[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_349":350,"_351":352},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_107":89,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",785,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","auth.ts","latestPath","fileId","5b71deae-47d9-11f1-b7ca-42b51c65c3df","name","fileType","script","content","// auth.ts — HMAC, CORS, rate limiting\n\nimport { WIDGET_SECRET, TOKEN_TTL, ALLOWED_ORIGINS } from \"./config.ts\";\n\n// --- Headers sécurité / CORS ---\n\nexport function securityHeaders(h: Headers = new Headers()): Headers {\n h.set(\"X-Content-Type-Options\", \"nosniff\");\n h.set(\"Referrer-Policy\", \"no-referrer\");\n return h;\n}\n\nexport function corsHeaders(origin: string | null = null): Headers {\n const h = securityHeaders(new Headers());\n if (origin && ALLOWED_ORIGINS.includes(origin)) {\n h.set(\"Access-Control-Allow-Origin\", origin);\n h.set(\"Vary\", \"Origin\");\n }\n h.set(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n h.set(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization\");\n return h;\n}\n\nexport function jsonResp(data: unknown, status = 200, origin: string | null = null): Response {\n const h = corsHeaders(origin);\n h.set(\"Content-Type\", \"application/json; charset=utf-8\");\n return new Response(JSON.stringify(data), { status, headers: h });\n}\n\n// --- HMAC ---\n\nexport async function verifyToken(uid: string | null, token: string | null): Promise {\n // Mode développement uniquement : en production WIDGET_SECRET doit être défini.\n if (!WIDGET_SECRET) return true;\n if (!token) return false;\n const colon = token.indexOf(\":\");\n if (colon === -1) return false;\n const tsStr = token.slice(0, colon);\n const sig = token.slice(colon + 1);\n const ts = parseInt(tsStr, 10);\n if (isNaN(ts)) return false;\n const age = Math.floor(Date.now() / 1000) - ts;\n if (age < 0 || age > TOKEN_TTL) return false;\n try {\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(WIDGET_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\n );\n const sigBytes = await crypto.subtle.sign(\n \"HMAC\", key, new TextEncoder().encode(`${uid ?? \"\"}:${tsStr}`)\n );\n const expected = Array.from(new Uint8Array(sigBytes))\n .map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n return sig === expected;\n } catch { return false; }\n}\n\n// --- Rate limiting (fenêtre glissante en mémoire) ---\n\nconst RATE_LIMIT_WINDOW_MS = 60_000;\nconst RATE_LIMIT_MAX = 10;\nconst rateMap = new Map();\n\nexport function checkRateLimit(userId: string | null): boolean {\n const key = userId ?? \"anonymous\";\n const now = Date.now();\n const times = (rateMap.get(key) ?? []).filter(t => now - t < RATE_LIMIT_WINDOW_MS);\n if (times.length >= RATE_LIMIT_MAX) return false;\n times.push(now);\n rateMap.set(key, times);\n return true;\n}\n","// auth.ts — HMAC, CORS, rate limiting\n\nimport {\n ALLOW_DEV_AUTH_BYPASS,\n ALLOWED_ORIGINS,\n TOKEN_TTL,\n WIDGET_SECRET,\n} from \"./config.ts\";\n\n// --- CORS ---\n\nexport function corsHeaders(origin: string | null = null): Headers {\n const h = new Headers();\n if (origin && ALLOWED_ORIGINS.includes(origin)) {\n h.set(\"Access-Control-Allow-Origin\", origin);\n h.set(\"Vary\", \"Origin\");\n }\n h.set(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n h.set(\"Access-Control-Allow-Headers\", \"Content-Type\");\n return h;\n}\n\nexport function jsonResp(data: unknown, status = 200, origin: string | null = null): Response {\n const h = corsHeaders(origin);\n h.set(\"Content-Type\", \"application/json\");\n return new Response(JSON.stringify(data), { status, headers: h });\n}\n\n// --- HMAC ---\n\nexport async function verifyToken(uid: string | null, token: string | null): Promise {\n // Sécurité : l'auth doit échouer fermée si WIDGET_SECRET est absent.\n // Le bypass sans secret est réservé au développement local et doit être explicitement activé.\n if (!WIDGET_SECRET) return ALLOW_DEV_AUTH_BYPASS;\n\n if (!token) return false;\n const colon = token.indexOf(\":\");\n if (colon === -1) return false;\n const tsStr = token.slice(0, colon);\n const sig = token.slice(colon + 1);\n const ts = parseInt(tsStr, 10);\n if (isNaN(ts)) return false;\n const age = Math.floor(Date.now() / 1000) - ts;\n if (age < 0 || age > TOKEN_TTL) return false;\n try {\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(WIDGET_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\n );\n const sigBytes = await crypto.subtle.sign(\n \"HMAC\", key, new TextEncoder().encode(`${uid ?? \"\"}:${tsStr}`)\n );\n const expected = Array.from(new Uint8Array(sigBytes))\n .map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n return sig === expected;\n } catch { return false; }\n}\n\n// --- Rate limiting (fenêtre glissante en mémoire) ---\n\nconst RATE_LIMIT_WINDOW_MS = 60_000;\nconst RATE_LIMIT_MAX = 10;\nconst rateMap = new Map();\n\nexport function checkRateLimit(userId: string | null): boolean {\n const key = userId ?? \"anonymous\";\n const now = Date.now();\n const times = (rateMap.get(key) ?? []).filter(t => now - t < RATE_LIMIT_WINDOW_MS);\n if (times.length >= RATE_LIMIT_MAX) return false;\n times.push(now);\n rateMap.set(key, times);\n return true;\n}\n","createdAt",["D",1779207811562],"branchVersion","branchId","76b32436-3fcb-11f1-bb81-42b51c65c3df","id","76b24c50-3fcb-11f1-bb81-42b51c65c3df","Dust-ChatBot",["D",1777027852749],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","019a1669-b237-742d-9576-26bd8101a3da","pinnedFileId","e849c87c-4217-11f1-8534-42b51c65c3df","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019a1669-b237-742d-9576-2af7ebcdd860","tursoName","76b24c503fcb11f1bb8142b51c65c3df","tursoHostname","76b24c503fcb11f1bb8142b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789579303050],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",878,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","beFlow","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzM0VnhaV2Y1amtBRnpzSkUzWE1GRFB2ZVpUcSJ9","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":344,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":-5,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":345,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":346,"_83":347,"_85":348,"_87":25},"tree",[279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294],"files",[279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294],"counts",{"_268":62,"_269":270,"_271":62,"_272":273,"_274":275},"contents",[129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":260,"_32":261,"_30":262,"_147":-5,"_41":42,"_40":263,"_149":25,"_38":264,"_13":265,"_33":20,"_35":266,"_24":25,"_154":-5,"_27":267},{"_43":256,"_32":28,"_30":31,"_147":-5,"_41":42,"_40":14,"_149":25,"_38":257,"_13":258,"_33":34,"_35":37,"_24":25,"_154":-5,"_27":259},{"_43":248,"_32":249,"_30":250,"_147":-5,"_41":42,"_40":251,"_149":25,"_38":252,"_13":253,"_33":34,"_35":254,"_24":25,"_154":-5,"_27":255},{"_43":240,"_32":241,"_30":242,"_147":-5,"_41":42,"_40":243,"_149":25,"_38":244,"_13":245,"_33":34,"_35":246,"_24":25,"_154":-5,"_27":247},{"_43":232,"_32":233,"_30":234,"_147":-5,"_41":42,"_40":235,"_149":25,"_38":236,"_13":237,"_33":152,"_35":238,"_24":25,"_154":-5,"_27":239},{"_43":224,"_32":225,"_30":226,"_147":-5,"_41":42,"_40":227,"_149":25,"_38":228,"_13":229,"_33":34,"_35":230,"_24":25,"_154":-5,"_27":231},{"_43":218,"_32":219,"_30":220,"_147":-5,"_41":42,"_40":167,"_149":58,"_38":221,"_13":62,"_33":34,"_35":222,"_24":25,"_154":-5,"_27":223},{"_43":210,"_32":211,"_30":212,"_147":-5,"_41":42,"_40":213,"_149":25,"_38":214,"_13":215,"_33":34,"_35":216,"_24":25,"_154":-5,"_27":217},{"_43":203,"_32":204,"_30":205,"_147":-5,"_41":42,"_40":167,"_149":58,"_38":206,"_13":207,"_33":152,"_35":208,"_24":25,"_154":-5,"_27":209},{"_43":195,"_32":196,"_30":197,"_147":-5,"_41":42,"_40":198,"_149":58,"_38":199,"_13":200,"_33":152,"_35":201,"_24":25,"_154":-5,"_27":202},{"_43":187,"_32":188,"_30":189,"_147":-5,"_41":42,"_40":190,"_149":58,"_38":191,"_13":192,"_33":34,"_35":193,"_24":25,"_154":-5,"_27":194},{"_43":179,"_32":180,"_30":181,"_147":-5,"_41":42,"_40":182,"_149":25,"_38":183,"_13":184,"_33":152,"_35":185,"_24":25,"_154":-5,"_27":186},{"_43":171,"_32":172,"_30":173,"_147":-5,"_41":42,"_40":174,"_149":58,"_38":175,"_13":176,"_33":34,"_35":177,"_24":25,"_154":-5,"_27":178},{"_43":164,"_32":165,"_30":166,"_147":-5,"_41":42,"_40":167,"_149":25,"_38":168,"_13":62,"_33":152,"_35":169,"_24":25,"_154":-5,"_27":170},{"_43":156,"_32":157,"_30":158,"_147":-5,"_41":42,"_40":159,"_149":58,"_38":160,"_13":161,"_33":34,"_35":162,"_24":25,"_154":-5,"_27":163},{"_43":145,"_32":146,"_30":56,"_147":-5,"_41":42,"_40":148,"_149":25,"_38":150,"_13":151,"_33":152,"_35":153,"_24":25,"_154":-5,"_27":155},"fecbdc80-537d-11f1-90bf-ee650bb23af1","widget.ts","parentId",752,"latest",["D",1779193603584],70,"http","// widget.ts — Sert le JS du widget comme fichier statique (HTTP handler)\n// v4.60 — protocole assistant-* uniquement, libellés de production nettoyés\n\nexport default function (_req: Request): Response {\n const js = `(function(){\n if(window.__AssistantChatLoaded)return;window.__AssistantChatLoaded=true;\n var CHAT_URL=\"https://beFlow--76b6689e3fcb11f1bb8142b51c65c3df.web.val.run\";\n var CHAT_ORIGIN=(function(){try{return new URL(CHAT_URL).origin;}catch(e){return CHAT_URL;}})();\n var isOpen=false,isExpanded=false,iframe=null,badge=null,previousBodyOverflow=\"\";\n var currentScript=document.currentScript||(function(){var s=document.getElementsByTagName('script');return s[s.length-1];})();\n var uid=currentScript?currentScript.getAttribute('data-uid'):null;\n var token=currentScript?currentScript.getAttribute('data-token'):null;\n var badgeVal=currentScript?currentScript.getAttribute('data-badge'):null;\n var label=currentScript?currentScript.getAttribute('data-label'):null;\n var tooltipTx=currentScript?currentScript.getAttribute('data-tooltip'):null;\n var accent=currentScript?currentScript.getAttribute('data-color'):null;\n var autoOpen=currentScript?currentScript.getAttribute('data-open'):null;\n label=label||\"Ouvrir l'assistant\";tooltipTx=tooltipTx||label;accent=accent||'#1d4ed8';\n function buildSrc(){return uid?CHAT_URL+'?uid='+encodeURIComponent(uid):CHAT_URL;}\n function postAuth(){if(iframe&&iframe.contentWindow&&token){iframe.contentWindow.postMessage({type:'assistant-auth',uid:uid,token:token},CHAT_ORIGIN);}}\n var SIZE_NORMAL={w:'400px',h:'min(600px, calc(100dvh - 112px))',b:'92px',r:'20px'};\n var SIZE_EXPANDED={w:'min(780px, 90vw)',h:'calc(100dvh - 112px)',b:'92px',r:'20px'};\n function applySize(s){panel.style.width=s.w;panel.style.height=s.h;panel.style.bottom=s.b;panel.style.right=s.r;}\n function isMobile(){return window.matchMedia&&window.matchMedia('(max-width: 500px)').matches;}\n var overlay=document.createElement('div');overlay.id='assistant-chat-overlay';overlay.style.cssText='position:fixed;inset:0;background:rgba(15,23,42,.34);backdrop-filter:blur(1px);z-index:99998;display:none;opacity:0;transition:opacity .32s ease';overlay.addEventListener('click',close);\n var panel=document.createElement('div');panel.id='assistant-chat-panel';panel.setAttribute('role','dialog');panel.setAttribute('aria-modal','true');panel.setAttribute('aria-label','Assistant documentaire');panel.style.cssText='position:fixed;border-radius:18px;overflow:hidden;box-shadow:0 24px 80px rgba(15,23,42,.32),0 4px 18px rgba(15,23,42,.16);z-index:99999;display:none;opacity:0;transform:translateY(10px) scale(.985);transition:opacity .34s cubic-bezier(.2,.8,.2,1),transform .34s cubic-bezier(.2,.8,.2,1),width .28s ease,height .28s ease,bottom .28s ease;background:#f9fafb;border:none;outline:none';applySize(SIZE_NORMAL);\n var loader=document.createElement('div');loader.id='assistant-chat-loader';loader.style.cssText='position:absolute;inset:0;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:10px;background:#f8fafc;color:#475569;font:12px system-ui,-apple-system,sans-serif;z-index:1';loader.innerHTML='

