name, old/new title, comment text, etc. */
-  /**
-   * Le texte de l'entrée : le corps d'un commentaire, ou le contexte du geste.
-   *
-   * Borné comme le corps d'une carte (100 000), et non plus à 5 000 : un
-   * commentaire est de la prose comme une description, et rien de technique ne
-   * justifiait un écart de vingt fois. La borne étroite s'est vue à l'import
-   * d'un Kanbanize, où des commentaires de 12 000 caractères passaient par
-   * l'API publique — bornée, elle, à 20 000 — pour écrire en base une donnée que
-   * ce schéma déclarait invalide, et qu'aucune reprise depuis l'interface
-   * n'aurait ensuite pu enregistrer.
-   */
-  detail: z20.string().max(1e5).optional(),
-  /**
-   * Stable identity of the event, used to tell an edit from an insertion when a
-   * whole history is written back. Absent on events recorded before the field
-   * existed; those fall back to (type, timestamp).
-   */
-  id: z20.string().max(128).optional(),
-  /** Who authored this event — 'ai' or 'user'. Only set for comment events. */
-  author: z20.enum(["ai", "user"]).optional(),
-  /**
-   * Qui est derrière l'événement, estampillé par le serveur — jamais pris du
-   * client, sans quoi n'importe qui pourrait signer au nom d'un autre.
-   *
-   * Posé sur les commentaires (c'est ce qui rend « mon propre commentaire »
-   * répondable ; `author` ne sépare que l'IA de l'humain) et sur les
-   * déplacements. Absent des événements écrits avant qu'on l'estampille : un
-   * lecteur doit donc afficher « on ne sait pas », pas un nom vide.
-   *
-   * Pour une clé d'API, c'est le nom de la clé et non son porteur : la clé
-   * emprunte les droits de son créateur, pas son identité — personne ne doit
-   * croire qu'un humain a déplacé ce qu'un robot de CI a déplacé.
-   */
-  authorUser: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional(),
-  /** Set when the author amended their comment, so the UI can say so. */
-  editedAt: z20.string().optional(),
-  /** Files attached to a comment — same storage as a card's own attachments. */
-  attachments: z20.array(KanbanAttachmentSchema).max(20).optional(),
-  /** Conversation that produced this event (comments only). Used to navigate back to the conversation. */
-  conversationId: z20.string().optional()
-});
-var KanbanCardSchema = z20.object({
-  id: z20.string(),
-  title: z20.string().min(1).max(500),
-  markdown: z20.string().max(1e5).default(""),
-  /**
-   * Legacy inline images, kept so boards written before object storage still
-   * render. New uploads go to `attachments` instead.
-   */
-  images: z20.array(z20.string()).default([]),
-  /** Files attached to the card — stored out of band, referenced here. */
-  attachments: z20.array(KanbanAttachmentSchema).max(50).default([]),
-  order: z20.number().int(),
-  /**
-   * La priorité de la carte, de 1 à 10 — 10 étant le plus urgent.
-   *
-   * Facultative, et absente veut dire « pas de priorité », pas « la plus
-   * basse » : une carte qu'on n'a pas encore arbitrée ne doit pas se ranger
-   * d'office au fond de la pile.
-   */
-  priority: z20.number().int().min(1).max(10).optional(),
-  /**
-   * Les groupes de la carte — des étiquettes libres, posées par l'équipe.
-   *
-   * Rien ne les déclare ailleurs : un groupe existe parce qu'une carte le
-   * porte, et disparaît avec la dernière qui le portait. C'est ce qui permet
-   * d'en créer un en le tapant, sans passer par un écran d'administration.
-   */
-  groups: z20.array(z20.string().min(1).max(60)).max(30).optional(),
-  /**
-   * L'échéance de la carte : le jour où elle est attendue, `AAAA-MM-JJ`.
-   *
-   * Un jour, pas un instant, et c'est une décision : une équipe se dit « pour
-   * vendredi », jamais « pour vendredi 23:59:59 UTC ». Stocker un instant
-   * ferait afficher une échéance au 4 mars comme le 3 mars à qui travaille à
-   * l'ouest de Greenwich — la carte serait en retard d'un jour pour la moitié
-   * de l'équipe, et personne ne saurait pourquoi.
-   *
-   * Facultative, et absente veut dire « pas d'échéance », pas « en retard » :
-   * une carte qu'on n'a pas datée ne doit pas s'annoncer comme urgente.
-   */
-  deadline: z20.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
-  /**
-   * La couleur de la carte, en hexadécimal (`#RRGGBB`) — un liseré en haut de
-   * la carte, et rien d'autre : ce qu'elle veut dire appartient à l'équipe.
-   *
-   * Bornée à une notation stricte plutôt qu'à une chaîne libre : cette valeur
-   * finit dans un attribut `style`, et une couleur ne doit pouvoir contenir
-   * qu'une couleur. Absente sur les cartes sans couleur.
-   */
-  color: z20.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-  /**
-   * Le journal de la carte — commentaires compris.
-   *
-   * Optionnel, et c'est tout l'intérêt : c'est la partie qui grossit sans fin
-   * (une IA bavarde y écrit des pages), alors les lectures de tableau ne le
-   * transportent plus. `undefined` veut dire « pas chargé », et une écriture
-   * qui l'omet laisse au serveur celui qu'il a en base — à ne pas confondre
-   * avec `[]`, qui demanderait bel et bien de le vider.
-   */
-  history: z20.array(KanbanCardEventSchema).optional(),
-  /**
-   * Ce que le journal absent laisse quand même dire : combien de commentaires,
-   * et quand fut le dernier. Posés par le serveur en lecture, ignorés en
-   * écriture — la carte ne les stocke pas, ils se déduisent de `history`.
-   */
-  commentCount: z20.number().int().nonnegative().optional(),
-  lastCommentAt: z20.string().optional(),
-  /**
-   * Les entrées de journal qui ouvrent une conversation IA. Elles restent dans
-   * la lecture allégée — il y en a une poignée par carte, et l'hôte s'en sert
-   * pour dire, sans ouvrir la carte, qu'une IA y travaille.
