@runeya/runeya 2.0.51 → 2.0.53

package/{src-R6JOPDNL.js → src-4GK5OK3K.js}

@@ -35,6 +35,7 @@ import {
   allVaultRoots,
   clearEncryptionKey,
   clearPendingLegacyKey,
+  clearVaultLock,
   decryptValue,
   decryptValueWith,
   decryptVariableSlots,
@@ -60,10 +61,12 @@ import {
   legacyMachineFilePath,
   legacyVaultRoot,
   listCloudVaults,
+  listOrgVaults,
   loadFromEnv,
   localVaultRoot,
   machineFilePath,
   machineRoot,
+  markVaultLocked,
   nativeParsers,
   orgVaultRoot,
   projectKey,
@@ -71,8 +74,10 @@ import {
   readEntity,
   readOrgClouds,
   refOfProjectAmong,
+  refsOfProjectId,
   registerProjectLoader,
   rootOfProjectAmong,
+  rootOfProjectRef,
   serviceStore,
   setEncryptionKey,
   setEncryptionKeyInMemory,
@@ -83,8 +88,9 @@ import {
   stampOrgCloud,
   traefikManager,
   vaultFor,
+  vaultIdOfRoot,
   writeEntity
-} from "./chunk-NVKGIBJN.js";
+} from "./chunk-EL75GG7O.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -127,7 +133,7 @@ async function verifyJwt(token) {
 // ../server/src/services/api-key-store.ts
 import { randomBytes as randomBytes2, randomUUID, timingSafeEqual } from "crypto";
 import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
-import { dirname } from "path";
+import { dirname, join } from "path";
 function maskApiKey(apiKey) {
   const { key, ...rest } = apiKey;
   return { ...rest, keyPreview: key.slice(-4) };
@@ -136,47 +142,66 @@ var FILE_PUBLIC = "api-keys.json";
 var FILE_PRIVATE = "api-keys.private.json";
 var ApiKeyStore = class {
   keys = /* @__PURE__ */ new Map();
+  /** Le propriétaire de chaque clé, d'après le coffre où elle a été lue. */
+  owners = /* @__PURE__ */ new Map();
+  /** Tous les coffres rencontrés — voir `AgentStore.knownOwners`, même raison. */
+  knownOwners = /* @__PURE__ */ new Set([null]);
   loaded = false;
   /**
    * Encrypted at rest, so the file sits beside the key that opens it — read
    * under a different key it would decrypt to blanks, then be saved back blank.
    */
-  filePath(isPublic) {
-    return keyedFilePath(isPublic ? FILE_PUBLIC : FILE_PRIVATE);
-  }
-  async ensureDir() {
-    await mkdir(dirname(await this.filePath(true)), { recursive: true });
-  }
-  async persistFile(isPublic) {
-    await this.ensureDir();
-    const path = await this.filePath(isPublic);
-    const keys = Array.from(this.keys.values()).filter((k) => k.isPublic === isPublic).map((k) => ({ ...k, key: encryptValue(k.key) }));
+  /**
+   * Le fichier d'un propriétaire. Côté machine il reste collé à la clé qui
+   * l'ouvre (`keyedFilePath`) ; côté organisation, c'est son coffre.
+   */
+  filePath(isPublic, owner) {
+    const name = isPublic ? FILE_PUBLIC : FILE_PRIVATE;
+    if (owner === null) return keyedFilePath(name);
+    return Promise.resolve(join(orgVaultRoot(owner), name));
+  }
+  async persistFile(isPublic, owner) {
+    const path = await this.filePath(isPublic, owner);
+    await mkdir(dirname(path), { recursive: true });
+    const keys = Array.from(this.keys.values()).filter((k) => k.isPublic === isPublic && (this.owners.get(k.id) ?? null) === owner).map((k) => ({ ...k, key: encryptValue(k.key, owner ?? void 0) }));
     const tmp = path + ".tmp";
     await writeFile(tmp, JSON.stringify({ keys }, null, 2), "utf-8");
     await rename(tmp, path);
     await chmod(path, 384);
   }
+  /**
+   * Réécrire ce fichier pour chaque propriétaire connu.
+   *
+   * Y compris ceux qui n'ont plus de clé : sinon une clé supprimée — ou dont le
+   * propriétaire a changé — survivrait dans son ancien coffre.
+   */
   async persist(isPublic) {
-    await this.persistFile(isPublic);
+    for (const owner of this.knownOwners) await this.persistFile(isPublic, owner);
   }
-  async loadFile(path) {
+  async loadFile(path, owner) {
     try {
       const raw = await readFile(path, "utf-8");
       const parsed = ApiKeysFileSchema.safeParse(JSON.parse(raw));
       if (parsed.success) {
         for (const k of parsed.data.keys) {
-          const key = isEncryptedValue(k.key) ? decryptValue(k.key) : k.key;
+          const key = isEncryptedValue(k.key) ? decryptValue(k.key, owner ?? void 0) : k.key;
           this.keys.set(k.id, { ...k, key });
+          this.owners.set(k.id, owner);
+          this.knownOwners.add(owner);
         }
       }
     } catch {
     }
   }
+  /** La machine, puis chaque organisation dont un coffre existe sur ce disque. */
   async load() {
     if (this.loaded) return;
     this.loaded = true;
-    await this.loadFile(await this.filePath(true));
-    await this.loadFile(await this.filePath(false));
+    const owners = [null, ...await listOrgVaults()];
+    for (const owner of owners) {
+      await this.loadFile(await this.filePath(true, owner), owner);
+      await this.loadFile(await this.filePath(false, owner), owner);
+    }
   }
   /**
    * Keys as exposed to callers — secrets stripped. Use `reveal` to obtain one
@@ -191,7 +216,7 @@ var ApiKeyStore = class {
     await this.load();
     return this.keys.get(id)?.key ?? null;
   }
-  async create(name, scopes, isPublic) {
+  async create(name, scopes, isPublic, owner = null) {
     await this.load();
     const apiKey = {
       id: `apikey-${randomUUID()}`,
@@ -202,6 +227,8 @@ var ApiKeyStore = class {
       isPublic
     };
     this.keys.set(apiKey.id, apiKey);
+    this.owners.set(apiKey.id, owner);
+    this.knownOwners.add(owner);
     await this.persist(isPublic);
     return apiKey;
   }
@@ -212,8 +239,8 @@ var ApiKeyStore = class {
     const updated = { ...existing, name, scopes, isPublic };
     this.keys.set(id, updated);
     if (existing.isPublic !== isPublic) {
-      await this.persistFile(existing.isPublic);
-      await this.persistFile(isPublic);
+      await this.persist(existing.isPublic);
+      await this.persist(isPublic);
     } else {
       await this.persist(isPublic);
     }
@@ -224,6 +251,7 @@ var ApiKeyStore = class {
     const existing = this.keys.get(id);
     if (!existing) return false;
     this.keys.delete(id);
+    this.owners.delete(id);
     await this.persist(existing.isPublic);
     return true;
   }
@@ -450,11 +478,11 @@ import { TRPCError as TRPCError2 } from "@trpc/server";
 import { randomUUID as randomUUID2 } from "crypto";
 import { EventEmitter } from "events";
 import { readFile as readFile2, writeFile as writeFile3, rename as rename2, mkdir as mkdir2, chmod as chmod2, rm } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // ../server/src/utils/ensure-data-gitignore.ts
 import { writeFile as writeFile2 } from "fs/promises";
-import { join } from "path";
+import { join as join2 } from "path";
 var GITIGNORE_CONTENT = `
 #################
 # Do not edit this file #
@@ -491,7 +519,7 @@ conversations.private.json
 *.log.*
 `;
 async function ensureDataGitignore(dataDir) {
-  const gitignorePath = join(dataDir, ".gitignore");
+  const gitignorePath = join2(dataDir, ".gitignore");
   await writeFile2(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 
@@ -506,14 +534,14 @@ async function readLocalProject() {
   const root = localVaultRoot();
   let current = null;
   try {
-    const raw = await readFile2(join2(root, FILENAME), "utf-8");
+    const raw = await readFile2(join3(root, FILENAME), "utf-8");
     const parsed = ProjectSchema.safeParse(JSON.parse(raw));
     if (parsed.success) current = parsed.data;
   } catch {
   }
   let legacy;
   try {
-    legacy = JSON.parse(await readFile2(join2(root, LEGACY_FILENAME), "utf-8"));
+    legacy = JSON.parse(await readFile2(join3(root, LEGACY_FILENAME), "utf-8"));
   } catch {
     return { local: current, strayCloud: [] };
   }
@@ -523,7 +551,7 @@ async function readLocalProject() {
   if (locals.length > 1) {
     const names = locals.map((p) => `"${p.name}" (${p.id})`).join(", ");
     throw new Error(
-      `${join2(root, LEGACY_FILENAME)} holds ${locals.length} local projects: ${names}. A directory now holds a single local project \u2014 move the others to their own directory, or into an organization, then start again.`
+      `${join3(root, LEGACY_FILENAME)} holds ${locals.length} local projects: ${names}. A directory now holds a single local project \u2014 move the others to their own directory, or into an organization, then start again.`
     );
   }
   return { local: locals[0] ?? null, strayCloud };
@@ -532,7 +560,7 @@ async function readCloudProjects() {
   const found = [];
   for (const { orgId, projectId, root } of await listCloudVaults()) {
     try {
-      const raw = await readFile2(join2(root, FILENAME), "utf-8");
+      const raw = await readFile2(join3(root, FILENAME), "utf-8");
       const parsed = ProjectSchema.safeParse({ ...JSON.parse(raw), id: projectId, orgId });
       if (parsed.success) found.push({ project: parsed.data, root });
     } catch {
@@ -562,7 +590,7 @@ var ProjectStore = class {
   /** Emits `'saved'` after every persisted mutation, for the cloud sync bridge. */
   events = new EventEmitter();
   getFilePath(root = localVaultRoot()) {
-    return join2(root, FILENAME);
+    return join3(root, FILENAME);
   }
   async writeAtomic(filePath, data) {
     const tmpPath = filePath + ".tmp";
@@ -643,7 +671,7 @@ var ProjectStore = class {
       await rm(this.getFilePath(), { force: true }).catch(() => {
       });
     }
-    await rename2(join2(localVaultRoot(), LEGACY_FILENAME), join2(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
+    await rename2(join3(localVaultRoot(), LEGACY_FILENAME), join3(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
     });
     for (const { project, root } of cloud) {
       await mkdir2(root, { recursive: true });
@@ -732,6 +760,40 @@ var ProjectStore = class {
     await this.save();
     return updated;
   }
+  /**
+   * Faire passer le projet local de ce dossier dans une organisation.
+   *
+   * Le seul déplacement de coffre qu'on s'autorise, et il ne va que dans ce
+   * sens : le projet quitte `<cwd>/.runeya` pour
+   * `~/.runeya/orgs/<org>/projects/<id>/`, en gardant son identifiant. Il n'y a
+   * donc jamais deux copies à réconcilier — c'est ce qui rendait « publier »
+   * dangereux tant que le projet restait aussi local.
+   *
+   * Refusé si l'organisation porte déjà ce projet : la copie d'ici écraserait
+   * celle du cloud, et ces deux histoires ne sont pas à nous de les fusionner.
+   *
+   * Ce qui suit le projet est écrit par les stores eux-mêmes : `save()` réécrit
+   * chaque coffre — le fichier local disparaît, celui de l'org apparaît — puis
+   * les contenus sont relogés depuis le registre, qui pointe désormais ailleurs.
+   */
+  async moveToOrg(projectId, orgId) {
+    await this.load();
+    const local = this.projects.get(projectKey({ id: projectId, orgId: null }));
+    if (!local) throw new Error("PROJECT_NOT_LOCAL");
+    if (this.projects.get(projectKey({ id: projectId, orgId }))) {
+      throw new Error("PROJECT_ALREADY_IN_ORG");
+    }
+    const moved = { ...local, orgId };
+    this.projects.delete(projectKey(local));
+    forgetProject(local);
+    this.projects.set(projectKey(moved), moved);
+    setProjectVault(moved, vaultFor(moved).root);
+    setProjectServices(moved, moved.serviceIds ?? []);
+    await this.save();
+    await serviceStore.reassignOrg(moved.serviceIds ?? [], orgId);
+    await environmentStore.relocateAll();
+    return moved;
+  }
   async delete(target) {
     await this.load();
     const found = this.find(target);
@@ -902,7 +964,7 @@ registerProjectLoader(() => projectStore.list().then(() => void 0));
 
 // ../server/src/services/environment-overrides-store.ts
 import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 var FILENAME2 = "environment-overrides.json";
 var EnvironmentOverridesStore = class {
   data = {};
@@ -956,7 +1018,7 @@ var EnvironmentOverridesStore = class {
     const sources = [
       this.getLegacyFilePath(),
       await keyedFilePath(FILENAME2),
-      ...roots.map((root) => join3(root, FILENAME2))
+      ...roots.map((root) => join4(root, FILENAME2))
     ];
     for (const path of sources) {
       let parsed;
@@ -972,7 +1034,8 @@ var EnvironmentOverridesStore = class {
       const decrypted = decryptVariableSlots(
         parsed,
         "environment-overrides",
-        (variableId) => this.unreadableSecrets.add(variableId)
+        (variableId) => this.unreadableSecrets.add(variableId),
+        vaultIdOfRoot(dirname2(path))
       );
       for (const [id, override] of Object.entries(decrypted)) {
         this.data[id] = { value: override.value };
@@ -1004,14 +1067,15 @@ var EnvironmentOverridesStore = class {
     for (const [root, overrides] of byRoot) {
       const encrypted = this.keepUnreadableSecrets(encryptVariableSlots(
         overrides,
-        this.diskEncryptedSlots
+        this.diskEncryptedSlots,
+        vaultIdOfRoot(root)
       ));
       Object.assign(
         this.diskEncryptedSlots,
         extractEncryptedVariableSlots(encrypted)
       );
       await mkdir3(root, { recursive: true });
-      const path = join3(root, FILENAME2);
+      const path = join4(root, FILENAME2);
       const tmpPath = path + ".tmp";
       await writeFile4(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
       await rename3(tmpPath, path);
@@ -1540,7 +1604,7 @@ var auditService = new AuditService();
 
