@kky42/pievo-server 2.4.12 → 2.4.14

package/.output/server/_ssr/boot-C472kLwY.mjs

@@ -0,0 +1,3947 @@
+import { r as __exportAll } from "../_runtime.mjs";
+import { _ as isNotNull, d as and, f as eq, g as inArray, j as sql, m as gte, u as desc, x as lte } from "../_libs/drizzle-orm+postgres.mjs";
+import { t as E } from "../_libs/croner.mjs";
+import { $ as getLoop, $t as reclaimRun, A as createLoop, An as updateLoop, At as logger, B as enqueueRun, Bt as parseArtifactSyncBody, C as claimReadyRunForMachine, Cn as sha256Buf, Ct as listLoops, D as countRuns, Dn as stopLoop, Dt as listRuns, E as countRunSnapshots, En as startLoop, F as dbWatchdogFailureThreshold, Ft as machinePresence, Gt as pruneRunSnapshots, H as expirePendingRun, Ht as pauseLoopState, I as dbWatchdogIntervalMs, It as machineReferencesBlob, Jt as putTerminalReportIncidentIfAbsent, K as gcIntervalMs, Kt as putReportReceiptIfAbsent, L as dbWatchdogTimeoutMs, M as dataDir, Mn as upsertConfiguredArtifactFile, Mt as loopIdsWithSnapshots, N as db, Nn as validateLoopTags, Nt as loopsForMachine, P as dbWatchdogEnabled, Pt as machineIdFromToken, Sn as sha256, T as coerceCodingAgent, Tn as snapshotRetention, Tt as listMachines, U as finalizeRunningRun, Ut as prevRunSnapshot, W as forceDeleteLoop, Wt as pruneExpiredLeases, Xt as readConnectKeyBinding, Yt as r2Config, Z as getExactTerminalReportIncident, Zt as readNewIdempotency, _ as blobExists, _n as runningRunForLoop, an as recordRunReportOnce, at as getRunSnapshot, b as blobSizes, cn as releaseAbsentReconciliations, dn as requestDeleteLoop, dt as isDeviceTokenShape, en as reconcileConfiguredArtifacts, et as getMachine, f as acknowledgeRetiredReport, fn as requestRunCancel, gn as runMigrations, h as artifactFileReferencesHash, hn as retireLease, in as recordNewIdempotency, it as getRun, j as createMachine, jn as updateMachine, jt as loginGateEnabled, kn as tryDeleteLoop, kt as liveBlobRefs, lt as initializeCronCadence, m as advanceDueSchedules, mn as resolveLease, on as refreshRunHeartbeats, ot as getTerminalReportIncidents, p as acknowledgeRetiredTerminalIncident, pt as isOutdated, qt as putRunSnapshot, rn as recordBlob, rt as getReportReceipt, s as CODING_AGENTS, sn as rejectTerminalReport, tn as reconcileReclaimedRun, u as TERMINAL_GRACE_MS, un as repairTerminalRunLeases, v as blobGcGraceMs, vn as runningRunsForMachine, vt as isValidHash, w as closeClient, wn as snapshotBlobRefs, x as buildLoopManifest, xn as setMachineOnline, xt as lastRun, y as blobHashesOlderThan, yn as runs, yt as isValidSemver, z as deleteBlob, zt as openRuns } from "./loopTags-CXx5UdGf.mjs";
+import { i as __exportAll$1 } from "./factory-ixUjZqJn.mjs";
+import { t as createTwoFilesPatch } from "../_libs/diff.mjs";
+import { createHash, randomUUID } from "node:crypto";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+//#region node_modules/.nitro/vite/services/ssr/assets/boot-C472kLwY.js
+var boot_C472kLwY_exports = /* @__PURE__ */ __exportAll({
+	_: () => validOptionalPollString,
+	a: () => POLL_HTTP_BODY_FIELDS,
+	c: () => MIN_DAEMON_VERSION,
+	d: () => statusDefinitionsFromLoop,
+	f: () => validateLoopEdit,
+	g: () => readJsonBody,
+	h: () => readByteBody,
+	i: () => runDiff_exports,
+	l: () => daemonNeedsUpdate,
+	m: () => POLL_INFO_TEXT_CAP,
+	n: () => ensureServer,
+	o: () => validPollCurrentRun,
+	p: () => MACHINE_BODY_CAP,
+	r: () => getArtifactSync,
+	s: () => validPollWireId,
+	t: () => boot_exports,
+	u: () => scheduleFromLoop
+});
+/**
+* Machine-route ingress: read + parse a JSON request body under a hard size cap.
+* The gateway's per-field wire caps (WIRE_TEXT_CAP etc.) clip individual strings
+* AFTER parse — without this, an unbounded `request.json()` still buffers an
+* arbitrarily large body first. Framework-free (plain Request) so any machine
+* route can share it.
+*/
+/**
+* Body cap for standard machine routes (poll / report / CLI).
+* 2MB — generously above the largest legitimate terminal report or loop edit.
+* The exact-manifest sync route has its own 32 MB JSON-body cap.
+*/
+var MACHINE_BODY_CAP = 2 * 1024 * 1024;
+/** Read raw request bytes under a hard cap. Declared oversize requests fail
+* before reading; chunked/lying streams are canceled on the first chunk that
+* takes the observed count over the cap. */
+async function readByteBody(request, maxBytes) {
+	const declared = Number(request.headers.get("content-length") ?? "");
+	if (Number.isFinite(declared) && declared > maxBytes) return { kind: "too-large" };
+	if (!request.body) return {
+		kind: "ok",
+		bytes: new Uint8Array()
+	};
+	const reader = request.body.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maxBytes) {
+				reader.cancel("request body exceeds byte cap").catch(() => void 0);
+				return { kind: "too-large" };
+			}
+			chunks.push(value);
+		}
+	} catch {
+		return { kind: "invalid" };
+	} finally {
+		reader.releaseLock();
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		kind: "ok",
+		bytes
+	};
+}
+/**
+* Read + parse a JSON body under an actual byte cap. An empty body parses as
+* `{}`; unreadable streams and parse failures are invalid.
+*/
+async function readJsonBody(request, maxBytes) {
+	const read = await readByteBody(request, maxBytes);
+	if (read.kind !== "ok") return read;
+	if (read.bytes.byteLength === 0) return {
+		kind: "ok",
+		body: {}
+	};
+	const text = new TextDecoder().decode(read.bytes);
+	if (!text) return {
+		kind: "ok",
+		body: {}
+	};
+	try {
+		return {
+			kind: "ok",
+			body: JSON.parse(text)
+		};
+	} catch {
+		return { kind: "invalid" };
+	}
+}
+var WIRE_TEXT_CAP = 512 * 1024;
+/** Validate an optional poll string without coercion, clipping, or NUL removal. */
+function validOptionalPollString(value, cap) {
+	return value === void 0 || typeof value === "string" && value.length <= cap && !value.includes("\0");
+}
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+/** Strip NUL (U+0000) from a wire string: Postgres text/jsonb columns REJECT the
+*  NUL byte (SQLite tolerated it), so a daemon-supplied string carrying one would
+*  throw mid-finalize on the DB write. The single sanitizing primitive behind
+*  `clipText` and index.ts's `str` - and used directly by `cli.ts`
+*  (parseFlags/validateState, the same one-chokepoint discipline). */
+function stripNul(s) {
+	return s.replace(/\u0000/g, "");
+}
+function clipText(s, cap) {
+	return stripNul(s.slice(0, cap));
+}
+/**
+* Deliver the user's prompt unchanged, followed only by the complete report
+* contract. The run index intentionally remains an internal history fact.
+*/
+function buildRunTask(loop) {
+	return `${loop.prompt}\n\nStatus definitions:\n- keep: ${loop.statusKeep}\n- no-change: ${loop.statusNoChange}\n- block: ${loop.statusBlock}\n\nBefore finishing, call exactly once:\npievo report --message "<summary>" --status <keep|no-change|block>`;
+}
+async function buildDelivery(loop, queuedRun, runToken, roots) {
+	if (queuedRun.runIndex == null) throw new Error(`claimed run ${queuedRun.id} has no history index`);
+	return {
+		runId: queuedRun.id,
+		runIndex: queuedRun.runIndex,
+		runToken,
+		roots,
+		loop: {
+			id: loop.id,
+			name: loop.name,
+			workdir: loop.workdir,
+			model: loop.model ?? null,
+			reasoningEffort: loop.reasoningEffort ?? null,
+			agent: loop.agent
+		},
+		task: buildRunTask(loop),
+		artifacts: loop.artifacts
+	};
+}
+/**
+* Content-addressed blob byte store for live-synced loop artifacts.
+*
+* Bytes are keyed by their sha256 hash (content-addressed ⇒ deduped across every
+* loop/run). The store ONLY writes/reads bytes — it never executes or interprets
+* them — preserving the server's zero-exec invariant.
+*
+* Three implementations behind one small interface:
+*   • LocalBlobStore — durable filesystem default under PIEVO_DATA_DIR/blobs.
+*   • R2BlobStore — Cloudflare R2 (S3-compatible) when credentials are configured.
+*   • MemoryBlobStore — explicit ephemeral selection or injected test fake.
+*
+* The S3 client is dynamic-imported inside R2BlobStore so tests (and any deploy
+* without R2 creds) never load the AWS SDK, and it stays out of the client bundle.
+*/
+var log$4 = logger.child({ mod: "blobstore" });
+var SHA256_HEX = /^[a-f0-9]{64}$/;
+/** Durable filesystem adapter. Hash sharding bounds entries per directory; atomic
+* temp-file renames ensure readers see either complete bytes or no object. */
+var LocalBlobStore = class {
+	root;
+	initialized;
+	constructor(root = path.join(dataDir(), "blobs")) {
+		this.root = root;
+	}
+	file(hash) {
+		if (!SHA256_HEX.test(hash)) throw new Error("invalid sha256 blob key");
+		return path.join(this.root, hash.slice(0, 2), hash);
+	}
+	async has(hash) {
+		const target = this.file(hash);
+		await this.ensureInitialized();
+		try {
+			return (await fs$1.stat(target)).isFile();
+		} catch (err) {
+			if (err.code === "ENOENT") return false;
+			throw err;
+		}
+	}
+	async syncDir(dir) {
+		let handle;
+		try {
+			handle = await fs$1.open(dir, "r");
+			await handle.sync();
+		} catch (err) {
+			const code = err.code;
+			if (![
+				"EINVAL",
+				"ENOTSUP",
+				"EBADF",
+				"EPERM",
+				"ENOENT"
+			].includes(code)) throw err;
+		} finally {
+			await handle?.close().catch(() => {});
+		}
+	}
+	ensureInitialized() {
+		return this.initialized ??= (async () => {
+			await fs$1.mkdir(this.root, { recursive: true });
+			await this.syncDir(path.dirname(path.dirname(this.root)));
+			await this.syncDir(path.dirname(this.root));
+			await this.syncDir(this.root);
+			for (const shard of await fs$1.readdir(this.root, { withFileTypes: true })) {
+				if (!shard.isDirectory() || !/^[a-f0-9]{2}$/.test(shard.name)) continue;
+				const dir = path.join(this.root, shard.name);
+				let removed = false;
+				for (const name of await fs$1.readdir(dir)) {
+					if (!/^\.[a-f0-9]{64}\.\d+\.[0-9a-f-]+\.tmp$/.test(name)) continue;
+					await fs$1.rm(path.join(dir, name), { force: true });
+					removed = true;
+				}
+				if (removed) await this.syncDir(dir);
+			}
+		})();
+	}
+	async put(hash, bytes) {
+		const target = this.file(hash);
+		await this.ensureInitialized();
+		const dir = path.dirname(target);
+		await fs$1.mkdir(dir, { recursive: true });
+		await this.syncDir(this.root);
+		const temp = path.join(dir, `.${hash}.${process.pid}.${randomUUID()}.tmp`);
+		let handle;
+		try {
+			handle = await fs$1.open(temp, "wx", 384);
+			await handle.writeFile(bytes);
+			await handle.sync();
+			await handle.close();
+			handle = void 0;
+			try {
+				await fs$1.rename(temp, target);
+				await this.syncDir(dir);
+			} catch (err) {
+				if ([
+					"EEXIST",
+					"EACCES",
+					"EPERM"
+				].includes(err.code ?? "") && await this.has(hash)) {
+					await fs$1.rm(temp, { force: true });
+					return;
+				}
+				throw err;
+			}
+		} catch (err) {
+			await handle?.close().catch(() => {});
+			await fs$1.rm(temp, { force: true }).catch(() => {});
+			throw err;
+		}
+	}
+	async get(hash) {
+		const target = this.file(hash);
+		await this.ensureInitialized();
+		try {
+			return await fs$1.readFile(target);
+		} catch (err) {
+			if (err.code === "ENOENT") return null;
+			throw err;
+		}
+	}
+	async delete(hash) {
+		const target = this.file(hash);
+		await this.ensureInitialized();
+		await fs$1.rm(target, { force: true });
+		await this.syncDir(path.dirname(target));
+	}
+};
+var MemoryBlobStore = class {
+	map = /* @__PURE__ */ new Map();
+	async has(hash) {
+		return this.map.has(hash);
+	}
+	async put(hash, bytes) {
+		this.map.set(hash, Buffer.from(bytes));
+	}
+	async get(hash) {
+		return this.map.get(hash) ?? null;
+	}
+	async delete(hash) {
+		this.map.delete(hash);
+	}
+};
+function blobKey(hash) {
+	return `blobs/${hash}`;
+}
+var R2BlobStore = class {
+	cfg;
+	client;
+	constructor(cfg) {
+		this.cfg = cfg;
+	}
+	async s3() {
+		if (this.client) return this.client;
+		const { S3Client } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
+		this.client = new S3Client({
+			region: this.cfg.region,
+			endpoint: this.cfg.endpoint,
+			credentials: {
+				accessKeyId: this.cfg.accessKeyId,
+				secretAccessKey: this.cfg.secretAccessKey
+			},
+			forcePathStyle: true
+		});
+		return this.client;
+	}
+	async has(hash) {
+		const { HeadObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
+		const client = await this.s3();
+		try {
+			await client.send(new HeadObjectCommand({
+				Bucket: this.cfg.bucket,
+				Key: blobKey(hash)
+			}));
+			return true;
+		} catch (err) {
+			if (isNotFound(err)) return false;
+			throw err;
+		}
+	}
+	async put(hash, bytes) {
+		const { PutObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
+		await (await this.s3()).send(new PutObjectCommand({
+			Bucket: this.cfg.bucket,
+			Key: blobKey(hash),
+			Body: bytes,
+			ContentLength: bytes.length
+		}));
+	}
+	async get(hash) {
+		const { GetObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
+		const client = await this.s3();
+		try {
+			const body = (await client.send(new GetObjectCommand({
+				Bucket: this.cfg.bucket,
+				Key: blobKey(hash)
+			}))).Body;
+			if (!body?.transformToByteArray) return null;
+			return Buffer.from(await body.transformToByteArray());
+		} catch (err) {
+			if (isNotFound(err)) return null;
+			throw err;
+		}
+	}
+	async delete(hash) {
+		const { DeleteObjectCommand } = await import("../_libs/@aws-sdk/client-s3+[...].mjs").then((n) => n.t);
+		await (await this.s3()).send(new DeleteObjectCommand({
+			Bucket: this.cfg.bucket,
+			Key: blobKey(hash)
+		}));
+	}
+};
+function isNotFound(err) {
+	const e = err;
+	return e?.name === "NotFound" || e?.name === "NoSuchKey" || e?.$metadata?.httpStatusCode === 404;
+}
+/**
+* The configured blob store: durable local filesystem under PIEVO_DATA_DIR by
+* default; complete R2 credentials preserve the existing R2 selection behavior,
+* while memory requires an explicit selector. Constructed once and shared by every
+* gateway so writes, reads, and GC use the same adapter.
+*/
+function createBlobStore() {
+	const selection = process.env.PIEVO_BLOB_STORE?.trim().toLowerCase();
+	if (selection && ![
+		"local",
+		"r2",
+		"memory"
+	].includes(selection)) throw new Error("PIEVO_BLOB_STORE must be local, r2, or memory");
+	if (selection === "memory") {
+		log$4.warn("blob store: EPHEMERAL MEMORY explicitly selected; all artifact bytes are lost on restart");
+		return new MemoryBlobStore();
+	}
+	if (selection === "local") {
+		const local = new LocalBlobStore();
+		log$4.info({ root: local.root }, "blob store: local filesystem (explicit)");
+		return local;
+	}
+	const cfg = r2Config();
+	if (selection === "r2" && !cfg) throw new Error("PIEVO_BLOB_STORE=r2 requires complete PIEVO_R2_* configuration");
+	if (cfg) {
+		log$4.info({
+			bucket: cfg.bucket,
+			endpoint: cfg.endpoint
+		}, "blob store: Cloudflare R2");
+		return new R2BlobStore(cfg);
+	}
+	const local = new LocalBlobStore();
+	log$4.info({ root: local.root }, "blob store: local filesystem");
+	return local;
+}
+/**
+* Artifact-storage retention + garbage collection — the policy that keeps the
+* local/R2 byte store from growing monotonically.
+*
+* The artifact pipeline is content-addressed: blob BYTES are keyed by sha256 and
+* deduped across every loop/run. When a path is deleted or its content changes,
+* the OLD blob is no longer pointed at by the current file row — but nothing was
+* reclaiming it, so the byte store grew forever. This module closes that gap with two pieces:
+*
+*   1. pruneSnapshots() — bound the per-loop run-snapshot history to a window, so
+*      old snapshots stop pinning the blobs they referenced for diffs.
+*   2. gcBlobs()        — delete blob bytes no LIVE row needs: a blob is collected
+*      only when NO artifact_files row AND NO retained run_snapshot references its
+*      hash. CORRECTNESS over aggressiveness — a still-referenced blob is never
+*      deleted; a leaked blob is only a cost bug the next pass reclaims.
+*
+* Concurrency: gcBlobs is safe to run alongside active syncs. Three guards combine —
+* a grace window (a blob whose metadata row is younger than the window is never
+* collected, so a blob a sync just wrote/referenced is untouchable), a point
+* re-check of each candidate immediately before its bytes are deleted (so a blob
+* re-referenced before we touch it keeps both its bytes and metadata), and a
+* bytes-before-metadata delete ordering: each candidate's bytes are reclaimed
+* FIRST, then its metadata row is dropped unconditionally — so blobExists() goes
+* false and any sync that re-references the hash (even one that raced the byte
+* delete) re-uploads the bytes (self-healing). We never leave a live blobs row
+* pointing at deleted bytes.
+*/
+var log$3 = logger.child({ mod: "retention" });
+/**
+* Prune every loop's run snapshots down to the configured retention window
+* (most-recent-N). Returns the total number pruned. This is what makes an old
+* snapshot's now-unreferenced blobs collectable by gcBlobs().
+*/
+async function pruneSnapshots(keep = snapshotRetention()) {
+	let pruned = 0;
+	for (const loopId of await loopIdsWithSnapshots()) pruned += await pruneRunSnapshots(loopId, keep);
+	return pruned;
+}
+/**
+* Reclaim unreferenced blob bytes. Returns the number of blobs collected.
+*
+* Algorithm:
+*   1. Compute the live keep-set (all hashes any artifact_files row / retained
+*      snapshot references) and the grace-windowed candidate list — both reads are
+*      synchronous (interleave-free under the single-threaded event loop).
+*   2. Garbage = candidates not in the keep-set.
+*   3. For each garbage hash, in order:
+*      a. Pre-delete guard: if a sync re-referenced it since the keep-set was
+*         computed, skip it — leaving both its bytes AND metadata row intact
+*         (a consistent live blob, nothing to heal). The guard is two O(1) checks:
+*         an indexed artifact_files point query (always fresh) plus membership in a
+*         snapshot-hash Set deserialized ONCE per pass and rebuilt only when the
+*         snapshot row count changes (a report() raced us) — never the old
+*         per-candidate full snapshot scan (which was O(garbage × snapshots), since
+*         genuine garbage always misses the file check and fell through to it).
