@kky42/pievo-server 2.4.12 → 2.4.13

package/.output/server/_ssr/{machineFns-Bb9KNXun.mjs → machineFns-CkNms3zA.mjs}

@@ -1,31 +1,15 @@
-import { A as ensureServer, Bt as sha256, C as createMachine$1, G as getMachine, Jt as updateMachine, P as forceDeleteMachine, St as mintDeviceToken, T as daemonNeedsUpdate, X as getTeamMember, bt as machineIdFromToken, dt as listMachines$1, ft as listMachinesForTeam, jt as rememberConnectKey, u as MIN_DAEMON_VERSION, yt as loopsForMachine } from "./boot-BIxtZHU-.mjs";
-import { requestScope } from "./auth-LwPp_iim.mjs";
+import { At as updateMachine, Ct as sha256, D as forceDeleteMachine, L as getMachine, b as createMachine$1, et as listMachines$1, lt as mintDeviceToken, ot as loopsForMachine, st as machineIdFromToken, tt as listMachinesForUser, u as MIN_DAEMON_VERSION, w as ensureServer, x as daemonNeedsUpdate } from "./boot-U-CFI65B.mjs";
+import { requestScope } from "./auth-BV0MxVdo.mjs";
 import { n as createServerFn } from "./ssr.mjs";
 import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-Bb9KNXun.js
-/**
-* Whether a machine is visible/actionable in the request scope. Mirrors
-* listMachines: open mode sees everything; otherwise the requester must own the
-* machine or share the active team with its owner. `teamMachineIds` is a THUNK
-* (the team set needs a DB join) invoked only after the owner check misses — the
-* hot path (machineStatus polls every ~2.5s while the connect dialog is open,
-* usually by the owner) pays no query.
-*/
-function machineInScope(m, scope, teamMachineIds) {
-	if (!scope.enforce) return true;
-	if (!scope.userId) return false;
-	if (m.userId === scope.userId) return true;
-	return teamMachineIds().has(m.id);
+//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-CkNms3zA.js
+/** Open mode sees every machine; auth mode sees only the signed-in owner's rows. */
+function machineInScope(machine, scope) {
+	return !scope.enforce || !!scope.userId && machine.userId === scope.userId;
 }
-/**
-* Whether the machine's PLAINTEXT device token may be serialized to this
-* requester. Owner-only under the gate — the token fully impersonates the
-* machine, so even a teammate/admin who may see (or delete) the row gets
-* `token: null`. Open mode keeps the v1 behavior (token shown, e.g. for the
-* reconnect command).
-*/
-function tokenVisibleTo(m, scope) {
-	return !scope.enforce || m.userId === scope.userId;
+/** A device token fully impersonates its machine, so auth mode keeps it owner-only. */
+function tokenVisibleTo(machine, scope) {
+	return machineInScope(machine, scope);
 }
 /**
 * Latest published @kky42/pievo version — a cached, fail-silent lookup of the
@@ -108,102 +92,64 @@ var LatestDaemonVersion = class {
 };
 var latestDaemonVersion = new LatestDaemonVersion();
 /**
-* Machine management server functions. Connect flow (two acts):
-*   1. createMachine() → mint a token, create a PENDING (unnamed) row, return
-*      {id, token}. The UI shows the connect command + "waiting…".
-*   2. the daemon connects → poll records online + hostname/platform/arch. The
-*      UI polls machineStatus(id); once connected it shows the name field
-*      (prefilled with the hostname). finalizeMachine({id,name}) names it →
-*      it appears in the list. cancelMachine(id) drops a pending row.
-*
-* Scoping: when the auth gate is on, every fn requires a signed-in user, and a
-* machine is visible/actionable only when the requester owns it, its owner is a
-* member of the active team, or the scope is the admin "All teams" view (the
-* same rule listMachines filters by). The PLAINTEXT device token is serialized
-* ONLY to the machine's owner — it fully impersonates the machine (poll /
-* create-loop / log), so a teammate who can see the row must never exfiltrate
-* it. Open mode (gate off) keeps the shared workspace: everyone sees/manages
-* all machines, tokens included. No workdir jail (fully open) for now.
