@runeya/runeya 2.0.106 → 2.0.108

package/{chunk-YQISK6BL.js → chunk-4SJCPFGK.js}

@@ -28,7 +28,7 @@ import {
   resetRelaunches,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-CQCCVPTX.js";
+} from "./chunk-DS66SEYH.js";
 import {
   agentManager,
   agentStore,
@@ -48,10 +48,10 @@ import {
   rememberFile,
   serviceStore,
   wasRead
-} from "./chunk-NPORVPEO.js";
+} from "./chunk-RIITTBK3.js";
 import {
   settingsManager
-} from "./chunk-5GYBAMHV.js";
+} from "./chunk-D2PF2FYU.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
@@ -83,7 +83,7 @@ import {
   machineRoot,
   orgVaultRoot,
   vaultIdOfRoot
-} from "./chunk-LTLOVQJQ.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/trpc/routers/chat.ts
 import { z as z5 } from "zod";
@@ -3549,11 +3549,14 @@ import { TRPCError as TRPCError3 } from "@trpc/server";
 // ../server/src/services/cloud-session-store.ts
 import { readFile as readFile7, writeFile as writeFile5, rename as rename5, mkdir as mkdir7, chmod as chmod4, unlink as unlink3 } from "fs/promises";
 import { dirname as dirname5 } from "path";
-import { randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FILENAME2 = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
+function accountIdFor(cloudUrl, userId) {
+  return createHash("sha256").update(`${cloudUrl.replace(/\/+$/, "")}|${userId}`).digest("hex").slice(0, 32);
+}
 var CloudSessionStore = class {
-  session = null;
+  accounts = [];
   loaded = false;
   /** Pending login states (CSRF binding between `start` and the callback). */
   pending = /* @__PURE__ */ new Map();
@@ -3581,11 +3584,37 @@ var CloudSessionStore = class {
       return readFile7(this.getLegacyFilePath(), "utf-8");
     }
   }
+  /**
+   * Relire le fichier, quelle que soit sa version.
+   *
+   * La forme d'avant n'est pas convertie sur disque ici : elle est lue telle
+   * quelle et prend un id dérivé de son seul cloud. L'identité manque — le
+   * compte n'était pas décrit — et se remplira au premier appel qui la
+   * connaîtra. Réécrire le fichier au chargement le rendrait illisible à une
+   * Runeya plus ancienne pour rien.
+   */
   async load() {
     if (this.loaded) return;
     try {
-      const raw = await this.readFromDisk();
-      this.session = JSON.parse(raw);
+      const parsed = JSON.parse(await this.readFromDisk());
+      if ("accounts" in parsed && Array.isArray(parsed.accounts)) {
+        this.accounts = parsed.accounts.filter(
+          (a) => typeof a?.id === "string" && typeof a?.encryptedToken === "string"
+        );
+      } else if (typeof parsed.encryptedToken === "string") {
+        const legacy = parsed;
+        this.accounts = [{
+          // Pas d'utilisateur connu : le cloud seul fonde l'id, et la première
+          // identité lue le remplacera par le définitif.
+          id: accountIdFor(legacy.cloudUrl, ""),
+          cloudUrl: legacy.cloudUrl,
+          encryptedToken: legacy.encryptedToken,
+          userId: "",
+          email: "",
+          name: "",
+          image: null
+        }];
+      }
     } catch {
     }
     this.loaded = true;
@@ -3625,48 +3654,137 @@ var CloudSessionStore = class {
     }
   }
   async save() {
-    await mkdir7(dirname5(await this.getFilePath()), { recursive: true });
     const filePath = await this.getFilePath();
+    await mkdir7(dirname5(filePath), { recursive: true });
+    const payload = { version: 2, accounts: this.accounts };
     const tmpPath = filePath + ".tmp";
-    await writeFile5(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await writeFile5(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
     await rename5(tmpPath, filePath);
     await chmod4(filePath, 384);
   }
-  /** Store the session token obtained from the one-time-token exchange. */
-  async set(cloudUrl, token) {
+  /**
+   * Ranger le token obtenu par l'échange de jeton à usage unique.
