@kky42/pievo-server 2.4.1 → 2.4.4

package/.output/server/_ssr/{boot-BbWxaF-z.mjs → boot-sNlIkoLe.mjs}

@@ -11,7 +11,7 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
-//#region node_modules/.nitro/vite/services/ssr/assets/boot-BbWxaF-z.js
+//#region node_modules/.nitro/vite/services/ssr/assets/boot-sNlIkoLe.js
 var import_pino = /* @__PURE__ */ __toESM(require_pino());
 var import_pino_pretty = /* @__PURE__ */ __toESM(require_pino_pretty());
 function defineErrorCodes(codes) {
@@ -1430,9 +1430,8 @@ function coerceCodingAgent(value) {
 * (postgres-js on Supabase; embedded pglite for local/self-host + tests) — the
 * query-builder API is identical, only `db/index.ts` branches the driver.
 *
-* Timestamps are ISO strings (`text`) for portability (no db-side defaults).
-* JSON columns use `jsonb().$type<>()` for typed
-* (de)serialization. Booleans use native `boolean()`.
+* Timestamp values are represented as ISO strings across both drivers. JSON
+* columns use `jsonb().$type<>()`; booleans use native `boolean()`.
 */
 var machines = pgTable("machines", {
 	/** m-sha256(deviceToken)[:16] */
@@ -1737,7 +1736,6 @@ var runSnapshots = pgTable("run_snapshots", {
 	manifest: jsonb("manifest").$type().notNull(),
 	createdAt: text("created_at").notNull()
 }, (t) => [index("run_snapshots_loop_idx").on(t.loopId)]);
-sql`1`;
 var user = pgTable("user", {
 	id: text("id").primaryKey(),
 	name: text("name").notNull(),
@@ -2854,8 +2852,7 @@ async function listMachines(teamId) {
 /**
 * Machines usable/visible in a team, MEMBERSHIP-scoped: every machine whose owner
 * belongs to the team (join `machines.userId` → a `team_members` row for this
-* team). One machine therefore appears in every team its owner is a member of —
-* the decoupling that lets a single daemon serve multiple teams (report §2.3).
+* team). One machine therefore appears in every team its owner belongs to.
 * A user has at most one membership row per team, so no machine is duplicated.
 */
 async function listMachinesForTeam(teamId) {
@@ -2889,9 +2886,7 @@ function teamIdForUser(userId) {
 }
 var ensuredTeams = /* @__PURE__ */ new Set();
 /** Idempotently create a team (+ owner membership) if absent. The email-derived
-*  `name` is INSERT-ONLY — it seeds a brand-new personal team but is NEVER synced
-*  onto an existing row, so an owner's `renameTeam` on their personal team sticks
-*  (design decision 5 / §6: the old force-rename silently reverted manual renames).
+*  `name` seeds only a new personal team, so later owner renames persist.
 *  Memoized ⇒ at most one reconcile per team per process. The team insert +
 *  membership insert are one atomic transaction. */
 async function ensureTeam(id, name, ownerUserId) {
@@ -2919,8 +2914,7 @@ async function ensureTeam(id, name, ownerUserId) {
 function newTeamId() {
 	return `team-${randomUUID().slice(0, 12)}`;
 }
-/** Is this the user's undeletable personal team (`team-<ownerUserId>`)? The
-*  requestScope fallback, so it can be renamed (decision 5) but never deleted/left. */
+/** Whether this is the user's renamable but undeletable personal team. */
 function isPersonalTeam(team) {
 	return !!team.ownerUserId && team.id === teamIdForUser(team.ownerUserId);
 }
@@ -2971,8 +2965,7 @@ async function listTeamMembers(teamId) {
 		displayName: r.displayName ?? null
 	})).sort((a, b) => a.role === b.role ? a.createdAt < b.createdAt ? -1 : 1 : a.role === "owner" ? -1 : 1);
 }
-/** Resolve a user by email (case-insensitive) — the direct-add-by-email fast path
-*  (design §4 option A). Undefined ⇒ no account yet (invite-link path instead). */
+/** Resolve a user by email for direct membership; undefined means no account yet. */
 async function userByEmail(email) {
 	const r = (await db.select({
 		id: user.id,
@@ -3030,9 +3023,8 @@ async function setTeamMemberRoleGuarded(teamId, userId, role) {
 }
 /**
 * Delete a team and its dependents, transactionally. The CALLER enforces the
-* policy guards first (personal-team undeletable; blocked while the team still
-* owns loops — design decision 1, no cascade of loop history). We RE-CHECK the
-* loop count INSIDE the transaction and abort (`has-loops`) if any loop exists,
+* policy guards first (personal-team undeletable; blocked while the team owns loops).
+* The transaction rechecks the loop count and aborts (`has-loops`) if one exists,
 * closing the check-then-cascade gap where a loop created between the caller's
 * guard and here would be orphaned at a now-deleted team. On success we cascade
 * the team's own resources: pending invites, memberships, and reassign
@@ -3394,7 +3386,7 @@ function parseArtifactSyncBody(value) {
 }
 /**
 * Machine + run credential helpers. Device tokens (`dk_…`) identify a machine
-* (its id is derived from the token: `m-sha256(token)[:16]`, BYOA §2). A RUN
+* (its id is derived from the token: `m-sha256(token)[:16]`). A run
 * LEASE (`rk_…`) is minted per delivery, bound to one run, and carries the
