@kky42/pievo-server 2.4.12 → 2.4.14

package/.output/server/_ssr/loopTags-CXx5UdGf.mjs

@@ -0,0 +1,3356 @@
+import { o as __toESM } from "../_runtime.mjs";
+import { t as Ve } from "../_libs/electric-sql__pglite.mjs";
+import { A as boolean, C as notInArray, D as text, E as timestamp, O as jsonb, S as ne, T as pgTable, _ as isNotNull, a as uniqueIndex, b as lt, c as relations, d as and, f as eq, g as inArray, i as index, j as sql, k as integer, l as asc, n as src_default, o as check, p as gt, r as drizzle$1, t as drizzle, u as desc, v as isNull, w as or } from "../_libs/drizzle-orm+postgres.mjs";
+import { t as require_pino } from "../_libs/pino+[...].mjs";
+import { t as require_pino_pretty } from "../_libs/pino-pretty+[...].mjs";
+import { t as E } from "../_libs/croner.mjs";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import os from "node:os";
+//#region node_modules/.nitro/vite/services/ssr/assets/loopTags-CXx5UdGf.js
+var import_pino = /* @__PURE__ */ __toESM(require_pino());
+var import_pino_pretty = /* @__PURE__ */ __toESM(require_pino_pretty());
+function defineErrorCodes(codes) {
+	return Object.fromEntries(Object.entries(codes).map(([key, value]) => [key, {
+		code: key,
+		message: value,
+		toString: () => key
+	}]));
+}
+var BASE_ERROR_CODES = defineErrorCodes({
+	USER_NOT_FOUND: "User not found",
+	FAILED_TO_CREATE_USER: "Failed to create user",
+	FAILED_TO_CREATE_SESSION: "Failed to create session",
+	FAILED_TO_UPDATE_USER: "Failed to update user",
+	FAILED_TO_GET_SESSION: "Failed to get session",
+	INVALID_PASSWORD: "Invalid password",
+	INVALID_EMAIL: "Invalid email",
+	INVALID_EMAIL_OR_PASSWORD: "Invalid email or password",
+	INVALID_USER: "Invalid user",
+	SOCIAL_ACCOUNT_ALREADY_LINKED: "Social account already linked",
+	PROVIDER_NOT_FOUND: "Provider not found",
+	INVALID_TOKEN: "Invalid token",
+	TOKEN_EXPIRED: "Token expired",
+	ID_TOKEN_NOT_SUPPORTED: "id_token not supported",
+	FAILED_TO_GET_USER_INFO: "Failed to get user info",
+	USER_EMAIL_NOT_FOUND: "User email not found",
+	EMAIL_NOT_VERIFIED: "Email not verified",
+	PASSWORD_TOO_SHORT: "Password too short",
+	PASSWORD_TOO_LONG: "Password too long",
+	USER_ALREADY_EXISTS: "User already exists.",
+	USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: "User already exists. Use another email.",
+	EMAIL_CAN_NOT_BE_UPDATED: "Email can not be updated",
+	CHANGE_EMAIL_DISABLED: "Change email is disabled",
+	CREDENTIAL_ACCOUNT_NOT_FOUND: "Credential account not found",
+	SESSION_EXPIRED: "Session expired. Re-authenticate to perform this action.",
+	FAILED_TO_UNLINK_LAST_ACCOUNT: "You can't unlink your last account",
+	ACCOUNT_NOT_FOUND: "Account not found",
+	USER_ALREADY_HAS_PASSWORD: "User already has a password. Provide that to delete the account.",
+	CROSS_SITE_NAVIGATION_LOGIN_BLOCKED: "Cross-site navigation login blocked. This request appears to be a CSRF attack.",
+	VERIFICATION_EMAIL_NOT_ENABLED: "Verification email isn't enabled",
+	EMAIL_ALREADY_VERIFIED: "Email is already verified",
+	EMAIL_MISMATCH: "Email mismatch",
+	SESSION_NOT_FRESH: "Session is not fresh",
+	LINKED_ACCOUNT_ALREADY_EXISTS: "Linked account already exists",
+	INVALID_ORIGIN: "Invalid origin",
+	INVALID_CALLBACK_URL: "Invalid callbackURL",
+	INVALID_REDIRECT_URL: "Invalid redirectURL",
+	INVALID_ERROR_CALLBACK_URL: "Invalid errorCallbackURL",
+	INVALID_NEW_USER_CALLBACK_URL: "Invalid newUserCallbackURL",
+	MISSING_OR_NULL_ORIGIN: "Missing or null Origin",
+	CALLBACK_URL_REQUIRED: "callbackURL is required",
+	FAILED_TO_CREATE_VERIFICATION: "Unable to create verification",
+	FIELD_NOT_ALLOWED: "Field not allowed to be set",
+	ASYNC_VALIDATION_NOT_SUPPORTED: "Async validation is not supported",
+	VALIDATION_ERROR: "Validation Error",
+	MISSING_FIELD: "Field is required",
+	METHOD_NOT_ALLOWED_DEFER_SESSION_REQUIRED: "POST method requires deferSessionRefresh to be enabled in session config",
+	BODY_MUST_BE_AN_OBJECT: "Body must be an object",
+	PASSWORD_ALREADY_SET: "User already has a password set"
+});
+function isErrorStackTraceLimitWritable() {
+	const desc = Object.getOwnPropertyDescriptor(Error, "stackTraceLimit");
+	if (desc === void 0) return Object.isExtensible(Error);
+	return Object.prototype.hasOwnProperty.call(desc, "writable") ? desc.writable : desc.set !== void 0;
+}
+/**
+* Hide internal stack frames from the error stack trace.
+*/
+function hideInternalStackFrames(stack) {
+	const lines = stack.split("\n    at ");
+	if (lines.length <= 1) return stack;
+	lines.splice(1, 1);
+	return lines.join("\n    at ");
+}
+/**
+* Creates a custom error class that hides stack frames.
+*/
+function makeErrorForHideStackFrame(Base, clazz) {
+	class HideStackFramesError extends Base {
+		#hiddenStack;
+		constructor(...args) {
+			if (isErrorStackTraceLimitWritable()) {
+				const limit = Error.stackTraceLimit;
+				Error.stackTraceLimit = 0;
+				super(...args);
+				Error.stackTraceLimit = limit;
+			} else super(...args);
+			const stack = (/* @__PURE__ */ new Error()).stack;
+			if (stack) this.#hiddenStack = hideInternalStackFrames(stack.replace(/^Error/, this.name));
+		}
+		get errorStack() {
+			return this.#hiddenStack;
+		}
+	}
+	Object.defineProperty(HideStackFramesError.prototype, "constructor", {
+		get() {
+			return clazz;
+		},
+		enumerable: false,
+		configurable: true
+	});
+	return HideStackFramesError;
+}
+var statusCodes = {
+	OK: 200,
+	CREATED: 201,
+	ACCEPTED: 202,
+	NO_CONTENT: 204,
+	MULTIPLE_CHOICES: 300,
+	MOVED_PERMANENTLY: 301,
+	FOUND: 302,
+	SEE_OTHER: 303,
+	NOT_MODIFIED: 304,
+	TEMPORARY_REDIRECT: 307,
+	BAD_REQUEST: 400,
+	UNAUTHORIZED: 401,
+	PAYMENT_REQUIRED: 402,
+	FORBIDDEN: 403,
+	NOT_FOUND: 404,
+	METHOD_NOT_ALLOWED: 405,
+	NOT_ACCEPTABLE: 406,
+	PROXY_AUTHENTICATION_REQUIRED: 407,
+	REQUEST_TIMEOUT: 408,
+	CONFLICT: 409,
+	GONE: 410,
+	LENGTH_REQUIRED: 411,
+	PRECONDITION_FAILED: 412,
+	PAYLOAD_TOO_LARGE: 413,
+	URI_TOO_LONG: 414,
+	UNSUPPORTED_MEDIA_TYPE: 415,
+	RANGE_NOT_SATISFIABLE: 416,
+	EXPECTATION_FAILED: 417,
+	"I'M_A_TEAPOT": 418,
+	MISDIRECTED_REQUEST: 421,
+	UNPROCESSABLE_ENTITY: 422,
+	LOCKED: 423,
+	FAILED_DEPENDENCY: 424,
+	TOO_EARLY: 425,
+	UPGRADE_REQUIRED: 426,
+	PRECONDITION_REQUIRED: 428,
+	TOO_MANY_REQUESTS: 429,
+	REQUEST_HEADER_FIELDS_TOO_LARGE: 431,
+	UNAVAILABLE_FOR_LEGAL_REASONS: 451,
+	INTERNAL_SERVER_ERROR: 500,
+	NOT_IMPLEMENTED: 501,
+	BAD_GATEWAY: 502,
+	SERVICE_UNAVAILABLE: 503,
+	GATEWAY_TIMEOUT: 504,
+	HTTP_VERSION_NOT_SUPPORTED: 505,
+	VARIANT_ALSO_NEGOTIATES: 506,
+	INSUFFICIENT_STORAGE: 507,
+	LOOP_DETECTED: 508,
+	NOT_EXTENDED: 510,
+	NETWORK_AUTHENTICATION_REQUIRED: 511
+};
+var InternalAPIError = class extends Error {
+	constructor(status = "INTERNAL_SERVER_ERROR", body = void 0, headers = {}, statusCode = typeof status === "number" ? status : statusCodes[status]) {
+		super(body?.message, body?.cause ? { cause: body.cause } : void 0);
+		this.status = status;
+		this.body = body;
+		this.headers = headers;
+		this.statusCode = statusCode;
+		this.name = "APIError";
+		this.status = status;
+		this.headers = headers;
+		this.statusCode = statusCode;
+		this.body = body;
+	}
+};
+var ValidationError$1 = class extends InternalAPIError {
+	constructor(message, issues) {
+		super(400, {
+			message,
+			code: "VALIDATION_ERROR"
+		});
+		this.message = message;
+		this.issues = issues;
+		this.issues = issues;
+	}
+};
+var BetterCallError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "BetterCallError";
+	}
+};
+var kAPIErrorHeaderSymbol = Symbol.for("better-call:api-error-headers");
+var APIError$1 = makeErrorForHideStackFrame(InternalAPIError, Error);
+var BetterAuthError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "BetterAuthError";
+		this.message = message;
+		this.stack = "";
+	}
+};
+var APIError = class APIError extends APIError$1 {
+	constructor(...args) {
+		super(...args);
+	}
+	static fromStatus(status, body) {
+		return new APIError(status, body);
+	}
+	static from(status, error) {
+		return new APIError(status, {
+			message: error.message,
+			code: error.code
+		});
+	}
+};
+var _envShim = Object.create(null);
+var _getEnv = (useShim) => globalThis.process?.env || globalThis.Deno?.env.toObject() || globalThis.__env__ || (useShim ? _envShim : globalThis);
+var env = new Proxy(_envShim, {
+	get(_, prop) {
+		return _getEnv()[prop] ?? _envShim[prop];
+	},
+	has(_, prop) {
+		return prop in _getEnv() || prop in _envShim;
+	},
+	set(_, prop, value) {
+		const env = _getEnv(true);
+		env[prop] = value;
+		return true;
+	},
+	deleteProperty(_, prop) {
+		if (!prop) return false;
+		const env = _getEnv(true);
+		delete env[prop];
+		return true;
+	},
+	ownKeys() {
+		const env = _getEnv(true);
+		return Object.keys(env);
+	}
+});
+function toBoolean(val) {
+	return val ? val !== "false" : false;
+}
+var nodeENV = env.NODE_ENV ?? "";
+/** Detect if `NODE_ENV` environment variable is `production` */
+var isProduction = nodeENV === "production";
+/** Detect if `NODE_ENV` environment variable is `dev` or `development` */
+var isDevelopment = () => nodeENV === "dev" || nodeENV === "development";
+/** Detect if `NODE_ENV` environment variable is `test` */
+var isTest = () => nodeENV === "test" || toBoolean(env.TEST);
+/**
+* Get environment variable with fallback
+*/
+function getEnvVar(key, fallback) {
+	if (typeof process !== "undefined" && process.env) return process.env[key] ?? fallback;
+	if (typeof Deno !== "undefined") return Deno.env.get(key) ?? fallback;
+	if (typeof Bun !== "undefined") return Bun.env[key] ?? fallback;
+	return fallback;
+}
+/**
+* Get boolean environment variable
+*/
+function getBooleanEnvVar(key, fallback = true) {
+	const value = getEnvVar(key);
+	if (!value) return fallback;
+	return value !== "0" && value.toLowerCase() !== "false" && value !== "";
+}
+/**
+* Common environment variables used in Better Auth
+*/
+var ENV = Object.freeze({
+	get BETTER_AUTH_SECRET() {
+		return getEnvVar("BETTER_AUTH_SECRET");
+	},
+	get AUTH_SECRET() {
+		return getEnvVar("AUTH_SECRET");
+	},
+	get BETTER_AUTH_TELEMETRY() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY");
+	},
+	get BETTER_AUTH_TELEMETRY_ID() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ID");
+	},
+	get NODE_ENV() {
+		return getEnvVar("NODE_ENV", "development");
+	},
+	get PACKAGE_VERSION() {
+		return getEnvVar("PACKAGE_VERSION", "0.0.0");
+	},
+	get BETTER_AUTH_TELEMETRY_ENDPOINT() {
+		return getEnvVar("BETTER_AUTH_TELEMETRY_ENDPOINT", "");
+	}
+});
+function capitalizeFirstLetter(str) {
+	return str.charAt(0).toUpperCase() + str.slice(1);
+}
+var WORD_PATTERN = /[\p{Ll}\d]+|\p{Lu}+(?!\p{Ll})|\p{Lu}[\p{Ll}\d]+|\p{Lo}+/gu;
+var APOSTROPHE_PATTERN = /['\u2019]/g;
+function splitWords(input) {
+	return input.replace(APOSTROPHE_PATTERN, "").match(WORD_PATTERN) ?? [];
+}
+function toKebabCase(input) {
+	return splitWords(input).map((word) => word.toLowerCase()).join("-");
+}
+/**
+* Escapes a character if it has a special meaning in regular expressions
+* and returns the character as is if it doesn't
+*/
+function escapeRegExpChar(char) {
+	if (char === "-" || char === "^" || char === "$" || char === "+" || char === "." || char === "(" || char === ")" || char === "|" || char === "[" || char === "]" || char === "{" || char === "}" || char === "*" || char === "?" || char === "\\") return `\\${char}`;
+	else return char;
+}
+/**
+* Escapes all characters in a given string that have a special meaning in regular expressions
+*/
+function escapeRegExpString(str) {
+	let result = "";
+	for (let i = 0; i < str.length; i++) result += escapeRegExpChar(str[i]);
+	return result;
+}
+/**
+* Transforms one or more glob patterns into a RegExp pattern
+*/
+function transform(pattern, separator = true) {
+	if (Array.isArray(pattern)) return `(?:${pattern.map((p) => `^${transform(p, separator)}$`).join("|")})`;
+	let separatorSplitter = "";
+	let separatorMatcher = "";
+	let wildcard = ".";
+	if (separator === true) {
+		separatorSplitter = "/";
+		separatorMatcher = "[/\\\\]";
+		wildcard = "[^/\\\\]";
+	} else if (separator) {
+		separatorSplitter = separator;
+		separatorMatcher = escapeRegExpString(separatorSplitter);
+		if (separatorMatcher.length > 1) {
+			separatorMatcher = `(?:${separatorMatcher})`;
+			wildcard = `((?!${separatorMatcher}).)`;
+		} else wildcard = `[^${separatorMatcher}]`;
+	}
+	const requiredSeparator = separator ? `${separatorMatcher}+?` : "";
+	const optionalSeparator = separator ? `${separatorMatcher}*?` : "";
+	const segments = separator ? pattern.split(separatorSplitter) : [pattern];
+	let result = "";
+	for (let s = 0; s < segments.length; s++) {
+		const segment = segments[s];
+		const nextSegment = segments[s + 1];
+		let currentSeparator = "";
+		if (!segment && s > 0) continue;
+		if (separator) if (s === segments.length - 1) currentSeparator = optionalSeparator;
+		else if (nextSegment !== "**") currentSeparator = requiredSeparator;
+		else currentSeparator = "";
+		if (separator && segment === "**") {
+			if (currentSeparator) {
+				result += s === 0 ? "" : currentSeparator;
+				result += `(?:${wildcard}*?${currentSeparator})*?`;
+			}
+			continue;
+		}
+		for (let c = 0; c < segment.length; c++) {
+			const char = segment[c];
+			if (char === "\\") {
+				if (c < segment.length - 1) {
+					result += escapeRegExpChar(segment[c + 1]);
+					c++;
+				}
+			} else if (char === "?") result += wildcard;
+			else if (char === "*") result += `${wildcard}*?`;
+			else result += escapeRegExpChar(char);
+		}
+		result += currentSeparator;
+	}
+	return result;
+}
+function isMatch(regexp, sample) {
+	if (typeof sample !== "string") throw new TypeError(`Sample must be a string, but ${typeof sample} given`);
+	return regexp.test(sample);
+}
+/**
+* Compiles one or more glob patterns into a RegExp and returns an isMatch function.
+* The isMatch function takes a sample string as its only argument and returns `true`
+* if the string matches the pattern(s).
+*
+* ```js
+* wildcardMatch('src/*.js')('src/index.js') //=> true
+* ```
+*
+* ```js
+* const isMatch = wildcardMatch('*.example.com', '.')
+* isMatch('foo.example.com') //=> true
+* isMatch('foo.bar.com') //=> false
+* ```
+*/
+function wildcardMatch(pattern, options) {
+	if (typeof pattern !== "string" && !Array.isArray(pattern)) throw new TypeError(`The first argument must be a single pattern string or an array of patterns, but ${typeof pattern} given`);
+	if (typeof options === "string" || typeof options === "boolean") options = { separator: options };
+	if (arguments.length === 2 && !(typeof options === "undefined" || typeof options === "object" && options !== null && !Array.isArray(options))) throw new TypeError(`The second argument must be an options object or a string/boolean separator, but ${typeof options} given`);
+	options = options || {};
+	if (options.separator === "\\") throw new Error("\\ is not a valid separator because it is used for escaping. Try setting the separator to `true` instead");
+	const regexpPattern = transform(pattern, options.separator);
+	const regexp = new RegExp(`^${regexpPattern}$`, options.flags);
+	const fn = isMatch.bind(null, regexp);
+	fn.options = options;
+	fn.pattern = pattern;
+	fn.regexp = regexp;
+	return fn;
+}
+var SLASH_CHAR_CODE = "/".charCodeAt(0);
+/**
+* Minimal loopback check for dev scheme inference only. Reachable from
+* `client/config.ts` via `getBaseURL`, so we MUST NOT import the full
+* `@better-auth/core/utils/host` classifier here: its `utils/ip` dependency
+* on zod would leak into the client bundle (see `e2e/smoke/test/vite.spec.ts`).
+*
+* Server-side SSRF/loopback checks (oauth redirect matching, trusted-origin
+* resolution, electron fetch gate) continue to use the authoritative
+* `isLoopbackHost` from `@better-auth/core/utils/host`. This helper's only
+* job is picking `http` vs `https` for dev ergonomics.