-   */
-  conversationEvents: z20.array(KanbanCardEventSchema).optional(),
-  createdAt: z20.string(),
-  updatedAt: z20.string(),
-  /**
-   * Quand la carte a été archivée — absente tant qu'elle est au tableau.
-   *
-   * Une carte archivée reste dans sa colonne en base : c'est la lecture qui la
-   * retire du tableau, jamais une écriture qui la déplace. Rien à recoller donc
-   * au désarchivage, et aucun cimetière où une carte pourrait se perdre.
-   */
-  archivedAt: z20.string().optional(),
-  /**
-   * La colonne d'où la carte a été archivée, telle qu'elle s'appelait alors.
-   *
-   * L'identifiant sert à l'y remettre, le titre à le dire dans l'archive même
-   * quand la colonne a disparu depuis — auquel cas le désarchivage repose la
-   * carte dans la première colonne, sans se taire sur son origine.
-   */
-  archivedFrom: z20.object({ columnId: z20.string().max(128), columnTitle: z20.string().max(200) }).optional(),
-  /**
-   * Quand la carte a été supprimée. Rien n'est effacé : la carte reste en base,
-   * et toutes les lectures l'écartent.
-   *
-   * Une suppression est le seul geste que rien ne rattrape — sauf à ne pas
-   * l'exécuter vraiment. La colonne et le tableau portent le même champ, pour
-   * que supprimer l'un n'emporte jamais les cartes de l'autre.
-   */
-  deletedAt: z20.string().optional(),
-  /**
-   * People assigned to the card. Names are denormalized for display; the server
-   * keeps only members of the owning organization, and notifies newcomers.
-   */
-  assignees: z20.array(z20.object({ id: z20.string().max(128), name: z20.string().max(200) })).max(20).default([]),
-  /**
-   * Who first created the card. Stamped by the server the first time a card id
-   * appears in a board write, never taken from the client — a member could
-   * otherwise claim any authorship. Absent on cards created before this field
-   * existed, so readers must treat it as unknown rather than assume.
-   */
-  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional()
-});
-var KanbanColumnSchema = z20.object({
-  id: z20.string(),
-  title: z20.string().min(1).max(200),
-  order: z20.number().int(),
-  cards: z20.array(KanbanCardSchema).default([]),
-  /**
-   * Le regroupement auquel la colonne appartient, s'il y en a un.
-   *
-   * Un pointeur vers le parent, et rien dans l'autre sens : le groupe ne tient
-   * pas la liste de ses membres. Deux listes qui prétendent dire qui contient
-   * quoi finissent par se contredire, et un déplacement devient alors deux
-   * écritures au lieu d'une.
-   */
-  groupId: z20.string().optional(),
-  /** Supprimée, mais conservée — voir `deletedAt` sur la carte. */
-  deletedAt: z20.string().optional()
-});
-var KanbanColumnGroupSchema = z20.object({
-  id: z20.string(),
-  title: z20.string().min(1).max(200),
-  /** La couleur du bandeau, en hexadécimal — l'interface décide du défaut. */
-  color: z20.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-  /** Le groupe parent, pour les regroupements imbriqués. */
-  parentId: z20.string().optional(),
-  /** Supprimé, mais conservé — comme une colonne. */
-  deletedAt: z20.string().optional()
-});
-var KanbanBoardSchema = z20.object({
-  id: z20.string(),
-  name: z20.string().min(1).max(200),
-  description: z20.string().max(1e4).default(""),
-  /**
-   * Le mode d'emploi du tableau, en texte libre : ce que veulent dire ses
-   * colonnes, quand une carte a le droit d'avancer, les conventions de
-   * l'équipe. Écrit par les humains, lu surtout par l'IA — il est injecté dans
-   * le prompt des agents pour qu'ils travaillent selon les règles du tableau
-   * plutôt que selon les leurs.
-   */
-  instructions: z20.string().max(2e4).default(""),
-  columns: z20.array(KanbanColumnSchema).default([]),
-  /** Les regroupements de colonnes — vide sur un tableau qui n'en a jamais eu. */
-  columnGroups: z20.array(KanbanColumnGroupSchema).default([]),
-  archived: z20.boolean().default(false),
-  /** Supprimé, mais conservé avec ses cartes — voir `deletedAt` sur la carte. */
-  deletedAt: z20.string().optional(),
-  createdAt: z20.string(),
-  updatedAt: z20.string()
-});
-var CreateKanbanBoardInput = z20.object({
-  name: z20.string().min(1).max(200),
-  description: z20.string().max(1e4).optional(),
-  instructions: z20.string().max(2e4).optional()
-});
-var UpdateKanbanBoardInput = z20.object({
-  id: z20.string(),
-  name: z20.string().min(1).max(200).optional(),
-  description: z20.string().max(1e4).optional(),
-  instructions: z20.string().max(2e4).optional(),
-  columns: z20.array(KanbanColumnSchema).optional(),
-  archived: z20.boolean().optional()
-});
-var KanbanCardLinkSchema = z20.object({
-  id: z20.string().max(128),
-  /** Le tableau et la carte qui *dépendent* de l'autre. */
-  childBoardId: z20.string().max(64),
-  childCardId: z20.string().max(128),
-  /** Le tableau et la carte *dont* on dépend. */
-  parentBoardId: z20.string().max(64),
-  parentCardId: z20.string().max(128),
-  createdAt: z20.string(),
-  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }).optional()
-});
-var KanbanCardRefSchema = z20.object({
-  cardId: z20.string().max(128),
-  boardId: z20.string().max(64),
-  boardName: z20.string().max(200),
-  columnId: z20.string().max(128),
-  columnTitle: z20.string().max(200),
-  title: z20.string().max(500),
-  /** Les mêmes informations qu'une ligne de tableau montre d'une carte d'ici. */
-  assignees: z20.array(z20.object({ id: z20.string().max(128), name: z20.string().max(200) })).default([]),
-  commentCount: z20.number().int().nonnegative().default(0)
-});
-
-// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
-import { z as z21 } from "zod";
-var CloudApiScopeSchema = z21.enum([
-  "kanban:read",
-  "kanban:write",
-  "kanban:comment",
-  "kanban:delete"
-]);
-var CloudApiKeySecretSchema = z21.string().regex(/^rk_[0-9a-f]{64}$/);
-var CloudApiKeySchema = z21.object({
-  id: z21.string().max(128),
-  organizationId: z21.string().max(128),
-  name: z21.string().min(1).max(200),
-  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
-  /**
-   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
-   * l'organisation ».
