@kky42/pievo-server 2.3.0 → 2.4.2

package/.output/server/_ssr/router-CXyrnvx-.mjs

@@ -0,0 +1,565 @@
+import { j as sql } from "../_libs/drizzle-orm+postgres.mjs";
+import { Dt as readByteBody, Ot as readJsonBody, Qt as validPollWireId, Xt as validOptionalPollString, Zt as validPollCurrentRun, d as POLL_HTTP_BODY_FIELDS, j as ensureServer, l as MACHINE_BODY_CAP } from "./boot-sNlIkoLe.mjs";
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { c as createFileRoute, i as HeadContent, l as createRootRoute, o as createRouter, r as Scripts } from "../_libs/@tanstack/react-router+[...].mjs";
+import { t as Route$12 } from "./invite._token-l1SjouDz.mjs";
+import { r as imageMime, t as Route$13 } from "./artifactKind-FBYbgSuf.mjs";
+import { t as Route$14 } from "./loops._loopId_.runs._runId-CduETLqH.mjs";
+import { t as Route$15 } from "./routes-BulNEUEE.mjs";
+import { t as Route$16 } from "./t._teamId-1CreIlPV.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/router-CXyrnvx-.js
+var import_jsx_runtime = require_jsx_runtime();
+var app_default = "/assets/app-CaZpuwOS.css";
+var Route$11 = createRootRoute({
+	head: () => ({
+		meta: [
+			{ charSet: "utf-8" },
+			{
+				name: "viewport",
+				content: "width=device-width, initial-scale=1"
+			},
+			{ title: "Pievo" }
+		],
+		links: [{
+			rel: "stylesheet",
+			href: app_default
+		}, {
+			rel: "icon",
+			type: "image/svg+xml",
+			href: "/favicon.svg"
+		}]
+	}),
+	shellComponent: RootDocument
+});
+function RootDocument({ children }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("html", {
+		lang: "en",
+		suppressHydrationWarning: true,
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("head", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(HeadContent, {}) }), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("body", {
+			className: "dot-grid-subtle bg-paper font-sans text-primary antialiased",
+			suppressHydrationWarning: true,
+			children: [children, /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Scripts, {})]
+		})]
+	});
+}
+var TokenBucketLimiter = class {
+	capacity;
+	refillPerSec;
+	maxKeys;
+	buckets = /* @__PURE__ */ new Map();
+	constructor(capacity, refillPerSec, maxKeys = 2e4) {
+		this.capacity = capacity;
+		this.refillPerSec = refillPerSec;
+		this.maxKeys = maxKeys;
+	}
+	/** Consume one token for `key`. Returns true if allowed, false if the bucket is dry. */
+	allow(key, now = Date.now()) {
+		let b = this.buckets.get(key);
+		if (!b) {
+			if (this.buckets.size >= this.maxKeys) this.evictOldest();
+			b = {
+				tokens: this.capacity,
+				last: now
+			};
+			this.buckets.set(key, b);
+		}
+		const elapsedSec = Math.max(0, (now - b.last) / 1e3);
+		b.tokens = Math.min(this.capacity, b.tokens + elapsedSec * this.refillPerSec);
+		b.last = now;
+		if (b.tokens >= 1) {
+			b.tokens -= 1;
+			return true;
+		}
+		return false;
+	}
+	/** Drop the least-recently-touched key (bounded memory under a distinct-key flood). */
+	evictOldest() {
+		let oldestKey;
+		let oldest = Number.POSITIVE_INFINITY;
+		for (const [k, b] of this.buckets) if (b.last < oldest) {
+			oldest = b.last;
+			oldestKey = k;
+		}
+		if (oldestKey !== void 0) this.buckets.delete(oldestKey);
+	}
+	/** Test seam — forget all state. */
+	reset() {
+		this.buckets.clear();
+	}
+};
+/** Parse a positive-number env override, falling back to `dflt` on absent/invalid. */
+function envNum(name, dflt) {
+	const raw = process.env[name]?.trim();
+	if (!raw) return dflt;
+	const n = Number(raw);
+	return Number.isFinite(n) && n > 0 ? n : dflt;
+}
+/**
+* Per-IP: default 240 burst + 8/sec sustained (≈480 req/min). One daemon does
+* ~20 polls/min plus sync bursts; this comfortably covers a dozen daemons behind a
+* shared NAT while still capping a single-IP flood.