 * run's least-privilege caps — the CLI dispatch authorizes the `pievo` shim
 * against it. Its lifecycle is a small state machine (`active` →
@@ -3403,10 +3395,9 @@ function parseArtifactSyncBody(value) {
 *
 * Leases and connect-key bindings are DURABLE (run_leases / connect_keys
 * tables): they must survive a deploy, or every restart 401s the in-flight
-* runs' callbacks/finalize and silently mis-files a post-restart paste into the
-* machine's home team. The short-lived UI correlations (`claimResults`) and the
-* 15-min `new` idempotency window stay in-process (accepted restart gaps —
-* losing one only degrades a dialog wait / a retry dedupe, never data).
+* runs' callbacks/finalize and silently mis-files a post-restart create into the
+* machine's home team. The 15-minute `new` idempotency window stays in-process;
+* losing it only degrades retry deduplication, never persisted data.
 */
 function sha256(s) {
 	return createHash("sha256").update(s).digest("hex");
@@ -3465,9 +3456,7 @@ async function getDeviceOwner(machineId, now = Date.now()) {
 	return row.userId;
 }
 /** How long a terminal-grace lease stays alive to accept one late wake-report.
-*  Generous on purpose: a laptop can sleep overnight or across a weekend before the
-*  daemon resumes and delivers the run's real result. (Subsumes the former
-*  `RECLAIM_GRACE_MS`.) */
+*  A laptop can sleep overnight or across a weekend before the daemon resumes. */
 var TERMINAL_GRACE_MS = 1440 * 60 * 1e3;
 /** Leases live in the `run_leases` table, keyed by sha256(full `rk_…` wire
 * token), so a deploy is invisible to an in-flight run and a DB leak never hands
@@ -3545,17 +3534,6 @@ function readNewIdempotency(key, machineId, now = Date.now()) {
 	if (rec.machineId !== machineId) return void 0;
 	return rec.loopId;
 }
-var claimResults = /* @__PURE__ */ new Map();
-function fulfillClaim(token, result) {
-	claimResults.set(token, result);
-}
-/** Read-and-consume: the dialog polls until it sees the result once, then closes —
-*  so we evict on first read to keep the map from growing one dead entry per loop. */
-function readClaim(token) {
-	const r = claimResults.get(token);
-	if (r) claimResults.delete(token);
-	return r;
-}
 /**
 * Derive a machine's presence from its stored `online` flag + `lastSeen` stamp.
 * `online` requires BOTH the flag and a fresh stamp (the stored flag lags the
@@ -4159,18 +4137,11 @@ async function authenticateDeviceToken(deviceToken, options = {}) {
 		machine
 	};
 }
-/** A double-quoted string is needed when the bare token would be ambiguous inside a
-*  `key: value` line or a comma-delimited row: an empty string, or one carrying
-*  whitespace, a comma, a colon, or a double-quote. This matches gh-axi's observable
-*  behavior (every value it leaves bare is a single delimiter-free token; anything
-*  with a space/comma/colon it quotes). */
+/** Whether a token needs quoting inside a key/value line or comma-delimited row. */
 function needsQuote(s) {
 	return s === "" || /[\s,:"]/.test(s);
 }
-/** Always wrap a string in double quotes, escaping backslashes, quotes, and newlines
-*  so the value survives on a single line (`\n` rendered as two chars, like gh-axi's
-*  body field). Used for error messages (always quoted, per gh-axi) and by `scalar`
-*  when quoting is required. */
+/** Quote and escape a string so it remains on one line. */
 function quote(s) {
 	return `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r?\n/g, "\\n")}"`;
 }
@@ -4203,8 +4174,7 @@ function detailBlock(topKey, rows) {
 	}
 	return lines.join("\n");
 }
-/** The `count:` aggregate line (P4). `total` → `count: N of TOTAL total` (a windowed
-*  survey); `showing` → `count: N (showing first SHOWING)`; else `count: N`. */
+/** Render a count, optionally with total or displayed-window context. */
 function countLine(count, opts = {}) {
 	if (opts.total !== void 0) return `count: ${count} of ${opts.total} total`;
 	if (opts.showing !== void 0) return `count: ${count} (showing first ${opts.showing})`;
@@ -4224,22 +4194,16 @@ function listBlock(name, fields, rows) {
 	for (const row of rows) lines.push(`  ${row.map(scalar).join(",")}`);
 	return lines.join("\n");
 }
-/** A definitive empty collection (P5): the bare `name: []` line. Pair with
-*  `countLine(0)` for the full `count: 0` + `name: []` empty state. */
+/** Render an empty named collection. */
 function emptyList(name) {
 	return `${name}: []`;
 }
-/**
-* A contextual-disclosure help block (P9): `help[N]:` then each command template
-* indented two spaces, verbatim (they carry backticks + `<placeholders>`).
-*/
+/** Render command templates as an indented help block. */
 function helpBlock(lines) {
 	return [`help[${lines.length}]:`, ...lines.map((l) => `  ${l}`)].join("\n");
 }
 /**
-* A structured error (P6): the message (always quoted) plus a bare machine-readable
-* slug, both to stdout. Slugs: VALIDATION_ERROR, FORBIDDEN, NOT_FOUND, CONFLICT,
-* UNAUTHORIZED, RATE_LIMITED, ERROR.
+* Render a quoted error plus a machine-readable code.
