[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_316":317,"_318":319},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":101,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":24,"_121":122,"_123":58,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",15,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","backend/routes/share.ts","latestPath","fileId","53161016-a555-11f1-8846-1607ee4eb77e","name","share.ts","fileType","script","content","import { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { verifyJwt } from \"../lib/jwt.ts\";\nimport { currentWeekStart } from \"../lib/dates.ts\";\nimport { getOrCreateWeek, getWeekMeals, getModificationsForWeek } from \"./weeks.ts\";\nimport { buildShoppingList } from \"../lib/shopping.ts\";\n\nexport const shareRoutes = new Hono();\n\ninterface FoyerRow {\n id: number;\n name: string;\n}\n\ninterface MemberRow {\n id: number;\n name: string;\n preferences: string;\n}\n\n// Vue publique en lecture seule d'un foyer, accessible via son lien de partage.\n// N'expose jamais la clé API, les mots de passe, ni les identifiants internes autres que ceux affichés.\nshareRoutes.get(\"/:token\", async (c) => {\n const token = c.req.param(\"token\");\n const payload = await verifyJwt<{ foyerId: number }>(token, \"SHARE_TOKEN_SECRET\");\n if (!payload?.foyerId) return c.json({ error: \"Lien de partage invalide ou expiré.\" }, 404);\n\n const foyerResult = await sqlite.execute({\n sql: \"SELECT id, name FROM foyers WHERE id = ?\",\n args: [payload.foyerId],\n });\n const foyer = foyerResult.rows[0] as unknown as FoyerRow | undefined;\n if (!foyer) return c.json({ error: \"Foyer introuvable.\" }, 404);\n\n const membersResult = await sqlite.execute({\n sql: \"SELECT id, name, preferences FROM members WHERE foyer_id = ? ORDER BY id ASC\",\n args: [foyer.id],\n });\n const members = (membersResult.rows as unknown as MemberRow[]).map((m) => ({\n id: m.id,\n name: m.name,\n }));\n\n const weekRow = await getOrCreateWeek(foyer.id, currentWeekStart());\n const meals = await getWeekMeals(weekRow.id);\n const modifications = await getModificationsForWeek(weekRow.id);\n const menus = meals.map((m) => m.generatedMenu).filter((m): m is NonNullable => m !== null);\n const shoppingList = buildShoppingList(menus);\n\n return c.json({\n foyer: { name: foyer.name },\n members,\n week: { weekStartDate: weekRow.week_start_date },\n meals,\n modifications,\n shoppingList,\n });\n});\n","createdAt",["D",1788192130961],"branchVersion","branchId","59c640c1-d555-4902-a8d3-71ace8a5e5c4","id","6626b8d6-3420-4848-8c35-d06d05fe18fd","menu-planner",["D",1788191950718],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Planificateur de menus pour un foyer avec IA","imageUrl","d66aba55-2367-403a-a570-71cd1c762bc0","pinnedFileId","faba7e02-a554-11f1-9530-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05825-cbf0-705e-9846-aecf6611a871","tursoName","6626b8d6342048488c35d06d05fe18fd","tursoHostname","6626b8d6342048488c35d06d05fe18fd-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789497078049],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":101},"org",{"_99":98,"_100":101,"_102":101,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",82,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","Antoine07","handle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_31":44,"_37":311,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":312,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":313,"_83":314,"_85":315,"_87":24},"tree",[150],"files",[150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169],"counts",{"_139":62,"_140":133,"_141":62,"_142":143,"_144":145},"contents",[128],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":129,"_31":130,"_29":131,"_132":-5,"_40":41,"_39":133,"_134":58,"_37":135,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_26":138},"9b96b1fe-dcd9-4982-b1ac-c60845e1241f","backend","843381a2-2df1-475d-b92f-a3a8ce678481","parentId",1,"latest",["D",1788191982713],"directory","label",[130],"pulls","branches","forks","envVars",{"_146":148,"_149":62},"connections",{"_146":62,"_147":62},"count","unfilledCount",3,"emptyCount",{"_42":129,"_31":130,"_29":131,"_132":-5,"_40":41,"_39":133,"_134":58,"_37":308,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_176":309,"_26":310},{"_42":304,"_31":303,"_29":297,"_132":131,"_40":41,"_39":298,"_134":58,"_37":305,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_176":306,"_26":307},{"_42":294,"_31":295,"_29":296,"_132":297,"_40":41,"_39":298,"_134":24,"_37":299,"_13":62,"_33":34,"_35":300,"_23":24,"_137":-5,"_176":301,"_26":302},{"_42":290,"_31":243,"_29":237,"_132":131,"_40":41,"_39":148,"_134":58,"_37":291,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_176":292,"_26":293},{"_42":284,"_31":210,"_29":285,"_132":237,"_40":41,"_39":148,"_134":58,"_37":286,"_13":62,"_33":34,"_35":287,"_23":24,"_137":-5,"_176":288,"_26":289},{"_42":276,"_31":277,"_29":278,"_132":237,"_40":41,"_39":279,"_134":24,"_37":280,"_13":62,"_33":34,"_35":281,"_23":24,"_137":-5,"_176":282,"_26":283},{"_42":268,"_31":269,"_29":270,"_132":237,"_40":41,"_39":271,"_134":58,"_37":272,"_13":62,"_33":34,"_35":273,"_23":24,"_137":-5,"_176":274,"_26":275},{"_42":260,"_31":261,"_29":262,"_132":237,"_40":41,"_39":263,"_134":58,"_37":264,"_13":62,"_33":34,"_35":265,"_23":24,"_137":-5,"_176":266,"_26":267},{"_42":252,"_31":253,"_29":254,"_132":237,"_40":41,"_39":255,"_134":58,"_37":256,"_13":62,"_33":34,"_35":257,"_23":24,"_137":-5,"_176":258,"_26":259},{"_42":244,"_31":245,"_29":246,"_132":237,"_40":41,"_39":247,"_134":58,"_37":248,"_13":62,"_33":34,"_35":249,"_23":24,"_137":-5,"_176":250,"_26":251},{"_42":234,"_31":235,"_29":236,"_132":237,"_40":41,"_39":238,"_134":58,"_37":239,"_13":62,"_33":34,"_35":240,"_23":24,"_137":-5,"_176":241,"_26":242},{"_42":230,"_31":229,"_29":223,"_132":131,"_40":41,"_39":224,"_134":58,"_37":231,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_176":232,"_26":233},{"_42":221,"_31":210,"_29":222,"_132":223,"_40":41,"_39":224,"_134":58,"_37":225,"_13":62,"_33":34,"_35":226,"_23":24,"_137":-5,"_176":227,"_26":228},{"_42":217,"_31":184,"_29":180,"_132":131,"_40":41,"_39":212,"_134":58,"_37":218,"_13":62,"_33":136,"_35":-5,"_23":24,"_137":-5,"_176":219,"_26":220},{"_42":209,"_31":210,"_29":211,"_132":180,"_40":41,"_39":212,"_134":24,"_37":213,"_13":62,"_33":34,"_35":214,"_23":24,"_137":-5,"_176":215,"_26":216},{"_42":201,"_31":202,"_29":203,"_132":180,"_40":41,"_39":204,"_134":58,"_37":205,"_13":62,"_33":34,"_35":206,"_23":24,"_137":-5,"_176":207,"_26":208},{"_42":193,"_31":194,"_29":195,"_132":180,"_40":41,"_39":196,"_134":24,"_37":197,"_13":62,"_33":34,"_35":198,"_23":24,"_137":-5,"_176":199,"_26":200},{"_42":185,"_31":186,"_29":187,"_132":180,"_40":41,"_39":188,"_134":58,"_37":189,"_13":62,"_33":34,"_35":190,"_23":24,"_137":-5,"_176":191,"_26":192},{"_42":179,"_31":32,"_29":30,"_132":180,"_40":41,"_39":14,"_134":58,"_37":181,"_13":62,"_33":34,"_35":36,"_23":24,"_137":-5,"_176":182,"_26":183},{"_42":170,"_31":171,"_29":56,"_132":131,"_40":41,"_39":133,"_134":58,"_37":172,"_13":62,"_33":173,"_35":174,"_23":24,"_137":175,"_176":177,"_26":178},"cb965474-f417-4337-951b-3a5afae866bf","index.ts",["D",1788191982713],"http","import { Hono } from \"npm:hono@4\";\nimport { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { ensureSchema } from \"./db/schema.ts\";\nimport { authRoutes } from \"./routes/auth.ts\";\nimport { foyerRoutes } from \"./routes/foyers.ts\";\nimport { memberRoutes } from \"./routes/members.ts\";\nimport { weekRoutes } from \"./routes/weeks.ts\";\nimport { mealRoutes } from \"./routes/meals.ts\";\nimport { shareRoutes } from \"./routes/share.ts\";\nimport { Root } from \"../frontend/root.tsx\";\n\nconst app = new Hono();\n\n// Le schéma est idempotent (CREATE TABLE IF NOT EXISTS) ; on ne le rejoue\n// qu'une fois par instance froide plutôt qu'à chaque requête.\nlet schemaReady: Promise | null = null;\napp.use(\"*\", async (_c, next) => {\n schemaReady ??= ensureSchema();\n await schemaReady;\n await next();\n});\n\napp.route(\"/api/auth\", authRoutes);\napp.route(\"/api/foyers\", foyerRoutes);\napp.route(\"/api/members\", memberRoutes);\napp.route(\"/api/weeks\", weekRoutes);\napp.route(\"/api/meals\", mealRoutes);\napp.route(\"/api/share\", shareRoutes);\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.get(\"/\", (c) => c.html(Root()));\n// Toute route côté client (ex. /partage/:token) doit servir la même coquille React.\napp.get(\"/partage/:token\", (c) => c.html(Root()));\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","planificateur-menus","children",[],[130,171],"d076dc76-4d7e-4d32-8660-7c775ea28429","3bdf4c9c-97f3-43b1-bb3a-fa5f83b8247c",["D",1788192130961],[],[130,184,32],"routes","5b175c61-5ef9-495a-8cf3-118d7ab2bfa8","members.ts","4f4c2b82-a555-11f1-8398-1607ee4eb77e",14,["D",1788192124625],"import { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAuth, type AppEnv } from \"../middleware/auth.ts\";\nimport { getAccessibleFoyerId, userHasFoyerAccess } from \"../lib/foyerAccess.ts\";\nimport type { Member, MemberPreferences } from \"../../shared/types.ts\";\n\nexport const memberRoutes = new Hono();\n\ninterface MemberRow {\n id: number;\n foyer_id: number;\n name: string;\n preferences: string;\n}\n\nconst DEFAULT_PREFERENCES: MemberPreferences = {\n vegetarien: false,\n vegan: false,\n sansGluten: false,\n sansLactose: false,\n notesLibres: \"\",\n};\n\nfunction toMember(row: MemberRow): Member {\n let preferences: MemberPreferences = DEFAULT_PREFERENCES;\n try {\n preferences = { ...DEFAULT_PREFERENCES, ...JSON.parse(row.preferences) };\n } catch {\n // préférences corrompues ou vides -> valeurs par défaut\n }\n return { id: row.id, foyerId: row.foyer_id, name: row.name, preferences };\n}\n\nfunction parsePreferencesInput(body: unknown): MemberPreferences {\n const b = body as Partial | undefined;\n return {\n vegetarien: !!b?.vegetarien,\n vegan: !!b?.vegan,\n sansGluten: !!b?.sansGluten,\n sansLactose: !!b?.sansLactose,\n notesLibres: typeof b?.notesLibres === \"string\" ? b.notesLibres.trim() : \"\",\n };\n}\n\nmemberRoutes.get(\"/\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const foyerId = await getAccessibleFoyerId(userId);\n if (!foyerId) return c.json({ members: [] });\n\n const result = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE foyer_id = ? ORDER BY id ASC\",\n args: [foyerId],\n });\n return c.json({ members: (result.rows as unknown as MemberRow[]).map(toMember) });\n});\n\nmemberRoutes.post(\"/\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const foyerId = await getAccessibleFoyerId(userId);\n if (!foyerId) return c.json({ error: \"Créez d'abord votre foyer.\" }, 400);\n\n const body = await c.req.json().catch(() => null);\n const name = typeof body?.name === \"string\" ? body.name.trim() : \"\";\n if (!name) return c.json({ error: \"Le nom du membre est requis.\" }, 400);\n\n const preferences = parsePreferencesInput(body?.preferences);\n const insertResult = await sqlite.execute({\n sql: \"INSERT INTO members (foyer_id, name, preferences) VALUES (?, ?, ?)\",\n args: [foyerId, name, JSON.stringify(preferences)],\n });\n\n const result = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE id = ?\",\n args: [Number(insertResult.lastInsertRowid)],\n });\n return c.json({ member: toMember(result.rows[0] as unknown as MemberRow) }, 201);\n});\n\nmemberRoutes.put(\"/:id\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const memberId = Number(c.req.param(\"id\"));\n\n const existing = await sqlite.execute({ sql: \"SELECT * FROM members WHERE id = ?\", args: [memberId] });\n const row = existing.rows[0] as unknown as MemberRow | undefined;\n if (!row) return c.json({ error: \"Membre introuvable.\" }, 404);\n if (!(await userHasFoyerAccess(userId, row.foyer_id))) return c.json({ error: \"Accès refusé.\" }, 403);\n\n const body = await c.req.json().catch(() => null);\n const name = typeof body?.name === \"string\" && body.name.trim() ? body.name.trim() : row.name;\n const preferences = parsePreferencesInput(body?.preferences ?? JSON.parse(row.preferences));\n\n await sqlite.execute({\n sql: \"UPDATE members SET name = ?, preferences = ? WHERE id = ?\",\n args: [name, JSON.stringify(preferences), memberId],\n });\n\n const result = await sqlite.execute({ sql: \"SELECT * FROM members WHERE id = ?\", args: [memberId] });\n return c.json({ member: toMember(result.rows[0] as unknown as MemberRow) });\n});\n\nmemberRoutes.delete(\"/:id\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const memberId = Number(c.req.param(\"id\"));\n\n const existing = await sqlite.execute({ sql: \"SELECT * FROM members WHERE id = ?\", args: [memberId] });\n const row = existing.rows[0] as unknown as MemberRow | undefined;\n if (!row) return c.json({ error: \"Membre introuvable.\" }, 404);\n if (!(await userHasFoyerAccess(userId, row.foyer_id))) return c.json({ error: \"Accès refusé.\" }, 403);\n\n await sqlite.batch([\n { sql: \"DELETE FROM meal_modifications WHERE member_id = ?\", args: [memberId] },\n { sql: \"DELETE FROM members WHERE id = ?