@kky42/pievo-server 1.0.0

package/.output/server/_ssr/start-4ifArtKx.mjs

@@ -0,0 +1,4 @@
+//#region node_modules/.nitro/vite/services/ssr/assets/start-4ifArtKx.js
+var startInstance = void 0;
+//#endregion
+export { startInstance };

package/.output/server/_ssr/store-b3JcQ08F.mjs

@@ -0,0 +1,2 @@
+import { X as getLoop } from "./boot-BbtG0ImW.mjs";
+export { getLoop };

package/.output/server/_ssr/t._teamId-CeUhzgzT.mjs

@@ -0,0 +1,32 @@
+import { C as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { s as useSession } from "./LoopPlaybook-BXH8mhiX.mjs";
+import { t as SignIn } from "./SignIn-dTndU6Hw.mjs";
+import { t as DashboardView } from "./DashboardView-CC7htv28.mjs";
+import { t as Route } from "./t._teamId-DR-hQK7o.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/t._teamId-CeUhzgzT.js
+var import_jsx_runtime = require_jsx_runtime();
+/**
+* The explicit-team dashboard (`/t/<teamId>`, Phase 2): the same dashboard scoped
+* to the team in the PATH, so a view is bookmarkable and each browser tab keeps
+* its own team (the list server fns take an explicit `teamId`, independent of the
+* shared last-used cookie). A team id rides the URL verbatim.
+*
+* The loader validates membership (`canViewTeam`) and, on failure, throws the SAME
+* generic not-found as a missing loop — never confirming a team exists to a
+* non-member (enumeration safety). Open mode has no gate: any `/t/<x>` renders the
+* single shared workspace.
+*/
+/** Load-failure screen (a non-member's generic not-found, or a first-load blip).
+*  Retry re-runs the loader; harmless for the not-found case, self-heals a blip. */
+function TeamDashboard() {
+	const loaded = Route.useLoaderData();
+	const { data: session, isPending } = useSession();
+	if (loaded?.auth?.enabled && !isPending && !session) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, {});
+	if (loaded?.mode === "signin") return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, {});
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DashboardView, {
+		teamId: loaded.teamId,
+		initial: loaded.initial
+	}, loaded.teamId);
+}
+//#endregion
+export { TeamDashboard as component };

package/.output/server/_ssr/t._teamId-DR-hQK7o.mjs

@@ -0,0 +1,47 @@
+import { c as createFileRoute, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
+import { g as listTemplates, l as getAuthState, t as canViewTeam } from "./loopApi-Cxe8WyOB.mjs";
+import { a as authClient } from "./LoopPlaybook-BXH8mhiX.mjs";
+import { n as fetchLiveData } from "./DashboardView-CC7htv28.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/t._teamId-DR-hQK7o.js
+var $$splitErrorComponentImporter = () => import("./t._teamId-Dy_McbRt.mjs");
+var $$splitComponentImporter = () => import("./t._teamId-CeUhzgzT.mjs");
+/**
+* The explicit-team dashboard (`/t/<teamId>`, Phase 2): the same dashboard scoped
+* to the team in the PATH, so a view is bookmarkable and each browser tab keeps
+* its own team (the list server fns take an explicit `teamId`, independent of the
+* shared last-used cookie). A team id rides the URL verbatim.
+*
+* The loader validates membership (`canViewTeam`) and, on failure, throws the SAME
+* generic not-found as a missing loop — never confirming a team exists to a
+* non-member (enumeration safety). Open mode has no gate: any `/t/<x>` renders the
+* single shared workspace.
+*/
+var Route = createFileRoute("/t/$teamId")({
+	ssr: false,
+	loader: async ({ params }) => {
+		const teamId = params.teamId;
+		const auth = await getAuthState();
+		if (auth.enabled) {
+			const { data: session } = await authClient.getSession();
+			if (!session) return {
+				mode: "signin",
+				auth,
+				teamId
+			};
+			if (!await canViewTeam({ data: teamId })) throw new Error("This team does not exist, or you do not have access to it.");
+		}
+		return {
+			mode: "dashboard",
+			auth,
+			teamId,
+			initial: {
+				...await fetchLiveData(teamId),
+				templates: await listTemplates()
+			}
+		};
+	},
+	component: lazyRouteComponent($$splitComponentImporter, "component"),
+	errorComponent: lazyRouteComponent($$splitErrorComponentImporter, "errorComponent")
+});
+//#endregion
+export { Route as t };

