@kky42/pievo-server 2.4.11 → 2.4.13

package/.output/server/_ssr/{MachinesModal-BhRw7oOx.mjs → MachinesModal-DBIP648Z.mjs}

@@ -1,64 +1,25 @@
 import { o as __toESM } from "../_runtime.mjs";
-import { tt as isOutdated, xt as machinePresence } from "./boot-BIxtZHU-.mjs";
+import { G as isOutdated, ct as machinePresence } from "./boot-U-CFI65B.mjs";
 import { a as DialogClose, c as TooltipPopup, d as TooltipTrigger, f as TooltipRoot, g as require_react, h as require_jsx_runtime, i as DialogPopup, l as TooltipPositioner, n as DialogRoot, o as DialogBackdrop, r as DialogPortal, t as DialogTitle, u as TooltipPortal } from "../_libs/@base-ui/react+[...].mjs";
 import { n as createServerFn } from "./ssr.mjs";
-import { d as getConfig, o as createSsrRpc } from "./SocialLinks-DVCLmql0.mjs";
-import { C as scheduleText, D as until, O as useHydrated, _ as inputCls, a as btn, b as rel, d as dotLabel, f as dotOpacity, h as fnum, m as fmt, o as btnDanger, p as dur, r as Pill, s as btnPrimary, t as ErrorBanner, u as dotColor, v as labelCls, w as sectionHeadCls, x as runPulseAnim, y as lastRunOf } from "./ui-DGz-q9MT.mjs";
-import { t as ConfirmBar } from "./actionUi-Cf6DuEC2.mjs";
-import { i as lifecyclePresentation, n as daemonStopSupport } from "./lifecycleUi-DauKavgx.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/MachinesModal-BhRw7oOx.js
+import { g as lifecyclePresentation, o as createSsrRpc, p as getConfig, s as daemonStopSupport } from "./auth-client-RTpMpT4L.mjs";
+import { A as until, C as rel, D as sectionHeadCls, E as scheduleText, M as useHydrated, S as lastRunOf, _ as fmt, b as inputCls, c as btn, g as dur, h as dotOpacity, l as btnDanger, m as dotLabel, n as ErrorBanner, o as Pill, p as dotColor, t as ConfirmBar, u as btnPrimary, v as fnum, w as runPulseAnim, x as labelCls } from "./actionUi-C_WswNb1.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/MachinesModal-DBIP648Z.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 /**
-* Machine management server functions. Connect flow (two acts):
-*   1. createMachine() → mint a token, create a PENDING (unnamed) row, return
-*      {id, token}. The UI shows the connect command + "waiting…".
-*   2. the daemon connects → poll records online + hostname/platform/arch. The
-*      UI polls machineStatus(id); once connected it shows the name field
-*      (prefilled with the hostname). finalizeMachine({id,name}) names it →
-*      it appears in the list. cancelMachine(id) drops a pending row.
-*
-* Scoping: when the auth gate is on, every fn requires a signed-in user, and a
-* machine is visible/actionable only when the requester owns it, its owner is a
-* member of the active team, or the scope is the admin "All teams" view (the
-* same rule listMachines filters by). The PLAINTEXT device token is serialized
-* ONLY to the machine's owner — it fully impersonates the machine (poll /
-* create-loop / log), so a teammate who can see the row must never exfiltrate
-* it. Open mode (gate off) keeps the shared workspace: everyone sees/manages
-* all machines, tokens included. No workdir jail (fully open) for now.
+* Machine-management server functions. In auth mode, the signed-in user is the
+* sole human authorization boundary. Open mode intentionally shares all machine
+* administration, including reconnect tokens.
 */
-/** Ids of the machines membership-visible in the scope's active team (the same
-*  set listMachines serves). Empty when the scope needs no team check (open
-*  mode or signed-out — machineInScope settles those before ever invoking its
-*  team-set thunk). */
-/**
-* Resolve a machine and authorize it against the request scope (the machine-fn
-* twin of loopApi's `ownedLoop`). `machine` is undefined when it's missing OR
-* out of scope — callers treat both as "not found" so existence never leaks.
-* The scope rides along so callers don't re-run requestScope (a second session
-* decrypt); the team-set thunk keeps the owner fast path query-free.
