'+x[0]+'

'+x[2]+'

'+x[1]+'

').join('');\n const missing=configMissing();const items=[...urg.slice(0,4).map(x=>({kind:'urgent',title:x.objet||x.description||'Demande urgente',sub:clientName(x),time:dt(x.created_at)})),...tasks.filter(x=>!/(termine|done)/i.test(x.statut||'')).slice(0,3).map(x=>({kind:'warn',title:x.titre||'Tâche',sub:x.priorite||'',time:dt(x.echeance||x.created_at)})),...missing.slice(0,2).map(x=>({kind:'warn',title:'Configurer '+x,sub:'Bloque la mise en production',time:''}))];\n q('#priorityList').innerHTML=items.length?items.map(x=>'

'+esc(x.title)+'

'+esc(x.sub)+'

'+esc(x.time)+'

').join(''):'

Rien de critique

La file prioritaire est vide.

';\n const upcoming=appointments.filter(x=>new Date(x.date_heure||x.debut||0)>=new Date()).sort((a,b)=>new Date(a.date_heure||a.debut)-new Date(b.date_heure||b.debut)).slice(0,5);\n q('#upcomingList').innerHTML=upcoming.length?upcoming.map(x=>'

'+day(x.date_heure||x.debut)+'

'+esc(clientName(x))+'

'+esc(x.type||x.objet||'Intervention')+'

'+dt(x.date_heure||x.debut)+'

').join(''):'

Aucun rendez-vous à venir

';\n q('#proofCount').textContent=verifiedCore()+'/6';\n}\n\nfunction requestRows(rows){return rows.map(x=>''+esc(x.numero||x.objet||'Demande')+'

'+esc(clientName(x))+'

'+pill(x.urgence||'normale')+''+pill(x.statut||'nouveau')+''+esc(x.description||x.objet||'—')+''+dt(x.created_at)+'').join('')}\nfunction renderRequests(){const term=(q('#requestSearch')?.value||'').toLowerCase(),filter=q('#requestFilter')?.value||'all';const rows=requests.filter(x=>{const hay=JSON.stringify([x.numero,x.objet,x.description,clientName(x)]).toLowerCase();return(!term||hay.includes(term))&&(filter==='all'||(filter==='urgent'?urgent(x):String(x.statut||'')===filter))});q('#requestsBody').innerHTML=rows.length?requestRows(rows):'Aucune demande';q('#requestsMobile').innerHTML=rows.map(x=>'

'+esc(x.objet||'Demande')+'

'+esc(clientName(x))+' · '+dt(x.created_at)+'

'+pill(x.statut||'nouveau')+'

').join('')||'

Aucune demande

';q('#requestCount').textContent=rows.length}\nq('#requestSearch').oninput=renderRequests;q('#requestFilter').onchange=renderRequests;\n\nfunction renderAgenda(){const rows=[...appointments].sort((a,b)=>new Date(a.date_heure||a.debut||0)-new Date(b.date_heure||b.debut||0));q('#agendaList').innerHTML=rows.length?rows.map(x=>'

'+day(x.date_heure||x.debut)+'

'+esc(clientName(x))+'

'+esc(x.type||x.objet||'Intervention')+' · '+esc(x.adresse||x.ville||'Adresse non renseignée')+'

'+dt(x.date_heure||x.debut)+'
'+pill(x.statut||'planifie')+'

').join(''):'

Aucun rendez-vous

'}\nfunction renderClients(){q('#clientsBody').innerHTML=clients.length?clients.map(x=>''+esc(x.nom||'Sans nom')+'

'+esc(x.ville||'')+'

'+esc(x.telephone||'—')+''+esc(x.email||'—')+''+esc(x.piscine?.type_bassin||x.type_bassin||'—')+''+pill(x.statut||'actif')+'').join(''):'Aucun client';q('#clientsMobile').innerHTML=clients.map(x=>'

'+esc(x.nom||x.telephone||'Client')+'

'+esc([x.telephone,x.email].filter(Boolean).join(' · '))+'

').join('')||'

Aucun client

';q('#clientCount').textContent=clients.length}\n\nlet moneyTab='quotes';function renderMoney(){qa('[data-money-tab]').forEach(x=>x.classList.toggle('active',x.dataset.moneyTab===moneyTab));const source=moneyTab==='quotes'?quotes:moneyTab==='invoices'?invoices:purchases;const rows=source.map(x=>''+esc(x.numero||x.fournisseur||x.objet||'Document')+'

'+esc(clientName(x))+'