 // ../server/src/services/project-path-store.ts
 import { readFile as readFile5, writeFile as writeFile5, rename as rename5, mkdir as mkdir5, chmod as chmod4, stat as stat2 } from "fs/promises";
-import { isAbsolute, join as join4, resolve } from "path";
+import { isAbsolute, join as join5, resolve } from "path";
 var FILENAME3 = "project-paths.json";
 var ProjectPathStore = class {
   paths = null;
@@ -1610,7 +1674,7 @@ function isPathMap(value) {
 async function holdsRuneyaProject(path) {
   for (const candidate of ["project.json", "projects.json"]) {
     try {
-      await stat2(join4(path, ".runeya", candidate));
+      await stat2(join5(path, ".runeya", candidate));
       return true;
     } catch {
     }
@@ -1896,27 +1960,61 @@ import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/settings-manager.ts
 import { readFile as readFile6, writeFile as writeFile6, rename as rename6, mkdir as mkdir6, chmod as chmod5 } from "fs/promises";
+import { join as join6 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 var SCHEMA_VERSION_FILE = "schema-version.json";
 var CURRENT_SCHEMA_VERSION = 4;
 var SettingsManager = class {
-  settings = null;
-  settingsPrivate = null;
+  settings = /* @__PURE__ */ new Map();
+  settingsPrivate = /* @__PURE__ */ new Map();
   schemaVersion = null;
-  async ensureDir() {
-    await mkdir6(machineRoot(), { recursive: true });
+  /**
+   * Le coffre visé, sous forme de racine sur le disque.
+   *
+   * Sans organisation, la racine machine — pas le répertoire de lancement. Ce
+   * n'est pas un reste de l'ancien monde : y écrire forcerait un `.runeya` à
+   * exister chez quelqu'un qui ne travaille que sur des projets cloud, ce que
+   * les coffres ont justement supprimé (et ce qu'un test garde).
+   */
+  rootOf(vault) {
+    return vault ? orgVaultRoot(vault) : machineRoot();
   }
-  async atomicWrite(filename, data) {
-    await this.ensureDir();
-    const filePath = machineFilePath(filename);
+  cacheKey(vault) {
+    return vault ?? "";
+  }
+  async atomicWrite(filename, data, vault) {
+    const root = this.rootOf(vault);
+    await mkdir6(root, { recursive: true });
+    const filePath = join6(root, filename);
     const tmpPath = filePath + ".tmp";
     await writeFile6(tmpPath, JSON.stringify(data, null, 2), "utf-8");
     await rename6(tmpPath, filePath);
     await chmod5(filePath, 384);
   }
-  /** Read the machine file, falling back to the launch directory of old. */
-  async readJson(filename) {
+  /**
+   * Lire le fichier de CE coffre, et rien d'autre.
+   *
+   * Pas de repli sur un autre emplacement : un réglage lu ailleurs que là où il
+   * est écrit fait deux vérités pour un même fait, et l'accord entre les deux
+   * devient une chose de plus à tenir. Ce que les versions précédentes ont
+   * écrit ailleurs est déplacé une fois pour toutes par
+   * `migrateSettingsIntoVaults`, pas relu indéfiniment.
+   */
+  async readJson(filename, vault) {
+    try {
+      return JSON.parse(await readFile6(join6(this.rootOf(vault), filename), "utf-8"));
+    } catch {
+      return null;
+    }
+  }
+  /** Vide les caches — après un déplacement de fichiers sous nos pieds. */
+  forget() {
+    this.settings.clear();
+    this.settingsPrivate.clear();
+  }
+  /** Un fichier qui appartient au poste, pas à un coffre. */
+  async readMachineJson(filename) {
     for (const path of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
       try {
         return JSON.parse(await readFile6(path, "utf-8"));
@@ -1925,43 +2023,53 @@ var SettingsManager = class {
     }
     return null;
   }
-  async getSettings() {
-    if (!this.settings) {
-      const raw = await this.readJson(SETTINGS_FILE);
+  async getSettings(vault) {
+    const key = this.cacheKey(vault);
+    let current = this.settings.get(key);
+    if (!current) {
+      const raw = await this.readJson(SETTINGS_FILE, vault);
       const parsed = raw ? SettingsSchema.safeParse(raw) : null;
       if (parsed?.success) {
-        this.settings = parsed.data;
+        current = parsed.data;
+        this.settings.set(key, current);
       } else {
-        this.settings = SettingsSchema.parse({ mode: env.MODE, cloudUrl: env.CLOUD_URL ?? null });
-        await this.saveSettings(this.settings);
+        current = SettingsSchema.parse({ mode: env.MODE, cloudUrl: env.CLOUD_URL ?? null });
+        await this.saveSettings(current, vault);
       }
     }
-    return this.settings;
+    return current;
   }
-  async saveSettings(settings) {
-    this.settings = settings;
-    await this.atomicWrite(SETTINGS_FILE, settings);
+  async saveSettings(settings, vault) {
+    this.settings.set(this.cacheKey(vault), settings);
+    await this.atomicWrite(SETTINGS_FILE, settings, vault);
   }
-  async getPrivateSettings() {
-    if (!this.settingsPrivate) {
-      const raw = await this.readJson(SETTINGS_PRIVATE_FILE);
+  async getPrivateSettings(vault) {
+    const key = this.cacheKey(vault);
+    let current = this.settingsPrivate.get(key);
+    if (!current) {
+      const raw = await this.readJson(SETTINGS_PRIVATE_FILE, vault);
       const parsed = raw ? SettingsPrivateSchema.safeParse(raw) : null;
       if (parsed?.success) {
-        this.settingsPrivate = parsed.data;
+        current = parsed.data;
+        this.settingsPrivate.set(key, current);
       } else {
-        this.settingsPrivate = SettingsPrivateSchema.parse({});
-        await this.savePrivateSettings(this.settingsPrivate);
+        current = SettingsPrivateSchema.parse({});
+        await this.savePrivateSettings(current, vault);
       }
     }
-    return this.settingsPrivate;
+    return current;
   }
-  async savePrivateSettings(settings) {
-    this.settingsPrivate = settings;
-    await this.atomicWrite(SETTINGS_PRIVATE_FILE, settings);
+  async savePrivateSettings(settings, vault) {
+    this.settingsPrivate.set(this.cacheKey(vault), settings);
+    await this.atomicWrite(SETTINGS_PRIVATE_FILE, settings, vault);
   }
+  /**
+   * La version de schéma reste au niveau machine, et ce n'est pas un oubli :
+   * elle ne configure rien, elle date les migrations des données de ce poste.
+   */
   async getSchemaVersion() {
     if (!this.schemaVersion) {
-      const raw = await this.readJson(SCHEMA_VERSION_FILE);
+      const raw = await this.readMachineJson(SCHEMA_VERSION_FILE);
       const parsed = raw ? SchemaVersionSchema.safeParse(raw) : null;
       if (parsed?.success) {
         this.schemaVersion = parsed.data;
@@ -1974,7 +2082,12 @@ var SettingsManager = class {
   }
   async saveSchemaVersion(sv) {
     this.schemaVersion = sv;
-    await this.atomicWrite(SCHEMA_VERSION_FILE, sv);
+    await mkdir6(machineRoot(), { recursive: true });
+    const filePath = machineFilePath(SCHEMA_VERSION_FILE);
+    const tmpPath = filePath + ".tmp";
+    await writeFile6(tmpPath, JSON.stringify(sv, null, 2), "utf-8");
+    await rename6(tmpPath, filePath);
+    await chmod5(filePath, 384);
   }
   getCurrentSchemaVersion() {
     return CURRENT_SCHEMA_VERSION;
@@ -1986,7 +2099,7 @@ var settingsManager = new SettingsManager();
 import { isAbsolute as isAbsolute3 } from "path";
 
