SAMI.TECH — Retours Ecotrack

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_376":377,"_378":379},"routes/_app.x.$handle.$name",{"_107":106,"_38":52,"_116":97,"_33":117,"_13":14,"_118":-5,"_11":119,"_120":121,"_122":123,"_124":125,"_126":127,"_26":-5,"_128":-5,"_129":-5,"_130":31,"_131":132,"_133":66,"_134":-5,"_135":-5,"_136":137},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_50":51,"_38":52,"_45":53,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":90,"_91":92,"_93":94,"_95":31},"version",33,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","87b0a069-464f-4009-bf7e-6a60771d81f3","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":39,"_40":41,"_42":44,"_45":46,"_47":14,"_48":49,"_30":31},"previous",{"_36":37,"_38":39,"_40":41,"_42":43},"deleted",false,"deletedHere","path","backend/ecotrack.ts","latestPath","fileId","76780022-b154-11f1-ac17-1607ee4eb77e","name","ecotrack.ts","fileType","script","content","/**\n * Client de l'API Ecotrack / OM Express.\n *\n * Règles absolues :\n * - le token reste côté serveur (jamais renvoyé au frontend, jamais loggé) ;\n * - lecture d'un colis : GET /api/v1/get/orders?tracking=...\n * - validation retour : POST /api/v1/valid/returns { trackings: [ ... ] }\n * - routes interdites : /retours/recu/validated et /api/v1/valid/order\n */\nimport { deleteSetting, getSetting, setSetting } from \"./db.ts\";\nimport { extractStatusValue, normalizeStatus } from \"../shared/status.ts\";\n\nconst CREDENTIALS_KEY = \"ecotrack_api_credentials\";\nconst API_BASE = \"https://omexpress.ecotrack.dz/api/v1\";\n\nexport type EcotrackCredentials = { apiToken: string };\n\nexport type OrderLookup =\n | {\n kind: \"found\";\n tracking: string;\n statusRaw: string;\n status: string;\n order: Record;\n }\n | { kind: \"not_found\" }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nexport type MutationResult =\n | { kind: \"success\" }\n | { kind: \"fail\" }\n | { kind: \"invalid\"; message: string; status: number }\n | { kind: \"api_error\"; status: number }\n | { kind: \"network_error\" }\n | { kind: \"unexpected\"; status: number };\n\n/* ------------------------------------------------------------------ */\n/* Credentials (stockés côté serveur, en base) */\n/* ------------------------------------------------------------------ */\n\nexport async function getCredentials(): Promise {\n const raw = await getSetting(CREDENTIALS_KEY);\n if (!raw) return null;\n try {\n const parsed = JSON.parse(raw) as { apiToken?: unknown };\n const apiToken = typeof parsed.apiToken === \"string\" ? parsed.apiToken.trim() : \"\";\n return apiToken ? { apiToken } : null;\n } catch {\n return null;\n }\n}\n\nexport async function saveCredentials(apiToken: string): Promise {\n await setSetting(CREDENTIALS_KEY, JSON.stringify({ apiToken: apiToken.trim() }));\n}\n\nexport async function deleteCredentials(): Promise {\n await deleteSetting(CREDENTIALS_KEY);\n}\n\n/* ------------------------------------------------------------------ */\n/* Appels HTTP */\n/* ------------------------------------------------------------------ */\n\nasync function ecotrackFetch(\n path: string,\n apiToken: string,\n init: { method: \"GET\" | \"POST\"; body?: string; contentType?: string } = { method: \"GET\" },\n): Promise {\n const headers = new Headers();\n headers.set(\"Accept\", \"application/json\");\n headers.set(\"Authorization\", `Bearer ${apiToken}`);\n if (init.contentType) headers.set(\"Content-Type\", init.contentType);\n // Le token peut aussi être transmis côté serveur via `api_token`.\n const separator = path.includes(\"?\") ? \"&\" : \"?\";\n const url = `${API_BASE}${path}${separator}api_token=${encodeURIComponent(apiToken)}`;\n return await fetch(url, { method: init.method, headers, body: init.body });\n}\n\n/** Vérifie la validité du token auprès d'Ecotrack. */\nexport async function validateToken(apiToken: string): Promise<{ ok: boolean; status: number }> {\n try {\n const response = await ecotrackFetch(\"/validate/token\", apiToken);\n return { ok: response.ok, status: response.status };\n } catch {\n return { ok: false, status: 0 };\n }\n}\n\n/* ------------------------------------------------------------------ */\n/* Lecture d'un colis */\n/* ------------------------------------------------------------------ */\n\nfunction asRecord(value: unknown): Record | null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record)\n : null;\n}\n\nfunction collectOrders(payload: unknown): Record[] {\n if (Array.isArray(payload)) {\n return payload.map(asRecord).filter((item): item is Record => item !== null);\n }\n const root = asRecord(payload);\n if (!root) return [];\n for (const key of [\"data\", \"orders\", \"results\", \"items\", \"colis\"]) {\n const nested = root[key];\n if (Array.isArray(nested)) {\n return nested.map(asRecord).filter((item): item is Record => item !== null);\n }\n }\n return [root];\n}\n\nfunction orderTracking(order: Record): string {\n for (const key of [\"tracking\", \"tracking_number\", \"code\", \"numero\", \"barcode\", \"code_barre\"]) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim().toUpperCase();\n }\n return \"\";\n}\n\nfunction pickOrder(payload: unknown, tracking: string): Record | null {\n const orders = collectOrders(payload);\n if (orders.length === 0) return null;\n const wanted = tracking.trim().toUpperCase();\n const exact = orders.find((order) => orderTracking(order) === wanted);\n if (exact) return exact;\n // Pas de correspondance explicite : n'accepter qu'une commande réellement porteuse d'un statut.\n return orders.find((order) => extractStatusValue(order) !== \"\") ?? null;\n}\n\n/** Relit un colis et retourne son statut normalisé. */\nexport async function findOrder(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(`/get/orders?tracking=${encodeURIComponent(tracking)}`, apiToken);\n } catch {\n return { kind: \"network_error\" };\n }\n if (!response.ok) return { kind: \"read_error\", status: response.status };\n\n let payload: unknown;\n try {\n payload = await response.json();\n } catch {\n return { kind: \"bad_response\" };\n }\n\n const order = pickOrder(payload, tracking);\n if (!order) return { kind: \"not_found\" };\n\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n}\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour (mutation) */\n/* ------------------------------------------------------------------ */\n\nfunction extractMessage(text: string): string {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.message === \"string\") return parsed.message;\n if (typeof parsed.error === \"string\") return parsed.error;\n } catch {\n /* corps non JSON */\n }\n return \"\";\n}\n\n/**\n * POST /api/v1/valid/returns — endpoint officiel de validation d'un retour.\n * Ne jamais appeler cette fonction sans avoir revérifié l'éligibilité côté serveur.\n */\nexport async function mutateReturn(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(\"/valid/returns\", apiToken, {\n method: \"POST\",\n contentType: \"application/json\",\n body: JSON.stringify({ trackings: [tracking] }),\n });\n } catch {\n return { kind: \"network_error\" };\n }\n\n const text = await response.text().catch(() => \"\");\n const emptyBody = text.trim() === \"\";\n let returned: string | null = null;\n if (!emptyBody) {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.returned === \"string\") returned = parsed.returned;\n } catch {\n /* corps non JSON */\n }\n }\n\n // Télémétrie sûre uniquement : jamais de token, jamais de body brut.\n console.log(\n JSON.stringify({\n evt: \"return_validate\",\n httpStatus: response.status,\n returned,\n emptyBody,\n }),\n );\n\n if (response.status === 422) {\n return { kind: \"invalid\", message: extractMessage(text), status: response.status };\n }\n if (!response.ok) return { kind: \"api_error\", status: response.status };\n if (returned === \"success\") return { kind: \"success\" };\n if (returned === \"fail\") return { kind: \"fail\" };\n return { kind: \"unexpected\", status: response.status };\n}","/**\n * Client de l'API Ecotrack / OM Express.\n *\n * Règles absolues :\n * - le token reste côté serveur (jamais renvoyé au frontend, jamais loggé) ;\n * - lecture d'un colis : GET /api/v1/get/orders?tracking=...\n * - validation retour : POST /api/v1/valid/returns { trackings: [ ... ] }\n * - routes interdites : /retours/recu/validated et /api/v1/valid/order\n */\nimport { deleteSetting, getSetting, setSetting } from \"./db.ts\";\nimport { extractStatusValue, normalizeStatus } from \"../shared/status.ts\";\n\nconst CREDENTIALS_KEY = \"ecotrack_api_credentials\";\nconst API_BASE = \"https://omexpress.ecotrack.dz/api/v1\";\n\nexport type EcotrackCredentials = { apiToken: string };\n\nexport type OrderLookup =\n | {\n kind: \"found\";\n tracking: string;\n statusRaw: string;\n status: string;\n order: Record;\n }\n | { kind: \"not_found\"; payloadKeys: string[] }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nexport type MutationResult =\n | { kind: \"success\" }\n | { kind: \"fail\" }\n | { kind: \"invalid\"; message: string; status: number }\n | { kind: \"api_error\"; status: number }\n | { kind: \"network_error\" }\n | { kind: \"unexpected\"; status: number };\n\n/* ------------------------------------------------------------------ */\n/* Credentials (stockés côté serveur, en base) */\n/* ------------------------------------------------------------------ */\n\nexport async function getCredentials(): Promise {\n const raw = await getSetting(CREDENTIALS_KEY);\n if (!raw) return null;\n try {\n const parsed = JSON.parse(raw) as { apiToken?: unknown };\n const apiToken = typeof parsed.apiToken === \"string\" ? parsed.apiToken.trim() : \"\";\n return apiToken ? { apiToken } : null;\n } catch {\n return null;\n }\n}\n\nexport async function saveCredentials(apiToken: string): Promise {\n await setSetting(CREDENTIALS_KEY, JSON.stringify({ apiToken: apiToken.trim() }));\n}\n\nexport async function deleteCredentials(): Promise {\n await deleteSetting(CREDENTIALS_KEY);\n}\n\n/* ------------------------------------------------------------------ */\n/* Appels HTTP */\n/* ------------------------------------------------------------------ */\n\nasync function ecotrackFetch(\n path: string,\n apiToken: string,\n init: { method: \"GET\" | \"POST\"; body?: string; contentType?: string } = { method: \"GET\" },\n): Promise {\n const headers = new Headers();\n headers.set(\"Accept\", \"application/json\");\n headers.set(\"Authorization\", `Bearer ${apiToken}`);\n if (init.contentType) headers.set(\"Content-Type\", init.contentType);\n // Le token peut aussi être transmis côté serveur via `api_token`.\n const separator = path.includes(\"?\") ? \"&\" : \"?\";\n const url = `${API_BASE}${path}${separator}api_token=${encodeURIComponent(apiToken)}`;\n return await fetch(url, { method: init.method, headers, body: init.body });\n}\n\n/** Vérifie la validité du token auprès d'Ecotrack. */\nexport async function validateToken(apiToken: string): Promise<{ ok: boolean; status: number }> {\n try {\n const response = await ecotrackFetch(\"/validate/token\", apiToken);\n return { ok: response.ok, status: response.status };\n } catch {\n return { ok: false, status: 0 };\n }\n}\n\n/* ------------------------------------------------------------------ */\n/* Lecture d'un colis */\n/* ------------------------------------------------------------------ */\n\nfunction asRecord(value: unknown): Record | null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record)\n : null;\n}\n\nfunction collectOrders(payload: unknown): Record[] {\n if (Array.isArray(payload)) {\n return payload.map(asRecord).filter((item): item is Record => item !== null);\n }\n const root = asRecord(payload);\n if (!root) return [];\n for (const key of [\"data\", \"orders\", \"results\", \"items\", \"colis\"]) {\n const nested = root[key];\n if (Array.isArray(nested)) {\n return nested.map(asRecord).filter((item): item is Record => item !== null);\n }\n }\n return [root];\n}\n\nfunction orderTracking(order: Record): string {\n for (const key of [\"tracking\", \"tracking_number\", \"code\", \"numero\", \"barcode\", \"code_barre\"]) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim().toUpperCase();\n }\n return \"\";\n}\n\nfunction pickOrder(payload: unknown, tracking: string): Record | null {\n const orders = collectOrders(payload);\n if (orders.length === 0) return null;\n const wanted = tracking.trim().toUpperCase();\n const exact = orders.find((order) => orderTracking(order) === wanted);\n if (exact) return exact;\n // Pas de correspondance explicite : n'accepter qu'une commande réellement porteuse d'un statut.\n return orders.find((order) => extractStatusValue(order) !