\", args: [memberId] },\n ]);\n return c.json({ ok: true });\n});\n",[],[130,184,186],"04a35761-2b80-4bff-873a-0a02f2c1f211","meals.ts","48091d94-a555-11f1-ae0f-1607ee4eb77e",13,["D",1788192112411],"import { Hono, type Context } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAuth, type AppEnv } from \"../middleware/auth.ts\";\nimport { userHasFoyerAccess } from \"../lib/foyerAccess.ts\";\nimport { decryptSecret } from \"../lib/crypto.ts\";\nimport { ClaudeGenerationError, generateAlternatives, generateMenu } from \"../lib/claude.ts\";\nimport { currentWeekStart } from \"../lib/dates.ts\";\nimport type { Member, MemberPreferences } from \"../../shared/types.ts\";\n\nexport const mealRoutes = new Hono();\n\ninterface MealRow {\n id: number;\n week_id: number;\n day_of_week: number;\n meal_type: string;\n num_people: number;\n generated_menu: string | null;\n}\n\ninterface WeekRow {\n id: number;\n foyer_id: number;\n week_start_date: string;\n}\n\ninterface MemberRow {\n id: number;\n foyer_id: number;\n name: string;\n preferences: string;\n}\n\nconst DEFAULT_PREFERENCES: MemberPreferences = {\n vegetarien: false,\n vegan: false,\n sansGluten: false,\n sansLactose: false,\n notesLibres: \"\",\n};\n\nfunction toMember(row: MemberRow): Member {\n let preferences: MemberPreferences = DEFAULT_PREFERENCES;\n try {\n preferences = { ...DEFAULT_PREFERENCES, ...JSON.parse(row.preferences) };\n } catch {\n // ignore\n }\n return { id: row.id, foyerId: row.foyer_id, name: row.name, preferences };\n}\n\n/**\n * Charge le repas + sa semaine et vérifie que l'utilisateur y a accès.\n * Renvoie soit `{ meal, week }`, soit directement la Response d'erreur à\n * retourner tel quel — le narrowing via `instanceof Response` évite les\n * unions mal discriminées.\n */\nasync function loadMealForUser(\n mealId: number,\n userId: number,\n c: Context,\n): Promise {\n const mealResult = await sqlite.execute({ sql: \"SELECT * FROM meals WHERE id = ?\", args: [mealId] });\n const meal = mealResult.rows[0] as unknown as MealRow | undefined;\n if (!meal) return c.json({ error: \"Repas introuvable.\" }, 404);\n\n const weekResult = await sqlite.execute({ sql: \"SELECT * FROM weeks WHERE id = ?\", args: [meal.week_id] });\n const week = weekResult.rows[0] as unknown as WeekRow | undefined;\n if (!week) return c.json({ error: \"Semaine introuvable.\" }, 404);\n\n if (!(await userHasFoyerAccess(userId, week.foyer_id))) {\n return c.json({ error: \"Accès refusé.\" }, 403);\n }\n if (week.week_start_date !== currentWeekStart()) {\n return c.json({ error: \"Cette semaine est en lecture seule.\" }, 403);\n }\n\n return { meal, week };\n}\n\nasync function getApiKeyForFoyer(foyerId: number): Promise {\n const result = await sqlite.execute({\n sql: `SELECT u.anthropic_api_key_encrypted AS key FROM users u\n JOIN foyers f ON f.user_id = u.id\n WHERE f.id = ?`,\n args: [foyerId],\n });\n const row = result.rows[0] as unknown as { key: string | null } | undefined;\n if (!row?.key) return null;\n return decryptSecret(row.key);\n}\n\nasync function getFoyerMembers(foyerId: number): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM members WHERE foyer_id = ? ORDER BY id ASC\",\n args: [foyerId],\n });\n return (result.rows as unknown as MemberRow[]).map(toMember);\n}\n\nmealRoutes.put(\"/:id/num-people\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const mealId = Number(c.req.param(\"id\"));\n const loaded = await loadMealForUser(mealId, userId, c);\n if (loaded instanceof Response) return loaded;\n\n const body = await c.req.json().catch(() => null);\n const numPeople = Number(body?.numPeople);\n if (!Number.isInteger(numPeople) || numPeople < 0 || numPeople > 30) {\n return c.json({ error: \"Nombre de personnes invalide.\" }, 400);\n }\n\n await sqlite.execute({ sql: \"UPDATE meals SET num_people = ? WHERE id = ?\", args: [numPeople, mealId] });\n return c.json({ ok: true, numPeople });\n});\n\nmealRoutes.post(\"/:id/generate\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const mealId = Number(c.req.param(\"id\"));\n const loaded = await loadMealForUser(mealId, userId, c);\n if (loaded instanceof Response) return loaded;\n const { meal, week } = loaded;\n\n if (meal.num_people <= 0) {\n return c.json({ error: \"Indiquez le nombre de personnes avant de générer un menu.\" }, 400);\n }\n\n const apiKey = await getApiKeyForFoyer(week.foyer_id);\n if (!apiKey) {\n return c.json({ error: \"Aucune clé API Anthropic configurée. Ajoutez-la dans votre profil.\" }, 400);\n }\n\n const members = await getFoyerMembers(week.foyer_id);\n\n try {\n const menu = await generateMenu(\n apiKey,\n meal.num_people,\n meal.meal_type as \"midi\" | \"soir\",\n members,\n );\n await sqlite.execute({\n sql: \"UPDATE meals SET generated_menu = ? WHERE id = ?\",\n args: [JSON.stringify(menu), mealId],\n });\n // Une nouvelle génération invalide les alternatives individuelles précédentes.\n await sqlite.execute({\n sql: \"DELETE FROM meal_modifications WHERE meal_id = ?\",\n args: [mealId],\n });\n return c.json({ menu });\n } catch (err) {\n if (err instanceof ClaudeGenerationError) return c.json({ error: err.message }, 502);\n throw err;\n }\n});\n\nmealRoutes.post(\"/:id/alternatives\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const mealId = Number(c.req.param(\"id\"));\n const loaded = await loadMealForUser(mealId, userId, c);\n if (loaded instanceof Response) return loaded;\n const { meal, week } = loaded;\n\n const body = await c.req.json().catch(() => null);\n const memberId = Number(body?.memberId);\n\n const memberResult = await sqlite.execute({ sql: \"SELECT * FROM members WHERE id = ?\", args: [memberId] });\n const memberRow = memberResult.rows[0] as unknown as MemberRow | undefined;\n if (!memberRow || memberRow.foyer_id !== week.foyer_id) {\n return c.json({ error: \"Membre introuvable.\" }, 404);\n }\n if (!meal.generated_menu) {\n return c.json({ error: \"Générez d'abord le menu de ce repas.\" }, 400);\n }\n\n const apiKey = await getApiKeyForFoyer(week.foyer_id);\n if (!apiKey) {\n return c.json({ error: \"Aucune clé API Anthropic configurée. Ajoutez-la dans votre profil.\" }, 400);\n }\n\n const currentDishTitle = JSON.parse(meal.generated_menu).platPrincipal.titre;\n\n try {\n const options = await generateAlternatives(apiKey, toMember(memberRow), currentDishTitle);\n return c.json({ options });\n } catch (err) {\n if (err instanceof ClaudeGenerationError) return c.json({ error: err.message }, 502);\n throw err;\n }\n});\n\nmealRoutes.post(\"/:id/alternatives/select\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const mealId = Number(c.req.param(\"id\"));\n const loaded = await loadMealForUser(mealId, userId, c);\n if (loaded instanceof Response) return loaded;\n const { week } = loaded;\n\n const body = await c.req.json().catch(() => null);\n const memberId = Number(body?.memberId);\n const option = body?.option;\n if (!option?.titre || !Array.isArray(option?.ingredients) || typeof option?.instructions !== \"string\") {\n return c.json({ error: \"Plat alternatif invalide.\" }, 400);\n }\n\n const memberResult = await sqlite.execute({ sql: \"SELECT * FROM members WHERE id = ?