 // ../server/src/services/workspace-cwd.ts
-import { isAbsolute as isAbsolute2, join as join5, dirname as dirname3 } from "path";
+import { isAbsolute as isAbsolute2, join as join7, dirname as dirname3 } from "path";
 async function projectRoot(ref) {
   const project = await projectStore.get(ref);
   if (!project?.orgId) return null;
@@ -2014,7 +2127,7 @@ async function resolveWorkspaceCwd(target) {
 function anchor(base, raw) {
   if (!raw || raw === ".") return base;
   if (raw.startsWith("~") || raw.startsWith("$") || isAbsolute2(raw)) return raw;
-  return join5(base, raw);
+  return join7(base, raw);
 }
 function localVaultRootParent() {
   return dirname3(localVaultRoot());
@@ -2272,13 +2385,13 @@ var serviceRouter = router({
       remote: service.git?.remote,
       checkReachability: input.checkReachability
     });
-    const { exists: exists2, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
+    const { exists: exists4, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
     if (unresolvedVars.length > 0) {
       return { exists: false, canClone: false, unresolvedVars, resolvedCwd, gitMismatch: null };
     }
-    const canClone = !!service.git?.remote && (!exists2 || actualRemote === null);
+    const canClone = !!service.git?.remote && (!exists4 || actualRemote === null);
     let gitMismatch = null;
-    if (exists2 && service.git?.remote && !canClone) {
+    if (exists4 && service.git?.remote && !canClone) {
       if (actualRemote === null) {
         gitMismatch = { actual: null, configured: service.git.remote };
       } else if (actualRemote !== service.git.remote) {
@@ -2287,7 +2400,7 @@ var serviceRouter = router({
         gitMismatch = { actual: actualRemote, configured: service.git.remote, unreachable: true };
       }
     }
-    return { exists: exists2, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
+    return { exists: exists4, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
   cloneRepository: protectedProcedure.input(z3.object({ id: z3.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
@@ -2376,10 +2489,18 @@ var agentRouter = router({
     z4.object({
       name: z4.string().min(1).max(100),
       url: z4.string().url().max(2048),
-      passphrase: z4.string().min(1).max(1024)
+      passphrase: z4.string().min(1).max(1024),
+      // À quelle organisation rattacher l'agent. Absent = la machine, ce que
+      // font l'agent local et tout client antérieur à ce champ.
+      orgId: z4.string().min(1).max(128).nullable().optional()
     })
   ).mutation(async ({ input }) => {
-    const config = await agentManager.register(input.name, input.url, input.passphrase);
+    const config = await agentManager.register(
+      input.name,
+      input.url,
+      input.passphrase,
+      input.orgId ?? null
+    );
     return { ...config, passphrase: "***" };
   }),
   /** Update an existing agent */
@@ -3120,11 +3241,29 @@ var environmentRouter = router({
 import { promises as dns } from "dns";
 import { z as z9 } from "zod";
 import { TRPCError as TRPCError7 } from "@trpc/server";
+
+// ../server/src/services/settings-scope.ts
+async function vaultOfProject(projectId) {
+  if (!projectId) return void 0;
+  await ensureProjectsLoaded();
+  const refs = refsOfProjectId(projectId);
+  if (refs.length !== 1) return void 0;
+  return refs[0]?.orgId ?? void 0;
+}
+
+// ../server/src/trpc/routers/settings.ts
 var NotificationPreferencesPatchSchema = NotificationPreferencesSchema.partial().strict();
 function maskApiKey2(plaintext) {
   if (plaintext.length <= 8) return "****";
   return plaintext.slice(0, 4) + "****" + plaintext.slice(-4);
 }
+var ScopeShape = {
+  orgId: z9.string().max(128).nullable().optional(),
+  projectId: z9.string().max(128).optional()
+};
+async function scopeOf(input) {
+  return input?.orgId ?? await vaultOfProject(input?.projectId);
+}
 var settingsRouter = router({
   /**
    * Get all settings
@@ -3162,15 +3301,16 @@ var settingsRouter = router({
   /**
    * Get notification preferences
    */
-  getNotificationPreferences: protectedProcedure.query(async () => {
-    const priv = await settingsManager.getPrivateSettings();
+  getNotificationPreferences: protectedProcedure.input(z9.object(ScopeShape).optional()).query(async ({ input }) => {
+    const priv = await settingsManager.getPrivateSettings(await scopeOf(input));
     return NotificationPreferencesSchema.parse(priv.notifications ?? {});
   }),
   /**
    * Update notification preferences (granular mute)
    */
-  updateNotificationPreferences: protectedProcedure.input(NotificationPreferencesPatchSchema).mutation(async ({ input }) => {
-    const priv = await settingsManager.getPrivateSettings();
+  updateNotificationPreferences: protectedProcedure.input(NotificationPreferencesPatchSchema.extend(ScopeShape)).mutation(async ({ input }) => {
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     const currentPrefs = NotificationPreferencesSchema.parse(priv.notifications ?? {});
     const updatedPrefs = {
       ...currentPrefs,
@@ -3179,7 +3319,7 @@ var settingsRouter = router({
     await settingsManager.savePrivateSettings({
       ...priv,
       notifications: updatedPrefs
-    });
+    }, vault);
     return updatedPrefs;
   }),
   /**
@@ -3290,13 +3430,14 @@ var settingsRouter = router({
   /**
    * List AI providers (API keys are masked)
    */
-  listAIProviders: protectedProcedure.query(async () => {
-    const priv = await settingsManager.getPrivateSettings();
+  listAIProviders: protectedProcedure.input(z9.object(ScopeShape).optional()).query(async ({ input }) => {
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     return (priv.aiProviders ?? []).map((p) => {
       let maskedKey = "(aucune)";
       if (p.encryptedApiKey) {
         try {
-          maskedKey = maskApiKey2(decryptValue(p.encryptedApiKey));
+          maskedKey = maskApiKey2(decryptValue(p.encryptedApiKey, vault));
         } catch {
           maskedKey = "(cl\xE9 invalide)";
         }
@@ -3312,12 +3453,14 @@ var settingsRouter = router({
     provider: AIProviderSchema.shape.provider,
     apiKey: z9.string().max(500).optional(),
     // optional for providers like Ollama
-    model: z9.string().max(200).optional()
+    model: z9.string().max(200).optional(),
+    ...ScopeShape
   })).mutation(async ({ input }) => {
     if (input.provider !== "ollama" && !input.apiKey?.trim()) {
       throw new TRPCError7({ code: "BAD_REQUEST", message: "Une cl\xE9 API est requise pour ce provider." });
     }
-    const priv = await settingsManager.getPrivateSettings();
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     const id = `aiprovider-${Date.now()}-${Math.random().toString(36).slice(2, 7)}`;
     const now = /* @__PURE__ */ new Date();
     const plainKey = input.apiKey ?? "";
@@ -3325,7 +3468,9 @@ var settingsRouter = router({
       id,
       name: input.name,
       provider: input.provider,
-      encryptedApiKey: plainKey ? encryptValue(plainKey) : "",
+      // Chiffrée par la clé de l'organisation : c'est ce qui permet de
+      // partager le fournisseur qu'elle paie sans partager la clé du poste.
+      encryptedApiKey: plainKey ? encryptValue(plainKey, vault) : "",
       model: input.model,
       active: (priv.aiProviders ?? []).length === 0,
       // first one is active by default
@@ -3335,7 +3480,7 @@ var settingsRouter = router({
     await settingsManager.savePrivateSettings({
       ...priv,
       aiProviders: [...priv.aiProviders ?? [], newProvider]
-    });
+    }, vault);
     return { ...newProvider, maskedKey: plainKey ? maskApiKey2(plainKey) : "(aucune)", encryptedApiKey: void 0 };
   }),
   /**
@@ -3346,14 +3491,16 @@ var settingsRouter = router({
     name: z9.string().min(1).max(200).optional(),
     provider: AIProviderSchema.shape.provider.optional(),
     apiKey: z9.string().min(1).max(500).optional(),
-    model: z9.string().max(200).optional()
+    model: z9.string().max(200).optional(),
+    ...ScopeShape
   })).mutation(async ({ input }) => {
-    const priv = await settingsManager.getPrivateSettings();
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const idx = providers.findIndex((p) => p.id === input.id);
     if (idx === -1) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const existing = providers[idx];
-    const encryptedApiKey = input.apiKey ? stableEncryptValue(input.apiKey, existing.encryptedApiKey) : existing.encryptedApiKey;
+    const encryptedApiKey = input.apiKey ? stableEncryptValue(input.apiKey, existing.encryptedApiKey, vault) : existing.encryptedApiKey;
     const updated = {
       ...existing,
       ...input.name ? { name: input.name } : {},
@@ -3364,11 +3511,11 @@ var settingsRouter = router({
     };
     const newProviders = [...providers];
     newProviders[idx] = updated;
-    await settingsManager.savePrivateSettings({ ...priv, aiProviders: newProviders });
+    await settingsManager.savePrivateSettings({ ...priv, aiProviders: newProviders }, vault);
     let maskedKey = "(aucune)";
     if (updated.encryptedApiKey) {
       try {
-        maskedKey = maskApiKey2(decryptValue(updated.encryptedApiKey));
+        maskedKey = maskApiKey2(decryptValue(updated.encryptedApiKey, vault));
       } catch {
       }
     }
@@ -3377,26 +3524,28 @@ var settingsRouter = router({
   /**
    * Delete AI provider
    */
-  deleteAIProvider: protectedProcedure.input(z9.object({ id: z9.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const priv = await settingsManager.getPrivateSettings();
+  deleteAIProvider: protectedProcedure.input(z9.object({ id: z9.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const filtered = providers.filter((p) => p.id !== input.id);
     if (filtered.length === providers.length) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const deletedWasActive = providers.find((p) => p.id === input.id)?.active ?? false;
     if (deletedWasActive && filtered.length > 0) filtered[0].active = true;
-    await settingsManager.savePrivateSettings({ ...priv, aiProviders: filtered });
+    await settingsManager.savePrivateSettings({ ...priv, aiProviders: filtered }, vault);
     return { deleted: true };
   }),
   /**
    * Set one provider as active (clears active flag on all others)
    */
-  setActiveAIProvider: protectedProcedure.input(z9.object({ id: z9.string().min(1).max(128) })).mutation(async ({ input }) => {
-    const priv = await settingsManager.getPrivateSettings();
+  setActiveAIProvider: protectedProcedure.input(z9.object({ id: z9.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+    const vault = await scopeOf(input);
+    const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
     const idx = providers.findIndex((p) => p.id === input.id);
     if (idx === -1) throw new TRPCError7({ code: "NOT_FOUND", message: `AI provider not found: ${input.id}` });
     const updated = providers.map((p) => ({ ...p, active: p.id === input.id }));
-    await settingsManager.savePrivateSettings({ ...priv, aiProviders: updated });
+    await settingsManager.savePrivateSettings({ ...priv, aiProviders: updated }, vault);
     return { id: input.id, active: true };
   }),
   // ---------------------------------------------------------------------------
@@ -3693,15 +3842,15 @@ import { z as z11 } from "zod";
 import { TRPCError as TRPCError8 } from "@trpc/server";
 import { execFile as execFile2, spawn } from "child_process";
 import { stat as stat3 } from "fs/promises";
-import { resolve as resolve2, join as join7 } from "path";
+import { resolve as resolve2, join as join9 } from "path";
 import { homedir as homedir2 } from "os";
 
 // ../server/src/services/user-config-manager.ts
 import { readFile as readFile7, writeFile as writeFile7, rename as rename7, mkdir as mkdir7, chmod as chmod6 } from "fs/promises";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 import { homedir } from "os";
 import { z as z10 } from "zod";
-var CONFIG_DIR = join6(homedir(), ".runeya");
+var CONFIG_DIR = join8(homedir(), ".runeya");
 var CONFIG_FILE = "runeya.conf";
 var EditorPreferencesSchema = z10.object({
   default: z10.string().max(64).optional()
@@ -3725,7 +3874,7 @@ var UserConfigManager = class {
   }
   async atomicWrite(data) {
     await this.ensureDir();
-    const filePath = join6(CONFIG_DIR, CONFIG_FILE);
+    const filePath = join8(CONFIG_DIR, CONFIG_FILE);
     const tmpPath = filePath + ".tmp";
     await writeFile7(tmpPath, JSON.stringify(data, null, 2), "utf-8");
     await rename7(tmpPath, filePath);
@@ -3734,7 +3883,7 @@ var UserConfigManager = class {
   async getConfig() {
     if (!this.config) {
       try {
-        const raw = await readFile7(join6(CONFIG_DIR, CONFIG_FILE), "utf-8");
+        const raw = await readFile7(join8(CONFIG_DIR, CONFIG_FILE), "utf-8");
         const parsed = UserConfigSchema.safeParse(JSON.parse(raw));
         this.config = parsed.success ? parsed.data : {};
       } catch {
@@ -3887,7 +4036,7 @@ var editorRouter = router({
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const cwd = await getServiceCwd(input.serviceId);
-    const filePath = join7(cwd, input.relativePath);
+    const filePath = join9(cwd, input.relativePath);
     if (!filePath.startsWith(cwd)) {
       throw new TRPCError8({ code: "BAD_REQUEST", message: "Path traversal not allowed" });
     }
@@ -3911,7 +4060,7 @@ var editorRouter = router({
 import { z as z12 } from "zod";
 import { TRPCError as TRPCError9 } from "@trpc/server";
 import { mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
-import { join as join8, dirname as dirname4 } from "path";
+import { join as join10, dirname as dirname4 } from "path";
 var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
   ".claude/skills/runeya/SKILL.md",
   ".cursor/rules/runeya.mdc",
@@ -3924,8 +4073,8 @@ var KeyInputSchema = z12.object({
 });
 var apiKeysRouter = router({
   list: protectedProcedure.query(() => apiKeyStore.list()),
-  create: protectedProcedure.input(KeyInputSchema).mutation(
-    ({ input }) => apiKeyStore.create(input.name, input.scopes, input.isPublic)
+  create: protectedProcedure.input(KeyInputSchema.extend({ orgId: z12.string().min(1).max(128).nullable().optional() })).mutation(
+    ({ input }) => apiKeyStore.create(input.name, input.scopes, input.isPublic, input.orgId ?? null)
   ),
   /**
    * Renvoie le secret d'une seule clé, sur demande explicite. `list` ne le
@@ -3958,7 +4107,7 @@ var apiKeysRouter = router({
     if (!ALLOWED_SKILL_PATHS.has(input.relativePath)) {
       throw new TRPCError9({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
     }
-    const abs = join8(await resolveWorkspaceCwd({}), input.relativePath);
+    const abs = join10(await resolveWorkspaceCwd({}), input.relativePath);
     await mkdir8(dirname4(abs), { recursive: true });
     await writeFile8(abs, input.content, { encoding: "utf-8", mode: 420 });
     return { path: input.relativePath };
@@ -4289,12 +4438,12 @@ function buildApiDocs(apiBaseUrl, apiToken) {
 import { readdir as readdir2, access, readFile as readFile9 } from "fs/promises";
 import { watch } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 
 // ../server/src/services/conversation-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { readFile as readFile8, writeFile as writeFile9, rename as rename8, mkdir as mkdir9, chmod as chmod7 } from "fs/promises";
-import { dirname as dirname5, join as join9 } from "path";
+import { dirname as dirname5, join as join11 } from "path";
 import { EventEmitter as EventEmitter2 } from "events";
 var FILENAME4 = "conversations.private.json";
 async function localProjectId() {
@@ -4338,19 +4487,19 @@ var ConversationStore = class {
   async ensureDir() {
     await mkdir9(dirname5(await this.getFilePath()), { recursive: true });
   }
-  encryptMessages(messages) {
-    return encryptValue(JSON.stringify(messages));
+  encryptMessages(messages, vault) {
+    return encryptValue(JSON.stringify(messages), vault);
   }
-  decryptMessages(encrypted) {
-    const json = decryptValue(encrypted);
+  decryptMessages(encrypted, vault) {
+    const json = decryptValue(encrypted, vault);
     return JSON.parse(json);
   }
-  toDisk(conv) {
+  toDisk(conv, vault) {
     return {
       id: conv.id,
       projectId: conv.projectId,
       title: conv.title,
-      encryptedMessages: this.encryptMessages(conv.messages),
+      encryptedMessages: this.encryptMessages(conv.messages, vault),
       isCli: conv.isCli,
       runner: conv.runner,
       providerId: conv.providerId,
@@ -4365,13 +4514,13 @@ var ConversationStore = class {
       updatedAt: conv.updatedAt
     };
   }
-  fromDisk(disk) {
+  fromDisk(disk, vault) {
     const workflowType = (disk.workflowType === "scenario" ? "scenario" : void 0) ?? (disk.scenarioId ? "scenario" : void 0);
     return {
       id: disk.id,
       projectId: disk.projectId,
       title: disk.title,
-      messages: this.decryptMessages(disk.encryptedMessages),
+      messages: this.decryptMessages(disk.encryptedMessages, vault),
       isCli: disk.isCli ?? disk.isClaudeCode ?? false,
       runner: disk.runner,
       providerId: disk.providerId,
@@ -4405,7 +4554,7 @@ var ConversationStore = class {
     const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME4)];
     const sources = [
       ...legacyPaths.map((path) => ({ path, legacy: true })),
-      ...vaults.map((root) => ({ path: join9(root, FILENAME4), legacy: false }))
+      ...vaults.map((root) => ({ path: join11(root, FILENAME4), legacy: false }))
     ];
     for (const { path, legacy } of sources) {
       let data;
@@ -4417,7 +4566,7 @@ var ConversationStore = class {
       const inherited = legacy ? await localProjectId() : null;
       for (const item of data) {
         try {
-          const conv = this.fromDisk(item);
+          const conv = this.fromDisk(item, vaultIdOfRoot(dirname5(path)));
           if (!conv.projectId && inherited) conv.projectId = inherited;
           this.conversations.set(item.id, conv);
           this.roots.set(item.id, dirname5(path));
@@ -4441,12 +4590,12 @@ var ConversationStore = class {
       const root = await this.rootFor(conv);
       this.roots.set(conv.id, root);
       const bucket = byRoot.get(root) ?? [];
-      bucket.push(this.toDisk(conv));
+      bucket.push(this.toDisk(conv, vaultIdOfRoot(root)));
       byRoot.set(root, bucket);
     }
     for (const [root, data] of byRoot) {
       await mkdir9(root, { recursive: true });
-      const filePath = join9(root, FILENAME4);
+      const filePath = join11(root, FILENAME4);
       const tmpPath = `${filePath}.tmp`;
       await writeFile9(tmpPath, JSON.stringify(data, null, 2), "utf-8");
       await rename8(tmpPath, filePath);
@@ -4477,6 +4626,16 @@ var ConversationStore = class {
     const ref = refOfProjectAmong(conv.projectId, known);
     return { id: ref.id, orgId: ref.orgId ?? null };
   }
+  /**
+   * Réécrire chaque coffre, en déplaçant ce qui appartient désormais ailleurs.
+   *
+   * Appelé quand un projet a changé de coffre : ses conversations sont écrites
+   * dans le nouveau, et le fichier d'où elles viennent est réécrit sans elles.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
+  }
   async save() {
     const write = this.saveQueue.then(() => this.saveInternal());
     this.saveQueue = write.catch(() => {
@@ -4487,6 +4646,39 @@ var ConversationStore = class {
     await this.load();
     return Array.from(this.conversations.values()).sort((a, b) => b.updatedAt - a.updatedAt);
   }
+  /**
+   * Les conversations d'un projet.
+   *
+   * Celle qui ne nomme aucun projet — écrite avant le champ, ou qu'une
+   * migration n'a pas su attribuer — n'est rendue que dans les projets de son
+   * propre coffre : elle reste atteignable là où elle a été écrite, sans se
+   * déverser dans toutes les organisations de la machine.
+   */
+  async listForProject(ref) {
+    const belongs = await this.matcherForProject(ref);
+    return (await this.list()).filter(belongs);
+  }
+  /**
+   * Le test d'appartenance à un projet, préparé une fois.
+   *
+   * Le flux temps réel en a besoin autant que la liste : une conversation qui
+   * arrive par événement doit passer le même filtre, sans quoi elle se
+   * réinvite dans un projet qui ne l'a jamais demandée.
+   */
+  async matcherForProject(ref) {
+    await this.load();
+    let projectRoot2 = null;
+    try {
+      projectRoot2 = ref.orgId === void 0 ? rootOfProjectAmong(ref.id, null) : rootOfProjectRef({ id: ref.id, orgId: ref.orgId ?? null });
+    } catch {
+      projectRoot2 = null;
+    }
+    return (conv) => {
+      if (conv.projectId) return conv.projectId === ref.id;
+      if (!projectRoot2) return true;
+      return this.roots.get(conv.id) === projectRoot2;
+    };
+  }
   async get(id) {
     await this.load();
     return this.conversations.get(id) ?? null;
@@ -4575,7 +4767,7 @@ var ConversationStore = class {
 var conversationStore = new ConversationStore();
 
