SAMI.TECH — Retours Ecotrack

\n \n \n",[19,71],"65e863f5-391b-4fbd-8ced-e27e780f2903","lib","07620b9a-84bf-4cea-b8dd-75e58750fcbc",9,["D",1789511212692],"directory",[19,78],"394fa985-734a-48a4-ba83-cef32342d0d9","components","34a6d1f5-1d62-4377-8a82-c7eaa0426cae",11,["D",1789511238063],[19,85],"d059b4c5-52dc-4b09-b505-15182f5cefe4",["D",1789511212578],[19],{"_38":274,"_13":275,"_41":276,"_43":-5,"_45":46,"_47":222,"_49":50,"_51":277,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":278,"_18":279},{"_38":90,"_13":19,"_41":44,"_43":-5,"_45":46,"_47":73,"_49":50,"_51":142,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":143,"_18":144},{"_38":117,"_13":118,"_41":119,"_43":-5,"_45":46,"_47":120,"_49":50,"_51":121,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":122,"_18":123},{"_38":109,"_13":110,"_41":111,"_43":-5,"_45":46,"_47":112,"_49":50,"_51":113,"_17":66,"_54":24,"_55":114,"_57":58,"_59":-5,"_106":115,"_18":116},{"_38":98,"_13":99,"_41":100,"_43":-5,"_45":46,"_47":101,"_49":50,"_51":102,"_17":103,"_54":104,"_55":105,"_57":58,"_59":-5,"_106":107,"_18":108},"55b7b067-ac39-40cb-8bec-42f264993253","index.ts","7d7be91a-b154-11f1-ac17-1607ee4eb77e",53,["D",1789513429320],6,"http","/**\n * SAMI.TECH — Retours Ecotrack\n * Backend HTTP (Hono) : verrouillage schéma 3x3, configuration Ecotrack,\n * vérification de tracking et validation officielle des retours.\n *\n * Projet totalement indépendant des autres applications SAMI.TECH :\n * aucune logique, aucun code, aucune base partagée.\n */\nimport { Hono } from \"npm:hono@4\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { ensureSchema, listRecentTrackings, rememberTracking } from \"./backend/db.ts\";\nimport {\n clearCookieHeader,\n createSession,\n destroySession,\n hasValidSession,\n isPatternConfigured,\n requireSession,\n sessionCookieHeader,\n setPattern,\n verifyPattern,\n} from \"./backend/access.ts\";\nimport {\n deleteCredentials,\n findOrder,\n getCredentials,\n listReadyReturns,\n mutateReturn,\n saveCredentials,\n} from \"./backend/ecotrack.ts\";\nimport { isReturnReadyStatus, isReturnValidatedStatus } from \"./shared/status.ts\";\nimport { extractTracking } from \"./shared/tracking.ts\";\n\nconst app = new Hono();\n\n/* ------------------------------------------------------------------ */\n/* Helpers */\n/* ------------------------------------------------------------------ */\n\nasync function readJson(request: Request): Promise | null> {\n try {\n const data = await request.json();\n return data && typeof data === \"object\" && !Array.isArray(data)\n ? (data as Record)\n : null;\n } catch {\n return null;\n }\n}\n\nfunction bodyString(body: Record | null, key: string): string {\n const value = body?.[key];\n return typeof value === \"string\" ? value : \"\";\n}\n\n/** Relecture du colis pour confirmer une validation ambiguë (jamais de 2e mutation). */\nasync function confirmValidated(apiToken: string, tracking: string): Promise {\n for (let attempt = 0; attempt < 3; attempt++) {\n await new Promise((resolve) => setTimeout(resolve, 1200));\n const lookup = await findOrder(apiToken, tracking);\n if (lookup.kind === \"found\" && isReturnValidatedStatus(lookup.statusRaw)) return true;\n }\n return false;\n}\n\n/* ------------------------------------------------------------------ */\n/* Santé */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/health\", (c) => c.json({ ok: true }));\n\n/* ------------------------------------------------------------------ */\n/* Accès (schéma 3x3) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/access/status\", async (c) => {\n const configured = await isPatternConfigured();\n const unlocked = configured ? await hasValidSession(c.req.raw) : false;\n return c.json({ ok: true, configured, unlocked });\n});\n\napp.post(\"/api/access/setup\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!/^\\d{4,9}$/.test(pattern)) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 400);\n }\n if (await isPatternConfigured()) {\n return c.json({ ok: false, code: \"ALREADY_CONFIGURED\" }, 409);\n }\n await setPattern(pattern);\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/unlock\", async (c) => {\n const pattern = bodyString(await readJson(c.req.raw), \"pattern\");\n if (!(await isPatternConfigured())) {\n return c.json({ ok: false, code: \"NOT_CONFIGURED\" }, 409);\n }\n if (!(await verifyPattern(pattern))) {\n return c.json({ ok: false, code: \"INVALID_PATTERN\" }, 401);\n }\n const session = await createSession();\n c.header(\"Set-Cookie\", sessionCookieHeader(session.token, session.maxAge));\n return c.json({ ok: true, unlocked: true });\n});\n\napp.post(\"/api/access/logout\", async (c) => {\n await destroySession(c.req.raw);\n c.header(\"Set-Cookie\", clearCookieHeader());\n return c.json({ ok: true });\n});\n\n/* ------------------------------------------------------------------ */\n/* Configuration */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/api/config\", async (c) => {\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.get(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const credentials = await getCredentials();\n return c.json({ ok: true, apiSaved: credentials !== null });\n});\n\napp.post(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n const apiToken = bodyString(await readJson(c.req.raw), \"apiToken\").trim();\n if (apiToken.length < 8) return c.json({ ok: false, code: \"INVALID_TOKEN\" }, 400);\n await saveCredentials(apiToken);\n return c.json({ ok: true, apiSaved: true });\n});\n\napp.delete(\"/api/ecotrack/settings\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n await deleteCredentials();\n return c.json({ ok: true, apiSaved: false });\n});\n\n/* ------------------------------------------------------------------ */\n/* Tracking */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n const lookup = await findOrder(credentials.apiToken, tracking);\n switch (lookup.kind) {\n case \"not_found\":\n return c.json(\n {\n ok: false,\n code: \"TRACKING_NOT_FOUND\",\n tracking,\n debug: lookup.payloadKeys.join(\", \"),\n },\n 404,\n );\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: lookup.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n\n // Mémorise le tracking (registre serveur) pour alimenter RETOURS PRÊTS.\n await rememberTracking(lookup.tracking, lookup.status);\n\n return c.json({\n ok: true,\n code: \"TRACKING_FOUND\",\n tracking: lookup.tracking,\n status: lookup.status,\n statusRaw: lookup.statusRaw,\n ready: isReturnReadyStatus(lookup.statusRaw),\n alreadyValidated: isReturnValidatedStatus(lookup.statusRaw),\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour */\n/* ------------------------------------------------------------------ */\n\napp.post(\"/api/return/validate\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const tracking = extractTracking(bodyString(await readJson(c.req.raw), \"tracking\"));\n if (!tracking) return c.json({ ok: false, code: \"INVALID_TRACKING\" }, 400);\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n // 1. Vérification serveur obligatoire AVANT toute mutation.\n const pre = await findOrder(credentials.apiToken, tracking);\n switch (pre.kind) {\n case \"not_found\":\n return c.json(\n {\n ok: false,\n code: \"TRACKING_NOT_FOUND\",\n tracking,\n debug: pre.payloadKeys.join(\", \"),\n },\n 404,\n );\n case \"read_error\":\n return c.json({ ok: false, code: \"ECOTRACK_READ_ERROR\", status: pre.status }, 502);\n case \"bad_response\":\n return c.json({ ok: false, code: \"ECOTRACK_BAD_RESPONSE\" }, 502);\n case \"network_error\":\n return c.json({ ok: false, code: \"ECOTRACK_NETWORK_ERROR\" }, 502);\n }\n if (!isReturnReadyStatus(pre.statusRaw)) {\n return c.json({ ok: false, code: \"RETURN_NOT_READY\", tracking, status: pre.status }, 409);\n }\n\n // 2. Mutation officielle : POST /api/v1/valid/returns\n const mutation = await mutateReturn(credentials.apiToken, tracking);\n switch (mutation.kind) {\n case \"network_error\":\n return c.json({ ok: false, code: \"RETURN_NETWORK_ERROR\", tracking }, 502);\n case \"api_error\":\n return c.json({ ok: false, code: \"RETURN_API_ERROR\", status: mutation.status, tracking }, 502);\n case \"invalid\":\n return c.json(\n { ok: false, code: \"RETURN_INVALID\", message: mutation.message, tracking },\n 422,\n );\n case \"fail\":\n return c.json({ ok: false, code: \"RETURN_NOT_ELIGIBLE\", tracking }, 409);\n case \"success\":\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n\n // 3. Réponse vide / inattendue : ne JAMAIS annoncer le succès sans confirmation.\n const confirmed = await confirmValidated(credentials.apiToken, tracking);\n if (confirmed) {\n return c.json({ ok: true, code: \"RETURN_VALIDATED\", tracking, confirmed: true });\n }\n return c.json({\n ok: true,\n code: \"RETURN_ACCEPTED_UNCONFIRMED\",\n tracking,\n confirmed: false,\n detail: \"Requête reçue par OM Express, validation non confirmée.\",\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Liste des retours prêts */\n/* */\n/* L'API Ecotrack n'expose pas de recherche par statut : cette route */\n/* tente d'abord un mode « liste » (lecture seule), puis retombe sur la */\n/* relecture des trackings connus, avec filtrage côté backend via */\n/* isReturnReadyStatus(). Aucune mutation ici. */\n/* ------------------------------------------------------------------ */\n\n/** Nombre maximum de trackings relus individuellement en mode repli. */\nconst REGISTRY_LIMIT = 15;\n\napp.get(\"/api/returns/ready\", async (c) => {\n const guard = await requireSession(c.req.raw);\n if (guard) return guard;\n\n const credentials = await getCredentials();\n if (!credentials) return c.json({ ok: false, code: \"API_NOT_CONFIGURED\" }, 409);\n\n const registry = await listRecentTrackings(REGISTRY_LIMIT);\n const result = await listReadyReturns(credentials.apiToken, registry);\n\n return c.json({\n ok: true,\n source: result.source,\n count: result.items.length,\n items: result.items,\n scanned: result.scanned,\n diagnostics: result.diagnostics,\n });\n});\n\n/* ------------------------------------------------------------------ */\n/* Frontend (assets statiques, transpilés par Val Town) */\n/* ------------------------------------------------------------------ */\n\napp.get(\"/\", (c) => serveFile(\"/frontend/index.html\", import.meta.url));\napp.get(\"/frontend/*\", (c) => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", (c) => serveFile(c.req.path, import.meta.url));\n\napp.notFound((c) => {\n if (c.req.path.startsWith(\"/api/\")) {\n return c.json({ ok: false, code: \"NOT_FOUND\" }, 404);\n }\n return c.text(\"Not found\", 404);\n});\n\n// Initialisation de la base au démarrage : ne doit jamais casser /health.\ntry {\n await ensureSchema();\n} catch (error) {\n console.error(\"schema init failed\", error instanceof Error ? error.message : error);\n}\n\nexport default app.fetch;","children",[],[99],"cb365bb7-4319-4c82-be9f-cd9af9c1c2f5","README.md","ba4dfe96-b154-11f1-bc07-1607ee4eb77e",19,["D",1789511288587],"# SAMI.TECH — Retours Ecotrack\n\nApplication mobile de scan de QR codes de colis retournés, avec vérification du statut dans\n**OM Express / Ecotrack** et validation officielle du retour.\n\nProjet **totalement indépendant** des autres applications SAMI.TECH : code, logique, base SQLite\net fonctions propres à ce val.\n\n## Principe\n\n1. Déverrouillage par **schéma Android 3×3** (hash PBKDF2-SHA256 salé, côté serveur).\n2. La **caméra arrière démarre automatiquement** après déverrouillage et **ne se ferme plus**.\n3. Le **scanner QR reste actif en continu** : QR détecté → pause logique → traitement → reprise.\n4. Le **backend** relit le colis dans Ecotrack et décide seul de l'éligibilité.\n5. La validation n'est proposée que pour `retour_recu` ou `livraison_echoue_recu`.\n\n## Niveaux de fiabilité (toujours distingués)\n\n| Niveau | Signification |\n| --- | --- |\n| 1 | QR détecté |\n| 2 | Tracking trouvé dans OM Express |\n| 3 | Tracking éligible au retour (`retour_recu` / `livraison_echoue_recu`) |\n| 4 | Retour réellement validé (`returned = \"success\"` ou confirmation après relecture) |\n\nUn QR détecté ne signifie **jamais** que le retour est validé.\n\n## Architecture\n\n```mermaid\ngraph TD\n A[index.ts — Hono] --> B[backend/access.ts — schéma 3x3 + sessions]\n A --> C[backend/ecotrack.ts — API OM Express]\n A --> D[backend/db.ts — SQLite projet]\n A --> E[shared/status.ts + shared/tracking.ts]\n A --> F[frontend/index.html + root.tsx]\n F --> G[components/App.tsx — machine à états]\n G --> H[PatternGate.tsx]\n G --> I[Scanner.tsx — BarcodeDetector + jsQR]\n G --> J[StatusPanel / ManualEntry / HistoryList / Settings]\n E --> I\n```\n\n## Routes\n\n| Méthode | Route | Rôle |\n| --- | --- | --- |\n| GET | `/health` | Santé (`{ \"ok\": true }`) |\n| GET | `/api/access/status` | Schéma configuré ? session ouverte ? |\n| POST | `/api/access/setup` | Créer le schéma (une seule fois) |\n| POST | `/api/access/unlock` | Déverrouiller (cookie `sami_access`, ~12 h) |\n| POST | `/api/access/logout` | Verrouiller |\n| GET | `/api/config` | `apiSaved` |\n| GET/POST/DELETE | `/api/ecotrack/settings` | Token API (jamais réaffiché) |\n| POST | `/api/validate` | Vérifier un tracking |\n| POST | `/api/return/validate` | Valider un retour (mutation) |\n\n## API Ecotrack utilisée\n\n- Vérification token : `GET /api/v1/validate/token`\n- Lecture colis : `GET /api/v1/get/orders?tracking=...`\n- **Validation retour : `POST /api/v1/valid/returns`** avec `{ \"trackings\": [\"...\"] }`\n\n### Routes interdites\n\n- `/retours/recu/validated` — dépendait d'une session web Ecotrack (HTTP 403).\n- `/api/v1/valid/order` — autre opération, ne remplace pas `/valid/returns`.\n\n## Codes métier backend\n\n`API_NOT_CONFIGURED`, `ECOTRACK_READ_ERROR`, `ECOTRACK_BAD_RESPONSE`, `TRACKING_NOT_FOUND`,\n`TRACKING_FOUND`, `ECOTRACK_NETWORK_ERROR`, `RETURN_NOT_READY`, `RETURN_INVALID`,\n`RETURN_API_ERROR`, `RETURN_NOT_ELIGIBLE`, `RETURN_VALIDATED`, `RETURN_ACCEPTED_UNCONFIRMED`,\n`RETURN_UNEXPECTED_RESPONSE`, `RETURN_NETWORK_ERROR`.\n\n## Sécurité\n\n- Le token API est stocké **côté serveur** dans `app_settings.ecotrack_api_credentials`\n (clé `ecotrack_api_credentials`, format `{ \"apiToken\": \"...\" }`).\n- Il n'est **jamais** renvoyé au navigateur, jamais loggé, jamais placé en URL publique.\n- Le schéma est stocké sous forme de hash salé ; les sessions ne stockent que le SHA-256 du token.\n- Les logs de validation ne contiennent que `httpStatus`, `returned` et `emptyBody`.\n\n## Premier lancement\n\n1. Ouvrir [l'application](url:index.ts) — le schéma 3×3 est demandé (à créer puis confirmer).