Chargement de l’assistant…

';panel.appendChild(loader);\n function ensureIframe(){if(iframe){postAuth();return;}iframe=document.createElement('iframe');iframe.src=buildSrc();iframe.title='Assistant documentaire';iframe.style.cssText='width:100%;height:100%;border:none;position:relative;z-index:2;background:transparent';iframe.setAttribute('allow','clipboard-write');iframe.addEventListener('load',function(){loader.style.display='none';postAuth();});panel.appendChild(iframe);}\n var btn=document.createElement('button');btn.id='assistant-chat-btn';btn.type='button';btn.setAttribute('aria-label',label);btn.setAttribute('aria-expanded','false');btn.innerHTML='';btn.style.cssText='position:fixed;bottom:calc(20px + env(safe-area-inset-bottom,0px));right:calc(20px + env(safe-area-inset-right,0px));width:58px;height:58px;border-radius:50%;border:none;background:'+accent+';display:flex;align-items:center;justify-content:center;cursor:pointer;z-index:100000;outline:none;animation:assistant-pulse 2.2s ease-out infinite;box-shadow:0 10px 26px rgba(29,78,216,.34);transition:transform .16s ease,box-shadow .16s ease,background .16s ease';\n if(badgeVal!==null&&badgeVal!==''){badge=document.createElement('span');badge.textContent=badgeVal;badge.style.cssText='position:absolute;top:-2px;right:-2px;min-width:20px;height:20px;padding:0 5px;border-radius:999px;background:#ef4444;color:#fff;font:700 11px system-ui,sans-serif;display:flex;align-items:center;justify-content:center;box-shadow:0 2px 6px rgba(0,0,0,.22);transition:transform .2s,opacity .2s';btn.appendChild(badge);}\n var tooltip=document.createElement('div');tooltip.id='assistant-chat-tooltip';tooltip.textContent=tooltipTx;tooltip.style.cssText='position:fixed;bottom:calc(88px + env(safe-area-inset-bottom,0px));right:calc(20px + env(safe-area-inset-right,0px));background:#111827;color:#fff;font:12px system-ui,-apple-system,sans-serif;padding:8px 13px;border-radius:10px;box-shadow:0 8px 22px rgba(0,0,0,.18);z-index:99999;opacity:0;transform:translateY(4px);transition:opacity .22s,transform .22s;pointer-events:none;white-space:nowrap';\n var style=document.createElement('style');style.textContent='@keyframes assistant-pulse{0%{box-shadow:0 10px 26px rgba(29,78,216,.34),0 0 0 0 rgba(29,78,216,.45)}65%{box-shadow:0 10px 26px rgba(29,78,216,.34),0 0 0 18px rgba(29,78,216,0)}100%{box-shadow:0 10px 26px rgba(29,78,216,.34),0 0 0 0 rgba(29,78,216,0)}}@keyframes assistant-spin{to{transform:rotate(360deg)}}#assistant-chat-btn .assistant-ico-chat{width:27px;height:27px;transition:transform .22s,opacity .18s}#assistant-chat-btn .assistant-ico-close{width:22px;height:22px;position:absolute;opacity:0;transform:rotate(-90deg);transition:transform .22s,opacity .18s}#assistant-chat-btn.assistant-open .assistant-ico-chat{opacity:0;transform:rotate(90deg)}#assistant-chat-btn.assistant-open .assistant-ico-close{opacity:1;transform:rotate(0)}#assistant-chat-btn.assistant-open{animation:none!important;box-shadow:0 10px 28px rgba(29,78,216,.38)}#assistant-chat-btn:hover{transform:scale(1.06)}#assistant-chat-btn:active{transform:scale(.96)}#assistant-chat-btn:focus-visible{box-shadow:0 0 0 4px rgba(59,130,246,.22),0 10px 28px rgba(29,78,216,.38)}@media(max-width:500px){#assistant-chat-overlay{background:rgba(15,23,42,.26)!important}#assistant-chat-panel{bottom:0!important;right:0!important;left:0!important;width:100%!important;height:100dvh!important;border-radius:0!important;border:none!important;box-shadow:none!important}#assistant-chat-btn.assistant-open{bottom:calc(12px + env(safe-area-inset-bottom,0px))!important;right:calc(12px + env(safe-area-inset-right,0px))!important;width:50px!important;height:50px!important}#assistant-chat-tooltip{display:none!important}}@media(prefers-reduced-motion:reduce){#assistant-chat-btn{animation:none!important}#assistant-chat-panel,#assistant-chat-btn,#assistant-chat-overlay,.assistant-ico-chat,.assistant-ico-close,#assistant-chat-tooltip{transition:none!important}}';\n function hideTooltip(){tooltip.style.opacity='0';tooltip.style.transform='translateY(4px)';}\n function showTooltip(){if(!isOpen){tooltip.style.opacity='1';tooltip.style.transform='translateY(0)';}}\n function open(){if(isOpen)return;isOpen=true;ensureIframe();if(badge){badge.style.transform='scale(0)';badge.style.opacity='0';}hideTooltip();previousBodyOverflow=document.body.style.overflow||'';document.body.style.overflow='hidden';overlay.style.display='block';panel.style.display='block';requestAnimationFrame(function(){requestAnimationFrame(function(){overlay.style.opacity='1';panel.style.opacity='1';panel.style.transform='translateY(0) scale(1)';});});btn.classList.add('assistant-open');btn.setAttribute('aria-expanded','true');}\n function close(){if(!isOpen)return;isOpen=false;isExpanded=false;applySize(SIZE_NORMAL);overlay.style.opacity='0';panel.style.opacity='0';panel.style.transform='translateY(10px) scale(.985)';btn.classList.remove('assistant-open');btn.setAttribute('aria-expanded','false');document.body.style.overflow=previousBodyOverflow;setTimeout(function(){if(!isOpen){overlay.style.display='none';panel.style.display='none';}},360);}\n function toggleExpand(){if(isMobile())return;isExpanded=!isExpanded;applySize(isExpanded?SIZE_EXPANDED:SIZE_NORMAL);}\n function toggle(){isOpen?close():open();}\n btn.addEventListener('click',toggle);overlay.addEventListener('click',close);window.addEventListener('message',function(e){if(e.origin!==CHAT_ORIGIN||!e.data||typeof e.data.type!=='string')return;switch(e.data.type){case 'assistant-minimize':close();break;case 'assistant-expand':toggleExpand();break;case 'assistant-ready':postAuth();break;}});document.addEventListener('keydown',function(e){if(e.key==='Escape'&&isOpen)close();});window.addEventListener('resize',function(){if(isOpen)applySize(isExpanded&&!isMobile()?SIZE_EXPANDED:SIZE_NORMAL);});\n setTimeout(function(){var seen=false;try{seen=localStorage.getItem('assistant_chat_tip_seen')==='1';}catch(e){}if(!seen&&!isOpen){showTooltip();setTimeout(hideTooltip,5200);try{localStorage.setItem('assistant_chat_tip_seen','1');}catch(e){}}},1600);btn.addEventListener('mouseenter',showTooltip);btn.addEventListener('mouseleave',hideTooltip);btn.addEventListener('focus',showTooltip);btn.addEventListener('blur',hideTooltip);\n window.AssistantChatWidget={open:open,close:close,toggle:toggle,expand:function(){if(!isOpen)open();if(!isExpanded)toggleExpand();},minimize:close};\n document.body.appendChild(style);document.body.appendChild(overlay);document.body.appendChild(tooltip);document.body.appendChild(panel);document.body.appendChild(btn);if(autoOpen==='1'||autoOpen==='true')setTimeout(open,300);\n})();`;\n return new Response(js, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Cache-Control\": \"no-cache, no-store, must-revalidate\",\n },\n });\n}\n","label",[146],"3cfb5972-4d4d-11f1-be67-ee650bb23af1","supabase.ts","5b4362ea-47d9-11f1-a4d5-42b51c65c3df",421,["D",1778512955585],19,"// supabase.ts — Logging et feedback\n\nimport {\n DUST_API_KEY,\n DUST_BASE,\n SUPABASE_KEY,\n SUPABASE_URL,\n VERSION,\n WORKSPACE_ID,\n} from \"./config.ts\";\nimport { extractAgentModel, extractAgentVersion } from \"./dust.ts\";\n\nfunction sbHeaders(): Record {\n return {\n \"Content-Type\": \"application/json\",\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": \"Bearer \" + SUPABASE_KEY,\n \"Prefer\": \"return=minimal\",\n };\n}\n\nexport interface LogExtras {\n action?: string;\n char_count?: number;\n origin?: string | null;\n responseTimeMs?: number | null;\n model?: string | null;\n // version de l'agent Dust (extraite de l'avertissement).\n // undefined = non fourni → fallback VERSION seulement pour les réponses agent\n // null = non trouvé dans la réponse agent → \"N/A\"\n // string = version extraite, ex: \"v2.7.14\"\n version?: string | null;\n}\n\nexport interface FeedbackExtras {\n version?: string | null;\n model?: string | null;\n}\n\nfunction cleanMeta(v: unknown): string | null {\n if (v == null) return null;\n const s = String(v).trim();\n return s ? s : null;\n}\n\nfunction rawFromAgentMsg(agentMsg: any): string {\n if (typeof agentMsg?.content === \"string\") return agentMsg.content;\n if (Array.isArray(agentMsg?.content)) {\n return agentMsg.content\n .filter((b: any) => b?.type === \"text\")\n .map((b: any) => b.text ?? \"\")\n .join(\"\");\n }\n if (Array.isArray(agentMsg?.rawContents)) {\n return agentMsg.rawContents.map((b: any) => b?.content ?? \"\").join(\"\");\n }\n return \"\";\n}\n\nasync function lookupDustMeta(\n conversationId: string | null,\n messageId: string | null,\n): Promise {\n if (!DUST_API_KEY || !DUST_BASE || !WORKSPACE_ID || !conversationId) return {};\n try {\n const r = await fetch(\n `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations/${conversationId}`,\n { headers: { \"Authorization\": \"Bearer \" + DUST_API_KEY }, signal: AbortSignal.timeout(8_000) },\n );\n if (!r.ok) return {};\n const data = await r.json().catch(() => ({}));\n const groups: any[][] = data.conversation?.content ?? [];\n const agentMessages = groups\n .flatMap((g: any) => Array.isArray(g) ? g : [])\n .filter((m: any) => m?.type === \"agent_message\");\n const agentMsg = messageId\n ? agentMessages.find((m: any) => m?.sId === messageId)\n : agentMessages[agentMessages.length - 1];\n if (!agentMsg) return {};\n const raw = rawFromAgentMsg(agentMsg);\n return {\n version: cleanMeta(extractAgentVersion(raw)),\n model: cleanMeta(extractAgentModel(agentMsg)),\n };\n } catch {\n return {};\n }\n}\n\nasync function lookupLogMeta(\n messageId: string | null,\n conversationId: string | null,\n): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY) return {};\n try {\n const filter = messageId\n ? `message_id=eq.${encodeURIComponent(messageId)}`\n : conversationId\n ? `conversation_id=eq.${encodeURIComponent(conversationId)}&direction=eq.agent&order=ts.desc`\n : \"\";\n if (!filter) return {};\n const r = await fetch(\n `${SUPABASE_URL}/rest/v1/ge_logs?select=version,model&${filter}&limit=1`,\n { headers: { \"apikey\": SUPABASE_KEY, \"Authorization\": \"Bearer \" + SUPABASE_KEY }, signal: AbortSignal.timeout(5_000) },\n );\n if (!r.ok) return {};\n const rows = await r.json().catch(() => []);\n return {\n version: cleanMeta(rows?.[0]?.version),\n model: cleanMeta(rows?.[0]?.model),\n };\n } catch {\n return {};\n }\n}\n\nasync function patchLogMeta(\n messageId: string | null,\n meta: FeedbackExtras,\n): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY || !messageId) return;\n const payload: Record = {};\n if (meta.version !== undefined) payload.version = meta.version ?? null;\n if (meta.model !== undefined) payload.model = meta.model ?? null;\n if (!Object.keys(payload).length) return;\n try {\n await fetch(\n `${SUPABASE_URL}/rest/v1/ge_logs?message_id=eq.${encodeURIComponent(messageId)}`,\n { method: \"PATCH\", headers: sbHeaders(), body: JSON.stringify(payload), signal: AbortSignal.timeout(5_000) },\n );\n } catch { /* non bloquant */ }\n}\n\nexport async function logMsg(\n userId: string | null,\n convId: string | null,\n msgId: string | null,\n direction: \"user\" | \"agent\",\n content: string,\n extras: LogExtras = {}\n): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY) return;\n try {\n let model = cleanMeta(extras.model);\n let version: string | null = null;\n\n if (direction === \"agent\") {\n if (extras.version !== undefined) version = cleanMeta(extras.version) ?? \"N/A\";\n else version = VERSION;\n\n // Si main.ts ne fournit pas encore le modèle, on le récupère en best-effort depuis Dust.\n if (!model && convId) {\n const dustMeta = await lookupDustMeta(convId, msgId);\n model = dustMeta.model ?? null;\n if ((version === VERSION || version === \"N/A\") && dustMeta.version) version = dustMeta.version;\n }\n }\n\n const payload: Record = {\n ts: new Date().toISOString(),\n user_id: userId ?? \"anonymous\",\n conversation_id: convId ?? null,\n message_id: msgId ?? null,\n direction,\n content,\n version: direction === \"agent\" ? version : null,\n model: direction === \"agent\" ? model : null,\n action: extras.action ?? null,\n char_count: extras.char_count ?? content.length,\n origin: extras.origin ?? null,\n };\n if (extras.responseTimeMs != null) payload.response_time_ms = extras.responseTimeMs;\n const r = await fetch(`${SUPABASE_URL}/rest/v1/ge_logs`, {\n method: \"POST\", headers: sbHeaders(), body: JSON.stringify(payload),\n });\n if (!r.ok) console.error(\"ge_logs:\", r.status, await r.text());\n } catch(e) { console.error(\"ge_logs:\", String(e)); }\n}\n\n// ── deleteMsg ─────────────────────────────────────────────────────────────\nexport async function deleteMsg(messageId: string | null): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY || !messageId) return;\n try {\n await fetch(\n `${SUPABASE_URL}/rest/v1/ge_logs?message_id=eq.${encodeURIComponent(messageId)}`,\n { method: \"DELETE\", headers: sbHeaders(), signal: AbortSignal.timeout(5_000) }\n );\n } catch { /* non bloquant */ }\n}\n\n// ── deleteFeedback ────────────────────────────────────────────────────────\nexport async function deleteFeedback(messageId: string | null): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY || !messageId) return;\n try {\n await fetch(\n `${SUPABASE_URL}/rest/v1/ge_feedback?message_id=eq.${encodeURIComponent(messageId)}`,\n { method: \"DELETE\", headers: sbHeaders(), signal: AbortSignal.timeout(5_000) }\n );\n } catch { /* non bloquant */ }\n}\n\nexport async function saveFeedback(\n userId: string | null,\n conversationId: string | null,\n messageId: string | null,\n thumb: number | null,\n tags: string | null,\n comment: string | null,\n extras: FeedbackExtras = {},\n): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY) return \"SUPABASE_URL ou SUPABASE_KEY manquant\";\n try {\n const logMeta = await lookupLogMeta(messageId, conversationId);\n const needDust = (extras.version === undefined && !logMeta.version) || (extras.model === undefined && !logMeta.model);\n const dustMeta = needDust ? await lookupDustMeta(conversationId, messageId) : {};\n\n const version = extras.version !