+*/
+var ipLimiter = new TokenBucketLimiter(envNum("PIEVO_RL_IP_BURST", 240), envNum("PIEVO_RL_IP_PER_SEC", 8));
+/**
+* Per-token (per-machine): default 120 burst + 4/sec sustained. A single daemon
+* never approaches this; it bounds one credential's share of the process.
+*/
+var tokenLimiter = new TokenBucketLimiter(envNum("PIEVO_RL_TOKEN_BURST", 120), envNum("PIEVO_RL_TOKEN_PER_SEC", 4));
+/** Whether rate limiting is active. Off by default in tests unless opted in, so the
+*  large existing suites don't trip it; ON in a real server process. */
+function rateLimitEnabled() {
+	const flag = process.env.PIEVO_RATE_LIMIT?.trim().toLowerCase();
+	if (flag === "0" || flag === "false" || flag === "off") return false;
+	if (flag === "1" || flag === "true" || flag === "on") return true;
+	return process.env.VITEST !== "true";
+}
+/**
+* Best-effort client IP from the request, honoring the usual proxy headers (Fly
+* sets `Fly-Client-IP`; a generic proxy sets `X-Forwarded-For`). Falls back to a
+* single shared key so a missing IP still shares ONE bucket (fail-closed: unknown
+* origins can't each get a private allowance). Only the FIRST `X-Forwarded-For` hop
+* is trusted (the client-facing edge appends left-to-right).
+*/
+function clientIp(request) {
+	const h = request.headers;
+	const fly = h.get("fly-client-ip");
+	if (fly) return fly.trim();
+	const xff = h.get("x-forwarded-for");
+	if (xff) {
+		const first = xff.split(",")[0]?.trim();
+		if (first) return first;
+	}
+	const real = h.get("x-real-ip");
+	if (real) return real.trim();
+	return "unknown";
+}
+/**
+* A 429 response with a Retry-After hint. Carries `text` + `exitCode` alongside
+* `error` so `/api/machine/cli` can print the response directly.
+*/
+function tooMany() {
+	return Response.json({
+		error: "rate limited — slow down",
+		text: "rate limited — slow down",
+		exitCode: 1
+	}, {
+		status: 429,
+		headers: { "retry-after": "1" }
+	});
+}
+/**
+* Enforce the machine-route rate limits for one request. Call it at the top of a
+* machine route handler, right after reading the Bearer token (pass it so a valid
+* daemon keys off its own per-machine bucket). Returns a 429 `Response` to return
+* verbatim, or null to proceed. Both tiers apply: the per-IP flood guard always,
+* and the per-token fairness tier whenever a credential is present. (The byte-
+* ingress routes are exempt entirely and simply do not call this — see the module
+* doc.)
+*/
+function machineRouteLimit(request, token, opts = {}) {
+	if (!rateLimitEnabled()) return null;
+	const now = opts.now ?? Date.now();
+	if (!ipLimiter.allow(clientIp(request), now)) return tooMany();
+	if (token && !tokenLimiter.allow(token, now)) return tooMany();
+	return null;
+}
+/** POST /machine/report — finalize a run (Bearer run token). */
+var Route$10 = createFileRoute("/machine/report")({ server: { handlers: { POST: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	const limited = machineRouteLimit(request, token || void 0);
+	if (limited) return limited;
+	if (!token) return Response.json({ error: "missing token" }, { status: 401 });
+	const parsed = await readJsonBody(request, MACHINE_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
+	const body = parsed.kind === "ok" && parsed.body && typeof parsed.body === "object" ? parsed.body : {};
+	const { getGateway } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getGateway()).report(token, body);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/**
+* Deep readiness for process launchers. Unlike /api/health, this waits for the
+* one-time backend boot (migrations, blob-store selection, and scheduler start).
+* The per-launch nonce lets a launcher reject a different process already bound
+* to the requested port.