package/.output/server/_ssr/t._teamId-Dy_McbRt.mjs

@@ -0,0 +1,31 @@
+import { C as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { f as useRouter } from "../_libs/@tanstack/react-router+[...].mjs";
+import { r as LoadErrorCard } from "./actionUi-CZbEixbf.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/t._teamId-Dy_McbRt.js
+var import_jsx_runtime = require_jsx_runtime();
+/**
+* The explicit-team dashboard (`/t/<teamId>`, Phase 2): the same dashboard scoped
+* to the team in the PATH, so a view is bookmarkable and each browser tab keeps
+* its own team (the list server fns take an explicit `teamId`, independent of the
+* shared last-used cookie). A team id rides the URL verbatim.
+*
+* The loader validates membership (`canViewTeam`) and, on failure, throws the SAME
+* generic not-found as a missing loop — never confirming a team exists to a
+* non-member (enumeration safety). Open mode has no gate: any `/t/<x>` renders the
+* single shared workspace.
+*/
+/** Load-failure screen (a non-member's generic not-found, or a first-load blip).
+*  Retry re-runs the loader; harmless for the not-found case, self-heals a blip. */
+function LoadError({ error }) {
+	const router = useRouter();
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {
+		className: "mx-auto max-w-[1180px] px-8 pt-12",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoadErrorCard, {
+			title: "Couldn't open this team.",
+			detail: String(error),
+			onRetry: () => void router.invalidate()
+		})
+	});
+}
+//#endregion
+export { LoadError as errorComponent };

package/.output/server/_ssr/teamCookie-B7hLOIie.mjs

@@ -0,0 +1,10 @@
+//#region node_modules/.nitro/vite/services/ssr/assets/teamCookie-B7hLOIie.js
+/** The single writer of the `pievo.team` active-team cookie. Both switch
+*  surfaces (the header TeamSwitcher and the cross-team loop banner) call this so
+*  they can't drift on cookie name/encoding/max-age/samesite. Client-set is fine:
+*  the server never trusts it blind (requestScope re-checks membership/admin). */
+function setActiveTeamCookie(id) {
+	document.cookie = `pievo.team=${encodeURIComponent(id)}; path=/; max-age=31536000; samesite=lax`;
+}
+//#endregion
+export { setActiveTeamCookie as t };