== undefined\n ? cleanMeta(extras.version)\n : logMeta.version ?? dustMeta.version ?? null;\n const model = extras.model !== undefined\n ? cleanMeta(extras.model)\n : logMeta.model ?? dustMeta.model ?? null;\n\n if ((dustMeta.version || dustMeta.model) && messageId) {\n await patchLogMeta(messageId, {\n version: logMeta.version ?? dustMeta.version ?? undefined,\n model: logMeta.model ?? dustMeta.model ?? undefined,\n });\n }\n\n const r = await fetch(`${SUPABASE_URL}/rest/v1/ge_feedback`, {\n method: \"POST\", headers: sbHeaders(),\n body: JSON.stringify({\n ts: new Date().toISOString(),\n user_id: userId ?? null,\n conversation_id: conversationId ?? null,\n message_id: messageId ?? null,\n thumb: thumb ?? null,\n tags: tags ?? null,\n comment: comment ?? null,\n version,\n model,\n }),\n });\n if (!r.ok) { const txt = await r.text(); return `Supabase ${r.status}: ${txt.slice(0, 120)}`; }\n return null;\n } catch(e) { return String(e); }\n}\n\n// Vérifie la connexion aux tables Supabase (utilisé par /dbcheck)\nexport async function checkSupabase(): Promise> {\n const tables = [\"ge_logs\", \"ge_feedback\"];\n const results: Record = {};\n for (const table of tables) {\n try {\n const r = await fetch(`${SUPABASE_URL}/rest/v1/${table}?limit=1&select=ts`, {\n headers: { \"apikey\": SUPABASE_KEY, \"Authorization\": \"Bearer \" + SUPABASE_KEY },\n });\n results[table] = r.ok ? \"ok\" : `erreur ${r.status}`;\n } catch(e) {\n results[table] = \"unreachable: \" + String(e);\n }\n }\n return results;\n}\n",[157],"c8c8fbc2-4ed7-11f1-beb2-ee650bb23af1","selftest.ts","c8c8fc4e-4ed7-11f1-beb2-ee650bb23af1",648,["D",1778682411837],"// selftest.ts — Tests read-only de non-régression\n// Endpoint protégé par DBCHECK_KEY. Ne modifie aucune donnée.\n\nimport {\n AGENT_ID,\n ALLOWED_ORIGINS,\n DBCHECK_KEY,\n DUST_API_KEY,\n SUPABASE_KEY,\n SUPABASE_URL,\n VERSION,\n WIDGET_SECRET,\n WORKSPACE_ID,\n} from \"./config.ts\";\n\nconst CHAT_URL = \"https://beFlow--76b6689e3fcb11f1bb8142b51c65c3df.web.val.run\";\nconst DASHBOARD_URL = \"https://beFlow--59f47d7e492411f1940f42b51c65c3df.web.val.run\";\nconst DBCHECK_URL = \"https://beFlow--92ae0bf2423b11f1961842b51c65c3df.web.val.run\";\n\ntype TestResult = {\n name: string;\n ok: boolean;\n status?: number;\n expected?: string;\n detail?: unknown;\n duration_ms: number;\n};\n\ntype ConfigChecks = {\n version_is_v5_1: boolean;\n widget_secret_configured: boolean;\n dbcheck_key_configured: boolean;\n allowed_origins_configured: boolean;\n dust_api_key_configured: boolean;\n workspace_id_configured: boolean;\n agent_id_configured: boolean;\n supabase_configured: boolean;\n};\n\nfunction headers(contentType = \"application/json; charset=utf-8\"): Headers {\n return new Headers({\n \"Content-Type\": contentType,\n \"Cache-Control\": \"no-store\",\n \"Referrer-Policy\": \"no-referrer\",\n \"X-Content-Type-Options\": \"nosniff\",\n });\n}\n\nfunction isAuthorized(req: Request, url: URL): boolean {\n const provided = url.searchParams.get(\"key\") ??\n req.headers.get(\"authorization\")?.replace(/^Bearer\\s+/i, \"\").trim() ??\n \"\";\n return !!DBCHECK_KEY && provided === DBCHECK_KEY;\n}\n\nfunction json(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data, null, 2), { status, headers: headers() });\n}\n\nfunction configChecks(): ConfigChecks {\n return {\n version_is_v5_1: VERSION === \"v5.1\",\n widget_secret_configured: !!WIDGET_SECRET,\n dbcheck_key_configured: !!DBCHECK_KEY,\n allowed_origins_configured: ALLOWED_ORIGINS.length > 0,\n dust_api_key_configured: !!DUST_API_KEY,\n workspace_id_configured: !!WORKSPACE_ID,\n agent_id_configured: !!AGENT_ID,\n supabase_configured: !!SUPABASE_URL && !!SUPABASE_KEY,\n };\n}\n\nfunction allConfigOk(config: ConfigChecks): boolean {\n return Object.values(config).every(Boolean);\n}\n\nasync function runTest(name: string, fn: () => Promise>): Promise {\n const start = Date.now();\n try {\n const r = await fn();\n return { name, duration_ms: Date.now() - start, ...r };\n } catch (e) {\n return { name, ok: false, detail: String(e), duration_ms: Date.now() - start };\n }\n}\n\nasync function readJson(res: Response): Promise {\n return await res.json().catch(async () => ({ raw: await res.text().catch(() => \"\") }));\n}\n\nexport default async function selftest(req: Request): Promise {\n const url = new URL(req.url);\n if (!isAuthorized(req, url)) {\n return json({ error: \"Non autorisé.\" }, 401);\n }\n\n const authHeaders = { \"Authorization\": \"Bearer \" + DBCHECK_KEY };\n const startedAt = new Date().toISOString();\n const config = configChecks();\n const configOk = allConfigOk(config);\n\n const tests: TestResult[] = [];\n\n tests.push(await runTest(\"chat.health\", async () => {\n const res = await fetch(`${CHAT_URL}/health?selftest=${Date.now()}`, { signal: AbortSignal.timeout(10_000) });\n const body = await readJson(res);\n return {\n ok: res.status === 200 && body?.ok === true && body?.version === VERSION,\n status: res.status,\n expected: `HTTP 200, ok=true, version=${VERSION}`,\n detail: { ok: body?.ok, version: body?.version, origins_configured: body?.origins_configured },\n };\n }));\n\n tests.push(await runTest(\"chat.page\", async () => {\n const res = await fetch(`${CHAT_URL}/?uid=selftest&t=${Date.now()}`, { signal: AbortSignal.timeout(10_000) });\n const text = await res.text();\n return {\n ok: res.status === 200 && text.includes(\"Assistant\"),\n status: res.status,\n expected: \"HTTP 200 et page HTML du chat servie\",\n detail: { content_type: res.headers.get(\"content-type\"), size: text.length },\n };\n }));\n\n tests.push(await runTest(\"chat.send_without_token\", async () => {\n const res = await fetch(CHAT_URL + \"/\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"send\", message: \"selftest\", userId: \"selftest-user\" }),\n signal: AbortSignal.timeout(10_000),\n });\n const body = await readJson(res);\n return {\n ok: res.status === 401,\n status: res.status,\n expected: \"HTTP 401\",\n detail: body,\n };\n }));\n\n tests.push(await runTest(\"chat.poll_without_token\", async () => {\n const res = await fetch(CHAT_URL + \"/\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ action: \"poll\", conversationId: \"fake-conv\", userId: \"selftest-user\" }),\n signal: AbortSignal.timeout(10_000),\n });\n const body = await readJson(res);\n return {\n ok: res.status === 401,\n status: res.status,\n expected: \"HTTP 401\",\n detail: body,\n };\n }));\n\n tests.push(await runTest(\"dbcheck.json\", async () => {\n const res = await fetch(`${DBCHECK_URL}?format=json&selftest=${Date.now()}`, {\n headers: authHeaders,\n signal: AbortSignal.timeout(15_000),\n });\n const body = await readJson(res);\n const schemaOk = Array.isArray(body?.schema) && body.schema.every((s: any) => s?.ok === true);\n return {\n ok: res.status === 200 && body?.ok === true && schemaOk,\n status: res.status,\n expected: \"HTTP 200, ok=true, schema OK\",\n detail: {\n ok: body?.ok,\n version: body?.version,\n ge_logs: body?.counts?.ge_logs?.count ?? null,\n ge_feedback: body?.counts?.ge_feedback?.count ?? null,\n schema: body?.schema?.map((s: any) => ({ table: s.table, ok: s.ok })) ?? null,\n },\n };\n }));\n\n tests.push(await runTest(\"dashboard.health\", async () => {\n const res = await fetch(`${DASHBOARD_URL}/?action=health&selftest=${Date.now()}`, {\n headers: authHeaders,\n signal: AbortSignal.timeout(10_000),\n });\n const body = await readJson(res);\n return {\n ok: res.status === 200 && body?.ok === true,\n status: res.status,\n expected: \"HTTP 200, ok=true\",\n detail: { ok: body?.ok, timestamp: body?.timestamp },\n };\n }));\n\n tests.push(await runTest(\"dashboard.purge_get_blocked\", async () => {\n const res = await fetch(`${DASHBOARD_URL}/?action=purge_logs&days=30&selftest=${Date.now()}`, {\n method: \"GET\",\n headers: authHeaders,\n signal: AbortSignal.timeout(10_000),\n });\n const body = await readJson(res);\n return {\n ok: res.status === 405,\n status: res.status,\n expected: \"HTTP 405\",\n detail: body,\n };\n }));\n\n tests.push(await runTest(\"dashboard.purge_user_missing_id\", async () => {\n const res = await fetch(`${DASHBOARD_URL}/?action=purge_user&selftest=${Date.now()}`, {\n method: \"POST\",\n headers: authHeaders,\n signal: AbortSignal.timeout(10_000),\n });\n const body = await readJson(res);\n return {\n ok: res.status === 200 && body?.ok === false,\n status: res.status,\n expected: \"HTTP 200, ok=false, aucune suppression\",\n detail: body,\n };\n }));\n\n tests.push(await runTest(\"dashboard.export_empty\", async () => {\n const res = await fetch(`${DASHBOARD_URL}/?action=export_logs&period=7&version=__selftest_no_such_version__&selftest=${Date.now()}`, {\n headers: authHeaders,\n signal: AbortSignal.timeout(10_000),\n });\n const text = await res.text();\n return {\n ok: res.status === 200,\n status: res.status,\n expected: \"HTTP 200 CSV, filtre sans résultat\",\n detail: { content_type: res.headers.get(\"content-type\"), size: text.length },\n };\n }));\n\n const testsOk = tests.every((t) => t.ok);\n const ok = configOk && testsOk;\n const status = ok ? 200 : 500;\n\n return json({\n ok,\n version: VERSION,\n config_ok: configOk,\n config,\n started_at: startedAt,\n finished_at: new Date().toISOString(),\n count: tests.length,\n passed: tests.filter((t) => t.ok).length,\n failed: tests.filter((t) => !t.ok).length,\n tests,\n }, status);\n}\n",[165],"97715fde-5363-11f1-a5b5-ee650bb23af1","render.ts","5b3d6d90-47d9-11f1-98ec-42b51c65c3df",695,["D",1779182263254],3,"// render.ts — Rendu HTML du contenu agent (citations, listes, bold)\n\nexport type RefEntry = { title: string; url: string };\n\nexport function he(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nexport function buildRefMap(agentMsg: any, raw: string): Record {\n const refMap: Record = {};\n\n for (const action of (agentMsg.actions ?? [])) {\n for (const item of (action.output ?? [])) {\n if (item?.type !== \"resource\") continue;\n const r = item.resource ?? {};\n const ref = String(r.ref ?? \"\");\n const url = String(r.uri ?? r.sourceUrl ?? \"\");\n if (!ref) continue;\n const tags = Array.isArray(r.tags) ? r.tags : [];\n const tt = tags.find((t: string) => typeof t === \"string\" && t.startsWith(\"title:\")) ?? \"\";\n const title = tt ? String(tt).slice(6) : String(r.id ?? ref);\n if (!refMap[ref] || (!refMap[ref].url && url)) refMap[ref] = { title, url };\n }\n if (Array.isArray(action.documents)) {\n for (const doc of action.documents) {\n const ref = String(doc.ref ?? doc.documentId ?? \"\");\n const url = String(doc.sourceUrl ?? doc.uri ?? \"\");\n if (!ref) continue;\n const tags = Array.isArray(doc.tags) ? doc.tags : [];\n const tt = tags.find((t: string) => typeof t === \"string\" && t.startsWith(\"title:\")) ?? \"\";\n const title = tt ? String(tt).slice(6) : String((doc.title ?? ref) || ref);\n if (!refMap[ref] || (!refMap[ref].url && url)) refMap[ref] = { title, url };\n }\n }\n }\n\n // Ajoute les refs trouvées dans le texte brut (:cite[xxx]) non encore dans la map\n const citeRe = /:cite\\[([a-zA-Z0-9_-]+)\\]/g;\n for (const line of raw.split(\"\\n\")) {\n citeRe.lastIndex = 0;\n let cm: RegExpExecArray | null;\n while ((cm = citeRe.exec(line)) !== null) {\n const ref = cm[1].trim();\n if (!ref || refMap[ref]) continue;\n refMap[ref] = { title: ref, url: \"\" };\n }\n }\n return refMap;\n}\n\nexport function renderContent(raw: string, refMap: Record): string {\n const nums: Record = {};\n let counter = 0;\n\n function buildLink(ref: string): string {\n const src = refMap[ref];\n if (!src) return \"\";\n if (nums[ref] === undefined) { counter++; nums[ref] = counter; }\n const n = nums[ref];\n if (src.url && src.url.startsWith(\"http\"))\n return `${n}`;\n return `${n}`;\n }\n\n function inline(text: string): string {\n let res = \"\", rem = text;\n while (rem.length > 0) {\n const si = rem.indexOf(\"*:cite[\");\n const ci = rem.indexOf(\":cite[\");\n const pi = rem.indexOf(\"*(\");\n const pp1 = rem.indexOf(\"(p. \");\n const pp2 = rem.indexOf(\"(pp. \");\n const ppi = (pp1 === -1 && pp2 === -1) ? -1 : (pp1 === -1) ? pp2 : (pp2 === -1) ? pp1 : Math.min(pp1, pp2);\n const bi = rem.indexOf(\"**\");\n let earliest = -1, type = \"\";\n if (si !== -1 && (earliest === -1 || si < earliest)) { earliest = si; type = \"starcite\"; }\n if (ci !== -1 && (earliest === -1 || ci < earliest)) { earliest = ci; type = \"cite\"; }\n if (pi !== -1 && (earliest === -1 || pi < earliest)) { earliest = pi; type = \"page\"; }\n if (ppi !== -1 && (earliest === -1 || ppi < earliest)) { earliest = ppi; type = \"paren\"; }\n if (bi !== -1 && (earliest === -1 || bi < earliest)) { earliest = bi; type = \"bold\"; }\n if (earliest === -1) { res += he(rem); break; }\n if (earliest > 0) res += he(rem.slice(0, earliest));\n rem = rem.slice(earliest);\n if (type === \"starcite\") {\n rem = rem.slice(1);\n const rest = rem.slice(6), cb = rest.indexOf(\"]\");\n if (cb === -1) { res += he(rem); break; }\n res += buildLink(rest.slice(0, cb));\n rem = rest.slice(cb + 1);\n if (rem.startsWith(\"*\")) rem = rem.slice(1);\n } else if (type === \"cite\") {\n const rest = rem.slice(6), cb = rest.indexOf(\"]\");\n if (cb === -1) { res += he(rem); break; }\n res += buildLink(rest.slice(0, cb));\n rem = rest.slice(cb + 1);\n } else if (type === \"page\") {\n const pe = rem.indexOf(\")*\");\n if (pe === -1) { res += he(rem.slice(0, 2)); rem = rem.slice(2); }\n else { res += `${he(rem.slice(1, pe + 1))}`; rem = rem.slice(pe + 2); }\n } else if (type === \"paren\") {\n const pe = rem.indexOf(\")\");\n if (pe === -1) { res += he(rem[0]); rem = rem.slice(1); }\n else { res += `${he(rem.slice(0, pe + 1))}`; rem = rem.slice(pe + 1); }\n } else {\n const e = rem.indexOf(\"**\", 2);\n if (e === -1) { res += he(rem); break; }\n res += `${inline(rem.slice(2, e))}`;\n rem = rem.slice(e + 2);\n }\n }\n return res;\n }\n\n const lines = raw.split(\"\\n\");\n let html = \"\", inList = false;\n function cl() { if (inList) { html += \"\"; inList = false; } }\n\n for (const line of lines) {\n if (line.startsWith(\"*⚠\")) {\n cl();\n let i = line.slice(1);\n if (i.endsWith(\"*\")) i = i.slice(0, -1);\n html += `