\", args: [memberId] });\n const memberRow = memberResult.rows[0] as unknown as MemberRow | undefined;\n if (!memberRow || memberRow.foyer_id !== week.foyer_id) {\n return c.json({ error: \"Membre introuvable.\" }, 404);\n }\n\n await sqlite.execute({\n sql: \"DELETE FROM meal_modifications WHERE meal_id = ? AND member_id = ?\",\n args: [mealId, memberId],\n });\n await sqlite.execute({\n sql: \"INSERT INTO meal_modifications (meal_id, member_id, alternative_dish, is_individual) VALUES (?, ?, ?, 1)\",\n args: [\n mealId,\n memberId,\n JSON.stringify({\n titre: option.titre,\n ingredients: option.ingredients,\n instructions: option.instructions,\n }),\n ],\n });\n\n return c.json({ ok: true });\n});\n",[],[130,184,194],"bc979431-db8d-4c06-83bc-432cc20a421c","foyers.ts","3be723b2-a555-11f1-8e97-1607ee4eb77e",12,["D",1788192092076],"import { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { requireAuth, type AppEnv } from \"../middleware/auth.ts\";\nimport { getAccessibleFoyerId } from \"../lib/foyerAccess.ts\";\nimport { signJwt, verifyJwt } from \"../lib/jwt.ts\";\nimport type { Foyer } from \"../../shared/types.ts\";\n\nexport const foyerRoutes = new Hono();\n\ninterface FoyerRow {\n id: number;\n user_id: number;\n name: string;\n share_token: string;\n created_at: string;\n}\n\nfunction toFoyer(row: FoyerRow): Foyer {\n return {\n id: row.id,\n userId: row.user_id,\n name: row.name,\n shareToken: row.share_token,\n createdAt: row.created_at,\n };\n}\n\nfoyerRoutes.get(\"/current\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const foyerId = await getAccessibleFoyerId(userId);\n if (!foyerId) return c.json({ foyer: null });\n\n const result = await sqlite.execute({ sql: \"SELECT * FROM foyers WHERE id = ?\", args: [foyerId] });\n const row = result.rows[0] as unknown as FoyerRow | undefined;\n if (!row) return c.json({ foyer: null });\n return c.json({ foyer: toFoyer(row) });\n});\n\nfoyerRoutes.post(\"/\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n\n const existingFoyerId = await getAccessibleFoyerId(userId);\n if (existingFoyerId) {\n return c.json({ error: \"Vous faites déjà partie d'un foyer.\" }, 409);\n }\n\n const body = await c.req.json().catch(() => null);\n const name = typeof body?.name === \"string\" ? body.name.trim() : \"\";\n if (!name) return c.json({ error: \"Le nom du foyer est requis.\" }, 400);\n\n const insertResult = await sqlite.execute({\n sql: \"INSERT INTO foyers (user_id, name, share_token) VALUES (?, ?, '')\",\n args: [userId, name],\n });\n const foyerId = Number(insertResult.lastInsertRowid);\n\n const shareToken = await signJwt({ foyerId }, \"SHARE_TOKEN_SECRET\");\n await sqlite.execute({\n sql: \"UPDATE foyers SET share_token = ? WHERE id = ?\",\n args: [shareToken, foyerId],\n });\n await sqlite.execute({\n sql: \"INSERT INTO foyer_access (foyer_id, user_id, role) VALUES (?, ?, 'owner')\",\n args: [foyerId, userId],\n });\n\n const result = await sqlite.execute({ sql: \"SELECT * FROM foyers WHERE id = ?\", args: [foyerId] });\n return c.json({ foyer: toFoyer(result.rows[0] as unknown as FoyerRow) }, 201);\n});\n\nfoyerRoutes.post(\"/join\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const body = await c.req.json().catch(() => null);\n const shareToken = typeof body?.shareToken === \"string\" ? body.shareToken : \"\";\n\n const payload = await verifyJwt<{ foyerId: number }>(shareToken, \"SHARE_TOKEN_SECRET\");\n if (!payload?.foyerId) return c.json({ error: \"Lien de partage invalide.\" }, 400);\n\n const foyer = await sqlite.execute({ sql: \"SELECT * FROM foyers WHERE id = ?\", args: [payload.foyerId] });\n const row = foyer.rows[0] as unknown as FoyerRow | undefined;\n if (!row) return c.json({ error: \"Foyer introuvable.\" }, 404);\n\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO foyer_access (foyer_id, user_id, role) VALUES (?, ?, 'member')\",\n args: [row.id, userId],\n });\n\n return c.json({ foyer: toFoyer(row) });\n});\n",[],[130,184,202],"345b4fa4-b4b2-43c6-abdb-e7eb8be8bbe4","auth.ts","352c1726-a555-11f1-b76c-1607ee4eb77e",11,["D",1788192080765],"import { Hono } from \"npm:hono@4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport {\n clearSessionCookie,\n createSessionCookie,\n hashPassword,\n verifyPassword,\n} from \"../lib/auth.ts\";\nimport { encryptSecret } from \"../lib/crypto.ts\";\nimport { requireAuth, type AppEnv } from \"../middleware/auth.ts\";\nimport { verifyJwt } from \"../lib/jwt.ts\";\nimport type { PublicUser } from \"../../shared/types.ts\";\n\nexport const authRoutes = new Hono();\n\nconst USERNAME_RE = /^[a-zA-Z0-9_-]{3,32}$/;\n\ninterface UserRow {\n id: number;\n username: string;\n email: string | null;\n anthropic_api_key_encrypted: string | null;\n created_at: string;\n}\n\nfunction toPublicUser(row: UserRow): PublicUser {\n return {\n id: row.id,\n username: row.username,\n email: row.email,\n hasApiKey: !!row.anthropic_api_key_encrypted,\n createdAt: row.created_at,\n };\n}\n\nauthRoutes.post(\"/signup\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = typeof body?.username === \"string\" ? body.username.trim() : \"\";\n const password = typeof body?.password === \"string\" ? body.password : \"\";\n const email = typeof body?.email === \"string\" && body.email.trim() ? body.email.trim() : null;\n // Jeton de partage optionnel : rejoindre un foyer existant lors de l'inscription.\n const shareToken = typeof body?.shareToken === \"string\" ? body.shareToken : null;\n\n if (!USERNAME_RE.test(username)) {\n return c.json({ error: \"Nom d'utilisateur invalide (3 à 32 caractères, lettres/chiffres/-/_).\" }, 400);\n }\n if (password.length < 8) {\n return c.json({ error: \"Le mot de passe doit contenir au moins 8 caractères.\" }, 400);\n }\n\n const existing = await sqlite.execute({\n sql: \"SELECT id FROM users WHERE username = ?\",\n args: [username],\n });\n if (existing.rows.length > 0) {\n return c.json({ error: \"Ce nom d'utilisateur est déjà pris.\" }, 409);\n }\n\n const passwordHash = await hashPassword(password);\n const insertResult = await sqlite.execute({\n sql: \"INSERT INTO users (username, password_hash, email) VALUES (?, ?, ?)\",\n args: [username, passwordHash, email],\n });\n const userId = Number(insertResult.lastInsertRowid);\n\n if (shareToken) {\n const payload = await verifyJwt<{ foyerId: number }>(shareToken, \"SHARE_TOKEN_SECRET\");\n if (payload?.foyerId) {\n const foyer = await sqlite.execute({\n sql: \"SELECT id FROM foyers WHERE id = ?