-*/
-/** Named machines only (pending/unnamed rows are mid-connect). Scoped to the
-*  given/active team when the gate is on; the full shared list in open mode. An
-*  explicit `teamId` (the `/t/<id>` route) scopes this request independent of the
-*  cookie, so a tab on /t/A and one on /t/B list different machines at once. */
-var listMachines = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(createSsrRpc("aa46310016bb8a58b273a648ffd498c87f1f450d12827e30110a3b83ba6a27d9"));
-/** Act 1 — create a pending machine + token, owned by the signed-in user's team.
-*  An explicit `teamId` (the `/t/<id>` route) binds the machine to that tab's team
-*  independent of the last-used cookie, mirroring `mintClaim`/`listMachines`. */
-var createMachine = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createSsrRpc("ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415"));
-/** Poll while the connect dialog is open. Scoped like listMachines; the token
-*  rides along only for the machine's owner (the connect dialog's minter). */
+/** Missing and out-of-scope machines both resolve to undefined. */
+var listMachines = createServerFn({ method: "GET" }).handler(createSsrRpc("aa46310016bb8a58b273a648ffd498c87f1f450d12827e30110a3b83ba6a27d9"));
+var createMachine = createServerFn({ method: "POST" }).handler(createSsrRpc("ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415"));
 var machineStatus = createServerFn({ method: "GET" }).validator((id) => id).handler(createSsrRpc("169566e7637a22599b4eb32ee3775574e99677406922bbef7482a102036c33dd"));
-var finalizeMachine = createServerFn({ method: "POST" }).validator((d) => d).handler(createSsrRpc("27d7eba0b6a2257949392fdd56057275a5c5366484ae01faf3b5897a225ecd83"));
+var finalizeMachine = createServerFn({ method: "POST" }).validator((data) => data).handler(createSsrRpc("27d7eba0b6a2257949392fdd56057275a5c5366484ae01faf3b5897a225ecd83"));
 /**
-* Cancel a pending connect or delete a machine and all of its server-owned data.
-* Each loop goes through forceDeleteLoop so execution authority is retired and
-* history/artifact metadata is removed. Nothing reaches into the machine's cwd.
-*
-* A teammate may still remove an empty machine as before. Cascading loops is
-* stronger: under the auth gate the caller must own every affected loop team,
-* matching the authority required to force-retire those teams' run leases.
+* Delete server-owned machine data without touching local project files. The
+* store rechecks ownership under the deletion lock in auth mode.
 */
 var deleteMachine = createServerFn({ method: "POST" }).validator((id) => id).handler(createSsrRpc("a6384dc7154d9930422d29396f5de64b3ac69c62ad3824bc4a22d745fc07b293"));
 /** Merge two chronological (oldest-first) run lists, dedup by id (the first
@@ -403,7 +364,7 @@ function machineOrder(a, b) {
 		sensitivity: "base"
 	}) || a.id.localeCompare(b.id);
 }
-function MachinesModal({ open, onClose, teamId }) {
+function MachinesModal({ open, onClose }) {
 	const [machines, setMachines] = (0, import_react.useState)([]);
 	const [pending, setPending] = (0, import_react.useState)(null);
 	const [status, setStatus] = (0, import_react.useState)(null);
@@ -435,10 +396,10 @@ function MachinesModal({ open, onClose, teamId }) {
 	const load = (0, import_react.useCallback)(async () => {
 		const request = ++loadRequest.current;
 		try {
-			const next = await listMachines({ data: teamId });
+			const next = await listMachines();
 			if (request === loadRequest.current) setMachines([...next].sort(machineOrder));
 		} catch {}
-	}, [teamId]);
+	}, []);
 	const openRef = (0, import_react.useRef)(open);
 	openRef.current = open;
 	(0, import_react.useEffect)(() => {
@@ -474,7 +435,7 @@ function MachinesModal({ open, onClose, teamId }) {
 		setBusy(true);
 		setDelErr(null);
 		try {
-			const r = await createMachine({ data: teamId });
+			const r = await createMachine();
 			if ("error" in r) {
 				setDelErr(r.error);
 				return;
@@ -756,4 +717,4 @@ function MachinesModal({ open, onClose, teamId }) {
 	});
 }
 //#endregion
-export { ModalSection as a, listMachines as c, ModalHead as i, mergeRuns as l, MachinesModal as n, Timeline as o, Modal as r, daemonConnectCommand as s, LoopOverview as t };
