@kky42/pievo-server 2.4.12 → 2.4.14

package/.output/server/_ssr/{loops._loopId-B5iPseDG.mjs → loops._loopId-CXgw2Rz1.mjs}

@@ -1,18 +1,15 @@
 import { o as __toESM } from "../_runtime.mjs";
-import { s as CODING_AGENTS } from "./boot-BIxtZHU-.mjs";
+import { Nn as validateLoopTags, s as CODING_AGENTS } from "./loopTags-CXx5UdGf.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { d as useNavigate, u as Link } from "../_libs/@tanstack/react-router+[...].mjs";
-import { C as startLoop, E as useSession, _ as loadOlderRuns, b as pauseLoop, c as getArtifact, l as getArtifacts, p as getLoopDetail, s as deleteLoop, w as stopLoop, x as runLoop, y as patchLoop } from "./SocialLinks-DVCLmql0.mjs";
-import { E as tsShort, S as runPulseStyle, T as selectCls, _ as inputCls, a as btn, b as rel, c as btnQuiet, d as dotLabel, g as humanBytes, m as fmt, n as Loading, o as btnDanger, p as dur, r as Pill, s as btnPrimary, t as ErrorBanner, u as dotColor, v as labelCls, w as sectionHeadCls } from "./ui-DGz-q9MT.mjs";
-import { t as setActiveTeamCookie } from "./teamCookie-B7hLOIie.mjs";
-import { t as SignIn } from "./SignIn-BhoZIOUp.mjs";
-import { i as useFlash, n as FlashLine, r as LoadErrorCard, t as ConfirmBar } from "./actionUi-Cf6DuEC2.mjs";
-import { n as daemonStopSupport, r as deriveLoopLifecycle, t as DAEMON_UPGRADE_REQUIRED } from "./lifecycleUi-DauKavgx.mjs";
-import { l as mergeRuns, n as MachinesModal, o as Timeline, t as LoopOverview } from "./MachinesModal-BhRw7oOx.mjs";
-import { n as artifactKind, t as Route } from "./artifactKind-DXumOv7c.mjs";
+import { E as stopLoop, O as useSession, S as runLoop, T as startLoop, b as patchLoop, c as deleteLoop, d as getArtifacts, i as OpenModeWarning, l as deriveLoopLifecycle, m as getLoopDetail, s as daemonStopSupport, t as DAEMON_UPGRADE_REQUIRED, u as getArtifact, v as loadOlderRuns, x as pauseLoop } from "./auth-client-lSMb_Idt.mjs";
+import { A as tsShort, E as runPulseStyle, M as useFlash, O as sectionHeadCls, S as labelCls, _ as fmt, a as Loading, b as humanBytes, c as btn, d as btnQuiet, g as dur, i as LoadErrorCard, k as selectCls, l as btnDanger, m as dotLabel, n as ErrorBanner, p as dotColor, r as FlashLine, t as ConfirmBar, u as btnPrimary, w as rel, x as inputCls, y as focusRing } from "./actionUi-5HOCZnom.mjs";
+import { a as Timeline, c as mergeRuns, n as MachinesModal, t as LoopOverview } from "./MachinesModal-BaEtzycr.mjs";
+import { n as artifactKind, t as Route } from "./artifactKind-DwDr8IYc.mjs";
+import { t as SignIn } from "./SignIn-sHQaBQJC.mjs";
 import { t as purify } from "../_libs/dompurify.mjs";
 import { t as g } from "../_libs/marked.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId-B5iPseDG.js
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId-CXgw2Rz1.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 /** Download URL for one artifact. Each path segment is encoded independently so
@@ -371,6 +368,8 @@ function initState(initial) {
 	const schedule = initial?.schedule;
 	return {
 		name: initial?.name ?? "",
+		tags: initial?.tags ?? [],
+		tagDraft: "",
 		mode: schedule?.mode ?? "cron",
 		cron: schedule?.mode === "cron" ? schedule.cron : "0 */3 * * *",
 		timezone: schedule?.mode === "cron" ? schedule.timezone : Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
@@ -450,10 +449,37 @@ function TextArea({ label, value, onChange, rows = 4, mono, hint }) {
 var LoopForm = (0, import_react.forwardRef)(function LoopForm({ initial }, ref) {
 	const [form, setForm] = (0, import_react.useState)(() => initState(initial));
 	const [error, setError] = (0, import_react.useState)(null);
+	const [tagError, setTagError] = (0, import_react.useState)(null);
+	const tagsLabelId = (0, import_react.useId)();
+	const tagsHintId = (0, import_react.useId)();
+	const tagsErrorId = (0, import_react.useId)();
+	const tagGroupRef = (0, import_react.useRef)(null);
+	const tagInputRef = (0, import_react.useRef)(null);
 	const set = (key, value) => setForm((current) => ({
 		...current,
 		[key]: value
 	}));
+	const commitTagDraft = () => {
+		const additions = form.tagDraft.trim() ? [form.tagDraft] : [];
+		if (!additions.length) {
+			set("tagDraft", "");
+			return;
+		}
+		const result = validateLoopTags([...form.tags, ...additions]);
+		if (!result.ok) {
+			setTagError(result.detail);
+			return;
+		}
+		setForm((current) => ({
