update signing properties + gitlab ci

.gitignore

@@ -0,0 +1,30 @@
+# Go backend
+backend/bin/
+backend/uploads/*
+!backend/uploads/.gitkeep
+
+# Env local (jamais commité — cf. backend/.env.example)
+.env
+backend/.env
+
+# Uploads locaux transitoires (racine / backend)
+uploads/
+backend/uploads/*
+
+# Android / Gradle
+mobile-kotlin/local.properties
+mobile-kotlin/.gradle/
+mobile-kotlin/.kotlin/
+**/build/
+*.iml
+.idea/
+
+# Signature release Android (jamais commité)
+signing.properties
+*.jks
+*.keystore
+!signing.properties.example
+
+# Artifacts
+*.apk
+dist/

.gitlab-ci.yml

@@ -0,0 +1,196 @@
+# Pipeline GitLab pour Kazier — CI + Release.
+#
+# Prérequis runner :
+#   - Un runner avec executor Docker pour les jobs d'images (postgres service,
+#     docker:dind). Les jobs Android utilisent $ANDROID_IMAGE (défaut
+#     cimg/android) ; remplacez par l'image installée sur vos workers.
+#
+# Variables CI/CD à définir (Settings > CI/CD > Variables) :
+#   - RELEASE_KEYSTORE_B64   base64 du keystore release Android (jamais en clair)
+#   - SIGNING_STORE_PASSWORD SIGNING_KEY_ALIAS SIGNING_KEY_PASSWORD
+#   - GITLAB_API_TOKEN       token (scope api, write_repository) pour créer la GitLab Release
+#   - DOCKERHUB_USER         DOCKERHUB_TOKEN  PAT Docker Hub (push public)
+#
+# Publication : à chaque tag vX.Y.Z → GitLab Release (APK attaché, latest +
+# historique) + image $CI_REGISTRY + image Docker Hub (docker.io/thirdshop/kasier).
+
+stages:
+  - lint
+  - test
+  - build
+  - docker
+  - release
+
+variables:
+  GO_IMAGE: "golang:1.26-alpine"
+  POSTGRES_IMAGE: "postgres:17-alpine"
+  ANDROID_IMAGE: "cimg/android:2024.01"
+  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
+  CGO_ENABLED: "0"
+  DOCKERHUB_IMAGE: "docker.io/thirdshop/kasier"
+  GLAB_VERSION: "1.118.0"
+
+default:
+  interruptible: true
+  retry:
+    max: 1
+
+# ---------------------------------------------------------------- lint ----
+lint-backend:
+  stage: lint
+  image: $GO_IMAGE
+  script:
+    - go mod download
+    - go vet ./...
+    - go install honnef.co/go/tools/cmd/staticcheck@latest && staticcheck ./...
+
+lint-mobile:
+  stage: lint
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - cd mobile-kotlin && ./gradlew :app:lint -q
+
+# ---------------------------------------------------------------- test ----
+test-backend:
+  stage: test
+  image: $GO_IMAGE
+  services:
+    - name: $POSTGRES_IMAGE
+      alias: postgres
+  variables:
+    POSTGRES_DB: kazier_test
+    POSTGRES_USER: kazier
+    POSTGRES_PASSWORD: kazier
+    TEST_DATABASE_URL: postgres://kazier:kazier@postgres:5432/kazier_test?sslmode=disable
+  script:
+    - mkdir -p .go-cache && export GOPATH="$CI_PROJECT_DIR/.go-cache"
+    - go mod download
+    - go test ./...
+  cache:
+    key: go-cache
+    paths:
+      - .go-cache
+
+test-mobile:
+  stage: test
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - cd mobile-kotlin && ./gradlew :app:testDebugUnitTest -q
+
+# ---------------------------------------------------------------- build ----
+build-backend:
+  stage: build
+  image: $GO_IMAGE
+  script:
+    - export VERSION=$(cat VERSION)
+    - mkdir -p backend/bin
+    - cd backend && CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o bin/kazier-server cmd/server/main.go
+    - ./bin/kazier-server --version
+  artifacts:
+    paths:
+      - backend/bin/kazier-server
+    expire_in: 1 week
+
+# --------------------------------------------------------------- docker ----
+docker:
+  stage: docker
+  image: docker:27
+  services:
+    - name: docker:27-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+    IMAGE_TAG: "$CI_COMMIT_TAG"
+  script:
+    - export IMAGE_TAG="${IMAGE_TAG:-$CI_COMMIT_REF_SLUG}"
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+    - docker build
+      --build-arg VERSION="$(cat VERSION)"
+      --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+      -t "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
+      ./backend
+    - docker push "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
+    - docker run --rm "$CI_REGISTRY_IMAGE:$IMAGE_TAG" --version
+  needs: ["build-backend"]
+  rules:
+    - if: $CI_COMMIT_TAG
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+
+# -------------------------------------------------------------- release ----
+release-apk:
+  stage: release
+  image: $ANDROID_IMAGE
+  cache:
+    key: gradle-cache
+    paths:
+      - .gradle-home/caches
+      - .gradle-home/wrapper
+  script:
+    - export VERSION=$(cat VERSION)
+    - cd mobile-kotlin
+    - |
+      if [ -n "${RELEASE_KEYSTORE_B64:-}" ]; then
+        echo "$RELEASE_KEYSTORE_B64" | base64 -d > app/release.keystore
+        cat > app/signing.properties <<EOF
+      storeFile=release.keystore
+      storePassword=${SIGNING_STORE_PASSWORD:?}
+      keyAlias=${SIGNING_KEY_ALIAS:?}
+      keyPassword=${SIGNING_KEY_PASSWORD:?}
+      EOF
+      else
+        echo "RELEASE_KEYSTORE_B64 manquant — release non signée." >&2
+        exit 1
+      fi
+    - ./gradlew :app:assembleRelease -q
+    - cd "$CI_PROJECT_DIR"
+    - |
+      # glab : création de la GitLab Release + upload de l'APK en asset.
+      curl -sSLf \
+        "https://gitlab.com/gitlab-org/cli/-/releases/v${GLAB_VERSION}/downloads/glab_${GLAB_VERSION}_linux_amd64.tar.gz" \
+        | tar xz --strip-components=1 -C /usr/local/bin bin/glab
+    - glab --version
+    - export GITLAB_TOKEN="$GITLAB_API_TOKEN"
+    - glab release create "v$VERSION"
+      --name "Kazier v$VERSION"
+      --notes-file CHANGELOG.md
+      "mobile-kotlin/app/build/outputs/apk/release/app-release.apk"
+  needs: ["docker"]
+  rules:
+    - if: $CI_COMMIT_TAG
+
+release-docker:
+  stage: release
+  image: docker:27
+  services:
+    - name: docker:27-dind
+      alias: docker
+  variables:
+    DOCKER_HOST: tcp://docker:2375
+    DOCKER_TLS_CERTDIR: ""
+  script:
+    - export VERSION=$(cat VERSION)
+    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
+    - docker pull "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG"
+    - |
+      : "${DOCKERHUB_USER:?DOCKERHUB_USER manquant}"
+      : "${DOCKERHUB_TOKEN:?DOCKERHUB_TOKEN manquant}"
+      echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USER" --password-stdin docker.io
+      IMAGE="$DOCKERHUB_IMAGE"
+      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:$CI_COMMIT_TAG"
+      docker tag "$CI_REGISTRY_IMAGE:$CI_COMMIT_TAG" "$IMAGE:latest"
+      docker push "$IMAGE:$CI_COMMIT_TAG"
+      docker push "$IMAGE:latest"
+  needs: ["docker"]
+  rules:
+    - if: $CI_COMMIT_TAG

AGENTS.md

@@ -1,4 +1,4 @@
-# VaultDrop
+# Kazier
 
 ## Project Status
 
@@ -50,7 +50,7 @@ Tests mobiles : JVM unit tests dans `app/src/test` (JUnit + Robolectric + Room i
 
 ## Frontend Structure (mobile-kotlin)
 
-- Entry point: `app/src/main/java/com/vaultdrop/mobile/VaultDropApplication.kt` (Hilt + `HiltWorkerFactory`) + `MainActivity.kt` (Hilt) ; navigation Compose dans `ui/navigation/` (`NavGraph.kt`, `VaultDropApp.kt`)
+- Entry point: `app/src/main/java/com/kazier/mobile/KazierApplication.kt` (Hilt + `HiltWorkerFactory`) + `MainActivity.kt` (Hilt) ; navigation Compose dans `ui/navigation/` (`NavGraph.kt`, `KazierApp.kt`)
 - Data layer — `data/`:
   - `data/local/` — Room SQLite (DB `dot.db`, **version 7**, `Migrations.kt` : tables `folders`, `files`, `user_preferences`, `pending_operations`) : entités Folder/File/UserPreference/PendingOperation, DAO, tri (`FileOrdering`) ; flag `processed` sur `files` (mode review « traiter », local au device, **gate de sync** : un fichier pas encore traité n'est jamais poussé) ; outbox transactionnel `pending_operations` (v7)
   - `data/remote/` — Retrofit/Moshi : `ApiService.kt` + `dto/Dtos.kt` = **contrat HTTP** (`{ data, meta }`, erreurs `{ error: { code, message } }`) ; `ApiClient.kt` normalise les réponses ; interceptors OkHttp (`AuthInterceptor`, `ServerUrlInterceptor`)

CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog
+
+Toutes les modifications notables de Kazier sont documentées ici.
+Le format suit [Keep a Changelog](https://keepachangelog.com/fr/1.1.0/) et le versioning est [SemVer](https://semver.org/lang/fr/).
+
+## [Unreleased]
+
+### Changé
+- **Renommage : VaultDrop → Kazier.** Marque, package Android (`com.kazier.mobile`), module Go (`github.com/kazier/backend`), binaire/image `kazier-server`, creds Postgres par défaut. Le code interne `dot.db` est conservé.
+
+### Ajouté
+- Pipeline de release CI (GitLab) : lint, tests backend/mobile, build Docker, signature APK release, publication GitLab Release + Docker Hub.
+- `backend/Dockerfile` multi-stage : image de production avec Tesseract (fra+eng) embarqué, user non-root, labels OCI.
+- Service `backend` actif dans `docker-compose.yml` (déploiement conteneurisé).
+- Signature release Android (`signing.properties` non commité, `assembleRelease`).
+- Scripts `mise build:release`, `mise docker:build`, `mise release`.
+- Licence AGPLv3, badge README, `CHANGELOG.md`.
+- Versioning Android aligné sur le `VERSION` racine (versionCode dérivé).
+
+### Corrigé
+- Docs : en-tête `docs/api-v1.md` (référence à l'ancien client Expo remplacée par le client Kotlin), quickstart et docker de la doc Starlight.
+- `.gitignore` racine (uploads, binaires, keystore, artifacts).
+
+## [0.1.0] - 2026-09-15
+
+Première version publique.
+
+### Ajouté
+- Backend Go/Gin : auth user-first (paseto v4-local), devices, users (resolve, change password), CRUD fichiers/dossiers, upload multipart, recherche, sharing, sync outbox idempotente + snapshot permissions, OCR jobs (Tesseract), migrations Postgres testées.
+- Client Android Kotlin : local-first Room (v7, migrations, DAO), SAF scanner deux passes, outbox transactionnel + worker WorkManager, recherche locale, génération PDF, scanner de documents, thumbnails, mode sombre, i18n FR/EN.
+- Contrat API V1 consolidé (`docs/api-v1.md`), test de contrat de routes.
+- Site de promotion public + documentation Starlight/Astro (FR/EN, versionnée).

LICENSE

@@ -0,0 +1,655 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they receive
+widespread use, become available for other developers to incorporate.
+Many developers of free software are heartened and encouraged by the
+resulting cooperation.  However, in the case of software used on
+network servers, this result may fail to come about.  The GNU General
+Public License permits making a modified version and letting the public
+access it on a server without ever releasing its source code to the
+public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, carries the obligation to make the source
+code freely available.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that transaction
+who receives a copy of the work also receives whatever licenses to the
+work the party's predecessors in interest had or could give under the
+previous paragraph, plus a right to possession of the Corresponding
+Source of the work from the predecessor in interest, if the predecessor
+has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Affero General Public License from time to time.  Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero
+General Public License "or any later version" applies to it, you have
+the option of following the terms and conditions either of that
+numbered version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number
+of the GNU Affero General Public License, you may choose any version
+ever published by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that
+proxy's public statement of acceptance of a version permanently
+authorizes you to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+PROGRAM IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT
+LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES
+SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE
+WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN
+ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    Kazier — personal document vault, local-first.
+    Copyright (C) 2026 Thirdshop
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -1,8 +1,10 @@
-# VaultDrop
+# Kazier
 
-VaultDrop est un coffre-fort de documents personnel, local-first. Le client Android镜映 le SAF dans une base Room et pousse les métadonnées de ses mutations via un outbox transactionnel vers le serveur Go/PostgreSQL — pas d'upload physique, pas de cloud-dépendance.
+Kazier est un coffre-fort de documents personnel, local-first. Le client Android reflète le SAF dans une base Room et pousse les métadonnées de ses mutations via un outbox transactionnel vers le serveur Go/PostgreSQL — pas d'upload physique, pas de cloud-dépendance.
 
-Disponible sur [thirdshop.fr](https://thirdshop.fr/en/applications/vault/)
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE)
+
+Disponible sur [thirdshop.fr](https://thirdshop.fr/en/applications/kazier/)
 
 ## Setup
 

VERSION

@@ -0,0 +1 @@
+0.1.0

backend/.dockerignore

@@ -0,0 +1,8 @@
+bin/
+uploads/*
+!uploads/.gitkeep
+.env
+.git
+*.md
+.vscode/
+.idea/

backend/.env.example

@@ -2,7 +2,7 @@
 
 # Serveur
 PORT=8080
-DATABASE_URL=postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_dev?sslmode=disable
+DATABASE_URL=postgres://kazier:kazier@localhost:5432/kazier_dev?sslmode=disable
 UPLOAD_DIR=./uploads
 MAX_FILE_SIZE_MB=50
 OCR_LANG=fra+eng

backend/Dockerfile

@@ -0,0 +1,59 @@
+# syntax=docker/dockerfile:1
+
+ARG VERSION=dev
+ARG BUILD_DATE=unknown
+
+# --- builder: compile statique du binaire Go (CGO off, musl) ---
+FROM golang:1.26-alpine AS builder
+ENV GOTOOLCHAIN=auto
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags "-s -w -X main.version=${VERSION}" \
+    -o /out/kazier-server \
+    ./cmd/server/main.go
+
+# --- runtime: mince, Tesseract (fra+eng) embarqué pour l'OCR ---
+FROM alpine:3.20
+RUN apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    tesseract-ocr \
+    tesseract-ocr-data-eng \
+    tesseract-ocr-data-fra
+
+WORKDIR /app
+
+ARG VERSION
+ARG BUILD_DATE
+LABEL org.opencontainers.image.title="kazier-server" \
+      org.opencontainers.image.description="Kazier backend API (Go/Gin + PostgreSQL) — local-first document vault" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.licenses="AGPL-3.0-only" \
+      org.opencontainers.image.source="https://gitlab.thirdshop.fr/thirdshop/kasier" \
+      org.opencontainers.image.url="https://thirdshop.fr/en/applications/kazier/" \
+      org.opencontainers.image.created="${BUILD_DATE}" \
+      org.opencontainers.image.revision=""
+
+COPY --from=builder /out/kazier-server /usr/local/bin/kazier-server
+
+# UPLOAD_DIR persistant, user non-root
+RUN mkdir -p /app/uploads \
+    && adduser -D -H -u 10001 kazier \
+    && chown kazier:kazier /app/uploads
+VOLUME /app/uploads
+
+ENV PORT=8080 \
+    UPLOAD_DIR=/app/uploads
+
+USER kazier
+EXPOSE 8080
+
+HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
+    CMD wget -q -O - http://127.0.0.1:8080/api/v1/health || exit 1
+
+ENTRYPOINT ["kazier-server"]

backend/cmd/server/main.go

@@ -1,19 +1,28 @@
 package main
 
 import (
+	"context"
+	"errors"
 	"fmt"
 	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
 
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/config"
-	"github.com/vaultdrop/backend/db"
-	"github.com/vaultdrop/backend/handlers"
-	"github.com/vaultdrop/backend/ocr"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/config"
+	"github.com/kazier/backend/db"
+	"github.com/kazier/backend/handlers"
+	"github.com/kazier/backend/ocr"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
+var version = "dev"
+
 func newRouter() *gin.Engine {
 	r := gin.Default()
 	handlers.RegisterRoutes(r)
@@ -21,8 +30,12 @@ func newRouter() *gin.Engine {
 }
 
 func main() {
+	if len(os.Args) > 1 && os.Args[1] == "--version" {
+		fmt.Printf("kazier-server %s\n", version)
+		os.Exit(0)
+	}
 
-	err, cfg := config.LoadApplicationConfig()
+	cfg, err := config.LoadApplicationConfig()
 
 	if err != nil {
 		log.Fatalln(err)
@@ -57,8 +70,30 @@ func main() {
 	)
 	handlers.Ocr = service.NewOcr(repo, cfg.UploadDir, cfg.OcrLang, ocr.NewTesseract())
 
-	if err := newRouter().Run(fmt.Sprintf(":%d", cfg.Port)); err != nil {
-		log.Fatalln(err)
-	}
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
 
+	// Worker OCR borné (OCR_WORKERS) : file `ocr_jobs`, hors request handlers.
+	go handlers.Ocr.Run(ctx, cfg.OcrWorkers)
+	log.Printf("ocr worker démarré (%d workers)", cfg.OcrWorkers)
+
+	srv := &http.Server{
+		Addr:    fmt.Sprintf(":%d", cfg.Port),
+		Handler: newRouter(),
+	}
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			log.Fatalf("server: %v", err)
+		}
+	}()
+
+	<-ctx.Done()
+	stop()
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := srv.Shutdown(shutdownCtx); err != nil {
+		log.Printf("shutdown: %v", err)
+	}
+	log.Println("arrêt propre")
 }

backend/cmd/server/main_test.go

@@ -4,19 +4,19 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/vaultdrop/backend/models"
+	"github.com/kazier/backend/models"
 )
 
 func TestUserCreation(t *testing.T) {
 
-	err, userAntoine := models.NewUser("antoine")
+	userAntoine, err := models.NewUser("antoine")
 	if err != nil {
-		t.Errorf(`Error creating antoine user %v`, err)
+		t.Fatalf("creating antoine user: %v", err)
 	}
 
-	err, userBob := models.NewUser("bob")
+	userBob, err := models.NewUser("bob")
 	if err != nil {
-		t.Errorf(`Error creating bob user %v`, err)
+		t.Fatalf("creating bob user: %v", err)
 	}
 
 	fmt.Println(userAntoine, userBob)
@@ -25,14 +25,14 @@ func TestUserCreation(t *testing.T) {
 
 func TestCreateDocument(t *testing.T) {
 
-	err, document := models.NewDocument("paper.pdf", models.FILE, 1)
+	document, err := models.NewDocument("paper.pdf", models.FILE, 1)
 	if err != nil {
-		t.Errorf(`Error creating document %v`, err)
+		t.Fatalf("creating document: %v", err)
 	}
 
