SAMI.TECH — Retours Ecotrack

\n \n \n",[],[154,246],"4b43d310-2ee2-46ec-a5f7-e3238ff5389e","messages.ts","8d1f9d26-b154-11f1-b96e-1607ee4eb77e","07620b9a-84bf-4cea-b8dd-75e58750fcbc",20,["D",1789511823118],"/** Traduction des codes métier backend en messages utilisateur. */\nimport { normalizeStatus } from \"../../shared/status.ts\";\n\nexport function messageForCode(code: string): string {\n switch (code) {\n case \"API_NOT_CONFIGURED\":\n return \"Aucune API Ecotrack enregistrée — ouvre les paramètres.\";\n case \"INVALID_TOKEN\":\n return \"Token API invalide.\";\n case \"INVALID_TRACKING\":\n return \"Numéro de tracking invalide.\";\n case \"TRACKING_NOT_FOUND\":\n return \"Tracking introuvable dans OM Express.\";\n case \"ECOTRACK_READ_ERROR\":\n return \"OM Express a refusé la lecture du colis.\";\n case \"ECOTRACK_BAD_RESPONSE\":\n return \"Réponse illisible de OM Express.\";\n case \"ECOTRACK_NETWORK_ERROR\":\n return \"Erreur réseau vers OM Express.\";\n case \"RETURN_NOT_READY\":\n return \"Retour non éligible : le statut ne permet pas la validation.\";\n case \"RETURN_NOT_ELIGIBLE\":\n return \"Retour non éligible (OM Express a répondu fail).\";\n case \"RETURN_INVALID\":\n return \"Validation refusée par OM Express (requête invalide).\";\n case \"RETURN_API_ERROR\":\n return \"Erreur OM Express pendant la validation.\";\n case \"RETURN_NETWORK_ERROR\":\n return \"Erreur réseau pendant la validation.\";\n case \"UNAUTHORIZED\":\n return \"Session expirée — reverrouille l'application.\";\n default:\n return \"Opération impossible pour le moment.\";\n }\n}\n\n/** Libellé lisible d'un statut Ecotrack brut. */\nexport function statusLabel(raw: string): string {\n switch (normalizeStatus(raw)) {\n case \"retour_recu\":\n return \"Retour reçu\";\n case \"livraison_echoue_recu\":\n return \"Livraison échouée — reçu\";\n case \"return_validated_by_partener\":\n case \"return_validated_by_partner\":\n case \"retour_valide\":\n case \"retour_validee\":\n return \"Retour déjà validé\";\n default:\n return raw.trim() || \"statut inconnu\";\n }\n}\n\n/** Vibration courte, jamais bloquante. */\nexport function vibrate(pattern: number[]): void {\n try {\n if (typeof navigator.vibrate === \"function\") navigator.vibrate(pattern);\n } catch {\n /* ignore */\n }\n}/**\n * Ton de l'ÉTAT : pilote la couleur du voyant et du cadre du scanner.\n * idle -> gris (repos)\n * busy -> ambre (traitement en cours)\n * ok -> vert (succès / prêt)\n * warn -> ambre (trouvé mais non éligible)\n * error -> rouge (échec)\n */\nexport type StatusTone = \"idle\" | \"busy\" | \"ok\" | \"warn\" | \"error\";\n\nexport function toneForCode(code: string): StatusTone {\n switch (code) {\n case \"TRACKING_FOUND\":\n case \"RETURN_VALIDATED\":\n return \"ok\";\n case \"RETURN_ACCEPTED_UNCONFIRMED\":\n case \"RETURN_NOT_READY\":\n case \"RETURN_NOT_ELIGIBLE\":\n return \"warn\";\n default:\n return \"error\";\n }\n}",[],[154,261,253],"lib","f0e4c272-af21-43ea-91a8-38ce5116eb20","api.ts","8d0e7514-b154-11f1-b96e-1607ee4eb77e",54,["D",1789513445064],"/**\n * Appels API côté navigateur.\n * Le frontend n'envoie que des informations fonctionnelles :\n * jamais de token, jamais de cookie Ecotrack, jamais de credential.\n */\n\nexport type ValidateOk = {\n ok: true;\n code: \"TRACKING_FOUND\";\n tracking: string;\n status: string;\n statusRaw: string;\n ready: boolean;\n alreadyValidated: boolean;\n};\n\nexport type ApiError = {\n ok: false;\n code: string;\n status?: number;\n message?: string;\n detail?: string;\n /** Noms des clés renvoyées par Ecotrack (diagnostic, aucune valeur). */\n debug?: string;\n};\n\nexport type ValidateResponse = ValidateOk | ApiError;\n\nexport type ReturnValidationResponse = {\n ok: boolean;\n code: string;\n tracking?: string;\n confirmed?: boolean;\n message?: string;\n detail?: string;\n};\n\nexport type AccessStatus = {\n ok: boolean;\n configured: boolean;\n unlocked: boolean;\n};\n\nasync function postJson(url: string, payload: unknown): Promise {\n const response = await fetch(url, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n body: JSON.stringify(payload),\n });\n return (await response.json()) as T;\n}\n\nexport function fetchAccessStatus(): Promise {\n return fetch(\"/api/access/status\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function fetchConfig(): Promise<{ ok: boolean; apiSaved: boolean }> {\n return fetch(\"/api/config\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function setupPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/setup\", { pattern });\n}\n\nexport function unlockPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/unlock\", { pattern });\n}\n\nexport function lockApp(): Promise<{ ok: boolean }> {\n return postJson(\"/api/access/logout\", {});\n}\n\nexport function saveApiToken(apiToken: string): Promise<{ ok: boolean; apiSaved?: boolean; code?: string }> {\n return postJson(\"/api/ecotrack/settings\", { apiToken });\n}\n\nexport async function deleteApiToken(): Promise<{ ok: boolean; apiSaved?: boolean }> {\n const response = await fetch(\"/api/ecotrack/settings\", {\n method: \"DELETE\",\n credentials: \"same-origin\",\n });\n return (await response.json()) as { ok: boolean; apiSaved?: boolean };\n}\n\nexport function validateTracking(tracking: string): Promise {\n return postJson(\"/api/validate\", { tracking });\n}\n\nexport function validateReturn(tracking: string): Promise {\n return postJson(\"/api/return/validate\", { tracking });\n}/* ------------------------------------------------------------------ */\n/* Retours prêts (liste serveur) */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyReturnsResponse = {\n ok: boolean;\n code?: string;\n /** `ecotrack_list` = liste renvoyée par l'API ; `local_registry` = relecture serveur. */\n source?: \"ecotrack_list\" | \"local_registry\";\n count?: number;\n items?: ReadyReturn[];\n scanned?: number;\n diagnostics?: string[];\n};\n\n/** Charge la liste des retours prêts. Le token Ecotrack reste côté serveur. */\nexport function fetchReadyReturns(): Promise {\n return fetch(\"/api/returns/ready\", { credentials: \"same-origin\" }).then((r) => r.json());\n}",[],[154,261,263],"65e863f5-391b-4fbd-8ced-e27e780f2903",9,["D",1789511212692],[191,192],[154,261],"6c4d6547-36ff-417e-8cf4-398a89134cff","StatusPanel.tsx","a49c9c4c-b154-11f1-aa9a-1607ee4eb77e","34a6d1f5-1d62-4377-8a82-c7eaa0426cae",21,["D",1789511823303],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Zone ÉTAT — toujours affichée AU-DESSUS de la caméra.\n * Le voyant est coloré selon le ton courant : vert (ok), ambre (busy/warn),\n * rouge (error), gris (idle).\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { StatusTone } from \"../lib/messages.ts\";\n\ntype Props = {\n status: string;\n tracking: string;\n tone: StatusTone;\n hint?: string;\n};\n\nexport default function StatusPanel({ status, tracking, tone, hint = \"\" }: Props) {\n return (\n

ÉTAT

\n \n

{status}

\n {tracking ? (\n

\n TRACKING {tracking}\n

\n ) : null}\n {hint ?

{hint}

: null}\n

\n );\n}",[],[154,284,276],"components","0727bdf1-ae1a-4960-a498-45fe55c8b48e","Settings.tsx","a4ab18a8-b154-11f1-aa9a-1607ee4eb77e",16,["D",1789511252317],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Paramètres — gestion du token API Ecotrack.\n *\n * Le token est envoyé une seule fois au serveur, puis jamais réaffiché.\n * Le badge affiché est « API SAUVEGARDÉE » : la présence d'un token ne garantit\n * pas que toutes les opérations Ecotrack sont disponibles.\n */\nimport React, { useState } from \"https://esm.sh/react@18.2.0\";\nimport { deleteApiToken, saveApiToken } from \"../lib/api.ts\";\n\ntype Props = {\n open: boolean;\n apiSaved: boolean;\n onClose: () => void;\n onSaved: (saved: boolean) => void;\n onLock: () => void;\n};\n\nexport default function Settings({ open, apiSaved, onClose, onSaved, onLock }: Props) {\n const [token, setToken] = useState(\"\");\n const [notice, setNotice] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n if (!open) return null;\n\n async function handleSave() {\n if (busy) return;\n const clean = token.trim();\n if (clean.length < 8) {\n setError(\"Token API trop court.\");\n return;\n }\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await saveApiToken(clean);\n if (result.ok) {\n setToken(\"\");\n setNotice(\"API Ecotrack enregistrée côté serveur.\");\n onSaved(true);\n } else {\n setError(\"Enregistrement refusé par le serveur.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n async function handleDelete() {\n if (busy) return;\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await deleteApiToken();\n if (result.ok) {\n setNotice(\"API Ecotrack supprimée du serveur.\");\n onSaved(false);\n } else {\n setError(\"Suppression impossible.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n return (\n

Paramètres

\n\n \n {apiSaved ? \"API SAUVEGARDÉE\" : \"AUCUNE API ENREGISTRÉE\"}\n \n\n

\n \n API TOKEN\n \n setToken(event.target.value)}\n />\n

\n\n {notice ?