+			...current,
+			tags: result.value,
+			tagDraft: ""
+		}));
+		setTagError(null);
+		if (result.value.length === 4) requestAnimationFrame(() => {
+			if (document.activeElement === document.body) tagGroupRef.current?.focus();
+		});
+	};
 	(0, import_react.useImperativeHandle)(ref, () => ({ read() {
 		const missing = [
 			["Name", form.name],
@@ -467,6 +493,12 @@ var LoopForm = (0, import_react.forwardRef)(function LoopForm({ initial }, ref)
 			setError(`${missing[0]} is required.`);
 			return null;
 		}
+		const tagResult = validateLoopTags([...form.tags, ...form.tagDraft.trim() ? [form.tagDraft] : []]);
+		if (!tagResult.ok) {
+			setTagError(tagResult.detail);
+			setError(null);
+			return null;
+		}
 		const delayMinutes = Number(form.delayMinutes);
 		if (form.mode === "continuous" && (!Number.isInteger(delayMinutes) || delayMinutes < 1)) {
 			setError("Continuous delay must be an integer of at least 1 minute.");
@@ -482,8 +514,10 @@ var LoopForm = (0, import_react.forwardRef)(function LoopForm({ initial }, ref)
 			delayMinutes
 		};
 		setError(null);
+		setTagError(null);
 		return {
 			name: form.name.trim(),
+			tags: tagResult.value,
 			schedule,
 			workdir: form.workdir.trim(),
 			agent: form.agent,
@@ -509,6 +543,79 @@ var LoopForm = (0, import_react.forwardRef)(function LoopForm({ initial }, ref)
 					value: form.name,
 					onChange: (value) => set("name", value)
 				}),
+				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+					className: "min-w-0",
+					children: [
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+							id: tagsLabelId,
+							className: labelCls,
+							children: "Tags"
+						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+							ref: tagGroupRef,
+							role: "group",
+							tabIndex: -1,
+							"aria-labelledby": tagsLabelId,
+							"aria-describedby": `${tagsHintId}${tagError ? ` ${tagsErrorId}` : ""}`,
+							"aria-invalid": tagError ? "true" : void 0,
+							className: "flex min-h-10 flex-wrap items-center gap-1.5 rounded-control border border-wire bg-surface px-2.5 py-1.5 outline-none transition-shadow focus-within:border-transparent focus-within:shadow-focus",
+							children: [form.tags.map((tag) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", {
+								className: "inline-flex h-6 max-w-full items-center gap-1 rounded-full bg-raised px-2.5 text-caption font-medium text-secondary",
+								children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+									className: "max-w-52 truncate",
+									title: tag,
+									children: tag
+								}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
+									type: "button",
+									"aria-label": `Remove tag ${tag}`,
+									onClick: () => {
+										set("tags", form.tags.filter((value) => value !== tag));
+										setTagError(null);
+										requestAnimationFrame(() => (tagInputRef.current ?? tagGroupRef.current)?.focus());
+									},
+									className: `-mr-1 inline-flex size-6 shrink-0 cursor-pointer items-center justify-center rounded-full text-disabled transition-colors hover:bg-surface hover:text-primary ${focusRing}`,
+									children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+										"aria-hidden": true,
+										children: "×"
+									})
+								})]
+							}, tag)), form.tags.length < 4 && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("input", {
+								ref: tagInputRef,
+								"aria-label": "Add tag",
+								value: form.tagDraft,
+								placeholder: form.tags.length ? "Add another…" : "Add a tag…",
+								onChange: (event) => {
+									set("tagDraft", event.target.value);
+									setTagError(null);
+								},
+								onKeyDown: (event) => {
+									if (event.nativeEvent.isComposing) return;
+									if (event.key === "Enter") {
+										event.preventDefault();
+										commitTagDraft();
+									} else if (event.key === "Backspace" && !form.tagDraft && form.tags.length) set("tags", form.tags.slice(0, -1));
+								},
+								onBlur: commitTagDraft,
+								className: "h-6 min-w-28 flex-1 bg-transparent px-1 text-sm text-primary outline-none placeholder:text-disabled"
+							})]
+						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+							id: tagsHintId,
+							className: hintCls,
+							children: [
+								"Up to ",
+								4,
+								". Press Enter to add."