+*      b. Otherwise delete the BYTES (the await), then drop the metadata row
+*         UNCONDITIONALLY. Bytes-before-metadata is the data-loss fix: if a sync
+*         raced the byte delete (re-referencing the hash + recreating the blobs
+*         row mid-await), dropping the metadata still leaves blobExists()=false,
+*         so that file re-uploads its bytes on the next sync. We never leave a
+*         live blobs row pointing at deleted bytes.
+*/
+async function gcBlobs(blobStore, graceMs = blobGcGraceMs()) {
+	const refs = await liveBlobRefs();
+	const garbage = (await blobHashesOlderThan(new Date(Date.now() - graceMs).toISOString())).filter((h) => !refs.has(h));
+	let snapCount = await countRunSnapshots();
+	let snapRefs = await snapshotBlobRefs();
+	let reclaimed = 0;
+	for (const hash of garbage) {
+		const count = await countRunSnapshots();
+		if (count !== snapCount) {
+			snapCount = count;
+			snapRefs = await snapshotBlobRefs();
+		}
+		if (await artifactFileReferencesHash(hash) || snapRefs.has(hash)) continue;
+		try {
+			await blobStore.delete(hash);
+			await deleteBlob(hash);
+			reclaimed++;
+		} catch (err) {
+			log$3.warn({
+				hash,
+				err: err instanceof Error ? err.message : String(err)
+			}, "gc: blob byte-delete failed");
+		}
+	}
+	return reclaimed;
+}
+/**
+* One full storage-maintenance pass: prune snapshots, then GC the blobs they
+* freed (plus any already-unreferenced). Order matters — pruning first lets the
+* same pass reclaim the blobs it just unpinned. Idempotent and safe with no
+* garbage (returns zeros).
+*/
+async function maintainStorage(blobStore) {
+	const snapshotsPruned = await pruneSnapshots();
+	const blobsReclaimed = await gcBlobs(blobStore);
+	if (snapshotsPruned || blobsReclaimed) log$3.info({
+		snapshotsPruned,
+		blobsReclaimed
+	}, "storage maintenance");
+	return {
+		snapshotsPruned,
+		blobsReclaimed
+	};
+}
+/**
+* Resolve a device credential and verify the complete token hash stored on the
+* machine row. The derived, truncated machine id is only a lookup key; it is
+* never sufficient authentication.
+*
+* Enrollment/status/home may allow a genuinely unknown token, but a token that
+* collides with an existing machine id still fails the full-hash check.
+*/
+async function authenticateDeviceToken(deviceToken, options = {}) {
+	if (!isDeviceTokenShape(deviceToken)) return {
+		ok: false,
+		reason: "invalid",
+		response: {
+			status: 401,
+			body: { error: "invalid device token" }
+		}
+	};
+	const machineId = machineIdFromToken(deviceToken);
+	const machine = await getMachine(machineId);
+	if (!machine) return options.allowUnknown ? {
+		ok: true,
+		machineId,
+		machine: void 0
+	} : {
+		ok: false,
+		reason: "unknown",
+		response: {
+			status: 401,
+			body: { error: "unknown machine (token not registered)" }
+		}
+	};
+	if (!machine.tokenHash || machine.tokenHash !== sha256(deviceToken)) return {
+		ok: false,
+		reason: "mismatch",
+		response: {
+			status: 401,
+			body: { error: "device token mismatch" }
+		}
+	};
+	return {
+		ok: true,
+		machineId,
+		machine
+	};
+}
+function needsQuote(s) {
+	return s === "" || /[\s,:"]/.test(s);
+}
+function quote(s) {
+	return `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\r?\n/g, "\\n")}"`;
+}
+function scalar(v) {
+	if (v === null || v === void 0) return "—";
+	if (typeof v === "number") return Number.isFinite(v) ? String(v) : "—";
+	if (typeof v === "boolean") return v ? "true" : "false";
+	return needsQuote(v) ? quote(v) : v;
+}
+function kvLine(key, v) {
+	return `${key}: ${scalar(v)}`;
+}
+function detailBlock(topKey, rows) {
+	const lines = [`${topKey}:`];
+	for (const [k, v] of rows) {
+		const rendered = v !== null && typeof v === "object" && "raw" in v ? v.raw : scalar(v);
+		lines.push(`  ${k}: ${rendered}`);
+	}
+	return lines.join("\n");
+}
+function countLine(count, opts = {}) {
+	if (opts.total !== void 0) return `count: ${count} of ${opts.total} total`;
+	if (opts.showing !== void 0) return `count: ${count} (showing first ${opts.showing})`;
+	return `count: ${count}`;
+}
+function listBlock(name, fields, rows) {
+	const lines = [`${name}[${rows.length}]{${fields.join(",")}}:`];
+	for (const row of rows) lines.push(`  ${row.map(scalar).join(",")}`);
+	return lines.join("\n");
+}
+function emptyList(name) {
+	return `${name}: []`;
+}
+function helpBlock(lines) {
+	return [`help[${lines.length}]:`, ...lines.map((l) => `  ${l}`)].join("\n");
+}
+function errorBlock(message, code) {
+	return `error: ${quote(message)}\ncode: ${code}`;
+}
+function codeForStatus(status) {
+	switch (status) {
+		case 400: return "VALIDATION_ERROR";
+		case 401: return "UNAUTHORIZED";
+		case 403: return "FORBIDDEN";
+		case 404: return "NOT_FOUND";
+		case 409: return "CONFLICT";
+		case 429: return "RATE_LIMITED";
+		default: return "ERROR";
+	}
+}
+function truncate(text, cap, tail = "use --full to see complete body") {
+	if (text.length <= cap) return {
+		value: text,
+		truncated: false
+	};
+	return {
+		value: `${text.slice(0, cap)} (truncated, ${text.length} chars total — ${tail})`,
+		truncated: true
+	};
+}
+function doc(...sections) {
+	return sections.filter((s) => typeof s === "string" && s.length > 0).join("\n");
+}
+var LOOP_CONFIG_FIELDS = [
+	"name",
+	"tags",
+	"schedule",
+	"workdir",
+	"agent",
+	"model",
+	"reasoningEffort",
+	"prompt",
+	"statusDefinitions",
+	"artifacts",
+	"enabled"
+];
+var LOOP_EDIT_FIELDS = new Set(LOOP_CONFIG_FIELDS);
+var SAFE_RETAINED_CRON = "0 0 1 1 *";
+function object(value) {
+	return value != null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function requiredText(value, field, preserve = false) {
+	if (typeof value !== "string" || !value.trim()) return {
+		ok: false,
+		detail: `${field} is required`
+	};
+	if (value.includes("\0")) return {
+		ok: false,
+		detail: `${field} must not contain NUL`
+	};
+	if (value.length > 524288) return {
+		ok: false,
+		detail: `${field} exceeds ${WIRE_TEXT_CAP} characters`
+	};
+	return {
+		ok: true,
+		value: preserve ? value : value.trim()
+	};
+}
+/** The server may validate a workdir for a daemon on another OS. Accept only
+* absolute POSIX or Windows syntax; never resolve a relative path against the
+* server process cwd. */
+function isAbsoluteWorkdir(value) {
+	return path.posix.isAbsolute(value) || path.win32.isAbsolute(value);
+}
+function validateWorkdir(value) {
+	const workdir = requiredText(value, "workdir");
+	if (!workdir.ok) return workdir;
+	return isAbsoluteWorkdir(workdir.value) ? workdir : {
+		ok: false,
+		detail: "workdir must be an absolute path"
+	};
+}
+function normalizeProviderSetting(input) {
+	if (typeof input !== "string") return null;
+	return input.replaceAll("\0", "").trim() || null;
+}
+function optionalProvider(value, field) {
+	if (value !== void 0 && value !== null && typeof value !== "string") return {
+		ok: false,
+		detail: `${field} must be a string or null`
+	};
+	return {
+		ok: true,
+		value: normalizeProviderSetting(value)
+	};
+}
+var PI_THINKING = new Set([
+	"off",
+	"minimal",
+	"low",
+	"medium",
+	"high",
+	"xhigh",
+	"max"
+]);
+function validateReasoningEffort(value, agent) {
+	const result = optionalProvider(value, "reasoningEffort");
+	if (!result.ok) return result;
+	if (agent === "pi" && result.value !== null && !PI_THINKING.has(result.value)) return {
+		ok: false,
+		detail: "reasoningEffort for pi must be one of off, minimal, low, medium, high, xhigh, max, or null"
+	};
+	return result;
+}
+function validTimezone(timezone) {
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone: timezone }).format();
+		return true;
+	} catch {
+		return false;
+	}
+}
+function validateCron(cron, timezone) {
+	try {
+		const probe = new E(cron, {
+			paused: true,
+			timezone
+		});
+		try {
+			const first = probe.nextRun();
+			const second = first ? probe.nextRun(first) : null;
+			if (!first || !second) return {
+				ok: false,
+				detail: "schedule.cron must have future occurrences"
+			};
+			if (second.getTime() - first.getTime() < 6e4) return {
+				ok: false,
+				detail: "schedule.cron must not run more than once per minute"
+			};
+		} finally {
+			probe.stop();
+		}
+		return {
+			ok: true,
+			value: cron
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			detail: `invalid schedule.cron: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+}
+function validateSchedule(value) {
+	const raw = object(value);
+	if (!raw) return {
+		ok: false,
+		detail: "schedule is required"
+	};
+	if (raw.mode === "cron") {
+		const unknown = Object.keys(raw).filter((key) => ![
+			"mode",
+			"cron",
+			"timezone",
+			"overlap"
+		].includes(key));
+		if (unknown.length) return {
+			ok: false,
+			detail: `cron schedule has unknown field(s): ${unknown.join(", ")}`
+		};
+		const cron = requiredText(raw.cron, "schedule.cron");
+		if (!cron.ok) return cron;
+		const timezone = requiredText(raw.timezone, "schedule.timezone");
+		if (!timezone.ok) return timezone;
+		if (!validTimezone(timezone.value)) return {
+			ok: false,
+			detail: `invalid schedule.timezone: ${timezone.value}`
+		};
+		const validCron = validateCron(cron.value, timezone.value);
+		if (!validCron.ok) return validCron;
+		if (raw.overlap !== "skip" && raw.overlap !== "queue-one") return {
+			ok: false,
+			detail: "schedule.overlap must be skip|queue-one"
+		};
+		return {
+			ok: true,
+			value: {
+				mode: "cron",
+				cron: validCron.value,
+				timezone: timezone.value,
+				overlap: raw.overlap
+			}
+		};
+	}
+	if (raw.mode === "continuous") {
+		const unknown = Object.keys(raw).filter((key) => !["mode", "delayMinutes"].includes(key));
+		if (unknown.length) return {
+			ok: false,
+			detail: `continuous schedule has unknown field(s): ${unknown.join(", ")}`
+		};
+		if (typeof raw.delayMinutes !== "number" || !Number.isInteger(raw.delayMinutes) || raw.delayMinutes < 1) return {
+			ok: false,
+			detail: "schedule.delayMinutes must be a JSON integer >= 1"
+		};
+		return {
+			ok: true,
+			value: {
+				mode: "continuous",
+				delayMinutes: raw.delayMinutes
+			}
+		};
+	}
+	return {
+		ok: false,
+		detail: "schedule.mode must be cron|continuous"
+	};
+}
+function validateStatusDefinitions(value) {
+	const raw = object(value);
+	if (!raw) return {
+		ok: false,
+		detail: "statusDefinitions is required"
+	};
+	const unknown = Object.keys(raw).filter((key) => ![
+		"keep",
+		"noChange",
+		"block"
+	].includes(key));
+	if (unknown.length) return {
+		ok: false,
+		detail: `statusDefinitions has unknown field(s): ${unknown.join(", ")}`
+	};
+	const keep = requiredText(raw.keep, "statusDefinitions.keep", true);
+	if (!keep.ok) return keep;
+	const noChange = requiredText(raw.noChange, "statusDefinitions.noChange", true);
+	if (!noChange.ok) return noChange;
+	const block = requiredText(raw.block, "statusDefinitions.block", true);
+	if (!block.ok) return block;
+	return {
+		ok: true,
+		value: {
+			keep: keep.value,
+			noChange: noChange.value,
+			block: block.value
+		}
+	};
+}
+function validateArtifactPaths(value) {
+	if (value === void 0 || value === null) return {
+		ok: true,
+		value: []
+	};
+	if (!Array.isArray(value)) return {
+		ok: false,
+		detail: "artifacts must be an array of exact relative file paths"
+	};
+	const paths = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string" || entry.length === 0) return {
+			ok: false,
+			detail: "artifact paths must be non-empty strings"
+		};
+		if (entry.includes("\0")) return {
+			ok: false,
+			detail: "artifact path must not contain NUL"
+		};
+		if (entry.startsWith("/") || entry.startsWith("\\") || /^[A-Za-z]:[\\/]/.test(entry)) return {
+			ok: false,
+			detail: `artifact path must be relative to workdir: ${entry}`
+		};
+		if (entry.split(/[\\/]/).some((part) => part === "" || part === "." || part === "..")) return {
+			ok: false,
+			detail: `artifact path must not traverse or alias another path: ${entry}`
+		};
+		if (seen.has(entry)) return {
+			ok: false,
+			detail: `duplicate artifact path: ${entry}`
+		};
+		seen.add(entry);
+		paths.push(entry);
+	}
+	return {
+		ok: true,
+		value: paths
+	};
+}
+function rowSchedule(schedule, retainedCron = SAFE_RETAINED_CRON) {
+	return schedule.mode === "cron" ? {
+		cron: schedule.cron,
+		scheduleMode: "cron",
+		cronOverlap: schedule.overlap,
+		continuousDelayMinutes: 1,
+		timezone: schedule.timezone
+	} : {
+		cron: retainedCron,
+		scheduleMode: "continuous",
+		cronOverlap: "queue-one",
+		continuousDelayMinutes: schedule.delayMinutes,
+		timezone: null
+	};
+}
+function scheduleFromLoop(loop) {
+	if (loop.scheduleMode === "continuous") return {
+		mode: "continuous",
+		delayMinutes: loop.continuousDelayMinutes
+	};
+	if (loop.scheduleMode === "cron") {
+		if (!loop.timezone) throw new Error(`invariant: cron loop ${loop.id} has no timezone`);
+		return {
+			mode: "cron",
+			cron: loop.cron,
+			timezone: loop.timezone,
+			overlap: loop.cronOverlap
+		};
+	}
+	throw new Error(`invariant: loop ${loop.id} has unknown schedule mode: ${String(loop.scheduleMode)}`);
+}
+function statusDefinitionsFromLoop(loop) {
+	return {
+		keep: loop.statusKeep,
+		noChange: loop.statusNoChange,
+		block: loop.statusBlock
+	};
+}
+function canonicalLoopEnvelope(loop) {
+	return {
+		id: loop.id,
+		name: loop.name,
+		tags: loop.tags,
+		schedule: scheduleFromLoop(loop),
+		workdir: loop.workdir,
+		agent: loop.agent,
+		model: loop.model ?? null,
+		reasoningEffort: loop.reasoningEffort ?? null,
+		prompt: loop.prompt,
+		statusDefinitions: statusDefinitionsFromLoop(loop),
+		artifacts: loop.artifacts,
+		enabled: loop.enabled
+	};
+}
+function validateLoopCreate(value) {
+	const raw = object(value);
+	if (!raw) return {
+		ok: false,
+		detail: "loop config must be an object"
+	};
+	const unknown = Object.keys(raw).filter((key) => !LOOP_CONFIG_FIELDS.includes(key));
+	if (unknown.length) return {
+		ok: false,
+		detail: `unknown field(s): ${unknown.join(", ")} — allowed: ${LOOP_CONFIG_FIELDS.join(", ")}`
+	};
+	const name = requiredText(raw.name, "name");
+	if (!name.ok) return name;
+	const tags = validateLoopTags(raw.tags);
+	if (!tags.ok) return tags;
+	const workdir = validateWorkdir(raw.workdir);
+	if (!workdir.ok) return workdir;
+	const prompt = requiredText(raw.prompt, "prompt", true);
+	if (!prompt.ok) return prompt;
+	const schedule = validateSchedule(raw.schedule);
+	if (!schedule.ok) return schedule;
+	const statusDefinitions = validateStatusDefinitions(raw.statusDefinitions);
+	if (!statusDefinitions.ok) return statusDefinitions;
+	const artifacts = validateArtifactPaths(raw.artifacts);
+	if (!artifacts.ok) return artifacts;
+	const model = optionalProvider(raw.model, "model");
+	if (!model.ok) return model;
+	const agent = coerceCodingAgent(raw.agent);
+	if (!agent) return {
+		ok: false,
+		detail: `agent is required and must be one of ${CODING_AGENTS.join(", ")}`
+	};
+	const reasoningEffort = validateReasoningEffort(raw.reasoningEffort, agent);
+	if (!reasoningEffort.ok) return reasoningEffort;
+	if (raw.enabled !== void 0 && typeof raw.enabled !== "boolean") return {
+		ok: false,
+		detail: "enabled must be boolean"
+	};
+	const config = {
+		name: name.value,
+		tags: tags.value,
+		schedule: schedule.value,
+		workdir: workdir.value,
+		agent,
+		model: model.value,
+		reasoningEffort: reasoningEffort.value,
+		prompt: prompt.value,
+		statusDefinitions: statusDefinitions.value,
+		artifacts: artifacts.value,
+		enabled: raw.enabled !== false
+	};
+	return {
+		ok: true,
+		value: {
+			config,
+			row: {
+				name: config.name,
+				tags: config.tags,
+				...rowSchedule(config.schedule),
+				workdir: config.workdir,
+				agent: config.agent,
+				model: config.model,
+				reasoningEffort: config.reasoningEffort,
+				prompt: config.prompt,
+				statusKeep: config.statusDefinitions.keep,
+				statusNoChange: config.statusDefinitions.noChange,
+				statusBlock: config.statusDefinitions.block,
+				artifacts: config.artifacts,
+				enabled: config.enabled
+			}
+		}
+	};
+}
+function validateLoopEdit(loop, value) {
+	const raw = object(value);
+	if (!raw) return {
+		ok: false,
+		detail: "loop patch must be an object"
+	};
+	const unknown = Object.keys(raw).filter((key) => !LOOP_EDIT_FIELDS.has(key));
+	if (unknown.length) return {
+		ok: false,
+		detail: `unknown field(s): ${unknown.join(", ")} — allowed: ${[...LOOP_EDIT_FIELDS].join(", ")}`
+	};
+	const update = {};
+	if (raw.name !== void 0) {
+		const result = requiredText(raw.name, "name");
+		if (!result.ok) return result;
+		update.name = result.value;
+	}
+	if (raw.tags !== void 0) {
+		const result = validateLoopTags(raw.tags);
+		if (!result.ok) return result;
+		update.tags = result.value;
+	}
+	if (raw.workdir !== void 0) {
+		const result = validateWorkdir(raw.workdir);
+		if (!result.ok) return result;
+		update.workdir = result.value;
+	}
+	if (raw.prompt !== void 0) {
+		const result = requiredText(raw.prompt, "prompt", true);
+		if (!result.ok) return result;
+		update.prompt = result.value;
+	}
+	if (raw.schedule !== void 0) {
+		const result = validateSchedule(raw.schedule);
+		if (!result.ok) return result;
+		Object.assign(update, rowSchedule(result.value, loop.cron));
+	}
+	if (raw.statusDefinitions !== void 0) {
+		const result = validateStatusDefinitions(raw.statusDefinitions);
+		if (!result.ok) return result;
+		update.statusKeep = result.value.keep;
+		update.statusNoChange = result.value.noChange;
+		update.statusBlock = result.value.block;
+	}
+	if (raw.artifacts !== void 0) {
+		const result = validateArtifactPaths(raw.artifacts);
+		if (!result.ok) return result;
+		update.artifacts = result.value;
+	}
+	if (raw.model !== void 0) {
+		const result = optionalProvider(raw.model, "model");
+		if (!result.ok) return result;
+		update.model = result.value;
+	}
+	let effectiveAgent = loop.agent;
+	if (raw.agent !== void 0) {
+		const agent = coerceCodingAgent(raw.agent);
+		if (!agent) return {
+			ok: false,
+			detail: `agent must be one of ${CODING_AGENTS.join(", ")}`
+		};
+		effectiveAgent = agent;
+		update.agent = agent;
+	}
+	if (raw.reasoningEffort !== void 0 || raw.agent !== void 0) {
+		const result = validateReasoningEffort(raw.reasoningEffort !== void 0 ? raw.reasoningEffort : loop.reasoningEffort, effectiveAgent);
+		if (!result.ok) return result;
+		if (raw.reasoningEffort !== void 0) update.reasoningEffort = result.value;
+	}
+	if (raw.enabled !== void 0) {
+		if (typeof raw.enabled !== "boolean") return {
+			ok: false,
+			detail: "enabled must be boolean"
+		};
+		update.enabled = raw.enabled;
+	}
+	return {
+		ok: true,
+		value: update
+	};
+}
+var MIN_DAEMON_VERSION = "2.4.0";
+function daemonNeedsUpdate(current, required = MIN_DAEMON_VERSION) {
+	if (!current || !isValidSemver(current) || !isValidSemver(required)) return true;
+	if (current === required) return false;
+	return isOutdated(current, required);
+}
+function daemonUpgradeCommand() {
+	return "npm install -g @kky42/pievo@latest && pievo daemon restart";
+}
+var POLL_INFO_FIELDS = new Set([
+	"host",
+	"platform",
+	"arch",
+	"version"
+]);
+var POLL_V4_REQUEST_FIELDS = new Set([
+	"protocolVersion",
+	"currentRuns",
+	"daemonInstanceId",
+	"recoveryComplete",
+	"info"
+]);
+var POLL_HTTP_BODY_FIELDS = new Set([
+	...POLL_INFO_FIELDS,
+	"protocolVersion",
+	"currentRuns",
+	"daemonInstanceId",
+	"recoveryComplete"
+]);
+var validPollWireId = (value) => typeof value === "string" && value.length <= 200 && value.trim().length > 0 && !value.includes("\0");
+var validPollCurrentRun = (value) => value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 2 && Object.prototype.hasOwnProperty.call(value, "runId") && Object.prototype.hasOwnProperty.call(value, "stage") && validPollWireId(value.runId) && (value.stage === "executing" || value.stage === "reporting");
+var validPollInfo = (value) => value === void 0 || value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).every((key) => POLL_INFO_FIELDS.has(key)) && validOptionalPollString(value.host, 524288) && validOptionalPollString(value.platform, 524288) && validOptionalPollString(value.arch, 524288) && validOptionalPollString(value.version, 64);
+/**
+* Machine gateway - the run-lifecycle core of the HTTP surface the daemon talks
+* to (poll transport: short-poll while a run is in flight, opt-in server-held
+* long-poll while idle). Framework-agnostic like the rest of the gateway
+* (return `{ status, body }` so the methods can be mounted on a plain http
+* server or TanStack server routes):
+*
+*   POST /api/machine/poll   (Bearer device token) → claim pending runs, deliver
+*   POST /machine/report     (Bearer run token)    → finalize a run
+*
+* plus owner create/list/edit methods and retention.