+   *
+   * L'identité est fournie par l'appelant, qui vient de la lire avec ce token :
+   * c'est elle qui donne son id au compte, et donc ce qui fait qu'une seconde
+   * connexion du même utilisateur remplace la première au lieu de s'ajouter.
+   */
+  async add(cloudUrl, token, identity) {
     await this.load();
-    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
+    const account = {
+      ...identity,
+      id: accountIdFor(cloudUrl, identity.userId),
+      cloudUrl,
+      encryptedToken: encryptValue(token)
+    };
+    const at = this.accounts.findIndex((a) => a.id === account.id);
+    if (at >= 0) this.accounts[at] = account;
+    else this.accounts.push(account);
     await this.save();
+    return this.publicView(account);
   }
-  /** The decrypted session token, or null when not logged in. */
-  async getToken() {
+  publicView(account) {
+    const { encryptedToken: _token, ...rest } = account;
+    return rest;
+  }
+  /** Les comptes liés à ce poste, sans rien de secret. */
+  async list() {
+    await this.load();
+    return this.accounts.map((a) => this.publicView(a));
+  }
+  /** Un compte par son id, ou null. */
+  async get(accountId) {
+    await this.load();
+    const found = this.accounts.find((a) => a.id === accountId);
+    return found ? this.publicView(found) : null;
+  }
+  /**
+   * Compléter ce qu'on sait d'un compte, une fois le cloud interrogé.
+   *
+   * Sert à la forme héritée, liée avant que l'identité soit retenue : son id
+   * provisoire (fondé sur le seul cloud) devient le définitif, et les tampons
+   * d'organisation qui le désignaient sont suivis par l'appelant.
+   */
+  async describe(accountId, identity) {
+    await this.load();
+    const at = this.accounts.findIndex((a) => a.id === accountId);
+    if (at < 0) return accountId;
+    const current = this.accounts[at];
+    const nextId = accountIdFor(current.cloudUrl, identity.userId);
+    if (current.id === nextId && current.email === identity.email && current.name === identity.name) {
+      return current.id;
+    }
+    const duplicate = this.accounts.findIndex((a) => a.id === nextId && a.id !== current.id);
+    if (duplicate >= 0) this.accounts.splice(duplicate, 1);
+    this.accounts[this.accounts.findIndex((a) => a.id === accountId)] = {
+      ...current,
+      ...identity,
+      id: nextId
+    };
+    await this.save();
+    return nextId;
+  }
+  /**
+   * Le token déchiffré d'un compte, ou null.
+   *
+   * Sans id : le compte unique du poste, et rien du tout dès qu'il y en a
+   * plusieurs — deviner lequel reviendrait à parler au cloud d'un autre
+   * utilisateur, ce qu'aucun appel ne veut jamais.
+   */
+  async getToken(accountId) {
     await this.load();
-    if (!this.session) return null;
+    const account = accountId ? this.accounts.find((a) => a.id === accountId) : this.accounts.length === 1 ? this.accounts[0] : void 0;
+    if (!account) return null;
     try {
-      return decryptValue(this.session.encryptedToken);
+      return decryptValue(account.encryptedToken);
     } catch {
       return null;
     }
   }
   /**
-   * The cloud this machine is signed into, or null when not linked.
+   * The cloud a given account is signed into, or null when unknown.
    *
    * Needed to tell "an org I am not a member of" apart from "an org of another
    * cloud instance entirely" — the ids of two clouds share no namespace, so
    * comparing them without this would call every foreign-cloud project a
    * permission problem.
