SAMI.TECH — Retours Ecotrack

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_406":407,"_408":409},"routes/_app.x.$handle.$name",{"_107":106,"_38":52,"_116":97,"_33":117,"_13":14,"_118":-5,"_11":119,"_120":121,"_122":123,"_124":125,"_126":127,"_26":-5,"_128":-5,"_129":-5,"_130":31,"_131":132,"_133":66,"_134":-5,"_135":-5,"_136":137},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_50":51,"_38":52,"_45":53,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":78,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":90,"_91":92,"_93":94,"_95":31},"version",58,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","cf938ce6-f1d3-4beb-ad5d-a916419b7361","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":39,"_40":41,"_42":44,"_45":46,"_47":14,"_48":49,"_30":31},"previous",{"_36":37,"_38":39,"_40":41,"_42":43},"deleted",false,"deletedHere","path","frontend/components/ReturnsReadyCard.tsx","latestPath","fileId","e83f1746-b158-11f1-b989-1607ee4eb77e","name","ReturnsReadyCard.tsx","fileType","script","content","/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Carte « RETOURS PRÊTS ».\n *\n * Ce composant ne crée AUCUNE caméra et n'appelle aucune API : il ne fait que\n * basculer le mode de lecture du scanner existant (scanMode). Le scanner, la\n * caméra et les routes backend restent strictement inchangés.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\nexport type ScanMode = \"normal\" | \"returns_ready\";\n\ntype Props = {\n scanMode: ScanMode;\n onStart: () => void;\n onStop: () => void;\n disabled?: boolean;\n};\n\nexport default function ReturnsReadyCard({ scanMode, onStart, onStop, disabled = false }: Props) {\n const active = scanMode === \"returns_ready\";\n\n return (\n

RETOURS PRÊTS

\n Scanne les colis dont le retour est prêt à être validé.\n

\n\n {active ? (\n <>\n MODE RETOURS PRÊTS ACTIF\n \n \n ) : (\n \n )}\n

\n );\n}","/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Rubrique « RETOURS PRÊTS ».\n *\n * Deux usages, une seule caméra et aucun appel Ecotrack direct :\n * 1. 🔄 CHARGER LES RETOURS PRÊTS → liste serveur (GET /api/returns/ready)\n * 2. 📷 SCANNER LES RETOURS PRÊTS → bascule le mode de lecture du scanner existant\n *\n * Ce composant ne crée aucune caméra et ne parle à aucune API : il délègue tout\n * à App.tsx, qui utilise les routes backend existantes.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport ReadyReturnsList from \"./ReadyReturnsList.tsx\";\n\nexport type ScanMode = \"normal\" | \"returns_ready\";\n\nexport type ReadyState = {\n loaded: boolean;\n loading: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n};\n\ntype Props = {\n scanMode: ScanMode;\n onStart: () => void;\n onStop: () => void;\n onLoad: () => void;\n onSelect: (item: ReadyReturn) => void;\n ready: ReadyState;\n disabled?: boolean;\n};\n\nexport default function ReturnsReadyCard({\n scanMode,\n onStart,\n onStop,\n onLoad,\n onSelect,\n ready,\n disabled = false,\n}: Props) {\n const active = scanMode === \"returns_ready\";\n\n return (\n

RETOURS PRÊTS

\n Charge la liste des colis prêts à être validés, ou scanne-les directement.\n

\n\n \n {ready.loading ? \"CHARGEMENT…\" : \"🔄 CHARGER LES RETOURS PRÊTS\"}\n \n\n \n\n {active ? (\n <>\n MODE RETOURS PRÊTS ACTIF\n \n \n ) : (\n \n )}\n

