@runeya/runeya 2.0.107 → 2.0.109

package/{chunk-ZDHLWTHW.js → chunk-77UQ2UKW.js}

@@ -2,14 +2,14 @@ import {
   SchemaVersionSchema,
   SettingsPrivateSchema,
   SettingsSchema
-} from "./chunk-QRMG6GMX.js";
+} from "./chunk-6T7R2JZR.js";
 import {
   env,
   legacyMachineFilePath,
   machineFilePath,
   machineRoot,
   orgVaultRoot
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/services/settings-manager.ts
 import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
@@ -151,4 +151,4 @@ var settingsManager = new SettingsManager();
 export {
   settingsManager
 };
-//# sourceMappingURL=chunk-ZDHLWTHW.js.map
+//# sourceMappingURL=chunk-77UQ2UKW.js.map

package/{chunk-JNI4CXJ7.js → chunk-HJZPLRNL.js}

@@ -28,7 +28,7 @@ import {
   resetRelaunches,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-TE57T5GO.js";
+} from "./chunk-OSKZYKSN.js";
 import {
   agentManager,
   agentStore,
@@ -48,10 +48,10 @@ import {
   rememberFile,
   serviceStore,
   wasRead
-} from "./chunk-ELI2TELD.js";
+} from "./chunk-OGCEFBSS.js";
 import {
   settingsManager
-} from "./chunk-ZDHLWTHW.js";
+} from "./chunk-77UQ2UKW.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
@@ -63,6 +63,7 @@ import {
   ScenarioSchema,
   ServiceCommandSchema,
   ServiceShortcutSchema,
+  ambiguousServiceSlugs,
   crossServiceValues,
   interpolateBuiltinsInEnv,
   nativeParsers,
@@ -71,7 +72,7 @@ import {
   serviceUrlValues,
   urlHostFor,
   withDeprecatedAliases
-} from "./chunk-QRMG6GMX.js";
+} from "./chunk-6T7R2JZR.js";
 import {
   allVaultRoots,
   env,
@@ -83,7 +84,7 @@ import {
   machineRoot,
   orgVaultRoot,
   vaultIdOfRoot
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/trpc/routers/chat.ts
 import { z as z5 } from "zod";
@@ -2247,13 +2248,10 @@ function buildServerBuiltins(input) {
   if (projectName !== void 0) values["project.NAME"] = projectName;
   if (environmentName !== void 0) values["runeya.ENV_NAME"] = environmentName;
   if (agentName !== void 0) values["agent.NAME"] = agentName;
-  const slugCounts = /* @__PURE__ */ new Map();
+  const ambiguous = ambiguousServiceSlugs(siblings.map((sibling) => sibling.name));
   for (const sibling of siblings) {
     const slug = serviceSlug(sibling.name);
-    if (slug) slugCounts.set(slug, (slugCounts.get(slug) ?? 0) + 1);
-  }
-  for (const sibling of siblings) {
-    if ((slugCounts.get(serviceSlug(sibling.name)) ?? 0) !== 1) continue;
+    if (!slug || ambiguous.has(slug)) continue;
     Object.assign(values, crossServiceValues({
       name: sibling.name,
       id: sibling.id,
@@ -3921,20 +3919,33 @@ function getCloudApiUrl() {
   return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
 }
 async function orgCloudUrl(orgId) {
-  const { readOrgClouds } = await import("./vault-resolver-V7KH4FTC.js");
+  const { readOrgClouds } = await import("./vault-resolver-57Q2DVOR.js");
   const clouds = await readOrgClouds();
   return (clouds[orgId] ?? getCloudApiUrl()).replace(/\/+$/, "");
 }
 async function accountForOrg(orgId) {
-  const { readOrgAccounts } = await import("./vault-resolver-V7KH4FTC.js");
-  const stamped = (await readOrgAccounts())[orgId];
-  const accounts = await cloudSessionStore.list();
-  if (stamped && accounts.some((a) => a.id === stamped)) return stamped;
-  return accounts.length === 1 ? accounts[0].id : null;
+  const { readOrgAccounts, readOrgClouds } = await import("./vault-resolver-57Q2DVOR.js");
+  const [stampedAccounts, stampedClouds, accounts] = await Promise.all([
+    readOrgAccounts(),
+    readOrgClouds(),
+    cloudSessionStore.list()
+  ]);
+  const orgCloud = stampedClouds[orgId]?.replace(/\/+$/, "");
+  const candidates = orgCloud ? accounts.filter((a) => a.cloudUrl.replace(/\/+$/, "") === orgCloud) : accounts;
+  const stamped = stampedAccounts[orgId];
+  if (stamped && candidates.some((a) => a.id === stamped)) return stamped;
+  return candidates.length === 1 ? candidates[0].id : null;
 }
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
+var CloudAmbiguousAccountError = class extends Error {
+  code = "CLOUD_AMBIGUOUS_ACCOUNT";
+  constructor() {
+    super("Several cloud accounts are linked; name the organization this call belongs to.");