'+dt(x.date_emission||x.date_facture||x.created_at)+''+money(x.total_ttc||x.montant_ttc||x.total||0)+''+pill(x.statut||'brouillon')+'').join('');q('#moneyBody').innerHTML=rows||'Aucun élément'}\nqa('[data-money-tab]').forEach(x=>x.onclick=()=>{moneyTab=x.dataset.moneyTab;renderMoney()});\n\nfunction integrationState(){const voice=integrations.retell_production_ready===true?'verified':present(integrations.retell_agent_id||data.retell_agent_id)?'partial':'blocked';const sms=integrations.twilio_production_ready===true?'verified':'blocked';const sec=securityState();const secDetail=sec==='verified'?Number(security.tables_total||0)+' tables protégées':sec==='partial'?'RLS active · policies à construire':list(security.rls_disabled).length+' table(s) sans RLS';return[{name:'Données',state:data.ok===true?'verified':'blocked',detail:'Supabase et transactions'},{name:'Sécurité',state:sec,detail:secDetail},{name:'Automatisation',state:data.runtime?.businessApi?'verified':'blocked',detail:'n8n et contrats métier'},{name:'Cockpit',state:'verified',detail:'Session et commandes'},{name:'Intelligence',state:ai.ok===true?'verified':'partial',detail:'Analyse et alertes'},{name:'Voix',state:voice,detail:voice==='verified'?'Test fournisseur prouvé':'Agent non certifié'},{name:'SMS',state:sms,detail:sms==='verified'?'Livraison prouvée':'Canal neutralisé'}]}\nfunction renderPilot(){const states=integrationState(),labels={verified:'Prouvé',partial:'Partiel',blocked:'Bloqué'},tones={verified:'ok',partial:'warn',blocked:'bad'};q('#integrationGrid').innerHTML=states.map(x=>'

'+x.name+'

'+labels[x.state]+'

'+x.detail+'

').join('');const calls=list(ai.recent_calls).slice(0,6);q('#aiCalls').innerHTML=calls.length?calls.map(x=>'

=60?'urgent':'ok')+'\">

'+esc(x.intent||'Appel')+'

'+esc(x.outcome||'À qualifier')+' · qualité '+esc(x.completeness_score||0)+'/100

'+dt(x.last_seen_at)+'

').join(''):'

Aucun appel analysé

';q('#alertList').innerHTML=alerts.length?alerts.map(x=>'

'+esc(x.title||'Alerte')+'

'+esc(x.category||'Système')+'

'+dt(x.created_at)+'

').join(''):'

Aucune alerte ouverte

'}\n\nfunction renderSettings(){const rows=[['Nom',company.nom],['Téléphone',company.tel||company.telephone],['E-mail',company.email],['SIRET',company.siret],['Adresse',company.adresse],['Zone',settings.zone_intervention],['Rayon',settings.rayon_km?settings.rayon_km+' km':null],['Transfert humain',settings.human_transfer_number]];q('#settingsDefinition').innerHTML=rows.map(x=>'

'+x[0]+'

'+esc(x[1]||'Non renseigné')+'

').join('');const missing=configMissing();q('#blockerList').innerHTML=missing.length?missing.map(x=>'

'+esc(x)+' manquant

').join(''):'

Configuration minimale complète

'}\n\nconst dialog=q('#actionDialog'),dialogTitle=q('#dialogTitle'),dialogBody=q('#dialogBody');\nconst forms={\n request:{title:'Nouvelle demande',action:'client.create',html:'

Nom

Téléphone *

E-mail

Urgence

Demande *

'},\n availability:{title:'Chercher un créneau',action:'availability.check',html:'

Date souhaitée *

Durée

Adresse

'},\n appointment:{title:'Planifier un rendez-vous',action:'rdv.create',html:'

Téléphone client *

Date et heure *

Type

Adresse

Le client a explicitement confirmé ce créneau.

'},\n context:{title:'Mémoire client',action:'client.context',html:'

Téléphone *

'},\n knowledge:{title:'Connaissance métier',action:'knowledge.lookup',html:'

Question *

'},\n next:{title:'Prochaine action',action:'next.action',html:'

Téléphone client *

'},\n quote:{title:'Nouveau devis',action:'devis.create',html:'