+* Also exposes `dispatcher` (a `Dispatcher` for the Scheduler: "is the machine
+* online?") and `sweep()` (mark stale machines offline, reclaim stuck runs).
+* CLI verb dispatch at `/api/machine/cli` lives in `gateway/cli.ts`
+* (`CliGateway`), which reuses this class's owner methods;
+* canonical loop configuration validation lives in `gateway/loopConfig.ts`.
+*/
+var log$2 = logger.child({ mod: "gateway" });
+var ONLINE_TTL_MS = 3e4;
+/** Auto-pause after this many consecutive errors. Canceled rows are transparent;
+*  zero disables the breaker. */
+var AUTOPAUSE_STREAK = Math.max(0, Number(process.env.PIEVO_FAILURE_AUTOPAUSE_STREAK ?? 3));
+var DEFERRED_MAX_MS = 7 * 864e5;
+/** A claimed run that never reports within this window is reclaimed as timed out. */
+var configuredRunTimeoutMs = Number(process.env.PIEVO_RUN_TIMEOUT_MS || 20 * 6e4);
+var RUN_TIMEOUT_MS = Number.isFinite(configuredRunTimeoutMs) && configuredRunTimeoutMs > 0 ? configuredRunTimeoutMs : 20 * 6e4;
+/** The ONLY keys an owner `editLoop` patch may touch. A key outside this set is
+*  rejected (400) rather than silently ignored, so a `--json` typo fails loudly
+*  and identity/ownership columns (id/userId/machineId/timestamps) can never be
+*  patched over the device-token edit surface. Exported for `cli.ts`
+*  (the `new`/`edit` verb help lists these keys). */
+var EDITABLE_LOOP_FIELDS = LOOP_EDIT_FIELDS;
+/** Formal `report --message` text. Provider finalText is stored separately;
+*  it never satisfies the successful-run reporting protocol. Run errors share
+*  this cap. Exported for `cli.ts` so the report verb uses the same budget. */
+var MESSAGE_CAP = 2e3;
+/** Provider session IDs are opaque short tokens; this rejects malformed payloads
+*  without constraining known provider formats. */
+var SESSION_ID_CAP = 200;
+function heartbeatRefreshMs(runTimeoutMs) {
+	if (!Number.isFinite(runTimeoutMs) || runTimeoutMs <= 0) return 1;
+	return Math.max(1, Math.min(6e4, runTimeoutMs / 3));
+}
+var HEARTBEAT_STAMP_REFRESH_MS = heartbeatRefreshMs(RUN_TIMEOUT_MS);
+/** How often the poll hot path re-stamps `machines.lastSeen`. Only the sweep
+*  (ONLINE_TTL_MS granularity) and presence reads consume the stamp, so an
+*  every-poll UPDATE is pure write amplification on Postgres — refresh at 10s
+*  and an idle poll becomes read-only, with worst-case staleness well inside
+*  the 30s TTL (max stamp gap = refresh + one poll interval). */
+var LAST_SEEN_REFRESH_MS = 1e4;
+var MACHINE_REPORT_FIELD_SET = new Set([
+	"reportId",
+	"runId",
+	"result",
+	"exitCode",
+	"durationMs",
+	"sessionId",
+	"usage",
+	"error",
+	"finalText"
+]);
+var MACHINE_REPORT_USAGE_FIELDS = new Set([
+	"inputTokens",
+	"outputTokens",
+	"cacheReadTokens",
+	"cacheCreationTokens"
+]);
+/** How long an idle poll is held open for work before returning empty.
+*  Bounded under the daemon's 30s fetch timeout AND under ONLINE_TTL_MS
+*  (with the end-of-wait re-stamp) so a parked long-poll never looks offline. */
+var LONG_POLL_WAIT_MS = 2e4;
+var USAGE_MAX = 0xe8d4a51000;
+var REPORT_ID_CAP = 200;
+function receiptFor(body, runId, ackStatus = 200, ackBody) {
+	if (typeof body.reportId !== "string") return void 0;
+	return {
+		reportId: body.reportId,
+		runId,
+		payloadDigest: sha256(canonicalJson(body)),
+		ackStatus,
+		ackBody: ackBody ?? {
+			ok: true,
+			reportId: body.reportId
+		},
+		createdAt: nowIso()
+	};
+}
+function receiptResponse(receipt, expected) {
+	if (!receipt || receipt.runId !== expected.runId) return void 0;
+	if (receipt.payloadDigest !== expected.payloadDigest) log$2.warn({
+		reportId: expected.reportId,
+		runId: expected.runId
+	}, "report: same-run payload changed after commit; replaying authoritative ACK");
+	return {
+		status: receipt.ackStatus,
+		body: receipt.ackBody
+	};
+}
+function incidentReceiptResponse(receipt) {
+	return receipt ? {
+		status: 200,
+		body: receipt.ackBody
+	} : void 0;
+}
+async function committedReportEvidence(reportId, payloadDigest, authoritativeRunId, allowExactIncidentReplay = false) {
+	const normal = await getReportReceipt(reportId);
+	const exactIncident = await getExactTerminalReportIncident(reportId, payloadDigest);
+	if (allowExactIncidentReplay && exactIncident) return {
+		response: incidentReceiptResponse(exactIncident),
+		foreignRun: false
+	};
+	if (typeof authoritativeRunId === "string") {
+		if (exactIncident?.runId === authoritativeRunId) return {
+			response: incidentReceiptResponse(exactIncident),
+			foreignRun: false
+		};
+		if (normal?.runId === authoritativeRunId) {
+			if (normal.payloadDigest !== payloadDigest) log$2.warn({
+				reportId,
+				runId: authoritativeRunId
+			}, "report: same-run payload changed after commit; replaying authoritative ACK");
+			return {
+				response: {
+					status: normal.ackStatus,
+					body: normal.ackBody
+				},
+				foreignRun: false
+			};
+		}
+	}
+	const incidents = await getTerminalReportIncidents(reportId);
+	return { foreignRun: !!normal || !!exactIncident || incidents.length > 0 };
+}
+function correlatableReportId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= REPORT_ID_CAP && !value.includes("\0");
+}
+function incidentDiagnosis(code, issues, reportId, payloadDigest) {
+	const faultDomain = code === "REPORT_CONFLICT" ? "internal" : issues.some((issue) => issue.includes("runId does not match")) ? "daemon" : "protocol";
+	const reason = code === "REPORT_CONFLICT" ? "Terminal report rejected because its reportId was already committed for another run." : `Terminal report rejected: ${issues.join("; ")}.`;
+	const recommendedAction = faultDomain === "internal" ? "Inspect pievo show and pievo log; retry only after confirming the daemon and server agree on the active run." : "Upgrade Pievo to the latest version and restart the daemon, then inspect pievo show and pievo log.";
+	return {
+		at: nowIso(),
+		code,
+		reason,
+		issues,
+		reportId,
+		payloadDigest,
+		faultDomain,
+		recommendedAction
+	};
+}
+/** Validate the durable report facts before a successful provider process may
+* become a successful run. The CLI validates first so an agent can retry; this
+* terminal seam prevents an ignored 400 from silently producing an empty run. */
+function runProtocolMissing(run) {
+	const missing = [];
+	if (run.status !== "keep" && run.status !== "no-change" && run.status !== "block") missing.push("status");
+	if (!run.message?.trim()) missing.push("message");
+	return missing;
+}
+function validateTerminalReport(body) {
+	const issues = [];
+	const has = (key) => Object.prototype.hasOwnProperty.call(body, key);
+	const unknown = Object.keys(body).filter((key) => !MACHINE_REPORT_FIELD_SET.has(key)).sort();
+	if (unknown.length) issues.push(`unknown fields: ${unknown.join(", ")}`);
+	if (![
+		"success",
+		"failure",
+		"canceled",
+		"timeout"
+	].includes(body.result)) issues.push("result must be success, failure, canceled, or timeout");
+	if (has("durationMs") && (typeof body.durationMs !== "number" || !Number.isInteger(body.durationMs) || body.durationMs < 0 || body.durationMs > 2147483647)) issues.push("durationMs must be a non-negative 32-bit integer");
+	if (has("exitCode") && body.exitCode !== null && (typeof body.exitCode !== "number" || !Number.isInteger(body.exitCode) || body.exitCode < 0 || body.exitCode > 2147483647)) issues.push("exitCode must be a non-negative 32-bit integer or null");
+	for (const key of [
+		"sessionId",
+		"error",
+		"finalText"
+	]) if (has(key) && typeof body[key] !== "string") issues.push(`${key} must be a string`);
+	if (has("usage")) if (body.usage === null || typeof body.usage !== "object" || Array.isArray(body.usage)) issues.push("usage must be an object");
+	else {
+		const usage = body.usage;
+		const unknownUsage = Object.keys(usage).filter((key) => !MACHINE_REPORT_USAGE_FIELDS.has(key)).sort();
+		if (unknownUsage.length) issues.push(`unknown usage fields: ${unknownUsage.join(", ")}`);
+		for (const key of MACHINE_REPORT_USAGE_FIELDS) {
+			if (!Object.prototype.hasOwnProperty.call(usage, key)) continue;
+			const value = usage[key];
+			if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > USAGE_MAX) issues.push(`usage.${key} must be a non-negative integer no greater than ${USAGE_MAX}`);
+		}
+	}
+	return issues;
+}
+function coerceTelemetry(body) {
+	const whole = (v, max) => typeof v === "number" && Number.isInteger(v) && v >= 0 && v <= max ? v : void 0;
+	const usageRaw = body.usage && typeof body.usage === "object" && !Array.isArray(body.usage) ? body.usage : {};
+	const usage = {};
+	for (const key of [
+		"inputTokens",
+		"outputTokens",
+		"cacheReadTokens",
+		"cacheCreationTokens"
+	]) {
+		const value = whole(usageRaw[key], USAGE_MAX);
+		if (value !== void 0) usage[key] = value;
+	}
+	return {
+		...whole(body.durationMs, 2147483647) !== void 0 ? { durationMs: body.durationMs } : {},
+		...whole(body.exitCode, 2147483647) !== void 0 ? { exitCode: body.exitCode } : {},
+		...typeof body.sessionId === "string" ? { sessionId: clipText(body.sessionId, SESSION_ID_CAP) } : {},
+		...typeof body.finalText === "string" ? { finalText: clipText(body.finalText, WIRE_TEXT_CAP) } : {},
+		...Object.keys(usage).length ? { usage } : {}
+	};
+}
+var MachineGateway = class {
+	scheduler;
+	blobStore;
+	constructor(scheduler, blobStore = createBlobStore()) {
+		this.scheduler = scheduler;
+		this.blobStore = blobStore;
+	}
+	/** In-flight latch: the maintenance pass is sequential and the first post-deploy
+	*  backlog reclamation can overrun the interval, so a fresh tick skips rather than
+	*  running a second pass concurrently (idempotent but wasteful + double-counts). */
+	maintenanceRunning = false;
+	applyAutopauseTimer(loopId, terminal) {
+		if (!terminal.autoPaused) return;
+		this.scheduler.removeLoop(loopId);
+		log$2.warn({
+			loopId,
+			streak: terminal.failureStreak
+		}, "loop auto-paused after block or consecutive errors");
+	}
+	/**
+	* Dispatcher for the Scheduler. The pending run row IS the queue (the daemon's
+	* next poll claims it, so nothing is ever lost); dispatch additionally WAKES
+	* the machine's parked long-poll, so an opted-in idle daemon claims the run
+	* immediately instead of on its next cadence tick.
+	*/
+	dispatcher = { dispatch: (loop) => this.wakeMachine(loop.machineId) };
+	/** One parked long-poll waiter per machine (the pidfile enforces one daemon).
+	*  The stored settle fn resolves `true` on wake (new pending run) and `false`
+	*  on timeout / supersede / cancel, then disarms itself. Poll waiters are
+	*  process-local; unlike durable run leases, a deploy drops them and the daemon
+	*  simply re-polls. */
+	pollWaiters = /* @__PURE__ */ new Map();
+	wakeMachine(machineId) {
+		this.pollWaiters.get(machineId)?.(true);
+	}
+	/** Arm this machine's long-poll waiter: the promise resolves `true` when
+	*  `wakeMachine` fires (a run went pending), `false` on timeout or cancel.
+	*  A pre-existing waiter is superseded (woken) first — a dangling held
+	*  request must never strand a newer one. */
+	armPollWaiter(machineId, waitMs) {
+		this.pollWaiters.get(machineId)?.(true);
+		let settle;
+		return {
+			promise: new Promise((resolve) => {
+				let done = false;
+				const timer = setTimeout(() => settle(false), waitMs);
+				timer.unref?.();
+				settle = (woken) => {
+					if (done) return;
+					done = true;
+					clearTimeout(timer);
+					if (this.pollWaiters.get(machineId) === settle) this.pollWaiters.delete(machineId);
+					resolve(woken);
+				};
+				this.pollWaiters.set(machineId, settle);
+			}),
+			cancel: () => settle(false)
+		};
+	}
+	/**
+	* Periodic maintenance: mark stale machines offline, and reclaim stuck runs.
+	* A RUNNING run that went silent is reclaimed as timed out; a PENDING run on
+	* an OFFLINE machine is NOT failed — it remains in the durable queue, bounded
+	* by DEFERRED_MAX_MS while offline.
+	* Online pending rows never synthesize an execution error.
+	*/
+	async sweep() {
+		const now = Date.now();
+		for (const m of await listMachines()) if (m.online && (!m.lastSeen || now - Date.parse(m.lastSeen) > 3e4)) await updateMachine(m.id, { online: false });
+		for (const run of await openRuns()) {
+			const pendingLifetime = now - Date.parse(run.createdAt);
+			if (run.phase === "pending") {
+				if ((await getMachine(run.machineId))?.online) {} else if (run.requestedBy === "system" && pendingLifetime > DEFERRED_MAX_MS) await expirePendingRun(run.id, {
+					requestedBy: run.requestedBy,
+					updatedAt: run.updatedAt
+				}, nowIso(), DEFERRED_MAX_MS, "skipped - the machine stayed offline past the catch-up window");
+			} else if (run.phase === "running") {
+				if (now - Math.max(Date.parse(run.ts), run.heartbeatAt ? Date.parse(run.heartbeatAt) || 0 : 0) > RUN_TIMEOUT_MS) await this.reclaimRun(run, "machine timed out / disconnected");
+			}
+		}
+		await pruneExpiredLeases(now);
+		for (const loop of await listLoops()) if (loop.deleteRequestedAt) await tryDeleteLoop(loop.id);
+	}
+	/** Finalize one stuck run as an error (the sweep's reclaim path): persist the
+	*  failure, TERMINALIZE its run lease (flip it to `terminal-grace` rather than
+	*  retiring it outright), while preserving a bounded reconciliation window.
+	*
+	*  Why terminalize, not retire: the usual cause is a laptop that merely fell
+	*  ASLEEP mid-run. When it wakes, claude finishes and the daemon delivers the real
+	*  (often SUCCESSFUL) result. Retiring the lease here would 401 that late report
+	*  and strand the run as a permanent false failure with its message lost (the
+	*  investigated bug). So the lease survives a bounded grace window
+	*  (`TERMINAL_GRACE_MS`) during which exactly ONE late wake-report may reconcile
+	*  the run — see `report()`'s terminal-grace branch. The credential is still
+	*  bounded: CLI mutations are refused while terminal-grace, and the
+	*  reconciliation retires the lease single-shot. Pending rows are durable inbox
+	*  entries and are never reclaimed by this path. */
+	async reclaimRun(run, reason) {
+		if (run.phase !== "running") return;
+		const at = nowIso();
+		const reclaimed = await reclaimRun(run.id, "running", reason, at, TERMINAL_GRACE_MS);
+		if (!reclaimed) return;
+		this.applyAutopauseTimer(run.loopId, reclaimed);
+		if (reclaimed.loop.enabled) this.scheduler.addLoop(reclaimed.loop);
+		else this.scheduler.removeLoop(reclaimed.loop.id);
+	}
+	/**
+	* Periodic storage maintenance: prune each loop's run snapshots to the
+	* retention window, then GC blob bytes no live row needs. Wired to its own
+	* interval in boot (independent of the faster offline-sweep) and exposed for
+	* tests / on-demand triggers. Safe to run concurrently with active syncs (a
+	* grace window + final re-check protect freshly-written/referenced blobs) and
+	* idempotent with no garbage. Best-effort — never throws into the caller.