{notice}

: null}\n {error ?

{error}

: null}\n\n

\n \n {apiSaved ? (\n \n SUPPRIMER\n \n ) : null}\n

\n \n \n

\n\n

\n Le token est conservé côté serveur et n'est jamais renvoyé au navigateur.\n

\n );\n}",[],[154,284,286],"c152045d-c111-424d-87d6-cdb45b949146","Scanner.tsx","9c31fd86-b154-11f1-8617-1607ee4eb77e",32,["D",1789511849454],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Scanner QR continu.\n *\n * Règle principale : le MediaStream caméra n'est JAMAIS fermé après un scan.\n * QR détecté -> pause logique (scanningRef = false) -> traitement -> reprise.\n * `stopCamera()` n'est appelé qu'au démontage du composant, à la fermeture de\n * l'application ou en cas de perte réelle du flux.\n *\n * Deux moteurs de détection : BarcodeDetector natif, puis jsQR en secours\n * (analyse plein cadre + analyse de la zone centrale).\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport jsQR from \"https://esm.sh/jsqr@1.4.0\";\nimport { extractTracking } from \"../../shared/tracking.ts\";\nimport { type StatusTone, vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n enabled: boolean;\n scanning: boolean;\n onReady: () => void;\n onTracking: (tracking: string) => void;\n onStatus: (status: string, tone?: StatusTone) => void;\n /** Couleur du cadre : vert (ok), rouge (error), blanc (neutral). */\n frameTone: \"neutral\" | \"ok\" | \"error\";\n};\n\ntype BarcodeDetectorLike = {\n detect: (source: CanvasImageSource) => Promise>;\n};\n\nconst FRAME_INTERVAL_MS = 160;\nconst SAME_RAW_COOLDOWN_MS = 2500;\nconst JSQR_MAX_SIDE = 640;\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction createDetector(): BarcodeDetectorLike | null {\n const ctor = (globalThis as unknown as {\n BarcodeDetector?: new (options?: { formats?: string[] }) => BarcodeDetectorLike;\n }).BarcodeDetector;\n if (!ctor) return null;\n try {\n return new ctor({ formats: [\"qr_code\"] });\n } catch {\n return null;\n }\n}\n\n/** Applique focus continu et zoom si le matériel les expose. */\nasync function applyTrackHints(stream: MediaStream): Promise {\n const track = stream.getVideoTracks()[0] as MediaStreamTrack & {\n getCapabilities?: () => Record;\n };\n if (!track?.getCapabilities || !track.applyConstraints) return;\n try {\n const capabilities = track.getCapabilities();\n const advanced: Record = {};\n\n const focusModes = capabilities.focusMode;\n if (Array.isArray(focusModes) && focusModes.includes(\"continuous\")) {\n advanced.focusMode = \"continuous\";\n }\n\n const zoom = capabilities.zoom as { min?: number; max?: number } | undefined;\n if (zoom && typeof zoom.max === \"number\") {\n const target = Math.min(1.6, zoom.max);\n if (target >= (zoom.min ?? 1)) advanced.zoom = target;\n }\n\n if (Object.keys(advanced).length > 0) {\n await track.applyConstraints({ advanced: [advanced] } as MediaStreamConstraints);\n }\n } catch {\n /* capacités non supportées : on continue sans */\n }\n}\n\n/** Analyse une zone vidéo avec jsQR. */\nfunction analyzeZone(\n context: CanvasRenderingContext2D,\n canvas: HTMLCanvasElement,\n video: HTMLVideoElement,\n source: { x: number; y: number; size: number },\n outputSize: number,\n): string | null {\n canvas.width = outputSize;\n canvas.height = outputSize;\n context.drawImage(\n video,\n source.x,\n source.y,\n source.size,\n source.size,\n 0,\n 0,\n outputSize,\n outputSize,\n );\n const image = context.getImageData(0, 0, outputSize, outputSize);\n const code = jsQR(image.data, image.width, image.height, { inversionAttempts: \"dontInvert\" });\n return code?.data ?? null;\n}\n\n/** Secours jsQR : plein cadre (sous-échantillonné) puis zone centrale (pleine résolution). */\nfunction detectWithJsQr(\n video: HTMLVideoElement,\n canvasRef: React.MutableRefObject,\n): string | null {\n const width = video.videoWidth;\n const height = video.videoHeight;\n if (!width || !height) return null;\n\n let canvas = canvasRef.current;\n if (!canvas) {\n canvas = document.createElement(\"canvas\");\n canvasRef.current = canvas;\n }\n const context = canvas.getContext(\"2d\", { willReadFrequently: true });\n if (!context) return null;\n\n const side = Math.min(width, height);\n const fullOutput = Math.max(160, Math.min(JSQR_MAX_SIDE, side));\n const full = analyzeZone(\n context,\n canvas,\n video,\n { x: 0, y: 0, size: side },\n fullOutput,\n );\n if (full) return full;\n\n // Deuxième analyse : zone centrale, pleine résolution.\n const centerSize = Math.floor(side * 0.6);\n const center = analyzeZone(\n context,\n canvas,\n video,\n { x: Math.floor((width - centerSize) / 2), y: Math.floor((height - centerSize) / 2), size: centerSize },\n centerSize,\n );\n return center;\n}\n\nexport default function Scanner(\n { enabled, scanning, frameTone, onReady, onTracking, onStatus }: Props,\n) {\n const videoRef = useRef(null);\n const canvasRef = useRef(null);\n const streamRef = useRef(null);\n const scanningRef = useRef(false);\n const loopRunningRef = useRef(false);\n const lastScanRef = useRef(\"\");\n const lastRawRef = useRef(\"\");\n const lastRawAtRef = useRef(0);\n const framesRef = useRef(0);\n const lastTickRef = useRef(0);\n\n const [cameraOn, setCameraOn] = useState(false);\n const [qrDetected, setQrDetected] = useState(false);\n\n const onReadyRef = useRef(onReady);\n const onTrackingRef = useRef(onTracking);\n const onStatusRef = useRef(onStatus);\n useEffect(() => {\n onReadyRef.current = onReady;\n onTrackingRef.current = onTracking;\n onStatusRef.current = onStatus;\n }, [onReady, onTracking, onStatus]);\n\n /* -------------------------------------------------------------- */\n /* Traitement d'un contenu QR */\n /* -------------------------------------------------------------- */\n\n const handleRaw = useCallback((raw: string) => {\n const now = Date.now();\n if (raw === lastRawRef.current && now - lastRawAtRef.current < SAME_RAW_COOLDOWN_MS) return;\n lastRawRef.current = raw;\n lastRawAtRef.current = now;\n\n const tracking = extractTracking(raw);\n if (!tracking) {\n setQrDetected(true);\n onStatusRef.current(\"QR lu, mais aucun numéro de tracking reconnu.\", \"error\");\n window.setTimeout(() => setQrDetected(false), 700);\n return;\n }\n if (lastScanRef.current === tracking) return;\n\n lastScanRef.current = tracking;\n scanningRef.current = false; // pause logique : le MediaStream reste ouvert\n setQrDetected(true);\n vibrate([70, 40, 110]);\n onStatusRef.current(\"QR détecté — tracking reconnu\", \"busy\");\n onTrackingRef.current(tracking);\n }, []);\n\n /* -------------------------------------------------------------- */\n /* Boucle de scan */\n /* -------------------------------------------------------------- */\n\n const scanLoop = useCallback(async () => {\n if (loopRunningRef.current) return;\n loopRunningRef.current = true;\n try {\n const detector = createDetector();\n while (scanningRef.current && streamRef.current) {\n const video = videoRef.current;\n if (!video || video.readyState < 2 || video.videoWidth === 0) {\n await sleep(120);\n continue;\n }\n const now = Date.now();\n if (now - lastTickRef.current < FRAME_INTERVAL_MS) {\n await sleep(40);\n continue;\n }\n lastTickRef.current = now;\n framesRef.current += 1;\n\n let raw: string | null = null;\n if (detector) {\n try {\n const codes = await detector.detect(video);\n if (codes.length > 0 && codes[0].rawValue) raw = codes[0].rawValue;\n } catch {\n /* BarcodeDetector indisponible sur cette frame : jsQR prend le relais */\n }\n }\n if (!raw) raw = detectWithJsQr(video, canvasRef);\n if (raw) handleRaw(raw);\n\n await sleep(50);\n }\n } finally {\n loopRunningRef.current = false;\n }\n }, [handleRaw]);\n\n /* -------------------------------------------------------------- */\n /* Caméra */\n /* -------------------------------------------------------------- */\n\n const stopCamera = useCallback(() => {\n scanningRef.current = false;\n const stream = streamRef.current;\n if (stream) stream.getTracks().forEach((track) => track.stop());\n streamRef.current = null;\n const video = videoRef.current;\n if (video) video.srcObject = null;\n setCameraOn(false);\n }, []);\n\n const startCamera = useCallback(async () => {\n if (streamRef.current) return;\n onStatusRef.current(\"Ouverture de la caméra…\", \"busy\");\n try {\n const constraints = {\n audio: false,\n video: {\n facingMode: { ideal: \"environment\" },\n width: { ideal: 1920 },\n height: { ideal: 1080 },\n },\n } as MediaStreamConstraints;\n const stream = await navigator.mediaDevices.getUserMedia(constraints);\n streamRef.current = stream;\n\n const video = videoRef.current;\n if (video) {\n video.srcObject = stream;\n video.muted = true;\n try {\n await video.play();\n } catch {\n /* autoplay bloqué : le flux reste ouvert */\n }\n }\n await applyTrackHints(stream);\n setCameraOn(true);\n onReadyRef.current();\n } catch {\n streamRef.current = null;\n setCameraOn(false);\n onStatusRef.current(\"Caméra indisponible — utilise la SAISIE MANUELLE.\", \"error\");\n }\n }, []);\n\n // Ouverture de la caméra après déverrouillage ; arrêt uniquement au démontage.\n useEffect(() => {\n if (!enabled) return;\n void startCamera();\n return () => stopCamera();\n }, [enabled, startCamera, stopCamera]);\n\n /* -------------------------------------------------------------- */\n /* Reprise automatique du scanner */\n /* -------------------------------------------------------------- */\n\n useEffect(() => {\n if (!scanning) {\n scanningRef.current = false;\n return;\n }\n // Équivalent de resumeScanner() : remise à zéro puis reprise.\n setQrDetected(false);\n lastScanRef.current = \"\";\n framesRef.current = 0;\n\n const stream = streamRef.current;\n const alive = !!stream && stream.getVideoTracks().some((track) => track.readyState === \"live\");\n if (alive && videoRef.current) {\n setCameraOn(true);\n scanningRef.current = true;\n onStatusRef.current(\"Analyse QR active — place le QR dans le cadre\", \"ok\");\n void scanLoop();\n return;\n }\n scanningRef.current = false;\n void startCamera();\n }, [scanning, scanLoop, startCamera]);\n\n return (\n