== \"\") ?? null;\n}\n\n/** Relit un colis et retourne son statut normalisé. */\nexport async function findOrder(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(`/get/orders?tracking=${encodeURIComponent(tracking)}`, apiToken);\n } catch {\n return { kind: \"network_error\" };\n }\n if (!response.ok) return { kind: \"read_error\", status: response.status };\n\n let payload: unknown;\n try {\n payload = await response.json();\n } catch {\n return { kind: \"bad_response\" };\n }\n\n const order = pickOrder(payload, tracking);\n if (!order) return { kind: \"not_found\" };\n\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n}\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour (mutation) */\n/* ------------------------------------------------------------------ */\n\nfunction extractMessage(text: string): string {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.message === \"string\") return parsed.message;\n if (typeof parsed.error === \"string\") return parsed.error;\n } catch {\n /* corps non JSON */\n }\n return \"\";\n}\n\n/**\n * POST /api/v1/valid/returns — endpoint officiel de validation d'un retour.\n * Ne jamais appeler cette fonction sans avoir revérifié l'éligibilité côté serveur.\n */\nexport async function mutateReturn(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(\"/valid/returns\", apiToken, {\n method: \"POST\",\n contentType: \"application/json\",\n body: JSON.stringify({ trackings: [tracking] }),\n });\n } catch {\n return { kind: \"network_error\" };\n }\n\n const text = await response.text().catch(() => \"\");\n const emptyBody = text.trim() === \"\";\n let returned: string | null = null;\n if (!emptyBody) {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.returned === \"string\") returned = parsed.returned;\n } catch {\n /* corps non JSON */\n }\n }\n\n // Télémétrie sûre uniquement : jamais de token, jamais de body brut.\n console.log(\n JSON.stringify({\n evt: \"return_validate\",\n httpStatus: response.status,\n returned,\n emptyBody,\n }),\n );\n\n if (response.status === 422) {\n return { kind: \"invalid\", message: extractMessage(text), status: response.status };\n }\n if (!response.ok) return { kind: \"api_error\", status: response.status };\n if (returned === \"success\") return { kind: \"success\" };\n if (returned === \"fail\") return { kind: \"fail\" };\n return { kind: \"unexpected\", status: response.status };\n}","createdAt",["D",1789511883727],"branchVersion","branchId","ff158aab-0096-40a5-8840-6ecf75e68750","id","ad65941b-e0c0-4a5b-89cf-11fa973d849a","sami-tech-retours",["D",1789511143425],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Scanner QR retours Ecotrack / OM Express + validation","imageUrl","0afb5d64-ebeb-4598-bd32-72c469e46178","pinnedFileId","7d7be91a-b154-11f1-ac17-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0a729-dd66-7509-8ac1-c1c985b77337","tursoName","ad65941be0c04a5b89cf11fa973d849a","tursoHostname","ad65941be0c04a5b89cf11fa973d849a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789696237964],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_107":106,"_115":111},"org",{"_107":106,"_108":109,"_110":111,"_19":62,"_112":113,"_114":31},"branch",{"_13":96,"_38":97,"_50":49,"_98":51,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":52,"_105":106},"isOwned",85,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","voidmarket","handle","displayName","sam rad","avatar","https://lh3.googleusercontent.com/a/ACg8ocLICX6mI-c9kDJUPFWRkbqww500mXryFODjCM8HOcTYTBsqIA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_50":51,"_38":52,"_45":371,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":372,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":373,"_91":374,"_93":375,"_95":31},"tree",[189,193,208,211,212],"files",[189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212],"counts",{"_179":70,"_180":163,"_181":70,"_182":183,"_184":185},"contents",[138,139,140,141,142],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_50":173,"_38":174,"_36":175,"_145":-5,"_48":49,"_47":176,"_147":66,"_45":177,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_33":178},{"_50":167,"_38":168,"_36":169,"_145":-5,"_48":49,"_47":170,"_147":66,"_45":171,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_33":172},{"_50":160,"_38":161,"_36":162,"_145":-5,"_48":49,"_47":163,"_147":66,"_45":164,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_33":166},{"_50":153,"_38":154,"_36":155,"_145":-5,"_48":49,"_47":156,"_147":66,"_45":157,"_13":70,"_40":26,"_42":158,"_30":31,"_151":-5,"_33":159},{"_50":143,"_38":144,"_36":64,"_145":-5,"_48":49,"_47":146,"_147":31,"_45":148,"_13":70,"_40":149,"_42":150,"_30":31,"_151":-5,"_33":152},"b3babdb7-26c6-4df9-a517-cc21a6fcd1ba","index.ts","parentId",6,"latest",["D",1789511186577],"http","/**\n * SAMI.TECH — Retours Ecotrack\n * Backend HTTP (Hono) : verrouillage schéma 3x3, configuration Ecotrack,\n * vérification de tracking et validation officielle des retours.\n *\n * Projet totalement indépendant des autres applications SAMI.TECH :\n * aucune logique, aucun code, aucune base partagée.\n */\nimport { Hono } from \"npm:hono@4\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { ensureSchema } from \"./backend/db.ts\";\nimport {\n clearCookieHeader,\n createSession,\n destroySession,\n hasValidSession,\n isPatternConfigured,\n requireSession,\n sessionCookieHeader,\n setPattern,\n verifyPattern,\n} from \"./backend/access.ts\";\nimport {\n deleteCredentials,\n findOrder,\n getCredentials,\n mutateReturn,\n saveCredentials,\n} from \"./backend/ecotrack.ts\";\nimport { isReturnReadyStatus, isReturnValidatedStatus } from \"./shared/status.ts\";\nimport { extractTracking } from \"./shared/tracking.ts\";\n\nconst app = new Hono();\n\n/* ------------------------------------------------------------------ */\n/* Helpers */\n/* ------------------------------------------------------------------ */\n\nasync function readJson(request: Request): Promise | null> {\n try {\n const data = await request.json();\n return data && typeof data === \"object\" && !Array.isArray(data)\n ? (data as Record)\n : null;\n } catch {\n return null;\n }\n}\n\nfunction bodyString(body: Record | null, key: string): string {\n const value = body?.[key];\n return typeof value === \"string\" ? value : \"\";\n}\n\n/** Relecture du colis pour confirmer une validation ambiguë (jamais de 2e mutation). */\nasync function confirmValidated(apiToken: string, tracking: string): Promise {\n for (let attempt = 0; attempt < 3; attempt++) {\n await new Promise((resolve) => setTimeout(resolve, 1200));\n const lookup = await findOrder(apiToken, tracking);\n if (lookup.kind === \"found\" && isReturnValidatedStatus(lookup.statusRaw)) return true;\n }\n return false;\n}\n\n/* ------------------------------------------------------------------ */\n/* Santé */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/health\", (c) => c.json({ ok: true }));\n\n/* ------------------------------------------------------------------ */\n/* Accès (schéma 3x3) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/access/status\", async (c) => {\n const configured = await isPatternConfigured();\n const unlocked = configured ? await hasValidSession(c.req.raw) : false;\n return c.json({ ok: true, configured, unlocked });\n});\n\napp.post(\"/api/access/setup\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!/^\\d{4,9}$/.test(pattern)) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 400);\n }\n if (await isPatternConfigured()) {\n return c.json({ ok: false, code: \"ALREADY_CONFIGURED\" }, 409);\n }\n await setPattern(pattern);\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/unlock\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!(await isPatternConfigured())) {\n return c.json({ ok: false, code: \"NOT_CONFIGURED\" }, 409);\n }\n if (!(await verifyPattern(pattern))) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 401);\n }\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/logout\", async (c) => {\n await destroySession(c.req.raw);\n c.header(\"Set-Cookie\", clearCookieHeader());\n return c.json({ ok: true });\n});\n\n/* ------------------------------------------------------------------ */\n/* Configuration */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/config\", async (c) => {\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.get(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.post(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const apiToken = bodyString(await readJson(c.req.raw), \"apiToken\").trim();\n if (apiToken.length < 8) return c.json({ ok: false, code: \"INVALID_TOKEN\" }, 400);\n await saveCredentials(apiToken);\n return c.json({ ok: true, apiSaved: true });\n});\n\napp.delete(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n await deleteCredentials();\n return c.json({ ok: true, apiSaved: false });\n});\n\n/* ------------------------------------------------------------------ */\n/* Tracking */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n const lookup = await findOrder(credentials.apiToken, tracking);\n switch (lookup.kind) {\n case \"not_found\":\n return c.json({ ok: false, code: \"TRACKING_NOT_FOUND\", tracking }, 404);\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: lookup.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n\n return c.json({\n ok: true,\n code: \"TRACKING_FOUND\",\n tracking: lookup.tracking,\n status: lookup.status,\n statusRaw: lookup.statusRaw,\n ready: isReturnReadyStatus(lookup.statusRaw),\n alreadyValidated: isReturnValidatedStatus(lookup.statusRaw),\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/return/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n // 1. Vérification serveur obligatoire AVANT toute mutation.\n const pre = await findOrder(credentials.apiToken, tracking);\n switch (pre.kind) {\n case \"not_found\":\n return c.json({ ok: false, code: \"TRACKING_NOT_FOUND\", tracking }, 404);\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: pre.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n if (!isReturnReadyStatus(pre.statusRaw)) {\n return c.json({ ok: false, code: \"RETURN_NOT_READY\", tracking, status: pre.status }, 409);\n }\n\n // 2. Mutation officielle : POST /api/v1/valid/returns\n const mutation = await mutateReturn(credentials.apiToken, tracking);\n switch (mutation.kind) {\n case \"network_error\":\n return c.json({ ok: false, code: \"RETURN_NETWORK_ERROR\", tracking }, 502);\n case \"api_error\":\n return c.json({ ok: false, code: \"RETURN_API_ERROR\", status: mutation.status, tracking }, 502);\n case \"invalid\":\n return c.json(\n { ok: false, code: \"RETURN_INVALID\", message: mutation.message, tracking },\n 422,\n );\n case \"fail\":\n return c.json({ ok: false, code: \"RETURN_NOT_ELIGIBLE\", tracking }, 409);\n case \"success\":\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n\n // 3. Réponse vide / inattendue : ne JAMAIS annoncer le succès sans confirmation.\n const confirmed = await confirmValidated(credentials.apiToken, tracking);\n if (confirmed) {\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n return c.json({\n ok: true,\n code: \"RETURN_ACCEPTED_UNCONFIRMED\",\n tracking,\n confirmed: false,\n detail: \"Requête reçue par OM Express, validation non confirmée.\",\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Frontend (assets statiques, transpilés par Val Town) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", (c) => serveFile(c.req.path, import.meta.url));\n\napp.notFound((c) => {\n if (c.req.path.startsWith(\"/api/\")) {\n return c.json({ ok: false, code: \"NOT_FOUND\" }, 404);\n }\n return c.text(\"Not found\", 404);\n});\n\n// Initialisation de la base au démarrage : ne doit jamais casser /health.\ntry {\n await ensureSchema();\n} catch (error) {\n console.error(\"schema init failed\", error instanceof Error ? error.message : error);\n}\n\nexport default app.fetch;","label",[144],"cb365bb7-4319-4c82-be9f-cd9af9c1c2f5","README.md","ba4dfe96-b154-11f1-bc07-1607ee4eb77e",19,["D",1789511288587],"# SAMI.TECH — Retours Ecotrack\n\nApplication mobile de scan de QR codes de colis retournés, avec vérification du statut dans\n**OM Express / Ecotrack** et validation officielle du retour.\n\nProjet **totalement indépendant** des autres applications SAMI.TECH : code, logique, base SQLite\net fonctions propres à ce val.\n\n## Principe\n\n1. Déverrouillage par **schéma Android 3×3** (hash PBKDF2-SHA256 salé, côté serveur).\n2. La **caméra arrière démarre automatiquement** après déverrouillage et **ne se ferme plus**.\n3. Le **scanner QR reste actif en continu** : QR détecté → pause logique → traitement → reprise.\n4. Le **backend** relit le colis dans Ecotrack et décide seul de l'éligibilité.\n5. La validation n'est proposée que pour `retour_recu` ou `livraison_echoue_recu`.