-*/
-/** Ids of the machines membership-visible in the scope's active team (the same
-*  set listMachines serves). Empty when the scope needs no team check (open
-*  mode or signed-out — machineInScope settles those before ever invoking its
-*  team-set thunk). */
-async function teamMachineIds(scope) {
-	if (!scope.enforce || !scope.userId) return /* @__PURE__ */ new Set();
-	return new Set((await listMachinesForTeam(scope.teamId)).map((m) => m.id));
-}
-/**
-* Resolve a machine and authorize it against the request scope (the machine-fn
-* twin of loopApi's `ownedLoop`). `machine` is undefined when it's missing OR
-* out of scope — callers treat both as "not found" so existence never leaks.
-* The scope rides along so callers don't re-run requestScope (a second session
-* decrypt); the team-set thunk keeps the owner fast path query-free.
+* Machine-management server functions. In auth mode, the signed-in user is the
+* sole human authorization boundary. Open mode intentionally shares all machine
+* administration, including reconnect tokens.
 */
+/** Missing and out-of-scope machines both resolve to undefined. */
 async function scopedMachine(id) {
 	const scope = await requestScope();
-	const m = await getMachine(id);
-	const teamIds = await teamMachineIds(scope);
+	if (scope.enforce && !scope.userId) return { scope };
+	const candidate = await getMachine(id);
 	return {
 		scope,
-		machine: m && machineInScope(m, scope, () => teamIds) ? m : void 0
+		machine: candidate && machineInScope(candidate, scope) ? candidate : void 0
 	};
 }
-async function toSummary(m, scope) {
+async function toSummary(machine, scope) {
 	return {
-		id: m.id,
-		name: m.name,
-		online: !!m.online,
-		lastSeen: m.lastSeen ?? null,
-		hostname: m.hostname ?? null,
-		platform: m.platform ?? null,
-		arch: m.arch ?? null,
-		daemonVersion: m.daemonVersion ?? null,
-		daemonProtocol: m.daemonProtocol ?? null,
+		id: machine.id,
+		name: machine.name,
+		online: !!machine.online,
+		lastSeen: machine.lastSeen ?? null,
+		hostname: machine.hostname ?? null,
+		platform: machine.platform ?? null,
+		arch: machine.arch ?? null,
+		daemonVersion: machine.daemonVersion ?? null,
+		daemonProtocol: machine.daemonProtocol ?? null,
 		latestDaemonVersion: latestDaemonVersion.get(),
-		needsUpdate: daemonNeedsUpdate(m.daemonVersion),
+		needsUpdate: daemonNeedsUpdate(machine.daemonVersion),
 		requiredDaemonVersion: MIN_DAEMON_VERSION,
-		token: tokenVisibleTo(m, scope) ? m.token ?? null : null,
-		loopCount: (await loopsForMachine(m.id)).length
+		token: tokenVisibleTo(machine, scope) ? machine.token ?? null : null,
+		loopCount: (await loopsForMachine(machine.id)).length
 	};
 }
-/** Named machines only (pending/unnamed rows are mid-connect). Scoped to the
-*  given/active team when the gate is on; the full shared list in open mode. An
-*  explicit `teamId` (the `/t/<id>` route) scopes this request independent of the
-*  cookie, so a tab on /t/A and one on /t/B list different machines at once. */
 var listMachines_createServerFn_handler = createServerRpc({
 	id: "aa46310016bb8a58b273a648ffd498c87f1f450d12827e30110a3b83ba6a27d9",
 	name: "listMachines",
 	filename: "src/server/machineFns.ts"
 }, (opts) => listMachines.__executeServer(opts));
-var listMachines = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(listMachines_createServerFn_handler, async ({ data: teamId }) => {