+    this.name = "CloudAmbiguousAccountError";
+  }
+};
 var CloudNotLinkedError = class extends Error {
   code = "CLOUD_NOT_LINKED";
   constructor() {
@@ -3942,16 +3953,21 @@ var CloudNotLinkedError = class extends Error {
     this.name = "CloudNotLinkedError";
   }
 };
-async function resolveAccountId(scope) {
-  if (scope.accountId) return scope.accountId;
-  if (scope.orgId) return accountForOrg(scope.orgId);
-  const accounts = await cloudSessionStore.list();
-  return accounts.length === 1 ? accounts[0].id : null;
+async function accountForOrgOrThrow(orgId) {
+  const accountId = await accountForOrg(orgId);
+  if (!accountId) throw new CloudNotLinkedError();
+  return accountId;
 }
-async function cloudFetch(path, init = {}) {
-  const accountId = await resolveAccountId(init);
-  const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
-  if (!accountId || !token) throw new CloudNotLinkedError();
+async function soleAccountOrThrow() {
+  const accounts = await cloudSessionStore.list();
+  if (accounts.length === 1) return accounts[0].id;
+  if (accounts.length === 0) throw new CloudNotLinkedError();
+  throw new CloudAmbiguousAccountError();
+}
+async function cloudFetch(path, init) {
+  const { accountId } = init;
+  const token = await cloudSessionStore.getToken(accountId);
+  if (!token) throw new CloudNotLinkedError();
   const base = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
   return fetch(`${base.replace(/\/+$/, "")}${path}`, {
     method: init.method ?? "GET",
@@ -4013,7 +4029,7 @@ function callbackForReturnTo(url) {
   if (!lanIps().includes(hostname2)) return null;
   return `${parsed.origin}/api/cloud/callback`;
 }
-async function cloudFetch2(path, init = {}) {
+async function cloudFetch2(path, init) {
   try {
     return await cloudFetch(path, init);
   } catch (err) {
@@ -4021,6 +4037,25 @@ async function cloudFetch2(path, init = {}) {
     throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
   }
 }
+async function accountForOrgScope(orgId) {
+  try {
+    return await accountForOrgOrThrow(orgId);
+  } catch (err) {
+    if (!(err instanceof CloudNotLinkedError)) throw err;
+    throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
+  }
+}
+async function soleAccountScope() {
+  try {
+    return await soleAccountOrThrow();
+  } catch (err) {
+    if (err instanceof CloudAmbiguousAccountError) {
+      throw new TRPCError3({ code: "BAD_REQUEST", message: err.message });
+    }
+    if (!(err instanceof CloudNotLinkedError)) throw err;
+    throw new TRPCError3({ code: "PRECONDITION_FAILED", message: err.message });
+  }
+}
 var PROXY_PREFIXES = ["/organization/", "/project/", "/chat/", "/kanban/", "/user/prefs"];
 function isAllowedProxyPath(path) {
   if (!path.startsWith("/") || path.includes("..")) return false;
@@ -4028,17 +4063,10 @@ function isAllowedProxyPath(path) {
   return PROXY_PREFIXES.some((p) => pathname === p || pathname.startsWith(p));
 }
 var ScopeSchema = z4.object({
-  accountId: z4.string().max(64).optional(),
-  orgId: z4.string().max(128).optional()
+  accountId: z4.string().min(1).max(64)
 });
 function scopeOf(input) {
-  return { accountId: input.accountId, orgId: input.orgId };
-}
-async function scopedAccountId(input) {
-  if (input.accountId) return input.accountId;
-  if (input.orgId) return accountForOrg(input.orgId);
-  const accounts = await cloudSessionStore.list();
-  return accounts.length === 1 ? accounts[0].id : null;
+  return { accountId: input.accountId };
 }
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
@@ -4068,6 +4096,19 @@ var cloudAuthRouter = router({
       accountCount: accounts.length
     };
   }),
+  /**
+   * Le compte dont relève une organisation.
+   *
+   * La question que l'interface pose à chaque changement de projet : le projet
+   * ouvert donne son organisation, l'organisation donne son compte. Répondue
+   * ici plutôt que déduite d'une carte tenue dans le navigateur — une carte se
+   * périme dès qu'un coffre est tamponné, et l'interface restait alors sur le
+   * compte précédent sans que rien ne le dise.
+   *
+   * `null` quand rien ne rattache cette organisation à un compte de ce poste :
+   * l'interface l'affiche comme déconnectée, ce qu'elle est.