+*/
+async function readyResponse(ensure = ensureServer, env = process.env) {
+	await ensure();
+	return Response.json({
+		ok: true,
+		nonce: env.PIEVO_SERVER_LAUNCH_NONCE ?? null
+	});
+}
+var Route$9 = createFileRoute("/api/ready")({ server: { handlers: { GET: () => readyResponse() } } });
+var buildSha = () => process.env.GIT_SHA || "unknown";
+var buildAt = () => process.env.BUILT_AT || "unknown";
+var Route$8 = createFileRoute("/api/health")({ server: { handlers: { GET: async () => Response.json({
+	ok: true,
+	sha: buildSha(),
+	builtAt: buildAt()
+}) } } });
+/**
+* POST /api/machine/sync — exact artifact sync (Bearer DEVICE token). The daemon
+* posts the complete configured-path manifest after a run; the server reconciles
+* artifact_files and replies with needHashes for raw blob PUTs.
+* The manifest route retains its dedicated 32 MB JSON-body limit.
+*
+* This byte-ingress route is deliberately NOT rate limited (same rationale as the
+* blob PUT): it requires a valid registered device token (unknown ⇒ 401) and is
+* already bounded by the exact-path/hash handshake and 32MB sync-body cap, so a
+* limiter would only throttle a legitimate large sync.
+*/
+var Route$7 = createFileRoute("/api/machine/sync")({ server: { handlers: { POST: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const { SYNC_BODY_CAP, parseArtifactSyncBody } = await import("./artifacts-BR3jj0NC.mjs");
+	const parsed = await readJsonBody(request, SYNC_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "sync body too large" }, { status: 413 });
+	if (parsed.kind === "invalid") return Response.json({ error: "invalid JSON" }, { status: 400 });
+	const body = parseArtifactSyncBody(parsed.body);
+	if (!body) return Response.json({ error: "invalid sync body" }, { status: 400 });
+	const { getArtifactSync } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getArtifactSync()).sync(token, body);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/** GET /api/machine/status — is this machine's daemon live? (Bearer device token) */
+var Route$6 = createFileRoute("/api/machine/status")({ server: { handlers: { GET: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	const limited = machineRouteLimit(request, token || void 0);
+	if (limited) return limited;
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const { getGateway } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getGateway()).status(token);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/** Reject non-object bodies, additions, coercible types, over-cap strings, and
+* NUL-bearing text before the gateway is loaded or any state can mutate. */
+function parsePollBody(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	if (Object.keys(value).some((key) => !POLL_HTTP_BODY_FIELDS.has(key))) return null;
+	const body = value;
+	if (!validOptionalPollString(body.host, 524288) || !validOptionalPollString(body.platform, 524288) || !validOptionalPollString(body.arch, 524288) || !validOptionalPollString(body.version, 64)) return null;
+	if (body.protocolVersion !== void 0 && (typeof body.protocolVersion !== "number" || !Number.isInteger(body.protocolVersion))) return null;
+	if (body.currentRuns !== void 0 && (!Array.isArray(body.currentRuns) || body.currentRuns.some((run) => !validPollCurrentRun(run)))) return null;
+	if (body.daemonInstanceId !== void 0 && !validPollWireId(body.daemonInstanceId)) return null;
+	if (body.recoveryComplete !== void 0 && typeof body.recoveryComplete !== "boolean") return null;
+	return body;
+}
+/** Keep the HTTP adapter's protocol forwarding independently testable. */
+function gatewayPollRequest(body) {
+	return {
+		protocolVersion: body.protocolVersion,
+		currentRuns: body.currentRuns,
+		daemonInstanceId: body.daemonInstanceId,
+		recoveryComplete: body.recoveryComplete,
+		info: {
+			host: body.host,
+			platform: body.platform,
+			arch: body.arch,
+			version: body.version
+		}
+	};
+}
+/** POST /api/machine/poll — daemon claims this machine's pending runs (Bearer device token). */
+var Route$5 = createFileRoute("/api/machine/poll")({ server: { handlers: { POST: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	const limited = machineRouteLimit(request, token || void 0);
+	if (limited) return limited;
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const parsed = await readJsonBody(request, MACHINE_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
+	if (parsed.kind !== "ok") return Response.json({ error: "invalid JSON body" }, { status: 400 });
+	const body = parsePollBody(parsed.body);
+	if (!body) return Response.json({ error: "unknown or invalid poll body fields" }, { status: 400 });
+	const { getGateway } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getGateway()).pollV4Wait(token, gatewayPollRequest(body));
+	return Response.json(r.body, { status: r.status });
+} } } });
+function parseCliBody(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const body = value;
+	if (Object.keys(body).length !== 1 || !Object.prototype.hasOwnProperty.call(body, "argv")) return null;
+	if (!Array.isArray(body.argv) || body.argv.some((entry) => typeof entry !== "string")) return null;
+	return { argv: body.argv };
+}
+/**
+* POST /api/machine/cli — the ONE unified CLI dispatch (Bearer credential + `{argv}`).