+var listMachines = createServerFn({ method: "GET" }).handler(listMachines_createServerFn_handler, async () => {
 	await ensureServer();
-	const scope = await requestScope(teamId);
-	const { enforce, userId, teamId: active } = scope;
-	if (enforce && !userId) return [];
-	const list = enforce ? await listMachinesForTeam(active) : await listMachines$1();
-	return Promise.all(list.filter((m) => m.name.trim()).map((m) => toSummary(m, scope)));
+	const scope = await requestScope();
+	if (scope.enforce && !scope.userId) return [];
+	const machines = scope.enforce ? await listMachinesForUser(scope.userId) : await listMachines$1();
+	return Promise.all(machines.filter((machine) => machine.name.trim()).map((machine) => toSummary(machine, scope)));
 });
 var createMachine_createServerFn_handler = createServerRpc({
 	id: "ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415",
 	name: "createMachine",
 	filename: "src/server/machineFns.ts"
 }, (opts) => createMachine.__executeServer(opts));
-var createMachine = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createMachine_createServerFn_handler, async ({ data: teamId }) => {
+var createMachine = createServerFn({ method: "POST" }).handler(createMachine_createServerFn_handler, async () => {
 	await ensureServer();
-	const { enforce, userId, teamId: active } = await requestScope(teamId);
-	if (enforce && !userId) return { error: "not signed in" };
+	const scope = await requestScope();
+	if (scope.enforce && !scope.userId) return { error: "not signed in" };
 	const token = mintDeviceToken();
 	const id = machineIdFromToken(token);
-	const owner = userId ?? "shared";
-	await rememberConnectKey(token, {
-		userId: owner,
-		teamId: active
-	});
 	await createMachine$1({
 		id,
-		userId: owner,
-		teamId: active,
+		userId: scope.userId ?? "shared",
 		name: "",
 		tokenHash: sha256(token),
 		token,
@@ -229,7 +175,7 @@ var finalizeMachine_createServerFn_handler = createServerRpc({
 	name: "finalizeMachine",
 	filename: "src/server/machineFns.ts"
 }, (opts) => finalizeMachine.__executeServer(opts));
-var finalizeMachine = createServerFn({ method: "POST" }).validator((d) => d).handler(finalizeMachine_createServerFn_handler, async ({ data }) => {
+var finalizeMachine = createServerFn({ method: "POST" }).validator((data) => data).handler(finalizeMachine_createServerFn_handler, async ({ data }) => {
 	await ensureServer();
 	const name = data.name?.trim();
 	if (!name) return { ok: false };
@@ -253,21 +199,8 @@ var deleteMachine = createServerFn({ method: "POST" }).validator((id) => id).han
 		ok: false,
 		error: "machine not found"
 	};
-	const loops = await loopsForMachine(id);
-	let allowedTeamIds = scope.enforce ? [] : void 0;
-	if (scope.enforce && loops.length > 0) {
-		allowedTeamIds = [...new Set(loops.map((loop) => loop.teamId))];
-		if ((await Promise.all(allowedTeamIds.map((teamId) => getTeamMember(teamId, scope.userId)))).some((membership) => membership?.role !== "owner")) return {
-			ok: false,
-			error: "Only an owner of every affected team can delete this machine and its loops."
-		};
-	}
-	const deleted = await forceDeleteMachine(id, allowedTeamIds);
-	if (deleted.state === "forbidden") return {
-		ok: false,
-		error: "Machine loops changed while deleting; review them and try again."