\n2. Icône ⚙ → coller le **token API Ecotrack** → `ENREGISTRER L'API`.\n3. La caméra démarre automatiquement : scanner un QR de colis.\n4. Si le colis est éligible, `VALIDER LE RETOUR` apparaît ; sinon le scanner reprend seul.\n\n> La base SQLite et les réglages sont propres à ce val. Aucune donnée n'est partagée avec une\n> autre application SAMI.TECH.",[],[110],"1f6fa16e-5c7c-4980-84f4-6be2d6a11da3","shared","bdc31962-8a03-4e1e-b919-22d73d4d7c5b",1,["D",1789511156942],[124,125],[118],{"_38":134,"_13":135,"_41":136,"_43":119,"_45":46,"_47":137,"_49":50,"_51":138,"_17":120,"_54":67,"_55":139,"_57":58,"_59":-5,"_106":140,"_18":141},{"_38":126,"_13":127,"_41":128,"_43":119,"_45":46,"_47":129,"_49":50,"_51":130,"_17":66,"_54":67,"_55":131,"_57":58,"_59":-5,"_106":132,"_18":133},"dd1deb99-f776-45fb-acf4-93e3a4d696f2","tracking.ts","6bd68792-b154-11f1-91d7-1607ee4eb77e",2,["D",1789511156972],"/**\n * Extraction d'un numéro de tracking depuis un contenu de QR code.\n *\n * Fonction pure, partagée entre le backend et le frontend.\n */\n\n/** Forme canonique d'un tracking : 6 à 64 caractères A-Z, 0-9, `_`, `-`. */\nconst TRACKING_SHAPE = /^[A-Z0-9_-]{6,64}$/;\n\n/** Recherche d'un tracking noyé dans un contenu plus large (URL, JSON, texte). */\nconst TRACKING_CANDIDATE = /[A-Z0-9][A-Z0-9_-]{5,63}/g;\n\n/** Nettoie une valeur : conserve A-Z, 0-9, `_`, `-` puis passe en majuscules. */\nexport function normalizeTracking(value: string): string {\n return value.replace(/[^A-Za-z0-9_-]/g, \"\").toUpperCase();\n}\n\n/** Vrai si la valeur a exactement la forme d'un tracking. */\nexport function isTrackingShape(value: string): boolean {\n return TRACKING_SHAPE.test(value);\n}\n\n/**\n * Extrait un tracking depuis un contenu de QR code.\n * Retourne une chaîne vide si rien d'exploitable n'est trouvé.\n */\nexport function extractTracking(raw: unknown): string {\n const text = typeof raw === \"string\" ? raw : String(raw ?? \"\");\n const trimmed = text.trim();\n if (!trimmed) return \"\";\n\n // Cas nominal : le QR contient uniquement le tracking.\n if (isTrackingShape(trimmed)) return trimmed.toUpperCase();\n\n // Cas secondaire : le tracking est noyé dans une URL ou un texte.\n const candidates = trimmed.toUpperCase().match(TRACKING_CANDIDATE) ?? [];\n\n // Priorité aux candidats mixtes lettres + chiffres (forme Ecotrack / OM Express).\n for (const candidate of candidates) {\n if (/[A-Z]/.test(candidate) && /\\d/.test(candidate)) return candidate;\n }\n // Puis aux candidats contenant une longue suite de chiffres.\n for (const candidate of candidates) {\n if (/\\d{6,}/.test(candidate)) return candidate;\n }\n return candidates[0] ?? \"\";\n}",[],[118,127],"b0f67b78-1eb9-48cc-94ce-47ec45738043","status.ts","6bd26bbc-b154-11f1-91d7-1607ee4eb77e",35,["D",1789511884442],"/**\n * Normalisation et interprétation des statuts Ecotrack.\n *\n * Fonctions pures, partagées entre le backend (index.ts) et le frontend.\n * Source de vérité unique : ne jamais dupliquer cette logique ailleurs.\n */\n\n/** Statuts Ecotrack qui autorisent la validation du retour. */\nconst READY_STATUSES = new Set([\n \"retour_recu\",\n \"livraison_echoue_recu\",\n]);\n\n/** Statuts confirmant qu'un retour a déjà été validé (orthographe Ecotrack conservée). */\nconst VALIDATED_STATUSES = new Set([\n \"return_validated_by_partener\",\n \"return_validated_by_partner\",\n \"retour_valide\",\n \"retour_validee\",\n]);\n\n/** Clés possibles du statut dans une réponse Ecotrack. */\nconst STATUS_KEYS = [\n \"status_name\",\n \"status\",\n \"statut\",\n \"etat\",\n \"state\",\n \"status_label\",\n \"statut_colis\",\n \"etat_colis\",\n \"return_status\",\n \"delivery_status\",\n];\n\n/**\n * Normalise un statut : chaîne, trim, minuscules, sans accents,\n * espaces et tirets remplacés par `_`.\n * Exemple : \"Retour Reçu\" -> \"retour_recu\"\n */\nexport function normalizeStatus(value: unknown): string {\n return String(value ?? \"\")\n .normalize(\"NFD\")\n .replace(/[\\u0300-\\u036f]/g, \"\")\n .trim()\n .toLowerCase()\n .replace(/[\\s-]+/g, \"_\")\n .replace(/_+/g, \"_\")\n .replace(/^_|_$/g, \"\");\n}\n\n/** Vrai uniquement pour `retour_recu` ou `livraison_echoue_recu`. */\nexport function isReturnReadyStatus(value: unknown): boolean {\n return READY_STATUSES.has(normalizeStatus(value));\n}\n\n/** Vrai si le statut indique qu'un retour a déjà été validé. */\nexport function isReturnValidatedStatus(value: unknown): boolean {\n return VALIDATED_STATUSES.has(normalizeStatus(value));\n}\n\n/** Extrait le statut brut d'une commande Ecotrack, quel que soit le champ utilisé. */\nexport function extractStatusValue(order: Record | null | undefined): string {\n if (!order) return \"\";\n for (const key of STATUS_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim();\n if (value && typeof value === \"object\") {\n const nested = value as Record;\n const candidate = nested.name ?? nested.label ?? nested.libelle;\n if (typeof candidate === \"string\" && candidate.trim()) return candidate.trim();\n }\n }\n return \"\";\n}",[],[118,135],["D",1789511212578],[145,146,147,148,149],[19],{"_38":84,"_13":85,"_41":86,"_43":44,"_45":46,"_47":87,"_49":50,"_51":180,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":181,"_18":182},{"_38":77,"_13":78,"_41":79,"_43":44,"_45":46,"_47":80,"_49":50,"_51":159,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":160,"_18":161},{"_38":70,"_13":71,"_41":72,"_43":44,"_45":46,"_47":73,"_49":50,"_51":156,"_17":66,"_54":24,"_55":75,"_57":58,"_59":-5,"_106":157,"_18":158},{"_38":61,"_13":62,"_41":63,"_43":44,"_45":46,"_47":64,"_49":50,"_51":153,"_17":66,"_54":67,"_55":68,"_57":58,"_59":-5,"_106":154,"_18":155},{"_38":39,"_13":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":150,"_17":53,"_54":24,"_55":56,"_57":58,"_59":-5,"_106":151,"_18":152},["D",1789513621794],[],[19,40],["D",1789511276974],[],[19,62],["D",1789511212578],[],[19,71],["D",1789511212692],[162,163],[19,78],{"_38":172,"_13":173,"_41":174,"_43":79,"_45":46,"_47":175,"_49":50,"_51":176,"_17":129,"_54":67,"_55":177,"_57":58,"_59":-5,"_106":178,"_18":179},{"_38":164,"_13":165,"_41":166,"_43":79,"_45":46,"_47":167,"_49":50,"_51":168,"_17":120,"_54":67,"_55":169,"_57":58,"_59":-5,"_106":170,"_18":171},"4b43d310-2ee2-46ec-a5f7-e3238ff5389e","messages.ts","8d1f9d26-b154-11f1-b96e-1607ee4eb77e",20,["D",1789511823118],"/** Traduction des codes métier backend en messages utilisateur. */\nimport { normalizeStatus } from \"../../shared/status.ts\";\n\nexport function messageForCode(code: string): string {\n switch (code) {\n case \"API_NOT_CONFIGURED\":\n return \"Aucune API Ecotrack enregistrée — ouvre les paramètres.\";\n case \"INVALID_TOKEN\":\n return \"Token API invalide.\";\n case \"INVALID_TRACKING\":\n return \"Numéro de tracking invalide.\";\n case \"TRACKING_NOT_FOUND\":\n return \"Tracking introuvable dans OM Express.\";\n case \"ECOTRACK_READ_ERROR\":\n return \"OM Express a refusé la lecture du colis.\";\n case \"ECOTRACK_BAD_RESPONSE\":\n return \"Réponse illisible de OM Express.\";\n case \"ECOTRACK_NETWORK_ERROR\":\n return \"Erreur réseau vers OM Express.\";\n case \"RETURN_NOT_READY\":\n return \"Retour non éligible : le statut ne permet pas la validation.\";\n case \"RETURN_NOT_ELIGIBLE\":\n return \"Retour non éligible (OM Express a répondu fail).\";\n case \"RETURN_INVALID\":\n return \"Validation refusée par OM Express (requête invalide).\";\n case \"RETURN_API_ERROR\":\n return \"Erreur OM Express pendant la validation.\";\n case \"RETURN_NETWORK_ERROR\":\n return \"Erreur réseau pendant la validation.\";\n case \"UNAUTHORIZED\":\n return \"Session expirée — reverrouille l'application.\";\n default:\n return \"Opération impossible pour le moment.\";\n }\n}\n\n/** Libellé lisible d'un statut Ecotrack brut. */\nexport function statusLabel(raw: string): string {\n switch (normalizeStatus(raw)) {\n case \"retour_recu\":\n return \"Retour reçu\";\n case \"livraison_echoue_recu\":\n return \"Livraison échouée — reçu\";\n case \"return_validated_by_partener\":\n case \"return_validated_by_partner\":\n case \"retour_valide\":\n case \"retour_validee\":\n return \"Retour déjà validé\";\n default:\n return raw.trim() || \"statut inconnu\";\n }\n}\n\n/** Vibration courte, jamais bloquante. */\nexport function vibrate(pattern: number[]): void {\n try {\n if (typeof navigator.vibrate === \"function\") navigator.vibrate(pattern);\n } catch {\n /* ignore */\n }\n}/**\n * Ton de l'ÉTAT : pilote la couleur du voyant et du cadre du scanner.\n * idle -> gris (repos)\n * busy -> ambre (traitement en cours)\n * ok -> vert (succès / prêt)\n * warn -> ambre (trouvé mais non éligible)\n * error -> rouge (échec)\n */\nexport type StatusTone = \"idle\" | \"busy\" | \"ok\" | \"warn\" | \"error\";\n\nexport function toneForCode(code: string): StatusTone {\n switch (code) {\n case \"TRACKING_FOUND\":\n case \"RETURN_VALIDATED\":\n return \"ok\";\n case \"RETURN_ACCEPTED_UNCONFIRMED\":\n case \"RETURN_NOT_READY\":\n case \"RETURN_NOT_ELIGIBLE\":\n return \"warn\";\n default:\n return \"error\";\n }\n}",[],[19,78,165],"f0e4c272-af21-43ea-91a8-38ce5116eb20","api.ts","8d0e7514-b154-11f1-b96e-1607ee4eb77e",54,["D",1789513445064],"/**\n * Appels API côté navigateur.\n * Le frontend n'envoie que des informations fonctionnelles :\n * jamais de token, jamais de cookie Ecotrack, jamais de credential.\n */\n\nexport type ValidateOk = {\n ok: true;\n code: \"TRACKING_FOUND\";\n tracking: string;\n status: string;\n statusRaw: string;\n ready: boolean;\n alreadyValidated: boolean;\n};\n\nexport type ApiError = {\n ok: false;\n code: string;\n status?: number;\n message?: string;\n detail?: string;\n /** Noms des clés renvoyées par Ecotrack (diagnostic, aucune valeur). */\n debug?: string;\n};\n\nexport type ValidateResponse = ValidateOk | ApiError;\n\nexport type ReturnValidationResponse = {\n ok: boolean;\n code: string;\n tracking?: string;\n confirmed?: boolean;\n message?: string;\n detail?: string;\n};\n\nexport type AccessStatus = {\n ok: boolean;\n configured: boolean;\n unlocked: boolean;\n};\n\nasync function postJson(url: string, payload: unknown): Promise {\n const response = await fetch(url, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n credentials: \"same-origin\",\n body: JSON.stringify(payload),\n });\n return (await response.json()) as T;\n}\n\nexport function fetchAccessStatus(): Promise {\n return fetch(\"/api/access/status\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function fetchConfig(): Promise<{ ok: boolean; apiSaved: boolean }> {\n return fetch(\"/api/config\", { credentials: \"same-origin\" }).then((r) => r.json());\n}\n\nexport function setupPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/setup\", { pattern });\n}\n\nexport function unlockPattern(pattern: string): Promise<{ ok: boolean; code?: string }> {\n return postJson(\"/api/access/unlock\", { pattern });\n}\n\nexport function lockApp(): Promise<{ ok: boolean }> {\n return postJson(\"/api/access/logout\", {});\n}\n\nexport function saveApiToken(apiToken: string): Promise<{ ok: boolean; apiSaved?: boolean; code?: string }> {\n return postJson(\"/api/ecotrack/settings\", { apiToken });\n}\n\nexport async function deleteApiToken(): Promise<{ ok: boolean; apiSaved?: boolean }> {\n const response = await fetch(\"/api/ecotrack/settings\", {\n method: \"DELETE\",\n credentials: \"same-origin\",\n });\n return (await response.json()) as { ok: boolean; apiSaved?: boolean };\n}\n\nexport function validateTracking(tracking: string): Promise {\n return postJson(\"/api/validate\", { tracking });\n}\n\nexport function validateReturn(tracking: string): Promise {\n return postJson(\"/api/return/validate\", { tracking });\n}/* ------------------------------------------------------------------ */\n/* Retours prêts (liste serveur) */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyReturnsResponse = {\n ok: boolean;\n code?: string;\n /** `ecotrack_list` = liste renvoyée par l'API ; `local_registry` = relecture serveur. */\n source?: \"ecotrack_list\" | \"local_registry\";\n count?: number;\n items?: ReadyReturn[];\n scanned?: number;\n diagnostics?: string[];\n};\n\n/** Charge la liste des retours prêts. Le token Ecotrack reste côté serveur. */\nexport function fetchReadyReturns(): Promise {\n return fetch(\"/api/returns/ready\", { credentials: \"same-origin\" }).then((r) => r.json());\n}",[],[19,78,173],["D",1789511238063],[183,184,185,186,187,188,189,190,191,192],[19,85],{"_38":265,"_13":266,"_41":267,"_43":86,"_45":46,"_47":268,"_49":50,"_51":269,"_17":270,"_54":67,"_55":271,"_57":58,"_59":-5,"_106":272,"_18":273},{"_38":257,"_13":258,"_41":259,"_43":86,"_45":46,"_47":260,"_49":50,"_51":261,"_17":66,"_54":67,"_55":262,"_57":58,"_59":-5,"_106":263,"_18":264},{"_38":249,"_13":250,"_41":251,"_43":86,"_45":46,"_47":252,"_49":50,"_51":253,"_17":66,"_54":67,"_55":254,"_57":58,"_59":-5,"_106":255,"_18":256},{"_38":242,"_13":243,"_41":244,"_43":86,"_45":46,"_47":87,"_49":50,"_51":245,"_17":66,"_54":67,"_55":246,"_57":58,"_59":-5,"_106":247,"_18":248},{"_38":234,"_13":235,"_41":236,"_43":86,"_45":46,"_47":237,"_49":50,"_51":238,"_17":120,"_54":67,"_55":239,"_57":58,"_59":-5,"_106":240,"_18":241},{"_38":226,"_13":227,"_41":228,"_43":86,"_45":46,"_47":229,"_49":50,"_51":230,"_17":66,"_54":67,"_55":231,"_57":58,"_59":-5,"_106":232,"_18":233},{"_38":217,"_13":218,"_41":219,"_43":86,"_45":46,"_47":220,"_49":50,"_51":221,"_17":222,"_54":67,"_55":223,"_57":58,"_59":-5,"_106":224,"_18":225},{"_38":209,"_13":210,"_41":211,"_43":86,"_45":46,"_47":212,"_49":50,"_51":213,"_17":80,"_54":67,"_55":214,"_57":58,"_59":-5,"_106":215,"_18":216},{"_38":201,"_13":202,"_41":203,"_43":86,"_45":46,"_47":204,"_49":50,"_51":205,"_17":66,"_54":67,"_55":206,"_57":58,"_59":-5,"_106":207,"_18":208},{"_38":193,"_13":194,"_41":195,"_43":86,"_45":46,"_47":196,"_49":50,"_51":197,"_17":120,"_54":67,"_55":198,"_57":58,"_59":-5,"_106":199,"_18":200},"6c4d6547-36ff-417e-8cf4-398a89134cff","StatusPanel.tsx","a49c9c4c-b154-11f1-aa9a-1607ee4eb77e",21,["D",1789511823303],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Zone ÉTAT — toujours affichée AU-DESSUS de la caméra.\n * Le voyant est coloré selon le ton courant : vert (ok), ambre (busy/warn),\n * rouge (error), gris (idle).\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { StatusTone } from \"../lib/messages.ts\";\n\ntype Props = {\n status: string;\n tracking: string;\n tone: StatusTone;\n hint?: string;\n};\n\nexport default function StatusPanel({ status, tracking, tone, hint = \"\" }: Props) {\n return (\n