${he(i)}

`;\n } else if (line.startsWith(\"- \")) {\n if (!inList) { html += \"

${inline(line.slice(2))}

${inline(line)}

{\n if ([\"send\", \"retry\", \"feedback\", \"poll\"].includes(action)) {\n if (!await verifyToken(userId, token)) {\n return jsonResp(\n { error: \"Non autorisé — session expirée ou invalide.\" },\n 401,\n origin,\n );\n }\n }\n\n if ([\"send\", \"retry\"].includes(action) && !checkRateLimit(userId)) {\n return jsonResp(\n { error: \"Trop de requêtes. Veuillez patienter une minute.\" },\n 429,\n origin,\n );\n }\n\n return null;\n}\n\nfunction rawTextFromAgentMessage(agentMsg: any): string {\n if (typeof agentMsg?.content === \"string\") return agentMsg.content;\n if (Array.isArray(agentMsg?.content)) {\n return agentMsg.content\n .filter((b: any) => b?.type === \"text\")\n .map((b: any) => b.text ?? \"\")\n .join(\"\");\n }\n if (Array.isArray(agentMsg?.rawContents)) {\n return agentMsg.rawContents.map((b: any) => b?.content ?? \"\").join(\"\");\n }\n return \"\";\n}\n\nfunction dustCreatedToMs(created: unknown): number | null {\n const n = typeof created === \"number\" ? created : Number(created);\n if (!Number.isFinite(n) || n <= 0) return null;\n // Dust peut exposer des timestamps en secondes ou en millisecondes selon les payloads.\n return n < 1_000_000_000_000 ? n * 1000 : n;\n}\n\nfunction responseTimeFromDustSentAt(sentAt: unknown): number | null {\n const sentAtMs = dustCreatedToMs(sentAt);\n if (!sentAtMs) return null;\n return Math.max(0, Date.now() - sentAtMs);\n}\n\nasync function dustErrorDetail(res: Response): Promise {\n try {\n return (await res.text()).slice(0, 500);\n } catch {\n return \"\";\n }\n}\n\nexport default async function (req: Request): Promise {\n const origin = req.headers.get(\"origin\");\n const url = new URL(req.url);\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsHeaders(origin) });\n }\n\n if (req.method === \"GET\") {\n if (url.pathname.endsWith(\"/dbcheck\")) {\n const provided = url.searchParams.get(\"key\") ??\n req.headers.get(\"authorization\")?.replace(/^Bearer\\s+/i, \"\").trim() ??\n \"\";\n if (!DBCHECK_KEY || provided !== DBCHECK_KEY) {\n return new Response(JSON.stringify({ error: \"Non autorisé.\" }), {\n status: 401,\n headers: { \"Content-Type\": \"application/json\" },\n });\n }\n const tables = await checkSupabase();\n const ok = Object.values(tables).every((v) => v === \"ok\");\n return new Response(\n JSON.stringify(\n {\n ok,\n version: VERSION,\n timestamp: new Date().toISOString(),\n ...tables,\n },\n null,\n 2,\n ),\n {\n status: ok ? 200 : 503,\n headers: { \"Content-Type\": \"application/json\" },\n },\n );\n }\n\n if (\n url.pathname.endsWith(\"/health\") || url.searchParams.get(\"health\") === \"1\"\n ) {\n return new Response(\n JSON.stringify({\n ok: true,\n version: VERSION,\n timestamp: new Date().toISOString(),\n origins_configured: ALLOWED_ORIGINS.length,\n }),\n { status: 200, headers: { \"Content-Type\": \"application/json\" } },\n );\n }\n\n return htmlResp();\n }\n\n if (req.method !== \"POST\") {\n return jsonResp({ error: \"Méthode non autorisée.\" }, 405, origin);\n }\n\n const body = await req.json().catch(() => ({}));\n const {\n action,\n message,\n conversationId,\n sentAt,\n messageId,\n thumb,\n tags,\n comment,\n userId,\n token,\n agentMessageId,\n userMessageId,\n userMsgId,\n } = body;\n\n const authErr = await requireActionAuth(\n action,\n userId ?? null,\n token ?? null,\n origin,\n );\n if (authErr) return authErr;\n\n if (action === \"send\") {\n if (!message?.trim()) {\n return jsonResp(\n { error: \"Le message ne peut pas être vide.\" },\n 400,\n origin,\n );\n }\n\n const isNew = !conversationId;\n const dustUrl = isNew\n ? `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations`\n : `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations/${conversationId}/messages`;\n const baseMsg = {\n content: message,\n mentions: [{ configurationId: AGENT_ID }],\n context: dustCtx,\n };\n const dustBody = isNew\n ? { visibility: \"unlisted\", title: AGENT_DISPLAY_NAME, message: baseMsg }\n : baseMsg;\n\n let res: Response;\n try {\n res = await dustFetch(dustUrl, {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n \"Authorization\": \"Bearer \" + DUST_API_KEY,\n },\n body: JSON.stringify(dustBody),\n });\n } catch (e) {\n const isTimeout = String(e).includes(\"TimeoutError\") ||\n String(e).includes(\"AbortError\");\n return jsonResp(\n {\n error: isTimeout\n ? \"L'assistant met trop de temps à répondre.\"\n : \"L'assistant est temporairement indisponible.\",\n },\n 502,\n origin,\n );\n }\n\n if (!res.ok) {\n const detail = await dustErrorDetail(res);\n console.error(\"Dust send:\", res.status, detail);\n return jsonResp(\n {\n error: \"L'assistant est temporairement indisponible.\",\n status: res.status,\n },\n 502,\n origin,\n );\n }\n\n const data = await res.json().catch(() => ({}));\n const newConvId = data.conversation?.sId ?? conversationId;\n const newUserMsgId = data.message?.sId ?? null;\n const dustSentAt = data.message?.created ?? 0;\n\n if (!newConvId || !newUserMsgId) {\n console.error(\"Dust send: réponse incomplète\", data);\n return jsonResp(\n { error: \"Réponse Dust incomplète. Veuillez réessayer.\" },\n 502,\n origin,\n );\n }\n\n await logMsg(userId ?? null, newConvId, newUserMsgId, \"user\", message, {\n action: \"send\",\n char_count: message.length,\n origin,\n });\n\n return jsonResp(\n {\n ok: true,\n conversationId: newConvId,\n userMsgId: newUserMsgId,\n sentAt: dustSentAt,\n },\n 200,\n origin,\n );\n }\n\n if (action === \"retry\") {\n if (!conversationId || !message?.trim()) {\n return jsonResp({ error: \"Paramètres manquants.\" }, 400, origin);\n }\n\n await Promise.all([\n agentMessageId\n ? dustDelete(conversationId, agentMessageId)\n : Promise.resolve(),\n userMessageId\n ? dustDelete(conversationId, userMessageId)\n : Promise.resolve(),\n deleteMsg(agentMessageId ?? null),\n deleteMsg(userMessageId ?? null),\n deleteFeedback(agentMessageId ?? null),\n ]);\n\n let newUserMsgId: string | null = null;\n let newSentAt = 0;\n try {\n const r = await dustPostUserMsg(conversationId, message);\n newUserMsgId = r.sId;\n newSentAt = r.created ?? 0;\n } catch (e) {\n return jsonResp(\n { error: \"Impossible de re-poster le message. \" + String(e) },\n 502,\n origin,\n );\n }\n\n await logMsg(\n userId ?? null,\n conversationId,\n newUserMsgId,\n \"user\",\n message,\n {\n action: \"retry\",\n char_count: message.length,\n origin,\n },\n );\n\n return jsonResp(\n { ok: true, conversationId, userMsgId: newUserMsgId, sentAt: newSentAt },\n 200,\n origin,\n );\n }\n\n if (action === \"poll\") {\n if (!conversationId) {\n return jsonResp(\n { error: \"Identifiant de conversation manquant.\" },\n 400,\n origin,\n );\n }\n\n let res: Response;\n try {\n res = await fetch(\n `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations/${conversationId}`,\n {\n headers: { \"Authorization\": \"Bearer \" + DUST_API_KEY },\n signal: AbortSignal.timeout(DUST_TIMEOUT_MS),\n },\n );\n } catch {\n return jsonResp({ status: \"pending\", conversationId }, 200, origin);\n }\n\n if (!res.ok) {\n return jsonResp(\n { error: \"L'assistant est temporairement indisponible.\" },\n 502,\n origin,\n );\n }\n\n const data = await res.json();\n const groups: any[][] = data.conversation?.content ?? [];\n const found = findAgentMsgAfter(groups, userMsgId ?? null, sentAt ?? 0);\n\n if (found.status === \"done\" && found.agentMsg) {\n const latest = found.agentMsg;\n const raw = rawTextFromAgentMessage(latest);\n const chainOfThought = extractChainOfThought(latest) ??\n buildActionsThinking(latest);\n const refMap = buildRefMap(latest, raw);\n const html = renderContent(raw, refMap);\n const responseTimeMs = responseTimeFromDustSentAt(sentAt);\n const agentVersion = extractAgentVersion(raw);\n const model = extractAgentModel(latest);\n\n await logMsg(\n userId ?? null,\n conversationId,\n latest.sId ?? null,\n \"agent\",\n raw,\n {\n action: \"poll\",\n char_count: raw.length,\n origin,\n responseTimeMs,\n version: agentVersion,\n model,\n },\n );\n\n return jsonResp(\n {\n status: \"done\",\n html,\n raw,\n conversationId,\n messageId: latest.sId ?? \"\",\n chainOfThought,\n },\n 200,\n origin,\n );\n }\n\n if (found.status === \"error\") {\n return jsonResp({ status: \"error\", conversationId }, 200, origin);\n }\n\n return jsonResp({ status: \"pending\", conversationId }, 200, origin);\n }\n\n if (action === \"feedback\") {\n const tagsStr = tags\n ? (Array.isArray(tags) ? tags.join(\", \") : String(tags))\n : null;\n const err = await saveFeedback(\n userId ?? null,\n conversationId ?? null,\n messageId ?? null,\n thumb ?? null,\n tagsStr,\n comment || null,\n );\n return jsonResp({ ok: !err, error: err }, 200, origin);\n }\n\n return jsonResp({ error: \"Action inconnue.\" }, 400, origin);\n}",[180],"0dd9b4bc-4ec0-11f1-a148-ee650bb23af1","dust.ts","5b7a9990-47d9-11f1-920b-42b51c65c3df",604,["D",1778672219787],13,"// dust.ts — Interactions avec l'API Dust\n\nimport { DUST_BASE, WORKSPACE_ID, AGENT_ID, DUST_TIMEOUT_MS, AGENT_LABEL } from \"./config.ts\";\n\nexport const dustCtx = {\n timezone: \"Europe/Paris\",\n username: \"Utilisateur\",\n fullName: \"Géomètre-Expert\",\n email: null,\n profilePictureUrl: null,\n};\n\n// Wrapper fetch avec timeout automatique\nexport function dustFetch(url: string, init: RequestInit = {}): Promise {\n return fetch(url, { ...init, signal: AbortSignal.timeout(DUST_TIMEOUT_MS) });\n}\n\n// Suppression best-effort d'un message (retry)\nexport async function dustDelete(conversationId: string, messageId: string): Promise {\n try {\n await fetch(\n `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations/${conversationId}/messages/${messageId}`,\n { method: \"DELETE\", headers: { \"Authorization\": \"Bearer \" + (Deno.env.get(\"DUST_API_KEY\") ?? \"\") } }\n );\n } catch { /* best-effort, non bloquant */ }\n}\n\n// Poste un message utilisateur dans une conversation existante\nexport async function dustPostUserMsg(\n conversationId: string,\n message: string\n): Promise<{ sId: string | null; created: number | null }> {\n const res = await fetch(\n `${DUST_BASE}/api/v1/w/${WORKSPACE_ID}/assistant/conversations/${conversationId}/messages`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", \"Authorization\": \"Bearer \" + (Deno.env.get(\"DUST_API_KEY\") ?? \"\") },\n body: JSON.stringify({ content: message, mentions: [{ configurationId: AGENT_ID }], context: dustCtx }),\n signal: AbortSignal.timeout(DUST_TIMEOUT_MS),\n }\n );\n if (!res.ok) throw new Error(\"Dust POST message \" + res.status);\n const data = await res.json().catch(() => ({}));\n return { sId: data.message?.sId ?? null, created: data.message?.created ?? null };\n}\n\n// Extrait la version de l'agent depuis la section avertissement de sa réponse.\n// Le nom de l'agent est lu depuis AGENT_LABEL (config) pour éviter tout hardcodage.\n// Ex: \"GE-Assistant Documentaire v2.7.14 | © 2026 beFlow\" → \"v2.7.14\"\nexport function extractAgentVersion(raw: string): string | null {\n const escaped = AGENT_LABEL.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n const m = raw.match(new RegExp(`${escaped}\\\\s+(v[\\\\d.]