+* `CliGateway.cli()` branches by credential type: a `dk_` device token takes owner
+* commands, while an `rk_` run credential can only report its run. Uses the standard
+* 2MB machine JSON body cap.
+*/
+var Route$4 = createFileRoute("/api/machine/cli")({ server: { handlers: { POST: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	const limited = machineRouteLimit(request, token || void 0);
+	if (limited) return limited;
+	if (!token) return Response.json({ error: "missing credential" }, { status: 401 });
+	const parsed = await readJsonBody(request, MACHINE_BODY_CAP);
+	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
+	const body = parsed.kind === "ok" ? parseCliBody(parsed.body) : null;
+	if (!body) return Response.json({ error: "body must be exactly {argv:string[]}" }, { status: 400 });
+	const { getCliGateway } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getCliGateway()).cli(token, body.argv);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/**
+* DB-touching liveness probe — the ONE home for the wedged-pool incident rationale
+* (db/index.ts and the Fly checks point here). Unlike /api/health (which never
+* touches the DB and so reported `ok` right through a ~5.5h outage while a dead
+* postgres-js pool masked it), this runs a trivial `select 1` through the runtime
+* pool.
+*
+* This route SURFACES a wedged pool (Fly's check goes critical, which de-routes the
+* machine); it does NOT by itself recover it. Fly's failing `[http_service.checks]`
+* only pull the machine from load balancing — they never restart the VM (the
+* 2026-07-12 outage: pool wedged, check critical, box down ~9h with no auto-restart
+* until a manual `fly machine restart`). The ACTUAL auto-recovery is the in-process
+* DB watchdog (`server/dbWatchdog.ts`), which exits the process on a sustained wedge
+* so Fly's `restart.policy = "on-failure"` brings up a fresh pool.
+*
+* A wedged pool makes `select 1` HANG (queued behind stuck connections; the pool's
+* `statement_timeout` is unenforced under the Supabase transaction pooler). So the
+* probe races the query against a hard client-side deadline (`PROBE_TIMEOUT_MS`, <
+* Fly's 10s check timeout) and returns a fast 503 instead of eating the full timeout
+* "awaiting headers". 200 → DB reachable; 503 → the query failed or timed out.
+* Drizzle imported inside the handler so it stays out of the client bundle.
+*/
+var PROBE_TIMEOUT_MS = 5e3;
+var Route$3 = createFileRoute("/api/health/db")({ server: { handlers: { GET: async () => {
+	try {
+		const { db } = await import("./db-CwLD-5w1.mjs");
+		const ping = db.execute(sql`select 1`);
+		const timeout = new Promise((_, reject) => {
+			setTimeout(() => reject(/* @__PURE__ */ new Error(`db ping timed out after ${PROBE_TIMEOUT_MS}ms`)), PROBE_TIMEOUT_MS).unref?.();
+		});
+		await Promise.race([ping, timeout]);
+		return Response.json({
+			ok: true,
+			db: "up"
+		});
+	} catch (err) {
+		return Response.json({
+			ok: false,
+			db: "down",
+			error: err instanceof Error ? err.message : String(err)
+		}, { status: 503 });
+	}
+} } } });
+/** Better Auth handler — GET/POST /api/auth/* (OAuth callbacks, session, sign-out). */
+var Route$2 = createFileRoute("/api/auth/$")({ server: { handlers: {
+	GET: async ({ request }) => (await import("./auth-C0zoZCGe.mjs")).auth.handler(request),
+	POST: async ({ request }) => (await import("./auth-C0zoZCGe.mjs")).auth.handler(request)
+} } });
+/**
+* `decodeURIComponent` that returns null on malformed percent-encoding instead
+* of throwing a URIError (which would escape a route handler as a 500). Shared
+* by the routes that decode path segments; the policy is uniform — ANY
+* malformed segment is the caller's clean 400, never silently kept raw.