 // ../server/src/services/claude-transcript-sync.ts
-var PROJECTS_DIR = join10(homedir3(), ".claude", "projects");
+var PROJECTS_DIR = join12(homedir3(), ".claude", "projects");
 var DEFAULT_TITLES = /* @__PURE__ */ new Set(["", "New conversation", "Nouvelle conversation"]);
 async function findClaudeSessionFile(sessionId) {
   let entries;
@@ -4586,7 +4778,7 @@ async function findClaudeSessionFile(sessionId) {
   }
   const filename = `${sessionId}.jsonl`;
   for (const dir of entries) {
-    const candidate = join10(PROJECTS_DIR, dir, filename);
+    const candidate = join12(PROJECTS_DIR, dir, filename);
     try {
       await access(candidate);
       return candidate;
@@ -4749,7 +4941,7 @@ async function startClaudeTranscriptWatcher() {
   }
   for (const dir of topLevel) {
     try {
-      const w = watch(join10(PROJECTS_DIR, dir), (_event, filename) => {
+      const w = watch(join12(PROJECTS_DIR, dir), (_event, filename) => {
         handleFsEvent(filename ? filename.toString() : null);
       });
       w.on("error", () => {
@@ -4775,8 +4967,8 @@ function stopClaudeTranscriptWatcher() {
 // ../server/src/services/codex-sessions.ts
 import { readdir as readdir3 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join11 } from "path";
-var SESSIONS_DIR = join11(homedir4(), ".codex", "sessions");
+import { join as join13 } from "path";
+var SESSIONS_DIR = join13(homedir4(), ".codex", "sessions");
 async function findCodexSessionFile(sessionId) {
   const suffix = `-${sessionId}.jsonl`;
   async function walk(dir) {
@@ -4787,7 +4979,7 @@ async function findCodexSessionFile(sessionId) {
       return null;
     }
     for (const entry of entries) {
-      const full = join11(dir, entry.name);
+      const full = join13(dir, entry.name);
       if (entry.isDirectory()) {
         const found = await walk(full);
         if (found) return found;
@@ -5607,34 +5799,34 @@ function normalizeNode(raw) {
   };
 }
 var ScenarioStore = class {
-  async list() {
+  async list(vault) {
     const [settings, priv] = await Promise.all([
-      settingsManager.getSettings(),
-      settingsManager.getPrivateSettings()
+      settingsManager.getSettings(vault),
+      settingsManager.getPrivateSettings(vault)
     ]);
     return [...settings.scenarios ?? [], ...priv.scenarios ?? []];
   }
-  async get(id) {
-    const list = await this.list();
+  async get(id, vault) {
+    const list = await this.list(vault);
     return list.find((e) => e.id === id) ?? null;
   }
-  async create(scenario) {
+  async create(scenario, vault) {
     const normalized = this.normalizeScenario(scenario);
     const parsed = ScenarioSchema.parse(normalized);
     this.validateHierarchy(parsed);
     if (parsed.isPublished) {
-      const settings = await settingsManager.getSettings();
-      await settingsManager.saveSettings({ ...settings, scenarios: [...settings.scenarios ?? [], parsed] });
+      const settings = await settingsManager.getSettings(vault);
+      await settingsManager.saveSettings({ ...settings, scenarios: [...settings.scenarios ?? [], parsed] }, vault);
     } else {
-      const priv = await settingsManager.getPrivateSettings();
-      await settingsManager.savePrivateSettings({ ...priv, scenarios: [...priv.scenarios ?? [], parsed] });
+      const priv = await settingsManager.getPrivateSettings(vault);
+      await settingsManager.savePrivateSettings({ ...priv, scenarios: [...priv.scenarios ?? [], parsed] }, vault);
     }
     return parsed;
   }
-  async update(id, patch) {
+  async update(id, patch, vault) {
     const [settings, priv] = await Promise.all([
-      settingsManager.getSettings(),
-      settingsManager.getPrivateSettings()
+      settingsManager.getSettings(vault),
+      settingsManager.getPrivateSettings(vault)
     ]);
     const publicScenarios = [...settings.scenarios ?? []];
     const privateScenarios = [...priv.scenarios ?? []];
@@ -5650,29 +5842,29 @@ var ScenarioStore = class {
     const isNowPublic = parsed.isPublished;
     if (wasPublic && isNowPublic) {
       publicScenarios[publicIdx] = parsed;
-      await settingsManager.saveSettings({ ...settings, scenarios: publicScenarios });
+      await settingsManager.saveSettings({ ...settings, scenarios: publicScenarios }, vault);
     } else if (!wasPublic && !isNowPublic) {
       privateScenarios[privateIdx] = parsed;
-      await settingsManager.savePrivateSettings({ ...priv, scenarios: privateScenarios });
+      await settingsManager.savePrivateSettings({ ...priv, scenarios: privateScenarios }, vault);
     } else if (wasPublic && !isNowPublic) {
       publicScenarios.splice(publicIdx, 1);
       await Promise.all([
-        settingsManager.saveSettings({ ...settings, scenarios: publicScenarios }),
-        settingsManager.savePrivateSettings({ ...priv, scenarios: [...privateScenarios, parsed] })
+        settingsManager.saveSettings({ ...settings, scenarios: publicScenarios }, vault),
+        settingsManager.savePrivateSettings({ ...priv, scenarios: [...privateScenarios, parsed] }, vault)
       ]);
     } else {
       privateScenarios.splice(privateIdx, 1);
       await Promise.all([
-        settingsManager.savePrivateSettings({ ...priv, scenarios: privateScenarios }),
-        settingsManager.saveSettings({ ...settings, scenarios: [...publicScenarios, parsed] })
+        settingsManager.savePrivateSettings({ ...priv, scenarios: privateScenarios }, vault),
+        settingsManager.saveSettings({ ...settings, scenarios: [...publicScenarios, parsed] }, vault)
       ]);
     }
     return parsed;
   }
-  async delete(id) {
+  async delete(id, vault) {
     const [settings, priv] = await Promise.all([
-      settingsManager.getSettings(),
-      settingsManager.getPrivateSettings()
+      settingsManager.getSettings(vault),
+      settingsManager.getPrivateSettings(vault)
     ]);
     const publicFiltered = (settings.scenarios ?? []).filter((e) => e.id !== id);
     const privateFiltered = (priv.scenarios ?? []).filter((e) => e.id !== id);
@@ -5680,8 +5872,8 @@ var ScenarioStore = class {
     const removedFromPrivate = privateFiltered.length < (priv.scenarios ?? []).length;
     if (!removedFromPublic && !removedFromPrivate) return false;
     await Promise.all([
-      removedFromPublic ? settingsManager.saveSettings({ ...settings, scenarios: publicFiltered }) : Promise.resolve(),
-      removedFromPrivate ? settingsManager.savePrivateSettings({ ...priv, scenarios: privateFiltered }) : Promise.resolve()
+      removedFromPublic ? settingsManager.saveSettings({ ...settings, scenarios: publicFiltered }, vault) : Promise.resolve(),
+      removedFromPrivate ? settingsManager.savePrivateSettings({ ...priv, scenarios: privateFiltered }, vault) : Promise.resolve()
     ]);
     return true;
   }
@@ -5748,7 +5940,7 @@ var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
 import { mkdir as mkdir11, rm as rm2, readFile as readFile11 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 
 // ../server/src/services/run-store-utils.ts
 import { chmod as chmod8, mkdir as mkdir10, rename as rename9, writeFile as writeFile10, readFile as readFile10 } from "fs/promises";
@@ -5825,8 +6017,8 @@ var ScenarioRunStore = class _ScenarioRunStore {
       "- Use read-only references from linked upstream files as context.",
       ""
     ].join("\n");
-    await atomicWriteSecure(join12(dir, "README.md"), overview);
-    await atomicWriteSecure(join12(dir, "USER_REQUEST.md"), `# User request
+    await atomicWriteSecure(join14(dir, "README.md"), overview);
+    await atomicWriteSecure(join14(dir, "USER_REQUEST.md"), `# User request
 