+)`, \"i\"));\n return m ? m[1] : null;\n}\n\nfunction modelToString(model: any): string | null {\n if (!model) return null;\n if (typeof model === \"string\") return model.trim() || null;\n if (typeof model !== \"object\") return null;\n const provider = typeof model.providerId === \"string\"\n ? model.providerId\n : typeof model.provider_id === \"string\"\n ? model.provider_id\n : typeof model.provider === \"string\"\n ? model.provider\n : \"\";\n const modelId = typeof model.modelId === \"string\"\n ? model.modelId\n : typeof model.model_id === \"string\"\n ? model.model_id\n : typeof model.name === \"string\"\n ? model.name\n : typeof model.id === \"string\"\n ? model.id\n : \"\";\n if (provider && modelId) return `${provider}/${modelId}`;\n if (modelId) return modelId;\n return null;\n}\n\n// Extrait le modèle depuis la configuration attachée au message agent Dust.\n// Formats supportés : configuration.model.providerId/modelId, model, modelId, model_id.\nexport function extractAgentModel(agentMsg: any): string | null {\n return modelToString(agentMsg?.configuration?.model)\n ?? modelToString(agentMsg?.model)\n ?? modelToString(agentMsg?.modelId)\n ?? modelToString(agentMsg?.model_id)\n ?? null;\n}\n\n// Extrait le chain-of-thought d'un message agent\nexport function extractChainOfThought(agentMsg: any): string | null {\n if (typeof agentMsg.chainOfThought === \"string\" && agentMsg.chainOfThought.trim())\n return agentMsg.chainOfThought.trim();\n if (typeof agentMsg.chain_of_thought === \"string\" && agentMsg.chain_of_thought.trim())\n return agentMsg.chain_of_thought.trim();\n if (Array.isArray(agentMsg.content)) {\n for (const b of agentMsg.content) {\n if (b?.type === \"chain_of_thought\" || b?.type === \"thinking\") {\n const t = b.text ?? b.value ?? b.content ?? \"\";\n if (typeof t === \"string\" && t.trim()) return t.trim();\n }\n }\n }\n return null;\n}\n\n// Construit un résumé des actions (recherche documentaire) pour le panneau de raisonnement\nexport function buildActionsThinking(agentMsg: any): string | null {\n const actions: any[] = agentMsg.actions ?? [];\n if (!actions.length) return null;\n const lines: string[] = [];\n for (const action of actions) {\n const type = action.type ?? \"\";\n const query = action.query ?? action.input?.query ?? action.params?.query ?? \"\";\n if (query) lines.push(`Requête : \"${query}\"`);\n const docs = action.documents ?? action.output ?? [];\n const docCount = Array.isArray(docs)\n ? docs.filter((d: any) => d?.type === \"document\" || d?.document || d?.documentId || d?.ref || d?.title).length\n : 0;\n if (docCount > 0) lines.push(`${docCount} extrait${docCount > 1 ? \"s\" : \"\"} analysé${docCount > 1 ? \"s\" : \"\"}`);\n if (!query && docCount === 0 && type) lines.push(`Action : ${type}`);\n }\n return lines.length ? lines.join(\"\\n\") : null;\n}\n\n// Trouve le message agent qui suit userMsgId dans les groupes de conversation\nexport function findAgentMsgAfter(\n groups: any[][],\n userMsgId: string | null,\n sentAt: number\n): { status: \"done\" | \"error\" | \"pending\" | \"not_found\"; agentMsg?: any } {\n\n // Stratégie 1 : ancrage par position (userMsgId connu)\n if (userMsgId) {\n let userIdx = -1;\n for (let i = 0; i < groups.length; i++) {\n if (!Array.isArray(groups[i])) continue;\n if (groups[i].some((v: any) => v?.sId === userMsgId)) { userIdx = i; break; }\n }\n if (userIdx >= 0) {\n for (let i = userIdx + 1; i < groups.length; i++) {\n const group = groups[i];\n if (!Array.isArray(group)) continue;\n const latest = group[group.length - 1];\n if (latest?.type !== \"agent_message\") continue;\n if (latest.status === \"succeeded\") return { status: \"done\", agentMsg: latest };\n if (latest.status === \"errored\") return { status: \"error\" };\n return { status: \"pending\" };\n }\n return { status: \"pending\" }; // agent message pas encore apparu\n }\n }\n\n // Stratégie 2 : fallback par timestamp (depuis la fin)\n for (let i = groups.length - 1; i >= 0; i--) {\n const group = groups[i];\n if (!Array.isArray(group)) continue;\n const latest = group[group.length - 1];\n if (latest?.type !== \"agent_message\") continue;\n if ((latest?.created ?? 0) < sentAt) break;\n if (latest.status === \"succeeded\") return { status: \"done\", agentMsg: latest };\n if (latest.status === \"errored\") return { status: \"error\" };\n return { status: \"pending\" };\n }\n return { status: \"not_found\" };\n}\n",[188],"835633e0-539e-11f1-9eb2-ee650bb23af1","demo.ts","01ba3fa2-422d-11f1-a532-42b51c65c3df",783,["D",1779207569839],121,"// GE-Assistant — Page démo & documentation d'intégration v5.1\n\nimport {\n AGENT_DISPLAY_NAME,\n AGENT_LABEL,\n ALLOWED_ORIGINS,\n CLIENT_NAME,\n TOKEN_TTL,\n VERSION,\n WIDGET_SECRET,\n} from \"./config.ts\";\nconst WIDGET_JS_URL =\n \"https://beFlow--e849c87c421711f1853442b51c65c3df.web.val.run/widget.js\";\nconst CHAT_URL = \"https://beFlow--76b6689e3fcb11f1bb8142b51c65c3df.web.val.run\";\nconst CHAT_ORIGIN = new URL(CHAT_URL).origin;\nconst DASHBOARD_URL =\n \"https://beFlow--59f47d7e492411f1940f42b51c65c3df.web.val.run\";\nconst DBCHECK_URL =\n \"https://beFlow--92ae0bf2423b11f1961842b51c65c3df.web.val.run\";\nconst SELFTEST_URL =\n \"https://beFlow--c8c8fc4e4ed711f1beb2ee650bb23af1.web.val.run\";\nconst TTL_DISPLAY = TOKEN_TTL < 3600\n ? `${TOKEN_TTL / 60} min`\n : `${TOKEN_TTL / 3600}h`;\n\nfunction esc(s: string): string {\n return s.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\nasync function generateToken(uid: string): Promise {\n if (!WIDGET_SECRET) return \"\";\n const ts = Math.floor(Date.now() / 1000).toString();\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(WIDGET_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = Array.from(\n new Uint8Array(\n await crypto.subtle.sign(\n \"HMAC\",\n key,\n new TextEncoder().encode(`${uid}:${ts}`),\n ),\n ),\n ).map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n return `${ts}:${sig}`;\n}\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const uid = url.searchParams.get(\"uid\") || \"\";\n const hasUid = uid.length > 0;\n const effectiveUid = uid || \"demo-user\";\n const token = await generateToken(effectiveUid);\n const genTime = token\n ? new Date(parseInt(token.split(\":\")[0], 10) * 1000)\n .toLocaleTimeString(\"fr-FR\", {\n timeZone: \"Europe/Paris\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n second: \"2-digit\",\n })\n : \"\";\n const scriptAttrs = `data-uid=\"${esc(effectiveUid)}\"${\n token ? ` data-token=\"${esc(token)}\"` : \"\"\n } data-label=\"Ouvrir l'assistant...\"`;\n // Option B : URL propre, token via postMessage uniquement\n const iframeSrc = `${CHAT_URL}?uid=${encodeURIComponent(effectiveUid)}`;\n const tokenBadge = token\n ? `✓ Token HMAC valide — TTL ${TTL_DISPLAY} — généré à ${genTime} — uid : ${\n esc(effectiveUid)\n }`\n : `⚠ WIDGET_SECRET non configuré — mode dev`;\n\n // ── PHP ────────────────────────────────────────────────────────────────\n const sPhpToken = esc(``);\n const sPhpA = esc(``);\n\n // Option B : token via postMessage — jamais dans l'URL\n const sPhpB = esc(`\n\n\n`);\n\n // ── Node.js / Express (CommonJS) ───────────────────────────────────────\n const sNodeToken = esc(`// Node.js + Express — CommonJS\nconst crypto = require('crypto');\n\nfunction generateToken(uid) {\n const secret = process.env.WIDGET_SECRET;\n const ts = Math.floor(Date.now() / 1000).toString();\n const hmac = crypto.createHmac('sha256', secret)\n .update(uid + ':' + ts)\n .digest('hex');\n return ts + ':' + hmac;\n}\n\nfunction jsonForScript(value) {\n return JSON.stringify(value)\n .replace(//g, \"\\\\u003e\")\n .replace(/&/g, \"\\\\u0026\");\n}`);\n\n const sNodeA = esc(`// Express — route\napp.get('/page', (req, res) => {\n const token = generateToken(req.session.uid);\n res.render('page', {\n widgetUrl: '${WIDGET_JS_URL}',\n uid: req.session.uid,\n token\n });\n});\n\n// Template EJS / Handlebars / Pug\n// `);\n\n // Option B : token via postMessage — jamais dans l'URL\n const sNodeB = esc(`// Express — route\napp.get('/page', (req, res) => {\n const uid = req.session.uid;\n const token = generateToken(uid);\n // URL propre : uid uniquement, token transmis via postMessage\n const src = \\`${CHAT_URL}?uid=\\${encodeURIComponent(uid)}\\`;\n res.render('page', {\n iframeSrc: src,\n uidJson: jsonForScript(uid),\n tokenJson: jsonForScript(token)\n });\n});\n\n// Template EJS / Handlebars / Pug\n// \n//\n// `);\n\n // ── ESM Moderne (Web Crypto API) ───────────────────────────────────────\n const sEsmToken = esc(`// Node.js 18+ · Deno · Bun · Cloudflare Workers\nconst secret = process.env.WIDGET_SECRET; // Deno : Deno.env.get(\"WIDGET_SECRET\")\nconst uid = session.user.email;\nconst ts = Math.floor(Date.now() / 1000).toString();\n\nconst key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]\n);\nconst sig = Array.from(new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key,\n new TextEncoder().encode(\\`\\${uid}:\\${ts}\\`))\n)).map(b => b.toString(16).padStart(2, \"0\")).join(\"\");\n\nconst token = \\`\\${ts}:\\${sig}\\`;`);\n const sEsmA = esc(`// Hono / Fastify / Express ESM — route\napp.get(\"/page\", async (req, res) => {\n const token = await generateToken(req.session.uid);\n res.render(\"page\", {\n widgetUrl: \"${WIDGET_JS_URL}\",\n uid: req.session.uid,\n token\n });\n});\n\n// Template EJS / Handlebars / Nunjucks\n// `);\n\n // Option B : token via postMessage — jamais dans l'URL\n const sEsmB = esc(`// Hono / Fastify / Express ESM — route\napp.get(\"/page\", async (req, res) => {\n const uid = req.session.uid;\n const token = await generateToken(uid);\n // URL propre : uid uniquement, token transmis via postMessage\n const src = \\`${CHAT_URL}?uid=\\${encodeURIComponent(uid)}\\`;\n res.render(\"page\", {\n iframeSrc: src,\n uidJson: jsonForScript(uid),\n tokenJson: jsonForScript(token)\n });\n});\n\n// Template EJS / Handlebars / Nunjucks\n// \n//\n// `);\n\n const sPostMsg = esc(\n `// Boutons widget (expand / minimize) — identique à avant\nwindow.addEventListener('message', function(e) {\n if (e.origin !== '${CHAT_ORIGIN}') return;\n var iframe = document.getElementById('assistant-chat');\n if (!iframe || !e.data || !e.data.type) return;\n if (e.data.type === 'assistant-expand') {\n var expanded = iframe.dataset.expanded === '1';\n if (expanded) {\n iframe.style.width = '420px';\n iframe.style.height = '680px';\n iframe.dataset.expanded = '0';\n } else {\n iframe.style.width = '780px';\n iframe.style.height = 'min(88vh, 860px)';\n iframe.dataset.expanded = '1';\n }\n }\nif (e.data.type === 'assistant-minimize') {\n iframe.style.width = '420px';\n iframe.style.height = '680px';\n iframe.dataset.expanded = '0';\n}\n});\n\n// Envoi sécurisé du token (à appeler UNE FOIS à la construction de la page)\n// document.getElementById('assistant-chat').addEventListener('load', function() {\n// this.contentWindow.postMessage(\n// { type: 'assistant-auth', uid: UID, token: TOKEN },\n// '${CHAT_ORIGIN}' // targetOrigin : sécurise l'envoi\n// );\n// });`,\n );\n\n const html = `\n\n\n\n\n${esc(CLIENT_NAME)} — Démo ${esc(AGENT_DISPLAY_NAME)}\n\n\n\n