\",\n args: [payload.foyerId],\n });\n if (foyer.rows.length > 0) {\n await sqlite.execute({\n sql: \"INSERT OR IGNORE INTO foyer_access (foyer_id, user_id, role) VALUES (?, ?, 'member')\",\n args: [payload.foyerId, userId],\n });\n }\n }\n }\n\n const cookie = await createSessionCookie({ userId, username });\n c.header(\"Set-Cookie\", cookie);\n\n const row = (await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [userId] }))\n .rows[0] as unknown as UserRow;\n return c.json({ user: toPublicUser(row) }, 201);\n});\n\nauthRoutes.post(\"/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const username = typeof body?.username === \"string\" ? body.username.trim() : \"\";\n const password = typeof body?.password === \"string\" ? body.password : \"\";\n\n const result = await sqlite.execute({\n sql: \"SELECT * FROM users WHERE username = ?\",\n args: [username],\n });\n const row = result.rows[0] as unknown as (UserRow & { password_hash: string }) | undefined;\n if (!row || !(await verifyPassword(password, row.password_hash))) {\n return c.json({ error: \"Identifiants incorrects.\" }, 401);\n }\n\n const cookie = await createSessionCookie({ userId: row.id, username: row.username });\n c.header(\"Set-Cookie\", cookie);\n return c.json({ user: toPublicUser(row) });\n});\n\nauthRoutes.post(\"/logout\", (c) => {\n c.header(\"Set-Cookie\", clearSessionCookie());\n return c.json({ ok: true });\n});\n\nauthRoutes.get(\"/me\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const result = await sqlite.execute({ sql: \"SELECT * FROM users WHERE id = ?\", args: [userId] });\n const row = result.rows[0] as unknown as UserRow | undefined;\n if (!row) return c.json({ error: \"Utilisateur introuvable.\" }, 404);\n return c.json({ user: toPublicUser(row) });\n});\n\nauthRoutes.put(\"/me/api-key\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n const body = await c.req.json().catch(() => null);\n const apiKey = typeof body?.apiKey === \"string\" ? body.apiKey.trim() : \"\";\n if (!apiKey) return c.json({ error: \"Clé API manquante.\" }, 400);\n\n const encrypted = await encryptSecret(apiKey);\n await sqlite.execute({\n sql: \"UPDATE users SET anthropic_api_key_encrypted = ? WHERE id = ?\",\n args: [encrypted, userId],\n });\n return c.json({ ok: true });\n});\n\nauthRoutes.delete(\"/me/api-key\", requireAuth, async (c) => {\n const userId = c.get(\"userId\");\n await sqlite.execute({\n sql: \"UPDATE users SET anthropic_api_key_encrypted = NULL WHERE id = ?\",\n args: [userId],\n });\n return c.json({ ok: true });\n});\n",[],[130,184,210],"6690d559-7bf6-4310-aefc-de5a687be263",["D",1788192080765],[164,165,166,167,168],[130,184],"346fa4c2-6e17-4687-a27a-68fcbffd8a41","29a1fe98-a555-11f1-9f75-1607ee4eb77e","6b001f32-8ae5-4b85-89b5-e784270035c0",10,["D",1788192061434],"import type { Context, Next } from \"npm:hono@4\";\nimport { getSessionFromCookie } from \"../lib/auth.ts\";\n\nexport interface AuthedVariables {\n userId: number;\n username: string;\n}\n\nexport type AppEnv = { Variables: AuthedVariables };\n\n/** Exige une session valide ; répond 401 sinon. */\nexport async function requireAuth(c: Context, next: Next) {\n const session = await getSessionFromCookie(c.req.header(\"cookie\") ?? null);\n if (!session) {\n return c.json({ error: \"Non authentifié.\" }, 401);\n }\n c.set(\"userId\", session.userId);\n c.set(\"username\", session.username);\n await next();\n}\n",[],[130,229,210],"middleware","657a58f4-aa57-4eb1-910b-f24f9d516a88",["D",1788192061434],[162],[130,229],"f5a42b2f-69ff-41fd-9f2e-f515a8870fe5","shopping.ts","281054da-a555-11f1-aeae-1607ee4eb77e","625001a9-80e0-4b73-81da-267477a3a76f",9,["D",1788192058802],"import type { GeneratedMenu, ShoppingListItem } from \"../../shared/types.ts\";\n\n// Unités regroupées en familles convertibles : on ne peut sommer des\n// quantités que si elles partagent une famille (masse, volume, ou pièce).\n// Tout le reste (cuillère à soupe, pincée, botte, ...) reste \"libre\" et\n// s'affiche séparément plutôt que d'être additionné à tort.\nconst MASS_TO_GRAMS: Record = {\n g: 1,\n gramme: 1,\n grammes: 1,\n kg: 1000,\n kilo: 1000,\n kilos: 1000,\n};\n\nconst VOLUME_TO_ML: Record = {\n ml: 1,\n cl: 10,\n l: 1000,\n litre: 1000,\n litres: 1000,\n};\n\nconst PIECE_UNITS = new Set([\"\", \"piece\", \"pièce\", \"pieces\", \"pièces\", \"unite\", \"unité\"]);\n\nfunction normalizeUnit(unit: string): string {\n return unit.trim().toLowerCase();\n}\n\nfunction normalizeName(name: string): string {\n return name.trim().toLowerCase().replace(/\\s+/g, \" \");\n}\n\n/** Catégories de rayon simples, par mots-clés — pour un tri manuel utile en magasin. */\nconst CATEGORY_KEYWORDS: [string, string[]][] = [\n [\"Fruits & légumes\", [\n \"tomate\", \"carotte\", \"oignon\", \"ail\", \"pomme\", \"banane\", \"salade\", \"courgette\",\n \"poivron\", \"citron\", \"aubergine\", \"champignon\", \"epinard\", \"épinard\", \"brocoli\",\n \"poireau\", \"haricot\", \"concombre\", \"persil\", \"basilic\", \"herbe\",\n ]],\n [\"Viandes & poissons\", [\n \"poulet\", \"boeuf\", \"bœuf\", \"porc\", \"agneau\", \"saumon\", \"poisson\", \"dinde\",\n \"jambon\", \"lardons\", \"crevette\", \"thon\", \"steak\",\n ]],\n [\"Crèmerie\", [\n \"lait\", \"beurre\", \"creme\", \"crème\", \"fromage\", \"yaourt\", \"oeuf\", \"œuf\",\n ]],\n [\"Épicerie\", [\n \"pate\", \"pâte\", \"riz\", \"farine\", \"sucre\", \"sel\", \"poivre\", \"huile\", \"vinaigre\",\n \"conserve\", \"bouillon\", \"epice\", \"épice\", \"sauce\", \"lentille\", \"pois chiche\",\n ]],\n [\"Boulangerie\", [\"pain\", \"baguette\", \"brioche\"]],\n [\"Surgelés\", [\"surgele\", \"surgelé\", \"glace\"]],\n];\n\nfunction guessCategory(ingredientName: string): string {\n const normalized = normalizeName(ingredientName);\n for (const [category, keywords] of CATEGORY_KEYWORDS) {\n if (keywords.some((keyword) => normalized.includes(keyword))) return category;\n }\n return \"Autres\";\n}\n\ninterface Accumulator {\n nom: string;\n categorie: string;\n massGrams: number;\n volumeMl: number;\n pieceCount: number;\n freeQuantities: string[]; // \"2 cuillères à soupe\", etc., non convertibles\n hasMass: boolean;\n hasVolume: boolean;\n hasPiece: boolean;\n}\n\nfunction parseQuantity(raw: string): number | null {\n const normalized = raw.trim().replace(\",\", \".\");\n const value = parseFloat(normalized);\n return Number.isFinite(value) ? value : null;\n}\n\n/**\n * Agrège les ingrédients de plusieurs menus (plat principal uniquement — les\n * alternatives individuelles ne sont pas incluses dans la liste de courses\n * commune, car elles concernent un seul membre et sont affichées à part).\n */\nexport function buildShoppingList(menus: GeneratedMenu[]): ShoppingListItem[] {\n const accumulators = new Map();\n\n for (const menu of menus) {\n for (const ingredient of menu.platPrincipal.ingredients) {\n const key = normalizeName(ingredient.nom);\n if (!accumulators.has(key)) {\n accumulators.set(key, {\n nom: ingredient.nom.trim(),\n categorie: guessCategory(ingredient.nom),\n massGrams: 0,\n volumeMl: 0,\n pieceCount: 0,\n freeQuantities: [],\n hasMass: false,\n hasVolume: false,\n hasPiece: false,\n });\n }\n const acc = accumulators.get(key)!;\n const unit = normalizeUnit(ingredient.unite);\n const qty = parseQuantity(ingredient.quantite);\n\n if (qty !