From bd604d28b85a658aa3ed8c40b440612d15c9434c Mon Sep 17 00:00:00 2001
From: Nicolas Cantu <nicolas.cantu@pm.me>
Date: Thu, 16 Apr 2026 10:07:17 +0200
Subject: [PATCH] refactor(deploy): use lecoffreio for nested secrets symlinks
 (not notary)

- deploy-conf-handling: symlink sites lecoffreio|enso|genealogie
- pousse: build message lists lecoffreio
- kogus docs: align mandatory secrets wording
---
 deploy/lib/deploy-conf-handling.sh | 6 +++---
 deploy/pousse.sh                   | 2 +-
 projects/kogus/docs/README.md      | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/deploy/lib/deploy-conf-handling.sh b/deploy/lib/deploy-conf-handling.sh
index 85374aa..7a44323 100644
--- a/deploy/lib/deploy-conf-handling.sh
+++ b/deploy/lib/deploy-conf-handling.sh
@@ -30,8 +30,8 @@ ia_dev_deploy_secrets_export_from_conf() {
 
 # ia_dev_deploy_ensure_nested_secrets_symlinks <secrets_parent> <env>
 # LeCoffre connect-db-paths expects `.secrets/<site>/<env>/` under secrets_parent. ia_dev conf often has a flat `<env>/` tree only.
-# For each site in notary, enso, genealogie: if `<secrets_parent>/<site>/<env>` is missing and `<secrets_parent>/<env>` is a directory,
-# create `<site>/<env>` as a symlink to `../<env>` (same convention as a manual `ln -sfn ../pprod notary/pprod`).
+# For each site in lecoffreio, enso, genealogie: if `<secrets_parent>/<site>/<env>` is missing and `<secrets_parent>/<env>` is a directory,
+# create `<site>/<env>` as a symlink to `../<env>` (same convention as a manual `ln -sfn ../pprod lecoffreio/pprod`).
 # Skips a site when a real (non-symlink) directory already exists at the nested path.
 ia_dev_deploy_ensure_nested_secrets_symlinks() {
 	local secrets_parent="${1:?}"
@@ -47,7 +47,7 @@ ia_dev_deploy_ensure_nested_secrets_symlinks() {
 		return 0
 	fi
 	local site nested
-	for site in notary enso genealogie; do
+	for site in lecoffreio enso genealogie; do
 		nested="${secrets_parent}/${site}/${env_name}"
 		if [[ -d "$nested" && ! -L "$nested" ]]; then
 			continue
diff --git a/deploy/pousse.sh b/deploy/pousse.sh
index 339bcb6..d41d480 100755
--- a/deploy/pousse.sh
+++ b/deploy/pousse.sh
@@ -148,7 +148,7 @@ if [[ ${#build_dirs[@]} -gt 0 ]]; then
 		fi
 		build_basename="$(basename "$abs_dir")"
 		if [[ -z "${NEXT_PUBLIC_SITE_CODE:-}" && ( "$build_basename" == "front-common" || "$build_basename" == "lecoffre-front-main" ) ]]; then
-			echo "[pousse] Building ${dir} (npm run build:all-sites: notary, enso, genealogie)..."
+			echo "[pousse] Building ${dir} (npm run build:all-sites: lecoffreio, enso, genealogie)..."
 			(cd "$abs_dir" && npm run build:all-sites) || {
 				echo "[pousse][ERROR] build:all-sites failed in ${dir}" >&2
 				exit 1
diff --git a/projects/kogus/docs/README.md b/projects/kogus/docs/README.md
index d23704c..9696245 100644
--- a/projects/kogus/docs/README.md
+++ b/projects/kogus/docs/README.md
@@ -22,7 +22,7 @@ Ces fichiers **ne sont pas** dans **`projects/kogus/docs/`** (ni dans le wiki) :
 | Fichier (nom relatif, voir `<env>`) | Rôle |
 |-------------------------------------|--------|
 | **`role-permissions-matrix-<env>.json`** | Injection / export-import de la **matrice des droits** (`role_permissions_matrix`) — API **back-admin**, voir `docs/features/secrets-devai-kogus-sites-and-imports.md`. |
-| **`office-deed-catalog-<env>.json`** | **Catalogue actes** / types de documents par bureau — **absent tant que non exporté** via **back-admin** `POST /api/office-deed-catalog/export-to-secrets`. Chemin sur le clone LeCoffre : **`.secrets/<site>/<env>/office-deed-catalog-<env>.json`** (ex. `.secrets/lecoffreio/test/office-deed-catalog-test.json`). **Pas** sous un dossier disque nommé **`notary`** : le code mappe **`notary` → `lecoffreio`**. Vérification : **GET** `/api/site-config/file-status?env=&site=`. |
+| **`office-deed-catalog-<env>.json`** | **Catalogue actes** — obligatoire pour **`deploy-site.sh`** (manifeste `site_env_required`). Export depuis la base : **back-admin** `POST /api/office-deed-catalog/export-to-secrets` ou lot **`POST /api/site-mandatory-artifacts/export-to-secrets`**. Chemin : **`.secrets/<site>/<env>/office-deed-catalog-<env>.json`** (ex. `.secrets/lecoffreio/test/office-deed-catalog-test.json`). Dossier disque **`lecoffreio`** (plus de segment **`notary`** côté **ia_dev** pour les symlinks secrets : voir **`ia_dev/deploy/lib/deploy-conf-handling.sh`**). Vérification : **GET** `/api/site-config/file-status?env=&site=`. |
 | **`site-config-<env>.json`** | **Configuration de la ligne** `sites` (intégrations, hôtes, drapeaux) — export/import **back-admin**. |
 | **`seed-site-texts-<env>.ts`** | **Textes i18n** publiés via `site_texts` ; **y compris les libellés et listes liés aux tiers** (clés `thirdParty.*`, `forms.thirdParty.*`, etc., selon `docs/Deployment.md` / seeds LeCoffre). |