-   *
-   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
-   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
-   * nommait plus que lui.
-   */
-  boards: z21.array(z21.string().max(64)).max(200).nullable(),
-  createdAt: z21.string().max(64),
-  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
-  lastUsedAt: z21.string().max(64).nullable(),
-  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
-  createdBy: z21.object({ id: z21.string().max(128), name: z21.string().max(200) }),
-  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
-  keyPreview: z21.string().max(8)
-});
-var CreatedCloudApiKeySchema = z21.object({
-  key: CloudApiKeySchema,
-  secret: CloudApiKeySecretSchema
-});
-var CreateCloudApiKeyInput = z21.object({
-  organizationId: z21.string().min(1).max(128),
-  name: z21.string().min(1).max(200),
-  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
-  boards: z21.array(z21.string().max(64)).max(200).nullable().default(null)
-});
-var UpdateCloudApiKeyInput = z21.object({
-  id: z21.string().min(1).max(128),
-  name: z21.string().min(1).max(200).optional(),
-  scopes: z21.array(CloudApiScopeSchema).min(1).max(10).optional(),
-  boards: z21.array(z21.string().max(64)).max(200).nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/changelog.schema.ts
-import { z as z22 } from "zod";
-var ChangelogSurfaceSchema = z22.enum(["app", "cloud"]);
-var ChangelogChangeKindSchema = z22.enum(["feature", "improvement", "fix", "breaking"]);
-var ChangelogTextSchema = z22.object({
-  fr: z22.string().min(1).max(500),
-  en: z22.string().min(1).max(500)
-});
-var ChangelogChangeSchema = z22.object({
-  kind: ChangelogChangeKindSchema,
-  text: ChangelogTextSchema
-});
-var ChangelogDraftSchema = ChangelogChangeSchema.extend({
-  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  title: ChangelogTextSchema.optional()
-});
-var ChangelogReleaseSchema = z22.object({
-  surface: ChangelogSurfaceSchema,
-  /** `1.4.2` pour l'app (version npm publiée), `2026-09-03` — ou `2026-09-03.2` — pour le cloud. */
-  version: z22.string().min(1).max(32).regex(/^[0-9][0-9.-]*$/),
-  /** Date de publication, `YYYY-MM-DD`. */
-  date: z22.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  /** Facultatif : une version peut s'annoncer par son seul numéro. */
-  title: ChangelogTextSchema.optional(),
-  /** Une version sans changement n'a rien à annoncer : elle n'a pas sa place ici. */
-  changes: z22.array(ChangelogChangeSchema).min(1).max(50)
-});
-var ChangelogIndexItemSchema = ChangelogReleaseSchema.omit({ changes: true }).extend({
-  changeCount: z22.number().int().nonnegative()
-});
-
-// ../../packages/shared/src/utils/crypto.ts
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3, pbkdf2Sync } from "crypto";
-
-// ../../packages/shared/src/native-parsers.ts
-var epoch = /* @__PURE__ */ new Date("2025-01-01T00:00:00Z");
-var nativeParsers = [
-  {
-    id: "native:json",
-    name: "JSON Log Parser",
-    description: "Parses JSON log lines and extracts level, message, timestamp, metadata, and the full parsed object.",
-    code: `(line) => {
-  var trimmed = line.message.trim();
-  if (!trimmed.startsWith('{')) return line;
-  try {
-    var obj = JSON.parse(trimmed);
-    var level = (obj.level || obj.severity || obj.loglevel || '').toString().toLowerCase();
-    var levelMap = { trace: 'debug', debug: 'debug', info: 'info', warn: 'warn', warning: 'warn', error: 'error', fatal: 'fatal', err: 'error' };
-    var mappedLevel = levelMap[level] || line.level;
-    var message = obj.message || obj.msg || obj.text || trimmed;
-    var metadata = {};
-    for (var k in obj) {
-      if (['level','severity','loglevel','message','msg','text','timestamp','time','ts'].indexOf(k) !== -1) continue;
-      metadata[k] = typeof obj[k] === 'string' ? obj[k] : JSON.stringify(obj[k]);
-    }
-    var merged = {};
-    for (var mk in line.metadata) merged[mk] = line.metadata[mk];
-    for (var nk in metadata) merged[nk] = metadata[nk];
-    return { raw: line.raw, stream: line.stream, level: mappedLevel, message: String(message).slice(0, 16384), hidden: line.hidden, metadata: merged, json: obj, jsonHeader: line.jsonHeader };
-  } catch (e) { return line; }
-}`,
-    enabled: true,
-    builtin: true,
-    createdAt: epoch,
-    updatedAt: epoch
-  },
-  {
-    id: "native:debug",
-    name: "Runeya Debug Parser",
-    description: 'Detects Runeya internal debug logs emitted as JSON arrays: ["runeya", payload]. Marks them as debug level.',
-    code: `(line) => {
-  var trimmed = line.message.trim();
-  if (!trimmed.startsWith('[')) return line;
-  try {
-    var parsed = JSON.parse(trimmed);
-    if (!Array.isArray(parsed) || parsed[0] !== 'runeya') return line;
-    var debug = parsed.length === 2 ? parsed[1] : parsed.slice(1);
-    var message = typeof debug === 'string' ? debug : JSON.stringify(debug);
-    var merged = {};
-    for (var k in line.metadata) merged[k] = line.metadata[k];
-    merged.runeya_debug = JSON.stringify(debug);
-    return { raw: line.raw, stream: line.stream, level: 'debug', message: message, hidden: line.hidden, metadata: merged, jsonHeader: line.jsonHeader };
-  } catch (e) { return line; }
-}`,
-    enabled: true,
-    builtin: true,
-    createdAt: epoch,
-    updatedAt: epoch
-  },
-  {
-    id: "native:links",
-    name: "Link Detector",
-    description: "Detects URLs in plain-text log lines and exposes them in metadata.links for frontend rendering.",
-    code: `(line) => {
-  var urlRegex = /(https?|ftp):\\/\\/[\\w_-]+(?:\\.[\\w_-]+)+([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?/gi;
-  var urls = line.message.match(urlRegex);
-  if (!urls || urls.length === 0) return line;
-  var merged = {};