+							]
+						}),
+						tagError && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+							id: tagsErrorId,
+							role: "alert",
+							className: "mt-1 text-caption text-accent",
+							children: tagError
+						})
+					]
+				}),
 				/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 					className: "min-w-0",
 					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("label", {
@@ -790,7 +897,6 @@ function LoopDetailView({ id }) {
 	const canStop = !deleting && !!summary.running && stopSupport.supported;
 	const online = detail.machine.online;
 	const asleep = detail.machine.presence === "asleep";
-	const crossTeam = detail.team && !detail.team.isActive ? detail.team : null;
 	if (editing) return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Shell, {
 		back,
 		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)(EditHead, {
@@ -854,24 +960,10 @@ function LoopDetailView({ id }) {
 							loopId: id,
 							runId: run.id
 						}
-					}),
-					extraPill: crossTeam ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Pill, {
-						tone: "outline",
-						children: crossTeam.name
-					}) : void 0
+					})
 				}), /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 					className: "mt-5 border-t border-hairline pt-4",
 					children: [
-						crossTeam && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(TeamBanner, {
-							team: crossTeam,
-							onSwitch: () => {
-								setActiveTeamCookie(crossTeam.id);
-								navigate({
-									to: "/t/$teamId",
-									params: { teamId: crossTeam.id }
-								});
-							}
-						}),
 						detail.machine.needsUpdate && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(MachineBanner, {
 							tone: "warn",
 							text: `Daemon update required · server requires v${detail.machine.requiredDaemonVersion}; machine reports ${detail.machine.daemonVersion ? `v${detail.machine.daemonVersion}` : "an unknown version"}.`,
@@ -989,6 +1081,20 @@ function LoopDetailView({ id }) {
 								children: configurationScheduleText
 							})
 						}),
+						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Config, {
+							label: "Tags",
+							children: loop.tags.length ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+								className: "flex flex-wrap gap-1.5",
+								children: loop.tags.map((tag) => /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+									className: "inline-flex h-[22px] max-w-52 items-center truncate rounded-full bg-raised px-2.5 text-caption font-medium text-secondary",
+									title: tag,
+									children: tag
+								}, tag))
+							}) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+								className: "text-disabled",
+								children: "None"
+							})
+						}),
 						/* @__PURE__ */ (0, import_jsx_runtime.jsx)(Config, {
 							label: "Working directory",
 							children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", {
@@ -1070,20 +1176,6 @@ function Config({ label, children }) {
 		children
 	})] });
 }
-function TeamBanner({ team, onSwitch }) {
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
-		className: "mb-2.5 flex flex-wrap items-center gap-3 rounded-control border border-hairline bg-raised px-4 py-2.5 text-meta text-secondary",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
-			"Viewing a loop in ",
-			team.name,
-			" - not your active team."
-		] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("button", {
-			onClick: onSwitch,
-			className: "ml-auto font-medium text-interactive underline",
-			children: "Switch to this team"
-		})]
-	});
-}
 function MachineBanner({ text, action, onAction, tone }) {
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
 		className: `mb-2.5 flex flex-wrap items-center gap-3 rounded-control border px-4 py-2.5 text-meta ${tone === "warn" ? "border-warn/40 bg-warn/10" : "border-hairline bg-raised"}`,
@@ -1114,7 +1206,7 @@ function EditHead({ name, onBack }) {
 		}),
 		/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
 			className: "mt-1.5 text-meta text-secondary",
-			children: "Edit the stored schedule, execution settings, prompt, status definitions, and exact artifact paths."