\n\n## Niveaux de fiabilité (toujours distingués)\n\n| Niveau | Signification |\n| --- | --- |\n| 1 | QR détecté |\n| 2 | Tracking trouvé dans OM Express |\n| 3 | Tracking éligible au retour (`retour_recu` / `livraison_echoue_recu`) |\n| 4 | Retour réellement validé (`returned = \"success\"` ou confirmation après relecture) |\n\nUn QR détecté ne signifie **jamais** que le retour est validé.\n\n## Architecture\n\n```mermaid\ngraph TD\n A[index.ts — Hono] --> B[backend/access.ts — schéma 3x3 + sessions]\n A --> C[backend/ecotrack.ts — API OM Express]\n A --> D[backend/db.ts — SQLite projet]\n A --> E[shared/status.ts + shared/tracking.ts]\n A --> F[frontend/index.html + root.tsx]\n F --> G[components/App.tsx — machine à états]\n G --> H[PatternGate.tsx]\n G --> I[Scanner.tsx — BarcodeDetector + jsQR]\n G --> J[StatusPanel / ManualEntry / HistoryList / Settings]\n E --> I\n```\n\n## Routes\n\n| Méthode | Route | Rôle |\n| --- | --- | --- |\n| GET | `/health` | Santé (`{ \"ok\": true }`) |\n| GET | `/api/access/status` | Schéma configuré ? session ouverte ? |\n| POST | `/api/access/setup` | Créer le schéma (une seule fois) |\n| POST | `/api/access/unlock` | Déverrouiller (cookie `sami_access`, ~12 h) |\n| POST | `/api/access/logout` | Verrouiller |\n| GET | `/api/config` | `apiSaved` |\n| GET/POST/DELETE | `/api/ecotrack/settings` | Token API (jamais réaffiché) |\n| POST | `/api/validate` | Vérifier un tracking |\n| POST | `/api/return/validate` | Valider un retour (mutation) |\n\n## API Ecotrack utilisée\n\n- Vérification token : `GET /api/v1/validate/token`\n- Lecture colis : `GET /api/v1/get/orders?tracking=...`\n- **Validation retour : `POST /api/v1/valid/returns`** avec `{ \"trackings\": [\"...\"] }`\n\n### Routes interdites\n\n- `/retours/recu/validated` — dépendait d'une session web Ecotrack (HTTP 403).\n- `/api/v1/valid/order` — autre opération, ne remplace pas `/valid/returns`.\n\n## Codes métier backend\n\n`API_NOT_CONFIGURED`, `ECOTRACK_READ_ERROR`, `ECOTRACK_BAD_RESPONSE`, `TRACKING_NOT_FOUND`,\n`TRACKING_FOUND`, `ECOTRACK_NETWORK_ERROR`, `RETURN_NOT_READY`, `RETURN_INVALID`,\n`RETURN_API_ERROR`, `RETURN_NOT_ELIGIBLE`, `RETURN_VALIDATED`, `RETURN_ACCEPTED_UNCONFIRMED`,\n`RETURN_UNEXPECTED_RESPONSE`, `RETURN_NETWORK_ERROR`.\n\n## Sécurité\n\n- Le token API est stocké **côté serveur** dans `app_settings.ecotrack_api_credentials`\n (clé `ecotrack_api_credentials`, format `{ \"apiToken\": \"...\" }`).\n- Il n'est **jamais** renvoyé au navigateur, jamais loggé, jamais placé en URL publique.\n- Le schéma est stocké sous forme de hash salé ; les sessions ne stockent que le SHA-256 du token.\n- Les logs de validation ne contiennent que `httpStatus`, `returned` et `emptyBody`.\n\n## Premier lancement\n\n1. Ouvrir [l'application](url:index.ts) — le schéma 3×3 est demandé (à créer puis confirmer).\n2. Icône ⚙ → coller le **token API Ecotrack** → `ENREGISTRER L'API`.\n3. La caméra démarre automatiquement : scanner un QR de colis.\n4. Si le colis est éligible, `VALIDER LE RETOUR` apparaît ; sinon le scanner reprend seul.\n\n> La base SQLite et les réglages sont propres à ce val. Aucune donnée n'est partagée avec une\n> autre application SAMI.TECH.",[154],"1f6fa16e-5c7c-4980-84f4-6be2d6a11da3","shared","bdc31962-8a03-4e1e-b919-22d73d4d7c5b",1,["D",1789511156942],"directory",[161],"d059b4c5-52dc-4b09-b505-15182f5cefe4","frontend","073bfc8f-0576-4e69-b7c4-68b0645cad94",7,["D",1789511212578],[168],"0f5af76f-7d2c-4035-9d53-5e115fec2804","backend","cb9b26c6-3552-462f-9d4a-105dd9b5b222",3,["D",1789511156996],[174],"pulls","branches","forks","envVars",{"_186":70,"_188":70},"connections",{"_186":70,"_187":70},"count","unfilledCount","emptyCount",{"_50":173,"_38":174,"_36":175,"_145":-5,"_48":49,"_47":176,"_147":66,"_45":368,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_214":369,"_33":370},{"_50":360,"_38":361,"_36":362,"_145":175,"_48":49,"_47":363,"_147":66,"_45":364,"_13":70,"_40":41,"_42":365,"_30":31,"_151":-5,"_214":366,"_33":367},{"_50":353,"_38":354,"_36":355,"_145":175,"_48":49,"_47":176,"_147":31,"_45":356,"_13":70,"_40":41,"_42":357,"_30":31,"_151":-5,"_214":358,"_33":359},{"_50":349,"_38":39,"_36":37,"_145":175,"_48":49,"_47":14,"_147":31,"_45":350,"_13":163,"_40":41,"_42":44,"_30":31,"_151":-5,"_214":351,"_33":352},{"_50":167,"_38":168,"_36":169,"_145":-5,"_48":49,"_47":170,"_147":66,"_45":346,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_214":347,"_33":348},{"_50":342,"_38":293,"_36":287,"_145":169,"_48":49,"_47":313,"_147":66,"_45":343,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_214":344,"_33":345},{"_50":334,"_38":335,"_36":336,"_145":287,"_48":49,"_47":337,"_147":31,"_45":338,"_13":70,"_40":41,"_42":339,"_30":31,"_151":-5,"_214":340,"_33":341},{"_50":326,"_38":327,"_36":328,"_145":287,"_48":49,"_47":329,"_147":66,"_45":330,"_13":70,"_40":41,"_42":331,"_30":31,"_151":-5,"_214":332,"_33":333},{"_50":318,"_38":319,"_36":320,"_145":287,"_48":49,"_47":321,"_147":66,"_45":322,"_13":70,"_40":41,"_42":323,"_30":31,"_151":-5,"_214":324,"_33":325},{"_50":310,"_38":311,"_36":312,"_145":287,"_48":49,"_47":313,"_147":66,"_45":314,"_13":70,"_40":41,"_42":315,"_30":31,"_151":-5,"_214":316,"_33":317},{"_50":302,"_38":303,"_36":304,"_145":287,"_48":49,"_47":305,"_147":66,"_45":306,"_13":280,"_40":41,"_42":307,"_30":31,"_151":-5,"_214":308,"_33":309},{"_50":294,"_38":295,"_36":296,"_145":287,"_48":49,"_47":297,"_147":66,"_45":298,"_13":70,"_40":41,"_42":299,"_30":31,"_151":-5,"_214":300,"_33":301},{"_50":284,"_38":285,"_36":286,"_145":287,"_48":49,"_47":288,"_147":66,"_45":289,"_13":163,"_40":41,"_42":290,"_30":31,"_151":-5,"_214":291,"_33":292},{"_50":279,"_38":270,"_36":264,"_145":169,"_48":49,"_47":280,"_147":66,"_45":281,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_214":282,"_33":283},{"_50":271,"_38":272,"_36":273,"_145":264,"_48":49,"_47":274,"_147":31,"_45":275,"_13":163,"_40":41,"_42":276,"_30":31,"_151":-5,"_214":277,"_33":278},{"_50":261,"_38":262,"_36":263,"_145":264,"_48":49,"_47":265,"_147":66,"_45":266,"_13":163,"_40":41,"_42":267,"_30":31,"_151":-5,"_214":268,"_33":269},{"_50":254,"_38":255,"_36":256,"_145":169,"_48":49,"_47":170,"_147":66,"_45":257,"_13":70,"_40":26,"_42":258,"_30":31,"_151":-5,"_214":259,"_33":260},{"_50":246,"_38":247,"_36":248,"_145":169,"_48":49,"_47":249,"_147":66,"_45":250,"_13":70,"_40":41,"_42":251,"_30":31,"_151":-5,"_214":252,"_33":253},{"_50":238,"_38":239,"_36":240,"_145":169,"_48":49,"_47":241,"_147":31,"_45":242,"_13":163,"_40":26,"_42":243,"_30":31,"_151":-5,"_214":244,"_33":245},{"_50":160,"_38":161,"_36":162,"_145":-5,"_48":49,"_47":163,"_147":66,"_45":235,"_13":70,"_40":165,"_42":-5,"_30":31,"_151":-5,"_214":236,"_33":237},{"_50":228,"_38":229,"_36":230,"_145":162,"_48":49,"_47":163,"_147":31,"_45":231,"_13":70,"_40":41,"_42":232,"_30":31,"_151":-5,"_214":233,"_33":234},{"_50":220,"_38":221,"_36":222,"_145":162,"_48":49,"_47":223,"_147":66,"_45":224,"_13":70,"_40":41,"_42":225,"_30":31,"_151":-5,"_214":226,"_33":227},{"_50":153,"_38":154,"_36":155,"_145":-5,"_48":49,"_47":156,"_147":66,"_45":217,"_13":70,"_40":26,"_42":158,"_30":31,"_151":-5,"_214":218,"_33":219},{"_50":143,"_38":144,"_36":64,"_145":-5,"_48":49,"_47":146,"_147":31,"_45":213,"_13":70,"_40":149,"_42":150,"_30":31,"_151":-5,"_214":215,"_33":216},["D",1789511186577],"children",[],[144],["D",1789511288587],[],[154],"dd1deb99-f776-45fb-acf4-93e3a4d696f2","tracking.ts","6bd68792-b154-11f1-91d7-1607ee4eb77e",2,["D",1789511156972],"/**\n * Extraction d'un numéro de tracking depuis un contenu de QR code.\n *\n * Fonction pure, partagée entre le backend et le frontend.\n */\n\n/** Forme canonique d'un tracking : 6 à 64 caractères A-Z, 0-9, `_`, `-`. */\nconst TRACKING_SHAPE = /^[A-Z0-9_-]{6,64}$/;\n\n/** Recherche d'un tracking noyé dans un contenu plus large (URL, JSON, texte). */\nconst TRACKING_CANDIDATE = /[A-Z0-9][A-Z0-9_-]{5,63}/g;\n\n/** Nettoie une valeur : conserve A-Z, 0-9, `_`, `-` puis passe en majuscules. */\nexport function normalizeTracking(value: string): string {\n return value.replace(/[^A-Za-z0-9_-]/g, \"\").toUpperCase();\n}\n\n/** Vrai si la valeur a exactement la forme d'un tracking. */\nexport function isTrackingShape(value: string): boolean {\n return TRACKING_SHAPE.test(value);\n}\n\n/**\n * Extrait un tracking depuis un contenu de QR code.\n * Retourne une chaîne vide si rien d'exploitable n'est trouvé.\n */\nexport function extractTracking(raw: unknown): string {\n const text = typeof raw === \"string\" ? raw : String(raw ?? \"\");\n const trimmed = text.trim();\n if (!trimmed) return \"\";\n\n // Cas nominal : le QR contient uniquement le tracking.\n if (isTrackingShape(trimmed)) return trimmed.toUpperCase();\n\n // Cas secondaire : le tracking est noyé dans une URL ou un texte.\n const candidates = trimmed.toUpperCase().match(TRACKING_CANDIDATE) ?? [];\n\n // Priorité aux candidats mixtes lettres + chiffres (forme Ecotrack / OM Express).\n for (const candidate of candidates) {\n if (/[A-Z]/.test(candidate) && /\\d/.test(candidate)) return candidate;\n }\n // Puis aux candidats contenant une longue suite de chiffres.\n for (const candidate of candidates) {\n if (/\\d{6,}/.test(candidate)) return candidate;\n }\n return candidates[0] ?? \"\";\n}",[],[161,221],"db189fd4-ec30-4b68-9187-510aeca9d36b","status.ts","6bd26bbc-b154-11f1-91d7-1607ee4eb77e",["D",1789511156942],"/**\n * Normalisation et interprétation des statuts Ecotrack.\n *\n * Fonctions pures, partagées entre le backend (index.ts) et le frontend.\n * Source de vérité unique : ne jamais dupliquer cette logique ailleurs.\n */\n\n/** Statuts Ecotrack qui autorisent la validation du retour. */\nconst READY_STATUSES = new Set([\n \"retour_recu\",\n \"livraison_echoue_recu\",\n]);\n\n/** Statuts confirmant qu'un retour a déjà été validé (orthographe Ecotrack conservée). */\nconst VALIDATED_STATUSES = new Set([\n \"return_validated_by_partener\",\n \"return_validated_by_partner\",\n \"retour_valide\",\n \"retour_validee\",\n]);\n\n/** Clés possibles du statut dans une réponse Ecotrack. */\nconst STATUS_KEYS = [\"status_name\", \"status\", \"statut\", \"etat\", \"state\"];\n\n/**\n * Normalise un statut : chaîne, trim, minuscules, sans accents,\n * espaces et tirets remplacés par `_`.\n * Exemple : \"Retour Reçu\" -> \"retour_recu\"\n */\nexport function normalizeStatus(value: unknown): string {\n return String(value ?? \"\")\n .normalize(\"NFD\")\n .replace(/[\\u0300-\\u036f]/g, \"\")\n .trim()\n .toLowerCase()\n .replace(/[\\s-]+/g, \"_\")\n .replace(/_+/g, \"_\")\n .replace(/^_|_$/g, \"\");\n}\n\n/** Vrai uniquement pour `retour_recu` ou `livraison_echoue_recu`. */\nexport function isReturnReadyStatus(value: unknown): boolean {\n return READY_STATUSES.has(normalizeStatus(value));\n}\n\n/** Vrai si le statut indique qu'un retour a déjà été validé. */\nexport function isReturnValidatedStatus(value: unknown): boolean {\n return VALIDATED_STATUSES.has(normalizeStatus(value));\n}\n\n/** Extrait le statut brut d'une commande Ecotrack, quel que soit le champ utilisé. */\nexport function extractStatusValue(order: Record | null | undefined): string {\n if (!order) return \"\";\n for (const key of STATUS_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim();\n if (value && typeof value === \"object\") {\n const nested = value as Record;\n const candidate = nested.name ?? nested.label ?? nested.libelle;\n if (typeof candidate === \"string\" && candidate.trim()) return candidate.trim();\n }\n }\n return \"\";\n}",[],[161,229],["D",1789511156942],[209,210],[161],"ecabff56-4650-4a7c-8d42-fe7919563d7d","style.css","8d06e5ce-b154-11f1-b96e-1607ee4eb77e",22,["D",1789511824732],"/* SAMI.TECH — Retours Ecotrack : interface mobile (max 430 px) */\n\n:root {\n --bg: #04120c;\n --bg-soft: #071a12;\n --card: #0b2118;\n --card-2: #103024;\n --line: #1c4634;\n --text: #ffffff;\n --muted: #9db8ac;\n --accent: #35e59a;\n --accent-dim: #1d8f5f;\n --danger: #ff6b6b;\n --warn: #ffc857;\n --radius: 18px;\n}\n\n* {\n box-sizing: border-box;\n -webkit-tap-highlight-color: transparent;\n}\n\nhtml,\nbody {\n margin: 0;\n padding: 0;\n background: var(--bg);\n color: var(--text);\n}\n\nbody {\n font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n min-height: 100dvh;\n overscroll-behavior-y: contain;\n}\n\nbutton,\ninput {\n font-family: inherit;\n}\n\n.app {\n max-width: 430px;\n margin: 0 auto;\n padding: 14px 14px 34px;\n display: flex;\n flex-direction: column;\n gap: 12px;\n}\n\n.boot {\n padding: 60px 0;\n text-align: center;\n color: var(--muted);\n}\n\n.muted {\n color: var(--muted);\n font-size: 13px;\n line-height: 1.5;\n margin: 0;\n}\n\n/* ---------------------------------------------------------------- */\n/* En-tête */\n/* ---------------------------------------------------------------- */\n\n.app-header {\n display: flex;\n align-items: center;\n justify-content: space-between;\n gap: 10px;\n padding: 4px 2px 2px;\n}\n\n.brand {\n display: flex;\n flex-direction: column;\n gap: 2px;\n}\n\n.brand-mark {\n font-size: 19px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.brand-dot {\n color: var(--accent);\n}\n\n.brand-sub {\n font-size: 12px;\n color: var(--muted);\n letter-spacing: 0.4px;\n}\n\n.icon-btn {\n width: 42px;\n height: 42px;\n border-radius: 13px;\n border: 1px solid var(--line);\n background: var(--card);\n color: var(--text);\n font-size: 18px;\n line-height: 1;\n cursor: pointer;\n display: grid;\n place-items: center;\n}\n\n.icon-btn:active {\n background: var(--card-2);\n}\n\n/* ---------------------------------------------------------------- */\n/* Cartes */\n/* ---------------------------------------------------------------- */\n\n.card {\n background: var(--card);\n border: 1px solid var(--line);\n border-radius: var(--radius);\n padding: 14px;\n}\n\n.card-label {\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.4px;\n color: var(--muted);\n margin-bottom: 10px;\n}\n\n/* ---------------------------------------------------------------- */\n/* ÉTAT (au-dessus de la caméra) */\n/* ---------------------------------------------------------------- */\n\n.status-card {\n background: linear-gradient(180deg, #0c2419 0%, #0b2118 100%);\n}\n\n.status-line {\n display: flex;\n align-items: flex-start;\n gap: 10px;\n}\n\n.pulse {\n flex: none;\n width: 10px;\n height: 10px;\n margin-top: 5px;\n border-radius: 50%;\n background: var(--accent);\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0.6);\n animation: pulse 1.8s infinite;\n}\n\n@keyframes pulse {\n 0% {\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0.55);\n }\n 70% {\n box-shadow: 0 0 0 12px rgba(53, 229, 154, 0);\n }\n 100% {\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0);\n }\n}\n\n.status-text {\n margin: 0;\n font-size: 15px;\n font-weight: 600;\n line-height: 1.35;\n}\n\n.tracking-chip {\n margin-top: 12px;\n display: inline-flex;\n align-items: center;\n gap: 8px;\n padding: 7px 11px;\n border-radius: 999px;\n background: rgba(53, 229, 154, 0.12);\n border: 1px solid rgba(53, 229, 154, 0.35);\n font-size: 11px;\n letter-spacing: 1px;\n color: var(--muted);\n}\n\n.tracking-chip strong {\n color: var(--accent);\n font-size: 13px;\n letter-spacing: 0.5px;\n word-break: break-all;\n}\n\n/* ---------------------------------------------------------------- */\n/* Caméra / scanner */\n/* ---------------------------------------------------------------- */\n\n.scanner-card {\n padding: 0;\n overflow: hidden;\n}\n\n.scanner-stage {\n position: relative;\n width: 100%;\n aspect-ratio: 3 / 4;\n background: #020906;\n overflow: hidden;\n}\n\n.scanner-video {\n position: absolute;\n inset: 0;\n width: 100%;\n height: 100%;\n object-fit: cover;\n background: #020906;\n}\n\n.frame {\n position: absolute;\n left: 50%;\n top: 50%;\n transform: translate(-50%, -50%);\n width: 68%;\n aspect-ratio: 1 / 1;\n border: 2px solid rgba(255, 255, 255, 0.92);\n border-radius: 16px;\n transition: border-color 90ms linear, box-shadow 90ms linear;\n pointer-events: none;\n}\n\n.frame.scanned {\n border-color: var(--accent);\n box-shadow: 0 0 0 3px rgba(53, 229, 154, 0.28), 0 0 26px rgba(53, 229, 154, 0.5);\n}\n\n.corner {\n position: absolute;\n width: 26px;\n height: 26px;\n border: 3px solid rgba(255, 255, 255, 0.95);\n transition: border-color 90ms linear;\n}\n\n.frame.scanned .corner {\n border-color: var(--accent);\n}\n\n.corner-tl {\n top: -3px;\n left: -3px;\n border-right: none;\n border-bottom: none;\n border-top-left-radius: 16px;\n}\n\n.corner-tr {\n top: -3px;\n right: -3px;\n border-left: none;\n border-bottom: none;\n border-top-right-radius: 16px;\n}\n\n.corner-bl {\n bottom: -3px;\n left: -3px;\n border-right: none;\n border-top: none;\n border-bottom-left-radius: 16px;\n}\n\n.corner-br {\n bottom: -3px;\n right: -3px;\n border-left: none;\n border-top: none;\n border-bottom-right-radius: 16px;\n}\n\n.scanner-off {\n position: absolute;\n inset: 0;\n display: flex;\n flex-direction: column;\n align-items: center;\n justify-content: center;\n gap: 10px;\n color: var(--muted);\n font-size: 14px;\n font-weight: 600;\n background: rgba(2, 9, 6, 0.92);\n}\n\n.qr-icon {\n font-size: 30px;\n color: var(--accent);\n opacity: 0.85;\n}\n\n/* ---------------------------------------------------------------- */\n/* Saisie manuelle */\n/* ---------------------------------------------------------------- */\n\n.manual-row {\n display: flex;\n gap: 8px;\n}\n\n.manual-input {\n flex: 1 1 auto;\n min-width: 0;\n height: 46px;\n padding: 0 12px;\n border-radius: 12px;\n border: 1px solid var(--line);\n background: #071a12;\n color: var(--text);\n font-size: 15px;\n letter-spacing: 1px;\n text-transform: uppercase;\n outline: none;\n}\n\n.manual-input:focus {\n border-color: var(--accent-dim);\n}\n\n.manual-input::placeholder {\n color: #5f7a6e;\n letter-spacing: 0.5px;\n text-transform: none;\n}\n\n/* ---------------------------------------------------------------- */\n/* Boutons */\n/* ---------------------------------------------------------------- */\n\n.btn {\n border: 1px solid var(--line);\n background: var(--card-2);\n color: var(--text);\n border-radius: 12px;\n height: 46px;\n padding: 0 16px;\n font-size: 13px;\n font-weight: 700;\n letter-spacing: 1px;\n cursor: pointer;\n white-space: nowrap;\n}\n\n.btn:disabled {\n opacity: 0.55;\n cursor: default;\n}\n\n.btn-primary {\n width: 100%;\n height: 56px;\n font-size: 15px;\n border: none;\n color: #04120c;\n background: linear-gradient(180deg, #45f0a6 0%, var(--accent) 100%);\n box-shadow: 0 10px 26px rgba(53, 229, 154, 0.24);\n}\n\n.btn-primary:active:not(:disabled) {\n transform: translateY(1px);\n}\n\n.btn-danger {\n border-color: rgba(255, 107, 107, 0.5);\n color: var(--danger);\n background: rgba(255, 107, 107, 0.08);\n}\n\n/* ---------------------------------------------------------------- */\n/* Historique */\n/* ---------------------------------------------------------------- */\n\n.history-list {\n list-style: none;\n margin: 0;\n padding: 0;\n display: flex;\n flex-direction: column;\n gap: 7px;\n}\n\n.history-item {\n display: flex;\n align-items: center;\n gap: 9px;\n padding: 9px 11px;\n border-radius: 11px;\n background: #071a12;\n border: 1px solid var(--line);\n font-size: 13px;\n letter-spacing: 0.6px;\n word-break: break-all;\n}\n\n.history-check {\n flex: none;\n color: var(--accent);\n font-weight: 700;\n}\n\n/* ---------------------------------------------------------------- */\n/* Footer */\n/* ---------------------------------------------------------------- */\n\n.app-footer {\n text-align: center;\n font-size: 11px;\n color: #5f7a6e;\n line-height: 1.6;\n padding: 6px 4px 0;\n}\n\n/* ---------------------------------------------------------------- */\n/* Verrouillage (schéma 3x3) */\n/* ---------------------------------------------------------------- */\n\n.gate {\n max-width: 430px;\n margin: 0 auto;\n min-height: 100dvh;\n padding: 28px 20px 40px;\n display: flex;\n flex-direction: column;\n justify-content: center;\n gap: 18px;\n}\n\n.gate-head {\n text-align: center;\n}\n\n.gate-title {\n margin: 0 0 6px;\n font-size: 20px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.gate-hint {\n margin: 0;\n font-size: 13px;\n color: var(--muted);\n line-height: 1.5;\n}\n\n.pattern-wrap {\n position: relative;\n width: 100%;\n max-width: 290px;\n margin: 0 auto;\n aspect-ratio: 1 / 1;\n touch-action: none;\n user-select: none;\n}\n\n.pattern-svg {\n position: absolute;\n inset: 0;\n width: 100%;\n height: 100%;\n pointer-events: none;\n}\n\n.pattern-line {\n fill: none;\n stroke: var(--accent);\n stroke-width: 0.09;\n stroke-linecap: round;\n stroke-linejoin: round;\n}\n\n.pattern-grid {\n position: absolute;\n inset: 0;\n display: grid;\n grid-template-columns: repeat(3, 1fr);\n grid-template-rows: repeat(3, 1fr);\n}\n\n.pattern-cell {\n display: grid;\n place-items: center;\n}\n\n.pattern-dot {\n width: 22%;\n aspect-ratio: 1 / 1;\n border-radius: 50%;\n border: 2px solid var(--line);\n background: #071a12;\n transition: background 90ms linear, border-color 90ms linear, transform 90ms linear;\n}\n\n.pattern-cell.active .pattern-dot {\n background: var(--accent);\n border-color: var(--accent);\n transform: scale(1.18);\n box-shadow: 0 0 16px rgba(53, 229, 154, 0.5);\n}\n\n.gate-error {\n min-height: 20px;\n text-align: center;\n font-size: 13px;\n color: var(--danger);\n}\n\n.gate-actions {\n display: flex;\n flex-direction: column;\n gap: 8px;\n}\n\n/* ---------------------------------------------------------------- */\n/* Panneau paramètres */\n/* ---------------------------------------------------------------- */\n\n.overlay {\n position: fixed;\n inset: 0;\n background: rgba(2, 9, 6, 0.78);\n backdrop-filter: blur(3px);\n display: flex;\n align-items: flex-end;\n justify-content: center;\n z-index: 40;\n}\n\n.sheet {\n width: 100%;\n max-width: 430px;\n background: var(--card);\n border-top: 1px solid var(--line);\n border-radius: 22px 22px 0 0;\n padding: 18px 16px calc(20px + env(safe-area-inset-bottom));\n display: flex;\n flex-direction: column;\n gap: 14px;\n}\n\n.sheet-title {\n margin: 0;\n font-size: 16px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.badge {\n display: inline-flex;\n align-items: center;\n gap: 7px;\n align-self: flex-start;\n padding: 6px 11px;\n border-radius: 999px;\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.1px;\n border: 1px solid var(--line);\n color: var(--muted);\n background: #071a12;\n}\n\n.badge-ok {\n color: var(--accent);\n border-color: rgba(53, 229, 154, 0.4);\n background: rgba(53, 229, 154, 0.1);\n}\n\n.field {\n display: flex;\n flex-direction: column;\n gap: 7px;\n}\n\n.field-label {\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.2px;\n color: var(--muted);\n}\n\n.input {\n height: 46px;\n padding: 0 12px;\n border-radius: 12px;\n border: 1px solid var(--line);\n background: #071a12;\n color: var(--text);\n font-size: 14px;\n outline: none;\n}\n\n.input:focus {\n border-color: var(--accent-dim);\n}\n\n.notice {\n margin: 0;\n font-size: 12.5px;\n line-height: 1.5;\n color: var(--accent);\n}\n\n.sheet-actions {\n display: flex;\n flex-direction: column;\n gap: 8px;\n}\n\n.sheet-row {\n display: flex;\n gap: 8px;\n}\n\n.sheet-row .btn {\n flex: 1 1 0;\n}/* ---------------------------------------------------------------- */\n/* ÉTAT : tons (vert / ambre / rouge / gris) */\n/* ---------------------------------------------------------------- */\n\n.status-card.status-idle .pulse {\n background: var(--muted);\n animation: none;\n box-shadow: none;\n}\n\n.status-card.status-busy .pulse {\n background: var(--warn);\n box-shadow: 0 0 0 0 rgba(255, 200, 87, 0.55);\n}\n\n.status-card.status-ok {\n border-color: rgba(53, 229, 154, 0.45);\n}\n\n.status-card.status-ok .status-text {\n color: #d9ffee;\n}\n\n.status-card.status-warn {\n border-color: rgba(255, 200, 87, 0.42);\n background: linear-gradient(180deg, #241d0d 0%, #0b2118 100%);\n}\n\n.status-card.status-warn .pulse {\n background: var(--warn);\n box-shadow: 0 0 0 0 rgba(255, 200, 87, 0.55);\n}\n\n.status-card.status-warn .status-text {\n color: #ffe9bd;\n}\n\n.status-card.status-error {\n border-color: rgba(255, 107, 107, 0.5);\n background: linear-gradient(180deg, #2b1114 0%, #0b2118 100%);\n}\n\n.status-card.status-error .pulse {\n background: var(--danger);\n animation: none;\n box-shadow: 0 0 0 3px rgba(255, 107, 107, 0.16);\n}\n\n.status-card.status-error .status-text {\n color: #ffd9d9;\n}\n\n.status-hint {\n margin: 9px 0 0;\n font-size: 11.5px;\n line-height: 1.45;\n color: var(--muted);\n word-break: break-word;\n}\n\n/* Cadre du scanner en échec */\n.frame.error {\n border-color: var(--danger);\n box-shadow: 0 0 0 3px rgba(255, 107, 107, 0.26), 0 0 26px rgba(255, 107, 107, 0.45);\n}\n\n.frame.error .corner {\n border-color: var(--danger);\n}",[],[168,239],"f1182f18-515d-440c-87d9-8f92557c7ad0","root.tsx","b35d4240-b154-11f1-a81e-1607ee4eb77e",18,["D",1789511276974],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/** Racine frontend : monte l'application React dans #root. */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client?deps=react@18.2.0\";\nimport App from \"./components/App.tsx\";\n\nconst container = document.getElementById(\"root\");\nif (container) {\n createRoot(container).render();\n}",[],[168,247],"19fbdc20-528c-4e75-a1ff-7bd73c7353f5","index.html","8cfbe944-b154-11f1-b96e-1607ee4eb77e",["D",1789511212578],"\n\n \n \n \n \n \n \n \n \n \n SAMI.TECH — Retours Ecotrack\n \n \n \n