-  for (var k in line.metadata) merged[k] = line.metadata[k];
-  merged.links = urls.join(' ');
-  return { raw: line.raw, stream: line.stream, level: line.level, message: line.message, hidden: line.hidden, metadata: merged, jsonHeader: line.jsonHeader };
-}`,
-    enabled: true,
-    builtin: true,
-    createdAt: epoch,
-    updatedAt: epoch
-  }
-];
-
-// ../../packages/shared/src/js-log-parser.ts
-import vm from "vm";
-var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
-var PARSE_TIMEOUT_MS = 50;
-var MAX_CONSECUTIVE_TIMEOUTS = 10;
-var JSLogParser = class {
-  parsers = [];
-  constructor(definitions = []) {
-    this.setParsers(definitions);
-  }
-  setParsers(definitions) {
-    this.parsers = [];
-    for (const def of definitions) {
-      if (!def.enabled) continue;
-      try {
-        const compiled = this.compileParser(def);
-        this.parsers.push({
-          id: def.id,
-          name: def.name,
-          enabled: true,
-          fn: compiled
-        });
-      } catch (err) {
-        console.warn(
-          `[js-log-parser] Failed to compile parser "${def.name}" (${def.id}): ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-  }
-  parse(line) {
-    let current = line;
-    for (const parser of this.parsers) {
-      try {
-        current = parser.fn(current);
-      } catch (err) {
-        console.warn(
-          `[js-log-parser] Parser "${parser.name}" threw error: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    return this.sanitize(current);
-  }
-  /**
-   * Compile le code utilisateur en une fonction bornée en temps.
-   *
-   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
-   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
-   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
-   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
-   * métriques de *tous* les services. Chaque invocation repasse maintenant par
-   * la vm, avec son propre budget.
-   */
-  compileParser(def) {
-    const forbidden = ["require(", "import ", "eval("];
-    for (const pat of forbidden) {
-      if (def.code.includes(pat)) {
-        throw new Error("Code contains forbidden patterns (require, import, eval)");
-      }
-    }
-    const sandbox = {
-      RegExp,
-      String,
-      Object,
-      Array,
-      JSON,
-      Math,
-      Date,
-      undefined: void 0,
-      null: null
-    };
-    let script;
-    try {
-      script = new vm.Script(`(${def.code})`, { filename: `parser-${def.id}.js` });
-    } catch (err) {
-      throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
-    let parserFn;
-    try {
-      parserFn = script.runInContext(context, { timeout: 100 });
-    } catch (err) {
-      throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (typeof parserFn !== "function") {
-      throw new Error("Parser code must export a function");
-    }
-    context["__parserFn"] = parserFn;
-    const callScript = new vm.Script("__result = __parserFn(__line);", {
-      filename: `parser-${def.id}-call.js`
-    });
-    let consecutiveTimeouts = 0;
-    let disabled = false;
-    return (line) => {
-      if (disabled) return line;
-      const ctx = context;
-      ctx["__line"] = line;
-      ctx["__result"] = null;
-      try {
-        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
-        consecutiveTimeouts = 0;
-      } catch (err) {
-        const e = err;
-        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
-        if (!timedOut) throw err;
-        consecutiveTimeouts += 1;
-        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
-          disabled = true;
-          console.warn(
-            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
-          );
-        }
-        return line;
-      }
-      const result = ctx["__result"];
-      if (result === null || result === void 0 || typeof result !== "object") {
-        return line;
-      }
-      return result;
-    };
-  }
-  /** Sanitize the final LogLine: truncate message, limit metadata, validate level */
-  sanitize(line) {
-    let { message, metadata, level } = line;
-    if (message.length > 16384) {
-      message = message.substring(0, 16384) + "...[truncated]";
-    }
-    metadata = metadata ?? {};
-    const metaKeys = Object.keys(metadata);
-    if (metaKeys.length > 100) {
-      const limited = {};
-      for (let i = 0; i < 100; i++) {
-        limited[metaKeys[i]] = metadata[metaKeys[i]];
-      }
-      metadata = limited;
-    }
-    if (!VALID_LEVELS.has(level)) {
-      level = "info";
-    }
-    if (message !== line.message || metadata !== line.metadata || level !== line.level) {
-      return { ...line, message, metadata, level };
-    }
-    return line;
-  }
-};
-
-// ../../packages/shared/src/builtins.ts
-var BUILTIN_VARIABLES = [
-  // ── Le service ───────────────────────────────────────────────────────────
-  { name: "service.NAME", scope: "server", descriptionKey: "serviceName" },
-  { name: "service.ID", scope: "server", descriptionKey: "serviceId" },
-  { name: "service.PORT", scope: "server", descriptionKey: "servicePort" },
-  { name: "service.URL", scope: "server", descriptionKey: "serviceUrl" },
-  { name: "service.BASE_URL", scope: "server", descriptionKey: "serviceBaseUrl" },
-  { name: "service.CWD", scope: "agent", descriptionKey: "serviceCwd" },
-  // ── Le projet et l'environnement actif ───────────────────────────────────
-  { name: "project.NAME", scope: "server", descriptionKey: "projectName" },
-  { name: "runeya.ENV_NAME", scope: "server", descriptionKey: "envName" },
-  // ── Le serveur Runeya ────────────────────────────────────────────────────
-  // `service.HOST` a toujours désigné l'adresse d'écoute du SERVEUR, pas une
-  // propriété du service : le nom trompait, il devient un alias.
