@runeya/runeya 2.0.105 → 2.0.107

package/{chunk-IOAGFK3P.js → chunk-JNI4CXJ7.js}

@@ -28,7 +28,7 @@ import {
   resetRelaunches,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-AAK7ACHG.js";
+} from "./chunk-TE57T5GO.js";
 import {
   agentManager,
   agentStore,
@@ -48,10 +48,10 @@ import {
   rememberFile,
   serviceStore,
   wasRead
-} from "./chunk-NPORVPEO.js";
+} from "./chunk-ELI2TELD.js";
 import {
   settingsManager
-} from "./chunk-5GYBAMHV.js";
+} from "./chunk-ZDHLWTHW.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
@@ -83,7 +83,7 @@ import {
   machineRoot,
   orgVaultRoot,
   vaultIdOfRoot
-} from "./chunk-LTLOVQJQ.js";
+} from "./chunk-J3NAI636.js";
 
 // ../server/src/trpc/routers/chat.ts
 import { z as z5 } from "zod";
@@ -2335,16 +2335,21 @@ async function resolveServiceVariables(service) {
 var DockerConfigInput = DockerConfigSchema;
 var serviceRouter = router({
   /**
-   * Sans `projectId`, la réponse couvre TOUT le poste : `serviceStore.list()`
-   * rend chaque coffre, donc chaque organisation et chaque projet de la
-   * machine. L'interface le supporte — elle n'affiche que le projet ouvert —
-   * mais un appelant sans écran reçoit la liste entière, d'où le filtre.
+   * Sans filtre, la réponse couvre TOUT le poste : `serviceStore.list()` rend
+   * chaque coffre, donc chaque organisation et chaque projet de la machine.
+   * Deux portées permettent de s'y borner, de la plus étroite à la plus large :
+   *
+   * - `projectId` (+ `orgId` pour le désigner) : les services de ce projet.
+   * - `orgId` seul : les services de cette organisation — `null` désigne le
+   *   coffre local, ce qui n'est pas la même chose que l'absence de filtre.
+   *   C'est la portée d'un écran qui doit proposer des services hors du projet
+   *   ouvert sans pour autant montrer ceux des autres organisations.
    *
    * Un projet introuvable rend une liste vide, jamais tout le poste : un repli
    * silencieux ferait croire au filtrage tout en rendant les services des
    * autres organisations.
    */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed)", protect: true } }).input(z2.object({
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed by project or organization)", protect: true } }).input(z2.object({
     projectId: z2.string().max(128).optional(),
     orgId: z2.string().max(128).nullable().optional()
   }).optional()).output(z2.any()).query(async ({ input, ctx }) => {
@@ -2358,6 +2363,9 @@ var serviceRouter = router({
       });
       const ids = new Set(project?.serviceIds ?? []);
       filtered = filtered.filter((s) => ids.has(s.id));
+    } else if (input && "orgId" in input && input.orgId !== void 0) {
+      const orgId = input.orgId ?? null;
+      filtered = filtered.filter((s) => (s.orgId ?? null) === orgId);
     }
     return Promise.all(filtered.map(async (s) => ({
       ...s,
@@ -2370,7 +2378,7 @@ var serviceRouter = router({
     if (!service) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
     }
-    return service;
+    return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service) };
   }),
   create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z2.any()).input(
     z2.object({
@@ -3541,11 +3549,14 @@ import { TRPCError as TRPCError3 } from "@trpc/server";
 // ../server/src/services/cloud-session-store.ts
 import { readFile as readFile7, writeFile as writeFile5, rename as rename5, mkdir as mkdir7, chmod as chmod4, unlink as unlink3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
-import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FILENAME2 = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
+function accountIdFor(cloudUrl, userId) {
+  return createHash("sha256").update(`${cloudUrl.replace(/\/+$/, "")}|${userId}`).digest("hex").slice(0, 32);
+}
 var CloudSessionStore = class {
-  session = null;
+  accounts = [];
   loaded = false;
   /** Pending login states (CSRF binding between `start` and the callback). */
   pending = /* @__PURE__ */ new Map();
@@ -3573,11 +3584,37 @@ var CloudSessionStore = class {
       return readFile7(this.getLegacyFilePath(), "utf-8");
     }
   }
+  /**
+   * Relire le fichier, quelle que soit sa version.