-	err, directory := models.NewDocument("bob", models.DIRECTORY, 1)
+	directory, err := models.NewDocument("bob", models.DIRECTORY, 1)
 	if err != nil {
-		t.Errorf(`Error creating bob directory %v`, err)
+		t.Fatalf("creating bob directory: %v", err)
 	}
 
 	fmt.Println(document, directory)

backend/cmd/server/router_test.go

@@ -14,6 +14,7 @@ var expectedRoutes = []string{
 
 	"GET /api/v1/files",
 	"GET /api/v1/files/:id",
+	"GET /api/v1/files/:id/ocr",
 	"DELETE /api/v1/files/:id",
 	"GET /api/v1/files/search",
 	"GET /api/v1/files/folders",

backend/config/config.go

@@ -13,36 +13,43 @@ type ApplicationConfig struct {
 	UploadDir     string
 	MaxFileSizeMB int64
 	OcrLang       string
+	OcrWorkers    int
 	AuthSecret    string
 	AdminUsername string
 	AdminPassword string
 }
 
-func LoadApplicationConfig() (error, *ApplicationConfig) {
+func LoadApplicationConfig() (*ApplicationConfig, error) {
 
 	// .env optionnel — les défauts suffisent pour le dev local.
 	_ = godotenv.Load()
 
 	port, err := getInt("PORT", 8080)
 	if err != nil {
-		return err, nil
+		return nil, err
 	}
 
 	maxSize, err := getInt("MAX_FILE_SIZE_MB", 50)
 	if err != nil {
-		return err, nil
+		return nil, err
 	}
 
-	return nil, &ApplicationConfig{
+	ocrWorkers, err := getInt("OCR_WORKERS", 2)
+	if err != nil {
+		return nil, err
+	}
+
+	return &ApplicationConfig{
 		Port:          port,
-		DatabaseURL:   get("DATABASE_URL", "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_dev?sslmode=disable"),
+		DatabaseURL:   get("DATABASE_URL", "postgres://kazier:kazier@localhost:5432/kazier_dev?sslmode=disable"),
 		UploadDir:     get("UPLOAD_DIR", "./uploads"),
 		MaxFileSizeMB: int64(maxSize),
 		OcrLang:       get("OCR_LANG", "fra+eng"),
+		OcrWorkers:    ocrWorkers,
 		AuthSecret:    get("AUTH_SECRET", "dev-secret-change-me"),
 		AdminUsername: get("ADMIN_USERNAME", ""),
 		AdminPassword: get("ADMIN_PASSWORD", ""),
-	}
+	}, nil
 
 }
 

backend/config/config_test.go

@@ -9,7 +9,7 @@ func clearEnv(t *testing.T) {
 	t.Helper()
 	for _, name := range []string{
 		"PORT", "DATABASE_URL", "UPLOAD_DIR", "MAX_FILE_SIZE_MB",
-		"OCR_LANG", "AUTH_SECRET", "ADMIN_USERNAME", "ADMIN_PASSWORD",
+		"OCR_LANG", "OCR_WORKERS", "AUTH_SECRET", "ADMIN_USERNAME", "ADMIN_PASSWORD",
 	} {
 		t.Setenv(name, "")
 	}
@@ -18,7 +18,7 @@ func clearEnv(t *testing.T) {
 func TestLoadApplicationDefaults(t *testing.T) {
 	clearEnv(t)
 
-	err, cfg := LoadApplicationConfig()
+	cfg, err := LoadApplicationConfig()
 	if err != nil {
 		t.Fatalf("LoadApplicationConfig: %v", err)
 	}
@@ -28,7 +28,7 @@ func TestLoadApplicationDefaults(t *testing.T) {
 	if cfg.MaxFileSizeMB != 50 {
 		t.Errorf("MaxFileSizeMB = %d, attendu 50", cfg.MaxFileSizeMB)
 	}
-	if cfg.DatabaseURL != "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_dev?sslmode=disable" {
+	if cfg.DatabaseURL != "postgres://kazier:kazier@localhost:5432/kazier_dev?sslmode=disable" {
 		t.Errorf("DatabaseURL défaut inattendu: %q", cfg.DatabaseURL)
 	}
 	if cfg.UploadDir != "./uploads" {
@@ -37,6 +37,9 @@ func TestLoadApplicationDefaults(t *testing.T) {
 	if cfg.OcrLang != "fra+eng" {
 		t.Errorf("OcrLang défaut inattendu: %q", cfg.OcrLang)
 	}
+	if cfg.OcrWorkers != 2 {
+		t.Errorf("OcrWorkers = %d, attendu 2", cfg.OcrWorkers)
+	}
 	if cfg.AuthSecret != "dev-secret-change-me" {
 		t.Errorf("AuthSecret défaut inattendu: %q", cfg.AuthSecret)
 	}
@@ -52,16 +55,17 @@ func TestLoadApplicationEnvOverrides(t *testing.T) {
 	t.Setenv("DATABASE_URL", "postgres://u:p@host:5433/db?sslmode=disable")
 	t.Setenv("UPLOAD_DIR", "/tmp/up")
 	t.Setenv("OCR_LANG", "eng")
+	t.Setenv("OCR_WORKERS", "4")
 	t.Setenv("AUTH_SECRET", "super-secret")
 	t.Setenv("ADMIN_USERNAME", "root")
 	t.Setenv("ADMIN_PASSWORD", "toor")
 
-	err, cfg := LoadApplicationConfig()
+	cfg, err := LoadApplicationConfig()
 	if err != nil {
 		t.Fatalf("LoadApplicationConfig: %v", err)
 	}
 	if cfg.Port != 9090 || cfg.MaxFileSizeMB != 120 || cfg.DatabaseURL != "postgres://u:p@host:5433/db?sslmode=disable" ||
-		cfg.UploadDir != "/tmp/up" || cfg.OcrLang != "eng" || cfg.AuthSecret != "super-secret" ||
+		cfg.UploadDir != "/tmp/up" || cfg.OcrLang != "eng" || cfg.OcrWorkers != 4 || cfg.AuthSecret != "super-secret" ||
 		cfg.AdminUsername != "root" || cfg.AdminPassword != "toor" {
 		t.Errorf("overrides non appliqués: %+v", cfg)
 	}
@@ -71,13 +75,13 @@ func TestLoadApplicationRejectsInvalidInt(t *testing.T) {
 	clearEnv(t)
 
 	t.Setenv("PORT", "not-a-number")
-	if err, _ := LoadApplicationConfig(); err == nil {
+	if _, err := LoadApplicationConfig(); err == nil {
 		t.Error("PORT invalide : attendu une erreur")
 	}
 
 	clearEnv(t)
 	t.Setenv("MAX_FILE_SIZE_MB", "99999999999999999999999")
-	if err, _ := LoadApplicationConfig(); err == nil {
+	if _, err := LoadApplicationConfig(); err == nil {
 		t.Error("MAX_FILE_SIZE_MB invalide : attendu une erreur")
 	}
 }

backend/db/migrations/000010_resources_ocr_text.down.sql

@@ -0,0 +1 @@
+ALTER TABLE resources DROP COLUMN ocr_text;

backend/db/migrations/000010_resources_ocr_text.up.sql

@@ -0,0 +1,5 @@
+-- Texte OCR porté sur la ressource (docs/api-v1.md §5) : le worker OCR écrit
+-- l'extrait (`resources.ocr_text`, updated_at bumpé) pour qu'il soit
+-- consultable par tous les devices du user ET par les grantees
+-- (GET /files/:id/ocr, visibilité viewer+).
+ALTER TABLE resources ADD COLUMN ocr_text TEXT;

backend/db/migrations_test.go

@@ -9,7 +9,7 @@ import (
 	_ "github.com/lib/pq"
 )
 
-const defaultTestDatabaseURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_migrations_test?sslmode=disable"
+const defaultTestDatabaseURL = "postgres://kazier:kazier@localhost:5432/kazier_migrations_test?sslmode=disable"
 
 func testDatabaseURL(t *testing.T) string {
 	t.Helper()

backend/dbtest/dbtest.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/lib/pq"
 
-	"github.com/vaultdrop/backend/db"
+	"github.com/kazier/backend/db"
 )
 
 // OpenTestDatabase ensures the test database exists, resets its schema, runs
@@ -27,7 +27,7 @@ func OpenTestDatabase(t *testing.T, databaseURL string) *sql.DB {
 		databaseURL = os.Getenv("TEST_DATABASE_URL")
 	}
 	if databaseURL == "" {
-		databaseURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_test?sslmode=disable"
+		databaseURL = "postgres://kazier:kazier@localhost:5432/kazier_test?sslmode=disable"
 	}
 
 	// Postgres joignable ? (sinon on skippe, sans être gênés par l'existence

backend/go.mod

@@ -1,4 +1,4 @@
-module github.com/vaultdrop/backend
+module github.com/kazier/backend
 
 go 1.26.4
 

backend/handlers/auth.go

@@ -8,11 +8,11 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/pkg/passwd"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/pkg/passwd"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
 type LoginRequest struct {

backend/handlers/auth_test.go

@@ -9,17 +9,17 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/dbtest"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/pkg/passwd"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/dbtest"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/pkg/passwd"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
-const authTestURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_handlers_auth_test?sslmode=disable"
+const authTestURL = "postgres://kazier:kazier@localhost:5432/kazier_handlers_auth_test?sslmode=disable"
 
 const (
-	authTestPassword = "vaultdrop-test-password"
+	authTestPassword = "kazier-test-password"
 	authTestDevice   = "0123456789abcdef0123456789abcdef"
 )
 
@@ -311,7 +311,7 @@ func TestResolveUser(t *testing.T) {
 		t.Errorf("resolve: %+v", env.Data)
 	}
 	// Jamais email ni is_admin
-	if len(rec.Body.Bytes()) < 0 || strings.Contains(rec.Body.String(), "is_admin") || strings.Contains(rec.Body.String(), "email") {
+	if len(rec.Body.Bytes()) == 0 || strings.Contains(rec.Body.String(), "is_admin") || strings.Contains(rec.Body.String(), "email") {
 		t.Error("resolve ne doit pas exposer email/is_admin")
 	}
 

backend/handlers/devices.go

@@ -4,7 +4,7 @@ import (
 	"regexp"
 
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/kazier/backend/pkg/api"
 )
 
 var deviceIDPattern = regexp.MustCompile(`^[0-9a-f]{32}$`)

backend/handlers/files.go

@@ -7,7 +7,7 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/kazier/backend/pkg/api"
 )
 
 func intParam(value string, fallback int) int {
@@ -59,6 +59,29 @@ func FilesGet(c *gin.Context) {
 	api.OK(c, file)
 }
 
+// FilesGetOcr expose l'extrait OCR server-side d'un fichier visible (viewer+,
+// own ou shared) : GET /files/:id/ocr. Réponse { text } ("" si pas encore
+// extrait) + updatedAt. Permet à un second device de récupérer le texte déjà
+// calculé sans re-téléverser les octets (cf. docs/api-v1.md §5).
+func FilesGetOcr(c *gin.Context) {
+	if Store == nil {
+		api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
+		return
+	}
+	userID := c.GetString(UserIDKey)
+	id := c.Param("id")
+	if !deviceIDPattern.MatchString(id) {
+		api.Error(c, http.StatusNotFound, "NOT_FOUND", "file not found")
+		return
+	}
+	dto, err := Store.GetFileOcr(userID, id)
+	if err != nil {
+		writeError(c, err)
+		return
+	}
+	api.OK(c, dto)
+}
+
 func FilesDelete(c *gin.Context) {
 	if Store == nil {
 		api.Error(c, http.StatusServiceUnavailable, "SERVICE_UNAVAILABLE", "backend not initialized")
@@ -85,6 +108,13 @@ func FilesUpload(c *gin.Context) {
 	}
 	userID := c.GetString(UserIDKey)
 	folderID := c.PostForm("folderId")
+	// resourceId optionnel : cible un fichier déjà connu (metadata-only de
+	// l'outbox) pour lui attacher ses octets physiques (ex. OCR serveur).
+	resourceID := c.PostForm("resourceId")
+	if resourceID != "" && !deviceIDPattern.MatchString(resourceID) {
+		api.Error(c, http.StatusNotFound, "NOT_FOUND", "file not found")
+		return
+	}
 
 	c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, Store.MaxFileSize+1)
 	file, err := c.FormFile("file")
@@ -102,7 +132,7 @@ func FilesUpload(c *gin.Context) {
 		return
 	}
 
-	dto, err := Store.Upload(userID, file, folderID)
+	dto, err := Store.Upload(userID, file, folderID, resourceID)
 	if err != nil {
 		writeError(c, err)
 		return

backend/handlers/files_test.go

@@ -11,15 +11,15 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/dbtest"
-	"github.com/vaultdrop/backend/handlers"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/pkg/passwd"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/dbtest"
+	"github.com/kazier/backend/handlers"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/pkg/passwd"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
-const handlersTestURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_handlers_test?sslmode=disable"
+const handlersTestURL = "postgres://kazier:kazier@localhost:5432/kazier_handlers_test?sslmode=disable"
 
 type envelope struct {
 	Data json.RawMessage `json:"data"`
@@ -39,6 +39,11 @@ type fileDTO struct {
 	CreatedAt string `json:"createdAt"`
 }
 
+type fileOcrDTO struct {
+	Text      string `json:"text"`
+	UpdatedAt string `json:"updatedAt"`
+}
+
 type apiError struct {
 	Error struct {
 		Code    string `json:"code"`
@@ -183,6 +188,29 @@ func uploadMultipart(t *testing.T, r *gin.Engine, token, folderID, filename stri
 	return rec
 }
 
+// uploadMultipartToResource uploads bytes targeted at an existing resource_id
+// (metadata-only file from the outbox), le cas d'usage OCR.
+func uploadMultipartToResource(t *testing.T, r *gin.Engine, token, resourceID, filename string, content []byte) *httptest.ResponseRecorder {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("file", filename)
+	if err != nil {
+		t.Fatalf("create form file: %v", err)
+	}
+	if _, err := part.Write(content); err != nil {
+		t.Fatalf("write body: %v", err)
+	}
+	if err := writer.WriteField("resourceId", resourceID); err != nil {
+		t.Fatalf("write resourceId: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close writer: %v", err)
+	}
+	rec, _ := doRequest(t, r, http.MethodPost, "/api/v1/files/upload", token, body.Bytes(), writer.FormDataContentType())
+	return rec
+}
+
 func TestFilesFlow(t *testing.T) {
 	r, _, repo := setup(t)
 	deviceA := repository.NewID()
@@ -385,6 +413,67 @@ func TestUploadNameConflict(t *testing.T) {
 	expectError(t, rec, http.StatusConflict, "NAME_CONFLICT", "upload-dupe")
 }
 
+func TestUploadTargetsExistingResource(t *testing.T) {
+	r, _, repo := setup(t)
+	device := repository.NewID()
+	token, user := registerAndLogin(t, r, repo, testUserUsername(device, "tr"), "upload-test-password", device)
+
+	// Fiche metadata-only (même sémantique que l'outbox create_resource).
+	resourceID := repository.NewID()
+	if err := repo.Resources.InsertFile(user, resourceID, "scan.png", "", 0, nil, nil); err != nil {
+		t.Fatalf("insert metadata-only file: %v", err)
+	}
+
+	rec := uploadMultipartToResource(t, r, token, resourceID, "scan.png", []byte("PNGDATA"))
+	env := expectOK(t, rec, "upload-target")
+	var uploaded fileDTO
+	if err := json.Unmarshal(env.Data, &uploaded); err != nil {
+		t.Fatalf("upload-target: unmarshal: %v", err)
+	}
+	if uploaded.ID != resourceID {
+		t.Errorf("id attendu %s, got %s", resourceID, uploaded.ID)
+	}
+	if uploaded.Size != 7 {
+		t.Errorf("taille = %d, attendu 7", uploaded.Size)
+	}
+
+	// Toujours une seule ligne (pas de doublon).
+	rec, _ = doRequest(t, r, http.MethodGet, "/api/v1/files", token, nil, "")
+	env = expectOK(t, rec, "list-after-targeted-upload")
+	var files []fileDTO
+	if err := json.Unmarshal(env.Data, &files); err != nil {
+		t.Fatalf("list: unmarshal: %v", err)
+	}
+	if len(files) != 1 || files[0].ID != resourceID {
+		t.Errorf("aucun doublon attendu, got %+v", files)
+	}
+}
+
+func TestUploadTargetForeignResourceNotFound(t *testing.T) {
+	r, _, repo := setup(t)
+	deviceA := repository.NewID()
+	deviceB := repository.NewID()
+	tokenA, _ := registerAndLogin(t, r, repo, testUserUsername(deviceA, "tf"), "upload-test-password", deviceA)
+	_, userB := registerAndLogin(t, r, repo, testUserUsername(deviceB, "tg"), "upload-test-password-b", deviceB)
+
+	resourceID := repository.NewID()
+	if err := repo.Resources.InsertFile(userB, resourceID, "mine.png", "", 0, nil, nil); err != nil {
+		t.Fatalf("insert B file: %v", err)
+	}
+
+	rec := uploadMultipartToResource(t, r, tokenA, resourceID, "mine.png", []byte("DATA"))
+	expectError(t, rec, http.StatusNotFound, "NOT_FOUND", "upload-foreign")
+}
+
+func TestUploadTargetInvalidID(t *testing.T) {
+	r, _, repo := setup(t)
+	device := repository.NewID()
+	token, _ := registerAndLogin(t, r, repo, testUserUsername(device, "ti"), "upload-test-password", device)
+
+	rec := uploadMultipartToResource(t, r, token, "NOT-HEX", "x.png", []byte("DATA"))
+	expectError(t, rec, http.StatusNotFound, "NOT_FOUND", "upload-invalid-id")
+}
+
 func TestFoldersListAndScoping(t *testing.T) {
 	r, _, repo := setup(t)
 	deviceA := repository.NewID()
@@ -493,3 +582,54 @@ func TestFilesGetDeleteRejectInvalidID(t *testing.T) {
 	rec, _ = doRequest(t, r, http.MethodGet, "/api/v1/files/"+fileID, otherToken, nil, "")
 	expectError(t, rec, http.StatusNotFound, "NOT_FOUND", "get-cross-user")
 }
+
+func TestFilesGetOcrOwnerShareAndScoping(t *testing.T) {
+	r, _, repo := setup(t)
+	ownerDevice := repository.NewID()
+	ownerToken, owner := registerAndLogin(t, r, repo, testUserUsername(ownerDevice, "oc"), "ocr-get-test-password", ownerDevice)
+	granteeDevice := repository.NewID()
+	granteeToken, grantee := registerAndLogin(t, r, repo, testUserUsername(granteeDevice, "og"), "ocr-get-test-password-b", granteeDevice)
+	outsiderDevice := repository.NewID()
+	outsiderToken, _ := registerAndLogin(t, r, repo, testUserUsername(outsiderDevice, "oh"), "ocr-get-test-password-c", outsiderDevice)
+
+	fileID := repository.NewID()
+	if err := repo.Resources.InsertFile(owner, fileID, "scan.png", "", 128, nil, nil); err != nil {
+		t.Fatalf("insert file: %v", err)
+	}
+	if err := repo.Resources.UpdateOcrText(owner, fileID, "extrait du scan"); err != nil {
+		t.Fatalf("write ocr_text: %v", err)
+	}
+
+	// Owner : texte + updatedAt.
+	rec, _ := doRequest(t, r, http.MethodGet, "/api/v1/files/"+fileID+"/ocr", ownerToken, nil, "")
+	envOcr := expectOK(t, rec, "ocr-owner")
+	var ownerOcr fileOcrDTO
+	if err := json.Unmarshal(envOcr.Data, &ownerOcr); err != nil {
+		t.Fatalf("ocr-owner: unmarshal: %v", err)
+	}
+	if ownerOcr.Text != "extrait du scan" || ownerOcr.UpdatedAt == "" {
+		t.Errorf("ocr owner = %+v, attendu texte+updatedAt", ownerOcr)
+	}
+
+	// Grantée viewer+ : même texte (partage rend l'OCR lisible).
+	if err := repo.Shares.Upsert(fileID, grantee, "viewer", false, nil, owner); err != nil {
+		t.Fatalf("share: %v", err)
+	}
+	rec, _ = doRequest(t, r, http.MethodGet, "/api/v1/files/"+fileID+"/ocr", granteeToken, nil, "")
+	envOcr = expectOK(t, rec, "ocr-grantee")
+	var granteeOcr fileOcrDTO
+	if err := json.Unmarshal(envOcr.Data, &granteeOcr); err != nil {
+		t.Fatalf("ocr-grantee: unmarshal: %v", err)
+	}
+	if granteeOcr.Text != "extrait du scan" {
+		t.Errorf("ocr grantee = %+v, attendu texte partagé", granteeOcr)
+	}
+
+	// Outsider : invisible (404).
+	rec, _ = doRequest(t, r, http.MethodGet, "/api/v1/files/"+fileID+"/ocr", outsiderToken, nil, "")
+	expectError(t, rec, http.StatusNotFound, "NOT_FOUND", "ocr-outsider")
+
+	// ID invalide → 404.
+	rec, _ = doRequest(t, r, http.MethodGet, "/api/v1/files/not-hex/ocr", ownerToken, nil, "")
+	expectError(t, rec, http.StatusNotFound, "NOT_FOUND", "ocr-invalid-id")
+}

backend/handlers/health.go

@@ -2,7 +2,7 @@ package handlers
 
 import (
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/kazier/backend/pkg/api"
 )
 
 func Health(c *gin.Context) {

backend/handlers/middleware.go

@@ -6,9 +6,9 @@ import (
 	"strings"
 