+export { Timeline as a, mergeRuns as c, ModalHead as i, MachinesModal as n, daemonConnectCommand as o, Modal as r, listMachines as s, LoopOverview as t };

package/.output/server/_ssr/{SignIn-BhoZIOUp.mjs → SignIn-Bp3uWaCQ.mjs}

@@ -1,7 +1,7 @@
 import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-import { S as signIn, n as GitHubIcon, r as PievoLogo, t as GITHUB_URL } from "./SocialLinks-DVCLmql0.mjs";
-import { s as btnPrimary } from "./ui-DGz-q9MT.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/SignIn-BhoZIOUp.js
+import { C as signIn, a as PievoLogo, n as GITHUB_URL, r as GitHubIcon } from "./auth-client-RTpMpT4L.mjs";
+import { u as btnPrimary } from "./actionUi-C_WswNb1.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/SignIn-Bp3uWaCQ.js
 var import_jsx_runtime = require_jsx_runtime();
 /**
 * Sign-in CTA — shown by the auth gate when a GitHub OAuth app is configured and

package/.output/server/_ssr/{ui-DGz-q9MT.mjs → actionUi-C_WswNb1.mjs}

@@ -1,6 +1,6 @@
 import { o as __toESM } from "../_runtime.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/ui-DGz-q9MT.js
+//#region node_modules/.nitro/vite/services/ssr/assets/actionUi-C_WswNb1.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 var fmt = (t) => t ? new Date(t).toLocaleString() : "—";
@@ -242,5 +242,116 @@ function StatusPill({ run, colorText }) {
 		}), dotLabel(run)]
 	});
 }
+/**
+* First-load failure card — the calm "couldn't load X" + Retry the dashboard,
+* loop page, and run page all show instead of a raw error dump. One shared
+* markup so the three screens can't drift.
+*/
+function LoadErrorCard({ title, detail, onRetry }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		className: "rounded-card border border-hairline bg-surface px-6 py-8 shadow-card",
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "text-[14px] text-accent",
+				children: title
+			}),
+			detail && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "mt-1 text-meta text-secondary",
+				children: detail
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				type: "button",
+				onClick: onRetry,
+				className: "mt-3 cursor-pointer border-none bg-transparent p-0 text-label font-medium text-interactive underline underline-offset-2 hover:text-display",
+				children: "Retry"
+			})
+		]
+	});
+}
+/**
+* In-panel guard — the Nothing-styled stand-in for native confirm(). Owns its
+* own a11y so the caller just renders it when armed: focus lands on the CTA,
+* Esc cancels, Enter (CTA focused) confirms. Render with `key={kind}` so it
+* remounts (and re-focuses) per guard.
+*/
+function ConfirmBar({ prompt, note, cta, danger, busy, onConfirm, onCancel }) {
+	const ctaRef = (0, import_react.useRef)(null);
+	(0, import_react.useEffect)(() => {
+		ctaRef.current?.focus();
+	}, []);
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		role: "group",
+		"aria-label": prompt,
+		onKeyDown: (e) => {
+			if (e.key === "Escape" && !busy) onCancel();
+		},
+		className: "flex flex-wrap items-center gap-x-4 gap-y-2.5 rounded-control border border-hairline bg-raised px-4 py-3",
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "min-w-0",
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "text-body font-medium text-display",
+				children: prompt
+			}), note && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "mt-0.5 text-meta text-secondary",
+				children: note
+			})]
+		}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+			className: "ml-auto flex items-center gap-2.5",
+			children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				ref: ctaRef,
+				className: danger ? btnDanger : btnPrimary,
+				disabled: busy,
+				onClick: onConfirm,
+				children: busy ? "Working…" : cta
+			}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				className: btn,
+				disabled: busy,
+				onClick: onCancel,
+				children: "Cancel"
+			})]
+		})]
+	});
+}
+/**
+* Transient peak-end acknowledgement (✓ done / ✕ gone), announced to AT via
+* aria-live. Self-clearing is the caller's concern (see `useFlash`); this is
+* pure presentation. No outer margin — wrap at the call site for spacing.
