@kky42/pievo-server 2.4.11 → 2.4.13

package/.output/server/_ssr/{boot-BIxtZHU-.mjs → boot-U-CFI65B.mjs}

@@ -11,7 +11,7 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import os from "node:os";
 import fs$1 from "node:fs/promises";
-//#region node_modules/.nitro/vite/services/ssr/assets/boot-BIxtZHU-.js
+//#region node_modules/.nitro/vite/services/ssr/assets/boot-U-CFI65B.js
 var import_pino = /* @__PURE__ */ __toESM(require_pino());
 var import_pino_pretty = /* @__PURE__ */ __toESM(require_pino_pretty());
 function defineErrorCodes(codes) {
@@ -1433,7 +1433,6 @@ function coerceCodingAgent(value) {
 var machines = pgTable("machines", {
 	id: text("id").primaryKey(),
 	userId: text("user_id").notNull(),
-	teamId: text("team_id").notNull(),
 	name: text("name").notNull(),
 	hostname: text("hostname"),
 	platform: text("platform"),
@@ -1445,18 +1444,17 @@ var machines = pgTable("machines", {
 	/**
 	* Plaintext device token. Stored so the UI can re-show the connect command
 	* anytime (MVP convenience — deviates from "store only the hash"; acceptable
-	* for a self-hosted team tool where the DB is already the trust root).
+	* for a self-hosted control plane where the DB is already the trust root).
 	*/
 	token: text("token"),
 	roots: jsonb("roots").$type(),
 	lastSeen: text("last_seen"),
 	online: boolean("online").notNull().default(false),
 	createdAt: text("created_at").notNull()
-}, (t) => [index("machines_user_idx").on(t.userId), index("machines_team_idx").on(t.teamId)]);
+}, (t) => [index("machines_user_idx").on(t.userId)]);
 var loops = pgTable("loops", {
 	id: text("id").primaryKey(),
 	userId: text("user_id").notNull(),
-	teamId: text("team_id").notNull(),
 	/** Execution machine (set at creation; no cross-machine fallback). */
 	machineId: text("machine_id").notNull(),
 	name: text("name").notNull(),
@@ -1498,7 +1496,6 @@ var loops = pgTable("loops", {
 	updatedAt: text("updated_at").notNull()
 }, (t) => [
 	index("loops_user_idx").on(t.userId),
-	index("loops_team_idx").on(t.teamId),
 	index("loops_machine_idx").on(t.machineId),
 	index("delete_requested_loops").on(t.deleteRequestedAt).where(sql`${t.deleteRequestedAt} IS NOT NULL`),
 	check("loops_agent_check", sql`${t.agent} IN ('claude-code', 'codex', 'pi')`),
@@ -1611,38 +1608,9 @@ var terminalReportIncidents = pgTable("terminal_report_incidents", {
 var connectKeys = pgTable("connect_keys", {
 	machineId: text("machine_id").primaryKey(),
 	userId: text("user_id").notNull(),
-	teamId: text("team_id").notNull(),
 	/** Mint time (ISO) — drives the TTL. */
 	mintedAt: text("minted_at").notNull()
 });
-var teams = pgTable("teams", {
-	id: text("id").primaryKey(),
-	name: text("name").notNull(),
-	ownerUserId: text("owner_user_id"),
-	createdAt: text("created_at").notNull()
-});
-var teamMembers = pgTable("team_members", {
-	id: text("id").primaryKey(),
-	teamId: text("team_id").notNull(),
-	userId: text("user_id").notNull(),
-	role: text("role", { enum: ["owner", "member"] }).notNull().default("member"),
-	createdAt: text("created_at").notNull()
-}, (t) => [
-	index("team_members_team_idx").on(t.teamId),
-	index("team_members_user_idx").on(t.userId),
-	check("team_members_role_check", sql`${t.role} IN ('owner', 'member')`)
-]);
-var teamInvites = pgTable("team_invites", {
-	token: text("token").primaryKey(),
-	teamId: text("team_id").notNull(),
-	role: text("role", { enum: ["owner", "member"] }).notNull().default("member"),
-	invitedByUserId: text("invited_by_user_id").notNull(),
-	expiresAt: text("expires_at").notNull(),
-	/** Single-use stamp: set on redeem so the same link can't be reused. */
-	redeemedAt: text("redeemed_at"),
-	redeemedByUserId: text("redeemed_by_user_id"),
-	createdAt: text("created_at").notNull()
-}, (t) => [index("team_invites_team_idx").on(t.teamId), check("team_invites_role_check", sql`${t.role} IN ('owner', 'member')`)]);
 /**
 * One content-addressed blob (deduped across every loop/run). The bytes live in
 * the byte store under the hash; this row records verified byte presence and size.
@@ -1767,9 +1735,6 @@ var schema = {
 	machines,
 	loops,
 	runs,
-	teams,
-	teamMembers,
-	teamInvites,
 	blobs,
 	artifactFiles,
 	runSnapshots,
@@ -1881,6 +1846,19 @@ async function closeClient() {
 	} catch {}
 }
 /**
+* The GitHub login-gate condition, in one leaf module. `auth.ts` derives its
+* load-time `authEnabled` value from this, and server boot calls it before any