-	};
-	if (deleted.state === "not-found") return {
+	const deleted = scope.enforce ? await forceDeleteMachine(id, scope.userId) : await forceDeleteMachine(id);
+	if (deleted.state === "forbidden" || deleted.state === "not-found") return {
 		ok: false,
 		error: "machine not found"
 	};

package/.output/server/_ssr/{node-sqlite-dialect-Dho9YjXb.mjs → node-sqlite-dialect-B_g92oFK.mjs}

@@ -1,6 +1,6 @@
-import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-LwPp_iim.mjs";
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-BV0MxVdo.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-Dho9YjXb.js
+//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-B_g92oFK.js
 var NodeSqliteAdapter = class {
 	get supportsCreateIfNotExists() {
 		return true;

package/.output/server/_ssr/{router-C8iotXtk.mjs → router-DCNZ2xLm.mjs}

@@ -1,15 +1,13 @@
 import { j as sql } from "../_libs/drizzle-orm+postgres.mjs";
-import { A as ensureServer, Dt as readJsonBody, Et as readByteBody, Qt as validPollWireId, Xt as validOptionalPollString, Zt as validPollCurrentRun, d as POLL_HTTP_BODY_FIELDS, l as MACHINE_BODY_CAP } from "./boot-BIxtZHU-.mjs";
+import { Mt as validPollCurrentRun, Nt as validPollWireId, d as POLL_HTTP_BODY_FIELDS, jt as validOptionalPollString, l as MACHINE_BODY_CAP, mt as readJsonBody, pt as readByteBody, w as ensureServer } from "./boot-U-CFI65B.mjs";
 import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { c as createFileRoute, i as HeadContent, l as createRootRoute, o as createRouter, r as Scripts } from "../_libs/@tanstack/react-router+[...].mjs";
-import { t as Route$12 } from "./invite._token-CPSvdDox.mjs";
-import { r as imageMime, t as Route$13 } from "./artifactKind-DXumOv7c.mjs";
-import { t as Route$14 } from "./loops._loopId_.runs._runId-DVtG0xYb.mjs";
-import { t as Route$15 } from "./routes-fiMzFtcP.mjs";
-import { t as Route$16 } from "./t._teamId-BYA4Dnjp.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/router-C8iotXtk.js
+import { r as imageMime, t as Route$12 } from "./artifactKind-DRCbYHZU.mjs";
+import { t as Route$13 } from "./loops._loopId_.runs._runId-DNXVmCt5.mjs";
+import { n as Route$14 } from "./routes-BaanDO41.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/router-DCNZ2xLm.js
 var import_jsx_runtime = require_jsx_runtime();
-var app_default = "/assets/app-D5Hy4BcS.css";
+var app_default = "/assets/app-PPhgN9iN.css";
 var Route$11 = createRootRoute({
 	head: () => ({
 		meta: [
@@ -169,7 +167,7 @@ var Route$10 = createFileRoute("/machine/report")({ server: { handlers: { POST:
 	const parsed = await readJsonBody(request, MACHINE_BODY_CAP);
 	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
 	const body = parsed.kind === "ok" && parsed.body && typeof parsed.body === "object" ? parsed.body : {};
-	const { getGateway } = await import("./boot-D8cj4uZj.mjs");
+	const { getGateway } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getGateway()).report(token, body);
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -209,13 +207,13 @@ var Route$7 = createFileRoute("/api/machine/sync")({ server: { handlers: { POST:
 	const auth = request.headers.get("authorization") ?? "";
 	const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
 	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
-	const { SYNC_BODY_CAP, parseArtifactSyncBody } = await import("./artifacts-DOLHJHcd.mjs");
+	const { SYNC_BODY_CAP, parseArtifactSyncBody } = await import("./artifacts-CzDJLaa6.mjs");
 	const parsed = await readJsonBody(request, SYNC_BODY_CAP);
 	if (parsed.kind === "too-large") return Response.json({ error: "sync body too large" }, { status: 413 });
 	if (parsed.kind === "invalid") return Response.json({ error: "invalid JSON" }, { status: 400 });
 	const body = parseArtifactSyncBody(parsed.body);
 	if (!body) return Response.json({ error: "invalid sync body" }, { status: 400 });
-	const { getArtifactSync } = await import("./boot-D8cj4uZj.mjs");
+	const { getArtifactSync } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getArtifactSync()).sync(token, body);
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -225,7 +223,7 @@ var Route$6 = createFileRoute("/api/machine/status")({ server: { handlers: { GET