 *
 *   error: "status must be keep|no-change|block (got \"wibble\")"
 *   code: VALIDATION_ERROR
@@ -4247,7 +4211,7 @@ function helpBlock(lines) {
 function errorBlock(message, code) {
 	return `error: ${quote(message)}\ncode: ${code}`;
 }
-/** The axi error-code slug for an HTTP status (P6). */
+/** Map an HTTP status to its CLI error code. */
 function codeForStatus(status) {
 	switch (status) {
 		case 400: return "VALIDATION_ERROR";
@@ -4259,13 +4223,7 @@ function codeForStatus(status) {
 		default: return "ERROR";
 	}
 }
-/**
-* Content truncation with a size hint (P3). A string within `cap` passes through
-* unchanged; a longer one is clipped to `cap` chars and gets the hint appended INSIDE
-* the value (so a caller can quote the whole thing as one field, like gh-axi's body).
-* `tail` is the escape-hatch phrasing — the full `use --full to see complete body`
-* for a detail body, or a terse `use --full` for a dense list cell.
-*/
+/** Clip content at `cap` and append its original size plus recovery hint. */
 function truncate(text, cap, tail = "use --full to see complete body") {
 	if (text.length <= cap) return {
 		value: text,
@@ -4723,6 +4681,29 @@ function daemonNeedsUpdate(current, required = MIN_DAEMON_VERSION) {
 function daemonUpgradeCommand() {
 	return "npm install -g @kky42/pievo@latest && pievo daemon restart";
 }
+var POLL_INFO_FIELDS = new Set([
+	"host",
+	"platform",
+	"arch",
+	"version"
+]);
+var POLL_V4_REQUEST_FIELDS = new Set([
+	"protocolVersion",
+	"currentRuns",
+	"daemonInstanceId",
+	"recoveryComplete",
+	"info"
+]);
+var POLL_HTTP_BODY_FIELDS = new Set([
+	...POLL_INFO_FIELDS,
+	"protocolVersion",
+	"currentRuns",
+	"daemonInstanceId",
+	"recoveryComplete"
+]);
+var validPollWireId = (value) => typeof value === "string" && value.length <= 200 && value.trim().length > 0 && !value.includes("\0");
+var validPollCurrentRun = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 2 && Object.prototype.hasOwnProperty.call(value, "runId") && Object.prototype.hasOwnProperty.call(value, "stage") && validPollWireId(value.runId) && (value.stage === "executing" || value.stage === "reporting");
+var validPollInfo = (value) => value === void 0 || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).every((key) => POLL_INFO_FIELDS.has(key)) && validOptionalPollString(value.host, 524288) && validOptionalPollString(value.platform, 524288) && validOptionalPollString(value.arch, 524288) && validOptionalPollString(value.version, 64);
 /**
 * Machine gateway - the run-lifecycle core of the HTTP surface the daemon talks
 * to (poll transport: short-poll while a run is in flight, opt-in server-held
@@ -5138,25 +5119,8 @@ var MachineGateway = class {
 	}
 	/** Protocol-v4 poll: plural local state, one new delivery per poll. */
 	async pollV4(deviceToken, request) {
-		const validWireId = (value) => typeof value === "string" && value.length <= 200 && value.trim().length > 0 && !value.includes("\0");
-		const validCurrent = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 2 && Object.prototype.hasOwnProperty.call(value, "runId") && Object.prototype.hasOwnProperty.call(value, "stage") && validWireId(value.runId) && (value.stage === "executing" || value.stage === "reporting");
-		const requestFields = new Set([
-			"protocolVersion",
-			"currentRuns",
-			"daemonInstanceId",
-			"recoveryComplete",
-			"info"
-		]);
-		const infoFields = new Set([
-			"host",
-			"platform",
-			"arch",
-			"version"
-		]);
 		const rawRequest = request;
-		const rawInfo = rawRequest?.info;
-		const infoValid = rawInfo === void 0 || rawInfo !== null && typeof rawInfo === "object" && !Array.isArray(rawInfo) && Object.keys(rawInfo).every((key) => infoFields.has(key)) && validOptionalPollString(rawInfo.host, 524288) && validOptionalPollString(rawInfo.platform, 524288) && validOptionalPollString(rawInfo.arch, 524288) && validOptionalPollString(rawInfo.version, 64);
-		if (request === null || typeof request !== "object" || Array.isArray(request) || Object.keys(rawRequest).some((key) => !requestFields.has(key)) || !infoValid || rawRequest.protocolVersion !== void 0 && (typeof rawRequest.protocolVersion !== "number" || !Number.isInteger(rawRequest.protocolVersion)) || rawRequest.currentRuns !== void 0 && (!Array.isArray(rawRequest.currentRuns) || rawRequest.currentRuns.some((run) => !validCurrent(run))) || rawRequest.daemonInstanceId !== void 0 && !validWireId(rawRequest.daemonInstanceId) || rawRequest.recoveryComplete !== void 0 && typeof rawRequest.recoveryComplete !== "boolean") return {
+		if (request === null || typeof request !== "object" || Array.isArray(request) || Object.keys(rawRequest).some((key) => !POLL_V4_REQUEST_FIELDS.has(key)) || !validPollInfo(rawRequest?.info) || rawRequest.protocolVersion !== void 0 && (typeof rawRequest.protocolVersion !== "number" || !Number.isInteger(rawRequest.protocolVersion)) || rawRequest.currentRuns !== void 0 && (!Array.isArray(rawRequest.currentRuns) || rawRequest.currentRuns.some((run) => !validPollCurrentRun(run))) || rawRequest.daemonInstanceId !== void 0 && !validPollWireId(rawRequest.daemonInstanceId) || rawRequest.recoveryComplete !== void 0 && typeof rawRequest.recoveryComplete !== "boolean") return {