+* migration or scheduler work.
+*
+* The gate is ON exactly when a complete GitHub OAuth app is configured. Open
+* mode requires both values to be absent; a partial configuration fails closed.
+*/
+function loginGateEnabled() {
+	const hasClientId = !!process.env.GITHUB_CLIENT_ID?.trim();
+	if (hasClientId !== !!process.env.GITHUB_CLIENT_SECRET?.trim()) throw new Error("incomplete GitHub auth configuration: set both GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET, or unset both for open mode");
+	return hasClientId;
+}
+/**
 * Data-access layer over Drizzle — replaces c0's file-per-loop store. The API is
 * function-style; persistence is relational (loops and runs are separate tables,
 * and `owner: PeerRef` is gone → `userId` + `machineId`).
@@ -1916,13 +1894,11 @@ function runTimes(at = nowIso$1()) {
 		updatedAt: at
 	};
 }
-async function listLoops(teamId) {
-	const q = db.select().from(loops);
-	return teamId ? await q.where(eq(loops.teamId, teamId)) : await q;
+async function listLoops() {
+	return db.select().from(loops);
 }
-async function countLoopsForTeam(teamId) {
-	const r = (await db.select({ n: sql`count(*)` }).from(loops).where(eq(loops.teamId, teamId)))[0];
-	return Number(r?.n ?? 0);
+async function listLoopsForUser(userId) {
+	return db.select().from(loops).where(eq(loops.userId, userId));
 }
 async function getLoop(id) {
 	return (await db.select().from(loops).where(eq(loops.id, id)))[0];
@@ -1950,7 +1926,12 @@ async function createLoop(input) {
 		updatedAt: ts
 	};
 	return db.transaction(async (tx) => {
-		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0]) throw new Error(`machine ${input.machineId} does not exist`);
+		const machine = (await tx.select({
+			id: machines.id,
+			userId: machines.userId
+		}).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0];
+		if (!machine) throw new Error(`machine ${input.machineId} does not exist`);
+		if (machine.userId !== input.userId) throw new Error(`machine ${input.machineId} is owned by a different user`);
 		return (await tx.insert(loops).values(row).returning())[0];
 	});
 }
@@ -2800,17 +2781,11 @@ async function expirePendingRun(runId, expected, at, maxLifetimeMs, message) {
 		}).where(and(eq(runs.id, runId), eq(runs.phase, "pending"), eq(runs.requestedBy, "system"), eq(runs.updatedAt, expected.updatedAt))).returning({ id: runs.id })).length > 0;
 	});
 }
-async function listMachines(teamId) {
-	return teamId ? await db.select().from(machines).where(eq(machines.teamId, teamId)).orderBy(asc(machines.name), asc(machines.id)) : await db.select().from(machines).orderBy(asc(machines.name), asc(machines.id));
+async function listMachines() {
+	return db.select().from(machines).orderBy(asc(machines.name), asc(machines.id));
 }
-/**
-* Machines usable/visible in a team, MEMBERSHIP-scoped: every machine whose owner
-* belongs to the team (join `machines.userId` → a `team_members` row for this
-* team). One machine therefore appears in every team its owner belongs to.
-* A user has at most one membership row per team, so no machine is duplicated.
-*/
-async function listMachinesForTeam(teamId) {
-	return (await db.select({ m: machines }).from(machines).innerJoin(teamMembers, eq(machines.userId, teamMembers.userId)).where(eq(teamMembers.teamId, teamId)).orderBy(asc(machines.name), asc(machines.id))).map((r) => r.m);
+async function listMachinesForUser(userId) {
+	return db.select().from(machines).where(eq(machines.userId, userId)).orderBy(asc(machines.name), asc(machines.id));
 }
 async function getMachine(id) {
 	return (await db.select().from(machines).where(eq(machines.id, id)))[0];
@@ -2826,16 +2801,18 @@ async function updateMachine(id, patch) {
 	return getMachine(id);
 }
 /** Atomically retire all loop authority, remove server-owned machine data, revoke
-* enrollment, and delete the machine. `allowedTeamIds` is supplied by the
-* authenticated owner flow; a concurrent loop from another team aborts safely. */
-async function forceDeleteMachine(id, allowedTeamIds) {
+* enrollment, and delete the machine. Auth-mode callers pass `ownerUserId` so
+* ownership is rechecked under the same lock as deletion; open/server callers omit it. */
+async function forceDeleteMachine(id, ownerUserId) {
 	return db.transaction(async (tx) => {
-		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, id)).for("update"))[0]) return { state: "not-found" };
+		const machine = (await tx.select({
+			id: machines.id,