+	*/
+	async maintainStorage() {
+		if (this.maintenanceRunning) {
+			log$2.info("storage maintenance already in progress — skipping this tick");
+			return {
+				snapshotsPruned: 0,
+				blobsReclaimed: 0
+			};
+		}
+		this.maintenanceRunning = true;
+		try {
+			return await maintainStorage(this.blobStore);
+		} catch (err) {
+			log$2.warn({ err: err instanceof Error ? err.message : String(err) }, "storage maintenance failed");
+			return {
+				snapshotsPruned: 0,
+				blobsReclaimed: 0
+			};
+		} finally {
+			this.maintenanceRunning = false;
+		}
+	}
+	async pollCore(deviceToken, info, currentRunIds, claimWork = true, recoveryComplete = false) {
+		const auth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		let machine = auth.machine;
+		if (!machine) {
+			const binding = await readConnectKeyBinding(deviceToken);
+			if (!binding) return {
+				status: 401,
+				body: { error: "unknown device token — connect this machine first" }
+			};
+			machine = await createMachine({
+				id: machineId,
+				userId: binding.userId,
+				name: info?.host || `machine-${machineId.slice(2, 8)}`,
+				tokenHash: sha256(deviceToken),
+				token: deviceToken,
+				online: true
+			});
+			log$2.info({
+				machineId,
+				host: info?.host
+			}, "poll: self-registered machine");
+		}
+		if (!machine.online || !machine.lastSeen || Date.now() - Date.parse(machine.lastSeen) > LAST_SEEN_REFRESH_MS) await setMachineOnline(machineId, true);
+		if (info) {
+			const version = typeof info.version === "string" && info.version.length <= 64 && isValidSemver(info.version) ? info.version : void 0;
+			const patch = {
+				...info.host && info.host !== machine.hostname ? { hostname: info.host } : {},
+				...info.platform && info.platform !== machine.platform ? { platform: info.platform } : {},
+				...info.arch && info.arch !== machine.arch ? { arch: info.arch } : {},
+				...version && version !== machine.daemonVersion ? { daemonVersion: version } : {},
+				...info.host && !machine.name?.trim() ? { name: info.host } : {}
+			};
+			if (Object.keys(patch).length) await updateMachine(machineId, patch);
+		}
+		if (Array.isArray(currentRunIds)) {
+			const ids = /* @__PURE__ */ new Set();
+			for (const value of currentRunIds) if (typeof value === "string") ids.add(value);
+			if (ids.size) {
+				const now = Date.now();
+				await refreshRunHeartbeats(machineId, [...ids], new Date(now).toISOString(), new Date(now - HEARTBEAT_STAMP_REFRESH_MS).toISOString());
+			}
+		}
+		if (recoveryComplete) await releaseAbsentReconciliations(machineId, currentRunIds ?? []);
+		let delivery = null;
+		if (claimWork) {
+			await this.scheduler.advanceDueSchedules(machineId);
+			const claimed = await claimReadyRunForMachine(machineId, void 0, currentRunIds ?? []);
+			if (claimed) delivery = await buildDelivery(claimed.loop, claimed.run, claimed.runToken, machine.roots ?? []);
+		}
+		if (delivery) log$2.info({
+			machineId,
+			runId: delivery.runId
+		}, "poll: delivered");
+		return {
+			status: 200,
+			body: { delivery }
+		};
+	}
+	async pollV4(deviceToken, request) {
+		const rawRequest = request;
+		if (request === null || typeof request !== "object" || Array.isArray(request) || Object.keys(rawRequest).some((key) => !POLL_V4_REQUEST_FIELDS.has(key)) || !validPollInfo(rawRequest?.info) || rawRequest.protocolVersion !== void 0 && (typeof rawRequest.protocolVersion !== "number" || !Number.isInteger(rawRequest.protocolVersion)) || rawRequest.currentRuns !== void 0 && (!Array.isArray(rawRequest.currentRuns) || rawRequest.currentRuns.some((run) => !validPollCurrentRun(run))) || rawRequest.daemonInstanceId !== void 0 && !validPollWireId(rawRequest.daemonInstanceId) || rawRequest.recoveryComplete !== void 0 && typeof rawRequest.recoveryComplete !== "boolean") return {
+			status: 400,
+			body: {
+				error: "invalid poll request",
+				code: "VALIDATION_ERROR"
+			}
+		};
+		if (request.protocolVersion !== 4) {
+			const auth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+			if (!auth.ok && auth.reason === "mismatch") return auth.response;
+			if (auth.ok && auth.machine) {
+				const reported = typeof request.protocolVersion === "number" && Number.isInteger(request.protocolVersion) ? request.protocolVersion : null;
+				await updateMachine(auth.machineId, { daemonProtocol: reported });
+			}
+			return {
+				status: 426,
+				body: {
+					error: "daemon upgrade required; run `npm install -g @kky42/pievo@latest`, then `pievo daemon restart`",
+					code: "UPGRADE_REQUIRED",
+					requiredProtocol: 4
+				}
+			};
+		}
+		if (!Array.isArray(request.currentRuns) || request.currentRuns.some((run) => !validPollCurrentRun(run))) return {
+			status: 400,
+			body: {
+				error: "invalid currentRuns",
+				code: "VALIDATION_ERROR"
+			}
+		};
+		if (request.recoveryComplete !== true) return {
+			status: 400,
+			body: {
+				error: "recoveryComplete must be true",
+				code: "VALIDATION_ERROR"
+			}
+		};
+		if (!validPollWireId(request.daemonInstanceId)) return {
+			status: 400,
+			body: {
+				error: "a valid daemonInstanceId is required",
+				code: "VALIDATION_ERROR"
+			}
+		};
+		const currentIds = [...new Set(request.currentRuns.map((run) => run.runId))];
+		const priorAuth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+		const machineId = priorAuth.ok ? priorAuth.machineId : "";
+		const reportedVersion = typeof request.info?.version === "string" ? request.info.version : void 0;
+		const needsUpdate = daemonNeedsUpdate(reportedVersion);
+		const base = await this.pollCore(deviceToken, request.info, currentIds, !needsUpdate, true);
+		if (base.status !== 200) return base;
+		if ((await getMachine(machineId))?.daemonProtocol !== 4) await updateMachine(machineId, { daemonProtocol: 4 });
+		const running = await runningRunsForMachine(machineId);
+		const currentSet = new Set(currentIds);
+		return {
+			status: 200,
+			body: {
+				delivery: base.body.delivery,
+				cancelRunIds: running.filter((run) => currentSet.has(run.id) && run.cancelRequestedAt).map((run) => run.id),
+				...needsUpdate ? { needsUpdate: {
+					current: reportedVersion ?? null,
+					required: MIN_DAEMON_VERSION,
+					command: daemonUpgradeCommand()
+				} } : {}
+			}
+		};
+	}
+	async pollV4Wait(deviceToken, request, waitMs = LONG_POLL_WAIT_MS) {
+		if (request.currentRuns?.length || request.protocolVersion !== 4) return this.pollV4(deviceToken, request);
+		const auth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+		if (!auth.ok) return auth.response;
+		const machineId = auth.machineId;
+		const waiter = this.armPollWaiter(machineId, Math.min(Math.max(waitMs, 0), LONG_POLL_WAIT_MS));
+		try {
+			const first = await this.pollV4(deviceToken, request);
+			if (first.status !== 200) return first;
+			if (first.body.delivery) return first;
+			if (!await waiter.promise) {
+				await setMachineOnline(machineId, true);
+				return first;
+			}
+			return this.pollV4(deviceToken, request);
+		} finally {
+			waiter.cancel();
+		}
+	}
+	/**
+	* Whether this machine (by device token) currently has a live daemon — so
+	* Claude Code can avoid starting a duplicate. `online` is fresh-checked against
+	* the poll TTL, not just the stored flag.
+	*/
+	async status(deviceToken) {
+		const auth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+		if (!auth.ok) return auth.response;
+		const { machineId, machine } = auth;
+		if (!machine) return {
+			status: 200,
+			body: {
+				registered: false,
+				claimValid: await readConnectKeyBinding(deviceToken) !== void 0,
+				online: false,
+				name: null,
+				lastSeen: null,
+				daemonProtocol: null
+			}
+		};
+		const fresh = !!machine.lastSeen && Date.now() - Date.parse(machine.lastSeen) < 3e4;
+		const online = !!machine.online && fresh;
+		const currentRuns = (await runningRunsForMachine(machineId)).map((run) => ({
+			runId: run.id,
+			stage: "executing",
+			cancelPending: run.cancelRequestedAt != null
+		}));
+		return {
+			status: 200,
+			body: {
+				registered: true,
+				online,
+				name: machine.name || null,
+				lastSeen: machine.lastSeen ?? null,
+				daemonProtocol: machine.daemonProtocol ?? null,
+				currentRuns: online ? currentRuns : []
+			}
+		};
+	}
+	async createLoop(deviceToken, body) {
+		const auth = await authenticateDeviceToken(deviceToken);
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		const machine = auth.machine;
+		{
+			if (body === null || typeof body !== "object" || Array.isArray(body)) return {
+				status: 400,
+				body: { error: "create body must be an object" }
+			};
+			const { dryRun, idempotencyKey, ...rawConfig } = body;
+			if (dryRun !== void 0 && typeof dryRun !== "boolean") return {
+				status: 400,
+				body: { error: "dryRun must be boolean when provided" }
+			};
+			if (typeof idempotencyKey !== "string" || !/^[0-9a-f]{64}$/.test(idempotencyKey)) return {
+				status: 400,
+				body: { error: "idempotencyKey is required and must be exactly 64 lowercase hex characters" }
+			};
+			const validated = validateLoopCreate(rawConfig);
+			if (!validated.ok) return {
+				status: 400,
+				body: { error: validated.detail }
+			};
+			const { config, row } = validated.value;
+			if (dryRun === true) return {
+				status: 200,
+				body: {
+					ok: true,
+					dryRun: true,
+					config,
+					text: JSON.stringify(config, null, 2)
+				}
+			};
+			const existingId = readNewIdempotency(idempotencyKey, machineId);
+			const existing = existingId ? await getLoop(existingId) : void 0;
+			if (existing?.machineId === machineId) return {
+				status: 200,
+				body: {
+					ok: true,
+					id: existing.id,
+					name: existing.name,
+					idempotent: true,
+					text: `loop: ${existing.name}\nid: ${existing.id}\nreplayed: true`
+				}
+			};
+			const loop = await createLoop({
+				userId: machine.userId,
+				machineId,
+				...row
+			});
+			this.scheduler.addLoop(loop);
+			recordNewIdempotency(idempotencyKey, machineId, loop.id);
+			log$2.info({
+				machineId,
+				loopId: loop.id,
+				agent: loop.agent
+			}, "createLoop: canonical prompt runner created");
+			return {
+				status: 200,
+				body: {
+					ok: true,
+					id: loop.id,
+					name: loop.name,
+					text: `loop: ${loop.name}\nid: ${loop.id}`
+				}
+			};
+		}
+	}
+	async listLoops(deviceToken, fieldsFlag, json) {
+		const auth = await authenticateDeviceToken(deviceToken);
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		const extras = [];
+		if (fieldsFlag !== void 0) {
+			const requested = String(fieldsFlag).split(",").map((s) => s.trim()).filter(Boolean);
+			const unknown = requested.filter((f) => !LIST_OPTIONAL_FIELDS.includes(f));
+			if (unknown.length) return {
+				status: 400,
+				body: { error: `unknown field(s): ${unknown.join(", ")} — available: ${LIST_OPTIONAL_FIELDS.join(", ")}` }
+			};
+			for (const f of requested) if (!extras.includes(f)) extras.push(f);
+		}
+		const fields = [...LIST_DEFAULT_FIELDS, ...extras];
+		const wantRuns = fields.includes("runs");
+		const wantLastResult = fields.includes("lastResult");
+		const loopRows = await loopsForMachine(machineId);
+		const loops = await Promise.all(loopRows.map(async (l) => {
+			const schedule = scheduleFromLoop(l);
+			const nextFire = l.enabled && schedule.mode === "cron" ? nextFires(schedule.cron, schedule.timezone, 1)[0] ?? null : null;
+			const last = wantLastResult ? await lastRun(l.id) : void 0;
+			return {
+				id: l.id,
+				name: l.name,
+				schedule,
+				enabled: l.enabled,
+				model: l.model ?? null,
+				reasoningEffort: l.reasoningEffort ?? null,
+				workdir: l.workdir,
+				nextFire,
+				runs: wantRuns ? await countRuns(l.id) : 0,
+				lastResult: last ? runResultToken(last) : null
+			};
+		}));
+		const envelopes = loopRows.map(canonicalLoopEnvelope);
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				loops: envelopes,
+				text: json ? JSON.stringify(envelopes, null, 2) : renderLoopsText(loops, fields)
+			}
+		};
+	}
+	async editLoop(deviceToken, id, patch, dryRun = false) {
+		const auth = await authenticateDeviceToken(deviceToken);
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		if (typeof id !== "string" || !id) return {
+			status: 400,
+			body: { error: "loop id required" }
+		};
+		const loop = await getLoop(id);
+		if (!loop || loop.machineId !== machineId) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		{
+			const validated = validateLoopEdit(loop, patch);
+			if (!validated.ok) return {
+				status: 400,
+				body: { error: validated.detail }
+			};
+			const update = validated.value;
+			const applied = Object.keys(patch ?? {});
+			if (dryRun) {
+				const before = canonicalLoopEnvelope(loop);
+				const after = canonicalLoopEnvelope({
+					...loop,
+					...update
+				});
+				const { id: _readOnlyId, ...config } = after;
+				const preview = {
+					id: loop.id,
+					applied,
+					before,
+					after
+				};
+				return {
+					status: 200,
+					body: {
+						ok: true,
+						dryRun: true,
+						...preview,
+						config,
+						text: JSON.stringify(preview, null, 2)
+					}
+				};
+			}
+			if (Object.keys(update).length === 0) return {
+				status: 200,
+				body: {
+					ok: true,
+					id: loop.id,
+					name: loop.name,
+					applied: [],
+					nothingToChange: true,
+					text: `loop: ${loop.name}\nid: ${loop.id}\napplied[0]:`
+				}
+			};
+			const updated = await updateLoop(loop.id, update);
+			if (!updated) return {
+				status: 404,
+				body: { error: "loop not found" }
+			};
+			if (updated.enabled) this.scheduler.addLoop(updated);
+			else this.scheduler.removeLoop(updated.id);
+			return {
+				status: 200,
+				body: {
+					ok: true,
+					id: updated.id,
+					name: updated.name,
+					applied,
+					text: `loop: ${updated.name}\nid: ${updated.id}\napplied: ${applied.join(",")}`
+				}
+			};
+		}
+	}
+	async rejectRetiredConflict(runToken, lease, body, payloadDigest) {
+		const ackBody = {
+			ok: true,
+			accepted: false,
+			terminal: true,
+			reportId: body.reportId,
+			code: "REPORT_CONFLICT",
+			issues: ["reportId was already committed for another run"],
+			disposition: "telemetry-rejected",
+			payloadDigest
+		};
+		const receipt = await acknowledgeRetiredTerminalIncident({
+			runId: lease.runId,
+			leaseTokenHash: sha256(runToken),
+			reportId: body.reportId,
+			payloadDigest,
+			ackBody
+		});
+		return receipt ? {
+			status: 200,
+			body: receipt.ackBody
+		} : {
+			status: 401,
+			body: { error: "invalid or expired token" }
+		};
+	}
+	async retiredReport(runToken, body, runId) {
+		const expected = receiptFor(body, runId, 410, {
+			error: "execution authority retired",
+			code: "RETIRED",
+			reportId: body.reportId
+		});
+		const stored = await acknowledgeRetiredReport(sha256(runToken), expected);
+		if (!stored) {
+			const winner = await getReportReceipt(expected.reportId);
+			if (winner && winner.runId !== runId) return this.rejectRetiredConflict(runToken, { runId }, body, sha256(JSON.stringify(body)));
+			return receiptResponse(winner, expected) ?? {
+				status: 401,
+				body: { error: "invalid or expired token" }
+			};
+		}
+		if (stored.runId !== runId) return this.rejectRetiredConflict(runToken, { runId }, body, sha256(JSON.stringify(body)));
+		return receiptResponse(stored, expected);
+	}
+	async ignoreCanceledReport(runToken, lease, body) {
+		const expected = receiptFor(body, lease.runId);
+		const stored = await putReportReceiptIfAbsent(expected);
+		if (!stored) return {
+			status: 401,
+			body: { error: "invalid or expired token" }
+		};
+		if (stored.runId !== lease.runId) {
+			const payloadDigest = sha256(JSON.stringify(body));
+			const ackBody = {
+				ok: true,
+				accepted: false,
+				terminal: true,
+				reportId: body.reportId,
+				code: "REPORT_CONFLICT",
+				issues: ["reportId was already committed for another run"],
+				disposition: "telemetry-rejected",
+				payloadDigest
+			};
+			const incident = await putTerminalReportIncidentIfAbsent({
+				runId: lease.runId,
+				reportId: body.reportId,
+				payloadDigest,
+				disposition: "telemetry-rejected",
+				ackBody
+			});
+			await retireLease(runToken);
+			return {
+				status: 200,
+				body: incident.ackBody
+			};
+		}
+		const response = receiptResponse(stored, expected);
+		if (response.status < 300) await retireLease(runToken);
+		log$2.info({ runId: lease.runId }, "report: ignored (run was canceled)");
+		return response;
+	}
+	/** Reconcile one swept run. The store consumes the terminal-grace lease in the
+	* same loop-lock transaction as the error→done/error patch and loop state, so
+	* concurrent late reports cannot both win (including error→error). */
+	async reconcileReclaimedReport(runToken, lease, run, body) {
+		const providerOk = body.result === "success";
+		const canceled = body.result === "canceled";
+		const protocolMissing = providerOk ? runProtocolMissing(run) : [];
+		const ok = providerOk && protocolMissing.length === 0;
+		const message = run.message ?? void 0;
+		const loopPatch = {};
+		const receipt = receiptFor(body, lease.runId);
+		const payloadDigest = sha256(JSON.stringify(body));
+		let reconciled;
+		try {
+			reconciled = await reconcileReclaimedRun(lease.loopId, lease.runId, sha256(runToken), {
+				phase: canceled ? "canceled" : ok ? "done" : "error",
+				...coerceTelemetry(body),
+				...message !== void 0 ? { message } : {},
+				...canceled ? { error: "stopped by user" } : protocolMissing.length ? { error: `run protocol incomplete: missing ${protocolMissing.join(", ")}` } : ok ? { error: null } : { error: typeof body.error === "string" ? clipText(body.error, MESSAGE_CAP) : run.error },
+				ts: nowIso()
+			}, loopPatch, AUTOPAUSE_STREAK, receipt);
+		} catch (error) {
+			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
+			if (raced.response) return raced.response;
+			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			throw error;
+		}
+		if (!reconciled) {
+			const raced = await committedReportEvidence(receipt.reportId, payloadDigest, lease.runId);
+			if (raced.response) return raced.response;
+			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const fresh = await getRun(lease.runId);
+			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