+			children: "Edit tags, schedule, execution settings, prompt, status definitions, and exact artifact paths."
 		})
 	] });
 }
@@ -1198,16 +1290,22 @@ function RunsSection({ loopId, summary, runs, older, onMore, onPickRun }) {
 * data + self-poll (ssr:false so the session cookie rides along with its fetches,
 * like the dashboard loader). Run rows link on to `/loops/$loopId/runs/$runId`.
 *
-* Auth-gated exactly like the dashboard (`/`): the loader checks getAuthState +
-* the session so a logged-out/expired DEEP LINK shows the sign-in CTA instead of
-* a raw `loop not found` error from the ownership-blocked data fetch.
+* Auth-gated exactly like the dashboard (`/`): Better Auth's session hook keeps a
+* logged-out or expired deep link from mounting the ownership-scoped data view.
 */
 function LoopDetailPage() {
 	const { loopId } = Route.useParams();
 	const { auth } = Route.useLoaderData() ?? { auth: { enabled: false } };
 	const { data: session, isPending } = useSession();
-	if (auth?.enabled && !isPending && !session) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, { callbackURL: `/loops/${loopId}` });
-	return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoopDetailView, { id: loopId });
+	if (auth.enabled && isPending) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {
+		className: "mx-auto max-w-[1360px] px-8 pt-10",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Loading, {})
+	});
+	if (auth.enabled && !session) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, { callbackURL: `/loops/${loopId}` });
+	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [!auth.enabled && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+		className: "mx-auto max-w-[1360px] px-8 pt-6",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OpenModeWarning, {})
+	}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)(LoopDetailView, { id: loopId })] });
 }
 //#endregion
 export { LoopDetailPage as component };

package/.output/server/_ssr/{loops._loopId_.runs._runId-DVtG0xYb.mjs → loops._loopId_.runs._runId-Dk94Z0Jq.mjs}

@@ -1,7 +1,7 @@
 import { c as createFileRoute, s as lazyRouteComponent } from "../_libs/@tanstack/react-router+[...].mjs";
-import { i as authClient, u as getAuthState } from "./SocialLinks-DVCLmql0.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-DVtG0xYb.js
-var $$splitComponentImporter = () => import("./loops._loopId_.runs._runId-BA-P6sGA.mjs");
+import { f as getAuthState } from "./auth-client-lSMb_Idt.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-Dk94Z0Jq.js
+var $$splitComponentImporter = () => import("./loops._loopId_.runs._runId-SASSqOfy.mjs");
 /**
 * Run detail PAGE — `/loops/$loopId/runs/$runId`. A standalone page (the trailing
 * `_` on the `$loopId` segment opts it out of the loop page's component so the run
@@ -9,19 +9,12 @@ var $$splitComponentImporter = () => import("./loops._loopId_.runs._runId-BA-P6s
 * modal or an inline panel. It resolves the run from the loop's detail payload
 * (reusing getLoopDetail) and the existing artifact diff.
 *
-* Auth-gated like the dashboard (`/`) so a logged-out/expired DEEP LINK shows the
-* sign-in CTA instead of a raw `loop not found` error from the blocked fetch.
+* Auth-gated like the dashboard (`/`) so Better Auth's session hook keeps a
+* logged-out or expired deep link from mounting the run view.