-  { name: "runeya.HOST", scope: "server", descriptionKey: "runeyaHost", deprecatedAlias: "service.HOST" },
-  // ── La machine qui exécute ───────────────────────────────────────────────
-  { name: "agent.HOST_LAN", scope: "agent", descriptionKey: "agentHostLan", deprecatedAlias: "service.HOST_LAN" },
-  // Le NOM de l'agent est une étiquette de la configuration du serveur, pas
-  // une propriété de la machine : c'est le serveur qui le connaît et le résout.
-  { name: "agent.NAME", scope: "server", descriptionKey: "agentName" },
-  { name: "agent.OS", scope: "agent", descriptionKey: "agentOs" },
-  { name: "agent.HOME", scope: "agent", descriptionKey: "agentHome" }
-];
-var BUILTIN_REFERENCE_RE = /\{\{([A-Za-z][A-Za-z0-9_.-]*)\}\}/g;
-var ENVIRONMENT_NAMESPACE = "environment.";
-function interpolateBuiltins(text, values) {
-  return text.replace(BUILTIN_REFERENCE_RE, (match, name) => {
-    if (name.startsWith(ENVIRONMENT_NAMESPACE)) return match;
-    return values[name] ?? match;
-  });
-}
-function interpolateBuiltinsInEnv(env2, values) {
-  const out = {};
-  for (const [key, value] of Object.entries(env2)) {
-    out[key] = interpolateBuiltins(value, values);
-  }
-  return out;
-}
-function withDeprecatedAliases(values) {
-  const out = { ...values };
-  for (const builtin of BUILTIN_VARIABLES) {
-    if (builtin.deprecatedAlias && out[builtin.name] !== void 0) {
-      out[builtin.deprecatedAlias] = out[builtin.name];
-    }
-  }
-  return out;
-}
-function serviceSlug(name) {
-  return name.normalize("NFD").replace(/[\u0300-\u036f]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-function servicePortValues(ports, prefix = "service") {
-  const values = {};
-  (ports ?? []).forEach((port, i) => {
-    values[i === 0 ? `${prefix}.PORT` : `${prefix}.PORT_${i + 1}`] = String(port);
-  });
-  return values;
-}
-function isWildcardHost(host) {
-  const h = host.trim();
-  return h === "" || h === "0.0.0.0" || h === "::" || h === "[::]";
-}
-function isLoopbackHost(host) {
-  const h = host.trim();
-  return h === "127.0.0.1" || h === "::1" || h === "[::1]";
-}
-function urlHostFor(host) {
-  if (isWildcardHost(host)) return null;
-  return isLoopbackHost(host) ? "localhost" : host.trim();
-}
-function serviceUrlValues(service, host, prefix = "service") {
-  const domainByPort = new Map((service.localUrls ?? []).map((lu) => [lu.port, lu.url]));
-  const ports = [...service.ports ?? []];
-  for (const local of service.localUrls ?? []) {
-    if (!ports.includes(local.port)) ports.push(local.port);
-  }
-  const values = {};
-  ports.forEach((port, i) => {
-    const domain = domainByPort.get(port);
-    values[i === 0 ? `${prefix}.URL` : `${prefix}.URL_${i + 1}`] = domain ? `http://${domain}` : `http://${host}:${port}`;
-  });
-  return values;
-}
-function crossServiceValues(service, host) {
-  const slug = serviceSlug(service.name);
-  if (!slug) return {};
-  return {
-    [`services.${slug}.NAME`]: service.name,
-    [`services.${slug}.ID`]: service.id,
-    ...servicePortValues(service.ports, `services.${slug}`),
-    ...serviceUrlValues(service, host, `services.${slug}`),
-    ...service.url ? { [`services.${slug}.BASE_URL`]: service.url } : {}
-  };
-}
-
-// ../../packages/shared/src/constants/intervals.ts
-var AGENT_HEALTH_POLL_INTERVAL = 15e3;
-
-// ../../packages/shared/src/constants/buffers.ts
-var LOG_BUFFER_SIZE = 5e3;
-
-// ../../packages/shared/src/constants/timeouts.ts
-var GRACE_PERIOD = 1e4;
-var AGENT_FETCH_TIMEOUT = 1e4;
-var AGENT_LONG_FETCH_TIMEOUT = 6e5;
-var AGENT_STOP_FETCH_TIMEOUT = GRACE_PERIOD + 15e3;
-var PASSPHRASE_TIMEOUT = 3e4;
-var WS_RECONNECT_MIN = 1e3;
-var WS_RECONNECT_MAX = 15e3;
-
-// ../../packages/shared/src/constants/editors.ts
-var SUPPORTED_EDITORS = [
-  { key: "vscode", name: "Visual Studio Code", command: "code" },
-  { key: "cursor", name: "Cursor", command: "cursor" },
-  { key: "windsurf", name: "Windsurf", command: "windsurf" },
-  { key: "sublime", name: "Sublime Text", command: "subl" },
-  { key: "atom", name: "Atom", command: "atom" },
-  { key: "antigravity", name: "Antigravity", command: "antigravity" },
-  { key: "intellij", name: "IntelliJ IDEA", command: "idea" },
-  { key: "android-studio", name: "Android Studio", command: "studio" },
-  { key: "webstorm", name: "WebStorm", command: "webstorm" },
-  { key: "zed", name: "Zed", command: "zed" },
-  { key: "neovim", name: "Neovim", command: "nvim" },
-  { key: "vim", name: "Vim", command: "vim" },
-  { key: "emacs", name: "Emacs", command: "emacs" },
-  { key: "fleet", name: "Fleet", command: "fleet" }
-];
-var EDITOR_BY_KEY = new Map(
-  SUPPORTED_EDITORS.map((e) => [e.key, e])
-);
-
-// ../../packages/shared/src/sync/json-crdt.ts
-import * as Y from "yjs";
-function normalize(value) {
-  return JSON.parse(JSON.stringify(value ?? null));
-}
-function isPlainObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function toPlain(value) {
-  if (value instanceof Y.Map) {