+			if (fresh?.phase === "done") return {
+				status: 409,
+				body: {
+					error: "run already finalized",
+					code: "REPORT_NOT_FINALIZED",
+					reportId: body.reportId
+				}
+			};
+			if ((await resolveLease(runToken))?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+			log$2.info({
+				runId: lease.runId,
+				phase: fresh?.phase
+			}, "report: late reconcile lost terminal race");
+			return {
+				status: 409,
+				body: {
+					error: "terminal report was not finalized",
+					code: "REPORT_NOT_FINALIZED",
+					reportId: body.reportId
+				}
+			};
+		}
+		const deleting = reconciled.loop.deleteRequestedAt != null;
+		const reportOnly = reconciled.reportOnly === true;
+		if (!deleting && !reportOnly) try {
+			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
+			await pruneRunSnapshots(lease.loopId, snapshotRetention());
+		} catch (err) {
+			log$2.warn({
+				runId: lease.runId,
+				err: err instanceof Error ? err.message : String(err)
+			}, "snapshot capture failed");
+		}
+		reconciled.run;
+		if (!reportOnly) this.scheduler.addLoop(reconciled.loop);
+		if (!reportOnly) this.applyAutopauseTimer(lease.loopId, reconciled);
+		if (deleting) await tryDeleteLoop(lease.loopId);
+		log$2.info({
+			runId: lease.runId,
+			ok,
+			reclaimed: true
+		}, canceled ? "report: reconciled a reclaimed run to canceled" : ok ? "report: reconciled a reclaimed run to done (machine woke)" : "report: recorded a reclaimed run's real error");
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				reportId: body.reportId
+			}
+		};
+	}
+	async rejectTerminalAttempt(runToken, lease, body, payloadDigest, code, issues) {
+		const reportId = body.reportId;
+		const run = await getRun(lease.runId);
+		const disposition = lease.state !== "active" && (run?.phase === "done" || run?.phase === "error" || run?.phase === "canceled") ? "telemetry-rejected" : "run-error";
+		const incident = incidentDiagnosis(code, issues, reportId, payloadDigest);
+		const ackBody = {
+			ok: true,
+			accepted: false,
+			terminal: true,
+			reportId,
+			code,
+			issues,
+			disposition,
+			payloadDigest
+		};
+		if (lease.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+		const rejected = await rejectTerminalReport({
+			loopId: lease.loopId,
+			runId: lease.runId,
+			leaseTokenHash: sha256(runToken),
+			leaseState: lease.state,
+			reportId,
+			payloadDigest,
+			disposition,
+			incident,
+			ackBody,
+			failureAutopauseStreak: AUTOPAUSE_STREAK
+		});
+		if (rejected.state === "normal-replay") return {
+			status: rejected.receipt.ackStatus,
+			body: rejected.receipt.ackBody
+		};
+		if (rejected.state === "incident-replay") return {
+			status: 200,
+			body: rejected.receipt.ackBody
+		};
+		if (rejected.state === "run-error" || rejected.state === "telemetry-rejected") {
+			this.scheduler.addLoop(rejected.loop);
+			if (rejected.state === "run-error") this.applyAutopauseTimer(lease.loopId, rejected);
+			if (rejected.loop.deleteRequestedAt) await tryDeleteLoop(lease.loopId);
+			log$2.warn({
+				runId: lease.runId,
+				reportId,
+				code,
+				disposition
+			}, "report: rejected terminal attempt durably handled");
+			return {
+				status: 200,
+				body: rejected.receipt.ackBody
+			};
+		}
+		const evidence = await committedReportEvidence(reportId, payloadDigest, body.runId);
+		if (evidence.response) return evidence.response;
+		if ((await resolveLease(runToken))?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+		return {
+			status: 401,
+			body: { error: "invalid or expired token" }
+		};
+	}
+	async report(runToken, body) {
+		if (!correlatableReportId(body.reportId)) {
+			if (!await resolveLease(runToken)) return {
+				status: 401,
+				body: { error: "invalid or expired token" }
+			};
+			return {
+				status: 400,
+				body: {
+					error: "reportId must be a non-empty NUL-free string of at most 200 characters",
+					code: "VALIDATION_ERROR"
+				}
+			};
+		}
+		const reportId = body.reportId;
+		const payloadDigest = sha256(JSON.stringify(body));
+		const lease = await resolveLease(runToken);
+		if (!lease) return (await committedReportEvidence(reportId, payloadDigest, body.runId, true)).response ?? {
+			status: 401,
+			body: { error: "invalid or expired token" }
+		};
+		const evidence = await committedReportEvidence(reportId, payloadDigest, lease.runId);
+		if (evidence.response) return evidence.response;
+		if (lease.state === "retired") {
+			if (evidence.foreignRun) return this.rejectRetiredConflict(runToken, lease, body, payloadDigest);
+			return this.retiredReport(runToken, body, lease.runId);
+		}
+		const issues = [];
+		if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(reportId)) issues.push("reportId must be a valid UUID");
+		if (typeof body.runId !== "string" || !body.runId) issues.push("runId is required");
+		else if (body.runId !== lease.runId) issues.push("runId does not match this run lease");
+		issues.push(...validateTerminalReport(body));
+		if (evidence.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+		if (issues.length) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_INVALID", issues);
+		const expected = receiptFor(body, lease.runId);
+		const ok = body.result === "success";
+		const canceled = body.result === "canceled";
+		const run = await getRun(lease.runId);
+		if (run?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
+		if (run?.phase === "done") return {
+			status: 409,
+			body: {
+				error: "run already finalized",
+				code: "REPORT_NOT_FINALIZED",
+				reportId
+			}
+		};
+		if (run?.phase === "error" && (lease.state === "terminal-grace" || lease.state === "reconciliation-only")) return this.reconcileReclaimedReport(runToken, lease, run, body);
+		const protocolMissing = ok && run ? runProtocolMissing(run) : [];
+		const effectiveOk = ok && protocolMissing.length === 0;
+		const loopPatch = {};
+		let terminal;
+		try {
+			terminal = await finalizeRunningRun(lease.loopId, lease.runId, {
+				phase: canceled ? "canceled" : effectiveOk ? "done" : "error",
+				...coerceTelemetry(body),
+				...canceled ? { error: "stopped by user" } : protocolMissing.length ? { error: `run protocol incomplete: missing ${protocolMissing.join(", ")}` } : effectiveOk ? {} : { error: typeof body.error === "string" ? clipText(body.error, MESSAGE_CAP) : "run failed on machine" },
+				ts: nowIso()
+			}, loopPatch, sha256(runToken), AUTOPAUSE_STREAK, expected);
+		} catch (error) {
+			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
+			if (raced.response) return raced.response;
+			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			throw error;
+		}
+		if (!terminal) {
+			const raced = await committedReportEvidence(reportId, payloadDigest, lease.runId);
+			if (raced.response) return raced.response;
+			if (raced.foreignRun) return this.rejectTerminalAttempt(runToken, lease, body, payloadDigest, "REPORT_CONFLICT", ["reportId was already committed for another run"]);
+			const fresh = await getRun(lease.runId);
+			if (fresh?.phase === "canceled") return this.ignoreCanceledReport(runToken, lease, body);
+			if (fresh?.phase === "done") return {
+				status: 409,
+				body: {
+					error: "run already finalized",
+					code: "REPORT_NOT_FINALIZED",
+					reportId
+				}
+			};
+			const refreshedLease = await resolveLease(runToken);
+			if (refreshedLease?.state === "retired") return this.retiredReport(runToken, body, lease.runId);
+			if (fresh?.phase === "error" && refreshedLease?.state === "terminal-grace") return this.reconcileReclaimedReport(runToken, refreshedLease, fresh, body);
+			log$2.info({
+				runId: lease.runId,
+				phase: fresh?.phase
+			}, "report: lost terminal race");
+			return {
+				status: 409,
+				body: {
+					error: "terminal report was not finalized",
+					code: "REPORT_NOT_FINALIZED",
+					reportId
+				}
+			};
+		}
+		terminal.run;
+		const deleting = terminal.loop.deleteRequestedAt != null;
+		if (!deleting) try {
+			await putRunSnapshot(lease.runId, lease.loopId, await buildLoopManifest(lease.loopId));
+			await pruneRunSnapshots(lease.loopId, snapshotRetention());
+		} catch (err) {
+			log$2.warn({
+				runId: lease.runId,
+				err: err instanceof Error ? err.message : String(err)
+			}, "snapshot capture failed");
+		}
+		this.scheduler.addLoop(terminal.loop);
+		this.applyAutopauseTimer(lease.loopId, terminal);
+		log$2.info({
+			runId: lease.runId,
+			ok: effectiveOk
+		}, "report: finalized");
+		if (deleting) await tryDeleteLoop(lease.loopId);
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				reportId
+			}
+		};
+	}
+};
+/** Compact a stored ISO timestamp to `YYYY-MM-DD HH:MM` (UTC, as stored) for a TOON
+*  cell — a date the agent reads at a glance without the `T`/seconds/zone noise. */
+function fmtTime(iso) {
+	return iso.slice(0, 16).replace("T", " ");
+}
+/** Format an instant in a loop's OWN timezone with a short zone name
+*  (`2026-07-08 05:00 GMT+8`), so cadence previews read in the schedule the owner set
+*  rather than raw UTC. `seconds` optionally adds `:SS`. Falls back to the bare
+*  `fmtTime` slice only if the stored timezone is invalid. */
+function fmtTimeZoned(iso, timezone, opts = {}) {
+	if (!timezone) throw new Error("invariant: cron schedule has no timezone");
+	try {
+		const parts = new Intl.DateTimeFormat("en-CA", {
+			timeZone: timezone,
+			year: "numeric",
+			month: "2-digit",
+			day: "2-digit",
+			hour: "2-digit",
+			minute: "2-digit",
+			...opts.seconds ? { second: "2-digit" } : {},
+			hour12: false,
+			timeZoneName: "short"
+		}).formatToParts(new Date(iso));
+		const get = (t) => parts.find((p) => p.type === t)?.value ?? "";
+		const sec = opts.seconds ? `:${get("second")}` : "";
+		return `${get("year")}-${get("month")}-${get("day")} ${get("hour")}:${get("minute")}${sec} ${get("timeZoneName")}`;
+	} catch {
+		return fmtTime(iso);
+	}
+}
+var LIST_DEFAULT_FIELDS = [
+	"id",
+	"name",
+	"cron",
+	"enabled",
+	"nextFire"
+];
+var LIST_OPTIONAL_FIELDS = [
+	"timezone",
+	"model",
+	"reasoningEffort",
+	"runs",
+	"lastResult"
+];
+function loopCell(rec, field) {
+	switch (field) {
+		case "id": return rec.id;
+		case "name": return rec.name;
+		case "cron": return rec.schedule.mode === "continuous" ? `continuous +${rec.schedule.delayMinutes}m` : rec.schedule.cron;
+		case "enabled": return rec.enabled ? "on" : "paused";
+		case "nextFire": return rec.nextFire ? fmtTime(rec.nextFire) : null;
+		case "timezone": return rec.schedule.mode === "cron" ? rec.schedule.timezone : null;
+		case "model": return rec.model;
+		case "reasoningEffort": return rec.reasoningEffort;
+		case "runs": return rec.runs;
+		case "lastResult": return rec.lastResult;
+		default: return null;
+	}
+}
+function renderLoopsText(loops, fields) {
+	if (!loops.length) return doc(countLine(0), emptyList("loops"), helpBlock(["Run `pievo new --json '{...}'` to create your first loop", "Run `pievo daemon connect` if this machine isn't connected yet"]));
+	return doc(countLine(loops.length), listBlock("loops", fields, loops.map((l) => fields.map((f) => loopCell(l, f)))), helpBlock(["Run `pievo show <id>` to see a loop's full config", "Run `pievo log <id>` to see a loop's recent runs"]));
+}
+function runResultToken(r) {
+	if (r.status === "block") return `block/${r.phase}`;
+	if (r.phase === "canceled") return "canceled";
+	const base = r.phase === "error" ? "failed" : r.phase === "done" ? "ok" : r.phase;
+	return r.status ? `${base}/${r.status}` : `${base}/missing-status`;
+}
+/** Stable JSON with recursively sorted object keys — so two structurally-equal values
+*  serialize identically regardless of key ordering (pg `jsonb` normalizes key order). */
+function canonicalJson(v) {
+	return JSON.stringify(v, (_k, val) => val && typeof val === "object" && !Array.isArray(val) ? Object.fromEntries(Object.entries(val).sort(([x], [y]) => x < y ? -1 : x > y ? 1 : 0)) : val);
+}
+/** The next N fire times of a cron, probed IN the loop's timezone (fire times shift
+*  with it — matching how the scheduler arms the loop), as ISO strings. Empty when
+*  the expression is invalid (the caller has already run validCadence). Powers the
+*  `--dry-run` fire preview. */
+function nextFires(cron, timezone, n) {
+	if (!timezone) throw new Error("invariant: cron schedule has no timezone");
+	try {
+		const c = new E(cron, {
+			paused: true,
+			timezone
+		});
+		const out = [];
+		let prev;
+		for (let i = 0; i < n; i++) {
+			const next = prev ? c.nextRun(prev) : c.nextRun();
+			if (!next) break;
+			out.push(next.toISOString());
+			prev = next;
+		}
+		c.stop();
+		return out;
+	} catch {
+		return [];
+	}
+}
+/**
+* Artifact sync - the byte-ingress half of the machine gateway, split out of
+* `MachineGateway` (which keeps poll/report/CLI/retention). Same wire surface,
+* framework-agnostic like the rest of the gateway (`{ status, body }` results):
+*
+*   POST /api/machine/sync        (Bearer device token) → manifest reconcile
+*   PUT  /api/machine/blob/:hash  (Bearer device token) → negotiated blob upload
+*
+* plus `readBlob` (the download seam the artifact/diff readers resolve bytes
+* through). Boot constructs ONE BlobStore and hands the SAME instance to this
+* class and to `MachineGateway` (whose `maintainStorage` GC deletes the bytes
+* written here).
+*/
+var log$1 = logger.child({ mod: "gateway" });
+var BLOB_PRESENCE_CONCURRENCY = 16;
+async function mapConcurrent(items, limit, visit) {
+	let next = 0;
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (next < items.length) {
+			const item = items[next++];
+			await visit(item);
+		}
+	}));
+}
+var ArtifactSync = class {
+	blobStore;
+	constructor(blobStore = createBlobStore()) {
+		this.blobStore = blobStore;
+	}
+	/**
+	* Reconcile one complete configured-path manifest after a run. Missing hashes
+	* are returned for upload through the raw blob PUT endpoint.
+	*/
+	async sync(deviceToken, rawBody) {
+		const auth = await authenticateDeviceToken(deviceToken);
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		const body = parseArtifactSyncBody(rawBody);
+		if (!body) return {
+			status: 400,
+			body: { error: "invalid sync body" }
+		};
+		const { loopId, manifest } = body;
+		const loop = await getLoop(loopId);
+		if (!loop || loop.machineId !== machineId) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		const allowedPaths = new Set(loop.artifacts);
+		if (manifest.some((entry) => !allowedPaths.has(entry.path))) return {
+			status: 400,
+			body: { error: "manifest path is not configured on this loop" }
+		};
+		const keepPaths = [];
+		const needHashes = /* @__PURE__ */ new Set();
+		const storedState = /* @__PURE__ */ new Map();
+		const stateFor = async (hash) => {
+			const cached = storedState.get(hash);
+			if (cached) return cached;
+			const metadata = await blobExists(hash);
+			const state = {
+				metadata,
+				bytes: metadata && await this.blobStore.has(hash)
+			};
+			storedState.set(hash, state);
+			return state;
+		};
+		await mapConcurrent([...new Set(manifest.flatMap((entry) => entry.oversize ? [] : [entry.hash]))], BLOB_PRESENCE_CONCURRENCY, async (hash) => {
+			await stateFor(hash);
+		});
+		for (const entry of manifest) {
+			if (entry.oversize) {
+				if (await upsertConfiguredArtifactFile({
+					loopId,
+					path: entry.path,
+					hash: null,
+					size: entry.size,
+					binary: entry.binary,
+					oversize: true
+				})) keepPaths.push(entry.path);
+				continue;
+			}
+			const hash = entry.hash;
+			const stored = await stateFor(hash);
+			if (!await upsertConfiguredArtifactFile({
+				loopId,
+				path: entry.path,
+				hash,
+				size: entry.size,
+				binary: entry.binary,
+				oversize: false
+			})) continue;
+			if (!stored.bytes) needHashes.add(hash);
+			keepPaths.push(entry.path);
+		}
+		const tombstoned = await reconcileConfiguredArtifacts(loopId, [...allowedPaths], keepPaths);
+		log$1.info({
+			machineId,
+			loopId,
+			files: keepPaths.length,
+			need: needHashes.size,
+			tombstoned
+		}, "sync: reconciled");
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				needHashes: [...needHashes]
+			}
+		};
+	}
+	/**
+	* Upload one content-addressed blob's raw bytes (Bearer device token). The
+	* server recomputes sha256(body) and rejects any mismatch before storing —
+	* integrity + anti-poisoning, so a blob's bytes always match its key.
+	*/
+	async putBlob(deviceToken, hash, bytes) {
+		const auth = await authenticateDeviceToken(deviceToken);
+		if (!auth.ok) return auth.response;
+		const { machineId } = auth;
+		if (!isValidHash(hash)) return {
+			status: 400,
+			body: { error: "invalid hash (expect sha256 hex)" }
+		};
+		if (bytes.length > 10485760) return {
+			status: 413,
+			body: { error: "blob exceeds size cap" }
+		};
+		if (sha256Buf(bytes) !== hash) return {
+			status: 400,
+			body: { error: "hash mismatch (sha256(body) !== :hash)" }
+		};
+		if (!await machineReferencesBlob(machineId, hash)) return {
+			status: 403,
+			body: { error: "hash was not requested for this machine (sync a manifest first)" }
+		};
+		await this.blobStore.put(hash, bytes);
+		await recordBlob(hash, bytes.length);
+		return {
+			status: 200,
+			body: { ok: true }
+		};
+	}
+	readBlob(hash) {
+		if (!isValidHash(hash)) return Promise.resolve(null);
+		return this.blobStore.get(hash);
+	}
+};
+/**
+* Per-run artifact diff. Computed lazily on the server at read time
+* (no stored diffs): load run N's snapshot + the previous run's snapshot and diff
+* the two path → metadata maps. For changed TEXT files we load both blobs and
+* compute a unified line diff with `diff` (jsdiff) — a pure-string library, no
+* process execution, so the server's zero-exec invariant holds. Binary/oversize
+* files emit a size-delta marker only (no inline diff).
+*/
+var runDiff_exports = /* @__PURE__ */ __exportAll$1({ computeRunDiff: () => computeRunDiff });
+/**
+* Upper bound for computing an inline unified diff. jsdiff is synchronous and
+* roughly O(N*D); on a multi-MB or minified text file it would block the
+* single-process server (which also owns the scheduler) for seconds. Above this
+* a changed text file degrades to the size-delta marker, like binary/oversize.