 */
 var Route = createFileRoute("/loops/$loopId_/runs/$runId")({
 	ssr: false,
-	loader: async () => {
-		const auth = await getAuthState();
-		if (auth.enabled) {
-			const { data: session } = await authClient.getSession();
-			if (!session) return { auth };
-		}
-		return { auth };
-	},
+	loader: async () => ({ auth: await getAuthState() }),
 	component: lazyRouteComponent($$splitComponentImporter, "component")
 });
 //#endregion

package/.output/server/_ssr/{loops._loopId_.runs._runId-BA-P6sGA.mjs → loops._loopId_.runs._runId-SASSqOfy.mjs}

@@ -1,12 +1,11 @@
 import { o as __toESM } from "../_runtime.mjs";
 import { g as require_react, h as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { u as Link } from "../_libs/@tanstack/react-router+[...].mjs";
-import { E as useSession, T as stopRun, _ as loadOlderRuns, m as getRunDiff, p as getLoopDetail } from "./SocialLinks-DVCLmql0.mjs";
-import { S as runPulseStyle, a as btn, g as humanBytes, h as fnum, i as StatusPill, m as fmt, n as Loading, o as btnDanger, p as dur, r as Pill, w as sectionHeadCls } from "./ui-DGz-q9MT.mjs";
-import { t as SignIn } from "./SignIn-BhoZIOUp.mjs";
-import { r as LoadErrorCard } from "./actionUi-Cf6DuEC2.mjs";
-import { t as Route } from "./loops._loopId_.runs._runId-DVtG0xYb.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-BA-P6sGA.js
+import { D as stopRun, O as useSession, h as getRunDiff, i as OpenModeWarning, m as getLoopDetail, v as loadOlderRuns } from "./auth-client-lSMb_Idt.mjs";
+import { E as runPulseStyle, O as sectionHeadCls, _ as fmt, a as Loading, b as humanBytes, c as btn, g as dur, i as LoadErrorCard, l as btnDanger, o as Pill, s as StatusPill, v as fnum } from "./actionUi-5HOCZnom.mjs";
+import { t as SignIn } from "./SignIn-sHQaBQJC.mjs";
+import { t as Route } from "./loops._loopId_.runs._runId-Dk94Z0Jq.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/loops._loopId_.runs._runId-SASSqOfy.js
 var import_react = /* @__PURE__ */ __toESM(require_react());
 var import_jsx_runtime = require_jsx_runtime();
 /**
@@ -596,30 +595,39 @@ function RunDetailView({ loopId, runId }) {
 * modal or an inline panel. It resolves the run from the loop's detail payload
 * (reusing getLoopDetail) and the existing artifact diff.
 *
-* Auth-gated like the dashboard (`/`) so a logged-out/expired DEEP LINK shows the
-* sign-in CTA instead of a raw `loop not found` error from the blocked fetch.
+* Auth-gated like the dashboard (`/`) so Better Auth's session hook keeps a
+* logged-out or expired deep link from mounting the run view.
 */
 function RunDetailPage() {
 	const { loopId, runId } = Route.useParams();
 	const { auth } = Route.useLoaderData() ?? { auth: { enabled: false } };
 	const { data: session, isPending } = useSession();
+	if (auth.enabled && isPending) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {
+		className: "mx-auto max-w-[1360px] px-8 pt-10",
+		children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Loading, {})
+	});
+	if (auth.enabled && !session) return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, { callbackURL: `/loops/${loopId}/runs/${runId}` });
 	return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("main", {
-		className: "mx-auto max-w-[1360px] px-8 pb-24 pt-10",
-		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
-			className: "mb-5",
-			children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Link, {
-				to: "/loops/$loopId",
-				params: { loopId },
-				className: "inline-flex items-center gap-1.5 text-label font-medium text-secondary transition-colors hover:text-display",
-				children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
-					"aria-hidden": true,
-					children: "←"
-				}), " Back to loop"]
+		className: "mx-auto max-w-[1360px] px-8 pb-24 pt-6",
+		children: [
+			!auth.enabled && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(OpenModeWarning, { className: "mb-6" }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", {
+				className: "mb-5",
+				children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Link, {
+					to: "/loops/$loopId",
+					params: { loopId },
+					className: "inline-flex items-center gap-1.5 text-label font-medium text-secondary transition-colors hover:text-display",
+					children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", {
+						"aria-hidden": true,
+						children: "←"
+					}), " Back to loop"]