-    const out = {};
-    for (const [k, v] of value.entries()) out[k] = toPlain(v);
-    return out;
-  }
-  if (value instanceof Y.Array) return value.toArray().map(toPlain);
-  return value ?? null;
-}
-function identityOf(value) {
-  if (isPlainObject(value) && typeof value["id"] === "string") return `id:${value["id"]}`;
-  return `v:${JSON.stringify(value)}`;
-}
-function identityOfY(value) {
-  if (value instanceof Y.Map) {
-    const id = value.get("id");
-    if (typeof id === "string") return `id:${id}`;
-  }
-  return `v:${JSON.stringify(toPlain(value))}`;
-}
-function toY(value) {
-  if (Array.isArray(value)) {
-    const arr = new Y.Array();
-    if (value.length > 0) arr.insert(0, value.map(toY));
-    return arr;
-  }
-  if (isPlainObject(value)) {
-    const map = new Y.Map();
-    for (const [k, v] of Object.entries(value)) map.set(k, toY(v));
-    return map;
-  }
-  return value;
-}
-function applyToMap(map, next) {
-  for (const key of Array.from(map.keys())) {
-    if (!(key in next)) map.delete(key);
-  }
-  for (const [key, value] of Object.entries(next)) {
-    const current = map.get(key);
-    if (Array.isArray(value)) {
-      if (!(current instanceof Y.Array)) map.set(key, toY(value));
-      else applyToArray(current, value);
-    } else if (isPlainObject(value)) {
-      if (!(current instanceof Y.Map)) map.set(key, toY(value));
-      else applyToMap(current, value);
-    } else if (current instanceof Y.Map || current instanceof Y.Array || current !== value) {
-      map.set(key, value);
-    }
-  }
-}
-function applyToArray(arr, next) {
-  const wanted = next.map(identityOf);
-  const wantedCount = /* @__PURE__ */ new Map();
-  for (const k of wanted) wantedCount.set(k, (wantedCount.get(k) ?? 0) + 1);
-  const seen2 = /* @__PURE__ */ new Map();
-  for (let i = arr.length - 1; i >= 0; i--) {
-    const key = identityOfY(arr.get(i));
-    const used = seen2.get(key) ?? 0;
-    if (used >= (wantedCount.get(key) ?? 0)) arr.delete(i, 1);
-    else seen2.set(key, used + 1);
-  }
-  for (let j = 0; j < next.length; j++) {
-    const key = wanted[j];
-    if (j < arr.length && identityOfY(arr.get(j)) === key) {
-      const current = arr.get(j);
-      const value = next[j];
-      if (current instanceof Y.Map && isPlainObject(value)) applyToMap(current, value);
-      else if (current instanceof Y.Array && Array.isArray(value)) applyToArray(current, value);
-      continue;
-    }
-    let found = -1;
-    for (let k = j + 1; k < arr.length; k++) {
-      if (identityOfY(arr.get(k)) === key) {
-        found = k;
-        break;
-      }
-    }
-    if (found !== -1) {
-      const moved = toPlain(arr.get(found));
-      arr.delete(found, 1);
-      arr.insert(j, [toY(moved)]);
-    } else {
-      arr.insert(j, [toY(next[j])]);
-    }
-  }
-}
-function getCollection(doc, name) {
-  return doc.getMap(name);
-}
-function readEntity(collection, id) {
-  const entity = collection.get(id);
-  if (!(entity instanceof Y.Map)) return null;
-  const plain = toPlain(entity);
-  return isPlainObject(plain) ? plain : null;
-}
-function writeEntity(collection, id, entity) {
-  const next = normalize(entity);
-  if (!isPlainObject(next)) return;
-  const current = collection.get(id);
-  if (!(current instanceof Y.Map)) {
-    collection.set(id, toY(next));
-    return;
-  }
-  applyToMap(current, next);
-}
-
 // ../server/src/services/environment-store.ts
 var FILENAME2 = "environments.json";
 var EnvironmentStore = class {
@@ -2505,7 +695,7 @@ var EnvironmentStore = class {
     return out;
   }
   getFilePath(root) {
-    return join3(root, FILENAME2);
+    return join2(root, FILENAME2);
   }
   /**
    * The vault an environment must be written to: its project's.
@@ -2646,7 +836,7 @@ var EnvironmentStore = class {
     }
     for (const root of await allVaultRoots()) {
       try {
-        const raw = await readFile3(this.getFilePath(root), "utf-8");
+        const raw = await readFile2(this.getFilePath(root), "utf-8");
         await rememberFile(this.getFilePath(root));
         const data = JSON.parse(raw);
         const clash = data.find((e) => this.environments.has(e.id) && this.roots.get(e.id) !== root);
@@ -2714,9 +904,9 @@ var EnvironmentStore = class {
         });
         continue;
       }
-      await mkdir3(root, { recursive: true });
+      await mkdir2(root, { recursive: true });
       const tmpPath = filePath + ".tmp";
-      await writeFile3(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
+      await writeFile2(tmpPath, JSON.stringify(environments, null, 2), "utf-8");
       await rename2(tmpPath, filePath);
       await chmod2(filePath, 384);
       await rememberFile(filePath);
@@ -3097,7 +1287,7 @@ var ServiceStore = class {
     this.notify();
   }
   getFilePath(root) {
-    return join4(root, FILENAME3);
+    return join3(root, FILENAME3);
   }
   /**
    * The vault a service must be written to: the one of the project owning it.