 	const limited = machineRouteLimit(request, token || void 0);
 	if (limited) return limited;
 	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
-	const { getGateway } = await import("./boot-D8cj4uZj.mjs");
+	const { getGateway } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getGateway()).status(token);
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -267,7 +265,7 @@ var Route$5 = createFileRoute("/api/machine/poll")({ server: { handlers: { POST:
 	if (parsed.kind !== "ok") return Response.json({ error: "invalid JSON body" }, { status: 400 });
 	const body = parsePollBody(parsed.body);
 	if (!body) return Response.json({ error: "unknown or invalid poll body fields" }, { status: 400 });
-	const { getGateway } = await import("./boot-D8cj4uZj.mjs");
+	const { getGateway } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getGateway()).pollV4Wait(token, gatewayPollRequest(body));
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -294,7 +292,7 @@ var Route$4 = createFileRoute("/api/machine/cli")({ server: { handlers: { POST:
 	if (parsed.kind === "too-large") return Response.json({ error: "body too large" }, { status: 413 });
 	const body = parsed.kind === "ok" ? parseCliBody(parsed.body) : null;
 	if (!body) return Response.json({ error: "body must be exactly {argv:string[]}" }, { status: 400 });
-	const { getCliGateway } = await import("./boot-D8cj4uZj.mjs");
+	const { getCliGateway } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getCliGateway()).cli(token, body.argv);
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -323,7 +321,7 @@ var Route$4 = createFileRoute("/api/machine/cli")({ server: { handlers: { POST:
 var PROBE_TIMEOUT_MS = 5e3;
 var Route$3 = createFileRoute("/api/health/db")({ server: { handlers: { GET: async () => {
 	try {
-		const { db } = await import("./db-BphSJs66.mjs");
+		const { db } = await import("./db-BTX-xORB.mjs");
 		const ping = db.execute(sql`select 1`);
 		const timeout = new Promise((_, reject) => {
 			setTimeout(() => reject(/* @__PURE__ */ new Error(`db ping timed out after ${PROBE_TIMEOUT_MS}ms`)), PROBE_TIMEOUT_MS).unref?.();
@@ -342,8 +340,8 @@ var Route$3 = createFileRoute("/api/health/db")({ server: { handlers: { GET: asy
 	}
 } } } });
 var Route$2 = createFileRoute("/api/auth/$")({ server: { handlers: {
-	GET: async ({ request }) => (await import("./auth-LwPp_iim.mjs")).auth.handler(request),
-	POST: async ({ request }) => (await import("./auth-LwPp_iim.mjs")).auth.handler(request)
+	GET: async ({ request }) => (await import("./auth-BV0MxVdo.mjs")).auth.handler(request),
+	POST: async ({ request }) => (await import("./auth-BV0MxVdo.mjs")).auth.handler(request)
 } } });
 /**
 * `decodeURIComponent` that returns null on malformed percent-encoding instead
@@ -377,12 +375,12 @@ var Route$1 = createFileRoute("/api/machine/blob/$hash")({ server: { handlers: {
 	if (!token) return Response.json({ error: "missing device token" }, { status: 401 });
 	const hash = safeDecode(new URL(request.url).pathname.split("/").pop() ?? "");
 	if (hash === null) return Response.json({ error: "bad hash" }, { status: 400 });
-	const { BLOB_CAP } = await import("./artifacts-DOLHJHcd.mjs");
+	const { BLOB_CAP } = await import("./artifacts-CzDJLaa6.mjs");
 	const body = await readByteBody(request, BLOB_CAP);
 	if (body.kind === "too-large") return Response.json({ error: "blob exceeds size cap" }, { status: 413 });
 	if (body.kind === "invalid") return Response.json({ error: "could not read blob body" }, { status: 400 });
 	const buf = Buffer.from(body.bytes.buffer, body.bytes.byteOffset, body.bytes.byteLength);
-	const { getArtifactSync } = await import("./boot-D8cj4uZj.mjs");
+	const { getArtifactSync } = await import("./boot-CsLXrLEa.mjs");
 	const r = await (await getArtifactSync()).putBlob(token, hash, buf);
 	return Response.json(r.body, { status: r.status });
 } } } });
@@ -399,8 +397,8 @@ var Route$1 = createFileRoute("/api/machine/blob/$hash")({ server: { handlers: {
 *    scripts - so an inline SVG can't run script against the session even if the
 *    URL is opened directly. Non-image inline requests fall back to attachment.