\n );\n}","createdAt",["D",1789513456884],"branchVersion","branchId","ff158aab-0096-40a5-8840-6ecf75e68750","id","ad65941b-e0c0-4a5b-89cf-11fa973d849a","sami-tech-retours",["D",1789511143425],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Scanner QR retours Ecotrack / OM Express + validation","imageUrl","0afb5d64-ebeb-4598-bd32-72c469e46178","pinnedFileId","7d7be91a-b154-11f1-ac17-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0a729-dd66-7509-8ac1-c1c985b77337","tursoName","ad65941be0c04a5b89cf11fa973d849a","tursoHostname","ad65941be0c04a5b89cf11fa973d849a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789696237964],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_107":106,"_115":111},"org",{"_107":106,"_108":109,"_110":111,"_19":62,"_112":113,"_114":31},"branch",{"_13":96,"_38":97,"_50":49,"_98":51,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":52,"_105":106},"isOwned",85,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","voidmarket","handle","displayName","sam rad","avatar","https://lh3.googleusercontent.com/a/ACg8ocLICX6mI-c9kDJUPFWRkbqww500mXryFODjCM8HOcTYTBsqIA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_50":51,"_38":52,"_45":401,"_54":-5,"_55":31,"_56":57,"_58":57,"_59":60,"_61":-5,"_19":62,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":70,"_71":72,"_73":74,"_75":76,"_77":402,"_79":-5,"_80":81,"_82":81,"_83":84,"_85":84,"_86":84,"_87":81,"_88":81,"_89":403,"_91":404,"_93":405,"_95":31},"tree",[190,194,212,215,216],"files",[190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216],"counts",{"_180":70,"_181":164,"_182":70,"_183":184,"_185":186},"contents",[138,139,140,141,142],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_50":174,"_38":175,"_36":176,"_145":-5,"_48":49,"_47":177,"_147":66,"_45":178,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_33":179},{"_50":168,"_38":169,"_36":170,"_145":-5,"_48":49,"_47":171,"_147":66,"_45":172,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_33":173},{"_50":161,"_38":162,"_36":163,"_145":-5,"_48":49,"_47":164,"_147":66,"_45":165,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_33":167},{"_50":154,"_38":155,"_36":156,"_145":-5,"_48":49,"_47":157,"_147":66,"_45":158,"_13":70,"_40":26,"_42":159,"_30":31,"_152":-5,"_33":160},{"_50":143,"_38":144,"_36":64,"_145":-5,"_48":49,"_47":146,"_147":66,"_45":148,"_13":149,"_40":150,"_42":151,"_30":31,"_152":-5,"_33":153},"55b7b067-ac39-40cb-8bec-42f264993253","index.ts","parentId",53,"latest",["D",1789513429320],6,"http","/**\n * SAMI.TECH — Retours Ecotrack\n * Backend HTTP (Hono) : verrouillage schéma 3x3, configuration Ecotrack,\n * vérification de tracking et validation officielle des retours.\n *\n * Projet totalement indépendant des autres applications SAMI.TECH :\n * aucune logique, aucun code, aucune base partagée.\n */\nimport { Hono } from \"npm:hono@4\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { ensureSchema, listRecentTrackings, rememberTracking } from \"./backend/db.ts\";\nimport {\n clearCookieHeader,\n createSession,\n destroySession,\n hasValidSession,\n isPatternConfigured,\n requireSession,\n sessionCookieHeader,\n setPattern,\n verifyPattern,\n} from \"./backend/access.ts\";\nimport {\n deleteCredentials,\n findOrder,\n getCredentials,\n listReadyReturns,\n mutateReturn,\n saveCredentials,\n} from \"./backend/ecotrack.ts\";\nimport { isReturnReadyStatus, isReturnValidatedStatus } from \"./shared/status.ts\";\nimport { extractTracking } from \"./shared/tracking.ts\";\n\nconst app = new Hono();\n\n/* ------------------------------------------------------------------ */\n/* Helpers */\n/* ------------------------------------------------------------------ */\n\nasync function readJson(request: Request): Promise | null> {\n try {\n const data = await request.json();\n return data && typeof data === \"object\" && !Array.isArray(data)\n ? (data as Record)\n : null;\n } catch {\n return null;\n }\n}\n\nfunction bodyString(body: Record | null, key: string): string {\n const value = body?.[key];\n return typeof value === \"string\" ? value : \"\";\n}\n\n/** Relecture du colis pour confirmer une validation ambiguë (jamais de 2e mutation). */\nasync function confirmValidated(apiToken: string, tracking: string): Promise {\n for (let attempt = 0; attempt < 3; attempt++) {\n await new Promise((resolve) => setTimeout(resolve, 1200));\n const lookup = await findOrder(apiToken, tracking);\n if (lookup.kind === \"found\" && isReturnValidatedStatus(lookup.statusRaw)) return true;\n }\n return false;\n}\n\n/* ------------------------------------------------------------------ */\n/* Santé */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/health\", (c) => c.json({ ok: true }));\n\n/* ------------------------------------------------------------------ */\n/* Accès (schéma 3x3) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/access/status\", async (c) => {\n const configured = await isPatternConfigured();\n const unlocked = configured ? await hasValidSession(c.req.raw) : false;\n return c.json({ ok: true, configured, unlocked });\n});\n\napp.post(\"/api/access/setup\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!/^\\d{4,9}$/.test(pattern)) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 400);\n }\n if (await isPatternConfigured()) {\n return c.json({ ok: false, code: \"ALREADY_CONFIGURED\" }, 409);\n }\n await setPattern(pattern);\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/unlock\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!(await isPatternConfigured())) {\n return c.json({ ok: false, code: \"NOT_CONFIGURED\" }, 409);\n }\n if (!(await verifyPattern(pattern))) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 401);\n }\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/logout\", async (c) => {\n await destroySession(c.req.raw);\n c.header(\"Set-Cookie\", clearCookieHeader());\n return c.json({ ok: true });\n});\n\n/* ------------------------------------------------------------------ */\n/* Configuration */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/config\", async (c) => {\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.get(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.post(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const apiToken = bodyString(await readJson(c.req.raw), \"apiToken\").trim();\n if (apiToken.length < 8) return c.json({ ok: false, code: \"INVALID_TOKEN\" }, 400);\n await saveCredentials(apiToken);\n return c.json({ ok: true, apiSaved: true });\n});\n\napp.delete(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n await deleteCredentials();\n return c.json({ ok: true, apiSaved: false });\n});\n\n/* ------------------------------------------------------------------ */\n/* Tracking */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n const lookup = await findOrder(credentials.apiToken, tracking);\n switch (lookup.kind) {\n case \"not_found\":\n return c.json(\n {\n ok: false,\n code: \"TRACKING_NOT_FOUND\",\n tracking,\n debug: lookup.payloadKeys.join(\", \"),\n },\n 404,\n );\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: lookup.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n\n // Mémorise le tracking (registre serveur) pour alimenter RETOURS PRÊTS.\n await rememberTracking(lookup.tracking, lookup.status);\n\n return c.json({\n ok: true,\n code: \"TRACKING_FOUND\",\n tracking: lookup.tracking,\n status: lookup.status,\n statusRaw: lookup.statusRaw,\n ready: isReturnReadyStatus(lookup.statusRaw),\n alreadyValidated: isReturnValidatedStatus(lookup.statusRaw),\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/return/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n // 1. Vérification serveur obligatoire AVANT toute mutation.\n const pre = await findOrder(credentials.apiToken, tracking);\n switch (pre.kind) {\n case \"not_found\":\n return c.json(\n {\n ok: false,\n code: \"TRACKING_NOT_FOUND\",\n tracking,\n debug: pre.payloadKeys.join(\", \"),\n },\n 404,\n );\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: pre.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n if (!isReturnReadyStatus(pre.statusRaw)) {\n return c.json({ ok: false, code: \"RETURN_NOT_READY\", tracking, status: pre.status }, 409);\n }\n\n // 2. Mutation officielle : POST /api/v1/valid/returns\n const mutation = await mutateReturn(credentials.apiToken, tracking);\n switch (mutation.kind) {\n case \"network_error\":\n return c.json({ ok: false, code: \"RETURN_NETWORK_ERROR\", tracking }, 502);\n case \"api_error\":\n return c.json({ ok: false, code: \"RETURN_API_ERROR\", status: mutation.status, tracking }, 502);\n case \"invalid\":\n return c.json(\n { ok: false, code: \"RETURN_INVALID\", message: mutation.message, tracking },\n 422,\n );\n case \"fail\":\n return c.json({ ok: false, code: \"RETURN_NOT_ELIGIBLE\", tracking }, 409);\n case \"success\":\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n\n // 3. Réponse vide / inattendue : ne JAMAIS annoncer le succès sans confirmation.\n const confirmed = await confirmValidated(credentials.apiToken, tracking);\n if (confirmed) {\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n return c.json({\n ok: true,\n code: \"RETURN_ACCEPTED_UNCONFIRMED\",\n tracking,\n confirmed: false,\n detail: \"Requête reçue par OM Express, validation non confirmée.\",\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Liste des retours prêts */\n/* */\n/* L'API Ecotrack n'expose pas de recherche par statut : cette route */\n/* tente d'abord un mode « liste » (lecture seule), puis retombe sur la */\n/* relecture des trackings connus, avec filtrage côté backend via */\n/* isReturnReadyStatus(). Aucune mutation ici. */\n/* ------------------------------------------------------------------ */\n\n/** Nombre maximum de trackings relus individuellement en mode repli. */\nconst REGISTRY_LIMIT = 15;\n\napp.get(\"/api/returns/ready\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n const registry = await listRecentTrackings(REGISTRY_LIMIT);\n const result = await listReadyReturns(credentials.apiToken, registry);\n\n return c.json({\n ok: true,\n source: result.source,\n count: result.items.length,\n items: result.items,\n scanned: result.scanned,\n diagnostics: result.diagnostics,\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Frontend (assets statiques, transpilés par Val Town) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", (c) => serveFile(c.req.path, import.meta.url));\n\napp.notFound((c) => {\n if (c.req.path.startsWith(\"/api/\")) {\n return c.json({ ok: false, code: \"NOT_FOUND\" }, 404);\n }\n return c.text(\"Not found\", 404);\n});\n\n// Initialisation de la base au démarrage : ne doit jamais casser /health.\ntry {\n await ensureSchema();\n} catch (error) {\n console.error(\"schema init failed\", error instanceof Error ? error.message : error);\n}\n\nexport default app.fetch;","label",[144],"cb365bb7-4319-4c82-be9f-cd9af9c1c2f5","README.md","ba4dfe96-b154-11f1-bc07-1607ee4eb77e",19,["D",1789511288587],"# SAMI.TECH — Retours Ecotrack\n\nApplication mobile de scan de QR codes de colis retournés, avec vérification du statut dans\n**OM Express / Ecotrack** et validation officielle du retour.\n\nProjet **totalement indépendant** des autres applications SAMI.TECH : code, logique, base SQLite\net fonctions propres à ce val.\n\n## Principe\n\n1. Déverrouillage par **schéma Android 3×3** (hash PBKDF2-SHA256 salé, côté serveur).\n2. La **caméra arrière démarre automatiquement** après déverrouillage et **ne se ferme plus**.\n3. Le **scanner QR reste actif en continu** : QR détecté → pause logique → traitement → reprise.\n4. Le **backend** relit le colis dans Ecotrack et décide seul de l'éligibilité.\n5. La validation n'est proposée que pour `retour_recu` ou `livraison_echoue_recu`.\n\n## Niveaux de fiabilité (toujours distingués)\n\n| Niveau | Signification |\n| --- | --- |\n| 1 | QR détecté |\n| 2 | Tracking trouvé dans OM Express |\n| 3 | Tracking éligible au retour (`retour_recu` / `livraison_echoue_recu`) |\n| 4 | Retour réellement validé (`returned = \"success\"` ou confirmation après relecture) |\n\nUn QR détecté ne signifie **jamais** que le retour est validé.\n\n## Architecture\n\n```mermaid\ngraph TD\n A[index.ts — Hono] --> B[backend/access.ts — schéma 3x3 + sessions]\n A --> C[backend/ecotrack.ts — API OM Express]\n A --> D[backend/db.ts — SQLite projet]\n A --> E[shared/status.ts + shared/tracking.ts]\n A --> F[frontend/index.html + root.tsx]\n F --> G[components/App.tsx — machine à états]\n G --> H[PatternGate.tsx]\n G --> I[Scanner.tsx — BarcodeDetector + jsQR]\n G --> J[StatusPanel / ManualEntry / HistoryList / Settings]\n E --> I\n```\n\n## Routes\n\n| Méthode | Route | Rôle |\n| --- | --- | --- |\n| GET | `/health` | Santé (`{ \"ok\": true }`) |\n| GET | `/api/access/status` | Schéma configuré ? session ouverte ? |\n| POST | `/api/access/setup` | Créer le schéma (une seule fois) |\n| POST | `/api/access/unlock` | Déverrouiller (cookie `sami_access`, ~12 h) |\n| POST | `/api/access/logout` | Verrouiller |\n| GET | `/api/config` | `apiSaved` |\n| GET/POST/DELETE | `/api/ecotrack/settings` | Token API (jamais réaffiché) |\n| POST | `/api/validate` | Vérifier un tracking |\n| POST | `/api/return/validate` | Valider un retour (mutation) |\n\n## API Ecotrack utilisée\n\n- Vérification token : `GET /api/v1/validate/token`\n- Lecture colis : `GET /api/v1/get/orders?tracking=...