== null && unit in MASS_TO_GRAMS) {\n acc.massGrams += qty * MASS_TO_GRAMS[unit];\n acc.hasMass = true;\n } else if (qty !== null && unit in VOLUME_TO_ML) {\n acc.volumeMl += qty * VOLUME_TO_ML[unit];\n acc.hasVolume = true;\n } else if (qty !== null && PIECE_UNITS.has(unit)) {\n acc.pieceCount += qty;\n acc.hasPiece = true;\n } else {\n acc.freeQuantities.push(`${ingredient.quantite} ${ingredient.unite}`.trim());\n }\n }\n }\n\n const items: ShoppingListItem[] = [];\n for (const acc of accumulators.values()) {\n // Une même ligne peut mélanger une quantité convertie et des quantités\n // libres (ex : \"500g\" + \"1 pincée\") : on émet une ligne principale pour\n // la quantité convertie, et on rattache le reste en quantité libre.\n if (acc.hasMass) {\n const useKg = acc.massGrams >= 1000;\n items.push({\n nom: acc.nom,\n quantite: useKg ? roundTo(acc.massGrams / 1000, 2) : acc.massGrams,\n unite: useKg ? \"kg\" : \"g\",\n categorie: acc.categorie,\n quantiteLibre: null,\n });\n }\n if (acc.hasVolume) {\n const useL = acc.volumeMl >= 1000;\n items.push({\n nom: acc.nom,\n quantite: useL ? roundTo(acc.volumeMl / 1000, 2) : acc.volumeMl,\n unite: useL ? \"L\" : \"ml\",\n categorie: acc.categorie,\n quantiteLibre: null,\n });\n }\n if (acc.hasPiece) {\n items.push({\n nom: acc.nom,\n quantite: acc.pieceCount,\n unite: \"pièce(s)\",\n categorie: acc.categorie,\n quantiteLibre: null,\n });\n }\n for (const free of acc.freeQuantities) {\n items.push({\n nom: acc.nom,\n quantite: null,\n unite: \"\",\n categorie: acc.categorie,\n quantiteLibre: free,\n });\n }\n }\n\n return items.sort((a, b) => {\n if (a.categorie !== b.categorie) return a.categorie.localeCompare(b.categorie, \"fr\");\n return a.nom.localeCompare(b.nom, \"fr\");\n });\n}\n\nexport function shoppingListToText(items: ShoppingListItem[]): string {\n const byCategory = new Map();\n for (const item of items) {\n if (!byCategory.has(item.categorie)) byCategory.set(item.categorie, []);\n byCategory.get(item.categorie)!.push(item);\n }\n const lines: string[] = [];\n for (const [category, categoryItems] of byCategory) {\n lines.push(`## ${category}`);\n for (const item of categoryItems) {\n const qty = item.quantite !== null\n ? `${formatQuantity(item.quantite)} ${item.unite}`.trim()\n : (item.quantiteLibre ?? \"\");\n lines.push(`- ${item.nom} — ${qty}`);\n }\n lines.push(\"\");\n }\n return lines.join(\"\\n\").trim();\n}\n\nfunction formatQuantity(n: number): string {\n return Number.isInteger(n) ? `${n}` : n.toFixed(2);\n}\n\nfunction roundTo(n: number, decimals: number): number {\n const factor = 10 ** decimals;\n return Math.round(n * factor) / factor;\n}\n",[],[130,243,235],"lib","72a641ba-3077-41df-9592-32759a2ef6ef","jwt.ts","1be43f32-a555-11f1-af6d-1607ee4eb77e",8,["D",1788192038382],"// Implémentation minimale de JWT (HS256) avec Web Crypto — pas de dépendance\n// externe. Utilisé pour les cookies de session et les liens de partage de foyer.\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlDecode(str: string): Uint8Array {\n const padded = str.replace(/-/g, \"+\").replace(/_/g, \"/\").padEnd(\n str.length + ((4 - (str.length % 4)) % 4),\n \"=\",\n );\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\nasync function getHmacKey(secretName: string): Promise {\n const secret = Deno.env.get(secretName);\n if (!secret) {\n throw new Error(`${secretName} n'est pas configurée (variable d'environnement du val).`);\n }\n return crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\nexport async function signJwt(\n payload: Record,\n secretName: string,\n expiresInSeconds?: number,\n): Promise {\n const header = { alg: \"HS256\", typ: \"JWT\" };\n const body = expiresInSeconds\n ? { ...payload, exp: Math.floor(Date.now() / 1000) + expiresInSeconds }\n : payload;\n\n const headerB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(header)));\n const bodyB64 = base64UrlEncode(new TextEncoder().encode(JSON.stringify(body)));\n const signingInput = `${headerB64}.${bodyB64}`;\n\n const key = await getHmacKey(secretName);\n const signature = await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(signingInput),\n );\n const signatureB64 = base64UrlEncode(new Uint8Array(signature));\n\n return `${signingInput}.${signatureB64}`;\n}\n\nexport async function verifyJwt>(\n token: string,\n secretName: string,\n): Promise {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const [headerB64, bodyB64, signatureB64] = parts;\n\n try {\n const key = await getHmacKey(secretName);\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n key,\n base64UrlDecode(signatureB64),\n new TextEncoder().encode(`${headerB64}.${bodyB64}`),\n );\n if (!valid) return null;\n\n const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(bodyB64)));\n if (typeof payload.exp === \"number\" && payload.exp < Math.floor(Date.now() / 1000)) {\n return null; // expiré\n }\n return payload as T;\n } catch {\n return null;\n }\n}\n",[],[130,243,245],"b1c8167d-1abd-44b0-abd6-ec3321d80692","foyerAccess.ts","16fda8fa-a555-11f1-8fbd-1607ee4eb77e",7,["D",1788192030140],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n/** Renvoie le foyer_id auquel l'utilisateur a accès (propriétaire ou invité), ou null. */\nexport async function getAccessibleFoyerId(userId: number): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT foyer_id FROM foyer_access WHERE user_id = ? ORDER BY id ASC LIMIT 1\",\n args: [userId],\n });\n const row = result.rows[0] as unknown as { foyer_id: number } | undefined;\n return row ? row.foyer_id : null;\n}\n\nexport async function userHasFoyerAccess(userId: number, foyerId: number): Promise {\n const result = await sqlite.execute({\n sql: \"SELECT 1 FROM foyer_access WHERE user_id = ? AND foyer_id = ? LIMIT 1\",\n args: [userId, foyerId],\n });\n return result.rows.length > 0;\n}\n",[],[130,243,253],"8ae70c7b-4aec-4556-872b-e202e2d8ac94","dates.ts","1560ab64-a555-11f1-9b2b-1607ee4eb77e",6,["D",1788192027447],"// Helpers de dates — toutes les semaines sont ancrées sur le lundi,\n// au format YYYY-MM-DD (UTC, pour rester stable indépendamment du fuseau du serveur).\n\nfunction toIsoDate(d: Date): string {\n return d.toISOString().slice(0, 10);\n}\n\n/** Renvoie le lundi (YYYY-MM-DD) de la semaine contenant `date` (par défaut aujourd'hui). */\nexport function mondayOf(date: Date = new Date()): string {\n const d = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), date.getUTCDate()));\n const day = d.getUTCDay(); // 0 = dimanche ... 