ÉTAT

\n \n

{status}

\n {tracking ? (\n

\n TRACKING {tracking}\n

\n ) : null}\n {hint ?

{hint}

: null}\n

\n );\n}",[],[19,85,194],"0727bdf1-ae1a-4960-a498-45fe55c8b48e","Settings.tsx","a4ab18a8-b154-11f1-aa9a-1607ee4eb77e",16,["D",1789511252317],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Paramètres — gestion du token API Ecotrack.\n *\n * Le token est envoyé une seule fois au serveur, puis jamais réaffiché.\n * Le badge affiché est « API SAUVEGARDÉE » : la présence d'un token ne garantit\n * pas que toutes les opérations Ecotrack sont disponibles.\n */\nimport React, { useState } from \"https://esm.sh/react@18.2.0\";\nimport { deleteApiToken, saveApiToken } from \"../lib/api.ts\";\n\ntype Props = {\n open: boolean;\n apiSaved: boolean;\n onClose: () => void;\n onSaved: (saved: boolean) => void;\n onLock: () => void;\n};\n\nexport default function Settings({ open, apiSaved, onClose, onSaved, onLock }: Props) {\n const [token, setToken] = useState(\"\");\n const [notice, setNotice] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n if (!open) return null;\n\n async function handleSave() {\n if (busy) return;\n const clean = token.trim();\n if (clean.length < 8) {\n setError(\"Token API trop court.\");\n return;\n }\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await saveApiToken(clean);\n if (result.ok) {\n setToken(\"\");\n setNotice(\"API Ecotrack enregistrée côté serveur.\");\n onSaved(true);\n } else {\n setError(\"Enregistrement refusé par le serveur.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n async function handleDelete() {\n if (busy) return;\n setBusy(true);\n setError(\"\");\n setNotice(\"\");\n try {\n const result = await deleteApiToken();\n if (result.ok) {\n setNotice(\"API Ecotrack supprimée du serveur.\");\n onSaved(false);\n } else {\n setError(\"Suppression impossible.\");\n }\n } catch {\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n setBusy(false);\n }\n }\n\n return (\n

Paramètres

\n\n \n {apiSaved ? \"API SAUVEGARDÉE\" : \"AUCUNE API ENREGISTRÉE\"}\n \n\n

\n \n API TOKEN\n \n setToken(event.target.value)}\n />\n

\n\n {notice ?

{notice}

: null}\n {error ?

{error}

: null}\n\n

\n \n {apiSaved ? (\n \n SUPPRIMER\n \n ) : null}\n

\n \n \n

\n\n

\n Le token est conservé côté serveur et n'est jamais renvoyé au navigateur.\n

\n );\n}",[],[19,85,202],"c152045d-c111-424d-87d6-cdb45b949146","Scanner.tsx","9c31fd86-b154-11f1-8617-1607ee4eb77e",32,["D",1789511849454],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Scanner QR continu.\n *\n * Règle principale : le MediaStream caméra n'est JAMAIS fermé après un scan.\n * QR détecté -> pause logique (scanningRef = false) -> traitement -> reprise.\n * `stopCamera()` n'est appelé qu'au démontage du composant, à la fermeture de\n * l'application ou en cas de perte réelle du flux.\n *\n * Deux moteurs de détection : BarcodeDetector natif, puis jsQR en secours\n * (analyse plein cadre + analyse de la zone centrale).\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport jsQR from \"https://esm.sh/jsqr@1.4.0\";\nimport { extractTracking } from \"../../shared/tracking.ts\";\nimport { type StatusTone, vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n enabled: boolean;\n scanning: boolean;\n onReady: () => void;\n onTracking: (tracking: string) => void;\n onStatus: (status: string, tone?: StatusTone) => void;\n /** Couleur du cadre : vert (ok), rouge (error), blanc (neutral). */\n frameTone: \"neutral\" | \"ok\" | \"error\";\n};\n\ntype BarcodeDetectorLike = {\n detect: (source: CanvasImageSource) => Promise>;\n};\n\nconst FRAME_INTERVAL_MS = 160;\nconst SAME_RAW_COOLDOWN_MS = 2500;\nconst JSQR_MAX_SIDE = 640;\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction createDetector(): BarcodeDetectorLike | null {\n const ctor = (globalThis as unknown as {\n BarcodeDetector?: new (options?: { formats?: string[] }) => BarcodeDetectorLike;\n }).BarcodeDetector;\n if (!ctor) return null;\n try {\n return new ctor({ formats: [\"qr_code\"] });\n } catch {\n return null;\n }\n}\n\n/** Applique focus continu et zoom si le matériel les expose. */\nasync function applyTrackHints(stream: MediaStream): Promise {\n const track = stream.getVideoTracks()[0] as MediaStreamTrack & {\n getCapabilities?: () => Record;\n };\n if (!track?.getCapabilities || !track.applyConstraints) return;\n try {\n const capabilities = track.getCapabilities();\n const advanced: Record = {};\n\n const focusModes = capabilities.focusMode;\n if (Array.isArray(focusModes) && focusModes.includes(\"continuous\")) {\n advanced.focusMode = \"continuous\";\n }\n\n const zoom = capabilities.zoom as { min?: number; max?: number } | undefined;\n if (zoom && typeof zoom.max === \"number\") {\n const target = Math.min(1.6, zoom.max);\n if (target >= (zoom.min ?? 1)) advanced.zoom = target;\n }\n\n if (Object.keys(advanced).length > 0) {\n await track.applyConstraints({ advanced: [advanced] } as MediaStreamConstraints);\n }\n } catch {\n /* capacités non supportées : on continue sans */\n }\n}\n\n/** Analyse une zone vidéo avec jsQR. */\nfunction analyzeZone(\n context: CanvasRenderingContext2D,\n canvas: HTMLCanvasElement,\n video: HTMLVideoElement,\n source: { x: number; y: number; size: number },\n outputSize: number,\n): string | null {\n canvas.width = outputSize;\n canvas.height = outputSize;\n context.drawImage(\n video,\n source.x,\n source.y,\n source.size,\n source.size,\n 0,\n 0,\n outputSize,\n outputSize,\n );\n const image = context.getImageData(0, 0, outputSize, outputSize);\n const code = jsQR(image.data, image.width, image.height, { inversionAttempts: \"dontInvert\" });\n return code?.data ?? null;\n}\n\n/** Secours jsQR : plein cadre (sous-échantillonné) puis zone centrale (pleine résolution). */\nfunction detectWithJsQr(\n video: HTMLVideoElement,\n canvasRef: React.MutableRefObject,\n): string | null {\n const width = video.videoWidth;\n const height = video.videoHeight;\n if (!width || !height) return null;\n\n let canvas = canvasRef.current;\n if (!canvas) {\n canvas = document.createElement(\"canvas\");\n canvasRef.current = canvas;\n }\n const context = canvas.getContext(\"2d\", { willReadFrequently: true });\n if (!context) return null;\n\n const side = Math.min(width, height);\n const fullOutput = Math.max(160, Math.min(JSQR_MAX_SIDE, side));\n const full = analyzeZone(\n context,\n canvas,\n video,\n { x: 0, y: 0, size: side },\n fullOutput,\n );\n if (full) return full;\n\n // Deuxième analyse : zone centrale, pleine résolution.\n const centerSize = Math.floor(side * 0.6);\n const center = analyzeZone(\n context,\n canvas,\n video,\n { x: Math.floor((width - centerSize) / 2), y: Math.floor((height - centerSize) / 2), size: centerSize },\n centerSize,\n );\n return center;\n}\n\nexport default function Scanner(\n { enabled, scanning, frameTone, onReady, onTracking, onStatus }: Props,\n) {\n const videoRef = useRef(null);\n const canvasRef = useRef(null);\n const streamRef = useRef(null);\n const scanningRef = useRef(false);\n const loopRunningRef = useRef(false);\n const lastScanRef = useRef(\"\");\n const lastRawRef = useRef(\"\");\n const lastRawAtRef = useRef(0);\n const framesRef = useRef(0);\n const lastTickRef = useRef(0);\n\n const [cameraOn, setCameraOn] = useState(false);\n const [qrDetected, setQrDetected] = useState(false);\n\n const onReadyRef = useRef(onReady);\n const onTrackingRef = useRef(onTracking);\n const onStatusRef = useRef(onStatus);\n useEffect(() => {\n onReadyRef.current = onReady;\n onTrackingRef.current = onTracking;\n onStatusRef.current = onStatus;\n }, [onReady, onTracking, onStatus]);\n\n /* -------------------------------------------------------------- */\n /* Traitement d'un contenu QR */\n /* -------------------------------------------------------------- */\n\n const handleRaw = useCallback((raw: string) => {\n const now = Date.now();\n if (raw === lastRawRef.current && now - lastRawAtRef.current < SAME_RAW_COOLDOWN_MS) return;\n lastRawRef.current = raw;\n lastRawAtRef.current = now;\n\n const tracking = extractTracking(raw);\n if (!tracking) {\n setQrDetected(true);\n onStatusRef.current(\"QR lu, mais aucun numéro de tracking reconnu.\", \"error\");\n window.setTimeout(() => setQrDetected(false), 700);\n return;\n }\n if (lastScanRef.current === tracking) return;\n\n lastScanRef.current = tracking;\n scanningRef.current = false; // pause logique : le MediaStream reste ouvert\n setQrDetected(true);\n vibrate([70, 40, 110]);\n onStatusRef.current(\"QR détecté — tracking reconnu\", \"busy\");\n onTrackingRef.current(tracking);\n }, []);\n\n /* -------------------------------------------------------------- */\n /* Boucle de scan */\n /* -------------------------------------------------------------- */\n\n const scanLoop = useCallback(async () => {\n if (loopRunningRef.current) return;\n loopRunningRef.current = true;\n try {\n const detector = createDetector();\n while (scanningRef.current && streamRef.current) {\n const video = videoRef.current;\n if (!video || video.readyState < 2 || video.videoWidth === 0) {\n await sleep(120);\n continue;\n }\n const now = Date.now();\n if (now - lastTickRef.current < FRAME_INTERVAL_MS) {\n await sleep(40);\n continue;\n }\n lastTickRef.current = now;\n framesRef.current += 1;\n\n let raw: string | null = null;\n if (detector) {\n try {\n const codes = await detector.detect(video);\n if (codes.length > 0 && codes[0].rawValue) raw = codes[0].rawValue;\n } catch {\n /* BarcodeDetector indisponible sur cette frame : jsQR prend le relais */\n }\n }\n if (!raw) raw = detectWithJsQr(video, canvasRef);\n if (raw) handleRaw(raw);\n\n await sleep(50);\n }\n } finally {\n loopRunningRef.current = false;\n }\n }, [handleRaw]);\n\n /* -------------------------------------------------------------- */\n /* Caméra */\n /* -------------------------------------------------------------- */\n\n const stopCamera = useCallback(() => {\n scanningRef.current = false;\n const stream = streamRef.current;\n if (stream) stream.getTracks().forEach((track) => track.stop());\n streamRef.current = null;\n const video = videoRef.current;\n if (video) video.srcObject = null;\n setCameraOn(false);\n }, []);\n\n const startCamera = useCallback(async () => {\n if (streamRef.current) return;\n onStatusRef.current(\"Ouverture de la caméra…\", \"busy\");\n try {\n const constraints = {\n audio: false,\n video: {\n facingMode: { ideal: \"environment\" },\n width: { ideal: 1920 },\n height: { ideal: 1080 },\n },\n } as MediaStreamConstraints;\n const stream = await navigator.mediaDevices.getUserMedia(constraints);\n streamRef.current = stream;\n\n const video = videoRef.current;\n if (video) {\n video.srcObject = stream;\n video.muted = true;\n try {\n await video.play();\n } catch {\n /* autoplay bloqué : le flux reste ouvert */\n }\n }\n await applyTrackHints(stream);\n setCameraOn(true);\n onReadyRef.current();\n } catch {\n streamRef.current = null;\n setCameraOn(false);\n onStatusRef.current(\"Caméra indisponible — utilise la SAISIE MANUELLE.\", \"error\");\n }\n }, []);\n\n // Ouverture de la caméra après déverrouillage ; arrêt uniquement au démontage.\n useEffect(() => {\n if (!enabled) return;\n void startCamera();\n return () => stopCamera();\n }, [enabled, startCamera, stopCamera]);\n\n /* -------------------------------------------------------------- */\n /* Reprise automatique du scanner */\n /* -------------------------------------------------------------- */\n\n useEffect(() => {\n if (!scanning) {\n scanningRef.current = false;\n return;\n }\n // Équivalent de resumeScanner() : remise à zéro puis reprise.\n setQrDetected(false);\n lastScanRef.current = \"\";\n framesRef.current = 0;\n\n const stream = streamRef.current;\n const alive = !!stream && stream.getVideoTracks().some((track) => track.readyState === \"live\");\n if (alive && videoRef.current) {\n setCameraOn(true);\n scanningRef.current = true;\n onStatusRef.current(\"Analyse QR active — place le QR dans le cadre\", \"ok\");\n void scanLoop();\n return;\n }\n scanningRef.current = false;\n void startCamera();\n }, [scanning, scanLoop, startCamera]);\n\n return (\n