\n {!cameraOn && (\n

\n ▣\n Scanner un retour\n

\n )}\n \n );\n}",[],[154,284,294],"a203b732-9657-4f91-bae1-492b9390c3e3","ReturnsReadyCard.tsx","e83f1746-b158-11f1-b989-1607ee4eb77e",70,["D",1789513621736],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Rubrique « RETOURS PRÊTS ».\n *\n * Deux usages, une seule caméra et aucun appel Ecotrack direct :\n * 1. 🔄 CHARGER LES RETOURS PRÊTS → liste serveur (GET /api/returns/ready)\n * 2. 📷 SCANNER LES RETOURS PRÊTS → bascule le mode de lecture du scanner existant\n *\n * Ce composant ne crée aucune caméra et ne parle à aucune API : il délègue tout\n * à App.tsx, qui utilise les routes backend existantes.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport ReadyReturnsList from \"./ReadyReturnsList.tsx\";\n\nexport type ScanMode = \"normal\" | \"returns_ready\";\n\nexport type ReadyState = {\n loaded: boolean;\n loading: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n /** Trace des tentatives côté serveur (statuts HTTP, formes de réponse). */\n diagnostics: string[];\n};\n\ntype Props = {\n scanMode: ScanMode;\n onStart: () => void;\n onStop: () => void;\n onLoad: () => void;\n onSelect: (item: ReadyReturn) => void;\n ready: ReadyState;\n disabled?: boolean;\n};\n\nexport default function ReturnsReadyCard({\n scanMode,\n onStart,\n onStop,\n onLoad,\n onSelect,\n ready,\n disabled = false,\n}: Props) {\n const active = scanMode === \"returns_ready\";\n\n return (\n

RETOURS PRÊTS

\n Charge la liste des colis prêts à être validés, ou scanne-les directement.\n

\n\n \n {ready.loading ? \"CHARGEMENT…\" : \"🔄 CHARGER LES RETOURS PRÊTS\"}\n \n\n \n\n {active ? (\n <>\n MODE RETOURS PRÊTS ACTIF\n \n \n ) : (\n \n )}\n

\n );\n}",[],[154,284,302],"dffbe624-83dc-4604-9139-7b13f40eba19","ReturnDetailSheet.tsx","bfb37906-b159-11f1-b477-1607ee4eb77e",56,["D",1789513445152],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Fiche retour — ouverte en cliquant un élément de RETOURS PRÊTS.\n *\n * Affiche le tracking et le statut Ecotrack, puis propose VALIDER LE RETOUR.\n * La validation utilise la route existante POST /api/return/validate :\n * la relecture serveur du statut avant mutation reste inchangée.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n tracking: string;\n statusRaw: string;\n validating: boolean;\n onClose: () => void;\n onValidate: () => void;\n};\n\nexport default function ReturnDetailSheet({\n tracking,\n statusRaw,\n validating,\n onClose,\n onValidate,\n}: Props) {\n if (!tracking) return null;\n\n return (\n

Fiche retour

\n\n

\n TRACKING\n {tracking}\n

\n\n

\n STATUT ECOTRACK\n {statusLabel(statusRaw)}\n

\n\n

\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n \n

\n\n

\n Le statut est revérifié côté serveur juste avant la validation.\n

\n );\n}",[],[154,284,310],"2b23e6f3-9051-4972-aac4-d0ff79c0f632","ReadyReturnsList.tsx","bfaddac8-b159-11f1-b477-1607ee4eb77e",71,["D",1789513621767],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Liste « RETOURS PRÊTS (X) ».\n * Chaque élément est cliquable et ouvre la fiche retour.\n * Aucun appel réseau ici : les données viennent du backend.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n loaded: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n diagnostics: string[];\n onSelect: (item: ReadyReturn) => void;\n};\n\nexport default function ReadyReturnsList({\n loaded,\n items,\n source,\n error,\n diagnostics,\n onSelect,\n}: Props) {\n if (error) return

{error}

;\n if (!loaded) return null;\n\n return (\n <>\n

\n RETOURS PRÊTS ({items.length})\n {source === \"local_registry\" ? (\n relecture serveur\n ) : null}\n

\n\n {items.length === 0 ? (\n

Aucun colis prêt renvoyé par le serveur.