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/repository"
 )
 
 const (

backend/handlers/ocr.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/repository"
 )
 
 type ocrJobRequest struct {

backend/handlers/ocr_test.go

@@ -11,11 +11,11 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/dbtest"
-	"github.com/vaultdrop/backend/handlers"
-	"github.com/vaultdrop/backend/pkg/auth"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/dbtest"
+	"github.com/kazier/backend/handlers"
+	"github.com/kazier/backend/pkg/auth"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
 type stubEngine struct {
@@ -42,6 +42,12 @@ func setupOcr(t *testing.T) (*gin.Engine, string, *repository.Repository) {
 	handlers.Store = store
 	handlers.Ocr = service.NewOcr(repo, uploadDir, "fra+eng", stubEngine{text: "HELLO OCR"})
 
+	// Worker OCR borné — le handler n'enfile plus que le job, le traitement
+	// tourne sur un worker de contexte.
+	ctx, cancel := context.WithCancel(context.Background())
+	go handlers.Ocr.Run(ctx, 1)
+	t.Cleanup(cancel)
+
 	gin.SetMode(gin.TestMode)
 	r := gin.New()
 	handlers.RegisterRoutes(r)

backend/handlers/router.go

@@ -2,11 +2,10 @@ package handlers
 
 import (
 	"net/http"
-	"strings"
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/pkg/api"
+	"github.com/kazier/backend/pkg/api"
 )
 
 // RegisterRoutes wires the full /api/v1 surface (public + protected).
@@ -28,6 +27,7 @@ func RegisterRoutes(r *gin.Engine) {
 		protected.GET("/files", FilesList)
 		protected.GET("/files/search", FilesSearch)
 		protected.GET("/files/:id", FilesGet)
+		protected.GET("/files/:id/ocr", FilesGetOcr)
 		protected.DELETE("/files/:id", FilesDelete)
 		protected.GET("/files/folders", FoldersList)
 		protected.POST("/files/upload", FilesUpload)
@@ -47,10 +47,3 @@ func RegisterRoutes(r *gin.Engine) {
 		api.Error(c, http.StatusNotFound, "NOT_FOUND", "route not found")
 	})
 }
-
-// userID lit la clé de scoping posée par RequireAuth. Un empty string est
-// impossible en conditions normales (le middleware l'a validé) ; garde-fou
-// pour un appel direct dans les tests.
-func userID(c *gin.Context) string {
-	return strings.TrimSpace(c.GetString(UserIDKey))
-}

backend/handlers/share_links.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/repository"
 )
 
 // ShareLinkGet resolves a public share link without authentication

backend/handlers/share_links_test.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/repository"
 )
 
 func TestShareLinkPublicResolution(t *testing.T) {

backend/handlers/store.go

@@ -4,9 +4,9 @@ import (
 	"errors"
 
 	"github.com/gin-gonic/gin"
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/repository"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/repository"
+	"github.com/kazier/backend/service"
 )
 
 // Store is the business layer used by handlers; set once at startup
@@ -25,7 +25,7 @@ func writeError(c *gin.Context, err error) {
 		api.Error(c, 404, "GRANTEE_NOT_FOUND", "the specified user does not exist")
 	case errors.Is(err, repository.ErrNameConflict):
 		api.Error(c, 409, "NAME_CONFLICT", "a resource with this name already exists here")
-	case errors.Is(err, service.FileTooLargeError):
+	case errors.Is(err, service.ErrFileTooLarge):
 		api.Error(c, 413, "FILE_TOO_LARGE", "file exceeds the maximum allowed size")
 	default:
 		api.Error(c, 500, "INTERNAL", err.Error())

backend/handlers/sync.go

@@ -5,8 +5,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
-	"github.com/vaultdrop/backend/pkg/api"
-	"github.com/vaultdrop/backend/service"
+	"github.com/kazier/backend/pkg/api"
+	"github.com/kazier/backend/service"
 )
 
 type syncOpsRequest struct {

backend/handlers/sync_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/repository"
 )
 
 func syncOpsBody(ops []map[string]any) []byte {

backend/models/clients.go

@@ -8,19 +8,19 @@ type Client interface {
 	GetClientVersion() int
 }
 
-func NewClient(clientVersion int) (error, Client) {
+func NewClient(clientVersion int) (Client, error) {
 
 	isCompatible := ServerClientIsCompatibleWithClient(clientVersion)
 
 	if !isCompatible {
-		return fmt.Errorf("You client version %d is not compatible with the server verison %d", clientVersion, SERVER_VERSION), nil
+		return nil, fmt.Errorf("client version %d is not compatible with the server version %d", clientVersion, SERVER_VERSION)
 	}
 
 	client := ClientVerisonOne{
 		Version: clientVersion,
 	}
 
-	return nil, &client
+	return &client, nil
 
 }
 

backend/models/documents.go

@@ -1,7 +1,7 @@
 package models
 
 import (
-	"fmt"
+	"errors"
 )
 
 type Document struct {
@@ -37,19 +37,19 @@ func IsDirectory(documentType int) bool {
 	return DIRECTORY == documentType
 }
 
-func NewDocument(documentName string, documentType int, documentVersion int) (error, *Document) {
+func NewDocument(documentName string, documentType int, documentVersion int) (*Document, error) {
 
 	documentTypeIsValid := IsDocumentTypeValid(documentType)
 
 	if !documentTypeIsValid {
-		return fmt.Errorf(ERROR_DOCUMENT_TYPE), nil
+		return nil, errors.New(ERROR_DOCUMENT_TYPE)
 	}
 
-	return nil, &Document{
+	return &Document{
 		Name:    &documentName,
 		Type:    documentType,
 		Version: documentVersion,
-	}
+	}, nil
 
 }
 

backend/models/users.go

@@ -4,8 +4,8 @@ type User struct {
 	Username string
 }
 
-func NewUser(username string) (error, *User) {
-	return nil, &User{
+func NewUser(username string) (*User, error) {
+	return &User{
 		Username: username,
-	}
+	}, nil
 }

backend/pkg/passwd/passwd.go

@@ -35,7 +35,7 @@ var (
 // quand même contre ce hash pour que le délai de réponse soit identique à un
 // « mauvais mot de passe ».
 var dummyHash = func() string {
-	h, err := Hash("vaultdrop-constantime-dummy")
+	h, err := Hash("kazier-constantime-dummy")
 	if err != nil {
 		panic(fmt.Sprintf("passwd: impossible de pré-hacher le dummy: %v", err))
 	}

backend/repository/devices_test.go

@@ -3,7 +3,7 @@ package repository
 import (
 	"testing"
 
-	"github.com/vaultdrop/backend/dbtest"
+	"github.com/kazier/backend/dbtest"
 )
 
 func newTestDevices(t *testing.T) *Devices {

backend/repository/ocr_jobs.go

@@ -3,6 +3,7 @@ package repository
 import (
 	"database/sql"
 	"errors"
+	"time"
 )
 
 // OcrJobRow maps ocr_jobs.
@@ -18,6 +19,9 @@ type OcrJobRow struct {
 // ErrJobNotFound marks an OCR job absent or owned by another device.
 var ErrJobNotFound = errors.New("ocr job not found")
 
+// ErrNoQueuedJobs marks an OCR queue drained (no job to claim).
+var ErrNoQueuedJobs = errors.New("no queued ocr jobs")
+
 type OcrJobs struct{ DB *sql.DB }
 
 func (o *OcrJobs) Create(jobID, deviceID, fileID string) error {
@@ -62,6 +66,49 @@ func (o *OcrJobs) TouchProcessing(deviceID, jobID string) error {
 	return err
 }
 
+// ClaimNext atomically picks the oldest queued job (FIFO) and moves it to
+// `processing`. Safe for concurrent workers: `FOR UPDATE SKIP LOCKED` blocks
+// the row as part of the same statement. Empty queue → ErrNoQueuedJobs.
+func (o *OcrJobs) ClaimNext() (OcrJobRow, error) {
+	var row OcrJobRow
+	err := o.DB.QueryRow(
+		`WITH next AS (
+		    SELECT job_id FROM ocr_jobs
+		    WHERE status = 'queued'
+		    ORDER BY created_at, job_id
+		    LIMIT 1
+		    FOR UPDATE SKIP LOCKED
+		)
+		UPDATE ocr_jobs
+		SET status = 'processing', started_at = NOW()
+		FROM next
+		WHERE ocr_jobs.job_id = next.job_id
+		RETURNING ocr_jobs.job_id, ocr_jobs.file_id, ocr_jobs.device_id, ocr_jobs.status`,
+	).Scan(&row.ID, &row.FileID, &row.DeviceID, &row.Status)
+	if err == sql.ErrNoRows {
+		return OcrJobRow{}, ErrNoQueuedJobs
+	}
+	if err != nil {
+		return OcrJobRow{}, err
+	}
+	return row, nil
+}
+
+// ResetStaleProcessing requeues jobs stuck in `processing` (worker crash /
+// processus redémarré) et plus vieux que `olderThan`. Retourne le nb de jobs
+// requeued.
+func (o *OcrJobs) ResetStaleProcessing(olderThan time.Duration) (int64, error) {
+	res, err := o.DB.Exec(
+		`UPDATE ocr_jobs SET status = 'queued', started_at = NULL
+		 WHERE status = 'processing' AND started_at < $1`,
+		time.Now().Add(-olderThan),
+	)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
 func (o *OcrJobs) Complete(deviceID, jobID, text string) error {
 	_, err := o.DB.Exec(
 		`UPDATE ocr_jobs SET status = 'done', text = NULLIF($3, ''), started_at = COALESCE(started_at, NOW()), completed_at = NOW()

backend/repository/ocr_jobs_test.go

@@ -3,8 +3,9 @@ package repository
 import (
 	"errors"
 	"testing"
+	"time"
 
-	"github.com/vaultdrop/backend/dbtest"
+	"github.com/kazier/backend/dbtest"
 )
 
 func newTestRepo(t *testing.T) *Repository {
@@ -90,3 +91,91 @@ func TestOcrJobsGetScopedByDevice(t *testing.T) {
 		t.Errorf("get par un autre device : attendu ErrJobNotFound, got %v", err)
 	}
 }
+
+func TestOcrJobsClaimNextFifo(t *testing.T) {
+	repo, _, deviceID, fileID := seedOcrJobFixture(t)
+	var jobIDs []string
+	for i := 0; i < 3; i++ {
+		jobID := NewID()
+		if err := repo.OcrJobs.Create(jobID, deviceID, fileID); err != nil {
+			t.Fatalf("create %d: %v", i, err)
+		}
+		jobIDs = append(jobIDs, jobID)
+	}
+
+	for i, want := range jobIDs {
+		row, err := repo.OcrJobs.ClaimNext()
+		if err != nil {
+			t.Fatalf("claim %d: %v", i, err)
+		}
+		if row.ID != want {
+			t.Errorf("claim %d = %q, attendu %q (FIFO)", i, row.ID, want)
+		}
+		if row.Status != "processing" {
+			t.Errorf("claim %d status = %q, attendu processing", i, row.Status)
+		}
+	}
+
+	if _, err := repo.OcrJobs.ClaimNext(); !errors.Is(err, ErrNoQueuedJobs) {
+		t.Errorf("queue vide : attendu ErrNoQueuedJobs, got %v", err)
+	}
+}
+
+func TestOcrJobsClaimNextSkipsProcessingAndDone(t *testing.T) {
+	repo, _, deviceID, fileID := seedOcrJobFixture(t)
+	job1 := NewID()
+	job2 := NewID()
+	if err := repo.OcrJobs.Create(job1, deviceID, fileID); err != nil {
+		t.Fatalf("create job1: %v", err)
+	}
+	if err := repo.OcrJobs.Create(job2, deviceID, fileID); err != nil {
+		t.Fatalf("create job2: %v", err)
+	}
+	if err := repo.OcrJobs.TouchProcessing(deviceID, job2); err != nil {
+		t.Fatalf("touch job2 processing: %v", err)
+	}
+
+	row, err := repo.OcrJobs.ClaimNext()
+	if err != nil {
+		t.Fatalf("claim: %v", err)
+	}
+	if row.ID != job1 {
+		t.Errorf("claim = %q, attendu job1 %q", row.ID, job1)
+	}
+}
+
+func TestOcrJobsResetStaleProcessing(t *testing.T) {
+	repo, _, deviceID, fileID := seedOcrJobFixture(t)
+	jobID := NewID()
+	if err := repo.OcrJobs.Create(jobID, deviceID, fileID); err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if err := repo.OcrJobs.TouchProcessing(deviceID, jobID); err != nil {
+		t.Fatalf("touch processing: %v", err)
+	}
+
+	// Started_at = NOW : pas encore stale → aucun requeue.
+	if n, err := repo.OcrJobs.ResetStaleProcessing(time.Minute); err != nil {
+		t.Fatalf("reset: %v", err)
+	} else if n != 0 {
+		t.Errorf("reset récent : attendu 0, got %d", n)
+	}
+
+	// Vieillit le started_at puis re-reset → 1 requeue.
+	if _, err := repo.OcrJobs.DB.Exec(`UPDATE ocr_jobs SET started_at = NOW() - interval '2 minutes' WHERE job_id = $1`, jobID); err != nil {
+		t.Fatalf("vieillir started_at: %v", err)
+	}
+	if n, err := repo.OcrJobs.ResetStaleProcessing(time.Minute); err != nil {
+		t.Fatalf("reset stale: %v", err)
+	} else if n != 1 {
+		t.Errorf("reset stale : attendu 1, got %d", n)
+	}
+
+	row, err := repo.OcrJobs.Get(deviceID, jobID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if row.Status != "queued" {
+		t.Errorf("status après reset = %q, attendu queued", row.Status)
+	}
+}

backend/repository/operations_test.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/vaultdrop/backend/dbtest"
+	"github.com/kazier/backend/dbtest"
 )
 
 func newTestOperations(t *testing.T) (*Operations, *Devices) {

backend/repository/resources.go

@@ -41,6 +41,7 @@ type FileRow struct {
 	FolderID  string
 	CreatedAt time.Time
 	UpdatedAt time.Time
+	OcrText   string
 }
 
 type FolderRow struct {
@@ -156,11 +157,11 @@ func (r *Resources) InsertFolder(ownerID, id, name, parentResourceID string) err
 	return r.insert(ownerID, id, name, parentResourceID, "folder", 0, nil, nil)
 }
 
-const fileColumns = `resource_id, name, size_bytes, COALESCE(mime_type, ''), COALESCE(parent_id, ''), created_at, updated_at`
+const fileColumns = `resource_id, name, size_bytes, COALESCE(mime_type, ''), COALESCE(parent_id, ''), created_at, updated_at, COALESCE(ocr_text, '')`
 
 func (r *Resources) scanFile(scan func(...any) error) (FileRow, error) {
 	var row FileRow
-	err := scan(&row.ID, &row.Name, &row.Size, &row.MimeType, &row.FolderID, &row.CreatedAt, &row.UpdatedAt)
+	err := scan(&row.ID, &row.Name, &row.Size, &row.MimeType, &row.FolderID, &row.CreatedAt, &row.UpdatedAt, &row.OcrText)
 	return row, err
 }
 
@@ -254,6 +255,21 @@ func (r *Resources) GetFileVisible(userID, resourceID string) (FileRow, error) {
 	return file, err
 }
 
+// GetResourceOwner returns the owning user_id of any resource (file or folder).
+// No-rows → ErrNotFound.
+func (r *Resources) GetResourceOwner(resourceID string) (string, error) {
+	var ownerID string
+	err := r.DB.QueryRow(
+		`SELECT user_id FROM resources
+		 WHERE resource_id = $1 AND deleted_at IS NULL`,
+		resourceID,
+	).Scan(&ownerID)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", ErrNotFound
+	}
+	return ownerID, err
+}
+
 // DeleteFile soft-deletes the file (deleted_at), returning its id.
 func (r *Resources) DeleteFile(ownerID, resourceID string) (string, error) {
 	result, err := r.DB.Exec(
@@ -433,6 +449,52 @@ func (r *Resources) UpdateNameByID(resourceID, name string) error {
 	return nil
 }
 