+   */
+  accountForOrg: protectedProcedure.input(z4.object({ orgId: z4.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
   /**
    * Les comptes liés à ce poste, et l'organisation dont chacun répond.
    *
@@ -4075,13 +4116,13 @@ var cloudAuthRouter = router({
    * du projet ouvert, sous quel compte il se synchronise.
    */
   accounts: protectedProcedure.query(async () => {
-    const { readOrgAccounts } = await import("./vault-resolver-V7KH4FTC.js");
+    const { readOrgAccounts } = await import("./vault-resolver-57Q2DVOR.js");
     return { accounts: await cloudSessionStore.list(), orgAccounts: await readOrgAccounts() };
   }),
   /** The cloud session (user + org), fetched with the stored token. */
-  session: protectedProcedure.input(ScopeSchema.optional()).query(async ({ input }) => {
-    const accountId = await scopedAccountId(input ?? {});
-    if (!accountId || !await cloudSessionStore.isAccountLinked(accountId)) return null;
+  session: protectedProcedure.input(ScopeSchema).query(async ({ input }) => {
+    const { accountId } = input;
+    if (!await cloudSessionStore.isAccountLinked(accountId)) return null;
     const res = await cloudFetch2("/api/auth/get-session", { accountId });
     if (!res.ok) {
       if (res.status === 401) await cloudSessionStore.remove(accountId);
@@ -4093,7 +4134,7 @@ var cloudAuthRouter = router({
       const identity = await readCloudIdentity(account.cloudUrl, await cloudSessionStore.getToken(accountId) ?? "");
       if (identity) {
         const settled = await cloudSessionStore.describe(accountId, identity);
-        const { renameOrgAccount } = await import("./vault-resolver-V7KH4FTC.js");
+        const { renameOrgAccount } = await import("./vault-resolver-57Q2DVOR.js");
         await renameOrgAccount(accountId, settled);
       }
     }
@@ -4104,8 +4145,8 @@ var cloudAuthRouter = router({
    * browsers signed into it. No token material — the cloud only ever returns
    * ids and labels here.
    */
-  devices: protectedProcedure.input(ScopeSchema.optional()).query(async ({ input }) => {
-    const accountId = await scopedAccountId(input ?? {});
+  devices: protectedProcedure.input(ScopeSchema).query(async ({ input }) => {
+    const { accountId } = input;
     if (!accountId || !await cloudSessionStore.isAccountLinked(accountId)) {
       return { devices: [] };
     }
@@ -4124,7 +4165,7 @@ var cloudAuthRouter = router({
    * left holding a dead credential.
    */
   revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const accountId = await scopedAccountId(input);
+    const { accountId } = input;
     if (!accountId) throw new TRPCError3({ code: "PRECONDITION_FAILED", message: "No cloud account for this scope." });
     const res = await cloudFetch2("/api/auth/device/revoke", {
       method: "POST",
@@ -4151,8 +4192,12 @@ var cloudAuthRouter = router({
       method: z4.enum(["GET", "POST"]).default("GET"),
       query: z4.record(z4.string().max(128), z4.string().max(2048)).optional(),
       body: z4.unknown().optional(),
-      accountId: z4.string().max(64).optional(),
-      orgId: z4.string().max(128).optional()
+      // Obligatoire, et seul : c'est la porte par laquelle passent tous les
+      // appels cloud de l'interface. La laisser optionnelle est ce qui a
+      // permis aux composables partagées de n'envoyer aucune portée pendant
+      // trente routes, et au serveur de retomber sur « le compte unique du
+      // poste » — muet dès qu'il y en a eu deux.
+      accountId: z4.string().min(1).max(64)
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -4181,12 +4226,8 @@ var cloudAuthRouter = router({
    * browser's session — signing out here leaves the web app signed in, and vice
    * versa.