+   *
+   * La forme d'avant n'est pas convertie sur disque ici : elle est lue telle
+   * quelle et prend un id dérivé de son seul cloud. L'identité manque — le
+   * compte n'était pas décrit — et se remplira au premier appel qui la
+   * connaîtra. Réécrire le fichier au chargement le rendrait illisible à une
+   * Runeya plus ancienne pour rien.
+   */
   async load() {
     if (this.loaded) return;
     try {
-      const raw = await this.readFromDisk();
-      this.session = JSON.parse(raw);
+      const parsed = JSON.parse(await this.readFromDisk());
+      if ("accounts" in parsed && Array.isArray(parsed.accounts)) {
+        this.accounts = parsed.accounts.filter(
+          (a) => typeof a?.id === "string" && typeof a?.encryptedToken === "string"
+        );
+      } else if (typeof parsed.encryptedToken === "string") {
+        const legacy = parsed;
+        this.accounts = [{
+          // Pas d'utilisateur connu : le cloud seul fonde l'id, et la première
+          // identité lue le remplacera par le définitif.
+          id: accountIdFor(legacy.cloudUrl, ""),
+          cloudUrl: legacy.cloudUrl,
+          encryptedToken: legacy.encryptedToken,
+          userId: "",
+          email: "",
+          name: "",
+          image: null
+        }];
+      }
     } catch {
     }
     this.loaded = true;
@@ -3617,48 +3654,137 @@ var CloudSessionStore = class {
     }
   }
   async save() {
-    await mkdir7(dirname5(await this.getFilePath()), { recursive: true });
     const filePath = await this.getFilePath();
+    await mkdir7(dirname5(filePath), { recursive: true });
+    const payload = { version: 2, accounts: this.accounts };
     const tmpPath = filePath + ".tmp";
-    await writeFile5(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await writeFile5(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
     await rename5(tmpPath, filePath);
     await chmod4(filePath, 384);
   }
-  /** Store the session token obtained from the one-time-token exchange. */
-  async set(cloudUrl, token) {
+  /**
+   * Ranger le token obtenu par l'échange de jeton à usage unique.
+   *
+   * L'identité est fournie par l'appelant, qui vient de la lire avec ce token :
+   * c'est elle qui donne son id au compte, et donc ce qui fait qu'une seconde
+   * connexion du même utilisateur remplace la première au lieu de s'ajouter.
+   */
+  async add(cloudUrl, token, identity) {
+    await this.load();
+    const account = {
+      ...identity,
+      id: accountIdFor(cloudUrl, identity.userId),
+      cloudUrl,
+      encryptedToken: encryptValue(token)
+    };
+    const at = this.accounts.findIndex((a) => a.id === account.id);
+    if (at >= 0) this.accounts[at] = account;
+    else this.accounts.push(account);
+    await this.save();
+    return this.publicView(account);
+  }
+  publicView(account) {
+    const { encryptedToken: _token, ...rest } = account;
+    return rest;
+  }
+  /** Les comptes liés à ce poste, sans rien de secret. */
+  async list() {
+    await this.load();
+    return this.accounts.map((a) => this.publicView(a));
+  }
+  /** Un compte par son id, ou null. */
+  async get(accountId) {
+    await this.load();
+    const found = this.accounts.find((a) => a.id === accountId);
+    return found ? this.publicView(found) : null;
+  }
+  /**
+   * Compléter ce qu'on sait d'un compte, une fois le cloud interrogé.
+   *
+   * Sert à la forme héritée, liée avant que l'identité soit retenue : son id
+   * provisoire (fondé sur le seul cloud) devient le définitif, et les tampons
+   * d'organisation qui le désignaient sont suivis par l'appelant.
+   */
+  async describe(accountId, identity) {
     await this.load();
-    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
+    const at = this.accounts.findIndex((a) => a.id === accountId);
+    if (at < 0) return accountId;
+    const current = this.accounts[at];
+    const nextId = accountIdFor(current.cloudUrl, identity.userId);
+    if (current.id === nextId && current.email === identity.email && current.name === identity.name) {
+      return current.id;
+    }
+    const duplicate = this.accounts.findIndex((a) => a.id === nextId && a.id !== current.id);
+    if (duplicate >= 0) this.accounts.splice(duplicate, 1);
+    this.accounts[this.accounts.findIndex((a) => a.id === accountId)] = {
+      ...current,
+      ...identity,
+      id: nextId
+    };
     await this.save();
+    return nextId;
   }
-  /** The decrypted session token, or null when not logged in. */
-  async getToken() {
+  /**
+   * Le token déchiffré d'un compte, ou null.