    */
-  async getCloudUrl() {
+  async getCloudUrl(accountId) {
     await this.load();
-    return this.session?.cloudUrl ?? null;
+    const account = accountId ? this.accounts.find((a) => a.id === accountId) : this.accounts.length === 1 ? this.accounts[0] : void 0;
+    return account?.cloudUrl ?? null;
   }
+  /** Au moins un compte lié — l'état du poste, pas celui d'un compte précis. */
   async isLinked() {
-    return await this.getToken() !== null;
+    await this.load();
+    return this.accounts.length > 0;
   }
-  /** Forget the session (sign-out). */
+  /** Ce compte-là est-il utilisable ? */
+  async isAccountLinked(accountId) {
+    return await this.getToken(accountId) !== null;
+  }
+  /**
+   * Oublier un compte, en laissant les autres tranquilles.
+   *
+   * Les organisations qui en dépendaient passent hors ligne d'elles-mêmes : leur
+   * tampon désigne un compte qui n'est plus là, et la résolution rend « non
+   * lié » plutôt que d'aller frapper au cloud avec le token du voisin.
+   */
+  async remove(accountId) {
+    await this.load();
+    const before = this.accounts.length;
+    this.accounts = this.accounts.filter((a) => a.id !== accountId);
+    if (this.accounts.length === before) return;
+    if (this.accounts.length === 0) {
+      await this.clear();
+      return;
+    }
+    await this.save();
+  }
+  /** Forget every session (full sign-out of this machine). */
   async clear() {
     await this.load();
-    this.session = null;
+    this.accounts = [];
     this.pending.clear();
     try {
       await unlink3(await this.getFilePath());
@@ -3803,13 +3921,33 @@ function getCloudApiUrl() {
   return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
 }
 async function orgCloudUrl(orgId) {
-  const { readOrgClouds } = await import("./vault-resolver-JR7TCITD.js");
+  const { readOrgClouds } = await import("./vault-resolver-57Q2DVOR.js");
   const clouds = await readOrgClouds();
   return (clouds[orgId] ?? getCloudApiUrl()).replace(/\/+$/, "");
 }
+async function accountForOrg(orgId) {
+  const { readOrgAccounts, readOrgClouds } = await import("./vault-resolver-57Q2DVOR.js");
+  const [stampedAccounts, stampedClouds, accounts] = await Promise.all([
+    readOrgAccounts(),
+    readOrgClouds(),
+    cloudSessionStore.list()
+  ]);
+  const orgCloud = stampedClouds[orgId]?.replace(/\/+$/, "");
+  const candidates = orgCloud ? accounts.filter((a) => a.cloudUrl.replace(/\/+$/, "") === orgCloud) : accounts;
+  const stamped = stampedAccounts[orgId];
+  if (stamped && candidates.some((a) => a.id === stamped)) return stamped;
+  return candidates.length === 1 ? candidates[0].id : null;
+}
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
+var CloudAmbiguousAccountError = class extends Error {
+  code = "CLOUD_AMBIGUOUS_ACCOUNT";
+  constructor() {
+    super("Several cloud accounts are linked; name the organization this call belongs to.");
+    this.name = "CloudAmbiguousAccountError";
+  }
+};
 var CloudNotLinkedError = class extends Error {
   code = "CLOUD_NOT_LINKED";
   constructor() {
@@ -3817,10 +3955,23 @@ var CloudNotLinkedError = class extends Error {
     this.name = "CloudNotLinkedError";
   }
 };
-async function cloudFetch(path, init = {}) {
-  const token = await cloudSessionStore.getToken();
+async function accountForOrgOrThrow(orgId) {
+  const accountId = await accountForOrg(orgId);
+  if (!accountId) throw new CloudNotLinkedError();
+  return accountId;
+}
+async function soleAccountOrThrow() {
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length === 1) return accounts[0].id;
+  if (accounts.length === 0) throw new CloudNotLinkedError();
+  throw new CloudAmbiguousAccountError();
+}
+async function cloudFetch(path, init) {
+  const { accountId } = init;
+  const token = await cloudSessionStore.getToken(accountId);