+// UpdatePhysical refreshes an existing file row's physical metadata
+// (size_bytes / mime_type / extension) after a targeted re-upload — used so a
+// resource created metadata-only (outbox create_resource) receives its bytes
+// for server-side OCR. Absent / not owned → ErrNotFound. Never renames or moves.
+func (r *Resources) UpdatePhysical(ownerID, resourceID string, size int64, mimeType, extension *string) error {
+	result, err := r.DB.Exec(
+		`UPDATE resources SET size_bytes = $3, mime_type = $4, extension = $5, updated_at = NOW()
+		 WHERE resource_id = $1 AND user_id = $2 AND type = 'file' AND deleted_at IS NULL`,
+		resourceID, ownerID, size, mimeType, extension,
+	)
+	if err != nil {
+		return err
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if affected == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// UpdateOcrText writes the server-computed OCR extract onto the resource
+// (owner-scoped, bumping updated_at so the change flows through the sync
+// snapshot). The text is then readable by every device of the user AND by
+// grantees via GET /files/:id/ocr (viewer+, cf. docs/api-v1.md §5).
+func (r *Resources) UpdateOcrText(ownerID, resourceID, text string) error {
+	result, err := r.DB.Exec(
+		`UPDATE resources SET ocr_text = $3, updated_at = NOW()
+		 WHERE resource_id = $1 AND user_id = $2 AND type = 'file' AND deleted_at IS NULL`,
+		resourceID, ownerID, text,
+	)
+	if err != nil {
+		return err
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if affected == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 // SyncDelete soft-deletes a resource; absence is NOT an error (idempotent
 // terminal state for the outbox).
 func (r *Resources) SyncDelete(ownerID, resourceID string) error {

backend/repository/resources_test.go

@@ -5,10 +5,10 @@ import (
 	"testing"
 	"time"
 
-	"github.com/vaultdrop/backend/dbtest"
+	"github.com/kazier/backend/dbtest"
 )
 
-const repositoryTestURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_repository_test?sslmode=disable"
+const repositoryTestURL = "postgres://kazier:kazier@localhost:5432/kazier_repository_test?sslmode=disable"
 
 func newTestResources(t *testing.T) *Resources {
 	t.Helper()
@@ -232,3 +232,54 @@ func TestListOwnedDelta(t *testing.T) {
 		t.Errorf("delta attendu uniquement fresh.txt, got %+v", delta)
 	}
 }
+
+func TestUpdateOcrTextAndReadBack(t *testing.T) {
+	repo := newTestResources(t)
+	owner := NewID()
+	other := NewID()
+	mustInsertUser(t, repo, owner)
+	mustInsertUser(t, repo, other)
+
+	fileID := NewID()
+	if err := repo.InsertFile(owner, fileID, "scan.png", "", 128, nil, nil); err != nil {
+		t.Fatalf("insert file: %v", err)
+	}
+
+	// Vide par défaut.
+	before := time.Now()
+	row, err := repo.GetFile(owner, fileID)
+	if err != nil {
+		t.Fatalf("get file: %v", err)
+	}
+	if row.OcrText != "" {
+		t.Errorf("ocr_text initial = %q, attendu vide", row.OcrText)
+	}
+
+	if err := repo.UpdateOcrText(owner, fileID, "extrait du scan"); err != nil {
+		t.Fatalf("update ocr_text: %v", err)
+	}
+
+	// L'exécution bump updated_at (→ delta outbox/snapshot).
+	time.Sleep(5 * time.Millisecond)
+	after, err := repo.GetFile(owner, fileID)
+	if err != nil {
+		t.Fatalf("get file après : %v", err)
+	}
+	if after.OcrText != "extrait du scan" {
+		t.Errorf("ocr_text = %q, attendu %q", after.OcrText, "extrait du scan")
+	}
+	if !after.UpdatedAt.After(before) {
+		t.Errorf("updated_at non bumpé: before=%v after=%v", before, after.UpdatedAt)
+	}
+	if after.UpdatedAt.Before(time.Now().Add(-time.Minute)) {
+		t.Errorf("updated_at incohérent: %v", after.UpdatedAt)
+	}
+
+	// Non-owner / ressource inconnue → ErrNotFound.
+	if err := repo.UpdateOcrText(other, fileID, "volé"); !errors.Is(err, ErrNotFound) {
+		t.Errorf("autre user : attendu ErrNotFound, got %v", err)
+	}
+	if err := repo.UpdateOcrText(owner, NewID(), "x"); !errors.Is(err, ErrNotFound) {
+		t.Errorf("inconnue : attendu ErrNotFound, got %v", err)
+	}
+}

backend/repository/users_test.go

@@ -4,7 +4,7 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/vaultdrop/backend/dbtest"
+	"github.com/kazier/backend/dbtest"
 )
 
 func newTestUsers(t *testing.T) *Users {

backend/service/bootstrap.go

@@ -5,8 +5,8 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/vaultdrop/backend/pkg/passwd"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/pkg/passwd"
+	"github.com/kazier/backend/repository"
 )
 
 // ErrAdminRequired : base vide et identifiants admin absents → le serveur

backend/service/bootstrap_test.go

@@ -4,8 +4,8 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/vaultdrop/backend/pkg/passwd"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/pkg/passwd"
+	"github.com/kazier/backend/repository"
 )
 
 func TestEnsureAdminCreatesFirstAdmin(t *testing.T) {

backend/service/folders.go

@@ -1,14 +1,14 @@
 package service
 
-import "github.com/vaultdrop/backend/models"
+import "github.com/kazier/backend/models"
 
-func (s *Services) CreateFolder(folderName string, destination *models.Document) (error, *models.Document) {
+func (s *Services) CreateFolder(folderName string, destination *models.Document) (*models.Document, error) {
 
-	err, directory := models.NewDocument(folderName, models.DIRECTORY, 1)
+	directory, err := models.NewDocument(folderName, models.DIRECTORY, 1)
 	if err != nil {
-		return err, nil
+		return nil, err
 	}
 
-	return nil, directory
+	return directory, nil
 
 }

backend/service/move.go

@@ -1,27 +1,28 @@
 package service
 
 import (
+	"errors"
 	"fmt"
 
-	"github.com/vaultdrop/backend/models"
+	"github.com/kazier/backend/models"
 )
 
 func (s *Services) MoveDocumentIntoDocument(from *models.Document, to *models.Document) error {
 
 	if from.UUID == nil {
-		return fmt.Errorf(models.ERROR_DOCUMENT_NOT_PERCISTED)
+		return errors.New(models.ERROR_DOCUMENT_NOT_PERCISTED)
 	}
 
 	if to.Type != models.DIRECTORY {
-		return fmt.Errorf("The destination document must be a directory")
+		return errors.New("the destination document must be a directory")
 	}
 
-	if canEdit, _ := UserCanEditDocument(s.ConnectedUser, from); canEdit == false {
-		return fmt.Errorf("You can not edit this folder")
+	if canEdit, _ := UserCanEditDocument(s.ConnectedUser, from); !canEdit {
+		return errors.New("you cannot edit this folder")
 	}
 
-	if canEdit, _ := UserCanEditDocument(s.ConnectedUser, to); canEdit == false {
-		return fmt.Errorf("You can not edit this folder")
+	if canEdit, _ := UserCanEditDocument(s.ConnectedUser, to); !canEdit {
+		return errors.New("you cannot edit this folder")
 	}
 
 	// Check if document exist and move the document into document if is directory

backend/service/move_test.go

@@ -3,28 +3,32 @@ package service
 import (
 	"testing"
 
-	"github.com/vaultdrop/backend/models"
+	"github.com/kazier/backend/models"
 )
 
 func TestMoveDocument(t *testing.T) {
 
-	err, userAntoine := models.NewUser("antoine")
+	userAntoine, err := models.NewUser("antoine")
 	if err != nil {
-		t.Errorf(`Error creating antoine user %v`, err)
+		t.Fatalf("creating antoine user: %v", err)
 	}
 
 	fakeUUID := "dsqdsq"
-	err, document := models.NewDocument("test.pdf", models.FILE, 1)
+	document, err := models.NewDocument("test.pdf", models.FILE, 1)
+	if err != nil {
+		t.Fatalf("creating document: %v", err)
+	}
 	document.UUID = &fakeUUID
 
-	err, folder := models.NewDocument("orga", models.DIRECTORY, 1)
+	folder, err := models.NewDocument("orga", models.DIRECTORY, 1)
+	if err != nil {
+		t.Fatalf("creating folder: %v", err)
+	}
 	folder.UUID = &fakeUUID
 
 	service := New(userAntoine)
 
-	err = service.MoveDocumentIntoDocument(document, folder)
-
-	if err != nil {
+	if err := service.MoveDocumentIntoDocument(document, folder); err != nil {
 		t.Error(err)
 	}
 
@@ -32,14 +36,20 @@ func TestMoveDocument(t *testing.T) {
 
 func TestMoveDocumentToAFile(t *testing.T) {
 
-	err, userAntoine := models.NewUser("antoine")
+	userAntoine, err := models.NewUser("antoine")
 	if err != nil {
-		t.Errorf(`Error creating antoine user %v`, err)
+		t.Fatalf("creating antoine user: %v", err)
 	}
 
-	err, document := models.NewDocument("test.pdf", models.FILE, 1)
+	document, err := models.NewDocument("test.pdf", models.FILE, 1)
+	if err != nil {
+		t.Fatalf("creating document: %v", err)
+	}
 
-	err, notAFolder := models.NewDocument("orga", models.FILE, 1)
+	notAFolder, err := models.NewDocument("orga", models.FILE, 1)
+	if err != nil {
+		t.Fatalf("creating file: %v", err)
+	}
 
 	service := New(userAntoine)
 

backend/service/ocr.go

@@ -2,11 +2,23 @@ package service
 
 import (
 	"context"
+	"errors"
+	"log"
 	"path/filepath"
 	"strings"
+	"sync"
+	"time"
 
-	"github.com/vaultdrop/backend/ocr"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/ocr"
+	"github.com/kazier/backend/repository"
+)
+
+const (
+	// StaleClaimTimeout : un job `processing` plus vieux que ça est ré-enfilé
+	// au boot (worker mort / process redémarré).
+	StaleClaimTimeout = 15 * time.Minute
+	// QueuePollInterval : cadence de scrutation quand la file est vide.
+	QueuePollInterval = time.Second
 )
 
 // OcrJobDTO serializes exactly as mobile/api/types.ts OcrJob.
@@ -17,22 +29,24 @@ type OcrJobDTO struct {
 	Error  string `json:"error,omitempty"`
 }
 
-// Ocr queues OCR jobs and processes them asynchronously (V1 : goroutine par
-// job ; le client poll GET /ocr/jobs/:id toutes les 3s).
+// Ocr queues OCR jobs in `ocr_jobs` (status `queued`) and processes them
+// asynchronously through a bounded worker ([Run]) — Tesseract ne tourne jamais
+// dans un request handler. Le client poll GET /ocr/jobs/:id toutes les 3s.
 type Ocr struct {
 	Repository *repository.Repository
 	UploadDir  string
 	Lang       string
 	Engine     ocr.Engine
+	StaleAfter time.Duration
 }
 
 func NewOcr(repo *repository.Repository, uploadDir, lang string, engine ocr.Engine) *Ocr {
-	return &Ocr{Repository: repo, UploadDir: uploadDir, Lang: lang, Engine: engine}
+	return &Ocr{Repository: repo, UploadDir: uploadDir, Lang: lang, Engine: engine, StaleAfter: StaleClaimTimeout}
 }
 
-// Create valide la ressource (ownership par user), met le job en file et
-// lance le traitement. Le job reste scopé par device (le service génère les
-// jobs du device courant ; l'outbox OCR n'est pas synchronisée entre devices).
+// Create valide la ressource (ownership par user) et l'enfile uniquement
+// (status `queued`) — le traitement est délégué au worker [Run] pour ne pas
+// stresser le serveur. Le job reste scopé par device.
 func (o *Ocr) Create(userID, deviceID, fileID string) (OcrJobDTO, error) {
 	if _, err := o.Repository.Resources.GetFile(userID, fileID); err != nil {
 		return OcrJobDTO{}, err
@@ -41,7 +55,6 @@ func (o *Ocr) Create(userID, deviceID, fileID string) (OcrJobDTO, error) {
 	if err := o.Repository.OcrJobs.Create(jobID, deviceID, fileID); err != nil {
 		return OcrJobDTO{}, err
 	}
-	go o.process(userID, deviceID, jobID, fileID)
 	return OcrJobDTO{ID: jobID, Status: "queued"}, nil
 }
 
@@ -53,22 +66,75 @@ func (o *Ocr) Get(deviceID, jobID string) (OcrJobDTO, error) {
 	return toOcrJobDTO(row), nil
 }
 
-func (o *Ocr) process(userID, deviceID, jobID, fileID string) {
-	ctx := context.Background()
-	if err := o.Repository.OcrJobs.TouchProcessing(deviceID, jobID); err != nil {
+// Run fait tourner le worker OCR : au démarrage il requeue les jobs laissés
+// en `processing` (crash), puis `workers` boucles consomment la file FIFO via
+// ClaimNext (atomique, `FOR UPDATE SKIP LOCKED`). `workers` borne la
+// concurrence Tesseract. Retourne quand ctx est annulé.
+func (o *Ocr) Run(ctx context.Context, workers int) {
+	if workers < 1 {
+		workers = 1
+	}
+	if _, err := o.Repository.OcrJobs.ResetStaleProcessing(o.StaleAfter); err != nil {
+		log.Printf("ocr: requeue jobs stale: %v", err)
+	}
+
+	var wg sync.WaitGroup
+	for i := 0; i < workers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			o.workerLoop(ctx)
+		}()
+	}
+	wg.Wait()
+}
+
+// workerLoop consomme la file : un job `queued` → processing → done/failed.
+// File vide → scrutation à QueuePollInterval jusqu'à annulation du ctx.
+func (o *Ocr) workerLoop(ctx context.Context) {
+	for {
+		row, err := o.Repository.OcrJobs.ClaimNext()
+		if err != nil {
+			if !errors.Is(err, repository.ErrNoQueuedJobs) {
+				log.Printf("ocr: claim: %v", err)
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(QueuePollInterval):
+			}
+			continue
+		}
+		o.process(ctx, row)
+	}
+}
+
+// process exécute l'extraction pour un job déjà réclamé (`processing`).
+func (o *Ocr) process(ctx context.Context, row repository.OcrJobRow) {
+	userID, err := o.Repository.Resources.GetResourceOwner(row.FileID)
+	if err != nil {
+		_ = o.Repository.OcrJobs.Fail(row.DeviceID, row.ID, "file not readable")
 		return
 	}
-	path, err := o.physicalPath(userID, fileID)
+	path, err := o.physicalPath(userID, row.FileID)
 	if err != nil {
-		_ = o.Repository.OcrJobs.Fail(deviceID, jobID, "file not readable")
+		_ = o.Repository.OcrJobs.Fail(row.DeviceID, row.ID, "file not readable")
 		return
 	}
 	text, err := o.Engine.ExtractText(ctx, path, o.Lang)
 	if err != nil {
-		_ = o.Repository.OcrJobs.Fail(deviceID, jobID, err.Error())
+		_ = o.Repository.OcrJobs.Fail(row.DeviceID, row.ID, err.Error())
 		return
 	}
-	_ = o.Repository.OcrJobs.Complete(deviceID, jobID, text)
+	_ = o.Repository.OcrJobs.Complete(row.DeviceID, row.ID, text)
+	// Le texte atterrit sur la ressource (updated_at bumpé) : consultable par
+	// tous les devices du user et les grantees via GET /files/:id/ocr. SILENCIEUX
+	// (hôte déjà supprimé ou lock d'écriture) : le job reste source d'historique.
+	if trimmed := strings.TrimSpace(text); trimmed != "" {
+		if err := o.Repository.Resources.UpdateOcrText(userID, row.FileID, trimmed); err != nil {
+			log.Printf("ocr: persiste ocr_text de %s: %v", row.FileID, err)
+		}
+	}
 }
 
 // physicalPath résout UPLOAD_DIR/<user_id>/<resource_id>.<ext> — l'ext est

backend/service/ocr_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/vaultdrop/backend/ocr"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/ocr"
+	"github.com/kazier/backend/repository"
 )
 
 // stubEngine again (package service) — même contrat que handlers/ocr_test.
@@ -26,13 +26,18 @@ func (s stubEngine) ExtractText(_ context.Context, _ string, _ string) (string,
 	return s.text, nil
 }
 
-// newTestOcr builds an Ocr over a fresh DB and returns it with the ids.
+// newTestOcr builds an Ocr over a fresh DB, starts the bounded worker (1
+// worker) and returns it with the ids.
 func newTestOcr(t *testing.T, uploadDir string, engine ocr.Engine) (*Ocr, string, string, string) {
 	t.Helper()
 	s := newServiceStore(t)
 	userID := mustCreateUser(t, s.Repository, "ocr-failed")
 	deviceID := mustRegisterDevice(t, s.Repository, repository.NewID())
-	return NewOcr(s.Repository, uploadDir, "fra+eng", engine), userID, deviceID, uploadDir
+	o := NewOcr(s.Repository, uploadDir, "fra+eng", engine)
+	ctx, cancel := context.WithCancel(context.Background())
+	go o.Run(ctx, 1)
+	t.Cleanup(cancel)
+	return o, userID, deviceID, uploadDir
 }
 
 // waitTillTerminal poll jusqu'à un statut terminal (done/failed).
@@ -105,6 +110,59 @@ func TestOcrJobFailsWhenPhysicalFileMissing(t *testing.T) {
 	}
 }
 
+func TestOcrJobPersistsTextOnResourceAndGrantsRead(t *testing.T) {
+	uploadDir := t.TempDir()
+	o, ownerID, deviceID, _ := newTestOcr(t, uploadDir, stubEngine{text: "  extrait du scan  "})
+	granteeID := mustCreateUser(t, o.Repository, "ocr-grantee")
+	outsiderID := mustCreateUser(t, o.Repository, "ocr-outsider")
+	mustRegisterDevice(t, o.Repository, shareTestDeviceID)
+
+	fileID := repository.NewID()
+	insertOcrFile(t, o, ownerID, fileID)
+	if err := os.MkdirAll(filepath.Join(uploadDir, ownerID), 0o755); err != nil {
+		t.Fatalf("mkdir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(uploadDir, ownerID, fileID+".png"), []byte("img"), 0o644); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	job, err := o.Create(ownerID, deviceID, fileID)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	row := waitTillTerminal(t, o, deviceID, job.ID)
+	if row.Status != "done" {
+		t.Fatalf("job %s: attendu done", row.Status)
+	}
+
+	// Le texte (trimé) a atterri sur la ressource, lisible par l'owner.
+	s := NewResources(o.Repository, uploadDir, 100)
+	owned, err := s.GetFileOcr(ownerID, fileID)
+	if err != nil {
+		t.Fatalf("get ocr owner: %v", err)
+	}
+	if owned.Text != "extrait du scan" {
+		t.Errorf("ocr_text = %q, attendu %q", owned.Text, "extrait du scan")
+	}
+
+	// ... et par un grantee viewer+ (docs §5 : partage rend le texte lisible).
+	if err := o.Repository.Shares.Upsert(fileID, granteeID, "viewer", false, nil, ownerID); err != nil {
+		t.Fatalf("share: %v", err)
+	}
+	shared, err := s.GetFileOcr(granteeID, fileID)
+	if err != nil {
+		t.Fatalf("get ocr grantee: %v", err)
+	}
+	if shared.Text != "extrait du scan" {
+		t.Errorf("ocr_text grantee = %q, attendu %q", shared.Text, "extrait du scan")
+	}
+
+	// Un tiers n'y a pas accès.
+	if _, err := s.GetFileOcr(outsiderID, fileID); !errors.Is(err, repository.ErrNotFound) {
+		t.Errorf("tiers : attendu ErrNotFound, got %v", err)
+	}
+}
+
 func TestOcrJobFailsOnEngineError(t *testing.T) {
 	uploadDir := t.TempDir()
 	o, userID, deviceID, _ := newTestOcr(t, uploadDir, stubEngine{err: errors.New("tesseract boom")})

backend/service/resources.go

@@ -10,11 +10,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/repository"
 )
 