+   *
+   * Sans id : le compte unique du poste, et rien du tout dès qu'il y en a
+   * plusieurs — deviner lequel reviendrait à parler au cloud d'un autre
+   * utilisateur, ce qu'aucun appel ne veut jamais.
+   */
+  async getToken(accountId) {
     await this.load();
-    if (!this.session) return null;
+    const account = accountId ? this.accounts.find((a) => a.id === accountId) : this.accounts.length === 1 ? this.accounts[0] : void 0;
+    if (!account) return null;
     try {
-      return decryptValue(this.session.encryptedToken);
+      return decryptValue(account.encryptedToken);
     } catch {
       return null;
     }
   }
   /**
-   * The cloud this machine is signed into, or null when not linked.
+   * The cloud a given account is signed into, or null when unknown.
    *
    * Needed to tell "an org I am not a member of" apart from "an org of another
    * cloud instance entirely" — the ids of two clouds share no namespace, so
    * comparing them without this would call every foreign-cloud project a
    * permission problem.
    */
-  async getCloudUrl() {
+  async getCloudUrl(accountId) {
     await this.load();
-    return this.session?.cloudUrl ?? null;
+    const account = accountId ? this.accounts.find((a) => a.id === accountId) : this.accounts.length === 1 ? this.accounts[0] : void 0;
+    return account?.cloudUrl ?? null;
   }
+  /** Au moins un compte lié — l'état du poste, pas celui d'un compte précis. */
   async isLinked() {
-    return await this.getToken() !== null;
+    await this.load();
+    return this.accounts.length > 0;
+  }
+  /** Ce compte-là est-il utilisable ? */
+  async isAccountLinked(accountId) {
+    return await this.getToken(accountId) !== null;
   }
-  /** Forget the session (sign-out). */
+  /**
+   * Oublier un compte, en laissant les autres tranquilles.
+   *
+   * Les organisations qui en dépendaient passent hors ligne d'elles-mêmes : leur
+   * tampon désigne un compte qui n'est plus là, et la résolution rend « non
+   * lié » plutôt que d'aller frapper au cloud avec le token du voisin.
+   */
+  async remove(accountId) {
+    await this.load();
+    const before = this.accounts.length;
+    this.accounts = this.accounts.filter((a) => a.id !== accountId);
+    if (this.accounts.length === before) return;
+    if (this.accounts.length === 0) {
+      await this.clear();
+      return;
+    }
+    await this.save();
+  }
+  /** Forget every session (full sign-out of this machine). */
   async clear() {
     await this.load();
-    this.session = null;
+    this.accounts = [];
     this.pending.clear();
     try {
       await unlink3(await this.getFilePath());
@@ -3795,10 +3921,17 @@ function getCloudApiUrl() {
   return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
 }
 async function orgCloudUrl(orgId) {
-  const { readOrgClouds } = await import("./vault-resolver-JR7TCITD.js");
+  const { readOrgClouds } = await import("./vault-resolver-V7KH4FTC.js");
   const clouds = await readOrgClouds();
   return (clouds[orgId] ?? getCloudApiUrl()).replace(/\/+$/, "");
 }
+async function accountForOrg(orgId) {
+  const { readOrgAccounts } = await import("./vault-resolver-V7KH4FTC.js");
+  const stamped = (await readOrgAccounts())[orgId];
+  const accounts = await cloudSessionStore.list();
+  if (stamped && accounts.some((a) => a.id === stamped)) return stamped;
+  return accounts.length === 1 ? accounts[0].id : null;
+}
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
@@ -3809,10 +3942,18 @@ var CloudNotLinkedError = class extends Error {
     this.name = "CloudNotLinkedError";
   }
 };
+async function resolveAccountId(scope) {
+  if (scope.accountId) return scope.accountId;
+  if (scope.orgId) return accountForOrg(scope.orgId);
+  const accounts = await cloudSessionStore.list();
+  return accounts.length === 1 ? accounts[0].id : null;
+}
 async function cloudFetch(path, init = {}) {
-  const token = await cloudSessionStore.getToken();
-  if (!token) throw new CloudNotLinkedError();
-  return fetch(`${getCloudApiUrl()}${path}`, {
+  const accountId = await resolveAccountId(init);
+  const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
+  if (!accountId || !token) throw new CloudNotLinkedError();
+  const base = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
+  return fetch(`${base.replace(/\/+$/, "")}${path}`, {