+*/
+function FlashLine({ label, tone = "ok", onUndo }) {
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+		role: "status",
+		"aria-live": "polite",
+		className: "inline-flex items-center gap-2 text-label font-medium text-secondary",
+		style: { animation: "fadeIn 0.2s ease-out" },
+		children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+				"aria-hidden": true,
+				className: tone === "gone" ? "text-accent" : "text-success",
+				children: tone === "gone" ? "✕" : "✓"
+			}),
+			label,
+			onUndo && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+				type: "button",
+				onClick: onUndo,
+				className: "cursor-pointer border-none bg-transparent p-0 text-label font-medium text-interactive underline underline-offset-2 transition-colors hover:text-display",
+				children: "Undo"
+			})
+		]
+	});
+}
+/**
+* Flash state + its self-clear timer in one unit. `hold` wins; else an Undo
+* flash lingers ~6s (reachable), a bare "done" fades after ~2.2s. Fade, don't
+* slide.
+*/
+function useFlash() {
+	const [flash, setFlash] = (0, import_react.useState)(null);
+	(0, import_react.useEffect)(() => {
+		if (!flash) return;
+		const t = setTimeout(() => setFlash(null), flash.hold ?? (flash.undo ? 6e3 : 2200));
+		return () => clearTimeout(t);
+	}, [flash]);
+	return [flash, setFlash];
+}
 //#endregion
-export { scheduleText as C, until as D, tsShort as E, useHydrated as O, runPulseStyle as S, selectCls as T, inputCls as _, btn as a, rel as b, btnQuiet as c, dotLabel as d, dotOpacity as f, humanBytes as g, fnum as h, StatusPill as i, btnSm as l, fmt as m, Loading as n, btnDanger as o, dur as p, Pill as r, btnPrimary as s, ErrorBanner as t, dotColor as u, labelCls as v, sectionHeadCls as w, runPulseAnim as x, lastRunOf as y };
+export { until as A, rel as C, sectionHeadCls as D, scheduleText as E, useHydrated as M, selectCls as O, lastRunOf as S, runPulseStyle as T, fmt as _, Loading as a, inputCls as b, btn as c, btnQuiet as d, btnSm as f, dur as g, dotOpacity as h, LoadErrorCard as i, useFlash as j, tsShort as k, btnDanger as l, dotLabel as m, ErrorBanner as n, Pill as o, dotColor as p, FlashLine as r, StatusPill as s, ConfirmBar as t, btnPrimary as u, fnum as v, runPulseAnim as w, labelCls as x, humanBytes as y };

package/.output/server/_ssr/{artifactFiles-ChuJ4PzC.mjs → artifactFiles-BvVmixrs.mjs}

@@ -1,6 +1,6 @@
-import { F as getArtifactFile, I as getArtifactSync, Lt as safeRelPath, lt as listArtifacts } from "./boot-BIxtZHU-.mjs";
-import { n as toArtifactSummary } from "./loopProjection-DIpGR6rp.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/artifactFiles-ChuJ4PzC.js
+import { O as getArtifactFile, Z as listArtifacts, k as getArtifactSync, xt as safeRelPath } from "./boot-U-CFI65B.mjs";
+import { n as toArtifactSummary } from "./loopProjection-DMSNHux6.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/artifactFiles-BvVmixrs.js
 /**
 * Server-side reads over a loop's current exact artifacts. Pure helpers
 * (no request/session context) so they're shared by the lazy server fns

package/.output/server/_ssr/{artifactKind-DXumOv7c.mjs → artifactKind-DRCbYHZU.mjs}

@@ -1,27 +1,19 @@
 import { c as createFileRoute, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
-import { i as authClient, u as getAuthState } from "./SocialLinks-DVCLmql0.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/artifactKind-DXumOv7c.js
-var $$splitComponentImporter = () => import("./loops._loopId-B5iPseDG.mjs");
+import { f as getAuthState } from "./auth-client-RTpMpT4L.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/artifactKind-DRCbYHZU.js
+var $$splitComponentImporter = () => import("./loops._loopId-Q4pRYPip.mjs");
 /**
 * Loop detail page — `/loops/$loopId`: a loop header and action toolbar, the
 * exact artifact Files panel, and the runs timeline. The view owns its own
 * data + self-poll (ssr:false so the session cookie rides along with its fetches,
 * like the dashboard loader). Run rows link on to `/loops/$loopId/runs/$runId`.
 *
-* Auth-gated exactly like the dashboard (`/`): the loader checks getAuthState +
-* the session so a logged-out/expired DEEP LINK shows the sign-in CTA instead of
-* a raw `loop not found` error from the ownership-blocked data fetch.
+* Auth-gated exactly like the dashboard (`/`): Better Auth's session hook keeps a
+* logged-out or expired deep link from mounting the ownership-scoped data view.