   if (!token) throw new CloudNotLinkedError();
-  return fetch(`${getCloudApiUrl()}${path}`, {
+  const base = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
+  return fetch(`${base.replace(/\/+$/, "")}${path}`, {
     method: init.method ?? "GET",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -3833,6 +3984,26 @@ async function cloudFetch(path, init = {}) {
     signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
   });
 }
+async function readCloudIdentity(cloudUrl, token) {
+  try {
+    const res = await fetch(`${cloudUrl.replace(/\/+$/, "")}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    const id = body.user?.id;
+    if (typeof id !== "string" || !id) return null;
+    return {
+      userId: id,
+      email: typeof body.user?.email === "string" ? body.user.email : "",
+      name: typeof body.user?.name === "string" ? body.user.name : "",
+      image: typeof body.user?.image === "string" ? body.user.image : null
+    };
+  } catch {
+    return null;
+  }
+}
 
 // ../server/src/trpc/routers/cloud-auth.ts
 function getDeviceName() {
@@ -3860,7 +4031,7 @@ function callbackForReturnTo(url) {
   if (!lanIps().includes(hostname2)) return null;
   return `${parsed.origin}/api/cloud/callback`;
 }
-async function cloudFetch2(path, init = {}) {
+async function cloudFetch2(path, init) {
   try {
     return await cloudFetch(path, init);
   } catch (err) {
@@ -3868,12 +4039,37 @@ async function cloudFetch2(path, init = {}) {
     throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
   }
 }
+async function accountForOrgScope(orgId) {
+  try {
+    return await accountForOrgOrThrow(orgId);
+  } catch (err) {
+    if (!(err instanceof CloudNotLinkedError)) throw err;
+    throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
+  }
+}
+async function soleAccountScope() {
+  try {
+    return await soleAccountOrThrow();
+  } catch (err) {
+    if (err instanceof CloudAmbiguousAccountError) {
+      throw new TRPCError3({ code: "BAD_REQUEST", message: err.message });
+    }
+    if (!(err instanceof CloudNotLinkedError)) throw err;
+    throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
+  }
+}
 var PROXY_PREFIXES = ["/organization/", "/project/", "/chat/", "/kanban/", "/user/prefs"];
 function isAllowedProxyPath(path) {
   if (!path.startsWith("/") || path.includes("..")) return false;
   const [pathname] = path.split("?");
   return PROXY_PREFIXES.some((p) => pathname === p || pathname.startsWith(p));
 }
+var ScopeSchema = z4.object({
+  accountId: z4.string().min(1).max(64)
+});
+function scopeOf(input) {
+  return { accountId: input.accountId };
+}
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
   startLogin: protectedProcedure.input(z4.object({ returnTo: z4.string().url().max(2048) })).mutation(async ({ input }) => {
@@ -3888,31 +4084,77 @@ var cloudAuthRouter = router({
     const url = `${getCloudAppUrl()}/link-local?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
     return { url };
   }),
-  /** Whether this machine holds a cloud session, and against which cloud. */
+  /**
+   * Whether this machine holds any cloud session, and against which cloud.
+   *
+   * `cloudUrl` n'a de sens qu'avec un seul compte : au-delà, il n'y a plus « le »
+   * cloud du poste, et c'est `accounts` qu'il faut lire.
+   */
   status: protectedProcedure.query(async () => {
-    const linked = await cloudSessionStore.isLinked();
-    return { linked, cloudUrl: linked ? await cloudSessionStore.getCloudUrl() : null };
+    const accounts = await cloudSessionStore.list();
+    return {
+      linked: accounts.length > 0,
+      cloudUrl: accounts.length === 1 ? accounts[0].cloudUrl : null,
+      accountCount: accounts.length
+    };
+  }),
+  /**
+   * Le compte dont relève une organisation.