+*/
+function isLoopbackForDevScheme(host) {
+	const hostname = host.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").toLowerCase();
+	return hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || hostname.startsWith("127.");
+}
+function trimTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) end--;
+	return end === value.length ? value : value.slice(0, end);
+}
+function checkHasPath(url) {
+	try {
+		return (trimTrailingSlashes(new URL(url).pathname) || "/") !== "/";
+	} catch {
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`);
+	}
+}
+function assertHasProtocol(url) {
+	try {
+		const parsedUrl = new URL(url);
+		if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new BetterAuthError(`Invalid base URL: ${url}. URL must include 'http://' or 'https://'`);
+	} catch (error) {
+		if (error instanceof BetterAuthError) throw error;
+		throw new BetterAuthError(`Invalid base URL: ${url}. Please provide a valid base URL.`, { cause: error });
+	}
+}
+function withPath(url, path = "/api/auth") {
+	assertHasProtocol(url);
+	if (checkHasPath(url)) return url;
+	const trimmedUrl = trimTrailingSlashes(url);
+	if (!path || path === "/") return trimmedUrl;
+	path = path.startsWith("/") ? path : `/${path}`;
+	return `${trimmedUrl}${path}`;
+}
+function validateProxyHeader(header, type) {
+	if (!header || header.trim() === "") return false;
+	if (type === "proto") return header === "http" || header === "https";
+	if (type === "host") {
+		if ([
+			/\.\./,
+			/\0/,
+			/[\s]/,
+			/^[.]/,
+			/[<>'"]/,
+			/javascript:/i,
+			/file:/i,
+			/data:/i
+		].some((pattern) => pattern.test(header))) return false;
+		return /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(:[0-9]{1,5})?$/.test(header) || /^(\d{1,3}\.){3}\d{1,3}(:[0-9]{1,5})?$/.test(header) || /^\[[0-9a-fA-F:]+\](:[0-9]{1,5})?$/.test(header) || /^localhost(:[0-9]{1,5})?$/i.test(header);
+	}
+	return false;
+}
+function getBaseURL(url, path, request, loadEnv, trustedProxyHeaders) {
+	if (url) return withPath(url, path);
+	if (loadEnv !== false) {
+		const fromEnv = env.BETTER_AUTH_URL || env.NEXT_PUBLIC_BETTER_AUTH_URL || env.PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_BETTER_AUTH_URL || env.NUXT_PUBLIC_AUTH_URL || (env.BASE_URL !== "/" ? env.BASE_URL : void 0);
+		if (fromEnv) return withPath(fromEnv, path);
+	}
+	const fromRequest = request?.headers.get("x-forwarded-host");
+	const fromRequestProto = request?.headers.get("x-forwarded-proto");
+	if (fromRequest && fromRequestProto && trustedProxyHeaders) {
+		if (validateProxyHeader(fromRequestProto, "proto") && validateProxyHeader(fromRequest, "host")) try {
+			return withPath(`${fromRequestProto}://${fromRequest}`, path);
+		} catch (_error) {}
+	}
+	if (request) {
+		const url = getOrigin(request.url);
+		if (!url) throw new BetterAuthError("Could not get origin from request. Please provide a valid base URL.");
+		return withPath(url, path);
+	}
+	if (typeof window !== "undefined" && window.location) return withPath(window.location.origin, path);
+}
+function getOrigin(url) {
+	try {
+		const parsedUrl = new URL(url);
+		return parsedUrl.origin === "null" ? null : parsedUrl.origin;
+	} catch {
+		return null;
+	}
+}
+function getProtocol(url) {
+	try {
+		return new URL(url).protocol;
+	} catch {
+		return null;
+	}
+}
+function getHost(url) {
+	try {
+		return new URL(url).host;
+	} catch {
+		return null;
+	}
+}
+/**
+* Checks if the baseURL config is a dynamic config object
+*/
+function isDynamicBaseURLConfig(config) {
+	return typeof config === "object" && config !== null && "allowedHosts" in config && Array.isArray(config.allowedHosts);
+}
+/**
+* Check if a value is a `Request`
+* - `instanceof`: works for native Request instances
+* - `toString`: handles where instanceof check fails but the object is still a
+*   valid Request (e.g. cross-realm, polyfills). Paired with a shape check so
+*   an object that only spoofs `Symbol.toStringTag` without the real shape is
+*   rejected before downstream code tries to read `.headers` / `.url`.
+*
+* @param value The value to check
+* @returns `true` if the value is a Request instance
+*/
+function isRequestLike(value) {
+	if (value instanceof Request) return true;
+	if (typeof value !== "object" || value === null || Object.prototype.toString.call(value) !== "[object Request]") return false;
+	const v = value;
+	return typeof v.url === "string" && typeof v.headers === "object" && v.headers !== null && typeof v.headers.get === "function";
+}
+/**
+* Extracts the host from a `Request` or `Headers`.
+* Honors `x-forwarded-host` only when `trustedProxyHeaders` is enabled,
+* then falls back to the `host` header and finally the request URL.
+*/
+function getHostFromSource(source, trustedProxyHeaders) {
+	const headers = isRequestLike(source) ? source.headers : source;
+	if (trustedProxyHeaders) {
+		const forwardedHost = headers.get("x-forwarded-host");
+		if (forwardedHost && validateProxyHeader(forwardedHost, "host")) return forwardedHost;
+	}
+	const host = headers.get("host");
+	if (host && validateProxyHeader(host, "host")) return host;
+	if (isRequestLike(source)) try {
+		return new URL(source.url).host;
+	} catch {
+		return null;
+	}
+	return null;
+}
+/**
+* Extracts the protocol from a `Request` or `Headers`.
+* Honors `x-forwarded-proto` only when `trustedProxyHeaders` is enabled,
+* then falls back to the request URL, then to "https".
+*/
+function getProtocolFromSource(source, configProtocol, trustedProxyHeaders) {
+	if (configProtocol === "http" || configProtocol === "https") return configProtocol;
+	const headers = isRequestLike(source) ? source.headers : source;
+	if (trustedProxyHeaders) {
+		const forwardedProto = headers.get("x-forwarded-proto");
+		if (forwardedProto && validateProxyHeader(forwardedProto, "proto")) return forwardedProto;
+	}
+	if (isRequestLike(source)) try {
+		const url = new URL(source.url);
+		if (url.protocol === "http:" || url.protocol === "https:") return url.protocol.slice(0, -1);
+	} catch {}
+	const host = getHostFromSource(source, trustedProxyHeaders);
+	if (host && isLoopbackForDevScheme(host)) return "http";
+	return "https";
+}
+/**
+* Matches a hostname against a host pattern.
+* Supports wildcard patterns like `*.vercel.app` or `preview-*.myapp.com`.
+*
+* @param host The hostname to test (e.g., "myapp.com", "preview-123.vercel.app")
+* @param pattern The host pattern (e.g., "myapp.com", "*.vercel.app")
+* @returns {boolean} true if the host matches the pattern, false otherwise.
+*
+* @example
+* ```ts
+* matchesHostPattern("myapp.com", "myapp.com") // true
+* matchesHostPattern("preview-123.vercel.app", "*.vercel.app") // true
+* matchesHostPattern("preview-123.myapp.com", "preview-*.myapp.com") // true
+* matchesHostPattern("evil.com", "myapp.com") // false
+* ```
+*/
+var matchesHostPattern = (host, pattern) => {
+	if (!host || !pattern) return false;
+	const normalizedHost = host.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
+	const normalizedPattern = pattern.replace(/^https?:\/\//, "").split("/")[0].toLowerCase();
+	if (normalizedPattern.includes("*") || normalizedPattern.includes("?")) return wildcardMatch(normalizedPattern)(normalizedHost);
+	return normalizedHost.toLowerCase() === normalizedPattern.toLowerCase();
+};
+/**
+* Resolves the base URL from a dynamic config based on the incoming request.
+* Validates the derived host against the allowedHosts allowlist.
+*
+* @param config The dynamic base URL config
+* @param request The incoming request
+* @param basePath The base path to append
+* @returns The resolved base URL with path
+* @throws BetterAuthError if host is not in allowedHosts and no fallback is set
+*/
+function resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders) {
+	const host = getHostFromSource(source, trustedProxyHeaders);
+	if (!host) {
+		if (config.fallback) return withPath(config.fallback, basePath);
+		throw new BetterAuthError("Could not determine host from request headers. Please provide a fallback URL in your baseURL config.");
+	}
+	if (config.allowedHosts.some((pattern) => matchesHostPattern(host, pattern))) return withPath(`${getProtocolFromSource(source, config.protocol, trustedProxyHeaders)}://${host}`, basePath);
+	if (config.fallback) return withPath(config.fallback, basePath);
+	throw new BetterAuthError(`Host "${host}" is not in the allowed hosts list. Allowed hosts: ${config.allowedHosts.join(", ")}. Add this host to your allowedHosts config or provide a fallback URL.`);
+}
+/**
+* Resolves the base URL from any config type (static string or dynamic object).
+* This is the main entry point for base URL resolution.
+*
+* @param config The base URL config (string or object)
+* @param basePath The base path to append
+* @param request Optional request for dynamic resolution
+* @param loadEnv Whether to load from environment variables
+* @param trustedProxyHeaders Whether to trust proxy headers (for legacy behavior)
+* @returns The resolved base URL with path
+*/
+function resolveBaseURL(config, basePath, source, loadEnv, trustedProxyHeaders) {
+	if (isDynamicBaseURLConfig(config)) {
+		if (source) return resolveDynamicBaseURL(config, source, basePath, trustedProxyHeaders);
+		if (config.fallback) return withPath(config.fallback, basePath);
+		return getBaseURL(void 0, basePath, void 0, loadEnv, trustedProxyHeaders);
+	}
+	const request = isRequestLike(source) ? source : void 0;
+	if (typeof config === "string") return getBaseURL(config, basePath, request, loadEnv, trustedProxyHeaders);
+	return getBaseURL(void 0, basePath, request, loadEnv, trustedProxyHeaders);
+}
+/**
+* Normalizes a request pathname by removing the basePath prefix and trailing slashes.
+* This is useful for matching paths against configured path lists.
+*
+* @param requestUrl - The full request URL
+* @param basePath - The base path of the auth API (e.g., "/api/auth")
+* @returns The normalized path without basePath prefix or trailing slashes,
+*          or "/" if URL parsing fails
+*
+* @example
+* normalizePathname("http://localhost:3000/api/auth/sso/saml2/callback/provider1", "/api/auth")
+* // Returns: "/sso/saml2/callback/provider1"
+*
+* normalizePathname("http://localhost:3000/sso/saml2/callback/provider1/", "/")
+* // Returns: "/sso/saml2/callback/provider1"
+*/
+function normalizePathname(requestUrl, basePath) {
+	let pathname;
+	try {
+		pathname = new URL(requestUrl).pathname.replace(/\/+$/, "") || "/";
+	} catch {
+		return "/";
+	}
+	const normalizedBasePath = basePath.replace(/\/+$/, "");
+	if (normalizedBasePath === "") return pathname;
+	if (pathname === normalizedBasePath) return "/";
+	if (pathname.startsWith(normalizedBasePath + "/")) return pathname.slice(normalizedBasePath.length).replace(/\/+$/, "") || "/";
+	return pathname;
+}
+/**
+* Schemes that execute or embed code when navigated to or accepted as a
+* redirect target. These are never safe as an OAuth `redirect_uri` or as a
+* client-side navigation target (`window.location.href`, `location.assign`, ...).
+*/
+var DANGEROUS_URL_SCHEMES = [
+	"javascript:",
+	"data:",
+	"vbscript:"
+];
+/**
+* Returns `false` only when `value` is an absolute URL using a dangerous scheme
+* (`javascript:`, `data:`, `vbscript:`). Relative URLs (e.g. `/dashboard`) and
+* safe absolute schemes (`http`, `https`, custom app schemes such as
+* `myapp://`) return `true`.
+*
+* Use this to guard browser navigation sinks and any redirect target that may
+* originate from untrusted input. It is intentionally narrow: it blocks code
+* execution schemes without rejecting relative paths or mobile deep links.
+*/
+function isSafeUrlScheme(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		return true;
+	}
+	return !DANGEROUS_URL_SCHEMES.includes(parsed.protocol);
+}
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== null && prototype !== Object.prototype && Object.getPrototypeOf(prototype) !== null) return false;
+	if (Symbol.iterator in value) return false;
+	if (Symbol.toStringTag in value) return Object.prototype.toString.call(value) === "[object Module]";
+	return true;
+}
+function _defu(baseObject, defaults, namespace = ".", merger) {
+	if (!isPlainObject(defaults)) return _defu(baseObject, {}, namespace, merger);
+	const object = { ...defaults };
+	for (const key of Object.keys(baseObject)) {
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = baseObject[key];
+		if (value === null || value === void 0) continue;
+		if (merger && merger(object, key, value, namespace)) continue;
+		if (Array.isArray(value) && Array.isArray(object[key])) object[key] = [...value, ...object[key]];
+		else if (isPlainObject(value) && isPlainObject(object[key])) object[key] = _defu(value, object[key], (namespace ? `${namespace}.` : "") + key.toString(), merger);
+		else object[key] = value;
+	}
+	return object;
+}
+function createDefu(merger) {
+	return (...arguments_) => arguments_.reduce((p, c) => _defu(p, c, "", merger), {});
+}
+var defu = createDefu();
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, {
+	enumerable: true,
+	configurable: true,
+	writable: true,
+	value
+}) : obj[key] = value;
+var __spreadValues = (a, b) => {
+	for (var prop in b || (b = {})) if (__hasOwnProp.call(b, prop)) __defNormalProp(a, prop, b[prop]);
+	if (__getOwnPropSymbols) {
+		for (var prop of __getOwnPropSymbols(b)) if (__propIsEnum.call(b, prop)) __defNormalProp(a, prop, b[prop]);
+	}
+	return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var BetterFetchError = class extends Error {
+	constructor(status, statusText, error) {
+		super(statusText || status.toString(), { cause: error });
+		this.status = status;
+		this.statusText = statusText;
+		this.error = error;
+		Error.captureStackTrace(this, this.constructor);
+	}
+};
+var initializePlugins = async (url, options) => {
+	var _a, _b, _c, _d, _e, _f;
+	let opts = options || {};
+	const hooks = {
+		onRequest: [options == null ? void 0 : options.onRequest],
+		onResponse: [options == null ? void 0 : options.onResponse],
+		onSuccess: [options == null ? void 0 : options.onSuccess],
+		onError: [options == null ? void 0 : options.onError],
+		onRetry: [options == null ? void 0 : options.onRetry]
+	};
+	if (!options || !(options == null ? void 0 : options.plugins)) return {
+		url,
+		options: opts,
+		hooks
+	};
+	for (const plugin of (options == null ? void 0 : options.plugins) || []) {
+		if (plugin.init) {
+			const pluginRes = await ((_a = plugin.init) == null ? void 0 : _a.call(plugin, url.toString(), options));
+			opts = pluginRes.options || opts;
+			url = pluginRes.url;
+		}
+		hooks.onRequest.push((_b = plugin.hooks) == null ? void 0 : _b.onRequest);
+		hooks.onResponse.push((_c = plugin.hooks) == null ? void 0 : _c.onResponse);
+		hooks.onSuccess.push((_d = plugin.hooks) == null ? void 0 : _d.onSuccess);
+		hooks.onError.push((_e = plugin.hooks) == null ? void 0 : _e.onError);
+		hooks.onRetry.push((_f = plugin.hooks) == null ? void 0 : _f.onRetry);
+	}
+	return {
+		url,
+		options: opts,
+		hooks
+	};
+};
+var LinearRetryStrategy = class {
+	constructor(options) {
+		this.options = options;
+	}
+	shouldAttemptRetry(attempt, response) {
+		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
+		return Promise.resolve(attempt < this.options.attempts);
+	}
+	getDelay() {
+		return this.options.delay;
+	}
+};
+var ExponentialRetryStrategy = class {
+	constructor(options) {
+		this.options = options;
+	}
+	shouldAttemptRetry(attempt, response) {
+		if (this.options.shouldRetry) return Promise.resolve(attempt < this.options.attempts && this.options.shouldRetry(response));
+		return Promise.resolve(attempt < this.options.attempts);
+	}
+	getDelay(attempt) {
+		return Math.min(this.options.maxDelay, this.options.baseDelay * 2 ** attempt);
+	}
+};
+function createRetryStrategy(options) {
+	if (typeof options === "number") return new LinearRetryStrategy({
+		type: "linear",
+		attempts: options,
+		delay: 1e3
+	});
+	switch (options.type) {
+		case "linear": return new LinearRetryStrategy(options);
+		case "exponential": return new ExponentialRetryStrategy(options);
+		default: throw new Error("Invalid retry strategy");
+	}
+}
+var getAuthHeader = async (options) => {
+	const headers = {};
+	const getValue = async (value) => typeof value === "function" ? await value() : value;
+	if (options == null ? void 0 : options.auth) {
+		if (options.auth.type === "Bearer") {
+			const token = await getValue(options.auth.token);
+			if (!token) return headers;
+			headers["authorization"] = `Bearer ${token}`;
+		} else if (options.auth.type === "Basic") {
+			const [username, password] = await Promise.all([getValue(options.auth.username), getValue(options.auth.password)]);
+			if (!username || !password) return headers;
+			headers["authorization"] = `Basic ${btoa(`${username}:${password}`)}`;
+		} else if (options.auth.type === "Custom") {
+			const [prefix, value] = await Promise.all([getValue(options.auth.prefix), getValue(options.auth.value)]);
+			if (!value) return headers;
+			headers["authorization"] = `${prefix != null ? prefix : ""} ${value}`;
+		}
+	}
+	return headers;
+};
+var JSON_RE = /^application\/(?:[\w!#$%&*.^`~-]*\+)?json(;.+)?$/i;
+function detectResponseType(request) {
+	const _contentType = request.headers.get("content-type");
+	const textTypes = /* @__PURE__ */ new Set([
+		"image/svg",
+		"application/xml",
+		"application/xhtml",
+		"application/html"
+	]);
+	if (!_contentType) return "json";
+	const contentType = _contentType.split(";").shift() || "";
+	if (JSON_RE.test(contentType)) return "json";
+	if (textTypes.has(contentType) || contentType.startsWith("text/")) return "text";
+	return "blob";
+}
+function isJSONParsable(value) {
+	try {
+		JSON.parse(value);
+		return true;
+	} catch (error) {
+		return false;
+	}
+}
+function isJSONSerializable(value) {
+	if (value === void 0) return false;
+	const t = typeof value;
+	if (t === "string" || t === "number" || t === "boolean" || t === null) return true;
+	if (t !== "object") return false;
+	if (Array.isArray(value)) return true;
+	if (value.buffer) return false;
+	return value.constructor && value.constructor.name === "Object" || typeof value.toJSON === "function";
+}
+function jsonParse(text) {
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		return text;
+	}
+}
+function isFunction(value) {
+	return typeof value === "function";
+}
+function getFetch(options) {
+	if (options == null ? void 0 : options.customFetchImpl) return options.customFetchImpl;
+	if (typeof globalThis !== "undefined" && isFunction(globalThis.fetch)) return globalThis.fetch;
+	if (typeof window !== "undefined" && isFunction(window.fetch)) return window.fetch;
+	throw new Error("No fetch implementation found");
+}
+function mergeHeaders(...sources) {
+	const merged = {};
+	for (const source of sources) {
+		if (!source) continue;
+		if (source instanceof Headers) source.forEach((value, key) => {
+			merged[key] = value;
+		});
+		else {
+			const entries = Array.isArray(source) ? source : Object.entries(source);
+			for (const [key, value] of entries) if (value !== null && value !== void 0) merged[key] = value;