     method: init.method ?? "GET",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -3825,6 +3966,26 @@ async function cloudFetch(path, init = {}) {
     signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
   });
 }
+async function readCloudIdentity(cloudUrl, token) {
+  try {
+    const res = await fetch(`${cloudUrl.replace(/\/+$/, "")}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const id = body.user?.id;
+    if (typeof id !== "string" || !id) return null;
+    return {
+      userId: id,
+      email: typeof body.user?.email === "string" ? body.user.email : "",
+      name: typeof body.user?.name === "string" ? body.user.name : "",
+      image: typeof body.user?.image === "string" ? body.user.image : null
+    };
+  } catch {
+    return null;
+  }
+}
 
 // ../server/src/trpc/routers/cloud-auth.ts
 function getDeviceName() {
@@ -3866,6 +4027,19 @@ function isAllowedProxyPath(path) {
   const [pathname] = path.split("?");
   return PROXY_PREFIXES.some((p) => pathname === p || pathname.startsWith(p));
 }
+var ScopeSchema = z4.object({
+  accountId: z4.string().max(64).optional(),
+  orgId: z4.string().max(128).optional()
+});
+function scopeOf(input) {
+  return { accountId: input.accountId, orgId: input.orgId };
+}
+async function scopedAccountId(input) {
+  if (input.accountId) return input.accountId;
+  if (input.orgId) return accountForOrg(input.orgId);
+  const accounts = await cloudSessionStore.list();
+  return accounts.length === 1 ? accounts[0].id : null;
+}
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
   startLogin: protectedProcedure.input(z4.object({ returnTo: z4.string().url().max(2048) })).mutation(async ({ input }) => {
@@ -3880,31 +4054,64 @@ var cloudAuthRouter = router({
     const url = `${getCloudAppUrl()}/link-local?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
     return { url };
   }),
-  /** Whether this machine holds a cloud session, and against which cloud. */
+  /**
+   * Whether this machine holds any cloud session, and against which cloud.
+   *
+   * `cloudUrl` n'a de sens qu'avec un seul compte : au-delà, il n'y a plus « le »
+   * cloud du poste, et c'est `accounts` qu'il faut lire.
+   */
   status: protectedProcedure.query(async () => {
-    const linked = await cloudSessionStore.isLinked();
-    return { linked, cloudUrl: linked ? await cloudSessionStore.getCloudUrl() : null };
+    const accounts = await cloudSessionStore.list();
+    return {
+      linked: accounts.length > 0,
+      cloudUrl: accounts.length === 1 ? accounts[0].cloudUrl : null,
+      accountCount: accounts.length
+    };
+  }),
+  /**
+   * Les comptes liés à ce poste, et l'organisation dont chacun répond.
+   *
+   * Aucun token n'en sort : de quoi peupler la page Compte et afficher, à côté
+   * du projet ouvert, sous quel compte il se synchronise.
+   */
+  accounts: protectedProcedure.query(async () => {
+    const { readOrgAccounts } = await import("./vault-resolver-V7KH4FTC.js");
+    return { accounts: await cloudSessionStore.list(), orgAccounts: await readOrgAccounts() };
   }),
   /** The cloud session (user + org), fetched with the stored token. */
-  session: protectedProcedure.query(async () => {
-    if (!await cloudSessionStore.isLinked()) return null;
-    const res = await cloudFetch2("/api/auth/get-session");
+  session: protectedProcedure.input(ScopeSchema.optional()).query(async ({ input }) => {
+    const accountId = await scopedAccountId(input ?? {});
+    if (!accountId || !await cloudSessionStore.isAccountLinked(accountId)) return null;
+    const res = await cloudFetch2("/api/auth/get-session", { accountId });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       return null;
     }
-    return await res.json();
+    const payload = await res.json();
+    const account = await cloudSessionStore.get(accountId);
+    if (account && !account.userId) {
+      const identity = await readCloudIdentity(account.cloudUrl, await cloudSessionStore.getToken(accountId) ?? "");
+      if (identity) {
+        const settled = await cloudSessionStore.describe(accountId, identity);
+        const { renameOrgAccount } = await import("./vault-resolver-V7KH4FTC.js");
+        await renameOrgAccount(accountId, settled);
+      }
+    }
+    return payload;
   }),
   /**
    * Every session of the cloud account: the machines linked to it and the
    * browsers signed into it. No token material — the cloud only ever returns
    * ids and labels here.