+   *
+   * La question que l'interface pose à chaque changement de projet : le projet
+   * ouvert donne son organisation, l'organisation donne son compte. Répondue
+   * ici plutôt que déduite d'une carte tenue dans le navigateur — une carte se
+   * périme dès qu'un coffre est tamponné, et l'interface restait alors sur le
+   * compte précédent sans que rien ne le dise.
+   *
+   * `null` quand rien ne rattache cette organisation à un compte de ce poste :
+   * l'interface l'affiche comme déconnectée, ce qu'elle est.
+   */
+  accountForOrg: protectedProcedure.input(z4.object({ orgId: z4.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
+  /**
+   * Les comptes liés à ce poste, et l'organisation dont chacun répond.
+   *
+   * Aucun token n'en sort : de quoi peupler la page Compte et afficher, à côté
+   * du projet ouvert, sous quel compte il se synchronise.
+   */
+  accounts: protectedProcedure.query(async () => {
+    const { readOrgAccounts } = await import("./vault-resolver-57Q2DVOR.js");
+    return { accounts: await cloudSessionStore.list(), orgAccounts: await readOrgAccounts() };
   }),
   /** The cloud session (user + org), fetched with the stored token. */
-  session: protectedProcedure.query(async () => {
-    if (!await cloudSessionStore.isLinked()) return null;
-    const res = await cloudFetch2("/api/auth/get-session");
+  session: protectedProcedure.input(ScopeSchema).query(async ({ input }) => {
+    const { accountId } = input;
+    if (!await cloudSessionStore.isAccountLinked(accountId)) return null;
+    const res = await cloudFetch2("/api/auth/get-session", { accountId });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       return null;
     }
-    return await res.json();
+    const payload = await res.json();
+    const account = await cloudSessionStore.get(accountId);
+    if (account && !account.userId) {
+      const identity = await readCloudIdentity(account.cloudUrl, await cloudSessionStore.getToken(accountId) ?? "");
+      if (identity) {
+        const settled = await cloudSessionStore.describe(accountId, identity);
+        const { renameOrgAccount } = await import("./vault-resolver-57Q2DVOR.js");
+        await renameOrgAccount(accountId, settled);
+      }
+    }
+    return payload;
   }),
   /**
    * Every session of the cloud account: the machines linked to it and the
    * browsers signed into it. No token material — the cloud only ever returns
    * ids and labels here.
    */
-  devices: protectedProcedure.query(async () => {
-    if (!await cloudSessionStore.isLinked()) return { devices: [] };
-    const res = await cloudFetch2("/api/auth/device/list");
+  devices: protectedProcedure.input(ScopeSchema).query(async ({ input }) => {
+    const { accountId } = input;
+    if (!accountId || !await cloudSessionStore.isAccountLinked(accountId)) {
+      return { devices: [] };
+    }
+    const res = await cloudFetch2("/api/auth/device/list", { accountId });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       return { devices: [] };
     }
     return await res.json();
@@ -3924,14 +4166,20 @@ var cloudAuthRouter = router({
    * drops the session, and the local token is dropped here too, so nothing is
    * left holding a dead credential.
    */
-  revokeDevice: protectedProcedure.input(z4.object({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const res = await cloudFetch2("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
+  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
+    const { accountId } = input;
+    if (!accountId) throw new TRPCError3({ code: "PRECONDITION_FAILED", message: "No cloud account for this scope." });
+    const res = await cloudFetch2("/api/auth/device/revoke", {
+      method: "POST",
+      body: { id: input.id },
+      accountId
+    });
     if (!res.ok) {
-      if (res.status === 401) await cloudSessionStore.clear();
+      if (res.status === 401) await cloudSessionStore.remove(accountId);
       throw new TRPCError3({ code: "BAD_REQUEST", message: "Could not revoke this session." });
     }
     const { self } = await res.json();
-    if (self) await cloudSessionStore.clear();
+    if (self) await cloudSessionStore.remove(accountId);
     return { success: true, self: self === true };
   }),
   /**
@@ -3945,7 +4193,13 @@ var cloudAuthRouter = router({
       path: z4.string().min(1).max(512),
       method: z4.enum(["GET", "POST"]).default("GET"),
       query: z4.record(z4.string().max(128), z4.string().max(2048)).optional(),
-      body: z4.unknown().optional()
+      body: z4.unknown().optional(),
+      // Obligatoire, et seul : c'est la porte par laquelle passent tous les
+      // appels cloud de l'interface. La laisser optionnelle est ce qui a
+      // permis aux composables partagées de n'envoyer aucune portée pendant
+      // trente routes, et au serveur de retomber sur « le compte unique du
+      // poste » — muet dès qu'il y en a eu deux.