+				})
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)(RunDetailView, {
+				loopId,
+				runId
 			})
-		}), auth?.enabled && !isPending && !session ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(SignIn, { callbackURL: `/loops/${loopId}/runs/${runId}` }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RunDetailView, {
-			loopId,
-			runId
-		})]
+		]
 	});
 }
 //#endregion

package/.output/server/_ssr/{machineFns-Bb9KNXun.mjs → machineFns-BSrIgn3f.mjs}

@@ -1,31 +1,16 @@
-import { A as ensureServer, Bt as sha256, C as createMachine$1, G as getMachine, Jt as updateMachine, P as forceDeleteMachine, St as mintDeviceToken, T as daemonNeedsUpdate, X as getTeamMember, bt as machineIdFromToken, dt as listMachines$1, ft as listMachinesForTeam, jt as rememberConnectKey, u as MIN_DAEMON_VERSION, yt as loopsForMachine } from "./boot-BIxtZHU-.mjs";
-import { requestScope } from "./auth-LwPp_iim.mjs";
+import { Et as listMachinesForUser, G as forceDeleteMachine, Lt as mintDeviceToken, Nt as loopsForMachine, Pt as machineIdFromToken, Sn as sha256, Tt as listMachines$1, et as getMachine, j as createMachine$1, jn as updateMachine } from "./loopTags-CXx5UdGf.mjs";
+import { a as daemonNeedsUpdate, n as MIN_DAEMON_VERSION, o as ensureServer } from "./boot-C472kLwY.mjs";
+import { requestScope } from "./auth-0AamrwHo.mjs";
 import { n as createServerFn } from "./ssr.mjs";
 import { t as createServerRpc } from "./createServerRpc-BD8Xn_0_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-Bb9KNXun.js
-/**
-* Whether a machine is visible/actionable in the request scope. Mirrors
-* listMachines: open mode sees everything; otherwise the requester must own the
-* machine or share the active team with its owner. `teamMachineIds` is a THUNK
-* (the team set needs a DB join) invoked only after the owner check misses — the
-* hot path (machineStatus polls every ~2.5s while the connect dialog is open,
-* usually by the owner) pays no query.
-*/
-function machineInScope(m, scope, teamMachineIds) {
-	if (!scope.enforce) return true;
-	if (!scope.userId) return false;
-	if (m.userId === scope.userId) return true;
-	return teamMachineIds().has(m.id);
+//#region node_modules/.nitro/vite/services/ssr/assets/machineFns-BSrIgn3f.js
+/** Open mode sees every machine; auth mode sees only the signed-in owner's rows. */
+function machineInScope(machine, scope) {
+	return !scope.enforce || !!scope.userId && machine.userId === scope.userId;
 }
-/**
-* Whether the machine's PLAINTEXT device token may be serialized to this
-* requester. Owner-only under the gate — the token fully impersonates the
-* machine, so even a teammate/admin who may see (or delete) the row gets
-* `token: null`. Open mode keeps the v1 behavior (token shown, e.g. for the
-* reconnect command).
-*/
-function tokenVisibleTo(m, scope) {
-	return !scope.enforce || m.userId === scope.userId;
+/** A device token fully impersonates its machine, so auth mode keeps it owner-only. */
+function tokenVisibleTo(machine, scope) {
+	return machineInScope(machine, scope);
 }
 /**
 * Latest published @kky42/pievo version — a cached, fail-silent lookup of the
@@ -108,102 +93,64 @@ var LatestDaemonVersion = class {
 };
 var latestDaemonVersion = new LatestDaemonVersion();
 /**
-* Machine management server functions. Connect flow (two acts):
-*   1. createMachine() → mint a token, create a PENDING (unnamed) row, return
-*      {id, token}. The UI shows the connect command + "waiting…".
-*   2. the daemon connects → poll records online + hostname/platform/arch. The
-*      UI polls machineStatus(id); once connected it shows the name field
-*      (prefilled with the hostname). finalizeMachine({id,name}) names it →
-*      it appears in the list. cancelMachine(id) drops a pending row.
-*
-* Scoping: when the auth gate is on, every fn requires a signed-in user, and a
-* machine is visible/actionable only when the requester owns it, its owner is a
-* member of the active team, or the scope is the admin "All teams" view (the
-* same rule listMachines filters by). The PLAINTEXT device token is serialized
-* ONLY to the machine's owner — it fully impersonates the machine (poll /
-* create-loop / log), so a teammate who can see the row must never exfiltrate
-* it. Open mode (gate off) keeps the shared workspace: everyone sees/manages
-* all machines, tokens included. No workdir jail (fully open) for now.