\n \n \n",[],[168,255],"4b43d310-2ee2-46ec-a5f7-e3238ff5389e","messages.ts","8d1f9d26-b154-11f1-b96e-1607ee4eb77e","07620b9a-84bf-4cea-b8dd-75e58750fcbc",20,["D",1789511823118],"/** Traduction des codes métier backend en messages utilisateur. */\nimport { normalizeStatus } from \"../../shared/status.ts\";\n\nexport function messageForCode(code: string): string {\n switch (code) {\n case \"API_NOT_CONFIGURED\":\n return \"Aucune API Ecotrack enregistrée — ouvre les paramètres.\";\n case \"INVALID_TOKEN\":\n return \"Token API invalide.\";\n case \"INVALID_TRACKING\":\n return \"Numéro de tracking invalide.\";\n case \"TRACKING_NOT_FOUND\":\n return \"Tracking introuvable dans OM Express.\";\n case \"ECOTRACK_READ_ERROR\":\n return \"OM Express a refusé la lecture du colis.\";\n case \"ECOTRACK_BAD_RESPONSE\":\n return \"Réponse illisible de OM Express.\";\n case \"ECOTRACK_NETWORK_ERROR\":\n return \"Erreur réseau vers OM Express.\";\n case \"RETURN_NOT_READY\":\n return \"Retour non éligible : le statut ne permet pas la validation.\";\n case \"RETURN_NOT_ELIGIBLE\":\n return \"Retour non éligible (OM Express a répondu fail).\";\n case \"RETURN_INVALID\":\n return \"Validation refusée par OM Express (requête invalide).\";\n case \"RETURN_API_ERROR\":\n return \"Erreur OM Express pendant la validation.\";\n case \"RETURN_NETWORK_ERROR\":\n return \"Erreur réseau pendant la validation.\";\n case \"UNAUTHORIZED\":\n return \"Session expirée — reverrouille l'application.\";\n default:\n return \"Opération impossible pour le moment.\";\n }\n}\n\n/** Libellé lisible d'un statut Ecotrack brut. */\nexport function statusLabel(raw: string): string {\n switch (normalizeStatus(raw)) {\n case \"retour_recu\":\n return \"Retour reçu\";\n case \"livraison_echoue_recu\":\n return \"Livraison échouée — reçu\";\n case \"return_validated_by_partener\":\n case \"return_validated_by_partner\":\n case \"retour_valide\":\n case \"retour_validee\":\n return \"Retour déjà validé\";\n default:\n return raw.trim() || \"statut inconnu\";\n }\n}\n\n/** Vibration courte, jamais bloquante. */\nexport function vibrate(pattern: number[]): void {\n try {\n if (typeof navigator.vibrate === \"function\") navigator.vibrate(pattern);\n } catch {\n /* ignore */\n }\n}/**\n * Ton de l'ÉTAT : pilote la couleur du voyant et du cadre du scanner.\n * idle -> gris (repos)\n * busy -> ambre (traitement en cours)\n * ok -> vert (succès / prêt)\n * warn -> ambre (trouvé mais non éligible)\n * error -> rouge (échec)\n */\nexport type StatusTone = \"idle\" | \"busy\" | \"ok\" | \"warn\" | \"error\";\n\nexport function toneForCode(code: string): StatusTone {\n switch (code) {\n case \"TRACKING_FOUND\":\n case \"RETURN_VALIDATED\":\n return \"ok\";\n case \"RETURN_ACCEPTED_UNCONFIRMED\":\n case \"RETURN_NOT_READY\":\n case \"RETURN_NOT_ELIGIBLE\":\n return \"warn\";\n default:\n return \"error\";\n }\n}",[],[168,270,262],"lib","de44b1b7-d267-4e87-83b8-450fbf7e79e4","api.ts","8d0e7514-b154-11f1-b96e-1607ee4eb77e",23,["D",1789511824837],"/**\n * Appels API côté navigateur.\n * Le frontend n'envoie que des informations fonctionnelles :\n * jamais de token, jamais de cookie Ecotrack, jamais de credential.\n */\n\nexport type ValidateOk = {\n ok: true;\n code: \"TRACKING_FOUND\";\n tracking: string;\n status: string;\n statusRaw: string;\n ready: boolean;\n alreadyValidated: boolean;\n};\n\nexport type ApiError = {\n ok: false;\n code: string;\n status?: number;\n message?: string;\n detail?: string;\n /** Noms des clés renvoyées par Ecotrack (diagnostic, aucune valeur). */\n debug?: string;\n};\n\nexport type ValidateResponse = ValidateOk | ApiError;\n\nexport type ReturnValidationResponse = {\n ok: boolean;\n code: string;\n tracking?: string;\n confirmed?: boolean;\n message?: string;\n detail?: string;\n};\n\nexport type AccessStatus = {\n ok: boolean;\n configured: boolean;\n unlocked: boolean;\n};\n\nasync function postJson(url: string, payload: unknown): Promise {\n const response = await fetch(url, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n body: JSON.stringify(payload),\n });\n return (await response.json()) as T;\n}\n\nexport function fetchAccessStatus(): Promise {\n return fetch(\"/api/access/status\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function fetchConfig(): Promise<{ ok: boolean; apiSaved: boolean }> {\n return fetch(\"/api/config\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function setupPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/setup\", { pattern });\n}\n\nexport function unlockPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/unlock\", { pattern });\n}\n\nexport function lockApp(): Promise<{ ok: boolean }> {\n return postJson(\"/api/access/logout\", {});\n}\n\nexport function saveApiToken(apiToken: string): Promise<{ ok: boolean; apiSaved?: boolean; code?: string }> {\n return postJson(\"/api/ecotrack/settings\", { apiToken });\n}\n\nexport async function deleteApiToken(): Promise<{ ok: boolean; apiSaved?: boolean }> {\n const response = await fetch(\"/api/ecotrack/settings\", {\n method: \"DELETE\",\n credentials: \"same-origin\",\n });\n return (await response.json()) as { ok: boolean; apiSaved?: boolean };\n}\n\nexport function validateTracking(tracking: string): Promise {\n return postJson(\"/api/validate\", { tracking });\n}\n\nexport function validateReturn(tracking: string): Promise {\n return postJson(\"/api/return/validate\", { tracking });\n}",[],[168,270,272],"65e863f5-391b-4fbd-8ced-e27e780f2903",9,["D",1789511212692],[203,204],[168,270],"6c4d6547-36ff-417e-8cf4-398a89134cff","StatusPanel.tsx","a49c9c4c-b154-11f1-aa9a-1607ee4eb77e","34a6d1f5-1d62-4377-8a82-c7eaa0426cae",21,["D",1789511823303],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Zone ÉTAT — toujours affichée AU-DESSUS de la caméra.\n * Le voyant est coloré selon le ton courant : vert (ok), ambre (busy/warn),\n * rouge (error), gris (idle).\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { StatusTone } from \"../lib/messages.ts\";\n\ntype Props = {\n status: string;\n tracking: string;\n tone: StatusTone;\n hint?: string;\n};\n\nexport default function StatusPanel({ status, tracking, tone, hint = \"\" }: Props) {\n return (\n