+		}
+	}
+	return merged;
+}
+async function getHeaders(opts) {
+	const headers = new Headers(mergeHeaders(opts == null ? void 0 : opts.headers, await getAuthHeader(opts)));
+	if (!headers.has("content-type")) {
+		const contentType = detectContentType(opts == null ? void 0 : opts.body);
+		if (contentType) headers.set("content-type", contentType);
+	}
+	return headers;
+}
+function detectContentType(body) {
+	if (isJSONSerializable(body)) return "application/json";
+	return null;
+}
+function getMediaType(headers) {
+	const contentType = headers.get("content-type");
+	return contentType ? contentType.split(";")[0].trim().toLowerCase() : null;
+}
+function getBody(options, headers) {
+	const { body } = options;
+	if (!body) return null;
+	if (!isJSONSerializable(body)) return body;
+	if (typeof body === "string") return body;
+	if (getMediaType(headers) === "application/x-www-form-urlencoded") return new URLSearchParams(body).toString();
+	return JSON.stringify(body);
+}
+function getMethod(url, options) {
+	var _a;
+	if (options == null ? void 0 : options.method) return options.method.toUpperCase();
+	if (url.startsWith("@")) {
+		const pMethod = (_a = url.split("@")[1]) == null ? void 0 : _a.split("/")[0];
+		if (!methods.includes(pMethod)) return (options == null ? void 0 : options.body) ? "POST" : "GET";
+		return pMethod.toUpperCase();
+	}
+	return (options == null ? void 0 : options.body) ? "POST" : "GET";
+}
+function getTimeout(options, controller) {
+	let abortTimeout;
+	if (!(options == null ? void 0 : options.signal) && (options == null ? void 0 : options.timeout)) abortTimeout = setTimeout(() => controller == null ? void 0 : controller.abort(), options == null ? void 0 : options.timeout);
+	return {
+		abortTimeout,
+		clearTimeout: () => {
+			if (abortTimeout) clearTimeout(abortTimeout);
+		}
+	};
+}
+var ValidationError = class _ValidationError extends Error {
+	constructor(issues, message) {
+		super(message || JSON.stringify(issues, null, 2));
+		this.issues = issues;
+		Object.setPrototypeOf(this, _ValidationError.prototype);
+	}
+};
+async function parseStandardSchema(schema, input) {
+	const result = await schema["~standard"].validate(input);
+	if (result.issues) throw new ValidationError(result.issues);
+	return result.value;
+}
+var methods = [
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete"
+];
+var applySchemaPlugin = (config) => ({
+	id: "apply-schema",
+	name: "Apply Schema",
+	version: "1.0.0",
+	async init(url, options) {
+		var _a, _b, _c, _d;
+		const schema = ((_b = (_a = config.plugins) == null ? void 0 : _a.find((plugin) => {
+			var _a2;
+			return ((_a2 = plugin.schema) == null ? void 0 : _a2.config) ? url.startsWith(plugin.schema.config.baseURL || "") || url.startsWith(plugin.schema.config.prefix || "") : false;
+		})) == null ? void 0 : _b.schema) || config.schema;
+		if (schema) {
+			let urlKey = url;
+			if ((_c = schema.config) == null ? void 0 : _c.prefix) {
+				if (urlKey.startsWith(schema.config.prefix)) {
+					urlKey = urlKey.replace(schema.config.prefix, "");
+					if (schema.config.baseURL) url = url.replace(schema.config.prefix, schema.config.baseURL);
+				}
+			}
+			if ((_d = schema.config) == null ? void 0 : _d.baseURL) {
+				if (urlKey.startsWith(schema.config.baseURL)) urlKey = urlKey.replace(schema.config.baseURL, "");
+			}
+			if (urlKey.startsWith("/") && urlKey.charAt(1) === "@") urlKey = urlKey.substring(1);
+			const keySchema = schema.schema[urlKey];
+			if (keySchema) {
+				let validatedHeaders = options == null ? void 0 : options.headers;
+				if (keySchema.headers && !(options == null ? void 0 : options.disableValidation)) {
+					const normalizedHeaders = {};
+					if (options == null ? void 0 : options.headers) {
+						if (options.headers instanceof Headers) options.headers.forEach((value, key) => {
+							normalizedHeaders[key.toLowerCase()] = value;
+						});
+						else if (typeof options.headers === "object") {
+							for (const [key, value] of Object.entries(options.headers)) if (value !== null && value !== void 0) normalizedHeaders[key.toLowerCase()] = value;
+						}
+					}
+					const validated = await parseStandardSchema(keySchema.headers, normalizedHeaders);
+					const finalHeaders = {};
+					for (const [key, value] of Object.entries(validated)) finalHeaders[key.toLowerCase()] = value;
+					validatedHeaders = finalHeaders;
+				}
+				let opts = __spreadProps(__spreadValues({}, options), {
+					method: keySchema.method,
+					output: keySchema.output,
+					headers: validatedHeaders
+				});
+				if (!(options == null ? void 0 : options.disableValidation)) opts = __spreadProps(__spreadValues({}, opts), {
+					body: keySchema.input ? await parseStandardSchema(keySchema.input, options == null ? void 0 : options.body) : options == null ? void 0 : options.body,
+					params: keySchema.params ? await parseStandardSchema(keySchema.params, options == null ? void 0 : options.params) : options == null ? void 0 : options.params,
+					query: keySchema.query ? await parseStandardSchema(keySchema.query, options == null ? void 0 : options.query) : options == null ? void 0 : options.query
+				});
+				return {
+					url,
+					options: opts
+				};
+			}
+		}
+		return {
+			url,
+			options
+		};
+	}
+});
+var createFetch = (config) => {
+	async function $fetch(url, options) {
+		const opts = __spreadProps(__spreadValues(__spreadValues({}, config), options), {
+			headers: mergeHeaders(config == null ? void 0 : config.headers, options == null ? void 0 : options.headers),
+			plugins: [
+				...(config == null ? void 0 : config.plugins) || [],
+				applySchemaPlugin(config || {}),
+				...(options == null ? void 0 : options.plugins) || []
+			]
+		});
+		if (config == null ? void 0 : config.catchAllError) try {
+			return await betterFetch(url, opts);
+		} catch (error) {
+			return {
+				data: null,
+				error: {
+					status: 500,
+					statusText: "Fetch Error",
+					message: "Fetch related error. Captured by catchAllError option. See error property for more details.",
+					error
+				}
+			};
+		}
+		return await betterFetch(url, opts);
+	}
+	return $fetch;
+};
+var isReservedPathSegment = (value) => value === "." || value === "..";
+function encodePathSegment(segment, pathParams) {
+	let pathSegment = segment;
+	for (const [key, value] of pathParams) pathSegment = pathSegment.replace(key, value);
+	if (isReservedPathSegment(pathSegment)) throw new TypeError("Path parameters cannot be reserved path segments");
+	return encodeURIComponent(pathSegment);
+}
+function getURL2(url, option) {
+	const { baseURL, params, query } = option || {
+		query: {},
+		params: {},
+		baseURL: ""
+	};
+	let basePath = url.startsWith("http") ? url.split("/").slice(0, 3).join("/") : baseURL || "";
+	if (url.startsWith("@")) {
+		const m = url.toString().split("@")[1].split("/")[0];
+		if (methods.includes(m)) url = url.replace(`@${m}/`, "/");
+	}
+	if (!basePath.endsWith("/")) basePath += "/";
+	let [path, urlQuery] = url.replace(basePath, "").split("?");
+	const queryParams = new URLSearchParams(urlQuery);
+	for (const [key, value] of Object.entries(query || {})) {
+		if (value == null) continue;
+		let serializedValue;
+		if (typeof value === "string") serializedValue = value;
+		else if (Array.isArray(value)) {
+			for (const val of value) queryParams.append(key, val);
+			continue;
+		} else serializedValue = JSON.stringify(value);
+		queryParams.set(key, serializedValue);
+	}
+	const pathParams = /* @__PURE__ */ new Map();
+	if (params) if (Array.isArray(params)) {
+		const paramPaths = path.split("/").filter((p) => p.startsWith(":"));
+		for (const [index, key] of paramPaths.entries()) {
+			const value = params[index];
+			pathParams.set(key, String(value));
+		}
+	} else for (const [key, value] of Object.entries(params)) pathParams.set(`:${key}`, String(value));
+	path = path.split("/").map((segment) => encodePathSegment(segment, pathParams)).join("/");
+	path = path.replace(/^\/+/, "");
+	let queryParamString = queryParams.toString();
+	queryParamString = queryParamString.length > 0 ? `?${queryParamString}`.replace(/\+/g, "%20") : "";
+	if (!basePath.startsWith("http")) return `${basePath}${path}${queryParamString}`;
+	return new URL(`${path}${queryParamString}`, basePath);
+}
+var betterFetch = async (url, options) => {
+	var _a, _b, _c, _d, _e, _f, _g, _h;
+	const { hooks, url: __url, options: opts } = await initializePlugins(url, options);
+	const fetch = getFetch(opts);
+	const controller = new AbortController();
+	const signal = (_a = opts.signal) != null ? _a : controller.signal;
+	const _url = getURL2(__url, opts);
+	const headers = await getHeaders(opts);
+	const body = getBody(opts, headers);
+	const method = getMethod(__url, opts);
+	const context = __spreadProps(__spreadValues({}, opts), {
+		url: _url,
+		headers,
+		body,
+		method,
+		signal
+	});
+	for (const onRequest of hooks.onRequest) if (onRequest) {
+		const res = await onRequest(context);
+		if (typeof res === "object" && res !== null) Object.assign(context, res);
+	}
+	if ("pipeTo" in context && typeof context.pipeTo === "function" || typeof ((_b = options == null ? void 0 : options.body) == null ? void 0 : _b.pipe) === "function") {
+		if (!("duplex" in context)) context.duplex = "half";
+	}
+	const { clearTimeout: clearTimeout2 } = getTimeout(opts, controller);
+	let response = await fetch(context.url, context);
+	clearTimeout2();
+	const responseContext = {
+		response,
+		request: context
+	};
+	for (const onResponse of hooks.onResponse) if (onResponse) {
+		const r = await onResponse(__spreadProps(__spreadValues({}, responseContext), { response: ((_c = options == null ? void 0 : options.hookOptions) == null ? void 0 : _c.cloneResponse) ? response.clone() : response }));
+		if (r instanceof Response) response = r;
+		else if (typeof r === "object" && r !== null) response = r.response;
+	}
+	if (response.ok) {
+		if (!(context.method !== "HEAD")) return {
+			data: "",
+			error: null
+		};
+		const responseType = detectResponseType(response);
+		const successContext = {
+			data: null,
+			response,
+			request: context
+		};
+		if (responseType === "json" || responseType === "text") {
+			const text = await response.text();
+			successContext.data = await ((_d = context.jsonParser) != null ? _d : jsonParse)(text);
+		} else successContext.data = await response[responseType]();
+		if (context == null ? void 0 : context.output) {
+			if (context.output && !context.disableValidation) successContext.data = await parseStandardSchema(context.output, successContext.data);
+		}
+		for (const onSuccess of hooks.onSuccess) if (onSuccess) await onSuccess(__spreadProps(__spreadValues({}, successContext), { response: ((_e = options == null ? void 0 : options.hookOptions) == null ? void 0 : _e.cloneResponse) ? response.clone() : response }));
+		if (options == null ? void 0 : options.throw) return successContext.data;
+		return {
+			data: successContext.data,
+			error: null
+		};
+	}
+	const parser = (_f = options == null ? void 0 : options.jsonParser) != null ? _f : jsonParse;
+	const responseText = await response.text();
+	const isJSONResponse = isJSONParsable(responseText);
+	const errorObject = isJSONResponse ? await parser(responseText) : null;
+	const errorContext = {
+		response,
+		responseText,
+		request: context,
+		error: __spreadProps(__spreadValues({}, errorObject), {
+			status: response.status,
+			statusText: response.statusText
+		})
+	};
+	for (const onError of hooks.onError) if (onError) await onError(__spreadProps(__spreadValues({}, errorContext), { response: ((_g = options == null ? void 0 : options.hookOptions) == null ? void 0 : _g.cloneResponse) ? response.clone() : response }));
+	if (options == null ? void 0 : options.retry) {
+		const retryStrategy = createRetryStrategy(options.retry);
+		const _retryAttempt = (_h = options.retryAttempt) != null ? _h : 0;
+		if (await retryStrategy.shouldAttemptRetry(_retryAttempt, response)) {
+			for (const onRetry of hooks.onRetry) if (onRetry) await onRetry(responseContext);
+			const delay = retryStrategy.getDelay(_retryAttempt);
+			await new Promise((resolve) => setTimeout(resolve, delay));
+			return await betterFetch(url, __spreadProps(__spreadValues({}, options), { retryAttempt: _retryAttempt + 1 }));
+		}
+	}
+	if (options == null ? void 0 : options.throw) throw new BetterFetchError(response.status, response.statusText, isJSONResponse ? errorObject : responseText);
+	return {
+		data: null,
+		error: __spreadProps(__spreadValues({}, errorObject), {
+			status: response.status,
+			statusText: response.statusText
+		})
+	};
+};
+/**
+* Pievo server data directory — server-side file state, and (for the embedded
+* pglite tier) the on-disk Postgres data dir at `<dataDir>/pgdata`. Locally it
+* defaults to `~/.pievo`. Override with `PIEVO_DATA_DIR`. A hosted-Postgres tier
+* still uses `<dataDir>/blobs` unless R2 is configured.
+*/
+function dataDir() {
+	return process.env.PIEVO_DATA_DIR?.trim() || path.join(os.homedir(), ".pievo");
+}
+/**
+* Supabase (or any Postgres) connection string for the RUNTIME app process. When
+* set, the server uses the postgres-js driver (hosted prod/staging). Pool options
+* are MODE-AWARE (`db/poolOptions.ts`): a Supabase TRANSACTION pooler URL
+* (`:6543`) gets `prepare:false`; a SESSION pooler / direct URL (`:5432`) gets
+* `prepare:true` (backend pinned per connection — safe and faster). Either form
+* is supported; `dbPoolMode()` below overrides the port-based detection.
+* When UNSET, the server falls back to the embedded, file-backed pglite database
+* at `<dataDir>/pgdata` (local dev + light self-host + tests) — zero external DB.
+*/
+function databaseUrl() {
+	return process.env.DATABASE_URL?.trim() || void 0;
+}
+/**
+* Explicit pool-mode override for the runtime postgres-js pool
+* (`PIEVO_DB_POOL_MODE=transaction|session`). Normally UNSET — the mode is
+* detected from `DATABASE_URL`'s port (`:6543` ⇒ transaction pooler; see
+* `db/poolOptions.ts` `isTransactionPooler`). This is the escape hatch for a
+* NONSTANDARD-PORT or self-hosted pooler the port heuristic can't classify.
+* Getting it wrong on a real transaction pooler (`session` when the pooler is
+* transaction-mode) re-arms the prepared-statement breakage the detection
+* exists to prevent — set it only when you know the pooler's mode.
+*/
+function dbPoolMode() {
+	const raw = process.env.PIEVO_DB_POOL_MODE?.trim().toLowerCase();
+	if (raw === "transaction" || raw === "session") return raw;
+}
+function r2Config() {
+	const accountId = process.env.PIEVO_R2_ACCOUNT_ID?.trim();
+	const bucket = process.env.PIEVO_R2_BUCKET?.trim();
+	const accessKeyId = process.env.PIEVO_R2_ACCESS_KEY_ID?.trim();
+	const secretAccessKey = process.env.PIEVO_R2_SECRET_ACCESS_KEY?.trim();
+	const explicitEndpoint = process.env.PIEVO_R2_ENDPOINT?.trim();
+	const region = process.env.PIEVO_R2_REGION?.trim();
+	const endpoint = explicitEndpoint || (accountId ? `https://${accountId}.r2.cloudflarestorage.com` : void 0);
+	if (!!!(accountId || bucket || accessKeyId || secretAccessKey || explicitEndpoint || region)) return null;
+	const missing = [
+		!bucket && "PIEVO_R2_BUCKET",
+		!accessKeyId && "PIEVO_R2_ACCESS_KEY_ID",
+		!secretAccessKey && "PIEVO_R2_SECRET_ACCESS_KEY",
+		!endpoint && "PIEVO_R2_ACCOUNT_ID or PIEVO_R2_ENDPOINT"
+	].filter(Boolean);
+	if (missing.length) throw new Error(`incomplete R2 configuration — missing ${missing.join(", ")}`);
+	return {
+		bucket,
+		endpoint,
+		accessKeyId,
+		secretAccessKey,
+		region: region || "auto"
+	};
+}
+/**
+* Artifact-storage retention / GC knobs (see gateway/retention.ts). Read lazily
+* from env at call time (not at module load) so tests can set them per-case and
+* a deploy can tune them without a rebuild. Each has a safe, generous default —
+* the bias is "keep storage bounded without ever surprising a healthy loop".
+*/
+function posIntEnv(name, fallback) {
+	const raw = process.env[name]?.trim();
+	if (!raw) return fallback;
+	const n = Number(raw);
+	return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
+}
+/**
+* How many of the most recent run snapshots to keep per loop. Older ones are
+* pruned (their now-unreferenced blobs then become GC-collectable). The per-run
+* diff only needs the immediately-prior snapshot, so 20 keeps ample history for
+* the "Changes" view while bounding the table + blob retention. Default 20.
+*/
+function snapshotRetention() {
+	return posIntEnv("PIEVO_SNAPSHOT_RETENTION", 20);
+}
+/**
+* GC grace window: a blob whose metadata row is younger than this is NEVER
+* collected, even if currently unreferenced. This is the concurrency guard —
+* a blob a sync just wrote (and is about to reference) can't be swept out from
+* under it. Generous default (1h) since a leaked blob is only a cost bug that
+* the next GC pass reclaims anyway. Default 3,600,000ms (1 hour).
+*/
+function blobGcGraceMs() {
+	return posIntEnv("PIEVO_BLOB_GC_GRACE_MS", 3600 * 1e3);
+}
+/**
+* How often the periodic storage-maintenance pass runs (prune snapshots → GC
+* blobs). Default 15 minutes. Kept independent of the faster offline-sweep tick.
+*/
+function gcIntervalMs() {
+	return posIntEnv("PIEVO_GC_INTERVAL_MS", 900 * 1e3);
+}
+/**
+* DB watchdog (`server/dbWatchdog.ts`) — the ACTUAL auto-recovery backstop for a
+* wedged postgres-js pool. Fly's `[http_service.checks]` failing only pulls the
+* machine from load balancing; it never restarts the VM (the 2026-07-12 outage:
+* the pool wedged, `/api/health/db` hung, the check went critical, and the box
+* stayed down ~9h with no auto-restart). The watchdog turns a HANG into a process
+* EXIT so Fly's `restart.policy = "on-failure"` kicks in with a fresh pool.
+*
+* Enabled by default ONLY on the hosted postgres tier (a wedged transaction-pooler
+* connection is the failure mode); OFF for the embedded pglite tier and under
+* vitest (a test must never `process.exit`). Force either way with
+* `PIEVO_DB_WATCHDOG=on|off`.
+*/
+function dbWatchdogEnabled() {
+	const raw = process.env.PIEVO_DB_WATCHDOG?.trim().toLowerCase();
+	if (raw === "on") return true;
+	if (raw === "off") return false;
+	if (process.env.VITEST || false) return false;
+	return Boolean(databaseUrl());
+}
+function dbWatchdogIntervalMs() {
+	return posIntEnv("PIEVO_DB_WATCHDOG_INTERVAL_MS", 2e4);
+}
+function dbWatchdogTimeoutMs() {
+	return posIntEnv("PIEVO_DB_WATCHDOG_TIMEOUT_MS", 5e3);
+}
+/**
+* Consecutive failed/timed-out pings before the watchdog exits the process. A
+* healthy ping resets the counter, so this only trips on a SUSTAINED wedge — a
+* brief blip never restarts the box. Default 3 (≈60-75s to detect at 20s cadence).
+*/
+function dbWatchdogFailureThreshold() {
+	return posIntEnv("PIEVO_DB_WATCHDOG_FAILURES", 3);
+}
+/**
+* Uses pino-pretty as a *synchronous* destination stream (not a worker-thread
+* transport) so logs flush before process.exit() in the one-shot CLIs. Writes to
+* stderr (fd 2) to keep stdout clean for QR codes and human CLI output.