 *
-* Authed via the WEB SESSION (not a machine token) and scoped to the loop's team,
-* mirroring the server fns' `ownedLoop` gate. Path-safe: the relative path is
+* Authed via the web session (not a machine token) and scoped to the loop owner,
+* mirroring the server functions' `ownedLoop` gate. Path-safe: the relative path is
 * normalized + traversal-rejected before it ever reaches a blob, and blob keys
 * are content hashes, never the user path. Reads stream from the BlobStore
 * (local by default, R2 when configured); the route never writes.
@@ -417,11 +415,11 @@ var Route = createFileRoute("/api/artifact/$loopId/$")({ server: { handlers: { G
 	const segments = after.slice(slash + 1).split("/").map((s) => safeDecode(s));
 	if (segments.some((s) => s === null)) return Response.json({ error: "bad path" }, { status: 400 });
 	const relPath = segments.join("/");
-	const loop = await (await import("./store-CFCp_ggC.mjs")).getLoop(loopId);
+	const loop = await (await import("./store-DSNbXxqz.mjs")).getLoop(loopId);
 	if (!loop) return Response.json({ error: "not found" }, { status: 404 });
-	const { requestScope, canAccessLoop } = await import("./auth-LwPp_iim.mjs");
-	if (!await canAccessLoop(loop.teamId, await requestScope())) return Response.json({ error: "not found" }, { status: 404 });
-	const { readLoopArtifactBytes } = await import("./artifactFiles-ChuJ4PzC.mjs");
+	const { requestScope, canAccessLoop } = await import("./auth-BV0MxVdo.mjs");
+	if (!canAccessLoop(loop.userId, await requestScope())) return Response.json({ error: "not found" }, { status: 404 });
+	const { readLoopArtifactBytes } = await import("./artifactFiles-BvVmixrs.mjs");
 	const r = await readLoopArtifactBytes(loopId, relPath);
 	if (r.status !== 200 || !r.bytes) return Response.json({ error: "not found" }, { status: r.status });
 	const filename = (r.filename || "file").replace(/["\\\r\n]/g, "_");
@@ -447,31 +445,21 @@ var Route = createFileRoute("/api/artifact/$loopId/$")({ server: { handlers: { G
 		}
 	});
 } } } });
-var IndexRoute = Route$15.update({
+var IndexRoute = Route$14.update({
 	id: "/",
 	path: "/",
 	getParentRoute: () => Route$11
 });
-var TTeamIdRoute = Route$16.update({
-	id: "/t/$teamId",
-	path: "/t/$teamId",
-	getParentRoute: () => Route$11
-});
 var MachineReportRoute = Route$10.update({
 	id: "/machine/report",
 	path: "/machine/report",
 	getParentRoute: () => Route$11
 });
-var LoopsLoopIdRoute = Route$13.update({
+var LoopsLoopIdRoute = Route$12.update({
 	id: "/loops/$loopId",
 	path: "/loops/$loopId",
 	getParentRoute: () => Route$11
 });
-var InviteTokenRoute = Route$12.update({
-	id: "/invite/$token",
-	path: "/invite/$token",
-	getParentRoute: () => Route$11
-});
 var ApiReadyRoute = Route$9.update({
 	id: "/api/ready",
 	path: "/api/ready",
@@ -512,7 +500,7 @@ var ApiAuthSplatRoute = Route$2.update({
 	path: "/api/auth/$",
 	getParentRoute: () => Route$11
 });
-var LoopsLoopIdRunsRunIdRoute = Route$14.update({
+var LoopsLoopIdRunsRunIdRoute = Route$13.update({
 	id: "/loops/$loopId_/runs/$runId",
 	path: "/loops/$loopId/runs/$runId",