ÉTAT

\n \n

{status}

\n {tracking ? (\n

\n TRACKING {tracking}\n

\n ) : null}\n {hint ?

{hint}

: null}\n

\n );\n}",[],[168,293,285],"components","0727bdf1-ae1a-4960-a498-45fe55c8b48e","Settings.tsx","a4ab18a8-b154-11f1-aa9a-1607ee4eb77e",16,["D",1789511252317],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Paramètres — gestion du token API Ecotrack.\n *\n * Le token est envoyé une seule fois au serveur, puis jamais réaffiché.\n * Le badge affiché est « API SAUVEGARDÉE » : la présence d'un token ne garantit\n * pas que toutes les opérations Ecotrack sont disponibles.\n */\nimport React, { useState } from \"https://esm.sh/react@18.2.0\";\nimport { deleteApiToken, saveApiToken } from \"../lib/api.ts\";\n\ntype Props = {\n open: boolean;\n apiSaved: boolean;\n onClose: () => void;\n onSaved: (saved: boolean) => void;\n onLock: () => void;\n};\n\nexport default function Settings({ open, apiSaved, onClose, onSaved, onLock }: Props) {\n const [token, setToken] = useState(\"\");\n const [notice, setNotice] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n if (!open) return null;\n\n async function handleSave() {\n if (busy) return;\n const clean = token.trim();\n if (clean.length < 8) {\n setError(\"Token API trop court.\");\n return;\n }\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await saveApiToken(clean);\n if (result.ok) {\n setToken(\"\");\n setNotice(\"API Ecotrack enregistrée côté serveur.\");\n onSaved(true);\n } else {\n setError(\"Enregistrement refusé par le serveur.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n async function handleDelete() {\n if (busy) return;\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await deleteApiToken();\n if (result.ok) {\n setNotice(\"API Ecotrack supprimée du serveur.\");\n onSaved(false);\n } else {\n setError(\"Suppression impossible.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n return (\n

Paramètres

\n\n \n {apiSaved ? \"API SAUVEGARDÉE\" : \"AUCUNE API ENREGISTRÉE\"}\n \n\n

\n \n API TOKEN\n \n setToken(event.target.value)}\n />\n

\n\n {notice ?

{notice}

: null}\n {error ?

{error}

: null}\n\n

\n \n {apiSaved ? (\n \n SUPPRIMER\n \n ) : null}\n

\n \n \n

\n\n

\n Le token est conservé côté serveur et n'est jamais renvoyé au navigateur.\n

\n );\n}",[],[168,293,295],"c152045d-c111-424d-87d6-cdb45b949146","Scanner.tsx","9c31fd86-b154-11f1-8617-1607ee4eb77e",32,["D",1789511849454],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Scanner QR continu.\n *\n * Règle principale : le MediaStream caméra n'est JAMAIS fermé après un scan.\n * QR détecté -> pause logique (scanningRef = false) -> traitement -> reprise.\n * `stopCamera()` n'est appelé qu'au démontage du composant, à la fermeture de\n * l'application ou en cas de perte réelle du flux.\n *\n * Deux moteurs de détection : BarcodeDetector natif, puis jsQR en secours\n * (analyse plein cadre + analyse de la zone centrale).\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport jsQR from \"https://esm.sh/jsqr@1.4.0\";\nimport { extractTracking } from \"../../shared/tracking.ts\";\nimport { type StatusTone, vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n enabled: boolean;\n scanning: boolean;\n onReady: () => void;\n onTracking: (tracking: string) => void;\n onStatus: (status: string, tone?: StatusTone) => void;\n /** Couleur du cadre : vert (ok), rouge (error), blanc (neutral). */\n frameTone: \"neutral\" | \"ok\" | \"error\";\n};\n\ntype BarcodeDetectorLike = {\n detect: (source: CanvasImageSource) => Promise>;\n};\n\nconst FRAME_INTERVAL_MS = 160;\nconst SAME_RAW_COOLDOWN_MS = 2500;\nconst JSQR_MAX_SIDE = 640;\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction createDetector(): BarcodeDetectorLike | null {\n const ctor = (globalThis as unknown as {\n BarcodeDetector?: new (options?: { formats?: string[] }) => BarcodeDetectorLike;\n }).BarcodeDetector;\n if (!ctor) return null;\n try {\n return new ctor({ formats: [\"qr_code\"] });\n } catch {\n return null;\n }\n}\n\n/** Applique focus continu et zoom si le matériel les expose. */\nasync function applyTrackHints(stream: MediaStream): Promise {\n const track = stream.getVideoTracks()[0] as MediaStreamTrack & {\n getCapabilities?: () => Record;\n };\n if (!track?.getCapabilities || !track.applyConstraints) return;\n try {\n const capabilities = track.getCapabilities();\n const advanced: Record = {};\n\n const focusModes = capabilities.focusMode;\n if (Array.isArray(focusModes) && focusModes.includes(\"continuous\")) {\n advanced.focusMode = \"continuous\";\n }\n\n const zoom = capabilities.zoom as { min?: number; max?: number } | undefined;\n if (zoom && typeof zoom.max === \"number\") {\n const target = Math.min(1.6, zoom.max);\n if (target >= (zoom.min ?? 1)) advanced.zoom = target;\n }\n\n if (Object.keys(advanced).length > 0) {\n await track.applyConstraints({ advanced: [advanced] } as MediaStreamConstraints);\n }\n } catch {\n /* capacités non supportées : on continue sans */\n }\n}\n\n/** Analyse une zone vidéo avec jsQR. */\nfunction analyzeZone(\n context: CanvasRenderingContext2D,\n canvas: HTMLCanvasElement,\n video: HTMLVideoElement,\n source: { x: number; y: number; size: number },\n outputSize: number,\n): string | null {\n canvas.width = outputSize;\n canvas.height = outputSize;\n context.drawImage(\n video,\n source.x,\n source.y,\n source.size,\n source.size,\n 0,\n 0,\n outputSize,\n outputSize,\n );\n const image = context.getImageData(0, 0, outputSize, outputSize);\n const code = jsQR(image.data, image.width, image.height, { inversionAttempts: \"dontInvert\" });\n return code?.data ?? null;\n}\n\n/** Secours jsQR : plein cadre (sous-échantillonné) puis zone centrale (pleine résolution). */\nfunction detectWithJsQr(\n video: HTMLVideoElement,\n canvasRef: React.MutableRefObject,\n): string | null {\n const width = video.videoWidth;\n const height = video.videoHeight;\n if (!width || !height) return null;\n\n let canvas = canvasRef.current;\n if (!canvas) {\n canvas = document.createElement(\"canvas\");\n canvasRef.current = canvas;\n }\n const context = canvas.getContext(\"2d\", { willReadFrequently: true });\n if (!context) return null;\n\n const side = Math.min(width, height);\n const fullOutput = Math.max(160, Math.min(JSQR_MAX_SIDE, side));\n const full = analyzeZone(\n context,\n canvas,\n video,\n { x: 0, y: 0, size: side },\n fullOutput,\n );\n if (full) return full;\n\n // Deuxième analyse : zone centrale, pleine résolution.\n const centerSize = Math.floor(side * 0.6);\n const center = analyzeZone(\n context,\n canvas,\n video,\n { x: Math.floor((width - centerSize) / 2), y: Math.floor((height - centerSize) / 2), size: centerSize },\n centerSize,\n );\n return center;\n}\n\nexport default function Scanner(\n { enabled, scanning, frameTone, onReady, onTracking, onStatus }: Props,\n) {\n const videoRef = useRef(null);\n const canvasRef = useRef(null);\n const streamRef = useRef(null);\n const scanningRef = useRef(false);\n const loopRunningRef = useRef(false);\n const lastScanRef = useRef(\"\");\n const lastRawRef = useRef(\"\");\n const lastRawAtRef = useRef(0);\n const framesRef = useRef(0);\n const lastTickRef = useRef(0);\n\n const [cameraOn, setCameraOn] = useState(false);\n const [qrDetected, setQrDetected] = useState(false);\n\n const onReadyRef = useRef(onReady);\n const onTrackingRef = useRef(onTracking);\n const onStatusRef = useRef(onStatus);\n useEffect(() => {\n onReadyRef.current = onReady;\n onTrackingRef.current = onTracking;\n onStatusRef.current = onStatus;\n }, [onReady, onTracking, onStatus]);\n\n /* -------------------------------------------------------------- */\n /* Traitement d'un contenu QR */\n /* -------------------------------------------------------------- */\n\n const handleRaw = useCallback((raw: string) => {\n const now = Date.now();\n if (raw === lastRawRef.current && now - lastRawAtRef.current < SAME_RAW_COOLDOWN_MS) return;\n lastRawRef.current = raw;\n lastRawAtRef.current = now;\n\n const tracking = extractTracking(raw);\n if (!tracking) {\n setQrDetected(true);\n onStatusRef.current(\"QR lu, mais aucun numéro de tracking reconnu.\", \"error\");\n window.setTimeout(() => setQrDetected(false), 700);\n return;\n }\n if (lastScanRef.current === tracking) return;\n\n lastScanRef.current = tracking;\n scanningRef.current = false; // pause logique : le MediaStream reste ouvert\n setQrDetected(true);\n vibrate([70, 40, 110]);\n onStatusRef.current(\"QR détecté — tracking reconnu\", \"busy\");\n onTrackingRef.current(tracking);\n }, []);\n\n /* -------------------------------------------------------------- */\n /* Boucle de scan */\n /* -------------------------------------------------------------- */\n\n const scanLoop = useCallback(async () => {\n if (loopRunningRef.current) return;\n loopRunningRef.current = true;\n try {\n const detector = createDetector();\n while (scanningRef.current && streamRef.current) {\n const video = videoRef.current;\n if (!video || video.readyState < 2 || video.videoWidth === 0) {\n await sleep(120);\n continue;\n }\n const now = Date.now();\n if (now - lastTickRef.current < FRAME_INTERVAL_MS) {\n await sleep(40);\n continue;\n }\n lastTickRef.current = now;\n framesRef.current += 1;\n\n let raw: string | null = null;\n if (detector) {\n try {\n const codes = await detector.detect(video);\n if (codes.length > 0 && codes[0].rawValue) raw = codes[0].rawValue;\n } catch {\n /* BarcodeDetector indisponible sur cette frame : jsQR prend le relais */\n }\n }\n if (!raw) raw = detectWithJsQr(video, canvasRef);\n if (raw) handleRaw(raw);\n\n await sleep(50);\n }\n } finally {\n loopRunningRef.current = false;\n }\n }, [handleRaw]);\n\n /* -------------------------------------------------------------- */\n /* Caméra */\n /* -------------------------------------------------------------- */\n\n const stopCamera = useCallback(() => {\n scanningRef.current = false;\n const stream = streamRef.current;\n if (stream) stream.getTracks().forEach((track) => track.stop());\n streamRef.current = null;\n const video = videoRef.current;\n if (video) video.srcObject = null;\n setCameraOn(false);\n }, []);\n\n const startCamera = useCallback(async () => {\n if (streamRef.current) return;\n onStatusRef.current(\"Ouverture de la caméra…\", \"busy\");\n try {\n const constraints = {\n audio: false,\n video: {\n facingMode: { ideal: \"environment\" },\n width: { ideal: 1920 },\n height: { ideal: 1080 },\n },\n } as MediaStreamConstraints;\n const stream = await navigator.mediaDevices.getUserMedia(constraints);\n streamRef.current = stream;\n\n const video = videoRef.current;\n if (video) {\n video.srcObject = stream;\n video.muted = true;\n try {\n await video.play();\n } catch {\n /* autoplay bloqué : le flux reste ouvert */\n }\n }\n await applyTrackHints(stream);\n setCameraOn(true);\n onReadyRef.current();\n } catch {\n streamRef.current = null;\n setCameraOn(false);\n onStatusRef.current(\"Caméra indisponible — utilise la SAISIE MANUELLE.\", \"error\");\n }\n }, []);\n\n // Ouverture de la caméra après déverrouillage ; arrêt uniquement au démontage.\n useEffect(() => {\n if (!enabled) return;\n void startCamera();\n return () => stopCamera();\n }, [enabled, startCamera, stopCamera]);\n\n /* -------------------------------------------------------------- */\n /* Reprise automatique du scanner */\n /* -------------------------------------------------------------- */\n\n useEffect(() => {\n if (!scanning) {\n scanningRef.current = false;\n return;\n }\n // Équivalent de resumeScanner() : remise à zéro puis reprise.\n setQrDetected(false);\n lastScanRef.current = \"\";\n framesRef.current = 0;\n\n const stream = streamRef.current;\n const alive = !!stream && stream.getVideoTracks().some((track) => track.readyState === \"live\");\n if (alive && videoRef.current) {\n setCameraOn(true);\n scanningRef.current = true;\n onStatusRef.current(\"Analyse QR active — place le QR dans le cadre\", \"ok\");\n void scanLoop();\n return;\n }\n scanningRef.current = false;\n void startCamera();\n }, [scanning, scanLoop, startCamera]);\n\n return (\n