\n {!cameraOn && (\n

\n ▣\n Scanner un retour\n

\n )}\n \n );\n}",[],[19,85,210],"a203b732-9657-4f91-bae1-492b9390c3e3","ReturnsReadyCard.tsx","e83f1746-b158-11f1-b989-1607ee4eb77e",70,["D",1789513621736],3,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Rubrique « RETOURS PRÊTS ».\n *\n * Deux usages, une seule caméra et aucun appel Ecotrack direct :\n * 1. 🔄 CHARGER LES RETOURS PRÊTS → liste serveur (GET /api/returns/ready)\n * 2. 📷 SCANNER LES RETOURS PRÊTS → bascule le mode de lecture du scanner existant\n *\n * Ce composant ne crée aucune caméra et ne parle à aucune API : il délègue tout\n * à App.tsx, qui utilise les routes backend existantes.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport ReadyReturnsList from \"./ReadyReturnsList.tsx\";\n\nexport type ScanMode = \"normal\" | \"returns_ready\";\n\nexport type ReadyState = {\n loaded: boolean;\n loading: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n /** Trace des tentatives côté serveur (statuts HTTP, formes de réponse). */\n diagnostics: string[];\n};\n\ntype Props = {\n scanMode: ScanMode;\n onStart: () => void;\n onStop: () => void;\n onLoad: () => void;\n onSelect: (item: ReadyReturn) => void;\n ready: ReadyState;\n disabled?: boolean;\n};\n\nexport default function ReturnsReadyCard({\n scanMode,\n onStart,\n onStop,\n onLoad,\n onSelect,\n ready,\n disabled = false,\n}: Props) {\n const active = scanMode === \"returns_ready\";\n\n return (\n

RETOURS PRÊTS

\n Charge la liste des colis prêts à être validés, ou scanne-les directement.\n

\n\n \n {ready.loading ? \"CHARGEMENT…\" : \"🔄 CHARGER LES RETOURS PRÊTS\"}\n \n\n \n\n {active ? (\n <>\n MODE RETOURS PRÊTS ACTIF\n \n \n ) : (\n \n )}\n

\n );\n}",[],[19,85,218],"dffbe624-83dc-4604-9139-7b13f40eba19","ReturnDetailSheet.tsx","bfb37906-b159-11f1-b477-1607ee4eb77e",56,["D",1789513445152],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Fiche retour — ouverte en cliquant un élément de RETOURS PRÊTS.\n *\n * Affiche le tracking et le statut Ecotrack, puis propose VALIDER LE RETOUR.\n * La validation utilise la route existante POST /api/return/validate :\n * la relecture serveur du statut avant mutation reste inchangée.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n tracking: string;\n statusRaw: string;\n validating: boolean;\n onClose: () => void;\n onValidate: () => void;\n};\n\nexport default function ReturnDetailSheet({\n tracking,\n statusRaw,\n validating,\n onClose,\n onValidate,\n}: Props) {\n if (!tracking) return null;\n\n return (\n

Fiche retour

\n\n

\n TRACKING\n {tracking}\n

\n\n

\n STATUT ECOTRACK\n {statusLabel(statusRaw)}\n

\n\n

\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n \n

\n\n

\n Le statut est revérifié côté serveur juste avant la validation.\n

\n );\n}",[],[19,85,227],"2b23e6f3-9051-4972-aac4-d0ff79c0f632","ReadyReturnsList.tsx","bfaddac8-b159-11f1-b477-1607ee4eb77e",71,["D",1789513621767],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Liste « RETOURS PRÊTS (X) ».\n * Chaque élément est cliquable et ouvre la fiche retour.\n * Aucun appel réseau ici : les données viennent du backend.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { ReadyReturn } from \"../lib/api.ts\";\nimport { statusLabel } from \"../lib/messages.ts\";\n\ntype Props = {\n loaded: boolean;\n items: ReadyReturn[];\n source: string;\n error: string;\n diagnostics: string[];\n onSelect: (item: ReadyReturn) => void;\n};\n\nexport default function ReadyReturnsList({\n loaded,\n items,\n source,\n error,\n diagnostics,\n onSelect,\n}: Props) {\n if (error) return

{error}

;\n if (!loaded) return null;\n\n return (\n <>\n

\n RETOURS PRÊTS ({items.length})\n {source === \"local_registry\" ? (\n relecture serveur\n ) : null}\n

\n\n {items.length === 0 ? (\n

Aucun colis prêt renvoyé par le serveur.

\n ) : (\n

\n \n

\n )}\n\n {diagnostics.length > 0 ? (\n

\n {diagnostics.map((line) => (\n

{line}

\n ))}\n

\n ) : null}\n \n );\n}",[],[19,85,235],"1425fed1-60da-4bbc-9aae-2aede04a3c61","PatternGate.tsx","9c2cb9ca-b154-11f1-8617-1607ee4eb77e",["D",1789511238063],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Verrouillage de l'application par schéma Android 3x3.\n *\n * Le schéma est tracé au doigt (pointer events) puis envoyé au serveur.\n * En mode `setup`, le schéma doit être tracé deux fois de suite.\n * Aucun hash, aucun secret n'est manipulé côté navigateur.\n */\nimport React, { useCallback, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { setupPattern, unlockPattern } from \"../lib/api.ts\";\nimport { vibrate } from \"../lib/messages.ts\";\n\ntype Props = {\n mode: \"setup\" | \"unlock\";\n onUnlocked: () => void;\n};\n\nconst MIN_POINTS = 4;\n\nexport default function PatternGate({ mode, onUnlocked }: Props) {\n const [path, setPath] = useState([]);\n const [pending, setPending] = useState(null);\n const [error, setError] = useState(\"\");\n const [busy, setBusy] = useState(false);\n\n const pathRef = useRef([]);\n const tracingRef = useRef(false);\n const busyRef = useRef(false);\n const dotRefs = useRef>([]);\n\n const reset = useCallback(() => {\n pathRef.current = [];\n setPath([]);\n }, []);\n\n const addDot = useCallback((dot: number) => {\n if (pathRef.current.includes(dot)) return;\n pathRef.current = [...pathRef.current, dot];\n setPath(pathRef.current);\n vibrate([12]);\n }, []);\n\n const dotAt = useCallback((x: number, y: number): number | null => {\n for (let index = 0; index < 9; index++) {\n const element = dotRefs.current[index];\n if (!element) continue;\n const rect = element.getBoundingClientRect();\n const centerX = rect.left + rect.width / 2;\n const centerY = rect.top + rect.height / 2;\n const radius = Math.max(rect.width, 46);\n if (Math.hypot(x - centerX, y - centerY) <= radius) return index + 1;\n }\n return null;\n }, []);\n\n const submit = useCallback(\n async (pattern: string) => {\n if (busyRef.current) return;\n busyRef.current = true;\n setBusy(true);\n setError(\"\");\n try {\n if (mode === \"setup\") {\n if (pending === null) {\n setPending(pattern);\n reset();\n return;\n }\n if (pending !== pattern) {\n setPending(null);\n reset();\n setError(\"Les deux schémas ne correspondent pas. Recommence.\");\n return;\n }\n const result = await setupPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n setPending(null);\n reset();\n setError(\"Enregistrement impossible. Recharge la page et réessaie.\");\n return;\n }\n\n const result = await unlockPattern(pattern);\n if (result.ok) {\n onUnlocked();\n return;\n }\n reset();\n setError(\"Schéma incorrect.\");\n } catch {\n reset();\n setError(\"Erreur réseau. Réessaie.\");\n } finally {\n busyRef.current = false;\n setBusy(false);\n }\n },\n [mode, onUnlocked, pending, reset],\n );\n\n const handlePointerDown = useCallback(\n (event: React.PointerEvent) => {\n if (busyRef.current) return;\n event.currentTarget.setPointerCapture(event.pointerId);\n tracingRef.current = true;\n setError(\"\");\n reset();\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt, reset],\n );\n\n const handlePointerMove = useCallback(\n (event: React.PointerEvent) => {\n if (!tracingRef.current) return;\n const dot = dotAt(event.clientX, event.clientY);\n if (dot !== null) addDot(dot);\n },\n [addDot, dotAt],\n );\n\n const handlePointerUp = useCallback(() => {\n if (!tracingRef.current) return;\n tracingRef.current = false;\n const current = pathRef.current;\n if (current.length < MIN_POINTS) {\n reset();\n setError(\"Relie au moins 4 points.\");\n return;\n }\n void submit(current.join(\"\"));\n }, [reset, submit]);\n\n const points = path\n .map((dot) => `${((dot - 1) % 3) + 0.5},${Math.floor((dot - 1) / 3) + 0.5}`)\n .join(\" \");\n\n const hint = mode === \"setup\"\n ? pending === null\n ? \"Trace ton schéma de déverrouillage (4 points minimum).\"\n : \"Reproduis exactement le même schéma pour confirmer.\"\n : \"Trace ton schéma pour accéder au scanner.\";\n\n return (\n

\n SAMI.TECH\n

{hint}

\n\n \n \n

\n {Array.from({ length: 9 }, (_, index) => (\n \n {\n dotRefs.current[index] = element;\n }}\n />\n