+			userId: machines.userId
+		}).from(machines).where(eq(machines.id, id)).for("update"))[0];
+		if (!machine) return { state: "not-found" };
+		if (ownerUserId !== void 0 && machine.userId !== ownerUserId) return { state: "forbidden" };
 		const ownedLoops = await tx.select().from(loops).where(eq(loops.machineId, id)).for("update");
-		if (allowedTeamIds) {
-			const allowed = new Set(allowedTeamIds);
-			if (ownedLoops.some((loop) => !allowed.has(loop.teamId))) return { state: "forbidden" };
-		}
+		if (ownerUserId !== void 0 && ownedLoops.some((loop) => loop.userId !== ownerUserId)) return { state: "forbidden" };
 		for (const loop of ownedLoops) if (!await forceDeleteLoopTx(tx, loop.id)) throw new Error(`failed to delete loop ${loop.id}`);
 		await tx.delete(connectKeys).where(eq(connectKeys.machineId, id));
 		await tx.delete(machines).where(eq(machines.id, id));
@@ -2851,215 +2828,6 @@ async function setMachineOnline(id, online) {
 		lastSeen: nowIso$1()
 	}).where(eq(machines.id, id));
 }
-function teamIdForUser(userId) {
-	return `team-${userId ?? "shared"}`;
-}
-var ensuredTeams = /* @__PURE__ */ new Set();
-/** Idempotently create a team (+ owner membership) if absent. The email-derived
-*  `name` seeds only a new personal team, so later owner renames persist.
-*  Memoized ⇒ at most one reconcile per team per process. The team insert +
-*  membership insert are one atomic transaction. */
-async function ensureTeam(id, name, ownerUserId) {
-	if (ensuredTeams.has(id)) return;
-	const ts = nowIso$1();
-	await db.transaction(async (tx) => {
-		await tx.insert(teams).values({
-			id,
-			name,
-			ownerUserId,
-			createdAt: ts
-		}).onConflictDoNothing();
-		if (ownerUserId) await tx.insert(teamMembers).values({
-			id: `${id}:${ownerUserId}`,
-			teamId: id,
-			userId: ownerUserId,
-			role: "owner",
-			createdAt: ts
-		}).onConflictDoNothing();
-	});
-	ensuredTeams.add(id);
-}
-/** A fresh non-personal team id. Random (never `team-<userId>`, which is reserved
-*  for the personal team the requestScope fallback depends on). */
-function newTeamId() {
-	return `team-${randomUUID().slice(0, 12)}`;
-}
-function isPersonalTeam(team) {
-	return !!team.ownerUserId && team.id === teamIdForUser(team.ownerUserId);
-}
-/** Create a non-personal team owned by `ownerUserId` (creator = owner in both
-*  `teams.ownerUserId` and a `team_members` owner row), transactionally. */
-async function createTeam(name, ownerUserId) {
-	const ts = nowIso$1();
-	const id = newTeamId();
-	return db.transaction(async (tx) => {
-		const [team] = await tx.insert(teams).values({
-			id,
-			name,
-			ownerUserId,
-			createdAt: ts
-		}).returning();
-		await tx.insert(teamMembers).values({
-			id: `${id}:${ownerUserId}`,
-			teamId: id,
-			userId: ownerUserId,
-			role: "owner",
-			createdAt: ts
-		});
-		return team;
-	});
-}
-async function renameTeam(teamId, name) {
-	await db.update(teams).set({ name }).where(eq(teams.id, teamId));
-}
-async function getTeamMember(teamId, userId) {
-	return (await db.select().from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId))))[0];
-}
-async function listTeamMembers(teamId) {
-	return (await db.select({
-		id: teamMembers.id,
-		teamId: teamMembers.teamId,
-		userId: teamMembers.userId,
-		role: teamMembers.role,
-		createdAt: teamMembers.createdAt,
-		email: user.email,
-		displayName: user.name
-	}).from(teamMembers).leftJoin(user, eq(teamMembers.userId, user.id)).where(eq(teamMembers.teamId, teamId))).map((r) => ({
-		...r,
-		email: r.email ?? null,
-		displayName: r.displayName ?? null
-	})).sort((a, b) => a.role === b.role ? a.createdAt < b.createdAt ? -1 : 1 : a.role === "owner" ? -1 : 1);
-}
-async function userByEmail(email) {
-	const r = (await db.select({
-		id: user.id,
-		email: user.email
-	}).from(user).where(sql`lower(${user.email}) = lower(${email})`))[0];
-	return r ? {
-		id: r.id,
-		email: r.email
-	} : void 0;
-}
-/** Add a member (idempotent — a re-add is a no-op, not a duplicate row). */
-async function addTeamMember(teamId, userId, role) {
-	await db.insert(teamMembers).values({
-		id: `${teamId}:${userId}`,
-		teamId,
-		userId,
-		role,
-		createdAt: nowIso$1()
-	}).onConflictDoNothing();
-}
-/**
-* Remove a member, but REFUSE if they are the team's LAST owner (the ≥1-owner
-* invariant, checked in the SAME transaction as the delete so two concurrent
-* self-removals can't both win and strand a memberless team). Returns:
-*  - `not-member` — no membership row;
-*  - `last-owner` — refused (they are the sole owner; transfer/promote first);
-*  - `ok` — removed.
-*/
-async function removeTeamMemberGuarded(teamId, userId) {
-	return db.transaction(async (tx) => {
-		const m = (await tx.select().from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId))))[0];
-		if (!m) return "not-member";
-		if (m.role === "owner") {
-			if ((await tx.select({ id: teamMembers.id }).from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.role, "owner"))).for("update")).length <= 1) return "last-owner";
-		}
-		await tx.delete(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId)));
-		return "ok";
-	});
-}
-/**
-* Change a member's role, guarding the last-owner invariant transactionally: a
-* demote owner→member that would zero the owner set is refused. Returns
-* `not-member` / `last-owner` / `ok`. A no-op (same role) is `ok`.
-*/
-async function setTeamMemberRoleGuarded(teamId, userId, role) {
-	return db.transaction(async (tx) => {
-		const m = (await tx.select().from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId))))[0];
-		if (!m) return "not-member";
-		if (m.role === "owner" && role === "member") {
-			if ((await tx.select({ id: teamMembers.id }).from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.role, "owner"))).for("update")).length <= 1) return "last-owner";
-		}
-		await tx.update(teamMembers).set({ role }).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId)));
-		return "ok";
-	});
-}
-/**
-* Delete a team and its dependents, transactionally. The CALLER enforces the
-* policy guards first (personal-team undeletable; blocked while the team owns loops).
-* The transaction rechecks the loop count and aborts (`has-loops`) if one exists,
-* closing the check-then-cascade gap where a loop created between the caller's
-* guard and here would be orphaned at a now-deleted team. On success we cascade
-* the team's own resources: pending invites, memberships, and reassign
-* every machine whose cosmetic home-team was this team back to its owner's
-* personal team (machines are user-owned; the team pointer is only a home hint).
-*/
-async function deleteTeamCascade(teamId) {
-	const outcome = await db.transaction(async (tx) => {
-		if (Number((await tx.select({ n: sql`count(*)` }).from(loops).where(eq(loops.teamId, teamId)))[0]?.n ?? 0) > 0) return "has-loops";
-		const homed = await tx.select().from(machines).where(eq(machines.teamId, teamId));
-		for (const m of homed) await tx.update(machines).set({ teamId: teamIdForUser(m.userId) }).where(eq(machines.id, m.id));
-		await tx.delete(teamInvites).where(eq(teamInvites.teamId, teamId));
-		await tx.delete(teamMembers).where(eq(teamMembers.teamId, teamId));
-		await tx.delete(teams).where(eq(teams.id, teamId));
-		return "ok";
-	});
-	if (outcome === "ok") ensuredTeams.delete(teamId);
-	return outcome;
-}
-async function createInvite(input) {
-	return (await db.insert(teamInvites).values({
-		...input,
-		createdAt: nowIso$1()
-	}).returning())[0];
-}
-async function getInvite(token) {
-	return (await db.select().from(teamInvites).where(eq(teamInvites.token, token)))[0];
-}
-async function listPendingInvites(teamId) {
-	const now = nowIso$1();
-	return db.select().from(teamInvites).where(and(eq(teamInvites.teamId, teamId), isNull(teamInvites.redeemedAt), gt(teamInvites.expiresAt, now))).orderBy(desc(teamInvites.createdAt));
-}
-/**
-* Atomically redeem a single-use invite: in ONE transaction, stamp
-* `redeemedAt`/`redeemedByUserId` ONLY if the invite is still unredeemed and,
-* when this call won the stamp, grant the membership in the SAME transaction so
-* the two commit together (a crash between them can't burn the link without
-* granting membership). The `redeemed_at IS NULL` guard makes the stamp the
-* single-use chokepoint, so two concurrent redeems can't both add a member.
-* Pass `grant: null` for an already-member redeem (still burns the link, no
-* double-add / no role change). Returns false when the invite was already spent
-* (a losing race, or a stale re-redeem).
-*/
-async function redeemInviteAtomic(token, userId, grant) {
-	return db.transaction(async (tx) => {
-		if ((await tx.update(teamInvites).set({
-			redeemedAt: nowIso$1(),
-			redeemedByUserId: userId
-		}).where(and(eq(teamInvites.token, token), isNull(teamInvites.redeemedAt))).returning({ token: teamInvites.token })).length === 0) return false;