+*/
+function safeDecode(s) {
+	try {
+		return decodeURIComponent(s);
+	} catch {
+		return null;
+	}
+}
+/**
+* PUT /api/machine/blob/:hash — upload one content-addressed blob's raw bytes
+* (Bearer DEVICE token). The server recomputes sha256(body) and rejects a
+* mismatch before storing in the byte store. The hash is read from the URL (the daemon PUTs
+* exactly the hashes the sync handshake returned in needHashes).
+*
+* This byte-ingress route is deliberately NOT rate limited: it requires a valid
+* registered device token (unknown ⇒ 401, not an unauthenticated surface) and is
+* already bounded by the sync hash-handshake (the server only accepts hashes it
+* asked THIS machine for) plus the per-file 10MB byte cap. A
+* large first sync bursts many concurrent PUTs on one token, so any limiter would
+* only throttle legitimate uploads without adding real protection.
+*/
+var Route$1 = createFileRoute("/api/machine/blob/$hash")({ server: { handlers: { PUT: async ({ request }) => {
+	const auth = request.headers.get("authorization") ?? "";
+	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
+	const hash = safeDecode(new URL(request.url).pathname.split("/").pop() ?? "");
+	if (hash === null) return Response.json({ error: "bad hash" }, { status: 400 });
+	const { BLOB_CAP } = await import("./artifacts-BR3jj0NC.mjs");
+	const body = await readByteBody(request, BLOB_CAP);
+	if (body.kind === "too-large") return Response.json({ error: "blob exceeds size cap" }, { status: 413 });
+	if (body.kind === "invalid") return Response.json({ error: "could not read blob body" }, { status: 400 });
+	const buf = Buffer.from(body.bytes.buffer, body.bytes.byteOffset, body.bytes.byteLength);
+	const { getArtifactSync } = await import("./boot-CdOO4xOo.mjs");
+	const r = await (await getArtifactSync()).putBlob(token, hash, buf);
+	return Response.json(r.body, { status: r.status });
+} } } });
+/**
+* GET /api/artifact/:loopId/:path - stream one of a loop's live-synced artifact
+* blobs. Two dispositions:
+*  - default: `attachment` (the download affordance for binary/oversize files;
+*    text is shown inline via getArtifact).
+*  - `?view=inline`: for a KNOWN image type only (the `imageMime` allowlist),
+*    served `inline` with the real image content-type so an <img> can render it.
+*    Hardened against a direct navigation turning the byte stream into a scripted
+*    document on the app origin: `X-Content-Type-Options: nosniff` pins the type
+*    and `Content-Security-Policy: sandbox` loads it in an opaque origin with no
+*    scripts - so an inline SVG can't run script against the session even if the
+*    URL is opened directly. Non-image inline requests fall back to attachment.
+*
+* Authed via the WEB SESSION (not a machine token) and scoped to the loop's team,
+* mirroring the server fns' `ownedLoop` gate. Path-safe: the relative path is
+* normalized + traversal-rejected before it ever reaches a blob, and blob keys
+* are content hashes, never the user path. Reads stream from the BlobStore
+* (local by default, R2 when configured); the route never writes.
+*/
+var PREFIX = "/api/artifact/";
+var Route = createFileRoute("/api/artifact/$loopId/$")({ server: { handlers: { GET: async ({ request }) => {
+	const pathname = new URL(request.url).pathname;
+	if (!pathname.startsWith(PREFIX)) return Response.json({ error: "not found" }, { status: 404 });
+	const after = pathname.slice(14);
+	const slash = after.indexOf("/");
+	if (slash < 0) return Response.json({ error: "missing path" }, { status: 400 });
+	const loopId = safeDecode(after.slice(0, slash));
+	if (loopId === null) return Response.json({ error: "bad loop id" }, { status: 400 });
+	const segments = after.slice(slash + 1).split("/").map((s) => safeDecode(s));