Téléphone client *

Objet *

'}\n};\nfunction quoteLine(){const row=document.createElement('div');row.className='quote-line';row.innerHTML='';q('button',row).onclick=()=>row.remove();q('#quoteLines').appendChild(row)}\nfunction openAction(kind){const cfg=forms[kind];if(!cfg)return;dialogTitle.textContent=cfg.title;dialogBody.innerHTML='';dialogBody.dataset.kind=kind;q('[data-close]',dialogBody).onclick=()=>dialog.close();if(kind==='quote'){q('#addQuoteLine').onclick=quoteLine;quoteLine()}q('#actionForm').onsubmit=submitAction;dialog.showModal()}\nqa('[data-open-action]').forEach(x=>x.onclick=()=>openAction(x.dataset.openAction));q('#dialogClose').onclick=()=>dialog.close();\nasync function submitAction(event){event.preventDefault();const form=event.currentTarget,cfg=forms[dialogBody.dataset.kind],button=q('[type=submit]',form),payload=Object.fromEntries(new FormData(form).entries());if(dialogBody.dataset.kind==='quote')payload.lines=qa('.quote-line',form).map(row=>({designation:q('[name=designation]',row).value,quantite:Number(q('[name=quantite]',row).value||1),prix_unitaire_ht:Number(q('[name=prix_unitaire_ht]',row).value||0),tva_taux:20}));button.disabled=true;try{if(data.preview){toast('Aperçu : action non exécutée');dialog.close();return}const response=await fetch('/api/action',{method:'POST',headers:{'content-type':'application/json','x-csrf-token':csrf},body:JSON.stringify({action:cfg.action,data:payload})}),result=await response.json();if(!response.ok||result.ok===false)throw new Error(result.message||result.error||'Action refusée');if(['availability.check','client.context','knowledge.lookup','next.action'].includes(cfg.action)){const box=q('#actionResult');if(cfg.action==='knowledge.lookup'){const names=list(result.matches).map(x=>x.title).filter(Boolean);box.textContent=(result.assistant_message||'')+(names.length?'\\n'+names.join(' · '):'')}else if(cfg.action==='next.action'){box.textContent=(result.assistant_message||'')+'\\nConfiance : '+Math.round(Number(result.confidence||0)*100)+' %'}else{box.textContent=result.message||result.assistant_message||JSON.stringify(result,null,2)}box.classList.add('show')}else{toast(result.message||'Action enregistrée');dialog.close();setTimeout(()=>location.reload(),700)}}catch(error){toast(error.message||String(error),false)}finally{button.disabled=false}}\n\nconst searchDialog=q('#searchDialog'),searchInput=q('#globalSearch'),searchResults=q('#searchResults');\nfunction openSearch(){searchDialog.showModal();searchInput.value='';searchInput.focus();renderSearch('')}\nfunction renderSearch(term){term=term.toLowerCase().trim();const source=[...requests.map(x=>({view:'requests',title:x.objet||'Demande',sub:clientName(x)+' · '+textStatus(x.statut)})),...clients.map(x=>({view:'clients',title:x.nom||x.telephone||'Client',sub:[x.telephone,x.email].filter(Boolean).join(' · ')})),...quotes.map(x=>({view:'money',title:x.numero||x.objet||'Devis',sub:clientName(x)+' · '+money(x.total_ttc)}))].filter(x=>!term||(x.title+' '+x.sub).toLowerCase().includes(term)).slice(0,18);searchResults.innerHTML=source.length?source.map((x,i)=>'').join(''):'

Aucun résultat

';qa('[data-result]',searchResults).forEach(x=>x.onclick=()=>{showView(source[Number(x.dataset.result)].view);searchDialog.close()})}\nq('#searchTrigger').onclick=openSearch;searchInput.oninput=()=>renderSearch(searchInput.value);q('#searchClose').onclick=()=>searchDialog.close();document.addEventListener('keydown',event=>{if((event.ctrlKey||event.metaKey)&&event.key.toLowerCase()==='k'){event.preventDefault();openSearch()}if(event.key==='Escape'){searchDialog.close();dialog.close()}});\nq('#refreshAi').onclick=async()=>{const button=q('#refreshAi');button.disabled=true;try{const response=await fetch('/api/ai-supervision'),result=await response.json();if(!response.ok||result.ok===false)throw new Error('Supervision indisponible');data.ai=result;toast('Pilotage actualisé');location.reload()}catch(error){toast(error.message,false)}finally{button.disabled=false}};\nq('#logout').onclick=async()=>{await fetch('/logout',{method:'POST',headers:{'x-csrf-token':csrf}});location.href='/'};\nq('#todayDate').textContent=new Intl.DateTimeFormat('fr-FR',{weekday:'long',day:'numeric',month:'long'}).format(new Date());renderToday();renderRequests();renderAgenda();renderClients();renderMoney();renderPilot();renderSettings();showView(location.hash.slice(1)||'today');\n`;\n\nfunction safeJson(value: unknown): string {\n return JSON.stringify(value).replace(/ {\n return {\n \"Content-Type\": contentType,\n \"Cache-Control\": \"no-store, max-age=0\",\n \"Pragma\": \"no-cache\",\n \"Content-Security-Policy\": `default-src 'self'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'`,\n \"X-Frame-Options\": \"DENY\",\n \"X-Content-Type-Options\": \"nosniff\",\n \"Referrer-Policy\": \"no-referrer\",\n \"Permissions-Policy\": \"camera=(), microphone=(), geolocation=(), payment=(), usb=()\",\n \"Cross-Origin-Opener-Policy\": \"same-origin\",\n \"Cross-Origin-Resource-Policy\": \"same-origin\",\n };\n}\n\nexport function loginPage(error: string, nonce: string): string {\n return `Connexion · Secrétariat`;\n}\n\nexport function appPage(data: Record, session: Session, nonce: string): string {\n return `Secrétariat PiscinisteAller au contenu