+*/
+var level = (process.env.PIEVO_LOG_LEVEL || "info").toLowerCase();
+var stream = (0, import_pino_pretty.default)({
+	destination: 2,
+	colorize: true,
+	translateTime: "SYS:HH:MM:ss",
+	ignore: "pid,hostname"
+});
+var logger = (0, import_pino.default)({ level }, stream);
+/**
+* Pure pool-option derivation for the hosted postgres-js tier. LEAF module by
+* design: no env reads, no DB opens — `db/index.ts` supplies the URL (and the
+* optional `PIEVO_DB_POOL_MODE` override via `env.ts`), tests import this
+* directly without booting a database.
+*/
+/**
+* Whether `url` points at a pgBouncer/Supavisor TRANSACTION pooler. Detection
+* is by the conventional port `:6543` (Supabase's transaction-mode port).
+*
+* Why it matters: postgres-js pipelines queries and caches prepared statements
+* per connection, but a transaction pooler reassigns the backend connection per
+* transaction, which both breaks cached prepared statements and is implicated
+* in the pool-wedge failure mode (porsager/postgres#970). Session mode (:5432)
+* pins one backend per client connection, so neither problem exists there.
+*
+* LIMITATION: a nonstandard-port or self-hosted transaction pooler will NOT be
+* detected here — set `PIEVO_DB_POOL_MODE=transaction` (see `env.ts`
+* `dbPoolMode`) to override. Getting that wrong on a real transaction pooler
+* re-arms the prepared-statement breakage.
+*/
+function isTransactionPooler(url) {
+	try {
+		return new URL(url).port === "6543";
+	} catch {
+		return false;
+	}
+}
+/**
+* Mode-aware pool options:
+*
+*   - TRANSACTION pooler (:6543): `prepare:false` is mandatory — the backend is
+*     reassigned per transaction, so cached prepared statements break.
+*   - SESSION pooler / direct (:5432): the backend is pinned per connection, so
+*     `prepare:true` is safe AND faster (cached plans), and the session-scoped
+*     `statement_timeout` is actually enforced on the executing backend.
+*
+* The shared knobs are the conservative self-healing ring for one always-on
+* machine (see `db/index.ts` + api.health.db.ts for the incident history).
+* Pass `transactionPooler` explicitly to override the port-based detection
+* (the `PIEVO_DB_POOL_MODE` escape hatch).
+*/
+function poolOptionsFor(url, transactionPooler = isTransactionPooler(url)) {
+	return {
+		prepare: !transactionPooler,
+		max: 10,
+		idle_timeout: 30,
+		connect_timeout: 15,
+		max_lifetime: 1800,
+		connection: { statement_timeout: 3e4 }
+	};
+}
+/** The coding agent a loop is bound to AND executed with (BYOA on the owner's
+*  machine): `claude-code` → Claude Code, `codex` → `codex exec`, `pi` → Pi.
+*  Non-Claude agents may still have thinner daemon telemetry until stream
+*  integration lands; execution itself is real for every value.
+*
+*  Runtime SINGLE SOURCE (anti-drift): every server consumer DERIVES from this
+*  array — the `CodingAgent` type here, the `db/schema.ts` `CodingAgent` type AND
+*  the `loops.agent` column enum, the edit validator (`coerceCodingAgent`), and the
+*  web agent `<select>` (LoopForm). So widening the set is a one-line edit HERE with
+*  no other server change (the daemon's own enum in `packages/daemon/src/create.ts`
+*  is a separate package, widened alongside). */
+var CODING_AGENTS = [
+	"claude-code",
+	"codex",
+	"pi"
+];
+function coerceCodingAgent(value) {
+	return typeof value === "string" && CODING_AGENTS.includes(value) ? value : null;
+}
+var RESERVED_LOOP_TAGS = [
+	"all loops",
+	"active",
+	"paused",
+	"blocked"
+];
+/**
+* Pievo business schema (Drizzle, Postgres `pg-core` dialect).
+*
+* Core machine / loop / run tables live alongside Better Auth ownership data.
+* `userId` is the owning user's id. We use
+* Drizzle (not raw SQL) so the store is single-sourced across the driver tiers
+* (postgres-js on Supabase; embedded pglite for local/self-host + tests) — the
+* query-builder API is identical, only `db/index.ts` branches the driver.
+*
+* Timestamp values are represented as ISO strings across both drivers. JSON
+* columns use `jsonb().$type<>()`; booleans use native `boolean()`.
+*/
+var machines = pgTable("machines", {
+	id: text("id").primaryKey(),
+	userId: text("user_id").notNull(),
+	name: text("name").notNull(),
+	hostname: text("hostname"),
+	platform: text("platform"),
+	arch: text("arch"),
+	daemonVersion: text("daemon_version"),
+	/** Breaking machine protocol last observed on poll. */
+	daemonProtocol: integer("daemon_protocol"),
+	tokenHash: text("token_hash").notNull(),
+	/**
+	* Plaintext device token. Stored so the UI can re-show the connect command
+	* anytime (MVP convenience — deviates from "store only the hash"; acceptable
+	* for a self-hosted control plane where the DB is already the trust root).
+	*/
+	token: text("token"),
+	roots: jsonb("roots").$type(),
+	lastSeen: text("last_seen"),
+	online: boolean("online").notNull().default(false),
+	createdAt: text("created_at").notNull()
+}, (t) => [index("machines_user_idx").on(t.userId)]);
+var loops = pgTable("loops", {
+	id: text("id").primaryKey(),
+	userId: text("user_id").notNull(),
+	/** Execution machine (set at creation; no cross-machine fallback). */
+	machineId: text("machine_id").notNull(),
+	name: text("name").notNull(),
+	tags: text("tags").array().notNull().default(sql`ARRAY[]::text[]`),
+	prompt: text("prompt").notNull(),
+	statusKeep: text("status_keep").notNull(),
+	statusNoChange: text("status_no_change").notNull(),
+	statusBlock: text("status_block").notNull(),
+	/** Exact workdir-relative artifact paths collected by the daemon after provider exit. */
+	artifacts: jsonb("artifacts").$type().notNull().default([]),
+	cron: text("cron").notNull(),
+	scheduleMode: text("schedule_mode", { enum: ["cron", "continuous"] }).notNull(),
+	/** Cron-only overlap behavior. Continuous runs never overlap. */
+	cronOverlap: text("cron_overlap", { enum: ["skip", "queue-one"] }).notNull(),
+	continuousDelayMinutes: integer("continuous_delay_minutes").notNull(),
+	timezone: text("timezone"),
+	workdir: text("workdir").notNull(),
+	/** Durable Stop-before-delete marker. A deleting loop is never claimable. */
+	deleteRequestedAt: timestamp("delete_requested_at", {
+		withTimezone: true,
+		mode: "string"
+	}),
+	pauseCause: jsonb("pause_cause").$type(),
+	model: text("model"),
+	reasoningEffort: text("reasoning_effort"),
+	/** Coding agent this loop is BOUND TO and EXECUTED with: the daemon's
+	*  `buildAgentSpawn` branches on this value (`claude-code` → claude,
+	*  `codex` → `codex exec`, `pi` → Pi print mode). Measured from the creating CLI's env when
+	*  detectable, else the declared/selected value. The text column carries
+	*  both a TypeScript enum and a database CHECK constraint. */
+	agent: text("agent", { enum: CODING_AGENTS }).notNull(),
+	enabled: boolean("enabled").notNull().default(true),
+	nextRunAt: text("next_run_at"),
+	/** The next recurring cadence occurrence not yet materialized as a run. Cron
+	* advances this fact after each due occurrence; continuous clears it on due
+	* and restores it from a successful/error terminal. */
+	nextCadenceAt: text("next_cadence_at"),
+	lastRunIndex: integer("last_run_index").notNull().default(0),
+	createdAt: text("created_at").notNull(),
+	updatedAt: text("updated_at").notNull()
+}, (t) => [
+	index("loops_user_idx").on(t.userId),
+	index("loops_machine_idx").on(t.machineId),
+	index("delete_requested_loops").on(t.deleteRequestedAt).where(sql`${t.deleteRequestedAt} IS NOT NULL`),
+	check("loops_agent_check", sql`${t.agent} IN ('claude-code', 'codex', 'pi')`),
+	check("loops_tags_count_check", sql`cardinality(${t.tags}) <= 4`),
+	check("loops_tags_reserved_check", sql`NOT (${t.tags} && ARRAY['all loops', 'active', 'paused', 'blocked']::text[])`),
+	check("loops_schedule_mode_check", sql`${t.scheduleMode} IN ('cron', 'continuous')`),
+	check("loops_cron_overlap_check", sql`${t.cronOverlap} IN ('skip', 'queue-one')`)
+]);
+var runs = pgTable("runs", {
+	id: text("id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	machineId: text("machine_id").notNull(),
+	agent: text("agent", { enum: CODING_AGENTS }),
+	model: text("model"),
+	reasoningEffort: text("reasoning_effort"),
+	runIndex: integer("run_index"),
+	phase: text("phase", { enum: [
+		"pending",
+		"running",
+		"done",
+		"error",
+		"canceled"
+	] }).notNull(),
+	/** Durable queue authority. It only promotes system→owner; diagnostic trigger
+	* reasons, if added later, must never drive lifecycle state. */
+	requestedBy: text("requested_by", { enum: ["owner", "system"] }).notNull().default("system"),
+	ts: text("ts").notNull(),
+	createdAt: text("created_at").notNull().default(sql`CURRENT_TIMESTAMP::text`),
+	updatedAt: text("updated_at").notNull().default(sql`CURRENT_TIMESTAMP::text`),
+	status: text("status", { enum: [
+		"keep",
+		"no-change",
+		"block"
+	] }),
+	message: text("message"),
+	durationMs: integer("duration_ms"),
+	exitCode: integer("exit_code"),
+	finalText: text("final_text"),
+	error: text("error"),
+	sessionId: text("session_id"),
+	usage: jsonb("usage").$type(),
+	/** Monotonic cancellation intent. Running becomes canceled only on daemon report. */
+	cancelRequestedAt: timestamp("cancel_requested_at", {
+		withTimezone: true,
+		mode: "string"
+	}),
+	heartbeatAt: text("heartbeat_at"),
+	reportIncident: jsonb("report_incident").$type()
+}, (t) => [
+	index("runs_loop_idx").on(t.loopId),
+	index("runs_phase_idx").on(t.phase),
+	index("runs_machine_phase_ready_idx").on(t.machineId, t.phase),
+	index("runs_loop_ts_idx").on(t.loopId, t.ts),
+	uniqueIndex("runs_loop_run_index_idx").on(t.loopId, t.runIndex).where(sql`${t.runIndex} IS NOT NULL`),
+	index("runs_loop_terminal_history_idx").on(t.loopId, t.runIndex).where(sql`${t.runIndex} IS NOT NULL AND ${t.phase} IN ('done', 'error', 'canceled')`),
+	uniqueIndex("runs_loop_pending_idx").on(t.loopId).where(sql`${t.phase} = 'pending'`),
+	uniqueIndex("one_running_run_per_loop").on(t.loopId).where(sql`${t.phase} = 'running'`),
+	check("runs_agent_check", sql`${t.agent} IS NULL OR ${t.agent} IN ('claude-code', 'codex', 'pi')`),
+	check("runs_phase_check", sql`${t.phase} IN ('pending', 'running', 'done', 'error', 'canceled')`),
+	check("runs_requested_by_check", sql`${t.requestedBy} IN ('owner', 'system')`),
+	check("runs_status_check", sql`${t.status} IS NULL OR ${t.status} IN ('keep', 'no-change', 'block')`)
+]);
+var runLeases = pgTable("run_leases", {
+	tokenHash: text("token_hash").primaryKey(),
+	runId: text("run_id").notNull(),
+	loopId: text("loop_id").notNull(),
+	machineId: text("machine_id").notNull(),
+	state: text("state", { enum: [
+		"active",
+		"terminal-grace",
+		"reconciliation-only",
+		"retired"
+	] }).notNull().default("active"),
+	/** Null while active/retired; ISO only during terminal-grace. */
+	expiresAt: text("expires_at"),
+	createdAt: text("created_at").notNull()
+}, (t) => [
+	index("run_leases_run_idx").on(t.runId),
+	index("run_leases_loop_idx").on(t.loopId),
+	check("run_leases_state_check", sql`${t.state} IN ('active', 'terminal-grace', 'reconciliation-only', 'retired')`)
+]);
+var runReportReceipts = pgTable("run_report_receipts", {
+	reportId: text("report_id").primaryKey(),
+	runId: text("run_id").notNull(),
+	payloadDigest: text("payload_digest").notNull(),
+	ackStatus: integer("ack_status").notNull(),
+	ackBody: jsonb("ack_body").$type().notNull(),
+	createdAt: timestamp("created_at", {
+		withTimezone: true,
+		mode: "string"
+	}).notNull()
+}, (t) => [index("report_receipts_created").on(t.createdAt)]);
+/** Durable evidence for a rejected terminal attempt. It is keyed by
+* sha256(reportId + canonical-payload-digest), is never loop-owned, and therefore
+* survives loop deletion just like normal report receipts. */
+var terminalReportIncidents = pgTable("terminal_report_incidents", {
+	id: text("id").primaryKey(),
+	runId: text("run_id").notNull(),
+	reportId: text("report_id").notNull(),
+	payloadDigest: text("payload_digest").notNull(),
+	disposition: text("disposition", { enum: ["run-error", "telemetry-rejected"] }).$type().notNull(),
+	ackBody: jsonb("ack_body").$type().notNull(),
+	createdAt: timestamp("created_at", {
+		withTimezone: true,
+		mode: "string"
+	}).notNull()
+}, (t) => [
+	index("terminal_report_incidents_report_id").on(t.reportId),
+	index("terminal_report_incidents_created").on(t.createdAt),
+	check("terminal_report_incidents_disposition_check", sql`${t.disposition} IN ('run-error', 'telemetry-rejected')`)
+]);
+var connectKeys = pgTable("connect_keys", {
+	machineId: text("machine_id").primaryKey(),
+	userId: text("user_id").notNull(),
+	/** Mint time (ISO) — drives the TTL. */
+	mintedAt: text("minted_at").notNull()
+});
+/**
+* One content-addressed blob (deduped across every loop/run). The bytes live in
+* the byte store under the hash; this row records verified byte presence and size.
+*/
+var blobs = pgTable("blobs", {
+	hash: text("hash").primaryKey(),
+	size: integer("size").notNull(),
+	createdAt: text("created_at").notNull()
+});
+/**
+* The current configured file set of each loop — one row per live or tombstoned
+* relative path. `hash` → `blobs.hash`; null when the file is deleted or oversize
+* (metadata-only, no bytes synced). The
+* unique (loopId, path) index is the upsert key the sync reconciliation drives.
+*/
+var artifactFiles = pgTable("artifact_files", {
+	id: text("id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	/** Normalized workdir-relative path (never absolute or escaping the workdir). */
+	path: text("path").notNull(),
+	hash: text("hash"),
+	size: integer("size"),
+	/** Bytes contain a NUL (set even for oversize metadata-only files). */
+	binary: boolean("binary").notNull().default(false),
+	/** File exceeds the per-file byte cap → metadata-only (path + size), no blob. */
+	oversize: boolean("oversize").notNull().default(false),
+	deleted: boolean("deleted").notNull().default(false),
+	updatedAt: text("updated_at").notNull()
+}, (t) => [
+	index("artifact_files_loop_idx").on(t.loopId),
+	uniqueIndex("artifact_files_loop_path_idx").on(t.loopId, t.path),
+	index("artifact_files_hash_idx").on(t.hash)
+]);
+/**
+* The loop's full artifact manifest captured at each run's finalize — the input
+* to the per-run diff. Written cheaply on report (no diff computed on write);
+* `getRunDiff` lazily compares run N's snapshot with the preceding snapshot.
+* One row per run (runId primary key).
+*/
+var runSnapshots = pgTable("run_snapshots", {
+	runId: text("run_id").primaryKey(),
+	loopId: text("loop_id").notNull(),
+	manifest: jsonb("manifest").$type().notNull(),
+	createdAt: text("created_at").notNull()
+}, (t) => [index("run_snapshots_loop_idx").on(t.loopId)]);
+var user = pgTable("user", {
+	id: text("id").primaryKey(),
+	name: text("name").notNull(),
+	email: text("email").notNull().unique(),
+	emailVerified: boolean("email_verified").default(false).notNull(),
+	image: text("image"),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
+});
+var session = pgTable("session", {
+	id: text("id").primaryKey(),
+	expiresAt: timestamp("expires_at").notNull(),
+	token: text("token").notNull().unique(),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull(),
+	ipAddress: text("ip_address"),
+	userAgent: text("user_agent"),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" })
+}, (table) => [index("session_userId_idx").on(table.userId)]);
+var account = pgTable("account", {
+	id: text("id").primaryKey(),
+	accountId: text("account_id").notNull(),
+	providerId: text("provider_id").notNull(),
+	userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+	accessToken: text("access_token"),
+	refreshToken: text("refresh_token"),
+	idToken: text("id_token"),
+	accessTokenExpiresAt: timestamp("access_token_expires_at"),
+	refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+	scope: text("scope"),
+	password: text("password"),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
+}, (table) => [index("account_userId_idx").on(table.userId)]);
+var verification = pgTable("verification", {
+	id: text("id").primaryKey(),
+	identifier: text("identifier").notNull(),
+	value: text("value").notNull(),
+	expiresAt: timestamp("expires_at").notNull(),
+	createdAt: timestamp("created_at").defaultNow().notNull(),
+	updatedAt: timestamp("updated_at").defaultNow().$onUpdate(() => /* @__PURE__ */ new Date()).notNull()
+}, (table) => [index("verification_identifier_idx").on(table.identifier)]);
+relations(user, ({ many }) => ({
+	sessions: many(session),
+	accounts: many(account)
+}));
+relations(session, ({ one }) => ({ user: one(user, {
+	fields: [session.userId],
+	references: [user.id]
+}) }));
+relations(account, ({ one }) => ({ user: one(user, {
+	fields: [account.userId],
+	references: [user.id]
+}) }));
+/**
+* Postgres connection + Drizzle handle. The driver is chosen at boot from env
+* from environment configuration:
+*
+*   - `DATABASE_URL` SET   → postgres-js against Supabase (hosted prod/staging).
+*                            Pool options are mode-aware (`db/poolOptions.ts`):
+*                            `prepare:false` on the `:6543` transaction pooler,
+*                            `prepare:true` on a `:5432` session/direct URL.
+*   - `DATABASE_URL` UNSET → embedded pglite, file-backed at `<dataDir>/pgdata`
+*                            (local dev + light self-host + tests). Same pg
+*                            dialect, same migrations, zero external database.
+*
+* `store.ts` is single-sourced across both — the drizzle query-builder API is
+* identical; only this file branches. A `globalThis` guard keeps the handle a
+* true singleton across dev HMR reloads (the Scheduler shares it in-process).
+*
+* The fresh-deploy baseline lives in `packages/server/drizzle`. In
+* the HOSTED tier they're applied out-of-process via `pnpm db:migrate` before
+* `start` (over the DIRECT `:5432` URL); `runMigrations()` also applies them
+* in-process (the pglite tier's only path, plus dev boot + tests).