\n ) : (\n

\n \n

\n )}\n\n {diagnostics.length > 0 ? (\n

\n {diagnostics.map((line) => (\n

{line}

\n ))}\n

\n ) : null}\n \n );\n}",[],[154,284,318],"1425fed1-60da-4bbc-9aae-2aede04a3c61","PatternGate.tsx","9c2cb9ca-b154-11f1-8617-1607ee4eb77e",11,["D",1789511238063],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Verrouillage de l'application par schéma Android 3x3.\n *\n * Le schéma est tracé au doigt (pointer events) puis envoyé au serveur.\n * En mode `setup`, le schéma doit être tracé deux fois de suite.\n * Aucun hash, aucun secret n'est manipulé côté navigateur.\n */\nimport React, { useCallback, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { setupPattern, unlockPattern } from \"../lib/api.ts\";\nimport { vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n mode: \"setup\" | \"unlock\";\n onUnlocked: () => void;\n};\n\nconst MIN_POINTS = 4;\n\nexport default function PatternGate({ mode, onUnlocked }: Props) {\n const [path, setPath] = useState([]);\n const [pending, setPending] = useState(null);\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n const pathRef = useRef([]);\n const tracingRef = useRef(false);\n const busyRef = useRef(false);\n const dotRefs = useRef>([]);\n\n const reset = useCallback(() => {\n pathRef.current = [];\n setPath([]);\n }, []);\n\n const addDot = useCallback((dot: number) => {\n if (pathRef.current.includes(dot)) return;\n pathRef.current = [...pathRef.current, dot];\n setPath(pathRef.current);\n vibrate([12]);\n }, []);\n\n const dotAt = useCallback((x: number, y: number): number | null => {\n for (let index = 0; index < 9; index++) {\n const element = dotRefs.current[index];\n if (!element) continue;\n const rect = element.getBoundingClientRect();\n const centerX = rect.left + rect.width / 2;\n const centerY = rect.top + rect.height / 2;\n const radius = Math.max(rect.width, 46);\n if (Math.hypot(x - centerX, y - centerY) <= radius) return index + 1;\n }\n return null;\n }, []);\n\n const submit = useCallback(\n async (pattern: string) => {\n if (busyRef.current) return;\n busyRef.current = true;\n setBusy(true);\n setError(\"\");\n try {\n if (mode === \"setup\") {\n if (pending === null) {\n setPending(pattern);\n reset();\n return;\n }\n if (pending !== pattern) {\n setPending(null);\n reset();\n setError(\"Les deux schémas ne correspondent pas. Recommence.\");\n return;\n }\n const result = await setupPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n setPending(null);\n reset();\n setError(\"Enregistrement impossible. Recharge la page et réessaie.\");\n return;\n }\n\n const result = await unlockPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n reset();\n setError(\"Schéma incorrect.\");\n } catch {\n reset();\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n busyRef.current = false;\n setBusy(false);\n }\n },\n [mode, onUnlocked, pending, reset],\n );\n\n const handlePointerDown = useCallback(\n (event: React.PointerEvent) => {\n if (busyRef.current) return;\n event.currentTarget.setPointerCapture(event.pointerId);\n tracingRef.current = true;\n setError(\"\");\n reset();\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt, reset],\n );\n\n const handlePointerMove = useCallback(\n (event: React.PointerEvent) => {\n if (!tracingRef.current) return;\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt],\n );\n\n const handlePointerUp = useCallback(() => {\n if (!tracingRef.current) return;\n tracingRef.current = false;\n const current = pathRef.current;\n if (current.length < MIN_POINTS) {\n reset();\n setError(\"Relie au moins 4 points.\");\n return;\n }\n void submit(current.join(\"\"));\n }, [reset, submit]);\n\n const points = path\n .map((dot) => `${((dot - 1) % 3) + 0.5},${Math.floor((dot - 1) / 3) + 0.5}`)\n .join(\" \");\n\n const hint = mode === \"setup\"\n ? pending === null\n ? \"Trace ton schéma de déverrouillage (4 points minimum).\"\n : \"Reproduis exactement le même schéma pour confirmer.\"\n : \"Trace ton schéma pour accéder au scanner.\";\n\n return (\n

\n SAMI.TECH\n

{hint}

\n\n \n \n

\n {Array.from({ length: 9 }, (_, index) => (\n \n {\n dotRefs.current[index] = element;\n }}\n />\n

\n ))}\n

\n \n\n

{error}

\n\n

\n {\n reset();\n setPending(null);\n setError(\"\");\n }}\n >\n EFFACER\n \n

\n \n );\n}",[],[154,284,326],"fbf5dc9f-bcef-4638-8c09-b1c84bcaad75","ManualEntry.tsx","a4a1edc8-b154-11f1-aa9a-1607ee4eb77e",14,["D",1789511252256],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * SAISIE MANUELLE — directement sous la caméra.\n * Mêmes règles que le scanner : A-Z, 0-9, `_`, `-`, 6 à 64 caractères, majuscules.\n * La touche Entrée lance la vérification. La caméra n'est jamais fermée ici.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n value: string;\n onChange: (value: string) => void;\n onSubmit: (value: string) => void;\n disabled?: boolean;\n};\n\nconst MIN_LENGTH = 6;\nconst MAX_LENGTH = 64;\n\nexport default function ManualEntry({ value, onChange, onSubmit, disabled = false }: Props) {\n const canSubmit = value.trim().length >= MIN_LENGTH && !disabled;\n\n return (\n

SAISIE MANUELLE

\n {\n event.preventDefault();\n if (canSubmit) onSubmit(value.trim().toUpperCase());\n }}\n >\n {\n const clean = event.target.value\n .toUpperCase()\n .replace(/[^A-Z0-9_-]/g, \"\")\n .slice(0, MAX_LENGTH);\n onChange(clean);\n }}\n />\n \n \n

\n );\n}",[],[154,284,334],"62a5fdbe-684a-480f-82a7-af6c6aad1e52","HistoryList.tsx","a4a69242-b154-11f1-aa9a-1607ee4eb77e",15,["D",1789511252288],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * DERNIERS RETOURS VALIDÉS — historique d'affichage uniquement.\n * Ce n'est pas une preuve serveur : la source de vérité reste OM Express.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n items: string[];\n};\n\nexport default function HistoryList({ items }: Props) {\n return (\n

DERNIERS RETOURS VALIDÉS

\n {items.length === 0 ? (\n

Aucun retour validé pour l'instant.