 */
 var Route = createFileRoute("/loops/$loopId")({
 	ssr: false,
-	loader: async () => {
-		const auth = await getAuthState();
-		if (auth.enabled) {
-			const { data: session } = await authClient.getSession();
-			if (!session) return { auth };
-		}
-		return { auth };
-	},
+	loader: async () => ({ auth: await getAuthState() }),
 	component: lazyRouteComponent($$splitComponentImporter, "component")
 });
 /** Extension → MIME for the image types we serve inline. This is an ALLOWLIST:

package/.output/server/_ssr/artifacts-CzDJLaa6.mjs

@@ -0,0 +1,2 @@
+import { dt as parseArtifactSyncBody, f as SYNC_BODY_CAP, i as BLOB_CAP } from "./boot-U-CFI65B.mjs";
+export { BLOB_CAP, SYNC_BODY_CAP, parseArtifactSyncBody };

package/.output/server/_ssr/{auth-LwPp_iim.mjs → auth-BV0MxVdo.mjs}

@@ -1,6 +1,6 @@
 import { C as notInArray, S as ne, _ as isNotNull, b as lt, d as and, f as eq, g as inArray, h as ilike, j as sql, l as asc, m as gte, p as gt, s as count, u as desc, v as isNull$1, w as or, x as lte, y as like } from "../_libs/drizzle-orm+postgres.mjs";
-import { $ as isDevelopment, B as getEnvVar, Ct as normalizePathname, D as defu, E as db, H as getHost, It as resolveBaseURL, K as getOrigin, L as getBaseURL, M as env, R as getBooleanEnvVar, Wt as teamIdForUser, a as BetterAuthError, b as createDefu, c as ENV, ct as kAPIErrorHeaderSymbol, en as wildcardMatch, et as isDynamicBaseURLConfig, g as capitalizeFirstLetter, h as betterFetch, it as isRequestLike, j as ensureTeam, n as APIError$1, o as BetterCallError, ot as isTeamMember, p as ValidationError$1, q as getProtocol, r as BASE_ERROR_CODES, rt as isProduction, st as isTest, t as APIError } from "./boot-BIxtZHU-.mjs";
-import { C as withSpan, S as shouldPublishLog, _ as logger, a as __getBetterAuthGlobal, b as runWithTransaction, c as createRandomStringGenerator, d as getAuthTables, f as getBetterAuthVersion, g as initGetModelName, h as initGetFieldName, l as generateId$2, m as import_src, n as ATTR_HOOK_TYPE, o as createAdapterFactory, p as getCurrentAdapter, r as ATTR_OPERATION_ID, s as createLogger, t as ATTR_CONTEXT, u as getAsyncLocalStorage, v as queueAfterTransactionHook, x as safeJSONParse, y as runWithAdapter } from "./factory-pBwrjVTI.mjs";
+import { A as getBaseURL, C as defu, F as getHost, Ft as wildcardMatch, K as isProduction, N as getEnvVar, R as getOrigin, S as db, T as env, U as isDevelopment, W as isDynamicBaseURLConfig, X as kAPIErrorHeaderSymbol, Y as isTest, a as BetterAuthError, at as loginGateEnabled, bt as resolveBaseURL, c as ENV, h as capitalizeFirstLetter, j as getBooleanEnvVar, m as betterFetch, n as APIError$1, o as BetterCallError, p as ValidationError$1, q as isRequestLike, r as BASE_ERROR_CODES, t as APIError, ut as normalizePathname, v as createDefu, z as getProtocol } from "./boot-U-CFI65B.mjs";
+import { C as withSpan, S as shouldPublishLog, _ as logger, a as __getBetterAuthGlobal, b as runWithTransaction, c as createRandomStringGenerator, d as getAuthTables, f as getBetterAuthVersion, g as initGetModelName, h as initGetFieldName, l as generateId$2, m as import_src, n as ATTR_HOOK_TYPE, o as createAdapterFactory, p as getCurrentAdapter, r as ATTR_OPERATION_ID, s as createLogger, t as ATTR_CONTEXT, u as getAsyncLocalStorage, v as queueAfterTransactionHook, x as safeJSONParse, y as runWithAdapter } from "./factory-DYFx1fg-.mjs";
 import { randomBytes, scrypt } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -1700,7 +1700,7 @@ var JOIN_TYPE_SQL = freeze({
 	Using: "using"
 });
 //#endregion
-//#region node_modules/.nitro/vite/services/ssr/assets/auth-LwPp_iim.js
+//#region node_modules/.nitro/vite/services/ssr/assets/auth-BV0MxVdo.js
 /**