+*/
+var schema = {
+	machines,
+	loops,
+	runs,
+	blobs,
+	artifactFiles,
+	runSnapshots,
+	runLeases,
+	runReportReceipts,
+	terminalReportIncidents,
+	connectKeys,
+	user,
+	session,
+	account,
+	verification
+};
+var g = globalThis;
+/** Host (host:port, NEVER credentials) of a Postgres URL, for boot logging. */
+function pgHost(url) {
+	try {
+		return new URL(url).host || "unknown";
+	} catch {
+		return "unparseable";
+	}
+}
+function open() {
+	if (g.__pievoDb && g.__pievoClient && g.__pievoDriver) return {
+		db: g.__pievoDb,
+		client: g.__pievoClient,
+		driver: g.__pievoDriver
+	};
+	const url = databaseUrl();
+	if (url) {
+		logger.info({
+			tier: "postgres",
+			host: pgHost(url)
+		}, "database tier: postgres");
+		if (!/sslmode=/i.test(url)) logger.warn({ host: pgHost(url) }, "DATABASE_URL has no sslmode — the connection may be plaintext; append ?sslmode=require");
+		const mode = dbPoolMode();
+		const client = src_default(url, poolOptionsFor(url, mode ? mode === "transaction" : isTransactionPooler(url)));
+		const db = drizzle(client, { schema });
+		g.__pievoClient = client;
+		g.__pievoDb = db;
+		g.__pievoDriver = "postgres";
+		return {
+			db,
+			client,
+			driver: "postgres"
+		};
+	}
+	if (process.env.PIEVO_DB !== "pglite") throw new Error("refusing to boot the ephemeral embedded database in production — set DATABASE_URL, or PIEVO_DB=pglite to opt in");
+	const dir = path.join(dataDir(), "pgdata");
+	logger.info({
+		tier: "pglite",
+		pgdata: dir
+	}, "database tier: pglite");
+	fs.mkdirSync(dataDir(), { recursive: true });
+	const client = new Ve(dir);
+	const db = drizzle$1(client, { schema });
+	g.__pievoClient = client;
+	g.__pievoDb = db;
+	g.__pievoDriver = "pglite";
+	return {
+		db,
+		client,
+		driver: "pglite"
+	};
+}
+var opened = open();
+var db = opened.db;
+opened.client;
+/**
+* Migrations dir. In DEV this file lives at `src/db`, so the folder is at the
+* package root (`../../drizzle`). In the BUILT server the module is bundled under
+* `.output/server/{_ssr,_libs}` and `copy-pglite-assets.mjs` lands the folder at
+* `.output/server/drizzle` (`../drizzle`). Return the first candidate that exists
+* so the embedded pglite tier migrates in-process from either layout.
+*/
+function migrationsDir() {
+	const here = path.dirname(fileURLToPath(import.meta.url));
+	const devDir = path.resolve(here, "..", "..", "drizzle");
+	const builtDir = path.resolve(here, "..", "drizzle");
+	if (fs.existsSync(devDir)) return devDir;
+	if (fs.existsSync(builtDir)) return builtDir;
+	return devDir;
+}
+/**
+* Apply generated migrations IN-PROCESS (idempotent). This is the PGLITE tier's
+* only migration path (also dev boot + tests). The HOSTED postgres tier is a
+* NO-OP here: `prestart.mjs` (and `pnpm db:migrate`) own hosted migrations, run
+* once out-of-process over the DIRECT (:5432) URL before serving — re-migrating
+* over a second connection on every boot only risks a wedged connection hanging
+* boot and double-running the advisory lock.
+*/
+async function runMigrations() {
+	if (opened.driver === "postgres") return;
+	const dir = migrationsDir();
+	if (!fs.existsSync(dir)) return;
+	const { migrate } = await import("../_libs/drizzle-orm+postgres.mjs").then((n) => n.M);
+	await migrate(opened.db, { migrationsFolder: dir });
+}
+/**
+* Best-effort clean shutdown of the runtime database client (called from the
+* boot AbortController on SIGINT/SIGTERM). PGlite must be closed explicitly:
+* after migrations it owns a referenced WASM timer that otherwise keeps Node
+* alive until the managed launcher's graceful-stop deadline. Never throws —
+* shutdown must not wedge on a slow drain.
+*/
+async function closeClient() {
+	try {
+		if (opened.driver === "postgres") await opened.client.end({ timeout: 5 });
+		else await opened.client.close();
+	} catch {}
+}
+/**
+* The GitHub login-gate condition, in one leaf module. `auth.ts` derives its
+* load-time `authEnabled` value from this, and server boot calls it before any
+* migration or scheduler work.
+*
+* The gate is ON exactly when a complete GitHub OAuth app is configured. Open
+* mode requires both values to be absent; a partial configuration fails closed.
+*/
+function loginGateEnabled() {
+	const hasClientId = !!process.env.GITHUB_CLIENT_ID?.trim();
+	if (hasClientId !== !!process.env.GITHUB_CLIENT_SECRET?.trim()) throw new Error("incomplete GitHub auth configuration: set both GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET, or unset both for open mode");
+	return hasClientId;
+}
+/**
+* Data-access layer over Drizzle — replaces c0's file-per-loop store. The API is
+* function-style; persistence is relational (loops and runs are separate tables,
+* and `owner: PeerRef` is gone → `userId` + `machineId`).
+*
+* Under Postgres (postgres-js / pglite) the drizzle session is ASYNC, so every
+* DB-touching function returns a Promise. The 5 pure, DB-free helpers stay sync.
+* Using Drizzle (not raw SQL) keeps the dialect swap a swap, not a rewrite.
+*/
+function newLoopId() {
+	return `loop-${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function nextCronAt(cron, timezone, after) {
+	if (!timezone) throw new Error("invariant: cron schedule has no timezone");
+	const probe = new E(cron, {
+		paused: true,
+		timezone
+	});
+	try {
+		const next = probe.nextRun(new Date(after));
+		if (!next) throw new Error(`cron expression never fires again: ${cron}`);
+		return next.toISOString();
+	} finally {
+		probe.stop();
+	}
+}
+function runTimes(at = nowIso()) {
+	return {
+		ts: at,
+		createdAt: at,
+		updatedAt: at
+	};
+}
+async function listLoops() {
+	return db.select().from(loops);
+}
+async function listLoopsForUser(userId) {
+	return db.select().from(loops).where(eq(loops.userId, userId));
+}
+async function getLoop(id) {
+	return (await db.select().from(loops).where(eq(loops.id, id)))[0];
+}
+async function loopsForMachine(machineId) {
+	return db.select().from(loops).where(eq(loops.machineId, machineId));
+}
+async function createLoop(input) {
+	const ts = nowIso();
+	const enabled = input.enabled ?? true;
+	if (input.scheduleMode === "cron" && !input.timezone) throw new Error("invariant: cron loop creation requires a timezone");
+	if (input.scheduleMode === "continuous" && input.timezone !== null) throw new Error("invariant: continuous loop creation requires a null timezone");
+	const nextCadenceAt = !enabled ? null : input.scheduleMode === "continuous" ? ts : nextCronAt(input.cron, input.timezone, ts);
+	const row = {
+		...input,
+		enabled,
+		pauseCause: input.pauseCause ?? (!enabled ? {
+			kind: "owner",
+			at: ts
+		} : null),
+		nextRunAt: enabled ? input.nextRunAt ?? null : null,
+		nextCadenceAt,
+		id: input.id ?? newLoopId(),
+		createdAt: ts,
+		updatedAt: ts
+	};
+	return db.transaction(async (tx) => {
+		const machine = (await tx.select({
+			id: machines.id,
+			userId: machines.userId
+		}).from(machines).where(eq(machines.id, input.machineId)).for("key share"))[0];
+		if (!machine) throw new Error(`machine ${input.machineId} does not exist`);
+		if (machine.userId !== input.userId) throw new Error(`machine ${input.machineId} is owned by a different user`);
+		return (await tx.insert(loops).values(row).returning())[0];
+	});
+}
+/** Allocate the next 1-based history number. Every caller already holds the
+* owning loop row lock, so the counter and run transition share one commit. */
+async function allocateRunIndexTx(tx, loopId) {
+	const updated = (await tx.update(loops).set({ lastRunIndex: sql`${loops.lastRunIndex} + 1` }).where(eq(loops.id, loopId)).returning({ runIndex: loops.lastRunIndex }))[0];
+	if (!updated) throw new Error(`cannot allocate history index for missing loop ${loopId}`);
+	return updated.runIndex;
+}
+async function ensureRunIndexTx(tx, run) {
+	return run.runIndex ?? allocateRunIndexTx(tx, run.loopId);
+}
+async function cancelPendingTx(tx, where, message, at) {
+	const pending = await tx.select({
+		id: runs.id,
+		loopId: runs.loopId,
+		runIndex: runs.runIndex
+	}).from(runs).where(where).orderBy(asc(runs.createdAt), asc(runs.id)).for("update");
+	for (const run of pending) {
+		const runIndex = await ensureRunIndexTx(tx, run);
+		await tx.update(runs).set({
+			phase: "canceled",
+			runIndex,
+			message,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, run.id), eq(runs.phase, "pending")));
+	}
+}
+/** Apply one loop patch while its row lock is held. This is shared by owner edits
+* and run-authorized mutations, so cadence semantics cannot drift. */
+async function updateLoopTx(tx, current, patch, at) {
+	const extra = {};
+	if (patch.enabled === true) extra.pauseCause = null;
+	else if (patch.enabled === false && current.enabled && patch.pauseCause === void 0) extra.pauseCause = {
+		kind: "owner",
+		at
+	};
+	const effective = {
+		...current,
+		...patch,
+		...extra
+	};
+	if (current.deleteRequestedAt) extra.enabled = false;
+	const pausing = !effective.enabled || current.deleteRequestedAt != null;
+	const activating = effective.enabled && (patch.enabled === true && !current.enabled || patch.scheduleMode !== void 0 && patch.scheduleMode !== current.scheduleMode);
+	if (pausing) {
+		extra.nextCadenceAt = null;
+		extra.nextRunAt = null;
+	} else if (activating) if (effective.scheduleMode === "cron") extra.nextCadenceAt = nextCronAt(effective.cron, effective.timezone, at);
+	else extra.nextCadenceAt = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, current.id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0] ? null : at;
+	else if (effective.enabled && effective.scheduleMode === "cron" && (patch.cron !== void 0 && patch.cron !== current.cron || patch.timezone !== void 0 && patch.timezone !== current.timezone)) extra.nextCadenceAt = nextCronAt(effective.cron, effective.timezone, at);
+	else if (effective.enabled && effective.scheduleMode === "continuous" && current.nextCadenceAt && Date.parse(current.nextCadenceAt) > Date.parse(at) && patch.continuousDelayMinutes !== void 0 && patch.continuousDelayMinutes !== current.continuousDelayMinutes) {
+		const terminalAt = Date.parse(current.nextCadenceAt) - current.continuousDelayMinutes * 6e4;
+		extra.nextCadenceAt = new Date(terminalAt + effective.continuousDelayMinutes * 6e4).toISOString();
+	}
+	const loop = (await tx.update(loops).set({
+		...patch,
+		...extra,
+		updatedAt: at
+	}).where(eq(loops.id, current.id)).returning())[0];
+	if (patch.enabled === false) await cancelPendingTx(tx, and(eq(runs.loopId, current.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop paused before this system run was claimed", at);
+	if (patch.artifacts !== void 0) {
+		const allowed = new Set(patch.artifacts ?? []);
+		const removed = (await tx.select({
+			id: artifactFiles.id,
+			path: artifactFiles.path
+		}).from(artifactFiles).where(and(eq(artifactFiles.loopId, current.id), eq(artifactFiles.deleted, false)))).filter((file) => !allowed.has(file.path)).map((file) => file.id);
+		if (removed.length) await tx.update(artifactFiles).set({
+			hash: null,
+			deleted: true,
+			updatedAt: at
+		}).where(inArray(artifactFiles.id, removed));
+	}
+	return loop;
+}
+async function updateLoop(id, patch) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		return current ? updateLoopTx(tx, current, patch, nowIso()) : void 0;
+	});
+}
+/** Delete loop-owned history/content without erasing durable late-report evidence.
+* A retired lease is non-authorizing and never blocks deletion; only the matching
+* report→410 receipt transaction may consume it. */
+async function deleteLoopDataTx(tx, id) {
+	if (!(await tx.delete(loops).where(eq(loops.id, id)).returning({ id: loops.id })).length) return false;
+	await tx.delete(runs).where(eq(runs.loopId, id));
+	await tx.delete(runLeases).where(and(eq(runLeases.loopId, id), ne(runLeases.state, "retired")));
+	await tx.delete(artifactFiles).where(eq(artifactFiles.loopId, id));
+	await tx.delete(runSnapshots).where(eq(runSnapshots.loopId, id));
+	return true;
+}
+/** Stable Pause plus the post-transition running fact, observed under the same loop
+* lock. Callers use this result for truthful wording without a pre-lock race. */
+async function pauseLoopState(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current) return void 0;
+		const loop = await updateLoopTx(tx, current, { enabled: false }, nowIso());
+		const running = (await tx.select().from(runs).where(and(eq(runs.loopId, id), eq(runs.phase, "running"))).limit(1))[0];
+		return {
+			loop,
+			...running ? { running } : {}
+		};
+	});
+}
+async function pauseLoop(id) {
+	return (await pauseLoopState(id))?.loop;
+}
+async function startLoop(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current || current.deleteRequestedAt) return void 0;
+		return updateLoopTx(tx, current, { enabled: true }, nowIso());
+	});
+}
+async function stopLoopTx(tx, current, at) {
+	const loop = (await tx.update(loops).set({
+		enabled: false,
+		pauseCause: {
+			kind: "owner",
+			at
+		},
+		nextCadenceAt: null,
+		nextRunAt: null,
+		updatedAt: at
+	}).where(eq(loops.id, current.id)).returning())[0];
+	await cancelPendingTx(tx, and(eq(runs.loopId, current.id), eq(runs.phase, "pending")), "canceled - loop stopped before this queued run was claimed", at);
+	const running = (await tx.select().from(runs).where(and(eq(runs.loopId, current.id), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+	if (!running) return { loop };
+	return {
+		loop,
+		running: running.cancelRequestedAt ? running : (await tx.update(runs).set({
+			cancelRequestedAt: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, running.id), eq(runs.phase, "running"), isNull(runs.cancelRequestedAt))).returning())[0] ?? running
+	};
+}
+async function stopLoop(id) {
+	return db.transaction(async (tx) => {
+		const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		return current ? stopLoopTx(tx, current, nowIso()) : void 0;
+	});
+}
+async function requestRunCancel(loopId, runId) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, loopId)).for("update"))[0]) return void 0;
+		const run = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId))).limit(1).for("update"))[0];
+		if (!run) return void 0;
+		if (run.phase === "pending") {
+			const at = nowIso();
+			const runIndex = await ensureRunIndexTx(tx, run);
+			return (await tx.update(runs).set({
+				phase: "canceled",
+				runIndex,
+				error: "stopped by user",
+				ts: at,
+				updatedAt: at
+			}).where(and(eq(runs.id, runId), eq(runs.phase, "pending"))).returning())[0] ?? run;
+		}
+		if (run.phase === "running" && !run.cancelRequestedAt) {
+			const at = nowIso();
+			return (await tx.update(runs).set({
+				cancelRequestedAt: at,
+				updatedAt: at
+			}).where(and(eq(runs.id, runId), eq(runs.phase, "running"), isNull(runs.cancelRequestedAt))).returning())[0] ?? run;
+		}
+		return run;
+	});
+}
+async function requestDeleteLoop(id) {
+	return db.transaction(async (tx) => {
+		let current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+		if (!current) return void 0;
+		const at = current.deleteRequestedAt ?? nowIso();
+		if (!current.deleteRequestedAt) current = (await tx.update(loops).set({
+			deleteRequestedAt: at,
+			updatedAt: at
+		}).where(eq(loops.id, id)).returning())[0];
+		return stopLoopTx(tx, current, at);
+	});
+}
+async function tryDeleteLoop(id) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0]?.deleteRequestedAt) return false;
+		const open = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+		const authority = (await tx.select({ id: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, id), inArray(runLeases.state, ["active", "terminal-grace"]))).limit(1))[0];
+		if (open || authority) return false;
+		await tx.update(runLeases).set({
+			state: "retired",
+			expiresAt: null
+		}).where(and(eq(runLeases.loopId, id), eq(runLeases.state, "reconciliation-only")));
+		return deleteLoopDataTx(tx, id);
+	});
+}
+async function forceDeleteLoopTx(tx, id) {
+	if (!(await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0]) return false;
+	await tx.update(runLeases).set({
+		state: "retired",
+		expiresAt: null
+	}).where(and(eq(runLeases.loopId, id), inArray(runLeases.state, [
+		"active",
+		"terminal-grace",
+		"reconciliation-only",
+		"retired"
+	])));
+	return deleteLoopDataTx(tx, id);
+}
+async function forceDeleteLoop(id) {
+	return db.transaction((tx) => forceDeleteLoopTx(tx, id));
+}
+async function enqueueRunTx(tx, loop, request, at) {
+	if (loop.deleteRequestedAt) return {
+		state: "rejected",
+		reason: "loop is being deleted"
+	};
+	if (request.requestedBy !== "owner" && !loop.enabled) return {
+		state: "skipped",
+		reason: "loop is paused"
+	};
+	const pending = (await tx.select().from(runs).where(and(eq(runs.loopId, loop.id), eq(runs.phase, "pending"))).limit(1).for("update"))[0];
+	if (pending) {
+		const requestedBy = pending.requestedBy === "owner" || request.requestedBy === "owner" ? "owner" : "system";
+		const updated = (await tx.update(runs).set({
+			requestedBy,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, pending.id), eq(runs.phase, "pending"))).returning())[0];
+		return updated ? {
+			state: "coalesced",
+			run: updated
+		} : {
+			state: "skipped",
+			reason: "queued run was claimed concurrently"
+		};
+	}
+	const row = {
+		id: randomUUID(),
+		loopId: loop.id,
+		machineId: loop.machineId,
+		phase: "pending",
+		requestedBy: request.requestedBy,
+		...runTimes(at)
+	};
+	return {
+		state: "queued",
+		run: (await tx.insert(runs).values(row).returning())[0]
+	};
+}
+async function failureStreakTx(tx, loopId) {
+	const lastOk = (await tx.select({ runIndex: runs.runIndex }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "done"), isNotNull(runs.runIndex))).orderBy(desc(runs.runIndex)).limit(1))[0];
+	const conds = [
+		eq(runs.loopId, loopId),
+		eq(runs.phase, "error"),
+		isNotNull(runs.runIndex)
+	];
+	if (lastOk?.runIndex != null) conds.push(gt(runs.runIndex, lastOk.runIndex));
+	const row = (await tx.select({ n: sql`count(*)` }).from(runs).where(and(...conds)))[0];
+	return Number(row?.n ?? 0);
+}
+async function terminalLifecycleTx(tx, currentLoop, run, terminalAt, loopPatch = {}, failureAutopauseStreak = 0) {
+	const effective = {
+		...currentLoop,
+		...loopPatch
+	};
+	const update = { ...loopPatch };
+	if ((run.phase === "done" || run.phase === "error") && effective.scheduleMode === "continuous") {
+		const openExec = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, currentLoop.id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+		update.nextCadenceAt = effective.enabled && !openExec ? new Date(Date.parse(terminalAt) + Math.max(1, effective.continuousDelayMinutes) * 6e4).toISOString() : null;
+	}
+	let loop = Object.keys(update).length ? (await tx.update(loops).set({
+		...update,
+		updatedAt: terminalAt
+	}).where(eq(loops.id, currentLoop.id)).returning())[0] : currentLoop;
+	let failureStreak = 0;
+	let autoPaused = false;
+	if (run.phase === "done" && run.status === "block") {
+		loop = (await tx.update(loops).set({
+			enabled: false,
+			pauseCause: {
+				kind: "blocked",
+				at: terminalAt,
+				runId: run.id
+			},
+			nextCadenceAt: null,
+			nextRunAt: null,
+			updatedAt: terminalAt
+		}).where(eq(loops.id, currentLoop.id)).returning())[0];
+		await cancelPendingTx(tx, and(eq(runs.loopId, currentLoop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop auto-paused after a block report", terminalAt);
+		autoPaused = true;
+	}
+	if (run.phase === "error") {
+		failureStreak = await failureStreakTx(tx, currentLoop.id);
+		if (failureAutopauseStreak > 0 && failureStreak >= failureAutopauseStreak && loop.enabled) {
+			loop = (await tx.update(loops).set({
+				enabled: false,
+				pauseCause: {
+					kind: "failure-streak",
+					at: terminalAt,
+					runId: run.id,
+					count: failureStreak
+				},
+				nextCadenceAt: null,
+				nextRunAt: null,
+				updatedAt: terminalAt
+			}).where(eq(loops.id, currentLoop.id)).returning())[0];
+			await cancelPendingTx(tx, and(eq(runs.loopId, currentLoop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system")), "canceled - loop auto-paused after consecutive failures", terminalAt);
+			autoPaused = true;
+		}
+	}
+	return {
+		loop,
+		failureStreak,
+		autoPaused
+	};
+}
+async function getRun(id) {
+	return (await db.select().from(runs).where(eq(runs.id, id)))[0];
+}
+async function runningRunsForMachine(machineId) {
+	return db.select().from(runs).where(and(eq(runs.machineId, machineId), eq(runs.phase, "running"))).orderBy(asc(runs.createdAt), asc(runs.id));
+}
+async function runningRunForLoop(loopId) {
+	return (await db.select().from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1))[0];
+}
+async function getReportReceipt(reportId) {
+	return (await db.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, reportId)))[0];
+}
+function terminalIncidentReceiptId(reportId, payloadDigest) {
+	return createHash("sha256").update(reportId + payloadDigest).digest("hex");
+}
+async function getTerminalReportIncidents(reportId) {
+	return db.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, reportId)).orderBy(asc(terminalReportIncidents.createdAt));
+}
+async function getExactTerminalReportIncident(reportId, payloadDigest) {
+	return (await db.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, terminalIncidentReceiptId(reportId, payloadDigest))))[0];
+}
+async function putTerminalReportIncidentIfAbsent(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const id = terminalIncidentReceiptId(input.reportId, input.payloadDigest);
+		const existing = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, id)).limit(1))[0];
+		if (existing) return existing;
+		return (await tx.insert(terminalReportIncidents).values({
+			id,
+			...input,
+			createdAt: nowIso()
+		}).returning())[0];
+	});
+}
+/** Serialize all terminal handling for one reportId, even when the competing
+* runs belong to different loop locks or one terminal result lands in the incident table. */
+async function lockReportIdTx(tx, reportId) {
+	const unsigned = BigInt(`0x${createHash("sha256").update(reportId).digest("hex").slice(0, 16)}`);
+	const key = BigInt.asIntN(64, unsigned).toString();
+	await tx.execute(sql`select pg_advisory_xact_lock(${key}::bigint)`);
+}
+/** Race-safe receipt reservation for definitive non-finalization ACKs (RETIRED).