`\n- **Validation retour : `POST /api/v1/valid/returns`** avec `{ \"trackings\": [\"...\"] }`\n\n### Routes interdites\n\n- `/retours/recu/validated` — dépendait d'une session web Ecotrack (HTTP 403).\n- `/api/v1/valid/order` — autre opération, ne remplace pas `/valid/returns`.\n\n## Codes métier backend\n\n`API_NOT_CONFIGURED`, `ECOTRACK_READ_ERROR`, `ECOTRACK_BAD_RESPONSE`, `TRACKING_NOT_FOUND`,\n`TRACKING_FOUND`, `ECOTRACK_NETWORK_ERROR`, `RETURN_NOT_READY`, `RETURN_INVALID`,\n`RETURN_API_ERROR`, `RETURN_NOT_ELIGIBLE`, `RETURN_VALIDATED`, `RETURN_ACCEPTED_UNCONFIRMED`,\n`RETURN_UNEXPECTED_RESPONSE`, `RETURN_NETWORK_ERROR`.\n\n## Sécurité\n\n- Le token API est stocké **côté serveur** dans `app_settings.ecotrack_api_credentials`\n (clé `ecotrack_api_credentials`, format `{ \"apiToken\": \"...\" }`).\n- Il n'est **jamais** renvoyé au navigateur, jamais loggé, jamais placé en URL publique.\n- Le schéma est stocké sous forme de hash salé ; les sessions ne stockent que le SHA-256 du token.\n- Les logs de validation ne contiennent que `httpStatus`, `returned` et `emptyBody`.\n\n## Premier lancement\n\n1. Ouvrir [l'application](url:index.ts) — le schéma 3×3 est demandé (à créer puis confirmer).\n2. Icône ⚙ → coller le **token API Ecotrack** → `ENREGISTRER L'API`.\n3. La caméra démarre automatiquement : scanner un QR de colis.\n4. Si le colis est éligible, `VALIDER LE RETOUR` apparaît ; sinon le scanner reprend seul.\n\n> La base SQLite et les réglages sont propres à ce val. Aucune donnée n'est partagée avec une\n> autre application SAMI.TECH.",[155],"1f6fa16e-5c7c-4980-84f4-6be2d6a11da3","shared","bdc31962-8a03-4e1e-b919-22d73d4d7c5b",1,["D",1789511156942],"directory",[162],"d059b4c5-52dc-4b09-b505-15182f5cefe4","frontend","073bfc8f-0576-4e69-b7c4-68b0645cad94",7,["D",1789511212578],[169],"0f5af76f-7d2c-4035-9d53-5e115fec2804","backend","cb9b26c6-3552-462f-9d4a-105dd9b5b222",3,["D",1789511156996],[175],"pulls","branches","forks","envVars",{"_187":70,"_189":70},"connections",{"_187":70,"_188":70},"count","unfilledCount","emptyCount",{"_50":174,"_38":175,"_36":176,"_145":-5,"_48":49,"_47":177,"_147":66,"_45":398,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_218":399,"_33":400},{"_50":391,"_38":392,"_36":393,"_145":176,"_48":49,"_47":379,"_147":66,"_45":394,"_13":70,"_40":41,"_42":395,"_30":31,"_152":-5,"_218":396,"_33":397},{"_50":383,"_38":384,"_36":385,"_145":176,"_48":49,"_47":386,"_147":66,"_45":387,"_13":227,"_40":41,"_42":388,"_30":31,"_152":-5,"_218":389,"_33":390},{"_50":374,"_38":375,"_36":376,"_145":176,"_48":49,"_47":377,"_147":31,"_45":378,"_13":379,"_40":41,"_42":380,"_30":31,"_152":-5,"_218":381,"_33":382},{"_50":168,"_38":169,"_36":170,"_145":-5,"_48":49,"_47":171,"_147":66,"_45":371,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_218":372,"_33":373},{"_50":367,"_38":298,"_36":292,"_145":170,"_48":49,"_47":338,"_147":66,"_45":368,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_218":369,"_33":370},{"_50":359,"_38":360,"_36":361,"_145":292,"_48":49,"_47":362,"_147":31,"_45":363,"_13":149,"_40":41,"_42":364,"_30":31,"_152":-5,"_218":365,"_33":366},{"_50":351,"_38":352,"_36":353,"_145":292,"_48":49,"_47":354,"_147":66,"_45":355,"_13":70,"_40":41,"_42":356,"_30":31,"_152":-5,"_218":357,"_33":358},{"_50":343,"_38":344,"_36":345,"_145":292,"_48":49,"_47":346,"_147":66,"_45":347,"_13":70,"_40":41,"_42":348,"_30":31,"_152":-5,"_218":349,"_33":350},{"_50":335,"_38":336,"_36":337,"_145":292,"_48":49,"_47":338,"_147":66,"_45":339,"_13":70,"_40":41,"_42":340,"_30":31,"_152":-5,"_218":341,"_33":342},{"_50":327,"_38":328,"_36":329,"_145":292,"_48":49,"_47":330,"_147":31,"_45":331,"_13":70,"_40":41,"_42":332,"_30":31,"_152":-5,"_218":333,"_33":334},{"_50":319,"_38":320,"_36":321,"_145":292,"_48":49,"_47":322,"_147":66,"_45":323,"_13":70,"_40":41,"_42":324,"_30":31,"_152":-5,"_218":325,"_33":326},{"_50":315,"_38":39,"_36":37,"_145":292,"_48":49,"_47":14,"_147":31,"_45":316,"_13":164,"_40":41,"_42":44,"_30":31,"_152":-5,"_218":317,"_33":318},{"_50":307,"_38":308,"_36":309,"_145":292,"_48":49,"_47":310,"_147":66,"_45":311,"_13":285,"_40":41,"_42":312,"_30":31,"_152":-5,"_218":313,"_33":314},{"_50":299,"_38":300,"_36":301,"_145":292,"_48":49,"_47":302,"_147":66,"_45":303,"_13":70,"_40":41,"_42":304,"_30":31,"_152":-5,"_218":305,"_33":306},{"_50":289,"_38":290,"_36":291,"_145":292,"_48":49,"_47":293,"_147":66,"_45":294,"_13":164,"_40":41,"_42":295,"_30":31,"_152":-5,"_218":296,"_33":297},{"_50":284,"_38":275,"_36":269,"_145":170,"_48":49,"_47":285,"_147":66,"_45":286,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_218":287,"_33":288},{"_50":276,"_38":277,"_36":278,"_145":269,"_48":49,"_47":279,"_147":66,"_45":280,"_13":227,"_40":41,"_42":281,"_30":31,"_152":-5,"_218":282,"_33":283},{"_50":266,"_38":267,"_36":268,"_145":269,"_48":49,"_47":270,"_147":66,"_45":271,"_13":164,"_40":41,"_42":272,"_30":31,"_152":-5,"_218":273,"_33":274},{"_50":259,"_38":260,"_36":261,"_145":170,"_48":49,"_47":171,"_147":66,"_45":262,"_13":70,"_40":26,"_42":263,"_30":31,"_152":-5,"_218":264,"_33":265},{"_50":251,"_38":252,"_36":253,"_145":170,"_48":49,"_47":254,"_147":66,"_45":255,"_13":70,"_40":41,"_42":256,"_30":31,"_152":-5,"_218":257,"_33":258},{"_50":243,"_38":244,"_36":245,"_145":170,"_48":49,"_47":246,"_147":31,"_45":247,"_13":177,"_40":26,"_42":248,"_30":31,"_152":-5,"_218":249,"_33":250},{"_50":161,"_38":162,"_36":163,"_145":-5,"_48":49,"_47":164,"_147":66,"_45":240,"_13":70,"_40":166,"_42":-5,"_30":31,"_152":-5,"_218":241,"_33":242},{"_50":232,"_38":233,"_36":234,"_145":163,"_48":49,"_47":235,"_147":66,"_45":236,"_13":164,"_40":41,"_42":237,"_30":31,"_152":-5,"_218":238,"_33":239},{"_50":224,"_38":225,"_36":226,"_145":163,"_48":49,"_47":227,"_147":66,"_45":228,"_13":70,"_40":41,"_42":229,"_30":31,"_152":-5,"_218":230,"_33":231},{"_50":154,"_38":155,"_36":156,"_145":-5,"_48":49,"_47":157,"_147":66,"_45":221,"_13":70,"_40":26,"_42":159,"_30":31,"_152":-5,"_218":222,"_33":223},{"_50":143,"_38":144,"_36":64,"_145":-5,"_48":49,"_47":146,"_147":66,"_45":217,"_13":149,"_40":150,"_42":151,"_30":31,"_152":-5,"_218":219,"_33":220},["D",1789513429320],"children",[],[144],["D",1789511288587],[],[155],"dd1deb99-f776-45fb-acf4-93e3a4d696f2","tracking.ts","6bd68792-b154-11f1-91d7-1607ee4eb77e",2,["D",1789511156972],"/**\n * Extraction d'un numéro de tracking depuis un contenu de QR code.\n *\n * Fonction pure, partagée entre le backend et le frontend.\n */\n\n/** Forme canonique d'un tracking : 6 à 64 caractères A-Z, 0-9, `_`, `-`. */\nconst TRACKING_SHAPE = /^[A-Z0-9_-]{6,64}$/;\n\n/** Recherche d'un tracking noyé dans un contenu plus large (URL, JSON, texte). */\nconst TRACKING_CANDIDATE = /[A-Z0-9][A-Z0-9_-]{5,63}/g;\n\n/** Nettoie une valeur : conserve A-Z, 0-9, `_`, `-` puis passe en majuscules. */\nexport function normalizeTracking(value: string): string {\n return value.replace(/[^A-Za-z0-9_-]/g, \"\").toUpperCase();\n}\n\n/** Vrai si la valeur a exactement la forme d'un tracking. */\nexport function isTrackingShape(value: string): boolean {\n return TRACKING_SHAPE.test(value);\n}\n\n/**\n * Extrait un tracking depuis un contenu de QR code.\n * Retourne une chaîne vide si rien d'exploitable n'est trouvé.\n */\nexport function extractTracking(raw: unknown): string {\n const text = typeof raw === \"string\" ? raw : String(raw ?? \"\");\n const trimmed = text.trim();\n if (!trimmed) return \"\";\n\n // Cas nominal : le QR contient uniquement le tracking.\n if (isTrackingShape(trimmed)) return trimmed.toUpperCase();\n\n // Cas secondaire : le tracking est noyé dans une URL ou un texte.\n const candidates = trimmed.toUpperCase().match(TRACKING_CANDIDATE) ?? [];\n\n // Priorité aux candidats mixtes lettres + chiffres (forme Ecotrack / OM Express).\n for (const candidate of candidates) {\n if (/[A-Z]/.test(candidate) && /\\d/.test(candidate)) return candidate;\n }\n // Puis aux candidats contenant une longue suite de chiffres.\n for (const candidate of candidates) {\n if (/\\d{6,}/.test(candidate)) return candidate;\n }\n return candidates[0] ?? \"\";\n}",[],[162,225],"b0f67b78-1eb9-48cc-94ce-47ec45738043","status.ts","6bd26bbc-b154-11f1-91d7-1607ee4eb77e",35,["D",1789511884442],"/**\n * Normalisation et interprétation des statuts Ecotrack.\n *\n * Fonctions pures, partagées entre le backend (index.ts) et le frontend.\n * Source de vérité unique : ne jamais dupliquer cette logique ailleurs.\n */\n\n/** Statuts Ecotrack qui autorisent la validation du retour. */\nconst READY_STATUSES = new Set([\n \"retour_recu\",\n \"livraison_echoue_recu\",\n]);\n\n/** Statuts confirmant qu'un retour a déjà été validé (orthographe Ecotrack conservée). */\nconst VALIDATED_STATUSES = new Set([\n \"return_validated_by_partener\",\n \"return_validated_by_partner\",\n \"retour_valide\",\n \"retour_validee\",\n]);\n\n/** Clés possibles du statut dans une réponse Ecotrack. */\nconst STATUS_KEYS = [\n \"status_name\",\n \"status\",\n \"statut\",\n \"etat\",\n \"state\",\n \"status_label\",\n \"statut_colis\",\n \"etat_colis\",\n \"return_status\",\n \"delivery_status\",\n];\n\n/**\n * Normalise un statut : chaîne, trim, minuscules, sans accents,\n * espaces et tirets remplacés par `_`.\n * Exemple : \"Retour Reçu\" -> \"retour_recu\"\n */\nexport function normalizeStatus(value: unknown): string {\n return String(value ?? \"\")\n .normalize(\"NFD\")\n .replace(/[\\u0300-\\u036f]/g, \"\")\n .trim()\n .toLowerCase()\n .replace(/[\\s-]+/g, \"_\")\n .replace(/_+/g, \"_\")\n .replace(/^_|_$/g, \"\");\n}\n\n/** Vrai uniquement pour `retour_recu` ou `livraison_echoue_recu`. */\nexport function isReturnReadyStatus(value: unknown): boolean {\n return READY_STATUSES.has(normalizeStatus(value));\n}\n\n/** Vrai si le statut indique qu'un retour a déjà été validé. */\nexport function isReturnValidatedStatus(value: unknown): boolean {\n return VALIDATED_STATUSES.has(normalizeStatus(value));\n}\n\n/** Extrait le statut brut d'une commande Ecotrack, quel que soit le champ utilisé. */\nexport function extractStatusValue(order: Record | null | undefined): string {\n if (!order) return \"\";\n for (const key of STATUS_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim();\n if (value && typeof value === \"object\") {\n const nested = value as Record;\n const candidate = nested.name ?? nested.label ?? nested.libelle;\n if (typeof candidate === \"string\" && candidate.trim()) return candidate.trim();\n }\n }\n return \"\";\n}",[],[162,233],["D",1789511156942],[213,214],[162],"31b7fd15-c41f-4478-a1fa-065a996282c6","style.css","8d06e5ce-b154-11f1-b96e-1607ee4eb77e",57,["D",1789513445194],"/* SAMI.TECH — Retours Ecotrack : interface mobile (max 430 px) */\n\n:root {\n --bg: #04120c;\n --bg-soft: #071a12;\n --card: #0b2118;\n --card-2: #103024;\n --line: #1c4634;\n --text: #ffffff;\n --muted: #9db8ac;\n --accent: #35e59a;\n --accent-dim: #1d8f5f;\n --danger: #ff6b6b;\n --warn: #ffc857;\n --radius: 18px;\n}\n\n* {\n box-sizing: border-box;\n -webkit-tap-highlight-color: transparent;\n}\n\nhtml,\nbody {\n margin: 0;\n padding: 0;\n background: var(--bg);\n color: var(--text);\n}\n\nbody {\n font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, Helvetica, Arial, sans-serif;\n min-height: 100dvh;\n overscroll-behavior-y: contain;\n}\n\nbutton,\ninput {\n font-family: inherit;\n}\n\n.app {\n max-width: 430px;\n margin: 0 auto;\n padding: 14px 14px 34px;\n display: flex;\n flex-direction: column;\n gap: 12px;\n}\n\n.boot {\n padding: 60px 0;\n text-align: center;\n color: var(--muted);\n}\n\n.muted {\n color: var(--muted);\n font-size: 13px;\n line-height: 1.5;\n margin: 0;\n}\n\n/* ---------------------------------------------------------------- */\n/* En-tête */\n/* ---------------------------------------------------------------- */\n\n.app-header {\n display: flex;\n align-items: center;\n justify-content: space-between;\n gap: 10px;\n padding: 4px 2px 2px;\n}\n\n.brand {\n display: flex;\n flex-direction: column;\n gap: 2px;\n}\n\n.brand-mark {\n font-size: 19px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.brand-dot {\n color: var(--accent);\n}\n\n.brand-sub {\n font-size: 12px;\n color: var(--muted);\n letter-spacing: 0.4px;\n}\n\n.icon-btn {\n width: 42px;\n height: 42px;\n border-radius: 13px;\n border: 1px solid var(--line);\n background: var(--card);\n color: var(--text);\n font-size: 18px;\n line-height: 1;\n cursor: pointer;\n display: grid;\n place-items: center;\n}\n\n.icon-btn:active {\n background: var(--card-2);\n}\n\n/* ---------------------------------------------------------------- */\n/* Cartes */\n/* ---------------------------------------------------------------- */\n\n.card {\n background: var(--card);\n border: 1px solid var(--line);\n border-radius: var(--radius);\n padding: 14px;\n}\n\n.card-label {\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.4px;\n color: var(--muted);\n margin-bottom: 10px;\n}\n\n/* ---------------------------------------------------------------- */\n/* ÉTAT (au-dessus de la caméra) */\n/* ---------------------------------------------------------------- */\n\n.status-card {\n background: linear-gradient(180deg, #0c2419 0%, #0b2118 100%);\n}\n\n.status-line {\n display: flex;\n align-items: flex-start;\n