+*/
+var MAX_DIFF_BYTES = 512 * 1024;
+function isText(e) {
+	return !!e && !e.binary && !e.oversize && !!e.hash;
+}
+function withinDiffCap(e) {
+	return !!e && (e.size == null || e.size <= MAX_DIFF_BYTES);
+}
+async function bytesOf(e) {
+	if (!e.hash) return null;
+	return await (await getArtifactSync()).readBlob(e.hash) ?? null;
+}
+function unified(path, oldText, newText, maxEditLength) {
+	return maxEditLength === void 0 ? createTwoFilesPatch(path, path, oldText, newText, "previous run", "this run") : createTwoFilesPatch(path, path, oldText, newText, "previous run", "this run", { maxEditLength });
+}
+function budgetValue(value) {
+	return Number.isFinite(value) ? Math.max(0, Math.floor(value)) : Number.MAX_SAFE_INTEGER;
+}
+function expectedInputBytes(change, verifiedSizes) {
+	const sizes = [change.previous, change.current].filter((entry) => !!entry).map((entry) => entry.hash ? verifiedSizes.get(entry.hash) : void 0);
+	if (sizes.some((size) => size === void 0)) return null;
+	return sizes.reduce((sum, size) => sum + size, 0);
+}
+/** Compute one run's artifact diff. The default remains the web UI's complete
+* view. Budgeted callers get explicit totals and stop before blob reads/jsdiff
+* once any work limit is spent. */
+async function computeRunDiff(runId, budget) {
+	const bounded = budget !== void 0;
+	const limits = budget ? {
+		maxFiles: budgetValue(budget.maxFiles),
+		maxInputBytes: budgetValue(budget.maxInputBytes),
+		maxDiffChars: budgetValue(budget.maxDiffChars)
+	} : {
+		maxFiles: Number.MAX_SAFE_INTEGER,
+		maxInputBytes: Number.MAX_SAFE_INTEGER,
+		maxDiffChars: Number.MAX_SAFE_INTEGER
+	};
+	const unavailable = () => bounded ? {
+		hasSnapshot: false,
+		files: [],
+		totalFiles: 0,
+		truncated: false,
+		truncation: {
+			files: false,
+			inputBytes: false,
+			diffChars: false
+		},
+		work: {
+			filesProcessed: 0,
+			inputBytes: 0,
+			emittedDiffChars: 0
+		}
+	} : {
+		hasSnapshot: false,
+		files: []
+	};
+	const run = await getRun(runId);
+	if (!run) return unavailable();
+	const snap = await getRunSnapshot(runId);
+	if (!snap) return unavailable();
+	const curr = snap.manifest ?? {};
+	const prev = run.runIndex == null ? {} : (await prevRunSnapshot(run.loopId, run.runIndex))?.manifest ?? {};
+	const changes = [];
+	for (const path of [...new Set([...Object.keys(curr), ...Object.keys(prev)])].sort()) {
+		const current = curr[path];
+		const previous = prev[path];
+		if (current && previous && current.hash === previous.hash && current.oversize === previous.oversize && current.size === previous.size) continue;
+		changes.push({
+			path,
+			current,
+			previous
+		});
+	}
+	const selected = changes.slice(0, limits.maxFiles);
+	const verifiedSizes = bounded ? await blobSizes(selected.flatMap((change) => [change.previous?.hash, change.current?.hash].filter((hash) => !!hash))) : /* @__PURE__ */ new Map();
+	const files = [];
+	let inputBytes = 0;
+	let emittedDiffChars = 0;
+	let inputTruncated = false;
+	let diffTruncated = false;
+	for (const change of selected) {
+		const { path, current: c, previous: p } = change;
+		let file;
+		let diffable = false;
+		if (c && !p) {
+			const text = isText(c);
+			const tooLarge = text && !withinDiffCap(c);
+			file = {
+				path,
+				status: "added",
+				binary: !text,
+				tooLarge,
+				sizeDelta: c.size ?? null
+			};
+			diffable = text && !tooLarge;
+		} else if (!c && p) {
+			const text = isText(p);
+			const tooLarge = text && !withinDiffCap(p);
+			file = {
+				path,
+				status: "removed",
+				binary: !text,
+				tooLarge,
+				sizeDelta: p.size != null ? -p.size : null
+			};
+			diffable = text && !tooLarge;
+		} else {
+			const bothText = isText(c) && isText(p);
+			const tooLarge = bothText && !(withinDiffCap(c) && withinDiffCap(p));
+			file = {
+				path,
+				status: "modified",
+				binary: !bothText,
+				tooLarge,
+				sizeDelta: c.size != null && p.size != null ? c.size - p.size : null
+			};
+			diffable = bothText && !tooLarge;
+		}
+		if (diffable) {
+			const expectedBytes = bounded ? expectedInputBytes(change, verifiedSizes) : [p?.size ?? 0, c?.size ?? 0].reduce((sum, size) => sum + size, 0);
+			if (expectedBytes == null || expectedBytes > limits.maxInputBytes - inputBytes) {
+				file.diffOmitted = "input-budget";
+				inputTruncated = true;
+			} else if (emittedDiffChars >= limits.maxDiffChars) {
+				file.diffOmitted = "diff-budget";
+				diffTruncated = true;
+			} else {
+				const [oldBytes, newBytes] = await Promise.all([p ? bytesOf(p) : Promise.resolve(Buffer.alloc(0)), c ? bytesOf(c) : Promise.resolve(Buffer.alloc(0))]);
+				inputBytes += (oldBytes?.length ?? 0) + (newBytes?.length ?? 0);
+				if (oldBytes == null || newBytes == null) file.binary = true;
+				else if (inputBytes > limits.maxInputBytes) {
+					file.diffOmitted = "input-budget";
+					inputTruncated = true;
+				} else {
+					const remaining = limits.maxDiffChars - emittedDiffChars;
+					const full = unified(path, oldBytes.toString("utf8"), newBytes.toString("utf8"), bounded ? remaining : void 0);
+					if (full === void 0) {
+						file.diffOmitted = "diff-budget";
+						diffTruncated = true;
+					} else {
+						file.diff = full.slice(0, remaining);
+						emittedDiffChars += file.diff.length;
+						if (file.diff.length < full.length) {
+							file.diffTruncated = true;
+							file.diffTotalChars = full.length;
+							diffTruncated = true;
+						}
+					}
+				}
+			}
+		}
+		files.push(file);
+	}
+	if (!bounded) return {
+		hasSnapshot: true,
+		files
+	};
+	const truncation = {
+		files: changes.length > selected.length,
+		inputBytes: inputTruncated,
+		diffChars: diffTruncated
+	};
+	return {
+		hasSnapshot: true,
+		files,
+		totalFiles: changes.length,
+		truncated: truncation.files || truncation.inputBytes || truncation.diffChars,
+		truncation,
+		work: {
+			filesProcessed: selected.length,
+			inputBytes,
+			emittedDiffChars
+		}
+	};
+}
+var HISTORY_DETAIL_TEXT_CAP = 32 * 1024;
+var HISTORY_DIFF_TEXT_CAP = 96 * 1024;
+var HISTORY_DIFF_INPUT_BYTES_MAX = 2 * 1024 * 1024;
+var HISTORY_JSON_TEXT_CAP = 512 * 1024;
+var TERMINAL_PHASES = [
+	"done",
+	"error",
+	"canceled"
+];
+var STATUSES = [
+	"keep",
+	"no-change",
+	"block"
+];
+var LOG_FLAGS = new Set([
+	"_",
+	"loop",
+	"help",
+	"run",
+	"diff",
+	"since",
+	"until",
+	"status",
+	"phase",
+	"limit",
+	"json"
+]);
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function bool(v) {
+	return v === true || v === "true";
+}
+function positiveInt(name, value, max) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || !/^\d+$/.test(value)) return `--${name} must be a positive integer`;
+	const n = Number(value);
+	if (!Number.isSafeInteger(n) || n < 1 || max !== void 0 && n > max) return `--${name} must be between 1 and ${max ?? Number.MAX_SAFE_INTEGER}`;
+	return n;
+}
+function iso(name, value) {
+	if (value === void 0) return void 0;
+	if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T/.test(value) || !Number.isFinite(Date.parse(value))) return { error: `--${name} must be an ISO timestamp` };
+	return new Date(value).toISOString();
+}
+function parseHistoryFlags(flags) {
+	const unknown = Object.keys(flags).filter((key) => !LOG_FLAGS.has(key));
+	if (unknown.length) return {
+		ok: false,
+		error: `pievo: unknown flag --${unknown[0]} for log`
+	};
+	const limit = positiveInt("limit", flags.limit, 20);
+	if (typeof limit === "string") return {
+		ok: false,
+		error: limit
+	};
+	const since = iso("since", flags.since);
+	if (since && typeof since === "object") return {
+		ok: false,
+		error: since.error
+	};
+	const until = iso("until", flags.until);
+	if (until && typeof until === "object") return {
+		ok: false,
+		error: until.error
+	};
+	if (since !== void 0 && until !== void 0 && since > until) return {
+		ok: false,
+		error: "--since must not be after --until"
+	};
+	const status = flags.status;
+	if (status !== void 0 && (typeof status !== "string" || !STATUSES.includes(status))) return {
+		ok: false,
+		error: "--status must be keep|no-change|block"
+	};
+	const phase = flags.phase;
+	if (phase !== void 0 && (typeof phase !== "string" || !TERMINAL_PHASES.includes(phase))) return {
+		ok: false,
+		error: "--phase must be done|error|canceled"
+	};
+	const runRaw = flags.run;
+	if (bool(flags.diff) && runRaw === void 0) return {
+		ok: false,
+		error: "--diff requires --run"
+	};
+	if (runRaw !== void 0 && (since !== void 0 || until !== void 0 || status !== void 0 || phase !== void 0 || flags.limit !== void 0)) return {
+		ok: false,
+		error: "--run cannot be combined with time windows, list filters, or --limit"
+	};
+	let run;
+	if (runRaw !== void 0) {
+		if (typeof runRaw !== "string") return {
+			ok: false,
+			error: "--run needs a run index or full UUID"
+		};
+		if (/^\d+$/.test(runRaw)) {
+			const parsed = positiveInt("run", runRaw);
+			if (typeof parsed !== "number") return {
+				ok: false,
+				error: typeof parsed === "string" ? parsed : "--run needs a run index"
+			};
+			run = parsed;
+		} else if (UUID.test(runRaw)) run = runRaw;
+		else return {
+			ok: false,
+			error: "--run needs a positive run index or full UUID"
+		};
+	}
+	return {
+		ok: true,
+		value: {
+			mode: run === void 0 ? "list" : "detail",
+			json: bool(flags.json),
+			diff: bool(flags.diff),
+			...run !== void 0 ? { run } : {},
+			...since !== void 0 ? { since } : {},
+			...until !== void 0 ? { until } : {},
+			...status !== void 0 ? { status } : {},
+			...phase !== void 0 ? { phase } : {},
+			limit: limit ?? 10
+		}
+	};
+}
+function totalTokenUsage(usage) {
+	if (!usage || usage.inputTokens === void 0 && usage.outputTokens === void 0) return null;
+	return (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0);
+}
+function fmt(iso) {
+	return iso.replace("T", " ").replace(".000Z", "Z");
+}
+function boundedText(value, cap = HISTORY_DETAIL_TEXT_CAP) {
+	if (value == null) return {
+		value: null,
+		truncated: false
+	};
+	return {
+		value: value.slice(0, cap),
+		truncated: value.length > cap
+	};
+}
+function normalizedListRun(run) {
+	const message = boundedText(run.message ?? null, 500);
+	return {
+		runIndex: run.runIndex,
+		terminalAt: run.ts,
+		phase: run.phase,
+		status: run.status ?? null,
+		durationMs: run.durationMs ?? null,
+		tokenUsage: totalTokenUsage(run.usage ?? null),
+		message: message.value,
+		messageTruncated: message.truncated,
+		finalTextAvailable: !!run.finalText?.trim()
+	};
+}
+function jsonText(value) {
+	const text = JSON.stringify(value, null, 2);
+	return Buffer.byteLength(text, "utf8") <= 524288 ? text : void 0;
+}
+function response(text, channel = {}) {
+	const body = {
+		...channel,
+		text
+	};
+	if (Buffer.byteLength(JSON.stringify(body), "utf8") > 524288) return {
+		status: 413,
+		body: { error: `history response exceeds ${HISTORY_JSON_TEXT_CAP} bytes; narrow the window` }
+	};
+	return {
+		status: 200,
+		body
+	};
+}
+async function listHistory(loop, q) {
+	const conditions = [
+		eq(runs.loopId, loop.id),
+		isNotNull(runs.runIndex),
+		inArray(runs.phase, [...TERMINAL_PHASES]),
+		q.since ? gte(runs.ts, q.since) : void 0,
+		q.until ? lte(runs.ts, q.until) : void 0,
+		q.status ? eq(runs.status, q.status) : void 0,
+		q.phase ? eq(runs.phase, q.phase) : void 0
+	];
+	const [rows, counted] = await Promise.all([db.select().from(runs).where(and(...conditions)).orderBy(desc(runs.runIndex)).limit(q.limit), db.select({ n: sql`count(*)` }).from(runs).where(and(...conditions))]);
+	const normalized = rows.map(normalizedListRun);
+	const data = {
+		count: normalized.length,
+		total: Number(counted[0]?.n ?? 0),
+		runs: normalized
+	};
+	if (q.json) {
+		const text = jsonText(data);
+		return text ? response(text) : {
+			status: 413,
+			body: { error: "history JSON exceeds the response cap; lower --limit" }
+		};
+	}
+	const table = rows.length ? listBlock("runs", [
+		"index",
+		"terminal",
+		"phase",
+		"status",
+		"durationMs",
+		"tokenUsage",
+		"message",
+		"finalTextAvailable"
+	], rows.map((run) => [
+		run.runIndex,
+		fmt(run.ts),
+		run.phase,
+		run.status ?? null,
+		run.durationMs ?? null,
+		totalTokenUsage(run.usage ?? null),
+		run.message ? truncate(run.message, 500, "use --run for detail").value : null,
+		!!run.finalText?.trim()
+	])) : emptyList("runs");
+	return response(doc(`loop: ${scalar(loop.name)} (${loop.id})`, `count: ${rows.length} of ${Number(counted[0]?.n ?? 0)} matching`, table, helpBlock(["Use `pievo log --run <index>` for one run"])));
+}
+async function boundedDiff(runId) {
+	const raw = await computeRunDiff(runId, {
+		maxFiles: 100,
+		maxInputBytes: HISTORY_DIFF_INPUT_BYTES_MAX,
+		maxDiffChars: HISTORY_DIFF_TEXT_CAP
+	});
+	if (!raw.hasSnapshot) return {
+		included: true,
+		available: false,
+		reason: "snapshot-unavailable",
+		truncated: false,
+		files: []
+	};
+	return {
+		included: true,
+		available: true,
+		reason: null,
+		truncated: raw.truncated ?? false,
+		totalFiles: raw.totalFiles ?? raw.files.length,
+		truncation: raw.truncation,
+		work: raw.work,
+		files: raw.files
+	};
+}
+async function detailHistory(loop, q) {
+	const selector = typeof q.run === "number" ? eq(runs.runIndex, q.run) : eq(runs.id, q.run);
+	const run = (await db.select().from(runs).where(and(eq(runs.loopId, loop.id), selector)).limit(1))[0];
+	if (!run) return {
+		status: 404,
+		body: { error: "no such run in this loop" }
+	};
+	const snapshot = await getRunSnapshot(run.id);
+	const message = boundedText(run.message ?? null);
+	const error = boundedText(run.error ?? null);
+	const finalText = boundedText(run.finalText ?? null);
+	const detail = {
+		runIndex: run.runIndex ?? null,
+		terminalAt: TERMINAL_PHASES.includes(run.phase) ? run.ts : null,
+		phase: run.phase,
+		status: run.status ?? null,
+		durationMs: run.durationMs ?? null,
+		tokenUsage: totalTokenUsage(run.usage ?? null),
+		message: message.value,
+		messageTruncated: message.truncated,
+		error: error.value,
+		errorTruncated: error.truncated,
+		finalText: finalText.value,
+		finalTextTruncated: finalText.truncated,
+		diffAvailable: !!snapshot,
+		diff: q.diff ? await boundedDiff(run.id) : {
+			included: false,
+			available: !!snapshot
+		}
+	};
+	const json = jsonText(detail);
+	if (!json) return {
+		status: 413,
+		body: { error: "run detail exceeds the response cap" }
+	};
+	if (q.json) return response(json);
+	return response(detailBlock("run", [
+		["index", detail.runIndex],
+		["terminalAt", detail.terminalAt],
+		["phase", detail.phase],
+		["status", detail.status],
+		["durationMs", detail.durationMs],
+		["tokenUsage", detail.tokenUsage],
+		["message", detail.message],
+		["messageTruncated", detail.messageTruncated],
+		["error", detail.error],
+		["errorTruncated", detail.errorTruncated],
+		["finalText", detail.finalText],
+		["finalTextTruncated", detail.finalTextTruncated],
+		["diffAvailable", detail.diffAvailable],
+		["diff", { raw: JSON.stringify(detail.diff) }]
+	]));
+}
+/** Authorized owner history: bounded ordinary terminal list or one run detail. */
+async function readLoopHistory(loop, flags) {
+	const parsed = parseHistoryFlags(flags);
+	if (!parsed.ok) return {
+		status: 400,
+		body: { error: parsed.error }
+	};
+	return parsed.value.mode === "detail" ? detailHistory(loop, parsed.value) : listHistory(loop, parsed.value);
+}
+/**
+* CLI dispatch - the credential-keyed verb router half of the machine gateway,
+* split out of `MachineGateway` (which keeps poll/report/sweep/owner verbs).
+* Same wire surface, framework-agnostic like the rest of the gateway
+* (`{ status, body }` results):
+*
+*   POST /api/machine/cli  (Bearer device OR run credential) → unified dispatch
+*
+* The verb router keys authority on credential type first (`dk_` device prefix
+* vs `rk_` run lease) and reuses the core gateway
+* methods (`createLoop`/`editLoop`) through the injected `MachineGateway`,
+* plus the credential-neutral history module. Run credentials expose only the
+* exactly-once report callback.
+*/
+var cliLog = logger.child({ mod: "cli" });
+var CliGateway = class {
+	gateway;
+	pauseLoopState;
+	forceDeleteLoop;
+	destructiveLog;
+	constructor(gateway, deps = {}) {
+		this.gateway = gateway;
+		this.pauseLoopState = deps.pauseLoopState ?? pauseLoopState;
+		this.forceDeleteLoop = deps.forceDeleteLoop ?? forceDeleteLoop;
+		this.destructiveLog = deps.destructiveLog ?? ((event) => cliLog.warn(event, "force-delete: destructive server authority removal"));
+	}
+	/**
+	* The unified CLI endpoint. It is a ROUTER in front of the gateway logic that
+	* already exists — never a rewrite — that keys authority on the credential type:
+	*   · DEVICE credential (`dk_`-prefixed) → owner authority over any loop bound to
+	*     the machine: `new`→createLoop, `loops`→listLoops, `edit`→editLoop,
+	*     `log`→readLoopHistory, `show`→describe. `report` is RUN-only (403).
+	*   · RUN credential (`rk_` run lease) → report and report help only.
+	*     Every owner verb is rejected.