${\n esc(CLIENT_NAME)\n } — Démo & guide d’intégration

${esc(AGENT_DISPLAY_NAME)} · ${esc(AGENT_LABEL)} · ${\n esc(VERSION)\n }

\n Guide d’intégration\n

Simuler un utilisateur

\n \n ${tokenBadge}\n

Démarrer vite : mode recommandé

\n Cette page sert d'abord à tester l'assistant, puis à récupérer le snippet d'intégration.\n Pour un intranet standard, privilégier le widget flottant : il ne modifie pas la mise en page\n et transmet le token par postMessage.\n

\n Option A · Widget flottant\n

\n\n

\n Simuler un utilisateur\n Saisir un uid réaliste pour générer un token HMAC de démonstration.\n

\n Tester les deux modes\n Comparer le bouton flottant et l'iframe intégrée sur une même page.\n

\n Copier le snippet\n Choisir PHP, Node.js ou ESM, puis intégrer côté serveur client.\n

\n\n

\n Voir la démo\n Copier le code\n Sécurité\n Traçabilité\n Maintenance\n

Démonstration en direct — Comparer les deux modes

Option AWidget flottant

Une balise <script> suffit. Le bouton apparaît automatiquement en bas à droite.

Zéro impact sur la mise en page

Agrandir / Réduire / Fermer automatiques

Tooltip au bout de quelques secondes

Token transmis via postMessage — jamais dans l’URL

Bouton toujours visible sur la page

INTRANET ${CLIENT_NAME}

Une question ? Consultez l'assistant

👉 Bouton réel actif en bas à droite de cette page

Option BIframe intégrée

Widget intégré via <iframe>. Token transmis via postMessage — URL propre.

Widget toujours visible

Intégration panneau latéral

Token jamais exposé dans l’URL

Boutons header nécessitent un postMessage

intranet.oge.fr — Panneau assistant

\n \n

Sécurité — Token HMAC-SHA256

\n Important production.\n Le token de cette page est généré par Val Town uniquement pour la démonstration.\n En production, le token doit être généré côté serveur client,\n jamais dans le navigateur, avec le même WIDGET_SECRET.\n

Fonctionnement

Token généré côté serveur uniquement, signé HMAC-SHA256, lié au uid, valide ${TTL_DISPLAY}. Toute falsification → HTTP 401.

\n \n \n \n \n \n \n \n \n \n

Tentative	Résultat
Sans token	❌ HTTP 401
Token modifié	❌ HMAC invalide
uid changé, token inchangé	❌ uid ≠ HMAC
Token expiré (> ${TTL_DISPLAY})	❌ TTL expiré
Session active, token frais	✅ Accès autorisé

Durée de vie (TTL)

10h00Page chargée → serveur génère le token

10h20Questions → ✅ token valide

10h31Token expiré (> ${TTL_DISPLAY}) → ❌ Session expirée

10h31Rechargement → nouveau token

\n \n \n \n \n \n \n \n

Cas d’usage	`TOKEN_TTL`	Durée
Sécurité maximale	`1800`	30 min actuel
Usage bureautique	`3600`	1 heure
Journée de travail	`28800`	8 heures

CORS — Contrôle des origines autorisées v5.1

La variable d’environnement ALLOWED_ORIGINS liste les domaines autorisés à intégrer le widget. Toute origine absente → header Access-Control-Allow-Origin non renvoyé → requête bloquée par le navigateur.

\n \n \n \n \n \n \n

Variable	Valeur exemple	Effet
`ALLOWED_ORIGINS`	`https://intranet.oge.fr,https://portail.oge.fr`	Seuls ces domaines peuvent appeler l’API
`ALLOWED_ORIGINS` vide	(non défini)	Aucune origine externe autorisée par défaut — configurer explicitement en production

⚠️ En production, renseigner ALLOWED_ORIGINS avec les domaines exacts de l’intranet. Une valeur vide ne doit pas être utilisée comme mode ouvert.

\n À distinguer :\n widget.js peut rester public et cacheable ; l'accès réel au chat est\n protégé côté API par le couple uid + token HMAC, le TTL et le contrôle\n d'origine.\n

\n\n

Les 5 étapes de génération — comparaison des 3 langages

Toujours le même algorithme, 3 syntaxes différentes

\n \n \n \n \n \n \n \n \n \n \n

Étape	PHP PHP / Twig	Node Node.js / Express	ESM ESM Moderne
1 — Secret	`getenv('WIDGET_SECRET')`	`process.env.WIDGET_SECRET`	`process.env.WIDGET_SECRET` Deno : `Deno.env.get(...)`
2 — UID session	`$_SESSION['user_email']`	`req.session.uid`	`session.user.email`
3 — Timestamp	`time()`	`Math.floor(Date.now()/1000)`	`Math.floor(Date.now()/1000)`
4 — HMAC	`hash_hmac('sha256', $uid.':'.$ts, $secret)`	`crypto.createHmac('sha256', secret) .update(uid+':'+ts) .digest('hex')`	`await crypto.subtle.sign( \"HMAC\", key, payload)`
5 — Token final	`$ts . ':' . $hmac`	`ts + ':' + hmac`	\\`\\${ts}:\\${sig}\\`
Mode	Synchrone	Synchrone	Asynchrone (await)

💡 Le token produit est identique quel que soit le langage — Val Town valide de la même façon.

Ce que Val Town vérifie à chaque requête

📩Reçoit uid + token

⏱️Extrait le timestamp — vérifie < ${TTL_DISPLAY}

🔐Recalcule le HMAC — compare avec la signature reçue

✅Valide → accès autorisé

❌Invalide ou expiré → HTTP 401

Intégration intranet — code à copier

\n \n

Étape 1 — commune aux deux options — génération du token côté serveur :

CommunPHP

${sPhpToken}

CommunNode.js / Express

${sNodeToken}

CommunESM Moderne

${sEsmToken}

Étape 2 — choisir une option d’affichage :

Option AWidget flottant

Une seule balise <script>. Token via postMessage automatiquement.

Option APHP + HTML

${sPhpA}

Option BIframe intégrée

URL propre (uid uniquement). Token transmis via postMessage au chargement.

Option BPHP + HTML

${sPhpB}

Option AWidget flottant

Route Express → injecter widgetUrl, uid, token.

Option ANode.js + Template

${sNodeA}

Option BIframe intégrée

URL propre. Token via postMessage après chargement.

Option BNode.js + Template

${sNodeB}

Option AWidget flottant

Route async → injecter widgetUrl, uid, token.

Option AESM + Template

${sEsmA}

Option BIframe intégrée

URL propre. Token via postMessage après chargement.

Option BESM + Template

${sEsmB}

\n \n Options avancées du widget configuration avancée\n

\n\n

\n API publique du widget.\n Le widget expose window.AssistantChatWidget pour piloter l'ouverture,\n la fermeture et l'agrandissement depuis une page hôte. En iframe intégrée,\n la communication utilise le protocole assistant-* :\n assistant-auth, assistant-expand et\n assistant-minimize. Par défaut, le tooltip reprend\n data-label ; data-tooltip reste disponible uniquement\n si l’on souhaite un texte différent.\n

\n\n

HTMLOptions widget

\n \n

<script src=\"${WIDGET_JS_URL}\"\n        data-uid=\"<%= uid %>\"\n        data-token=\"<%= token %>\"\n        data-label=\"Ouvrir l'assistant...\"\n        data-color=\"#1d4ed8\"\n        data-open=\"false\"></script>

\n\n

data-labelLibellé accessible du bouton et texte de tooltip par défaut.

data-tooltipOptionnel. Texte de bulle différent de data-label.

data-colorCouleur principale du bouton.

data-opentrue ou 1 pour ouvrir automatiquement le widget.

\n\n

JSAPI publique

\n \n

window.AssistantChatWidget.open();\nwindow.AssistantChatWidget.close();\nwindow.AssistantChatWidget.toggle();\nwindow.AssistantChatWidget.expand();\nwindow.AssistantChatWidget.minimize();

Boutons du widget en mode iframe — Option B uniquement

Messages postMessage supportés

Ce JavaScript client est identique quel que soit le langage serveur. Il gère à la fois l’envoi du token et les événements UI.