À traiter maintenant

Priorités, rendez-vous et preuves.

—capacités prouvées

Priorités

Actions

Prochains rendez-vous

File opérationnelle

Demandes

Demande	Priorité	Statut	Objet	Créée

Planning

Agenda

Mémoire opérationnelle

Clients

0 clients

Client	Téléphone	E-mail	Piscine	État

Documents

Devis & finance

Document	Date	Montant	Statut

Vérité système

Pilotage

Appels récents

Alertes

Configuration

Réglages

Bloqueurs

`;\n}\n","label",[440,68],"lib","pulls","branches",100,"forks","envVars",{"_449":451,"_452":26},"connections",{"_449":26,"_450":26},"count","unfilledCount",51,"emptyCount",{"_32":484,"_13":440,"_66":432,"_42":-5,"_34":35,"_433":39,"_434":88,"_36":485,"_38":26,"_69":486,"_436":-5,"_71":24,"_438":-5,"_464":487,"_17":488},{"_32":477,"_13":478,"_66":479,"_42":432,"_34":35,"_433":39,"_434":88,"_36":480,"_38":26,"_69":70,"_436":481,"_71":24,"_438":-5,"_464":482,"_17":483},{"_32":470,"_13":471,"_66":472,"_42":432,"_34":35,"_433":39,"_434":88,"_36":473,"_38":26,"_69":70,"_436":474,"_71":24,"_438":-5,"_464":475,"_17":476},{"_32":431,"_13":68,"_66":67,"_42":432,"_34":35,"_433":39,"_434":88,"_36":467,"_38":26,"_69":70,"_436":437,"_71":24,"_438":-5,"_464":468,"_17":469},{"_32":458,"_13":459,"_66":460,"_42":-5,"_34":35,"_433":39,"_434":88,"_36":461,"_38":26,"_69":462,"_436":463,"_71":24,"_438":-5,"_464":465,"_17":466},"727d539b-b114-4733-82cc-07772752e07a","cockpit.ts","019f4ede-039a-7424-b93f-fe51e0bdd0a7",["D",1783734600613],"http","import {\n authConfigured,\n clearLoginFailures,\n expiredCookie,\n getSession,\n issueSession,\n loginRetryAfter,\n recordLoginFailure,\n sameOrigin,\n validAccessCode,\n validCsrf,\n} from \"./lib/auth.ts\";\nimport { aiSupervision, cockpitAction, cockpitApi, integrationConfig, securityAudit } from \"./lib/api.ts\";\nimport { appPage, loginPage, securityHeaders } from \"./lib/ui.ts\";\n\nconst VERSION = \"2026.07.11-cockpit-v3.1\";\nconst ACTIONS = new Set([\"client.create\", \"client.context\", \"availability.check\", \"rdv.create\", \"devis.create\", \"knowledge.lookup\", \"next.action\"]);\n\nfunction nonce(): string {\n return crypto.randomUUID().replaceAll(\"-\", \"\");\n}\n\nfunction json(data: unknown, status = 200, pageNonce = nonce()): Response {\n return new Response(JSON.stringify(data), { status, headers: securityHeaders(pageNonce, \"application/json; charset=utf-8\") });\n}\n\nfunction html(body: string, pageNonce: string, status = 200, extra: Record = {}): Response {\n return new Response(body, { status, headers: { ...securityHeaders(pageNonce, \"text/html; charset=utf-8\"), ...extra } });\n}\n\nfunction redirect(location: string, cookie?: string): Response {\n const headers: Record = { Location: location, \"Cache-Control\": \"no-store\" };\n if (cookie) headers[\"Set-Cookie\"] = cookie;\n return new Response(null, { status: 303, headers });\n}\n\nfunction apiRequest(url: URL): boolean {\n return url.pathname.startsWith(\"/api/\");\n}\n\nasync function readJson(req: Request): Promise> {\n const declared = Number(req.headers.get(\"content-length\") || 0);\n if (declared > 32_768) throw new Error(\"payload_too_large\");\n const raw = await req.text();\n if (raw.length > 32_768) throw new Error(\"payload_too_large\");\n const parsed = raw ? JSON.parse(raw) : {};\n if (!parsed || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error(\"invalid_payload\");\n return parsed as Record;\n}\n\nexport default async function handler(req: Request): Promise {\n const url = new URL(req.url);\n const pageNonce = nonce();\n\n if (req.method === \"GET\" && url.pathname === \"/health\") {\n const [business, ai, security] = await Promise.allSettled([cockpitApi(\"health\"), aiSupervision(), securityAudit()]);\n const services = {\n business: business.status === \"fulfilled\",\n intelligence: ai.status === \"fulfilled\",\n security: security.status === \"fulfilled\" && security.value.security_ok === true,\n };\n return json({ ok: services.business, service: \"secretariat-pisciniste\", version: VERSION, services }, services.business ? 