+	*/
+	async cli(token, argv) {
+		return finalizeCli(token.startsWith("dk_") ? await this.deviceCli(token, argv) : await this.runCli(token, argv));
+	}
+	async deviceCli(deviceToken, argv) {
+		const auth = await authenticateDeviceToken(deviceToken, { allowUnknown: true });
+		if (!auth.ok) return auth.response;
+		const { machineId, machine } = auth;
+		const verb = argv[0] ?? "";
+		if (verb === "home") return {
+			status: 200,
+			body: {
+				ok: true,
+				text: await this.homeDevice(machineId, parseFlags(argv.slice(1)))
+			}
+		};
+		if (!machine) return {
+			status: 401,
+			body: { error: "unknown machine (token not registered)" }
+		};
+		const flags = parseFlags(argv.slice(1));
+		const loopArg = typeof flags["loop"] === "string" ? flags["loop"] : typeof flags["_"] === "string" ? flags["_"] : "";
+		if (flags["help"] === true) {
+			const h = verbHelpText(verb);
+			if (h) return {
+				status: 200,
+				body: {
+					ok: true,
+					text: h
+				}
+			};
+		}
+		switch (verb) {
+			case "new": {
+				const parsed = parseJsonFlag(flags["json"]);
+				if (!parsed.ok) return {
+					status: 400,
+					body: { error: parsed.error }
+				};
+				const config = { ...parsed.value };
+				if (flags["dry-run"] === true) config.dryRun = true;
+				return this.gateway.createLoop(deviceToken, config);
+			}
+			case "loops": return this.gateway.listLoops(deviceToken, typeof flags["fields"] === "string" ? flags["fields"] : void 0, flags["json"] === true);
+			case "pause": return this.pauseOwnerLoop(machineId, loopArg);
+			case "start": return this.startOwnerLoop(machineId, loopArg);
+			case "stop": return this.stopOwnerLoop(machineId, loopArg);
+			case "delete": return this.deleteOwnerLoop(machineId, loopArg, flags["force"] === true, typeof flags["confirmation"] === "string" ? flags["confirmation"] : void 0);
+			case "run": return this.stopOwnerRun(machineId, argv);
+			case "edit": {
+				const parsed = parseJsonFlag(flags["json"]);
+				if (!parsed.ok) return {
+					status: 400,
+					body: { error: parsed.error }
+				};
+				return this.gateway.editLoop(deviceToken, loopArg || void 0, parsed.value, flags["dry-run"] === true);
+			}
+			case "log": {
+				const loop = await this.ownedLoop(machineId, loopArg);
+				if (!loop) return {
+					status: 404,
+					body: { error: "no such loop on this machine" }
+				};
+				return readLoopHistory(loop, flags);
+			}
+			case "show": {
+				const loop = loopArg ? await getLoop(loopArg) : void 0;
+				if (!loop || loop.machineId !== machineId) return {
+					status: 404,
+					body: { error: "no such loop on this machine" }
+				};
+				if (flags["json"] === true) {
+					const env = loopEnvelope(loop);
+					return {
+						status: 200,
+						body: {
+							ok: true,
+							loop: env,
+							text: JSON.stringify(env, null, 2)
+						}
+					};
+				}
+				return {
+					status: 200,
+					body: {
+						ok: true,
+						text: await this.describe(loop.id, { full: flags["full"] === true })
+					}
+				};
+			}
+			case "report": return {
+				status: 403,
+				body: { error: "pievo: report is a run-only verb; the owner edits via edit" }
+			};
+			default: return {
+				status: 400,
+				body: { error: `pievo: unknown command "${verb}" for the device credential (try: new, loops, pause, start, stop, delete, run stop, edit, log, show)` }
+			};
+		}
+	}
+	async ownedLoop(machineId, loopId) {
+		if (!loopId) return void 0;
+		const loop = await getLoop(loopId);
+		return loop?.machineId === machineId ? loop : void 0;
+	}
+	async pauseOwnerLoop(machineId, loopId) {
+		const loop = await this.ownedLoop(machineId, loopId);
+		if (!loop) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		const paused = await this.pauseLoopState(loop.id);
+		if (!paused) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		this.gateway.scheduler.removeLoop(loop.id);
+		return {
+			status: 200,
+			body: { text: paused.running ? PAUSED_FINISHING : "loop paused; future runs disabled" }
+		};
+	}
+	async startOwnerLoop(machineId, loopId) {
+		const loop = await this.ownedLoop(machineId, loopId);
+		if (!loop) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		if (loop.deleteRequestedAt) return {
+			status: 409,
+			body: { error: "loop is being deleted and cannot be started" }
+		};
+		const started = await startLoop(loop.id);
+		if (!started) return {
+			status: 409,
+			body: { error: "loop could not be started" }
+		};
+		this.gateway.scheduler.addLoop(started);
+		return {
+			status: 200,
+			body: { text: "loop started; preserved queued work is now eligible" }
+		};
+	}
+	async requireStopProtocol(machineId, running) {
+		if (!running) return void 0;
+		if ((await getMachine(machineId))?.daemonProtocol === 4) return void 0;
+		return {
+			status: 426,
+			body: {
+				text: STOP_UPGRADE_REQUIRED,
+				exitCode: 1
+			}
+		};
+	}
+	async stopOwnerLoop(machineId, loopId) {
+		const loop = await this.ownedLoop(machineId, loopId);
+		if (!loop) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		const target = await runningRunForLoop(loop.id);
+		const upgrade = await this.requireStopProtocol(machineId, target);
+		if (upgrade) return upgrade;
+		const result = await stopLoop(loop.id);
+		this.gateway.scheduler.removeLoop(loop.id);
+		if (!result) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		const machine = await getMachine(machineId);
+		return {
+			status: 200,
+			body: { text: result.running ? `stop requested; waiting for ${machine?.name || "machine"}` : "loop paused; queued work canceled; no current run" }
+		};
+	}
+	async deleteOwnerLoop(machineId, loopId, force, confirmation) {
+		const loop = await this.ownedLoop(machineId, loopId);
+		if (!loop) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		if (force) {
+			if (!loop.deleteRequestedAt) return {
+				status: 409,
+				body: { error: "delete must be requested first" }
+			};
+			if (confirmation !== FORCE_DELETE_CONFIRMATION) return {
+				status: 400,
+				body: { error: "force delete confirmation required" }
+			};
+			const machine = await getMachine(machineId);
+			const reachability = machinePresence(!!machine?.online, machine?.lastSeen ?? null);
+			if (!await this.forceDeleteLoop(loop.id)) return {
+				status: 409,
+				body: { error: "force delete failed; server data was not deleted" }
+			};
+			this.gateway.scheduler.removeLoop(loop.id);
+			this.destructiveLog({
+				action: "force-delete",
+				loopId: loop.id,
+				machineId,
+				actorUserId: loop.userId,
+				machineReachability: reachability
+			});
+			return {
+				status: 200,
+				body: { text: forceDeleteWarning(reachability) }
+			};
+		}
+		const target = await runningRunForLoop(loop.id);
+		const upgrade = await this.requireStopProtocol(machineId, target);
+		if (upgrade) return upgrade;
+		const result = await requestDeleteLoop(loop.id);
+		this.gateway.scheduler.removeLoop(loop.id);
+		if (!result) return {
+			status: 404,
+			body: { error: "no such loop on this machine" }
+		};
+		if (await tryDeleteLoop(loop.id)) return {
+			status: 200,
+			body: { text: "loop deleted; local project files were not deleted" }
+		};
+		return {
+			status: 200,
+			body: { text: `delete requested; stop requested; waiting for ${(await getMachine(machineId))?.name || "machine"}` }
+		};
+	}
+	async stopOwnerRun(machineId, argv) {
+		if (argv[1] !== "stop" || !argv[2]) return {
+			status: 400,
+			body: { error: "usage: pievo run stop <run>" }
+		};
+		const run = await getRun(argv[2]);
+		if (!run || run.machineId !== machineId) return {
+			status: 404,
+			body: { error: "no such run on this machine" }
+		};
+		const upgrade = await this.requireStopProtocol(machineId, run.phase === "running" ? run : void 0);
+		if (upgrade) return upgrade;
+		const stopped = await requestRunCancel(run.loopId, run.id);
+		if (!stopped) return {
+			status: 404,
+			body: { error: "no such run on this machine" }
+		};
+		if (stopped.phase === "running") return {
+			status: 200,
+			body: { text: `stop requested; waiting for ${(await getMachine(machineId))?.name || "machine"}` }
+		};
+		if (stopped.phase === "canceled") return {
+			status: 200,
+			body: { text: "run canceled before it started" }
+		};
+		return {
+			status: 200,
+			body: { text: `run already finished: ${runResultToken(stopped)}` }
+		};
+	}
+	async runCli(runToken, argv) {
+		const lease = await resolveLease(runToken);
+		if (!lease) return {
+			status: 401,
+			body: {
+				text: errorBlock("invalid or expired token", "UNAUTHORIZED"),
+				exitCode: 1
+			}
+		};
+		if (lease.state === "terminal-grace" || lease.state === "reconciliation-only") return {
+			status: 409,
+			body: {
+				text: errorBlock(TERMINAL_GRACE_MSG, "CONFLICT"),
+				exitCode: 1
+			}
+		};
+		const verb = argv[0] ?? "";
+		const flags = parseFlags(argv.slice(1));
+		if (DEVICE_ONLY_VERBS.has(verb)) return {
+			status: 403,
+			body: {
+				text: errorBlock(`"${verb}" needs the device credential (owner authority); a run may only report`, "FORBIDDEN"),
+				exitCode: 1
+			}
+		};
+		if (flags.help === true && verb === "report") return {
+			status: 200,
+			body: {
+				text: verbHelpText("report", lease),
+				exitCode: 0
+			}
+		};
+		if (verb !== "report" && verb !== "help" && verb !== "--help" && verb !== "-h" && verb !== "") return {
+			status: 403,
+			body: {
+				text: errorBlock("run credentials authorize only pievo report", "FORBIDDEN"),
+				exitCode: 1
+			}
+		};
+		const out = await this.dispatch(lease, createHash("sha256").update(runToken).digest("hex"), argv);
+		return {
+			status: out.code,
+			body: {
+				text: out.text,
+				exitCode: out.code === 200 ? 0 : 1
+			}
+		};
+	}
+	async dispatch(lease, leaseTokenHash, argv) {
+		const verb = argv[0];
+		const flags = parseFlags(argv.slice(1));
+		const str = (key) => typeof flags[key] === "string" ? flags[key] : void 0;
+		if (verb === void 0 || verb === "" || verb === "-h" || verb === "--help" || verb === "help") return {
+			code: 200,
+			text: this.helpText(lease)
+		};
+		if (verb !== "report") return derr(403, "run credentials authorize only pievo report", "FORBIDDEN");
+		if (flags.help === true) return {
+			code: 200,
+			text: verbHelpText("report", lease)
+		};
+		const rawStatus = str("status");
+		const status = reportStatus(rawStatus);
+		if (!status) return derr(400, `status must be keep|no-change|block${rawStatus === void 0 ? "" : ` (got "${rawStatus}")`}`, "VALIDATION_ERROR");
+		const message = str("message")?.trim();
+		if (!message) return derr(400, "report requires a non-empty --message", "VALIDATION_ERROR");
+		const acceptedFlags = [
+			"status",
+			"message",
+			"help"
+		];
+		const unknown = Object.keys(flags).filter((key) => !acceptedFlags.includes(key));
+		if (unknown.length) return derr(400, `report does not accept --${unknown[0]}`, "VALIDATION_ERROR");
+		if (lease.state === "retired") return {
+			code: 200,
+			text: "reported: run retired · result discarded"
+		};
+		const applied = await this.applyReportMutation(lease, leaseTokenHash, status, message.slice(0, MESSAGE_CAP));
+		return applied.ok ? {
+			code: 200,
+			text: renderReportedText(status, true)
+		} : derr(applied.status ?? 409, applied.detail ?? "this run is no longer active", applied.code);
+	}
+	helpText(_lease) {
+		return doc(listBlock("verbs", ["verb", "syntax"], [["report", "--status keep|no-change|block --message <summary>"]]), helpBlock(["Call exactly one pievo report before finishing", "No other command is accepted from a run credential"]));
+	}
+	async applyReportMutation(lease, leaseTokenHash, status, message) {
+		const result = await recordRunReportOnce({
+			loopId: lease.loopId,
+			runId: lease.runId,
+			leaseTokenHash,
+			status,
+			message
+		});
+		if (result.state === "applied") return {
+			ok: true,
+			detail: "reported"
+		};
+		if (result.state === "missing-loop") return {
+			ok: false,
+			detail: "loop not found",
+			code: "NOT_FOUND",
+			status: 404
+		};
+		if (result.state === "already-reported") return {
+			ok: false,
+			detail: "this run already reported",
+			code: "CONFLICT",
+			status: 409
+		};
+		return {
+			ok: false,
+			detail: "this run is no longer active",
+			code: "CONFLICT",
+			status: 409
+		};
+	}
+	async describe(loopId, opts = {}) {
+		const loop = await getLoop(loopId);
+		if (!loop) return "loop not found";
+		const recent = (await listRuns(loop.id, 8)).slice().reverse();
+		return renderShowText(loop, loopEnvelope(loop), await countRuns(loop.id), recent[0] ?? null, opts);
+	}
+	/**
+	* Bare `pievo` renders the home for a device credential. The
+	* daemon passes the local facts it alone knows as context flags (`--cwd`/`--home`
+	* for directory scoping, `--bin`/`--pid`/`--server` for the header); the server owns
+	* the whole TOON render (text-sink). An unregistered machine renders a DEFINITIVE
+	* "not connected" state (never empty, never an error).
+	*/
+	async homeDevice(machineId, flags) {
+		const machine = await getMachine(machineId);
+		const ctx = {
+			bin: typeof flags["bin"] === "string" ? flags["bin"] : null,
+			pid: typeof flags["pid"] === "string" ? flags["pid"] : null,
+			server: typeof flags["server"] === "string" ? flags["server"] : null,
+			cwd: typeof flags["cwd"] === "string" ? flags["cwd"] : null,
+			home: typeof flags["home"] === "string" ? flags["home"] : null
+		};
+		if (!machine) return renderHomeText(ctx, null, [], 0, []);
+		const presence = machinePresence(machine.online, machine.lastSeen);
+		const loops = await loopsForMachine(machineId);
+		const scoped = scopeLoopsByCwd(loops, ctx.cwd, ctx.home);
+		return renderHomeText(ctx, presence, await Promise.all(scoped.here.map(async (l) => {
+			const schedule = scheduleFromLoop(l);
+			return {
+				id: l.id,
+				name: l.name,
+				cron: schedule.mode === "continuous" ? `continuous +${schedule.delayMinutes}m` : schedule.cron,
+				enabled: l.enabled,
+				nextFire: l.enabled && schedule.mode === "cron" ? nextFires(schedule.cron, schedule.timezone, 1)[0] ?? null : null,
+				lastResult: await (async () => {
+					const last = await lastRun(l.id);
+					return last ? runResultToken(last) : null;
+				})()
+			};
+		})), scoped.elsewhere, await recentMachineRuns(loops, 3));
+	}
+};
+var TERMINAL_GRACE_MSG = "this run is terminal and no longer accepts commands; its final result is delivered via the terminal report";
+/** Verbs that require device authority. `report` is run-only and rejected there. */
+var DEVICE_ONLY_VERBS = new Set([
+	"new",
+	"edit",
+	"loops",
+	"start",
+	"stop",
+	"delete",
+	"run"
+]);
+var PAUSED_FINISHING = "loop paused; current run is finishing";
+var STOP_UPGRADE_REQUIRED = "Daemon upgrade required to stop a running process. Run `npm install -g @kky42/pievo@latest`, then `pievo daemon restart`.";
+var FORCE_DELETE_CONFIRMATION = "delete-server-data-anyway";
+function forceDeleteWarning(reachability) {
+	return `The ${reachability === "online" ? "machine is online" : reachability === "asleep" ? "machine is asleep" : "machine is unreachable"}. Its local process may still be running. This removes Pievo authority and server data only. Local project files are not deleted.`;
+}
+/** Parse a `--json '<obj>'` flag into an object. Absent → an empty object (the
+*  downstream createLoop/editLoop validators then produce the precise error, e.g.
+*  "cron required"). Present-but-not-a-JSON-object → a legible 400. Shared by the
+*  device-credential `new`/`edit` verbs of the unified CLI. */
+function parseJsonFlag(raw) {
+	if (raw === void 0 || raw === true) return {
+		ok: true,
+		value: {}
+	};
+	if (typeof raw !== "string") return {
+		ok: false,
+		error: "pievo: --json must be a JSON object string"
+	};
+	let obj;
+	try {
+		obj = JSON.parse(raw);
+	} catch {
+		return {
+			ok: false,
+			error: "pievo: --json must be valid JSON (an object)"
+		};
+	}
+	if (!obj || typeof obj !== "object" || Array.isArray(obj)) return {
+		ok: false,
+		error: "pievo: --json must be a JSON object"
+	};
+	return {
+		ok: true,
+		value: obj
+	};
+}
+/** A structured `error:`/`code:` TOON result for stdout.
+*  Mirrors the `{code, text}` shape `dispatch` returns; the slug defaults from the
+*  HTTP status but a caller may pin it (e.g. CONFLICT). */
+function derr(code, message, slug) {
+	return {
+		code,
+		text: errorBlock(message, slug ?? codeForStatus(code))
+	};
+}
+/** The structured keys a `/api/machine/cli` body may carry. The daemon renders
+* `text` and exits with `exitCode`; two structured channels remain because the
+* current daemon reads them as data:
+*   - `loops`: the daemon resolves cwd→loop CLIENT-side (`log`/`show`/`home`) from this
+*     list; the server's `log`/`show` dispatch needs an explicit id.
+*   - `runs`: the `log --json` normalized-data escape hatch. */
+var CLI_RETAINED_KEYS = new Set([
+	"text",
+	"exitCode",
+	"loops",
+	"runs"
+]);
+/** Finalize a `/api/machine/cli` body with `text` + `exitCode` and only the
+*  structured fields used by the daemon. A structured `{error}` is first
+*  rendered to `error:`/`code:` TOON so the daemon prints it to stdout. */
+function finalizeCli(res) {
+	const b = res.body;
+	if (b && typeof b === "object" && !Array.isArray(b)) {
+		const body = b;
+		if (typeof body.text !== "string" && typeof body.error === "string") body.text = errorBlock(body.error, codeForStatus(res.status));
+		if (typeof body.exitCode !== "number") body.exitCode = res.status >= 200 && res.status < 300 ? 0 : 1;
+		if (typeof body.text === "string") {
+			for (const k of Object.keys(body)) if (!CLI_RETAINED_KEYS.has(k)) delete body[k];
+		}
+	}
+	return res;
+}
+function renderReportedText(status, hasMessage) {
+	const parts = [];
+	if (status) parts.push(`status=${status}`);
+	if (hasMessage) parts.push("message recorded");
+	return `reported: ${parts.length ? parts.join(" · ") : "recorded"}`;
+}
+var RUN_VERB_HELP = { report: {
+	syntax: "report --status keep|no-change|block --message <text>",
+	summary: "record this run's required status and non-empty summary",
+	avail: () => "always available",
+	help: ["Run `pievo report --status no-change --message \"no actionable change\"` to close this run", "Run `pievo report --status keep --message \"completed the requested work\"` to retain a result"]
+} };
+var DEVICE_VERB_HELP = {
+	new: {
+		syntax: "new --json '<config>' [--dry-run]",
+		summary: `create a loop from the canonical envelope (keys: ${[...EDITABLE_LOOP_FIELDS].join(", ")}; agent required)`,
+		help: ["Run `pievo new --json '{\"name\":\"Daily check\",\"schedule\":{\"mode\":\"cron\",\"cron\":\"0 8 * * *\",\"timezone\":\"UTC\",\"overlap\":\"skip\"},\"workdir\":\"<path>\",\"agent\":\"claude-code\",\"prompt\":\"Check the project.\",\"statusDefinitions\":{\"keep\":\"result retained\",\"noChange\":\"nothing changed\",\"block\":\"owner input required\"}}'` to create a loop", "Run `pievo new --json '{...}' --dry-run` to validate without creating"]
+	},
+	loops: {
+		syntax: "loops [--fields a,b] [--json]",
+		summary: "list every loop bound to this machine",
+		help: ["Run `pievo show <id>` to see a loop's full config", "Run `pievo log <id>` to see a loop's recent runs"]
+	},
+	edit: {
+		syntax: "edit <id> --json '<patch>' [--dry-run]",
+		summary: `change a loop's config using one JSON patch (keys: ${[...EDITABLE_LOOP_FIELDS].join(", ")})`,
+		help: ["Run `pievo edit <id> --json '{\"schedule\":{\"mode\":\"continuous\",\"delayMinutes\":5}}'` to change the schedule", "Run `pievo edit <id> --json '{...}' --dry-run` to preview the change"]
+	},
+	show: {
+		syntax: "show [<id|unique-name>] [--full] [--json]",
+		summary: "print a loop's full config + recent runs (defaults from the current directory)",
+		help: ["Run `pievo loops` to list loops on this machine", "Run `pievo log <id>` to see the loop's recent runs"]
+	},
+	pause: {
+		syntax: "pause <id>",
+		summary: "pause future runs; the current run continues",
+		help: ["Pause future runs? The current run will continue."]
+	},
+	start: {
+		syntax: "start <id>",
+		summary: "enable a paused loop and re-arm its existing cadence",
+		help: ["Completed loops must be reopened explicitly; deleting loops cannot be started"]
+	},
+	stop: {
+		syntax: "stop <id>",
+		summary: "pause the loop, cancel queued work, and request process termination",
+		help: ["Pause this loop, cancel queued work, and stop the current run if it is still running?"]