\n \n \n \n \n \n \n \n

`type`	Direction	Rôle
`assistant-auth`	Parent → iframe	Envoi sécurisé du token au chargement
`assistant-expand`	iframe → parent	Basculer 420→780px
`assistant-minimize`	iframe → parent	Réduire à la taille standard

Option BJavaScript client

${sPostMsg}

Traçabilité Supabase

\n Convention dashboard :\n les métriques principales s'appuient sur les réponses agent.\n Dans ge_logs, les lignes direction = 'user'\n ont version = null et model = null.\n Les lignes direction = 'agent' peuvent porter\n version, model, response_time_ms\n et origin.\n

Le uid écrit dans Supabase est garanti par le HMAC — substituer le uid sans recalculer la signature → HTTP 401.

ge_logs

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n

Colonne	Type	Description
id	bigint	Clé primaire
ts	timestamptz	Horodatage UTC
user_id	text	uid garanti HMAC
conversation_id	text	Identifiant Dust
message_id	text	Identifiant du message Dust
direction	text	`user` ou `agent`
content	text	Texte brut
version	text	Version agent associée à une réponse. Null pour les questions utilisateur.
model v5.1	text	Modèle Dust / LLM utilisé pour la réponse agent. Null pour les questions utilisateur.
action v5.1	text	`send`, `retry` ou `poll`
char_count v5.1	integer	Nombre de caractères du message
origin v5.1	text	Domaine appelant (ex : intranet.oge.fr)
response_time_ms v5.1	integer	Durée de réponse en ms (messages agent)

ge_feedback

\n \n \n \n \n \n \n \n \n \n \n \n \n \n

Colonne	Type	Description
id	bigint	Clé primaire
ts	timestamptz	Horodatage UTC
user_id	text	uid garanti HMAC
conversation_id	text	Identifiant Dust de la conversation
message_id	text	Identifiant du message évalué
thumb	integer	`+1` (utile) ou `-1` (à améliorer)
tags	text	Tags sélectionnés par l’utilisateur (CSV)
comment	text	Commentaire libre (optionnel)
version v5.1	text	Version agent associée au feedback
model v5.1	text	Modèle associé à la réponse évaluée

SQL — Derniers échanges enrichis\n

SELECT\n  ts AT TIME ZONE 'Europe/Paris' AS date_heure,\n  user_id, conversation_id, message_id, version, model, response_time_ms, origin, \n  left(content, 120) AS apercu\nFROM ge_logs WHERE direction = 'agent' ORDER BY ts DESC LIMIT 50;

SQL — Temps de réponse moyen par jour\n

SELECT\n  date_trunc('day', ts AT TIME ZONE 'Europe/Paris') AS jour,\n  count(*) FILTER (WHERE direction = 'user') AS nb_questions,\n  round(avg(response_time_ms) FILTER (WHERE direction = 'agent') / 1000.0, 1) AS tps_rep_moy_s\nFROM ge_logs GROUP BY 1 ORDER BY 1 DESC;

SQL — Feedbacks par note\n

SELECT\n  CASE thumb WHEN 1 THEN '👍 Utile' ELSE '👎 À améliorer' END AS note,\n  count(*) AS nb,\n  string_agg(DISTINCT tags, ' · ') AS tags_frequents\nFROM ge_feedback GROUP BY thumb ORDER BY thumb DESC;

\n\n

Maintenance & non-régression v5.1

\n\n

\n Endpoints de maintenance protégés par DBCHECK_KEY.\n Le dashboard, le diagnostic Supabase et le self-test doivent être appelés avec\n Authorization: Bearer <DBCHECK_KEY> ou avec ?key=... en usage navigateur.\n

\n\n \n \n \n \n \n \n \n

Endpoint	URL	Rôle
Dashboard	`${\n esc(DASHBOARD_URL)\n }`	Métriques, exports CSV et purges protégées en POST.
DB check	`${\n esc(DBCHECK_URL + \"?format=json\")\n }`	Diagnostic Supabase read-only.
Self-test	`${\n esc(SELFTEST_URL)\n }`	Tests read-only de non-régression.

\n\n

\n Résultat attendu du self-test :\n ok=true, config_ok=true, passed=9, failed=0.\n Après rotation de DBCHECK_KEY, valider dashboard, dbcheck et selftest.\n

👉 Essayez le widget

\n\n\n\n`;\n return new Response(html, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}",[196],"c8ca355a-4ed7-11f1-beb2-ee650bb23af1","dbcheck.ts","92ae0bf2-423b-11f1-9618-42b51c65c3df",["D",1778682411837],17,"// dbcheck.ts — Diagnostic Supabase Assistant Chat\n// Diagnostic protégé, read-only : configuration, connexion, schéma attendu et dernières lignes.\n\nimport {\n AGENT_LABEL,\n AGENT_DISPLAY_NAME,\n DBCHECK_KEY,\n SUPABASE_KEY,\n SUPABASE_URL,\n VERSION,\n} from \"./config.ts\";\n\nconst TABLES = [\"ge_logs\", \"ge_feedback\"] as const;\nconst DEFAULT_LIMIT = 20;\n\nconst EXPECTED_COLUMNS: Record = {\n ge_logs: [\n \"id\",\n \"ts\",\n \"user_id\",\n \"conversation_id\",\n \"message_id\",\n \"direction\",\n \"content\",\n \"version\",\n \"model\",\n \"action\",\n \"char_count\",\n \"origin\",\n \"response_time_ms\",\n ],\n ge_feedback: [\n \"id\",\n \"ts\",\n \"user_id\",\n \"conversation_id\",\n \"message_id\",\n \"thumb\",\n \"tags\",\n \"comment\",\n \"version\",\n \"model\",\n ],\n};\n\ntype SchemaCheck = {\n table: string;\n ok: boolean;\n columns: string[];\n error: string | null;\n};\n\nfunction securityHeaders(contentType: string): Headers {\n return new Headers({\n \"Content-Type\": contentType,\n \"Cache-Control\": \"no-store\",\n \"Referrer-Policy\": \"no-referrer\",\n \"X-Content-Type-Options\": \"nosniff\",\n });\n}\n\nfunction sbHeaders(): Record {\n return {\n \"apikey\": SUPABASE_KEY,\n \"Authorization\": \"Bearer \" + SUPABASE_KEY,\n \"Content-Type\": \"application/json\",\n };\n}\n\nfunction esc(v: unknown): string {\n return String(v ?? \"—\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction envStatus(v: string): string {\n return v ? \"✅ définie\" : \"❌ non définie\";\n}\n\nfunction isAuthorized(req: Request, url: URL): boolean {\n const provided = url.searchParams.get(\"key\") ??\n req.headers.get(\"authorization\")?.replace(/^Bearer\\s+/i, \"\").trim() ??\n \"\";\n return !!DBCHECK_KEY && provided === DBCHECK_KEY;\n}\n\nasync function sbSelect(table: string, limit = DEFAULT_LIMIT): Promise<{ data: any[]; error: string | null }> {\n if (!SUPABASE_URL || !SUPABASE_KEY) return { data: [], error: \"SUPABASE_URL ou SUPABASE_KEY manquant\" };\n try {\n const r = await fetch(\n `${SUPABASE_URL}/rest/v1/${table}?select=*&order=ts.desc&limit=${limit}`,\n { headers: sbHeaders(), signal: AbortSignal.timeout(8_000) },\n );\n if (!r.ok) {\n const txt = await r.text();\n return { data: [], error: `HTTP ${r.status} : ${txt.slice(0, 240)}` };\n }\n const data = await r.json().catch(() => []);\n return { data: Array.isArray(data) ? data : [], error: null };\n } catch (e) {\n return { data: [], error: String(e) };\n }\n}\n\nasync function sbCount(table: string): Promise<{ count: number | null; error: string | null }> {\n if (!SUPABASE_URL || !SUPABASE_KEY) return { count: null, error: \"SUPABASE_URL ou SUPABASE_KEY manquant\" };\n try {\n const r = await fetch(`${SUPABASE_URL}/rest/v1/${table}?select=id`, {\n method: \"HEAD\",\n headers: {\n ...sbHeaders(),\n \"Prefer\": \"count=exact\",\n \"Range-Unit\": \"items\",\n \"Range\": \"0-0\",\n },\n signal: AbortSignal.timeout(6_000),\n });\n if (!r.ok) return { count: null, error: `HTTP ${r.status}` };\n const raw = r.headers.get(\"content-range\") ?? \"\";\n const total = raw.includes(\"/\") ? parseInt(raw.split(\"/\")[1], 10) : null;\n return { count: Number.isFinite(total) ? total : null, error: null };\n } catch (e) {\n return { count: null, error: String(e) };\n }\n}\n\nasync function sbSchemaCheck(table: string, columns: string[]): Promise {\n if (!SUPABASE_URL || !SUPABASE_KEY) {\n return { table, ok: false, columns, error: \"SUPABASE_URL ou SUPABASE_KEY manquant\" };\n }\n try {\n const select = columns.join(\",\");\n const r = await fetch(\n `${SUPABASE_URL}/rest/v1/${table}?select=${select}&limit=1`,\n { headers: sbHeaders(), signal: AbortSignal.timeout(6_000) },\n );\n if (!r.ok) {\n const txt = await r.text();\n return { table, ok: false, columns, error: `HTTP ${r.status} : ${txt.slice(0, 360)}` };\n }\n await r.text();\n return { table, ok: true, columns, error: null };\n } catch (e) {\n return { table, ok: false, columns, error: String(e) };\n }\n}\n\nasync function pingSupabase(): Promise<{ ok: boolean; status: string }> {\n if (!SUPABASE_URL || !SUPABASE_KEY) return { ok: false, status: \"variables manquantes\" };\n try {\n const r = await fetch(`${SUPABASE_URL}/rest/v1/`, {\n headers: sbHeaders(),\n signal: AbortSignal.timeout(6_000),\n });\n return { ok: r.ok || r.status === 200 || r.status === 400, status: `HTTP ${r.status}` };\n } catch (e) {\n return { ok: false, status: String(e) };\n }\n}\n\nfunction renderTable(rows: any[]): string {\n if (!rows.length) return `

Aucune donnée

`;\n const preferred = [\n \"id\", \"ts\", \"user_id\", \"conversation_id\", \"message_id\", \"direction\", \"thumb\",\n \"action\", \"response_time_ms\", \"version\", \"model\", \"origin\", \"char_count\", \"tags\", \"comment\", \"content\",\n ];\n const keys = [\n ...preferred.filter((k) => rows.some((r) => Object.prototype.hasOwnProperty.call(r, k))),\n ...Object.keys(rows[0]).filter((k) => !preferred.includes(k)),\n ];\n return `

\n ${keys.map((k) => ``).join(\"\")}\n ${rows.map((r) => `${keys.map((k) => {\n const raw = r[k];\n const value = typeof raw === \"object\" && raw !== null ? JSON.stringify(raw) : raw;\n return ``;\n }).join(\"\")}`).join(\"\")}\n

${esc(k)}
${esc(value)}

`;\n}\n\nfunction schemaInfo(checks: SchemaCheck[]): string {\n const cards = checks.map((c) => {\n const cls = c.ok ? \"schema-ok\" : \"schema-err\";\n const status = c.ok ? \"✅ Schéma OK\" : \"❌ Schéma à vérifier\";\n return `

${esc(c.table)} ${status}

Colonnes attendues par le chat, les logs, les feedbacks et le dashboard.

${c.columns.map((col) => `${esc(col)}`).join(\"\")}

\n ${c.error ? `

${esc(c.error)}

` : \"\"}\n

`;\n }).join(\"\");\n return `

${cards}

`;\n}\n\nfunction jsonResp(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data, null, 2), {\n status,\n headers: securityHeaders(\"application/json; charset=utf-8\"),\n });\n}\n\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n if (!isAuthorized(req, url)) {\n return jsonResp({ error: \"Non autorisé.\" }, 401);\n }\n\n const limit = Math.min(100, Math.max(1, parseInt(url.searchParams.get(\"limit\") ?? String(DEFAULT_LIMIT), 10) || DEFAULT_LIMIT));\n const envOk = !!SUPABASE_URL && !!SUPABASE_KEY;\n const [ping, logsRes, fbRes, logsCount, fbCount, ...schemaChecks] = await Promise.all([\n pingSupabase(),\n sbSelect(\"ge_logs\", limit),\n sbSelect(\"ge_feedback\", limit),\n sbCount(\"ge_logs\"),\n sbCount(\"ge_feedback\"),\n ...TABLES.map((table) => sbSchemaCheck(table, EXPECTED_COLUMNS[table])),\n ]);\n\n const schemaOk = schemaChecks.every((c) => c.ok);\n const ok = envOk && ping.ok && schemaOk && !logsRes.error && !fbRes.error;\n const nowIso = new Date().toISOString();\n const now = new Date().toLocaleString(\"fr-FR\", { timeZone: \"Europe/Paris\", dateStyle: \"short\", timeStyle: \"medium\" });\n\n const summary = {\n ok,\n timestamp: nowIso,\n version: VERSION,\n env: {\n supabase_url: !!SUPABASE_URL,\n supabase_key: !!SUPABASE_KEY,\n },\n ping,\n schema: schemaChecks,\n counts: {\n ge_logs: logsCount,\n ge_feedback: fbCount,\n },\n samples: {\n ge_logs: { displayed: logsRes.data.length, error: logsRes.error },\n ge_feedback: { displayed: fbRes.data.length, error: fbRes.error },\n },\n };\n\n if (url.searchParams.get(\"format\") === \"json\" || url.searchParams.get(\"json\") === \"1\") {\n return jsonResp(summary, ok ? 200 : 503);\n }\n\n const html = `\n\n${esc(AGENT_DISPLAY_NAME)} — DB Check Supabase\n\n

${esc(AGENT_DISPLAY_NAME)} — Supabase Check

${esc(AGENT_LABEL)} · ${esc(VERSION)} · ${esc(now)}

SUPABASE_URL${esc(envStatus(SUPABASE_URL))}

SUPABASE_KEY${esc(envStatus(SUPABASE_KEY))}

Ping${ping.ok ? `✅ ${esc(ping.status)}` : `❌ ${esc(ping.status)}`}

État global${ok ? `OK` : `À vérifier`}

\n ${!envOk ? `

❌ Variables SUPABASE_URL ou SUPABASE_KEY manquantes dans Val Town → Settings → Environment Variables

` : \"\"}\n

Accès protégé par DBCHECK_KEY. Paramètres optionnels : ?limit=${limit}, ?format=json. Diagnostic strictement read-only.