 ${userInput.trim() || "(empty)"}
 `);
@@ -5852,7 +6044,7 @@ ${userInput.trim() || "(empty)"}
         "- Waiting for assignment.",
         ""
       ].join("\n");
-      await atomicWriteSecure(join12(dir, fileName), content);
+      await atomicWriteSecure(join14(dir, fileName), content);
     }
   }
   async deleteRunDir(conversationId) {
@@ -5920,18 +6112,18 @@ ${userInput.trim() || "(empty)"}
         ...Object.keys(runState.nodeAgentIds).length > 0 ? { nodeAgentIds: { ...runState.nodeAgentIds } } : {},
         ...Object.keys(runState.waitingInputs).length > 0 ? { waitingInputs: { ...runState.waitingInputs } } : {}
       };
-      await atomicWriteJsonSecure(join12(dir, "run-state.json"), data);
+      await atomicWriteJsonSecure(join14(dir, "run-state.json"), data);
     } catch {
     }
   }
   async loadPersistedRunState(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join12(dir, "run-state.json"));
+    return readJsonFileSafe(join14(dir, "run-state.json"));
   }
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile11(join12(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile11(join14(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -5940,7 +6132,7 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile11(join12(dir, "README.md"), "utf-8");
+      return await readFile11(join14(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
@@ -5949,14 +6141,14 @@ ${userInput.trim() || "(empty)"}
     const dir = this.getRunDir(conversationId);
     await mkdir11(dir, { recursive: true });
     await atomicWriteJsonSecure(
-      join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
+      join14(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
       true
     );
   }
   async loadScenarioSnapshot(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
+    return readJsonFileSafe(join14(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
   }
 };
 var scenarioRunStore = new ScenarioRunStore();
@@ -5977,12 +6169,12 @@ var DEFAULT_MODELS = {
   mistral: "mistral-large-latest",
   ollama: "llama3"
 };
-async function getActiveProvider(providerId) {
-  const priv = await settingsManager.getPrivateSettings();
+async function getActiveProvider(providerId, vault) {
+  const priv = await settingsManager.getPrivateSettings(vault);
   const providers = priv.aiProviders ?? [];
   const selected = providerId ? providers.find((p) => p.id === providerId) : providers.find((p) => p.active);
   if (!selected) return null;
-  const plaintextKey = selected.encryptedApiKey ? decryptValue(selected.encryptedApiKey) : "";
+  const plaintextKey = selected.encryptedApiKey ? decryptValue(selected.encryptedApiKey, vault) : "";
   return { provider: selected, plaintextKey };
 }
 async function fetchProviderModels(provider, plaintextKey) {
@@ -6004,7 +6196,7 @@ async function fetchProviderModels(provider, plaintextKey) {
 import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir12, writeFile as writeFile11, readFile as readFile12, unlink as unlink2, readdir as readdir4 } from "fs/promises";
 import { existsSync } from "fs";
-import { join as join13, extname, resolve as resolve4, sep as sep2 } from "path";
+import { join as join15, extname, resolve as resolve4, sep as sep2 } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/jpeg",
@@ -6041,7 +6233,7 @@ var ImageStorageService = class {
     const imageId = randomUUID4();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
-    const filePath = join13(this.dir, fileName);
+    const filePath = join15(this.dir, fileName);
     const resolvedPath = resolve4(filePath);
     const resolvedDir = resolve4(this.dir);
     if (resolvedPath !== resolvedDir && !resolvedPath.startsWith(resolvedDir + sep2)) {
@@ -6067,7 +6259,7 @@ var ImageStorageService = class {
       const files = await readdir4(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile12(join13(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile12(join15(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -6093,7 +6285,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile12(join13(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile12(join15(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -6123,7 +6315,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile12(join13(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile12(join15(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -7002,7 +7194,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KX5MSTAK.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-RGDHYM64.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -7655,7 +7847,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KX5MSTAK.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-RGDHYM64.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -8516,12 +8708,24 @@ async function conversationCwd(conv) {
 }
 var chatRouter = router({
   conversations: router({
-    onChanged: protectedProcedure.subscription(async function* () {
-      const initial = await conversationStore.list();
+    /**
+     * Le flux des conversations du projet ouvert.
+     *
+     * Filtré comme `list` : l'instantané initial remplace la liste du client,
+     * et sans le même filtre il y reversait toutes les conversations de la
+     * machine, une seconde après un chargement pourtant filtré.
+     */
+    onChanged: protectedProcedure.input(z15.object({
+      projectId: Id128Schema.optional(),
+      orgId: Id128Schema.nullable().optional()
+    }).optional()).subscription(async function* ({ input }) {
+      const belongs = input?.projectId ? await conversationStore.matcherForProject({ id: input.projectId, orgId: input.orgId }) : () => true;
+      const initial = (await conversationStore.list()).filter(belongs);
       yield { type: "initial", conversations: initial };
       const queue = [];
       let resolve7 = null;
       const handler = (event) => {
+        if (event.type !== "deleted" && !belongs(event.conversation)) return;
         if (queue.length >= 500) queue.shift();
         queue.push(event);
         if (resolve7) {
@@ -8550,13 +8754,17 @@ var chatRouter = router({
      * A conversation belongs to the project it was opened from, so the caller
      * says which one it is looking at. Ones that name no project — written
      * before the field existed, or that a migration could not attribute — are
-     * returned whatever the project: hiding them would make them unreachable.
+     * returned only for the projects of the vault they were read from: still
+     * reachable where they were written, without leaking into every other
+     * organization's projects.
      */
-    list: protectedProcedure.input(z15.object({ projectId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
-      const all = await conversationStore.list();
+    list: protectedProcedure.input(z15.object({
+      projectId: Id128Schema.optional(),
+      orgId: Id128Schema.nullable().optional()
+    }).optional()).query(async ({ input }) => {
       const projectId = input?.projectId;
-      if (!projectId) return all;
-      return all.filter((c) => !c.projectId || c.projectId === projectId);
+      if (!projectId) return conversationStore.list();
+      return conversationStore.listForProject({ id: projectId, orgId: input?.orgId });
     }),
     get: protectedProcedure.input(z15.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
@@ -8579,7 +8787,10 @@ var chatRouter = router({
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
-        scenario = await scenarioStore.get(input.scenarioId);
+        scenario = await scenarioStore.get(
+          input.scenarioId,
+          input.orgId ?? await vaultOfProject(input.projectId)
+        );
         if (!scenario) throw new TRPCError11({ code: "NOT_FOUND", message: "Scenario not found" });
       }
       const conv = await conversationStore.create(
@@ -8644,8 +8855,17 @@ var chatRouter = router({
       return conv;
     })
   }),
-  listModels: protectedProcedure.input(z15.object({ providerId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
-    const active = await getActiveProvider(input?.providerId);
+  listModels: protectedProcedure.input(z15.object({
+    providerId: Id128Schema.optional(),
+    // Le projet dit de quelle organisation lire les fournisseurs ; absent,
+    // ce sont ceux du poste.
+    projectId: Id128Schema.optional(),
+    orgId: z15.string().max(128).nullable().optional()
+  }).optional()).query(async ({ input }) => {
+    const active = await getActiveProvider(
+      input?.providerId,
+      input?.orgId ?? await vaultOfProject(input?.projectId)
+    );
     if (!active) return [];
     try {
       return await fetchProviderModels(active.provider, active.plaintextKey);
@@ -8674,9 +8894,14 @@ var chatRouter = router({
   enhanceScenarioPrompt: protectedProcedure.input(z15.object({
     text: z15.string().max(1e4),
     providerId: Id128Schema.optional(),
-    model: z15.string().max(200).optional()
+    model: z15.string().max(200).optional(),
+    projectId: Id128Schema.optional(),
+    orgId: z15.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
-    const active = await getActiveProvider(input.providerId);
+    const active = await getActiveProvider(
+      input.providerId,
+      input.orgId ?? await vaultOfProject(input.projectId)
+    );
     if (!active) throw new TRPCError11({ code: "BAD_REQUEST", message: "No AI provider configured" });
     const systemPrompt = `You are an expert at writing clear, concise user request briefs for AI-powered workflows.
 When given a rough user request, rewrite it to be:
@@ -8970,7 +9195,8 @@ ${input.prompt}` : input.prompt;
       throw new TRPCError11({ code: "BAD_REQUEST", message: "Messages are required for new messages" });
     }
     const conv = await conversationStore.get(input.conversationId);
-    const active = await getActiveProvider(conv?.providerId);
+    const convRef = conv ? await conversationStore.projectRefOf(conv) : null;
+    const active = await getActiveProvider(conv?.providerId, convRef?.orgId ?? void 0);
     if (!active) {
       throw new TRPCError11({
         code: "PRECONDITION_FAILED",
@@ -9603,7 +9829,10 @@ var gitRouter = router({
     if (!diff.trim()) {
       throw new TRPCError12({ code: "BAD_REQUEST", message: "No staged changes to generate a commit message from" });
     }
-    const active = await getActiveProvider(input.providerId);
+    const active = await getActiveProvider(
+      input.providerId,
+      input.orgId ?? await vaultOfProject(input.projectId)
+    );
     if (!active) {
       throw new TRPCError12({ code: "BAD_REQUEST", message: "No AI provider configured" });
     }
@@ -9820,7 +10049,7 @@ async function* streamProviderText(input) {
 
 // ../server/src/trpc/ai-generation-procedure-utils.ts
 async function* streamWithActiveProvider(opts) {
-  const active = await getActiveProvider(opts.providerId);
+  const active = await getActiveProvider(opts.providerId, opts.vault);
   if (!active) throw new TRPCError14({ code: "BAD_REQUEST", message: "Aucun fournisseur IA configur\xE9" });
   const { provider, plaintextKey } = active;
   const model = opts.model || provider.model || DEFAULT_MODELS[provider.provider] || "";
@@ -9848,7 +10077,7 @@ async function* streamWithActiveProvider(opts) {
 // ../server/src/services/scenario-runner.ts
 import { mkdir as mkdir14 } from "fs/promises";
 import { randomUUID as randomUUID7 } from "crypto";
-import { join as join14 } from "path";
+import { join as join16 } from "path";
 
 // ../server/src/services/scenario-presets.ts
 var BUILT_IN_PRESETS = [
@@ -10626,7 +10855,7 @@ async function appendNodeOutput(conversationId, node, output) {
   if (!dir) return;
   const slug = node.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 60) || "member";
   const safeId = node.id.replace(/[^a-z0-9_-]/gi, "-").slice(0, 80);
-  const filePath = join14(dir, `${slug}_${safeId}.md`);
+  const filePath = join16(dir, `${slug}_${safeId}.md`);
   const content = `## Output
 
 ${output}
@@ -10641,7 +10870,7 @@ async function appendToReadme(conversationId, bus, text) {
   try {
     await mkdir14(dir, { recursive: true });
     const { appendFile: appendFile2 } = await import("fs/promises");
-    await appendFile2(join14(dir, "README.md"), line, "utf-8");
+    await appendFile2(join16(dir, "README.md"), line, "utf-8");
   } catch {
   }
   publishToBus(bus, { type: "readme_append", text: line });
@@ -10661,7 +10890,7 @@ async function writeFinalMd(conversationId, bus, userRequest, content) {
 
 ${content}
 `;
-  const filePath = join14(dir, "FINAL.md");
+  const filePath = join16(dir, "FINAL.md");
   await atomicWriteSecure(filePath, fullContent);
   await appendToReadme(
     conversationId,
@@ -10719,7 +10948,7 @@ async function runScenario(conversationId, scenarioId, userRequest, runOverrides
       };
       var isSubtreeComplete = isSubtreeComplete2;
       const scenario = await (async () => {
-        const base = await scenarioRunStore.loadScenarioSnapshot(conversationId) ?? await scenarioStore.get(scenarioId);
+        const base = await scenarioRunStore.loadScenarioSnapshot(conversationId) ?? await scenarioStore.get(scenarioId, runOverrides?.orgId ?? void 0);
         if (!base) throw new Error(`Scenario ${scenarioId} not found`);
         return applyRunOverridesToScenario(base, runOverrides);
       })();
@@ -11328,9 +11557,19 @@ Modify the scenario. Keep existing ids when possible.`;
   }
   return `Generate an scenario org-chart based on: ${userPrompt}`;
 }
+var ScopeShape2 = {
+  orgId: z17.string().max(128).nullable().optional(),
+  projectId: Id128Schema.optional()
+};
+async function scopeOf2(input) {
+  return input?.orgId ?? await vaultOfProject(input?.projectId);
+}
 var scenarioRouter = router({
-  list: protectedProcedure.query(() => scenarioStore.list()),
-  get: protectedProcedure.input(z17.object({ id: Id128Schema })).query(({ input }) => getOrNotFound(() => scenarioStore.get(input.id), "Scenario not found")),
+  list: protectedProcedure.input(z17.object(ScopeShape2).optional()).query(async ({ input }) => scenarioStore.list(await scopeOf2(input))),
+  get: protectedProcedure.input(z17.object({ id: Id128Schema, ...ScopeShape2 })).query(async ({ input }) => getOrNotFound(
+    async () => scenarioStore.get(input.id, await scopeOf2(input)),
+    "Scenario not found"
+  )),
   create: protectedProcedure.input(z17.object({
     name: NameSchema,
     icon: z17.string().max(64).optional(),
@@ -11340,10 +11579,11 @@ var scenarioRouter = router({
     nodes: z17.array(ScenarioNodeSchema).min(1).max(500),
     traversalMode: z17.enum(["hierarchical", "topological"]).optional(),
     presetId: z17.string().max(128).optional(),
-    isPublished: z17.boolean().optional()
+    isPublished: z17.boolean().optional(),
+    ...ScopeShape2
   })).mutation(({ input }) => {
     const now = Date.now();
-    return createOrBadRequest(() => scenarioStore.create({
+    return createOrBadRequest(async () => scenarioStore.create({
       id: randomUUID8(),
       name: input.name,
       icon: input.icon,
@@ -11368,9 +11608,10 @@ var scenarioRouter = router({
     nodes: z17.array(ScenarioNodeSchema).min(1).max(500).optional(),
     traversalMode: z17.enum(["hierarchical", "topological"]).optional(),
     presetId: z17.string().max(128).optional(),
-    isPublished: z17.boolean().optional()
+    isPublished: z17.boolean().optional(),
+    ...ScopeShape2
   })).mutation(({ input }) => updateOrThrow(
-    () => scenarioStore.update(input.id, {
+    async () => scenarioStore.update(input.id, {
       name: input.name,
       icon: input.icon,
       description: input.description,
@@ -11381,10 +11622,13 @@ var scenarioRouter = router({
       presetId: input.presetId,
       isPublished: input.isPublished,
       updatedAt: Date.now()
-    }),
+    }, await scopeOf2(input)),
+    "Scenario not found"
+  )),
+  delete: protectedProcedure.input(z17.object({ id: Id128Schema, ...ScopeShape2 })).mutation(({ input }) => deleteOrNotFound(
+    async () => scenarioStore.delete(input.id, await scopeOf2(input)),
     "Scenario not found"
   )),
-  delete: protectedProcedure.input(z17.object({ id: Id128Schema })).mutation(({ input }) => deleteOrNotFound(() => scenarioStore.delete(input.id), "Scenario not found")),
   run: protectedProcedure.input(z17.object({
     conversationId: ConversationIdSchema,
     scenarioId: Id128Schema,
@@ -11398,7 +11642,7 @@ var scenarioRouter = router({
     orgId: z17.string().max(128).nullable().optional(),
     resume: z17.boolean().optional()
   })).subscription(async function* ({ input, signal }) {
-    const scenario = await scenarioStore.get(input.scenarioId);
+    const scenario = await scenarioStore.get(input.scenarioId, await scopeOf2(input));
     if (!scenario) throw new TRPCError15({ code: "NOT_FOUND", message: "Scenario not found" });
     const canStart = input.userRequest.trim().length > 0 || !!input.resume;
     if (!isScenarioRunning(input.conversationId) && canStart) {
@@ -11718,11 +11962,14 @@ var KanbanQueueService = class extends EventEmitter4 {
       item.scenarioId ? "scenario" : void 0,
       item.runner,
       item.boardId,
-      item.cardId
+      item.cardId,
+      void 0,
+      item.projectId,
+      item.orgId
     );
     const cardContent = card.title + (card.markdown ? "\n\n" + card.markdown : "");
     if (item.scenarioId) {
-      const scenario = await scenarioStore.get(item.scenarioId);
+      const scenario = await scenarioStore.get(item.scenarioId, item.orgId ?? void 0);
       if (scenario) {
         await scenarioRunStore.initializeConversationWorkspace(conv.id, scenario, cardContent);
       }
@@ -11795,14 +12042,21 @@ var kanbanQueueRouter = router({
     cardId: z19.string().max(128),
     runner: z19.enum(["claude-code", "codex"]).optional(),
     model: z19.string().max(128).optional(),
-    scenarioId: z19.string().max(128).optional()
+    scenarioId: z19.string().max(128).optional(),
+    // Le projet ouvert quand la carte a été mise en file : la conversation
+    // qui en naîtra lui appartient, plutôt que de rester orpheline et de
+    // s'afficher dans tous les projets.
+    projectId: z19.string().max(128).optional(),
+    orgId: z19.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
   addColumn: protectedProcedure.input(z19.object({
     boardId: z19.string().max(128),
     columnId: z19.string().max(128),
     runner: z19.enum(["claude-code", "codex"]).optional(),
     model: z19.string().max(128).optional(),
-    scenarioId: z19.string().max(128).optional()
+    scenarioId: z19.string().max(128).optional(),
+    projectId: z19.string().max(128).optional(),
+    orgId: z19.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
@@ -11849,7 +12103,7 @@ var kanbanQueueRouter = router({
 import { mkdir as mkdir15, readdir as readdir5, rm as rm3, stat as stat4, writeFile as writeFile13 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 import { z as z20 } from "zod";
 import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
@@ -11900,14 +12154,14 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join15(tmpdir(), "runeya-kanban-attachments");
+  return join17(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
     for (const name of await readdir5(dir)) {
-      const path = join15(dir, name);
+      const path = join17(dir, name);
       const info = await stat4(path).catch(() => null);
       if (info && info.mtimeMs < cutoff) await rm3(path, { force: true });
     }
@@ -11915,14 +12169,14 @@ async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join15(machineRoot(), "kanban-attachments")];
+  return [attachmentCacheDir(), join17(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
       await mkdir15(dir, { recursive: true });
-      const path = join15(dir, safeLocalName(id, name));
+      const path = join17(dir, safeLocalName(id, name));
       await writeFile13(path, body);
       void purgeStaleAttachments(dir);
       return path;
@@ -12242,7 +12496,7 @@ var utilityRouter = router({
 import { z as z23 } from "zod";
 import { TRPCError as TRPCError19 } from "@trpc/server";
 import { readFile as readFile14, readdir as readdir6, stat as stat5, realpath, writeFile as writeFile14, mkdir as mkdir16, rename as rename11, rm as rm4 } from "fs/promises";
-import { resolve as resolvePath, join as join16, relative, sep as sep3, dirname as dirname8 } from "path";
+import { resolve as resolvePath, join as join18, relative, sep as sep3, dirname as dirname8 } from "path";
 var SCOPE_SCHEMA = z23.union([
   z23.literal("global"),
   z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
@@ -12312,7 +12566,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join16(dir, e.name);
+    const abs = join18(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -12478,29 +12732,10 @@ var configRouter = router({
 import { z as z24 } from "zod";
 import { TRPCError as TRPCError20 } from "@trpc/server";
 