package/.output/server/_ssr/teamFns-BIDnsg2A.mjs

@@ -0,0 +1,473 @@
+import { Bt as renameTeam$2, E as createInvite$1, Et as listTeamsForUser, F as ensureServer, Gt as setTeamMemberRoleGuarded, Lt as redeemInviteAtomic, M as deleteInvite, O as createTeam$2, P as deleteTeamCascade, St as listPendingInvites, Tt as listTeamMembers, Y as getInvite, ct as isPersonalTeam, en as userByEmail, nt as getTeam, p as addTeamMember$1, rt as getTeamMember, x as countLoopsForTeam, zt as removeTeamMemberGuarded } from "./boot-BbtG0ImW.mjs";
+import { n as createServerFn } from "./ssr.mjs";
+import { authEnabled, currentUserId } from "./auth-DY1DuYZd.mjs";
+import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
+import { randomUUID } from "node:crypto";
+//#region node_modules/.nitro/vite/services/ssr/assets/teamFns-BIDnsg2A.js
+/**
+* Team lifecycle + membership logic (design report §2/§4/§5, all six §7 decisions
+* approved as recommended). This module is the ONE authorization + rules
+* chokepoint; the `teamFns` server fns are thin wrappers that resolve the caller's
+* user id and delegate here. Keeping the logic framework-free (plain async
+* functions over the store, `(actorUserId, ...)` in) makes every rule directly
+* testable against a real pglite store without mocking the Start runtime.
+*
+* The non-negotiable invariants, enforced here + transactionally in the store:
+*  - every fn takes an EXPLICIT teamId and authorizes by MEMBERSHIP + ROLE, never
+*    the active-team cookie (the URL report's hard lesson — managing team B while
+*    browsing team A must work);
+*  - team MANAGEMENT (rename/delete/members/invites) is owner-only; any member may
+*    still create loops (decision 4, unchanged elsewhere);
+*  - the personal team is undeletable + un-leavable but renamable (decision 5);
+*  - a team always keeps ≥1 owner (decision 6, the last-owner guard);
+*  - deleting a team that still owns loops is BLOCKED, never cascaded (decision 1);
+*  - an invite grants membership within the app but never bypasses the login
+*    allowlist (decision 3 — the redeemer already signed in through the gate).
+*/
+/** Invite link lifetime (design §4 "short TTL, e.g. 7 days"). */
+var INVITE_TTL_MS = 10080 * 60 * 1e3;
+var NAME_MAX = 80;
+function cleanName(raw) {
+	return (raw || "").trim().slice(0, NAME_MAX) || null;
+}
+function isRole(v) {
+	return v === "owner" || v === "member";
+}
+/** Resolve the actor's role in a team (null ⇒ not a member). */
+async function roleOf(teamId, userId) {
+	return (await getTeamMember(teamId, userId))?.role ?? null;
+}
+/** Every team the actor belongs to, with their role + member count (the settings
+*  master list; doubles as a richer switcher). */
+async function listManagedTeams$1(userId) {
+	const teams = await listTeamsForUser(userId);
+	return Promise.all(teams.map(async (t) => {
+		const members = await listTeamMembers(t.id);
+		const me = members.find((m) => m.userId === userId);
+		return {
+			id: t.id,
+			name: t.name,
+			role: me?.role ?? "member",
+			memberCount: members.length,
+			personal: isPersonalTeam(t)
+		};
+	}));
+}
+/** Full settings detail for one team, authorized by membership (any member may
+*  view the roster; only an owner sees the pending invite links). Null ⇒ the
+*  actor is not a member (caller renders the generic not-found, no leak). */
+async function getTeamDetail$1(userId, teamId) {
+	const team = await getTeam(teamId);
+	if (!team) return null;
+	const myRole = await roleOf(teamId, userId);
+	if (!myRole) return null;
+	const members = await listTeamMembers(teamId);
+	const loopCount = await countLoopsForTeam(teamId);
+	const invites = myRole === "owner" ? await listPendingInvites(teamId) : [];
+	return {
+		id: team.id,
+		name: team.name,
+		role: myRole,
+		personal: isPersonalTeam(team),
+		loopCount,
+		members: members.map((m) => ({
+			userId: m.userId,
+			email: m.email,
+			displayName: m.displayName,
+			role: m.role,
+			isSelf: m.userId === userId
+		})),
+		invites: invites.map(inviteView)
+	};
+}
+function inviteView(i) {
+	return {
+		token: i.token,
+		role: i.role,
+		expiresAt: i.expiresAt
+	};
+}
+/** Owner-gate helper: the actor must be an OWNER of the team. Returns the FAILURE
+*  result to bubble up (assignable to any `Result<T>`), or null when authorized. */
+async function assertOwner(teamId, userId) {
+	const role = await roleOf(teamId, userId);
+	if (!role) return {
+		ok: false,
+		error: "This team does not exist, or you do not have access to it."
+	};
+	if (role !== "owner") return {
+		ok: false,
+		error: "Only a team owner can manage this team."
+	};
+	return null;
+}