@@ -3126,7 +1316,7 @@ var ServiceStore = class {
     await ensureProjectsLoaded();
     for (const root of await allVaultRoots()) {
       try {
-        const raw = await readFile4(this.getFilePath(root), "utf-8");
+        const raw = await readFile3(this.getFilePath(root), "utf-8");
         const data = JSON.parse(raw);
         const clash = data.find((s) => this.services.has(s.id) && this.roots.get(s.id) !== root);
         if (clash) {
@@ -3180,9 +1370,9 @@ var ServiceStore = class {
         });
         continue;
       }
-      await mkdir4(root, { recursive: true });
+      await mkdir3(root, { recursive: true });
       const tmpPath = filePath + ".tmp";
-      await writeFile4(tmpPath, JSON.stringify(services, null, 2), "utf-8");
+      await writeFile3(tmpPath, JSON.stringify(services, null, 2), "utf-8");
       await rename3(tmpPath, filePath);
       await chmod3(filePath, 384);
     }
@@ -3392,18 +1582,18 @@ var serviceStore = new ServiceStore();
 import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname as dirname2, join as join6 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // ../server/src/services/instance-registry.ts
-import { mkdir as mkdir5, readdir as readdir2, readFile as readFile5, writeFile as writeFile5, rm as rm3 } from "fs/promises";
+import { mkdir as mkdir4, readdir, readFile as readFile4, writeFile as writeFile4, rm as rm3 } from "fs/promises";
 import { readFileSync } from "fs";
 import dotenv from "dotenv";
 import { spawn } from "child_process";
-import { join as join5 } from "path";
-import { z as z23 } from "zod";
-var InstanceFileSchema = z23.object({
-  pid: z23.number().int().positive(),
+import { join as join4 } from "path";
+import { z } from "zod";
+var InstanceFileSchema = z.object({
+  pid: z.number().int().positive(),
   /**
    * The agent this server spawned, when it has one.
    *
@@ -3411,14 +1601,14 @@ var InstanceFileSchema = z23.object({
    * it, and because the agent may not be up yet — or at all, when the
    * encryption key is missing. Absent means « unknown », never « none ».
    */
-  agentPid: z23.number().int().positive().optional(),
-  port: z23.number().int().min(1).max(65535),
-  agentPort: z23.number().int().min(1).max(65535),
-  cwd: z23.string().max(4096),
-  dataDir: z23.string().max(4096),
-  version: z23.string().max(64),
-  fromDesktop: z23.boolean(),
-  startedAt: z23.number().int().nonnegative(),
+  agentPid: z.number().int().positive().optional(),
+  port: z.number().int().min(1).max(65535),
+  agentPort: z.number().int().min(1).max(65535),
+  cwd: z.string().max(4096),
+  dataDir: z.string().max(4096),
+  version: z.string().max(64),
+  fromDesktop: z.boolean(),
+  startedAt: z.number().int().nonnegative(),
   /**
    * De quoi relancer ce lancement à l'identique : l'exécutable, ses arguments,
    * et les `RUNEYA_*` de son environnement. Le `cwd` ci-dessus complète le
@@ -3428,9 +1618,9 @@ var InstanceFileSchema = z23.object({
    * écrit pas. Elle reste listée et arrêtable, simplement pas redémarrable —
    * un redémarrage approximatif serait pire qu'un bouton absent.
    */
-  execPath: z23.string().max(4096).optional(),
-  argv: z23.array(z23.string().max(4096)).max(128).optional(),
-  env: z23.record(z23.string().max(64), z23.string().max(4096)).optional(),
+  execPath: z.string().max(4096).optional(),
+  argv: z.array(z.string().max(4096)).max(128).optional(),
+  env: z.record(z.string().max(64), z.string().max(4096)).optional(),
   /**
    * L'instance tient un secret (`RUNEYA_ENCRYPTION_KEY`,
    * `RUNEYA_MASTER_PASSWORD`) que le relancement ne retrouverait pas. Le
@@ -3441,13 +1631,13 @@ var InstanceFileSchema = z23.object({
    * Un secret posé dans le `.env` de la pile ne compte pas : `dotenv` le relit
    * au démarrage depuis le même répertoire. Voir `secretsAreReproducible()`.