-// ../server/src/services/org-sync-scope.ts
-import { access as access2 } from "fs/promises";
-import { join as join17 } from "path";
-async function isMaterialized(root) {
-  return access2(join17(root, "project.json")).then(() => true, () => false);
-}
-async function orgsToSync() {
-  const cloudUrl = getCloudApiUrl();
-  const stamps = await readOrgClouds();
-  const orgIds = /* @__PURE__ */ new Set();
-  for (const vault of await listCloudVaults()) {
-    if (orgIds.has(vault.orgId)) continue;
-    const stamped = stamps[vault.orgId];
-    if (stamped && stamped.replace(/\/+$/, "") !== cloudUrl) continue;
-    if (await isMaterialized(vault.root)) orgIds.add(vault.orgId);
-  }
-  return Array.from(orgIds, (orgId) => ({ orgId, cloudUrl }));
-}
-
 // ../server/src/services/master-password.ts
 import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
 import { readFile as readFile15, writeFile as writeFile15, chmod as chmod10, stat as stat6, rename as rename12 } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
 var KEYRING_SERVICE = "runeya";
@@ -12533,7 +12768,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join19(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -12541,7 +12776,7 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join18(dataDir, PEPPER_FILENAME);
+  const filePath = join19(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
   await writeFile15(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod10(tmpPath, 384);
@@ -12585,26 +12820,26 @@ async function deriveKey(masterPassword, pepper, salt) {
   });
   return Buffer.from(derived);
 }
-async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
-  const pepper = await getOrCreatePepper(dataDir);
+async function writeEncryptedKey(dataDir, masterPassword, encryptionKey, pepperDir = dataDir) {
+  const pepper = await getOrCreatePepper(pepperDir);
   const salt = randomBytes4(16);
   const derivedKey = await deriveKey(masterPassword, pepper, salt);
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
   await writeFile15(tmpPath, encoded, "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
-async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
+async function readEncryptedKey(dataDir, masterPassword, pepperDir = dataDir) {
+  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
   const payload = fileContent.subarray(16);
-  const pepper = await getPepperFromKeychain(dataDir);
+  const pepper = await getPepperFromKeychain(pepperDir);
   const derivedKey = await deriveKey(masterPassword, pepper, salt);
   return aesDecrypt(derivedKey, payload);
 }
@@ -12619,13 +12854,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
   await writeFile15(tmpPath, payload.toString("base64"), "utf-8");
   await rename12(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join18(dataDir, VERIFY_FILENAME);
+  const filePath = join19(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
     throw new Error("Cl\xE9 d'encryption incorrecte");
@@ -12641,14 +12876,14 @@ function matchesCanary(canaryBase64, encryptionKey) {
 }
 async function readVerifyFile(dataDir) {
   try {
-    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+    return (await readKeyFile(join19(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
   } catch {
     return null;
   }
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat6(join18(dataDir, VERIFY_FILENAME));
+    await stat6(join19(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -12656,13 +12891,32 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat6(join18(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat6(join19(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
   }
 }
 