200 : 503, pageNonce);\n }\n\n if (req.method === \"POST\" && url.pathname === \"/login\") {\n if (!sameOrigin(req)) return html(loginPage(\"Requête refusée.\", pageNonce), pageNonce, 403);\n const retryAfter = await loginRetryAfter(req);\n if (retryAfter > 0) return html(loginPage(\"Trop de tentatives. Réessayez plus tard.\", pageNonce), pageNonce, 429, { \"Retry-After\": String(retryAfter) });\n const form = new URLSearchParams((await req.text()).slice(0, 2048));\n const code = String(form.get(\"code\") || \"\").slice(0, 256);\n if (!validAccessCode(code)) {\n await recordLoginFailure(req);\n return html(loginPage(\"Code incorrect.\", pageNonce), pageNonce, 401);\n }\n await clearLoginFailures(req);\n const issued = await issueSession();\n return redirect(\"/\", issued.cookie);\n }\n\n const session = await getSession(req);\n if (!session) {\n if (apiRequest(url)) return json({ ok: false, error: \"unauthorized\" }, 401, pageNonce);\n return html(loginPage(authConfigured() ? \"\" : \"Authentification indisponible.\", pageNonce), pageNonce, authConfigured() ? 200 : 503);\n }\n\n if (req.method === \"POST\" && url.pathname === \"/logout\") {\n if (!validCsrf(req, session)) return json({ ok: false, error: \"csrf_rejected\" }, 403, pageNonce);\n return redirect(\"/\", expiredCookie());\n }\n\n if (req.method === \"GET\" && url.pathname === \"/api/bootstrap\") {\n try {\n return json(await cockpitApi(\"bootstrap\"), 200, pageNonce);\n } catch {\n return json({ ok: false, error: \"business_api_unavailable\" }, 502, pageNonce);\n }\n }\n\n if (req.method === \"GET\" && url.pathname === \"/api/ai-supervision\") {\n try {\n return json(await aiSupervision(), 200, pageNonce);\n } catch {\n return json({ ok: false, error: \"intelligence_api_unavailable\" }, 502, pageNonce);\n }\n }\n\n if (req.method === \"GET\" && url.pathname === \"/api/security-audit\") {\n try {\n return json(await securityAudit(), 200, pageNonce);\n } catch {\n return json({ ok: false, error: \"security_audit_unavailable\" }, 502, pageNonce);\n }\n }\n\n if (req.method === \"POST\" && url.pathname === \"/api/action\") {\n if (!validCsrf(req, session)) return json({ ok: false, error: \"csrf_rejected\" }, 403, pageNonce);\n try {\n const body = await readJson(req);\n const action = String(body.action || \"\");\n if (!ACTIONS.has(action)) return json({ ok: false, error: \"action_not_enabled\" }, 409, pageNonce);\n const data = body.data && typeof body.data === \"object\" && !Array.isArray(body.data) ? body.data as Record : {};\n return json(await cockpitAction(action, data), 200, pageNonce);\n } catch (error) {\n const code = error instanceof Error && /^[a-z0-9_:-]+$/i.test(error.message) ? error.message : \"action_failed\";\n return json({ ok: false, error: code }, code === \"payload_too_large\" ? 413 : 400, pageNonce);\n }\n }\n\n if (req.method !== \"GET\" || url.pathname !== \"/\") return json({ ok: false, error: \"not_found\" }, 404, pageNonce);\n\n const [businessResult, aiResult, securityResult] = await Promise.allSettled([cockpitApi(\"bootstrap\"), aiSupervision(), securityAudit()]);\n const business = businessResult.status === \"fulfilled\" ? businessResult.value : {\n ok: false,\n clients: [], piscines: [], demandes: [], rendez_vous: [], devis: [], factures: [], achats: [], taches: [], integrations: {},\n };\n const ai = aiResult.status === \"fulfilled\" ? aiResult.value : { ok: false, metrics: {}, recent_calls: [], alerts: [], action_metrics: [], knowledge: [], capabilities: [] };\n const security = securityResult.status === \"fulfilled\" ? securityResult.value : { ok: false, security_ok: false, rls_disabled: [], rls_without_policies: [], tables_with_public_grants: [] };\n