6 = samedi\n const diffToMonday = day === 0 ? -6 : 1 - day;\n d.setUTCDate(d.getUTCDate() + diffToMonday);\n return toIsoDate(d);\n}\n\nexport function currentWeekStart(): string {\n return mondayOf(new Date());\n}\n\n/** Liste les N lundis précédant (strictement) `weekStartDate`, du plus récent au plus ancien. */\nexport function previousWeekStarts(weekStartDate: string, count: number): string[] {\n const [y, m, d] = weekStartDate.split(\"-\").map(Number);\n const base = new Date(Date.UTC(y, m - 1, d));\n const result: string[] = [];\n for (let i = 1; i <= count; i++) {\n const prev = new Date(base);\n prev.setUTCDate(prev.getUTCDate() - 7 * i);\n result.push(toIsoDate(prev));\n }\n return result;\n}\n",[],[130,243,261],"bfdce5f1-8133-44c3-910c-5027ca3a263b","crypto.ts","126f38c6-a555-11f1-8062-1607ee4eb77e",5,["D",1788192022509],"// Chiffrement symétrique (AES-GCM) de la clé API Anthropic avant stockage en\n// base, et helpers de hachage de mot de passe + signature de session.\n// Tout repose sur Web Crypto (natif Deno), aucune dépendance externe.\n\nfunction getEncryptionKeyMaterial(): string {\n const secret = Deno.env.get(\"ENCRYPTION_SECRET\");\n if (!secret) {\n throw new Error(\n \"ENCRYPTION_SECRET n'est pas configurée (variable d'environnement du val).\",\n );\n }\n return secret;\n}\n\nasync function deriveAesKey(): Promise {\n const material = getEncryptionKeyMaterial();\n const keyBytes = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(material),\n );\n return crypto.subtle.importKey(\"raw\", keyBytes, \"AES-GCM\", false, [\n \"encrypt\",\n \"decrypt\",\n ]);\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nfunction fromBase64(b64: string): Uint8Array {\n const binary = atob(b64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\nexport async function encryptSecret(plaintext: string): Promise {\n const key = await deriveAesKey();\n const iv = crypto.getRandomValues(new Uint8Array(12));\n const ciphertext = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv },\n key,\n new TextEncoder().encode(plaintext),\n );\n return `${toBase64(iv)}.${toBase64(new Uint8Array(ciphertext))}`;\n}\n\nexport async function decryptSecret(payload: string): Promise {\n const [ivB64, dataB64] = payload.split(\".\");\n if (!ivB64 || !dataB64) throw new Error(\"Format de secret chiffré invalide.\");\n const key = await deriveAesKey();\n const plaintext = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv: fromBase64(ivB64) },\n key,\n fromBase64(dataB64),\n );\n return new TextDecoder().decode(plaintext);\n}\n",[],[130,243,269],"171b0eb6-1575-4ed4-8121-234cbbf3ae3f","claude.ts","0e9589bc-a555-11f1-976f-1607ee4eb77e",4,["D",1788192016043],"import type { GeneratedMenu, Member, MealType } from \"../../shared/types.ts\";\n\nconst ANTHROPIC_API_URL = \"https://api.anthropic.com/v1/messages\";\nconst MODEL = \"claude-sonnet-4-5\";\nconst REQUEST_TIMEOUT_MS = 15000;\n\nexport class ClaudeGenerationError extends Error {}\n\nfunction preferencesSummary(member: Member): string {\n const flags: string[] = [];\n if (member.preferences.vegetarien) flags.push(\"végétarien\");\n if (member.preferences.vegan) flags.push(\"vegan\");\n if (member.preferences.sansGluten) flags.push(\"sans gluten\");\n if (member.preferences.sansLactose) flags.push(\"sans lactose\");\n const notes = member.preferences.notesLibres?.trim();\n const parts = [...flags];\n if (notes) parts.push(notes);\n return parts.length > 0 ? parts.join(\", \") : \"aucune restriction particulière\";\n}\n\nasync function callClaude(apiKey: string, prompt: string): Promise {\n const controller = new AbortController();\n const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n let response: Response;\n try {\n response = await fetch(ANTHROPIC_API_URL, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-api-key\": apiKey,\n \"anthropic-version\": \"2023-06-01\",\n },\n body: JSON.stringify({\n model: MODEL,\n max_tokens: 2048,\n messages: [{ role: \"user\", content: prompt }],\n }),\n signal: controller.signal,\n });\n } catch (err) {\n if (err instanceof DOMException && err.name === \"AbortError\") {\n throw new ClaudeGenerationError(\"Le service de génération a mis trop de temps à répondre.\");\n }\n throw new ClaudeGenerationError(\"Impossible de contacter le service de génération.\");\n } finally {\n clearTimeout(timeout);\n }\n\n if (response.status === 401) {\n throw new ClaudeGenerationError(\"Clé API Anthropic invalide ou expirée.\");\n }\n if (!response.ok) {\n throw new ClaudeGenerationError(`Le service de génération a répondu une erreur (${response.status}).`);\n }\n\n const data = await response.json();\n const text = data?.content?.[0]?.text;\n if (typeof text !== \"string\") {\n throw new ClaudeGenerationError(\"Réponse du service de génération illisible.\");\n }\n return text;\n}\n\nfunction extractJson(text: string): unknown {\n const fenced = text.match(/```(?:json)?\\s*([\\s\\S]*?)```/);\n const candidate = fenced ? fenced[1] : text;\n try {\n return JSON.parse(candidate.trim());\n } catch {\n throw new ClaudeGenerationError(\"Réponse du service de génération mal formée (JSON invalide).\");\n }\n}\n\nexport async function generateMenu(\n apiKey: string,\n numPeople: number,\n mealType: MealType,\n members: Member[],\n): Promise {\n const restrictionsCommunes = members.map((m) => `- ${m.name}: ${preferencesSummary(m)}`).join(\"\\n\");\n\n const prompt = `Tu es un assistant culinaire. Génère un menu pour ${numPeople} personne(s) pour un repas de ${mealType}.\n\nRestrictions et préférences des membres du foyer (à respecter pour le plat commun quand c'est possible ; sinon prévoir une alternative individuelle) :\n${restrictionsCommunes}\n\nRègles :\n- Le plat principal doit convenir à un maximum de monde. S'il ne peut pas convenir à un membre à cause d'une restriction stricte (allergie, régime), prévois une alternative individuelle pour ce membre uniquement.\n- Les quantités d'ingrédients doivent être adaptées au nombre de personnes indiqué.\n- Utilise des unités simples et cohérentes : \"g\", \"kg\", \"ml\", \"cl\", \"L\", ou \"\" (pièce) pour les ingrédients comptables.\n- Réponds UNIQUEMENT avec un objet JSON valide, sans texte autour, au format exact suivant :\n\n{\n \"plat_principal\": {\n \"titre\": \"string\",\n \"ingredients\": [{\"nom\": \"string\", \"quantite\": \"string\", \"unite\": \"string\"}],\n \"instructions\": \"string (quelques phrases courtes)\"\n },\n \"alternatives_individuelles\": [\n {\"pour_membre\": \"nom exact du membre\", \"titre\": \"string\", \"raison\": \"string\"}\n ]\n}\n\nSi aucune alternative n'est nécessaire, renvoie \"alternatives_individuelles\": [].