+// ../server/src/services/org-sync-scope.ts
+import { access as access2 } from "fs/promises";
+import { join as join20 } from "path";
+async function isMaterialized(root) {
+  return access2(join20(root, "project.json")).then(() => true, () => false);
+}
+async function orgsToSync() {
+  const cloudUrl = getCloudApiUrl();
+  const stamps = await readOrgClouds();
+  const orgIds = /* @__PURE__ */ new Set();
+  for (const vault of await listCloudVaults()) {
+    if (orgIds.has(vault.orgId)) continue;
+    const stamped = stamps[vault.orgId];
+    if (stamped && stamped.replace(/\/+$/, "") !== cloudUrl) continue;
+    if (await isMaterialized(vault.root)) orgIds.add(vault.orgId);
+  }
+  return Array.from(orgIds, (orgId) => ({ orgId, cloudUrl }));
+}
+
 // ../server/src/services/org-canary.ts
 var CanaryUnavailableError = class extends Error {
   code = "CANARY_UNAVAILABLE";
@@ -12681,9 +12935,9 @@ var OrgKeyMismatchError = class extends Error {
   }
 };
 async function reconcileOrgCanary(orgId) {
-  const key = getEncryptionKey();
-  if (!key) throw new CanaryUnavailableError("Encryption key not loaded.");
-  const local = await readVerifyFile(await keyRoot());
+  const key = getEncryptionKey(orgId);
+  if (!key) throw new CanaryUnavailableError("Cl\xE9 de l'organisation non charg\xE9e.");
+  const local = await readVerifyFile(orgVaultRoot(orgId)) ?? await readVerifyFile(await keyRoot());
   if (!local) throw new CanaryUnavailableError("This machine has no key canary yet.");
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
@@ -12707,10 +12961,10 @@ import * as Y from "yjs";
 // ../server/src/services/org-lock.ts
 import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir17 } from "fs/promises";
 import { readFileSync, unlinkSync } from "fs";
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 var held = /* @__PURE__ */ new Set();
 function lockPath(orgId) {
-  return join19(orgVaultRoot(orgId), "org.lock");
+  return join21(orgVaultRoot(orgId), "org.lock");
 }
 function isRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -13225,11 +13479,11 @@ var OrgSyncConnection = class {
   }
   async upsertLocally(name, id, fields) {
     if (name === "services") {
-      await serviceStore.applyRemoteUpsert(id, fields);
+      await serviceStore.applyRemoteUpsert(id, fields, this.link.orgId);
       return;
     }
     if (name === "environments") {
-      await environmentStore.applyRemoteUpsert(id, fields);
+      await environmentStore.applyRemoteUpsert(id, fields, this.link.orgId);
       return;
     }
     const result = await projectStore.applyRemoteUpsert(id, {
@@ -13350,6 +13604,14 @@ var CloudSyncBridge = class {
   connections = /* @__PURE__ */ new Map();
   /** Orgs another instance holds the lock on — reported, not retried blindly. */
   locked = /* @__PURE__ */ new Set();
+  /**
+   * Orgs whose key this machine does not have.
+   *
+   * Held here for the same reason as `locked`: the connection is never opened,
+   * so there is nothing to ask for its state — and an org that cannot sync
+   * until a human supplies a key must not read as merely "stopped".
+   */
+  keyMismatch = /* @__PURE__ */ new Set();
   started = false;
   /**
    * Start syncing every organization this machine holds a project of.
@@ -13369,7 +13631,13 @@ var CloudSyncBridge = class {
       return;
     }
     for (const link of links) await this.connect(link);
-    if (links.length > 0) console.log(`[cloud-sync] syncing ${links.length} organization(s)`);
+    const connected = this.connections.size;
+    if (links.length > 0) {
+      const skipped = links.length - connected;
+      console.log(
+        `[cloud-sync] syncing ${connected}/${links.length} organization(s)` + (skipped > 0 ? ` \u2014 ${skipped} not syncing (see the errors above)` : "")
+      );
+    }
   }
   /**
    * Reconnect every link whose session had been rejected. Called after a cloud
@@ -13379,6 +13647,26 @@ var CloudSyncBridge = class {
     const paused = Array.from(this.connections.values()).filter((c) => c.getState() === "unauthenticated").map((c) => c.getLink());
     for (const link of paused) await this.connect(link);
   }
+  /**
+   * Tout reconnecter, quel que soit l'état où chaque organisation s'était
+   * arrêtée.
+   *
+   * `resumeAll` ne reprend que les sessions rejetées ; après un changement de
+   * clé, ce sont justement les organisations écartées pour clé différente qu'il
+   * faut retenter — et elles n'ont pas de connexion à reprendre, seulement un
+   * lien sur le disque.
+   */
+  async restartAll() {
+    this.keyMismatch.clear();
+    let links = [];
+    try {
+      links = await orgsToSync();
+    } catch (err) {
+      console.error("[cloud-sync] could not read which organizations to sync:", err.message);
+      return;
+    }
+    for (const link of links) await this.connect(link);
+  }
   /** Per-org sync state, for the UI. */
   states() {
     const live = Array.from(this.connections.entries()).map(([orgId, conn]) => ({
@@ -13387,7 +13675,8 @@ var CloudSyncBridge = class {
       lastIncompatibleVersion: conn.getLastIncompatibleVersion()
     }));
     const locked = Array.from(this.locked).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({ orgId, state: "locked", lastIncompatibleVersion: null }));
-    return [...live, ...locked];
+    const mismatched = Array.from(this.keyMismatch).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({ orgId, state: "key-mismatch", lastIncompatibleVersion: null }));
+    return [...live, ...locked, ...mismatched];
   }
   /**
    * Follow one project of an org on this machine, pulling it now.
@@ -13421,6 +13710,7 @@ var CloudSyncBridge = class {
     } catch (err) {
       if (err instanceof OrgKeyMismatchError) {
         console.error("[cloud-sync] org %s: %s", link.orgId, err.message);
+        this.keyMismatch.add(link.orgId);
         return;
       }
       console.warn(
@@ -13429,6 +13719,7 @@ var CloudSyncBridge = class {
         err.message
       );
     }
+    this.keyMismatch.delete(link.orgId);
     const lock = await acquireOrgLock(link.orgId).catch((err) => {
       console.error("[cloud-sync] could not take the lock for org %s:", link.orgId, err.message);
       return { acquired: false, heldBy: 0 };
@@ -13463,11 +13754,185 @@ var CloudSyncBridge = class {
     for (const conn of this.connections.values()) conn.stop();
     this.connections.clear();
     this.locked.clear();
+    this.keyMismatch.clear();
     releaseAllOrgLocksSync();
   }
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
+// ../server/src/services/key-adoption.ts
+import { readdir as readdir7, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir20, copyFile, rename as rename13, stat as stat7 } from "fs/promises";
+import { join as join22 } from "path";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes5 } from "crypto";
+
+// ../server/src/services/org-keys.ts
+import { mkdir as mkdir19 } from "fs/promises";
+async function unlockOrgKeys(masterPassword) {
+  const machineKey = getEncryptionKey();
+  const report = { opened: [], seeded: [], locked: [] };
+  if (!machineKey) return report;
+  for (const orgId of await listOrgVaults()) {
+    const root = orgVaultRoot(orgId);
+    if (!masterPassword) {
+      setEncryptionKeyInMemory(machineKey, orgId);
+      continue;
+    }
+    const canary = await readVerifyFile(root);
+    if (canary) {
+      try {
+        const key = await readEncryptedKey(root, masterPassword, await keyRoot());
+        if (!matchesCanary(canary, key)) {
+          markVaultLocked(orgId);
+          report.locked.push(orgId);
+          continue;
+        }
+        setEncryptionKeyInMemory(key, orgId);
+        report.opened.push(orgId);
+      } catch {
+        markVaultLocked(orgId);
+        report.locked.push(orgId);
+      }
+      continue;
+    }
+    await mkdir19(root, { recursive: true });
+    await writeEncryptedKey(root, masterPassword, machineKey, await keyRoot());
+    await writeVerifyFile(root, machineKey);
+    setEncryptionKeyInMemory(machineKey, orgId);
+    report.seeded.push(orgId);
+  }
+  return report;
+}
+async function installOrgKey(orgId, key, masterPassword) {
+  const root = orgVaultRoot(orgId);
+  await mkdir19(root, { recursive: true });
+  const pepperDir = await keyRoot();
+  await writeEncryptedKey(root, masterPassword, key, pepperDir);
+  const readBack = await readEncryptedKey(root, masterPassword, pepperDir);
+  if (!readBack.equals(key)) {
+    throw new Error("V\xE9rification du fichier de cl\xE9 de l'organisation \xE9chou\xE9e.");
+  }
+  await writeVerifyFile(root, key);
+  setEncryptionKeyInMemory(key, orgId);
+}
+
+// ../server/src/services/key-adoption.ts
+var ALGORITHM = "aes-256-gcm";
+function isAgentTriplet(value) {
+  const hex = (v) => typeof v === "string" && /^[0-9a-f]+$/i.test(v);
+  return hex(value["encrypted"]) && hex(value["iv"]) && hex(value["authTag"]);
+}
+function decryptTriplet(key, t2) {
+  const decipher = createDecipheriv2(ALGORITHM, key, Buffer.from(t2.iv, "hex"), { authTagLength: 16 });
+  decipher.setAuthTag(Buffer.from(t2.authTag, "hex"));
+  return decipher.update(t2.encrypted, "hex", "utf-8") + decipher.final("utf-8");
+}
+function encryptTriplet(key, plaintext) {
+  const iv = randomBytes5(16);
+  const cipher = createCipheriv2(ALGORITHM, key, iv);
+  const encrypted = cipher.update(plaintext, "utf-8", "hex") + cipher.final("hex");
+  return { encrypted, iv: iv.toString("hex"), authTag: cipher.getAuthTag().toString("hex") };
+}
+function rekeyJsonValue(value, from, to, counter) {
+  if (typeof value === "string") {
+    if (!isEncryptedValue(value)) return value;
+    let plaintext;
+    try {
+      plaintext = decryptValueWith(from, value);
+    } catch {
+      return value;
+    }
+    counter.n += 1;
+    return encryptValueWith(to, plaintext);
+  }
+  if (Array.isArray(value)) return value.map((v) => rekeyJsonValue(v, from, to, counter));
+  if (value && typeof value === "object") {
+    const record = value;
+    if (isAgentTriplet(record)) {
+      try {
+        const plaintext = decryptTriplet(from, record);
+        counter.n += 1;
+        return { ...record, ...encryptTriplet(to, plaintext) };
+      } catch {
+        return record;
+      }
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(record)) out[k] = rekeyJsonValue(v, from, to, counter);
+    return out;
+  }
+  return value;
+}
+async function rootsOfOrg(orgId) {
+  const roots = /* @__PURE__ */ new Set([orgVaultRoot(orgId)]);
+  for (const vault of await listCloudVaults()) {
+    if (vault.orgId === orgId) roots.add(vault.root);
+  }
+  return Array.from(roots);
+}
+async function jsonFilesIn(root) {
+  try {
+    const entries = await readdir7(root, { withFileTypes: true });
+    return entries.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+async function exists(path) {
+  return stat7(path).then(() => true, () => false);
+}
+async function adoptOrgKey(orgId, newKey, masterPassword, now) {
+  const currentKey = getEncryptionKey(orgId);
+  if (!currentKey) {
+    throw new Error("La cl\xE9 actuelle de cette organisation n'est pas charg\xE9e.");
+  }
+  if (newKey.equals(currentKey)) {
+    throw new Error("Cette cl\xE9 est d\xE9j\xE0 celle de l'organisation.");
+  }
+  const machineRootDir = await keyRoot();
+  await readEncryptedKey(machineRootDir, masterPassword);
+  const pending = [];
+  const touchedRoots = /* @__PURE__ */ new Set();
+  for (const vaultRoot of await rootsOfOrg(orgId)) {
+    for (const name of await jsonFilesIn(vaultRoot)) {
+      const path = join22(vaultRoot, name);
+      let parsed;
+      try {
+        parsed = JSON.parse(await readFile17(path, "utf-8"));
+      } catch {
+        continue;
+      }
+      const counter = { n: 0 };
+      const converted = rekeyJsonValue(parsed, currentKey, newKey, counter);
+      if (counter.n === 0) continue;
+      pending.push({ path, content: JSON.stringify(converted, null, 2), values: counter.n });
+      touchedRoots.add(vaultRoot);
+    }
+  }
+  const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
+  const backups = [];
+  for (const vaultRoot of touchedRoots) {
+    const backupDir = join22(vaultRoot, `backup-key-${stamp}`);
+    await mkdir20(backupDir, { recursive: true });
+    for (const name of await jsonFilesIn(vaultRoot)) {
+      await copyFile(join22(vaultRoot, name), join22(backupDir, name));
+    }
+    for (const name of [".encryption.key.enc", ".runeya-verify"]) {
+      if (await exists(join22(vaultRoot, name))) {
+        await copyFile(join22(vaultRoot, name), join22(backupDir, name));
+      }
+    }
+    backups.push(backupDir);
+  }
+  for (const item of pending) {
+    const tmp = item.path + ".tmp";
+    await writeFile16(tmp, item.content, "utf-8");
+    await rename13(tmp, item.path);
+  }
+  await installOrgKey(orgId, newKey, masterPassword);
+  clearVaultLock(orgId);
+  return { converted: pending.map(({ path, values }) => ({ file: path, values })), backups };
+}
+
 // ../server/src/trpc/routers/cloud-sync.ts
 async function cloudMessage(res) {
   try {
@@ -13530,6 +13995,134 @@ var cloudSyncRouter = router({
       throw err;
     }
   }),
+  /**
+   * Faire passer le projet local de cette machine dans une organisation.
+   *
+   * Le projet n'est pas copié : il déménage. Son coffre quitte
+   * `<cwd>/.runeya` pour celui de l'organisation, en gardant son identifiant,
+   * puis il est suivi comme n'importe quel projet cloud — la réconciliation le
+   * pousse alors dans le doc, services et environnements compris.
+   *
+   * Le déménagement est ce qui rend le geste sûr : il ne peut jamais y avoir
+   * deux copies du même projet, donc rien à écraser. Un projet que
+   * l'organisation porte déjà sous le même identifiant est refusé plutôt que
+   * fusionné.
+   */
+  publishProject: protectedProcedure.input(
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      cloudUrl: z24.string().url().max(2048),
+      projectId: z24.string().min(1).max(128)
+    })
+  ).mutation(async ({ input }) => {
+    const local = await projectStore.get({ id: input.projectId, orgId: null });
+    if (!local) {
+      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
+    }
+    if (await projectStore.get({ id: input.projectId, orgId: input.orgId })) {
+      throw new TRPCError20({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
+    }
+    const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
+    if (!connected) {
+      await assertOrgKey(input.orgId);
+      await stampOrgCloud(input.orgId, input.cloudUrl);
+      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+    }
+    await projectStore.moveToOrg(input.projectId, input.orgId);
+    await conversationStore.relocateAll();
+    try {
+      await cloudSyncBridge.followProject(input.orgId, input.projectId);
+    } catch (err) {
+      if (err instanceof ProjectHeldElsewhereError) {
+        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
+      }
+      throw err;
+    }
+    return { state: syncState(input.orgId) };
+  }),
+  /**
+   * Cette clé est-elle celle de l'organisation ? Rien n'est écrit.
+   *
+   * L'étape à faire avant tout le reste : on ne re-chiffre pas une machine
+   * entière sur une clé dont on n'a pas la preuve qu'elle ouvre le canari
+   * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
+   * les yeux — donc le canari est rapatrié et jugé ici.
+   */
+  checkOrgKey: protectedProcedure.input(z24.object({
+    orgId: z24.string().min(1).max(128),
+    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i)
+  })).query(async ({ input }) => {
+    const res = await cloudFetch2(
+      `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
+      { method: "GET" }
+    );
+    if (!res.ok) {
+      throw new TRPCError20({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
+    }
+    const { canary } = await res.json();
+    if (typeof canary !== "string") return { matches: false, published: false };
+    return { matches: matchesCanary(canary, Buffer.from(input.keyHex, "hex")), published: true };
+  }),
+  /**
+   * Faire adopter à cette machine la clé d'une organisation.
+   *
+   * Le pendant de `resetOrgKey` : là où celle-ci fait plier l'organisation à la
+   * clé d'ici, celle-là fait plier cette machine à la sienne — et c'est la
+   * seule des deux qui rend lisible ce qui avait déjà été chiffré sous elle.
+   *
+   * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
+   * organisations et la machine gardent leur clé.
+   */
+  adoptOrgKey: protectedProcedure.input(z24.object({
+    orgId: z24.string().min(1).max(128),
+    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z24.string().min(1).max(1024)
+  })).mutation(async ({ input }) => {
+    const report = await adoptOrgKey(
+      input.orgId,
+      Buffer.from(input.keyHex, "hex"),
+      input.masterPassword,
+      /* @__PURE__ */ new Date()
+    );
+    await cloudSyncBridge.restartAll();
+    return { converted: report.converted.length, backups: report.backups, state: syncState(input.orgId) };
+  }),
+  /**
+   * Réinitialiser la clé de référence d'une organisation avec celle de cette
+   * machine, puis relancer sa synchronisation.
+   *
+   * Le canari publié par le cloud est write-once : c'est ce qui empêche un
+   * membre tenant la mauvaise clé d'enfermer les autres dehors. Le revers, c'est
+   * qu'une clé machine qui change — réinstallation, `~/.runeya` perdu, migration
+   * d'un ancien coffre — laisse l'organisation insynchronisable pour toujours.
+   * Cette route est la sortie de secours, réservée au propriétaire côté cloud.
+   *
+   * Elle ne re-chiffre rien : ce qui a déjà été synchronisé sous l'ancienne clé
+   * reste illisible. L'interface le dit avant de la déclencher.
+   */
+  resetOrgKey: protectedProcedure.input(z24.object({ orgId: z24.string().min(1).max(128) })).mutation(async ({ input }) => {
+    const canary = await readVerifyFile(await keyRoot());
+    if (!canary) {
+      throw new TRPCError20({
+        code: "PRECONDITION_FAILED",
+        message: "Cette machine n'a pas encore de cl\xE9 de chiffrement."
+      });
+    }
+    const res = await cloudFetch2("/api/auth/organization/canary/reset", {
+      method: "POST",
+      body: { organizationId: input.orgId, canary }
+    });
+    if (!res.ok) {
+      const detail = await cloudMessage(res);
+      throw new TRPCError20({
+        code: res.status === 403 ? "FORBIDDEN" : "BAD_GATEWAY",
+        message: detail || `ORG_KEY_RESET_FAILED (${res.status})`
+      });
+    }
+    const cloudUrl = (await orgsToSync()).find((l) => l.orgId === input.orgId)?.cloudUrl ?? getCloudApiUrl();
+    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl });
+    return { state: syncState(input.orgId) };
+  }),
   /**
    * Stop materializing one project of an org on this machine.
    *
@@ -13621,15 +14214,15 @@ var cloudSyncRouter = router({
 });
 