+* Returns the row that owns reportId, whether inserted here or concurrently. */
+async function putReportReceiptIfAbsent(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		return (await tx.insert(runReportReceipts).values(input).onConflictDoNothing({ target: runReportReceipts.reportId }).returning())[0] ?? (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+	});
+}
+/** Idempotent startup repair for a crash across terminalization.
+* Terminal runs can never retain active authority. */
+async function repairTerminalRunLeases(now = Date.now()) {
+	const repaired = await db.update(runLeases).set({
+		state: "terminal-grace",
+		expiresAt: new Date(now + TERMINAL_REPORT_GRACE_MS).toISOString()
+	}).where(and(eq(runLeases.state, "active"), sql`exists (select 1 from ${runs} where ${runs.id} = ${runLeases.runId} and ${runs.phase} in ('done', 'error', 'canceled'))`)).returning({ tokenHash: runLeases.tokenHash });
+	await db.update(runLeases).set({ expiresAt: null }).where(eq(runLeases.state, "retired"));
+	return repaired.length;
+}
+/** Atomically persist a definitive 410 and consume only the matching retired
+* tombstone. If the HTTP response is lost, the independent receipt replays it. */
+async function acknowledgeRetiredReport(leaseTokenHash, input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		if (!(await tx.select().from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.state, "retired"))).limit(1).for("update"))[0]) return void 0;
+		await tx.insert(runReportReceipts).values(input).onConflictDoNothing({ target: runReportReceipts.reportId });
+		const stored = (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+		if (stored?.runId === input.runId && stored.payloadDigest === input.payloadDigest && stored.ackStatus === input.ackStatus) await tx.delete(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.state, "retired")));
+		return stored;
+	});
+}
+/** Refresh provider-neutral liveness in one machine-scoped UPDATE. Untrusted ids
+* cannot stamp another machine or a non-running row; fresh stamps stay untouched. */
+async function refreshRunHeartbeats(machineId, runIds, at, staleBefore) {
+	if (!runIds.length) return 0;
+	return (await db.update(runs).set({
+		heartbeatAt: at,
+		updatedAt: at
+	}).where(and(eq(runs.machineId, machineId), eq(runs.phase, "running"), inArray(runs.id, runIds), or(isNull(runs.heartbeatAt), lt(runs.heartbeatAt, staleBefore)))).returning({ id: runs.id })).length;
+}
+async function activeRunForReportTx(tx, loopId, runId, leaseTokenHash) {
+	const lease = (await tx.select().from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), eq(runLeases.state, "active"))).limit(1).for("update"))[0];
+	if (!lease) return { state: "invalid-lease" };
+	const run = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.machineId, lease.machineId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+	return run ? {
+		state: "active",
+		run
+	} : { state: "run-not-running" };
+}
+/** Record the agent-authored status/message exactly once. The loop row is the
+* serialization point, so sequential and concurrent duplicate callbacks both
+* lose before any field can be overwritten. */
+async function recordRunReportOnce(input) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, input.loopId)).for("update"))[0]) return { state: "missing-loop" };
+		const active = await activeRunForReportTx(tx, input.loopId, input.runId, input.leaseTokenHash);
+		if (active.state !== "active") return active;
+		if (active.run.status != null || active.run.message != null) return { state: "already-reported" };
+		const at = nowIso();
+		const run = (await tx.update(runs).set({
+			status: input.status,
+			message: input.message,
+			updatedAt: at
+		}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"), isNull(runs.status), isNull(runs.message))).returning())[0];
+		return run ? {
+			state: "applied",
+			run
+		} : { state: "already-reported" };
+	});
+}
+/** Consume a retired tombstone when its reportId is owned by another run.
+* The run/loop may already be deleted, so only the exact incident receipt and
+* lease tombstone participate in this transaction. */
+async function acknowledgeRetiredTerminalIncident(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const id = terminalIncidentReceiptId(input.reportId, input.payloadDigest);
+		const replay = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, id)).limit(1))[0];
+		const lease = (await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.tokenHash, input.leaseTokenHash), eq(runLeases.runId, input.runId), eq(runLeases.state, "retired"))).limit(1).for("update"))[0];
+		if (!lease) return void 0;
+		if (replay) {
+			await tx.delete(runLeases).where(eq(runLeases.tokenHash, lease.tokenHash));
+			return replay;
+		}
+		const receipt = (await tx.insert(terminalReportIncidents).values({
+			id,
+			runId: input.runId,
+			reportId: input.reportId,
+			payloadDigest: input.payloadDigest,
+			disposition: "telemetry-rejected",
+			ackBody: input.ackBody,
+			createdAt: nowIso()
+		}).returning())[0];
+		await tx.delete(runLeases).where(eq(runLeases.tokenHash, lease.tokenHash));
+		return receipt;
+	});
+}
+/** Reject one correlatable terminal attempt as a durable terminal fact. Authority,
+* run/loop lifecycle, incident receipt, and lease consumption share one transaction.
+* No payload-authored cursor/task/message field is accepted here. */
+async function rejectTerminalReport(input) {
+	return db.transaction(async (tx) => {
+		await lockReportIdTx(tx, input.reportId);
+		const current = (await tx.select().from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+		if (!current) return { state: "missing-loop" };
+		const normal = (await tx.select().from(runReportReceipts).where(eq(runReportReceipts.reportId, input.reportId)))[0];
+		if (normal?.runId === input.runId) return {
+			state: "normal-replay",
+			receipt: normal
+		};
+		const priorIncident = (await tx.select().from(terminalReportIncidents).where(eq(terminalReportIncidents.id, terminalIncidentReceiptId(input.reportId, input.payloadDigest))).limit(1))[0];
+		if (priorIncident?.runId === input.runId) return {
+			state: "incident-replay",
+			receipt: priorIncident
+		};
+		const now = nowIso();
+		const leaseConditions = [
+			eq(runLeases.tokenHash, input.leaseTokenHash),
+			eq(runLeases.runId, input.runId),
+			eq(runLeases.loopId, input.loopId),
+			input.leaseState === "active" ? eq(runLeases.state, "active") : inArray(runLeases.state, ["terminal-grace", "reconciliation-only"])
+		];
+		if (input.leaseState !== "active") leaseConditions.push(gt(runLeases.expiresAt, now));
+		const lease = (await tx.select().from(runLeases).where(and(...leaseConditions)).limit(1).for("update"))[0];
+		if (!lease) return { state: "invalid-lease" };
+		const receiptInput = {
+			id: terminalIncidentReceiptId(input.reportId, input.payloadDigest),
+			runId: input.runId,
+			reportId: input.reportId,
+			payloadDigest: input.payloadDigest,
+			disposition: input.disposition,
+			ackBody: input.ackBody,
+			createdAt: input.incident.at
+		};
+		if (lease.state !== "active") {
+			const run = (await tx.update(runs).set({
+				reportIncident: input.incident,
+				updatedAt: input.incident.at
+			}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), inArray(runs.phase, [
+				"done",
+				"error",
+				"canceled"
+			]))).returning())[0];
+			if (!run) return { state: "run-not-terminalizable" };
+			await tx.delete(runLeases).where(eq(runLeases.tokenHash, input.leaseTokenHash));
+			return {
+				state: "telemetry-rejected",
+				run,
+				loop: current,
+				receipt: priorIncident ?? (await tx.insert(terminalReportIncidents).values(receiptInput).returning())[0],
+				failureStreak: 0,
+				autoPaused: false
+			};
+		}
+		const target = (await tx.select().from(runs).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+		if (!target) return { state: "run-not-terminalizable" };
+		const runIndex = await ensureRunIndexTx(tx, target);
+		const run = (await tx.update(runs).set({
+			phase: "error",
+			runIndex,
+			error: input.incident.reason,
+			reportIncident: input.incident,
+			ts: input.incident.at,
+			updatedAt: input.incident.at
+		}).where(and(eq(runs.id, input.runId), eq(runs.loopId, input.loopId), eq(runs.phase, "running"))).returning())[0];
+		if (!run) return { state: "run-not-terminalizable" };
+		const lifecycle = await terminalLifecycleTx(tx, current, run, input.incident.at, {}, input.failureAutopauseStreak ?? 0);
+		await tx.delete(runLeases).where(eq(runLeases.tokenHash, input.leaseTokenHash));
+		const receipt = priorIncident ?? (await tx.insert(terminalReportIncidents).values(receiptInput).returning())[0];
+		return {
+			state: "run-error",
+			run,
+			...lifecycle,
+			receipt
+		};
+	});
+}
+/** Atomically CAS running→terminal and apply the report's loop patch.
+* The loop patch is unreachable when cancel/reclaim/another report won. */
+async function finalizeRunningRun(loopId, runId, runPatch, loopPatch = {}, leaseTokenHash, failureAutopauseStreak = 0, receipt) {
+	return db.transaction(async (tx) => {
+		if (receipt) await lockReportIdTx(tx, receipt.reportId);
+		const current = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!current) return void 0;
+		if (receipt) {
+			if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, receipt.reportId)).limit(1))[0]) return void 0;
+		}
+		if (leaseTokenHash) {
+			if ((await activeRunForReportTx(tx, loopId, runId, leaseTokenHash)).state !== "active") return void 0;
+		}
+		const target = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1).for("update"))[0];
+		if (!target) return void 0;
+		const runIndex = await ensureRunIndexTx(tx, target);
+		const at = typeof runPatch.ts === "string" ? runPatch.ts : nowIso();
+		const run = (await tx.update(runs).set({
+			...runPatch,
+			runIndex,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "running"))).returning())[0];
+		if (!run) return void 0;
+		const lifecycle = await terminalLifecycleTx(tx, current, run, at, loopPatch, failureAutopauseStreak);
+		if (leaseTokenHash) await tx.delete(runLeases).where(eq(runLeases.runId, runId));
+		if (receipt) await tx.insert(runReportReceipts).values(receipt);
+		return {
+			run,
+			...lifecycle
+		};
+	});
+}
+/** Sweep reclaim under the same loop lock as claim/report/cancel. Running
+* reclaims terminalize their lease and write the provisional continuous cadence
+* fact atomically; pending reclaims have no lease. */
+async function reclaimRun(runId, expected, reason, at = nowIso(), graceMs = 1440 * 60 * 1e3, failureAutopauseStreak = 0) {
+	return db.transaction(async (tx) => {
+		const observed = (await tx.select({ loopId: runs.loopId }).from(runs).where(eq(runs.id, runId)).limit(1))[0];
+		if (!observed) return void 0;
+		const loop = (await tx.select().from(loops).where(eq(loops.id, observed.loopId)).for("update"))[0];
+		if (!loop) return void 0;
+		const currentRun = (await tx.select().from(runs).where(eq(runs.id, runId)).limit(1).for("update"))[0];
+		if (currentRun?.phase !== expected) return void 0;
+		if (expected === "running") await tx.update(runLeases).set({
+			state: "terminal-grace",
+			expiresAt: new Date(Date.parse(at) + graceMs).toISOString()
+		}).where(and(eq(runLeases.runId, runId), eq(runLeases.state, "active")));
+		const runIndex = await ensureRunIndexTx(tx, currentRun);
+		const reclaimed = (await tx.update(runs).set({
+			phase: "error",
+			runIndex,
+			error: reason,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.phase, expected))).returning())[0];
+		if (!reclaimed) return void 0;
+		return {
+			run: reclaimed,
+			...await terminalLifecycleTx(tx, loop, reclaimed, at, {}, failureAutopauseStreak)
+		};
+	});
+}
+/** A daemon's completed recovery snapshot is authoritative for execution
+* exclusion. Reclaimed runs absent from that snapshot retain late-report authority
+* until their original expiry, but stop blocking queued work immediately. */
+async function releaseAbsentReconciliations(machineId, recoverableRunIds, at = nowIso()) {
+	const conditions = [
+		eq(runLeases.machineId, machineId),
+		eq(runLeases.state, "terminal-grace"),
+		gt(runLeases.expiresAt, at)
+	];
+	const ids = [...new Set(recoverableRunIds)];
+	if (ids.length) conditions.push(notInArray(runLeases.runId, ids));
+	return (await db.update(runLeases).set({ state: "reconciliation-only" }).where(and(...conditions)).returning({ runId: runLeases.runId })).map((row) => row.runId);
+}
+/** Consume one terminal reconciliation lease and reconcile its reclaimed error
+* exactly once. Keeping the lease check/delete beside the run + loop writes closes the
+* error→error double-report hole where a phase CAS alone cannot distinguish the
+* first real failure from a second concurrent one. */
+async function reconcileReclaimedRun(loopId, runId, leaseTokenHash, runPatch, loopPatch = {}, failureAutopauseStreak = 0, receipt) {
+	return db.transaction(async (tx) => {
+		if (receipt) await lockReportIdTx(tx, receipt.reportId);
+		const current = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!current) return void 0;
+		if (receipt) {
+			if ((await tx.select({ id: terminalReportIncidents.id }).from(terminalReportIncidents).where(eq(terminalReportIncidents.reportId, receipt.reportId)).limit(1))[0]) return void 0;
+		}
+		const leaseNow = nowIso();
+		const lease = (await tx.select({
+			tokenHash: runLeases.tokenHash,
+			state: runLeases.state
+		}).from(runLeases).where(and(eq(runLeases.tokenHash, leaseTokenHash), eq(runLeases.runId, runId), eq(runLeases.loopId, loopId), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, leaseNow))).limit(1).for("update"))[0];
+		if (!lease) return void 0;
+		const target = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "error"))).limit(1).for("update"))[0];
+		if (!target) return void 0;
+		const runIndex = await ensureRunIndexTx(tx, target);
+		const at = typeof runPatch.ts === "string" ? runPatch.ts : nowIso();
+		const run = (await tx.update(runs).set({
+			...runPatch,
+			runIndex,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.loopId, loopId), eq(runs.phase, "error"))).returning())[0];
+		if (!run) return void 0;
+		const lifecycle = lease.state === "reconciliation-only" ? {
+			loop: current,
+			failureStreak: 0,
+			autoPaused: false
+		} : await terminalLifecycleTx(tx, current, run, at, loopPatch, failureAutopauseStreak);
+		await tx.delete(runLeases).where(eq(runLeases.runId, runId));
+		if (receipt) await tx.insert(runReportReceipts).values(receipt);
+		return {
+			run,
+			...lifecycle,
+			reportOnly: lease.state === "reconciliation-only"
+		};
+	});
+}
+var TERMINAL_REPORT_GRACE_MS = 600 * 1e3;
+/**
+* The durable run-queue write seam. It serializes on the loop row and owns every
+* queue invariant callers would otherwise have to reproduce:
+*  - at most one ordinary pending row per loop (also backed by a partial unique index),
+*  - a running run may retain one coalesced follow-up,
+*  - owner authority promotes an existing system row and never downgrades,
+*  - paused loops accept owner Run-once work while recurring system work stays stopped.