\n ))}\n

\n \n\n

{error}

\n\n

\n {\n reset();\n setPending(null);\n setError(\"\");\n }}\n >\n EFFACER\n \n

\n \n );\n}",[],[19,85,243],"fbf5dc9f-bcef-4638-8c09-b1c84bcaad75","ManualEntry.tsx","a4a1edc8-b154-11f1-aa9a-1607ee4eb77e",14,["D",1789511252256],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * SAISIE MANUELLE — directement sous la caméra.\n * Mêmes règles que le scanner : A-Z, 0-9, `_`, `-`, 6 à 64 caractères, majuscules.\n * La touche Entrée lance la vérification. La caméra n'est jamais fermée ici.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n value: string;\n onChange: (value: string) => void;\n onSubmit: (value: string) => void;\n disabled?: boolean;\n};\n\nconst MIN_LENGTH = 6;\nconst MAX_LENGTH = 64;\n\nexport default function ManualEntry({ value, onChange, onSubmit, disabled = false }: Props) {\n const canSubmit = value.trim().length >= MIN_LENGTH && !disabled;\n\n return (\n

SAISIE MANUELLE

\n {\n event.preventDefault();\n if (canSubmit) onSubmit(value.trim().toUpperCase());\n }}\n >\n {\n const clean = event.target.value\n .toUpperCase()\n .replace(/[^A-Z0-9_-]/g, \"\")\n .slice(0, MAX_LENGTH);\n onChange(clean);\n }}\n />\n \n \n

\n );\n}",[],[19,85,250],"62a5fdbe-684a-480f-82a7-af6c6aad1e52","HistoryList.tsx","a4a69242-b154-11f1-aa9a-1607ee4eb77e",15,["D",1789511252288],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * DERNIERS RETOURS VALIDÉS — historique d'affichage uniquement.\n * Ce n'est pas une preuve serveur : la source de vérité reste OM Express.\n */\nimport React from \"https://esm.sh/react@18.2.0\";\n\ntype Props = {\n items: string[];\n};\n\nexport default function HistoryList({ items }: Props) {\n return (\n

DERNIERS RETOURS VALIDÉS

\n {items.length === 0 ? (\n

Aucun retour validé pour l'instant.

\n ) : (\n

\n ✓\n {tracking}\n

\n )}\n

\n );\n}",[],[19,85,258],"3b06a799-b3f3-4d8c-ac2a-3c763a1b5d3b","App.tsx","b3594b36-b154-11f1-a81e-1607ee4eb77e",76,["D",1789513633536],17,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n/**\n * Application principale — machine à états du scanner continu.\n *\n * Ordre visuel imposé :\n * 1. En-tête SAMI.TECH / Retours Ecotrack\n * 2. ÉTAT (voyant coloré : vert ok, ambre busy/warn, rouge error, gris idle)\n * 3. Caméra / Scanner QR (cadre blanc / vert / rouge)\n * 4. SAISIE MANUELLE\n * 5. VALIDER LE RETOUR (uniquement si le colis est éligible)\n * 6. DERNIERS RETOURS VALIDÉS\n * 7. Footer\n *\n * Niveaux de fiabilité distingués en permanence :\n * QR détecté ≠ tracking trouvé ≠ retour éligible ≠ retour validé.\n */\nimport React, { useCallback, useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport { isReturnReadyStatus } from \"../../shared/status.ts\";\nimport {\n fetchAccessStatus,\n fetchConfig,\n fetchReadyReturns,\n lockApp,\n validateReturn,\n validateTracking,\n} from \"../lib/api.ts\";\nimport type { ReadyReturn, ValidateResponse } from \"../lib/api.ts\";\nimport { messageForCode, statusLabel, toneForCode, vibrate } from \"../lib/messages.ts\";\nimport type { StatusTone } from \"../lib/messages.ts\";\nimport HistoryList from \"./HistoryList.tsx\";\nimport ManualEntry from \"./ManualEntry.tsx\";\nimport PatternGate from \"./PatternGate.tsx\";\nimport ReturnsReadyCard from \"./ReturnsReadyCard.tsx\";\nimport type { ReadyState, ScanMode } from \"./ReturnsReadyCard.tsx\";\nimport ReturnDetailSheet from \"./ReturnDetailSheet.tsx\";\nimport Scanner from \"./Scanner.tsx\";\nimport Settings from \"./Settings.tsx\";\nimport StatusPanel from \"./StatusPanel.tsx\";\n\ntype AccessState = \"loading\" | \"setup\" | \"locked\" | \"open\";\ntype FrameTone = \"neutral\" | \"ok\" | \"error\";\n\nconst RESUME_DELAY_MS = 800;\nconst HISTORY_LIMIT = 8;\n\nexport default function App() {\n const [access, setAccess] = useState(\"loading\");\n const [statusText, setStatusText] = useState(\"Prêt à scanner\");\n const [tone, setTone] = useState(\"idle\");\n const [hint, setHint] = useState(\"\");\n const [tracking, setTracking] = useState(\"\");\n const [result, setResult] = useState(null);\n const [validating, setValidating] = useState(false);\n const [scanning, setScanning] = useState(false);\n const [manualValue, setManualValue] = useState(\"\");\n const [history, setHistory] = useState([]);\n const [settingsOpen, setSettingsOpen] = useState(false);\n const [apiSaved, setApiSaved] = useState(false);\n /** Mode de lecture du scanner existant : normal ou contrôle « retour prêt ». */\n const [scanMode, setScanMode] = useState(\"normal\");\n /** Liste RETOURS PRÊTS, chargée depuis le backend (token Ecotrack côté serveur). */\n const [readyState, setReadyState] = useState({\n loaded: false,\n loading: false,\n items: [],\n source: \"\",\n error: \"\",\n diagnostics: [],\n });\n /** Fiche retour ouverte depuis la liste. */\n const [selected, setSelected] = useState(null);\n\n const resumeTimer = useRef(null);\n const trackingRef = useRef(\"\");\n const validatingRef = useRef(false);\n\n useEffect(() => {\n trackingRef.current = tracking;\n }, [tracking]);\n\n useEffect(() => {\n return () => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n };\n }, []);\n\n /** Met à jour l'ÉTAT : texte + couleur + ligne de détail optionnelle. */\n const showStatus = useCallback(\n (text: string, nextTone: StatusTone = \"busy\", nextHint = \"\") => {\n setStatusText(text);\n setTone(nextTone);\n setHint(nextHint);\n },\n [],\n );\n\n /* ---------------------------------------------------------------- */\n /* Reprise automatique du scanner (jamais de fermeture caméra) */\n /* ---------------------------------------------------------------- */\n\n const resume = useCallback((delayMs: number = RESUME_DELAY_MS) => {\n if (resumeTimer.current !== null) window.clearTimeout(resumeTimer.current);\n setScanning(false);\n resumeTimer.current = window.setTimeout(() => {\n resumeTimer.current = null;\n setTracking(\"\");\n setResult(null);\n setHint(\"\");\n setTone(\"busy\");\n setScanning(true);\n }, delayMs);\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Déverrouillage */\n /* ---------------------------------------------------------------- */\n\n useEffect(() => {\n let cancelled = false;\n void (async () => {\n try {\n const data = await fetchAccessStatus();\n if (cancelled) return;\n if (!data.configured) setAccess(\"setup\");\n else if (data.unlocked) setAccess(\"open\");\n else setAccess(\"locked\");\n } catch {\n if (!cancelled) setAccess(\"locked\");\n }\n })();\n return () => {\n cancelled = true;\n };\n }, []);\n\n useEffect(() => {\n if (access !== \"open\") return;\n void (async () => {\n try {\n const data = await fetchConfig();\n setApiSaved(Boolean(data.apiSaved));\n } catch {\n /* ignore */\n }\n })();\n }, [access]);\n\n const handleLock = useCallback(async () => {\n setSettingsOpen(false);\n setScanning(false);\n try {\n await lockApp();\n } catch {\n /* ignore */\n }\n setTracking(\"\");\n setResult(null);\n setAccess(\"locked\");\n }, []);\n\n /* ---------------------------------------------------------------- */\n /* Vérification d'un tracking (QR ou saisie manuelle) */\n /* ---------------------------------------------------------------- */\n\n const handleTracking = useCallback(\n async (value: string) => {\n const clean = value.trim().toUpperCase();\n if (!clean) return;\n\n setTracking(clean);\n setResult(null);\n showStatus(\"Vérification du tracking…\", \"busy\");\n\n try {\n const response = await validateTracking(clean);\n\n if (!response.ok) {\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n showStatus(\n messageForCode(response.code),\n toneForCode(response.code),\n response.debug ? `Réponse OM Express : ${response.debug}` : \"\",\n );\n resume(900);\n return;\n }\n\n setResult(response);\n\n if (response.ready && isReturnReadyStatus(response.statusRaw)) {\n // Colis éligible : le scanner reste EN PAUSE, VALIDER LE RETOUR s'affiche.\n showStatus(\n scanMode === \"returns_ready\"\n ? \"RETOUR PRÊT À VALIDER\"\n : `Tracking trouvé dans OM Express — ${statusLabel(response.statusRaw)}`,\n \"ok\",\n );\n return;\n }\n\n showStatus(\n scanMode === \"returns_ready\"\n ? `RETOUR NON PRÊT — ${statusLabel(response.statusRaw)}`\n : response.alreadyValidated\n ? `Retour déjà validé dans OM Express — ${statusLabel(response.statusRaw)}`\n : `Tracking trouvé — statut « ${statusLabel(response.statusRaw)} » : validation impossible.`,\n \"warn\",\n );\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — vérifie ta connexion.\", \"error\");\n resume(900);\n }\n },\n [resume, showStatus, scanMode],\n );\n\n const handleManualSubmit = useCallback(\n (value: string) => {\n // La caméra n'est PAS fermée : simple pause logique du scanner.\n setScanning(false);\n void handleTracking(value);\n },\n [handleTracking],\n );\n\n /* ---------------------------------------------------------------- */\n /* Mode RETOURS PRÊTS — réutilise le scanner existant, une caméra */\n /* ---------------------------------------------------------------- */\n\n // `resume()` relance le scanLoop existant : la caméra n'est jamais fermée.\n const startReturnsReadyScan = useCallback(() => {\n setScanMode(\"returns_ready\");\n resume(60);\n }, [resume]);\n\n const stopReturnsReadyScan = useCallback(() => {\n setScanMode(\"normal\");\n resume(60);\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Liste RETOURS PRÊTS (chargée côté serveur) */\n /* ---------------------------------------------------------------- */\n\n const loadReadyReturns = useCallback(async () => {\n setReadyState((previous) => ({ ...previous, loading: true, error: \"\" }));\n try {\n const data = await fetchReadyReturns();\n if (!data.ok) {\n if (data.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n setReadyState({\n loaded: true,\n loading: false,\n items: [],\n source: \"\",\n error: messageForCode(data.code ?? \"\"),\n diagnostics: [],\n });\n return;\n }\n setReadyState({\n loaded: true,\n loading: false,\n items: data.items ?? [],\n source: data.source ?? \"\",\n error: \"\",\n diagnostics: data.diagnostics ?? [],\n });\n } catch {\n setReadyState({\n loaded: true,\n loading: false,\n items: [],\n source: \"\",\n error: \"Erreur réseau — liste indisponible.\",\n diagnostics: [],\n });\n }\n }, []);\n\n const handleSelectReady = useCallback((item: ReadyReturn) => {\n // Pause logique du scanner : la caméra reste ouverte.\n setScanning(false);\n setTracking(item.tracking);\n setSelected(item);\n }, []);\n\n const handleCloseDetail = useCallback(() => {\n setSelected(null);\n resume(60);\n }, [resume]);\n\n /* ---------------------------------------------------------------- */\n /* Validation officielle du retour */\n /* ---------------------------------------------------------------- */\n\n const handleValidateReturn = useCallback(async () => {\n if (validatingRef.current) return;\n const current = trackingRef.current;\n if (!current) return;\n\n validatingRef.current = true;\n setValidating(true);\n showStatus(\"Validation du retour dans OM Express…\", \"busy\");\n\n try {\n const response = await validateReturn(current);\n\n if (response.code === \"UNAUTHORIZED\") {\n setAccess(\"locked\");\n return;\n }\n\n if (response.ok && response.confirmed) {\n showStatus(\"Retour validé avec succès dans OM Express.\", \"ok\");\n vibrate([100, 50, 160]);\n setHistory((previous) =>\n [current, ...previous.filter((item) => item !== current)].slice(0, HISTORY_LIMIT)\n );\n setManualValue(\"\");\n setTracking(\"\");\n setResult(null);\n resume(700);\n return;\n }\n\n if (response.ok && response.code === \"RETURN_ACCEPTED_UNCONFIRMED\") {\n showStatus(\"Requête reçue par OM Express, mais validation non confirmée.\", \"warn\");\n resume(900);\n return;\n }\n\n showStatus(messageForCode(response.code), toneForCode(response.code));\n resume(900);\n } catch {\n showStatus(\"Erreur réseau — validation non confirmée.\", \"error\");\n resume(900);\n } finally {\n validatingRef.current = false;\n setValidating(false);\n }\n }, [resume, showStatus]);\n\n /** Validation depuis la fiche retour : même route, même vérification serveur. */\n const handleValidateFromDetail = useCallback(async () => {\n await handleValidateReturn();\n setSelected(null);\n void loadReadyReturns();\n }, [handleValidateReturn, loadReadyReturns]);\n\n /* ---------------------------------------------------------------- */\n /* Rendu */\n /* ---------------------------------------------------------------- */\n\n if (access === \"loading\") {\n return (\n

Chargement…

\n );\n }\n\n if (access === \"setup\" || access === \"locked\") {\n return (\n setAccess(\"open\")}\n />\n );\n }\n\n const ready = !!result && result.ok && result.ready && isReturnReadyStatus(result.statusRaw);\n const frameTone: FrameTone = tone === \"error\" ? \"error\" : ready ? \"ok\" : \"neutral\";\n\n return (\n