+	if (segments.some((s) => s === null)) return Response.json({ error: "bad path" }, { status: 400 });
+	const relPath = segments.join("/");
+	const loop = await (await import("./store-Cujtg2QE.mjs")).getLoop(loopId);
+	if (!loop) return Response.json({ error: "not found" }, { status: 404 });
+	const { requestScope, canAccessLoop } = await import("./auth-C0zoZCGe.mjs");
+	if (!await canAccessLoop(loop.teamId, await requestScope())) return Response.json({ error: "not found" }, { status: 404 });
+	const { readLoopArtifactBytes } = await import("./artifactFiles-DtpRidFZ.mjs");
+	const r = await readLoopArtifactBytes(loopId, relPath);
+	if (r.status !== 200 || !r.bytes) return Response.json({ error: "not found" }, { status: r.status });
+	const filename = (r.filename || "file").replace(/["\\\r\n]/g, "_");
+	const mime = new URL(request.url).searchParams.get("view") === "inline" ? imageMime(relPath) : null;
+	if (mime) return new Response(new Uint8Array(r.bytes), {
+		status: 200,
+		headers: {
+			"content-type": mime,
+			"content-length": String(r.bytes.length),
+			"content-disposition": `inline; filename="${filename}"`,
+			"x-content-type-options": "nosniff",
+			"content-security-policy": "sandbox",
+			"cache-control": "private, no-store"
+		}
+	});
+	return new Response(new Uint8Array(r.bytes), {
+		status: 200,
+		headers: {
+			"content-type": r.binary ? "application/octet-stream" : "text/plain; charset=utf-8",
+			"content-length": String(r.bytes.length),
+			"content-disposition": `attachment; filename="${filename}"`,
+			"cache-control": "private, no-store"
+		}
+	});
+} } } });
+var IndexRoute = Route$15.update({
+	id: "/",
+	path: "/",
+	getParentRoute: () => Route$11
+});
+var TTeamIdRoute = Route$16.update({
+	id: "/t/$teamId",
+	path: "/t/$teamId",
+	getParentRoute: () => Route$11
+});
+var MachineReportRoute = Route$10.update({
+	id: "/machine/report",
+	path: "/machine/report",
+	getParentRoute: () => Route$11
+});
+var LoopsLoopIdRoute = Route$13.update({
+	id: "/loops/$loopId",
+	path: "/loops/$loopId",
+	getParentRoute: () => Route$11
+});
+var InviteTokenRoute = Route$12.update({
+	id: "/invite/$token",
+	path: "/invite/$token",
+	getParentRoute: () => Route$11
+});
+var ApiReadyRoute = Route$9.update({
+	id: "/api/ready",
+	path: "/api/ready",
+	getParentRoute: () => Route$11
+});
+var ApiHealthRoute = Route$8.update({
+	id: "/api/health",
+	path: "/api/health",
+	getParentRoute: () => Route$11
+});
+var ApiMachineSyncRoute = Route$7.update({
+	id: "/api/machine/sync",
+	path: "/api/machine/sync",
+	getParentRoute: () => Route$11
+});
+var ApiMachineStatusRoute = Route$6.update({
+	id: "/api/machine/status",
+	path: "/api/machine/status",
+	getParentRoute: () => Route$11
+});
+var ApiMachinePollRoute = Route$5.update({
+	id: "/api/machine/poll",
+	path: "/api/machine/poll",
+	getParentRoute: () => Route$11
+});
+var ApiMachineCliRoute = Route$4.update({
+	id: "/api/machine/cli",
+	path: "/api/machine/cli",
+	getParentRoute: () => Route$11
+});
+var ApiHealthDbRoute = Route$3.update({
+	id: "/db",
+	path: "/db",
+	getParentRoute: () => ApiHealthRoute
+});
+var ApiAuthSplatRoute = Route$2.update({
+	id: "/api/auth/$",
+	path: "/api/auth/$",
+	getParentRoute: () => Route$11
+});
+var LoopsLoopIdRunsRunIdRoute = Route$14.update({
+	id: "/loops/$loopId_/runs/$runId",
+	path: "/loops/$loopId/runs/$runId",
+	getParentRoute: () => Route$11
+});
+var ApiMachineBlobHashRoute = Route$1.update({
+	id: "/api/machine/blob/$hash",
+	path: "/api/machine/blob/$hash",
+	getParentRoute: () => Route$11
+});
+var ApiArtifactLoopIdSplatRoute = Route.update({
+	id: "/api/artifact/$loopId/$",
+	path: "/api/artifact/$loopId/$",
+	getParentRoute: () => Route$11
+});
+var ApiHealthRouteChildren = { ApiHealthDbRoute };
+var rootRouteChildren = {
+	IndexRoute,