    */
-  devices: protectedProcedure.query(async () => {
-    if (!await cloudSessionStore.isLinked()) return { devices: [] };
-    const res = await cloudFetch2("/api/auth/device/list");
+  devices: protectedProcedure.input(ScopeSchema.optional()).query(async ({ input }) => {
+    const accountId = await scopedAccountId(input ?? {});
+    if (!accountId || !await cloudSessionStore.isAccountLinked(accountId)) {
+      return { devices: [] };
+    }
+    const res = await cloudFetch2("/api/auth/device/list", { accountId });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       return { devices: [] };
     }
     return await res.json();
@@ -3916,14 +4123,20 @@ var cloudAuthRouter = router({
    * drops the session, and the local token is dropped here too, so nothing is
    * left holding a dead credential.
    */
-  revokeDevice: protectedProcedure.input(z4.object({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const res = await cloudFetch2("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
+  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
+    const accountId = await scopedAccountId(input);
+    if (!accountId) throw new TRPCError3({ code: "PRECONDITION_FAILED", message: "No cloud account for this scope." });
+    const res = await cloudFetch2("/api/auth/device/revoke", {
+      method: "POST",
+      body: { id: input.id },
+      accountId
+    });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       throw new TRPCError3({ code: "BAD_REQUEST", message: "Could not revoke this session." });
     }
     const { self } = await res.json();
-    if (self) await cloudSessionStore.clear();
+    if (self) await cloudSessionStore.remove(accountId);
     return { success: true, self: self === true };
   }),
   /**
@@ -3937,7 +4150,9 @@ var cloudAuthRouter = router({
       path: z4.string().min(1).max(512),
       method: z4.enum(["GET", "POST"]).default("GET"),
       query: z4.record(z4.string().max(128), z4.string().max(2048)).optional(),
-      body: z4.unknown().optional()
+      body: z4.unknown().optional(),
+      accountId: z4.string().max(64).optional(),
+      orgId: z4.string().max(128).optional()
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -3946,7 +4161,8 @@ var cloudAuthRouter = router({
     const qs = input.query ? `?${new URLSearchParams(input.query).toString()}` : "";
     const res = await cloudFetch2(`/api/auth${input.path}${qs}`, {
       method: input.method,
-      ...input.method === "POST" ? { body: input.body ?? {} } : {}
+      ...input.method === "POST" ? { body: input.body ?? {} } : {},
+      ...scopeOf(input)
     });
     const text = await res.text();
     let data = null;
@@ -3965,14 +4181,19 @@ var cloudAuthRouter = router({
    * browser's session — signing out here leaves the web app signed in, and vice
    * versa.