gap: 10px;\n}\n\n.pulse {\n flex: none;\n width: 10px;\n height: 10px;\n margin-top: 5px;\n border-radius: 50%;\n background: var(--accent);\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0.6);\n animation: pulse 1.8s infinite;\n}\n\n@keyframes pulse {\n 0% {\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0.55);\n }\n 70% {\n box-shadow: 0 0 0 12px rgba(53, 229, 154, 0);\n }\n 100% {\n box-shadow: 0 0 0 0 rgba(53, 229, 154, 0);\n }\n}\n\n.status-text {\n margin: 0;\n font-size: 15px;\n font-weight: 600;\n line-height: 1.35;\n}\n\n.tracking-chip {\n margin-top: 12px;\n display: inline-flex;\n align-items: center;\n gap: 8px;\n padding: 7px 11px;\n border-radius: 999px;\n background: rgba(53, 229, 154, 0.12);\n border: 1px solid rgba(53, 229, 154, 0.35);\n font-size: 11px;\n letter-spacing: 1px;\n color: var(--muted);\n}\n\n.tracking-chip strong {\n color: var(--accent);\n font-size: 13px;\n letter-spacing: 0.5px;\n word-break: break-all;\n}\n\n/* ---------------------------------------------------------------- */\n/* Caméra / scanner */\n/* ---------------------------------------------------------------- */\n\n.scanner-card {\n padding: 0;\n overflow: hidden;\n}\n\n.scanner-stage {\n position: relative;\n width: 100%;\n aspect-ratio: 3 / 4;\n background: #020906;\n overflow: hidden;\n}\n\n.scanner-video {\n position: absolute;\n inset: 0;\n width: 100%;\n height: 100%;\n object-fit: cover;\n background: #020906;\n}\n\n.frame {\n position: absolute;\n left: 50%;\n top: 50%;\n transform: translate(-50%, -50%);\n width: 68%;\n aspect-ratio: 1 / 1;\n border: 2px solid rgba(255, 255, 255, 0.92);\n border-radius: 16px;\n transition: border-color 90ms linear, box-shadow 90ms linear;\n pointer-events: none;\n}\n\n.frame.scanned {\n border-color: var(--accent);\n box-shadow: 0 0 0 3px rgba(53, 229, 154, 0.28), 0 0 26px rgba(53, 229, 154, 0.5);\n}\n\n.corner {\n position: absolute;\n width: 26px;\n height: 26px;\n border: 3px solid rgba(255, 255, 255, 0.95);\n transition: border-color 90ms linear;\n}\n\n.frame.scanned .corner {\n border-color: var(--accent);\n}\n\n.corner-tl {\n top: -3px;\n left: -3px;\n border-right: none;\n border-bottom: none;\n border-top-left-radius: 16px;\n}\n\n.corner-tr {\n top: -3px;\n right: -3px;\n border-left: none;\n border-bottom: none;\n border-top-right-radius: 16px;\n}\n\n.corner-bl {\n bottom: -3px;\n left: -3px;\n border-right: none;\n border-top: none;\n border-bottom-left-radius: 16px;\n}\n\n.corner-br {\n bottom: -3px;\n right: -3px;\n border-left: none;\n border-top: none;\n border-bottom-right-radius: 16px;\n}\n\n.scanner-off {\n position: absolute;\n inset: 0;\n display: flex;\n flex-direction: column;\n align-items: center;\n justify-content: center;\n gap: 10px;\n color: var(--muted);\n font-size: 14px;\n font-weight: 600;\n background: rgba(2, 9, 6, 0.92);\n}\n\n.qr-icon {\n font-size: 30px;\n color: var(--accent);\n opacity: 0.85;\n}\n\n/* ---------------------------------------------------------------- */\n/* Saisie manuelle */\n/* ---------------------------------------------------------------- */\n\n.manual-row {\n display: flex;\n gap: 8px;\n}\n\n.manual-input {\n flex: 1 1 auto;\n min-width: 0;\n height: 46px;\n padding: 0 12px;\n border-radius: 12px;\n border: 1px solid var(--line);\n background: #071a12;\n color: var(--text);\n font-size: 15px;\n letter-spacing: 1px;\n text-transform: uppercase;\n outline: none;\n}\n\n.manual-input:focus {\n border-color: var(--accent-dim);\n}\n\n.manual-input::placeholder {\n color: #5f7a6e;\n letter-spacing: 0.5px;\n text-transform: none;\n}\n\n/* ---------------------------------------------------------------- */\n/* Boutons */\n/* ---------------------------------------------------------------- */\n\n.btn {\n border: 1px solid var(--line);\n background: var(--card-2);\n color: var(--text);\n border-radius: 12px;\n height: 46px;\n padding: 0 16px;\n font-size: 13px;\n font-weight: 700;\n letter-spacing: 1px;\n cursor: pointer;\n white-space: nowrap;\n}\n\n.btn:disabled {\n opacity: 0.55;\n cursor: default;\n}\n\n.btn-primary {\n width: 100%;\n height: 56px;\n font-size: 15px;\n border: none;\n color: #04120c;\n background: linear-gradient(180deg, #45f0a6 0%, var(--accent) 100%);\n box-shadow: 0 10px 26px rgba(53, 229, 154, 0.24);\n}\n\n.btn-primary:active:not(:disabled) {\n transform: translateY(1px);\n}\n\n.btn-danger {\n border-color: rgba(255, 107, 107, 0.5);\n color: var(--danger);\n background: rgba(255, 107, 107, 0.08);\n}\n\n/* ---------------------------------------------------------------- */\n/* Historique */\n/* ---------------------------------------------------------------- */\n\n.history-list {\n list-style: none;\n margin: 0;\n padding: 0;\n display: flex;\n flex-direction: column;\n gap: 7px;\n}\n\n.history-item {\n display: flex;\n align-items: center;\n gap: 9px;\n padding: 9px 11px;\n border-radius: 11px;\n background: #071a12;\n border: 1px solid var(--line);\n font-size: 13px;\n letter-spacing: 0.6px;\n word-break: break-all;\n}\n\n.history-check {\n flex: none;\n color: var(--accent);\n font-weight: 700;\n}\n\n/* ---------------------------------------------------------------- */\n/* Footer */\n/* ---------------------------------------------------------------- */\n\n.app-footer {\n text-align: center;\n font-size: 11px;\n color: #5f7a6e;\n line-height: 1.6;\n padding: 6px 4px 0;\n}\n\n/* ---------------------------------------------------------------- */\n/* Verrouillage (schéma 3x3) */\n/* ---------------------------------------------------------------- */\n\n.gate {\n max-width: 430px;\n margin: 0 auto;\n min-height: 100dvh;\n padding: 28px 20px 40px;\n display: flex;\n flex-direction: column;\n justify-content: center;\n gap: 18px;\n}\n\n.gate-head {\n text-align: center;\n}\n\n.gate-title {\n margin: 0 0 6px;\n font-size: 20px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.gate-hint {\n margin: 0;\n font-size: 13px;\n color: var(--muted);\n line-height: 1.5;\n}\n\n.pattern-wrap {\n position: relative;\n width: 100%;\n max-width: 290px;\n margin: 0 auto;\n aspect-ratio: 1 / 1;\n touch-action: none;\n user-select: none;\n}\n\n.pattern-svg {\n position: absolute;\n inset: 0;\n width: 100%;\n height: 100%;\n pointer-events: none;\n}\n\n.pattern-line {\n fill: none;\n stroke: var(--accent);\n stroke-width: 0.09;\n stroke-linecap: round;\n stroke-linejoin: round;\n}\n\n.pattern-grid {\n position: absolute;\n inset: 0;\n display: grid;\n grid-template-columns: repeat(3, 1fr);\n grid-template-rows: repeat(3, 1fr);\n}\n\n.pattern-cell {\n display: grid;\n place-items: center;\n}\n\n.pattern-dot {\n width: 22%;\n aspect-ratio: 1 / 1;\n border-radius: 50%;\n border: 2px solid var(--line);\n background: #071a12;\n transition: background 90ms linear, border-color 90ms linear, transform 90ms linear;\n}\n\n.pattern-cell.active .pattern-dot {\n background: var(--accent);\n border-color: var(--accent);\n transform: scale(1.18);\n box-shadow: 0 0 16px rgba(53, 229, 154, 0.5);\n}\n\n.gate-error {\n min-height: 20px;\n text-align: center;\n font-size: 13px;\n color: var(--danger);\n}\n\n.gate-actions {\n display: flex;\n flex-direction: column;\n gap: 8px;\n}\n\n/* ---------------------------------------------------------------- */\n/* Panneau paramètres */\n/* ---------------------------------------------------------------- */\n\n.overlay {\n position: fixed;\n inset: 0;\n background: rgba(2, 9, 6, 0.78);\n backdrop-filter: blur(3px);\n display: flex;\n align-items: flex-end;\n justify-content: center;\n z-index: 40;\n}\n\n.sheet {\n width: 100%;\n max-width: 430px;\n background: var(--card);\n border-top: 1px solid var(--line);\n border-radius: 22px 22px 0 0;\n padding: 18px 16px calc(20px + env(safe-area-inset-bottom));\n display: flex;\n flex-direction: column;\n gap: 14px;\n}\n\n.sheet-title {\n margin: 0;\n font-size: 16px;\n font-weight: 800;\n letter-spacing: 0.5px;\n}\n\n.badge {\n display: inline-flex;\n align-items: center;\n gap: 7px;\n align-self: flex-start;\n padding: 6px 11px;\n border-radius: 999px;\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.1px;\n border: 1px solid var(--line);\n color: var(--muted);\n background: #071a12;\n}\n\n.badge-ok {\n color: var(--accent);\n border-color: rgba(53, 229, 154, 0.4);\n background: rgba(53, 229, 154, 0.1);\n}\n\n.field {\n display: flex;\n flex-direction: column;\n gap: 7px;\n}\n\n.field-label {\n font-size: 11px;\n font-weight: 700;\n letter-spacing: 1.2px;\n color: var(--muted);\n}\n\n.input {\n height: 46px;\n padding: 0 12px;\n border-radius: 12px;\n border: 1px solid var(--line);\n background: #071a12;\n color: var(--text);\n font-size: 14px;\n outline: none;\n}\n\n.input:focus {\n border-color: var(--accent-dim);\n}\n\n.notice {\n margin: 0;\n font-size: 12.5px;\n line-height: 1.5;\n color: var(--accent);\n}\n\n.sheet-actions {\n display: flex;\n flex-direction: column;\n gap: 8px;\n}\n\n.sheet-row {\n display: flex;\n gap: 8px;\n}\n\n.sheet-row .btn {\n flex: 1 1 0;\n}/* ---------------------------------------------------------------- */\n/* ÉTAT : tons (vert / ambre / rouge / gris) */\n/* ---------------------------------------------------------------- */\n\n.status-card.status-idle .pulse {\n background: var(--muted);\n animation: none;\n box-shadow: none;\n}\n\n.status-card.status-busy .pulse {\n background: var(--warn);\n box-shadow: 0 0 0 0 rgba(255, 200, 87, 0.55);\n}\n\n.status-card.status-ok {\n border-color: rgba(53, 229, 154, 0.45);\n}\n\n.status-card.status-ok .status-text {\n color: #d9ffee;\n}\n\n.status-card.status-warn {\n border-color: rgba(255, 200, 87, 0.42);\n background: linear-gradient(180deg, #241d0d 0%, #0b2118 100%);\n}\n\n.status-card.status-warn .pulse {\n background: var(--warn);\n box-shadow: 0 0 0 0 rgba(255, 200, 87, 0.55);\n}\n\n.status-card.status-warn .status-text {\n color: #ffe9bd;\n}\n\n.status-card.status-error {\n border-color: rgba(255, 107, 107, 0.5);\n background: linear-gradient(180deg, #2b1114 0%, #0b2118 100%);\n}\n\n.status-card.status-error .pulse {\n background: var(--danger);\n animation: none;\n box-shadow: 0 0 0 3px rgba(255, 107, 107, 0.16);\n}\n\n.status-card.status-error .status-text {\n color: #ffd9d9;\n}\n\n.status-hint {\n margin: 9px 0 0;\n font-size: 11.5px;\n line-height: 1.45;\n color: var(--muted);\n word-break: break-word;\n}\n\n/* Cadre du scanner en échec */\n.frame.error {\n border-color: var(--danger);\n box-shadow: 0 0 0 3px rgba(255, 107, 107, 0.26), 0 0 26px rgba(255, 107, 107, 0.45);\n}\n\n.frame.error .corner {\n border-color: var(--danger);\n}/* ---------------------------------------------------------------- */\n/* Carte RETOURS PRÊTS */\n/* ---------------------------------------------------------------- */\n\n.returns-card {\n display: flex;\n flex-direction: column;\n gap: 10px;\n}\n\n.returns-help {\n margin: 0;\n}\n\n.btn-returns {\n border-color: rgba(53, 229, 154, 0.45);\n background: rgba(53, 229, 154, 0.1);\n color: var(--accent);\n}/* ---------------------------------------------------------------- */\n/* Liste RETOURS PRÊTS + fiche retour */\n/* ---------------------------------------------------------------- */\n\n.ready-head {\n display: flex;\n align-items: center;\n justify-content: space-between;\n gap: 8px;\n}\n\n.ready-count {\n font-size: 12px;\n font-weight: 700;\n letter-spacing: 1.1px;\n}\n\n.ready-source {\n font-size: 10.5px;\n color: var(--muted);\n letter-spacing: 0.6px;\n}\n\n.ready-list {\n list-style: none;\n margin: 0;\n padding: 0;\n display: flex;\n flex-direction: column;\n gap: 8px;\n max-height: 320px;\n overflow-y: auto;\n}\n\n.ready-item {\n width: 100%;\n text-align: left;\n display: flex;\n flex-direction: column;\n gap: 4px;\n padding: 11px 12px;\n border-radius: 12px;\n border: 1px solid var(--line);\n background: #071a12;\n color: var(--text);\n cursor: pointer;\n}\n\n.ready-item:active {\n background: var(--card-2);\n}\n\n.ready-item-top {\n font-size: 11px;\n letter-spacing: 1px;\n color: var(--muted);\n}\n\n.ready-item-top strong {\n color: var(--accent);\n font-size: 13px;\n letter-spacing: 0.5px;\n word-break: break-all;\n}\n\n.ready-item-bottom {\n font-size: 12px;\n color: var(--muted);\n}\n\n.detail-row {\n display: flex;\n flex-direction: column;\n gap: 4px;\n padding: 11px 12px;\n border-radius: 12px;\n background: #071a12;\n border: 1px solid var(--line);\n}\n\n.detail-label {\n font-size: 10.5px;\n letter-spacing: 1.2px;\n color: var(--muted);\n}\n\n.detail-value {\n font-size: 14px;\n font-weight: 600;\n word-break: break-all;\n}\n\n.detail-value.accent {\n color: var(--accent);\n}",[],[169,244],"f1182f18-515d-440c-87d9-8f92557c7ad0","root.tsx","b35d4240-b154-11f1-a81e-1607ee4eb77e",18,["D",1789511276974],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/** Racine frontend : monte l'application React dans #root. */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { createRoot } from \"https://esm.sh/react-dom@18.2.0/client?deps=react@18.2.0\";\nimport App from \"./components/App.tsx\";\n\nconst container = document.getElementById(\"root\");\nif (container) {\n createRoot(container).render();\n}",[],[169,252],"19fbdc20-528c-4e75-a1ff-7bd73c7353f5","index.html","8cfbe944-b154-11f1-b96e-1607ee4eb77e",["D",1789511212578],"\n\n \n \n \n \n \n \n \n \n \n SAMI.TECH — Retours Ecotrack\n \n \n \n