-// FileTooLargeError signals an upload above MaxFileSize.
-var FileTooLargeError = errors.New("file too large")
+// ErrFileTooLarge signals an upload above MaxFileSize.
+var ErrFileTooLarge = errors.New("file too large")
 
 // FileDTO serializes exactly as mobile/api/types.ts FileDto.
 type FileDTO struct {
@@ -73,6 +73,26 @@ func (s *Resources) GetFile(ownerID, id string) (FileDTO, error) {
 	return toFileDTO(row), nil
 }
 
+// FileOcrDTO is the payload of GET /files/:id/ocr: the server-computed OCR
+// extract of the resource, readable by its owner and by grantees (viewer+).
+type FileOcrDTO struct {
+	Text      string `json:"text"`
+	UpdatedAt string `json:"updatedAt,omitempty"`
+}
+
+// GetFileOcr returns the OCR text of a file the user can see (viewer+, own or
+// shared). Absent text → Text empty ("") with 200 (the caller decides).
+func (s *Resources) GetFileOcr(ownerID, id string) (FileOcrDTO, error) {
+	row, err := s.Repo.GetFileVisible(ownerID, id)
+	if err != nil {
+		return FileOcrDTO{}, err
+	}
+	return FileOcrDTO{
+		Text:      row.OcrText,
+		UpdatedAt: row.UpdatedAt.UTC().Format(time.RFC3339),
+	}, nil
+}
+
 func (s *Resources) DeleteFile(ownerID, id string) (string, error) {
 	return s.Repo.DeleteFile(ownerID, id)
 }
@@ -104,30 +124,51 @@ func (s *Resources) SearchFiles(ownerID, q string, page, pageSize int) ([]FileDT
 // Upload persists the multipart-sourced file under UploadDir/<user> and
 // records its metadata, returning the FileDTO. The physical file is removed
 // if metadata persistence fails (e.g. name conflict).
-func (s *Resources) Upload(ownerID string, file *multipart.FileHeader, folderID string) (FileDTO, error) {
+//
+// When resourceID is non-empty the upload TARGETS an existing file owned by
+// the user (metadata-only resource from the outbox, or a previously uploaded
+// file): the bytes are written under UploadDir/<user>/<resourceID>.<ext> and
+// only the physical metadata (size/mime/extension) is refreshed — never a
+// rename, never a move, never a duplicate row. Unknown / foreign resource →
+// repo.ErrNotFound.
+func (s *Resources) Upload(ownerID string, file *multipart.FileHeader, folderID, resourceID string) (FileDTO, error) {
 	if file.Size > s.MaxFileSize {
-		return FileDTO{}, FileTooLargeError
+		return FileDTO{}, ErrFileTooLarge
+	}
+
+	targetExisting := resourceID != ""
+	if targetExisting {
+		if _, err := s.Repo.GetFile(ownerID, resourceID); err != nil {
+			return FileDTO{}, err
+		}
+	} else {
+		resourceID = repository.NewID()
 	}
 
-	id := repository.NewID()
 	extension := strings.TrimPrefix(filepath.Ext(file.Filename), ".")
 	destDir := filepath.Join(s.UploadDir, ownerID)
 	if err := os.MkdirAll(destDir, 0o755); err != nil {
 		return FileDTO{}, fmt.Errorf("create upload dir: %w", err)
 	}
 
-	destPath := filepath.Join(destDir, id+"."+extension)
+	destPath := filepath.Join(destDir, resourceID+"."+extension)
 	if err := copyMultipart(file, destPath); err != nil {
 		return FileDTO{}, err
 	}
 
 	mimeType := file.Header.Get("Content-Type")
-	if err := s.Repo.InsertFile(ownerID, id, file.Filename, folderID, file.Size, &mimeType, &extension); err != nil {
+	var err error
+	if targetExisting {
+		err = s.Repo.UpdatePhysical(ownerID, resourceID, file.Size, &mimeType, &extension)
+	} else {
+		err = s.Repo.InsertFile(ownerID, resourceID, file.Filename, folderID, file.Size, &mimeType, &extension)
+	}
+	if err != nil {
 		_ = os.Remove(destPath)
 		return FileDTO{}, err
 	}
 
-	row, err := s.Repo.GetFile(ownerID, id)
+	row, err := s.Repo.GetFile(ownerID, resourceID)
 	if err != nil {
 		return FileDTO{}, err
 	}

backend/service/resources_test.go

@@ -8,7 +8,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/repository"
 )
 
 func multipartFileHeader(t *testing.T, filename string, content []byte) *multipart.FileHeader {
@@ -42,7 +42,7 @@ func TestUploadPersistsPhysicalFile(t *testing.T) {
 	s := newServiceStore(t)
 	userID := mustCreateUser(t, s.Repository, "upload-happy")
 
-	dto, err := s.Upload(userID, multipartFileHeader(t, "docs.txt", []byte("hello")), "")
+	dto, err := s.Upload(userID, multipartFileHeader(t, "docs.txt", []byte("hello")), "", "")
 	if err != nil {
 		t.Fatalf("upload: %v", err)
 	}
@@ -70,7 +70,7 @@ func TestUploadRemovesPhysicalFileOnNameConflict(t *testing.T) {
 	}
 
 	target := multipartFileHeader(t, "dupe.txt", []byte("hello"))
-	first, err := s.Upload(userID, target, folderID)
+	first, err := s.Upload(userID, target, folderID, "")
 	if err != nil {
 		t.Fatalf("premier upload: %v", err)
 	}
@@ -79,7 +79,7 @@ func TestUploadRemovesPhysicalFileOnNameConflict(t *testing.T) {
 	}
 
 	// Même nom, même dossier → NAME_CONFLICT et pas de second fichier physique.
-	if _, err := s.Upload(userID, target, folderID); !errors.Is(err, repository.ErrNameConflict) {
+	if _, err := s.Upload(userID, target, folderID, ""); !errors.Is(err, repository.ErrNameConflict) {
 		t.Fatalf("second upload : attendu ErrNameConflict, got %v", err)
 	}
 
@@ -91,3 +91,74 @@ func TestUploadRemovesPhysicalFileOnNameConflict(t *testing.T) {
 		t.Errorf("fichier orphelin laissé après NAME_CONFLICT : %d fichiers", len(entries))
 	}
 }
+
+func TestUploadTargetsExistingResource(t *testing.T) {
+	s := newServiceStore(t)
+	userID := mustCreateUser(t, s.Repository, "upload-target")
+
+	// Fiche metadata-only créée par l'outbox côté client.
+	resourceID := repository.NewID()
+	ext := "png"
+	if err := s.Repository.Resources.InsertFile(userID, resourceID, "scan.png", "", 0, nil, &ext); err != nil {
+		t.Fatalf("insert metadata-only file: %v", err)
+	}
+
+	// Re-upload ciblé : mêmes octets, même resource_id, pas de doublon.
+	dto, err := s.Upload(userID, multipartFileHeader(t, "scan.png", []byte("PNGDATA")), "", resourceID)
+	if err != nil {
+		t.Fatalf("targeted upload: %v", err)
+	}
+	if dto.ID != resourceID {
+		t.Errorf("id attendu %s, got %s", resourceID, dto.ID)
+	}
+	if dto.Size != 7 {
+		t.Errorf("taille = %d, attendu 7 (rafraîchie)", dto.Size)
+	}
+
+	path := filepath.Join(s.UploadDir, userID, resourceID+".png")
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("fichier physique absent: %v", err)
+	}
+	if info.Size() != 7 {
+		t.Errorf("taille physique = %d, attendu 7", info.Size())
+	}
+
+	// Une seule ligne serveur (pas de doublon créé par le re-upload).
+	rows, total, err := s.Repo.ListFiles(userID, "", 50, 0, "", "")
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if total != 1 || len(rows) != 1 || rows[0].ID != resourceID {
+		t.Errorf("liste après re-upload: total=%d rows=%+v", total, rows)
+	}
+}
+
+func TestUploadTargetsOwnedResourceOnly(t *testing.T) {
+	s := newServiceStore(t)
+	userID := mustCreateUser(t, s.Repository, "upload-owner")
+	otherUser := mustCreateUser(t, s.Repository, "upload-owner-other")
+
+	resourceID := repository.NewID()
+	if err := s.Repository.Resources.InsertFile(otherUser, resourceID, "mine.png", "", 0, nil, nil); err != nil {
+		t.Fatalf("insert other's file: %v", err)
+	}
+
+	// Un resource_id d'un autre user → ErrNotFound, aucun octet écrit.
+	if _, err := s.Upload(userID, multipartFileHeader(t, "mine.png", []byte("DATA")), "", resourceID); !errors.Is(err, repository.ErrNotFound) {
+		t.Fatalf("upload cross-user : attendu ErrNotFound, got %v", err)
+	}
+	// Le dossier upload du user ne doit pas avoir été créé (échec avant écriture).
+	if _, err := os.Stat(filepath.Join(s.UploadDir, userID)); !os.IsNotExist(err) {
+		t.Errorf("dossier upload créé à tort ou erreur inattendue: %v", err)
+	}
+}
+
+func TestUploadTargetUnknownIsNotFound(t *testing.T) {
+	s := newServiceStore(t)
+	userID := mustCreateUser(t, s.Repository, "upload-unknown")
+
+	if _, err := s.Upload(userID, multipartFileHeader(t, "ghost.png", []byte("DATA")), "", repository.NewID()); !errors.Is(err, repository.ErrNotFound) {
+		t.Fatalf("upload inconnu : attendu ErrNotFound, got %v", err)
+	}
+}

backend/service/services.go

@@ -1,6 +1,6 @@
 package service
 
-import "github.com/vaultdrop/backend/models"
+import "github.com/kazier/backend/models"
 
 type Services struct {
 	ConnectedUser *models.User

backend/service/sync.go

@@ -6,7 +6,7 @@ import (
 	"regexp"
 	"time"
 
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/repository"
 )
 
 var resourceIDPattern = regexp.MustCompile(`^[0-9a-f]{32}$`)

backend/service/sync_test.go

@@ -6,11 +6,11 @@ import (
 	"testing"
 	"time"
 
-	"github.com/vaultdrop/backend/dbtest"
-	"github.com/vaultdrop/backend/repository"
+	"github.com/kazier/backend/dbtest"
+	"github.com/kazier/backend/repository"
 )
 
-const serviceTestURL = "postgres://vaultdrop:vaultdrop@localhost:5432/vaultdrop_service_test?sslmode=disable"
+const serviceTestURL = "postgres://kazier:kazier@localhost:5432/kazier_service_test?sslmode=disable"
 
 // newServiceStore returns a Resources service over a fresh migrated test DB.
 func newServiceStore(t *testing.T) *Resources {

backend/service/upload.go

@@ -3,13 +3,13 @@ package service
 import (
 	"fmt"
 
-	"github.com/vaultdrop/backend/models"
+	"github.com/kazier/backend/models"
 )
 
 func (s *Services) UploadDocument(file *string, destination *models.Document) error {
 
 	if canEdit, _ := UserCanEditDocument(s.ConnectedUser, destination); !canEdit {
-		return fmt.Errorf("Can not edit")
+		return fmt.Errorf("cannot edit document")
 	}
 
 	models.NewDocument("test", models.FILE, 1)

docker-compose.yml

@@ -1,47 +1,45 @@
 services:
-  # paddleocr envisagé, non retenu — OCR via Tesseract (appel système), cf. docs/api-v1.md
-  # paddleocr:
-  #   build:
-  #     context: ./backend/ocr-server
-  #     dockerfile: Dockerfile
-  #   ports:
-  #     - "9090:8080"
-  #   environment:
-  #     - OCR_LANG=fr
-  #   restart: unless-stopped
-
   postgres:
     image: postgres:17-alpine
     ports:
       - "5432:5432"
     environment:
-      POSTGRES_DB: vaultdrop_dev
-      POSTGRES_USER: vaultdrop
-      POSTGRES_PASSWORD: vaultdrop
+      POSTGRES_DB: ${POSTGRES_DB:-kazier_dev}
+      POSTGRES_USER: ${POSTGRES_USER:-kazier}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-kazier}
     volumes:
       - postgres-data:/var/lib/postgresql/data
     restart: unless-stopped
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U vaultdrop"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-kazier}"]
       interval: 10s
       timeout: 5s
       retries: 5
 
-  # backend:
-  #   build:
-  #     context: ./backend
-  #     dockerfile: Dockerfile
-  #   ports:
-  #     - "8080:8080"
-  #   environment:
-  #     - PORT=8080
-  #     - DATABASE_URL=postgres://vaultdrop:vaultdrop@postgres:5432/vaultdrop_dev?sslmode=disable
-  #   volumes:
-  #     - ./backend/uploads:/app/uploads
-  #   depends_on:
-  #     postgres:
-  #       condition: service_healthy
-  #   restart: unless-stopped
+  backend:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+      args:
+        VERSION: ${VERSION:-dev}
+    ports:
+      - "${PORT:-8080}:8080"
+    environment:
+      PORT: 8080
+      DATABASE_URL: postgres://${POSTGRES_USER:-kazier}:${POSTGRES_PASSWORD:-kazier}@postgres:5432/${POSTGRES_DB:-kazier_dev}?sslmode=disable
+      UPLOAD_DIR: /app/uploads
+      MAX_FILE_SIZE_MB: ${MAX_FILE_SIZE_MB:-50}
+      OCR_LANG: ${OCR_LANG:-fra+eng}
+      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET requis (voir backend/.env.example)}
+      ADMIN_USERNAME: ${ADMIN_USERNAME:?ADMIN_USERNAME requis au premier démarrage}
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD:?ADMIN_PASSWORD requis au premier démarrage}
+    volumes:
+      - backend-uploads:/app/uploads
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: unless-stopped
 
 volumes:
   postgres-data:
+  backend-uploads:

docs/api-v1.md

@@ -1,6 +1,6 @@
-# VaultDrop — Contrat API V1 (autoritatif)
+# Kazier — Contrat API V1 (autoritatif)
 
-Status : **autoritatif**. Le client mobile est la source de vérité : `mobile/api/types.ts` + `mobile/api/client.ts` sont implémentés et testés ; le serveur Go doit les matcher exactement (méthode + path + enveloppe), il ne re-négocie pas. Document consolidé à partir de ces deux fichiers — toute divergence de ce doc doit être portée dans le client d'abord.
+Status : **autoritatif**. Le client mobile Kotlin est la source de vérité : `data/remote/ApiService.kt` + `data/remote/dto/Dtos.kt` (contrat Retrofit/Moshi) sont implémentés ; le serveur Go doit les matcher exactement (méthode + path + enveloppe), il ne re-négocie pas. Document consolidé depuis le client — toute divergence de ce doc doit être portée dans le client d'abord.
 
 Références : `V2.md` (modèle cible), `mobile/services/db/` (conventions sync), `AGENTS.md` (structure + commandes).
 
@@ -8,7 +8,7 @@ Références : `V2.md` (modèle cible), `mobile/services/db/` (conventions sync)
 
 ## 1. Base et transport
 
-- Base URL serveur : schéma + host configurés côté client via `EXPO_PUBLIC_API_BASE_URL` (défaut `http://localhost:8080/api/v1`).
+- Base URL serveur : configurable à l'exécution dans les Réglages de l'appli (défaut `http://10.0.2.2:8080/api/v1`).
 - JSON partout, sauf `POST /files/upload` (multipart).
 - Enveloppe succès : `{ "data": T, "meta"?: { "page": int, "pageSize": int, "total": int } }` (`meta` présent sur les listes paginées).
 - Erreur : `{ "error": { "code": string, "message": string } }` + statut HTTP adéquat.
@@ -43,10 +43,11 @@ Références : `V2.md` (modèle cible), `mobile/services/db/` (conventions sync)
 | POST | `/files/upload` | multipart : `file` (uri/name/type), `folderId?` | `FileDto` | `FILE_TOO_LARGE` |
 | POST | `/ocr/jobs` | `{ "fileId": "…" }` | `OcrJob` | — |
 | GET | `/ocr/jobs/:id` | — | `OcrJob` | `NOT_FOUND` |
+| GET | `/files/:id/ocr` | — | `FileOcr` (`{ text, updatedAt }`) | `NOT_FOUND` |
 | POST | `/sync/ops` | voir §6 | voir §6 | — |
 | GET | `/sync/permissions` | query `after?` (cached_at ms) | `ResourcePermission[]` | — |
 
-> **Lecture partagée** : `GET /files`, `GET /files/:id`, `GET /files/search` et `GET /files/folders` couvrent les ressources **possédées ET partagées** (accès `viewer+`, §6.2). Le rename d'une ressource partagée passe par l'outbox `update_metadata` (nécessite `editor+`, §6.1). `DELETE /files/:id` reste owner-only.
+> **Lecture partagée** : `GET /files`, `GET /files/:id`, `GET /files/search`, `GET /files/:id/ocr` et `GET /files/folders` couvrent les ressources **possédées ET partagées** (accès `viewer+`, §6.2). Le rename d'une ressource partagée passe par l'outbox `update_metadata` (nécessite `editor+`, §6.1). `DELETE /files/:id` reste owner-only.
 