+async function createTeam$1(userId, name) {
+	const clean = cleanName(name);
+	if (!clean) return {
+		ok: false,
+		error: "Team name is required."
+	};
+	return {
+		ok: true,
+		id: (await createTeam$2(clean, userId)).id
+	};
+}
+async function renameTeam$1(userId, teamId, name) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	const clean = cleanName(name);
+	if (!clean) return {
+		ok: false,
+		error: "Team name is required."
+	};
+	await renameTeam$2(teamId, clean);
+	return { ok: true };
+}
+function blockedByLoops(loopCount) {
+	const one = loopCount === 1;
+	return {
+		ok: false,
+		error: `This team still owns ${loopCount} loop${one ? "" : "s"} — move or delete ${one ? "it" : "them"} first.`
+	};
+}
+async function deleteTeam$1(userId, teamId) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	const team = await getTeam(teamId);
+	if (!team) return {
+		ok: false,
+		error: "This team no longer exists."
+	};
+	if (isPersonalTeam(team)) return {
+		ok: false,
+		error: "Your personal team can't be deleted."
+	};
+	const loopCount = await countLoopsForTeam(teamId);
+	if (loopCount > 0) return blockedByLoops(loopCount);
+	if (await deleteTeamCascade(teamId) === "has-loops") return blockedByLoops(await countLoopsForTeam(teamId));
+	return { ok: true };
+}
+/** Direct-add-by-email fast path (design §4 option A): add an EXISTING account to
+*  the team immediately. No account yet ⇒ steer the owner to an invite link. */
+async function addMemberByEmail(userId, teamId, email, role) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	if (!isRole(role)) return {
+		ok: false,
+		error: "Invalid role."
+	};
+	const addr = (email || "").trim();
+	if (!addr) return {
+		ok: false,
+		error: "An email address is required."
+	};
+	const target = await userByEmail(addr);
+	if (!target) return {
+		ok: false,
+		error: "No Pievo account uses that email yet. Generate an invite link they can redeem after signing in."
+	};
+	if (await getTeamMember(teamId, target.id)) return {
+		ok: false,
+		error: `${target.email} is already a member of this team.`
+	};
+	await addTeamMember$1(teamId, target.id, role);
+	return {
+		ok: true,
+		added: target.email
+	};
+}
+async function setMemberRole(userId, teamId, targetUserId, role) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	if (!isRole(role)) return {
+		ok: false,
+		error: "Invalid role."
+	};
+	const outcome = await setTeamMemberRoleGuarded(teamId, targetUserId, role);
+	if (outcome === "not-member") return {
+		ok: false,
+		error: "That person is not a member of this team."
+	};
+	if (outcome === "last-owner") return {
+		ok: false,
+		error: "This is the team's only owner — promote another owner first."
+	};
+	return { ok: true };
+}
+async function removeMember(userId, teamId, targetUserId) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	if (targetUserId === userId) return {
+		ok: false,
+		error: "Use “Leave team” to remove yourself."
+	};
+	const outcome = await removeTeamMemberGuarded(teamId, targetUserId);
+	if (outcome === "not-member") return {
+		ok: false,
+		error: "That person is not a member of this team."
+	};
+	if (outcome === "last-owner") return {
+		ok: false,
+		error: "This is the team's only owner — promote another owner first."
+	};
+	return { ok: true };
+}
+/** Leave a team (any member). The personal team can't be left; the last owner
+*  can't leave (transfer ownership or delete the team first). */
+async function leaveTeam$1(userId, teamId) {
+	const team = await getTeam(teamId);
+	if (!team) return {
+		ok: false,
+		error: "This team no longer exists."
+	};
+	if (!await roleOf(teamId, userId)) return {
+		ok: false,
+		error: "You are not a member of this team."
+	};
+	if (isPersonalTeam(team)) return {
+		ok: false,
+		error: "You can't leave your personal team."
+	};
+	const outcome = await removeTeamMemberGuarded(teamId, userId);
+	if (outcome === "last-owner") return {
+		ok: false,
+		error: "You are the team's only owner — promote another owner or delete the team first."
+	};
+	if (outcome === "not-member") return {
+		ok: false,
+		error: "You are not a member of this team."
+	};
+	return { ok: true };
+}
+/** Mint a single-use, short-lived invite link (owner-only). `role` is capped at
+*  the inviter's role — an owner may mint member or owner links (decision 6). */
+async function createInvite(userId, teamId, role, nowMs) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	if (!isRole(role)) return {
+		ok: false,
+		error: "Invalid role."
+	};
+	const invite = await createInvite$1({
+		token: `inv_${randomUUID().replace(/-/g, "")}${randomUUID().replace(/-/g, "").slice(0, 8)}`,
+		teamId,