    */
-  signOut: protectedProcedure.mutation(async () => {
-    if (await cloudSessionStore.isLinked()) {
+  signOut: protectedProcedure.input(ScopeSchema.optional()).mutation(async ({ input }) => {
+    const accountId = await scopedAccountId(input ?? {});
+    if (!accountId) {
+      if ((await cloudSessionStore.list()).length === 0) return { success: true };
+      throw new TRPCError3({ code: "BAD_REQUEST", message: "Which account? Several are linked." });
+    }
+    if (await cloudSessionStore.isAccountLinked(accountId)) {
       try {
-        await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {} });
+        await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {}, accountId });
       } catch {
       }
     }
-    await cloudSessionStore.clear();
+    await cloudSessionStore.remove(accountId);
     return { success: true };
   })
 });
@@ -4012,12 +4233,57 @@ function must(res) {
   }
   return res.data;
 }
+var boardAccounts = /* @__PURE__ */ new Map();
+async function accountOfOrg(orgId) {
+  return await accountForOrg(orgId) ?? void 0;
+}
+function rememberBoardAccount(boardId, accountId) {
+  if (accountId) boardAccounts.set(boardId, accountId);
+}
+async function accountOfBoard(boardId) {
+  const memo = boardAccounts.get(boardId);
+  if (memo) return memo;
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length <= 1) return accounts[0]?.id;
+  const owners = await Promise.all(accounts.map(async (account) => {
+    const res = await callCloud(
+      `/kanban/board/get?id=${encodeURIComponent(boardId)}`,
+      { accountId: account.id }
+    );
+    return res.ok && res.data?.board ? account.id : null;
+  }));
+  const owner = owners.find((id) => id !== null);
+  if (owner) {
+    boardAccounts.set(boardId, owner);
+    return owner;
+  }
+  throw new KanbanUnavailableError(
+    `Aucun des ${accounts.length} comptes li\xE9s \xE0 ce poste ne conna\xEEt le tableau ${boardId}.`
+  );
+}
+async function scopeOfBoard(boardId) {
+  const accountId = await accountOfBoard(boardId);
+  return accountId ? { accountId } : {};
+}
 async function resolveOrganizationId(explicit) {
   if (explicit) return explicit;
-  const session = await callCloud("/get-session");
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length > 1) {
+    throw new KanbanUnavailableError(
+      `Ce poste est li\xE9 \xE0 ${accounts.length} comptes cloud : pr\xE9cisez organizationId, sans quoi rien ne dit lequel interroger.`
+    );
+  }
+  const accountId = accounts[0]?.id;
+  const session = await callCloud(
+    "/get-session",
+    accountId ? { accountId } : {}
+  );
   const active = session.data?.session?.activeOrganizationId;
   if (active) return active;
-  const orgs = must(await callCloud("/organization/list"));
+  const orgs = must(await callCloud(
+    "/organization/list",
+    accountId ? { accountId } : {}
+  ));
   if (orgs.length === 1) return orgs[0].id;
   if (orgs.length === 0) {
     throw new KanbanUnavailableError(
@@ -4039,7 +4305,12 @@ var KanbanStore = class {
   async list(includeArchived = false, organizationId) {
     const orgId = await resolveOrganizationId(organizationId);
     const query = `?organizationId=${encodeURIComponent(orgId)}` + (includeArchived ? "&includeArchived=true" : "");
-    const res = must(await callCloud(`/kanban/board/list${query}`));
+    const accountId = await accountOfOrg(orgId);
+    const res = must(await callCloud(
+      `/kanban/board/list${query}`,
+      accountId ? { accountId } : {}
+    ));
+    for (const board of res.boards ?? []) rememberBoardAccount(board.id, accountId);
     return { organizationId: orgId, boards: res.boards ?? [] };
   }
   /**
@@ -4050,13 +4321,18 @@ var KanbanStore = class {
    */
   async get(id, opts = {}) {
     const query = `?id=${encodeURIComponent(id)}${opts.withHistory ? "&withHistory=true" : ""}`;
-    const res = must(await callCloud(`/kanban/board/get${query}`));
+    const accountId = await accountOfBoard(id);
+    const res = must(await callCloud(
+      `/kanban/board/get${query}`,
+      accountId ? { accountId } : {}
+    ));
     return res.board ?? null;
   }
   /** Le journal d'une seule carte — ce que le contexte d'un agent demande. */
   async cardHistory(boardId, cardId) {
     const res = await callCloud(
-      `/kanban/card/history?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`
+      `/kanban/card/history?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`,
+      await scopeOfBoard(boardId)
     );
     return res.data?.history ?? [];
   }
@@ -4070,7 +4346,8 @@ var KanbanStore = class {
   async addComment(boardId, cardId, detail, conversationId) {
     const res = await callCloud("/kanban/card/comment/add", {
       method: "POST",
-      body: { boardId, cardId, detail, author: "ai", ...conversationId ? { conversationId } : {} }
+      body: { boardId, cardId, detail, author: "ai", ...conversationId ? { conversationId } : {} },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4078,7 +4355,8 @@ var KanbanStore = class {