 // ../server/src/trpc/routers/filesystem.ts
-import { readdir as readdir7, stat as stat7 } from "fs/promises";
+import { readdir as readdir8, stat as stat8 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute4, join as join20, resolve as resolve5, dirname as dirname9, basename as basename2 } from "path";
+import { isAbsolute as isAbsolute4, join as join23, resolve as resolve5, dirname as dirname9, basename as basename2 } from "path";
 import { z as z25 } from "zod";
 var MAX_ENTRIES = 500;
 var PATH_SCHEMA = z25.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join20(homedir5(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join23(homedir5(), input.slice(1)) : input;
   if (!isAbsolute4(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve5(expanded);
 }
@@ -13652,20 +14245,20 @@ var filesystemRouter = router({
    */
   listDirectories: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
-    const info = await stat7(dir).catch(() => null);
+    const info = await stat8(dir).catch(() => null);
     if (!info?.isDirectory()) {
       throw new Error(`Ce n'est pas un r\xE9pertoire : ${dir}`);
     }
     let names;
     try {
-      names = (await readdir7(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+      names = (await readdir8(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
     } catch {
       throw new Error(`R\xE9pertoire illisible : ${dir}`);
     }
     const truncated = names.length > MAX_ENTRIES;
     const entries = [];
     for (const name of names.slice(0, MAX_ENTRIES)) {
-      const path = join20(dir, name);
+      const path = join23(dir, name);
       entries.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
@@ -13690,7 +14283,7 @@ var filesystemRouter = router({
     orgId: z25.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
-    const info = await stat7(dir).catch(() => null);
+    const info = await stat8(dir).catch(() => null);
     if (!info?.isDirectory()) {
       return { ok: false, reason: "missing", path: dir, otherProjectId: null };
     }
@@ -13765,7 +14358,7 @@ var MigrationEngine = class {
 var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
-import { chmod as chmod11, stat as stat8 } from "fs/promises";
+import { chmod as chmod11, stat as stat9 } from "fs/promises";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -13779,7 +14372,7 @@ async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
     for (const filepath of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
       try {
-        const stats = await stat8(filepath);
+        const stats = await stat9(filepath);
         const mode = stats.mode & 511;
         if (mode !== SECURE_MODE) {
           console.warn("[security] File", filepath, "has mode", mode.toString(8) + ", fixing to 600");
@@ -13795,8 +14388,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir8, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir19, copyFile, unlink as unlink5, rename as rename13, stat as stat9 } from "fs/promises";
-import { join as join21 } from "path";
+import { readdir as readdir9, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir21, copyFile as copyFile2, unlink as unlink5, rename as rename14, stat as stat10 } from "fs/promises";
+import { join as join24 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -13806,35 +14399,14 @@ var MACHINE_FILES = [
   "api-keys.private.json",
   "settings.private.json"
 ];
-function rekeyValue(value, from, to, counter) {
-  if (typeof value === "string") {
-    if (!isEncryptedValue(value)) return value;
-    let plaintext;
-    try {
-      plaintext = decryptValueWith(from, value);
-    } catch {
-      return value;
-    }
-    counter.n += 1;
-    return encryptValueWith(to, plaintext);
-  }
-  if (Array.isArray(value)) return value.map((v) => rekeyValue(v, from, to, counter));
-  if (value && typeof value === "object") {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = rekeyValue(v, from, to, counter);
-    }
-    return out;
-  }
-  return value;
-}
+var rekeyValue = rekeyJsonValue;
 async function vaultJsonFiles(root) {
-  const entries = await readdir8(root, { withFileTypes: true });
+  const entries = await readdir9(root, { withFileTypes: true });
   return entries.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
 }
-async function exists(path) {
+async function exists2(path) {
   try {
-    await stat9(path);
+    await stat10(path);
     return true;
   } catch {
     return false;
@@ -13847,17 +14419,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join21(legacyRoot, `backup-${stamp}`);
-  await mkdir19(backupDir, { recursive: true });
+  const backupDir = join24(legacyRoot, `backup-${stamp}`);
+  await mkdir21(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists(join21(legacyRoot, name))) {
-      await copyFile(join21(legacyRoot, name), join21(backupDir, name));
+    if (await exists2(join24(legacyRoot, name))) {
+      await copyFile2(join24(legacyRoot, name), join24(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile17(join21(legacyRoot, name), "utf-8");
+    const raw = await readFile18(join24(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -13867,13 +14439,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join21(legacyRoot, `${name}.tmp`);
-    await writeFile16(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename13(tmp, join21(legacyRoot, name));
+    const tmp = join24(legacyRoot, `${name}.tmp`);
+    await writeFile17(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename14(tmp, join24(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile17(join21(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile18(join24(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -13882,41 +14454,93 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir19(machineRootDir, { recursive: true });
+  await mkdir21(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join21(legacyRoot, name);
-    if (!await exists(from)) continue;
-    const to = join21(machineRootDir, name);
-    if (await exists(to)) {
+    const from = join24(legacyRoot, name);
+    if (!await exists2(from)) continue;
+    const to = join24(machineRootDir, name);
+    if (await exists2(to)) {
       skipped.push(name);
       continue;
     }
-    await copyFile(from, to);
+    await copyFile2(from, to);
     await unlink5(from);
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join21(legacyRoot, name);
-    if (await exists(path)) await unlink5(path);
+    const path = join24(legacyRoot, name);
+    if (await exists2(path)) await unlink5(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
+// ../server/src/services/settings-migration.ts
+import { readFile as readFile19, writeFile as writeFile18, rename as rename15, unlink as unlink6, mkdir as mkdir22, chmod as chmod12, stat as stat11 } from "fs/promises";
+import { join as join25 } from "path";
+var SETTINGS_FILE2 = "settings.json";
+var SETTINGS_PRIVATE_FILE2 = "settings.private.json";
+async function exists3(path) {
+  return stat11(path).then(() => true, () => false);
+}
+async function legacySource(filename) {
+  for (const path of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
+    if (await exists3(path)) return path;
+  }
+  return null;
+}
+async function moveInto(root, filename, from) {
+  await mkdir22(root, { recursive: true });
+  const to = join25(root, filename);
+  const contents = await readFile19(from, "utf-8");
+  const tmp = to + ".tmp";
+  await writeFile18(tmp, contents, "utf-8");
+  await rename15(tmp, to);
+  await chmod12(to, 384);
+  await unlink6(from);
+}
+async function migrateSettingsIntoVaults() {
+  const report = { movedTo: null, files: [], ambiguous: [] };
+  const sources = [];
+  for (const filename of [SETTINGS_FILE2, SETTINGS_PRIVATE_FILE2]) {
+    const from = await legacySource(filename);
+    if (from) sources.push({ filename, from });
+  }
+  if (sources.length === 0) return report;
+  const orgs = await listOrgVaults();
+  if (orgs.length === 0) return report;
+  if (orgs.length > 1) {
+    report.ambiguous = orgs;
+    return report;
+  }
+  const orgId = orgs[0];
+  const root = orgVaultRoot(orgId);
+  for (const { filename, from } of sources) {
+    if (await exists3(join25(root, filename))) continue;
+    await moveInto(root, filename, from);
+    report.files.push(filename);
+  }
+  if (report.files.length > 0) {
+    report.movedTo = orgId;
+    settingsManager.forget();
+  }
+  return report;
+}
+
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
-import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
+import { randomBytes as randomBytes6, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile18,
-  writeFile as writeFile17,
-  rename as rename14,
-  mkdir as mkdir20,
+  readFile as readFile20,
+  writeFile as writeFile19,
+  rename as rename16,
+  mkdir as mkdir23,
   access as access3,
-  readdir as readdir9
+  readdir as readdir10
 } from "fs/promises";
-import { join as join22, dirname as dirname10 } from "path";
+import { join as join26, dirname as dirname10 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -13929,8 +14553,8 @@ var PARSER_ID_MAP = {
 function encryptValue2(plaintext) {
   const key = getEncryptionKey();
   if (!key) throw new Error("[legacy-migration] Encryption key not loaded");
-  const iv = randomBytes5(16);
-  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const iv = randomBytes6(16);
+  const cipher = createCipheriv3("aes-256-gcm", key, iv);
   let enc = cipher.update(plaintext, "utf-8", "hex");
   enc += cipher.final("hex");
   const authTag = cipher.getAuthTag().toString("hex");
@@ -13977,7 +14601,7 @@ function decryptMigrationValue(encrypted) {
     const parts = encrypted.split(":");
     if (parts.length !== 3) return null;
     const [ivHex, authHex, ct] = parts;
-    const dec = createDecipheriv2("aes-256-gcm", key, Buffer.from(ivHex, "hex"), { authTagLength: 16 });
+    const dec = createDecipheriv3("aes-256-gcm", key, Buffer.from(ivHex, "hex"), { authTagLength: 16 });
     dec.setAuthTag(Buffer.from(authHex, "hex"));
     return dec.update(ct, "hex", "utf-8") + dec.final("utf-8");
   } catch {
@@ -14025,7 +14649,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile18(filePath, "utf-8")).trim();
+  const raw = (await readFile20(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -14045,12 +14669,12 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile17(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename14(tmp, path);
+  await writeFile19(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await rename16(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join22(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join26(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
   } catch {
@@ -14058,20 +14682,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join22(abCwd, ".runeya-tmp");
-  await rename14(legacyRoot, legacyTmp);
-  await mkdir20(dataDir, { recursive: true });
-  const legacyOld = join22(dataDir, `backup-${timestamp}`);
-  await rename14(legacyTmp, legacyOld);
+  const legacyTmp = join26(abCwd, ".runeya-tmp");
+  await rename16(legacyRoot, legacyTmp);
+  await mkdir23(dataDir, { recursive: true });
+  const legacyOld = join26(dataDir, `backup-${timestamp}`);
+  await rename16(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile18(join22(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile20(join26(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join22(legacyOld, "dbs");
+  const dbsDir = join26(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -14080,29 +14704,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join22(dbsDir, "envs");
-  const envFiles = (await readdir9(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join26(dbsDir, "envs");
+  const envFiles = (await readdir10(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join22(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join26(envsDir, file));
   }
-  const servicesDir = join22(dbsDir, "services");
-  const serviceFiles = (await readdir9(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join26(dbsDir, "services");
+  const serviceFiles = (await readdir10(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join22(servicesDir, file));
+    const data = await readEncrypted(join26(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join22(dbsDir, "overrides");
-  const overrideFiles = (await readdir9(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join26(dbsDir, "overrides");
+  const overrideFiles = (await readdir10(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join22(overridesDir, file));
+    const data = await readEncrypted(join26(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -14110,11 +14734,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join22(dbsDir, "parsers");
-  const parserFiles = (await readdir9(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join26(dbsDir, "parsers");
+  const parserFiles = (await readdir10(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join22(parsersDir, file));
+    const data = await readEncrypted(join26(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -14455,7 +15079,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile18(join22(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile20(join26(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -14476,11 +15100,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join22(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join22(dataDir, "services.json"), runeServices);
-  await atomicWrite(join22(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join22(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join22(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join26(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join26(dataDir, "services.json"), runeServices);
+  await atomicWrite(join26(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join26(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join26(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -14491,12 +15115,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries = await readdir9(dataDir);
+    const entries = await readdir10(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join22(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join26(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile18(keyJsonPath, "utf-8");
+        const raw = await readFile20(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -14517,14 +15141,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve7 } = await import("path");
   const abDataDir = resolve7(dataDir);
   const candidateDirs = [
-    join22(dirname10(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join22(abDataDir, "dbs", "overrides")
+    join26(dirname10(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join26(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir9(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir10(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -14534,7 +15158,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join22(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join26(overridesDir, "..", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
     return false;
@@ -14552,7 +15176,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile18(join22(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile20(join26(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -14571,7 +15195,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile18(join22(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile20(join26(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -14588,7 +15212,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join26(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -14615,7 +15239,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join22(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join26(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -14625,7 +15249,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join26(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -14684,12 +15308,12 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join22(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join26(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename14(overridesDir, migratedDir);
+    await rename16(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -14699,8 +15323,8 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join23 } from "path";
-import { stat as stat10 } from "fs/promises";
+import { join as join27 } from "path";
+import { stat as stat12 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
 async function getServerState() {
@@ -14709,22 +15333,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat10(join23(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat12(join27(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat10(join23(dataDir, VERIFY_FILENAME2));
+    await stat12(join27(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat10(join23(dataDir, "projects.json"));
+    await stat12(join27(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat10(join23(dataDir, "project.json"));
+    await stat12(join27(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -15158,9 +15782,25 @@ async function createLocalServer() {
     credentials: true
   }));
   let postUnlockDone = false;
-  async function runPostUnlock() {
+  async function runPostUnlock(masterPassword = null) {
     if (postUnlockDone) return;
     postUnlockDone = true;
+    const orgKeys = await unlockOrgKeys(masterPassword);
+    if (orgKeys.seeded.length > 0) {
+      console.log(`[org-keys] ${orgKeys.seeded.length} organisation(s) ont re\xE7u leur propre cl\xE9 de chiffrement`);
+    }
+    for (const orgId of orgKeys.locked) {
+      console.error(`[org-keys] org ${orgId}: sa cl\xE9 ne s'ouvre pas avec ce master password \u2014 ce coffre reste ferm\xE9.`);
+    }
+    const settingsMove = await migrateSettingsIntoVaults();
+    if (settingsMove.movedTo) {
+      console.log(`[settings] r\xE9glages d\xE9plac\xE9s vers l'organisation ${settingsMove.movedTo} : ${settingsMove.files.join(", ")}`);
+    }
+    if (settingsMove.ambiguous.length > 0) {
+      console.warn(
+        `[settings] r\xE9glages encore au niveau du poste : ${settingsMove.ambiguous.length} organisations sur cette machine, impossible de deviner \xE0 laquelle ils appartiennent \u2014 r\xE9partissez-les depuis les r\xE9glages.`
+      );
+    }
     await runOverrideOnlyMigration(env.DATA_DIR);
     if (env.MODE === "local-simple") {
       const projects = await projectStore.list();
@@ -15416,7 +16056,7 @@ async function createLocalServer() {
       }
       const encKey = await readEncryptedKey(await keyRoot(), masterPassword);
       setEncryptionKeyInMemory(encKey);
-      await runPostUnlock();
+      await runPostUnlock(masterPassword);
       const token = await signJwt();
       res.json({ token });
     } catch (err) {
@@ -15462,8 +16102,8 @@ async function createLocalServer() {
           }
           encKey = Buffer.from(encryptionKeyHex, "hex");
         } else {
-          const { randomBytes: randomBytes6 } = await import("crypto");
-          encKey = randomBytes6(32);
+          const { randomBytes: randomBytes7 } = await import("crypto");
+          encKey = randomBytes7(32);
         }
       }
       await writeEncryptedKey(await keyRoot(), masterPassword, encKey);
@@ -15479,7 +16119,7 @@ async function createLocalServer() {
       if (isLegacyMigration) {
         clearPendingLegacyKey();
       }
-      await runPostUnlock();
+      await runPostUnlock(masterPassword);
       const token = await signJwt();
       res.json({ token });
     } catch (err) {
@@ -15938,4 +16578,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-R6JOPDNL.js.map
+//# sourceMappingURL=src-4GK5OK3K.js.map