+      accountId: z4.string().min(1).max(64)
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -3954,7 +4208,8 @@ var cloudAuthRouter = router({
     const qs = input.query ? `?${new URLSearchParams(input.query).toString()}` : "";
     const res = await cloudFetch2(`/api/auth${input.path}${qs}`, {
       method: input.method,
-      ...input.method === "POST" ? { body: input.body ?? {} } : {}
+      ...input.method === "POST" ? { body: input.body ?? {} } : {},
+      ...scopeOf(input)
     });
     const text = await res.text();
     let data = null;
@@ -3973,14 +4228,15 @@ var cloudAuthRouter = router({
    * browser's session — signing out here leaves the web app signed in, and vice
    * versa.
    */
-  signOut: protectedProcedure.mutation(async () => {
-    if (await cloudSessionStore.isLinked()) {
+  signOut: protectedProcedure.input(ScopeSchema).mutation(async ({ input }) => {
+    const { accountId } = input;
+    if (await cloudSessionStore.isAccountLinked(accountId)) {
       try {
-        await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {} });
+        await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {}, accountId });
       } catch {
       }
     }
-    await cloudSessionStore.clear();
+    await cloudSessionStore.remove(accountId);
     return { success: true };
   })
 });
@@ -4001,7 +4257,7 @@ function planGateMessage(status, path) {
   }
   return `Le cloud a r\xE9pondu HTTP ${status} sur ${path}.`;
 }
-async function callCloud(path, init = {}) {
+async function callCloud(path, init) {
   try {
     const res = await cloudFetch2(`/api/auth${path}`, init);
     if (!res.ok) {
@@ -4020,12 +4276,56 @@ function must(res) {
   }
   return res.data;
 }
+var boardAccounts = /* @__PURE__ */ new Map();
+async function accountOfOrg(orgId) {
+  return accountForOrgScope(orgId);
+}
+function rememberBoardAccount(boardId, accountId) {
+  boardAccounts.set(boardId, accountId);
+}
+async function accountOfBoard(boardId) {
+  const memo = boardAccounts.get(boardId);
+  if (memo) return memo;
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length <= 1) return soleAccountScope();
+  const owners = await Promise.all(accounts.map(async (account) => {
+    const res = await callCloud(
+      `/kanban/board/get?id=${encodeURIComponent(boardId)}`,
+      { accountId: account.id }
+    );
+    return res.ok && res.data?.board ? account.id : null;
+  }));
+  const owner = owners.find((id) => id !== null);
+  if (owner) {
+    boardAccounts.set(boardId, owner);
+    return owner;
+  }
+  throw new KanbanUnavailableError(
+    `Aucun des ${accounts.length} comptes li\xE9s \xE0 ce poste ne conna\xEEt le tableau ${boardId}.`
+  );
+}
+async function scopeOfBoard(boardId) {
+  return { accountId: await accountOfBoard(boardId) };
+}
 async function resolveOrganizationId(explicit) {
   if (explicit) return explicit;
-  const session = await callCloud("/get-session");
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length > 1) {
+    throw new KanbanUnavailableError(
+      `Ce poste est li\xE9 \xE0 ${accounts.length} comptes cloud : pr\xE9cisez organizationId, sans quoi rien ne dit lequel interroger.`
+    );
+  }
+  const accountId = await soleAccountScope();
+  const session = await callCloud(
+    "/get-session",
+    { accountId }
+  );
   const active = session.data?.session?.activeOrganizationId;
   if (active) return active;
-  const orgs = must(await callCloud("/organization/list"));
+  const orgs = must(await callCloud(
+    "/organization/list",
+    { accountId }
+  ));
   if (orgs.length === 1) return orgs[0].id;
   if (orgs.length === 0) {
     throw new KanbanUnavailableError(