   async addCardEvent(boardId, cardId, type, detail) {
     const res = await callCloud("/kanban/card/event/add", {
       method: "POST",
-      body: { boardId, cardId, type, detail }
+      body: { boardId, cardId, type, detail },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4092,14 +4370,16 @@ var KanbanStore = class {
   async addCard(boardId, input) {
     const res = await callCloud("/kanban/card/add", {
       method: "POST",
-      body: { boardId, ...input }
+      body: { boardId, ...input },
+      ...await scopeOfBoard(boardId)
     });
     return { card: res.data?.card ?? null, unsupported: res.status === 404 };
   }
   /** Une carte, par son identifiant — archivée comprise. */
   async card(boardId, cardId) {
     const res = await callCloud(
-      `/kanban/card/get?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`
+      `/kanban/card/get?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`,
+      await scopeOfBoard(boardId)
     );
     return res.data ?? null;
   }
@@ -4113,7 +4393,8 @@ var KanbanStore = class {
   async updateCard(boardId, cardId, patch) {
     const res = await callCloud("/kanban/card/update", {
       method: "POST",
-      body: { boardId, cardId, ...patch }
+      body: { boardId, cardId, ...patch },
+      ...await scopeOfBoard(boardId)
     });
     return res.data?.card ?? null;
   }
@@ -4121,7 +4402,8 @@ var KanbanStore = class {
   async setCardArchived(boardId, cardId, archived) {
     const res = await callCloud(`/kanban/card/${archived ? "archive" : "unarchive"}`, {
       method: "POST",
-      body: { boardId, cardId }
+      body: { boardId, cardId },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4133,7 +4415,8 @@ var KanbanStore = class {
     const orgId = await resolveOrganizationId(organizationId);
     const res = must(
       await callCloud(
-        `/organization/get-full-organization?organizationId=${encodeURIComponent(orgId)}`
+        `/organization/get-full-organization?organizationId=${encodeURIComponent(orgId)}`,
+        { orgId }
       )
     );
     return (res.members ?? []).map((m) => ({
@@ -4161,7 +4444,8 @@ var KanbanStore = class {
     if (input.limit) query.set("limit", String(input.limit));
     const res = must(
       await callCloud(
-        `/kanban/card/search?${query.toString()}`
+        `/kanban/card/search?${query.toString()}`,
+        { orgId }
       )
     );
     return { cards: res.cards ?? [], total: res.total ?? 0, truncated: Boolean(res.truncated) };
@@ -4170,7 +4454,8 @@ var KanbanStore = class {
   async moveCard(boardId, cardId, toColumnId) {
     const res = await callCloud("/kanban/card/move", {
       method: "POST",
-      body: { boardId, cardId, toColumnId }
+      body: { boardId, cardId, toColumnId },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4183,7 +4468,8 @@ var KanbanStore = class {
    */
   async cardLinks(boardId) {
     const res = await callCloud(
-      `/kanban/card-link/list?boardId=${encodeURIComponent(boardId)}`
+      `/kanban/card-link/list?boardId=${encodeURIComponent(boardId)}`,
+      await scopeOfBoard(boardId)
     );
     return { links: res.data?.links ?? [], cards: res.data?.cards ?? [] };
   }
@@ -4201,7 +4487,8 @@ var KanbanStore = class {
         cardId,
         parentBoardId: parent?.boardId ?? null,
         parentCardId: parent?.cardId ?? null
-      }
+      },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4210,6 +4497,7 @@ var KanbanStore = class {
     if (!organizationId) return null;
     const res = await callCloud("/kanban/board/create", {
       method: "POST",
+      orgId: organizationId,
       body: {
         organizationId,
         name: input.name,
@@ -4222,14 +4510,16 @@ var KanbanStore = class {
   async update(input) {
     const res = await callCloud("/kanban/board/update", {
       method: "POST",
-      body: input
+      body: input,
+      ...await scopeOfBoard(input.id)
     });
     return res.data?.board ?? null;
   }
   async delete(id) {
     const res = await callCloud("/kanban/board/delete", {
       method: "POST",
-      body: { id }
+      body: { id },
+      ...await scopeOfBoard(id)
     });
     return res.data?.success ?? false;
   }
@@ -4649,7 +4939,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-4XJUIZKL.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-2RWV2SXZ.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5341,7 +5631,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-4XJUIZKL.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-2RWV2SXZ.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7289,7 +7579,9 @@ export {
   cloudSessionStore,
   getCloudApiUrl,
   orgCloudUrl,
+  accountForOrg,
   cloudFetch,
+  readCloudIdentity,
   environmentOverridesStore,
   environmentResolver,
   auditService,
@@ -7336,4 +7628,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-IOAGFK3P.js.map
+//# sourceMappingURL=chunk-JNI4CXJ7.js.map