\n \n SAMI.TECH\n \n Retours Ecotrack\n

\n setSettingsOpen(true)}\n >\n ⚙\n \n

\n\n \n\n

\n setScanning(true)}\n onTracking={handleTracking}\n onStatus={(text, nextTone) => showStatus(text, nextTone ?? \"busy\")}\n />\n

\n\n \n\n \n\n {ready ? (\n \n {validating ? \"VALIDATION…\" : \"VALIDER LE RETOUR\"}\n \n ) : null}\n\n \n\n \n\n setSettingsOpen(false)}\n onSaved={setApiSaved}\n onLock={handleLock}\n />\n\n \n

\n );\n}",[],[19,85,266],"0f5af76f-7d2c-4035-9d53-5e115fec2804","backend","cb9b26c6-3552-462f-9d4a-105dd9b5b222",["D",1789511156996],[280,281,282],[275],{"_38":299,"_13":300,"_41":301,"_43":276,"_45":46,"_47":53,"_49":50,"_51":302,"_17":66,"_54":67,"_55":303,"_57":58,"_59":-5,"_106":304,"_18":305},{"_38":291,"_13":292,"_41":293,"_43":276,"_45":46,"_47":294,"_49":50,"_51":295,"_17":129,"_54":67,"_55":296,"_57":58,"_59":-5,"_106":297,"_18":298},{"_38":283,"_13":284,"_41":285,"_43":276,"_45":46,"_47":286,"_49":50,"_51":287,"_17":204,"_54":67,"_55":288,"_57":58,"_59":-5,"_106":289,"_18":290},"807e9071-57ff-4bb5-bd69-bacc7a8fea99","ecotrack.ts","76780022-b154-11f1-ac17-1607ee4eb77e",85,["D",1789514201578],"/**\n * Client de l'API Ecotrack / OM Express.\n *\n * Règles absolues :\n * - le token reste côté serveur (jamais renvoyé au frontend, jamais loggé) ;\n * - lecture d'un colis : GET /api/v1/get/orders?tracking=...\n * - validation retour : POST /api/v1/valid/returns { trackings: [ ... ] }\n * - routes interdites : /retours/recu/validated et /api/v1/valid/order\n */\nimport { deleteSetting, getSetting, setSetting } from \"./db.ts\";\nimport { extractStatusValue, isReturnReadyStatus, normalizeStatus } from \"../shared/status.ts\";\n\nconst CREDENTIALS_KEY = \"ecotrack_api_credentials\";\nconst API_BASE = \"https://omexpress.ecotrack.dz/api/v1\";\n\nexport type EcotrackCredentials = { apiToken: string };\n\nexport type OrderLookup =\n | {\n kind: \"found\";\n tracking: string;\n statusRaw: string;\n status: string;\n order: Record;\n }\n | { kind: \"not_found\"; payloadKeys: string[] }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nexport type MutationResult =\n | { kind: \"success\" }\n | { kind: \"fail\" }\n | { kind: \"invalid\"; message: string; status: number }\n | { kind: \"api_error\"; status: number }\n | { kind: \"network_error\" }\n | { kind: \"unexpected\"; status: number };\n\n/* ------------------------------------------------------------------ */\n/* Credentials (stockés côté serveur, en base) */\n/* ------------------------------------------------------------------ */\n\nexport async function getCredentials(): Promise {\n const raw = await getSetting(CREDENTIALS_KEY);\n if (!raw) return null;\n try {\n const parsed = JSON.parse(raw) as { apiToken?: unknown };\n const apiToken = typeof parsed.apiToken === \"string\" ? parsed.apiToken.trim() : \"\";\n return apiToken ? { apiToken } : null;\n } catch {\n return null;\n }\n}\n\nexport async function saveCredentials(apiToken: string): Promise {\n await setSetting(CREDENTIALS_KEY, JSON.stringify({ apiToken: apiToken.trim() }));\n}\n\nexport async function deleteCredentials(): Promise {\n await deleteSetting(CREDENTIALS_KEY);\n}\n\n/* ------------------------------------------------------------------ */\n/* Appels HTTP */\n/* ------------------------------------------------------------------ */\n\nasync function ecotrackFetch(\n path: string,\n apiToken: string,\n init: { method: \"GET\" | \"POST\"; body?: string; contentType?: string } = { method: \"GET\" },\n): Promise {\n const headers = new Headers();\n headers.set(\"Accept\", \"application/json\");\n headers.set(\"Authorization\", `Bearer ${apiToken}`);\n if (init.contentType) headers.set(\"Content-Type\", init.contentType);\n // Le token peut aussi être transmis côté serveur via `api_token`.\n const separator = path.includes(\"?\") ? \"&\" : \"?\";\n const url = `${API_BASE}${path}${separator}api_token=${encodeURIComponent(apiToken)}`;\n return await fetch(url, { method: init.method, headers, body: init.body });\n}\n\n/** Vérifie la validité du token auprès d'Ecotrack. */\nexport async function validateToken(apiToken: string): Promise<{ ok: boolean; status: number }> {\n try {\n const response = await ecotrackFetch(\"/validate/token\", apiToken);\n return { ok: response.ok, status: response.status };\n } catch {\n return { ok: false, status: 0 };\n }\n}\n\n/* ------------------------------------------------------------------ */\n/* Lecture d'un colis */\n/* ------------------------------------------------------------------ */\n\nfunction asRecord(value: unknown): Record | null {\n return value && typeof value === \"object\" && !Array.isArray(value)\n ? (value as Record)\n : null;\n}\n\n/** Clés d'enveloppe possibles autour de la liste de commandes. */\nconst ORDER_KEYS = [\"data\", \"orders\", \"results\", \"items\", \"colis\", \"order\", \"livraisons\", \"rows\"];\n\n/** Clés possibles du numéro de tracking dans une commande. */\nconst TRACKING_KEYS = [\n \"tracking\",\n \"tracking_number\",\n \"trackingNumber\",\n \"code\",\n \"numero\",\n \"num\",\n \"barcode\",\n \"code_barre\",\n \"codebarre\",\n \"code_suivi\",\n \"reference\",\n];\n\nfunction asOrderList(value: unknown): Record[] {\n if (!Array.isArray(value)) return [];\n return value.map(asRecord).filter((item): item is Record => item !== null);\n}\n\nfunction orderTracking(order: Record): string {\n for (const key of TRACKING_KEYS) {\n const value = order[key];\n if (typeof value === \"string\" && value.trim()) return value.trim().toUpperCase();\n if (typeof value === \"number\") return String(value).toUpperCase();\n }\n return \"\";\n}\n\n/** Cherche la liste de commandes même si la réponse est imbriquée sur plusieurs niveaux. */\nfunction collectOrders(payload: unknown, depth = 0): Record[] {\n if (depth > 3) return [];\n\n const list = asOrderList(payload);\n if (list.length > 0) return list;\n\n const root = asRecord(payload);\n if (!root) return [];\n\n // L'objet est déjà une commande (il porte un statut ou un tracking).\n if (extractStatusValue(root) !== \"\" || orderTracking(root) !== \"\") return [root];\n\n for (const key of ORDER_KEYS) {\n const nested = root[key];\n if (Array.isArray(nested)) return asOrderList(nested);\n if (nested && typeof nested === \"object\") {\n const deeper = collectOrders(nested, depth + 1);\n if (deeper.length > 0) return deeper;\n }\n }\n\n // Aucune enveloppe connue : si l'objet est riche, on le traite comme la commande.\n const hasEnvelope = ORDER_KEYS.some((key) => key in root);\n if (!hasEnvelope && Object.keys(root).length >= 3) return [root];\n return [];\n}\n\n/** Noms des clés de premier niveau — diagnostic uniquement, aucune valeur exposée. */\nfunction topLevelKeys(payload: unknown): string[] {\n const root = asRecord(payload);\n if (root) return Object.keys(root).slice(0, 12);\n if (Array.isArray(payload)) return [`[array:${payload.length}]`];\n return [];\n}\n\nfunction pickOrder(payload: unknown, tracking: string): Record | null {\n const orders = collectOrders(payload);\n if (orders.length === 0) return null;\n\n const wanted = tracking.trim().toUpperCase();\n const exact = orders.find((order) => orderTracking(order) === wanted);\n if (exact) return exact;\n\n const withStatus = orders.find((order) => extractStatusValue(order) !== \"\");\n if (withStatus) return withStatus;\n\n // Une seule commande renvoyée pour cette requête : on l'accepte telle quelle.\n return orders.length === 1 ? orders[0] : null;\n}\n\ntype ReadResult =\n | { kind: \"ok\"; payload: unknown }\n | { kind: \"read_error\"; status: number }\n | { kind: \"bad_response\" }\n | { kind: \"network_error\" };\n\nasync function readOrders(apiToken: string, query: string): Promise {\n const path = query ? `/get/orders?${query}` : \"/get/orders\";\n let response: Response;\n try {\n response = await ecotrackFetch(path, apiToken);\n } catch {\n return { kind: \"network_error\" };\n }\n if (!response.ok) return { kind: \"read_error\", status: response.status };\n try {\n return { kind: \"ok\", payload: await response.json() };\n } catch {\n return { kind: \"bad_response\" };\n }\n}\n\n/**\n * Relit un colis et retourne son statut normalisé.\n * Deux variantes de paramètre sont tentées (`tracking` puis `trackings`) :\n * ce sont des lectures, jamais des mutations.\n */\nexport async function findOrder(apiToken: string, tracking: string): Promise {\n const encoded = encodeURIComponent(tracking);\n const queries = [`tracking=${encoded}`, `trackings=${encoded}`];\n let lastPayload: unknown = null;\n let lastErrorStatus: number | null = null;\n let sawSuccess = false;\n\n for (const query of queries) {\n const read = await readOrders(apiToken, query);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") {\n if (read.status >= 500) return { kind: \"read_error\", status: read.status };\n lastErrorStatus = read.status;\n continue;\n }\n\n sawSuccess = true;\n const order = pickOrder(read.payload, tracking);\n if (order) {\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n }\n lastPayload = read.payload;\n }\n\n if (!sawSuccess) return { kind: \"read_error\", status: lastErrorStatus ?? 0 };\n return { kind: \"not_found\", payloadKeys: topLevelKeys(lastPayload) };\n}\n\n/* ------------------------------------------------------------------ */\n/* Validation d'un retour (mutation) */\n/* ------------------------------------------------------------------ */\n\nfunction extractMessage(text: string): string {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.message === \"string\") return parsed.message;\n if (typeof parsed.error === \"string\") return parsed.error;\n } catch {\n /* corps non JSON */\n }\n return \"\";\n}\n\n/**\n * POST /api/v1/valid/returns — endpoint officiel de validation d'un retour.\n * Ne jamais appeler cette fonction sans avoir revérifié l'éligibilité côté serveur.\n */\nexport async function mutateReturn(apiToken: string, tracking: string): Promise {\n let response: Response;\n try {\n response = await ecotrackFetch(\"/valid/returns\", apiToken, {\n method: \"POST\",\n contentType: \"application/json\",\n body: JSON.stringify({ trackings: [tracking] }),\n });\n } catch {\n return { kind: \"network_error\" };\n }\n\n const text = await response.text().catch(() => \"\");\n const emptyBody = text.trim() === \"\";\n let returned: string | null = null;\n if (!emptyBody) {\n try {\n const parsed = JSON.parse(text) as Record;\n if (typeof parsed.returned === \"string\") returned = parsed.returned;\n } catch {\n /* corps non JSON */\n }\n }\n\n // Télémétrie sûre uniquement : jamais de token, jamais de body brut.\n console.log(\n JSON.stringify({\n evt: \"return_validate\",\n httpStatus: response.status,\n returned,\n emptyBody,\n }),\n );\n\n if (response.status === 422) {\n return { kind: \"invalid\", message: extractMessage(text), status: response.status };\n }\n if (!response.ok) return { kind: \"api_error\", status: response.status };\n if (returned === \"success\") return { kind: \"success\" };\n if (returned === \"fail\") return { kind: \"fail\" };\n return { kind: \"unexpected\", status: response.status };\n}/* ------------------------------------------------------------------ */\n/* Liste des retours prêts */\n/* */\n/* L'API officielle n'expose que la recherche PAR TRACKING */\n/* (`GET /api/v1/get/orders?tracking=…`). Aucun endpoint de liste par */\n/* statut n'est documenté : on tente donc d'abord quelques variantes de */\n/* lecture seule, puis on retombe sur la relecture individuelle des */\n/* trackings connus (registre SQLite) avec filtrage côté backend. */\n/* ------------------------------------------------------------------ */\n\nexport type ReadyReturn = {\n tracking: string;\n status: string;\n statusRaw: string;\n};\n\nexport type ReadyListResult = {\n /** `ecotrack_list` = liste obtenue de l'API ; `local_registry` = relecture individuelle. */\n source: \"ecotrack_list\" | \"local_registry\";\n items: ReadyReturn[];\n /** Nombre d'entrées examinées côté serveur. */\n scanned: number;\n /** Trace des tentatives (statuts HTTP, nombres) — jamais de token ni de valeur sensible. */\n diagnostics: string[];\n};\n\n/**\n * Variantes de lecture seule tentées pour découvrir un éventuel mode « liste ».\n * Aucune n'est documentée : elles sont essayées dans l'ordre et la première qui\n * renvoie des colis est retenue. Le détail des réponses est remonté au frontend\n * dans `diagnostics`.