@@ -4047,7 +4347,12 @@ var KanbanStore = class {
   async list(includeArchived = false, organizationId) {
     const orgId = await resolveOrganizationId(organizationId);
     const query = `?organizationId=${encodeURIComponent(orgId)}` + (includeArchived ? "&includeArchived=true" : "");
-    const res = must(await callCloud(`/kanban/board/list${query}`));
+    const accountId = await accountOfOrg(orgId);
+    const res = must(await callCloud(
+      `/kanban/board/list${query}`,
+      { accountId }
+    ));
+    for (const board of res.boards ?? []) rememberBoardAccount(board.id, accountId);
     return { organizationId: orgId, boards: res.boards ?? [] };
   }
   /**
@@ -4058,13 +4363,18 @@ var KanbanStore = class {
    */
   async get(id, opts = {}) {
     const query = `?id=${encodeURIComponent(id)}${opts.withHistory ? "&withHistory=true" : ""}`;
-    const res = must(await callCloud(`/kanban/board/get${query}`));
+    const accountId = await accountOfBoard(id);
+    const res = must(await callCloud(
+      `/kanban/board/get${query}`,
+      { accountId }
+    ));
     return res.board ?? null;
   }
   /** Le journal d'une seule carte — ce que le contexte d'un agent demande. */
   async cardHistory(boardId, cardId) {
     const res = await callCloud(
-      `/kanban/card/history?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`
+      `/kanban/card/history?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`,
+      await scopeOfBoard(boardId)
     );
     return res.data?.history ?? [];
   }
@@ -4078,7 +4388,8 @@ var KanbanStore = class {
   async addComment(boardId, cardId, detail, conversationId) {
     const res = await callCloud("/kanban/card/comment/add", {
       method: "POST",
-      body: { boardId, cardId, detail, author: "ai", ...conversationId ? { conversationId } : {} }
+      body: { boardId, cardId, detail, author: "ai", ...conversationId ? { conversationId } : {} },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4086,7 +4397,8 @@ var KanbanStore = class {
   async addCardEvent(boardId, cardId, type, detail) {
     const res = await callCloud("/kanban/card/event/add", {
       method: "POST",
-      body: { boardId, cardId, type, detail }
+      body: { boardId, cardId, type, detail },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4100,14 +4412,16 @@ var KanbanStore = class {
   async addCard(boardId, input) {
     const res = await callCloud("/kanban/card/add", {
       method: "POST",
-      body: { boardId, ...input }
+      body: { boardId, ...input },
+      ...await scopeOfBoard(boardId)
     });
     return { card: res.data?.card ?? null, unsupported: res.status === 404 };
   }
   /** Une carte, par son identifiant — archivée comprise. */
   async card(boardId, cardId) {
     const res = await callCloud(
-      `/kanban/card/get?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`
+      `/kanban/card/get?boardId=${encodeURIComponent(boardId)}&cardId=${encodeURIComponent(cardId)}`,
+      await scopeOfBoard(boardId)
     );
     return res.data ?? null;
   }
@@ -4121,7 +4435,8 @@ var KanbanStore = class {
   async updateCard(boardId, cardId, patch) {
     const res = await callCloud("/kanban/card/update", {
       method: "POST",
-      body: { boardId, cardId, ...patch }
+      body: { boardId, cardId, ...patch },
+      ...await scopeOfBoard(boardId)
     });
     return res.data?.card ?? null;
   }
@@ -4129,7 +4444,8 @@ var KanbanStore = class {
   async setCardArchived(boardId, cardId, archived) {
     const res = await callCloud(`/kanban/card/${archived ? "archive" : "unarchive"}`, {
       method: "POST",
-      body: { boardId, cardId }