    */
-  needsSecretEnv: z23.boolean().optional()
+  needsSecretEnv: z.boolean().optional()
 });
 function registryDir() {
-  return join5(machineRoot(), "instances");
+  return join4(machineRoot(), "instances");
 }
 function fileFor(pid) {
-  return join5(registryDir(), `${pid}.json`);
+  return join4(registryDir(), `${pid}.json`);
 }
 var published = null;
 var SECRET_ENV_KEYS = ["RUNEYA_ENCRYPTION_KEY", "RUNEYA_MASTER_PASSWORD"];
@@ -3467,7 +1657,7 @@ function secretsAreReproducible() {
   if (present.length === 0) return true;
   let fromFile;
   try {
-    fromFile = dotenv.parse(readFileSync(join5(process.cwd(), ".env")));
+    fromFile = dotenv.parse(readFileSync(join4(process.cwd(), ".env")));
   } catch {
     return false;
   }
@@ -3493,9 +1683,9 @@ function selfRecord() {
 }
 async function registerInstance() {
   try {
-    await mkdir5(registryDir(), { recursive: true });
+    await mkdir4(registryDir(), { recursive: true });
     published = selfRecord();
-    await writeFile5(fileFor(process.pid), JSON.stringify(published, null, 2));
+    await writeFile4(fileFor(process.pid), JSON.stringify(published, null, 2));
   } catch (err) {
     console.log("[instances] Could not register this instance:", err.message);
   }
@@ -3508,7 +1698,7 @@ async function setInstanceAgentPid(agentPid) {
   if (!published) return;
   published = { ...published, agentPid: agentPid ?? void 0 };
   try {
-    await writeFile5(fileFor(process.pid), JSON.stringify(published, null, 2));
+    await writeFile4(fileFor(process.pid), JSON.stringify(published, null, 2));
   } catch {
   }
 }
@@ -3535,7 +1725,7 @@ async function probe(port) {
 }
 async function describeInstance(pid) {
   try {
-    const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile5(fileFor(pid), "utf8")));
+    const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile4(fileFor(pid), "utf8")));
     if (!parsed.success) return null;
     return { pid, port: parsed.data.port, cwd: parsed.data.cwd };
   } catch {
@@ -3545,16 +1735,16 @@ async function describeInstance(pid) {
 async function listInstances() {
   let files;
   try {
-    files = await readdir2(registryDir());
+    files = await readdir(registryDir());
   } catch {
     return [];
   }
   const found = await Promise.all(
     files.filter((f) => f.endsWith(".json")).map(async (name) => {
-      const path = join5(registryDir(), name);
+      const path = join4(registryDir(), name);
       let record;
       try {
-        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile5(path, "utf8")));
+        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile4(path, "utf8")));
         if (!parsed.success) {
           await rm3(path, { force: true }).catch(() => {
           });
@@ -3869,7 +2059,7 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join6(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentDistPath = env.AGENT_BINARY_PATH || join5(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
     this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"],
@@ -3979,7 +2169,7 @@ var AgentSpawner = class {
       this.fileWatcher.close();
     }
     console.log("[agent-spawner] \u{1F50D} Watching agent dist for changes (hot reload enabled)");
-    const distDir = join6(this.agentDistPath, "..");
+    const distDir = join5(this.agentDistPath, "..");
     this.fileWatcher = watch(distDir, { persistent: false }, (eventType, filename) => {
       if ((eventType === "change" || eventType === "rename") && filename === "index.js" && !this.isRestarting) {
         this.isRestarting = true;
@@ -4293,16 +2483,16 @@ var AgentWSBridge = class extends EventEmitter {
 };
 
 // ../server/src/services/agent-manager.ts
-var HealthMessageSchema = z24.object({
-  status: z24.string(),
-  uptime: z24.number(),
-  runnersAvailable: z24.array(z24.enum(["native", "docker"])),
-  processCount: z24.number(),
-  runningCount: z24.number(),
-  lanIp: z24.string().optional(),
-  os: z24.string().max(64).optional(),
-  home: z24.string().max(4096).optional(),
-  cwd: z24.string().max(4096).optional()
+var HealthMessageSchema = z2.object({
+  status: z2.string(),
+  uptime: z2.number(),
+  runnersAvailable: z2.array(z2.enum(["native", "docker"])),
+  processCount: z2.number(),
+  runningCount: z2.number(),
+  lanIp: z2.string().optional(),
+  os: z2.string().max(64).optional(),
+  home: z2.string().max(4096).optional(),
+  cwd: z2.string().max(4096).optional()
 });
 var MIN_RECONNECT_DELAY = WS_RECONNECT_MIN;
 var MAX_RECONNECT_DELAY = WS_RECONNECT_MAX;
@@ -4764,7 +2954,6 @@ var AgentManager = class extends EventEmitter2 {
 var agentManager = new AgentManager();
 
 export {
-  env,
   isCiMode,
   loadFromEnv,
   setPendingLegacyKey,
@@ -4780,72 +2969,6 @@ export {
   clearVaultLock,
   ensureEncryptionKey,
   setEncryptionKey,
-  machineRoot,
-  localVaultRoot,
-  orgVaultRoot,
-  projectVaultRoot,
-  orgIdOfRoot,
-  vaultIdOfRoot,
-  vaultFor,
-  stampOrgCloud,
-  rememberOrgName,
-  readOrgNames,
-  rememberOrgLogo,
-  forgetOrgLogo,
-  readOrgLogos,
-  readOrgClouds,
-  listOrgVaults,
-  listCloudVaults,
-  allVaultRoots,
-  machineFilePath,
-  keyedFilePath,
-  legacyMachineFilePath,
-  ensureLocalVault,
-  keyRoot,
-  legacyVaultRoot,
-  ProjectSchema,
-  ScenarioGroupSchema,
-  ScenarioNodeSchema,
-  ScenarioSchema,
-  AIProviderSchema,
-  JSLogParserSchema,
-  NotificationPreferencesSchema,
-  SettingsSchema,
-  TraefikConfigSchema,
-  SettingsPrivateSchema,
-  SchemaVersionSchema,
-  LogSourceConfigSchema,
-  HealthCheckSchema,
-  DockerConfigSchema,
-  RestartStrategySchema,
-  ServiceShortcutSchema,
-  ServiceCommandSchema,
-  VariableSchema,
-  CreateEnvironmentSchema,
-  UpdateEnvironmentSchema,
-  VariableOverrideSchema,
-  ApiKeyScopeSchema,
-  ApiKeysFileSchema,
-  ChangelogSurfaceSchema,
-  ChangelogReleaseSchema,
-  ChangelogIndexItemSchema,
-  nativeParsers,
-  JSLogParser,
-  interpolateBuiltinsInEnv,
-  withDeprecatedAliases,
-  serviceSlug,
-  servicePortValues,
-  urlHostFor,
-  serviceUrlValues,
-  crossServiceValues,
-  LOG_BUFFER_SIZE,
-  AGENT_LONG_FETCH_TIMEOUT,
-  AGENT_STOP_FETCH_TIMEOUT,
-  SUPPORTED_EDITORS,
-  EDITOR_BY_KEY,
-  getCollection,
-  readEntity,
-  writeEntity,
   encryptValueWith,
   decryptValueWith,
   encryptValue,
@@ -4883,4 +3006,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-4PQXBTV6.js.map
+//# sourceMappingURL=chunk-HX3ZIWHM.js.map