return html(appPage({ ...business, ai, security, runtime: integrationConfig() }, session, pageNonce), pageNonce);\n}\n","children",[],[459],["D",1783734600613],[],[440,68],"699ec129-86ae-49f1-a671-a80b41151931","auth.ts","019f4ede-039a-7424-b93f-f144ed851c6d",["D",1783734600613],"const encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nconst ACCESS_CODE = Deno.env.get(\"PISCINE_ACCESS_CODE\") || \"\";\nconst BRIDGE_KEY = Deno.env.get(\"PISCINE_BRIDGE_KEY\") || \"\";\nconst COOKIE = \"piscine_session\";\nconst SESSION_TTL_MS = 8 * 60 * 60 * 1000;\nconst WINDOW_MS = 5 * 60 * 1000;\nconst MAX_FAILURES = 5;\n\nexport type Session = {\n v: 2;\n iat: number;\n exp: number;\n nonce: string;\n csrf: string;\n};\n\ntype Attempt = { count: number; resetAt: number; blockedUntil: number };\nconst attempts = new Map();\n\nfunction base64url(bytes: Uint8Array): string {\n let value = \"\";\n for (const byte of bytes) value += String.fromCharCode(byte);\n return btoa(value).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/g, \"\");\n}\n\nfunction decode64url(value: string): Uint8Array {\n const padded = value.replace(/-/g, \"+\").replace(/_/g, \"/\") + \"===\".slice((value.length + 3) % 4);\n const raw = atob(padded);\n return Uint8Array.from(raw, (char) => char.charCodeAt(0));\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n const aa = encoder.encode(a);\n const bb = encoder.encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let index = 0; index < aa.length; index++) diff |= aa[index] ^ bb[index];\n return diff === 0;\n}\n\nasync function signingKey(): Promise {\n return crypto.subtle.importKey(\n \"raw\",\n encoder.encode(`${ACCESS_CODE}\\u0000${BRIDGE_KEY}`),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n}\n\nasync function signature(value: string): Promise {\n const signed = await crypto.subtle.sign(\"HMAC\", await signingKey(), encoder.encode(value));\n return base64url(new Uint8Array(signed));\n}\n\nfunction cookies(req: Request): Record {\n const result: Record = {};\n for (const chunk of (req.headers.get(\"cookie\") || \"\").split(\";\")) {\n const [rawKey, ...parts] = chunk.trim().split(\"=\");\n if (!rawKey) continue;\n try {\n result[rawKey] = decodeURIComponent(parts.join(\"=\"));\n } catch {\n result[rawKey] = \"\";\n }\n }\n return result;\n}\n\nasync function clientKey(req: Request): Promise {\n const forwarded = req.headers.get(\"cf-connecting-ip\") || req.headers.get(\"x-forwarded-for\") || \"unknown\";\n const ip = forwarded.split(\",\")[0].trim();\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(`${ip}\\u0000${BRIDGE_KEY}`));\n return base64url(new Uint8Array(digest)).slice(0, 24);\n}\n\nasync function attemptFor(req: Request): Promise<[string, Attempt]> {\n const key = await clientKey(req);\n const now = Date.now();\n let state = attempts.get(key);\n if (!state || now >= state.resetAt) state = { count: 0, resetAt: now + WINDOW_MS, blockedUntil: 0 };\n attempts.set(key, state);\n return [key, state];\n}\n\nexport function authConfigured(): boolean {\n return Boolean(ACCESS_CODE && BRIDGE_KEY);\n}\n\nexport function validAccessCode(value: string): boolean {\n return Boolean(ACCESS_CODE) && safeEqual(value, ACCESS_CODE);\n}\n\nexport async function loginRetryAfter(req: Request): Promise {\n const [, state] = await attemptFor(req);\n return Math.max(0, Math.ceil((state.blockedUntil - Date.now()) / 1000));\n}\n\nexport async function recordLoginFailure(req: Request): Promise {\n const [key, state] = await attemptFor(req);\n state.count += 1;\n if (state.count >= MAX_FAILURES) state.blockedUntil = Date.now() + WINDOW_MS;\n attempts.set(key, state);\n await new Promise((resolve) => setTimeout(resolve, 450));\n return Math.max(0, Math.ceil((state.blockedUntil - Date.now()) / 1000));\n}\n\nexport async function clearLoginFailures(req: Request): Promise {\n attempts.delete(await clientKey(req));\n}\n\nexport function sameOrigin(req: Request): boolean {\n const target = new URL(req.url);\n const origin = req.headers.get(\"origin\");\n try {\n if (origin && origin !