\n ) : (\n

\n ✓\n {tracking}\n

\n )}\n

\n );\n}",[],[154,284,342],"3b06a799-b3f3-4d8c-ac2a-3c763a1b5d3b","App.tsx","b3594b36-b154-11f1-a81e-1607ee4eb77e",76,["D",1789513633536],17,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Application principale — machine à états du scanner continu.\n *\n * Ordre visuel imposé :\n * 1. En-tête SAMI.TECH / Retours Ecotrack\n * 2. ÉTAT (voyant coloré : vert ok, ambre busy/warn, rouge error, gris idle)\n * 3. Caméra / Scanner QR (cadre blanc / vert / rouge)\n * 4. SAISIE MANUELLE\n * 5. VALIDER LE RETOUR (uniquement si le colis est éligible)\n * 6. DERNIERS RETOURS VALIDÉS\n * 7. Footer\n *\n * Niveaux de fiabilité distingués en permanence :\n * QR détecté ≠ tracking trouvé ≠ retour éligible ≠ retour validé.\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { isReturnReadyStatus } from \"../../shared/status.ts\";\nimport {\n fetchAccessStatus,\n fetchConfig,\n fetchReadyReturns,\n lockApp,\n validateReturn,\n validateTracking,\n} from \"../lib/api.ts\";\nimport type { ReadyReturn, ValidateResponse } from \"../lib/api.ts\";\nimport { messageForCode, statusLabel, toneForCode, vibrate } from \"../lib/messages.ts\";\nimport type { StatusTone } from \"../lib/messages.ts\";\nimport HistoryList from \"./HistoryList.tsx\";\nimport ManualEntry from \"./ManualEntry.tsx\";\nimport PatternGate from \"./PatternGate.tsx\";\nimport ReturnsReadyCard from \"./ReturnsReadyCard.tsx\";\nimport type { ReadyState, ScanMode } from \"./ReturnsReadyCard.tsx\";\nimport ReturnDetailSheet from \"./ReturnDetailSheet.tsx\";\nimport Scanner from \"./Scanner.tsx\";\nimport Settings from \"./Settings.tsx\";\nimport StatusPanel from \"./StatusPanel.tsx\";\n\ntype AccessState = \"loading\" | \"setup\" | \"locked\" | \"open\";\ntype FrameTone = \"neutral\" | \"ok\" | \"error\";\n\nconst RESUME_DELAY_MS = 800;\nconst HISTORY_LIMIT = 8;\n\nexport default function App() {\n const [access, setAccess] = useState(\"loading\");\n const [statusText, setStatusText] = useState(\"Prêt à scanner\");\n const [tone, setTone] = useState(\"idle\");\n const [hint, setHint] = useState(\"\");\n const [tracking, setTracking] = useState(\"\");\n const [result, setResult] = useState(null);\n const [validating, setValidating] = useState(false);\n const [scanning, setScanning] = useState(false);\n const [manualValue, setManualValue] = useState(\"\");\n const [history, setHistory] = useState([]);\n const [settingsOpen, setSettingsOpen] = useState(false);\n const [apiSaved, setApiSaved] = useState(false);\n /** Mode de lecture du scanner existant : normal ou contrôle « retour prêt ». */\n const [scanMode, setScanMode] = useState(\"normal\");\n /** Liste RETOURS PRÊTS, chargée depuis le backend (token Ecotrack côté serveur). */\n const [readyState, setReadyState] = useState({\n loaded: false,\n loading: false,\n items: [],\n source: \"\",\n error: \"\",\n diagnostics: [],\n });\n /** Fiche retour ouverte depuis la liste. */\n const [selected, setSelected] = useState(null);\n\n const resumeTimer = useRef(null);\n const trackingRef = useRef(\"\");\n const validatingRef = useRef(false);\n\n useEffect(() => {\n trackingRef.current = tracking;\n }, [tracking]);\n\n useEffect(() => {\n return () => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n };\n }, []);\n\n /** Met à jour l'ÉTAT : texte + couleur + ligne de détail optionnelle. */\n const showStatus = useCallback(\n (text: string, nextTone: StatusTone = \"busy\", nextHint = \"\") => {\n setStatusText(text);\n setTone(nextTone);\n setHint(nextHint);\n },\n [],\n );\n\n /* ---------------------------------------------------------------- */\n /* Reprise automatique du scanner (jamais de fermeture caméra) */\n /* ---------------------------------------------------------------- */\n\n const resume = useCallback((delayMs: number = RESUME_DELAY_MS) => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n setScanning(false);\n resumeTimer.current = window.setTimeout(() => {\n resumeTimer.current = null;\n setTracking(\"\");\n setResult(null);\n setHint(\"\");\n setTone(\"busy\");\n setScanning(true);\n }, delayMs);\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Déverrouillage */\n /* ---------------------------------------------------------------- */\n\n useEffect(() => {\n let cancelled = false;\n void (async () => {\n try {\n const data = await fetchAccessStatus();\n if (cancelled) return;\n if (!data.configured) setAccess(\"setup\");\n else if (data.unlocked) setAccess(\"open\");\n else setAccess(\"locked\");\n } catch {\n if (!cancelled) setAccess(\"locked\");\n }\n })();\n return () => {\n cancelled = true;\n };\n }, []);\n\n useEffect(() => {\n if (access !== \"open\") return;\n void (async () => {\n try {\n const data = await fetchConfig();\n setApiSaved(Boolean(data.apiSaved));\n } catch {\n /* ignore */\n }\n })();\n }, [access]);\n\n const handleLock = useCallback(async () => {\n setSettingsOpen(false);\n setScanning(false);\n try {\n await lockApp();\n } catch {\n /* ignore */\n }\n setTracking(\"\");\n setResult(null);\n setAccess(\"locked\");\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Vérification d'un tracking (QR ou saisie manuelle) */\n /* ---------------------------------------------------------------- */\n\n const handleTracking = useCallback(\n async (value: string) => {\n const clean = value.trim().toUpperCase();\n if (!clean) return;\n\n setTracking(clean);\n setResult(null);\n showStatus(\"Vérification du tracking…\", \"busy\");\n\n try {\n const response = await validateTracking(clean);\n\n if (!response.ok) {\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n showStatus(\n messageForCode(response.code),\n toneForCode(response.code),\n response.debug ? `Réponse OM Express : ${response.debug}` : \"\",\n );\n resume(900);\n return;\n }\n\n setResult(response);\n\n if (response.ready && isReturnReadyStatus(response.statusRaw)) {\n // Colis éligible : le scanner reste EN PAUSE, VALIDER LE RETOUR s'affiche.\n showStatus(\n scanMode === \"returns_ready\"\n ? \"RETOUR PRÊT À VALIDER\"\n : `Tracking trouvé dans OM Express — ${statusLabel(response.statusRaw)}`,\n \"ok\",\n );\n return;\n }\n\n showStatus(\n scanMode === \"returns_ready\"\n ? `RETOUR NON PRÊT — ${statusLabel(response.statusRaw)}`\n : response.alreadyValidated\n ? `Retour déjà validé dans OM Express — ${statusLabel(response.statusRaw)}`\n : `Tracking trouvé — statut « ${statusLabel(response.statusRaw)} » : validation impossible.`,\n \"warn\",\n );\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — vérifie ta connexion.\", \"error\");\n resume(900);\n }\n },\n [resume, showStatus, scanMode],\n );\n\n const handleManualSubmit = useCallback(\n (value: string) => {\n // La caméra n'est PAS fermée : simple pause logique du scanner.\n setScanning(false);\n void handleTracking(value);\n },\n [handleTracking],\n );\n\n /* ---------------------------------------------------------------- */\n /* Mode RETOURS PRÊTS — réutilise le scanner existant, une caméra */\n /* ---------------------------------------------------------------- */\n\n // `resume()` relance le scanLoop existant : la caméra n'est jamais fermée.\n const startReturnsReadyScan = useCallback(() => {\n setScanMode(\"returns_ready\");\n resume(60);\n }, [resume]);\n\n const stopReturnsReadyScan = useCallback(() => {\n setScanMode(\"normal\");\n resume(60);\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Liste RETOURS PRÊTS (chargée côté serveur) */\n /* ---------------------------------------------------------------- */\n\n const loadReadyReturns = useCallback(async () => {\n setReadyState((previous) => ({ ...previous, loading: true, error: \"\" }));\n try {\n const data = await fetchReadyReturns();\n if (!data.ok) {\n if (data.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n setReadyState({\n loaded: true,\n loading: false,\n items: [],\n source: \"\",\n error: messageForCode(data.code ?? \"\"),\n diagnostics: [],\n });\n return;\n }\n setReadyState({\n loaded: true,\n loading: false,\n items: data.items ?? [],\n source: data.source ?? \"\",\n error: \"\",\n diagnostics: data.diagnostics ?? [],\n });\n } catch {\n setReadyState({\n loaded: true,\n loading: false,\n items: [],\n source: \"\",\n error: \"Erreur réseau — liste indisponible.\",\n diagnostics: [],\n });\n }\n }, []);\n\n const handleSelectReady = useCallback((item: ReadyReturn) => {\n // Pause logique du scanner : la caméra reste ouverte.\n setScanning(false);\n setTracking(item.tracking);\n setSelected(item);\n }, []);\n\n const handleCloseDetail = useCallback(() => {\n setSelected(null);\n resume(60);\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Validation officielle du retour */\n /* ---------------------------------------------------------------- */\n\n const handleValidateReturn = useCallback(async () => {\n if (validatingRef.current) return;\n const current = trackingRef.current;\n if (!current) return;\n\n validatingRef.current = true;\n setValidating(true);\n showStatus(\"Validation du retour dans OM Express…\", \"busy\");\n\n try {\n const response = await validateReturn(current);\n\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n\n if (response.ok && response.confirmed) {\n showStatus(\"Retour validé avec succès dans OM Express.\", \"ok\");\n vibrate([100, 50, 160]);\n setHistory((previous) =>\n [current, ...previous.filter((item) => item !== current)].slice(0, HISTORY_LIMIT)\n );\n setManualValue(\"\");\n setTracking(\"\");\n setResult(null);\n resume(700);\n return;\n }\n\n if (response.ok && response.code === \"RETURN_ACCEPTED_UNCONFIRMED\") {\n showStatus(\"Requête reçue par OM Express, mais validation non confirmée.\", \"warn\");\n resume(900);\n return;\n }\n\n showStatus(messageForCode(response.code), toneForCode(response.code));\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — validation non confirmée.\", \"error\");\n resume(900);\n } finally {\n validatingRef.current = false;\n setValidating(false);\n }\n }, [resume, showStatus]);\n\n /** Validation depuis la fiche retour : même route, même vérification serveur. */\n const handleValidateFromDetail = useCallback(async () => {\n await handleValidateReturn();\n setSelected(null);\n void loadReadyReturns();\n }, [handleValidateReturn, loadReadyReturns]);\n\n /* ---------------------------------------------------------------- */\n /* Rendu */\n /* ---------------------------------------------------------------- */\n\n if (access === \"loading\") {\n return (\n

Chargement…

\n );\n }\n\n if (access === \"setup\" || access === \"locked\") {\n return (\n setAccess(\"open\")}\n />\n );\n }\n\n const ready = !!result && result.ok && result.ready && isReturnReadyStatus(result.statusRaw);\n const frameTone: FrameTone = tone === \"error\" ? \"error\" : ready ? \"ok\" : \"neutral\";\n\n return (\n

\n \n SAMI.TECH\n \n Retours Ecotrack\n

\n setSettingsOpen(true)}\n >\n ⚙\n \n

\n\n \n\n

\n setScanning(true)}\n onTracking={handleTracking}\n onStatus={(text, nextTone) => showStatus(text, nextTone ?? \"busy\")}\n />\n

\n\n \n\n \n\n {ready ? (\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n ) : null}\n\n \n\n \n\n setSettingsOpen(false)}\n onSaved={setApiSaved}\n onLock={handleLock}\n />\n\n \n