-		if (grant) await tx.insert(teamMembers).values({
-			id: `${grant.teamId}:${userId}`,
-			teamId: grant.teamId,
-			userId,
-			role: grant.role,
-			createdAt: nowIso$1()
-		}).onConflictDoNothing();
-		return true;
-	});
-}
-async function deleteInvite(token) {
-	await db.delete(teamInvites).where(eq(teamInvites.token, token));
-}
-async function getTeam(id) {
-	return (await db.select().from(teams).where(eq(teams.id, id)))[0];
-}
-async function listTeamsForUser(userId) {
-	return (await db.select({ t: teams }).from(teamMembers).innerJoin(teams, eq(teamMembers.teamId, teams.id)).where(eq(teamMembers.userId, userId)).orderBy(desc(teams.createdAt))).map((r) => r.t);
-}
-async function isTeamMember(teamId, userId) {
-	return !!(await db.select({ id: teamMembers.id }).from(teamMembers).where(and(eq(teamMembers.teamId, teamId), eq(teamMembers.userId, userId))))[0];
-}
 async function blobExists(hash) {
 	return !!(await db.select({ hash: blobs.hash }).from(blobs).where(eq(blobs.hash, hash)))[0];
 }
@@ -3330,8 +3098,8 @@ function parseArtifactSyncBody(value) {
 *
 * Leases and connect-key bindings are DURABLE (run_leases / connect_keys
 * tables): they must survive a deploy, or every restart 401s the in-flight
-* runs' callbacks/finalize and silently mis-files a post-restart create into the
-* machine's home team. The 15-minute `new` idempotency window stays in-process;
+* runs' callbacks/finalize and prevents a freshly connected machine from
+* enrolling under its owner. The 15-minute `new` idempotency window stays in-process;
 * losing it only degrades retry deduplication, never persisted data.
 */
 function sha256(s) {
@@ -3356,15 +3124,13 @@ var CONNECT_KEY_TTL_MS = 1440 * 60 * 1e3;
 function connectKeyFresh(mintedAt, now) {
 	return now - Date.parse(mintedAt) <= CONNECT_KEY_TTL_MS;
 }
-/** Bind a freshly-minted connect-key to its minter and validated team.
-*  Prunes expired rows on write. */
-async function rememberConnectKey(connectKey, intent) {
+/** Bind a freshly minted connect key to its owner and prune expired rows. */
+async function rememberConnectKey(connectKey, binding) {
 	const now = /* @__PURE__ */ new Date();
 	await db.delete(connectKeys).where(lt(connectKeys.mintedAt, (/* @__PURE__ */ new Date(now.getTime() - CONNECT_KEY_TTL_MS)).toISOString()));
 	const row = {
 		machineId: machineIdFromToken(connectKey),
-		userId: intent.userId,
-		teamId: intent.teamId,
+		userId: binding.userId,
 		mintedAt: now.toISOString()
 	};
 	await db.insert(connectKeys).values(row).onConflictDoUpdate({
@@ -3372,19 +3138,11 @@ async function rememberConnectKey(connectKey, intent) {
 		set: row
 	});
 }
-async function readClaimIntent(connectKey, now = Date.now()) {
+async function readConnectKeyBinding(connectKey, now = Date.now()) {
 	if (!connectKey) return void 0;
 	const row = (await db.select().from(connectKeys).where(eq(connectKeys.machineId, machineIdFromToken(connectKey))))[0];
 	if (!row || !connectKeyFresh(row.mintedAt, now)) return void 0;
-	return {
-		userId: row.userId,
-		teamId: row.teamId
-	};
-}
-async function getDeviceOwner(machineId, now = Date.now()) {
-	const row = (await db.select().from(connectKeys).where(eq(connectKeys.machineId, machineId)))[0];
-	if (!row || !connectKeyFresh(row.mintedAt, now)) return void 0;
-	return row.userId;
+	return { userId: row.userId };
 }
 /** How long a terminal-grace lease stays alive to accept one late wake-report.
 *  A laptop can sleep overnight or across a weekend before the daemon resumes. */
@@ -4636,8 +4394,8 @@ var configuredRunTimeoutMs = Number(process.env.PIEVO_RUN_TIMEOUT_MS || 20 * 6e4
 var RUN_TIMEOUT_MS = Number.isFinite(configuredRunTimeoutMs) && configuredRunTimeoutMs > 0 ? configuredRunTimeoutMs : 20 * 6e4;
 /** The ONLY keys an owner `editLoop` patch may touch. A key outside this set is
 *  rejected (400) rather than silently ignored, so a `--json` typo fails loudly
-*  and identity/ownership columns (id/teamId/userId/machineId/timestamps) can
-*  never be patched over the device-token edit surface. Exported for `cli.ts`
+*  and identity/ownership columns (id/userId/machineId/timestamps) can never be
+*  patched over the device-token edit surface. Exported for `cli.ts`
 *  (the `new`/`edit` verb help lists these keys). */
 var EDITABLE_LOOP_FIELDS = LOOP_EDIT_FIELDS;
 /** Formal `report --message` text. Provider finalText is stored separately;
@@ -4961,18 +4719,14 @@ var MachineGateway = class {