+*/
+async function enqueueRun(loopId, request) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select().from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!loop) return {
+			state: "rejected",
+			reason: "loop not found"
+		};
+		return enqueueRunTx(tx, loop, request, nowIso());
+	});
+}
+/** Materialize every due schedule fact. Each loop is locked and rechecked in its
+* own transaction; cadence and one-shot facts may coalesce into one system exec
+* and are consumed together. */
+async function advanceDueSchedules(at = nowIso(), filter = {}) {
+	const due = or(and(isNotNull(loops.nextCadenceAt), sql`${loops.nextCadenceAt} <= ${at}`), and(isNotNull(loops.nextRunAt), sql`${loops.nextRunAt} <= ${at}`));
+	const candidates = await db.select({ id: loops.id }).from(loops).where(and(eq(loops.enabled, true), isNull(loops.deleteRequestedAt), due, filter.loopId ? eq(loops.id, filter.loopId) : void 0, filter.machineId ? eq(loops.machineId, filter.machineId) : void 0));
+	const advanced = [];
+	for (const { id } of candidates) {
+		const result = await db.transaction(async (tx) => {
+			const loop = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+			if (!loop?.enabled || loop.deleteRequestedAt) return void 0;
+			const cadenceDue = !!loop.nextCadenceAt && Date.parse(loop.nextCadenceAt) <= Date.parse(at);
+			const oneShotDue = !!loop.nextRunAt && Date.parse(loop.nextRunAt) <= Date.parse(at);
+			if (!cadenceDue && !oneShotDue) return void 0;
+			if ((await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, id), eq(runLeases.state, "terminal-grace"), gt(runLeases.expiresAt, at))).limit(1))[0]) return void 0;
+			const open = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, id), inArray(runs.phase, ["pending", "running"]))).limit(1))[0];
+			const skipRecurring = cadenceDue && !!open && (loop.scheduleMode === "continuous" || loop.cronOverlap === "skip");
+			const queued = oneShotDue || !skipRecurring ? await enqueueRunTx(tx, loop, { requestedBy: "system" }, at) : void 0;
+			if (queued && !("run" in queued)) return void 0;
+			const nextCadenceAt = cadenceDue ? loop.scheduleMode === "cron" ? nextCronAt(loop.cron, loop.timezone, at) : null : loop.nextCadenceAt;
+			const updatedLoop = (await tx.update(loops).set({
+				nextCadenceAt,
+				...oneShotDue ? { nextRunAt: null } : {},
+				updatedAt: at
+			}).where(eq(loops.id, id)).returning())[0];
+			return queued ? {
+				loop: updatedLoop,
+				run: queued.run,
+				state: queued.state
+			} : {
+				loop: updatedLoop,
+				state: "skipped"
+			};
+		});
+		if (result) advanced.push(result);
+	}
+	return advanced;
+}
+/** Conservative boot initialization for pre-fact cron rows. No history lookup and
+* no missed-fire catch-up: only install the next future occurrence. */
+async function initializeCronCadence(at = nowIso()) {
+	const candidates = await db.select({ id: loops.id }).from(loops).where(and(eq(loops.enabled, true), isNull(loops.deleteRequestedAt), eq(loops.scheduleMode, "cron"), isNull(loops.nextCadenceAt)));
+	const initialized = [];
+	for (const { id } of candidates) {
+		const loop = await db.transaction(async (tx) => {
+			const current = (await tx.select().from(loops).where(eq(loops.id, id)).for("update"))[0];
+			if (!current?.enabled || current.scheduleMode !== "cron" || current.nextCadenceAt) return void 0;
+			return (await tx.update(loops).set({
+				nextCadenceAt: nextCronAt(current.cron, current.timezone, at),
+				updatedAt: at
+			}).where(eq(loops.id, id)).returning())[0];
+		});
+		if (loop) initialized.push(loop);
+	}
+	return initialized;
+}
+/** Claim one ready loop and mint its lease atomically. Repeated polls may add
+* unlimited cross-loop concurrency; the loop index remains the final same-loop
+* serialization invariant. Reported local runs exclude their loops even if the
+* server has already terminalized an older process. */
+async function claimReadyRunForMachine(machineId, at = nowIso(), excludeRunIds = []) {
+	return db.transaction(async (tx) => {
+		if (!(await tx.select({ id: machines.id }).from(machines).where(eq(machines.id, machineId)).for("update"))[0]) return void 0;
+		const excludedLoops = /* @__PURE__ */ new Set();
+		if (excludeRunIds.length) {
+			const rows = await tx.select({ loopId: runs.loopId }).from(runs).where(and(eq(runs.machineId, machineId), inArray(runs.id, [...new Set(excludeRunIds)])));
+			for (const row of rows) excludedLoops.add(row.loopId);
+		}
+		const next = (await tx.select({
+			run: runs,
+			loop: loops
+		}).from(runs).innerJoin(loops, eq(loops.id, runs.loopId)).where(and(eq(runs.machineId, machineId), eq(runs.phase, "pending"), isNull(runs.cancelRequestedAt), or(eq(loops.enabled, true), eq(runs.requestedBy, "owner")), isNull(loops.deleteRequestedAt), excludedLoops.size ? notInArray(loops.id, [...excludedLoops]) : void 0, sql`not exists (select 1 from runs occupied where occupied.loop_id = ${loops.id} and occupied.phase = 'running')`, sql`not exists (select 1 from run_leases authority where authority.loop_id = ${loops.id} and (authority.state = 'active' or (authority.state = 'terminal-grace' and authority.expires_at > ${at})))`)).orderBy(asc(runs.createdAt), asc(runs.id)).limit(1))[0];
+		if (!next) return void 0;
+		let loop = (await tx.select().from(loops).where(eq(loops.id, next.loop.id)).for("update"))[0];
+		const candidate = (await tx.select().from(runs).where(eq(runs.id, next.run.id)).limit(1).for("update"))[0];
+		if (!loop || !candidate || candidate.phase !== "pending" || candidate.cancelRequestedAt || loop.deleteRequestedAt || !loop.enabled && candidate.requestedBy !== "owner") return void 0;
+		const occupied = (await tx.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loop.id), eq(runs.phase, "running"))).limit(1))[0];
+		const authority = (await tx.select({ tokenHash: runLeases.tokenHash }).from(runLeases).where(and(eq(runLeases.loopId, loop.id), inArray(runLeases.state, ["active", "terminal-grace"]), or(eq(runLeases.state, "active"), gt(runLeases.expiresAt, at)))).limit(1))[0];
+		if (occupied || authority) return void 0;
+		const runIndex = await ensureRunIndexTx(tx, candidate);
+		const run = (await tx.update(runs).set({
+			phase: "running",
+			runIndex,
+			agent: loop.agent,
+			model: loop.model,
+			reasoningEffort: loop.reasoningEffort,
+			heartbeatAt: null,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, candidate.id), eq(runs.phase, "pending"), isNull(runs.cancelRequestedAt))).returning())[0];
+		if (!run) return void 0;
+		if (loop.scheduleMode === "continuous" && loop.nextCadenceAt != null) loop = (await tx.update(loops).set({
+			nextCadenceAt: null,
+			updatedAt: at
+		}).where(eq(loops.id, loop.id)).returning())[0];
+		const runToken = `rk_${randomBytes(16).toString("hex")}`;
+		const tokenHash = createHash("sha256").update(runToken).digest("hex");
+		await tx.insert(runLeases).values({
+			tokenHash,
+			runId: run.id,
+			loopId: loop.id,
+			machineId,
+			createdAt: at
+		});
+		return {
+			run,
+			loop,
+			runToken
+		};
+	});
+}
+async function listRuns(loopId, limit = 30) {
+	return (await db.select().from(runs).where(eq(runs.loopId, loopId)).orderBy(desc(runs.ts)).limit(limit)).reverse();
+}
+async function reconciliationStatesForRuns(loopId, runIds, at = nowIso()) {
+	if (!runIds.length) return /* @__PURE__ */ new Map();
+	const rows = await db.select({
+		runId: runLeases.runId,
+		state: runLeases.state
+	}).from(runLeases).where(and(eq(runLeases.loopId, loopId), inArray(runLeases.runId, [...new Set(runIds)]), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), gt(runLeases.expiresAt, at)));
+	return new Map(rows.map((row) => [row.runId, row.state === "terminal-grace" ? "blocking" : "report-only"]));
+}
+/** One older page: runs strictly before `beforeTs`, newest-first then capped,
+*  returned chronological (oldest-first) to match listRuns. Cursor-based (by ts,
+*  not offset) so it's stable while new runs land at the head. */
+async function listRunsBefore(loopId, beforeTs, limit = 16) {
+	return (await db.select().from(runs).where(and(eq(runs.loopId, loopId), lt(runs.ts, beforeTs))).orderBy(desc(runs.ts)).limit(limit)).reverse();
+}
+async function lastRun(loopId) {
+	return (await db.select().from(runs).where(eq(runs.loopId, loopId)).orderBy(desc(runs.ts)).limit(1))[0];
+}
+async function countRuns(loopId) {
+	const r = (await db.select({ n: sql`count(*)` }).from(runs).where(eq(runs.loopId, loopId)))[0];
+	return Number(r?.n ?? 0);
+}
+async function recentLoopUsage(loopId, since) {
+	const row = (await db.select({
+		runCount: sql`count(*)`,
+		tokenCount: sql`coalesce(sum(
+        coalesce((${runs.usage} ->> 'inputTokens')::bigint, 0) +
+        coalesce((${runs.usage} ->> 'outputTokens')::bigint, 0)
+      ), 0)`
+	}).from(runs).where(and(eq(runs.loopId, loopId), sql`${runs.ts} >= ${since}`)))[0];
+	return {
+		runCount: Number(row?.runCount ?? 0),
+		tokenCount: Number(row?.tokenCount ?? 0)
+	};
+}
+async function openRuns() {
+	return db.select().from(runs).where(inArray(runs.phase, ["pending", "running"]));
+}
+async function hasRunningRun(loopId) {
+	return !!(await db.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "running"))).limit(1))[0];
+}
+async function hasPendingRun(loopId) {
+	return !!(await db.select({ id: runs.id }).from(runs).where(and(eq(runs.loopId, loopId), eq(runs.phase, "pending"))).limit(1))[0];
+}
+/** Expire one offline system row only if the sweep snapshot is still exact and
+* its immutable lifetime remains over the cap under the loop lock. */
+async function expirePendingRun(runId, expected, at, maxLifetimeMs, message) {
+	return db.transaction(async (tx) => {
+		const observed = (await tx.select({ loopId: runs.loopId }).from(runs).where(eq(runs.id, runId)).limit(1))[0];
+		if (!observed) return false;
+		const loop = (await tx.select({ id: loops.id }).from(loops).where(eq(loops.id, observed.loopId)).for("update"))[0];
+		if (!loop) return false;
+		const current = (await tx.select().from(runs).where(and(eq(runs.id, runId), eq(runs.loopId, loop.id), eq(runs.phase, "pending"), eq(runs.requestedBy, "system"), eq(runs.requestedBy, expected.requestedBy), eq(runs.updatedAt, expected.updatedAt))).limit(1).for("update"))[0];
+		if (!current || Date.parse(at) - Date.parse(current.createdAt) <= maxLifetimeMs) return false;
+		if ((await tx.select({ online: machines.online }).from(machines).where(eq(machines.id, current.machineId)).limit(1))[0]?.online) return false;
+		const runIndex = await ensureRunIndexTx(tx, current);
+		return (await tx.update(runs).set({
+			phase: "canceled",
+			runIndex,
+			message,
+			ts: at,
+			updatedAt: at
+		}).where(and(eq(runs.id, runId), eq(runs.phase, "pending"), eq(runs.requestedBy, "system"), eq(runs.updatedAt, expected.updatedAt))).returning({ id: runs.id })).length > 0;
+	});
+}
+async function listMachines() {
+	return db.select().from(machines).orderBy(asc(machines.name), asc(machines.id));
+}
+async function listMachinesForUser(userId) {
+	return db.select().from(machines).where(eq(machines.userId, userId)).orderBy(asc(machines.name), asc(machines.id));
+}
+async function getMachine(id) {
+	return (await db.select().from(machines).where(eq(machines.id, id)))[0];
+}
+async function createMachine(input) {
+	return (await db.insert(machines).values({
+		...input,
+		createdAt: nowIso()
+	}).returning())[0];
+}
+async function updateMachine(id, patch) {
+	await db.update(machines).set(patch).where(eq(machines.id, id));
+	return getMachine(id);
+}
+/** Atomically retire all loop authority, remove server-owned machine data, revoke
+* enrollment, and delete the machine. Auth-mode callers pass `ownerUserId` so
+* ownership is rechecked under the same lock as deletion; open/server callers omit it. */
+async function forceDeleteMachine(id, ownerUserId) {
+	return db.transaction(async (tx) => {
+		const machine = (await tx.select({
+			id: machines.id,
+			userId: machines.userId
+		}).from(machines).where(eq(machines.id, id)).for("update"))[0];
+		if (!machine) return { state: "not-found" };
+		if (ownerUserId !== void 0 && machine.userId !== ownerUserId) return { state: "forbidden" };
+		const ownedLoops = await tx.select().from(loops).where(eq(loops.machineId, id)).for("update");
+		if (ownerUserId !== void 0 && ownedLoops.some((loop) => loop.userId !== ownerUserId)) return { state: "forbidden" };
+		for (const loop of ownedLoops) if (!await forceDeleteLoopTx(tx, loop.id)) throw new Error(`failed to delete loop ${loop.id}`);
+		await tx.delete(connectKeys).where(eq(connectKeys.machineId, id));
+		await tx.delete(machines).where(eq(machines.id, id));
+		return {
+			state: "deleted",
+			loopIds: ownedLoops.map((loop) => loop.id)
+		};
+	});
+}
+async function setMachineOnline(id, online) {
+	await db.update(machines).set({
+		online,
+		lastSeen: nowIso()
+	}).where(eq(machines.id, id));
+}
+async function blobExists(hash) {
+	return !!(await db.select({ hash: blobs.hash }).from(blobs).where(eq(blobs.hash, hash)))[0];
+}
+/** Verified byte lengths recorded at blob ingress, used to budget reads before
+* touching the byte store. Missing metadata is intentionally not estimated. */
+async function blobSizes(hashes) {
+	if (!hashes.length) return /* @__PURE__ */ new Map();
+	const rows = await db.select({
+		hash: blobs.hash,
+		size: blobs.size
+	}).from(blobs).where(inArray(blobs.hash, [...new Set(hashes)]));
+	return new Map(rows.map((row) => [row.hash, row.size]));
+}
+async function recordBlob(hash, size) {
+	await db.insert(blobs).values({
+		hash,
+		size,
+		createdAt: nowIso()
+	}).onConflictDoNothing();
+}
+/** Does any LIVE artifact_files row on a loop bound to `machineId` point at `hash`?
+*  Gates putBlob: a device may only upload bytes the sync handshake actually asked
+*  it for (a row a prior sync wrote for one of ITS loops), never arbitrary
+*  self-hashed blobs — otherwise any device token is an uncapped blob write channel. */
+async function machineReferencesBlob(machineId, hash) {
+	return !!(await db.select({ id: artifactFiles.id }).from(artifactFiles).innerJoin(loops, eq(artifactFiles.loopId, loops.id)).where(and(eq(loops.machineId, machineId), eq(artifactFiles.hash, hash), eq(artifactFiles.deleted, false), sql`${loops.artifacts} @> jsonb_build_array(${artifactFiles.path})`)).limit(1))[0];
+}
+async function writeConfiguredArtifactTx(tx, input, ts) {
+	await tx.insert(artifactFiles).values({
+		id: randomUUID(),
+		loopId: input.loopId,
+		path: input.path,
+		hash: input.hash,
+		size: input.size,
+		binary: input.binary,
+		oversize: input.oversize,
+		deleted: false,
+		updatedAt: ts
+	}).onConflictDoUpdate({
+		target: [artifactFiles.loopId, artifactFiles.path],
+		set: {
+			hash: input.hash,
+			size: input.size,
+			binary: input.binary,
+			oversize: input.oversize,
+			deleted: false,
+			updatedAt: ts
+		}
+	});
+}
+/** Upsert only while the exact literal path remains configured, serialized with
+* owner edits by the loop row lock. */
+async function upsertConfiguredArtifactFile(input) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select({ artifacts: loops.artifacts }).from(loops).where(eq(loops.id, input.loopId)).for("update"))[0];
+		if (!loop || !loop.artifacts.includes(input.path)) return false;
+		await writeConfiguredArtifactTx(tx, input, nowIso());
+		return true;
+	});
+}
+/** Reconcile deletions against both the request's starting allowlist and the
+* current locked loop config. Newly-added paths are never tombstoned by an older
+* in-flight manifest; removed paths can never remain live. */
+async function reconcileConfiguredArtifacts(loopId, configuredAtStart, keepPaths) {
+	return db.transaction(async (tx) => {
+		const loop = (await tx.select({ artifacts: loops.artifacts }).from(loops).where(eq(loops.id, loopId)).for("update"))[0];
+		if (!loop) return 0;
+		const current = new Set(loop.artifacts);
+		const started = new Set(configuredAtStart);
+		const keep = new Set(keepPaths);
+		const stale = (await tx.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.deleted, false)))).filter((file) => !current.has(file.path) || started.has(file.path) && !keep.has(file.path));
+		if (!stale.length) return 0;
+		const at = nowIso();
+		await tx.update(artifactFiles).set({
+			hash: null,
+			deleted: true,
+			updatedAt: at
+		}).where(inArray(artifactFiles.id, stale.map((file) => file.id)));
+		return stale.length;
+	});
+}
+async function listArtifacts(loopId) {
+	return db.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.deleted, false))).orderBy(artifactFiles.path);
+}
+async function getArtifactFile(loopId, path) {
+	return (await db.select().from(artifactFiles).where(and(eq(artifactFiles.loopId, loopId), eq(artifactFiles.path, path))))[0];
+}
+async function buildLoopManifest(loopId) {
+	const manifest = {};
+	for (const f of await listArtifacts(loopId)) manifest[f.path] = {
+		hash: f.hash,
+		size: f.size,
+		binary: f.binary,
+		oversize: f.oversize
+	};
+	return manifest;
+}
+/** Write/overwrite a run's snapshot (path → file metadata). Idempotent on runId
+*  so a re-report of the same run just refreshes the captured artifact state. */
+async function putRunSnapshot(runId, loopId, manifest) {
+	await db.insert(runSnapshots).values({
+		runId,
+		loopId,
+		manifest,
+		createdAt: nowIso()
+	}).onConflictDoUpdate({
+		target: runSnapshots.runId,
+		set: {
+			loopId,
+			manifest,
+			createdAt: nowIso()
+		}
+	});
+}
+async function getRunSnapshot(runId) {
+	return (await db.select().from(runSnapshots).where(eq(runSnapshots.runId, runId)))[0];
+}
+/** The most recent indexed snapshot before one run. History order, not a
+* timestamp tie, is the diff baseline. */
+async function prevRunSnapshot(loopId, beforeRunIndex) {
+	return (await db.select({ snap: runSnapshots }).from(runSnapshots).innerJoin(runs, eq(runSnapshots.runId, runs.id)).where(and(eq(runSnapshots.loopId, loopId), isNotNull(runs.runIndex), lt(runs.runIndex, beforeRunIndex))).orderBy(desc(runs.runIndex)).limit(1))[0]?.snap;
+}
+/**
+* Prune a loop's run snapshots down to the `keep` most recent (by createdAt),
+* deleting the rest. Returns the number deleted. This is what makes an old
+* snapshot's now-unreferenced blobs collectable by the blob GC. `keep <= 0`
+* means "keep none" (still bounded). Safe to call repeatedly (idempotent once
+* at/under the window).
+*/
+async function pruneRunSnapshots(loopId, keep) {
+	const survivors = keep > 0 ? (await db.select({ runId: runSnapshots.runId }).from(runSnapshots).where(eq(runSnapshots.loopId, loopId)).orderBy(desc(runSnapshots.createdAt), desc(runSnapshots.runId)).limit(keep)).map((r) => r.runId) : [];
+	const pred = survivors.length ? and(eq(runSnapshots.loopId, loopId), notInArray(runSnapshots.runId, survivors)) : eq(runSnapshots.loopId, loopId);
+	return (await db.delete(runSnapshots).where(pred).returning({ id: runSnapshots.runId })).length;
+}
+async function loopIdsWithSnapshots() {
+	return (await db.selectDistinct({ loopId: runSnapshots.loopId }).from(runSnapshots)).map((r) => r.loopId);
+}
+/**
+* The full set of blob hashes still referenced by a LIVE row — the GC's keep
+* set. A hash is live if ANY artifact_files row points at it (deleted tombstones
+* carry hash=null, so they don't pin a blob) OR ANY retained run_snapshot's
+* manifest references it. Computed in one pass so the GC never deletes a blob a
+* snapshot still needs for its diff.
+*/
+async function liveBlobRefs() {
+	const refs = /* @__PURE__ */ new Set();
+	for (const r of await db.selectDistinct({ hash: artifactFiles.hash }).from(artifactFiles).where(isNotNull(artifactFiles.hash))) if (r.hash) refs.add(r.hash);
+	for (const r of await db.select({ manifest: runSnapshots.manifest }).from(runSnapshots)) for (const entry of Object.values(r.manifest)) if (entry?.hash) refs.add(entry.hash);
+	return refs;
+}
+/** Blob hashes whose metadata row predates `cutoffIso` (GC candidates — the grace
+*  window excludes freshly-written blobs a concurrent sync may be referencing). */
+async function blobHashesOlderThan(cutoffIso) {
+	return (await db.select({ hash: blobs.hash }).from(blobs).where(lt(blobs.createdAt, cutoffIso))).map((r) => r.hash);
+}
+/** Delete a blob's metadata row (the bytes are reclaimed separately via the
+*  BlobStore). Idempotent. */
+async function deleteBlob(hash) {
+	await db.delete(blobs).where(eq(blobs.hash, hash));
+}
+/** Indexed point check: does any LIVE artifact_files row still point at this hash?