 			status: 400,
 			body: {
 				error: "invalid poll request",
@@ -5179,7 +5143,7 @@ var MachineGateway = class {
 				}
 			};
 		}
-		if (!Array.isArray(request.currentRuns) || request.currentRuns.some((run) => !validCurrent(run))) return {
+		if (!Array.isArray(request.currentRuns) || request.currentRuns.some((run) => !validPollCurrentRun(run))) return {
 			status: 400,
 			body: {
 				error: "invalid currentRuns",
@@ -5193,7 +5157,7 @@ var MachineGateway = class {
 				code: "VALIDATION_ERROR"
 			}
 		};
-		if (!validWireId(request.daemonInstanceId)) return {
+		if (!validPollWireId(request.daemonInstanceId)) return {
 			status: 400,
 			body: {
 				error: "a valid daemonInstanceId is required",
@@ -5279,12 +5243,8 @@ var MachineGateway = class {
 			}
 		};
 	}
-	/**
-	* Create a loop from Claude Code (Bearer device token). The user perfected the
-	* task in their own Claude Code session, then — per SKILL.md — claude authors
-	* the loop config and POSTs it here. Binds the loop to the token's machine and
-	* schedules it immediately. The web's New-loop dialog is just waiting on this.
-	*/
+	/** Create a validated loop through device authority, bind it to that machine,
+	* and schedule it immediately. */
 	async createLoop(deviceToken, body) {
 		const auth = await authenticateDeviceToken(deviceToken);
 		if (!auth.ok) return auth.response;
@@ -5360,12 +5320,6 @@ var MachineGateway = class {
 				...row
 			});
 			this.scheduler.addLoop(loop);
-			if (typeof claim === "string") fulfillClaim(claim, {
-				loopId: loop.id,
-				name: loop.name,
-				machineId,
-				agent: loop.agent
-			});
 			recordNewIdempotency(idempotencyKey, machineId, loop.id);
 			log$2.info({
 				machineId,
@@ -5383,10 +5337,8 @@ var MachineGateway = class {
 			};
 		}
 	}
-	/** List the loops bound to this machine, for `pievo loops`. The default columns
-	*  are the minimal `{id,name,cron,enabled,nextFire}` (P2); `--fields` extends them
-	*  from the optional set, and an unknown field fails loud (P6, VALIDATION_ERROR).
-	*  `--json` (OQ4) is the escape hatch: the full structured records as real JSON
+	/** List loops bound to this machine. `--fields` extends the minimal default
+	*  columns and rejects unknown names. `--json` returns full structured records
 	*  (first byte `[`), mirroring `show --json` — the daemon prints `text` either way. */
 	async listLoops(deviceToken, fieldsFlag, json) {
 		const auth = await authenticateDeviceToken(deviceToken);
@@ -5499,10 +5451,6 @@ var MachineGateway = class {
 			};
 		}
 	}
-	/** Read a New-loop claim's result (the web dialog polls this while waiting). */
-	claimStatus(token) {
-		return readClaim(token);
-	}
 	async rejectRetiredConflict(runToken, lease, body, payloadDigest) {
 		const ackBody = {
 			ok: true,
@@ -5878,8 +5826,7 @@ function fmtTimeZoned(iso, timezone, opts = {}) {
 		return fmtTime(iso);
 	}
 }
-/** `pievo loops` default columns (P2 — minimal): identity + the two things an
-*  agent scans for (schedule + when it next fires). */
+/** Minimal default columns for `pievo loops`. */
 var LIST_DEFAULT_FIELDS = [
 	"id",
 	"name",
@@ -5888,7 +5835,7 @@ var LIST_DEFAULT_FIELDS = [
 	"nextFire"
 ];
 /** The optional columns `--fields` may add (the "available" set an unknown field is
-*  measured against, §4.2). `runs`/`lastResult` are derived per loop. */
+*  measured against). `runs`/`lastResult` are derived per loop. */
 var LIST_OPTIONAL_FIELDS = [
 	"timezone",
 	"model",
@@ -5912,7 +5859,7 @@ function loopCell(rec, field) {
 		default: return null;
 	}
 }
-/** `pievo loops` — the typed loop list (P2/P4/P5/P9). Columns = the default set
+/** Render the typed loop list. Columns are the default set
 *  plus any `--fields` extras (validated + resolved by `listLoops`). */
 function renderLoopsText(loops, fields) {
 	if (!loops.length) return doc(countLine(0), emptyList("loops"), helpBlock(["Run `pievo new --json '{...}'` to create your first loop", "Run `pievo daemon start` if this machine isn't connected yet"]));
@@ -7016,7 +6963,7 @@ var CliGateway = class {
 		return renderShowText(loop, loopEnvelope(loop), await countRuns(loop.id), recent[0] ?? null, opts);
 	}
 	/**
-	* `pievo` (bare) — the content-first home for a DEVICE credential (P8/§5.1). The
+	* Bare `pievo` renders the home for a device credential. The
 	* daemon passes the local facts it alone knows as context flags (`--cwd`/`--home`
 	* for directory scoping, `--bin`/`--pid`/`--server` for the header); the server owns
 	* the whole TOON render (text-sink). An unregistered machine renders a DEFINITIVE
@@ -7053,9 +7000,7 @@ var CliGateway = class {
 };
 /** Shared refusal for terminal-report-only grace after reclaim. */