\n );\n}",[],[154,284,350],"394fa985-734a-48a4-ba83-cef32342d0d9",["D",1789511238063],[180,181,182,183,184,185,186,187,188,189],[154,284],["D",1789511212578],[179,190,193,194,195],[154],"807e9071-57ff-4bb5-bd69-bacc7a8fea99","ecotrack.ts","76780022-b154-11f1-ac17-1607ee4eb77e",["D",1789514201578],"/**\n * Client de l'API Ecotrack / OM Express.\n *\n * Règles absolues :\n * - le token reste côté serveur (jamais renvoyé au frontend, jamais loggé) ;\n * - lecture d'un colis : GET /api/v1/get/orders?tracking=...\n * - validation retour : POST /api/v1/valid/returns { trackings: [ ... ] }\n * - routes interdites : /retours/recu/validated et /api/v1/valid/order\n */\nimport { deleteSetting, getSetting, setSetting } from \"./db.ts\";\nimport { extractStatusValue, isReturnReadyStatus, normalizeStatus } from \"../shared/status.ts\";\n\nconst CREDENTIALS_KEY = \"ecotrack_api_credentials\";\nconst API_BASE = \"https://omexpress.ecotrack.dz/api/v1\";\n\nexport type EcotrackCredentials = { apiToken: string };\n\nexport type OrderLookup =\n | {\n kind: \"found\";\n tracking: string;\n statusRaw: string;\n status: string;\n order: Record;\n }\n | { kind: \"not_found\"; payloadKeys: string[] }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nexport type MutationResult =\n | { kind: \"success\" }\n | { kind: \"fail\" }\n | { kind: \"invalid\"; message: string; status: number }\n | { kind: \"api_error\"; status: number }\n | { kind: \"network_error\" }\n | { kind: \"unexpected\"; status: number };\n\n/* ------------------------------------------------------------------ */\n/* Credentials (stockés côté serveur, en base) */\n/* ------------------------------------------------------------------ */\n\nexport async function getCredentials(): Promise {\n const raw = await getSetting(CREDENTIALS_KEY);\n if (!raw) return null;\n try {\n const parsed = JSON.parse(raw) as { apiToken?: unknown };\n const apiToken = typeof parsed.apiToken === \"string\" ? parsed.apiToken.trim() : \"\";\n return apiToken ? { apiToken } : null;\n } catch {\n return null;\n }\n}\n\nexport async function saveCredentials(apiToken: string): Promise {\n await setSetting(CREDENTIALS_KEY, JSON.stringify({ apiToken: apiToken.trim() }));\n}\n\nexport async function deleteCredentials(): Promise {\n await deleteSetting(CREDENTIALS_KEY);\n}\n\n/* ------------------------------------------------------------------ */\n/* Appels HTTP */\n/* ------------------------------------------------------------------ */\n\nasync function ecotrackFetch(\n path: string,\n apiToken: string,\n init: { method: \"GET\" | \"POST\"; body?: string; contentType?: string } = { method: \"GET\" },\n): Promise {\n const headers = new Headers();\n headers.set(\"Accept\", \"application/json\");\n headers.set(\"Authorization\", `Bearer ${apiToken}`);\n if (init.contentType) headers.set(\"Content-Type\", init.contentType);\n // Le token peut aussi être transmis côté serveur via `api_token`.\n const separator = path.includes(\"?\") ? \"&\" : \"?\";\n const url = `${API_BASE}${path}${separator}api_token=${encodeURIComponent(apiToken)}`;\n return await fetch(url, { method: init.method, headers, body: init.body });\n}\n\n/** Vérifie la validité du token auprès d'Ecotrack. */\nexport async function validateToken(apiToken: string): Promise<{ ok: boolean; status: number }> {\n try {\n const response = await ecotrackFetch(\"/validate/token\", apiToken);\n return { ok: response.ok, status: response.status };\n } catch {\n return { ok: false, status: 0 };\n }\n}\n\n/* ------------------------------------------------------------------ */\n/* Lecture d'un colis */\n/* ------------------------------------------------------------------ */\n\nfunction asRecord(value: unknown): Record | null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record)\n : null;\n}\n\n/** Clés d'enveloppe possibles autour de la liste de commandes. */\nconst ORDER_KEYS = [\"data\", \"orders\", \"results\", \"items\", \"colis\", \"order\", \"livraisons\", \"rows\"];\n\n/** Clés possibles du numéro de tracking dans une commande. */\nconst TRACKING_KEYS = [\n \"tracking\",\n \"tracking_number\",\n \"trackingNumber\",\n \"code\",\n \"numero\",\n \"num\",\n \"barcode\",\n \"code_barre\",\n \"codebarre\",\n \"code_suivi\",\n \"reference\",\n];\n\nfunction asOrderList(value: unknown): Record[] {\n if (!Array.isArray(value)) return [];\n return value.map(asRecord).filter((item): item is Record => item !== null);\n}\n\nfunction orderTracking(order: Record): string {\n for (const key of TRACKING_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim().toUpperCase();\n if (typeof value === \"number\") return String(value).toUpperCase();\n }\n return \"\";\n}\n\n/** Cherche la liste de commandes même si la réponse est imbriquée sur plusieurs niveaux. */\nfunction collectOrders(payload: unknown, depth = 0): Record[] {\n if (depth > 3) return [];\n\n const list = asOrderList(payload);\n if (list.length > 0) return list;\n\n const root = asRecord(payload);\n if (!root) return [];\n\n // L'objet est déjà une commande (il porte un statut ou un tracking).\n if (extractStatusValue(root) !== \"\" || orderTracking(root) !== \"\") return [root];\n\n for (const key of ORDER_KEYS) {\n const nested = root[key];\n if (Array.isArray(nested)) return asOrderList(nested);\n if (nested && typeof nested === \"object\") {\n const deeper = collectOrders(nested, depth + 1);\n if (deeper.length > 0) return deeper;\n }\n }\n\n // Aucune enveloppe connue : si l'objet est riche, on le traite comme la commande.\n const hasEnvelope = ORDER_KEYS.some((key) => key in root);\n if (!hasEnvelope && Object.keys(root).length >= 3) return [root];\n return [];\n}\n\n/** Noms des clés de premier niveau — diagnostic uniquement, aucune valeur exposée. */\nfunction topLevelKeys(payload: unknown): string[] {\n const root = asRecord(payload);\n if (root) return Object.keys(root).slice(0, 12);\n if (Array.isArray(payload)) return [`[array:${payload.length}]`];\n return [];\n}\n\nfunction pickOrder(payload: unknown, tracking: string): Record | null {\n const orders = collectOrders(payload);\n if (orders.length === 0) return null;\n\n const wanted = tracking.trim().toUpperCase();\n const exact = orders.find((order) => orderTracking(order) === wanted);\n if (exact) return exact;\n\n const withStatus = orders.find((order) => extractStatusValue(order) !== \"\");\n if (withStatus) return withStatus;\n\n // Une seule commande renvoyée pour cette requête : on l'accepte telle quelle.\n return orders.length === 1 ? orders[0] : null;\n}\n\ntype ReadResult =\n | { kind: \"ok\"; payload: unknown }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nasync function readOrders(apiToken: string, query: string): Promise {\n const path = query ? `/get/orders?${query}` : \"/get/orders\";\n let response: Response;\n try {\n response = await ecotrackFetch(path, apiToken);\n } catch {\n return { kind: \"network_error\" };\n }\n if (!response.ok) return { kind: \"read_error\", status: response.status };\n try {\n return { kind: \"ok\", payload: await response.json() };\n } catch {\n return { kind: \"bad_response\" };\n }\n}\n\n/**\n * Relit un colis et retourne son statut normalisé.\n * Deux variantes de paramètre sont tentées (`tracking` puis `trackings`) :\n * ce sont des lectures, jamais des mutations.\n */\nexport async function findOrder(apiToken: string, tracking: string): Promise {\n const encoded = encodeURIComponent(tracking);\n const queries = [`tracking=${encoded}`, `trackings=${encoded}`];\n let lastPayload: unknown = null;\n let lastErrorStatus: number | null = null;\n let sawSuccess = false;\n\n for (const query of queries) {\n const read = await readOrders(apiToken, query);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") {\n if (read.status >= 500) return { kind: \"read_error\", status: read.status };\n lastErrorStatus = read.status;\n continue;\n }\n\n sawSuccess = true;\n const order = pickOrder(read.payload, tracking);\n if (order) {\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n }\n lastPayload = read.payload;\n }\n\n if (!sawSuccess) return { kind: \"read_error\", status: lastErrorStatus ?? 0 };\n return { kind: \"not_found\", payloadKeys: topLevelKeys(lastPayload) };\n}\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour (mutation) */\n/* ------------------------------------------------------------------ */\n\nfunction extractMessage(text: string): string {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.message === \"string\") return parsed.message;\n if (typeof parsed.error === \"string\") return parsed.error;\n } catch {\n /* corps non JSON */\n }\n return \"\";\n}\n\n/**\n * POST /api/v1/valid/returns — endpoint officiel de validation d'un retour.\n * Ne jamais appeler cette fonction sans avoir revérifié l'éligibilité côté serveur.\n */\nexport async function mutateReturn(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(\"/valid/returns\", apiToken, {\n method: \"POST\",\n contentType: \"application/json\",\n body: JSON.stringify({ trackings: [tracking] }),\n });\n } catch {\n return { kind: \"network_error\" };\n }\n\n const text = await response.text().catch(() => \"\");\n const emptyBody = text.trim() === \"\";\n let returned: string | null = null;\n if (!emptyBody) {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.returned === \"string\") returned = parsed.returned;\n } catch {\n /* corps non JSON */\n }\n }\n\n // Télémétrie sûre uniquement : jamais de token, jamais de body brut.