 * @internal
 */
@@ -15993,7 +15993,7 @@ var createKyselyAdapter = async (config) => {
 	if ("getConnection" in db) dialect = new MysqlDialect(db);
 	if ("connect" in db) dialect = new PostgresDialect({ pool: db });
 	if ("fileControl" in db) {
-		const { BunSqliteDialect } = await import("./bun-sqlite-dialect-BW9W1_Ps-CHMDkKqA.mjs");
+		const { BunSqliteDialect } = await import("./bun-sqlite-dialect-BW9W1_Ps-D9KUBJ-L.mjs");
 		dialect = new BunSqliteDialect({ database: db });
 	}
 	if ("createSession" in db) {
@@ -16009,12 +16009,12 @@ var createKyselyAdapter = async (config) => {
 			if (error !== null && typeof error === "object" && "code" in error && error.code !== "ERR_UNKNOWN_BUILTIN_MODULE") throw error;
 		}
 		if (DatabaseSync && db instanceof DatabaseSync) {
-			const { NodeSqliteDialect } = await import("./node-sqlite-dialect-Dho9YjXb.mjs");
+			const { NodeSqliteDialect } = await import("./node-sqlite-dialect-B_g92oFK.mjs");
 			dialect = new NodeSqliteDialect({ database: db });
 		}
 	}
 	if ("batch" in db && "exec" in db && "prepare" in db) {
-		const { D1SqliteDialect } = await import("./d1-sqlite-dialect-BLC8LXE6-DYum6qky.mjs");
+		const { D1SqliteDialect } = await import("./d1-sqlite-dialect-BLC8LXE6-CVHRzH1n.mjs");
 		dialect = new D1SqliteDialect({ database: db });
 	}
 	return {
@@ -36526,7 +36526,7 @@ async function getBaseAdapter(options, handleDirectDatabase) {
 			acc[key] = [];
 			return acc;
 		}, {});
-		const { memoryAdapter } = await import("./dist-bWqs5sTy.mjs");
+		const { memoryAdapter } = await import("./dist-D7UDVZ5G.mjs");
 		adapter = memoryAdapter(memoryDB)(options);
 	} else if (typeof options.database === "function") adapter = options.database(options);
 	else adapter = await handleDirectDatabase(options);
@@ -36540,10 +36540,10 @@ async function getBaseAdapter(options, handleDirectDatabase) {
 }
 async function getAdapter(options) {
 	return getBaseAdapter(options, async (opts) => {
-		const { createKyselyAdapter } = await import("./kysely-adapter-DMf5pFTf.mjs");
+		const { createKyselyAdapter } = await import("./kysely-adapter-CwdB7yBh.mjs");
 		const { kysely, databaseType, transaction } = await createKyselyAdapter(opts);
 		if (!kysely) throw new BetterAuthError("Failed to initialize database adapter");
-		const { kyselyAdapter } = await import("./kysely-adapter-DMf5pFTf.mjs");
+		const { kyselyAdapter } = await import("./kysely-adapter-CwdB7yBh.mjs");
 		return kyselyAdapter(kysely, {
 			type: databaseType || "sqlite",
 			debugLogs: opts.database && "debugLogs" in opts.database ? opts.database.debugLogs : false,
@@ -38278,40 +38278,23 @@ var drizzleAdapter = (db, config) => {
 	};
 };
 /**
-* The GitHub login-gate condition, in ONE place. `auth.ts` derives its load-time
-* `authEnabled` const from this; the machine-enrollment guard (`gateway/index.ts`
-* `poll`) calls it LIVE so the gated-vs-open behavior can be exercised in a test
-* (which sets the env vars per-case) without pulling betterAuth into the machine
-* hot path. Leaf module — no imports, no side effects.
-*
-* The gate is ON exactly when a GitHub OAuth app is configured (both id + secret).
-* OFF ⇒ open/dev mode (single shared workspace, anonymous self-registration).
-*/
-function loginGateEnabled() {
-	return !!(process.env.GITHUB_CLIENT_ID?.trim() && process.env.GITHUB_CLIENT_SECRET?.trim());
-}
-/**
-* Better Auth with GitHub social login. Supplying the GitHub OAuth credentials
-* enables authentication; `PIEVO_ALLOWED_LOGINS` optionally narrows who may sign
-* in. Authenticated data is team-scoped, while `userId` retains creator/owner
-* attribution. With no GitHub credentials the local server runs in open mode.