    */
-  signOut: protectedProcedure.input(ScopeSchema.optional()).mutation(async ({ input }) => {
-    const accountId = await scopedAccountId(input ?? {});
-    if (!accountId) {
-      if ((await cloudSessionStore.list()).length === 0) return { success: true };
-      throw new TRPCError3({ code: "BAD_REQUEST", message: "Which account? Several are linked." });
-    }
+  signOut: protectedProcedure.input(ScopeSchema).mutation(async ({ input }) => {
+    const { accountId } = input;
     if (await cloudSessionStore.isAccountLinked(accountId)) {
       try {
         await cloudFetch2("/api/auth/sign-out", { method: "POST", body: {}, accountId });
@@ -4214,7 +4255,7 @@ function planGateMessage(status, path) {
   }
   return `Le cloud a r\xE9pondu HTTP ${status} sur ${path}.`;
 }
-async function callCloud(path, init = {}) {
+async function callCloud(path, init) {
   try {
     const res = await cloudFetch2(`/api/auth${path}`, init);
     if (!res.ok) {
@@ -4235,16 +4276,16 @@ function must(res) {
 }
 var boardAccounts = /* @__PURE__ */ new Map();
 async function accountOfOrg(orgId) {
-  return await accountForOrg(orgId) ?? void 0;
+  return accountForOrgScope(orgId);
 }
 function rememberBoardAccount(boardId, accountId) {
-  if (accountId) boardAccounts.set(boardId, accountId);
+  boardAccounts.set(boardId, accountId);
 }
 async function accountOfBoard(boardId) {
   const memo = boardAccounts.get(boardId);
   if (memo) return memo;
   const accounts = await cloudSessionStore.list();
-  if (accounts.length <= 1) return accounts[0]?.id;
+  if (accounts.length <= 1) return soleAccountScope();
   const owners = await Promise.all(accounts.map(async (account) => {
     const res = await callCloud(
       `/kanban/board/get?id=${encodeURIComponent(boardId)}`,
@@ -4262,8 +4303,7 @@ async function accountOfBoard(boardId) {
   );
 }
 async function scopeOfBoard(boardId) {
-  const accountId = await accountOfBoard(boardId);
-  return accountId ? { accountId } : {};
+  return { accountId: await accountOfBoard(boardId) };
 }
 async function resolveOrganizationId(explicit) {
   if (explicit) return explicit;
@@ -4273,16 +4313,16 @@ async function resolveOrganizationId(explicit) {
       `Ce poste est li\xE9 \xE0 ${accounts.length} comptes cloud : pr\xE9cisez organizationId, sans quoi rien ne dit lequel interroger.`
     );
   }
-  const accountId = accounts[0]?.id;
+  const accountId = await soleAccountScope();
   const session = await callCloud(
     "/get-session",
-    accountId ? { accountId } : {}
+    { accountId }
   );
   const active = session.data?.session?.activeOrganizationId;
   if (active) return active;
   const orgs = must(await callCloud(
     "/organization/list",
-    accountId ? { accountId } : {}
+    { accountId }
   ));
   if (orgs.length === 1) return orgs[0].id;
   if (orgs.length === 0) {
@@ -4308,7 +4348,7 @@ var KanbanStore = class {
     const accountId = await accountOfOrg(orgId);
     const res = must(await callCloud(
       `/kanban/board/list${query}`,
-      accountId ? { accountId } : {}
+      { accountId }
     ));
     for (const board of res.boards ?? []) rememberBoardAccount(board.id, accountId);
     return { organizationId: orgId, boards: res.boards ?? [] };
@@ -4324,7 +4364,7 @@ var KanbanStore = class {
     const accountId = await accountOfBoard(id);
     const res = must(await callCloud(
       `/kanban/board/get${query}`,
-      accountId ? { accountId } : {}
+      { accountId }
     ));
     return res.board ?? null;
   }
@@ -4416,7 +4456,7 @@ var KanbanStore = class {
     const res = must(
       await callCloud(
         `/organization/get-full-organization?organizationId=${encodeURIComponent(orgId)}`,
-        { orgId }
+        { accountId: await accountOfOrg(orgId) }
       )
     );
     return (res.members ?? []).map((m) => ({
@@ -4445,7 +4485,7 @@ var KanbanStore = class {
     const res = must(
       await callCloud(
         `/kanban/card/search?${query.toString()}`,
-        { orgId }
+        { accountId: await accountOfOrg(orgId) }
       )
     );
     return { cards: res.cards ?? [], total: res.total ?? 0, truncated: Boolean(res.truncated) };
@@ -4497,7 +4537,7 @@ var KanbanStore = class {
     if (!organizationId) return null;
     const res = await callCloud("/kanban/board/create", {
       method: "POST",
-      orgId: organizationId,
+      accountId: await accountOfOrg(organizationId),
       body: {
         organizationId,
         name: input.name,
@@ -4939,7 +4979,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2RWV2SXZ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-APY7SZ75.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5631,7 +5671,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2RWV2SXZ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-APY7SZ75.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7580,6 +7620,7 @@ export {
   getCloudApiUrl,
   orgCloudUrl,
   accountForOrg,
+  accountForOrgOrThrow,
   cloudFetch,
   readCloudIdentity,
   environmentOverridesStore,
@@ -7616,6 +7657,8 @@ export {
   imageStorageService,
   getDeviceName,
   cloudFetch2,
+  accountForOrgScope,
+  soleAccountScope,
   cloudAuthRouter,
   kanbanStore,
   executeKanbanCommands,
@@ -7628,4 +7671,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-JNI4CXJ7.js.map
+//# sourceMappingURL=chunk-HJZPLRNL.js.map