 		const { machineId } = auth;
 		let machine = auth.machine;
 		if (!machine) {
-			const owner = await getDeviceOwner(machineId);
-			if (owner == null) return {
+			const binding = await readConnectKeyBinding(deviceToken);
+			if (!binding) return {
 				status: 401,
 				body: { error: "unknown device token — connect this machine first" }
 			};
-			const ownerId = owner;
-			const teamId = teamIdForUser(ownerId);
-			await ensureTeam(teamId, ownerId === "shared" ? "Shared Workspace" : "Personal Team", ownerId === "shared" ? null : ownerId);
 			machine = await createMachine({
 				id: machineId,
-				userId: ownerId,
-				teamId,
+				userId: binding.userId,
 				name: info?.host || `machine-${machineId.slice(2, 8)}`,
 				tokenHash: sha256(deviceToken),
 				token: deviceToken,
@@ -5120,7 +4874,7 @@ var MachineGateway = class {
 			status: 200,
 			body: {
 				registered: false,
-				claimValid: await readClaimIntent(deviceToken) !== void 0,
+				claimValid: await readConnectKeyBinding(deviceToken) !== void 0,
 				online: false,
 				name: null,
 				lastSeen: null,
@@ -5156,8 +4910,7 @@ var MachineGateway = class {
 				status: 400,
 				body: { error: "create body must be an object" }
 			};
-			const rawBody = body;
-			const { claim, dryRun, idempotencyKey, ...rawConfig } = rawBody;
+			const { dryRun, idempotencyKey, ...rawConfig } = body;
 			if (dryRun !== void 0 && typeof dryRun !== "boolean") return {
 				status: 400,
 				body: { error: "dryRun must be boolean when provided" }
@@ -5166,26 +4919,6 @@ var MachineGateway = class {
 				status: 400,
 				body: { error: "idempotencyKey is required and must be exactly 64 lowercase hex characters" }
 			};
-			let intent = void 0;
-			if (Object.prototype.hasOwnProperty.call(rawBody, "claim")) {
-				if (typeof claim !== "string" || !isDeviceTokenShape(claim)) return {
-					status: 400,
-					body: { error: "claim must have the exact dk_<30 lowercase hex> shape" }
-				};
-				intent = await readClaimIntent(claim);
-				if (!intent) return {
-					status: 400,
-					body: { error: "claim is unknown or expired" }
-				};
-				if (machine.userId !== intent.userId) return {
-					status: 403,
-					body: { error: "connect-key was minted by a different user" }
-				};
-				if (!await isTeamMember(intent.teamId, machine.userId)) return {
-					status: 403,
-					body: { error: "not authorized to create loops in that team" }
-				};
-			}
 			const validated = validateLoopCreate(rawConfig);
 			if (!validated.ok) return {
 				status: 400,
@@ -5213,10 +4946,8 @@ var MachineGateway = class {
 					text: `loop: ${existing.name}\nid: ${existing.id}\nreplayed: true`
 				}
 			};
-			const teamId = intent?.teamId ?? machine.teamId;
 			const loop = await createLoop({
 				userId: machine.userId,
-				teamId,
 				machineId,
 				...row
 			});
@@ -6664,11 +6395,6 @@ var CliGateway = class {
 				body: { error: "force delete confirmation required" }
 			};
 			const machine = await getMachine(machineId);
-			const actor = machine?.userId;
-			if (!loop.teamId || !actor || (await getTeamMember(loop.teamId, actor))?.role !== "owner") return {
-				status: 403,
-				body: { error: "only a team owner can force delete this loop" }
-			};
 			const reachability = machinePresence(!!machine?.online, machine?.lastSeen ?? null);
 			if (!await this.forceDeleteLoop(loop.id)) return {
 				status: 409,
@@ -6679,7 +6405,7 @@ var CliGateway = class {
 				action: "force-delete",
 				loopId: loop.id,
 				machineId,
-				actorUserId: actor,
+				actorUserId: loop.userId,
 				machineReachability: reachability
 			});
 			return {
@@ -6992,7 +6718,7 @@ var RUN_VERB_HELP = { report: {
 } };
 var DEVICE_VERB_HELP = {
 	new: {
-		syntax: "new --json '<config>' [--dry-run] [--connect-key <dk_…>] [--server-url <url>]",
+		syntax: "new --json '<config>' [--dry-run]",
 		summary: `create a loop from the canonical envelope (keys: ${[...EDITABLE_LOOP_FIELDS].join(", ")}; agent required)`,
 		help: ["Run `pievo new --json '{\"name\":\"Daily check\",\"schedule\":{\"mode\":\"cron\",\"cron\":\"0 8 * * *\",\"timezone\":\"UTC\",\"overlap\":\"skip\"},\"workdir\":\"<path>\",\"agent\":\"claude-code\",\"prompt\":\"Check the project.\",\"statusDefinitions\":{\"keep\":\"result retained\",\"noChange\":\"nothing changed\",\"block\":\"owner input required\"}}'` to create a loop", "Run `pievo new --json '{...}' --dry-run` to validate without creating"]