+* Better Auth with GitHub social login. Supplying GitHub OAuth credentials
+* enables authentication; `PIEVO_ALLOWED_LOGINS` optionally narrows who may
+* sign in. Auth mode isolates data by signed-in user. Without GitHub
+* credentials, the server is one shared open-mode workspace.
 */
 var clientId = process.env.GITHUB_CLIENT_ID?.trim();
 var clientSecret = process.env.GITHUB_CLIENT_SECRET?.trim();
-/** Auth is enforced only when a GitHub OAuth app is configured. Single source of
-*  the condition is `loginGateEnabled()` — the machine-enrollment guard reads it
-*  live so the two can never drift. */
+/** Keep the web-session gate and machine-enrollment gate on one live condition. */
 var authEnabled = loginGateEnabled();
 var authSecret = process.env.PIEVO_AUTH_SECRET?.trim();
 if (authEnabled && !authSecret) throw new Error("PIEVO_AUTH_SECRET must be set when the GitHub login gate is enabled (GITHUB_CLIENT_ID/SECRET present) — refusing to fall back to the public dev secret.");
-var allowlist = (process.env.PIEVO_ALLOWED_LOGINS || "").split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
 /**
-* Whether an email may sign in. An empty allowlist means "allow anyone" (open
-* mode). Each allowlist entry is either a full email (exact match) or a DOMAIN
-* WILDCARD — `@example.com` or `*@example.com` — matching any address at that
-* domain (so `*@example.com` admits the whole team without listing each one).
+* An empty allowlist permits any GitHub-authenticated user. Entries may be full
+* email addresses or domain wildcards (`@example.com` or `*@example.com`).
 */
 function emailAllowed(email) {
+	const allowlist = (process.env.PIEVO_ALLOWED_LOGINS || "").split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
 	if (!allowlist.length) return true;
 	const e = (email || "").toLowerCase();
 	const at = e.indexOf("@");
@@ -38319,97 +38302,41 @@ function emailAllowed(email) {
 	const domain = e.slice(at);
 	return allowlist.some((entry) => entry === e || entry === domain || entry.startsWith("*@") && entry.slice(1) === domain);
 }
-function teamNameForEmail(email) {
-	const local = (email || "").split("@")[0]?.trim();
-	return local ? `${local}'s Team` : "Personal Team";
+function rejectDisallowedEmail(email) {
+	throw new APIError("FORBIDDEN", { message: `${(email || "").trim().toLowerCase() || "this account"} is not on the Pievo allowlist` });
 }
-var TEAM_COOKIE = "pievo.team";
-/**
-* The signed-in user (id + email) for the current server-fn request, or null when
-* no session. Reads the request via TanStack's async-local context, so it only
-* works inside a server fn / server route handler.
-*/
+/** The Better Auth user for the current server request, or null without a session. */
 async function currentUser() {
 	const { getRequest } = await import("./ssr.mjs").then((n) => n.i).then((n) => n.t);
-	const u = (await auth.api.getSession({ headers: getRequest().headers }))?.user;
-	return u ? {
-		id: u.id,
-		email: u.email ?? null
+	const user = (await auth.api.getSession({ headers: getRequest().headers }))?.user;
+	return user ? {
+		id: user.id,
+		email: user.email ?? null
 	} : null;
 }
 async function currentUserId() {
 	return (await currentUser())?.id ?? null;
 }
-async function selectedTeam() {
-	const { getRequest } = await import("./ssr.mjs").then((n) => n.i).then((n) => n.t);
-	const raw = getRequest().headers.get("cookie") || "";
-	const v = new RegExp(`(?:^|;\\s*)${TEAM_COOKIE}=([^;]+)`).exec(raw)?.[1];
-	return v ? decodeURIComponent(v) : null;
-}
 /**
-* Per-request data scope. Machines and loops are scoped by `teamId`.
-* The active team is resolved from (in precedence order) an EXPLICIT team — the
-* `/t/<teamId>` route param, so a tab/bookmark pins its own team independent of
-* any cookie; otherwise the `pievo.team` cookie (only a last-used
-* default hint). Either source is VALIDATED here against membership, never
-* trusted blind, and falls back to the user's personal team.