\n */\nconst LIST_QUERIES = [\n \"per_page=100&page=1\",\n \"page=1\",\n \"per_page=100\",\n \"limit=100\",\n \"status=retour_recu\",\n \"status_name=retour_recu\",\n \"etat=retour_recu\",\n \"statut=retour_recu\",\n \"statuses[]=retour_recu\",\n \"filter[status]=retour_recu\",\n \"with=status&per_page=100\",\n \"\",\n];\n\nconst MAX_ITEMS = 100;\n\n/**\n * Nombre maximum de pages relues quand un mode « liste » est trouvé.\n * 20 pages × 40 colis ≈ 800 colis : assez pour atteindre des retours anciens\n * si la liste est triée du plus récent au plus ancien.\n */\nconst MAX_PAGES = 20;\n\n/**\n * Filtres de statut testés en priorité. S'ils sont appliqués par l'API, c'est\n * la voie la plus rapide et la plus fiable : une seule requête suffit.\n */\nconst STATUS_PROBES = [\n \"status=retour_recu\",\n \"status=livraison_echoue_recu\",\n \"global_status=retour_recu\",\n \"global_status=livraison_echoue_recu\",\n];\n\n/** Clés dont le nom évoque un statut ou un état de retour (diagnostic uniquement). */\nconst STATUS_HINT = /status|statut|etat|state|libelle|situation|retour|return|transfer/i;\n\n/**\n * Décrit les champs de statut réellement présents dans les colis renvoyés :\n * nom du champ + valeurs distinctes avec leur fréquence.\n * Aucune donnée personnelle (client, téléphone, adresse) n'est incluse.\n */\nfunction describeStatusFields(orders: Record[]): string {\n const buckets = new Map>();\n\n for (const order of orders) {\n for (const [key, value] of Object.entries(order)) {\n if (!STATUS_HINT.test(key)) continue;\n const raw = value === null || value === undefined\n ? \"\"\n : typeof value === \"object\"\n ? \"(objet)\"\n : String(value).trim();\n const text = raw === \"\" ? \"(vide)\" : raw;\n if (text.length > 40) continue;\n if (!buckets.has(key)) buckets.set(key, new Map());\n const bucket = buckets.get(key) as Map;\n bucket.set(text, (bucket.get(text) ?? 0) + 1);\n }\n }\n\n if (buckets.size === 0) return \"aucun champ de statut détecté\";\n\n const parts: string[] = [];\n for (const [key, bucket] of buckets) {\n const values = Array.from(bucket.entries())\n .sort((a, b) => b[1] - a[1])\n .slice(0, 10)\n .map(([value, count]) => `${value}×${count}`)\n .join(\", \");\n parts.push(`${key} = ${values}`);\n }\n return parts.join(\" | \");\n}\n\n/** Complète la première page par les suivantes (lecture seule, plafonnée). */\nasync function collectPages(\n apiToken: string,\n query: string,\n first: Record[],\n diagnostics: string[],\n): Promise[]> {\n const all = [...first];\n if (!/(^|&)page=/.test(query)) return all;\n\n for (let page = 2; page <= MAX_PAGES; page++) {\n const next = query.replace(/(^|&)page=\\d+/, `$1page=${page}`);\n const read = await readOrders(apiToken, next);\n\n if (read.kind === \"network_error\" || read.kind === \"bad_response\") {\n diagnostics.push(`page ${page} → ${read.kind === \"network_error\" ? \"réseau\" : \"corps illisible\"}`);\n break;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`page ${page} → HTTP ${read.status}`);\n break;\n }\n\n const orders = collectOrders(read.payload);\n if (orders.length === 0) {\n diagnostics.push(`page ${page} → vide`);\n break;\n }\n all.push(...orders);\n diagnostics.push(`page ${page} → ${orders.length} colis`);\n if (page === MAX_PAGES) {\n diagnostics.push(\n `limite de ${MAX_PAGES} pages atteinte — des colis plus anciens peuvent manquer`,\n );\n }\n }\n\n return all;\n}\n\n/** Lecture d'un seul colis, sans variante de repli (latence maîtrisée). */\nasync function readOneOrder(apiToken: string, tracking: string): Promise {\n const read = await readOrders(apiToken, `tracking=${encodeURIComponent(tracking)}`);\n if (read.kind === \"network_error\") return { kind: \"network_error\" };\n if (read.kind === \"bad_response\") return { kind: \"bad_response\" };\n if (read.kind === \"read_error\") return { kind: \"read_error\", status: read.status };\n\n const order = pickOrder(read.payload, tracking);\n if (!order) return { kind: \"not_found\", payloadKeys: topLevelKeys(read.payload) };\n\n const statusRaw = extractStatusValue(order);\n return {\n kind: \"found\",\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n order,\n };\n}\n\nfunction toReadyReturn(tracking: string, statusRaw: string): ReadyReturn {\n return {\n tracking: tracking.trim().toUpperCase(),\n statusRaw,\n status: normalizeStatus(statusRaw),\n };\n}\n\n/**\n * Retours actuellement prêts (statut normalisé `retour_recu` ou\n * `livraison_echoue_recu`). Lecture seule uniquement : aucune mutation.\n */\nexport async function listReadyReturns(\n apiToken: string,\n registry: { tracking: string; lastStatus: string }[],\n): Promise {\n const diagnostics: string[] = [];\n\n // 1) Filtres de statut : si l'API les applique, réponse en une requête.\n for (const probe of STATUS_PROBES) {\n const query = `${probe}&per_page=100&page=1`;\n const read = await readOrders(apiToken, query);\n\n if (read.kind === \"network_error\") {\n diagnostics.push(`${query} → réseau`);\n continue;\n }\n if (read.kind === \"bad_response\") {\n diagnostics.push(`${query} → corps illisible`);\n continue;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`${query} → HTTP ${read.status}`);\n continue;\n }\n\n const orders = collectOrders(read.payload);\n const ready = orders\n .map((order) => ({ tracking: orderTracking(order), statusRaw: extractStatusValue(order) }))\n .filter((entry) => entry.tracking !== \"\" && isReturnReadyStatus(entry.statusRaw))\n .map((entry) => toReadyReturn(entry.tracking, entry.statusRaw));\n\n diagnostics.push(`${query} → 200, ${orders.length} colis, ${ready.length} prêt(s)`);\n if (ready.length > 0) {\n return {\n source: \"ecotrack_list\",\n items: dedupe(ready).slice(0, MAX_ITEMS),\n scanned: orders.length,\n diagnostics,\n };\n }\n }\n\n // 2) Mode « liste » général, puis pagination complète.\n for (const query of LIST_QUERIES) {\n const label = query === \"\" ? \"(sans paramètre)\" : query;\n const read = await readOrders(apiToken, query);\n\n if (read.kind === \"network_error\") {\n diagnostics.push(`${label} → réseau`);\n continue;\n }\n if (read.kind === \"bad_response\") {\n diagnostics.push(`${label} → corps illisible`);\n continue;\n }\n if (read.kind === \"read_error\") {\n diagnostics.push(`${label} → HTTP ${read.status}`);\n continue;\n }\n\n const firstPage = collectOrders(read.payload);\n if (firstPage.length === 0) {\n const keys = topLevelKeys(read.payload).join(\", \") || \"—\";\n diagnostics.push(`${label} → 200, 0 colis (clés: ${keys})`);\n continue;\n }\n\n diagnostics.push(`${label} → 200, ${firstPage.length} colis`);\n const orders = await collectPages(apiToken, query, firstPage, diagnostics);\n\n diagnostics.push(`champs: ${Object.keys(orders[0]).slice(0, 40).join(\", \")}`);\n diagnostics.push(`statuts détectés: ${describeStatusFields(orders)}`);\n\n const ready = orders\n .map((order) => ({ tracking: orderTracking(order), statusRaw: extractStatusValue(order) }))\n .filter((entry) => entry.tracking !== \"\" && isReturnReadyStatus(entry.statusRaw))\n .map((entry) => toReadyReturn(entry.tracking, entry.statusRaw));\n\n diagnostics.push(`→ ${orders.length} colis relus, ${ready.length} prêt(s)`);\n return {\n source: \"ecotrack_list\",\n items: dedupe(ready).slice(0, MAX_ITEMS),\n scanned: orders.length,\n diagnostics,\n };\n }\n\n // 3) Repli : relecture individuelle des trackings connus, filtrage backend.\n const items: ReadyReturn[] = [];\n for (const entry of registry) {\n const lookup = await readOneOrder(apiToken, entry.tracking);\n if (lookup.kind !== \"found\") continue;\n if (!isReturnReadyStatus(lookup.statusRaw)) continue;\n items.push(toReadyReturn(lookup.tracking, lookup.statusRaw));\n }\n diagnostics.push(\n `registre local → ${registry.length} tracking(s) relu(s), ${items.length} prêt(s)`,\n );\n return { source: \"local_registry\", items: dedupe(items).slice(0, MAX_ITEMS), scanned: registry.length, diagnostics };\n}\n\nfunction dedupe(items: ReadyReturn[]): ReadyReturn[] {\n const seen = new Set();\n const result: ReadyReturn[] = [];\n for (const item of items) {\n if (seen.has(item.tracking)) continue;\n seen.add(item.tracking);\n result.push(item);\n }\n return result;\n}",[],[275,284],"0b1e17d8-2f63-49de-9348-e0fefc13be5c","db.ts","6bda7e38-b154-11f1-91d7-1607ee4eb77e",47,["D",1789513419610],"/**\n * Accès SQLite (base projet, isolée des autres applications SAMI.TECH).\n *\n * Tables :\n * app_settings (key, value) -> schéma 3x3 + credentials Ecotrack\n * app_sessions (token_hash, expires_at, created_at) -> sessions du cookie sami_access\n * idx_app_sessions_expires -> purge / lookup rapide\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nlet schemaReady: Promise | null = null;\n\n/** Crée les tables et l'index si nécessaire. Idempotent, exécuté une seule fois. */\nexport function ensureSchema(): Promise {\n if (!schemaReady) {\n schemaReady = sqlite\n .batch([\n `CREATE TABLE IF NOT EXISTS app_settings (\n key TEXT PRIMARY KEY,\n value TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_sessions (\n token_hash TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at INTEGER NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_app_sessions_expires ON app_sessions (expires_at)`,\n `CREATE TABLE IF NOT EXISTS seen_trackings (\n tracking TEXT PRIMARY KEY,\n first_seen_at INTEGER NOT NULL,\n last_seen_at INTEGER NOT NULL,\n last_status TEXT NOT NULL DEFAULT ''\n )`,\n `CREATE INDEX IF NOT EXISTS idx_seen_trackings_last_seen ON seen_trackings (last_seen_at)`,\n ])\n .then(() => undefined)\n .catch((error) => {\n schemaReady = null;\n throw error;\n });\n }\n return schemaReady;\n}\n\n/** Lit une valeur de configuration. */\nexport async function getSetting(key: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT value FROM app_settings WHERE key = ?\",\n args: [key],\n });\n const row = result.rows[0] as unknown as { value?: string } | undefined;\n return row?.value ?? null;\n}\n\n/** Écrit (ou remplace) une valeur de configuration. */\nexport async function setSetting(key: string, value: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `INSERT INTO app_settings (key, value) VALUES (?, ?)\n ON CONFLICT(key) DO UPDATE SET value = excluded.value`,\n args: [key, value],\n });\n}\n\n/** Supprime une valeur de configuration. */\nexport async function deleteSetting(key: string): Promise {\n await ensureSchema();\n await sqlite.execute({ sql: \"DELETE FROM app_settings WHERE key = ?\", args: [key] });\n}/* ------------------------------------------------------------------ */\n/* Registre des trackings déjà vus */\n/* */\n/* L'API Ecotrack n'expose pas de recherche par statut : on ne peut */\n/* relire un colis que par son numéro de tracking. Ce registre local */\n/* (SQLite) conserve les trackings déjà vérifiés par l'application afin */\n/* de pouvoir les relire côté serveur et filtrer ceux qui sont prêts. */\n/* ------------------------------------------------------------------ */\n\nconst REGISTRY_TTL_MS = 120 * 24 * 60 * 60 * 1000; // 120 jours\n\n/** Mémorise (ou met à jour) un tracking vérifié avec succès. */\nexport async function rememberTracking(tracking: string, status: string): Promise {\n const clean = tracking.trim().toUpperCase();\n if (!clean) return;\n await ensureSchema();\n const now = Date.now();\n await sqlite.execute({\n sql: `INSERT INTO seen_trackings (tracking, first_seen_at, last_seen_at, last_status)\n VALUES (?, ?, ?, ?)\n ON CONFLICT(tracking) DO UPDATE SET\n last_seen_at = excluded.last_seen_at,\n last_status = excluded.last_status`,\n args: [clean, now, now, status ?? \"\"],\n });\n}\n\n/** Trackings connus les plus récents (les plus anciens sont purgés). */\nexport async function listRecentTrackings(\n limit: number,\n): Promise<{ tracking: string; lastStatus: string }[]> {\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM seen_trackings WHERE last_seen_at < ?\",\n args: [Date.now() - REGISTRY_TTL_MS],\n });\n const result = await sqlite.execute({\n sql: \"SELECT tracking, last_status FROM seen_trackings ORDER BY last_seen_at DESC LIMIT ?\",\n args: [limit],\n });\n return (result.rows as unknown as { tracking: string; last_status: string }[]).map((row) => ({\n tracking: row.tracking,\n lastStatus: row.last_status ?? \"\",\n }));\n}",[],[275,292],"45232bfa-011c-48a2-9b91-3626695b9180","access.ts","7673ba6c-b154-11f1-ac17-1607ee4eb77e",["D",1789511174778],"/**\n * Verrouillage de l'application par schéma Android 3x3 + sessions.