-*/
-/** Ids of the machines membership-visible in the scope's active team (the same
-*  set listMachines serves). Empty when the scope needs no team check (open
-*  mode or signed-out — machineInScope settles those before ever invoking its
-*  team-set thunk). */
-async function teamMachineIds(scope) {
-	if (!scope.enforce || !scope.userId) return /* @__PURE__ */ new Set();
-	return new Set((await listMachinesForTeam(scope.teamId)).map((m) => m.id));
-}
-/**
-* Resolve a machine and authorize it against the request scope (the machine-fn
-* twin of loopApi's `ownedLoop`). `machine` is undefined when it's missing OR
-* out of scope — callers treat both as "not found" so existence never leaks.
-* The scope rides along so callers don't re-run requestScope (a second session
-* decrypt); the team-set thunk keeps the owner fast path query-free.
+* Machine-management server functions. In auth mode, the signed-in user is the
+* sole human authorization boundary. Open mode intentionally shares all machine
+* administration, including reconnect tokens.
 */
+/** Missing and out-of-scope machines both resolve to undefined. */
 async function scopedMachine(id) {
 	const scope = await requestScope();
-	const m = await getMachine(id);
-	const teamIds = await teamMachineIds(scope);
+	if (scope.enforce && !scope.userId) return { scope };
+	const candidate = await getMachine(id);
 	return {
 		scope,
-		machine: m && machineInScope(m, scope, () => teamIds) ? m : void 0
+		machine: candidate && machineInScope(candidate, scope) ? candidate : void 0
 	};
 }
-async function toSummary(m, scope) {
+async function toSummary(machine, scope) {
 	return {
-		id: m.id,
-		name: m.name,
-		online: !!m.online,
-		lastSeen: m.lastSeen ?? null,
-		hostname: m.hostname ?? null,
-		platform: m.platform ?? null,
-		arch: m.arch ?? null,
-		daemonVersion: m.daemonVersion ?? null,
-		daemonProtocol: m.daemonProtocol ?? null,
+		id: machine.id,
+		name: machine.name,
+		online: !!machine.online,
+		lastSeen: machine.lastSeen ?? null,
+		hostname: machine.hostname ?? null,
+		platform: machine.platform ?? null,
+		arch: machine.arch ?? null,
+		daemonVersion: machine.daemonVersion ?? null,
+		daemonProtocol: machine.daemonProtocol ?? null,
 		latestDaemonVersion: latestDaemonVersion.get(),
-		needsUpdate: daemonNeedsUpdate(m.daemonVersion),
+		needsUpdate: daemonNeedsUpdate(machine.daemonVersion),
 		requiredDaemonVersion: MIN_DAEMON_VERSION,
-		token: tokenVisibleTo(m, scope) ? m.token ?? null : null,
-		loopCount: (await loopsForMachine(m.id)).length
+		token: tokenVisibleTo(machine, scope) ? machine.token ?? null : null,
+		loopCount: (await loopsForMachine(machine.id)).length
 	};
 }
-/** Named machines only (pending/unnamed rows are mid-connect). Scoped to the
-*  given/active team when the gate is on; the full shared list in open mode. An
-*  explicit `teamId` (the `/t/<id>` route) scopes this request independent of the
-*  cookie, so a tab on /t/A and one on /t/B list different machines at once. */
 var listMachines_createServerFn_handler = createServerRpc({
 	id: "aa46310016bb8a58b273a648ffd498c87f1f450d12827e30110a3b83ba6a27d9",
 	name: "listMachines",
 	filename: "src/server/machineFns.ts"
 }, (opts) => listMachines.__executeServer(opts));
-var listMachines = createServerFn({ method: "GET" }).validator((teamId) => teamId).handler(listMachines_createServerFn_handler, async ({ data: teamId }) => {
+var listMachines = createServerFn({ method: "GET" }).handler(listMachines_createServerFn_handler, async () => {
 	await ensureServer();
-	const scope = await requestScope(teamId);
-	const { enforce, userId, teamId: active } = scope;
-	if (enforce && !userId) return [];
-	const list = enforce ? await listMachinesForTeam(active) : await listMachines$1();
-	return Promise.all(list.filter((m) => m.name.trim()).map((m) => toSummary(m, scope)));