\n \n \n",[],[169,260],"4b43d310-2ee2-46ec-a5f7-e3238ff5389e","messages.ts","8d1f9d26-b154-11f1-b96e-1607ee4eb77e","07620b9a-84bf-4cea-b8dd-75e58750fcbc",20,["D",1789511823118],"/** Traduction des codes métier backend en messages utilisateur. */\nimport { normalizeStatus } from \"../../shared/status.ts\";\n\nexport function messageForCode(code: string): string {\n switch (code) {\n case \"API_NOT_CONFIGURED\":\n return \"Aucune API Ecotrack enregistrée — ouvre les paramètres.\";\n case \"INVALID_TOKEN\":\n return \"Token API invalide.\";\n case \"INVALID_TRACKING\":\n return \"Numéro de tracking invalide.\";\n case \"TRACKING_NOT_FOUND\":\n return \"Tracking introuvable dans OM Express.\";\n case \"ECOTRACK_READ_ERROR\":\n return \"OM Express a refusé la lecture du colis.\";\n case \"ECOTRACK_BAD_RESPONSE\":\n return \"Réponse illisible de OM Express.\";\n case \"ECOTRACK_NETWORK_ERROR\":\n return \"Erreur réseau vers OM Express.\";\n case \"RETURN_NOT_READY\":\n return \"Retour non éligible : le statut ne permet pas la validation.\";\n case \"RETURN_NOT_ELIGIBLE\":\n return \"Retour non éligible (OM Express a répondu fail).\";\n case \"RETURN_INVALID\":\n return \"Validation refusée par OM Express (requête invalide).\";\n case \"RETURN_API_ERROR\":\n return \"Erreur OM Express pendant la validation.\";\n case \"RETURN_NETWORK_ERROR\":\n return \"Erreur réseau pendant la validation.\";\n case \"UNAUTHORIZED\":\n return \"Session expirée — reverrouille l'application.\";\n default:\n return \"Opération impossible pour le moment.\";\n }\n}\n\n/** Libellé lisible d'un statut Ecotrack brut. */\nexport function statusLabel(raw: string): string {\n switch (normalizeStatus(raw)) {\n case \"retour_recu\":\n return \"Retour reçu\";\n case \"livraison_echoue_recu\":\n return \"Livraison échouée — reçu\";\n case \"return_validated_by_partener\":\n case \"return_validated_by_partner\":\n case \"retour_valide\":\n case \"retour_validee\":\n return \"Retour déjà validé\";\n default:\n return raw.trim() || \"statut inconnu\";\n }\n}\n\n/** Vibration courte, jamais bloquante. */\nexport function vibrate(pattern: number[]): void {\n try {\n if (typeof navigator.vibrate === \"function\") navigator.vibrate(pattern);\n } catch {\n /* ignore */\n }\n}/**\n * Ton de l'ÉTAT : pilote la couleur du voyant et du cadre du scanner.\n * idle -> gris (repos)\n * busy -> ambre (traitement en cours)\n * ok -> vert (succès / prêt)\n * warn -> ambre (trouvé mais non éligible)\n * error -> rouge (échec)\n */\nexport type StatusTone = \"idle\" | \"busy\" | \"ok\" | \"warn\" | \"error\";\n\nexport function toneForCode(code: string): StatusTone {\n switch (code) {\n case \"TRACKING_FOUND\":\n case \"RETURN_VALIDATED\":\n return \"ok\";\n case \"RETURN_ACCEPTED_UNCONFIRMED\":\n case \"RETURN_NOT_READY\":\n case \"RETURN_NOT_ELIGIBLE\":\n return \"warn\";\n default:\n return \"error\";\n }\n}",[],[169,275,267],"lib","f0e4c272-af21-43ea-91a8-38ce5116eb20","api.ts","8d0e7514-b154-11f1-b96e-1607ee4eb77e",54,["D",1789513445064],"/**\n * Appels API côté navigateur.\n * Le frontend n'envoie que des informations fonctionnelles :\n * jamais de token, jamais de cookie Ecotrack, jamais de credential.\n */\n\nexport type ValidateOk = {\n ok: true;\n code: \"TRACKING_FOUND\";\n tracking: string;\n status: string;\n statusRaw: string;\n ready: boolean;\n alreadyValidated: boolean;\n};\n\nexport type ApiError = {\n ok: false;\n code: string;\n status?: number;\n message?: string;\n detail?: string;\n /** Noms des clés renvoyées par Ecotrack (diagnostic, aucune valeur). */\n debug?: string;\n};\n\nexport type ValidateResponse = ValidateOk | ApiError;\n\nexport type ReturnValidationResponse = {\n ok: boolean;\n code: string;\n tracking?: string;\n confirmed?: boolean;\n message?: string;\n detail?: string;\n};\n\nexport type AccessStatus = {\n ok: boolean;\n configured: boolean;\n unlocked: boolean;\n};\n\nasync function postJson(url: string, payload: unknown): Promise {\n const response = await fetch(url, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n body: JSON.stringify(payload),\n });\n return (await response.json()) as T;\n}\n\nexport function fetchAccessStatus(): Promise {\n return fetch(\"/api/access/status\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function fetchConfig(): Promise<{ ok: boolean; apiSaved: boolean }> {\n return fetch(\"/api/config\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function setupPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/setup\", { pattern });\n}\n\nexport function unlockPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/unlock\", { pattern });\n}\n\nexport function lockApp(): Promise<{ ok: boolean }> {\n return postJson(\"/api/access/logout\", {});\n}\n\nexport function saveApiToken(apiToken: string): Promise<{ ok: boolean; apiSaved?: boolean; code?: string }> {\n return postJson(\"/api/ecotrack/settings\", { apiToken });\n}\n\nexport async function deleteApiToken(): Promise<{ ok: boolean; apiSaved?: boolean }> {\n const response = await fetch(\"/api/ecotrack/settings\", {\n method: \"DELETE\",\n credentials: \"same-origin\",\n });\n return (await response.json()) as { ok: boolean; apiSaved?: boolean };\n}\n\nexport function validateTracking(tracking: string): Promise {\n return postJson(\"/api/validate\", { tracking });\n}\n\nexport function validateReturn(tracking: string): Promise {\n return postJson(\"/api/return/validate\", { tracking });\n}/* ------------------------------------------------------------------ */\n/* Retours prêts (liste serveur) */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyReturnsResponse = {\n ok: boolean;\n code?: string;\n /** `ecotrack_list` = liste renvoyée par l'API ; `local_registry` = relecture serveur. */\n source?: \"ecotrack_list\" | \"local_registry\";\n count?: number;\n items?: ReadyReturn[];\n scanned?: number;\n diagnostics?: string[];\n};\n\n/** Charge la liste des retours prêts. Le token Ecotrack reste côté serveur. */\nexport function fetchReadyReturns(): Promise {\n return fetch(\"/api/returns/ready\", { credentials: \"same-origin\" }).then((r) => r.json());\n}",[],[169,275,277],"65e863f5-391b-4fbd-8ced-e27e780f2903",9,["D",1789511212692],[207,208],[169,275],"6c4d6547-36ff-417e-8cf4-398a89134cff","StatusPanel.tsx","a49c9c4c-b154-11f1-aa9a-1607ee4eb77e","34a6d1f5-1d62-4377-8a82-c7eaa0426cae",21,["D",1789511823303],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Zone ÉTAT — toujours affichée AU-DESSUS de la caméra.\n * Le voyant est coloré selon le ton courant : vert (ok), ambre (busy/warn),\n * rouge (error), gris (idle).\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { StatusTone } from \"../lib/messages.ts\";\n\ntype Props = {\n status: string;\n tracking: string;\n tone: StatusTone;\n hint?: string;\n};\n\nexport default function StatusPanel({ status, tracking, tone, hint = \"\" }: Props) {\n return (\n