 	},
@@ -7402,6 +7128,7 @@ function ensureServer() {
 	return p;
 }
 async function boot() {
+	loginGateEnabled();
 	await runMigrations();
 	await repairTerminalRunLeases();
 	const abort = new AbortController();
@@ -7463,4 +7190,4 @@ async function getCliGateway() {
 	return (await ensureServer()).cliGateway;
 }
 //#endregion
-export { isDevelopment as $, validateLoopEdit as $t, ensureServer as A, redeemInviteAtomic as At, getEnvVar as B, sha256 as Bt, createMachine as C, normalizePathname as Ct, defu as D, readJsonBody as Dt, db as E, readByteBody as Et, getArtifactFile as F, requestRunCancel as Ft, getMachine as G, toKebabCase as Gt, getHost as H, statusDefinitionsFromLoop as Ht, getArtifactSync as I, resolveBaseURL as It, getRun as J, updateMachine as Jt, getOrigin as K, tryDeleteLoop as Kt, getBaseURL as L, safeRelPath as Lt, env as M, removeTeamMemberGuarded as Mt, forceDeleteLoop as N, renameTeam as Nt, deleteInvite as O, recentLoopUsage as Ot, forceDeleteMachine as P, requestDeleteLoop as Pt, hasRunningRun as Q, validPollWireId as Qt, getBooleanEnvVar as R, scheduleFromLoop as Rt, createInvite as S, mintDeviceToken as St, daemonNeedsUpdate as T, pauseLoop as Tt, getInvite as U, stopLoop as Ut, getGateway as V, startLoop as Vt, getLoop as W, teamIdForUser as Wt, getTeamMember as X, validOptionalPollString as Xt, getTeam as Y, userByEmail as Yt, hasPendingRun as Z, validPollCurrentRun as Zt, computeRunDiff as _, listTeamsForUser as _t, BetterAuthError as a, isSafeUrlScheme as at, createDefu as b, machineIdFromToken as bt, ENV as c, kAPIErrorHeaderSymbol as ct, POLL_HTTP_BODY_FIELDS as d, listMachines as dt, wildcardMatch as en, isDynamicBaseURLConfig as et, SYNC_BODY_CAP as f, listMachinesForTeam as ft, capitalizeFirstLetter as g, listTeamMembers as gt, betterFetch as h, listRunsBefore as ht, BLOB_CAP as i, isRequestLike as it, ensureTeam as j, rememberConnectKey as jt, deleteTeamCascade as k, reconciliationStatesForRuns as kt, MACHINE_BODY_CAP as l, listArtifacts as lt, addTeamMember as m, listRuns as mt, APIError$1 as n, isPersonalTeam as nt, BetterCallError as o, isTeamMember as ot, ValidationError$1 as p, listPendingInvites as pt, getProtocol as q, updateLoop as qt, BASE_ERROR_CODES as r, isProduction as rt, CODING_AGENTS as s, isTest as st, APIError as t, isOutdated as tt, MIN_DAEMON_VERSION as u, listLoops as ut, countLoopsForTeam as v, logger as vt, createTeam as w, parseArtifactSyncBody as wt, createFetch as x, machinePresence as xt, countRuns as y, loopsForMachine as yt, getCliGateway as z, setTeamMemberRoleGuarded as zt };
+export { listLoopsForUser as $, getBaseURL as A, updateMachine as At, getRun as B, defu as C, sha256 as Ct, forceDeleteMachine as D, toKebabCase as Dt, forceDeleteLoop as E, stopLoop as Et, getHost as F, wildcardMatch as Ft, isOutdated as G, hasRunningRun as H, getLoop as I, isSafeUrlScheme as J, isProduction as K, getMachine as L, getCliGateway as M, validPollCurrentRun as Mt, getEnvVar as N, validPollWireId as Nt, getArtifactFile as O, tryDeleteLoop as Ot, getGateway as P, validateLoopEdit as Pt, listLoops as Q, getOrigin as R, db as S, scheduleFromLoop as St, env as T, statusDefinitionsFromLoop as Tt, isDevelopment as U, hasPendingRun as V, isDynamicBaseURLConfig as W, kAPIErrorHeaderSymbol as X, isTest as Y, listArtifacts as Z, countRuns as _, rememberConnectKey as _t, BetterAuthError as a, loginGateEnabled as at, createMachine as b, resolveBaseURL as bt, ENV as c, machinePresence as ct, POLL_HTTP_BODY_FIELDS as d, parseArtifactSyncBody as dt, listMachines as et, SYNC_BODY_CAP as f, pauseLoop as ft, computeRunDiff as g, reconciliationStatesForRuns as gt, capitalizeFirstLetter as h, recentLoopUsage as ht, BLOB_CAP as i, logger as it, getBooleanEnvVar as j, validOptionalPollString as jt, getArtifactSync as k, updateLoop as kt, MACHINE_BODY_CAP as l, mintDeviceToken as lt, betterFetch as m, readJsonBody as mt, APIError$1 as n, listRuns as nt, BetterCallError as o, loopsForMachine as ot, ValidationError$1 as p, readByteBody as pt, isRequestLike as q, BASE_ERROR_CODES as r, listRunsBefore as rt, CODING_AGENTS as s, machineIdFromToken as st, APIError as t, listMachinesForUser as tt, MIN_DAEMON_VERSION as u, normalizePathname as ut, createDefu as v, requestDeleteLoop as vt, ensureServer as w, startLoop as wt, daemonNeedsUpdate as x, safeRelPath as xt, createFetch as y, requestRunCancel as yt, getProtocol as z };