\n *\n * - Le schéma est stocké sous forme de hash PBKDF2-SHA256 salé (jamais en clair).\n * - Les sessions vivent en base (app_sessions) et sont portées par le cookie\n * `sami_access` (HttpOnly, Secure, ~12 h). Le cookie ne contient qu'un token\n * aléatoire : seul son SHA-256 est stocké.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { ensureSchema, getSetting, setSetting } from \"./db.ts\";\n\nconst PATTERN_KEY = \"access_pattern_hash\";\nconst SESSION_COOKIE = \"sami_access\";\nconst SESSION_TTL_MS = 12 * 60 * 60 * 1000; // ~12 heures\nconst PBKDF2_ITERATIONS = 100_000;\nconst encoder = new TextEncoder();\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction randomHex(byteLength: number): string {\n const buffer = new Uint8Array(byteLength);\n crypto.getRandomValues(buffer);\n return toHex(buffer);\n}\n\nasync function sha256Hex(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return toHex(new Uint8Array(digest));\n}\n\nasync function pbkdf2Hex(secret: string, salt: string, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(secret), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt: encoder.encode(salt), iterations },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\n\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** Vrai si un schéma a déjà été configuré. */\nexport async function isPatternConfigured(): Promise {\n return (await getSetting(PATTERN_KEY)) !== null;\n}\n\n/** Enregistre un nouveau schéma et invalide toutes les sessions existantes. */\nexport async function setPattern(pattern: string): Promise {\n const salt = randomHex(16);\n const hash = await pbkdf2Hex(pattern, salt, PBKDF2_ITERATIONS);\n await setSetting(PATTERN_KEY, `pbkdf2$${PBKDF2_ITERATIONS}$${salt}$${hash}`);\n await deleteAllSessions();\n}\n\n/** Vérifie un schéma saisi contre le hash stocké. */\nexport async function verifyPattern(pattern: string): Promise {\n const stored = await getSetting(PATTERN_KEY);\n if (!stored) return false;\n const [scheme, iterationsRaw, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterationsRaw || !salt || !hash) return false;\n const candidate = await pbkdf2Hex(pattern, salt, Number(iterationsRaw));\n return timingSafeEqual(candidate, hash);\n}\n\n/** Crée une session et retourne le token à poser en cookie. */\nexport async function createSession(): Promise<{ token: string; maxAge: number }> {\n await ensureSchema();\n const token = randomHex(32);\n const tokenHash = await sha256Hex(token);\n const now = Date.now();\n await sqlite.execute({\n sql: \"INSERT INTO app_sessions (token_hash, expires_at, created_at) VALUES (?, ?, ?)\",\n args: [tokenHash, now + SESSION_TTL_MS, now],\n });\n return { token, maxAge: Math.floor(SESSION_TTL_MS / 1000) };\n}\n\n/** Vrai si la requête porte une session valide et non expirée. */\nexport async function hasValidSession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return false;\n await ensureSchema();\n const tokenHash = await sha256Hex(token);\n const result = await sqlite.execute({\n sql: \"SELECT expires_at FROM app_sessions WHERE token_hash = ?\",\n args: [tokenHash],\n });\n const row = result.rows[0] as unknown as { expires_at?: number } | undefined;\n if (!row) return false;\n if (Number(row.expires_at) < Date.now()) {\n await sqlite.execute({ sql: \"DELETE FROM app_sessions WHERE token_hash = ?\", args: [tokenHash] });\n return false;\n }\n return true;\n}\n\n/** Invalide la session portée par la requête. */\nexport async function destroySession(request: Request): Promise {\n const token = readCookie(request, SESSION_COOKIE);\n if (!token) return;\n await ensureSchema();\n await sqlite.execute({\n sql: \"DELETE FROM app_sessions WHERE token_hash = ?\",\n args: [await sha256Hex(token)],\n });\n}\n\n/** Invalide toutes les sessions (purge à la reconfiguration du schéma). */\nexport async function deleteAllSessions(): Promise {\n await ensureSchema();\n await sqlite.execute(\"DELETE FROM app_sessions\");\n}\n\n/** Garde-fou : retourne une réponse 401 si la session est absente, sinon null. */\nexport async function requireSession(request: Request): Promise {\n if (await hasValidSession(request)) return null;\n return Response.json({ ok: false, code: \"UNAUTHORIZED\" }, { status: 401 });\n}\n\nexport function sessionCookieHeader(token: string, maxAge: number): string {\n return `${SESSION_COOKIE}=${token}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=${maxAge}`;\n}\n\nexport function clearCookieHeader(): string {\n return `${SESSION_COOKIE}=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`;\n}\n\nfunction readCookie(request: Request, name: string): string | null {\n const header = request.headers.get(\"cookie\") ?? \"\";\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) return part.slice(index + 1).trim();\n }\n return null;\n}",[],[275,300],"ad65941b-e0c0-4a5b-89cf-11fa973d849a",["D",1789511143425],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Scanner QR retours Ecotrack / OM Express + validation","imageUrl","userId","0afb5d64-ebeb-4598-bd32-72c469e46178","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0a729-dd66-7509-8ac1-c1c985b77337","tursoName","ad65941be0c04a5b89cf11fa973d849a","tursoHostname","ad65941be0c04a5b89cf11fa973d849a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789609258211],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_363":359},"org",{"_11":12,"_356":357,"_358":359,"_316":317,"_360":361,"_362":58},"branch",{"_17":286,"_13":16,"_38":46,"_348":306,"_349":-5,"_350":-5,"_351":-5,"_352":-5,"_353":-5,"_354":14,"_355":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sam rad","avatar","https://lh3.googleusercontent.com/a/ACg8ocLICX6mI-c9kDJUPFWRkbqww500mXryFODjCM8HOcTYTBsqIA=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_38":306,"_13":14,"_51":484,"_308":-5,"_309":58,"_310":311,"_312":311,"_313":314,"_315":-5,"_316":317,"_318":100,"_319":50,"_320":-5,"_321":-5,"_322":66,"_323":324,"_325":326,"_327":328,"_329":485,"_331":-5,"_332":333,"_334":333,"_335":336,"_337":336,"_338":336,"_339":333,"_340":333,"_341":486,"_343":487,"_345":488,"_347":58},[403,407,425,428,429],"files",[403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,419,420,421,422,423,424,425,426,427,428,429],"counts",{"_394":66,"_395":120,"_396":66,"_32":397,"_398":399},[384,385,386,387,388],{"_38":90,"_13":19,"_41":44,"_43":-5,"_45":46,"_47":73,"_49":50,"_51":91,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_18":383},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],{"_38":84,"_13":85,"_41":86,"_43":44,"_45":46,"_47":87,"_49":50,"_51":88,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_18":393},{"_38":77,"_13":78,"_41":79,"_43":44,"_45":46,"_47":80,"_49":50,"_51":81,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_18":392},{"_38":70,"_13":71,"_41":72,"_43":44,"_45":46,"_47":73,"_49":50,"_51":74,"_17":66,"_54":24,"_55":75,"_57":58,"_59":-5,"_18":391},{"_38":61,"_13":62,"_41":63,"_43":44,"_45":46,"_47":64,"_49":50,"_51":65,"_17":66,"_54":67,"_55":68,"_57":58,"_59":-5,"_18":390},{"_38":39,"_13":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_17":53,"_54":24,"_55":56,"_57":58,"_59":-5,"_18":389},[19,40],[19,62],[19,71],[19,78],[19,85],"pulls","branches","forks",{"_400":66,"_402":66},"connections",{"_400":66,"_401":66},"count","unfilledCount","emptyCount",{"_38":274,"_13":275,"_41":276,"_43":-5,"_45":46,"_47":222,"_49":50,"_51":277,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":482,"_18":483},{"_38":299,"_13":300,"_41":301,"_43":276,"_45":46,"_47":53,"_49":50,"_51":302,"_17":66,"_54":67,"_55":303,"_57":58,"_59":-5,"_106":480,"_18":481},{"_38":291,"_13":292,"_41":293,"_43":276,"_45":46,"_47":294,"_49":50,"_51":295,"_17":129,"_54":67,"_55":296,"_57":58,"_59":-5,"_106":478,"_18":479},{"_38":283,"_13":284,"_41":285,"_43":276,"_45":46,"_47":286,"_49":50,"_51":287,"_17":204,"_54":67,"_55":288,"_57":58,"_59":-5,"_106":476,"_18":477},{"_38":90,"_13":19,"_41":44,"_43":-5,"_45":46,"_47":73,"_49":50,"_51":142,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":474,"_18":475},{"_38":84,"_13":85,"_41":86,"_43":44,"_45":46,"_47":87,"_49":50,"_51":180,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":472,"_18":473},{"_38":265,"_13":266,"_41":267,"_43":86,"_45":46,"_47":268,"_49":50,"_51":269,"_17":270,"_54":67,"_55":271,"_57":58,"_59":-5,"_106":470,"_18":471},{"_38":257,"_13":258,"_41":259,"_43":86,"_45":46,"_47":260,"_49":50,"_51":261,"_17":66,"_54":67,"_55":262,"_57":58,"_59":-5,"_106":468,"_18":469},{"_38":249,"_13":250,"_41":251,"_43":86,"_45":46,"_47":252,"_49":50,"_51":253,"_17":66,"_54":67,"_55":254,"_57":58,"_59":-5,"_106":466,"_18":467},{"_38":242,"_13":243,"_41":244,"_43":86,"_45":46,"_47":87,"_49":50,"_51":245,"_17":66,"_54":67,"_55":246,"_57":58,"_59":-5,"_106":464,"_18":465},{"_38":234,"_13":235,"_41":236,"_43":86,"_45":46,"_47":237,"_49":50,"_51":238,"_17":120,"_54":67,"_55":239,"_57":58,"_59":-5,"_106":462,"_18":463},{"_38":226,"_13":227,"_41":228,"_43":86,"_45":46,"_47":229,"_49":50,"_51":230,"_17":66,"_54":67,"_55":231,"_57":58,"_59":-5,"_106":460,"_18":461},{"_38":217,"_13":218,"_41":219,"_43":86,"_45":46,"_47":220,"_49":50,"_51":221,"_17":222,"_54":67,"_55":223,"_57":58,"_59":-5,"_106":458,"_18":459},{"_38":209,"_13":210,"_41":211,"_43":86,"_45":46,"_47":212,"_49":50,"_51":213,"_17":80,"_54":67,"_55":214,"_57":58,"_59":-5,"_106":456,"_18":457},{"_38":201,"_13":202,"_41":203,"_43":86,"_45":46,"_47":204,"_49":50,"_51":205,"_17":66,"_54":67,"_55":206,"_57":58,"_59":-5,"_106":454,"_18":455},{"_38":193,"_13":194,"_41":195,"_43":86,"_45":46,"_47":196,"_49":50,"_51":197,"_17":120,"_54":67,"_55":198,"_57":58,"_59":-5,"_106":452,"_18":453},{"_38":77,"_13":78,"_41":79,"_43":44,"_45":46,"_47":80,"_49":50,"_51":159,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":450,"_18":451},{"_38":172,"_13":173,"_41":174,"_43":79,"_45":46,"_47":175,"_49":50,"_51":176,"_17":129,"_54":67,"_55":177,"_57":58,"_59":-5,"_106":448,"_18":449},{"_38":164,"_13":165,"_41":166,"_43":79,"_45":46,"_47":167,"_49":50,"_51":168,"_17":120,"_54":67,"_55":169,"_57":58,"_59":-5,"_106":446,"_18":447},{"_38":70,"_13":71,"_41":72,"_43":44,"_45":46,"_47":73,"_49":50,"_51":156,"_17":66,"_54":24,"_55":75,"_57":58,"_59":-5,"_106":444,"_18":445},{"_38":61,"_13":62,"_41":63,"_43":44,"_45":46,"_47":64,"_49":50,"_51":153,"_17":66,"_54":67,"_55":68,"_57":58,"_59":-5,"_106":442,"_18":443},{"_38":39,"_13":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":150,"_17":53,"_54":24,"_55":56,"_57":58,"_59":-5,"_106":440,"_18":441},{"_38":117,"_13":118,"_41":119,"_43":-5,"_45":46,"_47":120,"_49":50,"_51":121,"_17":66,"_54":82,"_55":-5,"_57":58,"_59":-5,"_106":438,"_18":439},{"_38":134,"_13":135,"_41":136,"_43":119,"_45":46,"_47":137,"_49":50,"_51":138,"_17":120,"_54":67,"_55":139,"_57":58,"_59":-5,"_106":436,"_18":437},{"_38":126,"_13":127,"_41":128,"_43":119,"_45":46,"_47":129,"_49":50,"_51":130,"_17":66,"_54":67,"_55":131,"_57":58,"_59":-5,"_106":434,"_18":435},{"_38":109,"_13":110,"_41":111,"_43":-5,"_45":46,"_47":112,"_49":50,"_51":113,"_17":66,"_54":24,"_55":114,"_57":58,"_59":-5,"_106":432,"_18":433},{"_38":98,"_13":99,"_41":100,"_43":-5,"_45":46,"_47":101,"_49":50,"_51":102,"_17":103,"_54":104,"_55":105,"_57":58,"_59":-5,"_106":430,"_18":431},[],[99],[],[110],[],[118,127],[],[118,135],[426,427],[118],[],[19,40],[],[19,62],[],[19,71],[],[19,78,165],[],[19,78,173],[420,421],[19,78],[],[19,85,194],[],[19,85,202],[],[19,85,210],[],[19,85,218],[],[19,85,227],[],[19,85,235],[],[19,85,243],[],[19,85,250],[],[19,85,258],[],[19,85,266],[409,410,411,412,413,414,415,416,417,418],[19,85],[408,419,422,423,424],[19],[],[275,284],[],[275,292],[],[275,300],[404,405,406],[275],["D",1789511143425],["D",1789609258211],{"_11":12,"_363":359},{"_11":12,"_356":357,"_358":359,"_316":317,"_360":361,"_362":58},{"_17":286,"_13":16,"_38":46,"_348":306,"_349":-5,"_350":-5,"_351":-5,"_352":-5,"_353":-5,"_354":14,"_355":12},"ctx",{"_341":-5,"_380":522,"_523":524,"_525":526,"_527":58,"_528":58,"_529":58,"_530":50,"_531":-5,"_532":-7,"_533":-7,"_534":66,"_535":58,"_536":58,"_537":-5,"_538":58,"_539":58,"_540":58,"_541":-5},"ENV",{"_493":494,"_495":496,"_497":16,"_498":499,"_500":501,"_502":503,"_504":505,"_506":507,"_508":509,"_510":511,"_512":513,"_514":515,"_516":517,"_518":519,"_520":521},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]