`;\n\n const raw = await callClaude(apiKey, prompt);\n const parsed = extractJson(raw) as {\n plat_principal: { titre: string; ingredients: { nom: string; quantite: string; unite: string }[]; instructions: string };\n alternatives_individuelles: { pour_membre: string; titre: string; raison: string }[];\n };\n\n const byName = new Map(members.map((m) => [m.name, m]));\n\n return {\n platPrincipal: {\n titre: parsed.plat_principal.titre,\n ingredients: parsed.plat_principal.ingredients,\n instructions: parsed.plat_principal.instructions,\n },\n alternativesIndividuelles: (parsed.alternatives_individuelles ?? [])\n .map((alt) => {\n const member = byName.get(alt.pour_membre);\n if (!member) return null;\n return {\n pourMemberId: member.id,\n membreName: member.name,\n titre: alt.titre,\n raison: alt.raison,\n };\n })\n .filter((alt): alt is NonNullable => alt !== null),\n };\n}\n\nexport interface AlternativeOption {\n titre: string;\n ingredients: { nom: string; quantite: string; unite: string }[];\n instructions: string;\n raison: string;\n}\n\nexport async function generateAlternatives(\n apiKey: string,\n member: Member,\n currentDishTitle: string,\n): Promise {\n const prompt = `Le plat prévu pour ce repas est \"${currentDishTitle}\", mais il ne convient pas (ou peu) à ${member.name}.\nPréférences et restrictions de ${member.name} : ${preferencesSummary(member)}.\n\nPropose exactement 3 plats alternatifs adaptés, variés entre eux. Réponds UNIQUEMENT avec un objet JSON valide au format exact :\n\n{\n \"options\": [\n {\n \"titre\": \"string\",\n \"ingredients\": [{\"nom\": \"string\", \"quantite\": \"string\", \"unite\": \"string\"}],\n \"instructions\": \"string (quelques phrases courtes)\",\n \"raison\": \"string (pourquoi ce plat convient)\"\n }\n ]\n}\n\nLe tableau \"options\" doit contenir exactement 3 éléments.`;\n\n const raw = await callClaude(apiKey, prompt);\n const parsed = extractJson(raw) as { options: AlternativeOption[] };\n return parsed.options ?? [];\n}\n",[],[130,243,277],"ddcb559a-43ce-432c-b953-bdc207ccb83e","040f543c-a555-11f1-97f0-1607ee4eb77e",["D",1788191998400],"import bcrypt from \"npm:bcryptjs@2.4.3\";\nimport { signJwt, verifyJwt } from \"./jwt.ts\";\n\nconst SESSION_COOKIE = \"session\";\nconst SESSION_SECRET_NAME = \"SESSION_SECRET\";\nconst SESSION_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 jours\n\nexport interface SessionPayload {\n userId: number;\n username: string;\n}\n\nexport async function hashPassword(password: string): Promise {\n return bcrypt.hash(password, 10);\n}\n\nexport async function verifyPassword(password: string, hash: string): Promise {\n return bcrypt.compare(password, hash);\n}\n\nexport async function createSessionCookie(payload: SessionPayload): Promise {\n const token = await signJwt({ ...payload }, SESSION_SECRET_NAME, SESSION_TTL_SECONDS);\n const maxAge = SESSION_TTL_SECONDS;\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearSessionCookie(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=0`;\n}\n\nexport function readSessionCookieValue(cookieHeader: string | null): string | null {\n if (!cookieHeader) return null;\n const match = cookieHeader\n .split(\";\")\n .map((part) => part.trim())\n .find((part) => part.startsWith(`${SESSION_COOKIE}=`));\n if (!match) return null;\n return match.slice(SESSION_COOKIE.length + 1);\n}\n\nexport async function getSessionFromCookie(\n cookieHeader: string | null,\n): Promise {\n const token = readSessionCookieValue(cookieHeader);\n if (!token) return null;\n const payload = await verifyJwt(\n token,\n SESSION_SECRET_NAME,\n );\n if (!payload) return null;\n return { userId: payload.userId, username: payload.username };\n}\n",[],[130,243,210],"776b0922-f1d9-49cf-8ebd-5d82c9279641",["D",1788191998400],[154,155,156,157,158,159,160],[130,243],"fd4c5f3e-9205-46c7-b61a-988472846d13","schema.ts","015ccdb4-a555-11f1-b518-1607ee4eb77e","33d9d9fc-70d9-4462-9b17-b10ca5880ffa",2,["D",1788191993442],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// Idempotent schema setup — appelé au démarrage de chaque requête froide.\n// CREATE TABLE IF NOT EXISTS partout : sûr à ré-exécuter.\nexport async function ensureSchema() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n username TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n email TEXT,\n anthropic_api_key_encrypted TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS foyers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id INTEGER NOT NULL REFERENCES users(id),\n name TEXT NOT NULL,\n share_token TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n // Table de jonction : un foyer peut être partagé et rejoint par plusieurs\n // comptes utilisateurs (propriétaire inclus).\n {\n sql: `CREATE TABLE IF NOT EXISTS foyer_access (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n foyer_id INTEGER NOT NULL REFERENCES foyers(id),\n user_id INTEGER NOT NULL REFERENCES users(id),\n role TEXT NOT NULL DEFAULT 'member',\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(foyer_id, user_id)\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS members (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n foyer_id INTEGER NOT NULL REFERENCES foyers(id),\n name TEXT NOT NULL,\n preferences TEXT NOT NULL DEFAULT '{}',\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS weeks (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n foyer_id INTEGER NOT NULL REFERENCES foyers(id),\n week_start_date TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(foyer_id, week_start_date)\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS meals (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n week_id INTEGER NOT NULL REFERENCES weeks(id),\n day_of_week INTEGER NOT NULL,\n meal_type TEXT NOT NULL CHECK (meal_type IN ('midi', 'soir')),\n num_people INTEGER NOT NULL DEFAULT 0,\n generated_menu TEXT,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n UNIQUE(week_id, day_of_week, meal_type)\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS meal_modifications (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n meal_id INTEGER NOT NULL REFERENCES meals(id),\n member_id INTEGER REFERENCES members(id),\n alternative_dish TEXT NOT NULL,\n is_individual INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n args: [],\n },\n ]);\n}\n",[],[130,303,295],"db","e3698a61-28ac-40d3-bb2f-c5feb458113b",["D",1788191993442],[152],[130,303],["D",1788191982713],[151,153,161,163,169],[130],["D",1788191950718],["D",1789497078049],{"_99":98,"_106":101},{"_99":98,"_100":101,"_102":101,"_18":54,"_103":104,"_105":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_125":349,"_350":351,"_352":353,"_354":24,"_355":24,"_356":24,"_357":58,"_358":-5,"_359":-7,"_360":-7,"_361":62,"_362":24,"_363":24,"_364":-5,"_365":24,"_366":24,"_367":24,"_368":-5},"ENV",{"_320":321,"_322":323,"_324":89,"_325":326,"_327":328,"_329":330,"_331":332,"_333":334,"_335":336,"_337":338,"_339":340,"_341":342,"_343":344,"_345":346,"_347":348},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v15