\n {!cameraOn && (\n

\n ▣\n Scanner un retour\n

\n )}\n \n );\n}",[],[168,293,303],"1425fed1-60da-4bbc-9aae-2aede04a3c61","PatternGate.tsx","9c2cb9ca-b154-11f1-8617-1607ee4eb77e",11,["D",1789511238063],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Verrouillage de l'application par schéma Android 3x3.\n *\n * Le schéma est tracé au doigt (pointer events) puis envoyé au serveur.\n * En mode `setup`, le schéma doit être tracé deux fois de suite.\n * Aucun hash, aucun secret n'est manipulé côté navigateur.\n */\nimport React, { useCallback, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { setupPattern, unlockPattern } from \"../lib/api.ts\";\nimport { vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n mode: \"setup\" | \"unlock\";\n onUnlocked: () => void;\n};\n\nconst MIN_POINTS = 4;\n\nexport default function PatternGate({ mode, onUnlocked }: Props) {\n const [path, setPath] = useState([]);\n const [pending, setPending] = useState(null);\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n const pathRef = useRef([]);\n const tracingRef = useRef(false);\n const busyRef = useRef(false);\n const dotRefs = useRef>([]);\n\n const reset = useCallback(() => {\n pathRef.current = [];\n setPath([]);\n }, []);\n\n const addDot = useCallback((dot: number) => {\n if (pathRef.current.includes(dot)) return;\n pathRef.current = [...pathRef.current, dot];\n setPath(pathRef.current);\n vibrate([12]);\n }, []);\n\n const dotAt = useCallback((x: number, y: number): number | null => {\n for (let index = 0; index < 9; index++) {\n const element = dotRefs.current[index];\n if (!element) continue;\n const rect = element.getBoundingClientRect();\n const centerX = rect.left + rect.width / 2;\n const centerY = rect.top + rect.height / 2;\n const radius = Math.max(rect.width, 46);\n if (Math.hypot(x - centerX, y - centerY) <= radius) return index + 1;\n }\n return null;\n }, []);\n\n const submit = useCallback(\n async (pattern: string) => {\n if (busyRef.current) return;\n busyRef.current = true;\n setBusy(true);\n setError(\"\");\n try {\n if (mode === \"setup\") {\n if (pending === null) {\n setPending(pattern);\n reset();\n return;\n }\n if (pending !== pattern) {\n setPending(null);\n reset();\n setError(\"Les deux schémas ne correspondent pas. Recommence.\");\n return;\n }\n const result = await setupPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n setPending(null);\n reset();\n setError(\"Enregistrement impossible. Recharge la page et réessaie.\");\n return;\n }\n\n const result = await unlockPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n reset();\n setError(\"Schéma incorrect.\");\n } catch {\n reset();\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n busyRef.current = false;\n setBusy(false);\n }\n },\n [mode, onUnlocked, pending, reset],\n );\n\n const handlePointerDown = useCallback(\n (event: React.PointerEvent) => {\n if (busyRef.current) return;\n event.currentTarget.setPointerCapture(event.pointerId);\n tracingRef.current = true;\n setError(\"\");\n reset();\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt, reset],\n );\n\n const handlePointerMove = useCallback(\n (event: React.PointerEvent) => {\n if (!tracingRef.current) return;\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt],\n );\n\n const handlePointerUp = useCallback(() => {\n if (!tracingRef.current) return;\n tracingRef.current = false;\n const current = pathRef.current;\n if (current.length < MIN_POINTS) {\n reset();\n setError(\"Relie au moins 4 points.\");\n return;\n }\n void submit(current.join(\"\"));\n }, [reset, submit]);\n\n const points = path\n .map((dot) => `${((dot - 1) % 3) + 0.5},${Math.floor((dot - 1) / 3) + 0.5}`)\n .join(\" \");\n\n const hint = mode === \"setup\"\n ? pending === null\n ? \"Trace ton schéma de déverrouillage (4 points minimum).\"\n : \"Reproduis exactement le même schéma pour confirmer.\"\n : \"Trace ton schéma pour accéder au scanner.\";\n\n return (\n

\n SAMI.TECH\n

{hint}

\n\n \n \n

\n {Array.from({ length: 9 }, (_, index) => (\n \n {\n dotRefs.current[index] = element;\n }}\n />\n

\n ))}\n

\n \n\n

{error}

\n\n

\n {\n reset();\n setPending(null);\n setError(\"\");\n }}\n >\n EFFACER\n \n

\n \n );\n}",[],[168,293,311],"fbf5dc9f-bcef-4638-8c09-b1c84bcaad75","ManualEntry.tsx","a4a1edc8-b154-11f1-aa9a-1607ee4eb77e",14,["D",1789511252256],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * SAISIE MANUELLE — directement sous la caméra.\n * Mêmes règles que le scanner : A-Z, 0-9, `_`, `-`, 6 à 64 caractères, majuscules.\n * La touche Entrée lance la vérification. La caméra n'est jamais fermée ici.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n value: string;\n onChange: (value: string) => void;\n onSubmit: (value: string) => void;\n disabled?: boolean;\n};\n\nconst MIN_LENGTH = 6;\nconst MAX_LENGTH = 64;\n\nexport default function ManualEntry({ value, onChange, onSubmit, disabled = false }: Props) {\n const canSubmit = value.trim().length >= MIN_LENGTH && !disabled;\n\n return (\n

SAISIE MANUELLE

\n {\n event.preventDefault();\n if (canSubmit) onSubmit(value.trim().toUpperCase());\n }}\n >\n {\n const clean = event.target.value\n .toUpperCase()\n .replace(/[^A-Z0-9_-]/g, \"\")\n .slice(0, MAX_LENGTH);\n onChange(clean);\n }}\n />\n \n \n

\n );\n}",[],[168,293,319],"62a5fdbe-684a-480f-82a7-af6c6aad1e52","HistoryList.tsx","a4a69242-b154-11f1-aa9a-1607ee4eb77e",15,["D",1789511252288],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * DERNIERS RETOURS VALIDÉS — historique d'affichage uniquement.\n * Ce n'est pas une preuve serveur : la source de vérité reste OM Express.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n items: string[];\n};\n\nexport default function HistoryList({ items }: Props) {\n return (\n

DERNIERS RETOURS VALIDÉS

\n {items.length === 0 ? (\n

Aucun retour validé pour l'instant.