\n\n${schemaInfo(schemaChecks)}\n\n

ge_logs ${logsCount.count ?? \"?\"} total · ${logsRes.data.length} affichés

\n${logsRes.error ? `

❌ ${esc(logsRes.error)}

` : renderTable(logsRes.data)}\n\n

\n\n

ge_feedback ${fbCount.count ?? \"?\"} total · ${fbRes.data.length} affichés

\n${fbRes.error ? `

❌ ${esc(fbRes.error)}

` : renderTable(fbRes.data)}\n\n\n`;\n\n return new Response(html, { headers: securityHeaders(\"text/html; charset=utf-8\") });\n}\n",[204],"5d667558-5378-11f1-850c-ee650bb23af1","dashboardView.ts","c8c7926e-4ed7-11f1-beb2-ee650bb23af1",745,["D",1779191185323],20,"// dashboardView.ts — Rendu HTML/CSS/JS du dashboard\n\nimport { AGENT_LABEL, CLIENT_NAME, VERSION } from \"./config.ts\";\nimport { type DashboardData, PERIODS } from \"./dashboardData.ts\";\nimport { bars, enc, fmtMs, fmtTs, h, js, svgLineChart } from \"./dashboardUi.ts\";\n\nfunction paginationLinks(\n baseUrl: string,\n shared: string,\n param: \"page\" | \"fb_page\",\n page: number,\n totalPages: number,\n keep: Record = {},\n): string {\n const pages = Array.from({ length: Math.min(7, totalPages) }, (_, i) => {\n if (totalPages <= 7) return i + 1;\n if (page <= 4) return i + 1;\n if (page >= totalPages - 3) return totalPages - 6 + i;\n return page - 3 + i;\n });\n const keepQs = Object.entries(keep)\n .map(([k, v]) => `&${k}=${encodeURIComponent(String(v))}`)\n .join(\"\");\n const href = (p: number) => `${baseUrl}&${shared}&${param}=${p}${keepQs}`;\n return `

← Préc.

${\n pages.map((p) =>\n `${p}`\n ).join(\"\")\n }

= totalPages ? \"disabled\" : \"\"}\" href=\"${\n href(page + 1)\n }\">Suiv. →

`;\n}\n\nfunction actionClass(action: unknown): string {\n const a = String(action ?? \"\").toLowerCase();\n if (a === \"send\") return \"action-send\";\n if (a === \"retry\") return \"action-retry\";\n return \"\";\n}\n\nexport function renderDashboardPage(\n opts: { data: DashboardData; baseUrl: string; notice: string },\n): string {\n const { data, baseUrl, notice } = opts;\n const f = data.filters;\n const vqs = f.version ? `&version=${enc(f.version)}` : \"\";\n const mqs = f.model ? `&model=${enc(f.model)}` : \"\";\n const oqs = f.origin ? `&origin=${enc(f.origin)}` : \"\";\n const shared = `period=${f.period}${vqs}${mqs}${oqs}`;\n const pageSize = 20;\n const pageFrom = data.counts.totalResponses === 0\n ? 0\n : (f.page - 1) * pageSize + 1;\n const pageTo = Math.min(f.page * pageSize, data.counts.totalResponses);\n const fbPageFrom = data.counts.fbTotalRows === 0\n ? 0\n : (f.fbPage - 1) * pageSize + 1;\n\n const fbPageTo = Math.min(f.fbPage * pageSize, data.counts.fbTotalRows);\n\n const periodLinks = PERIODS.map((p) =>\n `${p} j.`\n ).join(\"\");\n\n const select = (\n name: string,\n label: string,\n values: string[],\n selected: string,\n cls: string,\n ) =>\n values.length\n ? `

`\n : \"\";\n\n const { svg: activityChart, data: activityChartData } = svgLineChart(\"act\", {\n series: [\n {\n label: \"Réponses\",\n color: \"#f97316\",\n values: data.charts.activity.responses,\n },\n {\n label: \"Conversations\",\n color: \"#60a5fa\",\n values: data.charts.activity.convs,\n },\n {\n label: \"Utilisateurs\",\n color: \"#a78bfa\",\n values: data.charts.activity.users,\n },\n ],\n labels: data.charts.labels,\n yFmtType: \"count\",\n });\n const { svg: latencyChart, data: latencyChartData } = svgLineChart(\"lat\", {\n series: [\n { label: \"Moyenne\", color: \"#60a5fa\", values: data.charts.latency.avg },\n { label: \"Médiane\", color: \"#a78bfa\", values: data.charts.latency.med },\n ],\n labels: data.charts.labels,\n yFmt: (v) => v === 0 ? \"0s\" : v.toFixed(1) + \"s\",\n yFmtType: \"seconds\",\n });\n const chartData = { act: activityChartData, lat: latencyChartData };\n\n const fbData = data.feedbackRows.map((r) => ({\n cid: r.conversation_id ?? \"\",\n mid: r.message_id ?? \"\",\n thumb: r.thumb === 1 ? \"👍\" : \"👎\",\n tags: r.tags ?? \"\",\n comment: r.comment ?? \"\",\n }));\n\n const feedbackRows = data.feedbackRows.length\n ? data.feedbackRows.map((r, i) =>\n `${fmtTs(r.ts)}${\n r.thumb === 1\n ? '👍'\n : '👎'\n }${\n h(r.tags || \"—\")\n }${\n h(r.comment || \"—\")\n }${\n h(r.user_id || \"anonyme\")\n }${\n r.conversation_id\n ? ``\n : `—`\n }${\n h(r.version || \"—\")\n }${\n h(r.model || \"—\")\n }`\n ).join(\"\")\n : `Aucun feedback`;\n\n const detailIcon =\n ``;\n const responseRows = data.messages.length\n ? data.messages.map((r) => {\n const content = String(r.content ?? \"\").trim();\n const rt = r.response_time_ms;\n const rtC = !rt\n ? \"\"\n : rt < 10000\n ? \"resp-fast\"\n : rt < 30000\n ? \"resp-mid\"\n : \"resp-slow\";\n const cidBtn = r.conversation_id\n ? ``\n : \"—\";\n return `${\n fmtTs(r.ts)\n }${\n h(r.user_id || \"anonyme\")\n }${\n r.action\n ? `${\n h(r.action)\n }`\n : \"—\"\n }${\n fmtMs(rt)\n }${\n h(r.version || \"—\")\n }${\n h(r.model || \"—\")\n }${cidBtn}${h(r.origin || \"—\")}`;\n }).join(\"\")\n : `Aucune réponse`;\n\n const now = new Date().toLocaleString(\"fr-FR\", {\n timeZone: \"Europe/Paris\",\n dateStyle: \"short\",\n timeStyle: \"medium\",\n });\n const apiRoot = baseUrl.split(\"?key=\")[0];\n const apiKey = new URL(baseUrl).searchParams.get(\"key\") ?? \"\";\n const scopeLabel = `${f.period} derniers jours${\n f.version ? ` · version ${f.version}` : \"\"\n }${f.model ? ` · ${f.model}` : \"\"}${f.origin ? ` · ${f.origin}` : \"\"}`;\n\n return `Dashboard — ${\n h(CLIENT_NAME)\n }\n\n

\n\n\n

Dashboard — ${\n h(CLIENT_NAME)\n }

Métriques assistant · ${\n h(AGENT_LABEL)\n }

${\n h(VERSION)\n }${\n h(now)\n }

${\n select(\n \"version\",\n \"🏷️ Version\",\n data.lists.versions,\n f.version,\n \"ver-select\",\n )\n }${select(\"model\", \"🤖 Modèle\", data.lists.models, f.model, \"model-select\")}${\n select(\n \"origin\",\n \"🌐 Origine\",\n data.lists.origins,\n f.origin,\n \"origin-select\",\n )\n }📊 ${h(scopeLabel)}

\n${\n notice\n ? `

${\n h(notice)\n }

`\n : \"\"\n }\n

Vue centrée sur les réponses agent : les KPI, les filtres version/modèle/origine et la table principale portent sur les réponses produites. Les messages utilisateur restent utilisés uniquement pour calculer le taux d'échec.

Réponses générées${\n data.counts.totalAgent.toLocaleString(\"fr-FR\")\n }réponses agent · filtres actifs

Conversations initiées${data.counts.activeConvs}avec au moins une réponse agent

Utilisateurs servis${data.counts.activeUsers}utilisateurs avec réponse agent

Délai moyen${\n data.latency.avgMs ? (data.latency.avgMs / 1000).toFixed(1) + \"s\" : \"—\"\n }médiane ${fmtMs(data.latency.medMs)} · P95 ${\n fmtMs(data.latency.p95Ms)\n }

= 70\n ? \"green\"\n : \"amber\"\n }\">Satisfaction${\n data.feedback.score !== null ? data.feedback.score + \"%\" : \"—\"\n }${data.feedback.total} avis · ${data.feedback.up} 👍 / ${data.feedback.down} 👎 · ${\n data.feedback.rate ?? \"—\"\n }% notées

= 10\n ? \"red\"\n : data.counts.failureRate >= 3\n ? \"amber\"\n : \"green\"\n }\">Taux d'échec${data.counts.failureRate}%${data.counts.failed} questions sans réponse / ${data.counts.attempts} tentatives

Graphiques

Activité

Réponses, conversations et utilisateurs par jour.

${activityChart}

Latence en secondes

Moyenne et médiane par jour.

${latencyChart}

Top utilisateurs

${\n bars(data.distributions.users, data.counts.totalAgent)\n }

Satisfaction

${\n data.feedback.total\n ? `

👍 ${data.feedback.up}= 70\n ? \"var(--green)\"\n : \"var(--amber)\"\n }\">${data.feedback.score}%👎 ${data.feedback.down}

${data.feedback.total} avis · couverture ${\n data.feedback.rate ?? 0\n }%

`\n : `

Aucun feedback sur cette période

`\n }

Modèles

${\n bars(data.distributions.models, data.counts.totalAgent)\n }

Versions

${\n bars(data.distributions.versions, data.counts.totalAgent)\n }

Origines

${\n bars(data.distributions.origins, data.counts.totalAgent)\n }

Irritants feedback 👎

${\n bars(\n data.feedback.negTags,\n Math.max(1, data.feedback.down),\n \"Aucun feedback négatif tagué\",\n )\n }

Feedbacks

${feedbackRows}

Date	Note	Tags	Commentaire	Utilisateur	Conv. ID	Version	Modèle

Page ${f.fbPage}/${data.counts.fbTotalPages} · ${\n fbPageFrom.toLocaleString(\"fr-FR\")\n }–${fbPageTo.toLocaleString(\"fr-FR\")} sur ${\n data.counts.fbTotalRows.toLocaleString(\"fr-FR\")\n } feedbacks

${\n paginationLinks(\n baseUrl,\n shared,\n \"fb_page\",\n f.fbPage,\n data.counts.fbTotalPages,\n {\n page: f.page,\n },\n )\n }

Réponses agent

${responseRows}

Voir	Date	Utilisateur	Question	Tps rép.	Version	Modèle	Conv.	Origine

Page ${f.page}/${data.counts.totalPages} · ${\n pageFrom.toLocaleString(\"fr-FR\")\n }–${pageTo.toLocaleString(\"fr-FR\")} sur ${\n data.counts.totalResponses.toLocaleString(\"fr-FR\")\n } réponses

${\n paginationLinks(baseUrl, shared, \"page\", f.page, data.counts.totalPages, {\n fb_page: f.fbPage,\n })\n }

Maintenance

🗑 Purger les logs anciens

Supprime les entrées de ge_logs antérieures à la durée choisie.

🧹 Purger utilisateurs de test

Supprime ge_logs et ge_feedback pour un user_id factice utilisé en test.

📥 Exports CSV

Télécharge jusqu’à 5 000 lignes avec les filtres actifs.

ge_logs.csv ge_feedback.csv

\n`;\n}",[211],"c8c747a0-4ed7-11f1-beb2-ee650bb23af1","dashboardUi.ts","c8c74868-4ed7-11f1-beb2-ee650bb23af1",["D",1778682411837],"// dashboardUi.ts — Helpers UI / CSV / formats pour dashboard\n// v3 : restaure le rendu SVG de la sauvegarde (tailles de police fixes, y compris en zoom)\n\nexport type Row = Record;\n\nexport type ChartSeries = {\n label: string;\n color: string;\n values: (number | null)[];\n};\nexport type ChartData = {\n xl: number;\n xr: number;\n n: number;\n yt: number;\n yb: number;\n fmt: \"count\" | \"seconds\";\n labels: string[];\n series: { l: string; c: string; v: (number | null)[] }[];\n};\n\nexport function h(v: unknown): string {\n return String(v ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nexport function js(v: unknown): string {\n return JSON.stringify(v).replace(/<\\/script/gi, \"<\\\\/script\").replace(\n /

Diff · v785