+		role,
+		invitedByUserId: userId,
+		expiresAt: new Date(nowMs + INVITE_TTL_MS).toISOString()
+	});
+	return {
+		ok: true,
+		token: invite.token,
+		expiresAt: invite.expiresAt,
+		role: invite.role
+	};
+}
+async function revokeInvite(userId, teamId, token) {
+	const gate = await assertOwner(teamId, userId);
+	if (gate) return gate;
+	const invite = await getInvite(token);
+	if (!invite || invite.teamId !== teamId) return {
+		ok: false,
+		error: "That invite no longer exists."
+	};
+	await deleteInvite(token);
+	return { ok: true };
+}
+/**
+* Redeem an invite as the signed-in actor. Any signed-in user may redeem (the
+* link is the authority, not team membership); the login allowlist already gated
+* their sign-in, so this never widens who can sign in (decision 3). Outcomes:
+*  - invalid token / wrong shape → error;
+*  - already redeemed (single-use) → error;
+*  - expired → error;
+*  - already a member → success, no double-add (`alreadyMember`);
+*  - otherwise → membership granted at the invite's role.
+*/
+async function redeemInvite(userId, token, nowMs) {
+	const invite = await getInvite(token);
+	if (!invite) return {
+		ok: false,
+		error: "This invite link is invalid."
+	};
+	if (invite.redeemedAt) return {
+		ok: false,
+		error: "This invite link has already been used."
+	};
+	if (new Date(invite.expiresAt).getTime() <= nowMs) return {
+		ok: false,
+		error: "This invite link has expired."
+	};
+	const team = await getTeam(invite.teamId);
+	if (!team) return {
+		ok: false,
+		error: "The team for this invite no longer exists."
+	};
+	const already = !!await getTeamMember(invite.teamId, userId);
+	if (!await redeemInviteAtomic(token, userId, already ? null : {
+		teamId: invite.teamId,
+		role: invite.role
+	})) return {
+		ok: false,
+		error: "This invite link has already been used."
+	};
+	return {
+		ok: true,
+		teamId: invite.teamId,
+		teamName: team.name,
+		alreadyMember: already
+	};
+}
+/**
+* Team management server functions — the thin RPC surface over `teamAdmin`
+* (which holds all the rules + authorization). Every mutating fn takes an
+* EXPLICIT teamId and authorizes by membership + role inside teamAdmin, never the
+* active-team cookie (the URL report's hard lesson: managing team B while browsing
+* team A must work). Team management is a GATED feature — it needs a real
+* signed-in user, so open mode (single shared workspace, no identities) returns a
+* uniform "sign-in required" error.
+*/
+var SIGNIN_REQUIRED = {
+	ok: false,
+	error: "Team management requires signing in."
+};
+/** Resolve the signed-in user id, or null when the gate is off / no session. */
+async function actor() {
+	if (!authEnabled) return null;
+	return currentUserId();
+}
+/** GET — every team the caller manages/belongs to (role + member count). Open
+*  mode / signed-out ⇒ empty (the settings surface is gated). */
+var listManagedTeams_createServerFn_handler = createServerRpc({
+	id: "94d1108f156fa2273cb78140852e9c3e368de0b8321db0de932a16567671716f",
+	name: "listManagedTeams",
+	filename: "src/server/teamFns.ts"
+}, (opts) => listManagedTeams.__executeServer(opts));
+var listManagedTeams = createServerFn({ method: "GET" }).handler(listManagedTeams_createServerFn_handler, async () => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return [];
+	return listManagedTeams$1(userId);
+});
+var getTeamDetail_createServerFn_handler = createServerRpc({
+	id: "fc7a4775f418dde12f422ff9ca65d9e07428fb0dc35c9399592c0081467330bf",
+	name: "getTeamDetail",
+	filename: "src/server/teamFns.ts"
+}, (opts) => getTeamDetail.__executeServer(opts));
+var getTeamDetail = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(getTeamDetail_createServerFn_handler, async ({ data: teamId }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return { error: SIGNIN_REQUIRED.error };
+	return await getTeamDetail$1(userId, teamId) ?? { error: "This team does not exist, or you do not have access to it." };
+});
+var createTeam_createServerFn_handler = createServerRpc({
+	id: "0f279cfe81021a642289ce6e95622e7198aaeab4147880f85824a02ee9ebafcf",
+	name: "createTeam",
+	filename: "src/server/teamFns.ts"
+}, (opts) => createTeam.__executeServer(opts));
+var createTeam = createServerFn({ method: "POST" }).validator((name) => name).handler(createTeam_createServerFn_handler, async ({ data: name }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return createTeam$1(userId, name);
+});
+var renameTeam_createServerFn_handler = createServerRpc({
+	id: "5721e01d84c20ffde19d2191648d76a7e5ede3bbb4f44efa59107a786947cf27",
+	name: "renameTeam",
+	filename: "src/server/teamFns.ts"