 ### DTOs (copie conforme de `mobile/api/types.ts`)
 
@@ -64,20 +65,24 @@ type FileDto = {
 type FolderDto = { id: string; name: string; parentId?: string | null };
 type OcrJobStatus = 'queued' | 'processing' | 'done' | 'failed';
 type OcrJob = { id: string; status: OcrJobStatus; text?: string | null; error?: string | null };
+type FileOcr = { text: string; updatedAt?: string | null };
 ```
 
 ## 4. Upload
 
-- Multipart : champ `file` + `folderId?` optionnel. **Le client ne fixe jamais `Content-Type`** (le boundary doit être généré par la plateforme).
+- Multipart : champ `file` + `folderId?` optionnel + `resourceId?` optionnel. **Le client ne fixe jamais `Content-Type`** (le boundary doit être généré par la plateforme).
+- `resourceId` optionnel : cible un **fichier déjà connu du user** (créé metadata-only via l'outbox `create_resource`, ou précédemment uploadé) pour lui **attacher ses octets physiques** — cas d'usage : le client local-first doit fournir le bytes d'un fichier SAF pour l'OCR serveur (`POST /ocr/jobs`). Le `resourceId` fourni doit exister et appartenir au user (sinon `NOT_FOUND`, même réponses/format que `GET /files/:id`) ; la ligne n'est **jamais re-créée ni renommée ni déplacée**, seule la métadonnée physique (`size`/`mimeType`/extension) est rafraîchie et `FileDto` renvoyé. `resourceId` absent → comportement historique (nouvelle ressource).
 - Limite : `MAX_FILE_SIZE_MB` (défaut 50). Dépassement → 413 `{ "error": { "code": "FILE_TOO_LARGE", … } }`.
 - Le fichier physique est stocké sous `UPLOAD_DIR/<user_id>/<resource_id>.<ext>` ; la métadonnée est persistée en base et renvoyée en `FileDto`. Si la persistance de la métadonnée échoue (ex. `NAME_CONFLICT`), le fichier physique est supprimé.
 
 ## 5. OCR
 
-- `POST /ocr/jobs { fileId }` → `OcrJob` immédiat (`status: queued`), traitement **asynchrone** (goroutine par job côté serveur, V1).
+- `POST /ocr/jobs { fileId }` → `OcrJob` immédiat (`status: queued`), traitement **asynchrone** par une **file serveur bornée** (`ocr_jobs` + worker `Ocr.Run`, `OCR_WORKERS` défaut 2) — le handler n'enfile **jamais** de traitement, Tesseract tourne hors request handler (FIFO, récupération des `processing` orphelins au boot).
 - `GET /ocr/jobs/:id` → statut. Le mobile **poll toutes les 3s** jusqu'à `done`/`failed` (`hooks/useUpload.ts`). Cycle : `queued → processing → done | failed` ; `done` renvoie `text`, `failed` renvoie `error`.
 - Moteur : **Tesseract en appel système** (`ocr/tesseract.go`), langue `OCR_LANG` (défaut `fra+eng`). Les images sont passées directement à `tesseract` ; les **PDF** subissent une extraction du calque texte (`ledongthuc/pdf`, déjà en go.mod) — un PDF scanné produit un texte vide plutôt qu'un rendu/OCR (hors scope V1).
 - `fileId` inconnu/pas du user → `NOT_FOUND`. Fichier physique introuvable (ex. suppression manuelle sous `UPLOAD_DIR`) → job `failed` `"file not readable"`. Le job est créé par le device courant (`ocr_jobs.device_id`) mais la validation de la ressource est scopée par le **user**.
+- **Le texte atterrit sur la ressource** : à la complétion (`done` avec texte non vide), le worker écrit l'extrait trimé dans `resources.ocr_text` (et **bump `updated_at`**, d'où une injection dans le delta outbox/snapshot). `ocr_jobs.text` reste l'historique du job.
+- **`GET /files/:id/ocr`** → `FileOcr { text, updatedAt }` : l'extrait server-side du fichier, lisible par le **possédant ET les grantees** (`viewer+`, même portée que `GET /files/:id` ; `text` `""` si pas encore extrait). Un **second device** rapatrie ainsi le texte d'un OCR fait par un autre device (ou par la ressource partagée) **sans re-téléverser les octets ni re-soumettre de job** — le client Kotlin le fait en tête de `OcrRepository.syncFromServer`/`processAuto` et du viewer (`OcrViewModel`).
 
 ## 6. Contrat de sync (outbox + snapshot)
 

mise.toml

@@ -26,3 +26,71 @@ else
   adb -d install -r "$APK"
 fi
 '''
+
+[tasks.test]
+description = "Run all tests (Go + Kotlin)"
+run = '''
+set -euo pipefail
+cd backend && go test ./...
+cd ../mobile-kotlin && ./gradlew :app:testDebugUnitTest -q
+'''
+
+[tasks.build]
+description = "Build all artifacts (Go binary + Android APK)"
+run = '''
+set -euo pipefail
+VERSION=$(cat VERSION)
+mkdir -p backend/bin
+cd backend && go build -ldflags "-X main.version=$VERSION" -o bin/kazier-server cmd/server/main.go
+cd ../mobile-kotlin && ./gradlew :app:assembleDebug -q
+'''
+
+[tasks.lint]
+description = "Lint all code (staticcheck + Android Lint)"
+run = '''
+set -euo pipefail
+cd backend && staticcheck ./...
+cd ../mobile-kotlin && ./gradlew :app:lint -q
+'''
+
+[tasks."build:release"]
+description = "Build signed release APK (assembleRelease)"
+dir = "mobile-kotlin"
+run = '''
+#!/usr/bin/env bash
+set -euo pipefail
+if [ ! -f app/signing.properties ] && [ -z "${SIGNING_STORE_FILE:-}" ]; then
+  echo "signing.properties absent — copiez app/signing.properties.example et"
+  echo "préparez un keystore, ou fournissez SIGNING_STORE_FILE (CI)." >&2
+  exit 1
+fi
+./gradlew :app:assembleRelease -q
+echo "APK : app/build/outputs/apk/release/app-release.apk"
+'''
+
+[tasks."docker:build"]
+description = "Build the backend Docker image (tagged with VERSION)"
+run = '''
+set -euo pipefail
+VERSION=$(cat VERSION)
+docker build \\
+  --build-arg VERSION="$VERSION" \\
+  --build-arg BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)" \\
+  -t kazier-server:"$VERSION" \\
+  ./backend
+echo "Image : kazier-server:$VERSION"
+'''
+
+[tasks.release]
+description = "Local release checklist: test, build artifacts, tag, push"
+run = '''
+set -euo pipefail
+VERSION=$(cat VERSION)
+echo ">>> Version : $VERSION (tag cible v$VERSION)"
+mise run test
+mise run build
+mise run docker:build
+echo
+echo "Prêt à tagger ? La CI GitLab construira la release finale à partir du tag."
+echo "  git tag v$VERSION && git push origin v$VERSION"
+'''

mobile-kotlin/app/build.gradle.kts

@@ -8,19 +8,34 @@ plugins {
     alias(libs.plugins.hilt)
 }
 
+// Source unique de vérité : VERSION à la racine du dépôt (ex. 0.1.0).
+val kazierVersion: String = rootProject.file("../VERSION").readText().trim()
+val kazierVersionCode: Int = run {
+    val parts = kazierVersion.split('.').map { it.toInt() }
+    check(parts.size == 3) { "VERSION doit être major.minor.patch, reçu: $kazierVersion" }
+    parts[0] * 1_000_000 + parts[1] * 1_000 + parts[2]
+}
+
+// Signature release : signing.properties (gitignoré) en local, variables
+// d'env (SIGNING_*) en CI. Jamais de keystore commité.
+val signingProps = Properties().apply {
+    val f = file("signing.properties")
+    if (f.exists()) f.inputStream().use { load(it) }
+}
+
 android {
-    namespace = "com.vaultdrop.mobile"
+    namespace = "com.kazier.mobile"
     compileSdk = 35
 
     defaultConfig {
-        applicationId = "com.vaultdrop.mobile"
+        applicationId = "com.kazier.mobile"
         minSdk = 26
         // targetSdk 35 exige des .so alignés en 16K ; les libs précompilées
         // OpenCV/CameraX sont en 4K (warning de compatibilité sur devices
         // 16K-pages). On reste en 34 tant qu'elles ne sont pas mises à jour.
         targetSdk = 34
-        versionCode = 1
-        versionName = "0.1.0"
+        versionCode = kazierVersionCode
+        versionName = kazierVersion
 
         // OpenCV natif : on conserve uniquement les ABIs ciblés
         // (arm64 = devices, x86_64 = émulateur) pour garder l'APK raisonnable.
@@ -29,6 +44,18 @@ android {
         }
     }
 
+    signingConfigs {
+        create("release") {
+            val storePath = signingProps.getProperty("storeFile") ?: System.getenv("SIGNING_STORE_FILE")
+            if (storePath != null) {
+                storeFile = file(storePath)
+                storePassword = signingProps.getProperty("storePassword") ?: System.getenv("SIGNING_STORE_PASSWORD")
+                keyAlias = signingProps.getProperty("keyAlias") ?: System.getenv("SIGNING_KEY_ALIAS")
+                keyPassword = signingProps.getProperty("keyPassword") ?: System.getenv("SIGNING_KEY_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = false
@@ -36,6 +63,7 @@ android {
                 getDefaultProguardFile("proguard-android-optimize.txt"),
                 "proguard-rules.pro",
             )
+            signingConfig = signingConfigs.getByName("release")
         }
     }
     compileOptions {

mobile-kotlin/app/signing.properties.example

@@ -0,0 +1,16 @@
+# Signature release Android — copier vers signing.properties (jamais commité)
+# Alternative CI : mêmes valeurs via les variables d'environnement SIGNING_*.
+#
+# 1. Générer un keystore (ne jamais le committer, garder en lieu sûr) :
+#    keytool -genkey -v -keystore release.keystore -alias kazier \
+#            -keyalg RSA -keysize 2048 -validity 10000
+#    Note : un keystore existant garde SON alias d'origine (ex. kazier) —
+#    reporter alors la même valeur dans keyAlias ci-dessous.
+# 2. Renseigner les valeurs ci-dessous.
+#
+# storeFile est relatif au répertoire du module app/ (mobile-kotlin/app).
+
+storeFile=release.keystore
+storePassword=CHANGE_ME
+keyAlias=kazier
+keyPassword=CHANGE_ME

mobile-kotlin/app/src/main/AndroidManifest.xml

@@ -10,17 +10,17 @@
         android:required="false" />
 
     <application
-        android:name=".VaultDropApplication"
+        android:name=".KazierApplication"
         android:allowBackup="true"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
         android:supportsRtl="true"
         android:usesCleartextTraffic="true"
-        android:theme="@style/Theme.VaultDrop">
+        android:theme="@style/Theme.Kazier">
 
         <!-- HiltWorkerFactory : désactive l'initialisation WorkManager par
              défaut (androidx.startup) pour que Configuration.Provider
-             (VaultDropApplication) soit honoré — sinon le @HiltWorker ne peut
+             (KazierApplication) soit honoré — sinon le @HiltWorker ne peut
              pas être instancié (NoSuchMethodException). -->
         <provider
             android:name="androidx.startup.InitializationProvider"
@@ -36,7 +36,7 @@
         <activity
             android:name=".MainActivity"
             android:exported="true"
-            android:theme="@style/Theme.VaultDrop">
+            android:theme="@style/Theme.Kazier">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />

mobile-kotlin/app/src/main/java/com/kazier/mobile/KazierApplication.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile
+package com.kazier.mobile
 
 import android.app.Application
 import androidx.hilt.work.HiltWorkerFactory
@@ -8,7 +8,7 @@ import timber.log.Timber
 import javax.inject.Inject
 
 @HiltAndroidApp
-class VaultDropApplication : Application(), Configuration.Provider {
+class KazierApplication : Application(), Configuration.Provider {
 
     @Inject
     lateinit var workerFactory: HiltWorkerFactory

mobile-kotlin/app/src/main/java/com/kazier/mobile/MainActivity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile
+package com.kazier.mobile
 
 import android.os.Bundle
 import androidx.activity.ComponentActivity
@@ -7,9 +7,9 @@ import androidx.activity.enableEdgeToEdge
 import androidx.compose.runtime.getValue
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import androidx.lifecycle.lifecycleScope
-import com.vaultdrop.mobile.domain.ThemePreferenceStore
-import com.vaultdrop.mobile.ui.navigation.VaultDropApp
-import com.vaultdrop.mobile.ui.theme.VaultDropTheme
+import com.kazier.mobile.domain.ThemePreferenceStore
+import com.kazier.mobile.ui.navigation.KazierApp
+import com.kazier.mobile.ui.theme.KazierTheme
 import dagger.hilt.android.AndroidEntryPoint
 import javax.inject.Inject
 import kotlinx.coroutines.launch
@@ -28,8 +28,8 @@ class MainActivity : ComponentActivity() {
 
         setContent {
             val theme by themePreferenceStore.theme.collectAsStateWithLifecycle()
-            VaultDropTheme(theme = theme) {
-                VaultDropApp()
+            KazierTheme(theme = theme) {
+                KazierApp()
             }
         }
     }

mobile-kotlin/app/src/main/java/com/kazier/mobile/auth/SecureTokenStore.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.auth
+package com.kazier.mobile.auth
 
 import android.content.Context
 import android.content.SharedPreferences
@@ -6,7 +6,7 @@ import androidx.security.crypto.EncryptedSharedPreferences
 import androidx.security.crypto.MasterKeys
 import com.squareup.moshi.JsonAdapter
 import com.squareup.moshi.Moshi
-import com.vaultdrop.mobile.data.remote.dto.UserDto
+import com.kazier.mobile.data.remote.dto.UserDto
 import dagger.hilt.android.qualifiers.ApplicationContext
 import javax.inject.Inject
 import javax.inject.Singleton
@@ -56,8 +56,8 @@ class SecureTokenStore @Inject constructor(
     }
 
     companion object {
-        private const val FILE_NAME = "vaultdrop_secure"
-        private const val KEY_TOKEN = "vaultdrop.auth_token"
-        private const val KEY_ACCOUNT = "vaultdrop.account"
+        private const val FILE_NAME = "kazier_secure"
+        private const val KEY_TOKEN = "kazier.auth_token"
+        private const val KEY_ACCOUNT = "kazier.account"
     }
 }

mobile-kotlin/app/src/main/java/com/kazier/mobile/auth/SessionManager.kt

@@ -1,10 +1,10 @@
-package com.vaultdrop.mobile.auth
+package com.kazier.mobile.auth
 
-import com.vaultdrop.mobile.data.remote.ApiClient
-import com.vaultdrop.mobile.data.remote.dto.LoginResponseDto
-import com.vaultdrop.mobile.domain.ActiveUserStore
-import com.vaultdrop.mobile.domain.DeviceIdentity
-import com.vaultdrop.mobile.domain.LocalModeStore
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.dto.LoginResponseDto
+import com.kazier.mobile.domain.ActiveUserStore
+import com.kazier.mobile.domain.DeviceIdentity
+import com.kazier.mobile.domain.LocalModeStore
 import javax.inject.Inject
 import javax.inject.Singleton
 
@@ -30,7 +30,7 @@ class SessionManager @Inject constructor(
         return AuthSession(token = token, user = user)
     }
 
-    suspend fun save(token: String, user: com.vaultdrop.mobile.data.remote.dto.UserDto) {
+    suspend fun save(token: String, user: com.kazier.mobile.data.remote.dto.UserDto) {
         secureTokenStore.save(token, user)
         activeUserStore.set(user.id)
         localModeStore.clear()
@@ -52,5 +52,5 @@ class SessionManager @Inject constructor(
 
 data class AuthSession(
     val token: String,
-    val user: com.vaultdrop.mobile.data.remote.dto.UserDto,
+    val user: com.kazier.mobile.data.remote.dto.UserDto,
 )

mobile-kotlin/app/src/main/java/com/kazier/mobile/auth/TokenProvider.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.auth
+package com.kazier.mobile.auth
 
 import javax.inject.Inject
 import javax.inject.Singleton

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/AppDatabase.kt

@@ -0,0 +1,42 @@
+package com.kazier.mobile.data.local
+
+import androidx.room.Database
+import androidx.room.RoomDatabase
+import com.kazier.mobile.data.local.dao.FileDao
+import com.kazier.mobile.data.local.dao.FolderDao
+import com.kazier.mobile.data.local.dao.PendingOperationDao
+import com.kazier.mobile.data.local.dao.ScanDao
+import com.kazier.mobile.data.local.dao.UserPreferenceDao
+import com.kazier.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.local.entity.FolderEntity
+import com.kazier.mobile.data.local.entity.PendingOperationEntity
+import com.kazier.mobile.data.local.entity.ScanPageEntity
+import com.kazier.mobile.data.local.entity.ScanSessionEntity
+import com.kazier.mobile.data.local.entity.UserPreferenceEntity
+
+/*
+ * DB SQLite locale, `dot.db` (même nom que la version Expo).
+ * v1: folders ; v2: user_preferences ; v3: files ; v4: category sur files ;
+ * v5: created_in_app sur folders ; v6: processed sur files (mode review) ;
+ * v7: pending_operations (outbox) ; v8: scan_sessions + scan_pages (scanner) ;
+ * v9: content sur files (corps des notes créées dans l'app) ;
+ * v10: ocr_text sur files (extrait OCR serveur persisté localement) ;
+ * v11: ocr_attempts + ocr_queued_at sur files (driver OCR auto côté client —
+ *   compteur d'échecs terminaux ≤ 3, marqueur « en cours » de l'upload).
+ */
+@Database(
+    entities = [
+        FolderEntity::class, UserPreferenceEntity::class, FileEntity::class,
+        PendingOperationEntity::class, ScanSessionEntity::class, ScanPageEntity::class,
+    ],
+    version = 11,
+    exportSchema = false,
+)
+abstract class AppDatabase : RoomDatabase() {
+
+    abstract fun folderDao(): FolderDao
+    abstract fun userPreferenceDao(): UserPreferenceDao
+    abstract fun fileDao(): FileDao
+    abstract fun pendingOperationDao(): PendingOperationDao
+    abstract fun scanDao(): ScanDao
+}

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/FileOrdering.kt

@@ -1,6 +1,6 @@
-package com.vaultdrop.mobile.data.local
+package com.kazier.mobile.data.local
 
-import com.vaultdrop.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.local.entity.FileEntity
 
 /** Date de référence d'un fichier : modification SAF quand dispo, sinon ajout local. */
 val FileEntity.referenceDate: Long

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/dao/FileDao.kt

@@ -1,9 +1,9 @@
-package com.vaultdrop.mobile.data.local.dao
+package com.kazier.mobile.data.local.dao
 
 import androidx.room.Dao
 import androidx.room.Query
 import androidx.room.Upsert
-import com.vaultdrop.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.local.entity.FileEntity
 import kotlinx.coroutines.flow.Flow
 
 @Dao
@@ -122,4 +122,37 @@ interface FileDao {
         WHERE "exists" = 1 AND processed = 0 AND uri IS NOT NULL
     """)
     suspend fun markAllProcessed(updatedAt: Long)
+
+    /** Persiste l'extrait OCR d'un fichier (résultat local du job serveur). */
+    @Query("UPDATE files SET ocr_text = :text, updated_at = :updatedAt WHERE resource_id = :resourceId")
+    suspend fun updateOcrText(resourceId: String, text: String?, updatedAt: Long)
+
+    /** Candidate OCR auto : fichier `processed`, `local-cloud`, avec copie