\n console.log(\n JSON.stringify({\n evt: \"return_validate\",\n httpStatus: response.status,\n returned,\n emptyBody,\n }),\n );\n\n if (response.status === 422) {\n return { kind: \"invalid\", message: extractMessage(text), status: response.status };\n }\n if (!response.ok) return { kind: \"api_error\", status: response.status };\n if (returned === \"success\") return { kind: \"success\" };\n if (returned === \"fail\") return { kind: \"fail\" };\n return { kind: \"unexpected\", status: response.status };\n}/* ------------------------------------------------------------------ */\n/* Liste des retours prêts */\n/* */\n/* L'API officielle n'expose que la recherche PAR TRACKING */\n/* (`GET /api/v1/get/orders?tracking=…`). Aucun endpoint de liste par */\n/* statut n'est documenté : on tente donc d'abord quelques variantes de */\n/* lecture seule, puis on retombe sur la relecture individuelle des */\n/* trackings connus (registre SQLite) avec filtrage côté backend. */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyListResult = {\n /** `ecotrack_list` = liste obtenue de l'API ; `local_registry` = relecture individuelle. */\n source: \"ecotrack_list\" | \"local_registry\";\n items: ReadyReturn[];\n /** Nombre d'entrées examinées côté serveur. */\n scanned: number;\n /** Trace des tentatives (statuts HTTP, nombres) — jamais de token ni de valeur sensible. */\n diagnostics: string[];\n};\n\n/**\n * Variantes de lecture seule tentées pour découvrir un éventuel mode « liste ».\n * Aucune n'est documentée : elles sont essayées dans l'ordre et la première qui\n * renvoie des colis est retenue. Le détail des réponses est remonté au frontend\n * dans `diagnostics`.\n */\nconst LIST_QUERIES = [\n \"per_page=100&page=1\",\n \"page=1\",\n \"per_page=100\",\n \"limit=100\",\n \"status=retour_recu\",\n \"status_name=retour_recu\",\n \"etat=retour_recu\",\n \"statut=retour_recu\",\n \"statuses[]=retour_recu\",\n \"filter[status]=retour_recu\",\n \"with=status&per_page=100\",\n \"\",\n];\n\nconst MAX_ITEMS = 100;\n\n/**\n * Nombre maximum de pages relues quand un mode « liste » est trouvé.\n * 20 pages × 40 colis ≈ 800 colis : assez pour atteindre des retours anciens\n * si la liste est triée du plus récent au plus ancien.\n */\nconst MAX_PAGES = 20;\n\n/**\n * Filtres de statut testés en priorité. S'ils sont appliqués par l'API, c'est\n * la voie la plus rapide et la plus fiable : une seule requête suffit.\n */\nconst STATUS_PROBES = [\n \"status=retour_recu\",\n \"status=livraison_echoue_recu\",\n \"global_status=retour_recu\",\n \"global_status=livraison_echoue_recu\",\n];\n\n/** Clés dont le nom évoque un statut ou un état de retour (diagnostic uniquement). */\nconst STATUS_HINT = /status|statut|etat|state|libelle|situation|retour|return|transfer/i;\n\n/**\n * Décrit les champs de statut réellement présents dans les colis renvoyés :\n * nom du champ + valeurs distinctes avec leur fréquence.\n * Aucune donnée personnelle (client, téléphone, adresse) n'est incluse.\n */\nfunction describeStatusFields(orders: Record[]): string {\n const buckets = new Map>();\n\n for (const order of orders) {\n for (const [key, value] of Object.entries(order)) {\n if (!STATUS_HINT.test(key)) continue;\n const raw = value === null || value === undefined\n ? \"\"\n : typeof value === \"object\"\n ? \"(objet)\"\n : String(value).trim();\n const text = raw === \"\" ? \"(vide)\" : raw;\n if (text.length > 40) continue;\n if (!buckets.has(key)) buckets.set(key, new Map());\n const bucket = buckets.get(key) as Map;\n bucket.set(text, (bucket.get(text) ?? 0) + 1);\n }\n }\n\n if (buckets.size === 0) return \"aucun champ de statut détecté\";\n\n const parts: string[] = [];\n for (const [key, bucket] of buckets) {\n const values = Array.from(bucket.entries())\n .sort((a, b) => b[1] - a[1])\n .slice(0, 10)\n .map(([value, count]) => `${value}×${count}`)\n .join(\", \");\n parts.push(`${key} = ${values}`);\n }\n return parts.join(\" | \");\n}\n\n/** Complète la première page par les suivantes (lecture seule, plafonnée). */\nasync function collectPages(\n apiToken: string,\n query: string,\n first: Record[],\n diagnostics: string[],\n): Promise[]> {\n const all = [...first];\n if (!/(^|&)page=/.test(query)) return all;\n\n for (let page = 2; page <= MAX_PAGES; page++) {\n const next = query.replace(/(^|&)page=\\d+/, `$1page=${page}`);\n const read = await readOrders(apiToken, next);\n\n if (read.kind === \"network_error\" || read.kind === \"bad_response\") {\n diagnostics.push(`page ${page} → ${read.kind === \"network_error\" ? \"réseau\" : \"corps illisible\"}`);\n break;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`page ${page} → HTTP ${read.status}`);\n break;\n }\n\n const orders = collectOrders(read.payload);\n if (orders.length === 0) {\n diagnostics.push(`page ${page} → vide`);\n break;\n }\n all.push(...orders);\n diagnostics.push(`page ${page} → ${orders.length} colis`);\n if (page === MAX_PAGES) {\n diagnostics.push(\n `limite de ${MAX_PAGES} pages atteinte — des colis plus anciens peuvent manquer`,\n );\n }\n }\n\n return all;\n}\n\n/** Lecture d'un seul colis, sans variante de repli (latence maîtrisée). */\nasync function readOneOrder(apiToken: string, tracking: string): Promise {\n const read = await readOrders(apiToken, `tracking=${encodeURIComponent(tracking)}`);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") return { kind: \"read_error\", status: read.status };\n\n const order = pickOrder(read.payload, tracking);\n if (!order) return { kind: \"not_found\", payloadKeys: topLevelKeys(read.payload) };\n\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n}\n\nfunction toReadyReturn(tracking: string, statusRaw: string): ReadyReturn {\n return {\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n };\n}\n\n/**\n * Retours actuellement prêts (statut normalisé `retour_recu` ou\n * `livraison_echoue_recu`). Lecture seule uniquement : aucune mutation.\n */\nexport async function listReadyReturns(\n apiToken: string,\n registry: { tracking: string; lastStatus: string }[],\n): Promise {\n const diagnostics: string[] = [];\n\n // 1) Filtres de statut : si l'API les applique, réponse en une requête.\n for (const probe of STATUS_PROBES) {\n const query = `${probe}&per_page=100&page=1`;\n const read = await readOrders(apiToken, query);\n\n if (read.kind === \"network_error\") {\n diagnostics.push(`${query} → réseau`);\n continue;\n }\n if (read.kind === \"bad_response\") {\n diagnostics.push(`${query} → corps illisible`);\n continue;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`${query} → HTTP ${read.status}`);\n continue;\n }\n\n const orders = collectOrders(read.payload);\n const ready = orders\n .map((order) => ({ tracking: orderTracking(order), statusRaw: extractStatusValue(order) }))\n .filter((entry) => entry.tracking !== \"\" && isReturnReadyStatus(entry.statusRaw))\n .map((entry) => toReadyReturn(entry.tracking, entry.statusRaw));\n\n diagnostics.push(`${query} → 200, ${orders.length} colis, ${ready.length} prêt(s)`);\n if (ready.length > 0) {\n return {\n source: \"ecotrack_list\",\n items: dedupe(ready).slice(0, MAX_ITEMS),\n scanned: orders.length,\n diagnostics,\n };\n }\n }\n\n // 2) Mode « liste » général, puis pagination complète.\n for (const query of LIST_QUERIES) {\n const label = query === \"\" ? \"(sans paramètre)\" : query;\n const read = await readOrders(apiToken, query);\n\n if (read.kind === \"network_error\") {\n diagnostics.push(`${label} → réseau`);\n continue;\n }\n if (read.kind === \"bad_response\") {\n diagnostics.push(`${label} → corps illisible`);\n continue;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`${label} → HTTP ${read.status}`);\n continue;\n }\n\n const firstPage = collectOrders(read.payload);\n if (firstPage.length === 0) {\n const keys = topLevelKeys(read.payload).join(\", \") || \"—\";\n diagnostics.push(`${label} → 200, 0 colis (clés: ${keys})`);\n continue;\n }\n\n diagnostics.push(`${label} → 200, ${firstPage.length} colis`);\n const orders = await collectPages(apiToken, query, firstPage, diagnostics);\n\n diagnostics.push(`champs: ${Object.keys(orders[0]).slice(0, 40).join(\", \")}`);\n diagnostics.push(`statuts détectés: ${describeStatusFields(orders)}`);\n\n const ready = orders\n .map((order) => ({ tracking: orderTracking(order), statusRaw: extractStatusValue(order) }))\n .filter((entry) => entry.tracking !== \"\" && isReturnReadyStatus(entry.statusRaw))\n .map((entry) => toReadyReturn(entry.tracking, entry.statusRaw));\n\n diagnostics.push(`→ ${orders.length} colis relus, ${ready.length} prêt(s)`);\n return {\n source: \"ecotrack_list\",\n items: dedupe(ready).slice(0, MAX_ITEMS),\n scanned: orders.length,\n diagnostics,\n };\n }\n\n // 3) Repli : relecture individuelle des trackings connus, filtrage backend.\n const items: ReadyReturn[] = [];\n for (const entry of registry) {\n const lookup = await readOneOrder(apiToken, entry.tracking);\n if (lookup.kind !