+}, (opts) => renameTeam.__executeServer(opts));
+var renameTeam = createServerFn({ method: "POST" }).validator((d) => d).handler(renameTeam_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return renameTeam$1(userId, data.teamId, data.name);
+});
+var deleteTeam_createServerFn_handler = createServerRpc({
+	id: "d2372a81af17eb3a7e4c1407d6ef26a8a9522b66fd6a94858cb35c864b270d77",
+	name: "deleteTeam",
+	filename: "src/server/teamFns.ts"
+}, (opts) => deleteTeam.__executeServer(opts));
+var deleteTeam = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(deleteTeam_createServerFn_handler, async ({ data: teamId }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return deleteTeam$1(userId, teamId);
+});
+var addTeamMember_createServerFn_handler = createServerRpc({
+	id: "284cb82b5e5cb37242d053b1b14449760d8334e9dadffc6dcbba11db2200a709",
+	name: "addTeamMember",
+	filename: "src/server/teamFns.ts"
+}, (opts) => addTeamMember.__executeServer(opts));
+var addTeamMember = createServerFn({ method: "POST" }).validator((d) => d).handler(addTeamMember_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return addMemberByEmail(userId, data.teamId, data.email, data.role);
+});
+var setTeamMemberRole_createServerFn_handler = createServerRpc({
+	id: "c3762cecd4a15f7eca064bca295255e942d7c3dce65f66f8593ae145fd7859a0",
+	name: "setTeamMemberRole",
+	filename: "src/server/teamFns.ts"
+}, (opts) => setTeamMemberRole.__executeServer(opts));
+var setTeamMemberRole = createServerFn({ method: "POST" }).validator((d) => d).handler(setTeamMemberRole_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return setMemberRole(userId, data.teamId, data.userId, data.role);
+});
+var removeTeamMember_createServerFn_handler = createServerRpc({
+	id: "a3326ed8ecd726fbcc28a439bf0012983cbe387d5062e0155096ee5a558e313b",
+	name: "removeTeamMember",
+	filename: "src/server/teamFns.ts"
+}, (opts) => removeTeamMember.__executeServer(opts));
+var removeTeamMember = createServerFn({ method: "POST" }).validator((d) => d).handler(removeTeamMember_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return removeMember(userId, data.teamId, data.userId);
+});
+var leaveTeam_createServerFn_handler = createServerRpc({
+	id: "fe7cc1df829414194e9b0615b86584c8510369da18f4d8805ccd76468cadf2ff",
+	name: "leaveTeam",
+	filename: "src/server/teamFns.ts"
+}, (opts) => leaveTeam.__executeServer(opts));
+var leaveTeam = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(leaveTeam_createServerFn_handler, async ({ data: teamId }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return leaveTeam$1(userId, teamId);
+});
+var createTeamInvite_createServerFn_handler = createServerRpc({
+	id: "bbc1020c771335020ef51b326d74b1649966740f273913d32040fa2c3c9f5f0b",
+	name: "createTeamInvite",
+	filename: "src/server/teamFns.ts"
+}, (opts) => createTeamInvite.__executeServer(opts));
+var createTeamInvite = createServerFn({ method: "POST" }).validator((d) => d).handler(createTeamInvite_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return createInvite(userId, data.teamId, data.role, Date.now());
+});
+var revokeTeamInvite_createServerFn_handler = createServerRpc({
+	id: "b92e9a08eda2d217bf4028f90dbc6bf7d7e8d7c148ebb8a8330286b5935a3fa1",
+	name: "revokeTeamInvite",
+	filename: "src/server/teamFns.ts"
+}, (opts) => revokeTeamInvite.__executeServer(opts));
+var revokeTeamInvite = createServerFn({ method: "POST" }).validator((d) => d).handler(revokeTeamInvite_createServerFn_handler, async ({ data }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return revokeInvite(userId, data.teamId, data.token);
+});
+var redeemTeamInvite_createServerFn_handler = createServerRpc({
+	id: "6f5fe23f6da1d4aecc198b6f71a041c0fe29cabb6ccad807bb3f16c23c5bd9cd",
+	name: "redeemTeamInvite",
+	filename: "src/server/teamFns.ts"
+}, (opts) => redeemTeamInvite.__executeServer(opts));
+var redeemTeamInvite = createServerFn({ method: "POST" }).validator((token) => token).handler(redeemTeamInvite_createServerFn_handler, async ({ data: token }) => {
+	await ensureServer();
+	const userId = await actor();
+	if (!userId) return SIGNIN_REQUIRED;
+	return redeemInvite(userId, token, Date.now());
+});
+//#endregion
+export { addTeamMember_createServerFn_handler, createTeamInvite_createServerFn_handler, createTeam_createServerFn_handler, deleteTeam_createServerFn_handler, getTeamDetail_createServerFn_handler, leaveTeam_createServerFn_handler, listManagedTeams_createServerFn_handler, redeemTeamInvite_createServerFn_handler, removeTeamMember_createServerFn_handler, renameTeam_createServerFn_handler, revokeTeamInvite_createServerFn_handler, setTeamMemberRole_createServerFn_handler };