 	getParentRoute: () => Route$11
@@ -532,10 +520,8 @@ var rootRouteChildren = {
 	IndexRoute,
 	ApiHealthRoute: ApiHealthRoute._addFileChildren(ApiHealthRouteChildren),
 	ApiReadyRoute,
-	InviteTokenRoute,
 	LoopsLoopIdRoute,
 	MachineReportRoute,
-	TTeamIdRoute,
 	ApiAuthSplatRoute,
 	ApiMachineCliRoute,
 	ApiMachinePollRoute,

package/.output/server/_ssr/routes-8JSF7bX_.mjs

@@ -0,0 +1,27 @@
+import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
+import { O as useSession } from "./auth-client-RTpMpT4L.mjs";
+import { a as Loading } from "./actionUi-C_WswNb1.mjs";
+import { t as SignIn } from "./SignIn-Bp3uWaCQ.mjs";
+import { n as Route, t as DashboardView } from "./routes-BaanDO41.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-8JSF7bX_.js
+var import_jsx_runtime = require_jsx_runtime();
+/** The dashboard route. Auth mode shows sign-in before loading owner-scoped data;
+* open mode renders the server's shared administrative workspace. */
+/** First-load failure screen — a calm retry instead of the router's default
+*  error dump. Only the initial loader can land here; the in-page poll is
+*  fetch-then-set and keeps stale data on a transient blip. */
+function Home() {
+	const loaded = Route.useLoaderData();
+	const { data: session, isPending } = useSession();
+	if (loaded.auth.enabled && isPending) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {
+		className: "mx-auto max-w-[1180px] px-8 pt-12",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Loading, {})
+	});
+	if (loaded.auth.enabled && !session) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, {});
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(DashboardView, {
+		initial: loaded.initial,
+		mode: loaded.auth.enabled ? "auth" : "open"
+	});
+}
+//#endregion
+export { Home as component };

package/.output/server/_ssr/{routes-FO0MFfYK.mjs → routes-B3fulW5I.mjs}

@@ -1,15 +1,10 @@
 import { h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { f as useRouter } from "../_libs/@tanstack/react-router+[...].mjs";
-import { r as LoadErrorCard } from "./actionUi-Cf6DuEC2.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/routes-FO0MFfYK.js
+import { i as LoadErrorCard } from "./actionUi-C_WswNb1.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/routes-B3fulW5I.js
 var import_jsx_runtime = require_jsx_runtime();
-/**
-* The home route. Under the auth gate it is now a THIN redirect to the explicit
-* team URL (`/t/<lastUsed|personal>`) so the dashboard's team lives in the path
-* (bookmarkable, multi-tab). `/` keeps working forever: a signed-out visitor gets
-* the sign-in CTA; open mode (no gate ⇒ a single shared workspace with no team to
-* expose in the URL) renders the dashboard right here, unchanged.
-*/
+/** The dashboard route. Auth mode shows sign-in before loading owner-scoped data;
+* open mode renders the server's shared administrative workspace. */
 /** First-load failure screen — a calm retry instead of the router's default
 *  error dump. Only the initial loader can land here; the in-page poll is
 *  fetch-then-set and keeps stale data on a transient blip. */