+*  The GC's cheap, always-fresh per-candidate guard (the common re-reference path) —
+*  uses the artifact_files_hash index, so it stays O(1) even as candidates pile up. */
+async function artifactFileReferencesHash(hash) {
+	return !!(await db.select({ id: artifactFiles.id }).from(artifactFiles).where(eq(artifactFiles.hash, hash)))[0];
+}
+/** Every blob hash referenced by ANY retained run_snapshot's manifest — the full
+*  snapshot scan deserialized ONCE into a Set so the GC can answer per-candidate
+*  snapshot membership in O(1) instead of re-scanning the whole table per garbage
+*  hash. The GC rebuilds this only when the snapshot row count changes (a report()
+*  raced the pass), so a snapshot that comes to reference a hash mid-pass is still
+*  caught — closing the GC-check-time gap where a snapshot references a hash no live
+*  file row does — without paying O(garbage × snapshots). */
+async function snapshotBlobRefs() {
+	const refs = /* @__PURE__ */ new Set();
+	for (const r of await db.select({ manifest: runSnapshots.manifest }).from(runSnapshots)) for (const entry of Object.values(r.manifest)) if (entry?.hash) refs.add(entry.hash);
+	return refs;
+}
+/** Count of retained run_snapshot rows — the GC's cheap change-detector for deciding
+*  whether to rebuild its precomputed snapshotBlobRefs() set mid-pass. */
+async function countRunSnapshots() {
+	const r = (await db.select({ n: sql`count(*)` }).from(runSnapshots))[0];
+	return Number(r?.n ?? 0);
+}
+/** Per-file byte cap. At or under ⇒ bytes sync; over ⇒ metadata-only (no bytes). */
+var BLOB_CAP = 10 * 1024 * 1024;
+/** Hard ceiling on the exact-manifest sync POST body. */
+var SYNC_BODY_CAP = 32 * 1024 * 1024;
+var SYNC_FIELDS = new Set(["loopId", "manifest"]);
+var MANIFEST_FIELDS = new Set([
+	"path",
+	"hash",
+	"size",
+	"binary",
+	"oversize"
+]);
+var MAX_STORED_SIZE = 2147483647;
+function exactRecord(value, fields) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return false;
+	const keys = Object.keys(value);
+	return keys.length === fields.size && keys.every((key) => fields.has(key));
+}
+function sha256Buf(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function isValidHash(hash) {
+	return typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash);
+}
+/**
+* Validate and preserve an untrusted, loop-folder-relative literal path. Returns
+* null if it is absolute, contains an empty/dot/traversal segment, is empty, or
+* carries a NUL (no real filesystem produces one, and Postgres rejects it).
+*/
+function safeRelPath(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.includes("\0")) return null;
+	if (raw.startsWith("/") || raw.startsWith("\\") || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+	if (raw.split(/[\\/]/).some((part) => part === "" || part === "." || part === "..")) return null;
+	return raw;
+}
+/** Parse the one canonical sync envelope without coercion or omitted-field defaults. */
+function parseArtifactSyncBody(value) {
+	if (!exactRecord(value, SYNC_FIELDS)) return null;
+	const { loopId, manifest } = value;
+	if (typeof loopId !== "string" || loopId.length === 0 || loopId.length > 200 || loopId.includes("\0") || !Array.isArray(manifest)) return null;
+	const entries = [];
+	const paths = /* @__PURE__ */ new Set();
+	for (const raw of manifest) {
+		if (!exactRecord(raw, MANIFEST_FIELDS)) return null;
+		const { path, hash, size, binary, oversize } = raw;
+		const rel = safeRelPath(path);
+		if (rel === null || paths.has(rel) || typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > MAX_STORED_SIZE || typeof binary !== "boolean" || typeof oversize !== "boolean") return null;
+		if (oversize) {
+			if (size <= 10485760 || hash !== null) return null;
+			entries.push({
+				path: rel,
+				hash: null,
+				size,
+				binary,
+				oversize: true
+			});
+		} else {
+			if (size > 10485760 || !isValidHash(hash)) return null;
+			entries.push({
+				path: rel,
+				hash,
+				size,
+				binary,
+				oversize: false
+			});
+		}
+		paths.add(rel);
+	}
+	return {
+		loopId,
+		manifest: entries
+	};
+}
+/**
+* Machine + run credential helpers. Device tokens (`dk_…`) identify a machine
+* (its id is derived from the token: `m-sha256(token)[:16]`). A run
+* LEASE (`rk_…`) is minted per delivery, bound to one run, and carries the
+* run's least-privilege caps — the CLI dispatch authorizes the `pievo` shim
+* against it. Its lifecycle is a small state machine (`active` →
+* `terminal-grace` → `reconciliation-only`/`retired`), not a mint→revoke pair;
+* see `RunLease` below.
+*
+* Leases and connect-key bindings are DURABLE (run_leases / connect_keys
+* tables): they must survive a deploy, or every restart 401s the in-flight
+* runs' callbacks/finalize and prevents a freshly connected machine from
+* enrolling under its owner. The 15-minute `new` idempotency window stays in-process;
+* losing it only degrades retry deduplication, never persisted data.
+*/
+function sha256(s) {
+	return createHash("sha256").update(s).digest("hex");
+}
+function mintDeviceToken() {
+	return `dk_${randomBytes(15).toString("hex")}`;
+}
+function machineIdFromToken(token) {
+	return `m-${sha256(token).slice(0, 16)}`;
+}
+/**
+* Whether a string has the one current device-token wire shape. This malformed-input
+* filter runs before enrollment lookup; the connect-key gate remains the auth boundary.
+*/
+var DEVICE_TOKEN_RE = /^dk_[0-9a-f]{30}$/;
+function isDeviceTokenShape(token) {
+	return DEVICE_TOKEN_RE.test(token);
+}
+/** Keep bindings long enough for a leisurely paste, then drop (bounded table). */
+var CONNECT_KEY_TTL_MS = 1440 * 60 * 1e3;
+function connectKeyFresh(mintedAt, now) {
+	return now - Date.parse(mintedAt) <= CONNECT_KEY_TTL_MS;
+}
+/** Bind a freshly minted connect key to its owner and prune expired rows. */
+async function rememberConnectKey(connectKey, binding) {
+	const now = /* @__PURE__ */ new Date();
+	await db.delete(connectKeys).where(lt(connectKeys.mintedAt, (/* @__PURE__ */ new Date(now.getTime() - CONNECT_KEY_TTL_MS)).toISOString()));
+	const row = {
+		machineId: machineIdFromToken(connectKey),
+		userId: binding.userId,
+		mintedAt: now.toISOString()
+	};
+	await db.insert(connectKeys).values(row).onConflictDoUpdate({
+		target: connectKeys.machineId,
+		set: row
+	});
+}
+async function readConnectKeyBinding(connectKey, now = Date.now()) {
+	if (!connectKey) return void 0;
+	const row = (await db.select().from(connectKeys).where(eq(connectKeys.machineId, machineIdFromToken(connectKey))))[0];
+	if (!row || !connectKeyFresh(row.mintedAt, now)) return void 0;
+	return { userId: row.userId };
+}
+/** How long a terminal-grace lease stays alive to accept one late wake-report.
+*  A laptop can sleep overnight or across a weekend before the daemon resumes. */
+var TERMINAL_GRACE_MS = 1440 * 60 * 1e3;
+/** Leases live in the `run_leases` table, keyed by sha256(full `rk_…` wire
+* token), so a deploy is invisible to an in-flight run and a DB leak never hands
+* out live credentials. In rows, `expiresAt` null encodes `Infinity`. */
+function leaseFromRow(row) {
+	return {
+		runId: row.runId,
+		loopId: row.loopId,
+		machineId: row.machineId,
+		state: row.state,
+		expiresAt: row.expiresAt == null ? Number.POSITIVE_INFINITY : Date.parse(row.expiresAt)
+	};
+}
+/** Mint a fresh run lease and return its wire token (`rk_…`, so the unified CLI
+*  dispatch can tell a run credential from a device `dk_…` in O(1) before any
+*  lookup). Starts `active` with no expiry. */
+var RUN_TOKEN_RE = /^rk_[0-9a-f]{32}$/;
+function isRunTokenShape(token) {
+	return RUN_TOKEN_RE.test(token);
+}
+/** Resolve a run lease. An elapsed reconciliation window is atomically reduced
+* to durable, non-authorizing retired evidence rather than deleted. */
+async function resolveLease(token, now = Date.now()) {
+	if (!isRunTokenShape(token)) return void 0;
+	const tokenHash = sha256(token);
+	let row = (await db.select().from(runLeases).where(eq(runLeases.tokenHash, tokenHash)))[0];
+	if (!row) return void 0;
+	if ((row.state === "terminal-grace" || row.state === "reconciliation-only") && row.expiresAt != null && now > Date.parse(row.expiresAt)) {
+		row = (await db.update(runLeases).set({
+			state: "retired",
+			expiresAt: null
+		}).where(and(eq(runLeases.tokenHash, tokenHash), inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), isNotNull(runLeases.expiresAt), lt(runLeases.expiresAt, new Date(now).toISOString()))).returning())[0] ?? (await db.select().from(runLeases).where(eq(runLeases.tokenHash, tokenHash)))[0];
+		if (!row) return void 0;
+	}
+	return leaseFromRow(row);
+}
+/** Retire a lease outside a terminal write transaction (canceled/losing report
+* cleanup and expiry paths). Normal finalize and reclaimed-run
+* reconcile consume the row inside their store transaction so run+loop+lease are
+* one single-shot commit. */
+async function retireLease(token) {
+	await db.delete(runLeases).where(eq(runLeases.tokenHash, sha256(token)));
+}
+/** State-aware lease maintenance. Expired reconciliation authority becomes a
+* durable retired tombstone. Active and already-retired rows are never age-pruned. */
+async function pruneExpiredLeases(now = Date.now()) {
+	await db.update(runLeases).set({
+		state: "retired",
+		expiresAt: null
+	}).where(and(inArray(runLeases.state, ["terminal-grace", "reconciliation-only"]), isNotNull(runLeases.expiresAt), lt(runLeases.expiresAt, new Date(now).toISOString())));
+}
+var newIdempotency = /* @__PURE__ */ new Map();
+function pruneNewIdempotency(now) {
+	for (const [key, rec] of newIdempotency) if (now - rec.at > 9e5) newIdempotency.delete(key);
+}
+function recordNewIdempotency(key, machineId, loopId, now = Date.now()) {
+	pruneNewIdempotency(now);
+	newIdempotency.set(key, {
+		loopId,
+		machineId,
+		at: now
+	});
+}
+/** The loop a still-live key already created for THIS machine, or undefined (a miss,
+*  an expired key — dropped here — or a cross-machine record). NON-evicting on a hit:
+*  a genuine retry may arrive more than once within the window. */
+function readNewIdempotency(key, machineId, now = Date.now()) {
+	const rec = newIdempotency.get(key);
+	if (!rec) return void 0;
+	if (now - rec.at > 9e5) {
+		newIdempotency.delete(key);
+		return;
+	}
+	if (rec.machineId !== machineId) return void 0;
+	return rec.loopId;
+}
+/**
+* Derive a machine's presence from its stored `online` flag + `lastSeen` stamp.
+* `online` requires BOTH the flag and a fresh stamp (the stored flag lags the
+* sweep by up to one interval); everything else keys off how stale `lastSeen` is.
+*/
+function machinePresence(online, lastSeen, now = Date.now()) {
+	const seenAt = lastSeen ? Date.parse(lastSeen) : NaN;
+	if (!Number.isFinite(seenAt)) return "offline";
+	const age = now - seenAt;
+	if (!!online && age < 3e4) return "online";
+	if (age < 216e5) return "asleep";
+	return "offline";
+}
+/**
+* Tiny semver comparison — just enough to decide "is the daemon older than the
+* latest published version?" for the web's update hint. No dependency; we only
+* need numeric-core ordering (major.minor.patch), and a pre-release is treated
+* as older than its release (a "0.9.0-rc.1" daemon is still behind "0.9.0").
+*/
+/** Strict SemVer validation for security/protocol gates. Unlike the update-hint
+* comparison below, this accepts no whitespace, `v` prefix, partial core, or
+* trailing garbage. */
+function isValidSemver(value) {
+	const plus = value.split("+");
+	if (plus.length > 2) return false;
+	const [versionAndPre, build] = plus;
+	if (build !== void 0 && !validIdentifiers(build, false)) return false;
+	const dash = versionAndPre.indexOf("-");
+	const numeric = dash < 0 ? versionAndPre : versionAndPre.slice(0, dash);
+	const pre = dash < 0 ? void 0 : versionAndPre.slice(dash + 1);
+	if (!/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(numeric)) return false;
+	return pre === void 0 || validIdentifiers(pre, true);
+}
+function validIdentifiers(value, rejectNumericLeadingZero) {
+	if (!value) return false;
+	return value.split(".").every((identifier) => {
+		if (!/^[0-9A-Za-z-]+$/.test(identifier)) return false;
+		return !rejectNumericLeadingZero || !/^\d+$/.test(identifier) || identifier === "0" || !identifier.startsWith("0");
+	});
+}
+function core(v) {
+	const m = /^\s*v?(\d+)\.(\d+)\.(\d+)/.exec(v);
+	if (!m) return null;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
+}
+function isPre(v) {
+	return /^\s*v?\d+\.\d+\.\d+-/.test(v);
+}
+/**
+* `true` when `current` is strictly older than `latest`. Returns `false` on any
+* unparseable/equal/newer input — the hint is opt-in, so we only ever show it
+* when we can be confident the daemon is genuinely behind.
+*/
+function isOutdated(current, latest) {
+	if (!current || !latest) return false;
+	const a = core(current);
+	const b = core(latest);
+	if (!a || !b) return false;
+	for (let i = 0; i < 3; i++) {
+		const ai = a[i];
+		const bi = b[i];
+		if (ai < bi) return true;
+		if (ai > bi) return false;
+	}
+	return isPre(current) && !isPre(latest);
+}
+var reserved = new Set(RESERVED_LOOP_TAGS);
+function normalizeLoopTag(value) {
+	return value.normalize("NFKC").trim().replace(/\s+/gu, " ").toLocaleLowerCase("en-US");
+}
+function validateLoopTags(value) {
+	if (value === void 0) return {
+		ok: true,
+		value: []
+	};
+	if (!Array.isArray(value)) return {
+		ok: false,
+		detail: "tags must be an array of strings"
+	};
+	if (value.length > 4) return {
+		ok: false,
+		detail: `tags must contain at most 4 values`
+	};
+	const tags = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of value) {
+		if (typeof entry !== "string") return {
+			ok: false,
+			detail: "tags must contain only strings"
+		};
+		if (/\p{Cc}|\p{Cf}|\p{Default_Ignorable_Code_Point}/u.test(entry)) return {
+			ok: false,
+			detail: "tags must not contain control or invisible characters"
+		};
+		const tag = normalizeLoopTag(entry);
+		if (!tag) return {
+			ok: false,
+			detail: "tags must not contain empty values"
+		};
+		if ([...tag].length > 64) return {
+			ok: false,
+			detail: `each tag must contain at most 64 characters`
+		};
+		if (reserved.has(tag)) return {
+			ok: false,
+			detail: `reserved tag: ${tag}`
+		};
+		if (seen.has(tag)) return {
+			ok: false,
+			detail: `duplicate tag: ${tag}`
+		};
+		seen.add(tag);
+		tags.push(tag);
+	}
+	return {
+		ok: true,
+		value: [...tags].sort()
+	};
+}
+//#endregion
+export { getLoop as $, reclaimRun as $t, createLoop as A, updateLoop as An, logger as At, enqueueRun as B, parseArtifactSyncBody as Bt, claimReadyRunForMachine as C, sha256Buf as Cn, listLoops as Ct, countRuns as D, stopLoop as Dn, listRuns as Dt, countRunSnapshots as E, startLoop as En, listMachinesForUser as Et, dbWatchdogFailureThreshold as F, machinePresence as Ft, forceDeleteMachine as G, pruneRunSnapshots as Gt, expirePendingRun as H, pauseLoopState as Ht, dbWatchdogIntervalMs as I, machineReferencesBlob as It, getBaseURL as J, putTerminalReportIncidentIfAbsent as Jt, gcIntervalMs as K, putReportReceiptIfAbsent as Kt, dbWatchdogTimeoutMs as L, mintDeviceToken as Lt, dataDir as M, upsertConfiguredArtifactFile as Mn, loopIdsWithSnapshots as Mt, db as N, validateLoopTags as Nn, loopsForMachine as Nt, createDefu as O, toKebabCase as On, listRunsBefore as Ot, dbWatchdogEnabled as P, wildcardMatch as Pn, machineIdFromToken as Pt, getHost as Q, recentLoopUsage as Qt, defu as R, normalizePathname as Rt, capitalizeFirstLetter as S, sha256 as Sn, listArtifacts as St, coerceCodingAgent as T, snapshotRetention as Tn, listMachines as Tt, finalizeRunningRun as U, prevRunSnapshot as Ut, env as V, pauseLoop as Vt, forceDeleteLoop as W, pruneExpiredLeases as Wt, getEnvVar as X, readConnectKeyBinding as Xt, getBooleanEnvVar as Y, r2Config as Yt, getExactTerminalReportIncident as Z, readNewIdempotency as Zt, blobExists as _, runningRunForLoop as _n, isTest as _t, BetterAuthError as a, recordRunReportOnce as an, getRunSnapshot as at, blobSizes as b, safeRelPath as bn, kAPIErrorHeaderSymbol as bt, ENV as c, releaseAbsentReconciliations as cn, hasRunningRun as ct, ValidationError$1 as d, requestDeleteLoop as dn, isDeviceTokenShape as dt, reconcileConfiguredArtifacts as en, getMachine as et, acknowledgeRetiredReport as f, requestRunCancel as fn, isDynamicBaseURLConfig as ft, betterFetch as g, runMigrations as gn, isSafeUrlScheme as gt, artifactFileReferencesHash as h, retireLease as hn, isRequestLike as ht, BLOB_CAP as i, recordNewIdempotency as in, getRun as it, createMachine as j, updateMachine as jn, loginGateEnabled as jt, createFetch as k, tryDeleteLoop as kn, liveBlobRefs as kt, SYNC_BODY_CAP as l, rememberConnectKey as ln, initializeCronCadence as lt, advanceDueSchedules as m, resolveLease as mn, isProduction as mt, APIError$1 as n, reconciliationStatesForRuns as nn, getProtocol as nt, BetterCallError as o, refreshRunHeartbeats as on, getTerminalReportIncidents as ot, acknowledgeRetiredTerminalIncident as p, resolveBaseURL as pn, isOutdated as pt, getArtifactFile as q, putRunSnapshot as qt, BASE_ERROR_CODES as r, recordBlob as rn, getReportReceipt as rt, CODING_AGENTS as s, rejectTerminalReport as sn, hasPendingRun as st, APIError as t, reconcileReclaimedRun as tn, getOrigin as tt, TERMINAL_GRACE_MS as u, repairTerminalRunLeases as un, isDevelopment as ut, blobGcGraceMs as v, runningRunsForMachine as vn, isValidHash as vt, closeClient as w, snapshotBlobRefs as wn, listLoopsForUser as wt, buildLoopManifest as x, setMachineOnline as xn, lastRun as xt, blobHashesOlderThan as y, runs as yn, isValidSemver as yt, deleteBlob as z, openRuns as zt };