ÉTAT

\n \n

{status}

\n {tracking ? (\n

\n TRACKING {tracking}\n

\n ) : null}\n {hint ?

{hint}

: null}\n

\n );\n}",[],[169,298,290],"components","0727bdf1-ae1a-4960-a498-45fe55c8b48e","Settings.tsx","a4ab18a8-b154-11f1-aa9a-1607ee4eb77e",16,["D",1789511252317],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Paramètres — gestion du token API Ecotrack.\n *\n * Le token est envoyé une seule fois au serveur, puis jamais réaffiché.\n * Le badge affiché est « API SAUVEGARDÉE » : la présence d'un token ne garantit\n * pas que toutes les opérations Ecotrack sont disponibles.\n */\nimport React, { useState } from \"https://esm.sh/react@18.2.0\";\nimport { deleteApiToken, saveApiToken } from \"../lib/api.ts\";\n\ntype Props = {\n open: boolean;\n apiSaved: boolean;\n onClose: () => void;\n onSaved: (saved: boolean) => void;\n onLock: () => void;\n};\n\nexport default function Settings({ open, apiSaved, onClose, onSaved, onLock }: Props) {\n const [token, setToken] = useState(\"\");\n const [notice, setNotice] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n if (!open) return null;\n\n async function handleSave() {\n if (busy) return;\n const clean = token.trim();\n if (clean.length < 8) {\n setError(\"Token API trop court.\");\n return;\n }\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await saveApiToken(clean);\n if (result.ok) {\n setToken(\"\");\n setNotice(\"API Ecotrack enregistrée côté serveur.\");\n onSaved(true);\n } else {\n setError(\"Enregistrement refusé par le serveur.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n async function handleDelete() {\n if (busy) return;\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await deleteApiToken();\n if (result.ok) {\n setNotice(\"API Ecotrack supprimée du serveur.\");\n onSaved(false);\n } else {\n setError(\"Suppression impossible.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n return (\n

Paramètres

\n\n \n {apiSaved ? \"API SAUVEGARDÉE\" : \"AUCUNE API ENREGISTRÉE\"}\n \n\n

\n \n API TOKEN\n \n setToken(event.target.value)}\n />\n

\n\n {notice ?

{notice}

: null}\n {error ?

{error}

: null}\n\n

\n \n {apiSaved ? (\n \n SUPPRIMER\n \n ) : null}\n

\n \n \n

\n\n

\n Le token est conservé côté serveur et n'est jamais renvoyé au navigateur.\n

\n );\n}",[],[169,298,300],"c152045d-c111-424d-87d6-cdb45b949146","Scanner.tsx","9c31fd86-b154-11f1-8617-1607ee4eb77e",32,["D",1789511849454],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Scanner QR continu.\n *\n * Règle principale : le MediaStream caméra n'est JAMAIS fermé après un scan.\n * QR détecté -> pause logique (scanningRef = false) -> traitement -> reprise.\n * `stopCamera()` n'est appelé qu'au démontage du composant, à la fermeture de\n * l'application ou en cas de perte réelle du flux.\n *\n * Deux moteurs de détection : BarcodeDetector natif, puis jsQR en secours\n * (analyse plein cadre + analyse de la zone centrale).\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport jsQR from \"https://esm.sh/jsqr@1.4.0\";\nimport { extractTracking } from \"../../shared/tracking.ts\";\nimport { type StatusTone, vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n enabled: boolean;\n scanning: boolean;\n onReady: () => void;\n onTracking: (tracking: string) => void;\n onStatus: (status: string, tone?: StatusTone) => void;\n /** Couleur du cadre : vert (ok), rouge (error), blanc (neutral). */\n frameTone: \"neutral\" | \"ok\" | \"error\";\n};\n\ntype BarcodeDetectorLike = {\n detect: (source: CanvasImageSource) => Promise>;\n};\n\nconst FRAME_INTERVAL_MS = 160;\nconst SAME_RAW_COOLDOWN_MS = 2500;\nconst JSQR_MAX_SIDE = 640;\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction createDetector(): BarcodeDetectorLike | null {\n const ctor = (globalThis as unknown as {\n BarcodeDetector?: new (options?: { formats?: string[] }) => BarcodeDetectorLike;\n }).BarcodeDetector;\n if (!ctor) return null;\n try {\n return new ctor({ formats: [\"qr_code\"] });\n } catch {\n return null;\n }\n}\n\n/** Applique focus continu et zoom si le matériel les expose. */\nasync function applyTrackHints(stream: MediaStream): Promise {\n const track = stream.getVideoTracks()[0] as MediaStreamTrack & {\n getCapabilities?: () => Record;\n };\n if (!track?.getCapabilities || !track.applyConstraints) return;\n try {\n const capabilities = track.getCapabilities();\n const advanced: Record = {};\n\n const focusModes = capabilities.focusMode;\n if (Array.isArray(focusModes) && focusModes.includes(\"continuous\")) {\n advanced.focusMode = \"continuous\";\n }\n\n const zoom = capabilities.zoom as { min?: number; max?: number } | undefined;\n if (zoom && typeof zoom.max === \"number\") {\n const target = Math.min(1.6, zoom.max);\n if (target >= (zoom.min ?? 1)) advanced.zoom = target;\n }\n\n if (Object.keys(advanced).length > 0) {\n await track.applyConstraints({ advanced: [advanced] } as MediaStreamConstraints);\n }\n } catch {\n /* capacités non supportées : on continue sans */\n }\n}\n\n/** Analyse une zone vidéo avec jsQR. */\nfunction analyzeZone(\n context: CanvasRenderingContext2D,\n canvas: HTMLCanvasElement,\n video: HTMLVideoElement,\n source: { x: number; y: number; size: number },\n outputSize: number,\n): string | null {\n canvas.width = outputSize;\n canvas.height = outputSize;\n context.drawImage(\n video,\n source.x,\n source.y,\n source.size,\n source.size,\n 0,\n 0,\n outputSize,\n outputSize,\n );\n const image = context.getImageData(0, 0, outputSize, outputSize);\n const code = jsQR(image.data, image.width, image.height, { inversionAttempts: \"dontInvert\" });\n return code?.data ?? null;\n}\n\n/** Secours jsQR : plein cadre (sous-échantillonné) puis zone centrale (pleine résolution). */\nfunction detectWithJsQr(\n video: HTMLVideoElement,\n canvasRef: React.MutableRefObject,\n): string | null {\n const width = video.videoWidth;\n const height = video.videoHeight;\n if (!width || !height) return null;\n\n let canvas = canvasRef.current;\n if (!canvas) {\n canvas = document.createElement(\"canvas\");\n canvasRef.current = canvas;\n }\n const context = canvas.getContext(\"2d\", { willReadFrequently: true });\n if (!context) return null;\n\n const side = Math.min(width, height);\n const fullOutput = Math.max(160, Math.min(JSQR_MAX_SIDE, side));\n const full = analyzeZone(\n context,\n canvas,\n video,\n { x: 0, y: 0, size: side },\n fullOutput,\n );\n if (full) return full;\n\n // Deuxième analyse : zone centrale, pleine résolution.\n const centerSize = Math.floor(side * 0.6);\n const center = analyzeZone(\n context,\n canvas,\n video,\n { x: Math.floor((width - centerSize) / 2), y: Math.floor((height - centerSize) / 2), size: centerSize },\n centerSize,\n );\n return center;\n}\n\nexport default function Scanner(\n { enabled, scanning, frameTone, onReady, onTracking, onStatus }: Props,\n) {\n const videoRef = useRef(null);\n const canvasRef = useRef(null);\n const streamRef = useRef(null);\n const scanningRef = useRef(false);\n const loopRunningRef = useRef(false);\n const lastScanRef = useRef(\"\");\n const lastRawRef = useRef(\"\");\n const lastRawAtRef = useRef(0);\n const framesRef = useRef(0);\n const lastTickRef = useRef(0);\n\n const [cameraOn, setCameraOn] = useState(false);\n const [qrDetected, setQrDetected] = useState(false);\n\n const onReadyRef = useRef(onReady);\n const onTrackingRef = useRef(onTracking);\n const onStatusRef = useRef(onStatus);\n useEffect(() => {\n onReadyRef.current = onReady;\n onTrackingRef.current = onTracking;\n onStatusRef.current = onStatus;\n }, [onReady, onTracking, onStatus]);\n\n /* -------------------------------------------------------------- */\n /* Traitement d'un contenu QR */\n /* -------------------------------------------------------------- */\n\n const handleRaw = useCallback((raw: string) => {\n const now = Date.now();\n if (raw === lastRawRef.current && now - lastRawAtRef.current < SAME_RAW_COOLDOWN_MS) return;\n lastRawRef.current = raw;\n lastRawAtRef.current = now;\n\n const tracking = extractTracking(raw);\n if (!tracking) {\n setQrDetected(true);\n onStatusRef.current(\"QR lu, mais aucun numéro de tracking reconnu.\", \"error\");\n window.setTimeout(() => setQrDetected(false), 700);\n return;\n }\n if (lastScanRef.current === tracking) return;\n\n lastScanRef.current = tracking;\n scanningRef.current = false; // pause logique : le MediaStream reste ouvert\n setQrDetected(true);\n vibrate([70, 40, 110]);\n onStatusRef.current(\"QR détecté — tracking reconnu\", \"busy\");\n onTrackingRef.current(tracking);\n }, []);\n\n /* -------------------------------------------------------------- */\n /* Boucle de scan */\n /* -------------------------------------------------------------- */\n\n const scanLoop = useCallback(async () => {\n if (loopRunningRef.current) return;\n loopRunningRef.current = true;\n try {\n const detector = createDetector();\n while (scanningRef.current && streamRef.current) {\n const video = videoRef.current;\n if (!video || video.readyState < 2 || video.videoWidth === 0) {\n await sleep(120);\n continue;\n }\n const now = Date.now();\n if (now - lastTickRef.current < FRAME_INTERVAL_MS) {\n await sleep(40);\n continue;\n }\n lastTickRef.current = now;\n framesRef.current += 1;\n\n let raw: string | null = null;\n if (detector) {\n try {\n const codes = await detector.detect(video);\n if (codes.length > 0 && codes[0].rawValue) raw = codes[0].rawValue;\n } catch {\n /* BarcodeDetector indisponible sur cette frame : jsQR prend le relais */\n }\n }\n if (!raw) raw = detectWithJsQr(video, canvasRef);\n if (raw) handleRaw(raw);\n\n await sleep(50);\n }\n } finally {\n loopRunningRef.current = false;\n }\n }, [handleRaw]);\n\n /* -------------------------------------------------------------- */\n /* Caméra */\n /* -------------------------------------------------------------- */\n\n const stopCamera = useCallback(() => {\n scanningRef.current = false;\n const stream = streamRef.current;\n if (stream) stream.getTracks().forEach((track) => track.stop());\n streamRef.current = null;\n const video = videoRef.current;\n if (video) video.srcObject = null;\n setCameraOn(false);\n }, []);\n\n const startCamera = useCallback(async () => {\n if (streamRef.current) return;\n onStatusRef.current(\"Ouverture de la caméra…\", \"busy\");\n try {\n const constraints = {\n audio: false,\n video: {\n facingMode: { ideal: \"environment\" },\n width: { ideal: 1920 },\n height: { ideal: 1080 },\n },\n } as MediaStreamConstraints;\n const stream = await navigator.mediaDevices.getUserMedia(constraints);\n streamRef.current = stream;\n\n const video = videoRef.current;\n if (video) {\n video.srcObject = stream;\n video.muted = true;\n try {\n await video.play();\n } catch {\n /* autoplay bloqué : le flux reste ouvert */\n }\n }\n await applyTrackHints(stream);\n setCameraOn(true);\n onReadyRef.current();\n } catch {\n streamRef.current = null;\n setCameraOn(false);\n onStatusRef.current(\"Caméra indisponible — utilise la SAISIE MANUELLE.\", \"error\");\n }\n }, []);\n\n // Ouverture de la caméra après déverrouillage ; arrêt uniquement au démontage.\n useEffect(() => {\n if (!enabled) return;\n void startCamera();\n return () => stopCamera();\n }, [enabled, startCamera, stopCamera]);\n\n /* -------------------------------------------------------------- */\n /* Reprise automatique du scanner */\n /* -------------------------------------------------------------- */\n\n useEffect(() => {\n if (!scanning) {\n scanningRef.current = false;\n return;\n }\n // Équivalent de resumeScanner() : remise à zéro puis reprise.\n setQrDetected(false);\n lastScanRef.current = \"\";\n framesRef.current = 0;\n\n const stream = streamRef.current;\n const alive = !!stream && stream.getVideoTracks().some((track) => track.readyState === \"live\");\n if (alive && videoRef.current) {\n setCameraOn(true);\n scanningRef.current = true;\n onStatusRef.current(\"Analyse QR active — place le QR dans le cadre\", \"ok\");\n void scanLoop();\n return;\n }\n scanningRef.current = false;\n void startCamera();\n }, [scanning, scanLoop, startCamera]);\n\n return (\n