+	ApiHealthRoute: ApiHealthRoute._addFileChildren(ApiHealthRouteChildren),
+	ApiReadyRoute,
+	InviteTokenRoute,
+	LoopsLoopIdRoute,
+	MachineReportRoute,
+	TTeamIdRoute,
+	ApiAuthSplatRoute,
+	ApiMachineCliRoute,
+	ApiMachinePollRoute,
+	ApiMachineStatusRoute,
+	ApiMachineSyncRoute,
+	ApiArtifactLoopIdSplatRoute,
+	ApiMachineBlobHashRoute,
+	LoopsLoopIdRunsRunIdRoute
+};
+var routeTree = Route$11._addFileChildren(rootRouteChildren)._addFileTypes();
+function getRouter() {
+	return createRouter({
+		routeTree,
+		scrollRestoration: true,
+		defaultPreload: "intent"
+	});
+}
+//#endregion
+export { getRouter };

package/.output/server/_ssr/{routes-ClZEdsnB.mjs → routes-BulNEUEE.mjs}

@@ -1,10 +1,9 @@
 import { c as createFileRoute, p as redirect, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
-import { c as getAuthState, d as getDefaultTeam, g as listTemplates } from "./loopApi-8_KgBapr.mjs";
-import { a as authClient } from "./LoopPlaybook-DC7QVvPY.mjs";
-import { n as fetchLiveData } from "./DashboardView-BF7PciP7.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/routes-ClZEdsnB.js
-var $$splitErrorComponentImporter = () => import("./routes-ComqHvCL.mjs");
-var $$splitComponentImporter = () => import("./routes-D5jJJ-30.mjs");
+import { f as getDefaultTeam, i as authClient, u as getAuthState } from "./SocialLinks-Cm4H8pUJ.mjs";
+import { n as fetchLiveData } from "./DashboardView-C2LdV6J0.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-BulNEUEE.js
+var $$splitErrorComponentImporter = () => import("./routes-DD94baie.mjs");
+var $$splitComponentImporter = () => import("./routes-Wjexi35W.mjs");
 /**
 * The home route. Under the auth gate it is now a THIN redirect to the explicit
 * team URL (`/t/<lastUsed|personal>`) so the dashboard's team lives in the path
@@ -30,10 +29,7 @@ var Route = createFileRoute("/")({
 		return {
 			mode: "dashboard",
 			auth,
-			initial: {
-				...await fetchLiveData(),
-				templates: await listTemplates()
-			}
+			initial: await fetchLiveData()
 		};
 	},
 	component: lazyRouteComponent($$splitComponentImporter, "component"),

package/.output/server/_ssr/{routes-ComqHvCL.mjs → routes-DD94baie.mjs}

@@ -1,7 +1,7 @@
-import { g as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { r as LoadErrorCard } from "./actionUi-DJBWuNwr.mjs";
 import { f as useRouter } from "../_libs/@tanstack/react-router+[...].mjs";
-import { r as LoadErrorCard } from "./actionUi-BN55TNYE.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/routes-ComqHvCL.js
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-DD94baie.js
 var import_jsx_runtime = require_jsx_runtime();
 /**
 * The home route. Under the auth gate it is now a THIN redirect to the explicit

package/.output/server/_ssr/{routes-D5jJJ-30.mjs → routes-Wjexi35W.mjs}

@@ -1,9 +1,9 @@
-import { g as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { s as useSession } from "./LoopPlaybook-DC7QVvPY.mjs";
-import { t as SignIn } from "./SignIn-RmpWm9uy.mjs";
-import { t as DashboardView } from "./DashboardView-BF7PciP7.mjs";
-import { t as Route } from "./routes-ClZEdsnB.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/routes-D5jJJ-30.js
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { E as useSession } from "./SocialLinks-Cm4H8pUJ.mjs";
+import { t as SignIn } from "./SignIn-DEGrvJvb.mjs";
+import { t as DashboardView } from "./DashboardView-C2LdV6J0.mjs";
+import { t as Route } from "./routes-BulNEUEE.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-Wjexi35W.js
 var import_jsx_runtime = require_jsx_runtime();
 /**
 * The home route. Under the auth gate it is now a THIN redirect to the explicit

package/.output/server/_ssr/runDiff-Ba8Lg1vg.mjs

@@ -0,0 +1,2 @@
+import { _ as computeRunDiff } from "./boot-sNlIkoLe.mjs";
+export { computeRunDiff };