 var TERMINAL_GRACE_MSG = "this run is terminal and no longer accepts commands; its final result is delivered via the terminal report";
-/** Verbs that require OWNER (device) authority — a run credential is 403'd on these
-*  in the unified `cli` dispatch (§4.1). `report` is the mirror image
-*  (run-only, 403 for a device credential) and are handled inline in `deviceCli`. */
+/** Verbs that require device authority. `report` is run-only and rejected there. */
 var DEVICE_ONLY_VERBS = new Set([
 	"new",
 	"edit",
@@ -7102,7 +7047,7 @@ function parseJsonFlag(raw) {
 		value: obj
 	};
 }
-/** A structured error result to STDOUT (P6): `error:`/`code:` TOON as the verb `text`.
+/** A structured `error:`/`code:` TOON result for stdout.
 *  Mirrors the `{code, text}` shape `dispatch` returns; the slug defaults from the
 *  HTTP status but a caller may pin it (e.g. CONFLICT). */
 function derr(code, message, slug) {
@@ -7115,7 +7060,7 @@ function derr(code, message, slug) {
 * `text` and exits with `exitCode`; two structured channels remain because the
 * current daemon reads them as data:
 *   - `loops`: the daemon resolves cwd→loop CLIENT-side (`log`/`show`/`home`) from this
-*     list — the server's `log`/`show` dispatch needs an explicit id (design §3).
+*     list; the server's `log`/`show` dispatch needs an explicit id.
 *   - `runs`: the `log --json` normalized-data escape hatch. */
 var CLI_RETAINED_KEYS = new Set([
 	"text",
@@ -7138,7 +7083,7 @@ function finalizeCli(res) {
 	}
 	return res;
 }
-/** `pievo report` — the compact run-status confirmation (§4.6). */
+/** Render the compact run-status confirmation. */
 function renderReportedText(status, hasMessage) {
 	const parts = [];
 	if (status) parts.push(`status=${status}`);
@@ -7205,7 +7150,7 @@ var DEVICE_VERB_HELP = {
 		help: ["Run `pievo log <id> --json` for structured history", "Run `pievo log <id> --run 12 --diff` for bounded run detail and artifact diff"]
 	}
 };
-/** Render a verb's `--help` (P10). A run lease selects the report-only help;
+/** Render per-verb help. A run lease selects the report-only help;
 *  no lease means the device (owner) surface. Returns undefined for a verb
 *  with no help spec, so the caller falls back to its unknown-command handling. */
 function verbHelpText(verb, lease) {
@@ -7231,11 +7176,7 @@ function nextFireDisplay(loop) {
 	if (!iso) return "(never)";
 	return fmtTimeZoned(iso, schedule.timezone, { seconds: true });
 }
-/**
-* `pievo show` — the full editable envelope TOON (F1/F6, feedback #1/#2, §4.1).
-* The `loop:` block keys are EXACTLY `edit --json`'s keys (read/write identity),
-* then the read-only derived aggregates (`nextFire`/`lifecycle`/`runs`).
-*/
+/** `pievo show` renders the editable envelope followed by derived read-only state. */
 function renderShowText(loop, env, totalRuns, lastRun, opts = {}) {
 	const full = opts.full === true;
 	const block = detailBlock("loop", [
@@ -7259,8 +7200,7 @@ function renderShowText(loop, env, totalRuns, lastRun, opts = {}) {
 	];
 	return doc(block, kvLine("nextFire", nextFireDisplay(loop)), `lifecycle: ${loop.enabled ? "active" : "paused"}`, `runs: ${runsTally}`, !loop.enabled ? kvLine("pauseCause", loop.pauseCause?.kind === "failure-streak" ? `failure-streak (run ${loop.pauseCause.runId}, count ${loop.pauseCause.count})` : loop.pauseCause?.kind === "blocked" ? `blocked (run ${loop.pauseCause.runId})` : loop.pauseCause?.kind === "owner" ? "owner" : "unknown") : null, lastRun?.reportIncident ? kvLine("reportIncident", `${lastRun.reportIncident.code} · ${lastRun.reportIncident.faultDomain} · ${lastRun.reportIncident.reason}`) : null, helpBlock(help));
 }
-/** The static one-line description in the home header (mirrors the reference axi
-*  tools' `description:` line — what this bin is for). */
+/** The static one-line description in the home header. */
 var HOME_DESCRIPTION = "Run your scheduled Pievo agent loops on this machine with your own coding agent.";
 /** Expand a leading `~/` against the daemon-supplied home dir (the SERVER's own home
 *  is irrelevant — a loop's paths are the daemon machine's). Absent home ⇒ unchanged. */
@@ -7273,7 +7213,7 @@ function scopeLoopDir(workdir, home) {
 }
 /**
 * Partition a machine's loops into the ones rooted at (or under) `cwd` — the
-* directory-scoped ambient context P8 wants — and a count of the rest. With no cwd
+* directory-scoped ambient context and a count of the rest. With no cwd
 * (or none matching), ALL loops are "here" (elsewhere 0): a home run from an
 * unrelated directory still shows the whole machine rather than nothing.
 */
@@ -7308,7 +7248,7 @@ async function recentMachineRuns(loops, n) {
 	rows.sort((a, b) => a.ts < b.ts ? 1 : a.ts > b.ts ? -1 : 0);
 	return rows.slice(0, n);
 }
-/** The device home (P8/§5.1): `bin:`/`description:`/`machine:` header, the cwd-scoped
+/** The device home: `bin:`/`description:`/`machine:` header, the cwd-scoped
 *  loop list, recent runs, and a `help[]`. `presence` null ⇒ the machine is not