+	},
+	delete: {
+		syntax: "delete <id> [--force]",
+		summary: "stop first, then delete server history and synced artifact metadata",
+		help: ["Stop this loop and delete its Pievo history and synced artifacts? Local project files are not deleted.", "--force requires a prior Delete request and explicit local confirmation; the local process may still be running"]
+	},
+	run: {
+		syntax: "run stop <run-id>",
+		summary: "stop one pending or running run without pausing its loop",
+		help: ["A running run remains running until the daemon confirms cancellation"]
+	},
+	log: {
+		syntax: "log [<id>] [--limit 1..20] [--since ISO] [--until ISO] [--status keep|no-change|block] [--phase done|error|canceled] [--run <index|UUID> [--diff]] [--json]",
+		summary: "bounded terminal history or one detailed run",
+		help: ["Run `pievo log <id> --json` for structured history", "Run `pievo log <id> --run 12 --diff` for bounded run detail and artifact diff"]
+	}
+};
+function verbHelpText(verb, lease) {
+	const spec = lease ? RUN_VERB_HELP[verb] : DEVICE_VERB_HELP[verb];
+	if (!spec) return void 0;
+	return doc(kvLine("verb", verb), kvLine("syntax", spec.syntax), kvLine("summary", spec.summary), lease && spec.avail ? kvLine("availability", spec.avail(lease)) : null, helpBlock(spec.help));
+}
+function loopEnvelope(loop) {
+	return { ...canonicalLoopEnvelope(loop) };
+}
+function contentField(value, full) {
+	if (value == null) return "absent";
+	if (full) return value;
+	return { raw: `present, ${value.length} bytes — use --full to see` };
+}
+function nextFireDisplay(loop) {
+	const schedule = scheduleFromLoop(loop);
+	if (schedule.mode === "continuous") return `after exec terminal + ${schedule.delayMinutes}m`;
+	const iso = nextFires(schedule.cron, schedule.timezone, 1)[0];
+	if (!iso) return "(never)";
+	return fmtTimeZoned(iso, schedule.timezone, { seconds: true });
+}
+function renderShowText(loop, env, totalRuns, lastRun, opts = {}) {
+	const full = opts.full === true;
+	const block = detailBlock("loop", [
+		["id", env.id],
+		["name", env.name],
+		["tags", { raw: JSON.stringify(env.tags) }],
+		["schedule", { raw: JSON.stringify(env.schedule) }],
+		["workdir", env.workdir],
+		["agent", env.agent],
+		["model", env.model == null ? { raw: "default" } : env.model],
+		["reasoningEffort", env.reasoningEffort == null ? { raw: "default" } : env.reasoningEffort],
+		["prompt", contentField(loop.prompt, full)],
+		["statusDefinitions", { raw: JSON.stringify(env.statusDefinitions) }],
+		["artifacts", { raw: JSON.stringify(env.artifacts) }],
+		["enabled", env.enabled]
+	]);
+	const runsTally = lastRun ? `${totalRuns} total · last ${runResultToken(lastRun)} ${fmtTime(lastRun.ts)}` : `${totalRuns} total`;
+	const help = [
+		`Run \`pievo show ${loop.id} --full\` to see the complete prompt`,
+		`Run \`pievo edit ${loop.id} --json '{"schedule":{"mode":"continuous","delayMinutes":5}}'\` to change the schedule`,
+		`Run \`pievo log ${loop.id}\` to see recent run results`
+	];
+	return doc(block, kvLine("nextFire", nextFireDisplay(loop)), `lifecycle: ${loop.enabled ? "active" : "paused"}`, `runs: ${runsTally}`, !loop.enabled ? kvLine("pauseCause", loop.pauseCause?.kind === "failure-streak" ? `failure-streak (run ${loop.pauseCause.runId}, count ${loop.pauseCause.count})` : loop.pauseCause?.kind === "blocked" ? `blocked (run ${loop.pauseCause.runId})` : loop.pauseCause?.kind === "owner" ? "owner" : "unknown") : null, lastRun?.reportIncident ? kvLine("reportIncident", `${lastRun.reportIncident.code} · ${lastRun.reportIncident.faultDomain} · ${lastRun.reportIncident.reason}`) : null, helpBlock(help));
+}
+var HOME_DESCRIPTION = "Run your scheduled Pievo agent loops on this machine with your own coding agent.";
+/** Expand a leading `~/` against the daemon-supplied home dir (the SERVER's own home
+*  is irrelevant — a loop's paths are the daemon machine's). Absent home ⇒ unchanged. */
+function expandHome(p, home) {
+	return home && p.startsWith("~/") ? path.join(home, p.slice(2)) : p;
+}
+function scopeLoopDir(workdir, home) {
+	return path.resolve(expandHome(workdir, home));
+}
+/**
+* Partition a machine's loops into the ones rooted at (or under) `cwd` — the
+* directory-scoped ambient context and a count of the rest. With no cwd
+* (or none matching), ALL loops are "here" (elsewhere 0): a home run from an
+* unrelated directory still shows the whole machine rather than nothing.
+*/
+function scopeLoopsByCwd(loops, cwd, home) {
+	if (!cwd) return {
+		here: loops,
+		elsewhere: 0
+	};
+	const here = path.resolve(cwd);
+	const matched = loops.filter((l) => {
+		const dir = scopeLoopDir(l.workdir, home);
+		return here === dir || here.startsWith(dir + path.sep);
+	});
+	if (matched.length === 0) return {
+		here: loops,
+		elsewhere: 0
+	};
+	return {
+		here: matched,
+		elsewhere: loops.length - matched.length
+	};
+}
+async function recentMachineRuns(loops, n) {
+	const rows = [];
+	for (const l of loops) for (const r of await listRuns(l.id, n)) rows.push({
+		ts: r.ts,
+		loop: l.name,
+		result: runResultToken(r)
+	});
+	rows.sort((a, b) => a.ts < b.ts ? 1 : a.ts > b.ts ? -1 : 0);
+	return rows.slice(0, n);
+}
+/** The device home: `bin:`/`description:`/`machine:` header, the cwd-scoped
+*  loop list, recent runs, and a `help[]`. `presence` null ⇒ the machine is not
+*  registered → a DEFINITIVE "not connected" state (never empty, never an error). */
+function renderHomeText(ctx, presence, here, elsewhere, recent) {
+	const machineLine = presence === null ? "machine: not connected — run `pievo daemon connect`" : `machine: ${[
+		presence,
+		ctx.pid ? `daemon pid ${ctx.pid}` : null,
+		ctx.server
+	].filter(Boolean).join(" · ")}`;
+	const binLineText = ctx.bin ? kvLine("bin", ctx.bin) : "bin: (not on PATH — run `npm install -g @kky42/pievo@latest`)";
+	if (presence === null) return doc(binLineText, kvLine("description", HOME_DESCRIPTION), machineLine, helpBlock(["Run `pievo daemon connect --server-url <url> --connect-key <dk_…>` to connect this machine", "Run `pievo --help` to see every command"]));
+	const loopsName = elsewhere > 0 ? "loops here" : "loops";
+	const loopsBlock = here.length ? listBlock(loopsName, [
+		"name",
+		"cron",
+		"enabled",
+		"nextFire",
+		"lastResult"
+	], here.map((l) => [
+		l.name,
+		l.cron,
+		l.enabled ? "on" : "paused",
+		l.nextFire ? fmtTime(l.nextFire) : null,
+		l.lastResult
+	])) : emptyList(loopsName);
+	const recentBlock = recent.length ? listBlock("recent", [
+		"ts",
+		"loop",
+		"result"
+	], recent.map((r) => [
+		fmtTime(r.ts),
+		r.loop,
+		r.result
+	])) : null;
+	return doc(binLineText, kvLine("description", HOME_DESCRIPTION), machineLine, loopsBlock, elsewhere > 0 ? `loops elsewhere: ${elsewhere} more on this machine` : null, recentBlock, helpBlock([
+		"Run `pievo loops` to list every loop on this machine",
+		"Run `pievo show <id>` to inspect a loop, `pievo log <id>` for its runs",
+		"Run `pievo new --json '{...}'` to create a loop"
+	]));
+}
+function reportStatus(s) {
+	return s === "keep" || s === "no-change" || s === "block" ? s : void 0;
+}
+/** Tiny flag parser: `--k v` pairs, bare `--flag` → true, first positional under `_`.
+*  Every key/value is NUL-stripped at this wire boundary before validation or
+*  persistence because Postgres text rejects NUL. */
+function parseFlags(args) {
+	const out = {};
+	for (let i = 0; i < args.length; i++) {
+		const a = args[i];
+		if (a.startsWith("--")) {
+			const key = stripNul(a.slice(2));
+			const next = args[i + 1];
+			if (next !== void 0 && !next.startsWith("--")) {
+				out[key] = stripNul(next);
+				i++;
+			} else out[key] = true;
+		} else if (out["_"] === void 0) out["_"] = stripNul(a);
+	}
+	return out;
+}
+var log = logger.child({ mod: "scheduler" });
+var MAX_TIMER_MS = 2147483647;
+var DUE_RETRY_MS = 2e4;
+/** Thin timer layer over durable schedule facts. All state transitions live in
+* the store; this class only arms hints and wakes parked machine polls. */
+var Scheduler = class {
+	dispatcher;
+	timers = /* @__PURE__ */ new Map();
+	constructor(dispatcher) {
+		this.dispatcher = dispatcher;
+	}
+	async start(signal) {
+		await initializeCronCadence();
+		const all = await listLoops();
+		for (const loop of all) this.addLoop(loop);
+		await this.advanceDueSchedules();
+		signal.addEventListener("abort", () => this.stopAll(), { once: true });
+		log.info({
+			loops: all.length,
+			timers: this.timers.size
+		}, "scheduler started");
+	}
+	static nextRun(expr) {
+		const probe = new E(expr, { paused: true });
+		try {
+			const next = probe.nextRun();
+			if (!next) throw new Error(`cron expression never fires again: ${expr}`);
+			return next;
+		} finally {
+			probe.stop();
+		}
+	}
+	/** Re-arm this loop's next durable fact. Queue rows are never changed here. */
+	addLoop(loop) {
+		this.armLoop(loop, false);
+	}
+	armLoop(loop, retryDue) {
+		const old = this.timers.get(loop.id);
+		if (old) clearTimeout(old);
+		this.timers.delete(loop.id);
+		if (!loop.enabled) return;
+		const targets = [loop.nextCadenceAt, loop.nextRunAt].filter((v) => v != null).map(Date.parse).filter(Number.isFinite);
+		if (!targets.length) return;
+		const rawDelay = Math.min(...targets) - Date.now();
+		const timer = setTimeout(() => void this.fire(loop.id), rawDelay <= 0 ? retryDue ? DUE_RETRY_MS : 0 : Math.min(rawDelay, MAX_TIMER_MS));
+		timer.unref?.();
+		this.timers.set(loop.id, timer);
+	}
+	removeLoop(id) {
+		const timer = this.timers.get(id);
+		if (timer) clearTimeout(timer);
+		this.timers.delete(id);
+	}
+	runNow(id) {
+		return this.enqueue(id, { requestedBy: "owner" });
+	}
+	enqueueInitialExec(id) {
+		return this.enqueue(id, { requestedBy: "system" });
+	}
+	async advanceDueSchedules(machineId, loopId) {
+		const advanced = await advanceDueSchedules((/* @__PURE__ */ new Date()).toISOString(), {
+			machineId,
+			loopId
+		});
+		for (const item of advanced) {
+			this.addLoop(item.loop);
+			if (item.run) await this.wake(item.loop, item.run);
+		}
+		return advanced;
+	}
+	async enqueue(id, request) {
+		const result = await enqueueRun(id, request);
+		if ("run" in result) {
+			const loop = await getLoop(id);
+			if (loop) await this.wake(loop, result.run);
+		}
+		return result;
+	}
+	async fire(loopId) {
+		this.timers.delete(loopId);
+		try {
+			await this.advanceDueSchedules(void 0, loopId);
+		} catch (err) {
+			log.warn({
+				loopId,
+				err: msg(err)
+			}, "schedule hint failed; polling will recover");
+		} finally {
+			const loop = await getLoop(loopId).catch(() => void 0);
+			if (loop && !this.timers.has(loopId)) this.armLoop(loop, true);
+		}
+	}
+	async wake(loop, run) {
+		try {
+			await this.dispatcher.dispatch(loop, run);
+		} catch (err) {
+			log.warn({
+				loopId: loop.id,
+				runId: run.id,
+				err: msg(err)
+			}, "queue wake failed; polling will recover");
+		}
+	}
+	stopAll() {
+		for (const timer of this.timers.values()) clearTimeout(timer);
+		this.timers.clear();
+		log.info("scheduler stopped");
+	}
+};
+function msg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* DB watchdog — the real auto-recovery backstop for a wedged postgres-js pool.
+*
+* BACKGROUND (2026-07-12 outage, twice in one day): the runtime pool against the
+* Supabase transaction pooler wedged — every connection stuck on a query that
+* never returned, so `/api/health/db`'s `select 1` queued behind them forever and
+* the server stopped sending response headers. Fly's health check went `critical`,
+* which only PULLS the machine from load balancing (a well-known Fly footgun:
+* failing `[http_service.checks]` do NOT restart the VM — only a process EXIT
+* triggers `restart.policy = "on-failure"`). Result: ~9h fully down with no
+* auto-recovery until a manual `fly machine restart`. The pool's own self-healing
+* (`max_lifetime`/`statement_timeout`, `db/index.ts`) can't cover a busy-wedged
+* connection or a dead socket that never errors.
+*
+* This watchdog closes that gap: it pings `select 1` on a fixed cadence under a
+* HARD client-side deadline (a hung ping counts as a failure, since the underlying
+* query can't be canceled). After N consecutive failures it exits the process, so
+* Fly restarts the machine with a fresh pool — turning a multi-hour hang into a
+* ~1-2min self-heal. A single healthy ping resets the streak, so a transient blip
+* never restarts the box.
+*
+* Pure + injectable: `makeDbWatchdog` takes the probe / exit / clock as deps so the
+* decision logic is unit-tested with no real DB, timers, or `process.exit`.
+*/
+/** Reject if `p` hasn't settled within `ms`. The underlying promise keeps running
+*  (we can't cancel a wedged query) — bounded by the exit after `failureThreshold`. */
+function withDeadline(p, ms, setTimer, clearTimer) {
+	return new Promise((resolve, reject) => {
+		const h = setTimer(() => reject(/* @__PURE__ */ new Error(`db ping timed out after ${ms}ms`)), ms);
+		p.then((v) => {
+			clearTimer(h);
+			resolve(v);
+		}, (e) => {
+			clearTimer(h);
+			reject(e instanceof Error ? e : new Error(String(e)));
+		});
+	});
+}
+function makeDbWatchdog(deps) {
+	const { probe, exit, timeoutMs, failureThreshold, setTimer = (fn, ms) => setTimeout(fn, ms), clearTimer = (h) => clearTimeout(h), log = logger } = deps;
+	let consecutive = 0;
+	let running = false;
+	let done = false;
+	async function tick() {
+		if (running || done) return;
+		running = true;
+		try {
+			await withDeadline(Promise.resolve().then(probe), timeoutMs, setTimer, clearTimer);
+			consecutive = 0;
+		} catch (err) {
+			consecutive += 1;
+			log.warn({
+				consecutive,
+				failureThreshold,
+				err: String(err)
+			}, "db watchdog: liveness ping failed");
+			if (consecutive >= failureThreshold) {
+				done = true;
+				log.error({ consecutive }, "db watchdog: database unreachable for too long — exiting so the platform restarts with a fresh pool");
+				exit(1);
+			}
+		} finally {
+			running = false;
+		}
+	}
+	return {
+		tick,
+		failures: () => consecutive
+	};
+}
+/**
+* Start the watchdog on a repeating interval. Returns a stop function (cleared on
+* the boot AbortController). The interval is `unref`'d so it never keeps the
+* process alive on its own.
+*/
+function startDbWatchdog(deps) {
+	const wd = makeDbWatchdog(deps);
+	const handle = setInterval(() => void wd.tick(), deps.intervalMs);
+	handle.unref?.();
+	return () => clearInterval(handle);
+}
+/**
+* Server boot — idempotent one-time init of the in-process backend: apply
+* migrations, wire the machine gateway's dispatcher into the Scheduler, start
+* the Scheduler + an offline-sweep interval. Guarded on `globalThis` so it
+* survives dev HMR and runs at most once per process. Call `ensureServer()`
+* from any server-side entry (the standalone machine server / TanStack server
+* fns); the first call boots, the rest share the same instance.
+*/
+var boot_exports = /* @__PURE__ */ __exportAll$1({
+	ensureServer: () => ensureServer,
+	getArtifactSync: () => getArtifactSync,
+	getCliGateway: () => getCliGateway,
+	getGateway: () => getGateway
+});
+var g = globalThis;
+function ensureServer() {
+	if (g.__pievoBooted) return g.__pievoBooted;
+	const p = boot();
+	g.__pievoBooted = p;
+	p.catch(() => {
+		if (g.__pievoBooted === p) g.__pievoBooted = void 0;
+	});
+	return p;
+}
+async function boot() {
+	loginGateEnabled();
+	await runMigrations();
+	await repairTerminalRunLeases();
+	const abort = new AbortController();
+	let closePromise;
+	const close = () => closePromise ??= closeClient();
+	abort.signal.addEventListener("abort", () => void close(), { once: true });
+	const shutdown = async () => {
+		abort.abort();
+		await close();
+	};
+	let gateway;
+	const scheduler = new Scheduler({ dispatch: (loop) => gateway.dispatcher.dispatch(loop) });
+	const blobStore = createBlobStore();
+	gateway = new MachineGateway(scheduler, blobStore);
+	const artifactSync = new ArtifactSync(blobStore);
+	const cliGateway = new CliGateway(gateway);
+	await scheduler.start(abort.signal);
+	const sweep = setInterval(() => void gateway.sweep().catch((err) => logger.error({ err: String(err) }, "sweep tick failed")), ONLINE_TTL_MS);
+	sweep.unref?.();
+	abort.signal.addEventListener("abort", () => clearInterval(sweep), { once: true });
+	const gc = setInterval(() => void gateway.maintainStorage().catch((err) => logger.error({ err: String(err) }, "gc tick failed")), gcIntervalMs());
+	gc.unref?.();
+	abort.signal.addEventListener("abort", () => clearInterval(gc), { once: true });
+	if (dbWatchdogEnabled()) {
+		const intervalMs = dbWatchdogIntervalMs();
+		const timeoutMs = dbWatchdogTimeoutMs();
+		const failureThreshold = dbWatchdogFailureThreshold();
+		logger.info({
+			intervalMs,
+			timeoutMs,
+			failureThreshold
+		}, "db watchdog: armed");
+		const stopWatchdog = startDbWatchdog({
+			probe: () => db.execute(sql`select 1`),
+			exit: (code) => process.exit(code),
+			intervalMs,
+			timeoutMs,
+			failureThreshold
+		});
+		abort.signal.addEventListener("abort", () => stopWatchdog(), { once: true });
+	}
+	logger.info("pievo server booted");
+	return {
+		scheduler,
+		gateway,
+		artifactSync,
+		cliGateway,
+		abort,
+		shutdown
+	};
+}
+async function getGateway() {
+	return (await ensureServer()).gateway;
+}
+async function getArtifactSync() {
+	return (await ensureServer()).artifactSync;
+}
+async function getCliGateway() {
+	return (await ensureServer()).cliGateway;
+}
+//#endregion
+export { daemonNeedsUpdate as a, readByteBody as c, statusDefinitionsFromLoop as d, validOptionalPollString as f, validateLoopEdit as h, boot_C472kLwY_exports as i, readJsonBody as l, validPollWireId as m, MIN_DAEMON_VERSION as n, ensureServer as o, validPollCurrentRun as p, POLL_HTTP_BODY_FIELDS as r, getArtifactSync as s, MACHINE_BODY_CAP as t, scheduleFromLoop as u };