\n {!cameraOn && (\n

\n ▣\n Scanner un retour\n

\n )}\n \n );\n}",[],[169,298,308],"8dca119b-bc0c-4574-8a11-89deff333154",["D",1789513456884],[],[169,298,39],"dffbe624-83dc-4604-9139-7b13f40eba19","ReturnDetailSheet.tsx","bfb37906-b159-11f1-b477-1607ee4eb77e",56,["D",1789513445152],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Fiche retour — ouverte en cliquant un élément de RETOURS PRÊTS.\n *\n * Affiche le tracking et le statut Ecotrack, puis propose VALIDER LE RETOUR.\n * La validation utilise la route existante POST /api/return/validate :\n * la relecture serveur du statut avant mutation reste inchangée.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n tracking: string;\n statusRaw: string;\n validating: boolean;\n onClose: () => void;\n onValidate: () => void;\n};\n\nexport default function ReturnDetailSheet({\n tracking,\n statusRaw,\n validating,\n onClose,\n onValidate,\n}: Props) {\n if (!tracking) return null;\n\n return (\n

Fiche retour

\n\n

\n TRACKING\n {tracking}\n

\n\n

\n STATUT ECOTRACK\n {statusLabel(statusRaw)}\n

\n\n

\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n \n

\n\n

\n Le statut est revérifié côté serveur juste avant la validation.\n

\n );\n}",[],[169,298,320],"12b51db6-8d7e-48ce-ae7c-d3f57192c43e","ReadyReturnsList.tsx","bfaddac8-b159-11f1-b477-1607ee4eb77e",55,["D",1789513445113],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Liste « RETOURS PRÊTS (X) ».\n * Chaque élément est cliquable et ouvre la fiche retour.\n * Aucun appel réseau ici : les données viennent du backend.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n loaded: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n onSelect: (item: ReadyReturn) => void;\n};\n\nexport default function ReadyReturnsList({ loaded, items, source, error, onSelect }: Props) {\n if (error) return

{error}

;\n if (!loaded) return null;\n\n return (\n <>\n

\n RETOURS PRÊTS ({items.length})\n {source === \"local_registry\" ? (\n relecture serveur\n ) : null}\n

\n\n {items.length === 0 ? (\n

Aucun colis prêt pour le moment.

\n ) : (\n

\n \n

\n )}\n \n );\n}",[],[169,298,328],"1425fed1-60da-4bbc-9aae-2aede04a3c61","PatternGate.tsx","9c2cb9ca-b154-11f1-8617-1607ee4eb77e",11,["D",1789511238063],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Verrouillage de l'application par schéma Android 3x3.\n *\n * Le schéma est tracé au doigt (pointer events) puis envoyé au serveur.\n * En mode `setup`, le schéma doit être tracé deux fois de suite.\n * Aucun hash, aucun secret n'est manipulé côté navigateur.\n */\nimport React, { useCallback, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { setupPattern, unlockPattern } from \"../lib/api.ts\";\nimport { vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n mode: \"setup\" | \"unlock\";\n onUnlocked: () => void;\n};\n\nconst MIN_POINTS = 4;\n\nexport default function PatternGate({ mode, onUnlocked }: Props) {\n const [path, setPath] = useState([]);\n const [pending, setPending] = useState(null);\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n const pathRef = useRef([]);\n const tracingRef = useRef(false);\n const busyRef = useRef(false);\n const dotRefs = useRef>([]);\n\n const reset = useCallback(() => {\n pathRef.current = [];\n setPath([]);\n }, []);\n\n const addDot = useCallback((dot: number) => {\n if (pathRef.current.includes(dot)) return;\n pathRef.current = [...pathRef.current, dot];\n setPath(pathRef.current);\n vibrate([12]);\n }, []);\n\n const dotAt = useCallback((x: number, y: number): number | null => {\n for (let index = 0; index < 9; index++) {\n const element = dotRefs.current[index];\n if (!element) continue;\n const rect = element.getBoundingClientRect();\n const centerX = rect.left + rect.width / 2;\n const centerY = rect.top + rect.height / 2;\n const radius = Math.max(rect.width, 46);\n if (Math.hypot(x - centerX, y - centerY) <= radius) return index + 1;\n }\n return null;\n }, []);\n\n const submit = useCallback(\n async (pattern: string) => {\n if (busyRef.current) return;\n busyRef.current = true;\n setBusy(true);\n setError(\"\");\n try {\n if (mode === \"setup\") {\n if (pending === null) {\n setPending(pattern);\n reset();\n return;\n }\n if (pending !== pattern) {\n setPending(null);\n reset();\n setError(\"Les deux schémas ne correspondent pas. Recommence.\");\n return;\n }\n const result = await setupPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n setPending(null);\n reset();\n setError(\"Enregistrement impossible. Recharge la page et réessaie.\");\n return;\n }\n\n const result = await unlockPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n reset();\n setError(\"Schéma incorrect.\");\n } catch {\n reset();\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n busyRef.current = false;\n setBusy(false);\n }\n },\n [mode, onUnlocked, pending, reset],\n );\n\n const handlePointerDown = useCallback(\n (event: React.PointerEvent) => {\n if (busyRef.current) return;\n event.currentTarget.setPointerCapture(event.pointerId);\n tracingRef.current = true;\n setError(\"\");\n reset();\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt, reset],\n );\n\n const handlePointerMove = useCallback(\n (event: React.PointerEvent) => {\n if (!tracingRef.current) return;\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt],\n );\n\n const handlePointerUp = useCallback(() => {\n if (!tracingRef.current) return;\n tracingRef.current = false;\n const current = pathRef.current;\n if (current.length < MIN_POINTS) {\n reset();\n setError(\"Relie au moins 4 points.\");\n return;\n }\n void submit(current.join(\"\"));\n }, [reset, submit]);\n\n const points = path\n .map((dot) => `${((dot - 1) % 3) + 0.5},${Math.floor((dot - 1) / 3) + 0.5}`)\n .join(\" \");\n\n const hint = mode === \"setup\"\n ? pending === null\n ? \"Trace ton schéma de déverrouillage (4 points minimum).\"\n : \"Reproduis exactement le même schéma pour confirmer.\"\n : \"Trace ton schéma pour accéder au scanner.\";\n\n return (\n

\n SAMI.TECH\n

{hint}

\n\n \n \n

\n {Array.from({ length: 9 }, (_, index) => (\n \n {\n dotRefs.current[index] = element;\n }}\n />\n

\n ))}\n

\n \n\n

{error}

\n\n

\n {\n reset();\n setPending(null);\n setError(\"\");\n }}\n >\n EFFACER\n \n

\n \n );\n}",[],[169,298,336],"fbf5dc9f-bcef-4638-8c09-b1c84bcaad75","ManualEntry.tsx","a4a1edc8-b154-11f1-aa9a-1607ee4eb77e",14,["D",1789511252256],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * SAISIE MANUELLE — directement sous la caméra.\n * Mêmes règles que le scanner : A-Z, 0-9, `_`, `-`, 6 à 64 caractères, majuscules.\n * La touche Entrée lance la vérification. La caméra n'est jamais fermée ici.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n value: string;\n onChange: (value: string) => void;\n onSubmit: (value: string) => void;\n disabled?: boolean;\n};\n\nconst MIN_LENGTH = 6;\nconst MAX_LENGTH = 64;\n\nexport default function ManualEntry({ value, onChange, onSubmit, disabled = false }: Props) {\n const canSubmit = value.trim().length >= MIN_LENGTH && !disabled;\n\n return (\n

SAISIE MANUELLE

\n {\n event.preventDefault();\n if (canSubmit) onSubmit(value.trim().toUpperCase());\n }}\n >\n {\n const clean = event.target.value\n .toUpperCase()\n .replace(/[^A-Z0-9_-]/g, \"\")\n .slice(0, MAX_LENGTH);\n onChange(clean);\n }}\n />\n \n \n

\n );\n}",[],[169,298,344],"62a5fdbe-684a-480f-82a7-af6c6aad1e52","HistoryList.tsx","a4a69242-b154-11f1-aa9a-1607ee4eb77e",15,["D",1789511252288],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * DERNIERS RETOURS VALIDÉS — historique d'affichage uniquement.\n * Ce n'est pas une preuve serveur : la source de vérité reste OM Express.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n items: string[];\n};\n\nexport default function HistoryList({ items }: Props) {\n return (\n

DERNIERS RETOURS VALIDÉS

\n {items.length === 0 ? (\n

Aucun retour validé pour l'instant.

\n ) : (\n

\n ✓\n {tracking}\n

\n )}\n

\n );\n}",[],[169,298,352],"86e3484f-7d27-42c6-ba8a-c18735c774ae","App.tsx","b3594b36-b154-11f1-a81e-1607ee4eb77e",45,["D",1789513083942],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Application principale — machine à états du scanner continu.\n *\n * Ordre visuel imposé :\n * 1. En-tête SAMI.TECH / Retours Ecotrack\n * 2. ÉTAT (voyant coloré : vert ok, ambre busy/warn, rouge error, gris idle)\n * 3. Caméra / Scanner QR (cadre blanc / vert / rouge)\n * 4. SAISIE MANUELLE\n * 5. VALIDER LE RETOUR (uniquement si le colis est éligible)\n * 6. DERNIERS RETOURS VALIDÉS\n * 7. Footer\n *\n * Niveaux de fiabilité distingués en permanence :\n * QR détecté ≠ tracking trouvé ≠ retour éligible ≠ retour validé.\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { isReturnReadyStatus } from \"../../shared/status.ts\";\nimport {\n fetchAccessStatus,\n fetchConfig,\n lockApp,\n validateReturn,\n validateTracking,\n} from \"../lib/api.ts\";\nimport type { ValidateResponse } from \"../lib/api.ts\";\nimport { messageForCode, statusLabel, toneForCode, vibrate } from \"../lib/messages.ts\";\nimport type { StatusTone } from \"../lib/messages.ts\";\nimport HistoryList from \"./HistoryList.tsx\";\nimport ManualEntry from \"./ManualEntry.tsx\";\nimport PatternGate from \"./PatternGate.tsx\";\nimport ReturnsReadyCard from \"./ReturnsReadyCard.tsx\";\nimport type { ScanMode } from \"./ReturnsReadyCard.tsx\";\nimport Scanner from \"./Scanner.tsx\";\nimport Settings from \"./Settings.tsx\";\nimport StatusPanel from \"./StatusPanel.tsx\";\n\ntype AccessState = \"loading\" | \"setup\" | \"locked\" | \"open\";\ntype FrameTone = \"neutral\" | \"ok\" | \"error\";\n\nconst RESUME_DELAY_MS = 800;\nconst HISTORY_LIMIT = 8;\n\nexport default function App() {\n const [access, setAccess] = useState(\"loading\");\n const [statusText, setStatusText] = useState(\"Prêt à scanner\");\n const [tone, setTone] = useState(\"idle\");\n const [hint, setHint] = useState(\"\");\n const [tracking, setTracking] = useState(\"\");\n const [result, setResult] = useState(null);\n const [validating, setValidating] = useState(false);\n const [scanning, setScanning] = useState(false);\n const [manualValue, setManualValue] = useState(\"\");\n const [history, setHistory] = useState([]);\n const [settingsOpen, setSettingsOpen] = useState(false);\n const [apiSaved, setApiSaved] = useState(false);\n /** Mode de lecture du scanner existant : normal ou contrôle « retour prêt ». */\n const [scanMode, setScanMode] = useState(\"normal\");\n\n const resumeTimer = useRef(null);\n const trackingRef = useRef(\"\");\n const validatingRef = useRef(false);\n\n useEffect(() => {\n trackingRef.current = tracking;\n }, [tracking]);\n\n useEffect(() => {\n return () => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n };\n }, []);\n\n /** Met à jour l'ÉTAT : texte + couleur + ligne de détail optionnelle. */\n const showStatus = useCallback(\n (text: string, nextTone: StatusTone = \"busy\", nextHint = \"\") => {\n setStatusText(text);\n setTone(nextTone);\n setHint(nextHint);\n },\n [],\n );\n\n /* ---------------------------------------------------------------- */\n /* Reprise automatique du scanner (jamais de fermeture caméra) */\n /* ---------------------------------------------------------------- */\n\n const resume = useCallback((delayMs: number = RESUME_DELAY_MS) => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n setScanning(false);\n resumeTimer.current = window.setTimeout(() => {\n resumeTimer.current = null;\n setTracking(\"\");\n setResult(null);\n setHint(\"\");\n setTone(\"busy\");\n setScanning(true);\n }, delayMs);\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Déverrouillage */\n /* ---------------------------------------------------------------- */\n\n useEffect(() => {\n let cancelled = false;\n void (async () => {\n try {\n const data = await fetchAccessStatus();\n if (cancelled) return;\n if (!data.configured) setAccess(\"setup\");\n else if (data.unlocked) setAccess(\"open\");\n else setAccess(\"locked\");\n } catch {\n if (!cancelled) setAccess(\"locked\");\n }\n })();\n return () => {\n cancelled = true;\n };\n }, []);\n\n useEffect(() => {\n if (access !== \"open\") return;\n void (async () => {\n try {\n const data = await fetchConfig();\n setApiSaved(Boolean(data.apiSaved));\n } catch {\n /* ignore */\n }\n })();\n }, [access]);\n\n const handleLock = useCallback(async () => {\n setSettingsOpen(false);\n setScanning(false);\n try {\n await lockApp();\n } catch {\n /* ignore */\n }\n setTracking(\"\");\n setResult(null);\n setAccess(\"locked\");\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Vérification d'un tracking (QR ou saisie manuelle) */\n /* ---------------------------------------------------------------- */\n\n const handleTracking = useCallback(\n async (value: string) => {\n const clean = value.trim().toUpperCase();\n if (!clean) return;\n\n setTracking(clean);\n setResult(null);\n showStatus(\"Vérification du tracking…\", \"busy\");\n\n try {\n const response = await validateTracking(clean);\n\n if (!response.ok) {\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n showStatus(\n messageForCode(response.code),\n toneForCode(response.code),\n response.debug ? `Réponse OM Express : ${response.debug}` : \"\",\n );\n resume(900);\n return;\n }\n\n setResult(response);\n\n if (response.ready && isReturnReadyStatus(response.statusRaw)) {\n // Colis éligible : le scanner reste EN PAUSE, VALIDER LE RETOUR s'affiche.\n showStatus(\n scanMode === \"returns_ready\"\n ? \"RETOUR PRÊT À VALIDER\"\n : `Tracking trouvé dans OM Express — ${statusLabel(response.statusRaw)}`,\n \"ok\",\n );\n return;\n }\n\n showStatus(\n scanMode === \"returns_ready\"\n ? `RETOUR NON PRÊT — ${statusLabel(response.statusRaw)}`\n : response.alreadyValidated\n ? `Retour déjà validé dans OM Express — ${statusLabel(response.statusRaw)}`\n : `Tracking trouvé — statut « ${statusLabel(response.statusRaw)} » : validation impossible.`,\n \"warn\",\n );\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — vérifie ta connexion.\", \"error\");\n resume(900);\n }\n },\n [resume, showStatus, scanMode],\n );\n\n const handleManualSubmit = useCallback(\n (value: string) => {\n // La caméra n'est PAS fermée : simple pause logique du scanner.\n setScanning(false);\n void handleTracking(value);\n },\n [handleTracking],\n );\n\n /* ---------------------------------------------------------------- */\n /* Mode RETOURS PRÊTS — réutilise le scanner existant, une caméra */\n /* ---------------------------------------------------------------- */\n\n // `resume()` relance le scanLoop existant : la caméra n'est jamais fermée.\n const startReturnsReadyScan = useCallback(() => {\n setScanMode(\"returns_ready\");\n resume(60);\n }, [resume]);\n\n const stopReturnsReadyScan = useCallback(() => {\n setScanMode(\"normal\");\n resume(60);\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Validation officielle du retour */\n /* ---------------------------------------------------------------- */\n\n const handleValidateReturn = useCallback(async () => {\n if (validatingRef.current) return;\n const current = trackingRef.current;\n if (!current) return;\n\n validatingRef.current = true;\n setValidating(true);\n showStatus(\"Validation du retour dans OM Express…\", \"busy\");\n\n try {\n const response = await validateReturn(current);\n\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n\n if (response.ok && response.confirmed) {\n showStatus(\"Retour validé avec succès dans OM Express.\", \"ok\");\n vibrate([100, 50, 160]);\n setHistory((previous) =>\n [current, ...previous.filter((item) => item !== current)].slice(0, HISTORY_LIMIT)\n );\n setManualValue(\"\");\n setTracking(\"\");\n setResult(null);\n resume(700);\n return;\n }\n\n if (response.ok && response.code === \"RETURN_ACCEPTED_UNCONFIRMED\") {\n showStatus(\"Requête reçue par OM Express, mais validation non confirmée.\", \"warn\");\n resume(900);\n return;\n }\n\n showStatus(messageForCode(response.code), toneForCode(response.code));\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — validation non confirmée.\", \"error\");\n resume(900);\n } finally {\n validatingRef.current = false;\n setValidating(false);\n }\n }, [resume, showStatus]);\n\n /* ---------------------------------------------------------------- */\n /* Rendu */\n /* ---------------------------------------------------------------- */\n\n if (access === \"loading\") {\n return (\n