 *  registered → a DEFINITIVE "not connected" state (never empty, never an error). */
 function renderHomeText(ctx, presence, here, elsewhere, recent) {
@@ -7440,9 +7380,6 @@ var Scheduler = class {
 		}
 		return advanced;
 	}
-	async runningIds() {
-		return [...new Set((await openRuns()).filter((r) => r.phase === "running").map((r) => r.loopId))];
-	}
 	async enqueue(id, request) {
 		const result = await enqueueRun(id, request);
 		if ("run" in result) {
@@ -7646,4 +7583,4 @@ async function getCliGateway() {
 	return (await ensureServer()).cliGateway;
 }
 //#endregion
-export { isDynamicBaseURLConfig as $, ensureServer as A, rememberConnectKey as At, getGateway as B, startLoop as Bt, createTeam as C, normalizePathname as Ct, deleteInvite as D, readJsonBody as Dt, defu as E, readByteBody as Et, getArtifactSync as F, resolveBaseURL as Ft, getOrigin as G, tryDeleteLoop as Gt, getInvite as H, stopLoop as Ht, getBaseURL as I, safeRelPath as It, getTeam as J, userByEmail as Jt, getProtocol as K, updateLoop as Kt, getBooleanEnvVar as L, scheduleFromLoop as Lt, env as M, renameTeam as Mt, forceDeleteLoop as N, requestDeleteLoop as Nt, deleteMachine as O, reconciliationStatesForRuns as Ot, getArtifactFile as P, requestRunCancel as Pt, isDevelopment as Q, getCliGateway as R, setTeamMemberRoleGuarded as Rt, createMachine as S, mintDeviceToken as St, db as T, pauseLoop as Tt, getLoop as U, teamIdForUser as Ut, getHost as V, statusDefinitionsFromLoop as Vt, getMachine as W, toKebabCase as Wt, hasPendingRun as X, validateLoopEdit as Xt, getTeamMember as Y, validOptionalPollString as Yt, hasRunningRun as Z, wildcardMatch as Zt, countLoopsForTeam as _, logger as _t, BetterAuthError as a, isTeamMember as at, createFetch as b, machineIdFromToken as bt, ENV as c, listArtifacts as ct, SYNC_BODY_CAP as d, listMachinesForTeam as dt, isOutdated as et, ValidationError$1 as f, listPendingInvites as ft, computeRunDiff as g, listTeamsForUser as gt, capitalizeFirstLetter as h, listTeamMembers as ht, BLOB_CAP as i, isSafeUrlScheme as it, ensureTeam as j, removeTeamMemberGuarded as jt, deleteTeamCascade as k, redeemInviteAtomic as kt, MACHINE_BODY_CAP as l, listLoops as lt, betterFetch as m, listRunsBefore as mt, APIError$1 as n, isProduction as nt, BetterCallError as o, isTest as ot, addTeamMember as p, listRuns as pt, getRun as q, updateMachine as qt, BASE_ERROR_CODES as r, isRequestLike as rt, CODING_AGENTS as s, kAPIErrorHeaderSymbol as st, APIError as t, isPersonalTeam as tt, MIN_DAEMON_VERSION as u, listMachines as ut, countRuns as v, loginGateEnabled as vt, daemonNeedsUpdate as w, parseArtifactSyncBody as wt, createInvite as x, machinePresence as xt, createDefu as y, loopsForMachine as yt, getEnvVar as z, sha256 as zt };
+export { isDevelopment as $, validateLoopEdit as $t, deleteTeamCascade as A, redeemInviteAtomic as At, getEnvVar as B, sha256 as Bt, createMachine as C, mintDeviceToken as Ct, defu as D, readByteBody as Dt, db as E, pauseLoop as Et, getArtifactFile as F, requestRunCancel as Ft, getMachine as G, toKebabCase as Gt, getHost as H, statusDefinitionsFromLoop as Ht, getArtifactSync as I, resolveBaseURL as It, getRun as J, updateMachine as Jt, getOrigin as K, tryDeleteLoop as Kt, getBaseURL as L, safeRelPath as Lt, ensureTeam as M, removeTeamMemberGuarded as Mt, env as N, renameTeam as Nt, deleteInvite as O, readJsonBody as Ot, forceDeleteLoop as P, requestDeleteLoop as Pt, hasRunningRun as Q, validPollWireId as Qt, getBooleanEnvVar as R, scheduleFromLoop as Rt, createInvite as S, machinePresence as St, daemonNeedsUpdate as T, parseArtifactSyncBody as Tt, getInvite as U, stopLoop as Ut, getGateway as V, startLoop as Vt, getLoop as W, teamIdForUser as Wt, getTeamMember as X, validOptionalPollString as Xt, getTeam as Y, userByEmail as Yt, hasPendingRun as Z, validPollCurrentRun as Zt, computeRunDiff as _, listTeamsForUser as _t, BetterAuthError as a, isSafeUrlScheme as at, createDefu as b, loopsForMachine as bt, ENV as c, kAPIErrorHeaderSymbol as ct, POLL_HTTP_BODY_FIELDS as d, listMachines as dt, wildcardMatch as en, isDynamicBaseURLConfig as et, SYNC_BODY_CAP as f, listMachinesForTeam as ft, capitalizeFirstLetter as g, listTeamMembers as gt, betterFetch as h, listRunsBefore as ht, BLOB_CAP as i, isRequestLike as it, ensureServer as j, rememberConnectKey as jt, deleteMachine as k, reconciliationStatesForRuns as kt, MACHINE_BODY_CAP as l, listArtifacts as lt, addTeamMember as m, listRuns as mt, APIError$1 as n, isPersonalTeam as nt, BetterCallError as o, isTeamMember as ot, ValidationError$1 as p, listPendingInvites as pt, getProtocol as q, updateLoop as qt, BASE_ERROR_CODES as r, isProduction as rt, CODING_AGENTS as s, isTest as st, APIError as t, isOutdated as tt, MIN_DAEMON_VERSION as u, listLoops as ut, countLoopsForTeam as v, logger as vt, createTeam as w, normalizePathname as wt, createFetch as x, machineIdFromToken as xt, countRuns as y, loginGateEnabled as yt, getCliGateway as z, setTeamMemberRoleGuarded as zt };