+     * locale, format potentiellement extractible, jamais extrait, pas en cours
+     * et pas épuisé (< 3 échecs terminaux). Trié par dernier upload. */
+    @Query("""
+        SELECT * FROM files
+        WHERE "exists" = 1
+          AND processed = 1
+          AND sync_status = 'local-cloud'
+          AND uri IS NOT NULL
+          AND ocr_text IS NULL
+          AND ocr_attempts < 3
+          AND ocr_queued_at IS NULL
+          AND category IN ('PDF', 'IMAGE', 'TEXT')
+        ORDER BY COALESCE(last_modified, added_at) DESC, name ASC
+    """)
+    suspend fun getOcrAutoCandidates(): List<FileEntity>
+
+    /** Pose le marqueur « en cours » du driver OCR auto (upload en vol). */
+    @Query("UPDATE files SET ocr_queued_at = :queuedAt, updated_at = :now WHERE resource_id = :resourceId")
+    suspend fun markOcrQueued(resourceId: String, queuedAt: Long, now: Long)
+
+    /** Levé du marqueur + reset du compteur d'échecs (succès / erreur transitoire). */
+    @Query("UPDATE files SET ocr_queued_at = NULL, ocr_attempts = 0, updated_at = :now WHERE resource_id = :resourceId")
+    suspend fun clearOcrQueued(resourceId: String, now: Long)
+
+    /** Échec terminal : +1 tentative, marqueur levé (ne rejoue pas à l'infini). */
+    @Query("UPDATE files SET ocr_attempts = ocr_attempts + 1, ocr_queued_at = NULL, updated_at = :now WHERE resource_id = :resourceId")
+    suspend fun markOcrFailure(resourceId: String, now: Long)
 }

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/dao/FolderDao.kt

@@ -1,11 +1,11 @@
-package com.vaultdrop.mobile.data.local.dao
+package com.kazier.mobile.data.local.dao
 
 import androidx.room.Dao
 import androidx.room.Insert
 import androidx.room.OnConflictStrategy
 import androidx.room.Query
 import androidx.room.Upsert
-import com.vaultdrop.mobile.data.local.entity.FolderEntity
+import com.kazier.mobile.data.local.entity.FolderEntity
 import kotlinx.coroutines.flow.Flow
 
 @Dao

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/dao/PendingOperationDao.kt

@@ -1,9 +1,9 @@
-package com.vaultdrop.mobile.data.local.dao
+package com.kazier.mobile.data.local.dao
 
 import androidx.room.Dao
 import androidx.room.Insert
 import androidx.room.Query
-import com.vaultdrop.mobile.data.local.entity.PendingOperationEntity
+import com.kazier.mobile.data.local.entity.PendingOperationEntity
 import kotlinx.coroutines.flow.Flow
 
 @Dao

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/dao/ScanDao.kt

@@ -1,11 +1,11 @@
-package com.vaultdrop.mobile.data.local.dao
+package com.kazier.mobile.data.local.dao
 
 import androidx.room.Dao
 import androidx.room.Insert
 import androidx.room.Query
 import androidx.room.Update
-import com.vaultdrop.mobile.data.local.entity.ScanPageEntity
-import com.vaultdrop.mobile.data.local.entity.ScanSessionEntity
+import com.kazier.mobile.data.local.entity.ScanPageEntity
+import com.kazier.mobile.data.local.entity.ScanSessionEntity
 import kotlinx.coroutines.flow.Flow
 
 /** Persistance des sessions de scan (appareil photo) — local uniquement. */

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/dao/UserPreferenceDao.kt

@@ -1,11 +1,11 @@
-package com.vaultdrop.mobile.data.local.dao
+package com.kazier.mobile.data.local.dao
 
 import androidx.room.Dao
 import androidx.room.Insert
 import androidx.room.OnConflictStrategy
 import androidx.room.Query
 import androidx.room.Upsert
-import com.vaultdrop.mobile.data.local.entity.UserPreferenceEntity
+import com.kazier.mobile.data.local.entity.UserPreferenceEntity
 
 @Dao
 interface UserPreferenceDao {

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/FileEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity
@@ -51,8 +51,16 @@ data class FileEntity(
     val category: String? = null,
     @ColumnInfo(name = "sync_status")
     val syncStatus: String = "local",
+    @ColumnInfo(name = "content")
+    val content: String? = null,
     @ColumnInfo(name = "processed")
     val processed: Boolean = false,
+    @ColumnInfo(name = "ocr_text")
+    val ocrText: String? = null,
+    @ColumnInfo(name = "ocr_attempts")
+    val ocrAttempts: Int = 0,
+    @ColumnInfo(name = "ocr_queued_at")
+    val ocrQueuedAt: Long? = null,
     @ColumnInfo(name = "added_at")
     val addedAt: Long,
     @ColumnInfo(name = "updated_at")

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/FolderEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/PendingOperationEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/ScanPageEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/ScanSessionEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/entity/UserPreferenceEntity.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.entity
+package com.kazier.mobile.data.local.entity
 
 import androidx.room.ColumnInfo
 import androidx.room.Entity

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/local/migration/Migrations.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.local.migration
+package com.kazier.mobile.data.local.migration
 
 import androidx.room.migration.Migration
 import androidx.sqlite.db.SupportSQLiteDatabase
@@ -22,6 +22,10 @@ import androidx.sqlite.db.SupportSQLiteDatabase
  *   docs/api-v1.md §6.1).
  * v8 : tables `scan_sessions` + `scan_pages` (scanner appareil photo) — session
  *   multi-pages persistée pour survivre au process death avant export SAF.
+ * v9 : ajout colonne `content` sur `files` — corps d'une note créée dans
+ *   l'app (fichier cloud-only, uri = NULL). Null pour les fichiers importés.
+ * v10 : ajout colonne `ocr_text` sur `files` — extrait OCR serveur persisté
+ *   localement (résultat d'un job `POST /ocr/jobs`, réaffichable sans relance).
  */
 object Migrations {
 
@@ -158,7 +162,26 @@ object Migrations {
         }
     }
 
+    private val MIGRATION_8_9 = object : Migration(8, 9) {
+        override fun migrate(db: SupportSQLiteDatabase) {
+            db.execSQL("ALTER TABLE `files` ADD COLUMN `content` TEXT")
+        }
+    }
+
+    private val MIGRATION_9_10 = object : Migration(9, 10) {
+        override fun migrate(db: SupportSQLiteDatabase) {
+            db.execSQL("ALTER TABLE `files` ADD COLUMN `ocr_text` TEXT")
+        }
+    }
+
+    private val MIGRATION_10_11 = object : Migration(10, 11) {
+        override fun migrate(db: SupportSQLiteDatabase) {
+            db.execSQL("ALTER TABLE `files` ADD COLUMN `ocr_attempts` INTEGER NOT NULL DEFAULT 0")
+            db.execSQL("ALTER TABLE `files` ADD COLUMN `ocr_queued_at` INTEGER")
+        }
+    }
+
     val ALL: Array<Migration> = arrayOf(
-        MIGRATION_1_2, MIGRATION_2_3, MIGRATION_3_4, MIGRATION_4_5, MIGRATION_5_6, MIGRATION_6_7, MIGRATION_7_8,
+        MIGRATION_1_2, MIGRATION_2_3, MIGRATION_3_4, MIGRATION_4_5, MIGRATION_5_6, MIGRATION_6_7, MIGRATION_7_8, MIGRATION_8_9, MIGRATION_9_10, MIGRATION_10_11,
     )
 }

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/preferences/DefaultRootStore.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.preferences
+package com.kazier.mobile.data.preferences
 
 import android.content.Context
 import android.content.SharedPreferences
@@ -7,7 +7,7 @@ import javax.inject.Inject
 import javax.inject.Singleton
 
 /**
- * Racine VaultDrop : le dossier SAF unique et obligatoire choisi au premier
+ * Racine Kazier : le dossier SAF unique et obligatoire choisi au premier
  * lancement. Tous les exports (assemblage PDF) y sont écrits directement,
  * sans sélecteur — la permission persistante sur l'arbre est acquise à ce
  * moment-là.
@@ -31,7 +31,7 @@ class DefaultRootStore @Inject constructor(
     }
 
     companion object {
-        private const val FILE_NAME = "vaultdrop_prefs"
-        private const val KEY_ROOT_RESOURCE_ID = "vaultdrop.default_root_resource_id"
+        private const val FILE_NAME = "kazier_prefs"
+        private const val KEY_ROOT_RESOURCE_ID = "kazier.default_root_resource_id"
     }
 }

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/remote/ApiClient.kt

@@ -1,19 +1,26 @@
-package com.vaultdrop.mobile.data.remote
+package com.kazier.mobile.data.remote
 
 import com.squareup.moshi.JsonAdapter
 import com.squareup.moshi.Moshi
-import com.vaultdrop.mobile.data.remote.dto.ApiEnvelope
-import com.vaultdrop.mobile.data.remote.dto.ApiErrorEnvelope
-import com.vaultdrop.mobile.data.remote.dto.DeviceRegistrationDto
-import com.vaultdrop.mobile.data.remote.dto.FileDto
-import com.vaultdrop.mobile.data.remote.dto.FolderDto
-import com.vaultdrop.mobile.data.remote.dto.LoginRequestDto
-import com.vaultdrop.mobile.data.remote.dto.LoginResponseDto
-import com.vaultdrop.mobile.data.remote.dto.ResolvedUserDto
-import com.vaultdrop.mobile.data.remote.dto.ResourcePermissionDto
-import com.vaultdrop.mobile.data.remote.dto.SyncOpDto
-import com.vaultdrop.mobile.data.remote.dto.SyncOpsRequest
-import com.vaultdrop.mobile.data.remote.dto.SyncOpsResult
+import com.kazier.mobile.data.remote.dto.ApiEnvelope
+import com.kazier.mobile.data.remote.dto.ApiErrorEnvelope
+import com.kazier.mobile.data.remote.dto.DeviceRegistrationDto
+import com.kazier.mobile.data.remote.dto.FileDto
+import com.kazier.mobile.data.remote.dto.FileOcrDto
+import com.kazier.mobile.data.remote.dto.FolderDto
+import com.kazier.mobile.data.remote.dto.LoginRequestDto
+import com.kazier.mobile.data.remote.dto.LoginResponseDto
+import com.kazier.mobile.data.remote.dto.OcrJobDto
+import com.kazier.mobile.data.remote.dto.OcrSubmitDto
+import com.kazier.mobile.data.remote.dto.ResolvedUserDto
+import com.kazier.mobile.data.remote.dto.ResourcePermissionDto
+import com.kazier.mobile.data.remote.dto.SyncOpDto
+import com.kazier.mobile.data.remote.dto.SyncOpsRequest
+import com.kazier.mobile.data.remote.dto.SyncOpsResult
+import okhttp3.MultipartBody
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.RequestBody
+import okhttp3.RequestBody.Companion.toRequestBody
 import okio.IOException
 import retrofit2.Response
 import timber.log.Timber
@@ -76,6 +83,33 @@ class ApiClient @Inject constructor(
     suspend fun syncPermissions(after: Long? = null): List<ResourcePermissionDto> =
         unwrap({ apiService.syncPermissions(after) })
 
+    /**
+     * Upload ciblé des octets d'un fichier vers son `resource_id` serveur
+     * (pipeline multipart séparé, hors outbox — cas d'usage OCR). La partie
+     * `file` est construite par l'appelant (flux SAF).
+     */
+    suspend fun uploadFile(
+        file: MultipartBody.Part,
+        resourceId: String? = null,
+        folderId: String? = null,
+    ): FileDto {
+        val resourceIdBody = resourceId?.toRequestBody("text/plain".toMediaType())
+        val folderIdBody = folderId?.toRequestBody("text/plain".toMediaType())
+        return unwrap({ apiService.uploadFile(file, resourceIdBody, folderIdBody) })
+    }
+
+    /** Soumet un job OCR serveur pour un fichier possédé. */
+    suspend fun submitOcr(fileId: String): OcrJobDto =
+        unwrap({ apiService.submitOcr(OcrSubmitDto(fileId)) })
+
+    /** Interroge un job OCR par son id (scopé au device du token). */
+    suspend fun getOcrJob(jobId: String): OcrJobDto =
+        unwrap({ apiService.getOcrJob(jobId) })
+
+    /** Extrait OCR server-side d'un fichier visible (viewer+, own ou shared). */
+    suspend fun getFileOcr(fileId: String): FileOcrDto =
+        unwrap({ apiService.getFileOcr(fileId) })
+
     private suspend fun <T> unwrap(
         call: suspend () -> Response<ApiEnvelope<T>>,
         skipUnauthorizedHandling: Boolean = false,

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/remote/ApiService.kt

@@ -0,0 +1,110 @@
+package com.kazier.mobile.data.remote
+
+import com.kazier.mobile.data.remote.dto.ApiEnvelope
+import com.kazier.mobile.data.remote.dto.DeviceRegistrationDto
+import com.kazier.mobile.data.remote.dto.FileDto
+import com.kazier.mobile.data.remote.dto.FileOcrDto
+import com.kazier.mobile.data.remote.dto.FolderDto
+import com.kazier.mobile.data.remote.dto.LoginRequestDto
+import com.kazier.mobile.data.remote.dto.LoginResponseDto
+import com.kazier.mobile.data.remote.dto.OcrJobDto
+import com.kazier.mobile.data.remote.dto.OcrSubmitDto
+import com.kazier.mobile.data.remote.dto.ResolvedUserDto
+import com.kazier.mobile.data.remote.dto.ResourcePermissionDto
+import com.kazier.mobile.data.remote.dto.SyncOpsRequest
+import com.kazier.mobile.data.remote.dto.SyncOpsResult
+import okhttp3.MultipartBody
+import okhttp3.RequestBody
+import retrofit2.Response
+import retrofit2.http.Body
+import retrofit2.http.GET
+import retrofit2.http.Multipart
+import retrofit2.http.POST
+import retrofit2.http.Part
+import retrofit2.http.Path
+import retrofit2.http.Query
+
+/**
+ * Contrat HTTP V1 — copie de `mobile/api/client.ts` (le client mobile est la
+ * source de vérité). Les méthodes renvoient `Response<ApiEnvelope<T>>` pour
+ * que l'`ApiClient` puisse dissocier succès / erreur contractuelle.
+ */
+interface ApiService {
+
+    @GET("files/folders")
+    suspend fun listFolders(): Response<ApiEnvelope<List<FolderDto>>>
+
+    /** Équivalent de `GET /files` (client.ts). Paginé (`meta`). */
+    @GET("files")
+    suspend fun listFiles(
+        @Query("folderId") folderId: String?,
+        @Query("page") page: Int?,
+        @Query("pageSize") pageSize: Int?,
+    ): Response<ApiEnvelope<List<FileDto>>>
+
+    /** Enregistrement idempotent du device — aucun token émis. */
+    @POST("devices")
+    suspend fun registerDevice(
+        @Body body: DeviceRegistrationDto,
+    ): Response<ApiEnvelope<DeviceRegistrationDto>>
+
+    /** Seule porte d'émission de token (V1). 401 = mauvaises identifiants. */
+    @POST("auth/login")
+    suspend fun login(
+        @Body body: LoginRequestDto,
+    ): Response<ApiEnvelope<LoginResponseDto>>
+
+    /** Outbox client→serveur : applique un batch séquentiel, idempotent par device. */
+    @POST("sync/ops")
+    suspend fun syncOps(
+        @Body body: SyncOpsRequest,
+    ): Response<ApiEnvelope<SyncOpsResult>>
+
+    /** Résolution d'un destinataire par username EXACT (jamais d'énumération). */
+    @GET("users/resolve")
+    suspend fun resolveUser(
+        @Query("username") username: String,
+    ): Response<ApiEnvelope<ResolvedUserDto>>
+
+    /** Snapshot des permissions effectives (delta si `after` fourni, ms epoch). */
+    @GET("sync/permissions")
+    suspend fun syncPermissions(
+        @Query("after") after: Long? = null,
+    ): Response<ApiEnvelope<List<ResourcePermissionDto>>>
+
+    /**
+     * Upload ciblé (multipart) : attache les octets d'un fichier SAF à son
+     * `resource_id` serveur déjà connu (créé metadata-only par l'outbox) —
+     * pipeline séparé, hors outbox, prérequis du OCR serveur. `resourceId`
+     * absent → création d'une nouvelle ressource.
+     */
+    @Multipart
+    @POST("files/upload")
+    suspend fun uploadFile(
+        @Part file: MultipartBody.Part,
+        @Part("resourceId") resourceId: RequestBody? = null,
+        @Part("folderId") folderId: RequestBody? = null,
+    ): Response<ApiEnvelope<FileDto>>
+
+    /** Soumet un job OCR serveur — `{ "fileId": "…" }` (docs/api-v1.md §5). */
+    @POST("ocr/jobs")
+    suspend fun submitOcr(
+        @Body body: OcrSubmitDto,
+    ): Response<ApiEnvelope<OcrJobDto>>
+
+    /** Interroge un job OCR — le client poll jusqu'à `done`/`failed` toutes les 3s. */
+    @GET("ocr/jobs/{id}")
+    suspend fun getOcrJob(
+        @Path("id") jobId: String,
+    ): Response<ApiEnvelope<OcrJobDto>>
+
+    /**
+     * Extrait OCR déjà calculé côté serveur pour un fichier visible (viewer+,
+     * own ou shared). Permet à un second device de récupérer le texte sans
+     * re-téléverser les octets (docs/api-v1.md §5).
+     */
+    @GET("files/{id}/ocr")
+    suspend fun getFileOcr(
+        @Path("id") fileId: String,
+    ): Response<ApiEnvelope<FileOcrDto>>
+}

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/remote/AuthInterceptor.kt

@@ -1,10 +1,10 @@
-package com.vaultdrop.mobile.data.remote
+package com.kazier.mobile.data.remote
 
 import okhttp3.Interceptor
 import okhttp3.Response
 import javax.inject.Inject
 import javax.inject.Singleton
-import com.vaultdrop.mobile.auth.TokenProvider
+import com.kazier.mobile.auth.TokenProvider
 
 /**
  * Injecte `Authorization: Bearer <token>` sur chaque requête si un token est

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/remote/ServerUrlInterceptor.kt

@@ -1,6 +1,6 @@
-package com.vaultdrop.mobile.data.remote
+package com.kazier.mobile.data.remote
 
-import com.vaultdrop.mobile.domain.ServerConfigStore
+import com.kazier.mobile.domain.ServerConfigStore
 import javax.inject.Inject
 import javax.inject.Singleton
 import okhttp3.HttpUrl.Companion.toHttpUrl

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/remote/dto/Dtos.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.data.remote.dto
+package com.kazier.mobile.data.remote.dto
 
 import com.squareup.moshi.Json
 
@@ -130,3 +130,36 @@ data class ResourcePermissionDto(
     @Json(name = "name") val name: String = "",
     @Json(name = "parentId") val parentId: String? = null,
 )
+
+/** Cycle d'un job OCR serveur (docs/api-v1.md §5). */
+object OcrJobStatus {
+    const val QUEUED = "queued"
+    const val PROCESSING = "processing"
+    const val DONE = "done"
+    const val FAILED = "failed"
+
+    val TERMINAL = setOf(DONE, FAILED)
+}
+
+/** Miroir de `OcrJob` (docs/api-v1.md §5) — `text`/`error` présents aux états terminaux. */
+data class OcrJobDto(
+    @Json(name = "id") val id: String,
+    @Json(name = "status") val status: String,
+    @Json(name = "text") val text: String? = null,
+    @Json(name = "error") val error: String? = null,
+)
+
+/** Requête `POST /ocr/jobs` — `{ "fileId": "…32-hex" }` (docs/api-v1.md §5). */
+data class OcrSubmitDto(
+    @Json(name = "fileId") val fileId: String,
+)
+
+/**
+ * Réponse `GET /files/{id}/ocr` — extrait OCR server-side du fichier,
+ * consultable par le user et les grantees (viewer+). `text` "" tant que
+ * l'OCR n'a pas encore atterri sur la ressource (docs/api-v1.md §5).
+ */
+data class FileOcrDto(
+    @Json(name = "text") val text: String,