-*
-* `explicitTeam` (when a non-empty string) wins over the cookie. An unauthorized
-* value falls through to the personal team exactly like a stale cookie, so the
-* caller can detect rejection by comparing the returned `teamId` to what it asked
-* for (see `canViewTeam` in loopApi) without this ever leaking another team's data.
-*/
-async function requestScope(explicitTeam) {
-	const enforce = authEnabled;
-	if (!enforce) {
-		const teamId = teamIdForUser(null);
-		await ensureTeam(teamId, "Shared Workspace", null);
-		return {
-			enforce,
-			userId: null,
-			teamId
-		};
-	}
-	const user = await currentUser();
-	const userId = user?.id ?? null;
-	const personalTeam = teamIdForUser(userId);
-	await ensureTeam(personalTeam, userId ? teamNameForEmail(user?.email) : "Shared Workspace", userId);
-	const sel = explicitTeam != null && explicitTeam !== "" ? explicitTeam : await selectedTeam();
-	if (sel && sel !== personalTeam && userId) {
-		if (await isTeamMember(sel, userId)) return {
-			enforce,
-			userId,
-			teamId: sel
-		};
-	}
+* Auth mode uses the signed-in user as the sole tenant boundary. Open mode is
+* intentionally unscoped and does not perform a session lookup.
+*/
+async function requestScope() {
+	if (!authEnabled) return {
+		enforce: false,
+		userId: null
+	};
 	return {
-		enforce,
-		userId,
-		teamId: personalTeam
+		enforce: true,
+		userId: await currentUserId()
 	};
 }
 /**
-* Whether the request may view/act on a loop, by its owning team. The single
-* source for loop authorization, shared by the server fns (`ownedLoop`) and the
-* artifact download route so the gate can't drift between them.
-*
-* Authorization is by MEMBERSHIP in the loop's own team — NOT by the loop merely
-* matching the caller's active team. A user who belongs to team B can open a
-* direct link to a team-B loop while their active team is A, instead of getting a
-* spurious "not found" (the cross-team-link bug). Rules:
-*  - open mode ⇒ the single shared workspace, everything visible;
-*  - the active team is a no-DB fast path (requestScope already membership-
-*    validated the active-team cookie);
-*  - otherwise the user must be a MEMBER of the loop's team.
-* Async because the membership fall-through is a store lookup. A non-member (and a
-* signed-out request) is denied, indistinguishable from a nonexistent loop.
-*/
-async function canAccessLoop(loopTeamId, scope) {
-	const { enforce, teamId, userId } = scope;
-	if (!enforce) return true;
-	if (loopTeamId === teamId) return true;
-	if (!loopTeamId || !userId) return false;
-	return isTeamMember(loopTeamId, userId);
+* Shared loop authorization used by server functions and raw artifact serving.
+* A denied loop and an absent loop must remain externally indistinguishable.
+*/
+function canAccessLoop(loopUserId, scope) {
+	return !scope.enforce || !!scope.userId && loopUserId === scope.userId;
 }
 var auth = betterAuth({
 	baseURL: process.env.PIEVO_BASE_URL || "http://127.0.0.1:3000",
@@ -38419,17 +38346,10 @@ var auth = betterAuth({
 		clientId,
 		clientSecret
 	} } : {},
-	databaseHooks: { user: { create: {
-		before: async (user) => {
-			if (!emailAllowed(user.email)) throw new APIError("FORBIDDEN", { message: `${(user.email || "").toLowerCase()} is not on the Pievo allowlist` });
-			return { data: user };
-		},
-		after: async (user) => {
-			try {
-				await ensureTeam(teamIdForUser(user.id), teamNameForEmail(user.email), user.id);
-			} catch {}
-		}
-	} } }
+	databaseHooks: { user: { create: { before: async (user) => {
+		if (!emailAllowed(user.email)) rejectDisallowedEmail(user.email);
+		return { data: user };
+	} } } }
 });
 //#endregion
-export { SqliteQueryCompiler as a, auth, authEnabled, canAccessLoop, currentUserId, SqliteAdapter as i, DefaultQueryCompiler as n, CompiledQuery as o, kyselyAdapter as r, requestScope, sql$1 as s, createKyselyAdapter as t };
+export { SqliteQueryCompiler as a, auth, authEnabled, canAccessLoop, SqliteAdapter as i, DefaultQueryCompiler as n, CompiledQuery as o, kyselyAdapter as r, requestScope, sql$1 as s, createKyselyAdapter as t };