package/.output/server/_ssr/{bun-sqlite-dialect-BW9W1_Ps-8MIh9jN1.mjs → bun-sqlite-dialect-BW9W1_Ps-DmlZWqO7.mjs}

@@ -1,6 +1,6 @@
-import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-CPCDf6Wr.mjs";
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-C0zoZCGe.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/bun-sqlite-dialect-BW9W1_Ps-8MIh9jN1.js
+//#region node_modules/.nitro/vite/services/ssr/assets/bun-sqlite-dialect-BW9W1_Ps-DmlZWqO7.js
 var BunSqliteAdapter = class {
 	get supportsCreateIfNotExists() {
 		return true;

package/.output/server/_ssr/{d1-sqlite-dialect-BLC8LXE6-CcMQ01_d.mjs → d1-sqlite-dialect-BLC8LXE6-CCNzqZwZ.mjs}

@@ -1,6 +1,6 @@
-import { a as SqliteQueryCompiler, i as SqliteAdapter } from "./auth-CPCDf6Wr.mjs";
+import { a as SqliteQueryCompiler, i as SqliteAdapter } from "./auth-C0zoZCGe.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/d1-sqlite-dialect-BLC8LXE6-CcMQ01_d.js
+//#region node_modules/.nitro/vite/services/ssr/assets/d1-sqlite-dialect-BLC8LXE6-CCNzqZwZ.js
 var D1SqliteAdapter = class extends SqliteAdapter {};
 var D1SqliteDriver = class {
 	#config;

package/.output/server/_ssr/db-CwLD-5w1.mjs

@@ -0,0 +1,2 @@
+import { E as db } from "./boot-sNlIkoLe.mjs";
+export { db };

package/.output/server/_ssr/{dist-AxCsRawm.mjs → dist-B3SxDOpW.mjs}

@@ -1,5 +1,5 @@
-import { _ as logger, o as createAdapterFactory } from "./factory-S7MaMVC2.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/dist-AxCsRawm.js
+import { _ as logger, o as createAdapterFactory } from "./factory-Dv3Zopis.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/dist-B3SxDOpW.js
 /**
 * Case-insensitive in-memory comparison helpers.
 * Used when evaluating where clauses in the memory adapter.

package/.output/server/_ssr/{factory-S7MaMVC2.mjs → factory-Dv3Zopis.mjs}

@@ -1,5 +1,5 @@
-import { M as env, a as BetterAuthError, z as getEnvVar } from "./boot-BbWxaF-z.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/factory-S7MaMVC2.js
+import { B as getEnvVar, N as env, a as BetterAuthError } from "./boot-sNlIkoLe.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/factory-Dv3Zopis.js
 var __defProp = Object.defineProperty;
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {

package/.output/server/_ssr/{invite._token-B1UgMbNQ.mjs → invite._token-AvtAuDKv.mjs}