+	const scope = await requestScope();
+	if (scope.enforce && !scope.userId) return [];
+	const machines = scope.enforce ? await listMachinesForUser(scope.userId) : await listMachines$1();
+	return Promise.all(machines.filter((machine) => machine.name.trim()).map((machine) => toSummary(machine, scope)));
 });
 var createMachine_createServerFn_handler = createServerRpc({
 	id: "ed679b4e1e05e903a5d4ba4a70d9b9d883991ab22ed59b4d2d69078941818415",
 	name: "createMachine",
 	filename: "src/server/machineFns.ts"
 }, (opts) => createMachine.__executeServer(opts));
-var createMachine = createServerFn({ method: "POST" }).validator((teamId) => teamId).handler(createMachine_createServerFn_handler, async ({ data: teamId }) => {
+var createMachine = createServerFn({ method: "POST" }).handler(createMachine_createServerFn_handler, async () => {
 	await ensureServer();
-	const { enforce, userId, teamId: active } = await requestScope(teamId);
-	if (enforce && !userId) return { error: "not signed in" };
+	const scope = await requestScope();
+	if (scope.enforce && !scope.userId) return { error: "not signed in" };
 	const token = mintDeviceToken();
 	const id = machineIdFromToken(token);
-	const owner = userId ?? "shared";
-	await rememberConnectKey(token, {
-		userId: owner,
-		teamId: active
-	});
 	await createMachine$1({
 		id,
-		userId: owner,
-		teamId: active,
+		userId: scope.userId ?? "shared",
 		name: "",
 		tokenHash: sha256(token),
 		token,
@@ -229,7 +176,7 @@ var finalizeMachine_createServerFn_handler = createServerRpc({
 	name: "finalizeMachine",
 	filename: "src/server/machineFns.ts"
 }, (opts) => finalizeMachine.__executeServer(opts));
-var finalizeMachine = createServerFn({ method: "POST" }).validator((d) => d).handler(finalizeMachine_createServerFn_handler, async ({ data }) => {
+var finalizeMachine = createServerFn({ method: "POST" }).validator((data) => data).handler(finalizeMachine_createServerFn_handler, async ({ data }) => {
 	await ensureServer();
 	const name = data.name?.trim();
 	if (!name) return { ok: false };
@@ -253,21 +200,8 @@ var deleteMachine = createServerFn({ method: "POST" }).validator((id) => id).han
 		ok: false,
 		error: "machine not found"
 	};
-	const loops = await loopsForMachine(id);
-	let allowedTeamIds = scope.enforce ? [] : void 0;
-	if (scope.enforce && loops.length > 0) {
-		allowedTeamIds = [...new Set(loops.map((loop) => loop.teamId))];
-		if ((await Promise.all(allowedTeamIds.map((teamId) => getTeamMember(teamId, scope.userId)))).some((membership) => membership?.role !== "owner")) return {
-			ok: false,
-			error: "Only an owner of every affected team can delete this machine and its loops."
-		};
-	}
-	const deleted = await forceDeleteMachine(id, allowedTeamIds);
-	if (deleted.state === "forbidden") return {
-		ok: false,
-		error: "Machine loops changed while deleting; review them and try again."
-	};
-	if (deleted.state === "not-found") return {
+	const deleted = scope.enforce ? await forceDeleteMachine(id, scope.userId) : await forceDeleteMachine(id);
+	if (deleted.state === "forbidden" || deleted.state === "not-found") return {
 		ok: false,
 		error: "machine not found"
 	};

package/.output/server/_ssr/{node-sqlite-dialect-Dho9YjXb.mjs → node-sqlite-dialect-BbUqnnYv.mjs}

@@ -1,6 +1,6 @@
-import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-LwPp_iim.mjs";
+import { n as DefaultQueryCompiler, o as CompiledQuery, s as sql$1 } from "./auth-0AamrwHo.mjs";
 import { n as DEFAULT_MIGRATION_TABLE, t as DEFAULT_MIGRATION_LOCK_TABLE } from "./kysely-migration-tables-JkVUjPF_-bPAX9LR_.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-Dho9YjXb.js
+//#region node_modules/.nitro/vite/services/ssr/assets/node-sqlite-dialect-BbUqnnYv.js
 var NodeSqliteAdapter = class {
 	get supportsCreateIfNotExists() {
 		return true;