package/.output/server/_ssr/teamFns-DA4ovI5g.mjs

@@ -0,0 +1,33 @@
+import { n as createServerFn } from "./ssr.mjs";
+import { r as createSsrRpc } from "./loopApi-Cxe8WyOB.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/teamFns-DA4ovI5g.js
+/**
+* Team management server functions — the thin RPC surface over `teamAdmin`
+* (which holds all the rules + authorization). Every mutating fn takes an
+* EXPLICIT teamId and authorizes by membership + role inside teamAdmin, never the
+* active-team cookie (the URL report's hard lesson: managing team B while browsing
+* team A must work). Team management is a GATED feature — it needs a real
+* signed-in user, so open mode (single shared workspace, no identities) returns a
+* uniform "sign-in required" error.
+*/
+/** Resolve the signed-in user id, or null when the gate is off / no session. */
+/** GET — every team the caller manages/belongs to (role + member count). Open
+*  mode / signed-out ⇒ empty (the settings surface is gated). */
+var listManagedTeams = createServerFn({ method: "GET" }).handler(createSsrRpc("94d1108f156fa2273cb78140852e9c3e368de0b8321db0de932a16567671716f"));
+/** GET — one team's full settings detail (roster + invites), authorized by
+*  membership. Missing/non-member ⇒ the generic not-found error (no leak). */
+var getTeamDetail = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(createSsrRpc("fc7a4775f418dde12f422ff9ca65d9e07428fb0dc35c9399592c0081467330bf"));
+var createTeam = createServerFn({ method: "POST" }).validator((name) => name).handler(createSsrRpc("0f279cfe81021a642289ce6e95622e7198aaeab4147880f85824a02ee9ebafcf"));
+var renameTeam = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("5721e01d84c20ffde19d2191648d76a7e5ede3bbb4f44efa59107a786947cf27"));
+var deleteTeam = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createSsrRpc("d2372a81af17eb3a7e4c1407d6ef26a8a9522b66fd6a94858cb35c864b270d77"));
+var addTeamMember = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("284cb82b5e5cb37242d053b1b14449760d8334e9dadffc6dcbba11db2200a709"));
+var setTeamMemberRole = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("c3762cecd4a15f7eca064bca295255e942d7c3dce65f66f8593ae145fd7859a0"));
+var removeTeamMember = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("a3326ed8ecd726fbcc28a439bf0012983cbe387d5062e0155096ee5a558e313b"));
+var leaveTeam = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createSsrRpc("fe7cc1df829414194e9b0615b86584c8510369da18f4d8805ccd76468cadf2ff"));
+var createTeamInvite = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("bbc1020c771335020ef51b326d74b1649966740f273913d32040fa2c3c9f5f0b"));
+var revokeTeamInvite = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("b92e9a08eda2d217bf4028f90dbc6bf7d7e8d7c148ebb8a8330286b5935a3fa1"));
+/** POST — redeem an invite link as the signed-in caller. Any signed-in user may
+*  redeem (the token is the authority); open mode / signed-out is refused. */
+var redeemTeamInvite = createServerFn({ method: "POST" }).validator((token) => token).handler(createSsrRpc("6f5fe23f6da1d4aecc198b6f71a041c0fe29cabb6ccad807bb3f16c23c5bd9cd"));
+//#endregion
+export { getTeamDetail as a, redeemTeamInvite as c, revokeTeamInvite as d, setTeamMemberRole as f, deleteTeam as i, removeTeamMember as l, createTeam as n, leaveTeam as o, createTeamInvite as r, listManagedTeams as s, addTeamMember as t, renameTeam as u };

package/.output/server/_ssr/tokens-ytd60FUt.mjs

@@ -0,0 +1,2 @@
+import { Mt as mintDeviceToken, Rt as rememberConnectKey } from "./boot-BbtG0ImW.mjs";
+export { mintDeviceToken, rememberConnectKey };