package/.output/server/_ssr/{bun-sqlite-dialect-BW9W1_Ps-CHMDkKqA.mjs → bun-sqlite-dialect-BW9W1_Ps-D9KUBJ-L.mjs}

@@ -1,6 +1,6 @@
-import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-LwPp_iim.mjs";
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-BV0MxVdo.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/bun-sqlite-dialect-BW9W1_Ps-CHMDkKqA.js
+//#region node_modules/.nitro/vite/services/ssr/assets/bun-sqlite-dialect-BW9W1_Ps-D9KUBJ-L.js
 var BunSqliteAdapter = class {
 	get supportsCreateIfNotExists() {
 		return true;

package/.output/server/_ssr/{d1-sqlite-dialect-BLC8LXE6-DYum6qky.mjs → d1-sqlite-dialect-BLC8LXE6-CVHRzH1n.mjs}

@@ -1,6 +1,6 @@
-import { a as SqliteQueryCompiler, i as SqliteAdapter } from "./auth-LwPp_iim.mjs";
+import { a as SqliteQueryCompiler, i as SqliteAdapter } from "./auth-BV0MxVdo.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/d1-sqlite-dialect-BLC8LXE6-DYum6qky.js
+//#region node_modules/.nitro/vite/services/ssr/assets/d1-sqlite-dialect-BLC8LXE6-CVHRzH1n.js
 var D1SqliteAdapter = class extends SqliteAdapter {};
 var D1SqliteDriver = class {
 	#config;

package/.output/server/_ssr/db-BTX-xORB.mjs

@@ -0,0 +1,2 @@
+import { S as db } from "./boot-U-CFI65B.mjs";
+export { db };

package/.output/server/_ssr/{dist-bWqs5sTy.mjs → dist-D7UDVZ5G.mjs}

@@ -1,5 +1,5 @@
-import { _ as logger, o as createAdapterFactory } from "./factory-pBwrjVTI.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/dist-bWqs5sTy.js
+import { _ as logger, o as createAdapterFactory } from "./factory-DYFx1fg-.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/dist-D7UDVZ5G.js
 /**
 * Case-insensitive in-memory comparison helpers.
 * Used when evaluating where clauses in the memory adapter.

package/.output/server/_ssr/{factory-pBwrjVTI.mjs → factory-DYFx1fg-.mjs}

@@ -1,5 +1,5 @@
-import { B as getEnvVar, M as env, a as BetterAuthError } from "./boot-BIxtZHU-.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/factory-pBwrjVTI.js
+import { N as getEnvVar, T as env, a as BetterAuthError } from "./boot-U-CFI65B.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/factory-DYFx1fg-.js
 var __defProp = Object.defineProperty;
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 var __exportAll = (all, no_symbols) => {

package/.output/server/_ssr/{kysely-adapter-DMf5pFTf.mjs → kysely-adapter-CwdB7yBh.mjs}

@@ -1,2 +1,2 @@
-import { r as kyselyAdapter, t as createKyselyAdapter } from "./auth-LwPp_iim.mjs";
+import { r as kyselyAdapter, t as createKyselyAdapter } from "./auth-BV0MxVdo.mjs";
 export { createKyselyAdapter, kyselyAdapter };

package/.output/server/_ssr/logger-CwiKSMp6.mjs

@@ -0,0 +1,2 @@
+import { it as logger } from "./boot-U-CFI65B.mjs";
+export { logger };