+      body: { boardId, cardId },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4141,7 +4457,8 @@ var KanbanStore = class {
     const orgId = await resolveOrganizationId(organizationId);
     const res = must(
       await callCloud(
-        `/organization/get-full-organization?organizationId=${encodeURIComponent(orgId)}`
+        `/organization/get-full-organization?organizationId=${encodeURIComponent(orgId)}`,
+        { accountId: await accountOfOrg(orgId) }
       )
     );
     return (res.members ?? []).map((m) => ({
@@ -4169,7 +4486,8 @@ var KanbanStore = class {
     if (input.limit) query.set("limit", String(input.limit));
     const res = must(
       await callCloud(
-        `/kanban/card/search?${query.toString()}`
+        `/kanban/card/search?${query.toString()}`,
+        { accountId: await accountOfOrg(orgId) }
       )
     );
     return { cards: res.cards ?? [], total: res.total ?? 0, truncated: Boolean(res.truncated) };
@@ -4178,7 +4496,8 @@ var KanbanStore = class {
   async moveCard(boardId, cardId, toColumnId) {
     const res = await callCloud("/kanban/card/move", {
       method: "POST",
-      body: { boardId, cardId, toColumnId }
+      body: { boardId, cardId, toColumnId },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4191,7 +4510,8 @@ var KanbanStore = class {
    */
   async cardLinks(boardId) {
     const res = await callCloud(
-      `/kanban/card-link/list?boardId=${encodeURIComponent(boardId)}`
+      `/kanban/card-link/list?boardId=${encodeURIComponent(boardId)}`,
+      await scopeOfBoard(boardId)
     );
     return { links: res.data?.links ?? [], cards: res.data?.cards ?? [] };
   }
@@ -4209,7 +4529,8 @@ var KanbanStore = class {
         cardId,
         parentBoardId: parent?.boardId ?? null,
         parentCardId: parent?.cardId ?? null
-      }
+      },
+      ...await scopeOfBoard(boardId)
     });
     return res.ok;
   }
@@ -4218,6 +4539,7 @@ var KanbanStore = class {
     if (!organizationId) return null;
     const res = await callCloud("/kanban/board/create", {
       method: "POST",
+      accountId: await accountOfOrg(organizationId),
       body: {
         organizationId,
         name: input.name,
@@ -4230,14 +4552,16 @@ var KanbanStore = class {
   async update(input) {
     const res = await callCloud("/kanban/board/update", {
       method: "POST",
-      body: input
+      body: input,
+      ...await scopeOfBoard(input.id)
     });
     return res.data?.board ?? null;
   }
   async delete(id) {
     const res = await callCloud("/kanban/board/delete", {
       method: "POST",
-      body: { id }
+      body: { id },
+      ...await scopeOfBoard(id)
     });
     return res.data?.success ?? false;
   }
@@ -4657,7 +4981,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-4XJUIZKL.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-EI7SXPN5.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5349,7 +5673,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-4XJUIZKL.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-EI7SXPN5.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7297,7 +7621,10 @@ export {
   cloudSessionStore,
   getCloudApiUrl,
   orgCloudUrl,
+  accountForOrg,
+  accountForOrgOrThrow,
   cloudFetch,
+  readCloudIdentity,
   environmentOverridesStore,
   environmentResolver,
   auditService,
@@ -7332,6 +7659,8 @@ export {
   imageStorageService,
   getDeviceName,
   cloudFetch2,
+  accountForOrgScope,
+  soleAccountScope,
   cloudAuthRouter,
   kanbanStore,
   executeKanbanCommands,
@@ -7344,4 +7673,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-YQISK6BL.js.map
+//# sourceMappingURL=chunk-4SJCPFGK.js.map