== \"null\") return new URL(origin).origin === target.origin;\n } catch {\n return false;\n }\n\n const referer = req.headers.get(\"referer\");\n if (referer) {\n try {\n const ref = new URL(referer);\n if (ref.origin === target.origin) return true;\n if (ref.hostname === \"val.town\" || ref.hostname.endsWith(\".val.town\")) return true;\n } catch {\n return false;\n }\n }\n\n const site = req.headers.get(\"sec-fetch-site\") || \"\";\n const mode = req.headers.get(\"sec-fetch-mode\") || \"\";\n return [\"same-origin\", \"same-site\", \"none\"].includes(site) && [\"navigate\", \"cors\", \"same-origin\"].includes(mode);\n}\n\nexport async function issueSession(): Promise<{ session: Session; cookie: string }> {\n const now = Date.now();\n const session: Session = {\n v: 2,\n iat: now,\n exp: now + SESSION_TTL_MS,\n nonce: crypto.randomUUID(),\n csrf: crypto.randomUUID(),\n };\n const payload = base64url(encoder.encode(JSON.stringify(session)));\n const token = `${payload}.${await signature(payload)}`;\n return {\n session,\n cookie: `${COOKIE}=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=${Math.floor(SESSION_TTL_MS / 1000)}`,\n };\n}\n\nexport async function getSession(req: Request): Promise {\n if (!authConfigured()) return null;\n const token = cookies(req)[COOKIE] || \"\";\n const [payload, provided, extra] = token.split(\".\");\n if (!payload || !provided || extra || !safeEqual(provided, await signature(payload))) return null;\n try {\n const session = JSON.parse(decoder.decode(decode64url(payload))) as Session;\n const now = Date.now();\n if (session.v !== 2 || !session.csrf || !session.nonce || session.iat > now + 30_000 || session.exp <= now) return null;\n return session;\n } catch {\n return null;\n }\n}\n\nexport function validCsrf(req: Request, session: Session): boolean {\n return sameOrigin(req) && safeEqual(req.headers.get(\"x-csrf-token\") || \"\", session.csrf);\n}\n\nexport function expiredCookie(): string {\n return `${COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`;\n}\n",[],[440,471],"d64050c9-d4e0-4b91-9bfa-bd57816ce5a5","api.ts","019f4ede-039a-7424-b93f-ef1fe57ad245",["D",1783734600613],"export type ApiResult> = T & { ok?: boolean; error?: string };\n\nconst BASE = (Deno.env.get(\"PISCINE_N8N_BASE\") || \"\").replace(/\\/$/, \"\");\nconst BRIDGE_KEY = Deno.env.get(\"PISCINE_BRIDGE_KEY\") || \"\";\nconst INTERNAL_PATH = (Deno.env.get(\"PISCINE_N8N_INTERNAL_PATH\") || \"\").trim();\nconst AI_PATH = `${Deno.env.get(\"PISCINE_AI_PATH_A\") || \"\"}${Deno.env.get(\"PISCINE_AI_PATH_B\") || \"\"}`;\n\nconst ACTION_MAP: Record = {\n \"client.create\": \"create_lead\",\n \"client.context\": \"client_context\",\n \"availability.check\": \"check_availability\",\n \"rdv.create\": \"book_appointment\",\n \"devis.create\": \"create_quote\",\n \"knowledge.lookup\": \"knowledge_lookup\",\n \"next.action\": \"next_best_action\",\n};\n\nfunction errorCode(value: unknown, fallback: string): string {\n const text = String(value || fallback).slice(0, 120);\n return /^[a-z0-9_:-]+$/i.test(text) ? text : fallback;\n}\n\nasync function fetchJson(url: string, init: RequestInit, timeoutMs = 10_000): Promise> {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), timeoutMs);\n try {\n const response = await fetch(url, { ...init, signal: controller.signal });\n const raw = (await response.text()).slice(0, 100_000);\n let payload: any = {};\n try {\n payload = raw ? JSON.parse(raw) : {};\n } catch {\n throw new Error(\"invalid_upstream_json\");\n }\n if (!response.ok || payload?.ok === false) throw new Error(errorCode(payload?.error || payload?.code, `upstream_${response.status}`));\n return payload as ApiResult;\n } finally {\n clearTimeout(timer);\n }\n}\n\nexport function integrationConfig() {\n return {\n businessApi: Boolean(BASE && BRIDGE_KEY),\n actionApi: Boolean(BASE && INTERNAL_PATH && BRIDGE_KEY),\n aiApi: Boolean(BASE && BRIDGE_KEY && AI_PATH),\n securityApi: Boolean(BASE && BRIDGE_KEY),\n };\n}\n\nexport async function cockpitApi>(action: string, data: Record = {}): Promise> {\n if (!BASE || !BRIDGE_KEY) throw new Error(\"cockpit_gateway_not_configured\");\n return fetchJson(`${BASE}/webhook/secretariat-pisciniste-cockpit-api-v1`, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-piscine-key\": BRIDGE_KEY,\n \"x-piscine-source\": \"valtown-cockpit\",\n \"x-request-id\": crypto.randomUUID(),\n },\n body: JSON.stringify({ action, data }),\n });\n}\n\nexport async function cockpitAction>(action: string, data: Record = {}): Promise> {\n if (!BASE || !INTERNAL_PATH || !BRIDGE_KEY) throw new Error(\"cockpit_action_gateway_not_configured\");\n const mapped = ACTION_MAP[action];\n if (!mapped) throw new Error(\"unsupported_cockpit_action\");\n\n const customerPhone = String(data.telephone ?? data.customer_phone ?? \"\").trim();\n const explicit = data.explicit_confirmation === true || data.explicit_confirmation === \"true\" || data.explicit_confirmation === \"on\";\n const businessData = {\n ...data,\n customer_name: data.nom ?? data.customer_name ?? \"\",\n customer_phone: customerPhone,\n address: data.adresse ?? data.address ?? \"\",\n city: data.ville ?? data.city ?? \"\",\n pool_type: data.type_bassin ?? data.pool_type ?? \"\",\n problem: data.objet ?? data.description ?? data.problem ?? \"\",\n intent: data.intent ?? \"autre\",\n urgency: data.urgence ?? \"normale\",\n appointment_datetime: data.date_heure ?? data.appointment_datetime ?? \"\",\n explicit_confirmation: explicit,\n };\n\n return fetchJson(`${BASE}/webhook/${INTERNAL_PATH}`, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-piscine-key\": BRIDGE_KEY,\n \"x-piscine-source\": \"valtown-cockpit\",\n \"x-request-id\": crypto.randomUUID(),\n },\n body: JSON.stringify({\n args: { action: mapped, data: businessData },\n call: { call_id: `cockpit-${crypto.randomUUID()}`, from_number: customerPhone },\n }),\n }, 12_000);\n}\n\nexport async function aiSupervision>(): Promise> {\n if (!BASE || !BRIDGE_KEY || !AI_PATH) throw new Error(\"ai_supervision_gateway_not_configured\");\n return fetchJson(`${BASE}/webhook/${AI_PATH}`, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-piscine-key\": BRIDGE_KEY,\n \"x-piscine-source\": \"valtown-cockpit\",\n \"x-request-id\": crypto.randomUUID(),\n },\n body: JSON.stringify({ action: \"supervision.snapshot\" }),\n });\n}\n\nexport async function securityAudit>(): Promise> {\n if (!BASE || !BRIDGE_KEY) throw new Error(\"security_audit_gateway_not_configured\");\n return fetchJson(`${BASE}/webhook/secretariat-pisciniste-security-audit-v1`, {\n method: \"POST\",\n headers: {\n \"content-type\": \"application/json\",\n \"x-piscine-key\": BRIDGE_KEY,\n \"x-piscine-source\": \"valtown-cockpit\",\n \"x-request-id\": crypto.randomUUID(),\n },\n body: \"{}\",\n });\n}\n",[],[440,478],"d1af853b-38c1-4f25-9ae0-d695c746c720",["D",1783734600613],"directory",[454,455,456],[440],["D",1783720739803],["D",1789526460011],{"_11":12,"_128":74},{"_11":12,"_123":124,"_73":74,"_30":72,"_125":126,"_127":24},{"_38":39,"_13":16,"_32":35,"_114":76,"_115":62,"_116":117,"_118":80,"_119":76,"_120":41,"_121":14,"_122":12},"ctx",{"_51":-5,"_148":527,"_528":529,"_530":531,"_532":24,"_533":24,"_534":24,"_535":88,"_536":-5,"_537":-7,"_538":-7,"_539":26,"_540":24,"_541":24,"_542":-5,"_543":24,"_544":24,"_545":24,"_546":-5},"ENV",{"_498":499,"_500":501,"_502":63,"_503":504,"_505":506,"_507":508,"_509":510,"_511":512,"_513":514,"_515":516,"_517":518,"_519":520,"_521":522,"_523":524,"_525":526},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · ui.ts