== \"found\") continue;\n if (!isReturnReadyStatus(lookup.statusRaw)) continue;\n items.push(toReadyReturn(lookup.tracking, lookup.statusRaw));\n }\n diagnostics.push(\n `registre local → ${registry.length} tracking(s) relu(s), ${items.length} prêt(s)`,\n );\n return { source: \"local_registry\", items: dedupe(items).slice(0, MAX_ITEMS), scanned: registry.length, diagnostics };\n}\n\nfunction dedupe(items: ReadyReturn[]): ReadyReturn[] {\n const seen = new Set();\n const result: ReadyReturn[] = [];\n for (const item of items) {\n if (seen.has(item.tracking)) continue;\n seen.add(item.tracking);\n result.push(item);\n }\n return result;\n}",[],[160,366],"0b1e17d8-2f63-49de-9348-e0fefc13be5c","db.ts","6bda7e38-b154-11f1-91d7-1607ee4eb77e",47,["D",1789513419610],"/**\n * Accès SQLite (base projet, isolée des autres applications SAMI.TECH).\n *\n * Tables :\n * app_settings (key, value) -> schéma 3x3 + credentials Ecotrack\n * app_sessions (token_hash, expires_at, created_at) -> sessions du cookie sami_access\n * idx_app_sessions_expires -> purge / lookup rapide\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nlet schemaReady: Promise | null = null;\n\n/** Crée les tables et l'index si nécessaire. Idempotent, exécuté une seule fois. */\nexport function ensureSchema(): Promise {\n if (!schemaReady) {\n schemaReady = sqlite\n .batch([\n `CREATE TABLE IF NOT EXISTS app_settings (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_sessions (\n token_hash TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_app_sessions_expires ON app_sessions (expires_at)`,\n `CREATE TABLE IF NOT EXISTS seen_trackings (\n tracking TEXT PRIMARY KEY,\n first_seen_at INTEGER NOT NULL,\n last_seen_at INTEGER NOT NULL,\n last_status TEXT NOT NULL DEFAULT ''\n )`,\n `CREATE INDEX IF NOT EXISTS idx_seen_trackings_last_seen ON seen_trackings (last_seen_at)`,\n ])\n .then(() => undefined)\n .catch((error) => {\n schemaReady = null;\n throw error;\n });\n }\n return schemaReady;\n}\n\n/** Lit une valeur de configuration. */\nexport async function getSetting(key: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT value FROM app_settings WHERE key = ?\",\n args: [key],\n });\n const row = result.rows[0] as unknown as { value?: string } | undefined;\n return row?.value ?? null;\n}\n\n/** Écrit (ou remplace) une valeur de configuration. */\nexport async function setSetting(key: string, value: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `INSERT INTO app_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, value],\n });\n}\n\n/** Supprime une valeur de configuration. */\nexport async function deleteSetting(key: string): Promise {\n await ensureSchema();\n await sqlite.execute({ sql: \"DELETE FROM app_settings WHERE key = ?\", args: [key] });\n}/* ------------------------------------------------------------------ */\n/* Registre des trackings déjà vus */\n/* */\n/* L'API Ecotrack n'expose pas de recherche par statut : on ne peut */\n/* relire un colis que par son numéro de tracking. Ce registre local */\n/* (SQLite) conserve les trackings déjà vérifiés par l'application afin */\n/* de pouvoir les relire côté serveur et filtrer ceux qui sont prêts. */\n/* ------------------------------------------------------------------ */\n\nconst REGISTRY_TTL_MS = 120 * 24 * 60 * 60 * 1000; // 120 jours\n\n/** Mémorise (ou met à jour) un tracking vérifié avec succès. */\nexport async function rememberTracking(tracking: string, status: string): Promise {\n const clean = tracking.trim().toUpperCase();\n if (!clean) return;\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({\n sql: `INSERT INTO seen_trackings (tracking, first_seen_at, last_seen_at, last_status)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(tracking) DO UPDATE SET\n last_seen_at = excluded.last_seen_at,\n last_status = excluded.last_status`,\n args: [clean, now, now, status ?? \"\"],\n });\n}\n\n/** Trackings connus les plus récents (les plus anciens sont purgés). */\nexport async function listRecentTrackings(\n limit: number,\n): Promise<{ tracking: string; lastStatus: string }[]> {\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM seen_trackings WHERE last_seen_at < ?\",\n args: [Date.now() - REGISTRY_TTL_MS],\n });\n const result = await sqlite.execute({\n sql: \"SELECT tracking, last_status FROM seen_trackings ORDER BY last_seen_at DESC LIMIT ?\",\n args: [limit],\n });\n return (result.rows as unknown as { tracking: string; last_status: string }[]).map((row) => ({\n tracking: row.tracking,\n lastStatus: row.last_status ?? \"\",\n }));\n}",[],[160,373],"45232bfa-011c-48a2-9b91-3626695b9180","access.ts","7673ba6c-b154-11f1-ac17-1607ee4eb77e",["D",1789511174778],"/**\n * Verrouillage de l'application par schéma Android 3x3 + sessions.\n *\n * - Le schéma est stocké sous forme de hash PBKDF2-SHA256 salé (jamais en clair).\n * - Les sessions vivent en base (app_sessions) et sont portées par le cookie\n * `sami_access` (HttpOnly, Secure, ~12 h). Le cookie ne contient qu'un token\n * aléatoire : seul son SHA-256 est stocké.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSchema, getSetting, setSetting } from \"./db.ts\";\n\nconst PATTERN_KEY = \"access_pattern_hash\";\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // ~12 heures\nconst PBKDF2_ITERATIONS = 100_000;\nconst encoder = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(byteLength: number): string {\n const buffer = new Uint8Array(byteLength);\n crypto.getRandomValues(buffer);\n return toHex(buffer);\n}\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return toHex(new Uint8Array(digest));\n}\n\nasync function pbkdf2Hex(secret: string, salt: string, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt: encoder.encode(salt), iterations },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** Vrai si un schéma a déjà été configuré. */\nexport async function isPatternConfigured(): Promise {\n return (await getSetting(PATTERN_KEY)) !== null;\n}\n\n/** Enregistre un nouveau schéma et invalide toutes les sessions existantes. */\nexport async function setPattern(pattern: string): Promise {\n const salt = randomHex(16);\n const hash = await pbkdf2Hex(pattern, salt, PBKDF2_ITERATIONS);\n await setSetting(PATTERN_KEY, `pbkdf2$${PBKDF2_ITERATIONS}$${salt}$${hash}`);\n await deleteAllSessions();\n}\n\n/** Vérifie un schéma saisi contre le hash stocké. */\nexport async function verifyPattern(pattern: string): Promise {\n const stored = await getSetting(PATTERN_KEY);\n if (!stored) return false;\n const [scheme, iterationsRaw, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterationsRaw || !salt || !hash) return false;\n const candidate = await pbkdf2Hex(pattern, salt, Number(iterationsRaw));\n return timingSafeEqual(candidate, hash);\n}\n\n/** Crée une session et retourne le token à poser en cookie. */\nexport async function createSession(): Promise<{ token: string; maxAge: number }> {\n await ensureSchema();\n const token = randomHex(32);\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, now + SESSION_TTL_MS, now],\n });\n return { token, maxAge: Math.floor(SESSION_TTL_MS / 1000) };\n}\n\n/** Vrai si la requête porte une session valide et non expirée. */\nexport async function hasValidSession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return false;\n await ensureSchema();\n const tokenHash = await sha256Hex(token);\n const result = await sqlite.execute({\n sql: \"SELECT expires_at FROM app_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n const row = result.rows[0] as unknown as { expires_at?: number } | undefined;\n if (!row) return false;\n if (Number(row.expires_at) < Date.now()) {\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n return false;\n }\n return true;\n}\n\n/** Invalide la session portée par la requête. */\nexport async function destroySession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return;\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM app_sessions WHERE token_hash = ?\",\n args: [await sha256Hex(token)],\n });\n}\n\n/** Invalide toutes les sessions (purge à la reconfiguration du schéma). */\nexport async function deleteAllSessions(): Promise {\n await ensureSchema();\n await sqlite.execute(\"DELETE FROM app_sessions\");\n}\n\n/** Garde-fou : retourne une réponse 401 si la session est absente, sinon null. */\nexport async function requireSession(request: Request): Promise {\n if (await hasValidSession(request)) return null;\n return Response.json({ ok: false, code: \"UNAUTHORIZED\" }, { status: 401 });\n}\n\nexport function sessionCookieHeader(token: string, maxAge: number): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearCookieHeader(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n const header = request.headers.get(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) return part.slice(index + 1).trim();\n }\n return null;\n}",[],[160,381],["D",1789511156996],[175,176,177],[160],["D",1789511143425],["D",1789609258211],{"_11":12,"_92":88},{"_11":12,"_85":86,"_87":88,"_45":46,"_89":90,"_91":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_80":-5,"_81":-5,"_82":-5,"_83":14,"_84":12},"ctx",{"_73":-5,"_114":428,"_429":430,"_431":432,"_433":38,"_434":38,"_435":38,"_436":50,"_437":-5,"_438":-7,"_439":-7,"_440":54,"_441":38,"_442":38,"_443":-5,"_444":38,"_445":38,"_446":38,"_447":-5},"ENV",{"_399":400,"_401":402,"_403":26,"_404":405,"_406":407,"_408":409,"_410":411,"_412":413,"_414":415,"_416":417,"_418":419,"_420":421,"_422":423,"_424":425,"_426":427},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1