@@ -1,18 +1,10 @@
 import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { r as LoadErrorCard } from "./actionUi-D15R8L7R.mjs";
+import { r as LoadErrorCard } from "./actionUi-DD7Cd7Le.mjs";
 import { f as useRouter } from "../_libs/@tanstack/react-router+[...].mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-B1UgMbNQ.js
+//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-AvtAuDKv.js
 var import_jsx_runtime = require_jsx_runtime();
-/**
-* Invite-link redeem (`/invite/<token>`, design §4 option B). The recipient opens
-* the link the owner shared; if signed out (under the gate) they hit the normal
-* gated GitHub sign-in and return here — the invite NEVER bypasses the login
-* allowlist (decision 3), it only grants membership once they already have an
-* account. On redeem we navigate to the team's dashboard.
-*
-* Open mode has no identities, so an invite is meaningless there — it renders a
-* calm explanation rather than a broken redeem.
-*/
+/** Redeem a team invite after normal gated sign-in. Invites grant membership but
+* never bypass the login allowlist; open mode has no invite identity to redeem. */
 function LoadError({ error }) {
 	const router = useRouter();
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {

package/.output/server/_ssr/{invite._token-BliJIGk4.mjs → invite._token-CHR5K84a.mjs}

@@ -1,18 +1,10 @@
 import { c as createFileRoute, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
-import { d as getAuthState, i as authClient } from "./SocialLinks-BTjsnVOm.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-BliJIGk4.js
-var $$splitErrorComponentImporter = () => import("./invite._token-B1UgMbNQ.mjs");
-var $$splitComponentImporter = () => import("./invite._token-D296YVGd.mjs");
-/**
-* Invite-link redeem (`/invite/<token>`, design §4 option B). The recipient opens
-* the link the owner shared; if signed out (under the gate) they hit the normal
-* gated GitHub sign-in and return here — the invite NEVER bypasses the login
-* allowlist (decision 3), it only grants membership once they already have an
-* account. On redeem we navigate to the team's dashboard.
-*
-* Open mode has no identities, so an invite is meaningless there — it renders a
-* calm explanation rather than a broken redeem.
-*/
+import { i as authClient, u as getAuthState } from "./SocialLinks-Bt7huqfS.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-CHR5K84a.js
+var $$splitErrorComponentImporter = () => import("./invite._token-AvtAuDKv.mjs");
+var $$splitComponentImporter = () => import("./invite._token-tw3mgvEo.mjs");
+/** Redeem a team invite after normal gated sign-in. Invites grant membership but
+* never bypass the login allowlist; open mode has no invite identity to redeem. */
 var Route = createFileRoute("/invite/$token")({
 	ssr: false,
 	loader: async ({ params }) => {

package/.output/server/_ssr/{invite._token-D296YVGd.mjs → invite._token-tw3mgvEo.mjs}

@@ -1,25 +1,17 @@
 import { o as __toESM } from "../_runtime.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { s as btnPrimary } from "./ui-DmFKW2H_.mjs";
+import { s as btnPrimary } from "./ui-dMEI4sHj.mjs";
 import { d as useNavigate } from "../_libs/@tanstack/react-router+[...].mjs";
-import { D as useSession, r as PievoLogo } from "./SocialLinks-BTjsnVOm.mjs";
+import { E as useSession, r as PievoLogo } from "./SocialLinks-Bt7huqfS.mjs";
 import { t as setActiveTeamCookie } from "./teamCookie-B7hLOIie.mjs";
-import { c as redeemTeamInvite } from "./teamFns-DcoVuWyH.mjs";
-import { t as Route } from "./invite._token-BliJIGk4.mjs";
-import { t as SignIn } from "./SignIn-DjSrg0nO.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-D296YVGd.js
+import { c as redeemTeamInvite } from "./teamFns-gilVwh7z.mjs";
+import { t as Route } from "./invite._token-CHR5K84a.mjs";
+import { t as SignIn } from "./SignIn-ffgDY0yf.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/invite._token-tw3mgvEo.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
-/**
-* Invite-link redeem (`/invite/<token>`, design §4 option B). The recipient opens
-* the link the owner shared; if signed out (under the gate) they hit the normal
-* gated GitHub sign-in and return here — the invite NEVER bypasses the login
-* allowlist (decision 3), it only grants membership once they already have an
-* account. On redeem we navigate to the team's dashboard.
-*
-* Open mode has no identities, so an invite is meaningless there — it renders a
-* calm explanation rather than a broken redeem.
-*/
+/** Redeem a team invite after normal gated sign-in. Invites grant membership but
+* never bypass the login allowlist; open mode has no invite identity to redeem. */
 function Shell({ children }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: "mx-auto mt-32 max-w-sm text-center",

package/.output/server/_ssr/{kysely-adapter-DUdpqcCJ.mjs → kysely-adapter-nL7WKSgw.mjs}

@@ -1,2 +1,2 @@
-import { r as kyselyAdapter, t as createKyselyAdapter } from "./auth-CPCDf6Wr.mjs";
+import { r as kyselyAdapter, t as createKyselyAdapter } from "./auth-C0zoZCGe.mjs";
 export { createKyselyAdapter, kyselyAdapter };