\n ) : (\n

\n ✓\n {tracking}\n

\n )}\n

\n );\n}",[],[168,293,327],"45c0c980-60ce-4984-8a68-ac35f06b3e40","App.tsx","b3594b36-b154-11f1-a81e-1607ee4eb77e",17,["D",1789511276946],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Application principale — machine à états du scanner continu.\n *\n * Ordre visuel imposé :\n * 1. En-tête SAMI.TECH / Retours Ecotrack\n * 2. ÉTAT\n * 3. Caméra / Scanner QR\n * 4. SAISIE MANUELLE\n * 5. VALIDER LE RETOUR (uniquement si le colis est éligible)\n * 6. DERNIERS RETOURS VALIDÉS\n * 7. Footer\n *\n * Niveaux de fiabilité distingués en permanence :\n * QR détecté ≠ tracking trouvé ≠ retour éligible ≠ retour validé.\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { isReturnReadyStatus } from \"../../shared/status.ts\";\nimport {\n fetchAccessStatus,\n fetchConfig,\n lockApp,\n validateReturn,\n validateTracking,\n} from \"../lib/api.ts\";\nimport type { ValidateResponse } from \"../lib/api.ts\";\nimport { messageForCode, statusLabel, vibrate } from \"../lib/messages.ts\";\nimport HistoryList from \"./HistoryList.tsx\";\nimport ManualEntry from \"./ManualEntry.tsx\";\nimport PatternGate from \"./PatternGate.tsx\";\nimport Scanner from \"./Scanner.tsx\";\nimport Settings from \"./Settings.tsx\";\nimport StatusPanel from \"./StatusPanel.tsx\";\n\ntype AccessState = \"loading\" | \"setup\" | \"locked\" | \"open\";\n\nconst RESUME_DELAY_MS = 800;\nconst HISTORY_LIMIT = 8;\n\nexport default function App() {\n const [access, setAccess] = useState(\"loading\");\n const [status, setStatus] = useState(\"Prêt à scanner\");\n const [tracking, setTracking] = useState(\"\");\n const [result, setResult] = useState(null);\n const [validating, setValidating] = useState(false);\n const [scanning, setScanning] = useState(false);\n const [manualValue, setManualValue] = useState(\"\");\n const [history, setHistory] = useState([]);\n const [settingsOpen, setSettingsOpen] = useState(false);\n const [apiSaved, setApiSaved] = useState(false);\n\n const resumeTimer = useRef(null);\n const trackingRef = useRef(\"\");\n const validatingRef = useRef(false);\n\n useEffect(() => {\n trackingRef.current = tracking;\n }, [tracking]);\n\n useEffect(() => {\n return () => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n };\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Reprise automatique du scanner (jamais de fermeture caméra) */\n /* ---------------------------------------------------------------- */\n\n const resume = useCallback((delayMs: number = RESUME_DELAY_MS) => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n setScanning(false);\n resumeTimer.current = window.setTimeout(() => {\n resumeTimer.current = null;\n setTracking(\"\");\n setResult(null);\n setScanning(true);\n }, delayMs);\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Déverrouillage */\n /* ---------------------------------------------------------------- */\n\n useEffect(() => {\n let cancelled = false;\n void (async () => {\n try {\n const data = await fetchAccessStatus();\n if (cancelled) return;\n if (!data.configured) setAccess(\"setup\");\n else if (data.unlocked) setAccess(\"open\");\n else setAccess(\"locked\");\n } catch {\n if (!cancelled) setAccess(\"locked\");\n }\n })();\n return () => {\n cancelled = true;\n };\n }, []);\n\n useEffect(() => {\n if (access !== \"open\") return;\n void (async () => {\n try {\n const data = await fetchConfig();\n setApiSaved(Boolean(data.apiSaved));\n } catch {\n /* ignore */\n }\n })();\n }, [access]);\n\n const handleLock = useCallback(async () => {\n setSettingsOpen(false);\n setScanning(false);\n try {\n await lockApp();\n } catch {\n /* ignore */\n }\n setTracking(\"\");\n setResult(null);\n setAccess(\"locked\");\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Vérification d'un tracking (QR ou saisie manuelle) */\n /* ---------------------------------------------------------------- */\n\n const handleTracking = useCallback(\n async (value: string) => {\n const clean = value.trim().toUpperCase();\n if (!clean) return;\n\n setTracking(clean);\n setResult(null);\n setStatus(\"Vérification du tracking…\");\n\n try {\n const response = await validateTracking(clean);\n\n if (!response.ok) {\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n setStatus(messageForCode(response.code));\n resume(900);\n return;\n }\n\n setResult(response);\n\n if (response.ready && isReturnReadyStatus(response.statusRaw)) {\n // Colis éligible : le scanner reste EN PAUSE, VALIDER LE RETOUR s'affiche.\n setStatus(`Tracking trouvé dans OM Express — ${statusLabel(response.statusRaw)}`);\n return;\n }\n\n setStatus(\n response.alreadyValidated\n ? `Retour déjà validé dans OM Express — ${statusLabel(response.statusRaw)}`\n : `Tracking trouvé — statut « ${statusLabel(response.statusRaw)} » : validation impossible.`,\n );\n resume(900);\n } catch {\n setStatus(\"Erreur réseau — vérifie ta connexion.\");\n resume(900);\n }\n },\n [resume],\n );\n\n const handleManualSubmit = useCallback(\n (value: string) => {\n // La caméra n'est PAS fermée : simple pause logique du scanner.\n setScanning(false);\n void handleTracking(value);\n },\n [handleTracking],\n );\n\n /* ---------------------------------------------------------------- */\n /* Validation officielle du retour */\n /* ---------------------------------------------------------------- */\n\n const handleValidateReturn = useCallback(async () => {\n if (validatingRef.current) return;\n const current = trackingRef.current;\n if (!current) return;\n\n validatingRef.current = true;\n setValidating(true);\n setStatus(\"Validation du retour dans OM Express…\");\n\n try {\n const response = await validateReturn(current);\n\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n\n if (response.ok && response.confirmed) {\n setStatus(\"Retour validé avec succès dans OM Express.\");\n vibrate([100, 50, 160]);\n setHistory((previous) =>\n [current, ...previous.filter((item) => item !== current)].slice(0, HISTORY_LIMIT)\n );\n setManualValue(\"\");\n setTracking(\"\");\n setResult(null);\n resume(700);\n return;\n }\n\n if (response.ok && response.code === \"RETURN_ACCEPTED_UNCONFIRMED\") {\n setStatus(\"Requête reçue par OM Express, mais validation non confirmée.\");\n resume(900);\n return;\n }\n\n setStatus(messageForCode(response.code));\n resume(900);\n } catch {\n setStatus(\"Erreur réseau — validation non confirmée.\");\n resume(900);\n } finally {\n validatingRef.current = false;\n setValidating(false);\n }\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Rendu */\n /* ---------------------------------------------------------------- */\n\n if (access === \"loading\") {\n return (\n

Chargement…

\n );\n }\n\n if (access === \"setup\" || access === \"locked\") {\n return (\n setAccess(\"open\")}\n />\n );\n }\n\n const showValidate = !!result && result.ok && result.ready &&\n isReturnReadyStatus(result.statusRaw);\n\n return (\n

\n \n SAMI.TECH\n \n Retours Ecotrack\n

\n setSettingsOpen(true)}\n >\n ⚙\n \n

\n\n \n\n

\n setScanning(true)}\n onTracking={handleTracking}\n onStatus={setStatus}\n />\n

\n\n \n\n {showValidate ? (\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n ) : null}\n\n \n\n \n\n setSettingsOpen(false)}\n onSaved={setApiSaved}\n onLock={handleLock}\n />\n

\n );\n}",[],[168,293,335],"394fa985-734a-48a4-ba83-cef32342d0d9",["D",1789511238063],[195,196,197,198,199,200,201],[168,293],["D",1789511212578],[194,202,205,206,207],[168],"996227ed-ed69-45d1-9e00-93c62621d2f4",["D",1789511883727],[],[174,39],"ff227c11-697c-4ee1-811f-6515cd9fbb6b","db.ts","6bda7e38-b154-11f1-91d7-1607ee4eb77e",["D",1789511156996],"/**\n * Accès SQLite (base projet, isolée des autres applications SAMI.TECH).\n *\n * Tables :\n * app_settings (key, value) -> schéma 3x3 + credentials Ecotrack\n * app_sessions (token_hash, expires_at, created_at) -> sessions du cookie sami_access\n * idx_app_sessions_expires -> purge / lookup rapide\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nlet schemaReady: Promise | null = null;\n\n/** Crée les tables et l'index si nécessaire. Idempotent, exécuté une seule fois. */\nexport function ensureSchema(): Promise {\n if (!schemaReady) {\n schemaReady = sqlite\n .batch([\n `CREATE TABLE IF NOT EXISTS app_settings (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_sessions (\n token_hash TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_app_sessions_expires ON app_sessions (expires_at)`,\n ])\n .then(() => undefined)\n .catch((error) => {\n schemaReady = null;\n throw error;\n });\n }\n return schemaReady;\n}\n\n/** Lit une valeur de configuration. */\nexport async function getSetting(key: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT value FROM app_settings WHERE key = ?\",\n args: [key],\n });\n const row = result.rows[0] as unknown as { value?: string } | undefined;\n return row?.value ?? null;\n}\n\n/** Écrit (ou remplace) une valeur de configuration. */\nexport async function setSetting(key: string, value: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `INSERT INTO app_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, value],\n });\n}\n\n/** Supprime une valeur de configuration. */\nexport async function deleteSetting(key: string): Promise {\n await ensureSchema();\n await sqlite.execute({ sql: \"DELETE FROM app_settings WHERE key = ?\", args: [key] });\n}",[],[174,354],"45232bfa-011c-48a2-9b91-3626695b9180","access.ts","7673ba6c-b154-11f1-ac17-1607ee4eb77e",4,["D",1789511174778],"/**\n * Verrouillage de l'application par schéma Android 3x3 + sessions.\n *\n * - Le schéma est stocké sous forme de hash PBKDF2-SHA256 salé (jamais en clair).\n * - Les sessions vivent en base (app_sessions) et sont portées par le cookie\n * `sami_access` (HttpOnly, Secure, ~12 h). Le cookie ne contient qu'un token\n * aléatoire : seul son SHA-256 est stocké.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSchema, getSetting, setSetting } from \"./db.ts\";\n\nconst PATTERN_KEY = \"access_pattern_hash\";\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // ~12 heures\nconst PBKDF2_ITERATIONS = 100_000;\nconst encoder = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(byteLength: number): string {\n const buffer = new Uint8Array(byteLength);\n crypto.getRandomValues(buffer);\n return toHex(buffer);\n}\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return toHex(new Uint8Array(digest));\n}\n\nasync function pbkdf2Hex(secret: string, salt: string, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt: encoder.encode(salt), iterations },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** Vrai si un schéma a déjà été configuré. */\nexport async function isPatternConfigured(): Promise {\n return (await getSetting(PATTERN_KEY)) !== null;\n}\n\n/** Enregistre un nouveau schéma et invalide toutes les sessions existantes. */\nexport async function setPattern(pattern: string): Promise {\n const salt = randomHex(16);\n const hash = await pbkdf2Hex(pattern, salt, PBKDF2_ITERATIONS);\n await setSetting(PATTERN_KEY, `pbkdf2$${PBKDF2_ITERATIONS}$${salt}$${hash}`);\n await deleteAllSessions();\n}\n\n/** Vérifie un schéma saisi contre le hash stocké. */\nexport async function verifyPattern(pattern: string): Promise {\n const stored = await getSetting(PATTERN_KEY);\n if (!stored) return false;\n const [scheme, iterationsRaw, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterationsRaw || !salt || !hash) return false;\n const candidate = await pbkdf2Hex(pattern, salt, Number(iterationsRaw));\n return timingSafeEqual(candidate, hash);\n}\n\n/** Crée une session et retourne le token à poser en cookie. */\nexport async function createSession(): Promise<{ token: string; maxAge: number }> {\n await ensureSchema();\n const token = randomHex(32);\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, now + SESSION_TTL_MS, now],\n });\n return { token, maxAge: Math.floor(SESSION_TTL_MS / 1000) };\n}\n\n/** Vrai si la requête porte une session valide et non expirée. */\nexport async function hasValidSession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return false;\n await ensureSchema();\n const tokenHash = await sha256Hex(token);\n const result = await sqlite.execute({\n sql: \"SELECT expires_at FROM app_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n const row = result.rows[0] as unknown as { expires_at?: number } | undefined;\n if (!row) return false;\n if (Number(row.expires_at) < Date.now()) {\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n return false;\n }\n return true;\n}\n\n/** Invalide la session portée par la requête. */\nexport async function destroySession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return;\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM app_sessions WHERE token_hash = ?\",\n args: [await sha256Hex(token)],\n });\n}\n\n/** Invalide toutes les sessions (purge à la reconfiguration du schéma). */\nexport async function deleteAllSessions(): Promise {\n await ensureSchema();\n await sqlite.execute(\"DELETE FROM app_sessions\");\n}\n\n/** Garde-fou : retourne une réponse 401 si la session est absente, sinon null. */\nexport async function requireSession(request: Request): Promise {\n if (await hasValidSession(request)) return null;\n return Response.json({ ok: false, code: \"UNAUTHORIZED\" }, { status: 401 });\n}\n\nexport function sessionCookieHeader(token: string, maxAge: number): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearCookieHeader(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n const header = request.headers.get(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) return part.slice(index + 1).trim();\n }\n return null;\n}",[],[174,361],["D",1789511156996],[190,191,192],[174],["D",1789511143425],["D",1789696237964],{"_107":106,"_115":111},{"_107":106,"_108":109,"_110":111,"_19":62,"_112":113,"_114":31},{"_13":96,"_38":97,"_50":49,"_98":51,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":52,"_105":106},"ctx",{"_89":-5,"_135":409,"_410":411,"_412":413,"_414":31,"_415":31,"_416":31,"_417":66,"_418":-5,"_419":-7,"_420":-7,"_421":70,"_422":31,"_423":31,"_424":-5,"_425":31,"_426":31,"_427":31,"_428":-5},"ENV",{"_380":381,"_382":383,"_384":97,"_385":386,"_387":388,"_389":390,"_391":392,"_393":394,"_395":396,"_397":398,"_399":400,"_401":402,"_403":404,"_405":406,"_407":408},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v33