Chargement…

\n );\n }\n\n if (access === \"setup\" || access === \"locked\") {\n return (\n setAccess(\"open\")}\n />\n );\n }\n\n const ready = !!result && result.ok && result.ready && isReturnReadyStatus(result.statusRaw);\n const frameTone: FrameTone = tone === \"error\" ? \"error\" : ready ? \"ok\" : \"neutral\";\n\n return (\n

\n \n SAMI.TECH\n \n Retours Ecotrack\n

\n setSettingsOpen(true)}\n >\n ⚙\n \n

\n\n \n\n

\n setScanning(true)}\n onTracking={handleTracking}\n onStatus={(text, nextTone) => showStatus(text, nextTone ?? \"busy\")}\n />\n

\n\n \n\n \n\n {ready ? (\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n ) : null}\n\n \n\n \n\n setSettingsOpen(false)}\n onSaved={setApiSaved}\n onLock={handleLock}\n />\n

\n );\n}",[],[169,298,360],"394fa985-734a-48a4-ba83-cef32342d0d9",["D",1789511238063],[196,197,198,199,200,201,202,203,204,205],[169,298],["D",1789511212578],[195,206,209,210,211],[169],"3a0961ab-0efd-4762-9d52-5a779f56635d","ecotrack.ts","76780022-b154-11f1-ac17-1607ee4eb77e",49,["D",1789513419706],4,"/**\n * Client de l'API Ecotrack / OM Express.\n *\n * Règles absolues :\n * - le token reste côté serveur (jamais renvoyé au frontend, jamais loggé) ;\n * - lecture d'un colis : GET /api/v1/get/orders?tracking=...\n * - validation retour : POST /api/v1/valid/returns { trackings: [ ... ] }\n * - routes interdites : /retours/recu/validated et /api/v1/valid/order\n */\nimport { deleteSetting, getSetting, setSetting } from \"./db.ts\";\nimport { extractStatusValue, isReturnReadyStatus, normalizeStatus } from \"../shared/status.ts\";\n\nconst CREDENTIALS_KEY = \"ecotrack_api_credentials\";\nconst API_BASE = \"https://omexpress.ecotrack.dz/api/v1\";\n\nexport type EcotrackCredentials = { apiToken: string };\n\nexport type OrderLookup =\n | {\n kind: \"found\";\n tracking: string;\n statusRaw: string;\n status: string;\n order: Record;\n }\n | { kind: \"not_found\"; payloadKeys: string[] }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nexport type MutationResult =\n | { kind: \"success\" }\n | { kind: \"fail\" }\n | { kind: \"invalid\"; message: string; status: number }\n | { kind: \"api_error\"; status: number }\n | { kind: \"network_error\" }\n | { kind: \"unexpected\"; status: number };\n\n/* ------------------------------------------------------------------ */\n/* Credentials (stockés côté serveur, en base) */\n/* ------------------------------------------------------------------ */\n\nexport async function getCredentials(): Promise {\n const raw = await getSetting(CREDENTIALS_KEY);\n if (!raw) return null;\n try {\n const parsed = JSON.parse(raw) as { apiToken?: unknown };\n const apiToken = typeof parsed.apiToken === \"string\" ? parsed.apiToken.trim() : \"\";\n return apiToken ? { apiToken } : null;\n } catch {\n return null;\n }\n}\n\nexport async function saveCredentials(apiToken: string): Promise {\n await setSetting(CREDENTIALS_KEY, JSON.stringify({ apiToken: apiToken.trim() }));\n}\n\nexport async function deleteCredentials(): Promise {\n await deleteSetting(CREDENTIALS_KEY);\n}\n\n/* ------------------------------------------------------------------ */\n/* Appels HTTP */\n/* ------------------------------------------------------------------ */\n\nasync function ecotrackFetch(\n path: string,\n apiToken: string,\n init: { method: \"GET\" | \"POST\"; body?: string; contentType?: string } = { method: \"GET\" },\n): Promise {\n const headers = new Headers();\n headers.set(\"Accept\", \"application/json\");\n headers.set(\"Authorization\", `Bearer ${apiToken}`);\n if (init.contentType) headers.set(\"Content-Type\", init.contentType);\n // Le token peut aussi être transmis côté serveur via `api_token`.\n const separator = path.includes(\"?\") ? \"&\" : \"?\";\n const url = `${API_BASE}${path}${separator}api_token=${encodeURIComponent(apiToken)}`;\n return await fetch(url, { method: init.method, headers, body: init.body });\n}\n\n/** Vérifie la validité du token auprès d'Ecotrack. */\nexport async function validateToken(apiToken: string): Promise<{ ok: boolean; status: number }> {\n try {\n const response = await ecotrackFetch(\"/validate/token\", apiToken);\n return { ok: response.ok, status: response.status };\n } catch {\n return { ok: false, status: 0 };\n }\n}\n\n/* ------------------------------------------------------------------ */\n/* Lecture d'un colis */\n/* ------------------------------------------------------------------ */\n\nfunction asRecord(value: unknown): Record | null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record)\n : null;\n}\n\n/** Clés d'enveloppe possibles autour de la liste de commandes. */\nconst ORDER_KEYS = [\"data\", \"orders\", \"results\", \"items\", \"colis\", \"order\", \"livraisons\", \"rows\"];\n\n/** Clés possibles du numéro de tracking dans une commande. */\nconst TRACKING_KEYS = [\n \"tracking\",\n \"tracking_number\",\n \"trackingNumber\",\n \"code\",\n \"numero\",\n \"num\",\n \"barcode\",\n \"code_barre\",\n \"codebarre\",\n \"code_suivi\",\n \"reference\",\n];\n\nfunction asOrderList(value: unknown): Record[] {\n if (!Array.isArray(value)) return [];\n return value.map(asRecord).filter((item): item is Record => item !== null);\n}\n\nfunction orderTracking(order: Record): string {\n for (const key of TRACKING_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim().toUpperCase();\n if (typeof value === \"number\") return String(value).toUpperCase();\n }\n return \"\";\n}\n\n/** Cherche la liste de commandes même si la réponse est imbriquée sur plusieurs niveaux. */\nfunction collectOrders(payload: unknown, depth = 0): Record[] {\n if (depth > 3) return [];\n\n const list = asOrderList(payload);\n if (list.length > 0) return list;\n\n const root = asRecord(payload);\n if (!root) return [];\n\n // L'objet est déjà une commande (il porte un statut ou un tracking).\n if (extractStatusValue(root) !== \"\" || orderTracking(root) !== \"\") return [root];\n\n for (const key of ORDER_KEYS) {\n const nested = root[key];\n if (Array.isArray(nested)) return asOrderList(nested);\n if (nested && typeof nested === \"object\") {\n const deeper = collectOrders(nested, depth + 1);\n if (deeper.length > 0) return deeper;\n }\n }\n\n // Aucune enveloppe connue : si l'objet est riche, on le traite comme la commande.\n const hasEnvelope = ORDER_KEYS.some((key) => key in root);\n if (!hasEnvelope && Object.keys(root).length >= 3) return [root];\n return [];\n}\n\n/** Noms des clés de premier niveau — diagnostic uniquement, aucune valeur exposée. */\nfunction topLevelKeys(payload: unknown): string[] {\n const root = asRecord(payload);\n if (root) return Object.keys(root).slice(0, 12);\n if (Array.isArray(payload)) return [`[array:${payload.length}]`];\n return [];\n}\n\nfunction pickOrder(payload: unknown, tracking: string): Record | null {\n const orders = collectOrders(payload);\n if (orders.length === 0) return null;\n\n const wanted = tracking.trim().toUpperCase();\n const exact = orders.find((order) => orderTracking(order) === wanted);\n if (exact) return exact;\n\n const withStatus = orders.find((order) => extractStatusValue(order) !== \"\");\n if (withStatus) return withStatus;\n\n // Une seule commande renvoyée pour cette requête : on l'accepte telle quelle.\n return orders.length === 1 ? orders[0] : null;\n}\n\ntype ReadResult =\n | { kind: \"ok\"; payload: unknown }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nasync function readOrders(apiToken: string, query: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(`/get/orders?${query}`, apiToken);\n } catch {\n return { kind: \"network_error\" };\n }\n if (!response.ok) return { kind: \"read_error\", status: response.status };\n try {\n return { kind: \"ok\", payload: await response.json() };\n } catch {\n return { kind: \"bad_response\" };\n }\n}\n\n/**\n * Relit un colis et retourne son statut normalisé.\n * Deux variantes de paramètre sont tentées (`tracking` puis `trackings`) :\n * ce sont des lectures, jamais des mutations.\n */\nexport async function findOrder(apiToken: string, tracking: string): Promise {\n const encoded = encodeURIComponent(tracking);\n const queries = [`tracking=${encoded}`, `trackings=${encoded}`];\n let lastPayload: unknown = null;\n let lastErrorStatus: number | null = null;\n let sawSuccess = false;\n\n for (const query of queries) {\n const read = await readOrders(apiToken, query);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") {\n if (read.status >= 500) return { kind: \"read_error\", status: read.status };\n lastErrorStatus = read.status;\n continue;\n }\n\n sawSuccess = true;\n const order = pickOrder(read.payload, tracking);\n if (order) {\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n }\n lastPayload = read.payload;\n }\n\n if (!sawSuccess) return { kind: \"read_error\", status: lastErrorStatus ?? 0 };\n return { kind: \"not_found\", payloadKeys: topLevelKeys(lastPayload) };\n}\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour (mutation) */\n/* ------------------------------------------------------------------ */\n\nfunction extractMessage(text: string): string {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.message === \"string\") return parsed.message;\n if (typeof parsed.error === \"string\") return parsed.error;\n } catch {\n /* corps non JSON */\n }\n return \"\";\n}\n\n/**\n * POST /api/v1/valid/returns — endpoint officiel de validation d'un retour.\n * Ne jamais appeler cette fonction sans avoir revérifié l'éligibilité côté serveur.\n */\nexport async function mutateReturn(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(\"/valid/returns\", apiToken, {\n method: \"POST\",\n contentType: \"application/json\",\n body: JSON.stringify({ trackings: [tracking] }),\n });\n } catch {\n return { kind: \"network_error\" };\n }\n\n const text = await response.text().catch(() => \"\");\n const emptyBody = text.trim() === \"\";\n let returned: string | null = null;\n if (!emptyBody) {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.returned === \"string\") returned = parsed.returned;\n } catch {\n /* corps non JSON */\n }\n }\n\n // Télémétrie sûre uniquement : jamais de token, jamais de body brut.\n console.log(\n JSON.stringify({\n evt: \"return_validate\",\n httpStatus: response.status,\n returned,\n emptyBody,\n }),\n );\n\n if (response.status === 422) {\n return { kind: \"invalid\", message: extractMessage(text), status: response.status };\n }\n if (!response.ok) return { kind: \"api_error\", status: response.status };\n if (returned === \"success\") return { kind: \"success\" };\n if (returned === \"fail\") return { kind: \"fail\" };\n return { kind: \"unexpected\", status: response.status };\n}/* ------------------------------------------------------------------ */\n/* Liste des retours prêts */\n/* */\n/* L'API officielle n'expose que la recherche PAR TRACKING */\n/* (`GET /api/v1/get/orders?tracking=…`). Aucun endpoint de liste par */\n/* statut n'est documenté : on tente donc d'abord quelques variantes de */\n/* lecture seule, puis on retombe sur la relecture individuelle des */\n/* trackings connus (registre SQLite) avec filtrage côté backend. */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyListResult = {\n /** `ecotrack_list` = liste obtenue de l'API ; `local_registry` = relecture individuelle. */\n source: \"ecotrack_list\" | \"local_registry\";\n items: ReadyReturn[];\n /** Nombre d'entrées examinées côté serveur. */\n scanned: number;\n /** Trace des tentatives (statuts HTTP, nombres) — jamais de token ni de valeur sensible. */\n diagnostics: string[];\n};\n\n/** Variantes de lecture seule tentées pour découvrir un éventuel mode « liste ». */\nconst LIST_QUERIES = [\n \"status=retour_recu\",\n \"statuses[]=retour_recu&statuses[]=livraison_echoue_recu\",\n \"status=retour_recu&per_page=100&page=1\",\n \"per_page=100&page=1\",\n];\n\nconst MAX_ITEMS = 100;\n\n/** Lecture d'un seul colis, sans variante de repli (latence maîtrisée). */\nasync function readOneOrder(apiToken: string, tracking: string): Promise {\n const read = await readOrders(apiToken, `tracking=${encodeURIComponent(tracking)}`);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") return { kind: \"read_error\", status: read.status };\n\n const order = pickOrder(read.payload, tracking);\n if (!order) return { kind: \"not_found\", payloadKeys: topLevelKeys(read.payload) };\n\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n}\n\nfunction toReadyReturn(tracking: string, statusRaw: string): ReadyReturn {\n return {\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n };\n}\n\n/**\n * Retours actuellement prêts (statut normalisé `retour_recu` ou\n * `livraison_echoue_recu`). Lecture seule uniquement : aucune mutation.\n */\nexport async function listReadyReturns(\n apiToken: string,\n registry: { tracking: string; lastStatus: string }[],\n): Promise {\n const diagnostics: string[] = [];\n\n // 1) Tentative d'un mode « liste » sur l'API officielle.\n for (const query of LIST_QUERIES) {\n const read = await readOrders(apiToken, query);\n if (read.kind === \"network_error\") {\n diagnostics.push(`${query} → réseau`);\n continue;\n }\n if (read.kind === \"bad_response\") {\n diagnostics.push(`${query} → corps illisible`);\n continue;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`${query} → HTTP ${read.status}`);\n continue;\n }\n\n const orders = collectOrders(read.payload);\n const ready = orders\n .map((order) => ({ tracking: orderTracking(order), statusRaw: extractStatusValue(order) }))\n .filter((entry) => entry.tracking !== \"\" && isReturnReadyStatus(entry.statusRaw))\n .map((entry) => toReadyReturn(entry.tracking, entry.statusRaw));\n\n diagnostics.push(`${query} → ${orders.length} colis, ${ready.length} prêt(s)`);\n if (ready.length > 0) {\n return { source: \"ecotrack_list\", items: dedupe(ready).slice(0, MAX_ITEMS), scanned: orders.length, diagnostics };\n }\n }\n\n // 2) Repli : relecture individuelle des trackings connus, filtrage backend.\n const items: ReadyReturn[] = [];\n for (const entry of registry) {\n const lookup = await readOneOrder(apiToken, entry.tracking);\n if (lookup.kind !== \"found\") continue;\n if (!isReturnReadyStatus(lookup.statusRaw)) continue;\n items.push(toReadyReturn(lookup.tracking, lookup.statusRaw));\n }\n diagnostics.push(\n `registre local → ${registry.length} tracking(s) relu(s), ${items.length} prêt(s)`,\n );\n return { source: \"local_registry\", items: dedupe(items).slice(0, MAX_ITEMS), scanned: registry.length, diagnostics };\n}\n\nfunction dedupe(items: ReadyReturn[]): ReadyReturn[] {\n const seen = new Set();\n const result: ReadyReturn[] = [];\n for (const item of items) {\n if (seen.has(item.tracking)) continue;\n seen.add(item.tracking);\n result.push(item);\n }\n return result;\n}",[],[175,375],"0b1e17d8-2f63-49de-9348-e0fefc13be5c","db.ts","6bda7e38-b154-11f1-91d7-1607ee4eb77e",47,["D",1789513419610],"/**\n * Accès SQLite (base projet, isolée des autres applications SAMI.TECH).\n *\n * Tables :\n * app_settings (key, value) -> schéma 3x3 + credentials Ecotrack\n * app_sessions (token_hash, expires_at, created_at) -> sessions du cookie sami_access\n * idx_app_sessions_expires -> purge / lookup rapide\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nlet schemaReady: Promise | null = null;\n\n/** Crée les tables et l'index si nécessaire. Idempotent, exécuté une seule fois. */\nexport function ensureSchema(): Promise {\n if (!schemaReady) {\n schemaReady = sqlite\n .batch([\n `CREATE TABLE IF NOT EXISTS app_settings (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_sessions (\n token_hash TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_app_sessions_expires ON app_sessions (expires_at)`,\n `CREATE TABLE IF NOT EXISTS seen_trackings (\n tracking TEXT PRIMARY KEY,\n first_seen_at INTEGER NOT NULL,\n last_seen_at INTEGER NOT NULL,\n last_status TEXT NOT NULL DEFAULT ''\n )`,\n `CREATE INDEX IF NOT EXISTS idx_seen_trackings_last_seen ON seen_trackings (last_seen_at)`,\n ])\n .then(() => undefined)\n .catch((error) => {\n schemaReady = null;\n throw error;\n });\n }\n return schemaReady;\n}\n\n/** Lit une valeur de configuration. */\nexport async function getSetting(key: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT value FROM app_settings WHERE key = ?\",\n args: [key],\n });\n const row = result.rows[0] as unknown as { value?: string } | undefined;\n return row?.value ?? null;\n}\n\n/** Écrit (ou remplace) une valeur de configuration. */\nexport async function setSetting(key: string, value: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `INSERT INTO app_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, value],\n });\n}\n\n/** Supprime une valeur de configuration. */\nexport async function deleteSetting(key: string): Promise {\n await ensureSchema();\n await sqlite.execute({ sql: \"DELETE FROM app_settings WHERE key = ?\", args: [key] });\n}/* ------------------------------------------------------------------ */\n/* Registre des trackings déjà vus */\n/* */\n/* L'API Ecotrack n'expose pas de recherche par statut : on ne peut */\n/* relire un colis que par son numéro de tracking. Ce registre local */\n/* (SQLite) conserve les trackings déjà vérifiés par l'application afin */\n/* de pouvoir les relire côté serveur et filtrer ceux qui sont prêts. */\n/* ------------------------------------------------------------------ */\n\nconst REGISTRY_TTL_MS = 120 * 24 * 60 * 60 * 1000; // 120 jours\n\n/** Mémorise (ou met à jour) un tracking vérifié avec succès. */\nexport async function rememberTracking(tracking: string, status: string): Promise {\n const clean = tracking.trim().toUpperCase();\n if (!clean) return;\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({\n sql: `INSERT INTO seen_trackings (tracking, first_seen_at, last_seen_at, last_status)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(tracking) DO UPDATE SET\n last_seen_at = excluded.last_seen_at,\n last_status = excluded.last_status`,\n args: [clean, now, now, status ?? \"\"],\n });\n}\n\n/** Trackings connus les plus récents (les plus anciens sont purgés). */\nexport async function listRecentTrackings(\n limit: number,\n): Promise<{ tracking: string; lastStatus: string }[]> {\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM seen_trackings WHERE last_seen_at < ?\",\n args: [Date.now() - REGISTRY_TTL_MS],\n });\n const result = await sqlite.execute({\n sql: \"SELECT tracking, last_status FROM seen_trackings ORDER BY last_seen_at DESC LIMIT ?\",\n args: [limit],\n });\n return (result.rows as unknown as { tracking: string; last_status: string }[]).map((row) => ({\n tracking: row.tracking,\n lastStatus: row.last_status ?? \"\",\n }));\n}",[],[175,384],"45232bfa-011c-48a2-9b91-3626695b9180","access.ts","7673ba6c-b154-11f1-ac17-1607ee4eb77e",["D",1789511174778],"/**\n * Verrouillage de l'application par schéma Android 3x3 + sessions.\n *\n * - Le schéma est stocké sous forme de hash PBKDF2-SHA256 salé (jamais en clair).\n * - Les sessions vivent en base (app_sessions) et sont portées par le cookie\n * `sami_access` (HttpOnly, Secure, ~12 h). Le cookie ne contient qu'un token\n * aléatoire : seul son SHA-256 est stocké.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSchema, getSetting, setSetting } from \"./db.ts\";\n\nconst PATTERN_KEY = \"access_pattern_hash\";\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // ~12 heures\nconst PBKDF2_ITERATIONS = 100_000;\nconst encoder = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(byteLength: number): string {\n const buffer = new Uint8Array(byteLength);\n crypto.getRandomValues(buffer);\n return toHex(buffer);\n}\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return toHex(new Uint8Array(digest));\n}\n\nasync function pbkdf2Hex(secret: string, salt: string, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt: encoder.encode(salt), iterations },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** Vrai si un schéma a déjà été configuré. */\nexport async function isPatternConfigured(): Promise {\n return (await getSetting(PATTERN_KEY)) !== null;\n}\n\n/** Enregistre un nouveau schéma et invalide toutes les sessions existantes. */\nexport async function setPattern(pattern: string): Promise {\n const salt = randomHex(16);\n const hash = await pbkdf2Hex(pattern, salt, PBKDF2_ITERATIONS);\n await setSetting(PATTERN_KEY, `pbkdf2$${PBKDF2_ITERATIONS}$${salt}$${hash}`);\n await deleteAllSessions();\n}\n\n/** Vérifie un schéma saisi contre le hash stocké. */\nexport async function verifyPattern(pattern: string): Promise {\n const stored = await getSetting(PATTERN_KEY);\n if (!stored) return false;\n const [scheme, iterationsRaw, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterationsRaw || !salt || !hash) return false;\n const candidate = await pbkdf2Hex(pattern, salt, Number(iterationsRaw));\n return timingSafeEqual(candidate, hash);\n}\n\n/** Crée une session et retourne le token à poser en cookie. */\nexport async function createSession(): Promise<{ token: string; maxAge: number }> {\n await ensureSchema();\n const token = randomHex(32);\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, now + SESSION_TTL_MS, now],\n });\n return { token, maxAge: Math.floor(SESSION_TTL_MS / 1000) };\n}\n\n/** Vrai si la requête porte une session valide et non expirée. */\nexport async function hasValidSession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return false;\n await ensureSchema();\n const tokenHash = await sha256Hex(token);\n const result = await sqlite.execute({\n sql: \"SELECT expires_at FROM app_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n const row = result.rows[0] as unknown as { expires_at?: number } | undefined;\n if (!row) return false;\n if (Number(row.expires_at) < Date.now()) {\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n return false;\n }\n return true;\n}\n\n/** Invalide la session portée par la requête. */\nexport async function destroySession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return;\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM app_sessions WHERE token_hash = ?\",\n args: [await sha256Hex(token)],\n });\n}\n\n/** Invalide toutes les sessions (purge à la reconfiguration du schéma). */\nexport async function deleteAllSessions(): Promise {\n await ensureSchema();\n await sqlite.execute(\"DELETE FROM app_sessions\");\n}\n\n/** Garde-fou : retourne une réponse 401 si la session est absente, sinon null. */\nexport async function requireSession(request: Request): Promise {\n if (await hasValidSession(request)) return null;\n return Response.json({ ok: false, code: \"UNAUTHORIZED\" }, { status: 401 });\n}\n\nexport function sessionCookieHeader(token: string, maxAge: number): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearCookieHeader(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n const header = request.headers.get(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) return part.slice(index + 1).trim();\n }\n return null;\n}",[],[175,392],["D",1789511156996],[191,192,193],[175],["D",1789511143425],["D",1789696237964],{"_107":106,"_115":111},{"_107":106,"_108":109,"_110":111,"_19":62,"_112":113,"_114":31},{"_13":96,"_38":97,"_50":49,"_98":51,"_99":-5,"_100":-5,"_101":-5,"_102":-5,"_103":-5,"_104":52,"_105":106},"ctx",{"_89":-5,"_135":439,"_440":441,"_442":443,"_444":31,"_445":31,"_446":31,"_447":66,"_448":-5,"_449":-7,"_450":-7,"_451":70,"_452":31,"_453":31,"_454":-5,"_455":31,"_456":31,"_457":31,"_458":-5},"ENV",{"_410":411,"_412":413,"_414":97,"_415":416,"_417":418,"_419":420,"_421":422,"_423":424,"_425":426,"_427":428,"_429":430,"_431":432,"_433":434,"_435":436,"_437":438},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v58