+    @Json(name = "updatedAt") val updatedAt: String? = null,
+)

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/AuthRepository.kt

@@ -1,8 +1,8 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
-import com.vaultdrop.mobile.data.remote.ApiClient
-import com.vaultdrop.mobile.data.remote.dto.LoginResponseDto
-import com.vaultdrop.mobile.domain.DeviceIdentity
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.dto.LoginResponseDto
+import com.kazier.mobile.domain.DeviceIdentity
 import timber.log.Timber
 import javax.inject.Inject
 import javax.inject.Singleton

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/FileRepository.kt

@@ -1,15 +1,15 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
 import androidx.room.withTransaction
-import com.vaultdrop.mobile.data.local.AppDatabase
-import com.vaultdrop.mobile.data.local.dao.FileDao
-import com.vaultdrop.mobile.data.local.entity.FileEntity
-import com.vaultdrop.mobile.data.local.entity.FileStatus
-import com.vaultdrop.mobile.data.remote.ApiClient
-import com.vaultdrop.mobile.data.remote.dto.FileDto
-import com.vaultdrop.mobile.domain.GenerateId
-import com.vaultdrop.mobile.domain.SyncPlacement
-import com.vaultdrop.mobile.domain.computeCategory
+import com.kazier.mobile.data.local.AppDatabase
+import com.kazier.mobile.data.local.dao.FileDao
+import com.kazier.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.local.entity.FileStatus
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.dto.FileDto
+import com.kazier.mobile.domain.GenerateId
+import com.kazier.mobile.domain.SyncPlacement
+import com.kazier.mobile.domain.computeCategory
 import kotlinx.coroutines.flow.Flow
 import javax.inject.Inject
 import javax.inject.Singleton
@@ -117,6 +117,56 @@ class FileRepository @Inject constructor(
     suspend fun getFile(resourceId: String): FileEntity? =
         fileDao.getByResourceId(resourceId)
 
+    /**
+     * Crée une note fichier directement dans l'app : ligne `files` cloud-only
+     * (uri NULL — aucun copie physique, le corps est stocké dans `content`)
+     * avec `processed = 1` (jamais dans la file de review). Le `create_resource`
+     * est poussé dans la même transaction (pattern transactional outbox).
+     */
+    suspend fun createNote(
+        title: String,
+        body: String,
+        folderResourceId: String,
+        ownerId: String? = null,
+    ): FileEntity {
+        val now = System.currentTimeMillis()
+        val trimmedTitle = title.trim()
+        val noteName = if (trimmedTitle.endsWith(".txt", ignoreCase = true)) {
+            trimmedTitle
+        } else {
+            "$trimmedTitle.txt"
+        }
+        val entity = FileEntity(
+            resourceId = generateId.newResourceId(),
+            uri = null,
+            name = noteName,
+            folderResourceId = folderResourceId,
+            extension = "txt",
+            size = body.length.toLong(),
+            mimeType = "text/plain",
+            exists = 1,
+            ownerId = ownerId,
+            category = computeCategory("text/plain", "txt").dbValue,
+            syncStatus = FileStatus.CLOUD,
+            content = body,
+            processed = true,
+            addedAt = now,
+            updatedAt = now,
+        )
+        appDatabase.withTransaction {
+            fileDao.upsert(entity)
+            outboxRepository.enqueueCreateResource(
+                resourceId = entity.resourceId,
+                resourceType = "file",
+                name = entity.name,
+                parentResourceId = entity.folderResourceId,
+                mimeType = entity.mimeType,
+                extension = entity.extension,
+            )
+        }
+        return entity
+    }
+
     suspend fun getAll(): List<FileEntity> = fileDao.getAll()
 
     /**

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/FolderRepository.kt

@@ -1,15 +1,15 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
 import androidx.room.withTransaction
-import com.vaultdrop.mobile.data.local.AppDatabase
-import com.vaultdrop.mobile.data.local.dao.FolderDao
-import com.vaultdrop.mobile.data.local.entity.FolderEntity
-import com.vaultdrop.mobile.data.local.entity.FolderStatus
-import com.vaultdrop.mobile.data.remote.ApiClient
-import com.vaultdrop.mobile.data.remote.dto.FolderDto
-import com.vaultdrop.mobile.domain.DeviceIdentity
-import com.vaultdrop.mobile.domain.GenerateId
-import com.vaultdrop.mobile.domain.SyncPlacement
+import com.kazier.mobile.data.local.AppDatabase
+import com.kazier.mobile.data.local.dao.FolderDao
+import com.kazier.mobile.data.local.entity.FolderEntity
+import com.kazier.mobile.data.local.entity.FolderStatus
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.dto.FolderDto
+import com.kazier.mobile.domain.DeviceIdentity
+import com.kazier.mobile.domain.GenerateId
+import com.kazier.mobile.domain.SyncPlacement
 import kotlinx.coroutines.flow.Flow
 import javax.inject.Inject
 import javax.inject.Singleton

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/OcrRepository.kt

@@ -0,0 +1,186 @@
+package com.kazier.mobile.data.repository
+
+import android.content.ContentResolver
+import android.content.Context
+import android.net.Uri
+import androidx.core.net.toUri
+import com.kazier.mobile.data.local.dao.FileDao
+import com.kazier.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.ApiException
+import com.kazier.mobile.data.remote.dto.OcrJobDto
+import com.kazier.mobile.data.remote.dto.OcrJobStatus
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.delay
+import okhttp3.MediaType
+import okhttp3.MediaType.Companion.toMediaTypeOrNull
+import okhttp3.MultipartBody
+import okhttp3.RequestBody
+import okio.BufferedSink
+import okio.source
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * OCR serveur (docs/api-v1.md §5) côté client.
+ *
+ * Séquence pour un fichier SAF `processed` + `local-cloud` (resource_id déjà
+ * connu du serveur via l'outbox `create_resource`) :
+ *  0. [syncFromServer] — si un autre device a déjà OCRisé le fichier, le texte
+ *     est rapatrié via `GET /files/:id/ocr` (viewer+) **sans** upload ni job ;
+ *  1. [ensurePhysical] — upload multipart **ciblé** (`resourceId`) des octets
+ *     locaux : pipeline séparé, hors outbox, qui écrit
+ *     `UPLOAD_DIR/<user>/<resource_id>.<ext>` — sans lequel le job OCR
+ *     échouerait « file not readable » ;
+ *  2. [submit] — enfile le job (status `queued`) ;
+ *  3. [poll] — interroge toutes les 3 s jusqu'à `done`/`failed` ;
+ *  4. [saveResult] — persiste l'extrait en Room (v10, `ocr_text`) pour un
+ *     réaffichage sans relance.
+ */
+@Singleton
+class OcrRepository @Inject constructor(
+    private val apiClient: ApiClient,
+    private val fileDao: FileDao,
+    @ApplicationContext private val context: Context,
+) {
+
+    /** Envoie les octets SAF vers le resource_id serveur déjà connu. */
+    suspend fun ensurePhysical(file: FileEntity) {
+        val uri = file.uri ?: return
+        val mediaType = file.mimeType?.toMediaTypeOrNull()
+        val body = SafFileRequestBody(context.contentResolver, uri, file.size, mediaType)
+        apiClient.uploadFile(
+            file = MultipartBody.Part.createFormData("file", file.name, body),
+            resourceId = file.resourceId,
+        )
+    }
+
+    /** Enfile le job OCR du fichier et renvoie son id. */
+    suspend fun submit(fileId: String): String =
+        apiClient.submitOcr(fileId).id
+
+    /**
+     * Poll toutes les 3 s (docs §5) jusqu'à l'état terminal. [onProgress] est
+     * appelé à chaque réponse du serveur (état courant exposé à l'UI).
+     */
+    suspend fun poll(jobId: String, onProgress: (OcrJobDto) -> Unit = {}): OcrJobDto {
+        while (true) {
+            val job = apiClient.getOcrJob(jobId)
+            onProgress(job)
+            if (job.status in OcrJobStatus.TERMINAL) return job
+            delay(POLL_INTERVAL_MS)
+        }
+    }
+
+    /** Persiste l'extrait OCR localement (null = texte absent → nettoyage). */
+    suspend fun saveResult(resourceId: String, text: String?) {
+        fileDao.updateOcrText(resourceId, text?.takeIf { it.isNotBlank() }, System.currentTimeMillis())
+    }
+
+    /**
+     * Rapatrie l'extrait OCR déjà calculé côté serveur pour un fichier visible
+     * (viewer+, own ou shared). Renvoie le texte persisté en Room, ou null si le
+     * serveur n'a pas encore d'extrait — un second device récupère ainsi le
+     * résultat d'un OCR fait par un autre device, **sans re-téléverser les
+     * octets ni re-soumettre un job** (docs/api-v1.md §5, GET /files/:id/ocr).
+     */
+    suspend fun syncFromServer(file: FileEntity): String? {
+        val dto = apiClient.getFileOcr(file.resourceId)
+        if (dto.text.isBlank()) return null
+        saveResult(file.resourceId, dto.text)
+        return dto.text
+    }
+
+    /**
+     * OCR auto d'un fichier (un seul à la fois) : marqueur « en cours », upload
+     * multipart ciblé, soumission du job serveur, poll jusqu'au terminal puis
+     * persistance. Le worker [OcrAutoWorker] appelle cette méthode fichier par
+     * fichier pour rester séquentiel — le traitement lourd reste la file
+     * bornée côté serveur.
+     */
+    suspend fun processAuto(file: FileEntity): OcrAutoOutcome {
+        val now = System.currentTimeMillis()
+        fileDao.markOcrQueued(file.resourceId, now, now)
+        return try {
+            // 0. Un autre device a peut-être déjà OCRisé le fichier : si le
+            //    serveur a le texte, on le rapatrie sans upload ni job.
+            if (syncFromServer(file) != null) {
+                fileDao.clearOcrQueued(file.resourceId, System.currentTimeMillis())
+                return OcrAutoOutcome.Done
+            }
+            ensurePhysical(file)
+            val jobId = submit(file.resourceId)
+            val final = poll(jobId)
+            when (final.status) {
+                OcrJobStatus.DONE -> {
+                    saveResult(file.resourceId, final.text)
+                    fileDao.clearOcrQueued(file.resourceId, System.currentTimeMillis())
+                    OcrAutoOutcome.Done
+                }
+                else -> {
+                    fileDao.markOcrFailure(file.resourceId, System.currentTimeMillis())
+                    OcrAutoOutcome.Failed
+                }
+            }
+        } catch (e: ApiException) {
+            when {
+                e.code == "NETWORK_ERROR" || e.httpCode >= 500 -> {
+                    // Transitoire : levé le marqueur, WorkManager retente avec backoff.
+                    fileDao.clearOcrQueued(file.resourceId, System.currentTimeMillis())
+                    OcrAutoOutcome.Retryable
+                }
+                e.httpCode == 401 -> OcrAutoOutcome.Unauthorized
+                else -> {
+                    // Erreur permanente : +1 tentative (≤ 3), relance manuelle possible.
+                    fileDao.markOcrFailure(file.resourceId, System.currentTimeMillis())
+                    OcrAutoOutcome.Failed
+                }
+            }
+        } catch (e: Exception) {
+            fileDao.markOcrFailure(file.resourceId, System.currentTimeMillis())
+            OcrAutoOutcome.Failed
+        }
+    }
+
+    companion object {
+        const val POLL_INTERVAL_MS = 3_000L
+    }
+}
+
+/** Résultat d'une passe d'OCR auto (un fichier max). */
+sealed interface OcrAutoOutcome {
+    /** Traité avec succès : `ocr_text` persisté. */
+    data object Done : OcrAutoOutcome
+
+    /** Job terminal `failed` / erreur permanente : `ocr_attempts` incrémenté. */
+    data object Failed : OcrAutoOutcome
+
+    /** Erreur transitoire : à retenter via backoff WorkManager. */
+    data object Retryable : OcrAutoOutcome
+
+    /** Token expiré/révoqué : le re-login passera par l'UI. */
+    data object Unauthorized : OcrAutoOutcome
+}
+
+/**
+ * `RequestBody` paresseux : le flux SAF est ouvert à l'écriture (multipart),
+ * jamais chargé en mémoire — les fichiers jusqu'à `MAX_FILE_SIZE_MB` restent
+ * gérables.
+ */
+private class SafFileRequestBody(
+    private val contentResolver: ContentResolver,
+    private val uri: String,
+    private val length: Long,
+    private val mediaType: MediaType?,
+) : RequestBody() {
+
+    override fun contentType(): MediaType? = mediaType
+
+    override fun contentLength(): Long = length
+
+    override fun writeTo(sink: BufferedSink) {
+        contentResolver.openInputStream(uri.toUri())?.use { stream ->
+            sink.writeAll(stream.source())
+        }
+    }
+}

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/OutboxRepository.kt

@@ -1,13 +1,13 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
 import com.squareup.moshi.JsonAdapter
 import com.squareup.moshi.Moshi
 import com.squareup.moshi.Types
-import com.vaultdrop.mobile.data.local.dao.PendingOperationDao
-import com.vaultdrop.mobile.data.local.entity.PendingOpStatus
-import com.vaultdrop.mobile.data.local.entity.PendingOperationEntity
-import com.vaultdrop.mobile.data.local.entity.PendingOperationType
-import com.vaultdrop.mobile.domain.GenerateId
+import com.kazier.mobile.data.local.dao.PendingOperationDao
+import com.kazier.mobile.data.local.entity.PendingOpStatus
+import com.kazier.mobile.data.local.entity.PendingOperationEntity
+import com.kazier.mobile.data.local.entity.PendingOperationType
+import com.kazier.mobile.domain.GenerateId
 import javax.inject.Inject
 import javax.inject.Singleton
 

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/ScanRepository.kt

@@ -1,13 +1,13 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
 import androidx.room.withTransaction
-import com.vaultdrop.mobile.data.local.AppDatabase
-import com.vaultdrop.mobile.data.local.dao.ScanDao
-import com.vaultdrop.mobile.data.local.entity.ScanPageEntity
-import com.vaultdrop.mobile.data.local.entity.ScanPageStatus
-import com.vaultdrop.mobile.data.local.entity.ScanSessionEntity
-import com.vaultdrop.mobile.data.local.entity.ScanSessionStatus
-import com.vaultdrop.mobile.domain.GenerateId
+import com.kazier.mobile.data.local.AppDatabase
+import com.kazier.mobile.data.local.dao.ScanDao
+import com.kazier.mobile.data.local.entity.ScanPageEntity
+import com.kazier.mobile.data.local.entity.ScanPageStatus
+import com.kazier.mobile.data.local.entity.ScanSessionEntity
+import com.kazier.mobile.data.local.entity.ScanSessionStatus
+import com.kazier.mobile.domain.GenerateId
 import kotlinx.coroutines.flow.Flow
 import javax.inject.Inject
 import javax.inject.Singleton

mobile-kotlin/app/src/main/java/com/kazier/mobile/data/repository/ShareRepository.kt

@@ -1,15 +1,15 @@
-package com.vaultdrop.mobile.data.repository
+package com.kazier.mobile.data.repository
 
 import androidx.room.withTransaction
-import com.vaultdrop.mobile.data.local.AppDatabase
-import com.vaultdrop.mobile.data.local.dao.FileDao
-import com.vaultdrop.mobile.data.local.dao.FolderDao
-import com.vaultdrop.mobile.data.local.entity.FileEntity
-import com.vaultdrop.mobile.data.local.entity.FolderEntity
-import com.vaultdrop.mobile.data.remote.ApiClient
-import com.vaultdrop.mobile.data.remote.dto.ResourcePermissionDto
-import com.vaultdrop.mobile.domain.DeviceIdentity
-import com.vaultdrop.mobile.domain.SyncPlacement
+import com.kazier.mobile.data.local.AppDatabase
+import com.kazier.mobile.data.local.dao.FileDao
+import com.kazier.mobile.data.local.dao.FolderDao
+import com.kazier.mobile.data.local.entity.FileEntity
+import com.kazier.mobile.data.local.entity.FolderEntity
+import com.kazier.mobile.data.remote.ApiClient
+import com.kazier.mobile.data.remote.dto.ResourcePermissionDto
+import com.kazier.mobile.domain.DeviceIdentity
+import com.kazier.mobile.domain.SyncPlacement
 import timber.log.Timber
 import javax.inject.Inject
 import javax.inject.Singleton

mobile-kotlin/app/src/main/java/com/kazier/mobile/di/AppModule.kt

@@ -1,4 +1,4 @@
-package com.vaultdrop.mobile.di
+package com.kazier.mobile.di
 
 import dagger.Module
 import dagger.hilt.InstallIn

mobile-kotlin/app/src/main/java/com/kazier/mobile/di/DatabaseModule.kt

@@ -1,14 +1,14 @@
-package com.vaultdrop.mobile.di
+package com.kazier.mobile.di
 
 import android.content.Context
 import androidx.room.Room
-import com.vaultdrop.mobile.data.local.AppDatabase
-import com.vaultdrop.mobile.data.local.dao.FileDao
-import com.vaultdrop.mobile.data.local.dao.FolderDao
-import com.vaultdrop.mobile.data.local.dao.PendingOperationDao
-import com.vaultdrop.mobile.data.local.dao.ScanDao
-import com.vaultdrop.mobile.data.local.dao.UserPreferenceDao
-import com.vaultdrop.mobile.data.local.migration.Migrations
+import com.kazier.mobile.data.local.AppDatabase
+import com.kazier.mobile.data.local.dao.FileDao
+import com.kazier.mobile.data.local.dao.FolderDao
+import com.kazier.mobile.data.local.dao.PendingOperationDao
+import com.kazier.mobile.data.local.dao.ScanDao
+import com.kazier.mobile.data.local.dao.UserPreferenceDao
+import com.kazier.mobile.data.local.migration.Migrations
 import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn

mobile-kotlin/app/src/main/java/com/kazier/mobile/di/NetworkModule.kt

@@ -1,11 +1,11 @@
-package com.vaultdrop.mobile.di
+package com.kazier.mobile.di
 
 import com.squareup.moshi.Moshi
 import com.squareup.moshi.kotlin.reflect.KotlinJsonAdapterFactory
-import com.vaultdrop.mobile.BuildConfig
-import com.vaultdrop.mobile.data.remote.ApiService
-import com.vaultdrop.mobile.data.remote.AuthInterceptor
-import com.vaultdrop.mobile.data.remote.ServerUrlInterceptor
+import com.kazier.mobile.BuildConfig
+import com.kazier.mobile.data.remote.ApiService
+import com.kazier.mobile.data.remote.AuthInterceptor
+import com.kazier.mobile.data.remote.ServerUrlInterceptor
 import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn
@@ -80,5 +80,5 @@ object NetworkModule {
     fun provideApiService(retrofit: Retrofit): ApiService =
         retrofit.create(ApiService::class.java)
 
-    private const val PLACEHOLDER_BASE_URL = "http://vaultdrop.invalid/"
+    private const val PLACEHOLDER_BASE_URL = "http://kazier.invalid/"
 }